- Wraps some parts of The MIRACL Core Cryptographic Library to provide a nice abstraction to work with finite field elements and group elements when working with elliptic curves.
- Overloads +, -, *, +=, -= to use with field as well as group elements. The overloaded operators correspond to constant time methods. HOwever, for for scalar multiplication, variable time algorithms are present but can be used by calling methods only.
- Point compression and hash to curve according to the IETF standard through the Core library.
- Provides abstraction for creating vectors of field elements or group (elliptic curve points) elements and then scale, add, subtract, take inner product or Hadamard product.
- Supports creating univariate polynomials of field elements and doing arithmetic on them.
- Some of the operations on vectors and polynomials are parallelized using rayon.
- Serialization support using serde.
- Field and group elements are cleared when dropped. Using zeroize.
- Additionally, implements some extra algorithms like variable time scalar multiplication using wNAF, constant time and variable time multi-scalar multiplication, batch (simultaneous) inversion and Barrett reduction.
The wrapper has to be built by enabling any one of the mentioned curve as a feature.
To build for BLS-381 curve, use
cargo build --no-default-features --features bls381
For BN-254 curve, use
cargo build --no-default-features --features bn254
Similarly, to build for ed25519, use
cargo build --no-default-features --features ed25519
To run tests for secp256k1, use
cargo test --no-default-features --features secp256k1
To use it as dependency crate, use the name of the curve as a feature. eg. for BLS12-381 curve, use
[dependencies.amcl_wrapper]
version = "0.4.0"
default-features = false
features = ["bls381"]
Note that only one curve can be used at a time so the code only works with one feature.
There are tests for various operations which print the time taken to do those ops. They are prefixed with timing*[]:
To run them use
cargo test --release --no-default-features --features <curve name> -- --nocapture timing
-
Create some random field elements or group elements and do some basic additions/subtraction/multiplication
let a = FieldElement::random(); let b = FieldElement::random(); let neg_b = -b; assert_ne!(b, neg_b); let neg_neg_b = -neg_b; assert_eq!(b, neg_neg_b); assert_eq!(b+neg_b, FieldElement::zero()); let c = a + b; let d = a - b; let e = a * b; let mut sum = FieldElement::zero(); sum += c; sum += d;
// Compute inverse of element let n = a.invert(); // Faster but constant time computation of inverse of several elements. `inverses` will be a vector of inverses of elements and `pr` will be the product of all inverses. let (inverses, pr) = FieldElement::batch_invert(vec![a, b, c, d].as_slice());
// Compute a width 5 NAF. let a_wnaf = a.to_wnaf(5);
// G1 is the elliptic curve sub-group over the prime field let x = G1::random(); let y = G1::random(); let neg_y = -y; assert_ne!(y, neg_y); let neg_neg_y = -neg_y; assert_eq!(y, neg_neg_y); assert_eq!(y+neg_y, G1::identity()); let z = x + y; let z1 = x - y; let mut sum_1 = G1::identity(); sum_1 += z; sum_1 += z1;
// G2 is the elliptic curve sub-group over the prime extension field let x = G2::random(); let y = G2::random(); let neg_y = -y; assert_ne!(y, neg_y); let neg_neg_y = -neg_y; assert_eq!(y, neg_neg_y); assert_eq!(y+neg_y, G2::identity()); let z = x + y; let z1 = x - y; let mut sum_1 = G2::identity(); sum_1 += z; sum_1 += z1; // To check that G1 or G2 have correct order, i.e. the curve order let x = G1::random(); assert!(x.has_correct_order()); let y = G2::random(); assert!(y.has_correct_order());
Mutating versions of the above operations like addition/subtraction/negation/inversion are present but have to be called as methods like
b.negate() -
Scalar multiplication
let a = FieldElement::random(); let g = G1::generator(); // the group's generator // constant time scalar multiplication let m = g * a; // variable time scalar multiplication using wNAF let n = g.scalar_mul_variable_time(&a);
-
Map an arbitrary size message to a field element or group element by hashing the message internally.
let msg = "Some message"; let a = FieldElement::from_msg_hash(msg.as_bytes()); let b = G1::from_msg_hash(msg.as_bytes()); -
Create vectors of field elements and do some operations
// creates a vector of size 10 with all elements as 0 let mut a = FieldElementVector::new(10); // Add 2 more elements to the above vector a.push(FieldElement::random()); a.push(FieldElement::random()); a[0]; // 0th element of above vector a[1]; // 1st element of above vector a.len(); // length of vector a.sum(); // sum of elements of vector
// Return a Vandermonde vector of a given field element, i.e. given element `k` and size `n`, return vector as `vec![1, k, k^2, k^3, ... k^n-1]` let k = FieldElement::random(); let van_vec = FieldElementVector::new_vandermonde_vector(&k, 5);
// creates a vector of size 10 with randomly generated field elements let rands: Vec<_> = (0..10).map(|_| FieldElement::random()).collect(); // an alternative way of creating vector of size 10 of random field elements let rands_1 = FieldElementVector::random(10);
// Compute new vector as sum of 2 vectors. Requires vectors to be of equal length. let sum_vec = rands.plus(&rands_1); // Compute new vector as difference of 2 vectors. Requires vectors to be of equal length. let diff_vec = rands.minus(&rands_1); // Return the scaled vector of the given vector by a field element `n`, i.e. multiply each element of the vector by that field element let n = FieldElement::random(); let scaled_vec = rands.scaled_by(&n); // Scale the vector itself let mut rands_2 = rands_1.clone(); rands_2.scale(&n);
// Compute inner product of 2 vectors. Requires vectors to be of equal length. let ip = rands.inner_product(&rands_1); // Compute Hadamard product of 2 vectors. Requires vectors to be of equal length. let hp = rands.hadamard_product(&rands_1);
-
Create vectors of group elements and do some operations
// creates a vector of size 10 with all elements as 0 let mut a = G1Vector::new(10); // Add 2 more elements to the above vector a.push(G1::random()); a.push(G1::random()); // creating vector of size 10 of random group elements let rands: Vec<_> = (0..10).map(|_| G1::random()).collect(); let rands_1 = G1Vector::random(10); // Compute new vector as sum of 2 vectors. Requires vectors to be of equal length. let sum_vec = rands.plus(&rands_1); // Compute new vector as difference of 2 vectors. Requires vectors to be of equal length. let diff_vec = rands.minus(&rands_1);
// Compute inner product of a vector of group elements with a vector of field elements. // eg. given a vector of group elements and field elements, G and F respectively, compute G[0]*F[0] + G[1]*F[1] + G[2]*F[2] + .. G[n-1]*F[n-1] // requires vectors to be of same length let g = G1Vector::random(10); let f = FieldElementVector::random(10); // Uses constant time multi-scalar multiplication `multi_scalar_mul_const_time` underneath. let ip = g.inner_product_const_time(&f); // Uses variable time multi-scalar multiplication `multi_scalar_mul_var_time` underneath. let ip1 = g.inner_product_var_time(&f); // If lookup tables are already constructed, `multi_scalar_mul_const_time_with_precomputation_done` and `multi_scalar_mul_var_time_with_precomputation_done` can be used for constant and variable time multi-scalar multiplication
-
Pairing support. Ate pairing is supported with target group
GTlet g1 = G1::random(); let g2 = G2::random(); // compute reduced ate pairing for 2 elements, i.e. e(g1, g2) let gt = GT::ate_pairing(&g1, &g2); // multiply target group elements let h1 = G1::random(); let h2 = G2::random(); let ht = GT::ate_pairing(&h1, &h2); let m = GT::mul(>, &ht); // compute reduced ate pairing for 4 elements, i.e. e(g1, g2) * e (h1, h2) let p = GT::ate_2_pairing(&g1, &g2, &h1, &h2); // compute reduced ate multi-pairing. Takes a vector of tuples of group elements G1 and G2 as Vec<(&G1, &G2)> let e = GT::ate_multi_pairing(tuple_vec); // Raise target group element to field element (GT^f) let r = FieldElement::random(); let p = gt.pow(&r);
-
Serialization
// Convert to and from bytes let x = G1::random(); let y = G2::random(); // Get byte representation of uncompressed point by passing false to `to_bytes` let un_compressed_bytes_for_G1: Vec<u8> = x.to_bytes(false); let un_compressed_bytes_for_G2: Vec<u8> = y.to_bytes(false); // Get byte representation of compressed point by passing true to `to_bytes` let compressed_bytes_for_G1: Vec<u8> = x.to_bytes(true); let compressed_bytes_for_G2: Vec<u8> = y.to_bytes(true); // Use `write_to_slice` or `write_to_slice_unchecked` to avoid creating a `Vec` by passing a mutable slice // Use `from_bytes` to get the group element back from compressed or uncompressed bytes let x_recovered = G1::from_bytes(&un_compressed_bytes_for_G1)?; let y_recovered = G2::from_bytes(&un_compressed_bytes_for_G2)?; // Or let x_recovered = G1::from_bytes(&compressed_bytes_for_G1)?; let y_recovered = G2::from_bytes(&compressed_bytes_for_G2)?; // Convert to and from hex. let hex_repr = a.to_hex(); let a_recon = FieldElement::from_hex(hex_repr).unwrap(); // Constant time conversion // Convert to and from hex. let hex_repr = x.to_hex(); let x_recon = G1::from_hex(hex_repr).unwrap(); // Constant time conversion // Convert to and from hex. let hex_repr = y.to_hex(); let y_recon = G2::from_hex(hex_repr).unwrap(); // Constant time conversion
-
Hash to curve point Use
hash_to_curveof G1 or G2 to hash arbitrary bytes to subgroup of the curve according to the hash to curve point IETF standard https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/?include_text=1// `dst` is the domain separation tag and `msg` is the message (bytes) to hash let g1 = G1::hash_to_curve(&dst, &msg); // Similarly for G2 let g2 = G2::hash_to_curve(&dst, &msg);
Check the documentation of
hash_to_curvefor more details -
Univariate polynomials
// Create a univariate zero polynomial of degree `d`, i.e. the polynomial will be 0 + 0*x + 0*x^2 + 0*x^3 + ... + 0*x^d let poly = UnivarPolynomial::new(d); assert!(poly.is_zero()); // Create a polynomial from field elements as coefficients, the following polynomial will be c_0 + c_1*x + c_2*x^2 + c_3*x^3 + ... + c_d*x^d let coeffs: Vec<FieldElement> = vec![c_0, c_1, ... coefficients for smaller to higher degrees ..., c_d]; let poly1 = UnivarPolynomial(FieldElementVector::from(coeffs)); // Create a polynomial of degree `d` with random coefficients let poly2 = UnivarPolynomial::random(d); // Create a polynomial from its roots let poly3 = UnivarPolynomial::new_with_roots(roots); // Create a polynomial by passing the coefficients to a macro let poly4 = univar_polynomial!( FieldElement::one(), FieldElement::zero(), FieldElement::from(87u64), -FieldElement::one(), FieldElement::from(300u64) ); // A polynomial can be evaluated at a field element `v` let res: FieldElement = poly1.eval(v); // Polynomials can be added, subtracted, multiplied or divided to give new polynomials let sum = UnivarPolynomial::sum(&poly1, &poly2); // Or use operator overloading let sum = &poly1 + &poly2; let diff = UnivarPolynomial::difference(&poly1, &poly2); // Or use operator overloading let diff = &poly1 - &poly2; let product = UnivarPolynomial::multiply(&poly1, &poly2); // Or use operator overloading let product = &poly1 * &poly2; // Dividing polynomials: poly1 / poly2 let (quotient, rem) = UnivarPolynomial::long_division(&poly1, &poly2);