pairing 1.0.0 → 1.1.0
raw patch · 8 files changed
+388/−253 lines, 8 filesdep ~MonadRandomdep ~bytestringdep ~errors
Dependency ranges changed: MonadRandom, bytestring, errors, galois-field, groups, tasty-quickcheck
Files
- ChangeLog.md +4/−0
- Example.hs +36/−0
- LICENSE +1/−1
- README.md +0/−159
- README.notex.md +164/−0
- pairing.cabal +178/−88
- src/Data/Pairing/Ate.hs +1/−1
- src/Data/Pairing/Hash.hs +4/−4
ChangeLog.md view
@@ -1,5 +1,9 @@ # Change log for pairing +## 1.1.0++* Bump bounds for galois-field and poly.+ ## 1.0.0 * Refactor library structure from `Pairing.Pairing` to `Data.Pairing`.
+ Example.hs view
@@ -0,0 +1,36 @@+module Main where++import Data.Curve.Weierstrass (Point (A), mul')+import Data.Group (pow)+import Data.Pairing.BN254 (BN254, G1, G2, pairing)+import Protolude++p :: G1 BN254+p =+ A+ 1368015179489954701390400359078579693043519447331113978918064868415326638035+ 9918110051302171585080402603319702774565515993150576347155970296011118125764++q :: G2 BN254+q =+ A+ [ 2725019753478801796453339367788033689375851816420509565303521482350756874229,+ 7273165102799931111715871471550377909735733521218303035754523677688038059653+ ]+ [ 2512659008974376214222774206987427162027254181373325676825515531566330959255,+ 957874124722006818841961785324909313781880061366718538693995380805373202866+ ]++main :: IO ()+main = do+ putText "P:"+ print p+ putText "Q:"+ print q+ putText "e(P, Q):"+ print (pairing p q)+ putText "e(P, Q) is bilinear:"+ print $ pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b)+ where+ a = 2 :: Int+ b = 3 :: Int
LICENSE view
@@ -1,4 +1,4 @@-Copyright (c) 2018-2019 Adjoint Inc.+Copyright (c) 2018-2020 Adjoint Inc. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal
− README.md
@@ -1,159 +0,0 @@-<p align="center">-<a href="https://www.adjoint.io">- <img width="250" src="./.assets/adjoint.png" alt="Adjoint Logo" />-</a>-</p>--[](https://hackage.haskell.org/package/pairing)--Implementation of the Barreto-Naehrig (BN) curve construction from-[[BCTV2015]](https://eprint.iacr.org/2013/879.pdf) to provide two cyclic groups-**G<sub>1</sub>** and **G<sub>2</sub>**, with an efficient bilinear pairing:--*e: G<sub>1</sub> × G<sub>2</sub> → G<sub>T</sub>*--# Pairing--Let G<sub>1</sub>, G<sub>2</sub> and G<sub>T</sub> be abelian groups of prime order `q` and let `g` and `h` elements of G<sub>1</sub> and G<sub>2</sub> respectively . A pairing is a non-degenerate bilinear map e: G<sub>1</sub> × G<sub>2</sub> → G<sub>T</sub>.--This bilinearity property is what makes pairings such a powerful primitive in cryptography. It satisfies:-- e(g<sub>1</sub> + g<sub>2</sub>, h) = e(g<sub>1</sub>, h) e(g<sub>2</sub>, h)-- e(g, h<sub>1</sub> + h<sub>2</sub>) = e(g, h<sub>1</sub>) e(g, h<sub>2</sub>)---The non-degeneracy property guarantees non-trivial pairings for non-trivial arguments. In other words, being non-degenerate means that:-- ∀ g ≠ 1, ∃ h<sub>i</sub> ∈ G<sub>2</sub> such that e(g, h<sub>i</sub>) ≠ 1-- ∀ h ≠ 1, ∃ g<sub>i</sub> ∈ G<sub>1</sub> such that e(g<sub>i</sub>, h) ≠ 1--An example of a pairing would be the scalar product on euclidean space <.> : R<sup>n</sup> × R<sup>n</sup> → R--## Example Usage--A simple example of calculating the optimal ate pairing given two points in G<sub>1</sub> and G<sub>2</sub>.--```haskell-import Protolude--import Data.Group (pow)-import Data.Curve.Weierstrass (Point(A), mul')--import Data.Pairing.BN254 (BN254, G1, G2, pairing)--p :: G1 BN254-p = A- 1368015179489954701390400359078579693043519447331113978918064868415326638035- 9918110051302171585080402603319702774565515993150576347155970296011118125764---q :: G2 BN254-q = A- [2725019753478801796453339367788033689375851816420509565303521482350756874229- ,7273165102799931111715871471550377909735733521218303035754523677688038059653- ]- [2512659008974376214222774206987427162027254181373325676825515531566330959255- ,957874124722006818841961785324909313781880061366718538693995380805373202866- ]--main :: IO ()-main = do- putText "P:"- print $ p- putText "Q:"- print $ q- putText "e(P, Q):"- print $ pairing p q- putText "e(P, Q) is bilinear:"- print $ pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b)- where- a = 2 :: Int- b = 3 :: Int-```--## Pairings in cryptography--Pairings are used in encryption algorithms, such as identity-based encryption (IBE), attribute-based encryption (ABE), (inner-product) predicate encryption, short broadcast encryption and searchable encryption, among others. It allows strong encryption with small signature sizes.--## Admissible Pairings--A pairing `e` is called admissible pairing if it is efficiently computable. The only admissible pairings that are suitable for cryptography are the Weil and Tate pairings on algebraic curves and their variants. Let `r` be the order of a group and E[r] be the entire group of points of order `r` on E(F<sub>q</sub>). E[r] is called the r-torsion and is defined as E[r] = { P ∈ E(F<sub>q</sub>) | rP = O }. Both Weil and Tate pairings require that `P` and `Q` come from disjoint cyclic subgroups of the same prime order `r`. Lagrange's theorem states that for any finite group `G`, the order (number of elements) of every subgroup `H` of `G` divides the order of `G`. Therefore, r | #E(F<sub>q</sub>).--G<sub>1</sub> and G<sub>2</sub> are subgroups of a group defined in an elliptic curve over an extension of a finite field F<sub>q</sub>, namely E(F<sub>q<sup>k</sup></sub>), where `q` is the characteristic of the field and `k` is a positive integer called embedding degree.--The embedding degree `k` plays a crucial role in pairing cryptography:-- It's the value that makes F<sub>q<sup>k</sup></sub> be the smallest extension of F<sub>q</sub> such that E(F<sub>q<sup>k</sup></sub>) captures more points of order `r`.-- It's the minimal value that holds r | (q<sup>k</sup> - 1).-- It's the smallest positive integer such that E[r] ⊂ E(F<sub>q<sup>k</sup></sub>)--There are subtle but relevant differences in G<sub>1</sub> and G<sub>2</sub> subgroups depending on the type of pairing. Nowadays, all of the state-of-the-art implementations of pairings take place on ordinary curves and assume a type of pairing (Type 3) where G<sub>1</sub> = E[r] ∩ Ker(π - [1]) and G<sub>2</sub> = E[r] ∩ Ker(π - [q]) and there is no non-trivial map φ: G<sub>2</sub> → G<sub>1</sub>.--## Tate Pairing--The Tate pairing is a map:--tr : E(F<sub>q<sup>k</sup></sub>)[r] × E(F<sub>q<sup>k</sup></sub>) / rE(F<sub>q<sup>k</sup></sub>) → F<sup>*</sup><sub>q<sup>k</sup></sub> / (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup>--defined as:--tr(P, Q) = f(Q)--where P ∈ E(F<sub>q<sup>k</sup></sub>)[r], Q is any representative in a equivalence class in E(F<sub>q<sup>k</sup></sub>) / rE(F<sub>q<sup>k</sup></sub>) and F<sup>*</sup><sub>q<sup>k</sup></sub> / (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup> is the set of equivalence classes of F<sup>*</sup><sub>q<sup>k</sup></sub> under the equivalence relation a ≡ b iff a / b ∈ (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup>. The equivalence relation in the output of the Tate pairing is unfortunate. In cryptography, different parties must compute the same value under the bilinearity property.--The reduced Tate pairing solves this undesirable property by exponentiating elements in F<sup>*</sup><sub>q<sup>k</sup></sub> / (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup> to the power of (q<sup>k</sup> - 1) / r. It maps all elements in an equivalence class to the same value. It is defined as:--Tr(P, Q) = t<sub>r</sub>(P, Q)<sup>#F<sub>q<sup>k</sup></sub> / r</sup> = f<sub>r</sub>,P(Q)<sup>(q<sup>k</sup> - 1) / r</sup>.--When we say Tate pairing, we normally mean the reduced Tate pairing.--## Pairing optimization--Tate pairings use Miller's algorithm, which is essentially the double-and-add algorithm for elliptic curve point multiplication combined with evaluation of the functions used in the addition process. Miller's algorithm remains the fastest algorithm for computing pairings to date.--Both G<sub>1</sub> and G<sub>2</sub> are elliptic curve groups. G<sub>T</sub> is a multiplicative subgroup of a finite field. The security an elliptic curve group offers per bit is considerably greater than the security a finite field does. In order to achieve security comparable to 128-bit security (AES-128), an elliptic curve of 256 bits will suffice, while we need a finite field of 3248 bits. The aim of a cryptographic protocol is to achieve the highest security degree with the smallest signature size, which normally leads to a more efficient computation. In pairing cryptography, significant improvements can be made by keeping all three group sizes the same. It is possible to find elliptic curves over a field F<sub>q</sub> whose largest prime order subgroup `r` has the same bit-size as the characteristic of the field `q`. The ratio between the field size `q` and the large prime group order `r` is called the φ-value. It is an important value that indicates how much (ECDLP) security a curve offers for its field size. φ=1 is the optimal value. The Barreto-Naehrig (BN) family of curves all have φ=1 and k=12. They are perfectly suited to the 128-bit security level.--Most operations in pairings happen in the extension field F<sub>q<sup>k</sup></sub>. The larger k gets, the more complex F<sub>q<sup>k</sup></sub> becomes and the more computationally expensive the pairing becomes. The complexity of Miller's algorithm heavily depends on the complexity of the associated F<sub>q<sup>k</sup></sub>-arithmetic. Therefore, the aim is to minimize the cost of arithmetic in F<sub>q<sup>k</sup></sub>.--It is possible to construct an extension of a field F<sub>q<sup>k</sup></sub> by successively towering up intermediate fields F<sub>q<sup>a</sup></sub> and F<sub>q<sup>b</sup></sub> such that k = a^i b^j, where a and b are usually 2 and 3. One of the reasons tower extensions work is that quadratic and cubic extensions (F<sub>q<sup>2</sup></sub> and F<sub>q<sup>3</sup></sub>) offer methods of performing arithmetic more efficiently.--Miller's algorithm in the Tate pairing iterates as far as the prime group order `r`, which is a large number in cryptography. The ate pairing comes up as an optimization of the Tate pairing by shortening Miller's loop. It achieves a much shorter loop of length T = t - 1 on an ordinary curve, where t is the trace of the Frobenius endomorphism. The ate pairing is defined as:--at(Q,P) = f<sub>r,Q</sub>(P)<sup>(q<sup>k</sup> - 1) / r</sup>--## Implementation--We have implemented a polymorphic optimal ate pairing over the following pairing-friendly elliptic curves:--* Barreto-Lynn-Scott degree 12 curves- * [BLS12381](src/Data/Pairing/BLS12381.hs)-* Barreto-Naehrig curves- * [BN254](src/Data/Pairing/BN254.hs)- * [BN254A](src/Data/Pairing/BN254A.hs)- * [BN254B](src/Data/Pairing/BN254B.hs)- * [BN254C](src/Data/Pairing/BN254C.hs)- * [BN254D](src/Data/Pairing/BN254D.hs)- * [BN462](src/Data/Pairing/BN462.hs)--A more detailed documentation on their domain parameters can be found in our [elliptic curve library](https://github.com/adjoint-io/elliptic-curve).--## License--```-Copyright (c) 2018-2019 Adjoint Inc.--Permission is hereby granted, free of charge, to any person obtaining a copy-of this software and associated documentation files (the "Software"), to deal-in the Software without restriction, including without limitation the rights-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell-copies of the Software, and to permit persons to whom the Software is-furnished to do so, subject to the following conditions:--The above copyright notice and this permission notice shall be included in all-copies or substantial portions of the Software.--THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,-DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR-OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE-OR OTHER DEALINGS IN THE SOFTWARE.-```
