|
|
|
@ -1,12 +1,12 @@ |
|
|
|
use r1cs_core::{ConstraintSystem, SynthesisError};
|
|
|
|
use r1cs_core::SynthesisError;
|
|
|
|
|
|
|
|
use super::PairingGadget as PG;
|
|
|
|
use super::PairingVar as PG;
|
|
|
|
|
|
|
|
use crate::{
|
|
|
|
fields::{fp::FpGadget, fp3::Fp3Gadget, fp6_2over3::Fp6Gadget, FieldGadget},
|
|
|
|
fields::{fp::FpVar, fp3::Fp3Var, fp6_2over3::Fp6Var, FieldVar},
|
|
|
|
groups::mnt6::{
|
|
|
|
AteAdditionCoefficientsGadget, AteDoubleCoefficientsGadget, G1Gadget, G1PreparedGadget,
|
|
|
|
G2Gadget, G2PreparedGadget, G2ProjectiveExtendedGadget,
|
|
|
|
AteAdditionCoefficientsVar, AteDoubleCoefficientsVar, G1PreparedVar, G1Var, G2PreparedVar,
|
|
|
|
G2ProjectiveExtendedVar, G2Var,
|
|
|
|
},
|
|
|
|
};
|
|
|
|
use algebra::{
|
|
|
|
@ -15,154 +15,90 @@ use algebra::{ |
|
|
|
};
|
|
|
|
use core::marker::PhantomData;
|
|
|
|
|
|
|
|
pub struct PairingGadget<P: MNT6Parameters>(PhantomData<P>);
|
|
|
|
|
|
|
|
type Fp3G<P> = Fp3Gadget<<P as MNT6Parameters>::Fp3Params, <P as MNT6Parameters>::Fp>;
|
|
|
|
type Fp6G<P> = Fp6Gadget<<P as MNT6Parameters>::Fp6Params, <P as MNT6Parameters>::Fp>;
|
|
|
|
pub type GTGadget<P> = Fp6G<P>;
|
|
|
|
|
|
|
|
impl<P: MNT6Parameters> PairingGadget<P> {
|
|
|
|
pub(crate) fn doubling_step_for_flipped_miller_loop<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
mut cs: CS,
|
|
|
|
r: &G2ProjectiveExtendedGadget<P>,
|
|
|
|
) -> Result<
|
|
|
|
(
|
|
|
|
G2ProjectiveExtendedGadget<P>,
|
|
|
|
AteDoubleCoefficientsGadget<P>,
|
|
|
|
),
|
|
|
|
SynthesisError,
|
|
|
|
> {
|
|
|
|
let a = r.t.square(cs.ns(|| "r.t^2"))?;
|
|
|
|
let b = r.x.square(cs.ns(|| "r.x^2"))?;
|
|
|
|
let c = r.y.square(cs.ns(|| "r.y^2"))?;
|
|
|
|
let d = c.square(cs.ns(|| "c^2"))?;
|
|
|
|
let mut e = r.x.add(cs.ns(|| "r.x + c"), &c)?;
|
|
|
|
e.square_in_place(cs.ns(|| "(r.x + c)^2"))?;
|
|
|
|
e.sub_in_place(cs.ns(|| "(r.x + c)^2 - b"), &b)?;
|
|
|
|
e.sub_in_place(cs.ns(|| "(r.x + c)^2 - b - d"), &d)?;
|
|
|
|
|
|
|
|
let mut f = b.double(cs.ns(|| "b + b"))?;
|
|
|
|
f.add_in_place(cs.ns(|| "b + b + b"), &b)?;
|
|
|
|
let twist_a = a.mul_by_constant(cs.ns(|| "TWIST_COEFF_A * a"), &P::TWIST_COEFF_A)?;
|
|
|
|
f.add_in_place(cs.ns(|| "(b + b + b) + (TWIST_COEFF_A * a)"), &twist_a)?;
|
|
|
|
let g = f.square(cs.ns(|| "f^2"))?;
|
|
|
|
|
|
|
|
let d_eight = d
|
|
|
|
.double(cs.ns(|| "2 * d"))?
|
|
|
|
.double(cs.ns(|| "4 * d"))?
|
|
|
|
.double(cs.ns(|| "8 * d"))?;
|
|
|
|
|
|
|
|
let e2 = e.double(cs.ns(|| "2 * e"))?;
|
|
|
|
let e4 = e2.double(cs.ns(|| "4 * e"))?;
|
|
|
|
let x = g.sub(cs.ns(|| "- (e + e + e + e) + g"), &e4)?;
|
|
|
|
|
|
|
|
let mut y = e2.sub(cs.ns(|| "e + e - x"), &x)?;
|
|
|
|
y.mul_in_place(cs.ns(|| "f * (e + e - x)"), &f)?;
|
|
|
|
y.sub_in_place(cs.ns(|| "- d_eight + f * (e + e - x)"), &d_eight)?;
|
|
|
|
let mut z = r.y.add(cs.ns(|| "r.y + r.z"), &r.z)?;
|
|
|
|
z.square_in_place(cs.ns(|| "(r.y + r.z)^2"))?;
|
|
|
|
z.sub_in_place(cs.ns(|| "(r.y + r.z)^2 - c"), &c)?;
|
|
|
|
let z2 = r.z.square(cs.ns(|| "r.z^2"))?;
|
|
|
|
z.sub_in_place(cs.ns(|| "(r.y + r.z)^2 - c - r.z^2"), &z2)?;
|
|
|
|
let t = z.square(cs.ns(|| "z^2"))?;
|
|
|
|
|
|
|
|
let r2 = G2ProjectiveExtendedGadget { x, y, z, t };
|
|
|
|
|
|
|
|
let c_h =
|
|
|
|
r2.z.add(cs.ns(|| "r2.z + r.t"), &r.t)?
|
|
|
|
.square(cs.ns(|| "(r2.z + r.t)^2"))?
|
|
|
|
.sub(cs.ns(|| "(r2.z + r.t)^2 - r2.t"), &r2.t)?
|
|
|
|
.sub(cs.ns(|| "(r2.z + r.t)^2 - r2.t - a"), &a)?;
|
|
|
|
let c_4c = c.double(cs.ns(|| "2 * c"))?.double(cs.ns(|| "4 * c"))?;
|
|
|
|
let mut c_j = f.add(cs.ns(|| "f + r.t"), &r.t)?;
|
|
|
|
c_j.square_in_place(cs.ns(|| "(f + r.t)^2"))?;
|
|
|
|
c_j.sub_in_place(cs.ns(|| "(f + r.t)^2 - g"), &g)?;
|
|
|
|
c_j.sub_in_place(cs.ns(|| "(f + r.t)^2 - g - a"), &a)?;
|
|
|
|
let mut c_l = f.add(cs.ns(|| "f + r.x"), &r.x)?;
|
|
|
|
c_l.square_in_place(cs.ns(|| "(f + r.x)^2"))?;
|
|
|
|
c_l.sub_in_place(cs.ns(|| "(f + r.x)^2 - g"), &g)?;
|
|
|
|
c_l.sub_in_place(cs.ns(|| "(f + r.x)^2 - g - b"), &b)?;
|
|
|
|
let coeff = AteDoubleCoefficientsGadget {
|
|
|
|
c_h,
|
|
|
|
c_4c,
|
|
|
|
c_j,
|
|
|
|
c_l,
|
|
|
|
pub struct PairingVar<P: MNT6Parameters>(PhantomData<P>);
|
|
|
|
|
|
|
|
type Fp3G<P> = Fp3Var<<P as MNT6Parameters>::Fp3Params>;
|
|
|
|
type Fp6G<P> = Fp6Var<<P as MNT6Parameters>::Fp6Params>;
|
|
|
|
pub type GTVar<P> = Fp6G<P>;
|
|
|
|
|
|
|
|
impl<P: MNT6Parameters> PairingVar<P> {
|
|
|
|
pub(crate) fn doubling_step_for_flipped_miller_loop(
|
|
|
|
r: &G2ProjectiveExtendedVar<P>,
|
|
|
|
) -> Result<(G2ProjectiveExtendedVar<P>, AteDoubleCoefficientsVar<P>), SynthesisError> {
|
|
|
|
let a = r.t.square()?;
|
|
|
|
let b = r.x.square()?;
|
|
|
|
let c = r.y.square()?;
|
|
|
|
let d = c.square()?;
|
|
|
|
let e = (&r.x + &c).square()? - &b - &d;
|
|
|
|
let f = b.double()? + &b + &(&a * P::TWIST_COEFF_A);
|
|
|
|
let g = f.square()?;
|
|
|
|
|
|
|
|
let d_eight = d.double()?.double()?.double()?;
|
|
|
|
|
|
|
|
let e2 = e.double()?;
|
|
|
|
let x = &g - e2.double()?;
|
|
|
|
let y = &f * (e2 - &x) - d_eight;
|
|
|
|
let z = (&r.y + &r.z).square()? - &c - &r.z.square()?;
|
|
|
|
let t = z.square()?;
|
|
|
|
|
|
|
|
let r2 = G2ProjectiveExtendedVar { x, y, z, t };
|
|
|
|
let coeff = AteDoubleCoefficientsVar {
|
|
|
|
c_h: (&r2.z + &r.t).square()? - &r2.t - &a,
|
|
|
|
c_4c: c.double()?.double()?,
|
|
|
|
c_j: (&f + &r.t).square()? - &g - &a,
|
|
|
|
c_l: (&f + &r.x).square()? - &g - &b,
|
|
|
|
};
|
|
|
|
|
|
|
|
Ok((r2, coeff))
|
|
|
|
}
|
|
|
|
|
|
|
|
pub(crate) fn mixed_addition_step_for_flipped_miller_loop<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
mut cs: CS,
|
|
|
|
pub(crate) fn mixed_addition_step_for_flipped_miller_loop(
|
|
|
|
x: &Fp3G<P>,
|
|
|
|
y: &Fp3G<P>,
|
|
|
|
r: &G2ProjectiveExtendedGadget<P>,
|
|
|
|
) -> Result<
|
|
|
|
(
|
|
|
|
G2ProjectiveExtendedGadget<P>,
|
|
|
|
AteAdditionCoefficientsGadget<P>,
|
|
|
|
),
|
|
|
|
SynthesisError,
|
|
|
|
> {
|
|
|
|
let a = y.square(cs.ns(|| "y^2"))?;
|
|
|
|
let b = r.t.mul(cs.ns(|| "r.t * x"), &x)?;
|
|
|
|
let mut d = r.z.add(cs.ns(|| "r.z + y"), &y)?;
|
|
|
|
d.square_in_place(cs.ns(|| "(r.z + y)^2"))?;
|
|
|
|
d.sub_in_place(cs.ns(|| "(r.z + y)^2 - a"), &a)?;
|
|
|
|
d.sub_in_place(cs.ns(|| "(r.z + y)^2 - a - r.t"), &r.t)?;
|
|
|
|
d.mul_in_place(cs.ns(|| "((r.z + y)^2 - a - r.t) * r.t"), &r.t)?;
|
|
|
|
let h = b.sub(cs.ns(|| "b - r.x"), &r.x)?;
|
|
|
|
let i = h.square(cs.ns(|| "h^2"))?;
|
|
|
|
let e = i.double(cs.ns(|| "2 * i"))?.double(cs.ns(|| "4 * i"))?;
|
|
|
|
let j = h.mul(cs.ns(|| "h * e"), &e)?;
|
|
|
|
let v = r.x.mul(cs.ns(|| "r.x * e"), &e)?;
|
|
|
|
let ry2 = r.y.double(cs.ns(|| "r.y + r.y"))?;
|
|
|
|
let l1 = d.sub(cs.ns(|| "d - (r.y + r.y)"), &ry2)?;
|
|
|
|
|
|
|
|
let v2 = v.double(cs.ns(|| "v + v"))?;
|
|
|
|
let x = l1
|
|
|
|
.square(cs.ns(|| "l1^2"))?
|
|
|
|
.sub(cs.ns(|| "l1^2 - j"), &j)?
|
|
|
|
.sub(cs.ns(|| "l1^2 - j - (v + v)"), &v2)?;
|
|
|
|
let v_minus_x = v.sub(cs.ns(|| "v - x"), &x)?;
|
|
|
|
let j_ry2 = j.mul(cs.ns(|| "j * (r.y + r.y)"), &ry2)?;
|
|
|
|
let y = l1
|
|
|
|
.mul(cs.ns(|| "l1 * (v - x)"), &v_minus_x)?
|
|
|
|
.sub(cs.ns(|| "l1 * (v - x) - (j * (r.y + r.y)"), &j_ry2)?;
|
|
|
|
let mut z = r.z.add(cs.ns(|| "r.z + h"), &h)?;
|
|
|
|
z.square_in_place(cs.ns(|| "(r.z + h)^2"))?;
|
|
|
|
z.sub_in_place(cs.ns(|| "(r.z + h)^2 - r.t"), &r.t)?;
|
|
|
|
z.sub_in_place(cs.ns(|| "(r.z + h)^2 - r.t - i"), &i)?;
|
|
|
|
let t = z.square(cs.ns(|| "z^2"))?;
|
|
|
|
|
|
|
|
let r2 = G2ProjectiveExtendedGadget {
|
|
|
|
r: &G2ProjectiveExtendedVar<P>,
|
|
|
|
) -> Result<(G2ProjectiveExtendedVar<P>, AteAdditionCoefficientsVar<P>), SynthesisError> {
|
|
|
|
let a = y.square()?;
|
|
|
|
let b = &r.t * x;
|
|
|
|
let d = ((&r.z + y).square()? - &a - &r.t) * &r.t;
|
|
|
|
let h = &b - &r.x;
|
|
|
|
let i = h.square()?;
|
|
|
|
let e = i.double()?.double()?;
|
|
|
|
let j = &h * &e;
|
|
|
|
let v = &r.x * &e;
|
|
|
|
let ry2 = r.y.double()?;
|
|
|
|
let l1 = &d - &ry2;
|
|
|
|
|
|
|
|
let x = l1.square()? - &j - &v.double()?;
|
|
|
|
let y = &l1 * &(&v - &x) - &j * ry2;
|
|
|
|
let z = (&r.z + &h).square()? - &r.t - &i;
|
|
|
|
let t = z.square()?;
|
|
|
|
|
|
|
|
let r2 = G2ProjectiveExtendedVar {
|
|
|
|
x,
|
|
|
|
y,
|
|
|
|
z: z.clone(),
|
|
|
|
t,
|
|
|
|
};
|
|
|
|
let coeff = AteAdditionCoefficientsGadget { c_l1: l1, c_rz: z };
|
|
|
|
let coeff = AteAdditionCoefficientsVar { c_l1: l1, c_rz: z };
|
|
|
|
|
|
|
|
Ok((r2, coeff))
|
|
|
|
}
|
|
|
|
|
|
|
|
pub fn ate_miller_loop<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
mut cs: CS,
|
|
|
|
p: &G1PreparedGadget<P>,
|
|
|
|
q: &G2PreparedGadget<P>,
|
|
|
|
pub fn ate_miller_loop(
|
|
|
|
p: &G1PreparedVar<P>,
|
|
|
|
q: &G2PreparedVar<P>,
|
|
|
|
) -> Result<Fp6G<P>, SynthesisError> {
|
|
|
|
let zero = FpGadget::<P::Fp>::zero(cs.ns(|| "zero"))?;
|
|
|
|
let mut l1_coeff = Fp3G::<P>::new(p.x.clone(), zero.clone(), zero);
|
|
|
|
l1_coeff.sub_in_place(cs.ns(|| "l1_coeff"), &q.x_over_twist)?;
|
|
|
|
let zero = FpVar::<P::Fp>::zero();
|
|
|
|
let l1_coeff = Fp3Var::new(p.x.clone(), zero.clone(), zero) - &q.x_over_twist;
|
|
|
|
|
|
|
|
let mut f = Fp6G::<P>::one(cs.ns(|| "one"))?;
|
|
|
|
let mut f = Fp6G::<P>::one();
|
|
|
|
|
|
|
|
let mut dbl_idx: usize = 0;
|
|
|
|
let mut add_idx: usize = 0;
|
|
|
|
|
|
|
|
let mut found_one = false;
|
|
|
|
|
|
|
|
for (j, bit) in BitIterator::new(P::ATE_LOOP_COUNT).enumerate() {
|
|
|
|
for bit in BitIterator::new(P::ATE_LOOP_COUNT) {
|
|
|
|
// code below gets executed for all bits (EXCEPT the MSB itself) of
|
|
|
|
// mnt6_param_p (skipping leading zeros) in MSB to LSB order
|
|
|
|
if !found_one && bit {
|
|
|
|
@ -172,173 +108,109 @@ impl PairingGadget { |
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
let mut cs = cs.ns(|| format!("bit {}", j));
|
|
|
|
|
|
|
|
let dc = &q.double_coefficients[dbl_idx];
|
|
|
|
dbl_idx += 1;
|
|
|
|
|
|
|
|
let c_j_x_twist = dc.c_j.mul(cs.ns(|| "dc.c_j * p.x_twist"), &p.x_twist)?;
|
|
|
|
let c0 = dc.c_l.sub(cs.ns(|| "-dc.c_4c + dc.c_l"), &dc.c_4c)?.sub(
|
|
|
|
cs.ns(|| "-dc.c_4c - (dc.c_j * p.x_twist) + dc.c_l"),
|
|
|
|
&c_j_x_twist,
|
|
|
|
)?;
|
|
|
|
let c1 = dc.c_h.mul(cs.ns(|| "dc.c_h * p.y_twist"), &p.y_twist)?;
|
|
|
|
let g_rr_at_p = Fp6G::<P>::new(c0, c1);
|
|
|
|
let g_rr_at_p = Fp6Var::new(
|
|
|
|
&dc.c_l - &dc.c_4c - &dc.c_j * &p.x_twist,
|
|
|
|
&dc.c_h * &p.y_twist,
|
|
|
|
);
|
|
|
|
|
|
|
|
f = f
|
|
|
|
.square(cs.ns(|| "f^2"))?
|
|
|
|
.mul(cs.ns(|| "f^2 * g_rr_at_p"), &g_rr_at_p)?;
|
|
|
|
f = f.square()? * &g_rr_at_p;
|
|
|
|
|
|
|
|
if bit {
|
|
|
|
let ac = &q.addition_coefficients[add_idx];
|
|
|
|
add_idx += 1;
|
|
|
|
|
|
|
|
let l1_coeff_c_l1 = l1_coeff.mul(cs.ns(|| "l1_coeff * ac.c_l1"), &ac.c_l1)?;
|
|
|
|
let g_rq_at_p = Fp6G::<P>::new(
|
|
|
|
ac.c_rz.mul(cs.ns(|| "ac.c_rz * p.y_twist"), &p.y_twist)?,
|
|
|
|
q.y_over_twist
|
|
|
|
.mul(cs.ns(|| "q.y_over_twist * ac.c_rz"), &ac.c_rz)?
|
|
|
|
.add(
|
|
|
|
cs.ns(|| "q.y_over_twist * ac.c_rz + (l1_coeff * ac.c_l1)"),
|
|
|
|
&l1_coeff_c_l1,
|
|
|
|
)?
|
|
|
|
.negate(cs.ns(|| "-(q.y_over_twist * ac.c_rz + (l1_coeff * ac.c_l1))"))?,
|
|
|
|
let g_rq_at_p = Fp6Var::new(
|
|
|
|
&ac.c_rz * &p.y_twist,
|
|
|
|
(&q.y_over_twist * &ac.c_rz + &(&l1_coeff * &ac.c_l1)).negate()?,
|
|
|
|
);
|
|
|
|
f.mul_in_place(cs.ns(|| "f *= g_rq_at_p"), &g_rq_at_p)?;
|
|
|
|
f *= &g_rq_at_p;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if P::ATE_IS_LOOP_COUNT_NEG {
|
|
|
|
let ac = &q.addition_coefficients[add_idx];
|
|
|
|
|
|
|
|
let l1_coeff_c_l1 = l1_coeff.mul(cs.ns(|| "l1_coeff * ac.c_l1"), &ac.c_l1)?;
|
|
|
|
let g_rnegr_at_p = Fp6G::<P>::new(
|
|
|
|
ac.c_rz.mul(cs.ns(|| "ac.c_rz * p.y_twist"), &p.y_twist)?,
|
|
|
|
q.y_over_twist
|
|
|
|
.mul(cs.ns(|| "q.y_over_twist * ac.c_rz"), &ac.c_rz)?
|
|
|
|
.add(
|
|
|
|
cs.ns(|| "q.y_over_twist * ac.c_rz + (l1_coeff * ac.c_l1)"),
|
|
|
|
&l1_coeff_c_l1,
|
|
|
|
)?
|
|
|
|
.negate(cs.ns(|| "-(q.y_over_twist * ac.c_rz + (l1_coeff * ac.c_l1))"))?,
|
|
|
|
let g_rnegr_at_p = Fp6Var::new(
|
|
|
|
&ac.c_rz * &p.y_twist,
|
|
|
|
(&q.y_over_twist * &ac.c_rz + &(l1_coeff * &ac.c_l1)).negate()?,
|
|
|
|
);
|
|
|
|
f = f
|
|
|
|
.mul(cs.ns(|| "f * g_rnegr_at_p"), &g_rnegr_at_p)?
|
|
|
|
.inverse(cs.ns(|| "inverse f"))?;
|
|
|
|
f = (f * &g_rnegr_at_p).inverse()?;
|
|
|
|
}
|
|
|
|
|
|
|
|
Ok(f)
|
|
|
|
}
|
|
|
|
|
|
|
|
pub fn final_exponentiation<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
mut cs: CS,
|
|
|
|
value: &Fp6G<P>,
|
|
|
|
) -> Result<GTGadget<P>, SynthesisError> {
|
|
|
|
let value_inv = value.inverse(cs.ns(|| "value inverse"))?;
|
|
|
|
let value_to_first_chunk = Self::final_exponentiation_first_chunk(
|
|
|
|
cs.ns(|| "value_to_first_chunk"),
|
|
|
|
value,
|
|
|
|
&value_inv,
|
|
|
|
)?;
|
|
|
|
let value_inv_to_first_chunk = Self::final_exponentiation_first_chunk(
|
|
|
|
cs.ns(|| "value_inv_to_first_chunk"),
|
|
|
|
&value_inv,
|
|
|
|
value,
|
|
|
|
)?;
|
|
|
|
Self::final_exponentiation_last_chunk(
|
|
|
|
cs.ns(|| "final_exp_last_chunk"),
|
|
|
|
&value_to_first_chunk,
|
|
|
|
&value_inv_to_first_chunk,
|
|
|
|
)
|
|
|
|
pub fn final_exponentiation(value: &Fp6G<P>) -> Result<GTVar<P>, SynthesisError> {
|
|
|
|
let value_inv = value.inverse()?;
|
|
|
|
let value_to_first_chunk = Self::final_exponentiation_first_chunk(value, &value_inv)?;
|
|
|
|
let value_inv_to_first_chunk = Self::final_exponentiation_first_chunk(&value_inv, value)?;
|
