API with assembly impl Mul z = x * y mod q see https://hackmd.io/@zkteam/modular_multiplication

Equal returns z == x

FromMont converts z in place (i.e. mutates) from Montgomery to regular representation sets and returns z = z * 1

SetUint64 z = v, sets z LSB to v (non-Montgomery form) and convert z to Montgomery form

Add z = x + y mod q

ToBigIntRegular returns z as a big.Int in regular form

Cmp compares (lexicographic order) z and x and returns: -1 if z < x 0 if z == x +1 if z > x

Add sets p to p1+p2.

Modulus returns q as a big.Int q = 13108968793781547619861935127046491459309155893440570251786403306729687672801

SetRandom sets z to a random element < q

Bytes returns the compressed serialized version of the element.

madd2 hi, lo = a*b + c + d

IsZero returns z == 0

ToBigInt returns z as a big.Int in Montgomery form

One returns 1 (in montgommery form)

Square z = x * x mod q see https://hackmd.io/@zkteam/modular_multiplication

Sub z = x - y mod q

Set z = x

Sub sets p to p1-p2.

partitionScalars compute, for each scalars over c-bit wide windows, nbChunk digits if the digit is larger than 2^{c-1}, then, we borrow 2^c from the

Equal returns true if p and other represent the same point.

Inverse z = x^-1 mod q Algorithm 16 in "Efficient Software-Implementation of Finite Fields with Applications to Cryptography" if x == 0, sets and retu

Neg z = q - x

Computes a challenge based off of the state of the transcript Hash the transcript state, then reduce the hash modulo the size of the scalar field No

Write serializes the IPA proof to the given writer.

One returns the field element 1.

msmReduceChunkPointAffine reduces the weighted sum of the buckets into the result of the multiExp

Appends a Scalar to the transcript Converts the scalar to 32 bytes, then appends it to the state

Double z = x + x mod q, aka Lsh 1

Exp z = x^exponent mod q

Appends a Point to the transcript Compresses the Point into a 32 byte slice, then appends it to the state

SetBytes deserializes a compressed group element from buf. This method does all the proper checks assuming the bytes come from an untrusted source.

Div z = x*y^-1 mod q

Zero returns 0 (in montgommery form) This is not strictly needed, as the default value for u64s is zero

Commit calculates the Pedersen Commitment of a polynomial polynomial in evaluation form using the SRS.

Equal checks if two IPA proofs are equal.

SetOne z = 1 (in Montgomery form)

Double sets p to 2*p1.

SetString creates a big.Int with s (in base 10) and calls SetBigInt on z

Set sets p to p1.

SetBytes interprets e as the bytes of a big-endian unsigned integer, sets z to that value (in Montgomery form), and returns z.

InnerProd computes the inner product of a and b.

madd0 hi = a*b + c (discards lo bits)

Bytes returns the regular (non montgomery) value of z as a little-endian byte array.

Normalize returns a point in affine form. If the point is at infinity, returns an error.

ScalarMul sets p to p1*s.

SetZero z = 0

Sqrt z = √x mod q if the square root doesn't exist (x is not a square mod q) Sqrt leaves z unchanged and returns nil

CreateMultiProof creates a multi-proof for several polynomials in evaluation form. The list of triplets (C, Fs, Z) represents each polynomial commitme

MultiExp implements section 4 of https://eprint.iacr.org/2012/549.pdf

SetBigInt sets z to v (regular form) and returns z in Montgomery form

Zero returns the field element 0.

commit commits to a polynomial using the input group elements

madd1 hi, lo = a*b + c

Bytes returns the regular (non montgomery) value of z as a big-endian byte array.

CheckMultiProof verifies a multi-proof for several polynomials in evaluation form. The list of triplets (C, Y, Z) represents each polynomial commitmen

MultiExp implements section 4 of https://eprint.iacr.org/2012/549.pdf Note: We rely on this algortithm not use Equal functionality, since it is called

Generic (no ADX instructions, no AMD64) versions of multiplication and squaring algorithms

BatchInvert returns a new slice with every element inverted. Uses Montgomery batch inversion trick

BatchNormalize normalizes a slice of group elements.

CheckIPAProof verifies an IPA proof for a committed polynomial in evaluation form. It verifies that `proof` is a valid proof for the polynomial at the

ComputeBarycentricCoefficients, computes the coefficients `bary_coeffs` for a point `z` such that when we have a polynomial `p` in lagrange basis, the

CreateIPAProof creates an IPA proof for a committed polynomial in evaluation form. `a` are the evaluation of the polynomial in the domain, and `evalPo

Execute process in parallel the work function

LexicographicallyLargest returns true if this element is strictly lexicographically larger than its negation, false otherwise

One returns 1 (in montgommery form)

NewPrecompMSM creates a new MSMPrecomp.

SetBytesUncompressed deserializes an uncompressed group element from buf. This method does all the proper checks assuming the bytes come from an untru

BatchInvert computes the inverse of a slice of field elements.

IsUint64 returns true if z[0] >= 0 and all other words are 0

MSM calculates the 256-MSM of the given scalars on the fixed basis. It automatically detects how many non-zero scalars there are and parallelizes the

MultiScalar computes the multi scalar multiplication of points and scalars.

Neg sets p to -p1.

NewPrecomputedWeights generates the precomputed weights for the barycentric formula.

Returns powers of x from 0 to degree-1 <1, x, x^2, x^3, x^4,...,x^(degree-1)> TODO This method is used in two places; one is to evaluate a polynomial

SetBytes interprets e as the bytes of a little-endian unsigned integer, sets z to that value (in Montgomery form), and returns z.

String returns the string form of an Element in Montgomery form

ToMont converts z to Montgomery form sets and returns z = z * r^2