diff --git a/neps/nep-0488.md b/neps/nep-0488.md index 890d85d48..acd7a121d 100644 --- a/neps/nep-0488.md +++ b/neps/nep-0488.md @@ -16,7 +16,7 @@ A pre-compiled NEAR runtime functions for operations on BLS12-381 curve. It is a ## Motivation -The BLS12-381 [[1](https://www.researchgate.net/publication/2894224_Constructing_Elliptic_Curves_with_Prescribed_Embedding_Degrees), [11](https://hackmd.io/@benjaminion/bls12-381), [52](https://eprint.iacr.org/2019/403.pdf)] is a wildly +The BLS12-381[^1], [11](https://hackmd.io/@benjaminion/bls12-381), [52](https://eprint.iacr.org/2019/403.pdf)] is a wildly used[[2](https://zips.z.cash/protocol/protocol.pdf),[3](https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md), [4](https://internetcomputer.org/docs/current/references/ic-interface-spec#certificate), [5](https://wiki.tezosagora.org/learn/futuredevelopments/layer2#zkchannels), [6](https://spec.filecoin.io/), [7](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-09#name-adoption-status-of-pairing-)] elliptic curve with 120+ bits of security[[8](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-09#section-4.2.1)] which support **the *pairing* operation*.* It is a good alternative for bn254 elliptic curve[[9](https://eprint.iacr.org/2005/133), [12](https://hackmd.io/@jpw/bn254)], which also supports the aggregation, and is currently implemented as NEAR precompiles[[10](https://github.com/near/NEPs/issues/98)]. Recent research shows that it contains only <100 bits of security[[13](https://www.ietf.org/archive/id/draft-irtf-cfrg-pairing-friendly-curves-02.html#name-for-100-bits-of-security)] and we can see the tendency of switching from bn254 to bls12-381(ZCash[[14](https://electriccoin.co/blog/new-snark-curve/)], Ethereum[[15](https://eips.ethereum.org/EIPS/eip-2537)], Tezos[[16](https://medium.com/metastatedev/meanwhile-at-cryptium-labs-2-part-2-adding-the-pairing-equipped-elliptic-curve-bls12-381-to-tezos-cfce907e4be3)]). The implementation of BLS12-381 curve operations from this NEP as a precompile will allows effective verify the BLS-signature and zkSNARKs. At the moment, BLS signature verification for BLS12-381 is impossible due to the limitation of the gas in 300 TGas for one transaction. @@ -1220,7 +1220,7 @@ The previous NEP for supporting BLS signature based on BLS12-381[[26](https://gi ## References -1. BLS 2002 [https://www.researchgate.net/publication/2894224_Constructing_Elliptic_Curves_with_Prescribed_Embedding_Degrees](https://www.researchgate.net/publication/2894224_Constructing_Elliptic_Curves_with_Prescribed_Embedding_Degrees) +[^1]: BLS 2002 [https://www.researchgate.net/publication/2894224_Constructing_Elliptic_Curves_with_Prescribed_Embedding_Degrees](https://www.researchgate.net/publication/2894224_Constructing_Elliptic_Curves_with_Prescribed_Embedding_Degrees) 2. ZCash protocol: [https://zips.z.cash/protocol/protocol.pdf](https://zips.z.cash/protocol/protocol.pdf) 3. Ethereum 2 specification: [https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md](https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md) 4. Dfinity: [https://internetcomputer.org/docs/current/references/ic-interface-spec#certificate](https://internetcomputer.org/docs/current/references/ic-interface-spec#certificate)