Merge pull request #1258 from Consensys/refactor/limb-composition

refactor: utility methods into separate internal package for reuse in std library

constraint/gkr.go

@@ -2,10 +2,11 @@ package constraint
 
 import (
 	"fmt"
+	"sort"
+
 	"github.com/consensys/gnark-crypto/utils"
 	"github.com/consensys/gnark/constraint/solver"
-	"github.com/consensys/gnark/std/utils/algo_utils"
-	"sort"
+	"github.com/consensys/gnark/internal/algo_utils"
 )
 
 type GkrVariable int // Just an alias to hide implementation details. May be more trouble than worth

internal/generator/backend/template/representations/gkr.go.tmpl

@@ -7,7 +7,7 @@ import (
 	"github.com/consensys/gnark-crypto/utils"
 	"github.com/consensys/gnark/constraint"
 	hint "github.com/consensys/gnark/constraint/solver"
-	"github.com/consensys/gnark/std/utils/algo_utils"
+	"github.com/consensys/gnark/internal/algo_utils"
 	"hash"
 	"math/big"
 	"sync"

std/compress/internal/io_test.go

@@ -3,19 +3,20 @@ package internal_test
 import (
 	"bytes"
 	"crypto/rand"
+	"testing"
+
 	"github.com/consensys/gnark-crypto/ecc"
 	"github.com/consensys/gnark/backend"
 	"github.com/consensys/gnark/frontend"
 	"github.com/consensys/gnark/frontend/cs/scs"
 	"github.com/consensys/gnark/std/compress"
 	"github.com/consensys/gnark/std/compress/internal"
 	"github.com/consensys/gnark/std/compress/lzss"
+	test_vector_utils "github.com/consensys/gnark/std/internal/test_vectors_utils"
 	"github.com/consensys/gnark/std/math/bits"
-	test_vector_utils "github.com/consensys/gnark/std/utils/test_vectors_utils"
 	"github.com/consensys/gnark/test"
 	"github.com/icza/bitio"
 	"github.com/stretchr/testify/assert"
-	"testing"
 )
 
 func TestRecombineBytes(t *testing.T) {

std/compress/internal/plonk/plonk_test.go

@@ -4,14 +4,15 @@ import (
 	"crypto/rand"
 	"encoding/binary"
 	"errors"
+	"reflect"
+	"testing"
+
 	"github.com/consensys/gnark-crypto/ecc"
 	"github.com/consensys/gnark-crypto/ecc/bls12-377/fr"
 	"github.com/consensys/gnark/backend"
 	"github.com/consensys/gnark/frontend"
-	test_vector_utils "github.com/consensys/gnark/std/utils/test_vectors_utils"
+	test_vector_utils "github.com/consensys/gnark/std/internal/test_vectors_utils"
 	"github.com/consensys/gnark/test"
-	"reflect"
-	"testing"
 )
 
 func TestCustomConstraint(t *testing.T) {

std/compress/io_test.go

@@ -4,18 +4,19 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
+	"math/big"
+	"testing"
+
 	"github.com/consensys/gnark-crypto/ecc"
 	"github.com/consensys/gnark-crypto/ecc/bls12-377/fr"
 	"github.com/consensys/gnark-crypto/hash"
 	"github.com/consensys/gnark/backend"
 	"github.com/consensys/gnark/frontend"
 	"github.com/consensys/gnark/frontend/cs/scs"
 	"github.com/consensys/gnark/profile"
-	test_vector_utils "github.com/consensys/gnark/std/utils/test_vectors_utils"
+	test_vector_utils "github.com/consensys/gnark/std/internal/test_vectors_utils"
 	"github.com/consensys/gnark/test"
 	"github.com/stretchr/testify/assert"
-	"math/big"
-	"testing"
 )
 
 func TestShiftLeft(t *testing.T) {

std/compress/lzss/snark_test.go

@@ -4,15 +4,16 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
-	"github.com/consensys/gnark/frontend/cs/scs"
 	"os"
 	"testing"
 
+	"github.com/consensys/gnark/frontend/cs/scs"
+
 	"github.com/consensys/compress/lzss"
 	"github.com/consensys/gnark-crypto/ecc"
 	"github.com/consensys/gnark/backend"
 	"github.com/consensys/gnark/frontend"
-	test_vector_utils "github.com/consensys/gnark/std/utils/test_vectors_utils"
+	test_vector_utils "github.com/consensys/gnark/std/internal/test_vectors_utils"
 	"github.com/consensys/gnark/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

std/compress/lzss/snark_testing.go

@@ -4,7 +4,7 @@ import (
 	"github.com/consensys/compress/lzss"
 	"github.com/consensys/gnark/frontend"
 	"github.com/consensys/gnark/std/compress"
-	test_vector_utils "github.com/consensys/gnark/std/utils/test_vectors_utils"
+	test_vector_utils "github.com/consensys/gnark/std/internal/test_vectors_utils"
 )
 
 type DecompressionTestCircuit struct {

std/evmprecompiles/hints.go

@@ -8,6 +8,7 @@ import (
 	"github.com/consensys/gnark-crypto/ecc/secp256k1/ecdsa"
 	"github.com/consensys/gnark/constraint/solver"
 	"github.com/consensys/gnark/frontend"
+	limbs "github.com/consensys/gnark/std/internal/limbcomposition"
 	"github.com/consensys/gnark/std/math/emulated"
 )
 
@@ -46,10 +47,20 @@ func recoverPublicKeyHint(_ *big.Int, inputs []*big.Int, outputs []*big.Int) err
 	if len(outputs) != 2*int(emfp.NbLimbs())+1 {
 		return fmt.Errorf("expected output %d limbs got %d", 2*emfp.NbLimbs(), len(outputs))
 	}
-	msg := recompose(inputs[:emfr.NbLimbs()], emfr.BitsPerLimb())
+	msg, r, s := new(big.Int), new(big.Int), new(big.Int)
+	err := limbs.Recompose(inputs[:emfr.NbLimbs()], emfr.BitsPerLimb(), msg)
+	if err != nil {
+		return fmt.Errorf("recompose message: %w", err)
+	}
 	v := inputs[emfr.NbLimbs()].Uint64()
-	r := recompose(inputs[emfr.NbLimbs()+1:2*emfr.NbLimbs()+1], emfr.BitsPerLimb())
-	s := recompose(inputs[2*emfr.NbLimbs()+1:3*emfr.NbLimbs()+1], emfr.BitsPerLimb())
+	err = limbs.Recompose(inputs[emfr.NbLimbs()+1:2*emfr.NbLimbs()+1], emfr.BitsPerLimb(), r)
+	if err != nil {
+		return fmt.Errorf("recompose r: %w", err)
+	}
+	err = limbs.Recompose(inputs[2*emfr.NbLimbs()+1:3*emfr.NbLimbs()+1], emfr.BitsPerLimb(), s)
+	if err != nil {
+		return fmt.Errorf("recompose s: %w", err)
+	}
 	var pk ecdsa.PublicKey
 	var isQNRFailure int
 	if err := pk.RecoverFrom(msg.Bytes(), uint(v), r, s); err != nil {
@@ -62,10 +73,10 @@ func recoverPublicKeyHint(_ *big.Int, inputs []*big.Int, outputs []*big.Int) err
 	}
 	Px := pk.A.X.BigInt(new(big.Int))
 	Py := pk.A.Y.BigInt(new(big.Int))
-	if err := decompose(Px, emfp.BitsPerLimb(), outputs[0:emfp.NbLimbs()]); err != nil {
+	if err := limbs.Decompose(Px, emfp.BitsPerLimb(), outputs[0:emfp.NbLimbs()]); err != nil {
 		return fmt.Errorf("decompose x: %w", err)
 	}
-	if err := decompose(Py, emfp.BitsPerLimb(), outputs[emfp.NbLimbs():2*emfp.NbLimbs()]); err != nil {
+	if err := limbs.Decompose(Py, emfp.BitsPerLimb(), outputs[emfp.NbLimbs():2*emfp.NbLimbs()]); err != nil {
 		return fmt.Errorf("decompose y: %w", err)
 	}
 	// we also return a flag that indicates if the public key is zero but only

std/gkr/api.go

@@ -2,7 +2,7 @@ package gkr
 
 import (
 	"github.com/consensys/gnark/constraint"
-	"github.com/consensys/gnark/std/utils/algo_utils"
+	"github.com/consensys/gnark/internal/algo_utils"
 )
 
 func frontendVarToInt(a constraint.GkrVariable) int {

std/gkr/api_test.go

@@ -2,18 +2,19 @@ package gkr
 
 import (
 	"fmt"
+	"hash"
+	"math/rand"
+	"strconv"
+	"testing"
+	"time"
+
 	bls12377 "github.com/consensys/gnark/constraint/bls12-377"
 	bls12381 "github.com/consensys/gnark/constraint/bls12-381"
 	bls24315 "github.com/consensys/gnark/constraint/bls24-315"
 	bls24317 "github.com/consensys/gnark/constraint/bls24-317"
 	bw6633 "github.com/consensys/gnark/constraint/bw6-633"
 	bw6761 "github.com/consensys/gnark/constraint/bw6-761"
 	"github.com/consensys/gnark/test"
-	"hash"
-	"math/rand"
-	"strconv"
-	"testing"
-	"time"
 
 	"github.com/consensys/gnark-crypto/kzg"
 	"github.com/consensys/gnark/backend/plonk"
@@ -32,7 +33,7 @@ import (
 	"github.com/consensys/gnark/frontend/cs/scs"
 	stdHash "github.com/consensys/gnark/std/hash"
 	"github.com/consensys/gnark/std/hash/mimc"
-	test_vector_utils "github.com/consensys/gnark/std/utils/test_vectors_utils"
+	test_vector_utils "github.com/consensys/gnark/std/internal/test_vectors_utils"
 	"github.com/consensys/gnark/test/unsafekzg"
 )
 

std/gkr/compile.go

@@ -7,9 +7,9 @@ import (
 	"github.com/consensys/gnark/constraint"
 	"github.com/consensys/gnark/constraint/solver"
 	"github.com/consensys/gnark/frontend"
+	"github.com/consensys/gnark/internal/algo_utils"
 	fiatshamir "github.com/consensys/gnark/std/fiat-shamir"
 	"github.com/consensys/gnark/std/hash"
-	"github.com/consensys/gnark/std/utils/algo_utils"
 )
 
 type circuitDataForSnark struct {

std/internal/limbcomposition/composition.go

@@ -0,0 +1,54 @@
+package limbs
+
+import (
+	"fmt"
+	"math/big"
+)
+
+// Recompose takes the limbs in inputs and combines them into res. It errors if
+// inputs is uninitialized or zero-length and if the result is uninitialized.
+//
+// The following holds
+//
+//	res = \sum_{i=0}^{len(inputs)} inputs[i] * 2^{nbBits * i}
+func Recompose(inputs []*big.Int, nbBits uint, res *big.Int) error {
+	if len(inputs) == 0 {
+		return fmt.Errorf("zero length slice input")
+	}
+	if res == nil {
+		return fmt.Errorf("result not initialized")
+	}
+	res.SetUint64(0)
+	for i := range inputs {
+		res.Lsh(res, nbBits)
+		res.Add(res, inputs[len(inputs)-i-1])
+	}
+	// we do not mod-reduce here as the result is mod-reduced by the caller if
+	// needed. In some places we need non-reduced results.
+	return nil
+}
+
+// Decompose decomposes the input into res as integers of width nbBits. It
+// errors if the decomposition does not fit into res or if res is uninitialized.
+//
+// The following holds
+//
+//	input = \sum_{i=0}^{len(res)} res[i] * 2^{nbBits * i}
+func Decompose(input *big.Int, nbBits uint, res []*big.Int) error {
+	// limb modulus
+	if input.BitLen() > len(res)*int(nbBits) {
+		return fmt.Errorf("decomposed integer does not fit into res")
+	}
+	for _, r := range res {
+		if r == nil {
+			return fmt.Errorf("result slice element uninitalized")
+		}
+	}
+	base := new(big.Int).Lsh(big.NewInt(1), nbBits)
+	tmp := new(big.Int).Set(input)
+	for i := 0; i < len(res); i++ {
+		res[i].Mod(tmp, base)
+		tmp.Rsh(tmp, nbBits)
+	}
+	return nil
+}