1package edwards_curve
  2
  3import (
  4	"fmt"
  5	"math/big"
  6
  7	"github.com/consensys/gnark/frontend"
  8	"github.com/consensys/gnark/std/math/emulated"
  9)
 10
 11func New[T, S emulated.FieldParams](api frontend.API) (*Curve[T, S], error) {
 12	var t T
 13	var s S
 14	var gxb, gyb *big.Int
 15	var A, D *big.Int
 16	_, is_25519_t := any(t).(Ed25519)
 17	_, is_25519_s := any(s).(Ed25519Scalars)
 18	if is_25519_t && is_25519_s {
 19		// https://neuromancer.sk/std/other/Ed25519
 20		gxb = newBigInt("216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A")
 21		gyb = newBigInt("6666666666666666666666666666666666666666666666666666666666666658")
 22		A = newBigInt("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec")
 23		D = newBigInt("52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3")
 24	} else {
 25		return nil, fmt.Errorf("unknown curve")
 26	}
 27	return newCurve[T, S](
 28		api,
 29		emulated.NewElement[T](A),
 30		emulated.NewElement[T](D),
 31		emulated.NewElement[T](gxb),
 32		emulated.NewElement[T](gyb))
 33}
 34
 35func newBigInt(s string) *big.Int {
 36	result, success := new(big.Int).SetString(s, 16)
 37	if !success {
 38		panic("invalid bigint")
 39	}
 40	return result
 41}
 42
 43// TODO: could also have a type constraint for curve parameters (fields,
 44// equation and generator). But for now we don't do arbitrary curves.
 45
 46type Curve[T, S emulated.FieldParams] struct {
 47	A emulated.Element[T]
 48	D emulated.Element[T]
 49
 50	// api is the native api, we construct it ourselves to be sure
 51	api frontend.API
 52	// baseApi is the api for point operations
 53	baseApi frontend.API
 54	// scalarApi is the api for scalar operations
 55	scalarApi frontend.API
 56
 57	g AffinePoint[T]
 58}
 59
 60func (c *Curve[T, S]) Generator() AffinePoint[T] {
 61	return c.g
 62}
 63
 64func newCurve[T, S emulated.FieldParams](api frontend.API, A, D, Gx, Gy emulated.Element[T]) (*Curve[T, S], error) {
 65	ba, err := emulated.NewField[T](api)
 66	if err != nil {
 67		return nil, fmt.Errorf("new base api: %w", err)
 68	}
 69	sa, err := emulated.NewField[S](api)
 70	if err != nil {
 71		return nil, fmt.Errorf("new scalar api: %w", err)
 72	}
 73	return &Curve[T, S]{
 74		A: A,
 75		D: D,
 76		api:       api,
 77		baseApi:   ba,
 78		scalarApi: sa,
 79		g: AffinePoint[T]{
 80			X: Gx,
 81			Y: Gy,
 82		},
 83	}, nil
 84}
 85
 86type AffinePoint[T emulated.FieldParams] struct {
 87	X, Y emulated.Element[T]
 88}
 89
 90func (c *Curve[T, S]) Neg(p AffinePoint[T]) AffinePoint[T] {
 91	return AffinePoint[T]{
 92		X: p.X,
 93		Y: c.baseApi.Neg(p.Y).(emulated.Element[T]),
 94	}
 95}
 96
 97func (c *Curve[T, S]) AssertIsEqual(p, q AffinePoint[T]) {
 98	c.baseApi.AssertIsEqual(p.X, q.X)
 99	c.baseApi.AssertIsEqual(p.Y, q.Y)
100}
101
102func (c *Curve[T, S]) AssertIsOnCurve(p AffinePoint[T]) {
103	xx := c.baseApi.Mul(p.X, p.X)
104	yy := c.baseApi.Mul(p.Y, p.Y)
105	fmt.Println(xx)
106	fmt.Println(c.A)
107	axx := c.baseApi.Mul(xx, c.A)
108	lhs := c.baseApi.Add(axx, yy)
109
110	dxx := c.baseApi.Mul(xx, c.D)
111	dxxyy := c.baseApi.Mul(dxx, yy)
112	rhs := c.baseApi.Add(dxxyy, 1)
113
114	c.baseApi.AssertIsEqual(lhs, rhs)
115}
116
117// func (c *Curve[T, S]) Add(q, r AffinePoint[T]) AffinePoint[T] {
118// 	// compute lambda = (p1.y-p.y)/(p1.x-p.x)
119// 	lambda := c.baseApi.DivUnchecked(c.baseApi.Sub(r.Y, q.Y), c.baseApi.Sub(r.X, q.X))
120
121// 	// xr = lambda**2-p.x-p1.x
122// 	xr := c.baseApi.Sub(c.baseApi.Mul(lambda, lambda), c.baseApi.Add(q.X, r.X))
123
124// 	// p.y = lambda(p.x-xr) - p.y
125// 	py := c.baseApi.Sub(c.baseApi.Mul(lambda, c.baseApi.Sub(q.X, xr)), q.Y)
126
127// 	return AffinePoint[T]{
128// 		X: xr.(emulated.Element[T]),
129// 		Y: py.(emulated.Element[T]),
130// 	}
131// }
132
133// func (c *Curve[T, S]) Double(p AffinePoint[T]) AffinePoint[T] {
134
135// 	// compute lambda = (3*p1.x**2+a)/2*p1.y, here we assume a=0 (j invariant 0 curve)
136// 	lambda := c.baseApi.DivUnchecked(c.baseApi.Mul(p.X, p.X, 3), c.baseApi.Mul(p.Y, 2))
137
138// 	// xr = lambda**2-p1.x-p1.x
139// 	xr := c.baseApi.Sub(c.baseApi.Mul(lambda, lambda), c.baseApi.Mul(p.X, 2))
140
141// 	// p.y = lambda(p.x-xr) - p.y
142// 	py := c.baseApi.Sub(c.baseApi.Mul(lambda, c.baseApi.Sub(p.X, xr)), p.Y)
143
144// 	return AffinePoint[T]{
145// 		X: xr.(emulated.Element[T]),
146// 		Y: py.(emulated.Element[T]),
147// 	}
148// }
149
150func (c *Curve[T, S]) Select(b frontend.Variable, p, q AffinePoint[T]) AffinePoint[T] {
151	x := c.baseApi.Select(b, p.X, q.X)
152	y := c.baseApi.Select(b, p.Y, q.Y)
153	return AffinePoint[T]{
154		X: x.(emulated.Element[T]),
155		Y: y.(emulated.Element[T]),
156	}
157}
158
159// func (c *Curve[T, S]) ScalarMul(p AffinePoint[T], s emulated.Element[S]) AffinePoint[T] {
160// 	res := p
161// 	acc := c.Double(p)
162
163// 	sBits := c.scalarApi.ToBinary(s)
164// 	for i := 1; i < len(sBits); i++ {
165// 		tmp := c.Add(res, acc)
166// 		res = c.Select(sBits[i], tmp, res)
167// 		acc = c.Double(acc)
168// 	}
169
170// 	tmp := c.Add(res, c.Neg(p))
171// 	res = c.Select(sBits[0], res, tmp)
172// 	return res
173// }