I am implementing Bulletproofs over Ristretto255. (I am using libsodium, so can't switch to another Elliptic Curve implementation.)

I need to implement zero knowledge verification of elliptic curve operations, with the ultimate intention of using these to implement with these more advanced operations like EdDSA and (Pedersen) hashing.

In order to do this, I need to choose an elliptic curve whose scalar field is the size of the Ristretto group.

Looking at the literature, I see that others who have tried to build such elliptic curve verification proofs use either BLS12-381 for the underlying scalar, and build Jubjub on top of it, or use BN254 for the underlying scalar, and build Baby Jubjub on top of it. As I am forced to use Ristretto255 for the underlying scalar, what would be a good and safe choice of elliptic curve to build on top of it (replacing Jubjub or Baby Jubjub in the examples given)?

I'll remark that the use of BN254 and BLS12-381 is typically in the context of zk-SNARKs, where you need the underlying elliptic curve used for the scalars to be a pairing-friendly elliptic curve. I am using Bulletproofs, so don't have this constraint.

Many thanks for any help or any helpful pointers.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.