Foreign curve and ECDSA #1007

mitschabaude · 2023-06-28T15:38:35Z

stacked behind both #985 and #1240

closes #966, #1156 , #1158

Main changes:

Adds several missing EC gadgets in gadgets/elliptic-curve.ts: assertOnCurve(), assertInSubgroup(), negate(), scale()
- unifies the API of all EC gadgets, to take inputs first and then a Curve and possibly other config
Adds unit tests for EC gadgets
New export: ForeignCurve class and createForeignCurve() factory, see foreign-curve.ts
New export: EcdsaSignature class and createEcdsa() factory, see foreign-ecdsa.ts
Removes the lower-level Gadgets.Ecdsa namespace. I concluded that it wasn't very usable without a sibling low-level EC gadgets namespace, and exposing the full EC + ECDSA API in two different forms seemed complete overkill to me. Better to have one way to do things
Some additions and changes to ForeignField

bindings: o1-labs/o1js-bindings#215

src/lib/foreign-curve.ts

mitschabaude · 2023-12-05T13:00:02Z

package.json

I simplified the scripts as I was finding myself running npm run build:test everytime -- now both npm run dev and npm run build include building test dependencies, and only the production build doesn't

mitschabaude · 2023-12-05T13:00:57Z

src/examples/crypto/ecdsa/ecdsa.ts

this example was moved here from examples/zkprogram/ and now uses the new class APIs

mitschabaude · 2023-12-05T13:08:31Z

src/lib/foreign-field.ts

+   * let isXZero = x.equals(0);
+   * ```
+   */
+  equals(y: bigint | number) {


I noticed (when I wanted to use it) that the original ForeignField.equals() is very error-prone, since it checked for exact equality instead of equality mod p. I replaced it with this constant version (which assumes an almost reduced input) and the full version on CanonicalForeignField

mitschabaude · 2023-12-05T13:09:15Z

src/lib/foreign-field.ts

@@ -186,7 +191,7 @@ class ForeignField {
   *
   * Returns the field element as a {@link CanonicalForeignField}.
   */
-  assertCanonicalFieldElement() {
+  assertCanonical() {


old name was too long

mitschabaude · 2023-12-05T13:10:51Z

src/lib/foreign-field.ts

@@ -661,7 +696,7 @@ type Constructor<T> = new (...args: any[]) => T;

 function provable<F extends ForeignField>(
  Class: Constructor<F> & { check(x: ForeignField): void }
-): ProvablePure<F> {
+): ProvablePureExtended<F, string> {


making this support toJSON etc. makes a nicer inferred Provable for ForeignCurve and EcdsaSignature as well

mitschabaude · 2023-12-05T13:16:00Z

src/lib/provable-context.ts

+      summary() {
+        let gateTypes: Partial<Record<GateType | 'Total rows', number>> = {};
+        gateTypes['Total rows'] = rows;


I had this code manually copied in a lot of files, find it useful to expose

mitschabaude · 2023-12-05T13:16:53Z

src/lib/testing/constraint-system.ts

+      // prevent blow-up of constant size
+      if (x[0] === FieldType.Constant && y[0] === FieldType.Constant) return x;


changes here prevent rare cases where constraintSystem tests would be flaky on a very large constant input (for example, if the circuit asserts that the input is less than 256)

mitschabaude · 2023-12-05T13:46:06Z

src/lib/testing/equivalent.ts

+    if (verbose) {
+      let ms = (performance.now() - start).toFixed(1);
+      let runs = nRuns.toString().padStart(2, ' ');
+      console.log(
+        `${label.padEnd(20, ' ')}    success on ${runs} runs in ${ms}ms.`
+      );
+    }


new argument verbose prints a nice summary of the test run. I used this to debug why the new EC unit tests were taking so long (turns out that scale() just takes a pretty long time, like a few seconds, I'm planning to look into how it can be made faster, as a follow-up)

mitschabaude · 2023-12-05T13:46:58Z

src/lib/testing/equivalent.ts

  let fromUnions = fromRaw.map(toUnion);
+  assert(fromUnions.some(isProvable), 'equivalentProvable: no provable input');


this prevents the accident with ecdsa, where we weren't testing it in provable code, in the future

mitschabaude · 2023-12-05T13:48:47Z

tests/vk-regression/vk-regression.json

-        "rows": 38846,
-        "digest": "892b0a1fad0f13d92ba6099cd54e6780"
+        "rows": 38888,
+        "digest": "70f148db469f028f1d8cb99e8e8e278a"


the example circuit changed: it previously did no validity checks on the input public key, now it does (automatically, when the input is witnessed)

Trivo25 · 2023-12-06T08:15:30Z

src/lib/foreign-curve.ts

+ * `createForeignCurve(params)` takes curve parameters {@link CurveParams} as input.
+ * We support `modulus` and `order` to be prime numbers up to 259 bits.
+ *
+ * The returned {@link ForeignCurve} class represents a _non-zero curve point_ and supports standard


I wonder if there are any important algorithms where we actually have to deal with the point at infinity 🤔

Trivo25 · 2023-12-06T08:25:58Z

src/lib/gadgets/elliptic-curve.ts

+
+function random(Curve: CurveAffine) {
+  let x = Curve.Field.random();
+  return simpleMapToCurve(x, Curve);


wouldn't it be more efficient to scale the generator by a random element x to gain a new random point instead of going through a map to curve algorithm?

no, map to curve is faster. EC scale is a fairly heavy operation - much heavier than square root

This reverts commit 7ec8090.

nicc · 2023-12-07T18:40:42Z

Reminder to remove "coming soon" from the docs when this is merged

mitschabaude added 25 commits June 28, 2023 13:07

fix example

a637e7c

initial minimal foreign curve, doesn't work yet

1febfbe

initial work on test

e012ba6

working bare bones ec with add

addf84c

make curve provable

578f444

expose common ec methods

4fb98e6

add remaining provable methods

7a228c3

correct comments

e241042

minor tweaks

6f0a888

improve api

44779a1

stub out ecdsa factory

26affb1

expose ecdsa methods

81b9118

from hex

1dae1dc

start writing test for eth signature

005a2aa

ecdsa test

b237f9c

minor

36ad895

Merge branch 'feature/foreign-field' into feature/ecdsa

f4e59b2

bindings

9b5cf28

renamings

b530803

add most constant curve impls

afce065

scale

6b43f92

constant subgroup check

5781049

getting non provable curve ops to run

5ad6b49

start writing doc comments

78c635b

more doc comments, unsafe parameter, proper check()

bf9968a

barriebyron reviewed Jul 13, 2023

View reviewed changes

src/lib/foreign-curve.ts Outdated Show resolved Hide resolved

mitschabaude added 4 commits July 13, 2023 20:13

fox typo and foreign curve check

61bb485

ecdsa doc comments

499928d

implement ecdsa in ts for non-provable

f2460f1

minor

07a45f7

mitschabaude added 9 commits December 5, 2023 10:27

remove use of build:node

ce82667

improve comments

81d0047

flesh out doccomments

818046c

move dangerous foreign field equals

3d14a4e

change to safe equals() methods in foreign field, rename assertCanonical

dfc7e97

add safe ec addition

0403912

signature to bigint

abe4d56

adapt unit test

3a3cce3

delete ec and ecdsa gadgets namespaces

9bcb6fd

mitschabaude linked an issue Dec 5, 2023 that may be closed by this pull request

Port ECDSAVerify gadget to TypeScript #1159

Closed

mitschabaude removed a link to an issue Dec 5, 2023

Port ECDSAVerify gadget to TypeScript #1159

Closed

This was linked to issues Dec 5, 2023

Port ECIsOnCurve gadget to TypeScript #1156

Closed

Port EcCheckSubgroup gadget to TypeScript #1158

Closed

changelog

31282ea

mitschabaude commented Dec 5, 2023

View reviewed changes

mitschabaude marked this pull request as ready for review December 5, 2023 13:52

mitschabaude requested a review from a team as a code owner December 5, 2023 13:52

Trivo25 approved these changes Dec 6, 2023

View reviewed changes

mitschabaude added 2 commits December 6, 2023 20:53

Revert "remove ecdsa from vk test for now"

db8f63a

This reverts commit 7ec8090.

Merge branch 'tmp' into feature/ecdsa

120ae94

Base automatically changed from feature/ecdsa-new to main December 6, 2023 21:06

mitschabaude added 2 commits December 7, 2023 08:09

Merge branch 'main' into feature/ecdsa

0a96141

dump vks

62091b8

This was referenced Dec 7, 2023

Port ECIsOnCurve gadget to TypeScript #1156

Closed

Port EcCheckSubgroup gadget to TypeScript #1158

Closed

Port ECNegate gadget to TypeScript #1155

Closed

Merge branch 'main' into feature/ecdsa

5430dc4

mitschabaude merged commit bf00ea6 into main Dec 12, 2023
13 checks passed

mitschabaude deleted the feature/ecdsa branch December 12, 2023 11:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Foreign curve and ECDSA #1007

Foreign curve and ECDSA #1007

mitschabaude commented Jun 28, 2023 •

edited

Loading

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

mitschabaude Dec 5, 2023

Trivo25 Dec 6, 2023

Trivo25 Dec 6, 2023

mitschabaude Dec 6, 2023

nicc commented Dec 7, 2023

		// prevent blow-up of constant size
		if (x[0] === FieldType.Constant && y[0] === FieldType.Constant) return x;

		let fromUnions = fromRaw.map(toUnion);
		assert(fromUnions.some(isProvable), 'equivalentProvable: no provable input');

Foreign curve and ECDSA #1007

Foreign curve and ECDSA #1007

Conversation

mitschabaude commented Jun 28, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nicc commented Dec 7, 2023

mitschabaude commented Jun 28, 2023 •

edited

Loading