chore: Native curve audit - pairing by federicobarbacovi · Pull Request #21104 · AztecProtocol/aztec-packages

federicobarbacovi · 2026-03-04T13:23:32Z

🧾 Audit Context

ecc/curve audit: pairing. In this PR we add documentation and testing for pairings. We also rewrite the implementation of the Miller loop to follow standard references.

🛠️ Changes Made

Add testing for pairings
Add benchmarks for pairings
Add documentation + md file
Rewrite Miller loop implementation to follow standard reference (linked in code) --> No change in performance

Note: I tried implementing cyclotomic squaring but the result was not faster than the current implementation (it was slower). The problem is the inversion that is required to decompress the squaring (which were computed in compressed form). Even using a batch inversion trick didn't help. The paper I tried to implement is: https://eprint.iacr.org/2010/542.pdf

✅ Checklist

Audited all methods of the relevant module/class
Audited the interface of the module/class with other (relevant) components
Documented existing functionality and any changes made (as per Doxygen requirements)
Resolved and/or closed all issues/TODOs pertaining to the audited files
Confirmed and documented any security or other issues found (if applicable)
Verified that tests cover all critical paths (and added tests if necessary)
Updated audit tracking for the files audited (check the start of each file you audited)

📌 Notes for Reviewers

(Optional) Call out anything that reviewers should pay close attention to — like logic changes, performance implications, or potential regressions.

federicobarbacovi · 2026-03-04T13:59:44Z

@@ -239,12 +197,7 @@ template <typename quadratic_field, typename base_field, typename Fq12Params> cl
        };
    }



I tried implementing cyclotomic squaring as explained in https://eprint.iacr.org/2010/542.pdf (and use the squaring to compute powers). It wasn't faster than the current implementation. While squaring in compressed form uses fewer operations, decompression requires an inversion. During an exponentation, we need to decompress many times. I tried to use a batch inversion trick, but that stil didn't make the calculation faster. For this reason, I removed the implementation (which is present in the history of this branch) in favour of simpler code.

federicobarbacovi · 2026-03-04T16:17:20Z

-    file(GLOB_RECURSE TEST_SOURCE_FILES *.test.cpp)
-    file(GLOB_RECURSE BENCH_SOURCE_FILES *.bench.cpp)
-    file(GLOB_RECURSE FUZZERS_SOURCE_FILES *.fuzzer.cpp)
+    file(GLOB_RECURSE SOURCE_FILES CONFIGURE_DEPENDS *.cpp)


Auto re-discover some files. Discussed with @ludamad and he's ok with it

thanks, this is helpful!

notnotraju · 2026-03-06T10:50:13Z

    constexpr bool operator==(const field6& other) const { return c0 == other.c0 && c1 == other.c1 && c2 == other.c2; }
+
+    /**
+     * @brief Multiply a field6 element by a0 + a1 * v.


notnotraju · 2026-03-06T10:54:17Z

+    {
+        base_field A = a0 * c0;
+        base_field B = a1 * c1;
+        base_field C = Fq6Params::mul_by_non_residue(a1 * c2);


I won't complain if you change the name of the mul_by_non_residue method, it confused me!

notnotraju · 2026-03-06T10:59:59Z

-
-constexpr void final_exponentiation_easy_part(const fq12& elt, fq12& r);
+ *
+ * @details When calculating pairings, point operations are calculated via an ad-hoc method, so it's more sensible to


notnotraju

Looks great, thank you! A few tiny nits here and there.

BEGIN_COMMIT_OVERRIDE chore: Native curve audit - pairing (#21104) feat: batch hiding kernel and translator proofs (#21246) fix: remove obsolete KZG:masking_challenge from batched translator expected manifest (#21371) fix: add TLS alignment pad to fix x86_64-macos segfault (#21372) END_COMMIT_OVERRIDE

federicobarbacovi commented Mar 4, 2026

View reviewed changes

federicobarbacovi marked this pull request as ready for review March 4, 2026 16:15

federicobarbacovi commented Mar 4, 2026

View reviewed changes

federicobarbacovi self-assigned this Mar 4, 2026

federicobarbacovi requested review from Copilot and notnotraju and removed request for Copilot March 4, 2026 17:48

Copilot started reviewing on behalf of federicobarbacovi March 4, 2026 17:49 View session