Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Precompiled contract for pairing check. #212

Merged
merged 22 commits into from Dec 7, 2017
Merged

Precompiled contract for pairing check. #212

merged 22 commits into from Dec 7, 2017

Conversation

@chriseth
Copy link
Contributor

@chriseth chriseth commented Feb 13, 2017

Precompiled contracts for elliptic curve pairing operations are required in order to perform zkSNARK verification within the block gas limit.

Replaces #197

Output: If the length of the input is incorrect or any of the inputs are not elements of
the respective group or are not encoded correctly, the call fails.
Otherwise, return one if
log_P1(a1) * log_P2(b1) + ... + log_P1(ak) * log_P2(bk) = 0

This comment has been minimized.

@pirapira

pirapira Feb 14, 2017
Member

On which ring is this equation evaluated?

This comment has been minimized.

@chriseth

chriseth Feb 14, 2017
Author Contributor

log_P is defined to map into F_q and that is the ring / field where this expression is evaluated.

This comment has been minimized.

@pirapira

pirapira Feb 14, 2017
Member

Is q common both to G_1 and G_2?

This comment has been minimized.

@pirapira

pirapira Feb 14, 2017
Member

Ah, the answer is there above.


### Definition of the groups

The groups `G_1` and `G_1` are cyclic groups on the elliptic curve `alt_bn128` defined by the curve equation

This comment has been minimized.

@pirapira

pirapira Feb 14, 2017
Member

I guess it's G_1 and G_2

The group `G_2` is a cyclic group of prime order in the same elliptic curve over a different field `F_p^2 = F_p[X] / (X^2 + 1)` (p is the same as above) with generator
```
P2 = (
11559732032986387107991004021392285783925812861821192530917403151452391805634 * i +

This comment has been minimized.

@pirapira

pirapira Feb 14, 2017
Member

I wonder if we should stick to X instead of i. An element of F_p^2 would look like a polynomial of X. (Of course i is an intuitive choice because i * i + 1 = 0.)

This comment has been minimized.

@chriseth

chriseth Feb 14, 2017
Author Contributor

Oh right, it should be consistent.

The precompiled contract is defined as follows, where the two groups `G_1` and `G_2` and their generators `P_1` and `P_2` are defined below (they have the same order `q`):

```
Input: (a1, b1, a2, b2, ..., ak, bk) from (G_1 x G_2)^k

This comment has been minimized.

@pirapira

pirapira Feb 14, 2017
Member

I think it's worth clarifying if k = 0 is allowed (usually I don't say this, but now it's about protocol consensus).

This comment has been minimized.

@chriseth

chriseth Feb 14, 2017
Author Contributor

I would say of course it is, but it probably makes sense to be explicit about that.

@chriseth chriseth mentioned this pull request Feb 22, 2017
8 of 8 tasks complete

### Definition of the groups

The groups `G_1` and `G_2` are cyclic groups of prime order `q` on the elliptic curve `alt_bn128` defined by the curve equation

This comment has been minimized.

@chriseth

chriseth Feb 24, 2017
Author Contributor

Mention that q=21888242871839275222246405745257275088548364400416034343698204186575808495617

```
Input: (a1, b1, a2, b2, ..., ak, bk) from (G_1 x G_2)^k
Output: If the length of the input is incorrect or any of the inputs are not elements of
the respective group or are not encoded correctly, the call fails.

This comment has been minimized.

@chriseth

chriseth Feb 24, 2017
Author Contributor

Mention explicitly that we have to check that the second elements are in the group G_2 (which is a subgroup of the full elliptic curve). In order to do that, verify that the order of the element is q=21888242871839275222246405745257275088548364400416034343698204186575808495617 (the prime group order of G_2).

TODO: Check that G_2 is the only subgroup of the elliptic curve with that order.

This comment has been minimized.

@pirapira

pirapira Feb 26, 2017
Member

Zcash does something slightly different for the purpose zcash-hackworks/bn@ef95df6

The Zcash implementation adds an element of G_2 at the end.

This comment has been minimized.

@pirapira

pirapira Feb 27, 2017
Member

I edited my post above because zcash does something else for input checking.

This comment has been minimized.

@chriseth

chriseth Feb 28, 2017
Author Contributor

The article by Barreto and Naehrig "Pairing-Friendly Elliptic Curves of Prime Order" mentions that the order of the curve twist is n(2p-n) (the proof is left to the reader, so it would be nice to find such a reader) where n is the order of the field and p the order of the original curve. Since G_2 has the same order p and both p and n are primes, it suffices to verify the order of the point is p as long as p does not divide 2p-n, which is the case with our numbers.

This comment has been minimized.

@vbuterin

vbuterin Mar 4, 2017
Contributor

that the order of the curve twist is n(2p-n) (the proof is left to the reader, so it would be nice to find such a reader)

Consider a transformation that takes (x, y) into (x / cbrt(xi / 3), y / sqrt(xi / 3)). If one puts in an (x, y) pair that is on the original curve, with order n (ie. x**3 - y**2 = 3), into this transformation, then one should get out a value that satisfies x**3 - y**2 = 3/xi. However, xi / 3 is a quadratic nonresidue (though it is a cubic residue), so any x value that provides two points on the original curve would provide no points when transformed in this way, and because nonresidue * nonresidue = residue, any x value that provides no points on the original curve would provide two points when transformed. There are 2p possible points on the original curve (taking a possible point as a pair (x, parity of y), of which n turn out to be actual points; hence, the transformation gives us 2p - n points (though no proof yet that they are all linearly dependent).

I haven't gotten any further yet but this seems like the right path.


## Specification

Add a precompiled contracts for a bilinear function on groups on the elliptic curve "alt_bn128". We will define the precompiled contract in terms of a discrete logarithm. The discrete logarithm is of course assumed to be hard to compute, but we will give an equivalent specification that makes use of elliptic curve pairing functions which can be efficiently computed below.

This comment has been minimized.

@pirapira

pirapira Feb 26, 2017
Member

In some libraries, I saw alt_bn128 is an alternative implementation of bn128. I got an impression they are for the same curve.

This comment has been minimized.

@NikVolf

NikVolf Mar 28, 2017

yes, this is the case, probably better call it just bn128, because alt_bn128 is just implementation-specific label for the same curve in one particular library (libsnark, https://github.com/scipr-lab/libsnark)

This comment has been minimized.

@chriseth

chriseth Mar 28, 2017
Author Contributor

@NikVolf the curve might be the same, but the generators used seem to be different:
https://github.com/scipr-lab/libsnark/blob/master/src/algebra/curves/bn128/bn128_init.cpp#L166 - https://github.com/scipr-lab/libsnark/blob/master/src/algebra/curves/alt_bn128/alt_bn128_init.cpp#L208 (but it might just be a different encoding)
In that case, we should perhaps move this wording closer to the specification of the generators.

This comment has been minimized.

@cdetrio

cdetrio Nov 17, 2017
Member

Here are the permalinks.

alt_bn128 generator: https://github.com/scipr-lab/libff/blob/a44f482e18b8ac04d034c193bd9d7df7817ad73f/libff/algebra/curves/alt_bn128/alt_bn128_init.cpp#L208-L211

bn128 generator: https://github.com/scipr-lab/libff/blob/a44f482e18b8ac04d034c193bd9d7df7817ad73f/libff/algebra/curves/bn128/bn128_init.cpp#L166-L169

The numbers can be copy/pasted and they're both valid G2 points on the bn128 curve, so they are different generators (with the same encoding).

This comment has been minimized.

@cdetrio

cdetrio Nov 17, 2017
Member

Also note that currently the cpp-ethereum implementation is not actually using the alt_bn128 optimization, but the bn128 generator points (if I remember correctly) ethereum/aleth#4450

4082367875863433681332203403145435568316851327593401208105741076214120093531 * i +
8495653923123431417604973247489272438418190587263600148770280649306958101930
)
```

This comment has been minimized.

@pirapira

pirapira Feb 26, 2017
Member

Let G_3 be the cyclic subgroup generated by P3, where P3 is very similar to P2 but uses -i instead of i. Is it the case that G_3 has the same order as G_2? If that's the case, the current input checking method checks <G_2, G_3> I guess.

This comment has been minimized.

@chriseth

chriseth May 18, 2017
Author Contributor

Why can't it be that P3 is just another element of the same cyclic group?

This comment has been minimized.

@pirapira

pirapira May 18, 2017
Member

The question is the other way around, why is it the case that P3 is just another element of the same cyclic group?

This comment has been minimized.

@pirapira

pirapira May 18, 2017
Member

(I guess Lagrange's theorem might be useful.)


```
Input: (a1, b1, a2, b2, ..., ak, bk) from (G_1 x G_2)^k
Output: If the length of the input is incorrect or any of the inputs are not elements of

This comment has been minimized.

@rphmeier

rphmeier Apr 6, 2017

This is a distinct break from the pattern of an infinitely zero-extended input. Why not prepend the number of elements?

pirapira added a commit to pirapira/yellowpaper that referenced this pull request Apr 13, 2017
As described in ethereum/EIPs#212
pirapira added a commit to pirapira/yellowpaper that referenced this pull request Apr 18, 2017
As described in ethereum/EIPs#212
@chfast chfast mentioned this pull request Apr 21, 2017
17 of 17 tasks complete
@nicola
Copy link

@nicola nicola commented May 7, 2017

How much would the cost to validate a zksnark?

@pirapira
Copy link
Member

@pirapira pirapira commented Dec 1, 2017

@cdetrio if we avoid mentioning a generator, we need an alternative way to specify a group on the curve.

@pirapira
Copy link
Member

@pirapira pirapira commented Dec 1, 2017

@cdetrio I doubt there is a shorter way than to mention a generator explicitly.

@pirapira
Copy link
Member

@pirapira pirapira commented Dec 1, 2017

@cdetrio and then, exploring an alternative definition is beyond editorship.

Maybe the BN parameters and so on can be added as an informational EIP. A link can be added from here then.

pirapira and others added 3 commits Dec 1, 2017
@pirapira pirapira force-pushed the pairings branch from 099e668 to a849495 Dec 4, 2017
pirapira added 2 commits Dec 4, 2017
@pirapira
Copy link
Member

@pirapira pirapira commented Dec 4, 2017

Looks good to me.

Now I'm wondering if I should wait for @cdetrio 's alternative.

@pirapira
Copy link
Member

@pirapira pirapira commented Dec 4, 2017

I wouldn't believe the existence of those subgroups of order q without shown at least one generator. With a concrete generator, I can multiply it by q and then believe the existence of those subgroups.

The uniqueness part is not so hard. Basically, q is big enough.

pirapira added 3 commits Dec 4, 2017
The EIP is already active on the main net.
)
```

Note that `G_2` is the only group of order `q` of that elliptic curve over the field `F_p^2`. Any other generator of order `q` instead of `P2` would define the same `G_2`. However, the concrete value of `P2` is useful for skeptical readers who doubt the existence of a group of order `q`. They can be instructed to compare the concrete values of `q * P2` and `P2`.

This comment has been minimized.

@pirapira

pirapira Dec 4, 2017
Member

@cdetrio is this better now?

@pirapira pirapira merged commit 6131f33 into master Dec 7, 2017
@pirapira pirapira deleted the pairings branch Dec 7, 2017
@pirapira
Copy link
Member

@pirapira pirapira commented Dec 7, 2017

I think @cdetrio's findings can be filed as an informational EIP, and this one can link to that.

pirapira added a commit to pirapira/yellowpaper that referenced this pull request Jan 17, 2018
As described in ethereum/EIPs#212
pirapira added a commit to pirapira/yellowpaper that referenced this pull request Jan 19, 2018
As described in ethereum/EIPs#212
pirapira added a commit to pirapira/yellowpaper that referenced this pull request Jan 19, 2018
As described in ethereum/EIPs#212
pirapira added a commit to pirapira/yellowpaper that referenced this pull request Jan 19, 2018
As described in ethereum/EIPs#212
pirapira added a commit to pirapira/yellowpaper that referenced this pull request Jan 19, 2018
As described in ethereum/EIPs#212
pirapira added a commit to pirapira/yellowpaper that referenced this pull request Jan 19, 2018
As described in ethereum/EIPs#212
pirapira added a commit to pirapira/yellowpaper that referenced this pull request Jan 19, 2018
As described in ethereum/EIPs#212
@holgerd77 holgerd77 mentioned this pull request Jun 25, 2020
15 of 15 tasks complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

9 participants
You can’t perform that action at this time.