Documentation
¶
Overview ¶
Package sw_bw6761 implements G1 and G2 arithmetics and pairing computation over BW6-761 curve.
The implementation follows Housni22: "Pairings in Rank-1 Constraint Systems" and BW6-761-hackmd.
Index ¶
- type BaseField
- type G1Affine
- type G2Affine
- type GTEl
- type Pairing
- func (pr Pairing) AssertIsEqual(x, y *GTEl)
- func (pr Pairing) FinalExponentiation(z *GTEl) *GTEl
- func (pr Pairing) MillerLoop(P []*G1Affine, Q []*G2Affine) (*GTEl, error)
- func (pr Pairing) Pair(P []*G1Affine, Q []*G2Affine) (*GTEl, error)
- func (pr Pairing) PairingCheck(P []*G1Affine, Q []*G2Affine) error
- type Scalar
- type ScalarField
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BaseField ¶
BaseField is the emulated.FieldParams impelementation of the curve base field.
type G1Affine ¶
type G1Affine = sw_emulated.AffinePoint[BaseField]
G1Affine is the point in G1. It is an alias to the generic emulated affine point.
func NewG1Affine ¶
NewG1Affine allocates a witness from the native G1 element and returns it.
type G2Affine ¶
type G2Affine struct {
P g2AffP
Lines *lineEvaluations
}
G2Affine represents G2 element with optional embedded line precomputations.
func NewG2Affine ¶
NewG2Affine returns the witness of v without precomputations. In case of pairing the precomputation will be done in-circuit.
func NewG2AffineFixed ¶
NewG2AffineFixed returns witness of v with precomputations for efficient pairing computation.
func NewG2AffineFixedPlaceholder ¶
func NewG2AffineFixedPlaceholder() G2Affine
NewG2AffineFixedPlaceholder returns a placeholder for the circuit compilation when witness will be given with line precomputations using NewG2AffineFixed.
type Pairing ¶
type Pairing struct {
*fields_bw6761.Ext6
// contains filtered or unexported fields
}
Example ¶
package main
import (
"crypto/rand"
"fmt"
"github.com/airchains-network/gnark/backend/groth16"
"github.com/airchains-network/gnark/frontend"
"github.com/airchains-network/gnark/frontend/cs/r1cs"
"github.com/airchains-network/gnark/std/algebra/emulated/sw_bw6761"
"github.com/consensys/gnark-crypto/ecc"
bw6761 "github.com/consensys/gnark-crypto/ecc/bw6-761"
)
type PairCircuit struct {
InG1 sw_bw6761.G1Affine
InG2 sw_bw6761.G2Affine
Res sw_bw6761.GTEl
}
func (c *PairCircuit) Define(api frontend.API) error {
pairing, err := sw_bw6761.NewPairing(api)
if err != nil {
return fmt.Errorf("new pairing: %w", err)
}
// Pair method does not check that the points are in the proper groups.
// Compute the pairing
res, err := pairing.Pair([]*sw_bw6761.G1Affine{&c.InG1}, []*sw_bw6761.G2Affine{&c.InG2})
if err != nil {
return fmt.Errorf("pair: %w", err)
}
pairing.AssertIsEqual(res, &c.Res)
return nil
}
func main() {
p, q, err := randomG1G2Affines()
if err != nil {
panic(err)
}
res, err := bw6761.Pair([]bw6761.G1Affine{p}, []bw6761.G2Affine{q})
if err != nil {
panic(err)
}
circuit := PairCircuit{}
witness := PairCircuit{
InG1: sw_bw6761.NewG1Affine(p),
InG2: sw_bw6761.NewG2Affine(q),
Res: sw_bw6761.NewGTEl(res),
}
ccs, err := frontend.Compile(ecc.BN254.ScalarField(), r1cs.NewBuilder, &circuit)
if err != nil {
panic(err)
}
pk, vk, err := groth16.Setup(ccs)
if err != nil {
panic(err)
}
secretWitness, err := frontend.NewWitness(&witness, ecc.BN254.ScalarField())
if err != nil {
panic(err)
}
publicWitness, err := secretWitness.Public()
if err != nil {
panic(err)
}
proof, err := groth16.Prove(ccs, pk, secretWitness)
if err != nil {
panic(err)
}
err = groth16.Verify(proof, vk, publicWitness)
if err != nil {
panic(err)
}
}
func randomG1G2Affines() (p bw6761.G1Affine, q bw6761.G2Affine, err error) {
_, _, G1AffGen, G2AffGen := bw6761.Generators()
mod := bw6761.ID.ScalarField()
s1, err := rand.Int(rand.Reader, mod)
if err != nil {
return p, q, err
}
s2, err := rand.Int(rand.Reader, mod)
if err != nil {
return p, q, err
}
p.ScalarMultiplication(&G1AffGen, s1)
q.ScalarMultiplication(&G2AffGen, s2)
return
}
Output:
func (Pairing) AssertIsEqual ¶
func (Pairing) FinalExponentiation ¶
FinalExponentiation computes the exponentiation zᵈ where
d = (p⁶-1)/r = (p⁶-1)/Φ₆(p) ⋅ Φ₆(p)/r = (p³-1)(p+1)(p²-p+1)/r
we use instead d = s⋅(p³-1)(p+1)(p²-p+1)/r where s is the cofactor (x₀+1)
func (Pairing) MillerLoop ¶
MillerLoop computes the optimal Tate multi-Miller loop (or twisted ate or Eta revisited)
∏ᵢ { fᵢ_{x₀+1+λ(x₀³-x₀²-x₀),Qᵢ}(Pᵢ) }
Alg.2 in https://eprint.iacr.org/2021/1359.pdf Eq. (6') in https://hackmd.io/@gnark/BW6-761-changes
type Scalar ¶
type Scalar = emulated.Element[ScalarField]
Scalar is the scalar in the groups. It is an alias to the emulated element defined over the scalar field of the groups.
type ScalarField ¶
ScalarField is the emulated.FieldParams impelementation of the curve scalar field.
Source Files