# Elliptic curve cycles

Halo2 designed a cycle of elliptic curves, Pallas and Vesta (referred as the "Pasta" curves), which form a circle with one another. That is, the base field of the Pallas curve is the scalar field of the Vesta curve and viceversa. When we say that a curve $E$ is over a particular field, this is the base field of the curve.

Validity predicates are instantiated over the Pallas curve. We'll notate this curve as $E_{pallas}$ and we'll refer to this curve as the "inner" curve. We'll also notate its base field as $\mathbb{F}_p$ and its scalar field as $\mathbb{F}_q$. That is, given a point $P = (x, y) \in E_{pallas}$, $x, y \in \mathbb{F}_p$ and for any scalar multiplication $a \cdot P, a \in \mathbb{F}_q$. The "outer" curve in our case is the Vesta curve $E_{vesta}$. In broad terms, the prover's circuit is based on the inner curve $E_{pasta}$ and the verifier circuit is based on the outer curve $E_{vesta}$.

The arithmetic of the $E_{pallas}$ curve is over $\mathbb{F}_q$, whereas the arithmetic of the $E_{vesta}$ curve is over $\mathbb{F}_p$. To understand the reason behind this as well as the need to introduce $E_{vesta}$ in the first place, we need to review a bit about these proving systems. A validity predicate is a particular type of circuit which returns a boolean value. A a circuit can be arithmetised using its trace:

Using interpolation from these trace values, we'll be able to create a polynomial $f(X)$ which encodes the circuit. Without loss of generality, this will be of the form $f(x) := a_n \cdot x^n + ... + a_1 \cdot x + a_0$. A commitment to $f$ consists of the multiplication of the polynomial by a generator point of the Pallas curve. That is, $Com(f) := f \cdot G = [ a_n \cdot G, ..., a_1 \cdot G, a_0 \cdot G]$. Since these are scalar multiplications on a point $G \in E_{pallas}$, this implies that $a_i \in \mathbb{F}_q, \forall i\in \{0, ..., n\}$.

Thus, having a circuit over $E_{pallas}$ allows us to prove statements about $\mathbb{F}_q$-arithmetic circuit satisfiability, that is, we do arithmetic over its scalar field.

The proof of the validity predicate consists on a bunch of points of the Pallas curve $E_{pallas}$. To verify the proof, the verifier will need to perform group operations on these points (the points of an elliptic curve form a group). These operations like point doubling and addition use arithmetic in the base field $\mathbb{F}_p$ of $E_{pallas}$, since the coordinates of points are in $\mathbb{F}_p$. So we need a curve to do operations on $\mathbb{F}_p$, that is, a curve whose scalar field is $\mathbb{F}_p$. This curve in Halo2 is the Vesta curve, and has the additional benefit of having $\mathbb{F}_q$ as its base field. This allows us to recursively proof circuits.