1. 目前主流的pairing-friendly曲线家族
以太坊eip-1962提案中关于曲线计算及曲线选择中指出，目前主流的pairing-friendly曲线家族有：
- BLS12
- BN
- MNT4
- MNT6
- Cocks-Pinch (Tate pairing)
2. 主要应用选型
ZKProof社区关于适于circuit的曲线生成提案中指出：
The proposal addresses the generation of an embedded elliptic curve (of Edwards shape) over a given pairing-friendly elliptic curve (e.g. BN128 or BLS12-381). We can add to the proposal:
- The generation of an embedded pairing-friendly elliptic curve (of Weierstrass shape) if one wants to do in-circuit pairing based computations (e.g. BLS signatures).
- The generation of pairing-friendly EC cycles (e.g. MNT4 and MNT6 as used in Coda) if one wants to do recursive zkSNARKs.
- The generation of pairing-friendly EC chains (e.g. BLS12-377 and Cocks-pinch as used in Zexe) if one wants to do bounded recursive zkSNARKs or aggregate many proofs into one.
The second and third point require the generation of at least two EC where pairing-friendliness and high 2-adicity w.r.t. both the subgroup order and the field size are into consideration.
EYBlockchain/nightfall中BLS12_377, SW6, MNT4753 and MNT6753曲线讨论中指出：
Computing proof generation and verification times for these curves to understand which approach to go forward with for now
- BLS12_377 for inner curve with SW6 for outer curve (non-recursive approach)
- MNT4753 - MNT6753 (recursive approach)
3. 曲线的生成和参数选择
zexe中的cocks-pinch curve讨论，很多专家参与，提到了很多构建曲线和生成参数的代码库，如：
- 构建MNT/BN等曲线的代码库
- HarryR的cocks-pinch-derive-elements Python和SageMath脚本笔记
- sw6-bis代码实现，比zexe的SW6效率略高，实际运行时，zexe中的
SW6曲线效率比MNT6、bls12-377和bls12-381等曲线的执行效率都要低。
zcash讨论Understand how to optimize a circuit implementation of Groth16 verification
4. 什么是Cocks–Pinch曲线？
可参见《Cocks–Pinch curves with efficient ate pairing》。
参考资料：
[1] 以太坊eip-1962提案中关于曲线计算及曲线选择
[2] ZKProof社区关于适于circuit的曲线生成提案
[3] EYBlockchain/nightfall中BLS12_377, SW6, MNT4753 and MNT6753曲线讨论
[4] zexe中的cocks-pinch curve讨论，很多专家参与
[5] 构建MNT/BN等曲线的代码库
[6] HarryR的cocks-pinch-derive-elements Python和SageMath脚本笔记
[7] sw6-bis代码实现，比zexe的SW6效率略高
[8] 《Cocks–Pinch curves with efficient ate pairing》
[9] zcash讨论Understand how to optimize a circuit implementation of Groth16 verification
