use ark_ec::{AffineRepr, CurveGroup}; use ark_r1cs_std::{ alloc::{AllocVar, AllocationMode}, fields::fp::FpVar, ToConstraintFieldGadget, }; use ark_relations::r1cs::{Namespace, SynthesisError}; use ark_std::Zero; use core::borrow::Borrow; use crate::transcript::{AbsorbNonNative, AbsorbNonNativeGadget}; use super::uint::{nonnative_field_to_field_elements, NonNativeUintVar}; /// NonNativeAffineVar represents an elliptic curve point in Affine representation in the non-native /// field, over the constraint field. It is not intended to perform operations, but just to contain /// the affine coordinates in order to perform hash operations of the point. #[derive(Debug, Clone)] pub struct NonNativeAffineVar { pub x: NonNativeUintVar, pub y: NonNativeUintVar, } impl AllocVar for NonNativeAffineVar where C: CurveGroup, { fn new_variable>( cs: impl Into>, f: impl FnOnce() -> Result, mode: AllocationMode, ) -> Result { f().and_then(|val| { let cs = cs.into(); let affine = val.borrow().into_affine(); let zero = (&C::BaseField::zero(), &C::BaseField::zero()); let (x, y) = affine.xy().unwrap_or(zero); let x = NonNativeUintVar::new_variable(cs.clone(), || Ok(*x), mode)?; let y = NonNativeUintVar::new_variable(cs.clone(), || Ok(*y), mode)?; Ok(Self { x, y }) }) } } impl ToConstraintFieldGadget for NonNativeAffineVar { // Used for converting `NonNativeAffineVar` to a vector of `FpVar` with minimum length in // the circuit. fn to_constraint_field(&self) -> Result>, SynthesisError> { let x = self.x.to_constraint_field()?; let y = self.y.to_constraint_field()?; Ok([x, y].concat()) } } /// The out-circuit counterpart of `NonNativeAffineVar::to_constraint_field` #[allow(clippy::type_complexity)] fn nonnative_affine_to_field_elements( p: C, ) -> (Vec, Vec) { let affine = p.into_affine(); let zero = (&C::BaseField::zero(), &C::BaseField::zero()); let (x, y) = affine.xy().unwrap_or(zero); let x = nonnative_field_to_field_elements(x); let y = nonnative_field_to_field_elements(y); (x, y) } impl NonNativeAffineVar { // Extracts a list of field elements of type `C::ScalarField` from the public input // `p`, in exactly the same way as how `NonNativeAffineVar` is represented as limbs of type // `FpVar` in-circuit. #[allow(clippy::type_complexity)] pub fn inputize(p: C) -> Result<(Vec, Vec), SynthesisError> { let affine = p.into_affine(); let zero = (&C::BaseField::zero(), &C::BaseField::zero()); let (x, y) = affine.xy().unwrap_or(zero); let x = NonNativeUintVar::inputize(*x); let y = NonNativeUintVar::inputize(*y); Ok((x, y)) } } impl AbsorbNonNative for C { fn to_native_sponge_field_elements(&self, dest: &mut Vec) { let (x, y) = nonnative_affine_to_field_elements(*self); dest.extend(x); dest.extend(y); } } impl AbsorbNonNativeGadget for NonNativeAffineVar { fn to_native_sponge_field_elements( &self, ) -> Result>, SynthesisError> { self.to_constraint_field() } } #[cfg(test)] mod tests { use super::*; use ark_pallas::{Fr, Projective}; use ark_r1cs_std::R1CSVar; use ark_relations::r1cs::ConstraintSystem; use ark_std::UniformRand; #[test] fn test_alloc_zero() { let cs = ConstraintSystem::::new_ref(); // dealing with the 'zero' point should not panic when doing the unwrap let p = Projective::zero(); assert!(NonNativeAffineVar::::new_witness(cs.clone(), || Ok(p)).is_ok()); } #[test] fn test_improved_to_constraint_field() { let cs = ConstraintSystem::::new_ref(); // check that point_to_nonnative_limbs returns the expected values let mut rng = ark_std::test_rng(); let p = Projective::rand(&mut rng); let pVar = NonNativeAffineVar::::new_witness(cs.clone(), || Ok(p)).unwrap(); let (x, y) = nonnative_affine_to_field_elements(p); assert_eq!( pVar.to_constraint_field().unwrap().value().unwrap(), [x, y].concat() ); } #[test] fn test_inputize() { let cs = ConstraintSystem::::new_ref(); // check that point_to_nonnative_limbs returns the expected values let mut rng = ark_std::test_rng(); let p = Projective::rand(&mut rng); let pVar = NonNativeAffineVar::::new_witness(cs.clone(), || Ok(p)).unwrap(); let (x, y) = NonNativeAffineVar::inputize(p).unwrap(); assert_eq!(pVar.x.0.value().unwrap(), x); assert_eq!(pVar.y.0.value().unwrap(), y); } }