BatchVerifier #66
Open
BatchVerifier #66
+165
−37
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Draft
ggwpez
reviewed
Jan 29, 2026
davxy
commented
Jan 29, 2026
Comment on lines
+147
to
+157
| // Pick some entropy from plonk verifier for later usage | ||
| let mut entropy = [0_u8; 32]; | ||
| rng.fill_bytes(&mut entropy); | ||
|
|
||
| PreparedBatchItem { | ||
| piop, | ||
| proof, | ||
| challenges, | ||
| entropy, | ||
| } | ||
| } |
Member
Author
There was a problem hiding this comment.
@swasilyev @burdges @drskalman Need some extra attention here.
In practice, instead of immediately using the returned rng, we pick some randomness from it to be used later in the push_prepared
davxy
commented
Jan 29, 2026
Comment on lines
+159
to
+164
| pub fn push_prepared(&mut self, item: PreparedBatchItem<E, J>) { | ||
| let mut ts = self.verifier.plonk_verifier.transcript_prelude.clone(); | ||
| ts._add_serializable(b"batch-entropy", &item.entropy); | ||
| self.acc | ||
| .accumulate(item.piop, item.proof, item.challenges, &mut ts.to_rng()); | ||
| } |
Member
Author
There was a problem hiding this comment.
@swasilyev @burdges @drskalman here I pick the randomness back to:
- extend verifier transcript
- and use the derived rng in accumulate
ggwpez
approved these changes
Feb 2, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR targets batching branch
Introduce a batching structure for ring proofs that bundles the
KzgAccumulatorand theRingVerifier, providing greater flexibility for downstream users.This would be further improved if
KzgAccumulatorimplementedCanonicalSerializeandCanonicalDeserialize, enabling batching across blocks.Proofs can be prepared for batch verification in parallel. Prepared proofs can be accumulated.
Performance boost ~2x
Some benches
Batch vs sequential verification times (ms):
Sequential prepare+accumulate
Sequential verification scales linearly with proof count.
Batch verification scales sub-linearly.
Parallel prepare + final sequential accumulate
NOTE: Parallel preparation can roughly yield an extra 2x speedup.
The
parallelcrate feature does not enable this.Downstream users can perform parallel preparation themselves. Each Prepared proof consumes ~3K, which may introduce significant hidden overhead when preparing big batches, so it may be preferable to accumulate every X proofs rather than the entire batch at once to save memory.