mirror of
https://github.com/codex-storage/constantine.git
synced 2025-01-29 20:17:24 +00:00
2f839cb1bf
* Elliptic curve and Twisted curve templates - initial commit * Support EC Add on G2 (Sextic Twisted curve for BN and BLS12 families) * Refactor the config parser to prepare for elliptic coefficient support * Add elliptic curve parameter for BN254 (Snarks), BLS12-381 and Zexe curve BLS12-377 * Add accessors to curve parameters * Allow computing the right-hand-side of of Weierstrass equation "y² = x³ + a x + b" * Randomized test infrastructure for elliptic curves * Start a testing suite on ellptic curve addition (failing) * detail projective addition * Fix EC addition test (forgot initializing Z=1 and that there ar emultiple infinity points) * Test with random Z coordinate + add elliptic curve test to test suite * fix reference to the (deactivated) addchain inversion for BN curves [skip ci] * .nims file leftover [skip ci]
139 lines
4.5 KiB
Nim
139 lines
4.5 KiB
Nim
# Constantine
|
|
# Copyright (c) 2018-2019 Status Research & Development GmbH
|
|
# Copyright (c) 2020-Present Mamy André-Ratsimbazafy
|
|
# Licensed and distributed under either of
|
|
# * MIT license (license terms in the root directory or at http://opensource.org/licenses/MIT).
|
|
# * Apache v2 license (license terms in the root directory or at http://www.apache.org/licenses/LICENSE-2.0).
|
|
# at your option. This file may not be copied, modified, or distributed except according to those terms.
|
|
|
|
import
|
|
../constantine/arithmetic/bigints,
|
|
../constantine/config/[common, curves],
|
|
../constantine/elliptic/[ec_weierstrass_affine, ec_weierstrass_projective]
|
|
|
|
# ############################################################
|
|
#
|
|
# Pseudo-Random Number Generator
|
|
#
|
|
# ############################################################
|
|
#
|
|
# Our field elements for elliptic curve cryptography
|
|
# are in the 2^256~2^512 range.
|
|
# For pairings, with embedding degrees of 12 to 48
|
|
# We would need 12~48 field elements per point on the curve
|
|
#
|
|
# The recommendation by Vigna at http://prng.di.unimi.it
|
|
# is to have a period of t^2 if we need t values (i.e. about 2^1024)
|
|
# but also that for all practical purposes 2^256 period is enough
|
|
#
|
|
# We use 2^512 to cover the range the base field elements
|
|
|
|
type RngState* = object
|
|
s: array[8, uint64]
|
|
|
|
func splitMix64(state: var uint64): uint64 =
|
|
state += 0x9e3779b97f4a7c15'u64
|
|
result = state
|
|
result = (result xor (result shr 30)) * 0xbf58476d1ce4e5b9'u64
|
|
result = (result xor (result shr 27)) * 0xbf58476d1ce4e5b9'u64
|
|
result = result xor (result shr 31)
|
|
|
|
func seed*(rng: var RngState, x: SomeInteger) =
|
|
## Seed the random number generator with a fixed seed
|
|
var sm64 = uint64(x)
|
|
rng.s[0] = splitMix64(sm64)
|
|
rng.s[1] = splitMix64(sm64)
|
|
rng.s[2] = splitMix64(sm64)
|
|
rng.s[3] = splitMix64(sm64)
|
|
rng.s[4] = splitMix64(sm64)
|
|
rng.s[5] = splitMix64(sm64)
|
|
rng.s[6] = splitMix64(sm64)
|
|
rng.s[7] = splitMix64(sm64)
|
|
|
|
func rotl(x: uint64, k: static int): uint64 {.inline.} =
|
|
return (x shl k) or (x shr (64 - k))
|
|
|
|
template `^=`(x: var uint64, y: uint64) =
|
|
x = x xor y
|
|
|
|
func next(rng: var RngState): uint64 =
|
|
## Compute a random uint64 from the input state
|
|
## using xoshiro512** algorithm by Vigna et al
|
|
## State is updated.
|
|
result = rotl(rng.s[1] * 5, 7) * 9
|
|
|
|
let t = rng.s[1] shl 11
|
|
rng.s[2] ^= rng.s[0];
|
|
rng.s[5] ^= rng.s[1];
|
|
rng.s[1] ^= rng.s[2];
|
|
rng.s[7] ^= rng.s[3];
|
|
rng.s[3] ^= rng.s[4];
|
|
rng.s[4] ^= rng.s[5];
|
|
rng.s[0] ^= rng.s[6];
|
|
rng.s[6] ^= rng.s[7];
|
|
|
|
rng.s[6] ^= t;
|
|
|
|
rng.s[7] = rotl(rng.s[7], 21);
|
|
|
|
# BigInts and Fields
|
|
# ------------------------------------------------------------
|
|
|
|
func random[T](rng: var RngState, a: var T, C: static Curve) {.noInit.}=
|
|
## Recursively initialize a BigInt or Field element
|
|
when T is BigInt:
|
|
var reduced, unreduced{.noInit.}: T
|
|
|
|
for i in 0 ..< unreduced.limbs.len:
|
|
unreduced.limbs[i] = Word(rng.next())
|
|
|
|
# Note: a simple modulo will be biaised but it's simple and "fast"
|
|
reduced.reduce(unreduced, C.Mod)
|
|
a.montyResidue(reduced, C.Mod, C.getR2modP(), C.getNegInvModWord(), C.canUseNoCarryMontyMul())
|
|
|
|
else:
|
|
for field in fields(a):
|
|
rng.random(field, C)
|
|
|
|
# Elliptic curves
|
|
# ------------------------------------------------------------
|
|
|
|
func random[F](rng: var RngState, a: var ECP_SWei_Proj[F]) =
|
|
## Initialize a random curve point with Z coordinate == 1
|
|
|
|
var fieldElem {.noInit.}: F
|
|
var success = CtFalse
|
|
|
|
while not bool(success):
|
|
# Euler's criterion: there are (p-1)/2 squares in a field with modulus `p`
|
|
# so we have a probability of ~0.5 to get a good point
|
|
rng.random(fieldElem, F.C)
|
|
success = trySetFromCoordX(a, fieldElem)
|
|
|
|
func random_with_randZ[F](rng: var RngState, a: var ECP_SWei_Proj[F]) =
|
|
## Initialize a random curve point with Z coordinate being random
|
|
|
|
var Z{.noInit.}: F
|
|
rng.random(Z, F.C) # If Z is zero, X will be zero and that will be an infinity point
|
|
|
|
var fieldElem {.noInit.}: F
|
|
var success = CtFalse
|
|
|
|
while not bool(success):
|
|
rng.random(fieldElem, F.C)
|
|
success = trySetFromCoordsXandZ(a, fieldElem, Z)
|
|
|
|
# Generic over any supported type
|
|
# ------------------------------------------------------------
|
|
|
|
func random*(rng: var RngState, T: typedesc): T =
|
|
## Create a random Field or Extension Field or Curve Element
|
|
when T is ECP_SWei_Proj:
|
|
rng.random(result)
|
|
else:
|
|
rng.random(result, T.C)
|
|
|
|
func random_with_randZ*(rng: var RngState, T: typedesc[ECP_SWei_Proj]): T =
|
|
## Create a random curve element with a random Z coordinate
|
|
rng.random_with_randZ(result)
|