CN115951861A

CN115951861A - MSM optimization method and device under multiple GPUs

Info

Publication number: CN115951861A
Application number: CN202310007035.7A
Authority: CN
Inventors: 李星; 张守恒; 叶经纬
Original assignee: Shanghai Zhiju Information Technology Co ltd
Current assignee: Shanghai Zhiju Information Technology Co ltd
Priority date: 2023-01-03
Filing date: 2023-01-03
Publication date: 2023-04-11

Abstract

The application discloses a method and a device for optimizing MSM (Mobile multimedia Messaging service) under multiple GPUs (graphic processing units), which take the situation that multiple display cards coexist in practical application scenes into consideration, and further enlarge the window size c in an algorithm by utilizing the difference of the multiple display cards and a single display card under the condition that zero knowledge proves that the small circuit scale can use a table look-up method, so as to improve the MSM performance, wherein a formula [ n/c ] is used _orig *N‑n/c _expand *N]/(n/c _orig * N) can calculate the specific value of the performance improvement. By providing the MSM optimization method and device under multiple GPUs, the MSM calculation performance based on the table look-up method can be linearly increased along with the number of display cards, the MSM calculation efficiency is further improved, and a wide space is opened for application and popularization of a zero-knowledge proof protocol in a real scene.

Description

MSM optimization method and device under multiple GPUs

Technical Field

The application relates to the technical field of cryptography, in particular to an MSM optimization method and device under multiple GPUs.

Background

Zero-Knowledge Proof (Zero-Knowledge Proof) refers to a Proof person that can convince a verifier that some argument is correct without providing the verifier with any useful information, which is in fact a cryptographic protocol. Zero knowledge proof is essentially an agreement involving two or more parties, i.e., a series of steps that are required by two or more parties to complete a task. The prover proves and believes to the verifier that he knows or owns a certain message, but the proving process cannot reveal any information about the proven message to the verifier. Zero knowledge proof is very useful in cryptography, as is a number of facts proof. If zero knowledge proof could be used for verification, many problems would be effectively solved.

MSM (Multiple Scale replication) is a way to calculate the commitment of polynomial in the currently popular zero-knowledge proof system, and the calculation formula is:

wherein, P _i Is a point on an elliptic curve, a _i Is scalar, which is an element on the field (which can be simply understood as a large integer that satisfies some condition).

The MSM calculation is essentially the addition of points on a series of elliptic curves, and is characterized in that: the calculation is relatively complex and the calculation amount is large, so the method becomes a main focus for improving the performance of the zero-knowledge proof system.

Referring to fig. 1, the current general algorithm of MSM is the pippenger algorithm, and the principle of the pippenger algorithm is as follows:

step 1: dividing each scalar into windows, namely dividing each bit into a window under the binary representation of the scalar; assuming that the number of bits of scalar is n bits and each c bit is a window, there are k = n/c windows, and each window corresponds to a window size of 2 ^c -an array of 1, namely buckets (buckets);

and 2, step: the barrel is lost;

and step 3: single barrel accumulation;

and 4, step 4: and calculating the result of each barrel to obtain the final result.

To illustrate the principle of the pippenger algorithm more clearly, the above process is demonstrated below with one scalar and one point P as an example:

suppose scalar a =0x12cb =0001001011001011

Step 1: window division, i.e. the number of bits n =16 for scalar, let c =8, then k =16/8=2, i.e. there are two windows, which are noted as:

window_0＝0xcb＝192

window_1＝0x12＝18；

a bucket array is prepared for each window, there are two windows, so there are two bucket arrays, each having (2) ^c -1)＝(2 ⁸ -1) =255 elements, and the bucket corresponding to window _0 is recorded as bucket _0; the bucket corresponding to the window _1 is bucket _1;

and 2, step: the barrel is lost; taking the value in the window as the position, adding P to the corresponding position of the corresponding barrel, and recording as:

window_0＝192->bucket_0[192-1]+＝P

window_1＝16->bucket_1[18-1]+＝P

and step 3: accumulating the barrels; namely, the following accumulation is performed by respectively traversing the packet _0 and the packet _1:

fori＝255to i＝0:

res<-res+bucket_0[i]

sum<-sum+res

the packet _1 is also accumulated, and the accumulation results are sum _0 and sum _1;

window_0->bucket_0->sum_0

window_1->bucket_1->sum_1

and 4, step 4: and solving a final result through double and add.

result＝sum_1*2 ⁸ +sum_0。

When generating the proof, since all points P participating in the calculation _i All are fixed, and the window size c can be determined, so that under the condition that the memory space is enough, the pippenger algorithm can be optimized by using a table look-up method, and the specific principle is as follows:

let the value (position in bucket) represented by each window be s _i Then, the following conclusion is reached:

i∈[0..k],s _i ∈[0..2 ^c -1]

as can be seen from the principle of the pippenger algorithm, the process of bucket loss and bucket accumulation together essentially calculates s _i *P _i The value of (c). Thus in c and P _i All possible s can be determined _i *P _i Precalculation was performed and the results of the resulting table were as follows:

therefore, the algorithm of bucket loss and bucket accumulation in the pippenger algorithm can be combined into one, and the algorithm can be called window accumulation. The analysis from the aspect of the calculation amount is to reduce the calculation amount of the bucket accumulation part in the pippenger algorithm principle, and the rest is consistent.

The MSM is crucial in the zero knowledge proof calculation process, the speed of MSM calculation is related to whether the whole zero knowledge proof protocol can be used, and if the MSM calculation is too slow, the zero knowledge proof protocol cannot be used, so how to improve the MSM calculation efficiency becomes a problem to be urgently solved by the person in the art.

Disclosure of Invention

Therefore, the MSM optimization method and device under multiple GPUs are provided, and the problem that the MSM in the prior art is low in calculation efficiency is solved.

In order to achieve the above purpose, the present application provides the following technical solutions:

in a first aspect, a method for optimizing MSM under multiple GPUs includes:

acquiring MSM source data;

dividing the MSM source data into a plurality of groups, and performing parallel computation based on multiple GPUs by adopting a pippenger algorithm optimized by a table look-up method;

wherein, for all possible S _i *P _i The table formed by precalculation is divided into a plurality of sub-tables, and the same point P is ensured _i All the multiple points are in the same sub-table, so that the calculation window c is increased under the condition of multiple GPUs, and the calculation efficiency of the MSM is improved;

and generating a zero knowledge proof according to the obtained MSM calculation result, and sending the zero knowledge proof to the opposite terminal.

Preferably, said pair is all possibleS _i *P _i The table formed by precalculation is divided into a plurality of sub-tables, and particularly is divided by a first formula;

the first formula is:

wherein, P _i Is a point on the elliptic curve, l = N/m, m being the number of GPUs.

Preferably, when performing parallel computation based on multiple GPUs, the computation formula of the MSM is:

wherein, a _i Is scalar.

Preferably, the window c is increased to:

wherein, c _orig Is the upper limit value of the window size on a single video card, N is the scale of MSM, m is the number of video cards, c _expand The window is expanded in size.

Preferably, the computational efficiency of the MSM is improved as follows:

[n/c _orig *N-n/c _expand *N]/(n/c _orig *N)。

in a second aspect, an MSM optimization apparatus under multiple GPUs includes:

the MSM data acquisition module is used for acquiring MSM source data;

the parallel computing module is used for dividing the MSM source data into a plurality of groups, and performing parallel computing based on multiple GPUs by adopting a pippenger algorithm optimized by a table look-up method;

wherein, for all possible S _i *P _i The table formed by precalculation is divided into a plurality of sub-tables, and the same point P is ensured _i All ofThe multiple points are all in the same sub-table, so that the calculation window c is increased under the condition of multiple GPUs, and the calculation efficiency of the MSM is improved;

and the zero knowledge proof generation module is used for generating a zero knowledge proof according to the obtained MSM calculation result and sending the zero knowledge proof to the opposite terminal.

In a third aspect, a computer device comprises a memory storing a computer program and a processor implementing the steps of the MSM optimization method under multiple GPUs when executing the computer program.

In a fourth aspect, a computer readable storage medium has stored thereon a computer program which, when executed by a processor, performs the steps of MSM optimization under multiple GPUs.

Compared with the prior art, the method has the following beneficial effects that:

the application discloses a method and a device for optimizing MSM (Mobile multimedia Messaging service) under multiple GPUs (graphic processing units), which take the situation that multiple display cards coexist in practical application scenes into consideration, and further enlarge the window size c in an algorithm by utilizing the difference of the multiple display cards and a single display card under the condition that zero knowledge proves that the small circuit scale can use a table look-up method, so as to improve the MSM performance, wherein a formula [ n/c ] is used _orig *N-n/c _expand *N]/(n/c _orig * N) can calculate the specific value of the performance improvement. By providing the MSM optimization method and device under multiple GPUs, the MSM calculation performance based on the table look-up method can be linearly increased along with the number of display cards, the MSM calculation efficiency is further improved, and a wide space is opened for application and popularization of a zero-knowledge proof protocol in a real scene.

Drawings

To more intuitively illustrate the prior art and the present application, several exemplary drawings are given below. It should be understood that the specific shapes, configurations and illustrations in the drawings are not to be construed as limiting, in general, the practice of the present application; for example, it is within the ability of those skilled in the art to make routine adjustments or further optimizations based on the technical concepts disclosed in the present application and the exemplary drawings, for the increase/decrease/attribution of certain units (components), specific shapes, positional relationships, connection manners, dimensional ratios, and the like.

FIG. 1 is a schematic diagram of the general algorithm pippenger algorithm of MSM in the prior art;

fig. 2 is a schematic diagram of the GPU pippenger algorithm principle provided in the present application;

fig. 3 is a flowchart of an optimization method of MSM under multiple GPUs according to an embodiment of the present disclosure.

Detailed Description

The present application will be described in further detail below with reference to specific embodiments thereof, with reference to the accompanying drawings.

In the description of the present application: "plurality" means two or more unless otherwise specified. The terms "first", "second", "third", and the like in this application are intended to distinguish one referenced item from another without having a special meaning in technical connotation (e.g., should not be construed as emphasizing a degree or order of importance, etc.). The terms "comprising," "including," "having," and the like, are intended to be inclusive and mean "not limited to" (some elements, components, materials, steps, etc.).

In the present application, terms such as "upper", "lower", "left", "right", "middle", and the like are generally used for easy visual understanding with reference to the drawings, and are not intended to absolutely limit the positional relationship in an actual product. Changes in these relative positional relationships are also considered to be within the scope of the present disclosure without departing from the technical concepts disclosed in the present disclosure.

1. Implementation of pippenger algorithm on GPU

Referring to fig. 2, since the GPU has a plurality of computing units, in order to utilize this feature of the GPU, the data is divided into a plurality of groups (groups) to facilitate parallel computing.

As shown in fig. 2, the application of the MSM general algorithm pippenger to the GPU (abbreviated as GPU pippenger) is basically the same as the pippenger, and the difference is:

the number of the barrels is increased; the number of the buckets is increased from one for each original window to one for each window, and each group is one;

(II) the number of accumulated barrels is increased;

and (III) when the final result is calculated, adding the results of all groups.

2. Analysis of the calculated amount of the GPU pippenger algorithm (so-called analysis of the calculated amount, which is the number of point additions made by MSM):

let the scale of MSM be N, the number of bits per scalar be N, the window size (number of bits per window) be c, and the number of windows be k = N/c.

Determining the number of groups: if the core number of the GPU is core _ count, and a constant is taken as batch _ size, then:

group_num＝batch_size*core_count/k

＝batch_size*core_count*c/n

step 1: the barrel is lost;

one addition per window, so there are k additions to one scalar, for a total of N scalars, so the total number of additions is: k N = N/c N;

step 2: accumulating the barrels;

one cycle per bucket, 2 additions per single cycle, for a total of 2 ^c 1 cycle, for a total of k × group _ num buckets, so the cumulative number of additions for the bucket is:

(k*group_num)*2*(2 ^c -1)＝batch_size*core_count*2*(2 ^c -1)

and step 3: obtaining a result;

the calculated amount is as follows: and d and double operation of k × group _ num of the sum, wherein the calculated amount is fixed.

3. Lookup table applicable scenario analysis

The principle of optimizing the pippenger algorithm by using the table look-up method is known, the table look-up method is a calculation for reducing the bucket accumulation part, so the following proportions are considered:

from equation (3), the smaller r is, the smaller the performance improvement by the table lookup method is, and the larger r is. It can also be derived that (batch size core count/n) is constant for a particular display card and scalar, that is, the larger c, the greater the effect of the look-up table. However, due to the limitation of video memory, the size of the table is actually limited, i.e., c is limited.

When the problem size N is large (e.g., N = 2) ²⁸ ) R may be small (e.g., 1% or less), i.e., the look-up table has little effect on performance improvement. The table lookup method works well for smaller problem sizes, i.e., small-scale circuits.

Based on the above three point analysis, the calculation amount in the case of using the table lookup method in the small-scale circuit is N/c × N. It can be seen that the larger c, the smaller the calculation amount, so in practice, the window size c is always increased as much as possible to achieve the purpose of reducing the calculation amount. However, as can be seen from the table shown in the principle of optimizing the pippenger algorithm by the table lookup method, the table size is doubled every time c is increased by one bit (i.e. one bit), and the occupied video memory space is doubled, so that c has an upper limit for a single video card. Meanwhile, in consideration of the situation that a plurality of display cards coexist in an actual application scene, the method for further expanding c for the plurality of display cards to further improve the MSM performance under the condition that zero knowledge proves the scale of a small circuit is provided.

Example one

Referring to fig. 3, the present embodiment provides a method for optimizing MSM under multiple GPUs, including:

s1: acquiring MSM source data;

s2: dividing MSM source data into a plurality of groups, and performing parallel computation based on multiple GPUs by adopting a pippenger algorithm optimized by a table look-up method;

wherein, for all possible S _i *P _i The table formed by precalculation is divided into a plurality of sub-tables, and the same point P is ensured _i All the multiple points of (A) are in the same sublist, i.e.

All in the same table, thereby increasing the calculation window c under the condition of multiple GPUs and further promoting MThe computational efficiency of the SM; />

S3: and generating a zero knowledge proof according to the obtained MSM calculation result, and sending the zero knowledge proof to the opposite terminal.

In particular, in the case of all possible S _i *P _i The table formed by precalculation is divided into a plurality of sub-tables, in particular, table (2) in the background art is divided into m tables with the same size (assuming m | N, the condition is usually satisfied in practice).

The table after division is shown in table (4).

Specifically, when parallel computation is performed based on multiple GPUs, the computation formula of the MSM is as follows:

the formula (5) is obtained by dividing the formula (1) in the background art, wherein a _i Is scalar.

As can be seen from tables (4) and (5), each video card stores only 1/m of the size of the original table. At this time, although the calculation amount of the MSM is hardly changed (only m times of addition is added), the video memory of each video card is only 1/m of the original video memory, so that a space is opened for enlarging the window c.

Since the table shrinks to 1/m, the window c increases to:

It should be noted that when the display cards are sharedWhen m pieces of video are displayed, the window size c on a single video card of the model reaches the upper limit, namely c _orig . It is to be noted that "reaching the upper limit" here is not in the mathematical sense, but in the practical sense, that is to say when c = c _orig At +1, the video memory cannot be loaded.

Note that the last "approximately equal" in equation (6) is acceptable in practice. This is because, when c _expand ＝c _orig +log ₂ (m), the occupied video memory is:

(2 ^expand -1)*N/m＝(2 ^orig *m-1)*N/m＝2 ^orig *N-N/m (7)

and it follows that the window size is extended by one bit, the size of the table is doubled. So equation (7) occupies a memory size difference compared to directly extending one bit on a single card:

this indicates that, in practice, "approximately equal" in the formula (6) can be achieved.

In summary, the metric for improving performance is the reduction of the number of additions, so the computation efficiency of MSM is improved as follows:

[n/c _orig *N-n/c _expand *N]/(n/c _orig *N)＝1-c _orig /c _expand (9)

in summary, the embodiment realizes the improvement of the MSM performance by a plurality of video cards under the condition of a small-scale circuit in the zero-knowledge proof, and provides a specific value for improving the performance of the method.

By providing the MSM optimization method under multiple GPUs, the MSM calculation performance based on the table look-up method can be linearly increased along with the number of display cards, the MSM calculation efficiency is further improved, and a wide space is opened for application and popularization of a zero-knowledge proof protocol in a real scene.

Example two

The embodiment provides an MSM optimization device under multiple GPUs, which comprises:

the MSM data acquisition module is used for acquiring MSM source data;

wherein, for all possible S _i *P _i The table formed by precomputation is divided into a plurality of sub-tables to ensure the same point P _i All the multiple points are in the same sub-table, so that the calculation window c is enlarged under the condition of multiple GPUs, and the calculation efficiency of the MSM is improved;

For specific definition of an MSM optimization device under multiple GPUs, refer to the above definition of an MSM optimization method under multiple GPUs, which is not described herein again.

EXAMPLE III

The embodiment provides a computer device, which comprises a memory and a processor, wherein the memory stores a computer program, and the processor realizes the steps of the optimization method of the MSM under multiple GPUs when executing the computer program.

Example four

The present embodiments provide a computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of MSM optimization under multiple GPUs.

All the technical features of the above embodiments can be arbitrarily combined (as long as there is no contradiction between the combinations of the technical features), and for brevity of description, all the possible combinations of the technical features in the above embodiments are not described; these examples, which are not explicitly described, should be considered to be within the scope of the present description.

The present application has been described in considerable detail with reference to the foregoing general description and specific examples. It should be understood that several conventional adaptations or further innovations of these specific embodiments may also be made based on the technical idea of the present application; however, such conventional modifications and further innovations may also fall within the scope of the claims of the present application as long as they do not depart from the technical idea of the present application.

Claims

1. A method for optimizing MSM under multiple GPUs is characterized by comprising the following steps:

acquiring MSM source data;

wherein, for all possible S _i *P _i The table formed by precomputation is divided into a plurality of sub-tables to ensure the same point P _i All the multiple points are in the same sub-table, so that the calculation window c is increased under the condition of multiple GPUs, and the calculation efficiency of the MSM is improved;

2. The MSM optimization method under multiple GPUs according to claim 1, wherein said pair of all possible S _i *P _i The table formed by precalculation is divided into a plurality of sub-tables, and particularly is divided by a first formula;

the first formula is:

3. The MSM optimization method of claim 2 based on multiple GPUs, wherein the MSM calculation formula is:

wherein, a _i Is scalar.

4. The MSM optimization method under multiple GPUs according to claim 1, wherein the window c is increased as:

5. The MSM optimization method under multiple GPUs according to claim 4, wherein the MSM computational efficiency is improved as follows:

[n/c _orig *N-n/c _expand *N/(n/c _orig *N)。

6. an MSM optimization device under multiple GPUs, comprising:

the MSM data acquisition module is used for acquiring MSM source data;

the parallel computing module is used for dividing the MSM source data into a plurality of groups, adopting a pippenger algorithm optimized by a table look-up method and carrying out parallel computing based on multiple GPUs;

7. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method of any of claims 1 to 5.

8. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 5.