Multi-scalar Multiplication Research Articles

Application of Mordell–Weil lattices with large kissing numbers to acceleration of multiscalar multiplication on elliptic curves

Abstract This article aims to speed up (the precomputation stage of) multiscalar multiplication (MSM) on ordinary elliptic curves of j j -invariant 0 with respect to specific “independent” (also known as “basis”) points. For this purpose, the so-called Mordell–Weil lattices (up to rank 8) with large kissing numbers (up to 240) are employed. In a nutshell, the new approach consists in obtaining more efficiently a considerable number (up to 240) of certain elementary linear combinations of the “independent” points. By scaling the point (re)generation process, it is thus possible to obtain a significant performance gain. As usual, the resulting curve points can be then regularly used in the main stage of an MSM algorithm to avoid repeating computations. Seemingly, this is the first usage of lattices with large kissing numbers in cryptography, while such lattices have already found numerous applications in other mathematical domains. Without exaggeration, MSM is a widespread primitive (often the unique bottleneck) in modern protocols of real-world elliptic curve cryptography. Moreover, the new (re)generation technique is prone to further improvements by considering Mordell–Weil lattices with even greater kissing numbers.

Speeding Up Multi-scalar Multiplications for Pairing-Based zkSNARKs

Speeding Up Multi-scalar Multiplications for Pairing-Based zkSNARKs

OPTIMSM: FPGA hardware accelerator for Zero-Knowledge MSM

The Multi-Scalar Multiplication (MSM) is the main barrier to accelerating Zero-Knowledge applications. In recent years, hardware acceleration of this algorithm on both FPGA and GPU has become a popular research topic and the subject of a multi-million dollar prize competition (ZPrize). This work presents OPTIMSM: Optimized Processing Through Iterative Multi-Scalar Multiplication. This novel accelerator focuses on the acceleration of the MSM algorithm for any Elliptic Curve (EC) by improving upon the Pippenger algorithm. A new iteration technique is introduced to decouple the required buckets from the window size, resulting in fewer EC computations for the same on-chip memory resources. Furthermore, we combine known optimizations from the literature for the first time to achieve additional latency improvements. Our enhanced MSM implementation significantly reduces computation time, achieving a speedup of up to x12.77 compared to recent FPGA implementations. Specifically, for the BLS12-381 curve, we reduce the computation time for an MSM of size 224 to 914 ms using a single compute unit on the U55C FPGA or to 231 ms using four U55C devices. These results indicate a substantial improvement in efficiency, paving the way for more scalable and efficient Zero-Knowledge proof systems.

SimdMSM: SIMD-accelerated Multi-Scalar Multiplication Framework for zkSNARKs

Multi-scalar multiplication (MSM) is the primary building block in many pairing-based zero-knowledge proof (ZKP) systems. MSM at large scales has become the main bottleneck in ZKP implementations. Inspired by existing SIMD-accelerated work, we are focused on accelerating MSM computing efficiency using SIMD instructions in a single CPU environment. First, we propose a SIMD-accelerated MSM computing architecture with no write conflicts and constant memory overheads. This architecture utilizes multithreading to achieve task-level and loop-level parallelism and employs a three-tier buffer mechanism to maximize the utilization of the SIMD engine. Instanced with AVX512-IFMA instructions, we implement six SIMD elliptic curve arithmetic engines for different point addition in three coordinate systems and two groups. Moreover, we integrate our AVX-MSM implementation into the libsnark library, naming it AVX-ZK. In more detail, point deduplication and “Three-Stage” memory optimization are proposed to address problems existing in practical applications. Based on the RELIC library, our performance results on the BLS12-381 curve show that our AVX-MSM achieves up to 27.86x speedup over the most popular Pippenger algorithm. Compared with libsnark, our AVX-ZK implementation achieves over 11.53x (up to 20.26x) speedup under standard benchmarks.

Falic: An FPGA-Based Multi-Scalar Multiplication Accelerator for Zero-Knowledge Proof

Falic: An FPGA-Based Multi-Scalar Multiplication Accelerator for Zero-Knowledge Proof

Accelerating large-scale multi-scalar multiplication in Zk-SNARK through exploiting its multilevel parallelism

Accelerating large-scale multi-scalar multiplication in Zk-SNARK through exploiting its multilevel parallelism

Elastic MSM: A Fast, Elastic and Modular Preprocessing Technique for Multi-Scalar Multiplication Algorithm on GPUs

Zero-knowledge proof (ZKP) is a cryptographic primitive that enables a prover to convince a verifier that a statement is true, without revealing any other information beyond the correctness of the statement itself. Due to its powerful capabilities, its most practical type, called zero-knowledge Succinct Non-interactive ARgument of Knowledge (zkSNARK), has been widely deployed in various privacypreserving applications such as cryptocurrencies and verifiable computation. Although state-of-the-art zkSNARKs are highly efficient for the verifier, the computational overhead for the prover is still orders of magnitude too high to warrant use in many applications. This overhead arises from several time-consuming operations, including large-scale matrix-vector multiplication (MUL), number-theoretic transform (NTT), and especially the multi-scalar multiplication (MSM) which constitutes the largest proportion. Therefore, further efficiency improvements are needed.In this paper, we focus on comprehensive optimization of running time and storage space required by the MSM algorithm on GPUs. Specifically, we propose a novel, modular and adaptive parameter configuration technique—elastic MSM to enable us to adjust the scale of MSM according to our own wishes by performing a corresponding amount of preprocessing. This technique enables us to fully unleash the potential of various efficient parallel MSM algorithms. We have implemented and tested elastic MSM over three prevailing parallel Pippenger algorithms on GPUs. Across various preprocessing space limitations (across various MSM scales), our constructions achieve up to about 1.90×, 1.08× and 1.36× (2.58×, 1.39× and 1.91×) speedup versus three state-of-the-art parallel Pippenger algorithms on GPUs, respectively.From another perspective, elastic MSM could also be regarded as a preprocessing technique over the well-known Pippenger algorithm, which is modular and could be used to accelerate almost all the most advanced parallel Pippenger algorithms on GPUs. Meanwhile, elastic MSM provides an adaptive trade-off between the running time and the extra storage space needed by parallel Pippenger algorithms on GPUs. This is the first preprocessing technique to retain the improved MSM computation brought by preprocessing under varying storage space limitations. Specifically, across various preprocessing space limitations (across various MSM scales), our constructions achieve up to about 192× and 223× (159× and 174×) speedup versus two state-ofthe- art preprocessing parallel Pippenger algorithms on GPUs, respectively.

PriorMSM: An Efficient Acceleration Architecture for Multi-Scalar Multiplication

Multi-Scalar Multiplication (MSM) is a computationally intensive task that operates on elliptic curves based on GF(P) . It is commonly used in zero-knowledge proof (ZKP), where it accounts for a significant portion of the computation time required for proof generation. In this article, we present PriorMSM, an efficient acceleration architecture for MSM. We propose a Priority-Based Scheduling Mechanism (PBSM) based on a multi-FIFO and multi-bank architecture to accelerate the implementation of MSM. By increasing the pairing success rate of internal points, PBSM reduces the number of bubbles in the pipeline of point addition (PADD), consequently improving the data throughput of the pipeline. We also introduce an advanced parallel bucket aggregation algorithm, leveraging PADD’s fully pipelined characteristics to significantly accelerate the implementation of bucket aggregation. We perform a sensitivity analysis on the crucial parameter of window size in MSM. The results indicate that the window size of the MSM significantly impacts its latency. Area-Time Product (ATP) metric is introduced to guide the selection of the optimal window size, balancing the performance and cost for practical applications of subsequent MSM implementations. PriorMSM is evaluated using the TSMC 28 nm process. It achieves a maximum speedup of 10.9× compared to the previous custom hardware implementations and a maximum speedup of 3.9× compared to the GPU implementations.

Load-Balanced Parallel Implementation on GPUs for Multi-Scalar Multiplication Algorithm

Multi-scalar multiplication (MSM) is an important building block in most of elliptic-curve-based zero-knowledge proof systems, such as Groth16 and PLONK. Recently, Lu et al. proposed cuZK, a new parallel MSM algorithm on GPUs. In this paper, we revisit this scheme and present a new GPU-based implementation to further improve the performance of MSM algorithm. First, we propose a novel method for mapping scalars into Pippenger’s bucket indices, largely reducing the number of buckets compared to the original Pippenger algorithm. Second, in the case that memory is sufficient, we develop a new efficient algorithm based on homogeneous coordinates in the bucket accumulation phase. Moreover, our accumulation phase is load-balanced, which means the parallel speedup ratio is almost linear growth as the number of device threads increases. Finally, we also propose a parallel layered reduction algorithm for the bucket aggregation phase, whose time complexity remains at the logarithmic level of the number of buckets. The implementation results over the BLS12-381 curve on the V100 graphics card show that our proposed algorithm achieves up to 1.998x, 1.821x and 1.818x speedup compared to cuZK at scales of 221, 222, and 223, respectively.

CuZK: Accelerating Zero-Knowledge Proof with A Faster Parallel Multi-Scalar Multiplication Algorithm on GPUs

Zero-knowledge proof is a critical cryptographic primitive. Its most practical type, called zero-knowledge Succinct Non-interactive ARgument of Knowledge (zkSNARK), has been deployed in various privacy-preserving applications such as cryptocurrencies and verifiable machine learning. Unfortunately, zkSNARK like Groth16 has a high overhead on its proof generation step, which consists of several time-consuming operations, including large-scale matrix-vector multiplication (MUL), number-theoretic transform (NTT), and multi-scalar multiplication (MSM). Therefore, this paper presents cuZK, an efficient GPU implementation of zkSNARK with the following three techniques to achieve high performance. First, we propose a new parallel MSM algorithm. This MSM algorithm achieves nearly perfect linear speedup over the Pippenger algorithm, a well-known serial MSM algorithm. Second, we parallelize the MUL operation. Along with our self-designed MSM scheme and well-studied NTT scheme, cuZK achieves the parallelization of all operations in the proof generation step. Third, cuZK reduces the latency overhead caused by CPU-GPU data transfer by 1) reducing redundant data transfer and 2) overlapping data transfer and device computation. The evaluation results show that our MSM module provides over 2.08x (up to 2.94x) speedup versus the state-of-the-art GPU implementation. cuZK achieves over 2.65x (up to 4.86x) speedup on standard benchmarks and 2.18× speedup on a GPU-accelerated cryptocurrency application, Filecoin.

Faster Montgomery multiplication and Multi-Scalar-Multiplication for SNARKs

The bottleneck in the proving algorithm of most of elliptic-curve-based SNARK proof systems is the Multi-Scalar-Multiplication (MSM) algorithm. In this paper we give an overview of a variant of the Pippenger MSM algorithm together with a set of optimizations tailored for curves that admit a twisted Edwards form. We prove that this is the case for SNARK-friendly chains and cycles of elliptic curves, which are useful for recursive constructions. Our contribution is twofold: first, we optimize the arithmetic of finite fields by improving on the well-known Coarsely Integrated Operand Scanning (CIOS) modular multiplication. This is a contribution of independent interest that applies to many different contexts. Second, we propose a new coordinate system for twisted Edwards curves tailored for the Pippenger MSM algorithm.Accelerating the MSM over these curves is critical for deployment of recursive proof< systems applications such as proof-carrying-data, blockchain rollups and blockchain light clients. We implement our work in Go and benchmark it on two different CPU architectures (x86 and arm64). We show that our implementation achieves a 40-47% speedup over the state-of-the-art implementation (which was implemented in Rust). This MSM implementation won the first place in the ZPrize competition in the open division “Accelerating MSM on Mobile” and will be deployed in two real-world applications: Linea zkEVM by ConsenSys and probably Celo network.

Speeding Up Multi-Scalar Multiplication over Fixed Points Towards Efficient zkSNARKs

The arithmetic of computing multiple scalar multiplications in an elliptic curve group then adding them together is called multi-scalar multiplication (MSM). MSM over fixed points dominates the time consumption in the pairing-based trusted setup zero-knowledge succinct non-interactive argument of knowledge (zkSNARK), thus for practical applications we would appreciate fast algorithms to compute it. This paper proposes a bucket set construction that can be utilized in the context of Pippenger’s bucket method to speed up MSM over fixed points with the help of precomputation. If instantiating the proposed construction over BLS12-381 curve, when computing n-scalar multiplications for n = 2e (10 ≤ e ≤ 21), theoretical analysis ndicates that the proposed construction saves more than 21% computational cost compared to Pippenger’s bucket method, and that it saves 2.6% to 9.6% computational cost compared to the most popular variant of Pippenger’s bucket method. Finally, our experimental result demonstrates the feasibility of accelerating the computation of MSM over fixed points using large precomputation tables as well as the effectiveness of our new construction.

On Multi-Scalar Multiplication Algorithms for Register-Constrained Environments

A basic but expensive operation in the implementations of several famous public-key cryptosystems is the computation of the multi-scalar multiplication in a certain finite additive group defined by an elliptic curve. We propose an adaptive window method for the multi-scalar multiplication, which aims to balance the computation cost and the memory cost under register-constrained environments. That is, our method can maximize the computation efficiency of multi-scalar multiplication according to any small, fixed number of registers provided by electronic devices. We further demonstrate that our method is efficient when five registers are available. Our method is further studied in detail in the case where it is combined with the non-adjacent form (NAF) representation and the joint sparse form (JSF) representation. One efficiency result is that our method with the proposed improved NAF n-bit representation on average requires 209n/432 point additions. To the best of our knowledge, this efficiency result is optimal compared with those of similar methods using five registers. Unlike the previous window methods, which store all possible values in the window, our method stores those with comparatively high probabilities to reduce the number of required registers.

An Improvement of Scalar Multiplication by Skew Frobenius Map with Multi-Scalar Multiplication for KSS Curve

An Improvement of Scalar Multiplication by Skew Frobenius Map with Multi-Scalar Multiplication for KSS Curve

Optimizing memory cost of multi-scalar multiplication

Предлагается модификация разреженного представления для мультискалярного умножения, обеспечивающая эффективную балансировку эффективности и памяти. Кроме того, выявлена особенность исходного алгоритма, препятствующая использованию всех возможных оснований.

Hardware Realization of Fast Multi-Scalar Elliptic Curve Point Multiplication by Reducing the Hamming Weights Over GF(p)

We present a new hardware realization of fast elliptic curve Multi-Scalar Point Multiplication (MSPM) using the sum of products expansion of the scalars. In Elliptic curve point Multiplication latency depends on the number of one's (Hamming Weight) in the binary representation of the scalar multiplier. By reducing the effective number of one's in the multiplier, the multiplication speed is automatically increased. Therefore we describe a new method of effectively reducing the Hamming weight of the scalar multipliers thereby reduces the number of Point Adders when multi scalar multiplication is needed. The increase in speed achieved outweighs the hardware cost and complexity. Index Terms—Sum of products expansion, Hamming Weight, multi-scalar point multiplication, triple-scalar point multiplication, elliptic curve point multiplication, elliptic curve point addition.

Hyper-and-elliptic-curve cryptography

AbstractThis paper introduces ‘hyper-and-elliptic-curve cryptography’, in which a single high-security group supports fast genus-2-hyperelliptic-curve formulas for variable-base-point single-scalar multiplication (for example, Diffie–Hellman shared-secret computation) and at the same time supports fast elliptic-curve formulas for fixed-base-point scalar multiplication (for example, key generation) and multi-scalar multiplication (for example, signature verification).

A Novel Elliptic Curve Scalar Multiplication Algorithm against Power Analysis

Nowadays, power analysis attacks are becoming more and more sophisticated. Through power analysis attacks, an attacker can obtain sensitive data stored in smart cards or other embedded devices more efficiently than with any other kind of physical attacks. Among power analysis, simple power analysis (SPA) is probably the most effective against elliptic curve cryptosystem, because an attacker can easily distinguish between point addition and point doubling in a single execution of scalar multiplication. To make elliptic curve scalar multiplication secure against SPA attacks, many methods have been proposed using special point representations. In this paper, a simple but efficient SPA-resistant multiscalar multiplication is proposed. The method is to convert the scalar into a nonadjacent form (NAF) representation at first and then constitute it in a new signed digit representation. This new representation is undertaken at a small precomputation cost, as each representation needs just one doubling and 1/2 additions for each bit. In addition, when combined with randomization techniques, the proposed method can also guard against differential power analysis (DPA) attack.

Triple-Base Hybrid Joint Sparse Form and its Applications

Multi-scalar multiplication and multi-exponentiation are the major problems in digital signal processing(DSP) and in public-key cryptography. In DSP, multiplication of the filter coefficients, which is used in different signal processing algorithms, is a time consuming operation. Also in elliptic curve cryptography(ECC), this multiplication process takes a lot of time. Though there are several algorithms to speed up this multiplication process, but they are not up to the satisfactory limit. The algorithms are based on the minimization of the multipliers or adders required, i.e. the minimization of the numbers of „one‟ appear in the binary representation of the signal and the coefficients in DSP or of the number of general multiplications and points addition in ECC. Different existing algorithms in this context are Joint Sparse Form(JSF), w-NAF, Double Base Chain(DBC), Hybrid Binery-Ternary Joint Sparse Form(HBTJSF) etc. In this paper, a novel algorithm has been proposed which is the modified HBTJSF, known as Triple-Base Hybrid Joint Sparse Form(TBHJSF). The proposed method is based on the decomposition of an integer or fraction that mixes the power of the base 2,3 and 5. The experimental results show that it requires less numbers of multiplier and adder and hence show its novelty over other algorithms.

A Multiple Scalar Multiplications Algorithm in the Elliptic Curve Cryptosystem

PDF HTML阅读 XML下载 导出引用 引用提醒 椭圆曲线密码中一种多标量乘算法 DOI: 10.3724/SP.J.1001.2011.03730 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: 国家自然科学基金(90704003); 国家高技术研究发展计划(863)(863-317-01-04-99, 2007AA01Z431); 河南省重大科技攻关项目(092101210502) A Multiple Scalar Multiplications Algorithm in the Elliptic Curve Cryptosystem Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:标量乘和多标量乘是实现椭圆曲线密码体制的核心运算,其运算速度从整体上决定了椭圆曲线密码体制的实现效率.提出了一种多标量乘算法,该算法的基本思想是,将标量用带符号的整数阶乘展开式表示,并结合固定基窗口标量乘算法,使得实现多标量乘算法只需做点加运算即可.这不仅突破了传统求多标量乘算法的模式,而且提高了多标量乘的计算速度.同时,还对算法正确性和复杂度进行了分析.由实验结果可知,在m=2 的情况下,该算法在计算效率上比已有的多标量乘算法提高了约47.8%~56.5%. Abstract:The main operations of elliptic curve cryptosystems (ECCs) are scalar multiplications and multi-scalar multiplications, which heavily determined the overall implementation of the efficiency of ECC. This algorithm extends the fixed-base window method by using the signed integer factorial expansions of scalar. The main characteristic of this method is that only a point addition computation is required, and it greatly improves the computational performance of a multi-scalar. Furthermore, the correctness proof and complexity analysis of the new algorithm are presented. At last, experimental results show that the computational efficiency increases about 47.8% to 56.5% when compared with other existing methods in the case m=2. 参考文献 相似文献 引证文献