Multiexponentiation improvements

[aleksejspopovs]

The main purpose of this pull request is to improve multiexponentiation performance.

To this end, the pull request replaces the old bool use_multiexp parameter in the multi_exp function (and related ones, such as multi_exp_with_mixed_addition) with a template parameter Method that can be used to select one of many algorithms. The short version of the justification for why this parameter must be a template parameter is that some algorithms do not compile with some choices of operand type --- e.g., the method previously implemented in naive_exp uses opt_window_wnaf_exp, so it wouldn't compile for any type opt_window_wnaf_exp doesn't support.

The most exciting part of this pull request is the introduction of the multi_exp_method_djb algorithm, an implementation of the special case of Pippenger's algorithm as presented by Dan Bernstein et al (p. 15). We have found that this algorithm significantly outperforms our existing implementation of the Bos-Coster algorithm on big, random inputs.

Specifically, on a machine with an Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz CPU, when compiling libff with MULTICORE=off and USE_MIXED_ADDITION=on and exponentiating members of BN128_G1, djb is 32% faster on 2^18 inputs, and 47% faster on 2^22 inputs.

Further performance improvements might be possible by tuning the c parameter in the implementation of djb. It appears that optimal selection of this parameter might be machine-specific, much like the window sizes for fixed_base_exp_window_table.

This change breaks libsnark by changing the signature of the multi_exp function; a libsnark pull request adopting to this change and also switching to using the djb algorithm where useful is coming in a moment.

[madars]

This is great!

Regarding the naming, I think we should name algorithm something other than djb as this would be more in line with the authorship policy of Cryptographic Implementations group at Eindhoven :) "In recognition of the fact that author lists are often alphabetized, Cryptographic Implementations personnel are required to cite the full author lists for all papers; e.g., citing "Bernstein et al." is prohibited". Maybe pippenger as Bernstein-Doumen-Lange-Oosterwijk paper attributes it to Pippenger?

[aleksejspopovs]

The problem with calling it "Pippenger's algorithm" (of which the algorithm implemented in our code is a special case) is that Dan Bernstein seems to be able to show more or less any multiexp algorithm to be some special case of Pippenger's :)

[tromer]

Concept looks fine to me, and kudos for the performance!
Regarding name, I suggest acronym bibliography style:

• Daniel J. Bernstein, Jeroen Doumen, Tanja Lange, Jan-Jaap Oosterwijk, Faster batch forgery identification, INDOCRYPT 2012

hence multi_exp_method_BDLJO12.

[aleksejspopovs]

I have updated this pull request and the one in libsnark to use multi_exp_method_BDLO12.