-
Notifications
You must be signed in to change notification settings - Fork 56
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Discuss: enforce mul_by_inverse
#70
Conversation
This one would need a little bit more mental effort to review, as it is not straightforward. |
I feel like we previously used to enforce these constraints; was there a reason why we stopped, @ValarDragon ? |
I think this issue was noticed in the discussion of #42 (comment) but we just forgot to follow up with it. |
Nope, I found that this one (the one-constraint version) is still not sound. When |
It is another thing to discuss: do we want to require the caller to This has an effect on non-zero affine gadgets, as it now requires additional constraints to handle the case of adding the point to itself and doubling-and-adding the point to itself. |
Given the discussion above, it seems that all the single-constraint implementation of So, I replaced the |
the appropriate pseudocode seems to be
I think for the |
If we require the caller to ensure that Definitely looks this has always been missing the |
I think this also suggests we need a general way of having tests identify allocated vars within a gadget, and try randomly mutating one at a time and ensuring failure. |
Following Pratyush's suggestion, I think this:
has two things: |
We may consider |
I will merge this one sooner, and we may need to release a new version (0.3.1) + make a security announcement, based on the discussion in Telegram. I feel that likely we will let |
Description
It seems that the
mul_by_inverse
implementation has a soundness issue that the newly allocatedd_inv
does not need to be the inverse ofd
but could be any value. This can be a soundness issue as thepoly
gadgets have used this API.The speed improvement seems okay for
FpVar
, but the constraint needs to be manually written (otherwise, mul + inverse or mul + equal always cause two constraints).It passes the existing tests.
Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.
Pending
section inCHANGELOG.md
Files changed
in the Github PR explorer