By now the pairing engines for different types of pairing-friendly curves are implemented independently, resulting in five pieces of very similar code for the Ate pairing evaluation:
algebra/src/curves/models/bls12/mod.rs, ZEXE's generic implementation for BLS12 curves in affine coordinates,
algebra/src/curves/mnt6/mod.rs, ZEXE's specific implementation for the MNT6-298,
algebra/src/curves/sw6/mod.rs, another implementation for the Cocks-Pinch curve-782 of embedding degree 6 (ZEXE's outer curve with respect to the BLS12-377),
and our recent implementations for generic MNT4 curves, algebra/src/curves/models/mnt4/mod.rs, and MNT6 curves, algebra/src/curves/models/mnt6/mod.rs.
I propose a different level of abstraction, introducing twist2Ate and twist6Ate as pairing types according to the two representations of G2 as found in the above implementations: either as a subgroup of a quadratic twist (as for MNT4/6, mnt6, sw6) or sextic twist (BLS12) of the curve.
Both twist2Ate and twist6Ate need to allow the base field for the twist E' to be a general extension field of the same characteristic as the one for E - but the operations for the evaluation of the Ate paring are generic, i.e. independent of the degree of the base field for E'.
Such abstraction makes it possible to reuse these two types of pairing types, and to aggregate pairing evaluation code in an own folder (e.g. algebra/src/pairings/ ) separated from algebra/src/curves, which contain also non-pairing-friendly curves such as the JubJub.
In my opinion such a structure is more clear than the present. Moreover, it makes it is easier to find all the pairing code when extending the lib by further pairing types (which use cubic twists, e.g.).
By now the pairing engines for different types of pairing-friendly curves are implemented independently, resulting in five pieces of very similar code for the Ate pairing evaluation:
algebra/src/curves/models/bls12/mod.rs
, ZEXE's generic implementation for BLS12 curves in affine coordinates,algebra/src/curves/mnt6/mod.rs
, ZEXE's specific implementation for the MNT6-298,algebra/src/curves/sw6/mod.rs
, another implementation for the Cocks-Pinch curve-782 of embedding degree 6 (ZEXE's outer curve with respect to the BLS12-377),algebra/src/curves/models/mnt4/mod.rs
, and MNT6 curves,algebra/src/curves/models/mnt6/mod.rs
.I propose a different level of abstraction, introducing
twist2Ate
andtwist6Ate
as pairing types according to the two representations of G2 as found in the above implementations: either as a subgroup of a quadratic twist (as for MNT4/6, mnt6, sw6) or sextic twist (BLS12) of the curve. Bothtwist2Ate
andtwist6Ate
need to allow the base field for the twist E' to be a general extension field of the same characteristic as the one for E - but the operations for the evaluation of the Ate paring are generic, i.e. independent of the degree of the base field for E'.Such abstraction makes it possible to reuse these two types of pairing types, and to aggregate pairing evaluation code in an own folder (e.g.
algebra/src/pairings/
) separated fromalgebra/src/curves
, which contain also non-pairing-friendly curves such as the JubJub.In my opinion such a structure is more clear than the present. Moreover, it makes it is easier to find all the pairing code when extending the lib by further pairing types (which use cubic twists, e.g.).