1/// Implements the C_{EC} circuit described in [CycleFold paper](https://eprint.iacr.org/2023/1192.pdf)
 2use ark_ec::CurveGroup;
 3use ark_r1cs_std::{boolean::Boolean, prelude::CurveVar};
 4use ark_relations::r1cs::SynthesisError;
 5use core::marker::PhantomData;
 6
 7use super::CF;
 8
 9/// ECRLC implements gadget that checks the Elliptic Curve points RandomLinearCombination described
10/// in [CycleFold](https://eprint.iacr.org/2023/1192.pdf).
11#[derive(Debug)]
12pub struct ECRLC<C: CurveGroup, GC: CurveVar<C, CF<C>>> {
13    _c: PhantomData<C>,
14    _gc: PhantomData<GC>,
15}
16impl<C: CurveGroup, GC: CurveVar<C, CF<C>>> ECRLC<C, GC> {
17    pub fn check(
18        // get r in bits format, so it can be reused across many instances of ECRLC gadget,
19        // reducing the number of constraints needed
20        r_bits: Vec<Boolean<CF<C>>>,
21        p1: GC,
22        p2: GC,
23        p3: GC,
24    ) -> Result<(), SynthesisError> {
25        p3.enforce_equal(&(p1 + p2.scalar_mul_le(r_bits.iter())?))?;
26        Ok(())
27    }
28}
29
30#[cfg(test)]
31mod tests {
32    use super::*;
33    use ark_ff::{BigInteger, PrimeField};
34    use ark_pallas::{constraints::GVar, Fq, Fr, Projective};
35    use ark_r1cs_std::alloc::AllocVar;
36    use ark_relations::r1cs::ConstraintSystem;
37    use ark_std::UniformRand;
38    use std::ops::Mul;
39
40    /// Let Curve1=pallas and Curve2=vesta. Here our constraints system will work over Curve2::Fr =
41    /// vesta::Fr (=pallas::Fq), thus our points are P_i \in Curve1 (=pasta).
42    #[test]
43    fn test_ecrlc_check() {
44        let mut rng = ark_std::test_rng();
45
46        let r = Fr::rand(&mut rng);
47        let p1 = Projective::rand(&mut rng);
48        let p2 = Projective::rand(&mut rng);
49        let p3 = p1 + p2.mul(r);
50
51        let cs = ConstraintSystem::<Fq>::new_ref(); // CS over Curve2::Fr = Curve1::Fq
52
53        // prepare circuit inputs
54        let rbitsVar: Vec<Boolean<Fq>> =
55            Vec::new_witness(cs.clone(), || Ok(r.into_bigint().to_bits_le())).unwrap();
56
57        let p1Var = GVar::new_witness(cs.clone(), || Ok(p1)).unwrap();
58        let p2Var = GVar::new_witness(cs.clone(), || Ok(p2)).unwrap();
59        let p3Var = GVar::new_witness(cs.clone(), || Ok(p3)).unwrap();
60
61        // check ECRLC circuit
62        ECRLC::<Projective, GVar>::check(rbitsVar, p1Var, p2Var, p3Var).unwrap();
63        assert!(cs.is_satisfied().unwrap());
64    }
65}