Baby Jubjub and Zero Knowledge Proofs

Baby Jubjub is a neopet, but it’s also an elliptic curve which supports enhanced usage of Zero Knowledge Proofs

One of the core advancements in blockchain technology has been in Zero Knowledge Proofs (ZKPs), and especially around zk-SNARKs (zero-knowledge Succinct Non-interactive ARguments of Knowledge). With this, we use an arithmetic circuit defined over a finite field (zk-SNARK circuits). In order to verify a zk-SNARK proof, we need to define an elliptic curve. With Ethereum, we use the BN254 curve. As an alternative, we can use the Baby Jubjub curve for a zk-SNARK circuit and which supports a range of cryptographic primitives, such as the Pedersen Hash or the Edwards Digital Signature Algorithm (EdDSA).

Why Baby Jubjub?

Baby Jubjub was created to fulfil the requirements of using an elliptic curve of F_r arithmetic circuits (and where we have a finite field (F_r) of size r). The twisted Edwards curve was chosen as it has a single complete formula for the addition of two points on the curve — and which is highly efficient for computations within the circuit. Along with this, a twisted Edwards curve can be converted into an equivalent Montgomery curve. This allows for point addition and doubling in a Montgomery curve outside the circuit [here]: