ark_r1cs_std/fields/
fp12.rs

1use crate::fields::{fp2::Fp2Var, fp6_3over2::Fp6Var, quadratic_extension::*, FieldVar};
2use ark_ff::{
3    fields::{fp12_2over3over2::*, Field},
4    fp6_3over2::Fp6Config,
5    QuadExtConfig,
6};
7use ark_relations::r1cs::SynthesisError;
8
9/// A degree-12 extension field constructed as the tower of a
10/// quadratic extension over a cubic extension over a quadratic extension field.
11/// This is the R1CS equivalent of `ark_ff::fp12_2over3over2::Fp12<P>`.
12pub type Fp12Var<P> = QuadExtVar<Fp6Var<<P as Fp12Config>::Fp6Config>, Fp12ConfigWrapper<P>>;
13
14type Fp2Config<P> = <<P as Fp12Config>::Fp6Config as Fp6Config>::Fp2Config;
15
16impl<P: Fp12Config> QuadExtVarConfig<Fp6Var<P::Fp6Config>> for Fp12ConfigWrapper<P> {
17    fn mul_base_field_var_by_frob_coeff(fe: &mut Fp6Var<P::Fp6Config>, power: usize) {
18        fe.c0 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
19        fe.c1 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
20        fe.c2 *= Self::FROBENIUS_COEFF_C1[power % Self::DEGREE_OVER_BASE_PRIME_FIELD];
21    }
22}
23
24impl<P: Fp12Config> Fp12Var<P> {
25    /// Multiplies by a sparse element of the form `(c0 = (c0, c1, 0), c1 = (0,
26    /// d1, 0))`.
27    #[inline]
28    pub fn mul_by_014(
29        &self,
30        c0: &Fp2Var<Fp2Config<P>>,
31        c1: &Fp2Var<Fp2Config<P>>,
32        d1: &Fp2Var<Fp2Config<P>>,
33    ) -> Result<Self, SynthesisError> {
34        let v0 = self.c0.mul_by_c0_c1_0(&c0, &c1)?;
35        let v1 = self.c1.mul_by_0_c1_0(&d1)?;
36        let new_c0 = Self::mul_base_field_by_nonresidue(&v1)? + &v0;
37
38        let new_c1 = (&self.c0 + &self.c1).mul_by_c0_c1_0(&c0, &(c1 + d1))? - &v0 - &v1;
39        Ok(Self::new(new_c0, new_c1))
40    }
41
42    /// Multiplies by a sparse element of the form `(c0 = (c0, 0, 0), c1 = (d0,
43    /// d1, 0))`.
44    #[inline]
45    pub fn mul_by_034(
46        &self,
47        c0: &Fp2Var<Fp2Config<P>>,
48        d0: &Fp2Var<Fp2Config<P>>,
49        d1: &Fp2Var<Fp2Config<P>>,
50    ) -> Result<Self, SynthesisError> {
51        let a0 = &self.c0.c0 * c0;
52        let a1 = &self.c0.c1 * c0;
53        let a2 = &self.c0.c2 * c0;
54        let a = Fp6Var::new(a0, a1, a2);
55        let b = self.c1.mul_by_c0_c1_0(&d0, &d1)?;
56
57        let c0 = c0 + d0;
58        let c1 = d1;
59        let e = (&self.c0 + &self.c1).mul_by_c0_c1_0(&c0, &c1)?;
60        let new_c1 = e - (&a + &b);
61        let new_c0 = Self::mul_base_field_by_nonresidue(&b)? + &a;
62
63        Ok(Self::new(new_c0, new_c1))
64    }
65
66    /// Squares `self` when `self` is in the cyclotomic subgroup.
67    pub fn cyclotomic_square(&self) -> Result<Self, SynthesisError> {
68        if characteristic_square_mod_6_is_one(Fp12::<P>::characteristic()) {
69            let fp2_nr = <P::Fp6Config as Fp6Config>::NONRESIDUE;
70
71            let z0 = &self.c0.c0;
72            let z4 = &self.c0.c1;
73            let z3 = &self.c0.c2;
74            let z2 = &self.c1.c0;
75            let z1 = &self.c1.c1;
76            let z5 = &self.c1.c2;
77
78            // t0 + t1*y = (z0 + z1*y)^2 = a^2
79            let tmp = z0 * z1;
80            let t0 = {
81                let tmp1 = z0 + z1;
82                let tmp2 = z1 * fp2_nr + z0;
83                let tmp4 = &tmp * fp2_nr + &tmp;
84                tmp1 * tmp2 - tmp4
85            };
86            let t1 = tmp.double()?;
87
88            // t2 + t3*y = (z2 + z3*y)^2 = b^2
89            let tmp = z2 * z3;
90            let t2 = {
91                // (z2 + &z3) * &(z2 + &(fp2_nr * &z3)) - &tmp - &(tmp * &fp2_nr);
92                let tmp1 = z2 + z3;
93                let tmp2 = z3 * fp2_nr + z2;
94                let tmp4 = &tmp * fp2_nr + &tmp;
95                tmp1 * tmp2 - tmp4
96            };
97            let t3 = tmp.double()?;
98
99            // t4 + t5*y = (z4 + z5*y)^2 = c^2
100            let tmp = z4 * z5;
101            let t4 = {
102                // (z4 + &z5) * &(z4 + &(fp2_nr * &z5)) - &tmp - &(tmp * &fp2_nr);
103                let tmp1 = z4 + z5;
104                let tmp2 = (z5 * fp2_nr) + z4;
105                let tmp4 = (&tmp * fp2_nr) + &tmp;
106                (tmp1 * tmp2) - tmp4
107            };
108            let t5 = tmp.double()?;
109
110            // for A
111
112            // z0 = 3 * t0 - 2 * z0
113            let c0_c0 = (&t0 - z0).double()? + &t0;
114
115            // z1 = 3 * t1 + 2 * z1
116            let c1_c1 = (&t1 + z1).double()? + &t1;
117
118            // for B
119
120            // z2 = 3 * (xi * t5) + 2 * z2
121            let c1_c0 = {
122                let tmp = &t5 * fp2_nr;
123                (z2 + &tmp).double()? + &tmp
124            };
125
126            // z3 = 3 * t4 - 2 * z3
127            let c0_c2 = (&t4 - z3).double()? + &t4;
128
129            // for C
130
131            // z4 = 3 * t2 - 2 * z4
132            let c0_c1 = (&t2 - z4).double()? + &t2;
133
134            // z5 = 3 * t3 + 2 * z5
135            let c1_c2 = (&t3 + z5).double()? + &t3;
136            let c0 = Fp6Var::new(c0_c0, c0_c1, c0_c2);
137            let c1 = Fp6Var::new(c1_c0, c1_c1, c1_c2);
138
139            Ok(Self::new(c0, c1))
140        } else {
141            self.square()
142        }
143    }
144
145    /// Like `Self::cyclotomic_exp`, but additionally uses cyclotomic squaring.
146    pub fn optimized_cyclotomic_exp(
147        &self,
148        exponent: impl AsRef<[u64]>,
149    ) -> Result<Self, SynthesisError> {
150        use ark_ff::biginteger::arithmetic::find_naf;
151        let mut res = Self::one();
152        let self_inverse = self.unitary_inverse()?;
153
154        let mut found_nonzero = false;
155        let naf = find_naf(exponent.as_ref());
156
157        for &value in naf.iter().rev() {
158            if found_nonzero {
159                res = res.cyclotomic_square()?;
160            }
161
162            if value != 0 {
163                found_nonzero = true;
164
165                if value > 0 {
166                    res *= self;
167                } else {
168                    res *= &self_inverse;
169                }
170            }
171        }
172
173        Ok(res)
174    }
175}
ark_r1cs_std/fields/fp12.rs

ark_r1cs_std/fields/
fp12.rs
