From 830941ff62af3b08c0405dc060ad8085d80fd9c6 Mon Sep 17 00:00:00 2001 From: str4d Date: Mon, 20 Dec 2021 17:57:09 +0000 Subject: [PATCH] deploy: 54cdc051fe71eb76cef2a9a4c8c60ee2965888bc --- design/circuit/gadgets/decomposition.html | 2 +- .../gadgets/ecc/fixed-base-scalar-mul.html | 9 +++---- .../gadgets/ecc/var-base-scalar-mul.html | 13 +++++----- print.html | 24 ++++++++++--------- searchindex.js | 2 +- searchindex.json | 2 +- 6 files changed, 28 insertions(+), 24 deletions(-) diff --git a/design/circuit/gadgets/decomposition.html b/design/circuit/gadgets/decomposition.html index dd8d1eb8..2ec1dd97 100644 --- a/design/circuit/gadgets/decomposition.html +++ b/design/circuit/gadgets/decomposition.html @@ -190,7 +190,7 @@

where and are the same cell (but distinguished here for clarity of usage).

Short range decomposition

-

For a short range (for instance, where ), we can range-constrain each word using a degree- polynomial constraint instead of a lookup:

+

For a short range (for instance, where ), we can range-constrain each word using a degree- polynomial constraint instead of a lookup:

diff --git a/design/circuit/gadgets/ecc/fixed-base-scalar-mul.html b/design/circuit/gadgets/ecc/fixed-base-scalar-mul.html index b8e7a1bb..638fcecb 100644 --- a/design/circuit/gadgets/ecc/fixed-base-scalar-mul.html +++ b/design/circuit/gadgets/ecc/fixed-base-scalar-mul.html @@ -181,15 +181,15 @@

The scalar multiplication will be computed correctly for representing any integer in the range .

We range-constrain each -bit word of the scalar decomposition using a polynomial range-check constraint: - -where

+ +where

Base field element

We support using a base field element as the scalar in fixed-base multiplication. This occurs, for example, in the scalar multiplication for the nullifier computation of the Action circuit : here, the scalar is the result of a base field addition.

Decompose the base field element into three-bit windows, and range-constrain each window, using the short range decomposition gadget in strict mode, with

If is witnessed directly then no issue of canonicity arises. However, because the scalar is given as a base field element here, care must be taken to ensure a canonical representation, since . That is, we must check that where the is Pallas base field modulus Note that

To do this, we decompose into three pieces:

We check the correctness of this decomposition by: - + If the MSB is not set, then However, in the case where , we must check: