1
1
use super :: { add, double, util, CellValue , EccConfig , EccPoint } ;
2
2
use crate :: constants:: NUM_COMPLETE_BITS ;
3
+ use std:: ops:: Deref ;
3
4
4
5
use ff:: PrimeField ;
5
6
use halo2:: {
@@ -55,8 +56,7 @@ pub(super) fn create_gate<F: FieldExt>(
55
56
// y_{A,i+1} = (λ_{1,i+1} + λ_{2,i+1})
56
57
// * (x_{A,i+1} - (λ_{1,i+1}^2 - x_{A,i+1} - x_{P,i+1})) / 2
57
58
let y_a_next = ( lambda1_next. clone ( ) + lambda2_next)
58
- * ( x_a_next. clone ( )
59
- - ( lambda1_next. clone ( ) * lambda1_next - x_a_next. clone ( ) - x_p_next. clone ( ) ) )
59
+ * ( x_a_next. clone ( ) - ( lambda1_next. clone ( ) * lambda1_next - x_a_next. clone ( ) - x_p_next) )
60
60
* F :: TWO_INV ;
61
61
62
62
// λ_{1,i}⋅(x_{A,i} − x_{P,i}) − y_{A,i} + (2k_i - 1) y_{P,i} = 0
@@ -158,7 +158,7 @@ pub(super) fn assign_region<C: CurveAffine>(
158
158
159
159
// Bits used in incomplete addition. k_{254} to k_{4} inclusive
160
160
let incomplete_range = 0 ..( C :: Scalar :: NUM_BITS as usize - 1 - NUM_COMPLETE_BITS ) ;
161
- let k_incomplete = & k_bits[ incomplete_range. clone ( ) ] ;
161
+ let k_incomplete = & k_bits[ incomplete_range] ;
162
162
let k_incomplete_hi = & k_incomplete[ ..k_incomplete. len ( ) / 2 ] ;
163
163
let k_incomplete_lo = & k_incomplete[ k_incomplete. len ( ) / 2 ..] ;
164
164
@@ -183,8 +183,7 @@ pub(super) fn assign_region<C: CurveAffine>(
183
183
offset + 1 ,
184
184
hi_columns,
185
185
k_incomplete_hi,
186
- z,
187
- ( acc. x . clone ( ) , acc. y . value ) ,
186
+ ( X ( acc. x . clone ( ) ) , Y ( acc. y . value ) , ZValue ( z) ) ,
188
187
) ?;
189
188
190
189
// Double-and-add (incomplete addition) for the `lo` half of the scalar decomposition
@@ -195,8 +194,7 @@ pub(super) fn assign_region<C: CurveAffine>(
195
194
offset + 1 ,
196
195
lo_columns,
197
196
k_incomplete_lo,
198
- z,
199
- ( x, y_a) ,
197
+ ( x, y_a, z) ,
200
198
) ?;
201
199
202
200
// Move from incomplete addition to complete addition
@@ -219,8 +217,8 @@ pub(super) fn assign_region<C: CurveAffine>(
219
217
& config. perm_sum ,
220
218
) ?;
221
219
EccPoint {
222
- x,
223
- y : CellValue :: < C :: Base > :: new ( y_a_cell, y_a) ,
220
+ x : x . 0 ,
221
+ y : CellValue :: < C :: Base > :: new ( y_a_cell, * y_a) ,
224
222
}
225
223
} ;
226
224
@@ -332,7 +330,7 @@ pub(super) fn assign_region<C: CurveAffine>(
332
330
} ;
333
331
334
332
// Return the result of the final complete addition as `[scalar]B`
335
- add:: assign_region :: < C > ( & p, & acc, k_0_row + offset, region, config. clone ( ) )
333
+ add:: assign_region :: < C > ( & p, & acc, k_0_row + offset, region, config)
336
334
} else {
337
335
// If `k_0` is 1, simply return `Acc`
338
336
Ok ( acc)
@@ -347,6 +345,36 @@ struct IncompleteColumns {
347
345
lambda : ( Column < Advice > , Column < Advice > ) ,
348
346
}
349
347
348
+ #[ derive( Clone , Debug ) ]
349
+ struct X < F : FieldExt > ( CellValue < F > ) ;
350
+ impl < F : FieldExt > Deref for X < F > {
351
+ type Target = CellValue < F > ;
352
+
353
+ fn deref ( & self ) -> & Self :: Target {
354
+ & self . 0
355
+ }
356
+ }
357
+
358
+ #[ derive( Copy , Clone , Debug ) ]
359
+ struct Y < F : FieldExt > ( Option < F > ) ;
360
+ impl < F : FieldExt > Deref for Y < F > {
361
+ type Target = Option < F > ;
362
+
363
+ fn deref ( & self ) -> & Self :: Target {
364
+ & self . 0
365
+ }
366
+ }
367
+
368
+ #[ derive( Clone , Debug ) ]
369
+ struct ZValue < F : FieldExt > ( CellValue < F > ) ;
370
+ impl < F : FieldExt > Deref for ZValue < F > {
371
+ type Target = CellValue < F > ;
372
+
373
+ fn deref ( & self ) -> & Self :: Target {
374
+ & self . 0
375
+ }
376
+ }
377
+
350
378
// We perform incomplete addition on all but the last three bits of the
351
379
// decomposed scalar.
352
380
// We split the bits in the incomplete addition range into "hi" and "lo"
@@ -360,13 +388,12 @@ fn add_incomplete<C: CurveAffine>(
360
388
offset : usize ,
361
389
columns : IncompleteColumns ,
362
390
bits : & [ bool ] ,
363
- starting_z : CellValue < C :: Base > ,
364
- acc : ( CellValue < C :: Base > , Option < C :: Base > ) ,
365
- ) -> Result < ( CellValue < C :: Base > , Option < C :: Base > , CellValue < C :: Base > ) , Error > {
391
+ acc : ( X < C :: Base > , Y < C :: Base > , ZValue < C :: Base > ) ,
392
+ ) -> Result < ( X < C :: Base > , Y < C :: Base > , ZValue < C :: Base > ) , Error > {
366
393
// Initialise the running `z` sum for the scalar bits.
367
- let mut z_val = starting_z . value . unwrap ( ) ;
394
+ let mut z_val = acc . 2 . value . unwrap ( ) ;
368
395
let mut z_cell = region. assign_advice ( || "starting z" , columns. z , offset, || Ok ( z_val) ) ?;
369
- region. constrain_equal ( & config. perm_sum , z_cell, starting_z . cell ) ?;
396
+ region. constrain_equal ( & config. perm_sum , z_cell, acc . 2 . cell ) ?;
370
397
371
398
let offset = offset + 1 ;
372
399
@@ -379,7 +406,7 @@ fn add_incomplete<C: CurveAffine>(
379
406
|| x_a. ok_or ( Error :: SynthesisError ) ,
380
407
) ?;
381
408
region. constrain_equal ( & config. perm_sum , x_a_cell, acc. 0 . cell ) ?;
382
- let mut y_a = acc. 1 ;
409
+ let mut y_a = * acc. 1 ;
383
410
384
411
// Enable `q_mul` on all but the last row of the incomplete range.
385
412
for row in 1 ..( bits. len ( ) - 1 ) {
@@ -461,9 +488,9 @@ fn add_incomplete<C: CurveAffine>(
461
488
) ?;
462
489
}
463
490
Ok ( (
464
- CellValue :: < C :: Base > :: new ( x_a_cell, x_a) ,
465
- y_a,
466
- CellValue :: < C :: Base > :: new ( z_cell, Some ( z_val) ) ,
491
+ X ( CellValue :: < C :: Base > :: new ( x_a_cell, x_a) ) ,
492
+ Y ( y_a) ,
493
+ ZValue ( CellValue :: < C :: Base > :: new ( z_cell, Some ( z_val) ) ) ,
467
494
) )
468
495
}
469
496
0 commit comments