Performance-Critical Components
The prover hot path is dominated by:- Sumcheck inner loop: Polynomial binding, evaluations, and EQ polynomial operations
- Commitment operations: Batched polynomial openings and Dory commitment computations
- Memory operations: Polynomial coefficient storage and manipulation
Core Optimizations
Protocol-Level Optimizations
Batched Sumcheck
Reduces verifier cost and proof size by batching parallel sumcheck instances
Batched Openings
Amortizes polynomial opening proof costs across multiple polynomials
Data Structure Optimizations
Small Value Polynomials
Compact representation for polynomials with small scalar coefficients
EQ Polynomial Optimizations
Specialized algorithms for equality polynomial evaluations
Advanced Techniques
Cryptographic Inlines
Replace expensive RISC-V execution with constraint-native primitives
Torus Compression
Proof size reduction through torus-based compression
Performance Impact
These optimizations work together to achieve:- 10-100x prover speedup from CompactPolynomial vs. full field elements
- Linear complexity reduction through batched sumcheck protocols
- 2-5x throughput improvement from cryptographic inlines
- 3x proof size reduction from torus compression (estimated)
Design Principles
1. Hot Path Focus
Optimizations target operations executed thousands of times per proof:- Polynomial binding operations in sumcheck rounds
- EQ polynomial evaluations across multiple instances
- Field arithmetic in inner loops
2. Memory Efficiency
- CompactPolynomial: Store u8/u16/u32 coefficients instead of 32-byte field elements
- SharedRaPolynomials: Share EQ tables across multiple polynomials
- Lazy materialization: Defer field element conversion until binding
3. Parallelization
All critical paths support parallel execution:- Parallel polynomial binding for large coefficients
- Parallel EQ table computation
- Parallel sumcheck instance evaluation
4. Zero-Copy Operations
Minimize allocations and clones:- In-place polynomial updates where possible
- Pre-allocated buffers with known sizes
- Unsafe allocation for zero-initialization
Implementation Guidelines
Profiling Tools
Benchmarking Changes
Small regressions in polynomial operations compound:- A 1% slowdown in
bind()affects every sumcheck round - Memory allocations in inner loops are strictly prohibited
- Use
#[inline]judiciously on hot paths
Next Steps
Explore each optimization in detail to understand implementation techniques and performance impact:- Start with Batched Sumcheck to understand protocol-level batching
- Learn about CompactPolynomial for memory-efficient polynomial storage
- Discover Cryptographic Inlines for domain-specific acceleration