Discussion:
Curve cycles
(too old to reply)
Jeff Burdges
2018-08-18 12:28:46 UTC
Permalink
Is anyone actively working on cycles of pairing friendly elliptic curves?

In other words, each curve’s field of definition is the scalar field of it’s predecessor, which makes recursive composition of SNARKs not totally insane:
https://www.iacr.org/archive/crypto2014/86160202/86160202.pdf

I’d think you’d want to explore a lot of possible optimisations beyond that paper before trying to use something like this, so maybe someone has tried?

In practice, I’m unsure if recursively composed SNARKs really give you much since, if you want to add a SNARK layer, then you still need access to some large database, but.. that discussion might veer off topic for here.

Best,
Jeff

p.s. We’re hiring cryptographers at the web 3 foundation : https://web3.foundation/jobs
Michael Scott
2018-08-18 13:10:31 UTC
Permalink
I really don't expect any other cycles to be found, outside the simple MNT
case. The search for pairing-friendly curves is I suspect largely complete
at this stage.

Mike Scott
Post by Jeff Burdges
Is anyone actively working on cycles of pairing friendly elliptic curves?
In other words, each curve’s field of definition is the scalar field of
it’s predecessor, which makes recursive composition of SNARKs not totally
https://www.iacr.org/archive/crypto2014/86160202/86160202.pdf
I’d think you’d want to explore a lot of possible optimisations beyond
that paper before trying to use something like this, so maybe someone has
tried?
In practice, I’m unsure if recursively composed SNARKs really give you
much since, if you want to add a SNARK layer, then you still need access to
some large database, but.. that discussion might veer off topic for here.
Best,
Jeff
https://web3.foundation/jobs
_______________________________________________
Curves mailing list
https://moderncrypto.org/mailman/listinfo/curves
Loading...