Faster Montgomery multiplication and Multi-Scalar-Multiplication for SNARKs
نویسندگان
چکیده
The bottleneck in the proving algorithm of most elliptic-curve-based SNARK proof systems is Multi-Scalar-Multiplication (MSM) algorithm. In this paper we give an overview a variant Pippenger MSM together with set optimizations tailored for curves that admit twisted Edwards form. We prove case SNARK-friendly chains and cycles elliptic curves, which are useful recursive constructions. Our contribution twofold: first, optimize arithmetic finite fields by improving on well-known Coarsely Integrated Operand Scanning (CIOS) modular multiplication. This independent interest applies to many different contexts. Second, propose new coordinate system algorithm.Accelerating over these critical deployment proof< applications such as proof-carrying-data, blockchain rollups light clients. implement our work Go benchmark it two CPU architectures (x86 arm64). show implementation achieves 40-47% speedup state-of-the-art (which was implemented Rust). won first place ZPrize competition open division “Accelerating Mobile” will be deployed real-world applications: Linea zkEVM ConsenSys probably Celo network.
منابع مشابه
Montgomery Scalar Multiplication for Genus 2 Curves
Using powerful tools on genus 2 curves like the Kummer variety, we generalize the Montgomery method for scalar multiplication to the jacobian of these curves. Previously this method was only known for elliptic curves. We obtain an algorithm that is competitive compared to the usual methods of scalar multiplication and that has additional properties such as resistance to timings attacks. This al...
متن کاملA Compact Architecture for Montgomery Elliptic Curve Scalar Multiplication Processor
We propose a compact architecture of a Montgomery elliptic curve scalar multiplier in a projective coordinate system over GF (2). To minimize the gate area of the architecture, we use the common Z projective coordinate system where a common Z value is kept for two elliptic curve points during the calculations, which results in one register reduction. In addition, by reusing the registers we are...
متن کاملMontgomery Multiplication in Gf2
We show that the multiplication operation c = a br ,1 in the eld GF2 k can be implemented signiicantly faster in software than the standard multiplication, where r is a special xed element of the eld. This operation is the nite eld analogue of the Montgomery multiplication for modular multiplication of integers. We give the bit-level and word-level algorithms for computing the product, perform ...
متن کاملDual-Residue Montgomery Multiplication
The paper introduces a new approach based on dual residue system to compute Montgomery multiplication. The novelty of this proposal is that we import an extra Montgomery residue system with new transformation constant beside the normal one. In this way, one of the multiplicand can be divided into two parts and both higher and lower parts are calculated in parallel to speed up computation. Then ...
متن کاملLeakage from Montgomery Multiplication
Modular multiplication P = A×B mod M is a fundamental operation in most public key cryptography. Its efficiency is usually critical in determining the overall efficiency of a system because it is the main component in modular exponentiation and in elliptic curve point multiplication. There are several algorithms which can be chosen for performing modular multiplication, of which those by Barret...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
ژورنال
عنوان ژورنال: IACR transactions on cryptographic hardware and embedded systems
سال: 2023
ISSN: ['2569-2925']
DOI: https://doi.org/10.46586/tches.v2023.i3.504-521