feat(prover-ray): migrate KoalaBear extension field from degree-4 to degree-6#3111
Open
gbotrel wants to merge 2 commits into
Open
feat(prover-ray): migrate KoalaBear extension field from degree-4 to degree-6#3111gbotrel wants to merge 2 commits into
gbotrel wants to merge 2 commits into
Conversation
…degree-6
Bumps `gnark-crypto` to v0.20.2-...-df0578435b08 which exposes the new
`extensions.E6`, `BatchInvertE6`, `VectorE6`, `FFTExt6` and
`FFTInverseExt6` APIs, and migrates every reference to the degree-4
extension under `prover-ray/` to the degree-6 tower:
𝔽_{p^6} = 𝔽_{p^2}[v] / (v³ − (u+1)) (cubic non-residue: u+1)
𝔽_{p^2} = 𝔽_p[u] / (u² − 3)
Highlights
- `maths/koalabear/field/ext.go`: full rewrite over six base-field
coordinates (Mul/Square/Inverse/BatchInvert delegated to gnark-crypto;
byte encoding grows from 16 to 24 bytes per element).
- `maths/koalabear/circuit/ext.go`: gnark circuit layer rewritten for E6
using Algorithm 13/16 from eprint 2010/354 (six E2 muls per MulExt);
hint plumbing extended from 4 → 6 limbs; new e2MulByCubicNonResidue
helper; ConjugateExt removed (was unused and ill-defined for cubic).
- `wiop/compilers/global/global.go`: replaced the coord-by-coord
`applyBaseFFT4` helper (four base FFTs + four scratch buffers) by a
direct `FFTExt6` / `FFTInverseExt6` call. Removes four scratch slices
per bucket and improves cache locality.
- `crypto/koalabear/vortex/verifier_common.go`: ships a local
`evalFextPolyHorner` / `evalBasePolyHorner` since gnark-crypto's
`vortex.Eval*PolyHorner` is still E4-typed upstream.
- `crypto/koalabear/{reedsolomon,ringsis,vortex}`: FFT calls switched to
`FFTExt6` / `FFTInverseExt6`; vortex hint chunk size now driven by
`field.ExtensionDegree (= 6)`.
- `crypto/koalabear/fiatshamir`: `RandomFext` consumes 6 of the 8 hashed
Poseidon outputs.
Tests: `go test ./...` is green; new microbench files
`maths/koalabear/field/ext_bench_test.go` and
`maths/koalabear/polynomials/lagrange_bench_test.go` were added so the
E4 → E6 cost delta can be tracked.
See `prover-ray/transition_fp6_worklog.md` for the full file-by-file
log, benchmark numbers (Apple M5 Max), and follow-up items.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
linea-besu Changelog Preview (informational)[Unreleased] diff (commits touching
|
Contributor
postman Changelog Preview (informational)[Unreleased] diff (commits touching
|
Contributor
tx-exclusion-api Changelog Preview (informational)[Unreleased] diff (commits touching
|
Contributor
coordinator Changelog Preview (informational)[Unreleased] diff (commits touching
|
Contributor
prover Changelog Preview (informational)[Unreleased] diff (commits touching
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 7ddc0fe. Configure here.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates prover-ray KoalaBear extension-field usage from E4 to E6, updating field helpers, circuit arithmetic, FFT integrations, verifier polynomial evaluation, and benchmarks/worklog documentation.
Changes:
- Replaces E4 types/helpers with E6-aware field, circuit, FFT, and transcript handling.
- Updates tests/benchmarks for six-coordinate extension values.
- Adds a migration worklog with performance notes and follow-ups.
Reviewed changes
Copilot reviewed 19 out of 20 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
prover-ray/wiop/compilers/global/global.go |
Switches quotient-share extension FFTs to FFTExt6/FFTInverseExt6 and removes E4 coordinate scratch buffers. |
prover-ray/transition_fp6_worklog.md |
Adds migration notes, benchmark results, and follow-up items. |
prover-ray/maths/koalabear/polynomials/lagrange_test.go |
Extends coordinate-wise FFT test helpers to B2 coordinates. |
prover-ray/maths/koalabear/polynomials/lagrange_bench_test.go |
Adds extension Lagrange evaluation benchmarks. |
prover-ray/maths/koalabear/polynomials/canonical_test.go |
Updates extension random/equality helpers for E6. |
prover-ray/maths/koalabear/field/vec.go |
Updates extension-degree and operation-cost comments. |
prover-ray/maths/koalabear/field/gen.go |
Updates extension-degree and multiplication-cost comments. |
prover-ray/maths/koalabear/field/gen_test.go |
Extends test equality helper to B2 coordinates. |
prover-ray/maths/koalabear/field/ext.go |
Migrates field.Ext helpers, serialization, constructors, and inversion to E6. |
prover-ray/maths/koalabear/field/ext_test.go |
Updates extension-field tests for six coordinates and 24-byte encodings. |
prover-ray/maths/koalabear/field/ext_bench_test.go |
Adds extension arithmetic/vector benchmarks. |
prover-ray/maths/koalabear/circuit/ext.go |
Reworks circuit extension type/arithmetic/hints from E4 to E6. |
prover-ray/maths/koalabear/circuit/doc.go |
Updates package documentation to degree-6 extension fields. |
prover-ray/go.mod |
Updates gnark-crypto to the E6-supporting pseudo-version. |
prover-ray/go.sum |
Updates checksums for the new gnark-crypto dependency. |
prover-ray/crypto/koalabear/vortex/verifier_common.go |
Replaces upstream E4 Horner helpers with local E6-compatible evaluators. |
prover-ray/crypto/koalabear/vortex/utils.go |
Updates FFT inverse hint chunking and FFT call to E6. |
prover-ray/crypto/koalabear/ringsis/ringsis.go |
Switches extension FFT calls to E6 variants. |
prover-ray/crypto/koalabear/reedsolomon/reedsolomon.go |
Switches extension Reed-Solomon FFT paths/vector casts to E6. |
prover-ray/crypto/koalabear/fiatshamir/poseidon2.go |
Updates transcript absorption/sampling for six extension coordinates. |
Merge origin/main into prover/fp6.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates every reference to the KoalaBear degree-4 extension field
(
extensions.E4) underprover-ray/to the degree-6 tower(
extensions.E6) shipped ingnark-crypto@v0.20.2-0.20260514182922-df0578435b08.Tower:
Caller-visible changes:
field.Extis now a six-coordinate value (24 bytes vs 16 bytespreviously);
ExtToBytes/BytesToExtchange accordingly.field.UintsToExt(v1..v4)→UintsToExt(v1..v6); dittoIntsToExt,ExtToUint64s.NewExtFrom4FrontendVars→NewExtFrom6FrontendVars.ConjugateExtremoved from the circuit API (was unused; the naturalFrobenius conjugation in a cubic tower is non-trivial and would be
misleading to expose).
