2-Chain and 2-Cycle of Elliptic Curves

2-Chain of Elliptic Curves

Definition 1.

A 2-chain of elliptic curves is a list of two distinct curves E1/Fp1E_1 / \mathbb{F}_{p_1} and E2/Fp2E_2/ \mathbb{F}_{p_2} where p1p_1 divides #E2(Fp2)\#E_2(\mathbb{F}_{p_2}). The first curve is denoted the inner curve, while the second curve whose order is the characteristic of the inner curve, is denoted the outer curve.

SNARK-friendly 2-chains are composed of two curves that have subgroups of orders r1r_1 and r2r_2 where r1#E1(Fp1)r_1 | \#E_1(\mathbb{F}_{p_1}), r2#E2(Fp2)r_2 | \#E_2(\mathbb{F}_{p_2}) and r1r21mod2Lr_1 \equiv r_2 \equiv 1 \mod 2^L for a large integer LL (2-adicity). An example of a 2-chain for SNARK is composed of the inner curve BLS12-377 and the outer curve BW6-761.

2-Cycle of Elliptic Curves

Definition 2.

A 2-cycle of elliptic curves is a list of two distinct prime-order curves E1/Fp1E_1 / \mathbb{F}_{p_1}and E2/Fp2E_2/ \mathbb{F}_{p_2} where p1p_1 and p2p_2 are large primes where p1=#E2(Fp2)p_1 = \#E_2(\mathbb{F}_{p_2}) and p2=#E1(Fp1)p_2 = \#E_1(\mathbb{F}_{p_1}). Similarly to the definition of 2-chain, by SNARK-friendly 2-cycles we mean the cycles composed of two curves whose orders satisfy the following : #E1(Fp1)#E2(Fp2)1mod2L\#E_1(\mathbb{F}_{p_1}) \equiv \#E_2(\mathbb{F}_{p_2}) \equiv 1 \mod 2^L for a large integer LL (2-adicity).

A 2-cycle is a 2-chain where both curves are inner and outer curves with respect to each other.

Recursive SNARKs benefit significantly from the structure of a 2-cycle of elliptic curves. In recursive constructions, a proof generated over one elliptic curve needs to be verified inside a SNARK circuit that runs over another curve. A 2-cycle enables this by ensuring that each curve’s scalar field matches the group order of the other, allowing seamless recursion across curves. This mutual compatibility is essential for recursive proof composition and is used in systems like Halo2 and Nova.


Reference

Written by Carson Lee from A41

Last updated