diff --git a/ecdsa/src/curve/glv.rs b/ecdsa/src/curve/glv.rs index aeeb463e..8859d904 100644 --- a/ecdsa/src/curve/glv.rs +++ b/ecdsa/src/curve/glv.rs @@ -31,6 +31,10 @@ const A2: Secp256K1Scalar = Secp256K1Scalar([6323353552219852760, 14980988506747 const B2: Secp256K1Scalar = Secp256K1Scalar([16747920425669159701, 3496713202691238861, 0, 0]); +/// Algorithm 15.41 in Handbook of Elliptic and Hyperelliptic Curve Cryptography. +/// Decompose a scalar `k` into two small scalars `k1, k2` with `|k1|, |k2| < √p` that satisfy +/// `k1 + s * k2 = k`. +/// Returns `(|k1|, |k2|, k1 < 0, k2 < 0)`. pub fn decompose_secp256k1_scalar( k: Secp256K1Scalar, ) -> (Secp256K1Scalar, Secp256K1Scalar, bool, bool) { @@ -71,12 +75,12 @@ pub fn decompose_secp256k1_scalar( (k1, k2, k1_neg, k2_neg) } +/// See Section 15.2.1 in Handbook of Elliptic and Hyperelliptic Curve Cryptography. +/// GLV scalar multiplication `k * P = k1 * P + k2 * psi(P)`, where `k = k1 + s * k2` is the +/// decomposition computed in `decompose_secp256k1_scalar(k)` and `psi` is the Secp256k1 +/// endomorphism `psi: (x, y) |-> (beta * x, y)` equivalent to scalar multiplication by `s`. pub fn glv_mul(p: ProjectivePoint, k: Secp256K1Scalar) -> ProjectivePoint { let (k1, k2, k1_neg, k2_neg) = decompose_secp256k1_scalar(k); - /*let one = Secp256K1Scalar::ONE; - let m1 = if k1_neg { -one } else { one }; - let m2 = if k2_neg { -one } else { one }; - assert!(k1 * m1 + S * k2 * m2 == k);*/ let p_affine = p.to_affine(); let sp = AffinePoint:: { diff --git a/ecdsa/src/gadgets/biguint.rs b/ecdsa/src/gadgets/biguint.rs index 0c08814c..25dab656 100644 --- a/ecdsa/src/gadgets/biguint.rs +++ b/ecdsa/src/gadgets/biguint.rs @@ -272,12 +272,11 @@ pub fn witness_get_biguint_target, F: PrimeField>( witness: &W, bt: BigUintTarget, ) -> BigUint { - let base = BigUint::from(1usize << 32); bt.limbs .into_iter() .rev() .fold(BigUint::zero(), |acc, limb| { - acc * &base + witness.get_target(limb.0).to_canonical_biguint() + (acc << 32) + witness.get_target(limb.0).to_canonical_biguint() }) } diff --git a/plonky2/src/plonk/circuit_builder.rs b/plonky2/src/plonk/circuit_builder.rs index 721797bd..8e2f2e10 100644 --- a/plonky2/src/plonk/circuit_builder.rs +++ b/plonky2/src/plonk/circuit_builder.rs @@ -70,7 +70,7 @@ pub struct CircuitBuilder, const D: usize> { marked_targets: Vec>, /// Generators used to generate the witness. - pub generators: Vec>>, + generators: Vec>>, constants_to_targets: HashMap, targets_to_constants: HashMap, @@ -150,7 +150,6 @@ impl, const D: usize> CircuitBuilder { /// generate the final witness (a grid of wire values), these virtual targets will go away. pub fn add_virtual_target(&mut self) -> Target { let index = self.virtual_target_index; - self.virtual_target_index += 1; Target::VirtualTarget { index } }