miden-crypto/crypto/src/hash/rpo/mds_freq.rs
crypto/src/hash/rpo/mds_freq.rsRaw
1// FFT-BASED MDS MULTIPLICATION HELPER FUNCTIONS
2// ================================================================================================
3
4/// This module contains helper functions as well as constants used to perform the vector-matrix
5/// multiplication step of the Rescue prime permutation. The special form of our MDS matrix
6/// i.e. being circular, allows us to reduce the vector-matrix multiplication to a Hadamard product
7/// of two vectors in "frequency domain". This follows from the simple fact that every circulant
8/// matrix has the columns of the discrete Fourier transform matrix as orthogonal eigenvectors.
9/// The implementation also avoids the use of 3-point FFTs, and 3-point iFFTs, and substitutes that
10/// with explicit expressions. It also avoids, due to the form of our matrix in the frequency domain,
11/// divisions by 2 and repeated modular reductions. This is because of our explicit choice of
12/// an MDS matrix that has small powers of 2 entries in frequency domain.
13/// The following implementation has benefited greatly from the discussions and insights of
14/// Hamish Ivey-Law and Jacqueline Nabaglo of Polygon Zero.
15
16// Rescue MDS matrix in frequency domain.
17// More precisely, this is the output of the three 4-point (real) FFTs of the first column of
18// the MDS matrix i.e. just before the multiplication with the appropriate twiddle factors
19// and application of the final four 3-point FFT in order to get the full 12-point FFT.
20// The entries have been scaled appropriately in order to avoid divisions by 2 in iFFT2 and iFFT4.
21// The code to generate the matrix in frequency domain is based on an adaptation of a code, to generate
22// MDS matrices efficiently in original domain, that was developed by the Polygon Zero team.
23const MDS_FREQ_BLOCK_ONE: [i64; 3] = [16, 8, 16];
24const MDS_FREQ_BLOCK_TWO: [(i64, i64); 3] = [(-1, 2), (-1, 1), (4, 8)];
25const MDS_FREQ_BLOCK_THREE: [i64; 3] = [-8, 1, 1];
26
27// We use split 3 x 4 FFT transform in order to transform our vectors into the frequency domain.
28#[inline(always)]
29pub(crate) fn mds_multiply_freq(state: [u64; 12]) -> [u64; 12] {
30 let [s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11] = state;
31
32 let (u0, u1, u2) = fft4_real([s0, s3, s6, s9]);
33 let (u4, u5, u6) = fft4_real([s1, s4, s7, s10]);
34 let (u8, u9, u10) = fft4_real([s2, s5, s8, s11]);
35
36 // This where the multiplication in frequency domain is done. More precisely, and with
37 // the appropriate permuations in between, the sequence of
38 // 3-point FFTs --> multiplication by twiddle factors --> Hadamard multiplication -->
39 // 3 point iFFTs --> multiplication by (inverse) twiddle factors
40 // is "squashed" into one step composed of the functions "block1", "block2" and "block3".
41 // The expressions in the aformentioned functions are the result of explicit computations
42 // combined with the Karatsuba trick for the multiplication of Complex numbers.
43
44 let [v0, v4, v8] = block1([u0, u4, u8], MDS_FREQ_BLOCK_ONE);
45 let [v1, v5, v9] = block2([u1, u5, u9], MDS_FREQ_BLOCK_TWO);
46 let [v2, v6, v10] = block3([u2, u6, u10], MDS_FREQ_BLOCK_THREE);
47 // The 4th block is not computed as it is similar to the 2nd one, up to complex conjugation,
48 // and is, due to the use of the real FFT and iFFT, redundant.
49
50 let [s0, s3, s6, s9] = ifft4_real((v0, v1, v2));
51 let [s1, s4, s7, s10] = ifft4_real((v4, v5, v6));
52 let [s2, s5, s8, s11] = ifft4_real((v8, v9, v10));
53
54 [s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11]
55}
56
57// We use the real FFT to avoid redundant computations. See https://www.mdpi.com/2076-3417/12/9/4700
58#[inline(always)]
59fn fft2_real(x: [u64; 2]) -> [i64; 2] {
60 [(x[0] as i64 + x[1] as i64), (x[0] as i64 - x[1] as i64)]
61}
62
63#[inline(always)]
64fn ifft2_real(y: [i64; 2]) -> [u64; 2] {
65 // We avoid divisions by 2 by appropriately scaling the MDS matrix constants.
66 [(y[0] + y[1]) as u64, (y[0] - y[1]) as u64]
67}
68
69#[inline(always)]
70fn fft4_real(x: [u64; 4]) -> (i64, (i64, i64), i64) {
71 let [z0, z2] = fft2_real([x[0], x[2]]);
72 let [z1, z3] = fft2_real([x[1], x[3]]);
73 let y0 = z0 + z1;
74 let y1 = (z2, -z3);
75 let y2 = z0 - z1;
76 (y0, y1, y2)
77}
78
79#[inline(always)]
80fn ifft4_real(y: (i64, (i64, i64), i64)) -> [u64; 4] {
81 // In calculating 'z0' and 'z1', division by 2 is avoided by appropriately scaling
82 // the MDS matrix constants.
83 let z0 = y.0 + y.2;
84 let z1 = y.0 - y.2;
85 let z2 = y.1 .0;
86 let z3 = -y.1 .1;
87
88 let [x0, x2] = ifft2_real([z0, z2]);
89 let [x1, x3] = ifft2_real([z1, z3]);
90
91 [x0, x1, x2, x3]
92}
93
94#[inline(always)]
95fn block1(x: [i64; 3], y: [i64; 3]) -> [i64; 3] {
96 let [x0, x1, x2] = x;
97 let [y0, y1, y2] = y;
98 let z0 = x0 * y0 + x1 * y2 + x2 * y1;
99 let z1 = x0 * y1 + x1 * y0 + x2 * y2;
100 let z2 = x0 * y2 + x1 * y1 + x2 * y0;
101
102 [z0, z1, z2]
103}
104
105#[inline(always)]
106fn block2(x: [(i64, i64); 3], y: [(i64, i64); 3]) -> [(i64, i64); 3] {
107 let [(x0r, x0i), (x1r, x1i), (x2r, x2i)] = x;
108 let [(y0r, y0i), (y1r, y1i), (y2r, y2i)] = y;
109 let x0s = x0r + x0i;
110 let x1s = x1r + x1i;
111 let x2s = x2r + x2i;
112 let y0s = y0r + y0i;
113 let y1s = y1r + y1i;
114 let y2s = y2r + y2i;
115
116 // Compute x0y0 − ix1y2 − ix2y1 using Karatsuba for complex numbers multiplication
117 let m0 = (x0r * y0r, x0i * y0i);
118 let m1 = (x1r * y2r, x1i * y2i);
119 let m2 = (x2r * y1r, x2i * y1i);
120 let z0r = (m0.0 - m0.1) + (x1s * y2s - m1.0 - m1.1) + (x2s * y1s - m2.0 - m2.1);
121 let z0i = (x0s * y0s - m0.0 - m0.1) + (-m1.0 + m1.1) + (-m2.0 + m2.1);
122 let z0 = (z0r, z0i);
123
124 // Compute x0y1 + x1y0 − ix2y2 using Karatsuba for complex numbers multiplication
125 let m0 = (x0r * y1r, x0i * y1i);
126 let m1 = (x1r * y0r, x1i * y0i);
127 let m2 = (x2r * y2r, x2i * y2i);
128 let z1r = (m0.0 - m0.1) + (m1.0 - m1.1) + (x2s * y2s - m2.0 - m2.1);
129 let z1i = (x0s * y1s - m0.0 - m0.1) + (x1s * y0s - m1.0 - m1.1) + (-m2.0 + m2.1);
130 let z1 = (z1r, z1i);
131
132 // Compute x0y2 + x1y1 + x2y0 using Karatsuba for complex numbers multiplication
133 let m0 = (x0r * y2r, x0i * y2i);
134 let m1 = (x1r * y1r, x1i * y1i);
135 let m2 = (x2r * y0r, x2i * y0i);
136 let z2r = (m0.0 - m0.1) + (m1.0 - m1.1) + (m2.0 - m2.1);
137 let z2i = (x0s * y2s - m0.0 - m0.1) + (x1s * y1s - m1.0 - m1.1) + (x2s * y0s - m2.0 - m2.1);
138 let z2 = (z2r, z2i);
139
140 [z0, z1, z2]
141}
142
143#[inline(always)]
144fn block3(x: [i64; 3], y: [i64; 3]) -> [i64; 3] {
145 let [x0, x1, x2] = x;
146 let [y0, y1, y2] = y;
147 let z0 = x0 * y0 - x1 * y2 - x2 * y1;
148 let z1 = x0 * y1 + x1 * y0 - x2 * y2;
149 let z2 = x0 * y2 + x1 * y1 + x2 * y0;
150
151 [z0, z1, z2]
152}
153
154// TESTS
155// ================================================================================================
156
157#[cfg(test)]
158mod tests {
159 use super::super::Rpo256;
160 use crate::hash::rpo::MDS;
161 use proptest::prelude::*;
162 use winterfell::math::{fields::f64::BaseElement, FieldElement};
163
164 const STATE_WIDTH: usize = 12;
165
166 #[inline(always)]
167 fn apply_mds_naive(state: &mut [BaseElement; STATE_WIDTH]) {
168 let mut result = [BaseElement::ZERO; STATE_WIDTH];
169 result.iter_mut().zip(MDS).for_each(|(r, mds_row)| {
170 state.iter().zip(mds_row).for_each(|(&s, m)| {
171 *r += m * s;
172 });
173 });
174 *state = result;
175 }
176
177 proptest! {
178 #[test]
179 fn mds_freq_proptest(a in any::<[u64;STATE_WIDTH]>()) {
180
181 let mut v1 = [BaseElement::ZERO;STATE_WIDTH];
182 let mut v2;
183
184 for i in 0..STATE_WIDTH {
185 v1[i] = BaseElement::new(a[i]);
186 }
187 v2 = v1.clone();
188
189 apply_mds_naive(&mut v1);
190 Rpo256::apply_mds(&mut v2);
191
192 prop_assert_eq!(v1, v2);
193 }
194 }
195}