precompiles: Optimize KZG point evaluation via joint G1 MSM#1536
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1536 +/- ##
==========================================
- Coverage 96.97% 96.97% -0.01%
==========================================
Files 162 162
Lines 14449 14447 -2
Branches 3382 3383 +1
==========================================
- Hits 14012 14010 -2
Misses 307 307
Partials 130 130
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR optimizes the EIP-4844 KZG point-evaluation precompile verification by algebraically rearranging the pairing equation to avoid G2 scalar mul/add and to combine the remaining G1 scalar multiplications into a joint 2-point MSM.
Changes:
- Rewrites the KZG verification equation to move the
[z]factor from G2 to G1 via pairing bilinearity. - Removes the need for the negative G2 generator constant and associated G2 mult/add helpers.
- Introduces a 2-term G1 MSM (
[z]π - [y]G1) and pairs the result against fixed G2 inputs.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Rearrange the standard KZG verification equation
e(C - [y]₁, [1]₂) =? e(π, [s - z]₂)
into
e(C + [z]π - [y]₁, [1]₂) =? e(π, [s]₂)
by moving the [z] factor from G2 to G1 via the pairing's bilinearity.
The new form:
- eliminates the G2 scalar multiplication entirely (was [z](-G2_gen)),
- eliminates the G2 point addition (was [s]G2 - [z]G2),
- merges the two remaining G1 scalar multiplications ([z]π and [y]₁)
into a single 2-point Pippenger MSM,
- keeps both G2 pairing arguments as fixed constants ([1]₂ via
blst_aggregated_in_g1's precomputed lines and the [s]₂ point from
the trusted setup).
G2_GENERATOR_NEGATIVE and the blst_p2 mult/add helpers are no longer
needed. G1_GENERATOR_NEGATIVE is redeclared as blst_p1_affine since
the Pippenger MSM consumes affine points.
Member
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rearrange the standard KZG verification equation
into
by moving the [z] factor from G2 to G1 via the pairing's bilinearity.
The new form:
into a single 2-point Pippenger MSM,
blst_aggregated_in_g1's precomputed lines and the [s]₂ point from
the trusted setup).
G2_GENERATOR_NEGATIVE and the blst_p2 mult/add helpers are no longer
needed. G1_GENERATOR_NEGATIVE is redeclared as blst_p1_affine since
the Pippenger MSM consumes affine points.