You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The bn128 G2 deserialization code does not ensure that the point is in the correct subgroup. This is resolved in Zcash (see zcash/zcash#1938) but is_well_formed and the deserialization code itself should be checking the order of the points it deserializes.
It's unclear to me how points outside the group affect the pairing.
The text was updated successfully, but these errors were encountered:
@tromer#42 is about something slightly different, the deserialization code doesn't check if it's on the curve, and checking if it's on the curve when you're verifying is a bit sketchy. This issue is about the check itself: it doesn't actually properly check if G2 elements are in the right subgroup.
The bn128 G2 deserialization code does not ensure that the point is in the correct subgroup. This is resolved in Zcash (see zcash/zcash#1938) but
is_well_formed
and the deserialization code itself should be checking the order of the points it deserializes.It's unclear to me how points outside the group affect the pairing.
The text was updated successfully, but these errors were encountered: