crypto: Express the G2 check's Frobenius powers directly - #1637
Open
chfast wants to merge 1 commit into
Open
Conversation
g2_subgroup_check spelled ψ, ψ² and ψ³ three different ways — endomorphism<1>, a chained endomorphism<1>, and endomorphism<1> composed with endomorphism<2> — even though a specialization exists for each power. Use them directly so the three terms match the [x+1]P + ψ([x]P) + ψ²([x]P) == ψ³([2x]P) identity being checked, which also drops 2 Fq2 multiplications and 3 conjugations per pair and cuts about 0.1% off the ECPAIRING instruction count.
There was a problem hiding this comment.
Pull request overview
Simplifies BN254 G2 subgroup checks by directly applying the required Frobenius powers.
Changes:
- Replaces chained endomorphisms with direct
ψ²andψ³calls. - Reduces field multiplications and conjugations.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1637 +/- ##
=======================================
Coverage 97.71% 97.71%
=======================================
Files 171 171
Lines 15607 15607
Branches 3610 3610
=======================================
Hits 15251 15251
Misses 269 269
Partials 87 87
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
g2_subgroup_check spelled the three consecutive Frobenius powers three
different ways: endomorphism<1>, a chained endomorphism<1>, and
endomorphism<1> composed with endomorphism<2>, although a specialization
exists for each power. Use them directly so the three terms match the
identity being checked, [x+1]P + ψ([x]P) + ψ²([x]P) == ψ³([2x]P).
Collapsing the chains relies on conj(γ₁)·γ₁ == γ₂ and γ₂·γ₁ == γ₃, which
hold for the FROBENIUS_COEFFS values; the Frobenius² coefficients are
real, so the conjugation passes through them unchanged. Drops 2 Fq²
multiplications and 3 conjugations per pair, about 0.1% of the ECPAIRING
instruction count.
🤖 Generated with Claude Code