diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,9 @@
# Change log for pairing
+## 1.1.0
+
+* Bump bounds for galois-field and poly.
+
## 1.0.0
* Refactor library structure from `Pairing.Pairing` to `Data.Pairing`.
diff --git a/Example.hs b/Example.hs
new file mode 100644
--- /dev/null
+++ b/Example.hs
@@ -0,0 +1,36 @@
+module Main where
+
+import Data.Curve.Weierstrass (Point (A), mul')
+import Data.Group (pow)
+import Data.Pairing.BN254 (BN254, G1, G2, pairing)
+import Protolude
+
+p :: G1 BN254
+p =
+ A
+ 1368015179489954701390400359078579693043519447331113978918064868415326638035
+ 9918110051302171585080402603319702774565515993150576347155970296011118125764
+
+q :: G2 BN254
+q =
+ A
+ [ 2725019753478801796453339367788033689375851816420509565303521482350756874229,
+ 7273165102799931111715871471550377909735733521218303035754523677688038059653
+ ]
+ [ 2512659008974376214222774206987427162027254181373325676825515531566330959255,
+ 957874124722006818841961785324909313781880061366718538693995380805373202866
+ ]
+
+main :: IO ()
+main = do
+ putText "P:"
+ print p
+ putText "Q:"
+ print q
+ putText "e(P, Q):"
+ print (pairing p q)
+ putText "e(P, Q) is bilinear:"
+ print $ pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b)
+ where
+ a = 2 :: Int
+ b = 3 :: Int
diff --git a/LICENSE b/LICENSE
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2018-2019 Adjoint Inc.
+Copyright (c) 2018-2020 Adjoint Inc.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
deleted file mode 100644
--- a/README.md
+++ /dev/null
@@ -1,159 +0,0 @@
-
-
- 
-
-
-
-[](https://hackage.haskell.org/package/pairing)
-
-Implementation of the Barreto-Naehrig (BN) curve construction from
-[[BCTV2015]](https://eprint.iacr.org/2013/879.pdf) to provide two cyclic groups
-**G1** and **G2**, with an efficient bilinear pairing:
-
-*e: G1 × G2 → GT*
-
-# Pairing
-
-Let G1, G2 and GT be abelian groups of prime order `q` and let `g` and `h` elements of G1 and G2 respectively . A pairing is a non-degenerate bilinear map e: G1 × G2 → GT.
-
-This bilinearity property is what makes pairings such a powerful primitive in cryptography. It satisfies:
-- e(g1 + g2, h) = e(g1, h) e(g2, h)
-- e(g, h1 + h2) = e(g, h1) e(g, h2)
-
-
-The non-degeneracy property guarantees non-trivial pairings for non-trivial arguments. In other words, being non-degenerate means that:
-- ∀ g ≠ 1, ∃ hi ∈ G2 such that e(g, hi) ≠ 1
-- ∀ h ≠ 1, ∃ gi ∈ G1 such that e(gi, h) ≠ 1
-
-An example of a pairing would be the scalar product on euclidean space <.> : Rn × Rn → R
-
-## Example Usage
-
-A simple example of calculating the optimal ate pairing given two points in G1 and G2.
-
-```haskell
-import Protolude
-
-import Data.Group (pow)
-import Data.Curve.Weierstrass (Point(A), mul')
-
-import Data.Pairing.BN254 (BN254, G1, G2, pairing)
-
-p :: G1 BN254
-p = A
- 1368015179489954701390400359078579693043519447331113978918064868415326638035
- 9918110051302171585080402603319702774565515993150576347155970296011118125764
-
-
-q :: G2 BN254
-q = A
- [2725019753478801796453339367788033689375851816420509565303521482350756874229
- ,7273165102799931111715871471550377909735733521218303035754523677688038059653
- ]
- [2512659008974376214222774206987427162027254181373325676825515531566330959255
- ,957874124722006818841961785324909313781880061366718538693995380805373202866
- ]
-
-main :: IO ()
-main = do
- putText "P:"
- print $ p
- putText "Q:"
- print $ q
- putText "e(P, Q):"
- print $ pairing p q
- putText "e(P, Q) is bilinear:"
- print $ pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b)
- where
- a = 2 :: Int
- b = 3 :: Int
-```
-
-## Pairings in cryptography
-
-Pairings are used in encryption algorithms, such as identity-based encryption (IBE), attribute-based encryption (ABE), (inner-product) predicate encryption, short broadcast encryption and searchable encryption, among others. It allows strong encryption with small signature sizes.
-
-## Admissible Pairings
-
-A pairing `e` is called admissible pairing if it is efficiently computable. The only admissible pairings that are suitable for cryptography are the Weil and Tate pairings on algebraic curves and their variants. Let `r` be the order of a group and E[r] be the entire group of points of order `r` on E(Fq). E[r] is called the r-torsion and is defined as E[r] = { P ∈ E(Fq) | rP = O }. Both Weil and Tate pairings require that `P` and `Q` come from disjoint cyclic subgroups of the same prime order `r`. Lagrange's theorem states that for any finite group `G`, the order (number of elements) of every subgroup `H` of `G` divides the order of `G`. Therefore, r | #E(Fq).
-
-G1 and G2 are subgroups of a group defined in an elliptic curve over an extension of a finite field Fq, namely E(Fqk), where `q` is the characteristic of the field and `k` is a positive integer called embedding degree.
-
-The embedding degree `k` plays a crucial role in pairing cryptography:
-- It's the value that makes Fqk be the smallest extension of Fq such that E(Fqk) captures more points of order `r`.
-- It's the minimal value that holds r | (qk - 1).
-- It's the smallest positive integer such that E[r] ⊂ E(Fqk)
-
-There are subtle but relevant differences in G1 and G2 subgroups depending on the type of pairing. Nowadays, all of the state-of-the-art implementations of pairings take place on ordinary curves and assume a type of pairing (Type 3) where G1 = E[r] ∩ Ker(π - [1]) and G2 = E[r] ∩ Ker(π - [q]) and there is no non-trivial map φ: G2 → G1.
-
-## Tate Pairing
-
-The Tate pairing is a map:
-
-tr : E(Fqk)[r] × E(Fqk) / rE(Fqk) → F*qk / (F*qk)r
-
-defined as:
-
-tr(P, Q) = f(Q)
-
-where P ∈ E(Fqk)[r], Q is any representative in a equivalence class in E(Fqk) / rE(Fqk) and F*qk / (F*qk)r is the set of equivalence classes of F*qk under the equivalence relation a ≡ b iff a / b ∈ (F*qk)r. The equivalence relation in the output of the Tate pairing is unfortunate. In cryptography, different parties must compute the same value under the bilinearity property.
-
-The reduced Tate pairing solves this undesirable property by exponentiating elements in F*qk / (F*qk)r to the power of (qk - 1) / r. It maps all elements in an equivalence class to the same value. It is defined as:
-
-Tr(P, Q) = tr(P, Q)#Fqk / r = fr,P(Q)(qk - 1) / r.
-
-When we say Tate pairing, we normally mean the reduced Tate pairing.
-
-## Pairing optimization
-
-Tate pairings use Miller's algorithm, which is essentially the double-and-add algorithm for elliptic curve point multiplication combined with evaluation of the functions used in the addition process. Miller's algorithm remains the fastest algorithm for computing pairings to date.
-
-Both G1 and G2 are elliptic curve groups. GT is a multiplicative subgroup of a finite field. The security an elliptic curve group offers per bit is considerably greater than the security a finite field does. In order to achieve security comparable to 128-bit security (AES-128), an elliptic curve of 256 bits will suffice, while we need a finite field of 3248 bits. The aim of a cryptographic protocol is to achieve the highest security degree with the smallest signature size, which normally leads to a more efficient computation. In pairing cryptography, significant improvements can be made by keeping all three group sizes the same. It is possible to find elliptic curves over a field Fq whose largest prime order subgroup `r` has the same bit-size as the characteristic of the field `q`. The ratio between the field size `q` and the large prime group order `r` is called the φ-value. It is an important value that indicates how much (ECDLP) security a curve offers for its field size. φ=1 is the optimal value. The Barreto-Naehrig (BN) family of curves all have φ=1 and k=12. They are perfectly suited to the 128-bit security level.
