add on curve check on groth16 proof points

keep-starknet-strange · Aug 6, 2024 · 5555dbd · 5555dbd
1 parent e169823
commit 5555dbd
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 10 deletions.
diff --git a/src/cairo/src/definitions.cairo b/src/cairo/src/definitions.cairo
@@ -30,11 +30,6 @@ struct G2Line {
     r1a1: u384,
 }
 
-
-trait G2PointTrait {
-    fn is_on_curve(self: @G2Point, curve_index: usize) -> bool;
-}
-
 #[derive(Copy, Drop, Debug, PartialEq)]
 struct G1G2Pair {
     p: G1Point,

diff --git a/src/cairo/src/ec_ops.cairo b/src/cairo/src/ec_ops.cairo
@@ -6,8 +6,8 @@ use core::circuit::{
     AddInputResultTrait, CircuitInputs, CircuitDefinition, CircuitData, CircuitInputAccumulator
 };
 use garaga::definitions::{
-    get_a, get_b, get_p, get_g, get_min_one, get_b2, get_n, G1Point, G2Point, G2PointTrait,
-    BLS_X_SEED_SQ_EPNS, G1PointInfinity, THIRD_ROOT_OF_UNITY_BLS12_381_G1
+    get_a, get_b, get_p, get_g, get_min_one, get_b2, get_n, G1Point, G2Point, BLS_X_SEED_SQ_EPNS,
+    G1PointInfinity, THIRD_ROOT_OF_UNITY_BLS12_381_G1
 };
 use core::option::Option;
 use core::poseidon::hades_permutation;
@@ -66,6 +66,7 @@ impl G1PointImpl of G1PointTrait {
     }
 }
 
+#[generate_trait]
 impl G2PointImpl of G2PointTrait {
     fn is_on_curve(self: @G2Point, curve_index: usize) -> bool {
         let (b20, b21) = get_b2(curve_index).unwrap();

diff --git a/src/cairo/src/groth16.cairo b/src/cairo/src/groth16.cairo
@@ -37,7 +37,7 @@ use core::poseidon::hades_permutation;
 
 
 use garaga::basic_field_ops::{neg_mod_p};
-use garaga::ec_ops::{msm_g1, MSMHint, DerivePointFromXHint};
+use garaga::ec_ops::{msm_g1, MSMHint, DerivePointFromXHint, G1PointTrait, G2PointTrait};
 
 use garaga::pairing_check::{MPCheckHintBN254, MPCheckHintBLS12_381};
 
@@ -97,7 +97,9 @@ fn verify_groth16_bn254(
         public_inputs_msm_derive_point_from_x_hint.unbox(),
         0
     );
-
+    assert!(proof.a.is_in_subgroup(0, Option::None, Option::None));
+    assert!(proof.b.is_on_curve(0));
+    assert!(proof.c.is_in_subgroup(0, Option::None, Option::None));
     return multi_pairing_check_bn254_3P_2F_with_extra_miller_loop_result(
         G1G2Pair { p: vk_x, q: verification_key.gamma_g2 },
         G1G2Pair { p: proof.c, q: verification_key.delta_g2 },
@@ -143,7 +145,9 @@ fn verify_groth16_bls12_381(
         public_inputs_msm_derive_point_from_x_hint.unbox(),
         1
     );
-
+    assert!(proof.a.is_in_subgroup(1, Option::None, Option::None));
+    assert!(proof.b.is_on_curve(1));
+    assert!(proof.c.is_in_subgroup(1, Option::None, Option::None));
     return multi_pairing_check_bls12_381_3P_2F_with_extra_miller_loop_result(
         G1G2Pair { p: vk_x, q: verification_key.gamma_g2 },
         G1G2Pair { p: proof.c, q: verification_key.delta_g2 },