iter().rev() / (0..64).rev() double-ended range iterators have no Aeneas
model. Iteration order and arithmetic identical to upstream: limbs most- to
least-significant, bits high to low. Crate tests: 11/11 fp tests pass
(incl. test_inv, test_inv_2, test_pow_by_t_minus1_over2).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Introduce `deferred::Product<F>`, a wide 576-bit accumulator (8 limbs
+ 64-bit carry) that replaces the eager `Accumulator = Fp/Fq` in the
DeferredField implementations.
Products are accumulated via an internal `accumulate` method (no
public Add/AddAssign impls), ensuring carry overflow requires 2^64
operations. At reduction time, `partial_reduce` folds the carry and
top limb back into range using 2^512 ≡ R2 (mod p) and 2^448 ≡ B448
(mod p), producing a value < 2^449 < R*p that is safe for the
existing `montgomery_reduce`.
All existing DeferredField tests continue to pass unchanged—the lazy
accumulator is a drop-in replacement for the eager one.
Test the accumulation-based API for both Fp and Fq: single
mul/square round-trips, inner products at various lengths (0–10,000),
reduce-zero identity, square-vs-mul consistency, mixed mul+square
accumulation, and a regression test with adversarial limb values that
exercise the partial-reduction path.
All tests are written against the DeferredField trait API and will
continue to pass when the eager accumulator is swapped for a lazy one.
Add the `deferred` module with a `DeferredField` trait that enables
accumulating multiple unreduced products before performing a single
reduction. The trait uses an accumulation-based API: callers feed
factor pairs into an `Accumulator` via `mul_accumulate` /
`square_accumulate`, then call `reduce` once at the end.
For now, both Fp and Fq implement the trait with `Accumulator = Self`,
performing eager reduction on each accumulation. A later commit will
swap in a wide accumulator that defers reduction for real.
The module is feature-gated behind the `deferred` feature flag.
Pure refactor: the schoolbook multiplication and squaring bodies are
extracted into pub(crate) helper methods returning [u64; 8]. mul()
and square() now call through to these helpers followed by
montgomery_reduce(), preserving identical behaviour.
This separation makes the raw 512-bit product available for later
reuse (e.g. deferred reduction / inner-product accumulation) without
duplicating the arithmetic.
One, two! One, two! And through and through
The vorpal blade went snicker-snack!
He left it dead, and with its head
He went galumphing back.
Closeszcash/pasta_curves#42.
It was only present to enable an FFT implementation in `halo2_proofs`
that is generic over fields and groups, but we can replace it with an
equivalent trait in `halo2_proofs` that can have a blanket impl.
The traits of ec-gpu changed a bit, there's now also a `GpuName`
trait that needs to be implemented.
BREAKING CHANGE: `ec-gpu` v0.2 traits are not compatible with v0.1
All dependencies that use `ec-gpu` need to be on v0.2.
This commit introduces a new feature called "gpu", which enables an
`ec_gpu:GpuField` implementation of `Fp` and `Fq`. This enables the
field arithmetics to be run on a GPU.
The code to convert from a u64 to a u32 vector was taken from
07a84f9727/src/lib.rs (L102-L108)
Now that we have a default implementation of `SqrtRatio::sqrt_ratio`, we
can use it and `FieldExt` in no-std environments.
We introduce an `alloc` feature flag to form a common feature dependency
between `std` and `sqrt-table`. It is currently unused directly, but
will be used after `CurveAffine` is refactored to remove the `std`
dependency.
Closeszcash/pasta_curves#25.
