perf: optimize Verify
and BatchVerifyMultiPoints
methods
#3
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR ports two optimizations from gnark-crypto:
Verify
pairing equation so that instead of doing a G1 scalar mul and a G2 scalar mul, we do a G1 2-MSM with Strauss-Shamir trick.// [f(z)]G₁ + [-z]([H(α)]G₁) = [f(z) - z*H(α)]G₁
Verify
andBatchVerifyMultiPoints
makes it possible to pre-compute the lines in pairing computation corresponding toG₂
and[α]G₂
// e([f(α)-f(z)+aH(α)]G₁], G₂).e([-H(α)]G₁, [α]G₂) == 1
These pre-computed lines can be stored in the SRS.
Bench
On a z1d.large AWS machine
First optimisation saving for
Verify
:The two optimisations combined: