arkworks-rs / r1cs-std

R1CS constraints for bits, fields, and elliptic curves
https://www.arkworks.rs
Apache License 2.0
133 stars 58 forks source link

alloc zero points consistently #126

Closed slumber closed 1 year ago

slumber commented 1 year ago

Description

Fix for https://github.com/arkworks-rs/crypto-primitives/pull/115

(0, 1) point is valid affine zero for twisted edwards curve, but this code is for short weierstrass. This causes inconsistency in poseidon sponge usage.


Before we can merge this PR, please make sure that all the following items have been checked off. If any of the checklist items are not applicable, please leave them but write a little note why.

slumber commented 1 year ago

Note that 23678c645674bb8ea79a2cf2151d89c688257627 should actually be kept, however, it breaks constraints for the on-curve check. I'd suggest to keep it and make Projective::zero() return { 0, 1, 0 }, like it's in-circuit counter part does.

Pratyush commented 1 year ago

@slumber https://github.com/arkworks-rs/r1cs-std/commit/23678c645674bb8ea79a2cf2151d89c688257627 is actually correct, as the coordinates used in the native version are different from the ones used in circuit: the native version uses jacobian coordinates, while the circuit one uses projective ones. The confusing name of SWProjective exacerbates this similarity and leads to confusion.