This repository was archived by the owner on Nov 26, 2025. It is now read-only.
Add check for G2 membership in pairing-check, and test #386
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Our
pairing-checkfunction has a vulnerability: It can admit points outside of G2 which can be used to potentially forge a valid proof.For reviewers: you cannot simply forge points outside of the curve for G1 as the cofactor is 1, so any points lying on the curve must be in G1. However, G2 (
E(F_{p^2})) has a large cofactor and points can live in other subgroups whose order is notr=21888242871839275222246405745257275088548364400416034343698204186575808495617.In our test, we create a simple call to
pairing-checkthat trivializes it with points outside of G2, and show that it indeed fails after the pact 5.4 patch.PR checklist:
Additionally, please justify why you should or should not do the following: