You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

183 lines
5.5 KiB

  1. ## Bn128
  2. [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/bn128?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128
  3. Implementation of the bn128 pairing in Go.
  4. Implementation followng the information and the implementations from:
  5. - `Multiplication and Squaring on Pairing-Friendly
  6. Fields`, Augusto Jun Devegili, Colm Ó hÉigeartaigh, Michael Scott, and Ricardo Dahab https://pdfs.semanticscholar.org/3e01/de88d7428076b2547b60072088507d881bf1.pdf
  7. - `Optimal Pairings`, Frederik Vercauteren https://www.cosic.esat.kuleuven.be/bcrypt/optimal.pdf , https://eprint.iacr.org/2008/096.pdf
  8. - `Double-and-Add with Relative Jacobian
  9. Coordinates`, Björn Fay https://eprint.iacr.org/2014/1014.pdf
  10. - `Fast and Regular Algorithms for Scalar Multiplication
  11. over Elliptic Curves`, Matthieu Rivain https://eprint.iacr.org/2011/338.pdf
  12. - `High-Speed Software Implementation of the Optimal Ate Pairing over Barreto–Naehrig Curves`, Jean-Luc Beuchat, Jorge E. González-Díaz, Shigeo Mitsunari, Eiji Okamoto, Francisco Rodríguez-Henríquez, and Tadanori Teruya https://eprint.iacr.org/2010/354.pdf
  13. - `New software speed records for cryptographic pairings`, Michael Naehrig, Ruben Niederhagen, Peter Schwabe https://cryptojedi.org/papers/dclxvi-20100714.pdf
  14. - `Implementing Cryptographic Pairings over Barreto-Naehrig Curves`, Augusto Jun Devegili, Michael Scott, Ricardo Dahab https://eprint.iacr.org/2007/390.pdf
  15. - https://github.com/zcash/zcash/tree/master/src/snark
  16. - https://github.com/iden3/snarkjs
  17. - https://github.com/ethereum/py_ecc/tree/master/py_ecc/bn128
  18. - [x] Fq, Fq2, Fq6, Fq12 operations
  19. - [x] G1, G2 operations
  20. - [x] preparePairing
  21. - [x] PreComupteG1, PreComupteG2
  22. - [x] DoubleStep, AddStep
  23. - [x] MillerLoop
  24. - [x] Pairing
  25. #### Usage
  26. - Pairing
  27. ```go
  28. bn128, err := NewBn128()
  29. assert.Nil(t, err)
  30. big25 := big.NewInt(int64(25))
  31. big30 := big.NewInt(int64(30))
  32. g1a := bn128.G1.MulScalar(bn128.G1.G, big25)
  33. g2a := bn128.G2.MulScalar(bn128.G2.G, big30)
  34. g1b := bn128.G1.MulScalar(bn128.G1.G, big30)
  35. g2b := bn128.G2.MulScalar(bn128.G2.G, big25)
  36. pA, err := bn128.Pairing(g1a, g2a)
  37. assert.Nil(t, err)
  38. pB, err := bn128.Pairing(g1b, g2b)
  39. assert.Nil(t, err)
  40. assert.True(t, bn128.Fq12.Equal(pA, pB))
  41. ```
  42. #### Test
  43. ```
  44. go test -v
  45. ```
  46. ##### Internal operations more deeply
  47. First let's assume that we have these three basic functions to convert integer compositions to big integer compositions:
  48. ```go
  49. func iToBig(a int) *big.Int {
  50. return big.NewInt(int64(a))
  51. }
  52. func iiToBig(a, b int) [2]*big.Int {
  53. return [2]*big.Int{iToBig(a), iToBig(b)}
  54. }
  55. func iiiToBig(a, b int) [2]*big.Int {
  56. return [2]*big.Int{iToBig(a), iToBig(b)}
  57. }
  58. ```
  59. - Finite Fields (1, 2, 6, 12) operations
  60. ```go
  61. // new finite field of order 1
  62. fq1 := NewFq(iToBig(7))
  63. // basic operations of finite field 1
  64. res := fq1.Add(iToBig(4), iToBig(4))
  65. res = fq1.Double(iToBig(5))
