You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: barretenberg/cpp/pil/vm2/ecc.pil
+6-10Lines changed: 6 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -2,16 +2,11 @@
2
2
/**
3
3
* This subtrace supports point addition over the Grumpkin curve.
4
4
* Given two points, P & Q, this trace computes R = P + Q.
5
-
* PRECONDITIONS: The only assumption here is that the inputs P & Q are points on the Grumpkin curve (note that the Point at Infinity = (0, 0) is considered on the curve):
6
-
* Grumpkin Curve Eqn in SW form: Y^2 = X^3 − 17.
5
+
* PRECONDITIONS: This trace assumes that the inputs P & Q are points on the Grumpkin curve and infinity points are correctly
6
+
* flagged with p_is_inf and/or q_is_inf (note that the Point at Infinity = (0, 0) is considered on the curve):
7
+
* Grumpkin Curve Eqn in SW form: Y^2 = X^3 − 17.
7
8
* Note: Grumpkin forms a 2-cycle with BN254, i.e the base field of one is the scalar field of the other and vice-versa.
8
9
*
9
-
*
10
-
* MW NOTE: USING APPROACH 1 BELOW:
11
-
* Note that once TODO(#AVM-266) is complete, is_inf will no longer be part of our point representation and we must either:
12
-
* - continue to rely on the 'calling' trace to inject a constrained is_inf, or
13
-
* - derive is_inf (<==> (X, Y) == (INFINITY_X, INFINITY_Y)) within this trace.
14
-
*
15
10
* USAGE: This is a non-memory aware subtrace used to constrain point addition as defined above. Each point can be looked up
16
11
* by coordinates (lookup as defined in ecc_mem.pil):
17
12
* #[INPUT_OUTPUT_ECC_ADD]
@@ -29,8 +24,9 @@
29
24
* ecc.r_x, ecc.r_y // Point R
30
25
* };
31
26
*
32
-
* MW NOTE: For now, the calling trace MUST constrain that p_is_inf, q_is_inf above are correct. This is so if we have a calling
33
-
* trace in which we know inf would never be an input we can simply use precomputed.zero and avoid wasting gates on deriving is_inf.
27
+
* NOTE: For now, the calling trace MUST constrain that p_is_inf, q_is_inf above are correct. This is so if we have a calling
28
+
* trace in which we know inf would never be an input we can simply use precomputed.zero and avoid wasting gates on deriving is_inf.
29
+
* This follows the same logic for points being on the curve.
34
30
*
35
31
* TRACE SHAPE: 1 single row per computation (P + Q = R).
0 commit comments