ark_bn254/curves/
g2.rs

1use ark_ec::AffineRepr;
2use ark_ec::{
3    models::{short_weierstrass::SWCurveConfig, CurveConfig},
4    scalar_mul::glv::GLVConfig,
5    short_weierstrass::{Affine, Projective},
6};
7use ark_ff::{AdditiveGroup, BigInt, Field, MontFp, PrimeField, Zero};
8
9use crate::{Fq, Fq2, Fr};
10
11pub type G2Affine = Affine<Config>;
12
13#[derive(Clone, Default, PartialEq, Eq)]
14pub struct Config;
15
16impl CurveConfig for Config {
17    type BaseField = Fq2;
18    type ScalarField = Fr;
19
20    /// COFACTOR = (36 * X^4) + (36 * X^3) + (30 * X^2) + 6*X + 1
21    /// 21888242871839275222246405745257275088844257914179612981679871602714643921549
22    #[rustfmt::skip]
23    const COFACTOR: &'static [u64] = &[
24        0x345f2299c0f9fa8d,
25        0x06ceecda572a2489,
26        0xb85045b68181585e,
27        0x30644e72e131a029,
28    ];
29
30    /// COFACTOR_INV = COFACTOR^{-1} mod r
31    const COFACTOR_INV: Fr =
32        MontFp!("10944121435919637613327163357776759465618812564592884533313067514031822496649");
33}
34
35impl SWCurveConfig for Config {
36    /// COEFF_A = [0, 0]
37    const COEFF_A: Fq2 = Fq2::ZERO;
38
39    /// COEFF_B = 3/(u+9)
40    /// (19485874751759354771024239261021720505790618469301721065564631296452457478373, 266929791119991161246907387137283842545076965332900288569378510910307636690)
41    const COEFF_B: Fq2 = Fq2::new(
42        MontFp!("19485874751759354771024239261021720505790618469301721065564631296452457478373"),
43        MontFp!("266929791119991161246907387137283842545076965332900288569378510910307636690"),
44    );
45
46    /// AFFINE_GENERATOR_COEFFS = (G2_GENERATOR_X, G2_GENERATOR_Y)
47    const GENERATOR: G2Affine = G2Affine::new_unchecked(G2_GENERATOR_X, G2_GENERATOR_Y);
48
49    #[inline(always)]
50    fn mul_by_a(_: Self::BaseField) -> Self::BaseField {
51        Self::BaseField::zero()
52    }
53
54    fn is_in_correct_subgroup_assuming_on_curve(point: &G2Affine) -> bool {
55        // Subgroup check from section 4.3 of https://eprint.iacr.org/2022/352.pdf.
56        //
57        // Checks that [p]P = [6X^2]P
58
59        let x_times_point = point.mul_bigint(SIX_X_SQUARED);
60        let p_times_point = p_power_endomorphism(point);
61        x_times_point.eq(&p_times_point)
62    }
63}
64
65impl GLVConfig for Config {
66    const ENDO_COEFFS: &'static [Self::BaseField] = &[Fq2::new(
67        MontFp!("21888242871839275220042445260109153167277707414472061641714758635765020556616"),
68        Fq::ZERO,
69    )];
70
71    const LAMBDA: Self::ScalarField =
72        MontFp!("4407920970296243842393367215006156084916469457145843978461");
73
74    const SCALAR_DECOMP_COEFFS: [(bool, <Self::ScalarField as PrimeField>::BigInt); 4] = [
75        (false, BigInt!("147946756881789319010696353538189108491")),
76        (false, BigInt!("9931322734385697763")),
77        (true, BigInt!("9931322734385697763")),
78        (false, BigInt!("147946756881789319000765030803803410728")),
79    ];
80
81    fn endomorphism(p: &Projective<Self>) -> Projective<Self> {
82        let mut res = (*p).clone();
83        res.x *= Self::ENDO_COEFFS[0];
84        res
85    }
86
87    fn endomorphism_affine(p: &Affine<Self>) -> Affine<Self> {
88        let mut res = (*p).clone();
89        res.x *= Self::ENDO_COEFFS[0];
90        res
91    }
92}
93
94pub const G2_GENERATOR_X: Fq2 = Fq2::new(G2_GENERATOR_X_C0, G2_GENERATOR_X_C1);
95pub const G2_GENERATOR_Y: Fq2 = Fq2::new(G2_GENERATOR_Y_C0, G2_GENERATOR_Y_C1);
96
97/// G2_GENERATOR_X_C0 =
98/// 10857046999023057135944570762232829481370756359578518086990519993285655852781
99pub const G2_GENERATOR_X_C0: Fq =
100    MontFp!("10857046999023057135944570762232829481370756359578518086990519993285655852781");
101
102/// G2_GENERATOR_X_C1 =
103/// 11559732032986387107991004021392285783925812861821192530917403151452391805634
104pub const G2_GENERATOR_X_C1: Fq =
105    MontFp!("11559732032986387107991004021392285783925812861821192530917403151452391805634");
106
107/// G2_GENERATOR_Y_C0 =
108/// 8495653923123431417604973247489272438418190587263600148770280649306958101930
109pub const G2_GENERATOR_Y_C0: Fq =
110    MontFp!("8495653923123431417604973247489272438418190587263600148770280649306958101930");
111
112/// G2_GENERATOR_Y_C1 =
113/// 4082367875863433681332203403145435568316851327593401208105741076214120093531
114pub const G2_GENERATOR_Y_C1: Fq =
115    MontFp!("4082367875863433681332203403145435568316851327593401208105741076214120093531");
116
117// PSI_X = (u+9)^((p-1)/3) = TWIST_MUL_BY_Q_X
118const P_POWER_ENDOMORPHISM_COEFF_0: Fq2 = Fq2::new(
119    MontFp!("21575463638280843010398324269430826099269044274347216827212613867836435027261"),
120    MontFp!("10307601595873709700152284273816112264069230130616436755625194854815875713954"),
121);
122
123// PSI_Y = (u+9)^((p-1)/2) = TWIST_MUL_BY_Q_Y
124const P_POWER_ENDOMORPHISM_COEFF_1: Fq2 = Fq2::new(
125    MontFp!("2821565182194536844548159561693502659359617185244120367078079554186484126554"),
126    MontFp!("3505843767911556378687030309984248845540243509899259641013678093033130930403"),
127);
128
129// Integer representation of 6x^2 = t - 1
130const SIX_X_SQUARED: [u64; 2] = [17887900258952609094, 8020209761171036667];
131
132/// psi(P) is the untwist-Frobenius-twist endomorphism on E'(Fq2)
133fn p_power_endomorphism(p: &Affine<Config>) -> Affine<Config> {
134    // Maps (x,y) -> (x^p * (u+9)^((p-1)/3), y^p * (u+9)^((p-1)/2))
135
136    let mut res = *p;
137    res.x.frobenius_map_in_place(1);
138    res.y.frobenius_map_in_place(1);
139
140    res.x *= P_POWER_ENDOMORPHISM_COEFF_0;
141    res.y *= P_POWER_ENDOMORPHISM_COEFF_1;
142
143    res
144}
145
146#[cfg(test)]
147mod test {
148
149    use super::*;
150    use crate::g2;
151    use ark_std::{rand::Rng, UniformRand};
152
153    fn sample_unchecked() -> Affine<g2::Config> {
154        let mut rng = ark_std::test_rng();
155        loop {
156            let x1 = Fq::rand(&mut rng);
157            let x2 = Fq::rand(&mut rng);
158            let greatest = rng.gen();
159            let x = Fq2::new(x1, x2);
160
161            if let Some(p) = Affine::get_point_from_x_unchecked(x, greatest) {
162                return p;
163            }
164        }
165    }
166
167    fn naive_is_in_subgroup_assuming_on_curve(p: &Affine<g2::Config>) -> bool {
168        <g2::Config as SWCurveConfig>::mul_affine(
169            p,
170            <g2::Config as CurveConfig>::ScalarField::characteristic(),
171        )
172        .is_zero()
173    }
174
175    #[test]
176    fn test_is_in_subgroup_assuming_on_curve() {
177        const SAMPLES: usize = 100;
178        for _ in 0..SAMPLES {
179            let p: Affine<g2::Config> = sample_unchecked();
180            assert!(p.is_on_curve());
181
182            assert_eq!(
183                naive_is_in_subgroup_assuming_on_curve(&p),
184                p.is_in_correct_subgroup_assuming_on_curve()
185            );
186
187            let cleared = p.clear_cofactor();
188            assert!(cleared.is_in_correct_subgroup_assuming_on_curve());
189        }
190    }
191}
ark_bn254/curves/g2.rs

ark_bn254/curves/
g2.rs
