Classes
struct	g1Projective
	Struct representing a point in G1 in homogeneous projective coordinates. More...

struct	g2Projective

struct	miller_lines

Functions
constexpr void	doubling_step_for_miller_loop (g2Projective &work_point, fq12::ell_coeffs &line)
	Doubling step for Miller loop calculation.

constexpr void	mixed_addition_step_for_miller_loop (const g2Projective &Q, g2Projective &work_point, fq12::ell_coeffs &line)
	Addition step for Miller loop calculation.

constexpr void	precompute_miller_lines (const g2Projective &Q, miller_lines &lines)
	Precomputation of Miller lines for a point Q in G2.

constexpr void	precompute_miller_lines (const g2::element &Q, miller_lines &lines)

constexpr fq12	miller_loop (const g1::affine_element &P, const miller_lines &lines)
	Miller loop implementation.

constexpr fq12	miller_loop_batch (const g1::affine_element points, const miller_lines lines, size_t num_pairs)
	Compute the Miller loop for multiple pairs of points.

constexpr g2Projective	twisted_frobenius (const g2Projective &a)
	Compute \(\Psi^{-1} \circ \phi_q \circ \Psi(Q)\) where \(\Psi\) is the untwisting isomorphism and \(\phi_q\) is the Frobenius morphism.

constexpr fq12	final_exponentiation_easy_part (const fq12 &elt)

constexpr fq12	final_exponentiation_exp_by_z (const fq12 &elt)

constexpr fq12	final_exponentiation_tricky_part (const fq12 &elt)

constexpr fq12	reduced_ate_pairing (const g1::affine_element &P_affine, const g2::affine_element &Q_affine)

fq12	reduced_ate_pairing_batch_precomputed (const g1::affine_element P_affines, const miller_lines lines, const size_t num_points)

fq12	reduced_ate_pairing_batch (const g1::affine_element P_affines, const g2::affine_element Q_affines, const size_t num_points)

Variables
constexpr size_t	loop_length = 64

constexpr size_t	z_loop_length = 62

constexpr size_t	precomputed_coefficients_length = 87

constexpr std::array< uint8_t, loop_length >	loop_bits

constexpr std::array< bool, z_loop_length >	z_loop_bits

constexpr fq	two_inv = fq(2).invert()

Function Documentation

◆ doubling_step_for_miller_loop()

constexpr void bb::pairing::doubling_step_for_miller_loop	(	g2Projective &	work_point,
		fq12::ell_coeffs &	line
	)

constexpr

Doubling step for Miller loop calculation.

This function computes the constants required to evaluate the tangent line at work_point and updates work_point to 2 * work_point. The formulas are taken from https://cacr.uwaterloo.ca/techreports/2012/cacr2012-17.pdf, section 4.2.

Parameters

work_point
line

Definition at line 42 of file pairing_impl.hpp.

◆ final_exponentiation_easy_part()

constexpr fq12 bb::pairing::final_exponentiation_easy_part ( const fq12 & elt )

constexpr

Definition at line 213 of file pairing_impl.hpp.

◆ final_exponentiation_exp_by_z()

constexpr fq12 bb::pairing::final_exponentiation_exp_by_z ( const fq12 & elt )

constexpr

Definition at line 220 of file pairing_impl.hpp.

◆ final_exponentiation_tricky_part()

constexpr fq12 bb::pairing::final_exponentiation_tricky_part ( const fq12 & elt )

constexpr

Definition at line 233 of file pairing_impl.hpp.

◆ miller_loop()

constexpr fq12 bb::pairing::miller_loop	(	const g1::affine_element &	P,
		const miller_lines &	lines
	)

constexpr

Miller loop implementation.

This function computes the Miller loop

\[ f_{6z + 2, Q}(P) \cdot l_{(6z + 2)Q, Q'}(P) \cdot l_{(6z + 2)Q + Q', -Q''}(P) \]

where Q' is the image of Q under the Frobenius map and Q'' is minus the image of Q' under the Frobenius map. For the point P and the precomputed Miller lines of Q.

Parameters

P
lines

Returns: constexpr fq12

Definition at line 124 of file pairing_impl.hpp.

◆ miller_loop_batch()

constexpr fq12 bb::pairing::miller_loop_batch	(	const g1::affine_element *	points,
		const miller_lines *	lines,
		size_t	num_pairs
	)

constexpr

Compute the Miller loop for multiple pairs of points.

The structure of the Miller loop allows computing the product of the Miller loops for multiple pairs (P_i, Q_i) with a single loop over the bits of 6z + 2: at each step in the loop we aggregate all the contributions from each point so to perform a single squaring.

Parameters

points
lines
num_pairs

Returns: constexpr fq12

Definition at line 165 of file pairing_impl.hpp.

◆ mixed_addition_step_for_miller_loop()

constexpr void bb::pairing::mixed_addition_step_for_miller_loop	(	const g2Projective &	Q,
		g2Projective &	work_point,
		fq12::ell_coeffs &	line
	)

constexpr

Addition step for Miller loop calculation.

This function computes the constants required to evaluate the line through work_point and Q and updates work_point to work_point + Q. The formulas are taken from https://cacr.uwaterloo.ca/techreports/2012/cacr2012-17.pdf, section 4.2.

Note: The formulas for mixed addition in https://cacr.uwaterloo.ca/techreports/2012/cacr2012-17.pdf have a typo: the first term in the line evaluation of the mixed addition is lambda * y_P, not lambda * (-y_P)

Parameters

Q
work_point
line

Definition at line 64 of file pairing_impl.hpp.

◆ precompute_miller_lines() [1/2]

constexpr void bb::pairing::precompute_miller_lines	(	const g2::element &	Q,
		miller_lines &	lines
	)

constexpr

Definition at line 116 of file pairing_impl.hpp.

◆ precompute_miller_lines() [2/2]

constexpr void bb::pairing::precompute_miller_lines	(	const g2Projective &	Q,
		miller_lines &	lines
	)

constexpr

Precomputation of Miller lines for a point Q in G2.

This function computes the lines that are evaluated in the calculation of the Miller loop for the point Q. Setting work_point = Q as the MSB bit in the signed decomposition of 6z + 2 is 1, for each bit in the signed decomposition of 6z + 2 (except the MSB) we need:

The tangent line at work_point --> updated work_point = 2 * work_point
The line through:
- work_point and Q if the bit is 1 --> updated work_point = work_point + Q
- work_point and -Q if the bit is -1 --> updated work_point = work_point - Q
- nothing else if the bit is 0 --> work_point is unchanged After the loop, we need two more lines:
The line through (6z + 2)Q and Q' (image of Q under the Frobenius map)
The line through (6z + 2)Q + Q' and Q'' (minus the image of Q' under the Frobenius map)

Parameters

Q
lines

Definition at line 90 of file pairing_impl.hpp.

◆ reduced_ate_pairing()

constexpr fq12 bb::pairing::reduced_ate_pairing	(	const g1::affine_element &	P_affine,
		const g2::affine_element &	Q_affine
	)

constexpr

Definition at line 258 of file pairing_impl.hpp.

◆ reduced_ate_pairing_batch()

fq12 bb::pairing::reduced_ate_pairing_batch	(	const g1::affine_element *	P_affines,
		const g2::affine_element *	Q_affines,
		const size_t	num_points
	)

Definition at line 300 of file pairing_impl.hpp.

◆ reduced_ate_pairing_batch_precomputed()

fq12 bb::pairing::reduced_ate_pairing_batch_precomputed	(	const g1::affine_element *	P_affines,
		const miller_lines *	lines,
		const size_t	num_points
	)

Definition at line 284 of file pairing_impl.hpp.

◆ twisted_frobenius()

constexpr g2Projective bb::pairing::twisted_frobenius ( const g2Projective & a )

inlineconstexpr

Compute \(\Psi^{-1} \circ \phi_q \circ \Psi(Q)\) where \(\Psi\) is the untwisting isomorphism and \(\phi_q\) is the Frobenius morphism.

Parameters

a

Returns: g2Projective

Definition at line 27 of file pairing_impl.hpp.

Variable Documentation

◆ loop_bits

constexpr std::array<uint8_t, loop_length> bb::pairing::loop_bits

constexpr

Initial value:

{ 1, 0, 1, 0, 0, 0, 3, 0, 3, 0, 0, 0, 3, 0, 1, 0, 3, 0, 0, 3, 0, 0,
                                                      0, 0, 0, 1, 0, 0, 3, 0, 1, 0, 0, 3, 0, 0, 0, 0, 3, 0, 1, 0, 0, 0,
                                                      3, 0, 3, 0, 0, 1, 0, 0, 0, 3, 0, 0, 3, 0, 1, 0, 1, 0, 0, 0 }

Definition at line 33 of file pairing.hpp.

◆ loop_length

constexpr size_t bb::pairing::loop_length = 64

constexpr

Definition at line 21 of file pairing.hpp.

◆ precomputed_coefficients_length

constexpr size_t bb::pairing::precomputed_coefficients_length = 87

constexpr

Definition at line 28 of file pairing.hpp.

◆ two_inv

constexpr fq bb::pairing::two_inv = fq(2).invert()

constexpr

Definition at line 18 of file pairing_impl.hpp.

◆ z_loop_bits

constexpr std::array<bool, z_loop_length> bb::pairing::z_loop_bits

constexpr

Initial value:

{
    false, false, false, true,  false, false, true,  true,  true, false, true,  false, false, true,  true,  false,
    false, true,  false, false, true,  false, true,  false, true, true,  false, true,  false, false, false, true,
    false, false, true,  false, true,  false, false, true,  true, false, true,  false, false, true,  false, false,
    false, false, true,  false, false, true,  true,  true,  true, true,  false, false, false, true
}

Definition at line 39 of file pairing.hpp.

◆ z_loop_length

constexpr size_t bb::pairing::z_loop_length = 62

constexpr

Definition at line 23 of file pairing.hpp.

Classes

Functions

Variables

Function Documentation

◆ doubling_step_for_miller_loop()

◆ final_exponentiation_easy_part()

◆ final_exponentiation_exp_by_z()

◆ final_exponentiation_tricky_part()

◆ miller_loop()

◆ miller_loop_batch()

◆ mixed_addition_step_for_miller_loop()

◆ precompute_miller_lines() [1/2]

◆ precompute_miller_lines() [2/2]

◆ reduced_ate_pairing()

◆ reduced_ate_pairing_batch()

◆ reduced_ate_pairing_batch_precomputed()

◆ twisted_frobenius()

Variable Documentation

◆ loop_bits

◆ loop_length

◆ precomputed_coefficients_length

◆ two_inv

◆ z_loop_bits

◆ z_loop_length