Initial commit

bls12_377/src/curves/g1.rs

@@ -0,0 +1,77 @@
+use ark_ec::models::{ModelParameters, SWModelParameters};
+use ark_ff::{
+    biginteger::{BigInteger256, BigInteger384},
+    field_new, Zero,
+};
+
+use crate::{Fq, Fr};
+
+#[derive(Clone, Default, PartialEq, Eq)]
+pub struct Parameters;
+
+impl ModelParameters for Parameters {
+    type BaseField = Fq;
+    type ScalarField = Fr;
+}
+
+impl SWModelParameters for Parameters {
+    /// COEFF_A = 0
+    const COEFF_A: Fq = field_new!(Fq, BigInteger384([0x0, 0x0, 0x0, 0x0, 0x0, 0x0]));
+
+    /// COEFF_B = 1
+    #[rustfmt::skip]
+    const COEFF_B: Fq = field_new!(Fq, BigInteger384([
+        0x2cdffffffffff68,
+        0x51409f837fffffb1,
+        0x9f7db3a98a7d3ff2,
+        0x7b4e97b76e7c6305,
+        0x4cf495bf803c84e8,
+        0x8d6661e2fdf49a,
+    ]));
+
+    /// COFACTOR = (x - 1)^2 / 3  = 30631250834960419227450344600217059328
+    const COFACTOR: &'static [u64] = &[0x0, 0x170b5d4430000000];
+
+    /// COFACTOR_INV = COFACTOR^{-1} mod r
+    /// = 5285428838741532253824584287042945485047145357130994810877
+    #[rustfmt::skip]
+    const COFACTOR_INV: Fr = field_new!(Fr, BigInteger256([
+        2013239619100046060,
+        4201184776506987597,
+        2526766393982337036,
+        1114629510922847535,
+    ]));
+
+    /// AFFINE_GENERATOR_COEFFS = (G1_GENERATOR_X, G1_GENERATOR_Y)
+    const AFFINE_GENERATOR_COEFFS: (Self::BaseField, Self::BaseField) =
+        (G1_GENERATOR_X, G1_GENERATOR_Y);
+
+    #[inline(always)]
+    fn mul_by_a(_: &Self::BaseField) -> Self::BaseField {
+        Self::BaseField::zero()
+    }
+}
+
+/// G1_GENERATOR_X =
+/// 81937999373150964239938255573465948239988671502647976594219695644855304257327692006745978603320413799295628339695
+#[rustfmt::skip]
+pub const G1_GENERATOR_X: Fq = field_new!(Fq, BigInteger384([
+    0x260f33b9772451f4,
+    0xc54dd773169d5658,
+    0x5c1551c469a510dd,
+    0x761662e4425e1698,
+    0xc97d78cc6f065272,
+    0xa41206b361fd4d,
+]));
+
+/// G1_GENERATOR_Y =
+/// 241266749859715473739788878240585681733927191168601896383759122102112907357779751001206799952863815012735208165030
+#[rustfmt::skip]
+pub const G1_GENERATOR_Y: Fq = field_new!(Fq, BigInteger384([
+    0x8193961fb8cb81f3,
+    0x638d4c5f44adb8,
+    0xfafaf3dad4daf54a,
+    0xc27849e2d655cd18,
+    0x2ec3ddb401d52814,
+    0x7da93326303c71,
+]));

