Skip to content

Prime order/subgroup check missing on BLS12-377(short_weierstrass) ProofVars (allocated as Witness) #199

@sidhujag

Description

@sidhujag

Is this correct? it seems like a placeholder but ge == ge is always true, should it not ensure r * ge == 0? I found BLS12-377 G2, proof.b inside the recursive circuit using proof vars will not have proper prime-order/subgroup checks as it falls in this path.

ge.enforce_equal(&ge)?;

I think the fix it literally:

} else {
    ge.negate()?.enforce_equal(&result)?;
    Ok(ge)
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions