Skip to content

Commit

Permalink
fix Motivation section
Browse files Browse the repository at this point in the history
  • Loading branch information
olga24912 committed Nov 29, 2023
1 parent cdc7484 commit 7667596
Showing 1 changed file with 11 additions and 10 deletions.
21 changes: 11 additions & 10 deletions neps/nep-0488.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,15 +37,15 @@ we must efficiently verify BLS signatures based on BLS12-381, as these are the s

In this NEP, we propose to add the following host functions:

- ***bls12381_g1_sum —*** sum the signed points from $G_1$ on an elliptic curve. This function is useful for the aggregation of public keys in BLS Signature. It can be used for simple addition in $G_1$. Separate from the multiexp function due to the gas cost.
- ***bls12381_g2_sum —*** sum the signed points from $G_2$ on an elliptic curve. This function is useful for the aggregation of signatures in BLS Signature. It can be used for simple addition in $G_2$. Separate from the multiexp function due to the gas cost.
- ***bls12381_g1_multiexp —*** for points $g_i \in G_1$ and scalars $s_i$ calculate $\sum g_i s_i$. It can be used to multiply a group element by a scalar.
- ***bls12381_g2_multiexp —*** for points $g_i \in G_2$ and scalars $s_i$ calculate $\sum g_i s_i$. It can be used to multiply a group element by a scalar.
- ***bls12381_map_fp_to_g1 —*** maps base field element into the $G_1$ point. It does not perform mapping of the byte string into field elements.
- ***bls12381_map_fp2_to_g2 —*** maps extension field element into the $G_2$ point. It does not perform mapping of the byte string into extension field elements. We require this function to efficiently map a message into a group element. We don't implement hash_to_field[^60] function, because it can be done inside a contract and different hashing algorithms can be used.
- ***bls12381_decompress_g1 —*** decompresses the points from $G_1$ provided in the compressed form. Some protocols provide points on the curve in the compressed form (e.g., the light client updates in Ethereum 2.0), and decompressing is a time-consuming operation. All the other functions in this NEP accept only decompressed points to be simple and to have optimized gas consumption.
- ***bls12381_g1_sum —*** sum the signed points from $G_1$ on an elliptic curve. This function is useful for aggregating public keys in BLS Signature. It can be employed for simple addition in $G_1$. It is kept separate from the multiexp function due to gas cost considerations.
- ***bls12381_g2_sum —*** sum the signed points from $G_2$ on an elliptic curve. This function is useful for aggregating signatures in BLS Signature.
- ***bls12381_g1_multiexp —*** for points $g_i \in G_1$ and scalars $s_i$ calculate $\sum g_i s_i$. This operation can be utilized to multiply a group element by a scalar.
- ***bls12381_g2_multiexp —*** for points $g_i \in G_2$ and scalars $s_i$ calculate $\sum g_i s_i$.
- ***bls12381_map_fp_to_g1 —*** maps a base field element into the $G_1$ point. It does not perform the mapping of the byte string into field elements.
- ***bls12381_map_fp2_to_g2 —*** maps an extension field element into the $G_2$ point. It does not perform the mapping of the byte string into extension field elements. We need this function to efficiently map a message into a group element. We are not implementing the hash_to_field[^60] function because it can be executed within a contract and various hashing algorithms can be applied.
- ***bls12381_decompress_g1 —*** decompresses the points from $G_1$ provided in the compressed form. Certain protocols offer points on the curve in compressed form (e.g., the light client updates in Ethereum 2.0), and decompression is a time-consuming operation. All the other functions in this NEP only accept decompressed points for simplicity and optimized gas consumption.
- ***bls12381_decompress_g2 —*** decompresses the points from $G_2$ provided in the compressed form.
- ***bls12381_pairing_check —*** verifying that $\prod e(p_i, q_i) = 1$, where $e$ is a pairing operation and $p_i \in G_1 \land q_i \in G_2$. Used to verify BLS signatures or zkSNARKs.
- ***bls12381_pairing_check —*** verifying that $\prod e(p_i, q_i) = 1$, where $e$ is a pairing operation and $p_i \in G_1 \land q_i \in G_2$. This function is used to verify BLS signatures or zkSNARKs.

Functions required for verifying BLS signatures[^59]:

Expand All @@ -66,8 +66,9 @@ Both zkSNARKs and BLS signatures can be implemented alternatively by swapping G1
Therefore, all functions have been implemented for both G1 and G2.

An analogous proposal, EIP-2537[^15], exists in Ethereum.
The functions here have been designed considering compatibility with Ethereum's proposal.
This design approach aims to ensure future ease in supporting corresponding precompiles for Aurora[^24].
The functions here have been designed with compatibility
with Ethereum's proposal in mind. This design approach aims
to ensure future ease in supporting corresponding precompiles for Aurora[^24].

## Specification

Expand Down

0 comments on commit 7667596

Please sign in to comment.