1use ark_ec::{
 2    bls12,
 3    bls12::Bls12Parameters,
 4    models::CurveConfig,
 5    short_weierstrass::{Affine, SWCurveConfig},
 6    AffineRepr, Group,
 7};
 8use ark_ff::{Field, MontFp, Zero};
 9use ark_std::ops::Neg;
10
11use crate::*;
12
13pub type G1Affine = bls12::G1Affine<crate::Parameters>;
14pub type G1Projective = bls12::G1Projective<crate::Parameters>;
15
16#[derive(Clone, Default, PartialEq, Eq)]
17pub struct Parameters;
18
19impl CurveConfig for Parameters {
20    type BaseField = Fq;
21    type ScalarField = Fr;
22
23    /// COFACTOR = (x - 1)^2 / 3  = 76329603384216526031706109802092473003
24    const COFACTOR: &'static [u64] = &[0x8c00aaab0000aaab, 0x396c8c005555e156];
25
26    /// COFACTOR_INV = COFACTOR^{-1} mod r
27    /// = 52435875175126190458656871551744051925719901746859129887267498875565241663483
28    const COFACTOR_INV: Fr =
29        MontFp!("52435875175126190458656871551744051925719901746859129887267498875565241663483");
30}
31
32impl SWCurveConfig for Parameters {
33    /// COEFF_A = 0
34    const COEFF_A: Fq = Fq::ZERO;
35
36    /// COEFF_B = 4
37    const COEFF_B: Fq = MontFp!("4");
38
39    /// AFFINE_GENERATOR_COEFFS = (G1_GENERATOR_X, G1_GENERATOR_Y)
40    const GENERATOR: G1Affine = G1Affine::new_unchecked(G1_GENERATOR_X, G1_GENERATOR_Y);
41
42    #[inline(always)]
43    fn mul_by_a(_: Self::BaseField) -> Self::BaseField {
44        Self::BaseField::zero()
45    }
46
47    #[inline]
48    fn is_in_correct_subgroup_assuming_on_curve(p: &G1Affine) -> bool {
49        // Algorithm from Section 6 of https://eprint.iacr.org/2021/1130.
50        //
51        // Check that endomorphism_p(P) == -[X^2]P
52
53        // An early-out optimization described in Section 6.
54        // If uP == P but P != point of infinity, then the point is not in the right
55        // subgroup.
56        let x_times_p = p.mul_bigint(crate::Parameters::X);
57        if x_times_p.eq(p) && !p.infinity {
58            return false;
59        }
60
61        let minus_x_squared_times_p = x_times_p.mul_bigint(crate::Parameters::X).neg();
62        let endomorphism_p = endomorphism(p);
63        minus_x_squared_times_p.eq(&endomorphism_p)
64    }
65}
66
67/// G1_GENERATOR_X =
68/// 3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507
69pub const G1_GENERATOR_X: Fq = MontFp!("3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507");
70
71/// G1_GENERATOR_Y =
72/// 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569
73pub const G1_GENERATOR_Y: Fq = MontFp!("1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569");
74
75/// BETA is a non-trivial cubic root of unity in Fq.
76pub const BETA: Fq = MontFp!("793479390729215512621379701633421447060886740281060493010456487427281649075476305620758731620350");
77
78pub fn endomorphism(p: &Affine<Parameters>) -> Affine<Parameters> {
79    // Endomorphism of the points on the curve.
80    // endomorphism_p(x,y) = (BETA * x, y)
81    // where BETA is a non-trivial cubic root of unity in Fq.
82    let mut res = (*p).clone();
83    res.x *= BETA;
84    res
85}