Bug: SRS BN254 G2 h is not in subgroup
Closed this issue · 2 comments
volhovm commented
This fails, due to the fact how verifier_srs is created.
let actual: BN254G2Affine = srs.verifier_srs.h;
assert!(actual.is_in_correct_subgroup_assuming_on_curve());
The issue is in point_of_random_bytes() most likely.
dannywillems commented
Use mul_by_cofactor