Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Precompile 0x08 ecPairing #364

Open
Tracked by #856
Eikix opened this issue Dec 9, 2022 · 4 comments
Open
Tracked by #856

feat: Precompile 0x08 ecPairing #364

Eikix opened this issue Dec 9, 2022 · 4 comments
Labels
Context: isolated no previous knowledge of the codebase required

Comments

@Eikix
Copy link
Member

Eikix commented Dec 9, 2022

Feature Request

Describe the Feature Request

feat: Explore / propose strategy (if applicable, MVP implementation) for EVM Precompiled contract -> 0x08 ecPairing

https://www.evm.codes/precompiled

@Eikix Eikix added Difficulty: hard Context: isolated no previous knowledge of the codebase required labels Dec 9, 2022
@Eikix Eikix added this to the Kakarot v0.3 milestone Dec 9, 2022
@feltroidprime
Copy link
Contributor

feltroidprime commented Dec 14, 2022

alt_bn128 pairing logic is implemented in this file https://github.com/tekkac/cairo-alt_bn128/blob/c2ec87cc9b57846f2d89861f77b4bee69e2a5720/alt_bn128_pair.cairo#L143-L167 , the main part being the Miller loop, but it uses unsafe hints from this file https://github.com/tekkac/cairo-alt_bn128/blob/main/alt_bn128_gt.cairo

The author originally thought these hints could be verified in Cairo like for ec_add and ec_mul, but this is another type of ellipitic curve the same tricks don't apply here.
Native implementation (without hints + verification) implies arithmetics over FQ12 which are very costly.
Nethermind has a more advanced implementation of the miller loop for bls12-381 https://github.com/NethermindEth/optimized_ecc_cairo/blob/main/lib/pairing.cairo , but the miller loop is ~1 million step per iteration, with tens of iterations at minimum.

The smartest move would be to discover if a hint can be used with a small verification cost, but this requires much deeper knowledge of maths, and we don't have the certainty that it is even possible.

@feltroidprime
Copy link
Contributor

feltroidprime commented Dec 14, 2022

In fact in https://github.com/tekkac/cairo-alt_bn128/blob/main/alt_bn128_gt.cairo, There might be a trick to verify the hint of gt_line_slope though, but not the arithmetics like fq12_mul .

@tekkac
Copy link

tekkac commented Dec 15, 2022

I wrote the code above and I plan to work on it more soon.
My idea is to use a larger field to verify the mutiplication using a new hint (polynomial division).
It would increase the number of steps though, but we might get away with it.
Will report back.

@Eikix
Copy link
Member Author

Eikix commented Dec 15, 2022

Awesome!! Thank you for your input

@ClementWalter ClementWalter changed the title feat: Explore / propose strategy (if applicable, MVP implementation) for EVM Precompiled contract -> 0x08 ecPairing feat: Precompile 0x08 ecPairing Dec 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Context: isolated no previous knowledge of the codebase required
Projects
Status: 🆕 Backlog
Development

No branches or pull requests

3 participants