diff --git a/bellman/src/gadgets/test/mod.rs b/bellman/src/gadgets/test/mod.rs index b082907..d09d87e 100644 --- a/bellman/src/gadgets/test/mod.rs +++ b/bellman/src/gadgets/test/mod.rs @@ -1,6 +1,6 @@ //! Helpers for testing circuit implementations. -use ff::{Field, PowVartime, PrimeField, ScalarEngine}; +use ff::{Endianness, Field, PowVartime, PrimeField, ScalarEngine}; use crate::{ConstraintSystem, Index, LinearCombination, SynthesisError, Variable}; @@ -106,11 +106,9 @@ fn hash_lc(terms: &[(Variable, E::Fr)], h: &mut Blake2sState) { } } - // BLS12-381's Fr is canonically serialized in little-endian, but the hasher - // writes its coefficients in big endian. For now, we flip the endianness - // manually, which is not necessarily correct for circuits using other curves. - // TODO: Fix this in a standalone commit, and document the no-op change. - let coeff_be: Vec<_> = coeff.into_repr().as_ref().iter().cloned().rev().collect(); + let mut coeff_repr = coeff.into_repr(); + ::ReprEndianness::toggle_little_endian(&mut coeff_repr); + let coeff_be: Vec<_> = coeff_repr.as_ref().iter().cloned().rev().collect(); buf[9..].copy_from_slice(&coeff_be[..]); h.update(&buf); diff --git a/bellman/src/groth16/tests/dummy_engine.rs b/bellman/src/groth16/tests/dummy_engine.rs index 712d44b..3cf426a 100644 --- a/bellman/src/groth16/tests/dummy_engine.rs +++ b/bellman/src/groth16/tests/dummy_engine.rs @@ -285,6 +285,7 @@ impl Default for FrRepr { impl PrimeField for Fr { type Repr = FrRepr; + type ReprEndianness = byteorder::LittleEndian; const NUM_BITS: u32 = 16; const CAPACITY: u32 = 15; diff --git a/bellman/src/multiexp.rs b/bellman/src/multiexp.rs index 18f48bd..f53ef95 100644 --- a/bellman/src/multiexp.rs +++ b/bellman/src/multiexp.rs @@ -1,6 +1,6 @@ use super::multicore::Worker; use bit_vec::{self, BitVec}; -use ff::{Field, PrimeField, ScalarEngine}; +use ff::{Endianness, Field, PrimeField, ScalarEngine}; use futures::Future; use group::{CurveAffine, CurveProjective}; use std::io; @@ -195,8 +195,18 @@ where bases.skip(1)?; } } else { - let exp = exp >> skip; - let exp = exp & ((1 << c) - 1); + let mut exp = exp.into_repr(); + <::Fr as PrimeField>::ReprEndianness::toggle_little_endian(&mut exp); + + let exp = exp + .as_ref() + .into_iter() + .map(|b| (0..8).map(move |i| (b >> i) & 1u8)) + .flatten() + .skip(skip as usize) + .take(c as usize) + .enumerate() + .fold(0u64, |acc, (i, b)| acc + ((b as u64) << i)); if exp != 0 { (&mut buckets[(exp - 1) as usize]) diff --git a/ff/Cargo.toml b/ff/Cargo.toml index 9dbf514..01cc6c6 100644 --- a/ff/Cargo.toml +++ b/ff/Cargo.toml @@ -11,7 +11,7 @@ repository = "https://github.com/ebfull/ff" edition = "2018" [dependencies] -byteorder = { version = "1", optional = true } +byteorder = { version = "1", default-features = false } ff_derive = { version = "0.6", path = "ff_derive", optional = true } rand_core = { version = "0.5", default-features = false } subtle = { version = "2.2.1", default-features = false, features = ["i128"] } @@ -19,7 +19,7 @@ subtle = { version = "2.2.1", default-features = false, features = ["i128"] } [features] default = ["std"] derive = ["ff_derive"] -std = ["byteorder"] +std = [] [badges] maintenance = { status = "actively-developed" } diff --git a/ff/ff_derive/src/lib.rs b/ff/ff_derive/src/lib.rs index 410732c..ad25c5b 100644 --- a/ff/ff_derive/src/lib.rs +++ b/ff/ff_derive/src/lib.rs @@ -31,6 +31,13 @@ impl FromStr for ReprEndianness { } impl ReprEndianness { + fn repr_endianness(&self) -> proc_macro2::TokenStream { + match self { + ReprEndianness::Big => quote! {::byteorder::BigEndian}, + ReprEndianness::Little => quote! {::byteorder::LittleEndian}, + } + } + fn from_repr(&self, name: &syn::Ident, limbs: usize) -> proc_macro2::TokenStream { let read_repr = match self { ReprEndianness::Big => quote! { @@ -885,6 +892,7 @@ fn prime_field_impl( let mont_reduce_self_params = mont_reduce_params(quote! {self}, limbs); let mont_reduce_other_params = mont_reduce_params(quote! {other}, limbs); + let repr_endianness = endianness.repr_endianness(); let from_repr_impl = endianness.from_repr(name, limbs); let into_repr_impl = endianness.into_repr(repr, &mont_reduce_self_params, limbs); @@ -1117,58 +1125,9 @@ fn prime_field_impl( } } - impl ::core::ops::BitAnd for #name { - type Output = u64; - - #[inline(always)] - fn bitand(mut self, rhs: u64) -> u64 { - self.mont_reduce( - #mont_reduce_self_params - ); - - self.0[0] & rhs - } - } - - impl ::core::ops::Shr for #name { - type Output = #name; - - #[inline(always)] - fn shr(mut self, mut n: u32) -> #name { - if n as usize >= 64 * #limbs { - return Self::from(0); - } - - // Convert from Montgomery to native representation. - self.mont_reduce( - #mont_reduce_self_params - ); - - while n >= 64 { - let mut t = 0; - for i in self.0.iter_mut().rev() { - ::core::mem::swap(&mut t, i); - } - n -= 64; - } - - if n > 0 { - let mut t = 0; - for i in self.0.iter_mut().rev() { - let t2 = *i << (64 - n); - *i >>= n; - *i |= t; - t = t2; - } - } - - // Convert back to Montgomery representation - self * R2 - } - } - impl ::ff::PrimeField for #name { type Repr = #repr; + type ReprEndianness = #repr_endianness; fn from_repr(r: #repr) -> Option<#name> { #from_repr_impl diff --git a/ff/src/lib.rs b/ff/src/lib.rs index 4296cff..92a6079 100644 --- a/ff/src/lib.rs +++ b/ff/src/lib.rs @@ -12,6 +12,7 @@ extern crate std; #[cfg(feature = "derive")] pub use ff_derive::*; +use byteorder::ByteOrder; use core::convert::TryFrom; use core::fmt; use core::marker::PhantomData; @@ -124,14 +125,36 @@ impl PowVartime for T { const LIMB_SIZE: u64 = 64; } +/// Helper trait for converting the binary representation of a prime field element into a +/// specific endianness. This is useful when you need to act on the bit representation +/// of an element generically, as the native binary representation of a prime field is +/// field-dependent. +pub trait Endianness: ByteOrder { + /// Converts the provided representation between native and little-endian. + fn toggle_little_endian>(t: &mut T); +} + +impl Endianness for byteorder::BigEndian { + fn toggle_little_endian>(t: &mut T) { + t.as_mut().reverse(); + } +} + +impl