saymrwulf/pasta_curves-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/pasta_curves-source.git synced 2026-09-10 21:00:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Rename Curve and CurveAffine properties to match group traits

Browse source
This commit is contained in:
Jack Grigg 2021-02-22 18:39:14 +00:00
parent 81a7936d99
commit 7037d55320
12 changed files with 98 additions and 107 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/arithmetic.rs
View file

@ -68,7 +68,7 @@ where
} }
} }
fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut C::Projective) { fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut C::Curve) {
let coeffs: Vec<[u8; 32]> = coeffs.iter().map(|a| a.to_bytes()).collect(); let coeffs: Vec<[u8; 32]> = coeffs.iter().map(|a| a.to_bytes()).collect();
let c = if bases.len() < 4 { let c = if bases.len() < 4 {
@ -110,7 +110,7 @@ fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut
enum Bucket<C: CurveAffine> { enum Bucket<C: CurveAffine> {
None, None,
Affine(C), Affine(C),
Projective(C::Projective), Projective(C::Curve),
} }
impl<C: CurveAffine> Bucket<C> { impl<C: CurveAffine> Bucket<C> {
@ -125,7 +125,7 @@ fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut
} }
} }
fn add(self, mut other: C::Projective) -> C::Projective { fn add(self, mut other: C::Curve) -> C::Curve {
match self { match self {
Bucket::None => other, Bucket::None => other,
Bucket::Affine(a) => { Bucket::Affine(a) => {
@ -150,7 +150,7 @@ fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut
// e.g. 3a + 2b + 1c = a + // e.g. 3a + 2b + 1c = a +
// (a) + b + // (a) + b +
// ((a) + b) + c // ((a) + b) + c
let mut running_sum = C::Projective::zero(); let mut running_sum = C::Curve::identity();
for exp in buckets.into_iter().rev() { for exp in buckets.into_iter().rev() {
running_sum = exp.add(running_sum); running_sum = exp.add(running_sum);
*acc = *acc + &running_sum; *acc = *acc + &running_sum;
@ -160,9 +160,9 @@ fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut
/// Performs a small multi-exponentiation operation. /// Performs a small multi-exponentiation operation.
/// Uses the double-and-add algorithm with doublings shared across points. /// Uses the double-and-add algorithm with doublings shared across points.
pub fn small_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::Projective { pub fn small_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::Curve {
let coeffs: Vec<[u8; 32]> = coeffs.iter().map(|a| a.to_bytes()).collect(); let coeffs: Vec<[u8; 32]> = coeffs.iter().map(|a| a.to_bytes()).collect();
let mut acc = C::Projective::zero(); let mut acc = C::Curve::identity();
// for byte idx // for byte idx
for byte_idx in (0..32).rev() { for byte_idx in (0..32).rev() {
@ -187,14 +187,14 @@ pub fn small_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::P
/// This function will panic if coeffs and bases have a different length. /// This function will panic if coeffs and bases have a different length.
/// ///
/// This will use multithreading if beneficial. /// This will use multithreading if beneficial.
pub fn best_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::Projective { pub fn best_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::Curve {
assert_eq!(coeffs.len(), bases.len()); assert_eq!(coeffs.len(), bases.len());
let num_cpus = num_cpus::get(); let num_cpus = num_cpus::get();
if coeffs.len() > num_cpus { if coeffs.len() > num_cpus {
let chunk = coeffs.len() / num_cpus; let chunk = coeffs.len() / num_cpus;
let num_chunks = coeffs.chunks(chunk).len(); let num_chunks = coeffs.chunks(chunk).len();
let mut results = vec![C::Projective::zero(); num_chunks]; let mut results = vec![C::Curve::identity(); num_chunks];
thread::scope(|scope| { thread::scope(|scope| {
let chunk = coeffs.len() / num_cpus; let chunk = coeffs.len() / num_cpus;
@ -209,9 +209,9 @@ pub fn best_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::Pr
} }
}) })
.unwrap(); .unwrap();
results.iter().fold(C::Projective::zero(), |a, b| a + b) results.iter().fold(C::Curve::identity(), |a, b| a + b)
} else { } else {
let mut acc = C::Projective::zero(); let mut acc = C::Curve::identity();
multiexp_serial(coeffs, bases, &mut acc); multiexp_serial(coeffs, bases, &mut acc);
acc acc
} }

37
src/arithmetic/curves.rs
View file

@ -43,11 +43,8 @@ pub trait Curve:
+ Group<Scalar = <Self as Curve>::Scalar> + Group<Scalar = <Self as Curve>::Scalar>
{ {
/// The representation of a point on this curve in the affine coordinate space. /// The representation of a point on this curve in the affine coordinate space.
type Affine: CurveAffine< type Affine: CurveAffine<Curve = Self, Scalar = <Self as Curve>::Scalar, Base = <Self as Curve>::Base>
Projective = Self, + Add<Output = Self>
Scalar = <Self as Curve>::Scalar,
Base = <Self as Curve>::Base,
> + Add<Output = Self>
+ Sub<Output = Self> + Sub<Output = Self>
+ Mul<<Self as Curve>::Scalar, Output = Self> + Mul<<Self as Curve>::Scalar, Output = Self>
+ Neg<Output = <Self as Curve>::Affine> + Neg<Output = <Self as Curve>::Affine>
@ -58,16 +55,16 @@ pub trait Curve:
type Base: FieldExt; type Base: FieldExt;
/// Obtains the additive identity. /// Obtains the additive identity.
fn zero() -> Self; fn identity() -> Self;
/// Obtains the base point of the curve. /// Obtains the base point of the curve.
fn one() -> Self; fn generator() -> Self;
/// Doubles this element. /// Doubles this element.
fn double(&self) -> Self; fn double(&self) -> Self;
/// Returns whether or not this element is the identity. /// Returns whether or not this element is the identity.
fn is_zero(&self) -> Choice; fn is_identity(&self) -> Choice;
/// Apply the curve endomorphism by multiplying the x-coordinate /// Apply the curve endomorphism by multiplying the x-coordinate
/// by an element of multiplicative order 3. /// by an element of multiplicative order 3.
@ -89,7 +86,7 @@ pub trait Curve:
/// ``` /// ```
/// use halo2::arithmetic::{Curve, CurveAffine}; /// use halo2::arithmetic::{Curve, CurveAffine};
/// fn pedersen_commitment<C: CurveAffine>(x: C::Scalar, r: C::Scalar) -> C { /// fn pedersen_commitment<C: CurveAffine>(x: C::Scalar, r: C::Scalar) -> C {
/// let hasher = C::Projective::hash_to_curve("z.cash:example_pedersen_commitment"); /// let hasher = C::Curve::hash_to_curve("z.cash:example_pedersen_commitment");
/// let g = hasher(b"g"); /// let g = hasher(b"g");
/// let h = hasher(b"h"); /// let h = hasher(b"h");
/// (g * x + &(h * r)).to_affine() /// (g * x + &(h * r)).to_affine()
@ -103,7 +100,7 @@ pub trait Curve:
/// Converts many elements into their affine form. Panics if the /// Converts many elements into their affine form. Panics if the
/// sizes of the slices are different. /// sizes of the slices are different.
fn batch_to_affine(v: &[Self], target: &mut [Self::Affine]); fn batch_normalize(v: &[Self], target: &mut [Self::Affine]);
/// Returns the curve constant a. /// Returns the curve constant a.
fn a() -> Self::Base; fn a() -> Self::Base;
@ -127,22 +124,22 @@ pub trait CurveAffine:
+ Sync + Sync
+ 'static + 'static
+ Debug + Debug
+ Add<Output = <Self as CurveAffine>::Projective> + Add<Output = <Self as CurveAffine>::Curve>
+ Sub<Output = <Self as CurveAffine>::Projective> + Sub<Output = <Self as CurveAffine>::Curve>
+ Mul<<Self as CurveAffine>::Scalar, Output = <Self as CurveAffine>::Projective> + Mul<<Self as CurveAffine>::Scalar, Output = <Self as CurveAffine>::Curve>
+ Neg<Output = Self> + Neg<Output = Self>
+ PartialEq + PartialEq
+ cmp::Eq + cmp::Eq
+ ConditionallySelectable + ConditionallySelectable
+ ConstantTimeEq + ConstantTimeEq
+ From<<Self as CurveAffine>::Projective> + From<<Self as CurveAffine>::Curve>
{ {
/// The representation of a point on this curve in the projective coordinate space. /// The representation of a point on this curve in the projective coordinate space.
type Projective: Curve< type Curve: Curve<
Affine = Self, Affine = Self,
Scalar = <Self as CurveAffine>::Scalar, Scalar = <Self as CurveAffine>::Scalar,
Base = <Self as CurveAffine>::Base, Base = <Self as CurveAffine>::Base,
> + Mul<<Self as CurveAffine>::Scalar, Output = <Self as CurveAffine>::Projective> > + Mul<<Self as CurveAffine>::Scalar, Output = <Self as CurveAffine>::Curve>
+ MulAssign<<Self as CurveAffine>::Scalar> + MulAssign<<Self as CurveAffine>::Scalar>
+ AddAssign<Self> + AddAssign<Self>
+ SubAssign<Self> + SubAssign<Self>
@ -160,16 +157,16 @@ pub trait CurveAffine:
const CURVE_ID: &'static str; const CURVE_ID: &'static str;
/// Obtains the additive identity. /// Obtains the additive identity.
fn zero() -> Self; fn identity() -> Self;
/// Obtains the base point of the curve. /// Obtains the base point of the curve.
fn one() -> Self; fn generator() -> Self;
/// Returns whether or not this element is the identity. /// Returns whether or not this element is the identity.
fn is_zero(&self) -> Choice; fn is_identity(&self) -> Choice;
/// Converts this element into its projective form. /// Converts this element into its projective form.
fn to_projective(&self) -> Self::Projective; fn to_curve(&self) -> Self::Curve;
/// Gets the $(x, y)$ coordinates of this point. /// Gets the $(x, y)$ coordinates of this point.
fn get_xy(&self) -> CtOption<(Self::Base, Self::Base)>; fn get_xy(&self) -> CtOption<(Self::Base, Self::Base)>;

4
src/pasta.rs
View file

@ -17,8 +17,8 @@ pub use fields::*;
fn test_endo_consistency() { fn test_endo_consistency() {
use crate::arithmetic::{Curve, FieldExt}; use crate::arithmetic::{Curve, FieldExt};
let a = pallas::Point::one(); let a = pallas::Point::generator();
assert_eq!(a * pallas::Scalar::ZETA, a.endo()); assert_eq!(a * pallas::Scalar::ZETA, a.endo());
let a = vesta::Point::one(); let a = vesta::Point::generator();
assert_eq!(a * vesta::Scalar::ZETA, a.endo()); assert_eq!(a * vesta::Scalar::ZETA, a.endo());
} }

88
src/pasta/curves.rs
View file

@ -57,7 +57,7 @@ macro_rules! new_curve_impl {
impl_projective_curve_specific!($name, $base, $curve_type); impl_projective_curve_specific!($name, $base, $curve_type);
fn zero() -> Self { fn identity() -> Self {
Self { Self {
x: $base::zero(), x: $base::zero(),
y: $base::zero(), y: $base::zero(),
@ -65,7 +65,7 @@ macro_rules! new_curve_impl {
} }
} }
fn is_zero(&self) -> Choice { fn is_identity(&self) -> Choice {
self.z.ct_is_zero() self.z.ct_is_zero()
} }
@ -82,7 +82,7 @@ macro_rules! new_curve_impl {
infinity: Choice::from(0u8), infinity: Choice::from(0u8),
}; };
$name_affine::conditional_select(&tmp, &$name_affine::zero(), zinv.ct_is_zero()) $name_affine::conditional_select(&tmp, &$name_affine::identity(), zinv.ct_is_zero())
} }
impl_projective_curve_ext!($name, $name_affine, $iso_affine, $base, $curve_type); impl_projective_curve_ext!($name, $name_affine, $iso_affine, $base, $curve_type);
@ -111,7 +111,7 @@ macro_rules! new_curve_impl {
| self.z.ct_is_zero() | self.z.ct_is_zero()
} }
fn batch_to_affine(p: &[Self], q: &mut [Self::Affine]) { fn batch_normalize(p: &[Self], q: &mut [Self::Affine]) {
assert_eq!(p.len(), q.len()); assert_eq!(p.len(), q.len());
let mut acc = $base::one(); let mut acc = $base::one();
@ -121,7 +121,7 @@ macro_rules! new_curve_impl {
q.x = acc; q.x = acc;
// We will end up skipping all identities in p // We will end up skipping all identities in p
acc = $base::conditional_select(&(acc * p.z), &acc, p.is_zero()); acc = $base::conditional_select(&(acc * p.z), &acc, p.is_identity());
} }
// This is the inverse, as all z-coordinates are nonzero and the ones // This is the inverse, as all z-coordinates are nonzero and the ones
@ -129,7 +129,7 @@ macro_rules! new_curve_impl {
acc = acc.invert().unwrap(); acc = acc.invert().unwrap();
for (p, q) in p.iter().rev().zip(q.iter_mut().rev()) { for (p, q) in p.iter().rev().zip(q.iter_mut().rev()) {
let skip = p.is_zero(); let skip = p.is_identity();
// Compute tmp = 1/z // Compute tmp = 1/z
let tmp = q.x * acc; let tmp = q.x * acc;
@ -145,7 +145,7 @@ macro_rules! new_curve_impl {
q.y = p.y * tmp3; q.y = p.y * tmp3;
q.infinity = Choice::from(0u8); q.infinity = Choice::from(0u8);
*q = $name_affine::conditional_select(&q, &$name_affine::zero(), skip); *q = $name_affine::conditional_select(&q, &$name_affine::identity(), skip);
} }
} }
@ -157,19 +157,19 @@ macro_rules! new_curve_impl {
impl<'a> From<&'a $name_affine> for $name { impl<'a> From<&'a $name_affine> for $name {
fn from(p: &'a $name_affine) -> $name { fn from(p: &'a $name_affine) -> $name {
p.to_projective() p.to_curve()
} }
} }
impl From<$name_affine> for $name { impl From<$name_affine> for $name {
fn from(p: $name_affine) -> $name { fn from(p: $name_affine) -> $name {
p.to_projective() p.to_curve()
} }
} }
impl Default for $name { impl Default for $name {
fn default() -> $name { fn default() -> $name {
$name::zero() $name::identity()
} }
} }
@ -186,8 +186,8 @@ macro_rules! new_curve_impl {
let z = z * self.z; let z = z * self.z;
let y2 = other.y * z; let y2 = other.y * z;
let self_is_zero = self.is_zero(); let self_is_zero = self.is_identity();
let other_is_zero = other.is_zero(); let other_is_zero = other.is_identity();
(self_is_zero & other_is_zero) // Both point at infinity (self_is_zero & other_is_zero) // Both point at infinity
| ((!self_is_zero) & (!other_is_zero) & x1.ct_eq(&x2) & y1.ct_eq(&y2)) | ((!self_is_zero) & (!other_is_zero) & x1.ct_eq(&x2) & y1.ct_eq(&y2))
@ -237,9 +237,9 @@ macro_rules! new_curve_impl {
type Output = $name; type Output = $name;
fn add(self, rhs: &'a $name) -> $name { fn add(self, rhs: &'a $name) -> $name {
if bool::from(self.is_zero()) { if bool::from(self.is_identity()) {
*rhs *rhs
} else if bool::from(rhs.is_zero()) { } else if bool::from(rhs.is_identity()) {
*self *self
} else { } else {
let z1z1 = self.z.square(); let z1z1 = self.z.square();
@ -253,7 +253,7 @@ macro_rules! new_curve_impl {
if s1 == s2 { if s1 == s2 {
self.double() self.double()
} else { } else {
$name::zero() $name::identity()
} }
} else { } else {
let h = u2 - u1; let h = u2 - u1;
@ -281,9 +281,9 @@ macro_rules! new_curve_impl {
type Output = $name; type Output = $name;
fn add(self, rhs: &'a $name_affine) -> $name { fn add(self, rhs: &'a $name_affine) -> $name {
if bool::from(self.is_zero()) { if bool::from(self.is_identity()) {
rhs.to_projective() rhs.to_curve()
} else if bool::from(rhs.is_zero()) { } else if bool::from(rhs.is_identity()) {
*self *self
} else { } else {
let z1z1 = self.z.square(); let z1z1 = self.z.square();
@ -294,7 +294,7 @@ macro_rules! new_curve_impl {
if self.y == s2 { if self.y == s2 {
self.double() self.double()
} else { } else {
$name::zero() $name::identity()
} }
} else { } else {
let h = u2 - self.x; let h = u2 - self.x;
@ -341,7 +341,7 @@ macro_rules! new_curve_impl {
fn mul(self, other: &'b $scalar) -> Self::Output { fn mul(self, other: &'b $scalar) -> Self::Output {
// TODO: make this faster // TODO: make this faster
let mut acc = $name::zero(); let mut acc = $name::identity();
// This is a simple double-and-add implementation of point // This is a simple double-and-add implementation of point
// multiplication, moving from most significant to least // multiplication, moving from most significant to least
@ -395,16 +395,16 @@ macro_rules! new_curve_impl {
type Output = $name; type Output = $name;
fn add(self, rhs: &'a $name_affine) -> $name { fn add(self, rhs: &'a $name_affine) -> $name {
if bool::from(self.is_zero()) { if bool::from(self.is_identity()) {
rhs.to_projective() rhs.to_curve()
} else if bool::from(rhs.is_zero()) { } else if bool::from(rhs.is_identity()) {
self.to_projective() self.to_curve()
} else { } else {
if self.x == rhs.x { if self.x == rhs.x {
if self.y == rhs.y { if self.y == rhs.y {
self.to_projective().double() self.to_curve().double()
} else { } else {
$name::zero() $name::identity()
} }
} else { } else {
let h = rhs.x - self.x; let h = rhs.x - self.x;
@ -451,7 +451,7 @@ macro_rules! new_curve_impl {
fn mul(self, other: &'b $scalar) -> Self::Output { fn mul(self, other: &'b $scalar) -> Self::Output {
// TODO: make this faster // TODO: make this faster
let mut acc = $name::zero(); let mut acc = $name::identity();
// This is a simple double-and-add implementation of point // This is a simple double-and-add implementation of point
// multiplication, moving from most significant to least // multiplication, moving from most significant to least
@ -474,7 +474,7 @@ macro_rules! new_curve_impl {
} }
impl CurveAffine for $name_affine { impl CurveAffine for $name_affine {
type Projective = $name; type Curve = $name;
type Scalar = $scalar; type Scalar = $scalar;
type Base = $base; type Base = $base;
@ -483,7 +483,7 @@ macro_rules! new_curve_impl {
impl_affine_curve_specific!($name, $base, $curve_type); impl_affine_curve_specific!($name, $base, $curve_type);
fn zero() -> Self { fn identity() -> Self {
Self { Self {
x: $base::zero(), x: $base::zero(),
y: $base::zero(), y: $base::zero(),
@ -491,7 +491,7 @@ macro_rules! new_curve_impl {
} }
} }
fn is_zero(&self) -> Choice { fn is_identity(&self) -> Choice {
self.infinity self.infinity
} }
@ -501,7 +501,7 @@ macro_rules! new_curve_impl {
| self.infinity | self.infinity
} }
fn to_projective(&self) -> Self::Projective { fn to_curve(&self) -> Self::Curve {
$name { $name {
x: self.x, x: self.x,
y: self.y, y: self.y,
@ -510,7 +510,7 @@ macro_rules! new_curve_impl {
} }
fn get_xy(&self) -> CtOption<(Self::Base, Self::Base)> { fn get_xy(&self) -> CtOption<(Self::Base, Self::Base)> {
CtOption::new((self.x, self.y), !self.is_zero()) CtOption::new((self.x, self.y), !self.is_identity())
} }
fn from_xy(x: Self::Base, y: Self::Base) -> CtOption<Self> { fn from_xy(x: Self::Base, y: Self::Base) -> CtOption<Self> {
@ -526,7 +526,7 @@ macro_rules! new_curve_impl {
tmp[31] &= 0b0111_1111; tmp[31] &= 0b0111_1111;
$base::from_bytes(&tmp).and_then(|x| { $base::from_bytes(&tmp).and_then(|x| {
CtOption::new(Self::zero(), x.ct_is_zero() & (!ysign)).or_else(|| { CtOption::new(Self::identity(), x.ct_is_zero() & (!ysign)).or_else(|| {
let x3 = x.square() * x; let x3 = x.square() * x;
(x3 + $name::curve_constant_b()).sqrt().and_then(|y| { (x3 + $name::curve_constant_b()).sqrt().and_then(|y| {
let sign = Choice::from(y.to_bytes()[0] & 1); let sign = Choice::from(y.to_bytes()[0] & 1);
@ -548,7 +548,7 @@ macro_rules! new_curve_impl {
fn to_bytes(&self) -> [u8; 32] { fn to_bytes(&self) -> [u8; 32] {
// TODO: not constant time // TODO: not constant time
if bool::from(self.is_zero()) { if bool::from(self.is_identity()) {
[0; 32] [0; 32]
} else { } else {
let (x, y) = (self.x, self.y); let (x, y) = (self.x, self.y);
@ -567,7 +567,7 @@ macro_rules! new_curve_impl {
$base::from_bytes(&xbytes).and_then(|x| { $base::from_bytes(&xbytes).and_then(|x| {
$base::from_bytes(&ybytes).and_then(|y| { $base::from_bytes(&ybytes).and_then(|y| {
CtOption::new(Self::zero(), x.ct_is_zero() & y.ct_is_zero()).or_else(|| { CtOption::new(Self::identity(), x.ct_is_zero() & y.ct_is_zero()).or_else(|| {
let on_curve = let on_curve =
(x * x.square() + $name::curve_constant_b()).ct_eq(&y.square()); (x * x.square() + $name::curve_constant_b()).ct_eq(&y.square());
@ -586,7 +586,7 @@ macro_rules! new_curve_impl {
fn to_bytes_wide(&self) -> [u8; 64] { fn to_bytes_wide(&self) -> [u8; 64] {
// TODO: not constant time // TODO: not constant time
if bool::from(self.is_zero()) { if bool::from(self.is_identity()) {
[0; 64] [0; 64]
} else { } else {
let mut out = [0u8; 64]; let mut out = [0u8; 64];
@ -608,7 +608,7 @@ macro_rules! new_curve_impl {
impl Default for $name_affine { impl Default for $name_affine {
fn default() -> $name_affine { fn default() -> $name_affine {
$name_affine::zero() $name_affine::identity()
} }
} }
@ -662,7 +662,7 @@ macro_rules! new_curve_impl {
type Scalar = $scalar; type Scalar = $scalar;
fn group_zero() -> Self { fn group_zero() -> Self {
Self::zero() Self::identity()
} }
fn group_add(&mut self, rhs: &Self) { fn group_add(&mut self, rhs: &Self) {
*self = *self + *rhs; *self = *self + *rhs;
@ -679,7 +679,7 @@ macro_rules! new_curve_impl {
macro_rules! impl_projective_curve_specific { macro_rules! impl_projective_curve_specific {
($name:ident, $base:ident, special_a0_b5) => { ($name:ident, $base:ident, special_a0_b5) => {
fn one() -> Self { fn generator() -> Self {
// NOTE: This is specific to b = 5 // NOTE: This is specific to b = 5
const NEGATIVE_ONE: $base = $base::neg(&$base::one()); const NEGATIVE_ONE: $base = $base::neg(&$base::one());
@ -720,12 +720,12 @@ macro_rules! impl_projective_curve_specific {
z: z3, z: z3,
}; };
$name::conditional_select(&tmp, &$name::zero(), self.is_zero()) $name::conditional_select(&tmp, &$name::identity(), self.is_identity())
} }
}; };
($name:ident, $base:ident, general) => { ($name:ident, $base:ident, general) => {
/// Unimplemented: there is no standard generator for this curve. /// Unimplemented: there is no standard generator for this curve.
fn one() -> Self { fn generator() -> Self {
unimplemented!() unimplemented!()
} }
@ -753,7 +753,7 @@ macro_rules! impl_projective_curve_specific {
z: z3, z: z3,
}; };
$name::conditional_select(&tmp, &$name::zero(), self.is_zero()) $name::conditional_select(&tmp, &$name::identity(), self.is_identity())
} }
}; };
} }
@ -810,7 +810,7 @@ macro_rules! impl_projective_curve_ext {
macro_rules! impl_affine_curve_specific { macro_rules! impl_affine_curve_specific {
($name:ident, $base:ident, special_a0_b5) => { ($name:ident, $base:ident, special_a0_b5) => {
fn one() -> Self { fn generator() -> Self {
// NOTE: This is specific to b = 5 // NOTE: This is specific to b = 5
const NEGATIVE_ONE: $base = $base::neg(&$base::from_raw([1, 0, 0, 0])); const NEGATIVE_ONE: $base = $base::neg(&$base::from_raw([1, 0, 0, 0]));
@ -825,7 +825,7 @@ macro_rules! impl_affine_curve_specific {
}; };
($name:ident, $base:ident, general) => { ($name:ident, $base:ident, general) => {
/// Unimplemented: there is no standard generator for this curve. /// Unimplemented: there is no standard generator for this curve.
fn one() -> Self { fn generator() -> Self {
unimplemented!() unimplemented!()
} }
}; };

10
src/pasta/hashtocurve.rs
View file

@ -73,9 +73,9 @@ pub fn hash_to_field<F: FieldExt>(
/// Implements a degree 3 isogeny map. /// Implements a degree 3 isogeny map.
pub fn iso_map<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAffine<Base = F>>( pub fn iso_map<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAffine<Base = F>>(
p: &I::Projective, p: &I::Curve,
iso: &[C::Base; 13], iso: &[C::Base; 13],
) -> C::Projective { ) -> C::Curve {
// The input and output are in Jacobian coordinates, using the method // The input and output are in Jacobian coordinates, using the method
// in "Avoiding inversions" [WB2019, section 4.3]. // in "Avoiding inversions" [WB2019, section 4.3].
@ -96,14 +96,14 @@ pub fn iso_map<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAffine<Base = F>>(
let xo = num_x * div_y * zo; let xo = num_x * div_y * zo;
let yo = num_y * div_x * zo.square(); let yo = num_y * div_x * zo.square();
C::Projective::new_jacobian(xo, yo, zo).unwrap() C::Curve::new_jacobian(xo, yo, zo).unwrap()
} }
pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAffine<Base = F>>( pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAffine<Base = F>>(
u: &F, u: &F,
theta: F, theta: F,
z: F, z: F,
) -> I::Projective { ) -> I::Curve {
// 1. tv1 = inv0(Z^2 * u^4 + Z * u^2) // 1. tv1 = inv0(Z^2 * u^4 + Z * u^2)
// 2. x1 = (-B / A) * (1 + tv1) // 2. x1 = (-B / A) * (1 + tv1)
// 3. If tv1 == 0, set x1 = B / (Z * A) // 3. If tv1 == 0, set x1 = B / (Z * A)
@ -171,5 +171,5 @@ pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAf
(u.get_lower_32() % 2).ct_eq(&(y.get_lower_32() % 2)), (u.get_lower_32() % 2).ct_eq(&(y.get_lower_32() % 2)),
); );
I::Projective::new_jacobian(num_x * div, y * div3, div).unwrap() I::Curve::new_jacobian(num_x * div, y * div3, div).unwrap()
} }

6
src/pasta/pallas.rs
View file

@ -91,11 +91,11 @@ fn test_iso_map_identity() {
.unwrap(); .unwrap();
let r = (r * -Fq::one()) + r; let r = (r * -Fq::one()) + r;
assert!(bool::from(r.is_on_curve())); assert!(bool::from(r.is_on_curve()));
assert!(bool::from(r.is_zero())); assert!(bool::from(r.is_identity()));
let p = let p =
super::hashtocurve::iso_map::<_, Affine, super::IsoEpAffine>(&r, &Ep::ISOGENY_CONSTANTS); super::hashtocurve::iso_map::<_, Affine, super::IsoEpAffine>(&r, &Ep::ISOGENY_CONSTANTS);
assert!(bool::from(p.is_on_curve())); assert!(bool::from(p.is_on_curve()));
assert!(bool::from(p.is_zero())); assert!(bool::from(p.is_identity()));
} }
#[test] #[test]
@ -157,5 +157,5 @@ fn test_hash_to_curve() {
let p = (p * -Fq::one()) + p; let p = (p * -Fq::one()) + p;
assert!(bool::from(p.is_on_curve())); assert!(bool::from(p.is_on_curve()));
assert!(bool::from(p.is_zero())); assert!(bool::from(p.is_identity()));
} }

