MSM
Pippenger
This is the basic algorithm to optimize MSM. It doesn't leverage curve structure or anything.
- Explained here: Pippenger Algorithm Explained
- Explained also in section 4 here.
GLV Decomposition
- Original paper: Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms
- To read about endomorphisms: "Guide to Elliptic Curve Cryptography" Darrel Hankerson, Alfred Menezes, Scott Vanstone
- Link it seems that GLV stops being useful after 2^12 points.
Gnark ZPrize optimizations
The original paper is "EdMSM: Multi-Scalar-Multiplication for SNARKs and Faster Montgomery multiplication". This paper explains Pippenger at section 4.
Curve forms and coordinate system
- Mixed addition is adding a point in affine to a point in other coordinate system.
- In a short weierstrass curve, you have different types of coordinate system: affine, projective, jacobian and extended jacobian.
- Uses jacobian extended coordinates. These are the fastest when a curve is in short weierstrass form.
- Uses twisted edwards for mixed addition over BLS* curves.
- Twisted edwards for mixed addition is even better than extended jacobian in short weierstrass. It also uses an extended coordinate system over twisted edwards.
Signed digit decomposition
- When splitting each coefficient of bits into chunks of bits, you end up with possibilities for each coefficient. You can reduce this to using "signed digit decomposition". When a chunk is lower than it stays the same. When a chunk is greater than , then you can substract from it an add to the next chunk .
Parallelization
- Parallelization for pippenger in the "submsms", the first step.
Resources
- Constantine: Nim repo
- Trello card