Squashed 'src/snark/' content from commit 9ada3f8
git-subtree-dir: src/snark git-subtree-split: 9ada3f84ab484c57b2247c2f41091fd6a0916573
This commit is contained in:
commit
51e448641d
|
@ -0,0 +1,49 @@
|
|||
*.o
|
||||
*.a
|
||||
*.so
|
||||
*.d
|
||||
depinst/
|
||||
depsrc/
|
||||
README.html
|
||||
doxygen/
|
||||
src/gadgetlib2/examples/tutorial
|
||||
src/gadgetlib2/tests/gadgetlib2_test
|
||||
|
||||
src/algebra/curves/tests/test_bilinearity
|
||||
src/algebra/curves/tests/test_groups
|
||||
src/algebra/fields/tests/test_fields
|
||||
src/common/routing_algorithms/profiling/profile_routing_algorithms
|
||||
src/common/routing_algorithms/tests/test_routing_algorithms
|
||||
src/gadgetlib1/gadgets/cpu_checkers/fooram/examples/test_fooram
|
||||
src/gadgetlib1/gadgets/hashes/knapsack/tests/test_knapsack_gadget
|
||||
src/gadgetlib1/gadgets/hashes/sha256/tests/test_sha256_gadget
|
||||
src/gadgetlib1/gadgets/merkle_tree/tests/test_merkle_tree_gadgets
|
||||
src/gadgetlib1/gadgets/routing/profiling/profile_routing_gadgets
|
||||
src/gadgetlib1/gadgets/set_commitment/tests/test_set_commitment_gadget
|
||||
src/gadgetlib1/gadgets/verifiers/tests/test_r1cs_ppzksnark_verifier_gadget
|
||||
src/reductions/ram_to_r1cs/examples/demo_arithmetization
|
||||
src/relations/arithmetic_programs/qap/tests/test_qap
|
||||
src/relations/arithmetic_programs/ssp/tests/test_ssp
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_mp_ppzkpcd/profiling/profile_r1cs_mp_ppzkpcd
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_mp_ppzkpcd/tests/test_r1cs_mp_ppzkpcd
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_sp_ppzkpcd/profiling/profile_r1cs_sp_ppzkpcd
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_sp_ppzkpcd/tests/test_r1cs_sp_ppzkpcd
|
||||
src/zk_proof_systems/ppzkadsnark/r1cs_ppzkadsnark/examples/demo_r1cs_ppzkadsnark
|
||||
src/zk_proof_systems/ppzksnark/bacs_ppzksnark/profiling/profile_bacs_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/bacs_ppzksnark/tests/test_bacs_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/r1cs_gg_ppzksnark/profiling/profile_r1cs_gg_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/r1cs_gg_ppzksnark/tests/test_r1cs_gg_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/r1cs_ppzksnark/profiling/profile_r1cs_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/r1cs_ppzksnark/tests/test_r1cs_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark_generator
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark_prover
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark_verifier
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/profiling/profile_ram_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/tests/test_ram_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/tbcs_ppzksnark/profiling/profile_tbcs_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/tbcs_ppzksnark/tests/test_tbcs_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/uscs_ppzksnark/profiling/profile_uscs_ppzksnark
|
||||
src/zk_proof_systems/ppzksnark/uscs_ppzksnark/tests/test_uscs_ppzksnark
|
||||
src/zk_proof_systems/zksnark/ram_zksnark/profiling/profile_ram_zksnark
|
||||
src/zk_proof_systems/zksnark/ram_zksnark/tests/test_ram_zksnark
|
|
@ -0,0 +1,19 @@
|
|||
SCIPR Lab:
|
||||
Eli Ben-Sasson
|
||||
Alessandro Chiesa
|
||||
Daniel Genkin
|
||||
Shaul Kfir
|
||||
Eran Tromer
|
||||
Madars Virza
|
||||
|
||||
External contributors:
|
||||
Michael Backes
|
||||
Manuel Barbosa
|
||||
Dario Fiore
|
||||
Jens Groth
|
||||
Joshua A. Kroll
|
||||
Shigeo MITSUNARI
|
||||
Raphael Reischuk
|
||||
Tadanori TERUYA
|
||||
Sean Bowe
|
||||
Daira Hopwood
|
|
@ -0,0 +1,24 @@
|
|||
The libsnark library is developed by SCIPR Lab (http://scipr-lab.org)
|
||||
and contributors.
|
||||
|
||||
Copyright (c) 2012-2014 SCIPR Lab and contributors (see AUTHORS file).
|
||||
|
||||
All files, with the exceptions below, are released under the MIT License:
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
|
@ -0,0 +1,277 @@
|
|||
#********************************************************************************
|
||||
# Makefile for the libsnark library.
|
||||
#********************************************************************************
|
||||
#* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
#* and contributors (see AUTHORS).
|
||||
#* @copyright MIT license (see LICENSE file)
|
||||
#*******************************************************************************/
|
||||
|
||||
# To override these, use "make OPTFLAGS=..." etc.
|
||||
CURVE = BN128
|
||||
OPTFLAGS = -O2 -march=native -mtune=native
|
||||
FEATUREFLAGS = -DUSE_ASM -DMONTGOMERY_OUTPUT
|
||||
|
||||
# Initialize this using "CXXFLAGS=... make". The makefile appends to that.
|
||||
CXXFLAGS += -std=c++11 -Wall -Wextra -Wno-unused-parameter -Wno-comment -Wfatal-errors $(OPTFLAGS) $(FEATUREFLAGS) -DCURVE_$(CURVE)
|
||||
|
||||
DEPSRC = depsrc
|
||||
DEPINST = depinst
|
||||
|
||||
CXXFLAGS += -I$(DEPINST)/include -Isrc
|
||||
LDFLAGS += -L$(DEPINST)/lib -Wl,-rpath,$(DEPINST)/lib
|
||||
LDLIBS += -lgmpxx -lgmp -lboost_program_options
|
||||
# OpenSSL and its dependencies (needed explicitly for static builds):
|
||||
LDLIBS += -lcrypto -ldl -lz
|
||||
# List of .a files to include within libsnark.a and libsnark.so:
|
||||
AR_LIBS =
|
||||
# List of library files to install:
|
||||
INSTALL_LIBS = $(LIB_FILE)
|
||||
# Sentinel file to check existence of this directory (since directories don't work as a Make dependency):
|
||||
DEPINST_EXISTS = $(DEPINST)/.exists
|
||||
|
||||
|
||||
COMPILE_GTEST :=
|
||||
ifneq ($(NO_GTEST),1)
|
||||
GTESTDIR=/usr/src/gtest
|
||||
# Compile GTest from sourcecode if we can (e.g., Ubuntu). Otherwise use precompiled one (e.g., Fedora).
|
||||
# See https://code.google.com/p/googletest/wiki/FAQ#Why_is_it_not_recommended_to_install_a_pre-compiled_copy_of_Goog .
|
||||
COMPILE_GTEST :=$(shell test -d $(GTESTDIR) && echo -n 1)
|
||||
GTEST_LDLIBS += -lgtest -lpthread
|
||||
endif
|
||||
|
||||
ifneq ($(NO_SUPERCOP),1)
|
||||
SUPERCOP_LDLIBS += -lsupercop
|
||||
INSTALL_LIBS += depinst/lib/libsupercop.a
|
||||
# Would have been nicer to roll supercop into libsnark.a ("AR_LIBS += $(DEPINST)/lib/libsupercop.a"), but it doesn't support position-independent code (libsnark issue #20).
|
||||
endif
|
||||
|
||||
LIB_SRCS = \
|
||||
src/algebra/curves/alt_bn128/alt_bn128_g1.cpp \
|
||||
src/algebra/curves/alt_bn128/alt_bn128_g2.cpp \
|
||||
src/algebra/curves/alt_bn128/alt_bn128_init.cpp \
|
||||
src/algebra/curves/alt_bn128/alt_bn128_pairing.cpp \
|
||||
src/algebra/curves/alt_bn128/alt_bn128_pp.cpp \
|
||||
src/common/profiling.cpp \
|
||||
src/common/utils.cpp \
|
||||
src/gadgetlib1/constraint_profiling.cpp \
|
||||
|
||||
ifeq ($(CURVE),BN128)
|
||||
LIB_SRCS += \
|
||||
src/algebra/curves/bn128/bn128_g1.cpp \
|
||||
src/algebra/curves/bn128/bn128_g2.cpp \
|
||||
src/algebra/curves/bn128/bn128_gt.cpp \
|
||||
src/algebra/curves/bn128/bn128_init.cpp \
|
||||
src/algebra/curves/bn128/bn128_pairing.cpp \
|
||||
src/algebra/curves/bn128/bn128_pp.cpp
|
||||
|
||||
CXXFLAGS += -DBN_SUPPORT_SNARK
|
||||
AR_LIBS += $(DEPINST)/lib/libzm.a
|
||||
endif
|
||||
|
||||
# FIXME: most of these are broken due to removed code.
|
||||
DISABLED_EXECUTABLES = \
|
||||
src/algebra/curves/tests/test_bilinearity \
|
||||
src/algebra/curves/tests/test_groups \
|
||||
src/algebra/fields/tests/test_fields \
|
||||
src/common/routing_algorithms/profiling/profile_routing_algorithms \
|
||||
src/common/routing_algorithms/tests/test_routing_algorithms \
|
||||
src/gadgetlib1/gadgets/cpu_checkers/fooram/examples/test_fooram \
|
||||
src/gadgetlib1/gadgets/hashes/knapsack/tests/test_knapsack_gadget \
|
||||
src/gadgetlib1/gadgets/hashes/sha256/tests/test_sha256_gadget \
|
||||
src/gadgetlib1/gadgets/merkle_tree/tests/test_merkle_tree_gadgets \
|
||||
src/gadgetlib1/gadgets/routing/profiling/profile_routing_gadgets \
|
||||
src/gadgetlib1/gadgets/set_commitment/tests/test_set_commitment_gadget \
|
||||
src/gadgetlib1/gadgets/verifiers/tests/test_r1cs_ppzksnark_verifier_gadget \
|
||||
src/reductions/ram_to_r1cs/examples/demo_arithmetization \
|
||||
src/relations/arithmetic_programs/qap/tests/test_qap \
|
||||
src/relations/arithmetic_programs/ssp/tests/test_ssp \
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_mp_ppzkpcd/profiling/profile_r1cs_mp_ppzkpcd \
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_mp_ppzkpcd/tests/test_r1cs_mp_ppzkpcd \
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_sp_ppzkpcd/profiling/profile_r1cs_sp_ppzkpcd \
|
||||
src/zk_proof_systems/pcd/r1cs_pcd/r1cs_sp_ppzkpcd/tests/test_r1cs_sp_ppzkpcd \
|
||||
src/zk_proof_systems/ppzksnark/bacs_ppzksnark/profiling/profile_bacs_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/bacs_ppzksnark/tests/test_bacs_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/r1cs_gg_ppzksnark/profiling/profile_r1cs_gg_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/r1cs_gg_ppzksnark/tests/test_r1cs_gg_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/r1cs_ppzksnark/profiling/profile_r1cs_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/r1cs_ppzksnark/tests/test_r1cs_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark_generator \
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark_prover \
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/examples/demo_ram_ppzksnark_verifier \
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/profiling/profile_ram_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/ram_ppzksnark/tests/test_ram_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/tbcs_ppzksnark/profiling/profile_tbcs_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/tbcs_ppzksnark/tests/test_tbcs_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/uscs_ppzksnark/profiling/profile_uscs_ppzksnark \
|
||||
src/zk_proof_systems/ppzksnark/uscs_ppzksnark/tests/test_uscs_ppzksnark \
|
||||
src/zk_proof_systems/zksnark/ram_zksnark/profiling/profile_ram_zksnark \
|
||||
src/zk_proof_systems/zksnark/ram_zksnark/tests/test_ram_zksnark
|
||||
|
||||
EXECUTABLES = \
|
||||
src/algebra/fields/tests/test_bigint
|
||||
|
||||
EXECUTABLES_WITH_GTEST = \
|
||||
src/gadgetlib2/examples/tutorial \
|
||||
src/gadgetlib2/tests/gadgetlib2_test
|
||||
|
||||
EXECUTABLES_WITH_SUPERCOP = \
|
||||
src/zk_proof_systems/ppzkadsnark/r1cs_ppzkadsnark/examples/demo_r1cs_ppzkadsnark
|
||||
|
||||
DOCS = README.html
|
||||
|
||||
LIBSNARK_A = libsnark.a
|
||||
|
||||
# For documentation of the following options, see README.md .
|
||||
|
||||
ifeq ($(NO_PROCPS),1)
|
||||
CXXFLAGS += -DNO_PROCPS
|
||||
else
|
||||
LDLIBS += -lprocps
|
||||
endif
|
||||
|
||||
ifeq ($(LOWMEM),1)
|
||||
CXXFLAGS += -DLOWMEM
|
||||
endif
|
||||
|
||||
ifeq ($(PROFILE_OP_COUNTS),1)
|
||||
STATIC = 1
|
||||
CXXFLAGS += -DPROFILE_OP_COUNTS
|
||||
endif
|
||||
|
||||
ifeq ($(STATIC),1)
|
||||
CXXFLAGS += -static -DSTATIC
|
||||
else
|
||||
CXXFLAGS += -fPIC
|
||||
endif
|
||||
|
||||
ifeq ($(MULTICORE),1)
|
||||
CXXFLAGS += -DMULTICORE -fopenmp
|
||||
endif
|
||||
|
||||
ifeq ($(CPPDEBUG),1)
|
||||
CXXFLAGS += -D_GLIBCXX_DEBUG -D_GLIBCXX_DEBUG_PEDANTIC
|
||||
DEBUG = 1
|
||||
endif
|
||||
|
||||
ifeq ($(DEBUG),1)
|
||||
CXXFLAGS += -DDEBUG -ggdb3
|
||||
endif
|
||||
|
||||
ifeq ($(PERFORMANCE),1)
|
||||
OPTFLAGS = -O3 -march=native -mtune=native
|
||||
CXXFLAGS += -DNDEBUG
|
||||
# Enable link-time optimization:
|
||||
CXXFLAGS += -flto -fuse-linker-plugin
|
||||
LDFLAGS += -flto
|
||||
endif
|
||||
|
||||
LIB_OBJS =$(patsubst %.cpp,%.o,$(LIB_SRCS))
|
||||
EXEC_OBJS =$(patsubst %,%.o,$(EXECUTABLES) $(EXECUTABLES_WITH_GTEST) $(EXECUTABLES_WITH_SUPERCOP))
|
||||
|
||||
all: \
|
||||
$(if $(NO_GTEST),,$(EXECUTABLES_WITH_GTEST)) \
|
||||
$(if $(NO_SUPERCOP),,$(EXECUTABLES_WITH_SUPERCOP)) \
|
||||
$(EXECUTABLES) \
|
||||
$(if $(NO_DOCS),,doc)
|
||||
|
||||
doc: $(DOCS)
|
||||
|
||||
$(DEPINST_EXISTS):
|
||||
# Create placeholder directories for installed dependencies. Some make settings (including the default) require actually running ./prepare-depends.sh to populate this directory.
|
||||
mkdir -p $(DEPINST)/lib $(DEPINST)/include
|
||||
touch $@
|
||||
|
||||
# In order to detect changes to #include dependencies. -MMD below generates a .d file for each .o file. Include the .d file.
|
||||
-include $(patsubst %.o,%.d, $(LIB_OBJS) $(EXEC_OBJS) )
|
||||
|
||||
$(LIB_OBJS) $(EXEC_OBJS): %.o: %.cpp
|
||||
$(CXX) -o $@ $< -c -MMD $(CXXFLAGS)
|
||||
|
||||
LIBGTEST_A = $(DEPINST)/lib/libgtest.a
|
||||
|
||||
$(LIBGTEST_A): $(GTESTDIR)/src/gtest-all.cc $(DEPINST_EXISTS)
|
||||
$(CXX) -o $(DEPINST)/lib/gtest-all.o -I $(GTESTDIR) -c -isystem $(GTESTDIR)/include $< $(CXXFLAGS)
|
||||
$(AR) -rv $(LIBGTEST_A) $(DEPINST)/lib/gtest-all.o
|
||||
|
||||
# libsnark.a will contains all of our relevant object files, and we also mash in the .a files of relevant dependencies built by ./prepare-depends.sh
|
||||
$(LIBSNARK_A): $(LIB_OBJS) $(AR_LIBS)
|
||||
( \
|
||||
echo "create $(LIBSNARK_A)"; \
|
||||
echo "addmod $(LIB_OBJS)"; \
|
||||
if [ -n "$(AR_LIBS)" ]; then for AR_LIB in $(AR_LIBS); do echo addlib $$AR_LIB; done; fi; \
|
||||
echo "save"; \
|
||||
echo "end"; \
|
||||
) | $(AR) -M
|
||||
$(AR) s $(LIBSNARK_A)
|
||||
|
||||
libsnark.so: $(LIBSNARK_A) $(DEPINST_EXISTS)
|
||||
$(CXX) -o $@ --shared -Wl,--whole-archive $(LIBSNARK_A) $(CXXFLAGS) $(LDFLAGS) -Wl,--no-whole-archive $(LDLIBS)
|
||||
|
||||
src/gadgetlib2/tests/gadgetlib2_test: \
|
||||
src/gadgetlib2/tests/adapters_UTEST.cpp \
|
||||
src/gadgetlib2/tests/constraint_UTEST.cpp \
|
||||
src/gadgetlib2/tests/gadget_UTEST.cpp \
|
||||
src/gadgetlib2/tests/integration_UTEST.cpp \
|
||||
src/gadgetlib2/tests/protoboard_UTEST.cpp \
|
||||
src/gadgetlib2/tests/variable_UTEST.cpp
|
||||
|
||||
$(EXECUTABLES): %: %.o $(LIBSNARK_A) $(DEPINST_EXISTS)
|
||||
$(CXX) -o $@ $@.o $(LIBSNARK_A) $(CXXFLAGS) $(LDFLAGS) $(LDLIBS)
|
||||
|
||||
$(EXECUTABLES_WITH_GTEST): %: %.o $(LIBSNARK_A) $(if $(COMPILE_GTEST),$(LIBGTEST_A)) $(DEPINST_EXISTS)
|
||||
$(CXX) -o $@ $@.o $(LIBSNARK_A) $(CXXFLAGS) $(LDFLAGS) $(GTEST_LDLIBS) $(LDLIBS)
|
||||
|
||||
$(EXECUTABLES_WITH_SUPERCOP): %: %.o $(LIBSNARK_A) $(DEPINST_EXISTS)
|
||||
$(CXX) -o $@ $@.o $(LIBSNARK_A) $(CXXFLAGS) $(LDFLAGS) $(SUPERCOP_LDLIBS) $(LDLIBS)
|
||||
|
||||
|
||||
ifeq ($(STATIC),1)
|
||||
LIB_FILE = $(LIBSNARK_A)
|
||||
else
|
||||
LIB_FILE = libsnark.so
|
||||
endif
|
||||
|
||||
lib: $(LIB_FILE)
|
||||
|
||||
$(DOCS): %.html: %.md
|
||||
markdown_py -f $@ $^ -x toc -x extra --noisy
|
||||
# TODO: Would be nice to enable "-x smartypants" but Ubuntu 12.04 doesn't support that.
|
||||
# TODO: switch to redcarpet, to produce same output as GitHub's processing of README.md. But what about TOC?
|
||||
|
||||
ifeq ($(PREFIX),)
|
||||
install:
|
||||
$(error Please provide PREFIX. E.g. make install PREFIX=/usr)
|
||||
else
|
||||
HEADERS_SRC=$(shell find src -name '*.hpp' -o -name '*.tcc')
|
||||
HEADERS_DEST=$(patsubst src/%,$(PREFIX)/include/libsnark/%,$(HEADERS_SRC))
|
||||
|
||||
$(HEADERS_DEST): $(PREFIX)/include/libsnark/%: src/%
|
||||
mkdir -p $(shell dirname $@)
|
||||
cp $< $@
|
||||
|
||||
install: $(INSTALL_LIBS) $(HEADERS_DEST) $(DEPINST_EXISTS)
|
||||
mkdir -p $(PREFIX)/lib
|
||||
cp -v $(INSTALL_LIBS) $(PREFIX)/lib/
|
||||
cp -rv $(DEPINST)/include $(PREFIX)
|
||||
endif
|
||||
|
||||
doxy:
|
||||
doxygen doxygen.conf
|
||||
|
||||
# Clean generated files, except locally-compiled dependencies
|
||||
clean:
|
||||
$(RM) \
|
||||
$(LIB_OBJS) $(EXEC_OBJS) \
|
||||
$(EXECUTABLES) $(EXECUTABLES_WITH_GTEST) $(EXECUTABLES_WITH_SUPERCOP) \
|
||||
$(DOCS) \
|
||||
${patsubst %.o,%.d,${LIB_OBJS} ${EXEC_OBJS}} \
|
||||
libsnark.so $(LIBSNARK_A) \
|
||||
$(RM) -fr doxygen/ \
|
||||
$(RM) $(LIBGTEST_A) $(DEPINST)/lib/gtest-all.o
|
||||
|
||||
# Clean all, including locally-compiled dependencies
|
||||
clean-all: clean
|
||||
$(RM) -fr $(DEPSRC) $(DEPINST)
|
||||
|
||||
.PHONY: all clean clean-all doc doxy lib install
|
|
@ -0,0 +1,628 @@
|
|||
libsnark: a C++ library for zkSNARK proofs
|
||||
================================================================================
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Authors
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The libsnark library is developed by the [SCIPR Lab] project and contributors
|
||||
and is released under the MIT License (see the [LICENSE] file).
|
||||
|
||||
Copyright (c) 2012-2014 SCIPR Lab and contributors (see [AUTHORS] file).
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
[TOC]
|
||||
|
||||
<!---
|
||||
NOTE: the file you are reading is in Markdown format, which is is fairly readable
|
||||
directly, but can be converted into an HTML file with much nicer formatting.
|
||||
To do so, run "make doc" (this requires the python-markdown package) and view
|
||||
the resulting file README.html. Alternatively, view the latest HTML version at
|
||||
https://github.com/scipr-lab/libsnark .
|
||||
-->
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Overview
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
This library implements __zkSNARK__ schemes, which are a cryptographic method
|
||||
for proving/verifying, in zero knowledge, the integrity of computations.
|
||||
|
||||
A computation can be expressed as an NP statement, in forms such as the following:
|
||||
|
||||
- "The C program _foo_, when executed, returns exit code 0 if given the input _bar_ and some additional input _qux_."
|
||||
- "The Boolean circuit _foo_ is satisfiable by some input _qux_."
|
||||
- "The arithmetic circuit _foo_ accepts the partial assignment _bar_, when extended into some full assignment _qux_."
|
||||
- "The set of constraints _foo_ is satisfiable by the partial assignment _bar_, when extended into some full assignment _qux_."
|
||||
|
||||
A prover who knows the witness for the NP statement (i.e., a satisfying input/assignment) can produce a short proof attesting to the truth of the NP statement. This proof can be verified by anyone, and offers the following properties.
|
||||
|
||||
- __Zero knowledge:__
|
||||
the verifier learns nothing from the proof beside the truth of the statement (i.e., the value _qux_, in the above examples, remains secret).
|
||||
- __Succinctness:__
|
||||
the proof is short and easy to verify.
|
||||
- __Non-interactivity:__
|
||||
the proof is a string (i.e. it does not require back-and-forth interaction between the prover and the verifier).
|
||||
- __Soundness:__
|
||||
the proof is computationally sound (i.e., it is infeasible to fake a proof of a false NP statement). Such a proof system is also called an _argument_.
|
||||
- __Proof of knowledge:__
|
||||
the proof attests not just that the NP statement is true, but also that the
|
||||
prover knows why (e.g., knows a valid _qux_).
|
||||
|
||||
These properties are summarized by the _zkSNARK_ acronym, which stands for _Zero-Knowledge Succinct Non-interactive ARgument of Knowledge_ (though zkSNARKs are also knows as
|
||||
_succinct non-interactive computationally-sound zero-knowledge proofs of knowledge_).
|
||||
For formal definitions and theoretical discussions about these, see
|
||||
\[BCCT12], \[BCIOP13], and the references therein.
|
||||
|
||||
The libsnark library currently provides a C++ implementation of:
|
||||
|
||||
1. General-purpose proof systems:
|
||||
1. A preprocessing zkSNARK for the NP-complete language "R1CS"
|
||||
(_Rank-1 Constraint Systems_), which is a language that is similar to arithmetic
|
||||
circuit satisfiability.
|
||||
2. A preprocessing SNARK for a language of arithmetic circuits, "BACS"
|
||||
(_Bilinear Arithmetic Circuit Satisfiability_). This simplifies the writing
|
||||
of NP statements when the additional flexibility of R1CS is not needed.
|
||||
Internally, it reduces to R1CS.
|
||||
3. A preprocessing SNARK for the language "USCS"
|
||||
(_Unitary-Square Constraint Systems_). This abstracts and implements the core
|
||||
contribution of \[DFGK14]
|
||||
4. A preprocessing SNARK for a language of Boolean circuits, "TBCS"
|
||||
(_Two-input Boolean Circuit Satisfiability_). Internally, it reduces to USCS.
|
||||
This is much more efficient than going through R1CS.
|
||||
5. ADSNARK, a preprocessing SNARKs for proving statements on authenticated
|
||||
data, as described in \[BBFR15].
|
||||
6. Proof-Carrying Data (PCD). This uses recursive composition of SNARKs, as
|
||||
explained in \[BCCT13] and optimized in \[BCTV14b].
|
||||
2. Gadget libraries (gadgetlib1 and gadgetlib2) for constructing R1CS
|
||||
instances out of modular "gadget" classes.
|
||||
3. Examples of applications that use the above proof systems to prove
|
||||
statements about:
|
||||
1. Several toy examples.
|
||||
2. Execution of TinyRAM machine code, as explained in \[BCTV14a] and
|
||||
\[BCGTV13]. (Such machine code can be obtained, e.g., by compiling from C.)
|
||||
This is easily adapted to any other Random Access Machine that satisfies a
|
||||
simple load-store interface.
|
||||
3. A scalable for TinyRAM using Proof-Carrying Data, as explained in \[BCTV14b]
|
||||
4. Zero-knowldge cluster MapReduce, as explained in \[CTV15].
|
||||
|
||||
The zkSNARK construction implemented by libsnark follows, extends, and
|
||||
optimizes the approach described in \[BCTV14], itself an extension of
|
||||
\[BCGTV13], following the approach of \[BCIOP13] and \[GGPR13]. An alternative
|
||||
implementation of the basic approach is the _Pinocchio_ system of \[PGHR13].
|
||||
See these references for discussions of efficiency aspects that arise in
|
||||
practical use of such constructions, as well as security and trust
|
||||
considerations.
|
||||
|
||||
This scheme is a _preprocessing zkSNARK_ (_ppzkSNARK_): before proofs can be
|
||||
created and verified, one needs to first decide on a size/circuit/system
|
||||
representing the NP statements to be proved, and run a _generator_ algorithm to
|
||||
create corresponding public parameters (a long proving key and a short
|
||||
verification key).
|
||||
|
||||
Using the library involves the following high-level steps:
|
||||
|
||||
1. Express the statements to be proved as an R1CS (or any of the other
|
||||
languages above, such as arithmetic circuits, Boolean circuits, or TinyRAM).
|
||||
This is done by writing C++ code that constructs an R1CS, and linking this code
|
||||
together with libsnark
|
||||
2. Use libsnark's generator algorithm to create the public parameters for this
|
||||
statement (once and for all).
|
||||
3. Use libsnark's prover algorithm to create proofs of true statements about
|
||||
the satisfiability of the R1CS.
|
||||
4. Use libsnark's verifier algorithm to check proofs for alleged statements.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
The NP-complete language R1CS
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The ppzkSNARK supports proving/verifying membership in a specific NP-complete
|
||||
language: R1CS (*rank-1 constraint systems*). An instance of the language is
|
||||
specified by a set of equations over a prime field F, and each equation looks like:
|
||||
< A, (1,X) > * < B , (1,X) > = < C, (1,X) >
|
||||
where A,B,C are vectors over F, and X is a vector of variables.
|
||||
|
||||
In particular, arithmetic (as well as boolean) circuits are easily reducible to
|
||||
this language by converting each gate into a rank-1 constraint. See \[BCGTV13]
|
||||
Appendix E (and "System of Rank 1 Quadratic Equations") for more details about this.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Elliptic curve choices
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The ppzkSNARK can be instantiated with different parameter choices, depending on
|
||||
which elliptic curve is used. The libsnark library currently provides three
|
||||
options:
|
||||
|
||||
* "edwards":
|
||||
an instantiation based on an Edwards curve, providing 80 bits of security.
|
||||
|
||||
* "bn128":
|
||||
an instantiation based on a Barreto-Naehrig curve, providing 128
|
||||
bits of security. The underlying curve implementation is
|
||||
\[ate-pairing], which has incorporated our patch that changes the
|
||||
BN curve to one suitable for SNARK applications.
|
||||
|
||||
* This implementation uses dynamically-generated machine code for the curve
|
||||
arithmetic. Some modern systems disallow execution of code on the heap, and
|
||||
will thus block this implementation.
|
||||
|
||||
For example, on Fedora 20 at its default settings, you will get the error
|
||||
`zmInit ERR:can't protect` when running this code. To solve this,
|
||||
run `sudo setsebool -P allow_execheap 1` to allow execution,
|
||||
or use `make CURVE=ALT_BN128` instead.
|
||||
|
||||
* "alt_bn128":
|
||||
an alternative to "bn128", somewhat slower but avoids dynamic code generation.
|
||||
|
||||
Note that bn128 requires an x86-64 CPU while the other curve choices
|
||||
should be architecture-independent; see [portability](#portability).
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Gadget libraries
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The libsnark library currently provides two libraries for conveniently constructing
|
||||
R1CS instances out of reusable "gadgets". Both libraries provide a way to construct
|
||||
gadgets on other gadgets as well as additional explicit equations. In this way,
|
||||
complex R1CS instances can be built bottom up.
|
||||
|
||||
### gadgetlib1
|
||||
|
||||
This is a low-level library which expose all features of the preprocessing
|
||||
zkSNARK for R1CS. Its design is based on templates (as does the ppzkSNARK code)
|
||||
to efficiently support working on multiple elliptic curves simultaneously. This
|
||||
library is used for most of the constraint-building in libsnark, both internal
|
||||
(reductions and Proof-Carrying Data) and examples applications.
|
||||
|
||||
### gadgetlib2
|
||||
|
||||
This is an alternative library for constructing systems of polynomial equations
|
||||
and, in particular, also R1CS instances. It is better documented and easier to
|
||||
use than gadgetlib1, and its interface does not use templates. However, fewer
|
||||
useful gadgets are provided.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Security
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The theoretical security of the underlying mathematical constructions, and the
|
||||
requisite assumptions, are analyzed in detailed in the aforementioned research
|
||||
papers.
|
||||
|
||||
**
|
||||
This code is a research-quality proof of concept, and has not
|
||||
yet undergone extensive review or testing. It is thus not suitable,
|
||||
as is, for use in critical or production systems.
|
||||
**
|
||||
|
||||
Known issues include the following:
|
||||
|
||||
* The ppzkSNARK's generator and prover exhibit data-dependent running times
|
||||
and memory usage. These form timing and cache-contention side channels,
|
||||
which may be an issue in some applications.
|
||||
|
||||
* Randomness is retrieved from /dev/urandom, but this should be
|
||||
changed to a carefully considered (depending on system and threat
|
||||
model) external, high-quality randomness source when creating
|
||||
long-term proving/verification keys.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Build instructions
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The libsnark library relies on the following:
|
||||
|
||||
- C++ build environment
|
||||
- GMP for certain bit-integer arithmetic
|
||||
- libprocps for reporting memory usage
|
||||
- GTest for some of the unit tests
|
||||
|
||||
So far we have tested these only on Linux, though we have been able to make the library work,
|
||||
with some features disabled (such as memory profiling or GTest tests), on Windows via Cygwin
|
||||
and on Mac OS X. (If you succeed in achieving more complete ports of the library, please
|
||||
let us know!) See also the notes on [portability](#portability) below.
|
||||
|
||||
For example, on a fresh install of Ubuntu 14.04, install the following packages:
|
||||
|
||||
$ sudo apt-get install build-essential git libgmp3-dev libprocps3-dev libgtest-dev python-markdown libboost-all-dev libssl-dev
|
||||
|
||||
Or, on Fedora 20:
|
||||
|
||||
$ sudo yum install gcc-c++ make git gmp-devel procps-ng-devel gtest-devel python-markdown
|
||||
|
||||
Run the following, to fetch dependencies from their GitHub repos and compile them.
|
||||
(Not required if you set `CURVE` to other than the default `BN128` and also set `NO_SUPERCOP=1`.)
|
||||
|
||||
$ ./prepare-depends.sh
|
||||
|
||||
Then, to compile the library, tests, profiling harness and documentation, run:
|
||||
|
||||
$ make
|
||||
|
||||
To create just the HTML documentation, run
|
||||
|
||||
$ make doc
|
||||
|
||||
and then view the resulting `README.html` (which contains the very text you are reading now).
|
||||
|
||||
To create Doxygen documentation summarizing all files, classes and functions,
|
||||
with some (currently sparse) comments, install the `doxygen` and `graphviz` packages, then run
|
||||
|
||||
$ make doxy
|
||||
|
||||
(this may take a few minutes). Then view the resulting [`doxygen/index.html`](doxygen/index.html).
|
||||
|
||||
### Using libsnark as a library
|
||||
|
||||
To develop an application that uses libsnark, you could add it within the libsnark directory tree and adjust the Makefile, but it is far better to build libsnark as a (shared or static) library. You can then write your code in a separate directory tree, and link it against libsnark.
|
||||
|
||||
|
||||
To build just the shared object library `libsnark.so`, run:
|
||||
|
||||
$ make lib
|
||||
|
||||
To build just the static library `libsnark.a`, run:
|
||||
|
||||
$ make lib STATIC=1
|
||||
|
||||
Note that static compilation requires static versions of all libraries it depends on.
|
||||
It may help to minize these dependencies by appending
|
||||
`CURVE=ALT_BN128 NO_PROCPS=1 NO_GTEST=1 NO_SUPERCOP=1`. On Fedora 21, the requisite
|
||||
library RPM dependencies are then:
|
||||
`boost-static glibc-static gmp-static libstdc++-static openssl-static zlib-static
|
||||
boost-devel glibc-devel gmp-devel gmp-devel libstdc++-devel openssl-devel openssl-devel`.
|
||||
|
||||
To build *and install* the libsnark library:
|
||||
|
||||
$ make install PREFIX=/install/path
|
||||
|
||||
This will install `libsnark.so` into `/install/path/lib`; so your application should be linked using `-L/install/path/lib -lsnark`. It also installs the requisite headers into `/install/path/include`; so your application should be compiled using `-I/install/path/include`.
|
||||
|
||||
In addition, unless you use `NO_SUPERCOP=1`, `libsupercop.a` will be installed and should be linked in using `-lsupercop`.
|
||||
|
||||
|
||||
### Building on Windows using Cygwin
|
||||
Install Cygwin using the graphical installer, including the `g++`, `libgmp`
|
||||
and `git` packages. Then disable the dependencies not easily supported under CygWin,
|
||||
using:
|
||||
|
||||
$ make NO_PROCPS=1 NO_GTEST=1 NO_DOCS=1
|
||||
|
||||
|
||||
### Building on Mac OS X
|
||||
|
||||
On Mac OS X, install GMP from MacPorts (`port install gmp`). Then disable the
|
||||
dependencies not easily supported under CygWin, using:
|
||||
|
||||
$ make NO_PROCPS=1 NO_GTEST=1 NO_DOCS=1
|
||||
|
||||
MacPorts does not write its libraries into standard system folders, so you
|
||||
might need to explicitly provide the paths to the header files and libraries by
|
||||
appending `CXXFLAGS=-I/opt/local/include LDFLAGS=-L/opt/local/lib` to the line
|
||||
above. Similarly, to pass the paths to ate-pairing you would run
|
||||
`INC_DIR=-I/opt/local/include LIB_DIR=-L/opt/local/lib ./prepare-depends.sh`
|
||||
instead of `./prepare-depends.sh` above.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Tutorials
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
libsnark includes a tutorial, and some usage examples, for the high-level API.
|
||||
|
||||
* `src/gadgetlib1/examples1` contains a simple example for constructing a
|
||||
constraint system using gadgetlib1.
|
||||
|
||||
* `src/gadgetlib2/examples` contains a tutorial for using gadgetlib2 to express
|
||||
NP statements as constraint systems. It introduces basic terminology, design
|
||||
overview, and recommended programming style. It also shows how to invoke
|
||||
ppzkSNARKs on such constraint systems. The main file, `tutorial.cpp`, builds
|
||||
into a standalone executable.
|
||||
|
||||
* `src/zk_proof_systems/ppzksnark/r1cs_ppzksnark/profiling/profile_r1cs_ppzksnark.cpp`
|
||||
constructs a simple constraint system and runs the ppzksnark. See below for how to
|
||||
run it.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Executing profiling example
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The command
|
||||
|
||||
$ src/zk_proof_systems/ppzksnark/r1cs_ppzksnark/profiling/profile_r1cs_ppzksnark 1000 10 Fr
|
||||
|
||||
exercises the ppzkSNARK (first generator, then prover, then verifier) on an
|
||||
R1CS instance with 1000 equations and an input consisting of 10 field elements.
|
||||
|
||||
(If you get the error `zmInit ERR:can't protect`, see the discussion
|
||||
[above](#elliptic-curve-choices).)
|
||||
|
||||
The command
|
||||
|
||||
$ src/zk_proof_systems/ppzksnark/r1cs_ppzksnark/profiling/profile_r1cs_ppzksnark 1000 10 bytes
|
||||
|
||||
does the same but now the input consists of 10 bytes.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Build options
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The following flags change the behavior of the compiled code.
|
||||
|
||||
* `make FEATUREFLAGS='-Dname1 -Dname2 ...'`
|
||||
|
||||
Override the active conditional #define names (you can see the default at the top of the Makefile).
|
||||
The next bullets list the most important conditionally-#defined features.
|
||||
For example, `make FEATUREFLAGS='-DBINARY_OUTPUT'` enables binary output and disables the default
|
||||
assembly optimizations and Montgomery-representation output.
|
||||
|
||||
* define `BINARY_OUTPUT`
|
||||
|
||||
In serialization, output raw binary data (instead of decimal, when not set).
|
||||
|
||||
* `make CURVE=choice` / define `CURVE_choice` (where `choice` is one of:
|
||||
ALT_BN128, BN128, EDWARDS, MNT4, MNT6)
|
||||
|
||||
Set the default curve to one of the above (see [elliptic curve choices](#elliptic-curve-choices)).
|
||||
|
||||
* `make DEBUG=1` / define `DEBUG`
|
||||
|
||||
Print additional information for debugging purposes.
|
||||
|
||||
* `make LOWMEM=1` / define `LOWMEM`
|
||||
|
||||
Limit the size of multi-exponentiation tables, for low-memory platforms.
|
||||
|
||||
* `make NO_DOCS=1`
|
||||
|
||||
Do not generate HTML documentation, e.g. on platforms where Markdown is not easily available.
|
||||
|
||||
* `make NO_PROCPS=1`
|
||||
|
||||
Do not link against libprocps. This disables memory profiling.
|
||||
|
||||
* `make NO_GTEST=1`
|
||||
|
||||
Do not link against GTest. The tutorial and test suite of gadgetlib2 tutorial won't be compiled.
|
||||
|
||||
* `make NO_SUPERCOP=1`
|
||||
|
||||
Do not link against SUPERCOP for optimized crypto. The ADSNARK executables will not be built.
|
||||
|
||||
* `make MULTICORE=1`
|
||||
|
||||
Enable parallelized execution of the ppzkSNARK generator and prover, using OpenMP.
|
||||
This will utilize all cores on the CPU for heavyweight parallelizabe operations such as
|
||||
FFT and multiexponentiation. The default is single-core.
|
||||
|
||||
To override the maximum number of cores used, set the environment variable `OMP_NUM_THREADS`
|
||||
at runtime (not compile time), e.g., `OMP_NUM_THREADS=8 test_r1cs_sp_ppzkpc`. It defaults
|
||||
to the autodetected number of cores, but on some devices, dynamic core management confused
|
||||
OpenMP's autodetection, so setting `OMP_NUM_THREADS` is necessary for full utilization.
|
||||
|
||||
* define `NO_PT_COMPRESSION`
|
||||
|
||||
Do not use point compression.
|
||||
This gives much faster serialization times, at the expense of ~2x larger
|
||||
sizes for serialized keys and proofs.
|
||||
|
||||
* define `MONTGOMERY_OUTPUT` (on by default)
|
||||
|
||||
Serialize Fp elements as their Montgomery representations. If this
|
||||
option is disabled then Fp elements are serialized as their
|
||||
equivalence classes, which is slower but produces human-readable
|
||||
output.
|
||||
|
||||
* `make PROFILE_OP_COUNTS=1` / define `PROFILE_OP_COUNTS`
|
||||
|
||||
Collect counts for field and curve operations inside static variables
|
||||
of the corresponding algebraic objects. This option works for all
|
||||
curves except bn128.
|
||||
|
||||
* define `USE_ASM` (on by default)
|
||||
|
||||
Use unrolled assembly routines for F[p] arithmetic and faster heap in
|
||||
multi-exponentiation. (When not set, use GMP's `mpn_*` routines instead.)
|
||||
|
||||
* define `USE_MIXED_ADDITION`
|
||||
|
||||
Convert each element of the proving key and verification key to
|
||||
affine coordinates. This allows using mixed addition formulas in
|
||||
multiexponentiation and results in slightly faster prover and
|
||||
verifier runtime at expense of increased proving time.
|
||||
|
||||
* `make PERFORMANCE=1`
|
||||
|
||||
Enables compiler optimizations such as link-time optimization, and disables debugging aids.
|
||||
(On some distributions this causes a `plugin needed to handle lto object` link error and `undefined reference`s, which can be remedied by `AR=gcc-ar make ...`.)
|
||||
|
||||
Not all combinations are tested together or supported by every part of the codebase.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Portability
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
libsnark is written in fairly standard C++11.
|
||||
|
||||
However, having been developed on Linux on x86-64 CPUs, libsnark has some limitations
|
||||
with respect to portability. Specifically:
|
||||
|
||||
1. libsnark's algebraic data structures assume little-endian byte order.
|
||||
|
||||
2. Profiling routines use `clock_gettime` and `readproc` calls, which are Linux-specific.
|
||||
|
||||
3. Random-number generation is done by reading from `/dev/urandom`, which is
|
||||
specific to Unix-like systems.
|
||||
|
||||
4. libsnark binary serialization routines (see `BINARY_OUTPUT` above) assume
|
||||
a fixed machine word size (i.e. sizeof(mp_limb_t) for GMP's limb data type).
|
||||
Objects serialized in binary on a 64-bit system cannot be de-serialized on
|
||||
a 32-bit system, and vice versa.
|
||||
(The decimal serialization routines have no such limitation.)
|
||||
|
||||
5. libsnark requires a C++ compiler with good C++11 support. It has been
|
||||
tested with g++ 4.7, g++ 4.8, and clang 3.4.
|
||||
|
||||
6. On x86-64, we by default use highly optimized assembly implementations for some
|
||||
operations (see `USE_ASM` above). On other architectures we fall back to a
|
||||
portable C++ implementation, which is slower.
|
||||
|
||||
Tested configurations include:
|
||||
|
||||
* Debian jessie with g++ 4.7 on x86-64
|
||||
* Debian jessie with clang 3.4 on x86-64
|
||||
* Fedora 20/21 with g++ 4.8.2/4.9.2 on x86-64 and i686
|
||||
* Ubuntu 14.04 LTS with g++ 4.8 on x86-64
|
||||
* Ubuntu 14.04 LTS with g++ 4.8 on x86-32, for EDWARDS and ALT_BN128 curve choices
|
||||
* Debian wheezy with g++ 4.7 on ARM little endian (Debian armel port) inside QEMU, for EDWARDS and ALT_BN128 curve choices
|
||||
* Windows 7 with g++ 4.8.3 under Cygwin 1.7.30 on x86-64 with NO_PROCPS=1, NO_GTEST=1 and NO_DOCS=1, for EDWARDS and ALT_BN128 curve choices
|
||||
* Mac OS X 10.9.4 (Mavericks) with Apple LLVM version 5.1 (based on LLVM 3.4svn) on x86-64 with NO_PROCPS=1, NO_GTEST=1 and NO_DOCS=1
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Directory structure
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
The directory structure of the libsnark library is as follows:
|
||||
|
||||
* src/ --- main C++ source code, containing the following modules:
|
||||
* algebra/ --- fields and elliptic curve groups
|
||||
* common/ --- miscellaneous utilities
|
||||
* gadgetlib1/ --- gadgetlib1, a library to construct R1CS instances
|
||||
* gadgets/ --- basic gadgets for gadgetlib1
|
||||
* gadgetlib2/ --- gadgetlib2, a library to construct R1CS instances
|
||||
* qap/ --- quadratic arithmetic program
|
||||
* domains/ --- support for fast interpolation/evaluation, by providing
|
||||
FFTs and Lagrange-coefficient computations for various domains
|
||||
* relations/ --- interfaces for expressing statement (relations between instances and witnesses) as various NP-complete languages
|
||||
* constraint_satisfaction_problems/ --- R1CS and USCS languages
|
||||
* circuit_satisfaction_problems/ --- Boolean and arithmetic circuit satisfiability languages
|
||||
* ram_computations/ --- RAM computation languages
|
||||
* zk_proof_systems --- interfaces and implementations of the proof systems
|
||||
* reductions --- reductions between languages (used internally, but contains many examples of building constraints)
|
||||
|
||||
Some of these module directories have the following subdirectories:
|
||||
|
||||
* ...
|
||||
* examples/ --- example code and tutorials for this module
|
||||
* tests/ --- unit tests for this module
|
||||
|
||||
In particular, the top-level API examples are at `src/r1cs_ppzksnark/examples/` and `src/gadgetlib2/examples/`.
|
||||
|
||||
* depsrc/ --- created by `prepare_depends.sh` for retrieved sourcecode and local builds of external code
|
||||
(currently: \[ate-pairing], and its dependency xbyak).
|
||||
|
||||
* depinst/ --- created by `prepare_depends.sh` and `Makefile`
|
||||
for local installation of locally-compiled dependencies.
|
||||
|
||||
* doxygen/ --- created by `make doxy` and contains a Doxygen summary of all files, classes etc. in libsnark.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
Further considerations
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### Multiexponentiation window size
|
||||
|
||||
The ppzkSNARK's generator has to solve a fixed-base multi-exponentiation
|
||||
problem. We use a window-based method in which the optimal window size depends
|
||||
on the size of the multiexponentiation instance *and* the platform.
|
||||
|
||||
On our benchmarking platform (a 3.40 GHz Intel Core i7-4770 CPU), we have
|
||||
computed for each curve optimal windows, provided as
|
||||
"fixed_base_exp_window_table" initialization sequences, for each curve; see
|
||||
`X_init.cpp` for X=edwards,bn128,alt_bn128.
|
||||
|
||||
Performance on other platforms may not be optimal (but probably not be far off).
|
||||
Future releases of the libsnark library will include a tool that generates
|
||||
optimal window sizes.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
References
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
\[BBFR15] [
|
||||
_ADSNARK: nearly practical and privacy-preserving proofs on authenticated data_
|
||||
](https://eprint.iacr.org/2014/617),
|
||||
Michael Backes, Manuel Barbosa, Dario Fiore, Raphael M. Reischuk,
|
||||
IEEE Symposium on Security and Privacy (Oakland) 2015
|
||||
|
||||
\[BCCT12] [
|
||||
_From extractable collision resistance to succinct non-Interactive arguments of knowledge, and back again_
|
||||
](http://eprint.iacr.org/2011/443),
|
||||
Nir Bitansky, Ran Canetti, Alessandro Chiesa, Eran Tromer,
|
||||
Innovations in Computer Science (ITCS) 2012
|
||||
|
||||
\[BCCT13] [
|
||||
_Recursive composition and bootstrapping for SNARKs and proof-carrying data_
|
||||
](http://eprint.iacr.org/2012/095)
|
||||
Nir Bitansky, Ran Canetti, Alessandro Chiesa, Eran Tromer,
|
||||
Symposium on Theory of Computing (STOC) 13
|
||||
|
||||
\[BCGTV13] [
|
||||
_SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge_
|
||||
](http://eprint.iacr.org/2013/507),
|
||||
Eli Ben-Sasson, Alessandro Chiesa, Daniel Genkin, Eran Tromer, Madars Virza,
|
||||
CRYPTO 2013
|
||||
|
||||
\[BCIOP13] [
|
||||
_Succinct Non-Interactive Arguments via Linear Interactive Proofs_
|
||||
](http://eprint.iacr.org/2012/718),
|
||||
Nir Bitansky, Alessandro Chiesa, Yuval Ishai, Rafail Ostrovsky, Omer Paneth,
|
||||
Theory of Cryptography Conference 2013
|
||||
|
||||
\[BCTV14a] [
|
||||
_Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture_
|
||||
](http://eprint.iacr.org/2013/879),
|
||||
Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, Madars Virza,
|
||||
USENIX Security 2014
|
||||
|
||||
\[BCTV14b] [
|
||||
_Scalable succinct non-interactive arguments via cycles of elliptic curves_
|
||||
](https://eprint.iacr.org/2014/595),
|
||||
Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, Madars Virza,
|
||||
CRYPTO 2014
|
||||
|
||||
\[CTV15] [
|
||||
_Cluster computing in zero knowledge_
|
||||
](https://eprint.iacr.org/2015/377),
|
||||
Alessandro Chiesa, Eran Tromer, Madars Virza,
|
||||
Eurocrypt 2015
|
||||
|
||||
\[DFGK14] [
|
||||
Square span programs with applications to succinct NIZK arguments
|
||||
](https://eprint.iacr.org/2014/718),
|
||||
George Danezis, Cedric Fournet, Jens Groth, Markulf Kohlweiss,
|
||||
ASIACCS 2014
|
||||
|
||||
\[GGPR13] [
|
||||
_Quadratic span programs and succinct NIZKs without PCPs_
|
||||
](http://eprint.iacr.org/2012/215),
|
||||
Rosario Gennaro, Craig Gentry, Bryan Parno, Mariana Raykova,
|
||||
EUROCRYPT 2013
|
||||
|
||||
\[ate-pairing] [
|
||||
_High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves_
|
||||
](https://github.com/herumi/ate-pairing),
|
||||
MITSUNARI Shigeo, TERUYA Tadanori
|
||||
|
||||
\[PGHR13] [
|
||||
_Pinocchio: Nearly Practical Verifiable Computation_
|
||||
](http://eprint.iacr.org/2013/279),
|
||||
Bryan Parno, Craig Gentry, Jon Howell, Mariana Raykova,
|
||||
IEEE Symposium on Security and Privacy (Oakland) 2013
|
||||
|
||||
[SCIPR Lab]: http://www.scipr-lab.org/ (Succinct Computational Integrity and Privacy Research Lab)
|
||||
|
||||
[LICENSE]: LICENSE (LICENSE file in top directory of libsnark distribution)
|
||||
|
||||
[AUTHORS]: AUTHORS (AUTHORS file in top directory of libsnark distribution)
|
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,524 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g1.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
long long alt_bn128_G1::add_cnt = 0;
|
||||
long long alt_bn128_G1::dbl_cnt = 0;
|
||||
#endif
|
||||
|
||||
std::vector<size_t> alt_bn128_G1::wnaf_window_table;
|
||||
std::vector<size_t> alt_bn128_G1::fixed_base_exp_window_table;
|
||||
alt_bn128_G1 alt_bn128_G1::G1_zero;
|
||||
alt_bn128_G1 alt_bn128_G1::G1_one;
|
||||
|
||||
alt_bn128_G1::alt_bn128_G1()
|
||||
{
|
||||
this->X = G1_zero.X;
|
||||
this->Y = G1_zero.Y;
|
||||
this->Z = G1_zero.Z;
|
||||
}
|
||||
|
||||
void alt_bn128_G1::print() const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
printf("O\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
alt_bn128_G1 copy(*this);
|
||||
copy.to_affine_coordinates();
|
||||
gmp_printf("(%Nd , %Nd)\n",
|
||||
copy.X.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
copy.Y.as_bigint().data, alt_bn128_Fq::num_limbs);
|
||||
}
|
||||
}
|
||||
|
||||
void alt_bn128_G1::print_coordinates() const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
printf("O\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
gmp_printf("(%Nd : %Nd : %Nd)\n",
|
||||
this->X.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
this->Y.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
this->Z.as_bigint().data, alt_bn128_Fq::num_limbs);
|
||||
}
|
||||
}
|
||||
|
||||
void alt_bn128_G1::to_affine_coordinates()
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
this->X = alt_bn128_Fq::zero();
|
||||
this->Y = alt_bn128_Fq::one();
|
||||
this->Z = alt_bn128_Fq::zero();
|
||||
}
|
||||
else
|
||||
{
|
||||
alt_bn128_Fq Z_inv = Z.inverse();
|
||||
alt_bn128_Fq Z2_inv = Z_inv.squared();
|
||||
alt_bn128_Fq Z3_inv = Z2_inv * Z_inv;
|
||||
this->X = this->X * Z2_inv;
|
||||
this->Y = this->Y * Z3_inv;
|
||||
this->Z = alt_bn128_Fq::one();
|
||||
}
|
||||
}
|
||||
|
||||
void alt_bn128_G1::to_special()
|
||||
{
|
||||
this->to_affine_coordinates();
|
||||
}
|
||||
|
||||
bool alt_bn128_G1::is_special() const
|
||||
{
|
||||
return (this->is_zero() || this->Z == alt_bn128_Fq::one());
|
||||
}
|
||||
|
||||
bool alt_bn128_G1::is_zero() const
|
||||
{
|
||||
return (this->Z.is_zero());
|
||||
}
|
||||
|
||||
bool alt_bn128_G1::operator==(const alt_bn128_G1 &other) const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other.is_zero();
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
/* now neither is O */
|
||||
|
||||
// using Jacobian coordinates so:
|
||||
// (X1:Y1:Z1) = (X2:Y2:Z2)
|
||||
// iff
|
||||
// X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
|
||||
// iff
|
||||
// X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
|
||||
|
||||
alt_bn128_Fq Z1_squared = (this->Z).squared();
|
||||
alt_bn128_Fq Z2_squared = (other.Z).squared();
|
||||
|
||||
if ((this->X * Z2_squared) != (other.X * Z1_squared))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
alt_bn128_Fq Z1_cubed = (this->Z) * Z1_squared;
|
||||
alt_bn128_Fq Z2_cubed = (other.Z) * Z2_squared;
|
||||
|
||||
if ((this->Y * Z2_cubed) != (other.Y * Z1_cubed))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool alt_bn128_G1::operator!=(const alt_bn128_G1& other) const
|
||||
{
|
||||
return !(operator==(other));
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::operator+(const alt_bn128_G1 &other) const
|
||||
{
|
||||
// handle special cases having to do with O
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other;
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return *this;
|
||||
}
|
||||
|
||||
// no need to handle points of order 2,4
|
||||
// (they cannot exist in a prime-order subgroup)
|
||||
|
||||
// check for doubling case
|
||||
|
||||
// using Jacobian coordinates so:
|
||||
// (X1:Y1:Z1) = (X2:Y2:Z2)
|
||||
// iff
|
||||
// X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
|
||||
// iff
|
||||
// X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
|
||||
|
||||
alt_bn128_Fq Z1Z1 = (this->Z).squared();
|
||||
alt_bn128_Fq Z2Z2 = (other.Z).squared();
|
||||
|
||||
alt_bn128_Fq U1 = this->X * Z2Z2;
|
||||
alt_bn128_Fq U2 = other.X * Z1Z1;
|
||||
|
||||
alt_bn128_Fq Z1_cubed = (this->Z) * Z1Z1;
|
||||
alt_bn128_Fq Z2_cubed = (other.Z) * Z2Z2;
|
||||
|
||||
alt_bn128_Fq S1 = (this->Y) * Z2_cubed; // S1 = Y1 * Z2 * Z2Z2
|
||||
alt_bn128_Fq S2 = (other.Y) * Z1_cubed; // S2 = Y2 * Z1 * Z1Z1
|
||||
|
||||
if (U1 == U2 && S1 == S2)
|
||||
{
|
||||
// dbl case; nothing of above can be reused
|
||||
return this->dbl();
|
||||
}
|
||||
|
||||
// rest of add case
|
||||
alt_bn128_Fq H = U2 - U1; // H = U2-U1
|
||||
alt_bn128_Fq S2_minus_S1 = S2-S1;
|
||||
alt_bn128_Fq I = (H+H).squared(); // I = (2 * H)^2
|
||||
alt_bn128_Fq J = H * I; // J = H * I
|
||||
alt_bn128_Fq r = S2_minus_S1 + S2_minus_S1; // r = 2 * (S2-S1)
|
||||
alt_bn128_Fq V = U1 * I; // V = U1 * I
|
||||
alt_bn128_Fq X3 = r.squared() - J - (V+V); // X3 = r^2 - J - 2 * V
|
||||
alt_bn128_Fq S1_J = S1 * J;
|
||||
alt_bn128_Fq Y3 = r * (V-X3) - (S1_J+S1_J); // Y3 = r * (V-X3)-2 S1 J
|
||||
alt_bn128_Fq Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
|
||||
|
||||
return alt_bn128_G1(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::operator-() const
|
||||
{
|
||||
return alt_bn128_G1(this->X, -(this->Y), this->Z);
|
||||
}
|
||||
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::operator-(const alt_bn128_G1 &other) const
|
||||
{
|
||||
return (*this) + (-other);
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::add(const alt_bn128_G1 &other) const
|
||||
{
|
||||
// handle special cases having to do with O
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other;
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return *this;
|
||||
}
|
||||
|
||||
// no need to handle points of order 2,4
|
||||
// (they cannot exist in a prime-order subgroup)
|
||||
|
||||
// handle double case
|
||||
if (this->operator==(other))
|
||||
{
|
||||
return this->dbl();
|
||||
}
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->add_cnt++;
|
||||
#endif
|
||||
// NOTE: does not handle O and pts of order 2,4
|
||||
// http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl
|
||||
|
||||
alt_bn128_Fq Z1Z1 = (this->Z).squared(); // Z1Z1 = Z1^2
|
||||
alt_bn128_Fq Z2Z2 = (other.Z).squared(); // Z2Z2 = Z2^2
|
||||
alt_bn128_Fq U1 = (this->X) * Z2Z2; // U1 = X1 * Z2Z2
|
||||
alt_bn128_Fq U2 = (other.X) * Z1Z1; // U2 = X2 * Z1Z1
|
||||
alt_bn128_Fq S1 = (this->Y) * (other.Z) * Z2Z2; // S1 = Y1 * Z2 * Z2Z2
|
||||
alt_bn128_Fq S2 = (other.Y) * (this->Z) * Z1Z1; // S2 = Y2 * Z1 * Z1Z1
|
||||
alt_bn128_Fq H = U2 - U1; // H = U2-U1
|
||||
alt_bn128_Fq S2_minus_S1 = S2-S1;
|
||||
alt_bn128_Fq I = (H+H).squared(); // I = (2 * H)^2
|
||||
alt_bn128_Fq J = H * I; // J = H * I
|
||||
alt_bn128_Fq r = S2_minus_S1 + S2_minus_S1; // r = 2 * (S2-S1)
|
||||
alt_bn128_Fq V = U1 * I; // V = U1 * I
|
||||
alt_bn128_Fq X3 = r.squared() - J - (V+V); // X3 = r^2 - J - 2 * V
|
||||
alt_bn128_Fq S1_J = S1 * J;
|
||||
alt_bn128_Fq Y3 = r * (V-X3) - (S1_J+S1_J); // Y3 = r * (V-X3)-2 S1 J
|
||||
alt_bn128_Fq Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
|
||||
|
||||
return alt_bn128_G1(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::mixed_add(const alt_bn128_G1 &other) const
|
||||
{
|
||||
#ifdef DEBUG
|
||||
assert(other.is_special());
|
||||
#endif
|
||||
|
||||
// handle special cases having to do with O
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other;
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return *this;
|
||||
}
|
||||
|
||||
// no need to handle points of order 2,4
|
||||
// (they cannot exist in a prime-order subgroup)
|
||||
|
||||
// check for doubling case
|
||||
|
||||
// using Jacobian coordinates so:
|
||||
// (X1:Y1:Z1) = (X2:Y2:Z2)
|
||||
// iff
|
||||
// X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
|
||||
// iff
|
||||
// X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
|
||||
|
||||
// we know that Z2 = 1
|
||||
|
||||
const alt_bn128_Fq Z1Z1 = (this->Z).squared();
|
||||
|
||||
const alt_bn128_Fq &U1 = this->X;
|
||||
const alt_bn128_Fq U2 = other.X * Z1Z1;
|
||||
|
||||
const alt_bn128_Fq Z1_cubed = (this->Z) * Z1Z1;
|
||||
|
||||
const alt_bn128_Fq &S1 = (this->Y); // S1 = Y1 * Z2 * Z2Z2
|
||||
const alt_bn128_Fq S2 = (other.Y) * Z1_cubed; // S2 = Y2 * Z1 * Z1Z1
|
||||
|
||||
if (U1 == U2 && S1 == S2)
|
||||
{
|
||||
// dbl case; nothing of above can be reused
|
||||
return this->dbl();
|
||||
}
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->add_cnt++;
|
||||
#endif
|
||||
|
||||
// NOTE: does not handle O and pts of order 2,4
|
||||
// http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-madd-2007-bl
|
||||
alt_bn128_Fq H = U2-(this->X); // H = U2-X1
|
||||
alt_bn128_Fq HH = H.squared() ; // HH = H&2
|
||||
alt_bn128_Fq I = HH+HH; // I = 4*HH
|
||||
I = I + I;
|
||||
alt_bn128_Fq J = H*I; // J = H*I
|
||||
alt_bn128_Fq r = S2-(this->Y); // r = 2*(S2-Y1)
|
||||
r = r + r;
|
||||
alt_bn128_Fq V = (this->X) * I ; // V = X1*I
|
||||
alt_bn128_Fq X3 = r.squared()-J-V-V; // X3 = r^2-J-2*V
|
||||
alt_bn128_Fq Y3 = (this->Y)*J; // Y3 = r*(V-X3)-2*Y1*J
|
||||
Y3 = r*(V-X3) - Y3 - Y3;
|
||||
alt_bn128_Fq Z3 = ((this->Z)+H).squared() - Z1Z1 - HH; // Z3 = (Z1+H)^2-Z1Z1-HH
|
||||
|
||||
return alt_bn128_G1(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::dbl() const
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->dbl_cnt++;
|
||||
#endif
|
||||
// handle point at infinity
|
||||
if (this->is_zero())
|
||||
{
|
||||
return (*this);
|
||||
}
|
||||
|
||||
// no need to handle points of order 2,4
|
||||
// (they cannot exist in a prime-order subgroup)
|
||||
|
||||
// NOTE: does not handle O and pts of order 2,4
|
||||
// http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
|
||||
|
||||
alt_bn128_Fq A = (this->X).squared(); // A = X1^2
|
||||
alt_bn128_Fq B = (this->Y).squared(); // B = Y1^2
|
||||
alt_bn128_Fq C = B.squared(); // C = B^2
|
||||
alt_bn128_Fq D = (this->X + B).squared() - A - C;
|
||||
D = D+D; // D = 2 * ((X1 + B)^2 - A - C)
|
||||
alt_bn128_Fq E = A + A + A; // E = 3 * A
|
||||
alt_bn128_Fq F = E.squared(); // F = E^2
|
||||
alt_bn128_Fq X3 = F - (D+D); // X3 = F - 2 D
|
||||
alt_bn128_Fq eightC = C+C;
|
||||
eightC = eightC + eightC;
|
||||
eightC = eightC + eightC;
|
||||
alt_bn128_Fq Y3 = E * (D - X3) - eightC; // Y3 = E * (D - X3) - 8 * C
|
||||
alt_bn128_Fq Y1Z1 = (this->Y)*(this->Z);
|
||||
alt_bn128_Fq Z3 = Y1Z1 + Y1Z1; // Z3 = 2 * Y1 * Z1
|
||||
|
||||
return alt_bn128_G1(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
bool alt_bn128_G1::is_well_formed() const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
return true;
|
||||
}
|
||||
else
|
||||
{
|
||||
/*
|
||||
y^2 = x^3 + b
|
||||
|
||||
We are using Jacobian coordinates, so equation we need to check is actually
|
||||
|
||||
(y/z^3)^2 = (x/z^2)^3 + b
|
||||
y^2 / z^6 = x^3 / z^6 + b
|
||||
y^2 = x^3 + b z^6
|
||||
*/
|
||||
alt_bn128_Fq X2 = this->X.squared();
|
||||
alt_bn128_Fq Y2 = this->Y.squared();
|
||||
alt_bn128_Fq Z2 = this->Z.squared();
|
||||
|
||||
alt_bn128_Fq X3 = this->X * X2;
|
||||
alt_bn128_Fq Z3 = this->Z * Z2;
|
||||
alt_bn128_Fq Z6 = Z3.squared();
|
||||
|
||||
return (Y2 == X3 + alt_bn128_coeff_b * Z6);
|
||||
}
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::zero()
|
||||
{
|
||||
return G1_zero;
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::one()
|
||||
{
|
||||
return G1_one;
|
||||
}
|
||||
|
||||
alt_bn128_G1 alt_bn128_G1::random_element()
|
||||
{
|
||||
return (scalar_field::random_element().as_bigint()) * G1_one;
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream &out, const alt_bn128_G1 &g)
|
||||
{
|
||||
alt_bn128_G1 copy(g);
|
||||
copy.to_affine_coordinates();
|
||||
|
||||
out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
|
||||
#ifdef NO_PT_COMPRESSION
|
||||
out << copy.X << OUTPUT_SEPARATOR << copy.Y;
|
||||
#else
|
||||
/* storing LSB of Y */
|
||||
out << copy.X << OUTPUT_SEPARATOR << (copy.Y.as_bigint().data[0] & 1);
|
||||
#endif
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
std::istream& operator>>(std::istream &in, alt_bn128_G1 &g)
|
||||
{
|
||||
char is_zero;
|
||||
alt_bn128_Fq tX, tY;
|
||||
|
||||
#ifdef NO_PT_COMPRESSION
|
||||
in >> is_zero >> tX >> tY;
|
||||
is_zero -= '0';
|
||||
#else
|
||||
in.read((char*)&is_zero, 1); // this reads is_zero;
|
||||
is_zero -= '0';
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
|
||||
unsigned char Y_lsb;
|
||||
in >> tX;
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
in.read((char*)&Y_lsb, 1);
|
||||
Y_lsb -= '0';
|
||||
|
||||
// y = +/- sqrt(x^3 + b)
|
||||
if (!is_zero)
|
||||
{
|
||||
alt_bn128_Fq tX2 = tX.squared();
|
||||
alt_bn128_Fq tY2 = tX2*tX + alt_bn128_coeff_b;
|
||||
tY = tY2.sqrt();
|
||||
|
||||
if ((tY.as_bigint().data[0] & 1) != Y_lsb)
|
||||
{
|
||||
tY = -tY;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
// using Jacobian coordinates
|
||||
if (!is_zero)
|
||||
{
|
||||
g.X = tX;
|
||||
g.Y = tY;
|
||||
g.Z = alt_bn128_Fq::one();
|
||||
}
|
||||
else
|
||||
{
|
||||
g = alt_bn128_G1::zero();
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<alt_bn128_G1> &v)
|
||||
{
|
||||
out << v.size() << "\n";
|
||||
for (const alt_bn128_G1& t : v)
|
||||
{
|
||||
out << t << OUTPUT_NEWLINE;
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
std::istream& operator>>(std::istream& in, std::vector<alt_bn128_G1> &v)
|
||||
{
|
||||
v.clear();
|
||||
|
||||
size_t s;
|
||||
in >> s;
|
||||
consume_newline(in);
|
||||
|
||||
v.reserve(s);
|
||||
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
alt_bn128_G1 g;
|
||||
in >> g;
|
||||
consume_OUTPUT_NEWLINE(in);
|
||||
v.emplace_back(g);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
template<>
|
||||
void batch_to_special_all_non_zeros<alt_bn128_G1>(std::vector<alt_bn128_G1> &vec)
|
||||
{
|
||||
std::vector<alt_bn128_Fq> Z_vec;
|
||||
Z_vec.reserve(vec.size());
|
||||
|
||||
for (auto &el: vec)
|
||||
{
|
||||
Z_vec.emplace_back(el.Z);
|
||||
}
|
||||
batch_invert<alt_bn128_Fq>(Z_vec);
|
||||
|
||||
const alt_bn128_Fq one = alt_bn128_Fq::one();
|
||||
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
alt_bn128_Fq Z2 = Z_vec[i].squared();
|
||||
alt_bn128_Fq Z3 = Z_vec[i] * Z2;
|
||||
|
||||
vec[i].X = vec[i].X * Z2;
|
||||
vec[i].Y = vec[i].Y * Z3;
|
||||
vec[i].Z = one;
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
|
@ -0,0 +1,95 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef ALT_BN128_G1_HPP_
|
||||
#define ALT_BN128_G1_HPP_
|
||||
#include <vector>
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_init.hpp"
|
||||
#include "algebra/curves/curve_utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
class alt_bn128_G1;
|
||||
std::ostream& operator<<(std::ostream &, const alt_bn128_G1&);
|
||||
std::istream& operator>>(std::istream &, alt_bn128_G1&);
|
||||
|
||||
class alt_bn128_G1 {
|
||||
public:
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
static long long add_cnt;
|
||||
static long long dbl_cnt;
|
||||
#endif
|
||||
static std::vector<size_t> wnaf_window_table;
|
||||
static std::vector<size_t> fixed_base_exp_window_table;
|
||||
static alt_bn128_G1 G1_zero;
|
||||
static alt_bn128_G1 G1_one;
|
||||
|
||||
typedef alt_bn128_Fq base_field;
|
||||
typedef alt_bn128_Fr scalar_field;
|
||||
|
||||
alt_bn128_Fq X, Y, Z;
|
||||
|
||||
// using Jacobian coordinates
|
||||
alt_bn128_G1();
|
||||
alt_bn128_G1(const alt_bn128_Fq& X, const alt_bn128_Fq& Y, const alt_bn128_Fq& Z) : X(X), Y(Y), Z(Z) {};
|
||||
|
||||
void print() const;
|
||||
void print_coordinates() const;
|
||||
|
||||
void to_affine_coordinates();
|
||||
void to_special();
|
||||
bool is_special() const;
|
||||
|
||||
bool is_zero() const;
|
||||
|
||||
bool operator==(const alt_bn128_G1 &other) const;
|
||||
bool operator!=(const alt_bn128_G1 &other) const;
|
||||
|
||||
alt_bn128_G1 operator+(const alt_bn128_G1 &other) const;
|
||||
alt_bn128_G1 operator-() const;
|
||||
alt_bn128_G1 operator-(const alt_bn128_G1 &other) const;
|
||||
|
||||
alt_bn128_G1 add(const alt_bn128_G1 &other) const;
|
||||
alt_bn128_G1 mixed_add(const alt_bn128_G1 &other) const;
|
||||
alt_bn128_G1 dbl() const;
|
||||
|
||||
bool is_well_formed() const;
|
||||
|
||||
static alt_bn128_G1 zero();
|
||||
static alt_bn128_G1 one();
|
||||
static alt_bn128_G1 random_element();
|
||||
|
||||
static size_t size_in_bits() { return base_field::size_in_bits() + 1; }
|
||||
static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
|
||||
static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
|
||||
|
||||
friend std::ostream& operator<<(std::ostream &out, const alt_bn128_G1 &g);
|
||||
friend std::istream& operator>>(std::istream &in, alt_bn128_G1 &g);
|
||||
};
|
||||
|
||||
template<mp_size_t m>
|
||||
alt_bn128_G1 operator*(const bigint<m> &lhs, const alt_bn128_G1 &rhs)
|
||||
{
|
||||
return scalar_mul<alt_bn128_G1, m>(rhs, lhs);
|
||||
}
|
||||
|
||||
template<mp_size_t m, const bigint<m>& modulus_p>
|
||||
alt_bn128_G1 operator*(const Fp_model<m,modulus_p> &lhs, const alt_bn128_G1 &rhs)
|
||||
{
|
||||
return scalar_mul<alt_bn128_G1, m>(rhs, lhs.as_bigint());
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<alt_bn128_G1> &v);
|
||||
std::istream& operator>>(std::istream& in, std::vector<alt_bn128_G1> &v);
|
||||
|
||||
template<typename T>
|
||||
void batch_to_special_all_non_zeros(std::vector<T> &vec);
|
||||
template<>
|
||||
void batch_to_special_all_non_zeros<alt_bn128_G1>(std::vector<alt_bn128_G1> &vec);
|
||||
|
||||
} // libsnark
|
||||
#endif // ALT_BN128_G1_HPP_
|
|
@ -0,0 +1,505 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g2.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
long long alt_bn128_G2::add_cnt = 0;
|
||||
long long alt_bn128_G2::dbl_cnt = 0;
|
||||
#endif
|
||||
|
||||
std::vector<size_t> alt_bn128_G2::wnaf_window_table;
|
||||
std::vector<size_t> alt_bn128_G2::fixed_base_exp_window_table;
|
||||
alt_bn128_G2 alt_bn128_G2::G2_zero;
|
||||
alt_bn128_G2 alt_bn128_G2::G2_one;
|
||||
|
||||
alt_bn128_G2::alt_bn128_G2()
|
||||
{
|
||||
this->X = G2_zero.X;
|
||||
this->Y = G2_zero.Y;
|
||||
this->Z = G2_zero.Z;
|
||||
}
|
||||
|
||||
alt_bn128_Fq2 alt_bn128_G2::mul_by_b(const alt_bn128_Fq2 &elt)
|
||||
{
|
||||
return alt_bn128_Fq2(alt_bn128_twist_mul_by_b_c0 * elt.c0, alt_bn128_twist_mul_by_b_c1 * elt.c1);
|
||||
}
|
||||
|
||||
void alt_bn128_G2::print() const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
printf("O\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
alt_bn128_G2 copy(*this);
|
||||
copy.to_affine_coordinates();
|
||||
gmp_printf("(%Nd*z + %Nd , %Nd*z + %Nd)\n",
|
||||
copy.X.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
copy.X.c0.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
copy.Y.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
copy.Y.c0.as_bigint().data, alt_bn128_Fq::num_limbs);
|
||||
}
|
||||
}
|
||||
|
||||
void alt_bn128_G2::print_coordinates() const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
printf("O\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
gmp_printf("(%Nd*z + %Nd : %Nd*z + %Nd : %Nd*z + %Nd)\n",
|
||||
this->X.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
this->X.c0.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
this->Y.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
this->Y.c0.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
this->Z.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
|
||||
this->Z.c0.as_bigint().data, alt_bn128_Fq::num_limbs);
|
||||
}
|
||||
}
|
||||
|
||||
void alt_bn128_G2::to_affine_coordinates()
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
this->X = alt_bn128_Fq2::zero();
|
||||
this->Y = alt_bn128_Fq2::one();
|
||||
this->Z = alt_bn128_Fq2::zero();
|
||||
}
|
||||
else
|
||||
{
|
||||
alt_bn128_Fq2 Z_inv = Z.inverse();
|
||||
alt_bn128_Fq2 Z2_inv = Z_inv.squared();
|
||||
alt_bn128_Fq2 Z3_inv = Z2_inv * Z_inv;
|
||||
this->X = this->X * Z2_inv;
|
||||
this->Y = this->Y * Z3_inv;
|
||||
this->Z = alt_bn128_Fq2::one();
|
||||
}
|
||||
}
|
||||
|
||||
void alt_bn128_G2::to_special()
|
||||
{
|
||||
this->to_affine_coordinates();
|
||||
}
|
||||
|
||||
bool alt_bn128_G2::is_special() const
|
||||
{
|
||||
return (this->is_zero() || this->Z == alt_bn128_Fq2::one());
|
||||
}
|
||||
|
||||
bool alt_bn128_G2::is_zero() const
|
||||
{
|
||||
return (this->Z.is_zero());
|
||||
}
|
||||
|
||||
bool alt_bn128_G2::operator==(const alt_bn128_G2 &other) const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other.is_zero();
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
/* now neither is O */
|
||||
|
||||
// using Jacobian coordinates so:
|
||||
// (X1:Y1:Z1) = (X2:Y2:Z2)
|
||||
// iff
|
||||
// X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
|
||||
// iff
|
||||
// X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
|
||||
|
||||
alt_bn128_Fq2 Z1_squared = (this->Z).squared();
|
||||
alt_bn128_Fq2 Z2_squared = (other.Z).squared();
|
||||
|
||||
if ((this->X * Z2_squared) != (other.X * Z1_squared))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
alt_bn128_Fq2 Z1_cubed = (this->Z) * Z1_squared;
|
||||
alt_bn128_Fq2 Z2_cubed = (other.Z) * Z2_squared;
|
||||
|
||||
if ((this->Y * Z2_cubed) != (other.Y * Z1_cubed))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool alt_bn128_G2::operator!=(const alt_bn128_G2& other) const
|
||||
{
|
||||
return !(operator==(other));
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::operator+(const alt_bn128_G2 &other) const
|
||||
{
|
||||
// handle special cases having to do with O
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other;
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return *this;
|
||||
}
|
||||
|
||||
// no need to handle points of order 2,4
|
||||
// (they cannot exist in a prime-order subgroup)
|
||||
|
||||
// check for doubling case
|
||||
|
||||
// using Jacobian coordinates so:
|
||||
// (X1:Y1:Z1) = (X2:Y2:Z2)
|
||||
// iff
|
||||
// X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
|
||||
// iff
|
||||
// X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
|
||||
|
||||
alt_bn128_Fq2 Z1Z1 = (this->Z).squared();
|
||||
alt_bn128_Fq2 Z2Z2 = (other.Z).squared();
|
||||
|
||||
alt_bn128_Fq2 U1 = this->X * Z2Z2;
|
||||
alt_bn128_Fq2 U2 = other.X * Z1Z1;
|
||||
|
||||
alt_bn128_Fq2 Z1_cubed = (this->Z) * Z1Z1;
|
||||
alt_bn128_Fq2 Z2_cubed = (other.Z) * Z2Z2;
|
||||
|
||||
alt_bn128_Fq2 S1 = (this->Y) * Z2_cubed; // S1 = Y1 * Z2 * Z2Z2
|
||||
alt_bn128_Fq2 S2 = (other.Y) * Z1_cubed; // S2 = Y2 * Z1 * Z1Z1
|
||||
|
||||
if (U1 == U2 && S1 == S2)
|
||||
{
|
||||
// dbl case; nothing of above can be reused
|
||||
return this->dbl();
|
||||
}
|
||||
|
||||
// rest of add case
|
||||
alt_bn128_Fq2 H = U2 - U1; // H = U2-U1
|
||||
alt_bn128_Fq2 S2_minus_S1 = S2-S1;
|
||||
alt_bn128_Fq2 I = (H+H).squared(); // I = (2 * H)^2
|
||||
alt_bn128_Fq2 J = H * I; // J = H * I
|
||||
alt_bn128_Fq2 r = S2_minus_S1 + S2_minus_S1; // r = 2 * (S2-S1)
|
||||
alt_bn128_Fq2 V = U1 * I; // V = U1 * I
|
||||
alt_bn128_Fq2 X3 = r.squared() - J - (V+V); // X3 = r^2 - J - 2 * V
|
||||
alt_bn128_Fq2 S1_J = S1 * J;
|
||||
alt_bn128_Fq2 Y3 = r * (V-X3) - (S1_J+S1_J); // Y3 = r * (V-X3)-2 S1 J
|
||||
alt_bn128_Fq2 Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
|
||||
|
||||
return alt_bn128_G2(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::operator-() const
|
||||
{
|
||||
return alt_bn128_G2(this->X, -(this->Y), this->Z);
|
||||
}
|
||||
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::operator-(const alt_bn128_G2 &other) const
|
||||
{
|
||||
return (*this) + (-other);
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::add(const alt_bn128_G2 &other) const
|
||||
{
|
||||
// handle special cases having to do with O
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other;
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return *this;
|
||||
}
|
||||
|
||||
// no need to handle points of order 2,4
|
||||
// (they cannot exist in a prime-order subgroup)
|
||||
|
||||
// handle double case
|
||||
if (this->operator==(other))
|
||||
{
|
||||
return this->dbl();
|
||||
}
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->add_cnt++;
|
||||
#endif
|
||||
// NOTE: does not handle O and pts of order 2,4
|
||||
// http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
|
||||
|
||||
alt_bn128_Fq2 Z1Z1 = (this->Z).squared(); // Z1Z1 = Z1^2
|
||||
alt_bn128_Fq2 Z2Z2 = (other.Z).squared(); // Z2Z2 = Z2^2
|
||||
alt_bn128_Fq2 U1 = (this->X) * Z2Z2; // U1 = X1 * Z2Z2
|
||||
alt_bn128_Fq2 U2 = (other.X) * Z1Z1; // U2 = X2 * Z1Z1
|
||||
alt_bn128_Fq2 S1 = (this->Y) * (other.Z) * Z2Z2; // S1 = Y1 * Z2 * Z2Z2
|
||||
alt_bn128_Fq2 S2 = (other.Y) * (this->Z) * Z1Z1; // S2 = Y2 * Z1 * Z1Z1
|
||||
alt_bn128_Fq2 H = U2 - U1; // H = U2-U1
|
||||
alt_bn128_Fq2 S2_minus_S1 = S2-S1;
|
||||
alt_bn128_Fq2 I = (H+H).squared(); // I = (2 * H)^2
|
||||
alt_bn128_Fq2 J = H * I; // J = H * I
|
||||
alt_bn128_Fq2 r = S2_minus_S1 + S2_minus_S1; // r = 2 * (S2-S1)
|
||||
alt_bn128_Fq2 V = U1 * I; // V = U1 * I
|
||||
alt_bn128_Fq2 X3 = r.squared() - J - (V+V); // X3 = r^2 - J - 2 * V
|
||||
alt_bn128_Fq2 S1_J = S1 * J;
|
||||
alt_bn128_Fq2 Y3 = r * (V-X3) - (S1_J+S1_J); // Y3 = r * (V-X3)-2 S1 J
|
||||
alt_bn128_Fq2 Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
|
||||
|
||||
return alt_bn128_G2(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::mixed_add(const alt_bn128_G2 &other) const
|
||||
{
|
||||
#ifdef DEBUG
|
||||
assert(other.is_special());
|
||||
#endif
|
||||
|
||||
// handle special cases having to do with O
|
||||
if (this->is_zero())
|
||||
{
|
||||
return other;
|
||||
}
|
||||
|
||||
if (other.is_zero())
|
||||
{
|
||||
return *this;
|
||||
}
|
||||
|
||||
// no need to handle points of order 2,4
|
||||
// (they cannot exist in a prime-order subgroup)
|
||||
|
||||
// check for doubling case
|
||||
|
||||
// using Jacobian coordinates so:
|
||||
// (X1:Y1:Z1) = (X2:Y2:Z2)
|
||||
// iff
|
||||
// X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
|
||||
// iff
|
||||
// X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
|
||||
|
||||
// we know that Z2 = 1
|
||||
|
||||
const alt_bn128_Fq2 Z1Z1 = (this->Z).squared();
|
||||
|
||||
const alt_bn128_Fq2 &U1 = this->X;
|
||||
const alt_bn128_Fq2 U2 = other.X * Z1Z1;
|
||||
|
||||
const alt_bn128_Fq2 Z1_cubed = (this->Z) * Z1Z1;
|
||||
|
||||
const alt_bn128_Fq2 &S1 = (this->Y); // S1 = Y1 * Z2 * Z2Z2
|
||||
const alt_bn128_Fq2 S2 = (other.Y) * Z1_cubed; // S2 = Y2 * Z1 * Z1Z1
|
||||
|
||||
if (U1 == U2 && S1 == S2)
|
||||
{
|
||||
// dbl case; nothing of above can be reused
|
||||
return this->dbl();
|
||||
}
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->add_cnt++;
|
||||
#endif
|
||||
|
||||
// NOTE: does not handle O and pts of order 2,4
|
||||
// http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-madd-2007-bl
|
||||
alt_bn128_Fq2 H = U2-(this->X); // H = U2-X1
|
||||
alt_bn128_Fq2 HH = H.squared() ; // HH = H&2
|
||||
alt_bn128_Fq2 I = HH+HH; // I = 4*HH
|
||||
I = I + I;
|
||||
alt_bn128_Fq2 J = H*I; // J = H*I
|
||||
alt_bn128_Fq2 r = S2-(this->Y); // r = 2*(S2-Y1)
|
||||
r = r + r;
|
||||
alt_bn128_Fq2 V = (this->X) * I ; // V = X1*I
|
||||
alt_bn128_Fq2 X3 = r.squared()-J-V-V; // X3 = r^2-J-2*V
|
||||
alt_bn128_Fq2 Y3 = (this->Y)*J; // Y3 = r*(V-X3)-2*Y1*J
|
||||
Y3 = r*(V-X3) - Y3 - Y3;
|
||||
alt_bn128_Fq2 Z3 = ((this->Z)+H).squared() - Z1Z1 - HH; // Z3 = (Z1+H)^2-Z1Z1-HH
|
||||
|
||||
return alt_bn128_G2(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::dbl() const
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->dbl_cnt++;
|
||||
#endif
|
||||
// handle point at infinity
|
||||
if (this->is_zero())
|
||||
{
|
||||
return (*this);
|
||||
}
|
||||
|
||||
// NOTE: does not handle O and pts of order 2,4
|
||||
// http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#doubling-dbl-2007-bl
|
||||
|
||||
alt_bn128_Fq2 A = (this->X).squared(); // A = X1^2
|
||||
alt_bn128_Fq2 B = (this->Y).squared(); // B = Y1^2
|
||||
alt_bn128_Fq2 C = B.squared(); // C = B^2
|
||||
alt_bn128_Fq2 D = (this->X + B).squared() - A - C;
|
||||
D = D+D; // D = 2 * ((X1 + B)^2 - A - C)
|
||||
alt_bn128_Fq2 E = A + A + A; // E = 3 * A
|
||||
alt_bn128_Fq2 F = E.squared(); // F = E^2
|
||||
alt_bn128_Fq2 X3 = F - (D+D); // X3 = F - 2 D
|
||||
alt_bn128_Fq2 eightC = C+C;
|
||||
eightC = eightC + eightC;
|
||||
eightC = eightC + eightC;
|
||||
alt_bn128_Fq2 Y3 = E * (D - X3) - eightC; // Y3 = E * (D - X3) - 8 * C
|
||||
alt_bn128_Fq2 Y1Z1 = (this->Y)*(this->Z);
|
||||
alt_bn128_Fq2 Z3 = Y1Z1 + Y1Z1; // Z3 = 2 * Y1 * Z1
|
||||
|
||||
return alt_bn128_G2(X3, Y3, Z3);
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::mul_by_q() const
|
||||
{
|
||||
return alt_bn128_G2(alt_bn128_twist_mul_by_q_X * (this->X).Frobenius_map(1),
|
||||
alt_bn128_twist_mul_by_q_Y * (this->Y).Frobenius_map(1),
|
||||
(this->Z).Frobenius_map(1));
|
||||
}
|
||||
|
||||
bool alt_bn128_G2::is_well_formed() const
|
||||
{
|
||||
if (this->is_zero())
|
||||
{
|
||||
return true;
|
||||
}
|
||||
else
|
||||
{
|
||||
/*
|
||||
y^2 = x^3 + b
|
||||
|
||||
We are using Jacobian coordinates, so equation we need to check is actually
|
||||
|
||||
(y/z^3)^2 = (x/z^2)^3 + b
|
||||
y^2 / z^6 = x^3 / z^6 + b
|
||||
y^2 = x^3 + b z^6
|
||||
*/
|
||||
alt_bn128_Fq2 X2 = this->X.squared();
|
||||
alt_bn128_Fq2 Y2 = this->Y.squared();
|
||||
alt_bn128_Fq2 Z2 = this->Z.squared();
|
||||
|
||||
alt_bn128_Fq2 X3 = this->X * X2;
|
||||
alt_bn128_Fq2 Z3 = this->Z * Z2;
|
||||
alt_bn128_Fq2 Z6 = Z3.squared();
|
||||
|
||||
return (Y2 == X3 + alt_bn128_twist_coeff_b * Z6);
|
||||
}
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::zero()
|
||||
{
|
||||
return G2_zero;
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::one()
|
||||
{
|
||||
return G2_one;
|
||||
}
|
||||
|
||||
alt_bn128_G2 alt_bn128_G2::random_element()
|
||||
{
|
||||
return (alt_bn128_Fr::random_element().as_bigint()) * G2_one;
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream &out, const alt_bn128_G2 &g)
|
||||
{
|
||||
alt_bn128_G2 copy(g);
|
||||
copy.to_affine_coordinates();
|
||||
out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
|
||||
#ifdef NO_PT_COMPRESSION
|
||||
out << copy.X << OUTPUT_SEPARATOR << copy.Y;
|
||||
#else
|
||||
/* storing LSB of Y */
|
||||
out << copy.X << OUTPUT_SEPARATOR << (copy.Y.c0.as_bigint().data[0] & 1);
|
||||
#endif
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
std::istream& operator>>(std::istream &in, alt_bn128_G2 &g)
|
||||
{
|
||||
char is_zero;
|
||||
alt_bn128_Fq2 tX, tY;
|
||||
|
||||
#ifdef NO_PT_COMPRESSION
|
||||
in >> is_zero >> tX >> tY;
|
||||
is_zero -= '0';
|
||||
#else
|
||||
in.read((char*)&is_zero, 1); // this reads is_zero;
|
||||
is_zero -= '0';
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
|
||||
unsigned char Y_lsb;
|
||||
in >> tX;
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
in.read((char*)&Y_lsb, 1);
|
||||
Y_lsb -= '0';
|
||||
|
||||
// y = +/- sqrt(x^3 + b)
|
||||
if (!is_zero)
|
||||
{
|
||||
alt_bn128_Fq2 tX2 = tX.squared();
|
||||
alt_bn128_Fq2 tY2 = tX2 * tX + alt_bn128_twist_coeff_b;
|
||||
tY = tY2.sqrt();
|
||||
|
||||
if ((tY.c0.as_bigint().data[0] & 1) != Y_lsb)
|
||||
{
|
||||
tY = -tY;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
// using projective coordinates
|
||||
if (!is_zero)
|
||||
{
|
||||
g.X = tX;
|
||||
g.Y = tY;
|
||||
g.Z = alt_bn128_Fq2::one();
|
||||
}
|
||||
else
|
||||
{
|
||||
g = alt_bn128_G2::zero();
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
template<>
|
||||
void batch_to_special_all_non_zeros<alt_bn128_G2>(std::vector<alt_bn128_G2> &vec)
|
||||
{
|
||||
std::vector<alt_bn128_Fq2> Z_vec;
|
||||
Z_vec.reserve(vec.size());
|
||||
|
||||
for (auto &el: vec)
|
||||
{
|
||||
Z_vec.emplace_back(el.Z);
|
||||
}
|
||||
batch_invert<alt_bn128_Fq2>(Z_vec);
|
||||
|
||||
const alt_bn128_Fq2 one = alt_bn128_Fq2::one();
|
||||
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
alt_bn128_Fq2 Z2 = Z_vec[i].squared();
|
||||
alt_bn128_Fq2 Z3 = Z_vec[i] * Z2;
|
||||
|
||||
vec[i].X = vec[i].X * Z2;
|
||||
vec[i].Y = vec[i].Y * Z3;
|
||||
vec[i].Z = one;
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
|
@ -0,0 +1,96 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef ALT_BN128_G2_HPP_
|
||||
#define ALT_BN128_G2_HPP_
|
||||
#include <vector>
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_init.hpp"
|
||||
#include "algebra/curves/curve_utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
class alt_bn128_G2;
|
||||
std::ostream& operator<<(std::ostream &, const alt_bn128_G2&);
|
||||
std::istream& operator>>(std::istream &, alt_bn128_G2&);
|
||||
|
||||
class alt_bn128_G2 {
|
||||
public:
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
static long long add_cnt;
|
||||
static long long dbl_cnt;
|
||||
#endif
|
||||
static std::vector<size_t> wnaf_window_table;
|
||||
static std::vector<size_t> fixed_base_exp_window_table;
|
||||
static alt_bn128_G2 G2_zero;
|
||||
static alt_bn128_G2 G2_one;
|
||||
|
||||
typedef alt_bn128_Fq base_field;
|
||||
typedef alt_bn128_Fq2 twist_field;
|
||||
typedef alt_bn128_Fr scalar_field;
|
||||
|
||||
alt_bn128_Fq2 X, Y, Z;
|
||||
|
||||
// using Jacobian coordinates
|
||||
alt_bn128_G2();
|
||||
alt_bn128_G2(const alt_bn128_Fq2& X, const alt_bn128_Fq2& Y, const alt_bn128_Fq2& Z) : X(X), Y(Y), Z(Z) {};
|
||||
|
||||
static alt_bn128_Fq2 mul_by_b(const alt_bn128_Fq2 &elt);
|
||||
|
||||
void print() const;
|
||||
void print_coordinates() const;
|
||||
|
||||
void to_affine_coordinates();
|
||||
void to_special();
|
||||
bool is_special() const;
|
||||
|
||||
bool is_zero() const;
|
||||
|
||||
bool operator==(const alt_bn128_G2 &other) const;
|
||||
bool operator!=(const alt_bn128_G2 &other) const;
|
||||
|
||||
alt_bn128_G2 operator+(const alt_bn128_G2 &other) const;
|
||||
alt_bn128_G2 operator-() const;
|
||||
alt_bn128_G2 operator-(const alt_bn128_G2 &other) const;
|
||||
|
||||
alt_bn128_G2 add(const alt_bn128_G2 &other) const;
|
||||
alt_bn128_G2 mixed_add(const alt_bn128_G2 &other) const;
|
||||
alt_bn128_G2 dbl() const;
|
||||
alt_bn128_G2 mul_by_q() const;
|
||||
|
||||
bool is_well_formed() const;
|
||||
|
||||
static alt_bn128_G2 zero();
|
||||
static alt_bn128_G2 one();
|
||||
static alt_bn128_G2 random_element();
|
||||
|
||||
static size_t size_in_bits() { return twist_field::size_in_bits() + 1; }
|
||||
static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
|
||||
static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
|
||||
|
||||
friend std::ostream& operator<<(std::ostream &out, const alt_bn128_G2 &g);
|
||||
friend std::istream& operator>>(std::istream &in, alt_bn128_G2 &g);
|
||||
};
|
||||
|
||||
template<mp_size_t m>
|
||||
alt_bn128_G2 operator*(const bigint<m> &lhs, const alt_bn128_G2 &rhs)
|
||||
{
|
||||
return scalar_mul<alt_bn128_G2, m>(rhs, lhs);
|
||||
}
|
||||
|
||||
template<mp_size_t m, const bigint<m>& modulus_p>
|
||||
alt_bn128_G2 operator*(const Fp_model<m,modulus_p> &lhs, const alt_bn128_G2 &rhs)
|
||||
{
|
||||
return scalar_mul<alt_bn128_G2, m>(rhs, lhs.as_bigint());
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
void batch_to_special_all_non_zeros(std::vector<T> &vec);
|
||||
template<>
|
||||
void batch_to_special_all_non_zeros<alt_bn128_G2>(std::vector<alt_bn128_G2> &vec);
|
||||
|
||||
} // libsnark
|
||||
#endif // ALT_BN128_G2_HPP_
|
|
@ -0,0 +1,273 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_init.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g1.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g2.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
bigint<alt_bn128_r_limbs> alt_bn128_modulus_r;
|
||||
bigint<alt_bn128_q_limbs> alt_bn128_modulus_q;
|
||||
|
||||
alt_bn128_Fq alt_bn128_coeff_b;
|
||||
alt_bn128_Fq2 alt_bn128_twist;
|
||||
alt_bn128_Fq2 alt_bn128_twist_coeff_b;
|
||||
alt_bn128_Fq alt_bn128_twist_mul_by_b_c0;
|
||||
alt_bn128_Fq alt_bn128_twist_mul_by_b_c1;
|
||||
alt_bn128_Fq2 alt_bn128_twist_mul_by_q_X;
|
||||
alt_bn128_Fq2 alt_bn128_twist_mul_by_q_Y;
|
||||
|
||||
bigint<alt_bn128_q_limbs> alt_bn128_ate_loop_count;
|
||||
bool alt_bn128_ate_is_loop_count_neg;
|
||||
bigint<12*alt_bn128_q_limbs> alt_bn128_final_exponent;
|
||||
bigint<alt_bn128_q_limbs> alt_bn128_final_exponent_z;
|
||||
bool alt_bn128_final_exponent_is_z_neg;
|
||||
|
||||
void init_alt_bn128_params()
|
||||
{
|
||||
typedef bigint<alt_bn128_r_limbs> bigint_r;
|
||||
typedef bigint<alt_bn128_q_limbs> bigint_q;
|
||||
|
||||
assert(sizeof(mp_limb_t) == 8 || sizeof(mp_limb_t) == 4); // Montgomery assumes this
|
||||
|
||||
/* parameters for scalar field Fr */
|
||||
|
||||
alt_bn128_modulus_r = bigint_r("21888242871839275222246405745257275088548364400416034343698204186575808495617");
|
||||
assert(alt_bn128_Fr::modulus_is_valid());
|
||||
if (sizeof(mp_limb_t) == 8)
|
||||
{
|
||||
alt_bn128_Fr::Rsquared = bigint_r("944936681149208446651664254269745548490766851729442924617792859073125903783");
|
||||
alt_bn128_Fr::Rcubed = bigint_r("5866548545943845227489894872040244720403868105578784105281690076696998248512");
|
||||
alt_bn128_Fr::inv = 0xc2e1f593efffffff;
|
||||
}
|
||||
if (sizeof(mp_limb_t) == 4)
|
||||
{
|
||||
alt_bn128_Fr::Rsquared = bigint_r("944936681149208446651664254269745548490766851729442924617792859073125903783");
|
||||
alt_bn128_Fr::Rcubed = bigint_r("5866548545943845227489894872040244720403868105578784105281690076696998248512");
|
||||
alt_bn128_Fr::inv = 0xefffffff;
|
||||
}
|
||||
alt_bn128_Fr::num_bits = 254;
|
||||
alt_bn128_Fr::euler = bigint_r("10944121435919637611123202872628637544274182200208017171849102093287904247808");
|
||||
alt_bn128_Fr::s = 28;
|
||||
alt_bn128_Fr::t = bigint_r("81540058820840996586704275553141814055101440848469862132140264610111");
|
||||
alt_bn128_Fr::t_minus_1_over_2 = bigint_r("40770029410420498293352137776570907027550720424234931066070132305055");
|
||||
alt_bn128_Fr::multiplicative_generator = alt_bn128_Fr("5");
|
||||
alt_bn128_Fr::root_of_unity = alt_bn128_Fr("19103219067921713944291392827692070036145651957329286315305642004821462161904");
|
||||
alt_bn128_Fr::nqr = alt_bn128_Fr("5");
|
||||
alt_bn128_Fr::nqr_to_t = alt_bn128_Fr("19103219067921713944291392827692070036145651957329286315305642004821462161904");
|
||||
|
||||
/* parameters for base field Fq */
|
||||
|
||||
alt_bn128_modulus_q = bigint_q("21888242871839275222246405745257275088696311157297823662689037894645226208583");
|
||||
assert(alt_bn128_Fq::modulus_is_valid());
|
||||
if (sizeof(mp_limb_t) == 8)
|
||||
{
|
||||
alt_bn128_Fq::Rsquared = bigint_q("3096616502983703923843567936837374451735540968419076528771170197431451843209");
|
||||
alt_bn128_Fq::Rcubed = bigint_q("14921786541159648185948152738563080959093619838510245177710943249661917737183");
|
||||
alt_bn128_Fq::inv = 0x87d20782e4866389;
|
||||
}
|
||||
if (sizeof(mp_limb_t) == 4)
|
||||
{
|
||||
alt_bn128_Fq::Rsquared = bigint_q("3096616502983703923843567936837374451735540968419076528771170197431451843209");
|
||||
alt_bn128_Fq::Rcubed = bigint_q("14921786541159648185948152738563080959093619838510245177710943249661917737183");
|
||||
alt_bn128_Fq::inv = 0xe4866389;
|
||||
}
|
||||
alt_bn128_Fq::num_bits = 254;
|
||||
alt_bn128_Fq::euler = bigint_q("10944121435919637611123202872628637544348155578648911831344518947322613104291");
|
||||
alt_bn128_Fq::s = 1;
|
||||
alt_bn128_Fq::t = bigint_q("10944121435919637611123202872628637544348155578648911831344518947322613104291");
|
||||
alt_bn128_Fq::t_minus_1_over_2 = bigint_q("5472060717959818805561601436314318772174077789324455915672259473661306552145");
|
||||
alt_bn128_Fq::multiplicative_generator = alt_bn128_Fq("3");
|
||||
alt_bn128_Fq::root_of_unity = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
|
||||
alt_bn128_Fq::nqr = alt_bn128_Fq("3");
|
||||
alt_bn128_Fq::nqr_to_t = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
|
||||
|
||||
/* parameters for twist field Fq2 */
|
||||
alt_bn128_Fq2::euler = bigint<2*alt_bn128_q_limbs>("239547588008311421220994022608339370399626158265550411218223901127035046843189118723920525909718935985594116157406550130918127817069793474323196511433944");
|
||||
alt_bn128_Fq2::s = 4;
|
||||
alt_bn128_Fq2::t = bigint<2*alt_bn128_q_limbs>("29943448501038927652624252826042421299953269783193801402277987640879380855398639840490065738714866998199264519675818766364765977133724184290399563929243");
|
||||
alt_bn128_Fq2::t_minus_1_over_2 = bigint<2*alt_bn128_q_limbs>("14971724250519463826312126413021210649976634891596900701138993820439690427699319920245032869357433499099632259837909383182382988566862092145199781964621");
|
||||
alt_bn128_Fq2::non_residue = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
|
||||
alt_bn128_Fq2::nqr = alt_bn128_Fq2(alt_bn128_Fq("2"),alt_bn128_Fq("1"));
|
||||
alt_bn128_Fq2::nqr_to_t = alt_bn128_Fq2(alt_bn128_Fq("5033503716262624267312492558379982687175200734934877598599011485707452665730"),alt_bn128_Fq("314498342015008975724433667930697407966947188435857772134235984660852259084"));
|
||||
alt_bn128_Fq2::Frobenius_coeffs_c1[0] = alt_bn128_Fq("1");
|
||||
alt_bn128_Fq2::Frobenius_coeffs_c1[1] = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
|
||||
|
||||
/* parameters for Fq6 */
|
||||
alt_bn128_Fq6::non_residue = alt_bn128_Fq2(alt_bn128_Fq("9"),alt_bn128_Fq("1"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c1[0] = alt_bn128_Fq2(alt_bn128_Fq("1"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c1[1] = alt_bn128_Fq2(alt_bn128_Fq("21575463638280843010398324269430826099269044274347216827212613867836435027261"),alt_bn128_Fq("10307601595873709700152284273816112264069230130616436755625194854815875713954"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c1[2] = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556616"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c1[3] = alt_bn128_Fq2(alt_bn128_Fq("3772000881919853776433695186713858239009073593817195771773381919316419345261"),alt_bn128_Fq("2236595495967245188281701248203181795121068902605861227855261137820944008926"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c1[4] = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651966"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c1[5] = alt_bn128_Fq2(alt_bn128_Fq("18429021223477853657660792034369865839114504446431234726392080002137598044644"),alt_bn128_Fq("9344045779998320333812420223237981029506012124075525679208581902008406485703"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c2[0] = alt_bn128_Fq2(alt_bn128_Fq("1"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c2[1] = alt_bn128_Fq2(alt_bn128_Fq("2581911344467009335267311115468803099551665605076196740867805258568234346338"),alt_bn128_Fq("19937756971775647987995932169929341994314640652964949448313374472400716661030"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c2[2] = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651966"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c2[3] = alt_bn128_Fq2(alt_bn128_Fq("5324479202449903542726783395506214481928257762400643279780343368557297135718"),alt_bn128_Fq("16208900380737693084919495127334387981393726419856888799917914180988844123039"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c2[4] = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556616"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq6::Frobenius_coeffs_c2[5] = alt_bn128_Fq2(alt_bn128_Fq("13981852324922362344252311234282257507216387789820983642040889267519694726527"),alt_bn128_Fq("7629828391165209371577384193250820201684255241773809077146787135900891633097"));
|
||||
|
||||
/* parameters for Fq12 */
|
||||
|
||||
alt_bn128_Fq12::non_residue = alt_bn128_Fq2(alt_bn128_Fq("9"),alt_bn128_Fq("1"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[0] = alt_bn128_Fq2(alt_bn128_Fq("1"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[1] = alt_bn128_Fq2(alt_bn128_Fq("8376118865763821496583973867626364092589906065868298776909617916018768340080"),alt_bn128_Fq("16469823323077808223889137241176536799009286646108169935659301613961712198316"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[2] = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556617"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[3] = alt_bn128_Fq2(alt_bn128_Fq("11697423496358154304825782922584725312912383441159505038794027105778954184319"),alt_bn128_Fq("303847389135065887422783454877609941456349188919719272345083954437860409601"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[4] = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556616"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[5] = alt_bn128_Fq2(alt_bn128_Fq("3321304630594332808241809054958361220322477375291206261884409189760185844239"),alt_bn128_Fq("5722266937896532885780051958958348231143373700109372999374820235121374419868"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[6] = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[7] = alt_bn128_Fq2(alt_bn128_Fq("13512124006075453725662431877630910996106405091429524885779419978626457868503"),alt_bn128_Fq("5418419548761466998357268504080738289687024511189653727029736280683514010267"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[8] = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651966"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[9] = alt_bn128_Fq2(alt_bn128_Fq("10190819375481120917420622822672549775783927716138318623895010788866272024264"),alt_bn128_Fq("21584395482704209334823622290379665147239961968378104390343953940207365798982"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[10] = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651967"),alt_bn128_Fq("0"));
|
||||
alt_bn128_Fq12::Frobenius_coeffs_c1[11] = alt_bn128_Fq2(alt_bn128_Fq("18566938241244942414004596690298913868373833782006617400804628704885040364344"),alt_bn128_Fq("16165975933942742336466353786298926857552937457188450663314217659523851788715"));
|
||||
|
||||
/* choice of short Weierstrass curve and its twist */
|
||||
|
||||
alt_bn128_coeff_b = alt_bn128_Fq("3");
|
||||
alt_bn128_twist = alt_bn128_Fq2(alt_bn128_Fq("9"), alt_bn128_Fq("1"));
|
||||
alt_bn128_twist_coeff_b = alt_bn128_coeff_b * alt_bn128_twist.inverse();
|
||||
alt_bn128_twist_mul_by_b_c0 = alt_bn128_coeff_b * alt_bn128_Fq2::non_residue;
|
||||
alt_bn128_twist_mul_by_b_c1 = alt_bn128_coeff_b * alt_bn128_Fq2::non_residue;
|
||||
alt_bn128_twist_mul_by_q_X = alt_bn128_Fq2(alt_bn128_Fq("21575463638280843010398324269430826099269044274347216827212613867836435027261"),
|
||||
alt_bn128_Fq("10307601595873709700152284273816112264069230130616436755625194854815875713954"));
|
||||
alt_bn128_twist_mul_by_q_Y = alt_bn128_Fq2(alt_bn128_Fq("2821565182194536844548159561693502659359617185244120367078079554186484126554"),
|
||||
alt_bn128_Fq("3505843767911556378687030309984248845540243509899259641013678093033130930403"));
|
||||
|
||||
/* choice of group G1 */
|
||||
alt_bn128_G1::G1_zero = alt_bn128_G1(alt_bn128_Fq::zero(),
|
||||
alt_bn128_Fq::one(),
|
||||
alt_bn128_Fq::zero());
|
||||
alt_bn128_G1::G1_one = alt_bn128_G1(alt_bn128_Fq("1"),
|
||||
alt_bn128_Fq("2"),
|
||||
alt_bn128_Fq::one());
|
||||
alt_bn128_G1::wnaf_window_table.push_back(11);
|
||||
alt_bn128_G1::wnaf_window_table.push_back(24);
|
||||
alt_bn128_G1::wnaf_window_table.push_back(60);
|
||||
alt_bn128_G1::wnaf_window_table.push_back(127);
|
||||
|
||||
alt_bn128_G1::fixed_base_exp_window_table.resize(0);
|
||||
// window 1 is unbeaten in [-inf, 4.99]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(1);
|
||||
// window 2 is unbeaten in [4.99, 10.99]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(5);
|
||||
// window 3 is unbeaten in [10.99, 32.29]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(11);
|
||||
// window 4 is unbeaten in [32.29, 55.23]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(32);
|
||||
// window 5 is unbeaten in [55.23, 162.03]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(55);
|
||||
// window 6 is unbeaten in [162.03, 360.15]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(162);
|
||||
// window 7 is unbeaten in [360.15, 815.44]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(360);
|
||||
// window 8 is unbeaten in [815.44, 2373.07]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(815);
|
||||
// window 9 is unbeaten in [2373.07, 6977.75]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(2373);
|
||||
// window 10 is unbeaten in [6977.75, 7122.23]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(6978);
|
||||
// window 11 is unbeaten in [7122.23, 57818.46]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(7122);
|
||||
// window 12 is never the best
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
|
||||
// window 13 is unbeaten in [57818.46, 169679.14]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(57818);
|
||||
// window 14 is never the best
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
|
||||
// window 15 is unbeaten in [169679.14, 439758.91]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(169679);
|
||||
// window 16 is unbeaten in [439758.91, 936073.41]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(439759);
|
||||
// window 17 is unbeaten in [936073.41, 4666554.74]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(936073);
|
||||
// window 18 is never the best
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
|
||||
// window 19 is unbeaten in [4666554.74, 7580404.42]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(4666555);
|
||||
// window 20 is unbeaten in [7580404.42, 34552892.20]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(7580404);
|
||||
// window 21 is never the best
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
|
||||
// window 22 is unbeaten in [34552892.20, inf]
|
||||
alt_bn128_G1::fixed_base_exp_window_table.push_back(34552892);
|
||||
|
||||
/* choice of group G2 */
|
||||
|
||||
alt_bn128_G2::G2_zero = alt_bn128_G2(alt_bn128_Fq2::zero(),
|
||||
alt_bn128_Fq2::one(),
|
||||
alt_bn128_Fq2::zero());
|
||||
|
||||
alt_bn128_G2::G2_one = alt_bn128_G2(alt_bn128_Fq2(alt_bn128_Fq("10857046999023057135944570762232829481370756359578518086990519993285655852781"),
|
||||
alt_bn128_Fq("11559732032986387107991004021392285783925812861821192530917403151452391805634")),
|
||||
alt_bn128_Fq2(alt_bn128_Fq("8495653923123431417604973247489272438418190587263600148770280649306958101930"),
|
||||
alt_bn128_Fq("4082367875863433681332203403145435568316851327593401208105741076214120093531")),
|
||||
alt_bn128_Fq2::one());
|
||||
alt_bn128_G2::wnaf_window_table.push_back(5);
|
||||
alt_bn128_G2::wnaf_window_table.push_back(15);
|
||||
alt_bn128_G2::wnaf_window_table.push_back(39);
|
||||
alt_bn128_G2::wnaf_window_table.push_back(109);
|
||||
|
||||
alt_bn128_G2::fixed_base_exp_window_table.resize(0);
|
||||
// window 1 is unbeaten in [-inf, 5.10]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(1);
|
||||
// window 2 is unbeaten in [5.10, 10.43]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(5);
|
||||
// window 3 is unbeaten in [10.43, 25.28]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(10);
|
||||
// window 4 is unbeaten in [25.28, 59.00]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(25);
|
||||
// window 5 is unbeaten in [59.00, 154.03]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(59);
|
||||
// window 6 is unbeaten in [154.03, 334.25]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(154);
|
||||
// window 7 is unbeaten in [334.25, 742.58]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(334);
|
||||
// window 8 is unbeaten in [742.58, 2034.40]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(743);
|
||||
// window 9 is unbeaten in [2034.40, 4987.56]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(2034);
|
||||
// window 10 is unbeaten in [4987.56, 8888.27]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(4988);
|
||||
// window 11 is unbeaten in [8888.27, 26271.13]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(8888);
|
||||
// window 12 is unbeaten in [26271.13, 39768.20]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(26271);
|
||||
// window 13 is unbeaten in [39768.20, 106275.75]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(39768);
|
||||
// window 14 is unbeaten in [106275.75, 141703.40]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(106276);
|
||||
// window 15 is unbeaten in [141703.40, 462422.97]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(141703);
|
||||
// window 16 is unbeaten in [462422.97, 926871.84]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(462423);
|
||||
// window 17 is unbeaten in [926871.84, 4873049.17]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(926872);
|
||||
// window 18 is never the best
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(0);
|
||||
// window 19 is unbeaten in [4873049.17, 5706707.88]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(4873049);
|
||||
// window 20 is unbeaten in [5706707.88, 31673814.95]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(5706708);
|
||||
// window 21 is never the best
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(0);
|
||||
// window 22 is unbeaten in [31673814.95, inf]
|
||||
alt_bn128_G2::fixed_base_exp_window_table.push_back(31673815);
|
||||
|
||||
/* pairing parameters */
|
||||
|
||||
alt_bn128_ate_loop_count = bigint_q("29793968203157093288");
|
||||
alt_bn128_ate_is_loop_count_neg = false;
|
||||
alt_bn128_final_exponent = bigint<12*alt_bn128_q_limbs>("552484233613224096312617126783173147097382103762957654188882734314196910839907541213974502761540629817009608548654680343627701153829446747810907373256841551006201639677726139946029199968412598804882391702273019083653272047566316584365559776493027495458238373902875937659943504873220554161550525926302303331747463515644711876653177129578303191095900909191624817826566688241804408081892785725967931714097716709526092261278071952560171111444072049229123565057483750161460024353346284167282452756217662335528813519139808291170539072125381230815729071544861602750936964829313608137325426383735122175229541155376346436093930287402089517426973178917569713384748081827255472576937471496195752727188261435633271238710131736096299798168852925540549342330775279877006784354801422249722573783561685179618816480037695005515426162362431072245638324744480");
|
||||
alt_bn128_final_exponent_z = bigint_q("4965661367192848881");
|
||||
alt_bn128_final_exponent_is_z_neg = false;
|
||||
|
||||
}
|
||||
} // libsnark
|
|
@ -0,0 +1,57 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef ALT_BN128_INIT_HPP_
|
||||
#define ALT_BN128_INIT_HPP_
|
||||
#include "algebra/curves/public_params.hpp"
|
||||
#include "algebra/fields/fp.hpp"
|
||||
#include "algebra/fields/fp2.hpp"
|
||||
#include "algebra/fields/fp6_3over2.hpp"
|
||||
#include "algebra/fields/fp12_2over3over2.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
const mp_size_t alt_bn128_r_bitcount = 254;
|
||||
const mp_size_t alt_bn128_q_bitcount = 254;
|
||||
|
||||
const mp_size_t alt_bn128_r_limbs = (alt_bn128_r_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
|
||||
const mp_size_t alt_bn128_q_limbs = (alt_bn128_q_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
|
||||
|
||||
extern bigint<alt_bn128_r_limbs> alt_bn128_modulus_r;
|
||||
extern bigint<alt_bn128_q_limbs> alt_bn128_modulus_q;
|
||||
|
||||
typedef Fp_model<alt_bn128_r_limbs, alt_bn128_modulus_r> alt_bn128_Fr;
|
||||
typedef Fp_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq;
|
||||
typedef Fp2_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq2;
|
||||
typedef Fp6_3over2_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq6;
|
||||
typedef Fp12_2over3over2_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq12;
|
||||
typedef alt_bn128_Fq12 alt_bn128_GT;
|
||||
|
||||
// parameters for Barreto--Naehrig curve E/Fq : y^2 = x^3 + b
|
||||
extern alt_bn128_Fq alt_bn128_coeff_b;
|
||||
// parameters for twisted Barreto--Naehrig curve E'/Fq2 : y^2 = x^3 + b/xi
|
||||
extern alt_bn128_Fq2 alt_bn128_twist;
|
||||
extern alt_bn128_Fq2 alt_bn128_twist_coeff_b;
|
||||
extern alt_bn128_Fq alt_bn128_twist_mul_by_b_c0;
|
||||
extern alt_bn128_Fq alt_bn128_twist_mul_by_b_c1;
|
||||
extern alt_bn128_Fq2 alt_bn128_twist_mul_by_q_X;
|
||||
extern alt_bn128_Fq2 alt_bn128_twist_mul_by_q_Y;
|
||||
|
||||
// parameters for pairing
|
||||
extern bigint<alt_bn128_q_limbs> alt_bn128_ate_loop_count;
|
||||
extern bool alt_bn128_ate_is_loop_count_neg;
|
||||
extern bigint<12*alt_bn128_q_limbs> alt_bn128_final_exponent;
|
||||
extern bigint<alt_bn128_q_limbs> alt_bn128_final_exponent_z;
|
||||
extern bool alt_bn128_final_exponent_is_z_neg;
|
||||
|
||||
void init_alt_bn128_params();
|
||||
|
||||
class alt_bn128_G1;
|
||||
class alt_bn128_G2;
|
||||
|
||||
} // libsnark
|
||||
#endif // ALT_BN128_INIT_HPP_
|
|
@ -0,0 +1,547 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_pairing.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_init.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g1.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g2.hpp"
|
||||
#include <cassert>
|
||||
#include "common/profiling.hpp"
|
||||
#include "common/assert_except.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
bool alt_bn128_ate_G1_precomp::operator==(const alt_bn128_ate_G1_precomp &other) const
|
||||
{
|
||||
return (this->PX == other.PX &&
|
||||
this->PY == other.PY);
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_G1_precomp &prec_P)
|
||||
{
|
||||
out << prec_P.PX << OUTPUT_SEPARATOR << prec_P.PY;
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
std::istream& operator>>(std::istream &in, alt_bn128_ate_G1_precomp &prec_P)
|
||||
{
|
||||
in >> prec_P.PX;
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
in >> prec_P.PY;
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
bool alt_bn128_ate_ell_coeffs::operator==(const alt_bn128_ate_ell_coeffs &other) const
|
||||
{
|
||||
return (this->ell_0 == other.ell_0 &&
|
||||
this->ell_VW == other.ell_VW &&
|
||||
this->ell_VV == other.ell_VV);
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_ell_coeffs &c)
|
||||
{
|
||||
out << c.ell_0 << OUTPUT_SEPARATOR << c.ell_VW << OUTPUT_SEPARATOR << c.ell_VV;
|
||||
return out;
|
||||
}
|
||||
|
||||
std::istream& operator>>(std::istream &in, alt_bn128_ate_ell_coeffs &c)
|
||||
{
|
||||
in >> c.ell_0;
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
in >> c.ell_VW;
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
in >> c.ell_VV;
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
bool alt_bn128_ate_G2_precomp::operator==(const alt_bn128_ate_G2_precomp &other) const
|
||||
{
|
||||
return (this->QX == other.QX &&
|
||||
this->QY == other.QY &&
|
||||
this->coeffs == other.coeffs);
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream& out, const alt_bn128_ate_G2_precomp &prec_Q)
|
||||
{
|
||||
out << prec_Q.QX << OUTPUT_SEPARATOR << prec_Q.QY << "\n";
|
||||
out << prec_Q.coeffs.size() << "\n";
|
||||
for (const alt_bn128_ate_ell_coeffs &c : prec_Q.coeffs)
|
||||
{
|
||||
out << c << OUTPUT_NEWLINE;
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
std::istream& operator>>(std::istream& in, alt_bn128_ate_G2_precomp &prec_Q)
|
||||
{
|
||||
in >> prec_Q.QX;
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
in >> prec_Q.QY;
|
||||
consume_newline(in);
|
||||
|
||||
prec_Q.coeffs.clear();
|
||||
size_t s;
|
||||
in >> s;
|
||||
|
||||
consume_newline(in);
|
||||
|
||||
prec_Q.coeffs.reserve(s);
|
||||
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
alt_bn128_ate_ell_coeffs c;
|
||||
in >> c;
|
||||
consume_OUTPUT_NEWLINE(in);
|
||||
prec_Q.coeffs.emplace_back(c);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
/* final exponentiations */
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_final_exponentiation_first_chunk(const alt_bn128_Fq12 &elt)
|
||||
{
|
||||
enter_block("Call to alt_bn128_final_exponentiation_first_chunk");
|
||||
|
||||
/*
|
||||
Computes result = elt^((q^6-1)*(q^2+1)).
|
||||
Follows, e.g., Beuchat et al page 9, by computing result as follows:
|
||||
elt^((q^6-1)*(q^2+1)) = (conj(elt) * elt^(-1))^(q^2+1)
|
||||
More precisely:
|
||||
A = conj(elt)
|
||||
B = elt.inverse()
|
||||
C = A * B
|
||||
D = C.Frobenius_map(2)
|
||||
result = D * C
|
||||
*/
|
||||
|
||||
const alt_bn128_Fq12 A = alt_bn128_Fq12(elt.c0,-elt.c1);
|
||||
const alt_bn128_Fq12 B = elt.inverse();
|
||||
const alt_bn128_Fq12 C = A * B;
|
||||
const alt_bn128_Fq12 D = C.Frobenius_map(2);
|
||||
const alt_bn128_Fq12 result = D * C;
|
||||
|
||||
leave_block("Call to alt_bn128_final_exponentiation_first_chunk");
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_exp_by_neg_z(const alt_bn128_Fq12 &elt)
|
||||
{
|
||||
enter_block("Call to alt_bn128_exp_by_neg_z");
|
||||
|
||||
alt_bn128_Fq12 result = elt.cyclotomic_exp(alt_bn128_final_exponent_z);
|
||||
if (!alt_bn128_final_exponent_is_z_neg)
|
||||
{
|
||||
result = result.unitary_inverse();
|
||||
}
|
||||
|
||||
leave_block("Call to alt_bn128_exp_by_neg_z");
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_final_exponentiation_last_chunk(const alt_bn128_Fq12 &elt)
|
||||
{
|
||||
enter_block("Call to alt_bn128_final_exponentiation_last_chunk");
|
||||
|
||||
/*
|
||||
Follows Laura Fuentes-Castaneda et al. "Faster hashing to G2"
|
||||
by computing:
|
||||
|
||||
result = elt^(q^3 * (12*z^3 + 6z^2 + 4z - 1) +
|
||||
q^2 * (12*z^3 + 6z^2 + 6z) +
|
||||
q * (12*z^3 + 6z^2 + 4z) +
|
||||
1 * (12*z^3 + 12z^2 + 6z + 1))
|
||||
which equals
|
||||
|
||||
result = elt^( 2z * ( 6z^2 + 3z + 1 ) * (q^4 - q^2 + 1)/r ).
|
||||
|
||||
Using the following addition chain:
|
||||
|
||||
A = exp_by_neg_z(elt) // = elt^(-z)
|
||||
B = A^2 // = elt^(-2*z)
|
||||
C = B^2 // = elt^(-4*z)
|
||||
D = C * B // = elt^(-6*z)
|
||||
E = exp_by_neg_z(D) // = elt^(6*z^2)
|
||||
F = E^2 // = elt^(12*z^2)
|
||||
G = epx_by_neg_z(F) // = elt^(-12*z^3)
|
||||
H = conj(D) // = elt^(6*z)
|
||||
I = conj(G) // = elt^(12*z^3)
|
||||
J = I * E // = elt^(12*z^3 + 6*z^2)
|
||||
K = J * H // = elt^(12*z^3 + 6*z^2 + 6*z)
|
||||
L = K * B // = elt^(12*z^3 + 6*z^2 + 4*z)
|
||||
M = K * E // = elt^(12*z^3 + 12*z^2 + 6*z)
|
||||
N = M * elt // = elt^(12*z^3 + 12*z^2 + 6*z + 1)
|
||||
O = L.Frobenius_map(1) // = elt^(q*(12*z^3 + 6*z^2 + 4*z))
|
||||
P = O * N // = elt^(q*(12*z^3 + 6*z^2 + 4*z) * (12*z^3 + 12*z^2 + 6*z + 1))
|
||||
Q = K.Frobenius_map(2) // = elt^(q^2 * (12*z^3 + 6*z^2 + 6*z))
|
||||
R = Q * P // = elt^(q^2 * (12*z^3 + 6*z^2 + 6*z) + q*(12*z^3 + 6*z^2 + 4*z) * (12*z^3 + 12*z^2 + 6*z + 1))
|
||||
S = conj(elt) // = elt^(-1)
|
||||
T = S * L // = elt^(12*z^3 + 6*z^2 + 4*z - 1)
|
||||
U = T.Frobenius_map(3) // = elt^(q^3(12*z^3 + 6*z^2 + 4*z - 1))
|
||||
V = U * R // = elt^(q^3(12*z^3 + 6*z^2 + 4*z - 1) + q^2 * (12*z^3 + 6*z^2 + 6*z) + q*(12*z^3 + 6*z^2 + 4*z) * (12*z^3 + 12*z^2 + 6*z + 1))
|
||||
result = V
|
||||
|
||||
*/
|
||||
|
||||
const alt_bn128_Fq12 A = alt_bn128_exp_by_neg_z(elt);
|
||||
const alt_bn128_Fq12 B = A.cyclotomic_squared();
|
||||
const alt_bn128_Fq12 C = B.cyclotomic_squared();
|
||||
const alt_bn128_Fq12 D = C * B;
|
||||
const alt_bn128_Fq12 E = alt_bn128_exp_by_neg_z(D);
|
||||
const alt_bn128_Fq12 F = E.cyclotomic_squared();
|
||||
const alt_bn128_Fq12 G = alt_bn128_exp_by_neg_z(F);
|
||||
const alt_bn128_Fq12 H = D.unitary_inverse();
|
||||
const alt_bn128_Fq12 I = G.unitary_inverse();
|
||||
const alt_bn128_Fq12 J = I * E;
|
||||
const alt_bn128_Fq12 K = J * H;
|
||||
const alt_bn128_Fq12 L = K * B;
|
||||
const alt_bn128_Fq12 M = K * E;
|
||||
const alt_bn128_Fq12 N = M * elt;
|
||||
const alt_bn128_Fq12 O = L.Frobenius_map(1);
|
||||
const alt_bn128_Fq12 P = O * N;
|
||||
const alt_bn128_Fq12 Q = K.Frobenius_map(2);
|
||||
const alt_bn128_Fq12 R = Q * P;
|
||||
const alt_bn128_Fq12 S = elt.unitary_inverse();
|
||||
const alt_bn128_Fq12 T = S * L;
|
||||
const alt_bn128_Fq12 U = T.Frobenius_map(3);
|
||||
const alt_bn128_Fq12 V = U * R;
|
||||
|
||||
const alt_bn128_Fq12 result = V;
|
||||
|
||||
leave_block("Call to alt_bn128_final_exponentiation_last_chunk");
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
alt_bn128_GT alt_bn128_final_exponentiation(const alt_bn128_Fq12 &elt)
|
||||
{
|
||||
enter_block("Call to alt_bn128_final_exponentiation");
|
||||
/* OLD naive version:
|
||||
alt_bn128_GT result = elt^alt_bn128_final_exponent;
|
||||
*/
|
||||
alt_bn128_Fq12 A = alt_bn128_final_exponentiation_first_chunk(elt);
|
||||
alt_bn128_GT result = alt_bn128_final_exponentiation_last_chunk(A);
|
||||
|
||||
leave_block("Call to alt_bn128_final_exponentiation");
|
||||
return result;
|
||||
}
|
||||
|
||||
/* ate pairing */
|
||||
|
||||
void doubling_step_for_flipped_miller_loop(const alt_bn128_Fq two_inv,
|
||||
alt_bn128_G2 ¤t,
|
||||
alt_bn128_ate_ell_coeffs &c)
|
||||
{
|
||||
const alt_bn128_Fq2 X = current.X, Y = current.Y, Z = current.Z;
|
||||
|
||||
const alt_bn128_Fq2 A = two_inv * (X * Y); // A = X1 * Y1 / 2
|
||||
const alt_bn128_Fq2 B = Y.squared(); // B = Y1^2
|
||||
const alt_bn128_Fq2 C = Z.squared(); // C = Z1^2
|
||||
const alt_bn128_Fq2 D = C+C+C; // D = 3 * C
|
||||
const alt_bn128_Fq2 E = alt_bn128_twist_coeff_b * D; // E = twist_b * D
|
||||
const alt_bn128_Fq2 F = E+E+E; // F = 3 * E
|
||||
const alt_bn128_Fq2 G = two_inv * (B+F); // G = (B+F)/2
|
||||
const alt_bn128_Fq2 H = (Y+Z).squared() - (B+C); // H = (Y1+Z1)^2-(B+C)
|
||||
const alt_bn128_Fq2 I = E-B; // I = E-B
|
||||
const alt_bn128_Fq2 J = X.squared(); // J = X1^2
|
||||
const alt_bn128_Fq2 E_squared = E.squared(); // E_squared = E^2
|
||||
|
||||
current.X = A * (B-F); // X3 = A * (B-F)
|
||||
current.Y = G.squared() - (E_squared+E_squared+E_squared); // Y3 = G^2 - 3*E^2
|
||||
current.Z = B * H; // Z3 = B * H
|
||||
c.ell_0 = alt_bn128_twist * I; // ell_0 = xi * I
|
||||
c.ell_VW = -H; // ell_VW = - H (later: * yP)
|
||||
c.ell_VV = J+J+J; // ell_VV = 3*J (later: * xP)
|
||||
}
|
||||
|
||||
void mixed_addition_step_for_flipped_miller_loop(const alt_bn128_G2 base,
|
||||
alt_bn128_G2 ¤t,
|
||||
alt_bn128_ate_ell_coeffs &c)
|
||||
{
|
||||
const alt_bn128_Fq2 X1 = current.X, Y1 = current.Y, Z1 = current.Z;
|
||||
const alt_bn128_Fq2 &x2 = base.X, &y2 = base.Y;
|
||||
|
||||
const alt_bn128_Fq2 D = X1 - x2 * Z1; // D = X1 - X2*Z1
|
||||
const alt_bn128_Fq2 E = Y1 - y2 * Z1; // E = Y1 - Y2*Z1
|
||||
const alt_bn128_Fq2 F = D.squared(); // F = D^2
|
||||
const alt_bn128_Fq2 G = E.squared(); // G = E^2
|
||||
const alt_bn128_Fq2 H = D*F; // H = D*F
|
||||
const alt_bn128_Fq2 I = X1 * F; // I = X1 * F
|
||||
const alt_bn128_Fq2 J = H + Z1*G - (I+I); // J = H + Z1*G - (I+I)
|
||||
|
||||
current.X = D * J; // X3 = D*J
|
||||
current.Y = E * (I-J)-(H * Y1); // Y3 = E*(I-J)-(H*Y1)
|
||||
current.Z = Z1 * H; // Z3 = Z1*H
|
||||
c.ell_0 = alt_bn128_twist * (E * x2 - D * y2); // ell_0 = xi * (E * X2 - D * Y2)
|
||||
c.ell_VV = - E; // ell_VV = - E (later: * xP)
|
||||
c.ell_VW = D; // ell_VW = D (later: * yP )
|
||||
}
|
||||
|
||||
alt_bn128_ate_G1_precomp alt_bn128_ate_precompute_G1(const alt_bn128_G1& P)
|
||||
{
|
||||
enter_block("Call to alt_bn128_ate_precompute_G1");
|
||||
|
||||
alt_bn128_G1 Pcopy = P;
|
||||
Pcopy.to_affine_coordinates();
|
||||
|
||||
alt_bn128_ate_G1_precomp result;
|
||||
result.PX = Pcopy.X;
|
||||
result.PY = Pcopy.Y;
|
||||
|
||||
leave_block("Call to alt_bn128_ate_precompute_G1");
|
||||
return result;
|
||||
}
|
||||
|
||||
alt_bn128_ate_G2_precomp alt_bn128_ate_precompute_G2(const alt_bn128_G2& Q)
|
||||
{
|
||||
enter_block("Call to alt_bn128_ate_precompute_G2");
|
||||
|
||||
alt_bn128_G2 Qcopy(Q);
|
||||
Qcopy.to_affine_coordinates();
|
||||
|
||||
alt_bn128_Fq two_inv = (alt_bn128_Fq("2").inverse()); // could add to global params if needed
|
||||
|
||||
alt_bn128_ate_G2_precomp result;
|
||||
result.QX = Qcopy.X;
|
||||
result.QY = Qcopy.Y;
|
||||
|
||||
alt_bn128_G2 R;
|
||||
R.X = Qcopy.X;
|
||||
R.Y = Qcopy.Y;
|
||||
R.Z = alt_bn128_Fq2::one();
|
||||
|
||||
const bigint<alt_bn128_Fr::num_limbs> &loop_count = alt_bn128_ate_loop_count;
|
||||
bool found_one = false;
|
||||
alt_bn128_ate_ell_coeffs c;
|
||||
|
||||
for (long i = loop_count.max_bits(); i >= 0; --i)
|
||||
{
|
||||
const bool bit = loop_count.test_bit(i);
|
||||
if (!found_one)
|
||||
{
|
||||
/* this skips the MSB itself */
|
||||
found_one |= bit;
|
||||
continue;
|
||||
}
|
||||
|
||||
doubling_step_for_flipped_miller_loop(two_inv, R, c);
|
||||
result.coeffs.push_back(c);
|
||||
|
||||
if (bit)
|
||||
{
|
||||
mixed_addition_step_for_flipped_miller_loop(Qcopy, R, c);
|
||||
result.coeffs.push_back(c);
|
||||
}
|
||||
}
|
||||
|
||||
alt_bn128_G2 Q1 = Qcopy.mul_by_q();
|
||||
assert_except(Q1.Z == alt_bn128_Fq2::one());
|
||||
alt_bn128_G2 Q2 = Q1.mul_by_q();
|
||||
assert_except(Q2.Z == alt_bn128_Fq2::one());
|
||||
|
||||
if (alt_bn128_ate_is_loop_count_neg)
|
||||
{
|
||||
R.Y = - R.Y;
|
||||
}
|
||||
Q2.Y = - Q2.Y;
|
||||
|
||||
mixed_addition_step_for_flipped_miller_loop(Q1, R, c);
|
||||
result.coeffs.push_back(c);
|
||||
|
||||
mixed_addition_step_for_flipped_miller_loop(Q2, R, c);
|
||||
result.coeffs.push_back(c);
|
||||
|
||||
leave_block("Call to alt_bn128_ate_precompute_G2");
|
||||
return result;
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_ate_miller_loop(const alt_bn128_ate_G1_precomp &prec_P,
|
||||
const alt_bn128_ate_G2_precomp &prec_Q)
|
||||
{
|
||||
enter_block("Call to alt_bn128_ate_miller_loop");
|
||||
|
||||
alt_bn128_Fq12 f = alt_bn128_Fq12::one();
|
||||
|
||||
bool found_one = false;
|
||||
size_t idx = 0;
|
||||
|
||||
const bigint<alt_bn128_Fr::num_limbs> &loop_count = alt_bn128_ate_loop_count;
|
||||
alt_bn128_ate_ell_coeffs c;
|
||||
|
||||
for (long i = loop_count.max_bits(); i >= 0; --i)
|
||||
{
|
||||
const bool bit = loop_count.test_bit(i);
|
||||
if (!found_one)
|
||||
{
|
||||
/* this skips the MSB itself */
|
||||
found_one |= bit;
|
||||
continue;
|
||||
}
|
||||
|
||||
/* code below gets executed for all bits (EXCEPT the MSB itself) of
|
||||
alt_bn128_param_p (skipping leading zeros) in MSB to LSB
|
||||
order */
|
||||
|
||||
c = prec_Q.coeffs[idx++];
|
||||
f = f.squared();
|
||||
f = f.mul_by_024(c.ell_0, prec_P.PY * c.ell_VW, prec_P.PX * c.ell_VV);
|
||||
|
||||
if (bit)
|
||||
{
|
||||
c = prec_Q.coeffs[idx++];
|
||||
f = f.mul_by_024(c.ell_0, prec_P.PY * c.ell_VW, prec_P.PX * c.ell_VV);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (alt_bn128_ate_is_loop_count_neg)
|
||||
{
|
||||
f = f.inverse();
|
||||
}
|
||||
|
||||
c = prec_Q.coeffs[idx++];
|
||||
f = f.mul_by_024(c.ell_0,prec_P.PY * c.ell_VW,prec_P.PX * c.ell_VV);
|
||||
|
||||
c = prec_Q.coeffs[idx++];
|
||||
f = f.mul_by_024(c.ell_0,prec_P.PY * c.ell_VW,prec_P.PX * c.ell_VV);
|
||||
|
||||
leave_block("Call to alt_bn128_ate_miller_loop");
|
||||
return f;
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_ate_double_miller_loop(const alt_bn128_ate_G1_precomp &prec_P1,
|
||||
const alt_bn128_ate_G2_precomp &prec_Q1,
|
||||
const alt_bn128_ate_G1_precomp &prec_P2,
|
||||
const alt_bn128_ate_G2_precomp &prec_Q2)
|
||||
{
|
||||
enter_block("Call to alt_bn128_ate_double_miller_loop");
|
||||
|
||||
alt_bn128_Fq12 f = alt_bn128_Fq12::one();
|
||||
|
||||
bool found_one = false;
|
||||
size_t idx = 0;
|
||||
|
||||
const bigint<alt_bn128_Fr::num_limbs> &loop_count = alt_bn128_ate_loop_count;
|
||||
for (long i = loop_count.max_bits(); i >= 0; --i)
|
||||
{
|
||||
const bool bit = loop_count.test_bit(i);
|
||||
if (!found_one)
|
||||
{
|
||||
/* this skips the MSB itself */
|
||||
found_one |= bit;
|
||||
continue;
|
||||
}
|
||||
|
||||
/* code below gets executed for all bits (EXCEPT the MSB itself) of
|
||||
alt_bn128_param_p (skipping leading zeros) in MSB to LSB
|
||||
order */
|
||||
|
||||
alt_bn128_ate_ell_coeffs c1 = prec_Q1.coeffs[idx];
|
||||
alt_bn128_ate_ell_coeffs c2 = prec_Q2.coeffs[idx];
|
||||
++idx;
|
||||
|
||||
f = f.squared();
|
||||
|
||||
f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
|
||||
f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
|
||||
|
||||
if (bit)
|
||||
{
|
||||
alt_bn128_ate_ell_coeffs c1 = prec_Q1.coeffs[idx];
|
||||
alt_bn128_ate_ell_coeffs c2 = prec_Q2.coeffs[idx];
|
||||
++idx;
|
||||
|
||||
f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
|
||||
f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
|
||||
}
|
||||
}
|
||||
|
||||
if (alt_bn128_ate_is_loop_count_neg)
|
||||
{
|
||||
f = f.inverse();
|
||||
}
|
||||
|
||||
alt_bn128_ate_ell_coeffs c1 = prec_Q1.coeffs[idx];
|
||||
alt_bn128_ate_ell_coeffs c2 = prec_Q2.coeffs[idx];
|
||||
++idx;
|
||||
f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
|
||||
f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
|
||||
|
||||
c1 = prec_Q1.coeffs[idx];
|
||||
c2 = prec_Q2.coeffs[idx];
|
||||
++idx;
|
||||
f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
|
||||
f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
|
||||
|
||||
leave_block("Call to alt_bn128_ate_double_miller_loop");
|
||||
|
||||
return f;
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_ate_pairing(const alt_bn128_G1& P, const alt_bn128_G2 &Q)
|
||||
{
|
||||
enter_block("Call to alt_bn128_ate_pairing");
|
||||
alt_bn128_ate_G1_precomp prec_P = alt_bn128_ate_precompute_G1(P);
|
||||
alt_bn128_ate_G2_precomp prec_Q = alt_bn128_ate_precompute_G2(Q);
|
||||
alt_bn128_Fq12 result = alt_bn128_ate_miller_loop(prec_P, prec_Q);
|
||||
leave_block("Call to alt_bn128_ate_pairing");
|
||||
return result;
|
||||
}
|
||||
|
||||
alt_bn128_GT alt_bn128_ate_reduced_pairing(const alt_bn128_G1 &P, const alt_bn128_G2 &Q)
|
||||
{
|
||||
enter_block("Call to alt_bn128_ate_reduced_pairing");
|
||||
const alt_bn128_Fq12 f = alt_bn128_ate_pairing(P, Q);
|
||||
const alt_bn128_GT result = alt_bn128_final_exponentiation(f);
|
||||
leave_block("Call to alt_bn128_ate_reduced_pairing");
|
||||
return result;
|
||||
}
|
||||
|
||||
/* choice of pairing */
|
||||
|
||||
alt_bn128_G1_precomp alt_bn128_precompute_G1(const alt_bn128_G1& P)
|
||||
{
|
||||
return alt_bn128_ate_precompute_G1(P);
|
||||
}
|
||||
|
||||
alt_bn128_G2_precomp alt_bn128_precompute_G2(const alt_bn128_G2& Q)
|
||||
{
|
||||
return alt_bn128_ate_precompute_G2(Q);
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_miller_loop(const alt_bn128_G1_precomp &prec_P,
|
||||
const alt_bn128_G2_precomp &prec_Q)
|
||||
{
|
||||
return alt_bn128_ate_miller_loop(prec_P, prec_Q);
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
|
||||
const alt_bn128_G2_precomp &prec_Q1,
|
||||
const alt_bn128_G1_precomp &prec_P2,
|
||||
const alt_bn128_G2_precomp &prec_Q2)
|
||||
{
|
||||
return alt_bn128_ate_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_pairing(const alt_bn128_G1& P,
|
||||
const alt_bn128_G2 &Q)
|
||||
{
|
||||
return alt_bn128_ate_pairing(P, Q);
|
||||
}
|
||||
|
||||
alt_bn128_GT alt_bn128_reduced_pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q)
|
||||
{
|
||||
return alt_bn128_ate_reduced_pairing(P, Q);
|
||||
}
|
||||
} // libsnark
|
|
@ -0,0 +1,92 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef ALT_BN128_PAIRING_HPP_
|
||||
#define ALT_BN128_PAIRING_HPP_
|
||||
#include <vector>
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_init.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/* final exponentiation */
|
||||
|
||||
alt_bn128_GT alt_bn128_final_exponentiation(const alt_bn128_Fq12 &elt);
|
||||
|
||||
/* ate pairing */
|
||||
|
||||
struct alt_bn128_ate_G1_precomp {
|
||||
alt_bn128_Fq PX;
|
||||
alt_bn128_Fq PY;
|
||||
|
||||
bool operator==(const alt_bn128_ate_G1_precomp &other) const;
|
||||
friend std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_G1_precomp &prec_P);
|
||||
friend std::istream& operator>>(std::istream &in, alt_bn128_ate_G1_precomp &prec_P);
|
||||
};
|
||||
|
||||
struct alt_bn128_ate_ell_coeffs {
|
||||
alt_bn128_Fq2 ell_0;
|
||||
alt_bn128_Fq2 ell_VW;
|
||||
alt_bn128_Fq2 ell_VV;
|
||||
|
||||
bool operator==(const alt_bn128_ate_ell_coeffs &other) const;
|
||||
friend std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_ell_coeffs &dc);
|
||||
friend std::istream& operator>>(std::istream &in, alt_bn128_ate_ell_coeffs &dc);
|
||||
};
|
||||
|
||||
struct alt_bn128_ate_G2_precomp {
|
||||
alt_bn128_Fq2 QX;
|
||||
alt_bn128_Fq2 QY;
|
||||
std::vector<alt_bn128_ate_ell_coeffs> coeffs;
|
||||
|
||||
bool operator==(const alt_bn128_ate_G2_precomp &other) const;
|
||||
friend std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_G2_precomp &prec_Q);
|
||||
friend std::istream& operator>>(std::istream &in, alt_bn128_ate_G2_precomp &prec_Q);
|
||||
};
|
||||
|
||||
alt_bn128_ate_G1_precomp alt_bn128_ate_precompute_G1(const alt_bn128_G1& P);
|
||||
alt_bn128_ate_G2_precomp alt_bn128_ate_precompute_G2(const alt_bn128_G2& Q);
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_ate_miller_loop(const alt_bn128_ate_G1_precomp &prec_P,
|
||||
const alt_bn128_ate_G2_precomp &prec_Q);
|
||||
alt_bn128_Fq12 alt_bn128_ate_double_miller_loop(const alt_bn128_ate_G1_precomp &prec_P1,
|
||||
const alt_bn128_ate_G2_precomp &prec_Q1,
|
||||
const alt_bn128_ate_G1_precomp &prec_P2,
|
||||
const alt_bn128_ate_G2_precomp &prec_Q2);
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_ate_pairing(const alt_bn128_G1& P,
|
||||
const alt_bn128_G2 &Q);
|
||||
alt_bn128_GT alt_bn128_ate_reduced_pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q);
|
||||
|
||||
/* choice of pairing */
|
||||
|
||||
typedef alt_bn128_ate_G1_precomp alt_bn128_G1_precomp;
|
||||
typedef alt_bn128_ate_G2_precomp alt_bn128_G2_precomp;
|
||||
|
||||
alt_bn128_G1_precomp alt_bn128_precompute_G1(const alt_bn128_G1& P);
|
||||
|
||||
alt_bn128_G2_precomp alt_bn128_precompute_G2(const alt_bn128_G2& Q);
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_miller_loop(const alt_bn128_G1_precomp &prec_P,
|
||||
const alt_bn128_G2_precomp &prec_Q);
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
|
||||
const alt_bn128_G2_precomp &prec_Q1,
|
||||
const alt_bn128_G1_precomp &prec_P2,
|
||||
const alt_bn128_G2_precomp &prec_Q2);
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_pairing(const alt_bn128_G1& P,
|
||||
const alt_bn128_G2 &Q);
|
||||
|
||||
alt_bn128_GT alt_bn128_reduced_pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q);
|
||||
|
||||
alt_bn128_GT alt_bn128_affine_reduced_pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q);
|
||||
|
||||
} // libsnark
|
||||
#endif // ALT_BN128_PAIRING_HPP_
|
|
@ -0,0 +1,58 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_pp.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
void alt_bn128_pp::init_public_params()
|
||||
{
|
||||
init_alt_bn128_params();
|
||||
}
|
||||
|
||||
alt_bn128_GT alt_bn128_pp::final_exponentiation(const alt_bn128_Fq12 &elt)
|
||||
{
|
||||
return alt_bn128_final_exponentiation(elt);
|
||||
}
|
||||
|
||||
alt_bn128_G1_precomp alt_bn128_pp::precompute_G1(const alt_bn128_G1 &P)
|
||||
{
|
||||
return alt_bn128_precompute_G1(P);
|
||||
}
|
||||
|
||||
alt_bn128_G2_precomp alt_bn128_pp::precompute_G2(const alt_bn128_G2 &Q)
|
||||
{
|
||||
return alt_bn128_precompute_G2(Q);
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_pp::miller_loop(const alt_bn128_G1_precomp &prec_P,
|
||||
const alt_bn128_G2_precomp &prec_Q)
|
||||
{
|
||||
return alt_bn128_miller_loop(prec_P, prec_Q);
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_pp::double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
|
||||
const alt_bn128_G2_precomp &prec_Q1,
|
||||
const alt_bn128_G1_precomp &prec_P2,
|
||||
const alt_bn128_G2_precomp &prec_Q2)
|
||||
{
|
||||
return alt_bn128_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_pp::pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q)
|
||||
{
|
||||
return alt_bn128_pairing(P, Q);
|
||||
}
|
||||
|
||||
alt_bn128_Fq12 alt_bn128_pp::reduced_pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q)
|
||||
{
|
||||
return alt_bn128_reduced_pairing(P, Q);
|
||||
}
|
||||
|
||||
} // libsnark
|
|
@ -0,0 +1,50 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef ALT_BN128_PP_HPP_
|
||||
#define ALT_BN128_PP_HPP_
|
||||
#include "algebra/curves/public_params.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_init.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g1.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_g2.hpp"
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_pairing.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
class alt_bn128_pp {
|
||||
public:
|
||||
typedef alt_bn128_Fr Fp_type;
|
||||
typedef alt_bn128_G1 G1_type;
|
||||
typedef alt_bn128_G2 G2_type;
|
||||
typedef alt_bn128_G1_precomp G1_precomp_type;
|
||||
typedef alt_bn128_G2_precomp G2_precomp_type;
|
||||
typedef alt_bn128_Fq Fq_type;
|
||||
typedef alt_bn128_Fq2 Fqe_type;
|
||||
typedef alt_bn128_Fq12 Fqk_type;
|
||||
typedef alt_bn128_GT GT_type;
|
||||
|
||||
static const bool has_affine_pairing = false;
|
||||
|
||||
static void init_public_params();
|
||||
static alt_bn128_GT final_exponentiation(const alt_bn128_Fq12 &elt);
|
||||
static alt_bn128_G1_precomp precompute_G1(const alt_bn128_G1 &P);
|
||||
static alt_bn128_G2_precomp precompute_G2(const alt_bn128_G2 &Q);
|
||||
static alt_bn128_Fq12 miller_loop(const alt_bn128_G1_precomp &prec_P,
|
||||
const alt_bn128_G2_precomp &prec_Q);
|
||||
static alt_bn128_Fq12 double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
|
||||
const alt_bn128_G2_precomp &prec_Q1,
|
||||
const alt_bn128_G1_precomp &prec_P2,
|
||||
const alt_bn128_G2_precomp &prec_Q2);
|
||||
static alt_bn128_Fq12 pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q);
|
||||
static alt_bn128_Fq12 reduced_pairing(const alt_bn128_G1 &P,
|
||||
const alt_bn128_G2 &Q);
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // ALT_BN128_PP_HPP_
|
|
@ -0,0 +1,22 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef CURVE_UTILS_HPP_
|
||||
#define CURVE_UTILS_HPP_
|
||||
#include <cstdint>
|
||||
|
||||
#include "algebra/fields/bigint.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename GroupT, mp_size_t m>
|
||||
GroupT scalar_mul(const GroupT &base, const bigint<m> &scalar);
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/curves/curve_utils.tcc"
|
||||
|
||||
#endif // CURVE_UTILS_HPP_
|
|
@ -0,0 +1,37 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef CURVE_UTILS_TCC_
|
||||
#define CURVE_UTILS_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename GroupT, mp_size_t m>
|
||||
GroupT scalar_mul(const GroupT &base, const bigint<m> &scalar)
|
||||
{
|
||||
GroupT result = GroupT::zero();
|
||||
|
||||
bool found_one = false;
|
||||
for (long i = scalar.max_bits() - 1; i >= 0; --i)
|
||||
{
|
||||
if (found_one)
|
||||
{
|
||||
result = result.dbl();
|
||||
}
|
||||
|
||||
if (scalar.test_bit(i))
|
||||
{
|
||||
found_one = true;
|
||||
result = result + base;
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // CURVE_UTILS_TCC_
|
|
@ -0,0 +1,103 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef PUBLIC_PARAMS_HPP_
|
||||
#define PUBLIC_PARAMS_HPP_
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/*
|
||||
for every curve the user should define corresponding
|
||||
public_params with the following typedefs:
|
||||
|
||||
Fp_type
|
||||
G1_type
|
||||
G2_type
|
||||
G1_precomp_type
|
||||
G2_precomp_type
|
||||
affine_ate_G1_precomp_type
|
||||
affine_ate_G2_precomp_type
|
||||
Fq_type
|
||||
Fqe_type
|
||||
Fqk_type
|
||||
GT_type
|
||||
|
||||
one should also define the following static methods:
|
||||
|
||||
void init_public_params();
|
||||
|
||||
GT<EC_ppT> final_exponentiation(const Fqk<EC_ppT> &elt);
|
||||
|
||||
G1_precomp<EC_ppT> precompute_G1(const G1<EC_ppT> &P);
|
||||
G2_precomp<EC_ppT> precompute_G2(const G2<EC_ppT> &Q);
|
||||
|
||||
Fqk<EC_ppT> miller_loop(const G1_precomp<EC_ppT> &prec_P,
|
||||
const G2_precomp<EC_ppT> &prec_Q);
|
||||
|
||||
affine_ate_G1_precomp<EC_ppT> affine_ate_precompute_G1(const G1<EC_ppT> &P);
|
||||
affine_ate_G2_precomp<EC_ppT> affine_ate_precompute_G2(const G2<EC_ppT> &Q);
|
||||
|
||||
|
||||
Fqk<EC_ppT> affine_ate_miller_loop(const affine_ate_G1_precomp<EC_ppT> &prec_P,
|
||||
const affine_ate_G2_precomp<EC_ppT> &prec_Q);
|
||||
Fqk<EC_ppT> affine_ate_e_over_e_miller_loop(const affine_ate_G1_precomp<EC_ppT> &prec_P1,
|
||||
const affine_ate_G2_precomp<EC_ppT> &prec_Q1,
|
||||
const affine_ate_G1_precomp<EC_ppT> &prec_P2,
|
||||
const affine_ate_G2_precomp<EC_ppT> &prec_Q2);
|
||||
Fqk<EC_ppT> affine_ate_e_times_e_over_e_miller_loop(const affine_ate_G1_precomp<EC_ppT> &prec_P1,
|
||||
const affine_ate_G2_precomp<EC_ppT> &prec_Q1,
|
||||
const affine_ate_G1_precomp<EC_ppT> &prec_P2,
|
||||
const affine_ate_G2_precomp<EC_ppT> &prec_Q2,
|
||||
const affine_ate_G1_precomp<EC_ppT> &prec_P3,
|
||||
const affine_ate_G2_precomp<EC_ppT> &prec_Q3);
|
||||
Fqk<EC_ppT> double_miller_loop(const G1_precomp<EC_ppT> &prec_P1,
|
||||
const G2_precomp<EC_ppT> &prec_Q1,
|
||||
const G1_precomp<EC_ppT> &prec_P2,
|
||||
const G2_precomp<EC_ppT> &prec_Q2);
|
||||
|
||||
Fqk<EC_ppT> pairing(const G1<EC_ppT> &P,
|
||||
const G2<EC_ppT> &Q);
|
||||
GT<EC_ppT> reduced_pairing(const G1<EC_ppT> &P,
|
||||
const G2<EC_ppT> &Q);
|
||||
GT<EC_ppT> affine_reduced_pairing(const G1<EC_ppT> &P,
|
||||
const G2<EC_ppT> &Q);
|
||||
*/
|
||||
|
||||
template<typename EC_ppT>
|
||||
using Fr = typename EC_ppT::Fp_type;
|
||||
template<typename EC_ppT>
|
||||
using G1 = typename EC_ppT::G1_type;
|
||||
template<typename EC_ppT>
|
||||
using G2 = typename EC_ppT::G2_type;
|
||||
template<typename EC_ppT>
|
||||
using G1_precomp = typename EC_ppT::G1_precomp_type;
|
||||
template<typename EC_ppT>
|
||||
using G2_precomp = typename EC_ppT::G2_precomp_type;
|
||||
template<typename EC_ppT>
|
||||
using affine_ate_G1_precomp = typename EC_ppT::affine_ate_G1_precomp_type;
|
||||
template<typename EC_ppT>
|
||||
using affine_ate_G2_precomp = typename EC_ppT::affine_ate_G2_precomp_type;
|
||||
template<typename EC_ppT>
|
||||
using Fq = typename EC_ppT::Fq_type;
|
||||
template<typename EC_ppT>
|
||||
using Fqe = typename EC_ppT::Fqe_type;
|
||||
template<typename EC_ppT>
|
||||
using Fqk = typename EC_ppT::Fqk_type;
|
||||
template<typename EC_ppT>
|
||||
using GT = typename EC_ppT::GT_type;
|
||||
|
||||
template<typename EC_ppT>
|
||||
using Fr_vector = std::vector<Fr<EC_ppT> >;
|
||||
template<typename EC_ppT>
|
||||
using G1_vector = std::vector<G1<EC_ppT> >;
|
||||
template<typename EC_ppT>
|
||||
using G2_vector = std::vector<G2<EC_ppT> >;
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // PUBLIC_PARAMS_HPP_
|
|
@ -0,0 +1,136 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
#include "common/profiling.hpp"
|
||||
#include "algebra/curves/edwards/edwards_pp.hpp"
|
||||
#ifdef CURVE_BN128
|
||||
#include "algebra/curves/bn128/bn128_pp.hpp"
|
||||
#endif
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_pp.hpp"
|
||||
#include "algebra/curves/mnt/mnt4/mnt4_pp.hpp"
|
||||
#include "algebra/curves/mnt/mnt6/mnt6_pp.hpp"
|
||||
|
||||
using namespace libsnark;
|
||||
|
||||
template<typename ppT>
|
||||
void pairing_test()
|
||||
{
|
||||
GT<ppT> GT_one = GT<ppT>::one();
|
||||
|
||||
printf("Running bilinearity tests:\n");
|
||||
G1<ppT> P = (Fr<ppT>::random_element()) * G1<ppT>::one();
|
||||
//G1<ppT> P = Fr<ppT>("2") * G1<ppT>::one();
|
||||
G2<ppT> Q = (Fr<ppT>::random_element()) * G2<ppT>::one();
|
||||
//G2<ppT> Q = Fr<ppT>("3") * G2<ppT>::one();
|
||||
|
||||
printf("P:\n");
|
||||
P.print();
|
||||
P.print_coordinates();
|
||||
printf("Q:\n");
|
||||
Q.print();
|
||||
Q.print_coordinates();
|
||||
printf("\n\n");
|
||||
|
||||
Fr<ppT> s = Fr<ppT>::random_element();
|
||||
//Fr<ppT> s = Fr<ppT>("2");
|
||||
G1<ppT> sP = s * P;
|
||||
G2<ppT> sQ = s * Q;
|
||||
|
||||
printf("Pairing bilinearity tests (three must match):\n");
|
||||
GT<ppT> ans1 = ppT::reduced_pairing(sP, Q);
|
||||
GT<ppT> ans2 = ppT::reduced_pairing(P, sQ);
|
||||
GT<ppT> ans3 = ppT::reduced_pairing(P, Q)^s;
|
||||
ans1.print();
|
||||
ans2.print();
|
||||
ans3.print();
|
||||
assert(ans1 == ans2);
|
||||
assert(ans2 == ans3);
|
||||
|
||||
assert(ans1 != GT_one);
|
||||
assert((ans1^Fr<ppT>::field_char()) == GT_one);
|
||||
printf("\n\n");
|
||||
}
|
||||
|
||||
template<typename ppT>
|
||||
void double_miller_loop_test()
|
||||
{
|
||||
const G1<ppT> P1 = (Fr<ppT>::random_element()) * G1<ppT>::one();
|
||||
const G1<ppT> P2 = (Fr<ppT>::random_element()) * G1<ppT>::one();
|
||||
const G2<ppT> Q1 = (Fr<ppT>::random_element()) * G2<ppT>::one();
|
||||
const G2<ppT> Q2 = (Fr<ppT>::random_element()) * G2<ppT>::one();
|
||||
|
||||
const G1_precomp<ppT> prec_P1 = ppT::precompute_G1(P1);
|
||||
const G1_precomp<ppT> prec_P2 = ppT::precompute_G1(P2);
|
||||
const G2_precomp<ppT> prec_Q1 = ppT::precompute_G2(Q1);
|
||||
const G2_precomp<ppT> prec_Q2 = ppT::precompute_G2(Q2);
|
||||
|
||||
const Fqk<ppT> ans_1 = ppT::miller_loop(prec_P1, prec_Q1);
|
||||
const Fqk<ppT> ans_2 = ppT::miller_loop(prec_P2, prec_Q2);
|
||||
const Fqk<ppT> ans_12 = ppT::double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
|
||||
assert(ans_1 * ans_2 == ans_12);
|
||||
}
|
||||
|
||||
template<typename ppT>
|
||||
void affine_pairing_test()
|
||||
{
|
||||
GT<ppT> GT_one = GT<ppT>::one();
|
||||
|
||||
printf("Running bilinearity tests:\n");
|
||||
G1<ppT> P = (Fr<ppT>::random_element()) * G1<ppT>::one();
|
||||
G2<ppT> Q = (Fr<ppT>::random_element()) * G2<ppT>::one();
|
||||
|
||||
printf("P:\n");
|
||||
P.print();
|
||||
printf("Q:\n");
|
||||
Q.print();
|
||||
printf("\n\n");
|
||||
|
||||
Fr<ppT> s = Fr<ppT>::random_element();
|
||||
G1<ppT> sP = s * P;
|
||||
G2<ppT> sQ = s * Q;
|
||||
|
||||
printf("Pairing bilinearity tests (three must match):\n");
|
||||
GT<ppT> ans1 = ppT::affine_reduced_pairing(sP, Q);
|
||||
GT<ppT> ans2 = ppT::affine_reduced_pairing(P, sQ);
|
||||
GT<ppT> ans3 = ppT::affine_reduced_pairing(P, Q)^s;
|
||||
ans1.print();
|
||||
ans2.print();
|
||||
ans3.print();
|
||||
assert(ans1 == ans2);
|
||||
assert(ans2 == ans3);
|
||||
|
||||
assert(ans1 != GT_one);
|
||||
assert((ans1^Fr<ppT>::field_char()) == GT_one);
|
||||
printf("\n\n");
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
start_profiling();
|
||||
edwards_pp::init_public_params();
|
||||
pairing_test<edwards_pp>();
|
||||
double_miller_loop_test<edwards_pp>();
|
||||
|
||||
mnt6_pp::init_public_params();
|
||||
pairing_test<mnt6_pp>();
|
||||
double_miller_loop_test<mnt6_pp>();
|
||||
affine_pairing_test<mnt6_pp>();
|
||||
|
||||
mnt4_pp::init_public_params();
|
||||
pairing_test<mnt4_pp>();
|
||||
double_miller_loop_test<mnt4_pp>();
|
||||
affine_pairing_test<mnt4_pp>();
|
||||
|
||||
alt_bn128_pp::init_public_params();
|
||||
pairing_test<alt_bn128_pp>();
|
||||
double_miller_loop_test<alt_bn128_pp>();
|
||||
|
||||
#ifdef CURVE_BN128 // BN128 has fancy dependencies so it may be disabled
|
||||
bn128_pp::init_public_params();
|
||||
pairing_test<bn128_pp>();
|
||||
double_miller_loop_test<bn128_pp>();
|
||||
#endif
|
||||
}
|
|
@ -0,0 +1,175 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
#include "common/profiling.hpp"
|
||||
#include "algebra/curves/edwards/edwards_pp.hpp"
|
||||
#include "algebra/curves/mnt/mnt4/mnt4_pp.hpp"
|
||||
#include "algebra/curves/mnt/mnt6/mnt6_pp.hpp"
|
||||
#ifdef CURVE_BN128
|
||||
#include "algebra/curves/bn128/bn128_pp.hpp"
|
||||
#endif
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_pp.hpp"
|
||||
#include <sstream>
|
||||
|
||||
using namespace libsnark;
|
||||
|
||||
template<typename GroupT>
|
||||
void test_mixed_add()
|
||||
{
|
||||
GroupT base, el, result;
|
||||
|
||||
base = GroupT::zero();
|
||||
el = GroupT::zero();
|
||||
el.to_special();
|
||||
result = base.mixed_add(el);
|
||||
assert(result == base + el);
|
||||
|
||||
base = GroupT::zero();
|
||||
el = GroupT::random_element();
|
||||
el.to_special();
|
||||
result = base.mixed_add(el);
|
||||
assert(result == base + el);
|
||||
|
||||
base = GroupT::random_element();
|
||||
el = GroupT::zero();
|
||||
el.to_special();
|
||||
result = base.mixed_add(el);
|
||||
assert(result == base + el);
|
||||
|
||||
base = GroupT::random_element();
|
||||
el = GroupT::random_element();
|
||||
el.to_special();
|
||||
result = base.mixed_add(el);
|
||||
assert(result == base + el);
|
||||
|
||||
base = GroupT::random_element();
|
||||
el = base;
|
||||
el.to_special();
|
||||
result = base.mixed_add(el);
|
||||
assert(result == base.dbl());
|
||||
}
|
||||
|
||||
template<typename GroupT>
|
||||
void test_group()
|
||||
{
|
||||
bigint<1> rand1 = bigint<1>("76749407");
|
||||
bigint<1> rand2 = bigint<1>("44410867");
|
||||
bigint<1> randsum = bigint<1>("121160274");
|
||||
|
||||
GroupT zero = GroupT::zero();
|
||||
assert(zero == zero);
|
||||
GroupT one = GroupT::one();
|
||||
assert(one == one);
|
||||
GroupT two = bigint<1>(2l) * GroupT::one();
|
||||
assert(two == two);
|
||||
GroupT five = bigint<1>(5l) * GroupT::one();
|
||||
|
||||
GroupT three = bigint<1>(3l) * GroupT::one();
|
||||
GroupT four = bigint<1>(4l) * GroupT::one();
|
||||
|
||||
assert(two+five == three+four);
|
||||
|
||||
GroupT a = GroupT::random_element();
|
||||
GroupT b = GroupT::random_element();
|
||||
|
||||
assert(one != zero);
|
||||
assert(a != zero);
|
||||
assert(a != one);
|
||||
|
||||
assert(b != zero);
|
||||
assert(b != one);
|
||||
|
||||
assert(a.dbl() == a + a);
|
||||
assert(b.dbl() == b + b);
|
||||
assert(one.add(two) == three);
|
||||
assert(two.add(one) == three);
|
||||
assert(a + b == b + a);
|
||||
assert(a - a == zero);
|
||||
assert(a - b == a + (-b));
|
||||
assert(a - b == (-b) + a);
|
||||
|
||||
// handle special cases
|
||||
assert(zero + (-a) == -a);
|
||||
assert(zero - a == -a);
|
||||
assert(a - zero == a);
|
||||
assert(a + zero == a);
|
||||
assert(zero + a == a);
|
||||
|
||||
assert((a + b).dbl() == (a + b) + (b + a));
|
||||
assert(bigint<1>("2") * (a + b) == (a + b) + (b + a));
|
||||
|
||||
assert((rand1 * a) + (rand2 * a) == (randsum * a));
|
||||
|
||||
assert(GroupT::order() * a == zero);
|
||||
assert(GroupT::order() * one == zero);
|
||||
assert((GroupT::order() * a) - a != zero);
|
||||
assert((GroupT::order() * one) - one != zero);
|
||||
|
||||
test_mixed_add<GroupT>();
|
||||
}
|
||||
|
||||
template<typename GroupT>
|
||||
void test_mul_by_q()
|
||||
{
|
||||
GroupT a = GroupT::random_element();
|
||||
assert((GroupT::base_field_char()*a) == a.mul_by_q());
|
||||
}
|
||||
|
||||
template<typename GroupT>
|
||||
void test_output()
|
||||
{
|
||||
GroupT g = GroupT::zero();
|
||||
|
||||
for (size_t i = 0; i < 1000; ++i)
|
||||
{
|
||||
std::stringstream ss;
|
||||
ss << g;
|
||||
GroupT gg;
|
||||
ss >> gg;
|
||||
assert(g == gg);
|
||||
/* use a random point in next iteration */
|
||||
g = GroupT::random_element();
|
||||
}
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
edwards_pp::init_public_params();
|
||||
test_group<G1<edwards_pp> >();
|
||||
test_output<G1<edwards_pp> >();
|
||||
test_group<G2<edwards_pp> >();
|
||||
test_output<G2<edwards_pp> >();
|
||||
test_mul_by_q<G2<edwards_pp> >();
|
||||
|
||||
mnt4_pp::init_public_params();
|
||||
test_group<G1<mnt4_pp> >();
|
||||
test_output<G1<mnt4_pp> >();
|
||||
test_group<G2<mnt4_pp> >();
|
||||
test_output<G2<mnt4_pp> >();
|
||||
test_mul_by_q<G2<mnt4_pp> >();
|
||||
|
||||
mnt6_pp::init_public_params();
|
||||
test_group<G1<mnt6_pp> >();
|
||||
test_output<G1<mnt6_pp> >();
|
||||
test_group<G2<mnt6_pp> >();
|
||||
test_output<G2<mnt6_pp> >();
|
||||
test_mul_by_q<G2<mnt6_pp> >();
|
||||
|
||||
alt_bn128_pp::init_public_params();
|
||||
test_group<G1<alt_bn128_pp> >();
|
||||
test_output<G1<alt_bn128_pp> >();
|
||||
test_group<G2<alt_bn128_pp> >();
|
||||
test_output<G2<alt_bn128_pp> >();
|
||||
test_mul_by_q<G2<alt_bn128_pp> >();
|
||||
|
||||
#ifdef CURVE_BN128 // BN128 has fancy dependencies so it may be disabled
|
||||
bn128_pp::init_public_params();
|
||||
test_group<G1<bn128_pp> >();
|
||||
test_output<G1<bn128_pp> >();
|
||||
test_group<G2<bn128_pp> >();
|
||||
test_output<G2<bn128_pp> >();
|
||||
#endif
|
||||
}
|
|
@ -0,0 +1,45 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for the "basic radix-2" evaluation domain.
|
||||
|
||||
Roughly, the domain has size m = 2^k and consists of the m-th roots of unity.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BASIC_RADIX2_DOMAIN_HPP_
|
||||
#define BASIC_RADIX2_DOMAIN_HPP_
|
||||
|
||||
#include "algebra/evaluation_domain/evaluation_domain.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
class basic_radix2_domain : public evaluation_domain<FieldT> {
|
||||
public:
|
||||
|
||||
FieldT omega;
|
||||
|
||||
basic_radix2_domain(const size_t m);
|
||||
|
||||
void FFT(std::vector<FieldT> &a);
|
||||
void iFFT(std::vector<FieldT> &a);
|
||||
void cosetFFT(std::vector<FieldT> &a, const FieldT &g);
|
||||
void icosetFFT(std::vector<FieldT> &a, const FieldT &g);
|
||||
std::vector<FieldT> lagrange_coeffs(const FieldT &t);
|
||||
FieldT get_element(const size_t idx);
|
||||
FieldT compute_Z(const FieldT &t);
|
||||
void add_poly_Z(const FieldT &coeff, std::vector<FieldT> &H);
|
||||
void divide_by_Z_on_coset(std::vector<FieldT> &P);
|
||||
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/evaluation_domain/domains/basic_radix2_domain.tcc"
|
||||
|
||||
#endif // BASIC_RADIX2_DOMAIN_HPP_
|
|
@ -0,0 +1,112 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for the "basic radix-2" evaluation domain.
|
||||
|
||||
See basic_radix2_domain.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BASIC_RADIX2_DOMAIN_TCC_
|
||||
#define BASIC_RADIX2_DOMAIN_TCC_
|
||||
|
||||
#include "algebra/evaluation_domain/domains/basic_radix2_domain_aux.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
basic_radix2_domain<FieldT>::basic_radix2_domain(const size_t m) : evaluation_domain<FieldT>(m)
|
||||
{
|
||||
assert(m > 1);
|
||||
const size_t logm = log2(m);
|
||||
assert(logm <= (FieldT::s));
|
||||
|
||||
omega = get_root_of_unity<FieldT>(m);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void basic_radix2_domain<FieldT>::FFT(std::vector<FieldT> &a)
|
||||
{
|
||||
enter_block("Execute FFT");
|
||||
assert(a.size() == this->m);
|
||||
_basic_radix2_FFT(a, omega);
|
||||
leave_block("Execute FFT");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void basic_radix2_domain<FieldT>::iFFT(std::vector<FieldT> &a)
|
||||
{
|
||||
enter_block("Execute inverse FFT");
|
||||
assert(a.size() == this->m);
|
||||
_basic_radix2_FFT(a, omega.inverse());
|
||||
|
||||
const FieldT sconst = FieldT(a.size()).inverse();
|
||||
for (size_t i = 0; i < a.size(); ++i)
|
||||
{
|
||||
a[i] *= sconst;
|
||||
}
|
||||
leave_block("Execute inverse FFT");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void basic_radix2_domain<FieldT>::cosetFFT(std::vector<FieldT> &a, const FieldT &g)
|
||||
{
|
||||
enter_block("Execute coset FFT");
|
||||
_multiply_by_coset(a, g);
|
||||
FFT(a);
|
||||
leave_block("Execute coset FFT");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void basic_radix2_domain<FieldT>::icosetFFT(std::vector<FieldT> &a, const FieldT &g)
|
||||
{
|
||||
enter_block("Execute inverse coset IFFT");
|
||||
iFFT(a);
|
||||
_multiply_by_coset(a, g.inverse());
|
||||
leave_block("Execute inverse coset IFFT");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> basic_radix2_domain<FieldT>::lagrange_coeffs(const FieldT &t)
|
||||
{
|
||||
return _basic_radix2_lagrange_coeffs(this->m, t);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT basic_radix2_domain<FieldT>::get_element(const size_t idx)
|
||||
{
|
||||
return omega^idx;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT basic_radix2_domain<FieldT>::compute_Z(const FieldT &t)
|
||||
{
|
||||
return (t^this->m) - FieldT::one();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void basic_radix2_domain<FieldT>::add_poly_Z(const FieldT &coeff, std::vector<FieldT> &H)
|
||||
{
|
||||
assert(H.size() == this->m+1);
|
||||
H[this->m] += coeff;
|
||||
H[0] -= coeff;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void basic_radix2_domain<FieldT>::divide_by_Z_on_coset(std::vector<FieldT> &P)
|
||||
{
|
||||
const FieldT coset = FieldT::multiplicative_generator;
|
||||
const FieldT Z_inverse_at_coset = this->compute_Z(coset).inverse();
|
||||
for (size_t i = 0; i < this->m; ++i)
|
||||
{
|
||||
P[i] *= Z_inverse_at_coset;
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // BASIC_RADIX2_DOMAIN_TCC_
|
|
@ -0,0 +1,48 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for auxiliary functions for the "basic radix-2" evaluation domain.
|
||||
|
||||
These functions compute the radix-2 FFT (in single- or multi-thread mode) and,
|
||||
also compute Lagrange coefficients.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BASIC_RADIX2_DOMAIN_AUX_HPP_
|
||||
#define BASIC_RADIX2_DOMAIN_AUX_HPP_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/**
|
||||
* Compute the radix-2 FFT of the vector a over the set S={omega^{0},...,omega^{m-1}}.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
void _basic_radix2_FFT(std::vector<FieldT> &a, const FieldT &omega);
|
||||
|
||||
/**
|
||||
* A multi-thread version of _basic_radix2_FFT.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
void _parallel_basic_radix2_FFT(std::vector<FieldT> &a, const FieldT &omega);
|
||||
|
||||
/**
|
||||
* Translate the vector a to a coset defined by g.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
void _multiply_by_coset(std::vector<FieldT> &a, const FieldT &g);
|
||||
|
||||
/**
|
||||
* Compute the m Lagrange coefficients, relative to the set S={omega^{0},...,omega^{m-1}}, at the field element t.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> _basic_radix2_lagrange_coeffs(const size_t m, const FieldT &t);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/evaluation_domain/domains/basic_radix2_domain_aux.tcc"
|
||||
|
||||
#endif // BASIC_RADIX2_DOMAIN_AUX_HPP_
|
|
@ -0,0 +1,242 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for auxiliary functions for the "basic radix-2" evaluation domain.
|
||||
|
||||
See basic_radix2_domain_aux.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BASIC_RADIX2_DOMAIN_AUX_TCC_
|
||||
#define BASIC_RADIX2_DOMAIN_AUX_TCC_
|
||||
|
||||
#include <cassert>
|
||||
#ifdef MULTICORE
|
||||
#include <omp.h>
|
||||
#endif
|
||||
#include "algebra/fields/field_utils.hpp"
|
||||
#include "common/profiling.hpp"
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
#ifdef MULTICORE
|
||||
#define _basic_radix2_FFT _basic_parallel_radix2_FFT
|
||||
#else
|
||||
#define _basic_radix2_FFT _basic_serial_radix2_FFT
|
||||
#endif
|
||||
|
||||
/*
|
||||
Below we make use of pseudocode from [CLRS 2n Ed, pp. 864].
|
||||
Also, note that it's the caller's responsibility to multiply by 1/N.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
void _basic_serial_radix2_FFT(std::vector<FieldT> &a, const FieldT &omega)
|
||||
{
|
||||
const size_t n = a.size(), logn = log2(n);
|
||||
assert(n == (1u << logn));
|
||||
|
||||
/* swapping in place (from Storer's book) */
|
||||
for (size_t k = 0; k < n; ++k)
|
||||
{
|
||||
const size_t rk = bitreverse(k, logn);
|
||||
if (k < rk)
|
||||
std::swap(a[k], a[rk]);
|
||||
}
|
||||
|
||||
size_t m = 1; // invariant: m = 2^{s-1}
|
||||
for (size_t s = 1; s <= logn; ++s)
|
||||
{
|
||||
// w_m is 2^s-th root of unity now
|
||||
const FieldT w_m = omega^(n/(2*m));
|
||||
|
||||
asm volatile ("/* pre-inner */");
|
||||
for (size_t k = 0; k < n; k += 2*m)
|
||||
{
|
||||
FieldT w = FieldT::one();
|
||||
for (size_t j = 0; j < m; ++j)
|
||||
{
|
||||
const FieldT t = w * a[k+j+m];
|
||||
a[k+j+m] = a[k+j] - t;
|
||||
a[k+j] += t;
|
||||
w *= w_m;
|
||||
}
|
||||
}
|
||||
asm volatile ("/* post-inner */");
|
||||
m *= 2;
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void _basic_parallel_radix2_FFT_inner(std::vector<FieldT> &a, const FieldT &omega, const size_t log_cpus)
|
||||
{
|
||||
const size_t num_cpus = 1ul<<log_cpus;
|
||||
|
||||
const size_t m = a.size();
|
||||
const size_t log_m = log2(m);
|
||||
assert(m == 1ul<<log_m);
|
||||
|
||||
if (log_m < log_cpus)
|
||||
{
|
||||
_basic_serial_radix2_FFT(a, omega);
|
||||
return;
|
||||
}
|
||||
|
||||
enter_block("Shuffle inputs");
|
||||
std::vector<std::vector<FieldT> > tmp(num_cpus);
|
||||
for (size_t j = 0; j < num_cpus; ++j)
|
||||
{
|
||||
tmp[j].resize(1ul<<(log_m-log_cpus), FieldT::zero());
|
||||
}
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t j = 0; j < num_cpus; ++j)
|
||||
{
|
||||
const FieldT omega_j = omega^j;
|
||||
const FieldT omega_step = omega^(j<<(log_m - log_cpus));
|
||||
|
||||
FieldT elt = FieldT::one();
|
||||
for (size_t i = 0; i < 1ul<<(log_m - log_cpus); ++i)
|
||||
{
|
||||
for (size_t s = 0; s < num_cpus; ++s)
|
||||
{
|
||||
// invariant: elt is omega^(j*idx)
|
||||
const size_t idx = (i + (s<<(log_m - log_cpus))) % (1u << log_m);
|
||||
tmp[j][i] += a[idx] * elt;
|
||||
elt *= omega_step;
|
||||
}
|
||||
elt *= omega_j;
|
||||
}
|
||||
}
|
||||
leave_block("Shuffle inputs");
|
||||
|
||||
enter_block("Execute sub-FFTs");
|
||||
const FieldT omega_num_cpus = omega^num_cpus;
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t j = 0; j < num_cpus; ++j)
|
||||
{
|
||||
_basic_serial_radix2_FFT(tmp[j], omega_num_cpus);
|
||||
}
|
||||
leave_block("Execute sub-FFTs");
|
||||
|
||||
enter_block("Re-shuffle outputs");
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t i = 0; i < num_cpus; ++i)
|
||||
{
|
||||
for (size_t j = 0; j < 1ul<<(log_m - log_cpus); ++j)
|
||||
{
|
||||
// now: i = idx >> (log_m - log_cpus) and j = idx % (1u << (log_m - log_cpus)), for idx = ((i<<(log_m-log_cpus))+j) % (1u << log_m)
|
||||
a[(j<<log_cpus) + i] = tmp[i][j];
|
||||
}
|
||||
}
|
||||
leave_block("Re-shuffle outputs");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void _basic_parallel_radix2_FFT(std::vector<FieldT> &a, const FieldT &omega)
|
||||
{
|
||||
#ifdef MULTICORE
|
||||
const size_t num_cpus = omp_get_max_threads();
|
||||
#else
|
||||
const size_t num_cpus = 1;
|
||||
#endif
|
||||
const size_t log_cpus = ((num_cpus & (num_cpus - 1)) == 0 ? log2(num_cpus) : log2(num_cpus) - 1);
|
||||
|
||||
#ifdef DEBUG
|
||||
print_indent(); printf("* Invoking parallel FFT on 2^%zu CPUs (omp_get_max_threads = %zu)\n", log_cpus, num_cpus);
|
||||
#endif
|
||||
|
||||
if (log_cpus == 0)
|
||||
{
|
||||
_basic_serial_radix2_FFT(a, omega);
|
||||
}
|
||||
else
|
||||
{
|
||||
_basic_parallel_radix2_FFT_inner(a, omega, log_cpus);
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void _multiply_by_coset(std::vector<FieldT> &a, const FieldT &g)
|
||||
{
|
||||
//enter_block("Multiply by coset");
|
||||
FieldT u = g;
|
||||
for (size_t i = 1; i < a.size(); ++i)
|
||||
{
|
||||
a[i] *= u;
|
||||
u *= g;
|
||||
}
|
||||
//leave_block("Multiply by coset");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> _basic_radix2_lagrange_coeffs(const size_t m, const FieldT &t)
|
||||
{
|
||||
if (m == 1)
|
||||
{
|
||||
return std::vector<FieldT>(1, FieldT::one());
|
||||
}
|
||||
|
||||
assert(m == (1u << log2(m)));
|
||||
|
||||
const FieldT omega = get_root_of_unity<FieldT>(m);
|
||||
|
||||
std::vector<FieldT> u(m, FieldT::zero());
|
||||
|
||||
/*
|
||||
If t equals one of the roots of unity in S={omega^{0},...,omega^{m-1}}
|
||||
then output 1 at the right place, and 0 elsewhere
|
||||
*/
|
||||
|
||||
if ((t^m) == (FieldT::one()))
|
||||
{
|
||||
FieldT omega_i = FieldT::one();
|
||||
for (size_t i = 0; i < m; ++i)
|
||||
{
|
||||
if (omega_i == t) // i.e., t equals omega^i
|
||||
{
|
||||
u[i] = FieldT::one();
|
||||
return u;
|
||||
}
|
||||
|
||||
omega_i *= omega;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
Otherwise, if t does not equal any of the roots of unity in S,
|
||||
then compute each L_{i,S}(t) as Z_{S}(t) * v_i / (t-\omega^i)
|
||||
where:
|
||||
- Z_{S}(t) = \prod_{j} (t-\omega^j) = (t^m-1), and
|
||||
- v_{i} = 1 / \prod_{j \neq i} (\omega^i-\omega^j).
|
||||
Below we use the fact that v_{0} = 1/m and v_{i+1} = \omega * v_{i}.
|
||||
*/
|
||||
|
||||
const FieldT Z = (t^m)-FieldT::one();
|
||||
FieldT l = Z * FieldT(m).inverse();
|
||||
FieldT r = FieldT::one();
|
||||
for (size_t i = 0; i < m; ++i)
|
||||
{
|
||||
u[i] = l * (t - r).inverse();
|
||||
l *= omega;
|
||||
r *= omega;
|
||||
}
|
||||
|
||||
return u;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // BASIC_RADIX2_DOMAIN_AUX_TCC_
|
|
@ -0,0 +1,125 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for evaluation domains.
|
||||
|
||||
Roughly, given a desired size m for the domain, the constructor selects
|
||||
a choice of domain S with size ~m that has been selected so to optimize
|
||||
- computations of Lagrange polynomials, and
|
||||
- FFT/iFFT computations.
|
||||
An evaluation domain also provides other other functions, e.g., accessing
|
||||
individual elements in S or evaluating its vanishing polynomial.
|
||||
|
||||
The descriptions below make use of the definition of a *Lagrange polynomial*,
|
||||
which we recall. Given a field F, a subset S=(a_i)_i of F, and an index idx
|
||||
in {0,...,|S-1|}, the idx-th Lagrange polynomial (wrt to subset S) is defined to be
|
||||
\f[ L_{idx,S}(z) := prod_{k \neq idx} (z - a_k) / prod_{k \neq idx} (a_{idx} - a_k) \f]
|
||||
Note that, by construction:
|
||||
\f[ \forall j \neq idx: L_{idx,S}(a_{idx}) = 1 \text{ and } L_{idx,S}(a_j) = 0 \f]
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef EVALUATION_DOMAIN_HPP_
|
||||
#define EVALUATION_DOMAIN_HPP_
|
||||
|
||||
#include <memory>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/**
|
||||
* An evaluation domain.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
class evaluation_domain {
|
||||
public:
|
||||
|
||||
const size_t m;
|
||||
|
||||
/**
|
||||
* Construct an evaluation domain S of size m, if possible.
|
||||
*
|
||||
* (See the function get_evaluation_domain below.)
|
||||
*/
|
||||
evaluation_domain(const size_t m) : m(m) {};
|
||||
|
||||
/**
|
||||
* Get the idx-th element in S.
|
||||
*/
|
||||
virtual FieldT get_element(const size_t idx) = 0;
|
||||
|
||||
/**
|
||||
* Compute the FFT, over the domain S, of the vector a.
|
||||
*/
|
||||
virtual void FFT(std::vector<FieldT> &a) = 0;
|
||||
|
||||
/**
|
||||
* Compute the inverse FFT, over the domain S, of the vector a.
|
||||
*/
|
||||
virtual void iFFT(std::vector<FieldT> &a) = 0;
|
||||
|
||||
/**
|
||||
* Compute the FFT, over the domain g*S, of the vector a.
|
||||
*/
|
||||
virtual void cosetFFT(std::vector<FieldT> &a, const FieldT &g) = 0;
|
||||
|
||||
/**
|
||||
* Compute the inverse FFT, over the domain g*S, of the vector a.
|
||||
*/
|
||||
virtual void icosetFFT(std::vector<FieldT> &a, const FieldT &g) = 0;
|
||||
|
||||
/**
|
||||
* Evaluate all Lagrange polynomials.
|
||||
*
|
||||
* The inputs are:
|
||||
* - an integer m
|
||||
* - an element t
|
||||
* The output is a vector (b_{0},...,b_{m-1})
|
||||
* where b_{i} is the evaluation of L_{i,S}(z) at z = t.
|
||||
*/
|
||||
virtual std::vector<FieldT> lagrange_coeffs(const FieldT &t) = 0;
|
||||
|
||||
/**
|
||||
* Evaluate the vanishing polynomial of S at the field element t.
|
||||
*/
|
||||
virtual FieldT compute_Z(const FieldT &t) = 0;
|
||||
|
||||
/**
|
||||
* Add the coefficients of the vanishing polynomial of S to the coefficients of the polynomial H.
|
||||
*/
|
||||
virtual void add_poly_Z(const FieldT &coeff, std::vector<FieldT> &H) = 0;
|
||||
|
||||
/**
|
||||
* Multiply by the evaluation, on a coset of S, of the inverse of the vanishing polynomial of S.
|
||||
*/
|
||||
virtual void divide_by_Z_on_coset(std::vector<FieldT> &P) = 0;
|
||||
};
|
||||
|
||||
/**
|
||||
* Return an evaluation domain object in which the domain S has size |S| >= min_size.
|
||||
* The function chooses from different supported domains, depending on min_size.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
std::shared_ptr<evaluation_domain<FieldT> > get_evaluation_domain(const size_t min_size);
|
||||
|
||||
/**
|
||||
* Naive evaluation of a *single* Lagrange polynomial, used for testing purposes.
|
||||
*
|
||||
* The inputs are:
|
||||
* - an integer m
|
||||
* - a domain S = (a_{0},...,a_{m-1}) of size m
|
||||
* - a field element element t
|
||||
* - an index idx in {0,...,m-1}
|
||||
* The output is the polynomial L_{idx,S}(z) evaluated at z = t.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
FieldT lagrange_eval(const size_t m, const std::vector<FieldT> &domain, const FieldT &t, const size_t idx);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/evaluation_domain/evaluation_domain.tcc"
|
||||
|
||||
#endif // EVALUATION_DOMAIN_HPP_
|
|
@ -0,0 +1,117 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Imeplementation of interfaces for evaluation domains.
|
||||
|
||||
See evaluation_domain.hpp .
|
||||
|
||||
We currently implement, and select among, three types of domains:
|
||||
- "basic radix-2": the domain has size m = 2^k and consists of the m-th roots of unity
|
||||
- "extended radix-2": the domain has size m = 2^{k+1} and consists of "the m-th roots of unity" union "a coset"
|
||||
- "step radix-2": the domain has size m = 2^k + 2^r and consists of "the 2^k-th roots of unity" union "a coset of 2^r-th roots of unity"
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef EVALUATION_DOMAIN_TCC_
|
||||
#define EVALUATION_DOMAIN_TCC_
|
||||
|
||||
#include <cassert>
|
||||
#include "algebra/fields/field_utils.hpp"
|
||||
#include "algebra/evaluation_domain/domains/basic_radix2_domain.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
std::shared_ptr<evaluation_domain<FieldT> > get_evaluation_domain(const size_t min_size)
|
||||
{
|
||||
assert(min_size > 1);
|
||||
const size_t log_min_size = log2(min_size);
|
||||
assert(log_min_size <= (FieldT::s+1));
|
||||
|
||||
std::shared_ptr<evaluation_domain<FieldT> > result;
|
||||
if (min_size == (1u << log_min_size))
|
||||
{
|
||||
if (log_min_size == FieldT::s+1)
|
||||
{
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("* Selected domain: extended_radix2\n");
|
||||
}
|
||||
assert(0);
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("* Selected domain: basic_radix2\n");
|
||||
}
|
||||
result.reset(new basic_radix2_domain<FieldT>(min_size));
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
const size_t big = 1ul<<(log2(min_size)-1);
|
||||
const size_t small = min_size - big;
|
||||
const size_t rounded_small = (1ul<<log2(small));
|
||||
if (big == rounded_small)
|
||||
{
|
||||
if (log2(big + rounded_small) < FieldT::s+1)
|
||||
{
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("* Selected domain: basic_radix2\n");
|
||||
}
|
||||
result.reset(new basic_radix2_domain<FieldT>(big + rounded_small));
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("* Selected domain: extended_radix2\n");
|
||||
}
|
||||
assert(0);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("* Selected domain: step_radix2\n");
|
||||
}
|
||||
assert(0);
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT lagrange_eval(const size_t m, const std::vector<FieldT> &domain, const FieldT &t, const size_t idx)
|
||||
{
|
||||
assert(m == domain.size());
|
||||
assert(idx < m);
|
||||
|
||||
FieldT num = FieldT::one();
|
||||
FieldT denom = FieldT::one();
|
||||
|
||||
for (size_t k = 0; k < m; ++k)
|
||||
{
|
||||
if (k == idx)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
num *= t - domain[k];
|
||||
denom *= domain[idx] - domain[k];
|
||||
}
|
||||
|
||||
return num * denom.inverse();
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // EVALUATION_DOMAIN_TCC_
|
|
@ -0,0 +1,31 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for (square-and-multiply) exponentiation.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef EXPONENTIATION_HPP_
|
||||
#define EXPONENTIATION_HPP_
|
||||
|
||||
#include <cstdint>
|
||||
|
||||
#include "algebra/fields/bigint.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, mp_size_t m>
|
||||
FieldT power(const FieldT &base, const bigint<m> &exponent);
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT power(const FieldT &base, const unsigned long exponent);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/exponentiation/exponentiation.tcc"
|
||||
|
||||
#endif // EXPONENTIATION_HPP_
|
|
@ -0,0 +1,53 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for (square-and-multiply) exponentiation.
|
||||
|
||||
See exponentiation.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef EXPONENTIATION_TCC_
|
||||
#define EXPONENTIATION_TCC_
|
||||
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, mp_size_t m>
|
||||
FieldT power(const FieldT &base, const bigint<m> &exponent)
|
||||
{
|
||||
FieldT result = FieldT::one();
|
||||
|
||||
bool found_one = false;
|
||||
|
||||
for (long i = exponent.max_bits() - 1; i >= 0; --i)
|
||||
{
|
||||
if (found_one)
|
||||
{
|
||||
result = result * result;
|
||||
}
|
||||
|
||||
if (exponent.test_bit(i))
|
||||
{
|
||||
found_one = true;
|
||||
result = result * base;
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT power(const FieldT &base, const unsigned long exponent)
|
||||
{
|
||||
return power<FieldT>(base, bigint<1>(exponent));
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // EXPONENTIATION_TCC_
|
|
@ -0,0 +1,70 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Declaration of bigint wrapper class around GMP's MPZ long integers.
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BIGINT_HPP_
|
||||
#define BIGINT_HPP_
|
||||
#include <cstddef>
|
||||
#include <iostream>
|
||||
#include <gmp.h>
|
||||
#include "common/serialization.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n> class bigint;
|
||||
template<mp_size_t n> std::ostream& operator<<(std::ostream &, const bigint<n>&);
|
||||
template<mp_size_t n> std::istream& operator>>(std::istream &, bigint<n>&);
|
||||
|
||||
/**
|
||||
* Wrapper class around GMP's MPZ long integers. It supports arithmetic operations,
|
||||
* serialization and randomization. Serialization is fragile, see common/serialization.hpp.
|
||||
*/
|
||||
|
||||
template<mp_size_t n>
|
||||
class bigint {
|
||||
public:
|
||||
static const mp_size_t N = n;
|
||||
|
||||
mp_limb_t data[n] = {0};
|
||||
|
||||
bigint() = default;
|
||||
bigint(const unsigned long x); /// Initalize from a small integer
|
||||
bigint(const char* s); /// Initialize from a string containing an integer in decimal notation
|
||||
bigint(const mpz_t r); /// Initialize from MPZ element
|
||||
|
||||
void print() const;
|
||||
void print_hex() const;
|
||||
bool operator==(const bigint<n>& other) const;
|
||||
bool operator!=(const bigint<n>& other) const;
|
||||
void clear();
|
||||
bool is_zero() const;
|
||||
size_t max_bits() const { return n * GMP_NUMB_BITS; }
|
||||
size_t num_bits() const;
|
||||
|
||||
unsigned long as_ulong() const; /* return the last limb of the integer */
|
||||
void to_mpz(mpz_t r) const;
|
||||
bool test_bit(const std::size_t bitno) const;
|
||||
|
||||
template<mp_size_t m> inline void operator+=(const bigint<m>& other);
|
||||
template<mp_size_t m> inline bigint<n+m> operator*(const bigint<m>& other) const;
|
||||
template<mp_size_t d> static inline void div_qr(bigint<n-d+1>& quotient, bigint<d>& remainder,
|
||||
const bigint<n>& dividend, const bigint<d>& divisor);
|
||||
template<mp_size_t m> inline bigint<m> shorten(const bigint<m>& q, const char *msg) const;
|
||||
|
||||
inline void limit(const bigint<n>& q, const char *msg) const;
|
||||
bool operator>(const bigint<n>& other) const;
|
||||
|
||||
bigint& randomize();
|
||||
|
||||
friend std::ostream& operator<< <n>(std::ostream &out, const bigint<n> &b);
|
||||
friend std::istream& operator>> <n>(std::istream &in, bigint<n> &b);
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/fields/bigint.tcc"
|
||||
#endif
|
|
@ -0,0 +1,278 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of bigint wrapper class around GMP's MPZ long integers.
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BIGINT_TCC_
|
||||
#define BIGINT_TCC_
|
||||
#include <cassert>
|
||||
#include <climits>
|
||||
#include <cstring>
|
||||
#include "sodium.h"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n>
|
||||
bigint<n>::bigint(const unsigned long x) /// Initalize from a small integer
|
||||
{
|
||||
static_assert(ULONG_MAX <= GMP_NUMB_MAX, "unsigned long does not fit in a GMP limb");
|
||||
this->data[0] = x;
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
bigint<n>::bigint(const char* s) /// Initialize from a string containing an integer in decimal notation
|
||||
{
|
||||
size_t l = strlen(s);
|
||||
unsigned char* s_copy = new unsigned char[l];
|
||||
|
||||
for (size_t i = 0; i < l; ++i)
|
||||
{
|
||||
assert(s[i] >= '0' && s[i] <= '9');
|
||||
s_copy[i] = s[i] - '0';
|
||||
}
|
||||
|
||||
mp_size_t limbs_written = mpn_set_str(this->data, s_copy, l, 10);
|
||||
assert(limbs_written <= n);
|
||||
|
||||
delete[] s_copy;
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
bigint<n>::bigint(const mpz_t r) /// Initialize from MPZ element
|
||||
{
|
||||
mpz_t k;
|
||||
mpz_init_set(k, r);
|
||||
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
{
|
||||
data[i] = mpz_get_ui(k);
|
||||
mpz_fdiv_q_2exp(k, k, GMP_NUMB_BITS);
|
||||
}
|
||||
|
||||
assert(mpz_sgn(k) == 0);
|
||||
mpz_clear(k);
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
void bigint<n>::print() const
|
||||
{
|
||||
gmp_printf("%Nd\n", this->data, n);
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
void bigint<n>::print_hex() const
|
||||
{
|
||||
gmp_printf("%Nx\n", this->data, n);
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
bool bigint<n>::operator==(const bigint<n>& other) const
|
||||
{
|
||||
return (mpn_cmp(this->data, other.data, n) == 0);
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
bool bigint<n>::operator!=(const bigint<n>& other) const
|
||||
{
|
||||
return !(operator==(other));
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
void bigint<n>::clear()
|
||||
{
|
||||
mpn_zero(this->data, n);
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
bool bigint<n>::is_zero() const
|
||||
{
|
||||
for (mp_size_t i = 0; i < n; ++i)
|
||||
{
|
||||
if (this->data[i])
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
size_t bigint<n>::num_bits() const
|
||||
{
|
||||
/*
|
||||
for (long i = max_bits(); i >= 0; --i)
|
||||
{
|
||||
if (this->test_bit(i))
|
||||
{
|
||||
return i+1;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
*/
|
||||
for (long i = n-1; i >= 0; --i)
|
||||
{
|
||||
mp_limb_t x = this->data[i];
|
||||
if (x == 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
else
|
||||
{
|
||||
return ((i+1) * GMP_NUMB_BITS) - __builtin_clzl(x);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
unsigned long bigint<n>::as_ulong() const
|
||||
{
|
||||
return this->data[0];
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
void bigint<n>::to_mpz(mpz_t r) const
|
||||
{
|
||||
mpz_set_ui(r, 0);
|
||||
|
||||
for (int i = n-1; i >= 0; --i)
|
||||
{
|
||||
mpz_mul_2exp(r, r, GMP_NUMB_BITS);
|
||||
mpz_add_ui(r, r, this->data[i]);
|
||||
}
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
bool bigint<n>::test_bit(const std::size_t bitno) const
|
||||
{
|
||||
if (bitno >= n * GMP_NUMB_BITS)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
const std::size_t part = bitno/GMP_NUMB_BITS;
|
||||
const std::size_t bit = bitno - (GMP_NUMB_BITS*part);
|
||||
const mp_limb_t one = 1;
|
||||
return (this->data[part] & (one<<bit));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
template<mp_size_t n> template<mp_size_t m>
|
||||
inline void bigint<n>::operator+=(const bigint<m>& other)
|
||||
{
|
||||
static_assert(n >= m, "first arg must not be smaller than second arg for bigint in-place add");
|
||||
mpn_add(data, data, n, other.data, m);
|
||||
}
|
||||
|
||||
template<mp_size_t n> template<mp_size_t m>
|
||||
inline bigint<n+m> bigint<n>::operator*(const bigint<m>& other) const
|
||||
{
|
||||
static_assert(n >= m, "first arg must not be smaller than second arg for bigint mul");
|
||||
bigint<n+m> res;
|
||||
mpn_mul(res.data, data, n, other.data, m);
|
||||
return res;
|
||||
}
|
||||
|
||||
template<mp_size_t n> template<mp_size_t d>
|
||||
inline void bigint<n>::div_qr(bigint<n-d+1>& quotient, bigint<d>& remainder,
|
||||
const bigint<n>& dividend, const bigint<d>& divisor)
|
||||
{
|
||||
static_assert(n >= d, "dividend must not be smaller than divisor for bigint::div_qr");
|
||||
assert(divisor.data[d-1] != 0);
|
||||
mpn_tdiv_qr(quotient.data, remainder.data, 0, dividend.data, n, divisor.data, d);
|
||||
}
|
||||
|
||||
// Return a copy shortened to m limbs provided it is less than limit, throwing std::domain_error if not in range.
|
||||
template<mp_size_t n> template<mp_size_t m>
|
||||
inline bigint<m> bigint<n>::shorten(const bigint<m>& q, const char *msg) const
|
||||
{
|
||||
static_assert(m <= n, "number of limbs must not increase for bigint::shorten");
|
||||
for (mp_size_t i = m; i < n; i++) { // high-order limbs
|
||||
if (data[i] != 0) {
|
||||
throw std::domain_error(msg);
|
||||
}
|
||||
}
|
||||
bigint<m> res;
|
||||
mpn_copyi(res.data, data, n);
|
||||
res.limit(q, msg);
|
||||
return res;
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
inline void bigint<n>::limit(const bigint<n>& q, const char *msg) const
|
||||
{
|
||||
if (!(q > *this)) {
|
||||
throw std::domain_error(msg);
|
||||
}
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
inline bool bigint<n>::operator>(const bigint<n>& other) const
|
||||
{
|
||||
return mpn_cmp(this->data, other.data, n) > 0;
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
bigint<n>& bigint<n>::randomize()
|
||||
{
|
||||
assert(GMP_NUMB_BITS == sizeof(mp_limb_t) * 8);
|
||||
|
||||
randombytes_buf(this->data, sizeof(mp_limb_t) * n);
|
||||
|
||||
return (*this);
|
||||
}
|
||||
|
||||
|
||||
template<mp_size_t n>
|
||||
std::ostream& operator<<(std::ostream &out, const bigint<n> &b)
|
||||
{
|
||||
#ifdef BINARY_OUTPUT
|
||||
out.write((char*)b.data, sizeof(b.data[0]) * n);
|
||||
#else
|
||||
mpz_t t;
|
||||
mpz_init(t);
|
||||
b.to_mpz(t);
|
||||
|
||||
out << t;
|
||||
|
||||
mpz_clear(t);
|
||||
#endif
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n>
|
||||
std::istream& operator>>(std::istream &in, bigint<n> &b)
|
||||
{
|
||||
#ifdef BINARY_OUTPUT
|
||||
in.read((char*)b.data, sizeof(b.data[0]) * n);
|
||||
#else
|
||||
std::string s;
|
||||
in >> s;
|
||||
|
||||
size_t l = s.size();
|
||||
unsigned char* s_copy = new unsigned char[l];
|
||||
|
||||
for (size_t i = 0; i < l; ++i)
|
||||
{
|
||||
assert(s[i] >= '0' && s[i] <= '9');
|
||||
s_copy[i] = s[i] - '0';
|
||||
}
|
||||
|
||||
mp_size_t limbs_written = mpn_set_str(b.data, s_copy, l, 10);
|
||||
assert(limbs_written <= n);
|
||||
|
||||
delete[] s_copy;
|
||||
#endif
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // BIGINT_TCC_
|
|
@ -0,0 +1,51 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FIELD_UTILS_HPP_
|
||||
#define FIELD_UTILS_HPP_
|
||||
#include <cstdint>
|
||||
|
||||
#include "common/utils.hpp"
|
||||
#include "algebra/fields/bigint.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
// returns root of unity of order n (for n a power of 2), if one exists
|
||||
template<typename FieldT>
|
||||
FieldT get_root_of_unity(const size_t n);
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> pack_int_vector_into_field_element_vector(const std::vector<size_t> &v, const size_t w);
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v, const size_t chunk_bits);
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v);
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> convert_bit_vector_to_field_element_vector(const bit_vector &v);
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector convert_field_element_vector_to_bit_vector(const std::vector<FieldT> &v);
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector convert_field_element_to_bit_vector(const FieldT &el);
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector convert_field_element_to_bit_vector(const FieldT &el, const size_t bitcount);
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT convert_bit_vector_to_field_element(const bit_vector &v);
|
||||
|
||||
template<typename FieldT>
|
||||
void batch_invert(std::vector<FieldT> &vec);
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/fields/field_utils.tcc"
|
||||
|
||||
#endif // FIELD_UTILS_HPP_
|
|
@ -0,0 +1,183 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of misc. math and serialization utility functions
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FIELD_UTILS_TCC_
|
||||
#define FIELD_UTILS_TCC_
|
||||
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT coset_shift()
|
||||
{
|
||||
return FieldT::multiplicative_generator.squared();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT get_root_of_unity(const size_t n)
|
||||
{
|
||||
const size_t logn = log2(n);
|
||||
assert(n == (1u << logn));
|
||||
assert(logn <= FieldT::s);
|
||||
|
||||
FieldT omega = FieldT::root_of_unity;
|
||||
for (size_t i = FieldT::s; i > logn; --i)
|
||||
{
|
||||
omega *= omega;
|
||||
}
|
||||
|
||||
return omega;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> pack_int_vector_into_field_element_vector(const std::vector<size_t> &v, const size_t w)
|
||||
{
|
||||
const size_t chunk_bits = FieldT::capacity();
|
||||
const size_t repacked_size = div_ceil(v.size() * w, chunk_bits);
|
||||
std::vector<FieldT> result(repacked_size);
|
||||
|
||||
for (size_t i = 0; i < repacked_size; ++i)
|
||||
{
|
||||
bigint<FieldT::num_limbs> b;
|
||||
for (size_t j = 0; j < chunk_bits; ++j)
|
||||
{
|
||||
const size_t word_index = (i * chunk_bits + j) / w;
|
||||
const size_t pos_in_word = (i * chunk_bits + j) % w;
|
||||
const size_t word_or_0 = (word_index < v.size() ? v[word_index] : 0);
|
||||
const size_t bit = (word_or_0 >> pos_in_word) & 1;
|
||||
|
||||
b.data[j / GMP_NUMB_BITS] |= bit << (j % GMP_NUMB_BITS);
|
||||
}
|
||||
result[i] = FieldT(b);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v, const size_t chunk_bits)
|
||||
{
|
||||
assert(chunk_bits <= FieldT::capacity());
|
||||
|
||||
const size_t repacked_size = div_ceil(v.size(), chunk_bits);
|
||||
std::vector<FieldT> result(repacked_size);
|
||||
|
||||
for (size_t i = 0; i < repacked_size; ++i)
|
||||
{
|
||||
bigint<FieldT::num_limbs> b;
|
||||
for (size_t j = 0; j < chunk_bits; ++j)
|
||||
{
|
||||
b.data[j / GMP_NUMB_BITS] |= ((i * chunk_bits + j) < v.size() && v[i * chunk_bits + j] ? 1ll : 0ll) << (j % GMP_NUMB_BITS);
|
||||
}
|
||||
result[i] = FieldT(b);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v)
|
||||
{
|
||||
return pack_bit_vector_into_field_element_vector<FieldT>(v, FieldT::capacity());
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
std::vector<FieldT> convert_bit_vector_to_field_element_vector(const bit_vector &v)
|
||||
{
|
||||
std::vector<FieldT> result;
|
||||
result.reserve(v.size());
|
||||
|
||||
for (const bool b : v)
|
||||
{
|
||||
result.emplace_back(b ? FieldT::one() : FieldT::zero());
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector convert_field_element_vector_to_bit_vector(const std::vector<FieldT> &v)
|
||||
{
|
||||
bit_vector result;
|
||||
|
||||
for (const FieldT &el : v)
|
||||
{
|
||||
const bit_vector el_bits = convert_field_element_to_bit_vector<FieldT>(el);
|
||||
result.insert(result.end(), el_bits.begin(), el_bits.end());
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector convert_field_element_to_bit_vector(const FieldT &el)
|
||||
{
|
||||
bit_vector result;
|
||||
|
||||
bigint<FieldT::num_limbs> b = el.as_bigint();
|
||||
for (size_t i = 0; i < FieldT::size_in_bits(); ++i)
|
||||
{
|
||||
result.push_back(b.test_bit(i));
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector convert_field_element_to_bit_vector(const FieldT &el, const size_t bitcount)
|
||||
{
|
||||
bit_vector result = convert_field_element_to_bit_vector(el);
|
||||
result.resize(bitcount);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
FieldT convert_bit_vector_to_field_element(const bit_vector &v)
|
||||
{
|
||||
assert(v.size() <= FieldT::size_in_bits());
|
||||
|
||||
FieldT res = FieldT::zero();
|
||||
FieldT c = FieldT::one();
|
||||
for (bool b : v)
|
||||
{
|
||||
res += b ? c : FieldT::zero();
|
||||
c += c;
|
||||
}
|
||||
return res;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void batch_invert(std::vector<FieldT> &vec)
|
||||
{
|
||||
std::vector<FieldT> prod;
|
||||
prod.reserve(vec.size());
|
||||
|
||||
FieldT acc = FieldT::one();
|
||||
|
||||
for (auto el : vec)
|
||||
{
|
||||
assert(!el.is_zero());
|
||||
prod.emplace_back(acc);
|
||||
acc = acc * el;
|
||||
}
|
||||
|
||||
FieldT acc_inverse = acc.inverse();
|
||||
|
||||
for (long i = vec.size()-1; i >= 0; --i)
|
||||
{
|
||||
const FieldT old_el = vec[i];
|
||||
vec[i] = acc_inverse * prod[i];
|
||||
acc_inverse = acc_inverse * old_el;
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // FIELD_UTILS_TCC_
|
|
@ -0,0 +1,182 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Declaration of arithmetic in the finite field F[p], for prime p of fixed length.
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP_HPP_
|
||||
#define FP_HPP_
|
||||
|
||||
#include "algebra/fields/bigint.hpp"
|
||||
#include "algebra/exponentiation/exponentiation.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp_model;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &, const Fp_model<n, modulus>&);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &, Fp_model<n, modulus> &);
|
||||
|
||||
/**
|
||||
* Arithmetic in the finite field F[p], for prime p of fixed length.
|
||||
*
|
||||
* This class implements Fp-arithmetic, for a large prime p, using a fixed number
|
||||
* of words. It is optimized for tight memory consumption, so the modulus p is
|
||||
* passed as a template parameter, to avoid per-element overheads.
|
||||
*
|
||||
* The implementation is mostly a wrapper around GMP's MPN (constant-size integers).
|
||||
* But for the integer sizes of interest for libsnark (3 to 5 limbs of 64 bits each),
|
||||
* we implement performance-critical routines, like addition and multiplication,
|
||||
* using hand-optimzied assembly code.
|
||||
*/
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp_model {
|
||||
public:
|
||||
bigint<n> mont_repr;
|
||||
public:
|
||||
static const mp_size_t num_limbs = n;
|
||||
static const constexpr bigint<n>& mod = modulus;
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
static long long add_cnt;
|
||||
static long long sub_cnt;
|
||||
static long long mul_cnt;
|
||||
static long long sqr_cnt;
|
||||
static long long inv_cnt;
|
||||
#endif
|
||||
static size_t num_bits;
|
||||
static bigint<n> euler; // (modulus-1)/2
|
||||
static size_t s; // modulus = 2^s * t + 1
|
||||
static bigint<n> t; // with t odd
|
||||
static bigint<n> t_minus_1_over_2; // (t-1)/2
|
||||
static Fp_model<n, modulus> nqr; // a quadratic nonresidue
|
||||
static Fp_model<n, modulus> nqr_to_t; // nqr^t
|
||||
static Fp_model<n, modulus> multiplicative_generator; // generator of Fp^*
|
||||
static Fp_model<n, modulus> root_of_unity; // generator^((modulus-1)/2^s)
|
||||
static mp_limb_t inv; // modulus^(-1) mod W, where W = 2^(word size)
|
||||
static bigint<n> Rsquared; // R^2, where R = W^k, where k = ??
|
||||
static bigint<n> Rcubed; // R^3
|
||||
|
||||
static bool modulus_is_valid() { return modulus.data[n-1] != 0; } // mpn inverse assumes that highest limb is non-zero
|
||||
|
||||
Fp_model() {};
|
||||
Fp_model(const bigint<n> &b);
|
||||
Fp_model(const long x, const bool is_unsigned=false);
|
||||
|
||||
void set_ulong(const unsigned long x);
|
||||
|
||||
void mul_reduce(const bigint<n> &other);
|
||||
|
||||
void clear();
|
||||
|
||||
/* Return the standard (not Montgomery) representation of the
|
||||
Field element's requivalence class. I.e. Fp(2).as_bigint()
|
||||
would return bigint(2) */
|
||||
bigint<n> as_bigint() const;
|
||||
/* Return the last limb of the standard representation of the
|
||||
field element. E.g. on 64-bit architectures Fp(123).as_ulong()
|
||||
and Fp(2^64+123).as_ulong() would both return 123. */
|
||||
unsigned long as_ulong() const;
|
||||
|
||||
bool operator==(const Fp_model& other) const;
|
||||
bool operator!=(const Fp_model& other) const;
|
||||
bool is_zero() const;
|
||||
|
||||
void print() const;
|
||||
|
||||
Fp_model& operator+=(const Fp_model& other);
|
||||
Fp_model& operator-=(const Fp_model& other);
|
||||
Fp_model& operator*=(const Fp_model& other);
|
||||
Fp_model& operator^=(const unsigned long pow);
|
||||
|
||||
template<mp_size_t m>
|
||||
Fp_model& operator^=(const bigint<m> &pow);
|
||||
|
||||
Fp_model operator+(const Fp_model& other) const;
|
||||
Fp_model operator-(const Fp_model& other) const;
|
||||
Fp_model operator*(const Fp_model& other) const;
|
||||
Fp_model operator-() const;
|
||||
Fp_model squared() const;
|
||||
Fp_model& invert();
|
||||
Fp_model inverse() const;
|
||||
Fp_model sqrt() const; // HAS TO BE A SQUARE (else does not terminate)
|
||||
|
||||
Fp_model operator^(const unsigned long pow) const;
|
||||
template<mp_size_t m>
|
||||
Fp_model operator^(const bigint<m> &pow) const;
|
||||
|
||||
static size_t size_in_bits() { return num_bits; }
|
||||
static size_t capacity() { return num_bits - 1; }
|
||||
static bigint<n> field_char() { return modulus; }
|
||||
|
||||
static Fp_model<n, modulus> zero();
|
||||
static Fp_model<n, modulus> one();
|
||||
static Fp_model<n, modulus> random_element();
|
||||
|
||||
friend std::ostream& operator<< <n,modulus>(std::ostream &out, const Fp_model<n, modulus> &p);
|
||||
friend std::istream& operator>> <n,modulus>(std::istream &in, Fp_model<n, modulus> &p);
|
||||
};
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
long long Fp_model<n, modulus>::add_cnt = 0;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
long long Fp_model<n, modulus>::sub_cnt = 0;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
long long Fp_model<n, modulus>::mul_cnt = 0;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
long long Fp_model<n, modulus>::sqr_cnt = 0;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
long long Fp_model<n, modulus>::inv_cnt = 0;
|
||||
#endif
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
size_t Fp_model<n, modulus>::num_bits;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<n> Fp_model<n, modulus>::euler;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
size_t Fp_model<n, modulus>::s;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<n> Fp_model<n, modulus>::t;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<n> Fp_model<n, modulus>::t_minus_1_over_2;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp_model<n, modulus>::nqr;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp_model<n, modulus>::nqr_to_t;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp_model<n, modulus>::multiplicative_generator;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp_model<n, modulus>::root_of_unity;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
mp_limb_t Fp_model<n, modulus>::inv;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<n> Fp_model<n, modulus>::Rsquared;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<n> Fp_model<n, modulus>::Rcubed;
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/fields/fp.tcc"
|
||||
|
||||
#endif // FP_HPP_
|
|
@ -0,0 +1,790 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of arithmetic in the finite field F[p], for prime p of fixed length.
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP_TCC_
|
||||
#define FP_TCC_
|
||||
#include <cassert>
|
||||
#include <cstdlib>
|
||||
#include <cmath>
|
||||
|
||||
#include "algebra/fields/fp_aux.tcc"
|
||||
#include "algebra/fields/field_utils.hpp"
|
||||
#include "common/assert_except.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
void Fp_model<n,modulus>::mul_reduce(const bigint<n> &other)
|
||||
{
|
||||
/* stupid pre-processor tricks; beware */
|
||||
#if defined(__x86_64__) && defined(USE_ASM)
|
||||
if (n == 3)
|
||||
{ // Use asm-optimized Comba multiplication and reduction
|
||||
mp_limb_t res[2*n];
|
||||
mp_limb_t c0, c1, c2;
|
||||
COMBA_3_BY_3_MUL(c0, c1, c2, res, this->mont_repr.data, other.data);
|
||||
|
||||
mp_limb_t k;
|
||||
mp_limb_t tmp1, tmp2, tmp3;
|
||||
REDUCE_6_LIMB_PRODUCT(k, tmp1, tmp2, tmp3, inv, res, modulus.data);
|
||||
|
||||
/* subtract t > mod */
|
||||
__asm__
|
||||
("/* check for overflow */ \n\t"
|
||||
MONT_CMP(16)
|
||||
MONT_CMP(8)
|
||||
MONT_CMP(0)
|
||||
|
||||
"/* subtract mod if overflow */ \n\t"
|
||||
"subtract%=: \n\t"
|
||||
MONT_FIRSTSUB
|
||||
MONT_NEXTSUB(8)
|
||||
MONT_NEXTSUB(16)
|
||||
"done%=: \n\t"
|
||||
:
|
||||
: [tmp] "r" (res+n), [M] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
mpn_copyi(this->mont_repr.data, res+n, n);
|
||||
}
|
||||
else if (n == 4)
|
||||
{ // use asm-optimized "CIOS method"
|
||||
|
||||
mp_limb_t tmp[n+1];
|
||||
mp_limb_t T0=0, T1=1, cy=2, u=3; // TODO: fix this
|
||||
|
||||
__asm__ (MONT_PRECOMPUTE
|
||||
MONT_FIRSTITER(1)
|
||||
MONT_FIRSTITER(2)
|
||||
MONT_FIRSTITER(3)
|
||||
MONT_FINALIZE(3)
|
||||
MONT_ITERFIRST(1)
|
||||
MONT_ITERITER(1, 1)
|
||||
MONT_ITERITER(1, 2)
|
||||
MONT_ITERITER(1, 3)
|
||||
MONT_FINALIZE(3)
|
||||
MONT_ITERFIRST(2)
|
||||
MONT_ITERITER(2, 1)
|
||||
MONT_ITERITER(2, 2)
|
||||
MONT_ITERITER(2, 3)
|
||||
MONT_FINALIZE(3)
|
||||
MONT_ITERFIRST(3)
|
||||
MONT_ITERITER(3, 1)
|
||||
MONT_ITERITER(3, 2)
|
||||
MONT_ITERITER(3, 3)
|
||||
MONT_FINALIZE(3)
|
||||
"/* check for overflow */ \n\t"
|
||||
MONT_CMP(24)
|
||||
MONT_CMP(16)
|
||||
MONT_CMP(8)
|
||||
MONT_CMP(0)
|
||||
|
||||
"/* subtract mod if overflow */ \n\t"
|
||||
"subtract%=: \n\t"
|
||||
MONT_FIRSTSUB
|
||||
MONT_NEXTSUB(8)
|
||||
MONT_NEXTSUB(16)
|
||||
MONT_NEXTSUB(24)
|
||||
"done%=: \n\t"
|
||||
:
|
||||
: [tmp] "r" (tmp), [A] "r" (this->mont_repr.data), [B] "r" (other.data), [inv] "r" (inv), [M] "r" (modulus.data),
|
||||
[T0] "r" (T0), [T1] "r" (T1), [cy] "r" (cy), [u] "r" (u)
|
||||
: "cc", "memory", "%rax", "%rdx"
|
||||
);
|
||||
mpn_copyi(this->mont_repr.data, tmp, n);
|
||||
}
|
||||
else if (n == 5)
|
||||
{ // use asm-optimized "CIOS method"
|
||||
|
||||
mp_limb_t tmp[n+1];
|
||||
mp_limb_t T0=0, T1=1, cy=2, u=3; // TODO: fix this
|
||||
|
||||
__asm__ (MONT_PRECOMPUTE
|
||||
MONT_FIRSTITER(1)
|
||||
MONT_FIRSTITER(2)
|
||||
MONT_FIRSTITER(3)
|
||||
MONT_FIRSTITER(4)
|
||||
MONT_FINALIZE(4)
|
||||
MONT_ITERFIRST(1)
|
||||
MONT_ITERITER(1, 1)
|
||||
MONT_ITERITER(1, 2)
|
||||
MONT_ITERITER(1, 3)
|
||||
MONT_ITERITER(1, 4)
|
||||
MONT_FINALIZE(4)
|
||||
MONT_ITERFIRST(2)
|
||||
MONT_ITERITER(2, 1)
|
||||
MONT_ITERITER(2, 2)
|
||||
MONT_ITERITER(2, 3)
|
||||
MONT_ITERITER(2, 4)
|
||||
MONT_FINALIZE(4)
|
||||
MONT_ITERFIRST(3)
|
||||
MONT_ITERITER(3, 1)
|
||||
MONT_ITERITER(3, 2)
|
||||
MONT_ITERITER(3, 3)
|
||||
MONT_ITERITER(3, 4)
|
||||
MONT_FINALIZE(4)
|
||||
MONT_ITERFIRST(4)
|
||||
MONT_ITERITER(4, 1)
|
||||
MONT_ITERITER(4, 2)
|
||||
MONT_ITERITER(4, 3)
|
||||
MONT_ITERITER(4, 4)
|
||||
MONT_FINALIZE(4)
|
||||
"/* check for overflow */ \n\t"
|
||||
MONT_CMP(32)
|
||||
MONT_CMP(24)
|
||||
MONT_CMP(16)
|
||||
MONT_CMP(8)
|
||||
MONT_CMP(0)
|
||||
|
||||
"/* subtract mod if overflow */ \n\t"
|
||||
"subtract%=: \n\t"
|
||||
MONT_FIRSTSUB
|
||||
MONT_NEXTSUB(8)
|
||||
MONT_NEXTSUB(16)
|
||||
MONT_NEXTSUB(24)
|
||||
MONT_NEXTSUB(32)
|
||||
"done%=: \n\t"
|
||||
:
|
||||
: [tmp] "r" (tmp), [A] "r" (this->mont_repr.data), [B] "r" (other.data), [inv] "r" (inv), [M] "r" (modulus.data),
|
||||
[T0] "r" (T0), [T1] "r" (T1), [cy] "r" (cy), [u] "r" (u)
|
||||
: "cc", "memory", "%rax", "%rdx"
|
||||
);
|
||||
mpn_copyi(this->mont_repr.data, tmp, n);
|
||||
}
|
||||
else
|
||||
#endif
|
||||
{
|
||||
mp_limb_t res[2*n];
|
||||
mpn_mul_n(res, this->mont_repr.data, other.data, n);
|
||||
|
||||
/*
|
||||
The Montgomery reduction here is based on Algorithm 14.32 in
|
||||
Handbook of Applied Cryptography
|
||||
<http://cacr.uwaterloo.ca/hac/about/chap14.pdf>.
|
||||
*/
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
{
|
||||
mp_limb_t k = inv * res[i];
|
||||
/* calculate res = res + k * mod * b^i */
|
||||
mp_limb_t carryout = mpn_addmul_1(res+i, modulus.data, n, k);
|
||||
carryout = mpn_add_1(res+n+i, res+n+i, n-i, carryout);
|
||||
assert(carryout == 0);
|
||||
}
|
||||
|
||||
if (mpn_cmp(res+n, modulus.data, n) >= 0)
|
||||
{
|
||||
const mp_limb_t borrow = mpn_sub(res+n, res+n, n, modulus.data, n);
|
||||
assert(borrow == 0);
|
||||
}
|
||||
|
||||
mpn_copyi(this->mont_repr.data, res+n, n);
|
||||
}
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus>::Fp_model(const bigint<n> &b)
|
||||
{
|
||||
mpn_copyi(this->mont_repr.data, Rsquared.data, n);
|
||||
mul_reduce(b);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus>::Fp_model(const long x, const bool is_unsigned)
|
||||
{
|
||||
if (is_unsigned || x >= 0)
|
||||
{
|
||||
this->mont_repr.data[0] = x;
|
||||
}
|
||||
else
|
||||
{
|
||||
const mp_limb_t borrow = mpn_sub_1(this->mont_repr.data, modulus.data, n, -x);
|
||||
assert(borrow == 0);
|
||||
}
|
||||
|
||||
mul_reduce(Rsquared);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
void Fp_model<n,modulus>::set_ulong(const unsigned long x)
|
||||
{
|
||||
this->mont_repr.clear();
|
||||
this->mont_repr.data[0] = x;
|
||||
mul_reduce(Rsquared);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
void Fp_model<n,modulus>::clear()
|
||||
{
|
||||
this->mont_repr.clear();
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<n> Fp_model<n,modulus>::as_bigint() const
|
||||
{
|
||||
bigint<n> one;
|
||||
one.clear();
|
||||
one.data[0] = 1;
|
||||
|
||||
Fp_model<n, modulus> res(*this);
|
||||
res.mul_reduce(one);
|
||||
|
||||
return (res.mont_repr);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
unsigned long Fp_model<n,modulus>::as_ulong() const
|
||||
{
|
||||
return this->as_bigint().as_ulong();
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp_model<n,modulus>::operator==(const Fp_model& other) const
|
||||
{
|
||||
return (this->mont_repr == other.mont_repr);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp_model<n,modulus>::operator!=(const Fp_model& other) const
|
||||
{
|
||||
return (this->mont_repr != other.mont_repr);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp_model<n,modulus>::is_zero() const
|
||||
{
|
||||
return (this->mont_repr.is_zero()); // zero maps to zero
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
void Fp_model<n,modulus>::print() const
|
||||
{
|
||||
Fp_model<n,modulus> tmp;
|
||||
tmp.mont_repr.data[0] = 1;
|
||||
tmp.mul_reduce(this->mont_repr);
|
||||
|
||||
tmp.mont_repr.print();
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::zero()
|
||||
{
|
||||
Fp_model<n,modulus> res;
|
||||
res.mont_repr.clear();
|
||||
return res;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::one()
|
||||
{
|
||||
Fp_model<n,modulus> res;
|
||||
res.mont_repr.data[0] = 1;
|
||||
res.mul_reduce(Rsquared);
|
||||
return res;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus>& Fp_model<n,modulus>::operator+=(const Fp_model<n,modulus>& other)
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->add_cnt++;
|
||||
#endif
|
||||
#if defined(__x86_64__) && defined(USE_ASM)
|
||||
if (n == 3)
|
||||
{
|
||||
__asm__
|
||||
("/* perform bignum addition */ \n\t"
|
||||
ADD_FIRSTADD
|
||||
ADD_NEXTADD(8)
|
||||
ADD_NEXTADD(16)
|
||||
"/* if overflow: subtract */ \n\t"
|
||||
"/* (tricky point: if A and B are in the range we do not need to do anything special for the possible carry flag) */ \n\t"
|
||||
"jc subtract%= \n\t"
|
||||
|
||||
"/* check for overflow */ \n\t"
|
||||
ADD_CMP(16)
|
||||
ADD_CMP(8)
|
||||
ADD_CMP(0)
|
||||
|
||||
"/* subtract mod if overflow */ \n\t"
|
||||
"subtract%=: \n\t"
|
||||
ADD_FIRSTSUB
|
||||
ADD_NEXTSUB(8)
|
||||
ADD_NEXTSUB(16)
|
||||
"done%=: \n\t"
|
||||
:
|
||||
: [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
}
|
||||
else if (n == 4)
|
||||
{
|
||||
__asm__
|
||||
("/* perform bignum addition */ \n\t"
|
||||
ADD_FIRSTADD
|
||||
ADD_NEXTADD(8)
|
||||
ADD_NEXTADD(16)
|
||||
ADD_NEXTADD(24)
|
||||
"/* if overflow: subtract */ \n\t"
|
||||
"/* (tricky point: if A and B are in the range we do not need to do anything special for the possible carry flag) */ \n\t"
|
||||
"jc subtract%= \n\t"
|
||||
|
||||
"/* check for overflow */ \n\t"
|
||||
ADD_CMP(24)
|
||||
ADD_CMP(16)
|
||||
ADD_CMP(8)
|
||||
ADD_CMP(0)
|
||||
|
||||
"/* subtract mod if overflow */ \n\t"
|
||||
"subtract%=: \n\t"
|
||||
ADD_FIRSTSUB
|
||||
ADD_NEXTSUB(8)
|
||||
ADD_NEXTSUB(16)
|
||||
ADD_NEXTSUB(24)
|
||||
"done%=: \n\t"
|
||||
:
|
||||
: [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
}
|
||||
else if (n == 5)
|
||||
{
|
||||
__asm__
|
||||
("/* perform bignum addition */ \n\t"
|
||||
ADD_FIRSTADD
|
||||
ADD_NEXTADD(8)
|
||||
ADD_NEXTADD(16)
|
||||
ADD_NEXTADD(24)
|
||||
ADD_NEXTADD(32)
|
||||
"/* if overflow: subtract */ \n\t"
|
||||
"/* (tricky point: if A and B are in the range we do not need to do anything special for the possible carry flag) */ \n\t"
|
||||
"jc subtract%= \n\t"
|
||||
|
||||
"/* check for overflow */ \n\t"
|
||||
ADD_CMP(32)
|
||||
ADD_CMP(24)
|
||||
ADD_CMP(16)
|
||||
ADD_CMP(8)
|
||||
ADD_CMP(0)
|
||||
|
||||
"/* subtract mod if overflow */ \n\t"
|
||||
"subtract%=: \n\t"
|
||||
ADD_FIRSTSUB
|
||||
ADD_NEXTSUB(8)
|
||||
ADD_NEXTSUB(16)
|
||||
ADD_NEXTSUB(24)
|
||||
ADD_NEXTSUB(32)
|
||||
"done%=: \n\t"
|
||||
:
|
||||
: [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
}
|
||||
else
|
||||
#endif
|
||||
{
|
||||
mp_limb_t scratch[n+1];
|
||||
const mp_limb_t carry = mpn_add_n(scratch, this->mont_repr.data, other.mont_repr.data, n);
|
||||
scratch[n] = carry;
|
||||
|
||||
if (carry || mpn_cmp(scratch, modulus.data, n) >= 0)
|
||||
{
|
||||
const mp_limb_t borrow = mpn_sub(scratch, scratch, n+1, modulus.data, n);
|
||||
assert(borrow == 0);
|
||||
}
|
||||
|
||||
mpn_copyi(this->mont_repr.data, scratch, n);
|
||||
}
|
||||
|
||||
return *this;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus>& Fp_model<n,modulus>::operator-=(const Fp_model<n,modulus>& other)
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->sub_cnt++;
|
||||
#endif
|
||||
#if defined(__x86_64__) && defined(USE_ASM)
|
||||
if (n == 3)
|
||||
{
|
||||
__asm__
|
||||
(SUB_FIRSTSUB
|
||||
SUB_NEXTSUB(8)
|
||||
SUB_NEXTSUB(16)
|
||||
|
||||
"jnc done%=\n\t"
|
||||
|
||||
SUB_FIRSTADD
|
||||
SUB_NEXTADD(8)
|
||||
SUB_NEXTADD(16)
|
||||
|
||||
"done%=:\n\t"
|
||||
:
|
||||
: [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
}
|
||||
else if (n == 4)
|
||||
{
|
||||
__asm__
|
||||
(SUB_FIRSTSUB
|
||||
SUB_NEXTSUB(8)
|
||||
SUB_NEXTSUB(16)
|
||||
SUB_NEXTSUB(24)
|
||||
|
||||
"jnc done%=\n\t"
|
||||
|
||||
SUB_FIRSTADD
|
||||
SUB_NEXTADD(8)
|
||||
SUB_NEXTADD(16)
|
||||
SUB_NEXTADD(24)
|
||||
|
||||
"done%=:\n\t"
|
||||
:
|
||||
: [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
}
|
||||
else if (n == 5)
|
||||
{
|
||||
__asm__
|
||||
(SUB_FIRSTSUB
|
||||
SUB_NEXTSUB(8)
|
||||
SUB_NEXTSUB(16)
|
||||
SUB_NEXTSUB(24)
|
||||
SUB_NEXTSUB(32)
|
||||
|
||||
"jnc done%=\n\t"
|
||||
|
||||
SUB_FIRSTADD
|
||||
SUB_NEXTADD(8)
|
||||
SUB_NEXTADD(16)
|
||||
SUB_NEXTADD(24)
|
||||
SUB_NEXTADD(32)
|
||||
|
||||
"done%=:\n\t"
|
||||
:
|
||||
: [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
}
|
||||
else
|
||||
#endif
|
||||
{
|
||||
mp_limb_t scratch[n+1];
|
||||
if (mpn_cmp(this->mont_repr.data, other.mont_repr.data, n) < 0)
|
||||
{
|
||||
const mp_limb_t carry = mpn_add_n(scratch, this->mont_repr.data, modulus.data, n);
|
||||
scratch[n] = carry;
|
||||
}
|
||||
else
|
||||
{
|
||||
mpn_copyi(scratch, this->mont_repr.data, n);
|
||||
scratch[n] = 0;
|
||||
}
|
||||
|
||||
const mp_limb_t borrow = mpn_sub(scratch, scratch, n+1, other.mont_repr.data, n);
|
||||
assert(borrow == 0);
|
||||
|
||||
mpn_copyi(this->mont_repr.data, scratch, n);
|
||||
}
|
||||
return *this;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus>& Fp_model<n,modulus>::operator*=(const Fp_model<n,modulus>& other)
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->mul_cnt++;
|
||||
#endif
|
||||
|
||||
mul_reduce(other.mont_repr);
|
||||
return *this;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus>& Fp_model<n,modulus>::operator^=(const unsigned long pow)
|
||||
{
|
||||
(*this) = power<Fp_model<n, modulus> >(*this, pow);
|
||||
return (*this);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
template<mp_size_t m>
|
||||
Fp_model<n,modulus>& Fp_model<n,modulus>::operator^=(const bigint<m> &pow)
|
||||
{
|
||||
(*this) = power<Fp_model<n, modulus>, m>(*this, pow);
|
||||
return (*this);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::operator+(const Fp_model<n,modulus>& other) const
|
||||
{
|
||||
Fp_model<n, modulus> r(*this);
|
||||
return (r += other);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::operator-(const Fp_model<n,modulus>& other) const
|
||||
{
|
||||
Fp_model<n, modulus> r(*this);
|
||||
return (r -= other);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::operator*(const Fp_model<n,modulus>& other) const
|
||||
{
|
||||
Fp_model<n, modulus> r(*this);
|
||||
return (r *= other);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::operator^(const unsigned long pow) const
|
||||
{
|
||||
Fp_model<n, modulus> r(*this);
|
||||
return (r ^= pow);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
template<mp_size_t m>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::operator^(const bigint<m> &pow) const
|
||||
{
|
||||
Fp_model<n, modulus> r(*this);
|
||||
return (r ^= pow);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::operator-() const
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->sub_cnt++;
|
||||
#endif
|
||||
|
||||
if (this->is_zero())
|
||||
{
|
||||
return (*this);
|
||||
}
|
||||
else
|
||||
{
|
||||
Fp_model<n, modulus> r;
|
||||
mpn_sub_n(r.mont_repr.data, modulus.data, this->mont_repr.data, n);
|
||||
return r;
|
||||
}
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::squared() const
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->sqr_cnt++;
|
||||
this->mul_cnt--; // zero out the upcoming mul
|
||||
#endif
|
||||
/* stupid pre-processor tricks; beware */
|
||||
#if defined(__x86_64__) && defined(USE_ASM)
|
||||
if (n == 3)
|
||||
{ // use asm-optimized Comba squaring
|
||||
mp_limb_t res[2*n];
|
||||
mp_limb_t c0, c1, c2;
|
||||
COMBA_3_BY_3_SQR(c0, c1, c2, res, this->mont_repr.data);
|
||||
|
||||
mp_limb_t k;
|
||||
mp_limb_t tmp1, tmp2, tmp3;
|
||||
REDUCE_6_LIMB_PRODUCT(k, tmp1, tmp2, tmp3, inv, res, modulus.data);
|
||||
|
||||
/* subtract t > mod */
|
||||
__asm__ volatile
|
||||
("/* check for overflow */ \n\t"
|
||||
MONT_CMP(16)
|
||||
MONT_CMP(8)
|
||||
MONT_CMP(0)
|
||||
|
||||
"/* subtract mod if overflow */ \n\t"
|
||||
"subtract%=: \n\t"
|
||||
MONT_FIRSTSUB
|
||||
MONT_NEXTSUB(8)
|
||||
MONT_NEXTSUB(16)
|
||||
"done%=: \n\t"
|
||||
:
|
||||
: [tmp] "r" (res+n), [M] "r" (modulus.data)
|
||||
: "cc", "memory", "%rax");
|
||||
|
||||
Fp_model<n, modulus> r;
|
||||
mpn_copyi(r.mont_repr.data, res+n, n);
|
||||
return r;
|
||||
}
|
||||
else
|
||||
#endif
|
||||
{
|
||||
Fp_model<n, modulus> r(*this);
|
||||
return (r *= r);
|
||||
}
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus>& Fp_model<n,modulus>::invert()
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
this->inv_cnt++;
|
||||
#endif
|
||||
|
||||
assert(!this->is_zero());
|
||||
|
||||
bigint<n> g; /* gp should have room for vn = n limbs */
|
||||
|
||||
mp_limb_t s[n+1]; /* sp should have room for vn+1 limbs */
|
||||
mp_size_t sn;
|
||||
|
||||
bigint<n> v = modulus; // both source operands are destroyed by mpn_gcdext
|
||||
|
||||
/* computes gcd(u, v) = g = u*s + v*t, so s*u will be 1 (mod v) */
|
||||
const mp_size_t gn = mpn_gcdext(g.data, s, &sn, this->mont_repr.data, n, v.data, n);
|
||||
assert(gn == 1 && g.data[0] == 1); /* inverse exists */
|
||||
|
||||
mp_limb_t q; /* division result fits into q, as sn <= n+1 */
|
||||
/* sn < 0 indicates negative sn; will fix up later */
|
||||
|
||||
if (std::abs(sn) >= n)
|
||||
{
|
||||
/* if sn could require modulus reduction, do it here */
|
||||
mpn_tdiv_qr(&q, this->mont_repr.data, 0, s, std::abs(sn), modulus.data, n);
|
||||
}
|
||||
else
|
||||
{
|
||||
/* otherwise just copy it over */
|
||||
mpn_zero(this->mont_repr.data, n);
|
||||
mpn_copyi(this->mont_repr.data, s, std::abs(sn));
|
||||
}
|
||||
|
||||
/* fix up the negative sn */
|
||||
if (sn < 0)
|
||||
{
|
||||
const mp_limb_t borrow = mpn_sub_n(this->mont_repr.data, modulus.data, this->mont_repr.data, n);
|
||||
assert(borrow == 0);
|
||||
}
|
||||
|
||||
mul_reduce(Rcubed);
|
||||
return *this;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::inverse() const
|
||||
{
|
||||
Fp_model<n, modulus> r(*this);
|
||||
return (r.invert());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp_model<n,modulus>::random_element() /// returns random element of Fp_model
|
||||
{
|
||||
/* note that as Montgomery representation is a bijection then
|
||||
selecting a random element of {xR} is the same as selecting a
|
||||
random element of {x} */
|
||||
Fp_model<n, modulus> r;
|
||||
do
|
||||
{
|
||||
r.mont_repr.randomize();
|
||||
|
||||
/* clear all bits higher than MSB of modulus */
|
||||
size_t bitno = GMP_NUMB_BITS * n - 1;
|
||||
while (modulus.test_bit(bitno) == false)
|
||||
{
|
||||
const std::size_t part = bitno/GMP_NUMB_BITS;
|
||||
const std::size_t bit = bitno - (GMP_NUMB_BITS*part);
|
||||
|
||||
r.mont_repr.data[part] &= ~(1ul<<bit);
|
||||
|
||||
bitno--;
|
||||
}
|
||||
}
|
||||
/* if r.data is still >= modulus -- repeat (rejection sampling) */
|
||||
while (mpn_cmp(r.mont_repr.data, modulus.data, n) >= 0);
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n,modulus> Fp_model<n,modulus>::sqrt() const
|
||||
{
|
||||
if (is_zero()) {
|
||||
return *this;
|
||||
}
|
||||
|
||||
Fp_model<n,modulus> one = Fp_model<n,modulus>::one();
|
||||
|
||||
size_t v = Fp_model<n,modulus>::s;
|
||||
Fp_model<n,modulus> z = Fp_model<n,modulus>::nqr_to_t;
|
||||
Fp_model<n,modulus> w = (*this)^Fp_model<n,modulus>::t_minus_1_over_2;
|
||||
Fp_model<n,modulus> x = (*this) * w;
|
||||
Fp_model<n,modulus> b = x * w; // b = (*this)^t
|
||||
|
||||
|
||||
// check if square with euler's criterion
|
||||
Fp_model<n,modulus> check = b;
|
||||
for (size_t i = 0; i < v-1; ++i)
|
||||
{
|
||||
check = check.squared();
|
||||
}
|
||||
if (check != one)
|
||||
{
|
||||
assert_except(0);
|
||||
}
|
||||
|
||||
|
||||
// compute square root with Tonelli--Shanks
|
||||
// (does not terminate if not a square!)
|
||||
|
||||
while (b != one)
|
||||
{
|
||||
size_t m = 0;
|
||||
Fp_model<n,modulus> b2m = b;
|
||||
while (b2m != one)
|
||||
{
|
||||
/* invariant: b2m = b^(2^m) after entering this loop */
|
||||
b2m = b2m.squared();
|
||||
m += 1;
|
||||
}
|
||||
|
||||
int j = v-m-1;
|
||||
w = z;
|
||||
while (j > 0)
|
||||
{
|
||||
w = w.squared();
|
||||
--j;
|
||||
} // w = z^2^(v-m-1)
|
||||
|
||||
z = w.squared();
|
||||
b = b * z;
|
||||
x = x * w;
|
||||
v = m;
|
||||
}
|
||||
|
||||
return x;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &out, const Fp_model<n, modulus> &p)
|
||||
{
|
||||
#ifndef MONTGOMERY_OUTPUT
|
||||
Fp_model<n,modulus> tmp;
|
||||
tmp.mont_repr.data[0] = 1;
|
||||
tmp.mul_reduce(p.mont_repr);
|
||||
out << tmp.mont_repr;
|
||||
#else
|
||||
out << p.mont_repr;
|
||||
#endif
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &in, Fp_model<n, modulus> &p)
|
||||
{
|
||||
#ifndef MONTGOMERY_OUTPUT
|
||||
in >> p.mont_repr;
|
||||
p.mul_reduce(Fp_model<n, modulus>::Rsquared);
|
||||
#else
|
||||
in >> p.mont_repr;
|
||||
#endif
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // FP_TCC_
|
|
@ -0,0 +1,116 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Declaration of arithmetic in the finite field F[((p^2)^3)^2].
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP12_2OVER3OVER2_HPP_
|
||||
#define FP12_2OVER3OVER2_HPP_
|
||||
#include "algebra/fields/fp.hpp"
|
||||
#include "algebra/fields/fp2.hpp"
|
||||
#include "algebra/fields/fp6_3over2.hpp"
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp12_2over3over2_model;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &, const Fp12_2over3over2_model<n, modulus> &);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &, Fp12_2over3over2_model<n, modulus> &);
|
||||
|
||||
/**
|
||||
* Arithmetic in the finite field F[((p^2)^3)^2].
|
||||
*
|
||||
* Let p := modulus. This interface provides arithmetic for the extension field
|
||||
* Fp12 = Fp6[W]/(W^2-V) where Fp6 = Fp2[V]/(V^3-non_residue) and non_residue is in Fp2
|
||||
*
|
||||
* ASSUMPTION: p = 1 (mod 6)
|
||||
*/
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp12_2over3over2_model {
|
||||
public:
|
||||
typedef Fp_model<n, modulus> my_Fp;
|
||||
typedef Fp2_model<n, modulus> my_Fp2;
|
||||
typedef Fp6_3over2_model<n, modulus> my_Fp6;
|
||||
|
||||
static Fp2_model<n, modulus> non_residue;
|
||||
static Fp2_model<n, modulus> Frobenius_coeffs_c1[12]; // non_residue^((modulus^i-1)/6) for i=0,...,11
|
||||
|
||||
my_Fp6 c0, c1;
|
||||
Fp12_2over3over2_model() {};
|
||||
Fp12_2over3over2_model(const my_Fp6& c0, const my_Fp6& c1) : c0(c0), c1(c1) {};
|
||||
|
||||
void clear() { c0.clear(); c1.clear(); }
|
||||
void print() const { printf("c0/c1:\n"); c0.print(); c1.print(); }
|
||||
|
||||
static Fp12_2over3over2_model<n, modulus> zero();
|
||||
static Fp12_2over3over2_model<n, modulus> one();
|
||||
static Fp12_2over3over2_model<n, modulus> random_element();
|
||||
|
||||
bool is_zero() const { return c0.is_zero() && c1.is_zero(); }
|
||||
bool operator==(const Fp12_2over3over2_model &other) const;
|
||||
bool operator!=(const Fp12_2over3over2_model &other) const;
|
||||
|
||||
Fp12_2over3over2_model operator+(const Fp12_2over3over2_model &other) const;
|
||||
Fp12_2over3over2_model operator-(const Fp12_2over3over2_model &other) const;
|
||||
Fp12_2over3over2_model operator*(const Fp12_2over3over2_model &other) const;
|
||||
Fp12_2over3over2_model operator-() const;
|
||||
Fp12_2over3over2_model squared() const; // default is squared_complex
|
||||
Fp12_2over3over2_model squared_karatsuba() const;
|
||||
Fp12_2over3over2_model squared_complex() const;
|
||||
Fp12_2over3over2_model inverse() const;
|
||||
Fp12_2over3over2_model Frobenius_map(unsigned long power) const;
|
||||
Fp12_2over3over2_model unitary_inverse() const;
|
||||
Fp12_2over3over2_model cyclotomic_squared() const;
|
||||
|
||||
Fp12_2over3over2_model mul_by_024(const my_Fp2 &ell_0, const my_Fp2 &ell_VW, const my_Fp2 &ell_VV) const;
|
||||
|
||||
static my_Fp6 mul_by_non_residue(const my_Fp6 &elt);
|
||||
|
||||
template<mp_size_t m>
|
||||
Fp12_2over3over2_model cyclotomic_exp(const bigint<m> &exponent) const;
|
||||
|
||||
static bigint<n> base_field_char() { return modulus; }
|
||||
static size_t extension_degree() { return 12; }
|
||||
|
||||
friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp12_2over3over2_model<n, modulus> &el);
|
||||
friend std::istream& operator>> <n, modulus>(std::istream &in, Fp12_2over3over2_model<n, modulus> &el);
|
||||
};
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp12_2over3over2_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp12_2over3over2_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator*(const Fp6_3over2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
|
||||
Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const bigint<m> &exponent);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& exp_modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const Fp_model<m, exp_modulus> &exponent);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp12_2over3over2_model<n, modulus>::non_residue;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp12_2over3over2_model<n, modulus>::Frobenius_coeffs_c1[12];
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/fields/fp12_2over3over2.tcc"
|
||||
#endif // FP12_2OVER3OVER2_HPP_
|
|
@ -0,0 +1,412 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of arithmetic in the finite field F[((p^2)^3)^2].
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP12_2OVER3OVER2_TCC_
|
||||
#define FP12_2OVER3OVER2_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n, modulus> Fp12_2over3over2_model<n,modulus>::mul_by_non_residue(const Fp6_3over2_model<n, modulus> &elt)
|
||||
{
|
||||
return Fp6_3over2_model<n, modulus>(non_residue * elt.c2, elt.c0, elt.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::zero()
|
||||
{
|
||||
return Fp12_2over3over2_model<n, modulus>(my_Fp6::zero(), my_Fp6::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::one()
|
||||
{
|
||||
return Fp12_2over3over2_model<n, modulus>(my_Fp6::one(), my_Fp6::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::random_element()
|
||||
{
|
||||
Fp12_2over3over2_model<n, modulus> r;
|
||||
r.c0 = my_Fp6::random_element();
|
||||
r.c1 = my_Fp6::random_element();
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp12_2over3over2_model<n,modulus>::operator==(const Fp12_2over3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return (this->c0 == other.c0 && this->c1 == other.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp12_2over3over2_model<n,modulus>::operator!=(const Fp12_2over3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return !(operator==(other));
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator+(const Fp12_2over3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(this->c0 + other.c0,
|
||||
this->c1 + other.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator-(const Fp12_2over3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(this->c0 - other.c0,
|
||||
this->c1 - other.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs)
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(lhs*rhs.c0,
|
||||
lhs*rhs.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs)
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(lhs*rhs.c0,
|
||||
lhs*rhs.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator*(const Fp6_3over2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs)
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(lhs*rhs.c0,
|
||||
lhs*rhs.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator*(const Fp12_2over3over2_model<n,modulus> &other) const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
|
||||
|
||||
const my_Fp6 &A = other.c0, &B = other.c1,
|
||||
&a = this->c0, &b = this->c1;
|
||||
const my_Fp6 aA = a * A;
|
||||
const my_Fp6 bB = b * B;
|
||||
|
||||
return Fp12_2over3over2_model<n,modulus>(aA + Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(bB),
|
||||
(a + b)*(A+B) - aA - bB);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator-() const
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(-this->c0,
|
||||
-this->c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::squared() const
|
||||
{
|
||||
return squared_complex();
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::squared_karatsuba() const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba squaring) */
|
||||
|
||||
const my_Fp6 &a = this->c0, &b = this->c1;
|
||||
const my_Fp6 asq = a.squared();
|
||||
const my_Fp6 bsq = b.squared();
|
||||
|
||||
return Fp12_2over3over2_model<n,modulus>(asq + Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(bsq),
|
||||
(a + b).squared() - asq - bsq);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::squared_complex() const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Complex squaring) */
|
||||
|
||||
const my_Fp6 &a = this->c0, &b = this->c1;
|
||||
const my_Fp6 ab = a * b;
|
||||
|
||||
return Fp12_2over3over2_model<n,modulus>((a + b) * (a + Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(b)) - ab - Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(ab),
|
||||
ab + ab);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::inverse() const
|
||||
{
|
||||
/* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 8 */
|
||||
|
||||
const my_Fp6 &a = this->c0, &b = this->c1;
|
||||
const my_Fp6 t0 = a.squared();
|
||||
const my_Fp6 t1 = b.squared();
|
||||
const my_Fp6 t2 = t0 - Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(t1);
|
||||
const my_Fp6 t3 = t2.inverse();
|
||||
const my_Fp6 c0 = a * t3;
|
||||
const my_Fp6 c1 = - (b * t3);
|
||||
|
||||
return Fp12_2over3over2_model<n,modulus>(c0, c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::Frobenius_map(unsigned long power) const
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(c0.Frobenius_map(power),
|
||||
Frobenius_coeffs_c1[power % 12] * c1.Frobenius_map(power));
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::unitary_inverse() const
|
||||
{
|
||||
return Fp12_2over3over2_model<n,modulus>(this->c0,
|
||||
-this->c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::cyclotomic_squared() const
|
||||
{
|
||||
/* OLD: naive implementation
|
||||
return (*this).squared();
|
||||
*/
|
||||
my_Fp2 z0 = this->c0.c0;
|
||||
my_Fp2 z4 = this->c0.c1;
|
||||
my_Fp2 z3 = this->c0.c2;
|
||||
my_Fp2 z2 = this->c1.c0;
|
||||
my_Fp2 z1 = this->c1.c1;
|
||||
my_Fp2 z5 = this->c1.c2;
|
||||
|
||||
my_Fp2 t0, t1, t2, t3, t4, t5, tmp;
|
||||
|
||||
// t0 + t1*y = (z0 + z1*y)^2 = a^2
|
||||
tmp = z0 * z1;
|
||||
t0 = (z0 + z1) * (z0 + my_Fp6::non_residue * z1) - tmp - my_Fp6::non_residue * tmp;
|
||||
t1 = tmp + tmp;
|
||||
// t2 + t3*y = (z2 + z3*y)^2 = b^2
|
||||
tmp = z2 * z3;
|
||||
t2 = (z2 + z3) * (z2 + my_Fp6::non_residue * z3) - tmp - my_Fp6::non_residue * tmp;
|
||||
t3 = tmp + tmp;
|
||||
// t4 + t5*y = (z4 + z5*y)^2 = c^2
|
||||
tmp = z4 * z5;
|
||||
t4 = (z4 + z5) * (z4 + my_Fp6::non_residue * z5) - tmp - my_Fp6::non_residue * tmp;
|
||||
t5 = tmp + tmp;
|
||||
|
||||
// for A
|
||||
|
||||
// z0 = 3 * t0 - 2 * z0
|
||||
z0 = t0 - z0;
|
||||
z0 = z0 + z0;
|
||||
z0 = z0 + t0;
|
||||
// z1 = 3 * t1 + 2 * z1
|
||||
z1 = t1 + z1;
|
||||
z1 = z1 + z1;
|
||||
z1 = z1 + t1;
|
||||
|
||||
// for B
|
||||
|
||||
// z2 = 3 * (xi * t5) + 2 * z2
|
||||
tmp = my_Fp6::non_residue * t5;
|
||||
z2 = tmp + z2;
|
||||
z2 = z2 + z2;
|
||||
z2 = z2 + tmp;
|
||||
|
||||
// z3 = 3 * t4 - 2 * z3
|
||||
z3 = t4 - z3;
|
||||
z3 = z3 + z3;
|
||||
z3 = z3 + t4;
|
||||
|
||||
// for C
|
||||
|
||||
// z4 = 3 * t2 - 2 * z4
|
||||
z4 = t2 - z4;
|
||||
z4 = z4 + z4;
|
||||
z4 = z4 + t2;
|
||||
|
||||
// z5 = 3 * t3 + 2 * z5
|
||||
z5 = t3 + z5;
|
||||
z5 = z5 + z5;
|
||||
z5 = z5 + t3;
|
||||
|
||||
return Fp12_2over3over2_model<n,modulus>(my_Fp6(z0,z4,z3),my_Fp6(z2,z1,z5));
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::mul_by_024(const Fp2_model<n, modulus> &ell_0,
|
||||
const Fp2_model<n, modulus> &ell_VW,
|
||||
const Fp2_model<n, modulus> &ell_VV) const
|
||||
{
|
||||
/* OLD: naive implementation
|
||||
Fp12_2over3over2_model<n,modulus> a(my_Fp6(ell_0, my_Fp2::zero(), ell_VV),
|
||||
my_Fp6(my_Fp2::zero(), ell_VW, my_Fp2::zero()));
|
||||
|
||||
return (*this) * a;
|
||||
*/
|
||||
my_Fp2 z0 = this->c0.c0;
|
||||
my_Fp2 z1 = this->c0.c1;
|
||||
my_Fp2 z2 = this->c0.c2;
|
||||
my_Fp2 z3 = this->c1.c0;
|
||||
my_Fp2 z4 = this->c1.c1;
|
||||
my_Fp2 z5 = this->c1.c2;
|
||||
|
||||
my_Fp2 x0 = ell_0;
|
||||
my_Fp2 x2 = ell_VV;
|
||||
my_Fp2 x4 = ell_VW;
|
||||
|
||||
my_Fp2 t0, t1, t2, s0, T3, T4, D0, D2, D4, S1;
|
||||
|
||||
D0 = z0 * x0;
|
||||
D2 = z2 * x2;
|
||||
D4 = z4 * x4;
|
||||
t2 = z0 + z4;
|
||||
t1 = z0 + z2;
|
||||
s0 = z1 + z3 + z5;
|
||||
|
||||
// For z.a_.a_ = z0.
|
||||
S1 = z1 * x2;
|
||||
T3 = S1 + D4;
|
||||
T4 = my_Fp6::non_residue * T3 + D0;
|
||||
z0 = T4;
|
||||
|
||||
// For z.a_.b_ = z1
|
||||
T3 = z5 * x4;
|
||||
S1 = S1 + T3;
|
||||
T3 = T3 + D2;
|
||||
T4 = my_Fp6::non_residue * T3;
|
||||
T3 = z1 * x0;
|
||||
S1 = S1 + T3;
|
||||
T4 = T4 + T3;
|
||||
z1 = T4;
|
||||
|
||||
// For z.a_.c_ = z2
|
||||
t0 = x0 + x2;
|
||||
T3 = t1 * t0 - D0 - D2;
|
||||
T4 = z3 * x4;
|
||||
S1 = S1 + T4;
|
||||
T3 = T3 + T4;
|
||||
|
||||
// For z.b_.a_ = z3 (z3 needs z2)
|
||||
t0 = z2 + z4;
|
||||
z2 = T3;
|
||||
t1 = x2 + x4;
|
||||
T3 = t0 * t1 - D2 - D4;
|
||||
T4 = my_Fp6::non_residue * T3;
|
||||
T3 = z3 * x0;
|
||||
S1 = S1 + T3;
|
||||
T4 = T4 + T3;
|
||||
z3 = T4;
|
||||
|
||||
// For z.b_.b_ = z4
|
||||
T3 = z5 * x2;
|
||||
S1 = S1 + T3;
|
||||
T4 = my_Fp6::non_residue * T3;
|
||||
t0 = x0 + x4;
|
||||
T3 = t2 * t0 - D0 - D4;
|
||||
T4 = T4 + T3;
|
||||
z4 = T4;
|
||||
|
||||
// For z.b_.c_ = z5.
|
||||
t0 = x0 + x2 + x4;
|
||||
T3 = s0 * t0 - S1;
|
||||
z5 = T3;
|
||||
|
||||
return Fp12_2over3over2_model<n,modulus>(my_Fp6(z0,z1,z2),my_Fp6(z3,z4,z5));
|
||||
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
|
||||
Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const bigint<m> &exponent)
|
||||
{
|
||||
return power<Fp12_2over3over2_model<n, modulus> >(self, exponent);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& exp_modulus>
|
||||
Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const Fp_model<m, exp_modulus> &exponent)
|
||||
{
|
||||
return self^(exponent.as_bigint());
|
||||
}
|
||||
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
template<mp_size_t m>
|
||||
Fp12_2over3over2_model<n, modulus> Fp12_2over3over2_model<n,modulus>::cyclotomic_exp(const bigint<m> &exponent) const
|
||||
{
|
||||
Fp12_2over3over2_model<n,modulus> res = Fp12_2over3over2_model<n,modulus>::one();
|
||||
|
||||
bool found_one = false;
|
||||
for (long i = m-1; i >= 0; --i)
|
||||
{
|
||||
for (long j = GMP_NUMB_BITS - 1; j >= 0; --j)
|
||||
{
|
||||
if (found_one)
|
||||
{
|
||||
res = res.cyclotomic_squared();
|
||||
}
|
||||
|
||||
if (exponent.data[i] & (1ul<<j))
|
||||
{
|
||||
found_one = true;
|
||||
res = res * (*this);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &out, const Fp12_2over3over2_model<n, modulus> &el)
|
||||
{
|
||||
out << el.c0 << OUTPUT_SEPARATOR << el.c1;
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &in, Fp12_2over3over2_model<n, modulus> &el)
|
||||
{
|
||||
in >> el.c0 >> el.c1;
|
||||
return in;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp12_2over3over2_model<n, modulus> > &v)
|
||||
{
|
||||
out << v.size() << "\n";
|
||||
for (const Fp12_2over3over2_model<n, modulus>& t : v)
|
||||
{
|
||||
out << t << OUTPUT_NEWLINE;
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp12_2over3over2_model<n, modulus> > &v)
|
||||
{
|
||||
v.clear();
|
||||
|
||||
size_t s;
|
||||
in >> s;
|
||||
|
||||
char b;
|
||||
in.read(&b, 1);
|
||||
|
||||
v.reserve(s);
|
||||
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
Fp12_2over3over2_model<n, modulus> el;
|
||||
in >> el;
|
||||
v.emplace_back(el);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // FP12_2OVER3OVER2_TCC_
|
|
@ -0,0 +1,120 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of arithmetic in the finite field F[p^2].
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP2_HPP_
|
||||
#define FP2_HPP_
|
||||
#include "algebra/fields/fp.hpp"
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp2_model;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &, const Fp2_model<n, modulus> &);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &, Fp2_model<n, modulus> &);
|
||||
|
||||
/**
|
||||
* Arithmetic in the field F[p^3].
|
||||
*
|
||||
* Let p := modulus. This interface provides arithmetic for the extension field
|
||||
* Fp2 = Fp[U]/(U^2-non_residue), where non_residue is in Fp.
|
||||
*
|
||||
* ASSUMPTION: p = 1 (mod 6)
|
||||
*/
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp2_model {
|
||||
public:
|
||||
typedef Fp_model<n, modulus> my_Fp;
|
||||
|
||||
static bigint<2*n> euler; // (modulus^2-1)/2
|
||||
static size_t s; // modulus^2 = 2^s * t + 1
|
||||
static bigint<2*n> t; // with t odd
|
||||
static bigint<2*n> t_minus_1_over_2; // (t-1)/2
|
||||
static my_Fp non_residue; // X^4-non_residue irreducible over Fp; used for constructing Fp2 = Fp[X] / (X^2 - non_residue)
|
||||
static Fp2_model<n, modulus> nqr; // a quadratic nonresidue in Fp2
|
||||
static Fp2_model<n, modulus> nqr_to_t; // nqr^t
|
||||
static my_Fp Frobenius_coeffs_c1[2]; // non_residue^((modulus^i-1)/2) for i=0,1
|
||||
|
||||
my_Fp c0, c1;
|
||||
Fp2_model() {};
|
||||
Fp2_model(const my_Fp& c0, const my_Fp& c1) : c0(c0), c1(c1) {};
|
||||
|
||||
void clear() { c0.clear(); c1.clear(); }
|
||||
void print() const { printf("c0/c1:\n"); c0.print(); c1.print(); }
|
||||
|
||||
static Fp2_model<n, modulus> zero();
|
||||
static Fp2_model<n, modulus> one();
|
||||
static Fp2_model<n, modulus> random_element();
|
||||
|
||||
bool is_zero() const { return c0.is_zero() && c1.is_zero(); }
|
||||
bool operator==(const Fp2_model &other) const;
|
||||
bool operator!=(const Fp2_model &other) const;
|
||||
|
||||
Fp2_model operator+(const Fp2_model &other) const;
|
||||
Fp2_model operator-(const Fp2_model &other) const;
|
||||
Fp2_model operator*(const Fp2_model &other) const;
|
||||
Fp2_model operator-() const;
|
||||
Fp2_model squared() const; // default is squared_complex
|
||||
Fp2_model inverse() const;
|
||||
Fp2_model Frobenius_map(unsigned long power) const;
|
||||
Fp2_model sqrt() const; // HAS TO BE A SQUARE (else does not terminate)
|
||||
Fp2_model squared_karatsuba() const;
|
||||
Fp2_model squared_complex() const;
|
||||
|
||||
template<mp_size_t m>
|
||||
Fp2_model operator^(const bigint<m> &other) const;
|
||||
|
||||
static size_t size_in_bits() { return 2*my_Fp::size_in_bits(); }
|
||||
static bigint<n> base_field_char() { return modulus; }
|
||||
|
||||
friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp2_model<n, modulus> &el);
|
||||
friend std::istream& operator>> <n, modulus>(std::istream &in, Fp2_model<n, modulus> &el);
|
||||
};
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp2_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp2_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp2_model<n, modulus> &rhs);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<2*n> Fp2_model<n, modulus>::euler;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
size_t Fp2_model<n, modulus>::s;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<2*n> Fp2_model<n, modulus>::t;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<2*n> Fp2_model<n, modulus>::t_minus_1_over_2;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp2_model<n, modulus>::non_residue;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp2_model<n, modulus>::nqr;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp2_model<n, modulus>::nqr_to_t;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp2_model<n, modulus>::Frobenius_coeffs_c1[2];
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/fields/fp2.tcc"
|
||||
|
||||
#endif // FP2_HPP_
|
|
@ -0,0 +1,261 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of arithmetic in the finite field F[p^2].
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP2_TCC_
|
||||
#define FP2_TCC_
|
||||
|
||||
#include "algebra/fields/field_utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::zero()
|
||||
{
|
||||
return Fp2_model<n, modulus>(my_Fp::zero(), my_Fp::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::one()
|
||||
{
|
||||
return Fp2_model<n, modulus>(my_Fp::one(), my_Fp::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::random_element()
|
||||
{
|
||||
Fp2_model<n, modulus> r;
|
||||
r.c0 = my_Fp::random_element();
|
||||
r.c1 = my_Fp::random_element();
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp2_model<n,modulus>::operator==(const Fp2_model<n,modulus> &other) const
|
||||
{
|
||||
return (this->c0 == other.c0 && this->c1 == other.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp2_model<n,modulus>::operator!=(const Fp2_model<n,modulus> &other) const
|
||||
{
|
||||
return !(operator==(other));
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::operator+(const Fp2_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp2_model<n,modulus>(this->c0 + other.c0,
|
||||
this->c1 + other.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::operator-(const Fp2_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp2_model<n,modulus>(this->c0 - other.c0,
|
||||
this->c1 - other.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp2_model<n, modulus> &rhs)
|
||||
{
|
||||
return Fp2_model<n,modulus>(lhs*rhs.c0,
|
||||
lhs*rhs.c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::operator*(const Fp2_model<n,modulus> &other) const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
|
||||
const my_Fp
|
||||
&A = other.c0, &B = other.c1,
|
||||
&a = this->c0, &b = this->c1;
|
||||
const my_Fp aA = a * A;
|
||||
const my_Fp bB = b * B;
|
||||
|
||||
return Fp2_model<n,modulus>(aA + non_residue * bB,
|
||||
(a + b)*(A+B) - aA - bB);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::operator-() const
|
||||
{
|
||||
return Fp2_model<n,modulus>(-this->c0,
|
||||
-this->c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::squared() const
|
||||
{
|
||||
return squared_complex();
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::squared_karatsuba() const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba squaring) */
|
||||
const my_Fp &a = this->c0, &b = this->c1;
|
||||
const my_Fp asq = a.squared();
|
||||
const my_Fp bsq = b.squared();
|
||||
|
||||
return Fp2_model<n,modulus>(asq + non_residue * bsq,
|
||||
(a + b).squared() - asq - bsq);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::squared_complex() const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Complex squaring) */
|
||||
const my_Fp &a = this->c0, &b = this->c1;
|
||||
const my_Fp ab = a * b;
|
||||
|
||||
return Fp2_model<n,modulus>((a + b) * (a + non_residue * b) - ab - non_residue * ab,
|
||||
ab + ab);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::inverse() const
|
||||
{
|
||||
const my_Fp &a = this->c0, &b = this->c1;
|
||||
|
||||
/* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 8 */
|
||||
const my_Fp t0 = a.squared();
|
||||
const my_Fp t1 = b.squared();
|
||||
const my_Fp t2 = t0 - non_residue * t1;
|
||||
const my_Fp t3 = t2.inverse();
|
||||
const my_Fp c0 = a * t3;
|
||||
const my_Fp c1 = - (b * t3);
|
||||
|
||||
return Fp2_model<n,modulus>(c0, c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::Frobenius_map(unsigned long power) const
|
||||
{
|
||||
return Fp2_model<n,modulus>(c0,
|
||||
Frobenius_coeffs_c1[power % 2] * c1);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::sqrt() const
|
||||
{
|
||||
if (is_zero()) {
|
||||
return *this;
|
||||
}
|
||||
|
||||
Fp2_model<n,modulus> one = Fp2_model<n,modulus>::one();
|
||||
|
||||
size_t v = Fp2_model<n,modulus>::s;
|
||||
Fp2_model<n,modulus> z = Fp2_model<n,modulus>::nqr_to_t;
|
||||
Fp2_model<n,modulus> w = (*this)^Fp2_model<n,modulus>::t_minus_1_over_2;
|
||||
Fp2_model<n,modulus> x = (*this) * w;
|
||||
Fp2_model<n,modulus> b = x * w; // b = (*this)^t
|
||||
|
||||
|
||||
// check if square with euler's criterion
|
||||
Fp2_model<n,modulus> check = b;
|
||||
for (size_t i = 0; i < v-1; ++i)
|
||||
{
|
||||
check = check.squared();
|
||||
}
|
||||
if (check != one)
|
||||
{
|
||||
assert_except(0);
|
||||
}
|
||||
|
||||
|
||||
// compute square root with Tonelli--Shanks
|
||||
// (does not terminate if not a square!)
|
||||
|
||||
while (b != one)
|
||||
{
|
||||
size_t m = 0;
|
||||
Fp2_model<n,modulus> b2m = b;
|
||||
while (b2m != one)
|
||||
{
|
||||
/* invariant: b2m = b^(2^m) after entering this loop */
|
||||
b2m = b2m.squared();
|
||||
m += 1;
|
||||
}
|
||||
|
||||
int j = v-m-1;
|
||||
w = z;
|
||||
while (j > 0)
|
||||
{
|
||||
w = w.squared();
|
||||
--j;
|
||||
} // w = z^2^(v-m-1)
|
||||
|
||||
z = w.squared();
|
||||
b = b * z;
|
||||
x = x * w;
|
||||
v = m;
|
||||
}
|
||||
|
||||
return x;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
template<mp_size_t m>
|
||||
Fp2_model<n,modulus> Fp2_model<n,modulus>::operator^(const bigint<m> &pow) const
|
||||
{
|
||||
return power<Fp2_model<n, modulus>, m>(*this, pow);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &out, const Fp2_model<n, modulus> &el)
|
||||
{
|
||||
out << el.c0 << OUTPUT_SEPARATOR << el.c1;
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &in, Fp2_model<n, modulus> &el)
|
||||
{
|
||||
in >> el.c0 >> el.c1;
|
||||
return in;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp2_model<n, modulus> > &v)
|
||||
{
|
||||
out << v.size() << "\n";
|
||||
for (const Fp2_model<n, modulus>& t : v)
|
||||
{
|
||||
out << t << OUTPUT_NEWLINE;
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp2_model<n, modulus> > &v)
|
||||
{
|
||||
v.clear();
|
||||
|
||||
size_t s;
|
||||
in >> s;
|
||||
|
||||
char b;
|
||||
in.read(&b, 1);
|
||||
|
||||
v.reserve(s);
|
||||
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
Fp2_model<n, modulus> el;
|
||||
in >> el;
|
||||
v.emplace_back(el);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // FP2_TCC_
|
|
@ -0,0 +1,122 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Declaration of arithmetic in the finite field F[p^3].
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP3_HPP_
|
||||
#define FP3_HPP_
|
||||
#include "algebra/fields/fp.hpp"
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp3_model;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &, const Fp3_model<n, modulus> &);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &, Fp3_model<n, modulus> &);
|
||||
|
||||
/**
|
||||
* Arithmetic in the field F[p^3].
|
||||
*
|
||||
* Let p := modulus. This interface provides arithmetic for the extension field
|
||||
* Fp3 = Fp[U]/(U^3-non_residue), where non_residue is in Fp.
|
||||
*
|
||||
* ASSUMPTION: p = 1 (mod 6)
|
||||
*/
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp3_model {
|
||||
public:
|
||||
typedef Fp_model<n, modulus> my_Fp;
|
||||
|
||||
static bigint<3*n> euler; // (modulus^3-1)/2
|
||||
static size_t s; // modulus^3 = 2^s * t + 1
|
||||
static bigint<3*n> t; // with t odd
|
||||
static bigint<3*n> t_minus_1_over_2; // (t-1)/2
|
||||
static my_Fp non_residue; // X^6-non_residue irreducible over Fp; used for constructing Fp3 = Fp[X] / (X^3 - non_residue)
|
||||
static Fp3_model<n, modulus> nqr; // a quadratic nonresidue in Fp3
|
||||
static Fp3_model<n, modulus> nqr_to_t; // nqr^t
|
||||
static my_Fp Frobenius_coeffs_c1[3]; // non_residue^((modulus^i-1)/3) for i=0,1,2
|
||||
static my_Fp Frobenius_coeffs_c2[3]; // non_residue^((2*modulus^i-2)/3) for i=0,1,2
|
||||
|
||||
my_Fp c0, c1, c2;
|
||||
Fp3_model() {};
|
||||
Fp3_model(const my_Fp& c0, const my_Fp& c1, const my_Fp& c2) : c0(c0), c1(c1), c2(c2) {};
|
||||
|
||||
void clear() { c0.clear(); c1.clear(); c2.clear(); }
|
||||
void print() const { printf("c0/c1/c2:\n"); c0.print(); c1.print(); c2.print(); }
|
||||
|
||||
static Fp3_model<n, modulus> zero();
|
||||
static Fp3_model<n, modulus> one();
|
||||
static Fp3_model<n, modulus> random_element();
|
||||
|
||||
bool is_zero() const { return c0.is_zero() && c1.is_zero() && c2.is_zero(); }
|
||||
bool operator==(const Fp3_model &other) const;
|
||||
bool operator!=(const Fp3_model &other) const;
|
||||
|
||||
Fp3_model operator+(const Fp3_model &other) const;
|
||||
Fp3_model operator-(const Fp3_model &other) const;
|
||||
Fp3_model operator*(const Fp3_model &other) const;
|
||||
Fp3_model operator-() const;
|
||||
Fp3_model squared() const;
|
||||
Fp3_model inverse() const;
|
||||
Fp3_model Frobenius_map(unsigned long power) const;
|
||||
Fp3_model sqrt() const; // HAS TO BE A SQUARE (else does not terminate)
|
||||
|
||||
template<mp_size_t m>
|
||||
Fp3_model operator^(const bigint<m> &other) const;
|
||||
|
||||
static size_t size_in_bits() { return 3*my_Fp::size_in_bits(); }
|
||||
static bigint<n> base_field_char() { return modulus; }
|
||||
|
||||
friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp3_model<n, modulus> &el);
|
||||
friend std::istream& operator>> <n, modulus>(std::istream &in, Fp3_model<n, modulus> &el);
|
||||
};
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp3_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp3_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp3_model<n, modulus> &rhs);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<3*n> Fp3_model<n, modulus>::euler;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
size_t Fp3_model<n, modulus>::s;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<3*n> Fp3_model<n, modulus>::t;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bigint<3*n> Fp3_model<n, modulus>::t_minus_1_over_2;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp3_model<n, modulus>::non_residue;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n, modulus> Fp3_model<n, modulus>::nqr;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n, modulus> Fp3_model<n, modulus>::nqr_to_t;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp3_model<n, modulus>::Frobenius_coeffs_c1[3];
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp_model<n, modulus> Fp3_model<n, modulus>::Frobenius_coeffs_c2[3];
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/fields/fp3.tcc"
|
||||
|
||||
#endif // FP3_HPP_
|
|
@ -0,0 +1,259 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of arithmetic in the finite field F[p^3].
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP3_TCC_
|
||||
#define FP3_TCC_
|
||||
|
||||
#include "algebra/fields/field_utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::zero()
|
||||
{
|
||||
return Fp3_model<n, modulus>(my_Fp::zero(), my_Fp::zero(), my_Fp::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::one()
|
||||
{
|
||||
return Fp3_model<n, modulus>(my_Fp::one(), my_Fp::zero(), my_Fp::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::random_element()
|
||||
{
|
||||
Fp3_model<n, modulus> r;
|
||||
r.c0 = my_Fp::random_element();
|
||||
r.c1 = my_Fp::random_element();
|
||||
r.c2 = my_Fp::random_element();
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp3_model<n,modulus>::operator==(const Fp3_model<n,modulus> &other) const
|
||||
{
|
||||
return (this->c0 == other.c0 && this->c1 == other.c1 && this->c2 == other.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp3_model<n,modulus>::operator!=(const Fp3_model<n,modulus> &other) const
|
||||
{
|
||||
return !(operator==(other));
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::operator+(const Fp3_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp3_model<n,modulus>(this->c0 + other.c0,
|
||||
this->c1 + other.c1,
|
||||
this->c2 + other.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::operator-(const Fp3_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp3_model<n,modulus>(this->c0 - other.c0,
|
||||
this->c1 - other.c1,
|
||||
this->c2 - other.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp3_model<n, modulus> &rhs)
|
||||
{
|
||||
return Fp3_model<n,modulus>(lhs*rhs.c0,
|
||||
lhs*rhs.c1,
|
||||
lhs*rhs.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::operator*(const Fp3_model<n,modulus> &other) const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (Karatsuba) */
|
||||
const my_Fp
|
||||
&A = other.c0, &B = other.c1, &C = other.c2,
|
||||
&a = this->c0, &b = this->c1, &c = this->c2;
|
||||
const my_Fp aA = a*A;
|
||||
const my_Fp bB = b*B;
|
||||
const my_Fp cC = c*C;
|
||||
|
||||
return Fp3_model<n,modulus>(aA + non_residue*((b+c)*(B+C)-bB-cC),
|
||||
(a+b)*(A+B)-aA-bB+non_residue*cC,
|
||||
(a+c)*(A+C)-aA+bB-cC);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::operator-() const
|
||||
{
|
||||
return Fp3_model<n,modulus>(-this->c0,
|
||||
-this->c1,
|
||||
-this->c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::squared() const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (CH-SQR2) */
|
||||
const my_Fp
|
||||
&a = this->c0, &b = this->c1, &c = this->c2;
|
||||
const my_Fp s0 = a.squared();
|
||||
const my_Fp ab = a*b;
|
||||
const my_Fp s1 = ab + ab;
|
||||
const my_Fp s2 = (a - b + c).squared();
|
||||
const my_Fp bc = b*c;
|
||||
const my_Fp s3 = bc + bc;
|
||||
const my_Fp s4 = c.squared();
|
||||
|
||||
return Fp3_model<n,modulus>(s0 + non_residue * s3,
|
||||
s1 + non_residue * s4,
|
||||
s1 + s2 + s3 - s0 - s4);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::inverse() const
|
||||
{
|
||||
const my_Fp
|
||||
&a = this->c0, &b = this->c1, &c = this->c2;
|
||||
|
||||
/* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 17 */
|
||||
const my_Fp t0 = a.squared();
|
||||
const my_Fp t1 = b.squared();
|
||||
const my_Fp t2 = c.squared();
|
||||
const my_Fp t3 = a*b;
|
||||
const my_Fp t4 = a*c;
|
||||
const my_Fp t5 = b*c;
|
||||
const my_Fp c0 = t0 - non_residue * t5;
|
||||
const my_Fp c1 = non_residue * t2 - t3;
|
||||
const my_Fp c2 = t1 - t4; // typo in paper referenced above. should be "-" as per Scott, but is "*"
|
||||
const my_Fp t6 = (a * c0 + non_residue * (c * c1 + b * c2)).inverse();
|
||||
return Fp3_model<n,modulus>(t6 * c0, t6 * c1, t6 * c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::Frobenius_map(unsigned long power) const
|
||||
{
|
||||
return Fp3_model<n,modulus>(c0,
|
||||
Frobenius_coeffs_c1[power % 3] * c1,
|
||||
Frobenius_coeffs_c2[power % 3] * c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::sqrt() const
|
||||
{
|
||||
Fp3_model<n,modulus> one = Fp3_model<n,modulus>::one();
|
||||
|
||||
size_t v = Fp3_model<n,modulus>::s;
|
||||
Fp3_model<n,modulus> z = Fp3_model<n,modulus>::nqr_to_t;
|
||||
Fp3_model<n,modulus> w = (*this)^Fp3_model<n,modulus>::t_minus_1_over_2;
|
||||
Fp3_model<n,modulus> x = (*this) * w;
|
||||
Fp3_model<n,modulus> b = x * w; // b = (*this)^t
|
||||
|
||||
#if DEBUG
|
||||
// check if square with euler's criterion
|
||||
Fp3_model<n,modulus> check = b;
|
||||
for (size_t i = 0; i < v-1; ++i)
|
||||
{
|
||||
check = check.squared();
|
||||
}
|
||||
if (check != one)
|
||||
{
|
||||
assert(0);
|
||||
}
|
||||
#endif
|
||||
|
||||
// compute square root with Tonelli--Shanks
|
||||
// (does not terminate if not a square!)
|
||||
|
||||
while (b != one)
|
||||
{
|
||||
size_t m = 0;
|
||||
Fp3_model<n,modulus> b2m = b;
|
||||
while (b2m != one)
|
||||
{
|
||||
/* invariant: b2m = b^(2^m) after entering this loop */
|
||||
b2m = b2m.squared();
|
||||
m += 1;
|
||||
}
|
||||
|
||||
int j = v-m-1;
|
||||
w = z;
|
||||
while (j > 0)
|
||||
{
|
||||
w = w.squared();
|
||||
--j;
|
||||
} // w = z^2^(v-m-1)
|
||||
|
||||
z = w.squared();
|
||||
b = b * z;
|
||||
x = x * w;
|
||||
v = m;
|
||||
}
|
||||
|
||||
return x;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
template<mp_size_t m>
|
||||
Fp3_model<n,modulus> Fp3_model<n,modulus>::operator^(const bigint<m> &pow) const
|
||||
{
|
||||
return power<Fp3_model<n, modulus> >(*this, pow);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &out, const Fp3_model<n, modulus> &el)
|
||||
{
|
||||
out << el.c0 << OUTPUT_SEPARATOR << el.c1 << OUTPUT_SEPARATOR << el.c2;
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &in, Fp3_model<n, modulus> &el)
|
||||
{
|
||||
in >> el.c0 >> el.c1 >> el.c2;
|
||||
return in;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp3_model<n, modulus> > &v)
|
||||
{
|
||||
out << v.size() << "\n";
|
||||
for (const Fp3_model<n, modulus>& t : v)
|
||||
{
|
||||
out << t << OUTPUT_NEWLINE;
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp3_model<n, modulus> > &v)
|
||||
{
|
||||
v.clear();
|
||||
|
||||
size_t s;
|
||||
in >> s;
|
||||
|
||||
char b;
|
||||
in.read(&b, 1);
|
||||
|
||||
v.reserve(s);
|
||||
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
Fp3_model<n, modulus> el;
|
||||
in >> el;
|
||||
v.emplace_back(el);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // FP3_TCC_
|
|
@ -0,0 +1,104 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Declaration of arithmetic in the finite field F[(p^2)^3]
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP6_3OVER2_HPP_
|
||||
#define FP6_3OVER2_HPP_
|
||||
#include "algebra/fields/fp.hpp"
|
||||
#include "algebra/fields/fp2.hpp"
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp6_3over2_model;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &, const Fp6_3over2_model<n, modulus> &);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &, Fp6_3over2_model<n, modulus> &);
|
||||
|
||||
/**
|
||||
* Arithmetic in the finite field F[(p^2)^3].
|
||||
*
|
||||
* Let p := modulus. This interface provides arithmetic for the extension field
|
||||
* Fp6 = Fp2[V]/(V^3-non_residue) where non_residue is in Fp.
|
||||
*
|
||||
* ASSUMPTION: p = 1 (mod 6)
|
||||
*/
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
class Fp6_3over2_model {
|
||||
public:
|
||||
typedef Fp_model<n, modulus> my_Fp;
|
||||
typedef Fp2_model<n, modulus> my_Fp2;
|
||||
|
||||
static my_Fp2 non_residue;
|
||||
static my_Fp2 Frobenius_coeffs_c1[6]; // non_residue^((modulus^i-1)/3) for i=0,1,2,3,4,5
|
||||
static my_Fp2 Frobenius_coeffs_c2[6]; // non_residue^((2*modulus^i-2)/3) for i=0,1,2,3,4,5
|
||||
|
||||
my_Fp2 c0, c1, c2;
|
||||
Fp6_3over2_model() {};
|
||||
Fp6_3over2_model(const my_Fp2& c0, const my_Fp2& c1, const my_Fp2& c2) : c0(c0), c1(c1), c2(c2) {};
|
||||
|
||||
void clear() { c0.clear(); c1.clear(); c2.clear(); }
|
||||
void print() const { printf("c0/c1/c2:\n"); c0.print(); c1.print(); c2.print(); }
|
||||
|
||||
static Fp6_3over2_model<n, modulus> zero();
|
||||
static Fp6_3over2_model<n, modulus> one();
|
||||
static Fp6_3over2_model<n, modulus> random_element();
|
||||
|
||||
bool is_zero() const { return c0.is_zero() && c1.is_zero() && c2.is_zero(); }
|
||||
bool operator==(const Fp6_3over2_model &other) const;
|
||||
bool operator!=(const Fp6_3over2_model &other) const;
|
||||
|
||||
Fp6_3over2_model operator+(const Fp6_3over2_model &other) const;
|
||||
Fp6_3over2_model operator-(const Fp6_3over2_model &other) const;
|
||||
Fp6_3over2_model operator*(const Fp6_3over2_model &other) const;
|
||||
Fp6_3over2_model operator-() const;
|
||||
Fp6_3over2_model squared() const;
|
||||
Fp6_3over2_model inverse() const;
|
||||
Fp6_3over2_model Frobenius_map(unsigned long power) const;
|
||||
|
||||
static my_Fp2 mul_by_non_residue(const my_Fp2 &elt);
|
||||
|
||||
template<mp_size_t m>
|
||||
Fp6_3over2_model operator^(const bigint<m> &other) const;
|
||||
|
||||
static bigint<n> base_field_char() { return modulus; }
|
||||
static size_t extension_degree() { return 6; }
|
||||
|
||||
friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp6_3over2_model<n, modulus> &el);
|
||||
friend std::istream& operator>> <n, modulus>(std::istream &in, Fp6_3over2_model<n, modulus> &el);
|
||||
};
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp6_3over2_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp6_3over2_model<n, modulus> > &v);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs);
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp6_3over2_model<n, modulus>::non_residue;
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp6_3over2_model<n, modulus>::Frobenius_coeffs_c1[6];
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp6_3over2_model<n, modulus>::Frobenius_coeffs_c2[6];
|
||||
|
||||
} // libsnark
|
||||
#include "algebra/fields/fp6_3over2.tcc"
|
||||
|
||||
#endif // FP6_3OVER2_HPP_
|
|
@ -0,0 +1,216 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of arithmetic in the finite field F[(p^2)^3].
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP6_3OVER2_TCC_
|
||||
#define FP6_3OVER2_TCC_
|
||||
#include "algebra/fields/field_utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp2_model<n, modulus> Fp6_3over2_model<n,modulus>::mul_by_non_residue(const Fp2_model<n, modulus> &elt)
|
||||
{
|
||||
return Fp2_model<n, modulus>(non_residue * elt);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::zero()
|
||||
{
|
||||
return Fp6_3over2_model<n, modulus>(my_Fp2::zero(), my_Fp2::zero(), my_Fp2::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::one()
|
||||
{
|
||||
return Fp6_3over2_model<n, modulus>(my_Fp2::one(), my_Fp2::zero(), my_Fp2::zero());
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::random_element()
|
||||
{
|
||||
Fp6_3over2_model<n, modulus> r;
|
||||
r.c0 = my_Fp2::random_element();
|
||||
r.c1 = my_Fp2::random_element();
|
||||
r.c2 = my_Fp2::random_element();
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp6_3over2_model<n,modulus>::operator==(const Fp6_3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return (this->c0 == other.c0 && this->c1 == other.c1 && this->c2 == other.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
bool Fp6_3over2_model<n,modulus>::operator!=(const Fp6_3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return !(operator==(other));
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator+(const Fp6_3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp6_3over2_model<n,modulus>(this->c0 + other.c0,
|
||||
this->c1 + other.c1,
|
||||
this->c2 + other.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator-(const Fp6_3over2_model<n,modulus> &other) const
|
||||
{
|
||||
return Fp6_3over2_model<n,modulus>(this->c0 - other.c0,
|
||||
this->c1 - other.c1,
|
||||
this->c2 - other.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs)
|
||||
{
|
||||
return Fp6_3over2_model<n,modulus>(lhs*rhs.c0,
|
||||
lhs*rhs.c1,
|
||||
lhs*rhs.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs)
|
||||
{
|
||||
return Fp6_3over2_model<n,modulus>(lhs*rhs.c0,
|
||||
lhs*rhs.c1,
|
||||
lhs*rhs.c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator*(const Fp6_3over2_model<n,modulus> &other) const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (Karatsuba) */
|
||||
|
||||
const my_Fp2 &A = other.c0, &B = other.c1, &C = other.c2,
|
||||
&a = this->c0, &b = this->c1, &c = this->c2;
|
||||
const my_Fp2 aA = a*A;
|
||||
const my_Fp2 bB = b*B;
|
||||
const my_Fp2 cC = c*C;
|
||||
|
||||
return Fp6_3over2_model<n,modulus>(aA + Fp6_3over2_model<n,modulus>::mul_by_non_residue((b+c)*(B+C)-bB-cC),
|
||||
(a+b)*(A+B)-aA-bB+Fp6_3over2_model<n,modulus>::mul_by_non_residue(cC),
|
||||
(a+c)*(A+C)-aA+bB-cC);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator-() const
|
||||
{
|
||||
return Fp6_3over2_model<n,modulus>(-this->c0,
|
||||
-this->c1,
|
||||
-this->c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::squared() const
|
||||
{
|
||||
/* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (CH-SQR2) */
|
||||
|
||||
const my_Fp2 &a = this->c0, &b = this->c1, &c = this->c2;
|
||||
const my_Fp2 s0 = a.squared();
|
||||
const my_Fp2 ab = a*b;
|
||||
const my_Fp2 s1 = ab + ab;
|
||||
const my_Fp2 s2 = (a - b + c).squared();
|
||||
const my_Fp2 bc = b*c;
|
||||
const my_Fp2 s3 = bc + bc;
|
||||
const my_Fp2 s4 = c.squared();
|
||||
|
||||
return Fp6_3over2_model<n,modulus>(s0 + Fp6_3over2_model<n,modulus>::mul_by_non_residue(s3),
|
||||
s1 + Fp6_3over2_model<n,modulus>::mul_by_non_residue(s4),
|
||||
s1 + s2 + s3 - s0 - s4);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::inverse() const
|
||||
{
|
||||
/* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 17 */
|
||||
|
||||
const my_Fp2 &a = this->c0, &b = this->c1, &c = this->c2;
|
||||
const my_Fp2 t0 = a.squared();
|
||||
const my_Fp2 t1 = b.squared();
|
||||
const my_Fp2 t2 = c.squared();
|
||||
const my_Fp2 t3 = a*b;
|
||||
const my_Fp2 t4 = a*c;
|
||||
const my_Fp2 t5 = b*c;
|
||||
const my_Fp2 c0 = t0 - Fp6_3over2_model<n,modulus>::mul_by_non_residue(t5);
|
||||
const my_Fp2 c1 = Fp6_3over2_model<n,modulus>::mul_by_non_residue(t2) - t3;
|
||||
const my_Fp2 c2 = t1 - t4; // typo in paper referenced above. should be "-" as per Scott, but is "*"
|
||||
const my_Fp2 t6 = (a * c0 + Fp6_3over2_model<n,modulus>::mul_by_non_residue((c * c1 + b * c2))).inverse();
|
||||
return Fp6_3over2_model<n,modulus>(t6 * c0, t6 * c1, t6 * c2);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::Frobenius_map(unsigned long power) const
|
||||
{
|
||||
return Fp6_3over2_model<n,modulus>(c0.Frobenius_map(power),
|
||||
Frobenius_coeffs_c1[power % 6] * c1.Frobenius_map(power),
|
||||
Frobenius_coeffs_c2[power % 6] * c2.Frobenius_map(power));
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
template<mp_size_t m>
|
||||
Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator^(const bigint<m> &pow) const
|
||||
{
|
||||
return power<Fp6_3over2_model<n, modulus>, m>(*this, pow);
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream &out, const Fp6_3over2_model<n, modulus> &el)
|
||||
{
|
||||
out << el.c0 << OUTPUT_SEPARATOR << el.c1 << OUTPUT_SEPARATOR << el.c2;
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream &in, Fp6_3over2_model<n, modulus> &el)
|
||||
{
|
||||
in >> el.c0 >> el.c1 >> el.c2;
|
||||
return in;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<Fp6_3over2_model<n, modulus> > &v)
|
||||
{
|
||||
out << v.size() << "\n";
|
||||
for (const Fp6_3over2_model<n, modulus>& t : v)
|
||||
{
|
||||
out << t << OUTPUT_NEWLINE;
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<mp_size_t n, const bigint<n>& modulus>
|
||||
std::istream& operator>>(std::istream& in, std::vector<Fp6_3over2_model<n, modulus> > &v)
|
||||
{
|
||||
v.clear();
|
||||
|
||||
size_t s;
|
||||
in >> s;
|
||||
|
||||
char b;
|
||||
in.read(&b, 1);
|
||||
|
||||
v.reserve(s);
|
||||
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
Fp6_3over2_model<n, modulus> el;
|
||||
in >> el;
|
||||
v.emplace_back(el);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // FP6_3_OVER_2_TCC_
|
|
@ -0,0 +1,389 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Assembly code snippets for F[p] finite field arithmetic, used by fp.tcc .
|
||||
Specific to x86-64, and used only if USE_ASM is defined.
|
||||
On other architectures or without USE_ASM, fp.tcc uses a portable
|
||||
C++ implementation instead.
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef FP_AUX_TCC_
|
||||
#define FP_AUX_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
#define STR_HELPER(x) #x
|
||||
#define STR(x) STR_HELPER(x)
|
||||
|
||||
/* addq is faster than adcq, even if preceded by clc */
|
||||
#define ADD_FIRSTADD \
|
||||
"movq (%[B]), %%rax \n\t" \
|
||||
"addq %%rax, (%[A]) \n\t"
|
||||
|
||||
#define ADD_NEXTADD(ofs) \
|
||||
"movq " STR(ofs) "(%[B]), %%rax \n\t" \
|
||||
"adcq %%rax, " STR(ofs) "(%[A]) \n\t"
|
||||
|
||||
#define ADD_CMP(ofs) \
|
||||
"movq " STR(ofs) "(%[mod]), %%rax \n\t" \
|
||||
"cmpq %%rax, " STR(ofs) "(%[A]) \n\t" \
|
||||
"jb done%= \n\t" \
|
||||
"ja subtract%= \n\t"
|
||||
|
||||
#define ADD_FIRSTSUB \
|
||||
"movq (%[mod]), %%rax \n\t" \
|
||||
"subq %%rax, (%[A]) \n\t"
|
||||
|
||||
#define ADD_FIRSTSUB \
|
||||
"movq (%[mod]), %%rax \n\t" \
|
||||
"subq %%rax, (%[A]) \n\t"
|
||||
|
||||
#define ADD_NEXTSUB(ofs) \
|
||||
"movq " STR(ofs) "(%[mod]), %%rax \n\t" \
|
||||
"sbbq %%rax, " STR(ofs) "(%[A]) \n\t"
|
||||
|
||||
#define SUB_FIRSTSUB \
|
||||
"movq (%[B]), %%rax\n\t" \
|
||||
"subq %%rax, (%[A])\n\t"
|
||||
|
||||
#define SUB_NEXTSUB(ofs) \
|
||||
"movq " STR(ofs) "(%[B]), %%rax\n\t" \
|
||||
"sbbq %%rax, " STR(ofs) "(%[A])\n\t"
|
||||
|
||||
#define SUB_FIRSTADD \
|
||||
"movq (%[mod]), %%rax\n\t" \
|
||||
"addq %%rax, (%[A])\n\t"
|
||||
|
||||
#define SUB_NEXTADD(ofs) \
|
||||
"movq " STR(ofs) "(%[mod]), %%rax\n\t" \
|
||||
"adcq %%rax, " STR(ofs) "(%[A])\n\t"
|
||||
|
||||
#define MONT_CMP(ofs) \
|
||||
"movq " STR(ofs) "(%[M]), %%rax \n\t" \
|
||||
"cmpq %%rax, " STR(ofs) "(%[tmp]) \n\t" \
|
||||
"jb done%= \n\t" \
|
||||
"ja subtract%= \n\t"
|
||||
|
||||
#define MONT_FIRSTSUB \
|
||||
"movq (%[M]), %%rax \n\t" \
|
||||
"subq %%rax, (%[tmp]) \n\t"
|
||||
|
||||
#define MONT_NEXTSUB(ofs) \
|
||||
"movq " STR(ofs) "(%[M]), %%rax \n\t" \
|
||||
"sbbq %%rax, " STR(ofs) "(%[tmp]) \n\t"
|
||||
|
||||
/*
|
||||
The x86-64 Montgomery multiplication here is similar
|
||||
to Algorithm 2 (CIOS method) in http://eprint.iacr.org/2012/140.pdf
|
||||
and the PowerPC pseudocode of gmp-ecm library (c) Paul Zimmermann and Alexander Kruppa
|
||||
(see comments on top of powerpc64/mulredc.m4).
|
||||
*/
|
||||
|
||||
#define MONT_PRECOMPUTE \
|
||||
"xorq %[cy], %[cy] \n\t" \
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"mulq 0(%[B]) \n\t" \
|
||||
"movq %%rax, %[T0] \n\t" \
|
||||
"movq %%rdx, %[T1] # T1:T0 <- A[0] * B[0] \n\t" \
|
||||
"mulq %[inv] \n\t" \
|
||||
"movq %%rax, %[u] # u <- T0 * inv \n\t" \
|
||||
"mulq 0(%[M]) \n\t" \
|
||||
"addq %[T0], %%rax \n\t" \
|
||||
"adcq %%rdx, %[T1] \n\t" \
|
||||
"adcq $0, %[cy] # cy:T1 <- (M[0]*u + T1 * b + T0) / b\n\t"
|
||||
|
||||
#define MONT_FIRSTITER(j) \
|
||||
"xorq %[T0], %[T0] \n\t" \
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"mulq " STR((j*8)) "(%[B]) \n\t" \
|
||||
"addq %[T1], %%rax \n\t" \
|
||||
"movq %%rax, " STR(((j-1)*8)) "(%[tmp]) \n\t" \
|
||||
"adcq $0, %%rdx \n\t" \
|
||||
"movq %%rdx, %[T1] # now T1:tmp[j-1] <-- X[0] * Y[j] + T1\n\t" \
|
||||
"movq " STR((j*8)) "(%[M]), %%rax \n\t" \
|
||||
"mulq %[u] \n\t" \
|
||||
"addq %%rax, " STR(((j-1)*8)) "(%[tmp]) \n\t" \
|
||||
"adcq %[cy], %%rdx \n\t" \
|
||||
"adcq $0, %[T0] \n\t" \
|
||||
"xorq %[cy], %[cy] \n\t" \
|
||||
"addq %%rdx, %[T1] \n\t" \
|
||||
"adcq %[T0], %[cy] # cy:T1:tmp[j-1] <---- (X[0] * Y[j] + T1) + (M[j] * u + cy * b) \n\t"
|
||||
|
||||
#define MONT_ITERFIRST(i) \
|
||||
"xorq %[cy], %[cy] \n\t" \
|
||||
"movq " STR((i*8)) "(%[A]), %%rax \n\t" \
|
||||
"mulq 0(%[B]) \n\t" \
|
||||
"addq 0(%[tmp]), %%rax \n\t" \
|
||||
"adcq 8(%[tmp]), %%rdx \n\t" \
|
||||
"adcq $0, %[cy] \n\t" \
|
||||
"movq %%rax, %[T0] \n\t" \
|
||||
"movq %%rdx, %[T1] # cy:T1:T0 <- A[i] * B[0] + tmp[1] * b + tmp[0]\n\t" \
|
||||
"mulq %[inv] \n\t" \
|
||||
"movq %%rax, %[u] # u <- T0 * inv\n\t" \
|
||||
"mulq 0(%[M]) \n\t" \
|
||||
"addq %[T0], %%rax \n\t" \
|
||||
"adcq %%rdx, %[T1] \n\t" \
|
||||
"adcq $0, %[cy] # cy:T1 <- (M[0]*u + cy * b * b + T1 * b + T0) / b\n\t"
|
||||
|
||||
#define MONT_ITERITER(i, j) \
|
||||
"xorq %[T0], %[T0] \n\t" \
|
||||
"movq " STR((i*8)) "(%[A]), %%rax \n\t" \
|
||||
"mulq " STR((j*8)) "(%[B]) \n\t" \
|
||||
"addq %[T1], %%rax \n\t" \
|
||||
"movq %%rax, " STR(((j-1)*8)) "(%[tmp]) \n\t" \
|
||||
"adcq $0, %%rdx \n\t" \
|
||||
"movq %%rdx, %[T1] # now T1:tmp[j-1] <-- X[i] * Y[j] + T1 \n\t" \
|
||||
"movq " STR((j*8)) "(%[M]), %%rax \n\t" \
|
||||
"mulq %[u] \n\t" \
|
||||
"addq %%rax, " STR(((j-1)*8)) "(%[tmp]) \n\t" \
|
||||
"adcq %[cy], %%rdx \n\t" \
|
||||
"adcq $0, %[T0] \n\t" \
|
||||
"xorq %[cy], %[cy] \n\t" \
|
||||
"addq %%rdx, %[T1] \n\t" \
|
||||
"adcq %[T0], %[cy] # cy:T1:tmp[j-1] <-- (X[i] * Y[j] + T1) + M[j] * u + cy * b \n\t" \
|
||||
"addq " STR(((j+1)*8)) "(%[tmp]), %[T1] \n\t" \
|
||||
"adcq $0, %[cy] # cy:T1:tmp[j-1] <-- (X[i] * Y[j] + T1) + M[j] * u + (tmp[j+1] + cy) * b \n\t"
|
||||
|
||||
#define MONT_FINALIZE(j) \
|
||||
"movq %[T1], " STR((j*8)) "(%[tmp]) \n\t" \
|
||||
"movq %[cy], " STR(((j+1)*8)) "(%[tmp]) \n\t"
|
||||
|
||||
/*
|
||||
Comba multiplication and squaring routines are based on the
|
||||
public-domain tomsfastmath library by Tom St Denis
|
||||
<http://www.libtom.org/>
|
||||
<https://github.com/libtom/tomsfastmath/blob/master/src/sqr/fp_sqr_comba.c
|
||||
<https://github.com/libtom/tomsfastmath/blob/master/src/mul/fp_mul_comba.c>
|
||||
|
||||
Compared to the above, we save 5-20% of cycles by using careful register
|
||||
renaming to implement Comba forward operation.
|
||||
*/
|
||||
|
||||
#define COMBA_3_BY_3_MUL(c0_, c1_, c2_, res_, A_, B_) \
|
||||
asm volatile ( \
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"mulq 0(%[B]) \n\t" \
|
||||
"movq %%rax, 0(%[res]) \n\t" \
|
||||
"movq %%rdx, %[c0] \n\t" \
|
||||
\
|
||||
"xorq %[c1], %[c1] \n\t" \
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"mulq 8(%[B]) \n\t" \
|
||||
"addq %%rax, %[c0] \n\t" \
|
||||
"adcq %%rdx, %[c1] \n\t" \
|
||||
\
|
||||
"xorq %[c2], %[c2] \n\t" \
|
||||
"movq 8(%[A]), %%rax \n\t" \
|
||||
"mulq 0(%[B]) \n\t" \
|
||||
"addq %%rax, %[c0] \n\t" \
|
||||
"movq %[c0], 8(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c1] \n\t" \
|
||||
"adcq $0, %[c2] \n\t" \
|
||||
\
|
||||
"// register renaming (c1, c2, c0)\n\t" \
|
||||
"xorq %[c0], %[c0] \n\t" \
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"mulq 16(%[B]) \n\t" \
|
||||
"addq %%rax, %[c1] \n\t" \
|
||||
"adcq %%rdx, %[c2] \n\t" \
|
||||
"adcq $0, %[c0] \n\t" \
|
||||
\
|
||||
"movq 8(%[A]), %%rax \n\t" \
|
||||
"mulq 8(%[B]) \n\t" \
|
||||
"addq %%rax, %[c1] \n\t" \
|
||||
"adcq %%rdx, %[c2] \n\t" \
|
||||
"adcq $0, %[c0] \n\t" \
|
||||
\
|
||||
"movq 16(%[A]), %%rax \n\t" \
|
||||
"mulq 0(%[B]) \n\t" \
|
||||
"addq %%rax, %[c1] \n\t" \
|
||||
"movq %[c1], 16(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c2] \n\t" \
|
||||
"adcq $0, %[c0] \n\t" \
|
||||
\
|
||||
"// register renaming (c2, c0, c1)\n\t" \
|
||||
"xorq %[c1], %[c1] \n\t" \
|
||||
"movq 8(%[A]), %%rax \n\t" \
|
||||
"mulq 16(%[B]) \n\t" \
|
||||
"addq %%rax, %[c2] \n\t" \
|
||||
"adcq %%rdx, %[c0] \n\t" \
|
||||
"adcq $0, %[c1] \n\t" \
|
||||
\
|
||||
"movq 16(%[A]), %%rax \n\t" \
|
||||
"mulq 8(%[B]) \n\t" \
|
||||
"addq %%rax, %[c2] \n\t" \
|
||||
"movq %[c2], 24(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c0] \n\t" \
|
||||
"adcq $0, %[c1] \n\t" \
|
||||
\
|
||||
"// register renaming (c0, c1, c2)\n\t" \
|
||||
"xorq %[c2], %[c2] \n\t" \
|
||||
"movq 16(%[A]), %%rax \n\t" \
|
||||
"mulq 16(%[B]) \n\t" \
|
||||
"addq %%rax, %[c0] \n\t" \
|
||||
"movq %[c0], 32(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c1] \n\t" \
|
||||
"movq %[c1], 40(%[res]) \n\t" \
|
||||
: [c0] "=&r" (c0_), [c1] "=&r" (c1_), [c2] "=&r" (c2_) \
|
||||
: [res] "r" (res_), [A] "r" (A_), [B] "r" (B_) \
|
||||
: "%rax", "%rdx", "cc", "memory")
|
||||
|
||||
#define COMBA_3_BY_3_SQR(c0_, c1_, c2_, res_, A_) \
|
||||
asm volatile ( \
|
||||
"xorq %[c1], %[c1] \n\t" \
|
||||
"xorq %[c2], %[c2] \n\t" \
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"mulq %%rax \n\t" \
|
||||
"movq %%rax, 0(%[res]) \n\t" \
|
||||
"movq %%rdx, %[c0] \n\t" \
|
||||
\
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"mulq 8(%[A]) \n\t" \
|
||||
"addq %%rax, %[c0] \n\t" \
|
||||
"adcq %%rdx, %[c1] \n\t" \
|
||||
"addq %%rax, %[c0] \n\t" \
|
||||
"movq %[c0], 8(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c1] \n\t" \
|
||||
"adcq $0, %[c2] \n\t" \
|
||||
\
|
||||
"// register renaming (c1, c2, c0)\n\t" \
|
||||
"movq 0(%[A]), %%rax \n\t" \
|
||||
"xorq %[c0], %[c0] \n\t" \
|
||||
"mulq 16(%[A]) \n\t" \
|
||||
"addq %%rax, %[c1] \n\t" \
|
||||
"adcq %%rdx, %[c2] \n\t" \
|
||||
"adcq $0, %[c0] \n\t" \
|
||||
"addq %%rax, %[c1] \n\t" \
|
||||
"adcq %%rdx, %[c2] \n\t" \
|
||||
"adcq $0, %[c0] \n\t" \
|
||||
\
|
||||
"movq 8(%[A]), %%rax \n\t" \
|
||||
"mulq %%rax \n\t" \
|
||||
"addq %%rax, %[c1] \n\t" \
|
||||
"movq %[c1], 16(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c2] \n\t" \
|
||||
"adcq $0, %[c0] \n\t" \
|
||||
\
|
||||
"// register renaming (c2, c0, c1)\n\t" \
|
||||
"movq 8(%[A]), %%rax \n\t" \
|
||||
"xorq %[c1], %[c1] \n\t" \
|
||||
"mulq 16(%[A]) \n\t" \
|
||||
"addq %%rax, %[c2] \n\t" \
|
||||
"adcq %%rdx, %[c0] \n\t" \
|
||||
"adcq $0, %[c1] \n\t" \
|
||||
"addq %%rax, %[c2] \n\t" \
|
||||
"movq %[c2], 24(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c0] \n\t" \
|
||||
"adcq $0, %[c1] \n\t" \
|
||||
\
|
||||
"// register renaming (c0, c1, c2)\n\t" \
|
||||
"movq 16(%[A]), %%rax \n\t" \
|
||||
"mulq %%rax \n\t" \
|
||||
"addq %%rax, %[c0] \n\t" \
|
||||
"movq %[c0], 32(%[res]) \n\t" \
|
||||
"adcq %%rdx, %[c1] \n\t" \
|
||||
"movq %[c1], 40(%[res]) \n\t" \
|
||||
\
|
||||
: [c0] "=&r" (c0_), [c1] "=&r" (c1_), [c2] "=&r" (c2_) \
|
||||
: [res] "r" (res_), [A] "r" (A_) \
|
||||
: "%rax", "%rdx", "cc", "memory")
|
||||
|
||||
/*
|
||||
The Montgomery reduction here is based on Algorithm 14.32 in
|
||||
Handbook of Applied Cryptography
|
||||
<http://cacr.uwaterloo.ca/hac/about/chap14.pdf>.
|
||||
*/
|
||||
#define REDUCE_6_LIMB_PRODUCT(k_, tmp1_, tmp2_, tmp3_, inv_, res_, mod_) \
|
||||
__asm__ volatile \
|
||||
("///////////////////////////////////\n\t" \
|
||||
"movq 0(%[res]), %%rax \n\t" \
|
||||
"mulq %[modprime] \n\t" \
|
||||
"movq %%rax, %[k] \n\t" \
|
||||
\
|
||||
"movq (%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"movq %%rax, %[tmp1] \n\t" \
|
||||
"movq %%rdx, %[tmp2] \n\t" \
|
||||
\
|
||||
"xorq %[tmp3], %[tmp3] \n\t" \
|
||||
"movq 8(%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"addq %[tmp1], 0(%[res]) \n\t" \
|
||||
"adcq %%rax, %[tmp2] \n\t" \
|
||||
"adcq %%rdx, %[tmp3] \n\t" \
|
||||
\
|
||||
"xorq %[tmp1], %[tmp1] \n\t" \
|
||||
"movq 16(%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"addq %[tmp2], 8(%[res]) \n\t" \
|
||||
"adcq %%rax, %[tmp3] \n\t" \
|
||||
"adcq %%rdx, %[tmp1] \n\t" \
|
||||
\
|
||||
"addq %[tmp3], 16(%[res]) \n\t" \
|
||||
"adcq %[tmp1], 24(%[res]) \n\t" \
|
||||
"adcq $0, 32(%[res]) \n\t" \
|
||||
"adcq $0, 40(%[res]) \n\t" \
|
||||
\
|
||||
"///////////////////////////////////\n\t" \
|
||||
"movq 8(%[res]), %%rax \n\t" \
|
||||
"mulq %[modprime] \n\t" \
|
||||
"movq %%rax, %[k] \n\t" \
|
||||
\
|
||||
"movq (%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"movq %%rax, %[tmp1] \n\t" \
|
||||
"movq %%rdx, %[tmp2] \n\t" \
|
||||
\
|
||||
"xorq %[tmp3], %[tmp3] \n\t" \
|
||||
"movq 8(%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"addq %[tmp1], 8(%[res]) \n\t" \
|
||||
"adcq %%rax, %[tmp2] \n\t" \
|
||||
"adcq %%rdx, %[tmp3] \n\t" \
|
||||
\
|
||||
"xorq %[tmp1], %[tmp1] \n\t" \
|
||||
"movq 16(%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"addq %[tmp2], 16(%[res]) \n\t" \
|
||||
"adcq %%rax, %[tmp3] \n\t" \
|
||||
"adcq %%rdx, %[tmp1] \n\t" \
|
||||
\
|
||||
"addq %[tmp3], 24(%[res]) \n\t" \
|
||||
"adcq %[tmp1], 32(%[res]) \n\t" \
|
||||
"adcq $0, 40(%[res]) \n\t" \
|
||||
\
|
||||
"///////////////////////////////////\n\t" \
|
||||
"movq 16(%[res]), %%rax \n\t" \
|
||||
"mulq %[modprime] \n\t" \
|
||||
"movq %%rax, %[k] \n\t" \
|
||||
\
|
||||
"movq (%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"movq %%rax, %[tmp1] \n\t" \
|
||||
"movq %%rdx, %[tmp2] \n\t" \
|
||||
\
|
||||
"xorq %[tmp3], %[tmp3] \n\t" \
|
||||
"movq 8(%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"addq %[tmp1], 16(%[res]) \n\t" \
|
||||
"adcq %%rax, %[tmp2] \n\t" \
|
||||
"adcq %%rdx, %[tmp3] \n\t" \
|
||||
\
|
||||
"xorq %[tmp1], %[tmp1] \n\t" \
|
||||
"movq 16(%[mod]), %%rax \n\t" \
|
||||
"mulq %[k] \n\t" \
|
||||
"addq %[tmp2], 24(%[res]) \n\t" \
|
||||
"adcq %%rax, %[tmp3] \n\t" \
|
||||
"adcq %%rdx, %[tmp1] \n\t" \
|
||||
\
|
||||
"addq %[tmp3], 32(%[res]) \n\t" \
|
||||
"adcq %[tmp1], 40(%[res]) \n\t" \
|
||||
: [k] "=&r" (k_), [tmp1] "=&r" (tmp1_), [tmp2] "=&r" (tmp2_), [tmp3] "=&r" (tmp3_) \
|
||||
: [modprime] "r" (inv_), [res] "r" (res_), [mod] "r" (mod_) \
|
||||
: "%rax", "%rdx", "cc", "memory")
|
||||
|
||||
} // libsnark
|
||||
#endif // FP_AUX_TCC_
|
|
@ -0,0 +1,107 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "algebra/fields/bigint.hpp"
|
||||
|
||||
using namespace libsnark;
|
||||
|
||||
void test_bigint()
|
||||
{
|
||||
static_assert(ULONG_MAX == 0xFFFFFFFFFFFFFFFFul, "unsigned long not 64-bit");
|
||||
static_assert(GMP_NUMB_BITS == 64, "GMP limb not 64-bit");
|
||||
|
||||
const char *b1_decimal = "76749407";
|
||||
const char *b2_decimal = "435020359732196472065729437602";
|
||||
const char *b3_decimal = "33387554642372758038536799358397002014";
|
||||
const char *b2_binary = "0000000000000000000000000000010101111101101000000110100001011010"
|
||||
"1101101010001001000001101000101000100110011001110001111110100010";
|
||||
|
||||
bigint<1> b0 = bigint<1>(0ul);
|
||||
bigint<1> b1 = bigint<1>(b1_decimal);
|
||||
bigint<2> b2 = bigint<2>(b2_decimal);
|
||||
|
||||
assert(b0.as_ulong() == 0ul);
|
||||
assert(b0.is_zero());
|
||||
assert(b1.as_ulong() == 76749407ul);
|
||||
assert(!(b1.is_zero()));
|
||||
assert(b2.as_ulong() == 15747124762497195938ul);
|
||||
assert(!(b2.is_zero()));
|
||||
assert(b0 != b1);
|
||||
assert(!(b0 == b1));
|
||||
|
||||
assert(b2.max_bits() == 128);
|
||||
assert(b2.num_bits() == 99);
|
||||
for (size_t i = 0; i < 128; i++) {
|
||||
assert(b2.test_bit(i) == (b2_binary[127-i] == '1'));
|
||||
}
|
||||
|
||||
bigint<3> b3 = b2 * b1;
|
||||
|
||||
assert(b3 == bigint<3>(b3_decimal));
|
||||
assert(!(b3.is_zero()));
|
||||
|
||||
bigint<3> b3a { b3 };
|
||||
assert(b3a == bigint<3>(b3_decimal));
|
||||
assert(b3a == b3);
|
||||
assert(!(b3a.is_zero()));
|
||||
|
||||
mpz_t m3;
|
||||
mpz_init(m3);
|
||||
b3.to_mpz(m3);
|
||||
bigint<3> b3b { m3 };
|
||||
assert(b3b == b3);
|
||||
|
||||
bigint<2> quotient;
|
||||
bigint<2> remainder;
|
||||
bigint<3>::div_qr(quotient, remainder, b3, b2);
|
||||
assert(quotient.num_bits() < GMP_NUMB_BITS);
|
||||
assert(quotient.as_ulong() == b1.as_ulong());
|
||||
bigint<1> b1inc = bigint<1>("76749408");
|
||||
bigint<1> b1a = quotient.shorten(b1inc, "test");
|
||||
assert(b1a == b1);
|
||||
assert(remainder.is_zero());
|
||||
remainder.limit(b2, "test");
|
||||
|
||||
try {
|
||||
(void)(quotient.shorten(b1, "test"));
|
||||
assert(false);
|
||||
} catch (std::domain_error) {}
|
||||
try {
|
||||
remainder.limit(remainder, "test");
|
||||
assert(false);
|
||||
} catch (std::domain_error) {}
|
||||
|
||||
bigint<1> br = bigint<1>("42");
|
||||
b3 += br;
|
||||
assert(b3 != b3a);
|
||||
assert(b3 > b3a);
|
||||
assert(!(b3a > b3));
|
||||
|
||||
bigint<3>::div_qr(quotient, remainder, b3, b2);
|
||||
assert(quotient.num_bits() < GMP_NUMB_BITS);
|
||||
assert(quotient.as_ulong() == b1.as_ulong());
|
||||
assert(remainder.num_bits() < GMP_NUMB_BITS);
|
||||
assert(remainder.as_ulong() == 42);
|
||||
|
||||
b3a.clear();
|
||||
assert(b3a.is_zero());
|
||||
assert(b3a.num_bits() == 0);
|
||||
assert(!(b3.is_zero()));
|
||||
|
||||
bigint<4> bx = bigint<4>().randomize();
|
||||
bigint<4> by = bigint<4>().randomize();
|
||||
assert(!(bx == by));
|
||||
|
||||
// TODO: test serialization
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
test_bigint();
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,245 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
#include "common/profiling.hpp"
|
||||
#include "algebra/curves/edwards/edwards_pp.hpp"
|
||||
#include "algebra/curves/mnt/mnt4/mnt4_pp.hpp"
|
||||
#include "algebra/curves/mnt/mnt6/mnt6_pp.hpp"
|
||||
#ifdef CURVE_BN128
|
||||
#include "algebra/curves/bn128/bn128_pp.hpp"
|
||||
#endif
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_pp.hpp"
|
||||
#include "algebra/fields/fp6_3over2.hpp"
|
||||
#include "algebra/fields/fp12_2over3over2.hpp"
|
||||
|
||||
using namespace libsnark;
|
||||
|
||||
template<typename FieldT>
|
||||
void test_field()
|
||||
{
|
||||
bigint<1> rand1 = bigint<1>("76749407");
|
||||
bigint<1> rand2 = bigint<1>("44410867");
|
||||
bigint<1> randsum = bigint<1>("121160274");
|
||||
|
||||
FieldT zero = FieldT::zero();
|
||||
FieldT one = FieldT::one();
|
||||
FieldT a = FieldT::random_element();
|
||||
FieldT a_ser;
|
||||
a_ser = reserialize<FieldT>(a);
|
||||
assert(a_ser == a);
|
||||
|
||||
FieldT b = FieldT::random_element();
|
||||
FieldT c = FieldT::random_element();
|
||||
FieldT d = FieldT::random_element();
|
||||
|
||||
assert(a != zero);
|
||||
assert(a != one);
|
||||
|
||||
assert(a * a == a.squared());
|
||||
assert((a + b).squared() == a.squared() + a*b + b*a + b.squared());
|
||||
assert((a + b)*(c + d) == a*c + a*d + b*c + b*d);
|
||||
assert(a - b == a + (-b));
|
||||
assert(a - b == (-b) + a);
|
||||
|
||||
assert((a ^ rand1) * (a ^ rand2) == (a^randsum));
|
||||
|
||||
assert(a * a.inverse() == one);
|
||||
assert((a + b) * c.inverse() == a * c.inverse() + (b.inverse() * c).inverse());
|
||||
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_sqrt()
|
||||
{
|
||||
for (size_t i = 0; i < 100; ++i)
|
||||
{
|
||||
FieldT a = FieldT::random_element();
|
||||
FieldT asq = a.squared();
|
||||
assert(asq.sqrt() == a || asq.sqrt() == -a);
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_two_squarings()
|
||||
{
|
||||
FieldT a = FieldT::random_element();
|
||||
assert(a.squared() == a * a);
|
||||
assert(a.squared() == a.squared_complex());
|
||||
assert(a.squared() == a.squared_karatsuba());
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_Frobenius()
|
||||
{
|
||||
FieldT a = FieldT::random_element();
|
||||
assert(a.Frobenius_map(0) == a);
|
||||
FieldT a_q = a ^ FieldT::base_field_char();
|
||||
for (size_t power = 1; power < 10; ++power)
|
||||
{
|
||||
const FieldT a_qi = a.Frobenius_map(power);
|
||||
assert(a_qi == a_q);
|
||||
|
||||
a_q = a_q ^ FieldT::base_field_char();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_unitary_inverse()
|
||||
{
|
||||
assert(FieldT::extension_degree() % 2 == 0);
|
||||
FieldT a = FieldT::random_element();
|
||||
FieldT aqcubed_minus1 = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
|
||||
assert(aqcubed_minus1.inverse() == aqcubed_minus1.unitary_inverse());
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_cyclotomic_squaring();
|
||||
|
||||
template<>
|
||||
void test_cyclotomic_squaring<Fqk<edwards_pp> >()
|
||||
{
|
||||
typedef Fqk<edwards_pp> FieldT;
|
||||
assert(FieldT::extension_degree() % 2 == 0);
|
||||
FieldT a = FieldT::random_element();
|
||||
FieldT a_unitary = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
|
||||
// beta = a^((q^(k/2)-1)*(q+1))
|
||||
FieldT beta = a_unitary.Frobenius_map(1) * a_unitary;
|
||||
assert(beta.cyclotomic_squared() == beta.squared());
|
||||
}
|
||||
|
||||
template<>
|
||||
void test_cyclotomic_squaring<Fqk<mnt4_pp> >()
|
||||
{
|
||||
typedef Fqk<mnt4_pp> FieldT;
|
||||
assert(FieldT::extension_degree() % 2 == 0);
|
||||
FieldT a = FieldT::random_element();
|
||||
FieldT a_unitary = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
|
||||
// beta = a^(q^(k/2)-1)
|
||||
FieldT beta = a_unitary;
|
||||
assert(beta.cyclotomic_squared() == beta.squared());
|
||||
}
|
||||
|
||||
template<>
|
||||
void test_cyclotomic_squaring<Fqk<mnt6_pp> >()
|
||||
{
|
||||
typedef Fqk<mnt6_pp> FieldT;
|
||||
assert(FieldT::extension_degree() % 2 == 0);
|
||||
FieldT a = FieldT::random_element();
|
||||
FieldT a_unitary = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
|
||||
// beta = a^((q^(k/2)-1)*(q+1))
|
||||
FieldT beta = a_unitary.Frobenius_map(1) * a_unitary;
|
||||
assert(beta.cyclotomic_squared() == beta.squared());
|
||||
}
|
||||
|
||||
template<typename ppT>
|
||||
void test_all_fields()
|
||||
{
|
||||
test_field<Fr<ppT> >();
|
||||
test_field<Fq<ppT> >();
|
||||
test_field<Fqe<ppT> >();
|
||||
test_field<Fqk<ppT> >();
|
||||
|
||||
test_sqrt<Fr<ppT> >();
|
||||
test_sqrt<Fq<ppT> >();
|
||||
test_sqrt<Fqe<ppT> >();
|
||||
|
||||
test_Frobenius<Fqe<ppT> >();
|
||||
test_Frobenius<Fqk<ppT> >();
|
||||
|
||||
test_unitary_inverse<Fqk<ppT> >();
|
||||
}
|
||||
|
||||
template<typename Fp4T>
|
||||
void test_Fp4_tom_cook()
|
||||
{
|
||||
typedef typename Fp4T::my_Fp FieldT;
|
||||
for (size_t i = 0; i < 100; ++i)
|
||||
{
|
||||
const Fp4T a = Fp4T::random_element();
|
||||
const Fp4T b = Fp4T::random_element();
|
||||
const Fp4T correct_res = a * b;
|
||||
|
||||
Fp4T res;
|
||||
|
||||
const FieldT
|
||||
&a0 = a.c0.c0,
|
||||
&a1 = a.c1.c0,
|
||||
&a2 = a.c0.c1,
|
||||
&a3 = a.c1.c1;
|
||||
|
||||
const FieldT
|
||||
&b0 = b.c0.c0,
|
||||
&b1 = b.c1.c0,
|
||||
&b2 = b.c0.c1,
|
||||
&b3 = b.c1.c1;
|
||||
|
||||
FieldT
|
||||
&c0 = res.c0.c0,
|
||||
&c1 = res.c1.c0,
|
||||
&c2 = res.c0.c1,
|
||||
&c3 = res.c1.c1;
|
||||
|
||||
const FieldT v0 = a0 * b0;
|
||||
const FieldT v1 = (a0 + a1 + a2 + a3) * (b0 + b1 + b2 + b3);
|
||||
const FieldT v2 = (a0 - a1 + a2 - a3) * (b0 - b1 + b2 - b3);
|
||||
const FieldT v3 = (a0 + FieldT(2)*a1 + FieldT(4)*a2 + FieldT(8)*a3) * (b0 + FieldT(2)*b1 + FieldT(4)*b2 + FieldT(8)*b3);
|
||||
const FieldT v4 = (a0 - FieldT(2)*a1 + FieldT(4)*a2 - FieldT(8)*a3) * (b0 - FieldT(2)*b1 + FieldT(4)*b2 - FieldT(8)*b3);
|
||||
const FieldT v5 = (a0 + FieldT(3)*a1 + FieldT(9)*a2 + FieldT(27)*a3) * (b0 + FieldT(3)*b1 + FieldT(9)*b2 + FieldT(27)*b3);
|
||||
const FieldT v6 = a3 * b3;
|
||||
|
||||
const FieldT beta = Fp4T::non_residue;
|
||||
|
||||
c0 = v0 + beta*(FieldT(4).inverse()*v0 - FieldT(6).inverse()*(v1 + v2) + FieldT(24).inverse() * (v3 + v4) - FieldT(5) * v6);
|
||||
c1 = - FieldT(3).inverse()*v0 + v1 - FieldT(2).inverse()*v2 - FieldT(4).inverse()*v3 + FieldT(20).inverse() * v4 + FieldT(30).inverse() * v5 - FieldT(12) * v6 + beta * ( - FieldT(12).inverse() * (v0 - v1) + FieldT(24).inverse()*(v2 - v3) - FieldT(120).inverse() * (v4 - v5) - FieldT(3) * v6);
|
||||
c2 = - (FieldT(5)*(FieldT(4).inverse()))* v0 + (FieldT(2)*(FieldT(3).inverse()))*(v1 + v2) - FieldT(24).inverse()*(v3 + v4) + FieldT(4)*v6 + beta*v6;
|
||||
c3 = FieldT(12).inverse() * (FieldT(5)*v0 - FieldT(7)*v1) - FieldT(24).inverse()*(v2 - FieldT(7)*v3 + v4 + v5) + FieldT(15)*v6;
|
||||
|
||||
assert(res == correct_res);
|
||||
|
||||
// {v0, v3, v4, v5}
|
||||
const FieldT u = (FieldT::one() - beta).inverse();
|
||||
assert(v0 == u * c0 + beta * u * c2 - beta * u * FieldT(2).inverse() * v1 - beta * u * FieldT(2).inverse() * v2 + beta * v6);
|
||||
assert(v3 == - FieldT(15) * u * c0 - FieldT(30) * u * c1 - FieldT(3) * (FieldT(4) + beta) * u * c2 - FieldT(6) * (FieldT(4) + beta) * u * c3 + (FieldT(24) - FieldT(3) * beta * FieldT(2).inverse()) * u * v1 + (-FieldT(8) + beta * FieldT(2).inverse()) * u * v2
|
||||
- FieldT(3) * (-FieldT(16) + beta) * v6);
|
||||
assert(v4 == - FieldT(15) * u * c0 + FieldT(30) * u * c1 - FieldT(3) * (FieldT(4) + beta) * u * c2 + FieldT(6) * (FieldT(4) + beta) * u * c3 + (FieldT(24) - FieldT(3) * beta * FieldT(2).inverse()) * u * v2 + (-FieldT(8) + beta * FieldT(2).inverse()) * u * v1
|
||||
- FieldT(3) * (-FieldT(16) + beta) * v6);
|
||||
assert(v5 == - FieldT(80) * u * c0 - FieldT(240) * u * c1 - FieldT(8) * (FieldT(9) + beta) * u * c2 - FieldT(24) * (FieldT(9) + beta) * u * c3 - FieldT(2) * (-FieldT(81) + beta) * u * v1 + (-FieldT(81) + beta) * u * v2
|
||||
- FieldT(8) * (-FieldT(81) + beta) * v6);
|
||||
|
||||
// c0 + beta c2 - (beta v1)/2 - (beta v2)/ 2 - (-1 + beta) beta v6,
|
||||
// -15 c0 - 30 c1 - 3 (4 + beta) c2 - 6 (4 + beta) c3 + (24 - (3 beta)/2) v1 + (-8 + beta/2) v2 + 3 (-16 + beta) (-1 + beta) v6,
|
||||
// -15 c0 + 30 c1 - 3 (4 + beta) c2 + 6 (4 + beta) c3 + (-8 + beta/2) v1 + (24 - (3 beta)/2) v2 + 3 (-16 + beta) (-1 + beta) v6,
|
||||
// -80 c0 - 240 c1 - 8 (9 + beta) c2 - 24 (9 + beta) c3 - 2 (-81 + beta) v1 + (-81 + beta) v2 + 8 (-81 + beta) (-1 + beta) v6
|
||||
}
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
edwards_pp::init_public_params();
|
||||
test_all_fields<edwards_pp>();
|
||||
test_cyclotomic_squaring<Fqk<edwards_pp> >();
|
||||
|
||||
mnt4_pp::init_public_params();
|
||||
test_all_fields<mnt4_pp>();
|
||||
test_Fp4_tom_cook<mnt4_Fq4>();
|
||||
test_two_squarings<Fqe<mnt4_pp> >();
|
||||
test_cyclotomic_squaring<Fqk<mnt4_pp> >();
|
||||
|
||||
mnt6_pp::init_public_params();
|
||||
test_all_fields<mnt6_pp>();
|
||||
test_cyclotomic_squaring<Fqk<mnt6_pp> >();
|
||||
|
||||
alt_bn128_pp::init_public_params();
|
||||
test_field<alt_bn128_Fq6>();
|
||||
test_Frobenius<alt_bn128_Fq6>();
|
||||
test_all_fields<alt_bn128_pp>();
|
||||
|
||||
#ifdef CURVE_BN128 // BN128 has fancy dependencies so it may be disabled
|
||||
bn128_pp::init_public_params();
|
||||
test_field<Fr<bn128_pp> >();
|
||||
test_field<Fq<bn128_pp> >();
|
||||
#endif
|
||||
}
|
|
@ -0,0 +1,84 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for:
|
||||
- a knowledge commitment, and
|
||||
- a knowledge commitment vector.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef KNOWLEDGE_COMMITMENT_HPP_
|
||||
#define KNOWLEDGE_COMMITMENT_HPP_
|
||||
|
||||
#include "algebra/fields/fp.hpp"
|
||||
#include "common/data_structures/sparse_vector.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/********************** Knowledge commitment *********************************/
|
||||
|
||||
/**
|
||||
* A knowledge commitment is a pair (g,h) where g is in T1 and h in T2,
|
||||
* and T1 and T2 are groups (written additively).
|
||||
*
|
||||
* Such pairs form a group by defining:
|
||||
* - "zero" = (0,0)
|
||||
* - "one" = (1,1)
|
||||
* - a * (g,h) + b * (g',h') := ( a * g + b * g', a * h + b * h').
|
||||
*/
|
||||
template<typename T1, typename T2>
|
||||
struct knowledge_commitment {
|
||||
|
||||
T1 g;
|
||||
T2 h;
|
||||
|
||||
knowledge_commitment<T1,T2>() = default;
|
||||
knowledge_commitment<T1,T2>(const knowledge_commitment<T1,T2> &other) = default;
|
||||
knowledge_commitment<T1,T2>(knowledge_commitment<T1,T2> &&other) = default;
|
||||
knowledge_commitment<T1,T2>(const T1 &g, const T2 &h);
|
||||
|
||||
knowledge_commitment<T1,T2>& operator=(const knowledge_commitment<T1,T2> &other) = default;
|
||||
knowledge_commitment<T1,T2>& operator=(knowledge_commitment<T1,T2> &&other) = default;
|
||||
knowledge_commitment<T1,T2> operator+(const knowledge_commitment<T1, T2> &other) const;
|
||||
|
||||
bool is_zero() const;
|
||||
bool operator==(const knowledge_commitment<T1,T2> &other) const;
|
||||
bool operator!=(const knowledge_commitment<T1,T2> &other) const;
|
||||
|
||||
static knowledge_commitment<T1,T2> zero();
|
||||
static knowledge_commitment<T1,T2> one();
|
||||
|
||||
void print() const;
|
||||
|
||||
static size_t size_in_bits();
|
||||
};
|
||||
|
||||
template<typename T1, typename T2, mp_size_t m>
|
||||
knowledge_commitment<T1,T2> operator*(const bigint<m> &lhs, const knowledge_commitment<T1,T2> &rhs);
|
||||
|
||||
template<typename T1, typename T2, mp_size_t m, const bigint<m> &modulus_p>
|
||||
knowledge_commitment<T1,T2> operator*(const Fp_model<m, modulus_p> &lhs, const knowledge_commitment<T1,T2> &rhs);
|
||||
|
||||
template<typename T1,typename T2>
|
||||
std::ostream& operator<<(std::ostream& out, const knowledge_commitment<T1,T2> &kc);
|
||||
|
||||
template<typename T1,typename T2>
|
||||
std::istream& operator>>(std::istream& in, knowledge_commitment<T1,T2> &kc);
|
||||
|
||||
/******************** Knowledge commitment vector ****************************/
|
||||
|
||||
/**
|
||||
* A knowledge commitment vector is a sparse vector of knowledge commitments.
|
||||
*/
|
||||
template<typename T1, typename T2>
|
||||
using knowledge_commitment_vector = sparse_vector<knowledge_commitment<T1, T2> >;
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/knowledge_commitment/knowledge_commitment.tcc"
|
||||
|
||||
#endif // KNOWLEDGE_COMMITMENT_HPP_
|
|
@ -0,0 +1,111 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for:
|
||||
- a knowledge commitment, and
|
||||
- a knowledge commitment vector.
|
||||
|
||||
See knowledge_commitment.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef KNOWLEDGE_COMMITMENT_TCC_
|
||||
#define KNOWLEDGE_COMMITMENT_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T1, typename T2>
|
||||
knowledge_commitment<T1,T2>::knowledge_commitment(const T1 &g, const T2 &h) :
|
||||
g(g), h(h)
|
||||
{
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
knowledge_commitment<T1,T2> knowledge_commitment<T1,T2>::zero()
|
||||
{
|
||||
return knowledge_commitment<T1,T2>(T1::zero(), T2::zero());
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
knowledge_commitment<T1,T2> knowledge_commitment<T1,T2>::one()
|
||||
{
|
||||
return knowledge_commitment<T1,T2>(T1::one(), T2::one());
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
knowledge_commitment<T1,T2> knowledge_commitment<T1,T2>::operator+(const knowledge_commitment<T1,T2> &other) const
|
||||
{
|
||||
return knowledge_commitment<T1,T2>(this->g + other.g,
|
||||
this->h + other.h);
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
bool knowledge_commitment<T1,T2>::is_zero() const
|
||||
{
|
||||
return (g.is_zero() && h.is_zero());
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
bool knowledge_commitment<T1,T2>::operator==(const knowledge_commitment<T1,T2> &other) const
|
||||
{
|
||||
return (this->g == other.g &&
|
||||
this->h == other.h);
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
bool knowledge_commitment<T1,T2>::operator!=(const knowledge_commitment<T1,T2> &other) const
|
||||
{
|
||||
return !((*this) == other);
|
||||
}
|
||||
|
||||
template<typename T1, typename T2, mp_size_t m>
|
||||
knowledge_commitment<T1,T2> operator*(const bigint<m> &lhs, const knowledge_commitment<T1,T2> &rhs)
|
||||
{
|
||||
return knowledge_commitment<T1,T2>(lhs * rhs.g,
|
||||
lhs * rhs.h);
|
||||
}
|
||||
|
||||
template<typename T1, typename T2, mp_size_t m, const bigint<m> &modulus_p>
|
||||
knowledge_commitment<T1,T2> operator*(const Fp_model<m, modulus_p> &lhs, const knowledge_commitment<T1,T2> &rhs)
|
||||
{
|
||||
return (lhs.as_bigint()) * rhs;
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
void knowledge_commitment<T1,T2>::print() const
|
||||
{
|
||||
printf("knowledge_commitment.g:\n");
|
||||
g.print();
|
||||
printf("knowledge_commitment.h:\n");
|
||||
h.print();
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
size_t knowledge_commitment<T1,T2>::size_in_bits()
|
||||
{
|
||||
return T1::size_in_bits() + T2::size_in_bits();
|
||||
}
|
||||
|
||||
template<typename T1,typename T2>
|
||||
std::ostream& operator<<(std::ostream& out, const knowledge_commitment<T1,T2> &kc)
|
||||
{
|
||||
out << kc.g << OUTPUT_SEPARATOR << kc.h;
|
||||
return out;
|
||||
}
|
||||
|
||||
template<typename T1,typename T2>
|
||||
std::istream& operator>>(std::istream& in, knowledge_commitment<T1,T2> &kc)
|
||||
{
|
||||
in >> kc.g;
|
||||
consume_OUTPUT_SEPARATOR(in);
|
||||
in >> kc.h;
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // KNOWLEDGE_COMMITMENT_TCC_
|
|
@ -0,0 +1,55 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef KC_MULTIEXP_HPP_
|
||||
#define KC_MULTIEXP_HPP_
|
||||
|
||||
/*
|
||||
Split out from multiexp to prevent cyclical
|
||||
dependencies. I.e. previously multiexp dependend on
|
||||
knowledge_commitment, which dependend on sparse_vector, which
|
||||
dependend on multiexp (to do accumulate).
|
||||
|
||||
Will probably go away in more general exp refactoring.
|
||||
*/
|
||||
|
||||
#include "algebra/knowledge_commitment/knowledge_commitment.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T1, typename T2, mp_size_t n>
|
||||
knowledge_commitment<T1,T2> opt_window_wnaf_exp(const knowledge_commitment<T1,T2> &base,
|
||||
const bigint<n> &scalar, const size_t scalar_bits);
|
||||
|
||||
template<typename T1, typename T2, typename FieldT>
|
||||
knowledge_commitment<T1, T2> kc_multi_exp_with_mixed_addition(const knowledge_commitment_vector<T1, T2> &vec,
|
||||
const size_t min_idx,
|
||||
const size_t max_idx,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end,
|
||||
const size_t chunks,
|
||||
const bool use_multiexp=false);
|
||||
|
||||
template<typename T1, typename T2>
|
||||
void kc_batch_to_special(std::vector<knowledge_commitment<T1, T2> > &vec);
|
||||
|
||||
template<typename T1, typename T2, typename FieldT>
|
||||
knowledge_commitment_vector<T1, T2> kc_batch_exp(const size_t scalar_size,
|
||||
const size_t T1_window,
|
||||
const size_t T2_window,
|
||||
const window_table<T1> &T1_table,
|
||||
const window_table<T2> &T2_table,
|
||||
const FieldT &T1_coeff,
|
||||
const FieldT &T2_coeff,
|
||||
const std::vector<FieldT> &v,
|
||||
const size_t suggested_num_chunks);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/scalar_multiplication/kc_multiexp.tcc"
|
||||
|
||||
#endif // KC_MULTIEXP_HPP_
|
|
@ -0,0 +1,274 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef KC_MULTIEXP_TCC_
|
||||
#define KC_MULTIEXP_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T1, typename T2, mp_size_t n>
|
||||
knowledge_commitment<T1,T2> opt_window_wnaf_exp(const knowledge_commitment<T1,T2> &base,
|
||||
const bigint<n> &scalar, const size_t scalar_bits)
|
||||
{
|
||||
return knowledge_commitment<T1,T2>(opt_window_wnaf_exp(base.g, scalar, scalar_bits),
|
||||
opt_window_wnaf_exp(base.h, scalar, scalar_bits));
|
||||
}
|
||||
|
||||
template<typename T1, typename T2, typename FieldT>
|
||||
knowledge_commitment<T1, T2> kc_multi_exp_with_mixed_addition(const knowledge_commitment_vector<T1, T2> &vec,
|
||||
const size_t min_idx,
|
||||
const size_t max_idx,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end,
|
||||
const size_t chunks,
|
||||
const bool use_multiexp)
|
||||
{
|
||||
enter_block("Process scalar vector");
|
||||
auto index_it = std::lower_bound(vec.indices.begin(), vec.indices.end(), min_idx);
|
||||
const size_t offset = index_it - vec.indices.begin();
|
||||
|
||||
auto value_it = vec.values.begin() + offset;
|
||||
|
||||
const FieldT zero = FieldT::zero();
|
||||
const FieldT one = FieldT::one();
|
||||
|
||||
std::vector<FieldT> p;
|
||||
std::vector<knowledge_commitment<T1, T2> > g;
|
||||
|
||||
knowledge_commitment<T1, T2> acc = knowledge_commitment<T1, T2>::zero();
|
||||
|
||||
size_t num_skip = 0;
|
||||
size_t num_add = 0;
|
||||
size_t num_other = 0;
|
||||
|
||||
const size_t scalar_length = std::distance(scalar_start, scalar_end);
|
||||
|
||||
while (index_it != vec.indices.end() && *index_it < max_idx)
|
||||
{
|
||||
const size_t scalar_position = (*index_it) - min_idx;
|
||||
assert(scalar_position < scalar_length);
|
||||
|
||||
const FieldT scalar = *(scalar_start + scalar_position);
|
||||
|
||||
if (scalar == zero)
|
||||
{
|
||||
// do nothing
|
||||
++num_skip;
|
||||
}
|
||||
else if (scalar == one)
|
||||
{
|
||||
#ifdef USE_MIXED_ADDITION
|
||||
acc.g = acc.g.mixed_add(value_it->g);
|
||||
acc.h = acc.h.mixed_add(value_it->h);
|
||||
#else
|
||||
acc.g = acc.g + value_it->g;
|
||||
acc.h = acc.h + value_it->h;
|
||||
#endif
|
||||
++num_add;
|
||||
}
|
||||
else
|
||||
{
|
||||
p.emplace_back(scalar);
|
||||
g.emplace_back(*value_it);
|
||||
++num_other;
|
||||
}
|
||||
|
||||
++index_it;
|
||||
++value_it;
|
||||
}
|
||||
|
||||
//print_indent(); printf("* Elements of w skipped: %zu (%0.2f%%)\n", num_skip, 100.*num_skip/(num_skip+num_add+num_other));
|
||||
//print_indent(); printf("* Elements of w processed with special addition: %zu (%0.2f%%)\n", num_add, 100.*num_add/(num_skip+num_add+num_other));
|
||||
//print_indent(); printf("* Elements of w remaining: %zu (%0.2f%%)\n", num_other, 100.*num_other/(num_skip+num_add+num_other));
|
||||
leave_block("Process scalar vector");
|
||||
|
||||
return acc + multi_exp<knowledge_commitment<T1, T2>, FieldT>(g.begin(), g.end(), p.begin(), p.end(), chunks, use_multiexp);
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
void kc_batch_to_special(std::vector<knowledge_commitment<T1, T2> > &vec)
|
||||
{
|
||||
enter_block("Batch-convert knowledge-commitments to special form");
|
||||
|
||||
std::vector<T1> g_vec;
|
||||
g_vec.reserve(vec.size());
|
||||
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
if (!vec[i].g.is_zero())
|
||||
{
|
||||
g_vec.emplace_back(vec[i].g);
|
||||
}
|
||||
}
|
||||
|
||||
batch_to_special_all_non_zeros<T1>(g_vec);
|
||||
auto g_it = g_vec.begin();
|
||||
T1 T1_zero_special = T1::zero();
|
||||
T1_zero_special.to_special();
|
||||
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
if (!vec[i].g.is_zero())
|
||||
{
|
||||
vec[i].g = *g_it;
|
||||
++g_it;
|
||||
}
|
||||
else
|
||||
{
|
||||
vec[i].g = T1_zero_special;
|
||||
}
|
||||
}
|
||||
|
||||
g_vec.clear();
|
||||
|
||||
std::vector<T2> h_vec;
|
||||
h_vec.reserve(vec.size());
|
||||
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
if (!vec[i].h.is_zero())
|
||||
{
|
||||
h_vec.emplace_back(vec[i].h);
|
||||
}
|
||||
}
|
||||
|
||||
batch_to_special_all_non_zeros<T2>(h_vec);
|
||||
auto h_it = h_vec.begin();
|
||||
T2 T2_zero_special = T2::zero();
|
||||
T2_zero_special.to_special();
|
||||
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
if (!vec[i].h.is_zero())
|
||||
{
|
||||
vec[i].h = *h_it;
|
||||
++h_it;
|
||||
}
|
||||
else
|
||||
{
|
||||
vec[i].h = T2_zero_special;
|
||||
}
|
||||
}
|
||||
|
||||
g_vec.clear();
|
||||
|
||||
leave_block("Batch-convert knowledge-commitments to special form");
|
||||
}
|
||||
|
||||
template<typename T1, typename T2, typename FieldT>
|
||||
knowledge_commitment_vector<T1, T2> kc_batch_exp_internal(const size_t scalar_size,
|
||||
const size_t T1_window,
|
||||
const size_t T2_window,
|
||||
const window_table<T1> &T1_table,
|
||||
const window_table<T2> &T2_table,
|
||||
const FieldT &T1_coeff,
|
||||
const FieldT &T2_coeff,
|
||||
const std::vector<FieldT> &v,
|
||||
const size_t start_pos,
|
||||
const size_t end_pos,
|
||||
const size_t expected_size)
|
||||
{
|
||||
knowledge_commitment_vector<T1, T2> res;
|
||||
|
||||
res.values.reserve(expected_size);
|
||||
res.indices.reserve(expected_size);
|
||||
|
||||
for (size_t pos = start_pos; pos != end_pos; ++pos)
|
||||
{
|
||||
if (!v[pos].is_zero())
|
||||
{
|
||||
res.values.emplace_back(knowledge_commitment<T1, T2>(windowed_exp(scalar_size, T1_window, T1_table, T1_coeff * v[pos]),
|
||||
windowed_exp(scalar_size, T2_window, T2_table, T2_coeff * v[pos])));
|
||||
res.indices.emplace_back(pos);
|
||||
}
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
template<typename T1, typename T2, typename FieldT>
|
||||
knowledge_commitment_vector<T1, T2> kc_batch_exp(const size_t scalar_size,
|
||||
const size_t T1_window,
|
||||
const size_t T2_window,
|
||||
const window_table<T1> &T1_table,
|
||||
const window_table<T2> &T2_table,
|
||||
const FieldT &T1_coeff,
|
||||
const FieldT &T2_coeff,
|
||||
const std::vector<FieldT> &v,
|
||||
const size_t suggested_num_chunks)
|
||||
{
|
||||
knowledge_commitment_vector<T1, T2> res;
|
||||
res.domain_size_ = v.size();
|
||||
|
||||
size_t nonzero = 0;
|
||||
for (size_t i = 0; i < v.size(); ++i)
|
||||
{
|
||||
nonzero += (v[i].is_zero() ? 0 : 1);
|
||||
}
|
||||
|
||||
const size_t num_chunks = std::max((size_t)1, std::min(nonzero, suggested_num_chunks));
|
||||
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("Non-zero coordinate count: %zu/%zu (%0.2f%%)\n", nonzero, v.size(), 100.*nonzero/v.size());
|
||||
}
|
||||
|
||||
std::vector<knowledge_commitment_vector<T1, T2> > tmp(num_chunks);
|
||||
std::vector<size_t> chunk_pos(num_chunks+1);
|
||||
|
||||
const size_t chunk_size = nonzero / num_chunks;
|
||||
const size_t last_chunk = nonzero - chunk_size * (num_chunks - 1);
|
||||
|
||||
chunk_pos[0] = 0;
|
||||
|
||||
size_t cnt = 0;
|
||||
size_t chunkno = 1;
|
||||
|
||||
for (size_t i = 0; i < v.size(); ++i)
|
||||
{
|
||||
cnt += (v[i].is_zero() ? 0 : 1);
|
||||
if (cnt == chunk_size && chunkno < num_chunks)
|
||||
{
|
||||
chunk_pos[chunkno] = i;
|
||||
cnt = 0;
|
||||
++chunkno;
|
||||
}
|
||||
}
|
||||
|
||||
chunk_pos[num_chunks] = v.size();
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t i = 0; i < num_chunks; ++i)
|
||||
{
|
||||
tmp[i] = kc_batch_exp_internal<T1, T2, FieldT>(scalar_size, T1_window, T2_window, T1_table, T2_table, T1_coeff, T2_coeff, v,
|
||||
chunk_pos[i], chunk_pos[i+1], i == num_chunks - 1 ? last_chunk : chunk_size);
|
||||
#ifdef USE_MIXED_ADDITION
|
||||
kc_batch_to_special<T1, T2>(tmp[i].values);
|
||||
#endif
|
||||
}
|
||||
|
||||
if (num_chunks == 1)
|
||||
{
|
||||
tmp[0].domain_size_ = v.size();
|
||||
return tmp[0];
|
||||
}
|
||||
else
|
||||
{
|
||||
for (size_t i = 0; i < num_chunks; ++i)
|
||||
{
|
||||
res.values.insert(res.values.end(), tmp[i].values.begin(), tmp[i].values.end());
|
||||
res.indices.insert(res.indices.end(), tmp[i].indices.begin(), tmp[i].indices.end());
|
||||
}
|
||||
return res;
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // KC_MULTIEXP_TCC_
|
|
@ -0,0 +1,110 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for multi-exponentiation routines.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MULTIEXP_HPP_
|
||||
#define MULTIEXP_HPP_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/**
|
||||
* Naive multi-exponentiation individually multiplies each base by the
|
||||
* corresponding scalar and adds up the results.
|
||||
*/
|
||||
template<typename T, typename FieldT>
|
||||
T naive_exp(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end);
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
T naive_plain_exp(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end);
|
||||
|
||||
/**
|
||||
* Naive multi-exponentiation uses a variant of the Bos-Coster algorithm [1],
|
||||
* and implementation suggestions from [2].
|
||||
*
|
||||
* [1] = Bos and Coster, "Addition chain heuristics", CRYPTO '89
|
||||
* [2] = Bernstein, Duif, Lange, Schwabe, and Yang, "High-speed high-security signatures", CHES '11
|
||||
*/
|
||||
template<typename T, typename FieldT>
|
||||
T multi_exp(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end,
|
||||
const size_t chunks,
|
||||
const bool use_multiexp=false);
|
||||
|
||||
|
||||
/**
|
||||
* A variant of multi_exp that takes advantage of the method mixed_add (instead of the operator '+').
|
||||
*/
|
||||
template<typename T, typename FieldT>
|
||||
T multi_exp_with_mixed_addition(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end,
|
||||
const size_t chunks,
|
||||
const bool use_multiexp);
|
||||
|
||||
/**
|
||||
* A window table stores window sizes for different instance sizes for fixed-base multi-scalar multiplications.
|
||||
*/
|
||||
template<typename T>
|
||||
using window_table = std::vector<std::vector<T> >;
|
||||
|
||||
/**
|
||||
* Compute window size for the given number of scalars.
|
||||
*/
|
||||
template<typename T>
|
||||
size_t get_exp_window_size(const size_t num_scalars);
|
||||
|
||||
/**
|
||||
* Compute table of window sizes.
|
||||
*/
|
||||
template<typename T>
|
||||
window_table<T> get_window_table(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const T &g);
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
T windowed_exp(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const window_table<T> &powers_of_g,
|
||||
const FieldT &pow);
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
std::vector<T> batch_exp(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const window_table<T> &table,
|
||||
const std::vector<FieldT> &v);
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
std::vector<T> batch_exp_with_coeff(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const window_table<T> &table,
|
||||
const FieldT &coeff,
|
||||
const std::vector<FieldT> &v);
|
||||
|
||||
// defined in every curve
|
||||
template<typename T>
|
||||
void batch_to_special_all_non_zeros(std::vector<T> &vec);
|
||||
|
||||
template<typename T>
|
||||
void batch_to_special(std::vector<T> &vec);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/scalar_multiplication/multiexp.tcc"
|
||||
|
||||
#endif // MULTIEXP_HPP_
|
|
@ -0,0 +1,590 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for multi-exponentiation routines.
|
||||
|
||||
See multiexp.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MULTIEXP_TCC_
|
||||
#define MULTIEXP_TCC_
|
||||
|
||||
#include "algebra/fields/fp_aux.tcc"
|
||||
|
||||
#include <algorithm>
|
||||
#include <cassert>
|
||||
#include <type_traits>
|
||||
|
||||
#include "common/profiling.hpp"
|
||||
#include "common/utils.hpp"
|
||||
#include "algebra/scalar_multiplication/wnaf.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n>
|
||||
class ordered_exponent {
|
||||
// to use std::push_heap and friends later
|
||||
public:
|
||||
size_t idx;
|
||||
bigint<n> r;
|
||||
|
||||
ordered_exponent(const size_t idx, const bigint<n> &r) : idx(idx), r(r) {};
|
||||
|
||||
bool operator<(const ordered_exponent<n> &other) const
|
||||
{
|
||||
#if defined(__x86_64__) && defined(USE_ASM)
|
||||
if (n == 3)
|
||||
{
|
||||
long res;
|
||||
__asm__
|
||||
("// check for overflow \n\t"
|
||||
"mov $0, %[res] \n\t"
|
||||
ADD_CMP(16)
|
||||
ADD_CMP(8)
|
||||
ADD_CMP(0)
|
||||
"jmp done%= \n\t"
|
||||
"subtract%=: \n\t"
|
||||
"mov $1, %[res] \n\t"
|
||||
"done%=: \n\t"
|
||||
: [res] "=&r" (res)
|
||||
: [A] "r" (other.r.data), [mod] "r" (this->r.data)
|
||||
: "cc", "%rax");
|
||||
return res;
|
||||
}
|
||||
else if (n == 4)
|
||||
{
|
||||
long res;
|
||||
__asm__
|
||||
("// check for overflow \n\t"
|
||||
"mov $0, %[res] \n\t"
|
||||
ADD_CMP(24)
|
||||
ADD_CMP(16)
|
||||
ADD_CMP(8)
|
||||
ADD_CMP(0)
|
||||
"jmp done%= \n\t"
|
||||
"subtract%=: \n\t"
|
||||
"mov $1, %[res] \n\t"
|
||||
"done%=: \n\t"
|
||||
: [res] "=&r" (res)
|
||||
: [A] "r" (other.r.data), [mod] "r" (this->r.data)
|
||||
: "cc", "%rax");
|
||||
return res;
|
||||
}
|
||||
else if (n == 5)
|
||||
{
|
||||
long res;
|
||||
__asm__
|
||||
("// check for overflow \n\t"
|
||||
"mov $0, %[res] \n\t"
|
||||
ADD_CMP(32)
|
||||
ADD_CMP(24)
|
||||
ADD_CMP(16)
|
||||
ADD_CMP(8)
|
||||
ADD_CMP(0)
|
||||
"jmp done%= \n\t"
|
||||
"subtract%=: \n\t"
|
||||
"mov $1, %[res] \n\t"
|
||||
"done%=: \n\t"
|
||||
: [res] "=&r" (res)
|
||||
: [A] "r" (other.r.data), [mod] "r" (this->r.data)
|
||||
: "cc", "%rax");
|
||||
return res;
|
||||
}
|
||||
else
|
||||
#endif
|
||||
{
|
||||
return (mpn_cmp(this->r.data, other.r.data, n) < 0);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
T naive_exp(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end)
|
||||
{
|
||||
T result(T::zero());
|
||||
|
||||
typename std::vector<T>::const_iterator vec_it;
|
||||
typename std::vector<FieldT>::const_iterator scalar_it;
|
||||
|
||||
for (vec_it = vec_start, scalar_it = scalar_start; vec_it != vec_end; ++vec_it, ++scalar_it)
|
||||
{
|
||||
bigint<FieldT::num_limbs> scalar_bigint = scalar_it->as_bigint();
|
||||
result = result + opt_window_wnaf_exp(*vec_it, scalar_bigint, scalar_bigint.num_bits());
|
||||
}
|
||||
assert(scalar_it == scalar_end);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
T naive_plain_exp(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end)
|
||||
{
|
||||
T result(T::zero());
|
||||
|
||||
typename std::vector<T>::const_iterator vec_it;
|
||||
typename std::vector<FieldT>::const_iterator scalar_it;
|
||||
|
||||
for (vec_it = vec_start, scalar_it = scalar_start; vec_it != vec_end; ++vec_it, ++scalar_it)
|
||||
{
|
||||
result = result + (*scalar_it) * (*vec_it);
|
||||
}
|
||||
assert(scalar_it == scalar_end);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
The multi-exponentiation algorithm below is a variant of the Bos-Coster algorithm
|
||||
[Bos and Coster, "Addition chain heuristics", CRYPTO '89].
|
||||
The implementation uses suggestions from
|
||||
[Bernstein, Duif, Lange, Schwabe, and Yang, "High-speed high-security signatures", CHES '11].
|
||||
*/
|
||||
template<typename T, typename FieldT>
|
||||
T multi_exp_inner(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end)
|
||||
{
|
||||
const mp_size_t n = std::remove_reference<decltype(*scalar_start)>::type::num_limbs;
|
||||
|
||||
if (vec_start == vec_end)
|
||||
{
|
||||
return T::zero();
|
||||
}
|
||||
|
||||
if (vec_start + 1 == vec_end)
|
||||
{
|
||||
return (*scalar_start)*(*vec_start);
|
||||
}
|
||||
|
||||
std::vector<ordered_exponent<n> > opt_q;
|
||||
const size_t vec_len = scalar_end - scalar_start;
|
||||
const size_t odd_vec_len = (vec_len % 2 == 1 ? vec_len : vec_len + 1);
|
||||
opt_q.reserve(odd_vec_len);
|
||||
std::vector<T> g;
|
||||
g.reserve(odd_vec_len);
|
||||
|
||||
typename std::vector<T>::const_iterator vec_it;
|
||||
typename std::vector<FieldT>::const_iterator scalar_it;
|
||||
size_t i;
|
||||
for (i=0, vec_it = vec_start, scalar_it = scalar_start; vec_it != vec_end; ++vec_it, ++scalar_it, ++i)
|
||||
{
|
||||
g.emplace_back(*vec_it);
|
||||
|
||||
opt_q.emplace_back(ordered_exponent<n>(i, scalar_it->as_bigint()));
|
||||
}
|
||||
std::make_heap(opt_q.begin(),opt_q.end());
|
||||
assert(scalar_it == scalar_end);
|
||||
|
||||
if (vec_len != odd_vec_len)
|
||||
{
|
||||
g.emplace_back(T::zero());
|
||||
opt_q.emplace_back(ordered_exponent<n>(odd_vec_len - 1, bigint<n>(0ul)));
|
||||
}
|
||||
assert(g.size() % 2 == 1);
|
||||
assert(opt_q.size() == g.size());
|
||||
|
||||
T opt_result = T::zero();
|
||||
|
||||
while (true)
|
||||
{
|
||||
ordered_exponent<n> &a = opt_q[0];
|
||||
ordered_exponent<n> &b = (opt_q[1] < opt_q[2] ? opt_q[2] : opt_q[1]);
|
||||
|
||||
const size_t abits = a.r.num_bits();
|
||||
|
||||
if (b.r.is_zero())
|
||||
{
|
||||
// opt_result = opt_result + (a.r * g[a.idx]);
|
||||
opt_result = opt_result + opt_window_wnaf_exp(g[a.idx], a.r, abits);
|
||||
break;
|
||||
}
|
||||
|
||||
const size_t bbits = b.r.num_bits();
|
||||
const size_t limit = (abits-bbits >= 20 ? 20 : abits-bbits);
|
||||
|
||||
if (bbits < 1ul<<limit)
|
||||
{
|
||||
/*
|
||||
In this case, exponentiating to the power of a is cheaper than
|
||||
subtracting b from a multiple times, so let's do it directly
|
||||
*/
|
||||
// opt_result = opt_result + (a.r * g[a.idx]);
|
||||
opt_result = opt_result + opt_window_wnaf_exp(g[a.idx], a.r, abits);
|
||||
#ifdef DEBUG
|
||||
printf("Skipping the following pair (%zu bit number vs %zu bit):\n", abits, bbits);
|
||||
a.r.print();
|
||||
b.r.print();
|
||||
#endif
|
||||
a.r.clear();
|
||||
}
|
||||
else
|
||||
{
|
||||
// x A + y B => (x-y) A + y (B+A)
|
||||
mpn_sub_n(a.r.data, a.r.data, b.r.data, n);
|
||||
g[b.idx] = g[b.idx] + g[a.idx];
|
||||
}
|
||||
|
||||
// regardless of whether a was cleared or subtracted from we push it down, then take back up
|
||||
|
||||
/* heapify A down */
|
||||
size_t a_pos = 0;
|
||||
while (2*a_pos + 2< odd_vec_len)
|
||||
{
|
||||
// this is a max-heap so to maintain a heap property we swap with the largest of the two
|
||||
if (opt_q[2*a_pos+1] < opt_q[2*a_pos+2])
|
||||
{
|
||||
std::swap(opt_q[a_pos], opt_q[2*a_pos+2]);
|
||||
a_pos = 2*a_pos+2;
|
||||
}
|
||||
else
|
||||
{
|
||||
std::swap(opt_q[a_pos], opt_q[2*a_pos+1]);
|
||||
a_pos = 2*a_pos+1;
|
||||
}
|
||||
}
|
||||
|
||||
/* now heapify A up appropriate amount of times */
|
||||
while (a_pos > 0 && opt_q[(a_pos-1)/2] < opt_q[a_pos])
|
||||
{
|
||||
std::swap(opt_q[a_pos], opt_q[(a_pos-1)/2]);
|
||||
a_pos = (a_pos-1) / 2;
|
||||
}
|
||||
}
|
||||
|
||||
return opt_result;
|
||||
}
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
T multi_exp(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end,
|
||||
const size_t chunks,
|
||||
const bool use_multiexp)
|
||||
{
|
||||
const size_t total = vec_end - vec_start;
|
||||
if (total < chunks)
|
||||
{
|
||||
return naive_exp<T, FieldT>(vec_start, vec_end, scalar_start, scalar_end);
|
||||
}
|
||||
|
||||
const size_t one = total/chunks;
|
||||
|
||||
std::vector<T> partial(chunks, T::zero());
|
||||
|
||||
if (use_multiexp)
|
||||
{
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t i = 0; i < chunks; ++i)
|
||||
{
|
||||
partial[i] = multi_exp_inner<T, FieldT>(vec_start + i*one,
|
||||
(i == chunks-1 ? vec_end : vec_start + (i+1)*one),
|
||||
scalar_start + i*one,
|
||||
(i == chunks-1 ? scalar_end : scalar_start + (i+1)*one));
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t i = 0; i < chunks; ++i)
|
||||
{
|
||||
partial[i] = naive_exp<T, FieldT>(vec_start + i*one,
|
||||
(i == chunks-1 ? vec_end : vec_start + (i+1)*one),
|
||||
scalar_start + i*one,
|
||||
(i == chunks-1 ? scalar_end : scalar_start + (i+1)*one));
|
||||
}
|
||||
}
|
||||
|
||||
T final = T::zero();
|
||||
|
||||
for (size_t i = 0; i < chunks; ++i)
|
||||
{
|
||||
final = final + partial[i];
|
||||
}
|
||||
|
||||
return final;
|
||||
}
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
T multi_exp_with_mixed_addition(typename std::vector<T>::const_iterator vec_start,
|
||||
typename std::vector<T>::const_iterator vec_end,
|
||||
typename std::vector<FieldT>::const_iterator scalar_start,
|
||||
typename std::vector<FieldT>::const_iterator scalar_end,
|
||||
const size_t chunks,
|
||||
const bool use_multiexp)
|
||||
{
|
||||
assert(std::distance(vec_start, vec_end) == std::distance(scalar_start, scalar_end));
|
||||
enter_block("Process scalar vector");
|
||||
auto value_it = vec_start;
|
||||
auto scalar_it = scalar_start;
|
||||
|
||||
const FieldT zero = FieldT::zero();
|
||||
const FieldT one = FieldT::one();
|
||||
std::vector<FieldT> p;
|
||||
std::vector<T> g;
|
||||
|
||||
T acc = T::zero();
|
||||
|
||||
size_t num_skip = 0;
|
||||
size_t num_add = 0;
|
||||
size_t num_other = 0;
|
||||
|
||||
for (; scalar_it != scalar_end; ++scalar_it, ++value_it)
|
||||
{
|
||||
if (*scalar_it == zero)
|
||||
{
|
||||
// do nothing
|
||||
++num_skip;
|
||||
}
|
||||
else if (*scalar_it == one)
|
||||
{
|
||||
#ifdef USE_MIXED_ADDITION
|
||||
acc = acc.mixed_add(*value_it);
|
||||
#else
|
||||
acc = acc + (*value_it);
|
||||
#endif
|
||||
++num_add;
|
||||
}
|
||||
else
|
||||
{
|
||||
p.emplace_back(*scalar_it);
|
||||
g.emplace_back(*value_it);
|
||||
++num_other;
|
||||
}
|
||||
}
|
||||
//print_indent(); printf("* Elements of w skipped: %zu (%0.2f%%)\n", num_skip, 100.*num_skip/(num_skip+num_add+num_other));
|
||||
//print_indent(); printf("* Elements of w processed with special addition: %zu (%0.2f%%)\n", num_add, 100.*num_add/(num_skip+num_add+num_other));
|
||||
//print_indent(); printf("* Elements of w remaining: %zu (%0.2f%%)\n", num_other, 100.*num_other/(num_skip+num_add+num_other));
|
||||
|
||||
leave_block("Process scalar vector");
|
||||
|
||||
return acc + multi_exp<T, FieldT>(g.begin(), g.end(), p.begin(), p.end(), chunks, use_multiexp);
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
size_t get_exp_window_size(const size_t num_scalars)
|
||||
{
|
||||
if (T::fixed_base_exp_window_table.empty())
|
||||
{
|
||||
#ifdef LOWMEM
|
||||
return 14;
|
||||
#else
|
||||
return 17;
|
||||
#endif
|
||||
}
|
||||
size_t window = 1;
|
||||
for (long i = T::fixed_base_exp_window_table.size()-1; i >= 0; --i)
|
||||
{
|
||||
#ifdef DEBUG
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
printf("%ld %zu %zu\n", i, num_scalars, T::fixed_base_exp_window_table[i]);
|
||||
}
|
||||
#endif
|
||||
if (T::fixed_base_exp_window_table[i] != 0 && num_scalars >= T::fixed_base_exp_window_table[i])
|
||||
{
|
||||
window = i+1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("Choosing window size %zu for %zu elements\n", window, num_scalars);
|
||||
}
|
||||
|
||||
#ifdef LOWMEM
|
||||
window = std::min((size_t)14, window);
|
||||
#endif
|
||||
return window;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
window_table<T> get_window_table(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const T &g)
|
||||
{
|
||||
const size_t in_window = 1ul<<window;
|
||||
const size_t outerc = (scalar_size+window-1)/window;
|
||||
const size_t last_in_window = 1ul<<(scalar_size - (outerc-1)*window);
|
||||
#ifdef DEBUG
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent(); printf("* scalar_size=%zu; window=%zu; in_window=%zu; outerc=%zu\n", scalar_size, window, in_window, outerc);
|
||||
}
|
||||
#endif
|
||||
|
||||
window_table<T> powers_of_g(outerc, std::vector<T>(in_window, T::zero()));
|
||||
|
||||
T gouter = g;
|
||||
|
||||
for (size_t outer = 0; outer < outerc; ++outer)
|
||||
{
|
||||
T ginner = T::zero();
|
||||
size_t cur_in_window = outer == outerc-1 ? last_in_window : in_window;
|
||||
for (size_t inner = 0; inner < cur_in_window; ++inner)
|
||||
{
|
||||
powers_of_g[outer][inner] = ginner;
|
||||
ginner = ginner + gouter;
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < window; ++i)
|
||||
{
|
||||
gouter = gouter + gouter;
|
||||
}
|
||||
}
|
||||
|
||||
return powers_of_g;
|
||||
}
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
T windowed_exp(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const window_table<T> &powers_of_g,
|
||||
const FieldT &pow)
|
||||
{
|
||||
const size_t outerc = (scalar_size+window-1)/window;
|
||||
const bigint<FieldT::num_limbs> pow_val = pow.as_bigint();
|
||||
|
||||
/* exp */
|
||||
T res = powers_of_g[0][0];
|
||||
|
||||
for (size_t outer = 0; outer < outerc; ++outer)
|
||||
{
|
||||
size_t inner = 0;
|
||||
for (size_t i = 0; i < window; ++i)
|
||||
{
|
||||
if (pow_val.test_bit(outer*window + i))
|
||||
{
|
||||
inner |= 1u << i;
|
||||
}
|
||||
}
|
||||
|
||||
res = res + powers_of_g[outer][inner];
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
std::vector<T> batch_exp(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const window_table<T> &table,
|
||||
const std::vector<FieldT> &v)
|
||||
{
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent();
|
||||
}
|
||||
std::vector<T> res(v.size(), table[0][0]);
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t i = 0; i < v.size(); ++i)
|
||||
{
|
||||
res[i] = windowed_exp(scalar_size, window, table, v[i]);
|
||||
|
||||
if (!inhibit_profiling_info && (i % 10000 == 0))
|
||||
{
|
||||
printf(".");
|
||||
fflush(stdout);
|
||||
}
|
||||
}
|
||||
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
printf(" DONE!\n");
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
template<typename T, typename FieldT>
|
||||
std::vector<T> batch_exp_with_coeff(const size_t scalar_size,
|
||||
const size_t window,
|
||||
const window_table<T> &table,
|
||||
const FieldT &coeff,
|
||||
const std::vector<FieldT> &v)
|
||||
{
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
print_indent();
|
||||
}
|
||||
std::vector<T> res(v.size(), table[0][0]);
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp parallel for
|
||||
#endif
|
||||
for (size_t i = 0; i < v.size(); ++i)
|
||||
{
|
||||
res[i] = windowed_exp(scalar_size, window, table, coeff * v[i]);
|
||||
|
||||
if (!inhibit_profiling_info && (i % 10000 == 0))
|
||||
{
|
||||
printf(".");
|
||||
fflush(stdout);
|
||||
}
|
||||
}
|
||||
|
||||
if (!inhibit_profiling_info)
|
||||
{
|
||||
printf(" DONE!\n");
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
void batch_to_special(std::vector<T> &vec)
|
||||
{
|
||||
enter_block("Batch-convert elements to special form");
|
||||
|
||||
std::vector<T> non_zero_vec;
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
if (!vec[i].is_zero())
|
||||
{
|
||||
non_zero_vec.emplace_back(vec[i]);
|
||||
}
|
||||
}
|
||||
|
||||
batch_to_special_all_non_zeros<T>(non_zero_vec);
|
||||
auto it = non_zero_vec.begin();
|
||||
T zero_special = T::zero();
|
||||
zero_special.to_special();
|
||||
|
||||
for (size_t i = 0; i < vec.size(); ++i)
|
||||
{
|
||||
if (!vec[i].is_zero())
|
||||
{
|
||||
vec[i] = *it;
|
||||
++it;
|
||||
}
|
||||
else
|
||||
{
|
||||
vec[i] = zero_special;
|
||||
}
|
||||
}
|
||||
leave_block("Batch-convert elements to special form");
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // MULTIEXP_TCC_
|
|
@ -0,0 +1,39 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for wNAF ("width-w Non-Adjacent Form") exponentiation routines.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef WNAF_HPP_
|
||||
#define WNAF_HPP_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/**
|
||||
* Find the wNAF representation of the given scalar relative to the given window size.
|
||||
*/
|
||||
template<mp_size_t n>
|
||||
std::vector<long> find_wnaf(const size_t window_size, const bigint<n> &scalar);
|
||||
|
||||
/**
|
||||
* In additive notation, use wNAF exponentiation (with the given window size) to compute scalar * base.
|
||||
*/
|
||||
template<typename T, mp_size_t n>
|
||||
T fixed_window_wnaf_exp(const size_t window_size, const T &base, const bigint<n> &scalar);
|
||||
|
||||
/**
|
||||
* In additive notation, use wNAF exponentiation (with the window size determined by T) to compute scalar * base.
|
||||
*/
|
||||
template<typename T, mp_size_t n>
|
||||
T opt_window_wnaf_exp(const T &base, const bigint<n> &scalar, const size_t scalar_bits);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "algebra/scalar_multiplication/wnaf.tcc"
|
||||
|
||||
#endif // WNAF_HPP_
|
|
@ -0,0 +1,123 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for wNAF ("weighted Non-Adjacent Form") exponentiation routines.
|
||||
|
||||
See wnaf.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef WNAF_TCC_
|
||||
#define WNAF_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<mp_size_t n>
|
||||
std::vector<long> find_wnaf(const size_t window_size, const bigint<n> &scalar)
|
||||
{
|
||||
const size_t length = scalar.max_bits(); // upper bound
|
||||
std::vector<long> res(length+1);
|
||||
bigint<n> c = scalar;
|
||||
long j = 0;
|
||||
while (!c.is_zero())
|
||||
{
|
||||
long u;
|
||||
if ((c.data[0] & 1) == 1)
|
||||
{
|
||||
u = c.data[0] % (1u << (window_size+1));
|
||||
if (u > (1 << window_size))
|
||||
{
|
||||
u = u - (1 << (window_size+1));
|
||||
}
|
||||
|
||||
if (u > 0)
|
||||
{
|
||||
mpn_sub_1(c.data, c.data, n, u);
|
||||
}
|
||||
else
|
||||
{
|
||||
mpn_add_1(c.data, c.data, n, -u);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
u = 0;
|
||||
}
|
||||
res[j] = u;
|
||||
++j;
|
||||
|
||||
mpn_rshift(c.data, c.data, n, 1); // c = c/2
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
template<typename T, mp_size_t n>
|
||||
T fixed_window_wnaf_exp(const size_t window_size, const T &base, const bigint<n> &scalar)
|
||||
{
|
||||
std::vector<long> naf = find_wnaf(window_size, scalar);
|
||||
std::vector<T> table(1ul<<(window_size-1));
|
||||
T tmp = base;
|
||||
T dbl = base.dbl();
|
||||
for (size_t i = 0; i < 1ul<<(window_size-1); ++i)
|
||||
{
|
||||
table[i] = tmp;
|
||||
tmp = tmp + dbl;
|
||||
}
|
||||
|
||||
T res = T::zero();
|
||||
bool found_nonzero = false;
|
||||
for (long i = naf.size()-1; i >= 0; --i)
|
||||
{
|
||||
if (found_nonzero)
|
||||
{
|
||||
res = res.dbl();
|
||||
}
|
||||
|
||||
if (naf[i] != 0)
|
||||
{
|
||||
found_nonzero = true;
|
||||
if (naf[i] > 0)
|
||||
{
|
||||
res = res + table[naf[i]/2];
|
||||
}
|
||||
else
|
||||
{
|
||||
res = res - table[(-naf[i])/2];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
template<typename T, mp_size_t n>
|
||||
T opt_window_wnaf_exp(const T &base, const bigint<n> &scalar, const size_t scalar_bits)
|
||||
{
|
||||
size_t best = 0;
|
||||
for (long i = T::wnaf_window_table.size() - 1; i >= 0; --i)
|
||||
{
|
||||
if (scalar_bits >= T::wnaf_window_table[i])
|
||||
{
|
||||
best = i+1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (best > 0)
|
||||
{
|
||||
return fixed_window_wnaf_exp(best, base, scalar);
|
||||
}
|
||||
else
|
||||
{
|
||||
return scalar * base;
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // WNAF_TCC_
|
|
@ -0,0 +1,12 @@
|
|||
#ifndef ASSERT_except_H
|
||||
#define ASSERT_except_H
|
||||
|
||||
#include <exception>
|
||||
|
||||
inline void assert_except(bool condition) {
|
||||
if (!condition) {
|
||||
throw std::runtime_error("Assertion failed.");
|
||||
}
|
||||
}
|
||||
|
||||
#endif
|
|
@ -0,0 +1,74 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for an accumulation vector.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef ACCUMULATION_VECTOR_HPP_
|
||||
#define ACCUMULATION_VECTOR_HPP_
|
||||
|
||||
#include "common/data_structures/sparse_vector.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T>
|
||||
class accumulation_vector;
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream &out, const accumulation_vector<T> &v);
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream &in, accumulation_vector<T> &v);
|
||||
|
||||
/**
|
||||
* An accumulation vector comprises an accumulation value and a sparse vector.
|
||||
* The method "accumulate_chunk" allows one to accumlate portions of the sparse
|
||||
* vector into the accumualation value.
|
||||
*/
|
||||
template<typename T>
|
||||
class accumulation_vector {
|
||||
public:
|
||||
T first;
|
||||
sparse_vector<T> rest;
|
||||
|
||||
accumulation_vector() = default;
|
||||
accumulation_vector(const accumulation_vector<T> &other) = default;
|
||||
accumulation_vector(accumulation_vector<T> &&other) = default;
|
||||
accumulation_vector(T &&first, sparse_vector<T> &&rest) : first(std::move(first)), rest(std::move(rest)) {};
|
||||
accumulation_vector(T &&first, std::vector<T> &&v) : first(std::move(first)), rest(std::move(v)) {}
|
||||
accumulation_vector(std::vector<T> &&v) : first(T::zero()), rest(std::move(v)) {};
|
||||
|
||||
accumulation_vector<T>& operator=(const accumulation_vector<T> &other) = default;
|
||||
accumulation_vector<T>& operator=(accumulation_vector<T> &&other) = default;
|
||||
|
||||
bool operator==(const accumulation_vector<T> &other) const;
|
||||
|
||||
bool is_fully_accumulated() const;
|
||||
|
||||
size_t domain_size() const;
|
||||
size_t size() const;
|
||||
size_t size_in_bits() const;
|
||||
|
||||
template<typename FieldT>
|
||||
accumulation_vector<T> accumulate_chunk(const typename std::vector<FieldT>::const_iterator &it_begin,
|
||||
const typename std::vector<FieldT>::const_iterator &it_end,
|
||||
const size_t offset) const;
|
||||
|
||||
};
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream &out, const accumulation_vector<T> &v);
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream &in, accumulation_vector<T> &v);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "common/data_structures/accumulation_vector.tcc"
|
||||
|
||||
#endif // ACCUMULATION_VECTOR_HPP_
|
|
@ -0,0 +1,84 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for an accumulation vector.
|
||||
|
||||
See accumulation_vector.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef ACCUMULATION_VECTOR_TCC_
|
||||
#define ACCUMULATION_VECTOR_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T>
|
||||
bool accumulation_vector<T>::operator==(const accumulation_vector<T> &other) const
|
||||
{
|
||||
return (this->first == other.first && this->rest == other.rest);
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
bool accumulation_vector<T>::is_fully_accumulated() const
|
||||
{
|
||||
return rest.empty();
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
size_t accumulation_vector<T>::domain_size() const
|
||||
{
|
||||
return rest.domain_size();
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
size_t accumulation_vector<T>::size() const
|
||||
{
|
||||
return rest.domain_size();
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
size_t accumulation_vector<T>::size_in_bits() const
|
||||
{
|
||||
const size_t first_size_in_bits = T::size_in_bits();
|
||||
const size_t rest_size_in_bits = rest.size_in_bits();
|
||||
return first_size_in_bits + rest_size_in_bits;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
template<typename FieldT>
|
||||
accumulation_vector<T> accumulation_vector<T>::accumulate_chunk(const typename std::vector<FieldT>::const_iterator &it_begin,
|
||||
const typename std::vector<FieldT>::const_iterator &it_end,
|
||||
const size_t offset) const
|
||||
{
|
||||
std::pair<T, sparse_vector<T> > acc_result = rest.template accumulate<FieldT>(it_begin, it_end, offset);
|
||||
T new_first = first + acc_result.first;
|
||||
return accumulation_vector<T>(std::move(new_first), std::move(acc_result.second));
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream& out, const accumulation_vector<T> &v)
|
||||
{
|
||||
out << v.first << OUTPUT_NEWLINE;
|
||||
out << v.rest << OUTPUT_NEWLINE;
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream& in, accumulation_vector<T> &v)
|
||||
{
|
||||
in >> v.first;
|
||||
consume_OUTPUT_NEWLINE(in);
|
||||
in >> v.rest;
|
||||
consume_OUTPUT_NEWLINE(in);
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // ACCUMULATION_VECTOR_TCC_
|
|
@ -0,0 +1,71 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for a Merkle tree.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_TREE_HPP_
|
||||
#define MERKLE_TREE_HPP_
|
||||
|
||||
#include <map>
|
||||
#include <vector>
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/**
|
||||
* A Merkle tree is maintained as two maps:
|
||||
* - a map from addresses to values, and
|
||||
* - a map from addresses to hashes.
|
||||
*
|
||||
* The second map maintains the intermediate hashes of a Merkle tree
|
||||
* built atop the values currently stored in the tree (the
|
||||
* implementation admits a very efficient support for sparse
|
||||
* trees). Besides offering methods to load and store values, the
|
||||
* class offers methods to retrieve the root of the Merkle tree and to
|
||||
* obtain the authentication paths for (the value at) a given address.
|
||||
*/
|
||||
|
||||
typedef bit_vector merkle_authentication_node;
|
||||
typedef std::vector<merkle_authentication_node> merkle_authentication_path;
|
||||
|
||||
template<typename HashT>
|
||||
class merkle_tree {
|
||||
private:
|
||||
|
||||
typedef typename HashT::hash_value_type hash_value_type;
|
||||
typedef typename HashT::merkle_authentication_path_type merkle_authentication_path_type;
|
||||
|
||||
public:
|
||||
|
||||
std::vector<hash_value_type> hash_defaults;
|
||||
std::map<size_t, bit_vector> values;
|
||||
std::map<size_t, hash_value_type> hashes;
|
||||
|
||||
size_t depth;
|
||||
size_t value_size;
|
||||
size_t digest_size;
|
||||
|
||||
merkle_tree(const size_t depth, const size_t value_size);
|
||||
merkle_tree(const size_t depth, const size_t value_size, const std::vector<bit_vector> &contents_as_vector);
|
||||
merkle_tree(const size_t depth, const size_t value_size, const std::map<size_t, bit_vector> &contents);
|
||||
|
||||
bit_vector get_value(const size_t address) const;
|
||||
void set_value(const size_t address, const bit_vector &value);
|
||||
|
||||
hash_value_type get_root() const;
|
||||
merkle_authentication_path_type get_path(const size_t address) const;
|
||||
|
||||
void dump() const;
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "common/data_structures/merkle_tree.tcc"
|
||||
|
||||
#endif // MERKLE_TREE_HPP_
|
|
@ -0,0 +1,246 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for Merkle tree.
|
||||
|
||||
See merkle_tree.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_TREE_TCC
|
||||
#define MERKLE_TREE_TCC
|
||||
|
||||
#include <algorithm>
|
||||
|
||||
#include "common/profiling.hpp"
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename HashT>
|
||||
typename HashT::hash_value_type two_to_one_CRH(const typename HashT::hash_value_type &l,
|
||||
const typename HashT::hash_value_type &r)
|
||||
{
|
||||
typename HashT::hash_value_type new_input;
|
||||
new_input.insert(new_input.end(), l.begin(), l.end());
|
||||
new_input.insert(new_input.end(), r.begin(), r.end());
|
||||
|
||||
const size_t digest_size = HashT::get_digest_len();
|
||||
assert(l.size() == digest_size);
|
||||
assert(r.size() == digest_size);
|
||||
|
||||
return HashT::get_hash(new_input);
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
merkle_tree<HashT>::merkle_tree(const size_t depth, const size_t value_size) :
|
||||
depth(depth), value_size(value_size)
|
||||
{
|
||||
assert(depth < sizeof(size_t) * 8);
|
||||
|
||||
digest_size = HashT::get_digest_len();
|
||||
assert(value_size <= digest_size);
|
||||
|
||||
hash_value_type last(digest_size);
|
||||
hash_defaults.reserve(depth+1);
|
||||
hash_defaults.emplace_back(last);
|
||||
for (size_t i = 0; i < depth; ++i)
|
||||
{
|
||||
last = two_to_one_CRH<HashT>(last, last);
|
||||
hash_defaults.emplace_back(last);
|
||||
}
|
||||
|
||||
std::reverse(hash_defaults.begin(), hash_defaults.end());
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
merkle_tree<HashT>::merkle_tree(const size_t depth,
|
||||
const size_t value_size,
|
||||
const std::vector<bit_vector> &contents_as_vector) :
|
||||
merkle_tree<HashT>(depth, value_size)
|
||||
{
|
||||
assert(log2(contents_as_vector.size()) <= depth);
|
||||
for (size_t address = 0; address < contents_as_vector.size(); ++address)
|
||||
{
|
||||
const size_t idx = address + (1ul<<depth) - 1;
|
||||
values[idx] = contents_as_vector[address];
|
||||
hashes[idx] = contents_as_vector[address];
|
||||
hashes[idx].resize(digest_size);
|
||||
}
|
||||
|
||||
size_t idx_begin = (1ul<<depth) - 1;
|
||||
size_t idx_end = contents_as_vector.size() + ((1ul<<depth) - 1);
|
||||
|
||||
for (int layer = depth; layer > 0; --layer)
|
||||
{
|
||||
for (size_t idx = idx_begin; idx < idx_end; idx += 2)
|
||||
{
|
||||
hash_value_type l = hashes[idx]; // this is sound, because idx_begin is always a left child
|
||||
hash_value_type r = (idx + 1 < idx_end ? hashes[idx+1] : hash_defaults[layer]);
|
||||
|
||||
hash_value_type h = two_to_one_CRH<HashT>(l, r);
|
||||
hashes[(idx-1)/2] = h;
|
||||
}
|
||||
|
||||
idx_begin = (idx_begin-1)/2;
|
||||
idx_end = (idx_end-1)/2;
|
||||
}
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
merkle_tree<HashT>::merkle_tree(const size_t depth,
|
||||
const size_t value_size,
|
||||
const std::map<size_t, bit_vector> &contents) :
|
||||
merkle_tree<HashT>(depth, value_size)
|
||||
{
|
||||
|
||||
if (!contents.empty())
|
||||
{
|
||||
assert(contents.rbegin()->first < 1ul<<depth);
|
||||
|
||||
for (auto it = contents.begin(); it != contents.end(); ++it)
|
||||
{
|
||||
const size_t address = it->first;
|
||||
const bit_vector value = it->second;
|
||||
const size_t idx = address + (1ul<<depth) - 1;
|
||||
|
||||
values[address] = value;
|
||||
hashes[idx] = value;
|
||||
hashes[idx].resize(digest_size);
|
||||
}
|
||||
|
||||
auto last_it = hashes.end();
|
||||
|
||||
for (int layer = depth; layer > 0; --layer)
|
||||
{
|
||||
auto next_last_it = hashes.begin();
|
||||
|
||||
for (auto it = hashes.begin(); it != last_it; ++it)
|
||||
{
|
||||
const size_t idx = it->first;
|
||||
const hash_value_type hash = it->second;
|
||||
|
||||
if (idx % 2 == 0)
|
||||
{
|
||||
// this is the right child of its parent and by invariant we are missing the left child
|
||||
hashes[(idx-1)/2] = two_to_one_CRH<HashT>(hash_defaults[layer], hash);
|
||||
}
|
||||
else
|
||||
{
|
||||
if (std::next(it) == last_it || std::next(it)->first != idx + 1)
|
||||
{
|
||||
// this is the left child of its parent and is missing its right child
|
||||
hashes[(idx-1)/2] = two_to_one_CRH<HashT>(hash, hash_defaults[layer]);
|
||||
}
|
||||
else
|
||||
{
|
||||
// typical case: this is the left child of the parent and adjecent to it there is a right child
|
||||
hashes[(idx-1)/2] = two_to_one_CRH<HashT>(hash, std::next(it)->second);
|
||||
++it;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
last_it = next_last_it;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
bit_vector merkle_tree<HashT>::get_value(const size_t address) const
|
||||
{
|
||||
assert(log2(address) <= depth);
|
||||
|
||||
auto it = values.find(address);
|
||||
bit_vector padded_result = (it == values.end() ? bit_vector(digest_size) : it->second);
|
||||
padded_result.resize(value_size);
|
||||
|
||||
return padded_result;
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
void merkle_tree<HashT>::set_value(const size_t address,
|
||||
const bit_vector &value)
|
||||
{
|
||||
assert(log2(address) <= depth);
|
||||
size_t idx = address + (1ul<<depth) - 1;
|
||||
|
||||
assert(value.size() == value_size);
|
||||
values[address] = value;
|
||||
hashes[idx] = value;
|
||||
hashes[idx].resize(digest_size);
|
||||
|
||||
for (int layer = depth-1; layer >=0; --layer)
|
||||
{
|
||||
idx = (idx-1)/2;
|
||||
|
||||
auto it = hashes.find(2*idx+1);
|
||||
hash_value_type l = (it == hashes.end() ? hash_defaults[layer+1] : it->second);
|
||||
|
||||
it = hashes.find(2*idx+2);
|
||||
hash_value_type r = (it == hashes.end() ? hash_defaults[layer+1] : it->second);
|
||||
|
||||
hash_value_type h = two_to_one_CRH<HashT>(l, r);
|
||||
hashes[idx] = h;
|
||||
}
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
typename HashT::hash_value_type merkle_tree<HashT>::get_root() const
|
||||
{
|
||||
auto it = hashes.find(0);
|
||||
return (it == hashes.end() ? hash_defaults[0] : it->second);
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
typename HashT::merkle_authentication_path_type merkle_tree<HashT>::get_path(const size_t address) const
|
||||
{
|
||||
typename HashT::merkle_authentication_path_type result(depth);
|
||||
assert(log2(address) <= depth);
|
||||
size_t idx = address + (1ul<<depth) - 1;
|
||||
|
||||
for (size_t layer = depth; layer > 0; --layer)
|
||||
{
|
||||
size_t sibling_idx = ((idx + 1) ^ 1) - 1;
|
||||
auto it = hashes.find(sibling_idx);
|
||||
if (layer == depth)
|
||||
{
|
||||
auto it2 = values.find(sibling_idx - ((1ul<<depth) - 1));
|
||||
result[layer-1] = (it2 == values.end() ? bit_vector(value_size, false) : it2->second);
|
||||
result[layer-1].resize(digest_size);
|
||||
}
|
||||
else
|
||||
{
|
||||
result[layer-1] = (it == hashes.end() ? hash_defaults[layer] : it->second);
|
||||
}
|
||||
|
||||
idx = (idx-1)/2;
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename HashT>
|
||||
void merkle_tree<HashT>::dump() const
|
||||
{
|
||||
for (size_t i = 0; i < 1ul<<depth; ++i)
|
||||
{
|
||||
auto it = values.find(i);
|
||||
printf("[%zu] -> ", i);
|
||||
const bit_vector value = (it == values.end() ? bit_vector(value_size) : it->second);
|
||||
for (bool b : value)
|
||||
{
|
||||
printf("%d", b ? 1 : 0);
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // MERKLE_TREE_TCC
|
|
@ -0,0 +1,79 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for a sparse vector.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SPARSE_VECTOR_HPP_
|
||||
#define SPARSE_VECTOR_HPP_
|
||||
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T>
|
||||
struct sparse_vector;
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream &out, const sparse_vector<T> &v);
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream &in, sparse_vector<T> &v);
|
||||
|
||||
/**
|
||||
* A sparse vector is a list of indices along with corresponding values.
|
||||
* The indices are selected from the set {0,1,...,domain_size-1}.
|
||||
*/
|
||||
template<typename T>
|
||||
struct sparse_vector {
|
||||
|
||||
std::vector<size_t> indices;
|
||||
std::vector<T> values;
|
||||
size_t domain_size_ = 0;
|
||||
|
||||
sparse_vector() = default;
|
||||
sparse_vector(const sparse_vector<T> &other) = default;
|
||||
sparse_vector(sparse_vector<T> &&other) = default;
|
||||
sparse_vector(std::vector<T> &&v); /* constructor from std::vector */
|
||||
|
||||
sparse_vector<T>& operator=(const sparse_vector<T> &other) = default;
|
||||
sparse_vector<T>& operator=(sparse_vector<T> &&other) = default;
|
||||
|
||||
T operator[](const size_t idx) const;
|
||||
|
||||
bool operator==(const sparse_vector<T> &other) const;
|
||||
bool operator==(const std::vector<T> &other) const;
|
||||
|
||||
bool is_valid() const;
|
||||
bool empty() const;
|
||||
|
||||
size_t domain_size() const; // return domain_size_
|
||||
size_t size() const; // return the number of indices (representing the number of non-zero entries)
|
||||
size_t size_in_bits() const; // return the number bits needed to store the sparse vector
|
||||
|
||||
/* return a pair consisting of the accumulated value and the sparse vector of non-accumuated values */
|
||||
template<typename FieldT>
|
||||
std::pair<T, sparse_vector<T> > accumulate(const typename std::vector<FieldT>::const_iterator &it_begin,
|
||||
const typename std::vector<FieldT>::const_iterator &it_end,
|
||||
const size_t offset) const;
|
||||
|
||||
friend std::ostream& operator<< <T>(std::ostream &out, const sparse_vector<T> &v);
|
||||
friend std::istream& operator>> <T>(std::istream &in, sparse_vector<T> &v);
|
||||
};
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream& out, const sparse_vector<T> &v);
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream& in, sparse_vector<T> &v);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "common/data_structures/sparse_vector.tcc"
|
||||
|
||||
#endif // SPARSE_VECTOR_HPP_
|
|
@ -0,0 +1,316 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for a sparse vector.
|
||||
|
||||
See sparse_vector.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SPARSE_VECTOR_TCC_
|
||||
#define SPARSE_VECTOR_TCC_
|
||||
|
||||
#include "algebra/scalar_multiplication/multiexp.hpp"
|
||||
|
||||
#include <numeric>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T>
|
||||
sparse_vector<T>::sparse_vector(std::vector<T> &&v) :
|
||||
values(std::move(v)), domain_size_(values.size())
|
||||
{
|
||||
indices.resize(domain_size_);
|
||||
std::iota(indices.begin(), indices.end(), 0);
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
T sparse_vector<T>::operator[](const size_t idx) const
|
||||
{
|
||||
auto it = std::lower_bound(indices.begin(), indices.end(), idx);
|
||||
return (it != indices.end() && *it == idx) ? values[it - indices.begin()] : T();
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
bool sparse_vector<T>::operator==(const sparse_vector<T> &other) const
|
||||
{
|
||||
if (this->domain_size_ != other.domain_size_)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
size_t this_pos = 0, other_pos = 0;
|
||||
while (this_pos < this->indices.size() && other_pos < other.indices.size())
|
||||
{
|
||||
if (this->indices[this_pos] == other.indices[other_pos])
|
||||
{
|
||||
if (this->values[this_pos] != other.values[other_pos])
|
||||
{
|
||||
return false;
|
||||
}
|
||||
++this_pos;
|
||||
++other_pos;
|
||||
}
|
||||
else if (this->indices[this_pos] < other.indices[other_pos])
|
||||
{
|
||||
if (!this->values[this_pos].is_zero())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
++this_pos;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!other.values[other_pos].is_zero())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
++other_pos;
|
||||
}
|
||||
}
|
||||
|
||||
/* at least one of the vectors has been exhausted, so other must be empty */
|
||||
while (this_pos < this->indices.size())
|
||||
{
|
||||
if (!this->values[this_pos].is_zero())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
++this_pos;
|
||||
}
|
||||
|
||||
while (other_pos < other.indices.size())
|
||||
{
|
||||
if (!other.values[other_pos].is_zero())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
++other_pos;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
bool sparse_vector<T>::operator==(const std::vector<T> &other) const
|
||||
{
|
||||
if (this->domain_size_ < other.size())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
size_t j = 0;
|
||||
for (size_t i = 0; i < other.size(); ++i)
|
||||
{
|
||||
if (this->indices[j] == i)
|
||||
{
|
||||
if (this->values[j] != other[j])
|
||||
{
|
||||
return false;
|
||||
}
|
||||
++j;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!other[j].is_zero())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
bool sparse_vector<T>::is_valid() const
|
||||
{
|
||||
if (values.size() == indices.size() && values.size() <= domain_size_)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
for (size_t i = 0; i + 1 < indices.size(); ++i)
|
||||
{
|
||||
if (indices[i] >= indices[i+1])
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
if (!indices.empty() && indices[indices.size()-1] >= domain_size_)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
bool sparse_vector<T>::empty() const
|
||||
{
|
||||
return indices.empty();
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
size_t sparse_vector<T>::domain_size() const
|
||||
{
|
||||
return domain_size_;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
size_t sparse_vector<T>::size() const
|
||||
{
|
||||
return indices.size();
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
size_t sparse_vector<T>::size_in_bits() const
|
||||
{
|
||||
return indices.size() * (sizeof(size_t) * 8 + T::size_in_bits());
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
template<typename FieldT>
|
||||
std::pair<T, sparse_vector<T> > sparse_vector<T>::accumulate(const typename std::vector<FieldT>::const_iterator &it_begin,
|
||||
const typename std::vector<FieldT>::const_iterator &it_end,
|
||||
const size_t offset) const
|
||||
{
|
||||
// TODO: does not really belong here.
|
||||
const size_t chunks = 1;
|
||||
const bool use_multiexp = true;
|
||||
|
||||
T accumulated_value = T::zero();
|
||||
sparse_vector<T> resulting_vector;
|
||||
resulting_vector.domain_size_ = domain_size_;
|
||||
|
||||
const size_t range_len = it_end - it_begin;
|
||||
bool in_block = false;
|
||||
size_t first_pos = -1, last_pos = -1; // g++ -flto emits unitialized warning, even though in_block guards for such cases.
|
||||
|
||||
for (size_t i = 0; i < indices.size(); ++i)
|
||||
{
|
||||
const bool matching_pos = (offset <= indices[i] && indices[i] < offset + range_len);
|
||||
// printf("i = %zu, pos[i] = %zu, offset = %zu, w_size = %zu\n", i, indices[i], offset, w_size);
|
||||
bool copy_over;
|
||||
|
||||
if (in_block)
|
||||
{
|
||||
if (matching_pos && last_pos == i-1)
|
||||
{
|
||||
// block can be extended, do it
|
||||
last_pos = i;
|
||||
copy_over = false;
|
||||
}
|
||||
else
|
||||
{
|
||||
// block has ended here
|
||||
in_block = false;
|
||||
copy_over = true;
|
||||
|
||||
#ifdef DEBUG
|
||||
print_indent(); printf("doing multiexp for w_%zu ... w_%zu\n", indices[first_pos], indices[last_pos]);
|
||||
#endif
|
||||
accumulated_value = accumulated_value + multi_exp<T, FieldT>(values.begin() + first_pos,
|
||||
values.begin() + last_pos + 1,
|
||||
it_begin + (indices[first_pos] - offset),
|
||||
it_begin + (indices[last_pos] - offset) + 1,
|
||||
chunks, use_multiexp);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
if (matching_pos)
|
||||
{
|
||||
// block can be started
|
||||
first_pos = i;
|
||||
last_pos = i;
|
||||
in_block = true;
|
||||
copy_over = false;
|
||||
}
|
||||
else
|
||||
{
|
||||
copy_over = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (copy_over)
|
||||
{
|
||||
resulting_vector.indices.emplace_back(indices[i]);
|
||||
resulting_vector.values.emplace_back(values[i]);
|
||||
}
|
||||
}
|
||||
|
||||
if (in_block)
|
||||
{
|
||||
#ifdef DEBUG
|
||||
print_indent(); printf("doing multiexp for w_%zu ... w_%zu\n", indices[first_pos], indices[last_pos]);
|
||||
#endif
|
||||
accumulated_value = accumulated_value + multi_exp<T, FieldT>(values.begin() + first_pos,
|
||||
values.begin() + last_pos + 1,
|
||||
it_begin + (indices[first_pos] - offset),
|
||||
it_begin + (indices[last_pos] - offset) + 1,
|
||||
chunks, use_multiexp);
|
||||
}
|
||||
|
||||
return std::make_pair(accumulated_value, resulting_vector);
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream& out, const sparse_vector<T> &v)
|
||||
{
|
||||
out << v.domain_size_ << "\n";
|
||||
out << v.indices.size() << "\n";
|
||||
for (const size_t& i : v.indices)
|
||||
{
|
||||
out << i << "\n";
|
||||
}
|
||||
|
||||
out << v.values.size() << "\n";
|
||||
for (const T& t : v.values)
|
||||
{
|
||||
out << t << OUTPUT_NEWLINE;
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream& in, sparse_vector<T> &v)
|
||||
{
|
||||
in >> v.domain_size_;
|
||||
consume_newline(in);
|
||||
|
||||
size_t s;
|
||||
in >> s;
|
||||
consume_newline(in);
|
||||
v.indices.resize(s);
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
in >> v.indices[i];
|
||||
consume_newline(in);
|
||||
}
|
||||
|
||||
v.values.clear();
|
||||
in >> s;
|
||||
consume_newline(in);
|
||||
v.values.reserve(s);
|
||||
|
||||
for (size_t i = 0; i < s; ++i)
|
||||
{
|
||||
T t;
|
||||
in >> t;
|
||||
consume_OUTPUT_NEWLINE(in);
|
||||
v.values.emplace_back(t);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // SPARSE_VECTOR_TCC_
|
|
@ -0,0 +1,53 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
This file defines default_ec_pp based on the CURVE=... make flag, which selects
|
||||
which elliptic curve is used to implement group arithmetic and pairings.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef EC_PP_HPP_
|
||||
#define EC_PP_HPP_
|
||||
|
||||
/************************ Pick the elliptic curve ****************************/
|
||||
|
||||
#ifdef CURVE_ALT_BN128
|
||||
#include "algebra/curves/alt_bn128/alt_bn128_pp.hpp"
|
||||
namespace libsnark {
|
||||
typedef alt_bn128_pp default_ec_pp;
|
||||
} // libsnark
|
||||
#endif
|
||||
|
||||
#ifdef CURVE_BN128
|
||||
#include "algebra/curves/bn128/bn128_pp.hpp"
|
||||
namespace libsnark {
|
||||
typedef bn128_pp default_ec_pp;
|
||||
} // libsnark
|
||||
#endif
|
||||
|
||||
#ifdef CURVE_EDWARDS
|
||||
#include "algebra/curves/edwards/edwards_pp.hpp"
|
||||
namespace libsnark {
|
||||
typedef edwards_pp default_ec_pp;
|
||||
} // libsnark
|
||||
#endif
|
||||
|
||||
#ifdef CURVE_MNT4
|
||||
#include "algebra/curves/mnt/mnt4/mnt4_pp.hpp"
|
||||
namespace libsnark {
|
||||
typedef mnt4_pp default_ec_pp;
|
||||
} // libsnark
|
||||
#endif
|
||||
|
||||
#ifdef CURVE_MNT6
|
||||
#include "algebra/curves/mnt/mnt6/mnt6_pp.hpp"
|
||||
namespace libsnark {
|
||||
typedef mnt6_pp default_ec_pp;
|
||||
} // libsnark
|
||||
#endif
|
||||
|
||||
#endif // EC_PP_HPP_
|
|
@ -0,0 +1,22 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
This file defines default_r1cs_ppzksnark_pp based on the elliptic curve
|
||||
choice selected in ec_pp.hpp.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef R1CS_PPZKSNARK_PP_HPP_
|
||||
#define R1CS_PPZKSNARK_PP_HPP_
|
||||
|
||||
#include "common/default_types/ec_pp.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
typedef default_ec_pp default_r1cs_ppzksnark_pp;
|
||||
} // libsnark
|
||||
|
||||
#endif // R1CS_PPZKSNARK_PP_HPP_
|
|
@ -0,0 +1,379 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of functions for profiling code blocks.
|
||||
|
||||
See profiling.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "common/profiling.hpp"
|
||||
#include <cassert>
|
||||
#include <stdexcept>
|
||||
#include <chrono>
|
||||
#include <cstdio>
|
||||
#include <list>
|
||||
#include <vector>
|
||||
#include <ctime>
|
||||
#include "common/default_types/ec_pp.hpp"
|
||||
#include "common/utils.hpp"
|
||||
|
||||
#ifndef NO_PROCPS
|
||||
#include <proc/readproc.h>
|
||||
#endif
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
long long get_nsec_time()
|
||||
{
|
||||
auto timepoint = std::chrono::high_resolution_clock::now();
|
||||
return std::chrono::duration_cast<std::chrono::nanoseconds>(timepoint.time_since_epoch()).count();
|
||||
}
|
||||
|
||||
/* Return total CPU time consumsed by all threads of the process, in nanoseconds. */
|
||||
long long get_nsec_cpu_time()
|
||||
{
|
||||
::timespec ts;
|
||||
if ( ::clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &ts) )
|
||||
throw ::std::runtime_error("clock_gettime(CLOCK_PROCESS_CPUTIME_ID) failed");
|
||||
// If we expected this to work, don't silently ignore failures, because that would hide the problem and incur an unnecessarily system-call overhead. So if we ever observe this exception, we should probably add a suitable #ifdef .
|
||||
//TODO: clock_gettime(CLOCK_PROCESS_CPUTIME_ID) is not supported by native Windows. What about Cygwin? Should we #ifdef on CLOCK_PROCESS_CPUTIME_ID or on __linux__?
|
||||
return ts.tv_sec * 1000000000ll + ts.tv_nsec;
|
||||
}
|
||||
|
||||
long long start_time, last_time;
|
||||
long long start_cpu_time, last_cpu_time;
|
||||
|
||||
void start_profiling()
|
||||
{
|
||||
printf("Reset time counters for profiling\n");
|
||||
|
||||
last_time = start_time = get_nsec_time();
|
||||
last_cpu_time = start_cpu_time = get_nsec_cpu_time();
|
||||
}
|
||||
|
||||
std::map<std::string, size_t> invocation_counts;
|
||||
std::map<std::string, long long> enter_times;
|
||||
std::map<std::string, long long> last_times;
|
||||
std::map<std::string, long long> cumulative_times;
|
||||
//TODO: Instead of analogous maps for time and cpu_time, use a single struct-valued map
|
||||
std::map<std::string, long long> enter_cpu_times;
|
||||
std::map<std::string, long long> last_cpu_times;
|
||||
std::map<std::pair<std::string, std::string>, long long> op_counts;
|
||||
std::map<std::pair<std::string, std::string>, long long> cumulative_op_counts; // ((msg, data_point), value)
|
||||
// TODO: Convert op_counts and cumulative_op_counts from pair to structs
|
||||
size_t indentation = 0;
|
||||
|
||||
std::vector<std::string> block_names;
|
||||
|
||||
std::list<std::pair<std::string, long long*> > op_data_points = {
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
std::make_pair("Fradd", &Fr<default_ec_pp>::add_cnt),
|
||||
std::make_pair("Frsub", &Fr<default_ec_pp>::sub_cnt),
|
||||
std::make_pair("Frmul", &Fr<default_ec_pp>::mul_cnt),
|
||||
std::make_pair("Frinv", &Fr<default_ec_pp>::inv_cnt),
|
||||
std::make_pair("Fqadd", &Fq<default_ec_pp>::add_cnt),
|
||||
std::make_pair("Fqsub", &Fq<default_ec_pp>::sub_cnt),
|
||||
std::make_pair("Fqmul", &Fq<default_ec_pp>::mul_cnt),
|
||||
std::make_pair("Fqinv", &Fq<default_ec_pp>::inv_cnt),
|
||||
std::make_pair("G1add", &G1<default_ec_pp>::add_cnt),
|
||||
std::make_pair("G1dbl", &G1<default_ec_pp>::dbl_cnt),
|
||||
std::make_pair("G2add", &G2<default_ec_pp>::add_cnt),
|
||||
std::make_pair("G2dbl", &G2<default_ec_pp>::dbl_cnt)
|
||||
#endif
|
||||
};
|
||||
|
||||
bool inhibit_profiling_info = false;
|
||||
bool inhibit_profiling_counters = false;
|
||||
|
||||
void clear_profiling_counters()
|
||||
{
|
||||
invocation_counts.clear();
|
||||
last_times.clear();
|
||||
last_cpu_times.clear();
|
||||
cumulative_times.clear();
|
||||
}
|
||||
|
||||
void print_cumulative_time_entry(const std::string &key, const long long factor)
|
||||
{
|
||||
const double total_ms = (cumulative_times.at(key) * 1e-6);
|
||||
const size_t cnt = invocation_counts.at(key);
|
||||
const double avg_ms = total_ms / cnt;
|
||||
printf(" %-45s: %12.5fms = %lld * %0.5fms (%zu invocations, %0.5fms = %lld * %0.5fms per invocation)\n", key.c_str(), total_ms, factor, total_ms/factor, cnt, avg_ms, factor, avg_ms/factor);
|
||||
}
|
||||
|
||||
void print_cumulative_times(const long long factor)
|
||||
{
|
||||
printf("Dumping times:\n");
|
||||
for (auto& kv : cumulative_times)
|
||||
{
|
||||
print_cumulative_time_entry(kv.first, factor);
|
||||
}
|
||||
}
|
||||
|
||||
void print_cumulative_op_counts(const bool only_fq)
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
printf("Dumping operation counts:\n");
|
||||
for (auto& msg : invocation_counts)
|
||||
{
|
||||
printf(" %-45s: ", msg.first.c_str());
|
||||
bool first = true;
|
||||
for (auto& data_point : op_data_points)
|
||||
{
|
||||
if (only_fq && data_point.first.compare(0, 2, "Fq") != 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
if (!first)
|
||||
{
|
||||
printf(", ");
|
||||
}
|
||||
printf("%-5s = %7.0f (%3zu)",
|
||||
data_point.first.c_str(),
|
||||
1. * cumulative_op_counts[std::make_pair(msg.first, data_point.first)] / msg.second,
|
||||
msg.second);
|
||||
first = false;
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
#else
|
||||
UNUSED(only_fq);
|
||||
#endif
|
||||
}
|
||||
|
||||
void print_op_profiling(const std::string &msg)
|
||||
{
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
printf("\n");
|
||||
print_indent();
|
||||
|
||||
printf("(opcounts) = (");
|
||||
bool first = true;
|
||||
for (std::pair<std::string, long long*> p : op_data_points)
|
||||
{
|
||||
if (!first)
|
||||
{
|
||||
printf(", ");
|
||||
}
|
||||
|
||||
printf("%s=%lld", p.first.c_str(), *(p.second)-op_counts[std::make_pair(msg, p.first)]);
|
||||
first = false;
|
||||
}
|
||||
printf(")");
|
||||
#else
|
||||
UNUSED(msg);
|
||||
#endif
|
||||
}
|
||||
|
||||
static void print_times_from_last_and_start(long long now, long long last,
|
||||
long long cpu_now, long long cpu_last)
|
||||
{
|
||||
long long time_from_start = now - start_time;
|
||||
long long time_from_last = now - last;
|
||||
|
||||
long long cpu_time_from_start = cpu_now - start_cpu_time;
|
||||
long long cpu_time_from_last = cpu_now - cpu_last;
|
||||
|
||||
if (time_from_last != 0) {
|
||||
double parallelism_from_last = 1.0 * cpu_time_from_last / time_from_last;
|
||||
printf("[%0.4fs x%0.2f]", time_from_last * 1e-9, parallelism_from_last);
|
||||
} else {
|
||||
printf("[ ]");
|
||||
}
|
||||
if (time_from_start != 0) {
|
||||
double parallelism_from_start = 1.0 * cpu_time_from_start / time_from_start;
|
||||
printf("\t(%0.4fs x%0.2f from start)", time_from_start * 1e-9, parallelism_from_start);
|
||||
}
|
||||
}
|
||||
|
||||
void print_time(const char* msg)
|
||||
{
|
||||
if (inhibit_profiling_info)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
long long now = get_nsec_time();
|
||||
long long cpu_now = get_nsec_cpu_time();
|
||||
|
||||
printf("%-35s\t", msg);
|
||||
print_times_from_last_and_start(now, last_time, cpu_now, last_cpu_time);
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
print_op_profiling(msg);
|
||||
#endif
|
||||
printf("\n");
|
||||
|
||||
fflush(stdout);
|
||||
last_time = now;
|
||||
last_cpu_time = cpu_now;
|
||||
}
|
||||
|
||||
void print_header(const char *msg)
|
||||
{
|
||||
printf("\n================================================================================\n");
|
||||
printf("%s\n", msg);
|
||||
printf("================================================================================\n\n");
|
||||
}
|
||||
|
||||
void print_indent()
|
||||
{
|
||||
for (size_t i = 0; i < indentation; ++i)
|
||||
{
|
||||
printf(" ");
|
||||
}
|
||||
}
|
||||
|
||||
void op_profiling_enter(const std::string &msg)
|
||||
{
|
||||
for (std::pair<std::string, long long*> p : op_data_points)
|
||||
{
|
||||
op_counts[std::make_pair(msg, p.first)] = *(p.second);
|
||||
}
|
||||
}
|
||||
|
||||
void enter_block(const std::string &msg, const bool indent)
|
||||
{
|
||||
if (inhibit_profiling_counters)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
block_names.emplace_back(msg);
|
||||
long long t = get_nsec_time();
|
||||
enter_times[msg] = t;
|
||||
long long cpu_t = get_nsec_cpu_time();
|
||||
enter_cpu_times[msg] = cpu_t;
|
||||
|
||||
if (inhibit_profiling_info)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp critical
|
||||
#endif
|
||||
{
|
||||
op_profiling_enter(msg);
|
||||
|
||||
print_indent();
|
||||
printf("(enter) %-35s\t", msg.c_str());
|
||||
print_times_from_last_and_start(t, t, cpu_t, cpu_t);
|
||||
printf("\n");
|
||||
fflush(stdout);
|
||||
|
||||
if (indent)
|
||||
{
|
||||
++indentation;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void leave_block(const std::string &msg, const bool indent)
|
||||
{
|
||||
if (inhibit_profiling_counters)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
#ifndef MULTICORE
|
||||
assert(*(--block_names.end()) == msg);
|
||||
#endif
|
||||
block_names.pop_back();
|
||||
|
||||
++invocation_counts[msg];
|
||||
|
||||
long long t = get_nsec_time();
|
||||
last_times[msg] = (t - enter_times[msg]);
|
||||
cumulative_times[msg] += (t - enter_times[msg]);
|
||||
|
||||
long long cpu_t = get_nsec_cpu_time();
|
||||
last_cpu_times[msg] = (cpu_t - enter_cpu_times[msg]);
|
||||
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
for (std::pair<std::string, long long*> p : op_data_points)
|
||||
{
|
||||
cumulative_op_counts[std::make_pair(msg, p.first)] += *(p.second)-op_counts[std::make_pair(msg, p.first)];
|
||||
}
|
||||
#endif
|
||||
|
||||
if (inhibit_profiling_info)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
#ifdef MULTICORE
|
||||
#pragma omp critical
|
||||
#endif
|
||||
{
|
||||
if (indent)
|
||||
{
|
||||
--indentation;
|
||||
}
|
||||
|
||||
print_indent();
|
||||
printf("(leave) %-35s\t", msg.c_str());
|
||||
print_times_from_last_and_start(t, enter_times[msg], cpu_t, enter_cpu_times[msg]);
|
||||
print_op_profiling(msg);
|
||||
printf("\n");
|
||||
fflush(stdout);
|
||||
}
|
||||
}
|
||||
|
||||
void print_mem(const std::string &s)
|
||||
{
|
||||
#ifndef NO_PROCPS
|
||||
struct proc_t usage;
|
||||
look_up_our_self(&usage);
|
||||
if (s.empty())
|
||||
{
|
||||
printf("* Peak vsize (physical memory+swap) in mebibytes: %lu\n", usage.vsize >> 20);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("* Peak vsize (physical memory+swap) in mebibytes (%s): %lu\n", s.c_str(), usage.vsize >> 20);
|
||||
}
|
||||
#else
|
||||
printf("* Memory profiling not supported in NO_PROCPS mode\n");
|
||||
#endif
|
||||
}
|
||||
|
||||
void print_compilation_info()
|
||||
{
|
||||
#ifdef __GNUC__
|
||||
printf("g++ version: %s\n", __VERSION__);
|
||||
//printf("Compiled on %s %s\n", __DATE__, __TIME__);
|
||||
#endif
|
||||
#ifdef STATIC
|
||||
printf("STATIC: yes\n");
|
||||
#else
|
||||
printf("STATIC: no\n");
|
||||
#endif
|
||||
#ifdef MULTICORE
|
||||
printf("MULTICORE: yes\n");
|
||||
#else
|
||||
printf("MULTICORE: no\n");
|
||||
#endif
|
||||
#ifdef DEBUG
|
||||
printf("DEBUG: yes\n");
|
||||
#else
|
||||
printf("DEBUG: no\n");
|
||||
#endif
|
||||
#ifdef PROFILE_OP_COUNTS
|
||||
printf("PROFILE_OP_COUNTS: yes\n");
|
||||
#else
|
||||
printf("PROFILE_OP_COUNTS: no\n");
|
||||
#endif
|
||||
#ifdef _GLIBCXX_DEBUG
|
||||
printf("_GLIBCXX_DEBUG: yes\n");
|
||||
#else
|
||||
printf("_GLIBCXX_DEBUG: no\n");
|
||||
#endif
|
||||
}
|
||||
|
||||
} // libsnark
|
|
@ -0,0 +1,51 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of functions for profiling code blocks.
|
||||
|
||||
Reports time, operation counts, memory usage, and others.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef PROFILING_HPP_
|
||||
#define PROFILING_HPP_
|
||||
|
||||
#include <cstddef>
|
||||
#include <map>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
void start_profiling();
|
||||
long long get_nsec_time();
|
||||
void print_time(const char* msg);
|
||||
void print_header(const char* msg);
|
||||
|
||||
void print_indent();
|
||||
|
||||
extern bool inhibit_profiling_info;
|
||||
extern bool inhibit_profiling_counters;
|
||||
extern std::map<std::string, size_t> invocation_counts;
|
||||
extern std::map<std::string, long long> last_times;
|
||||
extern std::map<std::string, long long> cumulative_times;
|
||||
|
||||
void clear_profiling_counters();
|
||||
|
||||
void print_cumulative_time_entry(const std::string &key, const long long factor=1);
|
||||
void print_cumulative_times(const long long factor=1);
|
||||
void print_cumulative_op_counts(const bool only_fq=false);
|
||||
|
||||
void enter_block(const std::string &msg, const bool indent=true);
|
||||
void leave_block(const std::string &msg, const bool indent=true);
|
||||
|
||||
void print_mem(const std::string &s = "");
|
||||
void print_compilation_info();
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // PROFILING_HPP_
|
|
@ -0,0 +1,104 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of serialization routines and constants.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SERIALIZATION_HPP_
|
||||
#define SERIALIZATION_HPP_
|
||||
|
||||
#include <istream>
|
||||
#include <map>
|
||||
#include <ostream>
|
||||
#include <set>
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/*
|
||||
* @todo
|
||||
* The serialization is fragile. Shoud be rewritten using a standard, portable-format
|
||||
* library like boost::serialize.
|
||||
*
|
||||
* However, for now the following conventions are used within the code.
|
||||
*
|
||||
* All algebraic objects support either binary or decimal output using
|
||||
* the standard C++ stream operators (operator<<, operator>>).
|
||||
*
|
||||
* The binary mode is activated by defining a BINARY_OUTPUT
|
||||
* preprocessor macro (e.g. g++ -DBINARY_OUTPUT ...).
|
||||
*
|
||||
* Binary output assumes that the stream is to be binary read at its
|
||||
* current position so any white space should be consumed beforehand.
|
||||
*
|
||||
* Consecutive algebraic objects are separated by OUTPUT_NEWLINE and
|
||||
* within themselves (e.g. X and Y coordinates for field elements) with
|
||||
* OUTPUT_SEPARATOR (as defined below).
|
||||
*
|
||||
* Therefore to dump two integers, two Fp elements and another integer
|
||||
* one would:
|
||||
*
|
||||
* out << 3 << "\n";
|
||||
* out << 4 << "\n";
|
||||
* out << FieldT(56) << OUTPUT_NEWLINE;
|
||||
* out << FieldT(78) << OUTPUT_NEWLINE;
|
||||
* out << 9 << "\n";
|
||||
*
|
||||
* Then reading back it its reader's responsibility (!) to consume "\n"
|
||||
* after 4, but Fp::operator<< will correctly consume OUTPUT_NEWLINE.
|
||||
*
|
||||
* The reader should also consume "\n" after 9, so that another field
|
||||
* element can be properly chained. This is especially important for
|
||||
* binary output.
|
||||
*
|
||||
* The binary serialization of algebraic objects is currently *not*
|
||||
* portable between machines of different word sizes.
|
||||
*/
|
||||
|
||||
#ifdef BINARY_OUTPUT
|
||||
#define OUTPUT_NEWLINE ""
|
||||
#define OUTPUT_SEPARATOR ""
|
||||
#else
|
||||
#define OUTPUT_NEWLINE "\n"
|
||||
#define OUTPUT_SEPARATOR " "
|
||||
#endif
|
||||
|
||||
inline void consume_newline(std::istream &in);
|
||||
inline void consume_OUTPUT_NEWLINE(std::istream &in);
|
||||
inline void consume_OUTPUT_SEPARATOR(std::istream &in);
|
||||
|
||||
inline void output_bool(std::ostream &out, const bool b);
|
||||
|
||||
inline void output_bool_vector(std::ostream &out, const std::vector<bool> &v);
|
||||
|
||||
template<typename T>
|
||||
T reserialize(const T &obj);
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<T> &v);
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::ostream& out, std::vector<T> &v);
|
||||
|
||||
template<typename T1, typename T2>
|
||||
std::ostream& operator<<(std::ostream& out, const std::map<T1, T2> &m);
|
||||
|
||||
template<typename T1, typename T2>
|
||||
std::istream& operator>>(std::istream& in, std::map<T1, T2> &m);
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream& out, const std::set<T> &s);
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream& in, std::set<T> &s);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "common/serialization.tcc"
|
||||
|
||||
#endif // SERIALIZATION_HPP_
|
|
@ -0,0 +1,180 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of serialization routines.
|
||||
|
||||
See serialization.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SERIALIZATION_TCC_
|
||||
#define SERIALIZATION_TCC_
|
||||
|
||||
#include <cassert>
|
||||
#include <sstream>
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
inline void consume_newline(std::istream &in)
|
||||
{
|
||||
char c;
|
||||
in.read(&c, 1);
|
||||
}
|
||||
|
||||
inline void consume_OUTPUT_NEWLINE(std::istream &in)
|
||||
{
|
||||
#ifdef BINARY_OUTPUT
|
||||
// nothing to consume
|
||||
UNUSED(in);
|
||||
#else
|
||||
char c;
|
||||
in.read(&c, 1);
|
||||
#endif
|
||||
}
|
||||
|
||||
inline void consume_OUTPUT_SEPARATOR(std::istream &in)
|
||||
{
|
||||
#ifdef BINARY_OUTPUT
|
||||
// nothing to consume
|
||||
UNUSED(in);
|
||||
#else
|
||||
char c;
|
||||
in.read(&c, 1);
|
||||
#endif
|
||||
}
|
||||
|
||||
inline void output_bool(std::ostream &out, const bool b)
|
||||
{
|
||||
out << (b ? 1 : 0) << "\n";
|
||||
}
|
||||
|
||||
inline void output_bool_vector(std::ostream &out, const std::vector<bool> &v)
|
||||
{
|
||||
out << v.size() << "\n";
|
||||
for (const bool b : v)
|
||||
{
|
||||
output_bool(out, b);
|
||||
}
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
T reserialize(const T &obj)
|
||||
{
|
||||
std::stringstream ss;
|
||||
ss << obj;
|
||||
T tmp;
|
||||
ss >> tmp;
|
||||
assert(obj == tmp);
|
||||
return tmp;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream& out, const std::vector<T> &v)
|
||||
{
|
||||
static_assert(!std::is_same<T, bool>::value, "this does not work for std::vector<bool>");
|
||||
out << v.size() << "\n";
|
||||
for (const T& t : v)
|
||||
{
|
||||
out << t << OUTPUT_NEWLINE;
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream& in, std::vector<T> &v)
|
||||
{
|
||||
static_assert(!std::is_same<T, bool>::value, "this does not work for std::vector<bool>");
|
||||
size_t size;
|
||||
in >> size;
|
||||
consume_newline(in);
|
||||
|
||||
v.resize(0);
|
||||
for (size_t i = 0; i < size; ++i)
|
||||
{
|
||||
T elt;
|
||||
in >> elt;
|
||||
consume_OUTPUT_NEWLINE(in);
|
||||
v.push_back(elt);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
std::ostream& operator<<(std::ostream& out, const std::map<T1, T2> &m)
|
||||
{
|
||||
out << m.size() << "\n";
|
||||
|
||||
for (auto &it : m)
|
||||
{
|
||||
out << it.first << "\n";
|
||||
out << it.second << "\n";
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
template<typename T1, typename T2>
|
||||
std::istream& operator>>(std::istream& in, std::map<T1, T2> &m)
|
||||
{
|
||||
m.clear();
|
||||
size_t size;
|
||||
in >> size;
|
||||
consume_newline(in);
|
||||
|
||||
for (size_t i = 0; i < size; ++i)
|
||||
{
|
||||
T1 k;
|
||||
T2 v;
|
||||
in >> k;
|
||||
consume_newline(in);
|
||||
in >> v;
|
||||
consume_newline(in);
|
||||
m[k] = v;
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
template<typename T>
|
||||
std::ostream& operator<<(std::ostream& out, const std::set<T> &s)
|
||||
{
|
||||
out << s.size() << "\n";
|
||||
|
||||
for (auto &el : s)
|
||||
{
|
||||
out << el << "\n";
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
|
||||
template<typename T>
|
||||
std::istream& operator>>(std::istream& in, std::set<T> &s)
|
||||
{
|
||||
s.clear();
|
||||
size_t size;
|
||||
in >> size;
|
||||
consume_newline(in);
|
||||
|
||||
for (size_t i = 0; i < size; ++i)
|
||||
{
|
||||
T el;
|
||||
in >> el;
|
||||
consume_newline(in);
|
||||
s.insert(el);
|
||||
}
|
||||
|
||||
return in;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
#endif // SERIALIZATION_TCC_
|
|
@ -0,0 +1,26 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of functions for supporting the use of templates.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef TEMPLATE_UTILS_HPP_
|
||||
#define TEMPLATE_UTILS_HPP_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/* A commonly used SFINAE helper type */
|
||||
template<typename T>
|
||||
struct void_type
|
||||
{
|
||||
typedef void type;
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // TEMPLATE_UTILS_HPP_
|
|
@ -0,0 +1,102 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of misc math and serialization utility functions
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include <algorithm>
|
||||
#include <cassert>
|
||||
#include <cstdint>
|
||||
#include <cstdarg>
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
size_t log2(size_t n)
|
||||
/* returns ceil(log2(n)), so 1ul<<log2(n) is the smallest power of 2,
|
||||
that is not less than n. */
|
||||
{
|
||||
size_t r = ((n & (n-1)) == 0 ? 0 : 1); // add 1 if n is not power of 2
|
||||
|
||||
while (n > 1)
|
||||
{
|
||||
n >>= 1;
|
||||
r++;
|
||||
}
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
size_t bitreverse(size_t n, const size_t l)
|
||||
{
|
||||
size_t r = 0;
|
||||
for (size_t k = 0; k < l; ++k)
|
||||
{
|
||||
r = (r << 1) | (n & 1);
|
||||
n >>= 1;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
|
||||
bit_vector int_list_to_bits(const std::initializer_list<unsigned long> &l, const size_t wordsize)
|
||||
{
|
||||
bit_vector res(wordsize*l.size());
|
||||
for (size_t i = 0; i < l.size(); ++i)
|
||||
{
|
||||
for (size_t j = 0; j < wordsize; ++j)
|
||||
{
|
||||
res[i*wordsize + j] = (*(l.begin()+i) & (1ul<<(wordsize-1-j)));
|
||||
}
|
||||
}
|
||||
return res;
|
||||
}
|
||||
|
||||
long long div_ceil(long long x, long long y)
|
||||
{
|
||||
return (x + (y-1)) / y;
|
||||
}
|
||||
|
||||
bool is_little_endian()
|
||||
{
|
||||
uint64_t a = 0x12345678;
|
||||
unsigned char *c = (unsigned char*)(&a);
|
||||
return (*c = 0x78);
|
||||
}
|
||||
|
||||
std::string FORMAT(const std::string &prefix, const char* format, ...)
|
||||
{
|
||||
const static size_t MAX_FMT = 256;
|
||||
char buf[MAX_FMT];
|
||||
va_list args;
|
||||
va_start(args, format);
|
||||
vsnprintf(buf, MAX_FMT, format, args);
|
||||
va_end(args);
|
||||
|
||||
return prefix + std::string(buf);
|
||||
}
|
||||
|
||||
void serialize_bit_vector(std::ostream &out, const bit_vector &v)
|
||||
{
|
||||
out << v.size() << "\n";
|
||||
for (size_t i = 0; i < v.size(); ++i)
|
||||
{
|
||||
out << v[i] << "\n";
|
||||
}
|
||||
}
|
||||
|
||||
void deserialize_bit_vector(std::istream &in, bit_vector &v)
|
||||
{
|
||||
size_t size;
|
||||
in >> size;
|
||||
v.resize(size);
|
||||
for (size_t i = 0; i < size; ++i)
|
||||
{
|
||||
bool b;
|
||||
in >> b;
|
||||
v[i] = b;
|
||||
}
|
||||
}
|
||||
} // libsnark
|
|
@ -0,0 +1,57 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Declaration of misc math and serialization utility functions
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef UTILS_HPP_
|
||||
#define UTILS_HPP_
|
||||
|
||||
#include <cassert>
|
||||
#include <iostream>
|
||||
#include <sstream>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
typedef std::vector<bool> bit_vector;
|
||||
|
||||
/// returns ceil(log2(n)), so 1ul<<log2(n) is the smallest power of 2, that is not less than n
|
||||
size_t log2(size_t n);
|
||||
|
||||
inline size_t exp2(size_t k) { return 1ul << k; }
|
||||
|
||||
size_t bitreverse(size_t n, const size_t l);
|
||||
bit_vector int_list_to_bits(const std::initializer_list<unsigned long> &l, const size_t wordsize);
|
||||
long long div_ceil(long long x, long long y);
|
||||
|
||||
bool is_little_endian();
|
||||
|
||||
std::string FORMAT(const std::string &prefix, const char* format, ...);
|
||||
|
||||
/* A variadic template to suppress unused argument warnings */
|
||||
template<typename ... Types>
|
||||
void UNUSED(Types&&...) {}
|
||||
|
||||
#ifdef DEBUG
|
||||
#define FMT FORMAT
|
||||
#else
|
||||
#define FMT(...) (UNUSED(__VA_ARGS__), "")
|
||||
#endif
|
||||
|
||||
void serialize_bit_vector(std::ostream &out, const bit_vector &v);
|
||||
void deserialize_bit_vector(std::istream &in, bit_vector &v);
|
||||
|
||||
template<typename T>
|
||||
size_t size_in_bits(const std::vector<T> &v);
|
||||
|
||||
#define ARRAY_SIZE(arr) (sizeof(arr)/sizeof(arr[0]))
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "common/utils.tcc" /* note that utils has a templatized part (utils.tcc) and non-templatized part (utils.cpp) */
|
||||
#endif // UTILS_HPP_
|
|
@ -0,0 +1,23 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
Implementation of templatized utility functions
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef UTILS_TCC_
|
||||
#define UTILS_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename T>
|
||||
size_t size_in_bits(const std::vector<T> &v)
|
||||
{
|
||||
return v.size() * T::size_in_bits();
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // UTILS_TCC_
|
|
@ -0,0 +1,48 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for profiling constraints.
|
||||
|
||||
See constraint_profiling.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "gadgetlib1/constraint_profiling.hpp"
|
||||
#include "common/profiling.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
size_t constraint_profiling_indent = 0;
|
||||
std::vector<constraint_profiling_entry> constraint_profiling_table;
|
||||
|
||||
size_t PRINT_CONSTRAINT_PROFILING()
|
||||
{
|
||||
size_t accounted = 0;
|
||||
print_indent();
|
||||
printf("Constraint profiling:\n");
|
||||
for (constraint_profiling_entry &ent : constraint_profiling_table)
|
||||
{
|
||||
if (ent.indent == 0)
|
||||
{
|
||||
accounted += ent.count;
|
||||
}
|
||||
|
||||
print_indent();
|
||||
for (size_t i = 0; i < ent.indent; ++i)
|
||||
{
|
||||
printf(" ");
|
||||
}
|
||||
printf("* Number of constraints in [%s]: %zu\n", ent.annotation.c_str(), ent.count);
|
||||
}
|
||||
|
||||
constraint_profiling_table.clear();
|
||||
constraint_profiling_indent = 0;
|
||||
|
||||
return accounted;
|
||||
}
|
||||
|
||||
}
|
|
@ -0,0 +1,42 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for profiling constraints.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef CONSTRAINT_PROFILING_HPP_
|
||||
#define CONSTRAINT_PROFILING_HPP_
|
||||
|
||||
#include <cstddef>
|
||||
#include <map>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
extern size_t constraint_profiling_indent;
|
||||
|
||||
struct constraint_profiling_entry {
|
||||
size_t indent;
|
||||
std::string annotation;
|
||||
size_t count;
|
||||
};
|
||||
|
||||
extern std::vector<constraint_profiling_entry> constraint_profiling_table;
|
||||
|
||||
#define PROFILE_CONSTRAINTS(pb, annotation) \
|
||||
for (size_t _num_constraints_before = pb.num_constraints(), _iter = (++constraint_profiling_indent, 0), _cp_pos = constraint_profiling_table.size(); \
|
||||
_iter == 0; \
|
||||
constraint_profiling_table.insert(constraint_profiling_table.begin() + _cp_pos, constraint_profiling_entry{--constraint_profiling_indent, annotation, pb.num_constraints() - _num_constraints_before}), \
|
||||
_iter = 1)
|
||||
|
||||
size_t PRINT_CONSTRAINT_PROFILING(); // returns # of top level constraints
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // CONSTRAINT_PROFILING_HPP_
|
|
@ -0,0 +1,23 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SIMPLE_EXAMPLE_HPP_
|
||||
#define SIMPLE_EXAMPLE_HPP_
|
||||
|
||||
#include "examples/r1cs_examples.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
r1cs_example<FieldT> gen_r1cs_example_from_protoboard(const size_t num_constraints,
|
||||
const size_t num_inputs);
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/examples/simple_example.tcc"
|
||||
|
||||
#endif // SIMPLE_EXAMPLE_HPP_
|
|
@ -0,0 +1,54 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SIMPLE_EXAMPLE_TCC_
|
||||
#define SIMPLE_EXAMPLE_TCC_
|
||||
|
||||
#include <cassert>
|
||||
#include "gadgetlib1/gadgets/basic_gadgets.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/* NOTE: all examples here actually generate one constraint less to account for soundness constraint in QAP */
|
||||
|
||||
template<typename FieldT>
|
||||
r1cs_example<FieldT> gen_r1cs_example_from_protoboard(const size_t num_constraints,
|
||||
const size_t num_inputs)
|
||||
{
|
||||
const size_t new_num_constraints = num_constraints - 1;
|
||||
|
||||
/* construct dummy example: inner products of two vectors */
|
||||
protoboard<FieldT> pb;
|
||||
pb_variable_array<FieldT> A;
|
||||
pb_variable_array<FieldT> B;
|
||||
pb_variable<FieldT> res;
|
||||
|
||||
// the variables on the protoboard are (ONE (constant 1 term), res, A[0], ..., A[num_constraints-1], B[0], ..., B[num_constraints-1])
|
||||
res.allocate(pb, "res");
|
||||
A.allocate(pb, new_num_constraints, "A");
|
||||
B.allocate(pb, new_num_constraints, "B");
|
||||
|
||||
inner_product_gadget<FieldT> compute_inner_product(pb, A, B, res, "compute_inner_product");
|
||||
compute_inner_product.generate_r1cs_constraints();
|
||||
|
||||
/* fill in random example */
|
||||
for (size_t i = 0; i < new_num_constraints; ++i)
|
||||
{
|
||||
pb.val(A[i]) = FieldT::random_element();
|
||||
pb.val(B[i]) = FieldT::random_element();
|
||||
}
|
||||
|
||||
compute_inner_product.generate_r1cs_witness();
|
||||
|
||||
pb.constraint_system.num_inputs = num_inputs;
|
||||
const r1cs_variable_assignment<FieldT> va = pb.values;
|
||||
const r1cs_variable_assignment<FieldT> input(va.begin(), va.begin() + num_inputs);
|
||||
return r1cs_example<FieldT>(pb.constraint_system, input, va, num_inputs);
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // R1CS_EXAMPLES_TCC_
|
|
@ -0,0 +1,27 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef GADGET_HPP_
|
||||
#define GADGET_HPP_
|
||||
|
||||
#include "gadgetlib1/protoboard.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
class gadget {
|
||||
protected:
|
||||
protoboard<FieldT> &pb;
|
||||
const std::string annotation_prefix;
|
||||
public:
|
||||
gadget(protoboard<FieldT> &pb, const std::string &annotation_prefix="");
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
#include "gadgetlib1/gadget.tcc"
|
||||
|
||||
#endif // GADGET_HPP_
|
|
@ -0,0 +1,23 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef GADGET_TCC_
|
||||
#define GADGET_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
gadget<FieldT>::gadget(protoboard<FieldT> &pb, const std::string &annotation_prefix) :
|
||||
pb(pb), annotation_prefix(annotation_prefix)
|
||||
{
|
||||
#ifdef DEBUG
|
||||
assert(annotation_prefix != "");
|
||||
#endif
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // GADGET_TCC_
|
|
@ -0,0 +1,351 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BASIC_GADGETS_HPP_
|
||||
#define BASIC_GADGETS_HPP_
|
||||
|
||||
#include <cassert>
|
||||
#include <memory>
|
||||
|
||||
#include "gadgetlib1/gadget.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/* forces lc to take value 0 or 1 by adding constraint lc * (1-lc) = 0 */
|
||||
template<typename FieldT>
|
||||
void generate_boolean_r1cs_constraint(protoboard<FieldT> &pb, const pb_linear_combination<FieldT> &lc, const std::string &annotation_prefix="");
|
||||
|
||||
template<typename FieldT>
|
||||
void generate_r1cs_equals_const_constraint(protoboard<FieldT> &pb, const pb_linear_combination<FieldT> &lc, const FieldT& c, const std::string &annotation_prefix="");
|
||||
|
||||
template<typename FieldT>
|
||||
class packing_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
/* no internal variables */
|
||||
public:
|
||||
const pb_linear_combination_array<FieldT> bits;
|
||||
const pb_linear_combination<FieldT> packed;
|
||||
|
||||
packing_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &bits,
|
||||
const pb_linear_combination<FieldT> &packed,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), bits(bits), packed(packed) {}
|
||||
|
||||
void generate_r1cs_constraints(const bool enforce_bitness);
|
||||
/* adds constraint result = \sum bits[i] * 2^i */
|
||||
|
||||
void generate_r1cs_witness_from_packed();
|
||||
void generate_r1cs_witness_from_bits();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
class multipacking_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
std::vector<packing_gadget<FieldT> > packers;
|
||||
public:
|
||||
const pb_linear_combination_array<FieldT> bits;
|
||||
const pb_linear_combination_array<FieldT> packed_vars;
|
||||
|
||||
const size_t chunk_size;
|
||||
const size_t num_chunks;
|
||||
// const size_t last_chunk_size;
|
||||
|
||||
multipacking_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &bits,
|
||||
const pb_linear_combination_array<FieldT> &packed_vars,
|
||||
const size_t chunk_size,
|
||||
const std::string &annotation_prefix="");
|
||||
void generate_r1cs_constraints(const bool enforce_bitness);
|
||||
void generate_r1cs_witness_from_packed();
|
||||
void generate_r1cs_witness_from_bits();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
class field_vector_copy_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
const pb_variable_array<FieldT> source;
|
||||
const pb_variable_array<FieldT> target;
|
||||
const pb_linear_combination<FieldT> do_copy;
|
||||
|
||||
field_vector_copy_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &source,
|
||||
const pb_variable_array<FieldT> &target,
|
||||
const pb_linear_combination<FieldT> &do_copy,
|
||||
const std::string &annotation_prefix="");
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
class bit_vector_copy_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
const pb_variable_array<FieldT> source_bits;
|
||||
const pb_variable_array<FieldT> target_bits;
|
||||
const pb_linear_combination<FieldT> do_copy;
|
||||
|
||||
pb_variable_array<FieldT> packed_source;
|
||||
pb_variable_array<FieldT> packed_target;
|
||||
|
||||
std::shared_ptr<multipacking_gadget<FieldT> > pack_source;
|
||||
std::shared_ptr<multipacking_gadget<FieldT> > pack_target;
|
||||
std::shared_ptr<field_vector_copy_gadget<FieldT> > copier;
|
||||
|
||||
const size_t chunk_size;
|
||||
const size_t num_chunks;
|
||||
|
||||
bit_vector_copy_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &source_bits,
|
||||
const pb_variable_array<FieldT> &target_bits,
|
||||
const pb_linear_combination<FieldT> &do_copy,
|
||||
const size_t chunk_size,
|
||||
const std::string &annotation_prefix="");
|
||||
void generate_r1cs_constraints(const bool enforce_source_bitness, const bool enforce_target_bitness);
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
class dual_variable_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
std::shared_ptr<packing_gadget<FieldT> > consistency_check;
|
||||
public:
|
||||
pb_variable<FieldT> packed;
|
||||
pb_variable_array<FieldT> bits;
|
||||
|
||||
dual_variable_gadget(protoboard<FieldT> &pb,
|
||||
const size_t width,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix)
|
||||
{
|
||||
packed.allocate(pb, FMT(this->annotation_prefix, " packed"));
|
||||
bits.allocate(pb, width, FMT(this->annotation_prefix, " bits"));
|
||||
consistency_check.reset(new packing_gadget<FieldT>(pb,
|
||||
bits,
|
||||
packed,
|
||||
FMT(this->annotation_prefix, " consistency_check")));
|
||||
}
|
||||
|
||||
dual_variable_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &bits,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), bits(bits)
|
||||
{
|
||||
packed.allocate(pb, FMT(this->annotation_prefix, " packed"));
|
||||
consistency_check.reset(new packing_gadget<FieldT>(pb,
|
||||
bits,
|
||||
packed,
|
||||
FMT(this->annotation_prefix, " consistency_check")));
|
||||
}
|
||||
|
||||
dual_variable_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable<FieldT> &packed,
|
||||
const size_t width,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), packed(packed)
|
||||
{
|
||||
bits.allocate(pb, width, FMT(this->annotation_prefix, " bits"));
|
||||
consistency_check.reset(new packing_gadget<FieldT>(pb,
|
||||
bits,
|
||||
packed,
|
||||
FMT(this->annotation_prefix, " consistency_check")));
|
||||
}
|
||||
|
||||
void generate_r1cs_constraints(const bool enforce_bitness);
|
||||
void generate_r1cs_witness_from_packed();
|
||||
void generate_r1cs_witness_from_bits();
|
||||
};
|
||||
|
||||
/*
|
||||
the gadgets below are Fp specific:
|
||||
I * X = R
|
||||
(1-R) * X = 0
|
||||
|
||||
if X = 0 then R = 0
|
||||
if X != 0 then R = 1 and I = X^{-1}
|
||||
*/
|
||||
|
||||
template<typename FieldT>
|
||||
class disjunction_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_variable<FieldT> inv;
|
||||
public:
|
||||
const pb_variable_array<FieldT> inputs;
|
||||
const pb_variable<FieldT> output;
|
||||
|
||||
disjunction_gadget(protoboard<FieldT>& pb,
|
||||
const pb_variable_array<FieldT> &inputs,
|
||||
const pb_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), inputs(inputs), output(output)
|
||||
{
|
||||
assert(inputs.size() >= 1);
|
||||
inv.allocate(pb, FMT(this->annotation_prefix, " inv"));
|
||||
}
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
void test_disjunction_gadget(const size_t n);
|
||||
|
||||
template<typename FieldT>
|
||||
class conjunction_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_variable<FieldT> inv;
|
||||
public:
|
||||
const pb_variable_array<FieldT> inputs;
|
||||
const pb_variable<FieldT> output;
|
||||
|
||||
conjunction_gadget(protoboard<FieldT>& pb,
|
||||
const pb_variable_array<FieldT> &inputs,
|
||||
const pb_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), inputs(inputs), output(output)
|
||||
{
|
||||
assert(inputs.size() >= 1);
|
||||
inv.allocate(pb, FMT(this->annotation_prefix, " inv"));
|
||||
}
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
void test_conjunction_gadget(const size_t n);
|
||||
|
||||
template<typename FieldT>
|
||||
class comparison_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_variable_array<FieldT> alpha;
|
||||
pb_variable<FieldT> alpha_packed;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_alpha;
|
||||
|
||||
std::shared_ptr<disjunction_gadget<FieldT> > all_zeros_test;
|
||||
pb_variable<FieldT> not_all_zeros;
|
||||
public:
|
||||
const size_t n;
|
||||
const pb_linear_combination<FieldT> A;
|
||||
const pb_linear_combination<FieldT> B;
|
||||
const pb_variable<FieldT> less;
|
||||
const pb_variable<FieldT> less_or_eq;
|
||||
|
||||
comparison_gadget(protoboard<FieldT>& pb,
|
||||
const size_t n,
|
||||
const pb_linear_combination<FieldT> &A,
|
||||
const pb_linear_combination<FieldT> &B,
|
||||
const pb_variable<FieldT> &less,
|
||||
const pb_variable<FieldT> &less_or_eq,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), n(n), A(A), B(B), less(less), less_or_eq(less_or_eq)
|
||||
{
|
||||
alpha.allocate(pb, n, FMT(this->annotation_prefix, " alpha"));
|
||||
alpha.emplace_back(less_or_eq); // alpha[n] is less_or_eq
|
||||
|
||||
alpha_packed.allocate(pb, FMT(this->annotation_prefix, " alpha_packed"));
|
||||
not_all_zeros.allocate(pb, FMT(this->annotation_prefix, " not_all_zeros"));
|
||||
|
||||
pack_alpha.reset(new packing_gadget<FieldT>(pb, alpha, alpha_packed,
|
||||
FMT(this->annotation_prefix, " pack_alpha")));
|
||||
|
||||
all_zeros_test.reset(new disjunction_gadget<FieldT>(pb,
|
||||
pb_variable_array<FieldT>(alpha.begin(), alpha.begin() + n),
|
||||
not_all_zeros,
|
||||
FMT(this->annotation_prefix, " all_zeros_test")));
|
||||
};
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
void test_comparison_gadget(const size_t n);
|
||||
|
||||
template<typename FieldT>
|
||||
class inner_product_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
/* S_i = \sum_{k=0}^{i+1} A[i] * B[i] */
|
||||
pb_variable_array<FieldT> S;
|
||||
public:
|
||||
const pb_linear_combination_array<FieldT> A;
|
||||
const pb_linear_combination_array<FieldT> B;
|
||||
const pb_variable<FieldT> result;
|
||||
|
||||
inner_product_gadget(protoboard<FieldT>& pb,
|
||||
const pb_linear_combination_array<FieldT> &A,
|
||||
const pb_linear_combination_array<FieldT> &B,
|
||||
const pb_variable<FieldT> &result,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), A(A), B(B), result(result)
|
||||
{
|
||||
assert(A.size() >= 1);
|
||||
assert(A.size() == B.size());
|
||||
|
||||
S.allocate(pb, A.size()-1, FMT(this->annotation_prefix, " S"));
|
||||
}
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
void test_inner_product_gadget(const size_t n);
|
||||
|
||||
template<typename FieldT>
|
||||
class loose_multiplexing_gadget : public gadget<FieldT> {
|
||||
/*
|
||||
this implements loose multiplexer:
|
||||
index not in bounds -> success_flag = 0
|
||||
index in bounds && success_flag = 1 -> result is correct
|
||||
however if index is in bounds we can also set success_flag to 0 (and then result will be forced to be 0)
|
||||
*/
|
||||
public:
|
||||
pb_variable_array<FieldT> alpha;
|
||||
private:
|
||||
std::shared_ptr<inner_product_gadget<FieldT> > compute_result;
|
||||
public:
|
||||
const pb_linear_combination_array<FieldT> arr;
|
||||
const pb_variable<FieldT> index;
|
||||
const pb_variable<FieldT> result;
|
||||
const pb_variable<FieldT> success_flag;
|
||||
|
||||
loose_multiplexing_gadget(protoboard<FieldT>& pb,
|
||||
const pb_linear_combination_array<FieldT> &arr,
|
||||
const pb_variable<FieldT> &index,
|
||||
const pb_variable<FieldT> &result,
|
||||
const pb_variable<FieldT> &success_flag,
|
||||
const std::string &annotation_prefix="") :
|
||||
gadget<FieldT>(pb, annotation_prefix), arr(arr), index(index), result(result), success_flag(success_flag)
|
||||
{
|
||||
alpha.allocate(pb, arr.size(), FMT(this->annotation_prefix, " alpha"));
|
||||
compute_result.reset(new inner_product_gadget<FieldT>(pb, alpha, arr, result, FMT(this->annotation_prefix, " compute_result")));
|
||||
};
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
void test_loose_multiplexing_gadget(const size_t n);
|
||||
|
||||
template<typename FieldT, typename VarT>
|
||||
void create_linear_combination_constraints(protoboard<FieldT> &pb,
|
||||
const std::vector<FieldT> &base,
|
||||
const std::vector<std::pair<VarT, FieldT> > &v,
|
||||
const VarT &target,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
template<typename FieldT, typename VarT>
|
||||
void create_linear_combination_witness(protoboard<FieldT> &pb,
|
||||
const std::vector<FieldT> &base,
|
||||
const std::vector<std::pair<VarT, FieldT> > &v,
|
||||
const VarT &target);
|
||||
|
||||
} // libsnark
|
||||
#include "gadgetlib1/gadgets/basic_gadgets.tcc"
|
||||
|
||||
#endif // BASIC_GADGETS_HPP_
|
|
@ -0,0 +1,705 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef BASIC_GADGETS_TCC_
|
||||
#define BASIC_GADGETS_TCC_
|
||||
|
||||
#include "common/profiling.hpp"
|
||||
#include "common/utils.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
void generate_boolean_r1cs_constraint(protoboard<FieldT> &pb, const pb_linear_combination<FieldT> &lc, const std::string &annotation_prefix)
|
||||
/* forces lc to take value 0 or 1 by adding constraint lc * (1-lc) = 0 */
|
||||
{
|
||||
pb.add_r1cs_constraint(r1cs_constraint<FieldT>(lc, 1-lc, 0),
|
||||
FMT(annotation_prefix, " boolean_r1cs_constraint"));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void generate_r1cs_equals_const_constraint(protoboard<FieldT> &pb, const pb_linear_combination<FieldT> &lc, const FieldT& c, const std::string &annotation_prefix)
|
||||
{
|
||||
pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1, lc, c),
|
||||
FMT(annotation_prefix, " constness_constraint"));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void packing_gadget<FieldT>::generate_r1cs_constraints(const bool enforce_bitness)
|
||||
/* adds constraint result = \sum bits[i] * 2^i */
|
||||
{
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1, pb_packing_sum<FieldT>(bits), packed), FMT(this->annotation_prefix, " packing_constraint"));
|
||||
|
||||
if (enforce_bitness)
|
||||
{
|
||||
for (size_t i = 0; i < bits.size(); ++i)
|
||||
{
|
||||
generate_boolean_r1cs_constraint<FieldT>(this->pb, bits[i], FMT(this->annotation_prefix, " bitness_%zu", i));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void packing_gadget<FieldT>::generate_r1cs_witness_from_packed()
|
||||
{
|
||||
packed.evaluate(this->pb);
|
||||
assert(this->pb.lc_val(packed).as_bigint().num_bits() <= bits.size());
|
||||
bits.fill_with_bits_of_field_element(this->pb, this->pb.lc_val(packed));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void packing_gadget<FieldT>::generate_r1cs_witness_from_bits()
|
||||
{
|
||||
bits.evaluate(this->pb);
|
||||
this->pb.lc_val(packed) = bits.get_field_element_from_bits(this->pb);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
multipacking_gadget<FieldT>::multipacking_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &bits,
|
||||
const pb_linear_combination_array<FieldT> &packed_vars,
|
||||
const size_t chunk_size,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix), bits(bits), packed_vars(packed_vars),
|
||||
chunk_size(chunk_size),
|
||||
num_chunks(div_ceil(bits.size(), chunk_size))
|
||||
// last_chunk_size(bits.size() - (num_chunks-1) * chunk_size)
|
||||
{
|
||||
assert(packed_vars.size() == num_chunks);
|
||||
for (size_t i = 0; i < num_chunks; ++i)
|
||||
{
|
||||
packers.emplace_back(packing_gadget<FieldT>(this->pb, pb_linear_combination_array<FieldT>(bits.begin() + i * chunk_size,
|
||||
bits.begin() + std::min((i+1) * chunk_size, bits.size())),
|
||||
packed_vars[i], FMT(this->annotation_prefix, " packers_%zu", i)));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void multipacking_gadget<FieldT>::generate_r1cs_constraints(const bool enforce_bitness)
|
||||
{
|
||||
for (size_t i = 0; i < num_chunks; ++i)
|
||||
{
|
||||
packers[i].generate_r1cs_constraints(enforce_bitness);
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void multipacking_gadget<FieldT>::generate_r1cs_witness_from_packed()
|
||||
{
|
||||
for (size_t i = 0; i < num_chunks; ++i)
|
||||
{
|
||||
packers[i].generate_r1cs_witness_from_packed();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void multipacking_gadget<FieldT>::generate_r1cs_witness_from_bits()
|
||||
{
|
||||
for (size_t i = 0; i < num_chunks; ++i)
|
||||
{
|
||||
packers[i].generate_r1cs_witness_from_bits();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
size_t multipacking_num_chunks(const size_t num_bits)
|
||||
{
|
||||
return div_ceil(num_bits, FieldT::capacity());
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
field_vector_copy_gadget<FieldT>::field_vector_copy_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &source,
|
||||
const pb_variable_array<FieldT> &target,
|
||||
const pb_linear_combination<FieldT> &do_copy,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix), source(source), target(target), do_copy(do_copy)
|
||||
{
|
||||
assert(source.size() == target.size());
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void field_vector_copy_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < source.size(); ++i)
|
||||
{
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(do_copy, source[i] - target[i], 0),
|
||||
FMT(this->annotation_prefix, " copying_check_%zu", i));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void field_vector_copy_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
do_copy.evaluate(this->pb);
|
||||
assert(this->pb.lc_val(do_copy) == FieldT::one() || this->pb.lc_val(do_copy) == FieldT::zero());
|
||||
if (this->pb.lc_val(do_copy) != FieldT::zero())
|
||||
{
|
||||
for (size_t i = 0; i < source.size(); ++i)
|
||||
{
|
||||
this->pb.val(target[i]) = this->pb.val(source[i]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector_copy_gadget<FieldT>::bit_vector_copy_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &source_bits,
|
||||
const pb_variable_array<FieldT> &target_bits,
|
||||
const pb_linear_combination<FieldT> &do_copy,
|
||||
const size_t chunk_size,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix), source_bits(source_bits), target_bits(target_bits), do_copy(do_copy),
|
||||
chunk_size(chunk_size), num_chunks(div_ceil(source_bits.size(), chunk_size))
|
||||
{
|
||||
assert(source_bits.size() == target_bits.size());
|
||||
|
||||
packed_source.allocate(pb, num_chunks, FMT(annotation_prefix, " packed_source"));
|
||||
pack_source.reset(new multipacking_gadget<FieldT>(pb, source_bits, packed_source, chunk_size, FMT(annotation_prefix, " pack_source")));
|
||||
|
||||
packed_target.allocate(pb, num_chunks, FMT(annotation_prefix, " packed_target"));
|
||||
pack_target.reset(new multipacking_gadget<FieldT>(pb, target_bits, packed_target, chunk_size, FMT(annotation_prefix, " pack_target")));
|
||||
|
||||
copier.reset(new field_vector_copy_gadget<FieldT>(pb, packed_source, packed_target, do_copy, FMT(annotation_prefix, " copier")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void bit_vector_copy_gadget<FieldT>::generate_r1cs_constraints(const bool enforce_source_bitness, const bool enforce_target_bitness)
|
||||
{
|
||||
pack_source->generate_r1cs_constraints(enforce_source_bitness);
|
||||
pack_target->generate_r1cs_constraints(enforce_target_bitness);
|
||||
|
||||
copier->generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void bit_vector_copy_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
do_copy.evaluate(this->pb);
|
||||
assert(this->pb.lc_val(do_copy) == FieldT::zero() || this->pb.lc_val(do_copy) == FieldT::one());
|
||||
if (this->pb.lc_val(do_copy) == FieldT::one())
|
||||
{
|
||||
for (size_t i = 0; i < source_bits.size(); ++i)
|
||||
{
|
||||
this->pb.val(target_bits[i]) = this->pb.val(source_bits[i]);
|
||||
}
|
||||
}
|
||||
|
||||
pack_source->generate_r1cs_witness_from_bits();
|
||||
pack_target->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void dual_variable_gadget<FieldT>::generate_r1cs_constraints(const bool enforce_bitness)
|
||||
{
|
||||
consistency_check->generate_r1cs_constraints(enforce_bitness);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void dual_variable_gadget<FieldT>::generate_r1cs_witness_from_packed()
|
||||
{
|
||||
consistency_check->generate_r1cs_witness_from_packed();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void dual_variable_gadget<FieldT>::generate_r1cs_witness_from_bits()
|
||||
{
|
||||
consistency_check->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void disjunction_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
/* inv * sum = output */
|
||||
linear_combination<FieldT> a1, b1, c1;
|
||||
a1.add_term(inv);
|
||||
for (size_t i = 0; i < inputs.size(); ++i)
|
||||
{
|
||||
b1.add_term(inputs[i]);
|
||||
}
|
||||
c1.add_term(output);
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(a1, b1, c1), FMT(this->annotation_prefix, " inv*sum=output"));
|
||||
|
||||
/* (1-output) * sum = 0 */
|
||||
linear_combination<FieldT> a2, b2, c2;
|
||||
a2.add_term(ONE);
|
||||
a2.add_term(output, -1);
|
||||
for (size_t i = 0; i < inputs.size(); ++i)
|
||||
{
|
||||
b2.add_term(inputs[i]);
|
||||
}
|
||||
c2.add_term(ONE, 0);
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(a2, b2, c2), FMT(this->annotation_prefix, " (1-output)*sum=0"));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void disjunction_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
FieldT sum = FieldT::zero();
|
||||
|
||||
for (size_t i = 0; i < inputs.size(); ++i)
|
||||
{
|
||||
sum += this->pb.val(inputs[i]);
|
||||
}
|
||||
|
||||
if (sum.is_zero())
|
||||
{
|
||||
this->pb.val(inv) = FieldT::zero();
|
||||
this->pb.val(output) = FieldT::zero();
|
||||
}
|
||||
else
|
||||
{
|
||||
this->pb.val(inv) = sum.inverse();
|
||||
this->pb.val(output) = FieldT::one();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_disjunction_gadget(const size_t n)
|
||||
{
|
||||
printf("testing disjunction_gadget on all %zu bit strings\n", n);
|
||||
|
||||
protoboard<FieldT> pb;
|
||||
pb_variable_array<FieldT> inputs;
|
||||
inputs.allocate(pb, n, "inputs");
|
||||
|
||||
pb_variable<FieldT> output;
|
||||
output.allocate(pb, "output");
|
||||
|
||||
disjunction_gadget<FieldT> d(pb, inputs, output, "d");
|
||||
d.generate_r1cs_constraints();
|
||||
|
||||
for (size_t w = 0; w < 1ul<<n; ++w)
|
||||
{
|
||||
for (size_t j = 0; j < n; ++j)
|
||||
{
|
||||
pb.val(inputs[j]) = FieldT((w & (1ul<<j)) ? 1 : 0);
|
||||
}
|
||||
|
||||
d.generate_r1cs_witness();
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("positive test for %zu\n", w);
|
||||
#endif
|
||||
assert(pb.val(output) == (w ? FieldT::one() : FieldT::zero()));
|
||||
assert(pb.is_satisfied());
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("negative test for %zu\n", w);
|
||||
#endif
|
||||
pb.val(output) = (w ? FieldT::zero() : FieldT::one());
|
||||
assert(!pb.is_satisfied());
|
||||
}
|
||||
|
||||
print_time("disjunction tests successful");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void conjunction_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
/* inv * (n-sum) = 1-output */
|
||||
linear_combination<FieldT> a1, b1, c1;
|
||||
a1.add_term(inv);
|
||||
b1.add_term(ONE, inputs.size());
|
||||
for (size_t i = 0; i < inputs.size(); ++i)
|
||||
{
|
||||
b1.add_term(inputs[i], -1);
|
||||
}
|
||||
c1.add_term(ONE);
|
||||
c1.add_term(output, -1);
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(a1, b1, c1), FMT(this->annotation_prefix, " inv*(n-sum)=(1-output)"));
|
||||
|
||||
/* output * (n-sum) = 0 */
|
||||
linear_combination<FieldT> a2, b2, c2;
|
||||
a2.add_term(output);
|
||||
b2.add_term(ONE, inputs.size());
|
||||
for (size_t i = 0; i < inputs.size(); ++i)
|
||||
{
|
||||
b2.add_term(inputs[i], -1);
|
||||
}
|
||||
c2.add_term(ONE, 0);
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(a2, b2, c2), FMT(this->annotation_prefix, " output*(n-sum)=0"));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void conjunction_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
FieldT sum = FieldT(inputs.size());
|
||||
|
||||
for (size_t i = 0; i < inputs.size(); ++i)
|
||||
{
|
||||
sum -= this->pb.val(inputs[i]);
|
||||
}
|
||||
|
||||
if (sum.is_zero())
|
||||
{
|
||||
this->pb.val(inv) = FieldT::zero();
|
||||
this->pb.val(output) = FieldT::one();
|
||||
}
|
||||
else
|
||||
{
|
||||
this->pb.val(inv) = sum.inverse();
|
||||
this->pb.val(output) = FieldT::zero();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_conjunction_gadget(const size_t n)
|
||||
{
|
||||
printf("testing conjunction_gadget on all %zu bit strings\n", n);
|
||||
|
||||
protoboard<FieldT> pb;
|
||||
pb_variable_array<FieldT> inputs;
|
||||
inputs.allocate(pb, n, "inputs");
|
||||
|
||||
pb_variable<FieldT> output;
|
||||
output.allocate(pb, "output");
|
||||
|
||||
conjunction_gadget<FieldT> c(pb, inputs, output, "c");
|
||||
c.generate_r1cs_constraints();
|
||||
|
||||
for (size_t w = 0; w < 1ul<<n; ++w)
|
||||
{
|
||||
for (size_t j = 0; j < n; ++j)
|
||||
{
|
||||
pb.val(inputs[j]) = (w & (1ul<<j)) ? FieldT::one() : FieldT::zero();
|
||||
}
|
||||
|
||||
c.generate_r1cs_witness();
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("positive test for %zu\n", w);
|
||||
#endif
|
||||
assert(pb.val(output) == (w == (1ul<<n) - 1 ? FieldT::one() : FieldT::zero()));
|
||||
assert(pb.is_satisfied());
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("negative test for %zu\n", w);
|
||||
#endif
|
||||
pb.val(output) = (w == (1ul<<n) - 1 ? FieldT::zero() : FieldT::one());
|
||||
assert(!pb.is_satisfied());
|
||||
}
|
||||
|
||||
print_time("conjunction tests successful");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void comparison_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
/*
|
||||
packed(alpha) = 2^n + B - A
|
||||
|
||||
not_all_zeros = \bigvee_{i=0}^{n-1} alpha_i
|
||||
|
||||
if B - A > 0, then 2^n + B - A > 2^n,
|
||||
so alpha_n = 1 and not_all_zeros = 1
|
||||
if B - A = 0, then 2^n + B - A = 2^n,
|
||||
so alpha_n = 1 and not_all_zeros = 0
|
||||
if B - A < 0, then 2^n + B - A \in {0, 1, \ldots, 2^n-1},
|
||||
so alpha_n = 0
|
||||
|
||||
therefore alpha_n = less_or_eq and alpha_n * not_all_zeros = less
|
||||
*/
|
||||
|
||||
/* not_all_zeros to be Boolean, alpha_i are Boolean by packing gadget */
|
||||
generate_boolean_r1cs_constraint<FieldT>(this->pb, not_all_zeros,
|
||||
FMT(this->annotation_prefix, " not_all_zeros"));
|
||||
|
||||
/* constraints for packed(alpha) = 2^n + B - A */
|
||||
pack_alpha->generate_r1cs_constraints(true);
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1, (FieldT(2)^n) + B - A, alpha_packed), FMT(this->annotation_prefix, " main_constraint"));
|
||||
|
||||
/* compute result */
|
||||
all_zeros_test->generate_r1cs_constraints();
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(less_or_eq, not_all_zeros, less),
|
||||
FMT(this->annotation_prefix, " less"));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void comparison_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
A.evaluate(this->pb);
|
||||
B.evaluate(this->pb);
|
||||
|
||||
/* unpack 2^n + B - A into alpha_packed */
|
||||
this->pb.val(alpha_packed) = (FieldT(2)^n) + this->pb.lc_val(B) - this->pb.lc_val(A);
|
||||
pack_alpha->generate_r1cs_witness_from_packed();
|
||||
|
||||
/* compute result */
|
||||
all_zeros_test->generate_r1cs_witness();
|
||||
this->pb.val(less) = this->pb.val(less_or_eq) * this->pb.val(not_all_zeros);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_comparison_gadget(const size_t n)
|
||||
{
|
||||
printf("testing comparison_gadget on all %zu bit inputs\n", n);
|
||||
|
||||
protoboard<FieldT> pb;
|
||||
|
||||
pb_variable<FieldT> A, B, less, less_or_eq;
|
||||
A.allocate(pb, "A");
|
||||
B.allocate(pb, "B");
|
||||
less.allocate(pb, "less");
|
||||
less_or_eq.allocate(pb, "less_or_eq");
|
||||
|
||||
comparison_gadget<FieldT> cmp(pb, n, A, B, less, less_or_eq, "cmp");
|
||||
cmp.generate_r1cs_constraints();
|
||||
|
||||
for (size_t a = 0; a < 1ul<<n; ++a)
|
||||
{
|
||||
for (size_t b = 0; b < 1ul<<n; ++b)
|
||||
{
|
||||
pb.val(A) = FieldT(a);
|
||||
pb.val(B) = FieldT(b);
|
||||
|
||||
cmp.generate_r1cs_witness();
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("positive test for %zu < %zu\n", a, b);
|
||||
#endif
|
||||
assert(pb.val(less) == (a < b ? FieldT::one() : FieldT::zero()));
|
||||
assert(pb.val(less_or_eq) == (a <= b ? FieldT::one() : FieldT::zero()));
|
||||
assert(pb.is_satisfied());
|
||||
}
|
||||
}
|
||||
|
||||
print_time("comparison tests successful");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void inner_product_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
/*
|
||||
S_i = \sum_{k=0}^{i+1} A[i] * B[i]
|
||||
S[0] = A[0] * B[0]
|
||||
S[i+1] - S[i] = A[i] * B[i]
|
||||
*/
|
||||
for (size_t i = 0; i < A.size(); ++i)
|
||||
{
|
||||
this->pb.add_r1cs_constraint(
|
||||
r1cs_constraint<FieldT>(A[i], B[i],
|
||||
(i == A.size()-1 ? result : S[i]) + (i == 0 ? 0 * ONE : -S[i-1])),
|
||||
FMT(this->annotation_prefix, " S_%zu", i));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void inner_product_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
FieldT total = FieldT::zero();
|
||||
for (size_t i = 0; i < A.size(); ++i)
|
||||
{
|
||||
A[i].evaluate(this->pb);
|
||||
B[i].evaluate(this->pb);
|
||||
|
||||
total += this->pb.lc_val(A[i]) * this->pb.lc_val(B[i]);
|
||||
this->pb.val(i == A.size()-1 ? result : S[i]) = total;
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_inner_product_gadget(const size_t n)
|
||||
{
|
||||
printf("testing inner_product_gadget on all %zu bit strings\n", n);
|
||||
|
||||
protoboard<FieldT> pb;
|
||||
pb_variable_array<FieldT> A;
|
||||
A.allocate(pb, n, "A");
|
||||
pb_variable_array<FieldT> B;
|
||||
B.allocate(pb, n, "B");
|
||||
|
||||
pb_variable<FieldT> result;
|
||||
result.allocate(pb, "result");
|
||||
|
||||
inner_product_gadget<FieldT> g(pb, A, B, result, "g");
|
||||
g.generate_r1cs_constraints();
|
||||
|
||||
for (size_t i = 0; i < 1ul<<n; ++i)
|
||||
{
|
||||
for (size_t j = 0; j < 1ul<<n; ++j)
|
||||
{
|
||||
size_t correct = 0;
|
||||
for (size_t k = 0; k < n; ++k)
|
||||
{
|
||||
pb.val(A[k]) = (i & (1ul<<k) ? FieldT::one() : FieldT::zero());
|
||||
pb.val(B[k]) = (j & (1ul<<k) ? FieldT::one() : FieldT::zero());
|
||||
correct += ((i & (1ul<<k)) && (j & (1ul<<k)) ? 1 : 0);
|
||||
}
|
||||
|
||||
g.generate_r1cs_witness();
|
||||
#ifdef DEBUG
|
||||
printf("positive test for (%zu, %zu)\n", i, j);
|
||||
#endif
|
||||
assert(pb.val(result) == FieldT(correct));
|
||||
assert(pb.is_satisfied());
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("negative test for (%zu, %zu)\n", i, j);
|
||||
#endif
|
||||
pb.val(result) = FieldT(100*n+19);
|
||||
assert(!pb.is_satisfied());
|
||||
}
|
||||
}
|
||||
|
||||
print_time("inner_product_gadget tests successful");
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void loose_multiplexing_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
/* \alpha_i (index - i) = 0 */
|
||||
for (size_t i = 0; i < arr.size(); ++i)
|
||||
{
|
||||
this->pb.add_r1cs_constraint(
|
||||
r1cs_constraint<FieldT>(alpha[i], index - i, 0),
|
||||
FMT(this->annotation_prefix, " alpha_%zu", i));
|
||||
}
|
||||
|
||||
/* 1 * (\sum \alpha_i) = success_flag */
|
||||
linear_combination<FieldT> a, b, c;
|
||||
a.add_term(ONE);
|
||||
for (size_t i = 0; i < arr.size(); ++i)
|
||||
{
|
||||
b.add_term(alpha[i]);
|
||||
}
|
||||
c.add_term(success_flag);
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(a, b, c), FMT(this->annotation_prefix, " main_constraint"));
|
||||
|
||||
/* now success_flag is constrained to either 0 (if index is out of
|
||||
range) or \alpha_i. constrain it and \alpha_i to zero */
|
||||
generate_boolean_r1cs_constraint<FieldT>(this->pb, success_flag, FMT(this->annotation_prefix, " success_flag"));
|
||||
|
||||
/* compute result */
|
||||
compute_result->generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void loose_multiplexing_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
/* assumes that idx can be fit in ulong; true for our purposes for now */
|
||||
const bigint<FieldT::num_limbs> valint = this->pb.val(index).as_bigint();
|
||||
unsigned long idx = valint.as_ulong();
|
||||
const bigint<FieldT::num_limbs> arrsize(arr.size());
|
||||
|
||||
if (idx >= arr.size() || mpn_cmp(valint.data, arrsize.data, FieldT::num_limbs) >= 0)
|
||||
{
|
||||
for (size_t i = 0; i < arr.size(); ++i)
|
||||
{
|
||||
this->pb.val(alpha[i]) = FieldT::zero();
|
||||
}
|
||||
|
||||
this->pb.val(success_flag) = FieldT::zero();
|
||||
}
|
||||
else
|
||||
{
|
||||
for (size_t i = 0; i < arr.size(); ++i)
|
||||
{
|
||||
this->pb.val(alpha[i]) = (i == idx ? FieldT::one() : FieldT::zero());
|
||||
}
|
||||
|
||||
this->pb.val(success_flag) = FieldT::one();
|
||||
}
|
||||
|
||||
compute_result->generate_r1cs_witness();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void test_loose_multiplexing_gadget(const size_t n)
|
||||
{
|
||||
printf("testing loose_multiplexing_gadget on 2**%zu pb_variable<FieldT> array inputs\n", n);
|
||||
protoboard<FieldT> pb;
|
||||
|
||||
pb_variable_array<FieldT> arr;
|
||||
arr.allocate(pb, 1ul<<n, "arr");
|
||||
pb_variable<FieldT> index, result, success_flag;
|
||||
index.allocate(pb, "index");
|
||||
result.allocate(pb, "result");
|
||||
success_flag.allocate(pb, "success_flag");
|
||||
|
||||
loose_multiplexing_gadget<FieldT> g(pb, arr, index, result, success_flag, "g");
|
||||
g.generate_r1cs_constraints();
|
||||
|
||||
for (size_t i = 0; i < 1ul<<n; ++i)
|
||||
{
|
||||
pb.val(arr[i]) = FieldT((19*i) % (1ul<<n));
|
||||
}
|
||||
|
||||
for (int idx = -1; idx <= (int)(1ul<<n); ++idx)
|
||||
{
|
||||
pb.val(index) = FieldT(idx);
|
||||
g.generate_r1cs_witness();
|
||||
|
||||
if (0 <= idx && idx <= (int)(1ul<<n) - 1)
|
||||
{
|
||||
printf("demuxing element %d (in bounds)\n", idx);
|
||||
assert(pb.val(result) == FieldT((19*idx) % (1ul<<n)));
|
||||
assert(pb.val(success_flag) == FieldT::one());
|
||||
assert(pb.is_satisfied());
|
||||
pb.val(result) -= FieldT::one();
|
||||
assert(!pb.is_satisfied());
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("demuxing element %d (out of bounds)\n", idx);
|
||||
assert(pb.val(success_flag) == FieldT::zero());
|
||||
assert(pb.is_satisfied());
|
||||
pb.val(success_flag) = FieldT::one();
|
||||
assert(!pb.is_satisfied());
|
||||
}
|
||||
}
|
||||
printf("loose_multiplexing_gadget tests successful\n");
|
||||
}
|
||||
|
||||
template<typename FieldT, typename VarT>
|
||||
void create_linear_combination_constraints(protoboard<FieldT> &pb,
|
||||
const std::vector<FieldT> &base,
|
||||
const std::vector<std::pair<VarT, FieldT> > &v,
|
||||
const VarT &target,
|
||||
const std::string &annotation_prefix)
|
||||
{
|
||||
for (size_t i = 0; i < base.size(); ++i)
|
||||
{
|
||||
linear_combination<FieldT> a, b, c;
|
||||
|
||||
a.add_term(ONE);
|
||||
b.add_term(ONE, base[i]);
|
||||
|
||||
for (auto &p : v)
|
||||
{
|
||||
b.add_term(p.first.all_vars[i], p.second);
|
||||
}
|
||||
|
||||
c.add_term(target.all_vars[i]);
|
||||
|
||||
pb.add_r1cs_constraint(r1cs_constraint<FieldT>(a, b, c), FMT(annotation_prefix, " linear_combination_%zu", i));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT, typename VarT>
|
||||
void create_linear_combination_witness(protoboard<FieldT> &pb,
|
||||
const std::vector<FieldT> &base,
|
||||
const std::vector<std::pair<VarT, FieldT> > &v,
|
||||
const VarT &target)
|
||||
{
|
||||
for (size_t i = 0; i < base.size(); ++i)
|
||||
{
|
||||
pb.val(target.all_vars[i]) = base[i];
|
||||
|
||||
for (auto &p : v)
|
||||
{
|
||||
pb.val(target.all_vars[i]) += p.second * pb.val(p.first.all_vars[i]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // BASIC_GADGETS_TCC_
|
|
@ -0,0 +1,45 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for a gadget that can be created from an R1CS constraint system.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef GADGET_FROM_R1CS_HPP_
|
||||
#define GADGET_FROM_R1CS_HPP_
|
||||
|
||||
#include <map>
|
||||
|
||||
#include "gadgetlib1/gadget.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
class gadget_from_r1cs : public gadget<FieldT> {
|
||||
|
||||
private:
|
||||
const std::vector<pb_variable_array<FieldT> > vars;
|
||||
const r1cs_constraint_system<FieldT> cs;
|
||||
std::map<size_t, size_t> cs_to_vars;
|
||||
|
||||
public:
|
||||
|
||||
gadget_from_r1cs(protoboard<FieldT> &pb,
|
||||
const std::vector<pb_variable_array<FieldT> > &vars,
|
||||
const r1cs_constraint_system<FieldT> &cs,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness(const r1cs_primary_input<FieldT> &primary_input,
|
||||
const r1cs_auxiliary_input<FieldT> &auxiliary_input);
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/gadget_from_r1cs.tcc"
|
||||
|
||||
#endif // GADGET_FROM_R1CS_HPP_
|
|
@ -0,0 +1,123 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for a gadget that can be created from an R1CS constraint system.
|
||||
|
||||
See gadget_from_r1cs.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef GADGET_FROM_R1CS_TCC_
|
||||
#define GADGET_FROM_R1CS_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
gadget_from_r1cs<FieldT>::gadget_from_r1cs(protoboard<FieldT> &pb,
|
||||
const std::vector<pb_variable_array<FieldT> > &vars,
|
||||
const r1cs_constraint_system<FieldT> &cs,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
vars(vars),
|
||||
cs(cs)
|
||||
{
|
||||
cs_to_vars[0] = 0; /* constant term maps to constant term */
|
||||
|
||||
size_t cs_var_idx = 1;
|
||||
for (auto va : vars)
|
||||
{
|
||||
#ifdef DEBUG
|
||||
printf("gadget_from_r1cs: translating a block of variables with length %zu\n", va.size());
|
||||
#endif
|
||||
for (auto v : va)
|
||||
{
|
||||
cs_to_vars[cs_var_idx] = v.index;
|
||||
|
||||
#ifdef DEBUG
|
||||
if (v.index != 0)
|
||||
{
|
||||
// handle annotations, except for re-annotating constant term
|
||||
const std::map<size_t, std::string>::const_iterator it = cs.variable_annotations.find(cs_var_idx);
|
||||
|
||||
std::string annotation = FMT(annotation_prefix, " variable_%zu", cs_var_idx);
|
||||
if (it != cs.variable_annotations.end())
|
||||
{
|
||||
annotation = annotation_prefix + " " + it->second;
|
||||
}
|
||||
|
||||
pb.augment_variable_annotation(v, annotation);
|
||||
}
|
||||
#endif
|
||||
++cs_var_idx;
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("gadget_from_r1cs: sum of all block lengths: %zu\n", cs_var_idx-1);
|
||||
printf("gadget_from_r1cs: cs.num_variables(): %zu\n", cs.num_variables());
|
||||
#endif
|
||||
|
||||
assert(cs_var_idx - 1 == cs.num_variables());
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void gadget_from_r1cs<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < cs.num_constraints(); ++i)
|
||||
{
|
||||
const r1cs_constraint<FieldT> &constr = cs.constraints[i];
|
||||
r1cs_constraint<FieldT> translated_constr;
|
||||
|
||||
for (const linear_term<FieldT> &t: constr.a.terms)
|
||||
{
|
||||
translated_constr.a.terms.emplace_back(linear_term<FieldT>(pb_variable<FieldT>(cs_to_vars[t.index]), t.coeff));
|
||||
}
|
||||
|
||||
for (const linear_term<FieldT> &t: constr.b.terms)
|
||||
{
|
||||
translated_constr.b.terms.emplace_back(linear_term<FieldT>(pb_variable<FieldT>(cs_to_vars[t.index]), t.coeff));
|
||||
}
|
||||
|
||||
for (const linear_term<FieldT> &t: constr.c.terms)
|
||||
{
|
||||
translated_constr.c.terms.emplace_back(linear_term<FieldT>(pb_variable<FieldT>(cs_to_vars[t.index]), t.coeff));
|
||||
}
|
||||
|
||||
std::string annotation = FMT(this->annotation_prefix, " constraint_%zu", i);
|
||||
|
||||
#ifdef DEBUG
|
||||
auto it = cs.constraint_annotations.find(i);
|
||||
if (it != cs.constraint_annotations.end())
|
||||
{
|
||||
annotation = this->annotation_prefix + " " + it->second;
|
||||
}
|
||||
#endif
|
||||
this->pb.add_r1cs_constraint(translated_constr, annotation);
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void gadget_from_r1cs<FieldT>::generate_r1cs_witness(const r1cs_primary_input<FieldT> &primary_input,
|
||||
const r1cs_auxiliary_input<FieldT> &auxiliary_input)
|
||||
{
|
||||
assert(cs.num_inputs() == primary_input.size());
|
||||
assert(cs.num_variables() == primary_input.size() + auxiliary_input.size());
|
||||
|
||||
for (size_t i = 0; i < primary_input.size(); ++i)
|
||||
{
|
||||
this->pb.val(pb_variable<FieldT>(cs_to_vars[i+1])) = primary_input[i];
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < auxiliary_input.size(); ++i)
|
||||
{
|
||||
this->pb.val(pb_variable<FieldT>(cs_to_vars[primary_input.size()+i+1])) = auxiliary_input[i];
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // GADGET_FROM_R1CS_TCC_
|
|
@ -0,0 +1,42 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
#ifndef DIGEST_SELECTOR_GADGET_HPP_
|
||||
#define DIGEST_SELECTOR_GADGET_HPP_
|
||||
|
||||
#include <vector>
|
||||
|
||||
#include "gadgetlib1/gadgets/basic_gadgets.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/hash_io.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
class digest_selector_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
size_t digest_size;
|
||||
digest_variable<FieldT> input;
|
||||
pb_linear_combination<FieldT> is_right;
|
||||
digest_variable<FieldT> left;
|
||||
digest_variable<FieldT> right;
|
||||
|
||||
digest_selector_gadget(protoboard<FieldT> &pb,
|
||||
const size_t digest_size,
|
||||
const digest_variable<FieldT> &input,
|
||||
const pb_linear_combination<FieldT> &is_right,
|
||||
const digest_variable<FieldT> &left,
|
||||
const digest_variable<FieldT> &right,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/hashes/digest_selector_gadget.tcc"
|
||||
|
||||
#endif // DIGEST_SELECTOR_GADGET_HPP_
|
|
@ -0,0 +1,62 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
#ifndef DIGEST_SELECTOR_GADGET_TCC_
|
||||
#define DIGEST_SELECTOR_GADGET_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
digest_selector_gadget<FieldT>::digest_selector_gadget(protoboard<FieldT> &pb,
|
||||
const size_t digest_size,
|
||||
const digest_variable<FieldT> &input,
|
||||
const pb_linear_combination<FieldT> &is_right,
|
||||
const digest_variable<FieldT> &left,
|
||||
const digest_variable<FieldT> &right,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix), digest_size(digest_size), input(input), is_right(is_right), left(left), right(right)
|
||||
{
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void digest_selector_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < digest_size; ++i)
|
||||
{
|
||||
/*
|
||||
input = is_right * right + (1-is_right) * left
|
||||
input - left = is_right(right - left)
|
||||
*/
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(is_right, right.bits[i] - left.bits[i], input.bits[i] - left.bits[i]),
|
||||
FMT(this->annotation_prefix, " propagate_%zu", i));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void digest_selector_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
is_right.evaluate(this->pb);
|
||||
|
||||
assert(this->pb.lc_val(is_right) == FieldT::one() || this->pb.lc_val(is_right) == FieldT::zero());
|
||||
if (this->pb.lc_val(is_right) == FieldT::one())
|
||||
{
|
||||
for (size_t i = 0; i < digest_size; ++i)
|
||||
{
|
||||
this->pb.val(right.bits[i]) = this->pb.val(input.bits[i]);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
for (size_t i = 0; i < digest_size; ++i)
|
||||
{
|
||||
this->pb.val(left.bits[i]) = this->pb.val(input.bits[i]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // DIGEST_SELECTOR_GADGET_TCC_
|
|
@ -0,0 +1,63 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
#ifndef HASH_IO_HPP_
|
||||
#define HASH_IO_HPP_
|
||||
#include <cstddef>
|
||||
#include <vector>
|
||||
#include "gadgetlib1/gadgets/basic_gadgets.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
class digest_variable : public gadget<FieldT> {
|
||||
public:
|
||||
size_t digest_size;
|
||||
pb_variable_array<FieldT> bits;
|
||||
|
||||
digest_variable<FieldT>(protoboard<FieldT> &pb,
|
||||
const size_t digest_size,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
digest_variable<FieldT>(protoboard<FieldT> &pb,
|
||||
const size_t digest_size,
|
||||
const pb_variable_array<FieldT> &partial_bits,
|
||||
const pb_variable<FieldT> &padding,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness(const bit_vector& contents);
|
||||
bit_vector get_digest() const;
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
class block_variable : public gadget<FieldT> {
|
||||
public:
|
||||
size_t block_size;
|
||||
pb_variable_array<FieldT> bits;
|
||||
|
||||
block_variable(protoboard<FieldT> &pb,
|
||||
const size_t block_size,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
block_variable(protoboard<FieldT> &pb,
|
||||
const std::vector<pb_variable_array<FieldT> > &parts,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
block_variable(protoboard<FieldT> &pb,
|
||||
const digest_variable<FieldT> &left,
|
||||
const digest_variable<FieldT> &right,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness(const bit_vector& contents);
|
||||
bit_vector get_block() const;
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
#include "gadgetlib1/gadgets/hashes/hash_io.tcc"
|
||||
|
||||
#endif // HASH_IO_HPP_
|
|
@ -0,0 +1,105 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
#ifndef HASH_IO_TCC_
|
||||
#define HASH_IO_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
digest_variable<FieldT>::digest_variable(protoboard<FieldT> &pb,
|
||||
const size_t digest_size,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix), digest_size(digest_size)
|
||||
{
|
||||
bits.allocate(pb, digest_size, FMT(this->annotation_prefix, " bits"));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
digest_variable<FieldT>::digest_variable(protoboard<FieldT> &pb,
|
||||
const size_t digest_size,
|
||||
const pb_variable_array<FieldT> &partial_bits,
|
||||
const pb_variable<FieldT> &padding,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix), digest_size(digest_size)
|
||||
{
|
||||
assert(bits.size() <= digest_size);
|
||||
bits = partial_bits;
|
||||
while (bits.size() != digest_size)
|
||||
{
|
||||
bits.emplace_back(padding);
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void digest_variable<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < digest_size; ++i)
|
||||
{
|
||||
generate_boolean_r1cs_constraint<FieldT>(this->pb, bits[i], FMT(this->annotation_prefix, " bits_%zu", i));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void digest_variable<FieldT>::generate_r1cs_witness(const bit_vector& contents)
|
||||
{
|
||||
bits.fill_with_bits(this->pb, contents);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector digest_variable<FieldT>::get_digest() const
|
||||
{
|
||||
return bits.get_bits(this->pb);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
block_variable<FieldT>::block_variable(protoboard<FieldT> &pb,
|
||||
const size_t block_size,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix), block_size(block_size)
|
||||
{
|
||||
bits.allocate(pb, block_size, FMT(this->annotation_prefix, " bits"));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
block_variable<FieldT>::block_variable(protoboard<FieldT> &pb,
|
||||
const std::vector<pb_variable_array<FieldT> > &parts,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix)
|
||||
{
|
||||
for (auto &part : parts)
|
||||
{
|
||||
bits.insert(bits.end(), part.begin(), part.end());
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
block_variable<FieldT>::block_variable(protoboard<FieldT> &pb,
|
||||
const digest_variable<FieldT> &left,
|
||||
const digest_variable<FieldT> &right,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix)
|
||||
{
|
||||
assert(left.bits.size() == right.bits.size());
|
||||
block_size = 2 * left.bits.size();
|
||||
bits.insert(bits.end(), left.bits.begin(), left.bits.end());
|
||||
bits.insert(bits.end(), right.bits.begin(), right.bits.end());
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void block_variable<FieldT>::generate_r1cs_witness(const bit_vector& contents)
|
||||
{
|
||||
bits.fill_with_bits(this->pb, contents);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector block_variable<FieldT>::get_block() const
|
||||
{
|
||||
return bits.get_bits(this->pb);
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
#endif // HASH_IO_TCC_
|
|
@ -0,0 +1,160 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for auxiliary gadgets for the SHA256 gadget.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SHA256_AUX_HPP_
|
||||
#define SHA256_AUX_HPP_
|
||||
|
||||
#include "gadgetlib1/gadgets/basic_gadgets.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
class lastbits_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
pb_variable<FieldT> X;
|
||||
size_t X_bits;
|
||||
pb_variable<FieldT> result;
|
||||
pb_linear_combination_array<FieldT> result_bits;
|
||||
|
||||
pb_linear_combination_array<FieldT> full_bits;
|
||||
std::shared_ptr<packing_gadget<FieldT> > unpack_bits;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_result;
|
||||
|
||||
lastbits_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable<FieldT> &X,
|
||||
const size_t X_bits,
|
||||
const pb_variable<FieldT> &result,
|
||||
const pb_linear_combination_array<FieldT> &result_bits,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
class XOR3_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_variable<FieldT> tmp;
|
||||
public:
|
||||
pb_linear_combination<FieldT> A;
|
||||
pb_linear_combination<FieldT> B;
|
||||
pb_linear_combination<FieldT> C;
|
||||
bool assume_C_is_zero;
|
||||
pb_linear_combination<FieldT> out;
|
||||
|
||||
XOR3_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination<FieldT> &A,
|
||||
const pb_linear_combination<FieldT> &B,
|
||||
const pb_linear_combination<FieldT> &C,
|
||||
const bool assume_C_is_zero,
|
||||
const pb_linear_combination<FieldT> &out,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
/* Page 10 of http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf */
|
||||
template<typename FieldT>
|
||||
class small_sigma_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_variable_array<FieldT> W;
|
||||
pb_variable<FieldT> result;
|
||||
public:
|
||||
pb_variable_array<FieldT> result_bits;
|
||||
std::vector<std::shared_ptr<XOR3_gadget<FieldT> > > compute_bits;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_result;
|
||||
|
||||
small_sigma_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &W,
|
||||
const pb_variable<FieldT> &result,
|
||||
const size_t rot1,
|
||||
const size_t rot2,
|
||||
const size_t shift,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
/* Page 10 of http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf */
|
||||
template<typename FieldT>
|
||||
class big_sigma_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_linear_combination_array<FieldT> W;
|
||||
pb_variable<FieldT> result;
|
||||
public:
|
||||
pb_variable_array<FieldT> result_bits;
|
||||
std::vector<std::shared_ptr<XOR3_gadget<FieldT> > > compute_bits;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_result;
|
||||
|
||||
big_sigma_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &W,
|
||||
const pb_variable<FieldT> &result,
|
||||
const size_t rot1,
|
||||
const size_t rot2,
|
||||
const size_t rot3,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
/* Page 10 of http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf */
|
||||
template<typename FieldT>
|
||||
class choice_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_variable_array<FieldT> result_bits;
|
||||
public:
|
||||
pb_linear_combination_array<FieldT> X;
|
||||
pb_linear_combination_array<FieldT> Y;
|
||||
pb_linear_combination_array<FieldT> Z;
|
||||
pb_variable<FieldT> result;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_result;
|
||||
|
||||
choice_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &X,
|
||||
const pb_linear_combination_array<FieldT> &Y,
|
||||
const pb_linear_combination_array<FieldT> &Z,
|
||||
const pb_variable<FieldT> &result, const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
/* Page 10 of http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf */
|
||||
template<typename FieldT>
|
||||
class majority_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
pb_variable_array<FieldT> result_bits;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_result;
|
||||
public:
|
||||
pb_linear_combination_array<FieldT> X;
|
||||
pb_linear_combination_array<FieldT> Y;
|
||||
pb_linear_combination_array<FieldT> Z;
|
||||
pb_variable<FieldT> result;
|
||||
|
||||
majority_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &X,
|
||||
const pb_linear_combination_array<FieldT> &Y,
|
||||
const pb_linear_combination_array<FieldT> &Z,
|
||||
const pb_variable<FieldT> &result,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/hashes/sha256/sha256_aux.tcc"
|
||||
|
||||
#endif // SHA256_AUX_HPP_
|
|
@ -0,0 +1,297 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for auxiliary gadgets for the SHA256 gadget.
|
||||
|
||||
See sha256_aux.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SHA256_AUX_TCC_
|
||||
#define SHA256_AUX_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
lastbits_gadget<FieldT>::lastbits_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable<FieldT> &X,
|
||||
const size_t X_bits,
|
||||
const pb_variable<FieldT> &result,
|
||||
const pb_linear_combination_array<FieldT> &result_bits,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
X(X),
|
||||
X_bits(X_bits),
|
||||
result(result),
|
||||
result_bits(result_bits)
|
||||
{
|
||||
full_bits = result_bits;
|
||||
for (size_t i = result_bits.size(); i < X_bits; ++i)
|
||||
{
|
||||
pb_variable<FieldT> full_bits_overflow;
|
||||
full_bits_overflow.allocate(pb, FMT(this->annotation_prefix, " full_bits_%zu", i));
|
||||
full_bits.emplace_back(full_bits_overflow);
|
||||
}
|
||||
|
||||
unpack_bits.reset(new packing_gadget<FieldT>(pb, full_bits, X, FMT(this->annotation_prefix, " unpack_bits")));
|
||||
pack_result.reset(new packing_gadget<FieldT>(pb, result_bits, result, FMT(this->annotation_prefix, " pack_result")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void lastbits_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
unpack_bits->generate_r1cs_constraints(true);
|
||||
pack_result->generate_r1cs_constraints(false);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void lastbits_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
unpack_bits->generate_r1cs_witness_from_packed();
|
||||
pack_result->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
XOR3_gadget<FieldT>::XOR3_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination<FieldT> &A,
|
||||
const pb_linear_combination<FieldT> &B,
|
||||
const pb_linear_combination<FieldT> &C,
|
||||
const bool assume_C_is_zero,
|
||||
const pb_linear_combination<FieldT> &out,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
A(A),
|
||||
B(B),
|
||||
C(C),
|
||||
assume_C_is_zero(assume_C_is_zero),
|
||||
out(out)
|
||||
{
|
||||
if (!assume_C_is_zero)
|
||||
{
|
||||
tmp.allocate(pb, FMT(this->annotation_prefix, " tmp"));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void XOR3_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
/*
|
||||
tmp = A + B - 2AB i.e. tmp = A xor B
|
||||
out = tmp + C - 2tmp C i.e. out = tmp xor C
|
||||
*/
|
||||
if (assume_C_is_zero)
|
||||
{
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(2*A, B, A + B - out), FMT(this->annotation_prefix, " implicit_tmp_equals_out"));
|
||||
}
|
||||
else
|
||||
{
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(2*A, B, A + B - tmp), FMT(this->annotation_prefix, " tmp"));
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(2 * tmp, C, tmp + C - out), FMT(this->annotation_prefix, " out"));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void XOR3_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
if (assume_C_is_zero)
|
||||
{
|
||||
this->pb.lc_val(out) = this->pb.lc_val(A) + this->pb.lc_val(B) - FieldT(2) * this->pb.lc_val(A) * this->pb.lc_val(B);
|
||||
}
|
||||
else
|
||||
{
|
||||
this->pb.val(tmp) = this->pb.lc_val(A) + this->pb.lc_val(B) - FieldT(2) * this->pb.lc_val(A) * this->pb.lc_val(B);
|
||||
this->pb.lc_val(out) = this->pb.val(tmp) + this->pb.lc_val(C) - FieldT(2) * this->pb.val(tmp) * this->pb.lc_val(C);
|
||||
}
|
||||
}
|
||||
|
||||
#define SHA256_GADGET_ROTR(A, i, k) A[((i)+(k)) % 32]
|
||||
|
||||
/* Page 10 of http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf */
|
||||
template<typename FieldT>
|
||||
small_sigma_gadget<FieldT>::small_sigma_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &W,
|
||||
const pb_variable<FieldT> &result,
|
||||
const size_t rot1,
|
||||
const size_t rot2,
|
||||
const size_t shift,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
W(W),
|
||||
result(result)
|
||||
{
|
||||
result_bits.allocate(pb, 32, FMT(this->annotation_prefix, " result_bits"));
|
||||
compute_bits.resize(32);
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
compute_bits[i].reset(new XOR3_gadget<FieldT>(pb, SHA256_GADGET_ROTR(W, i, rot1), SHA256_GADGET_ROTR(W, i, rot2),
|
||||
(i + shift < 32 ? W[i+shift] : ONE),
|
||||
(i + shift >= 32), result_bits[i],
|
||||
FMT(this->annotation_prefix, " compute_bits_%zu", i)));
|
||||
}
|
||||
pack_result.reset(new packing_gadget<FieldT>(pb, result_bits, result, FMT(this->annotation_prefix, " pack_result")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void small_sigma_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
compute_bits[i]->generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
pack_result->generate_r1cs_constraints(false);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void small_sigma_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
compute_bits[i]->generate_r1cs_witness();
|
||||
}
|
||||
|
||||
pack_result->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
big_sigma_gadget<FieldT>::big_sigma_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &W,
|
||||
const pb_variable<FieldT> &result,
|
||||
const size_t rot1,
|
||||
const size_t rot2,
|
||||
const size_t rot3,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
W(W),
|
||||
result(result)
|
||||
{
|
||||
result_bits.allocate(pb, 32, FMT(this->annotation_prefix, " result_bits"));
|
||||
compute_bits.resize(32);
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
compute_bits[i].reset(new XOR3_gadget<FieldT>(pb, SHA256_GADGET_ROTR(W, i, rot1), SHA256_GADGET_ROTR(W, i, rot2), SHA256_GADGET_ROTR(W, i, rot3), false, result_bits[i],
|
||||
FMT(this->annotation_prefix, " compute_bits_%zu", i)));
|
||||
}
|
||||
|
||||
pack_result.reset(new packing_gadget<FieldT>(pb, result_bits, result, FMT(this->annotation_prefix, " pack_result")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void big_sigma_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
compute_bits[i]->generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
pack_result->generate_r1cs_constraints(false);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void big_sigma_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
compute_bits[i]->generate_r1cs_witness();
|
||||
}
|
||||
|
||||
pack_result->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
/* Page 10 of http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf */
|
||||
template<typename FieldT>
|
||||
choice_gadget<FieldT>::choice_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &X,
|
||||
const pb_linear_combination_array<FieldT> &Y,
|
||||
const pb_linear_combination_array<FieldT> &Z,
|
||||
const pb_variable<FieldT> &result, const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
X(X),
|
||||
Y(Y),
|
||||
Z(Z),
|
||||
result(result)
|
||||
{
|
||||
result_bits.allocate(pb, 32, FMT(this->annotation_prefix, " result_bits"));
|
||||
pack_result.reset(new packing_gadget<FieldT>(pb, result_bits, result, FMT(this->annotation_prefix, " result")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void choice_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
/*
|
||||
result = x * y + (1-x) * z
|
||||
result - z = x * (y - z)
|
||||
*/
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(X[i], Y[i] - Z[i], result_bits[i] - Z[i]), FMT(this->annotation_prefix, " result_bits_%zu", i));
|
||||
}
|
||||
pack_result->generate_r1cs_constraints(false);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void choice_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
this->pb.val(result_bits[i]) = this->pb.lc_val(X[i]) * this->pb.lc_val(Y[i]) + (FieldT::one() - this->pb.lc_val(X[i])) * this->pb.lc_val(Z[i]);
|
||||
}
|
||||
pack_result->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
/* Page 10 of http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf */
|
||||
template<typename FieldT>
|
||||
majority_gadget<FieldT>::majority_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &X,
|
||||
const pb_linear_combination_array<FieldT> &Y,
|
||||
const pb_linear_combination_array<FieldT> &Z,
|
||||
const pb_variable<FieldT> &result,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
X(X),
|
||||
Y(Y),
|
||||
Z(Z),
|
||||
result(result)
|
||||
{
|
||||
result_bits.allocate(pb, 32, FMT(this->annotation_prefix, " result_bits"));
|
||||
pack_result.reset(new packing_gadget<FieldT>(pb, result_bits, result, FMT(this->annotation_prefix, " result")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void majority_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
/*
|
||||
2*result + aux = x + y + z
|
||||
x, y, z, aux -- bits
|
||||
aux = x + y + z - 2*result
|
||||
*/
|
||||
generate_boolean_r1cs_constraint<FieldT>(this->pb, result_bits[i], FMT(this->annotation_prefix, " result_%zu", i));
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(X[i] + Y[i] + Z[i] - 2 * result_bits[i],
|
||||
1 - (X[i] + Y[i] + Z[i] - 2 * result_bits[i]),
|
||||
0),
|
||||
FMT(this->annotation_prefix, " result_bits_%zu", i));
|
||||
}
|
||||
pack_result->generate_r1cs_constraints(false);
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void majority_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
for (size_t i = 0; i < 32; ++i)
|
||||
{
|
||||
const long v = (this->pb.lc_val(X[i]) + this->pb.lc_val(Y[i]) + this->pb.lc_val(Z[i])).as_ulong();
|
||||
this->pb.val(result_bits[i]) = FieldT(v / 2);
|
||||
}
|
||||
|
||||
pack_result->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // SHA256_AUX_TCC_
|
|
@ -0,0 +1,108 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for gadgets for the SHA256 message schedule and round function.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SHA256_COMPONENTS_HPP_
|
||||
#define SHA256_COMPONENTS_HPP_
|
||||
|
||||
#include "gadgetlib1/gadgets/basic_gadgets.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/hash_io.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/sha256/sha256_aux.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
const size_t SHA256_digest_size = 256;
|
||||
const size_t SHA256_block_size = 512;
|
||||
|
||||
template<typename FieldT>
|
||||
pb_linear_combination_array<FieldT> SHA256_default_IV(protoboard<FieldT> &pb);
|
||||
|
||||
template<typename FieldT>
|
||||
class sha256_message_schedule_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
std::vector<pb_variable_array<FieldT> > W_bits;
|
||||
std::vector<std::shared_ptr<packing_gadget<FieldT> > > pack_W;
|
||||
|
||||
std::vector<pb_variable<FieldT> > sigma0;
|
||||
std::vector<pb_variable<FieldT> > sigma1;
|
||||
std::vector<std::shared_ptr<small_sigma_gadget<FieldT> > > compute_sigma0;
|
||||
std::vector<std::shared_ptr<small_sigma_gadget<FieldT> > > compute_sigma1;
|
||||
std::vector<pb_variable<FieldT> > unreduced_W;
|
||||
std::vector<std::shared_ptr<lastbits_gadget<FieldT> > > mod_reduce_W;
|
||||
public:
|
||||
pb_variable_array<FieldT> M;
|
||||
pb_variable_array<FieldT> packed_W;
|
||||
sha256_message_schedule_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &M,
|
||||
const pb_variable_array<FieldT> &packed_W,
|
||||
const std::string &annotation_prefix);
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
class sha256_round_function_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
pb_variable<FieldT> sigma0;
|
||||
pb_variable<FieldT> sigma1;
|
||||
std::shared_ptr<big_sigma_gadget<FieldT> > compute_sigma0;
|
||||
std::shared_ptr<big_sigma_gadget<FieldT> > compute_sigma1;
|
||||
pb_variable<FieldT> choice;
|
||||
pb_variable<FieldT> majority;
|
||||
std::shared_ptr<choice_gadget<FieldT> > compute_choice;
|
||||
std::shared_ptr<majority_gadget<FieldT> > compute_majority;
|
||||
pb_variable<FieldT> packed_d;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_d;
|
||||
pb_variable<FieldT> packed_h;
|
||||
std::shared_ptr<packing_gadget<FieldT> > pack_h;
|
||||
pb_variable<FieldT> unreduced_new_a;
|
||||
pb_variable<FieldT> unreduced_new_e;
|
||||
std::shared_ptr<lastbits_gadget<FieldT> > mod_reduce_new_a;
|
||||
std::shared_ptr<lastbits_gadget<FieldT> > mod_reduce_new_e;
|
||||
pb_variable<FieldT> packed_new_a;
|
||||
pb_variable<FieldT> packed_new_e;
|
||||
public:
|
||||
pb_linear_combination_array<FieldT> a;
|
||||
pb_linear_combination_array<FieldT> b;
|
||||
pb_linear_combination_array<FieldT> c;
|
||||
pb_linear_combination_array<FieldT> d;
|
||||
pb_linear_combination_array<FieldT> e;
|
||||
pb_linear_combination_array<FieldT> f;
|
||||
pb_linear_combination_array<FieldT> g;
|
||||
pb_linear_combination_array<FieldT> h;
|
||||
pb_variable<FieldT> W;
|
||||
long K;
|
||||
pb_linear_combination_array<FieldT> new_a;
|
||||
pb_linear_combination_array<FieldT> new_e;
|
||||
|
||||
sha256_round_function_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &a,
|
||||
const pb_linear_combination_array<FieldT> &b,
|
||||
const pb_linear_combination_array<FieldT> &c,
|
||||
const pb_linear_combination_array<FieldT> &d,
|
||||
const pb_linear_combination_array<FieldT> &e,
|
||||
const pb_linear_combination_array<FieldT> &f,
|
||||
const pb_linear_combination_array<FieldT> &g,
|
||||
const pb_linear_combination_array<FieldT> &h,
|
||||
const pb_variable<FieldT> &W,
|
||||
const long &K,
|
||||
const pb_linear_combination_array<FieldT> &new_a,
|
||||
const pb_linear_combination_array<FieldT> &new_e,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/hashes/sha256/sha256_components.tcc"
|
||||
|
||||
#endif // SHA256_COMPONENTS_HPP_
|
|
@ -0,0 +1,250 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for gadgets for the SHA256 message schedule and round function.
