search

zkcrypto / pairing

Pairing-friendly elliptic curve library.
Other
337 stars 118 forks source link

Pairing speed relative to the herumi/mcl implementation #84

Open JustinDrake opened 6 years ago

JustinDrake commented 6 years ago

For BN254, Dfinity's implementation does pairing in less than 0.8ms (see here):

Notably, we see the signature validation time is 0.8 ms which involves a pairing evaluation.

This contrasts very favourably compared to the numbers given in this post where a BN254 pairing is done 2.5ms with USE_ASM. Why is the discrepancy so high, and does this suggest that this implementation can be sped up significantly?

daira commented 6 years ago

The BN254 implementation compared in that post is from libsnark. Should this be refiled as a ticket against libsnark?

daira commented 6 years ago

Oh, also the BLS12-381 pairing implemented in bellman takes 2.5ms in that post (on @ebfull's i7-3770S).

ebfull commented 6 years ago

Also, BN254 can mean a lot of different things. It can mean some 254-bit BN curve or it can mean the specific 254-bit BN curve implemented in libsnark, which could have different performance for pairings due to the parameter and the extension tower.

daira commented 5 years ago

https://github.com/dfinity/random-beacon is a bit of a red herring; the actual pairing implementation it uses is https://github.com/herumi/mcl (which supports BLS12-381 now). The readme says that it is using code from xbyak, so it is presumably doing JIT compilation. We're fine with the safe Rust code for now, but it's probably worth investigating whether we can achieve comparable performance without the JIT compilation.

(On the other hand, implementing batch proof validation would be a lower-hanging performance win.)