Functions
template<typename C , typename Fq , typename Fr , typename G >
std::ostream &	operator<< (std::ostream &os, element< C, Fq, Fr, G > const &v)

Detailed Description

Special case function for performing secp256k1 ecdsa signature verification group operations

TODO: we should try to genericize this, but this method is super fiddly and we need it to be efficient!

Special-case scalar-multiplication path for the secp256r1 ECDSA verification circuit.

For an ECDSA verification we want to compute R = u₁ · G + u₂ · Q. Each side uses a different in-circuit strategy:

u₁ · G (fixed base): Pedersen-style 8-bit-window plookup tables holding precomputed k · 2^(8w) · G + offset entries. No in-circuit doublings; cost is ~32 plookup reads + 31 chain-adds + a constant offset subtract. See element::secp256r1_fixed_base_mul.
u₂ · Q (variable base): "fake-GLV" (1). The prover supplies a hint T₂ claimed to equal u₂·Q together with integers (α₂, β₂) from a half-GCD of (n, u₂) so that β₂ · u₂ ≡ α₂ (mod n), |α₂|, |β₂| < √n < 2¹²⁸ for secp256r1. The identity α₂ · Q − β₂ · T₂ = O (iff T₂ = (α₂/β₂) · Q = u₂·Q, given β₂ ≠ 0) is verified as a 2-MSM at 128 bits via the generic batch_mul.

Soundness ingredients on the variable-base side:

α₂ and |β₂| are range-constrained to 128 bits and β₂ is asserted ≠ 0 (rules out the trivial (0, 0) decomposition).
The decomposition check β₂_signed · u₂ ≡ α₂ (mod n) pins (α₂, β₂) to u₂.
T₂ is pinned to u₂·Q by the 2-MSM identity.

Function Documentation

template<typename C , typename Fq , typename Fr , typename G >

std::ostream & bb::stdlib::element_default::operator<<	(	std::ostream &	os,
		element< C, Fq, Fr, G > const &	v
	)

inline

Definition at line 1029 of file biggroup.hpp.