You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The emulated methods Exp and ModExp take exponents as the same field elements as base, but in practice they do not belong to the field.
This is particularly case for the Exp method where when we obtain the exponent through a computation
l:=f.Mul(b, c)
res:=f.Exp(a, l)
then l can be either l or l+p (as the value is provided from hint). In this case, the result could be incorrect.
My proposal:
either omit Exp method as the method signature is just incorrect. Or it should take as an input frontend.Variable (or bits directly?) and we add documentation that we represent this as an integer.
add documentation for ModExp method which explains that exponent is not from the same field. Or we should already take bits as an input.
In both of the cases, actually it could be beneficial when we take directly bits as an input as this would allow to optimize the number of loops when computing the modular exponentiation (the number of loops is the length of the bits slice).
The text was updated successfully, but these errors were encountered:
The emulated methods
Exp
andModExp
take exponents as the same field elements as base, but in practice they do not belong to the field.This is particularly case for the
Exp
method where when we obtain the exponent through a computationthen
l
can be eitherl
orl+p
(as the value is provided from hint). In this case, the result could be incorrect.My proposal:
Exp
method as the method signature is just incorrect. Or it should take as an inputfrontend.Variable
(or bits directly?) and we add documentation that we represent this as an integer.ModExp
method which explains thatexponent
is not from the same field. Or we should already take bits as an input.In both of the cases, actually it could be beneficial when we take directly bits as an input as this would allow to optimize the number of loops when computing the modular exponentiation (the number of loops is the length of the bits slice).
The text was updated successfully, but these errors were encountered: