map-to-curve

Code accompanying the paper "On the Security of Constraint-Friendly Map-to-Curve Relations" by Youssef El Housni and Benedikt Bünz (https://eprint.iacr.org/2026/590).

Reproducing Paper Results

Use the root Makefile to reproduce the code-backed results:

# show available targets
make help

# run the Sage attack demos and correctness checks
make sage-attack

# run the Go correctness suite
make go-test

# reproduce constraint-count logs for the paper tables
make constraints

# reproduce full prove/verify benchmark logs
make pipeline

# run everything
make repro

Outputs are written under artifacts/logs/. The Sage attack log includes the Ethereum BN254 M=2^120 relation-only search, the Beuchat/TEPLA BN254B complete forgery at M=2^120, and the Ethereum BN254 complete forgery at M=2^124. The Makefile also sets a local GOCACHE under artifacts/.gocache so runs do not depend on a writable global Go cache.

Structure

sage/                         SageMath reference implementations and attack scripts
go/                           gnark ZK circuits and benchmarks
├── x-increment/              x-increment (GMMZ) circuits, tests, pipeline benchmarks
├── y-increment/              y-increment circuits, tests, pipeline benchmarks
└── internal/                 helpers (cube roots, Cardano solver, Fp2 arithmetic)
noir/                         Noir circuit attack tests against existing implementations
└── jasleen-map-to-curve-gmmz/  authors' implementation and our attacks (submodule)

See sage/README.md, go/README.md, and noir/README.md for details.

Dependencies

• SageMath 10+
• Go 1.25+, gnark, gnark-crypto, fp2-cbrt
• Nargo (optional, for Noir attack tests) — see installation.

Install commands:

# macOS (Homebrew)
brew install go sagemath

# Ubuntu / Debian
sudo apt-get update
sudo apt-get install -y golang sagemath