ec_operations.cpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: Complete, auditors: [Luke], commit: a48c205d6dcd4338f5b83b4fda18bff6015be07b}
// external_1:  { status: not started, auditors: [], commit: }
// external_2:  { status: not started, auditors: [], commit: }
// =====================
 
#include "ec_operations.hpp"
#include "barretenberg/ecc/curves/bn254/fr.hpp"
#include "barretenberg/ecc/curves/grumpkin/grumpkin.hpp"
#include "barretenberg/ecc/groups/affine_element.hpp"
#include "barretenberg/honk/execution_trace/gate_data.hpp"
#include "barretenberg/stdlib/primitives/group/cycle_group.hpp"
 
namespace acir_format {
 
template <typename Builder> void create_ec_add_constraint(Builder& builder, const EcAdd& input)
{
    using cycle_group_ct = bb::stdlib::cycle_group<Builder>;
    using field_ct = bb::stdlib::field_t<Builder>;
    using bool_ct = bb::stdlib::bool_t<Builder>;
 
    // Step 1.
    bool_ct predicate = bool_ct(to_field_ct(input.predicate, builder));
 
    field_ct input_result_x = field_ct::from_witness_index(&builder, input.result_x);
    field_ct input_result_y = field_ct::from_witness_index(&builder, input.result_y);
    bool_ct input_result_infinite = bool_ct(field_ct::from_witness_index(&builder, input.result_infinite));
 
    if (builder.is_write_vk_mode()) {
        builder.set_variable(input_result_x.get_witness_index(), bb::grumpkin::g1::affine_one.x);
        builder.set_variable(input_result_y.get_witness_index(), bb::grumpkin::g1::affine_one.y);
        builder.set_variable(input_result_infinite.get_witness_index(), bb::fr(0)); // generator is finite
    }
 
    cycle_group_ct input1_point =
        to_grumpkin_point(input.input1_x, input.input1_y, input.input1_infinite, predicate, builder);
    cycle_group_ct input2_point =
        to_grumpkin_point(input.input2_x, input.input2_y, input.input2_infinite, predicate, builder);
 
    // Use public constructor which auto-detects infinity from (0,0) coordinates.
    // Note that input_result is computed by Noir and passed to bb via ACIR. Hence, it is always a valid point on
    // Grumpkin, so we don't need to assert on curve.
    cycle_group_ct input_result(input_result_x, input_result_y, /*assert_on_curve=*/false);
 
    // Constrain the result_infinite witness against the auto-detected infinity from coordinates.
    // Use conditional_assign so the constraint is inactive when predicate is false.
    bool_ct expected_infinite =
        bool_ct::conditional_assign(predicate, input_result.is_point_at_infinity(), input_result_infinite);
    input_result_infinite.assert_equal(expected_infinite);
 
    // Step 2.
    cycle_group_ct result = input1_point + input2_point;
 
    // The assert_equal method standardizes both points before comparing, so if either of them is the point at
    // infinity, the coordinates will be assigned to be (0,0). This is OK as long as Noir developers do not use the
    // coordinates of a point at infinity (otherwise input_result might be the point at infinity different from (0,
    // 0, true), and the fact that assert_equal passes doesn't imply anything for the original coordinates of
    // input_result).
    cycle_group_ct to_be_asserted_equal = cycle_group_ct::conditional_assign(predicate, input_result, result);
    result.assert_equal(to_be_asserted_equal);
}
 
template void create_ec_add_constraint<bb::UltraCircuitBuilder>(bb::UltraCircuitBuilder& builder, const EcAdd& input);
template void create_ec_add_constraint<bb::MegaCircuitBuilder>(bb::MegaCircuitBuilder& builder, const EcAdd& input);
 
} // namespace acir_format