-- Hoogle documentation, generated by Haddock -- See Hoogle, http://www.haskell.org/hoogle/ -- | Bilinear pairings -- -- Optimal Ate pairing over Barreto-Naehrig curves @package pairing @version 1.0.0 module Data.Pairing -- | Pairings of general cryptographic groups. -- -- Let G1 and G2 be additive cyclic groups of prime -- order r, and GT be a multiplicative cyclic group of -- prime order r. -- -- Then the pairing is defined to be of type G1 x G2 -> GT, -- and satisfies bilinearity, non-degeneracy, and computability. class (Arbitrary (G1 e), Arbitrary (G2 e), Arbitrary (GT e), Eq (G1 e), Eq (G2 e), Eq (GT e), Generic (G1 e), Generic (G2 e), Generic (GT e), Group (G1 e), Group (G2 e), Group (GT e), NFData (G1 e), NFData (G2 e), NFData (GT e), Random (G1 e), Random (G2 e), Random (GT e), Show (G1 e), Show (G2 e), Show (GT e)) => Pairing e where { -- | Left group G1. type family G1 e = (g :: *) | g -> e; -- | Right group G2. type family G2 e = (g :: *) | g -> e; -- | Target group GT. type family GT e = (g :: *) | g -> e; } -- | Computable non-degenerate bilinear map. pairing :: Pairing e => G1 e -> G2 e -> GT e -- | Pairings of a family of pairing-friendly elliptic curves. -- -- Let E(Fq) be an elliptic curve over a prime field -- Fq, and let Fq < Fq' < Fq'' < Fq''' be a -- tower of simple field extensions defined by irreducible monic -- polynomials u, v, and w. -- -- Then the pairing is defined to be of type E(Fq) x E(Fq') -> -- U_r, where U_r is the r-th roots of unity -- multiplicative subgroup of Fq''', and r is the order -- of E(Fq) and the order of a prime field Fr. type ECPairing e q r u v w = (Pairing e, ECPairingG1 e q r, ECPairingG2 e q r u, ECPairingGT e q r u v w) -- | Pairing-friendly elliptic curve left group E(Fq). type ECPairingG1 e q r = (KnownNat q, WACurve e (Prime q) (Prime r), G1 e ~ WAPoint e (Prime q) (Prime r)) -- | Pairing-friendly elliptic curve right group E(Fq'). type ECPairingG2 e q r u = (IrreducibleMonic u (Prime q), WACurve e (Extension u (Prime q)) (Prime r), G2 e ~ WAPoint e (Extension u (Prime q)) (Prime r)) -- | Pairing-friendly field multiplicative target group U_r. type ECPairingGT e q r u v w = (KnownNat r, IrreducibleMonic v (Extension u (Prime q)), IrreducibleMonic w (Extension v (Extension u (Prime q))), GT e ~ RootsOfUnity r (Extension w (Extension v (Extension u (Prime q))))) module Data.Pairing.Ate -- | Miller algorithm for Barreto-Lynn-Scott degree 12 curves. millerAlgorithmBLS12 :: ECPairing e q r u v w => [Int8] -> G1 e -> G2 e -> GT e -- | Final exponentiation for Barreto-Lynn-Scott degree 12 curves. finalExponentiationBLS12 :: ECPairing e q r u v w => Integer -> GT e -> GT e -- | Miller algorithm for Barreto-Naehrig curves. millerAlgorithmBN :: ECPairing e q r u v w => Extension u (Prime q) -> [Int8] -> G1 e -> G2 e -> GT e -- | Final exponentiation for Barreto-Naehrig curves. finalExponentiationBN :: ECPairing e q r u v w => Integer -> GT e -> GT e module Data.Pairing.BLS12381 -- | BLS12381 curve. data BLS12381 -- | BLS12381 curve parameter s = t in signed binary. parameterBin :: [Int8] -- | BLS12381 curve parameter t in hexadecimal. parameterHex :: Integer -- | Field of points of BLS12381 curve. type Fq = Prime Q -- | Field of points of BLS12381 curve over Fq2. type Fq2 = Extension U Fq -- | Field of points of BLS12381 curve over Fq6. type Fq6 = Extension V Fq2 -- | Field of points of BLS12381 curve over Fq12. type Fq12 = Extension W Fq6 -- | Field of coefficients of BLS12381 curve. type Fr = Prime R -- | BLS12381 curve left group G1 = E(Fq). type G1' = PA -- | BLS12381 curve right group G2 = E'(Fq2). type G2' = PA -- | Fq12 multiplicative target group GT. type GT' = RootsOfUnity R Fq12 -- | Precompute primitive roots of unity for binary powers that divide -- r - 1. getRootOfUnity :: Int -> Fr instance Data.Pairing.Pairing Data.Curve.Weierstrass.BLS12381.BLS12381 instance Data.Field.Galois.Unity.CyclicSubgroup (Data.Field.Galois.Unity.RootsOfUnity Data.Curve.Weierstrass.BLS12381.R Data.Pairing.BLS12381.Fq12) instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BLS12381.W Data.Pairing.BLS12381.Fq6 instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BLS12381.V