You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the C implementation of the pippenger function, it mentions that;
/*
* Infinite point among inputs would be devastating. Shall we change it?
*/
Meaning that C function breaks if you provide the identity of the group among the inputs. It does not make sense to add it, as the identity scaled and added will not alter the answer, but it does imply that this function is unsafe without a proper check that the inputs do not include zero.
Now, the weird thing is, the rust bindings for blst do not make this check.
And indeed, if you add this identity to the inputs, the result of running this little test is that the msm indeed returns infinity and not the expected unchanged non-zero point:
let grouped_vks = p2_affines::from(transmuted_vks.as_slice());
let grouped_sigs = p1_affines::from(transmuted_sigs.as_slice());
If the transmuted_{vks/sigs} contains the identity element, both p2_affines::from() and p1_affines::from() will return the identity element (which may trivially satisfy conditions like signatures checks).
Actual behavior
If the transmuted_{vks/sigs} contains the identity element, both p2_affines::from() and p1_affines::from() convert all elements in the lists to identity elements.
Expected behavior
There should be no identity element in the signature and verification key list. Even if there is any, functions should not convert all elements to identity elements.
The text was updated successfully, but these errors were encountered:
Context & versions
In the C implementation of the pippenger function, it mentions that;
Meaning that C function breaks if you provide the identity of the group among the inputs. It does not make sense to add it, as the identity scaled and added will not alter the answer, but it does imply that this function is unsafe without a proper check that the inputs do not include zero.
Now, the weird thing is, the rust bindings for blst do not make this check.
And indeed, if you add this identity to the inputs, the result of running this little test is that the msm indeed returns infinity and not the expected unchanged non-zero point:
Steps to reproduce
These lines in /mithril-stm/src/multi_sig.rs are impacted:
If the
transmuted_{vks/sigs}
contains the identity element, bothp2_affines::from()
andp1_affines::from()
will return the identity element (which may trivially satisfy conditions like signatures checks).Actual behavior
If the
transmuted_{vks/sigs}
contains the identity element, bothp2_affines::from()
andp1_affines::from()
convert all elements in the lists to identity elements.Expected behavior
There should be no identity element in the signature and verification key list. Even if there is any, functions should not convert all elements to identity elements.
The text was updated successfully, but these errors were encountered: