EIP-212 (bn128 curve pairing)

ethcore/res/ethereum/foundation.json

@@ -192,6 +192,7 @@
 		"0000000000000000000000000000000000000005": { "builtin": { "name": "modexp", "activate_at": "0x7fffffffffffff", "pricing": { "modexp": { "divisor": 20 } } } },
 		"0000000000000000000000000000000000000006": { "builtin": { "name": "bn128_add", "activate_at": "0x7fffffffffffff", "pricing": { "linear": { "base": 999999, "word": 0 } } } },
 		"0000000000000000000000000000000000000007": { "builtin": { "name": "bn128_mul", "activate_at": "0x7fffffffffffff", "pricing": { "linear": { "base": 999999, "word": 0 } } } },
+		"0000000000000000000000000000000000000008": { "builtin": { "name": "bn128_pairing", "activate_at": "0x7fffffffffffff", "pricing": { "linear": { "base": 999999, "word": 0 } } } },
 		"3282791d6fd713f1e94f4bfd565eaa78b3a0599d": {
 			"balance": "1337000000000000000000"
 		},

ethcore/src/builtin.rs

@@ -158,6 +158,7 @@ fn ethereum_builtin(name: &str) -> Box<Impl> {
 		"modexp" => Box::new(ModexpImpl) as Box<Impl>,
 		"bn128_add" => Box::new(Bn128AddImpl) as Box<Impl>,
 		"bn128_mul" => Box::new(Bn128MulImpl) as Box<Impl>,
+		"bn128_pairing" => Box::new(Bn128PairingImpl) as Box<Impl>,
 		_ => panic!("invalid builtin name: {}", name),
 	}
 }
@@ -191,6 +192,9 @@ struct Bn128AddImpl;
 #[derive(Debug)]
 struct Bn128MulImpl;
 
+#[derive(Debug)]
+struct Bn128PairingImpl;
+
 impl Impl for Identity {
 	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
 		output.write(0, input);
@@ -393,11 +397,109 @@ impl Impl for Bn128MulImpl {
 	}	
 }
 
+mod bn128_gen {
+	use bn::{AffineG1, AffineG2, Fq, Fq2, G1, G2, Gt, pairing};
+
+	lazy_static! {
+		pub static ref P1: G1 = G1::from(AffineG1::new(
+			Fq::from_str("1").expect("1 is a valid field element"),
+			Fq::from_str("2").expect("2 is a valid field element"),
+		).expect("Generator P1(1, 2) is a valid curve point"));
+	}
+
+	lazy_static! {
+		pub static ref P2: G2 = G2::from(AffineG2::new(
+			Fq2::new(
+				Fq::from_str("10857046999023057135944570762232829481370756359578518086990519993285655852781")
+					.expect("a valid field element"),
+				Fq::from_str("11559732032986387107991004021392285783925812861821192530917403151452391805634")
+					.expect("a valid field element"),
+			),
+			Fq2::new(
+				Fq::from_str("8495653923123431417604973247489272438418190587263600148770280649306958101930")
+					.expect("a valid field element"),
+				Fq::from_str("4082367875863433681332203403145435568316851327593401208105741076214120093531")
+					.expect("a valid field element"),
+			),			
+		).expect("the generator P2(10857046999023057135944570762232829481370756359578518086990519993285655852781 + 11559732032986387107991004021392285783925812861821192530917403151452391805634i, 8495653923123431417604973247489272438418190587263600148770280649306958101930 + 4082367875863433681332203403145435568316851327593401208105741076214120093531i) is a valid curve point"));
+	}	
+
+	lazy_static! {
+		pub static ref P1_P2_PAIRING: Gt = pairing(P1.clone(), P2.clone());
+	}		
+}
+
+impl Impl for Bn128PairingImpl {
+	/// Can fail if:
+	///     - input length is not a multiple of 192
+	///     - any of odd points does not belong to bn128 curve
+	///     - any of even points does not belong to the twisted bn128 curve over the field F_p^2 = F_p[i] / (i^2 + 1)
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
+		use bn::{AffineG1, AffineG2, Fq, Fq2, pairing, G1, G2, Gt};
+
+		let elements = input.len() / 192; // (a, b_a, b_b - each 64-byte affine coordinates)
+		if input.len() % 192 != 0 { 
+			return Err("Invalid input length, must be multiple of 192 (3 * (32*2))".into()) 
+		}
+		let ret_val = if input.len() == 0 {
+			U256::one()
+		} else {
+			let mut vals = Vec::new();
+			for idx in 0..elements {
+				let a_x = Fq::from_slice(&input[idx*192..idx*192+32])
+					.map_err(|_| Error::from("Invalid a argument x coordinate"))?;
+
+				let a_y = Fq::from_slice(&input[idx*192+32..idx*192+64])
+					.map_err(|_| Error::from("Invalid a argument y coordinate"))?;
+
+				let b_b_x = Fq::from_slice(&input[idx*192+64..idx*192+96])
+					.map_err(|_| Error::from("Invalid b argument imaginary coeff x coordinate"))?;
+
+				let b_b_y = Fq::from_slice(&input[idx*192+96..idx*192+128])
+					.map_err(|_| Error::from("Invalid b argument imaginary coeff y coordinate"))?;
+
+				let b_a_x = Fq::from_slice(&input[idx*192+128..idx*192+160])
+					.map_err(|_| Error::from("Invalid b argument real coeff x coordinate"))?;					
+
+				let b_a_y = Fq::from_slice(&input[idx*192+160..idx*192+192])
+					.map_err(|_| Error::from("Invalid b argument real coeff y coordinate"))?;					
+
+				vals.push((
+					G1::from(
+						AffineG1::new(a_x, a_y).map_err(|_| Error::from("Invalid a argument - not on curve"))?
+					),
+					G2::from(
+						AffineG2::new(
+							Fq2::new(b_a_x, b_a_y),
+							Fq2::new(b_b_x, b_b_y),
+						).map_err(|_| Error::from("Invalid b argument - not on curve"))?
+					),
+				));
+			};
+
+			let mul = vals.into_iter().fold(Gt::one(), |s, (a, b)| s * pairing(a, b));
+
+			if mul == *bn128_gen::P1_P2_PAIRING {
+				U256::one()
+			} else {
+				U256::zero()
+			}
+		};
+
+		let mut buf = [0u8; 32];
+		ret_val.to_big_endian(&mut buf);
+		output.write(0, &buf);
+
+		Ok(())
+	}
+}
+
 #[cfg(test)]
 mod tests {
 	use super::{Builtin, Linear, ethereum_builtin, Pricer, Modexp};
 	use ethjson;
 	use util::{U256, BytesRef};
+	use rustc_serialize::hex::FromHex;
 
 	#[test]
 	fn identity() {
@@ -713,7 +815,82 @@ mod tests {
 			assert!(res.is_err(), "There should be built-in error here");
 		}		
 	}
+
+	fn builtin_pairing() -> Builtin {
+		Builtin {
+			pricer: Box::new(Linear { base: 0, word: 0 }),
+			native: ethereum_builtin("bn128_pairing"),
+			activate_at: 0,
+		}
+	}
+
+	fn empty_test(f: Builtin, expected: Vec<u8>) {
+		let mut empty = [0u8; 0];
+		let input = BytesRef::Fixed(&mut empty);		
+
+		let mut output = vec![0u8; expected.len()];
+
+		f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..])).expect("Builtin should not fail");
+		assert_eq!(output, expected);		
+	}
+
+	fn error_test(f: Builtin, input: &[u8], msg_contains: Option<&str>) {
+		let mut output = vec![0u8; 64];
+		let res = f.execute(input, &mut BytesRef::Fixed(&mut output[..]));
+		if let Some(msg) = msg_contains {
+			if let Err(e) = res {
+				if !e.0.contains(msg) {
+					panic!("There should be error containing '{}' here, but got: '{}'", msg, e.0);
+				}
+			}
+		} else {
+			assert!(res.is_err(), "There should be built-in error here");
+		}
+	}
+
+	fn bytes(s: &'static str) -> Vec<u8> {
+		FromHex::from_hex(s).expect("static str should contain valid hex bytes")
+	}
 
+	#[test]
+	fn bn128_pairing_empty() {
+		// should not fail, because empty input is a valid input of 0 elements
+		empty_test(
+			builtin_pairing(), 
+			bytes("0000000000000000000000000000000000000000000000000000000000000001"),
+		);
+	}
+
+	#[test]
+	fn bn128_pairing_notcurve() {
+		// should fail - point not on curve
+		error_test(
+			builtin_pairing(),
+			&bytes("\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111"
+			),
+			Some("not on curve"),
+		);
+	}
+
+	#[test]
+	fn bn128_pairing_fragmented() {
+		// should fail - input length is invalid
+		error_test(
+			builtin_pairing(),
+			&bytes("\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				111111111111111111111111111111"
+			),
+			Some("Invalid input length"),
+		);
+	}	
 
 	#[test]
 	#[should_panic]