Skip to content

Feat : MSM black box implementation#310

Open
ocdbytes wants to merge 20 commits intomainfrom
aj/black-box/msm
Open

Feat : MSM black box implementation#310
ocdbytes wants to merge 20 commits intomainfrom
aj/black-box/msm

Conversation

@ocdbytes
Copy link
Collaborator

@ocdbytes ocdbytes commented Feb 26, 2026

MSM Black Box Support

  • Implements black-box Multi-Scalar Multiplication (MSM) in the R1CS compiler with full elliptic
    curve arithmetic over multi-limb field elements.
  • Adds a cost model that analytically selects optimal (limb_bits, window_size) parameters,
    following the same pattern as SHA256 spread optimization.
  • Implements FakeGLV scalar decomposition for single-point MSM, reducing scalar width by ~50% via
    half-GCD and interleaved two-point windowed scalar multiplication.
  • Adds bigint_mod.rs in the prover for 256-bit modular arithmetic (half-GCD, Barrett reduction,
    modular inverse) used in witness solving.
  • 18.9% decrease in constraint count as compared to native noir implementation of msm.
  • To test MSM blackbox :
    cargo test -p provekit-bench --test compiler -- "embedded_curve_msm"

Performance Comparison :
This is for 2 points call for msm: s_1[p_1] * s_2[p_2]

Metric Native Noir MSM Black Box MSM % Reduction
R1CS Constraints 5,741 4,658 -18.9%
R1CS Witnesses 6,257 5,899 -5.7%
A Entries 6,749 6,813 +0.9%
B Entries 6,364 7,264 +14.1%
C Entries 14,453 9,021 -37.6%
W1 Size 3,354 1,769 -47.3%
W2 Size 3,367 4,130 +22.7%

@ocdbytes ocdbytes marked this pull request as ready for review March 11, 2026 03:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant