Update field variables in `r1cs-std`

r1cs-std/src/fields/cubic_extension.rs

@@ -0,0 +1,521 @@
+use algebra::{
+    fields::{CubicExtField, CubicExtParameters, Field},
+    One,
+};
+use core::{borrow::Borrow, marker::PhantomData};
+use r1cs_core::{ConstraintSystemRef, Namespace, SynthesisError};
+
+use crate::{
+    fields::{FieldOpsBounds, FieldVar},
+    prelude::*,
+    Assignment, Vec,
+};
+
+#[derive(Derivative)]
+#[derivative(Debug(bound = "BF: core::fmt::Debug"), Clone(bound = "BF: Clone"))]
+#[must_use]
+pub struct CubicExtVar<BF: FieldVar<P::BaseField, P::BasePrimeField>, P: CubicExtVarParams<BF>>
+where
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+{
+    pub c0: BF,
+    pub c1: BF,
+    pub c2: BF,
+    #[derivative(Debug = "ignore")]
+    _params: PhantomData<P>,
+}
+
+pub trait CubicExtVarParams<BF: FieldVar<Self::BaseField, Self::BasePrimeField>>:
+    CubicExtParameters
+where
+    for<'a> &'a BF: FieldOpsBounds<'a, Self::BaseField, BF>,
+{
+    fn mul_base_field_vars_by_frob_coeff(c1: &mut BF, c2: &mut BF, power: usize);
+}
+
+impl<BF: FieldVar<P::BaseField, P::BasePrimeField>, P: CubicExtVarParams<BF>> CubicExtVar<BF, P>
+where
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+{
+    #[inline]
+    pub fn new(c0: BF, c1: BF, c2: BF) -> Self {
+        let _params = PhantomData;
+        Self {
+            c0,
+            c1,
+            c2,
+            _params,
+        }
+    }
+
+    /// Multiply a BF by cubic nonresidue P::NONRESIDUE.
+    #[inline]
+    pub fn mul_base_field_by_nonresidue(fe: &BF) -> Result<BF, SynthesisError> {
+        Ok(fe * P::NONRESIDUE)
+    }
+
+    /// Multiply a CubicExtVar by an element of `P::BaseField`.
+    #[inline]
+    pub fn mul_by_base_field_constant(&self, fe: P::BaseField) -> Self {
+        let c0 = &self.c0 * fe;
+        let c1 = &self.c1 * fe;
+        let c2 = &self.c2 * fe;
+        Self::new(c0, c1, c2)
+    }
+
+    #[inline]
+    pub fn mul_assign_by_base_field_constant(&mut self, fe: P::BaseField) {
+        *self = (&*self).mul_by_base_field_constant(fe);
+    }
+}
+
+impl<BF, P> R1CSVar<P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    type Value = CubicExtField<P>;
+
+    fn cs(&self) -> Option<ConstraintSystemRef<P::BasePrimeField>> {
+        [&self.c0, &self.c1, &self.c2].cs()
+    }
+
+    #[inline]
+    fn value(&self) -> Result<Self::Value, SynthesisError> {
+        match (self.c0.value(), self.c1.value(), self.c2.value()) {
+            (Ok(c0), Ok(c1), Ok(c2)) => Ok(CubicExtField::new(c0, c1, c2)),
+            (..) => Err(SynthesisError::AssignmentMissing),
+        }
+    }
+}
+
+impl<BF, P> From<Boolean<P::BasePrimeField>> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    fn from(other: Boolean<P::BasePrimeField>) -> Self {
+        let c0 = BF::from(other);
+        let c1 = BF::zero();
+        let c2 = BF::zero();
+        Self::new(c0, c1, c2)
+    }
+}
+
+impl<'a, BF, P> FieldOpsBounds<'a, CubicExtField<P>, CubicExtVar<BF, P>> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+}
+impl<'a, BF, P> FieldOpsBounds<'a, CubicExtField<P>, CubicExtVar<BF, P>> for &'a CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+}
+
+impl<BF, P> FieldVar<CubicExtField<P>, P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    fn constant(other: CubicExtField<P>) -> Self {
+        let c0 = BF::constant(other.c0);
+        let c1 = BF::constant(other.c1);
+        let c2 = BF::constant(other.c2);
+        Self::new(c0, c1, c2)
+    }
+
+    fn zero() -> Self {
+        let c0 = BF::zero();
+        let c1 = BF::zero();
+        let c2 = BF::zero();
+        Self::new(c0, c1, c2)
+    }
+
+    fn one() -> Self {
+        let c0 = BF::one();
+        let c1 = BF::zero();
+        let c2 = BF::zero();
+        Self::new(c0, c1, c2)
+    }
+
+    #[inline]
+    fn double(&self) -> Result<Self, SynthesisError> {
+        let c0 = self.c0.double()?;
+        let c1 = self.c1.double()?;
+        let c2 = self.c2.double()?;
+        Ok(Self::new(c0, c1, c2))
+    }
+
+    #[inline]
+    fn negate(&self) -> Result<Self, SynthesisError> {
+        let mut result = self.clone();
+        result.c0.negate_in_place()?;
+        result.c1.negate_in_place()?;
+        result.c2.negate_in_place()?;
+        Ok(result)
+    }
+
+    /// Use the Chung-Hasan asymmetric squaring formula.
+    ///
+    /// (Devegili OhEig Scott Dahab --- Multiplication and Squaring on
+    /// Abstract Pairing-Friendly
+    /// Fields.pdf; Section 4 (CH-SQR2))
+    #[inline]
+    fn square(&self) -> Result<Self, SynthesisError> {
+        let a = self.c0.clone();
+        let b = self.c1.clone();
+        let c = self.c2.clone();
+
+        let s0 = a.square()?;
+        let ab = &a * &b;
+        let s1 = ab.double()?;
+        let s2 = (&a - &b + &c).square()?;
+        let s3 = (&b * &c).double()?;
+        let s4 = c.square()?;
+
+        let c0 = Self::mul_base_field_by_nonresidue(&s3)? + &s0;
+        let c1 = Self::mul_base_field_by_nonresidue(&s4)? + &s1;
+        let c2 = s1 + &s2 + &s3 - &s0 - &s4;
+
+        Ok(Self::new(c0, c1, c2))
+    }
+
+    fn mul_equals(&self, other: &Self, result: &Self) -> Result<(), SynthesisError> {
+        // Karatsuba multiplication for cubic extensions:
+        //     v0 = A.c0 * B.c0
+        //     v1 = A.c1 * B.c1
+        //     v2 = A.c2 * B.c2
+        //     result.c0 = v0 + β((a1 + a2)(b1 + b2) − v1 − v2)
+        //     result.c1 = (a0 + a1)(b0 + b1) − v0 − v1 + βv2
+        //     result.c2 = (a0 + a2)(b0 + b2) − v0 + v1 − v2,
+        // We enforce this with six constraints:
+        //
+        //     v0 = A.c0 * B.c0
+        //     v1 = A.c1 * B.c1
+        //     v2 = A.c2 * B.c2
+        //
+        //     result.c0 - v0 + \beta*(v1 + v2) = β(a1 + a2)(b1 + b2))
+        //     result.c1 + v0 + v1 - βv2        = (a0 + a1)(b0 + b1)
+        //     result.c2 + v0 - v1 + v2         = (a0 + a2)(b0 + b2)
+        // Reference:
+        // "Multiplication and Squaring on Pairing-Friendly Fields"
+        // Devegili, OhEigeartaigh, Scott, Dahab
+        //
+        // This implementation adapted from
+        // https://github.com/ZencashOfficial/ginger-lib/blob/development/r1cs/gadgets/std/src/fields/fp3.rs
+        let v0 = &self.c0 * &other.c0;
+        let v1 = &self.c1 * &other.c1;
+        let v2 = &self.c2 * &other.c2;
+
+        // Check c0
+        let nr_a1_plus_a2 = (&self.c1 + &self.c2) * P::NONRESIDUE;
+        let b1_plus_b2 = &other.c1 + &other.c2;
+        let nr_v1 = &v1 * P::NONRESIDUE;
+        let nr_v2 = &v2 * P::NONRESIDUE;
+        let to_check = &result.c0 - &v0 + &nr_v1 + &nr_v2;
+        nr_a1_plus_a2.mul_equals(&b1_plus_b2, &to_check)?;
+
+        // Check c1
+        let a0_plus_a1 = &self.c0 + &self.c1;
+        let b0_plus_b1 = &other.c0 + &other.c1;
+        let to_check = &result.c1 - &nr_v2 + &v0 + &v1;
+        a0_plus_a1.mul_equals(&b0_plus_b1, &to_check)?;
+
+        // Check c2
+        let a0_plus_a2 = &self.c0 + &self.c2;
+        let b0_plus_b2 = &other.c0 + &other.c2;
+        let to_check = &result.c2 + &v0 - &v1 + &v2;
+        a0_plus_a2.mul_equals(&b0_plus_b2, &to_check)?;
+        Ok(())
+    }
+
+    fn frobenius_map(&self, power: usize) -> Result<Self, SynthesisError> {
+        let mut result = self.clone();
+        result.c0.frobenius_map_in_place(power)?;
+        result.c1.frobenius_map_in_place(power)?;
+        result.c2.frobenius_map_in_place(power)?;
+
+        P::mul_base_field_vars_by_frob_coeff(&mut result.c1, &mut result.c2, power);
+        Ok(result)
+    }
+
+    fn inverse(&self) -> Result<Self, SynthesisError> {
+        let cs = self.cs().get()?.clone();
+        let one = Self::new_constant(cs.clone(), CubicExtField::one())?;
+        let inverse = Self::new_witness(cs, || self.value().and_then(|v| v.inverse().get()))?;
+        self.mul_equals(&inverse, &one)?;
+        Ok(inverse)
+    }
+}
+
+impl_bounded_ops!(
+    CubicExtVar<BF, P>,
+    CubicExtField<P>,
+    Add,
+    add,
+    AddAssign,
+    add_assign,
+    |this: &'a CubicExtVar<BF, P>, other: &'a CubicExtVar<BF, P>| {
+        let c0 = &this.c0 + &other.c0;
+        let c1 = &this.c1 + &other.c1;
+        let c2 = &this.c2 + &other.c2;
+        CubicExtVar::new(c0, c1, c2)
+    },
+    |this: &'a CubicExtVar<BF, P>, other: CubicExtField<P>| {
+        this + CubicExtVar::constant(other)
+    },
+    (BF: FieldVar<P::BaseField, P::BasePrimeField>, P: CubicExtVarParams<BF>),
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+);
+impl_bounded_ops!(
+    CubicExtVar<BF, P>,
+    CubicExtField<P>,
+    Sub,
+    sub,
+    SubAssign,
+    sub_assign,
+    |this: &'a CubicExtVar<BF, P>, other: &'a CubicExtVar<BF, P>| {
+        let c0 = &this.c0 - &other.c0;
+        let c1 = &this.c1 - &other.c1;
+        let c2 = &this.c2 - &other.c2;
+        CubicExtVar::new(c0, c1, c2)
+    },
+    |this: &'a CubicExtVar<BF, P>, other: CubicExtField<P>| {
+        this - CubicExtVar::constant(other)
+    },
+    (BF: FieldVar<P::BaseField, P::BasePrimeField>, P: CubicExtVarParams<BF>),
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+);
+impl_bounded_ops!(
+    CubicExtVar<BF, P>,
+    CubicExtField<P>,
+    Mul,
+    mul,
+    MulAssign,
+    mul_assign,
+    |this: &'a CubicExtVar<BF, P>, other: &'a CubicExtVar<BF, P>| {
+        // Karatsuba multiplication for cubic extensions:
+        //     v0 = A.c0 * B.c0
+        //     v1 = A.c1 * B.c1
+        //     v2 = A.c2 * B.c2
+        //     result.c0 = v0 + β((a1 + a2)(b1 + b2) − v1 − v2)
+        //     result.c1 = (a0 + a1)(b0 + b1) − v0 − v1 + βv2
+        //     result.c2 = (a0 + a2)(b0 + b2) − v0 + v1 − v2,
+        //
+        // Reference:
+        // "Multiplication and Squaring on Pairing-Friendly Fields"
+        // Devegili, OhEigeartaigh, Scott, Dahab
+        let v0 = &this.c0 * &other.c0;
+        let v1 = &this.c1 * &other.c1;
+        let v2 = &this.c2 * &other.c2;
+        let c0 =
+            (((&this.c1 + &this.c2) * (&other.c1 + &other.c2) - &v1 - &v2) * P::NONRESIDUE) + &v0 ;
+        let c1 =
+            (&this.c0 + &this.c1) * (&other.c0 + &other.c1) - &v0 - &v1 + (&v2 * P::NONRESIDUE);
+        let c2 =
+            (&this.c0 + &this.c2) * (&other.c0 + &other.c2) - &v0 + &v1 - &v2;
+
+        CubicExtVar::new(c0, c1, c2)
+    },
+    |this: &'a CubicExtVar<BF, P>, other: CubicExtField<P>| {
+        this * CubicExtVar::constant(other)
+    },
+    (BF: FieldVar<P::BaseField, P::BasePrimeField>, P: CubicExtVarParams<BF>),
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+);
+
+impl<BF, P> EqGadget<P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    fn is_eq(&self, other: &Self) -> Result<Boolean<P::BasePrimeField>, SynthesisError> {
+        let b0 = self.c0.is_eq(&other.c0)?;
+        let b1 = self.c1.is_eq(&other.c1)?;
+        let b2 = self.c2.is_eq(&other.c2)?;
+        b0.and(&b1)?.and(&b2)
+    }
+
+    #[inline]
+    fn conditional_enforce_equal(
+        &self,
+        other: &Self,
+        condition: &Boolean<P::BasePrimeField>,
+    ) -> Result<(), SynthesisError> {
+        self.c0.conditional_enforce_equal(&other.c0, condition)?;
+        self.c1.conditional_enforce_equal(&other.c1, condition)?;
+        self.c2.conditional_enforce_equal(&other.c2, condition)?;
+        Ok(())
+    }
+
+    #[inline]
+    fn conditional_enforce_not_equal(
+        &self,
+        other: &Self,
+        condition: &Boolean<P::BasePrimeField>,
+    ) -> Result<(), SynthesisError> {
+        let is_equal = self.is_eq(other)?;
+        is_equal
+            .and(condition)?
+            .enforce_equal(&Boolean::Constant(false))
+    }
+}
+
+impl<BF, P> ToBitsGadget<P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    fn to_bits(&self) -> Result<Vec<Boolean<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_bits()?;
+        let mut c1 = self.c1.to_bits()?;
+        let mut c2 = self.c2.to_bits()?;
+        c0.append(&mut c1);
+        c0.append(&mut c2);
+        Ok(c0)
+    }
+
+    fn to_non_unique_bits(&self) -> Result<Vec<Boolean<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_non_unique_bits()?;
+        let mut c1 = self.c1.to_non_unique_bits()?;
+        let mut c2 = self.c2.to_non_unique_bits()?;
+        c0.append(&mut c1);
+        c0.append(&mut c2);
+        Ok(c0)
+    }
+}
+
+impl<BF, P> ToBytesGadget<P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    fn to_bytes(&self) -> Result<Vec<UInt8<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_bytes()?;
+        let mut c1 = self.c1.to_bytes()?;
+        let mut c2 = self.c2.to_bytes()?;
+        c0.append(&mut c1);
+        c0.append(&mut c2);
+
+        Ok(c0)
+    }
+
+    fn to_non_unique_bytes(&self) -> Result<Vec<UInt8<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_non_unique_bytes()?;
+        let mut c1 = self.c1.to_non_unique_bytes()?;
+        let mut c2 = self.c2.to_non_unique_bytes()?;
+
+        c0.append(&mut c1);
+        c0.append(&mut c2);
+
+        Ok(c0)
+    }
+}
+
+impl<BF, P> CondSelectGadget<P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    #[inline]
+    fn conditionally_select(
+        cond: &Boolean<P::BasePrimeField>,
+        true_value: &Self,
+        false_value: &Self,
+    ) -> Result<Self, SynthesisError> {
+        let c0 = BF::conditionally_select(cond, &true_value.c0, &false_value.c0)?;
+        let c1 = BF::conditionally_select(cond, &true_value.c1, &false_value.c1)?;
+        let c2 = BF::conditionally_select(cond, &true_value.c2, &false_value.c2)?;
+        Ok(Self::new(c0, c1, c2))
+    }
+}
+
+impl<BF, P> TwoBitLookupGadget<P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>
+        + TwoBitLookupGadget<P::BasePrimeField, TableConstant = P::BaseField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    type TableConstant = CubicExtField<P>;
+
+    fn two_bit_lookup(
+        b: &[Boolean<P::BasePrimeField>],
+        c: &[Self::TableConstant],
+    ) -> Result<Self, SynthesisError> {
+        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
+        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
+        let c2s = c.iter().map(|f| f.c2).collect::<Vec<_>>();
+        let c0 = BF::two_bit_lookup(b, &c0s)?;
+        let c1 = BF::two_bit_lookup(b, &c1s)?;
+        let c2 = BF::two_bit_lookup(b, &c2s)?;
+        Ok(Self::new(c0, c1, c2))
+    }
+}
+
+impl<BF, P> ThreeBitCondNegLookupGadget<P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>
+        + ThreeBitCondNegLookupGadget<P::BasePrimeField, TableConstant = P::BaseField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    type TableConstant = CubicExtField<P>;
+
+    fn three_bit_cond_neg_lookup(
+        b: &[Boolean<P::BasePrimeField>],
+        b0b1: &Boolean<P::BasePrimeField>,
+        c: &[Self::TableConstant],
+    ) -> Result<Self, SynthesisError> {
+        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
+        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
+        let c2s = c.iter().map(|f| f.c2).collect::<Vec<_>>();
+        let c0 = BF::three_bit_cond_neg_lookup(b, b0b1, &c0s)?;
+        let c1 = BF::three_bit_cond_neg_lookup(b, b0b1, &c1s)?;
+        let c2 = BF::three_bit_cond_neg_lookup(b, b0b1, &c2s)?;
+        Ok(Self::new(c0, c1, c2))
+    }
+}
+
+impl<BF, P> AllocVar<CubicExtField<P>, P::BasePrimeField> for CubicExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: CubicExtVarParams<BF>,
+{
+    fn new_variable<T: Borrow<CubicExtField<P>>>(
+        cs: impl Into<Namespace<P::BasePrimeField>>,
+        f: impl FnOnce() -> Result<T, SynthesisError>,
+        mode: AllocationMode,
+    ) -> Result<Self, SynthesisError> {
+        let ns = cs.into();
+        let cs = ns.cs();
+
+        use SynthesisError::*;
+        let (c0, c1, c2) = match f() {
+            Ok(fe) => (Ok(fe.borrow().c0), Ok(fe.borrow().c1), Ok(fe.borrow().c2)),
+            Err(_) => (
+                Err(AssignmentMissing),
+                Err(AssignmentMissing),
+                Err(AssignmentMissing),
+            ),
+        };
+
+        let c0 = BF::new_variable(cs.ns("c0"), || c0, mode)?;
+        let c1 = BF::new_variable(cs.ns("c1"), || c1, mode)?;
+        let c2 = BF::new_variable(cs.ns("c2"), || c2, mode)?;
+        Ok(Self::new(c0, c1, c2))
+    }
+}

r1cs-std/src/fields/fp/cmp.rs

@@ -1,127 +1,89 @@
 use crate::{
     boolean::Boolean,
-    fields::{fp::FpGadget, FieldGadget},
+    fields::{fp::FpVar, FieldVar},
+    prelude::*,
     ToBitsGadget,
 };
 use algebra::PrimeField;
 use core::cmp::Ordering;
-use r1cs_core::{ConstraintSystem, SynthesisError};
+use r1cs_core::{lc, SynthesisError, Variable};
 
-impl<F: PrimeField> FpGadget<F> {
-    /// This function enforces the ordering between `self` and `b`. The
+impl<F: PrimeField> FpVar<F> {
+    /// This function enforces the ordering between `self` and `other`. The
     /// constraint system will not be satisfied otherwise. If `self` should
-    /// also be checked for equality, e.g. `a <= b` instead of `a < b`, set
-    /// `should_also_check_quality` to `true`. This variant verifies `a` and `b`
+    /// also be checked for equality, e.g. `self <= other` instead of `self < other`, set
+    /// `should_also_check_quality` to `true`. This variant verifies `self` and `other`
     /// are `<= (p-1)/2`.
-    pub fn enforce_cmp<CS: ConstraintSystem<F>>(
+    pub fn enforce_cmp(
         &self,
-        mut cs: CS,
-        b: &FpGadget<F>,
+        other: &FpVar<F>,
         ordering: Ordering,
         should_also_check_equality: bool,
     ) -> Result<(), SynthesisError> {
-        let (left, right) = Self::process_cmp_inputs(
-            cs.ns(|| "process cmp inputs"),
-            &self,
-            b,
-            ordering,
-            should_also_check_equality,
-        )?;
-        Self::enforce_smaller_than(cs.ns(|| "enforce smaller than"), &left, &right)
+        let (left, right) = self.process_cmp_inputs(other, ordering, should_also_check_equality)?;
+        left.enforce_smaller_than(&right)
     }
 
-    /// This function enforces the ordering between `self` and `b`. The
+    /// This function enforces the ordering between `self` and `other`. The
     /// constraint system will not be satisfied otherwise. If `self` should
-    /// also be checked for equality, e.g. `a <= b` instead of `a < b`, set
-    /// `should_also_check_quality` to `true`. This variant assumes `a` and `b`
+    /// also be checked for equality, e.g. `self <= other` instead of `self < other`, set
+    /// `should_also_check_quality` to `true`. This variant assumes `self` and `other`
     /// are `<= (p-1)/2` and does not generate constraints to verify that.
-    pub fn enforce_cmp_unchecked<CS: ConstraintSystem<F>>(
+    pub fn enforce_cmp_unchecked(
         &self,
-        mut cs: CS,
-        b: &FpGadget<F>,
+        other: &FpVar<F>,
         ordering: Ordering,
         should_also_check_equality: bool,
     ) -> Result<(), SynthesisError> {
-        let (left, right) = Self::process_cmp_inputs(
-            cs.ns(|| "process cmp inputs"),
-            &self,
-            b,
-            ordering,
-            should_also_check_equality,
-        )?;
-        Self::enforce_smaller_than_unchecked(cs.ns(|| "enforce smaller than"), &left, &right)
+        let (left, right) = self.process_cmp_inputs(other, ordering, should_also_check_equality)?;
+        left.enforce_smaller_than_unchecked(&right)
     }
 
-    /// This function checks the ordering between `self` and `b`. It outputs a
+    /// This function checks the ordering between `self` and `other`. It outputs self
     /// `Boolean` that contains the result - `1` if true, `0` otherwise. The
     /// constraint system will be satisfied in any case. If `self` should
-    /// also be checked for equality, e.g. `a <= b` instead of `a < b`, set
-    /// `should_also_check_quality` to `true`. This variant verifies `a` and `b`
+    /// also be checked for equality, e.g. `self <= other` instead of `self < other`, set
+    /// `should_also_check_quality` to `true`. This variant verifies `self` and `other`
     /// are `<= (p-1)/2`.
-    pub fn is_cmp<CS: ConstraintSystem<F>>(
+    pub fn is_cmp(
         &self,
-        mut cs: CS,
-        b: &FpGadget<F>,
+        other: &FpVar<F>,
         ordering: Ordering,
         should_also_check_equality: bool,
-    ) -> Result<Boolean, SynthesisError> {
-        let (left, right) = Self::process_cmp_inputs(
-            cs.ns(|| "process cmp inputs"),
-            &self,
-            b,
-            ordering,
-            should_also_check_equality,
-        )?;
-        Self::is_smaller_than(cs.ns(|| "enforce smaller than"), &left, &right)
+    ) -> Result<Boolean<F>, SynthesisError> {
+        let (left, right) = self.process_cmp_inputs(other, ordering, should_also_check_equality)?;
+        left.is_smaller_than(&right)
     }
 
-    /// This function checks the ordering between `self` and `b`. It outputs a
+    /// This function checks the ordering between `self` and `other`. It outputs a
     /// `Boolean` that contains the result - `1` if true, `0` otherwise. The
     /// constraint system will be satisfied in any case. If `self` should
-    /// also be checked for equality, e.g. `a <= b` instead of `a < b`, set
-    /// `should_also_check_quality` to `true`. This variant assumes `a` and `b`
+    /// also be checked for equality, e.g. `self <= other` instead of `self < other`, set
+    /// `should_also_check_quality` to `true`. This variant assumes `self` and `other`
     /// are `<= (p-1)/2` and does not generate constraints to verify that.
-    pub fn is_cmp_unchecked<CS: ConstraintSystem<F>>(
+    pub fn is_cmp_unchecked(
         &self,
-        mut cs: CS,
-        b: &FpGadget<F>,
+        other: &FpVar<F>,
         ordering: Ordering,
         should_also_check_equality: bool,
-    ) -> Result<Boolean, SynthesisError> {
-        let (left, right) = Self::process_cmp_inputs(
-            cs.ns(|| "process cmp inputs"),
-            &self,
-            b,
-            ordering,
-            should_also_check_equality,
-        )?;
-        Self::is_smaller_than_unchecked(cs.ns(|| "enforce smaller than"), &left, &right)
+    ) -> Result<Boolean<F>, SynthesisError> {
+        let (left, right) = self.process_cmp_inputs(other, ordering, should_also_check_equality)?;
+        left.is_smaller_than_unchecked(&right)
     }
 
-    fn process_cmp_inputs<CS: ConstraintSystem<F>>(
-        mut cs: CS,
-        a: &FpGadget<F>,
-        b: &FpGadget<F>,
+    fn process_cmp_inputs(
+        &self,
+        other: &Self,
         ordering: Ordering,
         should_also_check_equality: bool,
-    ) -> Result<(FpGadget<F>, FpGadget<F>), SynthesisError> {
-        let left;
-        let right;
-        match ordering {
-            Ordering::Less => {
-                left = a;
-                right = b;
-            }
-            Ordering::Greater => {
-                left = b;
-                right = a;
-            }
-            Ordering::Equal => {
-                return Err(SynthesisError::Unsatisfiable);
-            }
+    ) -> Result<(Self, Self), SynthesisError> {
+        let (left, right) = match ordering {
+            Ordering::Less => (self, other),
+            Ordering::Greater => (other, self),
+            Ordering::Equal => Err(SynthesisError::Unsatisfiable)?,
         };
         let right_for_check = if should_also_check_equality {
-            right.add_constant(cs.ns(|| "plus one"), &F::one())?
+            right + F::one()
         } else {
             right.clone()
         };
@@ -129,77 +91,47 @@ impl FpGadget {
         Ok((left.clone(), right_for_check))
     }
 
-    // Helper function to enforce `a <= (p-1)/2`.
-    pub fn enforce_smaller_or_equal_than_mod_minus_one_div_two<CS: ConstraintSystem<F>>(
-        mut cs: CS,
-        a: &FpGadget<F>,
+    // Helper function to enforce `self <= (p-1)/2`.
+    pub fn enforce_smaller_or_equal_than_mod_minus_one_div_two(
+        &self,
     ) -> Result<(), SynthesisError> {
-        let a_bits = a.to_bits(cs.ns(|| "a to bits"))?;
-        Boolean::enforce_smaller_or_equal_than::<_, _, F, _>(
-            cs.ns(|| "enforce smaller than modulus minus one div two"),
-            &a_bits,
+        let _ = Boolean::enforce_smaller_or_equal_than(
+            &self.to_bits()?,
             F::modulus_minus_one_div_two(),
         )?;
-
         Ok(())
     }
 
-    /// Helper function to check `a < b` and output a result bit. This function
-    /// verifies `a` and `b` are `<= (p-1)/2`.
-    fn is_smaller_than<CS: ConstraintSystem<F>>(
-        mut cs: CS,
-        a: &FpGadget<F>,
-        b: &FpGadget<F>,
-    ) -> Result<Boolean, SynthesisError> {
-        Self::enforce_smaller_or_equal_than_mod_minus_one_div_two(cs.ns(|| "check a in range"), a)?;
-        Self::enforce_smaller_or_equal_than_mod_minus_one_div_two(cs.ns(|| "check b in range"), b)?;
-        Self::is_smaller_than_unchecked(cs.ns(|| "enforce smaller than"), a, b)
+    /// Helper function to check `self < other` and output a result bit. This function
+    /// verifies `self` and `other` are `<= (p-1)/2`.
+    fn is_smaller_than(&self, other: &FpVar<F>) -> Result<Boolean<F>, SynthesisError> {
+        self.enforce_smaller_or_equal_than_mod_minus_one_div_two()?;
+        other.enforce_smaller_or_equal_than_mod_minus_one_div_two()?;
+        self.is_smaller_than_unchecked(other)
     }
 
-    /// Helper function to check `a < b` and output a result bit. This function
-    /// assumes `a` and `b` are `<= (p-1)/2` and does not generate constraints
+    /// Helper function to check `self < other` and output a result bit. This function
+    /// assumes `self` and `other` are `<= (p-1)/2` and does not generate constraints
     /// to verify that.
-    fn is_smaller_than_unchecked<CS: ConstraintSystem<F>>(
-        mut cs: CS,
-        a: &FpGadget<F>,
-        b: &FpGadget<F>,
-    ) -> Result<Boolean, SynthesisError> {
-        let two = F::one() + F::one();
-        let d0 = a.sub(cs.ns(|| "a - b"), b)?;
-        let d = d0.mul_by_constant(cs.ns(|| "mul 2"), &two)?;
-        let d_bits = d.to_bits(cs.ns(|| "d to bits"))?;
-        let d_bits_len = d_bits.len();
-        Ok(d_bits[d_bits_len - 1])
+    fn is_smaller_than_unchecked(&self, other: &FpVar<F>) -> Result<Boolean<F>, SynthesisError> {
+        Ok((self - other).double()?.to_bits()?.last().unwrap().clone())
     }
 
-    /// Helper function to enforce `a < b`. This function verifies `a` and `b`
+    /// Helper function to enforce `self < other`. This function verifies `self` and `other`
     /// are `<= (p-1)/2`.
-    fn enforce_smaller_than<CS: ConstraintSystem<F>>(
-        mut cs: CS,
-        a: &FpGadget<F>,
-        b: &FpGadget<F>,
-    ) -> Result<(), SynthesisError> {
-        Self::enforce_smaller_or_equal_than_mod_minus_one_div_two(cs.ns(|| "check a in range"), a)?;
-        Self::enforce_smaller_or_equal_than_mod_minus_one_div_two(cs.ns(|| "check b in range"), b)?;
-        Self::enforce_smaller_than_unchecked(cs.ns(|| "enforce smaller than"), a, b)
+    fn enforce_smaller_than(&self, other: &FpVar<F>) -> Result<(), SynthesisError> {
+        self.enforce_smaller_or_equal_than_mod_minus_one_div_two()?;
+        other.enforce_smaller_or_equal_than_mod_minus_one_div_two()?;
+        self.enforce_smaller_than_unchecked(other)
     }
 
-    /// Helper function to enforce `a < b`. This function assumes `a` and `b`
+    /// Helper function to enforce `self < other`. This function assumes `self` and `other`
     /// are `<= (p-1)/2` and does not generate constraints to verify that.
-    fn enforce_smaller_than_unchecked<CS: ConstraintSystem<F>>(
-        mut cs: CS,
-        a: &FpGadget<F>,
-        b: &FpGadget<F>,
-    ) -> Result<(), SynthesisError> {
-        let is_smaller_than = Self::is_smaller_than_unchecked(cs.ns(|| "is smaller than"), a, b)?;
-        cs.enforce(
-            || "enforce smaller than",
-            |_| is_smaller_than.lc(CS::one(), F::one()),
-            |lc| lc + (F::one(), CS::one()),
-            |lc| lc + (F::one(), CS::one()),
-        );
-
-        Ok(())
+    fn enforce_smaller_than_unchecked(&self, other: &FpVar<F>) -> Result<(), SynthesisError> {
+        let cs = [self, other].cs().unwrap();
+        let is_smaller_than = self.is_smaller_than_unchecked(other)?;
+        let lc_one = lc!() + Variable::One;
+        cs.enforce_constraint(is_smaller_than.lc(), lc_one.clone(), lc_one)
     }
 }
 
@@ -209,9 +141,7 @@ mod test {
     use rand_xorshift::XorShiftRng;
     use std::cmp::Ordering;
 
-    use crate::{
-        alloc::AllocGadget, fields::fp::FpGadget, test_constraint_system::TestConstraintSystem,
-    };
+    use crate::{alloc::AllocVar, fields::fp::FpVar};
     use algebra::{bls12_381::Fr, PrimeField, UniformRand};
     use r1cs_core::ConstraintSystem;
 
@@ -233,43 +163,20 @@ mod test {
             r
         }
         for i in 0..10 {
-            let mut cs = TestConstraintSystem::<Fr>::new();
+            let cs = ConstraintSystem::<Fr>::new_ref();
             let a = rand_in_range(&mut rng);
-            let a_var = FpGadget::<Fr>::alloc(cs.ns(|| "a"), || Ok(a)).unwrap();
+            let a_var = FpVar::<Fr>::new_witness(cs.ns("a"), || Ok(a)).unwrap();
             let b = rand_in_range(&mut rng);
-            let b_var = FpGadget::<Fr>::alloc(cs.ns(|| "b"), || Ok(b)).unwrap();
+            let b_var = FpVar::<Fr>::new_witness(cs.ns("b"), || Ok(b)).unwrap();
 
             match a.cmp(&b) {
                 Ordering::Less => {
-                    a_var
-                        .enforce_cmp(cs.ns(|| "smaller than test"), &b_var, Ordering::Less, false)
-                        .unwrap();
-                    a_var
-                        .enforce_cmp(
-                            cs.ns(|| "smaller than test 2"),
-                            &b_var,
-                            Ordering::Less,
-                            true,
-                        )
-                        .unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Less, false).unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Less, true).unwrap();
                 }
                 Ordering::Greater => {
-                    a_var
-                        .enforce_cmp(
-                            cs.ns(|| "smaller than test"),
-                            &b_var,
-                            Ordering::Greater,
-                            false,
-                        )
-                        .unwrap();
-                    a_var
-                        .enforce_cmp(
-                            cs.ns(|| "smaller than test 2"),
-                            &b_var,
-                            Ordering::Greater,
-                            true,
-                        )
-                        .unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Greater, false).unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Greater, true).unwrap();
                 }
                 _ => {}
             }
@@ -277,79 +184,46 @@ mod test {
             if i == 0 {
                 println!("number of constraints: {}", cs.num_constraints());
             }
-            assert!(cs.is_satisfied());
+            assert!(cs.is_satisfied().unwrap());
         }
 
         for _i in 0..10 {
-            let mut cs = TestConstraintSystem::<Fr>::new();
+            let cs = ConstraintSystem::<Fr>::new_ref();
             let a = rand_in_range(&mut rng);
-            let a_var = FpGadget::<Fr>::alloc(cs.ns(|| "a"), || Ok(a)).unwrap();
+            let a_var = FpVar::<Fr>::new_witness(cs.ns("a"), || Ok(a)).unwrap();
             let b = rand_in_range(&mut rng);
-            let b_var = FpGadget::<Fr>::alloc(cs.ns(|| "b"), || Ok(b)).unwrap();
+            let b_var = FpVar::<Fr>::new_witness(cs.ns("b"), || Ok(b)).unwrap();
 
             match b.cmp(&a) {
                 Ordering::Less => {
-                    a_var
-                        .enforce_cmp(cs.ns(|| "smaller than test"), &b_var, Ordering::Less, false)
-                        .unwrap();
-                    a_var
-                        .enforce_cmp(
-                            cs.ns(|| "smaller than test 2"),
-                            &b_var,
-                            Ordering::Less,
-                            true,
-                        )
-                        .unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Less, false).unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Less, true).unwrap();
                 }
                 Ordering::Greater => {
-                    a_var
-                        .enforce_cmp(
-                            cs.ns(|| "smaller than test"),
-                            &b_var,
-                            Ordering::Greater,
-                            false,
-                        )
-                        .unwrap();
-                    a_var
-                        .enforce_cmp(
-                            cs.ns(|| "smaller than test 2"),
-                            &b_var,
-                            Ordering::Greater,
-                            true,
-                        )
-                        .unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Greater, false).unwrap();
+                    a_var.enforce_cmp(&b_var, Ordering::Greater, true).unwrap();
                 }
                 _ => {}
             }
 
-            assert!(!cs.is_satisfied());
+            assert!(!cs.is_satisfied().unwrap());
         }
 
         for _i in 0..10 {
-            let mut cs = TestConstraintSystem::<Fr>::new();
+            let cs = ConstraintSystem::<Fr>::new_ref();
             let a = rand_in_range(&mut rng);
-            let a_var = FpGadget::<Fr>::alloc(cs.ns(|| "a"), || Ok(a)).unwrap();
-            a_var
-                .enforce_cmp(cs.ns(|| "smaller than test"), &a_var, Ordering::Less, false)
-                .unwrap();
+            let a_var = FpVar::<Fr>::new_witness(cs.ns("a"), || Ok(a)).unwrap();
+            a_var.enforce_cmp(&a_var, Ordering::Less, false).unwrap();
 
-            assert!(!cs.is_satisfied());
+            assert!(!cs.is_satisfied().unwrap());
         }
 
         for _i in 0..10 {
-            let mut cs = TestConstraintSystem::<Fr>::new();
+            let cs = ConstraintSystem::<Fr>::new_ref();
             let a = rand_in_range(&mut rng);
-            let a_var = FpGadget::<Fr>::alloc(cs.ns(|| "a"), || Ok(a)).unwrap();
-            a_var
-                .enforce_cmp(
-                    cs.ns(|| "smaller than or equal to test"),
-                    &a_var,
-                    Ordering::Less,
-                    true,
-                )
-                .unwrap();
-
-            assert!(cs.is_satisfied());
+            let a_var = FpVar::<Fr>::new_witness(cs.ns("a"), || Ok(a)).unwrap();
+            a_var.enforce_cmp(&a_var, Ordering::Less, true).unwrap();
+            assert!(cs.is_satisfied().unwrap());
         }
     }
 }

r1cs-std/src/fields/fp2.rs

@@ -1,693 +1,10 @@
-use algebra::{
-    fields::{Fp2, Fp2Parameters},
-    PrimeField,
-};
-use core::{borrow::Borrow, marker::PhantomData};
-use r1cs_core::{ConstraintSystem, ConstraintVar, SynthesisError};
+use crate::fields::{fp::FpVar, quadratic_extension::*};
+use algebra::fields::{Fp2Parameters, Fp2ParamsWrapper, QuadExtParameters};
 
-use crate::{fields::fp::FpGadget, prelude::*, Vec};
+pub type Fp2Var<P> = QuadExtVar<FpVar<<P as Fp2Parameters>::Fp>, Fp2ParamsWrapper<P>>;
 
-#[derive(Derivative)]
-#[derivative(Debug(bound = "P: Fp2Parameters, ConstraintF: PrimeField"))]
-#[must_use]
-pub struct Fp2Gadget<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> {
-    pub c0: FpGadget<ConstraintF>,
-    pub c1: FpGadget<ConstraintF>,
-    #[derivative(Debug = "ignore")]
-    _params: PhantomData<P>,
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField>
-    ToConstraintFieldGadget<ConstraintF> for Fp2Gadget<P, ConstraintF>
-{
-    fn to_constraint_field<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<FpGadget<ConstraintF>>, SynthesisError> {
-        let mut res = Vec::new();
-
-        let mut c0_gadget = self.c0.to_constraint_field(&mut cs.ns(|| "c0"))?;
-        let mut c1_gadget = self.c1.to_constraint_field(&mut cs.ns(|| "c1"))?;
-
-        res.append(&mut c0_gadget);
-        res.append(&mut c1_gadget);
-
-        Ok(res)
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> Fp2Gadget<P, ConstraintF> {
-    pub fn new(c0: FpGadget<ConstraintF>, c1: FpGadget<ConstraintF>) -> Self {
-        Self {
-            c0,
-            c1,
-            _params: PhantomData,
-        }
-    }
-
-    /// Multiply a FpGadget by quadratic nonresidue P::NONRESIDUE.
-    #[inline]
-    pub fn mul_fp_gadget_by_nonresidue<CS: ConstraintSystem<ConstraintF>>(
-        cs: CS,
-        fe: &FpGadget<ConstraintF>,
-    ) -> Result<FpGadget<ConstraintF>, SynthesisError> {
-        fe.mul_by_constant(cs, &P::NONRESIDUE)
-    }
-
-    /// Multiply a Fp2Gadget by an element of fp.
-    #[inline]
-    pub fn mul_by_fp_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        fe: &P::Fp,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.mul_by_constant_in_place(cs.ns(|| "c0"), fe)?;
-        self.c1.mul_by_constant_in_place(cs.ns(|| "c1"), fe)?;
-        Ok(self)
-    }
-
-    /// Multiply a Fp2Gadget by an element of fp.
-    #[inline]
-    pub fn mul_by_fp_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        fe: &P::Fp,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.mul_by_fp_constant_in_place(cs, fe)?;
-        Ok(result)
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> FieldGadget<Fp2<P>, ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    type Variable = (ConstraintVar<ConstraintF>, ConstraintVar<ConstraintF>);
-
-    #[inline]
-    fn get_value(&self) -> Option<Fp2<P>> {
-        match (self.c0.value, self.c1.value) {
-            (Some(c0), Some(c1)) => Some(Fp2::new(c0, c1)),
-            (..) => None,
-        }
-    }
-
-    #[inline]
-    fn get_variable(&self) -> Self::Variable {
-        (self.c0.get_variable(), self.c1.get_variable())
-    }
-
-    #[inline]
-    fn zero<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = FpGadget::zero(cs.ns(|| "c0"))?;
-        let c1 = FpGadget::zero(cs.ns(|| "c1"))?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn one<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = FpGadget::one(cs.ns(|| "c0"))?;
-        let c1 = FpGadget::zero(cs.ns(|| "c1"))?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn conditionally_add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        bit: &Boolean,
-        coeff: Fp2<P>,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self
-            .c0
-            .conditionally_add_constant(cs.ns(|| "c0"), bit, coeff.c0)?;
-        let c1 = self
-            .c1
-            .conditionally_add_constant(cs.ns(|| "c1"), bit, coeff.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn add<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.add(&mut cs.ns(|| "add c0"), &other.c0)?;
-        let c1 = self.c1.add(&mut cs.ns(|| "add c1"), &other.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn sub<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.sub(&mut cs.ns(|| "sub c0"), &other.c0)?;
-        let c1 = self.c1.sub(&mut cs.ns(|| "sub c1"), &other.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn double<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.double_in_place(cs)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn double_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.double_in_place(&mut cs.ns(|| "double c0"))?;
-        self.c1.double_in_place(&mut cs.ns(|| "double c1"))?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn negate<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.negate_in_place(cs)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn negate_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.negate_in_place(&mut cs.ns(|| "negate c0"))?;
-        self.c1.negate_in_place(&mut cs.ns(|| "negate c1"))?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn mul<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        // Karatsuba multiplication for Fp2:
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     result.c0 = v0 + non_residue * v1
-        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
-        // Enforced with 3 constraints:
-        //     A.c1 * B.c1 = v1
-        //     A.c0 * B.c0 = result.c0 - non_residue * v1
-        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        // Devegili, OhEigeartaigh, Scott, Dahab
-        let mul_cs = &mut cs.ns(|| "mul");
-
-        let v0 = self.c0.mul(mul_cs.ns(|| "v0"), &other.c0)?;
-        let v1 = self.c1.mul(mul_cs.ns(|| "v1"), &other.c1)?;
-        let c0 = {
-            let non_residue_times_v1 =
-                v1.mul_by_constant(mul_cs.ns(|| "non_residue * v0"), &P::NONRESIDUE)?;
-            v0.add(mul_cs.ns(|| "v0 + beta * v1"), &non_residue_times_v1)?
-        };
-        let c1 = {
-            let a0_plus_a1 = self.c0.add(mul_cs.ns(|| "a0 + a1"), &self.c1)?;
-            let b0_plus_b1 = other.c0.add(mul_cs.ns(|| "b0 + b1"), &other.c1)?;
-            let a0_plus_a1_times_b0_plus_b1 =
-                a0_plus_a1.mul(&mut mul_cs.ns(|| "(a0 + a1) * (b0 + b1)"), &b0_plus_b1)?;
-            a0_plus_a1_times_b0_plus_b1
-                .sub(mul_cs.ns(|| "res - v0"), &v0)?
-                .sub(mul_cs.ns(|| "res - v0 - v1"), &v1)?
-        };
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn square<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        // From Libsnark/fp2_gadget.tcc
-        // Complex multiplication for Fp2:
-        //     v0 = A.c0 * A.c1
-        //     result.c0 = (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) - (1 +
-        // non_residue) * v0     result.c1 = 2 * v0
-        // Enforced with 2 constraints:
-        //     (2*A.c0) * A.c1 = result.c1
-        //     (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) = result.c0 + result.c1 * (1
-        // + non_residue)/2 Reference:
-        //     "Multiplication and Squaring on Pairing-Friendly Fields"
-        //     Devegili, OhEigeartaigh, Scott, Dahab
-
-        let mut v0 = self.c0.mul(cs.ns(|| "v0"), &self.c1)?;
-        let a0_plus_a1 = self.c0.add(cs.ns(|| "a0 + a1"), &self.c1)?;
-
-        let non_residue_c1 = self
-            .c1
-            .mul_by_constant(cs.ns(|| "non_residue * a1"), &P::NONRESIDUE)?;
-        let a0_plus_non_residue_c1 = self
-            .c0
-            .add(cs.ns(|| "a0 + non_residue * a1"), &non_residue_c1)?;
-        let one_plus_non_residue_v0 = v0.mul_by_constant(
-            cs.ns(|| "1 + non_residue * v0"),
-            &(P::Fp::one() + &P::NONRESIDUE),
-        )?;
-
-        let c0 = a0_plus_a1
-            .mul(
-                cs.ns(|| "(a0 + a1) * (a0 + non_residue * a1)"),
-                &a0_plus_non_residue_c1,
-            )?
-            .sub(cs.ns(|| "- (1 + non_residue) v0"), &one_plus_non_residue_v0)?;
-
-        v0.double_in_place(cs.ns(|| "2v0"))?;
-        let c1 = v0;
-
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn square_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        // From Libsnark/fp2_gadget.tcc
-        // Complex multiplication for Fp2:
-        //     v0 = A.c0 * A.c1
-        //     result.c0 = (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) - (1 +
-        // non_residue) * v0     result.c1 = 2 * v0
-        // Enforced with 2 constraints:
-        //     (2*A.c0) * A.c1 = result.c1
-        //     (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) = result.c0 + result.c1 * (1
-        // + non_residue)/2 Reference:
-        //     "Multiplication and Squaring on Pairing-Friendly Fields"
-        //     Devegili, OhEigeartaigh, Scott, Dahab
-
-        let mut v0 = self.c0.mul(cs.ns(|| "v0"), &self.c1)?;
-        let a0_plus_a1 = self.c0.add(cs.ns(|| "a0 + a1"), &self.c1)?;
-
-        let _ = self
-            .c1
-            .mul_by_constant_in_place(cs.ns(|| "non_residue * a1"), &P::NONRESIDUE)?;
-        let a0_plus_non_residue_c1 = self.c0.add(cs.ns(|| "a0 + non_residue * a1"), &self.c1)?;
-        let one_plus_non_residue_v0 = v0.mul_by_constant(
-            cs.ns(|| "1 + non_residue * v0"),
-            &(P::Fp::one() + &P::NONRESIDUE),
-        )?;
-
-        self.c0 = a0_plus_a1
-            .mul(
-                cs.ns(|| "(a0 + a1) * (a0 + non_residue * a1)"),
-                &a0_plus_non_residue_c1,
-            )?
-            .sub(cs.ns(|| "- (1 + non_residue) v0"), &one_plus_non_residue_v0)?;
-
-        v0.double_in_place(cs.ns(|| "2v0"))?;
-        self.c1 = v0;
-
-        Ok(self)
-    }
-
-    fn mul_equals<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        result: &Self,
-    ) -> Result<(), SynthesisError> {
-        // Karatsuba multiplication for Fp2:
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     result.c0 = v0 + non_residue * v1
-        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
-        // Enforced with 3 constraints:
-        //     A.c1 * B.c1 = v1
-        //     A.c0 * B.c0 = result.c0 - non_residue * v1
-        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        // Devegili, OhEigeartaigh, Scott, Dahab
-        let mul_cs = &mut cs.ns(|| "mul");
-
-        // Compute v1
-        let mut v1 = self.c1.mul(mul_cs.ns(|| "v1"), &other.c1)?;
-
-        // Perform second check
-        let non_residue_times_v1 =
-            v1.mul_by_constant(mul_cs.ns(|| "non_residue * v0"), &P::NONRESIDUE)?;
-        let rhs = result
-            .c0
-            .sub(mul_cs.ns(|| "sub from result.c0"), &non_residue_times_v1)?;
-        self.c0
-            .mul_equals(mul_cs.ns(|| "second check"), &other.c0, &rhs)?;
-
-        // Last check
-        let a0_plus_a1 = self.c0.add(mul_cs.ns(|| "a0 + a1"), &self.c1)?;
-        let b0_plus_b1 = other.c0.add(mul_cs.ns(|| "b0 + b1"), &other.c1)?;
-        let one_minus_non_residue_v1 =
-            v1.sub_in_place(mul_cs.ns(|| "sub from v1"), &non_residue_times_v1)?;
-
-        let result_c1_plus_result_c0_plus_one_minus_non_residue_v1 = result
-            .c1
-            .add(mul_cs.ns(|| "c1 + c0"), &result.c0)?
-            .add(mul_cs.ns(|| "rest of stuff"), one_minus_non_residue_v1)?;
-
-        a0_plus_a1.mul_equals(
-            mul_cs.ns(|| "third check"),
-            &b0_plus_b1,
-            &result_c1_plus_result_c0_plus_one_minus_non_residue_v1,
-        )?;
-
-        Ok(())
-    }
-
-    fn frobenius_map<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        power: usize,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        let _ = result.frobenius_map_in_place(cs, power)?;
-        Ok(result)
-    }
-
-    fn frobenius_map_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        power: usize,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c1
-            .mul_by_constant_in_place(cs, &P::FROBENIUS_COEFF_FP2_C1[power % 2])?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        other: &Fp2<P>,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        let _ = result.add_constant_in_place(cs, other)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn add_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        other: &Fp2<P>,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.add_constant_in_place(cs.ns(|| "c0"), &other.c0)?;
-        self.c1.add_constant_in_place(cs.ns(|| "c1"), &other.c1)?;
-        Ok(self)
-    }
-
-    fn mul_by_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        fe: &Fp2<P>,
-    ) -> Result<Self, SynthesisError> {
-        // Karatsuba multiplication (see mul above).
-        // Doesn't need any constraints; returns linear combinations of
-        // `self`'s variables.
-        //
-        // (The operations below are guaranteed to return linear combinations)
-        let (a0, a1) = (&self.c0, &self.c1);
-        let (b0, b1) = (fe.c0, fe.c1);
-        let mut v0 = a0.mul_by_constant(&mut cs.ns(|| "v0"), &b0)?;
-        let beta_v1 = a1.mul_by_constant(&mut cs.ns(|| "v1"), &(b1 * &P::NONRESIDUE))?;
-
-        v0.add_in_place(&mut cs.ns(|| "c0"), &beta_v1)?;
-        let c0 = v0;
-
-        let mut a0b1 = a0.mul_by_constant(&mut cs.ns(|| "a0b1"), &b1)?;
-        let a1b0 = a1.mul_by_constant(&mut cs.ns(|| "a1b0"), &b0)?;
-        a0b1.add_in_place(&mut cs.ns(|| "c1"), &a1b0)?;
-        let c1 = a0b1;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost_of_mul() -> usize {
-        3 * FpGadget::<ConstraintF>::cost_of_mul()
-    }
-
-    fn cost_of_mul_equals() -> usize {
-        Self::cost_of_mul()
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> PartialEq
-    for Fp2Gadget<P, ConstraintF>
-{
-    fn eq(&self, other: &Self) -> bool {
-        self.c0 == other.c0 && self.c1 == other.c1
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> Eq for Fp2Gadget<P, ConstraintF> {}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> EqGadget<ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> ConditionalEqGadget<ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn conditional_enforce_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        condition: &Boolean,
-    ) -> Result<(), SynthesisError> {
-        self.c0
-            .conditional_enforce_equal(&mut cs.ns(|| "c0"), &other.c0, condition)?;
-        self.c1
-            .conditional_enforce_equal(&mut cs.ns(|| "c1"), &other.c1, condition)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        2
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> NEqGadget<ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn enforce_not_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<(), SynthesisError> {
-        self.c0.enforce_not_equal(&mut cs.ns(|| "c0"), &other.c0)?;
-        self.c1.enforce_not_equal(&mut cs.ns(|| "c1"), &other.c1)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        2
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> ToBitsGadget<ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    fn to_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bits(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-
-    fn to_non_unique_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bits(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> ToBytesGadget<ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    fn to_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bytes(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-
-    fn to_non_unique_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bytes(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> Clone
-    for Fp2Gadget<P, ConstraintF>
-{
-    fn clone(&self) -> Self {
-        Self {
-            c0: self.c0.clone(),
-            c1: self.c1.clone(),
-            _params: PhantomData,
-        }
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> CondSelectGadget<ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn conditionally_select<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        cond: &Boolean,
-        true_value: &Self,
-        false_value: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = FpGadget::<ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c0"),
-            cond,
-            &true_value.c0,
-            &false_value.c0,
-        )?;
-        let c1 = FpGadget::<ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c1"),
-            cond,
-            &true_value.c1,
-            &false_value.c1,
-        )?;
-
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> TwoBitLookupGadget<ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    type TableConstant = Fp2<P>;
-    fn two_bit_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c0 = FpGadget::two_bit_lookup(cs.ns(|| "Lookup c0"), b, &c0s)?;
-        let c1 = FpGadget::two_bit_lookup(cs.ns(|| "Lookup c1"), b, &c1s)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <FpGadget<ConstraintF> as TwoBitLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField>
-    ThreeBitCondNegLookupGadget<ConstraintF> for Fp2Gadget<P, ConstraintF>
-{
-    type TableConstant = Fp2<P>;
-
-    fn three_bit_cond_neg_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        b0b1: &Boolean,
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c0 = FpGadget::three_bit_cond_neg_lookup(cs.ns(|| "Lookup c0"), b, b0b1, &c0s)?;
-        let c1 = FpGadget::three_bit_cond_neg_lookup(cs.ns(|| "Lookup c1"), b, b0b1, &c1s)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <FpGadget<ConstraintF> as ThreeBitCondNegLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P: Fp2Parameters<Fp = ConstraintF>, ConstraintF: PrimeField> AllocGadget<Fp2<P>, ConstraintF>
-    for Fp2Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn alloc_constant<T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        t: T,
-    ) -> Result<Self, SynthesisError>
-    where
-        T: Borrow<Fp2<P>>,
-    {
-        Self::zero(cs.ns(|| "zero"))?.add_constant(cs.ns(|| "add constant"), t.borrow())
-    }
-
-    #[inline]
-    fn alloc<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp2<P>>,
-    {
-        let (c0, c1) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1))
-            }
-            Err(_) => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = FpGadget::alloc(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = FpGadget::alloc(&mut cs.ns(|| "c1"), || c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn alloc_input<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp2<P>>,
-    {
-        let (c0, c1) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1))
-            }
-            Err(_) => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = FpGadget::alloc_input(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = FpGadget::alloc_input(&mut cs.ns(|| "c1"), || c1)?;
-        Ok(Self::new(c0, c1))
+impl<P: Fp2Parameters> QuadExtVarParams<FpVar<P::Fp>> for Fp2ParamsWrapper<P> {
+    fn mul_base_field_var_by_frob_coeff(fe: &mut FpVar<P::Fp>, power: usize) {
+        *fe *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
     }
 }

r1cs-std/src/fields/fp3.rs

@@ -1,955 +1,15 @@
-use algebra::{
-    fields::fp3::{Fp3, Fp3Parameters},
-    PrimeField, SquareRootField,
-};
-use core::{borrow::Borrow, marker::PhantomData};
-use r1cs_core::{ConstraintSystem, ConstraintVar, SynthesisError};
+use crate::fields::{cubic_extension::*, fp::FpVar};
+use algebra::fields::{CubicExtParameters, Fp3Parameters, Fp3ParamsWrapper};
 
-use crate::{fields::fp::FpGadget, prelude::*, Vec};
+pub type Fp3Var<P> = CubicExtVar<FpVar<<P as Fp3Parameters>::Fp>, Fp3ParamsWrapper<P>>;
 
-#[derive(Derivative)]
-#[derivative(Debug(
-    bound = "P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField"
-))]
-#[must_use]
-pub struct Fp3Gadget<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-{
-    pub c0: FpGadget<ConstraintF>,
-    pub c1: FpGadget<ConstraintF>,
-    pub c2: FpGadget<ConstraintF>,
-    #[derivative(Debug = "ignore")]
-    _params: PhantomData<P>,
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    ToConstraintFieldGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    fn to_constraint_field<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<FpGadget<ConstraintF>>, SynthesisError> {
-        let mut res = Vec::new();
-
-        let mut c0_gadget = self.c0.to_constraint_field(&mut cs.ns(|| "c0"))?;
-        let mut c1_gadget = self.c1.to_constraint_field(&mut cs.ns(|| "c1"))?;
-        let mut c2_gadget = self.c2.to_constraint_field(&mut cs.ns(|| "c2"))?;
-
-        res.append(&mut c0_gadget);
-        res.append(&mut c1_gadget);
-        res.append(&mut c2_gadget);
-
-        Ok(res)
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    Fp3Gadget<P, ConstraintF>
-{
-    #[inline]
-    pub fn new(
-        c0: FpGadget<ConstraintF>,
-        c1: FpGadget<ConstraintF>,
-        c2: FpGadget<ConstraintF>,
-    ) -> Self {
-        Self {
-            c0,
-            c1,
-            c2,
-            _params: PhantomData,
-        }
-    }
-
-    /// Multiply a FpGadget by quadratic nonresidue P::NONRESIDUE.
-    #[inline]
-    pub fn mul_fp_gadget_by_nonresidue<CS: ConstraintSystem<ConstraintF>>(
-        cs: CS,
-        fe: &FpGadget<ConstraintF>,
-    ) -> Result<FpGadget<ConstraintF>, SynthesisError> {
-        fe.mul_by_constant(cs, &P::NONRESIDUE)
-    }
-
-    /// Multiply a Fp3Gadget by an element of fp.
-    #[inline]
-    pub fn mul_by_fp_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        fe: &P::Fp,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.mul_by_constant_in_place(cs.ns(|| "c0"), fe)?;
-        self.c1.mul_by_constant_in_place(cs.ns(|| "c1"), fe)?;
-        self.c2.mul_by_constant_in_place(cs.ns(|| "c2"), fe)?;
-        Ok(self)
-    }
-
-    /// Multiply a Fp3Gadget by an element of fp.
-    #[inline]
-    pub fn mul_by_fp_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        fe: &P::Fp,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.mul_by_fp_constant_in_place(cs, fe)?;
-        Ok(result)
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    FieldGadget<Fp3<P>, ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    type Variable = (
-        ConstraintVar<ConstraintF>,
-        ConstraintVar<ConstraintF>,
-        ConstraintVar<ConstraintF>,
-    );
-
-    #[inline]
-    fn get_value(&self) -> Option<Fp3<P>> {
-        match (
-            self.c0.get_value(),
-            self.c1.get_value(),
-            self.c2.get_value(),
-        ) {
-            (Some(c0), Some(c1), Some(c2)) => Some(Fp3::new(c0, c1, c2)),
-            (..) => None,
-        }
-    }
-
-    #[inline]
-    fn get_variable(&self) -> Self::Variable {
-        (
-            self.c0.get_variable(),
-            self.c1.get_variable(),
-            self.c2.get_variable(),
-        )
-    }
-
-    #[inline]
-    fn zero<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = FpGadget::<ConstraintF>::zero(cs.ns(|| "c0"))?;
-        let c1 = FpGadget::<ConstraintF>::zero(cs.ns(|| "c1"))?;
-        let c2 = FpGadget::<ConstraintF>::zero(cs.ns(|| "c2"))?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn one<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = FpGadget::<ConstraintF>::one(cs.ns(|| "c0"))?;
-        let c1 = FpGadget::<ConstraintF>::zero(cs.ns(|| "c1"))?;
-        let c2 = FpGadget::<ConstraintF>::zero(cs.ns(|| "c2"))?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn conditionally_add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        bit: &Boolean,
-        coeff: Fp3<P>,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self
-            .c0
-            .conditionally_add_constant(cs.ns(|| "c0"), bit, coeff.c0)?;
-        let c1 = self
-            .c1
-            .conditionally_add_constant(cs.ns(|| "c1"), bit, coeff.c1)?;
-        let c2 = self
-            .c2
-            .conditionally_add_constant(cs.ns(|| "c2"), bit, coeff.c2)?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn add<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.add(&mut cs.ns(|| "add c0"), &other.c0)?;
-        let c1 = self.c1.add(&mut cs.ns(|| "add c1"), &other.c1)?;
-        let c2 = self.c2.add(&mut cs.ns(|| "add c2"), &other.c2)?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn sub<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.sub(&mut cs.ns(|| "sub c0"), &other.c0)?;
-        let c1 = self.c1.sub(&mut cs.ns(|| "sub c1"), &other.c1)?;
-        let c2 = self.c2.sub(&mut cs.ns(|| "sub c2"), &other.c2)?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn negate<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.negate(&mut cs.ns(|| "negate c0"))?;
-        let c1 = self.c1.negate(&mut cs.ns(|| "negate c1"))?;
-        let c2 = self.c2.negate(&mut cs.ns(|| "negate c2"))?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn negate_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.negate_in_place(&mut cs.ns(|| "negate c0"))?;
-        self.c1.negate_in_place(&mut cs.ns(|| "negate c1"))?;
-        self.c2.negate_in_place(&mut cs.ns(|| "negate c2"))?;
-        Ok(self)
-    }
-
-    /// Use the Toom-Cook-3x method to compute multiplication.
-    #[inline]
-    fn mul<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        // Uses Toom-Cook-3x multiplication from
-        //
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        //    Devegili, OhEigeartaigh, Scott, Dahab
-
-        // v0 = a(0)b(0)   = a0 * b0
-        let v0 = self.c0.mul(&mut cs.ns(|| "Calc v0"), &other.c0)?;
-
-        // v1 = a(1)b(1)   = (a0 + a1 + a2)(b0 + b1 + b2)
-        let v1 = {
-            let mut v1_cs = cs.ns(|| "compute v1");
-            let a0_plus_a1_plus_a2 = self
-                .c0
-                .add(v1_cs.ns(|| "a0 + a1"), &self.c1)?
-                .add(v1_cs.ns(|| "a0 + a1 + a2"), &self.c2)?;
-            let b0_plus_b1_plus_b2 = other
-                .c0
-                .add(v1_cs.ns(|| "b0 + b1"), &other.c1)?
-                .add(v1_cs.ns(|| "b0 + b1 + b2"), &other.c2)?;
-
-            a0_plus_a1_plus_a2.mul(
-                v1_cs.ns(|| "(a0 + a1 + a2)(b0 + b1 + b2)"),
-                &b0_plus_b1_plus_b2,
-            )?
-        };
-
-        // v2 = a(−1)b(−1) = (a0 − a1 + a2)(b0 − b1 + b2)
-        let v2 = {
-            let mut v2_cs = cs.ns(|| "compute v2");
-
-            let a0_minus_a1_plus_a2 = self
-                .c0
-                .sub(v2_cs.ns(|| "a0 - a1"), &self.c1)?
-                .add(v2_cs.ns(|| "a0 - a1 + a2"), &self.c2)?;
-
-            let b0_minus_b1_plus_b2 = other
-                .c0
-                .sub(v2_cs.ns(|| "b0 - b1"), &other.c1)?
-                .add(v2_cs.ns(|| "b0 - b1 + b2"), &other.c2)?;
-
-            a0_minus_a1_plus_a2.mul(
-                v2_cs.ns(|| "(a0 - a1 + a2)(b0 - b1 + b2)"),
-                &b0_minus_b1_plus_b2,
-            )?
-        };
-
-        // v3 = a(2)b(2)   = (a0 + 2a1 + 4a2)(b0 + 2b1 + 4b2)
-        let v3 = {
-            let v3_cs = &mut cs.ns(|| "compute v3");
-
-            let a1_double = self.c1.double(v3_cs.ns(|| "2 * a1"))?;
-            let a2_quad = self
-                .c2
-                .double(v3_cs.ns(|| "2 * a2"))?
-                .double(v3_cs.ns(|| "4 * a2"))?;
-
-            let a0_plus_2_a1_plus_4_a2 = self
-                .c0
-                .add(v3_cs.ns(|| "a0 + 2a1"), &a1_double)?
-                .add(v3_cs.ns(|| "a0 + 2a1 + 4a2"), &a2_quad)?;
-
-            let b1_double = other.c1.double(v3_cs.ns(|| "2 * b1"))?;
-            let b2_quad = other
-                .c2
-                .double(v3_cs.ns(|| "2 * b2"))?
-                .double(v3_cs.ns(|| "4 * b2"))?;
-            let b0_plus_2_b1_plus_4_b2 = other
-                .c0
-                .add(v3_cs.ns(|| "b0 + 2b1"), &b1_double)?
-                .add(v3_cs.ns(|| "b0 + 2b1 + 4b2"), &b2_quad)?;
-
-            a0_plus_2_a1_plus_4_a2.mul(
-                v3_cs.ns(|| "(a0 + 2a1 + 4a2)(b0 + 2b1 + 4b2)"),
-                &b0_plus_2_b1_plus_4_b2,
-            )?
-        };
-
-        // v4 = a(∞)b(∞)   = a2 * b2
-        let v4 = self.c2.mul(cs.ns(|| "v2: a2 * b2"), &other.c2)?;
-
-        let two = P::Fp::one().double();
-        let six = two.double() + &two;
-        let mut two_and_six = [two, six];
-        algebra::fields::batch_inversion(&mut two_and_six);
-        let (two_inverse, six_inverse) = (two_and_six[0], two_and_six[1]);
-
-        let half_v0 = v0.mul_by_constant(cs.ns(|| "half_v0"), &two_inverse)?;
-        let half_v1 = v1.mul_by_constant(cs.ns(|| "half_v1"), &two_inverse)?;
-        let one_sixth_v2 = v2.mul_by_constant(cs.ns(|| "v2_by_six"), &six_inverse)?;
-        let one_sixth_v3 = v3.mul_by_constant(cs.ns(|| "v3_by_six"), &six_inverse)?;
-        let two_v4 = v4.double(cs.ns(|| "2 * v4"))?;
-
-        // c0 = v0 + β((1/2)v0 − (1/2)v1 − (1/6)v2 + (1/6)v3 − 2v4)
-        let c0 = {
-            let c0_cs = &mut cs.ns(|| "c0");
-
-            // No constraints, only get a linear combination back.
-            let temp = half_v0
-                .sub(c0_cs.ns(|| "sub1"), &half_v1)?
-                .sub(c0_cs.ns(|| "sub2"), &one_sixth_v2)?
-                .add(c0_cs.ns(|| "add3"), &one_sixth_v3)?
-                .sub(c0_cs.ns(|| "sub4"), &two_v4)?;
-            let non_residue_times_inner =
-                temp.mul_by_constant(&mut c0_cs.ns(|| "mul5"), &P::NONRESIDUE)?;
-            v0.add(c0_cs.ns(|| "add6"), &non_residue_times_inner)?
-        };
-
-        // −(1/2)v0 + v1 − (1/3)v2 − (1/6)v3 + 2v4 + βv4
-        let c1 = {
-            let c1_cs = &mut cs.ns(|| "c1");
-            let one_third_v2 = one_sixth_v2.double(&mut c1_cs.ns(|| "v2_by_3"))?;
-            let non_residue_v4 =
-                v4.mul_by_constant(&mut c1_cs.ns(|| "mul_by_beta"), &P::NONRESIDUE)?;
-
-            let result = half_v0
-                .negate(c1_cs.ns(|| "neg1"))?
-                .add(c1_cs.ns(|| "add2"), &v1)?
-                .sub(c1_cs.ns(|| "sub3"), &one_third_v2)?
-                .sub(c1_cs.ns(|| "sub4"), &one_sixth_v3)?
-                .add(c1_cs.ns(|| "sub5"), &two_v4)?
-                .add(c1_cs.ns(|| "sub6"), &non_residue_v4)?;
-            result
-        };
-
-        // -v0 + (1/2)v1 + (1/2)v2 −v4
-        let c2 = {
-            let c2_cs = &mut cs.ns(|| "c2");
-            let half_v2 = v2.mul_by_constant(&mut c2_cs.ns(|| "mul1"), &two_inverse)?;
-            let result = half_v1
-                .add(c2_cs.ns(|| "add1"), &half_v2)?
-                .sub(c2_cs.ns(|| "sub1"), &v4)?
-                .sub(c2_cs.ns(|| "sub2"), &v0)?;
-            result
-        };
-
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn mul_equals<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        result: &Self,
-    ) -> Result<(), SynthesisError> {
-        // Karatsuba multiplication for Fp3:
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     v2 = A.c2 * B.c2
-        //     result.c0 = v0 + β((a1 + a2)(b1 + b2) − v1 − v2)
-        //     result.c1 = (a0 + a1)(b0 + b1) − v0 − v1 + βv2
-        //     result.c2 = (a0 + a2)(b0 + b2) − v0 + v1 − v2,
-        // We enforce this with six constraints:
-        //
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     v2 = A.c2 * B.c2
-        //
-        //     result.c0 - v0 + \beta*(v1 + v2) = β(a1 + a2)(b1 + b2))
-        //     result.c1 + v0 + v1 - βv2        = (a0 + a1)(b0 + b1)
-        //     result.c2 + v0 - v1 + v2         = (a0 + a2)(b0 + b2)
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        // Devegili, OhEigeartaigh, Scott, Dahab
-        //
-        // This implementation adapted from
-        // https://github.com/ZencashOfficial/ginger-lib/blob/development/r1cs/gadgets/std/src/fields/fp3.rs
-        let v0 = self.c0.mul(cs.ns(|| "v0 = a0 * b0"), &other.c0)?;
-        let v1 = self.c1.mul(cs.ns(|| "v1 = a1 * b1"), &other.c1)?;
-        let v2 = self.c2.mul(cs.ns(|| "v2 = a2 * b2"), &other.c2)?;
-
-        // Check c0
-        let nr_a1_plus_a2 = self
-            .c1
-            .add(cs.ns(|| "a1 + a2"), &self.c2)?
-            .mul_by_constant(cs.ns(|| "nr*(a1 + a2)"), &P::NONRESIDUE)?;
-        let b1_plus_b2 = other.c1.add(cs.ns(|| "b1 + b2"), &other.c2)?;
-        let nr_v1 = v1.mul_by_constant(cs.ns(|| "nr * v1"), &P::NONRESIDUE)?;
-        let nr_v2 = v2.mul_by_constant(cs.ns(|| "nr * v2"), &P::NONRESIDUE)?;
-        let to_check = result
-            .c0
-            .sub(cs.ns(|| "c0 - v0"), &v0)?
-            .add(cs.ns(|| "c0 - v0 + nr * v1"), &nr_v1)?
-            .add(cs.ns(|| "c0 - v0 + nr * v1 + nr * v2"), &nr_v2)?;
-        nr_a1_plus_a2.mul_equals(cs.ns(|| "check c0"), &b1_plus_b2, &to_check)?;
-
-        // Check c1
-        let a0_plus_a1 = self.c0.add(cs.ns(|| "a0 + a1"), &self.c1)?;
-        let b0_plus_b1 = other.c0.add(cs.ns(|| "b0 + b1"), &other.c1)?;
-        let to_check = result
-            .c1
-            .sub(cs.ns(|| "c1 - nr * v2"), &nr_v2)?
-            .add(cs.ns(|| "c1 - nr * v2 + v0"), &v0)?
-            .add(cs.ns(|| "c1 - nr * v2 + v0 + v1"), &v1)?;
-        a0_plus_a1.mul_equals(cs.ns(|| "check c1"), &b0_plus_b1, &to_check)?;
-
-        // Check c2
-        let a0_plus_a2 = self.c0.add(cs.ns(|| "a0 + a2"), &self.c2)?;
-        let b0_plus_b2 = other.c0.add(cs.ns(|| "b0 + b2"), &other.c2)?;
-        let to_check = result
-            .c2
-            .add(cs.ns(|| "c2 + v0"), &v0)?
-            .sub(cs.ns(|| "c2 + v0 - v1"), &v1)?
-            .add(cs.ns(|| "c2 + v0 - v1 + v2"), &v2)?;
-        a0_plus_a2.mul_equals(cs.ns(|| "check c2"), &b0_plus_b2, &to_check)?;
-        Ok(())
-    }
-
-    /// Use the Chung-Hasan asymmetric squaring formula.
-    ///
-    /// (Devegili OhEig Scott Dahab --- Multiplication and Squaring on
-    /// Abstract Pairing-Friendly
-    /// Fields.pdf; Section 4 (CH-SQR2))
-    #[inline]
-    fn square<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        let a = self.c0.clone();
-        let b = self.c1.clone();
-        let c = self.c2.clone();
-
-        let s0 = a.square(cs.ns(|| "s0"))?;
-        let ab = a.mul(cs.ns(|| "ab"), &b)?;
-        let s1 = ab.double(cs.ns(|| "s1"))?;
-        let s2 = a
-            .sub(cs.ns(|| "a-b"), &b)?
-            .add(cs.ns(|| "plus c"), &c)?
-            .square(cs.ns(|| "s2"))?;
-        let s3 = b.mul(cs.ns(|| "bc"), &c)?.double(cs.ns(|| "s3"))?;
-        let s4 = c.square(cs.ns(|| "s4"))?;
-
-        let c0 = Self::mul_fp_gadget_by_nonresidue(cs.ns(|| "c0 part 1"), &s3)?
-            .add(cs.ns(|| "c0"), &s0)?;
-
-        let c1 = Self::mul_fp_gadget_by_nonresidue(cs.ns(|| "c1 part 1"), &s4)?
-            .add(cs.ns(|| "c1"), &s1)?;
-
-        let c2 = s1
-            .add(cs.ns(|| "c2 part1"), &s2)?
-            .add(cs.ns(|| "c2 part2"), &s3)?
-            .sub(cs.ns(|| "c2 part3"), &s0)?
-            .sub(cs.ns(|| "c2 part4"), &s4)?;
-
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Fp3<P>,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.add_constant(cs.ns(|| "c0"), &other.c0)?;
-        let c1 = self.c1.add_constant(cs.ns(|| "c1"), &other.c1)?;
-        let c2 = self.c2.add_constant(cs.ns(|| "c2"), &other.c2)?;
-
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn add_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        other: &Fp3<P>,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.add_constant_in_place(cs.ns(|| "c0"), &other.c0)?;
-        self.c1.add_constant_in_place(cs.ns(|| "c1"), &other.c1)?;
-        self.c2.add_constant_in_place(cs.ns(|| "c2"), &other.c2)?;
-        Ok(self)
-    }
-
-    /// Use the Toom-Cook-3x method to compute multiplication.
-    #[inline]
-    fn mul_by_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Fp3<P>,
-    ) -> Result<Self, SynthesisError> {
-        // Uses Toom-Cook-3x multiplication from
-        //
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        //    Devegili, OhEigeartaigh, Scott, Dahab
-
-        // v0 = a(0)b(0)   = a0 * b0
-        let v0 = self.c0.mul_by_constant(cs.ns(|| "v0"), &other.c0)?;
-
-        // v1 = a(1)b(1)   = (a0 + a1 + a2)(b0 + b1 + b2)
-        let v1 = {
-            let mut v1_cs = cs.ns(|| "v1");
-            let mut a0_plus_a1_plus_a2 = self
-                .c0
-                .add(v1_cs.ns(|| "a0 + a1"), &self.c1)?
-                .add(v1_cs.ns(|| "a0 + a1 + a2"), &self.c2)?;
-            let b0_plus_b1_plus_b2 = other.c0 + &other.c1 + &other.c2;
-
-            a0_plus_a1_plus_a2.mul_by_constant_in_place(
-                v1_cs.ns(|| "(a0 + a1 + a2)*(b0 + b1 + b2)"),
-                &b0_plus_b1_plus_b2,
-            )?;
-            a0_plus_a1_plus_a2
-        };
-
-        // v2 = a(−1)b(−1) = (a0 − a1 + a2)(b0 − b1 + b2)
-        let mut v2 = {
-            let mut v2_cs = cs.ns(|| "v2");
-            let mut a0_minus_a1_plus_a2 = self
-                .c0
-                .sub(v2_cs.ns(|| "sub1"), &self.c1)?
-                .add(v2_cs.ns(|| "add2"), &self.c2)?;
-            let b0_minus_b1_plus_b2 = other.c0 - &other.c1 + &other.c2;
-            a0_minus_a1_plus_a2.mul_by_constant_in_place(
-                v2_cs.ns(|| "(a0 - a1 + a2)*(b0 - b1 + b2)"),
-                &b0_minus_b1_plus_b2,
-            )?;
-            a0_minus_a1_plus_a2
-        };
-
-        // v3 = a(2)b(2)   = (a0 + 2a1 + 4a2)(b0 + 2b1 + 4b2)
-        let mut v3 = {
-            let mut v3_cs = cs.ns(|| "v3");
-            let a1_double = self.c1.double(v3_cs.ns(|| "2a1"))?;
-            let a2_quad = self
-                .c2
-                .double(v3_cs.ns(|| "2a2"))?
-                .double(v3_cs.ns(|| "4a2"))?;
-            let mut a0_plus_2_a1_plus_4_a2 = self
-                .c0
-                .add(v3_cs.ns(|| "a0 + 2a1"), &a1_double)?
-                .add(v3_cs.ns(|| "a0 + 2a1 + 4a2"), &a2_quad)?;
-
-            let b1_double = other.c1.double();
-            let b2_quad = other.c2.double().double();
-            let b0_plus_2_b1_plus_4_b2 = other.c0 + &b1_double + &b2_quad;
-
-            a0_plus_2_a1_plus_4_a2.mul_by_constant_in_place(
-                v3_cs.ns(|| "(a0 + 2a1 + 4a2)*(b0 + 2b1 + 4b2)"),
-                &b0_plus_2_b1_plus_4_b2,
-            )?;
-            a0_plus_2_a1_plus_4_a2
-        };
-
-        // v4 = a(∞)b(∞)   = a2 * b2
-        let v4 = self.c2.mul_by_constant(cs.ns(|| "v4"), &other.c2)?;
-
-        let two = P::Fp::one().double();
-        let six = two.double() + &two;
-        let mut two_and_six = [two, six];
-        algebra::fields::batch_inversion(&mut two_and_six);
-        let (two_inverse, six_inverse) = (two_and_six[0], two_and_six[1]);
-
-        let mut half_v0 = v0.mul_by_constant(cs.ns(|| "half_v0"), &two_inverse)?;
-        let half_v1 = v1.mul_by_constant(cs.ns(|| "half_v1"), &two_inverse)?;
-        let mut one_sixth_v2 = v2.mul_by_constant(cs.ns(|| "v2_by_6"), &six_inverse)?;
-        let one_sixth_v3 = v3.mul_by_constant_in_place(cs.ns(|| "v3_by_6"), &six_inverse)?;
-        let two_v4 = v4.double(cs.ns(|| "2v4"))?;
-
-        // c0 = v0 + β((1/2)v0 − (1/2)v1 − (1/6)v2 + (1/6)v3 − 2v4)
-        let c0 = {
-            let mut c0_cs = cs.ns(|| "c0");
-
-            // No constraints, only get a linear combination back.
-            let mut inner = half_v0
-                .sub(c0_cs.ns(|| "sub1"), &half_v1)?
-                .sub(c0_cs.ns(|| "sub2"), &one_sixth_v2)?
-                .add(c0_cs.ns(|| "add3"), &one_sixth_v3)?
-                .sub(c0_cs.ns(|| "sub4"), &two_v4)?;
-            let non_residue_times_inner =
-                inner.mul_by_constant_in_place(&mut c0_cs, &P::NONRESIDUE)?;
-            v0.add(c0_cs.ns(|| "add5"), non_residue_times_inner)?
-        };
-
-        // −(1/2)v0 + v1 − (1/3)v2 − (1/6)v3 + 2v4 + βv4
-        let c1 = {
-            let mut c1_cs = cs.ns(|| "c1");
-            let one_third_v2 = one_sixth_v2.double_in_place(c1_cs.ns(|| "double1"))?;
-            let non_residue_v4 =
-                v4.mul_by_constant(c1_cs.ns(|| "mul_by_const1"), &P::NONRESIDUE)?;
-
-            half_v0
-                .negate_in_place(c1_cs.ns(|| "neg1"))?
-                .add(c1_cs.ns(|| "add1"), &v1)?
-                .sub(c1_cs.ns(|| "sub2"), one_third_v2)?
-                .sub(c1_cs.ns(|| "sub3"), &one_sixth_v3)?
-                .add(c1_cs.ns(|| "add4"), &two_v4)?
-                .add(c1_cs.ns(|| "add5"), &non_residue_v4)?
-        };
-
-        // -v0 + (1/2)v1 + (1/2)v2 −v4
-        let c2 = {
-            let mut c2_cs = cs.ns(|| "c2");
-            let half_v2 = v2.mul_by_constant_in_place(c2_cs.ns(|| "half_v2"), &two_inverse)?;
-            half_v1
-                .add(c2_cs.ns(|| "add1"), half_v2)?
-                .sub(c2_cs.ns(|| "sub2"), &v4)?
-                .sub(c2_cs.ns(|| "sub3"), &v0)?
-        };
-
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    fn frobenius_map<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
+impl<P: Fp3Parameters> CubicExtVarParams<FpVar<P::Fp>> for Fp3ParamsWrapper<P> {
+    fn mul_base_field_vars_by_frob_coeff(
+        c1: &mut FpVar<P::Fp>,
+        c2: &mut FpVar<P::Fp>,
         power: usize,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.frobenius_map_in_place(cs, power)?;
-        Ok(result)
-    }
-
-    fn frobenius_map_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        power: usize,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c1.mul_by_constant_in_place(
-            cs.ns(|| "c1_power"),
-            &P::FROBENIUS_COEFF_FP3_C1[power % 3],
-        )?;
-        self.c2.mul_by_constant_in_place(
-            cs.ns(|| "c2_power"),
-            &P::FROBENIUS_COEFF_FP3_C2[power % 3],
-        )?;
-
-        Ok(self)
-    }
-
-    fn cost_of_mul() -> usize {
-        5 * FpGadget::<ConstraintF>::cost_of_mul()
-    }
-
-    fn cost_of_mul_equals() -> usize {
-        6 * FpGadget::<ConstraintF>::cost_of_mul()
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField> PartialEq
-    for Fp3Gadget<P, ConstraintF>
-{
-    fn eq(&self, other: &Self) -> bool {
-        self.c0 == other.c0 && self.c1 == other.c1 && self.c2 == other.c2
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField> Eq
-    for Fp3Gadget<P, ConstraintF>
-{
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    EqGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    ConditionalEqGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn conditional_enforce_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        condition: &Boolean,
-    ) -> Result<(), SynthesisError> {
-        self.c0
-            .conditional_enforce_equal(&mut cs.ns(|| "c0"), &other.c0, condition)?;
-        self.c1
-            .conditional_enforce_equal(&mut cs.ns(|| "c1"), &other.c1, condition)?;
-        self.c2
-            .conditional_enforce_equal(&mut cs.ns(|| "c2"), &other.c2, condition)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        3 * <FpGadget<ConstraintF> as ConditionalEqGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    NEqGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn enforce_not_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<(), SynthesisError> {
-        self.c0.enforce_not_equal(&mut cs.ns(|| "c0"), &other.c0)?;
-        self.c1.enforce_not_equal(&mut cs.ns(|| "c1"), &other.c1)?;
-        self.c2.enforce_not_equal(&mut cs.ns(|| "c2"), &other.c2)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        3 * <FpGadget<ConstraintF> as NEqGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    ToBitsGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    fn to_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bits(cs.ns(|| "c1"))?;
-        let mut c2 = self.c2.to_bits(cs.ns(|| "c2"))?;
-
-        c0.append(&mut c1);
-        c0.append(&mut c2);
-
-        Ok(c0)
-    }
-
-    fn to_non_unique_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bits(cs.ns(|| "c1"))?;
-        let mut c2 = self.c2.to_non_unique_bits(cs.ns(|| "c2"))?;
-
-        c0.append(&mut c1);
-        c0.append(&mut c2);
-
-        Ok(c0)
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    ToBytesGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    fn to_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bytes(cs.ns(|| "c1"))?;
-        let mut c2 = self.c2.to_bytes(cs.ns(|| "c2"))?;
-
-        c0.append(&mut c1);
-        c0.append(&mut c2);
-
-        Ok(c0)
-    }
-
-    fn to_non_unique_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bytes(cs.ns(|| "c1"))?;
-        let mut c2 = self.c2.to_non_unique_bytes(cs.ns(|| "c2"))?;
-
-        c0.append(&mut c1);
-        c0.append(&mut c2);
-
-        Ok(c0)
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField> Clone
-    for Fp3Gadget<P, ConstraintF>
-{
-    fn clone(&self) -> Self {
-        Self::new(self.c0.clone(), self.c1.clone(), self.c2.clone())
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    CondSelectGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn conditionally_select<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        cond: &Boolean,
-        first: &Self,
-        second: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = FpGadget::<ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c0"),
-            cond,
-            &first.c0,
-            &second.c0,
-        )?;
-        let c1 = FpGadget::<ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c1"),
-            cond,
-            &first.c1,
-            &second.c1,
-        )?;
-        let c2 = FpGadget::<ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c2"),
-            cond,
-            &first.c2,
-            &second.c2,
-        )?;
-
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    fn cost() -> usize {
-        3 * <FpGadget<ConstraintF> as CondSelectGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    TwoBitLookupGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    type TableConstant = Fp3<P>;
-    fn two_bit_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c2s = c.iter().map(|f| f.c2).collect::<Vec<_>>();
-        let c0 = FpGadget::<ConstraintF>::two_bit_lookup(cs.ns(|| "Lookup c0"), b, &c0s)?;
-        let c1 = FpGadget::<ConstraintF>::two_bit_lookup(cs.ns(|| "Lookup c1"), b, &c1s)?;
-        let c2 = FpGadget::<ConstraintF>::two_bit_lookup(cs.ns(|| "Lookup c2"), b, &c2s)?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    fn cost() -> usize {
-        3 * <FpGadget<ConstraintF> as TwoBitLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    ThreeBitCondNegLookupGadget<ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    type TableConstant = Fp3<P>;
-
-    fn three_bit_cond_neg_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        b0b1: &Boolean,
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c2s = c.iter().map(|f| f.c2).collect::<Vec<_>>();
-        let c0 = FpGadget::<ConstraintF>::three_bit_cond_neg_lookup(
-            cs.ns(|| "Lookup c0"),
-            b,
-            b0b1,
-            &c0s,
-        )?;
-        let c1 = FpGadget::<ConstraintF>::three_bit_cond_neg_lookup(
-            cs.ns(|| "Lookup c1"),
-            b,
-            b0b1,
-            &c1s,
-        )?;
-        let c2 = FpGadget::<ConstraintF>::three_bit_cond_neg_lookup(
-            cs.ns(|| "Lookup c2"),
-            b,
-            b0b1,
-            &c2s,
-        )?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    fn cost() -> usize {
-        3 * <FpGadget<ConstraintF> as ThreeBitCondNegLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P: Fp3Parameters<Fp = ConstraintF>, ConstraintF: PrimeField + SquareRootField>
-    AllocGadget<Fp3<P>, ConstraintF> for Fp3Gadget<P, ConstraintF>
-{
-    #[inline]
-    fn alloc_constant<T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        t: T,
-    ) -> Result<Self, SynthesisError>
-    where
-        T: Borrow<Fp3<P>>,
-    {
-        Self::zero(cs.ns(|| "zero"))?.add_constant(cs.ns(|| "add constant"), t.borrow())
-    }
-
-    #[inline]
-    fn alloc<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp3<P>>,
-    {
-        let (c0, c1, c2) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1), Ok(fe.c2))
-            }
-            _ => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = FpGadget::<ConstraintF>::alloc(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = FpGadget::<ConstraintF>::alloc(&mut cs.ns(|| "c1"), || c1)?;
-        let c2 = FpGadget::<ConstraintF>::alloc(&mut cs.ns(|| "c2"), || c2)?;
-        Ok(Self::new(c0, c1, c2))
-    }
-
-    #[inline]
-    fn alloc_input<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp3<P>>,
-    {
-        let (c0, c1, c2) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1), Ok(fe.c2))
-            }
-            _ => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = FpGadget::<ConstraintF>::alloc_input(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = FpGadget::<ConstraintF>::alloc_input(&mut cs.ns(|| "c1"), || c1)?;
-        let c2 = FpGadget::<ConstraintF>::alloc_input(&mut cs.ns(|| "c2"), || c2)?;
-        Ok(Self::new(c0, c1, c2))
+    ) {
+        *c1 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
+        *c2 *= Self::FROBENIUS_COEFF_C2[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
     }
 }

r1cs-std/src/fields/fp4.rs

@@ -1,757 +1,11 @@
-use algebra::{
-    fields::{Fp2, Fp2Parameters, Fp4, Fp4Parameters},
-    BigInteger, PrimeField,
-};
-use core::{borrow::Borrow, marker::PhantomData};
-use r1cs_core::{ConstraintSystem, SynthesisError};
+use crate::fields::{fp2::Fp2Var, quadratic_extension::*};
+use algebra::fields::{Fp4Parameters, Fp4ParamsWrapper, QuadExtParameters};
 
-use crate::{prelude::*, Vec};
+pub type Fp4Var<P> = QuadExtVar<Fp2Var<<P as Fp4Parameters>::Fp2Params>, Fp4ParamsWrapper<P>>;
 
-type Fp2Gadget<P, ConstraintF> =
-    super::fp2::Fp2Gadget<<P as Fp4Parameters>::Fp2Params, ConstraintF>;
-type Fp2GadgetVariable<P, ConstraintF> = <Fp2Gadget<P, ConstraintF> as FieldGadget<
-    Fp2<<P as Fp4Parameters>::Fp2Params>,
-    ConstraintF,
->>::Variable;
-
-#[derive(Derivative)]
-#[derivative(Debug(bound = "ConstraintF: PrimeField"))]
-#[must_use]
-pub struct Fp4Gadget<P, ConstraintF: PrimeField>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    pub c0: Fp2Gadget<P, ConstraintF>,
-    pub c1: Fp2Gadget<P, ConstraintF>,
-    #[derivative(Debug = "ignore")]
-    _params: PhantomData<P>,
-}
-
-impl<P, ConstraintF: PrimeField> ToConstraintFieldGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    fn to_constraint_field<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<FpGadget<ConstraintF>>, SynthesisError> {
-        let mut res = Vec::new();
-
-        let mut c0_gadget = self.c0.to_constraint_field(&mut cs.ns(|| "c0"))?;
-        let mut c1_gadget = self.c1.to_constraint_field(&mut cs.ns(|| "c1"))?;
-
-        res.append(&mut c0_gadget);
-        res.append(&mut c1_gadget);
-
-        Ok(res)
-    }
-}
-
-impl<P, ConstraintF: PrimeField> Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    pub fn new(c0: Fp2Gadget<P, ConstraintF>, c1: Fp2Gadget<P, ConstraintF>) -> Self {
-        Self {
-            c0,
-            c1,
-            _params: PhantomData,
-        }
-    }
-
-    /// Multiply a Fp2Gadget by quadratic nonresidue P::NONRESIDUE.
-    #[inline]
-    pub fn mul_fp2_gadget_by_nonresidue<CS: ConstraintSystem<ConstraintF>>(
-        cs: CS,
-        fe: &Fp2Gadget<P, ConstraintF>,
-    ) -> Result<Fp2Gadget<P, ConstraintF>, SynthesisError> {
-        let new_c0 = Fp2Gadget::<P, ConstraintF>::mul_fp_gadget_by_nonresidue(cs, &fe.c1)?;
-        let new_c1 = fe.c0.clone();
-        Ok(Fp2Gadget::<P, ConstraintF>::new(new_c0, new_c1))
-    }
-
-    /// Multiply a Fp4Gadget by an element of fp.
-    #[inline]
-    pub fn mul_by_fp_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        fe: &<<P as Fp4Parameters>::Fp2Params as Fp2Parameters>::Fp,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.mul_by_fp_constant_in_place(cs.ns(|| "c0"), fe)?;
-        self.c1.mul_by_fp_constant_in_place(cs.ns(|| "c1"), fe)?;
-        Ok(self)
-    }
-
-    /// Multiply a Fp4Gadget by an element of fp.
-    #[inline]
-    pub fn mul_by_fp_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        fe: &<<P as Fp4Parameters>::Fp2Params as Fp2Parameters>::Fp,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.mul_by_fp_constant_in_place(cs, fe)?;
-        Ok(result)
-    }
-
-    pub fn unitary_inverse<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        Ok(Self::new(self.c0.clone(), self.c1.negate(cs)?))
-    }
-
-    #[inline]
-    pub fn cyclotomic_exp<CS: ConstraintSystem<ConstraintF>, B: BigInteger>(
-        &self,
-        mut cs: CS,
-        exponent: &B,
-    ) -> Result<Self, SynthesisError> {
-        let mut res = Self::one(cs.ns(|| "one"))?;
-        let self_inverse = self.unitary_inverse(cs.ns(|| "unitary inverse"))?;
-
-        let mut found_nonzero = false;
-        let naf = exponent.find_wnaf();
-
-        for (i, &value) in naf.iter().rev().enumerate() {
-            if found_nonzero {
-                res.square_in_place(cs.ns(|| format!("square {}", i)))?;
-            }
-
-            if value != 0 {
-                found_nonzero = true;
-
-                if value > 0 {
-                    res.mul_in_place(cs.ns(|| format!("res *= self {}", i)), &self)?;
-                } else {
-                    res.mul_in_place(
-                        cs.ns(|| format!("res *= self_inverse {}", i)),
-                        &self_inverse,
-                    )?;
-                }
-            }
-        }
-
-        Ok(res)
-    }
-}
-
-impl<P, ConstraintF: PrimeField> FieldGadget<Fp4<P>, ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    type Variable = (
-        Fp2GadgetVariable<P, ConstraintF>,
-        Fp2GadgetVariable<P, ConstraintF>,
-    );
-
-    #[inline]
-    fn get_value(&self) -> Option<Fp4<P>> {
-        match (self.c0.get_value(), self.c1.get_value()) {
-            (Some(c0), Some(c1)) => Some(Fp4::new(c0, c1)),
-            (..) => None,
-        }
-    }
-
-    #[inline]
-    fn get_variable(&self) -> Self::Variable {
-        (self.c0.get_variable(), self.c1.get_variable())
-    }
-
-    #[inline]
-    fn zero<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = Fp2Gadget::<P, ConstraintF>::zero(cs.ns(|| "c0"))?;
-        let c1 = Fp2Gadget::<P, ConstraintF>::zero(cs.ns(|| "c1"))?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn one<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = Fp2Gadget::<P, ConstraintF>::one(cs.ns(|| "c0"))?;
-        let c1 = Fp2Gadget::<P, ConstraintF>::zero(cs.ns(|| "c1"))?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn conditionally_add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        bit: &Boolean,
-        coeff: Fp4<P>,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self
-            .c0
-            .conditionally_add_constant(cs.ns(|| "c0"), bit, coeff.c0)?;
-        let c1 = self
-            .c1
-            .conditionally_add_constant(cs.ns(|| "c1"), bit, coeff.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn add<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.add(&mut cs.ns(|| "add c0"), &other.c0)?;
-        let c1 = self.c1.add(&mut cs.ns(|| "add c1"), &other.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn sub<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.sub(&mut cs.ns(|| "sub c0"), &other.c0)?;
-        let c1 = self.c1.sub(&mut cs.ns(|| "sub c1"), &other.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn double<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.double_in_place(cs)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn double_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.double_in_place(&mut cs.ns(|| "double c0"))?;
-        self.c1.double_in_place(&mut cs.ns(|| "double c1"))?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn negate<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.negate_in_place(cs)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn negate_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.negate_in_place(&mut cs.ns(|| "negate c0"))?;
-        self.c1.negate_in_place(&mut cs.ns(|| "negate c1"))?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn mul<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        // Karatsuba multiplication for Fp4:
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     result.c0 = v0 + non_residue * v1
-        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
-        // Enforced with 3 constraints:
-        //     A.c1 * B.c1 = v1
-        //     A.c0 * B.c0 = result.c0 - non_residue * v1
-        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        // Devegili, OhEigeartaigh, Scott, Dahab
-        let mul_cs = &mut cs.ns(|| "mul");
-
-        let v0 = self.c0.mul(mul_cs.ns(|| "v0"), &other.c0)?;
-        let v1 = self.c1.mul(mul_cs.ns(|| "v1"), &other.c1)?;
-        let c0 = {
-            let non_residue_times_v1 =
-                Self::mul_fp2_gadget_by_nonresidue(mul_cs.ns(|| "first mul_by_nr"), &v1)?;
-            v0.add(mul_cs.ns(|| "v0 + beta * v1"), &non_residue_times_v1)?
-        };
-        let c1 = {
-            let a0_plus_a1 = self.c0.add(mul_cs.ns(|| "a0 + a1"), &self.c1)?;
-            let b0_plus_b1 = other.c0.add(mul_cs.ns(|| "b0 + b1"), &other.c1)?;
-            let a0_plus_a1_times_b0_plus_b1 =
-                a0_plus_a1.mul(&mut mul_cs.ns(|| "(a0 + a1) * (b0 + b1)"), &b0_plus_b1)?;
-            a0_plus_a1_times_b0_plus_b1
-                .sub(mul_cs.ns(|| "res - v0"), &v0)?
-                .sub(mul_cs.ns(|| "res - v0 - v1"), &v1)?
-        };
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn square<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        // From Libsnark/fp4_gadget.tcc
-        // Complex multiplication for Fp4:
-        //     v0 = A.c0 * A.c1
-        //     result.c0 = (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) - (1 +
-        // non_residue) * v0     result.c1 = 2 * v0
-        // Enforced with 2 constraints:
-        //     (2*A.c0) * A.c1 = result.c1
-        //     (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) = result.c0 + result.c1 * (1
-        // + non_residue)/2 Reference:
-        //     "Multiplication and Squaring on Pairing-Friendly Fields"
-        //     Devegili, OhEigeartaigh, Scott, Dahab
-
-        let mut v0 = self.c0.mul(cs.ns(|| "v0"), &self.c1)?;
-        let a0_plus_a1 = self.c0.add(cs.ns(|| "a0 + a1"), &self.c1)?;
-
-        let non_residue_c1 =
-            Self::mul_fp2_gadget_by_nonresidue(cs.ns(|| "non_residue * a1"), &self.c1)?;
-        let a0_plus_non_residue_c1 = self
-            .c0
-            .add(cs.ns(|| "a0 + non_residue * a1"), &non_residue_c1)?;
-        let one_plus_non_residue_v0 =
-            Self::mul_fp2_gadget_by_nonresidue(cs.ns(|| "non_residue * v0"), &v0)?
-                .add(cs.ns(|| "plus v0"), &v0)?;
-
-        let c0 = a0_plus_a1
-            .mul(
-                cs.ns(|| "(a0 + a1) * (a0 + non_residue * a1)"),
-                &a0_plus_non_residue_c1,
-            )?
-            .sub(cs.ns(|| "- (1 + non_residue) v0"), &one_plus_non_residue_v0)?;
-
-        v0.double_in_place(cs.ns(|| "2v0"))?;
-        let c1 = v0;
-
-        Ok(Self::new(c0, c1))
-    }
-
-    fn mul_equals<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        result: &Self,
-    ) -> Result<(), SynthesisError> {
-        // Karatsuba multiplication for Fp4:
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     result.c0 = v0 + non_residue * v1
-        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
-        // Enforced with 3 constraints:
-        //     A.c1 * B.c1 = v1
-        //     A.c0 * B.c0 = result.c0 - non_residue * v1
-        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        // Devegili, OhEigeartaigh, Scott, Dahab
-        let mul_cs = &mut cs.ns(|| "mul");
-
-        // Compute v1
-        let mut v1 = self.c1.mul(mul_cs.ns(|| "v1"), &other.c1)?;
-
-        // Perform second check
-        let non_residue_times_v1 =
-            Self::mul_fp2_gadget_by_nonresidue(mul_cs.ns(|| "nr * v1"), &v1)?;
-        let rhs = result
-            .c0
-            .sub(mul_cs.ns(|| "sub from result.c0"), &non_residue_times_v1)?;
-        self.c0
-            .mul_equals(mul_cs.ns(|| "second check"), &other.c0, &rhs)?;
-
-        // Last check
-        let a0_plus_a1 = self.c0.add(mul_cs.ns(|| "a0 + a1"), &self.c1)?;
-        let b0_plus_b1 = other.c0.add(mul_cs.ns(|| "b0 + b1"), &other.c1)?;
-        let one_minus_non_residue_v1 =
-            v1.sub_in_place(mul_cs.ns(|| "sub from v1"), &non_residue_times_v1)?;
-
-        let result_c1_plus_result_c0_plus_one_minus_non_residue_v1 = result
-            .c1
-            .add(mul_cs.ns(|| "c1 + c0"), &result.c0)?
-            .add(mul_cs.ns(|| "rest of stuff"), one_minus_non_residue_v1)?;
-
-        a0_plus_a1.mul_equals(
-            mul_cs.ns(|| "third check"),
-            &b0_plus_b1,
-            &result_c1_plus_result_c0_plus_one_minus_non_residue_v1,
-        )?;
-
-        Ok(())
-    }
-
-    fn frobenius_map<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        power: usize,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        let _ = result.frobenius_map_in_place(cs, power)?;
-        Ok(result)
-    }
-
-    fn frobenius_map_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        power: usize,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0
-            .frobenius_map_in_place(cs.ns(|| "frob_map1"), power)?;
-        self.c1
-            .frobenius_map_in_place(cs.ns(|| "frob_map2"), power)?;
-        self.c1
-            .mul_by_fp_constant_in_place(cs.ns(|| "mul"), &P::FROBENIUS_COEFF_FP4_C1[power % 4])?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        other: &Fp4<P>,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        let _ = result.add_constant_in_place(cs, other)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn add_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        other: &Fp4<P>,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.add_constant_in_place(cs.ns(|| "c0"), &other.c0)?;
-        self.c1.add_constant_in_place(cs.ns(|| "c1"), &other.c1)?;
-        Ok(self)
-    }
-
-    fn mul_by_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        fe: &Fp4<P>,
-    ) -> Result<Self, SynthesisError> {
-        // Karatsuba multiplication (see mul above).
-        // Doesn't need any constraints; returns linear combinations of
-        // `self`'s variables.
-        //
-        // (The operations below are guaranteed to return linear combinations)
-        let (a0, a1) = (&self.c0, &self.c1);
-        let (b0, b1) = (fe.c0, fe.c1);
-        let mut v0 = a0.mul_by_constant(&mut cs.ns(|| "v0"), &b0)?;
-        let mut v1 = Self::mul_fp2_gadget_by_nonresidue(&mut cs.ns(|| "v1"), a1)?;
-        let beta_v1 = v1.mul_by_constant_in_place(&mut cs.ns(|| "beta * v1"), &b1)?;
-
-        v0.add_in_place(&mut cs.ns(|| "c0"), &beta_v1)?;
-        let c0 = v0;
-
-        let mut a0b1 = a0.mul_by_constant(&mut cs.ns(|| "a0b1"), &b1)?;
-        let a1b0 = a1.mul_by_constant(&mut cs.ns(|| "a1b0"), &b0)?;
-        a0b1.add_in_place(&mut cs.ns(|| "c1"), &a1b0)?;
-        let c1 = a0b1;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost_of_mul() -> usize {
-        3 * Fp2Gadget::<P, ConstraintF>::cost_of_mul()
-    }
-
-    fn cost_of_mul_equals() -> usize {
-        Self::cost_of_mul()
-    }
-}
-
-impl<P, ConstraintF: PrimeField> PartialEq for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    fn eq(&self, other: &Self) -> bool {
-        self.c0 == other.c0 && self.c1 == other.c1
-    }
-}
-
-impl<P, ConstraintF: PrimeField> Eq for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-}
-
-impl<P, ConstraintF: PrimeField> EqGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-}
-
-impl<P, ConstraintF: PrimeField> ConditionalEqGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn conditional_enforce_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        condition: &Boolean,
-    ) -> Result<(), SynthesisError> {
-        self.c0
-            .conditional_enforce_equal(&mut cs.ns(|| "c0"), &other.c0, condition)?;
-        self.c1
-            .conditional_enforce_equal(&mut cs.ns(|| "c1"), &other.c1, condition)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        2 * <Fp2Gadget<P, ConstraintF> as ConditionalEqGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField> NEqGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn enforce_not_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<(), SynthesisError> {
-        self.c0.enforce_not_equal(&mut cs.ns(|| "c0"), &other.c0)?;
-        self.c1.enforce_not_equal(&mut cs.ns(|| "c1"), &other.c1)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        2 * <Fp2Gadget<P, ConstraintF> as NEqGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField> ToBitsGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    fn to_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bits(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-
-    fn to_non_unique_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bits(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-}
-
-impl<P, ConstraintF: PrimeField> ToBytesGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    fn to_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bytes(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-
-    fn to_non_unique_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bytes(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-}
-
-impl<P, ConstraintF: PrimeField> Clone for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    fn clone(&self) -> Self {
-        Self {
-            c0: self.c0.clone(),
-            c1: self.c1.clone(),
-            _params: PhantomData,
-        }
-    }
-}
-
-impl<P, ConstraintF: PrimeField> CondSelectGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn conditionally_select<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        cond: &Boolean,
-        first: &Self,
-        second: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = Fp2Gadget::<P, ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c0"),
-            cond,
-            &first.c0,
-            &second.c0,
-        )?;
-        let c1 = Fp2Gadget::<P, ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c1"),
-            cond,
-            &first.c1,
-            &second.c1,
-        )?;
-
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <Fp2Gadget<P, ConstraintF> as CondSelectGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField> TwoBitLookupGadget<ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    type TableConstant = Fp4<P>;
-    fn two_bit_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c0 = Fp2Gadget::<P, ConstraintF>::two_bit_lookup(cs.ns(|| "Lookup c0"), b, &c0s)?;
-        let c1 = Fp2Gadget::<P, ConstraintF>::two_bit_lookup(cs.ns(|| "Lookup c1"), b, &c1s)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <Fp2Gadget<P, ConstraintF> as TwoBitLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField> ThreeBitCondNegLookupGadget<ConstraintF>
-    for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    type TableConstant = Fp4<P>;
-
-    fn three_bit_cond_neg_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        b0b1: &Boolean,
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c0 = Fp2Gadget::<P, ConstraintF>::three_bit_cond_neg_lookup(
-            cs.ns(|| "Lookup c0"),
-            b,
-            b0b1,
-            &c0s,
-        )?;
-        let c1 = Fp2Gadget::<P, ConstraintF>::three_bit_cond_neg_lookup(
-            cs.ns(|| "Lookup c1"),
-            b,
-            b0b1,
-            &c1s,
-        )?;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <Fp2Gadget<P, ConstraintF> as ThreeBitCondNegLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField> AllocGadget<Fp4<P>, ConstraintF> for Fp4Gadget<P, ConstraintF>
-where
-    P: Fp4Parameters,
-    P::Fp2Params: Fp2Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn alloc_constant<T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        t: T,
-    ) -> Result<Self, SynthesisError>
-    where
-        T: Borrow<Fp4<P>>,
-    {
-        Self::zero(cs.ns(|| "zero"))?.add_constant(cs.ns(|| "add constant"), t.borrow())
-    }
-
-    #[inline]
-    fn alloc<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp4<P>>,
-    {
-        let (c0, c1) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1))
-            }
-            Err(_) => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = Fp2Gadget::<P, ConstraintF>::alloc(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = Fp2Gadget::<P, ConstraintF>::alloc(&mut cs.ns(|| "c1"), || c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn alloc_input<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp4<P>>,
-    {
-        let (c0, c1) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1))
-            }
-            Err(_) => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = Fp2Gadget::<P, ConstraintF>::alloc_input(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = Fp2Gadget::<P, ConstraintF>::alloc_input(&mut cs.ns(|| "c1"), || c1)?;
-        Ok(Self::new(c0, c1))
+impl<P: Fp4Parameters> QuadExtVarParams<Fp2Var<P::Fp2Params>> for Fp4ParamsWrapper<P> {
+    fn mul_base_field_var_by_frob_coeff(fe: &mut Fp2Var<P::Fp2Params>, power: usize) {
+        fe.c0 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
+        fe.c1 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
     }
 }

r1cs-std/src/fields/fp6_2over3.rs

@@ -1,749 +1,12 @@
-use algebra::{
-    fields::{
-        fp6_2over3::{Fp6, Fp6Parameters},
-        Fp3, Fp3Parameters,
-    },
-    BigInteger, PrimeField, SquareRootField,
-};
-use core::{borrow::Borrow, marker::PhantomData};
-use r1cs_core::{ConstraintSystem, SynthesisError};
+use crate::fields::{fp3::Fp3Var, quadratic_extension::*};
+use algebra::fields::{fp6_2over3::*, QuadExtParameters};
 
-use crate::{prelude::*, Vec};
+pub type Fp6Var<P> = QuadExtVar<Fp3Var<<P as Fp6Parameters>::Fp3Params>, Fp6ParamsWrapper<P>>;
 
-type Fp3Gadget<P, ConstraintF> =
-    super::fp3::Fp3Gadget<<P as Fp6Parameters>::Fp3Params, ConstraintF>;
-type Fp3GadgetVariable<P, ConstraintF> = <Fp3Gadget<P, ConstraintF> as FieldGadget<
-    Fp3<<P as Fp6Parameters>::Fp3Params>,
-    ConstraintF,
->>::Variable;
-
-#[derive(Derivative)]
-#[derivative(Debug(bound = "ConstraintF: PrimeField + SquareRootField"))]
-#[must_use]
-pub struct Fp6Gadget<P, ConstraintF: PrimeField + SquareRootField>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    pub c0: Fp3Gadget<P, ConstraintF>,
-    pub c1: Fp3Gadget<P, ConstraintF>,
-    #[derivative(Debug = "ignore")]
-    _params: PhantomData<P>,
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> ToConstraintFieldGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    fn to_constraint_field<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<FpGadget<ConstraintF>>, SynthesisError> {
-        let mut res = Vec::new();
-
-        let mut c0_gadget = self.c0.to_constraint_field(&mut cs.ns(|| "c0"))?;
-        let mut c1_gadget = self.c1.to_constraint_field(&mut cs.ns(|| "c1"))?;
-
-        res.append(&mut c0_gadget);
-        res.append(&mut c1_gadget);
-
-        Ok(res)
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    pub fn new(c0: Fp3Gadget<P, ConstraintF>, c1: Fp3Gadget<P, ConstraintF>) -> Self {
-        Self {
-            c0,
-            c1,
-            _params: PhantomData,
-        }
-    }
-
-    /// Multiply a Fp3Gadget by quadratic nonresidue P::NONRESIDUE.
-    #[inline]
-    pub fn mul_fp3_gadget_by_nonresidue<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        fe: &Fp3Gadget<P, ConstraintF>,
-    ) -> Result<Fp3Gadget<P, ConstraintF>, SynthesisError> {
-        let mut res = Fp3Gadget::<P, ConstraintF>::new(fe.c2.clone(), fe.c0.clone(), fe.c1.clone());
-        res.c0.mul_by_constant_in_place(
-            cs.ns(|| "res * non_residue"),
-            &<P::Fp3Params as Fp3Parameters>::NONRESIDUE,
-        )?;
-        Ok(res)
-    }
-
-    pub fn unitary_inverse<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        Ok(Self::new(self.c0.clone(), self.c1.negate(cs)?))
-    }
-
-    #[inline]
-    pub fn cyclotomic_exp<CS: ConstraintSystem<ConstraintF>, B: BigInteger>(
-        &self,
-        mut cs: CS,
-        exponent: &B,
-    ) -> Result<Self, SynthesisError> {
-        let mut res = Self::one(cs.ns(|| "one"))?;
-        let self_inverse = self.unitary_inverse(cs.ns(|| "unitary inverse"))?;
-
-        let mut found_nonzero = false;
-        let naf = exponent.find_wnaf();
-
-        for (i, &value) in naf.iter().rev().enumerate() {
-            if found_nonzero {
-                res.square_in_place(cs.ns(|| format!("square {}", i)))?;
-            }
-
-            if value != 0 {
-                found_nonzero = true;
-
-                if value > 0 {
-                    res.mul_in_place(cs.ns(|| format!("res *= self {}", i)), &self)?;
-                } else {
-                    res.mul_in_place(
-                        cs.ns(|| format!("res *= self_inverse {}", i)),
-                        &self_inverse,
-                    )?;
-                }
-            }
-        }
-
-        Ok(res)
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> FieldGadget<Fp6<P>, ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    type Variable = (
-        Fp3GadgetVariable<P, ConstraintF>,
-        Fp3GadgetVariable<P, ConstraintF>,
-    );
-
-    #[inline]
-    fn get_value(&self) -> Option<Fp6<P>> {
-        match (self.c0.get_value(), self.c1.get_value()) {
-            (Some(c0), Some(c1)) => Some(Fp6::new(c0, c1)),
-            (..) => None,
-        }
-    }
-
-    #[inline]
-    fn get_variable(&self) -> Self::Variable {
-        (self.c0.get_variable(), self.c1.get_variable())
-    }
-
-    #[inline]
-    fn zero<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = Fp3Gadget::<P, ConstraintF>::zero(cs.ns(|| "c0"))?;
-        let c1 = Fp3Gadget::<P, ConstraintF>::zero(cs.ns(|| "c1"))?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn one<CS: ConstraintSystem<ConstraintF>>(mut cs: CS) -> Result<Self, SynthesisError> {
-        let c0 = Fp3Gadget::<P, ConstraintF>::one(cs.ns(|| "c0"))?;
-        let c1 = Fp3Gadget::<P, ConstraintF>::zero(cs.ns(|| "c1"))?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn conditionally_add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        bit: &Boolean,
-        coeff: Fp6<P>,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self
-            .c0
-            .conditionally_add_constant(cs.ns(|| "c0"), bit, coeff.c0)?;
-        let c1 = self
-            .c1
-            .conditionally_add_constant(cs.ns(|| "c1"), bit, coeff.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn add<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.add(&mut cs.ns(|| "add c0"), &other.c0)?;
-        let c1 = self.c1.add(&mut cs.ns(|| "add c1"), &other.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn sub<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = self.c0.sub(&mut cs.ns(|| "sub c0"), &other.c0)?;
-        let c1 = self.c1.sub(&mut cs.ns(|| "sub c1"), &other.c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn double<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.double_in_place(cs)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn double_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.double_in_place(&mut cs.ns(|| "double c0"))?;
-        self.c1.double_in_place(&mut cs.ns(|| "double c1"))?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn negate<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        result.negate_in_place(cs)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn negate_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.negate_in_place(&mut cs.ns(|| "negate c0"))?;
-        self.c1.negate_in_place(&mut cs.ns(|| "negate c1"))?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn mul<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<Self, SynthesisError> {
-        // Karatsuba multiplication for Fp6:
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     result.c0 = v0 + non_residue * v1
-        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
-        // Enforced with 3 constraints:
-        //     A.c1 * B.c1 = v1
-        //     A.c0 * B.c0 = result.c0 - non_residue * v1
-        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        // Devegili, OhEigeartaigh, Scott, Dahab
-        let mul_cs = &mut cs.ns(|| "mul");
-
-        let v0 = self.c0.mul(mul_cs.ns(|| "v0"), &other.c0)?;
-        let v1 = self.c1.mul(mul_cs.ns(|| "v1"), &other.c1)?;
-        let c0 = {
-            let non_residue_times_v1 =
-                Self::mul_fp3_gadget_by_nonresidue(mul_cs.ns(|| "first mul_by_nr"), &v1)?;
-            v0.add(mul_cs.ns(|| "v0 + beta * v1"), &non_residue_times_v1)?
-        };
-        let c1 = {
-            let a0_plus_a1 = self.c0.add(mul_cs.ns(|| "a0 + a1"), &self.c1)?;
-            let b0_plus_b1 = other.c0.add(mul_cs.ns(|| "b0 + b1"), &other.c1)?;
-            let a0_plus_a1_times_b0_plus_b1 =
-                a0_plus_a1.mul(&mut mul_cs.ns(|| "(a0 + a1) * (b0 + b1)"), &b0_plus_b1)?;
-            a0_plus_a1_times_b0_plus_b1
-                .sub(mul_cs.ns(|| "res - v0"), &v0)?
-                .sub(mul_cs.ns(|| "res - v0 - v1"), &v1)?
-        };
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn square<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        // From Libsnark/fp4_gadget.tcc
-        // Complex multiplication for Fp6:
-        //     v0 = A.c0 * A.c1
-        //     result.c0 = (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) - (1 +
-        // non_residue) * v0     result.c1 = 2 * v0
-        // Enforced with 2 constraints:
-        //     (2*A.c0) * A.c1 = result.c1
-        //     (A.c0 + A.c1) * (A.c0 + non_residue * A.c1) = result.c0 + result.c1 * (1
-        // + non_residue)/2 Reference:
-        //     "Multiplication and Squaring on Pairing-Friendly Fields"
-        //     Devegili, OhEigeartaigh, Scott, Dahab
-
-        let mut v0 = self.c0.mul(cs.ns(|| "v0"), &self.c1)?;
-        let a0_plus_a1 = self.c0.add(cs.ns(|| "a0 + a1"), &self.c1)?;
-
-        let non_residue_c1 =
-            Self::mul_fp3_gadget_by_nonresidue(cs.ns(|| "non_residue * a1"), &self.c1)?;
-        let a0_plus_non_residue_c1 = self
-            .c0
-            .add(cs.ns(|| "a0 + non_residue * a1"), &non_residue_c1)?;
-        let one_plus_non_residue_v0 =
-            Self::mul_fp3_gadget_by_nonresidue(cs.ns(|| "non_residue * v0"), &v0)?
-                .add(cs.ns(|| "plus v0"), &v0)?;
-
-        let c0 = a0_plus_a1
-            .mul(
-                cs.ns(|| "(a0 + a1) * (a0 + non_residue * a1)"),
-                &a0_plus_non_residue_c1,
-            )?
-            .sub(cs.ns(|| "- (1 + non_residue) v0"), &one_plus_non_residue_v0)?;
-
-        v0.double_in_place(cs.ns(|| "2v0"))?;
-        let c1 = v0;
-
-        Ok(Self::new(c0, c1))
-    }
-
-    fn mul_equals<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        result: &Self,
-    ) -> Result<(), SynthesisError> {
-        // Karatsuba multiplication for Fp6:
-        //     v0 = A.c0 * B.c0
-        //     v1 = A.c1 * B.c1
-        //     result.c0 = v0 + non_residue * v1
-        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
-        // Enforced with 3 constraints:
-        //     A.c1 * B.c1 = v1
-        //     A.c0 * B.c0 = result.c0 - non_residue * v1
-        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
-        // Reference:
-        // "Multiplication and Squaring on Pairing-Friendly Fields"
-        // Devegili, OhEigeartaigh, Scott, Dahab
-        let mul_cs = &mut cs.ns(|| "mul");
-
-        // Compute v1
-        let mut v1 = self.c1.mul(mul_cs.ns(|| "v1"), &other.c1)?;
-
-        // Perform second check
-        let non_residue_times_v1 =
-            Self::mul_fp3_gadget_by_nonresidue(mul_cs.ns(|| "nr * v1"), &v1)?;
-        let rhs = result
-            .c0
-            .sub(mul_cs.ns(|| "sub from result.c0"), &non_residue_times_v1)?;
-        self.c0
-            .mul_equals(mul_cs.ns(|| "second check"), &other.c0, &rhs)?;
-
-        // Last check
-        let a0_plus_a1 = self.c0.add(mul_cs.ns(|| "a0 + a1"), &self.c1)?;
-        let b0_plus_b1 = other.c0.add(mul_cs.ns(|| "b0 + b1"), &other.c1)?;
-        let one_minus_non_residue_v1 =
-            v1.sub_in_place(mul_cs.ns(|| "sub from v1"), &non_residue_times_v1)?;
-
-        let result_c1_plus_result_c0_plus_one_minus_non_residue_v1 = result
-            .c1
-            .add(mul_cs.ns(|| "c1 + c0"), &result.c0)?
-            .add(mul_cs.ns(|| "rest of stuff"), one_minus_non_residue_v1)?;
-
-        a0_plus_a1.mul_equals(
-            mul_cs.ns(|| "third check"),
-            &b0_plus_b1,
-            &result_c1_plus_result_c0_plus_one_minus_non_residue_v1,
-        )?;
-
-        Ok(())
-    }
-
-    fn frobenius_map<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        power: usize,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        let _ = result.frobenius_map_in_place(cs, power)?;
-        Ok(result)
-    }
-
-    fn frobenius_map_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        power: usize,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0
-            .frobenius_map_in_place(cs.ns(|| "frob_map1"), power)?;
-        self.c1
-            .frobenius_map_in_place(cs.ns(|| "frob_map2"), power)?;
-        self.c1
-            .mul_by_fp_constant_in_place(cs.ns(|| "mul"), &P::FROBENIUS_COEFF_FP6_C1[power % 6])?;
-        Ok(self)
-    }
-
-    #[inline]
-    fn add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        other: &Fp6<P>,
-    ) -> Result<Self, SynthesisError> {
-        let mut result = self.clone();
-        let _ = result.add_constant_in_place(cs, other)?;
-        Ok(result)
-    }
-
-    #[inline]
-    fn add_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        mut cs: CS,
-        other: &Fp6<P>,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.c0.add_constant_in_place(cs.ns(|| "c0"), &other.c0)?;
-        self.c1.add_constant_in_place(cs.ns(|| "c1"), &other.c1)?;
-        Ok(self)
-    }
-
-    fn mul_by_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        fe: &Fp6<P>,
-    ) -> Result<Self, SynthesisError> {
-        // Karatsuba multiplication (see mul above).
-        // Doesn't need any constraints; returns linear combinations of
-        // `self`'s variables.
-        //
-        // (The operations below are guaranteed to return linear combinations)
-        let (a0, a1) = (&self.c0, &self.c1);
-        let (b0, b1) = (fe.c0, fe.c1);
-        let mut v0 = a0.mul_by_constant(&mut cs.ns(|| "v0"), &b0)?;
-        let mut v1 = Self::mul_fp3_gadget_by_nonresidue(&mut cs.ns(|| "v1"), a1)?;
-        let beta_v1 = v1.mul_by_constant_in_place(&mut cs.ns(|| "beta * v1"), &b1)?;
-
-        v0.add_in_place(&mut cs.ns(|| "c0"), &beta_v1)?;
-        let c0 = v0;
-
-        let mut a0b1 = a0.mul_by_constant(&mut cs.ns(|| "a0b1"), &b1)?;
-        let a1b0 = a1.mul_by_constant(&mut cs.ns(|| "a1b0"), &b0)?;
-        a0b1.add_in_place(&mut cs.ns(|| "c1"), &a1b0)?;
-        let c1 = a0b1;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost_of_mul() -> usize {
-        2 * Fp3Gadget::<P, ConstraintF>::cost_of_mul()
-    }
-
-    fn cost_of_mul_equals() -> usize {
-        Self::cost_of_mul()
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> PartialEq for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    fn eq(&self, other: &Self) -> bool {
-        self.c0 == other.c0 && self.c1 == other.c1
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> Eq for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> EqGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> ConditionalEqGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn conditional_enforce_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        condition: &Boolean,
-    ) -> Result<(), SynthesisError> {
-        self.c0
-            .conditional_enforce_equal(&mut cs.ns(|| "c0"), &other.c0, condition)?;
-        self.c1
-            .conditional_enforce_equal(&mut cs.ns(|| "c1"), &other.c1, condition)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        2 * <Fp3Gadget<P, ConstraintF> as ConditionalEqGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> NEqGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn enforce_not_equal<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-    ) -> Result<(), SynthesisError> {
-        self.c0.enforce_not_equal(&mut cs.ns(|| "c0"), &other.c0)?;
-        self.c1.enforce_not_equal(&mut cs.ns(|| "c1"), &other.c1)?;
-        Ok(())
-    }
-
-    fn cost() -> usize {
-        2 * <Fp3Gadget<P, ConstraintF> as NEqGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> ToBitsGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    fn to_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bits(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-
-    fn to_non_unique_bits<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<Boolean>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bits(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bits(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> ToBytesGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    fn to_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_bytes(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-
-    fn to_non_unique_bytes<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Vec<UInt8>, SynthesisError> {
-        let mut c0 = self.c0.to_non_unique_bytes(cs.ns(|| "c0"))?;
-        let mut c1 = self.c1.to_non_unique_bytes(cs.ns(|| "c1"))?;
-        c0.append(&mut c1);
-        Ok(c0)
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> Clone for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    fn clone(&self) -> Self {
-        Self {
-            c0: self.c0.clone(),
-            c1: self.c1.clone(),
-            _params: PhantomData,
-        }
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> CondSelectGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn conditionally_select<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        cond: &Boolean,
-        first: &Self,
-        second: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let c0 = Fp3Gadget::<P, ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c0"),
-            cond,
-            &first.c0,
-            &second.c0,
-        )?;
-        let c1 = Fp3Gadget::<P, ConstraintF>::conditionally_select(
-            &mut cs.ns(|| "c1"),
-            cond,
-            &first.c1,
-            &second.c1,
-        )?;
-
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <Fp3Gadget<P, ConstraintF> as CondSelectGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> TwoBitLookupGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    type TableConstant = Fp6<P>;
-    fn two_bit_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c0 = Fp3Gadget::<P, ConstraintF>::two_bit_lookup(cs.ns(|| "Lookup c0"), b, &c0s)?;
-        let c1 = Fp3Gadget::<P, ConstraintF>::two_bit_lookup(cs.ns(|| "Lookup c1"), b, &c1s)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <Fp3Gadget<P, ConstraintF> as TwoBitLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> ThreeBitCondNegLookupGadget<ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    type TableConstant = Fp6<P>;
-
-    fn three_bit_cond_neg_lookup<CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        b: &[Boolean],
-        b0b1: &Boolean,
-        c: &[Self::TableConstant],
-    ) -> Result<Self, SynthesisError> {
-        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
-        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
-        let c0 = Fp3Gadget::<P, ConstraintF>::three_bit_cond_neg_lookup(
-            cs.ns(|| "Lookup c0"),
-            b,
-            b0b1,
-            &c0s,
-        )?;
-        let c1 = Fp3Gadget::<P, ConstraintF>::three_bit_cond_neg_lookup(
-            cs.ns(|| "Lookup c1"),
-            b,
-            b0b1,
-            &c1s,
-        )?;
-        Ok(Self::new(c0, c1))
-    }
-
-    fn cost() -> usize {
-        2 * <Fp3Gadget<P, ConstraintF> as ThreeBitCondNegLookupGadget<ConstraintF>>::cost()
-    }
-}
-
-impl<P, ConstraintF: PrimeField + SquareRootField> AllocGadget<Fp6<P>, ConstraintF>
-    for Fp6Gadget<P, ConstraintF>
-where
-    P: Fp6Parameters,
-    P::Fp3Params: Fp3Parameters<Fp = ConstraintF>,
-{
-    #[inline]
-    fn alloc_constant<T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        t: T,
-    ) -> Result<Self, SynthesisError>
-    where
-        T: Borrow<Fp6<P>>,
-    {
-        Self::zero(cs.ns(|| "zero"))?.add_constant(cs.ns(|| "add constant"), t.borrow())
-    }
-
-    #[inline]
-    fn alloc<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp6<P>>,
-    {
-        let (c0, c1) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1))
-            }
-            Err(_) => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = Fp3Gadget::<P, ConstraintF>::alloc(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = Fp3Gadget::<P, ConstraintF>::alloc(&mut cs.ns(|| "c1"), || c1)?;
-        Ok(Self::new(c0, c1))
-    }
-
-    #[inline]
-    fn alloc_input<F, T, CS: ConstraintSystem<ConstraintF>>(
-        mut cs: CS,
-        value_gen: F,
-    ) -> Result<Self, SynthesisError>
-    where
-        F: FnOnce() -> Result<T, SynthesisError>,
-        T: Borrow<Fp6<P>>,
-    {
-        let (c0, c1) = match value_gen() {
-            Ok(fe) => {
-                let fe = *fe.borrow();
-                (Ok(fe.c0), Ok(fe.c1))
-            }
-            Err(_) => (
-                Err(SynthesisError::AssignmentMissing),
-                Err(SynthesisError::AssignmentMissing),
-            ),
-        };
-
-        let c0 = Fp3Gadget::<P, ConstraintF>::alloc_input(&mut cs.ns(|| "c0"), || c0)?;
-        let c1 = Fp3Gadget::<P, ConstraintF>::alloc_input(&mut cs.ns(|| "c1"), || c1)?;
-        Ok(Self::new(c0, c1))
+impl<P: Fp6Parameters> QuadExtVarParams<Fp3Var<P::Fp3Params>> for Fp6ParamsWrapper<P> {
+    fn mul_base_field_var_by_frob_coeff(fe: &mut Fp3Var<P::Fp3Params>, power: usize) {
+        fe.c0 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
+        fe.c1 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
+        fe.c2 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
     }
 }

r1cs-std/src/fields/mod.rs

@@ -1,9 +1,15 @@
-use algebra::{fields::BitIterator, Field, PrimeField, Vec};
-use core::fmt::Debug;
-use r1cs_core::{ConstraintSystem, SynthesisError};
+use algebra::{prelude::*, BitIterator};
+use core::{
+    fmt::Debug,
+    ops::{Add, AddAssign, Mul, MulAssign, Sub, SubAssign},
+};
+use r1cs_core::SynthesisError;
 
 use crate::{prelude::*, Assignment};
 
+pub mod cubic_extension;
+pub mod quadratic_extension;
+
 pub mod fp;
 pub mod fp12;
 pub mod fp2;
@@ -12,278 +18,146 @@ pub mod fp4;
 pub mod fp6_2over3;
 pub mod fp6_3over2;
 
-use crate::fields::fp::FpGadget;
-pub trait ToConstraintFieldGadget<ConstraintF: PrimeField> {
-    fn to_constraint_field<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-    ) -> Result<Vec<FpGadget<ConstraintF>>, SynthesisError>;
+/// A hack used to work around the lack of implied bounds.
+pub trait FieldOpsBounds<'a, F, T: 'a>:
+    Sized
+    + Add<&'a T, Output = T>
+    + Sub<&'a T, Output = T>
+    + Mul<&'a T, Output = T>
+    + Add<T, Output = T>
+    + Sub<T, Output = T>
+    + Mul<T, Output = T>
+    + Add<F, Output = T>
+    + Sub<F, Output = T>
+    + Mul<F, Output = T>
+{
 }
 
-pub trait FieldGadget<F: Field, ConstraintF: Field>:
-    Sized
+/// A variable representing a field. Corresponds to the native type `F`.
+pub trait FieldVar<F: Field, ConstraintF: Field>:
+    'static
     + Clone
+    + From<Boolean<ConstraintF>>
+    + R1CSVar<ConstraintF, Value = F>
     + EqGadget<ConstraintF>
-    + NEqGadget<ConstraintF>
-    + ConditionalEqGadget<ConstraintF>
     + ToBitsGadget<ConstraintF>
-    + AllocGadget<F, ConstraintF>
+    + AllocVar<F, ConstraintF>
     + ToBytesGadget<ConstraintF>
     + CondSelectGadget<ConstraintF>
-    + TwoBitLookupGadget<ConstraintF, TableConstant = F>
-    + ThreeBitCondNegLookupGadget<ConstraintF, TableConstant = F>
+    + for<'a> FieldOpsBounds<'a, F, Self>
+    + for<'a> AddAssign<&'a Self>
+    + for<'a> SubAssign<&'a Self>
+    + for<'a> MulAssign<&'a Self>
+    + AddAssign<Self>
+    + SubAssign<Self>
+    + MulAssign<Self>
+    + AddAssign<F>
+    + SubAssign<F>
+    + MulAssign<F>
     + Debug
 {
-    type Variable: Clone + Debug;
-
-    fn get_value(&self) -> Option<F>;
-
-    fn get_variable(&self) -> Self::Variable;
-
-    fn zero<CS: ConstraintSystem<ConstraintF>>(_: CS) -> Result<Self, SynthesisError>;
-
-    fn one<CS: ConstraintSystem<ConstraintF>>(_: CS) -> Result<Self, SynthesisError>;
+    fn zero() -> Self;
 
-    fn conditionally_add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        _: CS,
-        _: &Boolean,
-        _: F,
-    ) -> Result<Self, SynthesisError>;
-
-    fn add<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        _: CS,
-        _: &Self,
-    ) -> Result<Self, SynthesisError>;
-
-    fn add_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        other: &Self,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.add(cs, other)?;
-        Ok(self)
+    fn is_zero(&self) -> Result<Boolean<ConstraintF>, SynthesisError> {
+        self.is_eq(&Self::zero())
     }
 
-    fn double<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        self.add(cs, &self)
-    }
-
-    fn double_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.double(cs)?;
-        Ok(self)
-    }
+    fn one() -> Self;
 
-    fn sub<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        _: CS,
-        _: &Self,
-    ) -> Result<Self, SynthesisError>;
-
-    fn sub_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        other: &Self,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.sub(cs, other)?;
-        Ok(self)
+    fn is_one(&self) -> Result<Boolean<ConstraintF>, SynthesisError> {
+        self.is_eq(&Self::one())
     }
 
-    fn negate<CS: ConstraintSystem<ConstraintF>>(&self, _: CS) -> Result<Self, SynthesisError>;
+    fn constant(v: F) -> Self;
 
-    #[inline]
-    fn negate_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.negate(cs)?;
-        Ok(self)
+    fn double(&self) -> Result<Self, SynthesisError> {
+        Ok(self.clone() + self)
     }
 
-    fn mul<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        _: CS,
-        _: &Self,
-    ) -> Result<Self, SynthesisError>;
-
-    fn mul_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        other: &Self,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.mul(cs, other)?;
+    fn double_in_place(&mut self) -> Result<&mut Self, SynthesisError> {
+        *self += self.double()?;
         Ok(self)
     }
 
-    fn square<CS: ConstraintSystem<ConstraintF>>(&self, cs: CS) -> Result<Self, SynthesisError> {
-        self.mul(cs, &self)
-    }
+    fn negate(&self) -> Result<Self, SynthesisError>;
 
-    fn square_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.square(cs)?;
+    #[inline]
+    fn negate_in_place(&mut self) -> Result<&mut Self, SynthesisError> {
+        *self = self.negate()?;
         Ok(self)
     }
 
-    fn mul_equals<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        other: &Self,
-        result: &Self,
-    ) -> Result<(), SynthesisError> {
-        let actual_result = self.mul(cs.ns(|| "calc_actual_result"), other)?;
-        result.enforce_equal(&mut cs.ns(|| "test_equals"), &actual_result)
-    }
-
-    fn square_equals<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        result: &Self,
-    ) -> Result<(), SynthesisError> {
-        let actual_result = self.square(cs.ns(|| "calc_actual_result"))?;
-        result.enforce_equal(&mut cs.ns(|| "test_equals"), &actual_result)
+    fn square(&self) -> Result<Self, SynthesisError> {
+        Ok(self.clone() * self)
     }
 
-    fn add_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        _: CS,
-        _: &F,
-    ) -> Result<Self, SynthesisError>;
-
-    fn add_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        other: &F,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.add_constant(cs, other)?;
+    fn square_in_place(&mut self) -> Result<&mut Self, SynthesisError> {
+        *self = self.square()?;
         Ok(self)
     }
 
-    fn sub_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        cs: CS,
-        fe: &F,
-    ) -> Result<Self, SynthesisError> {
-        self.add_constant(cs, &(-(*fe)))
+    /// Enforce that `self * other == result`.
+    fn mul_equals(&self, other: &Self, result: &Self) -> Result<(), SynthesisError> {
+        let actual_result = self.clone() * other;
+        result.enforce_equal(&actual_result)
     }
 
-    fn sub_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        other: &F,
-    ) -> Result<&mut Self, SynthesisError> {
-        self.add_constant_in_place(cs, &(-(*other)))
+    /// Enforce that `self * self == result`.
+    fn square_equals(&self, result: &Self) -> Result<(), SynthesisError> {
+        let actual_result = self.square()?;
+        result.enforce_equal(&actual_result)
     }
 
-    fn mul_by_constant<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        _: CS,
-        _: &F,
-    ) -> Result<Self, SynthesisError>;
-
-    fn mul_by_constant_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        other: &F,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.mul_by_constant(cs, other)?;
-        Ok(self)
-    }
-
-    fn inverse<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-    ) -> Result<Self, SynthesisError> {
-        let one = Self::one(&mut cs.ns(|| "one"))?;
-        let inverse = Self::alloc(&mut cs.ns(|| "alloc inverse"), || {
-            self.get_value().and_then(|val| val.inverse()).get()
+    fn inverse(&self) -> Result<Self, SynthesisError>;
+
+    /// Returns (self / denominator), but requires fewer constraints than
+    /// self * denominator.inverse()
+    /// It is up to the caller to ensure that denominator is non-zero,
+    /// since in that case the result is unconstrained.
+    fn mul_by_inverse(&self, denominator: &Self) -> Result<Self, SynthesisError> {
+        let result = Self::new_witness(self.cs().unwrap(), || {
+            let denominator_inv_native = denominator.value()?.inverse().get()?;
+            let result = self.value()? * &denominator_inv_native;
+            Ok(result)
         })?;
-        self.mul_equals(cs.ns(|| "check inv"), &inverse, &one)?;
-        Ok(inverse)
-    }
-
-    // Returns (self / denominator), but requires fewer constraints than
-    // self * denominator.inverse()
-    // It is up to the caller to ensure that denominator is non-zero,
-    // since in that case the result is unconstrained.
-    fn mul_by_inverse<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        denominator: &Self,
-    ) -> Result<Self, SynthesisError> {
-        let denominator_inv_native = denominator
-            .get_value()
-            .and_then(|val| val.inverse())
-            .get()?;
-        let result_native = self.get_value().get()? * &denominator_inv_native;
-
-        let result = Self::alloc(&mut cs.ns(|| "alloc mul_by_inverse result"), || {
-            Ok(result_native)
-        })?;
-        result.mul_equals(cs.ns(|| "check mul_by_inverse"), &denominator, &self)?;
+        result.mul_equals(&denominator, &self)?;
 
         Ok(result)
     }
 
-    fn frobenius_map<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        _: CS,
-        power: usize,
-    ) -> Result<Self, SynthesisError>;
-
-    fn frobenius_map_in_place<CS: ConstraintSystem<ConstraintF>>(
-        &mut self,
-        cs: CS,
-        power: usize,
-    ) -> Result<&mut Self, SynthesisError> {
-        *self = self.frobenius_map(cs, power)?;
+    fn frobenius_map(&self, power: usize) -> Result<Self, SynthesisError>;
+
+    fn frobenius_map_in_place(&mut self, power: usize) -> Result<&mut Self, SynthesisError> {
+        *self = self.frobenius_map(power)?;
         Ok(self)
     }
 
-    /// Accepts as input a list of bits which, when interpreted in big-endian
+    /// Accepts as input a list of bits which, when interpreted in little-endian
     /// form, are a scalar.
-    #[inline]
-    fn pow<CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        bits: &[Boolean],
-    ) -> Result<Self, SynthesisError> {
-        let mut res = Self::one(cs.ns(|| "Alloc result"))?;
-        for (i, bit) in bits.iter().enumerate() {
-            res = res.square(cs.ns(|| format!("Double {}", i)))?;
-            let tmp = res.mul(cs.ns(|| format!("Add {}-th base power", i)), self)?;
-            res = Self::conditionally_select(
-                cs.ns(|| format!("Conditional Select {}", i)),
-                bit,
-                &tmp,
-                &res,
-            )?;
+    //
+    // TODO: check that the input really should be in little-endian or not...
+    fn pow(&self, bits: &[Boolean<ConstraintF>]) -> Result<Self, SynthesisError> {
+        let mut res = Self::one();
+        for bit in bits.iter() {
+            res.square_in_place()?;
+            let tmp = res.clone() * self;
+            res = bit.select(&tmp, &res)?;
         }
         Ok(res)
     }
 
-    fn pow_by_constant<S: AsRef<[u64]>, CS: ConstraintSystem<ConstraintF>>(
-        &self,
-        mut cs: CS,
-        exp: S,
-    ) -> Result<Self, SynthesisError> {
+    fn pow_by_constant<S: AsRef<[u64]>>(&self, exp: S) -> Result<Self, SynthesisError> {
         let mut res = self.clone();
         let mut found_one = false;
 
-        for (i, bit) in BitIterator::new(exp).enumerate() {
+        for bit in BitIterator::new(exp) {
             if found_one {
-                res = res.square(cs.ns(|| format!("square for bit {:?}", i)))?;
+                res = res.square()?;
             }
 
             if bit {
                 if found_one {
-                    res = res.mul(cs.ns(|| format!("mul for bit {:?}", i)), self)?;
+                    res *= self;
                 }
                 found_one = true;
             }
@@ -291,16 +165,6 @@ pub trait FieldGadget:
 
         Ok(res)
     }
-
-    fn cost_of_mul() -> usize;
-
-    fn cost_of_mul_equals() -> usize {
-        Self::cost_of_mul() + <Self as EqGadget<ConstraintF>>::cost()
-    }
-
-    fn cost_of_inv() -> usize {
-        Self::cost_of_mul_equals()
-    }
 }
 
 #[cfg(test)]
@@ -308,267 +172,197 @@ pub(crate) mod tests {
     use rand::{self, SeedableRng};
     use rand_xorshift::XorShiftRng;
 
-    use crate::{prelude::*, test_constraint_system::TestConstraintSystem, Vec};
+    use crate::{fields::*, Vec};
     use algebra::{test_rng, BitIterator, Field, UniformRand};
-    use r1cs_core::ConstraintSystem;
+    use r1cs_core::{ConstraintSystem, SynthesisError};
 
     #[allow(dead_code)]
-    pub(crate) fn field_test<FE: Field, ConstraintF: Field, F: FieldGadget<FE, ConstraintF>>() {
-        let mut cs = TestConstraintSystem::<ConstraintF>::new();
+    pub(crate) fn field_test<F, ConstraintF, AF>() -> Result<(), SynthesisError>
+    where
+        F: Field,
+        ConstraintF: Field,
+        AF: FieldVar<F, ConstraintF>,
+        AF: TwoBitLookupGadget<ConstraintF, TableConstant = F>,
+        for<'a> &'a AF: FieldOpsBounds<'a, F, AF>,
+    {
+        let cs = ConstraintSystem::<ConstraintF>::new_ref();
 
         let mut rng = test_rng();
-        let a_native = FE::rand(&mut rng);
-        let b_native = FE::rand(&mut rng);
-        let a = F::alloc(&mut cs.ns(|| "generate_a"), || Ok(a_native)).unwrap();
-        let b = F::alloc(&mut cs.ns(|| "generate_b"), || Ok(b_native)).unwrap();
-        let b_const = F::alloc_constant(&mut cs.ns(|| "generate_b_as_constant"), b_native).unwrap();
-
-        let zero = F::zero(cs.ns(|| "zero")).unwrap();
-        let zero_native = zero.get_value().unwrap();
-        zero.enforce_equal(&mut cs.ns(|| "zero_equals?"), &zero)
-            .unwrap();
-        assert_eq!(zero, zero);
-
-        let one = F::one(cs.ns(|| "one")).unwrap();
-        let one_native = one.get_value().unwrap();
-        assert_eq!(one, one);
-        one.enforce_equal(&mut cs.ns(|| "one_equals?"), &one)
-            .unwrap();
-        assert_ne!(one, zero);
-
-        let one_dup = zero.add(cs.ns(|| "zero_plus_one"), &one).unwrap();
-        one_dup
-            .enforce_equal(&mut cs.ns(|| "one_plus_zero_equals"), &one)
-            .unwrap();
-        assert_eq!(one_dup, one);
-
-        let two = one.add(cs.ns(|| "one_plus_one"), &one).unwrap();
-        two.enforce_equal(&mut cs.ns(|| "two_equals?"), &two)
-            .unwrap();
-        assert_eq!(two, two);
-        assert_ne!(zero, two);
-        assert_ne!(one, two);
-
-        // a == a
-        assert_eq!(a, a);
+        let a_native = F::rand(&mut rng);
+        let b_native = F::rand(&mut rng);
+        let a = AF::new_witness(cs.ns("generate_a"), || Ok(a_native))?;
+        let b = AF::new_witness(cs.ns("generate_b"), || Ok(b_native))?;
+        let b_const = AF::new_constant(cs.ns("b_as_constant"), b_native)?;
+
+        let zero = AF::zero();
+        let zero_native = zero.value()?;
+        zero.enforce_equal(&zero)?;
+
+        let one = AF::one();
+        let one_native = one.value()?;
+        one.enforce_equal(&one)?;
+
+        one.enforce_not_equal(&zero)?;
+
+        let one_dup = &zero + &one;
+        one_dup.enforce_equal(&one)?;
+
+        let two = &one + &one;
+        two.enforce_equal(&two)?;
+        two.enforce_equal(&one.double()?)?;
+        two.enforce_not_equal(&one)?;
+        two.enforce_not_equal(&zero)?;
 
         // a + 0 = a
-        let a_plus_zero = a.add(cs.ns(|| "a_plus_zero"), &zero).unwrap();
-        assert_eq!(a_plus_zero, a);
-        assert_eq!(a_plus_zero.get_value().unwrap(), a_native);
-        a_plus_zero
-            .enforce_equal(&mut cs.ns(|| "a_plus_zero_equals?"), &a)
-            .unwrap();
+        let a_plus_zero = &a + &zero;
+        assert_eq!(a_plus_zero.value()?, a_native);
+        a_plus_zero.enforce_equal(&a)?;
+        a_plus_zero.enforce_not_equal(&a.double()?)?;
 
         // a - 0 = a
-        let a_minus_zero = a.sub(cs.ns(|| "a_minus_zero"), &zero).unwrap();
-        assert_eq!(a_minus_zero, a);
-        assert_eq!(a_minus_zero.get_value().unwrap(), a_native);
-        a_minus_zero
-            .enforce_equal(&mut cs.ns(|| "a_minus_zero_equals?"), &a)
-            .unwrap();
+        let a_minus_zero = &a - &zero;
+        assert_eq!(a_minus_zero.value()?, a_native);
+        a_minus_zero.enforce_equal(&a)?;
 
         // a - a = 0
-        let a_minus_a = a.sub(cs.ns(|| "a_minus_a"), &a).unwrap();
-        assert_eq!(a_minus_a, zero);
-        assert_eq!(a_minus_a.get_value().unwrap(), zero_native);
-        a_minus_a
-            .enforce_equal(&mut cs.ns(|| "a_minus_a_equals?"), &zero)
-            .unwrap();
+        let a_minus_a = &a - &a;
+        assert_eq!(a_minus_a.value()?, zero_native);
+        a_minus_a.enforce_equal(&zero)?;
 
         // a + b = b + a
-        let a_b = a.add(cs.ns(|| "a_plus_b"), &b).unwrap();
-        let b_a = b.add(cs.ns(|| "b_plus_a"), &a).unwrap();
-        assert_eq!(a_b, b_a);
-        assert_eq!(a_b.get_value().unwrap(), a_native + &b_native);
-        a_b.enforce_equal(&mut cs.ns(|| "a+b == b+a"), &b_a)
-            .unwrap();
+        let a_b = &a + &b;
+        let b_a = &b + &a;
+        assert_eq!(a_b.value()?, a_native + &b_native);
+        a_b.enforce_equal(&b_a)?;
 
         // (a + b) + a = a + (b + a)
-        let ab_a = a_b.add(cs.ns(|| "a_b_plus_a"), &a).unwrap();
-        let a_ba = a.add(cs.ns(|| "a_plus_b_a"), &b_a).unwrap();
-        assert_eq!(ab_a, a_ba);
-        assert_eq!(ab_a.get_value().unwrap(), a_native + &b_native + &a_native);
-        ab_a.enforce_equal(&mut cs.ns(|| "a+b + a == a+ b+a"), &a_ba)
-            .unwrap();
-
-        let b_times_a_plus_b = a_b.mul(cs.ns(|| "b * (a + b)"), &b).unwrap();
-        let b_times_b_plus_a = b_a.mul(cs.ns(|| "b * (b + a)"), &b).unwrap();
-        assert_eq!(b_times_b_plus_a, b_times_a_plus_b);
+        let ab_a = &a_b + &a;
+        let a_ba = &a + &b_a;
+        assert_eq!(ab_a.value()?, a_native + &b_native + &a_native);
+        ab_a.enforce_equal(&a_ba)?;
+
+        let b_times_a_plus_b = &a_b * &b;
+        let b_times_b_plus_a = &b_a * &b;
         assert_eq!(
-            b_times_a_plus_b.get_value().unwrap(),
+            b_times_a_plus_b.value()?,
             b_native * &(b_native + &a_native)
         );
         assert_eq!(
-            b_times_a_plus_b.get_value().unwrap(),
+            b_times_a_plus_b.value()?,
             (b_native + &a_native) * &b_native
         );
         assert_eq!(
-            b_times_a_plus_b.get_value().unwrap(),
+            b_times_a_plus_b.value()?,
             (a_native + &b_native) * &b_native
         );
-        b_times_b_plus_a
-            .enforce_equal(&mut cs.ns(|| "b*(a+b) == b * (b+a)"), &b_times_a_plus_b)
-            .unwrap();
-
-        // a * 0 = 0
-        assert_eq!(a.mul(cs.ns(|| "a_times_zero"), &zero).unwrap(), zero);
+        b_times_b_plus_a.enforce_equal(&b_times_a_plus_b)?;
 
         // a * 1 = a
-        assert_eq!(a.mul(cs.ns(|| "a_times_one"), &one).unwrap(), a);
-        assert_eq!(
-            a.mul(cs.ns(|| "a_times_one2"), &one)
-                .unwrap()
-                .get_value()
-                .unwrap(),
-            a_native * &one_native
-        );
+        assert_eq!((&a * &one).value()?, a_native * &one_native);
 
         // a * b = b * a
-        let ab = a.mul(cs.ns(|| "a_times_b"), &b).unwrap();
-        let ba = b.mul(cs.ns(|| "b_times_a"), &a).unwrap();
-        assert_eq!(ab, ba);
-        assert_eq!(ab.get_value().unwrap(), a_native * &b_native);
+        let ab = &a * &b;
+        let ba = &b * &a;
+        assert_eq!(ab.value()?, ba.value()?);
+        assert_eq!(ab.value()?, a_native * &b_native);
 
-        let ab_const = a.mul(cs.ns(|| "a_times_b_const"), &b_const).unwrap();
-        let b_const_a = b_const.mul(cs.ns(|| "b_const_times_a"), &a).unwrap();
-        assert_eq!(ab_const, b_const_a);
-        assert_eq!(ab_const, ab);
-        assert_eq!(ab_const.get_value().unwrap(), a_native * &b_native);
+        let ab_const = &a * &b_const;
+        let b_const_a = &b_const * &a;
+        assert_eq!(ab_const.value()?, b_const_a.value()?);
+        assert_eq!(ab_const.value()?, ab.value()?);
+        assert_eq!(ab_const.value()?, a_native * &b_native);
 
         // (a * b) * a = a * (b * a)
-        let ab_a = ab.mul(cs.ns(|| "ab_times_a"), &a).unwrap();
-        let a_ba = a.mul(cs.ns(|| "a_times_ba"), &ba).unwrap();
-        assert_eq!(ab_a, a_ba);
-        assert_eq!(ab_a.get_value().unwrap(), a_native * &b_native * &a_native);
-
-        let aa = a.mul(cs.ns(|| "a * a"), &a).unwrap();
-        let a_squared = a.square(cs.ns(|| "a^2")).unwrap();
-        a_squared
-            .enforce_equal(&mut cs.ns(|| "a^2 == a*a"), &aa)
-            .unwrap();
-        assert_eq!(aa, a_squared);
-        assert_eq!(aa.get_value().unwrap(), a_native.square());
-
-        let aa = a
-            .mul_by_constant(cs.ns(|| "a * a via mul_by_const"), &a.get_value().unwrap())
-            .unwrap();
-        a_squared
-            .enforce_equal(&mut cs.ns(|| "a^2 == a*a via mul_by_const"), &aa)
-            .unwrap();
-        assert_eq!(aa, a_squared);
-        assert_eq!(aa.get_value().unwrap(), a_native.square());
-
-        let a_b2 = a
-            .add_constant(cs.ns(|| "a + b via add_const"), &b.get_value().unwrap())
-            .unwrap();
-        a_b.enforce_equal(&mut cs.ns(|| "a + b == a + b via add_const"), &a_b2)
-            .unwrap();
-        assert_eq!(a_b, a_b2);
-
-        let a_inv = a.inverse(cs.ns(|| "a_inv")).unwrap();
-        a_inv
-            .mul_equals(cs.ns(|| "check a_inv * a = 1"), &a, &one)
-            .unwrap();
-        assert_eq!(
-            a_inv.get_value().unwrap(),
-            a.get_value().unwrap().inverse().unwrap()
-        );
-        assert_eq!(a_inv.get_value().unwrap(), a_native.inverse().unwrap());
-
-        let a_b_inv = a.mul_by_inverse(cs.ns(|| "a_b_inv"), &b).unwrap();
-        a_b_inv
-            .mul_equals(cs.ns(|| "check a_b_inv * b = a"), &b, &a)
-            .unwrap();
-        assert_eq!(
-            a_b_inv.get_value().unwrap(),
-            a_native * b_native.inverse().unwrap()
-        );
+        let ab_a = &ab * &a;
+        let a_ba = &a * &ba;
+        assert_eq!(ab_a.value()?, a_ba.value()?);
+        assert_eq!(ab_a.value()?, a_native * &b_native * &a_native);
+
+        let aa = &a * &a;
+        let a_squared = a.square()?;
+        a_squared.enforce_equal(&aa)?;
+        assert_eq!(aa.value()?, a_squared.value()?);
+        assert_eq!(aa.value()?, a_native.square());
+
+        let aa = &a * a.value()?;
+        a_squared.enforce_equal(&aa)?;
+        assert_eq!(aa.value()?, a_squared.value()?);
+        assert_eq!(aa.value()?, a_native.square());
+
+        let a_b2 = &a + b_native;
+        a_b.enforce_equal(&a_b2)?;
+        assert_eq!(a_b.value()?, a_b2.value()?);
+
+        let a_inv = a.inverse()?;
+        a_inv.mul_equals(&a, &one)?;
+        assert_eq!(a_inv.value()?, a.value()?.inverse().unwrap());
+        assert_eq!(a_inv.value()?, a_native.inverse().unwrap());
+
+        let a_b_inv = a.mul_by_inverse(&b)?;
+        a_b_inv.mul_equals(&b, &a)?;
+        assert_eq!(a_b_inv.value()?, a_native * b_native.inverse().unwrap());
 
         // a * a * a = a^3
         let bits = BitIterator::new([0x3])
             .map(Boolean::constant)
             .collect::<Vec<_>>();
-        assert_eq!(
-            a_native * &(a_native * &a_native),
-            a.pow(cs.ns(|| "test_pow"), &bits)
-                .unwrap()
-                .get_value()
-                .unwrap()
-        );
+        assert_eq!(a_native.pow([0x3]), a.pow(&bits)?.value()?);
 
         // a * a * a = a^3
-        assert_eq!(
-            a_native * &(a_native * &a_native),
-            a.pow_by_constant(cs.ns(|| "test_constant_pow"), &[3])
-                .unwrap()
-                .get_value()
-                .unwrap()
-        );
+        assert_eq!(a_native.pow([0x3]), a.pow_by_constant(&[3])?.value()?);
 
         // a * a * a = a^3
-        let mut constants = [FE::zero(); 4];
+        let mut constants = [F::zero(); 4];
         for c in &mut constants {
             *c = UniformRand::rand(&mut test_rng());
-            println!("Current c[i]: {:?}", c);
         }
-        let bits = [Boolean::constant(false), Boolean::constant(true)];
-        let lookup_result =
-            F::two_bit_lookup(cs.ns(|| "Lookup"), &bits, constants.as_ref()).unwrap();
-        assert_eq!(lookup_result.get_value().unwrap(), constants[2]);
-
-        let negone: FE = UniformRand::rand(&mut test_rng());
-
-        let n = F::alloc(&mut cs.ns(|| "alloc new var"), || Ok(negone)).unwrap();
-        let _ = n.to_bytes(&mut cs.ns(|| "ToBytes")).unwrap();
-        let _ = n
-            .to_non_unique_bytes(&mut cs.ns(|| "ToBytes Strict"))
-            .unwrap();
-
-        let ab_false = a
-            .conditionally_add_constant(
-                cs.ns(|| "Add bool with coeff false"),
-                &Boolean::constant(false),
-                b_native,
-            )
-            .unwrap();
-        assert_eq!(ab_false.get_value().unwrap(), a_native);
-        let ab_true = a
-            .conditionally_add_constant(
-                cs.ns(|| "Add bool with coeff true"),
-                &Boolean::constant(true),
-                b_native,
-            )
-            .unwrap();
-        assert_eq!(ab_true.get_value().unwrap(), a_native + &b_native);
-
-        if !cs.is_satisfied() {
+        let bits = [
+            Boolean::<ConstraintF>::constant(false),
+            Boolean::constant(true),
+        ];
+        let lookup_result = AF::two_bit_lookup(&bits, constants.as_ref())?;
+        assert_eq!(lookup_result.value()?, constants[2]);
+
+        let negone: F = UniformRand::rand(&mut test_rng());
+
+        let n = AF::new_witness(cs.ns("alloc new var"), || Ok(negone)).unwrap();
+        let _ = n.to_bytes()?;
+        let _ = n.to_non_unique_bytes()?;
+
+        let ab_false = &a + (AF::from(Boolean::Constant(false)) * b_native);
+        assert_eq!(ab_false.value()?, a_native);
+        let ab_true = &a + (AF::from(Boolean::Constant(true)) * b_native);
+        assert_eq!(ab_true.value()?, a_native + &b_native);
+
+        if !cs.is_satisfied().unwrap() {
             println!("{:?}", cs.which_is_unsatisfied().unwrap());
         }
-        assert!(cs.is_satisfied());
+        assert!(cs.is_satisfied().unwrap());
+        Ok(())
     }
 
     #[allow(dead_code)]
-    pub(crate) fn frobenius_tests<
-        FE: Field,
-        ConstraintF: Field,
-        F: FieldGadget<FE, ConstraintF>,
-    >(
+    pub(crate) fn frobenius_tests<F: Field, ConstraintF, AF>(
         maxpower: usize,
-    ) {
-        let mut cs = TestConstraintSystem::<ConstraintF>::new();
+    ) -> Result<(), SynthesisError>
+    where
+        F: Field,
+        ConstraintF: Field,
+        AF: FieldVar<F, ConstraintF>,
+        for<'a> &'a AF: FieldOpsBounds<'a, F, AF>,
+    {
+        let cs = ConstraintSystem::<ConstraintF>::new_ref();
         let mut rng = XorShiftRng::seed_from_u64(1231275789u64);
         for i in 0..=maxpower {
-            let mut a = FE::rand(&mut rng);
-            let mut a_gadget = F::alloc(cs.ns(|| format!("a_gadget_{:?}", i)), || Ok(a)).unwrap();
-            a_gadget = a_gadget
-                .frobenius_map(cs.ns(|| format!("frob_map_{}", i)), i)
-                .unwrap();
+            let mut a = F::rand(&mut rng);
+            let mut a_gadget = AF::new_witness(cs.ns(format!("a_gadget_{:?}", i)), || Ok(a))?;
+            a_gadget.frobenius_map_in_place(i)?;
             a.frobenius_map(i);
 
-            assert_eq!(a_gadget.get_value().unwrap(), a);
+            assert_eq!(a_gadget.value()?, a);
         }
 
-        assert!(cs.is_satisfied());
+        assert!(cs.is_satisfied().unwrap());
+        Ok(())
     }
 }

r1cs-std/src/fields/quadratic_extension.rs

@@ -0,0 +1,504 @@
+use algebra::{
+    fields::{Field, QuadExtField, QuadExtParameters},
+    One,
+};
+use core::{borrow::Borrow, marker::PhantomData};
+use r1cs_core::{ConstraintSystemRef, Namespace, SynthesisError};
+
+use crate::{
+    fields::{FieldOpsBounds, FieldVar},
+    prelude::*,
+    Assignment, Vec,
+};
+
+#[derive(Derivative)]
+#[derivative(Debug(bound = "BF: core::fmt::Debug"), Clone(bound = "BF: Clone"))]
+#[must_use]
+pub struct QuadExtVar<BF: FieldVar<P::BaseField, P::BasePrimeField>, P: QuadExtVarParams<BF>>
+where
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+{
+    pub c0: BF,
+    pub c1: BF,
+    #[derivative(Debug = "ignore")]
+    _params: PhantomData<P>,
+}
+
+pub trait QuadExtVarParams<BF: FieldVar<Self::BaseField, Self::BasePrimeField>>:
+    QuadExtParameters
+where
+    for<'a> &'a BF: FieldOpsBounds<'a, Self::BaseField, BF>,
+{
+    fn mul_base_field_var_by_frob_coeff(fe: &mut BF, power: usize);
+}
+
+impl<BF: FieldVar<P::BaseField, P::BasePrimeField>, P: QuadExtVarParams<BF>> QuadExtVar<BF, P>
+where
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+{
+    pub fn new(c0: BF, c1: BF) -> Self {
+        Self {
+            c0,
+            c1,
+            _params: PhantomData,
+        }
+    }
+
+    /// Multiply a BF by quadratic nonresidue P::NONRESIDUE.
+    #[inline]
+    pub fn mul_base_field_by_nonresidue(fe: &BF) -> Result<BF, SynthesisError> {
+        Ok(fe * P::NONRESIDUE)
+    }
+
+    #[inline]
+    pub fn mul_by_base_field_constant(&self, fe: P::BaseField) -> Self {
+        let c0 = self.c0.clone() * fe;
+        let c1 = self.c1.clone() * fe;
+        QuadExtVar::new(c0, c1)
+    }
+
+    #[inline]
+    pub fn mul_assign_by_base_field_constant(&mut self, fe: P::BaseField) {
+        *self = (&*self).mul_by_base_field_constant(fe);
+    }
+
+    /// This is only to be used when the element is *known* to be in the cyclotomic subgroup.
+    #[inline]
+    pub fn unitary_inverse(&self) -> Result<Self, SynthesisError> {
+        Ok(Self::new(self.c0.clone(), self.c1.negate()?))
+    }
+
+    /// This is only to be used when the element is *known* to be in the cyclotomic subgroup.
+    #[inline]
+    pub fn cyclotomic_exp(&self, exponent: impl AsRef<[u64]>) -> Result<Self, SynthesisError>
+    where
+        Self: FieldVar<QuadExtField<P>, P::BasePrimeField>,
+    {
+        use algebra::biginteger::arithmetic::find_wnaf;
+        let mut res = Self::one();
+        let self_inverse = self.unitary_inverse()?;
+
+        let mut found_nonzero = false;
+        let naf = find_wnaf(exponent.as_ref());
+
+        for &value in naf.iter().rev() {
+            if found_nonzero {
+                res.square_in_place()?;
+            }
+
+            if value != 0 {
+                found_nonzero = true;
+
+                if value > 0 {
+                    res *= self;
+                } else {
+                    res *= &self_inverse;
+                }
+            }
+        }
+
+        Ok(res)
+    }
+}
+
+impl<BF, P> R1CSVar<P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    type Value = QuadExtField<P>;
+
+    fn cs(&self) -> Option<ConstraintSystemRef<P::BasePrimeField>> {
+        [&self.c0, &self.c1].cs()
+    }
+
+    #[inline]
+    fn value(&self) -> Result<Self::Value, SynthesisError> {
+        match (self.c0.value(), self.c1.value()) {
+            (Ok(c0), Ok(c1)) => Ok(QuadExtField::new(c0, c1)),
+            (..) => Err(SynthesisError::AssignmentMissing),
+        }
+    }
+}
+
+impl<BF, P> From<Boolean<P::BasePrimeField>> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    fn from(other: Boolean<P::BasePrimeField>) -> Self {
+        let c0 = BF::from(other);
+        let c1 = BF::zero();
+        Self::new(c0, c1)
+    }
+}
+
+impl<'a, BF, P> FieldOpsBounds<'a, QuadExtField<P>, QuadExtVar<BF, P>> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+}
+impl<'a, BF, P> FieldOpsBounds<'a, QuadExtField<P>, QuadExtVar<BF, P>> for &'a QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+}
+
+impl<BF, P> FieldVar<QuadExtField<P>, P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'a> &'a BF: FieldOpsBounds<'a, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    fn constant(other: QuadExtField<P>) -> Self {
+        let c0 = BF::constant(other.c0);
+        let c1 = BF::constant(other.c1);
+        Self::new(c0, c1)
+    }
+
+    fn zero() -> Self {
+        let c0 = BF::zero();
+        let c1 = BF::zero();
+        Self::new(c0, c1)
+    }
+
+    fn one() -> Self {
+        let c0 = BF::one();
+        let c1 = BF::zero();
+        Self::new(c0, c1)
+    }
+
+    #[inline]
+    fn double(&self) -> Result<Self, SynthesisError> {
+        let c0 = self.c0.double()?;
+        let c1 = self.c1.double()?;
+        Ok(Self::new(c0, c1))
+    }
+
+    #[inline]
+    fn negate(&self) -> Result<Self, SynthesisError> {
+        let mut result = self.clone();
+        result.c0.negate_in_place()?;
+        result.c1.negate_in_place()?;
+        Ok(result)
+    }
+
+    #[inline]
+    fn square(&self) -> Result<Self, SynthesisError> {
+        // From Libsnark/fp2_gadget.tcc
+        // Complex multiplication for Fp2:
+        //     "Multiplication and Squaring on Pairing-Friendly Fields"
+        //     Devegili, OhEigeartaigh, Scott, Dahab
+
+        // v0 = c0 - c1
+        let mut v0 = &self.c0 - &self.c1;
+        // v3 = c0 - beta * c1
+        let v3 = &self.c0 - &Self::mul_base_field_by_nonresidue(&self.c1)?;
+        // v2 = c0 * c1
+        let v2 = &self.c0 * &self.c1;
+
+        // v0 = (v0 * v3) + v2
+        v0 *= &v3;
+        v0 += &v2;
+
+        let c0 = &v0 + &Self::mul_base_field_by_nonresidue(&v2)?;
+        let c1 = v2.double()?;
+
+        Ok(Self::new(c0, c1))
+    }
+
+    fn mul_equals(&self, other: &Self, result: &Self) -> Result<(), SynthesisError> {
+        // Karatsuba multiplication for Fp2:
+        //     v0 = A.c0 * B.c0
+        //     v1 = A.c1 * B.c1
+        //     result.c0 = v0 + non_residue * v1
+        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
+        // Enforced with 3 constraints:
+        //     A.c1 * B.c1 = v1
+        //     A.c0 * B.c0 = result.c0 - non_residue * v1
+        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
+        // Reference:
+        // "Multiplication and Squaring on Pairing-Friendly Fields"
+        // Devegili, OhEigeartaigh, Scott, Dahab
+        // Compute v1
+        let v1 = &self.c1 * &other.c1;
+
+        // Perform second check
+        let non_residue_times_v1 = Self::mul_base_field_by_nonresidue(&v1)?;
+        let rhs = &result.c0 - &non_residue_times_v1;
+        self.c0.mul_equals(&other.c0, &rhs)?;
+
+        // Last check
+        let a0_plus_a1 = &self.c0 + &self.c1;
+        let b0_plus_b1 = &other.c0 + &other.c1;
+        let one_minus_non_residue_v1 = &v1 - &non_residue_times_v1;
+
+        let tmp = &(&result.c1 + &result.c0) + &one_minus_non_residue_v1;
+        a0_plus_a1.mul_equals(&b0_plus_b1, &tmp)?;
+
+        Ok(())
+    }
+
+    fn frobenius_map(&self, power: usize) -> Result<Self, SynthesisError> {
+        let mut result = self.clone();
+        result.c0.frobenius_map_in_place(power)?;
+        result.c1.frobenius_map_in_place(power)?;
+        P::mul_base_field_var_by_frob_coeff(&mut result.c1, power);
+        Ok(result)
+    }
+
+    fn inverse(&self) -> Result<Self, SynthesisError> {
+        let one = Self::new_constant(self.cs().get()?.clone(), QuadExtField::one())?;
+        let inverse = Self::new_witness(self.cs().get()?.clone(), || {
+            self.value().and_then(|val| val.inverse().get())
+        })?;
+        self.mul_equals(&inverse, &one)?;
+        Ok(inverse)
+    }
+}
+
+impl_bounded_ops!(
+    QuadExtVar<BF, P>,
+    QuadExtField<P>,
+    Add,
+    add,
+    AddAssign,
+    add_assign,
+    |this: &'a QuadExtVar<BF, P>, other: &'a QuadExtVar<BF, P>| {
+        let c0 = &this.c0 + &other.c0;
+        let c1 = &this.c1 + &other.c1;
+        QuadExtVar::new(c0, c1)
+    },
+    |this: &'a QuadExtVar<BF, P>, other: QuadExtField<P>| {
+        this + QuadExtVar::constant(other)
+    },
+    (BF: FieldVar<P::BaseField, P::BasePrimeField>, P: QuadExtVarParams<BF>),
+    for <'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>
+);
+impl_bounded_ops!(
+    QuadExtVar<BF, P>,
+    QuadExtField<P>,
+    Sub,
+    sub,
+    SubAssign,
+    sub_assign,
+    |this: &'a QuadExtVar<BF, P>, other: &'a QuadExtVar<BF, P>| {
+        let c0 = &this.c0 - &other.c0;
+        let c1 = &this.c1 - &other.c1;
+        QuadExtVar::new(c0, c1)
+    },
+    |this: &'a QuadExtVar<BF, P>, other: QuadExtField<P>| {
+        this - QuadExtVar::constant(other)
+    },
+    (BF: FieldVar<P::BaseField, P::BasePrimeField>, P: QuadExtVarParams<BF>),
+    for <'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>
+);
+impl_bounded_ops!(
+    QuadExtVar<BF, P>,
+    QuadExtField<P>,
+    Mul,
+    mul,
+    MulAssign,
+    mul_assign,
+    |this: &'a QuadExtVar<BF, P>, other: &'a QuadExtVar<BF, P>| {
+        // Karatsuba multiplication for Fp2:
+        //     v0 = A.c0 * B.c0
+        //     v1 = A.c1 * B.c1
+        //     result.c0 = v0 + non_residue * v1
+        //     result.c1 = (A.c0 + A.c1) * (B.c0 + B.c1) - v0 - v1
+        // Enforced with 3 constraints:
+        //     A.c1 * B.c1 = v1
+        //     A.c0 * B.c0 = result.c0 - non_residue * v1
+        //     (A.c0+A.c1)*(B.c0+B.c1) = result.c1 + result.c0 + (1 - non_residue) * v1
+        // Reference:
+        // "Multiplication and Squaring on Pairing-Friendly Fields"
+        // Devegili, OhEigeartaigh, Scott, Dahab
+        let mut result = this.clone();
+        let v0 = &this.c0 * &other.c0;
+        let v1 = &this.c1 * &other.c1;
+
+        result.c1 += &this.c0;
+        result.c1 *= &other.c0 + &other.c1;
+        result.c1 -= &v0;
+        result.c1 -= &v1;
+        result.c0 = v0 + &QuadExtVar::<BF, P>::mul_base_field_by_nonresidue(&v1).unwrap();
+        result
+    },
+    |this: &'a QuadExtVar<BF, P>, other: QuadExtField<P>| {
+        this * QuadExtVar::constant(other)
+    },
+    (BF: FieldVar<P::BaseField, P::BasePrimeField>, P: QuadExtVarParams<BF>),
+    for <'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>
+);
+
+impl<BF, P> EqGadget<P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    fn is_eq(&self, other: &Self) -> Result<Boolean<P::BasePrimeField>, SynthesisError> {
+        let b0 = self.c0.is_eq(&other.c0)?;
+        let b1 = self.c1.is_eq(&other.c1)?;
+        b0.and(&b1)
+    }
+
+    #[inline]
+    fn conditional_enforce_equal(
+        &self,
+        other: &Self,
+        condition: &Boolean<P::BasePrimeField>,
+    ) -> Result<(), SynthesisError> {
+        self.c0.conditional_enforce_equal(&other.c0, condition)?;
+        self.c1.conditional_enforce_equal(&other.c1, condition)?;
+        Ok(())
+    }
+
+    #[inline]
+    fn conditional_enforce_not_equal(
+        &self,
+        other: &Self,
+        condition: &Boolean<P::BasePrimeField>,
+    ) -> Result<(), SynthesisError> {
+        let is_equal = self.is_eq(other)?;
+        is_equal
+            .and(condition)?
+            .enforce_equal(&Boolean::Constant(false))
+    }
+}
+
+impl<BF, P> ToBitsGadget<P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    fn to_bits(&self) -> Result<Vec<Boolean<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_bits()?;
+        let mut c1 = self.c1.to_bits()?;
+        c0.append(&mut c1);
+        Ok(c0)
+    }
+
+    fn to_non_unique_bits(&self) -> Result<Vec<Boolean<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_non_unique_bits()?;
+        let mut c1 = self.c1.to_non_unique_bits()?;
+        c0.append(&mut c1);
+        Ok(c0)
+    }
+}
+
+impl<BF, P> ToBytesGadget<P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    fn to_bytes(&self) -> Result<Vec<UInt8<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_bytes()?;
+        let mut c1 = self.c1.to_bytes()?;
+        c0.append(&mut c1);
+        Ok(c0)
+    }
+
+    fn to_non_unique_bytes(&self) -> Result<Vec<UInt8<P::BasePrimeField>>, SynthesisError> {
+        let mut c0 = self.c0.to_non_unique_bytes()?;
+        let mut c1 = self.c1.to_non_unique_bytes()?;
+        c0.append(&mut c1);
+        Ok(c0)
+    }
+}
+
+impl<BF, P> CondSelectGadget<P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    #[inline]
+    fn conditionally_select(
+        cond: &Boolean<P::BasePrimeField>,
+        true_value: &Self,
+        false_value: &Self,
+    ) -> Result<Self, SynthesisError> {
+        let c0 = BF::conditionally_select(cond, &true_value.c0, &false_value.c0)?;
+        let c1 = BF::conditionally_select(cond, &true_value.c1, &false_value.c1)?;
+        Ok(Self::new(c0, c1))
+    }
+}
+
+impl<BF, P> TwoBitLookupGadget<P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>
+        + TwoBitLookupGadget<P::BasePrimeField, TableConstant = P::BaseField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    type TableConstant = QuadExtField<P>;
+
+    fn two_bit_lookup(
+        b: &[Boolean<P::BasePrimeField>],
+        c: &[Self::TableConstant],
+    ) -> Result<Self, SynthesisError> {
+        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
+        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
+        let c0 = BF::two_bit_lookup(b, &c0s)?;
+        let c1 = BF::two_bit_lookup(b, &c1s)?;
+        Ok(Self::new(c0, c1))
+    }
+}
+
+impl<BF, P> ThreeBitCondNegLookupGadget<P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>
+        + ThreeBitCondNegLookupGadget<P::BasePrimeField, TableConstant = P::BaseField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    type TableConstant = QuadExtField<P>;
+
+    fn three_bit_cond_neg_lookup(
+        b: &[Boolean<P::BasePrimeField>],
+        b0b1: &Boolean<P::BasePrimeField>,
+        c: &[Self::TableConstant],
+    ) -> Result<Self, SynthesisError> {
+        let c0s = c.iter().map(|f| f.c0).collect::<Vec<_>>();
+        let c1s = c.iter().map(|f| f.c1).collect::<Vec<_>>();
+        let c0 = BF::three_bit_cond_neg_lookup(b, b0b1, &c0s)?;
+        let c1 = BF::three_bit_cond_neg_lookup(b, b0b1, &c1s)?;
+        Ok(Self::new(c0, c1))
+    }
+}
+
+impl<BF, P> AllocVar<QuadExtField<P>, P::BasePrimeField> for QuadExtVar<BF, P>
+where
+    BF: FieldVar<P::BaseField, P::BasePrimeField>,
+    for<'b> &'b BF: FieldOpsBounds<'b, P::BaseField, BF>,
+    P: QuadExtVarParams<BF>,
+{
+    fn new_variable<T: Borrow<QuadExtField<P>>>(
+        cs: impl Into<Namespace<P::BasePrimeField>>,
+        f: impl FnOnce() -> Result<T, SynthesisError>,
+        mode: AllocationMode,
+    ) -> Result<Self, SynthesisError> {
+        let ns = cs.into();
+        let cs = ns.cs();
+        let (c0, c1) = match f() {
+            Ok(fe) => (Ok(fe.borrow().c0), Ok(fe.borrow().c1)),
+            Err(_) => (
+                Err(SynthesisError::AssignmentMissing),
+                Err(SynthesisError::AssignmentMissing),
+            ),
+        };
+
+        let c0 = BF::new_variable(cs.ns("c0"), || c0, mode)?;
+        let c1 = BF::new_variable(cs.ns("c1"), || c1, mode)?;
+        Ok(Self::new(c0, c1))
+    }
+}