* We add a double_and_add method that computes 2 * self + other more
efficiently than just doubling + addition; this is not used anywhere
yet, but I am planning on fiddling with it to see if we can leverage
it somehow. (See zcash/zcash#3924 for details)
* We handle constant scalars better:
* We skip the most-significant constant zeroes to avoid unnecessary
doubling
* When intermediate bits of the scalar are constants, instead of
conditionally adding, we directly use the value of the bit to
decide whether to add or not.
Co-authored-by: Dev Ojha <ValarDragon@users.noreply.github.com>
Co-authored-by: weikeng <w.k@berkeley.edu>
* When a group element is a constant, precompute multiples of powers of two, and perform simple conditional additions (no doubling!).
* For short weierstrass curves, addition with a constant now uses mixed addition, which results in lower constraint weight.
* For short weierstrass curves, scalar multiplication now uses mixed addition, saving 1 constraint per bit of the scalar, along with lower constraint weight (at the cost of a small constant number of constraints to check for edge cases)
* adds alloc constant to AllocGadget
* fmt
* fmt
* more alloc constant impls
* fmt
* even more impls
* fixes type
* fixes alloc_constant in gm17
* uses alloc_constant from field gadget in group gadgets
* fmt
* handle most comments
* Add mnt6_753 curve
Generalize mnt6 curve model
* Add mnt4 curves
* Use resampled generators
* Calculate correct G2 cofactors
* Add fields to r1cs-std
* Add pairings
* Improve reusing of Fq/Fr among MNT curves
* Add instantiations of curves
Fix Fp6_2over3
Rebase code to current master
* Add test for recursive NIZK proof verification
* Address comments in PR
* Improve test case and port to GM17
Also fix a minor bug in to_field_vec
- contributes to #50,
- depends on #53 and builds on it,
- due to coherence & requirements of `num_traits::{Zero, One}` to implement `std::ops::Add<Self, ..>` and (resp.) `std::ops::Mul<Self, ..>`, I've had to replace the afferent `impl<'a, P: ..> (Add|Mul)<&'a Self> for Group(Affine|Projective)<P>` by direct implementations on `Self`,
- I did not have to fight the borrow checker for this conversion => I think this hints arithmetic operations are called in contexts where the operand is owned,
- hence should this end up on a merge track, we may want to open an issue to convert the `impl<'a, P:..> (Neg|Sub|..)<&'a Self> for ..<P>` trait usage to direct `impl<P:..> (Neg|Sub|..)<Self> for ..<P>`
- the `impl AddAssign for GroupAffine<P>` in curves/models/short_weierstrass_jacobian.rs is provided to fit trait bounds, and without any guarantee of suitability for any particular purpose
- and that, even though I don't think it's used.
Pratyush Mishra
mmagician
Weikeng Chen
Michele Orrù
Alex Ozdemir
Elder Ryan
Kobi Gurkan
Pascal Berrang
ValarDragon
Marek Kotewicz
François Garillot