bls12_377/src/curves/g2.rs

@@ -0,0 +1,129 @@
+use ark_ec::models::{ModelParameters, SWModelParameters};
+use ark_ff::{
+    biginteger::{BigInteger256, BigInteger384},
+    field_new, Zero,
+};
+
+use crate::{g1, Fq, Fq2, Fr};
+
+#[derive(Clone, Default, PartialEq, Eq)]
+pub struct Parameters;
+
+impl ModelParameters for Parameters {
+    type BaseField = Fq2;
+    type ScalarField = Fr;
+}
+
+impl SWModelParameters for Parameters {
+    /// COEFF_A = [0, 0]
+    #[rustfmt::skip]
+    const COEFF_A: Fq2 = field_new!(Fq2,
+        g1::Parameters::COEFF_A,
+        g1::Parameters::COEFF_A,
+    );
+
+    // As per https://eprint.iacr.org/2012/072.pdf,
+    // this curve has b' = b/i, where b is the COEFF_B of G1, and x^6 -i is
+    // the irreducible poly used to extend from Fp2 to Fp12.
+    // In our case, i = u (App A.3, T_6).
+    /// COEFF_B = [0,
+    /// 155198655607781456406391640216936120121836107652948796323930557600032281009004493664981332883744016074664192874906]
+    #[rustfmt::skip]
+    const COEFF_B: Fq2 = field_new!(Fq2,
+        field_new!(Fq, BigInteger384([0, 0, 0, 0, 0, 0])),
+        field_new!(Fq, BigInteger384([
+            9255502405446297221,
+            10229180150694123945,
+            9215585410771530959,
+            13357015519562362907,
+            5437107869987383107,
+            16259554076827459,
+        ])),
+    );
+
+    /// COFACTOR =
+    /// 7923214915284317143930293550643874566881017850177945424769256759165301436616933228209277966774092486467289478618404761412630691835764674559376407658497
+    #[rustfmt::skip]
+    const COFACTOR: &'static [u64] = &[
+        0x0000000000000001,
+        0x452217cc90000000,
+        0xa0f3622fba094800,
+        0xd693e8c36676bd09,
+        0x8c505634fae2e189,
+        0xfbb36b00e1dcc40c,
+        0xddd88d99a6f6a829,
+        0x26ba558ae9562a,
+    ];
+
+    /// COFACTOR_INV = COFACTOR^{-1} mod r
+    /// = 6764900296503390671038341982857278410319949526107311149686707033187604810669
+    #[rustfmt::skip]
+    const COFACTOR_INV: Fr = field_new!(Fr, BigInteger256([
+        15499857013495546999,
+        4613531467548868169,
+        14546778081091178013,
+        549402535258503313,
+    ]));
+
+    /// AFFINE_GENERATOR_COEFFS = (G2_GENERATOR_X, G2_GENERATOR_Y)
+    const AFFINE_GENERATOR_COEFFS: (Self::BaseField, Self::BaseField) =
+        (G2_GENERATOR_X, G2_GENERATOR_Y);
+
+    #[inline(always)]
+    fn mul_by_a(_: &Self::BaseField) -> Self::BaseField {
+        Self::BaseField::zero()
+    }
+}
+
+#[rustfmt::skip]
+pub const G2_GENERATOR_X: Fq2 = field_new!(Fq2, G2_GENERATOR_X_C0, G2_GENERATOR_X_C1);
+#[rustfmt::skip]
+pub const G2_GENERATOR_Y: Fq2 = field_new!(Fq2, G2_GENERATOR_Y_C0, G2_GENERATOR_Y_C1);
+
+/// G2_GENERATOR_X_C0 =
+/// 233578398248691099356572568220835526895379068987715365179118596935057653620464273615301663571204657964920925606294
+#[rustfmt::skip]
+pub const G2_GENERATOR_X_C0: Fq = field_new!(Fq, BigInteger384([
+    0x68904082f268725b,
+    0x668f2ea74f45328b,
+    0xebca7a65802be84f,
+    0x1e1850f4c1ada3e6,
+    0x830dc22d588ef1e9,
+    0x1862a81767c0982,
+]));
+
+/// G2_GENERATOR_X_C1 =
+/// 140913150380207355837477652521042157274541796891053068589147167627541651775299824604154852141315666357241556069118
+#[rustfmt::skip]
+pub const G2_GENERATOR_X_C1: Fq = field_new!(Fq, BigInteger384([
+    0x5f02a915c91c7f39,
+    0xf8c553ba388da2a7,
+    0xd51a416dbd198850,
+    0xe943c6f38ae3073a,
+    0xffe24aa8259a4981,
+    0x11853391e73dfdd,
+]));
+
+/// G2_GENERATOR_Y_C0 =
+/// 63160294768292073209381361943935198908131692476676907196754037919244929611450776219210369229519898517858833747423
+#[rustfmt::skip]
+pub const G2_GENERATOR_Y_C0: Fq = field_new!(Fq, BigInteger384([
+    0xd5b19b897881430f,
+    0x5be9118a5b371ed,
+    0x6063f91f86c131ee,
+    0x3244a61be8f4ec19,
+    0xa02e425b9f9a3a12,
+    0x18af8c04f3360d2,
+]));
+
+/// G2_GENERATOR_Y_C1 =
+/// 149157405641012693445398062341192467754805999074082136895788947234480009303640899064710353187729182149407503257491
+#[rustfmt::skip]
+pub const G2_GENERATOR_Y_C1: Fq = field_new!(Fq, BigInteger384([
+    0x57601ac71a5b96f5,
+    0xe99acc1714f2440e,
+    0x2339612f10118ea9,
+    0x8321e68a3b1cd722,
+    0x2b543b050cc74917,
+    0x590182b396c112,
+]));

