cycle_group represents a group Element of the proving system's embedded curve, i.e. a curve with a cofactor 1 defined over a field equal to the circuit's native field Builder::FF More...

#include <cycle_group.hpp>

Classes
struct	batch_mul_internal_output
	Stores temporary variables produced by internal multiplication algorithms. More...

Public Types
using	field_t = stdlib::field_t< Builder >

using	BaseField = field_t

using	bool_t = stdlib::bool_t< Builder >

using	witness_t = stdlib::witness_t< Builder >

using	Curve = bb::curve::Grumpkin

using	Group = bb::grumpkin::g1

using	Element = bb::grumpkin::g1::element

using	AffineElement = bb::grumpkin::g1::affine_element

using	GeneratorContext = crypto::GeneratorContext< Curve >

using	BigScalarField = stdlib::bigfield< Builder, bb::fq::Params >

using	cycle_scalar = ::bb::stdlib::cycle_scalar< Builder >

using	straus_lookup_table = ::bb::stdlib::straus_lookup_table< Builder >

using	straus_scalar_slices = ::bb::stdlib::straus_scalar_slices< Builder >

Public Member Functions
	cycle_group (Builder *_context=nullptr)
	Construct a new constant point at infinity cycle group object.

	cycle_group (const field_t &x, const field_t &y, bool_t is_infinity, bool assert_on_curve)
	Construct a new cycle group<Builder>::cycle group object.

	cycle_group (const bb::fr &x, const bb::fr &y, bool is_infinity)
	Construct a constant cycle_group object from raw field elements and a boolean.

	cycle_group (const AffineElement &_in)
	Construct a cycle_group object out of an AffineElement object.

Builder *	get_context (const cycle_group &other) const

Builder *	get_context () const

AffineElement	get_value () const

const field_t &	x () const

const field_t &	y () const

bool	is_constant () const

bool_t	is_point_at_infinity () const

bool	is_constant_point_at_infinity () const

void	standardize ()
	Convert the point to standard form.

void	validate_on_curve () const
	On-curve check.

cycle_group	dbl (const std::optional< AffineElement > hint=std::nullopt) const
	Evaluates a point doubling using Ultra ECC double gate (if non-constant)

cycle_group	unconditional_add (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point addition over `*this` and `other`.

cycle_group	unconditional_subtract (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point subtraction over `*this` and `other`.

cycle_group	checked_unconditional_add (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point addition over `*this` and `other`, with x-coordinate collision checks.

cycle_group	checked_unconditional_subtract (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point subtraction over `*this` and `other`, with x-coordinate collision checks.

cycle_group	operator+ (const cycle_group &other) const
	Evaluate ECC point addition over `*this` and `other`.

cycle_group	operator- (const cycle_group &other) const
	Evaluate ECC point subtraction over `*this` and `other`.

cycle_group	operator- () const
	Negates a point.

cycle_group &	operator+= (const cycle_group &other)

cycle_group &	operator-= (const cycle_group &other)

cycle_group	operator* (const cycle_scalar &scalar) const

cycle_group &	operator*= (const cycle_scalar &scalar)

cycle_group	operator* (const BigScalarField &scalar) const

cycle_group &	operator*= (const BigScalarField &scalar)

bool_t	operator== (cycle_group &other)

void	assert_equal (cycle_group &other, std::string const &msg="cycle_group::assert_equal")

void	set_origin_tag (OriginTag tag) const
	Set the origin tag for x, y and _is_infinity members of cycle_group.

OriginTag	get_origin_tag () const
	Get the origin tag of cycle_group (a merege of origin tags of x, y and _is_infinity members)

void	set_free_witness_tag ()
	Set the free witness flag for the cycle_group's tags.

void	unset_free_witness_tag ()
	Unset the free witness flag for the cycle_group's tags.

void	fix_witness ()

uint32_t	set_public ()
	Set the witness indices representing the cycle_group to public.

Static Public Member Functions
static cycle_group	one (Builder *_context)
	Construct a constant cycle_group representation of Group::one.

static cycle_group	constant_infinity (Builder *_context=nullptr)
	Construct a constant point at infinity.

static cycle_group	from_witness (Builder *_context, const AffineElement &_in)
	Converts an AffineElement into a circuit witness.

static cycle_group	from_constant_witness (Builder *_context, const AffineElement &_in)
	Converts a native AffineElement into a witness, but constrains the witness values to be known constants.

static cycle_group	batch_mul (const std::vector< cycle_group > &base_points, const std::vector< BigScalarField > &scalars, GeneratorContext context={})

static cycle_group	batch_mul (const std::vector< cycle_group > &base_points, const std::vector< cycle_scalar > &scalars, const GeneratorContext &context={})
	Multiscalar multiplication algorithm.

static cycle_group	conditional_assign (const bool_t &predicate, const cycle_group &lhs, const cycle_group &rhs)

static cycle_group	reconstruct_from_public (const std::span< const field_t, 2 > &limbs)
	Reconstruct a cycle_group from limbs (generally stored in the public inputs)

Static Public Attributes
static constexpr size_t	ROM_TABLE_BITS = 4

static constexpr size_t	NUM_BITS_FULL_FIELD_SIZE = bb::fq::modulus.get_msb() + 1

static constexpr std::string_view	OFFSET_GENERATOR_DOMAIN_SEPARATOR = "cycle_group_offset_generator"

static constexpr size_t	PUBLIC_INPUTS_SIZE = 2

Private Member Functions
cycle_group	_unconditional_add_or_subtract (const cycle_group &other, bool is_addition, const std::optional< AffineElement > hint) const
	Will evaluate ECC point addition or subtraction over `*this` and `other`.

Static Private Member Functions
static batch_mul_internal_output	_variable_base_batch_mul_internal (std::span< cycle_scalar > scalars, std::span< cycle_group > base_points, std::span< AffineElement const > offset_generators, bool unconditional_add)
	Internal logic to perform a variable-base batch mul using the Straus MSM algorithm.

static batch_mul_internal_output	_fixed_base_batch_mul_internal (std::span< cycle_scalar > scalars, std::span< AffineElement > base_points)
	Internal algorithm to perform a fixed-base batch mul.

Private Attributes
field_t	_x

field_t	_y

bool_t	_is_infinity

Builder *	context

Detailed Description

template<typename Builder>
class bb::stdlib::cycle_group< Builder >

cycle_group represents a group Element of the proving system's embedded curve, i.e. a curve with a cofactor 1 defined over a field equal to the circuit's native field Builder::FF

In barretenberg, cycle group is used to represent the Grumpkin curve defined over the bn254 scalar field. The point at infinity is represented as (0, 0).

Note: For the honest prover, we restrict the construction of cycle group elements in the following ways: (1) x and y coordinates of a point must have matching constancy, i.e. both are constants or both are witnesses, enforced via a runtime assert. (2) We disallow construction of points not on the curve via runtime asserts (always) and via circuit constraints in select situations, e.g. EC operations from noir in DSL.

Template Parameters

Builder

Definition at line 37 of file cycle_group.hpp.

Member Typedef Documentation

◆ AffineElement

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::AffineElement = bb::grumpkin::g1::affine_element

Definition at line 47 of file cycle_group.hpp.

◆ BaseField

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::BaseField = field_t

Definition at line 40 of file cycle_group.hpp.

◆ BigScalarField

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::BigScalarField = stdlib::bigfield<Builder, bb::fq::Params>

Definition at line 50 of file cycle_group.hpp.

◆ bool_t

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::bool_t = stdlib::bool_t<Builder>

Definition at line 41 of file cycle_group.hpp.

◆ Curve

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::Curve = bb::curve::Grumpkin

Definition at line 44 of file cycle_group.hpp.

◆ cycle_scalar

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::cycle_scalar = ::bb::stdlib::cycle_scalar<Builder>

Definition at line 51 of file cycle_group.hpp.

◆ Element

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::Element = bb::grumpkin::g1::element

Definition at line 46 of file cycle_group.hpp.

◆ field_t

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::field_t = stdlib::field_t<Builder>

Definition at line 39 of file cycle_group.hpp.

◆ GeneratorContext

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::GeneratorContext = crypto::GeneratorContext<Curve>

Definition at line 48 of file cycle_group.hpp.

◆ Group

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::Group = bb::grumpkin::g1

Definition at line 45 of file cycle_group.hpp.

◆ straus_lookup_table

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::straus_lookup_table = ::bb::stdlib::straus_lookup_table<Builder>

Definition at line 52 of file cycle_group.hpp.

◆ straus_scalar_slices

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::straus_scalar_slices = ::bb::stdlib::straus_scalar_slices<Builder>

Definition at line 53 of file cycle_group.hpp.

◆ witness_t

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::witness_t = stdlib::witness_t<Builder>

Definition at line 42 of file cycle_group.hpp.

Constructor & Destructor Documentation

◆ cycle_group() [1/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group ( Builder * _context = nullptr )

Construct a new constant point at infinity cycle group object.

Note: Don't use this constructor in case you want to assign the coordinates later.

Definition at line 27 of file cycle_group.cpp.

◆ cycle_group() [2/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group	(	const field_t &	x,
		const field_t &	y,
		bool_t	is_infinity,
		bool	assert_on_curve
	)

Construct a new cycle group<Builder>::cycle group object.

Warning: This constructor constrains the point to be on the curve by default, however this can be disabled by passing false for the assert_on_curve parameter. This is intended for cases where points are implicitly known to be on the curve such as the result of a point addition or doubling.

Parameters

_x
_y
is_infinity

Definition at line 43 of file cycle_group.cpp.

◆ cycle_group() [3/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group	(	const bb::fr &	x,
		const bb::fr &	y,
		bool	is_infinity
	)

Construct a constant cycle_group object from raw field elements and a boolean.

is_infinity is a circuit constant. We EXPLICITLY require that whether this point is infinity/not infinity is known at circuit-construction time and we know this point is on the curve. These checks are not constrained. Use from_witness if these conditions are not met. Examples of when conditions are met: point is a derived from a point that is on the curve + not at infinity. e.g. output of a doubling operation

Template Parameters

Builder

Parameters

_x
_y
is_infinity

Definition at line 96 of file cycle_group.cpp.

◆ cycle_group() [4/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group ( const AffineElement & _in )

Construct a cycle_group object out of an AffineElement object.

Uses convention that the coordinates of the point at infinity are (0,0).

Note: This produces a circuit-constant object i.e. known at compile-time, no constraints. If _in is not fixed for a given circuit, use from_witness instead.

Template Parameters

Builder

Parameters

_in

Definition at line 115 of file cycle_group.cpp.

Member Function Documentation

◆ _fixed_base_batch_mul_internal()

template<typename Builder >

cycle_group< Builder >::batch_mul_internal_output bb::stdlib::cycle_group< Builder >::_fixed_base_batch_mul_internal	(	std::span< cycle_scalar >	scalars,
		std::span< AffineElement >	base_points
	)

staticprivate

Internal algorithm to perform a fixed-base batch mul.

Computes a batch mul of fixed base points using the Straus multiscalar multiplication algorithm with lookup tables. Each scalar (cycle_scalar) is decomposed into two limbs, lo and hi, with 128 and 126 bits respectively. For each limb we use one of four precomputed plookup multi-tables FIXED_BASE_<LEFT/RIGHT>_<LO/HI> corresponding to the lo/hi limbs of the two generator points supported by this algorithm (defined in bb::plookup::fixed_base::table).

The LO multi-tables consist of fifteen basic tables (14 × 9-bit + 1 × 2-bit = 128 bits) and the HI multi-tables consist of fourteen 9-bit basic tables (14 × 9 = 126 bits). Each basic table stores at index i the precomputed points: \([offset\_generator_i] + k \cdot 2^{table\_bits \cdot i} \cdot [base\_point]\) for \(k = 0, 1, ..., 2^{table\_bits} - 1\). The offset generators prevent point-at-infinity edge cases. The algorithm sums all looked-up points to compute \(scalar \cdot [base\_point] + [sum\_of\_offset\_generators]\). We return both the accumulator and the sum of offset generators, so that it can be subtracted off later.

This approach avoids all point doublings and reduces one scalar mul to ~29 lookups + ~29 ecc addition gates.

Template Parameters

Builder

Parameters

scalars
base_points

return cycle_group<Builder>::batch_mul_internal_output

Definition at line 852 of file cycle_group.cpp.

◆ _unconditional_add_or_subtract()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::_unconditional_add_or_subtract	(	const cycle_group< Builder > &	other,
		bool	is_addition,
		const std::optional< AffineElement >	hint
	)		const

private

Will evaluate ECC point addition or subtraction over *this and other.

Warning: Incomplete addition formula edge cases are NOT checked! Only use this method if you know the x-coordinates of the operands cannot collide and none of the operands is a point at infinity. Uses Ultra-arithmetic elliptic curve addition gate.

Template Parameters

Builder

Parameters

other	Point to add/subtract
is_addition	: true for addition, false for subtraction
hint	: value of output point witness, if known ahead of time (used to avoid modular inversions during witgen)

Returns: cycle_group<Builder> Result of addition/subtraction

Definition at line 344 of file cycle_group.cpp.

◆ _variable_base_batch_mul_internal()

template<typename Builder >

cycle_group< Builder >::batch_mul_internal_output bb::stdlib::cycle_group< Builder >::_variable_base_batch_mul_internal	(	std::span< cycle_scalar >	scalars,
		std::span< cycle_group< Builder > >	base_points,
		std::span< AffineElement const >	offset_generators,
		bool	unconditional_add
	)

staticprivate

Internal logic to perform a variable-base batch mul using the Straus MSM algorithm.

Computes \(\sum_i scalars[i] \cdot base\_points[i]\) using the windowed Straus algorithm with 4-bit windows. The algorithm operates in three phases:

Native computation: Compute all EC operations natively to generate witness hints using batched operations. (This avoids the need to perform expensive modular inversions per operation during witness generation)
Table construction: Build in-circuit ROM lookup tables for each base point
Circuit execution: Perform the Straus algorithm in-circuit using the ROM tables and precomputed hints

Note: Offset generators are added to prevent point-at-infinity edge cases. The returned result is: \(\sum_i scalars[i] \cdot base\_points[i] + offset\_accumulator\) where offset_accumulator is also returned separately for later subtraction.

Parameters

scalars	Vector of scalar multipliers (must all have the same bit length)
base_points	Vector of EC points to multiply (can be constants or witnesses)
offset_generators	Precomputed offset points to prevent infinity edge cases (size = base_points.size() + 1)
unconditional_add	If true, skip x-coordinate collision checks (safe only when points are guaranteed distinct)

Returns: {accumulator, offset_accumulator} where batch mul result = accumulator - offset_accumulator

Definition at line 693 of file cycle_group.cpp.

◆ assert_equal()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::assert_equal	(	cycle_group< Builder > &	other,
		std::string const &	msg = `"cycle_group< Builder >::assert_equal"`
	)

Definition at line 1114 of file cycle_group.cpp.

◆ batch_mul() [1/2]

template<typename Builder >

static cycle_group bb::stdlib::cycle_group< Builder >::batch_mul	(	const std::vector< cycle_group< Builder > > &	base_points,
		const std::vector< BigScalarField > &	scalars,
		GeneratorContext	context = `{}`
	)

inlinestatic

Definition at line 115 of file cycle_group.hpp.

◆ batch_mul() [2/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::batch_mul	(	const std::vector< cycle_group< Builder > > &	base_points,
		const std::vector< cycle_scalar > &	scalars,
		const GeneratorContext &	context = `{}`
	)

static

Multiscalar multiplication algorithm.

Uses the Straus MSM algorithm. batch_mul splits inputs into three categories: Case 1. Point and scalar are both constant: scalar mul can be computed without constraints. Case 2A. Point is constant and one of two specific generators, scalar is a witness: use fixed-base Straus with plookup tables Case 2B. Point is constant but not one of two specific generators, scalar is a witness: use variable-base Straus using ROM tables. Case 3. Point is a witness, scalar is witness or constant: use variable-base Straus using ROM tables.

The results from all 3 categories are combined and returned as a single output point.

Note

Both the fixed and variable-base algorithms utilize an offset mechanism to avoid point at infinity edge cases. The total offset is tracked and subtracted from the final result to yield the correct output.

batch_mul can handle all known cases of trigger incomplete addition formula exceptions and other weirdness:

some/all of the input points are points at infinity
some/all of the input scalars are 0
some/all input points are equal to each other
output is the point at infinity
input vectors are empty

offset_generator_data is a pointer to precomputed offset generator list. There is a default parameter point that points to a list with DEFAULT_NUM_GENERATORS generator points (8). If more offset generators are required, they will be derived in-place which can be expensive. (num required offset generators is either num input points + 1 or num input points + 2, depends on if one or both of _fixed_base_batch_mul_internal, _variable_base_batch_mul_internal are called). If you're calling this function repeatedly and you KNOW you need >8 offset generators, it's faster to create a generator_data object with the required size and pass it in as a parameter.

Template Parameters

Builder

Parameters

scalars
base_points
offset_generator_data

Returns: cycle_group<Builder>

Definition at line 958 of file cycle_group.cpp.

◆ checked_unconditional_add()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::checked_unconditional_add	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point addition over *this and other, with x-coordinate collision checks.

Uses incomplete addition formula. If incomplete addition formula edge cases are triggered (x-coordinates of operands collide), the constraints produced by this method will be unsatisfiable. Useful when an honest prover will not produce a point collision with overwhelming probability, but a cheating prover will be able to.

Template Parameters

Builder

Parameters

other	Point to add
hint	: value of output point witness, if known ahead of time (used to avoid modular inversions during witgen)

Returns: cycle_group<Builder>

Definition at line 450 of file cycle_group.cpp.

◆ checked_unconditional_subtract()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::checked_unconditional_subtract	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point subtraction over *this and other, with x-coordinate collision checks.

Uses incomplete subtraction formula. If incomplete subtraction formula edge cases are triggered (x-coordinates of operands collide), the constraints produced by this method will be unsatisfiable. Useful when an honest prover will not produce a point collision with overwhelming probability, but a cheating prover will be able to.

Template Parameters

Builder

Parameters

other	Point to subtract
hint	: value of output point witness, if known ahead of time (used to avoid modular inversions during witgen)

Returns: cycle_group<Builder>

Definition at line 475 of file cycle_group.cpp.

◆ conditional_assign()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::conditional_assign	(	const bool_t &	predicate,
		const cycle_group< Builder > &	lhs,
		const cycle_group< Builder > &	rhs
	)

static

Definition at line 1124 of file cycle_group.cpp.

◆ constant_infinity()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::constant_infinity ( Builder * _context = nullptr )

static

Construct a constant point at infinity.

Definition at line 142 of file cycle_group.cpp.

◆ dbl()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::dbl ( const std::optional< AffineElement > hint = std::nullopt ) const

Evaluates a point doubling using Ultra ECC double gate (if non-constant)

Template Parameters

Builder

Parameters

hint	native result of the doubling (optional; used to avoid modular inversions during witgen)

Returns: cycle_group<Builder> The doubled point

Definition at line 273 of file cycle_group.cpp.

◆ fix_witness()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::fix_witness ( )

inline

Fix a witness. The value of the witness is constrained with a selector

Definition at line 181 of file cycle_group.hpp.

◆ from_constant_witness()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::from_constant_witness	(	Builder *	_context,
		const AffineElement &	_in
	)

static

Converts a native AffineElement into a witness, but constrains the witness values to be known constants.

Note: This is useful when performing group operations where one operand is a witness and one is a constant. In such cases it can be more efficient to convert the constant into a "fixed" witness because we have custom gates that evaluate additions in one constraint, but only if both operands are witnesses.

Template Parameters

Builder

Parameters

_context
_in

Returns: cycle_group<Builder>

Definition at line 201 of file cycle_group.cpp.

◆ from_witness()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::from_witness	(	Builder *	_context,
		const AffineElement &	_in
	)

static

Converts an AffineElement into a circuit witness.

Somewhat expensive as we do an on-curve check and _is_infinity is a witness and not a constant. If an element is being converted where it is known the element is on the curve and/or cannot be point at infinity, it is best to use other methods (e.g. direct conversion of field_t coordinates)

Template Parameters

Builder

Parameters

_context
_in

Returns: cycle_group<Builder>

Definition at line 170 of file cycle_group.cpp.

◆ get_context() [1/2]

template<typename Builder >

Builder * bb::stdlib::cycle_group< Builder >::get_context ( ) const

inline

Definition at line 84 of file cycle_group.hpp.

◆ get_context() [2/2]

template<typename Builder >

Builder * bb::stdlib::cycle_group< Builder >::get_context ( const cycle_group< Builder > & other ) const

Definition at line 219 of file cycle_group.cpp.

◆ get_origin_tag()

template<typename Builder >

OriginTag bb::stdlib::cycle_group< Builder >::get_origin_tag ( ) const

inline

Get the origin tag of cycle_group (a merege of origin tags of x, y and _is_infinity members)

Returns: OriginTag

Definition at line 153 of file cycle_group.hpp.

◆ get_value()

template<typename Builder >

cycle_group< Builder >::AffineElement bb::stdlib::cycle_group< Builder >::get_value ( ) const

Definition at line 227 of file cycle_group.cpp.

◆ is_constant()

template<typename Builder >

bool bb::stdlib::cycle_group< Builder >::is_constant ( ) const

inline

Definition at line 90 of file cycle_group.hpp.

◆ is_constant_point_at_infinity()

template<typename Builder >

bool bb::stdlib::cycle_group< Builder >::is_constant_point_at_infinity ( ) const

inline

Definition at line 95 of file cycle_group.hpp.

◆ is_point_at_infinity()

template<typename Builder >

bool_t bb::stdlib::cycle_group< Builder >::is_point_at_infinity ( ) const

inline

Definition at line 94 of file cycle_group.hpp.

◆ one()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::one ( Builder * _context )

static

Construct a constant cycle_group representation of Group::one.

Template Parameters

Builder

Parameters

_context

Returns: cycle_group<Builder>

Definition at line 129 of file cycle_group.cpp.

◆ operator*() [1/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator* ( const BigScalarField & scalar ) const

Definition at line 1095 of file cycle_group.cpp.

◆ operator*() [2/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator* ( const cycle_scalar & scalar ) const

Definition at line 1084 of file cycle_group.cpp.

◆ operator*=() [1/2]

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator*= ( const BigScalarField & scalar )

Definition at line 1100 of file cycle_group.cpp.

◆ operator*=() [2/2]

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator*= ( const cycle_scalar & scalar )

Definition at line 1089 of file cycle_group.cpp.

◆ operator+()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator+ ( const cycle_group< Builder > & other ) const

Evaluate ECC point addition over *this and other.

This method uses complete addition i.e. is compatible with all edge cases and is therefore expensive. To handle the possibility of x-coordinate collisions we evaluate both an addition (modified to avoid division by zero) and and a doubling, then conditionally assign the result.

Template Parameters

Builder

Parameters

other Point to add

Returns: cycle_group<Builder> Result of addition

Definition at line 497 of file cycle_group.cpp.

◆ operator+=()

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator+= ( const cycle_group< Builder > & other )

Definition at line 660 of file cycle_group.cpp.

◆ operator-() [1/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator- ( ) const

Negates a point.

Template Parameters

Builder

Parameters

other

Returns: cycle_group<Builder>

Definition at line 650 of file cycle_group.cpp.

◆ operator-() [2/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator- ( const cycle_group< Builder > & other ) const

Evaluate ECC point subtraction over *this and other.

This method uses complete subtraction i.e. is compatible with all edge cases and is therefore expensive. To handle the possibility of x-coordinate collisions we evaluate both a subtraction (modified to avoid division by zero) and a doubling, then conditionally assign the result.

Template Parameters

Builder

Parameters

other Point to subtract

Returns: cycle_group<Builder> Result of subtraction

Definition at line 571 of file cycle_group.cpp.

◆ operator-=()

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator-= ( const cycle_group< Builder > & other )

Definition at line 666 of file cycle_group.cpp.

◆ operator==()

template<typename Builder >

bool_t< Builder > bb::stdlib::cycle_group< Builder >::operator== ( cycle_group< Builder > & other )

Definition at line 1106 of file cycle_group.cpp.

◆ reconstruct_from_public()

template<typename Builder >

static cycle_group bb::stdlib::cycle_group< Builder >::reconstruct_from_public ( const std::span< const field_t, 2 > & limbs )

inlinestatic

Reconstruct a cycle_group from limbs (generally stored in the public inputs)

The base field of the cycle_group curve is the same as the circuit's native field so each coordinate is represented by a single "limb".

Parameters

limbs The coordinates of the cycle_group element

Returns: cycle_group

Definition at line 211 of file cycle_group.hpp.

◆ set_free_witness_tag()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::set_free_witness_tag ( )

inline

Set the free witness flag for the cycle_group's tags.

Definition at line 161 of file cycle_group.hpp.

◆ set_origin_tag()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::set_origin_tag ( OriginTag tag ) const

inline

Set the origin tag for x, y and _is_infinity members of cycle_group.

Parameters

tag

Definition at line 141 of file cycle_group.hpp.

◆ set_public()

template<typename Builder >

uint32_t bb::stdlib::cycle_group< Builder >::set_public ( )

inline

Set the witness indices representing the cycle_group to public.

Returns: uint32_t Index into the public inputs array at which the representation is stored

Definition at line 196 of file cycle_group.hpp.

◆ standardize()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::standardize ( )

Convert the point to standard form.

If the point is a point at infinity, ensure the coordinates are (0,0).

Definition at line 259 of file cycle_group.cpp.

◆ unconditional_add()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::unconditional_add	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point addition over *this and other.

Warning: Incomplete addition formula edge cases are NOT checked! Only use this method if you know the x-coordinates of the operands cannot collide and none of the operands is a point at infinity. Uses Ultra-arithmetic elliptic curve addition gate.

Definition at line 419 of file cycle_group.cpp.

◆ unconditional_subtract()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::unconditional_subtract	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point subtraction over *this and other.

Warning: Incomplete subtraction formula edge cases are NOT checked! Only use this method if you know the x-coordinates of the operands cannot collide and none of the operands is a point at infinity. Uses Ultra-arithmetic elliptic curve subtraction gate.

Definition at line 432 of file cycle_group.cpp.

◆ unset_free_witness_tag()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::unset_free_witness_tag ( )

inline

Unset the free witness flag for the cycle_group's tags.

Definition at line 171 of file cycle_group.hpp.

◆ validate_on_curve()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::validate_on_curve ( ) const

On-curve check.

Validates that the point satisfies the curve equation \(y^2 = x^3 + b\) or is the point at infinity.

Template Parameters

Builder

Definition at line 242 of file cycle_group.cpp.

◆ x()

template<typename Builder >

const field_t & bb::stdlib::cycle_group< Builder >::x ( ) const

inline

Definition at line 88 of file cycle_group.hpp.

◆ y()

template<typename Builder >

const field_t & bb::stdlib::cycle_group< Builder >::y ( ) const

inline

Definition at line 89 of file cycle_group.hpp.

Member Data Documentation

◆ _is_infinity

template<typename Builder >

bool_t bb::stdlib::cycle_group< Builder >::_is_infinity

private

Definition at line 220 of file cycle_group.hpp.

◆ _x

template<typename Builder >

field_t bb::stdlib::cycle_group< Builder >::_x

private

Definition at line 218 of file cycle_group.hpp.

◆ _y

template<typename Builder >

field_t bb::stdlib::cycle_group< Builder >::_y

private

Definition at line 219 of file cycle_group.hpp.

◆ context

template<typename Builder >

Builder* bb::stdlib::cycle_group< Builder >::context

private

Definition at line 221 of file cycle_group.hpp.

◆ NUM_BITS_FULL_FIELD_SIZE

template<typename Builder >

constexpr size_t bb::stdlib::cycle_group< Builder >::NUM_BITS_FULL_FIELD_SIZE = bb::fq::modulus.get_msb() + 1

staticconstexpr

Definition at line 57 of file cycle_group.hpp.

◆ OFFSET_GENERATOR_DOMAIN_SEPARATOR

template<typename Builder >

constexpr std::string_view bb::stdlib::cycle_group< Builder >::OFFSET_GENERATOR_DOMAIN_SEPARATOR = "cycle_group_offset_generator"

staticconstexpr

Definition at line 59 of file cycle_group.hpp.

◆ PUBLIC_INPUTS_SIZE

template<typename Builder >

constexpr size_t bb::stdlib::cycle_group< Builder >::PUBLIC_INPUTS_SIZE = 2

staticconstexpr

Definition at line 62 of file cycle_group.hpp.

◆ ROM_TABLE_BITS

template<typename Builder >

constexpr size_t bb::stdlib::cycle_group< Builder >::ROM_TABLE_BITS = 4

staticconstexpr

Definition at line 56 of file cycle_group.hpp.

The documentation for this class was generated from the following files:

src/barretenberg/stdlib/primitives/group/cycle_group.hpp
src/barretenberg/stdlib/primitives/group/cycle_group.cpp

Classes

Public Types

Public Member Functions

Static Public Member Functions

Static Public Attributes

Private Member Functions

Static Private Member Functions

Private Attributes

Detailed Description

Member Typedef Documentation

◆ AffineElement

◆ BaseField

◆ BigScalarField

◆ bool_t

◆ Curve

◆ cycle_scalar

◆ Element

◆ field_t

◆ GeneratorContext

◆ Group

◆ straus_lookup_table

◆ straus_scalar_slices

◆ witness_t

Constructor & Destructor Documentation

◆ cycle_group() [1/4]

◆ cycle_group() [2/4]

◆ cycle_group() [3/4]

◆ cycle_group() [4/4]

Member Function Documentation

◆ _fixed_base_batch_mul_internal()

◆ _unconditional_add_or_subtract()

◆ _variable_base_batch_mul_internal()

◆ assert_equal()

◆ batch_mul() [1/2]

◆ batch_mul() [2/2]

◆ checked_unconditional_add()

◆ checked_unconditional_subtract()

◆ conditional_assign()

◆ constant_infinity()

◆ dbl()

◆ fix_witness()

◆ from_constant_witness()

◆ from_witness()

◆ get_context() [1/2]

◆ get_context() [2/2]

◆ get_origin_tag()

◆ get_value()

◆ is_constant()

◆ is_constant_point_at_infinity()

◆ is_point_at_infinity()

◆ one()

◆ operator*() [1/2]

◆ operator*() [2/2]

◆ operator*=() [1/2]

◆ operator*=() [2/2]

◆ operator+()

◆ operator+=()

◆ operator-() [1/2]

◆ operator-() [2/2]

◆ operator-=()

◆ operator==()

◆ reconstruct_from_public()

◆ set_free_witness_tag()

◆ set_origin_tag()

◆ set_public()

◆ standardize()

◆ unconditional_add()

◆ unconditional_subtract()

◆ unset_free_witness_tag()

◆ validate_on_curve()

◆ x()

◆ y()

Member Data Documentation

◆ _is_infinity

◆ _x

◆ _y

◆ context

◆ NUM_BITS_FULL_FIELD_SIZE

◆ OFFSET_GENERATOR_DOMAIN_SEPARATOR

◆ PUBLIC_INPUTS_SIZE