Data.Curve.Weierstrass.BLS12381T.Fq2 module Data.Pairing.BN254 -- | BN254 curve. data BN254 -- | BN254 curve parameter s = 6t + 2 in signed binary. parameterBin :: [Int8] -- | BN254 curve parameter t in hexadecimal. parameterHex :: Integer -- | Field of points of BN254 curve. type Fq = Prime Q -- | Field of points of BN254 curve over Fq2. type Fq2 = Extension U Fq -- | Field of points of BN254 curve over Fq6. type Fq6 = Extension V Fq2 -- | Field of points of BN254 curve over Fq12. type Fq12 = Extension W Fq6 -- | Field of coefficients of BN254 curve. type Fr = Prime R -- | BN254 curve left group G1 = E(Fq). type G1' = PA -- | BN254 curve right group G2 = E'(Fq2). type G2' = PA -- | Fq12 multiplicative target group GT. type GT' = RootsOfUnity R Fq12 -- | Precompute primitive roots of unity for binary powers that divide -- r - 1. getRootOfUnity :: Int -> Fr instance Data.Pairing.Pairing Data.Curve.Weierstrass.BN254.BN254 instance Data.Field.Galois.Unity.CyclicSubgroup (Data.Field.Galois.Unity.RootsOfUnity Data.Curve.Weierstrass.BN254.R Data.Pairing.BN254.Fq12) instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254.W Data.Pairing.BN254.Fq6 instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254.V Data.Curve.Weierstrass.BN254T.Fq2 module Data.Pairing.BN254A -- | BN254A curve. data BN254A -- | BN254A curve parameter s = 6t + 2 in signed binary. parameterBin :: [Int8] -- | BN254A curve parameter t in hexadecimal. parameterHex :: Integer -- | Field of points of BN254A curve. type Fq = Prime Q -- | Field of points of BN254A curve over Fq2. type Fq2 = Extension U Fq -- | Field of points of BN254A curve over Fq6. type Fq6 = Extension V Fq2 -- | Field of points of BN254A curve over Fq12. type Fq12 = Extension W Fq6 -- | Field of coefficients of BN254A curve. type Fr = Prime R -- | BN254A curve left group G1 = E(Fq). type G1' = PA -- | BN254A curve right group G2 = E'(Fq2). type G2' = PA -- | Fq12 multiplicative target group GT. type GT' = RootsOfUnity R Fq12 -- | Precompute primitive roots of unity for binary powers that divide -- r - 1. getRootOfUnity :: Int -> Fr instance Data.Pairing.Pairing Data.Curve.Weierstrass.BN254A.BN254A instance Data.Field.Galois.Unity.CyclicSubgroup (Data.Field.Galois.Unity.RootsOfUnity Data.Curve.Weierstrass.BN254A.R Data.Pairing.BN254A.Fq12) instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254A.W Data.Pairing.BN254A.Fq6 instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254A.V Data.Curve.Weierstrass.BN254AT.Fq2 module Data.Pairing.BN254B -- | BN254B curve. data BN254B -- | BN254B curve parameter s = 6t + 2 in signed binary. parameterBin :: [Int8] -- | BN254B curve parameter t in hexadecimal. parameterHex :: Integer -- | Field of points of BN254B curve. type Fq = Prime Q -- | Field of points of BN254B curve over Fq2. type Fq2 = Extension U Fq -- | Field of points of BN254B curve over Fq6. type Fq6 = Extension V Fq2 -- | Field of points of BN254B curve over Fq12. type Fq12 = Extension W Fq6 -- | Field of coefficients of BN254B curve. type Fr = Prime R -- | BN254B curve left group G1 = E(Fq). type G1' = PA -- | BN254B curve right group G2 = E'(Fq2). type G2' = PA -- | Fq12 multiplicative target group GT. type GT' = RootsOfUnity R Fq12 -- | Precompute primitive roots of unity for binary powers that divide -- r - 1. getRootOfUnity :: Int -> Fr instance Data.Pairing.Pairing Data.Curve.Weierstrass.BN254B.BN254B instance Data.Field.Galois.Unity.CyclicSubgroup (Data.Field.Galois.Unity.RootsOfUnity Data.Curve.Weierstrass.BN254B.R Data.Pairing.BN254B.Fq12) instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254B.W Data.Pairing.BN254B.Fq6 instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254B.V Data.Curve.Weierstrass.BN254BT.Fq2 module Data.Pairing.BN254C -- | BN254C curve. data BN254C -- | BN254C curve parameter s = 6t + 2 in signed binary. parameterBin :: [Int8] -- | BN254C curve parameter t in hexadecimal. parameterHex :: Integer -- | Field of points of BN254C curve. type Fq = Prime Q -- | Field of points of BN254C curve over Fq2. type Fq2 = Extension U Fq -- | Field of points of BN254C curve over Fq6. type Fq6 = Extension V Fq2 -- | Field of points of BN254C curve over Fq12. type Fq12 = Extension W Fq6 -- | Field of coefficients of BN254C curve. type Fr = Prime R -- | BN254C curve left group G1 = E(Fq). type G1' = PA -- | BN254C curve right group G2 = E'(Fq2). type G2' = PA -- | Fq12 multiplicative target group GT. type GT' = RootsOfUnity R Fq12 -- | Precompute primitive roots of unity for binary powers that divide -- r - 1. getRootOfUnity :: Int -> Fr instance Data.Pairing.Pairing Data.Curve.Weierstrass.BN254C.BN254C instance Data.Field.Galois.Unity.CyclicSubgroup (Data.Field.Galois.Unity.RootsOfUnity Data.Curve.Weierstrass.BN254C.R Data.Pairing.BN254C.Fq12) instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254C.W Data.Pairing.BN254C.Fq6 instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254C.V Data.Curve.Weierstrass.BN254CT.Fq2 module Data.Pairing.BN254D -- | BN254D curve. data BN254D -- | BN254D curve parameter s = 6t + 2 in signed binary. parameterBin :: [Int8] -- | BN254D curve parameter t in hexadecimal. parameterHex :: Integer -- | Field of points of BN254D curve. type Fq = Prime Q -- | Field of points of BN254D curve over Fq2. type Fq2 = Extension U Fq -- | Field of points of BN254D curve over Fq6. type Fq6 = Extension V Fq2 -- | Field of points of BN254D curve over Fq12. type Fq12 = Extension W Fq6 -- | Field of coefficients of BN254D curve. type Fr = Prime R -- | BN254D curve left group G1 = E(Fq). type G1' = PA -- | BN254D curve right group G2 = E'(Fq2). type G2' = PA -- | Fq12 multiplicative target group GT. type GT' = RootsOfUnity R Fq12 -- | Precompute primitive roots of unity for binary powers that divide -- r - 1. getRootOfUnity :: Int -> Fr instance Data.Pairing.Pairing Data.Curve.Weierstrass.BN254D.BN254D instance Data.Field.Galois.Unity.CyclicSubgroup (Data.Field.Galois.Unity.RootsOfUnity Data.Curve.Weierstrass.BN254D.R Data.Pairing.BN254D.Fq12) instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254D.W Data.Pairing.BN254D.Fq6 instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN254D.V Data.Curve.Weierstrass.BN254DT.Fq2 module Data.Pairing.BN462 -- | BN462 curve. data BN462 -- | BN462 curve parameter s = 6t + 2 in signed binary. parameterBin :: [Int8] -- | BN462 curve parameter t in hexadecimal. parameterHex :: Integer -- | Field of points of BN462 curve. type Fq = Prime Q -- | Field of points of BN462 curve over Fq2. type Fq2 = Extension U Fq -- | Field of points of BN462 curve over Fq6. type Fq6 = Extension V Fq2 -- | Field of points of BN462 curve over Fq12. type Fq12 = Extension W Fq6 -- | Field of coefficients of BN462 curve. type Fr = Prime R -- | BN462 curve left group G1 = E(Fq). type G1' = PA -- | BN462 curve right group G2 = E'(Fq2). type G2' = PA -- | Fq12 multiplicative target group GT. type GT' = RootsOfUnity R Fq12 -- | Precompute primitive roots of unity for binary powers that divide -- r - 1. getRootOfUnity :: Int -> Fr instance Data.Pairing.Pairing Data.Curve.Weierstrass.BN462.BN462 instance Data.Field.Galois.Unity.CyclicSubgroup (Data.Field.Galois.Unity.RootsOfUnity Data.Curve.Weierstrass.BN462.R Data.Pairing.BN462.Fq12) instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN462.W Data.Pairing.BN462.Fq6 instance Data.Field.Galois.Extension.IrreducibleMonic Data.Pairing.BN462.V Data.Curve.Weierstrass.BN462T.Fq2 module Data.Pairing.Hash -- | Encodes a given byte string to a point on the BLS12 curve. -- -- The implementation uses the Shallue-van de Woestijne encoding to BLS12 -- curves as specified in Section 3 of Fast and simple constant-time -- hashing to the BLS12-381 elliptic curve. -- -- This function is not implemented yet. swEncBLS12 :: forall e m q r u v w. (MonadRandom m, ECPairing e q r u v w) => ByteString -> m (Maybe (G1 e)) -- | Encodes a given byte string to a point on the BN curve. -- -- The implementation uses the Shallue-van de Woestijne encoding to BN -- curves as specified in Section 6 of Indifferentiable Hashing to -- Barreto-Naehrig Curves. -- -- This function evaluates an empty bytestring or one that contains NUL -- to zero and is sent to an arbitrary point on the curve. swEncBN :: forall e m q r u v w. (MonadRandom m, ECPairing e q r u v w) => ByteString -> m (Maybe (G1 e))