ark-ec

ark-ec 定义了处理不同类型加法群的特性和算法，重点在于从椭圆曲线产生的群。它还提供了各种椭圆曲线模型（包括流行的配对友好曲线家族，如BLS12曲线家族）的这些特性的具体实例。可以使用这些曲线模型实现的特定曲线可以在 arkworks-rs/curves 中找到。

使用方法

Group 特性

许多加密协议使用素数阶群作为核心构建块。 PrimeGroup 特性是一个抽象，它表示这样的阿贝尔素数阶群中的元素。它提供了对群元素执行常见操作的方法

use ark_ec::{AdditiveGroup, PrimeGroup};
use ark_ff::{PrimeField, Field};
// We'll use the BLS12-381 G1 curve for this example.
// This group has a prime order `r`, and is associated with a prime field `Fr`.
use ark_test_curves::bls12_381::{G1Projective as G, Fr as ScalarField};
use ark_std::{Zero, UniformRand, ops::Mul};

let mut rng = ark_std::test_rng();
// Let's sample uniformly random group elements:
let a = G::rand(&mut rng);
let b = G::rand(&mut rng);

// We can add elements, ...
let c = a + b;
// ... subtract them, ...
let d = a - b;
// ... and double them.
assert_eq!(c + d, a.double());
// We can also negate elements, ...
let e = -a;
// ... and check that negation satisfies the basic group law
assert_eq!(e + a, G::zero());

// We can also multiply group elements by elements of the corresponding scalar field
// (an act known as *scalar multiplication*)
let scalar = ScalarField::rand(&mut rng);
let e = c.mul(scalar);
let f = e.mul(scalar.inverse().unwrap());
assert_eq!(f, c);

标量乘法

尽管 PrimeGroup 特性已经产生了标量乘法例程，但在许多情况下，可以利用群结构更有效地执行标量乘法。为了允许此类专业化，ark-ec 提供了 ScalarMul 和 VariableBaseMSM 特性。后者特性计算一个标量向量 s 和一个群元素向量 g 之间的“内积”。也就是说，它计算 s.iter().zip(g).map(|(s, g)| g * s).sum()。

use ark_ec::{PrimeGroup, VariableBaseMSM};
use ark_ff::{PrimeField, Field};
// We'll use the BLS12-381 G1 curve for this example.
// This group has a prime order `r`, and is associated with a prime field `Fr`.
use ark_test_curves::bls12_381::{G1Projective as G, G1Affine as GAffine, Fr as ScalarField};
use ark_std::{Zero,  UniformRand};

let mut rng = ark_std::test_rng();
// Let's sample uniformly random group elements:
let a = GAffine::rand(&mut rng);
let b = GAffine::rand(&mut rng);

let s1 = ScalarField::rand(&mut rng);
let s2 = ScalarField::rand(&mut rng);

// Note that we're using the `GAffine` type here, as opposed to `G`.
// This is because MSMs are more efficient when the group elements are in affine form. (See below for why.)
//
// The `VariableBaseMSM` trait allows specializing the input group element representation to allow
// for more efficient implementations.
let r = G::msm(&[a, b], &[s1, s2]).unwrap();
assert_eq!(r, a * s1 + b * s2);

椭圆曲线群

在有限域上使用椭圆曲线时，有两个特性非常重要：CurveGroup 和 AffineRepr。这两个特性都代表了同一曲线的元素，但提供了不同的底层表示。特别是，CurveGroup 对曲线点的表示通常在算术运算中更高效，但并不提供曲线点的唯一代表。另一方面，AffineRepr 表示是唯一的，但大多数算术运算速度较慢。让我们探讨如何以及何时使用这些特性。

use ark_ec::{AdditiveGroup, AffineRepr, PrimeGroup, CurveGroup, VariableBaseMSM};
use ark_ff::{PrimeField, Field};
use ark_test_curves::bls12_381::{G1Projective as G, G1Affine as GAffine, Fr as ScalarField};
use ark_std::{Zero, UniformRand};

let mut rng = ark_std::test_rng();
// Let's generate an elliptic curve group element in the `CurveGroup` representation
let a = G::rand(&mut rng);
// We can convert it the `AffineRepr` representation...
let a_aff = a.into_affine();
// ... and check that the two representations are equal.
assert_eq!(a_aff, a);
// We can also convert back to the `CurveGroup` representation:
assert_eq!(a, a_aff.into_group());

// As a general rule, most group operations are slower when elements
// are represented as `AffineRepr`. However, adding an `AffineRepr`
// point to a `CurveGroup` one is usually slightly more efficient than
// adding two `CurveGroup` points.
let d = a + a_aff;
assert_eq!(d, a.double());

// This efficiency also translates into more efficient scalar multiplication routines.
let scalar = ScalarField::rand(&mut rng);
let mul_result = a_aff * scalar;
assert_eq!(a * scalar, mul_result);

// Finally, while not recommended, users can directly construct group elements
// from the x and y coordinates of the curve points. This is useful when implementing algorithms
// like hash-to-curve.
let a_x = a_aff.x;
let a_y = a_aff.y;
let is_at_infinity = a_aff.is_zero();
// This check ensures that `new_a` is indeed in the curve group, and in particular
// is within the prime-order group.
let new_a = GAffine::new(a_x, a_y);
assert_eq!(a_aff, new_a);
assert!(new_a.is_on_curve());
assert!(new_a.is_in_correct_subgroup_assuming_on_curve());

除了上述椭圆曲线组的抽象接口之外，ark-ec 还提供了以下常见的椭圆曲线模型的具体实现：

• Short Weierstrass 曲线。在这种情况下，AffineRepr 采用典型的 Short Weierstrass 点表示，而 CurveGroup 使用 Jacobian 坐标 中的点。
• Twisted Edwards 曲线。在这种情况下，AffineRepr 采用标准的 Twisted Edwards 曲线表示，而 CurveGroup 使用 扩展的 Twisted Edwards 坐标。

配对

Pairing 是一个特性，它定义了配对友好椭圆曲线的接口。除了通用接口之外，我们还提供了流行的配对友好曲线家族的具体实现，例如 Barreto-Lynn-Scott 和 Barreto-Naehrig 家族。

use ark_ec::{pairing::Pairing, AffineRepr};
use ark_ff::Field;
use ark_std::UniformRand;

use ark_test_curves::bls12_381::{Bls12_381, G1Projective as G1, G2Projective as G2, Fq12 as Fq12};
use ark_test_curves::bls12_381::Fr as ScalarField;

// The pairing engine is parameterized by the scalar field of the curve.
let mut rng = ark_std::test_rng();
let s = ScalarField::rand(&mut rng);
let a = G1::rand(&mut rng);
let b = G2::rand(&mut rng);

// We can compute the pairing of two points on the curve, either monolithically...
let e1 = Bls12_381::pairing(a, b);
// ... or in two steps. First, we compute the Miller loop...
let ml_result = Bls12_381::miller_loop(a, b);
// ... and then the final exponentiation.
let e2 = Bls12_381::final_exponentiation(ml_result).unwrap();
assert_eq!(e1, e2);

哈希到群

ark-ec 还提供了用于将哈希值转换为椭圆曲线组的特性。该 HashToCurve 特性允许用户将任意字节字符串哈希到椭圆曲线群元素，并允许使用不同的哈希策略。