bn128 pairing not computed correctly? about snarkjs

[yelhousni]

This seems to suggest to me that there is something wrong with the way pairings are computed in snarkjs.

Indeed there is a slight difference between the pairing implementations in libsnark and snarkjs, but both are correct. In fact, the final exponentiation (FE) is computed differently and the result should be different because of an exponent cofactor. In the current implementation of snarkjs, the FE is elt^((q^12-1)/r) while in libsnark it is equal to elt^(2z * ( 6z^2 + 3z + 1 )*(q^12-1)/r where z=4965661367192848881 is the seed of the alt-bn128 curve. You can always raise to a multiple of (q^12-1)/r that is not divisible by r and the pairing would be correct. The point to do so is to find a good LLL decomposition in q^i-basis and use Frobenius maps instead of modular exponentiations (see [SAC:FueKnaRod11]).

I implemented this in this PR and it should fix your problem.

[jbaylina]

In the new version we are using the wasmcurves lib that uses the right pairing. Closing it.