Nova/src/r1cs.rs
src/r1cs.rsRaw
1//! This module defines R1CS related types and a folding scheme for Relaxed R1CS
2#![allow(clippy::type_complexity)]
3use crate::{
4 constants::{BN_LIMB_WIDTH, BN_N_LIMBS, NUM_HASH_BITS},
5 errors::NovaError,
6 gadgets::{
7 nonnative::{bignat::nat_to_limbs, util::f_to_nat},
8 utils::scalar_as_base,
9 },
10 traits::{
11 commitment::{CommitmentEngineTrait, CommitmentGensTrait},
12 AbsorbInROTrait, AppendToTranscriptTrait, Group, ROTrait,
13 },
14 Commitment, CommitmentGens, CE,
15};
16use core::cmp::max;
17use ff::Field;
18use flate2::{write::ZlibEncoder, Compression};
19use itertools::concat;
20use rayon::prelude::*;
21use serde::{Deserialize, Serialize};
22use sha3::{Digest, Sha3_256};
23
24/// Public parameters for a given R1CS
25#[derive(Clone, Serialize, Deserialize)]
26#[serde(bound = "")]
27pub struct R1CSGens<G: Group> {
28 pub(crate) gens: CommitmentGens<G>,
29}
30
31/// A type that holds the shape of the R1CS matrices
32#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
33pub struct R1CSShape<G: Group> {
34 pub(crate) num_cons: usize,
35 pub(crate) num_vars: usize,
36 pub(crate) num_io: usize,
37 pub(crate) A: Vec<(usize, usize, G::Scalar)>,
38 pub(crate) B: Vec<(usize, usize, G::Scalar)>,
39 pub(crate) C: Vec<(usize, usize, G::Scalar)>,
40 digest: G::Scalar, // digest of the rest of R1CSShape
41}
42
43/// A type that holds a witness for a given R1CS instance
44#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
45pub struct R1CSWitness<G: Group> {
46 W: Vec<G::Scalar>,
47}
48
49/// A type that holds an R1CS instance
50#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
51#[serde(bound = "")]
52pub struct R1CSInstance<G: Group> {
53 pub(crate) comm_W: Commitment<G>,
54 pub(crate) X: Vec<G::Scalar>,
55}
56
57/// A type that holds a witness for a given Relaxed R1CS instance
58#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
59pub struct RelaxedR1CSWitness<G: Group> {
60 pub(crate) W: Vec<G::Scalar>,
61 pub(crate) E: Vec<G::Scalar>,
62}
63
64/// A type that holds a Relaxed R1CS instance
65#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
66#[serde(bound = "")]
67pub struct RelaxedR1CSInstance<G: Group> {
68 pub(crate) comm_W: Commitment<G>,
69 pub(crate) comm_E: Commitment<G>,
70 pub(crate) X: Vec<G::Scalar>,
71 pub(crate) u: G::Scalar,
72}
73
74impl<G: Group> R1CSGens<G> {
75 /// Samples public parameters for the specified number of constraints and variables in an R1CS
76 pub fn new(num_cons: usize, num_vars: usize) -> R1CSGens<G> {
77 R1CSGens {
78 gens: CommitmentGens::<G>::new(b"gens", max(num_vars, num_cons)),
79 }
80 }
81}
82
83impl<G: Group> R1CSShape<G> {
84 /// Create an object of type `R1CSShape` from the explicitly specified R1CS matrices
85 pub fn new(
86 num_cons: usize,
87 num_vars: usize,
88 num_io: usize,
89 A: &[(usize, usize, G::Scalar)],
90 B: &[(usize, usize, G::Scalar)],
91 C: &[(usize, usize, G::Scalar)],
92 ) -> Result<R1CSShape<G>, NovaError> {
93 let is_valid = |num_cons: usize,
94 num_vars: usize,
95 num_io: usize,
96 M: &[(usize, usize, G::Scalar)]|
97 -> Result<(), NovaError> {
