BLS12-381 final exponentiation

[jonathanpwang]

I just want to check if the bls12381 final_exponentiate is supposed to be just ** ((p^12 - 1)/r). I had tried a comparison with just naive exponentiation (which I hope I did correctly) and it did not match. If it is intended to match, then I will try to find a reproducible example.

[kilic]

@jonathanpwang the final exp in the implementation follows https://eprint.iacr.org/2020/875.pdf and exponent should be ** ((p^12 - 1)/r) * s where s = 3. I prepared a test below for crosschecking.

    #[test]
    fn test_finalexp_bls12() {
        // python
        // r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
        // q = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
        // d = (q**12 - 1) // r
        // s = 3
        // print(hex(s*d))
        let e = BigUint::from_str_radix("8ca592196587127a538fd40dc3e541f9dca04bb7dc671be77cf17715a2b2fe3bea73dfb468d8f473094aecb7315a664019fbd84913caba6579c08fd42009fe1bd6fcbce15eacb2cf3218a165958cb8bfdae2d2d54207282314fc0dea9d6ff3a07dbd34efb77b732ba5f994816e296a72928cfee133bdc3ca9412b984b9783d9c6aa81297ab1cd294a502304773528bbae8706979f28efa0d355b0224e2513d6e4a5d3bb4dde0523678105d9167ff1323d6e99ac312d8a7d762336370c4347bb5a7e405d6f3496b2dd38e722d4c1f3ac25e3167ec2cb543d69430c37c2f98fcdd0dd36caa9f5aa7994cec31b24ed5e515911037b376e521070d29c9d56cfa8c3574363efb20f28c19e4105ab99edd44084bd23725017931d6740bda71e5f07600ce6b407e543c4bc40bcd4c0b600e6c98003bf8548986b14d9098746dc89d154af91ad54f337b31c79222145dd3ed254fdeda0300c49ebcd2352765f533883a3513435f3ee452496f5166c25bf503bd6ec0a0679efda3b46ebf86211d458de749460d4a2a19abe6ea2accb451ab9a096b98465d044dc2a7f86c253a4ee57b6df108eff598a8dbc483bf8b74c2789939db85ffd7e0fd55b32bc26877f5be26fa7d750500ce2fab93c0cbe7336b126a5693d0c16484f37addccc7642590dbe98538990b88637e374d545d9b34b67448d0357e60280bbd8542f1f4e813caa8e8db57364b4e0cc14f35af381dd9b71ec9292b3a3f16e42362d2019e05f30", 16);
        let e = e.unwrap();

        let g1 = G1Affine::generator();
        let g2 = G2Affine::generator();
        let ml = Bls12381::multi_miller_loop(&[(&g1, &g2)]);

        let r0 = ml.final_exponentiation();
        let r1 = ml.pow(&e.to_u64_digits());
        assert_eq!(r0.0, r1);
    }

Also see:
https://github.com/Consensys/gnark-crypto/blob/97d69dcde082a20847e16ba29bce35e9bfde0261/ecc/bls12-381/pairing.go#L52

[jonathanpwang]

@kilic ah thank you!

Apologies if I missed it, but could we add a comment above the final exp function noting this -- I had tried to find an indication of this but couldn't.