Implement CurveExt for G1Projective

[CPerezz]

This monstrosity which makes almost no-sense (Bls12-381 depending on pasta-curves) is the workaround that unblocks Bls12-381 usage in halo2curves.

For more context on the unblock, see: zkcrypto/group#48 && privacy-ethereum/halo2curves#75

Left to do for the future:

• hash_to_curve impl within CurveExt impl.

[CPerezz]

This needs a big cleanup and set a lot of features correctly.
But it at least compiles. Which allows me if the integration with halo2curves is feasible or not.

[CPerezz]

So we're on a weird situation here where we do have all of the tests passing for all the features. But the endomorphism seems to not work although the params have been derived twice ending in the same result.

[han0110]

Some constants of Fp need to be updated since it doesn't have from_raw to use, I've generated locally and add some comments.

Also perhaps we could add a test for these constans below like:

#[test]
fn constants() {
    assert_eq!(Fp::ONE.double(), GENERATOR);
    assert_eq!(Fp::ONE, Fp::ONE.double() * TWO_INV);
    assert_eq!(Fp::ONE, ROOT_OF_UNITY.pow([1 << Fp::S]));
    assert_eq!(Fp::ONE, ROOT_OF_UNITY * ROOT_OF_UNITY_INV);
    // sage: modulus = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
    // sage: hex((modulus - 1) >> 1)
    // '0xd0088f51cbff34d258dd3db21a5d66bb23ba5c279c2895fb39869507b587b120f55ffff58a9ffffdcff7fffffffd555'
    let t = [
        0xdcff7fffffffd555,
        0x0f55ffff58a9ffff,
        0xb39869507b587b12,
        0xb23ba5c279c2895f,
        0x258dd3db21a5d66b,
        0xd0088f51cbff34d,
    ];
    assert_eq!(Fp::ONE, DELTA.pow(t));
    assert_eq!(Fp::ONE, ZETA.pow([3]));
}

[CPerezz]

Some constants of Fp need to be updated since it doesn't have from_raw to use, I've generated locally and add some comments.

Also perhaps we could add a test for these constans below like:

#[test]
fn constants() {
    assert_eq!(Fp::ONE.double(), GENERATOR);
    assert_eq!(Fp::ONE, Fp::ONE.double() * TWO_INV);
    assert_eq!(Fp::ONE, ROOT_OF_UNITY.pow([1 << Fp::S]));
    assert_eq!(Fp::ONE, ROOT_OF_UNITY * ROOT_OF_UNITY_INV);
    // sage: modulus = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
    // sage: hex((modulus - 1) >> 1)
    // '0xd0088f51cbff34d258dd3db21a5d66bb23ba5c279c2895fb39869507b587b120f55ffff58a9ffffdcff7fffffffd555'
    let t = [
        0xdcff7fffffffd555,
        0x0f55ffff58a9ffff,
        0xb39869507b587b12,
        0xb23ba5c279c2895f,
        0x258dd3db21a5d66b,
        0xd0088f51cbff34d,
    ];
    assert_eq!(Fp::ONE, DELTA.pow(t));
    assert_eq!(Fp::ONE, ZETA.pow([3]));
}

I indeed had this kind of test in https://github.com/privacy-scaling-explorations/bls12_381/blob/tmp_curve_ext/src/scalar.rs#L819-L849

And assumed I had it too for Fp. Adding it!!

[han0110]

LGTM