search

penumbra-zone / decaf377

decaf377 is a prime-order group designed for use in SNARKs over BLS12-377
https://protocol.penumbra.zone/main/crypto/decaf377.html
12 stars 12 forks source link

Consider redefining decaf377 in terms of a new underlying curve #1

Closed hdevalence closed 9 months ago

hdevalence commented 3 years ago

https://eprint.iacr.org/2021/1152 proposes a new curve defined over the BLS12-381 scalar field called Bandersnatch. This curve has an endomorphism that allows use of the GLV method, making it faster in the software context (outside of a circuit).

Currently, decaf377 is defined in terms of the Edwards-on-BLS12-377 curve created as part of the Zexe paper. But there's no really compelling reason to use that curve in particular — unlike the scenario for ristretto255, there is not a large deployment base already using that curve.

So, instead, it might be better to try to apply the same techniques in the Bandersnatch paper to create a GLV-compatible Edwards curve defined over the BLS12-377 scalar field, and then define decaf377 in terms of that curve.

hdevalence commented 3 years ago

From the paper, it looks like they got lucky, finding a compatible curve that happens to have cofactor 4:

image

It would be good to find out if the search scripts can be adapted to the BLS12-377 case.

hdevalence commented 3 years ago

@asanso pointed to the script here: https://github.com/asanso/Bandersnatch/blob/main/python-ref-impl/small-disc-curves.py but suggested that there might not be any suitable curves for BLS12-377.