1use ark_ec::{AffineRepr, CurveGroup};
  2use ark_ff::PrimeField;
  3use ark_r1cs_std::{
  4    alloc::{AllocVar, AllocationMode},
  5    fields::fp::FpVar,
  6    ToConstraintFieldGadget,
  7};
  8use ark_relations::r1cs::{Namespace, SynthesisError};
  9use ark_std::Zero;
 10use core::borrow::Borrow;
 11
 12use super::uint::{nonnative_field_to_field_elements, NonNativeUintVar};
 13
 14/// NonNativeAffineVar represents an elliptic curve point in Affine representation in the non-native
 15/// field, over the constraint field. It is not intended to perform operations, but just to contain
 16/// the affine coordinates in order to perform hash operations of the point.
 17#[derive(Debug, Clone)]
 18pub struct NonNativeAffineVar<C: CurveGroup>
 19where
 20    <C as CurveGroup>::BaseField: PrimeField,
 21{
 22    pub x: NonNativeUintVar<C::ScalarField>,
 23    pub y: NonNativeUintVar<C::ScalarField>,
 24}
 25
 26impl<C> AllocVar<C, C::ScalarField> for NonNativeAffineVar<C>
 27where
 28    C: CurveGroup,
 29    <C as CurveGroup>::BaseField: PrimeField,
 30{
 31    fn new_variable<T: Borrow<C>>(
 32        cs: impl Into<Namespace<C::ScalarField>>,
 33        f: impl FnOnce() -> Result<T, SynthesisError>,
 34        mode: AllocationMode,
 35    ) -> Result<Self, SynthesisError> {
 36        f().and_then(|val| {
 37            let cs = cs.into();
 38
 39            let affine = val.borrow().into_affine();
 40            let zero_point = (&C::BaseField::zero(), &C::BaseField::zero());
 41            let xy = affine.xy().unwrap_or(zero_point);
 42
 43            let x = NonNativeUintVar::new_variable(cs.clone(), || Ok(*xy.0), mode)?;
 44            let y = NonNativeUintVar::new_variable(cs.clone(), || Ok(*xy.1), mode)?;
 45
 46            Ok(Self { x, y })
 47        })
 48    }
 49}
 50
 51impl<C: CurveGroup> ToConstraintFieldGadget<C::ScalarField> for NonNativeAffineVar<C>
 52where
 53    <C as CurveGroup>::BaseField: PrimeField,
 54{
 55    // Used for converting `NonNativeAffineVar` to a vector of `FpVar` with minimum length in
 56    // the circuit.
 57    fn to_constraint_field(&self) -> Result<Vec<FpVar<C::ScalarField>>, SynthesisError> {
 58        let x = self.x.to_constraint_field()?;
 59        let y = self.y.to_constraint_field()?;
 60        Ok([x, y].concat())
 61    }
 62}
 63
 64/// The out-circuit counterpart of `NonNativeAffineVar::to_constraint_field`
 65#[allow(clippy::type_complexity)]
 66pub fn nonnative_affine_to_field_elements<C: CurveGroup>(
 67    p: C,
 68) -> Result<(Vec<C::ScalarField>, Vec<C::ScalarField>), SynthesisError>
 69where
 70    <C as CurveGroup>::BaseField: PrimeField,
 71{
 72    let affine = p.into_affine();
 73    if affine.is_zero() {
 74        let x = nonnative_field_to_field_elements(&C::BaseField::zero());
 75        let y = nonnative_field_to_field_elements(&C::BaseField::zero());
 76        return Ok((x, y));
 77    }
 78
 79    let (x, y) = affine.xy().unwrap();
 80    let x = nonnative_field_to_field_elements(x);
 81    let y = nonnative_field_to_field_elements(y);
 82    Ok((x, y))
 83}
 84
 85impl<C: CurveGroup> NonNativeAffineVar<C>
 86where
 87    <C as CurveGroup>::BaseField: PrimeField,
 88{
 89    // A wrapper of `point_to_nonnative_limbs_custom_opt` with constraints-focused optimization
 90    // type (which is the default optimization type for arkworks' Groth16).
 91    // Used for extracting a list of field elements of type `C::ScalarField` from the public input
 92    // `p`, in exactly the same way as how `NonNativeAffineVar` is represented as limbs of type
 93    // `FpVar` in-circuit.
 94    #[allow(clippy::type_complexity)]
 95    pub fn inputize(p: C) -> Result<(Vec<C::ScalarField>, Vec<C::ScalarField>), SynthesisError> {
 96        let affine = p.into_affine();
 97        if affine.is_zero() {
 98            let x = NonNativeUintVar::inputize(C::BaseField::zero());
 99            let y = NonNativeUintVar::inputize(C::BaseField::zero());
100            return Ok((x, y));
101        }
102
103        let (x, y) = affine.xy().unwrap();
104        let x = NonNativeUintVar::inputize(*x);
105        let y = NonNativeUintVar::inputize(*y);
106        Ok((x, y))
107    }
108}
109
110#[cfg(test)]
111mod tests {
112    use super::*;
113    use ark_pallas::{Fr, Projective};
114    use ark_r1cs_std::R1CSVar;
115    use ark_relations::r1cs::ConstraintSystem;
116    use ark_std::UniformRand;
117
118    #[test]
119    fn test_alloc_zero() {
120        let cs = ConstraintSystem::<Fr>::new_ref();
121
122        // dealing with the 'zero' point should not panic when doing the unwrap
123        let p = Projective::zero();
124        assert!(NonNativeAffineVar::<Projective>::new_witness(cs.clone(), || Ok(p)).is_ok());
125    }
126
127    #[test]
128    fn test_improved_to_constraint_field() {
129        let cs = ConstraintSystem::<Fr>::new_ref();
130
131        // check that point_to_nonnative_limbs returns the expected values
132        let mut rng = ark_std::test_rng();
133        let p = Projective::rand(&mut rng);
134        let pVar = NonNativeAffineVar::<Projective>::new_witness(cs.clone(), || Ok(p)).unwrap();
135        let (x, y) = nonnative_affine_to_field_elements(p).unwrap();
136        assert_eq!(
137            pVar.to_constraint_field().unwrap().value().unwrap(),
138            [x, y].concat()
139        );
140    }
141
142    #[test]
143    fn test_inputize() {
144        let cs = ConstraintSystem::<Fr>::new_ref();
145
146        // check that point_to_nonnative_limbs returns the expected values
147        let mut rng = ark_std::test_rng();
148        let p = Projective::rand(&mut rng);
149        let pVar = NonNativeAffineVar::<Projective>::new_witness(cs.clone(), || Ok(p)).unwrap();
150        let (x, y) = NonNativeAffineVar::inputize(p).unwrap();
151
152        assert_eq!(pVar.x.0.value().unwrap(), x);
153        assert_eq!(pVar.y.0.value().unwrap(), y);
154    }
155}