{% extends "base.html" %}
{% block my_first_block %}
<h1>Press F12 to open the console before proceeding</h1>
  <p>Input number of trustees (4 by default)</p>
  <input type="text" id="field1" name="trustees">
  <input type="submit" id="to_press" value="Generate keys">
  <br>
  <p>Input number of voters (4 by default)</p>
  <input type="text" id="field2" name="voters" disabled=True>
  <input type="submit" id="to_press2" disabled=True value="Send the votes">
  <br>
  <input type="submit" id="to_press3" disabled=True value="Compute decryption factors">
  <br>
  <input type="submit" id="to_press4" disabled=True value="Get results">
  <br>
  <input type="submit" id="again" disabled=True value="Try again?">
  <p id="feed"></p>
  <p id="feed2"></p>
  <p id="feed3"></p>
  <p id="feed4"></p>
{% endblock %}
{% block script_block %}
<script>
    LargeInteger = verificatum.arithm.LargeInteger;
    hash = verificatum.crypto.sha256.hash; 
    time = verificatum.util.time_ms;
    
    var randomSource = new verificatum.crypto.RandomDevice();
    var ZERO = LargeInteger.ZERO;
    var ONE = LargeInteger.ONE;
    var TWO = new LargeInteger("2");
    var THREE = new LargeInteger("3");
    var FOUR = new LargeInteger("4");
    var SIX = new LargeInteger("6");
    var EIGHT = new LargeInteger("8");
    
    var election = {{ election|safe }};
    
    var p_raw = election.public_key.p;
    var r_raw = election.public_key.r;
    var g1_raw = election.public_key.g1;
    var h1_raw = election.public_key.h1;
    var h2_raw = election.public_key.h2;
    var p = new LargeInteger(p_raw);
    var r = new LargeInteger(r_raw);
    var g1 = EFp_fromHexString(g1_raw);
    var g2;
    var h1 = EFp2_fromHexString(h1_raw);
    var h2 = EFp2_fromHexString(h2_raw);
    
    var table_g1 = election.tables.g1;
    var table_h1 = election.tables.h1;
    var table_h2 = election.tables.h2;
    var tbl_g1 = load_table(table_g1);
    var tbl_g2;
    var tbl_h1 = load_table(table_h1);
    var tbl_h2 = load_table(table_h2);
    
    var uuid = election.uuid;
    var gamma = [null, null, null, null, null, null, null, null, p, r, TWO, [ONE.neg().mod(p), ONE]];
    var root = window.location.href;
    root = root.slice(0, root.lastIndexOf("/"));
    root = root.slice(0, root.lastIndexOf("/"));
    var pk=[];
    var sk=[];
    var zkp=[];
    var keyHolders = 4;
    var voters = 4;
    var confirmations = 0;
    var election;
    var globalStr_toHash0 = compute_hashing_string(election);
    var globalStr_toHash;
    
    /*
    Simulate *keyHolders* trustees and generate a private subkey pair for each
    Send the subkeys to the server which computes the elections public key
    */
    $(document).ready(function(){
        $("#to_press").click(function(){
            keyHolders = parseInt($("#field1").val()); //Get number of trustees as input from browser
            if(isNaN(keyHolders)){
                // Branch taken in case no input was provided
                console.log("Invalid input, setting trustees number to 4"); 
                keyHolders = 4;
            }
            // Disable the button
            $(to_press).attr("disabled",true);
            $(field1).attr("disabled",true);
            console.log("");
            
            //For each trustee generate pubk and sk
            var key_time=0;
            for(i=0;i<keyHolders;i++){
                var start = time();
                //Generate secret and public subkey
                sk[i] = new LargeInteger(r.length*28,randomSource); //r.length gives the number of 28-bit pieces in the Verificatum writing of the big integer
                sk[i] = sk[i].mod(r); //make modular reduction to make sure the key is in Zr (this operation is performed multiple times throughout the code when a random number must be picked)
                pk[i] = EFp_scalarMultOptim(sk[i], gamma, tbl_g1); //compute the public key

                //Generate ZKP 
                var w = new LargeInteger(r.length*28,randomSource);
                w = w.mod(r);
                var s = EFp_scalarMultOptim(w, gamma, tbl_g1);
                var string_to_hash = "partialPublicKey,"+EFp_toHexString(pk[i], 1)+",commitment,"+EFp_toHexString(s, 1)+","+globalStr_toHash0;
                var hashed_challenge = hash(toUTF8Array(string_to_hash));
                var e = new LargeInteger(hashed_challenge);
                e = e.mod(r);
                var f = w.modAdd(sk[i].modMul(e,r),r);
                zkp[i] = {
                    'A' : EFp_toHexString(s),
                    'e' : e.toHexString(),
                    'f' : f.toHexString()
                }
                var stop = time();
                key_time+=(stop-start);
                //Send the public subkey and its generation ZKP to the server with asynchronous POST to make sure all the subkeys were received before performing the key addition (see next GET request)
                var req = $.ajax( {method: "POST",
                                url: "/crypto/ppats" ,
                                data:  {'uuid' : uuid,
                                        'keyHolder' : i,
                                        'pubk' : JSON.stringify(EFp_toHexString(pk[i])),
                                        'zkp' : JSON.stringify(zkp[i])} ,
                                async: false, 
                        });
                req.done(function(data, status){
                    console.log(data);
                });
            }
            // Once all the subkeys were sent ask the server to compute the public key 
            $("#feed").text("The mean key generation time is: "+(key_time/(keyHolders)).toFixed(2)+"ms");
            var keyReq = $.ajax( {method: "GET",
                                    url: "/crypto/ppats?uuid="+uuid ,
                                    async: false,
                                });
            keyReq.done(function(data, status){
                //Update the election parameters with the overall public key
                console.log("Public key received");
                election = JSON.parse(data);
                globalStr_toHash = compute_hashing_string(election);
                g2 = EFp_fromHexString(election['public_key']['g2']);
                tbl_g2 = load_table(election['tables']['g2']);                
            });
            // Unlock the next step
            $(field2).attr("disabled",false);
            $(to_press2).attr("disabled",false);
        });
    });
    
    /*
    This is the ballot encryption process (See click_function)
    */
    $(document).ready(function(){
        $("#to_press2").click(click_function);
    });
    
    /*
    Compute the decryption factor from the c1 of the homomorphic total ballot and send it to the server for each trustee
    */
    $(document).ready(function(){
        $("#to_press3").click(function(){
            // Freeze the decryption factor button
            $(to_press3).attr("disabled",true);
            // Ask for the final ballot for each candidate. Asynchronous is false in order not to unfreeze the Get results button before the decryption factors were computed 
            var cipherReq = $.ajax( {method: "GET",
                                    url: "/crypto/ppats?uuid="+uuid+"&final=True" ,
                                    async: false,
                                });
            cipherReq.done(function(data, status){
                ballot = JSON.parse(data);
                console.log("");
                var Aux=[]; // Holds the c1 of each candidate ballot 
                var decF; // Auxiliary variable
                
                // Each trustee performs c1^sk[i] with their own sk[i] on each candidate ballot
                var dec_time=0;
                for(counter=0;counter<keyHolders;counter++){
                    var alpha = []; // Array that will contain the decryption factors of one trustee for each candidate ballot
                    var zkp = []; // Array that will contain the ZKPs of each decryption factor 
                    
                    var start = time();
                    for(answerNb=0;answerNb<ballot.length;answerNb++){
                        if(counter==0){
                            // Only perform the parsing once (since it's the same for all the trustees)
                            Aux[answerNb] = EFp_fromHexString(ballot[answerNb]["c1"]);
                        }
                        
                        // Compute decryption factor
                        decF = EFp_scalarMult(Aux[answerNb], sk[counter], gamma);
                        alpha[answerNb] = EFp_toHexString(decF);
                        
                        // Compute zero knowledge proof
                        var w = new LargeInteger(r.length*28,randomSource);
                        w = w.mod(r);
                        var A = EFp_scalarMultOptim(w, gamma, tbl_g1);
                        var B = EFp_scalarMult(Aux[answerNb], w, gamma);
                        string_to_hash = "decryptionFactor,"+EFp_toHexString(decF, 1)+",commitmentA,"+EFp_toHexString(A, 1)+",commitmentB,"+EFp_toHexString(B, 1)+","+globalStr_toHash;
                        var hashed_challenge = verificatum.crypto.sha256.hash(toUTF8Array(string_to_hash));
                        var e = new verificatum.arithm.LargeInteger(hashed_challenge);
                        e = e.mod(r);
                        var f = w.modAdd(sk[counter].modMul(e,r),r);
                        
                        zkp.push({
                            'commitment':{
                                'A' : EFp_toHexString(A),
                                'B' : EFp_toHexString(B)
                            },
                            'challenge' : e.toHexString(),
                            'response' : f.toHexString()
                        })
                    }
                    var stop = time();
                    dec_time+=(stop-start);
                    // Trustee sends the decryption factors for each candidate in *alpha* and respective ZKPs in *zkp* 
                    var finalPost = $.ajax( {method: "POST",
                                            url: "/crypto/ppats" ,
                                            data:  {'uuid' : uuid,
                                                    'keyHolder' : counter,
                                                    'alpha' : JSON.stringify(alpha),
                                                    'zkp' : JSON.stringify(zkp)} ,
                                            async: false,
                                    });
                    finalPost.done(function(data, status){
                        console.log(data);
                    });
                }
                $("#feed3").text("The mean decryption factor computation time is: "+(dec_time/(keyHolders)).toFixed(2)+"ms");
            });
            // Unlock the next step
            $(to_press4).attr("disabled",false);
        });
    });
    
    /*
    Ask the server for the results of the election and receive them as an array
    */
    $(document).ready(function(){
        $("#to_press4").click(function(){
            // Freeze the result button
            $(to_press4).attr("disabled",true);
            var computeReq = $.ajax( {method: "GET",
                                    url: "/crypto/ppats?uuid="+uuid+"&compute=True" ,
                                    async: false,
                                });
            computeReq.done(function(data, status){
                answers = election["questions"][0]["answers"];
                console.log("");
                console.log("RESULTS")
                for(t=0;t<answers.length;t++){
                    votes=JSON.parse(data);
                    console.log(answers[t]["prenom"]+","+answers[t]["nom"]+": "+votes[t]);
                }
            });
            // Unlock the Try Again button
            $(again).attr("disabled",false);
        });
    });
    
    /*
    Reloads the page
    */
    $(document).ready(function(){
        $("#again").click(function(){
			window.location.href = root+"/crypto/ppats";
		});
    });
    
    /*
    Simulate *voters* voters and for each one of them encrypt a random vote and generate the corresponding ZKPs
    */
    function click_function(){
        // Freeze the voting button
        $(field2).attr("disabled",true);
        $(to_press2).attr("disabled",true);
        console.log("");
        
        // Fetch number of simulated voters, set to 4 if not input was given
        voters = parseInt($("#field2").val());
            if(isNaN(voters)){
                console.log("Invalid input, setting voters number to 4");
                voters = 4;
            }
            
        // For each voter perform encryption
        var mean_enc_time = 0;
        var mean_dis_time = 0;
        var mean_conj_time = 0;
        for(ha=0;ha<voters;ha++){
            // Generate random vote
            var vote = Math.floor(Math.random()*election["questions"][0]["answers"].length).toString();
            console.log("Voter number "+ha+" voted for: "+vote);
            
            // Generate ballot and proofs and send them to server (see encrypt_and_send function)
            times=encrypt_and_send([vote]);
            mean_enc_time+=times[0];
            mean_dis_time+=times[1];
            mean_conj_time+=times[2];
            console.log("");
        }
        $("#feed2").text("The mean encryption time is: "+(mean_enc_time/(voters)).toFixed(2)+"ms, "+"The mean disjunctive proof time is: "+(mean_dis_time/(voters)).toFixed(2)+"ms, "+"The mean conjunctive proof time is: "+(mean_conj_time/(voters)).toFixed(2)+"ms. The total time is: "+(mean_enc_time+mean_dis_time+mean_conj_time)/(voters));
        // Check every half second if all the votes have been received
        var intervalCheck = setInterval(function(){
            // confirmations is a global variable incremented everytime a voter has submitted a valid ballot. The loop ends when everyone has sent a good ballot. This function is only important for the simulation 
            if(confirmations==voters){
                clearInterval(intervalCheck);
                $(to_press3).attr("disabled",false); //Unlock the next step
            }
        },500)
    }
    
    function encrypt_and_send(answer_indexes){
        /**
        * Encrypts votes in answer_indexes and sends them to the server
        * @param {String[]} answer_indexes Contains an array with votes indexes as Strings
        * @return {} No return
        */
        //We consider only one question for the moment
        var question = election['questions'][0];
        var answers = question['answers'];
        
        var choices = []
        var individual_proofs = []
        var overall_proof = null
        var randomness = []

        for(i=0;i<answers.length;i++){
            choices.push(null);
            individual_proofs.push(null);
            randomness.push(null);
        }

        // min and max for number of answers, useful later
        var min_answers = 0;
        var max_answers = answers.length;
        if(question['min']!= undefined){
            min_answers = question['min']; 
        }
        if(question['max']!= undefined){
            max_answers = question['max']; 
        }
        
        // keep track of number of options selected.
        var num_selected_answers = 0;

        // homomorphic sum of all
        var homomorphic_sum = [[ZERO, ONE], [ZERO, ONE], [ZERO, ZERO]];
        var randomness_sum = new LargeInteger("0");
        
        var enc_time = 0;
        var dis_time = 0;
        for(answer_num=0;answer_num<answers.length;answer_num++){
            var plaintext_index = 0;
            // assuming a list of answers
            if(answer_indexes.indexOf(answer_num.toString())>-1){
                plaintext_index = 1;
                num_selected_answers += 1;
            }
            randomness[answer_num] = new LargeInteger(r.length*28, randomSource);
            randomness[answer_num] = randomness[answer_num].mod(r);
            var aux1 = encrypt_vote(plaintext_index.toString(16), randomness[answer_num], gamma);
            enc_time+=aux1['times'][0];
            dis_time+=aux1['times'][1];
            choices[answer_num] = aux1['ballot'];
            individual_proofs[answer_num] = aux1['proof'];
            
            if(max_answers!=null){
                homomorphic_sum = EFp2_add2(homomorphic_sum, choices[answer_num][2], gamma);
                randomness_sum = randomness_sum.modAdd(randomness[answer_num], r);
            }
        }
        
        
        if(num_selected_answers < min_answers){
            throw Error("Need to select at least " + min_answers  +" answer(s)") 
        }
            
        if(num_selected_answers > max_answers){
            throw Error("Need to select at most " + max_answers  +" answer(s)") 
        }
        
        var start3 = time();
        var overall_proof = conjunctive_proof(randomness_sum, new LargeInteger(num_selected_answers.toString(16)), new LargeInteger(question['min'].toString(16)), new LargeInteger(question['max'].toString(16)), gamma, [tbl_h1, tbl_h2], homomorphic_sum);
        var stop3 = time();
        
        var ciphertexts = [];
        for(i=0;i<answers.length;i++){
            ciphertexts.push([EFp_toHexString(choices[i][0]), EFp_toHexString(choices[i][1]), EFp2_toHexString(choices[i][2]), choices[i][3]]);
        }
        // Send vote and ZKPs 
        $.post("/crypto/ppats" ,
                {'uuid' : uuid,
                'ciphertexts' : JSON.stringify(ciphertexts),
                'proofs' : JSON.stringify(individual_proofs),
                'overall' : JSON.stringify(overall_proof)} ,
                function(data, status){
                    confirmations++;
                    console.log(data);
                });
        return [enc_time,dis_time,(stop3-start3)];
    }

//////////////////////////////////////////////// Auxiliary functions /////////////////////////////////////////////////////////

function toBinary(n){
    /**
    * @param n: positive integer
    * @param toStr: if 1 returns as string, if 0 as array
    * @return: the number binary representation
    */
    var i = 0;
    var k = [];
    while(n.sign==1){
        var aux1 = n.getBit(0);
        k = k.concat(aux1);
        n = n.shiftRight(1);
    }
    k.reverse();
    return k
}

function toNAF(n){
    /**
    * @param n: positive integer
    * @return: the number Non Adjacent Form representation
    */
    var i = 0;
    var k = [];
    while (n.sign==1){
        if (n.getBit(0)==1){
            var aux1 = n.slice(0, 2);
            if(n.getBit(1)==0){
                k.push(1);
            }
            else{
                k.push(-1);
                n = n.add(ONE);
            }
        }
        else{
            k.push(0);
        }
        n = n.shiftRight(1);
        i = i + 1;
    }
    k = k.reverse();
    return k;
}

function FpExt_isZero(P){
    /**
    * Verifies if P is zero
    * @param P: array of mpz()
    * @return: True if only zeros, False otherwise
    */
    var isZero = 1;
    var i = 0;
    while (i<P.length && isZero){
        if(!P[i].equals(ZERO)) isZero = 0;
        i+=1;
    }
    return isZero;
}

function load_table(table){
    /**
    * @param table: contains pre-computed table in hex form
    * @return The table parsed into LargeInteger EC points
    */
    if(!Array.isArray(table[0][0])){
        var tbl = [];
        for(var i=0;i<table.length;i++){
            tbl=tbl.concat([[new LargeInteger(table[i][0]), new LargeInteger(table[i][1]), ONE]]);
        }
        return tbl;
    }
    else{
        var tbl = [];
        for(var i=0;i<table.length;i++){
            tbl=tbl.concat([[[new LargeInteger(table[i][0][0]), new LargeInteger(table[i][0][1])], [new LargeInteger(table[i][1][0]), new LargeInteger(table[i][1][1])], [ZERO, ONE]]]);
        }
        return tbl;
    }
}

function toUTF8Array(str) {
    /**
    * @param: str: String to convert to UTF8
    * @return String converted to UTF8
    */
    var utf8 = [];
    for (var i=0; i < str.length; i++) {
        var charcode = str.charCodeAt(i);
        if (charcode < 0x80) utf8.push(charcode);
        else if (charcode < 0x800) {
            utf8.push(0xc0 | (charcode >> 6), 
                    0x80 | (charcode & 0x3f));
        }
        else if (charcode < 0xd800 || charcode >= 0xe000) {
            utf8.push(0xe0 | (charcode >> 12), 
                    0x80 | ((charcode>>6) & 0x3f), 
                    0x80 | (charcode & 0x3f));
        }
        // surrogate pair
        else {
            i++;
            charcode = ((charcode&0x3ff)<<10)|(str.charCodeAt(i)&0x3ff)
            utf8.push(0xf0 | (charcode >>18), 
                    0x80 | ((charcode>>12) & 0x3f), 
                    0x80 | ((charcode>>6) & 0x3f), 
                    0x80 | (charcode & 0x3f));
        }
    }
    return utf8;
}

function noZeros(myStr){
    /**
    * @param myStr: Any Hexadecimal String
    * @return the same string without initial 0 if present
    */
    if(myStr[0]=="0") return myStr.substring(1);
    return myStr;
}

function compute_hashing_string(election){
    /**
    * Computes a string that must be included inside each challenge Hash
    * @param election: the election parameters
    * @return: string to hash
    */
    var string_to_hash = "";
    string_to_hash += "g1,"
    string_to_hash += EFp_toHexString(EFp_fromHexString(election["public_key"]["g1"]), 1)
    if (election["public_key"]["g2"] != " "){
        string_to_hash += ",g2,"
        string_to_hash += EFp_toHexString(EFp_fromHexString(election["public_key"]["g2"]), 1)
    }
    string_to_hash += ",h1,"
    string_to_hash += EFp2_toHexString(EFp2_fromHexString(election["public_key"]["h1"]), 1)
    string_to_hash += ",h2,"
    string_to_hash += EFp2_toHexString(EFp2_fromHexString(election["public_key"]["h2"]), 1)
    string_to_hash += ",cast_url,";
    string_to_hash += election.cast_url;
    string_to_hash += ",description,";
    string_to_hash += election.description;
    string_to_hash += ",name,";
    string_to_hash += election.name;
    string_to_hash += ",voting_starts_at,";
    string_to_hash += election.voting_starts_at;
    string_to_hash += ",voting_ends_at,";
    string_to_hash += election.voting_ends_at;
    string_to_hash += ",uuid,";
    string_to_hash += election.uuid;
    return string_to_hash;
}
//////////////////////////////////////////////// Operations in Fp2 //////////////////////////////////////////////////////////

function Fp2_conj(p, x){
    return [x[0].neg().mod(p), x[1]];
}

function Fp2_neg(p, x){
    return [x[0].neg().mod(p), x[1].neg().mod(p)];
}

function Fp2_equals(a, b){
    return a[0].equals(b[0]) && a[1].equals(b[1]);
}

function Fp2_add(a, b){
    var a1 = a[0];
    var a0 = a[1];
    var b1 = b[0];
    var b0 = b[1];
    var c0 = a0.add(b0);
    var c1 = a1.add(b1);
    return [c1,c0];
}

function Fp2_sub(a, b){
    var a1 = a[0];
    var a0 = a[1];
    var b1 = b[0];
    var b0 = b[1];
    var c0 = a0.sub(b0);
    var c1 = a1.sub(b1);
    return [c1,c0];
}

function Fp2_mul(a, b){
    if(!Array.isArray(a)){
        var b1 = b[0];
        var b0 = b[1];
        var c0 = b0.mul(a);
        var c1 = b1.mul(a);
    }else{
        var a1 = a[0];
        var a0 = a[1];
        var b1 = b[0];
        var b0 = b[1];
        var c0 = a0.mul(b0).sub(a1.mul(b1));
        var c1 = a1.mul(b0).add(a0.mul(b1));
    }
    return [c1,c0];
}

function Fp2_modAdd(p, a, b){
    var a1 = a[0];
    var a0 = a[1];
    var b1 = b[0];
    var b0 = b[1];
    var c0 = a0.modAdd(b0, p);
    var c1 = a1.modAdd(b1, p);
    return [c1,c0];
}

function Fp2_modSub(p, a, b){
    var a1 = a[0];
    var a0 = a[1];
    var b1 = b[0];
    var b0 = b[1];
    var c0 = a0.modSub(b0, p);
    var c1 = a1.modSub(b1, p);
    return [c1,c0];
}

function Fp2_modMul(p, a, b){
    if(!Array.isArray(a)){
        var b1 = b[0];
        var b0 = b[1];
        var c0 = b0.modMul(a, p);
        var c1 = b1.modMul(a, p);
    }else{
        var a1 = a[0];
        var a0 = a[1];
        var b1 = b[0];
        var b0 = b[1];
        var c0 = a0.modMul(b0,p).modSub(a1.modMul(b1,p),p);
        var c1 = a1.modMul(b0,p).modAdd(a0.modMul(b1,p),p);
    }
    return [c1,c0];
}

function Fp2_square(p, x){
    var a1 = x[0];
    var a0 = x[1];
    var c0 = a0.modMul(a0,p).modSub(a1.modMul(a1,p),p);
    var c1 = a0.modMul(a1,p).modMul(TWO,p);
    return [c1,c0];
}

function Fp2_inv(p, x){
    var a1 = x[0];
    var a0 = x[1];
    var inv_den = a0.modMul(a0,p).modAdd(a1.modMul(a1,p),p).modInv(p);
    var c0 = a0.modMul(inv_den,p);   
    var c1 = a1.neg().mod(p).modMul(inv_den,p);
    return [c1,c0];
}

function Fp2_pow(p, a, x){
    var x_bin = toBinary(x);
    var result = [ZERO, ONE];
    for(var i=0;i<x_bin.length;i++){
        result = Fp2_square(p, result);
        if(x_bin[i] == 1){
            result = Fp2_modMul(p, result, a);
        }
    }
    return result;
}


//////////////////////////////////////////////// EC on Fp ////////////////////////////////////////////////////////////////

function EFp_verify(P, gamma){
    /**
    * Verification that P belongs to the curve
    * @param P: Potential point in Jacobian Coordinates
    * @param gamma: array containing useful pre-computations
    * @return: True if point belongs to the curve, False otherwise
    */
    var b = gamma[10];
    var p = gamma[8];;
    var left = P[1].modPow(TWO,p);
    var right = P[0].modPow(THREE, p).modAdd(b.mul(P[2].modPow(SIX,p),p),p);
    return left.equals(right);
}

function EFp_add(P, Q, gamma){
    /**
    * Addition in EFp JACOBIAN WITH AFFINE
    * @param P: Point in EFp in JACOBIAN COORDINATES
    * @param Q: Point in EFp in AFFINE COORDINATES
    * @return: P+Q
    */
    var p = gamma[8];
    if (P[2].equals(ZERO))      return Q;
    var X1 = P[0];
    var Y1 = P[1];
    var Z1 = P[2];
    var X2 = Q[0];
    var Y2 = Q[1];
    var Z1Z1 = Z1.mul(Z1);
    var U2 = X2.modMul(Z1Z1, p);
    var S2 = Y2.mul(Z1).modMul(Z1Z1, p);
    var H = U2.sub(X1);
    var HH = H.mul(H);
    var I = HH.mul(FOUR);
    var J = H.modMul(I, p);
    var r = S2.sub(Y1).mul(TWO);
    var V = X1.mul(I);
    var X3 = r.mul(r).sub(J).modSub(V.mul(TWO), p);
    var Y3 = V.sub(X3).modMul(r, p).modSub(Y1.mul(J).mul(TWO), p)
    var Z1H = Z1.add(H)
    var Z3 = Z1H.mul(Z1H).sub(Z1Z1).modSub(HH, p);
    return [X3, Y3, Z3];
}

function EFp_add2(P, Q, gamma){
    /**
    * Addition in EFp JACOBIAN WITH JACOBIAN
    * @param P: Point in EFp in JACOBIAN COORDINATES
    * @param Q: Point in EFp in JACOBIAN COORDINATES
    * @return: P+Q
    */
    var p = gamma[8];
    if (P[2].equals(ZERO))      return Q;
    else if (Q[2].equals(ZERO)) return P;
    var X1 = P[0];
    var Y1 = P[1];
    var Z1 = P[2];
    var X2 = Q[0];
    var Y2 = Q[1];
    var Z2 = Q[2];
    
    var Z1Z1 = Z1.mul(Z1);
    var Z2Z2 = Z2.mul(Z2);
    var U1 = X1.modMul(Z2Z2,p);
    var U2 = X2.modMul(Z1Z1,p);
    var S1 = Y1.mul(Z2.modMul(Z2Z2,p));
    var S2 = Y2.mul(Z1.modMul(Z1Z1,p));
    var H = U2.sub(U1);
    var HH = H.mul(H);
    var HHH = H.modMul(HH,p);
    var r = S2.sub(S1);
    var V = U1.modMul(HH,p);
    var X3 = r.modMul(r,p).sub(HHH).modSub(V.mul(TWO),p);
    var Y3 = r.modMul(V.sub(X3),p).modSub(S1.mul(HHH),p);
    var Z3 = Z1.mul(Z2).modMul(H,p);
    return [X3, Y3, Z3];
}

function EFp_sub(P, Q, gamma){
    /**
    * Substraction in EFp JACOBIAN WITH AFFINE
    * @param P: Point in EFp in JACOBIAN COORDINATES
    * @param Q: Point in EFp in AFFINE COORDINATES
    * @return: P-Q
    */
    var Q2 = [Q[0], Q[1].neg().mod(gamma[8]), Q[2]];
    return EFp_add(P, Q2, gamma);
}

function EFp_double(P, gamma){
    /**
    * Doubling in EFp
    * @param P: Point in EFp
    * @param gamma: array containing useful pre-computations
    * @return: 2P
    */
    var p =gamma[8];
    if (P[2].equals(ZERO)) return P;
    else{
        var X1 = P[0];
        var Y1 = P[1];
        var Z1 = P[2];
        var A = X1.mul(X1);
        var B = Y1.mul(Y1);
        var C = B.modMul(B,p);
        var D = X1.add(B).modPow(TWO,p).sub(A).sub(C).mul(TWO);
        var E = A.mul(THREE);
        var F = E.modPow(TWO,p);
        var X3 = F.modSub(D.mul(TWO),p);
        var Y3 = E.modMul(D.sub(X3),p).modSub(C.mul(EIGHT), p);
        var Z3 = Y1.mul(Z1).modMul(TWO,p);
        return [X3,Y3,Z3];
    }
}

function EFp_scalarMult(P, n, gamma, binary=0){
    /**
    * Performs scalar multiplication of point in EFp
    * @param P: Point in EFp
    * @param n: scalar to multiply P
    * @param gamma: array containing useful pre-computations
    * @return n*P
    */
    var p = gamma[8];
    var k;
    if(binary) k=toBinary(n);
    else k = toNAF(n);
    var P_minus = [P[0], P[1].neg().mod(p), P[2]];
    var R = [ONE,ONE,ZERO]
    for (var i=0;i<k.length;i++){
        R = EFp_double(R, gamma);
        if (k[i]==1)       R = EFp_add2(R, P, gamma);
        else if (k[i]==-1) R = EFp_add2(R, P_minus, gamma);
    }
    return R;
}

function EFp_scalarMultOptim(n, gamma, table){
    /**
    * Performs optimal scalar multiplication of point in EFp with pre-computed table
    * @param n: scalar to multiply table[0]
    * @param gamma: array containing useful pre-computations
    * @param table: pre-computed table in affine coordinates
    * @return n*table[0]
    */
    var k = toNAF(n);
    k = k.reverse()
    var R = [ONE,ONE,ZERO];
    for (var i=0;i<k.length;i++){
        if (k[i]==1)       R = EFp_add(R, table[i], gamma);
        else if (k[i]==-1) R = EFp_sub(R, table[i], gamma);
    }
    if(EFp_verify(R, gamma)) return R;
    else return "Error";
}

function EFp_normalize(P, gamma){
    /**
    * Normalizes any point on EFp
    * @param P: Point in Jacobian coordinates
    * @param gamma: array containing useful pre-computations
    * @return: Point in Affine coordinates
    */
    var p = gamma[8];
    var inv_Pz = P[2].modInv(p);
    var inv_Pz2 = inv_Pz.modPow(TWO, p);
    var inv_Pz3 = inv_Pz2.modMul(inv_Pz, p);
    return [P[0].modMul(inv_Pz2,p), P[1].modMul(inv_Pz3,p), P[2].modMul(inv_Pz,p)];
}
    
function EFp_toHexString(P, hash=0){
    /**
    * Returns string representation of point on EFp
    * @param P: point on EFp
    * @param hash: if 1 then string, if 0 then array of strings
    * @return: string representation of point on EFp
    */
    if(hash) return noZeros(P[0].toHexString())+noZeros(P[1].toHexString())+noZeros(P[2].toHexString());
    return [noZeros(P[0].toHexString()), noZeros(P[1].toHexString()), noZeros(P[2].toHexString())];
}

function EFp_fromHexString(P){
    /**
    * Parses point on EFp from string to array of LargeInteger
    * @param P: string representation of point
    * @return: return point on EFp
    */
    return [new LargeInteger(P[0]), new LargeInteger(P[1]), new LargeInteger(P[2])]
}

/////////////////////////////////////////////////// EC on Fp2 //////////////////////////////////////////////////////////////

function EFp2_verify(P, gamma){
    /**
    * Verification that P belongs to the curve
    * @param P: Potential point in Jacobian Coordinates
    * @param gamma: array containing useful pre-computations
    * @return: True if point belongs to the curve, False otherwise
    */
    var p = gamma[8];
    var b = gamma[11];
    var left = Fp2_pow(p, P[1], TWO);
    var right = Fp2_modAdd(p, Fp2_pow(p, P[0], THREE), Fp2_modMul(p, b, Fp2_pow(p, P[2], SIX)))
    return Fp2_equals(left, right);
}

