@@ -57,24 +57,24 @@ void ECCVMPointTableRelationImpl<FF>::accumulate(ContainerOverSubrelations& accu
5757 * In the table, the point associated with `pc = 1` is labelled P.
5858 * the point associated with `pc = 0` is labelled Q.
5959 *
60- * | precompute_pc | precompute_point_transition | precompute_round | Tx | Ty | Dx | Dy |
61- * | -------- | ----------------------- | ----------- | ----- | ----- | ---- | ---- |
62- * | 1 | 0 | 0 |15P.x | 15P.y | 2P.x | 2P.y |
63- * | 1 | 0 | 1 |13P.x | 13P.y | 2P.x | 2P.y |
64- * | 1 | 0 | 2 |11P.x | 11P.y | 2P.x | 2P.y |
65- * | 1 | 0 | 3 | 9P.x | 9P.y | 2P.x | 2P.y |
66- * | 1 | 0 | 4 | 7P.x | 7P.y | 2P.x | 2P.y |
67- * | 1 | 0 | 5 | 5P.x | 5P.y | 2P.x | 2P.y |
68- * | 1 | 0 | 6 | 3P.x | 3P.y | 2P.x | 2P.y |
69- * | 1 | 1 | 7 | P.x | P.y | 2P.x | 2P.y |
70- * | 0 | 0 | 0 |15Q.x | 15Q.y | 2Q.x | 2Q.y |
71- * | 0 | 0 | 1 |13Q.x | 13Q.y | 2Q.x | 2Q.y |
72- * | 0 | 0 | 2 |11Q.x | 11Q.y | 2Q.x | 2Q.y |
73- * | 0 | 0 | 3 | 9Q.x | 9Q.y | 2Q.x | 2Q.y |
74- * | 0 | 0 | 4 | 7Q.x | 7Q.y | 2Q.x | 2Q.y |
75- * | 0 | 0 | 5 | 5Q.x | 5Q.y | 2Q.x | 2Q.y |
76- * | 0 | 0 | 6 | 3Q.x | 3Q.y | 2Q.x | 2Q.y |
77- * | 0 | 1 | 7 | Q.x | Q.y | 2Q.x | 2Q.y |
60+ * | precompute_pc | precompute_point_transition | precompute_round | Tx | Ty | Dx | Dy |
61+ * | ------------- | ---------------------------- | ------------------- | ----- | ----- | ---- | ---- |
62+ * | 1 | 0 | 0 | 15P.x | 15P.y | 2P.x | 2P.y |
63+ * | 1 | 0 | 1 | 13P.x | 13P.y | 2P.x | 2P.y |
64+ * | 1 | 0 | 2 | 11P.x | 11P.y | 2P.x | 2P.y |
65+ * | 1 | 0 | 3 | 9P.x | 9P.y | 2P.x | 2P.y |
66+ * | 1 | 0 | 4 | 7P.x | 7P.y | 2P.x | 2P.y |
67+ * | 1 | 0 | 5 | 5P.x | 5P.y | 2P.x | 2P.y |
68+ * | 1 | 0 | 6 | 3P.x | 3P.y | 2P.x | 2P.y |
69+ * | 1 | 1 | 7 | P.x | P.y | 2P.x | 2P.y |
70+ * | 0 | 0 | 0 | 15Q.x | 15Q.y | 2Q.x | 2Q.y |
71+ * | 0 | 0 | 1 | 13Q.x | 13Q.y | 2Q.x | 2Q.y |
72+ * | 0 | 0 | 2 | 11Q.x | 11Q.y | 2Q.x | 2Q.y |
73+ * | 0 | 0 | 3 | 9Q.x | 9Q.y | 2Q.x | 2Q.y |
74+ * | 0 | 0 | 4 | 7Q.x | 7Q.y | 2Q.x | 2Q.y |
75+ * | 0 | 0 | 5 | 5Q.x | 5Q.y | 2Q.x | 2Q.y |
76+ * | 0 | 0 | 6 | 3Q.x | 3Q.y | 2Q.x | 2Q.y |
77+ * | 0 | 1 | 7 | Q.x | Q.y | 2Q.x | 2Q.y |
7878 *
7979 * We apply the following relations to constrain the above table:
8080 *
@@ -84,9 +84,12 @@ void ECCVMPointTableRelationImpl<FF>::accumulate(ContainerOverSubrelations& accu
8484 *
8585 * The relations that constrain `precompute_point_transition` and `precompute_pc` are in `ecc_wnaf_relation.hpp`
8686 *
87- * When precompute_point_transition = 1, we use a strict lookup protocol in `ecc_set_relation.hpp` to validate (pc,
88- * Tx, Ty) belong to the set of points present in our transcript columns.
89- * ("strict" lookup protocol = every item in the table must be read from once, and only once)
87+ * When precompute_point_transition = 1, the next row corresponds to the beginning of the processing of a new point.
88+ * We use a multiset-equality check, `ecc_set_relation.hpp` to validate (pc, Tx, Ty, scalar-multiplier) is the same
89+ * as something derived from the transcript columns. In other words, the multiset equality check allows the tables
90+ * to communicate, and in particular validates that we are populating our PointTable with precomputed values that
91+ * indeed arise from the Transcript columns. (Formerly, we referred to this as a "strict" lookup protocol = every
92+ * item in the table must be read from once, and only once)
9093 *
9194 * For every row, we use a lookup protocol in `ecc_lookup_relation.hpp` to write the following tuples into a lookup
9295 * table:
@@ -102,15 +105,15 @@ void ECCVMPointTableRelationImpl<FF>::accumulate(ContainerOverSubrelations& accu
102105 * negative values produces the WNAF slice values that correspond to the multipliers for (Tx, Ty) and (Tx, -Ty):
103106 *
104107 * | Tx | Ty | x = 15 - precompute_round | 2x - 15 | y = precompute_round | 2y - 15 |
105- * | ----- | ----- | -------------------- | ------- | --------------- | ------- |
106- * | 15P.x | 15P.y | 15 | 15 | 0 | -15 |
107- * | 13P.x | 13P.y | 14 | 13 | 1 | -13 |
108- * | 11P.x | 11P.y | 13 | 11 | 2 | -11 |
109- * | 9P.x | 9P.y | 12 | 9 | 3 | -9 |
110- * | 7P.x | 7P.y | 11 | 7 | 4 | -7 |
111- * | 5P.x | 5P.y | 10 | 5 | 5 | -5 |
112- * | 3P.x | 3P.y | 9 | 3 | 6 | -3 |
113- * | P.x | P.y | 8 | 1 | 7 | -1 |
108+ * | ----- | ----- | -------------------- | ------- | --------------- | ------- |
109+ * | 15P.x | 15P.y | 15 | 15 | 0 | -15 |
110+ * | 13P.x | 13P.y | 14 | 13 | 1 | -13 |
111+ * | 11P.x | 11P.y | 13 | 11 | 2 | -11 |
112+ * | 9P.x | 9P.y | 12 | 9 | 3 | -9 |
113+ * | 7P.x | 7P.y | 11 | 7 | 4 | -7 |
114+ * | 5P.x | 5P.y | 10 | 5 | 5 | -5 |
115+ * | 3P.x | 3P.y | 9 | 3 | 6 | -3 |
116+ * | P.x | P.y | 8 | 1 | 7 | -1 |
114117 */
115118
116119 /* *
@@ -161,9 +164,11 @@ void ECCVMPointTableRelationImpl<FF>::accumulate(ContainerOverSubrelations& accu
161164 * (x_3 + x_2 + x_1) * (x_2 - x_1)^2 - (y_2 - y_1)^2 = 0
162165 * (y_3 + y_1) * (x_2 - x_1) + (x_3 - x_1) * (y_2 - y_1) = 0
163166 *
164- * We don't need to check for incomplete point addition edge case (x_1 == x_2)
165- * TODO explain why (computing simple point multiples cannot trigger the edge cases, but need to serve a proof of
166- * this...)
167+ * We don't need to check for incomplete point addition edge case (x_1 == x_2); the only cases this would correspond
168+ * to are y2 == y1 or y2 == -y1. Both of these cases may be ruled out as follows.
169+ * 1. y2 == y1. Then 2P == kP, where k∈{1, ..., 13}, which of course cannot happen because the order r of E(Fₚ)
170+ * is a large prime and P is already assumed to not be the neutral element.
171+ * 2. y2 == -y1. Again, then -2P == kP, k∈{1, ..., 13}, and we get the same contradiction.
167172 */
168173 const auto & x1 = Tx_shift;
169174 const auto & y1 = Ty_shift;
0 commit comments