cycle_group represents a group Element of the proving system's embedded curve, i.e. a curve with a cofactor 1 defined over a field equal to the circuit's native field Builder::FF More...

#include <cycle_group.hpp>

Classes
struct	batch_mul_internal_output
	Stores temporary variables produced by internal multiplication algorithms. More...

Public Types
using	field_t = stdlib::field_t< Builder >

using	BaseField = field_t

using	bool_t = stdlib::bool_t< Builder >

using	witness_t = stdlib::witness_t< Builder >

using	Curve = bb::curve::Grumpkin

using	Group = bb::grumpkin::g1

using	Element = bb::grumpkin::g1::element

using	AffineElement = bb::grumpkin::g1::affine_element

using	GeneratorContext = crypto::GeneratorContext< Curve >

using	BigScalarField = stdlib::bigfield< Builder, bb::fq::Params >

using	cycle_scalar = ::bb::stdlib::cycle_scalar< Builder >

using	straus_lookup_table = ::bb::stdlib::straus_lookup_table< Builder >

using	straus_plookup_table = ::bb::stdlib::straus_plookup_table< Builder >

using	straus_scalar_slices = ::bb::stdlib::straus_scalar_slices< Builder >

Public Member Functions
	cycle_group (Builder *_context=nullptr)
	Construct a new constant point at infinity cycle group object.

	cycle_group (const field_t &x, const field_t &y, bool assert_on_curve=true)
	Construct a point from the coordinates. Auto-detects infinity flag if x = y = 0.

	cycle_group (const AffineElement &_in)
	Construct a cycle_group object out of an AffineElement object.

Builder *	get_context (const cycle_group &other) const

Builder *	get_context () const

AffineElement	get_value () const

const field_t &	x () const

const field_t &	y () const

bool	is_constant () const

bool_t	is_point_at_infinity () const

bool	is_constant_point_at_infinity () const

void	standardize ()
	Convert the point to standard form.

void	validate_on_curve () const
	On-curve check.

cycle_group	dbl (const std::optional< AffineElement > hint=std::nullopt) const
	Evaluates a point doubling using Ultra ECC double gate (if non-constant)

cycle_group	unconditional_add (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point addition over `*this` and `other`.

cycle_group	unconditional_subtract (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point subtraction over `*this` and `other`.

cycle_group	checked_unconditional_add (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point addition over `*this` and `other`, with x-coordinate collision checks.

cycle_group	checked_unconditional_subtract (const cycle_group &other, const std::optional< AffineElement > hint=std::nullopt) const
	Evaluate incomplete ECC point subtraction over `*this` and `other`, with x-coordinate collision checks.

cycle_group	operator+ (const cycle_group &other) const
	Evaluate ECC point addition over `*this` and `other`.

cycle_group	operator- (const cycle_group &other) const
	Evaluate ECC point subtraction over `*this` and `other`.

cycle_group	operator- () const
	Negates a point.

cycle_group &	operator+= (const cycle_group &other)

cycle_group &	operator-= (const cycle_group &other)

cycle_group	operator* (const cycle_scalar &scalar) const

cycle_group &	operator*= (const cycle_scalar &scalar)

cycle_group	operator* (const BigScalarField &scalar) const

cycle_group &	operator*= (const BigScalarField &scalar)

bool_t	operator== (cycle_group &other)

void	assert_equal (cycle_group &other, std::string const &msg="cycle_group::assert_equal")

void	set_origin_tag (OriginTag tag) const
	Set the origin tag for x, y and _is_infinity members of cycle_group.

OriginTag	get_origin_tag () const
	Get the origin tag of cycle_group (a merege of origin tags of x, y and _is_infinity members)

void	set_free_witness_tag ()
	Set the free witness flag for the cycle_group's tags.

void	unset_free_witness_tag ()
	Unset the free witness flag for the cycle_group's tags.

void	fix_witness ()

uint32_t	set_public ()
	Set the witness indices representing the cycle_group to public.

Static Public Member Functions
static cycle_group	one (Builder *_context)
	Construct a constant cycle_group representation of Group::one.

static cycle_group	constant_infinity (Builder *_context=nullptr)
	Construct a constant point at infinity.

static cycle_group	from_witness (Builder *_context, const AffineElement &_in)
	Converts an AffineElement into a circuit witness.

static cycle_group	from_constant_witness (Builder *_context, const AffineElement &_in)
	Converts a native AffineElement into a witness, but constrains the witness values to be known constants.

static cycle_group	batch_mul (const std::vector< cycle_group > &base_points, const std::vector< BigScalarField > &scalars, GeneratorContext context={})

static cycle_group	batch_mul (const std::vector< cycle_group > &base_points, const std::vector< cycle_scalar > &scalars, const GeneratorContext &context={})
	Multiscalar multiplication algorithm.

static cycle_group	fixed_batch_mul (const std::vector< cycle_group > &constant_points, const std::vector< BigScalarField > &scalars, GeneratorContext context={}, size_t table_bits=ROM_TABLE_BITS)

static cycle_group	fixed_batch_mul (const std::vector< cycle_group > &constant_points, const std::vector< cycle_scalar > &scalars, const GeneratorContext &context={}, size_t table_bits=ROM_TABLE_BITS)
	Fixed-base multiscalar multiplication using plookup tables.

static cycle_group	conditional_assign (const bool_t &predicate, const cycle_group &lhs, const cycle_group &rhs)

Static Public Attributes
static constexpr size_t	ROM_TABLE_BITS = 4

static constexpr size_t	NUM_BITS_FULL_FIELD_SIZE = bb::fq::modulus.get_msb() + 1

static constexpr std::string_view	OFFSET_GENERATOR_DOMAIN_SEPARATOR = "cycle_group_offset_generator"

static constexpr size_t	PUBLIC_INPUTS_SIZE = 2

Private Member Functions
	cycle_group (const field_t &x, const field_t &y, bool_t is_infinity, bool assert_on_curve)
	Private constructor with explicit infinity flag control.

cycle_group	_unconditional_add_or_subtract (const cycle_group &other, bool is_addition, const std::optional< AffineElement > hint) const
	Will evaluate ECC point addition or subtraction over `*this` and `other`.

Static Private Member Functions
static batch_mul_internal_output	_variable_base_batch_mul_internal (std::span< cycle_scalar > scalars, std::span< cycle_group > base_points, std::span< AffineElement const > offset_generators, bool unconditional_add)
	Internal logic to perform a variable-base batch mul using the Straus MSM algorithm.

static batch_mul_internal_output	_fixed_base_batch_mul_internal (std::span< cycle_scalar > scalars, std::span< AffineElement > base_points)
	Internal algorithm to perform a fixed-base batch mul.

static batch_mul_internal_output	_fixed_base_plookup_batch_mul_internal (std::span< cycle_scalar > scalars, std::span< AffineElement const > base_points, std::span< AffineElement const > offset_generators, size_t table_bits=ROM_TABLE_BITS)
	Internal algorithm to perform a fixed-base batch mul using plookup tables.

Private Attributes
field_t	_x

field_t	_y

bool_t	_is_infinity

Builder *	context

Friends
class	::bb::stdlib::straus_lookup_table< Builder >

class	::bb::stdlib::straus_plookup_table< Builder >

Detailed Description

template<typename Builder>
class bb::stdlib::cycle_group< Builder >

cycle_group represents a group Element of the proving system's embedded curve, i.e. a curve with a cofactor 1 defined over a field equal to the circuit's native field Builder::FF

In barretenberg, cycle group is used to represent the Grumpkin curve defined over the bn254 scalar field. The point at infinity is tracked via an is_infinity flag. At observation boundaries (serialize_to_fields, set_public, operator==, assert_equal), coordinates are canonicalized to (0, 0) when is_infinity is true. Intermediate arithmetic results may have non-canonical coordinates when is_infinity is true.

Note: For the honest prover, we restrict the construction of cycle group elements in the following ways: (1) x and y coordinates of a point must have matching constancy, i.e. both are constants or both are witnesses, enforced via a runtime assert. (2) We disallow construction of points not on the curve via runtime asserts (always) and via circuit constraints in select situations, e.g. EC operations from noir in DSL.

Template Parameters

Builder

Definition at line 40 of file cycle_group.hpp.

Member Typedef Documentation

◆ AffineElement

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::AffineElement = bb::grumpkin::g1::affine_element

Definition at line 50 of file cycle_group.hpp.

◆ BaseField

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::BaseField = field_t

Definition at line 43 of file cycle_group.hpp.

◆ BigScalarField

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::BigScalarField = stdlib::bigfield<Builder, bb::fq::Params>

Definition at line 53 of file cycle_group.hpp.

◆ bool_t

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::bool_t = stdlib::bool_t<Builder>

Definition at line 44 of file cycle_group.hpp.

◆ Curve

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::Curve = bb::curve::Grumpkin

Definition at line 47 of file cycle_group.hpp.

◆ cycle_scalar

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::cycle_scalar = ::bb::stdlib::cycle_scalar<Builder>

Definition at line 54 of file cycle_group.hpp.

◆ Element

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::Element = bb::grumpkin::g1::element

Definition at line 49 of file cycle_group.hpp.

◆ field_t

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::field_t = stdlib::field_t<Builder>

Definition at line 42 of file cycle_group.hpp.

◆ GeneratorContext

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::GeneratorContext = crypto::GeneratorContext<Curve>

Definition at line 51 of file cycle_group.hpp.

◆ Group

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::Group = bb::grumpkin::g1

Definition at line 48 of file cycle_group.hpp.

◆ straus_lookup_table

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::straus_lookup_table = ::bb::stdlib::straus_lookup_table<Builder>

Definition at line 55 of file cycle_group.hpp.

◆ straus_plookup_table

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::straus_plookup_table = ::bb::stdlib::straus_plookup_table<Builder>

Definition at line 56 of file cycle_group.hpp.

◆ straus_scalar_slices

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::straus_scalar_slices = ::bb::stdlib::straus_scalar_slices<Builder>

Definition at line 57 of file cycle_group.hpp.

◆ witness_t

template<typename Builder >

using bb::stdlib::cycle_group< Builder >::witness_t = stdlib::witness_t<Builder>

Definition at line 45 of file cycle_group.hpp.

Constructor & Destructor Documentation

◆ cycle_group() [1/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group ( Builder * _context = nullptr )

Construct a new constant point at infinity cycle group object.

Note: Don't use this constructor in case you want to assign the coordinates later.

Definition at line 28 of file cycle_group.cpp.

◆ cycle_group() [2/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group	(	const field_t &	x,
		const field_t &	y,
		bool	assert_on_curve = `true`
	)

explicit

Construct a point from the coordinates. Auto-detects infinity flag if x = y = 0.

Parameters

x	The x coordinate
y	The y coordinate
assert_on_curve	If true, validate that (x, y) satisfies the curve equation

Definition at line 41 of file cycle_group.cpp.

◆ cycle_group() [3/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group ( const AffineElement & _in )

Construct a cycle_group object out of an AffineElement object.

Uses convention that the coordinates of the point at infinity are (0,0).

Note: This produces a circuit-constant object i.e. known at compile-time, no constraints. If _in is not fixed for a given circuit, use from_witness instead.

Template Parameters

Builder

Parameters

_in

Definition at line 134 of file cycle_group.cpp.

◆ cycle_group() [4/4]

template<typename Builder >

bb::stdlib::cycle_group< Builder >::cycle_group	(	const field_t &	x,
		const field_t &	y,
		bool_t	is_infinity,
		bool	assert_on_curve
	)

private

Private constructor with explicit infinity flag control.

Warning: This constructor is private because it gives too much control - external users should use the public constructors which auto-detect infinity from (x == 0 && y == 0). Internal operations use this for efficiency when the infinity flag is computed separately.

Parameters

_x
_y
is_infinity

Definition at line 86 of file cycle_group.cpp.

Member Function Documentation

◆ _fixed_base_batch_mul_internal()

template<typename Builder >

cycle_group< Builder >::batch_mul_internal_output bb::stdlib::cycle_group< Builder >::_fixed_base_batch_mul_internal	(	std::span< cycle_scalar >	scalars,
		std::span< AffineElement >	base_points
	)

staticprivate

Internal algorithm to perform a fixed-base batch mul.

Computes a batch mul of fixed base points using the Straus multiscalar multiplication algorithm with lookup tables. Each scalar (cycle_scalar) is decomposed into two limbs, lo and hi, with 128 and 126 bits respectively. For each limb we use one of four precomputed plookup multi-tables FIXED_BASE_<LEFT/RIGHT>_<LO/HI> corresponding to the lo/hi limbs of the two generator points supported by this algorithm (defined in bb::plookup::fixed_base::table).

The LO multi-tables consist of fifteen basic tables (14 × 9-bit + 1 × 2-bit = 128 bits) and the HI multi-tables consist of fourteen 9-bit basic tables (14 × 9 = 126 bits). Each basic table stores at index i the precomputed points: \([offset\_generator_i] + k \cdot 2^{table\_bits \cdot i} \cdot [base\_point]\) for \(k = 0, 1, ..., 2^{table\_bits} - 1\). The offset generators prevent point-at-infinity edge cases. The algorithm sums all looked-up points to compute \(scalar \cdot [base\_point] + [sum\_of\_offset\_generators]\). We return both the accumulator and the sum of offset generators, so that it can be subtracted off later.

This approach avoids all point doublings and reduces one scalar mul to ~29 lookups + ~29 ecc addition gates.

Template Parameters

Builder

Parameters

scalars
base_points

return cycle_group<Builder>::batch_mul_internal_output

Definition at line 897 of file cycle_group.cpp.