function EFp2_add(P, Q, gamma){
    /**
    * Addition in EFp2 JACOBIAN WITH AFFINE
    * @param P: Point in EFp2 in JACOBIAN COORDINATES
    * @param Q: Point in EFp2 in AFFINE COORDINATES
    * @return: P+Q
    */
    var p = gamma[8];
    if (FpExt_isZero(P[2]))      return Q;
    var X1 = P[0];
    var Y1 = P[1];
    var Z1 = P[2];
    var X2 = Q[0];
    var Y2 = Q[1];
    var Z1Z1 = Fp2_modMul(p, Z1, Z1);
    var U2 = Fp2_modMul(p, Z1Z1, X2);
    var S2 = Fp2_modMul(p, Fp2_mul(Y2, Z1), Z1Z1);
    var H = Fp2_sub(U2, X1);
    var HH = Fp2_modMul(p, H, H);
    var I = Fp2_mul(FOUR, HH);
    var J = Fp2_modMul(p, H, I);
    var r = Fp2_mul(TWO, Fp2_sub(S2, Y1));
    var V = Fp2_modMul(p, X1, I);
    var X3 = Fp2_modSub(p, Fp2_sub(Fp2_mul(r, r), J), Fp2_mul(TWO, V));
    var Y3 = Fp2_modSub(p, Fp2_mul(r, Fp2_sub(V, X3)), Fp2_mul(Y1, Fp2_mul(TWO, J)));
    var Z1H = Fp2_add(Z1, H);
    var Z3 = Fp2_modSub(p, Fp2_sub(Fp2_mul(Z1H, Z1H), Z1Z1), HH);
    return [X3, Y3, Z3];
}

function EFp2_add2(P, Q, gamma){
    /**
    * Addition in EFp2 JACOBIAN WITH JACOBIAN
    * @param P: Point in EFp2 in JACOBIAN COORDINATES
    * @param Q: Point in EFp2 in JACOBIAN COORDINATES
    * @return: P+Q
    */
    var p = gamma[8];
    if (FpExt_isZero(P[2]))      return Q;
    else if (FpExt_isZero(Q[2])) return P;
    var X1 = P[0];
    var Y1 = P[1];
    var Z1 = P[2];
    var X2 = Q[0];
    var Y2 = Q[1];
    var Z2 = Q[2];
    var Z1Z1 = Fp2_square(p, Z1);
    var Z2Z2 = Fp2_square(p, Z2);
    var U1 = Fp2_modMul(p, X1, Z2Z2);  
    var U2 = Fp2_modMul(p, X2, Z1Z1);  
    var S1 = Fp2_modMul(p, Fp2_modMul(p, Y1, Z2), Z2Z2);  
    var S2 = Fp2_modMul(p, Fp2_modMul(p, Y2, Z1), Z1Z1);
    var H = Fp2_modSub(p, U2, U1); 
    var HH = Fp2_square(p, H);  
    var HHH = Fp2_modMul(p, H, HH);  
    var r = Fp2_modSub(p, S2, S1); 
    var V = Fp2_modMul(p, U1, HH);
    var X3 = Fp2_modSub(p, Fp2_modSub(p, Fp2_square(p, r), HHH), Fp2_modMul(p, TWO, V));
    var Y3 = Fp2_modSub(p, Fp2_modMul(p, r, Fp2_modSub(p, V, X3)), Fp2_modMul(p, S1, HHH));  
    var Z3 = Fp2_modMul(p, Fp2_modMul(p, Z1, Z2), H);
    if (FpExt_isZero(X3) && FpExt_isZero(Y3) && FpExt_isZero(Z3)) return EFp2_double(P, gamma);
    else return [X3, Y3, Z3];
}

function EFp2_sub(P, Q, gamma){
    /**
    * Substraction in EFp2 JACOBIAN WITH AFFINE
    * @param P: Point in EFp2 in JACOBIAN COORDINATES
    * @param Q: Point in EFp2 in AFFINE COORDINATES
    * @return: P-Q
    */
    var p = gamma[8];
    var Q2 = [Q[0], Fp2_neg(p, Q[1]), Q[2]]
    return EFp2_add(P, Q2, gamma);
}

function EFp2_sub2(P, Q, gamma){
    /**
    * Substraction in EFp2 JACOBIAN WITH JACOBIAN
    * @param P: Point in EFp2 in JACOBIAN COORDINATES
    * @param Q: Point in EFp2 in JACOBIAN COORDINATES
    * @return: P-Q
    */
    var p = gamma[8];
    var Q2 = [Q[0], Fp2_neg(p, Q[1]), Q[2]];
    return EFp2_add2(P, Q2, gamma);
}

function EFp2_double(P, gamma){
    /**
    * Doubling in EFp2
    * @param P: Point in EFp2
    * @param gamma: array containing useful pre-computations
    * @return: 2P
    */
    var p = gamma[8];
    if(FpExt_isZero(P[2])) return P;
    else{
        var X1 = P[0];
        var Y1 = P[1];
        var Z1 = P[2];
        var A = Fp2_square(p, X1); 
        var B = Fp2_square(p, Y1);
        var C = Fp2_square(p, B);
        var D = Fp2_modMul(p, TWO, Fp2_modSub(p, Fp2_modSub(p, Fp2_square(p, Fp2_modAdd(p, X1, B)), A), C));
        var E = Fp2_modMul(p, THREE, A);
        var F = Fp2_square(p, E);
        var X3 = Fp2_modSub(p, F, Fp2_modMul(p, TWO, D));
        var Y3 = Fp2_modSub(p, Fp2_modMul(p, E, Fp2_modSub(p, D, X3)), Fp2_modMul(p, EIGHT, C));
        var Z3 = Fp2_modMul(p, TWO, Fp2_modMul(p, Y1, Z1));
        return [X3, Y3, Z3];
    }
}

function EFp2_scalarMult(P, N, gamma){
    /**
    * Performs scalar multiplication of point in EFp2
    * @param P: Point in EFp2
    * @param n: scalar to multiply P
    * @param gamma: array containing useful pre-computations
    * @return n*P
    */
    var p = gamma[8];
    var n, rev;
    if(N.sign<0){
        n = N.neg();
        rev = 1;
    }
    else{
        n = N;
        rev = 0;
    }
    var k = toNAF(n);
    var P_minus = [P[0], Fp2_neg(p, P[1]), P[2]];
    var R = [[ZERO, ONE], [ZERO, ONE], [ZERO, ZERO]];
    for (var i=0;i<k.length;i++){
        R = EFp2_double(R, gamma);
        if (k[i]==1)       R = EFp2_add2(R, P, gamma);
        else if (k[i]==-1) R = EFp2_add2(R, P_minus, gamma);
    }
    if(rev) return [R[0], Fp2_neg(p, R[1]), R[2]];
    else return R;
}

function EFp2_scalarMultOptim(n, gamma, table){
    /**
    * Performs optimal scalar multiplication of point in EFp2 with pre-computed table
    * @param n: scalar to multiply table[0]
    * @param gamma: array containing useful pre-computations
    * @param table: pre-computed table in affine coordinates
    * @return n*table[0]
    */
    var k = toNAF(n);
    k = k.reverse()
    var R = [[ZERO, ONE], [ZERO, ONE], [ZERO, ZERO]];
    for (var i=0;i<k.length;i++){
        if (k[i]==1)       R = EFp2_add(R, table[i], gamma);
        else if (k[i]==-1) R = EFp2_sub(R, table[i], gamma);
    }
    if(EFp2_verify(R, gamma)) return R;
    else return "Error";
}

