[cdecker]

There is also an implementation by Andrew Poelstra (one of the Bulletproof authors) in a PR to the secp256k1-zkp repository: https://github.com/ElementsProject/secp256k1-zkp/pull/23