Skip to content

Gas optimization through batch-invert barycentric denominators in sumcheck#22122

Open
nicolaslara wants to merge 1 commit intoAztecProtocol:nextfrom
nicolaslara:nicolas/montgomery-batch-inversion
Open

Gas optimization through batch-invert barycentric denominators in sumcheck#22122
nicolaslara wants to merge 1 commit intoAztecProtocol:nextfrom
nicolaslara:nicolas/montgomery-batch-inversion

Conversation

@nicolaslara
Copy link
Copy Markdown

When working on https://github.com/nicolaslara/solana-noir-verifier/ I had to do a few optimizations to reduce the compute time. Batch inversions was one of them. I noticed these were missing upstream, so adding the highest impact one here.

Here are the performance changes from the tests I ran:

Test Before After Saved %
Add2 968,225 922,589 45,636 4.7%
Add2 ZK 1,885,965 1,834,205 51,760 2.7%
Blake 1,461,863 1,346,344 115,519 7.9%
Blake ZK 2,451,954 2,321,207 130,747 5.3%
ECDSA 1,528,814 1,405,416 123,398 8.1%
ECDSA ZK 2,526,897 2,387,271 139,626 5.5%
Recursive 1,742,905 1,587,720 155,185 8.9%
Recursive ZK 2,773,343 2,597,880 175,463 6.3%

The next high impact version of this would be to apply it to the gemini fold. I can try that if you find this valuable

Precompute barycentric weights as constants and use Montgomery's batch inversion for the (u-i) terms, reducing N modexp calls to 1 per round. Saves ~45K-175K gas per verify() depending on circuit size.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant