1use crate::*;
  2use ark_ec::bls12::Bls12Parameters;
  3use ark_ec::{
  4    bls12,
  5    models::{ModelParameters, SWModelParameters},
  6    short_weierstrass_jacobian::GroupAffine,
  7    AffineCurve,
  8};
  9use ark_ff::{biginteger::BigInteger256, field_new, Field, Zero};
 10
 11pub type G2Affine = bls12::G2Affine<crate::Parameters>;
 12pub type G2Projective = bls12::G2Projective<crate::Parameters>;
 13
 14#[derive(Clone, Default, PartialEq, Eq)]
 15pub struct Parameters;
 16
 17impl ModelParameters for Parameters {
 18    type BaseField = Fq2;
 19    type ScalarField = Fr;
 20}
 21
 22impl SWModelParameters for Parameters {
 23    /// COEFF_A = [0, 0]
 24    const COEFF_A: Fq2 = field_new!(Fq2, g1::Parameters::COEFF_A, g1::Parameters::COEFF_A,);
 25
 26    /// COEFF_B = [4, 4]
 27    const COEFF_B: Fq2 = field_new!(Fq2, g1::Parameters::COEFF_B, g1::Parameters::COEFF_B,);
 28
 29    /// COFACTOR = (x^8 - 4 x^7 + 5 x^6) - (4 x^4 + 6 x^3 - 4 x^2 - 4 x + 13) //
 30    /// 9
 31    /// = 305502333931268344200999753193121504214466019254188142667664032982267604182971884026507427359259977847832272839041616661285803823378372096355777062779109
 32    #[rustfmt::skip]
 33    const COFACTOR: &'static [u64] = &[
 34        0xcf1c38e31c7238e5,
 35        0x1616ec6e786f0c70,
 36        0x21537e293a6691ae,
 37        0xa628f1cb4d9e82ef,
 38        0xa68a205b2e5a7ddf,
 39        0xcd91de4547085aba,
 40        0x91d50792876a202,
 41        0x5d543a95414e7f1,
 42    ];
 43
 44    /// COFACTOR_INV = COFACTOR^{-1} mod r
 45    /// 26652489039290660355457965112010883481355318854675681319708643586776743290055
 46    #[rustfmt::skip]
 47    const COFACTOR_INV: Fr = field_new!(Fr, "26652489039290660355457965112010883481355318854675681319708643586776743290055");
 48
 49    /// AFFINE_GENERATOR_COEFFS = (G2_GENERATOR_X, G2_GENERATOR_Y)
 50    const AFFINE_GENERATOR_COEFFS: (Self::BaseField, Self::BaseField) =
 51        (G2_GENERATOR_X, G2_GENERATOR_Y);
 52
 53    #[inline(always)]
 54    fn mul_by_a(_: &Self::BaseField) -> Self::BaseField {
 55        Self::BaseField::zero()
 56    }
 57
 58    fn is_in_correct_subgroup_assuming_on_curve(point: &GroupAffine<Parameters>) -> bool {
 59        // Algorithm from Section 4 of https://eprint.iacr.org/2021/1130.
 60        //
 61        // Checks that [p]P = [X]P
 62
 63        let mut x_times_point = point.mul(BigInteger256([crate::Parameters::X[0], 0, 0, 0]));
 64        if crate::Parameters::X_IS_NEGATIVE {
 65            x_times_point = -x_times_point;
 66        }
 67
 68        let p_times_point = p_power_endomorphism(point);
 69
 70        x_times_point.eq(&p_times_point)
 71    }
 72}
 73
 74pub const G2_GENERATOR_X: Fq2 = field_new!(Fq2, G2_GENERATOR_X_C0, G2_GENERATOR_X_C1);
 75pub const G2_GENERATOR_Y: Fq2 = field_new!(Fq2, G2_GENERATOR_Y_C0, G2_GENERATOR_Y_C1);
 76
 77/// G2_GENERATOR_X_C0 =
 78/// 352701069587466618187139116011060144890029952792775240219908644239793785735715026873347600343865175952761926303160
 79#[rustfmt::skip]
 80pub const G2_GENERATOR_X_C0: Fq = field_new!(Fq, "352701069587466618187139116011060144890029952792775240219908644239793785735715026873347600343865175952761926303160");
 81
 82/// G2_GENERATOR_X_C1 =
 83/// 3059144344244213709971259814753781636986470325476647558659373206291635324768958432433509563104347017837885763365758
 84#[rustfmt::skip]
 85pub const G2_GENERATOR_X_C1: Fq = field_new!(Fq, "3059144344244213709971259814753781636986470325476647558659373206291635324768958432433509563104347017837885763365758");
 86
 87/// G2_GENERATOR_Y_C0 =
 88/// 1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905
 89#[rustfmt::skip]
 90pub const G2_GENERATOR_Y_C0: Fq = field_new!(Fq, "1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905");
 91
 92/// G2_GENERATOR_Y_C1 =
 93/// 927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582
 94#[rustfmt::skip]
 95pub const G2_GENERATOR_Y_C1: Fq = field_new!(Fq, "927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582");
 96
 97// psi(x,y) = (x**p * PSI_X, y**p * PSI_Y) is the Frobenius composed
 98// with the quadratic twist and its inverse
 99
100// PSI_X = 1/(u+1)^((p-1)/3)
101pub const P_POWER_ENDOMORPHISM_COEFF_0 : Fq2 = field_new!(
102    Fq2,
103    FQ_ZERO,
104    field_new!(
105       Fq,
106       "4002409555221667392624310435006688643935503118305586438271171395842971157480381377015405980053539358417135540939437"
107    )
108);
109
110// PSI_Y = 1/(u+1)^((p-1)/2)
111pub const P_POWER_ENDOMORPHISM_COEFF_1: Fq2 = field_new!(
112    Fq2,
113    field_new!(
114       Fq,
115       "2973677408986561043442465346520108879172042883009249989176415018091420807192182638567116318576472649347015917690530"),
116    field_new!(
117       Fq,
118       "1028732146235106349975324479215795277384839936929757896155643118032610843298655225875571310552543014690878354869257")
119);
120
121pub fn p_power_endomorphism(p: &GroupAffine<Parameters>) -> GroupAffine<Parameters> {
122    // The p-power endomorphism for G2 is defined as follows:
123    // 1. Note that G2 is defined on curve E': y^2 = x^3 + 4(u+1). To map a point (x, y) in E' to (s, t) in E,
124    //    one set s = x / ((u+1) ^ (1/3)), t = y / ((u+1) ^ (1/2)), because E: y^2 = x^3 + 4.
125    // 2. Apply the Frobenius endomorphism (s, t) => (s', t'), another point on curve E,
126    //    where s' = s^p, t' = t^p.
127    // 3. Map the point from E back to E'; that is,
128    //    one set x' = s' * ((u+1) ^ (1/3)), y' = t' * ((u+1) ^ (1/2)).
129    //
130    // To sum up, it maps
131    // (x,y) -> (x^p / ((u+1)^((p-1)/3)), y^p / ((u+1)^((p-1)/2)))
132    // as implemented in the code as follows.
133
134    let mut res = *p;
135    res.x.frobenius_map(1);
136    res.y.frobenius_map(1);
137
138    let tmp_x = res.x.clone();
139    res.x.c0 = -P_POWER_ENDOMORPHISM_COEFF_0.c1 * &tmp_x.c1;
140    res.x.c1 = P_POWER_ENDOMORPHISM_COEFF_0.c1 * &tmp_x.c0;
141    res.y *= P_POWER_ENDOMORPHISM_COEFF_1;
142
143    res
144}