Bellman tests failed for Groth16 on BN254 curve

[esuwu]

Greetings!
Tests taken from Bellman implementation test_vectors.txt
fail.
Previous issue has been fixed but only for BLS-12381. See here previous PR.

The verification key format is slightly different, however you described how you converted Bellman VK format to gnark VK. I did the same, and Bellman tests are passed for BLS-12381. However for BN254 the tests (test_vectors.txt) fail.

[gbotrel]

hi :) can you:

1. link the snippets where bellman generates this test vector / the test running on it?
2. add in this issue the corresponding gnark code you used that failed?

[esuwu]

Of course
The test vector are generated from this library that is based on Bellman implementation. The same library that has been used to generate these test vectors.

The code I used from Gnark is in this implementation. I convert Bellman representation of VK to Gnark VK. You can run it and see
You can also see that BLS tests pass, but BN254 tests fail

[esuwu]

There is another implementation of groth16 verifier based on Bellman here (not using Gnark). The implementation is not perfect in terms of optimization but the tests for BN254 are passed successfully there

[gbotrel]

The error is: "invalid point: subgroup check failed" when unmarshaling the input points.

Very likely, the way compressed points are encoded differs. In the gowaves code you have:

https://github.com/wavesplatform/gowaves/blob/3c8690431fe83406249c78c3cbeb17dc132ce460/pkg/crypto/internal/groth16/bn256/utils/bn254/g1.go#L95

versus:

https://github.com/ConsenSys/gnark-crypto/blob/8f7ca09273c24ed9465043566906cbecf5dcee91/ecc/bn254/marshal.go#L39