Pre-compile for BLS

EIPs
1

Currently the EVM has no support for BLS signatures, there was a proposed eip although I don’t believe it made it in (or if it will make it in). Having the ability to perform on-chain BLS operations can be quite useful, especially since these curves are becoming increasingly popular in the rest of the blockchain world. More importantly, this would be an immense benefit for eth2.0.

Currently, the eth2.0 deposit contract is able to verify a deposit is correct, except for the actual signature. This means that if a user submits an invalid deposit they risk losing their 32 eth deposit. With a BLS pre-compile we could verify the deposits on-chain before the deposit occurs so users to do not burn there funds.

If this is somehing that would be considered I’m happy to draft the EIP ASAP. If there are suggested additions to this EIP (to make it more generalized, like the linked EIP) than I would also be happy to do that as well.

Counter argument: People will use eth2 software to ensure it is formed correctly.
Response: I’d rather be safe than sorry. We don’t need to do another bailout.

2

Why cannot you do it with the existing precompile?

3

I believe the cost of performing this verification is inherently expensive. Do you know the gas costs?

4

This precompile will add support for the BLS12-381 curve (https://electriccoin.co/blog/new-snark-curve/) we are using in eth2.0. We do happen to be using the BLS signature scheme over this curve and most of the relevant pieces (except “hash to curve”) could be done in a smart contract w/ the appropriate precompiles for the BLS12-381 curve ops.

5

This thread is listed as the discussion thread for EIP-3068 Precompile for BN256 HashToCurve Algorithms, which is proposal for Pectra.

I disagree with EIP-3068 as-is.

Since 2020, the IETF has standardized hashing-to-curve: Hashing to Elliptic Curves

The EIP-3068 would be doing “encode-to-curve” of the spec instead of hash-to-curve. The implementation difference is minimal, hash-to-curve samples 2 points and sum them to combat bias in the random distribution.

image
image1070×591 71 KB

Implementations: