Skip to content

Commit

Permalink
fix host functions specidifcations
Browse files Browse the repository at this point in the history
  • Loading branch information
olga24912 committed Dec 6, 2023
1 parent c70a134 commit f6402c4
Showing 1 changed file with 22 additions and 20 deletions.
42 changes: 22 additions & 20 deletions neps/nep-0488.md
Original file line number Diff line number Diff line change
Expand Up @@ -503,7 +503,7 @@ The function calculates the sum of signed elements on the BLS12-381 curve. It ac

The operations, including the $E(F_p)$ curve, points on the curve, multiplication by -1, and the addition operation, are detailed in the BLS12-381 Curve Specification section.

Note: The function accepts points from the entire curve, not restricted to $G_1$.
Note: This function accepts points from the entire curve and is not restricted to points in $G_1$.

***Input:***

Expand All @@ -523,7 +523,7 @@ The ERROR_CODE is returned.

<ins>Tests for the sum of two points</ins>

This section aims to verify the correctness of summing two valid elements on the curve:
This section aims to verify the correctness of summing up two valid elements on the curve:

- Utilize points on the curve with known addition results for comparison, such as tests from EIP-2537[^47],[^48].
- Generate random points on the curve and verify the commutative property: P + Q = Q + P.
Expand Down Expand Up @@ -564,16 +564,16 @@ This section aims to validate the handling of incorrect input data:
- Erroneous coding of field elements resulting in a correct element on the curve modulo p.
- Erroneous coding of field elements with an incorrect extra bit in the decompressed encoding.
- Point not on the curve.
- Incorrect encoding of the point on infinity.
- Incorrect encoding of the point at infinity.
- Input is beyond memory bounds.

<ins>Tests for the sum of an arbitrary amount of points</ins>

This section focuses on validating the summation functionality with an arbitrary number of points:

- Generate random points on the curve and verify that the sum of the random permutation matches.
- Generate random points on the curve and verify that the sum of a random permutation matches.
- Generate random points on the curve and utilize another library to validate results.
- Create points and cross-check the outcome with the multiexp function.
- Create points and cross-check the outcome with the `multiexp` function.
- Generate random points from $G_1$ and confirm that the sum is also from $G_1$.

Edge cases:
Expand All @@ -599,7 +599,7 @@ The function computes the sum of the signed elements on the BLS12-381 curve. It

The $E'(F_{p^2})$ curve, the points on the curve, the multiplication by -1, and the addition operation are all defined in the BLS12-381 Curve Specification section.

Note: The function accepts any points on the curve, not limited to $G_2$.
Note: The function accepts any points on the curve and is not limited to points in $G_2$.

***Input:***

Expand All @@ -613,7 +613,7 @@ More details are available in the Curve Points Encoding section.
The ERROR_CODE is returned.

- ERROR_CODE = 0: the input is correct
- <ins>Output:</ins> 192 bytes represent one point $\in E'(F_{p^2})$ in its decompressed form. In case of an empty input, it outputs a point on infinity (refer to the Curve Points Encoding section for more details).
- <ins>Output:</ins> 192 bytes represent one point $\in E'(F_{p^2})$ in its decompressed form. In case of an empty input, it outputs the point at infinity (refer to the Curve Points Encoding section for more details).
- ERROR_CODE = 1:
- Points or signs are incorrectly encoded (refer to Curve points encoded section).
- Point is not on the curve.
Expand Down Expand Up @@ -658,7 +658,7 @@ Please note:
The ERROR_CODE is returned.

- ERROR_CODE = 0: the input is correct
- <ins>Output:</ins> 96 bytes represent one point $\in E(F_p)$ in its decompressed form. In case of an empty input, it outputs a point on infinity (refer to the Curve Points Encoding section for more details).
- <ins>Output:</ins> 96 bytes represent one point $\in E(F_p)$ in its decompressed form. In case of an empty input, it outputs the point at infinity (refer to the Curve Points Encoding section for more details).
- ERROR_CODE = 1:
- Points are incorrectly encoded (refer to Curve points encoded section).
- Point is not on the curve.
Expand Down Expand Up @@ -741,14 +741,14 @@ Please note:

***Input:*** the sequence of pairs $(p_i, s_i)$, where $p_i \in E'(F_{p^2})$ is a point on the curve and $s_i \in \mathbb{N}_0$ is a scalar.

Expected `224*k` bytes as an input that is interpreted as byte concatenation of `k` slices, each slice is the concatenation of uncompressed point from $E'(F_{p^2})$ — `192` bytes and scalar — `32` bytes. More details are in the Curve Points Encoding section.
The expected input size is `224*k` bytes, interpreted as the byte concatenation of `k` slices. Each slice is the concatenation of an uncompressed point from $E'(F_{p^2})$ — `192` bytes and a scalar — `32` bytes. More details are in the Curve Points Encoding section.

***Output:***

The ERROR_CODE is returned.

- ERROR_CODE = 0: the input is correct
- <ins>Output:</ins> 192 bytes represent one point $\in E'(F_{p^2})$ in its decompressed form. In case of an empty input, it outputs a point on infinity (refer to the Curve Points Encoding section for more details).
- <ins>Output:</ins> 192 bytes represent one point $\in E'(F_{p^2})$ in its decompressed form. In case of an empty input, it outputs the point at infinity (refer to the Curve Points Encoding section for more details).
- ERROR_CODE = 1:
- Points are incorrectly encoded (refer to Curve points encoded section).
- Point is not on the curve.
Expand All @@ -772,10 +772,10 @@ pub fn bls12381_g2_multiexp(

***Description:***

The function takes the list of field elements $a_i \in F_p$ and maps them to $G_1 \subset E(F_p)$.
This function takes as input a list of field elements $a_i \in F_p$ and maps them to $G_1 \subset E(F_p)$.
You can find the specification of this mapping function in the section titled 'Map to curve specification.'
Importantly, this function does NOT perform the mapping of the byte string into $F_p$.
The implementation of this function may vary and can be effectively executed within the contract.
Importantly, this function does NOT perform the mapping of the byte string into $F_p$.
The implementation of the mapping to $F_p$ may vary and can be effectively executed within the contract.

***Input:***

Expand Down Expand Up @@ -832,7 +832,9 @@ pub fn bls12381_map_fp_to_g1(

***Description:***

The function takes the list of elements $a_i \in F_{p^2}$ and maps them to $G_2 \subset E'(F_{p^2})$. You can find the mapping function's specifications in the "Map to Curve Specification" section. It's important to note that this function does NOT map the byte string into $F_{p^2}$. The implementation of this function may vary and can be effectively executed within the contract.
This function takes as input a list of elements $a_i \in F_{p^2}$ and maps them to $G_2 \subset E'(F_{p^2})$.
You can find the mapping function specification in the "Map to Curve Specification" section. It's important to note that this function does NOT map byte strings into $F_{p^2}$.
The implementation of the mapping to $F_{p^2}$ may vary and can be effectively executed within the contract.

***Input:*** the function takes as input `96*k` bytes — the elements from $F_{p^2}$ (two unsigned integers $< p$). Additional details can be found in the Curve Points Encoding section.

Expand All @@ -851,7 +853,7 @@ The ERROR_CODE is returned.
- Validate the results for known answers from EIP-2537[^47],[^48]
- Generate a random point $a$ from $F_{p^2}$:
- Verify the result with another library.
- Check that result point on curve in $G_2$.
- Check that the resulting point lies in $G_2$.
- Compare results for $a$ and $-a$; they should have the same x-coordinates and opposite y-coordinates.

Edge cases:
Expand Down Expand Up @@ -900,13 +902,13 @@ $e([a]P, [b]Q) = e(P, Q)^{ab} = e([b]P, [a]Q)$

This function is necessary to verify BLS signatures/zkSNARKs.

This function takes as input the sequence of pairs $(p_i, q_i)$, where $p_i \in G_1 \subset E(F_{p})$ and $q_i \in G_2 \subset E'(F_{p^2})$ and validate:
This function takes as input the sequence of pairs $(p_i, q_i)$, where $p_i \in G_1 \subset E(F_{p})$ and $q_i \in G_2 \subset E'(F_{p^2})$ and validates:

$$
\prod e(p_i, q_i) = 1
$$

We don’t calculate the pairing function itself: the result will be in the huge field, and in all known applications only this validation check is necessary.
We don’t need to calculate the pairing function itself as the result would lie on a huge field, and in all known applications only this validation check is necessary.

***Input:*** A sequence of pairs $(p_i, q_i)$, where $p_i \in G_1 \subset E(F_{p})$ and $q_i \in G_2 \subset E'(F_{p^2})$. Each point is encoded in decompressed form. An expected input size of 288*k bytes is anticipated, interpreted as byte concatenation of k slices. Each slice comprises the concatenation of an uncompressed point from $G_1 \subset E(F_p)$ (occupying 96 bytes) and a point from $G_2 \subset E'(F_{p^2})$ (occupying 192 bytes). Additional details can be found in the Curve Points Encoding section.

Expand Down Expand Up @@ -962,7 +964,7 @@ For an empty input, the function returns ERROR_CODE = 0.
- The first point is not on the curve.
- The second point is not on the curve.
- Input length exceeds the memory limit.
- Incorrect encoding of the infinity point.
- Incorrect encoding of the point at infinity.
- Incorrect encoding of a curve point:
- Incorrect decompression bit.
- Coordinates greater than or equal to 'p'.
Expand Down Expand Up @@ -1016,7 +1018,7 @@ The ERROR_CODE is returned.
- The input is beyond memory bounds.
- Point is not on the curve.
- Incorrect decompression bit.
- Incorrectly encoded infinity point.
- Incorrectly encoded point at infinity.
- Point with a coordinate larger than 'p'.

***Annotation:***
Expand Down Expand Up @@ -1059,7 +1061,7 @@ pub fn bls12381_decompress_g2(&mut self,

#### General comments for all functions

In all functions, input is fetched from memory, beginning at `value_ptr` and extending to `value_ptr + value_len`.
In all functions, the input is fetched from memory, beginning at `value_ptr` and extending to `value_ptr + value_len`.
If `value_len` is `u64::MAX`, input will come from the register.

Execution ends only if there's an incorrect input length,
Expand Down

0 comments on commit f6402c4

Please sign in to comment.