implement schnorr siganture

halo2-ecc/src/bigint/big_is_even.rs

@@ -1,12 +1,11 @@
 use super::OverflowInteger;
 use halo2_base::gates::GateInstructions;
 use halo2_base::gates::RangeChip;
-use halo2_base::QuantumCell::Constant;
 use halo2_base::{safe_types::RangeInstructions, utils::ScalarField, AssignedValue, Context};
 
 /// # Assumptions
 /// * `a` has nonzero number of limbs
-pub fn positive<F: ScalarField>(
+pub fn range<F: ScalarField>(
     gate: &RangeChip<F>,
     ctx: &mut Context<F>,
     a: OverflowInteger<F>,
@@ -17,5 +16,5 @@ pub fn positive<F: ScalarField>(
     let first_cell: AssignedValue<F> = a.limbs[0];
 
     let last_bit = gate.get_last_bit(ctx, first_cell, limb_bits);
-    gate.gate.sub(ctx, Constant(F::one()), last_bit)
+    gate.gate.not(ctx, last_bit)
 }

halo2-ecc/src/ecc/schnorr_signature.rs

@@ -8,6 +8,8 @@ use super::{fixed_base, scalar_multiply, EcPoint, EccChip};
 // SF is the scalar field of GA
 // p = base field modulus
 // n = scalar field modulus
+// assume r < p, 0 < s < n, 0 < msgHash < n
+// this circuit applies over constraints that s > 0, msgHash > 0 cause scalar_multiply can't handle zero scalar
 /// `pubkey` should not be the identity point
 /// follow spec in https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
 pub fn schnorr_verify_no_pubkey_check<F: PrimeField, CF: PrimeField, SF: PrimeField, GA>(
@@ -29,9 +31,9 @@ where
 
     // check r < p
     let r_valid = base_chip.is_less_than_p(ctx, &r);
-    // check s < n
+    // check 0 < s < n
     let s_valid = scalar_chip.is_soft_nonzero(ctx, &s);
-    // check e < n
+    // check 0 < e < n
     let e_valid = scalar_chip.is_soft_nonzero(ctx, &msgHash);
 
     // compute s * G and msgHash * pubkey

halo2-ecc/src/fields/fp.rs

@@ -162,7 +162,7 @@ impl<'range, F: PrimeField, Fp: PrimeField> FpChip<'range, F, Fp> {
     ) -> AssignedValue<F> {
         let a = a.into();
         self.enforce_less_than_p(ctx, a.clone());
-        big_is_even::positive(self.range(), ctx, a.0.truncation, self.limb_bits)
+        big_is_even::range(self.range(), ctx, a.0.truncation, self.limb_bits)
     }
 }