longfellow 0.1.0

data/vendor/longfellow-zk/lib/algebra/fp_p256k1.h

@@ -0,0 +1,123 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P256K1_H_
+#define PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P256K1_H_
+
+#include <array>
+#include <cstdint>
+
+#include "algebra/fp_generic.h"
+#include "algebra/nat.h"
+#include "algebra/sysdep.h"
+
+namespace proofs {
+// Optimized implementation of Fp(2^256 - 2^32 - 977)
+//  = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1
+// Secp256k1 base field.
+
+/*
+This struct contains an optimized reduction step for the chosen field.
+*/
+struct Fp256k1Reduce {
+  // Hardcoded modulus (little endian)
+  static const constexpr std::array<uint64_t, 4> kModulus = {
+      0xFFFFFFFEFFFFFC2Fu,
+      0xFFFFFFFFFFFFFFFFu,
+      0xFFFFFFFFFFFFFFFFu,
+      0xFFFFFFFFFFFFFFFFu,
+  };
+
+#ifndef SYSDEP_MULQ64_NOT_DEFINED
+  static inline void reduction_step(uint64_t a[], uint64_t mprime,
+                                    const Nat<4>& m) {
+    // This step computes a += (mprime * a0) * p
+    // The modulus is P = 2^256 - S, where S = 2^32 + 977.
+    //
+    // The standard Montgomery reduction step computes u such that
+    // A + u * P is divisible by 2^64.
+    // u = a[0] * mprime mod 2^64.
+    //
+    // Then we compute A + u * P = A + u * (2^256 - S)
+    //                           = A + u * 2^256 - u * S.
+    //
+    // The division by 2^64 is implicit because we will just ignore the
+    // lower 64 bits (which are guaranteed to be zero) and shift the rest.
+    //
+    // So the steps are:
+    // 1. Calculate u = a[0] * mprime.
+    // 2. Calculate X = u * S.
+    //    S = 2^32 + 977, so X = u * 2^32 + u * 977.
+    // 3. Subtract X from A (A -= u * S).
+    // 4. Add u * 2^256 to A (A += u * 2^256).
+    //    Since 2^256 is 4 words shifted, this means adding u to a[4].
+    //
+    // The result is (A - u * S + u * 2^256) / 2^64.
+    uint64_t u = a[0] * mprime;
+
+    // Calculate u * S = u * (2^32 + 977)
+    uint64_t x_lo, x_hi;
+    mulq(&x_lo, &x_hi, u, (1ULL << 32) + 977);
+
+    // l = u * S
+    uint64_t l[2] = {x_lo, x_hi};
+
+    // Subtract l from a.
+    negaccum(6, a, 2, l);
+
+    // Add u * 2^256
+    // This adds u to a[4].
+    uint64_t h[1] = {u};
+    // We add u to a[4] and propagate the carry.
+    // a[4] corresponds to the 2^256 term.
+    // The carry can propagate to a[5].
+    // Since we are adding u (one limb) to a[4], the carry will at most be 1.
+    accum(2, a + 4, 1, h);
+  }
+#endif
+
+  static inline void reduction_step(uint32_t a[], uint32_t mprime,
+                                    const Nat<4>& m) {
+    uint32_t u = a[0] * mprime;
+    uint32_t h[1] = {u};
+
+    // S = 2^32 + 977
+    // u * S = u * 2^32 + u * 977
+    // u * 977 fits in 64 bits.
+    uint64_t u977 = (uint64_t)u * 977;
+    uint32_t s0 = (uint32_t)u977;
+    uint32_t s1 = (uint32_t)(u977 >> 32);
+
+    // Add u << 32 (which is effectively adding u to s1 position?)
+    // u * 2^32 means u is effectively at limb 1.
+    // So s1 += u.
+    uint32_t l[3] = {s0, s1, 0};
+    accum(2, &l[1], 1, h);
+
+    // Subtract u*S
+    negaccum(10, a, 3, l);
+
+    // Add u * 2^256 to a.
+    // 2^256 corresponds to the limb at index 8 (256 / 32 = 8).
+    // So we add u to a[8].
+    accum(2, a + 8, 1, h);
+  }
+};
+
+template <bool optimized_mul = true>
+using Fp256k1 = FpGeneric<4, optimized_mul, Fp256k1Reduce>;
+
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P256K1_H_

data/vendor/longfellow-zk/lib/algebra/fp_p384.h

@@ -0,0 +1,65 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P384_H_
+#define PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P384_H_
+
+#include <array>
+#include <cstdint>
+
+#include "algebra/fp_generic.h"
+#include "algebra/nat.h"
+#include "algebra/sysdep.h"
+
+namespace proofs {
+// Optimized implementation of
+// Fp(39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319)
+// 2^384 - 2^128 - 2^96 + 2^32 - 1
+
+struct Fp384Reduce {
+  // Hardcoded base_64 modulus.
+  static const constexpr std::array<uint64_t, 6> kModulus = {
+      0x00000000ffffffffu, 0xffffffff00000000u, 0xfffffffffffffffeu,
+      0xffffffffffffffffu, 0xffffffffffffffffu, 0xffffffffffffffffu};
+
+  static inline void reduction_step(uint64_t a[], uint64_t mprime,
+                                    const Nat<6>& m) {
+    // mprime = 2^32 + 1
+    uint64_t r = ((1ull << 32) + 1) * a[0];
+    // p = 2^384 - 2^128 - 2^96 + 2^32 - 1
+    uint64_t h[7] = {r << 32, r >> 32, 0, 0, 0, 0, r};
+    accum(8, a, 7, h);
+
+    uint64_t l[4] = {r, r << 32, r >> 32, 0};  // - 2^96 - 1
+    uint64_t l128[1] = {r};
+    accum(2, l+2, 1, l128);   // - 2^128 to l, with carry
+    negaccum(8, a, 4, l);
+  }
+
+  static inline void reduction_step(uint32_t a[], uint32_t mprime,
+                                    const Nat<6>& m) {
+    uint32_t r = mprime * a[0];
+    uint32_t h[13] = {0, r, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, r};
+    accum(14, a, 13, h);
+
+    uint32_t l[5] = {r, 0, 0, r, r};
+    negaccum(14, a, 5, l);
+  }
+};
+
+template <bool optimized_mul = false>
+using Fp384 = FpGeneric<6, optimized_mul, Fp384Reduce>;
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P384_H_

data/vendor/longfellow-zk/lib/algebra/fp_p521.h

@@ -0,0 +1,62 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P521_H_
+#define PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P521_H_
+
+#include <array>
+#include <cstdint>
+
+#include "algebra/fp_generic.h"
+#include "algebra/nat.h"
+#include "algebra/sysdep.h"
+
+namespace proofs {
+// Optimized implementation of
+// Fp(6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151)
+// 2^521 - 1
+
+struct Fp521Reduce {
+  // Hardcoded base_64 modulus.
+  static const constexpr std::array<uint64_t, 9> kModulus = {
+      0xFFFFFFFFFFFFFFFFu, 0xFFFFFFFFFFFFFFFFu, 0xFFFFFFFFFFFFFFFFu,
+      0xFFFFFFFFFFFFFFFFu, 0xFFFFFFFFFFFFFFFFu, 0xFFFFFFFFFFFFFFFFu,
+      0xFFFFFFFFFFFFFFFFu, 0xFFFFFFFFFFFFFFFFu, 0x1FFu};
+
+  static inline void reduction_step(uint64_t a[], uint64_t mprime,
+                                    const Nat<9>& m) {
+    // p = 2^521 - 1
+    // mprime = 1
+    uint64_t r = a[0];
+    uint64_t l[1] = {r};
+    uint64_t h[2] = {r << 9, r >> 55};
+    accum(3, a + 8, 2, h);
+    negaccum(11, a, 1, l);
+  }
+
+  static inline void reduction_step(uint32_t a[], uint32_t mprime,
+                                    const Nat<9>& m) {
+    uint32_t r = a[0];
+    uint32_t l[1] = {r};
+    uint32_t h[2] = {r << 9, r >> 23 };
+    accum(4, a + 16, 2, h);
+    negaccum(20, a, 1, l);
+  }
+};
+
+template <bool optimized_mul = false>
+using Fp521 = FpGeneric<9, optimized_mul, Fp521Reduce>;
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_ALGEBRA_FP_P521_H_