spec: ECSM affine ecall variant - #932
Open
nicole-graus wants to merge 2 commits into
Open
Conversation
Kimi Code ReviewAutomated review by Kimi (Moonshot AI) |
Codex Code ReviewNo issues found in the specified PR diff. The spec structure validator also passes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Specs the affine ECSM variant added in #879.
An
is_affineselector lets one chip serve both ecalls: it picks the ECALL number the chip answers to, and gates theyGread (addr_xG + 32, atts) and theyRwrite (addr_xR + 32, atts + 3). Everything else is shared. Two checks come with it — theyGread pins the input point's parity, which becomes observable onceyRis published, andyR < pforces the output canonical.ECSM goes 37 → 42 variables, 708 → 757 columns.
Numbering change: the ecall number is now
-11 - 2·id - is_affine, so secp256r1 moves from -12 to -13. #879 ships affine secp256k1 at -12, and secp256r1 has no implementation.Not spec'd: #879's address-limb LT bounds. Those close a gap in
ecsm.rs, which builds dword bases in the low limb only; the spec derives every address with a full 64-bitADD.