1use ark_ec::{
  2    bw6,
  3    bw6::{BW6Config, TwistType, BW6},
  4};
  5use ark_ff::{
  6    biginteger::BigInteger768 as BigInteger, fp6_2over3::Fp6, BigInt, CyclotomicMultSubgroup, Field,
  7};
  8
  9use crate::*;
 10
 11pub mod g1;
 12pub mod g2;
 13
 14#[cfg(test)]
 15mod tests;
 16
 17#[derive(PartialEq, Eq)]
 18pub struct Config;
 19
 20impl BW6Config for Config {
 21    const X: BigInteger = BigInt!("0x8508c00000000001");
 22    /// `x` is positive.
 23    const X_IS_NEGATIVE: bool = false;
 24    // X
 25    const ATE_LOOP_COUNT_1: &'static [u64] = &[0x8508c00000000001];
 26    // (X-1)/3
 27    const X_MINUS_1_DIV_3: BigInteger = BigInt!("0x2c58400000000000");
 28    // X+1
 29    const ATE_LOOP_COUNT_1_IS_NEGATIVE: bool = false;
 30    // X^2-X-1
 31    const ATE_LOOP_COUNT_2: &'static [i8] = &[
 32        -1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 33        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0,
 34        0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 35        0, 0, 1, 0, 0, 1, 0, 0, -1, 0, 1, 0, -1, 0, 0, 0, 0, -1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0,
 36        0, 1, 0, 1, 0, 0, 0, 1,
 37    ];
 38    const ATE_LOOP_COUNT_2_IS_NEGATIVE: bool = false;
 39    const TWIST_TYPE: TwistType = TwistType::M;
 40    const H_T: i64 = 13;
 41    const H_Y: i64 = 9;
 42    const T_MOD_R_IS_ZERO: bool = false;
 43    type Fp = Fq;
 44    type Fp3Config = Fq3Config;
 45    type Fp6Config = Fq6Config;
 46    type G1Config = g1::Config;
 47    type G2Config = g2::Config;
 48
 49    fn final_exponentiation_hard_part(f: &Fp6<Self::Fp6Config>) -> Fp6<Self::Fp6Config> {
 50        // hard_part
 51        // From https://eprint.iacr.org/2020/351.pdf, Alg.6
 52
 53        #[rustfmt::skip]
 54        // R0(x) := (-103*x^7 + 70*x^6 + 269*x^5 - 197*x^4 - 314*x^3 - 73*x^2 - 263*x - 220)
 55        // R1(x) := (103*x^9 - 276*x^8 + 77*x^7 + 492*x^6 - 445*x^5 - 65*x^4 + 452*x^3 - 181*x^2 + 34*x + 229)
 56        // f ^ R0(u) * (f ^ q) ^ R1(u) in a 2-NAF multi-exp fashion.
 57
 58        // steps 1,2,3
 59        let f0 = *f;
 60        let mut f0p = f0;
 61        f0p.frobenius_map_in_place(1);
 62        let f1 = Self::exp_by_x(&f0);
 63        let mut f1p = f1;
 64        f1p.frobenius_map_in_place(1);
 65        let f2 = Self::exp_by_x(&f1);
 66        let mut f2p = f2;
 67        f2p.frobenius_map_in_place(1);
 68        let f3 = Self::exp_by_x(&f2);
 69        let mut f3p = f3;
 70        f3p.frobenius_map_in_place(1);
 71        let f4 = Self::exp_by_x(&f3);
 72        let mut f4p = f4;
 73        f4p.frobenius_map_in_place(1);
 74        let f5 = Self::exp_by_x(&f4);
 75        let mut f5p = f5;
 76        f5p.frobenius_map_in_place(1);
 77        let f6 = Self::exp_by_x(&f5);
 78        let mut f6p = f6;
 79        f6p.frobenius_map_in_place(1);
 80        let f7 = Self::exp_by_x(&f6);
 81        let mut f7p = f7;
 82        f7p.frobenius_map_in_place(1);
 83
 84        // step 4
 85        let f8p = Self::exp_by_x(&f7p);
 86        let f9p = Self::exp_by_x(&f8p);
 87
 88        // step 5
 89        let mut f5p_p3 = f5p;
 90        f5p_p3.cyclotomic_inverse_in_place();
 91        let result1 = f3p * &f6p * &f5p_p3;
 92
 93        // step 6
 94        let result2 = result1.square();
 95        let f4_2p = f4 * &f2p;
 96        let mut tmp1_p3 = f0 * &f1 * &f3 * &f4_2p * &f8p;
 97        tmp1_p3.cyclotomic_inverse_in_place();
 98        let result3 = result2 * &f5 * &f0p * &tmp1_p3;
 99
100        // step 7
101        let result4 = result3.square();
102        let mut f7_p3 = f7;
103        f7_p3.cyclotomic_inverse_in_place();
104        let result5 = result4 * &f9p * &f7_p3;
105
106        // step 8
107        let result6 = result5.square();
108        let f2_4p = f2 * &f4p;
109        let f4_2p_5p = f4_2p * &f5p;
110        let mut tmp2_p3 = f2_4p * &f3 * &f3p;
111        tmp2_p3.cyclotomic_inverse_in_place();
112        let result7 = result6 * &f4_2p_5p * &f6 * &f7p * &tmp2_p3;
113
114        // step 9
115        let result8 = result7.square();
116        let mut tmp3_p3 = f0p * &f9p;
117        tmp3_p3.cyclotomic_inverse_in_place();
118        let result9 = result8 * &f0 * &f7 * &f1p * &tmp3_p3;
119
120        // step 10
121        let result10 = result9.square();
122        let f6p_8p = f6p * &f8p;
123        let f5_7p = f5 * &f7p;
124        let mut tmp4_p3 = f6p_8p;
125        tmp4_p3.cyclotomic_inverse_in_place();
126        let result11 = result10 * &f5_7p * &f2p * &tmp4_p3;
127
128        // step 11
129        let result12 = result11.square();
130        let f3_6 = f3 * &f6;
131        let f1_7 = f1 * &f7;
132        let mut tmp5_p3 = f1_7 * &f2;
133        tmp5_p3.cyclotomic_inverse_in_place();
134        let result13 = result12 * &f3_6 * &f9p * &tmp5_p3;
135
136        // step 12
137        let result14 = result13.square();
138        let mut tmp6_p3 = f4_2p * &f5_7p * &f6p_8p;
139        tmp6_p3.cyclotomic_inverse_in_place();
140        let result15 = result14 * &f0 * &f0p * &f3p * &f5p * &tmp6_p3;
141
142        // step 13
143        let result16 = result15.square();
144        let mut tmp7_p3 = f3_6;
145        tmp7_p3.cyclotomic_inverse_in_place();
146        let result17 = result16 * &f1p * &tmp7_p3;
147
148        // step 14
149        let result18 = result17.square();
150        let mut tmp8_p3 = f2_4p * &f4_2p_5p * &f9p;
151        tmp8_p3.cyclotomic_inverse_in_place();
152        let result19 = result18 * &f1_7 * &f5_7p * &f0p * &tmp8_p3;
153
154        result19
155    }
156}
157
158pub type BW6_761 = BW6<Config>;
159
160pub type G1Affine = bw6::G1Affine<Config>;
161pub type G1Projective = bw6::G1Projective<Config>;
162pub type G2Affine = bw6::G2Affine<Config>;
163pub type G2Projective = bw6::G2Projective<Config>;