Comments (5)
Not implemented.
from ethsnarks.
Doing additions in snark in Montgomery forum will cause some problems because it does not have a complete addition law so you will have to build an if loop which adds a bunch of constraints.
So what you will need to do is do half the computations in montgomery forum and then convert to twisted edwards. There are also some checks that zcash do after the conversion zcash/zcash#2230 (comment)
from ethsnarks.
See https://cr.yp.to/ecdh/curvezero-20060726.pdf Theorem 5.1.
So, input points need to be in Edwards X,Y form, each point is validated, and verified that it isn't infinity or one of the low-order points and the y coordinate is non-zero, then it's translated to Montgomery X,Z form.
However, in https://cr.yp.to/newelliptic/twisted-20080313.pdf Theorem 3.4 (pg 6) case 2, shows that for BabyJubJub there will be two more points of order 4 (where u=-1
, and [+,-] v=sqrt(a-2)
).
So, this validation doesn't need to happen for every bit of scalar multiplication, only for points going into and out of it, and in the case of a merkle tree, for points used as part of the path. The key being that you validate on the Edwards curve first (and avoid its edge cases), before using the Montgomery form of the point.
Yes, it adds a bunch of constraints, but the overhead is much smaller than doing everything in affine, projective extended twisted edwards coordinates.
No if conditions are necessary, nor ifs in loops, just constraints for validity.
from ethsnarks.
The Y coordinate of the Edwards form of Baby JubJub is all that's necessary to uniquely identify the point - so in lieu of recovering the X coordinate it contains everything necessary to uniquely identify a point on the curve.
Are you sure? Zcash uses the u-coordinate (X in your notation) as a unique representative of points in the prime subgroup. The v-coordinate (Y in your notation) is not a unique representative; in fact there will be two points P and -P with a given Y, unless X = 0. See the Zcash protocol spec Theorem 5.4.3 (which holds for any complete twisted Edwards curve).
from ethsnarks.
You are correct, I am wrong, the values n
and ORDER-n
produce the same v
coordinate, where u
is negated.
However, I found an oddity, there is a case where a mirror of a randomly chosen point, e.g. (-U, -V) can be turned into (U, V)
while True:
P = Point.from_hash(urandom(10)) # from_y(...)
B = Point.from_x(-P.x)
Q = Point(P.x, -P.y)
assert JUBJUB_L == JUBJUB_ORDER // JUBJUB_C # Curve cofactor, 8
if (-B * (JUBJUB_L-1)) == Q:
print("A")
break
if (B * (JUBJUB_L-1)) == Q:
print("B")
break
However, this only applies where I use Point.from_hash
, and not when I pick a random scalar then multiply the base point (which would defeat the point).
from ethsnarks.
Related Issues (20)
- Implement MiMCsponge HOT 18
- Export proving key and witness to `websnark` format
- Support zkinterface
- Database backed merkle tree implementation
- Add ethsnarks into places which mention zkSNARKs HOT 1
- In verifier, ensure that all public inputs are within the field
- Truncate hash output rather than `modulo p` HOT 2
- HashToPoint should re-hash at every iteration, instead of incrementing HOT 1
- Move away from Truffle
- Get patch accepted to libfqfft which solves OSX/Clang optimised, Enscripten (without patches) and Cheerp builds (which don't handle exceptions)
- Fix upstream bug with 32bit builds in `sha256_round_function_gadget`
- Remove `json` submodule
- Build error with Mingw32
- Python directory ethsnarks/ethsnarks as a PyPI package HOT 3
- Add roots of unity to `FQ` class
- Question about the MiMC implementation HOT 2
- Using SHA256 gadget with arbitrary sized input HOT 1
- is there poseidon solidity contract? HOT 2
- Is the ethsnark lib found on pypi is uploaded by this author? HOT 1
- Error when loading proving_key from pk_file
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ethsnarks.