How to hash-to-curve in circuit with the best performance?

[SherLzp]

Hi sir @ivokub , one question here. As I'm trying to work on verifying BLS signature(based on bls12-377 curve) on BW6-761 curve. I meet one problem here, I need to do a "map to G1 operation". However, it seems that if I follow the method here to implement it, I need to emulated the fp.Element operation(bls12-377) on BW6-761 curve. It seems that it will cost a lot of constraints. Is there any better method to do that?

[ivokub]

I'm not sure. There may be but I'm not too knowledgeable how hashing works.

One approach however is to see if you can use. With hint instead of hashing to curve in-circuit you compute the result and then assert that it was correctly computed. See NewHint method (and its example) on how to use hints in-circuit.