-
-Most operations in pairings happen in the extension field Fqk. The larger k gets, the more complex Fqk becomes and the more computationally expensive the pairing becomes. The complexity of Miller's algorithm heavily depends on the complexity of the associated Fqk-arithmetic. Therefore, the aim is to minimize the cost of arithmetic in Fqk.
-
-It is possible to construct an extension of a field Fqk by successively towering up intermediate fields Fqa and Fqb such that k = a^i b^j, where a and b are usually 2 and 3. One of the reasons tower extensions work is that quadratic and cubic extensions (Fq2 and Fq3) offer methods of performing arithmetic more efficiently.
-
-Miller's algorithm in the Tate pairing iterates as far as the prime group order `r`, which is a large number in cryptography. The ate pairing comes up as an optimization of the Tate pairing by shortening Miller's loop. It achieves a much shorter loop of length T = t - 1 on an ordinary curve, where t is the trace of the Frobenius endomorphism. The ate pairing is defined as:
-
-at(Q,P) = fr,Q(P)(qk - 1) / r
-
-## Implementation
-
-We have implemented a polymorphic optimal ate pairing over the following pairing-friendly elliptic curves:
-
-* Barreto-Lynn-Scott degree 12 curves
- * [BLS12381](src/Data/Pairing/BLS12381.hs)
-* Barreto-Naehrig curves
- * [BN254](src/Data/Pairing/BN254.hs)
- * [BN254A](src/Data/Pairing/BN254A.hs)
- * [BN254B](src/Data/Pairing/BN254B.hs)
- * [BN254C](src/Data/Pairing/BN254C.hs)
- * [BN254D](src/Data/Pairing/BN254D.hs)
- * [BN462](src/Data/Pairing/BN462.hs)
-
-A more detailed documentation on their domain parameters can be found in our [elliptic curve library](https://github.com/adjoint-io/elliptic-curve).
-
-## License
-
-```
-Copyright (c) 2018-2019 Adjoint Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-OR OTHER DEALINGS IN THE SOFTWARE.
-```
diff --git a/README.notex.md b/README.notex.md
new file mode 100644
--- /dev/null
+++ b/README.notex.md
@@ -0,0 +1,164 @@
+
+
+
+
+
+
+[](https://hackage.haskell.org/package/pairing)
+
+Implementation of the Barreto-Naehrig (BN) curve construction from
+[[BCTV2015]](https://eprint.iacr.org/2013/879.pdf) to provide two cyclic groups
+**G1** and **G2**, with an efficient bilinear pairing:
+
+*e: G1 × G2 → GT*
+
+# Pairing
+
+Let G1, G2 and GT be abelian groups of prime order `q` and let `g` and `h` elements of G1 and G2 respectively . A pairing is a non-degenerate bilinear map e: G1 × G2 → GT.
+
+This bilinearity property is what makes pairings such a powerful primitive in cryptography. It satisfies:
+- e(g1 + g2, h) = e(g1, h) e(g2, h)
+- e(g, h1 + h2) = e(g, h1) e(g, h2)
+
+
+The non-degeneracy property guarantees non-trivial pairings for non-trivial arguments. In other words, being non-degenerate means that:
+- ∀ g ≠ 1, ∃ hi ∈ G2 such that e(g, hi) ≠ 1
+- ∀ h ≠ 1, ∃ gi ∈ G1 such that e(gi, h) ≠ 1
+
+An example of a pairing would be the scalar product on euclidean space <.> : Rn × Rn → R
+
+## Example Usage
+
+A simple example of calculating the optimal ate pairing given two points in G1 and G2.
+
+```haskell
+import Protolude
+
+import Data.Group (pow)
+import Data.Curve.Weierstrass (Point(A), mul')
+
+import Data.Pairing.BN254 (BN254, G1, G2, pairing)
+
+p :: G1 BN254
+p = A
+ 1368015179489954701390400359078579693043519447331113978918064868415326638035
+ 9918110051302171585080402603319702774565515993150576347155970296011118125764
+
+
+q :: G2 BN254
+q = A
+ [2725019753478801796453339367788033689375851816420509565303521482350756874229
+ ,7273165102799931111715871471550377909735733521218303035754523677688038059653
+ ]
+ [2512659008974376214222774206987427162027254181373325676825515531566330959255
+ ,957874124722006818841961785324909313781880061366718538693995380805373202866
+ ]
+
+main :: IO ()
+main = do
+ putText "P:"
+ print $ p
+ putText "Q:"
+ print $ q
+ putText "e(P, Q):"
+ print $ pairing p q
+ putText "e(P, Q) is bilinear:"
+ print $ pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b)
+ where
+ a = 2 :: Int
+ b = 3 :: Int
+```
+
+## Pairings in cryptography
+
+Pairings are used in encryption algorithms, such as identity-based encryption (IBE), attribute-based encryption (ABE), (inner-product) predicate encryption, short broadcast encryption and searchable encryption, among others. It allows strong encryption with small signature sizes.
+
+## Admissible Pairings
+
+A pairing `e` is called admissible pairing if it is efficiently computable. The only admissible pairings that are suitable for cryptography are the Weil and Tate pairings on algebraic curves and their variants. Let `r` be the order of a group and E[r] be the entire group of points of order `r` on E(Fq). E[r] is called the r-torsion and is defined as E[r] = { P ∈ E(Fq) | rP = O }. Both Weil and Tate pairings require that `P` and `Q` come from disjoint cyclic subgroups of the same prime order `r`. Lagrange's theorem states that for any finite group `G`, the order (number of elements) of every subgroup `H` of `G` divides the order of `G`. Therefore, r | #E(Fq).
+
+G1 and G2 are subgroups of a group defined in an elliptic curve over an extension of a finite field Fq, namely E(Fqk), where `q` is the characteristic of the field and `k` is a positive integer called embedding degree.
+
+The embedding degree `k` plays a crucial role in pairing cryptography:
+- It's the value that makes Fqk be the smallest extension of Fq such that E(Fqk) captures more points of order `r`.
+- It's the minimal value that holds r | (qk - 1).
+- It's the smallest positive integer such that E[r] ⊂ E(Fqk)
+
+There are subtle but relevant differences in G1 and G2 subgroups depending on the type of pairing. Nowadays, all of the state-of-the-art implementations of pairings take place on ordinary curves and assume a type of pairing (Type 3) where G1 = E[r] ∩ Ker(π - [1]) and G2 = E[r] ∩ Ker(π - [q]) and there is no non-trivial map φ: G2 → G1.
+
+## Tate Pairing
+
+The Tate pairing is a map:
+
+tr : E(Fqk)[r] × E(Fqk) / rE(Fqk) → F*qk / (F*qk)r
+
+defined as:
+
+tr(P, Q) = f(Q)
+
+where P ∈ E(Fqk)[r], Q is any representative in a equivalence class in E(Fqk) / rE(Fqk) and F*qk / (F*qk)r is the set of equivalence classes of F*qk under the equivalence relation a ≡ b iff a / b ∈ (F*qk)r. The equivalence relation in the output of the Tate pairing is unfortunate. In cryptography, different parties must compute the same value under the bilinearity property.
+
+The reduced Tate pairing solves this undesirable property by exponentiating elements in F*qk / (F*qk)r to the power of (qk - 1) / r. It maps all elements in an equivalence class to the same value. It is defined as:
+
+Tr(P, Q) = tr(P, Q)#Fqk / r = fr,P(Q)(qk - 1) / r.
+
+When we say Tate pairing, we normally mean the reduced Tate pairing.
+
+## Pairing optimization
+
+Tate pairings use Miller's algorithm, which is essentially the double-and-add algorithm for elliptic curve point multiplication combined with evaluation of the functions used in the addition process. Miller's algorithm remains the fastest algorithm for computing pairings to date.
+
+Both G1 and G2 are elliptic curve groups. GT is a multiplicative subgroup of a finite field. The security an elliptic curve group offers per bit is considerably greater than the security a finite field does. In order to achieve security comparable to 128-bit security (AES-128), an elliptic curve of 256 bits will suffice, while we need a finite field of 3248 bits. The aim of a cryptographic protocol is to achieve the highest security degree with the smallest signature size, which normally leads to a more efficient computation. In pairing cryptography, significant improvements can be made by keeping all three group sizes the same. It is possible to find elliptic curves over a field Fq whose largest prime order subgroup `r` has the same bit-size as the characteristic of the field `q`. The ratio between the field size `q` and the large prime group order `r` is called the φ-value. It is an important value that indicates how much (ECDLP) security a curve offers for its field size. φ=1 is the optimal value. The Barreto-Naehrig (BN) family of curves all have φ=1 and k=12. They are perfectly suited to the 128-bit security level.
+
+Most operations in pairings happen in the extension field Fqk. The larger k gets, the more complex Fqk becomes and the more computationally expensive the pairing becomes. The complexity of Miller's algorithm heavily depends on the complexity of the associated Fqk-arithmetic. Therefore, the aim is to minimize the cost of arithmetic in Fqk.
+
+It is possible to construct an extension of a field Fqk by successively towering up intermediate fields Fqa and Fqb such that k = a^i b^j, where a and b are usually 2 and 3. One of the reasons tower extensions work is that quadratic and cubic extensions (Fq2 and Fq3) offer methods of performing arithmetic more efficiently.
+
+Miller's algorithm in the Tate pairing iterates as far as the prime group order `r`, which is a large number in cryptography. The ate pairing comes up as an optimization of the Tate pairing by shortening Miller's loop. It achieves a much shorter loop of length T = t - 1 on an ordinary curve, where t is the trace of the Frobenius endomorphism. The ate pairing is defined as:
+
+at(Q,P) = fr,Q(P)(qk - 1) / r
+
+## Implementation
+
+We have implemented a polymorphic optimal ate pairing over the following pairing-friendly elliptic curves:
+
+* Barreto-Lynn-Scott degree 12 curves
+ * [BLS12381](src/Data/Pairing/BLS12381.hs)
+* Barreto-Naehrig curves
+ * [BN254](src/Data/Pairing/BN254.hs)
+ * [BN254A](src/Data/Pairing/BN254A.hs)
+ * [BN254B](src/Data/Pairing/BN254B.hs)
+ * [BN254C](src/Data/Pairing/BN254C.hs)
+ * [BN254D](src/Data/Pairing/BN254D.hs)
+ * [BN462](src/Data/Pairing/BN462.hs)
+
+A more detailed documentation on their domain parameters can be found in our [elliptic curve library](https://github.com/adjoint-io/elliptic-curve).
+
+## Disclaimer
+
+This is experimental code meant for research-grade projects only. Please do not
+use this code in production until it has matured significantly.
+
+## License
+
+```
+Copyright (c) 2018-2019 Adjoint Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
+OR OTHER DEALINGS IN THE SOFTWARE.
+```
diff --git a/pairing.cabal b/pairing.cabal
--- a/pairing.cabal
+++ b/pairing.cabal
@@ -1,117 +1,207 @@
-cabal-version: 1.12
+cabal-version: 1.12
-- This file has been generated from package.yaml by hpack version 0.31.2.
--
-- see: https://github.com/sol/hpack
--
--- hash: 4557c34ff1d521a4f852373a67aecb963ea5357ddecdf3dcaaf0bc28bb58897f
+-- hash: f0737c857596bf304a755a35a010ab47b55eb69259a1c3a8519f7e28505f3fb8
-name: pairing
-version: 1.0.0
-synopsis: Bilinear pairings
-description: Optimal Ate pairing over Barreto-Naehrig curves
-category: Cryptography
-homepage: https://github.com/adjoint-io/pairing#readme
-bug-reports: https://github.com/adjoint-io/pairing/issues
-maintainer: Adjoint Inc (info@adjoint.io)
-license: MIT
-license-file: LICENSE
-build-type: Simple
+name: pairing
+version: 1.1.0
+synopsis: Bilinear pairings
+description: Bilinear pairings over elliptic curves
+category: Cryptography
+homepage: https://github.com/adjoint-io/pairing#readme
+bug-reports: https://github.com/adjoint-io/pairing/issues
+maintainer: Adjoint Inc (info@adjoint.io)
+license: MIT
+license-file: LICENSE
+build-type: Simple
extra-source-files:
- README.md
- ChangeLog.md
+ README.notex.md
+ ChangeLog.md
source-repository head
- type: git
+ type: git
location: https://github.com/adjoint-io/pairing
library
exposed-modules:
- Data.Pairing
- Data.Pairing.Ate
- Data.Pairing.BLS12381
- Data.Pairing.BN254
- Data.Pairing.BN254A
- Data.Pairing.BN254B
- Data.Pairing.BN254C
- Data.Pairing.BN254D
- Data.Pairing.BN462
- Data.Pairing.Hash
- other-modules:
- Paths_pairing
- hs-source-dirs:
- src
- default-extensions: LambdaCase RecordWildCards OverloadedStrings NoImplicitPrelude FlexibleInstances FlexibleContexts ScopedTypeVariables RankNTypes ConstraintKinds DataKinds DeriveGeneric GeneralizedNewtypeDeriving MultiParamTypeClasses OverloadedLists PatternSynonyms TypeFamilyDependencies
- ghc-options: -freverse-errors -O2 -Wall
+ Data.Pairing
+ Data.Pairing.Ate
+ Data.Pairing.BLS12381
+ Data.Pairing.BN254
+ Data.Pairing.BN254A
+ Data.Pairing.BN254B
+ Data.Pairing.BN254C
+ Data.Pairing.BN254D
+ Data.Pairing.BN462
+ Data.Pairing.Hash
+
+ other-modules: Paths_pairing
+ hs-source-dirs: src
+ default-extensions:
+ NoImplicitPrelude
+ ConstraintKinds
+ DataKinds
+ DeriveGeneric
+ FlexibleContexts
+ FlexibleInstances
+ GeneralizedNewtypeDeriving
+ LambdaCase
+ MultiParamTypeClasses
+ OverloadedLists
+ OverloadedStrings
+ PatternSynonyms
+ RankNTypes
+ RecordWildCards
+ ScopedTypeVariables
+ TypeFamilyDependencies
+
+ ghc-options: -freverse-errors -O2 -Wall
build-depends:
- MonadRandom
- , base >=4.10 && <5
- , bytestring
- , elliptic-curve >=0.3 && <0.4
- , errors
- , galois-field >=1 && <2
- , groups
- , protolude >=0.2 && <0.3
- , tasty-quickcheck
- default-language: Haskell2010
+ base >=4.10 && <5
+ , bytestring >=0.10.8 && <0.11
+ , elliptic-curve >=0.3 && <0.4
+ , errors >=2.3.0 && <2.4
+ , galois-field >=1.0.2 && <2.0
+ , groups >=0.4.1 && <0.5
+ , MonadRandom >=0.5.1 && <0.6
+ , protolude >=0.2 && <0.3
+ , tasty-quickcheck >=0.10.1 && <0.11
+ default-language: Haskell2010
+
+test-suite example-tests
+ type: exitcode-stdio-1.0
+ main-is: Example.hs
+ other-modules: Paths_pairing
+ default-extensions:
+ NoImplicitPrelude
+ ConstraintKinds
+ DataKinds
+ DeriveGeneric
+ FlexibleContexts
+ FlexibleInstances
+ GeneralizedNewtypeDeriving
+ LambdaCase
+ MultiParamTypeClasses
+ OverloadedLists
+ OverloadedStrings
+ PatternSynonyms
+ RankNTypes
+ RecordWildCards
+ ScopedTypeVariables
+ TypeFamilyDependencies
+
+ ghc-options: -freverse-errors -O2 -Wall
+ build-depends:
+ base >=4.10 && <5
+ , bytestring >=0.10.8 && <0.11
+ , elliptic-curve >=0.3 && <0.4
+ , errors >=2.3.0 && <2.4
+ , galois-field >=1.0.2 && <2.0
+ , groups >=0.4.1 && <0.5
+ , MonadRandom >=0.5.1 && <0.6
+ , pairing
+ , protolude >=0.2 && <0.3
+ , tasty-quickcheck >=0.10.1 && <0.11
+
+ default-language: Haskell2010
+
test-suite pairing-tests
- type: exitcode-stdio-1.0
- main-is: Main.hs
+ type: exitcode-stdio-1.0
+ main-is: Main.hs
other-modules:
- Test.BLS12381
- Test.BN254
- Test.BN254A
- Test.BN254B
- Test.BN254C
- Test.BN254D
- Test.BN462
- Test.Curve
- Test.Field
- Test.Pairing
- Paths_pairing
- hs-source-dirs:
- test
- default-extensions: LambdaCase RecordWildCards OverloadedStrings NoImplicitPrelude FlexibleInstances FlexibleContexts ScopedTypeVariables RankNTypes ConstraintKinds DataKinds DeriveGeneric GeneralizedNewtypeDeriving MultiParamTypeClasses OverloadedLists PatternSynonyms TypeFamilyDependencies
- ghc-options: -freverse-errors -O2 -Wall -main-is Main
+ Paths_pairing
+ Test.BLS12381
+ Test.BN254
+ Test.BN254A
+ Test.BN254B
+ Test.BN254C
+ Test.BN254D
+ Test.BN462
+ Test.Curve
+ Test.Field
+ Test.Pairing
+
+ hs-source-dirs: test
+ default-extensions:
+ NoImplicitPrelude
+ ConstraintKinds
+ DataKinds
+ DeriveGeneric
+ FlexibleContexts
+ FlexibleInstances
+ GeneralizedNewtypeDeriving
+ LambdaCase
+ MultiParamTypeClasses
+ OverloadedLists
+ OverloadedStrings
+ PatternSynonyms
+ RankNTypes
+ RecordWildCards
+ ScopedTypeVariables
+ TypeFamilyDependencies
+
+ ghc-options: -freverse-errors -O2 -Wall -main-is Main
build-depends:
- MonadRandom
- , QuickCheck
- , base >=4.10 && <5
- , bytestring
- , elliptic-curve >=0.3 && <0.4
- , errors
- , galois-field >=1 && <2
- , groups
+ base >=4.10 && <5
+ , bytestring >=0.10.8 && <0.11
+ , elliptic-curve >=0.3 && <0.4
+ , errors >=2.3.0 && <2.4
+ , galois-field >=1.0.2 && <2.0
+ , groups >=0.4.1 && <0.5
+ , MonadRandom >=0.5.1 && <0.6
, pairing
- , protolude >=0.2 && <0.3
+ , protolude >=0.2 && <0.3
+ , QuickCheck
, quickcheck-instances
, tasty
, tasty-hunit
, tasty-quickcheck
- default-language: Haskell2010
+ default-language: Haskell2010
+
benchmark pairing-benchmarks
- type: exitcode-stdio-1.0
- main-is: Main.hs
+ type: exitcode-stdio-1.0
+ main-is: Main.hs
other-modules:
- Bench.Hash
- Bench.Pairing
- Paths_pairing
- hs-source-dirs:
- bench
- default-extensions: LambdaCase RecordWildCards OverloadedStrings NoImplicitPrelude FlexibleInstances FlexibleContexts ScopedTypeVariables RankNTypes ConstraintKinds DataKinds DeriveGeneric GeneralizedNewtypeDeriving MultiParamTypeClasses OverloadedLists PatternSynonyms TypeFamilyDependencies
- ghc-options: -freverse-errors -O2 -Wall -main-is Main
+ Bench.Hash
+ Bench.Pairing
+ Paths_pairing
+
+ hs-source-dirs: bench
+ default-extensions:
+ NoImplicitPrelude
+ ConstraintKinds
+ DataKinds
+ DeriveGeneric
+ FlexibleContexts
+ FlexibleInstances
+ GeneralizedNewtypeDeriving
+ LambdaCase
+ MultiParamTypeClasses
+ OverloadedLists
+ OverloadedStrings
+ PatternSynonyms
+ RankNTypes
+ RecordWildCards
+ ScopedTypeVariables
+ TypeFamilyDependencies
+
+ ghc-options: -freverse-errors -O2 -Wall -main-is Main
build-depends:
- MonadRandom
- , base >=4.10 && <5
- , bytestring
+ base >=4.10 && <5
+ , bytestring >=0.10.8 && <0.11
, criterion
- , elliptic-curve >=0.3 && <0.4
- , errors
- , galois-field >=1 && <2
- , groups
+ , elliptic-curve >=0.3 && <0.4
+ , errors >=2.3.0 && <2.4
+ , galois-field >=1.0.2 && <2.0
+ , groups >=0.4.1 && <0.5
+ , MonadRandom >=0.5.1 && <0.6
, pairing
- , protolude >=0.2 && <0.3
- , tasty-quickcheck
- default-language: Haskell2010
+ , protolude >=0.2 && <0.3
+ , tasty-quickcheck >=0.10.1 && <0.11
+
+ default-language: Haskell2010
diff --git a/src/Data/Pairing/Ate.hs b/src/Data/Pairing/Ate.hs
--- a/src/Data/Pairing/Ate.hs
+++ b/src/Data/Pairing/Ate.hs
@@ -11,7 +11,7 @@
import Protolude
import Data.Curve.Weierstrass (Curve(..), Point(..))
-import Data.Field.Galois as F hiding (recip, (/))
+import Data.Field.Galois as F
import Data.Pairing
diff --git a/src/Data/Pairing/Hash.hs b/src/Data/Pairing/Hash.hs
--- a/src/Data/Pairing/Hash.hs
+++ b/src/Data/Pairing/Hash.hs
@@ -12,7 +12,7 @@
import Control.Monad.Random (MonadRandom)
import qualified Data.ByteString as B (foldl')
import Data.Curve.Weierstrass
-import Data.Field.Galois as F hiding ((/))
+import Data.Field.Galois as F
import Data.List ((!!))
import Data.Pairing
@@ -38,14 +38,14 @@
-- The implementation uses the Shallue-van de Woestijne encoding to BN curves
-- as specified in Section 6 of [Indifferentiable Hashing to Barreto-Naehrig Curves]
-- (https://www.di.ens.fr/~fouque/pub/latincrypt12.pdf).
---
+--
-- This function evaluates an empty bytestring or one that contains \NUL
-- to zero and is sent to an arbitrary point on the curve.
swEncBN :: forall e m q r u v w . (MonadRandom m, ECPairing e q r u v w)
=> ByteString -> m (Maybe (G1 e))
swEncBN bs = runMaybeT $ do
sqrt3 <- hoistMaybe $ sr $ -3
- let t = fromBytes bs
+ let t = fromInteger $ fromBytes bs
s1 = (sqrt3 - 1) / 2
b1 = 1 + b_ (witness :: G1 e)
guard (b1 + t * t /= 0)
@@ -82,7 +82,7 @@
-------------------------------------------------------------------------------
-- Conversion from bytestring to field.
-fromBytes :: (Bits k, Num k) => ByteString -> k
+fromBytes :: ByteString -> Integer
fromBytes = B.foldl' f 0
where
f a b = shiftL a 8 .|. fromIntegral b