quotient ring exponentiation

libs/algebra/include/nil/crypto3/algebra/fields/field_order.hpp

@@ -0,0 +1,50 @@
+//---------------------------------------------------------------------------//
+// Copyright (c) 2026
+//
+// MIT License
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//---------------------------------------------------------------------------//
+
+#ifndef CRYPTO3_ALGEBRA_FIELDS_FIELD_ORDER_HPP
+#define CRYPTO3_ALGEBRA_FIELDS_FIELD_ORDER_HPP
+
+#include <cstddef>
+
+#include <boost/multiprecision/cpp_int.hpp>
+
+namespace nil::crypto3::algebra::fields {
+
+    /**
+     * Return the number of elements in FieldType. Crypto3 field types describe extensions with an arity equal to their
+     * degree over the prime field, so a field of characteristic p and arity d has p^d elements.
+     */
+    template<typename FieldType>
+    boost::multiprecision::cpp_int field_order() {
+        const boost::multiprecision::cpp_int characteristic(FieldType::modulus.backend().to_cpp_int());
+        boost::multiprecision::cpp_int order = 1;
+        for (std::size_t i = 0; i < FieldType::arity; ++i) {
+            order *= characteristic;
+        }
+        return order;
+    }
+
+}    // namespace nil::crypto3::algebra::fields
+
+#endif    // CRYPTO3_ALGEBRA_FIELDS_FIELD_ORDER_HPP

libs/algebra/test/CMakeLists.txt

@@ -47,6 +47,7 @@ set(RUNTIME_TESTS_NAMES
         "short_weierstrass_coordinates"
         "curves_static"
         "fields"
+        "field_order"
         "fp12"
         "fields_static"
         "pairing"

libs/algebra/test/field_order.cpp

@@ -0,0 +1,63 @@
+//---------------------------------------------------------------------------//
+// Copyright (c) 2026
+//
+// MIT License
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//---------------------------------------------------------------------------//
+
+#define BOOST_TEST_MODULE field_order_test
+
+#include <boost/multiprecision/cpp_int.hpp>
+#include <boost/test/unit_test.hpp>
+
+#include <nil/crypto3/algebra/fields/alt_bn128/base_field.hpp>
+#include <nil/crypto3/algebra/fields/field_order.hpp>
+#include <nil/crypto3/algebra/fields/fp2.hpp>
+#include <nil/crypto3/algebra/fields/fp12_2over3over2.hpp>
+
+namespace {
+    namespace fields = nil::crypto3::algebra::fields;
+
+    using fq_field_type = fields::alt_bn128_base_field<254>;
+    using fq2_field_type = fields::fp2<fq_field_type>;
+    using fq12_field_type = fields::fp12_2over3over2<fq_field_type>;
+}    // namespace
+
+BOOST_AUTO_TEST_SUITE(field_order_test_suite)
+
+BOOST_AUTO_TEST_CASE(prime_field_order_equals_its_characteristic) {
+    const boost::multiprecision::cpp_int expected(
+        "21888242871839275222246405745257275088696311157297823662689037894645226208583");
+
+    BOOST_CHECK(fields::field_order<fq_field_type>() == expected);
+}
+
+BOOST_AUTO_TEST_CASE(extension_field_order_is_characteristic_to_the_extension_degree) {
+    const boost::multiprecision::cpp_int characteristic = fields::field_order<fq_field_type>();
+    boost::multiprecision::cpp_int expected_fq12_order = 1;
+    for (std::size_t i = 0; i < fq12_field_type::arity; ++i) {
+        expected_fq12_order *= characteristic;
+    }
+
+    BOOST_CHECK(fields::field_order<fq2_field_type>() == characteristic * characteristic);
+    BOOST_CHECK(fields::field_order<fq12_field_type>() == expected_fq12_order);
+}
+
+BOOST_AUTO_TEST_SUITE_END()

libs/math/include/nil/crypto3/math/polynomial/polynomial_division.hpp

@@ -253,37 +253,6 @@ namespace nil::crypto3::math {
         output = std::move(quotient);
     }
 
-    /**
-     * Compute output = (left * right) mod B, where B is the nonzero polynomial stored in divisor_context. B need not
-     * be monic or irreducible. The result is canonical, has degree less than degree(B) when B is nonconstant, and may
-     * alias either input.
-     *
-     * If the canonical product has p coefficients and d = degree(B), reduction requires p - d quotient coefficients
-     * when p > d. The context's precomputed inverse must have at least that precision. In particular, for nonconstant
-     * B, inputs already reduced modulo B require at most d - 1 inverse coefficients.
-     *
-     * @throws std::invalid_argument if the precomputed inverse has insufficient precision.
-     */
-    template<detail::SupportsDivrem Backend>
-    void mulmod(typename Backend::polynomial_type &output, const typename Backend::polynomial_type &left,
-                const typename Backend::polynomial_type &right,
-                const polynomial_divisor_context<Backend> &divisor_context,
-                polynomial_arithmetic::polynomial_context<Backend> &arithmetic_context) {
-        using polynomial_type = typename Backend::polynomial_type;
-        using value_type = typename polynomial_type::value_type;
-
-        // Every polynomial is zero modulo a nonzero constant, so no product needs to be computed.
-        if (divisor_context.degree() == 0) {
-            output.resize(1);
-            output[0] = value_type {};
-            return;
-        }
-
-        polynomial_type product;
-        multiplication(product, left, right, arithmetic_context);
-        remainder(output, product, divisor_context, arithmetic_context);
-    }
-
 }    // namespace nil::crypto3::math
 
 #endif    // CRYPTO3_MATH_POLYNOMIAL_DIVISION_HPP

libs/math/include/nil/crypto3/math/polynomial/polynomial_exponentiation.hpp

@@ -0,0 +1,110 @@
+//---------------------------------------------------------------------------//
+// Copyright (c) 2026
+//
+// MIT License
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//---------------------------------------------------------------------------//
+
+#ifndef CRYPTO3_MATH_POLYNOMIAL_EXPONENTIATION_HPP
+#define CRYPTO3_MATH_POLYNOMIAL_EXPONENTIATION_HPP
+
+#include <concepts>
+#include <stdexcept>
+#include <type_traits>
+#include <utility>
+
+#include <nil/crypto3/math/polynomial/polynomial_modular_arithmetic.hpp>
+
+namespace nil::crypto3::math {
+
+    namespace detail {
+        /** Integer-like exponent that can be consumed one binary digit at a time. */
+        template<typename Exponent>
+        concept IntegerExponent =
+            std::copy_constructible<Exponent> && requires(Exponent value, const Exponent constant) {
+                { constant == 0 } -> std::convertible_to<bool>;
+                { constant < 0 } -> std::convertible_to<bool>;
+                { (constant % 2) != 0 } -> std::convertible_to<bool>;
+                { value >>= 1 } -> std::same_as<Exponent &>;
+            };
+    }    // namespace detail
+
+    /**
+     * Compute output = base^exponent mod B by binary exponentiation, where B is the nonzero polynomial stored in
+     * divisor_context. B need not be monic or irreducible. The base is reduced before exponentiation, and every
+     * intermediate square and product is reduced before the next operation. Output is canonical and may alias base.
+     *
+     * If d = degree(B), products of reduced operands require at most d - 1 inverse coefficients. Reducing an
+     * unreduced base may require more, so divisor_context must also have sufficient precision for that initial
+     * reduction. Exponent zero returns the quotient-ring identity; modulo a nonzero constant this is the zero
+     * polynomial because the quotient ring is the zero ring.
+     *
+     * @throws std::invalid_argument if exponent is negative or the precomputed inverse has insufficient precision.
+     */
+    template<detail::SupportsDivrem Backend, detail::IntegerExponent Exponent>
+    void powmod(typename Backend::polynomial_type &output, const typename Backend::polynomial_type &base,
+                const Exponent &exponent, const polynomial_divisor_context<Backend> &divisor_context,
+                polynomial_arithmetic::polynomial_context<Backend> &arithmetic_context) {
+        using polynomial_type = typename Backend::polynomial_type;
+        using value_type = typename polynomial_type::value_type;
+
+        if constexpr (std::signed_integral<Exponent> || !std::integral<Exponent>) {
+            if (exponent < 0) {
+                throw std::invalid_argument("polynomial exponent must be nonnegative");
+            }
+        }
+
+        if (divisor_context.degree() == 0) {
+            output.assign(1, value_type {});
+            return;
+        }
+        if (exponent == 0) {
+            output.assign(1, value_type::one());
+            return;
+        }
+
+        polynomial_type power;
+        remainder(power, base, divisor_context, arithmetic_context);
+
+        Exponent remaining(exponent);
+        polynomial_type result;
+        bool found_set_bit = false;
+        while (remaining != 0) {
+            if ((remaining % 2) != 0) {
+                if (found_set_bit) {
+                    mulmod(result, result, power, divisor_context, arithmetic_context);
+                } else {
+                    result = power;
+                    found_set_bit = true;
+                }
+            }
+
+            remaining >>= 1;
+            if (remaining != 0) {
+                squaremod(power, power, divisor_context, arithmetic_context);
+            }
+        }
+
+        output = std::move(result);
+    }
+
+}    // namespace nil::crypto3::math
+
+#endif    // CRYPTO3_MATH_POLYNOMIAL_EXPONENTIATION_HPP

libs/math/include/nil/crypto3/math/polynomial/polynomial_modular_arithmetic.hpp

@@ -0,0 +1,90 @@
+//---------------------------------------------------------------------------//
+// Copyright (c) 2026
+//
+// MIT License
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//---------------------------------------------------------------------------//
+
+#ifndef CRYPTO3_MATH_POLYNOMIAL_MODULAR_ARITHMETIC_HPP
+#define CRYPTO3_MATH_POLYNOMIAL_MODULAR_ARITHMETIC_HPP
+
+#include <nil/crypto3/math/polynomial/polynomial_division.hpp>
+
+namespace nil::crypto3::math {
+
+    /**
+     * Compute output = (left * right) mod B, where B is the nonzero polynomial stored in divisor_context. B need not
+     * be monic or irreducible. The result is canonical, has degree less than degree(B) when B is nonconstant, and may
+     * alias either input.
+     *
+     * If the canonical product has p coefficients and d = degree(B), reduction requires p - d quotient coefficients
+     * when p > d. The context's precomputed inverse must have at least that precision. In particular, for nonconstant
+     * B, inputs already reduced modulo B require at most d - 1 inverse coefficients.
+     *
+     * @throws std::invalid_argument if the precomputed inverse has insufficient precision.
+     */
+    template<detail::SupportsDivrem Backend>
+    void mulmod(typename Backend::polynomial_type &output, const typename Backend::polynomial_type &left,
+                const typename Backend::polynomial_type &right,
+                const polynomial_divisor_context<Backend> &divisor_context,
+                polynomial_arithmetic::polynomial_context<Backend> &arithmetic_context) {
+        using polynomial_type = typename Backend::polynomial_type;
+        using value_type = typename polynomial_type::value_type;
+
+        // Every polynomial is zero modulo a nonzero constant, so no product needs to be computed.
+        if (divisor_context.degree() == 0) {
+            output.resize(1);
+            output[0] = value_type {};
+            return;
+        }
+
+        polynomial_type product;
+        multiplication(product, left, right, arithmetic_context);
+        remainder(output, product, divisor_context, arithmetic_context);
+    }
+
+    /**
+     * Compute output = input^2 mod B, where B is the nonzero polynomial stored in divisor_context. This is the
+     * squaring counterpart of mulmod and uses the backend's dedicated square operation. The result is canonical, has
+     * degree less than degree(B) when B is nonconstant, and may alias input.
+     *
+     * @throws std::invalid_argument if the precomputed inverse has insufficient precision.
+     */
+    template<detail::SupportsDivrem Backend>
+    void squaremod(typename Backend::polynomial_type &output, const typename Backend::polynomial_type &input,
+                   const polynomial_divisor_context<Backend> &divisor_context,
+                   polynomial_arithmetic::polynomial_context<Backend> &arithmetic_context) {
+        using polynomial_type = typename Backend::polynomial_type;
+        using value_type = typename polynomial_type::value_type;
+
+        if (divisor_context.degree() == 0) {
+            output.resize(1);
+            output[0] = value_type {};
+            return;
+        }
+
+        polynomial_type square;
+        arithmetic_context.square(square, input);
+        remainder(output, square, divisor_context, arithmetic_context);
+    }
+
+}    // namespace nil::crypto3::math
+
+#endif    // CRYPTO3_MATH_POLYNOMIAL_MODULAR_ARITHMETIC_HPP

libs/math/test/CMakeLists.txt

@@ -48,6 +48,7 @@ set(TESTS_NAMES
     "polynomial_arithmetic"
     "polynomial_backend"
     "polynomial_division"
+    "polynomial_exponentiation"
     "power_series"
     "polynomial"
     "polynomial_view"

libs/math/test/polynomial_division.cpp

@@ -35,6 +35,7 @@
 
 #include <nil/crypto3/math/polynomial/mixed_radix_backend.hpp>
 #include <nil/crypto3/math/polynomial/polynomial_division.hpp>
+#include <nil/crypto3/math/polynomial/polynomial_modular_arithmetic.hpp>
 #include <nil/crypto3/math/polynomial/schoolbook_backend.hpp>
 
 namespace {