Struct Secp256k1EndosplitHint 

pub struct Secp256k1EndosplitHint { /* private fields */ }

Implementations

impl Secp256k1EndosplitHint

pub fn new() -> Self

pub fn call( builder: &CircuitBuilder, k: &[Wire], ) -> (Wire, Wire, [Wire; 2], [Wire; 2])

Secp256k1 endomorphism split.

The curve has an endomorphism λ (x, y) = (βx, y) where λ³=1 (mod n) and β³=1 (mod p) (n being the scalar field modulus and p coordinate field one).

For a 256-bit scalar k it is possible to split it into k1 and k2 such that k1 + λ k2 = k (mod n) and both k1 and k2 are no farther than 2^128 from zero.

The k scalar is represented by four 64-bit limbs in little endian order. The return value is quadruple of (k1_neg, k2_neg, k1_abs, k2_abs) where k1_neg and k2_neg are MSB-bools indicating whether k1_abs or k2_abs, respectively, should be negated. k1_abs and k2_abs are at most 128 bits and are represented with two 64-bit limbs. When k cannot be represented in this way (any valid scalar can, so it has to be modulus or above), both k1_abs and k2_abs are assigned zero values.

This is a hint - a deterministic computation that happens only on the prover side. The result should be additionally constrained by using bignum circuits to check that k1 + λ k2 = k (mod n).

Trait Implementations

impl Default for Secp256k1EndosplitHint

fn default() -> Self

Returns the “default value” for a type.

impl Hint for Secp256k1EndosplitHint

const NAME: &'static str = "binius.secp256k1_endosplit"

Globally unique name for this hint, which the registry hashes into its key.

fn shape(&self, dimensions: &[usize]) -> (usize, usize)

Compute the gate’s input/output arity as a function of dimensions.

fn execute(&self, dimensions: &[usize], inputs: &[Word], outputs: &mut [Word])

Compute the hint’s outputs from its inputs at witness-generation time.