diff --git a/src/circuit/gadget/ecc/chip.rs b/src/circuit/gadget/ecc/chip.rs index 71b776b27..82ff04b02 100644 --- a/src/circuit/gadget/ecc/chip.rs +++ b/src/circuit/gadget/ecc/chip.rs @@ -103,7 +103,7 @@ pub struct EccConfig { } /// A chip implementing EccInstructions -#[derive(Debug)] +#[derive(Clone, Debug)] pub struct EccChip { pub config: EccConfig, pub loaded: EccLoaded, diff --git a/src/circuit/gadget/ecc/chip/mul.rs b/src/circuit/gadget/ecc/chip/mul.rs index af2bb5488..236cb5068 100644 --- a/src/circuit/gadget/ecc/chip/mul.rs +++ b/src/circuit/gadget/ecc/chip/mul.rs @@ -1,5 +1,6 @@ use super::{add, double, util, CellValue, EccConfig, EccPoint}; use crate::constants::NUM_COMPLETE_BITS; +use std::ops::Deref; use ff::PrimeField; use halo2::{ @@ -55,8 +56,7 @@ pub(super) fn create_gate( // y_{A,i+1} = (λ_{1,i+1} + λ_{2,i+1}) // * (x_{A,i+1} - (λ_{1,i+1}^2 - x_{A,i+1} - x_{P,i+1})) / 2 let y_a_next = (lambda1_next.clone() + lambda2_next) - * (x_a_next.clone() - - (lambda1_next.clone() * lambda1_next - x_a_next.clone() - x_p_next.clone())) + * (x_a_next.clone() - (lambda1_next.clone() * lambda1_next - x_a_next.clone() - x_p_next)) * F::TWO_INV; // λ_{1,i}⋅(x_{A,i} − x_{P,i}) − y_{A,i} + (2k_i - 1) y_{P,i} = 0 @@ -158,7 +158,7 @@ pub(super) fn assign_region( // Bits used in incomplete addition. k_{254} to k_{4} inclusive let incomplete_range = 0..(C::Scalar::NUM_BITS as usize - 1 - NUM_COMPLETE_BITS); - let k_incomplete = &k_bits[incomplete_range.clone()]; + let k_incomplete = &k_bits[incomplete_range]; let k_incomplete_hi = &k_incomplete[..k_incomplete.len() / 2]; let k_incomplete_lo = &k_incomplete[k_incomplete.len() / 2..]; @@ -183,8 +183,7 @@ pub(super) fn assign_region( offset + 1, hi_columns, k_incomplete_hi, - z, - (acc.x.clone(), acc.y.value), + (X(acc.x.clone()), Y(acc.y.value), ZValue(z)), )?; // Double-and-add (incomplete addition) for the `lo` half of the scalar decomposition @@ -195,8 +194,7 @@ pub(super) fn assign_region( offset + 1, lo_columns, k_incomplete_lo, - z, - (x, y_a), + (x, y_a, z), )?; // Move from incomplete addition to complete addition @@ -219,8 +217,8 @@ pub(super) fn assign_region( &config.perm_sum, )?; EccPoint { - x, - y: CellValue::::new(y_a_cell, y_a), + x: x.0, + y: CellValue::::new(y_a_cell, *y_a), } }; @@ -332,7 +330,7 @@ pub(super) fn assign_region( }; // Return the result of the final complete addition as `[scalar]B` - add::assign_region::(&p, &acc, k_0_row + offset, region, config.clone()) + add::assign_region::(&p, &acc, k_0_row + offset, region, config) } else { // If `k_0` is 1, simply return `Acc` Ok(acc) @@ -347,6 +345,36 @@ struct IncompleteColumns { lambda: (Column, Column), } +#[derive(Clone, Debug)] +struct X(CellValue); +impl Deref for X { + type Target = CellValue; + + fn deref(&self) -> &Self::Target { + &self.0 + } +} + +#[derive(Copy, Clone, Debug)] +struct Y(Option); +impl Deref for Y { + type Target = Option; + + fn deref(&self) -> &Self::Target { + &self.0 + } +} + +#[derive(Clone, Debug)] +struct ZValue(CellValue); +impl Deref for ZValue { + type Target = CellValue; + + fn deref(&self) -> &Self::Target { + &self.0 + } +} + // We perform incomplete addition on all but the last three bits of the // decomposed scalar. // We split the bits in the incomplete addition range into "hi" and "lo" @@ -360,13 +388,12 @@ fn add_incomplete( offset: usize, columns: IncompleteColumns, bits: &[bool], - starting_z: CellValue, - acc: (CellValue, Option), -) -> Result<(CellValue, Option, CellValue), Error> { + acc: (X, Y, ZValue), +) -> Result<(X, Y, ZValue), Error> { // Initialise the running `z` sum for the scalar bits. - let mut z_val = starting_z.value.unwrap(); + let mut z_val = acc.2.value.unwrap(); let mut z_cell = region.assign_advice(|| "starting z", columns.z, offset, || Ok(z_val))?; - region.constrain_equal(&config.perm_sum, z_cell, starting_z.cell)?; + region.constrain_equal(&config.perm_sum, z_cell, acc.2.cell)?; let offset = offset + 1; @@ -379,7 +406,7 @@ fn add_incomplete( || x_a.ok_or(Error::SynthesisError), )?; region.constrain_equal(&config.perm_sum, x_a_cell, acc.0.cell)?; - let mut y_a = acc.1; + let mut y_a = *acc.1; // Enable `q_mul` on all but the last row of the incomplete range. for row in 1..(bits.len() - 1) { @@ -461,9 +488,9 @@ fn add_incomplete( )?; } Ok(( - CellValue::::new(x_a_cell, x_a), - y_a, - CellValue::::new(z_cell, Some(z_val)), + X(CellValue::::new(x_a_cell, x_a)), + Y(y_a), + ZValue(CellValue::::new(z_cell, Some(z_val))), )) }