Twisted Edwards curves operations #1949
Conversation
querolita
force-pushed
the
feature/eddsa/twisted
branch
from
b741643 to
576725d
Compare
| toBigint({ x, y }: Point) { | ||
| let x_ = Field3.toBigint(x); | ||
| let y_ = Field3.toBigint(y); | ||
| return { x: x_, y: y_, infinity: x_ === 0n && y_ === 1n }; |
There was a problem hiding this comment.
I created an equivalent Point type (elliptic-curve also has it) with the difference that the infinity is not always set to false as it is the case in the other gadgets.
| let witnesses = exists(12, () => { | ||
| let [x1_, x2_, y1_, y2_] = Field3.toBigints(x1, x2, y1, y2); | ||
|
|
||
| // TODO: reuse code in twistedAdd to avoid recomputing these |
There was a problem hiding this comment.
This would be a nice feature and much cleaner code, but apparently this wouldn't be a trivial refactor at all. Ideas for the future: inspiration from the interpreter structure in o1vm?
| * TODO: could use lookups for picking precomputed multiples, instead of O(2^c) provable switch | ||
| * TODO: custom bit representation for the scalar that avoids 0, to get rid of the degenerate addition case | ||
| */ | ||
| function multiScalarMul( |
There was a problem hiding this comment.
basically the difference between this function and the counterpart in elliptic-curve.ts is that the Curve is a CurveTwisted instead of an affine curve. I don't know if making this more generic would be a good idea, maybe we want to have a specific implementation for each curve instead of parameterizing it. Open to suggestions (similar concerns arise in other functions of this interface as well).
|
Since twisted curve addition is complete, there's a lot of complexity in the scalar multiplication code around handling zeros that could be removed. E.g. you don't need the initial aggregator point, and you can just return the result instead of asserting it to be zero or non-zero |
|
@mitschabaude Oh that makes sense, I will look into it and clean the algorithm for twisted msm. |
This PR is the twisted counterpart of the operations found in
/src/lib/provable/gadgets/elliptic-curve.ts. It is a necessary step to support EdDSA, which uses the twisted curve Ed25519. Related to o1-labs/o1js-bindings#317.