Make ECDSA more efficient with GLV #209
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mitschabaude
commented
Nov 28, 2023
Comment on lines
+81
to
+83
| /** | ||
| * GLV decomposition, named after the authors Gallant, Lambert and Vanstone who introduced it: | ||
| * https://iacr.org/archive/crypto2001/21390189.pdf |
There was a problem hiding this comment.
this is where the magic happens!
Comment on lines
+237
to
+242
| // upper bounds for | ||
| // |s0| <= 0.5 * (|v00| + |v01|) | ||
| // |s1| <= 0.5 * (|v10| + |v11|) | ||
| let maxS0 = ((abs(v00) + abs(v01)) >> 1n) + 1n; | ||
| let maxS1 = ((abs(v10) + abs(v11)) >> 1n) + 1n; | ||
| let maxBits = log2(max(maxS0, maxS1)); |
There was a problem hiding this comment.
it's essential that we are able to statically compute the maximum number of bits (maxBits) that scalars have after GLV decomposition, with a reliable upper bound. Only with this knowledge can we leverage the gains of reduced bit lengths in a static circuit.
Trivo25
approved these changes
Dec 1, 2023
| generator | ||
| )); | ||
| } catch (e: any) { | ||
| console.log(`Warning: no endomorphism for ${name}`, e?.message); |
There was a problem hiding this comment.
we could also utilize console.warn if we want - but that also sometimes gets mistaken for runtime warnings and just ignored by users :X
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Companion of o1-labs/o1js#1257
endoScalar,endoBase, implements methods to decompose a scalar, and to do faster scalar multiplication using that decomposition ("GLV method")endoScalarandendoBasewhen they exist and are not already given as parameters (i.e. for secp256k1)