Fix: Bandersnatch GLV scalar multiplication

std/algebra/native/twistededwards/curve.go

@@ -46,14 +46,7 @@ func (c *curve) AssertIsOnCurve(p1 Point) {
 }
 func (c *curve) ScalarMul(p1 Point, scalar frontend.Variable) Point {
 	var p Point
-	if c.endo != nil {
-		// TODO restore
-		// this is disabled until this issue is solved https://github.com/ConsenSys/gnark/issues/268
-		// p.scalarMulGLV(c.api, &p1, scalar, c.params, c.endo)
-		p.scalarMul(c.api, &p1, scalar, c.params)
-	} else {
-		p.scalarMul(c.api, &p1, scalar, c.params)
-	}
+	p.scalarMul(c.api, &p1, scalar, c.params, c.endo)
 	return p
 }
 func (c *curve) DoubleBaseScalarMul(p1, p2 Point, s1, s2 frontend.Variable) Point {

std/algebra/native/twistededwards/hints.go

@@ -0,0 +1,136 @@
+package twistededwards
+
+import (
+	"fmt"
+	"math/big"
+
+	"github.com/consensys/gnark-crypto/ecc"
+	"github.com/consensys/gnark/constraint/solver"
+	"github.com/consensys/gnark/frontend"
+	"github.com/consensys/gnark/std/math/emulated"
+	"github.com/consensys/gnark/std/math/emulated/emparams"
+)
+
+func GetHints() []solver.Hint {
+	return []solver.Hint{
+		decomposeScalar,
+		decomposeScalarSigns,
+		decompose,
+	}
+}
+
+func init() {
+	solver.RegisterHint(GetHints()...)
+}
+
+type glvParams struct {
+	lambda, order big.Int
+	glvBasis      ecc.Lattice
+}
+
+func decomposeScalar(nativeMod *big.Int, nativeInputs, nativeOutputs []*big.Int) error {
+	return emulated.UnwrapHintWithNativeInput(nativeInputs, nativeOutputs, func(nnMod *big.Int, nninputs, nnOutputs []*big.Int) error {
+		if len(nninputs) != 1 {
+			return fmt.Errorf("expecting one input")
+		}
+		if len(nnOutputs) != 2 {
+			return fmt.Errorf("expecting two outputs")
+		}
+		var glv glvParams
+		glv.lambda.SetString("8913659658109529928382530854484400854125314752504019737736543920008458395397", 10)
+		glv.order.SetString("13108968793781547619861935127046491459309155893440570251786403306729687672801", 10)
+		ecc.PrecomputeLattice(&glv.order, &glv.lambda, &glv.glvBasis)
+		sp := ecc.SplitScalar(nninputs[0], &glv.glvBasis)
+		nnOutputs[0].Set(&(sp[0]))
+		nnOutputs[1].Set(&(sp[1]))
+
+		if nnOutputs[1].Sign() == -1 {
+			nnOutputs[1].Neg(nnOutputs[1])
+		}
+
+		return nil
+	})
+}
+
+func decomposeScalarSigns(mod *big.Int, inputs []*big.Int, outputs []*big.Int) error {
+	if len(inputs) != 1 {
+		return fmt.Errorf("expecting one input")
+	}
+	if len(outputs) != 1 {
+		return fmt.Errorf("expecting one output")
+	}
+	var glv glvParams
+	glv.lambda.SetString("8913659658109529928382530854484400854125314752504019737736543920008458395397", 10)
+	glv.order.SetString("13108968793781547619861935127046491459309155893440570251786403306729687672801", 10)
+	ecc.PrecomputeLattice(&glv.order, &glv.lambda, &glv.glvBasis)
+	sp := ecc.SplitScalar(inputs[0], &glv.glvBasis)
+	outputs[0].SetUint64(0)
+	if sp[1].Sign() == -1 {
+		outputs[0].SetUint64(1)
+	}
+
+	return nil
+}
+
+func callDecomposeScalar(api frontend.API, s frontend.Variable) (s1, s2, s3 frontend.Variable) {
+	var fr emparams.BandersnatchFr
+	var glv glvParams
+	glv.lambda.SetString("8913659658109529928382530854484400854125314752504019737736543920008458395397", 10)
+
+	sapi, err := emulated.NewField[emparams.BandersnatchFr](api)
+	if err != nil {
+		panic(err)
+	}
+	// compute the decomposition using a hint. We have to use the emulated
+	// version which takes native input and outputs non-native outputs.
+	//
+	// the hints allow to decompose the scalar s into s1 and s2 such that
+	//     s1 + λ * s2 == s mod r,
+	// where λ is third root of one in 𝔽_r.
+	sd, err := sapi.NewHintWithNativeInput(decomposeScalar, 2, s)
+	if err != nil {
+		panic(err)
+	}
+	bit, err := api.NewHint(decomposeScalarSigns, 1, s)
+	if err != nil {
+		panic(err)
+	}
+	// lambda as nonnative element
+	lambdaEmu := sapi.NewElement(glv.lambda)
+	// the scalar as nonnative element. We need to split at 64 bits.
+	limbs, err := api.NewHint(decompose, int(fr.NbLimbs()), s)
+	if err != nil {
+		panic(err)
+	}
+	semu := sapi.NewElement(limbs)
+	// we negated s2 in decomposeScalar so we check instead:
+	// 		s1 + λ * s2 == s mod r
+	_s1 := sapi.Select(bit[0], sapi.Neg(sd[1]), sd[1])
+	rhs := sapi.MulNoReduce(_s1, lambdaEmu)
+	rhs = sapi.Add(rhs, sd[0])
+	sapi.AssertIsEqual(rhs, semu)
+
+	s1 = 0
+	s2 = 0
+	s3 = bit[0]
+	b := big.NewInt(1)
+	for i := range sd[0].Limbs {
+		s1 = api.Add(s1, api.Mul(sd[0].Limbs[i], b))
+		s2 = api.Add(s2, api.Mul(sd[1].Limbs[i], b))
+		b.Lsh(b, 64)
+	}
+	return s1, s2, s3
+}
+
+func decompose(mod *big.Int, inputs, outputs []*big.Int) error {
+	if len(inputs) != 1 && len(outputs) != 4 {
+		return fmt.Errorf("input/output length mismatch")
+	}
+	tmp := new(big.Int).Set(inputs[0])
+	mask := new(big.Int).SetUint64(^uint64(0))
+	for i := 0; i < 4; i++ {
+		outputs[i].And(tmp, mask)
+		tmp.Rsh(tmp, 64)
+	}
+	return nil
+}

std/algebra/native/twistededwards/point.go

@@ -18,6 +18,7 @@ package twistededwards
 
 import (
 	"github.com/consensys/gnark/frontend"
+	"github.com/consensys/gnark/internal/frontendtype"
 )
 
 // neg computes the negative of a point in SNARK coordinates
@@ -95,17 +96,12 @@ func (p *Point) double(api frontend.API, p1 *Point, curve *CurveParams) *Point {
 	return p
 }
 
-// scalarMul computes the scalar multiplication of a point on a twisted Edwards curve
+// scalarMulGeneric computes the scalar multiplication of a point on a twisted Edwards curve
 // p1: base point (as snark point)
 // curve: parameters of the Edwards curve
 // scal: scalar as a SNARK constraint
 // Standard left to right double and add
-func (p *Point) scalarMul(api frontend.API, p1 *Point, scalar frontend.Variable, curve *CurveParams, endo ...*EndoParams) *Point {
-	if len(endo) == 1 && endo[0] != nil {
-		// use glv
-		return p.scalarMulGLV(api, p1, scalar, curve, endo[0])
-	}
-
+func (p *Point) scalarMulGeneric(api frontend.API, p1 *Point, scalar frontend.Variable, curve *CurveParams, endo ...*EndoParams) *Point {
 	// first unpack the scalar
 	b := api.ToBinary(scalar)
 
@@ -142,6 +138,28 @@ func (p *Point) scalarMul(api frontend.API, p1 *Point, scalar frontend.Variable,
 	return p
 }
 
+// scalarMul computes the scalar multiplication of a point on a twisted Edwards curve
+// p1: base point (as snark point)
+// curve: parameters of the Edwards curve
+// scal: scalar as a SNARK constraint
+// Standard left to right double and add
+func (p *Point) scalarMul(api frontend.API, p1 *Point, scalar frontend.Variable, curve *CurveParams, endo ...*EndoParams) *Point {
+	if ft, ok := api.(frontendtype.FrontendTyper); ok {
+		switch ft.FrontendType() {
+		case frontendtype.R1CS:
+			if len(endo) == 1 && endo[0] != nil {
+				// use glv
+				return p.scalarMulGLV(api, p1, scalar, curve, endo[0])
+			} else {
+				return p.scalarMulGeneric(api, p1, scalar, curve)
+			}
+		case frontendtype.SCS:
+			return p.scalarMulGeneric(api, p1, scalar, curve)
+		}
+	}
+	return p.scalarMulGeneric(api, p1, scalar, curve)
+}
+
 // doubleBaseScalarMul computes s1*P1+s2*P2
 // where P1 and P2 are points on a twisted Edwards curve
 // and s1, s2 scalars.
@@ -172,3 +190,60 @@ func (p *Point) doubleBaseScalarMul(api frontend.API, p1, p2 *Point, s1, s2 fron
 
 	return p
 }
+
+// GLV scalar multiplication
+
+// phi endomorphism √-2 ∈ 𝒪₋₈
+// (x,y) → λ × (x,y) s.t. λ² = -2 mod Order
+func (p *Point) phi(api frontend.API, p1 *Point, curve *CurveParams, endo *EndoParams) *Point {
+
+	xy := api.Mul(p1.X, p1.Y)
+	yy := api.Mul(p1.Y, p1.Y)
+	f := api.Sub(1, yy)
+	f = api.Mul(f, endo.Endo[1])
+	g := api.Add(yy, endo.Endo[0])
+	g = api.Mul(g, endo.Endo[0])
+	h := api.Sub(yy, endo.Endo[0])
+
+	p.X = api.DivUnchecked(f, xy)
+	p.Y = api.DivUnchecked(g, h)
+
+	return p
+}
+
+// scalarMulGLV computes the scalar multiplication of a point on a twisted Edwards curve à la GLV
+// p1: base point (as snark point)
+// curve: parameters of the Edwards curve
+// scal: scalar as a SNARK constraint
+// Standard left to right double and add
+func (p *Point) scalarMulGLV(api frontend.API, p1 *Point, scalar frontend.Variable, curve *CurveParams, endo *EndoParams) *Point {
+	// the hints allow to decompose the scalar s into s1 and s2 such that
+	// s1 + λ * s2 == s mod Order,
+	// with λ s.t. λ² = -2 mod Order.
+	s1, s2, s3 := callDecomposeScalar(api, scalar)
+
+	n := 127
+
+	b1 := api.ToBinary(s1, n)
+	b2 := api.ToBinary(s2, n)
+
+	var res, p2, p3, tmp Point
+	p2.phi(api, p1, curve, endo)
+	p2.X = api.Select(s3, api.Neg(p2.X), p2.X)
+	p3.add(api, p1, &p2, curve)
+
+	res.X = api.Lookup2(b1[n-1], b2[n-1], 0, p1.X, p2.X, p3.X)
+	res.Y = api.Lookup2(b1[n-1], b2[n-1], 1, p1.Y, p2.Y, p3.Y)
+
+	for i := n - 2; i >= 0; i-- {
+		res.double(api, &res, curve)
+		tmp.X = api.Lookup2(b1[i], b2[i], 0, p1.X, p2.X, p3.X)
+		tmp.Y = api.Lookup2(b1[i], b2[i], 1, p1.Y, p2.Y, p3.Y)
+		res.add(api, &res, &tmp, curve)
+	}
+
+	p.X = res.X
+	p.Y = res.Y
+
+	return p
+}