Documentation ¶
Overview ¶
Package bls24317 efficient elliptic curve, pairing and hash to curve implementation for bls24-317.
bls24-317: A Barreto--Lynn--Scott curve
embedding degree k=24 seed x₀=3640754176 𝔽r: r=30869589236456844204538189757527902584594726589286811523515204428962673459201 (x₀^8-x₀^4+2) 𝔽p: p=136393071104295911515099765908274057061945112121419593977210139303905973197232025618026156731051 ((x₀-1)² ⋅ r(x₀)/3+x₀) (E/𝔽p): Y²=X³+4 (Eₜ/𝔽p⁴): Y² = X³+4v (M-type twist) r ∣ #E(Fp) and r ∣ #Eₜ(𝔽p⁴)
Extension fields tower:
𝔽p²[u] = 𝔽p/u²+1 𝔽p⁴[v] = 𝔽p²/v²-u-1 𝔽p¹²[w] = 𝔽p⁴/w³-v 𝔽p²⁴[i] = 𝔽p¹²/i²-w
optimal Ate loop size:
x₀
Security: estimated 160-bit level following [https://eprint.iacr.org/2019/885.pdf] (r is 255 bits and p²⁴ is 7599 bits)
Warning ¶
This code has not been audited and is provided as-is. In particular, there is no security guarantees such as constant time implementation or side-channel attack resistance.
Index ¶
- Constants
- Variables
- func CurveCoefficients() (a, b fp.Element)
- func Generators() (g1Jac G1Jac, g2Jac G2Jac, g1Aff G1Affine, g2Aff G2Affine)
- func NoSubgroupChecks() func(*Decoder)
- func PairingCheck(P []G1Affine, Q []G2Affine) (bool, error)
- func PairingCheckFixedQ(P []G1Affine, lines [][2][len(LoopCounter) - 1]LineEvaluationAff) (bool, error)
- func PrecomputeLines(Q G2Affine) (PrecomputedLines [2][len(LoopCounter) - 1]LineEvaluationAff)
- func RawEncoding() func(*Encoder)
- type Decoder
- type Encoder
- type G1Affine
- func BatchJacobianToAffineG1(points []G1Jac) []G1Affine
- func BatchScalarMultiplicationG1(base *G1Affine, scalars []fr.Element) []G1Affine
- func EncodeToG1(msg, dst []byte) (G1Affine, error)
- func HashToG1(msg, dst []byte) (G1Affine, error)
- func MapToCurve1(u *fp.Element) G1Affine
- func MapToG1(u fp.Element) G1Affine
- func (p *G1Affine) Add(a, b *G1Affine) *G1Affine
- func (p *G1Affine) Bytes() (res [SizeOfG1AffineCompressed]byte)
- func (p *G1Affine) ClearCofactor(a *G1Affine) *G1Affine
- func (p *G1Affine) Double(a *G1Affine) *G1Affine
- func (p *G1Affine) Equal(a *G1Affine) bool
- func (p *G1Affine) Fold(points []G1Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G1Affine, error)
- func (p *G1Affine) FromJacobian(p1 *G1Jac) *G1Affine
- func (p *G1Affine) IsInSubGroup() bool
- func (p *G1Affine) IsInfinity() bool
- func (p *G1Affine) IsOnCurve() bool
- func (p *G1Affine) Marshal() []byte
- func (p *G1Affine) MultiExp(points []G1Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G1Affine, error)
- func (p *G1Affine) Neg(a *G1Affine) *G1Affine
- func (p *G1Affine) RawBytes() (res [SizeOfG1AffineUncompressed]byte)
- func (p *G1Affine) ScalarMultiplication(a *G1Affine, s *big.Int) *G1Affine
- func (p *G1Affine) ScalarMultiplicationBase(s *big.Int) *G1Affine
- func (p *G1Affine) Set(a *G1Affine) *G1Affine
- func (p *G1Affine) SetBytes(buf []byte) (int, error)
- func (p *G1Affine) String() string
- func (p *G1Affine) Sub(a, b *G1Affine) *G1Affine
- func (p *G1Affine) Unmarshal(buf []byte) error
- type G1Jac
- func (p *G1Jac) AddAssign(q *G1Jac) *G1Jac
- func (p *G1Jac) AddMixed(a *G1Affine) *G1Jac
- func (p *G1Jac) ClearCofactor(q *G1Jac) *G1Jac
- func (p *G1Jac) Double(q *G1Jac) *G1Jac
- func (p *G1Jac) DoubleAssign() *G1Jac
- func (p *G1Jac) DoubleMixed(a *G1Affine) *G1Jac
- func (p *G1Jac) Equal(q *G1Jac) bool
- func (p *G1Jac) Fold(points []G1Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G1Jac, error)
- func (p *G1Jac) FromAffine(a *G1Affine) *G1Jac
- func (p *G1Jac) IsInSubGroup() bool
- func (p *G1Jac) IsOnCurve() bool
- func (p *G1Jac) JointScalarMultiplication(a1, a2 *G1Affine, s1, s2 *big.Int) *G1Jac
- func (p *G1Jac) JointScalarMultiplicationBase(a *G1Affine, s1, s2 *big.Int) *G1Jac
- func (p *G1Jac) MultiExp(points []G1Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G1Jac, error)
- func (p *G1Jac) Neg(q *G1Jac) *G1Jac
- func (p *G1Jac) ScalarMultiplication(q *G1Jac, s *big.Int) *G1Jac
- func (p *G1Jac) ScalarMultiplicationBase(s *big.Int) *G1Jac
- func (p *G1Jac) Set(q *G1Jac) *G1Jac
- func (p *G1Jac) String() string
- func (p *G1Jac) SubAssign(q *G1Jac) *G1Jac
- type G2Affine
- func (p *G2Affine) Add(a, b *G2Affine) *G2Affine
- func (p *G2Affine) Bytes() (res [SizeOfG2AffineCompressed]byte)
- func (p *G2Affine) ClearCofactor(a *G2Affine) *G2Affine
- func (p *G2Affine) Double(a *G2Affine) *G2Affine
- func (p *G2Affine) Equal(a *G2Affine) bool
- func (p *G2Affine) Fold(points []G2Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G2Affine, error)
- func (p *G2Affine) FromJacobian(p1 *G2Jac) *G2Affine
- func (p *G2Affine) IsInSubGroup() bool
- func (p *G2Affine) IsInfinity() bool
- func (p *G2Affine) IsOnCurve() bool
- func (p *G2Affine) Marshal() []byte
- func (p *G2Affine) MultiExp(points []G2Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G2Affine, error)
- func (p *G2Affine) Neg(a *G2Affine) *G2Affine
- func (p *G2Affine) RawBytes() (res [SizeOfG2AffineUncompressed]byte)
- func (p *G2Affine) ScalarMultiplication(a *G2Affine, s *big.Int) *G2Affine
- func (p *G2Affine) ScalarMultiplicationBase(s *big.Int) *G2Affine
- func (p *G2Affine) Set(a *G2Affine) *G2Affine
- func (p *G2Affine) SetBytes(buf []byte) (int, error)
- func (p *G2Affine) String() string
- func (p *G2Affine) Sub(a, b *G2Affine) *G2Affine
- func (p *G2Affine) Unmarshal(buf []byte) error
- type G2Jac
- func (p *G2Jac) AddAssign(q *G2Jac) *G2Jac
- func (p *G2Jac) AddMixed(a *G2Affine) *G2Jac
- func (p *G2Jac) ClearCofactor(q *G2Jac) *G2Jac
- func (p *G2Jac) Double(q *G2Jac) *G2Jac
- func (p *G2Jac) DoubleAssign() *G2Jac
- func (p *G2Jac) DoubleMixed(a *G2Affine) *G2Jac
- func (p *G2Jac) Equal(q *G2Jac) bool
- func (p *G2Jac) Fold(points []G2Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G2Jac, error)
- func (p *G2Jac) FromAffine(a *G2Affine) *G2Jac
- func (p *G2Jac) IsInSubGroup() bool
- func (p *G2Jac) IsOnCurve() bool
- func (p *G2Jac) MultiExp(points []G2Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G2Jac, error)
- func (p *G2Jac) Neg(q *G2Jac) *G2Jac
- func (p *G2Jac) ScalarMultiplication(q *G2Jac, s *big.Int) *G2Jac
- func (p *G2Jac) ScalarMultiplicationBase(s *big.Int) *G2Jac
- func (p *G2Jac) Set(q *G2Jac) *G2Jac
- func (p *G2Jac) String() string
- func (p *G2Jac) SubAssign(q *G2Jac) *G2Jac
- type GT
- func FinalExponentiation(z *GT, _z ...*GT) GT
- func MillerLoop(P []G1Affine, Q []G2Affine) (GT, error)
- func MillerLoopFixedQ(P []G1Affine, lines [][2][len(LoopCounter) - 1]LineEvaluationAff) (GT, error)
- func Pair(P []G1Affine, Q []G2Affine) (GT, error)
- func PairFixedQ(P []G1Affine, lines [][2][len(LoopCounter) - 1]LineEvaluationAff) (GT, error)
- type LineEvaluationAff
Constants ¶
const ID = ecc.BLS24_317
ID bls317 ID
const SizeOfG1AffineCompressed = 40
SizeOfG1AffineCompressed represents the size in bytes that a G1Affine need in binary form, compressed
const SizeOfG1AffineUncompressed = SizeOfG1AffineCompressed * 2
SizeOfG1AffineUncompressed represents the size in bytes that a G1Affine need in binary form, uncompressed
const SizeOfG2AffineCompressed = 40 * 4
SizeOfG2AffineCompressed represents the size in bytes that a G2Affine need in binary form, compressed
const SizeOfG2AffineUncompressed = SizeOfG2AffineCompressed * 2
SizeOfG2AffineUncompressed represents the size in bytes that a G2Affine need in binary form, uncompressed
const SizeOfGT = fptower.SizeOfGT
SizeOfGT represents the size in bytes that a GT element need in binary form
Variables ¶
var ( ErrInvalidInfinityEncoding = errors.New("invalid infinity point encoding") ErrInvalidEncoding = errors.New("invalid point encoding") )
var LoopCounter [33]int8
optimal Ate loop counter
Functions ¶
func CurveCoefficients ¶ added in v0.10.0
CurveCoefficients returns the a, b coefficients of the curve equation.
func Generators ¶
Generators return the generators of the r-torsion group, resp. in ker(pi-id), ker(Tr)
func NoSubgroupChecks ¶
func NoSubgroupChecks() func(*Decoder)
NoSubgroupChecks returns an option to use in NewDecoder(...) which disable subgroup checks on the points the decoder will read. Use with caution, as crafted points from an untrusted source can lead to crypto-attacks.
func PairingCheck ¶
PairingCheck calculates the reduced pairing for a set of points and returns True if the result is One ∏ᵢ e(Pᵢ, Qᵢ) =? 1
This function doesn't check that the inputs are in the correct subgroup. See IsInSubGroup.
func PairingCheckFixedQ ¶ added in v0.13.0
func PairingCheckFixedQ(P []G1Affine, lines [][2][len(LoopCounter) - 1]LineEvaluationAff) (bool, error)
PairingCheckFixedQ calculates the reduced pairing for a set of points and returns True if the result is One ∏ᵢ e(Pᵢ, Qᵢ) =? 1 where Q are fixed points in G2.
This function doesn't check that the inputs are in the correct subgroup. See IsInSubGroup.
func PrecomputeLines ¶ added in v0.13.0
func PrecomputeLines(Q G2Affine) (PrecomputedLines [2][len(LoopCounter) - 1]LineEvaluationAff)
PrecomputeLines precomputes the lines for the fixed-argument Miller loop
func RawEncoding ¶
func RawEncoding() func(*Encoder)
RawEncoding returns an option to use in NewEncoder(...) which sets raw encoding mode to true points will not be compressed using this option
Types ¶
type Decoder ¶
type Decoder struct {
// contains filtered or unexported fields
}
Decoder reads bls24-317 object values from an inbound stream
func NewDecoder ¶
NewDecoder returns a binary decoder supporting curve bls24-317 objects in both compressed and uncompressed (raw) forms
type Encoder ¶
type Encoder struct {
// contains filtered or unexported fields
}
Encoder writes bls24-317 object values to an output stream
func NewEncoder ¶
NewEncoder returns a binary encoder supporting curve bls24-317 objects
func (*Encoder) BytesWritten ¶
BytesWritten return total bytes written on writer
type G1Affine ¶
G1Affine is a point in affine coordinates (x,y)
func BatchJacobianToAffineG1 ¶
BatchJacobianToAffineG1 converts points in Jacobian coordinates to Affine coordinates performing a single field inversion using the Montgomery batch inversion trick.
func BatchScalarMultiplicationG1 ¶
BatchScalarMultiplicationG1 multiplies the same base by all scalars and return resulting points in affine coordinates uses a simple windowed-NAF-like multiplication algorithm.
func EncodeToG1 ¶
EncodeToG1 hashes a message to a point on the G1 curve using the SSWU map. It is faster than HashToG1, but the result is not uniformly distributed. Unsuitable as a random oracle. dst stands for "domain separation tag", a string unique to the construction using the hash function https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#roadmap
func HashToG1 ¶
HashToG1 hashes a message to a point on the G1 curve using the SSWU map. Slower than EncodeToG1, but usable as a random oracle. dst stands for "domain separation tag", a string unique to the construction using the hash function https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#roadmap
func MapToCurve1 ¶ added in v0.11.0
https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#name-simplified-swu-method MapToCurve1 implements the SSWU map No cofactor clearing or isogeny
func (*G1Affine) Add ¶
Add adds two points in affine coordinates. It uses the Jacobian addition with a.Z=b.Z=1 and converts the result to affine coordinates.
https://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-mmadd-2007-bl
func (*G1Affine) Bytes ¶
func (p *G1Affine) Bytes() (res [SizeOfG1AffineCompressed]byte)
Bytes returns binary representation of p will store X coordinate in regular form and a parity bit we follow the BLS12-381 style encoding as specified in ZCash and now IETF
The most significant bit, when set, indicates that the point is in compressed form. Otherwise, the point is in uncompressed form.
The second-most significant bit indicates that the point is at infinity. If this bit is set, the remaining bits of the group element's encoding should be set to zero.
The third-most significant bit is set if (and only if) this point is in compressed form and it is not the point at infinity and its y-coordinate is the lexicographically largest of the two associated with the encoded x-coordinate.
func (*G1Affine) ClearCofactor ¶
ClearCofactor maps a point in curve to r-torsion
func (*G1Affine) Double ¶ added in v0.11.0
Double doubles a point in affine coordinates. It converts the point to Jacobian coordinates, doubles it using Jacobian addition with a.Z=1, and converts it back to affine coordinates.
http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-mdbl-2007-bl
func (*G1Affine) Fold ¶ added in v0.14.0
func (p *G1Affine) Fold(points []G1Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G1Affine, error)
Fold computes the multi-exponentiation \sum_{i=0}^{len(points)-1} points[i] * combinationCoeff^i and stores the result in p. It returns error in case configuration is invalid.
func (*G1Affine) FromJacobian ¶
FromJacobian converts a point p1 from Jacobian to affine coordinates.
