Method and device for optimizing MSM under multi-gpu

Abstract

The application discloses an optimization method and device of MSM under multiple GPUs. The method considers that multiple graphics cards usually coexist in actual application scenarios. In the case that a small circuit scale can use a lookup table method in zero-knowledge proof, the method further expands the window size c in the algorithm by using the difference between multiple graphics cards and a single graphics card, thereby improving the MSM performance. The specific value of performance improvement can be calculated by the formula [n / c orig *N‑n / c expand *N] / (n / c orig *N). The application provides an optimization method and device of MSM under multiple GPUs, so that the MSM calculation performance based on the lookup table method can linearly increase with the number of graphics cards, the calculation efficiency of the MSM is further improved, and a wide space is opened for the application and popularization of the zero-knowledge proof protocol in real scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cryptography, and particularly relates to an optimization method and device of MSM under multiple GPUs. BACKGROUND

[0002] Zero-Knowledge Proof refers to that a prover can make a verifier believe that a certain proposition is correct without providing any useful information to the verifier, and it is actually a cryptographic protocol. Zero-Knowledge Proof is essentially a protocol involving two or more parties, that is, a series of steps taken by two or more parties to complete a task. The prover proves and makes the verifier believe that he knows or has a certain message, but the proving process cannot leak any information about the message being proved to the verifier. A large number of facts prove that Zero-Knowledge Proof is very useful in cryptography. If Zero-Knowledge Proof can be used for verification, many problems can be effectively solved.

[0003] MSM (Multiple Scalar Multiplication) is a way to calculate a polynomial commitment in the current popular Zero-Knowledge Proof system, and its calculation formula is:

[0004]

[0005] wherein P i is a point on an elliptic curve, a i is a scalar, which is an element on a field (which can be simply understood as a large integer satisfying certain conditions).

[0006] The MSM calculation is essentially a series of additions of points on an elliptic curve, and its characteristics are: relatively complex calculation, large amount of calculation, so it becomes the main focus of improving the performance of the Zero-Knowledge Proof system.

[0007] Referring to Figure 1 , the current general algorithm of MSM is the pippenger algorithm, and the principle of the pippenger algorithm is specifically as follows:

[0008] Step 1: window division is performed on each scalar, that is, each c bits is divided into a window under the binary representation of the scalar; assuming that the number of bits of the scalar is n bits, each c bits is a window, and there are k = n / c windows, each window will correspond to an array with a size of 2 c -1, that is, a bucket;

[0009] Step 2: bucket elimination;

[0010] Step 3: single-bucket accumulation;

[0011] Step 4: Calculate the final result by operating the result of each bucket.

[0012] To make the principle of pippenger algorithm more clear, the following is an example of a scalar and a point P to demonstrate the above process:

[0013] Suppose scalar a = 0x12cb = 0001001011001011

[0014] Step 1: Window division, i.e. the number of bits of scalar n = 16, let c = 8, then k = 16 / 8 = 2, i.e. there are two windows, denoted as:

[0015] window_0 = 0xcb = 192

[0016] window_1 = 0x12 = 18;

[0017] Prepare a bucket array for each window, there are two windows, so there are two bucket arrays, each array has (2 c -1) = (2 8 -1) = 255 elements, denoted as bucket_0 corresponding to window_0; bucket_1 corresponding to window_1;

[0018] Step 2: Bucket; i.e. the value in the window is taken as the position, P is added to the corresponding position of the corresponding bucket, denoted as:

[0019] window_0 = 192 -> bucket_0[192-1] + = P

[0020] window_1 = 16 -> bucket_1[18-1] + = P

[0021] Step 3: Bucket accumulation; i.e. traverse bucket_0 and bucket_1 respectively, and perform the following accumulation:

[0022] for i = 255 to i = 0:

[0023] res <- res + bucket_0[i]

[0024] sum <- sum + res

[0025] bucket_1 is also accumulated in this way, and the accumulation results are denoted as sum_0 and sum_1 respectively;

[0026] window_0 -> bucket_0 -> sum_0

[0027] window_1 -> bucket_1 -> sum_1

[0028] Step 4: Get the final result by double and add.

[0029] result = sum_1 * 2 8 + sum_0.

[0030] When generating the proof, since all the points P i participating in the calculation are fixed, and the window size c can be determined, in the case of sufficient memory space, the pippenger algorithm can be optimized by table lookup, and the specific principle is as follows:

[0031] Let the value represented by each window (the position in the bucket) be s i , then the following conclusions are obtained:

[0032] i∈[0..k],s i ∈[0..2 c -1]

[0033] According to the principle of the pippenger algorithm, the process of losing the bucket and the bucket accumulation together is essentially the calculation of the value of s i *P i . Therefore, in the case where c and P i are determined, all possible s i *P i can be pre-calculated, and the resulting table is as follows:

[0034]

[0035] In this way, the bucket accumulation algorithm in the pippenger algorithm can be combined into one, which can be called window accumulation. From the calculation amount, it is reduced The calculation amount of the bucket accumulation part in the principle of the pippenger algorithm, the rest is the same.

[0036] MSM is crucial in the calculation process of zero-knowledge proof, and the speed of MSM calculation relates to whether the entire zero-knowledge proof protocol can be used. If the MSM calculation is too slow, the zero-knowledge proof protocol cannot be used, therefore, how to improve the calculation efficiency of MSM has become a problem to be solved by personnel in the field. SUMMARY

[0037] Therefore, the present application provides an optimization method and device of MSM under multi-GPU to solve the problem of slow calculation efficiency of MSM in the prior art.

[0038] In order to achieve the above purpose, the present application provides the following technical scheme:

[0039] In a first aspect, an optimization method of MSM under multi-GPU includes:

[0040] Obtaining MSM source data;

[0041] Dividing the MSM source data into several groups, using a lookup table method to optimize the pippenger algorithm, and performing parallel calculation based on multi-GPU;

[0042] Wherein, all possible S i *P i Pre-compute the table formed, and divide it into multiple sub-tables to ensure that all multiple points of the same point P i are in the same sub-table, thereby increasing the calculation window c under the condition of multi-GPU, and further improving the calculation efficiency of MSM;

[0043] According to the obtained MSM calculation result, a zero-knowledge proof is generated and sent to the opposite terminal.

[0044] As a preferred, the table formed by pre-computing all possible S i *P i is divided into multiple sub-tables, specifically by a first formula.

[0045] The first formula is:

[0046]

[0047] Wherein, P i is a point on an elliptic curve, l=N / m, and m is the number of GPUs.

[0048] As a preferred, when performing parallel calculation based on multi-GPU, the calculation formula of MSM is:

[0049]

[0050] Wherein, a i is a scalar.

[0051] As a preferred, the window c is increased to:

[0052]

[0053] Wherein, c orig is the upper limit value of the window size on a single graphics card, N is the scale of MSM, m is the number of graphics cards, and c expand is the window expansion size.

[0054] As a preferred, the calculation efficiency of MSM is improved to:

[0055] [n / c orig *N-n / c expandN) / (n / c orig N).

[0056] In a second aspect, an optimization device of MSM under multi-GPU includes:

[0057] An MSM data acquisition module is configured to acquire MSM source data.

[0058] A parallel computing module is configured to divide the MSM source data into several groups, use a pippenger algorithm optimized by a lookup table method, and perform parallel computing based on multi-GPU.

[0059] All possible S i P i The table formed by pre-computation is divided into multiple sub-tables, so that all multiple points of the same point P i are in the same sub-table, thereby increasing the calculation window c under the condition of multi-GPU and further improving the calculation efficiency of MSM.

[0060] A zero-knowledge proof generation module is configured to generate a zero-knowledge proof according to the obtained MSM calculation result and send the zero-knowledge proof to the opposite terminal.

[0061] In a third aspect, a computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the optimization method of MSM under multi-GPU when executing the computer program.

[0062] In a fourth aspect, a computer readable storage medium stores a computer program, and the computer program implements the steps of the optimization of MSM under multi-GPU when executed by a processor.

[0063] Compared with the prior art, the present application has at least the following beneficial effects:

[0064] The present application discloses an optimization method and device of MSM under multi-GPU. The method takes into account the actual application scenario, which usually has multiple graphics cards coexisting. For the case that the lookup table method can be used in small circuit scale in zero-knowledge proof, the method further expands the window size c in the algorithm by using multiple graphics cards and a single graphics card, thereby improving the MSM performance. The specific value of performance improvement can be calculated by the formula [n / c orig N-n / c expand N) / (n / c orig N). The present application provides an optimization method and device of MSM under multi-GPU, so that the MSM calculation performance based on the lookup table method can linearly increase with the number of graphics cards, further improving the calculation efficiency of MSM, and thereby opening up a broad space for the application and promotion of zero-knowledge proof protocol in real-world scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0065] In order to more intuitively illustrate the prior art and the present application, several exemplary drawings are given below. It should be understood that the specific shapes, configurations shown in the drawings should not be considered as limiting conditions in the implementation of the present application; for example, based on the technical concepts and exemplary drawings disclosed in the present application, those skilled in the art can easily make routine adjustments or further optimizations to the increase / decrease / assignment of certain units (components), specific shapes, positional relationships, connection methods, size ratio relationships, etc.

[0066] Figure 1 A schematic diagram of the principle of the pippenger algorithm for the general algorithm of MSM in the prior art;

[0067] Figure 2 A schematic diagram of the principle of the GPU pippenger algorithm provided by the present application;

[0068] Figure 3 A flowchart of an optimization method of MSM under multiple GPUs provided by Embodiment One of the present application. DETAILED DESCRIPTION

[0069] The present application will be further described in detail below with reference to the accompanying drawings.

[0070] In the description of the present application: unless otherwise specified, the meaning of "multiple" is two or more. The terms "first", "second", "third", etc. in the present application are intended to distinguish the objects referred to, and do not have a special meaning in terms of technology (for example, should not be understood as emphasizing importance or order, etc.). The expressions "include", "contain", "have", etc. also mean "not limited to" (certain units, components, materials, steps, etc.).

[0071] The terms such as "upper", "lower", "left", "right", "middle", etc. cited in the present application are generally intended to facilitate intuitive understanding by referring to the drawings, and are not an absolute limitation on the positional relationship in the actual product. Changes in these relative positional relationships, without departing from the technical concepts disclosed in the present application, are also considered within the scope of the present application.

[0072] I. Implementation of pippenger algorithm on GPU

[0073] Please refer to Figure 2 Since the GPU has a large number of computing units, in order to take advantage of this feature of the GPU, the data is divided into several groups (groups) for parallel computing.

[0074] From Figure 2It can be seen that the general algorithm pippenger of MSM is applied on GPU (referred to as: GPU pippenger) which is basically the same as pippenger, the difference is:

[0075] (I) The number of barrels increases; the number of barrels increases from one per window to one per group per window;

[0076] (II) The number of barrel accumulations increases;

[0077] (III) When calculating the final result, the results of each group are also added up.

[0078] II. Analysis of the computational complexity of the GPU pippenger algorithm (the so-called analysis of computational complexity is the number of point additions made by MSM):

[0079] Let the size of MSM be N, the number of bits of each scalar be n, the window size (the number of bits per window) be c, and the number of windows be k = n / c.

[0080] Determine the number of groups: Let the number of cores of the GPU be core_count, and take a constant batch_size, then:

[0081] group_num = batch_size * core_count / k

[0082] = batch_size * core_count * c / n

[0083] Step 1: Barrel throwing;

[0084] Each window has one addition, so there are k additions for one scalar, and a total of N scalars, so the total number of additions is: k*N = n / c*N;

[0085] Step 2: Barrel accumulation;

[0086] Each barrel has one loop, and each loop has two additions, a total of 2 c -1 loops, a total of k*group_num barrels, so the number of barrel accumulation additions is:

[0087] (k*group_num)*2*(2 c -1) = batch_size * core_count * 2 * (2 c -1)

[0088] Step 3: Calculate the result;

[0089] The calculation amount is: k*group_num double sum and add operations, and the calculation amount is fixed.

[0090] III. Analysis of the application scenarios of the table lookup method

[0091] As can be seen from the principle of optimizing the pippenger algorithm by the table lookup method, the table lookup method reduces the calculation of the bucket accumulation part, so the following ratio is investigated:

[0092]

[0093] As can be seen from equation (3), the smaller r is, the smaller the performance improvement of the table lookup method is, and vice versa. At the same time, it can be obtained that (batch_size*core_count / n) is a constant for a specific graphics card and scalar, that is, the larger c is, the greater the effect of the table lookup method is. However, due to the limitation of the memory, the size of the table is actually limited, that is, c is limited.

[0094] When the problem size N is very large (for example, N = 2 28 ), r can be small (for example, less than 1%), that is, the table lookup method has little effect on performance improvement. Therefore, the table lookup method has a good effect on small-scale circuits.

[0095] Based on the above three points, it can be obtained that the calculation amount in the case of using the table lookup method for small-scale circuits is n / c*N. It can be seen from this that the larger c is, the smaller the calculation amount is, so in practice, the window size c is always increased as much as possible to reduce the calculation amount. However, as can be seen from the table shown in the principle of optimizing the pippenger algorithm by the table lookup method, the size of the table is doubled and the memory space is doubled for each increase of one bit (i.e. one bit) of c, so for a single graphics card, c is limited. At the same time, considering the actual application scenario, multiple graphics cards are usually used together, so the present application proposes a method for further expanding c for multiple graphics cards to improve the performance of MSM in the case of small circuit size in zero-knowledge proof.

[0096] Embodiment one

[0097] Please refer to Figure 3 , the embodiment provides an optimization method of MSM under multiple GPUs, comprising:

[0098] S1: obtaining MSM source data;

[0099] S2: dividing the MSM source data into several groups, using the pippenger algorithm optimized by the table lookup method, and performing parallel calculation based on multiple GPUs;

[0100] where, for all possible S i *P i The table formed by pre-computation is divided into multiple sub-tables, ensuring that all multiple points of a same point P i are in a same sub-table, i.e. are in a same table, so as to increase the calculation window c under the condition of multiple GPUs, and further improve the calculation efficiency of MSM;

[0101] S3: generating zero-knowledge proof according to the obtained MSM calculation result, and sending to the opposite terminal.

[0102] Specifically, for all possible S i *P i The table formed by pre-computation is divided into multiple sub-tables, specifically, the table (2) in the background art is divided into m tables of the same size (assuming that m | N, which condition can be generally met in practice).

[0103] The divided table is represented by table (4).

[0104]

[0105] where, P i is a point on an elliptic curve, l = N / m, and m is the number of GPUs.

[0106] Specifically, when performing parallel calculation based on multiple GPUs, the calculation formula of MSM is:

[0107]

[0108] Formula (5) is obtained by dividing formula (1) in the background art, where a i is a scalar.

[0109] As can be seen from table (4) and formula (5), each graphics card only stores 1 / m of the original table. At this time, although the calculation amount of MSM has almost no change (only m times of addition is added), the memory of each graphics card is only 1 / m of the original, so it opens up space for expanding the window c.

[0110] Because the table is reduced to 1 / m of the original, the window c is increased to:

[0111]

[0112] where, c orig is the upper limit value of the window size on a single graphics card, N is the scale of MSM, m is the number of graphics cards, and c expand is the window expansion size.

[0113] It should be noted that when the total number of graphics cards is m, and it is assumed that the window size c of a single graphics card of this type has reached the upper limit, that is, c orig It is worth noting that here "reaching the upper limit" is not in the mathematical sense, but in the practical sense, that is, when c orig +1, the video memory cannot be carried.

[0114] It is noted that the last "approximately equal to" in formula (6) is acceptable in practice. This is because, when c expand =c orig +log2(m), the occupied video memory is:

[0115] (2 expand -1)*N / m=(2 orig *m-1)*N / m=2 orig *N-N / m (7)

[0116] And it can be seen that the window size is expanded by one bit, and the table size is doubled. Therefore, the difference in the size of the occupied memory between formula (7) and the direct expansion of one bit in a single card is:

[0117]

[0118] This shows that in practice, the "approximately equal to" in formula (6) can be achieved.

[0119] As can be seen from the above, the performance improvement is measured by the reduction in the number of additions, so the calculation efficiency of the MSM is improved as follows:

[0120] [n / c orig *N-n / c expand *N] / (n / c orig *N)=1-c orig / c expand (9)

[0121] In summary, the embodiment realizes the performance improvement of MSM by multiple graphics cards in the case of small-scale circuits in zero-knowledge proof, and gives the specific value of the performance improvement of the method.

[0122] The present application provides an optimization method for MSM under multiple GPUs, so that the calculation performance of MSM based on the lookup table method can increase linearly with the number of graphics cards, further improving the calculation efficiency of MSM, and further opening up a broad space for the application and promotion of zero-knowledge proof protocols in real-world scenarios.

[0123] Embodiment two

[0124] The embodiment provides an optimization device for MSM under multiple GPUs, comprising:

[0125] The MSM data acquisition module is configured to acquire MSM source data.

[0126] The parallel computing module is configured to divide the MSM source data into several groups, and perform parallel computation based on multiple GPUs by using a pippenger algorithm optimized by a lookup table method.

[0127] The zero-knowledge proof generation module is configured to generate a zero-knowledge proof according to the obtained MSM computation result, and send the zero-knowledge proof to the opposite terminal. i *P i The pre-computed table is divided into multiple sub-tables, so that all multiple points of the same point P i are in the same sub-table, thereby increasing the computation window c under the condition of multiple GPUs, and further improving the computation efficiency of the MSM.

[0128] The zero-knowledge proof generation module is configured to generate a zero-knowledge proof according to the obtained MSM computation result, and send the zero-knowledge proof to the opposite terminal.

[0129] The specific limitations of the MSM optimization device under multiple GPUs can be referred to the limitations of the MSM optimization method under multiple GPUs described above, and will not be described here.

[0130] Embodiment Three

[0131] The embodiment provides a computer device, which comprises a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of the MSM optimization method under multiple GPUs are implemented.

[0132] Embodiment Four

[0133] The embodiment provides a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the MSM optimization under multiple GPUs are implemented.

[0134] The technical features of the above embodiments can be combined in any manner (as long as the combination of the technical features does not exist contradictions). In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described. These embodiments which are not explicitly written should be considered as the scope of the present application.

[0135] The application is described in detail above by general description and specific embodiments. It should be understood that, based on the technical concept of the present application, some conventional adjustments or further innovations can be made to these specific embodiments; however, as long as these conventional adjustments or further innovations do not deviate from the technical concept of the present application, the technical solutions obtained by these conventional adjustments or further innovations also fall within the protection scope of the claims of the present application.

Claims

1. An optimization method of MSM under multi-GPU, characterized in that, The method comprises the following steps: acquiring MSM source data; dividing the MSM source data into several groups, performing parallel calculation based on multiple GPUs by using a pippenger algorithm optimized by a lookup table method; Wherein, all possible The table formed by pre-computation is divided into multiple sub-tables, and all multiple points of a same point are ensured to be in a same sub-table, so as to increase a calculation window c under a multi-GPU condition, and further improve the calculation efficiency of the MSM. The table formed by pre-computation is divided into multiple sub-tables, and all multiple points of a same point are ensured to be in a same sub-table, so as to increase a calculation window c under a multi-GPU condition, and further improve the calculation efficiency of the MSM. generating zero-knowledge proof according to the obtained MSM calculation result and sending the zero-knowledge proof to a terminal of an opposite party; Said to all possible Pre-computed table formed, divided into multiple sub-tables, specifically by the first formula. the first formula is: wherein, is a point on an elliptic curve, , is the number of GPUs, is an upper limit value of the window size on a single graphics card; when the parallel calculation is performed based on multiple GPUs, the calculation formula of the MSM is: wherein is a scalar.

2. The method of claim 1, wherein, the window c is increased to: wherein, is an upper limit value for the window size on a single display card, is the size of the MSM, is the number of display cards, is the window expansion size.

3. The method of claim 2, wherein, the calculation efficiency of the MSM is improved to: 。 4. An optimization device for MSM under multi-GPU, characterized in that, The method comprises the following steps: an MSM data acquisition module is configured to acquire MSM source data; a parallel calculation module is configured to divide the MSM source data into several groups, perform parallel calculation based on multiple GPUs by using a pippenger algorithm optimized by a lookup table method; Among them, for all possible The pre-calculated table is divided into multiple sub-tables to ensure that the same point... All the multipliers are in the same sub-table, thereby increasing the computation window c under multi-GPU conditions and thus improving the computational efficiency of MSM; a zero-knowledge proof generation module is configured to generate zero-knowledge proof according to the obtained MSM calculation result and send the zero-knowledge proof to a terminal of an opposite party; Said to all possible Pre-computed table formed, divided into multiple sub-tables, specifically by the first formula. the first formula is: wherein, is a point on an elliptic curve, , is the number of GPUs, is an upper limit value of the window size on a single graphics card; when the parallel calculation is performed based on multiple GPUs, the calculation formula of the MSM is: wherein is a scalar. 5.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-4 when the computer program is executed by the processor. the processor executes the computer program to realize the steps of the method in any one of claims 1 to 3.

6. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 3.

Images