feat: add native rust implementations of pedersen functions (#4871)

# Description

## Problem\*

Resolves #4863 

## Summary\*

This PR pulls in the relevant code from
[Barustenberg](https://github.com/laudiacay/barustenberg) for performing
pedersen commitments + hashes. Tests are currently failing (seems like
Barustenberg is failing its own CI) however it's a good starting point
for a working implementation.

In order for this PR to be merged we should have tests in barretenberg
which shows expected outputs for all of these added functions and this
code should replicate those.

Benchmarks relative to #5056 
```
pedersen_commitment     time:   [3.5018 µs 3.5059 µs 3.5102 µs]
                        change: [-99.357% -99.356% -99.354%] (p = 0.00 < 0.05)
                        Performance has improved.
Found 1 outliers among 40 measurements (2.50%)
  1 (2.50%) low mild

pedersen_hash           time:   [6.9828 µs 6.9920 µs 7.0021 µs]
                        change: [-99.181% -99.180% -99.178%] (p = 0.00 < 0.05)
                        Performance has improved.
Found 2 outliers among 40 measurements (5.00%)
  2 (5.00%) high mild
```

## Additional Context



## Documentation\*

Check one:
- [x] No documentation needed.
- [ ] Documentation included in this PR.
- [ ] **[For Experimental Features]** Documentation to be submitted in a
separate PR.

# PR Checklist\*

- [x] I have tested the changes locally.
- [x] I have formatted the changes with [Prettier](https://prettier.io/)
and/or `cargo fmt` on default settings.

acvm-repo/bn254_blackbox_solver/Cargo.toml

@@ -40,6 +40,7 @@ getrandom.workspace = true
 wasmer = "4.2.6"
 
 [dev-dependencies]
+ark-std = { version = "^0.4.0", default-features = false }
 criterion = "0.5.0"
 pprof = { version = "0.12", features = [
     "flamegraph",

acvm-repo/bn254_blackbox_solver/src/generator/generators.rs

@@ -0,0 +1,184 @@
+// Adapted from https://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/barustenberg/src/ecc/groups/affine_element.rshttps://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/barustenberg/src/ecc/groups/group.rs
+//!
+//! Code is used under the MIT license
+
+use std::sync::OnceLock;
+
+use ark_ec::short_weierstrass::Affine;
+
+use acvm_blackbox_solver::blake3;
+use grumpkin::GrumpkinParameters;
+
+use super::hash_to_curve::hash_to_curve;
+
+pub(crate) const DEFAULT_DOMAIN_SEPARATOR: &[u8] = "DEFAULT_DOMAIN_SEPARATOR".as_bytes();
+const NUM_DEFAULT_GENERATORS: usize = 8;
+
+fn default_generators() -> &'static [Affine<GrumpkinParameters>; NUM_DEFAULT_GENERATORS] {
+    static INSTANCE: OnceLock<[Affine<GrumpkinParameters>; NUM_DEFAULT_GENERATORS]> =
+        OnceLock::new();
+    INSTANCE.get_or_init(|| {
+        _derive_generators(DEFAULT_DOMAIN_SEPARATOR, NUM_DEFAULT_GENERATORS as u32, 0)
+            .try_into()
+            .expect("Should generate `NUM_DEFAULT_GENERATORS`")
+    })
+}
+
+/// Derives generator points via [hash-to-curve][hash_to_curve].
+///
+/// # ALGORITHM DESCRIPTION
+///
+/// 1. Each generator has an associated "generator index" described by its location in the vector
+/// 2. a 64-byte preimage buffer is generated with the following structure:
+///     - bytes 0-31: BLAKE3 hash of domain_separator
+///     - bytes 32-63: generator index in big-endian form
+/// 3. The [hash-to-curve algorithm][hash_to_curve] is used to hash the above into a curve point.
+///
+/// NOTE: The domain separator is included to ensure that it is possible to derive independent sets of
+/// index-addressable generators.
+///
+/// [hash_to_curve]: super::hash_to_curve::hash_to_curve
+pub(crate) fn derive_generators(
+    domain_separator_bytes: &[u8],
+    num_generators: u32,
+    starting_index: u32,
+) -> Vec<Affine<GrumpkinParameters>> {
+    // We cache a small number of the default generators so we can reuse them without needing to repeatedly recalculate them.
+    if domain_separator_bytes == DEFAULT_DOMAIN_SEPARATOR
+        && starting_index + num_generators <= NUM_DEFAULT_GENERATORS as u32
+    {
+        let start_index = starting_index as usize;
+        let end_index = (starting_index + num_generators) as usize;
+        default_generators()[start_index..end_index].to_vec()
+    } else {
+        _derive_generators(domain_separator_bytes, num_generators, starting_index)
+    }
+}
+
+fn _derive_generators(
+    domain_separator_bytes: &[u8],
+    num_generators: u32,
+    starting_index: u32,
+) -> Vec<Affine<GrumpkinParameters>> {
+    let mut generator_preimage = [0u8; 64];
+    let domain_hash = blake3(domain_separator_bytes).expect("hash should succeed");
+    //1st 32 bytes are blake3 domain_hash
+    generator_preimage[..32].copy_from_slice(&domain_hash);
+
+    // Convert generator index in big-endian form
+    let mut res = Vec::with_capacity(num_generators as usize);
+    for i in starting_index..(starting_index + num_generators) {
+        let generator_be_bytes: [u8; 4] = i.to_be_bytes();
+        generator_preimage[32] = generator_be_bytes[0];
+        generator_preimage[33] = generator_be_bytes[1];
+        generator_preimage[34] = generator_be_bytes[2];
+        generator_preimage[35] = generator_be_bytes[3];
+        let generator = hash_to_curve(&generator_preimage, 0);
+        res.push(generator);
+    }
+    res
+}
+
+#[cfg(test)]
+mod test {
+
+    use ark_ec::AffineRepr;
+    use ark_ff::{BigInteger, PrimeField};
+
+    use super::*;
+
+    #[test]
+    fn test_derive_generators() {
+        let res = derive_generators("test domain".as_bytes(), 128, 0);
+
+        let is_unique = |y: Affine<grumpkin::GrumpkinParameters>, j: usize| -> bool {
+            for (i, res) in res.iter().enumerate() {
+                if i != j && *res == y {
+                    return false;
+                }
+            }
+            true
+        };
+
+        for (i, res) in res.iter().enumerate() {
+            assert!(is_unique(*res, i));
+            assert!(res.is_on_curve());
+        }
+    }
+
+    #[test]
+    fn derive_length_generator() {
+        let domain_separator = "pedersen_hash_length";
+        let length_generator = derive_generators(domain_separator.as_bytes(), 1, 0)[0];
+
+        let expected_generator = (
+            "2df8b940e5890e4e1377e05373fae69a1d754f6935e6a780b666947431f2cdcd",
+            "2ecd88d15967bc53b885912e0d16866154acb6aac2d3f85e27ca7eefb2c19083",
+        );
+        assert_eq!(
+            hex::encode(length_generator.x().unwrap().into_bigint().to_bytes_be()),
+            expected_generator.0,
+            "Failed on x component"
+        );
+        assert_eq!(
+            hex::encode(length_generator.y().unwrap().into_bigint().to_bytes_be()),
+            expected_generator.1,
+            "Failed on y component"
+        );
+    }
+
+    #[test]
+    fn derives_default_generators() {
+        const DEFAULT_GENERATORS: &[[&str; 2]] = &[
+            [
+                "083e7911d835097629f0067531fc15cafd79a89beecb39903f69572c636f4a5a",
+                "1a7f5efaad7f315c25a918f30cc8d7333fccab7ad7c90f14de81bcc528f9935d",
+            ],
+            [
+                "054aa86a73cb8a34525e5bbed6e43ba1198e860f5f3950268f71df4591bde402",
+                "209dcfbf2cfb57f9f6046f44d71ac6faf87254afc7407c04eb621a6287cac126",
+            ],
+            [
+                "1c44f2a5207c81c28a8321a5815ce8b1311024bbed131819bbdaf5a2ada84748",
+                "03aaee36e6422a1d0191632ac6599ae9eba5ac2c17a8c920aa3caf8b89c5f8a8",
+            ],
+            [
+                "26d8b1160c6821a30c65f6cb47124afe01c29f4338f44d4a12c9fccf22fb6fb2",
+                "05c70c3b9c0d25a4c100e3a27bf3cc375f8af8cdd9498ec4089a823d7464caff",
+            ],
+            [
+                "20ed9c6a1d27271c4498bfce0578d59db1adbeaa8734f7facc097b9b994fcf6e",
+                "29cd7d370938b358c62c4a00f73a0d10aba7e5aaa04704a0713f891ebeb92371",
+            ],
+            [
+                "0224a8abc6c8b8d50373d64cd2a1ab1567bf372b3b1f7b861d7f01257052d383",
+                "2358629b90eafb299d6650a311e79914b0215eb0a790810b26da5a826726d711",
+            ],
+            [
+                "0f106f6d46bc904a5290542490b2f238775ff3c445b2f8f704c466655f460a2a",
+                "29ab84d472f1d33f42fe09c47b8f7710f01920d6155250126731e486877bcf27",
+            ],
+            [
+                "0298f2e42249f0519c8a8abd91567ebe016e480f219b8c19461d6a595cc33696",
+                "035bec4b8520a4ece27bd5aafabee3dfe1390d7439c419a8c55aceb207aac83b",
+            ],
+        ];
+
+        let generated_generators =
+            derive_generators(DEFAULT_DOMAIN_SEPARATOR, DEFAULT_GENERATORS.len() as u32, 0);
+        for (i, (generator, expected_generator)) in
+            generated_generators.iter().zip(DEFAULT_GENERATORS).enumerate()
+        {
+            assert_eq!(
+                hex::encode(generator.x().unwrap().into_bigint().to_bytes_be()),
+                expected_generator[0],
+                "Failed on x component of generator {i}"
+            );
+            assert_eq!(
+                hex::encode(generator.y().unwrap().into_bigint().to_bytes_be()),
+                expected_generator[1],
+                "Failed on y component of generator {i}"
+            );
+        }
+    }
+}

acvm-repo/bn254_blackbox_solver/src/generator/hash_to_curve.rs

@@ -0,0 +1,135 @@
+// Adapted from https://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/barustenberg/src/ecc/groups/affine_element.rs
+//!
+//! Code is used under the MIT license
+
+use acvm_blackbox_solver::blake3;
+
+use ark_ec::{short_weierstrass::Affine, AffineRepr, CurveConfig};
+use ark_ff::Field;
+use ark_ff::{BigInteger, PrimeField};
+use grumpkin::GrumpkinParameters;
+
+/// Hash a seed buffer into a point
+///
+/// # ALGORITHM DESCRIPTION
+///
+///  1. Initialize unsigned integer `attempt_count = 0`
+///  2. Copy seed into a buffer whose size is 2 bytes greater than `seed` (initialized to `0`)
+///  3. Interpret `attempt_count` as a byte and write into buffer at `[buffer.size() - 2]`
+///  4. Compute Blake3 hash of buffer
+///  5. Set the end byte of the buffer to `1`
+///  6. Compute Blake3 hash of buffer
+///  7. Interpret the two hash outputs as the high / low 256 bits of a 512-bit integer (big-endian)
+///  8. Derive x-coordinate of point by reducing the 512-bit integer modulo the curve's field modulus (Fq)
+///  9. Compute `y^2` from the curve formula `y^2 = x^3 + ax + b` (`a`, `b` are curve params. for BN254, `a = 0`, `b = 3`)
+///  10. IF `y^2` IS NOT A QUADRATIC RESIDUE:
+///
+///  a. increment `attempt_count` by 1 and go to step 2
+///  
+///  11. IF `y^2` IS A QUADRATIC RESIDUE:
+///
+///  a. derive y coordinate via `y = sqrt(y)`
+///
+///  b. Interpret most significant bit of 512-bit integer as a 'parity' bit
+///
+///  c. If parity bit is set AND `y`'s most significant bit is not set, invert `y`
+///
+///  d. If parity bit is not set AND `y`'s most significant bit is set, invert `y`
+///
+///  e. return (x, y)
+///
+///  N.B. steps c. and e. are because the `sqrt()` algorithm can return 2 values,
+///  we need to a way to canonically distinguish between these 2 values and select a "preferred" one
+pub(crate) fn hash_to_curve(seed: &[u8], attempt_count: u8) -> Affine<GrumpkinParameters> {
+    let seed_size = seed.len();
+    // expand by 2 bytes to cover incremental hash attempts
+    let mut target_seed = seed.to_vec();
+    target_seed.extend_from_slice(&[0u8; 2]);
+
+    target_seed[seed_size] = attempt_count;
+    target_seed[seed_size + 1] = 0;
+    let hash_hi = blake3(&target_seed).expect("hash should succeed");
+    target_seed[seed_size + 1] = 1;
+    let hash_lo = blake3(&target_seed).expect("hash should succeed");
+
+    let mut hash = hash_hi.to_vec();
+    hash.extend_from_slice(&hash_lo);
+
+    // Here we reduce the 512 bit number modulo the base field modulus to calculate `x`
+    let x = <<GrumpkinParameters as CurveConfig>::BaseField as Field>::BasePrimeField::from_be_bytes_mod_order(&hash);
+    let x = <GrumpkinParameters as CurveConfig>::BaseField::from_base_prime_field(x);
+
+    if let Some(point) = Affine::<GrumpkinParameters>::get_point_from_x_unchecked(x, false) {
+        let parity_bit = hash_hi[0] > 127;
+        let y_bit_set = point.y().unwrap().into_bigint().get_bit(0);
+        if (parity_bit && !y_bit_set) || (!parity_bit && y_bit_set) {
+            -point
+        } else {
+            point
+        }
+    } else {
+        hash_to_curve(seed, attempt_count + 1)
+    }
+}
+
+#[cfg(test)]
+mod test {
+
+    use ark_ec::AffineRepr;
+    use ark_ff::{BigInteger, PrimeField};
+
+    use super::hash_to_curve;
+
+    #[test]
+    fn smoke_test() {
+        let test_cases: [(&[u8], u8, (&str, &str)); 4] = [
+            (
+                &[],
+                0,
+                (
+                    "24c4cb9c1206ab5470592f237f1698abe684dadf0ab4d7a132c32b2134e2c12e",
+                    "0668b8d61a317fb34ccad55c930b3554f1828a0e5530479ecab4defe6bbc0b2e",
+                ),
+            ),
+            (
+                &[],
+                1,
+                (
+                    "24c4cb9c1206ab5470592f237f1698abe684dadf0ab4d7a132c32b2134e2c12e",
+                    "0668b8d61a317fb34ccad55c930b3554f1828a0e5530479ecab4defe6bbc0b2e",
+                ),
+            ),
+            (
+                &[1],
+                0,
+                (
+                    "107f1b633c6113f3222f39f6256f0546b41a4880918c86864b06471afb410454",
+                    "050cd3823d0c01590b6a50adcc85d2ee4098668fd28805578aa05a423ea938c6",
+                ),
+            ),
+            (
+                &[0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64],
+                0,
+                (
+                    "037c5c229ae495f6e8d1b4bf7723fafb2b198b51e27602feb8a4d1053d685093",
+                    "10cf9596c5b2515692d930efa2cf3817607e4796856a79f6af40c949b066969f",
+                ),
+            ),
+        ];
+
+        for (seed, attempt_count, expected_point) in test_cases {
+            let point = hash_to_curve(seed, attempt_count);
+            assert!(point.is_on_curve());
+            assert_eq!(
+                hex::encode(point.x().unwrap().into_bigint().to_bytes_be()),
+                expected_point.0,
+                "Failed on x component with seed {seed:?}, attempt_count {attempt_count}"
+            );
+            assert_eq!(
+                hex::encode(point.y().unwrap().into_bigint().to_bytes_be()),
+                expected_point.1,
+                "Failed on y component with seed {seed:?}, attempt_count {attempt_count}"
+            );
+        }
+    }
+}

acvm-repo/bn254_blackbox_solver/src/generator/mod.rs

@@ -0,0 +1,8 @@
+//! This module is adapted from the [Barustenberg][barustenberg] Rust implementation of the Barretenberg library.
+//!
+//! Code is used under the MIT license
+//!
+//! [barustenberg]: https://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/
+
+pub(crate) mod generators;
+mod hash_to_curve;

acvm-repo/bn254_blackbox_solver/src/lib.rs

@@ -6,14 +6,17 @@ use acir::{BlackBoxFunc, FieldElement};
 use acvm_blackbox_solver::{BlackBoxFunctionSolver, BlackBoxResolutionError};
 
 mod embedded_curve_ops;
+mod generator;
+mod pedersen;
 mod poseidon2;
 mod wasm;
 
+use ark_ec::AffineRepr;
 pub use embedded_curve_ops::{embedded_curve_add, multi_scalar_mul};
 pub use poseidon2::poseidon2_permutation;
 use wasm::Barretenberg;
 
-use self::wasm::{Pedersen, SchnorrSig};
+use self::wasm::SchnorrSig;
 
 pub struct Bn254BlackBoxSolver {
     blackbox_vendor: Barretenberg,
@@ -72,21 +75,24 @@ impl BlackBoxFunctionSolver for Bn254BlackBoxSolver {
         inputs: &[FieldElement],
         domain_separator: u32,
     ) -> Result<(FieldElement, FieldElement), BlackBoxResolutionError> {
-        #[allow(deprecated)]
-        self.blackbox_vendor.encrypt(inputs.to_vec(), domain_separator).map_err(|err| {
-            BlackBoxResolutionError::Failed(BlackBoxFunc::PedersenCommitment, err.to_string())
-        })
+        let inputs: Vec<grumpkin::Fq> = inputs.iter().map(|input| input.into_repr()).collect();
+        let result = pedersen::commitment::commit_native_with_index(&inputs, domain_separator);
+        let res_x =
+            FieldElement::from_repr(*result.x().expect("should not commit to point at infinity"));
+        let res_y =
+            FieldElement::from_repr(*result.y().expect("should not commit to point at infinity"));
+        Ok((res_x, res_y))
     }
 
     fn pedersen_hash(
         &self,
         inputs: &[FieldElement],
         domain_separator: u32,
     ) -> Result<FieldElement, BlackBoxResolutionError> {
-        #[allow(deprecated)]
-        self.blackbox_vendor.hash(inputs.to_vec(), domain_separator).map_err(|err| {
-            BlackBoxResolutionError::Failed(BlackBoxFunc::PedersenCommitment, err.to_string())
-        })
+        let inputs: Vec<grumpkin::Fq> = inputs.iter().map(|input| input.into_repr()).collect();
+        let result = pedersen::hash::hash_with_index(&inputs, domain_separator);
+        let result = FieldElement::from_repr(result);
+        Ok(result)
     }
 
     fn multi_scalar_mul(