ECFFT on the BN254 base field in Rust

Sat, 16 Oct 2021 00:57:25 -0700

$$ \def\F{\mathbb{F}} $$

tl;dr: A Rust implementation of the ECFFT here: https://github.com/wborgeaud/ecfft-bn254.

The last post was about the ECFFT algorithm by Eli Ben-Sasson, Dan Carmon, Swastik Kopparty and David Levit. At the end of the post, I mentioned that it would be fairly straightforward to implement the ECFFT algorithms in low-level languages like Rust by doing all the mathematical precomputations in Sage.

Well I have done exactly that and implemented the EXTEND and ENTER operations in Rust for the base field of the BN254 curve. This field has order

The ECFFT algorithm

Sat, 07 Aug 2021 00:57:25 -0700

$$ \def\F{\mathbb{F}} $$

This post is about a recent paper by Eli Ben-Sasson, Dan Carmon, Swastik Kopparty and David Levit. In this paper the authors present an amazing new generalization of the classic FFT algorithm that works in all finite fields. This post will give an overview of the algorithm and a simple implementation in Sage. I highly recommend reading the paper for more details and background.

The classic FFT algorithm

Let $p$ be a prime number, $n=2^k$ with $n \mid p-1$, $\langle w \rangle = H < \F_p^*$ a subgroup of size $n$. The classic FFT algorithm can be used to evaluate a polynomial $P(X)=\sum_{i=0}^n a_i X^i$ of degree $<n$ on $H$ in $O(n\log n)$. Note that the naive algorithm of evaluating $P$ at every point of $H$ takes $O(n^2)$ operations.
The FFT works by writing $P$ as $$P(X) = P_0(X^2) + XP_1(X^2)$$ where $P_0, P_1$ are the polynomials of degree $< n/2$ of even and odd coefficients of $P$.
Thus, given the evaluation of $P_0$ and $P_1$ on $H^2$, we can recover the evaluation of $P$ on $H$ with $O(n)$ operations.

Algorithms on wborgeaud

ECFFT on the BN254 base field in Rust

The ECFFT algorithm

The classic FFT algorithm