Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat Emulated BW6-761 #589

Closed
wants to merge 45 commits into from
Closed

Feat Emulated BW6-761 #589

wants to merge 45 commits into from

Conversation

SherLzp
Copy link
Contributor

@SherLzp SherLzp commented Mar 20, 2023

Emulate operations of BW6-761 curve with the following result:

Constraints:
MillerLoop 2153658
FinalExponentiation 2153658
1 Pairing: 3493454

In order to make complete tests, we need to wait for the merge of gnark-crypto#359

Sir, could you please take a reivew on that. @ivokub

@ivokub ivokub requested review from ivokub and yelhousni March 20, 2023 09:11
@ivokub
Copy link
Collaborator

ivokub commented Mar 20, 2023

Emulate operations of BW6-761 curve with the following result:

Constraints:
MillerLoop 2153658
FinalExponentiation 2153658
1 Pairing: 3493454

In order to make complete tests, we need to wait for the merge of gnark-crypto#359

Sir, could you please take a reivew on that. @ivokub

Thanks for the contribution! Also added @yelhousni.

It may take a few days before can get to it. But I really like the possibility of two layers of recursion, I think this will open up very interesting approaches for scalability.

@yelhousni
Copy link
Contributor

Great! thanks @SherLzp for the contribution!
This would be useful for a 2-layer recursion. One can use a 2-chain (e.g BLS12-377/BW6-761) for the first layer and then emulated BW6 over BN254 for the second layer (see conclusion of this paper).
There are however some optimisations to do (see #566). Also not sure if the twisted ate pairing is better than the ate pairing constraint-wise and there are couple of Miller loop variants I want to test (see this blog). What is your timeline on this? We can review as-is and work out the optimisations later or incorporate them into this PR?

@SherLzp
Copy link
Contributor Author

SherLzp commented Mar 21, 2023

Great! thanks @SherLzp for the contribution! This would be useful for a 2-layer recursion. One can use a 2-chain (e.g BLS12-377/BW6-761) for the first layer and then emulated BW6 over BN254 for the second layer (see conclusion of this paper). There are however some optimisations to do (see #566). Also not sure if the twisted ate pairing is better than the ate pairing constraint-wise and there are couple of Miller loop variants I want to test (see this blog). What is your timeline on this? We can review as-is and work out the optimisations later or incorporate them into this PR?

Yes, I think 2-chain + emulated BW6-761 is really amazing(comes from this paper). That's no problem. We can work out the optimisations later. If there is anything I can help, please let me know.

Even though if we use a bit wider limb we get one less limb then there is a
mismatch between the machine and non-native representations. For now change it
to match the machine sizes.

We are likely to reconsider the sizes when have updated the range checker
gadget to have limb sizes multible of the table size.
@ivokub
Copy link
Collaborator

ivokub commented Mar 23, 2023

I pushed a few fixes. There are still some cleanup work to do but I'll postpone. I want to move some types around into packages where they are actually used (LineEvaluation), also some documentation would be nice. And I see that tests print some logging info.

All in all, I think it is a bit of work. I'll then have a look at the correctness.

@yelhousni yelhousni self-assigned this Apr 5, 2023
@yelhousni yelhousni added new feature consolidate strengthen an existing feature labels Apr 5, 2023
@gbotrel gbotrel changed the base branch from develop to master August 22, 2023 19:49
@yelhousni yelhousni mentioned this pull request Oct 4, 2023
16 tasks
@yelhousni
Copy link
Contributor

yelhousni commented Oct 9, 2023

@SherLzp we ended up re-implementing in #846 the emulated BW6-761 pairing with the same optimization techniques as for BN254 and BLS12-381. I wanted to thank you for this PR which helped me init and test #846. The overall cost is now 2,969,304 R1CS which saves 524,150 constraints.

Edit: 2,716,106 R1CS now

@yelhousni yelhousni closed this Oct 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
consolidate strengthen an existing feature new feature
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants