Feat: Subgroup membership testing on Bandersnatch

internal/generator/edwards/template/curve.go.tmpl

@@ -10,12 +10,17 @@ import (
 	{{- end}}
 )
 
-// CurveParams curve parameters: ax^2 + y^2 = 1 + d*x^2*y^2
+// CurveParams curve parameters: Ax^2 + y^2 = 1 + Dx^2*y^2
 type CurveParams struct {
 	A, D     fr.Element
 	Cofactor fr.Element
 	Order    big.Int
 	Base     PointAffine
+	{{- if eq .Cofactor "4"}}
+	{{- if eq .Name "bls12-381"}}
+	t0, t1, b fr.Element
+	{{- end}}
+	{{- end}}
 
 	{{- if .HasEndomorphism}}
 	// endomorphism
@@ -36,6 +41,13 @@ func GetEdwardsCurve() CurveParams {
 	res.Cofactor.Set(&curveParams.Cofactor)
 	res.Order.Set(&curveParams.Order)
 	res.Base.Set(&curveParams.Base)
+	{{- if eq .Cofactor "4"}}
+	{{- if eq .Name "bls12-381"}}
+	res.t0.Set(&curveParams.t0)
+	res.t1.Set(&curveParams.t1)
+	res.b.Set(&curveParams.b)
+	{{- end}}
+	{{- end}}
 
 	{{- if .HasEndomorphism}}
 	res.endo[0].Set(&curveParams.endo[0])
@@ -62,6 +74,13 @@ func initCurveParams() {
 
 	curveParams.Base.X.SetString("{{.BaseX}}")
 	curveParams.Base.Y.SetString("{{.BaseY}}")
+	{{- if eq .Cofactor "4"}}
+	{{- if eq .Name "bls12-381"}}
+	curveParams.t0.SetString("44968234042453258989421494579017642355260750649112422763795205757285533011434")
+	curveParams.t1.SetString("7467641132672931490026245929168323482429801851415215058808452942653048173085")
+	curveParams.b.SetString("25465760566081946422412445027709227188579564747101592991722834452325077642517")
+	{{- end}}
+	{{- end}}
 
 	{{- if .HasEndomorphism}}
 	curveParams.endo[0].SetString("{{.Endo0}}")

internal/generator/edwards/template/point.go.tmpl

@@ -161,6 +161,68 @@ func (p *PointAffine) IsOnCurve() bool {
 	return lhs.Equal(&rhs)
 }
 
+{{- if eq .Cofactor "4"}}
+{{- if eq .Name "bls12-381"}}
+// IsInSubGroup checks if a point is in the prime subgroup (and on the curve)
+// based on https://eprint.iacr.org/2022/037.pdf by D. Koshelev.
+func (p *PointAffine) IsInSubGroup() bool {
+    if !p.IsOnCurve() {
+        return false
+    }
+	if p.IsZero() {
+		return true
+	}
+	initOnce.Do(initCurveParams)
+
+	// Given (x_e, x_e) a point on the twisted Edwards curve Ed_{a,d},
+	// (x_w, y_w) is a point on the birationally equivalent short Weierstrass curve W,
+	// where:
+	// 		x_w = ((1+y_e)/(1-y_e) + A/3 ) / B and
+	//  	A = 2(a+d)/(a-d), B = 4/(a-d)
+	//
+	// N.B.: We only need x_w in the following formula.
+ 	//
+	// We need to check that the two tate pairings t_{2,P1}(P) and t_{2,P2}(P) are 1,
+	// where P1, P2 form a basis of W[2].
+	// The Miller functions are:
+	// 		f1 = f_{2,P1} = x_w - P1.X
+	// 		f2 = f_{2,P2} = x_w - P2.X
+	// and the final exponentiations to (r-1)/2 are replaced by Legendre symbols.
+	//
+	// To avoid inverses we use the fact that ((a/b) / r)_2 = (a * b / r)_2.
+    // So f_{2,P2} and f_{2,Q2} are simplified as:
+    //              f1 = (t0 + t1 * y) * (3B * (1-y)) and
+    //              f2 = (t2 + t3 * y) * (3B * (1-y))
+ 	// where:
+	// 		t0 = 3+A-3B*P1.X
+	// 		t1 = 3-A+3B*P1.X
+	// 		t2 = 3+A-3B*P2.X
+	// 		t3 = 3-A+3B*P2.X
+	//
+	// With
+	// P1=(0x5de00fbdcf0964d2188e44aec311d927af0f7e94e94fca97c891a87d84178ed1,0)
+	// and
+	// P2=(0x23e93c143a3aa62dfef158aabe40ed250530ac9369509c984891a87e04178ed3,0)
+	// on W: y^2 = x^3 + x*(3-A^2)/(3*B^2) + (2*A^3-9*A)/(27*B^3),
+	// it happens that t0=t1=3 and f1 = (1 + y) * (B * (1-y))
+
+	var tate1, tate2, temp fr.Element
+	temp.SetOne()
+	tate2.Sub(&temp, &p.Y).
+		Mul(&tate2, &curveParams.b)
+	tate1.Add(&temp, &p.Y).
+		Mul(&tate1, &tate2)
+
+	fr.MulBy3(&tate2)
+	temp.Mul(&curveParams.t1, &p.Y).
+		Add(&temp, &curveParams.t0)
+	tate2.Mul(&temp, &tate2)
+
+	return tate1.Legendre() == 1 && tate2.Legendre() == 1
+}
+{{- end}}
+{{- end}}
+
 // Neg sets p to -p1 and returns it
 func (p *PointAffine) Neg(p1 *PointAffine) *PointAffine {
 	p.X.Neg(&p1.X)