Repository navigation
Conversation
Multiply two generators by one scalar from a single decomposition. The gadget emits component_mul_generator for the first generator verbatim, then the signed-digit rows of the second, which read their digits off the first chain's scalar accumulator. The second multiplication shares the canonicality check, the zero pin, the leading-zero bound and the closing equality: 590 gates against 662 for two single calls. The emission of component_mul_generator is unchanged; its golden digest holds. The soundness suite gains forgeries that fill the two chains from different digits, noncanonical aliases or modulus wraps, a golden digest for the pair, and a check that the pair starts with the single gadget.
There was a problem hiding this comment.
🔵 Needs a closer look
The implementation appears coherent and well tested, but changes cryptographic constraint wiring and therefore warrants final human review.
0 open findings
What changed in this PR
Adds an optimized fixed-base gadget that multiplies two generators using one securely constrained scalar decomposition.
Changes:
- Adds
component_mul_generator_pair, reducing two multiplications from 662 to 590 gates. - Refactors fixed-base chain construction for shared scalar witnesses.
- Adds layout, correctness, validation, and soundness tests.
| File | Description |
|---|---|
src/composer/fixed_base.rs |
Implements the paired gadget and shared chain logic. |
src/composer/constraint_system/ecc.rs |
Documents the new torsion-free point source. |
src/composer/tests/soundness/fixed_base.rs |
Tests wiring, layout, and forgery resistance. |
tests/ecc.rs |
Adds integration and input-validation tests. |
CHANGELOG.md |
Records the public API addition. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1016 +/- ##
==========================================
+ Coverage 92.25% 92.33% +0.07%
==========================================
Files 81 81
Lines 8887 9162 +275
==========================================
+ Hits 8199 8460 +261
- Misses 688 702 +14
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
|
None of our circuits lands in a smaller proving domain with these savings, so they would not speed up proving. Closing; 0.24.1 ships without them. The branch stays in case a later circuit needs it. |
Part of #1015
component_mul_generator_pair(jubjub, generator_a, generator_b)returnsjubjub · generator_aandjubjub · generator_bfrom one scalar decomposition. It emitscomponent_mul_generator's gates for the first generator, then the second generator's signed-digit rows, which read the same digit witnesses. The canonical range check, the zero pin, the leading-zero bound and the closing equality apply once to the shared accumulator, so both results carry the single call's bounds. Invalid generators and non-canonical scalars return the single call's errors before any gate is appended.It takes 590 gates instead of 2 × 331. The existing gadgets' layouts and golden digests are unchanged. The fixed-base host code moves into a shared
FixedBaseChain, whichgit diff --color-movedshows as a move.Tests:
r,k + r,q,1 − q). Each is rejected withCircuitUnsatisfiedagainst keys compiled from the honest gadget.