How to impl the compression format serialization of G1 and G2 points in the circuit?

[doubiliu]

In the current lib, there are methods such as MarshalG1. This is serialization in a non-compressed format, but data such as public keys will be used in the compressed format. How to implement compressed format conversion in a circuit?
@ivokub

[ivokub]

We don't have it included yet, but uncompressing G1 point is implemented in a PR https://github.com/Consensys/gnark/pull/1489/files#diff-82bd40cb77cb805ac078515edaa5e8daecc2a930afe9cfff1153e9fa4e09f6f2R61

We need to revisit it and refactor a bit, but it should give a starter for implementation.

[txhsl]

@ivokub I'm new to the Gnark code, but in this implementation, the computation of bls12381.G1Affine.Y is executed by gnark-crypto SetBytes in unmarshalHint(). Although this method is called in NewHint(), is it really safe? Or, I mean, is the result Y really restricted to be computed from X by the circuit?

[ivokub]

Later on we do subgroup check for the point (X, Y), this only passes if the point is actually in the correct subgroup (and on curve). This ensures that Y is correctly hinted from NewHint.