Add jubjub twisted edwards curve to stdlib

changelogs/unreleased/1259-dark64

@@ -0,0 +1 @@
+Add jubjub to stdlib (collab with @alvaro-alonso)

zokrates_core_test/tests/tests/arrays/fun_spread.zok

@@ -1,6 +1,6 @@
 import "utils/pack/bool/nonStrictUnpack256.zok" as unpack256;
 
 def main(field[2] inputs) -> bool[512] {
-    bool[512] preimage512 = [...unpack256(inputs[0]), ...unpack256(inputs[1])];
+    bool[512] preimage512 = [...unpack256(inputs[0], 254), ...unpack256(inputs[1], 254)];
     return preimage512;
 }

zokrates_stdlib/stdlib/ecc/babyjubjub.zok

@@ -0,0 +1,40 @@
+#pragma curve bn128
+
+import "./proofOfOwnership" as edwardsProofOfOwnership;
+import "./verifyEddsa" as edwardsSignature;
+import "utils/pack/bool/nonStrictUnpack256" as unpack256;
+
+// The `a` coefficient of the twisted Edwards curve
+const field EDWARDS_A = 168700;
+
+// The `d` coefficient of the twisted Edwards curve
+const field EDWARDS_D = 168696;
+
+// The generator point
+const field[2] G = [
+    16540640123574156134436876038791482806971768689494387082833631921987005038935, // Gx
+    20819045374670962167435360035096875258406992893633759881276124905556507972311  // Gy
+];
+
+const u32 bit_size = 254;
+
+def proofOfOwnership(field[2] pk, field sk) -> bool {
+    return edwardsProofOfOwnership(pk, sk, G, EDWARDS_A, EDWARDS_D, bit_size);
+}
+
+def verifyEddsa(field[2] R, field S, field[2] A, u32[8] M0, u32[8] M1) -> bool {
+    return edwardsSignature(R, S, A, M0, M1, G, EDWARDS_A, EDWARDS_D, bit_size);
+}
+
+def compress(field[2] pt) -> bool[256] {
+    field x = pt[0];
+    field y = pt[1];
+
+    bool[256] xBits = unpack256(x, 254);
+    bool[256] mut yBits = unpack256(y, 254);
+
+    bool sign = xBits[255];
+    yBits[0] = sign;
+
+    return yBits;
+}

zokrates_stdlib/stdlib/ecc/edwards.zok

@@ -0,0 +1,61 @@
+// Add two points on a twisted Edwards curve
+// https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Addition_on_twisted_Edwards_curves
+def add(field[2] pt1, field[2] pt2, field a, field d) -> field[2] {
+    field u1 = pt1[0];
+    field v1 = pt1[1];
+    field u2 = pt2[0];
+    field v2 = pt2[1];
+
+    field u = (u1*v2 + v1*u2) / (1 + d*u1*u2*v1*v2);
+    field v = (v1*v2 - a*u1*u2) / (1 - d*u1*u2*v1*v2);
+    return [u, v];
+}
+
+// Check if a point is on a twisted Edwards curve
+// See appendix 3.3.1 of Zcash protocol specification:
+// https://github.com/zcash/zips/blob/master/protocol/protocol.pdf
+def onCurve(field[2] pt, field a, field d) -> bool {
+    field uu = pt[0] * pt[0];
+    field vv = pt[1] * pt[1];
+    field uuvv = uu * vv;
+
+    assert(a * uu + vv == 1 + d * uuvv);
+    return true;
+}
+
+// Function that implements scalar multiplication for a fixed base point
+// Reference: https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/jubjub/fs.rs#L555
+def scalarMul<N>(bool[N] exponent, field[2] pt, field a, field d) -> field[2] {
+    field[2] mut res = pt;
+    field[2] mut acc = [0, 1];
+
+    for u32 i in 0..N {
+        u32 j = N - i - 1;
+        field[2] candidate = add(acc, res, a, d);
+        acc = exponent[j] ? candidate : acc;
+        res = add(res, res, a, d);
+    }
+
+    assert(onCurve(acc, a, d));
+    return acc;
+}
+
+// Negate a point on an Edwards curve
+// Twisted Edwards Curves, BBJLP-2008, section 2 pg 2
+def negate(field[2] pt) -> field[2] {
+    field u = pt[0];
+    field v = pt[1];
+    return [-u, v];
+}
+
+// Verifies that the point is not one of the low-order points.
+// If any of the points is multiplied by the cofactor, the resulting point will be infinity.
+// Returns true if the point is not one of the low-order points, false otherwise.
+// Cofactor is hard-coded to 8 for efficiency reasons
+// Reference: https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/jubjub/edwards.rs#L166
+def orderCheck(field[2] pt, field a, field d) -> bool {
+    field[2] mut res = add(pt, pt, a, d); // 2*pt
+    res = add(res, res, a, d);            // 4*pt
+    res = add(res, res, a, d);            // 8*pt
+    return !(res[0] == 0 && res[1] == 1);
+}

zokrates_stdlib/stdlib/ecc/jubjub.zok

@@ -0,0 +1,26 @@
+#pragma curve bls12_381
+
+import "./proofOfOwnership" as edwardsProofOfOwnership;
+import "./verifyEddsa" as edwardsSignature;
+
+// The `a` coefficient of the twisted Edwards curve
+const field EDWARDS_A = -1;
+
+// The `d` coefficient of the twisted Edwards curve (-10240/10241 mod p)
+const field EDWARDS_D = 19257038036680949359750312669786877991949435402254120286184196891950884077233;
+
+// The generator point
+const field[2] G = [
+    11076627216317271660298050606127911965867021807910416450833192264015104452986,  // Gx
+    44412834903739585386157632289020980010620626017712148233229312325549216099227  // Gy
+];
+
+const u32 bit_size = 255;
+
+def proofOfOwnership(field[2] pk, field sk) -> bool {
+    return edwardsProofOfOwnership(pk, sk, G, EDWARDS_A, EDWARDS_D, bit_size);
+}
+
+def verifyEddsa(field[2] R, field S, field[2] A, u32[8] M0, u32[8] M1) -> bool {
+    return edwardsSignature(R, S, A, M0, M1, G, EDWARDS_A, EDWARDS_D, bit_size);
+}

zokrates_stdlib/stdlib/ecc/proofOfOwnership.zok

@@ -1,7 +1,5 @@
-import "ecc/edwardsAdd" as add;
-import "ecc/edwardsScalarMult" as multiply;
 import "utils/pack/bool/nonStrictUnpack256" as unpack256;
-from "ecc/babyjubjubParams" import BabyJubJubParams;
+from "ecc/edwards" import scalarMul;
 
 /// Verifies match of a given public/private keypair.
 ///
@@ -11,18 +9,16 @@ from "ecc/babyjubjubParams" import BabyJubJubParams;
 ///    and * denotes scalar multiplication in the subgroup
 ///
 /// Arguments:
-///    pk: Curve point. Public key.
-///    sk: Field element. Private key.
-///    context: Curve parameters (including generator G) used to create keypair.
+///    pk: Curve point (public key)
+///    sk: Private key
+///    G: Generator point
+///    EDWARDS_A: Coefficient `a` of the twisted Edwards curve
+///    EDWARDS_D: Coefficient `d` of the twisted Edwards curve
+///    bit_size: Bit size of the twisted Edwards curve
 ///
-/// Returns:
-///     Return true for pk/sk being a valid keypair, false otherwise.
-def main(field[2] pk, field sk, BabyJubJubParams context) -> bool {
-    field[2] G = [context.Gu, context.Gv];
-
-    bool[256] skBits = unpack256(sk);
-    field[2] ptExp = multiply(skBits, G, context);
-
-    bool out = ptExp[0] == pk[0] && ptExp[1] == pk[1];
-    return out;
-}
+/// Returns true for pk/sk being a valid keypair, false otherwise.
+def main(field[2] pk, field sk, field[2] G, field EDWARDS_A, field EDWARDS_D, u32 bit_size) -> bool {
+    bool[256] sk_bits = unpack256(sk, bit_size);
+    field[2] res = scalarMul(sk_bits, G, EDWARDS_A, EDWARDS_D);
+    return (res[0] == pk[0] && res[1] == pk[1]);
+}