Talks | يوسف

On the Security of Constraint-Friendly Map-to-Curve Relations

Wed, 27 May 2026 00:00:00 +0000

Standard hash-to-curve constructions first hash the message to a field element through a cryptographic hash-to-field step, then map this field element to an elliptic-curve point. Inside constraint systems, this inner cryptographic hash is often the dominant cost. Groth, Malvai, Miller and Zhang (Asiacrypt 2025) introduced constraint-friendly map-to-elliptic-curve-group relations that bypass this step, achieving substantial reductions in circuit size. Their security proof works in the Elliptic Curve Generic Group Model (EC-GGM).

We identify three gaps. First, the security bound in terms of the message space size $M$ and tweak bound $T$ is not explicitly analyzed, and the bounds stated for the concrete instantiations are loose. Second, the EC-GGM does not capture the algebraic structure of most deployed curves; we exhibit a concrete signature forgery using the parameters claimed secure. Third, the construction requires a congruence condition on the field that is not satisfied by all deployed curves; we extend it to any field.

As a countermeasure we propose a $y$-increment variant that neutralizes the algebraic attack, removes the field restriction, and preserves a comparable constraint count. We implement and benchmark both constructions in the open-source gnark (Go) library; the attack is additionally demonstrated via a self-contained SageMath simulation and confirmed at the circuit level against the authors’ own Noir (Rust) implementation.

Zero-Knowledge Proofs — The Bridge Between Cryptographic Theory and Blockchain Scalability

Thu, 15 Jan 2026 00:00:00 +0000

Fast Elliptic Curve Scalar Multiplications in SN(T)ARK Circuits

Wed, 01 Oct 2025 00:00:00 +0000

Proof systems of arbitrary computations have found many applications in recent years. However, the proving algorithm has a consequent complexity tied to the size of the computation being proved. Thus, proving large computations is quite inefficient. One of these large computations is the scalar multiplication over an elliptic curve. In this work, we provide new techniques for reducing the time corresponding to proving a scalar multiplication, using integer lattice reduction or a (half) extended Euclidean algorithm in a ring of integers. We investigate optimizations in the case of small (complex multiplication) discriminant curves, and its generalization for multi scalar multiplications as used in signature verification. We provide an optimized Golang implementation for different elliptic curves in different proof systems settings. The speed-up in proving time is between 22% and 53% compared to the previous state-of-the-art.

On pairing implementation

Thu, 24 Jul 2025 00:00:00 +0000

This talk was about implementing bilinear pairings, with focus on gnark-crypto optimizations. It covers the mathematical foundations of pairings, their applications in cryptography, and practical considerations for efficient implementation. The talk also discusses challenges faced during the implementation process and how they were addressed, providing insights into the complexities of working with advanced cryptographic primitives.

Zero-knowedge proofs and blockchains

Thu, 24 Apr 2025 00:00:00 +0000

In this presentation, we will explore the fascinating intersection of zero-knowledge proofs and blockchain technology. We will begin by demystifying zero-knowledge proofs, explaining their fundamental principles and tracing their evolution from theoretical primitives to practical tools in cryptography. Following this, we will delve into the world of blockchain, discussing its reliance on cryptographic techniques to ensure security and integrity. The core of the talk will focus on the necessity of zero-knowledge proofs in blockchain applications, addressing privacy and scalability concerns. We will highlight how blockchain technology has spurred significant advancements in zero-knowledge proof research, fostering collaboration between academia and industry. Finally, I will present my own contributions to the field, including the optimization of mathematical building blocks for zero-knowledge proofs and their concrete applications within blockchain systems. This presentation aims to provide a comprehensive understanding of the critical role zero-knowledge proofs play in enhancing blockchain technology and to share insights from cutting-edge research in this dynamic area.

Modern Applications of Cryptography

Sat, 12 Apr 2025 00:00:00 +0000

I helped organize the Cipher Challenge at UM6P College of Computing, a competition that brings together students from all over Morocco. The material I contributed can be found at: https://cipherchallenge.github.io/. I gave a keynote presentation that delves into the fascinating world of cryptography and its evolution from classical techniques to modern applications. This talk provides a comprehensive overview of how cryptography has been traditionally used for encryption and digital signatures, and then explores groundbreaking advancements that are shaping the future of secure communication and data protection. Throughout the talk, we provide concrete examples of how these cryptographic techniques are being utilized in popular platforms and technologies, including Playstation, TikTok, Apple, WhatsApp, and various blockchains such as Bitcoin and Ethereum. By the end of the session, the goal is for the attendees to have a deeper appreciation for the critical role cryptography plays in our digital world and the innovative ways it continues to evolve to meet new challenges.

Elliptic curves and SNARKs — Past, present and future.

Tue, 12 Nov 2024 00:00:00 +0000

Elliptic curves are used in many proof systems. Some systems (e.g. Bulletproofs) use plain curves (e.g. ed25519). Some (e.g. Groth16, KZG-PLONK) use pairing-friendly curves (e.g. BLS12-381). Some recursive systems require pairing-friendly 2-cycle (e.g. MNT4/6) or 2-chains (e.g. BLS12-377/BW6-761). Some other recursive/folding systems require plain 2-cycle (e.g. Pasta). In this talk we will go through the difference between these curves and why there isn’t a silver bullet curve for all scenarios.

On proving scalar multiplications in SNARKs

Mon, 11 Nov 2024 00:00:00 +0000

We show a way to implement GLV-like scalar multiplication in SNARK circuits in the absence of an efficient endomorphism. When this latter is available, we show how to turn proving a scalar multiplication into proving a 4 dimensional multi-scalar multiplication of small scalars.

zkAggregation in Linea

Sun, 02 Jun 2024 00:00:00 +0000

This presentation is about the proof aggregation protocol in the Linea zkEVM. It uses the elliptic 2-chain of curves BLS12-377 and BW6-761 to aggregate PLONK-KZG proofs and reduce the verification cost.

gnark and 2-chain aggregation for Linea

Fri, 29 Mar 2024 00:00:00 +0000

This presentation is about the gnark and gnark-crypto libraries and how they are used to aggregate proofs on the Linea zkEVM.

Faster Montgomery multiplication and Multi-Scalar-Multiplication for SNARKs

Mon, 11 Sep 2023 00:00:00 +0000

This presentation is about the conference article that can be found online here. The bottleneck in the proving algorithm of most of elliptic-curve-based SNARK proof systems is the Multi-Scalar-Multiplication (MSM) algorithm. In this paper we give an overview of a variant of the Pippenger MSM algorithm together with a set of optimizations tailored for curves that admit a twisted Edwards form. We prove that this is the case for SNARK-friendly chains and cycles of elliptic curves, which are useful for recursive constructions. Our contribution is twofold: first, we optimize the arithmetic of finite fields by improving on the well-known Coarsely Integrated Operand Scanning (CIOS) modular multiplication. This is a contribution of independent interest that applies to many different contexts. Second, we propose a new coordinate system for twisted Edwards curves tailored for the Pippenger MSM algorithm.Accelerating the MSM over these curves is critical for deployment of recursive proof systems applications such as proof-carrying-data, blockchain rollups and blockchain light clients. We implement our work in Go and benchmark it on two different CPU architectures (x86 and arm64). We show that our implementation achieves a 40-47% speedup over the state-of-the-art implementation (which was implemented in Rust). This MSM implementation won the first place in the ZPrize competition in the open division “Accelerating MSM on Mobile” and will be deployed in two real-world applications: Linea zkEVM by Consensys and probably Celo network.

Pairings in Rank-1 Constraint System

Wed, 12 Jul 2023 00:00:00 +0000

This presentation is about the conference article that can be found online here. In this work, we consider efficiently implementing pairings in Rank-1 Constraint Systems (R1CS), a widely used model to express SNARK statements. We show that our techniques almost halve the arithmetic circuit depth of the previously best known pairing implementation on a Barreto–Lynn–Scott (BLS) curve of embedding degree 12, resulting in 70% faster proving time. We also investigate and implement the case of BLS curves of embedding degree 24.

Pairings in Rank-1 Constraint System

Tue, 20 Jun 2023 00:00:00 +0000

The arithmetic of pairing-based proof systems

Fri, 18 Nov 2022 00:00:00 +0000

This is my PhD defense.

Optimizing cryptographic algorithms in gnark

Thu, 13 Oct 2022 00:00:00 +0000

This talk is about algorithmic optimizations techniques used in gnark. In particular, we show that the implementation of Multi-Scalar-Multiplication (MSM) is 45% faster compared to competitors libraries. We also explain optimizations in the pairing computations both out-circuit and in-circuit. To the best of our knowledge, these implementations are best-in-class.

Elliptic curves and zk-SNARKs

Fri, 16 Sep 2022 00:00:00 +0000

A proof system is a protocol where one party (called the prover) tries to convince another party (called the verifier) that a given statement is true. In the class of non-interactive proof systems, a particularly interesting concept for proving the computational integrity is the Succinct Non-interactive ARgument of Knowledge (SNARK). It provides a computationally sound proof, cheap to verify and small compared to the size of the statement or the witness. Bilinear pairings over elliptic curves have become key ingredients for instantiating such SNARKs. In this thesis we investigate tailored pairing-friendly elliptic curves to efficiently implement SNARKs. We present a study at three stages of the process: curves to instantiate a SNARK, curves to instantiate a recursive SNARK, and also curves to express an elliptic-curve related statement. We provide new constructions of curves for SNARKs and new families of 2-chain curves for recursive SNARKs. We derive and implement in open-source efficient algorithms to speed up the arithmetic on these curves: Co-factor clearing, subgroup membership testing, multi-scalar multiplication and pairings over 2-chains. We also study and optimize elliptic curves arithmetic and pairings as a SNARK statement, yielding to the fastest recursive proof generation in pairing-based settings.

Cofactor clearing and subgroup membership testing on pairing-friendly elliptic curves

Wed, 20 Jul 2022 00:00:00 +0000

An important cryptographic operation on elliptic curves is hashing to a point on the curve. When the curve is not of prime order, the point is multiplied by the cofactor so that the result has a prime order. This is important to avoid small subgroup attacks for example. A second important operation, in the composite-order case, is testing whether a point belongs to the subgroup of prime order. A pairing is a bilinear map e: G1×G2 → GT where G1 and G2 are distinct subgroups of prime order r of an elliptic curve, and GT is a multiplicative subgroup of the same prime order r of a finite field extension. Pairing-friendly curves are rarely of prime order. In this talk, we investigate cofactor clearing and subgroup membership testing on these composite-order curves. First, we generalize a result on faster cofactor clearing for BLS curves to other pairingfriendly families of a polynomial form from the taxonomy of Freeman, Scott and Teske. Second, we investigate subgroup membership testing for G1 and G2. We fix a proof argument for the G2 case that appeared in a preprint by Scott in late 2021 and has recently been implemented in different cryptographic libraries. We then generalize the result to both G1 and G2 and apply it to different pairing-friendly families of curves. This gives a simple and shared framework to prove membership tests for both cryptographic subgroups.

Families of SNARK-friendly 2-chains of elliptic curves

Wed, 01 Jun 2022 00:00:00 +0000

In this talk, we first are interested in families of 2-chains in which the BW6-761 curve would fall. We present a family of BW6 curves from any BLS12 curve and derive generic formulas, in terms of the BLS12 curve seed u, and integer parameters ht,hy. We extend this work to a 2-chain family of BW6 curves from BLS24 curves. To achieve higher levels of security in the target finite field of the outer curves, we compare a larger field characteristic thanks to larger parameters ht,hy, to the larger embedding degrees 8 and 12 obtained with Cocks-Pinch curves. Finally, we argue that the BLS12 and BLS24 based families are respectively tailored for Groth’16 and KZG-based SNARKs recursive proof composition, and we present a short list of curves with an optimized implementation along with benchmarks.

Elliptic curves and SNARKs

Wed, 11 May 2022 00:00:00 +0000

Elliptic curves have become key ingredients for instantiating zero-knowledge proofs and more generally proof systems. Recently, there have been many tailored constructions of these curves that aim at efficiently implementing different kinds of proof systems. In this talk we provide a comprehensive view on existing work. We present an overview at two stages of the process; curves to instantiate a SNARK and curves to instantiate a recursive SNARK.

Pairings in R1CS

Thu, 21 Apr 2022 00:00:00 +0000

This presentation is about how to efficiently express a pairing a Rank-1 Constraint System (R1CS) arithmetic circuit. The goal is to reduce the time complexity to SNARK prove a bilinear pairing. A corresponding research paper will be soon available on ePrint.

Families of SNARK-friendly 2-chains of elliptic curves

Fri, 15 Apr 2022 00:00:00 +0000

On choosing suitable elliptic curves for zk-SNARK

Tue, 09 Feb 2021 00:00:00 +0000

This presentation is about requirements and methods to contruct tailored and optimized elliptic curves for zkSNARK applications.

zk-SNARK 101

Fri, 05 Feb 2021 00:00:00 +0000

This presentation is an introduction to the concept of zkSNARKs alongside an step-by-step toy example of Pinocchio-ish zkSNARK protocol.

Optimized and secure pairing-friendly elliptic curve suitable for one layer proof composition

Tue, 15 Dec 2020 00:00:00 +0000

This presentation is about a joint paper with Aurore Guillevic that can be found online here. It proposes new families of elliptic curves that are tailored and optimized for recursive SNARKs.

Faster proof composition with the BW6-761 curve

Wed, 08 Jul 2020 00:00:00 +0000

This presentation is about using the BW6-761 curve to generate and verify faster composed Groth'16 zk-SNARK proofs and its application in EY Blockchain effort to privacy-preserving blockchains.

Optimized and secure pairing-friendly elliptic curve suitable for one layer proof composition

Tue, 31 Mar 2020 00:00:00 +0000

This presentation is about a joint paper with Aurore Guillevic that can be found online here. It introduced a new elliptic curve, namely BW6-761 that is very efficient for one-layer recursive SNARKs compared to the state-of-the-art.

Nightfall - The Open Source Privacy Solution for Ethereum

Thu, 10 Oct 2019 00:00:00 +0000

We believe that public blockchain is the future of business to business transactions. However, two issues - privacy and scalability - will need to be solved if this vision is to be fully realised. This talk will explain the motivations behind the open-source nightfall code and how it is intended to tackle the first of these issues. We cover the operation of the protocol, the method by which it provides complete privacy, and how developers can use it to build their own applications by making use of its smart contract infrastructure and the ZoKrates framework. We will also present our modelling of transaction costs, which shows that nightfall can already provide a cost-competitive alternative to private blockchains for many situations and how that will be true for a growing number of use cases in the near future.

Elliptic curves in cryptography

Thu, 04 Jul 2019 00:00:00 +0000

I this presentation the 4th of July in Paris during ZK-PAR 0x01, the first Zero Knowledge meetup in the french capital. The meetups started in Tel-Aviv and then London and now Paris. They are intended for anyone interested in applied cryptography for privacy-preserving technology. The presentations are usually focussed on technical and practical aspects of this technology, notably its relation to blockchain technology. You can find more information and community discussions in the Facebook group and the Youtube channel.

ZK-PAR 0x01 hosted two speakers, Bastien Teinturier and myself. Bastien talked about anonymous payments in Bitcoin’s Lightning network and I invite you to watch his video and go through his slides.