Add goff ff.Element to babyjubjub

WIP, at this moment still does not bring much optimization

babyjub/babyjub.go

@@ -5,14 +5,15 @@ import (
 	"math/big"
 
 	"github.com/iden3/go-iden3-crypto/constants"
+	"github.com/iden3/go-iden3-crypto/ff"
 	"github.com/iden3/go-iden3-crypto/utils"
 )
 
 // A is one of the babyjub constants.
-var A *big.Int
+var A *ff.Element
 
 // D is one of the babyjub constants.
-var D *big.Int
+var D *ff.Element
 
 // Order of the babyjub curve.
 var Order *big.Int
@@ -27,29 +28,52 @@ var B8 *Point
 
 // init initializes global numbers and the subgroup base.
 func init() {
-	A = utils.NewIntFromString("168700")
-	D = utils.NewIntFromString("168696")
+	A = ff.NewElement().SetString("168700")
+	D = ff.NewElement().SetString("168696")
 
 	Order = utils.NewIntFromString(
 		"21888242871839275222246405745257275088614511777268538073601725287587578984328")
 	SubOrder = new(big.Int).Rsh(Order, 3)
 
 	B8 = NewPoint()
-	B8.X = utils.NewIntFromString(
+	B8.X = ff.NewElement().SetString(
 		"5299619240641551281634865583518297030282874472190772894086521144482721001553")
-	B8.Y = utils.NewIntFromString(
+	B8.Y = ff.NewElement().SetString(
 		"16950150798460657717958625567821834550301663161624707787222815936182638968203")
 }
 
-// Point represents a point of the babyjub curve.
-type Point struct {
+// PointBI represents a point of the babyjub curve.
+type PointBI struct {
 	X *big.Int
 	Y *big.Int
 }
 
-// NewPoint creates a new Point.
+type Point struct {
+	X *ff.Element
+	Y *ff.Element
+}
+
+func PointBIToPoint(p *PointBI) *Point {
+	return &Point{
+		X: ff.NewElement().SetBigInt(p.X),
+		Y: ff.NewElement().SetBigInt(p.Y),
+	}
+}
+
+func PointToPointBI(p *Point) *PointBI {
+	return &PointBI{
+		X: p.X.BigInt(),
+		Y: p.Y.BigInt(),
+	}
+}
+
+// NewPoint creates a new PointBI.
+func NewPointBI() *PointBI {
+	return &PointBI{X: big.NewInt(0), Y: big.NewInt(1)}
+}
+
 func NewPoint() *Point {
-	return &Point{X: big.NewInt(0), Y: big.NewInt(1)}
+	return &Point{X: ff.NewElement().SetZero(), Y: ff.NewElement().SetOne()}
 }
 
 // Set copies a Point c into the Point p
@@ -59,44 +83,45 @@ func (p *Point) Set(c *Point) *Point {
 	return p
 }
 
+func (p *Point) Equal(q *Point) bool {
+	// return p.X.Cmp(q.X) == 0 && p.Y.Cmp(q.Y) == 0
+	return p.X.Equal(q.X) && p.Y.Equal(q.Y)
+}
+
 // Add adds Point a and b into res
 func (res *Point) Add(a *Point, b *Point) *Point {
 	// x = (a.x * b.y + b.x * a.y) * (1 + D * a.x * b.x * a.y * b.y)^-1 mod q
-	x1a := new(big.Int).Mul(a.X, b.Y)
-	x1b := new(big.Int).Mul(b.X, a.Y)
+	x1a := ff.NewElement().Mul(a.X, b.Y)
+	x1b := ff.NewElement().Mul(b.X, a.Y)
 	x1a.Add(x1a, x1b) // x1a = a.x * b.y + b.x * a.y
 
-	x2 := new(big.Int).Set(D)
+	x2 := ff.NewElement().Set(D)
 	x2.Mul(x2, a.X)
 	x2.Mul(x2, b.X)
 	x2.Mul(x2, a.Y)
 	x2.Mul(x2, b.Y)
-	x2.Add(constants.One, x2)
-	x2.Mod(x2, constants.Q)
-	x2.ModInverse(x2, constants.Q) // x2 = (1 + D * a.x * b.x * a.y * b.y)^-1
+	x2.Add(ff.NewElement().SetOne(), x2)
+	x2.Inverse(x2) // x2 = (1 + D * a.x * b.x * a.y * b.y)^-1
 
 	// y = (a.y * b.y - A * a.x * b.x) * (1 - D * a.x * b.x * a.y * b.y)^-1 mod q
-	y1a := new(big.Int).Mul(a.Y, b.Y)
-	y1b := new(big.Int).Set(A)
+	y1a := ff.NewElement().Mul(a.Y, b.Y)
+	y1b := ff.NewElement().Set(A)
 	y1b.Mul(y1b, a.X)
 	y1b.Mul(y1b, b.X)
 
 	y1a.Sub(y1a, y1b) // y1a = a.y * b.y - A * a.x * b.x
 
-	y2 := new(big.Int).Set(D)
+	y2 := ff.NewElement().Set(D)
 	y2.Mul(y2, a.X)
 	y2.Mul(y2, b.X)
 	y2.Mul(y2, a.Y)
 	y2.Mul(y2, b.Y)
-	y2.Sub(constants.One, y2)
-	y2.Mod(y2, constants.Q)
-	y2.ModInverse(y2, constants.Q) // y2 = (1 - D * a.x * b.x * a.y * b.y)^-1
+	y2.Sub(ff.NewElement().SetOne(), y2)
+	y2.Inverse(y2) // y2 = (1 - D * a.x * b.x * a.y * b.y)^-1
 
 	res.X = x1a.Mul(x1a, x2)
-	res.X = res.X.Mod(res.X, constants.Q)
 
 	res.Y = y1a.Mul(y1a, y2)
-	res.Y = res.Y.Mod(res.Y, constants.Q)
 
 	return res
 }
@@ -104,8 +129,8 @@ func (res *Point) Add(a *Point, b *Point) *Point {
 // Mul multiplies the Point p by the scalar s and stores the result in res,
 // which is also returned.
 func (res *Point) Mul(s *big.Int, p *Point) *Point {
-	res.X = big.NewInt(0)
-	res.Y = big.NewInt(1)
+	res.X = ff.NewElement().SetZero()
+	res.Y = ff.NewElement().SetOne()
 	exp := NewPoint().Set(p)
 
 	for i := 0; i < s.BitLen(); i++ {
@@ -120,25 +145,21 @@ func (res *Point) Mul(s *big.Int, p *Point) *Point {
 
 // InCurve returns true when the Point p is in the babyjub curve.
 func (p *Point) InCurve() bool {
-	x2 := new(big.Int).Set(p.X)
+	x2 := ff.NewElement().Set(p.X)
 	x2.Mul(x2, x2)
-	x2.Mod(x2, constants.Q)
 
-	y2 := new(big.Int).Set(p.Y)
+	y2 := ff.NewElement().Set(p.Y)
 	y2.Mul(y2, y2)
-	y2.Mod(y2, constants.Q)
 
-	a := new(big.Int).Mul(A, x2)
+	a := ff.NewElement().Mul(A, x2)
 	a.Add(a, y2)
-	a.Mod(a, constants.Q)
 
-	b := new(big.Int).Set(D)
+	b := ff.NewElement().Set(D)
 	b.Mul(b, x2)
 	b.Mul(b, y2)
-	b.Add(constants.One, b)
-	b.Mod(b, constants.Q)
+	b.Add(ff.NewElement().SetOne(), b)
 
-	return a.Cmp(b) == 0
+	return a.Equal(b)
 }
 
 // InSubGroup returns true when the Point p is in the subgroup of the babyjub
@@ -148,7 +169,7 @@ func (p *Point) InSubGroup() bool {
 		return false
 	}
 	res := NewPoint().Mul(SubOrder, p)
-	return (res.X.Cmp(constants.Zero) == 0) && (res.Y.Cmp(constants.One) == 0)
+	return res.X.Equal(ff.NewElement().SetZero()) && res.Y.Equal(ff.NewElement().SetOne())
 }
 
 // PointCoordSign returns the sign of the curve point coordinate.  It returns
@@ -171,8 +192,9 @@ func PackPoint(ay *big.Int, sign bool) [32]byte {
 // Compress the point into a 32 byte array that contains the y coordinate in
 // little endian and the sign of the x coordinate.
 func (p *Point) Compress() [32]byte {
-	sign := PointCoordSign(p.X)
-	return PackPoint(p.Y, sign)
+	pBI := PointToPointBI(p)
+	sign := PointCoordSign(pBI.X)
+	return PackPoint(pBI.Y, sign)
 }
 
 // Decompress a compressed Point into p, and also returns the decompressed
@@ -183,34 +205,37 @@ func (p *Point) Decompress(leBuf [32]byte) (*Point, error) {
 		sign = true
 		leBuf[31] = leBuf[31] & 0x7F
 	}
-	utils.SetBigIntFromLEBytes(p.Y, leBuf[:])
-	if p.Y.Cmp(constants.Q) >= 0 {
+	y := big.NewInt(0)
+	utils.SetBigIntFromLEBytes(y, leBuf[:])
+	if y.Cmp(constants.Q) >= 0 {
 		return nil, fmt.Errorf("p.y >= Q")
 	}
+	p.Y = ff.NewElement().SetBigInt(y)
 
-	y2 := new(big.Int).Mul(p.Y, p.Y)
-	y2.Mod(y2, constants.Q)
-	xa := big.NewInt(1)
+	y2 := ff.NewElement().Mul(p.Y, p.Y)
+	xa := ff.NewElement().SetOne()
 	xa.Sub(xa, y2) // xa == 1 - y^2
 
-	xb := new(big.Int).Mul(D, y2)
-	xb.Mod(xb, constants.Q)
+	xb := ff.NewElement().Mul(D, y2)
 	xb.Sub(A, xb) // xb = A - d * y^2
 
-	if xb.Cmp(big.NewInt(0)) == 0 {
+	if xb.Equal(ff.NewElement().SetZero()) {
 		return nil, fmt.Errorf("division by 0")
 	}
-	xb.ModInverse(xb, constants.Q)
+	xb.Inverse(xb)
 	p.X.Mul(xa, xb) // xa / xb
-	p.X.Mod(p.X, constants.Q)
-	noSqrt := p.X.ModSqrt(p.X, constants.Q)
+
+	q := PointToPointBI(p)
+	noSqrt := q.X.ModSqrt(q.X, constants.Q)
 	if noSqrt == nil {
 		return nil, fmt.Errorf("x is not a square mod q")
 	}
-	if (sign && !PointCoordSign(p.X)) || (!sign && PointCoordSign(p.X)) {
-		p.X.Mul(p.X, constants.MinusOne)
+	if (sign && !PointCoordSign(q.X)) || (!sign && PointCoordSign(q.X)) {
+		q.X.Mul(q.X, constants.MinusOne)
 	}
-	p.X.Mod(p.X, constants.Q)
+	q.X.Mod(q.X, constants.Q)
+
+	p = PointBIToPoint(q)
 
 	return p, nil
 }

babyjub/babyjub_test.go

@@ -7,13 +7,21 @@ import (
 	"testing"
 
 	"github.com/iden3/go-iden3-crypto/constants"
+	"github.com/iden3/go-iden3-crypto/ff"
 	"github.com/iden3/go-iden3-crypto/utils"
 	"github.com/stretchr/testify/assert"
 )
 
+func zero() *ff.Element {
+	return ff.NewElement().SetZero()
+}
+func one() *ff.Element {
+	return ff.NewElement().SetOne()
+}
+
 func TestAdd1(t *testing.T) {
-	a := &Point{X: big.NewInt(0), Y: big.NewInt(1)}
-	b := &Point{X: big.NewInt(0), Y: big.NewInt(1)}
+	a := &Point{X: zero(), Y: one()}
+	b := &Point{X: zero(), Y: one()}
 
 	c := NewPoint().Add(a, b)
 	// fmt.Printf("%v = 2 * %v", *c, *a)
@@ -22,15 +30,15 @@ func TestAdd1(t *testing.T) {
 }
 
 func TestAdd2(t *testing.T) {
-	aX := utils.NewIntFromString(
+	aX := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	aY := utils.NewIntFromString(
+	aY := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	a := &Point{X: aX, Y: aY}
 
-	bX := utils.NewIntFromString(
+	bX := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	bY := utils.NewIntFromString(
+	bY := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	b := &Point{X: bX, Y: bY}
 
@@ -45,15 +53,15 @@ func TestAdd2(t *testing.T) {
 }
 
 func TestAdd3(t *testing.T) {
-	aX := utils.NewIntFromString(
+	aX := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	aY := utils.NewIntFromString(
+	aY := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	a := &Point{X: aX, Y: aY}
 
-	bX := utils.NewIntFromString(
+	bX := ff.NewElement().SetString(
 		"16540640123574156134436876038791482806971768689494387082833631921987005038935")
-	bY := utils.NewIntFromString(
+	bY := ff.NewElement().SetString(
 		"20819045374670962167435360035096875258406992893633759881276124905556507972311")
 	b := &Point{X: bX, Y: bY}
 
@@ -68,15 +76,15 @@ func TestAdd3(t *testing.T) {
 }
 
 func TestAdd4(t *testing.T) {
-	aX := utils.NewIntFromString(
+	aX := ff.NewElement().SetString(
 		"0")
-	aY := utils.NewIntFromString(
+	aY := ff.NewElement().SetString(
 		"1")
 	a := &Point{X: aX, Y: aY}
 
-	bX := utils.NewIntFromString(
+	bX := ff.NewElement().SetString(
 		"16540640123574156134436876038791482806971768689494387082833631921987005038935")
-	bY := utils.NewIntFromString(
+	bY := ff.NewElement().SetString(
 		"20819045374670962167435360035096875258406992893633759881276124905556507972311")
 	b := &Point{X: bX, Y: bY}
 
@@ -91,19 +99,19 @@ func TestAdd4(t *testing.T) {
 }
 
 func TestInCurve1(t *testing.T) {
-	p := &Point{X: big.NewInt(0), Y: big.NewInt(1)}
+	p := &Point{X: zero(), Y: one()}
 	assert.Equal(t, true, p.InCurve())
 }
 
 func TestInCurve2(t *testing.T) {
-	p := &Point{X: big.NewInt(1), Y: big.NewInt(0)}
+	p := &Point{X: one(), Y: zero()}
 	assert.Equal(t, false, p.InCurve())
 }
 
 func TestMul0(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	p := &Point{X: x, Y: y}
 	s := utils.NewIntFromString("3")
@@ -123,9 +131,9 @@ func TestMul0(t *testing.T) {
 }
 
 func TestMul1(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	p := &Point{X: x, Y: y}
 	s := utils.NewIntFromString(
@@ -140,9 +148,9 @@ func TestMul1(t *testing.T) {
 }
 
 func TestMul2(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"6890855772600357754907169075114257697580319025794532037257385534741338397365")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"4338620300185947561074059802482547481416142213883829469920100239455078257889")
 	p := &Point{X: x, Y: y}
 	s := utils.NewIntFromString(
@@ -157,45 +165,45 @@ func TestMul2(t *testing.T) {
 }
 
 func TestInCurve3(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	p := &Point{X: x, Y: y}
 	assert.Equal(t, true, p.InCurve())
 }
 
 func TestInCurve4(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"6890855772600357754907169075114257697580319025794532037257385534741338397365")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"4338620300185947561074059802482547481416142213883829469920100239455078257889")
 	p := &Point{X: x, Y: y}
 	assert.Equal(t, true, p.InCurve())
 }
 
 func TestInSubGroup1(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	p := &Point{X: x, Y: y}
 	assert.Equal(t, true, p.InSubGroup())
 }
 
 func TestInSubGroup2(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"6890855772600357754907169075114257697580319025794532037257385534741338397365")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"4338620300185947561074059802482547481416142213883829469920100239455078257889")
 	p := &Point{X: x, Y: y}
 	assert.Equal(t, true, p.InSubGroup())
 }
 
 func TestCompressDecompress1(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	p := &Point{X: x, Y: y}
 
@@ -209,9 +217,9 @@ func TestCompressDecompress1(t *testing.T) {
 }
 
 func TestCompressDecompress2(t *testing.T) {
-	x := utils.NewIntFromString(
+	x := ff.NewElement().SetString(
 		"6890855772600357754907169075114257697580319025794532037257385534741338397365")
-	y := utils.NewIntFromString(
+	y := ff.NewElement().SetString(
 		"4338620300185947561074059802482547481416142213883829469920100239455078257889")
 	p := &Point{X: x, Y: y}
 
@@ -230,7 +238,8 @@ func TestCompressDecompressRnd(t *testing.T) {
 		buf := p1.Compress()
 		p2, err := NewPoint().Decompress(buf)
 		assert.Equal(t, nil, err)
-		assert.Equal(t, p1, p2)
+		// assert.Equal(t, p1, p2)
+		assert.True(t, p1.Equal(p2))
 	}
 }
 
@@ -241,15 +250,15 @@ func BenchmarkBabyjub(b *testing.B) {
 
 	var badpoints [n]*Point
 	for i := 0; i < n; i++ {
-		x := new(big.Int).Rand(rnd, constants.Q)
-		y := new(big.Int).Rand(rnd, constants.Q)
+		x := ff.NewElement().SetRandom()
+		y := ff.NewElement().SetRandom()
 		badpoints[i] = &Point{X: x, Y: y}
 	}
 
 	var points [n]*Point
-	baseX := utils.NewIntFromString(
+	baseX := ff.NewElement().SetString(
 		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
-	baseY := utils.NewIntFromString(
+	baseY := ff.NewElement().SetString(
 		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
 	base := &Point{X: baseX, Y: baseY}
 	for i := 0; i < n; i++ {
@@ -263,8 +272,8 @@ func BenchmarkBabyjub(b *testing.B) {
 	}
 
 	b.Run("AddConst", func(b *testing.B) {
-		p0 := &Point{X: big.NewInt(0), Y: big.NewInt(1)}
-		p1 := &Point{X: big.NewInt(0), Y: big.NewInt(1)}
+		p0 := &Point{X: zero(), Y: one()}
+		p1 := &Point{X: zero(), Y: one()}
 
 		p2 := NewPoint()
 		for i := 0; i < b.N; i++ {

babyjub/eddsa.go

@@ -180,7 +180,7 @@ func (k *PrivateKey) SignMimc7(msg *big.Int) *Signature {
 	r.Mod(r, SubOrder)
 	R8 := NewPoint().Mul(r, B8) // R8 = r * 8 * B
 	A := k.Public().Point()
-	hmInput := []*big.Int{R8.X, R8.Y, A.X, A.Y, msg}
+	hmInput := []*big.Int{R8.X.BigInt(), R8.Y.BigInt(), A.X.BigInt(), A.Y.BigInt(), msg}
 	hm, err := mimc7.Hash(hmInput, nil) // hm = H1(8*R.x, 8*R.y, A.x, A.y, msg)
 	if err != nil {
 		panic(err)
@@ -196,7 +196,7 @@ func (k *PrivateKey) SignMimc7(msg *big.Int) *Signature {
 // VerifyMimc7 verifies the signature of a message encoded as a big.Int in Zq
 // using blake-512 hash for buffer hashing and mimc7 for big.Int hashing.
 func (p *PublicKey) VerifyMimc7(msg *big.Int, sig *Signature) bool {
-	hmInput := []*big.Int{sig.R8.X, sig.R8.Y, p.X, p.Y, msg}
+	hmInput := []*big.Int{sig.R8.X.BigInt(), sig.R8.Y.BigInt(), p.X.BigInt(), p.Y.BigInt(), msg}
 	hm, err := mimc7.Hash(hmInput, nil) // hm = H1(8*R.x, 8*R.y, A.x, A.y, msg)
 	if err != nil {
 		panic(err)
@@ -207,7 +207,7 @@ func (p *PublicKey) VerifyMimc7(msg *big.Int, sig *Signature) bool {
 	r1.Mul(r1, hm)
 	right := NewPoint().Mul(r1, p.Point())
 	right.Add(sig.R8, right) // right = 8 * R + 8 * hm * A
-	return (left.X.Cmp(right.X) == 0) && (left.Y.Cmp(right.Y) == 0)
+	return left.X.Equal(right.X) && left.Y.Equal(right.Y)
 }
 
 // SignPoseidon signs a message encoded as a big.Int in Zq using blake-512 hash
@@ -223,7 +223,7 @@ func (k *PrivateKey) SignPoseidon(msg *big.Int) *Signature {
 	R8 := NewPoint().Mul(r, B8) // R8 = r * 8 * B
 	A := k.Public().Point()
 
-	hmInput := [poseidon.T]*big.Int{R8.X, R8.Y, A.X, A.Y, msg, big.NewInt(int64(0))}
+	hmInput := [poseidon.T]*big.Int{R8.X.BigInt(), R8.Y.BigInt(), A.X.BigInt(), A.Y.BigInt(), msg, big.NewInt(int64(0))}
 	hm, err := poseidon.PoseidonHash(hmInput) // hm = H1(8*R.x, 8*R.y, A.x, A.y, msg)
 	if err != nil {
 		panic(err)
@@ -240,7 +240,7 @@ func (k *PrivateKey) SignPoseidon(msg *big.Int) *Signature {
 // VerifyPoseidon verifies the signature of a message encoded as a big.Int in Zq
 // using blake-512 hash for buffer hashing and Poseidon for big.Int hashing.
 func (p *PublicKey) VerifyPoseidon(msg *big.Int, sig *Signature) bool {
-	hmInput := [poseidon.T]*big.Int{sig.R8.X, sig.R8.Y, p.X, p.Y, msg, big.NewInt(int64(0))}
+	hmInput := [poseidon.T]*big.Int{sig.R8.X.BigInt(), sig.R8.Y.BigInt(), p.X.BigInt(), p.Y.BigInt(), msg, big.NewInt(int64(0))}
 	hm, err := poseidon.PoseidonHash(hmInput) // hm = H1(8*R.x, 8*R.y, A.x, A.y, msg)
 	if err != nil {
 		panic(err)
@@ -251,5 +251,5 @@ func (p *PublicKey) VerifyPoseidon(msg *big.Int, sig *Signature) bool {
 	r1.Mul(r1, hm)
 	right := NewPoint().Mul(r1, p.Point())
 	right.Add(sig.R8, right) // right = 8 * R + 8 * hm * A
-	return (left.X.Cmp(right.X) == 0) && (left.Y.Cmp(right.Y) == 0)
+	return left.X.Equal(right.X) && left.Y.Equal(right.Y)
 }

babyjub/eddsa_test.go

@@ -31,8 +31,8 @@ func TestPublicKey(t *testing.T) {
 		hex.Decode(k[:], []byte{byte(i)})
 	}
 	pk := k.Public()
-	assert.True(t, pk.X.Cmp(constants.Q) == -1)
-	assert.True(t, pk.Y.Cmp(constants.Q) == -1)
+	assert.True(t, pk.X.BigInt().Cmp(constants.Q) == -1)
+	assert.True(t, pk.Y.BigInt().Cmp(constants.Q) == -1)
 }
 
 func TestSignVerifyMimc7(t *testing.T) {

ff/util.go

@@ -1,5 +1,13 @@
 package ff
 
+import "math/big"
+
 func NewElement() *Element {
 	return &Element{}
 }
+
+func (e *Element) BigInt() *big.Int {
+	b := big.NewInt(0)
+	e.ToBigIntRegular(b)
+	return b
+}

field/field.go

@@ -1,152 +0,0 @@
-// code originally taken from https://github.com/arnaucube/go-snark (https://github.com/arnaucube/go-snark/blob/master/fields/fq.go), pasted here to ensure compatibility among future changes
-
-package field
-
-import (
-	"bytes"
-	"crypto/rand"
-	"math/big"
-)
-
-// Fq is the Z field over modulus Q
-type Fq struct {
-	Q *big.Int // Q
-}
-
-// NewFq generates a new Fq
-func NewFq(q *big.Int) Fq {
-	return Fq{
-		q,
-	}
-}
-
-// Zero returns a Zero value on the Fq
-func (fq Fq) Zero() *big.Int {
-	return big.NewInt(int64(0))
-}
-
-// One returns a One value on the Fq
-func (fq Fq) One() *big.Int {
-	return big.NewInt(int64(1))
-}
-
-// Add performs an addition on the Fq
-func (fq Fq) Add(a, b *big.Int) *big.Int {
-	r := new(big.Int).Add(a, b)
-	return new(big.Int).Mod(r, fq.Q)
-}
-
-// Double performs a doubling on the Fq
-func (fq Fq) Double(a *big.Int) *big.Int {
-	r := new(big.Int).Add(a, a)
-	return new(big.Int).Mod(r, fq.Q)
-}
-
-// Sub performs a subtraction on the Fq
-func (fq Fq) Sub(a, b *big.Int) *big.Int {
-	r := new(big.Int).Sub(a, b)
-	return new(big.Int).Mod(r, fq.Q)
-}
-
-// Neg performs a negation on the Fq
-func (fq Fq) Neg(a *big.Int) *big.Int {
-	m := new(big.Int).Neg(a)
-	return new(big.Int).Mod(m, fq.Q)
-}
-
-// Mul performs a multiplication on the Fq
-func (fq Fq) Mul(a, b *big.Int) *big.Int {
-	m := new(big.Int).Mul(a, b)
-	return new(big.Int).Mod(m, fq.Q)
-}
-
-func (fq Fq) MulScalar(base, e *big.Int) *big.Int {
-	return fq.Mul(base, e)
-}
-
-// Inverse returns the inverse on the Fq
-func (fq Fq) Inverse(a *big.Int) *big.Int {
-	return new(big.Int).ModInverse(a, fq.Q)
-}
-
-// Div performs the division over the finite field
-func (fq Fq) Div(a, b *big.Int) *big.Int {
-	d := fq.Mul(a, fq.Inverse(b))
-	return new(big.Int).Mod(d, fq.Q)
-}
-
-// Square performs a square operation on the Fq
-func (fq Fq) Square(a *big.Int) *big.Int {
-	m := new(big.Int).Mul(a, a)
-	return new(big.Int).Mod(m, fq.Q)
-}
-
-// Exp performs the exponential over Fq
-func (fq Fq) Exp(base *big.Int, e *big.Int) *big.Int {
-	res := fq.One()
-	rem := fq.Copy(e)
-	exp := base
-
-	for !bytes.Equal(rem.Bytes(), big.NewInt(int64(0)).Bytes()) {
-		if BigIsOdd(rem) {
-			res = fq.Mul(res, exp)
-		}
-		exp = fq.Square(exp)
-		rem = new(big.Int).Rsh(rem, 1)
-	}
-	return res
-}
-
-func (fq Fq) Rand() (*big.Int, error) {
-
-	maxbits := fq.Q.BitLen()
-	b := make([]byte, (maxbits/8)-1)
-	_, err := rand.Read(b)
-	if err != nil {
-		return nil, err
-	}
-	r := new(big.Int).SetBytes(b)
-	rq := new(big.Int).Mod(r, fq.Q)
-
-	// r over q, nil
-	return rq, nil
-}
-
-func (fq Fq) IsZero(a *big.Int) bool {
-	return bytes.Equal(a.Bytes(), fq.Zero().Bytes())
-}
-
-func (fq Fq) Copy(a *big.Int) *big.Int {
-	return new(big.Int).SetBytes(a.Bytes())
-}
-
-func (fq Fq) Affine(a *big.Int) *big.Int {
-	nq := fq.Neg(fq.Q)
-
-	aux := a
-	if aux.Cmp(big.NewInt(int64(0))) == -1 { // negative value
-		if aux.Cmp(nq) != 1 { // aux less or equal nq
-			aux = new(big.Int).Mod(aux, fq.Q)
-		}
-		if aux.Cmp(big.NewInt(int64(0))) == -1 { // negative value
-			aux = new(big.Int).Add(aux, fq.Q)
-		}
-	} else {
-		if aux.Cmp(fq.Q) != -1 { // aux greater or equal nq
-			aux = new(big.Int).Mod(aux, fq.Q)
-		}
-	}
-	return aux
-}
-
-func (fq Fq) Equal(a, b *big.Int) bool {
-	aAff := fq.Affine(a)
-	bAff := fq.Affine(b)
-	return bytes.Equal(aAff.Bytes(), bAff.Bytes())
-}
-
-func BigIsOdd(n *big.Int) bool {
-	one := big.NewInt(int64(1))
-	and := new(big.Int).And(n, one)
-	return bytes.Equal(and.Bytes(), big.NewInt(int64(1)).Bytes())
-}

field/field_test.go

@@ -1,39 +0,0 @@
-// code originally taken from https://github.com/arnaucube/go-snark (https://github.com/arnaucube/go-snark/blob/master/fields/fq.go), pasted here to ensure compatibility among future changes
-
-package field
-
-import (
-	"math/big"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func iToBig(a int) *big.Int {
-	return big.NewInt(int64(a))
-}
-
-func TestFq1(t *testing.T) {
-	fq1 := NewFq(iToBig(7))
-
-	res := fq1.Add(iToBig(4), iToBig(4))
-	assert.Equal(t, iToBig(1), fq1.Affine(res))
-
-	res = fq1.Double(iToBig(5))
-	assert.Equal(t, iToBig(3), fq1.Affine(res))
-
-	res = fq1.Sub(iToBig(5), iToBig(7))
-	assert.Equal(t, iToBig(5), fq1.Affine(res))
-
-	res = fq1.Neg(iToBig(5))
-	assert.Equal(t, iToBig(2), fq1.Affine(res))
-
-	res = fq1.Mul(iToBig(5), iToBig(11))
-	assert.Equal(t, iToBig(6), fq1.Affine(res))
-
-	res = fq1.Inverse(iToBig(4))
-	assert.Equal(t, iToBig(2), res)
-
-	res = fq1.Square(iToBig(5))
-	assert.Equal(t, iToBig(4), res)
-}

mimc7/mimc7.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/ethereum/go-ethereum/crypto"
 	_constants "github.com/iden3/go-iden3-crypto/constants"
-	"github.com/iden3/go-iden3-crypto/field"
+	"github.com/iden3/go-iden3-crypto/ff"
 	"github.com/iden3/go-iden3-crypto/utils"
 )
 
@@ -15,73 +15,72 @@ const SEED = "mimc"
 var constants = generateConstantsData()
 
 type constantsData struct {
-	maxFieldVal *big.Int
-	seedHash    *big.Int
-	iv          *big.Int
-	fqR         field.Fq
-	nRounds     int
-	cts         []*big.Int
+	seedHash *big.Int
+	iv       *big.Int
+	nRounds  int
+	cts      []*ff.Element
 }
 
 func generateConstantsData() constantsData {
 	var constants constantsData
 
-	fqR := field.NewFq(_constants.Q)
-	constants.fqR = fqR
-
-	// maxFieldVal is the R value of the Finite Field
-	constants.maxFieldVal = constants.fqR.Q
-
 	constants.seedHash = new(big.Int).SetBytes(crypto.Keccak256([]byte(SEED)))
 	c := new(big.Int).SetBytes(crypto.Keccak256([]byte(SEED + "_iv")))
-	constants.iv = new(big.Int).Mod(c, constants.maxFieldVal)
+	constants.iv = new(big.Int).Mod(c, _constants.Q)
 
 	constants.nRounds = 91
-	cts := getConstants(constants.fqR, SEED, constants.nRounds)
+	cts := getConstants(SEED, constants.nRounds)
 	constants.cts = cts
 	return constants
 }
 
-func getConstants(fqR field.Fq, seed string, nRounds int) []*big.Int {
-	cts := make([]*big.Int, nRounds)
-	cts[0] = big.NewInt(int64(0))
+func getConstants(seed string, nRounds int) []*ff.Element {
+	cts := make([]*ff.Element, nRounds)
+	cts[0] = ff.NewElement()
 	c := new(big.Int).SetBytes(crypto.Keccak256([]byte(SEED)))
 	for i := 1; i < nRounds; i++ {
 		c = new(big.Int).SetBytes(crypto.Keccak256(c.Bytes()))
 
-		n := fqR.Affine(c)
-		cts[i] = n
+		n := new(big.Int).Mod(c, _constants.Q)
+		cts[i] = ff.NewElement().SetBigInt(n)
 	}
 	return cts
 }
 
 // MIMC7HashGeneric performs the MIMC7 hash over a *big.Int, in a generic way, where it can be specified the Finite Field over R, and the number of rounds
-func MIMC7HashGeneric(fqR field.Fq, xIn, k *big.Int, nRounds int) *big.Int {
-	cts := getConstants(fqR, SEED, nRounds)
-	var r *big.Int
+func MIMC7HashGeneric(xInBI, kBI *big.Int, nRounds int) *big.Int {
+	xIn := ff.NewElement().SetBigInt(xInBI)
+	k := ff.NewElement().SetBigInt(kBI)
+
+	cts := getConstants(SEED, nRounds)
+	var r *ff.Element
 	for i := 0; i < nRounds; i++ {
-		var t *big.Int
+		var t *ff.Element
 		if i == 0 {
-			t = fqR.Add(xIn, k)
+			t = ff.NewElement().Add(xIn, k)
 		} else {
-			t = fqR.Add(fqR.Add(r, k), cts[i])
+			t = ff.NewElement().Add(ff.NewElement().Add(r, k), cts[i])
 		}
-		t2 := fqR.Square(t)
-		t4 := fqR.Square(t2)
-		r = fqR.Mul(fqR.Mul(t4, t2), t)
+		t2 := ff.NewElement().Square(t)
+		t4 := ff.NewElement().Square(t2)
+		r = ff.NewElement().Mul(ff.NewElement().Mul(t4, t2), t)
 	}
-	return fqR.Affine(fqR.Add(r, k))
+	rE := ff.NewElement().Add(r, k)
+
+	res := big.NewInt(0)
+	rE.ToBigIntRegular(res)
+	return res
 }
 
 // HashGeneric performs the MIMC7 hash over a *big.Int array, in a generic way, where it can be specified the Finite Field over R, and the number of rounds
-func HashGeneric(iv *big.Int, arr []*big.Int, fqR field.Fq, nRounds int) (*big.Int, error) {
+func HashGeneric(iv *big.Int, arr []*big.Int, nRounds int) (*big.Int, error) {
 	if !utils.CheckBigIntArrayInField(arr) {
 		return nil, errors.New("inputs values not inside Finite Field")
 	}
 	r := iv
 	var err error
 	for i := 0; i < len(arr); i++ {
-		r = MIMC7HashGeneric(fqR, r, arr[i], nRounds)
+		r = MIMC7HashGeneric(r, arr[i], nRounds)
 		if err != nil {
 			return r, err
 		}
@@ -90,20 +89,27 @@ func HashGeneric(iv *big.Int, arr []*big.Int, fqR field.Fq, nRounds int) (*big.I
 }
 
 // MIMC7Hash performs the MIMC7 hash over a *big.Int, using the Finite Field over R and the number of rounds setted in the `constants` variable
-func MIMC7Hash(xIn, k *big.Int) *big.Int {
-	var r *big.Int
+func MIMC7Hash(xInBI, kBI *big.Int) *big.Int {
+	xIn := ff.NewElement().SetBigInt(xInBI)
+	k := ff.NewElement().SetBigInt(kBI)
+
+	var r *ff.Element
 	for i := 0; i < constants.nRounds; i++ {
-		var t *big.Int
+		var t *ff.Element
 		if i == 0 {
-			t = constants.fqR.Add(xIn, k)
+			t = ff.NewElement().Add(xIn, k)
 		} else {
-			t = constants.fqR.Add(constants.fqR.Add(r, k), constants.cts[i])
+			t = ff.NewElement().Add(ff.NewElement().Add(r, k), constants.cts[i])
 		}
-		t2 := constants.fqR.Square(t)
-		t4 := constants.fqR.Square(t2)
-		r = constants.fqR.Mul(constants.fqR.Mul(t4, t2), t)
+		t2 := ff.NewElement().Square(t)
+		t4 := ff.NewElement().Square(t2)
+		r = ff.NewElement().Mul(ff.NewElement().Mul(t4, t2), t)
 	}
-	return constants.fqR.Affine(constants.fqR.Add(r, k))
+	rE := ff.NewElement().Add(r, k)
+
+	res := big.NewInt(0)
+	rE.ToBigIntRegular(res)
+	return res
 }
 
 // Hash performs the MIMC7 hash over a *big.Int array
@@ -113,17 +119,18 @@ func Hash(arr []*big.Int, key *big.Int) (*big.Int, error) {
 	}
 	var r *big.Int
 	if key == nil {
-		r = constants.fqR.Zero()
+		r = big.NewInt(0)
 	} else {
 		r = key
 	}
 	for i := 0; i < len(arr); i++ {
-		r = constants.fqR.Add(
-			constants.fqR.Add(
+		r = new(big.Int).Add(
+			new(big.Int).Add(
 				r,
 				arr[i],
 			),
 			MIMC7Hash(arr[i], r))
+		r = new(big.Int).Mod(r, _constants.Q)
 	}
 	return r, nil
 }

mimc7/mimc7_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/ethereum/go-ethereum/crypto"
-	"github.com/iden3/go-iden3-crypto/field"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -22,16 +21,12 @@ func TestMIMC7Generic(t *testing.T) {
 	b2 := big.NewInt(int64(2))
 	b3 := big.NewInt(int64(3))
 
-	r, ok := new(big.Int).SetString("21888242871839275222246405745257275088548364400416034343698204186575808495617", 10)
-	assert.True(t, ok)
-	fqR := field.NewFq(r)
-
 	bigArray := []*big.Int{b1, b2, b3}
 
 	// Generic Hash
-	mhg := MIMC7HashGeneric(fqR, b1, b2, 91)
+	mhg := MIMC7HashGeneric(b1, b2, 91)
 	assert.Equal(t, "10594780656576967754230020536574539122676596303354946869887184401991294982664", mhg.String())
-	hg, err := HashGeneric(fqR.Zero(), bigArray, fqR, 91)
+	hg, err := HashGeneric(big.NewInt(0), bigArray, 91)
 	assert.Nil(t, err)
 	assert.Equal(t, "6464402164086696096195815557694604139393321133243036833927490113253119343397", (*big.Int)(hg).String())
 }

poseidon/poseidon.go

@@ -20,7 +20,7 @@ var constC []*ff.Element
 var constM [T][T]*ff.Element
 
 func Zero() *ff.Element {
-	return ff.NewElement().SetZero()
+	return ff.NewElement()
 }
 
 func modQ(v *big.Int) {
@@ -71,7 +71,7 @@ func getMDS() [T][T]*ff.Element {
 
 func checkAllDifferent(v []*ff.Element) bool {
 	for i := 0; i < len(v); i++ {
-		if v[i].Equal(ff.NewElement().SetZero()) {
+		if v[i].Equal(ff.NewElement()) {
 			return false
 		}
 		for j := i + 1; j < len(v); j++ {
@@ -92,7 +92,6 @@ func ark(state [T]*ff.Element, c *ff.Element) {
 
 // cubic performs x^5 mod p
 // https://eprint.iacr.org/2019/458.pdf page 8
-// var five = big.NewInt(5)
 
 func cubic(a *ff.Element) {
 	a.Exp(*a, 5)