Hot-path changes:
wiop/compilers/global/global.go: replaced the coordinate-by-coordinateapplyBaseFFT4helper (4 disjoint base FFTs + 4 scratch buffers perbucket) with a direct
largeDomain.FFTInverseExt6/FFTExt6call.Walks the contiguous E6 layout once per pass instead of six times.
crypto/koalabear/{reedsolomon,ringsis,vortex}switched toFFTExt6/FFTInverseExt6.crypto/koalabear/vortex/verifier_common.goships localevalFextPolyHorner/evalBasePolyHornerbecause gnark-crypto'svortex.Eval*PolyHorneris still E4-typed upstream.Performance impact on Apple M5 Max (arm64):
ExtMulExtSquareExtMulByBaseExtInverseBatchInvertExtn=65536ParBatchInvertExtn=65536VecAddExtExtn=65536VecMulExtExtn=65536VecScaleBaseExtn=65536EvalLagrangeExtExtn=16kComputeLagrangeAtZExtn=16kMore numbers, raw artefacts and per-bench analysis are in
prover-ray/transition_fp6_worklog.md.Follow-ups (out of scope for this PR)
Max (arm64). gnark-crypto ships AVX-512 fast paths for E4 vector
kernels (
vectorMul_avx512,vectorScalarMul_avx512, …) but noAVX equivalents for E6 yet, so on the target x86 prover hosts the
VecMulExtExt/VecScaleBaseExtgap is expected to be largerthan what shows up here. Re-run the same bench suite on a
representative x86 node and post the comparison; that will tell us
where to focus a follow-up SIMD effort upstream in gnark-crypto.
directly translate to prover wall-time (Vortex transversal hashing
is unchanged; the FFT path actually gets better cache locality
from the
FFTExt6switch). Profile the full prover on arepresentative trace and reconcile.
extensions.E6.Mulis the standard Karatsuba-over-E2 (6 E2 muls).An accumulator-style kernel comparable to the existing E4
montReduce-batched one (single function for all 6 coordinates)could close roughly 30–50 % of the per-mul gap. Worth tracking
upstream.
extensions.E6AVX kernels in gnark-crypto: SIMDAdd,Mul,MulByElement,ScalarMul,Butterflyfor E6 — the biggestpotential win for the prover.
preserved the existing unit-test surface, but the wiop hot path
(quotient computation, lagrange checking, vortex commitments)
would benefit from a small property-test suite that randomises
sizes/ratios and asserts correctness across the new tower.
field.RootPowersis still useful — no caller usesit in this tree.
Test plan
go build ./...go vet ./...go test ./... -count=1 -timeout=600sin
transition_fp6_worklog.md🤖 Generated with Claude Code
Note
High Risk
High risk because it changes the core extension-field representation (E4→E6), serialization size/constructors, and updates FFT/circuit arithmetic paths used across prover and verifier logic; subtle compatibility or correctness regressions would affect proof generation/verification.
Overview
Migrates KoalaBear extension arithmetic across
prover-rayfrom degree-4 (E4) to degree-6 (E6) by switchingfield.Exttoextensions.E6andfield.ExtensionDegreeto6, updating all helpers to read/write six coordinates.Updates transcript sampling (
FiatShamir.RandomFextnow consumes 6 of 8 Poseidon outputs), FFT-based code paths (Reed-Solomon, RingSIS, polynomial coefficient recovery, vortex hints) to useFFTExt6/FFTInverseExt6, and fixes equality checks to useEqualfor E6 values.Reworks the gnark circuit
Exttype and arithmetic to E6 (new constructors, updatedMulExt/SquareExt/MulByNonResidueExt, expanded hint IO to 6 coordinates, removes unusedConjugateExt), and simplifieswiopquotient computation by dropping coordinate-sliced FFT scratch buffers in favor of directFFTInverseExt6.Adds/updates tests and adds new micro-benchmarks (
field/ext_bench_test.go,polynomials/lagrange_bench_test.go), and bumpsgnark-cryptoto an E6-capable revision.Reviewed by Cursor Bugbot for commit 1de3283. Bugbot is set up for automated code reviews on this repo. Configure here.