# Constantine # Copyright (c) 2018-2019 Status Research & Development GmbH # Copyright (c) 2020-Present Mamy André-Ratsimbazafy # Licensed and distributed under either of # * MIT license (license terms in the root directory or at http://opensource.org/licenses/MIT). # * Apache v2 license (license terms in the root directory or at http://www.apache.org/licenses/LICENSE-2.0). # at your option. This file may not be copied, modified, or distributed except according to those terms. import ../config/[common, curves, type_ff], ../towers, ../elliptic/[ ec_shortweierstrass_affine, ec_shortweierstrass_projective ], ../curves/zoo_pairings, ./lines_projective, ./mul_fp12_by_lines, ./miller_loops # ############################################################ # # Optimal ATE pairing for # BLS12-381 # # ############################################################ # # - Software Implementation, Algorithm 11.2 & 11.3 # Aranha, Dominguez Perez, A. Mrabet, Schwabe, # Guide to Pairing-Based Cryptography, 2015 # # - Physical Attacks, # N. El Mrabet, Goubin, Guilley, Fournier, Jauvart, Moreau, Rauzy, Rondepierre, # Guide to Pairing-Based Cryptography, 2015 # # - Pairing Implementation Revisited # Mike Scott, 2019 # https://eprint.iacr.org/2019/077.pdf # # Fault attacks: # To limite exposure to some fault attacks (flipping bits with a laser on embedded): # - changing the number of Miller loop iterations # - flipping the bits in the Miller loop # we hardcode unrolled addition chains. # This should also contribute to performance. # # Multi-pairing discussion: # Aranha & Scott proposes 2 different approaches for multi-pairing. # # ----- # Scott # # Algorithm 2: Calculate and store line functions for BLS12 curve # Input: Q ∈ G2, P ∈ G1 , curve parameter u # Output: An array g of blog2(u)c line functions ∈ Fp12 # 1 T ← Q # 2 for i ← ceil(log2(u)) − 1 to 0 do # 3 g[i] ← lT,T(P), T ← 2T # 4 if ui = 1 then # 5 g[i] ← g[i].lT,Q(P), T ← T + Q # 6 return g # # And to accumulate lines from a new (P, Q) tuple of points # # Algorithm 4: Accumulate another set of line functions into g # Input: The array g, Qj ∈ G2 , Pj ∈ G1 , curve parameter u # Output: Updated array g of ceil(log2(u)) line functions ∈ Fp12 # 1 T ← Qj # 2 for i ← blog2 (u)c − 1 to 0 do # 3 t ← lT,T (Pj), T ← 2T # 4 if ui = 1 then # 5 t ← t.lT,Qj (Pj), T ← T + Qj # 6 g[i] ← g[i].t # 7 return g # # ------ # Aranha # # Algorithm 11.2 Explicit multipairing version of Algorithm 11.1. # (we extract the Miller Loop part only) # Input : P1 , P2 , . . . Pn ∈ G1 , # Q1 , Q2, . . . Qn ∈ G2 # Output: (we focus on the Miller Loop) # # Write l in binary form, l = sum(0 ..< m-1) # f ← 1, l ← abs(AteParam) # for j ← 1 to n do # Tj ← Qj # end # # for i = m-2 down to 0 do # f ← f² # for j ← 1 to n do # f ← f gTj,Tj(Pj), Tj ← [2]Tj # if li = 1 then # f ← f gTj,Qj(Pj), Tj ← Tj + Qj # end # end # end # # ----- # Assuming we have N tuples (Pj, Qj) of points j in 0 ..< N # and I operations to do in our Miller loop: # - I = HammingWeight(AteParam) + Bitwidth(AteParam) # - HammingWeight(AteParam) corresponds to line additions # - Bitwidth(AteParam) corresponds to line doublings # # Scott approach is to have: # - I Fp12 accumulators `g` # - 1 G2 accumulator `T` # and then accumulating each (Pj, Qj) into their corresponding `g` accumulator. # # Aranha approach is to have: # - 1 Fp12 accumulator `f` # - N G2 accumulators `T` # and accumulate N points per I. # # Scott approach is fully "online"/"streaming", # while Aranha's saves space. # For BLS12_381, # I = 68 hence we would need 68*12*48 = 39168 