Add Pallas and Vesta curves (#21)

Co-authored-by: Ying Tong Lai <yingtong@electriccoin.co>
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Pratyush Mishra <pratyushmishra@berkeley.edu>
Co-authored-by: therealyingtong <yingtong@z.cash>

vesta/src/constraints/curves.rs

@@ -0,0 +1,12 @@
+use crate::*;
+use ark_r1cs_std::groups::curves::short_weierstrass::ProjectiveVar;
+
+use crate::constraints::FBaseVar;
+
+/// A group element in the Vesta prime-order group.
+pub type GVar = ProjectiveVar<VestaParameters, FBaseVar>;
+
+#[test]
+fn test() {
+    ark_curve_constraint_tests::curves::sw_test::<VestaParameters, GVar>().unwrap();
+}

vesta/src/constraints/fields.rs

@@ -0,0 +1,10 @@
+use crate::fq::Fq;
+use ark_r1cs_std::fields::fp::FpVar;
+
+/// A variable that is the R1CS equivalent of `crate::Fq`.
+pub type FBaseVar = FpVar<Fq>;
+
+#[test]
+fn test() {
+    ark_curve_constraint_tests::fields::field_test::<_, _, FBaseVar>().unwrap();
+}

vesta/src/constraints/mod.rs

@@ -0,0 +1,107 @@
+//! This module implements the R1CS equivalent of `ark_vesta`.
+//!
+//! It implements field variables for `crate::Fq`,
+//! and group variables for `crate::GroupProjective`.
+//!
+//! The field underlying these constraints is `crate::Fq`.
+//!
+//! # Examples
+//!
+//! One can perform standard algebraic operations on `FBaseVar`:
+//!
+//! ```
+//! # fn main() -> Result<(), ark_relations::r1cs::SynthesisError> {
+//! use ark_std::UniformRand;
+//! use ark_relations::r1cs::*;
+//! use ark_r1cs_std::prelude::*;
+//! use ark_vesta::{*, constraints::*};
+//!
+//! let cs = ConstraintSystem::<Fq>::new_ref();
+//! // This rng is just for test purposes; do not use it
+//! // in real applications.
+//! let mut rng = ark_std::test_rng();
+//!
+//! // Generate some random `Fq` elements.
+//! let a_native = Fq::rand(&mut rng);
+//! let b_native = Fq::rand(&mut rng);
+//!
+//! // Allocate `a_native` and `b_native` as witness variables in `cs`.
+//! let a = FBaseVar::new_witness(ark_relations::ns!(cs, "generate_a"), || Ok(a_native))?;
+//! let b = FBaseVar::new_witness(ark_relations::ns!(cs, "generate_b"), || Ok(b_native))?;
+//!
+//! // Allocate `a_native` and `b_native` as constants in `cs`. This does not add any
+//! // constraints or variables.
+//! let a_const = FBaseVar::new_constant(ark_relations::ns!(cs, "a_as_constant"), a_native)?;
+//! let b_const = FBaseVar::new_constant(ark_relations::ns!(cs, "b_as_constant"), b_native)?;
+//!
+//! let one = FBaseVar::one();
+//! let zero = FBaseVar::zero();
+//!
+//! // Sanity check one + one = two
+//! let two = &one + &one + &zero;
+//! two.enforce_equal(&one.double()?)?;
+//!
+//! assert!(cs.is_satisfied()?);
+//!
+//! // Check that the value of &a + &b is correct.
+//! assert_eq!((&a + &b).value()?, a_native + &b_native);
+//!
+//! // Check that the value of &a * &b is correct.
+//! assert_eq!((&a * &b).value()?, a_native * &b_native);
+//!
+//! // Check that operations on variables and constants are equivalent.
+//! (&a + &b).enforce_equal(&(&a_const + &b_const))?;
+//! assert!(cs.is_satisfied()?);
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! One can also perform standard algebraic operations on `GVar`:
+//!
+//! ```
+//! # fn main() -> Result<(), ark_relations::r1cs::SynthesisError> {
+//! # use ark_std::UniformRand;
+//! # use ark_relations::r1cs::*;
+//! # use ark_r1cs_std::prelude::*;
+//! # use ark_vesta::{*, constraints::*};
+//!
+//! # let cs = ConstraintSystem::<Fq>::new_ref();
+//! # let mut rng = ark_std::test_rng();
+//!
+//! // Generate some random `Projective` elements.
+//! let a_native = Projective::rand(&mut rng);
+//! let b_native = Projective::rand(&mut rng);
+//!
+//! // Allocate `a_native` and `b_native` as witness variables in `cs`.
+//! let a = GVar::new_witness(ark_relations::ns!(cs, "a"), || Ok(a_native))?;
+//! let b = GVar::new_witness(ark_relations::ns!(cs, "b"), || Ok(b_native))?;
+//!
+//! // Allocate `a_native` and `b_native` as constants in `cs`. This does not add any
+//! // constraints or variables.
+//! let a_const = GVar::new_constant(ark_relations::ns!(cs, "a_as_constant"), a_native)?;
+//! let b_const = GVar::new_constant(ark_relations::ns!(cs, "b_as_constant"), b_native)?;
+//!
+//! // This returns the identity.
+//! let zero = GVar::zero();
+//!
+//! // Sanity check one + one = two
+//! let two_a = &a + &a + &zero;
+//! two_a.enforce_equal(&a.double()?)?;
+//!
+//! assert!(cs.is_satisfied()?);
+//!
+//! // Check that the value of &a + &b is correct.
+//! assert_eq!((&a + &b).value()?, a_native + &b_native);
+//!
+//! // Check that operations on variables and constants are equivalent.
+//! (&a + &b).enforce_equal(&(&a_const + &b_const))?;
+//! assert!(cs.is_satisfied()?);
+//! # Ok(())
+//! # }
+//! ```
+
+mod curves;
+mod fields;
+
+pub use curves::*;
+pub use fields::*;

vesta/src/curves/mod.rs

@@ -0,0 +1,51 @@
+use crate::{fq::Fq, fr::Fr};
+use ark_ec::{
+    models::{ModelParameters, SWModelParameters},
+    short_weierstrass_jacobian::{GroupAffine, GroupProjective},
+};
+use ark_ff::{field_new, Zero};
+
+#[cfg(test)]
+mod tests;
+
+#[derive(Copy, Clone, Default, PartialEq, Eq)]
+pub struct VestaParameters;
+
+impl ModelParameters for VestaParameters {
+    type BaseField = Fq;
+    type ScalarField = Fr;
+}
+
+pub type Affine = GroupAffine<VestaParameters>;
+pub type Projective = GroupProjective<VestaParameters>;
+
+impl SWModelParameters for VestaParameters {
+    /// COEFF_A = 0
+    const COEFF_A: Fq = field_new!(Fq, "0");
+
+    /// COEFF_B = 5
+    const COEFF_B: Fq = field_new!(Fq, "5");
+
+    /// COFACTOR = 1
+    const COFACTOR: &'static [u64] = &[0x1];
+
+    /// COFACTOR_INV = 1
+    const COFACTOR_INV: Fr = field_new!(Fr, "1");
+
+    /// AFFINE_GENERATOR_COEFFS = (G1_GENERATOR_X, G1_GENERATOR_Y)
+    const AFFINE_GENERATOR_COEFFS: (Self::BaseField, Self::BaseField) =
+        (G_GENERATOR_X, G_GENERATOR_Y);
+
+    #[inline(always)]
+    fn mul_by_a(_: &Self::BaseField) -> Self::BaseField {
+        Self::BaseField::zero()
+    }
+}
+
+/// G_GENERATOR_X = -1
+/// Encoded in Montgomery form, so the value here is -R mod p.
+pub const G_GENERATOR_X: Fq = field_new!(Fq, "-1");
+
+/// G_GENERATOR_Y = 2
+/// Encoded in Montgomery form, so the value here is 2R mod p.
+pub const G_GENERATOR_Y: Fq = field_new!(Fq, "2");

vesta/src/curves/tests.rs

@@ -0,0 +1,39 @@
+#![allow(unused_imports)]
+use ark_ff::{
+    fields::{Field, FpParameters, PrimeField, SquareRootField},
+    One, Zero,
+};
+use ark_serialize::CanonicalSerialize;
+use ark_std::test_rng;
+
+use ark_ec::{models::SWModelParameters, AffineCurve, PairingEngine, ProjectiveCurve};
+use core::ops::{AddAssign, MulAssign};
+use rand::Rng;
+
+use crate::{Affine, Projective, VestaParameters};
+
+use ark_curve_tests::{
+    curves::{curve_tests, sw_tests},
+    groups::group_test,
+};
+
+#[test]
+fn test_projective_curve() {
+    curve_tests::<Projective>();
+    sw_tests::<VestaParameters>();
+}
+
+#[test]
+fn test_projective_group() {
+    let mut rng = test_rng();
+    let a: Projective = rng.gen();
+    let b: Projective = rng.gen();
+    group_test(a, b);
+}
+
+#[test]
+fn test_generator() {
+    let generator = Affine::prime_subgroup_generator();
+    assert!(generator.is_on_curve());
+    assert!(generator.is_in_correct_subgroup_assuming_on_curve());
+}

vesta/src/fields/fq.rs

@@ -0,0 +1 @@
+pub use ark_pallas::{Fr as Fq, FrParameters as FqParameters};

vesta/src/fields/fr.rs

@@ -0,0 +1 @@
+pub use ark_pallas::{Fq as Fr, FqParameters as FrParameters};

vesta/src/fields/mod.rs

@@ -0,0 +1,8 @@
+pub mod fq;
+pub use self::fq::*;
+
+pub mod fr;
+pub use self::fr::*;
+
+#[cfg(test)]
+mod tests;

vesta/src/fields/tests.rs

@@ -0,0 +1,26 @@
+use ark_std::test_rng;
+use rand::Rng;
+
+use crate::*;
+
+use ark_curve_tests::fields::*;
+
+#[test]
+fn test_fr() {
+    let mut rng = test_rng();
+    let a: Fr = rng.gen();
+    let b: Fr = rng.gen();
+    field_test(a, b);
+    sqrt_field_test(a);
+    primefield_test::<Fr>();
+}
+
+#[test]
+fn test_fq() {
+    let mut rng = test_rng();
+    let a: Fq = rng.gen();
+    let b: Fq = rng.gen();
+    field_test(a, b);
+    sqrt_field_test(a);
+    primefield_test::<Fq>();
+}

vesta/src/lib.rs

@@ -0,0 +1,33 @@
+#![cfg_attr(not(feature = "std"), no_std)]
+#![deny(
+    warnings,
+    unused,
+    future_incompatible,
+    nonstandard_style,
+    rust_2018_idioms
+)]
+#![forbid(unsafe_code)]
+
+//! This library implements the prime-order curve Vesta, generated by
+//! [Daira Hopwood](https://github.com/zcash/pasta). The main feature of this
+//! curve is that it forms a cycle with Pallas, i.e. its scalar field and base
+//! field respectively are the base field and scalar field of Pallas.
+//!
+//!
+//! Curve information:
+//! Vesta:
+//! * Base field: q =
+//!   28948022309329048855892746252171976963363056481941647379679742748393362948097
+//! * Scalar field: r =
+//!   28948022309329048855892746252171976963363056481941560715954676764349967630337
+//! * Curve equation: y^2 = x^3 + 5
+//! * Valuation(q - 1, 2) = 32
+//! * Valuation(r - 1, 2) = 32
+
+#[cfg(feature = "r1cs")]
+pub mod constraints;
+mod curves;
+mod fields;
+
+pub use curves::*;
+pub use fields::*;