Faster polynomial evaluation in Lagrange basis with rhizomes algorithm.

[armfazh]

Use of faster polynomial evaluation in the Lagrange basis from the rhizomes paper.

• It is applied to FLP.Query algorithm to evaluate several polynomials at a random value.
• In the paper, Algorithm 6 evaluates a single polynomial, while Alg. 7 is its batched version that is implemented.
• Savings are around 2x faster for PrepInit in all VDAFs.
• Unlike Prio2 optimization: use barycentric interpolation formula in poly_interpret_eval() #571, our method uses no field inverses.

Reference:
link Rhizomes and the Roots of Efficiency, Latincrypt 2025.

Running Benchmarks

git checkout main
cargo bench --features experimental --bench speed_tests -- "prio3.*prepare_init" --quiet --save-baseline baseline

git checkout pr
cargo bench --features experimental --bench speed_tests -- "prio3.*prepare_init" --quiet --save-baseline rhizomes
critcmp baseline rhizomes

Timings

Plot of the timings for PrepInit step.

[jcjones]

Only weighing in on the Rust, not the cryptographic implementation

[divergentdave]

This is looking good, just noted one edge case. Thanks so much for this work, the performance improvement is amazing!

[jcjones]

I've gone back through this and am good to merge with the existing review fixes in place.