zcash-hackworks / bn

Pairing cryptography library in Rust

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Should we perform subgroup checks for G2?

snjax opened this issue · comments

https://github.com/paritytech/bn/blob/master/src/groups/mod.rs#L108 The check is here.
I have seen no the same checks in bellman_ce, go-ethereum, and ethereumj. But parity-ethereum (openethereum) is still using this costly check.

Obviously, we should not check the subgroup for G1 at the prime order curve. What about checking G2 subgroup before pairing?