Optimized ECC chip

src/circuit/gadget/ecc.rs

@@ -9,6 +9,8 @@ use halo2::{
     plonk::Error,
 };
 
+pub mod chip;
+
 /// The set of circuit instructions required to use the ECC gadgets.
 pub trait EccInstructions<C: CurveAffine>: Chip<C::Base> {
     /// Variable representing an element of the elliptic curve's base field, that
@@ -36,16 +38,10 @@ pub trait EccInstructions<C: CurveAffine>: Chip<C::Base> {
     /// Variable representing the affine short Weierstrass x-coordinate of an
     /// elliptic curve point.
     type X: Clone + Debug;
-    /// Variable representing the set of fixed bases in the circuit.
+    /// Enumeration of the set of fixed bases to be used in full-width scalar mul.
     type FixedPoints: Clone + Debug;
-    /// Variable representing the set of fixed bases to be used in scalar
-    /// multiplication with a short signed exponent.
+    /// Enumeration of the set of fixed bases to be used in short signed scalar mul.
     type FixedPointsShort: Clone + Debug;
-    /// Variable representing a fixed elliptic curve point (constant in the circuit).
-    type FixedPoint: Clone + Debug;
-    /// Variable representing a fixed elliptic curve point (constant in the circuit)
-    /// to be used in scalar multiplication with a short signed exponent.
-    type FixedPointShort: Clone + Debug;
 
     /// Witnesses the given base field element as a private input to the circuit
     /// for variable-base scalar mul.
@@ -81,18 +77,6 @@ pub trait EccInstructions<C: CurveAffine>: Chip<C::Base> {
     /// Extracts the x-coordinate of a point.
     fn extract_p(point: &Self::Point) -> &Self::X;
 
-    /// Returns a fixed point that had been previously loaded into the circuit.
-    /// The pre-loaded cells are used to set up equality constraints in other
-    /// parts of the circuit where the fixed base is used.
-    fn get_fixed(&self, fixed_points: Self::FixedPoints) -> Result<Self::FixedPoint, Error>;
-
-    /// Returns a fixed point to be used in scalar multiplication with a signed
-    /// short exponent.
-    fn get_fixed_short(
-        &self,
-        fixed_points: Self::FixedPointsShort,
-    ) -> Result<Self::FixedPointShort, Error>;
-
     /// Performs incomplete point addition, returning `a + b`.
     ///
     /// This returns an error in exceptional cases.
@@ -111,14 +95,8 @@ pub trait EccInstructions<C: CurveAffine>: Chip<C::Base> {
         b: &Self::Point,
     ) -> Result<Self::Point, Error>;
 
-    /// Performs point doubling, returning `[2] a`.
-    fn double(
-        &self,
-        layouter: &mut impl Layouter<C::Base>,
-        a: &Self::Point,
-    ) -> Result<Self::Point, Error>;
-
     /// Performs variable-base scalar multiplication, returning `[scalar] base`.
+    /// Multiplication of the identity `[scalar] 𝒪 ` returns an error.
     fn mul(
         &self,
         layouter: &mut impl Layouter<C::Base>,
@@ -131,15 +109,15 @@ pub trait EccInstructions<C: CurveAffine>: Chip<C::Base> {
         &self,
         layouter: &mut impl Layouter<C::Base>,
         scalar: &Self::ScalarFixed,
-        base: &Self::FixedPoint,
+        base: &Self::FixedPoints,
     ) -> Result<Self::Point, Error>;
 
     /// Performs fixed-base scalar multiplication using a short signed scalar, returning `[scalar] base`.
     fn mul_fixed_short(
         &self,
         layouter: &mut impl Layouter<C::Base>,
         scalar: &Self::ScalarFixedShort,
-        base: &Self::FixedPointShort,
+        base: &Self::FixedPointsShort,
     ) -> Result<Self::Point, Error>;
 }
 
@@ -174,12 +152,18 @@ impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> ScalarVar
 
 /// A full-width element of the given elliptic curve's scalar field, to be used for fixed-base scalar mul.
 #[derive(Debug)]
-pub struct ScalarFixed<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> {
+pub struct ScalarFixed<C: CurveAffine, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
+{
     chip: EccChip,
     inner: EccChip::ScalarFixed,
 }
 
-impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> ScalarFixed<C, EccChip> {
+impl<C: CurveAffine, EccChip> ScalarFixed<C, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
+{
     /// Constructs a new ScalarFixed with the given value.
     pub fn new(
         chip: EccChip,
@@ -193,13 +177,17 @@ impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> ScalarFix
 
 /// A signed short element of the given elliptic curve's scalar field, to be used for fixed-base scalar mul.
 #[derive(Debug)]
-pub struct ScalarFixedShort<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> {
+pub struct ScalarFixedShort<C: CurveAffine, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
+{
     chip: EccChip,
     inner: EccChip::ScalarFixedShort,
 }
 
-impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq>
-    ScalarFixedShort<C, EccChip>
+impl<C: CurveAffine, EccChip> ScalarFixedShort<C, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
 {
     /// Constructs a new ScalarFixedShort with the given value.
     ///
@@ -231,7 +219,7 @@ impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq>
 }
 
 /// An elliptic curve point over the given curve.
-#[derive(Debug)]
+#[derive(Copy, Clone, Debug)]
 pub struct Point<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> {
     chip: EccChip,
     inner: EccChip::Point,
@@ -318,18 +306,18 @@ impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> X<C, EccC
 /// A constant elliptic curve point over the given curve, for which window tables have
 /// been provided to make scalar multiplication more efficient.
 #[derive(Clone, Debug)]
-pub struct FixedPoint<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> {
+pub struct FixedPoint<C: CurveAffine, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
+{
     chip: EccChip,
-    inner: EccChip::FixedPoint,
+    inner: EccChip::FixedPoints,
 }
 
-impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> FixedPoint<C, EccChip> {
-    /// Gets a reference to the specified fixed point in the circuit.
-    pub fn get(chip: EccChip, point: EccChip::FixedPoints) -> Result<Self, Error> {
-        chip.get_fixed(point)
-            .map(|inner| FixedPoint { chip, inner })
-    }
-
+impl<C: CurveAffine, EccChip> FixedPoint<C, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
+{
     /// Returns `[by] self`.
     pub fn mul(
         &self,
@@ -344,23 +332,28 @@ impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> FixedPoin
                 inner,
             })
     }
+
+    /// Wraps the given fixed base (obtained directly from an instruction) in a gadget.
+    pub fn from_inner(chip: EccChip, inner: EccChip::FixedPoints) -> Self {
+        FixedPoint { chip, inner }
+    }
 }
 
 /// A constant elliptic curve point over the given curve, used in scalar multiplication
 /// with a short signed exponent
 #[derive(Clone, Debug)]
-pub struct FixedPointShort<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> {
+pub struct FixedPointShort<C: CurveAffine, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
+{
     chip: EccChip,
-    inner: EccChip::FixedPointShort,
+    inner: EccChip::FixedPointsShort,
 }
 
-impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> FixedPointShort<C, EccChip> {
-    /// Gets a reference to the specified fixed point in the circuit.
-    pub fn get(chip: EccChip, point: EccChip::FixedPointsShort) -> Result<Self, Error> {
-        chip.get_fixed_short(point)
-            .map(|inner| FixedPointShort { chip, inner })
-    }
-
+impl<C: CurveAffine, EccChip> FixedPointShort<C, EccChip>
+where
+    EccChip: EccInstructions<C> + Clone + Debug + Eq,
+{
     /// Returns `[by] self`.
     pub fn mul(
         &self,
@@ -375,4 +368,145 @@ impl<C: CurveAffine, EccChip: EccInstructions<C> + Clone + Debug + Eq> FixedPoin
                 inner,
             })
     }
+
+    /// Wraps the given fixed base (obtained directly from an instruction) in a gadget.
+    pub fn from_inner(chip: EccChip, inner: EccChip::FixedPointsShort) -> Self {
+        FixedPointShort { chip, inner }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use group::{Curve, Group};
+    use halo2::{
+        arithmetic::CurveAffine,
+        circuit::{layouter::SingleChipLayouter, Layouter},
+        dev::MockProver,
+        pasta::pallas,
+        plonk::{Assignment, Circuit, ConstraintSystem, Error},
+    };
+
+    use super::chip::{EccChip, EccConfig};
+
+    struct MyCircuit<C: CurveAffine> {
+        _marker: std::marker::PhantomData<C>,
+    }
+
+    #[allow(non_snake_case)]
+    impl<C: CurveAffine> Circuit<C::Base> for MyCircuit<C> {
+        type Config = EccConfig;
+
+        fn configure(meta: &mut ConstraintSystem<C::Base>) -> Self::Config {
+            let advices = [
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+                meta.advice_column(),
+            ];
+
+            let perm = meta.permutation(
+                &advices
+                    .iter()
+                    .map(|advice| (*advice).into())
+                    .collect::<Vec<_>>(),
+            );
+
+            EccChip::<C>::configure(meta, advices, perm)
+        }
+
+        fn synthesize(
+            &self,
+            cs: &mut impl Assignment<C::Base>,
+            config: Self::Config,
+        ) -> Result<(), Error> {
+            let mut layouter = SingleChipLayouter::new(cs)?;
+            let chip = EccChip::construct(config);
+
+            // Generate a random point P
+            let p_val = C::CurveExt::random(rand::rngs::OsRng).to_affine(); // P
+            let p = super::Point::new(chip.clone(), layouter.namespace(|| "point"), Some(p_val))?;
+            let p_neg = -p_val;
+            let p_neg =
+                super::Point::new(chip.clone(), layouter.namespace(|| "point"), Some(p_neg))?;
+
+            // Generate a random point Q
+            let q_val = C::CurveExt::random(rand::rngs::OsRng).to_affine(); // P
+            let q = super::Point::new(chip.clone(), layouter.namespace(|| "point"), Some(q_val))?;
+
+            // Make sure P and Q are not the same point.
+            assert_ne!(p_val, q_val);
+
+            // Generate a (0,0) point to be used in other tests.
+            let zero = p.add(layouter.namespace(|| "P + (-P)"), &p_neg)?;
+
+            // Test complete addition
+            {
+                super::chip::add::tests::test_add(
+                    chip.clone(),
+                    layouter.namespace(|| "complete addition"),
+                    &zero,
+                    p_val,
+                    &p,
+                    q_val,
+                    &q,
+                    &p_neg,
+                )?;
+            }
+
+            // Test incomplete addition
+            {
+                super::chip::add_incomplete::tests::test_add_incomplete(
+                    layouter.namespace(|| "incomplete addition"),
+                    &zero,
+                    &p,
+                    &q,
+                    &p_neg,
+                )?;
+            }
+
+            // Test variable-base scalar multiplication
+            {
+                super::chip::mul::tests::test_mul(
+                    chip.clone(),
+                    layouter.namespace(|| "variable-base scalar mul"),
+                    &zero,
+                    &p,
+                )?;
+            }
+
+            // Test full-width fixed-base scalar multiplication
+            {
+                super::chip::mul_fixed::full_width::tests::test_mul_fixed(
+                    chip.clone(),
+                    layouter.namespace(|| "full-width fixed-base scalar mul"),
+                )?;
+            }
+
+            // Test signed short fixed-base scalar multiplication
+            {
+                super::chip::mul_fixed::short::tests::test_mul_fixed_short(
+                    chip,
+                    layouter.namespace(|| "signed short fixed-base scalar mul"),
+                )?;
+            }
+
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn ecc() {
+        let k = 12;
+        let circuit = MyCircuit::<pallas::Affine> {
+            _marker: std::marker::PhantomData,
+        };
+        let prover = MockProver::run(k, &circuit, vec![]).unwrap();
+        assert_eq!(prover.verify(), Ok(()))
+    }
 }