franklin-crypto
franklin-crypto copied to clipboard
Fix naive range checks in bigint_new
We noticed a few bugs with the naive strategy for range checks:
- The code assumed the wrong bit order from
BitIterator
- In the fast case (
num_bits < 4
), the linear combination check wasn't actually being enforced - In the other case,
d_next_coeff
was being updated incorrectly.