From d55d875d7a54cd73e54299ed79d4f8308e204f0a Mon Sep 17 00:00:00 2001 From: arnaucube Date: Sat, 24 Nov 2018 01:11:28 +0100 Subject: [PATCH] bn128 pairing implemented --- README.md | 45 ++- bn128/README.md | 44 ++- bn128/bn128.go | 357 +++++++++++++++++- bn128/bn128_test.go | 65 ++++ bn128/fq.go | 65 +++- bn128/fq12.go | 30 +- bn128/fq2.go | 42 ++- bn128/fq6.go | 23 +- bn128/fqn_test.go | 76 ++-- bn128/g1.go | 52 ++- bn128/g1_test.go | 7 +- bn128/g2.go | 83 +++- bn128/g2_test.go | 15 +- paillier/paillier.go | 2 +- .../shamirsecretsharing_test.go | 17 +- 15 files changed, 746 insertions(+), 177 deletions(-) create mode 100644 bn128/bn128_test.go diff --git a/README.md b/README.md index a85ce63..bc021f7 100644 --- a/README.md +++ b/README.md @@ -419,26 +419,32 @@ if verified { ## Bn128 -**[not finished]** -This is implemented followng the implementations and info from: -- https://github.com/iden3/zksnark -- https://github.com/zcash/zcash/tree/master/src/snark -- https://github.com/ethereum/py_ecc/tree/master/py_ecc/bn128 +This is implemented followng the info and the implementations from: - `Multiplication and Squaring on Pairing-Friendly Fields`, Augusto Jun Devegili, Colm Ó hÉigeartaigh, Michael Scott, and Ricardo Dahab https://pdfs.semanticscholar.org/3e01/de88d7428076b2547b60072088507d881bf1.pdf -- `Optimal Pairings`, Frederik Vercauteren https://www.cosic.esat.kuleuven.be/bcrypt/optimal.pdf +- `Optimal Pairings`, Frederik Vercauteren https://www.cosic.esat.kuleuven.be/bcrypt/optimal.pdf , https://eprint.iacr.org/2008/096.pdf - `Double-and-Add with Relative Jacobian Coordinates`, Björn Fay https://eprint.iacr.org/2014/1014.pdf - `Fast and Regular Algorithms for Scalar Multiplication over Elliptic Curves`, Matthieu Rivain https://eprint.iacr.org/2011/338.pdf +- `High-Speed Software Implementation of the Optimal Ate Pairing over Barreto–Naehrig Curves`, Jean-Luc Beuchat, Jorge E. González-Díaz, Shigeo Mitsunari, Eiji Okamoto, Francisco Rodríguez-Henríquez, and Tadanori Teruya https://eprint.iacr.org/2010/354.pdf +- `New software speed records for cryptographic pairings`, Michael Naehrig, Ruben Niederhagen, Peter Schwabe https://cryptojedi.org/papers/dclxvi-20100714.pdf +- https://github.com/zcash/zcash/tree/master/src/snark +- https://github.com/iden3/snarkjs +- https://github.com/ethereum/py_ecc/tree/master/py_ecc/bn128 - [x] Fq, Fq2, Fq6, Fq12 operations - [x] G1, G2 operations +- [x] preparePairing +- [x] PreComupteG1, PreComupteG2 +- [x] DoubleStep, AddStep +- [x] MillerLoop +- [x] Pairing #### Usage -First let's define three basic functions to convert integer compositions to big integer compositions: +First let's assume that we have these three basic functions to convert integer compositions to big integer compositions: ```go func iToBig(a int) *big.Int { return big.NewInt(int64(a)) @@ -453,6 +459,28 @@ func iiiToBig(a, b int) [2]*big.Int { } ``` + +- Pairing +```go +bn128, err := NewBn128() +assert.Nil(t, err) + +big25 := big.NewInt(int64(25)) +big30 := big.NewInt(int64(30)) + +g1a := bn128.G1.MulScalar(bn128.G1.G, big25) +g2a := bn128.G2.MulScalar(bn128.G2.G, big30) + +g1b := bn128.G1.MulScalar(bn128.G1.G, big30) +g2b := bn128.G2.MulScalar(bn128.G2.G, big25) + +pA, err := bn128.Pairing(g1a, g2a) +assert.Nil(t, err) +pB, err := bn128.Pairing(g1b, g2b) +assert.Nil(t, err) +assert.True(t, bn128.Fq12.Equal(pA, pB)) +``` + - Finite Fields (1, 2, 6, 12) operations ```go // new finite field of order 1 @@ -468,7 +496,7 @@ res = fq1.Inverse(iToBig(4)) res = fq1.Square(iToBig(5)) // new finite field of order 2 -nonResidueFq2str := "-1" // i / Beta +nonResidueFq2str := "-1" // i/j nonResidueFq2, ok := new(big.Int).SetString(nonResidueFq2str, 10) fq2 := Fq2{fq1, nonResidueFq2} nonResidueFq6 := iiToBig(9, 1) @@ -564,6 +592,7 @@ b := bn128.G2.Affine(grsum2) assert.Equal(t, a, b) ``` + --- To run all tests: diff --git a/bn128/README.md b/bn128/README.md index ff43b3e..73bcf97 100644 --- a/bn128/README.md +++ b/bn128/README.md @@ -1,24 +1,30 @@ ## Bn128 -**[not finished]** -This is implemented followng the implementations and info from: -- https://github.com/zcash/zcash/tree/master/src/snark -- https://github.com/iden3/snarkjs -- https://github.com/ethereum/py_ecc/tree/master/py_ecc/bn128 +This is implemented followng the info and the implementations from: - `Multiplication and Squaring on Pairing-Friendly Fields`, Augusto Jun Devegili, Colm Ó hÉigeartaigh, Michael Scott, and Ricardo Dahab https://pdfs.semanticscholar.org/3e01/de88d7428076b2547b60072088507d881bf1.pdf -- `Optimal Pairings`, Frederik Vercauteren https://www.cosic.esat.kuleuven.be/bcrypt/optimal.pdf +- `Optimal Pairings`, Frederik Vercauteren https://www.cosic.esat.kuleuven.be/bcrypt/optimal.pdf , https://eprint.iacr.org/2008/096.pdf - `Double-and-Add with Relative Jacobian Coordinates`, Björn Fay https://eprint.iacr.org/2014/1014.pdf - `Fast and Regular Algorithms for Scalar Multiplication over Elliptic Curves`, Matthieu Rivain https://eprint.iacr.org/2011/338.pdf +- `High-Speed Software Implementation of the Optimal Ate Pairing over Barreto–Naehrig Curves`, Jean-Luc Beuchat, Jorge E. González-Díaz, Shigeo Mitsunari, Eiji Okamoto, Francisco Rodríguez-Henríquez, and Tadanori Teruya https://eprint.iacr.org/2010/354.pdf +- `New software speed records for cryptographic pairings`, Michael Naehrig, Ruben Niederhagen, Peter Schwabe https://cryptojedi.org/papers/dclxvi-20100714.pdf +- https://github.com/zcash/zcash/tree/master/src/snark +- https://github.com/iden3/snarkjs +- https://github.com/ethereum/py_ecc/tree/master/py_ecc/bn128 - [x] Fq, Fq2, Fq6, Fq12 operations - [x] G1, G2 operations +- [x] preparePairing +- [x] PreComupteG1, PreComupteG2 +- [x] DoubleStep, AddStep +- [x] MillerLoop +- [x] Pairing #### Usage -First let's define three basic functions to convert integer compositions to big integer compositions: +First let's assume that we have these three basic functions to convert integer compositions to big integer compositions: ```go func iToBig(a int) *big.Int { return big.NewInt(int64(a)) @@ -33,6 +39,28 @@ func iiiToBig(a, b int) [2]*big.Int { } ``` + +- Pairing +```go +bn128, err := NewBn128() +assert.Nil(t, err) + +big25 := big.NewInt(int64(25)) +big30 := big.NewInt(int64(30)) + +g1a := bn128.G1.MulScalar(bn128.G1.G, big25) +g2a := bn128.G2.MulScalar(bn128.G2.G, big30) + +g1b := bn128.G1.MulScalar(bn128.G1.G, big30) +g2b := bn128.G2.MulScalar(bn128.G2.G, big25) + +pA, err := bn128.Pairing(g1a, g2a) +assert.Nil(t, err) +pB, err := bn128.Pairing(g1b, g2b) +assert.Nil(t, err) +assert.True(t, bn128.Fq12.Equal(pA, pB)) +``` + - Finite Fields (1, 2, 6, 12) operations ```go // new finite field of order 1 @@ -48,7 +76,7 @@ res = fq1.Inverse(iToBig(4)) res = fq1.Square(iToBig(5)) // new finite field of order 2 -nonResidueFq2str := "-1" // i / Beta +nonResidueFq2str := "-1" // i/j nonResidueFq2, ok := new(big.Int).SetString(nonResidueFq2str, 10) fq2 := Fq2{fq1, nonResidueFq2} nonResidueFq6 := iiToBig(9, 1) diff --git a/bn128/bn128.go b/bn128/bn128.go index 29ff08d..95a4ac8 100644 --- a/bn128/bn128.go +++ b/bn128/bn128.go @@ -1,13 +1,13 @@ package bn128 import ( + "bytes" "errors" "math/big" ) type Bn128 struct { Q *big.Int - R *big.Int Gg1 [2]*big.Int Gg2 [2][2]*big.Int NonResidueFq2 *big.Int @@ -18,6 +18,17 @@ type Bn128 struct { Fq12 Fq12 G1 G1 G2 G2 + LoopCount *big.Int + LoopCountNeg bool + + TwoInv *big.Int + CoefB *big.Int + TwistCoefB [2]*big.Int + Twist [2]*big.Int + FrobeniusCoeffsC11 *big.Int + TwistMulByQX [2]*big.Int + TwistMulByQY [2]*big.Int + FinalExp *big.Int } func NewBn128() (Bn128, error) { @@ -27,11 +38,6 @@ func NewBn128() (Bn128, error) { return b, errors.New("err with q") } b.Q = q - r, ok := new(big.Int).SetString("21888242871839275222246405745257275088548364400416034343698204186575808495617", 10) // i - if !ok { - return b, errors.New("err with r") - } - b.R = r b.Gg1 = [2]*big.Int{ big.NewInt(int64(1)), @@ -54,17 +60,16 @@ func NewBn128() (Bn128, error) { if !ok { return b, errors.New("err with g2_00") } - g2_0 := [2]*big.Int{ - g2_00, - g2_01, - } - g2_1 := [2]*big.Int{ - g2_10, - g2_11, - } + b.Gg2 = [2][2]*big.Int{ - g2_0, - g2_1, + [2]*big.Int{ + g2_00, + g2_01, + }, + [2]*big.Int{ + g2_10, + g2_11, + }, } b.Fq1 = NewFq(q) @@ -77,12 +82,326 @@ func NewBn128() (Bn128, error) { big.NewInt(int64(1)), } - b.Fq2 = Fq2{b.Fq1, b.NonResidueFq2} - b.Fq6 = Fq6{b.Fq2, b.NonResidueFq6} - b.Fq12 = Fq12{b.Fq6, b.Fq2, b.NonResidueFq6} + b.Fq2 = NewFq2(b.Fq1, b.NonResidueFq2) + b.Fq6 = NewFq6(b.Fq2, b.NonResidueFq6) + b.Fq12 = NewFq12(b.Fq6, b.Fq2, b.NonResidueFq6) b.G1 = NewG1(b.Fq1, b.Gg1) b.G2 = NewG2(b.Fq2, b.Gg2) + err := b.preparePairing() + if err != nil { + return b, err + } + return b, nil } + +func BigIsOdd(n *big.Int) bool { + one := big.NewInt(int64(1)) + and := new(big.Int).And(n, one) + return bytes.Equal(and.Bytes(), big.NewInt(int64(1)).Bytes()) +} + +func (bn128 *Bn128) preparePairing() error { + var ok bool + bn128.LoopCount, ok = new(big.Int).SetString("29793968203157093288", 10) + if !ok { + return errors.New("err with LoopCount from string") + } + + bn128.LoopCountNeg = false + + bn128.TwoInv = bn128.Fq1.Inverse(big.NewInt(int64(2))) + + bn128.CoefB = big.NewInt(int64(3)) + bn128.Twist = [2]*big.Int{ + big.NewInt(int64(9)), + big.NewInt(int64(1)), + } + bn128.TwistCoefB = bn128.Fq2.MulScalar(bn128.Fq2.Inverse(bn128.Twist), bn128.CoefB) + + bn128.FrobeniusCoeffsC11, ok = new(big.Int).SetString("21888242871839275222246405745257275088696311157297823662689037894645226208582", 10) + if !ok { + return errors.New("error parsing frobeniusCoeffsC11") + } + + a, ok := new(big.Int).SetString("21575463638280843010398324269430826099269044274347216827212613867836435027261", 10) + if !ok { + return errors.New("error parsing a") + } + b, ok := new(big.Int).SetString("10307601595873709700152284273816112264069230130616436755625194854815875713954", 10) + if !ok { + return errors.New("error parsing b") + } + bn128.TwistMulByQX = [2]*big.Int{ + a, + b, + } + + a, ok = new(big.Int).SetString("2821565182194536844548159561693502659359617185244120367078079554186484126554", 10) + if !ok { + return errors.New("error parsing a") + } + b, ok = new(big.Int).SetString("3505843767911556378687030309984248845540243509899259641013678093033130930403", 10) + if !ok { + return errors.New("error parsing b") + } + bn128.TwistMulByQY = [2]*big.Int{ + a, + b, + } + + bn128.FinalExp, ok = new(big.Int).SetString("552484233613224096312617126783173147097382103762957654188882734314196910839907541213974502761540629817009608548654680343627701153829446747810907373256841551006201639677726139946029199968412598804882391702273019083653272047566316584365559776493027495458238373902875937659943504873220554161550525926302303331747463515644711876653177129578303191095900909191624817826566688241804408081892785725967931714097716709526092261278071952560171111444072049229123565057483750161460024353346284167282452756217662335528813519139808291170539072125381230815729071544861602750936964829313608137325426383735122175229541155376346436093930287402089517426973178917569713384748081827255472576937471496195752727188261435633271238710131736096299798168852925540549342330775279877006784354801422249722573783561685179618816480037695005515426162362431072245638324744480", 10) + if !ok { + return errors.New("error parsing finalExp") + } + + return nil + +} + +func (bn128 Bn128) Pairing(p1 [3]*big.Int, p2 [3][2]*big.Int) ([2][3][2]*big.Int, error) { + pre1 := bn128.PreComputeG1(p1) + pre2, err := bn128.PreComputeG2(p2) + if err != nil { + return [2][3][2]*big.Int{}, err + } + + r1 := bn128.MillerLoop(pre1, pre2) + res := bn128.FinalExponentiation(r1) + return res, nil +} + +type AteG1Precomp struct { + Px *big.Int + Py *big.Int +} + +func (bn128 Bn128) PreComputeG1(p [3]*big.Int) AteG1Precomp { + pCopy := bn128.G1.Affine(p) + res := AteG1Precomp{ + Px: pCopy[0], + Py: pCopy[1], + } + return res +} + +type EllCoeffs struct { + Ell0 [2]*big.Int + EllVW [2]*big.Int + EllVV [2]*big.Int +} +type AteG2Precomp struct { + Qx [2]*big.Int + Qy [2]*big.Int + Coeffs []EllCoeffs +} + +func (bn128 Bn128) PreComputeG2(p [3][2]*big.Int) (AteG2Precomp, error) { + qCopy := bn128.G2.Affine(p) + res := AteG2Precomp{ + qCopy[0], + qCopy[1], + []EllCoeffs{}, + } + r := [3][2]*big.Int{ + bn128.Fq2.Copy(qCopy[0]), + bn128.Fq2.Copy(qCopy[1]), + bn128.Fq2.One(), + } + var c EllCoeffs + for i := bn128.LoopCount.BitLen() - 2; i >= 0; i-- { + bit := bn128.LoopCount.Bit(i) + + c, r = bn128.DoublingStep(r) + res.Coeffs = append(res.Coeffs, c) + if bit == 1 { + c, r = bn128.MixedAdditionStep(qCopy, r) + res.Coeffs = append(res.Coeffs, c) + } + } + + q1 := bn128.G2.Affine(bn128.G2MulByQ(qCopy)) + if !bn128.Fq2.Equal(q1[2], bn128.Fq2.One()) { + return res, errors.New("q1[2] != Fq2.One") + } + q2 := bn128.G2.Affine(bn128.G2MulByQ(q1)) + if !bn128.Fq2.Equal(q2[2], bn128.Fq2.One()) { + return res, errors.New("q2[2] != Fq2.One") + } + + if bn128.LoopCountNeg { + r[1] = bn128.Fq2.Neg(r[1]) + } + q2[1] = bn128.Fq2.Neg(q2[1]) + + c, r = bn128.MixedAdditionStep(q1, r) + res.Coeffs = append(res.Coeffs, c) + + c, r = bn128.MixedAdditionStep(q2, r) + res.Coeffs = append(res.Coeffs, c) + + return res, nil +} + +func (bn128 Bn128) DoublingStep(current [3][2]*big.Int) (EllCoeffs, [3][2]*big.Int) { + x := current[0] + y := current[1] + z := current[2] + + a := bn128.Fq2.MulScalar(bn128.Fq2.Mul(x, y), bn128.TwoInv) + b := bn128.Fq2.Square(y) + c := bn128.Fq2.Square(z) + d := bn128.Fq2.Add(c, bn128.Fq2.Add(c, c)) + e := bn128.Fq2.Mul(bn128.TwistCoefB, d) + f := bn128.Fq2.Add(e, bn128.Fq2.Add(e, e)) + g := bn128.Fq2.MulScalar(bn128.Fq2.Add(b, f), bn128.TwoInv) + h := bn128.Fq2.Sub( + bn128.Fq2.Square(bn128.Fq2.Add(y, z)), + bn128.Fq2.Add(b, c)) + i := bn128.Fq2.Sub(e, b) + j := bn128.Fq2.Square(x) + eSqr := bn128.Fq2.Square(e) + current[0] = bn128.Fq2.Mul(a, bn128.Fq2.Sub(b, f)) + current[1] = bn128.Fq2.Sub(bn128.Fq2.Sub(bn128.Fq2.Square(g), eSqr), + bn128.Fq2.Add(eSqr, eSqr)) + current[2] = bn128.Fq2.Mul(b, h) + res := EllCoeffs{ + Ell0: bn128.Fq2.Mul(i, bn128.Twist), + EllVW: bn128.Fq2.Neg(h), + EllVV: bn128.Fq2.Add(j, bn128.Fq2.Add(j, j)), + } + + return res, current +} + +func (bn128 Bn128) MixedAdditionStep(base, current [3][2]*big.Int) (EllCoeffs, [3][2]*big.Int) { + x1 := current[0] + y1 := current[1] + z1 := current[2] + x2 := base[0] + y2 := base[1] + + d := bn128.Fq2.Sub(x1, bn128.Fq2.Mul(x2, z1)) + e := bn128.Fq2.Sub(y1, bn128.Fq2.Mul(y2, z1)) + f := bn128.Fq2.Square(d) + g := bn128.Fq2.Square(e) + h := bn128.Fq2.Mul(d, f) + i := bn128.Fq2.Mul(x1, f) + j := bn128.Fq2.Sub( + bn128.Fq2.Add(h, bn128.Fq2.Mul(z1, g)), + bn128.Fq2.Add(i, i)) + + current[0] = bn128.Fq2.Mul(d, j) + current[1] = bn128.Fq2.Sub( + bn128.Fq2.Mul(e, bn128.Fq2.Sub(i, j)), + bn128.Fq2.Mul(h, y1)) + current[2] = bn128.Fq2.Mul(z1, h) + + coef := EllCoeffs{ + Ell0: bn128.Fq2.Mul( + bn128.Twist, + bn128.Fq2.Sub( + bn128.Fq2.Mul(e, x2), + bn128.Fq2.Mul(d, y2))), + EllVW: d, + EllVV: bn128.Fq2.Neg(e), + } + return coef, current +} +func (bn128 Bn128) G2MulByQ(p [3][2]*big.Int) [3][2]*big.Int { + fmx := [2]*big.Int{ + p[0][0], + bn128.Fq1.Mul(p[0][1], bn128.Fq1.Copy(bn128.FrobeniusCoeffsC11)), + } + fmy := [2]*big.Int{ + p[1][0], + bn128.Fq1.Mul(p[1][1], bn128.Fq1.Copy(bn128.FrobeniusCoeffsC11)), + } + fmz := [2]*big.Int{ + p[2][0], + bn128.Fq1.Mul(p[2][1], bn128.Fq1.Copy(bn128.FrobeniusCoeffsC11)), + } + + return [3][2]*big.Int{ + bn128.Fq2.Mul(bn128.TwistMulByQX, fmx), + bn128.Fq2.Mul(bn128.TwistMulByQY, fmy), + fmz, + } +} + +func (bn128 Bn128) MillerLoop(pre1 AteG1Precomp, pre2 AteG2Precomp) [2][3][2]*big.Int { + // https://cryptojedi.org/papers/dclxvi-20100714.pdf + // https://eprint.iacr.org/2008/096.pdf + + idx := 0 + var c EllCoeffs + f := bn128.Fq12.One() + + for i := bn128.LoopCount.BitLen() - 2; i >= 0; i-- { + bit := bn128.LoopCount.Bit(i) + + c = pre2.Coeffs[idx] + idx++ + f = bn128.Fq12.Square(f) + + f = bn128.MulBy024(f, + c.Ell0, + bn128.Fq2.MulScalar(c.EllVW, pre1.Py), + bn128.Fq2.MulScalar(c.EllVV, pre1.Px)) + + if bit == 1 { + c = pre2.Coeffs[idx] + idx++ + f = bn128.MulBy024( + f, + c.Ell0, + bn128.Fq2.MulScalar(c.EllVW, pre1.Py), + bn128.Fq2.MulScalar(c.EllVV, pre1.Px)) + } + } + if bn128.LoopCountNeg { + f = bn128.Fq12.Inverse(f) + } + + c = pre2.Coeffs[idx] + idx++ + f = bn128.MulBy024( + f, + c.Ell0, + bn128.Fq2.MulScalar(c.EllVW, pre1.Py), + bn128.Fq2.MulScalar(c.EllVV, pre1.Px)) + + c = pre2.Coeffs[idx] + idx++ + + f = bn128.MulBy024( + f, + c.Ell0, + bn128.Fq2.MulScalar(c.EllVW, pre1.Py), + bn128.Fq2.MulScalar(c.EllVV, pre1.Px)) + + return f +} + +func (bn128 Bn128) MulBy024(a [2][3][2]*big.Int, ell0, ellVW, ellVV [2]*big.Int) [2][3][2]*big.Int { + b := [2][3][2]*big.Int{ + [3][2]*big.Int{ + ell0, + bn128.Fq2.Zero(), + ellVV, + }, + [3][2]*big.Int{ + bn128.Fq2.Zero(), + ellVW, + bn128.Fq2.Zero(), + }, + } + return bn128.Fq12.Mul(a, b) +} + +func (bn128 Bn128) FinalExponentiation(r [2][3][2]*big.Int) [2][3][2]*big.Int { + res := bn128.Fq12.Exp(r, bn128.FinalExp) + return res +} diff --git a/bn128/bn128_test.go b/bn128/bn128_test.go new file mode 100644 index 0000000..aaecf19 --- /dev/null +++ b/bn128/bn128_test.go @@ -0,0 +1,65 @@ +package bn128 + +import ( + "math/big" + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestBN128(t *testing.T) { + bn128, err := NewBn128() + assert.Nil(t, err) + + big40 := big.NewInt(int64(40)) + big75 := big.NewInt(int64(75)) + + g1a := bn128.G1.MulScalar(bn128.G1.G, bn128.Fq1.Copy(big40)) + g2a := bn128.G2.MulScalar(bn128.G2.G, bn128.Fq1.Copy(big75)) + + g1b := bn128.G1.MulScalar(bn128.G1.G, bn128.Fq1.Copy(big75)) + g2b := bn128.G2.MulScalar(bn128.G2.G, bn128.Fq1.Copy(big40)) + + pre1a := bn128.PreComputeG1(g1a) + pre2a, err := bn128.PreComputeG2(g2a) + assert.Nil(t, err) + pre1b := bn128.PreComputeG1(g1b) + pre2b, err := bn128.PreComputeG2(g2b) + + r1 := bn128.MillerLoop(pre1a, pre2a) + r2 := bn128.MillerLoop(pre1b, pre2b) + + rbe := bn128.Fq12.Mul(r1, bn128.Fq12.Inverse(r2)) + + res := bn128.FinalExponentiation(rbe) + + a := bn128.Fq12.Affine(res) + b := bn128.Fq12.Affine(bn128.Fq12.One()) + + assert.True(t, bn128.Fq12.Equal(a, b)) + assert.True(t, bn128.Fq12.Equal(res, bn128.Fq12.One())) +} + +func TestBN128_PairingFunction(t *testing.T) { + bn128, err := NewBn128() + assert.Nil(t, err) + + big25 := big.NewInt(int64(25)) + big30 := big.NewInt(int64(30)) + + g1a := bn128.G1.MulScalar(bn128.G1.G, big25) + g2a := bn128.G2.MulScalar(bn128.G2.G, big30) + + g1b := bn128.G1.MulScalar(bn128.G1.G, big30) + g2b := bn128.G2.MulScalar(bn128.G2.G, big25) + + pA, err := bn128.Pairing(g1a, g2a) + assert.Nil(t, err) + pB, err := bn128.Pairing(g1b, g2b) + assert.Nil(t, err) + + assert.True(t, bn128.Fq12.Equal(pA, pB)) + + assert.Equal(t, pA[0][0][0].String(), "73680848340331011700282047627232219336104151861349893575958589557226556635706") + assert.Equal(t, bn128.Fq12.Affine(pA)[0][0][0].String(), "8016119724813186033542830391460394070015218389456422587891475873290878009957") +} diff --git a/bn128/fq.go b/bn128/fq.go index 9021802..d3a89d5 100644 --- a/bn128/fq.go +++ b/bn128/fq.go @@ -29,32 +29,37 @@ func (fq Fq) One() *big.Int { // Add performs an addition on the Fq func (fq Fq) Add(a, b *big.Int) *big.Int { - sum := new(big.Int).Add(a, b) - return new(big.Int).Mod(sum, fq.Q) + r := new(big.Int).Add(a, b) + // return new(big.Int).Mod(r, fq.Q) + return r } // Double performs a doubling on the Fq func (fq Fq) Double(a *big.Int) *big.Int { - sum := new(big.Int).Add(a, a) - return new(big.Int).Mod(sum, fq.Q) + r := new(big.Int).Add(a, a) + // return new(big.Int).Mod(r, fq.Q) + return r } // Sub performs a substraction on the Fq func (fq Fq) Sub(a, b *big.Int) *big.Int { - sum := new(big.Int).Sub(a, b) - return new(big.Int).Mod(sum, fq.Q) + r := new(big.Int).Sub(a, b) + // return new(big.Int).Mod(r, fq.Q) + return r } // Neg performs a negation on the Fq func (fq Fq) Neg(a *big.Int) *big.Int { m := new(big.Int).Neg(a) - return new(big.Int).Mod(m, fq.Q) + // return new(big.Int).Mod(m, fq.Q) + return m } // Mul performs a multiplication on the Fq func (fq Fq) Mul(a, b *big.Int) *big.Int { m := new(big.Int).Mul(a, b) return new(big.Int).Mod(m, fq.Q) + // return m } func (fq Fq) MulScalar(base, e *big.Int) *big.Int { @@ -64,12 +69,24 @@ func (fq Fq) MulScalar(base, e *big.Int) *big.Int { // Inverse returns the inverse on the Fq func (fq Fq) Inverse(a *big.Int) *big.Int { return new(big.Int).ModInverse(a, fq.Q) -} - -// Div performs a division on the Fq -func (fq Fq) Div(a, b *big.Int) *big.Int { - // not used in fq1, method added to fit the interface - return a + // q := bigCopy(fq.Q) + // t := big.NewInt(int64(0)) + // r := fq.Q + // newt := big.NewInt(int64(0)) + // newr := fq.Affine(a) + // for !bytes.Equal(newr.Bytes(), big.NewInt(int64(0)).Bytes()) { + // q := new(big.Int).Div(bigCopy(r), bigCopy(newr)) + // + // t = bigCopy(newt) + // newt = fq.Sub(t, fq.Mul(q, newt)) + // + // r = bigCopy(newr) + // newr = fq.Sub(r, fq.Mul(q, newr)) + // } + // if t.Cmp(big.NewInt(0)) == -1 { // t< 0 + // t = fq.Add(t, q) + // } + // return t } // Square performs a square operation on the Fq @@ -87,8 +104,26 @@ func (fq Fq) Copy(a *big.Int) *big.Int { } func (fq Fq) Affine(a *big.Int) *big.Int { - return a + nq := fq.Neg(fq.Q) + + aux := a + if aux.Cmp(big.NewInt(int64(0))) == -1 { // negative value + if aux.Cmp(nq) != 1 { // aux less or equal nq + aux = new(big.Int).Mod(aux, fq.Q) + } + if aux.Cmp(big.NewInt(int64(0))) == -1 { // negative value + aux = new(big.Int).Add(aux, fq.Q) + } + } else { + if aux.Cmp(fq.Q) != -1 { // aux greater or equal nq + aux = new(big.Int).Mod(aux, fq.Q) + } + } + return aux } + func (fq Fq) Equal(a, b *big.Int) bool { - return bytes.Equal(a.Bytes(), b.Bytes()) + aAff := fq.Affine(a) + bAff := fq.Affine(b) + return bytes.Equal(aAff.Bytes(), bAff.Bytes()) } diff --git a/bn128/fq12.go b/bn128/fq12.go index 757cc5f..4665865 100644 --- a/bn128/fq12.go +++ b/bn128/fq12.go @@ -31,7 +31,7 @@ func (fq12 Fq12) Zero() [2][3][2]*big.Int { // One returns a One value on the Fq12 func (fq12 Fq12) One() [2][3][2]*big.Int { - return [2][3][2]*big.Int{fq12.F.One(), fq12.F.One()} + return [2][3][2]*big.Int{fq12.F.One(), fq12.F.Zero()} } func (fq12 Fq12) mulByNonResidue(a [3][2]*big.Int) [3][2]*big.Int { @@ -70,7 +70,7 @@ func (fq12 Fq12) Neg(a [2][3][2]*big.Int) [2][3][2]*big.Int { // Mul performs a multiplication on the Fq12 func (fq12 Fq12) Mul(a, b [2][3][2]*big.Int) [2][3][2]*big.Int { - // Multiplication and Squaring on Pairing-Friendly [2]*big.Ints.pdf; Section 3 (Karatsuba) + // Multiplication and Squaring on Pairing-Friendly .pdf; Section 3 (Karatsuba) v0 := fq12.F.Mul(a[0], b[0]) v1 := fq12.F.Mul(a[1], b[1]) return [2][3][2]*big.Int{ @@ -84,6 +84,8 @@ func (fq12 Fq12) Mul(a, b [2][3][2]*big.Int) [2][3][2]*big.Int { } func (fq12 Fq12) MulScalar(base [2][3][2]*big.Int, e *big.Int) [2][3][2]*big.Int { + // for more possible implementations see g2.go file, at the function g2.MulScalar() + res := fq12.Zero() rem := e exp := base @@ -133,3 +135,27 @@ func (fq12 Fq12) Square(a [2][3][2]*big.Int) [2][3][2]*big.Int { fq12.F.Add(ab, ab), } } + +func (fq12 Fq12) Exp(base [2][3][2]*big.Int, e *big.Int) [2][3][2]*big.Int { + res := fq12.One() + rem := fq12.Fq2.F.Copy(e) + exp := base + + for !bytes.Equal(rem.Bytes(), big.NewInt(int64(0)).Bytes()) { + if BigIsOdd(rem) { + res = fq12.Mul(res, exp) + } + exp = fq12.Square(exp) + rem = new(big.Int).Rsh(rem, 1) + } + return res +} +func (fq12 Fq12) Affine(a [2][3][2]*big.Int) [2][3][2]*big.Int { + return [2][3][2]*big.Int{ + fq12.F.Affine(a[0]), + fq12.F.Affine(a[1]), + } +} +func (fq12 Fq12) Equal(a, b [2][3][2]*big.Int) bool { + return fq12.F.Equal(a[0], b[0]) && fq12.F.Equal(a[1], b[1]) +} diff --git a/bn128/fq2.go b/bn128/fq2.go index db1fe82..fe27431 100644 --- a/bn128/fq2.go +++ b/bn128/fq2.go @@ -1,7 +1,6 @@ package bn128 import ( - "bytes" "math/big" ) @@ -27,7 +26,7 @@ func (fq2 Fq2) Zero() [2]*big.Int { // One returns a One value on the Fq2 func (fq2 Fq2) One() [2]*big.Int { - return [2]*big.Int{fq2.F.One(), fq2.F.One()} + return [2]*big.Int{fq2.F.One(), fq2.F.Zero()} } func (fq2 Fq2) mulByNonResidue(a *big.Int) *big.Int { @@ -63,6 +62,7 @@ func (fq2 Fq2) Neg(a [2]*big.Int) [2]*big.Int { // Mul performs a multiplication on the Fq2 func (fq2 Fq2) Mul(a, b [2]*big.Int) [2]*big.Int { // Multiplication and Squaring on Pairing-Friendly.pdf; Section 3 (Karatsuba) + // https://pdfs.semanticscholar.org/3e01/de88d7428076b2547b60072088507d881bf1.pdf v0 := fq2.F.Mul(a[0], b[0]) v1 := fq2.F.Mul(a[1], b[1]) return [2]*big.Int{ @@ -74,24 +74,31 @@ func (fq2 Fq2) Mul(a, b [2]*big.Int) [2]*big.Int { fq2.F.Add(v0, v1)), } } -func (fq2 Fq2) MulScalar(base [2]*big.Int, e *big.Int) [2]*big.Int { - res := fq2.Zero() - rem := e - exp := base - for !bytes.Equal(rem.Bytes(), big.NewInt(int64(0)).Bytes()) { - // if rem % 2 == 1 - if bytes.Equal(new(big.Int).Rem(rem, big.NewInt(int64(2))).Bytes(), big.NewInt(int64(1)).Bytes()) { - res = fq2.Add(res, exp) +func (fq2 Fq2) MulScalar(p [2]*big.Int, e *big.Int) [2]*big.Int { + // for more possible implementations see g2.go file, at the function g2.MulScalar() + + q := fq2.Zero() + d := fq2.F.Copy(e) + r := p + + foundone := false + for i := d.BitLen(); i >= 0; i-- { + if foundone { + q = fq2.Double(q) + } + if d.Bit(i) == 1 { + foundone = true + q = fq2.Add(q, r) } - exp = fq2.Double(exp) - rem = rem.Rsh(rem, 1) // rem = rem >> 1 } - return res + return q } // Inverse returns the inverse on the Fq2 func (fq2 Fq2) Inverse(a [2]*big.Int) [2]*big.Int { + // High-Speed Software Implementation of the Optimal Ate Pairing over Barreto–Naehrig Curves .pdf + // https://eprint.iacr.org/2010/354.pdf , algorithm 8 t0 := fq2.F.Square(a[0]) t1 := fq2.F.Square(a[1]) t2 := fq2.F.Sub(t0, fq2.mulByNonResidue(t1)) @@ -109,8 +116,8 @@ func (fq2 Fq2) Div(a, b [2]*big.Int) [2]*big.Int { // Square performs a square operation on the Fq2 func (fq2 Fq2) Square(a [2]*big.Int) [2]*big.Int { + // https://pdfs.semanticscholar.org/3e01/de88d7428076b2547b60072088507d881bf1.pdf , complex squaring ab := fq2.F.Mul(a[0], a[1]) - return [2]*big.Int{ fq2.F.Sub( fq2.F.Mul( @@ -138,3 +145,10 @@ func (fq2 Fq2) Affine(a [2]*big.Int) [2]*big.Int { func (fq2 Fq2) Equal(a, b [2]*big.Int) bool { return fq2.F.Equal(a[0], b[0]) && fq2.F.Equal(a[1], b[1]) } + +func (fq2 Fq2) Copy(a [2]*big.Int) [2]*big.Int { + return [2]*big.Int{ + fq2.F.Copy(a[0]), + fq2.F.Copy(a[1]), + } +} diff --git a/bn128/fq6.go b/bn128/fq6.go index ed0ac81..d0fc33f 100644 --- a/bn128/fq6.go +++ b/bn128/fq6.go @@ -27,7 +27,7 @@ func (fq6 Fq6) Zero() [3][2]*big.Int { // One returns a One value on the Fq6 func (fq6 Fq6) One() [3][2]*big.Int { - return [3][2]*big.Int{fq6.F.One(), fq6.F.One(), fq6.F.One()} + return [3][2]*big.Int{fq6.F.One(), fq6.F.Zero(), fq6.F.Zero()} } func (fq6 Fq6) mulByNonResidue(a [2]*big.Int) [2]*big.Int { @@ -95,6 +95,8 @@ func (fq6 Fq6) Mul(a, b [3][2]*big.Int) [3][2]*big.Int { } func (fq6 Fq6) MulScalar(base [3][2]*big.Int, e *big.Int) [3][2]*big.Int { + // for more possible implementations see g2.go file, at the function g2.MulScalar() + res := fq6.Zero() rem := e exp := base @@ -169,3 +171,22 @@ func (fq6 Fq6) Square(a [3][2]*big.Int) [3][2]*big.Int { fq6.F.Add(s0, s4)), } } + +func (fq6 Fq6) Affine(a [3][2]*big.Int) [3][2]*big.Int { + return [3][2]*big.Int{ + fq6.F.Affine(a[0]), + fq6.F.Affine(a[1]), + fq6.F.Affine(a[2]), + } +} +func (fq6 Fq6) Equal(a, b [3][2]*big.Int) bool { + return fq6.F.Equal(a[0], b[0]) && fq6.F.Equal(a[1], b[1]) && fq6.F.Equal(a[2], b[2]) +} + +func (fq6 Fq6) Copy(a [3][2]*big.Int) [3][2]*big.Int { + return [3][2]*big.Int{ + fq6.F.Copy(a[0]), + fq6.F.Copy(a[1]), + fq6.F.Copy(a[2]), + } +} diff --git a/bn128/fqn_test.go b/bn128/fqn_test.go index 3f17673..a22e5eb 100644 --- a/bn128/fqn_test.go +++ b/bn128/fqn_test.go @@ -23,19 +23,19 @@ func TestFq1(t *testing.T) { fq1 := NewFq(iToBig(7)) res := fq1.Add(iToBig(4), iToBig(4)) - assert.Equal(t, iToBig(1), res) + assert.Equal(t, iToBig(1), fq1.Affine(res)) res = fq1.Double(iToBig(5)) - assert.Equal(t, iToBig(3), res) + assert.Equal(t, iToBig(3), fq1.Affine(res)) res = fq1.Sub(iToBig(5), iToBig(7)) - assert.Equal(t, iToBig(5), res) + assert.Equal(t, iToBig(5), fq1.Affine(res)) res = fq1.Neg(iToBig(5)) - assert.Equal(t, iToBig(2), res) + assert.Equal(t, iToBig(2), fq1.Affine(res)) res = fq1.Mul(iToBig(5), iToBig(11)) - assert.Equal(t, iToBig(6), res) + assert.Equal(t, iToBig(6), fq1.Affine(res)) res = fq1.Inverse(iToBig(4)) assert.Equal(t, iToBig(2), res) @@ -46,7 +46,7 @@ func TestFq1(t *testing.T) { func TestFq2(t *testing.T) { fq1 := NewFq(iToBig(7)) - nonResidueFq2str := "-1" // i / Beta + nonResidueFq2str := "-1" // i/j nonResidueFq2, ok := new(big.Int).SetString(nonResidueFq2str, 10) assert.True(t, ok) assert.Equal(t, nonResidueFq2.String(), nonResidueFq2str) @@ -54,45 +54,39 @@ func TestFq2(t *testing.T) { fq2 := Fq2{fq1, nonResidueFq2} res := fq2.Add(iiToBig(4, 4), iiToBig(3, 4)) - assert.Equal(t, iiToBig(0, 1), res) + assert.Equal(t, iiToBig(0, 1), fq2.Affine(res)) res = fq2.Double(iiToBig(5, 3)) - assert.Equal(t, iiToBig(3, 6), res) + assert.Equal(t, iiToBig(3, 6), fq2.Affine(res)) res = fq2.Sub(iiToBig(5, 3), iiToBig(7, 2)) - assert.Equal(t, iiToBig(5, 1), res) + assert.Equal(t, iiToBig(5, 1), fq2.Affine(res)) res = fq2.Neg(iiToBig(4, 4)) - assert.Equal(t, iiToBig(3, 3), res) + assert.Equal(t, iiToBig(3, 3), fq2.Affine(res)) res = fq2.Mul(iiToBig(4, 4), iiToBig(3, 4)) - assert.Equal(t, iiToBig(3, 0), res) + assert.Equal(t, iiToBig(3, 0), fq2.Affine(res)) res = fq2.Inverse(iiToBig(4, 4)) - assert.Equal(t, iiToBig(1, 6), res) - - res = fq2.Div(iiToBig(4, 4), iiToBig(3, 4)) - assert.Equal(t, iiToBig(0, 6), res) + assert.Equal(t, iiToBig(1, 6), fq2.Affine(res)) res = fq2.Square(iiToBig(4, 4)) - assert.Equal(t, iiToBig(0, 4), res) + assert.Equal(t, iiToBig(0, 4), fq2.Affine(res)) res2 := fq2.Mul(iiToBig(4, 4), iiToBig(4, 4)) - assert.Equal(t, res, res2) + assert.Equal(t, fq2.Affine(res), fq2.Affine(res2)) + assert.True(t, fq2.Equal(res, res2)) res = fq2.Square(iiToBig(3, 5)) - assert.Equal(t, iiToBig(5, 2), res) + assert.Equal(t, iiToBig(5, 2), fq2.Affine(res)) res2 = fq2.Mul(iiToBig(3, 5), iiToBig(3, 5)) - assert.Equal(t, res, res2) + assert.Equal(t, fq2.Affine(res), fq2.Affine(res2)) } func TestFq6(t *testing.T) { - fq1 := NewFq(big.NewInt(int64(7))) - nonResidueFq2, ok := new(big.Int).SetString("-1", 10) // i - assert.True(t, ok) - nonResidueFq6 := iiToBig(9, 1) // TODO + bn128, err := NewBn128() + assert.Nil(t, err) - fq2 := Fq2{fq1, nonResidueFq2} - fq6 := Fq6{fq2, nonResidueFq6} a := [3][2]*big.Int{ iiToBig(1, 2), iiToBig(3, 4), @@ -102,33 +96,9 @@ func TestFq6(t *testing.T) { iiToBig(10, 9), iiToBig(8, 7)} - res := fq6.Add(a, b) - assert.Equal(t, - [3][2]*big.Int{ - iiToBig(6, 6), - iiToBig(6, 6), - iiToBig(6, 6)}, - res) - - res = fq6.Sub(a, b) - assert.Equal(t, - [3][2]*big.Int{ - iiToBig(3, 5), - iiToBig(0, 2), - iiToBig(4, 6)}, - res) - - res = fq6.Mul(a, b) - assert.Equal(t, - [3][2]*big.Int{ - iiToBig(5, 0), - iiToBig(2, 1), - iiToBig(3, 0)}, - res) - - mulRes := fq6.Mul(a, b) - divRes := fq6.Div(mulRes, b) - assert.Equal(t, a, divRes) + mulRes := bn128.Fq6.Mul(a, b) + divRes := bn128.Fq6.Div(mulRes, b) + assert.Equal(t, bn128.Fq6.Affine(a), bn128.Fq6.Affine(divRes)) } func TestFq12(t *testing.T) { @@ -186,5 +156,5 @@ func TestFq12(t *testing.T) { mulRes := fq12.Mul(a, b) divRes := fq12.Div(mulRes, b) - assert.Equal(t, a, divRes) + assert.Equal(t, fq12.Affine(a), fq12.Affine(divRes)) } diff --git a/bn128/g1.go b/bn128/g1.go index 19442f5..4edd043 100644 --- a/bn128/g1.go +++ b/bn128/g1.go @@ -1,7 +1,6 @@ package bn128 import ( - "bytes" "math/big" ) @@ -117,7 +116,7 @@ func (g1 G1) Double(p [3]*big.Int) [3]*big.Int { t3 := g1.F.Sub(t2, c) d := g1.F.Double(t3) - e := g1.F.Add(g1.F.Add(a, a), a) // e = 3*a + e := g1.F.Add(g1.F.Add(a, a), a) f := g1.F.Square(e) t4 := g1.F.Double(d) @@ -136,21 +135,21 @@ func (g1 G1) Double(p [3]*big.Int) [3]*big.Int { return [3]*big.Int{x3, y3, z3} } -func (g1 G1) MulScalar(base [3]*big.Int, e *big.Int) [3]*big.Int { - // res := g1.Zero() - res := [3]*big.Int{g1.F.Zero(), g1.F.Zero(), g1.F.Zero()} - rem := e - exp := base - - for !bytes.Equal(rem.Bytes(), big.NewInt(int64(0)).Bytes()) { - // if rem % 2 == 1 - if bytes.Equal(new(big.Int).Rem(rem, big.NewInt(int64(2))).Bytes(), big.NewInt(int64(1)).Bytes()) { - res = g1.Add(res, exp) +func (g1 G1) MulScalar(p [3]*big.Int, e *big.Int) [3]*big.Int { + // https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Double-and-add + // for more possible implementations see g2.go file, at the function g2.MulScalar() + + q := [3]*big.Int{g1.F.Zero(), g1.F.Zero(), g1.F.Zero()} + d := g1.F.Copy(e) + r := p + for i := d.BitLen() - 1; i >= 0; i-- { + q = g1.Double(q) + if d.Bit(i) == 1 { + q = g1.Add(q, r) } - exp = g1.Double(exp) - rem = rem.Rsh(rem, 1) // rem = rem >> 1 } - return res + + return q } func (g1 G1) Affine(p [3]*big.Int) [2]*big.Int { @@ -167,3 +166,26 @@ func (g1 G1) Affine(p [3]*big.Int) [2]*big.Int { return [2]*big.Int{x, y} } + +func (g1 G1) Equal(p1, p2 [3]*big.Int) bool { + if g1.IsZero(p1) { + return g1.IsZero(p2) + } + if g1.IsZero(p2) { + return g1.IsZero(p1) + } + + z1z1 := g1.F.Square(p1[2]) + z2z2 := g1.F.Square(p2[2]) + + u1 := g1.F.Mul(p1[0], z2z2) + u2 := g1.F.Mul(p2[0], z1z1) + + z1cub := g1.F.Mul(p1[2], z1z1) + z2cub := g1.F.Mul(p2[2], z2z2) + + s1 := g1.F.Mul(p1[1], z2cub) + s2 := g1.F.Mul(p2[1], z1cub) + + return g1.F.Equal(u1, u2) && g1.F.Equal(s1, s2) +} diff --git a/bn128/g1_test.go b/bn128/g1_test.go index 8c9adbe..e2bf533 100644 --- a/bn128/g1_test.go +++ b/bn128/g1_test.go @@ -18,10 +18,11 @@ func TestG1(t *testing.T) { gr1 := bn128.G1.MulScalar(bn128.G1.G, bn128.Fq1.Copy(r1)) gr2 := bn128.G1.MulScalar(bn128.G1.G, bn128.Fq1.Copy(r2)) - grsum1 := bn128.G1.Add(gr1, gr2) - r1r2 := bn128.Fq1.Add(r1, r2) - grsum2 := bn128.G1.MulScalar(bn128.G1.G, r1r2) + grsum1 := bn128.G1.Add(gr1, gr2) // g*33 + g*44 + r1r2 := bn128.Fq1.Add(r1, r2) // 33 + 44 + grsum2 := bn128.G1.MulScalar(bn128.G1.G, r1r2) // g * (33+44) + assert.True(t, bn128.G1.Equal(grsum1, grsum2)) a := bn128.G1.Affine(grsum1) b := bn128.G1.Affine(grsum2) assert.Equal(t, a, b) diff --git a/bn128/g2.go b/bn128/g2.go index ebb33b8..f6b7cad 100644 --- a/bn128/g2.go +++ b/bn128/g2.go @@ -1,7 +1,6 @@ package bn128 import ( - "bytes" "math/big" ) @@ -119,7 +118,7 @@ func (g2 G2) Double(p [3][2]*big.Int) [3][2]*big.Int { t3 := g2.F.Sub(t2, c) d := g2.F.Double(t3) - e := g2.F.Add(g2.F.Add(a, a), a) // e = 3*a + e := g2.F.Add(g2.F.Add(a, a), a) f := g2.F.Square(e) t4 := g2.F.Double(d) @@ -138,21 +137,45 @@ func (g2 G2) Double(p [3][2]*big.Int) [3][2]*big.Int { return [3][2]*big.Int{x3, y3, z3} } -func (g2 G2) MulScalar(base [3][2]*big.Int, e *big.Int) [3][2]*big.Int { - // res := g2.Zero() - res := [3][2]*big.Int{g2.F.Zero(), g2.F.Zero(), g2.F.Zero()} - rem := e - exp := base +func (g2 G2) MulScalar(p [3][2]*big.Int, e *big.Int) [3][2]*big.Int { + // https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Double-and-add - for !bytes.Equal(rem.Bytes(), big.NewInt(int64(0)).Bytes()) { - // if rem % 2 == 1 - if bytes.Equal(new(big.Int).Rem(rem, big.NewInt(int64(2))).Bytes(), big.NewInt(int64(1)).Bytes()) { - res = g2.Add(res, exp) + q := [3][2]*big.Int{g2.F.Zero(), g2.F.Zero(), g2.F.Zero()} + d := g2.F.F.Copy(e) // d := e + r := p + + /* + here are three possible implementations: + */ + + /* index decreasing: */ + for i := d.BitLen() - 1; i >= 0; i-- { + q = g2.Double(q) + if d.Bit(i) == 1 { + q = g2.Add(q, r) } - exp = g2.Double(exp) - rem = rem.Rsh(rem, 1) // rem = rem >> 1 } - return res + + /* index increasing: */ + // for i := 0; i <= d.BitLen(); i++ { + // if d.Bit(i) == 1 { + // q = g2.Add(q, r) + // } + // r = g2.Double(r) + // } + + // foundone := false + // for i := d.BitLen(); i >= 0; i-- { + // if foundone { + // q = g2.Double(q) + // } + // if d.Bit(i) == 1 { + // foundone = true + // q = g2.Add(q, r) + // } + // } + + return q } func (g2 G2) Affine(p [3][2]*big.Int) [3][2]*big.Int { @@ -168,11 +191,31 @@ func (g2 G2) Affine(p [3][2]*big.Int) [3][2]*big.Int { y := g2.F.Mul(p[1], zinv3) return [3][2]*big.Int{ - x, - y, - [2]*big.Int{ - big.NewInt(int64(0)), - big.NewInt(int64(0)), - }, + g2.F.Affine(x), + g2.F.Affine(y), + g2.F.One(), + } +} + +func (g2 G2) Equal(p1, p2 [3][2]*big.Int) bool { + if g2.IsZero(p1) { + return g2.IsZero(p2) } + if g2.IsZero(p2) { + return g2.IsZero(p1) + } + + z1z1 := g2.F.Square(p1[2]) + z2z2 := g2.F.Square(p2[2]) + + u1 := g2.F.Mul(p1[0], z2z2) + u2 := g2.F.Mul(p2[0], z1z1) + + z1cub := g2.F.Mul(p1[2], z1z1) + z2cub := g2.F.Mul(p2[2], z2z2) + + s1 := g2.F.Mul(p1[1], z2cub) + s2 := g2.F.Mul(p2[1], z1cub) + + return g2.F.Equal(u1, u2) && g2.F.Equal(s1, s2) } diff --git a/bn128/g2_test.go b/bn128/g2_test.go index 8a65dc1..0782ae0 100644 --- a/bn128/g2_test.go +++ b/bn128/g2_test.go @@ -14,14 +14,11 @@ func TestG2(t *testing.T) { r1 := big.NewInt(int64(33)) r2 := big.NewInt(int64(44)) - gr1 := bn128.G2.MulScalar(bn128.G2.G, bn128.Fq1.Copy(r1)) - gr2 := bn128.G2.MulScalar(bn128.G2.G, bn128.Fq1.Copy(r2)) + gr1 := bn128.G2.Affine(bn128.G2.MulScalar(bn128.G2.G, r1)) + gr2 := bn128.G2.Affine(bn128.G2.MulScalar(bn128.G2.G, r2)) - grsum1 := bn128.G2.Add(gr1, gr2) - r1r2 := bn128.Fq1.Add(r1, r2) - grsum2 := bn128.G2.MulScalar(bn128.G2.G, r1r2) - - a := bn128.G2.Affine(grsum1) - b := bn128.G2.Affine(grsum2) - assert.Equal(t, a, b) + grsum1 := bn128.G2.Affine(bn128.G2.Add(gr1, gr2)) + r1r2 := bn128.Fq1.Affine(bn128.Fq1.Add(r1, r2)) + grsum2 := bn128.G2.Affine(bn128.G2.MulScalar(bn128.G2.G, r1r2)) + assert.True(t, bn128.G2.Equal(grsum1, grsum2)) } diff --git a/paillier/paillier.go b/paillier/paillier.go index e2179a3..13fc0f2 100644 --- a/paillier/paillier.go +++ b/paillier/paillier.go @@ -10,7 +10,7 @@ import ( ) const ( - bits = 16 + bits = 18 ) // PublicKey stores the public key data diff --git a/shamirsecretsharing/shamirsecretsharing_test.go b/shamirsecretsharing/shamirsecretsharing_test.go index f326ecc..b0e71c3 100644 --- a/shamirsecretsharing/shamirsecretsharing_test.go +++ b/shamirsecretsharing/shamirsecretsharing_test.go @@ -3,7 +3,6 @@ package shamirsecretsharing import ( "bytes" "crypto/rand" - "fmt" "math/big" "testing" @@ -31,14 +30,14 @@ func TestCreate(t *testing.T) { sharesToUse = append(sharesToUse, shares[0]) secr := LagrangeInterpolation(sharesToUse, p) - fmt.Print("original secret: ") - fmt.Println(k) - fmt.Print("p: ") - fmt.Println(p) - fmt.Print("shares: ") - fmt.Println(shares) - fmt.Print("secret result: ") - fmt.Println(secr) + // fmt.Print("original secret: ") + // fmt.Println(k) + // fmt.Print("p: ") + // fmt.Println(p) + // fmt.Print("shares: ") + // fmt.Println(shares) + // fmt.Print("secret result: ") + // fmt.Println(secr) if !bytes.Equal(k.Bytes(), secr.Bytes()) { t.Errorf("reconstructed secret not correspond to original secret") }