Improvements to background section:

* describe groups in general, rather than via the example of F_p^*
* explain the isomorphism between group elements and scalars, and how it is useful
* corrections and pedantry :-)

Signed-off-by: Daira Hopwood <daira@jacaranda.org>

book/src/background/curves.md

@@ -1,6 +1,10 @@
 # Elliptic curves
 
 Elliptic curves constructed over finite fields are another important cryptographic tool.
+
+We use elliptic curves because they provide a cryptographic [group](fields.md#Inverses_and_groups),
+i.e. a group in which the [discrete logarithm problem](fields#) is hard.
+
 There are several ways to define the curve equation, but for our purposes, let
 $\mathbb{F}_p$ be a large (255-bit) field, and then let the set of solutions $(x, y)$ to
 $y^2 = x^3 + b$ for some constant $b$ define the $\mathbb{F}_p$-rational points on an
@@ -19,10 +23,10 @@ handling: we find the line tangent to the point, and then find the single other
 intersects this line and then negate. Otherwise, in the event that a point is being
 "added" to its negation, the result is the point at infinity.
 
-The ability to add and double points naturally gives us a way to scale them by integers.
-The number of points on the curve is known as the "group order". If this number is prime
-$q$, we call the numbers that we scale curve points by "scalars" and consider that they
-are all elements of a scalar field $\mathbb{F}_q$.
+The ability to add and double points naturally gives us a way to scale them by integers,
+called _scalars_. The number of points on the curve is the group order. If this number
+is a prime $q$, then the scalars can be considered as elements of a _scalar field_,
+$\mathbb{F}_q$.
 
 Elliptic curves, when properly designed, have an important security property. Given two
 random elements $G, H \in E(\mathbb{F}_p)$ finding $a$ such that $[a] G = H$, otherwise
@@ -30,6 +34,29 @@ known as the discrete log of $H$ with respect to $G$, is considered computationa
 infeasible with classical computers. This is called the elliptic curve discrete log
 assumption.
 
+If an elliptic curve group $\mathbb{G}$ has prime order $q$ (like the ones used in Halo),
+then it is a finite cyclic group. Recall from the section on [groups](fields.md#Groups)
+that this implies it is isomorphic to $\mathbb{Z}/q\mathbb{Z}$, or equivalently, to the
+scalar field $\mathbb{F}_q$. Each possible generator $G$ fixes the isomorphism; then
+an element on the scalar side is precisely the discrete log of the corresponding group
+element with respect to $G$. In the case of a cryptographically secure elliptic curve,
+the isomorphism is hard to compute in the $\mathbb{G} \rightarrow \mathbb{F}_q$ direction
+because the elliptic curve discrete log problem is hard.
+
+> It is sometimes helpful to make use of this isomorphism by thinking of group-based
+> cryptographic protocols and algorithms in terms of the scalars instead of in terms of
+> the group elements. This can make proofs and notation simpler.
+>
+> For instance, it has become common in papers on proof systems to use the notation $[x]$
+> to denote a group element with discrete log $x$, where the generator is implicit.
+>
+> We also used this idea in the
+> "[distinct-x theorem](https://zips.z.cash/protocol/protocol.pdf#thmdistinctx)",
+> in order to prove correctness of optimizations
+> [for elliptic curve scalar multiplication](https://github.com/zcash/zcash/issues/3924)
+> in Sapling, and an endomorphism-based optimization in Appendix C of the original
+> [Halo paper](https://eprint.iacr.org/2019/1021.pdf).
+
 ## Curve arithmetic
 
 ### Point doubling
@@ -37,7 +64,7 @@ assumption.
 The simplest situation is doubling a point $(x_0, y_0)$. Continuing with our example
 $y^2 = x^3 + b$, this is done first by computing the derivative
 $$
-\lambda = \frac{dy}{dx} = \frac{3x^2}{2y}.
+\lambda = \frac{\mathrm{d}y}{\mathrm{d}x} = \frac{3x^2}{2y}.
 $$
 
 To obtain expressions for $(x_1, y_1) = (x_0, y_0) + (x_0, y_0),$ we consider 

book/src/background/fields.md

@@ -37,22 +37,23 @@ Important notes:
   versa. We could also use whether or not an element is larger than $(p - 1) / 2$ to give
   it a "sign."
 
-## Inverses and groups
+Finite fields will be useful later for constructing [polynomials](polynomials.md) and
+[elliptic curves](curves.md). Elliptic curves are examples of groups, which we discuss
+next.
 
-Any non-zero element $a \in \mathbb{F}_p$ has a _multiplicative inverse_ $b = a^{-1}$,
-which is the _unique_ element $b$ such that $ab = 1$.
+## Groups
 
-A quick way of obtaining the inverse is $a^{-1} = a^{p - 2}$. The reason for this stems
-from [Fermat's little theorem][fermat-little], which states that $a^p = a \pmod p$ for any
-integer $a$. If $a$ is nonzero, we can divide by $a$ twice to get $a^{p-2} = a^{-1}.$
+Groups are simpler and more limited than fields; they have only one binary operator $\cdot$
+and fewer axioms. They also have an identity, which we'll denote as $1$.
 
-[fermat-little]: https://en.wikipedia.org/wiki/Fermat%27s_little_theorem
+[group]: https://en.wikipedia.org/wiki/Group_(mathematics)
+[group-axioms]: https://en.wikipedia.org/wiki/Group_(mathematics)#Definition
+
+Any non-zero element $a$ in a group has an _inverse_ $b = a^{-1}$,
+which is the _unique_ element $b$ such that $a \cdot b = 1$.
      
-However, it may be more intuitive to understand the set of nonzero elements of
-$\mathbb{F}_p$ as a [group], where the group operation is given by multiplication on the
-field. We use the notation $\mathbb{F}_p^\times$ for the multiplicative group over the set
-$\mathbb{F}_p - \{0\}$. Groups are simpler and more limited than fields; they
-have only _one_ operator $\cdot$ and fewer axioms.
+For example, the set of nonzero elements of $\mathbb{F}_p$ forms a group, where the
+group operation is given by multiplication on the field.
 
 [group]: https://en.wikipedia.org/wiki/Group_(mathematics)
 
@@ -60,9 +61,9 @@ have only _one_ operator $\cdot$ and fewer axioms.
 > If $\cdot$ is written as $+$ and the identity as $0$ or $\mathcal{O}$, then we say the
 > group is "written additively". If $\cdot$ is written as $\times$ or omitted (i.e.
 > $a \cdot b$ written as $ab$) and the identity as $1$, then we say it is "written
-> multiplicatively". It's conventional to use additive notation for
-> [elliptic curve groups](curves.md), and multiplicative notation when (as in this case)
-> the elements come from a finite field. When additive notation is used, we also write
+> multiplicatively". It's conventional to use additive notation for elliptic curve
+> groups, and multiplicative notation when the elements come from a finite field.
+> When additive notation is used, we also write
 >
 > $$[k] A = \underbrace{A + A + \cdots + A}_{k \text{ times}}$$
 >
@@ -77,20 +78,53 @@ have only _one_ operator $\cdot$ and fewer axioms.
 > scalars to negative integers by inversion, i.e. $[-k] A + [k] A = \mathcal{O}$ or
 > $a^{-k} \times a^k = 1$.
 
-The _order_ of a group element $a$ is defined (in multiplicative notation) as the smallest
-positive integer $k$ such that $a^k = 1$.
+The _order_ of an element $a$ of a finite group is defined (in multiplicative notation)
+as the smallest positive integer $k$ such that $a^k = 1$. The order _of the group_ is
+the number of elements, which (for finite groups) is also the maximum order of any element.
 
 Groups always have [generators] which are elements that, when the group operation is
 applied repeatedly with the same element some number of times, produce every other element
 of the group. That is, a generator has maximal order, which we also call the order of the
-group.
+group. There can be many different generators.
 
