1use crate::*;
 2use ark_ec::{
 3    bls12,
 4    bls12::Bls12Parameters,
 5    models::{ModelParameters, SWModelParameters},
 6    short_weierstrass_jacobian::GroupAffine,
 7    AffineCurve, ProjectiveCurve,
 8};
 9use ark_ff::{biginteger::BigInteger256, field_new, Zero};
10use ark_std::ops::Neg;
11
12pub type G1Affine = bls12::G1Affine<crate::Parameters>;
13pub type G1Projective = bls12::G1Projective<crate::Parameters>;
14
15#[derive(Clone, Default, PartialEq, Eq)]
16pub struct Parameters;
17
18impl ModelParameters for Parameters {
19    type BaseField = Fq;
20    type ScalarField = Fr;
21
22    /// COFACTOR = (x - 1)^2 / 3  = 76329603384216526031706109802092473003
23    const COFACTOR: &'static [u64] = &[0x8c00aaab0000aaab, 0x396c8c005555e156];
24
25    /// COFACTOR_INV = COFACTOR^{-1} mod r
26    /// = 52435875175126190458656871551744051925719901746859129887267498875565241663483
27    #[rustfmt::skip]
28    const COFACTOR_INV: Fr = field_new!(Fr, "52435875175126190458656871551744051925719901746859129887267498875565241663483");
29}
30
31impl SWModelParameters for Parameters {
32    /// COEFF_A = 0
33    const COEFF_A: Fq = field_new!(Fq, "0");
34
35    /// COEFF_B = 4
36    #[rustfmt::skip]
37    const COEFF_B: Fq = field_new!(Fq, "4");
38
39    /// AFFINE_GENERATOR_COEFFS = (G1_GENERATOR_X, G1_GENERATOR_Y)
40    const AFFINE_GENERATOR_COEFFS: (Self::BaseField, Self::BaseField) =
41        (G1_GENERATOR_X, G1_GENERATOR_Y);
42
43    #[inline(always)]
44    fn mul_by_a(_: &Self::BaseField) -> Self::BaseField {
45        Self::BaseField::zero()
46    }
47
48    #[inline]
49    fn is_in_correct_subgroup_assuming_on_curve(p: &G1Affine) -> bool {
50        // Algorithm from Section 6 of https://eprint.iacr.org/2021/1130.
51        //
52        // Check that endomorphism_p(P) == -[X^2]P
53
54        let x = BigInteger256::new([crate::Parameters::X[0], 0, 0, 0]);
55
56        // An early-out optimization described in Section 6.
57        // If uP == P but P != point of infinity, then the point is not in the right subgroup.
58        let x_times_p = p.mul(x);
59        if x_times_p.eq(p) && !p.infinity {
60            return false;
61        }
62
63        let minus_x_squared_times_p = x_times_p.mul(x).neg();
64        let endomorphism_p = endomorphism(p);
65        minus_x_squared_times_p.eq(&endomorphism_p)
66    }
67}
68
69/// G1_GENERATOR_X =
70/// 3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507
71#[rustfmt::skip]
72pub const G1_GENERATOR_X: Fq = field_new!(Fq, "3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507");
73
74/// G1_GENERATOR_Y =
75/// 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569
76#[rustfmt::skip]
77pub const G1_GENERATOR_Y: Fq = field_new!(Fq, "1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569");
78
79/// BETA is a non-trivial cubic root of unity in Fq.
80pub const BETA: Fq = field_new!(Fq, "793479390729215512621379701633421447060886740281060493010456487427281649075476305620758731620350");
81
82pub fn endomorphism(p: &GroupAffine<Parameters>) -> GroupAffine<Parameters> {
83    // Endomorphism of the points on the curve.
84    // endomorphism_p(x,y) = (BETA * x, y) where BETA is a non-trivial cubic root of unity in Fq.
85    let mut res = (*p).clone();
86    res.x *= BETA;
87    res
88}