Public Goods RFP Proposal: P256 precompile support in the EVM

[clowes.eth]

@estmcmxci

If you don’t mind my asking, why is it necessary to use advanced cryptography in an L2?

I wouldn’t say its necessary, it just opens the door for developers to create novel applications that would be prohibitively expensive using the EVM.

@estmcmxci

The secp256r1 precompile is live, and I think it’d be worth considering in a roadmap for an ‘ENS Chain’. It would be a massive innovation (imho) if users could register their ENS using their biometric data.

Absolutely. My point was that previously we believed that only Arbitrum Orbit could offer the secp256r1 elliptic curve but as a result of this standardisation work any chain that implements this precompile could. RIPs are optional so it is not necessarily the case that all L2s will implement the precompile.

@estmcmxci

I’d love to stay informed about your research; do you have a newsletter or blog page that I can sign up for?

This is something we would like to do. Once we have some clarity on direction we will make a forum post

@NameSys

I am very curious about what sort of advanced cryptography is referred to here. Can you please elaborate? Thank you

Sure. Arbitrum have this super cool repo that links to some examples. Some that stand out are below:

• GitHub - jake-nyquist/stylus-p256-example: examples of a c p.256 signature verification implemented in arbitrum stylus. This is secp256r1
• GitHub - LimeChain/stylus-benchmark: Repostory for benchmarking Stylus vs EVM contracts outlines some benchmarks for ED25519 verify.
• GitHub - rauljordan/stylus-blst verification of Ethereum BLS signatures onchain
• GitHub - supernovahs/zk-sunade: Groth16 verifier on Arbitrum Stylus

[0xc0de4c0ffee]

It’s related to k1 vs r1 topics that we were following… r1 is more compatible with web2 services using new passkeys in browsers… *coz Chrome rejected k1 in webcrypto api.

Bug 29005 - Add support for secp256k1 curve · Issue #82 · w3c/webcrypto · GitHub

[NameSys]

@clowes.eth

@estmcmxci

If you don’t mind my asking, why is it necessary to use advanced cryptography in an L2?

I wouldn’t say its necessary, it just opens the door for developers to create novel applications that would be prohibitively expensive using the EVM.

I think the word “advanced” may have been used wrongly here which led to Marcus getting confused. Both ed25519 and secp256r1 curves are basic cryptography and not much different than secp256k1 at all; only difference is in the sampling of prime generator point(s) and consequently in available divisor subgroups (for BLS and ZKP). In terms of implementation, security or complexity, all are equivalent. Like @0xc0de4c0ffee mentioned, only real issue is compatibility. Web2 systems like using r1 whereas Satoshi led crypto on the path of k1 (for reasons that I do not agree with mathematically; r1 is negligibly more pre-quantum secure than k1 in my opinion). Other minor difference is that the r1 verifier doesn’t spit out public key for comparison but instead only relies on checking the validity of a given public key (I guess to avoid pubkey fingerprint rainbow-ing).

tl;dr It is not advanced cryptography, only a matter of web2 vs web3 standardisation; r1 and k1 are principally the same.

[estmcmxci]

Hey, I know a bit about cryptography myself! I actually drafted an ELI5 on @ulerdogan’s EIP, which led me down the rabbit hole of elliptic curve cryptography. Thanks, for elaborating on this though, it was very helpful!