Here is a small introduction about quantum computing and how it works. Knowing almost nothing about this part of computer science, I decided to dig into the rabbit hole and read more about it. I’m still very new at this (a noob) so I hope that this article makes some kind of sense. I found that the best way for me to understand a concept is to explain it completely so here it is!

In this article/tutorial, we’re going to discover qubits, why are they different from classical bits, how we can build quantum logic gates, and we’re going to solve a simple problem where quantum computers actually outperform classical computers. Pretty awesome.

Also the quantum world is actually hard to conceptualize usually. I read that our native languages are not fit for it, therefore it’s usually easier to see the math.

Let’s jump into the quantum realm.

Classical bits representation

Classical bits are units that represent 2 states: 0 or 1. It’s the foundation of classical computing.

For the rest of the article, we’re going to use a vector notation:

• bit 0: $\begin{pmatrix}1\\0\end{pmatrix}$ or using the Dirac vector notation: $\ket{0}$
• and bit 1: $\begin{pmatrix}0\\1\end{pmatrix}$ or: $\ket{1}$

A good way to remember which bit is which, you can think of the vector as an array with 1 at the index of the bit.

Now there are 4 operations we can apply to a bit: Identity, Negation, Set 0, Set 1. We can actually use a matrix as a transformation operator.

Identity

f(x) = x

Negation

f(x) = ¬x

Set 0

f(x) = 0

Set 1

f(x) = 1

Multiple bits

To represent multiple classical bits and keep consistency with each of the operations, we can use the tensor product of multiple vectors, each vector representing a single bit.

For 2 bits, it looks like: $\begin{pmatrix}a\\b\end{pmatrix} \otimes \begin{pmatrix}c\\d\end{pmatrix} = \begin{pmatrix}ac\\ad\\bc\\bd\end{pmatrix}$

For 3 bits: $\begin{pmatrix}a\\b\end{pmatrix} \otimes \begin{pmatrix}c\\d\end{pmatrix} \otimes \begin{pmatrix}e\\f\end{pmatrix} = \begin{pmatrix}ace\\acf\\ade\\adf\\bce\\bcf\\bde\\bdf\end{pmatrix}$

Example:

And again we see that $\ket{N}$ is a vector with a 1 at the Nth index.

Multi bits gates

CNOT gate

One common gate is called the CNOT gate. It takes 2 bits in input and “returns” 2 bits. The 1st bit is called the control bit and the 2nd bit is called the target bit. It behaves like this:

• If the control bit is 0, the target bit is left unchanged.
• If the control bit is 1, the target bit is flipped.

It can be represented as a matrix as well: $\begin{pmatrix}1 & 0 & 0 & 0\\0 & 1 & 0 & 0\\0 & 0 & 0 & 1\\0 & 0 & 1 & 0\end{pmatrix}$

We can see the 2 parts in the matrix with $\begin{pmatrix}1 & 0\\0 & 1\end{pmatrix}$ reflecting the identity part (leaving the target unchanged) and the $\begin{pmatrix}0 & 1\\1 & 0\end{pmatrix}$ reflecting the flipping part.

Qubits

Qubits are physical objets (ions, photons, nucleus, electrons, …) that can be used as units of quantum measurement. The difference with classical bits is that qubits can represent states that are neither 0 or 1, but a proportion of both 0 and 1 at the same time.

That weird state is called superposition.

And because we’re in the quantum world, it’s only when we measure a qubit that it collapses with a probability to finally be 0 or 1.

Now the way I understand it is with an example, if you have 3 bits, you can make 8 combinations: 000, 001, 010, 011, 100, 101, 110, and 111. However you’re only getting 1 information out of 3 bits.

In superposition, you can imagine that your qubits are in all those states at the same times, so 3 qubits gets 8 pieces of information, even though you can’t measure that information yet.

Mesuring is what makes all your qubits to collapse to a state, therefore coming back to being classical bits.

The power of qubits is to use superposition so that N Qubits gives you 2^N bit of information only until you measure your results. Exponential information!

When I started reading about Qubits, I couldn’t make sense of it but again, math is the language we need to understand it better.

Representation of Qubits

Qubits can also be written as vectors with each element of the vector a probability, and so a qubit is represented as: $\begin{pmatrix}a\\b\end{pmatrix}$ with ||a||² + ||b||² = 1 with a, b ∈ ℂ and so it has the probability ||a||² to be 0 and ||b||² to be 1.

so it can also look like $\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$ or even $\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$ which works because $\left|\left|\frac{1}{\sqrt{2}}\right|\right|^2 + \left|\left|-\frac{1}{\sqrt{2}}\right|\right|^2 = 1$

Note that in both these examples, the Qubit has 50% chance to collapse to either 0 or 1! When it’s 50/50, it’s called equal superposition.

Our classical bits vectors are just specific qubits, with:

$\ket{0} = \begin{pmatrix}1\\0\end{pmatrix}$ having the probability 100% of being a 0 and $\ket{1} = \begin{pmatrix}0\\1\end{pmatrix}$ having the probability 100% of being a 1

We now have some tools to manipulate our qubits, we can apply a CNOT to a pair of qubits or simply flip a qubit state, whatever that state is and even if we don’t know it, for example:

$\begin{pmatrix}0 & 1\\1 & 0\end{pmatrix} \begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix} = \begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$

Operations on qubits

Note that all operations on qubits have to be reversible. An operation is said to be reversible if knowing the output and the function, you’re able to know or reconstruct the input.

Identity and Negation are reversible, however Set-0 and Set-1 are not. Indeed, both functions are constant and don’t use the input at all, so knowing the result it’s impossible to know what the input was.

For constant operations, like Set-0 and Set-1, we can instead configure a gate using multiple Qubits. We’ll see how this works next in the article.

Bloch sphere

So far, we’ve been using matrixes but it also helps to visualize common Qubits on a sphere. It is called the Bloch sphere

To make it easy, we can consider Qubits with a, b ∈ ℝ and so in that case, we only need a circle (which simplifies the drawings).

We can use the probability to be 0 as the x coordinate and the probability to be 1 as the y coordinate. It looks like this:

We can actually navigate through the circle, for example bit flips:

Hadamard gate

Another gate we need before we dig into the problem we want to solve is the Hadamard gate

The hadamard gate takes a Qubit in equal superposition and turns it to a $\ket{0}$ or a $\ket{1}$. It’s matrix representation looks like: $\begin{pmatrix}\frac{1}{\sqrt{2}} & \frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}} & -\frac{1}{\sqrt{2}}\end{pmatrix}$

and on our Bloch circle:

The Deutsch oracle problem

We’re going to write a system with multiple gates so that we can actually find a result to a question faster than on a classical computer.

The question is: Given an unknown function, is this function constant (Set-0 / Set-1) or is this function variable (Identity / Negation)?

Classical approach

On a classical computer it could look like this:

And in order to know what the function is, we can use 2 queries:

Knowing if the function is constant or variable takes also 2 queries.

Quantum approach

On a quantum computer, remember that our function has to be reversible so we need a way for Set-0 and Set-1 to be reversible as well first.

The way to do it is to actually rewire our system to use multiple qubits for all the operations: Identity, Negation, Set-0, Set-1.

In the real world, note that qubits are resources that are changed, so in this case, we need 2 qubits:

• the input qubit that is left unchanged (in blue)
• the output qubit where the result is written (in red)

It’s intuitive to understand that having the input qubit left unchanged gives us an information for Set-0 and Set-1 that allows us to know what the function is.

Let’s now write all our operations using 2 qubits with the input the MSB (most significant bit) and the output the LSB (least significant bit).

It is normal to be confused by this part at first but hopefully it gets clearer afterwards.

To recap: we want to write all our operations as reversible operations (because this is how quantum computers work) and to do this, we pass an additional “output” qubit as input to our function. This qubit is initialized to $\ket{0}$ and is used to write the result of the operation, while the input qubit on the other hand is left unchanged. We’ll see that using 2 qubits allows us to write reversible operations.

Set-0

In this case, we have nothing to do, the output qubit is already set to 0, and we want to leave the input qubit unchanged, so we can just leave our qubits as they are.

Set-1

This time we have to flip our “output” qubit so it becomes 1, we just added a negation gate.

Identity

In this case we have to use a CNOT gate, with the input as the control bit.

Negation

And negation is pretty much same as identity with the CNOT gate, where we just flip the result by adding a negation gate.

Resolution

Now that we defined all the operations using 2 qubits, how can we know if a function is constant or variable using a single query?

The solution is to:

1. initialize 2 qubits to $\ket{0}$
2. apply a bit flip, so both are now $\ket{1}$
3. apply the Hadamard gate, so both are now in equal superposition: $\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$
4. apply the function f
5. apply the Hadamard gate again
6. measure the result:

• if the function is constant, it should be $\ket{11}$
• if the function is variable, it should be $\ket{01}$

After the first 3 steps, both qubits are always in state: $\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$

Let see what happens from each function:

Set-0

which gives us: $\ket{11}$

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div> 
  <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
    <defs>
      <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
        <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
      </marker>
      <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
       <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
      </marker>
    </defs>
    <circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
    <line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="110" y1="25" x2="155" y2="155" stroke="#00f" stroke-width="2" marker-start="url(#startarrow2)"/>
  </svg>
</div>

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
 <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div> 
 <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
   <defs>
     <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
       <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
     </marker>
     <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
   <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
  </marker>
</defs>
<circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
<line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="110" y1="25" x2="155" y2="155" stroke="#00f" stroke-width="2" marker-start="url(#startarrow2)"/>

Set-1

which gives us: $\ket{11}$

Note that $\begin{pmatrix}0\\-1\end{pmatrix} = \ket{1}$ simply because there is a probability || − 1||² to be 1.

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div> 
  <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
    <defs>
      <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
        <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
      </marker>
      <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
       <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
      </marker>
    </defs>
    <circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
    <line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="110" y1="25" x2="155" y2="155" stroke="#00f" stroke-width="2" marker-start="url(#startarrow2)"/>
  </svg>
</div>

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
 <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div> 
 <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
   <defs>
     <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
       <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
     </marker>
     <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
   <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
  </marker>
</defs>
<circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
<line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="155" y1="155" x2="45" y2="45" stroke="#00f" stroke-width="2" marker-end="url(#endarrow2)"/>
<line x1="45" y1="45" x2="100" y2="175" stroke="#00f" stroke-width="2" marker-end="url(#endarrow2)"/>

Identity

which gives us: $\ket{01}$

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div> 
  <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
    <defs>
      <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
        <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
      </marker>
      <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
       <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
      </marker>
    </defs>
    <circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
    <line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="155" y1="50" x2="155" y2="155" stroke="#00f" stroke-width="2" marker-start="url(#startarrow2)"/>
    <line x1="155" y1="50" x2="175" y2="100" stroke="#00f" stroke-width="2" marker-end="url(#endarrow2)"/>
  </svg>
</div>

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
 <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
 <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
   <defs>
     <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
       <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
     </marker>
     <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
   <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
  </marker>
</defs>
<circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
<line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="110" y1="25" x2="155" y2="155" stroke="#00f" stroke-width="2" marker-start="url(#startarrow2)"/>

Negation

which gives us: $\ket{01}$

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div> 
  <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
    <defs>
      <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
        <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
      </marker>
      <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
       <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
      </marker>
    </defs>
    <circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
    <line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
    <line x1="155" y1="50" x2="155" y2="155" stroke="#00f" stroke-width="2" marker-start="url(#startarrow2)"/>
    <line x1="155" y1="50" x2="175" y2="100" stroke="#00f" stroke-width="2" marker-end="url(#endarrow2)"/>
  </svg>
</div>

  <div style="position: absolute; top: calc(50% - 25px); left: 0; width: 50px; text-align: center">$\begin{pmatrix}-1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: 0; left: calc(25px + 200px / 2); width: 50px; text-align: center">$\begin{pmatrix}0\\1\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(50% - 25px); left: calc(100% - 50px); width: 50px; text-align: center">$\begin{pmatrix}1\\0\end{pmatrix}$</div>
  <div style="position: absolute; top: calc(100% - 50px); left: calc(50% - 25px); width: 50px; text-align: center">$\begin{pmatrix}0\\-1\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 25px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
  <div style="position: absolute; top: 225px; left: 25px; width: 50px; text-align: center">$\begin{pmatrix}-\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
 <div style="position: absolute; top: 225px; left: 225px; width: 50px; text-align: center">$\begin{pmatrix}\frac{1}{\sqrt{2}}\\-\frac{1}{\sqrt{2}}\end{pmatrix}$</div>
 <svg width="200" height="200" style="position: absolute; top: 50px; left: 50px">
   <defs>
     <marker id="startarrow2" markerWidth="5" markerHeight="7" refX="5" refY="3.5" orient="auto">
       <polygon points="5 0, 5 7, 0 3.5" fill="#00f" />
     </marker>
     <marker id="endarrow2" markerWidth="5" markerHeight="7" refX="0" refY="3.5" orient="auto" markerUnits="strokeWidth">
   <polygon points="0 0, 5 3.5, 0 7" fill="#00f" />
  </marker>
</defs>
<circle cx="100" cy="100" r="80" fill="#fff" stroke="#000" stroke-width="2"/>
<line x1="0" y1="100" x2="200" y2="100" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="100" y1="-100" x2="100" y2="200" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="25" y1="25" x2="175" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="175" y1="25" x2="25" y2="175" stroke="#aaa" stroke-dasharray="2" stroke-width="1"/>
<line x1="45" y1="45" x2="155" y2="155" stroke="#00f" stroke-width="2" marker-start="url(#startarrow2)"/>
<line x1="45" y1="45" x2="100" y2="175" stroke="#00f" stroke-width="2" marker-end="url(#endarrow2)"/>

Recap

• Using our system with Set-0 and Set-1 operations, we end up with $\ket{11}$ as the output
• Using our system with Identity and Negation operations, we end up with $\ket{01}$ as the output

For each those cases, it took us 1 single query to the operation as opposed to 2 queries on a classic computer.

The Deutsch–Jozsa algorithm generalizes the idea using functions that take N-bit input and generate single 0 or 1 bit, i.e. f{0, 1}ⁿ → {0, 1}

Decision problem

In short, a decision problem is basically a question regarding some input(s) that is answered by yes or no (true or false).

For example: Given 3 integers x, y and z, is the addition equals to 100?

This decision problem has an effective solution to find the correct answer, no matter the input, it is decidable.

def eq_100(x: int, y: int, z: int) -> bool:
    return (x + y + z) == 100

Ok, that’s not very impressive. As opposed to decidable, some decision problems are said to be non decidable i.e. there is no existing method to guarantee a correct answer for any inputs. This is the case for the halting problem.

The halting problem

The question is: Is it possible for a program to determine if another program given an input will eventually halt (or loop forever).

Note that it’s a decision problem because we have a question regarding some inputs (a program P and an input I) that is answered by yes or no (P will halt or not).

For this problem to be decidable, we need to find a program that finds the correct answer no matter the program it is given. I can tell you the answer right now, it is not decidable, there is no such program.

Alan Turing actually solved it in a clever way by using reductio ad absurdum.

Suppose we have a program R that takes 2 inputs: a program P and another input I, and is able to tell us if P(I) is going to halt or not.

Now, imagine if we create a program R' that gives its 2 inputs to R and:

• if the result of R(P, I) is true i.e. P with I will halt, then it loops forever.
• if the result of R(P, I) is false i.e. P with I will not halt, then it returns true.

something like this:

What happens if give our program R' to R'?

R' will give R' to R and so we have 2 cases:

• if R' is supposed to halt, R will return true, which will make R' loop forever
• if R' is not supposed to halt, R will return false, which will make R' halts and return true

In both cases, we have a paradox: when R tells us that R' is supposed to halt, it loops forever and vice versa.

We started with the assumption that R would be able to tell us whether a program is going to halt or not and we ended up with a paradox, therefore the assumption was bad.

An example with some python

Same story, let’s assume that there is a function is_halting that takes 2 arguments:

• the content of a source file src that is given an input. A source could be: src = "print('args:', arg)"
• another input arg

def is_halting(src: str, arg: Any) -> bool:
    # ...
    return result

When this function is executed, it either returns True or False depending on whether src associated with arg will halt or not.

Now, let’s make a program paradox.py that wraps our function.

Basically, we want to make a program that gives some source code and an argument to is_halting and if it returns True, it loops forever, else -if it is not supposed to halt-, we will print True. It could look like:

# ...
src = sys.argv[1]
arg = sys.argv[2]

result = is_halting(src, arg)
if result == True:
    # loop forever
    while True:
        pass
else:
    print(True)

Finally, let see what happens when we give paradox.py to itself:

• If paradox.py is supposed to be halting, we will loop forever, meaning paradox.py is not halting. Oops.
• If paradox.py is not supposed to halt, we will get an answer, meaning it is actually halting. Oops, I did it again.

We can then conclude that there is function is_halting that can gives a correct result.

Virtual address space

To understand a page fault, it’s necessary to understand how the memory is organized first.

Process memory

When multiple processes run at the same time, we need to ensure they are isolated from one another. We don’t want a process A being able to read or write a memory value from process B.

These addresses also need to be relative and not absolute. Imagine process A requests 4096 bytes so it could use 0x0000 to 0x0fff and process B needs 8192 bytes so from 0x1000 to 0x2fff. Now process A terminates and process C requests 8092 bytes but it can’t fit in process A old space so we now have a tiny gap and we just created memory fragmentation. At some point we may run out of memory.

To deal with these issues, each process has its own address space which depends on the architecture (for ex: 2³² addresses for a 32-bit architecture)

Notes:

• The physical memory doesn’t have to be as big as the address space.
• The OS reserves some of the virtual memory for itself.

Pages

When the CPU needs to access an address, the address is first sent to an MMU (Memory Management Unit) which translates it to a physical address and then sends the address on the memory bus.

The virtual address space is split into fixed memory range called pages. The physical address space is also split into pages called page frames. Usually virtual pages and page frames are the same size.

This allows to load an entire contiguous range of memory instead of a single value.

The OS keeps a mapping between virtual page / page frame that it shares with the MMU in order to translate a virtual address into a physical address. The MMU extracts from the address:

• a page index
• an offset

The MMU can then use the page index to retrieve the page frame from the page table and adds the offset back to get the physical address.

Page table

Page table entry

A page table entry contains more than just the page frame number:

with:

• Present/Absent: If this bit is 0, it means the page isn’t mapped (i.e. a page fault if it is accessed)
• Protection: It reflects the permission of the page, read/write or read only, etc. It can be 1 bit or 3 bits for more granular permissions.
• Modified: If a page is written (as being used), this bit is automatically set to 1. It allows the OS to decide if the page needs to be written to disk or if it’s still clean since the last save.
• Referenced: Sets if a page is referenced for writing or reading. It also helps the OS to decide on which page is less used.
• Caching disabled: Help to decide whether the cache for this page should be disabled.

Mapping

For example: If there are 16 virtual pages to represent address from 0 to 65536. Each address could be made of 4 bits to represent the virtual page index and 12 bits for the offset, which gives us 4096 possible offsets so each page should be 4096. In this case, address 24976 (= 0x6190) can be seen as 4 bits, 0x6, for the virtual page number and 12 bits, 0x190 = 400, for the offset.

Now accessing address 24976 is at virtual page 6. Virtual page 6 starts at address 24576 (4096x6) and the address has an offset of 400 so the MMU translates it to page frame 3 with offset 400 so it becomes 8192 + 400 = 8592

However, if you try accessing virtual address 28772 (virtual page 7), it’s not mapped, in that case it causes the CPU to trap the OS, which is called a page-fault.

Page-fault management

When the OS receives a page-fault from the CPU, it needs to remap the virtual page to a page-frame. It selects a virtual page that is less used (using the Modified and Referenced bits), saves the physical page, retrieves the referenced page (previously unmapped) and loads it into the page frame. Finally, it updates the page table and restarts the CPU instruction that traps.

There are 2 types of page-fault:

• soft: the page can be retrieved from memory cache
• hard: the page needs to be copied from disk (much slower)

Yo everybody, now that we have addition and multiplication, we’re going to need division.

Elliptic curve point addition requires field element addition, substraction, multiplication, square and division. Substraction is very similar to addition and square is very similar to multiplication so I won’t cover them. Modular division is a different story.

So we need to calculate a/b with b ≠ 0. Like in normal division, field division is the inverse of multiplication therefore:

a/b = a ⋅ 1/b = a ⋅ b⁻¹

if we can get the modular inverse of b, we can then multiply it by a.

I’m going to evaluate 2 main methods:

• Fermat little theorem
• Binary GCD

Fermat little theorem

Fermat little theorem demonstrates that when P is prime:

x⁻¹ ≡ x^P − 2 mod  P

Because we already have the multiplication working, we could indeed handle exponentiation. Of course, we don’t have to do P − 2 − 1 multiplications of x as we can store intermediary results and it can be done with some multiplications and squaring to have fast exponentiation.

It’s definitely interesting and multiplications on a 64 bits x86 CPU are quite fast but most of my research showed that GCD is a good way to support multiple platforms.

The intent of this lib is to be part of a blockchain node and I like that you could run a node from a raspberry pi.

It actually seems that Parity uses a similar approach as for now.

Extended euclidean arithmetic

Extended euclidean arithmetic extends the Euclidean arithmetic - duh - so we can compute the modular inverse.

GCD

While reading on how to deal with modular inverse, I found out an interesting method using the GCD (greatest common divisor).

Commonly, the Euclidean algorithm we learn at school looks like this:

And if we want the GCD of two numbers a and b, we just iterate until r_k + 1 = 0 and we have r_k = gcd(a,b)

Example with a = 2023, b = 714:

Thanks and bye.

Bézout’s identity

Ok great but how does it help finding the modular inverse?

Well now we have to use Bézout’s identity, quoting wikipedia:

Let a and b be integers with greatest common divisor d. Then there exist integers x and y such that ax + by = d. More generally, the integers of the form ax + by are exactly the multiples of d. 

It allows us to write this:

ax + by = gcd(a,b)

It becomes useful when a and b are co-prime because in this case:

ax + by = 1

ax = b(−y) + 1

Exactly like we would write an euclidean division: a′ = bq + r with a′ = ax

And we can deduce: ax ≡ 1 mod  b, therefore x is the multiplicative inverse of a mod b, and this is exactly what we want.

Extended Euclidean algorithm

How to calculate x and y?

The Extended Euclidean algorithm is actually about finding Bézout coefficients x and y:

It gives us: gcd(a,b) = r_k = ax_k + by_k

Application for P

If a and b are co-prime, ax ≡ 1 mod  b

Well, our P is prime itself so we already know that a and P are co-prime, i.e. ax ≡ 1 mod  P and we can calculate x thanks to the extended euclidean algo.

In python it looks like:

P = 2**256 - 2**32 - 977

def modinv(a, m):
    r0 = a
    r1 = m
    x = 1
    y = 0
    i = 0
    while r1 != 0:
        q = r0 // r1
        tmp = r0 - q * r1
        tmp2 = x - q * y
        r0 = r1
        r1 = tmp
        x = y
        y = tmp2
        i += 1
    if x < 0:
        x += m
    return x0

Now if we want a/b we can do:

a * modinv(b, P)

Another way is to modify the function so that x0 is initialized with the dividend directly, it works the same way because x0 is not involved in the loop condition and we only subtract values to it.

For now, it’s unclear if it’s better and a simple modinv and multiplication though.

Anyway…

TADAM

Okay, that’s cool but coming back to Rust, we cannot actually use our field element type here because we need signedness and all the operations without a reduction to P.

We need a new type that handles signedness, multiplication, integer division, addition and substraction. This type would need at least 257 bits: 1 bit for the sign, 256 bits to represent numbers close to P.

After dealing with our field element type, this seems easy enough except for the integer division. Indeed, if we want to compute a quotient of two big numbers. There are multiple interesting algorithms to deal with this but a simpler method is to use the binary GCD algorithm.

Please follow me, it’s this way:

Extended Binary GCD

The interesting part of this GCD algorithm is that it allows us to compute the GCD with only divisions by 2, so only right shifts.

The algorithm is described as follow on wikipedia:

Implementation

Taking the definition, it can be written this way:

def bin_gcd(u, v):
    if u == 0:
        return v
    if v == 0:
        return u
    k = 1
    while u != v:
        if u & 0x1 == 0:
            if v & 0x1 != 0:
                # gcd(2u, v) = gcd(u, v)
                u >>= 1
            else:
                # gcd(2u, 2v) = 2 * gcd(u, v)
                u >>= 1
                v >>= 1
                k <<= 1
        elif v & 0x1 == 0:
            # gcd(u, 2v) = gcd(u, v)
            v = v >> 1
        else:
            # gcd(u, v) = gcd(|u - v|, min(u, v))
            if u > v:
                u = (u - v)
            else:
                tmp = u
                u = (v - u)
                v = tmp
    return u * k

Binary mod inverse

Now this is a very basic implementation but in our case we want to integrate x such as ux ≡ 1 mod  P to create a modinv function.

Some interesting things to notice before writing a modinv version:

• the factor k isn’t necessary anymore, as it doesn’t play a role in the calculation, it’s just used to compute the GCD which would be 1 in our case
• all the divisions by 2 are exact

Refactoring our function, we can integrate x and y like we did before:

def div2(x, m):
    if x & 1:
        x += m
    return x >> 1

def modinv(a, m):
    u = a
    v = m
    x = 1
    y = 0
    while u != v:
        if (u & 0x01) == 0x00:
            u >>= 1
            x = div2(x, m)
        elif (v & 0x01) == 0x00:
            v >>= 1
            y = div2(y, m)
        elif u > v:
            u = (u - v) >> 1
            x = div2(x - y, m)
        else:
            v = (v - u) >> 1
            y = div2(y - x, m)
    return y

Note that we have a new div2 function because to compute an exact division, we want the dividend to be even. If it’s is odd, we can just add the -prime- moduli to it. Some possible optimizations will be covered in a next article.

It can be further simplified by just switching u and v when u < v:

def modinv_classic(a, m):
    u = a
    v = m
    x = 1
    y = 0
    while u != 0:
        if (u & 0x01) == 0x00:
            u >>= 1
            x = mdiv2(x, m)
        else:
            if u < v:
                tmp = u
                u = v
                v = tmp
                tmp = x
                x = y
                y = tmp
            u = (u - v) >> 1
            x = div2(x - y, m)
    return y

Let’s rust

Recap

A quick recap, we want to add a modinv function to our field element type.

For this, we need to create a modified binary gcd function that calculates the modular inverse of a value x. This function needs to work with signed numbers. Thus, we need to create a signed integer type.

Scalar

We want to represent numbers on 256 bits + 1 bit for the sign. However as we actually do multiple additions and substraction, it could be interesting to keep a carry and even more interesting to use the same carry-save tricks we use on our field element type.

modinv

This time modinv isn’t optimized specifically for P, instead we can pass a modulo m just so we can re-use the type:

#[derive(Clone, Copy, PartialEq, Eq)]
pub struct Scalar {
    pub d: [u64; 5]
}

impl Scalar {
    // ...
    fn div2_mod(&mut self, m: &Self) {
        if !self.is_even() {
            self.add_assign(m);
        }
        self.div2()
    }

    pub fn modinv(&mut self, m: &Self) {
        let mut b = *m;
        let mut x = Self::from_u64(1u64);
        let mut y = Self::from_u64(0u64);

        while !self.is_zero() {
            if self.is_even() {
                self.div2();
                x.div2_mod(m);
            } else {
                if *self < b {
                    mem::swap(self, &mut b);
                    mem::swap(&mut x, &mut y);
                }
                *self -= b;
                self.div2();
                x -= y;
                x.div2_mod(m);
            }
        }
        y.normalize(m);
        *self = y;
    }
}

It works exactly the same way as the python function. The only trick is to define the div2 function as a shift by 1. I didn’t go much into details about the other functions implementation because it mainly depends on the limb representation of the Scalar but if we forget about carry optimization, it looks like this.

