dannywillems / ocaml-bls12-381

Fast BLS12-381 implementation in OCaml

OCaml implementation of BLS12-381

This library provides a fast implementation of:

• operations over the scalar field, including (i)FFT.
• operations over the groups G1 and G2, including EC-FFT, hash_to_curve as described in this specification and the pippenger algorithm for fast multi scalar exponentiation.
• operations over the target group of the pairing (GT), written additively.
• pairing from G1 x G2 to GT

Encoding

Scalar

The scalar field is Fr = GF(0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001), encoded on 32 bytes in little endian.

Groups

For G1, the base field is Fq: GF(0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab) and E(Fq) := y^2 = x^3 + 4. An element of the base field can be encoded on 48 bytes (using only 381 bits, leaving 3 bits unused).

For G2, the base field is Fq2 := Fq[Z]/(X^2 + 1) and E(Fq2) := y^2 = x^3 + 4 (Z + 1). An element of the base field can be encoded on 2 * 48 bytes representing each coefficient of the polynomial. 3 bits of each coefficient encoding are unused.

The « uncompressed » form (x, y) of G1 and G2 is the concatenation of the elements x and y encoded in big endian.

The « compressed » form uses the first 3 most significant (and unused) bits of the coordinate x.

• the first most significant bit is always set to 1 to carry the information it is the compressed encoding of a point.
• the second most significant bit is set to 1 if the element is the identity of the curve.
• the third most significant bit is the sign of y. It is set to 1 if y is lexicographically larger than -y.

Install

opam install bls12-381

By default, if the architecture supports ADX, bls12-381 with be compiled using ADX opcodes (giving optimisations up to 20% for some arithmetic operations). If you don't want to build using ADX, you can add the environment variable BLST_PORTABLE and set it to any value. For instance,

BLST_PORTABLE=y opam install bls12-381

will instruct to build bls12-381 without ADX. This might be useful if you build docker images on ADX machines but you need the image to be portable on architecture not supporting ADX.

If the architecture does not support ADX, bls12-381 will be compiled without ADX opcodes.

Run tests

dune runtest

To get the coverage:

dune runtest --instrument-with bisect_ppx --force
bisect-ppx-report html

Run the benchmarks

Install core_bench:

opam install core_bench

See files listed in the directory benchmark and execute it with dune exec. For instance:

dune exec ./benchmark/bench_fr.exe

Documentation

opam install odoc
dune build @doc

ocaml-bls12-381's Issues

Compilation failure of ocaml-bls-12-381-unix in Mac OS X

opam install bls-12-381-unix.1.0.0 failed with the following errors:

$ cat ~/.opam/log/bls12-381-unix-53797-6d07ae.out
       build src/blst/dllblst.so,src/blst/libblst.a (exit 1)
(cd _build/default/src/blst/libblst && ./build.sh -shared)
+ cc -O -fno-builtin-memcpy -fPIC -Wall -Wextra -Werror -mno-avx -c ./src/server.c
In file included from ./src/server.c:19:
./src/bulk_addition.c:167:1: error: suggest braces around initialization of subobject [-Werror,-Wmissing-braces]
ADDITION_BTREE(blst_p2, POINTonE2, 384x, fp2, BLS12_381_Rx.p2)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./src/bulk_addition.c:113:57: note: expanded from macro 'ADDITION_BTREE'
#define ADDITION_BTREE(prefix, ptype, bits, field, one) \
                                                        ^
./src/bulk_addition.c:57:37: note: expanded from macro '\
HEAD'
    static const vec##bits zero = { 0 }; \
                                    ^
In file included from ./src/server.c:20:
./src/multi_scalar.c:245:1: error: suggest braces around initialization of subobject [-Werror,-Wmissing-braces]
POINTS_MULT_WBITS_IMPL(blst_p1, POINTonE1, 384, fp, BLS12_381_Rx.p)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./src/multi_scalar.c:162:46: note: expanded from macro 'POINTS_MULT_WBITS_IMPL'
    static const ptype##_affine infinity = { 0 }; \
                                             ^
./src/multi_scalar.c:248:1: error: suggest braces around initialization of subobject [-Werror,-Wmissing-braces]
POINTS_MULT_WBITS_IMPL(blst_p2, POINTonE2, 384x, fp2, BLS12_381_Rx.p2)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./src/multi_scalar.c:162:46: note: expanded from macro 'POINTS_MULT_WBITS_IMPL'
    static const ptype##_affine infinity = { 0 }; \
                                             ^
./src/multi_scalar.c:248:1: error: suggest braces around initialization of subobject [-Werror,-Wmissing-braces]
POINTS_MULT_WBITS_IMPL(blst_p2, POINTonE2, 384x, fp2, BLS12_381_Rx.p2)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./src/multi_scalar.c:162:46: note: expanded from macro 'POINTS_MULT_WBITS_IMPL'
    static const ptype##_affine infinity = { 0 }; \
                                             ^
4 errors generated.

no implementation found for virtual library

Hello, I am getting the following error when I try running the test on a simple program:

module Privkey = struct
  let keygen _ = 
    let ikm = Bytes.create 32 in
    Randoml.rand_fill ikm;
    Bls12_381.Signature.generate_sk ikm
end

let%test "keygen" =
  let key = Privkey.keygen () in
  printf "%s\n" key

Error: No implementation found for virtual library "bls12-381" in
/Users/xxx/.opam/4.13.1/lib/bls12-381.
-> required by library "narwhall" in _build/default

helping serialization

Hey hey,

So I have some custom records, and I want to serialize them. It seems like in OCaml the common way to do this is to use [@@deriving sexp], but this won't work with the types that are in Bls12-381. Would it make sense to add this (or add the specific functions it derives manually) within the library itself here?