Struct halo2_ecc::fields::fp12::Fp12Chip

pub struct Fp12Chip<'a, F: PrimeField, FpChip: FieldChip<F>, Fp12, const XI_0: i64>(pub FieldVectorChip<'a, F, FpChip>, _);

Represent Fp12 point as FqPoint with degree = 12 Fp12 = Fp2[w] / (w^6 - u - xi) This implementation assumes p = 3 (mod 4) in order for the polynomial u^2 + 1 to be irreducible over Fp; i.e., in order for -1 to not be a square (quadratic residue) in Fp This means we store an Fp12 point as \sum_{i = 0}^6 (a_{i0} + a_{i1} * u) * w^i This is encoded in an FqPoint of degree 12 as (a_{00}, ..., a_{50}, a_{01}, ..., a_{51})

Tuple Fields

0: FieldVectorChip<'a, F, FpChip>

Implementations

impl<'a, F, FpChip, Fp12, const XI_0: i64> Fp12Chip<'a, F, FpChip, Fp12, XI_0>where
    F: PrimeField,
    FpChip: PrimeFieldChip<F>,
    FpChip::FieldType: PrimeField,
    Fp12: Field,

pub fn new(fp_chip: &'a FpChip) -> Self

User must construct an FpChip first using a config. This is intended so everything shares a single FlexGateChip, which is needed for the column allocation to work.

pub fn fp_chip(&self) -> &FpChip

pub fn fp2_mul_no_carry(
    &self,
    ctx: &mut Context<F>,
    fp12_pt: FieldVector<FpChip::UnsafeFieldPoint>,
    fp2_pt: FieldVector<FpChip::UnsafeFieldPoint>
) -> FieldVector<FpChip::UnsafeFieldPoint>

pub fn conjugate(
    &self,
    ctx: &mut Context<F>,
    a: FieldVector<FpChip::FieldPoint>
) -> FieldVector<FpChip::FieldPoint>

impl<'chip, F: PrimeField> Fp12Chip<'chip, F, FpChip<'chip, F, Fq>, Fq12, 9>

pub fn frobenius_map(
    &self,
    ctx: &mut Context<F>,
    a: &<Self as FieldChip<F>>::FieldPoint,
    power: usize
) -> <Self as FieldChip<F>>::FieldPoint

pub fn pow(
    &self,
    ctx: &mut Context<F>,
    a: &<Self as FieldChip<F>>::FieldPoint,
    exp: Vec<u64>
) -> <Self as FieldChip<F>>::FieldPoint

Assumptions

• a is nonzero field point

pub fn cyclotomic_compress(&self, a: &FqPoint<F>) -> Vec<FqPoint<F>>

in = g0 + g2 w + g4 w^2 + g1 w^3 + g3 w^4 + g5 w^5 where g_i = g_i0 + g_i1 * u are elements of Fp2 out = Compress(in) = [ g2, g3, g4, g5 ]

pub fn cyclotomic_decompress(
    &self,
    ctx: &mut Context<F>,
    compression: Vec<FqPoint<F>>
) -> FqPoint<F>

Input:

• compression = [g2, g3, g4, g5] where g_i are proper elements of Fp2 Output:
• Decompress(compression) = g0 + g2 w + g4 w^2 + g1 w^3 + g3 w^4 + g5 w^5 where
• All elements of output are proper elements of Fp2 and: c = XI0 + u if g2 != 0: g1 = (g5^2 * c + 3 g4^2 - 2 g3)/(4g2) g0 = (2 g1^2 + g2 * g5 - 3 g3*g4) * c + 1 if g2 = 0: g1 = (2 g4 * g5)/g3 g0 = (2 g1^2 - 3 g3 * g4) * c + 1

pub fn cyclotomic_square(
    &self,
    ctx: &mut Context<F>,
    compression: &[FqPoint<F>]
) -> Vec<FqPoint<F>>

pub fn cyclotomic_pow(
    &self,
    ctx: &mut Context<F>,
    a: FqPoint<F>,
    exp: Vec<u64>
) -> FqPoint<F>

Assumptions

• a is a nonzero element in the cyclotomic subgroup

pub fn hard_part_BN(
    &self,
    ctx: &mut Context<F>,
    m: <Self as FieldChip<F>>::FieldPoint
) -> <Self as FieldChip<F>>::FieldPoint

pub fn easy_part(
    &self,
    ctx: &mut Context<F>,
    a: <Self as FieldChip<F>>::FieldPoint
) -> <Self as FieldChip<F>>::FieldPoint

Assumptions

• a is nonzero field point

pub fn final_exp(
    &self,
    ctx: &mut Context<F>,
    a: <Self as FieldChip<F>>::FieldPoint
) -> <Self as FieldChip<F>>::FieldPoint

Trait Implementations

impl<'a, F: Clone + PrimeField, FpChip: Clone + FieldChip<F>, Fp12: Clone, const XI_0: i64> Clone for Fp12Chip<'a, F, FpChip, Fp12, XI_0>

fn clone(&self) -> Fp12Chip<'a, F, FpChip, Fp12, XI_0>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a, F: Debug + PrimeField, FpChip: Debug + FieldChip<F>, Fp12: Debug, const XI_0: i64> Debug for Fp12Chip<'a, F, FpChip, Fp12, XI_0>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a, F, FpChip, Fp12, const XI_0: i64> FieldChip<F> for Fp12Chip<'a, F, FpChip, Fp12, XI_0>where
    F: PrimeField,
    FpChip: PrimeFieldChip<F>,
    FpChip::FieldType: PrimeField,
    Fp12: Field + FieldExtConstructor<FpChip::FieldType, 12>,
    FieldVector<FpChip::UnsafeFieldPoint>: From<FieldVector<FpChip::FieldPoint>>,
    FieldVector<FpChip::FieldPoint>: From<FieldVector<FpChip::ReducedFieldPoint>>,

const PRIME_FIELD_NUM_BITS: u32 = <FpChip::FieldType>::NUM_BITS

type UnsafeFieldPoint = FieldVector<<FpChip as FieldChip<F>>::UnsafeFieldPoint>

A representation of a field element that is used for intermediate computations. The representation can have “overflows” (e.g., overflow limbs or negative limbs).

type FieldPoint = FieldVector<<FpChip as FieldChip<F>>::FieldPoint>

The “proper” representation of a field element. Allowed to be a non-unique representation of a field element (e.g., can be greater than modulus)

type ReducedFieldPoint = FieldVector<<FpChip as FieldChip<F>>::ReducedFieldPoint>

A proper representation of field elements that guarantees a unique representation of each field element. Typically this means Uints that are less than the modulus.

type FieldType = Fp12

A type implementing Field trait to help with witness generation (for example with inverse)

type RangeChip = <FpChip as FieldChip<F>>::RangeChip

fn get_assigned_value(&self, x: &Self::UnsafeFieldPoint) -> Fp12

fn mul_no_carry(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    b: impl Into<Self::UnsafeFieldPoint>
) -> Self::UnsafeFieldPoint

fn native_modulus(&self) -> &BigUint

fn range(&self) -> &Self::RangeChip

fn limb_bits(&self) -> usize

fn load_private(
    &self,
    ctx: &mut Context<F>,
    fe: Self::FieldType
) -> Self::FieldPoint

Assigns fe as private witness. Note that the witness may not be constrained to be a unique representation of the field element fe.

fn load_constant(
    &self,
    ctx: &mut Context<F>,
    fe: Self::FieldType
) -> Self::FieldPoint

Assigns fe as constant.

fn add_no_carry(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    b: impl Into<Self::UnsafeFieldPoint>
) -> Self::UnsafeFieldPoint

fn add_constant_no_carry(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    c: Self::FieldType
) -> Self::UnsafeFieldPoint

output: a + c

fn sub_no_carry(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    b: impl Into<Self::UnsafeFieldPoint>
) -> Self::UnsafeFieldPoint

fn negate(&self, ctx: &mut Context<F>, a: Self::FieldPoint) -> Self::FieldPoint

fn scalar_mul_no_carry(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    c: i64
) -> Self::UnsafeFieldPoint

a * c

fn scalar_mul_and_add_no_carry(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    b: impl Into<Self::UnsafeFieldPoint>,
    c: i64
) -> Self::UnsafeFieldPoint

a * c + b

fn check_carry_mod_to_zero(&self, ctx: &mut Context<F>, a: Self::UnsafeFieldPoint)

fn carry_mod(
    &self,
    ctx: &mut Context<F>,
    a: Self::UnsafeFieldPoint
) -> Self::FieldPoint

fn range_check(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    max_bits: usize
)

fn enforce_less_than(
    &self,
    ctx: &mut Context<F>,
    a: Self::FieldPoint
) -> Self::ReducedFieldPoint

Constrains that a is a reduced representation and returns the wrapped a.

fn is_soft_zero(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::FieldPoint>
) -> AssignedValue<F>

fn is_soft_nonzero(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::FieldPoint>
) -> AssignedValue<F>

fn is_zero(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::FieldPoint>
) -> AssignedValue<F>

fn is_equal_unenforced(
    &self,
    ctx: &mut Context<F>,
    a: Self::ReducedFieldPoint,
    b: Self::ReducedFieldPoint
) -> AssignedValue<F>

fn assert_equal(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::FieldPoint>,
    b: impl Into<Self::FieldPoint>
)

fn gate(&self) -> &<Self::RangeChip as RangeInstructions<F>>::Gate

fn load_private_reduced(
    &self,
    ctx: &mut Context<F>,
    fe: Self::FieldType
) -> Self::ReducedFieldPoint

Assigns fe as private witness and contrains the witness to be in reduced form.

fn is_equal(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::FieldPoint>,
    b: impl Into<Self::FieldPoint>
) -> AssignedValue<F>

fn mul(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    b: impl Into<Self::UnsafeFieldPoint>
) -> Self::FieldPoint

If using UnsafeFieldPoint, make sure multiplication does not cause overflow.

fn divide(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::FieldPoint>,
    b: impl Into<Self::FieldPoint>
) -> Self::FieldPoint

Constrains that b is nonzero as a field element and then returns a / b.

fn divide_unsafe(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    b: impl Into<Self::UnsafeFieldPoint>
) -> Self::FieldPoint

Returns a / b without constraining b to be nonzero.

fn neg_divide(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::FieldPoint>,
    b: impl Into<Self::FieldPoint>
) -> Self::FieldPoint

Constrains that b is nonzero as a field element and then returns -a / b.

fn neg_divide_unsafe(
    &self,
    ctx: &mut Context<F>,
    a: impl Into<Self::UnsafeFieldPoint>,
    b: impl Into<Self::UnsafeFieldPoint>
) -> Self::FieldPoint

impl<'a, F: Copy + PrimeField, FpChip: Copy + FieldChip<F>, Fp12: Copy, const XI_0: i64> Copy for Fp12Chip<'a, F, FpChip, Fp12, XI_0>