Add `WnafBase::multiscalar_mul` by tarcieri · Pull Request #82 · zkcrypto/group

tarcieri · 2026-05-29T14:43:31Z

Computes a sum-of-products aA + bB + ... in variable time with w-NAF multi-exponentiation using the interleaved window method, also known as Straus' method.

The key insight is that when computing this sum by means of additions and doublings, the doublings can be shared by performing the additions within an inner loop.

The API and implementation are inspired in part by curve25519-dalek, namely the VartimeMultiscalarMul trait and corresponding implementation in straus.rs.

This results in ~28% speedup on p256 for a 3 scalar/point input:

ProjectivePoint operations/point-scalar lincomb (variable-time)
    time:   [149.13 µs 149.80 µs 150.84 µs]
    change: [−27.999% −27.645% −27.267%] (p = 0.00 < 0.05)

See also: RustCrypto#14

Computes a sum-of-products `aA + bB + ...` in variable time with w-NAF multi-exponentiation using the interleaved window method, also known as Straus' method. The key insight is that when computing this sum by means of additions and doublings, the doublings can be shared by performing the additions within an inner loop. The API and implementation are inspired in part by `curve25519-dalek`, namely the `VartimeMultiscalarMul` trait and corresponding implementation in `straus.rs`. This results in ~28% speedup on `p256` for a 3 scalar/point input: ProjectivePoint operations/point-scalar lincomb (variable-time) time: [149.13 µs 149.80 µs 150.84 µs] change: [−27.999% −27.645% −27.267%] (p = 0.00 < 0.05)

TalDerei

ACK, cherry picks commit from rustcrypto-group; left some initial observations (but i'm not a crate maintainer). cc @ebfull @str4d

TalDerei · 2026-05-30T20:29:57Z

+    /// Perform a multiscalar multiplication.
+    pub fn multiscalar_mul<'a, I, J>(scalars: I, bases: J) -> G


referencing dalek (VartimeMultiscalarMul trait and corresponding impl in straus.rs), there's explicit timing language there. suggest a timing note that this runs in variable time and not be used with secret scalars (dalek frames it as operating on "public scalars"). maybe also rename to vartime_multiscalar_mul?

We tend to put vartime at the end of the method names BTW.

gotcha, suggestion was matching dalek's naming convention.

FWIW we also use *_vartime as a suffix in @RustCrypto projects. When looking at something like rustdoc it makes it easier to discover operations have constant time and variable time versions

TalDerei · 2026-05-30T20:31:29Z

+/// This function must be provided with `tables` and `wnafs` that were constructed with
+/// the same window size; otherwise, it may panic or produce invalid results.
+pub(crate) fn wnaf_multi_exp<G: Group>(tables: &[&[G]], wnafs: &[&[i64]]) -> G {
+    debug_assert_eq!(tables.len(), wnafs.len());


promote to release assertion for mismatched lengths.

At least for now it's not possible to trip this assertion as the equality is enforced at the type system level where WnafBase and WnafScalar have a const generic WINDOW_SIZE that's ensured equal by bounds.

I can promote it, but really it's belt-and-suspenders.

TalDerei · 2026-05-30T20:53:36Z

+///
+/// This function must be provided with `tables` and `wnafs` that were constructed with
+/// the same window size; otherwise, it may panic or produce invalid results.
+pub(crate) fn wnaf_multi_exp<G: Group>(tables: &[&[G]], wnafs: &[&[i64]]) -> G {


ACK – traced the impl; extends wNAF to MSM via Straus' method: (N * (doublings + adds)) to (doublings + (N * adds)), where N is # LC terms. doubling savings from interleaving windows (and it stacks on existing addition savings that use signed digits). fine for small MSMs, but obviously for larger N a hand rolled Pippenger impl downstream.

generated some of my own test vectors locally, but suggesting multiscalar coverage for wnaf_multi_exp / multiscalar_mul in the diff.

The wNAF implementations in both curve25519-dalek and libsecp256k1 provide both Straus and Pippenger and select between them at runtime, which would probably be ideal here as well, but that first needs a generic implementation of Pippenger

TalDerei · 2026-05-30T20:57:35Z

+/// the same window size; otherwise, it may panic or produce invalid results.
+pub(crate) fn wnaf_multi_exp<G: Group>(tables: &[&[G]], wnafs: &[&[i64]]) -> G {
+    debug_assert_eq!(tables.len(), wnafs.len());
+    let window_size = wnafs.iter().map(|w| w.len()).max().unwrap_or(0);


nit; window_size is a misnomer here.

What would you suggest instead?

TalDerei · 2026-05-30T21:01:11Z

+    where
+        I: Iterator<Item = &'a WnafScalar<G::Scalar, WINDOW_SIZE>>,
+        J: Iterator<Item = &'a Self>,


nit; dalek uses IntoIterator.

TalDerei · 2026-06-01T21:41:10Z

we can reopen this and target base branch to a zkcrypto:release-0.14.1 per #63 (comment).

tarcieri · 2026-06-02T12:48:07Z

@TalDerei do you mean retarget to main? The release-0.14.0 branch was deleted.

Edit: oh, 0.14.1. Every patch release is getting its own branch?

tarcieri · 2026-06-02T13:05:20Z

Reopened as #85

tarcieri changed the title ~~Add WnafBase::multiscalar_mul (#14)~~ Add WnafBase::multiscalar_mul May 29, 2026

tarcieri mentioned this pull request May 30, 2026

wNAF: sum-of-products multiscalar multiplication / linear combination #75

Open

ebfull force-pushed the release-0.14.0 branch from 8b7a9c9 to f9a84a7 Compare May 30, 2026 17:41

TalDerei mentioned this pull request May 30, 2026

Release 0.14.0 #63

Merged

TalDerei reviewed May 30, 2026

View reviewed changes

ebfull deleted the branch zkcrypto:release-0.14.0 June 1, 2026 21:36

ebfull closed this Jun 1, 2026

tarcieri deleted the multiscalar-mul branch June 2, 2026 12:47

tarcieri mentioned this pull request Jun 2, 2026

Add WnafBase::multiscalar_mul #85

Open

		/// Perform a multiscalar multiplication.
		pub fn multiscalar_mul<'a, I, J>(scalars: I, bases: J) -> G

Conversation

tarcieri commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TalDerei left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TalDerei May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TalDerei May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TalDerei May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TalDerei commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tarcieri commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tarcieri commented Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tarcieri commented May 29, 2026 •

edited

Loading

TalDerei left a comment •

edited

Loading

TalDerei May 30, 2026 •

edited

Loading

TalDerei May 30, 2026 •

edited

Loading

TalDerei May 30, 2026 •

edited

Loading

TalDerei commented Jun 1, 2026 •

edited

Loading

tarcieri commented Jun 2, 2026 •

edited

Loading