function EFp2_normalize(P, gamma){
    /**
    * Normalizes any point on EFp2
    * @param P: Point in Jacobian coordinates
    * @param gamma: array containing useful pre-computations
    * @return: Point in Affine coordinates
    */
    var p = gamma[8];
    var inv_Pz = Fp2_inv(p, P[2]);
    var inv_Pz2 = Fp2_square(p, inv_Pz);
    var inv_Pz3 = Fp2_modMul(p, inv_Pz2, inv_Pz);
    var P0 = Fp2_modMul(p, P[0], inv_Pz2);
    var P1 = Fp2_modMul(p, P[1], inv_Pz3);
    var P2 = Fp2_modMul(p, P[2], inv_Pz);
    return [P0, P1, P2];
}

function EFp2_toHexString(P, hash=0){
    /**
    * Returns string representation of point on EFp2
    * @param P: point on EFp2
    * @param hash: if 1 then string, if 0 then array of strings
    * @return: string representation of point on EFp2
    */
    if(hash){
        var rep = "";
        for(var i=0;i<3;i++){
            var coord="";
            for(var j=0;j<2;j++){
                coord+=noZeros(P[i][j].toHexString());
            }
            rep+=coord;
        }
        return rep;
    }
    else{
        var rep = [];
        for(var i=0;i<3;i++){
            var coord=[];
            for(var j=0;j<2;j++){
                coord.push(noZeros(P[i][j].toHexString()));
            }
            rep.push(coord);
        }
        return rep;
    }
}

function EFp2_fromHexString(P){
    /**
    * Parses point on EFp2 from string to array of LargeInteger
    * @param P: string representation of point
    * @return: return point on EFp
    */
    var rep = [];
    for(var i=0;i<3;i++){
        var coord=[];
        for(var j=0;j<2;j++){
            coord.push(new LargeInteger(P[i][j]));
        }
        rep.push(coord);
    }
    return rep;
}

////////////////////////////////////////////////// PPATS /////////////////////////////////////////////////////////

function encrypt_vote(v, ran, gamma){
    /**
    * Creates ballot for vote v, consistency proof and disjunctive proof
    * @param {String} v The vote in hexadecimal string
    * @param {LargeInteger} ran Randomness used in c2=g1^ran*g2^s
    * @param {Array} array containing useful pre-computed values
    * @return [c1, c2, d sigma] and disjunctive_proof OR "KO" if problem with ballot
    */
    var start1 = time();
    var R = gamma[9];
    var s = new LargeInteger(R.length*28, randomSource);
    var v = new LargeInteger(v);
    s = s.mod(R);
    var c1 = EFp_scalarMultOptim(s, gamma, tbl_g1);
    var c2a = EFp_scalarMultOptim(ran, gamma, tbl_g1);
    var c2b = EFp_scalarMultOptim(s, gamma, tbl_g2);
    var c2 = EFp_add2(c2a, c2b, gamma);
    var d = EFp2_scalarMultOptim(ran, gamma, tbl_h1);
    //if(v) d = EFp2_add2(d, h2, gamma);
    d = EFp2_add2(d, EFp2_scalarMultOptim(v, gamma, tbl_h2), gamma);
    if(EFp_verify(c2, gamma) && EFp2_verify(d, gamma)) {
        var sigma = consistency_proof(ran, s, v, [c1, c2, d], gamma);
        var stop1 = time()
        var proof = disjunctive_proof(ran, v, gamma, [tbl_h1, tbl_h2],  [c1, c2, d]);
        var stop2 = time()
        return {"ballot": [c1, c2, d, sigma], "proof": proof, "times":[stop1-start1,stop2-stop1]};
    }
    else return "KO";
}

function consistency_proof(ran, s, v, c, gamma){
    /**
    * Compute consistency proof
    * @param ran: randomness of c2=g1^ran*g2^s
    * @param s: randomness of c1=g1^s
    * @param v: vote
    * @param c: encrypted ballot [c1, c2, d]
    * @param gamma: array containing useful pre-computed values
    * @return [e, fr, sr, vr, c1', c2', d'] consistency proof in hex string form
    */
    var R = gamma[9];
    var s2 = new LargeInteger(R.length*28, randomSource);
    var r2 = new LargeInteger(R.length*28, randomSource);
    var v2 = new LargeInteger(R.length*28, randomSource);
    s2 = s2.mod(R);
    r2 = r2.mod(R);
    v2 = v2.mod(R);
    var c0 = EFp_scalarMultOptim(s2, gamma, tbl_g1);
    var c1a = EFp_scalarMultOptim(r2, gamma, tbl_g1);
    var c1b = EFp_scalarMultOptim(s2, gamma, tbl_g2);
    var c1 = EFp_add2(c1a, c1b, gamma);
    var da = EFp2_scalarMultOptim(r2, gamma, tbl_h1);
    var db = EFp2_scalarMultOptim(v2, gamma, tbl_h2);
    var d = EFp2_add2(da, db, gamma);
    var string_to_hash = "c0,"+EFp_toHexString(c[0], 1)+",c1,"+EFp_toHexString(c[1], 1)+",d,"+EFp2_toHexString(c[2], 1)+",c0',"+EFp_toHexString(c0, 1)+",c1',"+EFp_toHexString(c1, 1)+",d',"+EFp2_toHexString(d, 1)+","+globalStr_toHash;
    var e = new LargeInteger(hash(toUTF8Array(string_to_hash)));
    e = e.mod(R);
    var fr = r2.modAdd(e.modMul(ran, R), R);
    var sr = s2.modAdd(e.modMul(s, R), R);
    var vr = v2.modAdd(e.modMul(v, R), R);
    return JSON.stringify([noZeros(e.toHexString()), noZeros(fr.toHexString()), noZeros(sr.toHexString()), noZeros(vr.toHexString()), EFp_toHexString(c0), EFp_toHexString(c1), EFp2_toHexString(d)]);
    //return [e, fr, sr, vr, c0, c1, d];
}

