MSM

Pippenger

This is the basic algorithm to optimize MSM. It doesn't leverage curve structure or anything.

GLV Decomposition

Gnark ZPrize optimizations

The original paper is "EdMSM: Multi-Scalar-Multiplication for SNARKs and Faster Montgomery multiplication". This paper explains Pippenger at section 4.

Curve forms and coordinate system

  • Mixed addition is adding a point in affine to a point in other coordinate system.
  • In a short weierstrass curve, you have different types of coordinate system: affine, projective, jacobian and extended jacobian.
  • Uses jacobian extended coordinates. These are the fastest when a curve is in short weierstrass form.
  • Uses twisted edwards for mixed addition over BLS* curves.
  • Twisted edwards for mixed addition is even better than extended jacobian in short weierstrass. It also uses an extended coordinate system over twisted edwards.

Signed digit decomposition

  • When splitting each coefficient of bits into chunks of bits, you end up with possibilities for each coefficient. You can reduce this to using "signed digit decomposition". When a chunk is lower than it stays the same. When a chunk is greater than , then you can substract from it an add to the next chunk .

Parallelization

  • Parallelization for pippenger in the "submsms", the first step.

Resources