Differential fuzzer for the hybrid ECDSA mul R = u₁·G + u₂·Q on secp256r1. More...

#include "barretenberg/circuit_checker/circuit_checker.hpp"
#include "barretenberg/ecc/curves/secp256r1/secp256r1.hpp"
#include "barretenberg/numeric/uint256/uint256.hpp"
#include "barretenberg/stdlib/primitives/biggroup/biggroup.hpp"
#include "barretenberg/stdlib/primitives/curves/secp256r1.hpp"
#include "barretenberg/stdlib_circuit_builders/ultra_circuit_builder.hpp"
#include <cassert>
#include <cstdint>
#include <cstring>

Typedefs
using	Builder = bb::UltraCircuitBuilder

using	Curve = bb::stdlib::secp256r1< Builder >

using	element_ct = typename Curve::Group

using	scalar_ct = typename Curve::ScalarField

using	fr_native = typename Curve::ScalarFieldNative

using	g1_native = typename Curve::GroupNative

using	affine_native = typename g1_native::affine_element

using	element_native = typename g1_native::element

Functions
int	LLVMFuzzerTestOneInput (const uint8_t *Data, size_t Size)

Detailed Description

Differential fuzzer for the hybrid ECDSA mul R = u₁·G + u₂·Q on secp256r1.

Each iteration consumes 96 bytes:

bytes 0..31 → u₁
bytes 32..63 → u₂
bytes 64..95 → scalar q used to derive an on-curve pubkey Q = q·G

The fuzzer compares the in-circuit hybrid path (fixed-base u₁·G + fake-GLV u₂·Q) against the native sum. Special-cases u₂ ∈ {0, ±1}: the fake-GLV path substitutes u₂ → 2 internally, so the returned point is deliberately wrong but the u2_is_acceptable soundness flag MUST be false. The fuzzer asserts that relationship in both directions (acceptable ⇔ u₂ ∉ {0, ±1}).

Definition in file secp256r1_ecdsa_mul_ultra.fuzzer.cpp.