ZKP16 Hardware Acceleration of ZKP-Toy模板网

这篇具有很好参考价值的文章主要介绍了ZKP16 Hardware Acceleration of ZKP。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

ZKP学习笔记

ZK-Learning MOOC课程笔记

Lecture 16: Hardware Acceleration of ZKP (Guest Lecturer: Kelly Olson)

The What and Why of Hardware Acceleration
- Hardware acceleration is the use of dedicated hardware to accelerate an operation so that it runs faster and/or more efficiently.
- Hardware acceleration can involve optimizing functions and code to use existing hardware (COTS) or it may involve the development of new hardware designed for a specific task.
  - COTS (commercially available off-the-shelf) hardware includes CPUs, GPUs, and FPGAS
  - Custom hardware is often referred to as an ASIC
- Examples
Hardware acceleration for crytpo
Why HW acceleration for ZKP
- ZK （and non-ZK） proof generation has high overheads relative to native computation
Goals of HW acceleration for ZKP
- Throughput: increase the number of operations per system
- Cost: reduce the cost of operation e.g. Bitcoin mining rigs are designed to reduce capital expenses ($/hash) and operational expenses (watts/hash)
- Latency: reduce the time of an individual operation e.g. 2kBridges may want to reduce the proof generation time for faster finality
Key Computational Primitives of ZKP
- Each proof system, and associated implementation will have slightly different computational requirements.
- Across a variety of proof systems these are three of the most computationally expensive operations
  - Multiscalar Multiplication (MSM)
    - A ‘dot product’ of elliptic curve points and scalars
    - Easily paralledizable
    - Optimization
      - When performing a MSM off of the host device, the scalars and sometimes points must be moved to the accelerator. The available communication bandwidth limits the maximum possible performance of the accelerator.
  - Number Theoretic Transformation (NTT)
    - Common algorithms like Cooley-Tukey reduce complexity from $O(N^2)$ to $O (N I o g N)$
    - Not Easily paralledizable
    - Furthermore, these elements must be kept in memory to be operated on, imposing high memory requirements
  - Arithmetic Hashes (e.g., Poseidon)
- SNARK V.S. STARK
  - The MSM, NTT and Hashes take 2/3 or more time in the proving system
- Foundational Primitive: Finite Field Arithmetic (especially ModMul)
Hardware Resources Required
- Determining Computational Cost
- Selecting the Right Hardware
  - Given that these workload are driven predominately by modular multiplication, we should look for platforms can perform a large number of multiplications, quickly and cheaply
  - Estimated HW performance can be evaluated by looking at # of hardware multipliers, size of hardware multipliers, and speed/frequency of each instruction
  - Examples
- Two Key Components to HW Acceleration
  - ‘HW friendly’ Algorithm
  - Efficient Implementation
Limits of Acceleration
- Acceleration Pitfalls
- Production Examples: Filecoin
Current Status of Hardware Acceleration
Future Directions for Hardware Acceleration
文章来源地址https://www.toymoban.com/news/detail-745701.html