feat: new precompile secp256r1

crates/core/executor/src/events/precompiles/ec.rs

@@ -2,7 +2,10 @@ use serde::{Deserialize, Serialize};
 
 use sp1_curves::{
     params::{NumLimbs, NumWords},
-    weierstrass::{bls12_381::bls12381_decompress, secp256k1::secp256k1_decompress},
+    weierstrass::{
+        bls12_381::bls12381_decompress, secp256k1::secp256k1_decompress,
+        secp256r1::secp256r1_decompress,
+    },
     AffinePoint, CurveType, EllipticCurve,
 };
 use sp1_primitives::consts::{bytes_to_words_le_vec, words_to_bytes_le_vec};
@@ -204,6 +207,7 @@ pub fn create_ec_decompress_event<E: EllipticCurve>(
 
     let decompress_fn = match E::CURVE_TYPE {
         CurveType::Secp256k1 => secp256k1_decompress::<E>,
+        CurveType::Secp256r1 => secp256r1_decompress::<E>,
         CurveType::Bls12381 => bls12381_decompress::<E>,
         _ => panic!("Unsupported curve"),
     };

crates/core/executor/src/events/precompiles/mod.rs

@@ -40,6 +40,12 @@ pub enum PrecompileEvent {
     Secp256k1Double(EllipticCurveDoubleEvent),
     /// Secp256k1 curve decompress precompile event.
     Secp256k1Decompress(EllipticCurveDecompressEvent),
+    /// Secp256r1 curve add precompile event.
+    Secp256r1Add(EllipticCurveAddEvent),
+    /// Secp256r1 curve double precompile event.
+    Secp256r1Double(EllipticCurveDoubleEvent),
+    /// Secp256r1 curve decompress precompile event.
+    Secp256r1Decompress(EllipticCurveDecompressEvent),
     /// K256 curve decompress precompile event.
     K256Decompress(EllipticCurveDecompressEvent),
     /// Bn254 curve add precompile event.
@@ -93,17 +99,20 @@ impl PrecompileLocalMemory for Vec<(SyscallEvent, PrecompileEvent)> {
                     iterators.push(e.local_mem_access.iter());
                 }
                 PrecompileEvent::Secp256k1Add(e)
+                | PrecompileEvent::Secp256r1Add(e)
                 | PrecompileEvent::EdAdd(e)
                 | PrecompileEvent::Bn254Add(e)
                 | PrecompileEvent::Bls12381Add(e) => {
                     iterators.push(e.local_mem_access.iter());
                 }
                 PrecompileEvent::Secp256k1Double(e)
+                | PrecompileEvent::Secp256r1Double(e)
                 | PrecompileEvent::Bn254Double(e)
                 | PrecompileEvent::Bls12381Double(e) => {
                     iterators.push(e.local_mem_access.iter());
                 }
                 PrecompileEvent::Secp256k1Decompress(e)
+                | PrecompileEvent::Secp256r1Decompress(e)
                 | PrecompileEvent::K256Decompress(e)
                 | PrecompileEvent::Bls12381Decompress(e) => {
                     iterators.push(e.local_mem_access.iter());

crates/core/executor/src/executor.rs

@@ -1699,8 +1699,8 @@ mod tests {
     use sp1_stark::SP1CoreOpts;
 
     use crate::programs::tests::{
-        fibonacci_program, panic_program, simple_memory_program, simple_program,
-        ssz_withdrawals_program,
+        fibonacci_program, panic_program, secp256r1_add_program, secp256r1_double_program,
+        simple_memory_program, simple_program, ssz_withdrawals_program,
     };
 
     use crate::Register;
@@ -1729,6 +1729,20 @@ mod tests {
         runtime.run().unwrap();
     }
 
+    #[test]
+    fn test_secp256r1_add_program_run() {
+        let program = secp256r1_add_program();
+        let mut runtime = Executor::new(program, SP1CoreOpts::default());
+        runtime.run().unwrap();
+    }
+
+    #[test]
+    fn test_secp256r1_double_program_run() {
+        let program = secp256r1_double_program();
+        let mut runtime = Executor::new(program, SP1CoreOpts::default());
+        runtime.run().unwrap();
+    }
+
     #[test]
     fn test_ssz_withdrawals_program_run() {
         let program = ssz_withdrawals_program();

crates/core/executor/src/hook.rs

@@ -4,14 +4,17 @@ use std::sync::{Arc, RwLock, RwLockWriteGuard};
 
 use hashbrown::HashMap;
 use sp1_curves::k256::{Invert, RecoveryId, Signature, VerifyingKey};
+use sp1_curves::p256::{Signature as p256Signature, VerifyingKey as p256VerifyingKey};
 
 use crate::Executor;
 
 /// A runtime hook, wrapped in a smart pointer.
 pub type BoxedHook<'a> = Arc<RwLock<dyn Hook + Send + Sync + 'a>>;
 
-/// The file descriptor through which to access `hook_ecrecover`.
-pub const FD_ECRECOVER_HOOK: u32 = 5;
+/// The file descriptor through which to access `hook_k1_ecrecover`.
+pub const K1_ECRECOVER_HOOK: u32 = 5;
+/// The file descriptor through which to access `hook_r1_ecrecover`.
+pub const R1_ECRECOVER_HOOK: u32 = 6;
 
 /// A runtime hook. May be called during execution by writing to a specified file descriptor,
 /// accepting and returning arbitrary data.
@@ -75,7 +78,8 @@ impl<'a> Default for HookRegistry<'a> {
         let table = HashMap::from([
             // Note: To ensure any `fd` value is synced with `zkvm/precompiles/src/io.rs`,
             // add an assertion to the test `hook_fds_match` below.
-            (FD_ECRECOVER_HOOK, hookify(hook_ecrecover)),
+            (K1_ECRECOVER_HOOK, hookify(hook_k1_ecrecover)),
+            (R1_ECRECOVER_HOOK, hookify(hook_r1_ecrecover)),
         ]);
 
         Self { table }
@@ -117,7 +121,7 @@ pub struct HookEnv<'a, 'b: 'a> {
 /// WARNING: This function is used to recover the public key outside of the zkVM context. These
 /// values must be constrained by the zkVM for correctness.
 #[must_use]
-pub fn hook_ecrecover(_: HookEnv, buf: &[u8]) -> Vec<Vec<u8>> {
+pub fn hook_k1_ecrecover(_: HookEnv, buf: &[u8]) -> Vec<Vec<u8>> {
     assert_eq!(buf.len(), 65 + 32, "ecrecover input should have length 65 + 32");
     let (sig, msg_hash) = buf.split_at(65);
     let sig: &[u8; 65] = sig.try_into().unwrap();
@@ -141,14 +145,56 @@ pub fn hook_ecrecover(_: HookEnv, buf: &[u8]) -> Vec<Vec<u8>> {
     vec![bytes.to_vec(), s_inverse.to_bytes().to_vec()]
 }
 
+/// Recovers the public key from the signature and message hash using the secp256r1 crate.
+///
+/// # Arguments
+///
+/// * `env` - The environment in which the hook is invoked.
+/// * `buf` - The buffer containing the signature and message hash.
+///     - The signature is 65 bytes, the first 64 bytes are the signature and the last byte is the
+///       recovery ID.
+///     - The message hash is 32 bytes.
+///
+/// The result is returned as a pair of bytes, where the first 32 bytes are the X coordinate
+/// and the second 32 bytes are the Y coordinate of the decompressed point.
+///
+/// WARNING: This function is used to recover the public key outside of the zkVM context. These
+/// values must be constrained by the zkVM for correctness.
+#[must_use]
+pub fn hook_r1_ecrecover(_: HookEnv, buf: &[u8]) -> Vec<Vec<u8>> {
+    assert_eq!(buf.len(), 65 + 32, "ecrecover input should have length 65 + 32");
+    let (sig, msg_hash) = buf.split_at(65);
+    let sig: &[u8; 65] = sig.try_into().unwrap();
+    let msg_hash: &[u8; 32] = msg_hash.try_into().unwrap();
+
+    let mut recovery_id = sig[64];
+    let mut sig = p256Signature::from_slice(&sig[..64]).unwrap();
+
+    if let Some(sig_normalized) = sig.normalize_s() {
+        sig = sig_normalized;
+        recovery_id ^= 1;
+    };
+    let recid = RecoveryId::from_byte(recovery_id).expect("Computed recovery ID is invalid!");
+
+    let recovered_key = p256VerifyingKey::recover_from_prehash(&msg_hash[..], &sig, recid).unwrap();
+    let recovered_key_compressed = recovered_key.to_encoded_point(true);
+    let bytes = recovered_key_compressed.as_bytes();
+
+    let (_, s) = sig.split_scalars();
+    let s_inverse = s.invert();
+
+    vec![bytes.to_vec(), s_inverse.to_bytes().to_vec()]
+}
+
 #[cfg(test)]
 pub mod tests {
     use super::*;
 
     #[test]
     pub fn hook_fds_match() {
         use sp1_zkvm::lib::io;
-        assert_eq!(FD_ECRECOVER_HOOK, io::FD_ECRECOVER_HOOK);
+        assert_eq!(K1_ECRECOVER_HOOK, io::K1_ECRECOVER_HOOK);
+        assert_eq!(R1_ECRECOVER_HOOK, io::R1_ECRECOVER_HOOK);
     }
 
     #[test]