diff --git a/bench/data.js b/bench/data.js
deleted file mode 100644
index f5eb12b90..000000000
--- a/bench/data.js
+++ /dev/null
@@ -1,12692 +0,0 @@
-window.BENCHMARK_DATA = {
- "lastUpdate": 1698074048010,
- "repoUrl": "https://github.com/lambdaclass/lambdaworks",
- "entries": {
- "Benchmark": [
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "21cc017bba911e0ada0822b291a180c393616c3b",
- "message": "Stark: Remove degree adjustment from composition poly (#563)\n\n* remove degree adjustment\n\n* remove unnecessary challenges\n\n* rename coefficients variables\n\n* remove degree adjustment from docs\n\n* remove whitespaces\n\n---------\n\nCo-authored-by: Mauro Toscano <12560266+MauroToscano@users.noreply.github.com>",
- "timestamp": "2023-09-21T15:43:08Z",
- "tree_id": "6fe57f30fab3e787d8b7519b2355116c96a3cb51",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/21cc017bba911e0ada0822b291a180c393616c3b"
- },
- "date": 1695311943511,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 80906685,
- "range": "± 3973747",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 163827314,
- "range": "± 3074837",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 307505052,
- "range": "± 2128221",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 629258729,
- "range": "± 16281845",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 34259067,
- "range": "± 837515",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 68767691,
- "range": "± 781590",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 136166075,
- "range": "± 1437006",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 284195927,
- "range": "± 3127477",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 26449665,
- "range": "± 618950",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 51962362,
- "range": "± 3358772",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 108742441,
- "range": "± 6765278",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 238466666,
- "range": "± 8798259",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 118100678,
- "range": "± 876090",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 236941069,
- "range": "± 1461953",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 475929062,
- "range": "± 13338609",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 960118625,
- "range": "± 33084625",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 399135895,
- "range": "± 4741370",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 799458271,
- "range": "± 2235816",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1579105979,
- "range": "± 7845662",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3089930583,
- "range": "± 22795686",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "21cc017bba911e0ada0822b291a180c393616c3b",
- "message": "Stark: Remove degree adjustment from composition poly (#563)\n\n* remove degree adjustment\n\n* remove unnecessary challenges\n\n* rename coefficients variables\n\n* remove degree adjustment from docs\n\n* remove whitespaces\n\n---------\n\nCo-authored-by: Mauro Toscano <12560266+MauroToscano@users.noreply.github.com>",
- "timestamp": "2023-09-21T15:43:08Z",
- "tree_id": "6fe57f30fab3e787d8b7519b2355116c96a3cb51",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/21cc017bba911e0ada0822b291a180c393616c3b"
- },
- "date": 1695313154465,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 846143153,
- "range": "± 4278230",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 2664558008,
- "range": "± 61528780",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 1775984479,
- "range": "± 1474799",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 6035932501,
- "range": "± 30143927",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 3706682968,
- "range": "± 1873073",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 13163489953,
- "range": "± 35002482",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 7720267977,
- "range": "± 4902680",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 27481631561,
- "range": "± 44307257",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 30103345,
- "range": "± 794654",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 29329320,
- "range": "± 312680",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 41492564,
- "range": "± 1631766",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 43107708,
- "range": "± 1183730",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 60875563,
- "range": "± 407160",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 61377316,
- "range": "± 227855",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 108662113,
- "range": "± 1013132",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 107370029,
- "range": "± 1084430",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 124482309,
- "range": "± 465141",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 123408297,
- "range": "± 128571",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 223863609,
- "range": "± 846011",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 223836008,
- "range": "± 1641128",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 247173208,
- "range": "± 276405",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 247104947,
- "range": "± 336524",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 453489397,
- "range": "± 977229",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 455002859,
- "range": "± 1316447",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 50304523,
- "range": "± 263170",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 104601380,
- "range": "± 489063",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 216840460,
- "range": "± 1296730",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 444210516,
- "range": "± 1229194",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 994875309,
- "range": "± 2496603",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2095032548,
- "range": "± 2213022",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 4361064036,
- "range": "± 3520451",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 9051281763,
- "range": "± 15083365",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1060782302,
- "range": "± 2244845",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2219063603,
- "range": "± 4137778",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 4613816404,
- "range": "± 6034531",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 9594912094,
- "range": "± 33638574",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 1539,
- "range": "± 1",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 98672,
- "range": "± 77",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 1224,
- "range": "± 1",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 433,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 1524,
- "range": "± 34",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 83628,
- "range": "± 116",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div",
- "value": 3920,
- "range": "± 1441",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with generic div",
- "value": 200145,
- "range": "± 1053",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with Ruffini",
- "value": 1571,
- "range": "± 8",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "71292159+mdvillagra@users.noreply.github.com",
- "name": "Marcos Villagra",
- "username": "mdvillagra"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "976c2375bad839a04d5bc8e629191d0b2d3c44fb",
- "message": "added `pub` keyword to poseidon hash function (#569)\n\nCo-authored-by: Sergio Chouhy <41742639+schouhy@users.noreply.github.com>",
- "timestamp": "2023-09-22T13:44:40Z",
- "tree_id": "87a7030bff1b8c818adf48b0f693b3edd80d8378",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/976c2375bad839a04d5bc8e629191d0b2d3c44fb"
- },
- "date": 1695391267240,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 102539174,
- "range": "± 11053277",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 176882715,
- "range": "± 15945851",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 334263448,
- "range": "± 16848572",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 646448792,
- "range": "± 24307815",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 33766591,
- "range": "± 155416",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 75302892,
- "range": "± 6372782",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 132896377,
- "range": "± 1187104",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 283671458,
- "range": "± 2043153",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 28317216,
- "range": "± 1684814",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 53664080,
- "range": "± 2514185",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 106373677,
- "range": "± 5415439",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 227402860,
- "range": "± 8099635",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 115480887,
- "range": "± 2074079",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 241188340,
- "range": "± 1989213",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 478629500,
- "range": "± 10585724",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 963858729,
- "range": "± 39376452",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 402655051,
- "range": "± 5174533",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 806759979,
- "range": "± 12623315",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1574023833,
- "range": "± 28840401",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3319014896,
- "range": "± 286344663",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "71292159+mdvillagra@users.noreply.github.com",
- "name": "Marcos Villagra",
- "username": "mdvillagra"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "976c2375bad839a04d5bc8e629191d0b2d3c44fb",
- "message": "added `pub` keyword to poseidon hash function (#569)\n\nCo-authored-by: Sergio Chouhy <41742639+schouhy@users.noreply.github.com>",
- "timestamp": "2023-09-22T13:44:40Z",
- "tree_id": "87a7030bff1b8c818adf48b0f693b3edd80d8378",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/976c2375bad839a04d5bc8e629191d0b2d3c44fb"
- },
- "date": 1695392676308,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 1011081156,
- "range": "± 3695536",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 3110010866,
- "range": "± 5443073",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 2113824093,
- "range": "± 5236702",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 6823005902,
- "range": "± 28385985",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 4458617885,
- "range": "± 7259287",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 14784961044,
- "range": "± 45512041",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 9266342074,
- "range": "± 43792615",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 31641013783,
- "range": "± 66235225",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 36572928,
- "range": "± 156152",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 36452906,
- "range": "± 244092",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 59335428,
- "range": "± 1214342",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 60338857,
- "range": "± 832931",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 72974480,
- "range": "± 287560",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 73584498,
- "range": "± 397481",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 125949860,
- "range": "± 1475522",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 127921969,
- "range": "± 1719342",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 146585385,
- "range": "± 358240",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 146330557,
- "range": "± 576116",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 266575110,
- "range": "± 17160967",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 266360712,
- "range": "± 563578",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 292513740,
- "range": "± 552281",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 292250499,
- "range": "± 535826",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 533210883,
- "range": "± 1671072",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 533540761,
- "range": "± 1551346",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 57247241,
- "range": "± 112799",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 117319038,
- "range": "± 218997",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 243273944,
- "range": "± 400004",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 507319787,
- "range": "± 1141482",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 1206383399,
- "range": "± 2478950",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2510188052,
- "range": "± 4106240",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 5220810178,
- "range": "± 11592323",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 10803818293,
- "range": "± 27609103",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1266354069,
- "range": "± 5766274",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2658736358,
- "range": "± 9562558",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 5493566709,
- "range": "± 29435490",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 11389085467,
- "range": "± 36683969",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 914,
- "range": "± 9",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 29437,
- "range": "± 95",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 834,
- "range": "± 8",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 384,
- "range": "± 1",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 1134,
- "range": "± 8",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 26156,
- "range": "± 109",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div",
- "value": 2964,
- "range": "± 546",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with generic div",
- "value": 71937,
- "range": "± 1000",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with Ruffini",
- "value": 927,
- "range": "± 11",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "12560266+MauroToscano@users.noreply.github.com",
- "name": "Mauro Toscano",
- "username": "MauroToscano"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": false,
- "id": "fe9c24f4c5e9db8ed1818877255aa937e5674a01",
- "message": "Add makefile (#571)",
- "timestamp": "2023-09-22T16:41:42Z",
- "tree_id": "6097cd455311087c4c03ca001ac459c5efbc7254",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/fe9c24f4c5e9db8ed1818877255aa937e5674a01"
- },
- "date": 1695401925827,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 88564915,
- "range": "± 6265385",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 164429268,
- "range": "± 5058062",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 300401843,
- "range": "± 3318662",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 646287021,
- "range": "± 48195265",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 42796184,
- "range": "± 2134357",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 78229297,
- "range": "± 4917999",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 147928341,
- "range": "± 4032024",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 308701239,
- "range": "± 8752517",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 51822733,
- "range": "± 4672102",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 67314498,
- "range": "± 4234561",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 132205628,
- "range": "± 9120218",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 231810826,
- "range": "± 10433062",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 166688421,
- "range": "± 5091955",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 345046531,
- "range": "± 25742143",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 674331500,
- "range": "± 37957268",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 1262564020,
- "range": "± 238486491",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 406526646,
- "range": "± 1631787",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 820768396,
- "range": "± 21292382",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1792259250,
- "range": "± 100293168",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3736440083,
- "range": "± 97514073",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "ba2645c15a85b4f60d513150a19f885d3142b171",
- "message": "Change generator in the Stark252PrimeField to one of maximal order $2^{192}$ (#572)\n\n* use a generator of the 2-Sylow subgroup in the Stark252PrimeField\n\n* use square",
- "timestamp": "2023-09-22T16:42:12Z",
- "tree_id": "004a8fe88e82a2b770c90e8cb60536dfdb3be6cc",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/ba2645c15a85b4f60d513150a19f885d3142b171"
- },
- "date": 1695402014610,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 108925649,
- "range": "± 5302474",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 177831624,
- "range": "± 8484376",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 351638197,
- "range": "± 6927356",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 661351333,
- "range": "± 16377371",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 44188072,
- "range": "± 3322142",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 88349800,
- "range": "± 4608551",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 170586136,
- "range": "± 6097545",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 354126406,
- "range": "± 30624201",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 33092202,
- "range": "± 2152692",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 61306393,
- "range": "± 924217",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 117642335,
- "range": "± 2085019",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 231425021,
- "range": "± 7507328",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 228854166,
- "range": "± 85779219",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 446731166,
- "range": "± 173206978",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 810111500,
- "range": "± 410187647",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 996154646,
- "range": "± 703171565",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 408820458,
- "range": "± 3590456",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 800869896,
- "range": "± 4413653",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1579673145,
- "range": "± 5892977",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3142198646,
- "range": "± 16865163",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "12560266+MauroToscano@users.noreply.github.com",
- "name": "Mauro Toscano",
- "username": "MauroToscano"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": false,
- "id": "fe9c24f4c5e9db8ed1818877255aa937e5674a01",
- "message": "Add makefile (#571)",
- "timestamp": "2023-09-22T16:41:42Z",
- "tree_id": "6097cd455311087c4c03ca001ac459c5efbc7254",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/fe9c24f4c5e9db8ed1818877255aa937e5674a01"
- },
- "date": 1695403081772,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 845620175,
- "range": "± 516594",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 2744734856,
- "range": "± 55190857",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 1774290545,
- "range": "± 837501",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 6047853694,
- "range": "± 17591734",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 3706379272,
- "range": "± 2605969",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 13138951980,
- "range": "± 55954320",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 7721739239,
- "range": "± 3468125",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 28092719304,
- "range": "± 79888998",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 30816443,
- "range": "± 129105",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 31215590,
- "range": "± 274507",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 52734443,
- "range": "± 1752387",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 51387154,
- "range": "± 1527059",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 61949117,
- "range": "± 96982",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 62176914,
- "range": "± 61287",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 113809711,
- "range": "± 1752258",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 116752428,
- "range": "± 1076722",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 124977731,
- "range": "± 240015",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 124703337,
- "range": "± 169878",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 236476929,
- "range": "± 957291",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 235381232,
- "range": "± 755884",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 248571303,
- "range": "± 273522",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 248634721,
- "range": "± 261463",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 474962632,
- "range": "± 596105",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 475093323,
- "range": "± 552711",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 52333753,
- "range": "± 91284",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 106321154,
- "range": "± 580469",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 220610628,
- "range": "± 656375",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 445047819,
- "range": "± 604241",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 1009250236,
- "range": "± 3088445",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2108901924,
- "range": "± 3751586",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 4370163882,
- "range": "± 2968167",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 9076385830,
- "range": "± 7887031",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1069708169,
- "range": "± 2058538",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2241556643,
- "range": "± 2399466",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 4640261607,
- "range": "± 3993011",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 9602438127,
- "range": "± 15740924",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 20,
- "range": "± 4",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 34,
- "range": "± 4",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 78,
- "range": "± 7",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 31,
- "range": "± 7",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 107,
- "range": "± 5",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 57,
- "range": "± 13",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "ba2645c15a85b4f60d513150a19f885d3142b171",
- "message": "Change generator in the Stark252PrimeField to one of maximal order $2^{192}$ (#572)\n\n* use a generator of the 2-Sylow subgroup in the Stark252PrimeField\n\n* use square",
- "timestamp": "2023-09-22T16:42:12Z",
- "tree_id": "004a8fe88e82a2b770c90e8cb60536dfdb3be6cc",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/ba2645c15a85b4f60d513150a19f885d3142b171"
- },
- "date": 1695403549022,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 1086930260,
- "range": "± 17828901",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 3593954127,
- "range": "± 51304983",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 2191250533,
- "range": "± 26076101",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 7856112925,
- "range": "± 109528600",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 4601549133,
- "range": "± 71643386",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 16908613703,
- "range": "± 117011791",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 9334409278,
- "range": "± 142567173",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 35987448125,
- "range": "± 526031066",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 38992247,
- "range": "± 1068513",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 38734017,
- "range": "± 851242",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 70734450,
- "range": "± 1337310",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 71257479,
- "range": "± 1186607",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 76662695,
- "range": "± 522751",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 76700202,
- "range": "± 756882",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 143929940,
- "range": "± 2775787",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 143794983,
- "range": "± 2511663",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 155605509,
- "range": "± 2243599",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 156567134,
- "range": "± 3049553",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 287784631,
- "range": "± 6235719",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 287737991,
- "range": "± 6598391",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 310453979,
- "range": "± 6812602",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 310000034,
- "range": "± 8259449",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 567221753,
- "range": "± 8010573",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 569297375,
- "range": "± 9098875",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 66789192,
- "range": "± 1546139",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 130518894,
- "range": "± 2259390",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 269619555,
- "range": "± 6061610",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 542675991,
- "range": "± 11270242",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 1238450007,
- "range": "± 26551949",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2587043985,
- "range": "± 39175812",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 5343581869,
- "range": "± 86348114",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 11167909954,
- "range": "± 122812613",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1321545676,
- "range": "± 16789391",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2758574073,
- "range": "± 36610026",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 5765930276,
- "range": "± 67953989",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 11580974583,
- "range": "± 102796371",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 872,
- "range": "± 86",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 28324,
- "range": "± 1264",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 829,
- "range": "± 43",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 383,
- "range": "± 17",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 1134,
- "range": "± 67",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 26612,
- "range": "± 1993",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div",
- "value": 3015,
- "range": "± 413",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with generic div",
- "value": 73143,
- "range": "± 3276",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with Ruffini",
- "value": 912,
- "range": "± 35",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "da688cd9f845c1c32216e179dd9389f339117a02",
- "message": "Stark: make transcript compatible with Stone Prover (#570)\n\n* add StarkTranscript trait and implementation\n\n* make append field element compatible with stone prover\n\n* add test\n\n* add tests\n\n* uncomment test\n\n* remove code added by mistake to exercises\n\n* make counter of type u32",
- "timestamp": "2023-09-22T19:56:35Z",
- "tree_id": "cac007153bc2c2a91c9c30c72008225a7082860f",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/da688cd9f845c1c32216e179dd9389f339117a02"
- },
- "date": 1695413737979,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 88452593,
- "range": "± 10114947",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 162210312,
- "range": "± 3274982",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 310486240,
- "range": "± 3648050",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 626147916,
- "range": "± 29029684",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 34091685,
- "range": "± 207389",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 67439151,
- "range": "± 450592",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 133624131,
- "range": "± 857875",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 279868573,
- "range": "± 3373396",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 29448542,
- "range": "± 251124",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 56449454,
- "range": "± 1386042",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 106012347,
- "range": "± 3969365",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 238343486,
- "range": "± 10575957",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 118072937,
- "range": "± 838288",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 238579166,
- "range": "± 1012500",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 496510312,
- "range": "± 5650720",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 990154625,
- "range": "± 12970507",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 406048041,
- "range": "± 3065748",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 795755833,
- "range": "± 4646334",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1569354166,
- "range": "± 22091684",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3136845541,
- "range": "± 28612161",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "da688cd9f845c1c32216e179dd9389f339117a02",
- "message": "Stark: make transcript compatible with Stone Prover (#570)\n\n* add StarkTranscript trait and implementation\n\n* make append field element compatible with stone prover\n\n* add test\n\n* add tests\n\n* uncomment test\n\n* remove code added by mistake to exercises\n\n* make counter of type u32",
- "timestamp": "2023-09-22T19:56:35Z",
- "tree_id": "cac007153bc2c2a91c9c30c72008225a7082860f",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/da688cd9f845c1c32216e179dd9389f339117a02"
- },
- "date": 1695414860782,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 944337731,
- "range": "± 612738",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 1962822427,
- "range": "± 17082111",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 1975801824,
- "range": "± 1759890",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 4392851305,
- "range": "± 14543517",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 4124944145,
- "range": "± 1897986",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 9949149914,
- "range": "± 14191238",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 8598542599,
- "range": "± 5759404",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 21443665945,
- "range": "± 25079847",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 33210417,
- "range": "± 82493",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 33124355,
- "range": "± 59686",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 49773769,
- "range": "± 664698",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 51323025,
- "range": "± 565171",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 66065993,
- "range": "± 80707",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 66278829,
- "range": "± 96012",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 110851338,
- "range": "± 694966",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 110688878,
- "range": "± 559560",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 132542429,
- "range": "± 127027",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 132258744,
- "range": "± 375465",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 226668950,
- "range": "± 383265",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 226546941,
- "range": "± 431081",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 263042954,
- "range": "± 340890",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 262968931,
- "range": "± 354722",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 449942834,
- "range": "± 599845",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 450209246,
- "range": "± 507765",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 45424061,
- "range": "± 159364",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 94067998,
- "range": "± 241039",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 189335964,
- "range": "± 458475",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 375066846,
- "range": "± 1141660",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 1087717497,
- "range": "± 1816344",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2269820040,
- "range": "± 2042287",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 4703945120,
- "range": "± 2687739",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 9795171016,
- "range": "± 13890883",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1154499080,
- "range": "± 1935092",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2403512451,
- "range": "± 1079422",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 4983100615,
- "range": "± 1841370",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 10315540429,
- "range": "± 3726411",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 34,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 153,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 76,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 36,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 108,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 214,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div",
- "value": 340,
- "range": "± 1",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with generic div",
- "value": 917,
- "range": "± 2",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with Ruffini",
- "value": 34,
- "range": "± 0",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": false,
- "id": "0a299a76a0a6f61e6c59aacb499c70c42b81c7af",
- "message": "Stark: Small refactor of StarkTranscript (#574)\n\n* small refactor of starkprovertranscript\n\n* move keccak_hash to StarkProverTranscript impl",
- "timestamp": "2023-09-25T14:17:27Z",
- "tree_id": "1c33239360f337ca6d9d76fa4ba0c30f851647e0",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/0a299a76a0a6f61e6c59aacb499c70c42b81c7af"
- },
- "date": 1695652654942,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 103776131,
- "range": "± 9542133",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 210099757,
- "range": "± 11940642",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 410962854,
- "range": "± 21745834",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 681870541,
- "range": "± 32539529",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 46661280,
- "range": "± 4294096",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 81800818,
- "range": "± 3717891",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 138840687,
- "range": "± 2459400",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 315714635,
- "range": "± 15778293",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 30316042,
- "range": "± 875767",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 56217499,
- "range": "± 830861",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 110534563,
- "range": "± 2947654",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 229212923,
- "range": "± 8950250",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 118487356,
- "range": "± 989811",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 242343923,
- "range": "± 1313012",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 499228354,
- "range": "± 13315955",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 984501521,
- "range": "± 9918763",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 411000854,
- "range": "± 3384334",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 799364063,
- "range": "± 6272688",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1592850041,
- "range": "± 8950540",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3150361000,
- "range": "± 12614311",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "71292159+mdvillagra@users.noreply.github.com",
- "name": "Marcos Villagra",
- "username": "mdvillagra"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "8e0438adb11cdbcb404116a63f51970369102c62",
- "message": "changed order of evaluation to avoid underflow (#575)",
- "timestamp": "2023-09-25T14:31:17Z",
- "tree_id": "cbf33abcc270acc3583765b5ff7fff89e3a7fb5a",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/8e0438adb11cdbcb404116a63f51970369102c62"
- },
- "date": 1695653307550,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 90813679,
- "range": "± 9833671",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 160172198,
- "range": "± 3891459",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 305762240,
- "range": "± 2844605",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 628935250,
- "range": "± 23010851",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 34690949,
- "range": "± 398473",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 69516833,
- "range": "± 497958",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 136802872,
- "range": "± 2128464",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 287174291,
- "range": "± 3115487",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 27596957,
- "range": "± 764467",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 56309147,
- "range": "± 1802114",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 109021808,
- "range": "± 3031316",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 228570958,
- "range": "± 6611478",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 115193312,
- "range": "± 692354",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 236045618,
- "range": "± 1372906",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 488282146,
- "range": "± 7843484",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 987419875,
- "range": "± 21200315",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 405468500,
- "range": "± 2362246",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 798426479,
- "range": "± 4516917",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1576969854,
- "range": "± 6095957",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3132808062,
- "range": "± 28096749",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "41742639+schouhy@users.noreply.github.com",
- "name": "Sergio Chouhy",
- "username": "schouhy"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": false,
- "id": "0a299a76a0a6f61e6c59aacb499c70c42b81c7af",
- "message": "Stark: Small refactor of StarkTranscript (#574)\n\n* small refactor of starkprovertranscript\n\n* move keccak_hash to StarkProverTranscript impl",
- "timestamp": "2023-09-25T14:17:27Z",
- "tree_id": "1c33239360f337ca6d9d76fa4ba0c30f851647e0",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/0a299a76a0a6f61e6c59aacb499c70c42b81c7af"
- },
- "date": 1695653863759,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 845757378,
- "range": "± 587148",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 2683717719,
- "range": "± 12395191",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 1772440677,
- "range": "± 1151510",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 5994651159,
- "range": "± 25111035",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 3702015733,
- "range": "± 1241691",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 12978429022,
- "range": "± 38538279",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 7718028433,
- "range": "± 4459508",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 28752720907,
- "range": "± 1863184915",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 30106679,
- "range": "± 156314",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 29912197,
- "range": "± 204621",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 50167014,
- "range": "± 1376135",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 47931984,
- "range": "± 1950548",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 61832523,
- "range": "± 272676",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 61528923,
- "range": "± 167673",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 110342894,
- "range": "± 583981",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 111079008,
- "range": "± 1165777",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 124898136,
- "range": "± 963017",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 124402609,
- "range": "± 346385",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 230106702,
- "range": "± 808826",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 229427556,
- "range": "± 3082446",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 247685090,
- "range": "± 578173",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 247951557,
- "range": "± 409712",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 454135403,
- "range": "± 1101114",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 454040204,
- "range": "± 1159040",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 50937927,
- "range": "± 276229",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 104123522,
- "range": "± 167455",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 208909237,
- "range": "± 722244",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 433691133,
- "range": "± 1586199",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 999497259,
- "range": "± 6700590",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2101013534,
- "range": "± 10016507",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 4388080552,
- "range": "± 6867411",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 9105089219,
- "range": "± 13554349",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1067457663,
- "range": "± 3802393",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2233646197,
- "range": "± 3313022",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 4639127913,
- "range": "± 5840829",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 9605853765,
- "range": "± 5899075",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 176,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 1437,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 219,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 101,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 340,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 1557,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div",
- "value": 986,
- "range": "± 13",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with generic div",
- "value": 4644,
- "range": "± 10",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with Ruffini",
- "value": 179,
- "range": "± 0",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "71292159+mdvillagra@users.noreply.github.com",
- "name": "Marcos Villagra",
- "username": "mdvillagra"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "8e0438adb11cdbcb404116a63f51970369102c62",
- "message": "changed order of evaluation to avoid underflow (#575)",
- "timestamp": "2023-09-25T14:31:17Z",
- "tree_id": "cbf33abcc270acc3583765b5ff7fff89e3a7fb5a",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/8e0438adb11cdbcb404116a63f51970369102c62"
- },
- "date": 1695654825773,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 1004396656,
- "range": "± 14966183",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 3517915208,
- "range": "± 36282329",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 2150902840,
- "range": "± 24739038",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 7760480930,
- "range": "± 61626609",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 4536899012,
- "range": "± 63289666",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 16908975115,
- "range": "± 94550350",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 9365430950,
- "range": "± 180860826",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 35894935843,
- "range": "± 145775530",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 35691252,
- "range": "± 933480",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 36184006,
- "range": "± 1247461",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 61666899,
- "range": "± 2409200",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 62447796,
- "range": "± 3992533",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 73016780,
- "range": "± 1447706",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 73740560,
- "range": "± 1708168",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 131865841,
- "range": "± 1955892",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 132866607,
- "range": "± 2619571",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 145409573,
- "range": "± 3937374",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 145351631,
- "range": "± 3094565",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 279621709,
- "range": "± 9204729",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 278832443,
- "range": "± 4254009",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 296473222,
- "range": "± 6996070",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 299887423,
- "range": "± 5965423",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 563948773,
- "range": "± 10916203",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 553708832,
- "range": "± 7909139",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 61478421,
- "range": "± 2101754",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 128674737,
- "range": "± 1602873",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 264134452,
- "range": "± 3202602",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 526522205,
- "range": "± 8164323",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 1240697492,
- "range": "± 25366027",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2560057785,
- "range": "± 37880096",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 5277019130,
- "range": "± 89902985",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 10830419467,
- "range": "± 95011316",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1267293000,
- "range": "± 16721304",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2661061961,
- "range": "± 25112762",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 5586664318,
- "range": "± 53821597",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 11494049027,
- "range": "± 92285090",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 47,
- "range": "± 4",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 112,
- "range": "± 4",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 99,
- "range": "± 5",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 38,
- "range": "± 2",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 143,
- "range": "± 9",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 150,
- "range": "± 8",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div",
- "value": 871,
- "range": "± 63",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with generic div",
- "value": 874,
- "range": "± 60",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with Ruffini",
- "value": 52,
- "range": "± 39",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "12560266+MauroToscano@users.noreply.github.com",
- "name": "Mauro Toscano",
- "username": "MauroToscano"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": false,
- "id": "9825074e9269326bea93b788540b3bac7cde4056",
- "message": "Multiple small fixes for the prover CLI (#579)\n\n* Add fixes\n\n* Move requirements\n\n* Update ci",
- "timestamp": "2023-09-27T14:53:39Z",
- "tree_id": "64371c82774782455ab832a6320103a7ecfa1a24",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/9825074e9269326bea93b788540b3bac7cde4056"
- },
- "date": 1695827778422,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Parallel (Metal)",
- "value": 87006244,
- "range": "± 7131810",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #2",
- "value": 160642936,
- "range": "± 6868632",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #3",
- "value": 303697448,
- "range": "± 4553277",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Parallel (Metal) #4",
- "value": 662370666,
- "range": "± 34753211",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal)",
- "value": 42456189,
- "range": "± 1152361",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #2",
- "value": 72371672,
- "range": "± 2386109",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #3",
- "value": 153709776,
- "range": "± 4824593",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/Parallel (Metal) #4",
- "value": 305029531,
- "range": "± 4988827",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal)",
- "value": 33577447,
- "range": "± 3364080",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #2",
- "value": 63446136,
- "range": "± 2245305",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #3",
- "value": 107886064,
- "range": "± 1314096",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Parallel (Metal) #4",
- "value": 222888222,
- "range": "± 10039915",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal",
- "value": 116806077,
- "range": "± 1252919",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #2",
- "value": 242871368,
- "range": "± 1246661",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #3",
- "value": 499098229,
- "range": "± 8677462",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_fft_metal #4",
- "value": 985588083,
- "range": "± 12879347",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal",
- "value": 408827083,
- "range": "± 3432456",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #2",
- "value": 790591124,
- "range": "± 5149137",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #3",
- "value": 1573447124,
- "range": "± 17362420",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/interpolate_fft_metal #4",
- "value": 3149364271,
- "range": "± 12402023",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "12560266+MauroToscano@users.noreply.github.com",
- "name": "Mauro Toscano",
- "username": "MauroToscano"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": false,
- "id": "9825074e9269326bea93b788540b3bac7cde4056",
- "message": "Multiple small fixes for the prover CLI (#579)\n\n* Add fixes\n\n* Move requirements\n\n* Update ci",
- "timestamp": "2023-09-27T14:53:39Z",
- "tree_id": "64371c82774782455ab832a6320103a7ecfa1a24",
- "url": "https://github.com/lambdaclass/lambdaworks/commit/9825074e9269326bea93b788540b3bac7cde4056"
- },
- "date": 1695829088630,
- "tool": "cargo",
- "benches": [
- {
- "name": "Ordered FFT/Sequential from NR radix2",
- "value": 859227821,
- "range": "± 410896",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2",
- "value": 3185504408,
- "range": "± 6594272",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #2",
- "value": 1797483634,
- "range": "± 806819",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #2",
- "value": 6982817015,
- "range": "± 10657077",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #3",
- "value": 3757353028,
- "range": "± 832512",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #3",
- "value": 14783046889,
- "range": "± 117642413",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from NR radix2 #4",
- "value": 7828571963,
- "range": "± 2495794",
- "unit": "ns/iter"
- },
- {
- "name": "Ordered FFT/Sequential from RN radix2 #4",
- "value": 31952585229,
- "range": "± 39043335",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural",
- "value": 31737138,
- "range": "± 49679",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed",
- "value": 31697024,
- "range": "± 54668",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed",
- "value": 59980613,
- "range": "± 388996",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed",
- "value": 59675686,
- "range": "± 249659",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #2",
- "value": 63330969,
- "range": "± 77816",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #2",
- "value": 63508025,
- "range": "± 72583",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #2",
- "value": 126544227,
- "range": "± 534298",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #2",
- "value": 127188387,
- "range": "± 428476",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #3",
- "value": 127266192,
- "range": "± 211902",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #3",
- "value": 127064959,
- "range": "± 62606",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #3",
- "value": 259825044,
- "range": "± 278144",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #3",
- "value": 259637328,
- "range": "± 532898",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural #4",
- "value": 252819423,
- "range": "± 236179",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/natural inversed #4",
- "value": 252677519,
- "range": "± 113121",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed #4",
- "value": 528712762,
- "range": "± 680971",
- "unit": "ns/iter"
- },
- {
- "name": "FFT twiddles generation/bit-reversed inversed #4",
- "value": 530513619,
- "range": "± 1784450",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential",
- "value": 61809749,
- "range": "± 343189",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #2",
- "value": 129972702,
- "range": "± 299862",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #3",
- "value": 274865142,
- "range": "± 370573",
- "unit": "ns/iter"
- },
- {
- "name": "Bit-reverse permutation/Sequential #4",
- "value": 560729625,
- "range": "± 927469",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT",
- "value": 1046702705,
- "range": "± 1657747",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #2",
- "value": 2186566298,
- "range": "± 2281132",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #3",
- "value": 4538156610,
- "range": "± 5673322",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial evaluation/Sequential FFT #4",
- "value": 9425146094,
- "range": "± 22256292",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT",
- "value": 1145420648,
- "range": "± 1707192",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #2",
- "value": 2380842395,
- "range": "± 4591939",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #3",
- "value": 4881151875,
- "range": "± 9504806",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial interpolation/Sequential FFT #4",
- "value": 10142493408,
- "range": "± 35295422",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate",
- "value": 1542,
- "range": "± 1",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/evaluate_slice",
- "value": 98767,
- "range": "± 148",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/add",
- "value": 1222,
- "range": "± 2",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/neg",
- "value": 423,
- "range": "± 0",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/sub",
- "value": 1521,
- "range": "± 3",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/mul",
- "value": 83688,
- "range": "± 91",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div",
- "value": 4167,
- "range": "± 1953",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with generic div",
- "value": 200774,
- "range": "± 941",
- "unit": "ns/iter"
- },
- {
- "name": "Polynomial/div by 'x - b' with Ruffini",
- "value": 1573,
- "range": "± 10",
- "unit": "ns/iter"
- }
- ]
- },
- {
- "commit": {
- "author": {
- "email": "ajgarassino@gmail.com",
- "name": "ajgara",
- "username": "ajgara"
- },
- "committer": {
- "email": "noreply@github.com",
- "name": "GitHub",
- "username": "web-flow"
- },
- "distinct": true,
- "id": "c76dbf6062ad8c8388b6757e9eef11776df5763e",
- "message": "Fix verifier and CairoAIR config (#578)\n\n* Fix verifier and CairoAIR config\n\n* Add test to make sure authentication paths are being checked\n\n* Cargo format\n\n* Fix clippy for feature metal\n\n---------\n\nCo-authored-by: Agustin In summary, at a very high level, the STARK protocol can be organized into three major parts: As the Recap mentions, the trace is a table containing the system's state at every step. In this section, we will denote the trace as . A trace can have several columns to store different aspects or features of a particular state at a specific moment. We will refer to the -th column as . You can think of a trace as a matrix where the entry is the -th element of the -th state. Most proving systems' primary tool is polynomials over a finite field . Each column of the trace will be interpreted as evaluations of such a polynomial . Consequently, any information about the states must be encoded somehow as an element in . Most proving systems' primary tool is polynomials over a finite field . Each column of the trace will be interpreted as evaluations of such a polynomial . Consequently, any information about the states must be encoded somehow as an element in . To ease notation, we will assume here and in the protocol that the constraints encoding transition rules depend only on a state and the previous one. Everything can be easily generalized to transitions that depend on many preceding states. Then, constraints can be expressed as multivariate polynomials in variables
A transition from state to state will be valid if and only if when we plug row of in the first variables and row in the second variables of , we get for all . In mathematical notation, this is
@@ -1202,73 +1202,68 @@ Given a vector , commiting to means the following. The prover builds a Merkle tree out of it and sends its root to the verifier. The verifier can then ask the prover to reveal, or open, the value of the vector at some index . The prover won't have any choice except to send the correct value. The verifier will expect the corresponding value and the authentication path to the tree's root to check its authenticity. The authentication path also encodes the vector's position and its length . In STARKs, all commited vectors are of the form for some polynomial and some domain fixed domain . The domain is always known to the prover and the verifier. The root of the Merkle tree is said to be the commitment of , and we denote it here by . The FRI protocol is a potent tool to prove that the commitment of a vector corresponds to the evaluations of a polynomial of a certain degree. The degree is a configuration of the protocol. In STARKs, all commited vectors are of the form for some polynomial and some fixed domain . The domain is always known to the prover and the verifier. It can be proved, as long as is less than the total number of field elements, that every vector is equal to for a unique polynomial of degree at most . This is called the Lagrange interpolation theorem. It means, there is a unique polynomial of degree at most such that for all . And is an upper bound to the degree of . It could be less. For example, the vector of all ones is the evaluation of the constant polynomial , which has degree . Suppose the vector is the vector of evaluations of a polynomial of degree strictly less than . Suppose one party holds the vector and another party holds only the commitment of it. The FRI protocol is an efficient interactive protocol with which the former can convince the latter that the commitment they hold corresponds to the vector of evaluations of a polynomial of degree strictly less than . More precisely, the protocol depends on the following parameters A prover holds a vector , and the verifier holds the commitment of it. The result of the FRI protocol will be Accept if the unique polynomial of degree less than such that has degree less than . Even more precisely, the protocol proves that is very close to a vector with of degree less than , but it may differ in negligible proportion of the coordinates. The number is called the blowup factor and the security of the protocol depends in part on this parameter. The specific shape of the domain set has some symmetric properties important for the inner workings of FRI, such as for all . FRI is usually described as above. In STARK, FRI is used as a building block for the polynomial commitment scheme of the next section. For that, a small variant of FRI is needed. Suppose the prover holds a vector and the verifier holds its commitment as before. Suppose further that both parties know a function that takes two field elements and outputs another field element. For example could be the function . More precisely, the kind of functions we need are . The protocol can be used to prove that the transformed vector is the vector of evaluations of a polynomial of degree at most . Note that in this variant, the verifier holds originally the commitment of the vector and not the commitment of the transformed vector. In the example, the verifier holds the commitment and FRI will return Accept if is the vector of evaluations of a polynomial of degree at most . STARK uses a univariate polynomial commitment scheme. The following is what is expected from the commit and open protocols: Let's see how both of these protocols work in detail. Some configuration parameters are needed: Let's see how both of these protocols work in detail. The same configuration parameters of FRI are needed: The commitment scheme will only work for polynomials of degree at most . This means anyone can commit to any polynomial, but the Open protocol will pass only for polynomials satisfying that degree bound. The commitment scheme will only work for polynomials of degree at most (polynomials of degree are allowed). This means: anyone can commit to any polynomial, but the Open protocol will pass only for polynomials satisfying that degree bound. Given a polynomial , the commitment is just the commitment of the vector . That is, is the root of the Merkle tree of the vector of evaluations of at . It is an interactive protocol. So assume there is a prover and a verifier. We describe the process considering an honest prover. In the next section, we analyze what happens for malicious provers. The prover holds the polynomial , and the verifier only the commitment of it. There is also an element . The prover evaluates and sends the result to the verifier. As we mentioned, the goal is to generate proof of the validity of the evaluation. Let us denote . This is a value now both the prover and verifier have. The protocol has three steps: FRI on : First, the prover and the verifier engage in a FRI protocol for polynomials of degree at most to check that is the commitment of such a polynomial. We will assume from now on that the degree of is at most . There is an optimization that completely removes this step—more on that later. FRI on : Since , the polynomial can be written as for some polynomial . The prover computes the commitment and sends it to the verifier. Now they engage in a FRI protocol for polynomials of degree at most , which convinces the verifier that is the commitment of a polynomial of degree at most . Point checks: From the point of view of the verifier the commitments and are still potentially unrelated. Therefore, there is a check to ensure that was computed properly from following the formula and that is its commitment. To do this, the verifier challenges the prover to open and as vectors. They use the open protocol of the vector commitment scheme to reveal the values and for some random point chosen by the verifier. Next he checks that . They repeat this last part times and, as we'll analyze in the next section, this whole thing will convince the verifier that as polynomials with overwhelming probability (about ). Finally, the verifier deduces that from this equality. The prover holds the polynomial , and the verifier only the commitment of it. There is also an element chosen by the verifier. The prover evaluates and sends the result back. As we mentioned, the goal is to generate proof of the validity of the evaluation. Let us denote the value received by the verifier. Now they engage in the variant of the FRI protocol for the function . The verifier accepts the value if and only if the result of FRI is Accept. Let's see why this makes sense. If the prover is honest, is of degree at most and equals . That means that
+
+for some polynomial . Since is of degree at most , then is of degree at most . The vector is then a vector of evaluations of a polynomial of degree at most . And it is equal to . So the FRI protocol will succeed. Let's analyze why the open protocol is sound. Keep in mind that the prover always has to provide a commitment of a polynomial of degree at most that satisfies for the chosen values of the verifier. That's the goal. An essential but subtle part of the soundness is that is a vector of length . To understand why let's see what would happen if . Suppose the prover tries to cheat the verifier by sending a value different from . This means that is not divisible by as polynomials. But as long as is not in the prover can interpolate the values
-at and obtain some polynomial of degree at most . This polynomial satisfies for all , but the equality of polynomials does not hold. Mainly because that would imply that , and we are assuming the opposite case. Nevertheless, if they continue with the open protocol, FRI will pass since is a polynomial of degree at most . All subsequent point checks will pass since was crafted especially for that. So how come is different from but has the property that for all ? FRI guarantees is of degree at most , which implies that is of degree at most . Then, since is of degree at most , the difference is again of degree at most . A polynomial of degree at most is zero if and only if we can prove that for distinct points. But the construction of only shows that for all , a set of points. It's not enough. One extra point and the equality would hold. Of course, that point doesn't exist, again, because that would imply that , which we assume is not true. Let's see one more example where we double the de size of but keep the same bound for the degree of the polynomials. So polynomials are of degree at most , and the length of is . Again let's assume the prover wants to cheat the verifier similarly and claims that is but, in reality, . Inevitably, for the Open protocol to succeed, the prover has to send a commitment of some polynomial of degree at most . The strategy of the prover is pretty much constrained to be the same. But now he can't interpolate as before in every element of because that would produce a polynomial of degree at most . This most likely won't pass the FRI check. Alternatively, he can choose some subset of of size and interpolate only there to get a polynomial of degree at most . That will succeed in the FRI phase, but what happens with the point checks? The check will pass if the verifier chooses a challenge that belongs to . If , then the check will inevitably fail. This is because, as we saw in the previous case, one extra successful point to the already points where was interpolated was enough to prove that , which we assume now not to hold. This means, if , then does not coincide with and the point check fails. So if the verifier chooses the challenges following a uniform distribution, the chances of the prover being caught cheating are for only one challenge. If the verifier performs challenges, then the chance of the prover not getting caught is . If the ratio between and is , then challenges give of probability for a malicious prover to succeed. If the ratio is , that is, if , then that probability is for the same number of point checks. This provides another way of improving the soundness error. The larger the ratio, the more complex it is to cheat in the open protocol. This ratio is what's called the blowup factor. It is a security parameter, and finding a balance between the number of challenges and the size of is part of the configuration of the protocol. Increasing the size of makes committing an expensive operation since it involves building a Merkle tree with a vector of the size of . But increasing the number of challenges makes the size of the final proof larger. We denote the blowup factor by , and it's always assumed to be a power of . Let's sketch an idea of the soundness. Note that the value is chosen by the verifier after receiving the commitment of . So the prover does not know in advance, at the moment of sending , what will be. Suppose the prover is trying to cheat and sends the commitment of a vector that's not the vector of evaluations of a polynomial of degree at most . Then the coordinates of the transformed vector are . Since was chosen by the verifier, dividing by shuffles all the elements in a very unpredictable way for the prover. So it is extremely unlikely that the cheating prover can craft an invalid vector such that the transformed vector turns out to be of degree at most . The expected degree of the polynomial associated with a random vector is . During proof generation, polynomials are committed and opened several times. Computing these for each polynomial independently is costly. In this section, we'll see how batching polynomials can reduce the amount of computation. Let be a set of polynomials. We will commit and open as a whole. We note this batch commitment as . We need the same configuration parameters as before: , with , a vector and . As described earlier, to commit to a single polynomial , a Merkle tree is built over the vector . When committing to a batch of polynomials , the leaves of the Merkle tree are instead the concatenation of the polynomial evaluations. That is, in the batch setting, the Merkle tree is built for the vector . The commitment is the root of this Merkle tree. This reduces the proof size: we only need one Merkle tree for polynomials. The verifier can then only ask for values in batches. When the verifier chooses an index , the prover sends along with one authentication path. The verifier on his side computes the concatenation and validates it with the authentication path and . This also reduces the computational time. By traversing the Merkle tree one time, it can reveal several components simultaneously. The batch open protocol proceeds similarly to the case of a single polynomial. The prover will try to convince the verifier that the committed polynomials at evaluate to some values . In the batch case, the prover will construct the following polynomial:
- Where are challenges provided by the verifier. The prover commits to and sends to the verifier. Then the prover and verifier continue similarly to the normal open protocol for only. This means they engage in a FRI protocol for polynomials of degree at most for . Then they engage in the point checks for . Here, for each challenge , the prover uses one authentication path for to reveal and use one authentication path for to batch reveal values . Successful point checks here mean that . We need the same configuration parameters as before: , with , a vector . As described earlier, to commit to a single polynomial , a Merkle tree is built over the vector . When committing to a batch of polynomials , the leaves of the Merkle tree are instead the concatenation of the polynomial evaluations. That is, in the batch setting, the Merkle tree is built for the vector
+
+The commitment is the root of this Merkle tree. This reduces the proof size: we only need one Merkle tree for polynomials. The verifier can then only ask for values in batches. When the verifier chooses an index , the prover sends along with one authentication path. The verifier on his side computes the concatenation and validates it with the authentication path and . This also reduces the computational time. By traversing the Merkle tree one time, it can reveal several components simultaneously. The batch open protocol proceeds similarly to the case of a single polynomial. The verifier sends evaluations points to the prover at which they wish to know the value of . The prover will try to convince the verifier that the committed polynomials , evaluate to some values . There is a generalization of the variant of FRI where the function takes more parameters, and in this case is
+Where are challenges provided by the verifier. Then FRI return Accept if and only if the vector
+is close to the vector of evaluations of a polynomial of degree at most . If this is the case, the verifier accepts the openings. In the context of STARKs, the polynomial is called the DEEP composition polynomial. This is equivalent to running the open protocol times, one for each term and . Note that this optimization makes a huge difference, as we only need to run the FRI protocol once instead of running it once for each polynomial. There is an optimization for the open protocol to avoid running FRI to check that is of degree at most . The idea is as follows. Part of FRI protocol for , to check that it is of degree at most , involves revealing values of at other random points also chosen by the verifier. These are part of the internal workings of FRI. These challenges are unrelated to what we mentioned before. So if one removes the FRI check for , the point checks of the open protocol need to be performed on these challenges of the FRI protocol for . This optimization is included in the formal description of the protocol. The protocol is split into rounds. Each round more or less represents an interaction with the verifier. Each round will generally start by getting a challenge from the verifier. The prover will need to interpolate polynomials, and he will always do it over the set , where is a root of unity in . Also, the vector commitments will be performed over the set where is a root of unity and is some field element. This is the set we denoted in the commitment scheme section. The specific choices for the shapes of these sets are motivated by optimizations at a code level. The protocol is split into rounds. Each round more or less represents an interaction with the verifier. Each round will generally start by getting a challenge from the verifier. The prover will need to interpolate polynomials, and he will always do it over the set , where is a root of unity in . Also, the vector commitments will be performed over the set where is a root of unity and is some field element. This is the set we denoted in the commitment scheme section. In round 1, the prover commits to the columns of the trace . He does so by interpolating each column and obtaining univariate polynomials .
Then the prover commits to over . In this way, we have .
@@ -1278,9 +1273,9 @@ Protocol
Arithmetization
Vector commitments
FRI
-
+
+Variant useful for STARKs
+Polynomial commitments
-
-Commit
Open
-
+Completeness
+Soundness
-Case
-Case
-General case: the blowup factor
-Batch
Optimize the open protocol reusing FRI internal challenges
-References
-
High-level description of the protocol
-Round 1: Arithmetization and commitment of the execution trace
will be a polynomial if and only if is a trace that satisfies all the transition and boundary constraints.
. This function will have the property that it is a polynomial if and only if the trace that the prover committed to at round 1 is valid and satisfies the agreed polynomial constraints. That is,
Note that we can compose the polynomials , the ones that interpolate the columns of the trace , with the multivariate constraint polynomials as follows. -These result in univariate polynomials. And the same can be done for the boundary constraints. Since , these univariate polynomials vanish at every element of if and only if the trace is valid.
+These result in univariate polynomials. The same can be done for the boundary constraints. Since , these univariate polynomials vanish at every element of if and only if the trace is valid.As we already mentioned, this is assuming that transitions only depend on the current and previous state. But it can be generalized to include frames with three or more rows or more context for each constraint. For example, in the Fibonacci case, the most natural way is to encode it as one transition constraint that depends on a row and the two preceding it, as we already did in the Recap section. The STARK protocol checks whether the function is a polynomial instead of checking that the polynomial is zero over the domain . The two statements are equivalent.
-The verifier could check that all are polynomials one by one, and the same for the polynomials coming from the boundary constraints. But this is inefficient; the same can be obtained with a single polynomial. To do this, the prover samples challenges and obtains a random linear combination of these polynomials. The result of this is denoted by and is called the composition polynomial. It integrates all the constraints by adding them up. So after computing , the prover commits to it and sends the commitment to the verifier. The rest of the protocol aims to prove that was constructed correctly and is a polynomial, which can only be true if the prover has a valid extension of the original trace.
+The verifier could check that all are polynomials one by one, and the same for the polynomials coming from the boundary constraints. However, this is inefficient; the same can be obtained with a single polynomial. To do this, the prover samples challenges and obtains a random linear combination of these polynomials. The result of this is denoted by and is called the composition polynomial. It integrates all the constraints by adding them up. So after computing , the prover commits to it and sends the commitment to the verifier. The rest of the protocol aims to prove that was constructed correctly and is a polynomial, which can only be true if the prover has a valid extension of the original trace.
The verifier must check that was constructed according to the protocol rules. That is, has to be a linear combination of all the functions and similar terms for the boundary constraints. To do so, in round 3 the verifier chooses a random point and the prover computes , and for all . With all these, the verifier can check that and the expected linear combination coincide, at least when evaluated at . Since was chosen randomly, this proves with overwhelming probability that was properly constructed.
In this section we describe precisely the STARKs protocol used in Lambdaworks.
We begin with some additional considerations and notation for most of the relevant objects and values to refer to them later on.
-This is a technique to increase the soundness of the protocol by adding proof of work. It works as follows. At some fixed point in the protocol, the verifier sends a challenge to the prover. The prover needs to find a string such that begins with a predefined number of zeroes. Here denotes the concatenation of and , seen as bit strings. -The number of zeroes is called the grinding factor. The hash function can be any hash function, independent of other hash functions used in the rest of the protocol. In Lambdaworks we use Keccak256.
The Fiat-Shamir heuristic is used to make the protocol noninteractive. We assume there is a transcript object to which values can be added and from which challenges can be sampled.
+This is a technique to increase the soundness of the protocol by adding proof of work. It works as follows. At some fixed point in the protocol, a value is derived in a deterministic way from all the interactions between the prover and the verifier up to that point (the state of the transcript). The prover needs to find a string such that begins with a predefined number of zeroes. Here denotes the concatenation of and , seen as bit strings. +The number of zeroes is called the grinding factor. The hash function can be any hash function, independent of other hash functions used in the rest of the protocol. In Lambdaworks we use Keccak256.
Given a vector . The operation returns the root of the Merkle tree that has the hash of the elements of as leaves.
-For , the operation returns and the authentication path to the Merkle tree root.
+For , the operation returns the pair , where is the authentication path to the Merkle tree root.
The operation returns Accept or Reject depending on whether the -th element of is . It checks whether the authentication path is compatible with , and the Merkle tree root .
In our cases the sets will be of the form for some elements . It will be convenient to use the following abuse of notation. We will write to mean . Similarly, we will write instead of . Note that this is only notation and is only checking that the is the -th element of the commited vector.
+As we mentioned in the protocol overview. When committing to multiple vectors , where one can build a single Merkle tree. Its -th leaf is the concatenation of all the -th coordinates of all vectors, that is, . The commitment to this batch of vectors is the root of this Merkle tree.
From the point of view of the verifier, the proof they receive is a bunch of values that may or may not be what they claim to be. To make this explicit, we avoid denoting values like as such, because that implicitly assumes that the value was obtained after evaluating a polynomial at . And that's something the verifier can't assume. We use the following convention.
+
This is the proof using the notation described above. The elements appear in the same exact order as they are in the Prover section, serving also as a complete reference of the meaning of each value.
+
To build the composition the prover samples challenges and for and . A variant of this is sampling a single challenge and defining and as powers of . That is, define for and for .
+The same variant applies for the challenges for used to build the deep composition polynomial. In this case the variant samples a single challenge and defines , for all , and .
+Inversions of finite field elements are slow. There is a very well known trick to batch invert many elements at once replacing inversions by multiplications. See here for the algorithm.
+One of the most computationally intensive operations performed is polynomial division. These can be optimized by utilizing Fast Fourier Transform (FFT) to divide each field element in Lagrange form.
+In specific scenarios, such as dividing by a polynomial of the form , for example when building the deep composition polynomial, Ruffini's rule can be employed to further enhance performance.
+As one can see from inspecting the protocol, there are multiple times where, for a polynomial , the prover sends both openings and . This implies, a priori, sending two authentication paths. Domains can be indexed using bit-reverse ordering to reduce this to a single authentication path for both openings, as follows.
+The natural way of building a Merkle tree to commit to a vector , is assigning the value to leaf . If this is the case, the value is at position and the value is at position . This is because equals for the value used in the protocol.
+Instead of this naive approach, a better solution is to assign the value to leaf , where is the bit-reversal permutation. This is the permutation that maps to the index whose binary representation (padded to bits), is the binary representation of but in reverse order. For example, if and , then its binary representation is , which reversed is . Therefore . In the same way and . Check out the wikipedia article. With this ordering of the leaves, if is even, element is at index and is at index . Which means that a single authentication path serves to validate both points simultaneously.
+The prover opens the polynomials of the FRI layers at and for all . Later on, the verifier uses each of those pairs to reconstruct one of the values of the next layer, namely . So there's no need to add the value to the proof, as the verifier reconstructs them. The prover only needs to send the authentication paths for them.
+The protocol is only modified at Step 3 of the verifier as follows. Checking that is skipped. After computing , the verifier uses it to check that is Accept, which proves that is actually , and continues to the next iteration of the loop.
The goal of this section will be to go over the details of the implementation of the proving system. To this end, we will follow the flow the example in the recap
chapter, diving deeper into the code when necessary and explaining how it fits into a more general case.
When evaluating or interpolating a polynomial, if the input (be it coefficients or evaluations) size isn't a power of two then the FFT API will extend it with zero padding until this requirement is met. This is because the library currently only uses a radix-2 FFT algorithm.
Also, right now FFT only supports inputs with a size up to elements.
-Whenever we interpolate or evaluate trace, boundary and constraint polynomials, we use some -th roots of unity. There are a few reasons for this:
In this section we describe precisely the STARKs protocol used in Lambdaworks.
We begin with some additional considerations and notation for most of the relevant objects and values to refer to them later on.
-This is a technique to increase the soundness of the protocol by adding proof of work. It works as follows. At some fixed point in the protocol, the verifier sends a challenge to the prover. The prover needs to find a string such that begins with a predefined number of zeroes. Here denotes the concatenation of and , seen as bit strings. -The number of zeroes is called the grinding factor. The hash function can be any hash function, independent of other hash functions used in the rest of the protocol. In Lambdaworks we use Keccak256.
The Fiat-Shamir heuristic is used to make the protocol noninteractive. We assume there is a transcript object to which values can be added and from which challenges can be sampled.
+This is a technique to increase the soundness of the protocol by adding proof of work. It works as follows. At some fixed point in the protocol, a value is derived in a deterministic way from all the interactions between the prover and the verifier up to that point (the state of the transcript). The prover needs to find a string such that begins with a predefined number of zeroes. Here denotes the concatenation of and , seen as bit strings. +The number of zeroes is called the grinding factor. The hash function can be any hash function, independent of other hash functions used in the rest of the protocol. In Lambdaworks we use Keccak256.
Given a vector . The operation returns the root of the Merkle tree that has the hash of the elements of as leaves.