Endianness for byteorder::LittleEndian { + fn toggle_little_endian>(_: &mut T) { + // No-op + } +} + /// This represents an element of a prime field. -pub trait PrimeField: - Field + Ord + From + BitAnd + Shr -{ +pub trait PrimeField: Field + Ord + From { /// The prime field can be converted back and forth into this binary /// representation. type Repr: Default + AsRef<[u8]> + AsMut<[u8]> + From + for<'r> From<&'r Self>; + /// This indicates the endianness of [`PrimeField::Repr`]. + type ReprEndianness: Endianness; + /// Interpret a string of numbers as a (congruent) prime field element. /// Does not accept unnecessary leading zeroes or a blank string. fn from_str(s: &str) -> Option { @@ -176,16 +199,15 @@ pub trait PrimeField: /// this prime field, failing if the input is not canonical (is not smaller than the /// field's modulus). /// - /// The byte representation is interpreted with the same endianness as is returned - /// by [`PrimeField::into_repr`]. + /// The byte representation is interpreted with the endianness defined by + /// [`PrimeField::ReprEndianness`]. fn from_repr(_: Self::Repr) -> Option; /// Converts an element of the prime field into the standard byte representation for /// this field. /// - /// Endianness of the byte representation is defined by the field implementation. - /// Callers should assume that it is the standard endianness used to represent encoded - /// elements of this particular field. + /// The endianness of the byte representation is defined by + /// [`PrimeField::ReprEndianness`]. fn into_repr(&self) -> Self::Repr; /// Returns true iff this element is odd. diff --git a/pairing/src/bls12_381/fq.rs b/pairing/src/bls12_381/fq.rs index 4e1ee2c..bc7abaf 100644 --- a/pairing/src/bls12_381/fq.rs +++ b/pairing/src/bls12_381/fq.rs @@ -1534,67 +1534,6 @@ fn test_fq_mul_assign() { } } -#[test] -fn test_fq_shr() { - let mut a = Fq::from_repr(FqRepr([ - 0x12, 0x25, 0xf2, 0x90, 0x1a, 0xea, 0x51, 0x4e, 0x16, 0x08, 0x0c, 0xf4, 0x07, 0x1e, 0x0b, - 0x05, 0xc5, 0x54, 0x1f, 0xd4, 0x80, 0x46, 0xb7, 0xe7, 0x9d, 0xdd, 0x5b, 0x31, 0x2f, 0x3d, - 0xd1, 0x04, 0x43, 0x24, 0x2c, 0x06, 0xae, 0xd5, 0x52, 0x87, 0xaa, 0x5c, 0xdd, 0x61, 0x72, - 0x84, 0x7f, 0xfd, - ])) - .unwrap(); - a = a >> 0; - assert_eq!( - a.into_repr(), - FqRepr([ - 0x12, 0x25, 0xf2, 0x90, 0x1a, 0xea, 0x51, 0x4e, 0x16, 0x08, 0x0c, 0xf4, 0x07, 0x1e, - 0x0b, 0x05, 0xc5, 0x54, 0x1f, 0xd4, 0x80, 0x46, 0xb7, 0xe7, 0x9d, 0xdd, 0x5b, 0x31, - 0x2f, 0x3d, 0xd1, 0x04, 0x43, 0x24, 0x2c, 0x06, 0xae, 0xd5, 0x52, 0x87, 0xaa, 0x5c, - 0xdd, 0x61, 0x72, 0x84, 0x7f, 0xfd, - ]) - ); - a = a >> 1; - assert_eq!( - a.into_repr(), - FqRepr([ - 0x09, 0x12, 0xf9, 0x48, 0x0d, 0x75, 0x28, 0xa7, 0x0b, 0x04, 0x06, 0x7a, 0x03, 0x8f, - 0x05, 0x82, 0xe2, 0xaa, 0x0f, 0xea, 0x40, 0x23, 0x5b, 0xf3, 0xce, 0xee, 0xad, 0x98, - 0x97, 0x9e, 0xe8, 0x82, 0x21, 0x92, 0x16, 0x03, 0x57, 0x6a, 0xa9, 0x43, 0xd5, 0x2e, - 0x6e, 0xb0, 0xb9, 0x42, 0x3f, 0xfe, - ]) - ); - a = a >> 50; - assert_eq!