feat: add Pectra BLS12-381 elliptic curve precompiles

[yelhousni]

Description

This PR adds gnark circuits corresponding to precompiles for BLS12-381 curve operations https://eips.ethereum.org/EIPS/eip-2537.

• BLS12_G1ADD
• BLS12_G1MSM
• BLS12_G2ADD
• BLS12_G2MSM
• BLS12_PAIRING_CHECK
• BLS12_MAP_FP_TO_G1 (@ThomasPiellard)
• BLS12_MAP_FP2_TO_G2 (feat: added HashToG2 and BLS G2 signature verification circuit for BLS12-381 #1040)

TODO:

• BLS12_PAIRING_CHECK: inlcude G2 memerbship in Miller loop (lines computation).
• BLS12_G2ADD: check the two addends are on G2.
• BLS12_G2MSM: optimized ScalarMul() with GLV
  • GLS? fakeGLS? GLV/S+fakeGLV/S?
• BLS12_G1MSM and BLS12_G2MSM: optimize MSM algorithm.

Type of change

• New feature (non-breaking change which adds functionality)

How has this been tested?

Tests are implemented in std/evmprecompiles/bls_test.go.

How has this been benchmarked?

PLONK (on BLS12-377) number of constraints (scs):

precompile	curve membership test?	subgroup membership test?	constraints (scs)
BLS12_G1ADD	Yes	No	9 641
BLS12_G2ADD	Yes	No	23 668

precompile	curve membership test?	subgroup membership test?	constraints (scs)
BLS12_G1MSM (1 pair) Scalar Multiplication	Yes	Yes	590 418
BLS12_G1MSM (2 pairs)	Yes	Yes	1 132 727
BLS12_G1MSM (3 pairs)	Yes	Yes	1 569 303
BLS12_G1MSM (5 pairs)	Yes	Yes	2 442 455
BLS12_G1MSM (10 pairs)	Yes	Yes	4 625 335
BLS12_G1MSM (20 pairs)	Yes	Yes	8 991 095
BLS12_G1MSM (100 pairs)	Yes	Yes	43 917 175

precompile	curve membership test?	subgroup membership test?	constraints (scs)
BLS12_G2MSM (1 pair) Scalar Multiplication	Yes	Yes	1 225 743
BLS12_G2MSM (2 pairs)	Yes	Yes	2 196 208
BLS12_G2MSM (3 pairs)	Yes	Yes	3 166 673
BLS12_G2MSM (5 pairs)	Yes	Yes	5 107 603
BLS12_G2MSM (10 pairs)	Yes	Yes	9 959 981
BLS12_G2MSM (20 pairs)	Yes	Yes	19 665 567
BLS12_G2MSM (50 pairs)	Yes	Yes	48 794 236

precompile	curve membership test?	subgroup membership test?	constraints (scs)
BLS12_PAIRING_CHECK (2 pairs)	Yes	Yes	2 821 323
BLS12_PAIRING_CHECK (4 pairs)	Yes	Yes	4 993 571
BLS12_PAIRING_CHECK (9 pairs)	Yes	Yes	10 424 481
BLS12_PAIRING_CHECK (20 pairs)	Yes	Yes	22 371 551

Checklist:

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I did not modify files generated from templates
• golangci-lint does not output errors locally
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[yelhousni]

I added Consensys/gnark-crypto#674 - I'll go over G2 map to curve to see that it is also useful for #1040.

Otherwise the map to curve also looks good. @yelhousni - please re-request review when you have addressed all the comments and I'll re-review. I had to merge master because there were some changes due to gnark-crypto API changes.

Addressed all the points except the AssertIsOnCurve and AssertIsOnG1 in the std/algebra.Curve interface. No strong opinion here.

[ivokub]

I added Consensys/gnark-crypto#674 - I'll go over G2 map to curve to see that it is also useful for #1040.
Otherwise the map to curve also looks good. @yelhousni - please re-request review when you have addressed all the comments and I'll re-review. I had to merge master because there were some changes due to gnark-crypto API changes.

Addressed all the points except the AssertIsOnCurve and AssertIsOnG1 in the std/algebra.Curve interface. No strong opinion here.

Yup - I think we could try to keep it simple for now. The only thing I'm worried about when having duplicate implementations (in sw_emulated and sw_bls12381) is that it may cause confusion when auditing or debugging bugs. I'll have another look, maybe I can come up with some idea while @ThomasPiellard is addressing the missing test comment.

[ivokub]

Good from my side now. But before merging we need to wait for Consensys/gnark-crypto#674 to be merged to gnark-crypto master and then we need to update the dependency in this PR. Otherwise we may have non-linear dependencies and depend on go package cache in case the gnark-crypto PR is deleted.

I'll try moving AssertIsOnCurve and AssertIsOnG1 to interfaces and de-duplicate in separate PR.