 HackMD
To implement BN254 precomiles in EVM circuit seesm to be impratical (probably fine to do add but definitely not fine for scalar mul or pairing), so we could delegate the computation to another sub-circuit and communicate the input by bn254_table. First we need to estimate how many different input could happen inside a single block (30M gas):
| Operation | Gas Cost | Maximum Different Input | Row Cost [1] |
|---|---|---|---|
BN254Add |
≥ 100 + 150 |
≤ 120000 ≈ 216.87 |
257 ≈ 28.01 |
BN254SalarMul |
≥ 100 + 6000 |
≤ 4919 ≈ 212.26 |
41880 ≈ 215.35 |
BN254Pairing |
≥ 100 + 45000 |
≤ 666 ≈ 29.38 |
? |
The maximum different input seems small enough to be packed into a single table.
But there is a problem, the pairing input could be variale size, for the table we could simply use RLC the sync the bytes, but for the BN254 circuit it needs to be able to handle variable size input.
So we could follow the Keccak circuit design, to repeat the region add_gt_or_pairing but the row cost of this region will limit how many pairing operation we could do (or we just have more BN254 circuit to reach the maximum different input).
Row cost is estimated using https://github.com/privacy-scaling-explorations/halo2wrong/tree/v2 and it should be easily extended by allocating more advice columns. ↩︎
