bulletproof requires nonce == blind

[mschneiderwng]

If I understand it correctly, then the blind and nonce can be chosen independently (even if the rust api sets nonce = blind) when creating and unwinding bulletproofs. However, if nonce != blind, then only the first 32 bytes of the message can be unwinded as in the following test which can be inserted into perdersen.rs.

    #[test]
    fn test_bullet_nonce_neq_blind() {
        use std;
        use super::*;
        let secp = Secp256k1::with_caps(ContextFlag::Commit);
        let mut rng = OsRng::new().unwrap();
        let value = 1234567;
        let blind = SecretKey::new(&secp, &mut rng);
        let nonce = SecretKey::new(&secp, &mut rng);
        //let nonce = blind; // this works
        let mut msg = [0u8; 64];
        rng.fill_bytes(&mut msg);

        // ffi structures
        let n_bits = 64;
        let mut proof = [0; constants::MAX_PROOF_SIZE];
        let mut plen = constants::MAX_PROOF_SIZE as size_t;
        let extra_data = vec![];

        // create proof
        let success = unsafe {
            ffi::secp256k1_bulletproof_rangeproof_prove_single_w_scratch(
                secp.ctx,
                proof.as_mut_ptr(),
                &mut plen,
                value,
                blind.as_ptr(),
                constants::GENERATOR_H.as_ptr(),
                n_bits as size_t,
                nonce.as_ptr(),
                extra_data.as_ptr(),
                extra_data.len() as size_t,
                msg.as_ptr()
            ) == 1
        };
        assert!(success);

        // unwind proof
        let mut unwinded_msg = [0u8; 64];
        let commit = secp.commit(value, blind).unwrap();
        let success = unsafe {
            ffi::secp256k1_bulletproof_rangeproof_unwind_message(
                secp.ctx,
                proof.as_ptr(),
                plen as size_t,
                commit.as_ptr(),
                n_bits as size_t,
                constants::GENERATOR_H.as_ptr(),
                extra_data.as_ptr(),
                extra_data.len() as size_t,
                nonce.as_ptr(),
                unwinded_msg.as_mut_ptr(),
            ) == 1
        };
        assert!(success);

        println!("msg:     {:?}", msg.to_vec());
        println!("unwinded:{:?}", unwinded_msg.to_vec());

        for i in 0..msg.len() {
            assert_eq!(msg[i], unwinded_msg[i]);
        }
    }

[mschneiderwng]

I think this should be moved to rust-secp256k1-zkp