Perf: KZG verify gadget #874
Conversation
|
📦 |
|
📦 📦 📦 |
|
📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ |
|
📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 📦 ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ 📦 ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ 📦 ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ 📦 ❌ ❌ ❌ ❌ 📦 ❌ ❌ ❌ ❌ |
|
📦 ❌ ❌ |
|
📦 ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ |
|
@ivokub this PR is good to go on my end. Your call if you want to merge as-is or contribute your refactoring here. |
Great work! I think I'll refactor and wait until the plonk verifier PR is done. I'm afraid there would be otherwise merge conflicts. |
|
@ivokub @ThomasPiellard I refactored this PR to follow the same pattern as in #930 for all curves. PR is ready for review. |
Description
(Refactored as in #930 )
The current KZG verify gadget computes (in
AssertProof) the multi-pairinge(totalG1, vk.SRS[0]) * e(negQuotientPoly, vk.SRS[1]) == 1assuming all arguments are variable. Howevervk.SRS[0]=G₂andvk.SRS[1]=[α]G₂are fixed points in G2. This PR pre-computes the lines used in the multi-pairing hence avoiding G2 arithmetic in-circuit.TODO:
vk.SRS[0]=G₂vk.SRS[1]=[α]G₂DoublePairingFixedQCheckwhich doese(var, fix) * e(var, var) == 1(Naive algorithm for now)DoublePairingFixedQCheckwhich doese(var, fix) * e(var, fix) == 1N.B.: To do the same for BW6-761, we need to revisit the Miller loop algortihm to be an ate loop instead of a Tate. Will do in a separate PR.
Edit: This was done in #876 and merged here
Type of change
How has this been tested?
Same existing tests work for the new feature.
How has this been benchmarked?
This is a 10.7M+ saving in SCS which largely offsets the 24k loss in #876 due to Miller algorithm change.
This is a 5.6k saving in SCS. A pairing in native already does not cost much.
Checklist:
golangci-lintdoes not output errors locally