search

privacy-scaling-explorations / halo2curves

Other
174 stars 141 forks source link

Bad subgroup check or cofactor clearing in G2 pluto #149

Closed kilic closed 7 months ago

kilic commented 7 months ago

Random point generation also clears cofactor just after finding a valid point on curve. In g2 of pluto it seems either cofactor clearing or subgroup check is not good. Reproduce with:

let point = G2::random(OsRng);
assert!(bool::from(point.is_on_curve()));
use group::cofactor::CofactorGroup;
assert!(bool::from(point.is_torsion_free()));