bls12_377/src/curves/mod.rs

@@ -0,0 +1,33 @@
+use crate::*;
+use ark_ec::{
+    bls12,
+    bls12::{Bls12, Bls12Parameters, TwistType},
+};
+
+pub mod g1;
+pub mod g2;
+
+#[cfg(test)]
+mod tests;
+
+pub struct Parameters;
+
+impl Bls12Parameters for Parameters {
+    const X: &'static [u64] = &[0x8508c00000000001];
+    /// `x` is positive.
+    const X_IS_NEGATIVE: bool = false;
+    const TWIST_TYPE: TwistType = TwistType::D;
+    type Fp = Fq;
+    type Fp2Params = Fq2Parameters;
+    type Fp6Params = Fq6Parameters;
+    type Fp12Params = Fq12Parameters;
+    type G1Parameters = g1::Parameters;
+    type G2Parameters = g2::Parameters;
+}
+
+pub type Bls12_377 = Bls12<Parameters>;
+
+pub type G1Affine = bls12::G1Affine<Parameters>;
+pub type G1Projective = bls12::G1Projective<Parameters>;
+pub type G2Affine = bls12::G2Affine<Parameters>;
+pub type G2Projective = bls12::G2Projective<Parameters>;

bls12_377/src/curves/tests.rs

@@ -0,0 +1,121 @@
+#![allow(unused_imports)]
+use ark_ff::{
+    fields::{Field, FpParameters, PrimeField, SquareRootField},
+    test_rng, One, Zero,
+};
+use ark_serialize::CanonicalSerialize;
+
+use ark_ec::{models::SWModelParameters, AffineCurve, PairingEngine, ProjectiveCurve};
+use core::ops::{AddAssign, MulAssign};
+use rand::Rng;
+
+use crate::{g1, g2, Bls12_377, Fq, Fq12, Fq2, Fr, G1Affine, G1Projective, G2Affine, G2Projective};
+
+use ark_curve_tests::{
+    curves::{curve_tests, sw_tests},
+    groups::group_test,
+};
+
+#[test]
+fn test_g1_projective_curve() {
+    curve_tests::<G1Projective>();
+
+    sw_tests::<g1::Parameters>();
+}
+
+#[test]
+fn test_g1_projective_group() {
+    let mut rng = test_rng();
+    let a: G1Projective = rng.gen();
+    let b: G1Projective = rng.gen();
+    group_test(a, b);
+}
+
+#[test]
+fn test_g1_generator() {
+    let generator = G1Affine::prime_subgroup_generator();
+    assert!(generator.is_on_curve());
+    assert!(generator.is_in_correct_subgroup_assuming_on_curve());
+}
+
+#[test]
+fn test_g2_projective_curve() {
+    curve_tests::<G2Projective>();
+
+    sw_tests::<g2::Parameters>();
+}
+
+#[test]
+fn test_g2_projective_group() {
+    let mut rng = test_rng();
+    let a: G2Projective = rng.gen();
+    let b: G2Projective = rng.gen();
+    group_test(a, b);
+}
+
+#[test]
+fn test_g2_generator() {
+    let generator = G2Affine::prime_subgroup_generator();
+    assert!(generator.is_on_curve());
+    assert!(generator.is_in_correct_subgroup_assuming_on_curve());
+}
+
+#[test]
+fn test_bilinearity() {
+    let mut rng = test_rng();
+    let a: G1Projective = rng.gen();
+    let b: G2Projective = rng.gen();
+    let s: Fr = rng.gen();
+
+    let mut sa = a;
+    sa.mul_assign(s);
+    let mut sb = b;
+    sb.mul_assign(s);
+
+    let ans1 = Bls12_377::pairing(sa, b);
+    let ans2 = Bls12_377::pairing(a, sb);
+    let ans3 = Bls12_377::pairing(a, b).pow(s.into_repr());
+
+    assert_eq!(ans1, ans2);
+    assert_eq!(ans2, ans3);
+
+    assert_ne!(ans1, Fq12::one());
+    assert_ne!(ans2, Fq12::one());
+    assert_ne!(ans3, Fq12::one());
+
+    assert_eq!(ans1.pow(Fr::characteristic()), Fq12::one());
+    assert_eq!(ans2.pow(Fr::characteristic()), Fq12::one());
+    assert_eq!(ans3.pow(Fr::characteristic()), Fq12::one());
+}
+
+#[test]
+fn test_g1_generator_raw() {
+    let mut x = Fq::zero();
+    let mut i = 0;
+    loop {
+        // y^2 = x^3 + b
+        let mut rhs = x;
+        rhs.square_in_place();
+        rhs.mul_assign(&x);
+        rhs.add_assign(&g1::Parameters::COEFF_B);
+
+        if let Some(y) = rhs.sqrt() {
+            let p = G1Affine::new(x, if y < -y { y } else { -y }, false);
+            assert!(!p.is_in_correct_subgroup_assuming_on_curve());
+
+            let g1 = p.scale_by_cofactor();
+            if !g1.is_zero() {
+                assert_eq!(i, 1);
+                let g1 = G1Affine::from(g1);
+
+                assert!(g1.is_in_correct_subgroup_assuming_on_curve());
+
+                assert_eq!(g1, G1Affine::prime_subgroup_generator());
+                break;
+            }
+        }
+
+        i += 1;
+        x.add_assign(&Fq::one());
+    }
+}