-For , the operation returns and the authentication path to the Merkle tree root.
+For , the operation returns the pair , where is the authentication path to the Merkle tree root.
The operation returns Accept or Reject depending on whether the -th element of is . It checks whether the authentication path is compatible with , and the Merkle tree root .
In our cases the sets will be of the form for some elements . It will be convenient to use the following abuse of notation. We will write to mean . Similarly, we will write instead of . Note that this is only notation and is only checking that the is the -th element of the commited vector.
+As we mentioned in the protocol overview. When committing to multiple vectors , where one can build a single Merkle tree. Its -th leaf is the concatenation of all the -th coordinates of all vectors, that is, . The commitment to this batch of vectors is the root of this Merkle tree.
From the point of view of the verifier, the proof they receive is a bunch of values that may or may not be what they claim to be. To make this explicit, we avoid denoting values like as such, because that implicitly assumes that the value was obtained after evaluating a polynomial at . And that's something the verifier can't assume. We use the following convention.
+
This is the proof using the notation described above. The elements appear in the same exact order as they are in the Prover section, serving also as a complete reference of the meaning of each value.
+
To build the composition the prover samples challenges and for and . A variant of this is sampling a single challenge and defining and as powers of . That is, define for and for .
+The same variant applies for the challenges for used to build the deep composition polynomial. In this case the variant samples a single challenge and defines , for all , and .
+Inversions of finite field elements are slow. There is a very well known trick to batch invert many elements at once replacing inversions by multiplications. See here for the algorithm.
+One of the most computationally intensive operations performed is polynomial division. These can be optimized by utilizing Fast Fourier Transform (FFT) to divide each field element in Lagrange form.
+In specific scenarios, such as dividing by a polynomial of the form , for example when building the deep composition polynomial, Ruffini's rule can be employed to further enhance performance.
+As one can see from inspecting the protocol, there are multiple times where, for a polynomial , the prover sends both openings and . This implies, a priori, sending two authentication paths. Domains can be indexed using bit-reverse ordering to reduce this to a single authentication path for both openings, as follows.
+The natural way of building a Merkle tree to commit to a vector , is assigning the value to leaf . If this is the case, the value is at position and the value is at position . This is because equals for the value used in the protocol.
+Instead of this naive approach, a better solution is to assign the value to leaf , where is the bit-reversal permutation. This is the permutation that maps to the index whose binary representation (padded to bits), is the binary representation of but in reverse order. For example, if and , then its binary representation is , which reversed is . Therefore . In the same way and . Check out the wikipedia article. With this ordering of the leaves, if is even, element is at index and is at index . Which means that a single authentication path serves to validate both points simultaneously.
+The prover opens the polynomials of the FRI layers at and for all . Later on, the verifier uses each of those pairs to reconstruct one of the values of the next layer, namely . So there's no need to add the value to the proof, as the verifier reconstructs them. The prover only needs to send the authentication paths for them.
+The protocol is only modified at Step 3 of the verifier as follows. Checking that is skipped. After computing , the verifier uses it to check that is Accept, which proves that is actually , and continues to the next iteration of the loop.
diff --git a/starks/protocol_overview.html b/starks/protocol_overview.html index a604b8d09..04989f5c2 100644 --- a/starks/protocol_overview.html +++ b/starks/protocol_overview.html @@ -152,12 +152,12 @@In summary, at a very high level, the STARK protocol can be organized into three major parts:
As the Recap mentions, the trace is a table containing the system's state at every step. In this section, we will denote the trace as . A trace can have several columns to store different aspects or features of a particular state at a specific moment. We will refer to the -th column as . You can think of a trace as a matrix where the entry is the -th element of the -th state.
-Most proving systems' primary tool is polynomials over a finite field . Each column of the trace will be interpreted as evaluations of such a polynomial . Consequently, any information about the states must be encoded somehow as an element in .
+Most proving systems' primary tool is polynomials over a finite field . Each column of the trace will be interpreted as evaluations of such a polynomial . Consequently, any information about the states must be encoded somehow as an element in .
To ease notation, we will assume here and in the protocol that the constraints encoding transition rules depend only on a state and the previous one. Everything can be easily generalized to transitions that depend on many preceding states. Then, constraints can be expressed as multivariate polynomials in variables A transition from state to state will be valid if and only if when we plug row of in the first variables and row in the second variables of , we get for all . In mathematical notation, this is @@ -169,73 +169,68 @@
Given a vector , commiting to means the following. The prover builds a Merkle tree out of it and sends its root to the verifier. The verifier can then ask the prover to reveal, or open, the value of the vector at some index . The prover won't have any choice except to send the correct value. The verifier will expect the corresponding value and the authentication path to the tree's root to check its authenticity. The authentication path also encodes the vector's position and its length .
-In STARKs, all commited vectors are of the form for some polynomial and some domain fixed domain . The domain is always known to the prover and the verifier.
+The root of the Merkle tree is said to be the commitment of , and we denote it here by .
The FRI protocol is a potent tool to prove that the commitment of a vector corresponds to the evaluations of a polynomial of a certain degree. The degree is a configuration of the protocol.
+In STARKs, all commited vectors are of the form for some polynomial and some fixed domain . The domain is always known to the prover and the verifier. It can be proved, as long as is less than the total number of field elements, that every vector is equal to for a unique polynomial of degree at most . This is called the Lagrange interpolation theorem. It means, there is a unique polynomial of degree at most such that for all . And is an upper bound to the degree of . It could be less. For example, the vector of all ones is the evaluation of the constant polynomial , which has degree .
+Suppose the vector is the vector of evaluations of a polynomial of degree strictly less than . Suppose one party holds the vector and another party holds only the commitment of it. The FRI protocol is an efficient interactive protocol with which the former can convince the latter that the commitment they hold corresponds to the vector of evaluations of a polynomial of degree strictly less than .
+More precisely, the protocol depends on the following parameters
+A prover holds a vector , and the verifier holds the commitment of it. The result of the FRI protocol will be Accept if the unique polynomial of degree less than such that has degree less than . Even more precisely, the protocol proves that is very close to a vector with of degree less than , but it may differ in negligible proportion of the coordinates.
+The number is called the blowup factor and the security of the protocol depends in part on this parameter. The specific shape of the domain set has some symmetric properties important for the inner workings of FRI, such as for all .
+FRI is usually described as above. In STARK, FRI is used as a building block for the polynomial commitment scheme of the next section. For that, a small variant of FRI is needed.
+Suppose the prover holds a vector and the verifier holds its commitment as before. Suppose further that both parties know a function that takes two field elements and outputs another field element. For example could be the function . More precisely, the kind of functions we need are .
+The protocol can be used to prove that the transformed vector is the vector of evaluations of a polynomial of degree at most . Note that in this variant, the verifier holds originally the commitment of the vector and not the commitment of the transformed vector. In the example, the verifier holds the commitment and FRI will return Accept if is the vector of evaluations of a polynomial of degree at most .
STARK uses a univariate polynomial commitment scheme. The following is what is expected from the commit and open protocols:
Let's see how both of these protocols work in detail. Some configuration parameters are needed:
+Let's see how both of these protocols work in detail. The same configuration parameters of FRI are needed:
The commitment scheme will only work for polynomials of degree at most . This means anyone can commit to any polynomial, but the Open protocol will pass only for polynomials satisfying that degree bound.
+The commitment scheme will only work for polynomials of degree at most (polynomials of degree are allowed). This means: anyone can commit to any polynomial, but the Open protocol will pass only for polynomials satisfying that degree bound.
Given a polynomial , the commitment is just the commitment of the vector . That is, is the root of the Merkle tree of the vector of evaluations of at .
It is an interactive protocol. So assume there is a prover and a verifier. We describe the process considering an honest prover. In the next section, we analyze what happens for malicious provers.
-The prover holds the polynomial , and the verifier only the commitment of it. There is also an element . The prover evaluates and sends the result to the verifier. As we mentioned, the goal is to generate proof of the validity of the evaluation. Let us denote . This is a value now both the prover and verifier have.
-The protocol has three steps:
-FRI on : First, the prover and the verifier engage in a FRI protocol for polynomials of degree at most to check that is the commitment of such a polynomial. We will assume from now on that the degree of is at most . There is an optimization that completely removes this step—more on that later.
-FRI on : Since , the polynomial can be written as for some polynomial . The prover computes the commitment and sends it to the verifier. Now they engage in a FRI protocol for polynomials of degree at most , which convinces the verifier that is the commitment of a polynomial of degree at most .
-Point checks: From the point of view of the verifier the commitments and are still potentially unrelated. Therefore, there is a check to ensure that was computed properly from following the formula and that is its commitment. To do this, the verifier challenges the prover to open and as vectors. They use the open protocol of the vector commitment scheme to reveal the values and for some random point chosen by the verifier. Next he checks that . They repeat this last part times and, as we'll analyze in the next section, this whole thing will convince the verifier that as polynomials with overwhelming probability (about ). Finally, the verifier deduces that from this equality.
-The prover holds the polynomial , and the verifier only the commitment of it. There is also an element chosen by the verifier. The prover evaluates and sends the result back. As we mentioned, the goal is to generate proof of the validity of the evaluation. Let us denote the value received by the verifier.
+Now they engage in the variant of the FRI protocol for the function . The verifier accepts the value if and only if the result of FRI is Accept.
+Let's see why this makes sense.
+If the prover is honest, is of degree at most and equals . That means that + +for some polynomial . Since is of degree at most , then is of degree at most . The vector is then a vector of evaluations of a polynomial of degree at most . And it is equal to . So the FRI protocol will succeed.
Let's analyze why the open protocol is sound. Keep in mind that the prover always has to provide a commitment of a polynomial of degree at most that satisfies for the chosen values of the verifier. That's the goal. An essential but subtle part of the soundness is that is a vector of length . To understand why let's see what would happen if .
-Suppose the prover tries to cheat the verifier by sending a value different from . This means that is not divisible by as polynomials. But as long as is not in the prover can interpolate the values -at and obtain some polynomial of degree at most . This polynomial satisfies for all , but the equality of polynomials does not hold. Mainly because that would imply that , and we are assuming the opposite case. Nevertheless, if they continue with the open protocol, FRI will pass since is a polynomial of degree at most . All subsequent point checks will pass since was crafted especially for that.
-So how come is different from but has the property that for all ? FRI guarantees is of degree at most , which implies that is of degree at most . Then, since is of degree at most , the difference is again of degree at most . A polynomial of degree at most is zero if and only if we can prove that for distinct points. But the construction of only shows that for all , a set of points. It's not enough. One extra point and the equality would hold. Of course, that point doesn't exist, again, because that would imply that , which we assume is not true.
-Let's see one more example where we double the de size of but keep the same bound for the degree of the polynomials. So polynomials are of degree at most , and the length of is .
-Again let's assume the prover wants to cheat the verifier similarly and claims that is but, in reality, . Inevitably, for the Open protocol to succeed, the prover has to send a commitment of some polynomial of degree at most . The strategy of the prover is pretty much constrained to be the same. But now he can't interpolate as before in every element of because that would produce a polynomial of degree at most . This most likely won't pass the FRI check.
-Alternatively, he can choose some subset of of size and interpolate only there to get a polynomial of degree at most . That will succeed in the FRI phase, but what happens with the point checks? The check will pass if the verifier chooses a challenge that belongs to . If , then the check will inevitably fail. This is because, as we saw in the previous case, one extra successful point to the already points where was interpolated was enough to prove that , which we assume now not to hold. This means, if , then does not coincide with and the point check fails. So if the verifier chooses the challenges following a uniform distribution, the chances of the prover being caught cheating are for only one challenge. If the verifier performs challenges, then the chance of the prover not getting caught is .
-If the ratio between and is , then challenges give of probability for a malicious prover to succeed. If the ratio is , that is, if , then that probability is for the same number of point checks. This provides another way of improving the soundness error. The larger the ratio, the more complex it is to cheat in the open protocol. This ratio is what's called the blowup factor. It is a security parameter, and finding a balance between the number of challenges and the size of is part of the configuration of the protocol. Increasing the size of makes committing an expensive operation since it involves building a Merkle tree with a vector of the size of . But increasing the number of challenges makes the size of the final proof larger.
-We denote the blowup factor by , and it's always assumed to be a power of .
+Let's sketch an idea of the soundness. Note that the value is chosen by the verifier after receiving the commitment of . So the prover does not know in advance, at the moment of sending , what will be.
+Suppose the prover is trying to cheat and sends the commitment of a vector that's not the vector of evaluations of a polynomial of degree at most . Then the coordinates of the transformed vector are . Since was chosen by the verifier, dividing by shuffles all the elements in a very unpredictable way for the prover. So it is extremely unlikely that the cheating prover can craft an invalid vector such that the transformed vector turns out to be of degree at most . The expected degree of the polynomial associated with a random vector is .
During proof generation, polynomials are committed and opened several times. Computing these for each polynomial independently is costly. In this section, we'll see how batching polynomials can reduce the amount of computation. Let be a set of polynomials. We will commit and open as a whole. We note this batch commitment as .
-We need the same configuration parameters as before: , with , a vector and .
-As described earlier, to commit to a single polynomial , a Merkle tree is built over the vector . When committing to a batch of polynomials , the leaves of the Merkle tree are instead the concatenation of the polynomial evaluations. That is, in the batch setting, the Merkle tree is built for the vector . The commitment is the root of this Merkle tree. This reduces the proof size: we only need one Merkle tree for polynomials. The verifier can then only ask for values in batches. When the verifier chooses an index , the prover sends along with one authentication path. The verifier on his side computes the concatenation and validates it with the authentication path and . This also reduces the computational time. By traversing the Merkle tree one time, it can reveal several components simultaneously.
-The batch open protocol proceeds similarly to the case of a single polynomial. The prover will try to convince the verifier that the committed polynomials at evaluate to some values . In the batch case, the prover will construct the following polynomial:
--
Where are challenges provided by the verifier. The prover commits to and sends to the verifier. Then the prover and verifier continue similarly to the normal open protocol for only. This means they engage in a FRI protocol for polynomials of degree at most for . Then they engage in the point checks for . Here, for each challenge , the prover uses one authentication path for to reveal and use one authentication path for to batch reveal values . Successful point checks here mean that .
+We need the same configuration parameters as before: , with , a vector .
+As described earlier, to commit to a single polynomial , a Merkle tree is built over the vector . When committing to a batch of polynomials , the leaves of the Merkle tree are instead the concatenation of the polynomial evaluations. That is, in the batch setting, the Merkle tree is built for the vector + +The commitment is the root of this Merkle tree. This reduces the proof size: we only need one Merkle tree for polynomials. The verifier can then only ask for values in batches. When the verifier chooses an index , the prover sends along with one authentication path. The verifier on his side computes the concatenation and validates it with the authentication path and . This also reduces the computational time. By traversing the Merkle tree one time, it can reveal several components simultaneously.
+The batch open protocol proceeds similarly to the case of a single polynomial. The verifier sends evaluations points to the prover at which they wish to know the value of . The prover will try to convince the verifier that the committed polynomials , evaluate to some values . There is a generalization of the variant of FRI where the function takes more parameters, and in this case is +Where are challenges provided by the verifier. Then FRI return Accept if and only if the vector +is close to the vector of evaluations of a polynomial of degree at most . If this is the case, the verifier accepts the openings. In the context of STARKs, the polynomial is called the DEEP composition polynomial.
This is equivalent to running the open protocol times, one for each term and . Note that this optimization makes a huge difference, as we only need to run the FRI protocol once instead of running it once for each polynomial.
-There is an optimization for the open protocol to avoid running FRI to check that is of degree at most . The idea is as follows. Part of FRI protocol for , to check that it is of degree at most , involves revealing values of at other random points also chosen by the verifier. These are part of the internal workings of FRI. These challenges are unrelated to what we mentioned before. So if one removes the FRI check for , the point checks of the open protocol need to be performed on these challenges of the FRI protocol for . This optimization is included in the formal description of the protocol.
The protocol is split into rounds. Each round more or less represents an interaction with the verifier. Each round will generally start by getting a challenge from the verifier.
-The prover will need to interpolate polynomials, and he will always do it over the set , where is a root of unity in . Also, the vector commitments will be performed over the set where is a root of unity and is some field element. This is the set we denoted in the commitment scheme section. The specific choices for the shapes of these sets are motivated by optimizations at a code level.
+The protocol is split into rounds. Each round more or less represents an interaction with the verifier. Each round will generally start by getting a challenge from the verifier.
+The prover will need to interpolate polynomials, and he will always do it over the set , where is a root of unity in . Also, the vector commitments will be performed over the set where is a root of unity and is some field element. This is the set we denoted in the commitment scheme section.
In round 1, the prover commits to the columns of the trace . He does so by interpolating each column and obtaining univariate polynomials . Then the prover commits to over . In this way, we have . @@ -245,9 +240,9 @@
Note that we can compose the polynomials , the ones that interpolate the columns of the trace , with the multivariate constraint polynomials as follows. -These result in univariate polynomials. And the same can be done for the boundary constraints. Since , these univariate polynomials vanish at every element of if and only if the trace is valid.
+These result in univariate polynomials. The same can be done for the boundary constraints. Since , these univariate polynomials vanish at every element of if and only if the trace is valid.As we already mentioned, this is assuming that transitions only depend on the current and previous state. But it can be generalized to include frames with three or more rows or more context for each constraint. For example, in the Fibonacci case, the most natural way is to encode it as one transition constraint that depends on a row and the two preceding it, as we already did in the Recap section. The STARK protocol checks whether the function is a polynomial instead of checking that the polynomial is zero over the domain . The two statements are equivalent.
-The verifier could check that all are polynomials one by one, and the same for the polynomials coming from the boundary constraints. But this is inefficient; the same can be obtained with a single polynomial. To do this, the prover samples challenges and obtains a random linear combination of these polynomials. The result of this is denoted by and is called the composition polynomial. It integrates all the constraints by adding them up. So after computing , the prover commits to it and sends the commitment to the verifier. The rest of the protocol aims to prove that was constructed correctly and is a polynomial, which can only be true if the prover has a valid extension of the original trace.
+The verifier could check that all are polynomials one by one, and the same for the polynomials coming from the boundary constraints. However, this is inefficient; the same can be obtained with a single polynomial. To do this, the prover samples challenges and obtains a random linear combination of these polynomials. The result of this is denoted by and is called the composition polynomial. It integrates all the constraints by adding them up. So after computing , the prover commits to it and sends the commitment to the verifier. The rest of the protocol aims to prove that was constructed correctly and is a polynomial, which can only be true if the prover has a valid extension of the original trace.
The verifier must check that was constructed according to the protocol rules. That is, has to be a linear combination of all the functions and similar terms for the boundary constraints. To do so, in round 3 the verifier chooses a random point and the prover computes , and for all . With all these, the verifier can check that and the expected linear combination coincide, at least when evaluated at . Since was chosen randomly, this proves with overwhelming probability that was properly constructed.