|
|
|
Self::final_exponentiation_last_chunk(&value_to_first_chunk, &value_inv_to_first_chunk)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn final_exponentiation_first_chunk<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
mut cs: CS,
|
|
|
|
fn final_exponentiation_first_chunk(
|
|
|
|
elt: &Fp6G<P>,
|
|
|
|
elt_inv: &Fp6G<P>,
|
|
|
|
) -> Result<Fp6G<P>, SynthesisError> {
|
|
|
|
// (q^3-1)*(q+1)
|
|
|
|
|
|
|
|
// elt_q3 = elt^(q^3)
|
|
|
|
let mut elt_q3 = elt.clone();
|
|
|
|
elt_q3.frobenius_map_in_place(cs.ns(|| "frobenius 3"), 3)?;
|
|
|
|
let elt_q3 = elt.unitary_inverse()?;
|
|
|
|
// elt_q3_over_elt = elt^(q^3-1)
|
|
|
|
let elt_q3_over_elt = elt_q3.mul(cs.ns(|| "elt_q3 * elt_inv"), elt_inv)?;
|
|
|
|
let elt_q3_over_elt = elt_q3 * elt_inv;
|
|
|
|
// alpha = elt^((q^3-1) * q)
|
|
|
|
let mut alpha = elt_q3_over_elt.clone();
|
|
|
|
alpha.frobenius_map_in_place(cs.ns(|| "frobenius 1"), 1)?;
|
|
|
|
let alpha = elt_q3_over_elt.frobenius_map(1)?;
|
|
|
|
// beta = elt^((q^3-1)*(q+1)
|
|
|
|
alpha.mul(cs.ns(|| "alpha * elt_q3_over_elt"), &elt_q3_over_elt)
|
|
|
|
Ok(alpha * &elt_q3_over_elt)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn final_exponentiation_last_chunk<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
mut cs: CS,
|
|
|
|
fn final_exponentiation_last_chunk(
|
|
|
|
elt: &Fp6G<P>,
|
|
|
|
elt_inv: &Fp6G<P>,
|
|
|
|
) -> Result<Fp6G<P>, SynthesisError> {
|
|
|
|
let elt_clone = elt.clone();
|
|
|
|
let elt_inv_clone = elt_inv.clone();
|
|
|
|
|
|
|
|
let mut elt_q = elt.clone();
|
|
|
|
elt_q.frobenius_map_in_place(cs.ns(|| "frobenius 1"), 1)?;
|
|
|
|
let elt_q = elt.frobenius_map(1)?;
|
|
|
|
|
|
|
|
let w1_part = elt_q.cyclotomic_exp(cs.ns(|| "w1_part"), &P::FINAL_EXPONENT_LAST_CHUNK_1)?;
|
|
|
|
let w0_part;
|
|
|
|
if P::FINAL_EXPONENT_LAST_CHUNK_W0_IS_NEG {
|
|
|
|
w0_part = elt_inv_clone
|
|
|
|
.cyclotomic_exp(cs.ns(|| "w0_part"), &P::FINAL_EXPONENT_LAST_CHUNK_ABS_OF_W0)?;
|
|
|
|
let w1_part = elt_q.cyclotomic_exp(&P::FINAL_EXPONENT_LAST_CHUNK_1)?;
|
|
|
|
let w0_part = if P::FINAL_EXPONENT_LAST_CHUNK_W0_IS_NEG {
|
|
|
|
elt_inv.cyclotomic_exp(&P::FINAL_EXPONENT_LAST_CHUNK_ABS_OF_W0)?
|
|
|
|
} else {
|
|
|
|
w0_part = elt_clone
|
|
|
|
.cyclotomic_exp(cs.ns(|| "w0_part"), &P::FINAL_EXPONENT_LAST_CHUNK_ABS_OF_W0)?;
|
|
|
|
}
|
|
|
|
elt.cyclotomic_exp(&P::FINAL_EXPONENT_LAST_CHUNK_ABS_OF_W0)?
|
|
|
|
};
|
|
|
|
|
|
|
|
w1_part.mul(cs.ns(|| "w1_part * w0_part"), &w0_part)
|
|
|
|
Ok(w1_part * &w0_part)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl<P: MNT6Parameters> PG<MNT6<P>, P::Fp> for PairingGadget<P> {
|
|
|
|
type G1Gadget = G1Gadget<P>;
|
|
|
|
type G2Gadget = G2Gadget<P>;
|
|
|
|
type G1PreparedGadget = G1PreparedGadget<P>;
|
|
|
|
type G2PreparedGadget = G2PreparedGadget<P>;
|
|
|
|
type GTGadget = GTGadget<P>;
|
|
|
|
|
|
|
|
fn miller_loop<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
mut cs: CS,
|
|
|
|
ps: &[Self::G1PreparedGadget],
|
|
|
|
qs: &[Self::G2PreparedGadget],
|
|
|
|
) -> Result<Self::GTGadget, SynthesisError> {
|
|
|
|
let mut result = Fp6G::<P>::one(cs.ns(|| "one"))?;
|
|
|
|
for (i, (p, q)) in ps.iter().zip(qs.iter()).enumerate() {
|
|
|
|
let miller =
|
|
|
|
Self::ate_miller_loop(cs.ns(|| format!("ate miller loop iteration {}", i)), p, q)?;
|
|
|
|
result.mul_in_place(
|
|
|
|
cs.ns(|| format!("mul ate miller loop iteration {}", i)),
|
|
|
|
&miller,
|
|
|
|
)?;
|
|
|
|
impl<P: MNT6Parameters> PG<MNT6<P>, P::Fp> for PairingVar<P> {
|
|
|
|
type G1Var = G1Var<P>;
|
|
|
|
type G2Var = G2Var<P>;
|
|
|
|
type G1PreparedVar = G1PreparedVar<P>;
|
|
|
|
type G2PreparedVar = G2PreparedVar<P>;
|
|
|
|
type GTVar = GTVar<P>;
|
|
|
|
|
|
|
|
fn miller_loop(
|
|
|
|
ps: &[Self::G1PreparedVar],
|
|
|
|
qs: &[Self::G2PreparedVar],
|
|
|
|
) -> Result<Self::GTVar, SynthesisError> {
|
|
|
|
let mut result = Fp6G::<P>::one();
|
|
|
|
for (p, q) in ps.iter().zip(qs) {
|
|
|
|
result *= Self::ate_miller_loop(p, q)?;
|
|
|
|
}
|
|
|
|
|
|
|
|
Ok(result)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn final_exponentiation<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
cs: CS,
|
|
|
|
r: &Self::GTGadget,
|
|
|
|
) -> Result<Self::GTGadget, SynthesisError> {
|
|
|
|
Self::final_exponentiation(cs, r)
|
|
|
|
fn final_exponentiation(r: &Self::GTVar) -> Result<Self::GTVar, SynthesisError> {
|
|
|
|
Self::final_exponentiation(r)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn prepare_g1<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
cs: CS,
|
|
|
|
p: &Self::G1Gadget,
|
|
|
|
) -> Result<Self::G1PreparedGadget, SynthesisError> {
|
|
|
|
Self::G1PreparedGadget::from_affine(cs, p)
|
|
|
|
fn prepare_g1(p: &Self::G1Var) -> Result<Self::G1PreparedVar, SynthesisError> {
|
|
|
|
Self::G1PreparedVar::from_group_var(p)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn prepare_g2<CS: ConstraintSystem<P::Fp>>(
|
|
|
|
cs: CS,
|
|
|
|
q: &Self::G2Gadget,
|
|
|
|
) -> Result<Self::G2PreparedGadget, SynthesisError> {
|
|
|
|
Self::G2PreparedGadget::from_affine(cs, q)
|
|
|
|
fn prepare_g2(q: &Self::G2Var) -> Result<Self::G2PreparedVar, SynthesisError> {
|
|
|
|
Self::G2PreparedVar::from_group_var(q)
|
|
|
|
}
|
|
|
|
}
|
Pratyush Mishra
4 years ago