bn256

bn256 is a pairing-friendly elliptic curve from the Barreto–Naehrig (BN) family, commonly referred to as BN256 or BN254 in various libraries. It is defined over a 254-bit prime field with embedding degree 12, a design that enables efficient bilinear pairings used in modern cryptography, particularly zk-SNARKs and other pairing-based protocols.

In the BN256 construction, cryptographic groups are arranged in three levels: G1, a subgroup of the elliptic curve E(Fp) over the base field; G2, a subgroup of a twist of the same curve defined over the quadratic extension Fp2; and GT, the multiplicative group of a finite field extension (Fp12). The pairing e: G1 × G2 → GT is bilinear, non-degenerate, and efficiently computable (often via Ate pairing optimizations), enabling constructions like short, non-interactive proofs.

bn256 is widely used in practice. It underpins many zk-SNARK toolchains and is implemented in several libraries, including the bn256 package in Go and various cryptographic toolkits. In blockchain contexts, Ethereum and other platforms expose a precompiled contract for alt_bn128 (a BN254 variant) to verify pairings efficiently on-chain, illustrating the curve’s practical deployment.

Security considerations for BN256 place the security level around 128 bits for typical parameter choices. However, bn256 is not post-quantum secure, and future-proofing would require alternative, quantum-resistant approaches or different curve families. While BN254 remains popular for its performance, newer curves such as BLS12-381 offer different performance and security trade-offs.

See also: Barreto–Naehrig curves, BN curves, alt_bn128, pairing-based cryptography, zk-SNARKs, Groth16.