1use crate::fields::{fp2::Fp2Var, fp6_3over2::Fp6Var, quadratic_extension::*, FieldVar};
  2use algebra::fields::{fp12_2over3over2::*, fp6_3over2::Fp6Parameters, Field, QuadExtParameters};
  3use r1cs_core::SynthesisError;
  4
  5/// A degree-12 extension field constructed as the tower of a
  6/// quadratic extension over a cubic extension over a quadratic extension field.
  7/// This is the R1CS equivalent of `algebra_core::fp12_2over3over2::Fp12<P>`.
  8pub type Fp12Var<P> = QuadExtVar<Fp6Var<<P as Fp12Parameters>::Fp6Params>, Fp12ParamsWrapper<P>>;
  9
 10type Fp2Params<P> = <<P as Fp12Parameters>::Fp6Params as Fp6Parameters>::Fp2Params;
 11
 12impl<P: Fp12Parameters> QuadExtVarParams<Fp6Var<P::Fp6Params>> for Fp12ParamsWrapper<P> {
 13    fn mul_base_field_var_by_frob_coeff(fe: &mut Fp6Var<P::Fp6Params>, power: usize) {
 14        fe.c0 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
 15        fe.c1 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
 16        fe.c2 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
 17    }
 18}
 19
 20impl<P: Fp12Parameters> Fp12Var<P> {
 21    /// Multiplies by a sparse element of the form `(c0 = (c0, c1, 0), c1 = (0, d1, 0))`.
 22    #[inline]
 23    pub fn mul_by_014(
 24        &self,
 25        c0: &Fp2Var<Fp2Params<P>>,
 26        c1: &Fp2Var<Fp2Params<P>>,
 27        d1: &Fp2Var<Fp2Params<P>>,
 28    ) -> Result<Self, SynthesisError> {
 29        let v0 = self.c0.mul_by_c0_c1_0(&c0, &c1)?;
 30        let v1 = self.c1.mul_by_0_c1_0(&d1)?;
 31        let new_c0 = Self::mul_base_field_by_nonresidue(&v1)? + &v0;
 32
 33        let new_c1 = (&self.c0 + &self.c1).mul_by_c0_c1_0(&c0, &(c1 + d1))? - &v0 - &v1;
 34        Ok(Self::new(new_c0, new_c1))
 35    }
 36
 37    /// Multiplies by a sparse element of the form `(c0 = (c0, 0, 0), c1 = (d0, d1, 0))`.
 38    #[inline]
 39    pub fn mul_by_034(
 40        &self,
 41        c0: &Fp2Var<Fp2Params<P>>,
 42        d0: &Fp2Var<Fp2Params<P>>,
 43        d1: &Fp2Var<Fp2Params<P>>,
 44    ) -> Result<Self, SynthesisError> {
 45        let a0 = &self.c0.c0 * c0;
 46        let a1 = &self.c0.c1 * c0;
 47        let a2 = &self.c0.c2 * c0;
 48        let a = Fp6Var::new(a0, a1, a2);
 49        let b = self.c1.mul_by_c0_c1_0(&d0, &d1)?;
 50
 51        let c0 = c0 + d0;
 52        let c1 = d1;
 53        let e = (&self.c0 + &self.c1).mul_by_c0_c1_0(&c0, &c1)?;
 54        let new_c1 = e - (&a + &b);
 55        let new_c0 = Self::mul_base_field_by_nonresidue(&b)? + &a;
 56
 57        Ok(Self::new(new_c0, new_c1))
 58    }
 59
 60    /// Squares `self` when `self` is in the cyclotomic subgroup.
 61    pub fn cyclotomic_square(&self) -> Result<Self, SynthesisError> {
 62        if characteristic_square_mod_6_is_one(Fp12::<P>::characteristic()) {
 63            let fp2_nr = <P::Fp6Params as Fp6Parameters>::NONRESIDUE;
 64
 65            let z0 = &self.c0.c0;
 66            let z4 = &self.c0.c1;
 67            let z3 = &self.c0.c2;
 68            let z2 = &self.c1.c0;
 69            let z1 = &self.c1.c1;
 70            let z5 = &self.c1.c2;
 71
 72            // t0 + t1*y = (z0 + z1*y)^2 = a^2
 73            let tmp = z0 * z1;
 74            let t0 = {
 75                let tmp1 = z0 + z1;
 76                let tmp2 = z1 * fp2_nr + z0;
 77                let tmp4 = &tmp * fp2_nr + &tmp;
 78                tmp1 * tmp2 - tmp4
 79            };
 80            let t1 = tmp.double()?;
 81
 82            // t2 + t3*y = (z2 + z3*y)^2 = b^2
 83            let tmp = z2 * z3;
 84            let t2 = {
 85                // (z2 + &z3) * &(z2 + &(fp2_nr * &z3)) - &tmp - &(tmp * &fp2_nr);
 86                let tmp1 = z2 + z3;
 87                let tmp2 = z3 * fp2_nr + z2;
 88                let tmp4 = &tmp * fp2_nr + &tmp;
 89                tmp1 * tmp2 - tmp4
 90            };
 91            let t3 = tmp.double()?;
 92
 93            // t4 + t5*y = (z4 + z5*y)^2 = c^2
 94            let tmp = z4 * z5;
 95            let t4 = {
 96                // (z4 + &z5) * &(z4 + &(fp2_nr * &z5)) - &tmp - &(tmp * &fp2_nr);
 97                let tmp1 = z4 + z5;
 98                let tmp2 = (z5 * fp2_nr) + z4;
 99                let tmp4 = (&tmp * fp2_nr) + &tmp;
100                (tmp1 * tmp2) - tmp4
101            };
102            let t5 = tmp.double()?;
103
104            // for A
105
106            // z0 = 3 * t0 - 2 * z0
107            let c0_c0 = (&t0 - z0).double()? + &t0;
108
109            // z1 = 3 * t1 + 2 * z1
110            let c1_c1 = (&t1 + z1).double()? + &t1;
111
112            // for B
113
114            // z2 = 3 * (xi * t5) + 2 * z2
115            let c1_c0 = {
116                let tmp = &t5 * fp2_nr;
117                (z2 + &tmp).double()? + &tmp
118            };
119
120            // z3 = 3 * t4 - 2 * z3
121            let c0_c2 = (&t4 - z3).double()? + &t4;
122
123            // for C
124
125            // z4 = 3 * t2 - 2 * z4
126            let c0_c1 = (&t2 - z4).double()? + &t2;
127
128            // z5 = 3 * t3 + 2 * z5
129            let c1_c2 = (&t3 + z5).double()? + &t3;
130            let c0 = Fp6Var::new(c0_c0, c0_c1, c0_c2);
131            let c1 = Fp6Var::new(c1_c0, c1_c1, c1_c2);
132
133            Ok(Self::new(c0, c1))
134        } else {
135            self.square()
136        }
137    }
138
139    /// Like `Self::cyclotomic_exp`, but additionally uses cyclotomic squaring.
140    pub fn optimized_cyclotomic_exp(
141        &self,
142        exponent: impl AsRef<[u64]>,
143    ) -> Result<Self, SynthesisError> {
144        use algebra::biginteger::arithmetic::find_wnaf;
145        let mut res = Self::one();
146        let self_inverse = self.unitary_inverse()?;
147
148        let mut found_nonzero = false;
149        let naf = find_wnaf(exponent.as_ref());
150
151        for &value in naf.iter().rev() {
152            if found_nonzero {
153                res = res.cyclotomic_square()?;
154            }
155
156            if value != 0 {
157                found_nonzero = true;
158
159                if value > 0 {
160                    res *= self;
161                } else {
162                    res *= &self_inverse;
163                }
164            }
165        }
166
167        Ok(res)
168    }
169}