neptune for Pasta curves

[lurk-lab]

neptune for Pasta curves

[porcuquine]

Yes, it's fine — because like BLS12-381, they are both prime fields of ~256 bits. I believe @DrPeterVanNostrand looked into this specifically and confirmed no change is required. We just didn't update the documentation when adding general support for Pasta curves. @DrPeterVanNostrand Can you confirm?

[DrPeterVanNostrand]

Hi @srinathsetty, round_numbers.rs assumes that the field which Poseidon is instantiated over is ~256 bits (which corresponds to our targeted 128-bit security level). BLS12-381, Pallas, and Vesta each have a 255-bit scalar field, so there's no problem using those fields. There is also an assertion when generating round constants which checks that the field size of the PrimeField type parameter is 32 bytes.

I think "Neptune is specialized to the BLS12-381 curve" also means that we implement a Groth16 circuit, GPU functionality, and have an audit for BLS12-381's scalar field. The "do not do this" part of the README should probably be made more specific.