From 7e403bd20bdbdfff9d0bda908c91a543150c515c Mon Sep 17 00:00:00 2001 From: Michael Connor Date: Sun, 22 Sep 2024 23:58:01 +0100 Subject: [PATCH 1/5] add bls12_381 (not working yet) --- Nargo.toml | 5 +- flamegraph/main_gates.svg | 918 ++++++++++++++++++++++ info.sh | 8 +- src/curve_jac.nr | 146 ++-- src/curves.nr | 2 + src/curves/bls12_381.nr | 540 +++++++++++++ src/{bigcurve_test.nr => curves/bn254.nr} | 244 +++--- src/lib.nr | 21 +- src/main.nr | 39 +- src/scalar_field.nr | 18 +- 10 files changed, 1719 insertions(+), 222 deletions(-) create mode 100644 flamegraph/main_gates.svg create mode 100644 src/curves.nr create mode 100644 src/curves/bls12_381.nr rename src/{bigcurve_test.nr => curves/bn254.nr} (68%) diff --git a/Nargo.toml b/Nargo.toml index 327af84..2773748 100644 --- a/Nargo.toml +++ b/Nargo.toml @@ -1,8 +1,9 @@ [package] name = "noir_bigcurve" -type = "lib" +type = "bin" authors = [""] compiler_version = ">=0.32.0" [dependencies] -bignum = {tag = "v0.3.1", git = "https://github.com/noir-lang/noir-bignum"} \ No newline at end of file +bignum = {tag = "v0.3.1", git = "https://github.com/noir-lang/noir-bignum"} +# bignum = {path = "../noir-bignum"} \ No newline at end of file diff --git a/flamegraph/main_gates.svg b/flamegraph/main_gates.svg new file mode 100644 index 0000000..59b8b8a --- /dev/null +++ b/flamegraph/main_gates.svg @@ -0,0 +1,918 @@ +./target/noir_bigcurve.json-main Reset ZoomSearch scalar_field.nr:204:9::x.validate_in_field() (5 gates, 0.00%)lib.nr:252:9::Params::get_instance().validate_in_field(self) (5 gates, 0.00%)runtime_bignum.nr:549:28::self.__validate_in_field_compute_borrow_flags(val) (5 gates, 0.00%)opcode::arithmetic (5 gates, 0.00%)bls12_381.nr:151:35::ScalarField::from_bignum(scalar_fr) (18 gates, 0.01%)scalar_field.nr:205:51::__get_wnaf_slices2(x.limbs) (13 gates, 0.01%)opcode::arithmetic (13 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (2,794 gates, 2.04%)r..mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,794 gates, 2.04%)m..opcode::blackbox::range (2,794 gates, 2.04%)o..main.nr:500:9::x3.validate_in_range() (2,819 gates, 2.06%)m..lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (2,819 gates, 2.06%)l..runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (25 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (25 gates, 0.02%)opcode::blackbox::range (25 gates, 0.02%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:501:9::y3.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)main.nr:502:9::lambda.validate_in_range() (16 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (16 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,385 gates, 1.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1,369 gates, 1.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,369 gates, 1.00%)opcode::blackbox::range (1,369 gates, 1.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (20 gates, 0.01%)opcode::arithmetic (20 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:507:9::BigNum::evaluate_quadratic_expression( + [[x1, x1, x1], [y1, y1, BigNum::new()]], + [[false, false, false], [false, false, false]], + [[x1], [lambda]], + [[false], [true]], + [CurveParams::a()], + [false] + ) (1,460 gates, 1.07%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (1,460 gates, 1.07%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:517:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x1, x1], + [true, true, true] + ) (87 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (87 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (18 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:80:18::P.double_with_hint(transcript[0]) (4,488 gates, 3.28%)mai..main.nr:527:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (88 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (88 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:85:24::P.y.neg() (4 gates, 0.00%)lib.nr:268:9::Params::get_instance().neg(self) (4 gates, 0.00%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)main.nr:184:9::x3.validate_in_range() (119 gates, 0.09%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (119 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (9 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)main.nr:185:9::y3.validate_in_range() (126 gates, 0.09%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (126 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)main.nr:186:9::lambda.validate_in_range() (118 gates, 0.09%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (118 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (8 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (8 gates, 0.01%)opcode::blackbox::range (8 gates, 0.01%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (14 gates, 0.01%)opcode::arithmetic (14 gates, 0.01%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (27 gates, 0.02%)opcode::arithmetic (27 gates, 0.02%)main.nr:189:9::x1.assert_is_not_equal(x2) (69 gates, 0.05%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (69 gates, 0.05%)runtime_bignum.nr:589:16::target != 0 (28 gates, 0.02%)opcode::arithmetic (28 gates, 0.02%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (111 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (111 gates, 0.08%)opcode::blackbox::range (111 gates, 0.08%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (121 gates, 0.09%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (10 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (10 gates, 0.01%)opcode::blackbox::range (10 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (400 gates, 0.29%)opcode::arithmetic (400 gates, 0.29%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (7 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (7 gates, 0.01%)opcode::blackbox::range (7 gates, 0.01%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (35 gates, 0.03%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (35 gates, 0.03%)opcode::blackbox::range (35 gates, 0.03%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (124 gates, 0.09%)opcode::arithmetic (124 gates, 0.09%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (221 gates, 0.16%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (221 gates, 0.16%)opcode::blackbox::range (221 gates, 0.16%)main.nr:192:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x2, x1]], + [[false, true]], + [y2, y1], + [true, false] + ) (915 gates, 0.67%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (915 gates, 0.67%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (120 gates, 0.09%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (10 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (10 gates, 0.01%)opcode::blackbox::range (10 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (112 gates, 0.08%)opcode::arithmetic (112 gates, 0.08%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (7 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (7 gates, 0.01%)opcode::blackbox::range (7 gates, 0.01%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (35 gates, 0.03%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (35 gates, 0.03%)opcode::blackbox::range (35 gates, 0.03%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (138 gates, 0.10%)opcode::arithmetic (138 gates, 0.10%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (221 gates, 0.16%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (221 gates, 0.16%)opcode::blackbox::range (221 gates, 0.16%)main.nr:202:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x2, x1], + [true, true, true] + ) (640 gates, 0.47%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (640 gates, 0.47%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (121 gates, 0.09%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (11 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (11 gates, 0.01%)opcode::blackbox::range (11 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (352 gates, 0.26%)opcode::arithmetic (352 gates, 0.26%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (7 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (7 gates, 0.01%)opcode::blackbox::range (7 gates, 0.01%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (35 gates, 0.03%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (35 gates, 0.03%)opcode::blackbox::range (35 gates, 0.03%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (126 gates, 0.09%)opcode::arithmetic (126 gates, 0.09%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (220 gates, 0.16%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (220 gates, 0.16%)opcode::blackbox::range (220 gates, 0.16%)main.nr:89:17::D2.incomplete_add_with_hint(A, transcript[i]) (2,855 gates, 2.09%)m..main.nr:212:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (868 gates, 0.64%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (868 gates, 0.64%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (28 gates, 0.02%)opcode::blackbox::range (28 gates, 0.02%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)runtime_bignum.nr:609:9::result.validate_in_range() (119 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (9 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:613:16::result_limb == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:617:20::result_limb == 0 (14 gates, 0.01%)opcode::arithmetic (14 gates, 0.01%)main.nr:551:37::PointTable::new_with_hint( + input, + [ + transcript[0], transcript[1], transcript[2], transcript[3], transcript[4], transcript[5], transcript[6], transcript[7] + ] + ) (7,522 gates, 5.51%)main.nr..main.nr:93:32::A.y.neg() (175 gates, 0.13%)lib.nr:268:9::Params::get_instance().neg(self) (175 gates, 0.13%)runtime_bignum.nr:620:16::result_limb == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:184:9::x3.validate_in_range() (17 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:185:9::y3.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:186:9::lambda.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (3 gates, 0.00%)opcode::arithmetic (3 gates, 0.00%)main.nr:189:9::x1.assert_is_not_equal(x2) (9 gates, 0.01%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (9 gates, 0.01%)runtime_bignum.nr:589:16::target != 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:192:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x2, x1]], + [[false, true]], + [y2, y1], + [true, false] + ) (87 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (87 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (18 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (18 gates, 0.01%)opcode::arithmetic (18 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:202:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x2, x1], + [true, true, true] + ) (90 gates, 0.07%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (90 gates, 0.07%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:560:31::accumulator.incomplete_add_with_hint(T.get(scalar.base4_slices[0]), transcript[3 + 5]) (327 gates, 0.24%)main.nr:212:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (88 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (88 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)opcode::arithmetic (21 gates, 0.02%)opcode::memory::init (4 gates, 0.00%)main.nr:104:23::self.x[idx] (35 gates, 0.03%)opcode::memory::op (10 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)opcode::memory::init (4 gates, 0.00%)main.nr:560:68::T.get(scalar.base4_slices[0]) (56 gates, 0.04%)main.nr:104:39::self.y[idx] (21 gates, 0.02%)opcode::memory::op (10 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)main.nr:501:9::y3.validate_in_range() (1,054 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,054 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( + [[x1, x1, x1], [y1, y1, BigNum::new()]], + [[false, false, false], [false, false, false]], + [[x1], [lambda]], + [[false], [true]], + [CurveParams::a()], + [false] + ) (7,355 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (7,355 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x1, x1], + [true, true, true] + ) (5,686 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (5,686 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:564:27::accumulator.double_with_hint(transcript[4 + 5 * i]) (25,010 gates, 18.30%)main.nr:564:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (8,678 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (8,678 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)main.nr:501:9::y3.validate_in_range() (1,056 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,056 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,149 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,149 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (141 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (141 gates, 0.10%)opcode::blackbox::range (141 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( + [[x1, x1, x1], [y1, y1, BigNum::new()]], + [[false, false, false], [false, false, false]], + [[x1], [lambda]], + [[false], [true]], + [CurveParams::a()], + [false] + ) (7,355 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (7,355 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,149 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (141 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (141 gates, 0.10%)opcode::blackbox::range (141 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x1, x1], + [true, true, true] + ) (5,685 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (5,685 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,056 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:565:27::accumulator.double_with_hint(transcript[5 + 5 * i]) (25,011 gates, 18.30%)main.nr:565:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (8,679 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (8,679 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)main.nr:501:9::y3.validate_in_range() (1,055 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,055 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,056 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( + [[x1, x1, x1], [y1, y1, BigNum::new()]], + [[false, false, false], [false, false, false]], + [[x1], [lambda]], + [[false], [true]], + [CurveParams::a()], + [false] + ) (7,356 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (7,356 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x1, x1], + [true, true, true] + ) (5,686 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (5,686 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,054 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:566:27::accumulator.double_with_hint(transcript[6 + 5 * i]) (25,011 gates, 18.30%)main.nr:566:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (8,677 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (8,677 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,086 gates, 0.79%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,086 gates, 0.79%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)main.nr:501:9::y3.validate_in_range() (1,056 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,056 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( + [[x1, x1, x1], [y1, y1, BigNum::new()]], + [[false, false, false], [false, false, false]], + [[x1], [lambda]], + [[false], [true]], + [CurveParams::a()], + [false] + ) (7,355 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (7,355 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x1, x1], + [true, true, true] + ) (5,686 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (5,686 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,056 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:567:27::accumulator.double_with_hint(transcript[7 + 5 * i]) (25,012 gates, 18.31%)main.nr:567:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (8,679 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (8,679 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:184:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)main.nr:185:9::y3.validate_in_range() (1,054 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,054 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:186:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (126 gates, 0.09%)opcode::arithmetic (126 gates, 0.09%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (315 gates, 0.23%)opcode::arithmetic (315 gates, 0.23%)main.nr:189:9::x1.assert_is_not_equal(x2) (693 gates, 0.51%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (693 gates, 0.51%)runtime_bignum.nr:589:16::target != 0 (252 gates, 0.18%)opcode::arithmetic (252 gates, 0.18%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:192:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x2, x1]], + [[false, true]], + [y2, y1], + [true, false] + ) (8,615 gates, 6.31%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (8,615 gates, 6.31%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,260 gates, 0.92%)opcode::arithmetic (1,260 gates, 0.92%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:202:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x2, x1], + [true, true, true] + ) (5,812 gates, 4.25%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (5,812 gates, 4.25%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (3,024 gates, 2.21%)r..opcode::arithmetic (3,024 gates, 2.21%)o..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:568:27::accumulator.incomplete_add_with_hint(T.get(scalar.base4_slices[i]), transcript[8 + 5 * i]) (26,081 gates, 19.09%)main.nr:568:27::accumulator.in..main.nr:212:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (7,670 gates, 5.61%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (7,670 gates, 5.61%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)opcode::arithmetic (189 gates, 0.14%)main.nr:104:23::self.x[idx] (819 gates, 0.60%)opcode::memory::op (630 gates, 0.46%)opcode::arithmetic (189 gates, 0.14%)main.nr:568:64::T.get(scalar.base4_slices[i]) (1,638 gates, 1.20%)main.nr:104:39::self.y[idx] (819 gates, 0.60%)opcode::memory::op (630 gates, 0.46%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (3 gates, 0.00%)opcode::arithmetic (3 gates, 0.00%)main.nr:451:9::x1.assert_is_not_equal(x2) (8 gates, 0.01%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (8 gates, 0.01%)runtime_bignum.nr:589:16::target != 0 (3 gates, 0.00%)opcode::arithmetic (3 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)main.nr:454:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x2, x1]], + [[false, true]], + [y2, y1], + [false, false] + ) (27 gates, 0.02%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (27 gates, 0.02%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (11 gates, 0.01%)opcode::arithmetic (11 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)main.nr:464:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x2, x1], + [true, true, true] + ) (28 gates, 0.02%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (28 gates, 0.02%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (48 gates, 0.04%)opcode::arithmetic (48 gates, 0.04%)main.nr:574:27::accumulator.incomplete_subtract_with_hint(input, transcript[4 + 5 * NScalarSlices]) (123 gates, 0.09%)main.nr:474:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (60 gates, 0.04%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (60 gates, 0.04%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:339:9::x3.validate_in_range() (17 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:340:9::y3.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:341:9::lambda.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (16 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (6 gates, 0.00%)opcode::arithmetic (6 gates, 0.00%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (35 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)main.nr:343:33::x2.eq(x1) (61 gates, 0.04%)lib.nr:59:40::self == other (61 gates, 0.04%)lib.nr:328:9::bn.eq(self, other) (61 gates, 0.04%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (6 gates, 0.00%)opcode::arithmetic (6 gates, 0.00%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (36 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)main.nr:344:33::y2.eq(y1) (62 gates, 0.05%)lib.nr:59:40::self == other (62 gates, 0.05%)lib.nr:328:9::bn.eq(self, other) (62 gates, 0.05%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)main.nr:346:35::x_equal_predicate & !y_equal_predicate (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)main.nr:351:14::BigNum::conditional_select(x1, BigNum::new(), evaluate_group_operation_predicate) (1 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (1 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:362:32::BigNum::conditional_select(y1, x2.neg(), double_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (4 gates, 0.00%)opcode::blackbox::range (4 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:609:9::result.validate_in_range() (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:613:16::result_limb == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:617:20::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)main.nr:362:63::x2.neg() (26 gates, 0.02%)lib.nr:268:9::Params::get_instance().neg(self) (26 gates, 0.02%)runtime_bignum.nr:620:16::result_limb == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:363:32::BigNum::conditional_select(y1, x1, double_predicate) (12 gates, 0.01%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (12 gates, 0.01%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)main.nr:364:32::BigNum::conditional_select(x1, BigNum::one(), double_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:365:32::BigNum::conditional_select(x1, y2, double_predicate) (1 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (1 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:366:32::BigNum::conditional_select(x1, y1, double_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:367:32::BigNum::conditional_select(x1, BigNum::new(), double_predicate) (1 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (1 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (19 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (3 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (3 gates, 0.00%)opcode::blackbox::range (3 gates, 0.00%)runtime_bignum.nr:480:40::t0[k][i] * t1[k][j] (17 gates, 0.01%)opcode::arithmetic (17 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:484:57::t0[k][i] * t1[k][j] (22 gates, 0.02%)opcode::arithmetic (22 gates, 0.02%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (35 gates, 0.03%)opcode::arithmetic (35 gates, 0.03%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:377:9::BigNum::evaluate_quadratic_expression( + [[lambda], [product_2_lhs_t0]], + [[true], [false]], + [ + [product_1_rhs_t0, product_1_rhs_t1, BigNum::new()], [product_2_rhs_t0, product_2_rhs_t1, product_2_rhs_t2] + ], + [[false, false, false], [false, false, false]], + [a_term], + [false] + ) (148 gates, 0.11%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (148 gates, 0.11%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (16 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (20 gates, 0.01%)opcode::arithmetic (20 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:390:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[lambda]], + [[false]], + [x3, x2, x1], + [true, true, true] + ) (91 gates, 0.07%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (91 gates, 0.07%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (64 gates, 0.05%)opcode::arithmetic (64 gates, 0.05%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (18 gates, 0.01%)opcode::arithmetic (18 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:400:9::BigNum::evaluate_quadratic_expression( + [[lambda]], + [[false]], + [[x3, x1]], + [[false, true]], + [y3, y1], + [false, false] + ) (138 gates, 0.10%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( + lhs_terms, + lhs_flags, + rhs_terms, + rhs_flags, + linear_terms, + linear_flags + ) (138 gates, 0.10%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:414:17::BigNum::conditional_select(BigNum::new(), x_out, infinity_predicate) (13 gates, 0.01%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (13 gates, 0.01%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (13 gates, 0.01%)opcode::arithmetic (13 gates, 0.01%)main.nr:415:25::BigNum::conditional_select(y3, y1, evaluate_group_operation_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:417:44::other.y.neg() (4 gates, 0.00%)lib.nr:268:9::Params::get_instance().neg(self) (4 gates, 0.00%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:418:17::BigNum::conditional_select(BigNum::new(), y_out, infinity_predicate) (8 gates, 0.01%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (8 gates, 0.01%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)opcode::arithmetic (5 gates, 0.00%)main.nr:422:32::conditional_select(true, false, evaluate_group_operation_predicate) (25 gates, 0.02%)main.nr:420:70::((a as Field - b as Field) * predicate as Field + b as Field) as bool (25 gates, 0.02%)opcode::blackbox::range (20 gates, 0.01%)opcode::arithmetic (5 gates, 0.00%)bls12_381.nr:155:18::P.mul_with_hint(scalar, transcript) (136,473 gates, 99.88%)bls12_381.nr:155:18::P.mul_with_hint(scalar, transcript)main.nr:577:23::accumulator.sub_with_hint(BigCurve::offset_generator_final(), transcript[5 + 5 * NScalarSlices]) (682 gates, 0.50%)main.nr:423:24::conditional_select(true, infinity_out, infinity_predicate) (20 gates, 0.01%)main.nr:420:70::((a as Field - b as Field) * predicate as Field + b as Field) as bool (20 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)bls12_381.nr:163:18::BigNum::new() - expected.y (4 gates, 0.00%)lib.nr:303:9::Params::get_instance().sub(self, other) (4 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (10 gates, 0.01%)opcode::arithmetic (10 gates, 0.01%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (44 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)lib.nr:59:40::self == other (70 gates, 0.05%)lib.nr:328:9::bn.eq(self, other) (70 gates, 0.05%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)bls12_381.nr:164:12::result.x.eq(expected.x) (71 gates, 0.05%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (10 gates, 0.01%)opcode::arithmetic (10 gates, 0.01%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (44 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)lib.nr:59:40::self == other (70 gates, 0.05%)lib.nr:328:9::bn.eq(self, other) (70 gates, 0.05%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)all (136,637 gates, 100%)main.nr:28:5::curves::bls12_381::test_mul() (136,637 gates, 100.00%)main.nr:28:5::curves::bls12_381::test_mul()bls12_381.nr:165:12::result.y.eq(expected.y) (71 gates, 0.05%)opcode::arithmetic (1 gates, 0.00%) \ No newline at end of file diff --git a/info.sh b/info.sh index 0049a4d..4bdc827 100755 --- a/info.sh +++ b/info.sh @@ -1 +1,7 @@ -nargo compile --force && bb gates -b ./target/noir_bigcurve.json \ No newline at end of file +nargo compile --force && bb gates -b ./target/noir_bigcurve.json + +# This is the command I've been using, to then view a flamegraph at localhost:3000: +# You'll need to replace all the paths for nargo, bb, the json file, for whatever they are on your machine. +# And you'll need a recent version of nargo; possibly the one inside aztec-packages. + +# ~/git/noir/target/debug/nargo compile && ~/.bb/bb gates_mega_honk -b ./target/noir_bigcurve.json > txt.txt && ~/git/noir/target/debug/noir-profiler gates-flamegraph --artifact-path ./target/noir_bigcurve.json --backend-path ~/.bb/bb --output ./flamegraph --backend-gates-command "gates_mega_honk" && python3 -m http.server --directory "./flamegraph" 3000 \ No newline at end of file diff --git a/src/curve_jac.nr b/src/curve_jac.nr index 78eb344..e76c768 100644 --- a/src/curve_jac.nr +++ b/src/curve_jac.nr @@ -42,7 +42,7 @@ struct JTranscript { } impl JTranscript where BigNum: BigNumTrait { - unconstrained fn new() -> Self { + unconstrained fn __new() -> Self { JTranscript { lambda_numerator: BigNum::new(), x3: BigNum::new(), y3: BigNum::new(), z3: BigNum::new() } } } @@ -69,11 +69,11 @@ impl AffineTranscript where BigNum: BigNumTrait { AffineTranscript { lambda: BigNum::new(), x3: BigNum::new(), y3: BigNum::new() } } - unconstrained fn from_j(j_tx: JTranscript) -> Self { - AffineTranscript::from_jacobian_transcript([j_tx].as_slice())[0] + unconstrained fn __from_j(j_tx: JTranscript) -> Self { + AffineTranscript::__from_jacobian_transcript([j_tx].as_slice())[0] } - unconstrained pub fn from_j_with_hint(j_tx: JTranscript, inverse: BigNum) -> AffineTranscript { + unconstrained pub fn __from_j_with_hint(j_tx: JTranscript, inverse: BigNum) -> AffineTranscript { let z_inv = inverse; let zz = z_inv.__mul(z_inv); let zzz = zz.__mul(z_inv); @@ -83,7 +83,7 @@ impl AffineTranscript where BigNum: BigNumTrait { AffineTranscript { x3, y3, lambda } } - unconstrained fn from_jacobian_transcript(j_tx: [JTranscript]) -> [AffineTranscript] { + unconstrained fn __from_jacobian_transcript(j_tx: [JTranscript]) -> [AffineTranscript] { let mut result: [AffineTranscript] = &[]; let mut inverses: [BigNum] = &[]; @@ -130,7 +130,7 @@ impl PointTable where BigNum: BigNumTrait { x: [BigNum::new(); 16], y: [BigNum::new(); 16], z: [BigNum::new(); 16], - transcript: [JTranscript::new(); 8] + transcript: [JTranscript::__new(); 8] } } /** @@ -141,14 +141,14 @@ impl PointTable where BigNum: BigNumTrait { * [0, P, ..., 15P] requires 14 group operations. * group operations are expensive! **/ - unconstrained fn new(P: CurveJ) -> Self where CurveParams: CurveParamsTrait { + unconstrained fn __new(P: CurveJ) -> Self where CurveParams: CurveParamsTrait { let mut result = PointTable { x: [BigNum::new(); 16], y: [BigNum::new(); 16], z: [BigNum::new(); 16], - transcript: [JTranscript::new(); 8] + transcript: [JTranscript::__new(); 8] }; - let op = P.dbl(); + let op = P.__dbl(); let D2 = op.0; result.transcript[0] = op.1; result.x[7] = P.x; @@ -159,7 +159,7 @@ impl PointTable where BigNum: BigNumTrait { result.z[8] = P.z; let mut A = P; for i in 1..8 { - let op = D2.incomplete_add(A); + let op = D2.__incomplete_add(A); A = op.0; result.transcript[i] = op.1; result.x[8+i] = A.x; @@ -176,7 +176,7 @@ impl PointTable where BigNum: BigNumTrait { /** * @brief get a value out of the lookup table **/ - unconstrained fn get(self, idx: u8) -> CurveJ where CurveParams: CurveParamsTrait { + unconstrained fn __get(self, idx: u8) -> CurveJ where CurveParams: CurveParamsTrait { CurveJ { x: self.x[idx], y: self.y[idx], z: self.z[idx], is_infinity: false } } } @@ -228,23 +228,23 @@ impl CurveJ where BigNum: BigNumTrait, /** * @brief negate a point **/ - fn neg(self) -> Self { + unconstrained fn __neg(self) -> Self { CurveJ { x: self.x, y: self.y.__neg(), z: self.z, is_infinity: self.is_infinity } } - unconstrained fn new() -> Self { + unconstrained fn __new() -> Self { CurveJ { x: BigNum::new(), y: BigNum::new(), z: BigNum::new(), is_infinity: false } } - unconstrained fn point_at_infinity() -> Self { + unconstrained fn __point_at_infinity() -> Self { CurveJ { x: BigNum::new(), y: BigNum::new(), z: BigNum::new(), is_infinity: true } } - unconstrained fn sub(self, p2: Self) -> (Self, JTranscript) { - self.add(p2.neg()) + unconstrained fn __sub(self, p2: Self) -> (Self, JTranscript) { + self.__add(p2.__neg()) } - unconstrained fn add(self, p2: Self) -> (Self, JTranscript) { + unconstrained fn __add(self, p2: Self) -> (Self, JTranscript) { // TODO: once we have linear expressions as unconstrained fns, replace this with something that has no addmods, submods let X1 = self.x; let X2 = p2.x; @@ -270,17 +270,17 @@ impl CurveJ where BigNum: BigNumTrait, let double_predicate = x_equal_predicate & y_equal_predicate & !lhs_infinity & !rhs_infinity; let add_predicate = !x_equal_predicate & !lhs_infinity & !rhs_infinity; let infinity_predicate = (x_equal_predicate & !y_equal_predicate) | (lhs_infinity & rhs_infinity); - let mut result: (Self, JTranscript) = (CurveJ::new(), JTranscript::new()); + let mut result: (Self, JTranscript) = (CurveJ::__new(), JTranscript::__new()); if (double_predicate) { - result = self.dbl(); + result = self.__dbl(); } else if (add_predicate) { - result = self.incomplete_add(p2); + result = self.__incomplete_add(p2); } else if (infinity_predicate) { - result = (CurveJ::point_at_infinity(), JTranscript::new() ); + result = (CurveJ::__point_at_infinity(), JTranscript::__new() ); } else if (lhs_infinity & !rhs_infinity) { - result = (p2, JTranscript::new()); + result = (p2, JTranscript::__new()); } else if (rhs_infinity & !lhs_infinity) { - result = (self, JTranscript::new()); + result = (self, JTranscript::__new()); } result // let (_, PP): (BigNum, BigNum ) = BigNum::__compute_quadratic_expression([[U2, U1]], [[false, true]], [[U2, U1]], [[false, true]], [], []); @@ -330,7 +330,7 @@ impl CurveJ where BigNum: BigNumTrait, * @note This method minimizes the number of calls to `compute_quadratic_expression`, * which is NOT the same as minimizing the number of multiplications. **/ - unconstrained fn incomplete_add(self, p2: Self) -> (Self, JTranscript) { + unconstrained fn __incomplete_add(self, p2: Self) -> (Self, JTranscript) { // TODO: once we have linear expressions as unconstrained fns, replace this with something that has no addmods, submods let X1 = self.x; let X2 = p2.x; @@ -395,7 +395,7 @@ impl CurveJ where BigNum: BigNumTrait, * @note This method minimizes the number of calls to `compute_quadratic_expression`, * which is NOT the same as minimizing the number of multiplications. **/ - unconstrained fn dbl(self) -> (Self, JTranscript) { + unconstrained fn __dbl(self) -> (Self, JTranscript) { let X1 = self.x; let Y1 = self.y; let Z1 = self.z; @@ -464,45 +464,45 @@ impl CurveJ where BigNum: BigNumTrait, /** * @brief Perform an ecc scalar multiplication and output the generated AffineTranscript **/ - unconstrained fn mul(self, scalar: ScalarField) -> (Self, [AffineTranscript]) { + unconstrained fn __mul(self, scalar: ScalarField) -> (Self, [AffineTranscript]) { let mut transcript: [JTranscript] = &[]; let input: Self = CurveJ::conditional_select(CurveJ::one(), self, self.is_infinity); let scalar: ScalarField = ScalarField::conditional_select(ScalarField::zero(), scalar, self.is_infinity); - let T = PointTable::new(input); + let T = PointTable::__new(input); for i in 0..8 { transcript = transcript.push_back(T.transcript[i]); } let mut accumulator: Self = CurveJ::offset_generator(); - let op = accumulator.incomplete_add(T.get(scalar.base4_slices[0])); + let op = accumulator.__incomplete_add(T.__get(scalar.base4_slices[0])); transcript = transcript.push_back(op.1); accumulator = op.0; for i in 1..NScalarSlices { for _ in 0..4 { - let op = accumulator.dbl(); + let op = accumulator.__dbl(); accumulator = op.0; transcript = transcript.push_back(op.1); } - let op = accumulator.incomplete_add(T.get(scalar.base4_slices[i])); + let op = accumulator.__incomplete_add(T.__get(scalar.base4_slices[i])); transcript = transcript.push_back(op.1); accumulator = op.0; } if scalar.skew { - let op = accumulator.incomplete_add(input.neg()); + let op = accumulator.__incomplete_add(input.__neg()); transcript = transcript.push_back(op.1); accumulator = op.0; } else { - transcript = transcript.push_back(JTranscript::new()); + transcript = transcript.push_back(JTranscript::__new()); } - let op = accumulator.sub(CurveJ::offset_generator_final()); + let op = accumulator.__sub(CurveJ::offset_generator_final()); transcript = transcript.push_back(op.1); accumulator = op.0; - let affine_transcript: [AffineTranscript] = AffineTranscript::from_jacobian_transcript(transcript); + let affine_transcript: [AffineTranscript] = AffineTranscript::__from_jacobian_transcript(transcript); (accumulator, affine_transcript) } @@ -510,14 +510,14 @@ impl CurveJ where BigNum: BigNumTrait, /** * @brief Perform an ecc scalar multiplication and output the generated AffineTranscript **/ - unconstrained fn msm_partial( + unconstrained fn __msm_partial( mut points: [Self; Size], mut scalars: [ScalarField; Size] ) -> (Self, [JTranscript]) { let mut transcript: [JTranscript] = &[]; let mut tables: [PointTable; Size] = [PointTable::empty(); Size]; - let mut _inputs: [Self; Size] = [CurveJ::new(); Size]; + let mut _inputs: [Self; Size] = [CurveJ::__new(); Size]; let mut _scalars: [ScalarField; Size] = [ScalarField::new(); Size]; for i in 0..Size { _inputs[i] = CurveJ::conditional_select(CurveJ::one(), points[i], points[i].is_infinity); @@ -527,30 +527,30 @@ impl CurveJ where BigNum: BigNumTrait, scalars = _scalars; for i in 0..Size { - tables[i] = PointTable::new(points[i]); + tables[i] = PointTable::__new(points[i]); for j in 0..8 { transcript = transcript.push_back(tables[i].transcript[j]); } } let mut accumulator: Self = CurveJ::offset_generator(); - let op = accumulator.incomplete_add(tables[0].get(scalars[0].base4_slices[0])); + let op = accumulator.__incomplete_add(tables[0].__get(scalars[0].base4_slices[0])); transcript = transcript.push_back(op.1); accumulator = op.0; for i in 1..Size { - let op = accumulator.incomplete_add(tables[i].get(scalars[i].base4_slices[0])); + let op = accumulator.__incomplete_add(tables[i].__get(scalars[i].base4_slices[0])); transcript = transcript.push_back(op.1); accumulator = op.0; } for i in 1..NScalarSlices { for _ in 0..4 { - let op = accumulator.dbl(); + let op = accumulator.__dbl(); accumulator = op.0; transcript = transcript.push_back(op.1); } for j in 0..Size { - let op = accumulator.incomplete_add(tables[j].get(scalars[j].base4_slices[i])); + let op = accumulator.__incomplete_add(tables[j].__get(scalars[j].base4_slices[i])); transcript = transcript.push_back(op.1); accumulator = op.0; } @@ -558,11 +558,11 @@ impl CurveJ where BigNum: BigNumTrait, for i in 0..Size { if scalars[i].skew { - let op = accumulator.incomplete_add(points[i].neg()); + let op = accumulator.__incomplete_add(points[i].__neg()); transcript = transcript.push_back(op.1); accumulator = op.0; } else { - transcript = transcript.push_back(JTranscript::new()); + transcript = transcript.push_back(JTranscript::__new()); } } // let op = accumulator.sub(CurveJ::offset_generator_final()); @@ -576,26 +576,26 @@ impl CurveJ where BigNum: BigNumTrait, /** * @brief Perform an ecc scalar multiplication and output the generated AffineTranscript **/ - unconstrained fn msm( + unconstrained fn __msm( mut points: [Self; Size], mut scalars: [ScalarField; Size] ) -> (Self, [AffineTranscript]) { - let mut (accumulator, transcript) = CurveJ::msm_partial(points, scalars); - let op = accumulator.sub(CurveJ::offset_generator_final()); + let mut (accumulator, transcript) = CurveJ::__msm_partial(points, scalars); + let op = accumulator.__sub(CurveJ::offset_generator_final()); transcript = transcript.push_back(op.1); accumulator = op.0; - let affine_transcript: [AffineTranscript] = AffineTranscript::from_jacobian_transcript(transcript); + let affine_transcript: [AffineTranscript] = AffineTranscript::__from_jacobian_transcript(transcript); (accumulator, affine_transcript) } - unconstrained fn compute_linear_expression_transcript( + unconstrained fn __compute_linear_expression_transcript( mul_points: [BigCurve; NMuls], mul_scalars: [ScalarField; NMuls], add_points: [BigCurve; NAdds] ) -> AffineLinearExpressionTranscript { - let mut mul_j: [CurveJ; NMuls] = [CurveJ::new(); NMuls]; - let mut add_j: [CurveJ; NAdds] = [CurveJ::new(); NAdds]; + let mut mul_j: [CurveJ; NMuls] = [CurveJ::__new(); NMuls]; + let mut add_j: [CurveJ; NAdds] = [CurveJ::__new(); NAdds]; for i in 0..NMuls { mul_j[i] = CurveJ::from(mul_points[i]); } @@ -604,18 +604,18 @@ impl CurveJ where BigNum: BigNumTrait, } let mut jacobian_transcript: LinearExpressionTranscript = LinearExpressionTranscript { - table_transcript: [[JTranscript::new(); 8]; NMuls], - msm_double_transcript: [[JTranscript::new(); 4]; NScalarSlices], - msm_add_transcript: [[JTranscript::new(); NMuls]; NScalarSlices], - skew_transcript: [JTranscript::new(); NMuls], - add_transcript: [JTranscript::new(); NAdds], - offset_generator_transcript: JTranscript::new() + table_transcript: [[JTranscript::__new(); 8]; NMuls], + msm_double_transcript: [[JTranscript::__new(); 4]; NScalarSlices], + msm_add_transcript: [[JTranscript::__new(); NMuls]; NScalarSlices], + skew_transcript: [JTranscript::__new(); NMuls], + add_transcript: [JTranscript::__new(); NAdds], + offset_generator_transcript: JTranscript::__new() }; // ##### let mut tables: [PointTable; NMuls] = [PointTable::empty(); NMuls]; - let mut _inputs: [Self; NMuls] = [CurveJ::new(); NMuls]; + let mut _inputs: [Self; NMuls] = [CurveJ::__new(); NMuls]; let mut _scalars: [ScalarField; NMuls] = [ScalarField::new(); NMuls]; for i in 0..NMuls { _inputs[i] = CurveJ::conditional_select(CurveJ::one(), mul_j[i], mul_j[i].is_infinity); @@ -625,30 +625,30 @@ impl CurveJ where BigNum: BigNumTrait, let scalars = _scalars; for i in 0..NMuls { - tables[i] = PointTable::new(points[i]); + tables[i] = PointTable::__new(points[i]); for j in 0..8 { jacobian_transcript.table_transcript[i][j] = tables[i].transcript[j]; } } let mut accumulator: Self = CurveJ::offset_generator(); - let op = accumulator.incomplete_add(tables[0].get(scalars[0].base4_slices[0])); + let op = accumulator.__incomplete_add(tables[0].__get(scalars[0].base4_slices[0])); jacobian_transcript.msm_add_transcript[0][0] = op.1; accumulator = op.0; for i in 1..NMuls { - let op = accumulator.incomplete_add(tables[i].get(scalars[i].base4_slices[0])); + let op = accumulator.__incomplete_add(tables[i].__get(scalars[i].base4_slices[0])); jacobian_transcript.msm_add_transcript[0][i] = op.1; accumulator = op.0; } for i in 1..NScalarSlices { for j in 0..4 { - let op = accumulator.dbl(); + let op = accumulator.__dbl(); accumulator = op.0; jacobian_transcript.msm_double_transcript[i][j] = op.1; } for j in 0..NMuls { - let op = accumulator.incomplete_add(tables[j].get(scalars[j].base4_slices[i])); + let op = accumulator.__incomplete_add(tables[j].__get(scalars[j].base4_slices[i])); jacobian_transcript.msm_add_transcript[i][j] = op.1; accumulator = op.0; } @@ -656,7 +656,7 @@ impl CurveJ where BigNum: BigNumTrait, for i in 0..NMuls { if scalars[i].skew { - let op = accumulator.incomplete_add(points[i].neg()); + let op = accumulator.__incomplete_add(points[i].__neg()); jacobian_transcript.skew_transcript[i] = op.1; accumulator = op.0; } else { @@ -665,12 +665,12 @@ impl CurveJ where BigNum: BigNumTrait, } for i in 0..NAdds { - let op = accumulator.incomplete_add(add_j[i]); + let op = accumulator.__incomplete_add(add_j[i]); jacobian_transcript.add_transcript[i] = op.1; accumulator = op.0; } - let op = accumulator.sub(CurveJ::offset_generator_final()); + let op = accumulator.__sub(CurveJ::offset_generator_final()); jacobian_transcript.offset_generator_transcript = op.1; accumulator = op.0; @@ -742,36 +742,36 @@ impl AffineLine let mut it = 0; for i in 0..NMuls { for j in 0..8 { - result.table_transcript[i][j] = AffineTranscript::from_j_with_hint(jtranscript.table_transcript[i][j], inverses[it]); + result.table_transcript[i][j] = AffineTranscript::__from_j_with_hint(jtranscript.table_transcript[i][j], inverses[it]); it+=1; } } for i in 0..NMuls { - result.msm_add_transcript[0][i] = AffineTranscript::from_j_with_hint(jtranscript.msm_add_transcript[0][i], inverses[it]); + result.msm_add_transcript[0][i] = AffineTranscript::__from_j_with_hint(jtranscript.msm_add_transcript[0][i], inverses[it]); it+=1; } for i in 1..NScalarSlices { for j in 0..4 { - result.msm_double_transcript[i][j] = AffineTranscript::from_j_with_hint(jtranscript.msm_double_transcript[i][j], inverses[it]); + result.msm_double_transcript[i][j] = AffineTranscript::__from_j_with_hint(jtranscript.msm_double_transcript[i][j], inverses[it]); it+=1; } for j in 0..NMuls { - result.msm_add_transcript[i][j] = AffineTranscript::from_j_with_hint(jtranscript.msm_add_transcript[i][j], inverses[it]); + result.msm_add_transcript[i][j] = AffineTranscript::__from_j_with_hint(jtranscript.msm_add_transcript[i][j], inverses[it]); it+=1; } } for i in 0..NMuls { - result.skew_transcript[i] = AffineTranscript::from_j_with_hint(jtranscript.skew_transcript[i], inverses[it]); + result.skew_transcript[i] = AffineTranscript::__from_j_with_hint(jtranscript.skew_transcript[i], inverses[it]); it+=1; } for i in 0..NAdds { - result.add_transcript[i] = AffineTranscript::from_j_with_hint(jtranscript.add_transcript[i], inverses[it]); + result.add_transcript[i] = AffineTranscript::__from_j_with_hint(jtranscript.add_transcript[i], inverses[it]); it+=1; } - result.offset_generator_transcript = AffineTranscript::from_j_with_hint(jtranscript.offset_generator_transcript, inverses[it]); + result.offset_generator_transcript = AffineTranscript::__from_j_with_hint(jtranscript.offset_generator_transcript, inverses[it]); result } @@ -780,7 +780,7 @@ impl AffineLine impl LinearExpressionTranscript where BigNum: BigNumTrait { // TODO: this should probably be in bignum - unconstrained pub fn batch_invert(x: &mut [BigNum]) where BigNum: BigNumTrait { + unconstrained pub fn __batch_invert(x: &mut [BigNum]) { let mut accumulator: BigNum = BigNum::one(); let mut temporaries: [BigNum] = &[]; diff --git a/src/curves.nr b/src/curves.nr new file mode 100644 index 0000000..9814094 --- /dev/null +++ b/src/curves.nr @@ -0,0 +1,2 @@ +mod bls12_381; +mod bn254; diff --git a/src/curves/bls12_381.nr b/src/curves/bls12_381.nr new file mode 100644 index 0000000..118e92d --- /dev/null +++ b/src/curves/bls12_381.nr @@ -0,0 +1,540 @@ +use dep::bignum::{ + BigNum, + fields::{ + bls12_381Fq::BLS12_381_Fq_Params, bls12_381Fr::BLS12_381_Fr_Params + } +}; + +use crate::BigCurve; +use crate::CurveParamsTrait; + +use crate::curve_jac; +use crate::curve_jac::JTranscript; +use crate::curve_jac::AffineTranscript; +use crate::curve_jac::CurveJ; +use crate::scalar_field::ScalarField; +use crate::PointTable; + + +type Fq = BigNum<4, BLS12_381_Fq_Params>; +type Fr = BigNum<3, BLS12_381_Fr_Params>; + +struct BLS12_381_Curve_Params { +} + +impl CurveParamsTrait> for BLS12_381_Curve_Params { + // Generator: + // https://github.com/zcash/librustzcash/blob/6e0364cd42a2b3d2b958a54771ef51a8db79dd29/pairing/src/bls12_381/README.md#generators + // https://hackmd.io/@benjaminion/bls12-381#Generators + fn one() -> [BigNum<4, BLS12_381_Fq_Params>; 2] { + [ + BigNum { limbs: [0x55e83ff97a1aeffb3af00adb22c6bb, 0x8c4f9774b905a14e3a3f171bac586c, 0xa73197d7942695638c4fa9ac0fc368, 0x17f1d3] }, + BigNum { limbs: [0x3cc744a2888ae40caa232946c5e7e1, 0xe095d5d00af600db18cb2c04b3edd0, 0x81e3aaa0f1a09e30ed741d8ae4fcf5, 0x8b3f4] } + ] + } + + // TODO: See sage for derivation `BLS12_381_E.gens()`. It's perhaps not the best "nothing up my sleeve" generator, but it is on the curve, and works for now... + fn offset_generator() -> [BigNum<4, BLS12_381_Fq_Params>; 2] { + [ + BigNum { limbs: [0x442fbd0ad62391acc555c722aea803, 0x874b86b63ecf19360c2b6d0929bb71, 0x78bb8da22c7570f7dc170e554d728b, 0x38e40] }, + BigNum { limbs: [0x2ea24532fc73e4d7584bb0fa458df4, 0xc92ed9753fb9e1b8819f3a605248e5, 0x8b7b998bb4f0c34146feb9d46b28ef, 0xbec32] } + ] + } + + fn offset_generator_final() -> [BigNum<4, BLS12_381_Fq_Params>; 2] { + [ + BigNum { limbs: [0xbf1e24769d991bf33870bd69d363ea, 0x2b423528162b0d76359c3da6ca2eea, 0xee96e3f32399f07455b37847f7acd5, 0x43fdb] }, + BigNum { limbs: [0x25925f2a055349541935f8c7a32590, 0xb37639973145c0eff2ffab0b9cbbf3, 0x8cb4e9e6329b89a2c7ab6063948b68, 0x1168d5] } + ] + } + + fn a() -> BigNum<4, BLS12_381_Fq_Params> { + BigNum { limbs: [0,0,0,0]} + } + + fn b() -> BigNum<4, BLS12_381_Fq_Params> { + BigNum { limbs: [4,0,0,0]} + } +} + +type BLS12_381_Point = BigCurve; +type BLS12_381_Point_J = CurveJ; + +fn main(x: Field) { + let mut foo: [Field; 8] = [0; 8]; + foo[0] = x; + for i in 1..8 { + foo[i] = foo[i-1]* x; + } + let P: BLS12_381_Point = BigCurve { + x: BigNum { limbs: [foo[0], foo[1], foo[2], foo[3]] }, + y: BigNum { limbs: [foo[4], foo[5], foo[6], foo[7]] }, + is_infinity: false + }; + + // 255-bit scalar field for BLS12_381 => 64 nibbles. + let scalar: ScalarField<64> = ScalarField::from(x); // p - 2 ? + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); + // 30768 + // 31020 + let mut A = P; + for i in 0..101 { + for j in 0..3 { + std::as_witness(transcript[i].lambda.limbs[j]); + std::as_witness(transcript[i].x3.limbs[j]); + std::as_witness(transcript[i].y3.limbs[j]); + } + A = A.double_with_hint(transcript[i]); + } + // println(f"{A}"); + // let result = P.mul_with_hint(scalar, transcript); + // // -2 + // let mut expected: BLS12_381_Point = BigCurve { + // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, + // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } + // }; + // expected.y = BigNum::new() - expected.y; + // assert(result == expected); + // let scalar2: ScalarField<64> = ScalarField::from(x * x); // p - 2 ? + // let transcript2 = __get_mul_transcript(CurveJ { x: Q.x, y: Q.y, z: BigNum::one() }, scalar); + // let result = Q.mul_with_hint(scalar2, transcript2); + // // -2 + // let mut expected: BLS12_381_Point = BigCurve { + // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, + // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } + // }; + // expected.y = BigNum::new() - expected.y; + // assert(result.x.eq(expected.x)); + // assert(result.y.eq(expected.y)); +} + +unconstrained fn evaluate_mul( + P: BLS12_381_Point_J, + scalar: ScalarField<64>, + Q: BLS12_381_Point_J, + K: BLS12_381_Point_J +) -> bool { + let s = (P.__mul(scalar)); + assert(s.0.eq(K.__neg())); + Q.eq(s.0) +} + +unconstrained fn get_msm_transcript( + P: BLS12_381_Point_J, + Q: BLS12_381_Point_J, + scalar1: ScalarField<64>, + scalar2: ScalarField<64> +) -> [AffineTranscript; 399] { + let s = (CurveJ::__msm([P, Q], [scalar1, scalar2])); + let ff = s.1; + // println(f"let transcript: AffineTranscript = {ff}"); + ff.as_array() +} + +unconstrained fn __get_mul_transcript( + P: BLS12_381_Point_J, + scalar: ScalarField<64> +) -> [AffineTranscript; 326] { + let res = P.__mul(scalar); + let transcript = res.1; + // println(f"let transcript: AffineTranscript = {transcript}"); + // let ff = transcript.len(); + // println(f"transcript len = {ff}"); + transcript.as_array() +} + +#[test] +fn test_mul() { + let P: BLS12_381_Point = BigCurve::one(); + + let scalar_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let scalar: ScalarField<64> = ScalarField::from_bignum(scalar_fr); // r - 2 + + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); + + let result = P.mul_with_hint(scalar, transcript); + + // -2 + let mut expected: BLS12_381_Point = BigCurve { + x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, + y: BigNum { limbs: [0x552629e43d42e3ff7877e6868b0d83, 0xcb96d142e5d6ff5199ed9511eb9d2, 0x5d8db972f7281e0142cbae1e9f41bd, 0x39674] }, + is_infinity: false + }; + expected.y = BigNum::new() - expected.y; + assert(result.x.eq(expected.x)); + assert(result.y.eq(expected.y)); +} + +#[test] +fn test_offset_foo() { + let P: BLS12_381_Point = BigCurve::offset_generator_final(); // It can be any point, really. + + let R: BLS12_381_Point = P.sub(P); + // println(f"R = {R}"); + assert(R.is_infinity == true); +} + +#[test] +fn test_mul_by_0() { + let P: BLS12_381_Point = BigCurve::one(); + + let scalar: ScalarField<64> = ScalarField::from(0); // p - 2 + + let foo: Field = ScalarField::into(scalar); + assert(foo == 0); + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); + + let result = P.mul_with_hint(scalar, transcript); + // println(f"RESULT = {result}"); + // -2 + assert(result.is_infinity == true); +} + +#[test] +fn test_mul_a_point_at_infinity() { + let P: BLS12_381_Point = BigCurve::point_at_infinity(); + + let scalar: ScalarField<64> = ScalarField::from(0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff); // p - 2 + + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); + + let result = P.mul_with_hint(scalar, transcript); + // println(f"RESULT = {result}"); + // -2 + assert(result.is_infinity == true); +} + +// // N.B. cannot test because stack too deep! +// #[test] +// fn test_linear_expression() { +// let One: BLS12_381_Point = BigCurve::one(); +// let Two: BLS12_381_Point = BigCurve { +// x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, +// y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, +// is_infinity: false +// }; + +// let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // p - 2 +// let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // p - 6 +// let scalar2: ScalarField<64> = ScalarField::from(p_minus_2); +// let scalar6: ScalarField<64> = ScalarField::from(p_minus_6); + +// let result = BigCurve::evaluate_linear_expression([One], [scalar2], []); +// let expected = Two.neg(); +// assert(result == expected); +// } + +// // N.B. cannot test because stack too deep! +// #[test] +// fn test_msm() { +// let One: BLS12_381_Point = BigCurve::one(); +// let Two: BLS12_381_Point = BigCurve { +// x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, +// y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, +// is_infinity: false +// }; + +// let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // p - 2 +// let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // p - 6 +// let scalar2: ScalarField<64> = ScalarField::from(p_minus_2); +// let scalar6: ScalarField<64> = ScalarField::from(p_minus_6); + +// let transcript = get_msm_transcript(CurveJ::from(One), CurveJ::from(Two), scalar6, scalar2); +// let result = BigCurve::msm_with_hint([One, Two.neg()], [scalar6, scalar2], transcript); +// let expected = Two.neg(); +// assert(result == expected); +// } + +#[test] +fn test_mul_jac() { + let scalar_multiplier = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000000; // p - 1 + let P: BLS12_381_Point_J = CurveJ::one(); + + let scalar: ScalarField<64> = ScalarField::from(scalar_multiplier); + + let expected = P.__incomplete_add(P.__dbl().0.__neg()).0; + let result = evaluate_mul(P, scalar, expected, P); + assert(result == true); +} + +unconstrained fn test_msm_jac_impl(scalars: [ScalarField<64>; 2]) { + let One: BLS12_381_Point_J = CurveJ::one(); + let Two: BLS12_381_Point_J = CurveJ { + x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, + y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + z: BigNum::one(), + is_infinity: false + }; + let result = CurveJ::__msm([One, Two.__neg()], scalars); + let expected = Two.__neg(); + assert(result.0 == expected); +} + +#[test] +fn test_msm_jac() { + let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // p - 2 + let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // p - 6 + let scalar2: ScalarField<64> = ScalarField::from(p_minus_2); + let scalar6: ScalarField<64> = ScalarField::from(p_minus_6); + + test_msm_jac_impl([scalar6, scalar2]); +} + +#[test] +fn test_add_dbl() { + let P: BLS12_381_Point_J = CurveJ::one(); + let lhs = ((P.__dbl().0).__dbl()).0; + let rhs = P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0; + assert(lhs == rhs); +} + +#[test] +fn test_transcript() { + let P: BLS12_381_Point_J = CurveJ::one(); + + let P2 = P.__dbl(); + + let Z_inverse = P2.1.z3.__invmod(); + + let lambda = P2.1.lambda_numerator.__mul(Z_inverse); + + let lhs = (lambda.__add(lambda)).__mul(P.y); + let rhs = (P.x.__add(P.x).__add(P.x)).__mul(P.x); + + assert(lhs.eq(rhs)); + + let X2 = P2.1.x3; + let Y2 = P2.1.y3; + let ZZ = Z_inverse.__mul(Z_inverse); + let ZZZ = ZZ.__mul(Z_inverse); + + let x2 = X2.__mul(ZZ); + let y2 = Y2.__mul(ZZZ); + + // ### test add transcript + let P3 = P.__incomplete_add(P2.0); + let Z_inverse = P3.1.z3.__invmod(); + + let lambda = P3.1.lambda_numerator.__mul(Z_inverse); + + let x1 = P.x; + let y1 = P.y; + + let lhs = lambda.__mul(x2.__sub(x1)); + let rhs = y2.__sub(y1); + assert(lhs.eq(rhs)); +} + +#[test] +fn test_double_with_hint() { + let P: BLS12_381_Point_J = CurveJ::one(); + + let P2 = P.__dbl(); + + let P_affine: BLS12_381_Point = BigCurve::one(); + + let Z_inverse = P2.1.z3.__invmod(); + + let lambda = P2.1.lambda_numerator.__mul(Z_inverse); + + let X3 = P2.1.x3; + let Y3 = P2.1.y3; + let ZZ = Z_inverse.__mul(Z_inverse); + let ZZZ = ZZ.__mul(Z_inverse); + + let x3 = X3.__mul(ZZ); + let y3 = Y3.__mul(ZZZ); + + let transcript: AffineTranscript = AffineTranscript { lambda, x3, y3 }; + let P2_affine = P_affine.double_with_hint(transcript); + + assert(P2_affine.x.eq(x3)); + assert(P2_affine.y.eq(y3)); +} + +#[test] +fn test_incomplete_add_with_hint() { + let P: BLS12_381_Point_J = CurveJ::one(); + + // Q = 2P + let Q_affine: BLS12_381_Point = BigCurve { + x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, + y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + is_infinity: false + }; + let Q = CurveJ::from(Q_affine); + let R = P.__incomplete_add(Q); + + let P_affine: BLS12_381_Point = BigCurve::one(); + + let Z_inverse = R.1.z3.__invmod(); + + let lambda = R.1.lambda_numerator.__mul(Z_inverse); + + let X3 = R.1.x3; + let Y3 = R.1.y3; + let ZZ = Z_inverse.__mul(Z_inverse); + let ZZZ = ZZ.__mul(Z_inverse); + + let x3 = X3.__mul(ZZ); + let y3 = Y3.__mul(ZZZ); + + let transcript: AffineTranscript = AffineTranscript { lambda, x3, y3 }; + let P2_affine = P_affine.incomplete_add_with_hint(Q_affine, transcript); + + assert(P2_affine.x.eq(x3)); + assert(P2_affine.y.eq(y3)); + + let P: BLS12_381_Point_J = CurveJ::one(); + + let lhs = P.__dbl().0.__dbl().0; + let rhs = P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0; + assert(lhs.eq(rhs)); +} + +#[test] +fn test_add() { + let mut P: BLS12_381_Point = BigCurve::one(); + + // Two_P = 2P + let mut Two_P: BLS12_381_Point = BigCurve { + x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, + y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + is_infinity: false + }; + + let mut result = CurveJ::from(P.add(Two_P)); // 3P_j + + let P_j = CurveJ::from(P); + let Two_P_j = CurveJ::from(Two_P); + let mut expected = P_j.__add(Two_P_j).0; // 3P_j + + assert(result.eq(expected)); + + // doubling + let Q: BLS12_381_Point = BigCurve::one(); // P + + // THIS DOUBLING BREAKS!!! + result = CurveJ::from(P.add(Q)); // 2P_j + expected = P_j.__dbl().0; // 2P_j + assert(result.eq(expected)); + + // infinity + let Neg_P = P.neg(); + result = CurveJ::from(P.add(Neg_P)); // 0_j + expected = CurveJ::__point_at_infinity(); + assert(result.eq(expected)); + + // lhs infinity + let Inf: BLS12_381_Point = BigCurve::point_at_infinity(); + result = CurveJ::from(Inf.add(Neg_P)); + expected = CurveJ::from(Neg_P); + assert(result.eq(expected)); + + // rhs infinity + result = CurveJ::from(Neg_P.add(Inf)); + assert(result.eq(expected)); + + // both infinity + let Inf2: BLS12_381_Point = BigCurve::point_at_infinity(); + result = CurveJ::from(Inf.add(Inf2)); + expected = CurveJ::__point_at_infinity(); + assert(result.eq(expected)); +} + +#[test] +fn test_sub() { + let P: BLS12_381_Point = BigCurve::one(); + + let Two_P: BLS12_381_Point = BigCurve { + x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, + y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + is_infinity: false + }; + + let result = CurveJ::from(P.sub(Two_P)); + + let P_j = CurveJ::from(P); + let Two_P_j = CurveJ::from(Two_P); + let expected = P_j.__sub(Two_P_j).0; + + assert(result.eq(expected)); + + // doubling + let Q: BLS12_381_Point = BigCurve::one(); // P + + let result = CurveJ::from(P.sub(Q.neg())); + let expected = P_j.__dbl().0; + assert(result.eq(expected)); + + // infinity + let result = CurveJ::from(P.sub(Q)); + let expected = CurveJ::__point_at_infinity(); + assert(result.eq(expected)); + + // lhs infinity + let P: BLS12_381_Point = BigCurve::point_at_infinity(); + let result = CurveJ::from(P.sub(Q)); + let expected = CurveJ::from(Q.neg()); + assert(result.eq(expected)); + + // rhs infinity + let result = CurveJ::from(Q.sub(P)); + let expected = expected.__neg(); + assert(result.eq(expected)); + + // both infinity + let Q: BLS12_381_Point = BigCurve::point_at_infinity(); + let result = CurveJ::from(Q.sub(P)); + let expected = CurveJ::__point_at_infinity(); + assert(result.eq(expected)); +} + +#[test] +fn test_make_table() { + let P: BLS12_381_Point_J = CurveJ::one(); + + let mut transcript: [JTranscript] = &[]; + let T: curve_jac::PointTable = curve_jac::PointTable::__new(P); + for i in 0..8 { + transcript = transcript.push_back(T.transcript[i]); + } + + let mut inverses: [Fq; 8] = [BigNum::new(); 8]; + + for i in 0..8 { + inverses[i] = transcript[i].z3; + } + + inverses = BigNum::__batch_invert(inverses); + + let mut affine_transcript: [AffineTranscript; 8] = [AffineTranscript::new(); 8]; + for i in 0..8 { + let z_inv = inverses[i]; + + let lambda = transcript[i].lambda_numerator.__mul(z_inv); + let zz = z_inv.__mul(z_inv); + let zzz = zz.__mul(z_inv); + let x3 = transcript[i].x3.__mul(zz); + let y3 = transcript[i].y3.__mul(zzz); + affine_transcript[i] = AffineTranscript{ lambda, x3, y3 }; + } + + let P_affine: BLS12_381_Point = BigCurve::one(); + + let affine_point_table: PointTable = PointTable::new_with_hint(P_affine, affine_transcript); + + for i in 0..8 { + let point: BLS12_381_Point = affine_point_table.get(i); + point.validate_on_curve(); + } +} + +// #[test] +// fn test_ScalarField_BigNum_conversion() { +// assert(BNParams::modulus_bits() == 254); +// let expected: Fq = BigNum::__derive_from_seed([1, 2, 3, 4]); +// let scalar: ScalarField<64> = ScalarField::from_bignum(expected); +// let result: Fq = scalar.into_bignum(); +// assert(result.limbs == expected.limbs); +// } diff --git a/src/bigcurve_test.nr b/src/curves/bn254.nr similarity index 68% rename from src/bigcurve_test.nr rename to src/curves/bn254.nr index cfb866d..273285f 100644 --- a/src/bigcurve_test.nr +++ b/src/curves/bn254.nr @@ -1,4 +1,4 @@ -use dep::bignum::BigNum; +use dep::bignum::{BigNum, fields::bn254Fq::BNParams as BN254_Fq_Params}; use crate::BigCurve; use crate::CurveParamsTrait; @@ -10,14 +10,13 @@ use crate::curve_jac::CurveJ; use crate::scalar_field::ScalarField; use crate::PointTable; -use dep::bignum::fields::bn254Fq::BNParams as BNParams; +type Fq = BigNum<3, BN254_Fq_Params>; -type Fq = BigNum<3, BNParams>; - -struct BN254Params { +struct BN254_Curve_Params { } -impl CurveParamsTrait> for BN254Params { - fn one() -> [BigNum<3, BNParams>; 2] { + +impl CurveParamsTrait> for BN254_Curve_Params { + fn one() -> [BigNum<3, BN254_Fq_Params>; 2] { let mut one: Fq = BigNum::new(); one.limbs[0] = 1; let mut two = one; @@ -25,46 +24,50 @@ impl CurveParamsTrait> for BN254Params { [one, two] } - fn offset_generator() -> [BigNum<3, BNParams>; 2] { + // hash some unique string into an ecc point like “BLS12-381 Offset Generator” + fn offset_generator() -> [BigNum<3, BN254_Fq_Params>; 2] { [ BigNum { limbs: [0xf30f376a22bd3695abf4dcdfed66c6, 0x80d7bbcaebb13bbabfc30184f59912, 0x0cfb] }, BigNum { limbs: [0xe53572d644c1e06f80ab52ef02fa2f, 0xa40d9e20debde026e47f8bfc4d3c41, 0x07f6] } ] } - fn offset_generator_final() -> [BigNum<3, BNParams>; 2] { + // offset_generator_final = offset_generator * 2^((NScalarSlices - 1) * 4) + // we hardcode NScalarSlices to 64 so it’s offset_generator * (2^252) + // i.e. it’s the offset_generator once it’s been passed through an MSM + fn offset_generator_final() -> [BigNum<3, BN254_Fq_Params>; 2] { [ BigNum { limbs: [0x0b672a3489895d47157f096e077348, 0x29f5f5b786660171ae9ad36f6db594, 0x15f1] }, BigNum { limbs: [0x6e4553aa3ae998fcd27ca8a17188ef, 0xb3193f7f0a731913174831ca905feb, 0x21ff] } ] } - fn b() -> BigNum<3, BNParams> { - BigNum { limbs: [3,0,0]} + fn a() -> BigNum<3, BN254_Fq_Params> { + BigNum { limbs: [0,0,0]} } - fn a() -> BigNum<3, BNParams> { - BigNum { limbs: [0,0,0]} + fn b() -> BigNum<3, BN254_Fq_Params> { + BigNum { limbs: [3,0,0]} } } -type BN254 = BigCurve; -type BN254J = CurveJ; +type BN254_Point = BigCurve; +type BN254_Point_J = CurveJ; fn main(x: Field) { - let mut foo: [Field; 12] = [0; 12]; + let mut foo: [Field; 6] = [0; 6]; foo[0] = x; - for i in 1..12 { - foo[i] = foo[i-1]* x; + for i in 1..6 { + foo[i] = foo[i-1] * x; } - let P: BN254 = BigCurve { + let P: BN254_Point = BigCurve { x: BigNum { limbs: [foo[0], foo[1], foo[2]] }, y: BigNum { limbs: [foo[3], foo[4], foo[5]] }, is_infinity: false }; let scalar: ScalarField<64> = ScalarField::from(x); // p - 2 ? - let transcript = get_transcript(CurveJ::from(P), scalar); + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); // 30768 // 31020 let mut A = P; @@ -79,7 +82,7 @@ fn main(x: Field) { // println(f"{A}"); // let result = P.mul_with_hint(scalar, transcript); // // -2 - // let mut expected: BN254 = BigCurve { + // let mut expected: BN254_Point = BigCurve { // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } // }; @@ -89,7 +92,7 @@ fn main(x: Field) { // let transcript2 = get_transcript(CurveJ { x: Q.x, y: Q.y, z: BigNum::one() }, scalar); // let result = Q.mul_with_hint(scalar2, transcript2); // // -2 - // let mut expected: BN254 = BigCurve { + // let mut expected: BN254_Point = BigCurve { // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } // }; @@ -98,26 +101,23 @@ fn main(x: Field) { // assert(result.y.eq(expected.y)); } -unconstrained fn evaluate_mul(P: BN254J, scalar: ScalarField<64>, Q: BN254J, K: BN254J) -> bool { - let s = (P.mul(scalar)); - assert(s.0.eq(K.neg())); - Q.eq(s.0) -} - -unconstrained fn get_msm_transcript( - P: BN254J, - Q: BN254J, +unconstrained fn __get_msm_transcript( + P: BN254_Point_J, + Q: BN254_Point_J, scalar1: ScalarField<64>, scalar2: ScalarField<64> ) -> [AffineTranscript; 399] { - let s = (CurveJ::msm([P, Q], [scalar1, scalar2])); + let s = (CurveJ::__msm([P, Q], [scalar1, scalar2])); let ff = s.1; // println(f"let transcript: AffineTranscript = {ff}"); ff.as_array() } -unconstrained fn get_transcript(P: BN254J, scalar: ScalarField<64>) -> [AffineTranscript; 326] { - let res = P.mul(scalar); +unconstrained fn __get_mul_transcript( + P: BN254_Point_J, + scalar: ScalarField<64> +) -> [AffineTranscript; 326] { + let res = P.__mul(scalar); let transcript = res.1; // println(f"let transcript: AffineTranscript = {transcript}"); // let ff = transcript.len(); @@ -127,16 +127,16 @@ unconstrained fn get_transcript(P: BN254J, scalar: ScalarField<64>) -> [AffineTr #[test] fn test_mul() { - let P: BN254 = BigCurve::one(); + let P: BN254_Point = BigCurve::one(); - let scalar: ScalarField<64> = ScalarField::from(0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff); // p - 2 + let scalar: ScalarField<64> = ScalarField::from(0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff); // r - 2 - let transcript = get_transcript(CurveJ::from(P), scalar); + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); let result = P.mul_with_hint(scalar, transcript); // -2 - let mut expected: BN254 = BigCurve { + let mut expected: BN254_Point = BigCurve { x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, is_infinity: false @@ -148,36 +148,36 @@ fn test_mul() { #[test] fn test_offset_foo() { - let P = BigCurve { + let P: BN254_Point = BigCurve { x: BigNum { limbs: [0x0b672a3489895d47157f096e077348, 0x29f5f5b786660171ae9ad36f6db594, 0x15f1] }, y: BigNum { limbs: [0x6e4553aa3ae998fcd27ca8a17188ef, 0xb3193f7f0a731913174831ca905feb, 0x21ff] }, is_infinity: false }; - let Q_inv = BigCurve { - x: BigNum { limbs: [0x0b672a3489895d47157f096e077348, 0x29f5f5b786660171ae9ad36f6db594, 0x15f1] }, - y: BigNum { limbs: [0x13253dbe36e0f43f4e0f6e370b7458, 0x9b59a1b295b69f3d2e6e4fb6c7fdac, 0x0e64] }, - is_infinity: false - }; - let Q= BigCurve { + // let Q_inv: BN254_Point = BigCurve { + // x: BigNum { limbs: [0x0b672a3489895d47157f096e077348, 0x29f5f5b786660171ae9ad36f6db594, 0x15f1] }, + // y: BigNum { limbs: [0x13253dbe36e0f43f4e0f6e370b7458, 0x9b59a1b295b69f3d2e6e4fb6c7fdac, 0x0e64] }, + // is_infinity: false + // }; + let Q: BN254_Point = BigCurve { x: BigNum { limbs: [0x0b672a3489895d47157f096e077348, 0x29f5f5b786660171ae9ad36f6db594, 0x15f1] }, y: BigNum { limbs: [0x6e4553aa3ae998fcd27ca8a17188ef, 0xb3193f7f0a731913174831ca905feb, 0x21ff] }, is_infinity: false }; - let R: BN254 = P.sub(Q); + let R: BN254_Point = P.sub(Q); // println(f"R = {R}"); assert(R.is_infinity == true); } #[test] fn test_mul_by_0() { - let P: BN254 = BigCurve::one(); + let P: BN254_Point = BigCurve::one(); - let scalar: ScalarField<64> = ScalarField::from(0); // p - 2 + let scalar: ScalarField<64> = ScalarField::from(0); // r - 2 let foo: Field = ScalarField::into(scalar); assert(foo == 0); - let transcript = get_transcript(CurveJ::from(P), scalar); + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); let result = P.mul_with_hint(scalar, transcript); // println(f"RESULT = {result}"); @@ -187,11 +187,11 @@ fn test_mul_by_0() { #[test] fn test_mul_a_point_at_infinity() { - let P: BN254 = BigCurve::point_at_infinity(); + let P: BN254_Point = BigCurve::point_at_infinity(); - let scalar: ScalarField<64> = ScalarField::from(0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff); // p - 2 + let scalar: ScalarField<64> = ScalarField::from(0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff); // r - 2 - let transcript = get_transcript(CurveJ::from(P), scalar); + let transcript = __get_mul_transcript(CurveJ::from(P), scalar); let result = P.mul_with_hint(scalar, transcript); // println(f"RESULT = {result}"); @@ -202,15 +202,15 @@ fn test_mul_a_point_at_infinity() { // // N.B. cannot test because stack too deep! // #[test] // fn test_linear_expression() { -// let One: BN254 = BigCurve::one(); -// let Two: BN254 = BigCurve { +// let One: BN254_Point = BigCurve::one(); +// let Two: BN254_Point = BigCurve { // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, // is_infinity: false // }; -// let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // p - 2 -// let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // p - 6 +// let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // r - 2 +// let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // r - 6 // let scalar2: ScalarField<64> = ScalarField::from(p_minus_2); // let scalar6: ScalarField<64> = ScalarField::from(p_minus_6); @@ -222,15 +222,15 @@ fn test_mul_a_point_at_infinity() { // // N.B. cannot test because stack too deep! // #[test] // fn test_msm() { -// let One: BN254 = BigCurve::one(); -// let Two: BN254 = BigCurve { +// let One: BN254_Point = BigCurve::one(); +// let Two: BN254_Point = BigCurve { // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, // is_infinity: false // }; -// let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // p - 2 -// let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // p - 6 +// let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // r - 2 +// let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // r - 6 // let scalar2: ScalarField<64> = ScalarField::from(p_minus_2); // let scalar6: ScalarField<64> = ScalarField::from(p_minus_6); @@ -240,54 +240,72 @@ fn test_mul_a_point_at_infinity() { // assert(result == expected); // } + +unconstrained fn __evaluate_mul( + P: BN254_Point_J, // P + s: ScalarField<64>, // -1 + neg_P: BN254_Point_J, // P + P_sub_2P: BN254_Point_J, // P - 2P +) -> bool { + let sP = (P.__mul(s)); // -P + assert(sP.0.eq(neg_P)); // -P = neg_P + P_sub_2P.eq(sP.0) // P - 2P = -P +} + #[test] fn test_mul_jac() { - let scalar_multiplier = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000000; // p - 1 - let P: BN254J = CurveJ::one(); + let scalar_multiplier = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000000; // r - 1 + let P: BN254_Point_J = CurveJ::one(); + + // -1 + let s: ScalarField<64> = ScalarField::from(scalar_multiplier); + + // P - 2P + let P_sub_2P = P.__incomplete_add(P.__dbl().0.__neg()).0; - let scalar: ScalarField<64> = ScalarField::from(scalar_multiplier); + // -P + let neg_P = P.__neg(); - let expected = P.incomplete_add(P.dbl().0.neg()).0; - let result = evaluate_mul(P, scalar, expected, P); - assert(result == true); + // Can't call `mul` in a constrained fn, because it is an unconstrained fn which returns a slice. + assert(__evaluate_mul(P, s, neg_P, P_sub_2P)); } -unconstrained fn test_msm_jac_impl(scalars: [ScalarField<64>; 2]) { - let One: BN254J = CurveJ::one(); - let Two: BN254J = CurveJ { +unconstrained fn __test_msm_jac_impl(scalars: [ScalarField<64>; 2]) { + let One: BN254_Point_J = CurveJ::one(); + let Two: BN254_Point_J = CurveJ { x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, z: BigNum::one(), is_infinity: false }; - let result = CurveJ::msm([One, Two.neg()], scalars); - let expected = Two.neg(); + let result = CurveJ::__msm([One, Two.__neg()], scalars); + let expected = Two.__neg(); assert(result.0 == expected); } #[test] fn test_msm_jac() { - let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // p - 2 - let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // p - 6 + let p_minus_2 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff; // r - 2 + let p_minus_6 = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593effffffb; // r - 6 let scalar2: ScalarField<64> = ScalarField::from(p_minus_2); let scalar6: ScalarField<64> = ScalarField::from(p_minus_6); - test_msm_jac_impl([scalar6, scalar2]); + __test_msm_jac_impl([scalar6, scalar2]); } #[test] fn test_add_dbl() { - let P: BN254J = CurveJ::one(); - let lhs = ((P.dbl().0).dbl()).0; - let rhs = P.dbl().0.incomplete_add(P).0.incomplete_add(P).0; + let P: BN254_Point_J = CurveJ::one(); + let lhs = ((P.__dbl().0).__dbl()).0; + let rhs = P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0; assert(lhs == rhs); } #[test] fn test_transcript() { - let P: BN254J = CurveJ::one(); + let P: BN254_Point_J = CurveJ::one(); - let P2 = P.dbl(); + let P2 = P.__dbl(); let Z_inverse = P2.1.z3.__invmod(); @@ -307,7 +325,7 @@ fn test_transcript() { let y2 = Y2.__mul(ZZZ); // ### test add transcript - let P3 = P.incomplete_add(P2.0); + let P3 = P.__incomplete_add(P2.0); let Z_inverse = P3.1.z3.__invmod(); let lambda = P3.1.lambda_numerator.__mul(Z_inverse); @@ -322,11 +340,11 @@ fn test_transcript() { #[test] fn test_double_with_hint() { - let P: BN254J = CurveJ::one(); + let P: BN254_Point_J = CurveJ::one(); - let P2 = P.dbl(); + let P2 = P.__dbl(); - let P_affine: BN254 = BigCurve::one(); + let P_affine: BN254_Point = BigCurve::one(); let Z_inverse = P2.1.z3.__invmod(); @@ -349,18 +367,18 @@ fn test_double_with_hint() { #[test] fn test_incomplete_add_with_hint() { - let P: BN254J = CurveJ::one(); + let P: BN254_Point_J = CurveJ::one(); // Q = 2P - let Q_affine: BN254 = BigCurve { + let Q_affine: BN254_Point = BigCurve { x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, is_infinity: false }; let Q = CurveJ::from(Q_affine); - let R = P.incomplete_add(Q); + let R = P.__incomplete_add(Q); - let P_affine: BN254 = BigCurve::one(); + let P_affine: BN254_Point = BigCurve::one(); let Z_inverse = R.1.z3.__invmod(); @@ -380,19 +398,19 @@ fn test_incomplete_add_with_hint() { assert(P2_affine.x.eq(x3)); assert(P2_affine.y.eq(y3)); - let P: BN254J = CurveJ::one(); + let P: BN254_Point_J = CurveJ::one(); - let lhs = P.dbl().0.dbl().0; - let rhs = P.dbl().0.incomplete_add(P).0.incomplete_add(P).0; + let lhs = P.__dbl().0.__dbl().0; + let rhs = P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0; assert(lhs.eq(rhs)); } #[test] fn test_add() { - let P: BN254 = BigCurve::one(); + let P: BN254_Point = BigCurve::one(); // Q = 2P - let Q: BN254 = BigCurve { + let Q: BN254_Point = BigCurve { x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, is_infinity: false @@ -402,25 +420,25 @@ fn test_add() { let P_j = CurveJ::from(P); let Q_j = CurveJ::from(Q); - let expected = P_j.add(Q_j).0; + let expected = P_j.__add(Q_j).0; assert(result.eq(expected)); // doubling - let Q: BN254 = BigCurve::one(); + let Q: BN254_Point = BigCurve::one(); let result = CurveJ::from(P.add(Q)); - let expected = P_j.dbl().0; + let expected = P_j.__dbl().0; assert(result.eq(expected)); // infinity let Q = P.neg(); let result = CurveJ::from(P.add(Q)); - let expected = CurveJ::point_at_infinity(); + let expected = CurveJ::__point_at_infinity(); assert(result.eq(expected)); // lhs infinity - let P: BN254 = BigCurve::point_at_infinity(); + let P: BN254_Point = BigCurve::point_at_infinity(); let result = CurveJ::from(P.add(Q)); let expected = CurveJ::from(Q); assert(result.eq(expected)); @@ -430,18 +448,18 @@ fn test_add() { assert(result.eq(expected)); // both infinity - let Q: BN254 = BigCurve::point_at_infinity(); + let Q: BN254_Point = BigCurve::point_at_infinity(); let result = CurveJ::from(Q.add(P)); - let expected = CurveJ::point_at_infinity(); + let expected = CurveJ::__point_at_infinity(); assert(result.eq(expected)); } #[test] fn test_sub() { - let P: BN254 = BigCurve::one(); + let P: BN254_Point = BigCurve::one(); // Q = 2P - let Q: BN254 = BigCurve { + let Q: BN254_Point = BigCurve { x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] }, is_infinity: false @@ -451,46 +469,46 @@ fn test_sub() { let P_j = CurveJ::from(P); let Q_j = CurveJ::from(Q); - let expected = P_j.sub(Q_j).0; + let expected = P_j.__sub(Q_j).0; assert(result.eq(expected)); // doubling - let Q: BN254 = BigCurve::one(); + let Q: BN254_Point = BigCurve::one(); let result = CurveJ::from(P.sub(Q.neg())); - let expected = P_j.dbl().0; + let expected = P_j.__dbl().0; assert(result.eq(expected)); // infinity let result = CurveJ::from(P.sub(Q)); - let expected = CurveJ::point_at_infinity(); + let expected = CurveJ::__point_at_infinity(); assert(result.eq(expected)); // lhs infinity - let P: BN254 = BigCurve::point_at_infinity(); + let P: BN254_Point = BigCurve::point_at_infinity(); let result = CurveJ::from(P.sub(Q)); let expected = CurveJ::from(Q.neg()); assert(result.eq(expected)); // rhs infinity let result = CurveJ::from(Q.sub(P)); - let expected = expected.neg(); + let expected = expected.__neg(); assert(result.eq(expected)); // both infinity - let Q: BN254 = BigCurve::point_at_infinity(); + let Q: BN254_Point = BigCurve::point_at_infinity(); let result = CurveJ::from(Q.sub(P)); - let expected = CurveJ::point_at_infinity(); + let expected = CurveJ::__point_at_infinity(); assert(result.eq(expected)); } #[test] fn test_make_table() { - let P: BN254J = CurveJ::one(); + let P: BN254_Point_J = CurveJ::one(); let mut transcript: [JTranscript] = &[]; - let T: curve_jac::PointTable = curve_jac::PointTable::new(P); + let T: curve_jac::PointTable = curve_jac::PointTable::__new(P); for i in 0..8 { transcript = transcript.push_back(T.transcript[i]); } @@ -515,12 +533,12 @@ fn test_make_table() { affine_transcript[i] = AffineTranscript{ lambda, x3, y3 }; } - let P_affine: BN254 = BigCurve::one(); + let P_affine: BN254_Point = BigCurve::one(); let affine_point_table: PointTable = PointTable::new_with_hint(P_affine, affine_transcript); for i in 0..8 { - let point: BN254 = affine_point_table.get(i); + let point: BN254_Point = affine_point_table.get(i); point.validate_on_curve(); } } diff --git a/src/lib.nr b/src/lib.nr index c0dd2d7..2ecedb3 100644 --- a/src/lib.nr +++ b/src/lib.nr @@ -1,7 +1,7 @@ mod scalar_field; mod curve_jac; +mod curves; mod test_data; -mod bigcurve_test; use dep::bignum::BigNum; @@ -630,16 +630,13 @@ impl BigCurve where CurveParams: Curve accumulator } - unconstrained fn get_mul_transcript( - P: Self, - scalar: ScalarField - ) -> [AffineTranscript; 326] { - CurveJ::from(P).mul(scalar).1.as_array() + unconstrained fn __get_mul_transcript(P: Self, scalar: ScalarField) -> [AffineTranscript; 326] { + CurveJ::from(P).__mul(scalar).1.as_array() } // Expensive witness generation! Avoid if possible fn mul(self, scalar: ScalarField) -> Self { - let transcript: [AffineTranscript; 326] = BigCurve::get_mul_transcript(self, scalar); + let transcript: [AffineTranscript; 326] = BigCurve::__get_mul_transcript(self, scalar); self.mul_with_hint(scalar, transcript) } @@ -649,7 +646,7 @@ impl BigCurve where CurveParams: Curve mut mul_scalars: [ScalarField; NMuls], add_points: [Self; NAdds] ) -> Self { - let affine_transcript: AffineLinearExpressionTranscript = CurveJ::compute_linear_expression_transcript(mul_points, mul_scalars, add_points); + let affine_transcript: AffineLinearExpressionTranscript = CurveJ::__compute_linear_expression_transcript(mul_points, mul_scalars, add_points); let mut _inputs: [Self; NMuls] = [BigCurve::one(); NMuls]; let mut _scalars: [ScalarField; NMuls] = [ScalarField::new(); NMuls]; @@ -716,9 +713,9 @@ impl std::ops::Add for BigCurve where // Expensive witness generation! Avoid if possible fn add(self, other: Self) -> Self { let lhsJ = CurveJ::from(self); - let rhsJ = CurveJ:: from(other); + let rhsJ = CurveJ::from(other); - let transcript = AffineTranscript::from_j(lhsJ.add(rhsJ).1); + let transcript = AffineTranscript::__from_j(lhsJ.__add(rhsJ).1); self.add_with_hint(other, transcript) } @@ -728,9 +725,9 @@ impl std::ops::Sub for BigCurve where // Expensive witness generation! Avoid if possible fn sub(self, other: Self) -> Self { let lhsJ = CurveJ::from(self); - let rhsJ = CurveJ:: from(other); + let rhsJ = CurveJ::from(other); - let transcript = AffineTranscript::from_j(lhsJ.sub(rhsJ).1); + let transcript = AffineTranscript::__from_j(lhsJ.__sub(rhsJ).1); self.sub_with_hint(other, transcript) } diff --git a/src/main.nr b/src/main.nr index 0de622a..30f0cab 100644 --- a/src/main.nr +++ b/src/main.nr @@ -1,7 +1,7 @@ mod scalar_field; mod curve_jac; +mod curves; mod test_data; -mod bigcurve_test; use dep::bignum::BigNum; @@ -12,7 +12,22 @@ use crate::curve_jac::CurveJ; use dep::bignum::BigNumTrait; fn main() { - bigcurve_test::test_mul() + // To measure bls12_381, temporarily + // let mut P: curves::bls12_381::BLS12_381_Point = BigCurve::one(); + + // let scalar_fr: curves::bls12_381::Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + + // let scalar: ScalarField<64> = ScalarField::from_bignum(scalar_fr); // r - 2 + + // for i in 0..1 { + // let transcript = curves::bls12_381::__get_mul_transcript(CurveJ::from(P), scalar); + + // P = P.mul_with_hint(scalar, transcript); + // } + + curves::bls12_381::test_mul() + // curves::bn254::test_mul() + } /** @@ -643,26 +658,26 @@ impl BigCurve where CurveParams: Curve accumulator } - unconstrained fn get_mul_transcript( + unconstrained fn __get_mul_transcript( P: Self, scalar: ScalarField - ) -> [AffineTranscript; 326] { - CurveJ::from(P).mul(scalar).1.as_array() + ) -> [AffineTranscript; 326] { + CurveJ::from(P).__mul(scalar).1.as_array() } // Expensive witness generation! Avoid if possible - fn mul(self, scalar: ScalarField) -> Self { - let transcript: [AffineTranscript; 326] = BigCurve::get_mul_transcript(self, scalar); + fn mul(self, scalar: ScalarField) -> Self { + let transcript: [AffineTranscript; 326] = BigCurve::__get_mul_transcript(self, scalar); self.mul_with_hint(scalar, transcript) } - fn evaluate_linear_expression( + fn evaluate_linear_expression( mut mul_points: [Self; NMuls], mut mul_scalars: [ScalarField; NMuls], add_points: [Self; NAdds] ) -> Self { - let affine_transcript: AffineLinearExpressionTranscript = CurveJ::compute_linear_expression_transcript(mul_points, mul_scalars, add_points); + let affine_transcript: AffineLinearExpressionTranscript = CurveJ::__compute_linear_expression_transcript(mul_points, mul_scalars, add_points); let mut _inputs: [Self; NMuls] = [BigCurve::one(); NMuls]; let mut _scalars: [ScalarField; NMuls] = [ScalarField::new(); NMuls]; @@ -731,7 +746,7 @@ impl std::ops::Add for BigCurve where let lhsJ = CurveJ::from(self); let rhsJ = CurveJ:: from(other); - let transcript = AffineTranscript::from_j(lhsJ.add(rhsJ).1); + let transcript = AffineTranscript::__from_j(lhsJ.__add(rhsJ).1); self.add_with_hint(other, transcript) } @@ -741,9 +756,9 @@ impl std::ops::Sub for BigCurve where // Expensive witness generation! Avoid if possible fn sub(self, other: Self) -> Self { let lhsJ = CurveJ::from(self); - let rhsJ = CurveJ:: from(other); + let rhsJ = CurveJ::from(other); - let transcript = AffineTranscript::from_j(lhsJ.sub(rhsJ).1); + let transcript = AffineTranscript::__from_j(lhsJ.__sub(rhsJ).1); self.sub_with_hint(other, transcript) } diff --git a/src/scalar_field.nr b/src/scalar_field.nr index 0119927..4079f72 100644 --- a/src/scalar_field.nr +++ b/src/scalar_field.nr @@ -23,7 +23,7 @@ struct ScalarField { } // 1, 2, 3, 4 -unconstrained fn get_wnaf_slices(x: Field) -> ([u8; N], bool) { +unconstrained fn __get_wnaf_slices(x: Field) -> ([u8; N], bool) { let mut result: [u8; N] = [0; N]; let mut nibbles = x.to_le_radix(16, N); @@ -43,7 +43,7 @@ unconstrained fn get_wnaf_slices(x: Field) -> ([u8; N], bool) { (result, skew) } -unconstrained fn get_wnaf_slices2(x: [Field; M]) -> ([u8; N], bool) { +unconstrained fn __get_wnaf_slices2(x: [Field; M]) -> ([u8; N], bool) { let mut result: [u8; N] = [0; N]; let mut nibbles: [[u8; 30]; M] = [[0; 30]; M]; @@ -69,7 +69,7 @@ unconstrained fn get_wnaf_slices2(x: [Field; M]) -> ([u8 (result, skew) } -unconstrained fn from_wnaf_slices(x: [u8; 64], skew: bool) -> Field { +unconstrained fn __from_wnaf_slices(x: [u8; 64], skew: bool) -> Field { let mut result: Field = 0; for i in 0..64 { @@ -81,7 +81,7 @@ unconstrained fn from_wnaf_slices(x: [u8; 64], skew: bool) -> Field { } -unconstrained fn get_modulus_slices() -> (Field, Field) { +unconstrained fn __get_modulus_slices() -> (Field, Field) { let bytes = std::field::modulus_be_bytes(); let num_bytes = (std::field::modulus_num_bits() / 8) + ((std::field::modulus_num_bits() % 8 != 0) as u64); let mut lo: Field = 0; @@ -99,7 +99,7 @@ unconstrained fn get_modulus_slices() -> (Field, Field) { (lo, hi) } -unconstrained fn get_borrow_flag(lhs_lo: Field, rhs_lo: Field) -> bool { +unconstrained fn __get_borrow_flag(lhs_lo: Field, rhs_lo: Field) -> bool { lhs_lo.lt(rhs_lo + 1) } @@ -112,7 +112,7 @@ impl std::convert::From for ScalarField { **/ fn from(x: Field) -> Self { let mut result: Self = ScalarField { base4_slices: [0; N], skew: false }; - let (slices, skew): ([u8; N], bool) = get_wnaf_slices(x); + let (slices, skew): ([u8; N], bool) = __get_wnaf_slices(x); result.base4_slices = slices; result.skew = skew; if (N < 64) { @@ -147,8 +147,8 @@ impl std::convert::From for ScalarField { // 0x8833e84879b9709143e1f593efffffff lo -= skew as Field; // Validate that the integer represented by (lo, hi) is smaller than the integer represented by (plo, phi) - let (plo, phi) = get_modulus_slices(); - let borrow = get_borrow_flag(plo, lo) as Field; + let (plo, phi) = __get_modulus_slices(); + let borrow = __get_borrow_flag(plo, lo) as Field; let rlo = plo - lo + borrow * borrow_shift - 1; // -1 because we are checking a strict <, not <= let rhi = phi - hi - borrow; let offset = (N & 1 == 1) as u32; @@ -202,7 +202,7 @@ impl ScalarField { // Note: I can't propagate ModulusBits or NumLimbs from a generic that satisfies BigNumTrait due to bugs, so we have to pass NumLimbs and Params in directly. disgusting! fn from_bignum(x: BigNum) -> Self where Params: BigNumParamsTrait + RuntimeBigNumParamsTrait { x.validate_in_field(); - let mut (slices, skew): ([u8; N], bool) = get_wnaf_slices2(x.limbs); + let mut (slices, skew): ([u8; N], bool) = __get_wnaf_slices2(x.limbs); // TODO: NONE OF THIS IS CONSTRAINED YET. FIX! Self{ base4_slices: slices, skew } From 788d89ff003769d346f68412c43fb7e264b5dd97 Mon Sep 17 00:00:00 2001 From: Michael Connor Date: Thu, 10 Oct 2024 15:58:16 +0100 Subject: [PATCH 2/5] tidy --- src/lib.nr | 3 --- txt.txt | 0 2 files changed, 3 deletions(-) delete mode 100644 txt.txt diff --git a/src/lib.nr b/src/lib.nr index af469af..267ad35 100644 --- a/src/lib.nr +++ b/src/lib.nr @@ -718,9 +718,6 @@ impl std::ops::Add for BigCurve where let lhsJ = CurveJ::from(self); let rhsJ = CurveJ::from(other); - let Sum_j = lhsJ.__add(rhsJ); - println("\nSum_j:"); - println(Sum_j); let transcript = unsafe { AffineTranscript::__from_j(lhsJ.__add(rhsJ).1) }; diff --git a/txt.txt b/txt.txt deleted file mode 100644 index e69de29..0000000 From 71e439519013a36c4741ab18930c84993708a431 Mon Sep 17 00:00:00 2001 From: Michael Connor Date: Thu, 10 Oct 2024 16:07:51 +0100 Subject: [PATCH 3/5] fmt --- src/curve_jac.nr | 10 +- src/curves/bls12_381.nr | 263 +++++++++++++++++++++++++++++----------- src/curves/bn254.nr | 14 ++- src/scalar_field.nr | 29 +++-- 4 files changed, 221 insertions(+), 95 deletions(-) diff --git a/src/curve_jac.nr b/src/curve_jac.nr index 78a9fe3..30d1948 100644 --- a/src/curve_jac.nr +++ b/src/curve_jac.nr @@ -178,7 +178,10 @@ impl PointTable where BigNum: BigNumTrait { /** * @brief get a value out of the lookup table **/ - unconstrained fn __get(self, idx: u8) -> CurveJ where CurveParams: CurveParamsTrait { + unconstrained fn __get( + self, + idx: u8 + ) -> CurveJ where CurveParams: CurveParamsTrait { CurveJ { x: self.x[idx], y: self.y[idx], z: self.z[idx], is_infinity: false } } } @@ -465,7 +468,10 @@ impl CurveJ where BigNum: BigNumTrait, /** * @brief Perform an ecc scalar multiplication and output the generated AffineTranscript **/ - unconstrained fn __mul(self, scalar: ScalarField) -> (Self, [AffineTranscript]) { + unconstrained fn __mul( + self, + scalar: ScalarField + ) -> (Self, [AffineTranscript]) { let mut transcript: [JTranscript; NScalarSlices * 5 + 6] = [JTranscript::__new(); NScalarSlices * 5 + 6]; let input: Self = CurveJ::conditional_select(CurveJ::one(), self, self.is_infinity); diff --git a/src/curves/bls12_381.nr b/src/curves/bls12_381.nr index bd6454e..5325129 100644 --- a/src/curves/bls12_381.nr +++ b/src/curves/bls12_381.nr @@ -1,9 +1,4 @@ -use dep::bignum::{ - BigNum, - fields::{ - bls12_381Fq::BLS12_381_Fq_Params, bls12_381Fr::BLS12_381_Fr_Params - } -}; +use dep::bignum::{BigNum, fields::{bls12_381Fq::BLS12_381_Fq_Params, bls12_381Fr::BLS12_381_Fr_Params}}; use crate::BigCurve; use crate::CurveParamsTrait; @@ -15,45 +10,68 @@ use crate::curve_jac::CurveJ; use crate::scalar_field::ScalarField; use crate::PointTable; - type Fq = BigNum<4, BLS12_381_Fq_Params>; type Fr = BigNum<3, BLS12_381_Fr_Params>; struct BLS12_381_Curve_Params { } -impl CurveParamsTrait> for BLS12_381_Curve_Params { +impl CurveParamsTrait> for BLS12_381_Curve_Params { // Generator: // https://github.com/zcash/librustzcash/blob/6e0364cd42a2b3d2b958a54771ef51a8db79dd29/pairing/src/bls12_381/README.md#generators // https://hackmd.io/@benjaminion/bls12-381#Generators fn one() -> [BigNum<4, BLS12_381_Fq_Params>; 2] { [ - BigNum { limbs: [0x55e83ff97a1aeffb3af00adb22c6bb, 0x8c4f9774b905a14e3a3f171bac586c, 0xa73197d7942695638c4fa9ac0fc368, 0x17f1d3] }, - BigNum { limbs: [0x3cc744a2888ae40caa232946c5e7e1, 0xe095d5d00af600db18cb2c04b3edd0, 0x81e3aaa0f1a09e30ed741d8ae4fcf5, 0x8b3f4] } + BigNum { + limbs: [ + 0x55e83ff97a1aeffb3af00adb22c6bb, 0x8c4f9774b905a14e3a3f171bac586c, 0xa73197d7942695638c4fa9ac0fc368, 0x17f1d3 + ] + }, + BigNum { + limbs: [ + 0x3cc744a2888ae40caa232946c5e7e1, 0xe095d5d00af600db18cb2c04b3edd0, 0x81e3aaa0f1a09e30ed741d8ae4fcf5, 0x8b3f4 + ] + } ] } // TODO: See sage for derivation `BLS12_381_E.gens()`. It's perhaps not the best "nothing up my sleeve" generator, but it is on the curve, and works for now... fn offset_generator() -> [BigNum<4, BLS12_381_Fq_Params>; 2] { [ - BigNum { limbs: [0x442fbd0ad62391acc555c722aea803, 0x874b86b63ecf19360c2b6d0929bb71, 0x78bb8da22c7570f7dc170e554d728b, 0x38e40] }, - BigNum { limbs: [0x2ea24532fc73e4d7584bb0fa458df4, 0xc92ed9753fb9e1b8819f3a605248e5, 0x8b7b998bb4f0c34146feb9d46b28ef, 0xbec32] } + BigNum { + limbs: [ + 0x442fbd0ad62391acc555c722aea803, 0x874b86b63ecf19360c2b6d0929bb71, 0x78bb8da22c7570f7dc170e554d728b, 0x38e40 + ] + }, + BigNum { + limbs: [ + 0x2ea24532fc73e4d7584bb0fa458df4, 0xc92ed9753fb9e1b8819f3a605248e5, 0x8b7b998bb4f0c34146feb9d46b28ef, 0xbec32 + ] + } ] } fn offset_generator_final() -> [BigNum<4, BLS12_381_Fq_Params>; 2] { [ - BigNum { limbs: [0xbf1e24769d991bf33870bd69d363ea, 0x2b423528162b0d76359c3da6ca2eea, 0xee96e3f32399f07455b37847f7acd5, 0x43fdb] }, - BigNum { limbs: [0x25925f2a055349541935f8c7a32590, 0xb37639973145c0eff2ffab0b9cbbf3, 0x8cb4e9e6329b89a2c7ab6063948b68, 0x1168d5] } + BigNum { + limbs: [ + 0xbf1e24769d991bf33870bd69d363ea, 0x2b423528162b0d76359c3da6ca2eea, 0xee96e3f32399f07455b37847f7acd5, 0x43fdb + ] + }, + BigNum { + limbs: [ + 0x25925f2a055349541935f8c7a32590, 0xb37639973145c0eff2ffab0b9cbbf3, 0x8cb4e9e6329b89a2c7ab6063948b68, 0x1168d5 + ] + } ] } - + fn a() -> BigNum<4, BLS12_381_Fq_Params> { - BigNum { limbs: [0,0,0,0]} + BigNum { limbs: [0, 0, 0, 0] } } fn b() -> BigNum<4, BLS12_381_Fq_Params> { - BigNum { limbs: [4,0,0,0]} + BigNum { limbs: [4, 0, 0, 0] } } } @@ -74,7 +92,9 @@ fn main(x: Field) { // 255-bit scalar field for BLS12_381 => 64 nibbles. let scalar: ScalarField<64> = ScalarField::from(x); // p - 2 ? - let transcript = unsafe { __get_mul_transcript(CurveJ::from(P), scalar) }; + let transcript = unsafe { + __get_mul_transcript(CurveJ::from(P), scalar) + }; // 30768 // 31020 let mut A = P; @@ -108,12 +128,7 @@ fn main(x: Field) { // assert(result.y.eq(expected.y)); } -unconstrained fn __evaluate_mul( - P: BLS12_381_Point_J, - scalar: ScalarField<64>, - Q: BLS12_381_Point_J, - K: BLS12_381_Point_J -) -> bool { +unconstrained fn __evaluate_mul(P: BLS12_381_Point_J, scalar: ScalarField<64>, Q: BLS12_381_Point_J, K: BLS12_381_Point_J) -> bool { let s = (P.__mul(scalar)); assert(s.0.eq(K.__neg())); Q.eq(s.0) @@ -129,10 +144,7 @@ unconstrained fn __get_msm_transcript( s.1 } -unconstrained fn __get_mul_transcript( - P: BLS12_381_Point_J, - scalar: ScalarField<64> -) -> [AffineTranscript; 326] { +unconstrained fn __get_mul_transcript(P: BLS12_381_Point_J, scalar: ScalarField<64>) -> [AffineTranscript; 326] { let res = P.__mul(scalar); let transcript = res.1; // println(f"let transcript: AffineTranscript = {transcript}"); @@ -145,17 +157,27 @@ unconstrained fn __get_mul_transcript( fn test_mul() { let P: BLS12_381_Point = BigCurve::one(); - let scalar_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let scalar_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; let scalar: ScalarField<64> = ScalarField::from_bignum(scalar_fr); // r - 2 - let transcript = unsafe { __get_mul_transcript(CurveJ::from(P), scalar) }; + let transcript = unsafe { + __get_mul_transcript(CurveJ::from(P), scalar) + }; let result = P.mul_with_hint(scalar, transcript); // (r - 2) * P // -2 let mut expected: BLS12_381_Point = BigCurve { - x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, - y: BigNum { limbs: [0x552629e43d42e3ff7877e6868b0d83, 0xcb96d142e5d6ff5199ed9511eb9d2, 0x5d8db972f7281e0142cbae1e9f41bd, 0x39674] }, + x: BigNum { + limbs: [ + 0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb + ] + }, + y: BigNum { + limbs: [ + 0x552629e43d42e3ff7877e6868b0d83, 0xcb96d142e5d6ff5199ed9511eb9d2, 0x5d8db972f7281e0142cbae1e9f41bd, 0x39674 + ] + }, is_infinity: false }; // expected.y = BigNum::new() - expected.y; @@ -180,7 +202,9 @@ fn test_mul_by_0() { let foo: Field = ScalarField::into(scalar); assert(foo == 0); - let transcript = unsafe { __get_mul_transcript(CurveJ::from(P), scalar) }; + let transcript = unsafe { + __get_mul_transcript(CurveJ::from(P), scalar) + }; let result = P.mul_with_hint(scalar, transcript); // println(f"RESULT = {result}"); @@ -194,7 +218,9 @@ fn test_mul_a_point_at_infinity() { let scalar: ScalarField<64> = ScalarField::from(0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff); // p - 2 - let transcript = unsafe { __get_mul_transcript(CurveJ::from(P), scalar) }; + let transcript = unsafe { + __get_mul_transcript(CurveJ::from(P), scalar) + }; let result = P.mul_with_hint(scalar, transcript); // println(f"RESULT = {result}"); @@ -207,15 +233,23 @@ fn test_mul_a_point_at_infinity() { fn test_linear_expression() { let One: BLS12_381_Point = BigCurve::one(); let Two: BLS12_381_Point = BigCurve { - x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, - y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + x: BigNum { + limbs: [ + 0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb + ] + }, + y: BigNum { + limbs: [ + 0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d + ] + }, is_infinity: false }; - let r_minus_2_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let r_minus_2_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; let scalar2: ScalarField<64> = ScalarField::from_bignum(r_minus_2_fr); // r - 2 - let r_minus_6_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffefffffffb, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let r_minus_6_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffefffffffb, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; let scalar6: ScalarField<64> = ScalarField::from_bignum(r_minus_6_fr); // r - 6 let expected = Two.neg(); @@ -229,15 +263,23 @@ fn test_linear_expression() { fn test_msm() { let One: BLS12_381_Point = BigCurve::one(); let Two: BLS12_381_Point = BigCurve { - x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, - y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + x: BigNum { + limbs: [ + 0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb + ] + }, + y: BigNum { + limbs: [ + 0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d + ] + }, is_infinity: false }; - let r_minus_2_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let r_minus_2_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; let scalar2: ScalarField<64> = ScalarField::from_bignum(r_minus_2_fr); // r - 2 - let r_minus_6_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffefffffffb, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let r_minus_6_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffefffffffb, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; let scalar6: ScalarField<64> = ScalarField::from_bignum(r_minus_6_fr); // r - 6 let transcript = unsafe { @@ -258,30 +300,46 @@ fn test_mul_jac() { let scalar_fr: Fr = BigNum { limbs: [0xbda402fffe5bfeffffffff00000000, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; // r - 1 let scalar: ScalarField<64> = ScalarField::from_bignum(scalar_fr); // r - 1 - let expected = unsafe { P.__incomplete_add(P.__dbl().0.__neg()).0 }; // P + -2P = -P - let result = unsafe { __evaluate_mul(P, scalar, expected, P) }; + let expected = unsafe { + P.__incomplete_add(P.__dbl().0.__neg()).0 + }; // P + -2P = -P + let result = unsafe { + __evaluate_mul(P, scalar, expected, P) + }; assert(result == true); } fn __test_msm_jac_impl(scalars: [ScalarField<64>; 2]) { let One: BLS12_381_Point_J = CurveJ::one(); let Two: BLS12_381_Point_J = CurveJ { - x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, - y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + x: BigNum { + limbs: [ + 0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb + ] + }, + y: BigNum { + limbs: [ + 0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d + ] + }, z: BigNum::one(), is_infinity: false }; - let result = unsafe { CurveJ::__msm([One, Two.__neg()], scalars) }; - let expected = unsafe { Two.__neg() }; + let result = unsafe { + CurveJ::__msm([One, Two.__neg()], scalars) + }; + let expected = unsafe { + Two.__neg() + }; assert(result.0 == expected); } #[test] fn test_msm_jac() { - let r_minus_2_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let r_minus_2_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffeffffffff, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; let r_minus_2_scalar: ScalarField<64> = ScalarField::from_bignum(r_minus_2_fr); // r - 2 - let r_minus_6_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffefffffffb, 0xa753299d7d483339d80809a1d80553, 0x73ed ] }; + let r_minus_6_fr: Fr = BigNum { limbs: [0xbda402fffe5bfefffffffefffffffb, 0xa753299d7d483339d80809a1d80553, 0x73ed] }; let r_minus_6_scalar: ScalarField<64> = ScalarField::from_bignum(r_minus_6_fr); // r - 6 unsafe { @@ -292,8 +350,12 @@ fn test_msm_jac() { #[test] fn test_add_dbl() { let P: BLS12_381_Point_J = CurveJ::one(); - let lhs = unsafe { ((P.__dbl().0).__dbl()).0 }; - let rhs = unsafe { P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0 }; + let lhs = unsafe { + ((P.__dbl().0).__dbl()).0 + }; + let rhs = unsafe { + P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0 + }; assert(lhs == rhs); } @@ -301,7 +363,9 @@ fn test_add_dbl() { fn test_transcript() { let P: BLS12_381_Point_J = CurveJ::one(); - let P2 = unsafe { P.__dbl() }; + let P2 = unsafe { + P.__dbl() + }; let Z_inverse = P2.1.z3.__invmod(); @@ -338,7 +402,9 @@ fn test_transcript() { fn test_double_with_hint() { let P: BLS12_381_Point_J = CurveJ::one(); - let P2 = unsafe { P.__dbl() }; + let P2 = unsafe { + P.__dbl() + }; let P_affine: BLS12_381_Point = BigCurve::one(); @@ -367,23 +433,39 @@ fn test_incomplete_add_with_hint() { // Q = 2P let Q_affine: BLS12_381_Point = BigCurve { - x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, - y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + x: BigNum { + limbs: [ + 0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb + ] + }, + y: BigNum { + limbs: [ + 0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d + ] + }, is_infinity: false }; let Q = CurveJ::from(Q_affine); - let R = unsafe { P.__incomplete_add(Q) }; + let R = unsafe { + P.__incomplete_add(Q) + }; let P_affine: BLS12_381_Point = BigCurve::one(); - let Z_inverse = unsafe { R.1.z3.__invmod() }; + let Z_inverse = unsafe { + R.1.z3.__invmod() + }; let lambda = R.1.lambda_numerator.__mul(Z_inverse); let X3 = R.1.x3; let Y3 = R.1.y3; - let ZZ = unsafe { Z_inverse.__mul(Z_inverse) }; - let ZZZ = unsafe { ZZ.__mul(Z_inverse) }; + let ZZ = unsafe { + Z_inverse.__mul(Z_inverse) + }; + let ZZZ = unsafe { + ZZ.__mul(Z_inverse) + }; let x3 = X3.__mul(ZZ); let y3 = Y3.__mul(ZZZ); @@ -396,8 +478,12 @@ fn test_incomplete_add_with_hint() { let P: BLS12_381_Point_J = CurveJ::one(); - let lhs = unsafe { P.__dbl().0.__dbl().0 }; - let rhs = unsafe { P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0 }; + let lhs = unsafe { + P.__dbl().0.__dbl().0 + }; + let rhs = unsafe { + P.__dbl().0.__incomplete_add(P).0.__incomplete_add(P).0 + }; assert(lhs.eq(rhs)); } @@ -407,8 +493,16 @@ fn test_add() { // Two_P = 2P let Two_P: BLS12_381_Point = BigCurve { - x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, - y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + x: BigNum { + limbs: [ + 0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb + ] + }, + y: BigNum { + limbs: [ + 0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d + ] + }, is_infinity: false }; @@ -416,11 +510,12 @@ fn test_add() { let P_j = CurveJ::from(P); let Two_P_j = CurveJ::from(Two_P); - let mut expected = unsafe { P_j.__add(Two_P_j).0 }; // 3P_j + let mut expected = unsafe { + P_j.__add(Two_P_j).0 + }; // 3P_j assert(result.eq(expected)); - let Two_P_j_unconstrained = P_j.__add(P_j); let Two_P_j_dbl_unconstrained = P_j.__dbl(); @@ -470,8 +565,16 @@ fn test_sub() { let P: BLS12_381_Point = BigCurve::one(); let Two_P: BLS12_381_Point = BigCurve { - x: BigNum { limbs: [0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb] }, - y: BigNum { limbs: [0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d] }, + x: BigNum { + limbs: [ + 0x8f75bb8f1c7c42c39a8c5529bf0f4e, 0xdb309128012543902d0ac358a62ae2, 0xea904d67468808c8eb50a9450c9721, 0x572cb + ] + }, + y: BigNum { + limbs: [ + 0x56d9d4cd16bd1bba86881979749d28, 0x3ecb8670e461f73bb9021d5fd76a4c, 0x8cabc673a322fda673779d8e3822ba, 0x166a9d + ] + }, is_infinity: false }; @@ -479,7 +582,9 @@ fn test_sub() { let P_j = CurveJ::from(P); let Two_P_j = CurveJ::from(Two_P); - let expected = unsafe { P_j.__sub(Two_P_j).0 }; + let expected = unsafe { + P_j.__sub(Two_P_j).0 + }; assert(result.eq(expected)); @@ -487,12 +592,16 @@ fn test_sub() { let Q: BLS12_381_Point = BigCurve::one(); // P let result = CurveJ::from(P.sub(Q.neg())); - let expected = unsafe { P_j.__dbl().0 }; + let expected = unsafe { + P_j.__dbl().0 + }; assert(result.eq(expected)); // infinity let result = CurveJ::from(P.sub(Q)); - let expected = unsafe { CurveJ::__point_at_infinity() }; + let expected = unsafe { + CurveJ::__point_at_infinity() + }; assert(result.eq(expected)); // lhs infinity @@ -503,13 +612,17 @@ fn test_sub() { // rhs infinity let result = CurveJ::from(Q.sub(P)); - let expected = unsafe { expected.__neg() }; + let expected = unsafe { + expected.__neg() + }; assert(result.eq(expected)); // both infinity let Q: BLS12_381_Point = BigCurve::point_at_infinity(); let result = CurveJ::from(Q.sub(P)); - let expected = unsafe { CurveJ::__point_at_infinity() }; + let expected = unsafe { + CurveJ::__point_at_infinity() + }; assert(result.eq(expected)); } @@ -518,7 +631,9 @@ fn test_make_table() { let P: BLS12_381_Point_J = CurveJ::one(); let mut transcript: [JTranscript] = &[]; - let T: curve_jac::PointTable = unsafe { curve_jac::PointTable::__new(P) }; + let T: curve_jac::PointTable = unsafe { + curve_jac::PointTable::__new(P) + }; for i in 0..8 { transcript = transcript.push_back(T.transcript[i]); } diff --git a/src/curves/bn254.nr b/src/curves/bn254.nr index 6c247a2..3c1e176 100644 --- a/src/curves/bn254.nr +++ b/src/curves/bn254.nr @@ -15,7 +15,7 @@ type Fq = BigNum<3, BN254_Fq_Params>; struct BN254_Curve_Params { } -impl CurveParamsTrait> for BN254_Curve_Params { +impl CurveParamsTrait> for BN254_Curve_Params { fn one() -> [BigNum<3, BN254_Fq_Params>; 2] { let mut one: Fq = BigNum::new(); one.limbs[0] = 1; @@ -43,11 +43,11 @@ impl CurveParamsTrait> for BN254_Curve_Params { } fn a() -> BigNum<3, BN254_Fq_Params> { - BigNum { limbs: [0, 0, 0]} + BigNum { limbs: [0, 0, 0] } } fn b() -> BigNum<3, BN254_Fq_Params> { - BigNum { limbs: [3, 0, 0]} + BigNum { limbs: [3, 0, 0] } } } @@ -243,7 +243,7 @@ unconstrained fn __evaluate_mul( P: BN254_Point_J, // P s: ScalarField<64>, // -1 neg_P: BN254_Point_J, // P - P_sub_2P: BN254_Point_J, // P - 2P + P_sub_2P: BN254_Point_J // P - 2P ) -> bool { let sP = P.__mul(s); // -P assert(sP.0.eq(neg_P)); // -P = neg_P @@ -445,7 +445,7 @@ fn test_add() { // doubling let Q: BN254_Point = BigCurve::one(); // P - let result = CurveJ::from(P.add(Q)); // 2P_j + let result = CurveJ::from(P.add(Q)); // 2P_j let expected = unsafe { P_j.__dbl().0 // 2P_j }; @@ -523,7 +523,9 @@ fn test_sub() { // rhs infinity let result = CurveJ::from(Q.sub(P)); - let expected = unsafe { expected.__neg() }; + let expected = unsafe { + expected.__neg() + }; assert(result.eq(expected)); // both infinity diff --git a/src/scalar_field.nr b/src/scalar_field.nr index 3c49f1f..8efd037 100644 --- a/src/scalar_field.nr +++ b/src/scalar_field.nr @@ -97,7 +97,9 @@ impl std::convert::From for ScalarField { **/ fn from(x: Field) -> Self { let mut result: Self = ScalarField { base4_slices: [0; N], skew: false }; - let (slices, skew): ([u8; N], bool) = unsafe{ __get_wnaf_slices(x) }; + let (slices, skew): ([u8; N], bool) = unsafe { + __get_wnaf_slices(x) + }; result.base4_slices = slices; result.skew = skew; if (N < 64) { @@ -107,33 +109,34 @@ impl std::convert::From for ScalarField { acc += (slices[i] as Field) * 2 - 15; } assert(acc - skew as Field == x); - } - else - { + } else { // TODO: if num bits = 64, validate in sum of the bits is smaller than the Field modulus - let mut lo: Field = slices[(N/2)] as Field * 2 - 15; + let mut lo: Field = slices[(N / 2)] as Field * 2 - 15; let mut hi: Field = slices[0] as Field * 2 - 15; let mut borrow_shift = 1; - for i in 1..(N/2) { + for i in 1..(N / 2) { borrow_shift *= 16; lo *= 16; lo += (slices[(N/2) + i] as Field) * 2 - 15; hi *= 16; hi += (slices[i] as Field) * 2 - 15; } - if ((N & 1) == 1) - { + if ((N & 1) == 1) { borrow_shift *= 16; lo *= 16; lo += (slices[N-1] as Field) * 2 - 15; } -// 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff - // 0x2833e84879b9709143e1f593f0000001 - // 0x8833e84879b9709143e1f593efffffff + // 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593efffffff + // 0x2833e84879b9709143e1f593f0000001 + // 0x8833e84879b9709143e1f593efffffff lo -= skew as Field; // Validate that the integer represented by (lo, hi) is smaller than the integer represented by (plo, phi) - let (plo, phi) = unsafe{ __get_modulus_slices() }; - let borrow = unsafe{ __get_borrow_flag(plo, lo) as Field }; + let (plo, phi) = unsafe { + __get_modulus_slices() + }; + let borrow = unsafe { + __get_borrow_flag(plo, lo) as Field + }; let rlo = plo - lo + borrow * borrow_shift - 1; // -1 because we are checking a strict <, not <= let rhi = phi - hi - borrow; let offset = (N & 1 == 1) as u32; From 1843b353538852c36481f3046062d3de6f50e515 Mon Sep 17 00:00:00 2001 From: Michael Connor Date: Fri, 11 Oct 2024 10:14:39 +0100 Subject: [PATCH 4/5] tidy --- flamegraph/main_gates.svg | 918 -------------------------------------- info.sh | 5 +- src/curves.nr | 4 +- src/curves/bls12_381.nr | 75 +--- src/curves/bn254.nr | 55 +-- src/lib.nr | 12 +- txt.txt | 0 7 files changed, 23 insertions(+), 1046 deletions(-) delete mode 100644 flamegraph/main_gates.svg create mode 100644 txt.txt diff --git a/flamegraph/main_gates.svg b/flamegraph/main_gates.svg deleted file mode 100644 index 59b8b8a..0000000 --- a/flamegraph/main_gates.svg +++ /dev/null @@ -1,918 +0,0 @@ -./target/noir_bigcurve.json-main Reset ZoomSearch scalar_field.nr:204:9::x.validate_in_field() (5 gates, 0.00%)lib.nr:252:9::Params::get_instance().validate_in_field(self) (5 gates, 0.00%)runtime_bignum.nr:549:28::self.__validate_in_field_compute_borrow_flags(val) (5 gates, 0.00%)opcode::arithmetic (5 gates, 0.00%)bls12_381.nr:151:35::ScalarField::from_bignum(scalar_fr) (18 gates, 0.01%)scalar_field.nr:205:51::__get_wnaf_slices2(x.limbs) (13 gates, 0.01%)opcode::arithmetic (13 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (2,794 gates, 2.04%)r..mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,794 gates, 2.04%)m..opcode::blackbox::range (2,794 gates, 2.04%)o..main.nr:500:9::x3.validate_in_range() (2,819 gates, 2.06%)m..lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (2,819 gates, 2.06%)l..runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (25 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (25 gates, 0.02%)opcode::blackbox::range (25 gates, 0.02%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:501:9::y3.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)main.nr:502:9::lambda.validate_in_range() (16 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (16 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,385 gates, 1.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1,369 gates, 1.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,369 gates, 1.00%)opcode::blackbox::range (1,369 gates, 1.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (20 gates, 0.01%)opcode::arithmetic (20 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:507:9::BigNum::evaluate_quadratic_expression( - [[x1, x1, x1], [y1, y1, BigNum::new()]], - [[false, false, false], [false, false, false]], - [[x1], [lambda]], - [[false], [true]], - [CurveParams::a()], - [false] - ) (1,460 gates, 1.07%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (1,460 gates, 1.07%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:517:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x1, x1], - [true, true, true] - ) (87 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (87 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (18 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:80:18::P.double_with_hint(transcript[0]) (4,488 gates, 3.28%)mai..main.nr:527:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (88 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (88 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:85:24::P.y.neg() (4 gates, 0.00%)lib.nr:268:9::Params::get_instance().neg(self) (4 gates, 0.00%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)main.nr:184:9::x3.validate_in_range() (119 gates, 0.09%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (119 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (9 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)main.nr:185:9::y3.validate_in_range() (126 gates, 0.09%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (126 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)main.nr:186:9::lambda.validate_in_range() (118 gates, 0.09%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (118 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (8 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (8 gates, 0.01%)opcode::blackbox::range (8 gates, 0.01%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (14 gates, 0.01%)opcode::arithmetic (14 gates, 0.01%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (27 gates, 0.02%)opcode::arithmetic (27 gates, 0.02%)main.nr:189:9::x1.assert_is_not_equal(x2) (69 gates, 0.05%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (69 gates, 0.05%)runtime_bignum.nr:589:16::target != 0 (28 gates, 0.02%)opcode::arithmetic (28 gates, 0.02%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (111 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (111 gates, 0.08%)opcode::blackbox::range (111 gates, 0.08%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (121 gates, 0.09%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (10 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (10 gates, 0.01%)opcode::blackbox::range (10 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (400 gates, 0.29%)opcode::arithmetic (400 gates, 0.29%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (7 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (7 gates, 0.01%)opcode::blackbox::range (7 gates, 0.01%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (35 gates, 0.03%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (35 gates, 0.03%)opcode::blackbox::range (35 gates, 0.03%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (124 gates, 0.09%)opcode::arithmetic (124 gates, 0.09%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (221 gates, 0.16%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (221 gates, 0.16%)opcode::blackbox::range (221 gates, 0.16%)main.nr:192:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x2, x1]], - [[false, true]], - [y2, y1], - [true, false] - ) (915 gates, 0.67%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (915 gates, 0.67%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (120 gates, 0.09%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (10 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (10 gates, 0.01%)opcode::blackbox::range (10 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (112 gates, 0.08%)opcode::arithmetic (112 gates, 0.08%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (7 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (7 gates, 0.01%)opcode::blackbox::range (7 gates, 0.01%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (35 gates, 0.03%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (35 gates, 0.03%)opcode::blackbox::range (35 gates, 0.03%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (138 gates, 0.10%)opcode::arithmetic (138 gates, 0.10%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (221 gates, 0.16%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (221 gates, 0.16%)opcode::blackbox::range (221 gates, 0.16%)main.nr:202:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x2, x1], - [true, true, true] - ) (640 gates, 0.47%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (640 gates, 0.47%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (121 gates, 0.09%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (11 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (11 gates, 0.01%)opcode::blackbox::range (11 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (352 gates, 0.26%)opcode::arithmetic (352 gates, 0.26%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (7 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (7 gates, 0.01%)opcode::blackbox::range (7 gates, 0.01%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (35 gates, 0.03%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (35 gates, 0.03%)opcode::blackbox::range (35 gates, 0.03%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (126 gates, 0.09%)opcode::arithmetic (126 gates, 0.09%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (220 gates, 0.16%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (220 gates, 0.16%)opcode::blackbox::range (220 gates, 0.16%)main.nr:89:17::D2.incomplete_add_with_hint(A, transcript[i]) (2,855 gates, 2.09%)m..main.nr:212:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (868 gates, 0.64%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (868 gates, 0.64%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (28 gates, 0.02%)opcode::blackbox::range (28 gates, 0.02%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (110 gates, 0.08%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (110 gates, 0.08%)opcode::blackbox::range (110 gates, 0.08%)runtime_bignum.nr:609:9::result.validate_in_range() (119 gates, 0.09%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (9 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:613:16::result_limb == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:617:20::result_limb == 0 (14 gates, 0.01%)opcode::arithmetic (14 gates, 0.01%)main.nr:551:37::PointTable::new_with_hint( - input, - [ - transcript[0], transcript[1], transcript[2], transcript[3], transcript[4], transcript[5], transcript[6], transcript[7] - ] - ) (7,522 gates, 5.51%)main.nr..main.nr:93:32::A.y.neg() (175 gates, 0.13%)lib.nr:268:9::Params::get_instance().neg(self) (175 gates, 0.13%)runtime_bignum.nr:620:16::result_limb == 0 (7 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:184:9::x3.validate_in_range() (17 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:185:9::y3.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:186:9::lambda.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (3 gates, 0.00%)opcode::arithmetic (3 gates, 0.00%)main.nr:189:9::x1.assert_is_not_equal(x2) (9 gates, 0.01%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (9 gates, 0.01%)runtime_bignum.nr:589:16::target != 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:192:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x2, x1]], - [[false, true]], - [y2, y1], - [true, false] - ) (87 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (87 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (18 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (18 gates, 0.01%)opcode::arithmetic (18 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:202:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x2, x1], - [true, true, true] - ) (90 gates, 0.07%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (90 gates, 0.07%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:560:31::accumulator.incomplete_add_with_hint(T.get(scalar.base4_slices[0]), transcript[3 + 5]) (327 gates, 0.24%)main.nr:212:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (88 gates, 0.06%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (88 gates, 0.06%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)opcode::arithmetic (21 gates, 0.02%)opcode::memory::init (4 gates, 0.00%)main.nr:104:23::self.x[idx] (35 gates, 0.03%)opcode::memory::op (10 gates, 0.01%)opcode::arithmetic (7 gates, 0.01%)opcode::memory::init (4 gates, 0.00%)main.nr:560:68::T.get(scalar.base4_slices[0]) (56 gates, 0.04%)main.nr:104:39::self.y[idx] (21 gates, 0.02%)opcode::memory::op (10 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)main.nr:501:9::y3.validate_in_range() (1,054 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,054 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( - [[x1, x1, x1], [y1, y1, BigNum::new()]], - [[false, false, false], [false, false, false]], - [[x1], [lambda]], - [[false], [true]], - [CurveParams::a()], - [false] - ) (7,355 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (7,355 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x1, x1], - [true, true, true] - ) (5,686 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (5,686 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:564:27::accumulator.double_with_hint(transcript[4 + 5 * i]) (25,010 gates, 18.30%)main.nr:564:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (8,678 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (8,678 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)main.nr:501:9::y3.validate_in_range() (1,056 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,056 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,149 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,149 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (141 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (141 gates, 0.10%)opcode::blackbox::range (141 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( - [[x1, x1, x1], [y1, y1, BigNum::new()]], - [[false, false, false], [false, false, false]], - [[x1], [lambda]], - [[false], [true]], - [CurveParams::a()], - [false] - ) (7,355 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (7,355 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,149 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (141 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (141 gates, 0.10%)opcode::blackbox::range (141 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x1, x1], - [true, true, true] - ) (5,685 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (5,685 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,056 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:565:27::accumulator.double_with_hint(transcript[5 + 5 * i]) (25,011 gates, 18.30%)main.nr:565:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (8,679 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (8,679 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)main.nr:501:9::y3.validate_in_range() (1,055 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,055 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,056 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( - [[x1, x1, x1], [y1, y1, BigNum::new()]], - [[false, false, false], [false, false, false]], - [[x1], [lambda]], - [[false], [true]], - [CurveParams::a()], - [false] - ) (7,356 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (7,356 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x1, x1], - [true, true, true] - ) (5,686 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (5,686 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,054 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:566:27::accumulator.double_with_hint(transcript[6 + 5 * i]) (25,011 gates, 18.30%)main.nr:566:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (8,677 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (8,677 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:500:9::x3.validate_in_range() (1,086 gates, 0.79%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,086 gates, 0.79%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)main.nr:501:9::y3.validate_in_range() (1,056 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,056 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:502:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (2,772 gates, 2.03%)r..opcode::arithmetic (2,772 gates, 2.03%)o..runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:507:9::BigNum::evaluate_quadratic_expression( - [[x1, x1, x1], [y1, y1, BigNum::new()]], - [[false, false, false], [false, false, false]], - [[x1], [lambda]], - [[false], [true]], - [CurveParams::a()], - [false] - ) (7,355 gates, 5.38%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (7,355 gates, 5.38%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (189 gates, 0.14%)opcode::arithmetic (189 gates, 0.14%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:517:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x1, x1], - [true, true, true] - ) (5,686 gates, 4.16%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (5,686 gates, 4.16%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,056 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:567:27::accumulator.double_with_hint(transcript[7 + 5 * i]) (25,012 gates, 18.31%)main.nr:567:27::accumulator.d..main.nr:527:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (8,679 gates, 6.35%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (8,679 gates, 6.35%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:184:9::x3.validate_in_range() (1,087 gates, 0.80%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,087 gates, 0.80%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)main.nr:185:9::y3.validate_in_range() (1,054 gates, 0.77%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,054 gates, 0.77%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)main.nr:186:9::lambda.validate_in_range() (1,150 gates, 0.84%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (1,150 gates, 0.84%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (126 gates, 0.09%)opcode::arithmetic (126 gates, 0.09%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (315 gates, 0.23%)opcode::arithmetic (315 gates, 0.23%)main.nr:189:9::x1.assert_is_not_equal(x2) (693 gates, 0.51%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (693 gates, 0.51%)runtime_bignum.nr:589:16::target != 0 (252 gates, 0.18%)opcode::arithmetic (252 gates, 0.18%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (977 gates, 0.72%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (977 gates, 0.72%)opcode::blackbox::range (977 gates, 0.72%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (78 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (78 gates, 0.06%)opcode::blackbox::range (78 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (4,032 gates, 2.95%)run..opcode::arithmetic (4,032 gates, 2.95%)opc..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:192:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x2, x1]], - [[false, true]], - [y2, y1], - [true, false] - ) (8,615 gates, 6.31%)main.nr:..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (8,615 gates, 6.31%)lib.nr:2..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (1,008 gates, 0.74%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,008 gates, 0.74%)opcode::blackbox::range (1,008 gates, 0.74%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,150 gates, 0.84%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (142 gates, 0.10%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (142 gates, 0.10%)opcode::blackbox::range (142 gates, 0.10%)runtime_bignum.nr:481:25::std::as_witness(new_term) (1,008 gates, 0.74%)opcode::arithmetic (1,008 gates, 0.74%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,260 gates, 0.92%)opcode::arithmetic (1,260 gates, 0.92%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (1,953 gates, 1.43%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1,953 gates, 1.43%)opcode::blackbox::range (1,953 gates, 1.43%)main.nr:202:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x2, x1], - [true, true, true] - ) (5,812 gates, 4.25%)main...lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (5,812 gates, 4.25%)lib.n..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (976 gates, 0.71%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (976 gates, 0.71%)opcode::blackbox::range (976 gates, 0.71%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (1,055 gates, 0.77%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (79 gates, 0.06%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (79 gates, 0.06%)opcode::blackbox::range (79 gates, 0.06%)runtime_bignum.nr:481:25::std::as_witness(new_term) (3,024 gates, 2.21%)r..opcode::arithmetic (3,024 gates, 2.21%)o..runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (63 gates, 0.05%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (63 gates, 0.05%)opcode::blackbox::range (63 gates, 0.05%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (315 gates, 0.23%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (315 gates, 0.23%)opcode::blackbox::range (315 gates, 0.23%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (1,134 gates, 0.83%)opcode::arithmetic (1,134 gates, 0.83%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (2,016 gates, 1.48%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2,016 gates, 1.48%)opcode::blackbox::range (2,016 gates, 1.48%)main.nr:568:27::accumulator.incomplete_add_with_hint(T.get(scalar.base4_slices[i]), transcript[8 + 5 * i]) (26,081 gates, 19.09%)main.nr:568:27::accumulator.in..main.nr:212:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (7,670 gates, 5.61%)main.nr..lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (7,670 gates, 5.61%)lib.nr:..runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (63 gates, 0.05%)opcode::arithmetic (63 gates, 0.05%)opcode::arithmetic (189 gates, 0.14%)main.nr:104:23::self.x[idx] (819 gates, 0.60%)opcode::memory::op (630 gates, 0.46%)opcode::arithmetic (189 gates, 0.14%)main.nr:568:64::T.get(scalar.base4_slices[i]) (1,638 gates, 1.20%)main.nr:104:39::self.y[idx] (819 gates, 0.60%)opcode::memory::op (630 gates, 0.46%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) * (diff - modulus_mod_n) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:588:26::diff * (diff + modulus_mod_n) (3 gates, 0.00%)opcode::arithmetic (3 gates, 0.00%)main.nr:451:9::x1.assert_is_not_equal(x2) (8 gates, 0.01%)lib.nr:264:9::Params::get_instance().assert_is_not_equal(self, other) (8 gates, 0.01%)runtime_bignum.nr:589:16::target != 0 (3 gates, 0.00%)opcode::arithmetic (3 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)main.nr:454:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x2, x1]], - [[false, true]], - [y2, y1], - [false, false] - ) (27 gates, 0.02%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (27 gates, 0.02%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (11 gates, 0.01%)opcode::arithmetic (11 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)main.nr:464:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x2, x1], - [true, true, true] - ) (28 gates, 0.02%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (28 gates, 0.02%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (48 gates, 0.04%)opcode::arithmetic (48 gates, 0.04%)main.nr:574:27::accumulator.incomplete_subtract_with_hint(input, transcript[4 + 5 * NScalarSlices]) (123 gates, 0.09%)main.nr:474:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (60 gates, 0.04%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (60 gates, 0.04%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:339:9::x3.validate_in_range() (17 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:340:9::y3.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)main.nr:341:9::lambda.validate_in_range() (18 gates, 0.01%)lib.nr:51:33::RuntimeBigNumTrait::validate_in_range(self) (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (16 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (6 gates, 0.00%)opcode::arithmetic (6 gates, 0.00%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (35 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)main.nr:343:33::x2.eq(x1) (61 gates, 0.04%)lib.nr:59:40::self == other (61 gates, 0.04%)lib.nr:328:9::bn.eq(self, other) (61 gates, 0.04%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (6 gates, 0.00%)opcode::arithmetic (6 gates, 0.00%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (36 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)main.nr:344:33::y2.eq(y1) (62 gates, 0.05%)lib.nr:59:40::self == other (62 gates, 0.05%)lib.nr:328:9::bn.eq(self, other) (62 gates, 0.05%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)main.nr:346:35::x_equal_predicate & !y_equal_predicate (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)main.nr:351:14::BigNum::conditional_select(x1, BigNum::new(), evaluate_group_operation_predicate) (1 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (1 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:362:32::BigNum::conditional_select(y1, x2.neg(), double_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (4 gates, 0.00%)opcode::blackbox::range (4 gates, 0.00%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:609:9::result.validate_in_range() (18 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (2 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (2 gates, 0.00%)opcode::blackbox::range (2 gates, 0.00%)runtime_bignum.nr:613:16::result_limb == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:617:20::result_limb == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)main.nr:362:63::x2.neg() (26 gates, 0.02%)lib.nr:268:9::Params::get_instance().neg(self) (26 gates, 0.02%)runtime_bignum.nr:620:16::result_limb == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:363:32::BigNum::conditional_select(y1, x1, double_predicate) (12 gates, 0.01%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (12 gates, 0.01%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)main.nr:364:32::BigNum::conditional_select(x1, BigNum::one(), double_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:365:32::BigNum::conditional_select(x1, y2, double_predicate) (1 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (1 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:366:32::BigNum::conditional_select(x1, y1, double_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:367:32::BigNum::conditional_select(x1, BigNum::new(), double_predicate) (1 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (1 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (19 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (3 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (3 gates, 0.00%)opcode::blackbox::range (3 gates, 0.00%)runtime_bignum.nr:480:40::t0[k][i] * t1[k][j] (17 gates, 0.01%)opcode::arithmetic (17 gates, 0.01%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:484:57::t0[k][i] * t1[k][j] (22 gates, 0.02%)opcode::arithmetic (22 gates, 0.02%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (35 gates, 0.03%)opcode::arithmetic (35 gates, 0.03%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (31 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (31 gates, 0.02%)opcode::blackbox::range (31 gates, 0.02%)main.nr:377:9::BigNum::evaluate_quadratic_expression( - [[lambda], [product_2_lhs_t0]], - [[true], [false]], - [ - [product_1_rhs_t0, product_1_rhs_t1, BigNum::new()], [product_2_rhs_t0, product_2_rhs_t1, product_2_rhs_t2] - ], - [[false, false, false], [false, false, false]], - [a_term], - [false] - ) (148 gates, 0.11%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (148 gates, 0.11%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (15 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (15 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (16 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (16 gates, 0.01%)opcode::arithmetic (16 gates, 0.01%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (20 gates, 0.01%)opcode::arithmetic (20 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:390:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[lambda]], - [[false]], - [x3, x2, x1], - [true, true, true] - ) (91 gates, 0.07%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (91 gates, 0.07%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:255:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:424:9::quotient.validate_quotient_in_range() (17 gates, 0.01%)runtime_bignum.nr:259:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:481:25::std::as_witness(new_term) (64 gates, 0.05%)opcode::arithmetic (64 gates, 0.05%)runtime_bignum.nr:508:9::borrow_flags.get(0).assert_max_bit_size(1) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:511:13::borrow_flags.get(i).assert_max_bit_size(1) (5 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (5 gates, 0.00%)opcode::blackbox::range (5 gates, 0.00%)runtime_bignum.nr:534:13::std::as_witness(product_limbs.get(i)) (18 gates, 0.01%)opcode::arithmetic (18 gates, 0.01%)runtime_bignum.nr:535:13::product_limbs.get(i).assert_max_bit_size(126) (32 gates, 0.02%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (32 gates, 0.02%)opcode::blackbox::range (32 gates, 0.02%)main.nr:400:9::BigNum::evaluate_quadratic_expression( - [[lambda]], - [[false]], - [[x3, x1]], - [[false, true]], - [y3, y1], - [false, false] - ) (138 gates, 0.10%)lib.nr:241:9::Params::get_instance().evaluate_quadratic_expression( - lhs_terms, - lhs_flags, - rhs_terms, - rhs_flags, - linear_terms, - linear_flags - ) (138 gates, 0.10%)runtime_bignum.nr:539:16::product_limbs.get(N + N - 2) == 0 (1 gates, 0.00%)opcode::arithmetic (1 gates, 0.00%)main.nr:414:17::BigNum::conditional_select(BigNum::new(), x_out, infinity_predicate) (13 gates, 0.01%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (13 gates, 0.01%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (13 gates, 0.01%)opcode::arithmetic (13 gates, 0.01%)main.nr:415:25::BigNum::conditional_select(y3, y1, evaluate_group_operation_predicate) (4 gates, 0.00%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (4 gates, 0.00%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:417:44::other.y.neg() (4 gates, 0.00%)lib.nr:268:9::Params::get_instance().neg(self) (4 gates, 0.00%)runtime_bignum.nr:608:38::self.__neg_with_flags(val) (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)main.nr:418:17::BigNum::conditional_select(BigNum::new(), y_out, infinity_predicate) (8 gates, 0.01%)lib.nr:50:76::RuntimeBigNumTrait::conditional_select(lhs, rhs, predicate) (8 gates, 0.01%)runtime_bignum.nr:224:31::(lhs.limbs[i] - rhs.limbs[i]) * predicate as Field (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)opcode::arithmetic (5 gates, 0.00%)main.nr:422:32::conditional_select(true, false, evaluate_group_operation_predicate) (25 gates, 0.02%)main.nr:420:70::((a as Field - b as Field) * predicate as Field + b as Field) as bool (25 gates, 0.02%)opcode::blackbox::range (20 gates, 0.01%)opcode::arithmetic (5 gates, 0.00%)bls12_381.nr:155:18::P.mul_with_hint(scalar, transcript) (136,473 gates, 99.88%)bls12_381.nr:155:18::P.mul_with_hint(scalar, transcript)main.nr:577:23::accumulator.sub_with_hint(BigCurve::offset_generator_final(), transcript[5 + 5 * NScalarSlices]) (682 gates, 0.50%)main.nr:423:24::conditional_select(true, infinity_out, infinity_predicate) (20 gates, 0.01%)main.nr:420:70::((a as Field - b as Field) * predicate as Field + b as Field) as bool (20 gates, 0.01%)opcode::blackbox::range (15 gates, 0.01%)bls12_381.nr:163:18::BigNum::new() - expected.y (4 gates, 0.00%)lib.nr:303:9::Params::get_instance().sub(self, other) (4 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (10 gates, 0.01%)opcode::arithmetic (10 gates, 0.01%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (44 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)lib.nr:59:40::self == other (70 gates, 0.05%)lib.nr:328:9::bn.eq(self, other) (70 gates, 0.05%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)bls12_381.nr:164:12::result.x.eq(expected.x) (71 gates, 0.05%)opcode::arithmetic (1 gates, 0.00%)runtime_bignum.nr:694:62::self.__sub_with_flags(lhs, rhs) (9 gates, 0.01%)opcode::blackbox::range (9 gates, 0.01%)runtime_bignum.nr:234:13::self.limbs[i].assert_max_bit_size(120) (16 gates, 0.01%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (16 gates, 0.01%)opcode::blackbox::range (16 gates, 0.01%)runtime_bignum.nr:695:9::result.validate_in_range() (17 gates, 0.01%)runtime_bignum.nr:237:9::self.limbs[N - 1].assert_max_bit_size(final_limb_bits as u32) (1 gates, 0.00%)mod.nr:27:9::self.__assert_max_bit_size(bit_size) (1 gates, 0.00%)opcode::blackbox::range (1 gates, 0.00%)runtime_bignum.nr:707:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:712:20::result_limb == 0 (10 gates, 0.01%)opcode::arithmetic (10 gates, 0.01%)runtime_bignum.nr:593:20::self.sub(lhs, rhs) (44 gates, 0.03%)runtime_bignum.nr:718:16::result_limb == 0 (4 gates, 0.00%)opcode::arithmetic (4 gates, 0.00%)runtime_bignum.nr:600:32::is_equal_modulus & (diff.limbs[i] == self.modulus[i]) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:600:52::diff.limbs[i] == self.modulus[i] (12 gates, 0.01%)opcode::arithmetic (12 gates, 0.01%)runtime_bignum.nr:601:29::is_equal_zero & (diff.limbs[i] == 0) (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)runtime_bignum.nr:601:46::diff.limbs[i] == 0 (8 gates, 0.01%)opcode::arithmetic (8 gates, 0.01%)lib.nr:59:40::self == other (70 gates, 0.05%)lib.nr:328:9::bn.eq(self, other) (70 gates, 0.05%)runtime_bignum.nr:603:9::is_equal_modulus | is_equal_zero (2 gates, 0.00%)opcode::arithmetic (2 gates, 0.00%)all (136,637 gates, 100%)main.nr:28:5::curves::bls12_381::test_mul() (136,637 gates, 100.00%)main.nr:28:5::curves::bls12_381::test_mul()bls12_381.nr:165:12::result.y.eq(expected.y) (71 gates, 0.05%)opcode::arithmetic (1 gates, 0.00%) \ No newline at end of file diff --git a/info.sh b/info.sh index 4bdc827..da7cbab 100755 --- a/info.sh +++ b/info.sh @@ -4,4 +4,7 @@ nargo compile --force && bb gates -b ./target/noir_bigcurve.json # You'll need to replace all the paths for nargo, bb, the json file, for whatever they are on your machine. # And you'll need a recent version of nargo; possibly the one inside aztec-packages. -# ~/git/noir/target/debug/nargo compile && ~/.bb/bb gates_mega_honk -b ./target/noir_bigcurve.json > txt.txt && ~/git/noir/target/debug/noir-profiler gates-flamegraph --artifact-path ./target/noir_bigcurve.json --backend-path ~/.bb/bb --output ./flamegraph --backend-gates-command "gates_mega_honk" && python3 -m http.server --directory "./flamegraph" 3000 \ No newline at end of file +# ~/git/noir/target/debug/nargo compile && ~/.bb/bb gates_mega_honk -b ./target/noir_bigcurve.json > txt.txt && ~/git/noir/target/debug/noir-profiler gates-flamegraph --artifact-path ./target/noir_bigcurve.json --backend-path ~/.bb/bb --output ./flamegraph --backend-gates-command "gates_mega_honk" && python3 -m http.server --directory "./flamegraph" 3000 + + +bb gates -b target/use.json -h \ No newline at end of file diff --git a/src/curves.nr b/src/curves.nr index 9814094..e11a6dd 100644 --- a/src/curves.nr +++ b/src/curves.nr @@ -1,2 +1,2 @@ -mod bls12_381; -mod bn254; +pub mod bls12_381; +pub mod bn254; diff --git a/src/curves/bls12_381.nr b/src/curves/bls12_381.nr index 5325129..6d03f3e 100644 --- a/src/curves/bls12_381.nr +++ b/src/curves/bls12_381.nr @@ -35,7 +35,6 @@ impl CurveParamsTrait> for BLS12_381_Curve_Params ] } - // TODO: See sage for derivation `BLS12_381_E.gens()`. It's perhaps not the best "nothing up my sleeve" generator, but it is on the curve, and works for now... fn offset_generator() -> [BigNum<4, BLS12_381_Fq_Params>; 2] { [ BigNum { @@ -75,58 +74,11 @@ impl CurveParamsTrait> for BLS12_381_Curve_Params } } -type BLS12_381_Point = BigCurve; -type BLS12_381_Point_J = CurveJ; +pub type BLS12_381_Point = BigCurve; +pub type BLS12_381_Point_J = CurveJ; -fn main(x: Field) { - let mut foo: [Field; 8] = [0; 8]; - foo[0] = x; - for i in 1..8 { - foo[i] = foo[i-1]* x; - } - let P: BLS12_381_Point = BigCurve { - x: BigNum { limbs: [foo[0], foo[1], foo[2], foo[3]] }, - y: BigNum { limbs: [foo[4], foo[5], foo[6], foo[7]] }, - is_infinity: false - }; - // 255-bit scalar field for BLS12_381 => 64 nibbles. - let scalar: ScalarField<64> = ScalarField::from(x); // p - 2 ? - let transcript = unsafe { - __get_mul_transcript(CurveJ::from(P), scalar) - }; - // 30768 - // 31020 - let mut A = P; - for i in 0..101 { - for j in 0..3 { - std::as_witness(transcript[i].lambda.limbs[j]); - std::as_witness(transcript[i].x3.limbs[j]); - std::as_witness(transcript[i].y3.limbs[j]); - } - A = A.double_with_hint(transcript[i]); - } - // println(f"{A}"); - // let result = P.mul_with_hint(scalar, transcript); - // // -2 - // let mut expected: BLS12_381_Point = BigCurve { - // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, - // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } - // }; - // expected.y = BigNum::new() - expected.y; - // assert(result == expected); - // let scalar2: ScalarField<64> = ScalarField::from(x * x); // p - 2 ? - // let transcript2 = __get_mul_transcript(CurveJ { x: Q.x, y: Q.y, z: BigNum::one() }, scalar); - // let result = Q.mul_with_hint(scalar2, transcript2); - // // -2 - // let mut expected: BLS12_381_Point = BigCurve { - // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, - // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } - // }; - // expected.y = BigNum::new() - expected.y; - // assert(result.x.eq(expected.x)); - // assert(result.y.eq(expected.y)); -} +// TESTING: unconstrained fn __evaluate_mul(P: BLS12_381_Point_J, scalar: ScalarField<64>, Q: BLS12_381_Point_J, K: BLS12_381_Point_J) -> bool { let s = (P.__mul(scalar)); @@ -147,9 +99,6 @@ unconstrained fn __get_msm_transcript( unconstrained fn __get_mul_transcript(P: BLS12_381_Point_J, scalar: ScalarField<64>) -> [AffineTranscript; 326] { let res = P.__mul(scalar); let transcript = res.1; - // println(f"let transcript: AffineTranscript = {transcript}"); - // let ff = transcript.len(); - // println(f"transcript len = {ff}"); transcript.as_array() } @@ -180,7 +129,6 @@ fn test_mul() { }, is_infinity: false }; - // expected.y = BigNum::new() - expected.y; assert(result.x.eq(expected.x)); assert(result.y.eq(expected.y)); } @@ -190,7 +138,6 @@ fn test_offset_foo() { let P: BLS12_381_Point = BigCurve::offset_generator_final(); // It can be any point, really. let R: BLS12_381_Point = P.sub(P); - // println(f"R = {R}"); assert(R.is_infinity == true); } @@ -207,8 +154,7 @@ fn test_mul_by_0() { }; let result = P.mul_with_hint(scalar, transcript); - // println(f"RESULT = {result}"); - // -2 + assert(result.is_infinity == true); } @@ -223,8 +169,7 @@ fn test_mul_a_point_at_infinity() { }; let result = P.mul_with_hint(scalar, transcript); - // println(f"RESULT = {result}"); - // -2 + assert(result.is_infinity == true); } @@ -519,25 +464,17 @@ fn test_add() { let Two_P_j_unconstrained = P_j.__add(P_j); let Two_P_j_dbl_unconstrained = P_j.__dbl(); - // let Three_P = P.add(P.add(P)); - // let Three_P_alt = P.add(Two_P); - // let P_plus_P = P.add(P); - // println(f"P: {P}"); - // println(f"P+P: {P_plus_P}"); - // println(f"Two_P: {Two_P}"); - let Two_P_alt = P + P; assert(Two_P.eq(Two_P_alt)); // doubling let Q: BLS12_381_Point = BigCurve::one(); // P - // THIS DOUBLING BREAKS!!! result = CurveJ::from(P.add(Q)); // 2P_j expected = unsafe { P_j.__dbl().0 }; // 2P_j assert(result.eq(expected)); - // // infinity + // infinity let Neg_P = P.neg(); result = CurveJ::from(P.add(Neg_P)); // 0_j expected = unsafe { CurveJ::__point_at_infinity() }; diff --git a/src/curves/bn254.nr b/src/curves/bn254.nr index 3c1e176..cfeba9b 100644 --- a/src/curves/bn254.nr +++ b/src/curves/bn254.nr @@ -51,57 +51,12 @@ impl CurveParamsTrait> for BN254_Curve_Params { } } -type BN254_Point = BigCurve; -type BN254_Point_J = CurveJ; - -fn main(x: Field) { - let mut foo: [Field; 6] = [0; 6]; - foo[0] = x; - for i in 1..6 { - foo[i] = foo[i-1] * x; - } - let P: BN254_Point = BigCurve { - x: BigNum { limbs: [foo[0], foo[1], foo[2]] }, - y: BigNum { limbs: [foo[3], foo[4], foo[5]] }, - is_infinity: false - }; +pub type BN254_Point = BigCurve; +pub type BN254_Point_J = CurveJ; + + +// TESTING: - let scalar: ScalarField<64> = ScalarField::from(x); // p - 2 ? - let transcript = unsafe { - __get_mul_transcript(CurveJ::from(P), scalar) - }; - // 30768 - // 31020 - let mut A = P; - for i in 0..101 { - for j in 0..3 { - std::as_witness(transcript[i].lambda.limbs[j]); - std::as_witness(transcript[i].x3.limbs[j]); - std::as_witness(transcript[i].y3.limbs[j]); - } - A = A.double_with_hint(transcript[i]); - } - // println(f"{A}"); - // let result = P.mul_with_hint(scalar, transcript); - // // -2 - // let mut expected: BN254_Point = BigCurve { - // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, - // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } - // }; - // expected.y = BigNum::new() - expected.y; - // assert(result == expected); - // let scalar2: ScalarField<64> = ScalarField::from(x * x); // p - 2 ? - // let transcript2 = get_transcript(CurveJ { x: Q.x, y: Q.y, z: BigNum::one() }, scalar); - // let result = Q.mul_with_hint(scalar2, transcript2); - // // -2 - // let mut expected: BN254_Point = BigCurve { - // x: BigNum { limbs: [0x7816a916871ca8d3c208c16d87cfd3, 0x44e72e131a029b85045b68181585d9, 0x0306] }, - // y: BigNum { limbs: [0xa6a449e3538fc7ff3ebf7a5a18a2c4, 0x738c0e0a7c92e7845f96b2ae9c0a68, 0x15ed] } - // }; - // expected.y = BigNum::new() - expected.y; - // assert(result.x.eq(expected.x)); - // assert(result.y.eq(expected.y)); -} unconstrained fn __get_msm_transcript( P: BN254_Point_J, diff --git a/src/lib.nr b/src/lib.nr index 267ad35..505247a 100644 --- a/src/lib.nr +++ b/src/lib.nr @@ -1,20 +1,20 @@ -mod scalar_field; -mod curve_jac; -mod curves; +pub mod scalar_field; +pub mod curve_jac; +pub mod curves; mod test_data; use dep::bignum::BigNum; +use dep::bignum::BigNumTrait; use crate::scalar_field::ScalarField; use crate::curve_jac::AffineTranscript; use crate::curve_jac::AffineLinearExpressionTranscript; use crate::curve_jac::CurveJ; -use dep::bignum::BigNumTrait; /** * @brief Implements an elliptic curve instantiated over a prime field that is NOT the circuit's native field **/ -struct BigCurve { +pub struct BigCurve { x: BigNum, y: BigNum, is_infinity: bool, @@ -619,7 +619,7 @@ impl BigCurve where CurveParams: Curve accumulator } - fn msm_with_hint( + pub fn msm_with_hint( mut points: [Self; Size], mut scalars: [ScalarField; Size], transcript: [AffineTranscript; NTranscriptSlices] diff --git a/txt.txt b/txt.txt new file mode 100644 index 0000000..e69de29 From 82ae959fb9c67dcbe823eb044732b8fab3d2fd51 Mon Sep 17 00:00:00 2001 From: Michael Connor Date: Fri, 11 Oct 2024 10:17:12 +0100 Subject: [PATCH 5/5] tidy --- info.sh | 9 --------- src/curves/bls12_381.nr | 13 ++++++++++--- src/curves/bn254.nr | 6 +----- txt.txt | 0 4 files changed, 11 insertions(+), 17 deletions(-) delete mode 100644 txt.txt diff --git a/info.sh b/info.sh index da7cbab..6a003f3 100755 --- a/info.sh +++ b/info.sh @@ -1,10 +1 @@ nargo compile --force && bb gates -b ./target/noir_bigcurve.json - -# This is the command I've been using, to then view a flamegraph at localhost:3000: -# You'll need to replace all the paths for nargo, bb, the json file, for whatever they are on your machine. -# And you'll need a recent version of nargo; possibly the one inside aztec-packages. - -# ~/git/noir/target/debug/nargo compile && ~/.bb/bb gates_mega_honk -b ./target/noir_bigcurve.json > txt.txt && ~/git/noir/target/debug/noir-profiler gates-flamegraph --artifact-path ./target/noir_bigcurve.json --backend-path ~/.bb/bb --output ./flamegraph --backend-gates-command "gates_mega_honk" && python3 -m http.server --directory "./flamegraph" 3000 - - -bb gates -b target/use.json -h \ No newline at end of file diff --git a/src/curves/bls12_381.nr b/src/curves/bls12_381.nr index 6d03f3e..628a8a8 100644 --- a/src/curves/bls12_381.nr +++ b/src/curves/bls12_381.nr @@ -77,10 +77,14 @@ impl CurveParamsTrait> for BLS12_381_Curve_Params pub type BLS12_381_Point = BigCurve; pub type BLS12_381_Point_J = CurveJ; - // TESTING: -unconstrained fn __evaluate_mul(P: BLS12_381_Point_J, scalar: ScalarField<64>, Q: BLS12_381_Point_J, K: BLS12_381_Point_J) -> bool { +unconstrained fn __evaluate_mul( + P: BLS12_381_Point_J, + scalar: ScalarField<64>, + Q: BLS12_381_Point_J, + K: BLS12_381_Point_J +) -> bool { let s = (P.__mul(scalar)); assert(s.0.eq(K.__neg())); Q.eq(s.0) @@ -96,7 +100,10 @@ unconstrained fn __get_msm_transcript( s.1 } -unconstrained fn __get_mul_transcript(P: BLS12_381_Point_J, scalar: ScalarField<64>) -> [AffineTranscript; 326] { +unconstrained fn __get_mul_transcript( + P: BLS12_381_Point_J, + scalar: ScalarField<64> +) -> [AffineTranscript; 326] { let res = P.__mul(scalar); let transcript = res.1; transcript.as_array() diff --git a/src/curves/bn254.nr b/src/curves/bn254.nr index cfeba9b..5dc1f9a 100644 --- a/src/curves/bn254.nr +++ b/src/curves/bn254.nr @@ -54,10 +54,8 @@ impl CurveParamsTrait> for BN254_Curve_Params { pub type BN254_Point = BigCurve; pub type BN254_Point_J = CurveJ; - // TESTING: - unconstrained fn __get_msm_transcript( P: BN254_Point_J, Q: BN254_Point_J, @@ -74,9 +72,7 @@ unconstrained fn __get_mul_transcript( ) -> [AffineTranscript; 326] { let res = P.__mul(scalar); let transcript = res.1; - // println(f"let transcript: AffineTranscript = {transcript}"); - // let ff = transcript.len(); - // println(f"transcript len = {ff}"); + transcript.as_array() } diff --git a/txt.txt b/txt.txt deleted file mode 100644 index e69de29..0000000