feat: add native rust implementations of pedersen functions

acvm-repo/bn254_blackbox_solver/Cargo.toml

@@ -40,6 +40,7 @@ getrandom.workspace = true
 wasmer = "4.2.6"
 
 [dev-dependencies]
+ark-std = { version = "^0.4.0", default-features = false }
 criterion = "0.5.0"
 pprof = { version = "0.12", features = [
     "flamegraph",

acvm-repo/bn254_blackbox_solver/src/generator/generators.rs

@@ -0,0 +1,184 @@
+// Adapted from https://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/barustenberg/src/ecc/groups/affine_element.rshttps://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/barustenberg/src/ecc/groups/group.rs
+//!
+//! Code is used under the MIT license
+
+use std::sync::OnceLock;
+
+use ark_ec::short_weierstrass::Affine;
+
+use acvm_blackbox_solver::blake3;
+use grumpkin::GrumpkinParameters;
+
+use super::hash_to_curve::hash_to_curve;
+
+pub(crate) const DEFAULT_DOMAIN_SEPARATOR: &[u8] = "DEFAULT_DOMAIN_SEPARATOR".as_bytes();
+const NUM_DEFAULT_GENERATORS: usize = 8;
+
+fn default_generators() -> &'static [Affine<GrumpkinParameters>; NUM_DEFAULT_GENERATORS] {
+    static INSTANCE: OnceLock<[Affine<GrumpkinParameters>; NUM_DEFAULT_GENERATORS]> =
+        OnceLock::new();
+    INSTANCE.get_or_init(|| {
+        _derive_generators(DEFAULT_DOMAIN_SEPARATOR, NUM_DEFAULT_GENERATORS as u32, 0)
+            .try_into()
+            .expect("Should generate `NUM_DEFAULT_GENERATORS`")
+    })
+}
+
+/// Derives generator points via [hash-to-curve][hash_to_curve].
+///
+/// # ALGORITHM DESCRIPTION
+///
+/// 1. Each generator has an associated "generator index" described by its location in the vector
+/// 2. a 64-byte preimage buffer is generated with the following structure:
+///     - bytes 0-31: BLAKE3 hash of domain_separator
+///     - bytes 32-63: generator index in big-endian form
+/// 3. The [hash-to-curve algorithm][hash_to_curve] is used to hash the above into a curve point.
+///
+/// NOTE: The domain separator is included to ensure that it is possible to derive independent sets of
+/// index-addressable generators.
+///
+/// [hash_to_curve]: super::hash_to_curve::hash_to_curve
+pub(crate) fn derive_generators(
+    domain_separator_bytes: &[u8],
+    num_generators: u32,
+    starting_index: u32,
+) -> Vec<Affine<GrumpkinParameters>> {
+    // We cache a small number of the default generators so we can reuse them without needing to repeatedly recalculate them.
+    if domain_separator_bytes == DEFAULT_DOMAIN_SEPARATOR
+        && starting_index + num_generators <= NUM_DEFAULT_GENERATORS as u32
+    {
+        let start_index = starting_index as usize;
+        let end_index = (starting_index + num_generators) as usize;
+        default_generators()[start_index..end_index].to_vec()
+    } else {
+        _derive_generators(domain_separator_bytes, num_generators, starting_index)
+    }
+}
+
+fn _derive_generators(
+    domain_separator_bytes: &[u8],
+    num_generators: u32,
+    starting_index: u32,
+) -> Vec<Affine<GrumpkinParameters>> {
+    let mut generator_preimage = [0u8; 64];
+    let domain_hash = blake3(domain_separator_bytes).expect("hash should succeed");
+    //1st 32 bytes are blake3 domain_hash
+    generator_preimage[..32].copy_from_slice(&domain_hash);
+
+    // Convert generator index in big-endian form
+    let mut res = Vec::with_capacity(num_generators as usize);
+    for i in starting_index..(starting_index + num_generators) {
+        let generator_be_bytes: [u8; 4] = i.to_be_bytes();
+        generator_preimage[32] = generator_be_bytes[0];
+        generator_preimage[33] = generator_be_bytes[1];
+        generator_preimage[34] = generator_be_bytes[2];
+        generator_preimage[35] = generator_be_bytes[3];
+        let generator = hash_to_curve(&generator_preimage, 0);
+        res.push(generator);
+    }
+    res
+}
+
+#[cfg(test)]
+mod test {
+
+    use ark_ec::AffineRepr;
+    use ark_ff::{BigInteger, PrimeField};
+
+    use super::*;
+
+    #[test]
+    fn test_derive_generators() {
+        let res = derive_generators("test domain".as_bytes(), 128, 0);
+
+        let is_unique = |y: Affine<grumpkin::GrumpkinParameters>, j: usize| -> bool {
+            for (i, res) in res.iter().enumerate() {
+                if i != j && *res == y {
+                    return false;
+                }
+            }
+            true
+        };
+
+        for (i, res) in res.iter().enumerate() {
+            assert!(is_unique(*res, i));
+            assert!(res.is_on_curve());
+        }
+    }
+
+    #[test]
+    fn derive_length_generator() {
+        let domain_separator = "pedersen_hash_length";
+        let length_generator = derive_generators(domain_separator.as_bytes(), 1, 0)[0];
+
+        let expected_generator = (
+            "2df8b940e5890e4e1377e05373fae69a1d754f6935e6a780b666947431f2cdcd",
+            "2ecd88d15967bc53b885912e0d16866154acb6aac2d3f85e27ca7eefb2c19083",
+        );
+        assert_eq!(
+            hex::encode(length_generator.x().unwrap().into_bigint().to_bytes_be()),
+            expected_generator.0,
+            "Failed on x component"
+        );
+        assert_eq!(
+            hex::encode(length_generator.y().unwrap().into_bigint().to_bytes_be()),
+            expected_generator.1,
+            "Failed on y component"
+        );
+    }
+
+    #[test]
+    fn derives_default_generators() {
+        const DEFAULT_GENERATORS: &[[&str; 2]] = &[
+            [
+                "083e7911d835097629f0067531fc15cafd79a89beecb39903f69572c636f4a5a",
+                "1a7f5efaad7f315c25a918f30cc8d7333fccab7ad7c90f14de81bcc528f9935d",
+            ],
+            [
+                "054aa86a73cb8a34525e5bbed6e43ba1198e860f5f3950268f71df4591bde402",
+                "209dcfbf2cfb57f9f6046f44d71ac6faf87254afc7407c04eb621a6287cac126",
+            ],
+            [
+                "1c44f2a5207c81c28a8321a5815ce8b1311024bbed131819bbdaf5a2ada84748",
+                "03aaee36e6422a1d0191632ac6599ae9eba5ac2c17a8c920aa3caf8b89c5f8a8",
+            ],
+            [
+                "26d8b1160c6821a30c65f6cb47124afe01c29f4338f44d4a12c9fccf22fb6fb2",
+                "05c70c3b9c0d25a4c100e3a27bf3cc375f8af8cdd9498ec4089a823d7464caff",
+            ],
+            [
+                "20ed9c6a1d27271c4498bfce0578d59db1adbeaa8734f7facc097b9b994fcf6e",
+                "29cd7d370938b358c62c4a00f73a0d10aba7e5aaa04704a0713f891ebeb92371",
+            ],
+            [
+                "0224a8abc6c8b8d50373d64cd2a1ab1567bf372b3b1f7b861d7f01257052d383",
+                "2358629b90eafb299d6650a311e79914b0215eb0a790810b26da5a826726d711",
+            ],
+            [
+                "0f106f6d46bc904a5290542490b2f238775ff3c445b2f8f704c466655f460a2a",
+                "29ab84d472f1d33f42fe09c47b8f7710f01920d6155250126731e486877bcf27",
+            ],
+            [
+                "0298f2e42249f0519c8a8abd91567ebe016e480f219b8c19461d6a595cc33696",
+                "035bec4b8520a4ece27bd5aafabee3dfe1390d7439c419a8c55aceb207aac83b",
+            ],
+        ];
+
+        let generated_generators =
+            derive_generators(DEFAULT_DOMAIN_SEPARATOR, DEFAULT_GENERATORS.len() as u32, 0);
+        for (i, (generator, expected_generator)) in
+            generated_generators.iter().zip(DEFAULT_GENERATORS).enumerate()
+        {
+            assert_eq!(
+                hex::encode(generator.x().unwrap().into_bigint().to_bytes_be()),
+                expected_generator[0],
+                "Failed on x component of generator {i}"
+            );
+            assert_eq!(
+                hex::encode(generator.y().unwrap().into_bigint().to_bytes_be()),
+                expected_generator[1],
+                "Failed on y component of generator {i}"
+            );
+        }
+    }
+}

acvm-repo/bn254_blackbox_solver/src/generator/hash_to_curve.rs

@@ -0,0 +1,135 @@
+// Adapted from https://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/barustenberg/src/ecc/groups/affine_element.rs
+//!
+//! Code is used under the MIT license
+
+use acvm_blackbox_solver::blake3;
+
+use ark_ec::{short_weierstrass::Affine, AffineRepr, CurveConfig};
+use ark_ff::Field;
+use ark_ff::{BigInteger, PrimeField};
+use grumpkin::GrumpkinParameters;
+
+/// Hash a seed buffer into a point
+///
+/// # ALGORITHM DESCRIPTION
+///
+///  1. Initialize unsigned integer `attempt_count = 0`
+///  2. Copy seed into a buffer whose size is 2 bytes greater than `seed` (initialized to `0`)
+///  3. Interpret `attempt_count` as a byte and write into buffer at `[buffer.size() - 2]`
+///  4. Compute Blake3 hash of buffer
+///  5. Set the end byte of the buffer to `1`
+///  6. Compute Blake3 hash of buffer
+///  7. Interpret the two hash outputs as the high / low 256 bits of a 512-bit integer (big-endian)
+///  8. Derive x-coordinate of point by reducing the 512-bit integer modulo the curve's field modulus (Fq)
+///  9. Compute `y^2` from the curve formula `y^2 = x^3 + ax + b` (`a`, `b` are curve params. for BN254, `a = 0`, `b = 3`)
+///  10. IF `y^2` IS NOT A QUADRATIC RESIDUE:
+///
+///  a. increment `attempt_count` by 1 and go to step 2
+///  
+///  11. IF `y^2` IS A QUADRATIC RESIDUE:
+///
+///  a. derive y coordinate via `y = sqrt(y)`
+///
+///  b. Interpret most significant bit of 512-bit integer as a 'parity' bit
+///
+///  c. If parity bit is set AND `y`'s most significant bit is not set, invert `y`
+///
+///  d. If parity bit is not set AND `y`'s most significant bit is set, invert `y`
+///
+///  e. return (x, y)
+///
+///  N.B. steps c. and e. are because the `sqrt()` algorithm can return 2 values,
+///  we need to a way to canonically distinguish between these 2 values and select a "preferred" one
+pub(crate) fn hash_to_curve(seed: &[u8], attempt_count: u8) -> Affine<GrumpkinParameters> {
+    let seed_size = seed.len();
+    // expand by 2 bytes to cover incremental hash attempts
+    let mut target_seed = seed.to_vec();
+    target_seed.extend_from_slice(&[0u8; 2]);
+
+    target_seed[seed_size] = attempt_count;
+    target_seed[seed_size + 1] = 0;
+    let hash_hi = blake3(&target_seed).expect("hash should succeed");
+    target_seed[seed_size + 1] = 1;
+    let hash_lo = blake3(&target_seed).expect("hash should succeed");
+
+    let mut hash = hash_hi.to_vec();
+    hash.extend_from_slice(&hash_lo);
+
+    // Here we reduce the 512 bit number modulo the base field modulus to calculate `x`
+    let x = <<GrumpkinParameters as CurveConfig>::BaseField as Field>::BasePrimeField::from_be_bytes_mod_order(&hash);
+    let x = <GrumpkinParameters as CurveConfig>::BaseField::from_base_prime_field(x);
+
+    if let Some(point) = Affine::<GrumpkinParameters>::get_point_from_x_unchecked(x, false) {
+        let parity_bit = hash_hi[0] > 127;
+        let y_bit_set = point.y().unwrap().into_bigint().get_bit(0);
+        if (parity_bit && !y_bit_set) || (!parity_bit && y_bit_set) {
+            -point
+        } else {
+            point
+        }
+    } else {
+        hash_to_curve(seed, attempt_count + 1)
+    }
+}
+
+#[cfg(test)]
+mod test {
+
+    use ark_ec::AffineRepr;
+    use ark_ff::{BigInteger, PrimeField};
+
+    use super::hash_to_curve;
+
+    #[test]
+    fn smoke_test() {
+        let test_cases: [(&[u8], u8, (&str, &str)); 4] = [
+            (
+                &[],
+                0,
+                (
+                    "24c4cb9c1206ab5470592f237f1698abe684dadf0ab4d7a132c32b2134e2c12e",
+                    "0668b8d61a317fb34ccad55c930b3554f1828a0e5530479ecab4defe6bbc0b2e",
+                ),
+            ),
+            (
+                &[],
+                1,
+                (
+                    "24c4cb9c1206ab5470592f237f1698abe684dadf0ab4d7a132c32b2134e2c12e",
+                    "0668b8d61a317fb34ccad55c930b3554f1828a0e5530479ecab4defe6bbc0b2e",
+                ),
+            ),
+            (
+                &[1],
+                0,
+                (
+                    "107f1b633c6113f3222f39f6256f0546b41a4880918c86864b06471afb410454",
+                    "050cd3823d0c01590b6a50adcc85d2ee4098668fd28805578aa05a423ea938c6",
+                ),
+            ),
+            (
+                &[0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64],
+                0,
+                (
+                    "037c5c229ae495f6e8d1b4bf7723fafb2b198b51e27602feb8a4d1053d685093",
+                    "10cf9596c5b2515692d930efa2cf3817607e4796856a79f6af40c949b066969f",
+                ),
+            ),
+        ];
+
+        for (seed, attempt_count, expected_point) in test_cases {
+            let point = hash_to_curve(seed, attempt_count);
+            assert!(point.is_on_curve());
+            assert_eq!(
+                hex::encode(point.x().unwrap().into_bigint().to_bytes_be()),
+                expected_point.0,
+                "Failed on x component with seed {seed:?}, attempt_count {attempt_count}"
+            );
+            assert_eq!(
+                hex::encode(point.y().unwrap().into_bigint().to_bytes_be()),
+                expected_point.1,
+                "Failed on y component with seed {seed:?}, attempt_count {attempt_count}"
+            );
+        }
+    }
+}

acvm-repo/bn254_blackbox_solver/src/generator/mod.rs

@@ -0,0 +1,8 @@
+//! This module is adapted from the [Barustenberg][barustenberg] Rust implementation of the Barretenberg library.
+//!
+//! Code is used under the MIT license
+//!
+//! [barustenberg]: https://github.com/laudiacay/barustenberg/blob/df6bc6f095fe7f288bf6a12e7317fd8eb33d68ae/
+
+pub(crate) mod generators;
+mod hash_to_curve;

acvm-repo/bn254_blackbox_solver/src/lib.rs

@@ -6,14 +6,17 @@ use acir::{BlackBoxFunc, FieldElement};
 use acvm_blackbox_solver::{BlackBoxFunctionSolver, BlackBoxResolutionError};
 
 mod embedded_curve_ops;
+mod generator;
+mod pedersen;
 mod poseidon2;
 mod wasm;
 
+use ark_ec::AffineRepr;
 pub use embedded_curve_ops::{embedded_curve_add, multi_scalar_mul};
 pub use poseidon2::poseidon2_permutation;
 use wasm::Barretenberg;
 
-use self::wasm::{Pedersen, SchnorrSig};
+use self::wasm::SchnorrSig;
 
 pub struct Bn254BlackBoxSolver {
     blackbox_vendor: Barretenberg,
@@ -72,21 +75,24 @@ impl BlackBoxFunctionSolver for Bn254BlackBoxSolver {
         inputs: &[FieldElement],
         domain_separator: u32,
     ) -> Result<(FieldElement, FieldElement), BlackBoxResolutionError> {
-        #[allow(deprecated)]
-        self.blackbox_vendor.encrypt(inputs.to_vec(), domain_separator).map_err(|err| {
-            BlackBoxResolutionError::Failed(BlackBoxFunc::PedersenCommitment, err.to_string())
-        })
+        let inputs: Vec<grumpkin::Fq> = inputs.iter().map(|input| input.into_repr()).collect();
+        let result = pedersen::commitment::commit_native_with_index(&inputs, domain_separator);
+        let res_x =
+            FieldElement::from_repr(*result.x().expect("should not commit to point at infinity"));
+        let res_y =
+            FieldElement::from_repr(*result.y().expect("should not commit to point at infinity"));
+        Ok((res_x, res_y))
     }
 
     fn pedersen_hash(
         &self,
         inputs: &[FieldElement],
         domain_separator: u32,
     ) -> Result<FieldElement, BlackBoxResolutionError> {
-        #[allow(deprecated)]
-        self.blackbox_vendor.hash(inputs.to_vec(), domain_separator).map_err(|err| {
-            BlackBoxResolutionError::Failed(BlackBoxFunc::PedersenCommitment, err.to_string())
-        })
+        let inputs: Vec<grumpkin::Fq> = inputs.iter().map(|input| input.into_repr()).collect();
+        let result = pedersen::hash::hash_with_index(&inputs, domain_separator);
+        let result = FieldElement::from_repr(result);
+        Ok(result)
     }
 
     fn multi_scalar_mul(