ecc

Documentation

Overview

Package ecc provides bls12-381, bls12-377, bn254, bw6-761, bls24-315, bls24-317, bw6-633, secp256k1, secp256r1, grumpkin and stark-curve elliptic curves implementations.

Also

• Bilinear pairing
• Multi exponentiation
• FFT
• Polynomial commitment schemes
• MiMC and Poseidon2 hash functions
• twisted edwards "companion curves"
• ECDSA
• EdDSA (on the "companion" twisted edwards curves)

Index

• func NafDecomposition(a *big.Int, result []int8) int
• func NextPowerOfTwo(n uint64) uint64
• func PrecomputeLattice(r, lambda *big.Int, res *Lattice)
• func PrecomputeLattice4(res *Lattice4)
• func SplitScalar(s *big.Int, l *Lattice) [2]big.Int
• func SplitScalarFour(s *big.Int, l *Lattice4) [4]big.Int
• func WnafDecomposition(a *big.Int, window uint, result []int8) int
• type ID
  • func IDFromString(s string) (ID, error)
  • func (id ID) BaseField() *big.Int
  • func (id ID) ScalarField() *big.Int
  • func (id ID) String() string
• type Lattice
• type Lattice4
• type MultiExpConfig

Functions

func NafDecomposition

func NafDecomposition(a *big.Int, result []int8) int

NafDecomposition gets the naf decomposition of a big number

func NextPowerOfTwo

func NextPowerOfTwo(n uint64) uint64

NextPowerOfTwo(n) = 2^⌈log₂(n)⌉ or 2ᵏ where 2ᵏ⁻¹ < n ≤ 2ᵏ

func PrecomputeLattice

func PrecomputeLattice(r, lambda *big.Int, res *Lattice)

PrecomputeLattice res such that res.V1, res.V2 are short vectors satisfying v11+v12.λ=v21+v22.λ=0[r]. cf https://www.iacr.org/archive/crypto2001/21390189.pdf

func PrecomputeLattice4

func PrecomputeLattice4(res *Lattice4)

PrecomputeLattice4 sets res.Det and the rounding constants (b1..b4) for a 4-dimensional lattice basis stored in res.V. The constants correspond to the first column of adj(res.V)/det(res.V), used for the closest vector approximation to (s,0,0,0).

func SplitScalar

func SplitScalar(s *big.Int, l *Lattice) [2]big.Int

SplitScalar outputs u,v such that u+vlambda=s[r]. The method is to view s as (s,0) in ZxZ, and find a close vector w of (s,0) in <l>, where l is a sub Z-module of ker((a,b) → a+b.λ[r]): then (u,v)=w-(s,0), and u+v.λ=s[r]. cf https://www.iacr.org/archive/crypto2001/21390189.pdf

func SplitScalarFour

func SplitScalarFour(s *big.Int, l *Lattice4) [4]big.Int

SplitScalarFour computes k0,k1,k2,k3 such that k0+k1*lambda1+k2*lambda2+k3*lambda1*lambda2 = s [r]. It uses a closest vector approximation in a 4-dimensional lattice.

func WnafDecomposition

func WnafDecomposition(a *big.Int, window uint, result []int8) int

WnafDecomposition gets the wNAF decomposition of a big number. 2 <= window <= 8 is the wNAF window size.

Types

type ID

type ID uint16

ID represent a unique ID for a curve

const (
	UNKNOWN ID = iota
	BN254
	BLS12_377
	BLS12_381
	BLS24_315
	BLS24_317
	BW6_761
	BW6_633
	STARK_CURVE
	SECP256K1
	GRUMPKIN
	SECP256R1
)

do not modify the order of this enum

func IDFromString

func IDFromString(s string) (ID, error)

IDFromString returns the ID corresponding to the string representation of the curve ID. It returns UNKNOWN if the string does not match any known curve ID.

func (ID) BaseField

func (id ID) BaseField() *big.Int

BaseField returns the base field of the curve

func (ID) ScalarField

func (id ID) ScalarField() *big.Int

ScalarField returns the scalar field of the curve

func (ID) String

func (id ID) String() string

String returns the string representation of the ID

type Lattice

type Lattice struct {
	V1, V2 [2]big.Int
	Det    big.Int
	// contains filtered or unexported fields
}

Lattice represents a Z module spanned by V1, V2. det is the associated determinant.

type Lattice4

type Lattice4 struct {
	V   [4][4]big.Int
	Det big.Int
	// contains filtered or unexported fields
}

Lattice4 represents a Z module spanned by V[0], V[1], V[2], V[3]. The vectors are stored as columns: V[col][row]. det is the associated determinant.

type MultiExpConfig

type MultiExpConfig struct {
	NbTasks int // go routines to be used in the multiexp. can be larger than num cpus.
}

MultiExpConfig enables to set optional configuration attribute to a call to MultiExp