98 let res = (0..M.len())
99 .map(|i| {
100 let (row, col, _val) = M[i];
101 if row >= num_cons || col > num_io + num_vars {
102 Err(NovaError::InvalidIndex)
103 } else {
104 Ok(())
105 }
106 })
107 .collect::<Result<Vec<()>, NovaError>>();
108
109 if res.is_err() {
110 Err(NovaError::InvalidIndex)
111 } else {
112 Ok(())
113 }
114 };
115
116 let res_A = is_valid(num_cons, num_vars, num_io, A);
117 let res_B = is_valid(num_cons, num_vars, num_io, B);
118 let res_C = is_valid(num_cons, num_vars, num_io, C);
119
120 if res_A.is_err() || res_B.is_err() || res_C.is_err() {
121 return Err(NovaError::InvalidIndex);
122 }
123
124 // We require the number of public inputs/outputs to be even
125 if num_io % 2 != 0 {
126 return Err(NovaError::OddInputLength);
127 }
128
129 let digest = Self::compute_digest(num_cons, num_vars, num_io, A, B, C);
130
131 let shape = R1CSShape {
132 num_cons,
133 num_vars,
134 num_io,
135 A: A.to_owned(),
136 B: B.to_owned(),
137 C: C.to_owned(),
138 digest,
139 };
140
141 Ok(shape)
142 }
143
144 pub fn multiply_vec(
145 &self,
146 z: &[G::Scalar],
147 ) -> Result<(Vec<G::Scalar>, Vec<G::Scalar>, Vec<G::Scalar>), NovaError> {
148 if z.len() != self.num_io + self.num_vars + 1 {
149 return Err(NovaError::InvalidWitnessLength);
150 }
151
152 // computes a product between a sparse matrix `M` and a vector `z`
153 // This does not perform any validation of entries in M (e.g., if entries in `M` reference indexes outside the range of `z`)
154 // This is safe since we know that `M` is valid
155 let sparse_matrix_vec_product =
156 |M: &Vec<(usize, usize, G::Scalar)>, num_rows: usize, z: &[G::Scalar]| -> Vec<G::Scalar> {
157 (0..M.len())
158 .map(|i| {
159 let (row, col, val) = M[i];
160 (row, val * z[col])
161 })
162 .fold(vec![G::Scalar::zero(); num_rows], |mut Mz, (r, v)| {
163 Mz[r] += v;
164 Mz
165 })
166 };
167
168 let (Az, (Bz, Cz)) = rayon::join(
169 || sparse_matrix_vec_product(&self.A, self.num_cons, z),
170 || {
171 rayon::join(
172 || sparse_matrix_vec_product(&self.B, self.num_cons, z),
173 || sparse_matrix_vec_product(&self.C, self.num_cons, z),
174 )
175 },
176 );
177
178 Ok((Az, Bz, Cz))
179 }
180
181 /// Checks if the Relaxed R1CS instance is satisfiable given a witness and its shape
182 pub fn is_sat_relaxed(
183 &self,
184 gens: &R1CSGens<G>,
185 U: &RelaxedR1CSInstance<G>,
186 W: &RelaxedR1CSWitness<G>,
187 ) -> Result<(), NovaError> {
188 assert_eq!(W.W.len(), self.num_vars);
189 assert_eq!(W.E.len(), self.num_cons);
190 assert_eq!(U.X.len(), self.num_io);
191
192 // verify if Az * Bz = u*Cz + E
193 let res_eq: bool = {
194 let z = concat(vec![W.W.clone(), vec![U.u], U.X.clone()]);
195 let (Az, Bz, Cz) = self.multiply_vec(&z)?;
196 assert_eq!(Az.len(), self.num_cons);
197 assert_eq!(Bz.len(), self.num_cons);
198 assert_eq!(Cz.len(), self.num_cons);
199
200 let res: usize = (0..self.num_cons)
201 .map(|i| usize::from(Az[i] * Bz[i] != U.u * Cz[i] + W.E[i]))
202 .sum();
203
204 res == 0
205 };
206
207 // verify if comm_E and comm_W are commitments to E and W
208 let res_comm: bool = {
209 let (comm_W, comm_E) = rayon::join(
210 || CE::<G>::commit(&gens.gens, &W.W),
211 || CE::<G>::commit(&gens.gens, &W.E),
212 );
213 U.comm_W == comm_W && U.comm_E == comm_E
214 };
215
216 if res_eq && res_comm {
217 Ok(())
218 } else {
219 Err(NovaError::UnSat)
220 }
221 }
222
223 /// Checks if the R1CS instance is satisfiable given a witness and its shape
224 pub fn is_sat(
225 &self,
226 gens: &R1CSGens<G>,
227 U: &R1CSInstance<G>,
228 W: &R1CSWitness<G>,
229 ) -> Result<(), NovaError> {
230 assert_eq!(W.W.len(), self.num_vars);
231 assert_eq!(U.X.len(), self.num_io);
232
233 // verify if Az * Bz = u*Cz
234 let res_eq: bool = {
235 let z = concat(vec![W.W.clone(), vec![G::Scalar::one()], U.X.clone()]);
236 let (Az, Bz, Cz) = self.multiply_vec(&z)?;
237 assert_eq!(Az.len(), self.num_cons);
238 assert_eq!(Bz.len(), self.num_cons);
239 assert_eq!(Cz.len(), self.num_cons);
240
241 let res: usize = (0..self.num_cons)
242 .map(|i| usize::from(Az[i] * Bz[i] != Cz[i]))
243 .sum();
244
245 res == 0
246 };
247
248 // verify if comm_W is a commitment to W
249 let res_comm: bool = U.comm_W == CE::<G>::commit(&gens.gens, &W.W);
250
251 if res_eq && res_comm {
252 Ok(())
253 } else {
254 Err(NovaError::UnSat)
255 }
256 }
257
258 /// A method to compute a commitment to the cross-term `T` given a
259 /// Relaxed R1CS instance-witness pair and an R1CS instance-witness pair
260 pub fn commit_T(
261 &self,
262 gens: &R1CSGens<G>,
263 U1: &RelaxedR1CSInstance<G>,
264 W1: &RelaxedR1CSWitness<G>,
265 U2: &R1CSInstance<G>,
266 W2: &R1CSWitness<G>,
267 ) -> Result<(Vec<G::Scalar>, Commitment<G>), NovaError> {
268 let (AZ_1, BZ_1, CZ_1) = {
269 let Z1 = concat(vec![W1.W.clone(), vec![U1.u], U1.X.clone()]);
270 self.multiply_vec(&Z1)?
271 };
272
273 let (AZ_2, BZ_2, CZ_2) = {
274 let Z2 = concat(vec![W2.W.clone(), vec![G::Scalar::one()], U2.X.clone()]);
275 self.multiply_vec(&Z2)?
276 };
277
278 let AZ_1_circ_BZ_2 = (0..AZ_1.len())
279 .into_par_iter()
280 .map(|i| AZ_1[i] * BZ_2[i])
281 .collect::<Vec<G::Scalar>>();
282 let AZ_2_circ_BZ_1 = (0..AZ_2.len())
283 .into_par_iter()
284 .map(|i| AZ_2[i] * BZ_1[i])
285 .collect::<Vec<G::Scalar>>();
286 let u_1_cdot_CZ_2 = (0..CZ_2.len())
287 .into_par_iter()
288 .map(|i| U1.u * CZ_2[i])
289 .collect::<Vec<G::Scalar>>();
290 let u_2_cdot_CZ_1 = (0..CZ_1.len())
291 .into_par_iter()
292 .map(|i| CZ_1[i])
293 .collect::<Vec<G::Scalar>>();
294
295 let T = AZ_1_circ_BZ_2
296 .par_iter()
297 .zip(&AZ_2_circ_BZ_1)
298 .zip(&u_1_cdot_CZ_2)
299 .zip(&u_2_cdot_CZ_1)
300 .map(|(((a, b), c), d)| *a + *b - *c - *d)
301 .collect::<Vec<G::Scalar>>();
302
303 let comm_T = CE::<G>::commit(&gens.gens, &T);
304
305 Ok((T, comm_T))
306 }
307
308 /// returns the digest of R1CSShape
309 pub fn get_digest(&self) -> G::Scalar {
310 self.digest
311 }
312
313 fn compute_digest(
314 num_cons: usize,
315 num_vars: usize,
316 num_io: usize,
317 A: &[(usize, usize, G::Scalar)],
318 B: &[(usize, usize, G::Scalar)],
319 C: &[(usize, usize, G::Scalar)],
320 ) -> G::Scalar {
321 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
322 struct R1CSShapeWithoutDigest<G: Group> {
323 num_cons: usize,
324 num_vars: usize,
325 num_io: usize,
326 A: Vec<(usize, usize, G::Scalar)>,
327 B: Vec<(usize, usize, G::Scalar)>,
328 C: Vec<(usize, usize, G::Scalar)>,
329 }
330
331 let shape = R1CSShapeWithoutDigest::<G> {
332 num_cons,
333 num_vars,
334 num_io,
335 A: A.to_vec(),
336 B: B.to_vec(),
337 C: C.to_vec(),
338 };
339
340 // obtain a vector of bytes representing the R1CS shape
341 let mut encoder = ZlibEncoder::new(Vec::new(), Compression::default());
342 bincode::serialize_into(&mut encoder, &shape).unwrap();
343 let shape_bytes = encoder.finish().unwrap();
344
345 // convert shape_bytes into a short digest
346 let mut hasher = Sha3_256::new();
347 hasher.input(&shape_bytes);
348 let digest = hasher.result();
349
350 // truncate the digest to 250 bits
351 let bv = (0..NUM_HASH_BITS).map(|i| {
352 let (byte_pos, bit_pos) = (i / 8, i % 8);
353 let bit = (digest[byte_pos] >> bit_pos) & 1;
354 bit == 1
355 });
356
357 // turn the bit vector into a scalar
358 let mut res = G::Scalar::zero();
359 let mut coeff = G::Scalar::one();
360 for bit in bv {
361 if bit {
362 res += coeff;
363 }
364 coeff += coeff;
365 }
366 res
367 }
368
369 /// Pads the R1CSShape so that the number of variables is a power of two
370 /// Renumbers variables to accomodate padded variables
371 pub fn pad(&self) -> Self {
372 // check if the provided R1CSShape is already as required
373 if self.num_vars.next_power_of_two() == self.num_vars
374 && self.num_cons.next_power_of_two() == self.num_cons
375 {
376 return self.clone();
377 }
378
379 // check if the number of variables are as expected, then
380 // we simply set the number of constraints to the next power of two
381 if self.num_vars.next_power_of_two() == self.num_vars {
382 let digest = Self::compute_digest(
383 self.num_cons.next_power_of_two(),
384 self.num_vars,
385 self.num_io,
386 &self.A,
387 &self.B,
388 &self.C,
389 );
390
391 return R1CSShape {
392 num_cons: self.num_cons.next_power_of_two(),
393 num_vars: self.num_vars,
394 num_io: self.num_io,
395 A: self.A.clone(),
396 B: self.B.clone(),
397 C: self.C.clone(),
398 digest,
399 };
400 }
401
402 // otherwise, we need to pad the number of variables and renumber variable accesses
403 let num_vars_padded = self.num_vars.next_power_of_two();
404 let num_cons_padded = self.num_cons.next_power_of_two();
405 let apply_pad = |M: &[(usize, usize, G::Scalar)]| -> Vec<(usize, usize, G::Scalar)> {
406 M.par_iter()
407 .map(|(r, c, v)| {
408 if c >= &self.num_vars {
409 (*r, c + num_vars_padded - self.num_vars, *v)
410 } else {
411 (*r, *c, *v)
412 }
413 })
414 .collect::<Vec<_>>()
415 };
416
417 let A_padded = apply_pad(&self.A);
418 let B_padded = apply_pad(&self.B);
419 let C_padded = apply_pad(&self.C);
420
421 let digest = Self::compute_digest(
422 num_cons_padded,
423 num_vars_padded,
424 self.num_io,
425 &A_padded,
426 &B_padded,
427 &C_padded,
428 );
429
430 R1CSShape {
431 num_cons: num_cons_padded,
432 num_vars: num_vars_padded,
433 num_io: self.num_io,
434 A: A_padded,
435 B: B_padded,
436 C: C_padded,
437 digest,
438 }
439 }
440}
441
442impl<G: Group> AppendToTranscriptTrait<G> for R1CSShape<G> {
443 fn append_to_transcript(&self, label: &'static [u8], transcript: &mut G::TE) {
444 <<G as Group>::Scalar as AppendToTranscriptTrait<G>>::append_to_transcript(
445 &self.get_digest(),
446 label,
447 transcript,
448 );
449 }
450}
451
452impl<G: Group> AbsorbInROTrait<G> for R1CSShape<G> {
453 fn absorb_in_ro(&self, ro: &mut G::RO) {
454 ro.absorb(scalar_as_base::<G>(self.get_digest()));
455 }
456}
457
458impl<G: Group> R1CSWitness<G> {
459 /// A method to create a witness object using a vector of scalars
460 pub fn new(S: &R1CSShape<G>, W: &[G::Scalar]) -> Result<R1CSWitness<G>, NovaError> {
461 if S.num_vars != W.len() {
462 Err(NovaError::InvalidWitnessLength)
463 } else {
464 Ok(R1CSWitness { W: W.to_owned() })
465 }
466 }
467
468 /// Commits to the witness using the supplied generators
469 pub fn commit(&self, gens: &R1CSGens<G>) -> Commitment<G> {
470 CE::<G>::commit(&gens.gens, &self.W)
471 }
472}
473
474impl<G: Group> R1CSInstance<G> {
475 /// A method to create an instance object using consitituent elements
476 pub fn new(
477 S: &R1CSShape<G>,
478 comm_W: &Commitment<G>,
479 X: &[G::Scalar],
480 ) -> Result<R1CSInstance<G>, NovaError> {
481 if S.num_io != X.len() {
482 Err(NovaError::InvalidInputLength)
483 } else {
484 Ok(R1CSInstance {
485 comm_W: *comm_W,
486 X: X.to_owned(),
487 })
488 }
489 }
490}
491
492impl<G: Group> AppendToTranscriptTrait<G> for R1CSInstance<G> {
493 fn append_to_transcript(&self, _label: &'static [u8], transcript: &mut G::TE) {
494 self.comm_W.append_to_transcript(b"comm_W", transcript);
495 <[G::Scalar] as AppendToTranscriptTrait<G>>::append_to_transcript(&self.X, b"X", transcript);
496 }
497}
498
499impl<G: Group> AbsorbInROTrait<G> for R1CSInstance<G> {
500 fn absorb_in_ro(&self, ro: &mut G::RO) {
501 self.comm_W.absorb_in_ro(ro);
502 for x in &self.X {
503 ro.absorb(scalar_as_base::<G>(*x));
504 }
505 }
506}
507
508impl<G: Group> RelaxedR1CSWitness<G> {
509 /// Produces a default RelaxedR1CSWitness given an R1CSShape
510 pub fn default(S: &R1CSShape<G>) -> RelaxedR1CSWitness<G> {
511 RelaxedR1CSWitness {
512 W: vec![G::Scalar::zero(); S.num_vars],
513 E: vec![G::Scalar::zero(); S.num_cons],
514 }
515 }
516
517 /// Initializes a new RelaxedR1CSWitness from an R1CSWitness
518 pub fn from_r1cs_witness(S: &R1CSShape<G>, witness: &R1CSWitness<G>) -> RelaxedR1CSWitness<G> {
519 RelaxedR1CSWitness {
520 W: witness.W.clone(),
521 E: vec![G::Scalar::zero(); S.num_cons],
522 }
523 }
524
525 /// Commits to the witness using the supplied generators
526 pub fn commit(&self, gens: &R1CSGens<G>) -> (Commitment<G>, Commitment<G>) {
527 (
528 CE::<G>::commit(&gens.gens, &self.W),
529 CE::<G>::commit(&gens.gens, &self.E),
530 )
531 }
532
533 /// Folds an incoming R1CSWitness into the current one
534 pub fn fold(
535 &self,
536 W2: &R1CSWitness<G>,
537 T: &[G::Scalar],
538 r: &G::Scalar,
539 ) -> Result<RelaxedR1CSWitness<G>, NovaError> {
540 let (W1, E1) = (&self.W, &self.E);
541 let W2 = &W2.W;
542
543 if W1.len() != W2.len() {
544 return Err(NovaError::InvalidWitnessLength);
545 }
546
547 let W = W1
548 .par_iter()
549 .zip(W2)
550 .map(|(a, b)| *a + *r * *b)
551 .collect::<Vec<G::Scalar>>();
552 let E = E1
553 .par_iter()
554 .zip(T)
555 .map(|(a, b)| *a + *r * *b)
556 .collect::<Vec<G::Scalar>>();
557 Ok(RelaxedR1CSWitness { W, E })
558 }
559
560 /// Pads the provided witness to the correct length
561 pub fn pad(&self, S: &R1CSShape<G>) -> RelaxedR1CSWitness<G> {
562 let W = {
563 let mut W = self.W.clone();
564 W.extend(vec![G::Scalar::zero(); S.num_vars - W.len()]);
565 W
566 };
567
568 let E = {
569 let mut E = self.E.clone();
570 E.extend(vec![G::Scalar::zero(); S.num_cons - E.len()]);
571 E
572 };
573
574 Self { W, E }
575 }
576}
577
578impl<G: Group> RelaxedR1CSInstance<G> {
579 /// Produces a default RelaxedR1CSInstance given R1CSGens and R1CSShape
580 pub fn default(_gens: &R1CSGens<G>, S: &R1CSShape<G>) -> RelaxedR1CSInstance<G> {
581 let (comm_W, comm_E) = (Commitment::<G>::default(), Commitment::<G>::default());
582 RelaxedR1CSInstance {
583 comm_W,
584 comm_E,
585 u: G::Scalar::zero(),
586 X: vec![G::Scalar::zero(); S.num_io],
587 }
588 }
589
590 /// Initializes a new RelaxedR1CSInstance from an R1CSInstance
591 pub fn from_r1cs_instance(
592 gens: &R1CSGens<G>,
593 S: &R1CSShape<G>,
594 instance: &R1CSInstance<G>,
595 ) -> RelaxedR1CSInstance<G> {
596 let mut r_instance = RelaxedR1CSInstance::default(gens, S);
597 r_instance.comm_W = instance.comm_W;
598 r_instance.u = G::Scalar::one();
599 r_instance.X = instance.X.clone();
600 r_instance
601 }
602
603 /// Folds an incoming RelaxedR1CSInstance into the current one
604 pub fn fold(
605 &self,
606 U2: &R1CSInstance<G>,
607 comm_T: &Commitment<G>,
608 r: &G::Scalar,
609 ) -> Result<RelaxedR1CSInstance<G>, NovaError> {
610 let (X1, u1, comm_W_1, comm_E_1) =
611 (&self.X, &self.u, &self.comm_W.clone(), &self.comm_E.clone());
612 let (X2, comm_W_2) = (&U2.X, &U2.comm_W);
613
614 // weighted sum of X, comm_W, comm_E, and u
615 let X = X1
616 .par_iter()
617 .zip(X2)
618 .map(|(a, b)| *a + *r * *b)
619 .collect::<Vec<G::Scalar>>();
620 let comm_W = *comm_W_1 + *comm_W_2 * *r;
621 let comm_E = *comm_E_1 + *comm_T * *r;
622 let u = *u1 + *r;
623
624 Ok(RelaxedR1CSInstance {
625 comm_W,
626 comm_E,
627 X,
628 u,
629 })
630 }
631}
632
633impl<G: Group> AppendToTranscriptTrait<G> for RelaxedR1CSInstance<G> {
634 fn append_to_transcript(&self, _label: &'static [u8], transcript: &mut G::TE) {
635 self.comm_W.append_to_transcript(b"comm_W", transcript);
636 self.comm_E.append_to_transcript(b"comm_E", transcript);
637 <G::Scalar as AppendToTranscriptTrait<G>>::append_to_transcript(&self.u, b"u", transcript);
638 <[G::Scalar] as AppendToTranscriptTrait<G>>::append_to_transcript(&self.X, b"X", transcript);
639 }
640}
641
642impl<G: Group> AbsorbInROTrait<G> for RelaxedR1CSInstance<G> {
643 fn absorb_in_ro(&self, ro: &mut G::RO) {
644 self.comm_W.absorb_in_ro(ro);
645 self.comm_E.absorb_in_ro(ro);
646 ro.absorb(scalar_as_base::<G>(self.u));
647
648 // absorb each element of self.X in bignum format
649 for x in &self.X {
650 let limbs: Vec<G::Scalar> = nat_to_limbs(&f_to_nat(x), BN_LIMB_WIDTH, BN_N_LIMBS).unwrap();
651 for limb in limbs {
652 ro.absorb(scalar_as_base::<G>(limb));
653 }
654 }
655 }
656}