func (*G1Affine) IsInSubGroup ¶
IsInSubGroup returns true if the affine point p is in the correct subgroup, false otherwise.
func (*G1Affine) IsInfinity ¶
IsInfinity checks if the affine point p is infinity, which is encoded as (0,0). N.B.: (0,0) is never on the curve for j=0 curves (Y²=X³+B).
func (*G1Affine) MultiExp ¶
func (p *G1Affine) MultiExp(points []G1Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G1Affine, error)
MultiExp implements section 4 of https://eprint.iacr.org/2012/549.pdf
This call return an error if len(scalars) != len(points) or if provided config is invalid.
func (*G1Affine) RawBytes ¶
func (p *G1Affine) RawBytes() (res [SizeOfG1AffineUncompressed]byte)
RawBytes returns binary representation of p (stores X and Y coordinate) see Bytes() for a compressed representation
func (*G1Affine) ScalarMultiplication ¶
ScalarMultiplication computes and returns p = [s]a where p and a are affine points.
func (*G1Affine) ScalarMultiplicationBase ¶ added in v0.9.1
ScalarMultiplicationBase computes and returns p = [s]g where g is the affine point generating the prime subgroup.
func (*G1Affine) SetBytes ¶
SetBytes sets p from binary representation in buf and returns number of consumed bytes
bytes in buf must match either RawBytes() or Bytes() output
if buf is too short io.ErrShortBuffer is returned
if buf contains compressed representation (output from Bytes()) and we're unable to compute the Y coordinate (i.e the square root doesn't exist) this function returns an error
this check if the resulting point is on the curve and in the correct subgroup
func (*G1Affine) String ¶
String returns the string representation E(x,y) of the affine point p or "O" if it is infinity.
type G1Jac ¶
G1Jac is a point in Jacobian coordinates (x=X/Z², y=Y/Z³)
func (*G1Jac) AddAssign ¶
AddAssign sets p to p+a in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
func (*G1Jac) AddMixed ¶
AddMixed sets p to p+a in Jacobian coordinates, where a.Z = 1.
http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-madd-2007-bl
func (*G1Jac) ClearCofactor ¶
ClearCofactor maps a point in E(Fp) to E(Fp)[r]
func (*G1Jac) Double ¶
Double sets p to [2]q in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2007-bl
func (*G1Jac) DoubleAssign ¶
DoubleAssign doubles p in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2007-bl
func (*G1Jac) DoubleMixed ¶ added in v0.13.0
Double sets p to [2]q in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2007-bl
func (*G1Jac) Fold ¶ added in v0.14.0
func (p *G1Jac) Fold(points []G1Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G1Jac, error)
Fold computes the multi-exponentiation \sum_{i=0}^{len(points)-1} points[i] * combinationCoeff^i and stores the result in p. It returns error in case configuration is invalid.
func (*G1Jac) FromAffine ¶
FromAffine converts a point a from affine to Jacobian coordinates.
func (*G1Jac) IsInSubGroup ¶
Z[r,0]+Z[-lambdaG1Affine, 1] is the kernel of (u,v)->u+lambdaG1Affinev mod r. Expressing r, lambdaG1Affine as polynomials in x, a short vector of this Zmodule is 1, x⁴. So we check that p+x⁴ϕ(p) is the infinity.
func (*G1Jac) JointScalarMultiplication ¶ added in v0.13.0
JointScalarMultiplication computes [s1]a1+[s2]a2 using Strauss-Shamir technique where a1 and a2 are affine points.
func (*G1Jac) JointScalarMultiplicationBase ¶ added in v0.9.1
JointScalarMultiplicationBase computes [s1]g+[s2]a using Straus-Shamir technique where g is the prime subgroup generator.
func (*G1Jac) MultiExp ¶
func (p *G1Jac) MultiExp(points []G1Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G1Jac, error)
MultiExp implements section 4 of https://eprint.iacr.org/2012/549.pdf
This call return an error if len(scalars) != len(points) or if provided config is invalid.
