* We add a double_and_add method that computes 2 * self + other more
efficiently than just doubling + addition; this is not used anywhere
yet, but I am planning on fiddling with it to see if we can leverage
it somehow. (See zcash/zcash#3924 for details)
* We handle constant scalars better:
* We skip the most-significant constant zeroes to avoid unnecessary
doubling
* When intermediate bits of the scalar are constants, instead of
conditionally adding, we directly use the value of the bit to
decide whether to add or not.
Co-authored-by: Dev Ojha <ValarDragon@users.noreply.github.com>
Co-authored-by: weikeng <w.k@berkeley.edu>
* When a group element is a constant, precompute multiples of powers of two, and perform simple conditional additions (no doubling!).
* For short weierstrass curves, addition with a constant now uses mixed addition, which results in lower constraint weight.
* For short weierstrass curves, scalar multiplication now uses mixed addition, saving 1 constraint per bit of the scalar, along with lower constraint weight (at the cost of a small constant number of constraints to check for edge cases)
This is related to a Zexe issue https://github.com/scipr-lab/zexe/issues/289
Basically, ToBitsGadget for FpVar may produce shorter output for a constant value, which is undesired for a few reasons.
Kobi Gurkan
Pratyush Mishra
Dev Ojha
William Lin
jon-chuang
Weikeng Chen
Nirvan Tyagi
Nirvan Tyagi
yelhousni