Struct CryptoBigintElement 

pub struct CryptoBigintElement<U: Limbs> {
    a: U,
    b: (Choice, U),
    c: U::Wide,
    discriminant_abs: U::Wide,
}

A constant-time primitive element of a class group, implemented via crypto-bigint.

This only supports discriminants delta such that $delta < 0, |delta| \cong 1 \mod 2$.

This is implemented in time variable to the discriminant yet constant to the a, b, c coefficients. This prevents timing analysis from leaking the elements being composed. It is only recommended for provers as it has a significant performance overhead compared to other backends, which verifiers should take advantage of.

This implementation does not itself allocate and can be used with crypto_bigint::Uint to achieve elements which are fixed size and live on the stack, albeit only with support for a bounded subset of discriminants. Alternatively, crypto_bigint::BoxedUint may be used to support all discriminants, at the cost of using the heap.

Fields

a: U

The a coefficient.

This may not be reduced but is bounded to less than the square root of the discriminant.

b: (Choice, U)

The b coefficient.

This may not be reduced but is bounded to have an absolute value less than the square root of the discriminant.

c: U::Wide

The c coefficient.

This may not be reduced but is bounded to be less than the discriminant.

discriminant_abs: U::Wide

The absolute value of the negative discriminant for this form.

This is used to recalculate the c coefficient after composition.

Implementations

impl<U: Limbs> CryptoBigintElement<U>

fn identity_from_discriminant(discriminant_abs: U::Wide) -> Self

This is only valid for forms of negative odd discriminant.

impl<U: Limbs> CryptoBigintElement<U>

fn partial_reduce( a: U::Wide, b: (Choice, U::Wide), discriminant_abs: U::Wide, ) -> Self

Partially reduce an element.

This assumes the coefficients are the result from composition (either addition or doubling) of two well-defined instances of this type.

fn reduce(self) -> Self

Reduce an element.

Trait Implementations

impl<U: Clone + Limbs> Clone for CryptoBigintElement<U>

where U::Wide: Clone,

fn clone(&self) -> CryptoBigintElement<U>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<U: Limbs> Coefficients for CryptoBigintElement<U>

fn a_b_c_discriminant( self, ) -> (impl AsRef<[u8]>, (Choice, impl AsRef<[u8]>), impl AsRef<[u8]>, impl AsRef<[u8]>)

This function runs in constant time.

impl<U: Limbs> CtEq for CryptoBigintElement<U>

fn ct_eq(&self, other: &Self) -> Choice

This MAY return an incorrect result for forms of different discriminants.

fn ct_ne(&self, other: &Rhs) -> Choice

Determine if self is NOT equal to other in constant-time.

impl<U: Limbs> CtSelect for CryptoBigintElement<U>

fn ct_select(&self, b: &Self, choice: Choice) -> Self

This MAY return an incorrect result for forms of different discriminants.

fn ct_swap(&mut self, other: &mut Self, choice: Choice)

Conditionally swap self and other if choice is Choice::TRUE.

impl<U: Debug + Limbs> Debug for CryptoBigintElement<U>

where U::Wide: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<U: Limbs> Element for CryptoBigintElement<U>

fn identity(discriminant_abs: impl AsRef<[u8]>) -> Self

This is only valid for forms of negative odd discriminant.

fn is_identity(&self) -> Choice

This MAY return an incorrect result when the form doesn’t have an odd, negative discriminant.

fn add(&self, other: &Self) -> Self

This is only correct for forms of the same discriminant where at least one form is primitive.

fn double(&self) -> Self

This is only correct when the form is primitive.

fn sub(&self, other: Self) -> Self

This is only correct for forms of the same discriminant where at least one form is primitive.

unsafe fn from_coefficients( a: impl AsRef<[u8]>, (b_positive, b_abs): (Choice, impl AsRef<[u8]>), c: impl AsRef<[u8]>, discriminant_abs: impl AsRef<[u8]>, ) -> Self

This function is only valid for primitive reduced positive definite binary quadratic forms of negative odd discriminant where the discriminant fits within (2 * max_bits) - 2 bits.

This function MAY run in time variable to:

• the byte-length of the inputs
• the validity of the inputs
• the discriminant

This function MAY panic if asked to handle coefficients which exceed the capacity of the underlying container(s).

fn uncompressed_encode(self) -> impl AsRef<[u8]>

This runs in time variable to the size of the discriminant and the size of the underlying container.

fn uncompressed_decode( buf: impl AsRef<[u8]>, discriminant_abs: impl AsRef<[u8]>, ) -> CtOption<Self>

This runs in time variable to the size of the discriminant and the size of the underlying container. This MAY return None for discriminants which fit within the bounds but have trailing zero bytes which cause the amount of encoded bits to exceed the bounds.

fn compress(self, writer: impl Write) -> Result<()>

Available on crate feature std only.

Compress an element.

fn decompress( reader: impl Read, discriminant_abs: impl AsRef<[u8]>, ) -> Result<Self>

Available on crate feature std only.

Decompress an element of the specified discriminant.

fn from(source: impl Element) -> Self

Create an element of this type from another element.

fn next_prime_ideal_squared( rng: impl CryptoRng, seed: BoxedUint, discriminant_abs: impl AsRef<[u8]>, bits_of_security: u32, ) -> Self

Available on crate feature alloc only.

Sample a uniform element from a subgroup of the class group and return its square.

impl<U: Limbs> ElementExt for CryptoBigintElement<U>

Available on crate feature alloc only.

fn multiexp(identity: &Self, pairs: &[(&Table<Self>, &[u8])]) -> Self

This is only correct when identity is in fact the identity element for the class group the elements in the table belong to.

const MAX_TABLE_BITS: u32 = 12

The maximum amount of bits to create a table with.

fn mul(table: &Table<Self>, scalar: &[u8]) -> Self

Perform a multiplication with a Table.

impl<U: Limbs> Eq for CryptoBigintElement<U>

#[doc(hidden)]

fn assert_receiver_is_total_eq(&self)

👎Deprecated since 1.95.0:

implementation detail of #[derive(Eq)]

#[doc(hidden)]

fn assert_fields_are_eq(&self)

🔬This is a nightly-only experimental API. (derive_eq_internals)

impl<U: Limbs> Neg for CryptoBigintElement<U>

fn neg(self) -> Self

This is only correct for primitives forms where $delta \cong 1 \mod 2$.

type Output = CryptoBigintElement<U>

The resulting type after applying the - operator.

impl<U: Limbs> PartialEq for CryptoBigintElement<U>

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<U: Limbs> Zeroize for CryptoBigintElement<U>

fn zeroize(&mut self)

This is only valid for forms of negative odd discriminant.

This does not zeroize the discriminant, solely the a, b, c coefficients, and will set the result to the identity element of the same discriminant.