ark-ec

ark-ec定义了与不同类型的加法群（重点是来自椭圆曲线的群）一起工作的特性和算法。它还为各种椭圆曲线模型提供了这些特性的具体实例，包括BLS12曲线家族等流行的配对友好曲线系列。可以使用这些曲线模型找到特定曲线的实现，见arkworks-rs/curves。

用法

Group特型

许多密码协议使用素数阶群作为核心构建块。 PrimeGroup 特型是一个抽象表示这样的阿贝尔素数阶群的元素。它提供了对群元素执行常见操作的方法

use ark_ec::{AdditiveGroup, PrimeGroup};
use ark_ff::{PrimeField, Field};
// We'll use the BLS12-381 G1 curve for this example.
// This group has a prime order `r`, and is associated with a prime field `Fr`.
use ark_test_curves::bls12_381::{G1Projective as G, Fr as ScalarField};
use ark_std::{Zero, UniformRand, ops::Mul};

let mut rng = ark_std::test_rng();
// Let's sample uniformly random group elements:
let a = G::rand(&mut rng);
let b = G::rand(&mut rng);

// We can add elements, ...
let c = a + b;
// ... subtract them, ...
let d = a - b;
// ... and double them.
assert_eq!(c + d, a.double());
// We can also negate elements, ...
let e = -a;
// ... and check that negation satisfies the basic group law
assert_eq!(e + a, G::zero());

// We can also multiply group elements by elements of the corresponding scalar field
// (an act known as *scalar multiplication*)
let scalar = ScalarField::rand(&mut rng);
let e = c.mul(scalar);
let f = e.mul(scalar.inverse().unwrap());
assert_eq!(f, c);

标量乘法

尽管 PrimeGroup 特性已经提供了标量乘法例程，但在许多情况下，可以利用群结构来更高效地执行标量乘法。为了允许此类专业化，ark-ec 提供了 ScalarMul 和 VariableBaseMSM 特性。后者特性计算一个标量向量 s 和一个群元素向量 g 之间的“内积”。也就是说，它计算 s.iter().zip(g).map(|(s, g)| g * s).sum()。

use ark_ec::{PrimeGroup, VariableBaseMSM};
use ark_ff::{PrimeField, Field};
// We'll use the BLS12-381 G1 curve for this example.
// This group has a prime order `r`, and is associated with a prime field `Fr`.
use ark_test_curves::bls12_381::{G1Projective as G, G1Affine as GAffine, Fr as ScalarField};
use ark_std::{Zero,  UniformRand};

let mut rng = ark_std::test_rng();
// Let's sample uniformly random group elements:
let a = GAffine::rand(&mut rng);
let b = GAffine::rand(&mut rng);

let s1 = ScalarField::rand(&mut rng);
let s2 = ScalarField::rand(&mut rng);

// Note that we're using the `GAffine` type here, as opposed to `G`.
// This is because MSMs are more efficient when the group elements are in affine form. (See below for why.)
//
// The `VariableBaseMSM` trait allows specializing the input group element representation to allow
// for more efficient implementations.
let r = G::msm(&[a, b], &[s1, s2]).unwrap();
assert_eq!(r, a * s1 + b * s2);

椭圆曲线群

当在有限域上处理椭圆曲线时，有两个特性非常重要：CurveGroup 和 AffineRepr。这两个特性表示同一条曲线的元素，但提供不同的底层表示。特别是，CurveGroup 的曲线点表示通常在算术运算中更高效，但它不提供曲线点的唯一表示。另一方面，AffineRepr 的表示是唯一的，但在大多数算术运算中较慢。让我们探索何时以及如何使用这些特性

use ark_ec::{AdditiveGroup, AffineRepr, PrimeGroup, CurveGroup, VariableBaseMSM};
use ark_ff::{PrimeField, Field};
use ark_test_curves::bls12_381::{G1Projective as G, G1Affine as GAffine, Fr as ScalarField};
use ark_std::{Zero, UniformRand};

let mut rng = ark_std::test_rng();
// Let's generate an elliptic curve group element in the `CurveGroup` representation
let a = G::rand(&mut rng);
// We can convert it the `AffineRepr` representation...
let a_aff = a.into_affine();
// ... and check that the two representations are equal.
assert_eq!(a_aff, a);
// We can also convert back to the `CurveGroup` representation:
assert_eq!(a, a_aff.into_group());

// As a general rule, most group operations are slower when elements
// are represented as `AffineRepr`. However, adding an `AffineRepr`
// point to a `CurveGroup` one is usually slightly more efficient than
// adding two `CurveGroup` points.
let d = a + a_aff;
assert_eq!(d, a.double());

// This efficiency also translates into more efficient scalar multiplication routines.
let scalar = ScalarField::rand(&mut rng);
let mul_result = a_aff * scalar;
assert_eq!(a * scalar, mul_result);

// Finally, while not recommended, users can directly construct group elements
// from the x and y coordinates of the curve points. This is useful when implementing algorithms
// like hash-to-curve.
let a_x = a_aff.x;
let a_y = a_aff.y;
let is_at_infinity = a_aff.is_zero();
// This check ensures that `new_a` is indeed in the curve group, and in particular
// is within the prime-order group.
let new_a = GAffine::new(a_x, a_y);
assert_eq!(a_aff, new_a);
assert!(new_a.is_on_curve());
assert!(new_a.is_in_correct_subgroup_assuming_on_curve());

除了上述椭圆曲线群的抽象接口之外，ark-ec 还提供了以下常见椭圆曲线模型的具象实例

• 短韦尔斯特拉斯 曲线。在这种情况下，AffineRepr 是典型的短韦尔斯特拉斯点表示，而 CurveGroup 使用的是 雅可比坐标 中的点。
• 扭曲爱德华兹 曲线。在这种情况下，AffineRepr 是标准的扭曲爱德华兹曲线表示，而 CurveGroup 使用的是 扩展扭曲爱德华兹坐标。

配对

Pairing 是一个特性，它定义了配对友好椭圆曲线的接口。除了通用接口之外，我们还提供了对流行的配对友好曲线家族的具象实例，例如 巴雷托-林恩-斯科特 和 巴雷托-内赫里格 家族。

use ark_ec::{pairing::Pairing, AffineRepr};
use ark_ff::Field;
use ark_std::UniformRand;

use ark_test_curves::bls12_381::{Bls12_381, G1Projective as G1, G2Projective as G2, Fq12 as Fq12};
use ark_test_curves::bls12_381::Fr as ScalarField;

// The pairing engine is parameterized by the scalar field of the curve.
let mut rng = ark_std::test_rng();
let s = ScalarField::rand(&mut rng);
let a = G1::rand(&mut rng);
let b = G2::rand(&mut rng);

// We can compute the pairing of two points on the curve, either monolithically...
let e1 = Bls12_381::pairing(a, b);
// ... or in two steps. First, we compute the Miller loop...
let ml_result = Bls12_381::miller_loop(a, b);
// ... and then the final exponentiation.
let e2 = Bls12_381::final_exponentiation(ml_result).unwrap();
assert_eq!(e1, e2);

哈希到群

ark-ec 还提供了将哈希值映射到椭圆曲线群的特性。HashToCurve 特性允许用户将任意字节数组哈希到椭圆曲线群元素，并允许使用不同的哈希策略。