Implemented serialization of Fp2, Fp6, Fp12 and Gt

benches/groups.rs

@@ -7,14 +7,51 @@ use bls12_381::*;
 use criterion::{black_box, Criterion};
 
 fn criterion_benchmark(c: &mut Criterion) {
+    // Scalar
+    {
+        let name = "Scalar";
+        let x = Scalar::from_raw([1, 2, 3, 4]);
+        let y = Scalar::from_raw([1, 2, 3, 4]);
+        let bytes = [0u8; 64];
+        c.bench_function(&format!("{} addition", name), move |b| {
+            b.iter(|| black_box(&x) + black_box(&y))
+        });
+        c.bench_function(&format!("{} multiplication", name), move |b| {
+            b.iter(|| black_box(&x) * black_box(&y))
+        });
+        c.bench_function(&format!("{} exponentiation", name), move |b| {
+            b.iter(|| black_box(&x).pow(&black_box((&y).into())))
+        });
+        c.bench_function(&format!("{} from bytes wide", name), move |b| {
+            b.iter(|| Scalar::from_bytes_wide(black_box(&bytes)))
+        });
+    }
+
     // Pairings
     {
+        let name = "Gt";
         let g = G1Affine::generator();
         let h = G2Affine::generator();
+        let a = pairing(&g, &h);
+        let s = Scalar::from_raw([1, 2, 3, 4]);
+        let compressed = [0u8; 288];
+        let uncompressed = [0u8; 576];
         c.bench_function("full pairing", move |b| {
             b.iter(|| pairing(black_box(&g), black_box(&h)))
         });
+        c.bench_function(&format!("{} scalar multiplication", name), move |b| {
+            b.iter(|| black_box(a) * black_box(s))
+        });
+        c.bench_function(
+            &format!("{} deserialize compressed element", name),
+            move |b| b.iter(|| Gt::from_compressed(black_box(&compressed))),
+        );
+        c.bench_function(
+            &format!("{} deserialize uncompressed element", name),
+            move |b| b.iter(|| Gt::from_uncompressed(black_box(&uncompressed))),
+        );
     }
+
     // G1Affine
     {
         let name = "G1Affine";

src/fp12.rs

@@ -1,6 +1,7 @@
 use crate::fp::*;
 use crate::fp2::*;
 use crate::fp6::*;
+use crate::scalar::MODULUS;
 
 use core::fmt;
 use core::ops::{Add, AddAssign, Mul, MulAssign, Neg, Sub, SubAssign};
@@ -178,6 +179,72 @@ impl Fp12 {
                 c1: self.c1 * -t,
             })
     }
+
+    /// Although this is labeled "vartime", it is only
+    /// variable time with respect to the exponent. It
+    /// is also not exposed in the public API.
+    pub fn pow_vartime(&self, by: &[u64]) -> Self {
+        let mut res = Self::one();
+        for e in by.iter().rev() {
+            for i in (0..64).rev() {
+                res = res.square();
+
+                if ((*e >> i) & 1) == 1 {
+                    res *= self;
+                }
+            }
+        }
+        res
+    }
+
+    /// Attempts to convert a little-endian byte representation of
+    /// a scalar into an `Fp12`.
+    ///
+    /// Only fails when the underlying Fp elements are not canonical,
+    /// but not when `Fp12` is not part of the subgroup.
+    pub fn from_bytes_unchecked(bytes: &[u8; 576]) -> CtOption<Fp12> {
+        let mut buf = [0u8; 288];
+
+        buf.copy_from_slice(&bytes[0..288]);
+        let c0 = Fp6::from_bytes_unchecked(&buf);
+        buf.copy_from_slice(&bytes[288..576]);
+        let c1 = Fp6::from_bytes_unchecked(&buf);
+
+        c0.and_then(|c0| c1.map(|c1| Fp12 { c0, c1 }))
+    }
+
+    /// Attempts to convert a little-endian byte representation of
+    /// a scalar into an `Fp12`, failing if the input is not canonical.
+    pub fn from_bytes(bytes: &[u8; 576]) -> CtOption<Fp12> {
+        Fp12::from_bytes_unchecked(bytes).and_then(|res| {
+            let is_some = res.is_element();
+            CtOption::new(res, is_some)
+        })
+    }
+
+    /// Converts an element of `Fp12` into a byte representation in
+    /// big-endian byte order.
+    pub fn to_bytes(&self) -> [u8; 576] {
+        let mut res = [0; 576];
+
+        res[0..288].copy_from_slice(&self.c0.to_bytes());
+        res[288..576].copy_from_slice(&self.c1.to_bytes());
+
+        res
+    }
+
+    /// Returns true if this element belongs to the Fp12 group.
+    pub fn is_element(&self) -> Choice {
+        // The exponent is a constant,
+        // thus this operation is constant time as well.
+        let modulus_pow = self.pow_vartime(&<[u64; 4]>::from(&MODULUS));
+
+        // Any field of characteristic p has at most one subgroup
+        // of order q so it suffices to check that raising the
+        // element to the power q aka scalar::MODULUS gives the
+        // identity.
+        modulus_pow.ct_eq(&Fp12::one())
+    }
 }
 
 impl<'a, 'b> Mul<&'b Fp12> for &'a Fp12 {

src/fp2.rs

@@ -334,6 +334,33 @@ impl Fp2 {
         }
         res
     }
+
+    /// Attempts to convert a little-endian byte representation of
+    /// a scalar into an `Fp2`.
+    ///
+    /// Only fails when the underlying Fp elements are not canonical,
+    /// but not when `Fp2` is not part of the subgroup.
+    pub fn from_bytes_unchecked(bytes: &[u8; 96]) -> CtOption<Fp2> {
+        let mut buf = [0u8; 48];
+
+        buf.copy_from_slice(&bytes[0..48]);
+        let c0 = Fp::from_bytes(&buf);
+        buf.copy_from_slice(&bytes[48..96]);
+        let c1 = Fp::from_bytes(&buf);
+
+        c0.and_then(|c0| c1.map(|c1| Fp2 { c0, c1 }))
+    }
+
+    /// Converts an element of `Fp2` into a byte representation in
+    /// big-endian byte order.
+    pub fn to_bytes(&self) -> [u8; 96] {
+        let mut res = [0; 96];
+
+        res[0..48].copy_from_slice(&self.c0.to_bytes());
+        res[48..96].copy_from_slice(&self.c1.to_bytes());
+
+        res
+    }
 }
 
 #[test]