  66. res = fq1.Sub(iToBig(5), iToBig(7))
  67. res = fq1.Neg(iToBig(5))
  68. res = fq1.Mul(iToBig(5), iToBig(11))
  69. res = fq1.Inverse(iToBig(4))
  70. res = fq1.Square(iToBig(5))
  71. // new finite field of order 2
  72. nonResidueFq2str := "-1" // i/j
  73. nonResidueFq2, ok := new(big.Int).SetString(nonResidueFq2str, 10)
  74. fq2 := Fq2{fq1, nonResidueFq2}
  75. nonResidueFq6 := iiToBig(9, 1)
  76. // basic operations of finite field of order 2
  77. res := fq2.Add(iiToBig(4, 4), iiToBig(3, 4))
  78. res = fq2.Double(iiToBig(5, 3))
  79. res = fq2.Sub(iiToBig(5, 3), iiToBig(7, 2))
  80. res = fq2.Neg(iiToBig(4, 4))
  81. res = fq2.Mul(iiToBig(4, 4), iiToBig(3, 4))
  82. res = fq2.Inverse(iiToBig(4, 4))
  83. res = fq2.Div(iiToBig(4, 4), iiToBig(3, 4))
  84. res = fq2.Square(iiToBig(4, 4))
  85. // new finite field of order 6
  86. nonResidueFq6 := iiToBig(9, 1) // TODO
  87. fq6 := Fq6{fq2, nonResidueFq6}
  88. // define two new values of Finite Field 6, in order to be able to perform the operations
  89. a := [3][2]*big.Int{
  90. iiToBig(1, 2),
  91. iiToBig(3, 4),
  92. iiToBig(5, 6)}
  93. b := [3][2]*big.Int{
  94. iiToBig(12, 11),
  95. iiToBig(10, 9),
  96. iiToBig(8, 7)}
  97. // basic operations of finite field order 6
  98. res := fq6.Add(a, b)
  99. res = fq6.Sub(a, b)
  100. res = fq6.Mul(a, b)
  101. divRes := fq6.Div(mulRes, b)
  102. // new finite field of order 12
  103. q, ok := new(big.Int).SetString("21888242871839275222246405745257275088696311157297823662689037894645226208583", 10) // i
  104. if !ok {
  105. fmt.Println("error parsing string to big integer")
  106. }
  107. fq1 := NewFq(q)
  108. nonResidueFq2, ok := new(big.Int).SetString("21888242871839275222246405745257275088696311157297823662689037894645226208582", 10) // i
  109. assert.True(t, ok)
  110. nonResidueFq6 := iiToBig(9, 1)
  111. fq2 := Fq2{fq1, nonResidueFq2}
  112. fq6 := Fq6{fq2, nonResidueFq6}
  113. fq12 := Fq12{fq6, fq2, nonResidueFq6}
  114. ```
  115. - G1 operations
  116. ```go
  117. bn128, err := NewBn128()
  118. assert.Nil(t, err)
  119. r1 := big.NewInt(int64(33))
  120. r2 := big.NewInt(int64(44))
  121. gr1 := bn128.G1.MulScalar(bn128.G1.G, bn128.Fq1.Copy(r1))
  122. gr2 := bn128.G1.MulScalar(bn128.G1.G, bn128.Fq1.Copy(r2))
  123. grsum1 := bn128.G1.Add(gr1, gr2)
  124. r1r2 := bn128.Fq1.Add(r1, r2)
  125. grsum2 := bn128.G1.MulScalar(bn128.G1.G, r1r2)
  126. a := bn128.G1.Affine(grsum1)
  127. b := bn128.G1.Affine(grsum2)
  128. assert.Equal(t, a, b)
  129. assert.Equal(t, "0x2f978c0ab89ebaa576866706b14787f360c4d6c3869efe5a72f7c3651a72ff00", utils.BytesToHex(a[0].Bytes()))
  130. assert.Equal(t, "0x12e4ba7f0edca8b4fa668fe153aebd908d322dc26ad964d4cd314795844b62b2", utils.BytesToHex(a[1].Bytes()))
  131. ```
  132. - G2 operations
  133. ```go
  134. bn128, err := NewBn128()
  135. assert.Nil(t, err)
  136. r1 := big.NewInt(int64(33))
  137. r2 := big.NewInt(int64(44))
  138. gr1 := bn128.G2.MulScalar(bn128.G2.G, bn128.Fq1.Copy(r1))
  139. gr2 := bn128.G2.MulScalar(bn128.G2.G, bn128.Fq1.Copy(r2))
  140. grsum1 := bn128.G2.Add(gr1, gr2)
  141. r1r2 := bn128.Fq1.Add(r1, r2)
  142. grsum2 := bn128.G2.MulScalar(bn128.G2.G, r1r2)
  143. a := bn128.G2.Affine(grsum1)
  144. b := bn128.G2.Affine(grsum2)
  145. assert.Equal(t, a, b)
  146. ```