|
| 1 | +use crate::{field::Fr, types::G1Point}; |
| 2 | + |
| 3 | +#[cfg(not(feature = "std"))] |
| 4 | +use alloc::{boxed::Box, string::String}; |
| 5 | +#[cfg(feature = "std")] |
| 6 | +use std::boxed::Box; |
| 7 | + |
| 8 | +use crate::trace; |
| 9 | +use ark_bn254::{Bn254, Fq, Fq2, G1Affine, G1Projective, G2Affine}; |
| 10 | +use ark_ec::{pairing::Pairing, CurveGroup, PrimeGroup}; |
| 11 | +#[cfg(feature = "trace")] |
| 12 | +use ark_ff::BigInteger; |
| 13 | +use ark_ff::{One, PrimeField, Zero}; |
| 14 | + |
| 15 | +#[cfg(feature = "soroban-bn254-precompile")] |
| 16 | +use once_cell::race::OnceBox; |
| 17 | + |
| 18 | +/// Trait for BN254 operations used by the verifier hot paths. |
| 19 | +/// Implement this to bridge MSM/pairing to a Soroban BN254 precompile. |
| 20 | +pub trait Bn254Ops { |
| 21 | + fn g1_msm(&self, coms: &[G1Point], scalars: &[Fr]) -> Result<G1Affine, String>; |
| 22 | + fn pairing_check(&self, p0: &G1Affine, p1: &G1Affine) -> bool; |
| 23 | +} |
| 24 | + |
| 25 | +#[inline(always)] |
| 26 | +fn affine_checked(pt: &G1Point) -> Result<G1Affine, String> { |
| 27 | + let aff = G1Affine::new_unchecked(pt.x, pt.y); |
| 28 | + if aff.is_on_curve() && aff.is_in_correct_subgroup_assuming_on_curve() { |
| 29 | + Ok(aff) |
| 30 | + } else { |
| 31 | + Err("invalid G1 point (not on curve)".into()) |
| 32 | + } |
| 33 | +} |
| 34 | + |
| 35 | +#[inline(always)] |
| 36 | +fn negate(pt: &G1Point) -> G1Point { |
| 37 | + G1Point { x: pt.x, y: -pt.y } |
| 38 | +} |
| 39 | + |
| 40 | +#[inline(always)] |
| 41 | +fn ark_g1_msm(coms: &[G1Point], scalars: &[Fr]) -> Result<G1Affine, String> { |
| 42 | + if coms.len() != scalars.len() { |
| 43 | + return Err("commitments / scalars length mismatch".into()); |
| 44 | + } |
| 45 | + let mut acc = G1Projective::zero(); |
| 46 | + trace!("Initial acc: {:?}", acc); |
| 47 | + for (c, s) in coms.iter().zip(scalars.iter()) { |
| 48 | + let aff = G1Affine::new_unchecked(c.x, c.y); |
| 49 | + if !aff.is_on_curve() || !aff.is_in_correct_subgroup_assuming_on_curve() { |
| 50 | + return Err("invalid G1 point".into()); |
| 51 | + } |
| 52 | + #[cfg(feature = "trace")] |
| 53 | + { |
| 54 | + trace!( |
| 55 | + "Point.x = 0x{}", |
| 56 | + hex::encode(c.x.into_bigint().to_bytes_be()) |
| 57 | + ); |
| 58 | + trace!( |
| 59 | + "Point.y = 0x{}", |
| 60 | + hex::encode(c.y.into_bigint().to_bytes_be()) |
| 61 | + ); |
| 62 | + trace!("Scalar = 0x{}", hex::encode(s.to_bytes())); |
| 63 | + } |
| 64 | + acc += G1Projective::from(aff).mul_bigint(s.0.into_bigint()); |
| 65 | + #[cfg(feature = "trace")] |
| 66 | + { |
| 67 | + let acc_aff = acc.into_affine(); |
| 68 | + trace!( |
| 69 | + "Acc.x = 0x{}", |
| 70 | + hex::encode(acc_aff.x.into_bigint().to_bytes_be()) |
| 71 | + ); |
| 72 | + trace!( |
| 73 | + "Acc.y = 0x{}", |
| 74 | + hex::encode(acc_aff.y.into_bigint().to_bytes_be()) |
| 75 | + ); |
| 76 | + acc = G1Projective::from(acc_aff); |
| 77 | + } |
| 78 | + } |
| 79 | + Ok(acc.into_affine()) |
| 80 | +} |
| 81 | + |
| 82 | +#[inline(always)] |
| 83 | +fn ark_pairing_check(p0: &G1Affine, p1: &G1Affine) -> bool { |
| 84 | + // fixed RHS G2 (inputValues[2-5]) |
| 85 | + let rhs_g2 = { |
| 86 | + let x = Fq2::new( |
| 87 | + Fq::from_le_bytes_mod_order(&[ |
| 88 | + 0xed, 0xf6, 0x92, 0xd9, 0x5c, 0xbd, 0xde, 0x46, 0xdd, 0xda, 0x5e, 0xf7, 0xd4, 0x22, |
| 89 | + 0x43, 0x67, 0x79, 0x44, 0x5c, 0x5e, 0x66, 0x00, 0x6a, 0x42, 0x76, 0x1e, 0x1f, 0x12, |
| 90 | + 0xef, 0xde, 0x00, 0x18, |
| 91 | + ]), |
| 92 | + Fq::from_le_bytes_mod_order(&[ |
| 93 | + 0xc2, 0x12, 0xf3, 0xae, 0xb7, 0x85, 0xe4, 0x97, 0x12, 0xe7, 0xa9, 0x35, 0x33, 0x49, |
| 94 | + 0xaa, 0xf1, 0x25, 0x5d, 0xfb, 0x31, 0xb7, 0xbf, 0x60, 0x72, 0x3a, 0x48, 0x0d, 0x92, |
| 95 | + 0x93, 0x93, 0x8e, 0x19, |
| 96 | + ]), |
| 97 | + ); |
| 98 | + let y = Fq2::new( |
| 99 | + Fq::from_le_bytes_mod_order(&[ |
| 100 | + 0xaa, 0x7d, 0xfa, 0x66, 0x01, 0xcc, 0xe6, 0x4c, 0x7b, 0xd3, 0x43, 0x0c, 0x69, 0xe7, |
| 101 | + 0xd1, 0xe3, 0x8f, 0x40, 0xcb, 0x8d, 0x80, 0x71, 0xab, 0x4a, 0xeb, 0x6d, 0x8c, 0xdb, |
| 102 | + 0xa5, 0x5e, 0xc8, 0x12, |
| 103 | + ]), |
| 104 | + Fq::from_le_bytes_mod_order(&[ |
| 105 | + 0x5b, 0x97, 0x22, 0xd1, 0xdc, 0xda, 0xac, 0x55, 0xf3, 0x8e, 0xb3, 0x70, 0x33, 0x31, |
| 106 | + 0x4b, 0xbc, 0x95, 0x33, 0x0c, 0x69, 0xad, 0x99, 0x9e, 0xec, 0x75, 0xf0, 0x5f, 0x58, |
| 107 | + 0xd0, 0x89, 0x06, 0x09, |
| 108 | + ]), |
| 109 | + ); |
| 110 | + G2Affine::new_unchecked(x, y) |
| 111 | + }; |
| 112 | + // fixed LHS G2 (VK) |
| 113 | + let lhs_g2 = { |
| 114 | + let x = Fq2::new( |
| 115 | + Fq::from_le_bytes_mod_order(&[ |
| 116 | + 0xb0, 0x83, 0x88, 0x93, 0xec, 0x1f, 0x23, 0x7e, 0x8b, 0x07, 0x32, 0x3b, 0x07, 0x44, |
| 117 | + 0x59, 0x9f, 0x4e, 0x97, 0xb5, 0x98, 0xb3, 0xb5, 0x89, 0xbc, 0xc2, 0xbc, 0x37, 0xb8, |
| 118 | + 0xd5, 0xc4, 0x18, 0x01, |
| 119 | + ]), |
| 120 | + Fq::from_le_bytes_mod_order(&[ |
| 121 | + 0xc1, 0x83, 0x93, 0xc0, 0xfa, 0x30, 0xfe, 0x4e, 0x8b, 0x03, 0x8e, 0x35, 0x7a, 0xd8, |
| 122 | + 0x51, 0xea, 0xe8, 0xde, 0x91, 0x07, 0x58, 0x4e, 0xff, 0xe7, 0xc7, 0xf1, 0xf6, 0x51, |
| 123 | + 0xb2, 0x01, 0x0e, 0x26, |
| 124 | + ]), |
| 125 | + ); |
| 126 | + let y = Fq2::new( |
| 127 | + Fq::from_le_bytes_mod_order(&[ |
| 128 | + 0x55, 0x5e, 0xcc, 0xda, 0xd4, 0x87, 0x4a, 0x85, 0xa2, 0xce, 0xe6, 0x96, 0x3f, 0xdd, |
| 129 | + 0xe6, 0x11, 0x5e, 0x61, 0xe5, 0x14, 0x42, 0x5b, 0x47, 0x56, 0x2a, 0x63, 0xc0, 0xc0, |
| 130 | + 0xa3, 0xbd, 0xfe, 0x22, |
| 131 | + ]), |
| 132 | + Fq::from_le_bytes_mod_order(&[ |
| 133 | + 0xe4, 0x5f, 0x6a, 0xda, 0x80, 0x3c, 0x41, 0xee, 0xa4, 0x9b, 0xf9, 0x41, 0x46, 0xa0, |
| 134 | + 0xf2, 0x9c, 0x85, 0x72, 0x9a, 0xbb, 0xc1, 0x56, 0x51, 0xd2, 0xe3, 0x0f, 0x11, 0xf7, |
| 135 | + 0x69, 0x63, 0xfc, 0x04, |
| 136 | + ]), |
| 137 | + ); |
| 138 | + G2Affine::new_unchecked(x, y) |
| 139 | + }; |
| 140 | + |
| 141 | + let e1 = Bn254::pairing(*p0, rhs_g2); |
| 142 | + let e2 = Bn254::pairing(*p1, lhs_g2); |
| 143 | + e1.0 * e2.0 == <Bn254 as Pairing>::TargetField::one() |
| 144 | +} |
| 145 | + |
| 146 | +pub struct ArkworksOps; |
| 147 | + |
| 148 | +impl Bn254Ops for ArkworksOps { |
| 149 | + #[inline(always)] |
| 150 | + fn g1_msm(&self, coms: &[G1Point], scalars: &[Fr]) -> Result<G1Affine, String> { |
| 151 | + ark_g1_msm(coms, scalars) |
| 152 | + } |
| 153 | + #[inline(always)] |
| 154 | + fn pairing_check(&self, p0: &G1Affine, p1: &G1Affine) -> bool { |
| 155 | + ark_pairing_check(p0, p1) |
| 156 | + } |
| 157 | +} |
| 158 | + |
| 159 | +static ARKWORKS: ArkworksOps = ArkworksOps; |
| 160 | + |
| 161 | +#[cfg(feature = "soroban-bn254-precompile")] |
| 162 | +struct BackendHolder(pub Box<dyn Bn254Ops + Send + Sync>); |
| 163 | + |
| 164 | +#[cfg(feature = "soroban-bn254-precompile")] |
| 165 | +static BACKEND: OnceBox<BackendHolder> = OnceBox::new(); |
| 166 | + |
| 167 | +#[inline(always)] |
| 168 | +fn backend() -> &'static dyn Bn254Ops { |
| 169 | + #[cfg(feature = "soroban-bn254-precompile")] |
| 170 | + { |
| 171 | + if let Some(b) = BACKEND.get() { |
| 172 | + return &*b.0; |
| 173 | + } |
| 174 | + } |
| 175 | + &ARKWORKS |
| 176 | +} |
| 177 | + |
| 178 | +/// Multi-scalar multiplication on G1: ∑ sᵢ·Cᵢ |
| 179 | +#[inline(always)] |
| 180 | +pub fn g1_msm(coms: &[G1Point], scalars: &[Fr]) -> Result<G1Affine, String> { |
| 181 | + backend().g1_msm(coms, scalars) |
| 182 | +} |
| 183 | + |
| 184 | +/// Pairing product check e(P0, rhs_g2) * e(P1, lhs_g2) == 1 |
| 185 | +#[inline(always)] |
| 186 | +pub fn pairing_check(p0: &G1Affine, p1: &G1Affine) -> bool { |
| 187 | + backend().pairing_check(p0, p1) |
| 188 | +} |
| 189 | + |
| 190 | +pub mod helpers { |
| 191 | + use super::*; |
| 192 | + #[inline(always)] |
| 193 | + pub fn affine_checked(pt: &G1Point) -> Result<G1Affine, String> { |
| 194 | + super::affine_checked(pt) |
| 195 | + } |
| 196 | + #[inline(always)] |
| 197 | + pub fn negate(pt: &G1Point) -> G1Point { |
| 198 | + super::negate(pt) |
| 199 | + } |
| 200 | +} |
| 201 | + |
| 202 | +#[cfg(feature = "soroban-bn254-precompile")] |
| 203 | +/// Register a custom BN254 backend (Soroban BN254 precompile bridge). |
| 204 | +pub fn set_backend(ops: Box<dyn Bn254Ops + Send + Sync>) { |
| 205 | + let _ = BACKEND.set(Box::new(BackendHolder(ops))); |
| 206 | +} |
| 207 | + |
| 208 | +#[cfg(feature = "soroban-bn254-precompile")] |
| 209 | +#[inline(always)] |
| 210 | +pub fn set_soroban_bn254_backend(ops: Box<dyn Bn254Ops + Send + Sync>) { |
| 211 | + set_backend(ops) |
| 212 | +} |
0 commit comments