◆ _fixed_base_plookup_batch_mul_internal()

template<typename Builder >

cycle_group< Builder >::batch_mul_internal_output bb::stdlib::cycle_group< Builder >::_fixed_base_plookup_batch_mul_internal	(	std::span< cycle_scalar >	scalars,
		std::span< AffineElement const >	base_points,
		std::span< AffineElement const >	offset_generators,
		size_t	table_bits = `ROM_TABLE_BITS`
	)

staticprivate

Internal algorithm to perform a fixed-base batch mul using plookup tables.

Computes a batch mul of constant base points using the Straus multiscalar multiplication algorithm. For each constant base point, a plookup table (BasicTable) is created with (1 << ROM_TABLE_BITS) entries. Unlike ROM tables, plookup tables have zero construction cost and zero finalization overhead. Each table read costs exactly 1 lookup gate.

Parameters

scalars	Witness scalars to multiply with base points
base_points	Constant affine points (SRS elements or similar)
offset_generators	Offset points to prevent infinity edge cases (size = base_points.size() + 1)

Returns: {accumulator, offset_generator_delta} where result = accumulator - offset_generator_delta

Definition at line 989 of file cycle_group.cpp.

◆ _unconditional_add_or_subtract()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::_unconditional_add_or_subtract	(	const cycle_group< Builder > &	other,
		bool	is_addition,
		const std::optional< AffineElement >	hint
	)		const

private

Will evaluate ECC point addition or subtraction over *this and other.

Warning: Incomplete addition formula edge cases are NOT checked! Only use this method if you know the x-coordinates of the operands cannot collide and none of the operands is a point at infinity. Uses Ultra-arithmetic elliptic curve addition gate.

Template Parameters

Builder

Parameters

other	Point to add/subtract
is_addition	: true for addition, false for subtraction
hint	: value of output point witness, if known ahead of time (used to avoid modular inversions during witgen)

Returns: cycle_group<Builder> Result of addition/subtraction

Definition at line 369 of file cycle_group.cpp.

◆ _variable_base_batch_mul_internal()

template<typename Builder >

cycle_group< Builder >::batch_mul_internal_output bb::stdlib::cycle_group< Builder >::_variable_base_batch_mul_internal	(	std::span< cycle_scalar >	scalars,
		std::span< cycle_group< Builder > >	base_points,
		std::span< AffineElement const >	offset_generators,
		bool	unconditional_add
	)

staticprivate

Internal logic to perform a variable-base batch mul using the Straus MSM algorithm.

Computes \(\sum_i scalars[i] \cdot base\_points[i]\) using the windowed Straus algorithm with 4-bit windows. The algorithm operates in three phases:

Native computation: Compute all EC operations natively to generate witness hints using batched operations. (This avoids the need to perform expensive modular inversions per operation during witness generation)
Table construction: Build in-circuit ROM lookup tables for each base point
Circuit execution: Perform the Straus algorithm in-circuit using the ROM tables and precomputed hints

Note: Offset generators are added to prevent point-at-infinity edge cases. The returned result is: \(\sum_i scalars[i] \cdot base\_points[i] + offset\_accumulator\) where offset_accumulator is also returned separately for later subtraction.

Parameters

scalars	Vector of scalar multipliers (must all have the same bit length)
base_points	Vector of EC points to multiply (can be constants or witnesses)
offset_generators	Precomputed offset points to prevent infinity edge cases (size = base_points.size() + 1)
unconditional_add	If true, skip x-coordinate collision checks (safe only when points are guaranteed distinct)

Returns: {accumulator, offset_accumulator} where batch mul result = accumulator - offset_accumulator

Definition at line 732 of file cycle_group.cpp.

◆ assert_equal()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::assert_equal	(	cycle_group< Builder > &	other,
		std::string const &	msg = `"cycle_group< Builder >::assert_equal"`
	)

Definition at line 1395 of file cycle_group.cpp.

◆ batch_mul() [1/2]

template<typename Builder >

static cycle_group bb::stdlib::cycle_group< Builder >::batch_mul	(	const std::vector< cycle_group< Builder > > &	base_points,
		const std::vector< BigScalarField > &	scalars,
		GeneratorContext	context = `{}`
	)

inlinestatic

Definition at line 120 of file cycle_group.hpp.

◆ batch_mul() [2/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::batch_mul	(	const std::vector< cycle_group< Builder > > &	base_points,
		const std::vector< cycle_scalar > &	scalars,
		const GeneratorContext &	context = `{}`
	)

static

Multiscalar multiplication algorithm.

Uses the Straus MSM algorithm. batch_mul splits inputs into three categories: Case 1. Point and scalar are both constant: scalar mul can be computed without constraints. Case 2A. Point is constant and one of two specific generators, scalar is a witness: use fixed-base Straus with plookup tables Case 2B. Point is constant but not one of two specific generators, scalar is a witness: use variable-base Straus using ROM tables. Case 3. Point is a witness, scalar is witness or constant: use variable-base Straus using ROM tables.

The results from all 3 categories are combined and returned as a single output point.

Note

Both the fixed and variable-base algorithms utilize an offset mechanism to avoid point at infinity edge cases. The total offset is tracked and subtracted from the final result to yield the correct output.

batch_mul can handle all known cases of trigger incomplete addition formula exceptions and other weirdness:

some/all of the input points are points at infinity
some/all of the input scalars are 0
some/all input points are equal to each other
output is the point at infinity
input vectors are empty

offset_generator_data is a pointer to precomputed offset generator list. There is a default parameter point that points to a list with DEFAULT_NUM_GENERATORS generator points (8). If more offset generators are required, they will be derived in-place which can be expensive. (num required offset generators is either num input points + 1 or num input points + 2, depends on if one or both of _fixed_base_batch_mul_internal, _variable_base_batch_mul_internal are called). If you're calling this function repeatedly and you KNOW you need >8 offset generators, it's faster to create a generator_data object with the required size and pass it in as a parameter.

Template Parameters

Builder

Parameters

scalars
base_points
offset_generator_data

Returns: cycle_group<Builder> (may be non-canonical if infinity; canonicalized at boundaries)

Definition at line 1226 of file cycle_group.cpp.

◆ checked_unconditional_add()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::checked_unconditional_add	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point addition over *this and other, with x-coordinate collision checks.

Uses incomplete addition formula. If incomplete addition formula edge cases are triggered (x-coordinates of operands collide), the constraints produced by this method will be unsatisfiable. Useful when an honest prover will not produce a point collision with overwhelming probability, but a cheating prover will be able to.

Template Parameters

Builder

Parameters

other	Point to add
hint	: value of output point witness, if known ahead of time (used to avoid modular inversions during witgen)

Returns: cycle_group<Builder>

Definition at line 479 of file cycle_group.cpp.

◆ checked_unconditional_subtract()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::checked_unconditional_subtract	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point subtraction over *this and other, with x-coordinate collision checks.

Uses incomplete subtraction formula. If incomplete subtraction formula edge cases are triggered (x-coordinates of operands collide), the constraints produced by this method will be unsatisfiable. Useful when an honest prover will not produce a point collision with overwhelming probability, but a cheating prover will be able to.

Template Parameters

Builder

Parameters

other	Point to subtract
hint	: value of output point witness, if known ahead of time (used to avoid modular inversions during witgen)

Returns: cycle_group<Builder>

Definition at line 504 of file cycle_group.cpp.

◆ conditional_assign()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::conditional_assign	(	const bool_t &	predicate,
		const cycle_group< Builder > &	lhs,
		const cycle_group< Builder > &	rhs
	)

static

Definition at line 1405 of file cycle_group.cpp.

◆ constant_infinity()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::constant_infinity ( Builder * _context = nullptr )

static

Construct a constant point at infinity.

Definition at line 160 of file cycle_group.cpp.

◆ dbl()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::dbl ( const std::optional< AffineElement > hint = std::nullopt ) const

Evaluates a point doubling using Ultra ECC double gate (if non-constant)

Note: Result coordinates are not standardized meaning the point at infinity may have coordinates that are not (0,0). Standardization is deferred to observation boundaries (e.g., serialize_to_fields, set_public, operator==, assert_equal) to allow for more efficient chaining of operations that may produce intermediate non-canonical infinity representations.

Template Parameters

Builder

Parameters

hint	native result of the doubling (optional; used to avoid modular inversions during witgen)

Returns: cycle_group<Builder> The doubled point (may be non-canonical if infinity; canonicalized at boundaries)

Definition at line 298 of file cycle_group.cpp.

◆ fix_witness()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::fix_witness ( )

inline

Fix a witness. The value of the witness is constrained with a selector

Definition at line 202 of file cycle_group.hpp.

◆ fixed_batch_mul() [1/2]

template<typename Builder >

static cycle_group bb::stdlib::cycle_group< Builder >::fixed_batch_mul	(	const std::vector< cycle_group< Builder > > &	constant_points,
		const std::vector< BigScalarField > &	scalars,
		GeneratorContext	context = `{}`,
		size_t	table_bits = `ROM_TABLE_BITS`
	)

inlinestatic

Definition at line 134 of file cycle_group.hpp.

◆ fixed_batch_mul() [2/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::fixed_batch_mul	(	const std::vector< cycle_group< Builder > > &	constant_points,
		const std::vector< cycle_scalar > &	scalars,
		const GeneratorContext &	context = `{}`,
		size_t	table_bits = `ROM_TABLE_BITS`
	)

static

Fixed-base multiscalar multiplication using plookup tables.

Optimized MSM for the case where all base points are circuit constants (e.g. SRS elements). Uses plookup tables instead of ROM tables, eliminating table construction gates and finalization overhead. All base points MUST be constants; witness base points will trigger an assertion failure.

Parameters

constant_points	Vector of constant cycle_group points
scalars	Vector of cycle_scalar values (may be witnesses or constants)
context	Generator context for offset generators

Returns: cycle_group The result of sum(scalars[i] * constant_points[i])

Definition at line 1110 of file cycle_group.cpp.

◆ from_constant_witness()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::from_constant_witness	(	Builder *	_context,
		const AffineElement &	_in
	)

static

Converts a native AffineElement into a witness, but constrains the witness values to be known constants.

Note: This is useful when performing group operations where one operand is a witness and one is a constant. In such cases it can be more efficient to convert the constant into a "fixed" witness because we have custom gates that evaluate additions in one constraint, but only if both operands are witnesses.

Template Parameters

Builder

Parameters

_context
_in

Returns: cycle_group<Builder>

Definition at line 215 of file cycle_group.cpp.

◆ from_witness()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::from_witness	(	Builder *	_context,
		const AffineElement &	_in
	)

static

Converts an AffineElement into a circuit witness.

Creates witness field elements for (x, y) and uses a constructor that auto-detects infinity from coordinates (x == 0 && y == 0) and validates the point is on the curve.

Template Parameters

Builder

Parameters

_context
_in

Returns: cycle_group<Builder>

Definition at line 189 of file cycle_group.cpp.

◆ get_context() [1/2]

template<typename Builder >

Builder * bb::stdlib::cycle_group< Builder >::get_context ( ) const

inline

Definition at line 88 of file cycle_group.hpp.

◆ get_context() [2/2]

template<typename Builder >

Builder * bb::stdlib::cycle_group< Builder >::get_context ( const cycle_group< Builder > & other ) const

Definition at line 233 of file cycle_group.cpp.

◆ get_origin_tag()

template<typename Builder >

OriginTag bb::stdlib::cycle_group< Builder >::get_origin_tag ( ) const

inline

Get the origin tag of cycle_group (a merege of origin tags of x, y and _is_infinity members)

Returns: OriginTag

Definition at line 174 of file cycle_group.hpp.

◆ get_value()

template<typename Builder >

cycle_group< Builder >::AffineElement bb::stdlib::cycle_group< Builder >::get_value ( ) const

Definition at line 241 of file cycle_group.cpp.

◆ is_constant()

template<typename Builder >

bool bb::stdlib::cycle_group< Builder >::is_constant ( ) const

inline

Definition at line 94 of file cycle_group.hpp.

◆ is_constant_point_at_infinity()

template<typename Builder >

bool bb::stdlib::cycle_group< Builder >::is_constant_point_at_infinity ( ) const

inline

Definition at line 99 of file cycle_group.hpp.

◆ is_point_at_infinity()

template<typename Builder >

bool_t bb::stdlib::cycle_group< Builder >::is_point_at_infinity ( ) const

inline

Definition at line 98 of file cycle_group.hpp.

◆ one()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::one ( Builder * _context )

static

Construct a constant cycle_group representation of Group::one.

Template Parameters

Builder

Parameters

_context

Returns: cycle_group<Builder>

Definition at line 148 of file cycle_group.cpp.

◆ operator*() [1/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator* ( const BigScalarField & scalar ) const

Definition at line 1376 of file cycle_group.cpp.

◆ operator*() [2/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator* ( const cycle_scalar & scalar ) const

Definition at line 1365 of file cycle_group.cpp.

◆ operator*=() [1/2]

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator*= ( const BigScalarField & scalar )

Definition at line 1381 of file cycle_group.cpp.

◆ operator*=() [2/2]

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator*= ( const cycle_scalar & scalar )

Definition at line 1370 of file cycle_group.cpp.

◆ operator+()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator+ ( const cycle_group< Builder > & other ) const

Evaluate ECC point addition over *this and other.

This method uses complete addition i.e. is compatible with all edge cases and is therefore expensive. To handle the possibility of x-coordinate collisions we evaluate both an addition (modified to avoid division by zero) and and a doubling, then conditionally assign the result.

Note: Result coordinates are not standardized meaning the point at infinity may have coordinates that are not (0,0). Standardization is deferred to observation boundaries (e.g., serialize_to_fields, set_public, operator==, assert_equal) to allow for more efficient chaining of operations that may produce intermediate non-canonical infinity representations.

Template Parameters

Builder

Parameters

other Point to add

Returns: cycle_group<Builder> Result of addition

Definition at line 531 of file cycle_group.cpp.

◆ operator+=()

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator+= ( const cycle_group< Builder > & other )

Definition at line 699 of file cycle_group.cpp.

◆ operator-() [1/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator- ( ) const

Negates a point.

Template Parameters

Builder

Parameters

other

Returns: cycle_group<Builder>

Definition at line 689 of file cycle_group.cpp.

◆ operator-() [2/2]

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::operator- ( const cycle_group< Builder > & other ) const

Evaluate ECC point subtraction over *this and other.

This method uses complete subtraction i.e. is compatible with all edge cases and is therefore expensive. To handle the possibility of x-coordinate collisions we evaluate both a subtraction (modified to avoid division by zero) and a doubling, then conditionally assign the result.

Note: Result coordinates are not standardized meaning the point at infinity may have coordinates that are not (0,0). Standardization is deferred to observation boundaries (e.g., serialize_to_fields, set_public, operator==, assert_equal) to allow for more efficient chaining of operations that may produce intermediate non-canonical infinity representations.

Template Parameters

Builder

Parameters

other Point to subtract

Returns: cycle_group<Builder> Result of subtraction

Definition at line 610 of file cycle_group.cpp.

◆ operator-=()

template<typename Builder >

cycle_group< Builder > & bb::stdlib::cycle_group< Builder >::operator-= ( const cycle_group< Builder > & other )

Definition at line 705 of file cycle_group.cpp.

◆ operator==()

template<typename Builder >

bool_t< Builder > bb::stdlib::cycle_group< Builder >::operator== ( cycle_group< Builder > & other )

Definition at line 1387 of file cycle_group.cpp.

◆ set_free_witness_tag()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::set_free_witness_tag ( )

inline

Set the free witness flag for the cycle_group's tags.

Definition at line 182 of file cycle_group.hpp.

◆ set_origin_tag()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::set_origin_tag ( OriginTag tag ) const

inline

Set the origin tag for x, y and _is_infinity members of cycle_group.

Parameters

tag

Definition at line 162 of file cycle_group.hpp.

◆ set_public()

template<typename Builder >

uint32_t bb::stdlib::cycle_group< Builder >::set_public ( )

inline

Set the witness indices representing the cycle_group to public.

Returns: uint32_t Index into the public inputs array at which the representation is stored

Definition at line 217 of file cycle_group.hpp.

◆ standardize()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::standardize ( )

Convert the point to standard form.

If the point is a point at infinity, ensure the coordinates are (0,0).

Definition at line 274 of file cycle_group.cpp.

◆ unconditional_add()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::unconditional_add	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point addition over *this and other.

Warning: Incomplete addition formula edge cases are NOT checked! Only use this method if you know the x-coordinates of the operands cannot collide and none of the operands is a point at infinity. Uses Ultra-arithmetic elliptic curve addition gate.

Definition at line 448 of file cycle_group.cpp.

◆ unconditional_subtract()

template<typename Builder >

cycle_group< Builder > bb::stdlib::cycle_group< Builder >::unconditional_subtract	(	const cycle_group< Builder > &	other,
		const std::optional< AffineElement >	hint = `std::nullopt`
	)		const

Evaluate incomplete ECC point subtraction over *this and other.

Warning: Incomplete subtraction formula edge cases are NOT checked! Only use this method if you know the x-coordinates of the operands cannot collide and none of the operands is a point at infinity. Uses Ultra-arithmetic elliptic curve subtraction gate.

Definition at line 461 of file cycle_group.cpp.

◆ unset_free_witness_tag()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::unset_free_witness_tag ( )

inline

Unset the free witness flag for the cycle_group's tags.

Definition at line 192 of file cycle_group.hpp.

◆ validate_on_curve()

template<typename Builder >

void bb::stdlib::cycle_group< Builder >::validate_on_curve ( ) const

On-curve check.

Validates that the point satisfies the curve equation \(y^2 = x^3 + b\) or is the point at infinity. This method does not constrain coordinates to be (0, 0) if the point is at infinity.

Template Parameters

Builder

Definition at line 257 of file cycle_group.cpp.

◆ x()

template<typename Builder >

const field_t & bb::stdlib::cycle_group< Builder >::x ( ) const

inline

Definition at line 92 of file cycle_group.hpp.

◆ y()

template<typename Builder >

const field_t & bb::stdlib::cycle_group< Builder >::y ( ) const

inline

Definition at line 93 of file cycle_group.hpp.

Friends And Related Symbol Documentation

◆ ::bb::stdlib::straus_lookup_table< Builder >

template<typename Builder >

friend class ::bb::stdlib::straus_lookup_table< Builder >

friend

Definition at line 217 of file cycle_group.hpp.

◆ ::bb::stdlib::straus_plookup_table< Builder >

template<typename Builder >

friend class ::bb::stdlib::straus_plookup_table< Builder >

friend

Definition at line 217 of file cycle_group.hpp.

Member Data Documentation

◆ _is_infinity

template<typename Builder >

bool_t bb::stdlib::cycle_group< Builder >::_is_infinity

private

Definition at line 236 of file cycle_group.hpp.

◆ _x

template<typename Builder >

field_t bb::stdlib::cycle_group< Builder >::_x

private

Definition at line 234 of file cycle_group.hpp.

◆ _y

template<typename Builder >

field_t bb::stdlib::cycle_group< Builder >::_y

private

Definition at line 235 of file cycle_group.hpp.

◆ context

template<typename Builder >

Builder* bb::stdlib::cycle_group< Builder >::context

private

Definition at line 237 of file cycle_group.hpp.

◆ NUM_BITS_FULL_FIELD_SIZE

template<typename Builder >

constexpr size_t bb::stdlib::cycle_group< Builder >::NUM_BITS_FULL_FIELD_SIZE = bb::fq::modulus.get_msb() + 1

staticconstexpr

Definition at line 61 of file cycle_group.hpp.

◆ OFFSET_GENERATOR_DOMAIN_SEPARATOR

template<typename Builder >

constexpr std::string_view bb::stdlib::cycle_group< Builder >::OFFSET_GENERATOR_DOMAIN_SEPARATOR = "cycle_group_offset_generator"

staticconstexpr

Definition at line 63 of file cycle_group.hpp.

◆ PUBLIC_INPUTS_SIZE

template<typename Builder >

constexpr size_t bb::stdlib::cycle_group< Builder >::PUBLIC_INPUTS_SIZE = 2

staticconstexpr

Definition at line 66 of file cycle_group.hpp.

◆ ROM_TABLE_BITS

template<typename Builder >

constexpr size_t bb::stdlib::cycle_group< Builder >::ROM_TABLE_BITS = 4

staticconstexpr

Definition at line 60 of file cycle_group.hpp.

The documentation for this class was generated from the following files:

src/barretenberg/stdlib/primitives/group/cycle_group.hpp
src/barretenberg/stdlib/primitives/group/cycle_group.cpp

Classes

Public Types

Public Member Functions

Static Public Member Functions

Static Public Attributes

Private Member Functions

Static Private Member Functions

Private Attributes

Friends

Detailed Description

Member Typedef Documentation

◆ AffineElement

◆ BaseField

◆ BigScalarField

◆ bool_t

◆ Curve

◆ cycle_scalar

◆ Element

◆ field_t

◆ GeneratorContext

◆ Group

◆ straus_lookup_table

◆ straus_plookup_table

◆ straus_scalar_slices

◆ witness_t

Constructor & Destructor Documentation

◆ cycle_group() [1/4]

◆ cycle_group() [2/4]

◆ cycle_group() [3/4]

◆ cycle_group() [4/4]

Member Function Documentation

◆ _fixed_base_batch_mul_internal()

◆ _fixed_base_plookup_batch_mul_internal()

◆ _unconditional_add_or_subtract()

◆ _variable_base_batch_mul_internal()

◆ assert_equal()

◆ batch_mul() [1/2]

◆ batch_mul() [2/2]

◆ checked_unconditional_add()

◆ checked_unconditional_subtract()

◆ conditional_assign()

◆ constant_infinity()

◆ dbl()

◆ fix_witness()

◆ fixed_batch_mul() [1/2]

◆ fixed_batch_mul() [2/2]

◆ from_constant_witness()

◆ from_witness()

◆ get_context() [1/2]

◆ get_context() [2/2]

◆ get_origin_tag()

◆ get_value()

◆ is_constant()

◆ is_constant_point_at_infinity()

◆ is_point_at_infinity()

◆ one()

◆ operator*() [1/2]

◆ operator*() [2/2]

◆ operator*=() [1/2]

◆ operator*=() [2/2]

◆ operator+()

◆ operator+=()

◆ operator-() [1/2]

◆ operator-() [2/2]

◆ operator-=()

◆ operator==()

◆ set_free_witness_tag()

◆ set_origin_tag()

◆ set_public()

◆ standardize()

◆ unconditional_add()

◆ unconditional_subtract()

◆ unset_free_witness_tag()

◆ validate_on_curve()

◆ x()

◆ y()

Friends And Related Symbol Documentation

◆ ::bb::stdlib::straus_lookup_table< Builder >

◆ ::bb::stdlib::straus_plookup_table< Builder >

Member Data Documentation