\(10\times\) Faster Sumcheck

over Binary Tower Fields

Suyash Bagad

Ingonyama

Yuval Domb

Ingonyama

Justin Thaler

a16z & Georgetown University

Sumcheck: The new bottleneck

• Binius enables efficient SNARKs over binary fields
• Fast commitment scheme + sumcheck based IOPs
• Commitment part is so fast that sumcheck becomes the bottleneck

• Binius enables efficient SNARKs over binary fields
• Fast commitment scheme + sumcheck based IOPs
• Commitment part is so fast that sumcheck becomes the bottleneck
• Aim: speed-up first few rounds of sumcheck

Credit: Radi Cojbasic's talk at zk summit 12.

Sumcheck: The new bottleneck

Sumcheck over Binary Fields

• Binary fields are fields of characteristic \(2\) of the form \(\textsf{GF}(2^n)\)
• When \(n = 1\), we get: \(\textsf{GF}(2)\) \(= \{0, 1\} \equiv \mathbb{F}_2\)
  • Addition is bitwise XOR and multiplication is bitwise AND
• When \(n = 2\), the field \(\textsf{GF}(2^2)\) is a degree-2 extension of \(\textsf{GF}(2)\)
  • Let \(m(x) = x^2 + x + 1\) be the irreducible polynomial
  • Any polynomial \(p(x)\) over \(\mathbb{F}_2\) when divided by \(m(x)\) gives the remainder
• In binius sumcheck:
  • The witness is from the base field \(\textsf{GF}(2)\) while
  • But the challenge is from the extension field \(\textsf{GF}(2^{128})\)
• Running sumcheck naively results in lots of extension field multiplications

Multiplication in Binary Tower Fields

Multiplication in Binary Tower Fields

Multiplication in Binary Tower Fields

Multiplication in Binary Tower Fields

• Addition is bitwise XOR
• Multiplication?

Multiplication in Binary Tower Fields

• 4 smaller mult. in 1 large mult.

Our Solution

• We devise two new algorithms for running sumcheck over "small" fields
• Minimise \(\textsf{ee}\) multiplications (at the cost of additional \(\textsf{bb}\) multiplications)
• Generalises for sumcheck over large fields when witnesses are small
• Comparison with Gruen's approach of the univariate-skip technique:
  • Our approach leads to lower proof size
  • Our techniques apply to existing sum-check-based SNARKs “as is”
  • Applicability to composition polynomial may lead to memory overheads 

Implementation

https://github.com/ingonyama-zk/smallfield-super-sumcheck

Results

Product Sumcheck

• We need sumcheck to prove (multilinear) polynomial relations like

• Sumcheck round polynomial in round \(i\)

Product Sumcheck

Product of extension-field elements

Product Sumcheck

Product of Linear Polynomials

• Let \(f_1, f_2, \dots, f_d\) be linear polynomials s.t.

• Using school-book multiplication

Efficient Product of Linear Polynomials

• Degree of \(f\) is \(d\). To compute \(f(x)\):
  • Evaluate each \(f_j\) on \(d + 1\) points \(\{e_0, e_1, \dots, e_d\}\)
  • Compute point-wise multiplication on all \(d\) points to get \([f(e_0), \dots, f(e_d)]\)

Efficient Product of Linear Polynomials

Schoolbook method

Toom-Cook method

Efficient Product of Linear Polynomials

Back to Sumcheck

• Round polynomial expression:

Back to Sumcheck

Why Toom-cook?

Switchover round \(t\)

Factor improvement  \((t_{\textsf{naive}} / t_{\textsf{algo}})\) for \(n=20\)