-
Notifications
You must be signed in to change notification settings - Fork 362
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
40 changed files
with
615 additions
and
514 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
#pragma curve bn128 | ||
|
||
// The `a` coefficient of the twisted Edwards curve | ||
const field EDWARDS_A = 168700; | ||
|
||
// The `d` coefficient of the twisted Edwards curve | ||
const field EDWARDS_D = 168696; | ||
|
||
// The generator point | ||
const field[2] G = [ | ||
16540640123574156134436876038791482806971768689494387082833631921987005038935, // Gx | ||
20819045374670962167435360035096875258406992893633759881276124905556507972311 // Gy | ||
]; |
21 changes: 21 additions & 0 deletions
21
zokrates_stdlib/stdlib/ecc/babyjubjub/proofOfOwnership.zok
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
import "utils/pack/bool/nonStrictUnpack256" as unpack256; | ||
from "./params" import EDWARDS_A, EDWARDS_D, G; | ||
from "ecc/edwards" import scalarMul; | ||
|
||
/// Verifies match of a given public/private keypair. | ||
/// | ||
/// Checks if the following equation holds for the provided keypair: | ||
/// pk = sk*G | ||
/// where G is the chosen base point of the subgroup | ||
/// and * denotes scalar multiplication in the subgroup | ||
/// | ||
/// Arguments: | ||
/// pk: Curve point (public key) | ||
/// sk: Private key | ||
/// | ||
/// Returns true for pk/sk being a valid keypair, false otherwise. | ||
def main(field[2] pk, field sk) -> bool { | ||
bool[256] sk_bits = unpack256(sk); | ||
field[2] res = scalarMul(sk_bits, G, EDWARDS_A, EDWARDS_D); | ||
return (res[0] == pk[0] && res[1] == pk[1]); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,61 @@ | ||
// Add two points on a twisted Edwards curve | ||
// https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Addition_on_twisted_Edwards_curves | ||
def add(field[2] pt1, field[2] pt2, field a, field d) -> field[2] { | ||
field u1 = pt1[0]; | ||
field v1 = pt1[1]; | ||
field u2 = pt2[0]; | ||
field v2 = pt2[1]; | ||
|
||
field u = (u1*v2 + v1*u2) / (1 + d*u1*u2*v1*v2); | ||
field v = (v1*v2 - a*u1*u2) / (1 - d*u1*u2*v1*v2); | ||
return [u, v]; | ||
} | ||
|
||
// Check if a point is on a twisted Edwards curve | ||
// See appendix 3.3.1 of Zcash protocol specification: | ||
// https://github.com/zcash/zips/blob/master/protocol/protocol.pdf | ||
def onCurve(field[2] pt, field a, field d) -> bool { | ||
field uu = pt[0] * pt[0]; | ||
field vv = pt[1] * pt[1]; | ||
field uuvv = uu * vv; | ||
|
||
assert(a * uu + vv == 1 + d * uuvv); | ||
return true; | ||
} | ||
|
||
// Function that implements scalar multiplication for a fixed base point | ||
// Reference: https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/jubjub/fs.rs#L555 | ||
def scalarMul<N>(bool[N] exponent, field[2] pt, field a, field d) -> field[2] { | ||
field[2] mut res = pt; | ||
field[2] mut acc = [0, 1]; | ||
|
||
for u32 i in 0..N { | ||
u32 j = N - i - 1; | ||
field[2] candidate = add(acc, res, a, d); | ||
acc = exponent[j] ? candidate : acc; | ||
res = add(res, res, a, d); | ||
} | ||
|
||
assert(onCurve(acc, a, d)); | ||
return acc; | ||
} | ||
|
||
// Negate a point on an Edwards curve | ||
// Twisted Edwards Curves, BBJLP-2008, section 2 pg 2 | ||
def negate(field[2] pt) -> field[2] { | ||
field u = pt[0]; | ||
field v = pt[1]; | ||
return [-u, v]; | ||
} | ||
|
||
// Verifies that the point is not one of the low-order points. | ||
// If any of the points is multiplied by the cofactor, the resulting point will be infinity. | ||
// Returns true if the point is not one of the low-order points, false otherwise. | ||
// Cofactor is hard-coded to 8 for efficiency reasons | ||
// Reference: https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/jubjub/edwards.rs#L166 | ||
def orderCheck(field[2] pt, field a, field d) -> bool { | ||
field[2] mut res = add(pt, pt, a, d); // 2*pt | ||
res = add(res, res, a, d); // 4*pt | ||
res = add(res, res, a, d); // 8*pt | ||
return !(res[0] == 0 && res[1] == 1); | ||
} |
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
#pragma curve bls12_381 | ||
|
||
// The `a` coefficient of the twisted Edwards curve | ||
const field EDWARDS_A = -1; | ||
|
||
// The `d` coefficient of the twisted Edwards curve (-10240/10241 mod p) | ||
const field EDWARDS_D = 19257038036680949359750312669786877991949435402254120286184196891950884077233; | ||
|
||
// The generator point | ||
const field[2] G = [ | ||
11076627216317271660298050606127911965867021807910416450833192264015104452986, // Gx | ||
44412834903739585386157632289020980010620626017712148233229312325549216099227 // Gy | ||
]; |
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.