update InCorrectSubgroup

g2.go

@@ -757,22 +757,17 @@ func (g *G2) MultiExp(r *PointG2, points []*PointG2, scalars []*Fr) (*PointG2, e
 // InCorrectSubgroup checks whether given point is in correct subgroup.
 func (g *G2) InCorrectSubgroup(p *PointG2) bool {
 
-	// Faster Subgroup Checks for BLS12-381
-	// S. Bowe
-	// https://eprint.iacr.org/2019/814.pdf
+	// A note on group membership tests for G1, G2
+	// and GT on BLS pairing-friendly curves
+	// M. Scott
+	// https://eprint.iacr.org/2021/1130.pdf
 
-	// [z]ψ^3(P) − ψ^2(P) + P = O
-	t0, t1 := g.New().Set(p), g.New()
+	// ψ^3(P) − [u]P = O
+	t0, t1 := g.New().Set(p), g.New().Set(p)
 
-	g.psi(t0)
-	g.psi(t0)
-	g.Neg(t1, t0) // - ψ^2(P)
-	g.psi(t0)     // ψ^3(P)
-	g.mulX(t0)    // - x ψ^3(P)
-	g.Neg(t0, t0)
-
-	g.Add(t0, t0, t1)
-	g.Add(t0, t0, p)
+	g.psi(t0)         //ψ(P)
+	g.mulX(t1)        //-[u]P
+	g.Add(t0, t0, t1) //ψ(P)-[u]P
 
 	return g.IsZero(t0)
 }

gt.go

@@ -65,9 +65,22 @@ func (g *GT) ToBytes(e *E) []byte {
 
 // IsValid checks whether given target group element is in correct subgroup.
 func (g *GT) IsValid(e *E) bool {
-	r := g.New()
-	g.fp12.exp(r, e, qBig)
-	return r.isOne()
+	r0, r1, r2 := g.New().Set(e), g.New(), g.New()
+
+	g.fp12.frobeniusMap1(r0)
+	r1.set(r0)
+	g.fp12.frobeniusMap1(r0)
+	r2.set(r0)
+	g.fp12.frobeniusMap2(r0)
+	g.Mul(r0, r0, e)
+	if !r0.Equal(r2) {
+		return false
+	}
+	g.Exp(r0, e, bigFromHex("0xd201000000010000"))
+	g.Mul(r0, r0, r1)
+
+	return r0.IsOne()
+
 }
 
 // New initializes a new target group element which is equal to one

pairing_test.go

@@ -247,6 +247,19 @@ func BenchmarkFinalExp(t *testing.B) {
 	f := gt.New().one()
 	t.ResetTimer()
 	for i := 0; i < t.N; i++ {
-		bls.finalExp(f)
+		bls.millerLoop(f)
 	}
 }
+
+func BenchmarkGT_IsValid(b *testing.B) {
+	bls := NewEngine()
+	g1, g2, gt := bls.G1, bls.G2, bls.GT()
+	bls.AddPair(g1.One(), g2.One())
+	e := gt.New()
+	e = bls.calculate()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		gt.IsValid(e)
+	}
+
+}