( - a.into_repr(), - FqRepr([ - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x44, 0xbe, 0x52, 0x03, 0x5d, 0x4a, 0x29, - 0xc2, 0xc1, 0x01, 0x9e, 0x80, 0xe3, 0xc1, 0x60, 0xb8, 0xaa, 0x83, 0xfa, 0x90, 0x08, - 0xd6, 0xfc, 0xf3, 0xbb, 0xab, 0x66, 0x25, 0xe7, 0xba, 0x20, 0x88, 0x64, 0x85, 0x80, - 0xd5, 0xda, 0xaa, 0x50, 0xf5, 0x4b, - ]) - ); - a = a >> 130; - assert_eq!( - a.into_repr(), - FqRepr([ - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x91, 0x2f, 0x94, 0x80, 0xd7, - 0x52, 0x8a, 0x70, 0xb0, 0x40, 0x67, 0xa0, 0x38, 0xf0, 0x58, 0x2e, 0x2a, 0xa0, 0xfe, - 0xa4, 0x02, 0x35, 0xbf, 0x3c, 0xee, - ]) - ); - a = a >> 64; - assert_eq!( - a.into_repr(), - FqRepr([ - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x91, 0x2f, 0x94, 0x80, 0xd7, 0x52, 0x8a, 0x70, 0xb0, 0x40, 0x67, - 0xa0, 0x38, 0xf0, 0x58, 0x2e, 0x2a, - ]) - ); -} - #[test] fn test_fq_squaring() { let a = Fq([ diff --git a/pairing/src/bls12_381/fr.rs b/pairing/src/bls12_381/fr.rs index 886319e..e01978d 100644 --- a/pairing/src/bls12_381/fr.rs +++ b/pairing/src/bls12_381/fr.rs @@ -323,61 +323,6 @@ fn test_fr_mul_assign() { } } -#[test] -fn test_fr_shr() { - let mut a = Fr::from_repr(FrRepr([ - 0x3f, 0x28, 0x2a, 0x48, 0xec, 0xba, 0x3f, 0xb3, 0xdf, 0xb3, 0x8c, 0xa8, 0xd3, 0xe0, 0x7d, - 0x99, 0x25, 0x55, 0x0e, 0x9a, 0x2a, 0x2d, 0xf6, 0x9a, 0xa1, 0x0d, 0xe7, 0x8d, 0xb0, 0x3a, - 0x00, 0x36, - ])) - .unwrap(); - a = a >> 0; - assert_eq!( - a.into_repr(), - FrRepr([ - 0x3f, 0x28, 0x2a, 0x48, 0xec, 0xba, 0x3f, 0xb3, 0xdf, 0xb3, 0x8c, 0xa8, 0xd3, 0xe0, - 0x7d, 0x99, 0x25, 0x55, 0x0e, 0x9a, 0x2a, 0x2d, 0xf6, 0x9a, 0xa1, 0x0d, 0xe7, 0x8d, - 0xb0, 0x3a, 0x00, 0x36, - ]) - ); - a = a >> 1; - assert_eq!( - a.into_repr(), - FrRepr([ - 0x1f, 0x14, 0x15, 0x24, 0x76, 0xdd, 0x9f, 0xd9, 0xef, 0x59, 0x46, 0xd4, 0x69, 0xf0, - 0xbe, 0xcc, 0x92, 0x2a, 0x07, 0x4d, 0x95, 0x16, 0x7b, 0xcd, 0xd0, 0x86, 0xf3, 0x46, - 0x58, 0x1d, 0x00, 0x1b, - ]) - ); - a = a >> 50; - assert_eq!( - a.into_repr(), - FrRepr([ - 0x67, 0xf6, 0x7b, 0x96, 0x11, 0x75, 0x1a, 0xbc, 0x2f, 0xb3, 0xa4, 0xca, 0x41, 0x53, - 0xa5, 0xc5, 0x5e, 0x33, 0xb4, 0xe1, 0xbc, 0x11, 0x56, 0x07, 0xc0, 0x06, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, - ]) - ); - a = a >> 130; - assert_eq!( - a.into_repr(), - FrRepr([ - 0xd7, 0x0c, 0x6d, 0x38, 0x6f, 0x84, 0xd5, 0x01, 0xb0, 0x01, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, - ]) - ); - a = a >> 64; - assert_eq!( - a.into_repr(), - FrRepr([ - 0xb0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, - ]) - ); -} - #[test] fn test_fr_squaring() { let a = Fr([ diff --git a/pairing/src/tests/repr.rs b/pairing/src/tests/repr.rs index 7bc44e9..ca6112e 100644 --- a/pairing/src/tests/repr.rs +++ b/pairing/src/tests/repr.rs @@ -4,7 +4,6 @@ use rand_xorshift::XorShiftRng; pub fn random_repr_tests() { random_encoding_tests::

(); - random_shr_tests::

(); } fn random_encoding_tests() { @@ -22,30 +21,3 @@ fn random_encoding_tests() { assert_eq!(r, rdecoded); } } - -fn random_shr_tests() { - let mut rng = XorShiftRng::from_seed([ - 0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc, - 0xe5, - ]); - - for _ in 0..100 { - let r = P::random(&mut rng); - - for shift in 0..P::NUM_BITS { - let r1 = r >> shift; - - // Doubling the shifted element inserts zeros on the right; re-shifting should - // undo the doubling. - let mut r2 = r1; - for _ in 0..shift { - r2 = r2.double(); - } - r2 = r2 >> shift; - - assert_eq!(r1, r2); - } - - assert_eq!(r >> P::NUM_BITS, P::zero()); - } -} diff --git a/zcash_primitives/src/jubjub/fs.rs b/zcash_primitives/src/jubjub/fs.rs index 731a3d1..6a48f8f 100644 --- a/zcash_primitives/src/jubjub/fs.rs +++ b/zcash_primitives/src/jubjub/fs.rs @@ -1,8 +1,7 @@ use byteorder::{ByteOrder, LittleEndian}; use ff::{adc, mac_with_carry, sbb, BitIterator, Field, PowVartime, PrimeField}; use rand_core::RngCore; -use std::mem; -use std::ops::{Add, AddAssign, BitAnd, Mul, MulAssign, Neg, Shr, Sub, SubAssign}; +use std::ops::{Add, AddAssign, Mul, MulAssign, Neg, Sub, SubAssign}; use subtle::{Choice, ConditionallySelectable, ConstantTimeEq, CtOption}; use super::ToUniform; @@ -328,53 +327,9 @@ impl MulAssign for Fs { } } -impl BitAnd for Fs { - type Output = u64; - - #[inline(always)] - fn bitand(mut self, rhs: u64) -> u64 { - self.mont_reduce(self.0[0], self.0[1], self.0[2], self.0[3], 0, 0, 0, 0); - self.0[0] & rhs - } -} - -impl Shr for Fs { - type Output = Self; - - #[inline(always)] - fn shr(mut self, mut n: u32) -> Self { - if n as usize >= 64 * 4 { - return Self::from(0); - } - - // Convert from Montgomery to native representation. - self.mont_reduce(self.0[0], self.0[1], self.0[2], self.0[3], 0, 0, 0, 0); - - while n >= 64 { - let mut t = 0; - for i in self.0.iter_mut().rev() { - mem::swap(&mut t, i); - } - n -= 64; - } - - if n > 0 { - let mut t = 0; - for i in self.0.iter_mut().rev() { - let t2 = *i << (64 - n); - *i >>= n; - *i |= t; - t = t2; - } - } - - // Convert back to Montgomery representation - self * R2 - } -} - impl PrimeField for Fs { type Repr = FsRepr; + type ReprEndianness = byteorder::LittleEndian; fn from_repr(r: FsRepr) -> Option { let r = { @@ -1003,61 +958,6 @@ fn test_fs_mul_assign() { } } -#[test] -fn test_fs_shr() { - let mut a = Fs::from_repr(FsRepr([ - 0x3f, 0x28, 0x2a, 0x48, 0xec, 0xba, 0x3f, 0xb3, 0xdf, 0xb3, 0x8c, 0xa8, 0xd3, 0xe0, 0x7d, - 0x99, 0x25, 0x55, 0x0e, 0x9a, 0x2a, 0x2d, 0xf6, 0x9a, 0xa1, 0x0d, 0xe7, 0x8d, 0xb0, 0x3a, - 0x00, 0x06, - ])) - .unwrap(); - a = a >> 0; - assert_eq!( - a.into_repr(), - FsRepr([ - 0x3f, 0x28, 0x2a, 0x48, 0xec, 0xba, 0x3f, 0xb3, 0xdf, 0xb3, 0x8c, 0xa8, 0xd3, 0xe0, - 0x7d, 0x99, 0x25, 0x55, 0x0e, 0x9a, 0x2a, 0x2d, 0xf6, 0x9a, 0xa1, 0x0d, 0xe7, 0x8d, - 0xb0, 0x3a, 0x00, 0x06, - ]) - ); - a = a >> 1; - assert_eq!( - a.into_repr(), - FsRepr([ - 0x1f, 0x14, 0x15, 0x24, 0x76, 0xdd, 0x9f, 0xd9, 0xef, 0x59, 0x46, 0xd4, 0x69, 0xf0, - 0xbe, 0xcc, 0x92, 0x2a, 0x07, 0x4d, 0x95, 0x16, 0x7b, 0xcd, 0xd0, 0x86, 0xf3, 0x46, - 0x58, 0x1d, 0x00, 0x03, - ]) - ); - a = a >> 50; - assert_eq!( - a.into_repr(), - FsRepr([ - 0x67, 0xf6, 0x7b, 0x96, 0x11, 0x75, 0x1a, 0xbc, 0x2f, 0xb3, 0xa4, 0xca, 0x41, 0x53, - 0xa5, 0xc5, 0x5e, 0x33, 0xb4, 0xe1, 0xbc, 0x11, 0x56, 0x07, 0xc0, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, - ]) - ); - a = a >> 130; - assert_eq!( - a.into_repr(), - FsRepr([ - 0xd7, 0x0c, 0x6d, 0x38, 0x6f, 0x84, 0xd5, 0x01, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, - ]) - ); - a = a >> 64; - assert_eq!( - a.into_repr(), - FsRepr([ - 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, - ]) - ); -} - #[test] fn test_fs_squaring() { let a = Fs([ diff --git a/zcash_primitives/src/jubjub/tests.rs b/zcash_primitives/src/jubjub/tests.rs index 595bf7c..a2f7fc7 100644 --- a/zcash_primitives/src/jubjub/tests.rs +++ b/zcash_primitives/src/jubjub/tests.rs @@ -1,6 +1,6 @@ use super::{edwards, montgomery, JubjubEngine, JubjubParams, PrimeOrder}; -use ff::{Field, PrimeField}; +use ff::{Endianness, Field, PrimeField}; use std::ops::{AddAssign, MulAssign, Neg, SubAssign}; use rand_core::{RngCore, SeedableRng}; @@ -372,7 +372,23 @@ fn test_jubjub_params(params: &E::Params) { let mut cur = E::Fs::one(); - let max = (-E::Fs::one()) >> 1; + let max = { + // Grab char - 1 in little endian. + let mut tmp = (-E::Fs::one()).into_repr(); + ::ReprEndianness::toggle_little_endian(&mut tmp); + + // Shift right by 1 bit. + let mut borrow = 0; + for b in tmp.as_mut().iter_mut().rev() { + let new_borrow = *b & 1; + *b = (borrow << 7) | (*b >> 1); + borrow = new_borrow; + } + + // Convert back to a field element. + ::ReprEndianness::toggle_little_endian(&mut tmp); + E::Fs::from_repr(tmp).unwrap() + }; let mut pacc = E::Fs::zero(); let mut nacc = E::Fs::zero(); diff --git a/zcash_primitives/src/pedersen_hash.rs b/zcash_primitives/src/pedersen_hash.rs index afd8a73..5d39cd6 100644 --- a/zcash_primitives/src/pedersen_hash.rs +++ b/zcash_primitives/src/pedersen_hash.rs @@ -1,7 +1,8 @@ //! Implementation of the Pedersen hash function used in Sapling. use crate::jubjub::*; -use ff::Field; +use byteorder::{ByteOrder, LittleEndian}; +use ff::{Endianness, Field, PrimeField}; use std::ops::{AddAssign, Neg}; #[derive(Copy, Clone)] @@ -85,17 +86,32 @@ where let mut table: &[Vec>] = &generators.next().expect("we don't have enough generators"); - let window = JubjubBls12::pedersen_hash_exp_window_size(); - let window_mask = (1 << window) - 1; + let window = JubjubBls12::pedersen_hash_exp_window_size() as usize; + let window_mask = (1u64 << window) - 1; + + let mut acc = acc.into_repr(); + ::ReprEndianness::toggle_little_endian(&mut acc); + let num_limbs: usize = acc.as_ref().len() / 8; + let mut limbs = vec![0u64; num_limbs + 1]; + LittleEndian::read_u64_into(acc.as_ref(), &mut limbs[..num_limbs]); let mut tmp = edwards::Point::zero(); - while !acc.is_zero() { - let i = (acc & window_mask) as usize; + let mut pos = 0; + while pos < E::Fs::NUM_BITS as usize { + let u64_idx = pos / 64; + let bit_idx = pos % 64; + let i = (if bit_idx + window < 64 { + // This window's bits are contained in a single u64. + limbs[u64_idx] >> bit_idx + } else { + // Combine the current u64's bits with the bits from the next u64. + (limbs[u64_idx] >> bit_idx) | (limbs[u64_idx + 1] << (64 - bit_idx)) + } & window_mask) as usize; tmp = tmp.add(&table[0][i], params); - acc = acc >> window; + pos += window; table = &table[1..]; }