No Fault polynomial time Miller s inversion implemented for altbn128, but can it be made usefull against eip197?

ytrezq · March 8, 2026, 1:17pm

Based on recent research results.

gist.github.com

https://gist.github.com/ytrezq/1186cda76fed142d1af72cd94311e179

Example Takakazu Satoh's Miller Inversion for Ethereum's EIP-197 or Altbn128 supersingular elliptic curve.Sage

from sage.all import Integer, EllipticCurve, GF, PolynomialRing, sqrt

#-----------------------1. Miller inversion --------------------------
def miller_invert(E, q, k, ell, d, v, A):
    
    """
    Attempts to find a point Q on E such that the raw Miller value A._miller_(Q, d) == v.
    This implementation is specific to curves where d | (q^(k/2) + 1).
    """

This file has been truncated. show original

Is there a way to lift both G_1 and G_2/G_12 to an hyperelliptic curve cover where the final exponentiation isn t required?

Or are there some cases where the right exponentiation inversion is easy as highlighted by some papers that where using faults for performing Miller inversion (which was usefull when a secret was to be hidden).