On proofs about elliptic curve elements and the BLS12-377/BW6-761 chain

[311923]

I am writing a proof that a certain relationship holds involving BLS12-377 elliptic curve group elements. Additionally, I had been hoping to use the BN254 curve with the plonk prover, so that I could use an existing trusted setup, such as the "perpetual powers of tau" or the setup done by zkSync.

However, I have found that gnark throws an error when it parses my circuit, mentioning that I must use BW6-761 because it is the outer curve of BLS12-377.

My two questions:

1. I had thought that the need to use BW6-761 arose mostly in terms of computing pairings in a SNARK. However, I get this inner curve-outer curve error even when proving a statement without pairings. Why is this?
2. Why does gnark throw an error in these circumstances, rather than simply compile a circuit with the size blow-up that is unavoidable?

Many thanks-

[ivokub]

The BLS12-377 implementation is native on BW6-761 in the sense that BLS12 base field corresponds to BW6 scalar field and all arithmetic can be done natively. If the underlying curve is not BW6 then we would have to perform non-native operations. It can definitely be done, but not very conveniently in automated manner. We use different types for native and non-native elements (frontend.Variable vs emulated.Element[FieldParams]), and it doesn't really well translate to unified implementation.

But if you are only interested in G1 curve operations, then we would definitely take a contribution. For that you would have to define BLS12-377 in https://github.com/Consensys/gnark/blob/master/std/math/emulated/emparams/emparams.go, then define the curve parameters in https://github.com/Consensys/gnark/blob/master/std/algebra/emulated/sw_emulated/params.go (take a,b from https://neuromancer.sk/std/bls/BLS12-377).

Actually, I think you should be able to do it without updating gnark - the implementations should be parametric enough that accepts user-provided field and curve params.