Derivatives of the Pornin's method #3

AlekseiVambol · 2023-09-28T14:48:01Z

Implements the function computing the Jacobi symbol by means of the original modification of the Pornin's method for modular inversion. Adds to the prime field structs the method "jacobi", which uses this function for computing the Legendre symbol, where the numerator and denominator are the element and the characteristic of the field, respectively.

The Legendre symbol is computed by the added method 10.1 times faster than by the previously existing one based on the Euler's criterion.

Note: According to the test bench in /benches/bn256_field.rs, the aforesaid performance advantage is more than 20 times, which is incorrect. The reason for this behavior of the test bench has not been found yet.

mratsim · 2023-10-09T12:46:41Z

benches/bn256_field.rs

@@ -43,6 +42,12 @@ pub fn bench_bn256_field(c: &mut Criterion) {
    group.bench_function("bn256_fq_invert", |bencher| {
        bencher.iter(|| black_box(&a).invert())
    });
+    group.bench_function("bn256_fq_legendre", |bencher| {


I assume Legendre is the old implementation?

mratsim · 2023-10-09T12:47:56Z

src/pornin.rs

@@ -0,0 +1,415 @@
+use core::cmp::PartialEq;


Re: the file name, I forgot about this in the previous PR but I'll probably change this to "legendre_pornin" and "inversion_bernsteinyang" so the functionality of the file is evident.

Ok, but "jacobi_pornin" is preferable.

mratsim · 2023-10-09T12:51:04Z

src/pornin.rs

+            // The modified Jacobi symbols (x / |y|) and (x / |-y|) are equal, so "t" is not updated
+            d = -d;
+        }
+    }


In the paper there is an extra reduction before exiting the loop

I may have missed it, but does it appear somewhere?

No, this is done for the modular inversion. Neither the GCD nor the Jacobi symbol requires this part.

…95) * Derivatives of the Pornin's method (taikoxyz#3) * renaming file * make cargo fmt happy * clarifications from #95 (comment) [skip ci] * Formatting and slightly changing a comment --------- Co-authored-by: Aleksei Vambol <[email protected]>

* Add field conversion to/from `[u64;4]` (privacy-scaling-explorations#80) * feat: add field conversion to/from `[u64;4]` * Added conversion tests * Added `montgomery_reduce_short` for no-asm * For bn256, uses assembly conversion when asm feature is on * fix: remove conflict for asm * chore: bump rust-toolchain to 1.67.0 * Compute Legendre symbol for `hash_to_curve` (privacy-scaling-explorations#77) * Add `Legendre` trait and macro - Add Legendre macro with norm and legendre symbol computation - Add macro for automatic implementation in prime fields * Add legendre macro call for prime fields * Remove unused imports * Remove leftover * Add `is_quadratic_non_residue` for hash_to_curve * Add `legendre` function * Compute modulus separately * Substitute division for shift * Update modulus computation * Add quadratic residue check func * Add quadratic residue tests * Add hash_to_curve bench * Implement Legendre trait for all curves * Move misplaced comment * Add all curves to hash bench * fix: add suggestion for legendre_exp * fix: imports after rebase * Add simplified SWU method (privacy-scaling-explorations#81) * Fix broken link * Add simple SWU algorithm * Add simplified SWU hash_to_curve for secp256r1 * add: sswu z reference * update MAP_ID identifier Co-authored-by: Han <[email protected]> --------- Co-authored-by: Han <[email protected]> * Bring back curve algorithms for `a = 0` (privacy-scaling-explorations#82) * refactor: bring back curve algorithms for `a = 0` * fix: clippy warning * fix: Improve serialization for prime fields (privacy-scaling-explorations#85) * fix: Improve serialization for prime fields Summary: 256-bit field serialization is currently 4x u64, ie. the native format. This implements the standard of byte-serialization (corresponding to the PrimeField::{to,from}_repr), and an hex-encoded variant of that for (de)serializers that are human-readable (concretely, json). - Added a new macro `serialize_deserialize_32_byte_primefield!` for custom serialization and deserialization of 32-byte prime field in different struct (Fq, Fp, Fr) across the secp256r, bn256, and derive libraries. - Implemented the new macro for serialization and deserialization in various structs, replacing the previous `serde::{Deserialize, Serialize}` direct use. - Enhanced error checking in the custom serialization methods to ensure valid field elements. - Updated the test function in the tests/field.rs file to include JSON serialization and deserialization tests for object integrity checking. * fixup! fix: Improve serialization for prime fields --------- Co-authored-by: Carlos Pérez <[email protected]> * refactor: (De)Serialization of points using `GroupEncoding` (privacy-scaling-explorations#88) * refactor: implement (De)Serialization of points using the `GroupEncoding` trait - Updated curve point (de)serialization logic from the internal representation to the representation offered by the implementation of the `GroupEncoding` trait. * fix: add explicit json serde tests * Insert MSM and FFT code and their benchmarks. (privacy-scaling-explorations#86) * Insert MSM and FFT code and their benchmarks. Resolves taikoxyz/zkevm-circuits#150. * feedback * Add instructions * feeback * Implement feedback: Actually supply the correct arguments to `best_multiexp`. Split into `singlecore` and `multicore` benchmarks so Criterion's result caching and comparison over multiple runs makes sense. Rewrite point and scalar generation. * Use slicing and parallelism to to decrease running time. Laptop measurements: k=22: 109 sec k=16: 1 sec * Refactor msm * Refactor fft * Update module comments * Fix formatting * Implement suggestion for fixing CI * Re-export also mod `pairing` and remove flag `reexport` to alwasy re-export (privacy-scaling-explorations#93) fix: re-export also mod `pairing` and remove flag `reexport` to alwasy re-export * fix regression in privacy-scaling-explorations#93 reexport field benches aren't run (privacy-scaling-explorations#94) fix regression in privacy-scaling-explorations#93, field benches aren't run * Fast modular inverse - 9.4x acceleration (privacy-scaling-explorations#83) * Bernstein yang modular multiplicative inverter (#2) * rename similar to privacy-scaling-explorations#95 --------- Co-authored-by: Aleksei Vambol <[email protected]> * Fast isSquare / Legendre symbol / Jacobi symbol - 16.8x acceleration (privacy-scaling-explorations#95) * Derivatives of the Pornin's method (taikoxyz#3) * renaming file * make cargo fmt happy * clarifications from privacy-scaling-explorations#95 (comment) [skip ci] * Formatting and slightly changing a comment --------- Co-authored-by: Aleksei Vambol <[email protected]> * chore: delete bernsteinyang module (replaced by ff_inverse) * Bump version to 0.4.1 --------- Co-authored-by: David Nevado <[email protected]> Co-authored-by: Han <[email protected]> Co-authored-by: François Garillot <[email protected]> Co-authored-by: Carlos Pérez <[email protected]> Co-authored-by: einar-taiko <[email protected]> Co-authored-by: Mamy Ratsimbazafy <[email protected]> Co-authored-by: Aleksei Vambol <[email protected]>

…rivacy-scaling-explorations#95) * Derivatives of the Pornin's method (taikoxyz#3) * renaming file * make cargo fmt happy * clarifications from privacy-scaling-explorations#95 (comment) [skip ci] * Formatting and slightly changing a comment --------- Co-authored-by: Aleksei Vambol <[email protected]>

AlekseiVambol added 7 commits September 28, 2023 16:06

Add files via upload

1994b48

Add files via upload

64374a4

Add files via upload

ff12af9

Add files via upload

3bb5159

Add files via upload

51c9c08

Add files via upload

dfbb819

Add files via upload

d53afc5

AlekseiVambol requested a review from mratsim September 28, 2023 14:48

mratsim approved these changes Oct 9, 2023

View reviewed changes

mratsim merged commit 2239b6a into main Oct 12, 2023
7 checks passed

mratsim pushed a commit that referenced this pull request Oct 13, 2023

Derivatives of the Pornin's method (#3)

2f612eb

mratsim pushed a commit that referenced this pull request Oct 13, 2023

Derivatives of the Pornin's method (#3)

1180609

mratsim pushed a commit that referenced this pull request Oct 13, 2023

Derivatives of the Pornin's method (#3)

5ab7742

mratsim mentioned this pull request Oct 13, 2023

Fast isSquare / Legendre symbol / Jacobi symbol - 16.8x acceleration privacy-scaling-explorations/halo2curves#95

Merged

mratsim pushed a commit that referenced this pull request Oct 19, 2023

Derivatives of the Pornin's method (#3)

8000162

mratsim mentioned this pull request Nov 2, 2023

[Experiment] Merge back upstream changes for #2 and #3 #4

Merged

mratsim deleted the Derivatives-of-the-Pornin's-method branch November 2, 2023 16:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Derivatives of the Pornin's method #3

Derivatives of the Pornin's method #3

AlekseiVambol commented Sep 28, 2023 •

edited

Loading

mratsim Oct 9, 2023

AlekseiVambol Oct 9, 2023

mratsim Oct 9, 2023

AlekseiVambol Oct 9, 2023

mratsim Oct 9, 2023

AlekseiVambol Oct 9, 2023 •

edited

Loading

Derivatives of the Pornin's method #3

Derivatives of the Pornin's method #3

Conversation

AlekseiVambol commented Sep 28, 2023 • edited Loading

mratsim Oct 9, 2023

Choose a reason for hiding this comment

AlekseiVambol Oct 9, 2023

Choose a reason for hiding this comment

mratsim Oct 9, 2023

Choose a reason for hiding this comment

AlekseiVambol Oct 9, 2023

Choose a reason for hiding this comment

mratsim Oct 9, 2023

Choose a reason for hiding this comment

AlekseiVambol Oct 9, 2023 • edited Loading

Choose a reason for hiding this comment

AlekseiVambol commented Sep 28, 2023 •

edited

Loading

AlekseiVambol Oct 9, 2023 •

edited

Loading