func (*G1Jac) ScalarMultiplication ¶
ScalarMultiplication computes and returns p = [s]a where p and a are Jacobian points. using the GLV technique. see https://www.iacr.org/archive/crypto2001/21390189.pdf
func (*G1Jac) ScalarMultiplicationBase ¶ added in v0.13.0
ScalarMultiplicationBase computes and returns p = [s]g where g is the prime subgroup generator.
type G2Affine ¶
G2Affine is a point in affine coordinates (x,y)
func BatchScalarMultiplicationG2 ¶
BatchScalarMultiplicationG2 multiplies the same base by all scalars and return resulting points in affine coordinates uses a simple windowed-NAF-like multiplication algorithm.
func EncodeToG2 ¶
EncodeToG2 maps an fp.Element to a point on the curve using the Shallue and van de Woestijne map https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-06#section-2.2.2
func HashToG2 ¶
HashToG2 maps an fp.Element to a point on the curve using the Shallue and van de Woestijne map https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-06#section-3
func MapToCurve2 ¶ added in v0.11.0
https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-06#section-4.1 Shallue and van de Woestijne method, works for any elliptic curve in Weierstrass curve
func MapToG2 ¶
MapToG2 maps an fp.Element to a point on the curve using the Shallue and van de Woestijne map https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-06#section-2.2.1
func RandomOnG2 ¶ added in v0.14.0
RandomOnG2 produces a random point in G2 using standard map-to-curve methods, which means the relative discrete log of the generated point with respect to the canonical generator is not known.
func (*G2Affine) Add ¶
Add adds two points in affine coordinates. It uses the Jacobian addition with a.Z=b.Z=1 and converts the result to affine coordinates.
https://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-mmadd-2007-bl
func (*G2Affine) Bytes ¶
func (p *G2Affine) Bytes() (res [SizeOfG2AffineCompressed]byte)
Bytes returns binary representation of p will store X coordinate in regular form and a parity bit we follow the BLS12-381 style encoding as specified in ZCash and now IETF
The most significant bit, when set, indicates that the point is in compressed form. Otherwise, the point is in uncompressed form.
The second-most significant bit indicates that the point is at infinity. If this bit is set, the remaining bits of the group element's encoding should be set to zero.
The third-most significant bit is set if (and only if) this point is in compressed form and it is not the point at infinity and its y-coordinate is the lexicographically largest of the two associated with the encoded x-coordinate.
func (*G2Affine) ClearCofactor ¶
ClearCofactor maps a point in curve to r-torsion
func (*G2Affine) Double ¶ added in v0.11.0
Double doubles a point in affine coordinates. It converts the point to Jacobian coordinates, doubles it using Jacobian addition with a.Z=1, and converts it back to affine coordinates.
http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-mdbl-2007-bl
func (*G2Affine) Fold ¶ added in v0.14.0
func (p *G2Affine) Fold(points []G2Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G2Affine, error)
Fold computes the multi-exponentiation \sum_{i=0}^{len(points)-1} points[i] * combinationCoeff^i and stores the result in p. It returns error in case configuration is invalid.
func (*G2Affine) FromJacobian ¶
FromJacobian converts a point p1 from Jacobian to affine coordinates.
func (*G2Affine) IsInSubGroup ¶
IsInSubGroup returns true if the affine point p is in the correct subgroup, false otherwise.
func (*G2Affine) IsInfinity ¶
IsInfinity checks if the affine point p is infinity, which is encoded as (0,0). N.B.: (0,0) is never on the curve for j=0 curves (Y²=X³+B).
func (*G2Affine) MultiExp ¶
func (p *G2Affine) MultiExp(points []G2Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G2Affine, error)
MultiExp implements section 4 of https://eprint.iacr.org/2012/549.pdf
This call return an error if len(scalars) != len(points) or if provided config is invalid.
func (*G2Affine) RawBytes ¶
func (p *G2Affine) RawBytes() (res [SizeOfG2AffineUncompressed]byte)
RawBytes returns binary representation of p (stores X and Y coordinate) see Bytes() for a compressed representation
func (*G2Affine) ScalarMultiplication ¶
ScalarMultiplication computes and returns p = [s]a where p and a are affine points.
func (*G2Affine) ScalarMultiplicationBase ¶ added in v0.13.0
ScalarMultiplicationBase computes and returns p = [s]g where g is the affine point generating the prime subgroup.
func (*G2Affine) SetBytes ¶
SetBytes sets p from binary representation in buf and returns number of consumed bytes
bytes in buf must match either RawBytes() or Bytes() output
if buf is too short io.ErrShortBuffer is returned
if buf contains compressed representation (output from Bytes()) and we're unable to compute the Y coordinate (i.e the square root doesn't exist) this function returns an error
this check if the resulting point is on the curve and in the correct subgroup
func (*G2Affine) String ¶
String returns the string representation E(x,y) of the affine point p or "O" if it is infinity.
type G2Jac ¶
G2Jac is a point in Jacobian coordinates (x=X/Z², y=Y/Z³)
func (*G2Jac) AddAssign ¶
AddAssign sets p to p+a in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
func (*G2Jac) AddMixed ¶
AddMixed sets p to p+a in Jacobian coordinates, where a.Z = 1.
http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-madd-2007-bl
func (*G2Jac) ClearCofactor ¶
ClearCofactor maps a point in curve to r-torsion
func (*G2Jac) Double ¶
Double sets p to [2]q in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2007-bl
func (*G2Jac) DoubleAssign ¶
DoubleAssign doubles p in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2007-bl
func (*G2Jac) DoubleMixed ¶ added in v0.13.0
Double sets p to [2]q in Jacobian coordinates.
https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2007-bl
func (*G2Jac) Fold ¶ added in v0.14.0
func (p *G2Jac) Fold(points []G2Affine, combinationCoeff fr.Element, config ecc.MultiExpConfig) (*G2Jac, error)
Fold computes the multi-exponentiation \sum_{i=0}^{len(points)-1} points[i] * combinationCoeff^i and stores the result in p. It returns error in case configuration is invalid.
func (*G2Jac) FromAffine ¶
FromAffine converts a point a from affine to Jacobian coordinates.
func (*G2Jac) IsInSubGroup ¶
IsInSubGroup returns true if p is on the r-torsion, false otherwise. https://eprint.iacr.org/2021/1130.pdf, sec.4 and https://eprint.iacr.org/2022/352.pdf, sec. 4.2 ψ(p) = [x₀]P
func (*G2Jac) MultiExp ¶
func (p *G2Jac) MultiExp(points []G2Affine, scalars []fr.Element, config ecc.MultiExpConfig) (*G2Jac, error)
MultiExp implements section 4 of https://eprint.iacr.org/2012/549.pdf
This call return an error if len(scalars) != len(points) or if provided config is invalid.
func (*G2Jac) ScalarMultiplication ¶
ScalarMultiplication computes and returns p = [s]a where p and a are Jacobian points. using the GLV technique. see https://www.iacr.org/archive/crypto2001/21390189.pdf
func (*G2Jac) ScalarMultiplicationBase ¶ added in v0.13.0
ScalarMultiplicationBase computes and returns p = [s]g where g is the prime subgroup generator.
type GT ¶
GT target group of the pairing
func FinalExponentiation ¶
FinalExponentiation computes the exponentiation (∏ᵢ zᵢ)ᵈ where d = (p²⁴-1)/r = (p²⁴-1)/Φ₂₄(p) ⋅ Φ₂₄(p)/r = (p¹²-1)(p⁴+1)(p⁸ - p⁴ +1)/r we use instead d=s ⋅ (p¹²-1)(p⁴+1)(p⁸ - p⁴ +1)/r where s is the cofactor 3 (Hayashida et al.)
