Join Log in
Score:2
Michael avatar Crypto

What good elliptic curve uses a scalar field the size of the Ristretto255 group?

bm flag
Michael

I am implementing Bulletproofs over Ristretto255. (I am using libsodium, so can't switch to another Elliptic Curve implementation.)

I need to implement zero knowledge verification of elliptic curve operations, with the ultimate intention of using these to implement with these more advanced operations like EdDSA and (Pedersen) hashing.

In order to do this, I need to choose an elliptic curve whose scalar field is the size of the Ristretto group.

Looking at the literature, I see that others who have tried to build such elliptic curve verification proofs use either BLS12-381 for the underlying scalar, and build Jubjub on top of it, or use BN254 for the underlying scalar, and build Baby Jubjub on top of it. As I am forced to use Ristretto255 for the underlying scalar, what would be a good and safe choice of elliptic curve to build on top of it (replacing Jubjub or Baby Jubjub in the examples given)?

I'll remark that the use of BN254 and BLS12-381 is typically in the context of zk-SNARKs, where you need the underlying elliptic curve used for the scalars to be a pairing-friendly elliptic curve. I am using Bulletproofs, so don't have this constraint.

Many thanks for any help or any helpful pointers.

108
0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.