KZG Multiopen

Overview

The Multiopen stage of Halo2 proof generation consists of composing a set of numerator polynomials from linear combination of sets of input polynomials, dividing a set of roots out of each numerator, and reducing the resulting quotients into a single polynomial via another linear combination.

GPU Implementation

The linear combination steps of multiopen are trivially implemented on the GPU by summing the corresponding coefficients of each input polynomial in parallel. The polynomial division operation is more complex but can be cast as a modified prefix-scan operation for which highly efficient GPU solutions are readily available.

Performance

The following table outlines the performance improvements yielded with just the cuSnark KZG Multiopen employed, showing the (CPU baseline) and accelerated results for the different proof stages in a set of proofs of various sizes. Times are in seconds, obtained on a AMD EPYC 7702 64-Core Processor with 4x NVIDIA GeForce RTX 3090 (24 GB) GPUs.

Proof Stage2^20 rows, 1135 columns2^25 rows, 5 columns

Initialization

(6.04) 6.06

(1.40) 1.39

Generate Instance

(0.05) 0.05

(1.05) 1.06

Generate Advice

(381.78) 381.82

(6.68) 6.66

Generate Lookups

(57.99) 58.43

(2.10) 2.11

Commit Permutations

(146.59) 146.91

(23.72) 25.28

Eval_h

(1069.09) 1071.40

(66.58) 66.95

Compute Evaluations

(9.81) 9.95

(35.79) 35.91

Multiopen

(18.71) 7.67

(28.82) 1.71

Total

(1690.05) 1682.28

(166.15) 141.06

PreviousQuotient Polynomial EvaluationNextPolynomial Inversion

Last updated