bytes (381-bit needs 48 bytes) # G2 has size 3*2*48 = 288 bytes (3 proj coordinates on Fp2) # and we choose N (which can be 1 for single pairing or reverting to Scott approach). # # In actual use, "streaming pairings" are not used, pairings to compute are receive # by batch, for example for blockchain you receive a batch of N blocks to verify from one peer. # Furthermore, 39kB would be over L1 cache size and incurs cache misses. # Additionally Aranha approach would make it easier to batch inversions # using Montgomery's simultaneous inversion technique. # Lastly, while a higher level API will need to store N (Pj, Qj) pairs for multi-pairings # for Aranha approach, it can decide how big N is depending on hardware and/or protocol. # # Regarding optimizations, as the Fp12 accumulator is dense # and lines are sparse (xyz000 or xy000z) Scott mentions the following costs: # - Dense-sparse is 13m # - sparse-sparse is 6m # - Dense-(somewhat sparse) is 17m # Hence when accumulating lines from multiple points: # - 2x Dense-sparse is 26m # - sparse-sparse then Dense-(somewhat sparse) is 23m # a 11.5% speedup # # We can use Aranha approach but process lines function 2-by-2 merging them # before merging them to the dense Fp12 accumulator # Miller Loop # ------------------------------------------------------------------------------------------------------- {.push raises: [].} import strutils, ../io/io_towers func miller_first_iter[N: static int]( f: var Fp12[BLS12_381], Ts: var array[N, ECP_ShortW_Prj[Fp2[BLS12_381], OnTwist]], Qs: array[N, ECP_ShortW_Aff[Fp2[BLS12_381], OnTwist]], Ps: array[N, ECP_ShortW_Aff[Fp[BLS12_381], NotOnTwist]] ) = ## Start a Miller Loop ## This means ## - 1 doubling ## - 1 add ## ## f is overwritten ## Ts are overwritten by Qs static: doAssert N >= 1 doAssert f.c0 is Fp4 {.push checks: off.} # No OverflowError or IndexError allowed var line {.noInit.}: Line[Fp2[BLS12_381]] # First step: T <- Q, f = 1 (mod p¹²), f *= line # ---------------------------------------------- for i in 0 ..< N: Ts[i].projectiveFromAffine(Qs[i]) line.line_double(Ts[0], Ps[0]) # f *= line <=> f = line for the first iteration # With Fp2 -> Fp4 -> Fp12 towering and a M-Twist # The line corresponds to a sparse xy000z Fp12 f.c0.c0 = line.x f.c0.c1 = line.y f.c1.c0.setZero() f.c1.c1.setZero() f.c2.c0.setZero() f.c2.c1 = line.z when N >= 2: line.line_double(Ts[1], Ps[1]) f.mul_sparse_by_line_xy000z(line) # TODO: sparse-sparse mul # Sparse merge 2 by 2, starting from 2 for i in countup(2, N-1, 2): # var f2 {.noInit.}: Fp12[BLS12_381] # TODO: sparse-sparse mul var line2 {.noInit.}: Line[Fp2[BLS12_381]] line.line_double(Ts[i], Ps[i]) line2.line_double(Ts[i+1], Ps[i+1]) # f2.mul_sparse_sparse(line, line2) # f.mul_somewhat_sparse(f2) f.mul_sparse_by_line_xy000z(line) f.mul_sparse_by_line_xy000z(line2) when N and 1 == 1: # N >= 2 and N is odd, there is a leftover line.line_double(Ts[N-1], Ps[N-1]) f.mul_sparse_by_line_xy000z(line) # 2nd step: Line addition as MSB is always 1 # ---------------------------------------------- when N >= 2: # f is dense, there are already many lines accumulated # Sparse merge 2 by 2, starting from 0 for i in countup(0, N-1, 2): # var f2 {.noInit.}: Fp12[BLS12_381] # TODO: sparse-sparse mul var line2 {.noInit.}: Line[Fp2[BLS12_381]] line.line_add(Ts[i], Qs[i], Ps[i]) line2.line_add(Ts[i+1], Qs[i+1], Ps[i+1]) # f2.mul_sparse_sparse(line, line2) # f.mul_somewhat_sparse(f2) f.mul_sparse_by_line_xy000z(line) f.mul_sparse_by_line_xy000z(line2) when N and 1 == 1: # N >= 2 and N is odd, there is a leftover line.line_add(Ts[N-1], Qs[N-1], Ps[N-1]) f.mul_sparse_by_line_xy000z(line) else: # N = 1, f is sparse line.line_add(Ts[0], Qs[0], Ps[0]) # f.mul_sparse_sparse(line) f.mul_sparse_by_line_xy000z(line) {.pop.} # No OverflowError or IndexError allowed func miller_accum_doublings[N: static int]( f: var Fp12[BLS12_381], Ts: var array[N, ECP_ShortW_Prj[Fp2[BLS12_381], OnTwist]], Ps: array[N, ECP_ShortW_Aff[Fp[BLS12_381], NotOnTwist]], numDoublings: int ) = ## Accumulate `numDoublings` Miller loop doubling steps into `f` static: doAssert N >= 1 {.push checks: off.} # No OverflowError or IndexError allowed var line {.noInit.}: Line[Fp2[BLS12_381]] for _ in 0 ..< numDoublings: f.square() when N >= 2: for i in countup(0, N-1, 2): # var f2 {.noInit.}: Fp12[BLS12_381] # TODO: sparse-sparse mul var line2 {.noInit.}: Line[Fp2[BLS12_381]] line.line_double(Ts[i], Ps[i]) line2.line_double(Ts[i+1], Ps[i+1]) # f2.mul_sparse_sparse(line, line2) # f.mul_somewhat_sparse(f2) f.mul_sparse_by_line_xy000z(line) f.mul_sparse_by_line_xy000z(line2) when N and 1 == 1: # N >= 2 and N is odd, there is a leftover line.line_double(Ts[N-1], Ps[N-1]) f.mul_sparse_by_line_xy000z(line) else: line.line_double(Ts[0], Ps[0]) f.mul_sparse_by_line_xy000z(line) {.pop.} # No OverflowError or IndexError allowed func miller_accum_addition[N: static int]( f: var Fp12[BLS12_381], Ts: var array[N, ECP_ShortW_Prj[Fp2[BLS12_381], OnTwist]], Qs: array[N, ECP_ShortW_Aff[Fp2[BLS12_381], OnTwist]], Ps: array[N, ECP_ShortW_Aff[Fp[BLS12_381], NotOnTwist]] ) = ## Accumulate a Miller loop addition step into `f` static: doAssert N >= 1 {.push checks: off.} # No OverflowError or IndexError allowed var line {.noInit.}: Line[Fp2[BLS12_381]] when N >= 2: # Sparse merge 2 by 2, starting from 0 for i in countup(0, N-1, 2): # var f2 {.noInit.}: Fp12[BLS12_381] # TODO: sparse-sparse mul var line2 {.noInit.}: Line[Fp2[BLS12_381]] line.line_add(Ts[i], Qs[i], Ps[i]) line2.line_add(Ts[i+1], Qs[i+1], Ps[i+1]) # f2.mul_sparse_sparse(line, line2) # f.mul_somewhat_sparse(f2) f.mul_sparse_by_line_xy000z(line) f.mul_sparse_by_line_xy000z(line2) when N and 1 == 1: # N >= 2 and N is odd, there is a leftover line.line_add(Ts[N-1], Qs[N-1], Ps[N-1]) f.mul_sparse_by_line_xy000z(line) else: line.line_add(Ts[0], Qs[0], Ps[0]) f.mul_sparse_by_line_xy000z(line) {.pop.} # No OverflowError or IndexError allowed func millerLoop_opt_BLS12_381*[N: static int]( f: var Fp12[BLS12_381], Qs: array[N, ECP_ShortW_Aff[Fp2[BLS12_381], OnTwist]], Ps: array[N, ECP_ShortW_Aff[Fp[BLS12_381], NotOnTwist]] ) {.meter.} = ## Generic Miller Loop for BLS12 curve ## Computes f{u,Q}(P) with u the BLS curve parameter var Ts {.noInit.}: array[N, ECP_ShortW_Prj[Fp2[BLS12_381], OnTwist]] # Ate param addition chain # Hex: 0xd201000000010000 # Bin: 0b1101001000000001000000000000000000000000000000010000000000000000 var iter = 1'u64 f.miller_first_iter(Ts, Qs, Ps) # 0b11 f.miller_accum_doublings(Ts, Ps, 2) # 0b1100 f.miller_accum_addition(Ts, Qs, Ps) # 0b1101 f.miller_accum_doublings(Ts, Ps, 3) # 0b1101000 f.miller_accum_addition(Ts, Qs, Ps) # 0b1101001 f.miller_accum_doublings(Ts, Ps, 9) # 0b1101001000000000 f.miller_accum_addition(Ts, Qs, Ps) # 0b1101001000000001 f.miller_accum_doublings(Ts, Ps, 32) # 0b110100100000000100000000000000000000000000000000 f.miller_accum_addition(Ts, Qs, Ps) # 0b110100100000000100000000000000000000000000000001 f.miller_accum_doublings(Ts, Ps, 16) # 0b1101001000000001000000000000000000000000000000010000000000000000 # TODO: what is the threshold for Karabina's compressed squarings?