Struct G 

pub struct G { /* private fields */ }

Represents a point in the Banderwagon group.

This group is defined over the BLS12-381 Scalar field. Because of that, we can efficiently use it in ZK proofs using BLS.

Implementations

impl G

pub fn scalar_mul_x_squared_base(&self, scalar: &Scalar) -> Scalar

Out-of-circuit squared affine x-coordinate of [scalar] * self.

We expose the squared abscissa rather than the bare one because the quotient identifies (x, y) with (-x, -y): a plain x-coordinate flips sign between the two representatives, whereas its square is a well-defined function of the group element (no representative to agree on, no canonicalize needed). The native counterpart of the in-circuit scalar_mul_x_squared.

pub fn scalar_mul_x_squared_f(&self, x: &F) -> Scalar

Out-of-circuit squared affine x-coordinate of [x] * self for an F exponent — the native counterpart of scalar_mul_x_squared_base, the square is representative-independent.

impl G

pub fn scalar_mul_many_in_circuit<'ctx, const WINDOW: usize>( bases: &[Self], bits: &[BoolVar<'ctx, Scalar>], ) -> Vec<GVar<'ctx>>

In-circuit fixed-base scalar multiplication for several public bases sharing one scalar bit decomposition.

WINDOW controls how many bits are selected at a time. Selector monomials are built once per window and reused across every base.

pub fn scalar_mul_x_squared<'ctx>( &self, ctx: Context<'ctx, Scalar>, scalar: &Var<'ctx, Scalar>, ) -> Var<'ctx, Scalar>

In-circuit squared affine x-coordinate of [scalar] * self.

We expose the squared abscissa rather than the bare one because the quotient identifies (x, y) with (-x, -y): a plain x-coordinate flips sign between the two representatives, whereas its square is a well-defined function of the group element, so the read agrees regardless of which representative a point happens to hold. The in-circuit counterpart of scalar_mul_x_squared_base.

pub fn scalar_mul_bits<'ctx>( &self, bits: &[BoolVar<'ctx, Scalar>], ) -> GVar<'ctx>

In-circuit [scalar] * self where the scalar is given directly as its little-endian bits, rather than as a Var to be decomposed.

This is the path for an F exponent (e.g. the eVRF secret): the bits are the witness, so unlike scalar_mul there is no recomposition or canonicity constraint — see F for why that is sound at F::BITS width. The caller must allocate the bits once and reuse the same slice across operations, so a single exponent is bound everywhere.

Trait Implementations

impl<'a> Add<&'a G> for G

type Output = G

The resulting type after applying the + operator.

fn add(self, rhs: &'a Self) -> Self::Output

Performs the + operation.

impl<'a> AddAssign<&'a G> for G

fn add_assign(&mut self, rhs: &'a Self)

Performs the += operation.

impl Additive for G

fn zero() -> Self

The neutral element for addition.

fn double(&mut self)

Add an element to itself.

fn scale(&self, bits_le: &[u64]) -> Self

Scale this number by a positive integer.

impl Clone for G

fn clone(&self) -> G

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CryptoGroup for G

fn generator() -> Self

Returns the prime-order Bandersnatch generator in extended coordinates.

type Scalar = F

impl Debug for G

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for G

impl FixedSize for G

const SIZE: usize = Scalar::SIZE

The size of the encoded value (in bytes).

impl HashToGroup for G

fn hash_to_group(domain_separator: &[u8], message: &[u8]) -> Self

Hashes (domain_separator, message) to a Banderwagon point.

Uses try-and-increment: for counter = 0, 1, 2, ... we derive a candidate abscissa x = H(domain_separator, message || counter) and return the first one that is a valid subgroup serialization. Because the serialization is a bijection between group elements and valid abscissae, and each candidate is an independent uniform field element, the result is a uniformly random group element whose discrete log w.r.t. the generator is unknown.

We deliberately choose this over a constant-time map (e.g. Elligator-2 on the Montgomery model of bandersnatch). Try-and-increment is simpler — it reuses from_x and adds no new trusted constants or rational maps — at the cost of not being constant-time: the number of attempts (~4 on average, since roughly 1/4 of field elements are valid abscissae) depends on the input.

That tradeoff fits our use case. The intended caller is the Golden DKG eVRF, where the hash inputs (public keys and messages) and outputs are public and the secret scalar is only applied afterwards — so the data-dependent timing reveals nothing secret. A future caller that hashes secret material would instead need a constant-time map.

fn rand_to_group(rng: impl CryptoRng) -> Self

Convert randomness to a group element, without learning its discrete logarithm.

impl<'a> Mul<&'a F> for G

type Output = G

The resulting type after applying the * operator.

fn mul(self, rhs: &'a F) -> Self::Output

Performs the * operation.

impl<'a> MulAssign<&'a F> for G

fn mul_assign(&mut self, rhs: &'a F)

Performs the *= operation.

impl Neg for G

type Output = G

The resulting type after applying the - operator.

fn neg(self) -> Self::Output

Performs the unary - operation.

impl Object for G

impl PartialEq for G

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Read for G

type Cfg = ()

The Cfg type parameter allows passing configuration during the read process. This is crucial for safely decoding untrusted data, for example, by providing size limits for collections or strings.

fn read_cfg(buf: &mut impl Buf, _: &()) -> Result<Self, CodecError>

Reads a value from the buffer using the provided configuration cfg.

impl Space<F> for G

fn msm(points: &[Self], scalars: &[F], _strategy: &impl Strategy) -> Self

Calculate sum_i points[i] * scalars[i].

impl<'a> Sub<&'a G> for G

type Output = G

The resulting type after applying the - operator.

fn sub(self, rhs: &'a Self) -> Self::Output

Performs the - operation.

impl<'a> SubAssign<&'a G> for G

fn sub_assign(&mut self, rhs: &'a Self)

Performs the -= operation.

impl Write for G

fn write(&self, buf: &mut impl BufMut)

Writes the binary representation of self to the provided buffer buf.

fn write_bufs(&self, buf: &mut impl BufsMut)

Writes to a BufsMut, allowing existing Bytes chunks to be appended via BufsMut::push instead of written inline. Must encode to the same format as Write::write. Defaults to Write::write.