 [generators]: https://en.wikipedia.org/wiki/Generating_set_of_a_group
 
-There can be many different generators. Let's assume that $\alpha$ is a generator of
-$\mathbb{F}_p^\times$, so it has order $p-1$ (equal to the number of elements in
-$\mathbb{F}_p^\times$). Therefore, for any element in $a \in \mathbb{F}_p^\times$ there is
-a unique integer $i \in \{0..p-2\}$ such that $a = \alpha^i$.
+A group is called [cyclic] if the whole group can be generated by a (not necessarily
+unique) single element.
+
+Any finite cyclic group $\mathbb{G}$ of order $n$ is [isomorphic] to the integers
+modulo $n$ (denoted $\mathbb{Z}/n\mathbb{Z}$), such that:
+
+- the operation $\cdot$ in $\mathbb{G}$ corresponds to addition modulo $n$;
+- the identity $\mathcal{O} \in \mathbb{G}$ corresponds to $0$;
+- some generator $G \in \mathbb{G}$ corresponds to $1$.
+
+Given a generator $G$, the isomorphism is always easy to compute in the
+$\mathbb{Z}/n\mathbb{Z} \rightarrow \mathbb{G}$ direction; it is just $a \mapsto [a] G$.
+It may be difficult in general to compute in the $\mathbb{G} \rightarrow \mathbb{Z}/n\mathbb{Z}$
+direction; we'll discuss this further when we come to [elliptic curves](curves.md).
+
+If the order $n$ of a finite group is prime, then the group is cyclic, and every
+non-identity element is a generator.
+
+[isomorphic]: https://en.wikipedia.org/wiki/Isomorphism
+[cyclic]: https://en.wikipedia.org/wiki/Cyclic_group
+
+### The multiplicative group of a finite field
+
+We use the notation $\mathbb{F}_p^\times$ for the multiplicative group (i.e. the group
+operation is multiplication in $\mathbb{F}_p$) over the set $\mathbb{F}_p - \{0\}$.
+
+A quick way of obtaining the inverse in $\mathbb{F}_p^\times$ is $a^{-1} = a^{p - 2}$.
+The reason for this stems from [Fermat's little theorem][fermat-little], which states
+that $a^p = a \pmod p$ for any integer $a$. If $a$ is nonzero, we can divide by $a$ twice
+to get $a^{p-2} = a^{-1}.$
+
+[fermat-little]: https://en.wikipedia.org/wiki/Fermat%27s_little_theorem
+
+Let's assume that $\alpha$ is a generator of $\mathbb{F}_p^\times$, so it has order $p-1$
+(equal to the number of elements in $\mathbb{F}_p^\times$). Therefore, for any element in
+$a \in \mathbb{F}_p^\times$ there is a unique integer $i \in \{0..p-2\}$ such that $a = \alpha^i$.
 
 Notice that $a \times b$ where $a, b \in \mathbb{F}_p^\times$ can really be interpreted as
 $\alpha^i \times \alpha^j$ where $a = \alpha^i$ and $b = \alpha^j$. Indeed, it holds that
@@ -107,17 +141,19 @@ so $a^{p - 2} = a^{-1}$.
 
 ### Montgomery's Trick
 
-Montgomery's trick, named after Peter Montgomery (RIP) is a way to compute many field
-inversions at the same time. Imagine we need to compute the inverses of three nonzero
-elements $a, b, c \in \mathbb{F}_p$. Instead, we'll compute the products $x = ab$ and
-$y = xc = abc$, and compute the inversion
+Montgomery's trick, named after Peter Montgomery (RIP) is a way to compute many group
+inversions at the same time. It is commonly used to compute inversions in
+$\mathbb{F}_p^\times$, which are quite computationally expensive compared to multiplication.
+
+Imagine we need to compute the inverses of three nonzero elements $a, b, c \in \mathbb{F}_p^\times$.
+Instead, we'll compute the products $x = ab$ and $y = xc = abc$, and compute the inversion
 
 $$z = y^{p - 2} = \frac{1}{abc}.$$
 
 We can now multiply $z$ by $x$ to obtain $\frac{1}{c}$ and multiply $z$ by $c$ to obtain
 $\frac{1}{ab}$, which we can then multiply by $a, b$ to obtain their respective inverses.
 
-This technique generalizes to arbitrary numbers of field elements with just a single
+This technique generalizes to arbitrary numbers of group elements with just a single
 inversion necessary.
 
 ## Multiplicative subgroups