allow subtracting from aggregate for when participation is high (#157)

When the aggregate public key of full participation is known,
and participation is high, it is worthwhile to subtract individual keys
from the known full participation aggregate public key.

Add a corresponding `fastAggregateVerify` overload to support that.

blscurve/bls_public_exports.nim

@@ -23,7 +23,7 @@ export
 # TODO - MIRACL implementation
 when BLS_BACKEND == BLST:
   export
-    exportUncompressed,
+    exportUncompressed, subtractAll,
     ID, recover, genSecretShare, fromUint32, add
 
 import bls_sig_min_pubkey

blscurve/bls_sig_min_pubkey.nim

@@ -256,3 +256,18 @@ func fastAggregateVerify*[T: byte|char](
   if not aggAffine.aggregateAll(publicKeys):
     return false
   return coreVerifyNoGroupCheck(aggAffine, message, signature, DST)
+
+func fastAggregateVerify*[T: byte|char](
+        fullParticipationAggregatePublicKey: PublicKey,
+        nonParticipatingPublicKeys: openArray[PublicKey],
+        message: openArray[T],
+        signature: Signature
+      ): bool =
+  ## Verify the aggregate of multiple signatures on the same message
+  ## This function is faster than AggregateVerify
+  ##
+  ## The proof-of-possession MUST be verified before calling this function.
+  ## The caller must ensure that at least one participating public key remains.
+  var aggAffine = fullParticipationAggregatePublicKey
+  aggAffine.subtractAll(nonParticipatingPublicKeys)
+  coreVerifyNoGroupCheck(aggAffine, message, signature, DST)

blscurve/blst/blst_min_pubkey_sig_core.nim

@@ -187,6 +187,17 @@ template genAggregatorProcedures(
     dst.finish(agg)
     return true
 
+  proc subtractAll*(dst: var BaseType, elems: openArray[BaseType]) =
+    ## Subtracts all ``elems[0..<elems.len]`` from ``dst``.
+    if len(elems) == 0:
+      return
+    var agg{.noinit.}: Aggregate
+    agg.init(elems[0])
+    agg.aggregate(elems.toOpenArray(1, elems.high))
+    agg.point.`blst _ p1_or_p2 _ cneg`(cbit = 1)
+    agg.aggregate(dst)
+    dst.finish(agg)
+
 genAggregatorProcedures(AggregateSignature, Signature, p2)
 genAggregatorProcedures(AggregatePublicKey, PublicKey, p1)
 

tests/eth2_vectors.nim

@@ -254,6 +254,13 @@ testGen(aggregate, test):
       "   computed: " & libAggSig.toHex() & "\n" &
       "   expected: " & expectedAgg.val.toHex()
 
+    when BLS_BACKEND == BLST:
+      libAggSig.subtractAll(sigs.val.toOpenArray(1, sigs.val.high))
+      doAssert libAggSig == sigs.val[0], block:
+        "\nSubtracting all but one signature differs from expected \n" &
+        "   computed: " & libAggSig.toHex() & "\n" &
+        "   expected: " & sigs.val[0].toHex()
+
 testGen(fast_aggregate_verify, test):
   let
     expected = bool.getFrom(test, Output)