Now for the carry optim version, we could simply implement something similar to our field element, and keep 1 bit per limb for the sign but that’s out of scope.

Field element division

We can simply define our field element inverse:

    pub fn to_scalar(&self) -> Scalar {
        let d0 = (self.d[0] >> 0) | (self.d[1] << 52);
        let d1 = (self.d[1] >> 12) | (self.d[2] << 40);
        let d2 = (self.d[2] >> 24) | (self.d[3] << 28);
        let d3 = (self.d[3] >> 36) | (self.d[4] << 16);

        Scalar::new(0, d3, d2, d1, d0)
    }

    pub fn from_scalar(&mut self, n: &Scalar) {
        let d0 = n.d[0] & 0x000fffffffffffff;
        let d1 = n.d[0] >> 52 | (n.d[1] & 0x000000ffffffffff) << 12;
        let d2 = n.d[1] >> 40 | (n.d[2] & 0x000000000fffffff) << 24;
        let d3 = n.d[2] >> 28 | (n.d[3] & 0x000000000000ffff) << 36;
        let d4 = n.d[3] >> 16;

        self.d = [d0, d1, d2, d3, d4];
    }

    pub fn inverse(&mut self) {
        self.reduce();
        let mut n = self.to_scalar();
        n.modinv(&P);
        self.from_scalar(&n);
    }

and even some syntactic sugar for the division itself:

    pub div_assign(&mut self, rhs: &Self) {
        let n = *rhs;
        n.inverse();
        return self.mul_assign(n);
    }

Alright, time to go to bed everyone.

We saw in the addition part 1 multiple ways to represent our field elements which is key to optimization.

The final version was 4 x u52 and 1 x 48 to store our 256 bits leaving the extra bits for the carry.

pub struct Fe {
    d: [u64; 5]
}

The long multiplication

Algo with 4 x u64

To make it easier we can start working with 4 u64 digits as we did for the addition, so a × b:

I labeled each column with t_i with i := 0 → 7 so it’s easier. And finally we also define c_i with i := 0 → 6 as the carries for each column.

Since we represent a and b with 4 digits, there are now 8 terms in our result:

Now we have an issue here, because most of these terms can exceed 128 bits while we only have a u128. For example t₁ \eqref{eq:t_1} is 64 × 64 + 64 × 64 + 64 → 129, meaning we would need 129 bits.

Fortunately if we go back to our u52 strategy, we don’t have this issue anymore because at worse t₃ \eqref{eq:t_3} is 52 × 52 + 52 × 52 + 52 × 52 + 52 × 52 + 52 → 106 i.e. requires 106 bits

Algo with 4 x u52 + u48

Let’s get back to our u52 baby

Now our beautiful multiplication looks more like:

We can also see our result R as R = R₁ ⋅ 2²⁵⁶ + R₀ with:

• R₀ composed of the digits t₀, t₁, t₂, t₃, t₄
• R₁ composed of the digits t₅, t₆, t₇, t₈, t₉

Now because of the size of R₁, it’s actually more interesting to reduce our result modulo P directly in the multiplication as opposed to our previous add function in which we could store the carry in the extra bits.

The final purpose is to be able to make multiplications of numbers close to P so the carry R₁ won’t fit in our 64-bits reserved space.

Similarly to the addition, we have 3 cases:

1. R₁ = 0 and R₀ < P

R = R₀

2. R₁ = 0, P <  = R₀ < 2²⁵⁶

R = R₀ − P

3. R₁ > 0

R = R₀ + R₁ ⋅ (2²⁵⁶−P)

For more clarity, let’s define P₀ = 2²⁵⁶ − P = 2³² + 977, we can now have:

Cool, now we have new carries to propagate:

It’s actually way easier to see it this way:

NOW IN RUST LADIES AND GENTLEMEN

    pub fn mul(&self, b: &Self) -> Self {
        const M52: u128 = 0x000fffffffffffffu128; // 2^52 - 1
        const M48: u128 = 0x0000ffffffffffffu128; // 2^48 - 1
        const P0: u128 = 0x1000003d1u128; // 2^32 + 977

        let (a0, a1, a2, a3, a4) = (self.d[0], self.d[1], self.d[2], self.d[3], self.d[4]);
        let (b0, b1, b2, b3, b4) = (b.d[0], b.d[1], b.d[2], b.d[3], b.d[4]);

        let (
            mut t0, mut t1, mut t2,
            mut t3, mut t4, mut t5,
            mut t6, mut t7, mut t8
        ): (
            u64, u64, u64,
            u64, u64, u64,
            u64, u64, u64
        );
        let t9: u64;

        let mut t: u128;
        let mut c: u128;

        t = a0 as u128 * b0 as u128;
        t0 = (t & M52) as u64;
        t >>= 52;
        t += a0 as u128 * b1 as u128 +
            a1 as u128 * b0 as u128;
        t1 = (t & M52) as u64;
        t >>= 52;
        t += a0 as u128 * b2 as u128 +
            a1 as u128 * b1 as u128 +
            a2 as u128 * b0 as u128;
        t2 = (t & M52) as u64;
        t >>= 52;
        t += a0 as u128 * b3 as u128 +
            a1 as u128 * b2 as u128 +
            a2 as u128 * b1 as u128 +
            a3 as u128 * b0 as u128;
        t3 = (t & M52) as u64;
        t >>= 52;
        t += a0 as u128 * b4 as u128 +
            a1 as u128 * b3 as u128 +
            a2 as u128 * b2 as u128 +
            a3 as u128 * b1 as u128 +
            a4 as u128 * b0 as u128;
        t4 = (t & M52) as u64;
        t >>= 52;
        c = t4 as u128 >> 48;
        t4 &= M48 as u64;

        t += a1 as u128 * b4 as u128 +
            a2 as u128 * b3 as u128 +
            a3 as u128 * b2 as u128 +
            a4 as u128 * b1 as u128;
        t5 = (t & M52) as u64;
        t >>= 52;
        t5 = t5 << 4 | c as u64;
        c = t5 as u128 >> 52;
        t5 &= M52 as u64;

        t += a2 as u128 * b4 as u128 +
            a3 as u128 * b3 as u128 +
            a4 as u128 * b2 as u128;
        t6 = (t & M52) as u64;
        t >>= 52;
        t6 = t6 << 4 | c as u64;
        c = t6 as u128 >> 52;
        t6 &= M52 as u64;
        
        t += a3 as u128 * b4 as u128 +
            a4 as u128 * b3 as u128;
        t7 = (t & M52) as u64;
        t >>= 52;
        t7 = t7 << 4 | c as u64;
        c = t7 as u128 >> 52;
        t7 &= M52 as u64;

        t += a4 as u128 * b4 as u128;
        t8 = (t & M52) as u64;
        t >>= 52;
        t8 = t8 << 4 | c as u64;
        c = t8 as u128 >> 52;
        t8 &= M52 as u64;

        t9 = (t << 4 | c) as u64;

        // 1st reduction R = R1 + R0 * P0
        t = t0 as u128 + t5 as u128 * P0;
        t0 = (t & M52) as u64;
        t >>= 52;

        t += t1 as u128 + t6 as u128 * P0;
        t1 = (t & M52) as u64;
        t >>= 52;

        t += t2 as u128 + t7 as u128 * P0;
        t2 = (t & M52) as u64;
        t >>= 52;

        t += t3 as u128 + t8 as u128 * P0;
        t3 = (t & M52) as u64;
        t >>= 52;

        t += t4 as u128 + t9 as u128 * P0;
        t4 = (t & M52) as u64;
        t >>= 52;
        c = (t4 >> 48) as u128;
        t4 &= M48 as u64;

        c = c | t << 4;

        // 2nd pass
        t = t0 as u128 + c * P0;
        t0 = (t & M52) as u64;
        t >>= 52;

        t += t1 as u128;
        t1 = (t & M52) as u64;
        t >>= 52;

        t += t2 as u128;
        t2 = (t & M52) as u64;
        t >>= 52;

        t += t3 as u128;
        t3 = (t & M52) as u64;
        t >>= 52;

        t += t4 as u128;
        t4 = (t & M48) as u64;

        Self { d: [t0, t1, t2, t3, t4] }
    }

Finally let’s write a quick test:

    #[test]
    fn it_multiply_field_elements() {
        // A=0xfffffffffffffffffffffffffffffffffffffffffffffffffffffbfefffffc2f = p - 2^42
        // B=0xfffffffffffffffffffffffffffffffffffffffffffffffffffff7fefffffc2f = p - 2^43
        let a = Fe::new(
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xfffffbfefffffc2fu64,
        );
        let b = Fe::new(
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xfffff7fefffffc2fu64,
        );
        let r = a.mul(&b);
        // r = ((p - 2^42) * (p - 2^43)) % p
        let expected = Fe::new(
            0x0000000000000000u64,
            0x0000000000000000u64,
            0x0000000000200000u64,
            0x0000000000000000u64,
        );
        assert_eq!(r, expected);
    }

and we now have a multiplication.

JUST LIKE THAT

Verbose, but it works.

Optimizations

Carry-saver

Okay, now let’s just think about it, we actually don’t have to propate the carry after the 2nd pass. Same as the addition, we can just use our carry-save storage.

A very simple way to prove it is to work with the worst case scenario: (P−1)(P−1)

After the 1st pass, it gives us a result R0 = 1000003d0fffffffffffffffffffffffffffffffffffffffffffffffefffff85dfff16f60₁₆ Or R0 = 2²⁵⁶ × 1000003d0₁₆ + fffffffffffffffffffffffffffffffffffffffffffffffefffff85dfff16f60₁₆

Now applying the 2nd pass:

1000003d0₁₆ × (2³²+977) is 65 bits so our first digit needs 66 bits. We only have 12 extra bits on the 1st digit d₀, so we need to propagate the carry on the 2nd digit d₁

And we don’t have to go further for now, we can still work with few operations before we overflow our 320 bits storage.

Let’s remove the last carry propagation on t3 and t4:

        // ...
        // 2nd pass
        t = t0 as u128 + c * P0;
        t0 = (t & M52) as u64;
        t >>= 52;

        t += t1 as u128;
        t1 = (t & M52) as u64;

        Self { d: [t0, t1, t2, t3, t4] }

Combine operations

Another optimization would be to combine the operations on t₀, we have:

        // 1st pass
        t = t0 as u128 + t5 as u128 * P0;
        t0 = (t & M52) as u64;
        // ...
        // 2nd pass
        t = t0 as u128 + c * P0;
        t0 = (t & M52) as u64;

Could be nice to combine those just so we save some instructions, better to do t₀ + (a+b)P₀ than t₀ + aP₀ + bP₀

We can use the fact that we don’t need to propagate the carry over t₃ and t₄ on the 2nd pass. Therefore, we can work with them first.

Final version

    pub fn mul(&mut self, b: &Self) -> Self {
        const M52: u128 = 0x000fffffffffffffu128; // 2^52 - 1
        const M48: u64 = 0x0000ffffffffffffu64; // 2^48 - 1
        const P0: u128 = 0x1000003d1u128; // 2^32 + 977
        const P1: u128 = 0x1000003d10u128; // 2^32 + 977 << 4

        let (a0, a1, a2, a3, a4) = (
            self.d[0] as u128, self.d[1] as u128, self.d[2] as u128,
            self.d[3] as u128, self.d[4] as u128
        );
        let (b0, b1, b2, b3, b4) = (
            b.d[0] as u128, b.d[1] as u128, b.d[2] as u128,
            b.d[3] as u128, b.d[4] as u128
        );
        let mut tx: u128;
        let mut cx: u128;
        let (t0, t1, t2, mut t3, mut t4, mut t5): (u64, u64, u64, u64, u64, u128);
        let c4: u64;

        // t3
        tx = a0 * b3 + a1 * b2 + a2 * b1 + a3 * b0;
        // t8
        cx = a4 * b4;
        // t3 + t8 * P1
        tx += (cx & M52) * P1;
        cx >>= 52;
        t3 = (tx & M52) as u64;
        tx >>= 52;

        // t4
        tx += a0 * b4 + a1 * b3 + a2 * b2 + a3 * b1 + a4 * b0;
        // (c3 + t4) + (c8 + t9) * P1
        tx += cx * P1;
        t4 = (tx & M52) as u64;
        tx >>= 52;
        c4 = t4 >> 48;
        t4 &= M48;

        // t5
        cx = tx + a1 * b4 + a2 * b3 + a3 * b2 + a4 * b1;
        // t0
        tx = a0 * b0;
        t5 = cx & M52;
        cx >>= 52;
        t5 = (t5 << 4) | c4 as u128;
        // c9 + t0 + (c4 + t5) * P0
        tx += t5 * P0;
        t0 = (tx & M52) as u64;
        tx >>= 52;

        // t1
        tx += a0 * b1 + a1 * b0;
        // t6
        cx += a2 * b4 + a3 * b3 + a4 * b2;
        // c0 + t1 + (c5 + t6) * P1
        tx += (cx & M52) * P1;
        cx >>= 52;
        t1 = (tx & M52) as u64;
        tx >>= 52;

        // t2
        tx += a0 * b2 + a1 * b1 + a2 * b0;
        // t7
        cx += a3 * b4 + a4 * b3;
        // t2 + t7 * P1
        tx += (cx & M52) * P1;
        cx >>= 52;
        t2 = (tx & M52) as u64;
        tx >>= 52;

        // t23
        tx += cx * P1 + t3 as u128;
        t3 = (tx & M52) as u64;
        tx >>= 52;
        // t24
        tx += t4 as u128;
        t4 = tx as u64;

        Self { d: [t0, t1, t2, t3, t4] }
    }

As I started to get interested in cryptography, I quickly tried to implement private key signing and verification.

One of the fundamentals is to use finite fields with a big prime P as the order of the field.

As I read mostly about secp256k1, I’ll deal with:

P = 2²⁵⁶ − 2³² − 2⁹ − 2⁸ − 2⁷ − 2⁶ − 2⁴ − 1

usually shortened as:

P = 2²⁵⁶ − 2³² − 977

Making a poc in python is quite easy:

P = 2**256 - 2**32 - 977

class Fe:
    def __init__(self, val):
        self.val = val

    def __add__(self, b):
        return self.__class__((self.val + b.val) % P)

    def __mul__(self, b):
        return self.__class__((self.val * b.val) % P)

Here self.val, b and P are supposedly close to 2²⁵⁶ which is fine because Python already supports integers of arbitrary size. Python actually mallocs an array of uint32_t and splits the original number in power of 2³⁰ when dealing with big numbers.

Field element representation in Rust

The common approach

In C or Rust, we could imagine doing the same thing aka (a+b) mod  P but then you’d have to find an integer type that fits at least 256 bits.

Is that enough?

Not really, if you add two u256 numbers, the maximum result is 2²⁵⁶ − 1 + 2²⁵⁶ − 1, i.e. 2²⁵⁷ − 2 so we need to handle an extra carry bit.

If we want to multiply two u256 numbers, the maximum result is (2²⁵⁶−1)(2²⁵⁶−1) i.e. 2⁵¹² − 2²⁵⁷ + 1 so now we also need a u512 type.

// after implementing u256 and u512

const P: u256 = (2u512.pow(256) - 0x100000000u256 - 0x3d1u256) as u256;

struct Fe {
    val: u256
}

impl Fe {
    fn new(val: u256) -> Self {
        Self { val }
    }

    fn add(&self, b: &Self) -> Self {
        let tmp: u512 = (self.val as u512 + b.val as u512) % (P as u512);

        Self { val: tmp as u256 }
    }

    fn mul(&self, b: &Self) -> Self {
        let tmp: u512 = (a as u512 * b.val as u512) % (P as u512);

        Self { val: tmp as u256 }
    }
}

1. We had to create 2 new integer types with one serving only as a temporary carry storage
2. There is a lot of waste for the addition as it needs at max 257 bits, meaning meaning 255 bits are just zeros and most generally all the explicit casts waste memory.

Integer representation

We haven’t talked yet about how to represent a u256, but since Rust supports u128, u64, u32, u16 and u8, we could use an array of “digits” to represent our number, just like Python does.

As we want to be efficient and limit the number of operations, 2 x u128 could be a good choice except we would still need to handle a carry when adding or multiplying the high or low digits of 2 u256.

For now, a better choice is to actually use 4 x u64 as it limits the number of instructions and we can use u128 as a temporary storage.

Finally, we would benefit from the x86_64 imul instruction instruction that can do multiplication of 2 u64 as 64x64 -> 128.

pub struct Fe {
    d: [u64; 4]
}

impl Fe {
    pub fn new(d3: u64, d2: u64, d1: u64, d0: u64) -> Self {
        Self { d: [d0, d1, d2, d3] }
    }
}

Addition v1

Ok, let’s now define an add method (I’m not bringing additional traits yet):

    pub fn add(&self, b: &Self) -> Self {
        let (d0, d1, d2, d3): (u64, u64, u64, u64);
        let mut tmp: u128;

        tmp = self.d[0] as u128 + b.d[0] as u128;
        d0 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[1] as u128 + b.d[1] as u128;
        d1 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[2] as u128 + b.d[2] as u128;
        d2 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[3] as u128 + b.d[3] as u128;
        d3 = tmp as u64;
        tmp >>= 64;
        // tmp here holds the final carry

        Self { d: [d0, d1, d2, d3] }
    }

Ok, so far we can make an addition of two u256, but we haven’t dealt with the modulo part or the final carry.

Actually we can define the result of A + B as:

A + B = R₁ ⋅ 2²⁵⁶ + R₀

with: R₀ < 2²⁵⁶ and R₁ ∈ (0,1)

Note: It helps to pick this form since our storage is 256 bits.

This gives us 3 cases:

R₁ = 0, R₀ < P (i.e. R < P)

The result is already less than P so nothing to do:

R₁ = 0, R₀ ≥ P (i.e. P ≤ R < 2²⁵⁶)

Here the result hasn’t overflowed 2²⁵⁶.

It’s easy to prove:

R₁ = 1 (i.e. R ≥ 2²⁵⁶)

Here the result has overflowed. In this case:

And here is the proof:

yet:

And from \eqref{eq:1}

2²⁵⁶ mod  P = 2²⁵⁶ − P

so:

Addition v2

Let’s add the modulo part in the addition:

    pub fn add(&self, b: &Self) -> Self {
        let (mut d0, mut d1, mut d2, mut d3): (u64, u64, u64, u64);
        let mut tmp: u128;

        tmp = self.d[0] as u128 + b.d[0] as u128;
        d0 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[1] as u128 + b.d[1] as u128;
        d1 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[2] as u128 + b.d[2] as u128;
        d2 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[3] as u128 + b.d[3] as u128;
        d3 = tmp as u64;
        tmp >>= 64;

        // N = [d0, d1, d2, d3]
        // tmp is the extra carry
        if tmp > 0 {
            // R = N + 2**32 + 977
            tmp = d0 as u128 + 0x1000003d1u128;
            d0 = tmp as u64;
            tmp >>= 64;
            tmp += d1 as u128;
            d1 = tmp as u64;
            tmp >>= 64;
            tmp += d2 as u128;
            d2 = tmp as u64;
            tmp >>= 64;
            tmp += d3 as u128;
            d3 = tmp as u64;
        } else if d3 == 0xffffffffffffffffu64 &&
                  d2 == 0xffffffffffffffffu64 &&
                  d1 == 0xffffffffffffffffu64 &&
                  d0 >= 0xfffffffefffffc2fu64 {
            // P <= R < 2^256
            // R -= P
            d0 -= 0xfffffffefffffc2fu64;
            d1 = 0;
            d2 = 0;
            d3 = 0;
        }

        Self { d: [d0, d1, d2, d3] }
    }

Addition v3

Now that works well but usually we have to deal with multiple additions in a row so this is not super optimized. Suppose we have ((((a+b mod  P)+c) mod  P)+d) mod  P, it would be more efficient to do (a+b+c+d) mod  P

In order to do this, we’d have to store the carry for later.

pub struct Fe {
    d: [u64; 4], // digits
    c: u64 // carry
}

With a 64 bits for the carry, it lets us do max 63 additions before we have to reduce the result, so let’s write a reduce function and the updated add version:

    pub fn add(&self, b: &Self) -> Self {
        let (d0, d1, d2, d3): (u64, u64, u64, u64);
        let mut tmp: u128;

        tmp = self.d[0] as u128 + b.d[0] as u128;
        d0 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[1] as u128 + b.d[1] as u128;
        d1 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[2] as u128 + b.d[2] as u128;
        d2 = tmp as u64;
        tmp >>= 64;
        tmp += self.d[3] as u128 + b.d[3] as u128;
        d3 = tmp as u64;
        tmp >>= 64;

        Self { d: [d0, d1, d2, d3], c: self.c + b.c + tmp as u64 }
    }

    pub fn reduce(&mut self) {
        let (mut d0, mut d1, mut d2, mut d3) = (self.d[0], self.d[1], self.d[2], self.d[3]);
        let mut c: u128 = self.c as u128;
        let mut tmp: u128;

        if c > 0 {
            tmp = d0 as u128 + c * 0x1000003d1u128;
            d0 = tmp as u64;
            tmp >>= 64;
            tmp += d1 as u128;
            d1 = tmp as u64;
            tmp >>= 64;
            tmp += d2 as u128;
            d2 = tmp as u64;
            tmp >>= 64;
            tmp += d3 as u128;
            d3 = tmp as u64;
            tmp >>= 64;
            c = tmp;
            if c > 0 { // 2nd pass
                tmp = d0 as u128 + c * 0x1000003d1u128;
                d0 = tmp as u64;
                tmp >>= 64;
                tmp += d1 as u128;
                d1 = tmp as u64;
                tmp >>= 64;
                tmp += d2 as u128;
                d2 = tmp as u64;
                tmp >>= 64;
                tmp += d3 as u128;
                d3 = tmp as u64;
            }
        } else if d3 == 0xffffffffffffffffu64 &&
                  d2 == 0xffffffffffffffffu64 &&
                  d1 == 0xffffffffffffffffu64 &&
                  d0 >= 0xfffffffefffffc2fu64 {
            d0 -= 0xfffffffefffffc2fu64;
            d1 = 0;
            d2 = 0;
            d3 = 0;
        }

        self.d = [d0, d1, d2, d3];
        self.c = 0;
    }

Now we can make several additions, store the carries in c and finally reduce to P at the very end.

Let’s also write a test:

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn it_adds_field_elements_carry() {
        let a = Fe::new(
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xfffffffefffffc2eu64,
        ); // P - 1
        let b = &a;
        let r = a.add(b);
        let rb = &r;
        let mut r2 = r.add(rb);
        // r2 = ((p - 1 + p - 1) + (p - 1 + p - 1))
        // we overflow p 3 times, so the carry should be 3
        assert_eq!(r2.c, 3);
        r2.reduce();
        // r2 = ((p - 1 + p - 1) + (p - 1 + p - 1)) % p
        let expected = Fe::new(
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xffffffffffffffffu64,
            0xfffffffefffffc2bu64,
        );
        assert_eq!(r2, expected);
    }

Addition v4

Another optimization would be to use a carry save strategy. If we look at the addition, we propagate the carry on each digit. It’s actually possible to reduce the storage size of each digit in order to keep bits for the carry.

I actually discovered it by looking at the bitcoin implementation and by asking the question directly to Pieter Wuille, the author of the libsecp256k1 used in bitcoin.

How it works

Instead of using 4 x u64 + a u64 carry, we could use 4 x u52 + 1 x u48 to represent our number (physically stored as 5 x u64) while keeping extra bits for the carry.

Now we don’t have to propagate the carry anymore in the addition, it will be stored in the extra bits, as we have 12 extra bits for the 4 first digits and 16 bits for the last.

It allows us to rewrite the addition this way:

    pub fn add(&self, b: &Self) -> Self {
        let (d0, d1, d2, d3, d4): (u64, u64, u64, u64, u64);

        d0 = self.d[0] + b.d[0];
        d1 = self.d[1] + b.d[1];
        d2 = self.d[2] + b.d[2];
        d3 = self.d[3] + b.d[3];
        d4 = self.d[3] + b.d[3];

        Self { d: [d0, d1, d2, d3, d4] }
    }

We now have a 5th digit but it’s pretty easy with less instructions. We can actually do 12 additions before one of the smallest carries overflows which is plenty enough.

Finally, we also have to rewrite our reduce function and optionally update our new method so it can easily transform 4 x u64 to 4 x u52 + 1 x u48, here is the final implementation:

impl Fe {
    pub fn new(d3: u64, d2: u64, d1: u64, d0: u64) -> Self {
        let (t0, t1, t2, t3): (u64, u64, u64, u64);
        let t4: u64;

        t0 = d0 & 0x000fffffffffffff;
        t1 = d0 >> 52 | (d1 & 0x000000ffffffffff) << 12; // 12 + 40
        t2 = d1 >> 40 | (d2 & 0x000000000fffffff) << 24; // 24 + 28
        t3 = d2 >> 28 | (d3 & 0x000000000000ffff) << 36; // 36 + 16
        t4 = d3 >> 16; // 48

        Self { d: [t0, t1, t2, t3, t4] }
    }

    pub fn add(&self, b: &Self) -> Self {
        let (d0, d1, d2, d3, d4): (u64, u64, u64, u64, u64);

        d0 = self.d[0] + b.d[0];
        d1 = self.d[1] + b.d[1];
        d2 = self.d[2] + b.d[2];
        d3 = self.d[3] + b.d[3];
        d4 = self.d[4] + b.d[4];

        Self { d: [d0, d1, d2, d3, d4] }
    }

    pub fn reduce(&mut self) {
        let (mut d0, mut d1, mut d2, mut d3, mut d4) = (self.d[0], self.d[1], self.d[2], self.d[3], self.d[4]);
        let mut c: u64;

        c = d4 >> 48;
        d4 &= 0x0000ffffffffffffu64;
        d0 += c * 0x1000003d1u64;
        d1 += d0 >> 52;
        d0 &= 0x000fffffffffffffu64;
        d2 += d1 >> 52;
        d1 &= 0x000fffffffffffffu64;
        d3 += d2 >> 52;
        d2 &= 0x000fffffffffffffu64;
        d4 += d3 >> 52;
        d3 &= 0x000fffffffffffffu64;

        if d4 > M48 || (d4 == M48 && d3 | d2 | d1 == M52 && d0 >= 0xffffefffffc2f) {
            if d4 > M48 {
                c = d4 >> 48;
            } else {
                c = 1
            }
            d4 &= 0x0000ffffffffffffu64;
            d0 += c * 0x1000003d1u64;
            d1 += d0 >> 52;
            d0 &= 0x000fffffffffffffu64;
            d2 += d1 >> 52;
            d1 &= 0x000fffffffffffffu64;
            d3 += d2 >> 52;
            d2 &= 0x000fffffffffffffu64;
            d4 += d3 >> 52;
            d3 &= 0x000fffffffffffffu64;
            d4 &= M48;
        }

        self.d = [d0, d1, d2, d3, d4];
    }
}

We also dropped the case P ≤ R < 2²⁵⁶ because now this is handled by the carry itself.

The tradeoff comes with the multiplication / square operations because as explained by Pieter, we would have to do more digit operations in the multiplication Fe x Fe.

I still need to benchmark it and see if it’s worth it because Elliptic curve point addition contains almost as many field element additions as field element multiplications.

Why not 2 x u104 + 1 x 48?

In the multiplication typically, we need to handle the carries differently. Using a long multiplication, we’d have to multiply 2 u104 resulting in 208 bits.

Anyway, see ya my bros ✌️

def hey(version):
    print("Just a tiny blog {:.1f}".format(version))

a + b (mod  P)