There is a flaw in the spec in the context of the BLST library.
In the inputs to multiplication (both MUL
and MSM
) the spec allows scalars bigger than the main subgroup order q
, e.g. 2^256-1
. In the BLST implementation this case is handled by slower non-GLV multiplication implementation “added for formal completeness”. In other words, users can bypass GLV multiplication by sending nonsensical inputs.
if (check_mod_256(val.s, BLS12_381_r)) /* z^4 is the formal limit */
POINTonE1_mult_glv(out, a, val.s);
else /* should never be the case, added for formal completeness */
POINTonE1_mult_w5(out, a, scalar, nbits);
Found by @rodiazet.