forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-02-26 15:47:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

crypto/bn256: add documentation on subgroup checks for G2 (#32066)

Browse source 
This PR improves the IsOnCurve methods for BN254 G2 points by:

* Clarifying its behavior the docstring, making it explicit that it
verifies both the point being on the curve and in the correct subgroup.

* Adding an in-line comment explaining the subgroup membership check
(c.Mul(Order)).

 * Minor wording adjustments for readability and consistency.
This commit is contained in:
Antonio Sanso 2025-06-20 13:18:20 +02:00 committed by GitHub
parent 6723388b01
commit f26b5653e8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
crypto/bn256/cloudflare/twist.go
View file

@ -43,7 +43,7 @@ func (c *twistPoint) Set(a *twistPoint) {
c.t.Set(&a.t) c.t.Set(&a.t)
} }
// IsOnCurve returns true iff c is on the curve. // IsOnCurve returns true iff c is on the curve and is in the correct subgroup.
func (c *twistPoint) IsOnCurve() bool { func (c *twistPoint) IsOnCurve() bool {
c.MakeAffine() c.MakeAffine()
if c.IsInfinity() { if c.IsInfinity() {
@ -57,6 +57,8 @@ func (c *twistPoint) IsOnCurve() bool {
if *y2 != *x3 { if *y2 != *x3 {
return false return false
} }
// Subgroup check: multiply the point by the group order and
// verify that it becomes the point at infinity.
cneg := &twistPoint{} cneg := &twistPoint{}
cneg.Mul(c, Order) cneg.Mul(c, Order)
return cneg.z.IsZero() return cneg.z.IsZero()

4
crypto/bn256/google/twist.go
View file

@ -67,7 +67,7 @@ func (c *twistPoint) Set(a *twistPoint) {
c.t.Set(a.t) c.t.Set(a.t)
} }
// IsOnCurve returns true iff c is on the curve where c must be in affine form. // IsOnCurve returns true iff c is on the curve and is in the correct subgroup, where c must be in affine form.
func (c *twistPoint) IsOnCurve() bool { func (c *twistPoint) IsOnCurve() bool {
pool := new(bnPool) pool := new(bnPool)
yy := newGFp2(pool).Square(c.y, pool) yy := newGFp2(pool).Square(c.y, pool)
@ -80,6 +80,8 @@ func (c *twistPoint) IsOnCurve() bool {
if yy.x.Sign() != 0 || yy.y.Sign() != 0 { if yy.x.Sign() != 0 || yy.y.Sign() != 0 {
return false return false
} }
// Subgroup check: multiply the point by the group order and
// verify that it becomes the point at infinity.
cneg := newTwistPoint(pool) cneg := newTwistPoint(pool)
cneg.Mul(c, Order, pool) cneg.Mul(c, Order, pool)
return cneg.z.IsZero() return cneg.z.IsZero()