group: Return subtle::Choice from Group::is_identity

bellman/src/groth16/generator.rs

@@ -446,7 +446,7 @@ where
     // Don't allow any elements be unconstrained, so that
     // the L query is always fully dense.
     for e in l.iter() {
-        if e.is_identity() {
+        if e.is_identity().into() {
             return Err(SynthesisError::UnconstrainedVariable);
         }
     }
@@ -472,19 +472,19 @@ where
         // Filter points at infinity away from A/B queries
         a: Arc::new(
             a.into_iter()
-                .filter(|e| !e.is_identity())
+                .filter(|e| bool::from(!e.is_identity()))
                 .map(|e| e.into_affine())
                 .collect(),
         ),
         b_g1: Arc::new(
             b_g1.into_iter()
-                .filter(|e| !e.is_identity())
+                .filter(|e| bool::from(!e.is_identity()))
                 .map(|e| e.into_affine())
                 .collect(),
         ),
         b_g2: Arc::new(
             b_g2.into_iter()
-                .filter(|e| !e.is_identity())
+                .filter(|e| bool::from(!e.is_identity()))
                 .map(|e| e.into_affine())
                 .collect(),
         ),

bellman/src/groth16/tests/dummy_engine.rs

@@ -381,8 +381,8 @@ impl Group for Fr {
         <Fr as Field>::one()
     }
 
-    fn is_identity(&self) -> bool {
-        <Fr as Field>::is_zero(self)
+    fn is_identity(&self) -> Choice {
+        Choice::from(if <Fr as Field>::is_zero(self) { 1 } else { 0 })
     }
 
     fn double(&self) -> Self {

group/Cargo.toml

@@ -19,6 +19,7 @@ byteorder = { version = "1", default-features = false }
 ff = { version = "0.6", path = "../ff" }
 rand = "0.7"
 rand_xorshift = "0.2"
+subtle = { version = "2.2.1", default-features = false }
 
 [badges]
 maintenance = { status = "actively-developed" }

group/src/lib.rs

@@ -7,6 +7,7 @@ use std::error::Error;
 use std::fmt;
 use std::iter::Sum;
 use std::ops::{Add, AddAssign, Mul, MulAssign, Neg, Sub, SubAssign};
+use subtle::Choice;
 
 pub mod tests;
 
@@ -80,7 +81,7 @@ pub trait Group:
     fn generator() -> Self::Subgroup;
 
     /// Determines if this point is the identity.
-    fn is_identity(&self) -> bool;
+    fn is_identity(&self) -> Choice;
 
     /// Doubles this element.
     #[must_use]

group/src/tests/mod.rs

@@ -14,13 +14,13 @@ pub fn curve_tests<G: CurveProjective>() {
     // Negation edge case with identity.
     {
         let z = G::identity().neg();
-        assert!(z.is_identity());
+        assert!(bool::from(z.is_identity()));
     }
 
     // Doubling edge case with identity.
     {
         let z = G::identity().double();
-        assert!(z.is_identity());
+        assert!(bool::from(z.is_identity()));
     }
 
     // Addition edge cases with identity
@@ -34,9 +34,9 @@ pub fn curve_tests<G: CurveProjective>() {
 
         let mut z = G::identity();
         z.add_assign(&G::identity());
-        assert!(z.is_identity());
+        assert!(bool::from(z.is_identity()));
         z.add_assign(&G::Affine::identity());
-        assert!(z.is_identity());
+        assert!(bool::from(z.is_identity()));
 
         let mut z2 = z;
         z2.add_assign(&r);
@@ -208,11 +208,11 @@ fn random_negation_tests<G: CurveProjective>() {
 
         let mut t3 = t1;
         t3.add_assign(&t2);
-        assert!(t3.is_identity());
+        assert!(bool::from(t3.is_identity()));
 
         let mut t4 = t1;
         t4.add_assign(&t2.into_affine());
-        assert!(t4.is_identity());
+        assert!(bool::from(t4.is_identity()));
 
         assert_eq!(t1.neg(), t2);
     }

pairing/src/bls12_381/ec.rs

@@ -42,11 +42,11 @@ macro_rules! curve_impl {
 
         impl PartialEq for $projective {
             fn eq(&self, other: &$projective) -> bool {
-                if self.is_identity() {
-                    return other.is_identity();
+                if self.is_identity().into() {
+                    return other.is_identity().into();
                 }
 
-                if other.is_identity() {
+                if other.is_identity().into() {
                     return false;
                 }
 
@@ -126,7 +126,7 @@ macro_rules! curve_impl {
             }
 
             fn is_on_curve(&self) -> bool {
-                if self.is_identity() {
+                if self.is_identity().into() {
                     true
                 } else {
                     // Check that the point is on the curve
@@ -141,7 +141,7 @@ macro_rules! curve_impl {
             }
 
             fn is_in_correct_subgroup_assuming_on_curve(&self) -> bool {
-                self.mul($scalarfield::char()).is_identity()
+                self.mul($scalarfield::char()).is_identity().into()
             }
         }
 
