v0.22.0

⚠️ Breaking changes

• BLS12-381/Jubjub: twisted-Edwards generator corrected (#821) — regenerate points, keys, and signatures derived from the previous generator.
• BLS12-381/Bandersnatch EdDSA now runs on Bandersnatch instead of Jubjub (#882) — regenerate keys and signatures.
• MamaBear Poseidon2 parameters corrected to R_F = 8, R_P = 32 for 128-bit security (#900) — digests are incompatible with the inherited schedule.
• Go 1.26.8 is now required (go.mod), CI runs Go 1.26.x.

🔒 Security

• ecdsa: reject identity and small-subgroup public keys in SetBytes (#889)
• kzg: restore Vk.G1 from the generator in MpcSetup.ReadFrom — a deserialized setup previously carried Vk.G1 = ∞, letting arbitrary nonzero opening proofs verify (#891)
• vortex: reject malformed opening proofs that could make a false evaluation claim verify (KoalaBear #896; MamaBear in this PR)
• shplonk, fflonk: validate proof shape in BatchVerify to prevent panics (#892)
• fft: validate domain cardinality in ReadFrom to prevent panic/OOM (#893)
• field vectors: bound the vector length read by AsyncReadFrom (#878)

✨ New

• MamaBear field (49-bit, p = 2⁴⁹ − 2³⁴ + 1): base field with AVX-512 IFMA kernels (R = 2⁵² Montgomery), degree-3 extension (~147-bit security), FFT (max NTT size 2³⁴), Poseidon2, SIS, IOP, and the experimental Vortex commitment scheme (#887)
• kzg: Committer interface + OpenWithCommitter / BatchOpenSinglePointWithCommitter for externally accelerated quotient commitments (e.g. WebGPU/wasm MSM) (#879)

⚡ Faster

• MamaBear IFMA vector kernels: mul 22.5×, scalarMul 22.7×, innerProduct 16.5×, sum 15.5× vs pure-Go at 2¹⁴ elements (still 5–9× at 2²⁴); E3 mul −12.5%, square −15.4%, lazy-reduction paths, Poseidon2 −7% (#887)

New Contributors

• @rdubois-crypto made their first contribution in #882
• @tzh476 made their first contribution in #878
• @Lepsina made their first contribution in #897
• @sug0 made their first contribution in #821

Full Changelog: v0.21.0...v0.22.0

v0.21.0

⚠️ Breaking Changes

• FRI & Plookup relocated — The fri and plookup packages are gone from all curves. FRI primitives now live under field/koalabear.
• Parallel goes public — internal/parallel is now exported as parallel; the worker pool moved to utils.
• Stricter EdDSA key parsing:
  • PublicKey.SetBytes now rejects points outside the prime-order subgroup.
  • PrivateKey.SetBytes now rejects malformed scalars and public keys that don't match their scalar.
  • Keys that used to load may now error.

🔒 Security

• shplonk & fflonk were missing subgroup membership checks on digests and proof points before verifying.
• KZG MPC setup — Verify was checking the ratio on the previous SRS instead of the contributed one, and never bound the G1 update to the proof.
• Subgroup membership tests added to all twistededwards curves.
• Fp2.Sqrt returned a wrong result on (non-QR, 0) inputs.
• Fixed a 4-byte overread in the innerProdVec AVX-512 path.

✨ New

• Cube roots in Fp and Fp2.
• FFT over degree-6 extensions for koalabear and babybear.
• Generic BitReverse / BitReverseCopy helpers in utils.
• Fixed-base scalar multiplication on twisted Edwards curves (used by eddsa).
• secp256r1: Fp2 tower + Cardano cube-root solver.

⚡ Faster

• 4-bit sliding window exponentiation across all fields.
• Lazy-reduction 𝔽p2 multiplication assembly for BLS12-381, BLS12-377, BLS24-315 & BLS24-317, plus improved Expt/mulBySeed chains and faster hash-to-G1 in the highly 2-adic Fp case.
• New SIMD work on the small fields:
  • AVX-512 & NEON kernels for Poseidon2 compression and VectorE6
  • AVX-512 batch ops for E6 FFT (2.97×)
  • Inlined E6 arithmetic for 31-bit primes (2.07×)
  • Unrolled FFT kernels

v0.20.1

This release contains correctness fix for vector multiplication using IFMA, see #816. Users of ecc/bls12-377/fr, ecc/bls12-381/fr, ecc/bls24-315/fr, ecc/bn254/fr, ecc/bn254/fp, ecc/grumpkin/fr, ecc/grumpkin/fp, ecc/stark-curve/fr and ecc/stark-curve/fp using v0.20.0 should upgrade to avoid incorrect computation results.

What's Changed

• fix: correct IFMA vector mul carry propagation by @gbotrel in #816
• deps(actions)(deps): bump actions/setup-go from 6.2.0 to 6.3.0 in the core-actions-minor-patch group by @dependabot[bot] in #814
• release: v0.20.1 by @ivokub in #818

Full Changelog: v0.20.0...v0.20.1

v0.20.0

What's Changed

• Feat: Jacobian Triple for j=0 curves by @yelhousni in #715
• feat: handle len(p)=0 in kzg by @ThomasPiellard in #730
• perf: optimize (purego) extension for koalabear by @gbotrel in #729
• fix: #727 with go generate and cosmetics by @gbotrel in #734
• perf: adds E4 vector ops (avx512) by @gbotrel in #733
• feat: make bitReverse generic by @gbotrel in #736
• fix: reintroduce BitReverse in fft package as deprecated for backward… by @gbotrel in #740
• perf: add for small fields int64 for exp by @gbotrel in #738
• feat: adds e4 vector Exp method by @gbotrel in #739
• Feat: add column linear combination check by @YaoJGalteland in #731
• Feat/newdomain optimization by @YaoJGalteland in #737
• Perf(BN254, BLS12-377/BW6-761): revisit mulBySeed() addition chains in G1/2 by @yelhousni in #720
• mpcsetup(generator): use G2Affine in UpdateMonomialsG2 template by @Forostovec in #735
• chore: clarify PublicKey.SetBytes uses compressed public key by @VolodymyrBg in #732
• perf: use vector ops on FFT E4 by @gbotrel in #746
• Feat/batch lagrange by @YaoJGalteland in #745
• feat: vector e4 utils ops by @gbotrel in #749
• feat: add parallel prefix product for vector e4 by @gbotrel in #750
• feat: add typed field hasher interface in MiMC package by @gbotrel in #752
• perf: twisted Edwards affine arithmetic by @yelhousni in #743
• perf: limit memory allocation during Vector deserialization by @ivokub in #759
• CI: Standardize imports by @Tabaie in #760
• fix: remove duplicate import by @ivokub in #762
• Perf: Optimize Sqrt in Fp2 for all fields by @yelhousni in #757
• feat: batch subgroup membership testing by @yelhousni in #710
• chore: merge v0.19 hotfix branch by @ivokub in #766
• release: v0.19 hotfix branch by @ivokub in #765
• chore: use self hosted runners by @waskow-consensys in #763
• Feat: Add P-256 (secp256r1) elliptic curve + ECDSA by @yelhousni in #767
• Feat/sig bounds by @ThomasPiellard in #725
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in the go_modules group across 1 directory by @dependabot[bot] in #770
• Fix: Affine twisted Edwards scalar multiplication edge case by @yelhousni in #774
• ci: enable security code scanner by @witmicko in #771
• perf(bw6): faster direct Fp6 mul by @yelhousni in #776
• perf: adds poseidon2 "simd" fashion compress function (avx512) by @gbotrel in #777
• feat: Expose NewDefaultPermutation in Poseidon2 packages by @Tabaie in #761
• perf: adds some more neon implementations for poseidon2 by @gbotrel in #785
• perf: direct quartic extension for koala and baby bears by @yelhousni in #779
• refactor: use more defines in assembly fine to make files less verbose by @gbotrel in #789
• perf: improve small size fft by @gbotrel in #791
• Refactor: code-generate Fp6 tower for BW6 curves by @yelhousni in #792
• fix: E2 MustSetRandom all elements by @ivokub in #793
• perf: use NAF decomposition in mulWindow by @yelhousni in #787
• perf: implement wNAF width=5 GLV scalar mul on G1/2 by @yelhousni in #788
• perf: GLV-GLS scalar multiplication in G2 by @yelhousni in #786
• perf: optimize precomputation in fixed-argument pairings by @yelhousni in #797
• perf: use ifma for some 4w vector operations by @gbotrel in #795
• feat: lattice-based rational reconstructions for gnark scalar decompositions by @yelhousni in #799
• perf: optimize Sqrt in highly 2-adic fields by @yelhousni in #796
• perf: optimize pre-computation in fixed-argument pairings by batching double steps by @yelhousni in #798
• chore: update ci workflows to go 1.25 by @gbotrel in #801
• chore: reintroduce slack notif by @gbotrel in #802
• fix: fix cursor bot comments by @gbotrel in #803
• chore: add dependabot configuration for GitHub Actions updates by @eloi010 in #804
• feat: add bn254 poseidon2 constants and support t=4/8/12/16 by @devon1209 in #783
• Add Python language configuration to security scanner (#807) by @ivokub in #808
• chore: rename sage files by @ivokub in #806
• FFT Vectorization Optimization for F31 Fields by @YaoJGalteland in #812
• FiatShamir: creation of new challenges with New() by @ThomasPiellard in #811
• chore: golangci-lint update by @ivokub in #813
• release: v0.20.0 by @ivokub in #815

New Contributors

• @Forostovec made their first contribution in #735
• @VolodymyrBg made their first contribution in #732
• @waskow-consensys made their first contribution in #763
• @eloi010 made their first contribution in #804
• @devon1209 made their first contribution in #783

Full Changelog: v0.19.2...v0.20.0

v0.19.2

Full Changelog: v0.19.1...v0.19.2

v0.19.1

Full Changelog: v0.19.0...v0.19.1

v0.18.2

Full Changelog: v0.18.1...v0.18.2

v0.18.1

Full Changelog: v0.18.0...v0.18.1

v0.19.0

What's Changed

• updating link to GLV.pdf in whole repo by @kks-code in #696
• fix: fixes #697 by @ThomasPiellard in #698
• feat: set default size for state by @ThomasPiellard in #700
• fix: MerkleDamgardHasher IV by @Tabaie in #701
• fix: MerkleDamgardHasher.Sum by @Tabaie in #699
• perf: Legendre using Pornin20 by @Tabaie in #704
• perf: small scalarmul by @ivokub in #703
• perf: optimize Eisenstein arithmetic by @yelhousni in #706
• Feat: Subgroup membership testing on Bandersnatch by @yelhousni in #708
• Feat/iop koalabear by @ThomasPiellard in #695
• perf: Doubling and mixed doubling in Jacobians and ext. Jacobians by @yelhousni in #716
• fix: refactor asm code generation to avoid use of R15 with global memory accesses by @gbotrel in #712
• Refector: Add feed-forward step to CompressPoseidon2 function by @YaoJGalteland in #721
• CI: Upgrade linter by @Tabaie in #726
• CI: update linter for the "push to master" flow by @Tabaie in #728

New Contributors

• @kks-code made their first contribution in #696

Full Changelog: v0.18.0...v0.19.0

v0.18.0

What's Changed

• perf: disable cobra bit reverse for small fields by @gbotrel in #662
• perf: adds avx512 poseidon2 for small fields by @gbotrel in #665
• GKR Gate Registry by @Tabaie in #652
• chore: remove unused benchmark script by @ivokub in #675
• Remove GKR from gnark-crypto by @Tabaie in #670
• feat: make <31 bit field generated using uint32 by @gbotrel in #676
• refactor: hash to curve by @ivokub in #674
• fix: Eisenstein Half-GCD convergence by @feltroidprime in #680
• feat/hashregistry by @Tabaie in #687
• Feat/fftext by @YaoJGalteland in #684
• Feat/vortex options by @ThomasPiellard in #689
• [secp256k1]: replace outdated link to article by @gap-editor in #690
• feat: remove dependency on internal package in ecc.go by @gbotrel in #693

New Contributors

• @feltroidprime made their first contribution in #680
• @YaoJGalteland made their first contribution in #684
• @gap-editor made their first contribution in #690

Full Changelog: v0.17.0...v0.18.0