MSM optimization

Cargo.toml

@@ -4,3 +4,12 @@ members = [
     "halo2_gadgets",
     "halo2_proofs",
 ]
+
+[profile.bench]
+opt-level = 3
+debug = false
+debug-assertions = false
+overflow-checks = false
+lto = true
+incremental = false
+codegen-units = 1

halo2_proofs/Cargo.toml

@@ -36,7 +36,7 @@ group = "0.11"
 rand = "0.8"
 rand_core = { version = "0.6", default-features = false }
 blake2b_simd = "1"
-pairing = { git = 'https://github.com/appliedzkp/pairing', package = "pairing_bn256" }
+pairing = { git = 'https://github.com/Brechtpd/pairing', branch = "msm", package = "pairing_bn256" }
 subtle = "2.3"
 cfg-if = "0.1"
 
@@ -57,6 +57,7 @@ criterion = "0.3"
 gumdrop = "0.8"
 proptest = "1"
 rand_core = { version = "0.6", default-features = false, features = ["getrandom"] }
+ark-std = { version = "0.3" }
 
 [target.'cfg(all(target_arch = "wasm32", target_os = "unknown"))'.dev-dependencies]
 getrandom = { version = "0.2", features = ["js"] }
@@ -68,6 +69,8 @@ gadget-traces = ["backtrace"]
 sanity-checks = []
 shplonk = []
 gwc = []
+asm = ["pairing/asm"]
+prefetch = ["pairing/prefetch"]
 
 [lib]
 bench = false

halo2_proofs/benches/plonk.rs

@@ -255,16 +255,16 @@ fn criterion_benchmark(c: &mut Criterion) {
         ParamsVerifier<Bn256>,
         ProvingKey<G1Affine>,
     ) {
-        let params: Params<G1Affine> = Params::<G1Affine>::unsafe_setup::<Bn256>(k);
+        let mut params: Params<G1Affine> = Params::<G1Affine>::unsafe_setup::<Bn256>(k);
         let params_verifier: ParamsVerifier<Bn256> = params.verifier(0).unwrap();
 
         let empty_circuit: MyCircuit<Fp> = MyCircuit { a: None, k };
-        let vk = keygen_vk(&params, &empty_circuit).expect("keygen_vk should not fail");
+        let vk = keygen_vk(&mut params, &empty_circuit).expect("keygen_vk should not fail");
         let pk = keygen_pk(&params, vk, &empty_circuit).expect("keygen_pk should not fail");
         (params, params_verifier, pk)
     }
 
-    fn prover(k: u32, params: &Params<G1Affine>, pk: &ProvingKey<G1Affine>) -> Vec<u8> {
+    fn prover(k: u32, params: &mut Params<G1Affine>, pk: &ProvingKey<G1Affine>) -> Vec<u8> {
         let rng = OsRng;
 
         let circuit: MyCircuit<Fp> = MyCircuit {
@@ -304,16 +304,16 @@ fn criterion_benchmark(c: &mut Criterion) {
             BenchmarkId::from_parameter(k),
             &(k, &params, &pk),
             |b, &(k, params, pk)| {
-                b.iter(|| prover(k, params, pk));
+                b.iter(|| prover(k, &mut params.clone(), pk));
             },
         );
     }
     prover_group.finish();
 
     let mut verifier_group = c.benchmark_group("plonk-verifier");
     for k in k_range {
-        let (params, params_verifier, pk) = keygen(k);
-        let proof = prover(k, &params, &pk);
+        let (mut params, params_verifier, pk) = keygen(k);
+        let proof = prover(k, &mut params, &pk);
 
         verifier_group.bench_with_input(
             BenchmarkId::from_parameter(k),

halo2_proofs/examples/simple-example-2.rs

@@ -245,11 +245,11 @@ fn main() {
     let empty_circuit: MyCircuit<Fp> = MyCircuit { a: None, k };
 
     // Initialize the polynomial commitment parameters
-    let params: Params<G1Affine> = Params::<G1Affine>::unsafe_setup::<Bn256>(k);
+    let mut params: Params<G1Affine> = Params::<G1Affine>::unsafe_setup::<Bn256>(k);
     let params_verifier: ParamsVerifier<Bn256> = params.verifier(public_inputs_size).unwrap();
 
     // Initialize the proving key
-    let vk = keygen_vk(&params, &empty_circuit).expect("keygen_vk should not fail");
+    let vk = keygen_vk(&mut params, &empty_circuit).expect("keygen_vk should not fail");
     let pk = keygen_pk(&params, vk, &empty_circuit).expect("keygen_pk should not fail");
 
     let circuit: MyCircuit<Fp> = MyCircuit {
@@ -263,7 +263,7 @@ fn main() {
     use std::time::Instant;
     let _dur = Instant::now();
 
-    create_proof(&params, &pk, &[circuit], &[&[]], OsRng, &mut transcript)
+    create_proof(&mut params, &pk, &[circuit], &[&[]], OsRng, &mut transcript)
         .expect("proof generation should not fail");
 
     println!("proving period: {:?}", _dur.elapsed());