+ README.notex.md view
@@ -0,0 +1,164 @@+<p align="center">+<a href="https://www.adjoint.io">+ <img width="250" src="./.assets/adjoint.png" alt="Adjoint Logo" />+</a>+</p>++[](https://hackage.haskell.org/package/pairing)++Implementation of the Barreto-Naehrig (BN) curve construction from+[[BCTV2015]](https://eprint.iacr.org/2013/879.pdf) to provide two cyclic groups+**G<sub>1</sub>** and **G<sub>2</sub>**, with an efficient bilinear pairing:++*e: G<sub>1</sub> × G<sub>2</sub> → G<sub>T</sub>*++# Pairing++Let G<sub>1</sub>, G<sub>2</sub> and G<sub>T</sub> be abelian groups of prime order `q` and let `g` and `h` elements of G<sub>1</sub> and G<sub>2</sub> respectively . A pairing is a non-degenerate bilinear map e: G<sub>1</sub> × G<sub>2</sub> → G<sub>T</sub>.++This bilinearity property is what makes pairings such a powerful primitive in cryptography. It satisfies:+- e(g<sub>1</sub> + g<sub>2</sub>, h) = e(g<sub>1</sub>, h) e(g<sub>2</sub>, h)+- e(g, h<sub>1</sub> + h<sub>2</sub>) = e(g, h<sub>1</sub>) e(g, h<sub>2</sub>)+++The non-degeneracy property guarantees non-trivial pairings for non-trivial arguments. In other words, being non-degenerate means that:+- ∀ g ≠ 1, ∃ h<sub>i</sub> ∈ G<sub>2</sub> such that e(g, h<sub>i</sub>) ≠ 1+- ∀ h ≠ 1, ∃ g<sub>i</sub> ∈ G<sub>1</sub> such that e(g<sub>i</sub>, h) ≠ 1++An example of a pairing would be the scalar product on euclidean space <.> : R<sup>n</sup> × R<sup>n</sup> → R++## Example Usage++A simple example of calculating the optimal ate pairing given two points in G<sub>1</sub> and G<sub>2</sub>.++```haskell+import Protolude++import Data.Group (pow)+import Data.Curve.Weierstrass (Point(A), mul')++import Data.Pairing.BN254 (BN254, G1, G2, pairing)++p :: G1 BN254+p = A+ 1368015179489954701390400359078579693043519447331113978918064868415326638035+ 9918110051302171585080402603319702774565515993150576347155970296011118125764+++q :: G2 BN254+q = A+ [2725019753478801796453339367788033689375851816420509565303521482350756874229+ ,7273165102799931111715871471550377909735733521218303035754523677688038059653+ ]+ [2512659008974376214222774206987427162027254181373325676825515531566330959255+ ,957874124722006818841961785324909313781880061366718538693995380805373202866+ ]++main :: IO ()+main = do+ putText "P:"+ print $ p+ putText "Q:"+ print $ q+ putText "e(P, Q):"+ print $ pairing p q+ putText "e(P, Q) is bilinear:"+ print $ pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b)+ where+ a = 2 :: Int+ b = 3 :: Int+```++## Pairings in cryptography++Pairings are used in encryption algorithms, such as identity-based encryption (IBE), attribute-based encryption (ABE), (inner-product) predicate encryption, short broadcast encryption and searchable encryption, among others. It allows strong encryption with small signature sizes.++## Admissible Pairings++A pairing `e` is called admissible pairing if it is efficiently computable. The only admissible pairings that are suitable for cryptography are the Weil and Tate pairings on algebraic curves and their variants. Let `r` be the order of a group and E[r] be the entire group of points of order `r` on E(F<sub>q</sub>). E[r] is called the r-torsion and is defined as E[r] = { P ∈ E(F<sub>q</sub>) | rP = O }. Both Weil and Tate pairings require that `P` and `Q` come from disjoint cyclic subgroups of the same prime order `r`. Lagrange's theorem states that for any finite group `G`, the order (number of elements) of every subgroup `H` of `G` divides the order of `G`. Therefore, r | #E(F<sub>q</sub>).++G<sub>1</sub> and G<sub>2</sub> are subgroups of a group defined in an elliptic curve over an extension of a finite field F<sub>q</sub>, namely E(F<sub>q<sup>k</sup></sub>), where `q` is the characteristic of the field and `k` is a positive integer called embedding degree.++The embedding degree `k` plays a crucial role in pairing cryptography:+- It's the value that makes F<sub>q<sup>k</sup></sub> be the smallest extension of F<sub>q</sub> such that E(F<sub>q<sup>k</sup></sub>) captures more points of order `r`.+- It's the minimal value that holds r | (q<sup>k</sup> - 1).+- It's the smallest positive integer such that E[r] ⊂ E(F<sub>q<sup>k</sup></sub>)++There are subtle but relevant differences in G<sub>1</sub> and G<sub>2</sub> subgroups depending on the type of pairing. Nowadays, all of the state-of-the-art implementations of pairings take place on ordinary curves and assume a type of pairing (Type 3) where G<sub>1</sub> = E[r] ∩ Ker(π - [1]) and G<sub>2</sub> = E[r] ∩ Ker(π - [q]) and there is no non-trivial map φ: G<sub>2</sub> → G<sub>1</sub>.++## Tate Pairing++The Tate pairing is a map:++tr : E(F<sub>q<sup>k</sup></sub>)[r] × E(F<sub>q<sup>k</sup></sub>) / rE(F<sub>q<sup>k</sup></sub>) → F<sup>*</sup><sub>q<sup>k</sup></sub> / (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup>++defined as:++tr(P, Q) = f(Q)++where P ∈ E(F<sub>q<sup>k</sup></sub>)[r], Q is any representative in a equivalence class in E(F<sub>q<sup>k</sup></sub>) / rE(F<sub>q<sup>k</sup></sub>) and F<sup>*</sup><sub>q<sup>k</sup></sub> / (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup> is the set of equivalence classes of F<sup>*</sup><sub>q<sup>k</sup></sub> under the equivalence relation a ≡ b iff a / b ∈ (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup>. The equivalence relation in the output of the Tate pairing is unfortunate. In cryptography, different parties must compute the same value under the bilinearity property.++The reduced Tate pairing solves this undesirable property by exponentiating elements in F<sup>*</sup><sub>q<sup>k</sup></sub> / (F<sup>*</sup><sub>q<sup>k</sup></sub>)<sup>r</sup> to the power of (q<sup>k</sup> - 1) / r. It maps all elements in an equivalence class to the same value. It is defined as:++Tr(P, Q) = t<sub>r</sub>(P, Q)<sup>#F<sub>q<sup>k</sup></sub> / r</sup> = f<sub>r</sub>,P(Q)<sup>(q<sup>k</sup> - 1) / r</sup>.++When we say Tate pairing, we normally mean the reduced Tate pairing.++## Pairing optimization++Tate pairings use Miller's algorithm, which is essentially the double-and-add algorithm for elliptic curve point multiplication combined with evaluation of the functions used in the addition process. Miller's algorithm remains the fastest algorithm for computing pairings to date.++Both G<sub>1</sub> and G<sub>2</sub> are elliptic curve groups. G<sub>T</sub> is a multiplicative subgroup of a finite field. The security an elliptic curve group offers per bit is considerably greater than the security a finite field does. In order to achieve security comparable to 128-bit security (AES-128), an elliptic curve of 256 bits will suffice, while we need a finite field of 3248 bits. The aim of a cryptographic protocol is to achieve the highest security degree with the smallest signature size, which normally leads to a more efficient computation. In pairing cryptography, significant improvements can be made by keeping all three group sizes the same. It is possible to find elliptic curves over a field F<sub>q</sub> whose largest prime order subgroup `r` has the same bit-size as the characteristic of the field `q`. The ratio between the field size `q` and the large prime group order `r` is called the φ-value. It is an important value that indicates how much (ECDLP) security a curve offers for its field size. φ=1 is the optimal value. The Barreto-Naehrig (BN) family of curves all have φ=1 and k=12. They are perfectly suited to the 128-bit security level.++Most operations in pairings happen in the extension field F<sub>q<sup>k</sup></sub>. The larger k gets, the more complex F<sub>q<sup>k</sup></sub> becomes and the more computationally expensive the pairing becomes. The complexity of Miller's algorithm heavily depends on the complexity of the associated F<sub>q<sup>k</sup></sub>-arithmetic. Therefore, the aim is to minimize the cost of arithmetic in F<sub>q<sup>k</sup></sub>.++It is possible to construct an extension of a field F<sub>q<sup>k</sup></sub> by successively towering up intermediate fields F<sub>q<sup>a</sup></sub> and F<sub>q<sup>b</sup></sub> such that k = a^i b^j, where a and b are usually 2 and 3. One of the reasons tower extensions work is that quadratic and cubic extensions (F<sub>q<sup>2</sup></sub> and F<sub>q<sup>3</sup></sub>) offer methods of performing arithmetic more efficiently.++Miller's algorithm in the Tate pairing iterates as far as the prime group order `r`, which is a large number in cryptography. The ate pairing comes up as an optimization of the Tate pairing by shortening Miller's loop. It achieves a much shorter loop of length T = t - 1 on an ordinary curve, where t is the trace of the Frobenius endomorphism. The ate pairing is defined as:++at(Q,P) = f<sub>r,Q</sub>(P)<sup>(q<sup>k</sup> - 1) / r</sup>++## Implementation++We have implemented a polymorphic optimal ate pairing over the following pairing-friendly elliptic curves:++* Barreto-Lynn-Scott degree 12 curves+ * [BLS12381](src/Data/Pairing/BLS12381.hs)+* Barreto-Naehrig curves+ * [BN254](src/Data/Pairing/BN254.hs)+ * [BN254A](src/Data/Pairing/BN254A.hs)+ * [BN254B](src/Data/Pairing/BN254B.hs)+ * [BN254C](src/Data/Pairing/BN254C.hs)+ * [BN254D](src/Data/Pairing/BN254D.hs)+ * [BN462](src/Data/Pairing/BN462.hs)++A more detailed documentation on their domain parameters can be found in our [elliptic curve library](https://github.com/adjoint-io/elliptic-curve).++## Disclaimer++This is experimental code meant for research-grade projects only. Please do not+use this code in production until it has matured significantly.++## License++```+Copyright (c) 2018-2019 Adjoint Inc.++Permission is hereby granted, free of charge, to any person obtaining a copy+of this software and associated documentation files (the "Software"), to deal+in the Software without restriction, including without limitation the rights+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell+copies of the Software, and to permit persons to whom the Software is+furnished to do so, subject to the following conditions:++The above copyright notice and this permission notice shall be included in all+copies or substantial portions of the Software.++THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE+OR OTHER DEALINGS IN THE SOFTWARE.+```
pairing.cabal view
@@ -1,117 +1,207 @@-cabal-version: 1.12+cabal-version: 1.12 -- This file has been generated from package.yaml by hpack version 0.31.2. -- -- see: https://github.com/sol/hpack ----- hash: 4557c34ff1d521a4f852373a67aecb963ea5357ddecdf3dcaaf0bc28bb58897f+-- hash: f0737c857596bf304a755a35a010ab47b55eb69259a1c3a8519f7e28505f3fb8 -name: pairing-version: 1.0.0-synopsis: Bilinear pairings-description: Optimal Ate pairing over Barreto-Naehrig curves-category: Cryptography-homepage: https://github.com/adjoint-io/pairing#readme-bug-reports: https://github.com/adjoint-io/pairing/issues-maintainer: Adjoint Inc (info@adjoint.io)-license: MIT-license-file: LICENSE-build-type: Simple+name: pairing+version: 1.1.0+synopsis: Bilinear pairings+description: Bilinear pairings over elliptic curves+category: Cryptography+homepage: https://github.com/adjoint-io/pairing#readme+bug-reports: https://github.com/adjoint-io/pairing/issues+maintainer: Adjoint Inc (info@adjoint.io)+license: MIT+license-file: LICENSE+build-type: Simple extra-source-files:- README.md- ChangeLog.md+ README.notex.md+ ChangeLog.md source-repository head- type: git+ type: git location: https://github.com/adjoint-io/pairing library exposed-modules:- Data.Pairing- Data.Pairing.Ate- Data.Pairing.BLS12381- Data.Pairing.BN254- Data.Pairing.BN254A- Data.Pairing.BN254B- Data.Pairing.BN254C- Data.Pairing.BN254D- Data.Pairing.BN462- Data.Pairing.Hash- other-modules:- Paths_pairing- hs-source-dirs:- src- default-extensions: LambdaCase RecordWildCards OverloadedStrings NoImplicitPrelude FlexibleInstances FlexibleContexts ScopedTypeVariables RankNTypes ConstraintKinds DataKinds DeriveGeneric GeneralizedNewtypeDeriving MultiParamTypeClasses OverloadedLists PatternSynonyms TypeFamilyDependencies- ghc-options: -freverse-errors -O2 -Wall+ Data.Pairing+ Data.Pairing.Ate+ Data.Pairing.BLS12381+ Data.Pairing.BN254+ Data.Pairing.BN254A+ Data.Pairing.BN254B+ Data.Pairing.BN254C+ Data.Pairing.BN254D+ Data.Pairing.BN462+ Data.Pairing.Hash++ other-modules: Paths_pairing+ hs-source-dirs: src+ default-extensions:+ NoImplicitPrelude+ ConstraintKinds+ DataKinds+ DeriveGeneric+ FlexibleContexts+ FlexibleInstances+ GeneralizedNewtypeDeriving+ LambdaCase+ MultiParamTypeClasses+ OverloadedLists+ OverloadedStrings+ PatternSynonyms+ RankNTypes+ RecordWildCards+ ScopedTypeVariables+ TypeFamilyDependencies++ ghc-options: -freverse-errors -O2 -Wall build-depends:- MonadRandom- , base >=4.10 && <5- , bytestring- , elliptic-curve >=0.3 && <0.4- , errors- , galois-field >=1 && <2- , groups- , protolude >=0.2 && <0.3- , tasty-quickcheck- default-language: Haskell2010+ base >=4.10 && <5+ , bytestring >=0.10.8 && <0.11+ , elliptic-curve >=0.3 && <0.4+ , errors >=2.3.0 && <2.4+ , galois-field >=1.0.2 && <2.0+ , groups >=0.4.1 && <0.5+ , MonadRandom >=0.5.1 && <0.6+ , protolude >=0.2 && <0.3+ , tasty-quickcheck >=0.10.1 && <0.11 + default-language: Haskell2010++test-suite example-tests+ type: exitcode-stdio-1.0+ main-is: Example.hs+ other-modules: Paths_pairing+ default-extensions:+ NoImplicitPrelude+ ConstraintKinds+ DataKinds+ DeriveGeneric+ FlexibleContexts+ FlexibleInstances+ GeneralizedNewtypeDeriving+ LambdaCase+ MultiParamTypeClasses+ OverloadedLists+ OverloadedStrings+ PatternSynonyms+ RankNTypes+ RecordWildCards+ ScopedTypeVariables+ TypeFamilyDependencies++ ghc-options: -freverse-errors -O2 -Wall+ build-depends:+ base >=4.10 && <5+ , bytestring >=0.10.8 && <0.11+ , elliptic-curve >=0.3 && <0.4+ , errors >=2.3.0 && <2.4+ , galois-field >=1.0.2 && <2.0+ , groups >=0.4.1 && <0.5+ , MonadRandom >=0.5.1 && <0.6+ , pairing+ , protolude >=0.2 && <0.3+ , tasty-quickcheck >=0.10.1 && <0.11++ default-language: Haskell2010+ test-suite pairing-tests- type: exitcode-stdio-1.0- main-is: Main.hs+ type: exitcode-stdio-1.0+ main-is: Main.hs other-modules:- Test.BLS12381- Test.BN254- Test.BN254A- Test.BN254B- Test.BN254C- Test.BN254D- Test.BN462- Test.Curve- Test.Field- Test.Pairing- Paths_pairing- hs-source-dirs:- test- default-extensions: LambdaCase RecordWildCards OverloadedStrings NoImplicitPrelude FlexibleInstances FlexibleContexts ScopedTypeVariables RankNTypes ConstraintKinds DataKinds DeriveGeneric GeneralizedNewtypeDeriving MultiParamTypeClasses OverloadedLists PatternSynonyms TypeFamilyDependencies- ghc-options: -freverse-errors -O2 -Wall -main-is Main+ Paths_pairing+ Test.BLS12381+ Test.BN254+ Test.BN254A+ Test.BN254B+ Test.BN254C+ Test.BN254D+ Test.BN462+ Test.Curve+ Test.Field+ Test.Pairing++ hs-source-dirs: test+ default-extensions:+ NoImplicitPrelude+ ConstraintKinds+ DataKinds+ DeriveGeneric+ FlexibleContexts+ FlexibleInstances+ GeneralizedNewtypeDeriving+ LambdaCase+ MultiParamTypeClasses+ OverloadedLists+ OverloadedStrings+ PatternSynonyms+ RankNTypes+ RecordWildCards+ ScopedTypeVariables+ TypeFamilyDependencies++ ghc-options: -freverse-errors -O2 -Wall -main-is Main build-depends:- MonadRandom- , QuickCheck- , base >=4.10 && <5- , bytestring- , elliptic-curve >=0.3 && <0.4- , errors- , galois-field >=1 && <2- , groups+ base >=4.10 && <5+ , bytestring >=0.10.8 && <0.11+ , elliptic-curve >=0.3 && <0.4+ , errors >=2.3.0 && <2.4+ , galois-field >=1.0.2 && <2.0+ , groups >=0.4.1 && <0.5+ , MonadRandom >=0.5.1 && <0.6 , pairing- , protolude >=0.2 && <0.3+ , protolude >=0.2 && <0.3+ , QuickCheck , quickcheck-instances , tasty , tasty-hunit , tasty-quickcheck- default-language: Haskell2010 + default-language: Haskell2010+ benchmark pairing-benchmarks- type: exitcode-stdio-1.0- main-is: Main.hs+ type: exitcode-stdio-1.0+ main-is: Main.hs other-modules:- Bench.Hash- Bench.Pairing- Paths_pairing- hs-source-dirs:- bench- default-extensions: LambdaCase RecordWildCards OverloadedStrings NoImplicitPrelude FlexibleInstances FlexibleContexts ScopedTypeVariables RankNTypes ConstraintKinds DataKinds DeriveGeneric GeneralizedNewtypeDeriving MultiParamTypeClasses OverloadedLists PatternSynonyms TypeFamilyDependencies- ghc-options: -freverse-errors -O2 -Wall -main-is Main+ Bench.Hash+ Bench.Pairing+ Paths_pairing++ hs-source-dirs: bench+ default-extensions:+ NoImplicitPrelude+ ConstraintKinds+ DataKinds+ DeriveGeneric+ FlexibleContexts+ FlexibleInstances+ GeneralizedNewtypeDeriving+ LambdaCase+ MultiParamTypeClasses+ OverloadedLists+ OverloadedStrings+ PatternSynonyms+ RankNTypes+ RecordWildCards+ ScopedTypeVariables+ TypeFamilyDependencies++ ghc-options: -freverse-errors -O2 -Wall -main-is Main build-depends:- MonadRandom- , base >=4.10 && <5- , bytestring+ base >=4.10 && <5+ , bytestring >=0.10.8 && <0.11 , criterion- , elliptic-curve >=0.3 && <0.4- , errors- , galois-field >=1 && <2- , groups+ , elliptic-curve >=0.3 && <0.4+ , errors >=2.3.0 && <2.4+ , galois-field >=1.0.2 && <2.0+ , groups >=0.4.1 && <0.5+ , MonadRandom >=0.5.1 && <0.6 , pairing- , protolude >=0.2 && <0.3- , tasty-quickcheck- default-language: Haskell2010+ , protolude >=0.2 && <0.3+ , tasty-quickcheck >=0.10.1 && <0.11++ default-language: Haskell2010
src/Data/Pairing/Ate.hs view
@@ -11,7 +11,7 @@ import Protolude import Data.Curve.Weierstrass (Curve(..), Point(..))-import Data.Field.Galois as F hiding (recip, (/))+import Data.Field.Galois as F import Data.Pairing
src/Data/Pairing/Hash.hs view
@@ -12,7 +12,7 @@ import Control.Monad.Random (MonadRandom) import qualified Data.ByteString as B (foldl') import Data.Curve.Weierstrass-import Data.Field.Galois as F hiding ((/))+import Data.Field.Galois as F import Data.List ((!!)) import Data.Pairing@@ -38,14 +38,14 @@ -- The implementation uses the Shallue-van de Woestijne encoding to BN curves -- as specified in Section 6 of [Indifferentiable Hashing to Barreto-Naehrig Curves] -- (https://www.di.ens.fr/~fouque/pub/latincrypt12.pdf).--- +-- -- This function evaluates an empty bytestring or one that contains \NUL -- to zero and is sent to an arbitrary point on the curve. swEncBN :: forall e m q r u v w . (MonadRandom m, ECPairing e q r u v w) => ByteString -> m (Maybe (G1 e)) swEncBN bs = runMaybeT $ do sqrt3 <- hoistMaybe $ sr $ -3- let t = fromBytes bs+ let t = fromInteger $ fromBytes bs s1 = (sqrt3 - 1) / 2 b1 = 1 + b_ (witness :: G1 e) guard (b1 + t * t /= 0)@@ -82,7 +82,7 @@ ------------------------------------------------------------------------------- -- Conversion from bytestring to field.-fromBytes :: (Bits k, Num k) => ByteString -> k+fromBytes :: ByteString -> Integer fromBytes = B.foldl' f 0 where f a b = shiftL a 8 .|. fromIntegral b