Support for bn254 G2

[matthiasgeihs]

With support for bls12-381 being stagnant (EIP-2537), to the best of my knowledge, using curve alt_bn128 is currently the only way to have efficient pairings on Ethereum (EIP-197). Any plans to integrate this curve with noble-curves?

For my use case, I would only need the group operations to be included in the library, not the pairing, basically asking for a similar thing as indutny/elliptic#154. The goal is to be able to write a JavaScript / TypeScript interface that can generate the inputs to the smart contract that then computes the pairing for verification.

[paulmillr]

We have this curve, and it's called bn254.

[matthiasgeihs]

@paulmillr Turns out I might actually need to compute in G_2 of alt_bn128/bn254 as well. Any suggestions how to go about this? (Background: Planning to implement Catalano-Fiore Vector Commitments.)

[paulmillr]

Take a look at bls12-381 implementation for Fp2 (G2) impl there.

We provide necessary abstractions for extension fields, so it can be done.

[matthiasgeihs]

Thanks for the hint. Looks like a bit of work (and proper understanding) is required to do that right. Not sure if I can dedicate the necessary time currently, but will keep it in the back of my head. (Might otherwise reside to using a Rust library and compiling Rust to WASM.)

[paulmillr]

As a side note, alt_bn128 was its name when it was thought if having 128-bit security. Now that it was found to be shitty, it became bn254.

https://moderncrypto.org/mail-archive/curves/2016/000740.html
zcash/zcash#714
https://xn--2-umb.com/22/pairings/

[matthiasgeihs]

I know about the issue. But are there any better alternatives on Ethereum as long as bls12-381 is not supported natively? (see EIP-2537 discussion thread)

[paulmillr]

As you've mentioned in the first post: unfortunately, no. We need to press on eth core, because it's really tragic.

[fedealconada]

The goal is to be able to write a JavaScript / TypeScript interface that can generate the inputs to the smart contract that then computes the pairing for verification.

hey @matthiasgeihs, wondering if you managed to do this? or what did you end up using

[matthiasgeihs]

@fedealconada I've been resorting to existing libraries such as ffjavascript.

[lucadonnoh]

i would also like this feature!

[rishabh-vasudevan19]

I would also love to have bn254 pairings and g2. Are you planning to add this to the repository?

[paulmillr]

Contributions are welcome.