Multi-pairing with provable pairing

[shramee]

Hi guys,

I think millerLoopAndFinalExpResult should do the most optimised circuit for (emulated?) Pairings.
I was wondering why this one doesn't support multiple pairings..?

i.e. Instead of,

func (pr Pairing) IsMillerLoopAndFinalExpOne(P *G1Affine, Q *G2Affine, previous *GTEl) frontend.Variable {

why don't we have P and Q as arrays in in the main pairing func?

func (pr Pairing) IsMillerLoopAndFinalExpOne(P []*G1Affine, Q []*G2Affine, previous *GTEl) frontend.Variable {

@yelhousni @ivokub

[ivokub]

Internally, in case of multi pairing check the algorithm is:

accumulator := Ext12.One()
for _, pairs := inputs {
    millerLoopResult := pairing.MillerLoop(pairs.P, pairs.Q)
    accumulator = Ext12.Mul(millerLoopResult, accumulator)
}
toTargetGroup := finalExp(accumulator)
Ext12.AssertIsOne(toTargetGroup)

the method IsMillerLoopAndFinalExpOne combines the last Miller loop computation, accumulator multiplication and final exp check as a single method. It is very specific to Linea use case and normally not needed elsewhere. There we want to have flexibility in the number of pairs we want to allow in pairing check and then we need to perform miller loops and finalexps separately.

For generic multi pairing check you should use PairingCheck method which is the full algorithm.

[ivokub]

If you want to have a look how we do it in Linea, then you can check here https://github.com/Consensys/linea-monorepo/tree/main/prover/zkevm/prover/ecpair. We currently don't have published the full documentation which describes it further, but it will be probably soon.