Skip to content

Commit a7e4145

Browse files
committed
add CHANGELOG + doc + basic DST to G2 module.
1 parent 6e8f0a9 commit a7e4145

File tree

3 files changed

+46
-7
lines changed

3 files changed

+46
-7
lines changed

CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
- [`aiken/crypto/int224`](https://aiken-lang.github.io/stdlib/aiken/crypto/int224.html)
99
- [`aiken/crypto/int256`](https://aiken-lang.github.io/stdlib/aiken/crypto/int256.html)
1010

11+
- New module wrapping BLS12-381 pairing features:
12+
- [`aiken/crypto/bls12_381/pairing`](https://aiken-lang.github.io/stdlib/aiken/crypto/bls12_381/pairing.html)
13+
1114
- [`aiken/collection/dict.{get_or_else}`](https://aiken-lang.github.io/stdlib/aiken/collection/list.html#get_or_else): to lookup a value from a dict, with a fallback.
1215

1316
- [`aiken/collection/list.{foldl2}`](https://aiken-lang.github.io/stdlib/aiken/collection/list.html#foldl2): to left-fold over lists while accumulating two separate results. This is reasonably faster than constructing a list of pairs.

lib/aiken/crypto/bls12_381/g2.ak

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ use aiken/crypto/bls12_381/scalar.{Scalar}
2121
pub const generator: G2Element =
2222
#<Bls12_381, G2>"93e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8"
2323

24+
/// Basic Domain Separation Tag as per the [IETF](https://www.ietf.org/archive/id/draft-irtf-cfrg-bls-signature-05.html#section-4.2.1).
25+
pub const domain_separation_tag_basic =
26+
"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_"
27+
2428
test generator_1() {
2529
builtin.bls12_381_g2_scalar_mul(scalar.field_prime, generator) == #<Bls12_381, G2>"c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
2630
}

lib/aiken/crypto/bls12_381/pairing.ak

Lines changed: 39 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,59 @@ use aiken/crypto/bls12_381/g1
44
use aiken/crypto/bls12_381/g2
55
use aiken/crypto/bls12_381/scalar.{Scalar}
66

7+
/// Computes a MillerLoop over the elements `q` and `p`
78
pub fn miller_loop(q: G1Element, p: G2Element) -> MillerLoopResult {
89
bls12_381_miller_loop(q, p)
910
}
1011

12+
/// Final exponentiation against two `MillerLoopResult`.
13+
///
14+
/// ```aiken
15+
/// prove: e(q^x, p^m) == e(q, p^m*x)
16+
/// let secret: State<Scalar> = scalar.from_int(44203)
17+
///
18+
/// let public_value: G1Element = g1.generator |> g1.scale(secret)
19+
///
20+
/// let message: ByteArray = #"acab"
21+
///
22+
/// let challenge: G2Element =
23+
/// message |> g2.hash_to_group(g2.domain_separation_tag_basic)
24+
///
25+
/// let witness: G2Element =
26+
/// message
27+
/// |> g2.hash_to_group(g2.domain_separation_tag_basic)
28+
/// |> g2.scale(secret)
29+
///
30+
/// final_exponentiation(
31+
/// miller_loop(public_value, challenge),
32+
/// miller_loop(g1.generator, witness),
33+
/// )
34+
/// ```
1135
pub fn final_exponentiation(
1236
left: MillerLoopResult,
1337
right: MillerLoopResult,
1438
) -> Bool {
1539
bls12_381_final_verify(left, right)
1640
}
1741

42+
// prove: e(q^x, p^m) == e(q, p^m*x)
1843
test simple_miller_loop_with_final_exponentiation() {
19-
// prove: e(q^x, p^m) == e(q, p^m*x)
2044
let secret: State<Scalar> = scalar.from_int(44203)
45+
2146
let public_value: G1Element = g1.generator |> g1.scale(secret)
47+
2248
let message: ByteArray = #"acab"
23-
let domain_tag: ByteArray = "BLS-TEST"
24-
let challenge: G2Element = g2.hash_to_group(message, domain_tag)
49+
50+
let challenge: G2Element =
51+
message |> g2.hash_to_group(g2.domain_separation_tag_basic)
52+
2553
let witness: G2Element =
26-
g2.hash_to_group(message, domain_tag) |> g2.scale(secret)
27-
let left: MillerLoopResult = miller_loop(public_value, challenge)
28-
let right: MillerLoopResult = miller_loop(g1.generator, witness)
29-
final_exponentiation(left, right)
54+
message
55+
|> g2.hash_to_group(g2.domain_separation_tag_basic)
56+
|> g2.scale(secret)
57+
58+
final_exponentiation(
59+
miller_loop(public_value, challenge),
60+
miller_loop(g1.generator, witness),
61+
)
3062
}

0 commit comments

Comments
 (0)