BN256 G2 operations inside the circuit

[mharishankar]

Hi,
We have implemented BLS public key additions and BLS signature verification with BN256 in our solidity smart-contract - Public keys are in G2 and hence public key aggregation operations are G2 additions, while signatures are in G1.

We are attempting to move the public key aggregations inside the snark as the BN256 G2 operations are gas expensive (https://github.com/musalbas/solidity-BN256G2) . However, I don't see support for this in the gnark repo, where only the twistededwards BN254 impl is available. Can you recommend a way to do this?

Thanks

[gbotrel]

Hello -- are you looking at doing BN256 Fp2 operations inside a BN256 Snark? If so, the field would be different, so unless I missed something in your goal, you would have to implement Fp2 arithmetic using the std/math/emulated package (develop branch), then point arithmetic.

[mharishankar]

hey @gbotrel did you have a chance to look at that commit? Can you weigh in on why it doesnt work / if im using the emulated arithmetic incorrectly?

[ivokub]

@mharishankar - I don't know if it is too late now, but I have implemented BN254 pairing in-circuit using field emulation. It may have relevant operations you are interested in. See #411

[yelhousni]

The BN254 Fp2 arithmetic inside a SNARK is now here https://github.com/ConsenSys/gnark/blob/develop/std/algebra/emulated/fields_bn254/e2.go

You can add the G2 arithmetic here: https://github.com/ConsenSys/gnark/blob/develop/std/algebra/emulated/sw_bn254/g2.go

[ivokub]

Some G2 arithmetic is in this PR: #629
It is still incomplete but you can get the gist.

[ivokub]

Tracking issue in #647