update curve add

2026-01-09 17:23:08 +00:00 · 2022-12-05 18:27:50 -08:00 · 2022-12-05 18:27:50 -08:00 · 97f90b2266
commit 97f90b2266
parent 0ced2b3e06
2 changed files with 123 additions and 179 deletions
--- a/evm/src/cpu/kernel/asm/curve/bn254/curve_arithmetic/curve_add.asm
+++ b/evm/src/cpu/kernel/asm/curve/bn254/curve_arithmetic/curve_add.asm
@ -1,33 +1,21 @@
-// #define N 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47 // BN254 base field order
+// BN254 elliptic curve addition via the standard affine addition formula.

-// BN254 elliptic curve addition.
-// Uses the standard affine addition formula.
 global ec_add:
-    // Uncomment for test inputs.
-    // PUSH 0xdeadbeef
-    // PUSH 2
-    // PUSH 1
-    // PUSH 0x1bf9384aa3f0b3ad763aee81940cacdde1af71617c06f46e11510f14f3d5d121
-    // PUSH 0xe7313274bb29566ff0c8220eb9841de1d96c2923c6a4028f7dd3c6a14cee770
-    // stack: x0, y0, x1, y1, retdest
+    // stack:                                    x0, y0, x1, y1, retdest

    // Check if points are valid BN254 points.
-    DUP2
-    // stack: y0, x0, y0, x1, y1, retdest
-    DUP2
-    // stack: x0, y0, x0, y0, x1, y1, retdest
+    DUP2  DUP2    
+    // stack:                            x0, y0, x0, y0, x1, y1, retdest
    %ec_check
-    // stack: isValid(x0, y0), x0, y0, x1, y1, retdest
-    DUP5
-    // stack: x1, isValid(x0, y0), x0, y0, x1, y1, retdest
-    DUP5
-    // stack: x1, y1, isValid(x0, y0), x0, y0, x1, y1, retdest
+    // stack:                   isValid(x0, y0), x0, y0, x1, y1, retdest
+    DUP5  DUP5    
+    // stack:         x1, y1  , isValid(x0, y0), x0, y0, x1, y1, retdest
    %ec_check
-    // stack: isValid(x1, y1), isValid(x0, y0), x0, y0, x1, y1, retdest
+    // stack: isValid(x1, y1) , isValid(x0, y0), x0, y0, x1, y1, retdest
    AND
    // stack: isValid(x1, y1) & isValid(x0, y0), x0, y0, x1, y1, retdest
    %jumpi(ec_add_valid_points)
-    // stack: x0, y0, x1, y1, retdest
+    // stack:                                    x0, y0, x1, y1, retdest

    // Otherwise return
    %pop4
@ -37,59 +25,50 @@ global ec_add:
 // BN254 elliptic curve addition.
 // Assumption: (x0,y0) and (x1,y1) are valid points.
 global ec_add_valid_points:
-    // stack: x0, y0, x1, y1, retdest
+    // stack:                   x0, y0, x1, y1, retdest

    // Check if the first point is the identity.
-    DUP2
-    // stack: y0, x0, y0, x1, y1, retdest
-    DUP2
-    // stack: x0, y0, x0, y0, x1, y1, retdest
+    DUP2  DUP2
+    // stack:           x0,y0 , x0, y0, x1, y1, retdest
    %ec_isidentity
-    // stack: (x0,y0)==(0,0), x0, y0, x1, y1, retdest
-    %jumpi(ec_add_first_zero)
-    // stack: x0, y0, x1, y1, retdest
+    // stack:   (0,0)==(x0,y0), x0, y0, x1, y1, retdest
+    %jumpi(ec_add_fst_zero)
+    // stack:                   x0, y0, x1, y1, retdest

-    // Check if the first point is the identity.
-    DUP4
-    // stack: y1, x0, y0, x1, y1, retdest
-    DUP4
-    // stack: x1, y1, x0, y0, x1, y1, retdest
+    // Check if the second point is the identity.
+    DUP4  DUP4    
+    // stack:           x1,y1 , x0, y0, x1, y1, retdest
    %ec_isidentity
-    // stack: (x1,y1)==(0,0), x0, y0, x1, y1, retdest
+    // stack:   (0,0)==(x1,y1), x0, y0, x1, y1, retdest
    %jumpi(ec_add_snd_zero)
-    // stack: x0, y0, x1, y1, retdest
+    // stack:                   x0, y0, x1, y1, retdest

    // Check if both points have the same x-coordinate.
-    DUP3
-    // stack: x1, x0, y0, x1, y1, retdest
-    DUP2
-    // stack: x0, x1, x0, y0, x1, y1, retdest
+    DUP3  DUP2    
+    // stack:         x0 ,  x1, x0, y0, x1, y1, retdest
    EQ
-    // stack: x0 == x1, x0, y0, x1, y1, retdest
+    // stack:         x0 == x1, x0, y0, x1, y1, retdest
    %jumpi(ec_add_equal_first_coord)
-    // stack: x0, y0, x1, y1, retdest

+
+    // stack:                   x0, y0, x1, y1, retdest
    // Otherwise, we can use the standard formula.
    // Compute lambda = (y0 - y1)/(x0 - x1)
-    DUP4
-    // stack: y1, x0, y0, x1, y1, retdest
-    DUP3
-    // stack: y0, y1, x0, y0, x1, y1, retdest
-    %submod
-    // stack: y0 - y1, x0, y0, x1, y1, retdest
-    DUP4
-    // stack: x1, y0 - y1, x0, y0, x1, y1, retdest
-    DUP3
-    // stack: x0, x1, y0 - y1, x0, y0, x1, y1, retdest
-    %submod
+    DUP4  DUP3
+    // stack:          y0 , y1, x0, y0, x1, y1, retdest
+    SUBFP254
+    // stack:          y0 - y1, x0, y0, x1, y1, retdest
+    DUP4  DUP3
+    // stack: x0 , x1, y0 - y1, x0, y0, x1, y1, retdest
+    SUBFP254
    // stack: x0 - x1, y0 - y1, x0, y0, x1, y1, retdest
    %divfp254
-    // stack: lambda, x0, y0, x1, y1, retdest
+    // stack:           lambda, x0, y0, x1, y1, retdest
    %jump(ec_add_valid_points_with_lambda)

 // BN254 elliptic curve addition.
 // Assumption: (x0,y0) == (0,0)
-ec_add_first_zero:
+ec_add_fst_zero:
    // stack: x0, y0, x1, y1, retdest
    // Just return (x1,y1)
    %stack (x0, y0, x1, y1, retdest) -> (retdest, x1, y1)
@ -99,7 +78,6 @@ ec_add_first_zero:
 // Assumption: (x1,y1) == (0,0)
 ec_add_snd_zero:
    // stack: x0, y0, x1, y1, retdest
-
    // Just return (x0,y0)
    %stack (x0, y0, x1, y1, retdest) -> (retdest, x0, y0)
    JUMP
@ -107,45 +85,37 @@ ec_add_snd_zero:
 // BN254 elliptic curve addition.
 // Assumption: lambda = (y0 - y1)/(x0 - x1)
 ec_add_valid_points_with_lambda:
-    // stack: lambda, x0, y0, x1, y1, retdest
+    // stack:                             lambda, x0, y0, x1, y1, retdest

    // Compute x2 = lambda^2 - x1 - x0
-    DUP2
-    // stack: x0, lambda, x0, y0, x1, y1, retdest
-    DUP5
-    // stack: x1, x0, lambda, x0, y0, x1, y1, retdest
-    %bn_base
-    // stack: N, x1, x0, lambda, x0, y0, x1, y1, retdest
-    DUP4
-    // stack: lambda, N, x1, x0, lambda, x0, y0, x1, y1, retdest
-    DUP1
-    // stack: lambda, lambda, N, x1, x0, lambda, x0, y0, x1, y1, retdest
-    MULMOD
-    // stack: lambda^2, x1, x0, lambda, x0, y0, x1, y1, retdest
-    %submod
-    // stack: lambda^2 - x1, x0, lambda, x0, y0, x1, y1, retdest
-    %submod
-    // stack: x2, lambda, x0, y0, x1, y1, retdest
+    DUP2  DUP5
+    // stack:                     x1, x0, lambda, x0, y0, x1, y1, retdest
+    DUP3
+    // stack:          lambda   , x1, x0, lambda, x0, y0, x1, y1, retdest
+    DUP1  MULFP254
+    // stack:          lambda^2 , x1, x0, lambda, x0, y0, x1, y1, retdest
+    SUBFP254
+    // stack:          lambda^2 - x1, x0, lambda, x0, y0, x1, y1, retdest
+    SUBFP254
+    // stack:                         x2, lambda, x0, y0, x1, y1, retdest

    // Compute y2 = lambda*(x1 - x2) - y1
-    %bn_base
-    // stack: N, x2, lambda, x0, y0, x1, y1, retdest
-    DUP2
-    // stack: x2, N, x2, lambda, x0, y0, x1, y1, retdest
-    DUP7
-    // stack: x1, x2, N, x2, lambda, x0, y0, x1, y1, retdest
-    %submod
-    // stack: x1 - x2, N, x2, lambda, x0, y0, x1, y1, retdest
-    DUP4
-    // stack: lambda, x1 - x2, N, x2, lambda, x0, y0, x1, y1, retdest
-    MULMOD
-    // stack: lambda * (x1 - x2), x2, lambda, x0, y0, x1, y1, retdest
+    DUP1
+    // stack:                    x2 , x2, lambda, x0, y0, x1, y1, retdest
+    DUP6
+    // stack:               x1 , x2 , x2, lambda, x0, y0, x1, y1, retdest
+    SUBFP254
+    // stack:               x1 - x2 , x2, lambda, x0, y0, x1, y1, retdest
+    DUP3
+    // stack:     lambda ,  x1 - x2 , x2, lambda, x0, y0, x1, y1, retdest
+    MULFP254
+    // stack:     lambda * (x1 - x2), x2, lambda, x0, y0, x1, y1, retdest
    DUP7
    // stack: y1, lambda * (x1 - x2), x2, lambda, x0, y0, x1, y1, retdest
    SWAP1
    // stack: lambda * (x1 - x2), y1, x2, lambda, x0, y0, x1, y1, retdest
-    %submod
-    // stack: y2, x2, lambda, x0, y0, x1, y1, retdest
+    SUBFP254
+    // stack:                     y2, x2, lambda, x0, y0, x1, y1, retdest

    // Return x2,y2
    %stack (y2, x2, lambda, x0, y0, x1, y1, retdest) -> (retdest, x2, y2)
@ -154,24 +124,20 @@ ec_add_valid_points_with_lambda:
 // BN254 elliptic curve addition.
 // Assumption: (x0,y0) and (x1,y1) are valid points and x0 == x1
 ec_add_equal_first_coord:
-    // stack: x0, y0, x1, y1, retdest with x0 == x1
+    // stack:           x0, y0, x1, y1, retdest with x0 == x1

    // Check if the points are equal
-    DUP2
-    // stack: y0, x0, y0, x1, y1, retdest
-    DUP5
-    // stack: y1, y0, x0, y0, x1, y1, retdest
+    DUP2  DUP5
+    // stack: y1  , y0, x0, y0, x1, y1, retdest
    EQ
    // stack: y1 == y0, x0, y0, x1, y1, retdest
    %jumpi(ec_add_equal_points)
-    // stack: x0, y0, x1, y1, retdest
+    // stack:           x0, y0, x1, y1, retdest

    // Otherwise, one is the negation of the other so we can return (0,0).
    %pop4
-    // stack: retdest
-    PUSH 0
-    // stack: 0, retdest
-    PUSH 0
+    // stack:       retdest
+    PUSH 0  PUSH 0
    // stack: 0, 0, retdest
    SWAP2
    // stack: retdest, 0, 0
@ -182,37 +148,29 @@ ec_add_equal_first_coord:
 // Assumption: x0 == x1 and y0 == y1
 // Standard doubling formula.
 ec_add_equal_points:
-    // stack: x0, y0, x1, y1, retdest
-
+    // stack:                 x0, y0, x1, y1, retdest
    // Compute lambda = 3/2 * x0^2 / y0
-    %bn_base
-    // stack: N, x0, y0, x1, y1, retdest
-    %bn_base
-    // stack: N, N, x0, y0, x1, y1, retdest
-    DUP3
-    // stack: x0, N, N, x0, y0, x1, y1, retdest
+
    DUP1
-    // stack: x0, x0, N, N, x0, y0, x1, y1, retdest
-    MULMOD
-    // stack: x0^2, N, x0, y0, x1, y1, retdest with
-    PUSH 0x183227397098d014dc2822db40c0ac2ecbc0b548b438e5469e10460b6c3e7ea5 // 3/2 in the base field
-    // stack: 3/2, x0^2, N, x0, y0, x1, y1, retdest
-    MULMOD
-    // stack: 3/2 * x0^2, x0, y0, x1, y1, retdest
+    // stack:           x0  , x0, y0, x1, y1, retdest
+    DUP1  MULFP254
+    // stack:           x0^2, x0, y0, x1, y1, retdest
+    %bn_3_over_2
+    // stack:     3/2 , x0^2, x0, y0, x1, y1, retdest
+    MULFP254
+    // stack:     3/2 * x0^2, x0, y0, x1, y1, retdest
    DUP3
    // stack: y0, 3/2 * x0^2, x0, y0, x1, y1, retdest
    %divfp254
-    // stack: lambda, x0, y0, x1, y1, retdest
+    // stack:         lambda, x0, y0, x1, y1, retdest
    %jump(ec_add_valid_points_with_lambda)

 // BN254 elliptic curve doubling.
 // Assumption: (x0,y0) is a valid point.
 // Standard doubling formula.
 global ec_double:
-    // stack: x0, y0, retdest
-    DUP2
-    // stack: y0, x0, y0, retdest
-    DUP2
+    // stack:         x0, y0, retdest
+    DUP2  DUP2    
    // stack: x0, y0, x0, y0, retdest
    %jump(ec_add_equal_points)

@ -221,79 +179,65 @@ global ec_double:
    PUSH 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47
 %endmacro

-// Assumption: x, y < N and 2N < 2^256.
-// Note: Doesn't hold for Secp256k1 base field.
-%macro submod
-    // stack: x, y
-    %bn_base
-    // stack: N, x, y
-    ADD
-    // stack: N + x, y // Doesn't overflow since 2N < 2^256
-    SUB
-    // stack: N + x - y // Doesn't underflow since y < N
-    %bn_base
-    // stack: N, N + x - y
-    SWAP1
-    // stack: N + x - y, N
-    MOD
-    // stack: (N + x - y) % N = (x-y) % N
+%macro bn_3_over_2
+    // 3/2 in the base field
+    PUSH 0x183227397098d014dc2822db40c0ac2ecbc0b548b438e5469e10460b6c3e7ea5
 %endmacro

 // Check if (x,y) is a valid curve point.
-// Puts y^2 % N == (x^3 + 3) % N & (x < N) & (y < N) || (x,y)==(0,0) on top of the stack.
+// Returns range & curve || is_identity
+// where
+//     range = (x < N) & (y < N) 
+//     curve = y^2 == (x^3 + 3) 
+//     ident = (x,y) == (0,0)
+
 %macro ec_check
-    // stack: x, y
-    %bn_base
-    // stack: N, x, y
-    DUP2
-    // stack: x, N, x, y
-    LT
-    // stack: x < N, x, y
-    %bn_base
-    // stack: N, x < N, x, y
-    DUP4
-    // stack: y, N, x < N, x, y
-    LT
-    // stack: y < N, x < N, x, y
-    AND
-    // stack: (y < N) & (x < N), x, y
-    %stack (b, x, y) -> (x, x, @BN_BASE, x, @BN_BASE, @BN_BASE, x, y, b)
-    // stack: x, x, N, x, N, N, x, y, b
-    MULMOD
-    // stack: x^2 % N, x, N, N, x, y, b
-    MULMOD
-    // stack: x^3 % N, N, x, y, b
-    PUSH 3
-    // stack: 3, x^3 % N, N, x, y, b
-    ADDMOD
-    // stack: (x^3 + 3) % N, x, y, b
-    DUP3
-    // stack: y, (x^3 + 3) % N, x, y, b
-    %bn_base
-    // stack: N, y, (x^3 + 3) % N, x, y, b
-    SWAP1
-    // stack: y, N, (x^3 + 3) % N, x, y, b
+    // stack:                       x, y
    DUP1
-    // stack: y, y, N, (x^3 + 3) % N, x, y, b
-    MULMOD
-    // stack: y^2 % N, (x^3 + 3) % N, x, y, b
-    EQ
-    // stack: y^2 % N == (x^3 + 3) % N, x, y, b
+    // stack:                    x, x, y
+    %bn_base
+    // stack:                N , x, x, y
+    DUP1
+    // stack:             N, N , x, x, y
+    DUP5
+    // stack:         y , N, N , x, x, y
+    LT  
+    // stack:         y < N, N , x, x, y
    SWAP2
-    // stack: y, x, y^2 % N == (x^3 + 3) % N, b
-    %ec_isidentity
-    // stack: (x,y)==(0,0), y^2 % N == (x^3 + 3) % N, b
-    SWAP2
-    // stack: b, y^2 % N == (x^3 + 3) % N, (x,y)==(0,0)
+    // stack:         x , N, y < N, x, y
+    LT
+    // stack:         x < N, y < N, x, y
    AND
-    // stack: y^2 % N == (x^3 + 3) % N & (x < N) & (y < N), (x,y)==(0,0)
+    // stack:                range, x, y
+    SWAP2
+    // stack:                y, x, range
+    DUP2 
+    // stack:           x  , y, x, range
+    DUP1  DUP1  MULFP254  MULFP254
+    // stack:           x^3, y, x, range
+    PUSH 3  ADDFP254
+    // stack:       3 + x^3, y, x, range
+    DUP2
+    // stack:  y  , 3 + x^3, y, x, range
+    DUP1  MULFP254
+    // stack:  y^2, 3 + x^3, y, x, range
+    EQ
+    // stack:         curve, y, x, range
+    SWAP2
+    // stack:         x, y, curve, range
+    %ec_isidentity
+    // stack:       ident , curve, range
+    SWAP2
+    // stack:       range , curve, ident
+    AND
+    // stack:       range & curve, ident
    OR
-    // stack: y^2 % N == (x^3 + 3) % N & (x < N) & (y < N) || (x,y)==(0,0)
+    // stack:                   is_valid
 %endmacro

 // Check if (x,y)==(0,0)
 %macro ec_isidentity
-    // stack: x, y
+    // stack: x , y
    OR
    // stack: x | y
    ISZERO
--- a/evm/src/cpu/kernel/asm/curve/bn254/field_arithmetic/moddiv.asm
+++ b/evm/src/cpu/kernel/asm/curve/bn254/field_arithmetic/moddiv.asm
@ -1,4 +1,4 @@
-/// Division modulo 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47, the BN254 base field order
+/// Division modulo the BN254 prime

 // Returns y * (x^-1) where the inverse is taken modulo N
 %macro divfp254