2
src/plonk/lookup/prover.rs
View file

@ -87,7 +87,7 @@ impl<F: FieldExt> Argument<F> {
) -> Result<Permuted<C>, Error> ) -> Result<Permuted<C>, Error>
where where
C: CurveAffine<Scalar = F>, C: CurveAffine<Scalar = F>,
C::Projective: Mul<F, Output = C::Projective> + MulAssign<F>, C::Curve: Mul<F, Output = C::Curve> + MulAssign<F>,
{ {
// Closure to get values of expressions and compress them // Closure to get values of expressions and compress them
let compress_expressions = |expressions: &[Expression<C::Scalar>]| { let compress_expressions = |expressions: &[Expression<C::Scalar>]| {

12
src/plonk/prover.rs
View file

@ -52,11 +52,9 @@ pub fn create_proof<C: CurveAffine, T: TranscriptWrite<C>, ConcreteCircuit: Circ
.iter() .iter()
.map(|poly| params.commit_lagrange(poly, Blind::default())) .map(|poly| params.commit_lagrange(poly, Blind::default()))
.collect(); .collect();
let mut instance_commitments = vec![C::zero(); instance_commitments_projective.len()]; let mut instance_commitments =
C::Projective::batch_to_affine( vec![C::identity(); instance_commitments_projective.len()];
&instance_commitments_projective, C::Curve::batch_normalize(&instance_commitments_projective, &mut instance_commitments);
&mut instance_commitments,
);
let instance_commitments = instance_commitments; let instance_commitments = instance_commitments;
drop(instance_commitments_projective); drop(instance_commitments_projective);
metrics::counter!("instance_commitments", instance_commitments.len() as u64); metrics::counter!("instance_commitments", instance_commitments.len() as u64);
@ -206,8 +204,8 @@ pub fn create_proof<C: CurveAffine, T: TranscriptWrite<C>, ConcreteCircuit: Circ
.zip(advice_blinds.iter()) .zip(advice_blinds.iter())
.map(|(poly, blind)| params.commit_lagrange(poly, *blind)) .map(|(poly, blind)| params.commit_lagrange(poly, *blind))
.collect(); .collect();
let mut advice_commitments = vec![C::zero(); advice_commitments_projective.len()]; let mut advice_commitments = vec![C::identity(); advice_commitments_projective.len()];
C::Projective::batch_to_affine(&advice_commitments_projective, &mut advice_commitments); C::Curve::batch_normalize(&advice_commitments_projective, &mut advice_commitments);
let advice_commitments = advice_commitments; let advice_commitments = advice_commitments;
drop(advice_commitments_projective); drop(advice_commitments_projective);
metrics::counter!("advice_commitments", advice_commitments.len() as u64); metrics::counter!("advice_commitments", advice_commitments.len() as u64);

4
src/plonk/vanishing/prover.rs
View file

@ -50,8 +50,8 @@ impl<C: CurveAffine> Argument<C> {
.zip(h_blinds.iter()) .zip(h_blinds.iter())
.map(|(h_piece, blind)| params.commit(&h_piece, *blind)) .map(|(h_piece, blind)| params.commit(&h_piece, *blind))
.collect(); .collect();
let mut h_commitments = vec![C::zero(); h_commitments_projective.len()]; let mut h_commitments = vec![C::identity(); h_commitments_projective.len()];
C::Projective::batch_to_affine(&h_commitments_projective, &mut h_commitments); C::Curve::batch_normalize(&h_commitments_projective, &mut h_commitments);
let h_commitments = h_commitments; let h_commitments = h_commitments;
// Hash each h(X) piece // Hash each h(X) piece

