26 July 2024 | Simon Masson, Antonio Sanso, Zhenfei Zhang
This paper introduces Bandersnatch, a new elliptic curve designed over the BLS12-381 scalar field. The curve features an efficient endomorphism, enabling a fast scalar multiplication algorithm. Benchmarking results show that Bandersnatch offers a 42% faster multiplication, a 21% reduction in circuit size for rank 1 constraint systems (R1CS), and a 10% reduction in Plonk circuit compared to the Jubjub curve, which has similar properties. The Jubjub curve, introduced by the ZCash team, is not pairing-friendly but is used in various zero-knowledge proof systems. Bandersnatch addresses the slow scalar multiplication issue of Jubjub by leveraging the GLV method, which requires an efficiently computable endomorphism. The authors implemented Bandersnatch in Rust using the Arkworks framework and released the code to the open domain. The paper also demonstrates how Bandersnatch can improve the efficiency of zero-knowledge proof systems, particularly in terms of the number of constraints required for group multiplication in R1CS and Plonk circuits.This paper introduces Bandersnatch, a new elliptic curve designed over the BLS12-381 scalar field. The curve features an efficient endomorphism, enabling a fast scalar multiplication algorithm. Benchmarking results show that Bandersnatch offers a 42% faster multiplication, a 21% reduction in circuit size for rank 1 constraint systems (R1CS), and a 10% reduction in Plonk circuit compared to the Jubjub curve, which has similar properties. The Jubjub curve, introduced by the ZCash team, is not pairing-friendly but is used in various zero-knowledge proof systems. Bandersnatch addresses the slow scalar multiplication issue of Jubjub by leveraging the GLV method, which requires an efficiently computable endomorphism. The authors implemented Bandersnatch in Rust using the Arkworks framework and released the code to the open domain. The paper also demonstrates how Bandersnatch can improve the efficiency of zero-knowledge proof systems, particularly in terms of the number of constraints required for group multiplication in R1CS and Plonk circuits.