Feat/ecsm update

crypto/ecsm/src/lib.rs

@@ -2,7 +2,7 @@
 //!
 //! This crate is shared by the executor (which needs `k·G`'s x-coordinate to write back
 //! to guest memory) and the prover (which replays the full double-and-add sequence to
-//! fill the ECSM / ECDAS / EC_SCALAR trace witnesses). Both entry points compute the same
+//! fill the ECSM / ECDAS trace witnesses). Both entry points compute the same
 //! `k·G` over the audited `k256` curve arithmetic — the executor via `k256`'s scalar
 //! multiplication, the prover via a projective double-and-add replay — so the x-coordinate
 //! they write/prove agrees. It is also independent of the `yG` root: both recover the same

crypto/ecsm/src/witness.rs

@@ -38,6 +38,8 @@ pub struct EcsmWitness {
     pub q1: [u8; 33],
     /// carries for the `yG` relation
     pub c1: [i64; 64],
+    /// `(xG - p) mod 2^256`
+    pub x_g_sub_p: [u8; 32],
     /// `(k - N) mod 2^256`
     pub k_sub_n: [u8; 32],
     /// `(xR - p) mod 2^256`
@@ -314,6 +316,7 @@ pub fn compute_witness(k_le: &[u8; 32], xg_le: &[u8; 32]) -> Result<EcsmWitness,
     // --- scalar range data ---
     let len_k = crate::curve::msb_position(&k) as u8;
     let two_256 = BigUint::from(1u8) << 256u32;
+    let x_g_sub_p = to_le_32(&((&two_256 + &g.x) - p())); // xG < p
     let k_sub_n = to_le_32(&((&two_256 + &k) - n())); // k < N
 
     // --- double/add replay ---
@@ -336,6 +339,7 @@ pub fn compute_witness(k_le: &[u8; 32], xg_le: &[u8; 32]) -> Result<EcsmWitness,
         c0,
         q1: q1_b,
         c1,
+        x_g_sub_p,
         k_sub_n,
         x_r_sub_p,
         len_k,

executor/src/vm/instruction/execution.rs

@@ -412,11 +412,13 @@ impl Instruction {
                         {
                             return Err(ExecutionError::EcsmAddressOverflow);
                         }
-                        // xG and k are both read at the same proof timestamp, so their
-                        // 32-byte ranges must be disjoint or the trace is unprovable
-                        // (MEMW orders accesses per address by strictly increasing
-                        // timestamp). xR may alias either: its accesses are offset to
-                        // later timestamps.
+                        // xG and k must occupy disjoint 32-byte regions. The trace builder
+                        // reads each operand as unaligned doubleword MEMW accesses (xG at T,
+                        // k at T+1); if the regions overlap, the same address is touched at
+                        // both timestamps and the MEMW consistency argument can't prove the
+                        // access chain. The loaded values would still be well-defined — this
+                        // guard is about trace provability, not correctness of the multiply.
+                        // xR may alias either: its accesses are at a later timestamp.
                         if addr_xg.abs_diff(addr_k) < 32 {
                             return Err(ExecutionError::EcsmOperandOverlap);
                         }

prover/src/lib.rs

@@ -52,9 +52,9 @@ use crate::tables::trace_builder::count_table_lengths;
 use crate::tables::types::BusId;
 use crate::test_utils::{
     E, F, VmAir, create_bitwise_air, create_branch_air, create_bytewise_air, create_commit_air,
-    create_cpu_air, create_cpu32_air, create_decode_air, create_dvrm_air, create_ec_scalar_air,
-    create_ecdas_air, create_ecsm_air, create_eq_air, create_halt_air, create_keccak_air,
-    create_keccak_rc_air, create_keccak_rnd_air, create_load_air, create_lt_air, create_memw_air,
+    create_cpu_air, create_cpu32_air, create_decode_air, create_dvrm_air, create_ecdas_air,
+    create_ecsm_air, create_eq_air, create_halt_air, create_keccak_air, create_keccak_rc_air,
+    create_keccak_rnd_air, create_load_air, create_lt_air, create_memw_air,
     create_memw_aligned_air, create_memw_register_air, create_mul_air, create_page_air,
     create_register_air, create_shift_air, create_store_air,
 };
@@ -78,8 +78,8 @@ pub struct RuntimePageRange {
 
 /// Number of tables that always contribute exactly one sub-proof, regardless
 /// of `TableCounts`: bitwise, decode, halt, commit, keccak, keccak_rnd,
-/// keccak_rc, register, ecsm, ec_scalar, ecdas.
-pub const FIXED_TABLE_COUNT: usize = 11;
+/// keccak_rc, register, ecsm, ecdas.
+pub const FIXED_TABLE_COUNT: usize = 10;
 
 /// Number of chunks for each split table.
 /// The verifier needs this to reconstruct matching AIRs.
@@ -259,7 +259,6 @@ pub(crate) struct VmAirs {
     pub keccak_rnd: VmAir,
     pub keccak_rc: VmAir,
     pub ecsm: VmAir,
-    pub ec_scalar: VmAir,
     pub ecdas: VmAir,
     pub register: VmAir,
     pub pages: Vec<VmAir>,
@@ -285,7 +284,6 @@ impl VmAirs {
             (self.keccak_rnd.as_ref(), &mut traces.keccak_rnd, &()),
             (self.keccak_rc.as_ref(), &mut traces.keccak_rc, &()),
             (self.ecsm.as_ref(), &mut traces.ecsm, &()),
-            (self.ec_scalar.as_ref(), &mut traces.ec_scalar, &()),
             (self.ecdas.as_ref(), &mut traces.ecdas, &()),
             (self.register.as_ref(), &mut traces.register, &()),
         ];
@@ -360,7 +358,6 @@ impl VmAirs {
             self.keccak_rnd.as_ref(),
             self.keccak_rc.as_ref(),
             self.ecsm.as_ref(),
-            self.ec_scalar.as_ref(),
             self.ecdas.as_ref(),
             self.register.as_ref(),
         ];
@@ -534,7 +531,6 @@ impl VmAirs {
             tables::keccak_rc::NUM_PRECOMPUTED_COLS,
         ));
         let ecsm: VmAir = Box::new(create_ecsm_air(proof_options));
-        let ec_scalar: VmAir = Box::new(create_ec_scalar_air(proof_options));
         let ecdas: VmAir = Box::new(create_ecdas_air(proof_options));
         let register: VmAir =
             if let Some((commitment, num_preprocessed_cols)) = register_preprocessed {
@@ -641,7 +637,6 @@ impl VmAirs {
             keccak_rnd,
             keccak_rc,
             ecsm,
-            ec_scalar,
             ecdas,
             register,
             pages,