20 const FF& scaling_factor)
25 const auto add2_s = ShortView(in.msm_add2);
26 const auto add3_s = ShortView(in.msm_add3);
27 const auto add4_s = ShortView(in.msm_add4);
28 const auto q_add_s = ShortView(in.msm_add);
29 const auto msm_transition_s = ShortView(in.msm_transition);
39 const auto lambda1 =
Accumulator(ShortView(in.msm_lambda1));
40 const auto lambda2 =
Accumulator(ShortView(in.msm_lambda2));
41 const auto lambda3 =
Accumulator(ShortView(in.msm_lambda3));
42 const auto lambda4 =
Accumulator(ShortView(in.msm_lambda4));
43 const auto acc_x =
Accumulator(ShortView(in.msm_accumulator_x));
44 const auto acc_y =
Accumulator(ShortView(in.msm_accumulator_y));
45 const auto acc_x_shift =
Accumulator(ShortView(in.msm_accumulator_x_shift));
46 const auto acc_y_shift =
Accumulator(ShortView(in.msm_accumulator_y_shift));
47 const auto msm_transition_acc =
Accumulator(msm_transition_s);
49 auto add = [&](
auto& xb,
auto& yb,
auto& xa,
auto& ya,
auto& lambda,
auto& selector) {
50 auto slope_relation = selector * (lambda * (xb - xa - 1) - (yb - ya)) + lambda;
51 auto x_out = lambda.sqr() + (-xb - xa - xa) * selector + xa;
52 auto y_out = lambda * (xa - x_out) + (-ya - ya) * selector + ya;
56 auto first_add = [&](
auto& xb,
auto& yb,
auto& xa,
auto& ya,
auto& lambda,
auto& selector) {
58 constexpr uint256_t oxu = offset_generator.x;
59 constexpr uint256_t oyu = offset_generator.y;
62 auto x = xo * selector + xb * (-selector + 1);
63 auto y = yo * selector + yb * (-selector + 1);
64 auto slope_relation = lambda * (x - xa) - (y - ya);
65 auto x_out = lambda * lambda + (-x - xa);
66 auto y_out = lambda * (xa - x_out) - ya;
73 auto [x_t1, y_t1, add_slope_relation1] = first_add(acc_x, acc_y, x1, y1, lambda1, msm_transition_acc);
74 auto [x_t2, y_t2, add_slope_relation2] = add(x2, y2, x_t1, y_t1, lambda2, add2_acc);
75 auto [x_t3, y_t3, add_slope_relation3] = add(x3, y3, x_t2, y_t2, lambda3, add3_acc);
76 auto [x_t4, y_t4, add_slope_relation4] = add(x4, y4, x_t3, y_t3, lambda4, add4_acc);
78 const auto q_add_scaled =
Accumulator(q_add_s * scaling_factor);
134 const FF& scaling_factor)
139 const auto q_skew_s = ShortView(in.msm_skew);
140 const auto slice1_s = ShortView(in.msm_slice1);
141 const auto slice2_s = ShortView(in.msm_slice2);
142 const auto slice3_s = ShortView(in.msm_slice3);
143 const auto slice4_s = ShortView(in.msm_slice4);
153 const auto lambda1 =
Accumulator(ShortView(in.msm_lambda1));
154 const auto lambda2 =
Accumulator(ShortView(in.msm_lambda2));
155 const auto lambda3 =
Accumulator(ShortView(in.msm_lambda3));
156 const auto lambda4 =
Accumulator(ShortView(in.msm_lambda4));
157 const auto acc_x =
Accumulator(ShortView(in.msm_accumulator_x));
158 const auto acc_y =
Accumulator(ShortView(in.msm_accumulator_y));
159 const auto acc_x_shift =
Accumulator(ShortView(in.msm_accumulator_x_shift));
160 const auto acc_y_shift =
Accumulator(ShortView(in.msm_accumulator_y_shift));
162 auto add = [&](
auto& xb,
auto& yb,
auto& xa,
auto& ya,
auto& lambda,
auto& selector) {
163 auto slope_relation = selector * (lambda * (xb - xa - 1) - (yb - ya)) + lambda;
164 auto x_out = lambda.sqr() + (-xb - xa - xa) * selector + xa;
165 auto y_out = lambda * (xa - x_out) + (-ya - ya) * selector + ya;
169 static const FF inverse_seven_static =
FF(7).