@@ -151,7 +151,7 @@ macro_rules! curve_impl {
             #[inline]
             fn neg(self) -> Self {
                 let mut ret = self;
-                if !ret.is_identity() {
+                if bool::from(!ret.is_identity()) {
                     ret.y = ret.y.neg();
                 }
                 ret
@@ -223,7 +223,7 @@ macro_rules! curve_impl {
             #[inline]
             fn neg(self) -> Self {
                 let mut ret = self;
-                if !ret.is_identity() {
+                if bool::from(!ret.is_identity()) {
                     ret.y = ret.y.neg();
                 }
                 ret
@@ -252,12 +252,12 @@ macro_rules! curve_impl {
 
         impl<'r> ::std::ops::AddAssign<&'r $projective> for $projective {
             fn add_assign(&mut self, other: &Self) {
-                if self.is_identity() {
+                if self.is_identity().into() {
                     *self = *other;
                     return;
                 }
 
-                if other.is_identity() {
+                if other.is_identity().into() {
                     return;
                 }
 
@@ -401,11 +401,11 @@ macro_rules! curve_impl {
             for $projective
         {
             fn add_assign(&mut self, other: &<$projective as CurveProjective>::Affine) {
-                if other.is_identity() {
+                if other.is_identity().into() {
                     return;
                 }
 
-                if self.is_identity() {
+                if self.is_identity().into() {
                     self.x = other.x;
                     self.y = other.y;
                     self.z = $basefield::one();
@@ -579,7 +579,7 @@ macro_rules! curve_impl {
                     if p.is_some().into() {
                         let p = p.unwrap().scale_by_cofactor();
 
-                        if !p.is_identity() {
+                        if bool::from(!p.is_identity()) {
                             return p;
                         }
                     }
@@ -602,12 +602,12 @@ macro_rules! curve_impl {
 
             // The point at infinity is always represented by
             // Z = 0.
-            fn is_identity(&self) -> bool {
-                self.z.is_zero()
+            fn is_identity(&self) -> Choice {
+                Choice::from(if self.z.is_zero() { 1 } else { 0 })
             }
 
             fn double(&self) -> Self {
-                if self.is_identity() {
+                if self.is_identity().into() {
                     return *self;
                 }
 
@@ -662,7 +662,7 @@ macro_rules! curve_impl {
             type Affine = $affine;
 
             fn is_normalized(&self) -> bool {
-                self.is_identity() || self.z == $basefield::one()
+                self.is_identity().into() || self.z == $basefield::one()
             }
 
             fn batch_normalization(v: &mut [Self]) {
@@ -737,7 +737,7 @@ macro_rules! curve_impl {
         // coordinates with Z = 1.
         impl From<$affine> for $projective {
             fn from(p: $affine) -> $projective {
-                if p.is_identity() {
+                if p.is_identity().into() {
                     $projective::identity()
                 } else {
                     $projective {
@@ -753,7 +753,7 @@ macro_rules! curve_impl {
         // coordinates as X/Z^2, Y/Z^3.
         impl From<$projective> for $affine {
             fn from(p: $projective) -> $affine {
-                if p.is_identity() {
+                if p.is_identity().into() {
                     $affine::identity()
                 } else if p.z == $basefield::one() {
                     // If Z is one, the point is already normalized.
@@ -798,7 +798,7 @@ pub mod g1 {
     use rand_core::RngCore;
     use std::fmt;
     use std::ops::{AddAssign, MulAssign, Neg, SubAssign};
-    use subtle::CtOption;
+    use subtle::{Choice, CtOption};
 
     curve_impl!(
         "G1",
@@ -1114,7 +1114,7 @@ pub mod g1 {
                 assert!(!p.is_in_correct_subgroup_assuming_on_curve());
 
                 let g1 = p.scale_by_cofactor();
-                if !g1.is_identity() {
+                if bool::from(!g1.is_identity()) {
                     assert_eq!(i, 4);
                     let g1 = G1Affine::from(g1);
 
@@ -1408,7 +1408,7 @@ pub mod g2 {
     use rand_core::RngCore;
     use std::fmt;
     use std::ops::{AddAssign, MulAssign, Neg, SubAssign};
-    use subtle::CtOption;
+    use subtle::{Choice, CtOption};
 
     curve_impl!(
         "G2",
@@ -1767,7 +1767,7 @@ pub mod g2 {
                 assert!(!p.is_in_correct_subgroup_assuming_on_curve());
 
                 let g2 = p.scale_by_cofactor();
-                if !g2.is_identity() {
+                if bool::from(!g2.is_identity()) {
                     assert_eq!(i, 2);
                     let g2 = G2Affine::from(g2);