|
||||
|
||||
See sha256_components.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SHA256_COMPONENTS_TCC_
|
||||
#define SHA256_COMPONENTS_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
const unsigned long SHA256_K[64] = {
|
||||
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
|
||||
0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
|
||||
0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
|
||||
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
|
||||
0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
|
||||
0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
|
||||
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
|
||||
0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
|
||||
};
|
||||
|
||||
const unsigned long SHA256_H[8] = {
|
||||
0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
|
||||
};
|
||||
|
||||
template<typename FieldT>
|
||||
pb_linear_combination_array<FieldT> SHA256_default_IV(protoboard<FieldT> &pb)
|
||||
{
|
||||
pb_linear_combination_array<FieldT> result;
|
||||
result.reserve(SHA256_digest_size);
|
||||
|
||||
for (size_t i = 0; i < SHA256_digest_size; ++i)
|
||||
{
|
||||
int iv_val = (SHA256_H[i / 32] >> (31-(i % 32))) & 1;
|
||||
|
||||
pb_linear_combination<FieldT> iv_element;
|
||||
iv_element.assign(pb, iv_val * ONE);
|
||||
iv_element.evaluate(pb);
|
||||
|
||||
result.emplace_back(iv_element);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
sha256_message_schedule_gadget<FieldT>::sha256_message_schedule_gadget(protoboard<FieldT> &pb,
|
||||
const pb_variable_array<FieldT> &M,
|
||||
const pb_variable_array<FieldT> &packed_W,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
M(M),
|
||||
packed_W(packed_W)
|
||||
{
|
||||
W_bits.resize(64);
|
||||
|
||||
pack_W.resize(16);
|
||||
for (size_t i = 0; i < 16; ++i)
|
||||
{
|
||||
W_bits[i] = pb_variable_array<FieldT>(M.rbegin() + (15-i) * 32, M.rbegin() + (16-i) * 32);
|
||||
pack_W[i].reset(new packing_gadget<FieldT>(pb, W_bits[i], packed_W[i], FMT(this->annotation_prefix, " pack_W_%zu", i)));
|
||||
}
|
||||
|
||||
/* NB: some of those will be un-allocated */
|
||||
sigma0.resize(64);
|
||||
sigma1.resize(64);
|
||||
compute_sigma0.resize(64);
|
||||
compute_sigma1.resize(64);
|
||||
unreduced_W.resize(64);
|
||||
mod_reduce_W.resize(64);
|
||||
|
||||
for (size_t i = 16; i < 64; ++i)
|
||||
{
|
||||
/* allocate result variables for sigma0/sigma1 invocations */
|
||||
sigma0[i].allocate(pb, FMT(this->annotation_prefix, " sigma0_%zu", i));
|
||||
sigma1[i].allocate(pb, FMT(this->annotation_prefix, " sigma1_%zu", i));
|
||||
|
||||
/* compute sigma0/sigma1 */
|
||||
compute_sigma0[i].reset(new small_sigma_gadget<FieldT>(pb, W_bits[i-15], sigma0[i], 7, 18, 3, FMT(this->annotation_prefix, " compute_sigma0_%zu", i)));
|
||||
compute_sigma1[i].reset(new small_sigma_gadget<FieldT>(pb, W_bits[i-2], sigma1[i], 17, 19, 10, FMT(this->annotation_prefix, " compute_sigma1_%zu", i)));
|
||||
|
||||
/* unreduced_W = sigma0(W_{i-15}) + sigma1(W_{i-2}) + W_{i-7} + W_{i-16} before modulo 2^32 */
|
||||
unreduced_W[i].allocate(pb, FMT(this->annotation_prefix, "unreduced_W_%zu", i));
|
||||
|
||||
/* allocate the bit representation of packed_W[i] */
|
||||
W_bits[i].allocate(pb, 32, FMT(this->annotation_prefix, " W_bits_%zu", i));
|
||||
|
||||
/* and finally reduce this into packed and bit representations */
|
||||
mod_reduce_W[i].reset(new lastbits_gadget<FieldT>(pb, unreduced_W[i], 32+2, packed_W[i], W_bits[i], FMT(this->annotation_prefix, " mod_reduce_W_%zu", i)));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_message_schedule_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < 16; ++i)
|
||||
{
|
||||
pack_W[i]->generate_r1cs_constraints(false); // do not enforce bitness here; caller be aware.
|
||||
}
|
||||
|
||||
for (size_t i = 16; i < 64; ++i)
|
||||
{
|
||||
compute_sigma0[i]->generate_r1cs_constraints();
|
||||
compute_sigma1[i]->generate_r1cs_constraints();
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1,
|
||||
sigma0[i] + sigma1[i] + packed_W[i-16] + packed_W[i-7],
|
||||
unreduced_W[i]),
|
||||
FMT(this->annotation_prefix, " unreduced_W_%zu", i));
|
||||
|
||||
mod_reduce_W[i]->generate_r1cs_constraints();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_message_schedule_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
for (size_t i = 0; i < 16; ++i)
|
||||
{
|
||||
pack_W[i]->generate_r1cs_witness_from_bits();
|
||||
}
|
||||
|
||||
for (size_t i = 16; i < 64; ++i)
|
||||
{
|
||||
compute_sigma0[i]->generate_r1cs_witness();
|
||||
compute_sigma1[i]->generate_r1cs_witness();
|
||||
|
||||
this->pb.val(unreduced_W[i]) = this->pb.val(sigma0[i]) + this->pb.val(sigma1[i]) + this->pb.val(packed_W[i-16]) + this->pb.val(packed_W[i-7]);
|
||||
mod_reduce_W[i]->generate_r1cs_witness();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
sha256_round_function_gadget<FieldT>::sha256_round_function_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &a,
|
||||
const pb_linear_combination_array<FieldT> &b,
|
||||
const pb_linear_combination_array<FieldT> &c,
|
||||
const pb_linear_combination_array<FieldT> &d,
|
||||
const pb_linear_combination_array<FieldT> &e,
|
||||
const pb_linear_combination_array<FieldT> &f,
|
||||
const pb_linear_combination_array<FieldT> &g,
|
||||
const pb_linear_combination_array<FieldT> &h,
|
||||
const pb_variable<FieldT> &W,
|
||||
const long &K,
|
||||
const pb_linear_combination_array<FieldT> &new_a,
|
||||
const pb_linear_combination_array<FieldT> &new_e,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
a(a),
|
||||
b(b),
|
||||
c(c),
|
||||
d(d),
|
||||
e(e),
|
||||
f(f),
|
||||
g(g),
|
||||
h(h),
|
||||
W(W),
|
||||
K(K),
|
||||
new_a(new_a),
|
||||
new_e(new_e)
|
||||
{
|
||||
/* compute sigma0 and sigma1 */
|
||||
sigma0.allocate(pb, FMT(this->annotation_prefix, " sigma0"));
|
||||
sigma1.allocate(pb, FMT(this->annotation_prefix, " sigma1"));
|
||||
compute_sigma0.reset(new big_sigma_gadget<FieldT>(pb, a, sigma0, 2, 13, 22, FMT(this->annotation_prefix, " compute_sigma0")));
|
||||
compute_sigma1.reset(new big_sigma_gadget<FieldT>(pb, e, sigma1, 6, 11, 25, FMT(this->annotation_prefix, " compute_sigma1")));
|
||||
|
||||
/* compute choice */
|
||||
choice.allocate(pb, FMT(this->annotation_prefix, " choice"));
|
||||
compute_choice.reset(new choice_gadget<FieldT>(pb, e, f, g, choice, FMT(this->annotation_prefix, " compute_choice")));
|
||||
|
||||
/* compute majority */
|
||||
majority.allocate(pb, FMT(this->annotation_prefix, " majority"));
|
||||
compute_majority.reset(new majority_gadget<FieldT>(pb, a, b, c, majority, FMT(this->annotation_prefix, " compute_majority")));
|
||||
|
||||
/* pack d */
|
||||
packed_d.allocate(pb, FMT(this->annotation_prefix, " packed_d"));
|
||||
pack_d.reset(new packing_gadget<FieldT>(pb, d, packed_d, FMT(this->annotation_prefix, " pack_d")));
|
||||
|
||||
/* pack h */
|
||||
packed_h.allocate(pb, FMT(this->annotation_prefix, " packed_h"));
|
||||
pack_h.reset(new packing_gadget<FieldT>(pb, h, packed_h, FMT(this->annotation_prefix, " pack_h")));
|
||||
|
||||
/* compute the actual results for the round */
|
||||
unreduced_new_a.allocate(pb, FMT(this->annotation_prefix, " unreduced_new_a"));
|
||||
unreduced_new_e.allocate(pb, FMT(this->annotation_prefix, " unreduced_new_e"));
|
||||
|
||||
packed_new_a.allocate(pb, FMT(this->annotation_prefix, " packed_new_a"));
|
||||
packed_new_e.allocate(pb, FMT(this->annotation_prefix, " packed_new_e"));
|
||||
|
||||
mod_reduce_new_a.reset(new lastbits_gadget<FieldT>(pb, unreduced_new_a, 32+3, packed_new_a, new_a, FMT(this->annotation_prefix, " mod_reduce_new_a")));
|
||||
mod_reduce_new_e.reset(new lastbits_gadget<FieldT>(pb, unreduced_new_e, 32+3, packed_new_e, new_e, FMT(this->annotation_prefix, " mod_reduce_new_e")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_round_function_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
compute_sigma0->generate_r1cs_constraints();
|
||||
compute_sigma1->generate_r1cs_constraints();
|
||||
|
||||
compute_choice->generate_r1cs_constraints();
|
||||
compute_majority->generate_r1cs_constraints();
|
||||
|
||||
pack_d->generate_r1cs_constraints(false);
|
||||
pack_h->generate_r1cs_constraints(false);
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1,
|
||||
packed_h + sigma1 + choice + K + W + sigma0 + majority,
|
||||
unreduced_new_a),
|
||||
FMT(this->annotation_prefix, " unreduced_new_a"));
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1,
|
||||
packed_d + packed_h + sigma1 + choice + K + W,
|
||||
unreduced_new_e),
|
||||
FMT(this->annotation_prefix, " unreduced_new_e"));
|
||||
|
||||
mod_reduce_new_a->generate_r1cs_constraints();
|
||||
mod_reduce_new_e->generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_round_function_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
compute_sigma0->generate_r1cs_witness();
|
||||
compute_sigma1->generate_r1cs_witness();
|
||||
|
||||
compute_choice->generate_r1cs_witness();
|
||||
compute_majority->generate_r1cs_witness();
|
||||
|
||||
pack_d->generate_r1cs_witness_from_bits();
|
||||
pack_h->generate_r1cs_witness_from_bits();
|
||||
|
||||
this->pb.val(unreduced_new_a) = this->pb.val(packed_h) + this->pb.val(sigma1) + this->pb.val(choice) + FieldT(K) + this->pb.val(W) + this->pb.val(sigma0) + this->pb.val(majority);
|
||||
this->pb.val(unreduced_new_e) = this->pb.val(packed_d) + this->pb.val(packed_h) + this->pb.val(sigma1) + this->pb.val(choice) + FieldT(K) + this->pb.val(W);
|
||||
|
||||
mod_reduce_new_a->generate_r1cs_witness();
|
||||
mod_reduce_new_e->generate_r1cs_witness();
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // SHA256_COMPONENTS_TCC_
|
|
@ -0,0 +1,98 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for top-level SHA256 gadgets.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SHA256_GADGET_HPP_
|
||||
#define SHA256_GADGET_HPP_
|
||||
|
||||
#include "common/data_structures/merkle_tree.hpp"
|
||||
#include "gadgetlib1/gadgets/basic_gadgets.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/hash_io.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/sha256/sha256_components.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
/**
|
||||
* Gadget for the SHA256 compression function.
|
||||
*/
|
||||
template<typename FieldT>
|
||||
class sha256_compression_function_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_a;
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_b;
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_c;
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_d;
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_e;
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_f;
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_g;
|
||||
std::vector<pb_linear_combination_array<FieldT> > round_h;
|
||||
|
||||
pb_variable_array<FieldT> packed_W;
|
||||
std::shared_ptr<sha256_message_schedule_gadget<FieldT> > message_schedule;
|
||||
std::vector<sha256_round_function_gadget<FieldT> > round_functions;
|
||||
|
||||
pb_variable_array<FieldT> unreduced_output;
|
||||
pb_variable_array<FieldT> reduced_output;
|
||||
std::vector<lastbits_gadget<FieldT> > reduce_output;
|
||||
public:
|
||||
pb_linear_combination_array<FieldT> prev_output;
|
||||
pb_variable_array<FieldT> new_block;
|
||||
digest_variable<FieldT> output;
|
||||
|
||||
sha256_compression_function_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &prev_output,
|
||||
const pb_variable_array<FieldT> &new_block,
|
||||
const digest_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix);
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
};
|
||||
|
||||
/**
|
||||
* Gadget for the SHA256 compression function, viewed as a 2-to-1 hash
|
||||
* function, and using the same initialization vector as in SHA256
|
||||
* specification. Thus, any collision for
|
||||
* sha256_two_to_one_hash_gadget trivially extends to a collision for
|
||||
* full SHA256 (by appending the same padding).
|
||||
*/
|
||||
template<typename FieldT>
|
||||
class sha256_two_to_one_hash_gadget : public gadget<FieldT> {
|
||||
public:
|
||||
typedef bit_vector hash_value_type;
|
||||
typedef merkle_authentication_path merkle_authentication_path_type;
|
||||
|
||||
std::shared_ptr<sha256_compression_function_gadget<FieldT> > f;
|
||||
|
||||
sha256_two_to_one_hash_gadget(protoboard<FieldT> &pb,
|
||||
const digest_variable<FieldT> &left,
|
||||
const digest_variable<FieldT> &right,
|
||||
const digest_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix);
|
||||
sha256_two_to_one_hash_gadget(protoboard<FieldT> &pb,
|
||||
const size_t block_length,
|
||||
const block_variable<FieldT> &input_block,
|
||||
const digest_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints(const bool ensure_output_bitness=true); // TODO: ignored for now
|
||||
void generate_r1cs_witness();
|
||||
|
||||
static size_t get_block_len();
|
||||
static size_t get_digest_len();
|
||||
static bit_vector get_hash(const bit_vector &input);
|
||||
|
||||
static size_t expected_constraints(const bool ensure_output_bitness=true); // TODO: ignored for now
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/hashes/sha256/sha256_gadget.tcc"
|
||||
|
||||
#endif // SHA256_GADGET_HPP_
|
|
@ -0,0 +1,230 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for top-level SHA256 gadgets.
|
||||
|
||||
See sha256_gadget.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef SHA256_GADGET_TCC_
|
||||
#define SHA256_GADGET_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT>
|
||||
sha256_compression_function_gadget<FieldT>::sha256_compression_function_gadget(protoboard<FieldT> &pb,
|
||||
const pb_linear_combination_array<FieldT> &prev_output,
|
||||
const pb_variable_array<FieldT> &new_block,
|
||||
const digest_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
prev_output(prev_output),
|
||||
new_block(new_block),
|
||||
output(output)
|
||||
{
|
||||
/* message schedule and inputs for it */
|
||||
packed_W.allocate(pb, 64, FMT(this->annotation_prefix, " packed_W"));
|
||||
message_schedule.reset(new sha256_message_schedule_gadget<FieldT>(pb, new_block, packed_W, FMT(this->annotation_prefix, " message_schedule")));
|
||||
|
||||
/* initalize */
|
||||
round_a.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 7*32, prev_output.rbegin() + 8*32));
|
||||
round_b.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 6*32, prev_output.rbegin() + 7*32));
|
||||
round_c.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 5*32, prev_output.rbegin() + 6*32));
|
||||
round_d.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 4*32, prev_output.rbegin() + 5*32));
|
||||
round_e.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 3*32, prev_output.rbegin() + 4*32));
|
||||
round_f.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 2*32, prev_output.rbegin() + 3*32));
|
||||
round_g.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 1*32, prev_output.rbegin() + 2*32));
|
||||
round_h.push_back(pb_linear_combination_array<FieldT>(prev_output.rbegin() + 0*32, prev_output.rbegin() + 1*32));
|
||||
|
||||
/* do the rounds */
|
||||
for (size_t i = 0; i < 64; ++i)
|
||||
{
|
||||
round_h.push_back(round_g[i]);
|
||||
round_g.push_back(round_f[i]);
|
||||
round_f.push_back(round_e[i]);
|
||||
round_d.push_back(round_c[i]);
|
||||
round_c.push_back(round_b[i]);
|
||||
round_b.push_back(round_a[i]);
|
||||
|
||||
pb_variable_array<FieldT> new_round_a_variables;
|
||||
new_round_a_variables.allocate(pb, 32, FMT(this->annotation_prefix, " new_round_a_variables_%zu", i+1));
|
||||
round_a.emplace_back(new_round_a_variables);
|
||||
|
||||
pb_variable_array<FieldT> new_round_e_variables;
|
||||
new_round_e_variables.allocate(pb, 32, FMT(this->annotation_prefix, " new_round_e_variables_%zu", i+1));
|
||||
round_e.emplace_back(new_round_e_variables);
|
||||
|
||||
round_functions.push_back(sha256_round_function_gadget<FieldT>(pb,
|
||||
round_a[i], round_b[i], round_c[i], round_d[i],
|
||||
round_e[i], round_f[i], round_g[i], round_h[i],
|
||||
packed_W[i], SHA256_K[i], round_a[i+1], round_e[i+1],
|
||||
FMT(this->annotation_prefix, " round_functions_%zu", i)));
|
||||
}
|
||||
|
||||
/* finalize */
|
||||
unreduced_output.allocate(pb, 8, FMT(this->annotation_prefix, " unreduced_output"));
|
||||
reduced_output.allocate(pb, 8, FMT(this->annotation_prefix, " reduced_output"));
|
||||
for (size_t i = 0; i < 8; ++i)
|
||||
{
|
||||
reduce_output.push_back(lastbits_gadget<FieldT>(pb,
|
||||
unreduced_output[i],
|
||||
32+1,
|
||||
reduced_output[i],
|
||||
pb_variable_array<FieldT>(output.bits.rbegin() + (7-i) * 32, output.bits.rbegin() + (8-i) * 32),
|
||||
FMT(this->annotation_prefix, " reduce_output_%zu", i)));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_compression_function_gadget<FieldT>::generate_r1cs_constraints()
|
||||
{
|
||||
message_schedule->generate_r1cs_constraints();
|
||||
for (size_t i = 0; i < 64; ++i)
|
||||
{
|
||||
round_functions[i].generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < 4; ++i)
|
||||
{
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1,
|
||||
round_functions[3-i].packed_d + round_functions[63-i].packed_new_a,
|
||||
unreduced_output[i]),
|
||||
FMT(this->annotation_prefix, " unreduced_output_%zu", i));
|
||||
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(1,
|
||||
round_functions[3-i].packed_h + round_functions[63-i].packed_new_e,
|
||||
unreduced_output[4+i]),
|
||||
FMT(this->annotation_prefix, " unreduced_output_%zu", 4+i));
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < 8; ++i)
|
||||
{
|
||||
reduce_output[i].generate_r1cs_constraints();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_compression_function_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
message_schedule->generate_r1cs_witness();
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("Input:\n");
|
||||
for (size_t j = 0; j < 16; ++j)
|
||||
{
|
||||
printf("%lx ", this->pb.val(packed_W[j]).as_ulong());
|
||||
}
|
||||
printf("\n");
|
||||
#endif
|
||||
|
||||
for (size_t i = 0; i < 64; ++i)
|
||||
{
|
||||
round_functions[i].generate_r1cs_witness();
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < 4; ++i)
|
||||
{
|
||||
this->pb.val(unreduced_output[i]) = this->pb.val(round_functions[3-i].packed_d) + this->pb.val(round_functions[63-i].packed_new_a);
|
||||
this->pb.val(unreduced_output[4+i]) = this->pb.val(round_functions[3-i].packed_h) + this->pb.val(round_functions[63-i].packed_new_e);
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < 8; ++i)
|
||||
{
|
||||
reduce_output[i].generate_r1cs_witness();
|
||||
}
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("Output:\n");
|
||||
for (size_t j = 0; j < 8; ++j)
|
||||
{
|
||||
printf("%lx ", this->pb.val(reduced_output[j]).as_ulong());
|
||||
}
|
||||
printf("\n");
|
||||
#endif
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
sha256_two_to_one_hash_gadget<FieldT>::sha256_two_to_one_hash_gadget(protoboard<FieldT> &pb,
|
||||
const digest_variable<FieldT> &left,
|
||||
const digest_variable<FieldT> &right,
|
||||
const digest_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix)
|
||||
{
|
||||
/* concatenate block = left || right */
|
||||
pb_variable_array<FieldT> block;
|
||||
block.insert(block.end(), left.bits.begin(), left.bits.end());
|
||||
block.insert(block.end(), right.bits.begin(), right.bits.end());
|
||||
|
||||
/* compute the hash itself */
|
||||
f.reset(new sha256_compression_function_gadget<FieldT>(pb, SHA256_default_IV<FieldT>(pb), block, output, FMT(this->annotation_prefix, " f")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
sha256_two_to_one_hash_gadget<FieldT>::sha256_two_to_one_hash_gadget(protoboard<FieldT> &pb,
|
||||
const size_t block_length,
|
||||
const block_variable<FieldT> &input_block,
|
||||
const digest_variable<FieldT> &output,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix)
|
||||
{
|
||||
assert(block_length == SHA256_block_size);
|
||||
assert(input_block.bits.size() == block_length);
|
||||
f.reset(new sha256_compression_function_gadget<FieldT>(pb, SHA256_default_IV<FieldT>(pb), input_block.bits, output, FMT(this->annotation_prefix, " f")));
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_two_to_one_hash_gadget<FieldT>::generate_r1cs_constraints(const bool ensure_output_bitness)
|
||||
{
|
||||
UNUSED(ensure_output_bitness);
|
||||
f->generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
void sha256_two_to_one_hash_gadget<FieldT>::generate_r1cs_witness()
|
||||
{
|
||||
f->generate_r1cs_witness();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
size_t sha256_two_to_one_hash_gadget<FieldT>::get_block_len()
|
||||
{
|
||||
return SHA256_block_size;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
size_t sha256_two_to_one_hash_gadget<FieldT>::get_digest_len()
|
||||
{
|
||||
return SHA256_digest_size;
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
bit_vector sha256_two_to_one_hash_gadget<FieldT>::get_hash(const bit_vector &input)
|
||||
{
|
||||
protoboard<FieldT> pb;
|
||||
|
||||
block_variable<FieldT> input_variable(pb, SHA256_block_size, "input");
|
||||
digest_variable<FieldT> output_variable(pb, SHA256_digest_size, "output");
|
||||
sha256_two_to_one_hash_gadget<FieldT> f(pb, SHA256_block_size, input_variable, output_variable, "f");
|
||||
|
||||
input_variable.generate_r1cs_witness(input);
|
||||
f.generate_r1cs_witness();
|
||||
|
||||
return output_variable.get_digest();
|
||||
}
|
||||
|
||||
template<typename FieldT>
|
||||
size_t sha256_two_to_one_hash_gadget<FieldT>::expected_constraints(const bool ensure_output_bitness)
|
||||
{
|
||||
UNUSED(ensure_output_bitness);
|
||||
return 27280; /* hardcoded for now */
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // SHA256_GADGET_TCC_
|
|
@ -0,0 +1,55 @@
|
|||
#!/usr/bin/env python
|
||||
##
|
||||
# @author This file is part of libsnark, developed by SCIPR Lab
|
||||
# and contributors (see AUTHORS).
|
||||
# @copyright MIT license (see LICENSE file)
|
||||
|
||||
import random
|
||||
import pypy_sha256 # PyPy's implementation of SHA256 compression function; see copyright and authorship notice within.
|
||||
|
||||
BLOCK_LEN = 512
|
||||
BLOCK_BYTES = BLOCK_LEN // 8
|
||||
HASH_LEN = 256
|
||||
HASH_BYTES = HASH_LEN // 8
|
||||
|
||||
def gen_random_bytes(n):
|
||||
return [random.randint(0, 255) for i in xrange(n)]
|
||||
|
||||
def words_to_bytes(arr):
|
||||
return sum(([x >> 24, (x >> 16) & 0xff, (x >> 8) & 0xff, x & 0xff] for x in arr), [])
|
||||
|
||||
def bytes_to_words(arr):
|
||||
l = len(arr)
|
||||
assert l % 4 == 0
|
||||
return [(arr[i*4 + 3] << 24) + (arr[i*4+2] << 16) + (arr[i*4+1] << 8) + arr[i*4] for i in xrange(l//4)]
|
||||
|
||||
def cpp_val(s, log_radix=32):
|
||||
if log_radix == 8:
|
||||
hexfmt = '0x%02x'
|
||||
elif log_radix == 32:
|
||||
hexfmt = '0x%08x'
|
||||
s = bytes_to_words(s)
|
||||
else:
|
||||
raise
|
||||
return 'int_list_to_bits({%s}, %d)' % (', '.join(hexfmt % x for x in s), log_radix)
|
||||
|
||||
def H_bytes(x):
|
||||
assert len(x) == BLOCK_BYTES
|
||||
state = pypy_sha256.sha_init()
|
||||
state['data'] = words_to_bytes(bytes_to_words(x))
|
||||
pypy_sha256.sha_transform(state)
|
||||
return words_to_bytes(bytes_to_words(words_to_bytes(state['digest'])))
|
||||
|
||||
def generate_sha256_gadget_tests():
|
||||
left = gen_random_bytes(HASH_BYTES)
|
||||
right = gen_random_bytes(HASH_BYTES)
|
||||
hash = H_bytes(left + right)
|
||||
|
||||
print "const bit_vector left_bv = %s;" % cpp_val(left)
|
||||
print "const bit_vector right_bv = %s;" % cpp_val(right)
|
||||
print "const bit_vector hash_bv = %s;" % cpp_val(hash)
|
||||
|
||||
if __name__ == '__main__':
|
||||
random.seed(0) # for reproducibility
|
||||
generate_sha256_gadget_tests()
|
||||
|
|
@ -0,0 +1,263 @@
|
|||
#!/usr/bin/env python
|
||||
#
|
||||
# SHA256 compression function implementation below is a verbatim copy of PyPy's implementation from
|
||||
# https://bitbucket.org/pypy/pypy/raw/f1f064b3faf1e012f7a9a9ab08f18074637ebe8a/lib_pypy/_sha256.py .
|
||||
#
|
||||
# It is licensed under the MIT license and copyright PyPy Copyright holders 2003-2015
|
||||
# See https://bitbucket.org/pypy/pypy/src/tip/LICENSE for the full copyright notice.
|
||||
#
|
||||
|
||||
SHA_BLOCKSIZE = 64
|
||||
SHA_DIGESTSIZE = 32
|
||||
|
||||
|
||||
def new_shaobject():
|
||||
return {
|
||||
'digest': [0]*8,
|
||||
'count_lo': 0,
|
||||
'count_hi': 0,
|
||||
'data': [0]* SHA_BLOCKSIZE,
|
||||
'local': 0,
|
||||
'digestsize': 0
|
||||
}
|
||||
|
||||
ROR = lambda x, y: (((x & 0xffffffff) >> (y & 31)) | (x << (32 - (y & 31)))) & 0xffffffff
|
||||
Ch = lambda x, y, z: (z ^ (x & (y ^ z)))
|
||||
Maj = lambda x, y, z: (((x | y) & z) | (x & y))
|
||||
S = lambda x, n: ROR(x, n)
|
||||
R = lambda x, n: (x & 0xffffffff) >> n
|
||||
Sigma0 = lambda x: (S(x, 2) ^ S(x, 13) ^ S(x, 22))
|
||||
Sigma1 = lambda x: (S(x, 6) ^ S(x, 11) ^ S(x, 25))
|
||||
Gamma0 = lambda x: (S(x, 7) ^ S(x, 18) ^ R(x, 3))
|
||||
Gamma1 = lambda x: (S(x, 17) ^ S(x, 19) ^ R(x, 10))
|
||||
|
||||
def sha_transform(sha_info):
|
||||
W = []
|
||||
|
||||
d = sha_info['data']
|
||||
for i in range(0,16):
|
||||
W.append( (d[4*i]<<24) + (d[4*i+1]<<16) + (d[4*i+2]<<8) + d[4*i+3])
|
||||
|
||||
for i in range(16,64):
|
||||
W.append( (Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]) & 0xffffffff )
|
||||
|
||||
ss = sha_info['digest'][:]
|
||||
|
||||
def RND(a,b,c,d,e,f,g,h,i,ki):
|
||||
t0 = h + Sigma1(e) + Ch(e, f, g) + ki + W[i];
|
||||
t1 = Sigma0(a) + Maj(a, b, c);
|
||||
d += t0;
|
||||
h = t0 + t1;
|
||||
return d & 0xffffffff, h & 0xffffffff
|
||||
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],0,0x428a2f98);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],1,0x71374491);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],2,0xb5c0fbcf);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],3,0xe9b5dba5);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],4,0x3956c25b);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],5,0x59f111f1);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],6,0x923f82a4);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],7,0xab1c5ed5);
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],8,0xd807aa98);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],9,0x12835b01);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],10,0x243185be);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],11,0x550c7dc3);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],12,0x72be5d74);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],13,0x80deb1fe);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],14,0x9bdc06a7);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],15,0xc19bf174);
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],16,0xe49b69c1);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],17,0xefbe4786);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],18,0x0fc19dc6);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],19,0x240ca1cc);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],20,0x2de92c6f);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],21,0x4a7484aa);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],22,0x5cb0a9dc);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],23,0x76f988da);
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],24,0x983e5152);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],25,0xa831c66d);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],26,0xb00327c8);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],27,0xbf597fc7);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],28,0xc6e00bf3);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],29,0xd5a79147);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],30,0x06ca6351);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],31,0x14292967);
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],32,0x27b70a85);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],33,0x2e1b2138);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],34,0x4d2c6dfc);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],35,0x53380d13);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],36,0x650a7354);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],37,0x766a0abb);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],38,0x81c2c92e);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],39,0x92722c85);
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],40,0xa2bfe8a1);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],41,0xa81a664b);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],42,0xc24b8b70);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],43,0xc76c51a3);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],44,0xd192e819);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],45,0xd6990624);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],46,0xf40e3585);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],47,0x106aa070);
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],48,0x19a4c116);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],49,0x1e376c08);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],50,0x2748774c);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],51,0x34b0bcb5);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],52,0x391c0cb3);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],53,0x4ed8aa4a);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],54,0x5b9cca4f);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],55,0x682e6ff3);
|
||||
ss[3], ss[7] = RND(ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],56,0x748f82ee);
|
||||
ss[2], ss[6] = RND(ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],57,0x78a5636f);
|
||||
ss[1], ss[5] = RND(ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],ss[5],58,0x84c87814);
|
||||
ss[0], ss[4] = RND(ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],ss[4],59,0x8cc70208);
|
||||
ss[7], ss[3] = RND(ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],ss[3],60,0x90befffa);
|
||||
ss[6], ss[2] = RND(ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],ss[2],61,0xa4506ceb);
|
||||
ss[5], ss[1] = RND(ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],ss[1],62,0xbef9a3f7);
|
||||
ss[4], ss[0] = RND(ss[1],ss[2],ss[3],ss[4],ss[5],ss[6],ss[7],ss[0],63,0xc67178f2);
|
||||
|
||||
dig = []
|
||||
for i, x in enumerate(sha_info['digest']):
|
||||
dig.append( (x + ss[i]) & 0xffffffff )
|
||||
sha_info['digest'] = dig
|
||||
|
||||
def sha_init():
|
||||
sha_info = new_shaobject()
|
||||
sha_info['digest'] = [0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19]
|
||||
sha_info['count_lo'] = 0
|
||||
sha_info['count_hi'] = 0
|
||||
sha_info['local'] = 0
|
||||
sha_info['digestsize'] = 32
|
||||
return sha_info
|
||||
|
||||
def sha224_init():
|
||||
sha_info = new_shaobject()
|
||||
sha_info['digest'] = [0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4]
|
||||
sha_info['count_lo'] = 0
|
||||
sha_info['count_hi'] = 0
|
||||
sha_info['local'] = 0
|
||||
sha_info['digestsize'] = 28
|
||||
return sha_info
|
||||
|
||||
def sha_update(sha_info, buffer):
|
||||
if isinstance(buffer, str):
|
||||
raise TypeError("Unicode strings must be encoded before hashing")
|
||||
count = len(buffer)
|
||||
buffer_idx = 0
|
||||
clo = (sha_info['count_lo'] + (count << 3)) & 0xffffffff
|
||||
if clo < sha_info['count_lo']:
|
||||
sha_info['count_hi'] += 1
|
||||
sha_info['count_lo'] = clo
|
||||
|
||||
sha_info['count_hi'] += (count >> 29)
|
||||
|
||||
if sha_info['local']:
|
||||
i = SHA_BLOCKSIZE - sha_info['local']
|
||||
if i > count:
|
||||
i = count
|
||||
|
||||
# copy buffer
|
||||
sha_info['data'][sha_info['local']:sha_info['local']+i] = buffer[buffer_idx:buffer_idx+i]
|
||||
|
||||
count -= i
|
||||
buffer_idx += i
|
||||
|
||||
sha_info['local'] += i
|
||||
if sha_info['local'] == SHA_BLOCKSIZE:
|
||||
sha_transform(sha_info)
|
||||
sha_info['local'] = 0
|
||||
else:
|
||||
return
|
||||
|
||||
while count >= SHA_BLOCKSIZE:
|
||||
# copy buffer
|
||||
sha_info['data'] = list(buffer[buffer_idx:buffer_idx + SHA_BLOCKSIZE])
|
||||
count -= SHA_BLOCKSIZE
|
||||
buffer_idx += SHA_BLOCKSIZE
|
||||
sha_transform(sha_info)
|
||||
|
||||
|
||||
# copy buffer
|
||||
pos = sha_info['local']
|
||||
sha_info['data'][pos:pos+count] = buffer[buffer_idx:buffer_idx + count]
|
||||
sha_info['local'] = count
|
||||
|
||||
def sha_final(sha_info):
|
||||
lo_bit_count = sha_info['count_lo']
|
||||
hi_bit_count = sha_info['count_hi']
|
||||
count = (lo_bit_count >> 3) & 0x3f
|
||||
sha_info['data'][count] = 0x80;
|
||||
count += 1
|
||||
if count > SHA_BLOCKSIZE - 8:
|
||||
# zero the bytes in data after the count
|
||||
sha_info['data'] = sha_info['data'][:count] + ([0] * (SHA_BLOCKSIZE - count))
|
||||
sha_transform(sha_info)
|
||||
# zero bytes in data
|
||||
sha_info['data'] = [0] * SHA_BLOCKSIZE
|
||||
else:
|
||||
sha_info['data'] = sha_info['data'][:count] + ([0] * (SHA_BLOCKSIZE - count))
|
||||
|
||||
sha_info['data'][56] = (hi_bit_count >> 24) & 0xff
|
||||
sha_info['data'][57] = (hi_bit_count >> 16) & 0xff
|
||||
sha_info['data'][58] = (hi_bit_count >> 8) & 0xff
|
||||
sha_info['data'][59] = (hi_bit_count >> 0) & 0xff
|
||||
sha_info['data'][60] = (lo_bit_count >> 24) & 0xff
|
||||
sha_info['data'][61] = (lo_bit_count >> 16) & 0xff
|
||||
sha_info['data'][62] = (lo_bit_count >> 8) & 0xff
|
||||
sha_info['data'][63] = (lo_bit_count >> 0) & 0xff
|
||||
|
||||
sha_transform(sha_info)
|
||||
|
||||
dig = []
|
||||
for i in sha_info['digest']:
|
||||
dig.extend([ ((i>>24) & 0xff), ((i>>16) & 0xff), ((i>>8) & 0xff), (i & 0xff) ])
|
||||
return ''.join([chr(i) for i in dig])
|
||||
|
||||
class sha256(object):
|
||||
digest_size = digestsize = SHA_DIGESTSIZE
|
||||
block_size = SHA_BLOCKSIZE
|
||||
|
||||
def __init__(self, s=None):
|
||||
self._sha = sha_init()
|
||||
if s:
|
||||
sha_update(self._sha, s)
|
||||
|
||||
def update(self, s):
|
||||
sha_update(self._sha, s)
|
||||
|
||||
def digest(self):
|
||||
return sha_final(self._sha.copy())[:self._sha['digestsize']]
|
||||
|
||||
def hexdigest(self):
|
||||
return ''.join(['%.2x' % ord(i) for i in self.digest()])
|
||||
|
||||
def copy(self):
|
||||
new = sha256.__new__(sha256)
|
||||
new._sha = self._sha.copy()
|
||||
return new
|
||||
|
||||
class sha224(sha256):
|
||||
digest_size = digestsize = 28
|
||||
|
||||
def __init__(self, s=None):
|
||||
self._sha = sha224_init()
|
||||
if s:
|
||||
sha_update(self._sha, s)
|
||||
|
||||
def copy(self):
|
||||
new = sha224.__new__(sha224)
|
||||
new._sha = self._sha.copy()
|
||||
return new
|
||||
|
||||
def test():
|
||||
a_str = "just a test string"
|
||||
|
||||
assert 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' == sha256().hexdigest()
|
||||
assert 'd7b553c6f09ac85d142415f857c5310f3bbbe7cdd787cce4b985acedd585266f' == sha256(a_str).hexdigest()
|
||||
assert '8113ebf33c97daa9998762aacafe750c7cefc2b2f173c90c59663a57fe626f21' == sha256(a_str*7).hexdigest()
|
||||
|
||||
s = sha256(a_str)
|
||||
s.update(a_str)
|
||||
assert '03d9963e05a094593190b6fc794cb1a3e1ac7d7883f0b5855268afeccc70d461' == s.hexdigest()
|
||||
|
||||
if __name__ == "__main__":
|
||||
test()
|
|
@ -0,0 +1,46 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#include "common/default_types/ec_pp.hpp"
|
||||
#include "common/utils.hpp"
|
||||
#include "common/profiling.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/sha256/sha256_gadget.hpp"
|
||||
|
||||
using namespace libsnark;
|
||||
|
||||
template<typename FieldT>
|
||||
void test_two_to_one()
|
||||
{
|
||||
protoboard<FieldT> pb;
|
||||
|
||||
digest_variable<FieldT> left(pb, SHA256_digest_size, "left");
|
||||
digest_variable<FieldT> right(pb, SHA256_digest_size, "right");
|
||||
digest_variable<FieldT> output(pb, SHA256_digest_size, "output");
|
||||
|
||||
sha256_two_to_one_hash_gadget<FieldT> f(pb, left, right, output, "f");
|
||||
f.generate_r1cs_constraints();
|
||||
printf("Number of constraints for sha256_two_to_one_hash_gadget: %zu\n", pb.num_constraints());
|
||||
|
||||
const bit_vector left_bv = int_list_to_bits({0x426bc2d8, 0x4dc86782, 0x81e8957a, 0x409ec148, 0xe6cffbe8, 0xafe6ba4f, 0x9c6f1978, 0xdd7af7e9}, 32);
|
||||
const bit_vector right_bv = int_list_to_bits({0x038cce42, 0xabd366b8, 0x3ede7e00, 0x9130de53, 0x72cdf73d, 0xee825114, 0x8cb48d1b, 0x9af68ad0}, 32);
|
||||
const bit_vector hash_bv = int_list_to_bits({0xeffd0b7f, 0x1ccba116, 0x2ee816f7, 0x31c62b48, 0x59305141, 0x990e5c0a, 0xce40d33d, 0x0b1167d1}, 32);
|
||||
|
||||
left.generate_r1cs_witness(left_bv);
|
||||
right.generate_r1cs_witness(right_bv);
|
||||
|
||||
f.generate_r1cs_witness();
|
||||
output.generate_r1cs_witness(hash_bv);
|
||||
|
||||
assert(pb.is_satisfied());
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
start_profiling();
|
||||
default_ec_pp::init_public_params();
|
||||
test_two_to_one<Fr<default_ec_pp> >();
|
||||
}
|
|
@ -0,0 +1,38 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_AUTHENTICATION_PATH_VARIABLE_HPP_
|
||||
#define MERKLE_AUTHENTICATION_PATH_VARIABLE_HPP_
|
||||
|
||||
#include "common/data_structures/merkle_tree.hpp"
|
||||
#include "gadgetlib1/gadget.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/hash_io.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
class merkle_authentication_path_variable : public gadget<FieldT> {
|
||||
public:
|
||||
|
||||
const size_t tree_depth;
|
||||
std::vector<digest_variable<FieldT> > left_digests;
|
||||
std::vector<digest_variable<FieldT> > right_digests;
|
||||
|
||||
merkle_authentication_path_variable(protoboard<FieldT> &pb,
|
||||
const size_t tree_depth,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness(const size_t address, const merkle_authentication_path &path);
|
||||
merkle_authentication_path get_authentication_path(const size_t address) const;
|
||||
};
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/merkle_tree/merkle_authentication_path_variable.tcc"
|
||||
|
||||
#endif // MERKLE_AUTHENTICATION_PATH_VARIABLE_HPP
|
|
@ -0,0 +1,76 @@
|
|||
/**
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_AUTHENTICATION_PATH_VARIABLE_TCC_
|
||||
#define MERKLE_AUTHENTICATION_PATH_VARIABLE_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
merkle_authentication_path_variable<FieldT, HashT>::merkle_authentication_path_variable(protoboard<FieldT> &pb,
|
||||
const size_t tree_depth,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
tree_depth(tree_depth)
|
||||
{
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
left_digests.emplace_back(digest_variable<FieldT>(pb, HashT::get_digest_len(), FMT(annotation_prefix, " left_digests_%zu", i)));
|
||||
right_digests.emplace_back(digest_variable<FieldT>(pb, HashT::get_digest_len(), FMT(annotation_prefix, " right_digests_%zu", i)));
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void merkle_authentication_path_variable<FieldT, HashT>::generate_r1cs_constraints()
|
||||
{
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
left_digests[i].generate_r1cs_constraints();
|
||||
right_digests[i].generate_r1cs_constraints();
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void merkle_authentication_path_variable<FieldT, HashT>::generate_r1cs_witness(const size_t address, const merkle_authentication_path &path)
|
||||
{
|
||||
assert(path.size() == tree_depth);
|
||||
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
if (address & (1ul << (tree_depth-1-i)))
|
||||
{
|
||||
left_digests[i].generate_r1cs_witness(path[i]);
|
||||
}
|
||||
else
|
||||
{
|
||||
right_digests[i].generate_r1cs_witness(path[i]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
merkle_authentication_path merkle_authentication_path_variable<FieldT, HashT>::get_authentication_path(const size_t address) const
|
||||
{
|
||||
merkle_authentication_path result;
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
if (address & (1ul << (tree_depth-1-i)))
|
||||
{
|
||||
result.emplace_back(left_digests[i].get_digest());
|
||||
}
|
||||
else
|
||||
{
|
||||
result.emplace_back(right_digests[i].get_digest());
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // MERKLE_AUTHENTICATION_PATH_VARIABLE_TCC
|
|
@ -0,0 +1,73 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for the Merkle tree check read gadget.
|
||||
|
||||
The gadget checks the following: given a root R, address A, value V, and
|
||||
authentication path P, check that P is a valid authentication path for the
|
||||
value V as the A-th leaf in a Merkle tree with root R.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_TREE_CHECK_READ_GADGET_HPP_
|
||||
#define MERKLE_TREE_CHECK_READ_GADGET_HPP_
|
||||
|
||||
#include "common/data_structures/merkle_tree.hpp"
|
||||
#include "gadgetlib1/gadget.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/hash_io.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/digest_selector_gadget.hpp"
|
||||
#include "gadgetlib1/gadgets/merkle_tree/merkle_authentication_path_variable.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
class merkle_tree_check_read_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
|
||||
std::vector<HashT> hashers;
|
||||
std::vector<block_variable<FieldT> > hasher_inputs;
|
||||
std::vector<digest_selector_gadget<FieldT> > propagators;
|
||||
std::vector<digest_variable<FieldT> > internal_output;
|
||||
|
||||
std::shared_ptr<digest_variable<FieldT> > computed_root;
|
||||
std::shared_ptr<bit_vector_copy_gadget<FieldT> > check_root;
|
||||
|
||||
public:
|
||||
|
||||
const size_t digest_size;
|
||||
const size_t tree_depth;
|
||||
pb_linear_combination_array<FieldT> address_bits;
|
||||
digest_variable<FieldT> leaf;
|
||||
digest_variable<FieldT> root;
|
||||
merkle_authentication_path_variable<FieldT, HashT> path;
|
||||
pb_linear_combination<FieldT> read_successful;
|
||||
|
||||
merkle_tree_check_read_gadget(protoboard<FieldT> &pb,
|
||||
const size_t tree_depth,
|
||||
const pb_linear_combination_array<FieldT> &address_bits,
|
||||
const digest_variable<FieldT> &leaf_digest,
|
||||
const digest_variable<FieldT> &root_digest,
|
||||
const merkle_authentication_path_variable<FieldT, HashT> &path,
|
||||
const pb_linear_combination<FieldT> &read_successful,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
|
||||
static size_t root_size_in_bits();
|
||||
/* for debugging purposes */
|
||||
static size_t expected_constraints(const size_t tree_depth);
|
||||
};
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void test_merkle_tree_check_read_gadget();
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/merkle_tree/merkle_tree_check_read_gadget.tcc"
|
||||
|
||||
#endif // MERKLE_TREE_CHECK_READ_GADGET_HPP_
|
|
@ -0,0 +1,196 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for the Merkle tree check read.
|
||||
|
||||
See merkle_tree_check_read_gadget.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_TREE_CHECK_READ_GADGET_TCC_
|
||||
#define MERKLE_TREE_CHECK_READ_GADGET_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
merkle_tree_check_read_gadget<FieldT, HashT>::merkle_tree_check_read_gadget(protoboard<FieldT> &pb,
|
||||
const size_t tree_depth,
|
||||
const pb_linear_combination_array<FieldT> &address_bits,
|
||||
const digest_variable<FieldT> &leaf,
|
||||
const digest_variable<FieldT> &root,
|
||||
const merkle_authentication_path_variable<FieldT, HashT> &path,
|
||||
const pb_linear_combination<FieldT> &read_successful,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
digest_size(HashT::get_digest_len()),
|
||||
tree_depth(tree_depth),
|
||||
address_bits(address_bits),
|
||||
leaf(leaf),
|
||||
root(root),
|
||||
path(path),
|
||||
read_successful(read_successful)
|
||||
{
|
||||
/*
|
||||
The tricky part here is ordering. For Merkle tree
|
||||
authentication paths, path[0] corresponds to one layer below
|
||||
the root (and path[tree_depth-1] corresponds to the layer
|
||||
containing the leaf), while address_bits has the reverse order:
|
||||
address_bits[0] is LSB, and corresponds to layer containing the
|
||||
leaf, and address_bits[tree_depth-1] is MSB, and corresponds to
|
||||
the subtree directly under the root.
|
||||
*/
|
||||
assert(tree_depth > 0);
|
||||
assert(tree_depth == address_bits.size());
|
||||
|
||||
for (size_t i = 0; i < tree_depth-1; ++i)
|
||||
{
|
||||
internal_output.emplace_back(digest_variable<FieldT>(pb, digest_size, FMT(this->annotation_prefix, " internal_output_%zu", i)));
|
||||
}
|
||||
|
||||
computed_root.reset(new digest_variable<FieldT>(pb, digest_size, FMT(this->annotation_prefix, " computed_root")));
|
||||
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
block_variable<FieldT> inp(pb, path.left_digests[i], path.right_digests[i], FMT(this->annotation_prefix, " inp_%zu", i));
|
||||
hasher_inputs.emplace_back(inp);
|
||||
hashers.emplace_back(HashT(pb, 2*digest_size, inp, (i == 0 ? *computed_root : internal_output[i-1]),
|
||||
FMT(this->annotation_prefix, " load_hashers_%zu", i)));
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
/*
|
||||
The propagators take a computed hash value (or leaf in the
|
||||
base case) and propagate it one layer up, either in the left
|
||||
or the right slot of authentication_path_variable.
|
||||
*/
|
||||
propagators.emplace_back(digest_selector_gadget<FieldT>(pb, digest_size, i < tree_depth - 1 ? internal_output[i] : leaf,
|
||||
address_bits[tree_depth-1-i], path.left_digests[i], path.right_digests[i],
|
||||
FMT(this->annotation_prefix, " digest_selector_%zu", i)));
|
||||
}
|
||||
|
||||
check_root.reset(new bit_vector_copy_gadget<FieldT>(pb, computed_root->bits, root.bits, read_successful, FieldT::capacity(), FMT(annotation_prefix, " check_root")));
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void merkle_tree_check_read_gadget<FieldT, HashT>::generate_r1cs_constraints()
|
||||
{
|
||||
/* ensure correct hash computations */
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
// Note that we check root outside and have enforced booleanity of path.left_digests/path.right_digests outside in path.generate_r1cs_constraints
|
||||
hashers[i].generate_r1cs_constraints(false);
|
||||
}
|
||||
|
||||
/* ensure consistency of path.left_digests/path.right_digests with internal_output */
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
propagators[i].generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
check_root->generate_r1cs_constraints(false, false);
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void merkle_tree_check_read_gadget<FieldT, HashT>::generate_r1cs_witness()
|
||||
{
|
||||
/* do the hash computations bottom-up */
|
||||
for (int i = tree_depth-1; i >= 0; --i)
|
||||
{
|
||||
/* propagate previous input */
|
||||
propagators[i].generate_r1cs_witness();
|
||||
|
||||
/* compute hash */
|
||||
hashers[i].generate_r1cs_witness();
|
||||
}
|
||||
|
||||
check_root->generate_r1cs_witness();
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
size_t merkle_tree_check_read_gadget<FieldT, HashT>::root_size_in_bits()
|
||||
{
|
||||
return HashT::get_digest_len();
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
size_t merkle_tree_check_read_gadget<FieldT, HashT>::expected_constraints(const size_t tree_depth)
|
||||
{
|
||||
/* NB: this includes path constraints */
|
||||
const size_t hasher_constraints = tree_depth * HashT::expected_constraints(false);
|
||||
const size_t propagator_constraints = tree_depth * HashT::get_digest_len();
|
||||
const size_t authentication_path_constraints = 2 * tree_depth * HashT::get_digest_len();
|
||||
const size_t check_root_constraints = 3 * div_ceil(HashT::get_digest_len(), FieldT::capacity());
|
||||
|
||||
return hasher_constraints + propagator_constraints + authentication_path_constraints + check_root_constraints;
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void test_merkle_tree_check_read_gadget()
|
||||
{
|
||||
/* prepare test */
|
||||
const size_t digest_len = HashT::get_digest_len();
|
||||
const size_t tree_depth = 16;
|
||||
std::vector<merkle_authentication_node> path(tree_depth);
|
||||
|
||||
bit_vector prev_hash(digest_len);
|
||||
std::generate(prev_hash.begin(), prev_hash.end(), [&]() { return std::rand() % 2; });
|
||||
bit_vector leaf = prev_hash;
|
||||
|
||||
bit_vector address_bits;
|
||||
|
||||
size_t address = 0;
|
||||
for (long level = tree_depth-1; level >= 0; --level)
|
||||
{
|
||||
const bool computed_is_right = (std::rand() % 2);
|
||||
address |= (computed_is_right ? 1ul << (tree_depth-1-level) : 0);
|
||||
address_bits.push_back(computed_is_right);
|
||||
bit_vector other(digest_len);
|
||||
std::generate(other.begin(), other.end(), [&]() { return std::rand() % 2; });
|
||||
|
||||
bit_vector block = prev_hash;
|
||||
block.insert(computed_is_right ? block.begin() : block.end(), other.begin(), other.end());
|
||||
bit_vector h = HashT::get_hash(block);
|
||||
|
||||
path[level] = other;
|
||||
|
||||
prev_hash = h;
|
||||
}
|
||||
bit_vector root = prev_hash;
|
||||
|
||||
/* execute test */
|
||||
protoboard<FieldT> pb;
|
||||
pb_variable_array<FieldT> address_bits_va;
|
||||
address_bits_va.allocate(pb, tree_depth, "address_bits");
|
||||
digest_variable<FieldT> leaf_digest(pb, digest_len, "input_block");
|
||||
digest_variable<FieldT> root_digest(pb, digest_len, "output_digest");
|
||||
merkle_authentication_path_variable<FieldT, HashT> path_var(pb, tree_depth, "path_var");
|
||||
merkle_tree_check_read_gadget<FieldT, HashT> ml(pb, tree_depth, address_bits_va, leaf_digest, root_digest, path_var, ONE, "ml");
|
||||
|
||||
path_var.generate_r1cs_constraints();
|
||||
ml.generate_r1cs_constraints();
|
||||
|
||||
address_bits_va.fill_with_bits(pb, address_bits);
|
||||
assert(address_bits_va.get_field_element_from_bits(pb).as_ulong() == address);
|
||||
leaf_digest.generate_r1cs_witness(leaf);
|
||||
path_var.generate_r1cs_witness(address, path);
|
||||
ml.generate_r1cs_witness();
|
||||
|
||||
/* make sure that read checker didn't accidentally overwrite anything */
|
||||
address_bits_va.fill_with_bits(pb, address_bits);
|
||||
leaf_digest.generate_r1cs_witness(leaf);
|
||||
root_digest.generate_r1cs_witness(root);
|
||||
assert(pb.is_satisfied());
|
||||
|
||||
const size_t num_constraints = pb.num_constraints();
|
||||
const size_t expected_constraints = merkle_tree_check_read_gadget<FieldT, HashT>::expected_constraints(tree_depth);
|
||||
assert(num_constraints == expected_constraints);
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // MERKLE_TREE_CHECK_READ_GADGET_TCC_
|
|
@ -0,0 +1,91 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Declaration of interfaces for the Merkle tree check read gadget.
|
||||
|
||||
The gadget checks the following: given two roots R1 and R2, address A, two
|
||||
values V1 and V2, and authentication path P, check that
|
||||
- P is a valid authentication path for the value V1 as the A-th leaf in a Merkle tree with root R1, and
|
||||
- P is a valid authentication path for the value V2 as the A-th leaf in a Merkle tree with root R2.
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_TREE_CHECK_UPDATE_GADGET_HPP_
|
||||
#define MERKLE_TREE_CHECK_UPDATE_GADGET_HPP_
|
||||
|
||||
#include "common/data_structures/merkle_tree.hpp"
|
||||
#include "gadgetlib1/gadget.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/crh_gadget.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/hash_io.hpp"
|
||||
#include "gadgetlib1/gadgets/hashes/digest_selector_gadget.hpp"
|
||||
#include "gadgetlib1/gadgets/merkle_tree/merkle_authentication_path_variable.hpp"
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
class merkle_tree_check_update_gadget : public gadget<FieldT> {
|
||||
private:
|
||||
|
||||
std::vector<HashT> prev_hashers;
|
||||
std::vector<block_variable<FieldT> > prev_hasher_inputs;
|
||||
std::vector<digest_selector_gadget<FieldT> > prev_propagators;
|
||||
std::vector<digest_variable<FieldT> > prev_internal_output;
|
||||
|
||||
std::vector<HashT> next_hashers;
|
||||
std::vector<block_variable<FieldT> > next_hasher_inputs;
|
||||
std::vector<digest_selector_gadget<FieldT> > next_propagators;
|
||||
std::vector<digest_variable<FieldT> > next_internal_output;
|
||||
|
||||
std::shared_ptr<digest_variable<FieldT> > computed_next_root;
|
||||
std::shared_ptr<bit_vector_copy_gadget<FieldT> > check_next_root;
|
||||
|
||||
public:
|
||||
|
||||
const size_t digest_size;
|
||||
const size_t tree_depth;
|
||||
|
||||
pb_variable_array<FieldT> address_bits;
|
||||
digest_variable<FieldT> prev_leaf_digest;
|
||||
digest_variable<FieldT> prev_root_digest;
|
||||
merkle_authentication_path_variable<FieldT, HashT> prev_path;
|
||||
digest_variable<FieldT> next_leaf_digest;
|
||||
digest_variable<FieldT> next_root_digest;
|
||||
merkle_authentication_path_variable<FieldT, HashT> next_path;
|
||||
pb_linear_combination<FieldT> update_successful;
|
||||
|
||||
/* Note that while it is necessary to generate R1CS constraints
|
||||
for prev_path, it is not necessary to do so for next_path. See
|
||||
comment in the implementation of generate_r1cs_constraints() */
|
||||
|
||||
merkle_tree_check_update_gadget(protoboard<FieldT> &pb,
|
||||
const size_t tree_depth,
|
||||
const pb_variable_array<FieldT> &address_bits,
|
||||
const digest_variable<FieldT> &prev_leaf_digest,
|
||||
const digest_variable<FieldT> &prev_root_digest,
|
||||
const merkle_authentication_path_variable<FieldT, HashT> &prev_path,
|
||||
const digest_variable<FieldT> &next_leaf_digest,
|
||||
const digest_variable<FieldT> &next_root_digest,
|
||||
const merkle_authentication_path_variable<FieldT, HashT> &next_path,
|
||||
const pb_linear_combination<FieldT> &update_successful,
|
||||
const std::string &annotation_prefix);
|
||||
|
||||
void generate_r1cs_constraints();
|
||||
void generate_r1cs_witness();
|
||||
|
||||
static size_t root_size_in_bits();
|
||||
/* for debugging purposes */
|
||||
static size_t expected_constraints(const size_t tree_depth);
|
||||
};
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void test_merkle_tree_check_update_gadget();
|
||||
|
||||
} // libsnark
|
||||
|
||||
#include "gadgetlib1/gadgets/merkle_tree/merkle_tree_check_update_gadget.tcc"
|
||||
|
||||
#endif // MERKLE_TREE_CHECK_UPDATE_GADGET_HPP_
|
|
@ -0,0 +1,265 @@
|
|||
/** @file
|
||||
*****************************************************************************
|
||||
|
||||
Implementation of interfaces for the Merkle tree check update gadget.
|
||||
|
||||
See merkle_tree_check_update_gadget.hpp .
|
||||
|
||||
*****************************************************************************
|
||||
* @author This file is part of libsnark, developed by SCIPR Lab
|
||||
* and contributors (see AUTHORS).
|
||||
* @copyright MIT license (see LICENSE file)
|
||||
*****************************************************************************/
|
||||
|
||||
#ifndef MERKLE_TREE_CHECK_UPDATE_GADGET_TCC_
|
||||
#define MERKLE_TREE_CHECK_UPDATE_GADGET_TCC_
|
||||
|
||||
namespace libsnark {
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
merkle_tree_check_update_gadget<FieldT, HashT>::merkle_tree_check_update_gadget(protoboard<FieldT> &pb,
|
||||
const size_t tree_depth,
|
||||
const pb_variable_array<FieldT> &address_bits,
|
||||
const digest_variable<FieldT> &prev_leaf_digest,
|
||||
const digest_variable<FieldT> &prev_root_digest,
|
||||
const merkle_authentication_path_variable<FieldT, HashT> &prev_path,
|
||||
const digest_variable<FieldT> &next_leaf_digest,
|
||||
const digest_variable<FieldT> &next_root_digest,
|
||||
const merkle_authentication_path_variable<FieldT, HashT> &next_path,
|
||||
const pb_linear_combination<FieldT> &update_successful,
|
||||
const std::string &annotation_prefix) :
|
||||
gadget<FieldT>(pb, annotation_prefix),
|
||||
digest_size(HashT::get_digest_len()),
|
||||
tree_depth(tree_depth),
|
||||
address_bits(address_bits),
|
||||
prev_leaf_digest(prev_leaf_digest),
|
||||
prev_root_digest(prev_root_digest),
|
||||
prev_path(prev_path),
|
||||
next_leaf_digest(next_leaf_digest),
|
||||
next_root_digest(next_root_digest),
|
||||
next_path(next_path),
|
||||
update_successful(update_successful)
|
||||
{
|
||||
assert(tree_depth > 0);
|
||||
assert(tree_depth == address_bits.size());
|
||||
|
||||
for (size_t i = 0; i < tree_depth-1; ++i)
|
||||
{
|
||||
prev_internal_output.emplace_back(digest_variable<FieldT>(pb, digest_size, FMT(this->annotation_prefix, " prev_internal_output_%zu", i)));
|
||||
next_internal_output.emplace_back(digest_variable<FieldT>(pb, digest_size, FMT(this->annotation_prefix, " next_internal_output_%zu", i)));
|
||||
}
|
||||
|
||||
computed_next_root.reset(new digest_variable<FieldT>(pb, digest_size, FMT(this->annotation_prefix, " computed_root")));
|
||||
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
block_variable<FieldT> prev_inp(pb, prev_path.left_digests[i], prev_path.right_digests[i], FMT(this->annotation_prefix, " prev_inp_%zu", i));
|
||||
prev_hasher_inputs.emplace_back(prev_inp);
|
||||
prev_hashers.emplace_back(HashT(pb, 2*digest_size, prev_inp, (i == 0 ? prev_root_digest : prev_internal_output[i-1]),
|
||||
FMT(this->annotation_prefix, " prev_hashers_%zu", i)));
|
||||
|
||||
block_variable<FieldT> next_inp(pb, next_path.left_digests[i], next_path.right_digests[i], FMT(this->annotation_prefix, " next_inp_%zu", i));
|
||||
next_hasher_inputs.emplace_back(next_inp);
|
||||
next_hashers.emplace_back(HashT(pb, 2*digest_size, next_inp, (i == 0 ? *computed_next_root : next_internal_output[i-1]),
|
||||
FMT(this->annotation_prefix, " next_hashers_%zu", i)));
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
prev_propagators.emplace_back(digest_selector_gadget<FieldT>(pb, digest_size, i < tree_depth -1 ? prev_internal_output[i] : prev_leaf_digest,
|
||||
address_bits[tree_depth-1-i], prev_path.left_digests[i], prev_path.right_digests[i],
|
||||
FMT(this->annotation_prefix, " prev_propagators_%zu", i)));
|
||||
next_propagators.emplace_back(digest_selector_gadget<FieldT>(pb, digest_size, i < tree_depth -1 ? next_internal_output[i] : next_leaf_digest,
|
||||
address_bits[tree_depth-1-i], next_path.left_digests[i], next_path.right_digests[i],
|
||||
FMT(this->annotation_prefix, " next_propagators_%zu", i)));
|
||||
}
|
||||
|
||||
check_next_root.reset(new bit_vector_copy_gadget<FieldT>(pb, computed_next_root->bits, next_root_digest.bits, update_successful, FieldT::capacity(), FMT(annotation_prefix, " check_next_root")));
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void merkle_tree_check_update_gadget<FieldT, HashT>::generate_r1cs_constraints()
|
||||
{
|
||||
/* ensure correct hash computations */
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
prev_hashers[i].generate_r1cs_constraints(false); // we check root outside and prev_left/prev_right above
|
||||
next_hashers[i].generate_r1cs_constraints(true); // however we must check right side hashes
|
||||
}
|
||||
|
||||
/* ensure consistency of internal_left/internal_right with internal_output */
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
prev_propagators[i].generate_r1cs_constraints();
|
||||
next_propagators[i].generate_r1cs_constraints();
|
||||
}
|
||||
|
||||
/* ensure that prev auxiliary input and next auxiliary input match */
|
||||
for (size_t i = 0; i < tree_depth; ++i)
|
||||
{
|
||||
for (size_t j = 0; j < digest_size; ++j)
|
||||
{
|
||||
/*
|
||||
addr * (prev_left - next_left) + (1 - addr) * (prev_right - next_right) = 0
|
||||
addr * (prev_left - next_left - prev_right + next_right) = next_right - prev_right
|
||||
*/
|
||||
this->pb.add_r1cs_constraint(r1cs_constraint<FieldT>(address_bits[tree_depth-1-i],
|
||||
prev_path.left_digests[i].bits[j] - next_path.left_digests[i].bits[j] - prev_path.right_digests[i].bits[j] + next_path.right_digests[i].bits[j],
|
||||
next_path.right_digests[i].bits[j] - prev_path.right_digests[i].bits[j]),
|
||||
FMT(this->annotation_prefix, " aux_check_%zu_%zu", i, j));
|
||||
}
|
||||
}
|
||||
|
||||
/* Note that while it is necessary to generate R1CS constraints
|
||||
for prev_path, it is not necessary to do so for next_path.
|
||||
|
||||
This holds, because { next_path.left_inputs[i],
|
||||
next_path.right_inputs[i] } is a pair { hash_output,
|
||||
auxiliary_input }. The bitness for hash_output is enforced
|
||||
above by next_hashers[i].generate_r1cs_constraints.
|
||||
|
||||
Because auxiliary input is the same for prev_path and next_path
|
||||
(enforced above), we have that auxiliary_input part is also
|
||||
constrained to be boolean, because prev_path is *all*
|
||||
constrained to be all boolean. */
|
||||
|
||||
check_next_root->generate_r1cs_constraints(false, false);
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void merkle_tree_check_update_gadget<FieldT, HashT>::generate_r1cs_witness()
|
||||
{
|
||||
/* do the hash computations bottom-up */
|
||||
for (int i = tree_depth-1; i >= 0; --i)
|
||||
{
|
||||
/* ensure consistency of prev_path and next_path */
|
||||
if (this->pb.val(address_bits[tree_depth-1-i]) == FieldT::one())
|
||||
{
|
||||
next_path.left_digests[i].generate_r1cs_witness(prev_path.left_digests[i].get_digest());
|
||||
}
|
||||
else
|
||||
{
|
||||
next_path.right_digests[i].generate_r1cs_witness(prev_path.right_digests[i].get_digest());
|
||||
}
|
||||
|
||||
/* propagate previous input */
|
||||
prev_propagators[i].generate_r1cs_witness();
|
||||
next_propagators[i].generate_r1cs_witness();
|
||||
|
||||
/* compute hash */
|
||||
prev_hashers[i].generate_r1cs_witness();
|
||||
next_hashers[i].generate_r1cs_witness();
|
||||
}
|
||||
|
||||
check_next_root->generate_r1cs_witness();
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
size_t merkle_tree_check_update_gadget<FieldT, HashT>::root_size_in_bits()
|
||||
{
|
||||
return HashT::get_digest_len();
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
size_t merkle_tree_check_update_gadget<FieldT, HashT>::expected_constraints(const size_t tree_depth)
|
||||
{
|
||||
/* NB: this includes path constraints */
|
||||
const size_t prev_hasher_constraints = tree_depth * HashT::expected_constraints(false);
|
||||
const size_t next_hasher_constraints = tree_depth * HashT::expected_constraints(true);
|
||||
const size_t prev_authentication_path_constraints = 2 * tree_depth * HashT::get_digest_len();
|
||||
const size_t prev_propagator_constraints = tree_depth * HashT::get_digest_len();
|
||||
const size_t next_propagator_constraints = tree_depth * HashT::get_digest_len();
|
||||
const size_t check_next_root_constraints = 3 * div_ceil(HashT::get_digest_len(), FieldT::capacity());
|
||||
const size_t aux_equality_constraints = tree_depth * HashT::get_digest_len();
|
||||
|
||||
return (prev_hasher_constraints + next_hasher_constraints + prev_authentication_path_constraints +
|
||||
prev_propagator_constraints + next_propagator_constraints + check_next_root_constraints +
|
||||
aux_equality_constraints);
|
||||
}
|
||||
|
||||
template<typename FieldT, typename HashT>
|
||||
void test_merkle_tree_check_update_gadget()
|
||||
{
|
||||
/* prepare test */
|
||||
const size_t digest_len = HashT::get_digest_len();
|
||||
|
||||
const size_t tree_depth = 16;
|
||||
std::vector<merkle_authentication_node> prev_path(tree_depth);
|
||||
|
||||
bit_vector prev_load_hash(digest_len);
|
||||
std::generate(prev_load_hash.begin(), prev_load_hash.end(), [&]() { return std::rand() % 2; });
|
||||
bit_vector prev_store_hash(digest_len);
|
||||
std::generate(prev_store_hash.begin(), prev_store_hash.end(), [&]() { return std::rand() % 2; });
|
||||
|
||||
bit_vector loaded_leaf = prev_load_hash;
|
||||
bit_vector stored_leaf = prev_store_hash;
|
||||
|
||||
bit_vector address_bits;
|
||||
|
||||
size_t address = 0;
|
||||
for (long level = tree_depth-1; level >= 0; --level)
|
||||
{
|
||||
const bool computed_is_right = (std::rand() % 2);
|
||||
address |= (computed_is_right ? 1ul << (tree_depth-1-level) : 0);
|
||||
address_bits.push_back(computed_is_right);
|
||||
bit_vector other(digest_len);
|
||||
std::generate(other.begin(), other.end(), [&]() { return std::rand() % 2; });
|
||||
|
||||
bit_vector load_block = prev_load_hash;
|
||||
load_block.insert(computed_is_right ? load_block.begin() : load_block.end(), other.begin(), other.end());
|
||||
bit_vector store_block = prev_store_hash;
|
||||
store_block.insert(computed_is_right ? store_block.begin() : store_block.end(), other.begin(), other.end());
|
||||
|
||||
bit_vector load_h = HashT::get_hash(load_block);
|
||||
bit_vector store_h = HashT::get_hash(store_block);
|
||||
|
||||
prev_path[level] = other;
|
||||
|
||||
prev_load_hash = load_h;
|
||||
prev_store_hash = store_h;
|
||||
}
|
||||
|
||||
bit_vector load_root = prev_load_hash;
|
||||
bit_vector store_root = prev_store_hash;
|
||||
|
||||
/* execute the test */
|
||||
protoboard<FieldT> pb;
|
||||
pb_variable_array<FieldT> address_bits_va;
|
||||
address_bits_va.allocate(pb, tree_depth, "address_bits");
|
||||
digest_variable<FieldT> prev_leaf_digest(pb, digest_len, "prev_leaf_digest");
|
||||
digest_variable<FieldT> prev_root_digest(pb, digest_len, "prev_root_digest");
|
||||
merkle_authentication_path_variable<FieldT, HashT> prev_path_var(pb, tree_depth, "prev_path_var");
|
||||
digest_variable<FieldT> next_leaf_digest(pb, digest_len, "next_leaf_digest");
|
||||
digest_variable<FieldT> next_root_digest(pb, digest_len, "next_root_digest");
|
||||
merkle_authentication_path_variable<FieldT, HashT> next_path_var(pb, tree_depth, "next_path_var");
|
||||
merkle_tree_check_update_gadget<FieldT, HashT> mls(pb, tree_depth, address_bits_va,
|
||||
prev_leaf_digest, prev_root_digest, prev_path_var,
|
||||
next_leaf_digest, next_root_digest, next_path_var, ONE, "mls");
|
||||
|
||||
prev_path_var.generate_r1cs_constraints();
|
||||
mls.generate_r1cs_constraints();
|
||||
|
||||
address_bits_va.fill_with_bits(pb, address_bits);
|
||||
assert(address_bits_va.get_field_element_from_bits(pb).as_ulong() == address);
|
||||
prev_leaf_digest.generate_r1cs_witness(loaded_leaf);
|
||||
prev_path_var.generate_r1cs_witness(address, prev_path);
|
||||
next_leaf_digest.generate_r1cs_witness(stored_leaf);
|
||||
address_bits_va.fill_with_bits(pb, address_bits);
|
||||
mls.generate_r1cs_witness();
|
||||
|
||||
/* make sure that update check will check for the right things */
|
||||
prev_leaf_digest.generate_r1cs_witness(loaded_leaf);
|
||||
next_leaf_digest.generate_r1cs_witness(stored_leaf);
|
||||
prev_root_digest.generate_r1cs_witness(load_root);
|
||||
next_root_digest.generate_r1cs_witness(store_root);
|
||||
address_bits_va.fill_with_bits(pb, address_bits);
|
||||
assert(pb.is_satisfied());
|
||||
|
||||
const size_t num_constraints = pb.num_constraints();
|
||||
const size_t expected_constraints = merkle_tree_check_update_gadget<FieldT, HashT>::expected_constraints(tree_depth);
|
||||
assert(num_constraints == expected_constraints);
|
||||
}
|
||||
|
||||
} // libsnark
|
||||
|
||||
#endif // MERKLE_TREE_CHECK_UPDATE_GADGET_TCC_
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue