CompressedE12T

Dedicated structure for compressed elements in the cyclotomic subgroup G_phi ⊂ Fq^12

Background and intent (Observation 47):

Elements in the cyclotomic subgroup admit the Karabina compression where two of the Fp6 components (c0.b0 and c1.b1 in our tower representation) can be recovered from the remaining ones. Squaring in this form is cheaper and is implemented by the circuit run_BLS12_381_E12T_CYCLO_SQUARE_COMPRESSED_circuit that takes eight Fp limbs.
We represent such compressed elements explicitly instead of overloading E12T. This avoids confusing unused fields and makes the intent of “compressed cyclotomic value” explicit at the type level.

Representation details:

E12T is modeled as Fp12 via the tower (Fp2 → Fp6 → Fp12) with coordinates c{i}.b{j}.a{k}. The compressed form stores exactly the eight limbs required by the Karabina formulas: c0.b1, c0.b2, c1.b0 and c1.b2 (each over Fp2 → a0,a1).
The fields c0.b0 and c1.b1 are intentionally absent; they are reconstructed during decompression using DECOMP_KARABINA_* circuits.
Validity invariant: values of this type must come from the cyclotomic subgroup; using arbitrary Fp12 elements here is undefined.

Usage:

Squaring: feed the eight limbs directly to run_BLS12_381_E12T_CYCLO_SQUARE_COMPRESSED_circuit.
Multiplication or any generic operation: first call decompress_karabina_bls12_381_compressed to recover a full E12T.
Zero-branch: when c1b2 == 0, decompression uses the cheaper “I_Z” path.

Security/correctness notes:

Decompression returns One when the Karabina t1 component is zero, matching the standard algorithmic edge case.
The helper to_compressed(E12T) merely copies the eight required limbs; it does not check subgroup membership.

Fully qualified path: garaga::ec::pairing::single_pairing_tower::CompressedE12T

[derive(Copy, Drop, Debug, PartialEq)]
pub struct CompressedE12T {
    pub c0b1a0: u384,
    pub c0b1a1: u384,
    pub c0b2a0: u384,
    pub c0b2a1: u384,
    pub c1b0a0: u384,
    pub c1b0a1: u384,
    pub c1b2a0: u384,
    pub c1b2a1: u384,
}