16
src/poly/commitment.rs
View file

@ -60,7 +60,7 @@ impl<C: CurveAffine> Params<C> {
let g = { let g = {
let mut g = Vec::with_capacity(n as usize); let mut g = Vec::with_capacity(n as usize);
g.resize(n as usize, C::zero()); g.resize(n as usize, C::identity());
parallelize(&mut g, move |g, start| { parallelize(&mut g, move |g, start| {
let mut hasher = Blake2bParams::new() let mut hasher = Blake2bParams::new()
@ -87,7 +87,7 @@ impl<C: CurveAffine> Params<C> {
for _ in k..C::Scalar::S { for _ in k..C::Scalar::S {
alpha_inv = alpha_inv.square(); alpha_inv = alpha_inv.square();
} }
let mut g_lagrange_projective = g.iter().map(|g| g.to_projective()).collect::<Vec<_>>(); let mut g_lagrange_projective = g.iter().map(|g| g.to_curve()).collect::<Vec<_>>();
best_fft(&mut g_lagrange_projective, alpha_inv, k); best_fft(&mut g_lagrange_projective, alpha_inv, k);
let minv = C::Scalar::TWO_INV.pow_vartime(&[k as u64, 0, 0, 0]); let minv = C::Scalar::TWO_INV.pow_vartime(&[k as u64, 0, 0, 0]);
parallelize(&mut g_lagrange_projective, |g, _| { parallelize(&mut g_lagrange_projective, |g, _| {
@ -97,9 +97,9 @@ impl<C: CurveAffine> Params<C> {
}); });
let g_lagrange = { let g_lagrange = {
let mut g_lagrange = vec![C::zero(); n as usize]; let mut g_lagrange = vec![C::identity(); n as usize];
parallelize(&mut g_lagrange, |g_lagrange, starts| { parallelize(&mut g_lagrange, |g_lagrange, starts| {
C::Projective::batch_to_affine( C::Curve::batch_normalize(
&g_lagrange_projective[starts..(starts + g_lagrange.len())], &g_lagrange_projective[starts..(starts + g_lagrange.len())],
g_lagrange, g_lagrange,
); );
@ -141,11 +141,7 @@ impl<C: CurveAffine> Params<C> {
/// This computes a commitment to a polynomial described by the provided /// This computes a commitment to a polynomial described by the provided
/// slice of coefficients. The commitment will be blinded by the blinding /// slice of coefficients. The commitment will be blinded by the blinding
/// factor `r`. /// factor `r`.
pub fn commit( pub fn commit(&self, poly: &Polynomial<C::Scalar, Coeff>, r: Blind<C::Scalar>) -> C::Curve {
&self,
poly: &Polynomial<C::Scalar, Coeff>,
r: Blind<C::Scalar>,
) -> C::Projective {
metrics::increment_counter!("multiexp", "size" => format!("{}", poly.len() + 1), "fn" => "commit"); metrics::increment_counter!("multiexp", "size" => format!("{}", poly.len() + 1), "fn" => "commit");
let mut tmp_scalars = Vec::with_capacity(poly.len() + 1); let mut tmp_scalars = Vec::with_capacity(poly.len() + 1);
let mut tmp_bases = Vec::with_capacity(poly.len() + 1); let mut tmp_bases = Vec::with_capacity(poly.len() + 1);
@ -166,7 +162,7 @@ impl<C: CurveAffine> Params<C> {
&self, &self,
poly: &Polynomial<C::Scalar, LagrangeCoeff>, poly: &Polynomial<C::Scalar, LagrangeCoeff>,
r: Blind<C::Scalar>, r: Blind<C::Scalar>,
) -> C::Projective { ) -> C::Curve {
metrics::increment_counter!("multiexp", "size" => format!("{}", poly.len() + 1), "fn" => "commit_lagrange"); metrics::increment_counter!("multiexp", "size" => format!("{}", poly.len() + 1), "fn" => "commit_lagrange");
let mut tmp_scalars = Vec::with_capacity(poly.len() + 1); let mut tmp_scalars = Vec::with_capacity(poly.len() + 1);
let mut tmp_bases = Vec::with_capacity(poly.len() + 1); let mut tmp_bases = Vec::with_capacity(poly.len() + 1);

2
src/poly/commitment/msm.rs
View file

@ -144,6 +144,6 @@ impl<'a, C: CurveAffine> MSM<'a, C> {
assert_eq!(scalars.len(), len); assert_eq!(scalars.len(), len);
metrics::increment_counter!("multiexp", "size" => format!("{}", len), "fn" => "MSM::eval"); metrics::increment_counter!("multiexp", "size" => format!("{}", len), "fn" => "MSM::eval");
bool::from(best_multiexp(&scalars, &bases).is_zero()) bool::from(best_multiexp(&scalars, &bases).is_identity())
} }
} }

4
src/poly/commitment/prover.rs
View file

@ -152,8 +152,8 @@ fn parallel_generator_collapse<C: CurveAffine>(g: &mut [C], challenge: C::Scalar
let g_hi = &g_hi[start..]; let g_hi = &g_hi[start..];
let mut tmp = Vec::with_capacity(g_lo.len()); let mut tmp = Vec::with_capacity(g_lo.len());
for (g_lo, g_hi) in g_lo.iter().zip(g_hi.iter()) { for (g_lo, g_hi) in g_lo.iter().zip(g_hi.iter()) {
tmp.push(g_lo.to_projective() + &(*g_hi * challenge)); tmp.push(g_lo.to_curve() + &(*g_hi * challenge));
} }
C::Projective::batch_to_affine(&tmp, g_lo); C::Curve::batch_normalize(&tmp, g_lo);
}); });
} }