ark-r1cs-std/r1cs-std/src/groups/curves/short_weierstrass/mod.rs
r1cs-std/src/groups/curves/short_weierstrass/mod.rsRaw
1use algebra::{
2 curves::{
3 short_weierstrass_jacobian::{GroupAffine as SWAffine, GroupProjective as SWProjective},
4 SWModelParameters,
5 },
6 AffineCurve, BitIterator, Field, One, PrimeField, ProjectiveCurve, Zero,
7};
8use core::{borrow::Borrow, marker::PhantomData, ops::Neg};
9use r1cs_core::{ConstraintSystem, SynthesisError};
10
11use crate::{prelude::*, Assignment, Vec};
12
13pub mod bls12;
14pub mod mnt4;
15pub mod mnt6;
16
17#[derive(Derivative)]
18#[derivative(Debug, Clone)]
19#[must_use]
20pub struct AffineGadget<
21 P: SWModelParameters,
22 ConstraintF: Field,
23 F: FieldGadget<P::BaseField, ConstraintF>,
24> {
25 pub x: F,
26 pub y: F,
27 pub infinity: Boolean,
28 _params: PhantomData<P>,
29 _engine: PhantomData<ConstraintF>,
30}
31
32impl<P: SWModelParameters, ConstraintF: Field, F: FieldGadget<P::BaseField, ConstraintF>>
33 AffineGadget<P, ConstraintF, F>
34{
35 pub fn new(x: F, y: F, infinity: Boolean) -> Self {
36 Self {
37 x,
38 y,
39 infinity,
40 _params: PhantomData,
41 _engine: PhantomData,
42 }
43 }
44
45 pub fn alloc_without_check<FN, CS: ConstraintSystem<ConstraintF>>(
46 mut cs: CS,
47 value_gen: F,
48 ) -> Result<Self, SynthesisError>
49 where
50 F: FnOnce() -> Result<SWProjective<P>, SynthesisError>,
51 {
52 let (x, y, infinity) = match value_gen() {
53 Ok(ge) => {
54 let ge = ge.into_affine();
55 (Ok(ge.x), Ok(ge.y), Ok(ge.infinity))
56 }
57 _ => (
58 Err(SynthesisError::AssignmentMissing),
59 Err(SynthesisError::AssignmentMissing),
60 Err(SynthesisError::AssignmentMissing),
61 ),
62 };
63
64 let x = F::alloc(&mut cs.ns(|| "x"), || x)?;
65 let y = F::alloc(&mut cs.ns(|| "y"), || y)?;
66 let infinity = Boolean::alloc(&mut cs.ns(|| "infinity"), || infinity)?;
67
68 Ok(Self::new(x, y, infinity))
69 }
70}
71
72impl<P, ConstraintF, F> PartialEq for AffineGadget<P, ConstraintF, F>
73where
74 P: SWModelParameters,
75 ConstraintF: Field,
76 F: FieldGadget<P::BaseField, ConstraintF>,
77{
78 fn eq(&self, other: &Self) -> bool {
79 self.x == other.x && self.y == other.y
80 }
81}
82
83impl<P, ConstraintF, F> Eq for AffineGadget<P, ConstraintF, F>
84where
85 P: SWModelParameters,
86 ConstraintF: Field,
87 F: FieldGadget<P::BaseField, ConstraintF>,
88{
89}
90
91impl<P, ConstraintF, F> GroupGadget<SWProjective<P>, ConstraintF>
92 for AffineGadget<P, ConstraintF, F>
93where
94 P: SWModelParameters,
95 ConstraintF: PrimeField,
96 F: FieldGadget<P::BaseField, ConstraintF>,
97{
98 type Value = SWProjective<P>;
99 type Variable = (F::Variable, F::Variable);
100
101 #[inline]
102 fn get_value(&self) -> Option<Self::Value> {
103 match (
104 self.x.get_value(),
105 self.y.get_value(),
106 self.infinity.get_value(),
107 ) {
108 (Some(x), Some(y), Some(infinity)) => {
109 Some(SWAffine::new(x, y, infinity).into_projective())
110 }
111 (None, None, None) => None,
112 _ => unreachable!(),
113 }
114 }
115
116 #[inline]
117 fn get_variable(&self) -> Self::Variable {
118 (self.x.get_variable(), self.y.get_variable())
119 }
120
121 #[inline]
122 fn zero<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
123 Ok(Self::new(
124 F::zero(cs.ns(|| "zero"))?,
125 F::one(cs.ns(|| "one"))?,
126 Boolean::Constant(true),
127 ))
128 }
129
130 #[inline]
131 /// Incomplete addition: neither `self` nor `other` can be the neutral
132 /// element.
133 fn add<CS: ConstraintSystem<ConstraintF>>(
134 &self,
135 mut cs: CS,
136 other: &Self,
137 ) -> Result<Self, SynthesisError> {
138 // lambda = (B.y - A.y)/(B.x - A.x)
139 // C.x = lambda^2 - A.x - B.x
140 // C.y = lambda(A.x - C.x) - A.y
141 //
142 // Special cases:
143 //
144 // doubling: if B.y = A.y and B.x = A.x then lambda is unbound and
145 // C = (lambda^2, lambda^3)
146 //
147 // addition of negative point: if B.y = -A.y and B.x = A.x then no
148 // lambda can satisfy the first equation unless B.y - A.y = 0. But
149 // then this reduces to doubling.
150 //
151 // So we need to check that A.x - B.x != 0, which can be done by
152 // enforcing I * (B.x - A.x) = 1
153 // This is done below when we calculate inv (by F::inverse)
154
155 let x2_minus_x1 = other.x.sub(cs.ns(|| "x2 - x1"), &self.x)?;
156 let y2_minus_y1 = other.y.sub(cs.ns(|| "y2 - y1"), &self.y)?;
157
158 let inv = x2_minus_x1.inverse(cs.ns(|| "compute inv"))?;
159
160 let lambda = F::alloc(cs.ns(|| "lambda"), || {
161 Ok(y2_minus_y1.get_value().get()? * &inv.get_value().get()?)
162 })?;
163
164 let x_3 = F::alloc(&mut cs.ns(|| "x_3"), || {
165 let lambda_val = lambda.get_value().get()?;
166 let x1 = self.x.get_value().get()?;
167 let x2 = other.x.get_value().get()?;
168 Ok((lambda_val.square() - &x1) - &x2)
169 })?;
170
171 let y_3 = F::alloc(&mut cs.ns(|| "y_3"), || {
172 let lambda_val = lambda.get_value().get()?;
173 let x_1 = self.x.get_value().get()?;
174 let y_1 = self.y.get_value().get()?;
175 let x_3 = x_3.get_value().get()?;
176 Ok(lambda_val * &(x_1 - &x_3) - &y_1)
177 })?;
178
179 // Check lambda
180 lambda.mul_equals(cs.ns(|| "check lambda"), &x2_minus_x1, &y2_minus_y1)?;
181
182 // Check x3
183 let x3_plus_x1_plus_x2 = x_3
184 .add(cs.ns(|| "x3 + x1"), &self.x)?
185 .add(cs.ns(|| "x3 + x1 + x2"), &other.x)?;
186 lambda.mul_equals(cs.ns(|| "check x3"), &lambda, &x3_plus_x1_plus_x2)?;
187
188 // Check y3
189 let y3_plus_y1 = y_3.add(cs.ns(|| "y3 + y1"), &self.y)?;
190 let x1_minus_x3 = self.x.sub(cs.ns(|| "x1 - x3"), &x_3)?;
191
192 lambda.mul_equals(cs.ns(|| ""), &x1_minus_x3, &y3_plus_y1)?;
193
194 Ok(Self::new(x_3, y_3, Boolean::Constant(false)))
195 }
196
197 /// Incomplete addition: neither `self` nor `other` can be the neutral
198 /// element.
199 fn add_constant<CS: ConstraintSystem<ConstraintF>>(
200 &self,
201 mut cs: CS,
202 other: &SWProjective<P>,
203 ) -> Result<Self, SynthesisError> {
204 // lambda = (B.y - A.y)/(B.x - A.x)
205 // C.x = lambda^2 - A.x - B.x
206 // C.y = lambda(A.x - C.x) - A.y
207 //
208 // Special cases:
209 //
210 // doubling: if B.y = A.y and B.x = A.x then lambda is unbound and
211 // C = (lambda^2, lambda^3)
212 //
213 // addition of negative point: if B.y = -A.y and B.x = A.x then no
214 // lambda can satisfy the first equation unless B.y - A.y = 0. But
215 // then this reduces to doubling.
216 //
217 // So we need to check that A.x - B.x != 0, which can be done by
218 // enforcing I * (B.x - A.x) = 1
219 if other.is_zero() {
220 return Err(SynthesisError::AssignmentMissing);
221 }
222 let other = other.into_affine();
223 let other_x = other.x;
224 let other_y = other.y;
225
226 let x2_minus_x1 = self
227 .x
228 .sub_constant(cs.ns(|| "x2 - x1"), &other_x)?
229 .negate(cs.ns(|| "neg1"))?;
230 let y2_minus_y1 = self
231 .y
232 .sub_constant(cs.ns(|| "y2 - y1"), &other_y)?
233 .negate(cs.ns(|| "neg2"))?;
234
235 let inv = x2_minus_x1.inverse(cs.ns(|| "compute inv"))?;
236
237 let lambda = F::alloc(cs.ns(|| "lambda"), || {
238 Ok(y2_minus_y1.get_value().get()? * &inv.get_value().get()?)
239 })?;
240
241 let x_3 = F::alloc(&mut cs.ns(|| "x_3"), || {
242 let lambda_val = lambda.get_value().get()?;
243 let x1 = self.x.get_value().get()?;
244 let x2 = other_x;
245 Ok((lambda_val.square() - &x1) - &x2)
246 })?;
247
248 let y_3 = F::alloc(&mut cs.ns(|| "y_3"), || {
249 let lambda_val = lambda.get_value().get()?;
250 let x_1 = self.x.get_value().get()?;
251 let y_1 = self.y.get_value().get()?;
252 let x_3 = x_3.get_value().get()?;
253 Ok(lambda_val * &(x_1 - &x_3) - &y_1)
254 })?;
255
256 // Check lambda
257 lambda.mul_equals(cs.ns(|| "check lambda"), &x2_minus_x1, &y2_minus_y1)?;
258
259 // Check x3
260 let x3_plus_x1_plus_x2 = x_3
261 .add(cs.ns(|| "x3 + x1"), &self.x)?
262 .add_constant(cs.ns(|| "x3 + x1 + x2"), &other_x)?;
263 lambda.mul_equals(cs.ns(|| "check x3"), &lambda, &x3_plus_x1_plus_x2)?;
264
265 // Check y3
266 let y3_plus_y1 = y_3.add(cs.ns(|| "y3 + y1"), &self.y)?;
267 let x1_minus_x3 = self.x.sub(cs.ns(|| "x1 - x3"), &x_3)?;
268
269 lambda.mul_equals(cs.ns(|| ""), &x1_minus_x3, &y3_plus_y1)?;
270
271 Ok(Self::new(x_3, y_3, Boolean::Constant(false)))
272 }
273
274 #[inline]
275 fn double_in_place<CS: ConstraintSystem<ConstraintF>>(
276 &mut self,
277 mut cs: CS,
278 ) -> Result<(), SynthesisError> {
279 let a = P::COEFF_A;
280 let x_squared = self.x.square(cs.ns(|| "x^2"))?;
281
282 let one = P::BaseField::one();
283 let two = one.double();
284 let three = two + &one;
285
286 let three_x_squared = x_squared.mul_by_constant(cs.ns(|| "3 * x^2"), &three)?;
287 let three_x_squared_plus_a = three_x_squared.add_constant(cs.ns(|| "3 * x^2 + a"), &a)?;
288
289 let two_y = self.y.double(cs.ns(|| "2y"))?;
290
291 let lambda = F::alloc(cs.ns(|| "lambda"), || {
292 let y_doubled_inv = two_y.get_value().get()?.inverse().get()?;
293 Ok(three_x_squared_plus_a.get_value().get()? * &y_doubled_inv)
294 })?;
295
296 // Check lambda
297 lambda.mul_equals(cs.ns(|| "check lambda"), &two_y, &three_x_squared_plus_a)?;
298
299 let x = lambda
300 .square(cs.ns(|| "lambda^2"))?
301 .sub(cs.ns(|| "lambda^2 - x"), &self.x)?
302 .sub(cs.ns(|| "lambda^2 - 2x"), &self.x)?;
303
304 let y = self
305 .x
306 .sub(cs.ns(|| "x - self.x"), &x)?
307 .mul(cs.ns(|| "times lambda"), &lambda)?
308 .sub(cs.ns(|| "plus self.y"), &self.y)?;
309
310 *self = Self::new(x, y, Boolean::Constant(false));
311 Ok(())
312 }
313
314 fn negate<CS: ConstraintSystem<ConstraintF>>(
315 &self,
316 mut cs: CS,
317 ) -> Result<Self, SynthesisError> {
318 Ok(Self::new(
319 self.x.clone(),
320 self.y.negate(cs.ns(|| "negate y"))?,
321 self.infinity,
322 ))
323 }
324
325 fn cost_of_add() -> usize {
326 3 * F::cost_of_mul_equals() + F::cost_of_inv()
327 }
328
329 fn cost_of_double() -> usize {
330 4 * F::cost_of_mul()
331 }
332}
333
334impl<P, ConstraintF, F> CondSelectGadget<ConstraintF> for AffineGadget<P, ConstraintF, F>
335where
336 P: SWModelParameters,
337 ConstraintF: PrimeField,
338 F: FieldGadget<P::BaseField, ConstraintF>,
339{
340 #[inline]
341 fn conditionally_select<CS: ConstraintSystem<ConstraintF>>(
342 mut cs: CS,
343 cond: &Boolean,
344 true_value: &Self,
345 false_value: &Self,
346 ) -> Result<Self, SynthesisError> {
347 let x = F::conditionally_select(&mut cs.ns(|| "x"), cond, &true_value.x, &false_value.x)?;
348 let y = F::conditionally_select(&mut cs.ns(|| "y"), cond, &true_value.y, &false_value.y)?;
349 let infinity = Boolean::conditionally_select(
350 &mut cs.ns(|| "infinity"),
351 cond,
352 &true_value.infinity,
353 &false_value.infinity,
354 )?;
355
356 Ok(Self::new(x, y, infinity))
357 }
358
359 fn cost() -> usize {
360 2 * <F as CondSelectGadget<ConstraintF>>::cost()
361 + <Boolean as CondSelectGadget<ConstraintF>>::cost()
362 }
363}
364
365impl<P, ConstraintF, F> EqGadget<ConstraintF> for AffineGadget<P, ConstraintF, F>
366where
367 P: SWModelParameters,
368 ConstraintF: Field,
369 F: FieldGadget<P::BaseField, ConstraintF>,
370{
371}
372
373impl<P, ConstraintF, F> ConditionalEqGadget<ConstraintF> for AffineGadget<P, ConstraintF, F>
374where
375 P: SWModelParameters,
376 ConstraintF: Field,
377 F: FieldGadget<P::BaseField, ConstraintF>,
378{
379 #[inline]
380 fn conditional_enforce_equal<CS: ConstraintSystem<ConstraintF>>(
381 &self,
382 mut cs: CS,
383 other: &Self,
384 condition: &Boolean,
385 ) -> Result<(), SynthesisError> {
386 self.x.conditional_enforce_equal(
387 &mut cs.ns(|| "X Coordinate Conditional Equality"),
388 &other.x,
389 condition,
390 )?;
391 self.y.conditional_enforce_equal(
392 &mut cs.ns(|| "Y Coordinate Conditional Equality"),
393 &other.y,
394 condition,
395 )?;
396 self.infinity.conditional_enforce_equal(
397 &mut cs.ns(|| "Infinity Conditional Equality"),
398 &other.infinity,
399 condition,
400 )?;
401 Ok(())
402 }
403
404 fn cost() -> usize {
405 2 * <F as ConditionalEqGadget<ConstraintF>>::cost()
406 }
407}
408
409impl<P, ConstraintF, F> NEqGadget<ConstraintF> for AffineGadget<P, ConstraintF, F>
410where
411 P: SWModelParameters,
412 ConstraintF: Field,
413 F: FieldGadget<P::BaseField, ConstraintF>,
414{
415 #[inline]
416 fn enforce_not_equal<CS: ConstraintSystem<ConstraintF>>(
417 &self,
418 mut cs: CS,
419 other: &Self,
420 ) -> Result<(), SynthesisError> {
421 self.x
422 .enforce_not_equal(&mut cs.ns(|| "X Coordinate Inequality"), &other.x)?;
423 self.y
424 .enforce_not_equal(&mut cs.ns(|| "Y Coordinate Inequality"), &other.y)?;
425 Ok(())
426 }
427
428 fn cost() -> usize {
429 2 * <F as NEqGadget<ConstraintF>>::cost()
430 }
431}
432
433impl<P, ConstraintF, F> AllocGadget<SWProjective<P>, ConstraintF>
434 for AffineGadget<P, ConstraintF, F>
435where
436 P: SWModelParameters,
437 ConstraintF: PrimeField,
438 F: FieldGadget<P::BaseField, ConstraintF>,
439{
440 #[inline]
441 fn alloc<FN, T, CS: ConstraintSystem<ConstraintF>>(
442 mut cs: CS,
443 value_gen: FN,
444 ) -> Result<Self, SynthesisError>
445 where
446 FN: FnOnce() -> Result<T, SynthesisError>,
447 T: Borrow<SWProjective<P>>,
448 {
449 let (x, y, infinity) = match value_gen() {
450 Ok(ge) => {
451 let ge = ge.borrow().into_affine();
452 (Ok(ge.x), Ok(ge.y), Ok(ge.infinity))
453 }
454 _ => (
455 Err(SynthesisError::AssignmentMissing),
456 Err(SynthesisError::AssignmentMissing),
457 Err(SynthesisError::AssignmentMissing),
458 ),
459 };
460
461 // Perform on-curve check.
462 let b = P::COEFF_B;
463 let a = P::COEFF_A;
464
465 let x = F::alloc(&mut cs.ns(|| "x"), || x)?;
466 let y = F::alloc(&mut cs.ns(|| "y"), || y)?;
467 let infinity = Boolean::alloc(&mut cs.ns(|| "infinity"), || infinity)?;
468
469 // Check that y^2 = x^3 + ax +b
470 // We do this by checking that y^2 - b = x * (x^2 +a)
471 let x2 = x.square(&mut cs.ns(|| "x^2"))?;
472 let y2 = y.square(&mut cs.ns(|| "y^2"))?;
473
474 let x2_plus_a = x2.add_constant(cs.ns(|| "x^2 + a"), &a)?;
475 let y2_minus_b = y2.add_constant(cs.ns(|| "y^2 - b"), &b.neg())?;
476
477 x2_plus_a.mul_equals(cs.ns(|| "on curve check"), &x, &y2_minus_b)?;
478
479 Ok(Self::new(x, y, infinity))
480 }
481
482 #[inline]
483 fn alloc_checked<FN, T, CS: ConstraintSystem<ConstraintF>>(
484 mut cs: CS,
485 value_gen: FN,
486 ) -> Result<Self, SynthesisError>
487 where
488 FN: FnOnce() -> Result<T, SynthesisError>,
489 T: Borrow<SWProjective<P>>,
490 {
491 let cofactor_weight = BitIterator::new(P::COFACTOR).filter(|b| *b).count();
492 // If we multiply by r, we actually multiply by r - 2.
493 let r_minus_1 = (-P::ScalarField::one()).into_repr();
494 let r_weight = BitIterator::new(&r_minus_1).filter(|b| *b).count();
495
496 // We pick the most efficient method of performing the prime order check:
497 // If the cofactor has lower hamming weight than the scalar field's modulus,
498 // we first multiply by the inverse of the cofactor, and then, after allocating,
499 // multiply by the cofactor. This ensures the resulting point has no cofactors
500 //
501 // Else, we multiply by the scalar field's modulus and ensure that the result
502 // is zero.
503 if cofactor_weight < r_weight {
504 let ge = Self::alloc(cs.ns(|| "Alloc checked"), || {
505 value_gen().map(|ge| {
506 ge.borrow()
507 .into_affine()
508 .mul_by_cofactor_inv()
509 .into_projective()
510 })
511 })?;
512 let mut seen_one = false;
513 let mut result = Self::zero(cs.ns(|| "result"))?;
514 for (i, b) in BitIterator::new(P::COFACTOR).enumerate() {
515 let mut cs = cs.ns(|| format!("Iteration {}", i));
516
517 let old_seen_one = seen_one;
518 if seen_one {
519 result.double_in_place(cs.ns(|| "Double"))?;
520 } else {
521 seen_one = b;
522 }
523
524 if b {
525 result = if old_seen_one {
526 result.add(cs.ns(|| "Add"), &ge)?
527 } else {
528 ge.clone()
529 };
530 }
531 }
532 Ok(result)
533 } else {
534 let ge = Self::alloc(cs.ns(|| "Alloc checked"), value_gen)?;
535 let mut seen_one = false;
536 let mut result = Self::zero(cs.ns(|| "result"))?;
537 // Returns bits in big-endian order
538 for (i, b) in BitIterator::new(r_minus_1).enumerate() {
539 let mut cs = cs.ns(|| format!("Iteration {}", i));
540
541 let old_seen_one = seen_one;
542 if seen_one {
543 result.double_in_place(cs.ns(|| "Double"))?;
544 } else {
545 seen_one = b;
546 }
547
548 if b {
549 result = if old_seen_one {
550 result.add(cs.ns(|| "Add"), &ge)?
551 } else {
552 ge.clone()
553 };
554 }
555 }
556 let neg_ge = ge.negate(cs.ns(|| "Negate ge"))?;
557 neg_ge.enforce_equal(cs.ns(|| "Check equals"), &result)?;
558 Ok(ge)
559 }
560 }
561
562 #[inline]
563 fn alloc_input<FN, T, CS: ConstraintSystem<ConstraintF>>(
564 mut cs: CS,
565 value_gen: FN,
566 ) -> Result<Self, SynthesisError>
567 where
568 FN: FnOnce() -> Result<T, SynthesisError>,
569 T: Borrow<SWProjective<P>>,
570 {
571 // When allocating the input we assume that the verifier has performed
572 // any on curve checks already.
573 let (x, y, infinity) = match value_gen() {
574 Ok(ge) => {
575 let ge = ge.borrow().into_affine();
576 (Ok(ge.x), Ok(ge.y), Ok(ge.infinity))
577 }
578 _ => (
579 Err(SynthesisError::AssignmentMissing),
580 Err(SynthesisError::AssignmentMissing),
581 Err(SynthesisError::AssignmentMissing),
582 ),
583 };
584
585 let x = F::alloc_input(&mut cs.ns(|| "x"), || x)?;
586 let y = F::alloc_input(&mut cs.ns(|| "y"), || y)?;
587 let infinity = Boolean::alloc_input(&mut cs.ns(|| "infinity"), || infinity)?;
588
589 Ok(Self::new(x, y, infinity))
590 }
591}
592
593impl<P, ConstraintF, F> ToBitsGadget<ConstraintF> for AffineGadget<P, ConstraintF, F>
594where
595 P: SWModelParameters,
596 ConstraintF: Field,
597 F: FieldGadget<P::BaseField, ConstraintF>,
598{
599 fn to_bits<CS: ConstraintSystem<ConstraintF>>(
600 &self,
601 mut cs: CS,
602 ) -> Result<Vec<Boolean>, SynthesisError> {
603 let mut x_bits = self.x.to_bits(&mut cs.ns(|| "X Coordinate To Bits"))?;
604 let y_bits = self.y.to_bits(&mut cs.ns(|| "Y Coordinate To Bits"))?;
605 x_bits.extend_from_slice(&y_bits);
606 x_bits.push(self.infinity);
607 Ok(x_bits)
608 }
609
610 fn to_non_unique_bits<CS: ConstraintSystem<ConstraintF>>(
611 &self,
612 mut cs: CS,
613 ) -> Result<Vec<Boolean>, SynthesisError> {
614 let mut x_bits = self
615 .x
616 .to_non_unique_bits(&mut cs.ns(|| "X Coordinate To Bits"))?;
617 let y_bits = self
618 .y
619 .to_non_unique_bits(&mut cs.ns(|| "Y Coordinate To Bits"))?;
620 x_bits.extend_from_slice(&y_bits);
621 x_bits.push(self.infinity);
622
623 Ok(x_bits)
624 }
625}
626
627impl<P, ConstraintF, F> ToBytesGadget<ConstraintF> for AffineGadget<P, ConstraintF, F>
628where
629 P: SWModelParameters,
630 ConstraintF: Field,
631 F: FieldGadget<P::BaseField, ConstraintF>,
632{
633 fn to_bytes<CS: ConstraintSystem<ConstraintF>>(
634 &self,
635 mut cs: CS,
636 ) -> Result<Vec<UInt8>, SynthesisError> {
637 let mut x_bytes = self.x.to_bytes(&mut cs.ns(|| "X Coordinate To Bytes"))?;
638 let y_bytes = self.y.to_bytes(&mut cs.ns(|| "Y Coordinate To Bytes"))?;
639 let inf_bytes = self.infinity.to_bytes(&mut cs.ns(|| "Infinity to Bytes"))?;
640 x_bytes.extend_from_slice(&y_bytes);
641 x_bytes.extend_from_slice(&inf_bytes);
642 Ok(x_bytes)
643 }
644
645 fn to_non_unique_bytes<CS: ConstraintSystem<ConstraintF>>(
646 &self,
647 mut cs: CS,
648 ) -> Result<Vec<UInt8>, SynthesisError> {
649 let mut x_bytes = self
650 .x
651 .to_non_unique_bytes(&mut cs.ns(|| "X Coordinate To Bytes"))?;
652 let y_bytes = self
653 .y
654 .to_non_unique_bytes(&mut cs.ns(|| "Y Coordinate To Bytes"))?;
655 let inf_bytes = self
656 .infinity
657 .to_non_unique_bytes(&mut cs.ns(|| "Infinity to Bytes"))?;
658 x_bytes.extend_from_slice(&y_bytes);
659 x_bytes.extend_from_slice(&inf_bytes);
660
661 Ok(x_bytes)
662 }
663}
664
665#[cfg(test)]
666#[allow(dead_code)]
667pub(crate) fn test<ConstraintF, P, GG>()
668where
669 ConstraintF: Field,
670 P: SWModelParameters,
671 GG: GroupGadget<SWProjective<P>, ConstraintF, Value = SWProjective<P>>,
672{
673 use crate::{boolean::AllocatedBit, prelude::*, test_constraint_system::TestConstraintSystem};
674 use algebra::{test_rng, Group, UniformRand};
675 use rand::Rng;
676
677 // Incomplete addition doesn't allow us to call the group_test.
678 // group_test::<ConstraintF, SWProjective<P>, GG>();
679
680 let mut rng = test_rng();
681
682 let mut cs = TestConstraintSystem::<ConstraintF>::new();
683
684 let a = SWProjective::<P>::rand(&mut rng);
685 let b = SWProjective::<P>::rand(&mut rng);
686 let a_affine = a.into_affine();
687 let b_affine = b.into_affine();
688 let mut gadget_a = GG::alloc(&mut cs.ns(|| "a"), || Ok(a)).unwrap();
689 let gadget_b = GG::alloc_checked(&mut cs.ns(|| "b"), || Ok(b)).unwrap();
690 assert_eq!(gadget_a.get_value().unwrap().x, a_affine.x);
691 assert_eq!(gadget_a.get_value().unwrap().y, a_affine.y);
692 assert_eq!(gadget_b.get_value().unwrap().x, b_affine.x);
693 assert_eq!(gadget_b.get_value().unwrap().y, b_affine.y);
694
695 // Check addition
696 let ab = a + &b;
697 let ab_affine = ab.into_affine();
698 let gadget_ab = gadget_a.add(&mut cs.ns(|| "ab"), &gadget_b).unwrap();
699 let gadget_ba = gadget_b.add(&mut cs.ns(|| "ba"), &gadget_a).unwrap();
700 gadget_ba
701 .enforce_equal(&mut cs.ns(|| "b + a == a + b?"), &gadget_ab)
702 .unwrap();
703
704 let ab_val = gadget_ab
705 .get_value()
706 .expect("Doubling should be successful")
707 .into_affine();
708 assert_eq!(ab_val, ab_affine, "Result of addition is unequal");
709
710 // Check doubling
711 let aa = Group::double(&a);
712 let aa_affine = aa.into_affine();
713 gadget_a.double_in_place(&mut cs.ns(|| "2a")).unwrap();
714 let aa_val = gadget_a
715 .get_value()
716 .expect("Doubling should be successful")
717 .into_affine();
718 assert_eq!(
719 aa_val, aa_affine,
720 "Gadget and native values are unequal after double."
721 );
722
723 // Check mul_bits
724 let scalar = P::ScalarField::rand(&mut rng);
725 let native_result = aa.into_affine().mul(scalar) + &b;
726 let native_result = native_result.into_affine();
727
728 let mut scalar: Vec<bool> = BitIterator::new(scalar.into_repr()).collect();
729 // Get the scalar bits into little-endian form.
730 scalar.reverse();
731 let input = Vec::<Boolean>::alloc(cs.ns(|| "Input"), || Ok(scalar)).unwrap();
732 let result = gadget_a
733 .mul_bits(cs.ns(|| "mul_bits"), &gadget_b, input.iter())
734 .unwrap();
735 let result_val = result.get_value().unwrap().into_affine();
736 assert_eq!(
737 result_val, native_result,
738 "gadget & native values are diff. after scalar mul"
739 );
740
741 if !cs.is_satisfied() {
742 println!("{:?}", cs.which_is_unsatisfied().unwrap());
743 }
744
745 assert!(cs.is_satisfied());
746
747 // Constraint cost etc.
748 let mut cs = TestConstraintSystem::<ConstraintF>::new();
749
750 let bit = AllocatedBit::alloc(&mut cs.ns(|| "bool"), || Ok(true))
751 .unwrap()
752 .into();
753
754 let mut rng = test_rng();
755 let a: SWProjective<P> = rng.gen();
756 let b: SWProjective<P> = rng.gen();
757 let gadget_a = GG::alloc(&mut cs.ns(|| "a"), || Ok(a)).unwrap();
758 let gadget_b = GG::alloc(&mut cs.ns(|| "b"), || Ok(b)).unwrap();
759 let alloc_cost = cs.num_constraints();
760 let _ =
761 GG::conditionally_select(&mut cs.ns(|| "cond_select"), &bit, &gadget_a, &gadget_b).unwrap();
762 let cond_select_cost = cs.num_constraints() - alloc_cost;
763
764 let _ = gadget_a.add(&mut cs.ns(|| "ab"), &gadget_b).unwrap();
765 let add_cost = cs.num_constraints() - cond_select_cost - alloc_cost;
766
767 assert!(cs.is_satisfied());
768 assert_eq!(
769 cond_select_cost,
770 <GG as CondSelectGadget<ConstraintF>>::cost()
771 );
772 assert_eq!(add_cost, GG::cost_of_add());
773}