Booth encoding

[kilic]

Booth encoding is implemented in line with incremental suggetions of halo2/#187. This is basically signed digit encoding but without preprocessing and extra memory requirements. And signed digit encoding helps us to reduce number of buckets to nearly half. Below there are benchmark results whihc are run on M1 machine. This PR also moves original msm implementation under mod test to keep it as baseline implementation for benchmarking and testing purposes.

w/  booth k=14 ............................................................29.588ms
w/o booth k=14 ............................................................41.151ms

w/  booth k=15 ............................................................47.325ms
w/o booth k=15 ............................................................56.038ms

w/  booth k=16 ............................................................97.727ms
w/o booth k=16 ............................................................104.224ms

w/  booth k=17 ............................................................153.295ms
w/o booth k=17 ............................................................185.561ms

w/  booth k=18 ............................................................297.498ms
w/o booth k=18 ............................................................317.606ms

w/  booth k=19 ............................................................525.640ms
w/o booth k=19 ............................................................561.605ms

w/  booth k=20 ............................................................977.872ms
w/o booth k=20 ............................................................1.037s

w/  booth k=21 ............................................................1.767s
w/o booth k=21 ............................................................2.001s

w/  booth k=22 ............................................................3.458s
w/o booth k=22 ............................................................3.622s```

[han0110]

LGTM!

[mratsim]

LGTM

To give more context:

NAF (what most pippenger/bucket implementation use) provides 2 things:

• signed digit recoding so the number of buckets (and memory consumption) is reduced by half
• minimizing the number of additions in the double-and-add algorithm.

But with MSM, for large windows for example 16, the chances of having no addition when input is random is extremely low, unless we have special cases like privacy-scaling-explorations/halo2#202 where all bits are zero.

Now the main issue is that for this benefit, NAF requires preprocessing, which requires extra storage and is also less friendly to GPUs. Booth encoding only provides the first part and can be computed on-the-fly.

Implementation

In Constantine:

• selecting a window https://github.com/mratsim/constantine/blob/8367d7d/constantine/math/arithmetic/bigints.nim#L357-L374
• Booth encoding: https://github.com/mratsim/constantine/blob/8367d7d/constantine/math/arithmetic/bigints.nim#L792-L818

In BLST:

• https://github.com/supranational/blst/blob/badb7f9/src/ec_mult.h#L11-L56
• Formal implementation and verification: https://github.com/GaloisInc/BLST-Verification/blob/f7c50e4/proof/ec_mult.saw#L86-L105

Litterature
Booth and bit pair encoding.pdf
Booth encoding.pdf