curve BLS12-377/381 BN256 SageMath脚本

1. BLS12-377 curve

BLS12-377 curve为：
$y^2=x^3+b$ over $F_p$ field

其中$b=1$，$p=258664426012969094010652733694893533536393512754914660539884262666720468348340822774968888139573360124440321458177$。

1.1 BLS12-377 Scalar Field

Montgomery R. 实际R = 2^256 mod q。
factor(q-1)=2^s*t。
BLS12-377 Scalar Field SageMath脚本：

q = 8444461749428370424248824938781546531375899335154063827935233455917409239041
R = 6014086494747379908336260804527802945383293308637734276299549080986809532403
s = 47
o = q - 1
F = GF(q)
g = F.multiplicative_generator()
assert g.multiplicative_order() == o
g2 = g ** (o/2**s)
assert g2.multiplicative_order() == 2**s
def into_chunks(val, width, n):
    return [hex(int(val) // (2 ** (width * i)) % 2 ** width) for i in range(n)]
print("Gen (g % q): ", g % q)
print("Gen (g * R % q): ", g * R % q)
print("Gen into_chunks(g * R % q): ", into_chunks(g * R % q, 64, 4))
print("2-adic gen (g2 % q): ", g2 % q)
print("2-adic gen (g2 * R % q): ", g2 * R % q)
print("2-adic gen into_chunks(g2 * R % q): ", into_chunks(g2 * R % q, 64, 4))

输出结果为：

Gen (g % q):  22
Gen (g * R % q):  5642976643016801619665363617888466827793962762719196659561577942948671127251
Gen into_chunks(g * R % q):  ['0x296c7ffffffffed3', '0x929216656ffffec7', '0x4c01534d92860e69', '0xc79cfc4b9819970']
2-adic gen (g2 % q):  8065159656716812877374967518403273466521432693661810619979959746626482506078
2-adic gen (g2 * R % q):  7039866554349711480672062101017509031917008525101396696252683426045173093960
2-adic gen into_chunks(g2 * R % q):  ['0xaf80da4dda3ad648', '0x5e223adbfc381dac', '0x3ba0666b2f92525', '0xf906c5b3befb0ce']

to get the root of unity array脚本为：

for d in range(0, s):
	print("The ", d, "-th root of unity: ", into_chunks(g2**(2**d) * R % q, 64, 4))

2. BN256 curve

BN256 curve为：
$y^2=x^3+b$ over $F_p$ field

其中$b=3$，$p=21888242871839275222246405745257275088696311157297823662689037894645226208583$。

2.1 BN256 Scalar Field

Montgomery R. 实际R = 2^256 mod q。
factor(q-1)=2^s*t。
bn256 Scalar Field SageMath脚本：

q = 21888242871839275222246405745257275088548364400416034343698204186575808495617
R =  6350874878119819312338956282401532410528162663560392320966563075034087161851  
s = 28
o = q - 1
F = GF(q)
g = F.multiplicative_generator() 
assert g.multiplicative_order() == o
g2 = g ** (o/2**s)
assert g2.multiplicative_order() == 2**s
def into_chunks(val, width, n):
    return [hex(int(val) // (2 ** (width * i)) % 2 ** width) for i in range(n)]
print("Gen (g % q): ", g % q)
print("Gen (g * R % q): ", g * R % q)
print("Gen into_chunks(g * R % q): ", into_chunks(g * R % q, 32, 8))
print("2-adic gen (g2 % q): ", g2 % q)
print("2-adic gen (g2 * R % q): ", g2 * R % q)
print("2-adic gen into_chunks(g2 * R % q): ", into_chunks(g2 * R % q, 32, 8))

输出结果为：

Gen (g % q):  5
Gen (g * R % q):  9866131518759821339448375666750386964092448917385927261134611188594627313638
Gen into_chunks(g * R % q):  ['0x9fffffe6', '0x1b0d0ef9', '0xa32a913f', '0xeaba68a3', '0xd8dd0689', '0x47d8eb76', '0x20f5bbc3', '0x15d00855']
2-adic gen (g2 % q):  19103219067921713944291392827692070036145651957329286315305642004821462161904
2-adic gen (g2 * R % q):  11026779196025039675543067535165575398706865421176733435921293210460577938844
2-adic gen into_chunks(g2 * R % q):  ['0x80d13d9c', '0x636e7355', '0x2445ffd6', '0xa22bf374', '0x1eb203d8', '0x56452ac0', '0x2963f9e7', '0x1860ef94']

注意，此处的generator g为5。而在 https://github.com/matter-labs/pairing/blob/master/src/bn256/fr.rs中，选的generator为7，而不是5?【二者等价。】
二者order都是2**s。

sage: F(5).multiplicative_order()                                                                                                                                                                         
21888242871839275222246405745257275088548364400416034343698204186575808495616
sage: F(7).multiplicative_order()                                                                                                                                                                         
21888242871839275222246405745257275088548364400416034343698204186575808495616

可修改为：

q = 21888242871839275222246405745257275088548364400416034343698204186575808495617
R =  6350874878119819312338956282401532410528162663560392320966563075034087161851  
s = 28
o = q - 1
F = GF(q)
g = F(7)
assert g.multiplicative_order() == o
g2 = g ** (o/2**s)
assert g2.multiplicative_order() == 2**s
def into_chunks(val, width, n):
    return [hex(int(val) // (2 ** (width * i)) % 2 ** width) for i in range(n)]
print("Gen (g % q): ", g % q)
print("Gen (g * R % q): ", g * R % q)
print("Gen into_chunks(g * R % q): ", into_chunks(g * R % q, 32, 8))
print("2-adic gen (g2 % q): ", g2 % q)
print("2-adic gen (g2 * R % q): ", g2 * R % q)
print("2-adic gen into_chunks(g2 * R % q): ", into_chunks(g2 * R % q, 32, 8))

相应输出为：

Gen (g % q):  7
Gen (g * R % q):  679638403160184741879882486296176696600409844090677559369533152086993141723
Gen into_chunks(g * R % q):  ['0x4fffffdb', '0x3057819e', '0x6832bb01', '0x307f6d86', '0x484e3a89', '0x5c65ec9f', '0x73d3d9f8', '0x180a965']
2-adic gen (g2 % q):  1748695177688661943023146337482803886740723238769601073607632802312037301404
2-adic gen (g2 * R % q):  13302640224962090080372469718276213809319545764099277440601762868024527421112
2-adic gen into_chunks(g2 * R % q):  ['0xb639feb8', '0x9632c7c5', '0xd0ff299', '0x985ce340', '0x1b0ecd8', '0xb2dd8800', '0x6d98ce29', '0x1d69070d']

以及：

sage: into_chunks(g2*g2*R %q, 32,8)                                                                                                                                                                       
['0xec57db3',
 '0xe1ef40ad',
 '0xee40b76b',
 '0xcd1ac2ce',
 '0x4dfbd166',
 '0x1c8ccf8b',
 '0xec337b30',
 '0x10f18813']
sage: into_chunks(g2**4*R %q, 32,8)                                                                                                                                                                       
['0xf7ccc56e',
 '0x7640c5d5',
 '0xd8f3f2a7',
 '0xe716f31f',
 '0xf430ff47',
 '0x76dc9ef6',
 '0x364e38db',
 '0x221cf465']
sage: into_chunks(g2**8*R %q, 32,8)                                                                                                                                                                       
['0xcb3c1dda',
 '0xb91c3f6a',
 '0x5473a018',
 '0x9ec4a464',
 '0x6b0fdf0c',
 '0xe9f95d64',
 '0xc8c42ef6',
 '0x2f7abadc']

3. BLS12-381 curve

BLS12-381 curve为：
$y^2=x^3+b$ over $F_p$ field

其中$b=4$，$p=4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559787$。

3.1 BLS12-381 Scalar Field

Montgomery R. 实际R = 2^256 mod q。
factor(q-1)=2^s*t。
BLS12-381 Scalar Field SageMath脚本为：

q = 52435875175126190479447740508185965837690552500527637822603658699938581184513
R = 2**256 % q 
s = 32
o = q - 1
F = GF(q)
g = F.multiplicative_generator()
assert g.multiplicative_order() == o
g2 = g ** (o/2**s)
assert g2.multiplicative_order() == 2**s
def into_chunks(val, width, n):
    return [hex(int(val) // (2 ** (width * i)) % 2 ** width) for i in range(n)]
print("Gen (g % q): ", g % q)
print("Gen (g * R % q): ", g * R % q)
print("Gen into_chunks(g * R % q): ", into_chunks(g * R % q, 64, 4))
print("2-adic gen (g2 % q): ", g2 % q)
print("2-adic gen (g2 * R % q): ", g2 * R % q)
print("2-adic gen into_chunks(g2 * R % q): ", into_chunks(g2 * R % q, 64, 4))

输出结果为：

Gen (g % q):  7
Gen (g * R % q):  24006497034320510773280787438025867407531605151569380937148207556313189711857
Gen into_chunks(g * R % q):  ['0xefffffff1', '0x17e363d300189c0f', '0xff9c57876f8457b0', '0x351332208fc5a8c4']
2-adic gen (g2 % q):  10238227357739495823651030575849232062558860180284477541189508159991286009131
2-adic gen (g2 * R % q):  41591012939933701679937910449512288723811437702128681116874646627560979318378
2-adic gen into_chunks(g2 * R % q):  ['0xb9b58d8c5f0e466a', '0x5b1b4c801819d7ec', '0xaf53ae352a31e64', '0x5bf3adda19e9b27b']

参考资料

[1] Standard curve database