Precompile for BN256 HashToCurve Algorithms

Status history

1. Draft23 Oct 2020
2. ⋯Stagnantdate not observed

Abstract

There is currently no inexpensive way to perform BLS signature verification for arbitrary messages. This stems from the fact that there is no precompiled contract in the EVM for a hash-to-curve algorithm for the BN256 elliptic curve. The gas cost of calling a deterministic hash-to-curve algorithm written in Solidity is approximately that of one pairing check, although the latter requires an order…