invert();
170 const auto skew1_select =
Accumulator(slice1_s * inverse_seven_static);
171 const auto skew2_select =
Accumulator(slice2_s * inverse_seven_static);
172 const auto skew3_select =
Accumulator(slice3_s * inverse_seven_static);
173 const auto skew4_select =
Accumulator(slice4_s * inverse_seven_static);
174 auto [x_s1, y_s1, skew_slope_relation1] = add(x1, y1, acc_x, acc_y, lambda1, skew1_select);
175 auto [x_s2, y_s2, skew_slope_relation2] = add(x2, y2, x_s1, y_s1, lambda2, skew2_select);
176 auto [x_s3, y_s3, skew_slope_relation3] = add(x3, y3, x_s2, y_s2, lambda3, skew3_select);
177 auto [x_s4, y_s4, skew_slope_relation4] = add(x4, y4, x_s3, y_s3, lambda4, skew4_select);
179 const auto q_skew_scaled =
Accumulator(q_skew_s * scaling_factor);
193 const FF& scaling_factor)
203 const auto add1_s = ShortView(in.msm_add1);
204 const auto add1_shift_s = ShortView(in.msm_add1_shift);
205 const auto add2_s = ShortView(in.msm_add2);
206 const auto add3_s = ShortView(in.msm_add3);
207 const auto add4_s = ShortView(in.msm_add4);
208 const auto q_add_s = ShortView(in.msm_add);
209 const auto q_add_shift_s = ShortView(in.msm_add_shift);
210 const auto q_skew_s = ShortView(in.msm_skew);
211 const auto q_skew_shift_s = ShortView(in.msm_skew_shift);
212 const auto q_double_s = ShortView(in.msm_double);
213 const auto q_double_shift_s = ShortView(in.msm_double_shift);
214 const auto msm_transition_s = ShortView(in.msm_transition);
215 const auto msm_transition_shift_s = ShortView(in.msm_transition_shift);
217 const auto round_s = ShortView(in.msm_round);
218 const auto round_shift_s = ShortView(in.msm_round_shift);
219 const auto round_minus_31_inv_s = ShortView(in.msm_round_minus_31_inv);
220 const auto count_s = ShortView(in.msm_count);
221 const auto count_shift_s = ShortView(in.msm_count_shift);
222 const auto pc_s = ShortView(in.msm_pc);
223 const auto pc_shift_s = ShortView(in.msm_pc_shift);
224 const auto msm_size_s = ShortView(in.msm_size_of_msm);
225 const auto slice1_s = ShortView(in.msm_slice1);
226 const auto slice2_s = ShortView(in.msm_slice2);
227 const auto slice3_s = ShortView(in.msm_slice3);
228 const auto slice4_s = ShortView(in.msm_slice4);
234 const auto collision_inverse1 = ShortView(in.msm_collision_x1);
235 const auto collision_inverse2 = ShortView(in.msm_collision_x2);
236 const auto collision_inverse3 = ShortView(in.msm_collision_x3);
237 const auto collision_inverse4 = ShortView(in.msm_collision_x4);
238 const auto lambda1 =
Accumulator(ShortView(in.msm_lambda1));
239 const auto lambda2 =
Accumulator(ShortView(in.msm_lambda2));
240 const auto lambda3 =
Accumulator(ShortView(in.msm_lambda3));
241 const auto lambda4 =
Accumulator(ShortView(in.msm_lambda4));
242 const auto acc_x =
Accumulator(ShortView(in.msm_accumulator_x));
243 const auto acc_y =
Accumulator(ShortView(in.msm_accumulator_y));
244 const auto acc_x_shift =
Accumulator(ShortView(in.msm_accumulator_x_shift));
245 const auto acc_y_shift =
Accumulator(ShortView(in.msm_accumulator_y_shift));
246 const auto msm_transition_acc =
Accumulator(msm_transition_s);
248 auto add_x = [&](
auto& xb,
auto& xa,
auto& lambda,
auto& selector,
auto& collision_relation) {
249 collision_relation += selector * (xb - xa);
250 return lambda.sqr() + (-xb - xa - xa) * selector + xa;
253 auto first_add_x = [&](
auto& xb,
auto& xa,
auto& lambda,
auto& selector,
auto& collision_relation) {
255 constexpr uint256_t oxu = offset_generator.x;
257 auto x = xo * selector + xb * (-selector + 1);
258 collision_relation += (xa - x);
259 return lambda * lambda + (-x - xa);
269 auto x_t1 = first_add_x(acc_x, x1, lambda1, msm_transition_acc, x1_collision_relation);
270 auto x_t2 = add_x(x2, x_t1, lambda2, add2_acc, x2_collision_relation);
271 auto x_t3 = add_x(x3, x_t2, lambda3, add3_acc, x3_collision_relation);
272 add_x(x4, x_t3, lambda4, add4_acc, x4_collision_relation);
274 static const FF inverse_seven_static =
FF(7).
invert();
275 const auto skew1_select =
Accumulator(slice1_s * inverse_seven_static);
276 const auto skew2_select =
Accumulator(slice2_s * inverse_seven_static);
277 const auto skew3_select =
Accumulator(slice3_s * inverse_seven_static);
278 const auto skew4_select =
Accumulator(slice4_s * inverse_seven_static);
283 auto x_s1 = add_x(x1, acc_x, lambda1, skew1_select, x1_skew_collision_relation);
284 auto x_s2 = add_x(x2, x_s1, lambda2, skew2_select, x2_skew_collision_relation);
285 auto x_s3 = add_x(x3, x_s2, lambda3, skew3_select, x3_skew_collision_relation);
286 add_x(x4, x_s3, lambda4, skew4_select, x4_skew_collision_relation);
288 const auto add_first_point_short = add1_s * q_add_s + q_skew_s * (slice1_s * inverse_seven_static);
289 const auto add_second_point_short = add2_s * q_add_s + q_skew_s * (slice2_s * inverse_seven_static);
290 const auto add_third_point_short = add3_s * q_add_s + q_skew_s * (slice3_s * inverse_seven_static);
291 const auto add_fourth_point_short = add4_s * q_add_s + q_skew_s * (slice4_s * inverse_seven_static);
294 const auto x1_delta = x1_skew_collision_relation * q_skew_acc + x1_collision_relation * q_add_acc;
295 const auto x2_delta = x2_skew_collision_relation * q_skew_acc + x2_collision_relation * q_add_acc;
296 const auto x3_delta = x3_skew_collision_relation * q_skew_acc + x3_collision_relation * q_add_acc;
297 const auto x4_delta = x4_skew_collision_relation * q_skew_acc + x4_collision_relation * q_add_acc;
299 Accumulator(add_first_point_short * scaling_factor);
301 Accumulator(add_second_point_short * scaling_factor);
303 Accumulator(add_third_point_short * scaling_factor);
305 Accumulator(add_fourth_point_short * scaling_factor);
313 const auto sum = q_add_s * q_double_s + q_add_s * q_skew_s + q_double_s * q_skew_s;
317 const auto no_op_selector_short_a = (-q_add_s +
FF(1)) * (-q_double_s +
FF(1));
318 const auto no_op_selector_short_b = (-q_skew_s +
FF(1)) * (-msm_transition_s +
FF(1));
319 const auto no_op_selector_short_c = -lagrange_first_s +
FF(1);
320 const auto no_op_selector_scaled_acc =
Accumulator(no_op_selector_short_a * scaling_factor) *
327 const auto round_delta_short = round_shift_s - round_s;
328 const auto neg_msm_transition_shift_plus_one_short = -msm_transition_shift_s +
FF(1);
329 const auto round_transition_short = round_delta_short * neg_msm_transition_shift_plus_one_short;
331 const auto round_delta_minus_one_short = round_delta_short -
FF(1);
333 Acc4(round_transition_short * scaling_factor) * Acc4(round_delta_minus_one_short);
336 const auto round_minus_31_short = round_s -
FF(31);
338 Acc5(round_transition_short * scaling_factor) * Acc5(q_skew_shift_s * round_minus_31_short);
341 const auto q_skew_plus_q_double_minus_one_short = (q_skew_shift_s + q_double_shift_s) -
FF(1);
343 Acc4(round_transition_short * scaling_factor) * Acc4(q_skew_plus_q_double_minus_one_short);
346 const auto neg_double_short = -q_double_shift_s +
FF(1);
347 const auto neg_skew_short = -q_skew_shift_s +
FF(1);
348 const auto not_double_not_skew_short = neg_double_short * neg_skew_short;
350 Acc5(round_transition_short * scaling_factor) * Acc5(not_double_not_skew_short);
355 Acc3((round_delta_short * count_shift_s) * scaling_factor);
357 const auto neg_round_delta_plus_one_short = -round_delta_short +
FF(1);
358 const auto outer_short = neg_msm_transition_shift_plus_one_short * neg_round_delta_plus_one_short;
359 const auto inner_short = ((count_shift_s - count_s) - add1_s - add2_s - add3_s) - add4_s;
363 const auto is_not_first_row_short = -lagrange_first_s +
FF(1);
364 const auto outer_a_short = is_not_first_row_short * neg_msm_transition_shift_plus_one_short;
365 const auto outer_b_short = round_delta_short * count_shift_s;
367 Acc5(outer_a_short * scaling_factor) * Acc5(outer_b_short);
372 const auto is_not_first_row_short = -lagrange_first_s +
FF(1);
373 const auto outer_short = is_not_first_row_short * msm_transition_shift_s;
374 const auto inner_short = (msm_size_s + pc_shift_s) - pc_s;
379 const auto inverse_check_short = -(round_minus_31_short * round_minus_31_inv_s) +
FF(1);
381 Acc4(q_double_shift_s * scaling_factor) * Acc4(inverse_check_short);
384 const auto not_add_short = -q_add_s +
FF(1);
385 const auto not_double_short = -q_double_s +
FF(1);
386 const auto not_skew_short = -q_skew_s +
FF(1);
387 const auto next_phase_short = q_add_shift_s + q_double_shift_s + q_skew_shift_s;
388 const auto transition_shift_minus_one_short = msm_transition_shift_s -
FF(1);
390 Acc6(not_add_short * scaling_factor) * Acc6(not_double_short) * Acc6(not_skew_short) *
391 Acc6(next_phase_short) * Acc6(transition_shift_minus_one_short);
394 const auto is_not_first_row_short = -lagrange_first_s +
FF(1);
395 const auto active_phase_short = q_add_s + q_double_s;
397 Acc5(is_not_first_row_short * scaling_factor) * Acc5(active_phase_short) *
398 Acc5(neg_msm_transition_shift_plus_one_short) * Acc5(pc_shift_s - pc_s);
401 Acc4((q_skew_s * q_skew_shift_s) * scaling_factor) * Acc4(pc_shift_s - pc_s);
408 const auto outer_short = q_add_s * q_add_shift_s + q_skew_s * q_skew_shift_s;
409 const auto inner_short = (-add4_s +
FF(1)) * add1_shift_s;
414 const auto neg_skew_shift_short = -q_skew_shift_s +
FF(1);
415 const auto outer_short = neg_msm_transition_shift_plus_one_short * q_skew_s;
417 Acc4(outer_short * scaling_factor) * Acc4(neg_skew_shift_short);
421 Acc3(((-round_delta_short +
FF(1)) * q_double_shift_s) * scaling_factor);