### 1 unstable release

0.2.0 | Dec 22, 2021 |
---|

#**5** in #bls12-381

**63** downloads per month

Used in **3** crates
(2 directly)

**MIT/Apache**

325KB

8K
SLoC

**THIS CRATE IS A FORK OF https://github.com/zkcrypto/bls12_381 where the Dusk-Network team has added a variety of tools required by other libraries built on the top of this one.
The 99% of the library stills being done by @ebfull and you SHOULD NOT use this one unless you need a specific tool that we've
implemented and it's not on the original library.**

## Extra tools added to the original bls12_381 lib:

- Add serde support for every single data structure in the crate that is exported.
- Add various multiscalar_mul algorithms.
- Use

as a default feature.`std``&`endo - Impl Iter Sum & Product for Scalar.
- Implement random for Scalar.
- Implement XOR & AND for Scalar.
- Add base_4 conversion fn (no longer required).
- Impl Ord & PartialOrd for Scalar.
- Implement w_naf_scalar_mul (71% faster than the original double-and-add impl).
- Implement a reduce function wrapper for Scalar.
- Expose some Scarlar-related Constants as public.

This crate provides an implementation of the BLS12-381 pairing-friendly elliptic curve construction.

**This implementation has not been reviewed or audited. Use at your own risk.**- This implementation targets Rust

or later.`1.``36` - This implementation does not require the Rust standard library.
- All operations are constant time unless explicitly noted.

## Features

(on by default): Enables APIs for performing group arithmetic with G1, G2, and GT.`groups`

(on by default): Enables some APIs for performing pairings.`pairings`

(on by default): Enables APIs that require an allocator; these include pairing optimizations.`alloc`

: Enables`nightly`

which tries to prevent compiler optimizations that could jeopardize constant time operations. Requires the nightly Rust compiler.`subtle``/`nightly

: Enables optimizations that leverage curve endomorphisms, which may run foul of patents US7110538B2 and US7995752B2 set to expire in September 2020.`endo`

(on by default): Enables`parallel`

usage for higly parallelizable ops such as multiscalar multiplication.`rayon`

: Enables the usage of`canon`

for WASM-related serialization usages.`canonical`

## Documentation

## Curve Description

BLS12-381 is a pairing-friendly elliptic curve construction from the BLS family, with embedding degree 12. It is built over a 381-bit prime field

with...`GF``(`p`)`

- z =
`-``0xd201000000010000` - p = (z - 1)
^{2}(z^{4}- z^{2}+ 1) / 3 + z- =
`0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab`

- =
- q = z
^{4}- z^{2}+ 1- =
`0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001`

- =

... yielding two **source groups** G_{1} and G_{2}, each of 255-bit prime order

, such that an efficiently computable non-degenerate bilinear pairing function `q`

exists into a third `e`**target group** G_{T}. Specifically, G_{1} is the

-order subgroup of E(F`q`_{p}) : y^{2} = x^{3} + 4 and G_{2} is the

-order subgroup of E'(F`q`_{p2}) : y^{2} = x^{3} + 4(u + 1) where the extension field F_{p2} is defined as F_{p}(u) / (u^{2} + 1).

BLS12-381 is chosen so that

has small Hamming weight (to improve pairing performance) and also so that `z`

has a large 2`GF``(`q`)`^{32} primitive root of unity for performing radix-2 fast Fourier transforms for efficient multi-point evaluation and interpolation. It is also chosen so that it exists in a particularly efficient and rigid subfamily of BLS12 curves.

### Curve Security

Pairing-friendly elliptic curve constructions are (necessarily) less secure than conventional elliptic curves due to their small "embedding degree". Given a small enough embedding degree, the pairing function itself would allow for a break in DLP hardness if it projected into a weak target group, as weaknesses in this target group are immediately translated into weaknesses in the source group.

In order to achieve reasonable security without an unreasonably expensive pairing function, a careful choice of embedding degree, base field characteristic and prime subgroup order must be made. BLS12-381 uses an embedding degree of 12 to ensure fast pairing performance but a choice of a 381-bit base field characteristic to yield a 255-bit subgroup order (for protection against Pollard's rho algorithm) while reaching close to a 128-bit security level.

There are known optimizations of the Number Field Sieve algorithm which could be used to weaken DLP security in the target group by taking advantage of its structure, as it is a multiplicative subgroup of a low-degree extension field. However, these attacks require an (as of yet unknown) efficient algorithm for scanning a large space of polynomials. Even if the attack were practical it would only reduce security to roughly 117 to 120 bits. (This contrasts with 254-bit BN curves which usually have less than 100 bits of security in the same situation.)

### Alternative Curves

Applications may wish to exchange pairing performance and/or G_{2} performance by using BLS24 or KSS16 curves which conservatively target 128-bit security. In applications that need cycles of elliptic curves for e.g. arbitrary proof composition, MNT6/MNT4 curve cycles are known that target the 128-bit security level. In applications that only need fixed-depth proof composition, curves of this form have been constructed as part of Zexe.

## Acknowledgements

Please see

for a list of primary authors of this codebase.`Cargo .toml`

## License

Licensed under either of

- Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

### Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

#### Dependencies

~1–6MB

~105K SLoC