Skip to content

Chore/bls12-381 #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
d4rp4t wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

Chore/bls12-381 #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1112a7b
add blst submodule
d4rp4t May 20, 2026
1d085be
wip
d4rp4t May 20, 2026
925c598
fix dleq verification on swap builder
d4rp4t May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitmodules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
[submodule "DotNut.BLS12-381"]
path = DotNut.BLS12-381
url = https://github.com/d4rp4t/DotNut.BLS12-381.git
Comment on lines +1 to +3

@coderabbitai coderabbitai Bot May 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the submodule repository is accessible
echo "=== Checking submodule repository accessibility ==="
curl -s -o /dev/null -w "%{http_code}" https://github.com/d4rp4t/DotNut.BLS12-381 | grep -q "200" && echo "Repository is accessible" || echo "Repository may not be accessible"

# Check repository metadata
echo -e "\n=== Repository metadata ==="
gh repo view d4rp4t/DotNut.BLS12-381 --json name,description,createdAt,pushedAt,stargazerCount,forkCount,isArchived,isFork,parent || echo "Failed to fetch repository metadata"

Repository: Kukks/DotNut

Length of output: 357

🌐 Web query:

BLS12-381 .NET library audited cryptographic

💡 Result:

There isn’t evidence (from authoritative/official sources) that a specific.NET library implementing BLS12-381 has been independently “audited cryptographically” (i.e., has a published third-party audit report) as a.NET library. What I did find: 1) Neo.Cryptography.BLS12_381 (.NET) - The NuGet package exists (example: Neo.Cryptography.BLS12_381 3.9.0) [1]. - The repository’s GitHub “Security” page shows no published security advisories and indicates no SECURITY.md policy file is detected [2]. This is not a cryptographic audit confirmation. 2) BLS12-381 audit evidence exists for non-.NET implementations, and sometimes they have C#/bindings - The supranational blst library (C/assembly; provides C# bindings via SWIG) states: “An initial audit of this library was conducted by NCC Group in January 2021” and links to where the audit is “here” [3]. This is evidence of third-party audit for the underlying library, but it is not an audit claim specifically for any.NET wrapper quality. 3) gnark-crypto - gnark-crypto’s README states: “gnark-crypto is not fully audited … [and] makes no security guarantees such as constant time … or side-channel attack resistance” [4]. So even if audit reports exist for certain curves (including bls12-381), it does not amount to a fully-audited security claim for the whole package. Conclusion - For “BLS12-381.NET library audited cryptographic”: the closest directly sourced third-party audit evidence I found is for the underlying blst implementation (NCC Group audit in Jan 2021) and that it offers C# bindings [3]. For.NET libraries specifically (e.g., Neo.Cryptography.BLS12_381), I found no published third-party cryptographic audit status in the sources retrieved. If you share the exact NuGet package name (and version), I can re-check whether it references a specific audit (for the exact code version) or whether there are any published third-party audit reports tied to that.NET library.

Citations:

Verify the cryptographic library source and consider established alternatives.

The submodule points to a personal repository (d4rp4t/DotNut.BLS12-381) for BLS12-381 cryptographic operations. While the repository is accessible and recently active (last updated 2026-05-20), using a novel, community-unreviewed implementation for cryptographic operations raises significant concerns:

  • Supply chain security: This is a novel implementation (not a fork of an established library) with zero community adoption (0 stars, 0 forks). Cryptographic libraries require rigorous security review and established trust.
  • Availability risk: Personal repositories can be deleted, made private, or renamed, breaking builds for all users.
  • Maintenance: Long-term maintenance and security updates may not be guaranteed.

Verify whether established .NET BLS12-381 libraries meet your requirements before committing to this implementation. Known alternatives include:

  1. Neo.Cryptography.BLS12_381 — Available on NuGet with version history
  2. Supranational blst — C library with C# bindings; underwent third-party audit by NCC Group (January 2021)
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.gitmodules around lines 1 - 3, The .gitmodules entry adds a submodule named
"DotNut.BLS12-381" pointing to a personal GitHub repo; replace or validate this
by either swapping the submodule to an established, audited BLS12-381
implementation (e.g., Neo.Cryptography.BLS12_381 NuGet package or blst with C#
bindings) or documenting and approving the security review for DotNut.BLS12-381;
update the submodule reference in .gitmodules (submodule "DotNut.BLS12-381")
accordingly and ensure build/CI uses the chosen source and that dependency
provenance and maintenance rationale are recorded.

1 change: 1 addition & 0 deletions DotNut.BLS12-381
Open in desktop
Submodule DotNut.BLS12-381 added at 9eaeb6
Loading