2

I am experimenting the ecmul opcode (inside the EccMul function) where I can multiply the given generator with the given number.

pragma solidity ^0.8.0;

contract TestEccMul {
   
    struct G1Point {
        uint X;
        uint Y;
    }

    struct G2Point {
        uint[2] X;
        uint[2] Y;
    }

    /// @return the generator of G1
    function P1() public pure returns (G1Point memory) {
        return G1Point(1, 2);
    }
    
    /// @return the generator of G2
    function P2() public pure returns (G2Point memory) {
        return G2Point(
            [535000198726010842494463887012728317008839985956991949449597676023059784793,
            50911955057697873758342946860545764866265758828426205386527214348449976128083],

            [34456506622601912613857833514763279459301076221556609925761869949091594580415,
            8211078999328499834214571830542910221251497399640112479758011117184688730247]
        );
        
    }

    function EccMul(uint s) public view returns (G1Point memory r) {
        uint[3] memory input;
        input[0] = P1().X;
        input[1] = P1().Y;
        input[2] = s;

        assembly {
            if iszero (staticcall(gas(), 0x07, input, 0x60, r, 0x40)) {
                revert (0,0)
            }
        }
        return r;
    }
}

The code perfectly works with the given generator (where g1 = (1,2) ); however, EVM reverts when I change the generator to any other coordinates. Why is this the case? Whats the point of this if I can't use other generators then the one defined in EIP-197. Am I missing something?

4
  • 1
    In case you don't get an answer, a suggestion would be to try the cryptography channel in the Ethereum R&D Discord. Please do post an answer here if you get answer on Discord :)
    – eth
    Nov 1, 2022 at 5:31
  • Thank you I will ask there. In a meanwhile, woud you mind apply bounty to question? There is literally nothing on the internet regarding this topic.
    – Emrah
    Nov 1, 2022 at 13:39
  • There is an ecmul opcode? Where is that? Nov 30, 2022 at 12:53
  • 1
    @PatrickCollins here you go evm.codes/precompiled?fork=istanbul
    – Emrah
    Nov 30, 2022 at 14:25

3 Answers 3

2
+100

pre-compile exist to reduce gas and because of this reason they are implemented with specific values and functions, in this case, EccMul is defined with the specific curve Y² = X³ + 3 over the prime value "P" on G-1 group, for other Groups, the prime number is the same but you have to implement new curve to solve this problem because EVM work with specific curves like Y² = X³ + 3.

1

The ecmul opcode in Solidity allows you to multiply a given point on the elliptic curve with a scalar value. The point used in the ecmul opcode must be a generator point on the elliptic curve, which is a pre-defined point that satisfies certain mathematical properties. The generator point used in the ecmul opcode in the provided code is (1,2), which is the generator point for the curve used in EIP-197.

If you try to use a different point as the generator, the ecmul opcode will fail because the point is not a valid generator for the curve. This is why the code reverts when you try to use a different point as the generator.

In order to use a different generator point, you would need to use a different curve with a different generator point. You can find more information about different curves and their generator points in the EIP-197 specification.

2
  • do you have an example of which points can be used that is valid on this curve?
    – Emrah
    Dec 5, 2022 at 16:47
  • (0,0) can be used - but then your EccMul() function will return (0, 0).
    – Yakitori
    Dec 5, 2022 at 23:13
0

It is likely that the ecmul opcode only accepts the default generator point as input, and will revert if given any other point. This is because the ecmul opcode is specifically designed to perform scalar multiplication on a given elliptic curve, and the default generator point is the point on the curve that the ecmul opcode is designed to work with. If you try to use a different point as input, the ecmul opcode may not be able to correctly perform the scalar multiplication and will therefore revert.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.