hard limit

neps/nep-0488.md

@@ -728,7 +728,7 @@ The $E(F_p)$ curve,  points on the curve, multiplication on -1,  and the additio
 
 Note: we take as input any points on the curve, not only from   $G_1$
 
-***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E(F_p)$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and sign encoded in one byte with only two allowed values: 0, 1. Expected `97*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the uncompressed point from $E(F_p)$ and a bool value for point sign. More details are in the Curve Points Encoding section.
+***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E(F_p)$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and sign encoded in one byte with only two allowed values: 0, 1. Expected `97*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the uncompressed point from $E(F_p)$ and a bool value for point sign. More details are in the Curve Points Encoding section.
 
 ***Output:*** the ERROR_CODE is returned. 
 
@@ -761,7 +761,7 @@ Here you can find benchmark test vectors for EIP-2537[^46]. It doesn’t contain
 - The coding of field elements is incorrect, but by modulo p it is a correct element on the curve
 - The coding of field elements is incorrect, an incorrect extra bit, which shows that it is decompressed encoding.
 - Sum with the maximum number of elements
-- Too many points for sum
+- Number of points more than 1000
 - Incorrect len of input
 - Empty input
 - Generate points on the curve and check that the result doesn’t depend on permutation
@@ -778,6 +778,7 @@ We can use all the tests for addition for Ethereum[^47],[^48] to check the case
 ***Error cases:***
 
 - The input length is not divided by 97
+- Number of points more than 1000
 - Too much memory is used
 - The sign value is not 0 or 1
 
@@ -807,7 +808,7 @@ The $E'(F_{p^2})$ curve,  points on the curve, multiplication on -1, and the add
 
 Note: we take as input any points on the curve, not only from $G_2$
 
-***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E'(F_{p^2})$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and sign encoded in one byte. Expected `193*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the uncompressed point from $E'(F_{p^2})$ and the point sign. More details are in the Curve Points Encoding section.
+***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E'(F_{p^2})$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and sign encoded in one byte. Expected `193*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the uncompressed point from $E'(F_{p^2})$ and the point sign. More details are in the Curve Points Encoding section.
 
 ***Output:***
 the ERROR_CODE is returned.
@@ -842,6 +843,7 @@ We can use all the tests for addition for Ethereum[^47],[^48] to check the case
 
 - The input length is not divided by 193
 - Too much memory is used
+- Number of points more than 1000
 - The sign value is not 0 or 1
 
 ***Annotation:***
@@ -879,7 +881,7 @@ Note:
 - We take as input any points on the curve, not only from   $G_1$.
 - The scalar is an arbitrary unsigned integer and can be bigger than the group order.
 
-***Input:*** the sequence of pairs $(p_i, s_i)$, where $p_i \in E(F_p)$ is a point on the curve and $s_i \in \mathbb{N}_0$ is a scalar. Each point is encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `128*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the concatenation of uncompressed point from $E(F_p)$ — `96` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section.
+***Input:*** the sequence of pairs $(p_i, s_i)$, where $p_i \in E(F_p)$ is a point on the curve and $s_i \in \mathbb{N}_0$ is a scalar. Each point is encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `128*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the concatenation of uncompressed point from $E(F_p)$ — `96` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section.
 
 ***Output:***
 the ERROR_CODE is returned.
@@ -922,6 +924,7 @@ The EIP-2537 contains the same function, so we can reuse test vectors from Ether
 
 - The input length is not divided by 128
 - Too much memory is used
+- Number of points more than 1000
 
 ***Annotation:***
 
@@ -962,7 +965,7 @@ Note:
 
 ***Input:*** the sequence of pairs $(p_i, s_i)$, where $p_i \in E'(F_{p^2})$ is a point on the curve and $s_i \in \mathbb{N}_0$ is a scalar. 
 
-Each point is encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `224*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the concatenation of uncompressed point from $E'(F_{p^2})$ — `192` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section.
+Each point is encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `224*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the concatenation of uncompressed point from $E'(F_{p^2})$ — `192` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section.
 
 ***Output:*** 
 
@@ -1001,6 +1004,7 @@ The EIP-2537 contains the same function, so we can reuse test vectors from Ether
 - Too much memory is used
 - Field elements encoded incorrectly (see Curve points encoded section)
 - Any points not on the curve
+- Number of points more than 1000
 
 ***Annotation:***
 
@@ -1147,7 +1151,7 @@ $$
 
 We don’t calculate the pairing function itself: the result will be in the huge field, and in all known applications only such a check is necessary.
 
-***Input:*** the sequence of pairs $(p_i, q_i)$, where $p_i \in G_1 \subset E(F_{p})$ and $q_i \in G_2 \subset E'(F_{p^2})$. Each point is encoded in decompressed form. Expected `288*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the concatenation of uncompressed point from $G_1 \subset E(F_p)$ — `96 bytes` and point from $G_2 \subset E'(F_{p^2})$ — `192 bytes`. More details are in the Curve Points Encoding section.
+***Input:*** the sequence of pairs $(p_i, q_i)$, where $p_i \in G_1 \subset E(F_{p})$ and $q_i \in G_2 \subset E'(F_{p^2})$. Each point is encoded in decompressed form. Expected `288*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the concatenation of uncompressed point from $G_1 \subset E(F_p)$ — `96 bytes` and point from $G_2 \subset E'(F_{p^2})$ — `192 bytes`. More details are in the Curve Points Encoding section.
 
 ***Output:***
 
@@ -1192,6 +1196,7 @@ Here you can find benchmark test vectors for EIP-2537[^46].
 
 - The input length is not divided by 288
 - Too much memory is used
+- Number of pairs more than 1000
 
 ***Annotation:***
 
@@ -1208,7 +1213,7 @@ pub fn bls12381_pairing_check(&mut self, value_len: u64, value_ptr: u64) -> Resu
 
 ***Description:***  Function decompress compressed points from $E(F_p)$. The input is an arbitrary number of points $p_i \in E(F_p)$ in compressed format, and the output is the same number of points from $E(F_p)$ in decompressed format. More about the decompressed and compressed formats you can read in the Curve Points Encoding section.
 
-***Input:***  the sequence of point $p_i \in E(F_p)$, each point encoded in compressed form. Expected `48*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the compressed point from $E(F_p)$. More details are in the Curve Points Encoding section.
+***Input:***  the sequence of point $p_i \in E(F_p)$, each point encoded in compressed form. Expected `48*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the compressed point from $E(F_p)$. More details are in the Curve Points Encoding section.
 
 ***Output:***
 
@@ -1246,6 +1251,7 @@ A and B are constants calculated empirically.
 
 - The input length is not divided by 48
 - Too much memory is used
+- Number of points more than 1000
 
 ***Annotation:***
 
@@ -1267,7 +1273,7 @@ pub fn bls12381_decompress_g1(&mut self,
 
 ***Description:***  Function decompress compressed points from $E'(F_{p^2})$. The input is an arbitrary number of points $p_i \in E'(F_{p^2})$ in compressed format, and the output is the same number of points from $E'(F_{p^2})$ in decompressed format. More about the decompressed and compressed formats you can read in the Curve Points Encoding section.
 
-***Input:***  the sequence of point $p_i \in E'(F_{p^2})$, each point encoded in compressed form. Expected `96*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the compressed point from $E'(F_{p^2})$. More details are in the Curve Points Encoding section.
+***Input:***  the sequence of point $p_i \in E'(F_{p^2})$, each point encoded in compressed form. Expected `96*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the compressed point from $E'(F_{p^2})$. More details are in the Curve Points Encoding section.
 
 ***Output:***
 
@@ -1305,6 +1311,7 @@ A and B are constants calculated empirically.
 
 - The input length is not divided by 96
 - Too much memory is used
+- Number of points more than 1000
 
 ***Annotation:***