diff --git a/neps/nep-0488.md b/neps/nep-0488.md index 15c58afc9..7ab15f9c2 100644 --- a/neps/nep-0488.md +++ b/neps/nep-0488.md @@ -728,7 +728,7 @@ The $E(F_p)$ curve, points on the curve, multiplication on -1, and the additio Note: we take as input any points on the curve, not only from $G_1$ -***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E(F_p)$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and sign encoded in one byte with only two allowed values: 0, 1. Expected `97*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the uncompressed point from $E(F_p)$ and a bool value for point sign. More details are in the Curve Points Encoding section. +***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E(F_p)$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and sign encoded in one byte with only two allowed values: 0, 1. Expected `97*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the uncompressed point from $E(F_p)$ and a bool value for point sign. More details are in the Curve Points Encoding section. ***Output:*** the ERROR_CODE is returned. @@ -761,7 +761,7 @@ Here you can find benchmark test vectors for EIP-2537[^46]. It doesn’t contain - The coding of field elements is incorrect, but by modulo p it is a correct element on the curve - The coding of field elements is incorrect, an incorrect extra bit, which shows that it is decompressed encoding. - Sum with the maximum number of elements -- Too many points for sum +- Number of points more than 1000 - Incorrect len of input - Empty input - Generate points on the curve and check that the result doesn’t depend on permutation @@ -778,6 +778,7 @@ We can use all the tests for addition for Ethereum[^47],[^48] to check the case ***Error cases:*** - The input length is not divided by 97 +- Number of points more than 1000 - Too much memory is used - The sign value is not 0 or 1 @@ -807,7 +808,7 @@ The $E'(F_{p^2})$ curve, points on the curve, multiplication on -1, and the add Note: we take as input any points on the curve, not only from $G_2$ -***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E'(F_{p^2})$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and sign encoded in one byte. Expected `193*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the uncompressed point from $E'(F_{p^2})$ and the point sign. More details are in the Curve Points Encoding section. +***Input:*** the sequence of pairs $(s_i, p_i)$, where $p_i \in E'(F_{p^2})$ is point and $s_i \in \textbraceleft 0, 1 \textbraceright$ is sign, each point encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and sign encoded in one byte. Expected `193*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the uncompressed point from $E'(F_{p^2})$ and the point sign. More details are in the Curve Points Encoding section. ***Output:*** the ERROR_CODE is returned. @@ -842,6 +843,7 @@ We can use all the tests for addition for Ethereum[^47],[^48] to check the case - The input length is not divided by 193 - Too much memory is used +- Number of points more than 1000 - The sign value is not 0 or 1 ***Annotation:*** @@ -879,7 +881,7 @@ Note: - We take as input any points on the curve, not only from $G_1$. - The scalar is an arbitrary unsigned integer and can be bigger than the group order. -***Input:*** the sequence of pairs $(p_i, s_i)$, where $p_i \in E(F_p)$ is a point on the curve and $s_i \in \mathbb{N}_0$ is a scalar. Each point is encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `128*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the concatenation of uncompressed point from $E(F_p)$ — `96` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section. +***Input:*** the sequence of pairs $(p_i, s_i)$, where $p_i \in E(F_p)$ is a point on the curve and $s_i \in \mathbb{N}_0$ is a scalar. Each point is encoded in decompress form as $(x\colon F_p, y\colon F_p)$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `128*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the concatenation of uncompressed point from $E(F_p)$ — `96` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section. ***Output:*** the ERROR_CODE is returned. @@ -922,6 +924,7 @@ The EIP-2537 contains the same function, so we can reuse test vectors from Ether - The input length is not divided by 128 - Too much memory is used +- Number of points more than 1000 ***Annotation:*** @@ -962,7 +965,7 @@ Note: ***Input:*** the sequence of pairs $(p_i, s_i)$, where $p_i \in E'(F_{p^2})$ is a point on the curve and $s_i \in \mathbb{N}_0$ is a scalar. -Each point is encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `224*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the concatenation of uncompressed point from $E'(F_{p^2})$ — `192` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section. +Each point is encoded in decompress form as $(x\colon F_{p^2}, y\colon F_{p^2})$ and a scalar has a type `u256` and BigEndian encoded in 32 bytes. Expected `224*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the concatenation of uncompressed point from $E'(F_{p^2})$ — `192` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section. ***Output:*** @@ -1001,6 +1004,7 @@ The EIP-2537 contains the same function, so we can reuse test vectors from Ether - Too much memory is used - Field elements encoded incorrectly (see Curve points encoded section) - Any points not on the curve +- Number of points more than 1000 ***Annotation:*** @@ -1147,7 +1151,7 @@ $$ We don’t calculate the pairing function itself: the result will be in the huge field, and in all known applications only such a check is necessary. -***Input:*** the sequence of pairs $(p_i, q_i)$, where $p_i \in G_1 \subset E(F_{p})$ and $q_i \in G_2 \subset E'(F_{p^2})$. Each point is encoded in decompressed form. Expected `288*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the concatenation of uncompressed point from $G_1 \subset E(F_p)$ — `96 bytes` and point from $G_2 \subset E'(F_{p^2})$ — `192 bytes`. More details are in the Curve Points Encoding section. +***Input:*** the sequence of pairs $(p_i, q_i)$, where $p_i \in G_1 \subset E(F_{p})$ and $q_i \in G_2 \subset E'(F_{p^2})$. Each point is encoded in decompressed form. Expected `288*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the concatenation of uncompressed point from $G_1 \subset E(F_p)$ — `96 bytes` and point from $G_2 \subset E'(F_{p^2})$ — `192 bytes`. More details are in the Curve Points Encoding section. ***Output:*** @@ -1192,6 +1196,7 @@ Here you can find benchmark test vectors for EIP-2537[^46]. - The input length is not divided by 288 - Too much memory is used +- Number of pairs more than 1000 ***Annotation:*** @@ -1208,7 +1213,7 @@ pub fn bls12381_pairing_check(&mut self, value_len: u64, value_ptr: u64) -> Resu ***Description:*** Function decompress compressed points from $E(F_p)$. The input is an arbitrary number of points $p_i \in E(F_p)$ in compressed format, and the output is the same number of points from $E(F_p)$ in decompressed format. More about the decompressed and compressed formats you can read in the Curve Points Encoding section. -***Input:*** the sequence of point $p_i \in E(F_p)$, each point encoded in compressed form. Expected `48*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the compressed point from $E(F_p)$. More details are in the Curve Points Encoding section. +***Input:*** the sequence of point $p_i \in E(F_p)$, each point encoded in compressed form. Expected `48*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the compressed point from $E(F_p)$. More details are in the Curve Points Encoding section. ***Output:*** @@ -1246,6 +1251,7 @@ A and B are constants calculated empirically. - The input length is not divided by 48 - Too much memory is used +- Number of points more than 1000 ***Annotation:*** @@ -1267,7 +1273,7 @@ pub fn bls12381_decompress_g1(&mut self, ***Description:*** Function decompress compressed points from $E'(F_{p^2})$. The input is an arbitrary number of points $p_i \in E'(F_{p^2})$ in compressed format, and the output is the same number of points from $E'(F_{p^2})$ in decompressed format. More about the decompressed and compressed formats you can read in the Curve Points Encoding section. -***Input:*** the sequence of point $p_i \in E'(F_{p^2})$, each point encoded in compressed form. Expected `96*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the compressed point from $E'(F_{p^2})$. More details are in the Curve Points Encoding section. +***Input:*** the sequence of point $p_i \in E'(F_{p^2})$, each point encoded in compressed form. Expected `96*k` bytes as an input that is interpreted as byte concatenation of `k` slices ($k \le 1000$), each slice is the compressed point from $E'(F_{p^2})$. More details are in the Curve Points Encoding section. ***Output:*** @@ -1305,6 +1311,7 @@ A and B are constants calculated empirically. - The input length is not divided by 96 - Too much memory is used +- Number of points more than 1000 ***Annotation:***