Refactory #39
Refactory #39
Conversation
Switch to ark-transcript
naming convention and clean up. Co-authored-by: Davide Galassi <[email protected]>
…-proof into skalman--powers-of-two-gadget
- make test compiles for std (and fails due to lack of rng).
- make sure random and hashed points are not identity elements.
Cond Add extendend with TE
| { | ||
| type CondAddValT = TeCondAddValues<F, Curve>; | ||
| type Values = TECondAddValues<C>; | ||
|
|
||
| // Populates the acc column starting from the supplied seed (as 0 doesn't work with the addition formula). | ||
| // As the TE addition formula used is not complete, the seed must be selected in a way that would prevent | ||
| // exceptional cases (doublings or adding the opposite point). | ||
| // The last point of the input column is ignored, as adding it would made the acc column overflow due the initial point. | ||
| fn init( |
There was a problem hiding this comment.
Here you could check if the seed is inside the group.
There was a problem hiding this comment.
In general, SW "works" even when the seed is within the prime order subgroup, provided that the cond add do not (maliciously or not) stumble to the identity.
Does TE strictly require the seed to be within the prime order subgroup, or could it also operate with a seed outside the prime order subgroup (with some failure cases that are more or less probable)?
Specifically, if for TE a point outside the prime order group is chosen as a seed, what would be the resulting behavior? I haven't yet analyzed the constraint formula for the TE construction...
There was a problem hiding this comment.
Yeah, there is a slightly higher risk. Given you have enforced PoP, I think the probablity of failure if you choose S outside the group is like 8-9 times higher than if you choose it inside, for the TE case. For
You could argue that 8 times of negligible is still negligble. I'd have put a check to prevent choosing out of the prime subgroup here, as it doesn't have performance hit, but I agree it is somehow a subjective, so your choice.
| { | ||
| type CondAddValT = SwCondAddValues<F>; | ||
| type Values = SWCondAddValues<C>; | ||
|
|
||
| // Populates the acc column starting from the supplied seed (as 0 doesn't have an affine SW representation). | ||
| // As the SW addition formula used is not complete, the seed must be selected in a way that would prevent | ||
| // exceptional cases (doublings or adding the opposite point). | ||
| // The last point of the input column is ignored, as adding it would made the acc column overflow due the initial point. | ||
| fn init( |
There was a problem hiding this comment.
Here you could check if the seed is outside of the group.
There was a problem hiding this comment.
Wouldn't this be more of a suggestion? From my understanding, it is recommended to select a seed point outside the prime order subgroup. However, the implementation still functions even if the seed is within the group (in this case we need PoP). In the codebase there are generic tests that simply use a random point from the prime order group as a seed for SW, which avoids the need for separate code for seed generation (TE vs SW)
I would prefer to add a comment that suggests choosing a seed outside the group, possibly generated via find_complement_point.
There was a problem hiding this comment.
This true. Sure. You could add a comment saying you need to check PoP unless if S is outside of the group.
|
@drskalman I applied some of your suggestions. I have questions for the |
| { | ||
| type CondAddValT = SwCondAddValues<F>; | ||
| type Values = SWCondAddValues<C>; | ||
|
|
||
| // Populates the acc column starting from the supplied seed (as 0 doesn't have an affine SW representation). | ||
| // As the SW addition formula used is not complete, the seed must be selected in a way that would prevent | ||
| // exceptional cases (doublings or adding the opposite point). | ||
| // The last point of the input column is ignored, as adding it would made the acc column overflow due the initial point. | ||
| fn init( |
There was a problem hiding this comment.
This true. Sure. You could add a comment saying you need to check PoP unless if S is outside of the group.
| { | ||
| type CondAddValT = TeCondAddValues<F, Curve>; | ||
| type Values = TECondAddValues<C>; | ||
|
|
||
| // Populates the acc column starting from the supplied seed (as 0 doesn't work with the addition formula). | ||
| // As the TE addition formula used is not complete, the seed must be selected in a way that would prevent | ||
| // exceptional cases (doublings or adding the opposite point). | ||
| // The last point of the input column is ignored, as adding it would made the acc column overflow due the initial point. | ||
| fn init( |
There was a problem hiding this comment.
Yeah, there is a slightly higher risk. Given you have enforced PoP, I think the probablity of failure if you choose S outside the group is like 8-9 times higher than if you choose it inside, for the TE case. For
You could argue that 8 times of negligible is still negligble. I'd have put a check to prevent choosing out of the prime subgroup here, as it doesn't have performance hit, but I agree it is somehow a subjective, so your choice.
test-vectorsfeature: zk rows set to zero for deterministic proofAffineCondAddtraitArkTranscript