BN254 / alt-bn128 Curve Precompile (EIP-196/197/1108)

Abstract

BN254 (also known as alt-bn128 or Barreto-Naehrig 254-bit) is the pairing-friendly elliptic curve hard-coded into the EVM at addresses 0x06 (G1 point addition, EIP-196), 0x07 (G1 scalar multiplication, EIP-196), and 0x08 (optimal-ate pairing check, EIP-197), with gas costs re-priced by EIP-1108. This LP pins the Lux network's implementation of BN254 — backed by the luxfi/bn256 Go package ported from Cloudflare's CIRCL — covering both the precompile behaviour (input/output encoding, gas table) and the application- level pairing API used by Groth16 / PLONK verifier circuits compiled to EVM bytecode. BN254 is the de-facto SNARK-verifier curve for the Ethereum ecosystem; the Lux network retains BN254 precompile parity with Ethereum mainnet for tooling and library compatibility, while new long-lived deployments are encouraged to use BLS12-381 (LP-4110) which has a larger security margin (~128-bit classical security, versus ~100-bit for BN254 post-2019-cryptanalysis).

Reference implementation

• Primitive: luxfi/bn256 (Cloudflare CIRCL port) / luxfi/crypto/bn254
• Precompile addresses: 0x06 (ECADD), 0x07 (ECMUL), 0x08 (ECPAIRING)
• Gas (EIP-1108):
  • ECADD: 150
  • ECMUL: 6,000
  • ECPAIRING: 45,000 base + 34,000 per pair
• Test vectors: Ethereum EIP-196/197/1108 reference vectors
• Standards: EIP-196, EIP-197, EIP-1108, RFC 5639 (BN curve parameters)

Security notes

The 2019 Kim-Barbulescu paper "Extended Tower Number Field Sieve" revised BN254's security from ~128-bit down to ~100-bit. BN254 remains acceptable for short-lived verifier circuits and tooling parity, but new high-value deployments should default to BLS12-381 (LP-4110) which is unaffected by that attack.

Copyright

Copyright and related rights waived via CC0.