[SM9/BN256] Special square in final exponentiation

[emmansun]

References:

• Fast Squaring in the Cyclotomic Subgroup
• dclxvi

// 这个是四次扩域上的平方
// Implicit fp4 squaring for Granger/Scott special squaring in final expo
// fp4e_square takes two fp2e op1, op2 representing the fp4 element 
// op1*z^3 + op2, writes the square to rop1, rop2 representing rop1*z^3 + rop2.
// (op1*z^3 + op2)^2 = (2*op1*op2)*z^3 + (op1^2*xi + op2^2).
void fp4e_square(fp2e_t rop1, fp2e_t rop2, const fp2e_t op1, const fp2e_t op2)
{
  fp2e_t t1, t2;

  fp2e_square(t1, op1);		// t1 = op1^2
  fp2e_square(t2, op2);		// t2 = op2^2

  //fp2e_mul(rop1, op1, op2);    // rop1 = op1*op2
  //fp2e_add(rop1, rop1, rop1);  // rop1 = 2*op1*op2
  fp2e_add(rop1, op1, op2);
  fp2e_short_coeffred(rop1);
  fp2e_square(rop1, rop1);
  fp2e_sub2(rop1, t1);
  fp2e_sub2(rop1, t2);		// rop1 = 2*op1*op2

  fp2e_mulxi(rop2, t1);		// rop2 = op1^2*xi
  fp2e_add2(rop2, t2);		// rop2 = op1^2*xi + op2^2
}

// Special squaring for use on elements in T_6(fp2) (after the
// easy part of the final exponentiation. Used in the hard part 
// of the final exponentiation. Function uses formulas in
// Granger/Scott (PKC2010).
void fp12e_special_square_finexp(fp12e_t rop, const fp12e_t op)
{
  fp2e_t f00, f01, f02, f10, f11, f12;
  fp2e_t t00, t01, t02, t10, t11, t12, t;
  fp6e_t f0, f1;


 // 对应表
 // m_a->m_a <-> x.x
 // m_a->m_b <-> z.x
 // m_a->m_c <-> y.y
 // m_b->m_a <-> y.x
 // m_b->m_b <-> x.y
 // m_b->m_c <-> z.y
  fp4e_square(t11, t00, op->m_a->m_b, op->m_b->m_c); // a.b 对应1-2-4-12扩域上的z.x，b.c对应1-2-4-12扩域上的z.y，所以也就是z^2
  fp4e_square(t12, t01, op->m_b->m_a, op->m_a->m_c); // b.a 对应1-2-4-12扩域上的y.x，a.c对应1-2-4-12扩域上的y.y，所以也就是y^2
  fp4e_square(t02, t10, op->m_a->m_a, op->m_b->m_b);// a.a 对应1-2-4-12扩域上的x.x，b.b对应1-2-4-12扩域上的x.y，所以也就是x^2

 // (t02, t10) = x^2 * xi
  fp2e_mulxi(t, t02); 
  fp2e_set(t02, t10); 
  fp2e_set(t10, t);     

 // (f11, f00) = -2 * z'
 // (f12, f01) = -2 * x'
 // (f02, f10) = -2 * y'
  fp2e_mul_scalar(f00, op->m_b->m_c, -2);  // f00 = -2 * z.y
  fp2e_mul_scalar(f01, op->m_b->m_b, -2); // f01 = -2 * x.y
  fp2e_mul_scalar(f02, op->m_b->m_a, -2); // f02 = -2 * y.x
  fp2e_double(f10, op->m_a->m_c);   // f10 = 2 * y.y
  fp2e_double(f11, op->m_a->m_b);  // f11 = 2 * z.x
  fp2e_double(f12, op->m_a->m_a); // f12 = 2 * x.x

// (t11, t00) = 3 * z^2
// (t12, t01) = 3 * y^2
// (t02, t10) = 3 * x^2 * xi
  fp2e_triple2(t00);  
  fp2e_triple2(t01);
  fp2e_triple2(t02);
  fp2e_triple2(t10);
  fp2e_triple2(t11);
  fp2e_triple2(t12);

 // (f11, f00) = 3 * z^2 - 2 * z'
 // (f12, f01) = 3 * y^2 - 2 * x'
 // (f02, f10) =  3 * x^2 * xi - 2 * y'
  fp2e_add2(f00, t00);
  fp2e_add2(f01, t01);
  fp2e_add2(f02, t02);
  fp2e_add2(f10, t10);
  fp2e_add2(f11, t11);
  fp2e_add2(f12, t12);

 // rop.b.a = f02 = y.x
 // rop.b.b = f01 = x.y
 // rop.b.c = f00 = z.y
 // rop.a.a = f12 = x.x
 // rop.a.b = f11 = z.x
 // rop.a.c = f10 = y.y
  fp6e_set_fp2e(f0, f02, f01, f00);
  fp6e_short_coeffred(f0);
  fp6e_set_fp2e(f1, f12, f11, f10);
  fp6e_short_coeffred(f1);
  fp12e_set_fp6e(rop, f1, f0);
}

[emmansun]

这个对finalExponentiation的性能影响还是挺大的

[emmansun]

finalExponentiation，或者Pairing的结果是否是分圆子群上的元素呢？