Pairing over BLS12-381

Implementation of pairing over BLS12-381 in Noir. This uses the new BigNum library.

Usage

This library uses nargo 0.35.0 and BigNum library version 0.3.7.

To do a pairing define the 2 inputs of types G1Affine and G2Affine and apply the pairing. Example:

    let g = G1Affine::generator();

    let h = G2Affine::generator();

    let first_pairing = pairing(g.neg(), h);
    let second_pairing = pairing(g, h.neg());
    assert(first_pairing.eq(second_pairing));

Implementation

This codebase uses the zkcrypto repository as a referece: https://github.com/zkcrypto/bls12_381. This has also been used for tests and test values. The Noir implementation passes pairing & bilinearity tests obtained from the zkcrypto repo.

The BLS12-381 Fq field parameters comes from BigNum library and the type BLS12_381Fq in Fp2 follows the definition in the BigCurve library:

pub type BLS12_381Fq = BigNum<4, BLS12_381_Fq_Params>;

We define it here to not have to import the full BigCurve library.

Test

Run all tests

nargo test

Note that a good amount of the tests are commented out because they take a fair amount of time (20-30 min) to run. For example test_pairings_1 and test_bilinearity in pairings.nr.

Benchmarks

One pairing:

• "acir_opcodes": 2.441.154
• "circuit_size": 3.210.945

For code snippet:

fn main(p: G1Affine, q: G2Affine) {
    let res = pairing(p, q);
}

Related Noir work

• BLS12_381 Elliptic Curve Pairing and Signature Verification Library by @onurinanc: repo
• Noir BigCurve library: repo