func MillerLoop ¶
MillerLoop computes the multi-Miller loop ∏ᵢ MillerLoop(Pᵢ, Qᵢ) = ∏ᵢ { fᵢ_{x,Qᵢ}(Pᵢ) }
func MillerLoopFixedQ ¶ added in v0.13.0
func MillerLoopFixedQ(P []G1Affine, lines [][2][len(LoopCounter) - 1]LineEvaluationAff) (GT, error)
MillerLoopFixedQ computes the multi-Miller loop as in MillerLoop but Qᵢ are fixed points in G2 known in advance.
func Pair ¶
Pair calculates the reduced pairing for a set of points ∏ᵢ e(Pᵢ, Qᵢ).
This function doesn't check that the inputs are in the correct subgroup. See IsInSubGroup.
func PairFixedQ ¶ added in v0.13.0
func PairFixedQ(P []G1Affine, lines [][2][len(LoopCounter) - 1]LineEvaluationAff) (GT, error)
PairFixedQ calculates the reduced pairing for a set of points ∏ᵢ e(Pᵢ, Qᵢ) where Q are fixed points in G2.
This function doesn't check that the inputs are in the correct subgroup. See IsInSubGroup.
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
Package ecdsa provides ECDSA signature scheme on the bls24-317 curve.
|
Package ecdsa provides ECDSA signature scheme on the bls24-317 curve. |
Package fp contains field arithmetic operations for modulus = 0x1058ca...ab2aab.
|
Package fp contains field arithmetic operations for modulus = 0x1058ca...ab2aab. |
hash_to_field
Package htf provides hasher based on RFC 9380 Section 5.
|
Package htf provides hasher based on RFC 9380 Section 5. |
Package fr contains field arithmetic operations for modulus = 0x443f91...000001.
|
Package fr contains field arithmetic operations for modulus = 0x443f91...000001. |
fft
Package fft provides in-place discrete Fourier transform on powers-of-two subgroups of 𝔽ᵣˣ (the multiplicative group (ℤ/rℤ, x) ).
|
Package fft provides in-place discrete Fourier transform on powers-of-two subgroups of 𝔽ᵣˣ (the multiplicative group (ℤ/rℤ, x) ). |
fri
Package fri provides the FRI (multiplicative) commitment scheme.
|
Package fri provides the FRI (multiplicative) commitment scheme. |
hash_to_field
Package htf provides hasher based on RFC 9380 Section 5.
|
Package htf provides hasher based on RFC 9380 Section 5. |
iop
Package iop provides an API to computations common to iop backends (permutation, quotient).
|
Package iop provides an API to computations common to iop backends (permutation, quotient). |
mimc
Package mimc provides MiMC hash function using Miyaguchi–Preneel construction.
|
Package mimc provides MiMC hash function using Miyaguchi–Preneel construction. |
pedersen
Package pedersen allows to compute and verify Pedersen vector commitments
|
Package pedersen allows to compute and verify Pedersen vector commitments |
permutation
Package permutation provides an API to build permutation proofs.
|
Package permutation provides an API to build permutation proofs. |
plookup
Package plookup provides an API to build plookup proofs.
|
Package plookup provides an API to build plookup proofs. |
polynomial
Package polynomial provides polynomial methods and commitment schemes.
|
Package polynomial provides polynomial methods and commitment schemes. |
internal
|
|
Package kzg provides a KZG commitment scheme.
|
Package kzg provides a KZG commitment scheme. |
Package twistededwards provides bls24-317's twisted edwards "companion curve" defined on fr.
|
Package twistededwards provides bls24-317's twisted edwards "companion curve" defined on fr. |
eddsa
Package eddsa provides EdDSA signature scheme on bls24-317's twisted edwards curve.
|
Package eddsa provides EdDSA signature scheme on bls24-317's twisted edwards curve. |