Skip to content

Prime order/subgroup check missing on BLS12-377(short_weierstrass) ProofVars (allocated as Witness) #199

@sidhujag

Description

@sidhujag

Is this correct? it seems like a placeholder but ge == ge is always true, should it not ensure r * ge == 0? I found BLS12-377 G2, proof.b inside the recursive circuit using proof vars will not have proper prime-order/subgroup checks as it falls in this path.

ge.enforce_equal(&ge)?;

I think the fix it literally:

} else {
    ge.negate()?.enforce_equal(&result)?;
    Ok(ge)
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions