From b6deaf24fe95da3d13eef7c449709be17baca6f5 Mon Sep 17 00:00:00 2001 From: Youssef El Housni Date: Fri, 20 Dec 2024 16:24:18 -0500 Subject: [PATCH 1/3] perf(bn254): PairingCheck saves ExpByU --- std/algebra/emulated/sw_bn254/hints.go | 139 +++++++++++++++- std/algebra/emulated/sw_bn254/pairing.go | 157 +++++++++++++++++- std/algebra/emulated/sw_bn254/pairing_test.go | 41 +++++ 3 files changed, 325 insertions(+), 12 deletions(-) diff --git a/std/algebra/emulated/sw_bn254/hints.go b/std/algebra/emulated/sw_bn254/hints.go index c73329d82..4e60fc4a7 100644 --- a/std/algebra/emulated/sw_bn254/hints.go +++ b/std/algebra/emulated/sw_bn254/hints.go @@ -17,10 +17,142 @@ func init() { func GetHints() []solver.Hint { return []solver.Hint{ millerLoopAndCheckFinalExpHint, + pairingCheckHint, finalExpHint, } } +func pairingCheckHint(nativeMod *big.Int, nativeInputs, nativeOutputs []*big.Int) error { + // This follows section 4.3.2 of https://eprint.iacr.org/2024/640.pdf + return emulated.UnwrapHint(nativeInputs, nativeOutputs, + func(mod *big.Int, inputs, outputs []*big.Int) error { + var tmp, x3, cubicNonResiduePower, x, millerLoop, residueWitness, residueWitnessInv, one, root27thOf1 bn254.E12 + var exp1, exp2, rInv, mInv big.Int + var P bn254.G1Affine + var Q bn254.G2Affine + n := len(inputs) + p := make([]bn254.G1Affine, 0, n/6) + q := make([]bn254.G2Affine, 0, n/6) + for k := 0; k < n/6+1; k += 2 { + P.X.SetBigInt(inputs[k]) + P.Y.SetBigInt(inputs[k+1]) + p = append(p, P) + } + for k := n / 3; k < n/2+3; k += 4 { + Q.X.A0.SetBigInt(inputs[k]) + Q.X.A1.SetBigInt(inputs[k+1]) + Q.Y.A0.SetBigInt(inputs[k+2]) + Q.Y.A1.SetBigInt(inputs[k+3]) + q = append(q, Q) + } + + lines := make([][2][len(bn254.LoopCounter)]bn254.LineEvaluationAff, 0, len(q)) + for _, qi := range q { + lines = append(lines, bn254.PrecomputeLines(qi)) + } + millerLoop, err := bn254.MillerLoopFixedQ(p, lines) + if err != nil { + return err + } + + // exp1 = (p^12-1)/3 + exp1.SetString("4030969696062745741797811005853058291874379204406359442560681893891674450106959530046539719647151210908190211459382793062006703141168852426020468083171325367934590379984666859998399967609544754664110191464072930598755441160008826659219834762354786403012110463250131961575955268597858015384895449311534622125256548620283853223733396368939858981844663598065852816056384933498610930035891058807598891752166582271931875150099691598048016175399382213304673796601585080509443902692818733420199004555566113537482054218823936116647313678747500267068559627206777530424029211671772692598157901876223857571299238046741502089890557442500582300718504160740314926185458079985126192563953772118929726791041828902047546977272656240744693339962973939047279285351052107950250121751682659529260304162131862468322644288196213423232132152125277136333208005221619443705106431645884840489295409272576227859206166894626854018093044908314720", 10) + // root27thOf1 = (0, c010, c011, 0, 0, 0, 0, 0, 0, 0, 0, 0) + // is a 27-th root of unity which is necessarily a cubic non-residue + // since h/r = (p^12-1)/r = 27·l and 3 does not divide l. + // it was computed as w^((p^12-1)/27) = c2 * w^2 + c8 * w^8 where + // Fp12 = Fp[w]/w^12-18w^6+82 which is isomorphic to our Fp12 tower + // then c010 = (c2 + 9 * c8) % p and c011 = c8 + root27thOf1.C0.B1.A0.SetString("9483667112135124394372960210728142145589475128897916459350428495526310884707") + root27thOf1.C0.B1.A1.SetString("4534159768373982659291990808346042891252278737770656686799127720849666919525") + + if one.Exp(millerLoop, &exp1).IsOne() { + // residueWitness = millerLoop is a cubic residue + cubicNonResiduePower.SetOne() + residueWitness.Set(&millerLoop) + } else if one.Exp(*millerLoop.Mul(&millerLoop, &root27thOf1), &exp1).IsOne() { + // residueWitness = millerLoop * root27thOf1 is a cubic residue + cubicNonResiduePower.Set(&root27thOf1) + residueWitness.Set(&millerLoop) + } else { + // residueWitness = millerLoop * root27thOf1^2 is a cubic residue + cubicNonResiduePower.Square(&root27thOf1) + residueWitness.Mul(&millerLoop, &root27thOf1) + } + + // 1. compute r-th root: + // Exponentiate to rInv where + // rInv = 1/r mod (p^12-1)/r + rInv.SetString("495819184011867778744231927046742333492451180917315223017345540833046880485481720031136878341141903241966521818658471092566752321606779256340158678675679238405722886654128392203338228575623261160538734808887996935946888297414610216445334190959815200956855428635568184508263913274453942864817234480763055154719338281461936129150171789463489422401982681230261920147923652438266934726901346095892093443898852488218812468761027620988447655860644584419583586883569984588067403598284748297179498734419889699245081714359110559679136004228878808158639412436468707589339209058958785568729925402190575720856279605832146553573981587948304340677613460685405477047119496887534881410757668344088436651291444274840864486870663164657544390995506448087189408281061890434467956047582679858345583941396130713046072603335601764495918026585155498301896749919393", 10) + residueWitness.Exp(residueWitness, &rInv) + + // 2. compute m-th root: + // where m = (6x + 2 + q^3 - q^2 + q)/(3r) + // Exponentiate to mInv where + // mInv = 1/m mod p^12-1 + mInv.SetString("17840267520054779749190587238017784600702972825655245554504342129614427201836516118803396948809179149954197175783449826546445899524065131269177708416982407215963288737761615699967145070776364294542559324079147363363059480104341231360692143673915822421222230661528586799190306058519400019024762424366780736540525310403098758015600523609594113357130678138304964034267260758692953579514899054295817541844330584721967571697039986079722203518034173581264955381924826388858518077894154909963532054519350571947910625755075099598588672669612434444513251495355121627496067454526862754597351094345783576387352673894873931328099247263766690688395096280633426669535619271711975898132416216382905928886703963310231865346128293216316379527200971959980873989485521004596686352787540034457467115536116148612884807380187255514888720048664139404687086409399", 10) + residueWitness.Exp(residueWitness, &mInv) + + // 3. compute cube root: + // since gcd(3, (p^12-1)/r) ≠ 1 we use a modified Toneelli-Shanks algorithm + // see Alg.4 of https://eprint.iacr.org/2024/640.pdf + // Typo in the paper: p^k-1 = 3^n * s instead of p-1 = 3^r * s + // where k=12 and n=3 here and exp2 = (s+1)/3 + residueWitnessInv.Inverse(&residueWitness) + exp2.SetString("149295173928249842288807815031594751550902933496531831205951181255247201855813315927649619246190785589192230054051214557852100116339587126889646966043382421034614458517950624444385183985538694617189266350521219651805757080000326913304438324531658755667115202342597480058368713651772519088329461085612393412046538837788290860138273939590365147475728281409846400594680923462911515927255224400281440435265428973034513894448136725853630228718495637529802733207466114092942366766400693830377740909465411612499335341437923559875826432546203713595131838044695464089778859691547136762894737106526809539677749557286722299625576201574095640767352005953344997266128077036486155280146436004404804695964512181557316554713802082990544197776406442186936269827816744738898152657469728130713344598597476387715653492155415311971560450078713968012341037230430349766855793764662401499603533676762082513303932107208402000670112774382027", 10) + x.Exp(residueWitness, &exp2) + + // 3^t is ord(x^3 / residueWitness) + x3.Square(&x).Mul(&x3, &x).Mul(&x3, &residueWitnessInv) + t := 0 + for !x3.IsOne() { + t++ + tmp.Square(&x3) + x3.Mul(&tmp, &x3) + } + + for t != 0 { + x.Mul(&x, tmp.Exp(root27thOf1, &exp2)) + + // 3^t is ord(x^3 / residueWitness) + x3.Square(&x).Mul(&x3, &x).Mul(&x3, &residueWitnessInv) + t = 0 + for !x3.IsOne() { + t++ + tmp.Square(&x3) + x3.Mul(&tmp, &x3) + } + } + + // x is now the cube root of residueWitness + residueWitness.Set(&x) + + residueWitness.C0.B0.A0.BigInt(outputs[0]) + residueWitness.C0.B0.A1.BigInt(outputs[1]) + residueWitness.C0.B1.A0.BigInt(outputs[2]) + residueWitness.C0.B1.A1.BigInt(outputs[3]) + residueWitness.C0.B2.A0.BigInt(outputs[4]) + residueWitness.C0.B2.A1.BigInt(outputs[5]) + residueWitness.C1.B0.A0.BigInt(outputs[6]) + residueWitness.C1.B0.A1.BigInt(outputs[7]) + residueWitness.C1.B1.A0.BigInt(outputs[8]) + residueWitness.C1.B1.A1.BigInt(outputs[9]) + residueWitness.C1.B2.A0.BigInt(outputs[10]) + residueWitness.C1.B2.A1.BigInt(outputs[11]) + + // we also need to return the cubic non-residue power + cubicNonResiduePower.C0.B0.A0.BigInt(outputs[12]) + cubicNonResiduePower.C0.B0.A1.BigInt(outputs[13]) + cubicNonResiduePower.C0.B1.A0.BigInt(outputs[14]) + cubicNonResiduePower.C0.B1.A1.BigInt(outputs[15]) + cubicNonResiduePower.C0.B2.A0.BigInt(outputs[16]) + cubicNonResiduePower.C0.B2.A1.BigInt(outputs[17]) + + return nil + }) + +} + func millerLoopAndCheckFinalExpHint(nativeMod *big.Int, nativeInputs, nativeOutputs []*big.Int) error { // This follows section 4.3.2 of https://eprint.iacr.org/2024/640.pdf return emulated.UnwrapHint(nativeInputs, nativeOutputs, @@ -136,7 +268,6 @@ func millerLoopAndCheckFinalExpHint(nativeMod *big.Int, nativeInputs, nativeOutp // x is now the cube root of residueWitness residueWitness.Set(&x) - residueWitnessInv.Inverse(&residueWitness) residueWitness.C0.B0.A0.BigInt(outputs[0]) residueWitness.C0.B0.A1.BigInt(outputs[1]) @@ -275,12 +406,6 @@ func finalExpHint(nativeMod *big.Int, nativeInputs, nativeOutputs []*big.Int) er cubicNonResiduePower.C0.B1.A1.BigInt(outputs[15]) cubicNonResiduePower.C0.B2.A0.BigInt(outputs[16]) cubicNonResiduePower.C0.B2.A1.BigInt(outputs[17]) - cubicNonResiduePower.C1.B0.A0.BigInt(outputs[18]) - cubicNonResiduePower.C1.B0.A1.BigInt(outputs[19]) - cubicNonResiduePower.C1.B1.A0.BigInt(outputs[20]) - cubicNonResiduePower.C1.B1.A1.BigInt(outputs[21]) - cubicNonResiduePower.C1.B2.A0.BigInt(outputs[22]) - cubicNonResiduePower.C1.B2.A1.BigInt(outputs[23]) return nil }) diff --git a/std/algebra/emulated/sw_bn254/pairing.go b/std/algebra/emulated/sw_bn254/pairing.go index a66755246..f741f83c1 100644 --- a/std/algebra/emulated/sw_bn254/pairing.go +++ b/std/algebra/emulated/sw_bn254/pairing.go @@ -148,7 +148,7 @@ func (pr Pairing) FinalExponentiation(e *GTEl) *GTEl { func (pr Pairing) AssertFinalExponentiationIsOne(a *GTEl) { tower := pr.Ext12.ToTower(a) - res, err := pr.curveF.NewHint(finalExpHint, 24, tower[0], tower[1], tower[2], tower[3], tower[4], tower[5], tower[6], tower[7], tower[8], tower[9], tower[10], tower[11]) + res, err := pr.curveF.NewHint(finalExpHint, 18, tower[0], tower[1], tower[2], tower[3], tower[4], tower[5], tower[6], tower[7], tower[8], tower[9], tower[10], tower[11]) if err != nil { // err is non-nil only for invalid number of inputs panic(err) @@ -211,13 +211,160 @@ func (pr Pairing) AssertFinalExponentiationIsOne(a *GTEl) { // // This function doesn't check that the inputs are in the correct subgroups. See AssertIsOnG1 and AssertIsOnG2. func (pr Pairing) PairingCheck(P []*G1Affine, Q []*G2Affine) error { - f, err := pr.MillerLoop(P, Q) + // check input size match + nP := len(P) + nQ := len(Q) + if nP == 0 || nP != nQ { + return nil + } + // hint the non-residue witness + inputs := make([]*baseEl, 0, 2*nP+4*nQ) + for _, p := range P { + inputs = append(inputs, &p.X, &p.Y) + } + for _, q := range Q { + inputs = append(inputs, &q.P.X.A0, &q.P.X.A1, &q.P.Y.A0, &q.P.Y.A1) + } + hint, err := pr.curveF.NewHint(pairingCheckHint, 18, inputs...) if err != nil { - return err + // err is non-nil only for invalid number of inputs + panic(err) + } + residueWitness := pr.Ext12.FromTower([12]*baseEl{hint[0], hint[1], hint[2], hint[3], hint[4], hint[5], hint[6], hint[7], hint[8], hint[9], hint[10], hint[11]}) + + // constrain cubicNonResiduePower to be in Fp6 + // that is: a100=a101=a110=a111=a120=a121=0 + // or + // A0 = a000 - 9 * a001 + // A1 = 0 + // A2 = a010 - 9 * a011 + // A3 = 0 + // A4 = a020 - 9 * a021 + // A5 = 0 + // A6 = a001 + // A7 = 0 + // A8 = a011 + // A9 = 0 + // A10 = a021 + // A11 = 0 + nine := big.NewInt(9) + cubicNonResiduePower := GTEl{ + A0: *pr.curveF.Sub(hint[12], pr.curveF.MulConst(hint[13], nine)), + A1: *pr.curveF.Zero(), + A2: *pr.curveF.Sub(hint[14], pr.curveF.MulConst(hint[15], nine)), + A3: *pr.curveF.Zero(), + A4: *pr.curveF.Sub(hint[16], pr.curveF.MulConst(hint[17], nine)), + A5: *pr.curveF.Zero(), + A6: *hint[13], + A7: *pr.curveF.Zero(), + A8: *hint[15], + A9: *pr.curveF.Zero(), + A10: *hint[17], + A11: *pr.curveF.Zero(), + } + + lines := make([]lineEvaluations, nQ) + for i := range Q { + if Q[i].Lines == nil { + Qlines := pr.computeLines(&Q[i].P) + Q[i].Lines = &Qlines + } + lines[i] = *Q[i].Lines + } + + // precomputations + yInv := make([]*baseEl, nP) + xNegOverY := make([]*baseEl, nP) + for k := 0; k < nP; k++ { + // P are supposed to be on G1 respectively of prime order r. + // The point (x,0) is of order 2. But this function does not check + // subgroup membership. + yInv[k] = pr.curveF.Inverse(&P[k].Y) + xNegOverY[k] = pr.curveF.Mul(&P[k].X, yInv[k]) + xNegOverY[k] = pr.curveF.Neg(xNegOverY[k]) } - pr.AssertFinalExponentiationIsOne(f) + // init Miller loop accumulator to residueWitnessInv to share the squarings + // of residueWitnessInv^{6x₀+2} + residueWitnessInv := pr.Ext12.Inverse(residueWitness) + res := residueWitnessInv + + // Compute f_{6x₀+2,Q}(P) + for i := 64; i >= 0; i-- { + res = pr.Ext12.Square(res) + + switch loopCounter[i] { + case 0: + for k := 0; k < nP; k++ { + res = pr.MulBy01379( + res, + pr.Ext2.MulByElement(&lines[k][0][i].R0, xNegOverY[k]), + pr.Ext2.MulByElement(&lines[k][0][i].R1, yInv[k]), + ) + } + case 1: + // multiply by residueWitnessInv when bit=1 + res = pr.Ext12.Mul(res, residueWitnessInv) + // ℓ × ℓ + for k := 0; k < nP; k++ { + prodLines := pr.Mul01379By01379( + pr.Ext2.MulByElement(&lines[k][0][i].R0, xNegOverY[k]), + pr.Ext2.MulByElement(&lines[k][0][i].R1, yInv[k]), + pr.Ext2.MulByElement(&lines[k][1][i].R0, xNegOverY[k]), + pr.Ext2.MulByElement(&lines[k][1][i].R1, yInv[k]), + ) + // (ℓ × ℓ) × res + res = pr.Ext12.MulBy012346789(res, prodLines) + } + case -1: + // multiply by residueWitness when bit=-1 + res = pr.Ext12.Mul(res, residueWitness) + for k := 0; k < nP; k++ { + // ℓ × ℓ + prodLines := pr.Mul01379By01379( + pr.Ext2.MulByElement(&lines[k][0][i].R0, xNegOverY[k]), + pr.Ext2.MulByElement(&lines[k][0][i].R1, yInv[k]), + pr.Ext2.MulByElement(&lines[k][1][i].R0, xNegOverY[k]), + pr.Ext2.MulByElement(&lines[k][1][i].R1, yInv[k]), + ) + // (ℓ × ℓ) × res + res = pr.Ext12.MulBy012346789(res, prodLines) + } + default: + panic(fmt.Sprintf("invalid loop counter value %d", loopCounter[i])) + } + } + + // Compute ℓ_{[6x₀+2]Q,π(Q)}(P) · ℓ_{[6x₀+2]Q+π(Q),-π²(Q)}(P) + // lines evaluations at P + // and ℓ × ℓ + for k := 0; k < nP; k++ { + prodLines := pr.Mul01379By01379( + pr.Ext2.MulByElement(&lines[k][0][65].R0, xNegOverY[k]), + pr.Ext2.MulByElement(&lines[k][0][65].R1, yInv[k]), + pr.Ext2.MulByElement(&lines[k][1][65].R0, xNegOverY[k]), + pr.Ext2.MulByElement(&lines[k][1][65].R1, yInv[k]), + ) + res = pr.Ext12.MulBy012346789(res, prodLines) + } + + // Check that res * cubicNonResiduePower * residueWitnessInv^λ' == 1 + // where λ' = q^3 - q^2 + q, with u the BN254 seed + // and residueWitnessInv, cubicNonResiduePower from the hint. + // Note that res is already MillerLoop(P,Q) * residueWitnessInv^{6x₀+2} since + // we initialized the Miller loop accumulator with residueWitnessInv. + t2 := pr.Ext12.Mul(&cubicNonResiduePower, res) + + t1 := pr.FrobeniusCube(residueWitnessInv) + t0 := pr.FrobeniusSquare(residueWitness) + t1 = pr.Ext12.Mul(t1, t0) + t0 = pr.Frobenius(residueWitnessInv) + t1 = pr.Ext12.Mul(t1, t0) + + t2 = pr.Ext12.Mul(t2, t1) + + pr.AssertIsEqual(t2, pr.Ext12.One()) return nil } @@ -638,7 +785,7 @@ func (pr Pairing) millerLoopAndFinalExpResult(P *G1Affine, Q *G2Affine, previous // err is non-nil only for invalid number of inputs panic(err) } - residueWitness := pr.FromTower([12]*baseEl{hint[0], hint[1], hint[2], hint[3], hint[4], hint[5], hint[6], hint[7], hint[8], hint[9], hint[10], hint[11]}) + residueWitness := pr.Ext12.FromTower([12]*baseEl{hint[0], hint[1], hint[2], hint[3], hint[4], hint[5], hint[6], hint[7], hint[8], hint[9], hint[10], hint[11]}) // constrain cubicNonResiduePower to be in Fp6 // that is: a100=a101=a110=a111=a120=a121=0 diff --git a/std/algebra/emulated/sw_bn254/pairing_test.go b/std/algebra/emulated/sw_bn254/pairing_test.go index ae2fe87e8..43cdf46b6 100644 --- a/std/algebra/emulated/sw_bn254/pairing_test.go +++ b/std/algebra/emulated/sw_bn254/pairing_test.go @@ -38,6 +38,47 @@ type FinalExponentiation struct { Res GTEl } +type MillerLoopCircuit struct { + In1G1, In2G1 G1Affine + In1G2, In2G2 G2Affine + Res GTEl +} + +func (c *MillerLoopCircuit) Define(api frontend.API) error { + pairing, err := NewPairing(api) + if err != nil { + return fmt.Errorf("new pairing: %w", err) + } + res, err := pairing.MillerLoop([]*G1Affine{&c.In1G1, &c.In2G1}, []*G2Affine{&c.In1G2, &c.In2G2}) + if err != nil { + return fmt.Errorf("pair: %w", err) + } + pairing.AssertIsEqual(res, &c.Res) + return nil +} + +func TestMillerLoopTestSolve(t *testing.T) { + assert := test.NewAssert(t) + p1, q1 := randomG1G2Affines() + p2, q2 := randomG1G2Affines() + lines1 := bn254.PrecomputeLines(q1) + lines2 := bn254.PrecomputeLines(q2) + res, err := bn254.MillerLoopFixedQ( + []bn254.G1Affine{p1, p2}, + [][2][len(bn254.LoopCounter)]bn254.LineEvaluationAff{lines1, lines2}, + ) + assert.NoError(err) + witness := MillerLoopCircuit{ + In1G1: NewG1Affine(p1), + In1G2: NewG2Affine(q1), + In2G1: NewG1Affine(p2), + In2G2: NewG2Affine(q2), + Res: NewGTEl(res), + } + err = test.IsSolved(&MillerLoopCircuit{}, &witness, ecc.BN254.ScalarField()) + assert.NoError(err) +} + func (c *FinalExponentiation) Define(api frontend.API) error { pairing, err := NewPairing(api) if err != nil { From e02032bc4f9329fb6cff797e0c0eed2df245030a Mon Sep 17 00:00:00 2001 From: Youssef El Housni Date: Fri, 20 Dec 2024 16:54:27 -0500 Subject: [PATCH 2/3] perf(bls12-381): PairingCheck saves ExpByU --- std/algebra/emulated/sw_bls12381/hints.go | 130 +++++++++++++++++- std/algebra/emulated/sw_bls12381/pairing.go | 116 +++++++++++++++- .../emulated/sw_bls12381/pairing_test.go | 41 ++++++ std/algebra/emulated/sw_bn254/pairing_test.go | 10 +- 4 files changed, 287 insertions(+), 10 deletions(-) diff --git a/std/algebra/emulated/sw_bls12381/hints.go b/std/algebra/emulated/sw_bls12381/hints.go index 676ed3c22..3a3210869 100644 --- a/std/algebra/emulated/sw_bls12381/hints.go +++ b/std/algebra/emulated/sw_bls12381/hints.go @@ -14,7 +14,135 @@ func init() { // GetHints returns all hint functions used in the package. func GetHints() []solver.Hint { - return []solver.Hint{finalExpHint} + return []solver.Hint{ + finalExpHint, + pairingCheckHint, + } +} + +func pairingCheckHint(nativeMod *big.Int, nativeInputs, nativeOutputs []*big.Int) error { + // This is inspired from https://eprint.iacr.org/2024/640.pdf + // and based on a personal communication with the author Andrija Novakovic. + return emulated.UnwrapHint(nativeInputs, nativeOutputs, + func(mod *big.Int, inputs, outputs []*big.Int) error { + var root, rootPthInverse, root27thInverse, residueWitness, scalingFactor bls12381.E12 + var order3rd, order3rdPower, exponent, exponentInv, finalExpFactor, polyFactor big.Int + var P bls12381.G1Affine + var Q bls12381.G2Affine + n := len(inputs) + p := make([]bls12381.G1Affine, 0, n/6) + q := make([]bls12381.G2Affine, 0, n/6) + for k := 0; k < n/6+1; k += 2 { + P.X.SetBigInt(inputs[k]) + P.Y.SetBigInt(inputs[k+1]) + p = append(p, P) + } + for k := n / 3; k < n/2+3; k += 4 { + Q.X.A0.SetBigInt(inputs[k]) + Q.X.A1.SetBigInt(inputs[k+1]) + Q.Y.A0.SetBigInt(inputs[k+2]) + Q.Y.A1.SetBigInt(inputs[k+3]) + q = append(q, Q) + } + + lines := make([][2][len(bls12381.LoopCounter) - 1]bls12381.LineEvaluationAff, 0, len(q)) + for _, qi := range q { + lines = append(lines, bls12381.PrecomputeLines(qi)) + } + millerLoop, err := bls12381.MillerLoopFixedQ(p, lines) + if err != nil { + return err + } + millerLoop.Conjugate(&millerLoop) + + // polyFactor = (1-x)/3 + polyFactor.SetString("5044125407647214251", 10) + // finalExpFactor = ((q^12 - 1) / r) / (27 * polyFactor) + finalExpFactor.SetString("2366356426548243601069753987687709088104621721678962410379583120840019275952471579477684846670499039076873213559162845121989217658133790336552276567078487633052653005423051750848782286407340332979263075575489766963251914185767058009683318020965829271737924625612375201545022326908440428522712877494557944965298566001441468676802477524234094954960009227631543471415676620753242466901942121887152806837594306028649150255258504417829961387165043999299071444887652375514277477719817175923289019181393803729926249507024121957184340179467502106891835144220611408665090353102353194448552304429530104218473070114105759487413726485729058069746063140422361472585604626055492939586602274983146215294625774144156395553405525711143696689756441298365274341189385646499074862712688473936093315628166094221735056483459332831845007196600723053356837526749543765815988577005929923802636375670820616189737737304893769679803809426304143627363860243558537831172903494450556755190448279875942974830469855835666815454271389438587399739607656399812689280234103023464545891697941661992848552456326290792224091557256350095392859243101357349751064730561345062266850238821755009430903520645523345000326783803935359711318798844368754833295302563158150573540616830138810935344206231367357992991289265295323280", 10) + + // 1. get pth-root inverse + exponent.Mul(&finalExpFactor, big.NewInt(27)) + root.Exp(millerLoop, &exponent) + if root.IsOne() { + rootPthInverse.SetOne() + } else { + exponentInv.ModInverse(&exponent, &polyFactor) + exponent.Neg(&exponentInv).Mod(&exponent, &polyFactor) + rootPthInverse.Exp(root, &exponent) + } + + // 2.1. get order of 3rd primitive root + var three big.Int + three.SetUint64(3) + exponent.Mul(&polyFactor, &finalExpFactor) + root.Exp(millerLoop, &exponent) + if root.IsOne() { + order3rdPower.SetUint64(0) + } + root.Exp(root, &three) + if root.IsOne() { + order3rdPower.SetUint64(1) + } + root.Exp(root, &three) + if root.IsOne() { + order3rdPower.SetUint64(2) + } + root.Exp(root, &three) + if root.IsOne() { + order3rdPower.SetUint64(3) + } + + // 2.2. get 27th root inverse + if order3rdPower.Uint64() == 0 { + root27thInverse.SetOne() + } else { + order3rd.Exp(&three, &order3rdPower, nil) + exponent.Mul(&polyFactor, &finalExpFactor) + root.Exp(millerLoop, &exponent) + exponentInv.ModInverse(&exponent, &order3rd) + exponent.Neg(&exponentInv).Mod(&exponent, &order3rd) + root27thInverse.Exp(root, &exponent) + } + + // 2.3. shift the Miller loop result so that millerLoop * scalingFactor + // is of order finalExpFactor + scalingFactor.Mul(&rootPthInverse, &root27thInverse) + millerLoop.Mul(&millerLoop, &scalingFactor) + + // 3. get the witness residue + // + // lambda = q - u, the optimal exponent + var lambda big.Int + lambda.SetString("4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129030796414117214202539", 10) + exponent.ModInverse(&lambda, &finalExpFactor) + residueWitness.Exp(millerLoop, &exponent) + + // return the witness residue + residueWitness.C0.B0.A0.BigInt(outputs[0]) + residueWitness.C0.B0.A1.BigInt(outputs[1]) + residueWitness.C0.B1.A0.BigInt(outputs[2]) + residueWitness.C0.B1.A1.BigInt(outputs[3]) + residueWitness.C0.B2.A0.BigInt(outputs[4]) + residueWitness.C0.B2.A1.BigInt(outputs[5]) + residueWitness.C1.B0.A0.BigInt(outputs[6]) + residueWitness.C1.B0.A1.BigInt(outputs[7]) + residueWitness.C1.B1.A0.BigInt(outputs[8]) + residueWitness.C1.B1.A1.BigInt(outputs[9]) + residueWitness.C1.B2.A0.BigInt(outputs[10]) + residueWitness.C1.B2.A1.BigInt(outputs[11]) + + // return the scaling factor + scalingFactor.C0.B0.A0.BigInt(outputs[12]) + scalingFactor.C0.B0.A1.BigInt(outputs[13]) + scalingFactor.C0.B1.A0.BigInt(outputs[14]) + scalingFactor.C0.B1.A1.BigInt(outputs[15]) + scalingFactor.C0.B2.A0.BigInt(outputs[16]) + scalingFactor.C0.B2.A1.BigInt(outputs[17]) + + return nil + + }) + } func finalExpHint(nativeMod *big.Int, nativeInputs, nativeOutputs []*big.Int) error { diff --git a/std/algebra/emulated/sw_bls12381/pairing.go b/std/algebra/emulated/sw_bls12381/pairing.go index 76798f42e..93943ec05 100644 --- a/std/algebra/emulated/sw_bls12381/pairing.go +++ b/std/algebra/emulated/sw_bls12381/pairing.go @@ -100,14 +100,122 @@ func (pr Pairing) Pair(P []*G1Affine, Q []*G2Affine) (*GTEl, error) { // // This function doesn't check that the inputs are in the correct subgroups. func (pr Pairing) PairingCheck(P []*G1Affine, Q []*G2Affine) error { - f, err := pr.MillerLoop(P, Q) + // check input size match + nP := len(P) + nQ := len(Q) + if nP == 0 || nP != nQ { + return nil + } + // hint the non-residue witness + inputs := make([]*baseEl, 0, 2*nP+4*nQ) + for _, p := range P { + inputs = append(inputs, &p.X, &p.Y) + } + for _, q := range Q { + inputs = append(inputs, &q.P.X.A0, &q.P.X.A1, &q.P.Y.A0, &q.P.Y.A1) + } + hint, err := pr.curveF.NewHint(pairingCheckHint, 18, inputs...) if err != nil { - return err + // err is non-nil only for invalid number of inputs + panic(err) + } + residueWitness := pr.FromTower([12]*baseEl{hint[0], hint[1], hint[2], hint[3], hint[4], hint[5], hint[6], hint[7], hint[8], hint[9], hint[10], hint[11]}) + // constrain cubicNonResiduePower to be in Fp6 + // that is: a100=a101=a110=a111=a120=a121=0 + // or + // A0 = a000 - a001 + // A1 = 0 + // A2 = a010 - a011 + // A3 = 0 + // A4 = a020 - a021 + // A5 = 0 + // A6 = a001 + // A7 = 0 + // A8 = a011 + // A9 = 0 + // A10 = a021 + // A11 = 0 + scalingFactor := GTEl{ + A0: *pr.curveF.Sub(hint[12], hint[13]), + A1: *pr.curveF.Zero(), + A2: *pr.curveF.Sub(hint[14], hint[15]), + A3: *pr.curveF.Zero(), + A4: *pr.curveF.Sub(hint[16], hint[17]), + A5: *pr.curveF.Zero(), + A6: *hint[13], + A7: *pr.curveF.Zero(), + A8: *hint[15], + A9: *pr.curveF.Zero(), + A10: *hint[17], + A11: *pr.curveF.Zero(), } - pr.AssertFinalExponentiationIsOne(f) + lines := make([]lineEvaluations, nQ) + for i := range Q { + if Q[i].Lines == nil { + Qlines := pr.computeLines(&Q[i].P) + Q[i].Lines = &Qlines + } + lines[i] = *Q[i].Lines + } + // precomputations + yInv := make([]*baseEl, nP) + xNegOverY := make([]*baseEl, nP) + + for k := 0; k < nP; k++ { + // P are supposed to be on G1 respectively of prime order r. + // The point (x,0) is of order 2. But this function does not check + // subgroup membership. + yInv[k] = pr.curveF.Inverse(&P[k].Y) + xNegOverY[k] = pr.curveF.Mul(&P[k].X, yInv[k]) + xNegOverY[k] = pr.curveF.Neg(xNegOverY[k]) + } + + // init Miller loop accumulator to residueWitnessInv to share the squarings + // of residueWitnessInv^{x₀} + residueWitnessInv := pr.Ext12.Inverse(residueWitness) + res := residueWitnessInv + + // Compute ∏ᵢ { fᵢ_{x₀,Q}(P) } + for i := 62; i >= 0; i-- { + // mutualize the square among n Miller loops + // (∏ᵢfᵢ)² + res = pr.Ext12.Square(res) + + if loopCounter[i] == 0 { + for k := 0; k < nP; k++ { + res = pr.MulBy02368(res, + pr.MulByElement(&lines[k][0][i].R1, yInv[k]), + pr.MulByElement(&lines[k][0][i].R0, xNegOverY[k]), + ) + } + } else { + // multiply by residueWitnessInv when bit=1 + res = pr.Ext12.Mul(res, residueWitnessInv) + for k := 0; k < nP; k++ { + res = pr.MulBy02368(res, + pr.MulByElement(&lines[k][0][i].R1, yInv[k]), + pr.MulByElement(&lines[k][0][i].R0, xNegOverY[k]), + ) + res = pr.MulBy02368(res, + pr.MulByElement(&lines[k][1][i].R1, yInv[k]), + pr.MulByElement(&lines[k][1][i].R0, xNegOverY[k]), + ) + } + } + } + + // Check that res * scalingFactor == residueWitness^(q) + // where u=-0xd201000000010000 is the BLS12-381 seed, + // and residueWitness, scalingFactor from the hint. + // Note that res is already MillerLoop(P,Q) * residueWitnessInv^{-x₀} since + // we initialized the Miller loop accumulator with residueWitnessInv. + t0 := pr.Frobenius(residueWitness) + t1 := pr.Ext12.Mul(res, &scalingFactor) + + pr.AssertIsEqual(t0, t1) return nil } @@ -312,7 +420,7 @@ func (pr Pairing) FinalExponentiation(e *GTEl) *GTEl { func (pr Pairing) AssertFinalExponentiationIsOne(x *GTEl) { tower := pr.ToTower(x) - res, err := pr.curveF.NewHint(finalExpHint, 24, tower[0], tower[1], tower[2], tower[3], tower[4], tower[5], tower[6], tower[7], tower[8], tower[9], tower[10], tower[11]) + res, err := pr.curveF.NewHint(finalExpHint, 18, tower[0], tower[1], tower[2], tower[3], tower[4], tower[5], tower[6], tower[7], tower[8], tower[9], tower[10], tower[11]) if err != nil { // err is non-nil only for invalid number of inputs panic(err) diff --git a/std/algebra/emulated/sw_bls12381/pairing_test.go b/std/algebra/emulated/sw_bls12381/pairing_test.go index 30cbb14a0..7020c3240 100644 --- a/std/algebra/emulated/sw_bls12381/pairing_test.go +++ b/std/algebra/emulated/sw_bls12381/pairing_test.go @@ -33,6 +33,47 @@ func randomG1G2Affines() (bls12381.G1Affine, bls12381.G2Affine) { return p, q } +type MillerLoopCircuit struct { + In1G1, In2G1 G1Affine + In1G2, In2G2 G2Affine + Res GTEl +} + +func (c *MillerLoopCircuit) Define(api frontend.API) error { + pairing, err := NewPairing(api) + if err != nil { + return fmt.Errorf("new pairing: %w", err) + } + res, err := pairing.MillerLoop([]*G1Affine{&c.In1G1, &c.In2G1}, []*G2Affine{&c.In1G2, &c.In2G2}) + if err != nil { + return fmt.Errorf("pair: %w", err) + } + pairing.AssertIsEqual(res, &c.Res) + return nil +} + +func TestMillerLoopTestSolve(t *testing.T) { + assert := test.NewAssert(t) + p1, q1 := randomG1G2Affines() + p2, q2 := randomG1G2Affines() + lines1 := bls12381.PrecomputeLines(q1) + lines2 := bls12381.PrecomputeLines(q2) + res, err := bls12381.MillerLoopFixedQ( + []bls12381.G1Affine{p1, p2}, + [][2][len(bls12381.LoopCounter) - 1]bls12381.LineEvaluationAff{lines1, lines2}, + ) + assert.NoError(err) + witness := MillerLoopCircuit{ + In1G1: NewG1Affine(p1), + In1G2: NewG2Affine(q1), + In2G1: NewG1Affine(p2), + In2G2: NewG2Affine(q2), + Res: NewGTEl(res), + } + err = test.IsSolved(&MillerLoopCircuit{}, &witness, ecc.BN254.ScalarField()) + assert.NoError(err) +} + type FinalExponentiationCircuit struct { InGt GTEl Res GTEl diff --git a/std/algebra/emulated/sw_bn254/pairing_test.go b/std/algebra/emulated/sw_bn254/pairing_test.go index 43cdf46b6..70e97c975 100644 --- a/std/algebra/emulated/sw_bn254/pairing_test.go +++ b/std/algebra/emulated/sw_bn254/pairing_test.go @@ -33,11 +33,6 @@ func randomG1G2Affines() (bn254.G1Affine, bn254.G2Affine) { return p, q } -type FinalExponentiation struct { - InGt GTEl - Res GTEl -} - type MillerLoopCircuit struct { In1G1, In2G1 G1Affine In1G2, In2G2 G2Affine @@ -79,6 +74,11 @@ func TestMillerLoopTestSolve(t *testing.T) { assert.NoError(err) } +type FinalExponentiation struct { + InGt GTEl + Res GTEl +} + func (c *FinalExponentiation) Define(api frontend.API) error { pairing, err := NewPairing(api) if err != nil { From 2a0dc3e3e4ef2e378a0f7d1fde92db4552c63b1f Mon Sep 17 00:00:00 2001 From: Youssef El Housni Date: Thu, 9 Jan 2025 12:59:07 -0500 Subject: [PATCH 3/3] perf(bls12-377): PairingCheck saves ExpByU --- std/algebra/emulated/sw_bls12381/pairing.go | 2 +- std/algebra/native/sw_bls12377/hints.go | 85 ++++++++++++++ std/algebra/native/sw_bls12377/pairing.go | 124 +++++++++++++++++--- std/algebra/native/sw_bls12377/pairing2.go | 17 +-- 4 files changed, 198 insertions(+), 30 deletions(-) diff --git a/std/algebra/emulated/sw_bls12381/pairing.go b/std/algebra/emulated/sw_bls12381/pairing.go index 93943ec05..0d8cf81b1 100644 --- a/std/algebra/emulated/sw_bls12381/pairing.go +++ b/std/algebra/emulated/sw_bls12381/pairing.go @@ -104,7 +104,7 @@ func (pr Pairing) PairingCheck(P []*G1Affine, Q []*G2Affine) error { nP := len(P) nQ := len(Q) if nP == 0 || nP != nQ { - return nil + return errors.New("invalid inputs sizes") } // hint the non-residue witness inputs := make([]*baseEl, 0, 2*nP+4*nQ) diff --git a/std/algebra/native/sw_bls12377/hints.go b/std/algebra/native/sw_bls12377/hints.go index 6a993b909..519e577b9 100644 --- a/std/algebra/native/sw_bls12377/hints.go +++ b/std/algebra/native/sw_bls12377/hints.go @@ -18,6 +18,7 @@ func GetHints() []solver.Hint { scalarMulGLVG1Hint, halfGCDEisenstein, halfGCDEisensteinSigns, + pairingCheckHint, } } @@ -25,6 +26,90 @@ func init() { solver.RegisterHint(GetHints()...) } +func pairingCheckHint(scalarField *big.Int, inputs, outputs []*big.Int) error { + var P bls12377.G1Affine + var Q bls12377.G2Affine + n := len(inputs) + p := make([]bls12377.G1Affine, 0, n/6) + q := make([]bls12377.G2Affine, 0, n/6) + for k := 0; k < n/6+1; k += 2 { + P.X.SetBigInt(inputs[k]) + P.Y.SetBigInt(inputs[k+1]) + p = append(p, P) + } + for k := n / 3; k < n/2+3; k += 4 { + Q.X.A0.SetBigInt(inputs[k]) + Q.X.A1.SetBigInt(inputs[k+1]) + Q.Y.A0.SetBigInt(inputs[k+2]) + Q.Y.A1.SetBigInt(inputs[k+3]) + q = append(q, Q) + } + + lines := make([][2][len(bls12377.LoopCounter) - 1]bls12377.LineEvaluationAff, 0, len(q)) + for _, qi := range q { + lines = append(lines, bls12377.PrecomputeLines(qi)) + } + millerLoop, err := bls12377.MillerLoopFixedQ(p, lines) + if err != nil { + return err + } + + var root, rootPthInverse, residueWitness, scalingFactor bls12377.E12 + var exponent, exponentInv, finalExpFactor, polyFactor big.Int + // polyFactor = 12(x-1) + polyFactor.SetString("115033474957087604736", 10) + // finalExpFactor = ((q^12 - 1) / r) / polyFactor + finalExpFactor.SetString("92351561334497520756349650336409370070948672672207914824247073415859727964231807559847070685040742345026775319680739143654748316009031763764029886042408725311062057776702838555815712331129279611544378217895455619058809454575474763035923260395518532422855090028311239234310116353269618927871828693919559964406939845784130633021661399269804065961999062695977580539176029238189119059338698461832966347603096853909366901376879505972606045770762516580639801134008192256366142553202619529638202068488750102055204336502584141399828818871664747496033599618827160583206926869573005874449182200210044444351826855938563862937638034918413235278166699461287943529570559518592586872860190313088429391521694808994276205429071153237122495989095857292965461625387657577981811772819764071512345106346232882471034669258055302790607847924560040527682025558360106509628206144255667203317787586698694011876342903106644003067103035176245790275561392007119121995936066014208972135762663107247939004517852248103325700169848524693333524025685325993207375736519358185783520948988673594976115901587076295116293065682366935313875411927779217584729138600463438806153265891176654957439524358472291492028580820575807385461119025678550977847392818655362610734928283105671242634809807533919011078145", 10) + + // 1. get pth-root inverse + exponent.Set(&finalExpFactor) + root.Exp(millerLoop, &finalExpFactor) + if root.IsOne() { + rootPthInverse.SetOne() + } else { + exponentInv.ModInverse(&exponent, &polyFactor) + exponent.Neg(&exponentInv).Mod(&exponent, &polyFactor) + rootPthInverse.Exp(root, &exponent) + } + + // 3. shift the Miller loop result so that millerLoop * scalingFactor + // is of order finalExpFactor + scalingFactor.Set(&rootPthInverse) + millerLoop.Mul(&millerLoop, &scalingFactor) + + // 4. get the witness residue + // + // lambda = q - u, the optimal exponent + var lambda big.Int + lambda.SetString("258664426012969094010652733694893533536393512754914660539884262666720468348340822774968888139563774001527230824448", 10) + exponent.ModInverse(&lambda, &finalExpFactor) + residueWitness.Exp(millerLoop, &exponent) + + // return the witness residue + residueWitness.C0.B0.A0.BigInt(outputs[0]) + residueWitness.C0.B0.A1.BigInt(outputs[1]) + residueWitness.C0.B1.A0.BigInt(outputs[2]) + residueWitness.C0.B1.A1.BigInt(outputs[3]) + residueWitness.C0.B2.A0.BigInt(outputs[4]) + residueWitness.C0.B2.A1.BigInt(outputs[5]) + residueWitness.C1.B0.A0.BigInt(outputs[6]) + residueWitness.C1.B0.A1.BigInt(outputs[7]) + residueWitness.C1.B1.A0.BigInt(outputs[8]) + residueWitness.C1.B1.A1.BigInt(outputs[9]) + residueWitness.C1.B2.A0.BigInt(outputs[10]) + residueWitness.C1.B2.A1.BigInt(outputs[11]) + + // return the scaling factor + scalingFactor.C0.B0.A0.BigInt(outputs[12]) + scalingFactor.C0.B0.A1.BigInt(outputs[13]) + scalingFactor.C0.B1.A0.BigInt(outputs[14]) + scalingFactor.C0.B1.A1.BigInt(outputs[15]) + scalingFactor.C0.B2.A0.BigInt(outputs[16]) + scalingFactor.C0.B2.A1.BigInt(outputs[17]) + + return nil +} + func decomposeScalarG1Simple(scalarField *big.Int, inputs []*big.Int, outputs []*big.Int) error { if len(inputs) != 1 { return errors.New("expecting one input") diff --git a/std/algebra/native/sw_bls12377/pairing.go b/std/algebra/native/sw_bls12377/pairing.go index c19c0fcd7..90821cc36 100644 --- a/std/algebra/native/sw_bls12377/pairing.go +++ b/std/algebra/native/sw_bls12377/pairing.go @@ -240,22 +240,118 @@ func Pair(api frontend.API, P []G1Affine, Q []G2Affine) (GT, error) { // // This function doesn't check that the inputs are in the correct subgroups func PairingCheck(api frontend.API, P []G1Affine, Q []G2Affine) error { - f, err := MillerLoop(api, P, Q) + + // check input size match + nP := len(P) + nQ := len(Q) + if nP == 0 || nP != nQ { + return errors.New("invalid inputs sizes") + } + // hint the non-residue witness + inputs := make([]frontend.Variable, 0, 2*nP+4*nQ) + for _, p := range P { + inputs = append(inputs, p.X, p.Y) + } + for _, q := range Q { + inputs = append(inputs, q.P.X.A0, q.P.X.A1, q.P.Y.A0, q.P.Y.A1) + } + hint, err := api.NewHint(pairingCheckHint, 18, inputs...) if err != nil { - return err + // err is non-nil only for invalid number of inputs + panic(err) + } + var residueWitness GT + residueWitness.C0.B0.A0 = hint[0] + residueWitness.C0.B0.A1 = hint[1] + residueWitness.C0.B1.A0 = hint[2] + residueWitness.C0.B1.A1 = hint[3] + residueWitness.C0.B2.A0 = hint[4] + residueWitness.C0.B2.A1 = hint[5] + residueWitness.C1.B0.A0 = hint[6] + residueWitness.C1.B0.A1 = hint[7] + residueWitness.C1.B1.A0 = hint[8] + residueWitness.C1.B1.A1 = hint[9] + residueWitness.C1.B2.A0 = hint[10] + residueWitness.C1.B2.A1 = hint[11] + + var scalingFactor fields_bls12377.E6 + // constrain cubicNonResiduePower to be in Fp6 + scalingFactor.B0.A0 = hint[12] + scalingFactor.B0.A1 = hint[13] + scalingFactor.B1.A0 = hint[14] + scalingFactor.B1.A1 = hint[15] + scalingFactor.B2.A0 = hint[16] + scalingFactor.B2.A1 = hint[17] + + lines := make([]lineEvaluations, nQ) + for i := range Q { + if Q[i].Lines == nil { + Qlines := computeLines(api, Q[i].P) + Q[i].Lines = Qlines + } + lines[i] = *Q[i].Lines } - // We perform the easy part of the final exp to push f to the cyclotomic - // subgroup so that AssertFinalExponentiationIsOne is carried with optimized - // cyclotomic squaring (e.g. Karabina12345). - // - // f = f^(p⁶-1)(p²+1) - var buf GT - buf.Conjugate(api, f) - buf.DivUnchecked(api, buf, f) - f.FrobeniusSquare(api, buf). - Mul(api, f, buf) - - f.AssertFinalExponentiationIsOne(api) + + // precomputations + yInv := make([]frontend.Variable, nP) + xNegOverY := make([]frontend.Variable, nP) + for k := 0; k < nP; k++ { + yInv[k] = api.DivUnchecked(1, P[k].Y) + xNegOverY[k] = api.Mul(P[k].X, yInv[k]) + xNegOverY[k] = api.Neg(xNegOverY[k]) + } + + // init Miller loop accumulator to residueWitness to share the squarings + // of residueWitness^{x₀} + res := residueWitness + + var prodLines [5]fields_bls12377.E2 + var l0, l1 lineEvaluation + + // Compute ∏ᵢ { fᵢ_{x₀,Q}(P) } + for i := 62; i >= 0; i-- { + // mutualize the square among n Miller loops + // (∏ᵢfᵢ)² + res.Square(api, res) + + if loopCounter[i] == 0 { + for k := 0; k < nP; k++ { + // line evaluation at P + // ℓ × res + res.MulBy034(api, + *l0.R0.MulByFp(api, lines[k][0][i].R0, xNegOverY[k]), + *l0.R1.MulByFp(api, lines[k][0][i].R1, yInv[k]), + ) + } + } else { + // multiply by residueWitness when bit=1 + res.Mul(api, res, residueWitness) + for k := 0; k < nP; k++ { + // lines evaluation at P + // ℓ × ℓ + prodLines = *fields_bls12377.Mul034By034(api, + *l0.R0.MulByFp(api, lines[k][0][i].R0, xNegOverY[k]), + *l0.R1.MulByFp(api, lines[k][0][i].R1, yInv[k]), + *l1.R0.MulByFp(api, lines[k][1][i].R0, xNegOverY[k]), + *l1.R1.MulByFp(api, lines[k][1][i].R1, yInv[k]), + ) + // (ℓ × ℓ) × res + res.MulBy01234(api, prodLines) + } + } + } + + // Check that res * scalingFactor == residueWitness^(q) + // where u=0x8508c00000000001 is the BLS12-377 seed, + // and residueWitness, scalingFactor from the hint. + // Note that res is already MillerLoop(P,Q) * residueWitness^{x₀} since + // we initialized the Miller loop accumulator with residueWitness. + var t0, t1 GT + t1.C0.Mul(api, res.C0, scalingFactor) + t1.C1.Mul(api, res.C1, scalingFactor) + t0.Frobenius(api, residueWitness) + + t0.AssertIsEqual(api, t1) return nil } diff --git a/std/algebra/native/sw_bls12377/pairing2.go b/std/algebra/native/sw_bls12377/pairing2.go index d76daab6d..92bd5396b 100644 --- a/std/algebra/native/sw_bls12377/pairing2.go +++ b/std/algebra/native/sw_bls12377/pairing2.go @@ -313,21 +313,8 @@ func (p *Pairing) PairingCheck(P []*G1Affine, Q []*G2Affine) error { for i := range Q { inQ[i] = *Q[i] } - res, err := MillerLoop(p.api, inP, inQ) - if err != nil { - return err - } - // We perform the easy part of the final exp to push res to the cyclotomic - // subgroup so that AssertFinalExponentiationIsOne is carried with optimized - // cyclotomic squaring (e.g. Karabina12345). - // - // res = res^(p⁶-1)(p²+1) - var buf GT - buf.Conjugate(p.api, res) - buf.DivUnchecked(p.api, buf, res) - res.FrobeniusSquare(p.api, buf).Mul(p.api, res, buf) - - res.AssertFinalExponentiationIsOne(p.api) + PairingCheck(p.api, inP, inQ) + return nil }