Conversion of frontend.Variable <-> emulated.Element

[shreyas-londhe]

Hi! I am using the develop branch to perfom emulated field operations for the bn254 curve and I wanted to know if there is any way to convert frontend.Variable to emulated.Element.

I want to compute a MiMC hash inside the circuit and then map the hash to the curve to do a a pairing check. But I cannot do that becuase I don't see a way to convert.

Thanks

[hussein-aitlahcen]

I believe there is no hash to curve circuit yet. You would probably need to build it on top of emulated arithmetic for G1 and G2.

[ivokub]

Yup, right now we don't have hash to curve in-circuit yet. We are planning to do it, but right now are focusing on finishing features for Linea. Soon!

[shreyas-londhe]

No issues, I think I figured it out.

func convertFrontendVariableToEmulatedElement(api frontend.API, v frontend.Variable) emulated.Element[emulated.BN254Fp] {
	bits := api.ToBinary(v)

	field, err := emulated.NewField[emulated.BN254Fp](api)
	HandleError(err)

	return *field.FromBits(bits...)
}

I hope this helps.

[shreyas-londhe]

@ivokub Can I make a PR to add these helper functions?

[ivokub]

I think correctly using such functionality would be difficult considering that that it depends on the underlying curve. I think it would be better to keep it application-specific where the curve and field is fixed.

[shreyas-londhe]

Ohh makes sense, thanks for the prompt response, appreciate it!

[shreyas-londhe]

Btw, as an alternative for HashToCurve, will using the hash as a scalar and multiplying it with a fixed point on the curve to get a HashToCurve kinda functionality be cryptographically secure?

[hussein-aitlahcen]

It's not secure in BLS. If you have a signature $S = sk \times H$ where $H = m \times P$, anyone can forge a signature for another message $\mathit{m'}$ by doing $$m' \times m^{-1} \times S=sk \times m' \times P=sk \times H' = S'$$

[ivokub]

I think it depends on the use case. Usually people use generic hash-to-curve when they want to obtain a point for which there is no know relation between the base point. Otherwise some protocols break. See also https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-12.html#appendix-A-2

But, if doesn't break your protocol, then you are good.