{"id":13532109,"url":"https://github.com/zkcrypto/bls12_381","last_synced_at":"2025-04-01T20:31:20.933Z","repository":{"id":34081715,"uuid":"169515439","full_name":"zkcrypto/bls12_381","owner":"zkcrypto","description":"Implementation of the BLS12-381 pairing-friendly elliptic curve group","archived":false,"fork":false,"pushed_at":"2024-08-16T10:58:29.000Z","size":658,"stargazers_count":326,"open_issues_count":36,"forks_count":190,"subscribers_count":17,"default_branch":"main","last_synced_at":"2025-03-01T13:48:42.952Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zkcrypto.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-02-07T03:46:20.000Z","updated_at":"2025-03-01T13:40:32.000Z","dependencies_parsed_at":"2023-12-20T17:44:04.906Z","dependency_job_id":"2f8f52d2-9944-4e25-a9d4-08a88a4a4614","html_url":"https://github.com/zkcrypto/bls12_381","commit_stats":{"total_commits":147,"total_committers":18,"mean_commits":8.166666666666666,"dds":0.6734693877551021,"last_synced_commit":"7de7b9d9c509b9973b35a3241b74bbbea95e700a"},"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zkcrypto%2Fbls12_381","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zkcrypto%2Fbls12_381/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zkcrypto%2Fbls12_381/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zkcrypto%2Fbls12_381/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zkcrypto","download_url":"https://codeload.github.com/zkcrypto/bls12_381/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246709923,"owners_count":20821297,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T07:01:08.259Z","updated_at":"2025-04-01T20:31:15.923Z","avatar_url":"https://github.com/zkcrypto.png","language":"Rust","funding_links":[],"categories":["Rust","Cryptography"],"sub_categories":["Theorem"],"readme":"# bls12_381 [![Crates.io](https://img.shields.io/crates/v/bls12_381.svg)](https://crates.io/crates/bls12_381) #\n\nThis crate provides an implementation of the BLS12-381 pairing-friendly elliptic curve construction.\n\n* **This implementation has not been reviewed or audited. Use at your own risk.**\n* This implementation targets Rust `1.56` or later.\n* This implementation does not require the Rust standard library.\n* All operations are constant time unless explicitly noted.\n\n## RFC process\n\nThis crate follows the [zkcrypto RFC process](https://zkcrypto.github.io/rfcs/).\nIf you want to propose \"substantial\" changes to this crate, please\n[create an RFC](https://github.com/zkcrypto/rfcs) for wider discussion.\n\n## Features\n\n* `bits` (on by default): Enables APIs for obtaining bit iterators for scalars.\n* `groups` (on by default): Enables APIs for performing group arithmetic with G1, G2, and GT.\n* `pairings` (on by default): Enables some APIs for performing pairings.\n* `alloc` (on by default): Enables APIs that require an allocator; these include pairing optimizations.\n* `nightly`: Enables `subtle/nightly` which tries to prevent compiler optimizations that could jeopardize constant time operations. Requires the nightly Rust compiler.\n* `experimental`: Enables experimental features. These features have no backwards-compatibility guarantees and may change at any time; users that depend on specific behaviour should pin an exact version of this crate. The current list of experimental features:\n  * Hashing to curves ([Internet Draft v16](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-16))\n\n## [Documentation](https://docs.rs/bls12_381)\n\n## Curve Description\n\nBLS12-381 is a pairing-friendly elliptic curve construction from the [BLS family](https://eprint.iacr.org/2002/088), with embedding degree 12. It is built over a 381-bit prime field `GF(p)` with...\n\n* z = `-0xd201000000010000`\n* p = (z - 1)\u003csup\u003e2\u003c/sup\u003e(z\u003csup\u003e4\u003c/sup\u003e - z\u003csup\u003e2\u003c/sup\u003e + 1) / 3 + z\n\t* = `0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab`\n* q = z\u003csup\u003e4\u003c/sup\u003e - z\u003csup\u003e2\u003c/sup\u003e + 1\n\t* = `0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001`\n\n... yielding two **source groups** G\u003csub\u003e1\u003c/sub\u003e and G\u003csub\u003e2\u003c/sub\u003e, each of 255-bit prime order `q`, such that an efficiently computable non-degenerate bilinear pairing function `e` exists into a third **target group** G\u003csub\u003eT\u003c/sub\u003e. Specifically, G\u003csub\u003e1\u003c/sub\u003e is the `q`-order subgroup of E(F\u003csub\u003ep\u003c/sub\u003e) : y\u003csup\u003e2\u003c/sup\u003e = x\u003csup\u003e3\u003c/sup\u003e + 4 and G\u003csub\u003e2\u003c/sub\u003e is the `q`-order subgroup of E'(F\u003csub\u003ep\u003csup\u003e2\u003c/sup\u003e\u003c/sub\u003e) : y\u003csup\u003e2\u003c/sup\u003e = x\u003csup\u003e3\u003c/sup\u003e + 4(u + 1) where the extension field F\u003csub\u003ep\u003csup\u003e2\u003c/sup\u003e\u003c/sub\u003e is defined as F\u003csub\u003ep\u003c/sub\u003e(u) / (u\u003csup\u003e2\u003c/sup\u003e + 1).\n\nBLS12-381 is chosen so that `z` has small Hamming weight (to improve pairing performance) and also so that `GF(q)` has a large 2\u003csup\u003e32\u003c/sup\u003e primitive root of unity for performing radix-2 fast Fourier transforms for efficient multi-point evaluation and interpolation. It is also chosen so that it exists in a particularly efficient and rigid subfamily of BLS12 curves.\n\n### Curve Security\n\nPairing-friendly elliptic curve constructions are (necessarily) less secure than conventional elliptic curves due to their small \"embedding degree\". Given a small enough embedding degree, the pairing function itself would allow for a break in DLP hardness if it projected into a weak target group, as weaknesses in this target group are immediately translated into weaknesses in the source group.\n\nIn order to achieve reasonable security without an unreasonably expensive pairing function, a careful choice of embedding degree, base field characteristic and prime subgroup order must be made. BLS12-381 uses an embedding degree of 12 to ensure fast pairing performance but a choice of a 381-bit base field characteristic to yield a 255-bit subgroup order (for protection against [Pollard's rho algorithm](https://en.wikipedia.org/wiki/Pollard%27s_rho_algorithm)) while reaching close to a 128-bit security level.\n\nThere are [known optimizations](https://ellipticnews.wordpress.com/2016/05/02/kim-barbulescu-variant-of-the-number-field-sieve-to-compute-discrete-logarithms-in-finite-fields/) of the [Number Field Sieve algorithm](https://en.wikipedia.org/wiki/General_number_field_sieve) which could be used to weaken DLP security in the target group by taking advantage of its structure, as it is a multiplicative subgroup of a low-degree extension field. However, these attacks require an (as of yet unknown) efficient algorithm for scanning a large space of polynomials. Even if the attack were practical it would only reduce security to roughly 117 to 120 bits. (This contrasts with 254-bit BN curves which usually have less than 100 bits of security in the same situation.)\n\n### Alternative Curves\n\nApplications may wish to exchange pairing performance and/or G\u003csub\u003e2\u003c/sub\u003e performance by using BLS24 or KSS16 curves which conservatively target 128-bit security. In applications that need cycles of elliptic curves for e.g. arbitrary proof composition, MNT6/MNT4 curve cycles are known that target the 128-bit security level. In applications that only need fixed-depth proof composition, curves of this form have been constructed as part of Zexe.\n\n## Acknowledgements\n\nPlease see `Cargo.toml` for a list of primary authors of this codebase.\n\n## License\n\nLicensed under either of\n\n * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)\n * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)\n\nat your option.\n\n### Contribution\n\nUnless you explicitly state otherwise, any contribution intentionally\nsubmitted for inclusion in the work by you, as defined in the Apache-2.0\nlicense, shall be dual licensed as above, without any additional terms or\nconditions.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzkcrypto%2Fbls12_381","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzkcrypto%2Fbls12_381","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzkcrypto%2Fbls12_381/lists"}