Precompile

[0xWOLAND]

Currently, bls12-381 implements CPU-optimized Fp multiplication. However, this is quite slow inside of SP1. Instead, we should use a precompile to accelerate Fp-type multiplication.

[0xWOLAND]

This is because Fp uses a Montgomery representation, so we have to multiply by r_inv to convert a normal number back into Montgomery form. Here's the cost of doing this here versus in the precompile:

Montgomery Conversion in bls12-381

┌╴fp-square    
└╴942 cycles    
┌╴fp-mul    
└╴1,022 cycles    
┌╴fp2-square    
└╴2,471 cycles    
┌╴fp2-mul    
└╴3,761 cycles    
┌╴fp6-square    
└╴24,385 cycles   
┌╴fp6-mul    
└╴37,067 cycles   
┌╴fp12-square    
└╴91,731 cycles   
┌╴fp12-mul    
└╴128,033 cycles  

Montgomery Conversion in an SP1 Precompile

┌╴fp-square    
└╴731 cycles    
┌╴fp-mul    
└╴811 cycles    
┌╴fp2-square    
└╴2,055 cycles   
┌╴fp2-mul    
└╴2,955 cycles   
┌╴fp6-square    
└╴21,594 cycles  
┌╴fp6-mul    
└╴29,443 cycles  
┌╴fp12-square    
└╴76,539 cycles  
┌╴fp12-mul    
└╴104,920 cycles 

So putting this in the precompile makes it marginally faster. I computed the Montgomery conversion in the bls12-381 crate to make verify_kzg_proof 15% more cycles.

[0xWOLAND]

Also, if we move the Montgomery conversion logic into the precompile, the total cycle count for verify_kzg_proof is 95,222,885 cycles. If we crudely do two multiplications (as above), it is 111,284,472 cycles.

[0xWOLAND]

Related to succinctlabs/sp1#1075