chore: Native curve audit by federicobarbacovi · Pull Request #20936 · AztecProtocol/aztec-packages

federicobarbacovi · 2026-02-27T07:25:05Z

🧾 Audit Context

First part of the audit of ecc/curves. This PR is concerned with curve fields: we restructure testing, standardise struct format, and add some more constant checks.

🛠️ Changes Made

Refactor field params structs so that they all have the same format
Refactor testing: move some testing to generic field testing, standardise testing for all field params struct, add tests for constants

✅ Checklist

Audited all methods of the relevant module/class
Audited the interface of the module/class with other (relevant) components
Documented existing functionality and any changes made (as per Doxygen requirements)
Resolved and/or closed all issues/TODOs pertaining to the audited files
Confirmed and documented any security or other issues found (if applicable)
Verified that tests cover all critical paths (and added tests if necessary)
Updated audit tracking for the files audited (check the start of each file you audited)

📌 Notes for Reviewers

federicobarbacovi · 2026-02-27T07:25:37Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/constants.test.cpp

 TEST(FqConstants, RInv)
 {
    // r_inv = -q^{-1} mod 2^64
-    uint512_t r{ 0, 1 };


This was using r = 1 << 256

federicobarbacovi · 2026-02-27T07:26:09Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq2.hpp

+    static constexpr fq frobenius_on_twisted_curve_y_1{
        0xa1d77ce45ffe77c7UL, 0x07affd117826d1dbUL, 0x6d16bd27bb7edc6bUL, 0x2c87200285defeccUL
    };
-    static constexpr fq twist_cube_root_0{


federicobarbacovi · 2026-02-27T07:26:33Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq2.hpp

    static constexpr fq twist_coeff_b_1{
        0x38e7ecccd1dcff67UL, 0x65f0b37d93ce0d3eUL, 0xd749d0dd22ac00aaUL, 0x0141b9ce4a688d4dUL
    };
-    static constexpr fq twist_mul_by_q_x_0{


Changed names to make them more descriptive

…; mark from_montgomery_form as const in fq12

…ore general testing

…ield params

federicobarbacovi · 2026-02-27T20:19:17Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/bn254.hpp

@@ -25,18 +25,16 @@ class BN254 {
    using TargetField = bb::fq12;

    static constexpr const char* name = "BN254";


Old issue, closed

federicobarbacovi · 2026-02-27T20:20:41Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq.hpp

+    static constexpr uint64_t primitive_root_3 = 0UL;
+
+    // Coset generators in Montgomery form for R=2^256 mod Modulus. Used in FFT-based proving systems
+    static constexpr uint64_t coset_generator_0 = 0x7a17caa950ad28d7ULL;


We need only the first coset generator, I removed the other ones from all the fields

federicobarbacovi · 2026-02-27T20:21:18Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq.test.cpp

-    constexpr fq b = uint256_t{ 0x744fc10aec23e56aUL, 0x5dea4788a3b936a6UL, 0xa0a89f4a8af01df1UL, 0x72ae28836807df3UL };
-    constexpr fq expected =
-        uint256_t{ 0x6c0a789c0028fd09UL, 0xca9520d84c684efaUL, 0xcbf3f7b023a852b4UL, 0x1b2e4dac41400621UL };
+    constexpr fq a{ 0x83aa80986c4f06f8, 0xbd01cce5e3b3afc3, 0x1cba208cb70aa13b, 0x2a582eb35a932e0d };


Prior to this change the elements were in non-Montgomery form. I changed them so that we use Montgomery form in all tests

federicobarbacovi · 2026-02-27T20:21:35Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq.test.cpp

    constexpr fq inv = a.invert();
    // Verify a * a^-1 = 1
    static_assert(a * inv == fq::one());
 }


Moved to generic field testing

federicobarbacovi · 2026-02-27T20:26:06Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fr.test.cpp

    k1.self_to_montgomery_form();
    k2.self_to_montgomery_form();

+    EXPECT_LT(uint256_t(k1).get_msb(), 128);


They were present in other tests so I added them here as well

federicobarbacovi · 2026-02-27T20:27:27Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq6.test.cpp

@@ -3,75 +3,6 @@

 using namespace bb;


I don't see the value of these tests

federicobarbacovi · 2026-02-27T20:29:10Z

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq12.test.cpp

@@ -403,22 +307,6 @@ TEST(fq12, SqrCheckAgainstConstants)
    EXPECT_EQ(result, expected);
 }


Inverse moved to generic field testing; unitary inverse is below

federicobarbacovi · 2026-02-27T20:56:20Z

barretenberg/cpp/src/barretenberg/ecc/fields/general_field.test.cpp


    EXPECT_EQ(result, expected);
 }
+


Add some generic testing

federicobarbacovi · 2026-02-27T20:56:51Z

barretenberg/cpp/src/barretenberg/ecc/fields/field_docs.md

 Prime field documentation    {#field_docs}
 ===
-Barretenberg has its own implementation of finite field arithmetic. The implementation targets 254-bit (bn254, grumpkin) and 256-bit (secp256k1, secp256r1) fields. Internally the field is represented as a little-endian C-array of 4 uint64_t limbs. For 254-bit fields, the internal representation must be in the range \f$[0, 2p)\f$ (which we refer to as the _coarse representation_), while for 256-bit fields the internal representation is an arbitrary `uint256_t`.
+Barretenberg has its own implementation of finite field arithmetic. The implementation targets 254-bit (bn254, grumpkin) and 256-bit (secp256k1, secp256r1) fields. Internally the field is represented as a little-endian C-array of 4 uint64_t limbs. For 254-bit fields, the internal representation must be in the range $[0, 2p)$ (which we refer to as the _coarse representation_), while for 256-bit fields the internal representation is an arbitrary `uint256_t`.


Changed formatting to markdown math instead of Doxygen math

federicobarbacovi · 2026-02-27T20:57:16Z

barretenberg/cpp/src/barretenberg/ecc/fields/field_declarations.hpp

+            Params::coset_generator_3,
        };
 #else
        const field result{


Removed some unused code

federicobarbacovi · 2026-02-27T20:57:38Z

barretenberg/cpp/src/barretenberg/ecc/fields/field12.hpp

    }

-    constexpr field12 from_montgomery_form()
+    constexpr field12 from_montgomery_form() const


Needed for uniform testing

federicobarbacovi commented Feb 27, 2026

View reviewed changes

federicobarbacovi added 16 commits February 27, 2026 20:13

Improve constant testing + formatting changes

72aad9a

Improve testing + remove old code about coset generators

c694613

Re order constants

c0b0385

Fr

da7ae50

Fq (bn254)

5e4533e

Fr tests

ff5f567

Move some testing to general field testing; standardise fq/fr testing…

380fb13

…; mark from_montgomery_form as const in fq12

Fix python script + Fq2 testing + Fq2 (remove cube root of unity) + M…

26208ac

…ore general testing

Improve naming

32a3015

Fq6

85015d2

Fq12

02ac6bc

BN254

f818714

Grumpkin

76595b6

Fixes

33ddf6a

Uniform tests for curve field parameters + standardize structure of f…

f2b70cf

…ield params

Final stuff

a003ee8

federicobarbacovi force-pushed the fb/native_curve_audit branch from f7702a3 to a003ee8 Compare February 27, 2026 20:16

federicobarbacovi commented Feb 27, 2026

View reviewed changes

Fixes + add test for generator and coeffs

d561a9b

federicobarbacovi marked this pull request as ready for review February 27, 2026 21:01

federicobarbacovi self-assigned this Feb 27, 2026

federicobarbacovi requested a review from notnotraju February 27, 2026 21:40

		@@ -25,18 +25,16 @@ class BN254 {
		using TargetField = bb::fq12;

		static constexpr const char* name = "BN254";

		@@ -403,22 +307,6 @@ TEST(fq12, SqrCheckAgainstConstants)
		EXPECT_EQ(result, expected);
		}

Conversation

federicobarbacovi commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧾 Audit Context

🛠️ Changes Made

✅ Checklist

📌 Notes for Reviewers

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

federicobarbacovi commented Feb 27, 2026 •

edited

Loading