Skip to content

Commit 025ddd7

Browse files
DreamWuGitDreamWuGit
committed
add FQ_MODULUS
1 parent 34e035f commit 025ddd7

File tree

1 file changed

+39
-26
lines changed

1 file changed

+39
-26
lines changed

‎zkevm-circuits/src/evm_circuit/execution/precompiles/p256_verify.rs

+39-26
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ use crate::{
3030
// secp256r1 Fq
3131
static FQ_MODULUS: LazyLock<U256> =
3232
LazyLock::new(|| word!("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"));
33-
33+
34+
// secp256r1 Fp
35+
static FP_MODULUS: LazyLock<U256> =
36+
LazyLock::new(|| word!("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"));
37+
3438
#[derive(Clone, Debug)]
3539
pub struct P256VerifyGadget<F> {
3640
input_bytes_rlc: Cell<F>,
@@ -44,12 +48,16 @@ pub struct P256VerifyGadget<F> {
4448
sig_r_keccak_rlc: Cell<F>,
4549
sig_s_keccak_rlc: Cell<F>,
4650
// recovered_addr_keccak_rlc: RandomLinearCombination<F, N_BYTES_ACCOUNT_ADDRESS>,
51+
pubkey_x_keccak_rlc: Cell<F>,
52+
pubkey_y_keccak_rlc: Cell<F>,
4753

4854
msg_hash_raw: Word<F>,
4955
msg_hash: Word<F>,
5056
fq_modulus: Word<F>,
5157
msg_hash_mod: ModGadget<F, true>,
5258

59+
fp_modulus: Word<F>,
60+
5361
sig_r: Word<F>,
5462
sig_r_canonical: LtWordGadget<F>,
5563
sig_s: Word<F>,
@@ -85,17 +93,19 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
8593
msg_hash_keccak_rlc,
8694
sig_r_keccak_rlc,
8795
sig_s_keccak_rlc,
88-
recovered_addr_keccak_rlc,
96+
//recovered_addr_keccak_rlc,
8997
) = (
9098
cb.query_cell_phase2(),
9199
cb.query_cell_phase2(),
92100
cb.query_cell_phase2(),
93-
cb.query_keccak_rlc(),
101+
//cb.query_keccak_rlc(),
94102
);
95103

96104
let msg_hash_raw = cb.query_word_rlc();
97105
let msg_hash = cb.query_word_rlc();
98106
let fq_modulus = cb.query_word_rlc();
107+
let fp_modulus = cb.query_word_rlc();
108+
99109
let msg_hash_mod = ModGadget::construct(cb, [&msg_hash_raw, &fq_modulus, &msg_hash]);
100110

101111
let sig_r = cb.query_word_rlc();
@@ -104,6 +114,11 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
104114
let sig_s_canonical = LtWordGadget::construct(cb, &sig_s, &fq_modulus);
105115
let r_s_canonical = and::expr([sig_r_canonical.expr(), sig_s_canonical.expr()]);
106116

117+
let pk_x = cb.query_word_rlc();
118+
let pk_y = cb.query_word_rlc();
119+
let pk_x_canonical = LtWordGadget::construct(cb, &pk_x, &fp_modulus);
120+
let pk_y_canonical = LtWordGadget::construct(cb, &pk_y, &fp_modulus);
121+
107122
cb.require_equal(
108123
"msg hash cells assigned incorrectly",
109124
msg_hash_keccak_rlc.expr(),
@@ -149,6 +164,11 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
149164
fq_modulus.expr(),
150165
cb.word_rlc::<N_BYTES_WORD>(FQ_MODULUS.to_le_bytes().map(|b| b.expr())),
151166
);
167+
cb.require_equal(
168+
"Secp256r1::Fp modulus assigned correctly",
169+
fp_modulus.expr(),
170+
cb.word_rlc::<N_BYTES_WORD>(FP_MODULUS.to_le_bytes().map(|b| b.expr())),
171+
);
152172

153173
let [is_success, callee_address, is_root, call_data_offset, call_data_length, return_data_offset, return_data_length] =
154174
[
@@ -241,17 +261,13 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
241261
+ (sig_r_keccak_rlc.expr() * r_pow_32)
242262
+ sig_s_keccak_rlc.expr(),
243263
);
244-
// RLC of output bytes always equals RLC of the recovered address.
245-
cb.require_equal(
246-
"output bytes (RLC) = recovered address",
247-
output_bytes_rlc.expr(),
248-
recovered_addr_keccak_rlc.expr(),
249-
);
250-
// If the address was not recovered, RLC(address) == RLC(output) == 0.
251-
cb.condition(not::expr(recovered.expr()), |cb| {
252-
cb.require_zero("output bytes == 0", output_bytes_rlc.expr());
253-
});
254-
264+
// TODO: constrain output first byte is bool .
265+
// cb.require_equal(
266+
// "output bytes (RLC) = recovered address",
267+
// output_bytes_rlc.expr(),
268+
// recovered_addr_keccak_rlc.expr(),
269+
// );
270+
255271
let restore_context = super::gen_restore_context(
256272
cb,
257273
is_root.expr(),
@@ -285,6 +301,10 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
285301
sig_s,
286302
sig_s_canonical,
287303

304+
pk_x,
305+
pk_x_canonical,
306+
pk_y,
307+
pk_y_canonical,
288308
is_success,
289309
callee_address,
290310
is_root,
@@ -305,7 +325,7 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
305325
call: &Call,
306326
step: &ExecStep,
307327
) -> Result<(), Error> {
308-
if let Some(PrecompileAuxData::Ecrecover(aux_data)) = &step.aux_data {
328+
if let Some(PrecompileAuxData::P256Verify(aux_data)) = &step.aux_data {
309329
self.input_bytes_rlc.assign(
310330
region,
311331
offset,
@@ -330,9 +350,7 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
330350
.keccak_input()
331351
.map(|r| rlc::value(aux_data.return_bytes.iter().rev(), r)),
332352
)?;
333-
let recovered = !aux_data.recovered_addr.is_zero();
334-
self.recovered
335-
.assign(region, offset, Value::known(F::from(recovered as u64)))?;
353+
// check is_valid of sig ?
336354
self.msg_hash_keccak_rlc.assign(
337355
region,
338356
offset,
@@ -341,14 +359,7 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
341359
.keccak_input()
342360
.map(|r| rlc::value(&aux_data.msg_hash.to_le_bytes(), r)),
343361
)?;
344-
self.sig_v_keccak_rlc.assign(
345-
region,
346-
offset,
347-
region
348-
.challenges()
349-
.keccak_input()
350-
.map(|r| rlc::value(&aux_data.sig_v.to_le_bytes(), r)),
351-
)?;
362+
352363
self.sig_r_keccak_rlc.assign(
353364
region,
354365
offset,
@@ -377,6 +388,8 @@ impl<F: Field> ExecutionGadget<F> for P256VerifyGadget<F> {
377388
.assign(region, offset, Some(remainder.to_le_bytes()))?;
378389
self.fq_modulus
379390
.assign(region, offset, Some(FQ_MODULUS.to_le_bytes()))?;
391+
self.fp_modulus
392+
.assign(region, offset, Some(FP_MODULUS.to_le_bytes()))?;
380393
self.msg_hash_mod.assign(
381394
region,
382395
offset,

0 commit comments

Comments
 (0)