[moodlezoup]

Summary

• Cyclotomic scaling. ArkGT scaling (Group::scale, ArkFr * ArkGT) now goes through PairingOutput's scalar multiplication, which is arkworks' NAF cyclotomic_exp with Granger–Scott squaring, instead of the generic Fq12::pow.
• PairingCurve::gt_msm. New trait method computing Σ kᵢ·tᵢ in GT. The default implementation scales each term. The BN254 backend overrides it with an interleaved width-5 wNAF multi-exponentiation: all terms share one chain of ~254 cyclotomic squarings, each base gets an 8-entry table of odd powers, and negative digits use conjugation. With parallel, inputs with more than 8 terms split into per-thread chains.
• Verifier. process_round uses gt_msm for C, D₁ and D₂ (4, 3 and 3 terms). The verify_final right-hand side uses it too: 4 terms in transparent mode, 9 in ZK mode, where d²·(A − c₂·D₂_init) is expanded into two terms.

Group results are unchanged, so proofs are byte-identical.

Soundness

Cyclotomic squaring, and conjugation as the inverse, are valid only in the cyclotomic subgroup of Fq12, which contains GT. Every ArkGT the verifier exponentiates is one of:

• a pairing output, or a product of pairing outputs;
• a setup element;
• a proof element, which ArkGT deserialization subgroup-checks (fix: enforce GT subgroup membership in ArkGT deserialization #22).

Impact

Measured as instructions retired under Callgrind, in Jolt's single-threaded verifier (fib, trace length 2^16), counting only DoryScheme::verify:

dory-pcs	DoryScheme::verify
0.4.2 (Fq12::pow)	839.9 M
cyclotomic scaling only	577.3 M (−31%)
this PR (cyclotomic scaling + gt_msm)	362.9 M (−57%)

Per-operation cost with full 254-bit scalars (Callgrind):

Operation	Instructions
Fq12::pow	8.10 M
cyclotomic_exp	5.02 M
gt_msm, 3 terms	6.68 M (vs 15.1 M as 3 cyclotomic scalings)
gt_msm, 4 terms	8.06 M (vs 20.1 M)
gt_msm, 41 terms	59.2 M (vs 205.8 M)

Testing

• New test. gt_msm_matches_naive compares gt_msm against per-term scale for 3, 5 and 40 terms; 40 terms exercises the parallel split. The inputs include an identity base, a zero scalar and a −1 scalar, and an empty-input case.
• Local CI run. All of these passed locally:
  • cargo fmt --check;
  • clippy with -D warnings for transparent, zk and --no-default-features;
  • cargo doc with -D warnings;
  • nextest for both feature sets (86/86 and 143/143);
  • every CI example, including zk_statistical.
• Downstream. perf(dory): cyclotomic GT exponentiation and GT multi-exponentiation jolt#2174 pins this commit. Jolt's clear and ZK guest matrices (10/10 each), the verifier fixtures and the jolt-dory/jolt-crypto suites pass against it.

🤖 Generated with Claude Code