Feat Emulated BW6-761

[SherLzp]

Emulate operations of BW6-761 curve with the following result:

Constraints:
MillerLoop 2153658
FinalExponentiation 2153658
1 Pairing: 3493454

In order to make complete tests, we need to wait for the merge of gnark-crypto#359

Sir, could you please take a reivew on that. @ivokub

[ivokub]

Emulate operations of BW6-761 curve with the following result:

Constraints:
MillerLoop 2153658
FinalExponentiation 2153658
1 Pairing: 3493454

In order to make complete tests, we need to wait for the merge of gnark-crypto#359

Sir, could you please take a reivew on that. @ivokub

Thanks for the contribution! Also added @yelhousni.

It may take a few days before can get to it. But I really like the possibility of two layers of recursion, I think this will open up very interesting approaches for scalability.

[yelhousni]

Great! thanks @SherLzp for the contribution!
This would be useful for a 2-layer recursion. One can use a 2-chain (e.g BLS12-377/BW6-761) for the first layer and then emulated BW6 over BN254 for the second layer (see conclusion of this paper).
There are however some optimisations to do (see #566). Also not sure if the twisted ate pairing is better than the ate pairing constraint-wise and there are couple of Miller loop variants I want to test (see this blog). What is your timeline on this? We can review as-is and work out the optimisations later or incorporate them into this PR?

[SherLzp]

Great! thanks @SherLzp for the contribution! This would be useful for a 2-layer recursion. One can use a 2-chain (e.g BLS12-377/BW6-761) for the first layer and then emulated BW6 over BN254 for the second layer (see conclusion of this paper). There are however some optimisations to do (see #566). Also not sure if the twisted ate pairing is better than the ate pairing constraint-wise and there are couple of Miller loop variants I want to test (see this blog). What is your timeline on this? We can review as-is and work out the optimisations later or incorporate them into this PR?

Yes, I think 2-chain + emulated BW6-761 is really amazing(comes from this paper). That's no problem. We can work out the optimisations later. If there is anything I can help, please let me know.

[ivokub]

I pushed a few fixes. There are still some cleanup work to do but I'll postpone. I want to move some types around into packages where they are actually used (LineEvaluation), also some documentation would be nice. And I see that tests print some logging info.

All in all, I think it is a bit of work. I'll then have a look at the correctness.

[yelhousni]

@SherLzp we ended up re-implementing in #846 the emulated BW6-761 pairing with the same optimization techniques as for BN254 and BLS12-381. I wanted to thank you for this PR which helped me init and test #846. The overall cost is now 2,969,304 R1CS which saves 524,150 constraints.

Edit: 2,716,106 R1CS now