sample.cpp

Go to the documentation of this file.

/*
    a tiny sample of optimal ate pairing
*/
#include "bn.h"
#include "test_point.hpp"
 
static int errNum = 0;
 
template<class T, class S>
void verify(const char *msg, const T& a, const S& b)
{
    if (a == b) {
        printf("%s : ok\n", msg);
    } else {
        printf("%s : ng\n", msg);
        PUT(a);
        PUT(b);
        errNum++;
    }
}
 
void sample1(const bn::CurveParam& cp)
{
    using namespace bn;
    // init my library
    Param::init(cp);
    // prepair a generator
    const Point& pt = selectPoint(cp);
    const Fp2 g2[3] = {
        Fp2(Fp(pt.g2.aa), Fp(pt.g2.ab)),
        Fp2(Fp(pt.g2.ba), Fp(pt.g2.bb)),
        Fp2(1, 0),
    };
    const Fp g1[3] = { pt.g1.a, pt.g1.b, 1 };
    // verify g2 and g1 on curve
    verify("g1 is on EC", ecop::isOnECJac3(g1), true);
    verify("g2 is on twist EC", ecop::isOnTwistECJac3(g2), true);
    puts("order of group");
    PUT(Param::r);
    PUT(Param::p);
    PUT(Param::t);
    {
        Fp t[3];
        ecop::ScalarMult(t, g1, Param::r);
        // (x, y, 0) means 0 at Jacobi coordinate
        verify("orgder of g1 == r", t[2], 0);
    }
    {
        Fp2 t[3];
        ecop::ScalarMult(t, g2, Param::r);
        verify("order of g2 == r", t[2], 0);
    }
    const char *aStr = "123456789012345";
    const char *bStr = "998752342342342342424242421";
    const mie::Vuint a(aStr);
    const mie::Vuint b(bStr);
 
    // scalar-multiplication sample
    {
        Fp Pa[3];
        Fp Pb[3];
        Fp Pc[3];
        Fp out[3];
        const mie::Vuint c = a + b;
 
        ecop::ScalarMult(Pa, g1, a); // Pa = g1 * a
        ecop::ScalarMult(Pb, g1, b); // Pb = g1 * b
        ecop::ScalarMult(Pc, g1, c); // Pc = g1 * (a + b)
        ecop::ECAdd(out, Pa, Pb); // g1 * a + g1 * b
        ecop::NormalizeJac(Pc, Pc);
        ecop::NormalizeJac(out, out);
        std::cout << std::hex;
        verify("check g1 * c = g1 * a + g1 * b", Pc[0] == out[0] && Pc[1] == out[1] && Pc[2] == out[2], true);
 
#ifdef MIE_ATE_USE_GMP
        {
            mpz_class aa(aStr);
            mpz_class bb(bStr);
            mpz_class cc = aa + bb;
            Fp Paa[3];
            Fp Pbb[3];
            Fp Pcc[3];
            ecop::ScalarMult(Paa, g1, aa); // Pa = g1 * a
            ecop::ScalarMult(Pbb, g1, bb); // Pb = g1 * b
            ecop::ScalarMult(Pcc, g1, cc); // Pc = g1 * (a + b)
            ecop::NormalizeJac(Pcc, Pcc);
            verify("gmp Paa == Pa", Paa[0] == Pa[0] && Paa[1] == Pa[1] && Paa[2] == Pa[2], true);
            verify("gmp Pbb == Pb", Pbb[0] == Pb[0] && Pbb[1] == Pb[1] && Pbb[2] == Pb[2], true);
            verify("gmp Pcc == Pc", Pcc[0] == Pc[0] && Pcc[1] == Pc[1] && Pcc[2] == Pc[2], true);
        }
#endif
    }
 
    Fp12 e;
    // calc e : G2 x G1 -> G3 pairing
    opt_atePairingJac<Fp>(e, g2, g1); // e = e(g2, g1)
    PUT(e);
    {
        Fp12 t = power(e, Param::r);
        verify("order of e == r", t, 1);
    }
    Fp2 g2a[3];
    ecop::ScalarMult(g2a, g2, a); // g2a = g2 * a
    Fp12 ea1;
    opt_atePairingJac<Fp>(ea1, g2a, g1); // ea1 = e(g2a, g1)
    Fp12 ea2 = power(e, a); // ea2 = e^a
    verify("e(g2 * a, g1) = e(g2, g1)^a", ea1, ea2);
 
    Fp g1b[3];
    ecop::ScalarMult(g1b, g1, b); // g1b = g1 * b
    Fp12 eb1;
    opt_atePairingJac<Fp>(eb1, g2, g1b); // eb1 = e(g2, g1b)
    Fp12 eb2 = power(e, b); // eb2 = e^b
    verify("e(g2a, g1 * b) = e(g2, g1)^b", eb1, eb2);
 
    Fp q1[3];
    ecop::ScalarMult(q1, g1, 12345);
 
    verify("q1 is on EC", ecop::isOnECJac3(q1), true);
    Fp12 e1, e2;
    opt_atePairingJac<Fp>(e1, g2, g1); // e1 = e(g2, g1)
    opt_atePairingJac<Fp>(e2, g2, q1); // e2 = e(g2, q1)
    Fp q2[3];
    ecop::ECAdd(q2, g1, q1); // q2 = g1 + q1
    opt_atePairingJac<Fp>(e, g2, q2); // e = e(g2, q2)
    verify("e = e1 * e2", e, e1 * e2);
}
 
void sample2(const bn::CurveParam& cp)
{
    using namespace bn;
    // init my library
    Param::init(cp);
    const Point& pt = selectPoint(cp);
    const Ec2 g2(
        Fp2(Fp(pt.g2.aa), Fp(pt.g2.ab)),
        Fp2(Fp(pt.g2.ba), Fp(pt.g2.bb))
    );
    const Ec1 g1(pt.g1.a, pt.g1.b);
    // verify g2 and g1 on curve
    verify("g1 is on EC", g1.isValid(), true);
    verify("g2 is on twist EC", g2.isValid(), true);
    puts("order of group");
    PUT(Param::r);
    {
        Ec1 t = g1 * Param::r;
        // Ec1::mul(t, g1, Param::r);
        verify("orgder of g1 == r", t.isZero(), true);
    }
    {
        Ec2 t = g2 * Param::r;
        // Ec2::mul(t, g2, Param::r);
        verify("order of g2 == r", t.isZero(), true);
    }
    const char *aStr = "123456789012345";
    const char *bStr = "998752342342342342424242421";
    const mie::Vuint a(aStr);
    const mie::Vuint b(bStr);
 
    // scalar-multiplication sample
    {
        const mie::Vuint c = a + b;
        Ec1 Pa = g1 * a;
        Ec1 Pb = g1 * b;
        Ec1 Pc = g1 * c;
        Ec1 out = Pa + Pb;
 
        verify("check g1 * c = g1 * a + g1 * b", Pc, out);
#ifdef MIE_ATE_USE_GMP
        {
            mpz_class aa(aStr);
            mpz_class bb(bStr);
            mpz_class cc = aa + bb;
            Ec1 Paa = g1 * aa;
            Ec1 Pbb = g1 * bb;
            Ec1 Pcc = g1 * cc;
            verify("gmp Paa == Pa", Paa, Pa);
            verify("gmp Pbb == Pb", Pbb, Pb);
            verify("gmp Pcc == Pc", Pcc, Pc);
        }
#endif
    }
 
    Fp12 e;
    // calc e : G2 x G1 -> G3 pairing
    opt_atePairing(e, g2, g1); // e = e(g2, g1)
    PUT(e);
    {
        Fp12 t = power(e, Param::r);
        verify("order of e == r", t, 1);
    }
    Ec2 g2a = g2 * a;
    // Ec2::mul(g2a, g2, a);
    Fp12 ea1;
    opt_atePairing(ea1, g2a, g1); // ea1 = e(g2a, g1)
    Fp12 ea2 = power(e, a); // ea2 = e^a
    verify("e(g2 * a, g1) = e(g2, g1)^a", ea1, ea2);
 
    Ec1 g1b = g1 * b;
    // Ec1::mul(g1b, g1, b);
    Fp12 eb1;
    opt_atePairing(eb1, g2, g1b); // eb1 = e(g2, g1b)
    Fp12 eb2 = power(e, b); // eb2 = e^b
    verify("e(g2a, g1 * b) = e(g2, g1)^b", eb1, eb2);
 
    Ec1 q1 = g1 * 12345;
    verify("q1 is on EC", q1.isValid(), true);
    Fp12 e1, e2;
    opt_atePairing(e1, g2, g1); // e1 = e(g2, g1)
    opt_atePairing(e2, g2, q1); // e2 = e(g2, q1)
    Ec1 q2 = g1 + q1;
    opt_atePairing(e, g2, q2); // e = e(g2, q2)
    verify("e = e1 * e2", e, e1 * e2);
 
    /*
        reduce one copy as the following
    */
    Ec2::mul(g2a, g2, a); // g2a = g2 * a
    Ec1::mul(g1b, g1, b);
    verify("g2a == g2 * a", g2a, g2 * a);
    verify("g1b == g1 * b", g1b, g1 * b);
}
 
void multi(const bn::CurveParam& cp)
{
    using namespace bn;
    // init my library
    Param::init(cp);
    const Point& pt = selectPoint(cp);
    const Ec2 g2(
        Fp2(Fp(pt.g2.aa), Fp(pt.g2.ab)),
        Fp2(Fp(pt.g2.ba), Fp(pt.g2.bb))
    );
    const Ec1 g1(pt.g1.a, pt.g1.b);
    const size_t N = 10;
    const int c = 234567;
    std::vector<Ec1> g1s;
    g1s.resize(N);
 
    for (size_t i = 0; i < N; i++) {
        Ec1::mul(g1s[i], g1, c + i);
        g1s[i] = g1 * (c + i);
        g1s[i].normalize();
    }
    std::vector<Fp6> Qcoeff;
    Fp2 precQ[3];
    bn::components::precomputeG2(Qcoeff, precQ, g2.p);
    for (size_t i = 0; i < N; i++) {
        Fp12 e1;
        bn::components::millerLoop(e1, Qcoeff, g1s[i].p);
        e1.final_exp();
        Fp12 e2;
        opt_atePairing(e2, g2, g1s[i]);
        if (e1 != e2) {
            printf("err multi %d\n", (int)i);
        }
    }
}
 
int main(int argc, char *argv[])
{
#ifdef BN_SUPPORT_SNARK
    int b = 3;
    if (argc >= 2) {
        b = atoi(argv[1]);
        if (b != 3 && b != 82) {
            printf("not support b=%d\n", b);
            return 1;
        }
    }
    printf("SNARK b = %d\n", b);
    bn::CurveParam cp = bn::CurveSNARK1;
    cp.b = b;
#else
    if (argc > 1 && argv[1]) {
        printf("not support\n");
        return 1;
    }
    bn::CurveParam cp = bn::CurveFp254BNb;
#endif
    puts("sample1");
    sample1(cp);
    puts("sample2");
    sample2(cp);
    puts("multi");
    multi(cp);
    printf("errNum = %d\n", errNum);
}