p = 2^255 - 19
altbn_P = 21888242871839275222246405745257275088548364400416034343698204186575808495617
pused by ED25519 is different and greater in value than
altbn_P. Hence, we must define an approach that allows us to perform ED25519 operations while keeping all numbers within the snark prime field.
altbn_Pbut the entire array could represent larger numbers. In fact, we can choose any base
b < altbn_P
pand it can be represented in a max of 255 bits. In base
2^51, we need a max of 5 elements to represent all ed25519 numbers. The number of constraints is the same when multiplying
2^51. Hence, it makes sense to use the largest base possible.
2^51. (although base
2^85is even better). Note that
2^51 < altbn_Pwhich is necessary.
2^51inside circom, so that we can start doing ED25519 maths.
xcan be of arbitrary size.
(x3,y3)satisfy these two polynomials, we can say that the third point is the sum of the first two points.