Comments (3)
So literature is contradicting itself (?)
For BN254:
0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47 ≡ 7 (mod 8)
Aranha in https://caramba.loria.fr/sem-slides/201905241000.pdf / https://ecc2017.cs.ru.nl/slides/ecc2017-aranha.pdf mentions that they can use the following towering:
and https://eprint.iacr.org/2010/526.pdf
But Grewal in https://eprint.iacr.org/2012/408.pdf mentions that for BN curve with p ≡ 7 (mod 8) you need 𝔽p² = √-2
[8] refers to Pereira paper: https://eprint.iacr.org/2010/429.pdf
From Bos, Costello Naehrig https://www.microsoft.com/en-us/research/wp-content/uploads/2013/08/exponentiating_pairing.pdf
from constantine.
So in Ethereum the curve equation is y^2 = x^3 + 3
But in the papers cited they create y² = x³ + 2. According to Pereira paper, b = N(ξ) (norm of Xi) with ξ = c² + d³ 𝑖, due to b = 2 this works for ξ = 1+𝑖 and bypasses (?) the cubic non-residue requirement.
However for Ethereum usage, the curve is y² = x³ + 3 so we can't find "friendly" parameters for y² = x³ + 2 and we need to fallback to cubic non-residue to extend 𝔽p6=𝔽p[v]/(v² − ξ), possible using √-2 instead of 𝑖 for the base quadratic extension.
Can someone with a good grasp on that confirm?
from constantine.
Confusion solved Snarks and Ethereum use the prime 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47 and Nogami/Aranha and the litterature use 0x2523648240000001ba344d80000000086121000000000013a700000000000013. Both are BN primes of width 254-bit .
The sage formulas have been updated and the suggested towers matches the litterature and specifications.
from constantine.
Related Issues (20)
- EIP-2537: Potential memory leak in G1 and G2 MSM
- Followup: Go API for BLS signatures HOT 2
- MSM - optimized MSM wrong result in IPA verifier.
- Verkle IPA - Incomplete test suite - bugs in prover & verifier HOT 2
- Bug: Cubic extension conjugate
- Build failing on MacOS HOT 4
- Optimize MSM for Bandersnatch/wagon and Verkle Tries
- Optimize MSM for small scalars
- Verkle Trees: Faster subgroup checks for Banderwagon via vartime Legendre symbol
- Parallelize IPA for Verkle Trees
- Custom Vec/Seq with destructors HOT 1
- SIMD Vectorization - Use Integer Fused Multiply-Add (AVX512) HOT 2
- Per-curve towering
- LLVM/Nvidia GPU backend: LLVM 17 broke everything HOT 2
- Optimize batch verification for same message (Pippenger msm)
- Low-level: discrepancy between field arithmetic performance and elliptic curve performance HOT 4
- Windows: Secp256k1 tests assembly test frozen
- Oblivious Maps / side-channel secure hash tables
- Parallel MSM load balancing: minimize work per-thread
- [Fuzzing] Implement a Fp12 serializer to canonical serialization HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from constantine.