sw_bls12377

package
v0.0.0-...-70ee9f5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 19, 2023 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Overview

Package sw_bls12377 implements the arithmetics of G1, G2 and the pairing computation on BLS12-377 as a SNARK circuit over BW6-761. These two curves form a 2-chain so the operations use native field arithmetic.

References: BW6-761: https://eprint.iacr.org/2020/351 Pairings in R1CS: https://eprint.iacr.org/2022/1162

Index

Constants

This section is empty.

Variables

View Source 
var DecomposeScalarG1 = func(scalarField *big.Int, inputs []*big.Int, res []*big.Int) error {
	cc := getInnerCurveConfig(scalarField)
	sp := ecc.SplitScalar(inputs[0], cc.glvBasis)
	res[0].Set(&(sp[0]))
	res[1].Set(&(sp[1]))
	one := big.NewInt(1)

	for res[0].Cmp(cc.lambda) < 1 && res[1].Cmp(cc.lambda) < 1 {
		res[0].Add(res[0], cc.lambda)
		res[0].Add(res[0], one)
		res[1].Add(res[1], cc.lambda)
	}

	res[2].Mul(res[1], cc.lambda).Add(res[2], res[0])
	res[2].Sub(res[2], inputs[0])
	res[2].Div(res[2], cc.fr)

	return nil
}
View Source 
var DecomposeScalarG2 = func(scalarField *big.Int, inputs []*big.Int, res []*big.Int) error {
	cc := getInnerCurveConfig(scalarField)
	sp := ecc.SplitScalar(inputs[0], cc.glvBasis)
	res[0].Set(&(sp[0]))
	res[1].Set(&(sp[1]))
	one := big.NewInt(1)

	for res[0].Cmp(cc.lambda) < 1 && res[1].Cmp(cc.lambda) < 1 {
		res[0].Add(res[0], cc.lambda)
		res[0].Add(res[0], one)
		res[1].Add(res[1], cc.lambda)
	}

	res[2].Mul(res[1], cc.lambda).Add(res[2], res[0])
	res[2].Sub(res[2], inputs[0])
	res[2].Div(res[2], cc.fr)

	return nil
}

Functions

func PairingCheck 

func PairingCheck(api frontend.API, P []G1Affine, Q []G2Affine) error

PairingCheck calculates the reduced pairing for a set of points and asserts if the result is One ∏ᵢ e(Pᵢ, Qᵢ) =? 1

This function doesn't check that the inputs are in the correct subgroups

Types

type Curve 

type Curve struct {
	// contains filtered or unexported fields
}

Curve allows G1 operations in BLS12-377.

func NewCurve 

func NewCurve(api frontend.API) (*Curve, error)

NewCurve initializes a new Curve instance.

func (*Curve) Add 

func (c *Curve) Add(P, Q *G1Affine) *G1Affine

Add points P and Q and return the result. Does not modify the inputs.

func (*Curve) AddUnified 

func (c *Curve) AddUnified(P, Q *G1Affine) *G1Affine

AddUnified adds any two points and returns the sum. It does not modify the input points.

func (*Curve) AssertIsEqual 

func (c *Curve) AssertIsEqual(P, Q *G1Affine)

AssertIsEqual asserts the equality of P and Q.

func (*Curve) Lookup2 

func (c *Curve) Lookup2(b1, b2 frontend.Variable, p1, p2, p3, p4 *G1Affine) *G1Affine

Lookup2 performs a 2-bit lookup between p1, p2, p3, p4 based on bits b0 and b1. Returns:

  • p1 if b0=0 and b1=0,
  • p2 if b0=1 and b1=0,
  • p3 if b0=0 and b1=1,
  • p4 if b0=1 and b1=1.

func (*Curve) MarshalG1 

func (c *Curve) MarshalG1(P G1Affine) []frontend.Variable

MarshalG1 returns [P.X || P.Y] in binary. Both P.X and P.Y are in little endian.

func (*Curve) MarshalScalar 

func (c *Curve) MarshalScalar(s Scalar) []frontend.Variable

MarshalScalar returns

func (*Curve) MultiScalarMul 

func (c *Curve) MultiScalarMul(P []*G1Affine, scalars []*Scalar, opts ...algopts.AlgebraOption) (*G1Affine, error)

MultiScalarMul computes ∑scalars_i * P_i and returns it. It doesn't modify the inputs. It returns an error if there is a mismatch in the lengths of the inputs.

func (*Curve) Neg 

func (c *Curve) Neg(P *G1Affine) *G1Affine

Neg negates P and returns the result. Does not modify P.

func (*Curve) ScalarMul 

func (c *Curve) ScalarMul(P *G1Affine, s *Scalar, opts ...algopts.AlgebraOption) *G1Affine

ScalarMul computes scalar*P and returns the result. It doesn't modify the inputs.

func (*Curve) ScalarMulBase 

func (c *Curve) ScalarMulBase(s *Scalar, opts ...algopts.AlgebraOption) *G1Affine

ScalarMulBase computes scalar*G where G is the standard base point of the curve. It doesn't modify the scalar.

func (*Curve) Select 

func (c *Curve) Select(b frontend.Variable, p1, p2 *G1Affine) *G1Affine

Select sets p1 if b=1, p2 if b=0, and returns it. b must be boolean constrained

type G1Affine 

type G1Affine struct {
	X, Y frontend.Variable
}

G1Affine point in affine coords

func NewG1Affine 

func NewG1Affine(v bls12377.G1Affine) G1Affine

NewG1Affine allocates a witness from the native G1 element and returns it.

func (*G1Affine) AddAssign 

func (p *G1Affine) AddAssign(api frontend.API, p1 G1Affine) *G1Affine

AddAssign adds p1 to p using the affine formulas with division, and return p

func (*G1Affine) AddUnified 

func (p *G1Affine) AddUnified(api frontend.API, q G1Affine) *G1Affine

func (*G1Affine) AssertIsEqual 

func (p *G1Affine) AssertIsEqual(api frontend.API, other G1Affine)

AssertIsEqual constraint self to be equal to other into the given constraint system

func (*G1Affine) Assign 

func (p *G1Affine) Assign(p1 *bls12377.G1Affine)

Assign a value to self (witness assignment)

func (*G1Affine) Double 

func (p *G1Affine) Double(api frontend.API, p1 G1Affine) *G1Affine

Double double a point in affine coords

func (*G1Affine) DoubleAndAdd 

func (p *G1Affine) DoubleAndAdd(api frontend.API, p1, p2 *G1Affine) *G1Affine

DoubleAndAdd computes 2*p1+p in affine coords

func (*G1Affine) FromJac 

func (p *G1Affine) FromJac(api frontend.API, p1 G1Jac) *G1Affine

FromJac sets p to p1 in affine and returns it

func (*G1Affine) Lookup2 

func (p *G1Affine) Lookup2(api frontend.API, b1, b2 frontend.Variable, p1, p2, p3, p4 G1Affine) *G1Affine

Lookup2 performs a 2-bit lookup between p1, p2, p3, p4 based on bits b0 and b1. Returns:

  • p1 if b0=0 and b1=0,
  • p2 if b0=1 and b1=0,
  • p3 if b0=0 and b1=1,
  • p4 if b0=1 and b1=1.

func (*G1Affine) Neg 

func (p *G1Affine) Neg(api frontend.API, p1 G1Affine) *G1Affine

Neg outputs -p

func (*G1Affine) ScalarMul 

func (P *G1Affine) ScalarMul(api frontend.API, Q G1Affine, s interface{}) *G1Affine

ScalarMul sets P = [s] Q and returns P.

The method chooses an implementation based on scalar s. If it is constant, then the compiled circuit depends on s. If it is variable type, then the circuit is independent of the inputs.

func (*G1Affine) ScalarMulBase 

func (P *G1Affine) ScalarMulBase(api frontend.API, s frontend.Variable) *G1Affine

ScalarMulBase computes s * g1 and returns it, where g1 is the fixed generator. It doesn't modify s.

func (*G1Affine) Select 

func (p *G1Affine) Select(api frontend.API, b frontend.Variable, p1, p2 G1Affine) *G1Affine

Select sets p1 if b=1, p2 if b=0, and returns it. b must be boolean constrained

type G1Jac 

type G1Jac struct {
	X, Y, Z frontend.Variable
}

G1Jac point in Jacobian coords

func (*G1Jac) AddAssign 

func (p *G1Jac) AddAssign(api frontend.API, p1 G1Jac) *G1Jac

AddAssign adds 2 point in Jacobian coordinates p=p, a=p1

func (*G1Jac) AssertIsEqual 

func (p *G1Jac) AssertIsEqual(api frontend.API, other G1Jac)

AssertIsEqual constraint self to be equal to other into the given constraint system

func (*G1Jac) Assign 

func (p *G1Jac) Assign(p1 *bls12377.G1Jac)

Assign a value to self (witness assignment)

func (*G1Jac) DoubleAssign 

func (p *G1Jac) DoubleAssign(api frontend.API) *G1Jac

DoubleAssign doubles the receiver point in jacobian coords and returns it

func (*G1Jac) Neg 

func (p *G1Jac) Neg(api frontend.API, p1 G1Jac) *G1Jac

Neg outputs -p

type G2Affine 

type G2Affine struct {
	P     g2AffP
	Lines *lineEvaluations
}

G2Affine point in affine coords

func NewG2Affine 

func NewG2Affine(v bls12377.G2Affine) G2Affine

func NewG2AffineFixed 

func NewG2AffineFixed(v bls12377.G2Affine) G2Affine

NewG2AffineFixed returns witness of v with precomputations for efficient pairing computation.

func NewG2AffineFixedPlaceholder 

func NewG2AffineFixedPlaceholder() G2Affine

NewG2AffineFixedPlaceholder returns a placeholder for the circuit compilation when witness will be given with line precomputations using NewG2AffineFixed.

type G2Jac 

type G2Jac struct {
	X, Y, Z fields_bls12377.E2
}

G2Jac point in Jacobian coords

func (*G2Jac) AddAssign 

func (p *G2Jac) AddAssign(api frontend.API, p1 *G2Jac) *G2Jac

AddAssign adds 2 point in Jacobian coordinates p=p, a=p1

func (*G2Jac) AssertIsEqual 

func (p *G2Jac) AssertIsEqual(api frontend.API, other G2Jac)

AssertIsEqual constraint self to be equal to other into the given constraint system

func (*G2Jac) Assign 

func (p *G2Jac) Assign(p1 *bls12377.G2Jac)

Assign a value to self (witness assignment)

func (*G2Jac) Double 

func (p *G2Jac) Double(api frontend.API, p1 G2Jac) *G2Jac

Double doubles a point in jacobian coords

func (*G2Jac) Neg 

func (p *G2Jac) Neg(api frontend.API, p1 G2Jac) *G2Jac

Neg outputs -p

type GT 

type GT = fields_bls12377.E12

GT target group of the pairing

func FinalExponentiation 

func FinalExponentiation(api frontend.API, e1 GT) GT

FinalExponentiation computes the exponentiation e1ᵈ where d = (p¹²-1)/r = (p¹²-1)/Φ₁₂(p) ⋅ Φ₁₂(p)/r = (p⁶-1)(p²+1)(p⁴ - p² +1)/r we use instead d=s ⋅ (p⁶-1)(p²+1)(p⁴ - p² +1)/r where s is the cofactor 3 (Hayashida et al.)

func MillerLoop 

func MillerLoop(api frontend.API, P []G1Affine, Q []G2Affine) (GT, error)

MillerLoop computes the product of n miller loops (n can be 1) ∏ᵢ { fᵢ_{x₀,Q}(P) }

func NewGTEl 

func NewGTEl(v bls12377.GT) GT

NewGTEl allocates a witness from the native target group element and returns it.

func Pair 

func Pair(api frontend.API, P []G1Affine, Q []G2Affine) (GT, error)

Pair calculates the reduced pairing for a set of points ∏ᵢ e(Pᵢ, Qᵢ).

This function doesn't check that the inputs are in the correct subgroup

type Pairing 

type Pairing struct {
	// contains filtered or unexported fields
}

Pairing allows computing pairing-related operations in BLS12-377.

func NewPairing 

func NewPairing(api frontend.API) *Pairing

NewPairing initializes a Pairing instance.

func (*Pairing) AssertIsEqual 

func (p *Pairing) AssertIsEqual(e1, e2 *GT)

AssertIsEqual asserts the equality of the target group elements.

func (*Pairing) FinalExponentiation 

func (p *Pairing) FinalExponentiation(e *GT) *GT

FinalExponentiation performs the final exponentiation on the target group element. It doesn't modify the input.

func (*Pairing) MillerLoop 

func (p *Pairing) MillerLoop(P []*G1Affine, Q []*G2Affine) (*GT, error)

MillerLoop computes the Miller loop between the pairs of inputs. It doesn't modify the inputs. It returns an error if there is a mismatch betwen the lengths of the inputs.

func (*Pairing) Pair 

func (p *Pairing) Pair(P []*G1Affine, Q []*G2Affine) (*GT, error)

Pair computes a full multi-pairing on the input pairs.

func (*Pairing) PairingCheck 

func (p *Pairing) PairingCheck(P []*G1Affine, Q []*G2Affine) error

PairingCheck computes the multi-pairing of the input pairs and asserts that the result is an identity element in the target group. It returns an error if there is a mismatch between the lengths of the inputs.

type Scalar 

type Scalar = emulated.Element[ScalarField]

Scalar is a scalar in the groups. As the implementation is defined on a 2-chain, then this type is an alias to frontend.Variable.

func NewScalar 

func NewScalar(v fr_bls12377.Element) Scalar

NewScalar allocates a witness from the native scalar and returns it.

type ScalarField 

type ScalarField = emparams.BLS12377Fr

ScalarField defines the emulated.FieldParams implementation on a one limb of the scalar field.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.