1use algebra::{
  2    curves::bls12::{Bls12Parameters, G1Prepared, TwistType},
  3    fields::Field,
  4    BitIterator, One, ProjectiveCurve,
  5};
  6use r1cs_core::{ConstraintSystem, SynthesisError};
  7
  8use crate::{
  9    fields::{fp::FpGadget, fp2::Fp2Gadget, FieldGadget},
 10    groups::curves::short_weierstrass::AffineGadget,
 11    prelude::*,
 12    Vec,
 13};
 14
 15use core::fmt::Debug;
 16
 17pub type G1Gadget<P> = AffineGadget<
 18    <P as Bls12Parameters>::G1Parameters,
 19    <P as Bls12Parameters>::Fp,
 20    FpGadget<<P as Bls12Parameters>::Fp>,
 21>;
 22
 23pub type G2Gadget<P> =
 24    AffineGadget<<P as Bls12Parameters>::G2Parameters, <P as Bls12Parameters>::Fp, Fp2G<P>>;
 25
 26#[derive(Derivative)]
 27#[derivative(
 28    Clone(bound = "G1Gadget<P>: Clone"),
 29    Debug(bound = "G1Gadget<P>: Debug")
 30)]
 31pub struct G1PreparedGadget<P: Bls12Parameters>(pub G1Gadget<P>);
 32
 33impl<P: Bls12Parameters> G1PreparedGadget<P> {
 34    pub fn get_value(&self) -> Option<G1Prepared<P>> {
 35        Some(G1Prepared::from(self.0.get_value().unwrap().into_affine()))
 36    }
 37
 38    pub fn from_affine<CS: ConstraintSystem<P::Fp>>(
 39        _cs: CS,
 40        q: &G1Gadget<P>,
 41    ) -> Result<Self, SynthesisError> {
 42        Ok(G1PreparedGadget(q.clone()))
 43    }
 44}
 45
 46impl<P: Bls12Parameters> ToBytesGadget<P::Fp> for G1PreparedGadget<P> {
 47    #[inline]
 48    fn to_bytes<CS: ConstraintSystem<P::Fp>>(
 49        &self,
 50        mut cs: CS,
 51    ) -> Result<Vec<UInt8>, SynthesisError> {
 52        self.0.to_bytes(&mut cs.ns(|| "g_alpha to bytes"))
 53    }
 54
 55    fn to_bytes_strict<CS: ConstraintSystem<P::Fp>>(
 56        &self,
 57        cs: CS,
 58    ) -> Result<Vec<UInt8>, SynthesisError> {
 59        self.to_bytes(cs)
 60    }
 61}
 62
 63type Fp2G<P> = Fp2Gadget<<P as Bls12Parameters>::Fp2Params, <P as Bls12Parameters>::Fp>;
 64type LCoeff<P> = (Fp2G<P>, Fp2G<P>);
 65#[derive(Derivative)]
 66#[derivative(
 67    Clone(bound = "Fp2Gadget<P::Fp2Params, P::Fp>: Clone"),
 68    Debug(bound = "Fp2Gadget<P::Fp2Params, P::Fp>: Debug")
 69)]
 70pub struct G2PreparedGadget<P: Bls12Parameters> {
 71    pub ell_coeffs: Vec<LCoeff<P>>,
 72}
 73
 74impl<P: Bls12Parameters> ToBytesGadget<P::Fp> for G2PreparedGadget<P> {
 75    #[inline]
 76    fn to_bytes<CS: ConstraintSystem<P::Fp>>(
 77        &self,
 78        mut cs: CS,
 79    ) -> Result<Vec<UInt8>, SynthesisError> {
 80        let mut bytes = Vec::new();
 81        for (i, coeffs) in self.ell_coeffs.iter().enumerate() {
 82            let mut cs = cs.ns(|| format!("Iteration {}", i));
 83            bytes.extend_from_slice(&coeffs.0.to_bytes(&mut cs.ns(|| "c0"))?);
 84            bytes.extend_from_slice(&coeffs.1.to_bytes(&mut cs.ns(|| "c1"))?);
 85        }
 86        Ok(bytes)
 87    }
 88
 89    fn to_bytes_strict<CS: ConstraintSystem<P::Fp>>(
 90        &self,
 91        cs: CS,
 92    ) -> Result<Vec<UInt8>, SynthesisError> {
 93        self.to_bytes(cs)
 94    }
 95}
 96
 97impl<P: Bls12Parameters> G2PreparedGadget<P> {
 98    pub fn from_affine<CS: ConstraintSystem<P::Fp>>(
 99        mut cs: CS,
100        q: &G2Gadget<P>,
101    ) -> Result<Self, SynthesisError> {
102        let two_inv = P::Fp::one().double().inverse().unwrap();
103        let zero = G2Gadget::<P>::zero(cs.ns(|| "zero"))?;
104        q.enforce_not_equal(cs.ns(|| "enforce not zero"), &zero)?;
105        let mut ell_coeffs = vec![];
106        let mut r = q.clone();
107
108        for (j, i) in BitIterator::new(P::X).skip(1).enumerate() {
109            let mut cs = cs.ns(|| format!("Iteration {}", j));
110            ell_coeffs.push(Self::double(cs.ns(|| "double"), &mut r, &two_inv)?);
111
112            if i {
113                ell_coeffs.push(Self::add(cs.ns(|| "add"), &mut r, &q)?);
114            }
115        }
116
117        Ok(Self { ell_coeffs })
118    }
119
120    fn double<CS: ConstraintSystem<P::Fp>>(
121        mut cs: CS,
122        r: &mut G2Gadget<P>,
123        two_inv: &P::Fp,
124    ) -> Result<LCoeff<P>, SynthesisError> {
125        let a = r.y.inverse(cs.ns(|| "Inverse"))?;
126        let mut b = r.x.square(cs.ns(|| "square x"))?;
127        let b_tmp = b.clone();
128        b.mul_by_fp_constant_in_place(cs.ns(|| "mul by two_inv"), two_inv)?;
129        b.add_in_place(cs.ns(|| "compute b"), &b_tmp)?;
130
131        let c = a.mul(cs.ns(|| "compute c"), &b)?;
132        let d = r.x.double(cs.ns(|| "compute d"))?;
133        let x3 = c.square(cs.ns(|| "c^2"))?.sub(cs.ns(|| "sub d"), &d)?;
134        let e = c
135            .mul(cs.ns(|| "c*r.x"), &r.x)?
136            .sub(cs.ns(|| "sub r.y"), &r.y)?;
137        let c_x3 = c.mul(cs.ns(|| "c*x_3"), &x3)?;
138        let y3 = e.sub(cs.ns(|| "e = c * x3"), &c_x3)?;
139        let mut f = c;
140        f.negate_in_place(cs.ns(|| "c = -c"))?;
141        r.x = x3;
142        r.y = y3;
143        match P::TWIST_TYPE {
144            TwistType::M => Ok((e, f)),
145            TwistType::D => Ok((f, e)),
146        }
147    }
148
149    fn add<CS: ConstraintSystem<P::Fp>>(
150        mut cs: CS,
151        r: &mut G2Gadget<P>,
152        q: &G2Gadget<P>,
153    ) -> Result<LCoeff<P>, SynthesisError> {
154        let a =
155            q.x.sub(cs.ns(|| "q.x - r.x"), &r.x)?
156                .inverse(cs.ns(|| "calc a"))?;
157        let b = q.y.sub(cs.ns(|| "q.y - r.y"), &r.y)?;
158        let c = a.mul(cs.ns(|| "compute c"), &b)?;
159        let d = r.x.add(cs.ns(|| "r.x + q.x"), &q.x)?;
160        let x3 = c.square(cs.ns(|| "c^2"))?.sub(cs.ns(|| "sub d"), &d)?;
161
162        let e =
163            r.x.sub(cs.ns(|| "r.x - x3"), &x3)?
164                .mul(cs.ns(|| "c * (r.x - x3)"), &c)?;
165        let y3 = e.sub(cs.ns(|| "calc y3"), &r.y)?;
166        let g = c
167            .mul(cs.ns(|| "c*r.x"), &r.x)?
168            .sub(cs.ns(|| "calc g"), &r.y)?;
169        let mut f = c;
170        f.negate_in_place(cs.ns(|| "c = -c"))?;
171        r.x = x3;
172        r.y = y3;
173        match P::TWIST_TYPE {
174            TwistType::M => Ok((g, f)),
175            TwistType::D => Ok((f, g)),
176        }
177    }
178}