function disjunctive_proof(ran, v, gamma, tables, c){
    /**
    * Compute disjunctive proof
    * @param ran: randomness of c2=g1^ran*g2^s
    * @param v: vote
    * @param gamma: array containing useful pre-computed values
    * @param tables: [table_h1, table_h2]
    * @param c: encrypted ballot [c1, c2, d]
    * @return [[A0, e0, f0], [A1, e1, f1]] disjunctive proof in hex string form
    */
    var R = gamma[9];
    if(v.equals(ONE)){
        var f0 = new LargeInteger(R.length*28, randomSource);
        var e0 = new LargeInteger(R.length*28, randomSource);
        f0 = f0.mod(R);
        e0 = f0.mod(R);
        var a0 = f0.modSub(e0.modMul(ran, R), R);
        var tmp1 = EFp2_scalarMultOptim(a0, gamma, tables[0]);
        var tmp2 = EFp2_scalarMultOptim(e0, gamma, tables[1]);
        var A0 = EFp2_sub2(tmp1, tmp2, gamma);
        var a1 = new LargeInteger(R.length*28, randomSource);
        a1 = a1.mod(R);
        var A1 = EFp2_scalarMultOptim(a1, gamma, tables[0]);
        var string_to_hash = "c0,"+EFp_toHexString(c[0], 1)+",c1,"+EFp_toHexString(c[1], 1)+",d,"+EFp2_toHexString(c[2], 1)+",commitmentA0,"+EFp2_toHexString(A0, 1) +",commitmentA1,"+ EFp2_toHexString(A1, 1) +","+ globalStr_toHash;
        var e = new LargeInteger(hash(toUTF8Array(string_to_hash)));
        e = e.mod(R);
        var e1 = e.modSub(e0, R);
        var f1 = a1.modAdd(e1.modMul(ran, R), R);
    }
    else if(v.equals(ZERO)){
        var f1 = new LargeInteger(R.length*28, randomSource);
        var e1 = new LargeInteger(R.length*28, randomSource);
        f1 = f1.mod(R);
        e1 = e1.mod(R);
        var a1 = f1.modSub(e1.modMul(ran, R), R);
        var tmp1 = EFp2_scalarMultOptim(a1, gamma, tables[0]);
        var tmp2 = EFp2_scalarMultOptim(e1, gamma, tables[1]);
        var A1 = EFp2_add2(tmp1, tmp2, gamma);
        var a0 = new LargeInteger(R.length*28, randomSource);
        a0 = a0.mod(R);
        var A0 = EFp2_scalarMultOptim(a0, gamma, tables[0]);
        var string_to_hash = "c0,"+EFp_toHexString(c[0], 1)+",c1,"+EFp_toHexString(c[1], 1)+",d,"+EFp2_toHexString(c[2], 1)+",commitmentA0,"+EFp2_toHexString(A0, 1) +",commitmentA1,"+ EFp2_toHexString(A1, 1) +","+ globalStr_toHash;
        var e = new LargeInteger(hash(toUTF8Array(string_to_hash)));
        e = e.mod(R);
        var e0 = e.modSub(e1, R);
        var f0 = a0.modAdd(e0.modMul(ran, R), R);
    }
    else{
        return "Vote is neither 1 nor 0";
    }
    return [[EFp2_toHexString(A0), noZeros(e0.toHexString()), noZeros(f0.toHexString())], [EFp2_toHexString(A1), noZeros(e1.toHexString()), noZeros(f1.toHexString())]];
}

function conjunctive_proof(ran, v, min, max, gamma, tables, d){
    /**
    * Compute conjunctive proof
    * @param ran: randomness of c2=g1^ran*g2^s
    * @param v: sum of votes
    * @param min: minimum number of votes for the election
    * @param max: maximum number of votes for the election
    * @param gamma: array containing useful pre-computed values
    * @param tables: [table_h1, table_h2]
    * @param d: encrypted summed-up ballot [c1, c2, d]
    * @return [[Ai, ei, fi]] for min<=i<=max, conjunctive proofs in hex string form
    */
    if (v.cmp(min)==-1 || v.cmp(max)==1){
        return "Incorrect number of votes";
    }
    var R = gamma[9];
    var rep = [];
    var iter = new LargeInteger(min.toHexString());
    var string_to_hash1="d,"+EFp2_toHexString(d, 1);
    var string_to_hash2="";
    var e_total = new LargeInteger("0");
    while(iter.cmp(v)==-1){
        var f = new LargeInteger(R.length*28, randomSource);
        var e = new LargeInteger(R.length*28, randomSource);
        f = f.mod(R);
        e = e.mod(R);
        var a = f.modSub(e.modMul(ran, R), R);
        var tmp1 = EFp2_scalarMultOptim(a, gamma, tables[0]);
        var tmp2 = EFp2_scalarMultOptim(e, gamma, tables[1]);
        var tmp3 = EFp2_scalarMult(tmp2, v.sub(iter), gamma);
        var A = EFp2_sub2(tmp1, tmp3, gamma);
        rep.push([EFp2_toHexString(A), noZeros(e.toHexString()), noZeros(f.toHexString())]);
        string_to_hash1+=",commitment"+parseInt(iter.toHexString(), 16)+","+EFp2_toHexString(A, 1);
        e_total = e_total.modAdd(e, R);
        iter = iter.add(ONE);
    }
    var real_index = rep.length;
    rep.push(null);
    iter = iter.add(ONE);
    while(iter.cmp(max)<=0){
        var f = new LargeInteger(R.length*28, randomSource);
        var e = new LargeInteger(R.length*28, randomSource);
        f = f.mod(R);
        e = e.mod(R);
        var a = f.modSub(e.modMul(ran, R), R);
        var tmp1 = EFp2_scalarMultOptim(a, gamma, tables[0]);
        var tmp2 = EFp2_scalarMultOptim(e, gamma, tables[1]);
        var tmp3 = EFp2_scalarMult(tmp2, iter.sub(v), gamma);
        var A = EFp2_add2(tmp1, tmp3, gamma);
        rep.push([EFp2_toHexString(A), noZeros(e.toHexString()), noZeros(f.toHexString())]);
        string_to_hash2+=",commitment"+parseInt(iter.toHexString(), 16)+","+EFp2_toHexString(A, 1);
        e_total = e_total.modAdd(e, R);
        iter = iter.add(ONE);
    }
    var a = new LargeInteger(R.length*28, randomSource);
    a = a.mod(R);
    var A = EFp2_scalarMultOptim(a, gamma, tables[0]);
    var string_to_hash = string_to_hash1+",commitment"+parseInt(v.toHexString(), 16)+","+EFp2_toHexString(A, 1)+string_to_hash2+","+globalStr_toHash;
    var E = new LargeInteger(hash(toUTF8Array(string_to_hash)));
    E = E.mod(R);
    var e = E.modSub(e_total, R);
    var f = a.modAdd(e.modMul(ran, R), R);
    rep[real_index] = [EFp2_toHexString(A), noZeros(e.toHexString()), noZeros(f.toHexString())];
    return rep;
}

</script>
{% endblock %}