{"id":13619880,"url":"https://github.com/BitVM/rust-bitcoin-m31-or-babybear","last_synced_at":"2025-04-14T18:32:34.723Z","repository":{"id":228122275,"uuid":"772838858","full_name":"BitVM/rust-bitcoin-m31-or-babybear","owner":"BitVM","description":"Arithmetic over the M31 or BabyBear field in Bitcoin Script ","archived":false,"fork":false,"pushed_at":"2024-07-24T09:52:16.000Z","size":48,"stargazers_count":26,"open_issues_count":1,"forks_count":13,"subscribers_count":7,"default_branch":"main","last_synced_at":"2024-11-08T06:39:09.623Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://bitvm.org","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BitVM.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-16T02:53:11.000Z","updated_at":"2024-10-11T02:56:45.000Z","dependencies_parsed_at":"2024-04-24T12:41:22.272Z","dependency_job_id":"e99d7527-ef6c-4921-a436-4007dac7d34f","html_url":"https://github.com/BitVM/rust-bitcoin-m31-or-babybear","commit_stats":null,"previous_names":["l2iterative/rust-bitcoin-m31-or-babybear","bitvm/rust-bitcoin-m31-or-babybear"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BitVM%2Frust-bitcoin-m31-or-babybear","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BitVM%2Frust-bitcoin-m31-or-babybear/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BitVM%2Frust-bitcoin-m31-or-babybear/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BitVM%2Frust-bitcoin-m31-or-babybear/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BitVM","download_url":"https://codeload.github.com/BitVM/rust-bitcoin-m31-or-babybear/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248936942,"owners_count":21186131,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T21:00:49.788Z","updated_at":"2025-04-14T18:32:34.406Z","avatar_url":"https://github.com/BitVM.png","language":"Rust","funding_links":[],"categories":["Libraries"],"sub_categories":["Potential Use Case"],"readme":"## rust-bitcoin-m31-or-babybear\n\nThis repository implements M31 and BabyBear field arithmetic in Bitcoin Script.\n\n### Performance\n\nIn the current implementation, M31 and BabyBear has equivalent performance for the standalone field. \nThe overhead for field extension is slightly different due to the extension polynomial.\n\n- addition: 18 weight units\n- subtraction: 12 weight units\n- multiplication: 1415 weight units\n- multiplication by constant: ~744 weight units (M31), ~738 weight units (BabyBear)\n\nFor the degree-4 extension of BabyBear over x^4 + 11, we have:\n\n- addition: 84 weight units\n- subtraction: 63 weight units\n- multiplication: 13576 weight units\n- multiplication by BabyBear: 4702 weight units\n- multiplication by BabyBear constant: ~2973 weight units\n\nNote that Plonky3 uses x^4 - 11 as the extension polynomial. Here we use the one from RISC Zero, which is more heavily \nused in production, and it is x^4 + 11.\n\nFor the degree-4 extension of M31 using y^2 - 2 - i over the complex field x^2 + 1, we have:\n\n- addition: 84 weight units\n- subtraction: 63 weight units\n- multiplication: 13321 weight units\n- multiplication by M31: 4702 weight units\n- multiplication by M31 constant: ~2981 weight units\n\n### Credits\n\nThanks to [Robin Linus](https://robinlinus.com/) for pointing out an optimization that reduces the multiplication from 1767 to 1736 (`1 OP_ROLL` is \nequivalent to `OP_SWAP`). \n\nThanks to [Shahar Papini](https://twitter.com/PapiniShahar) from Starkware for pointing out that double Karatsuba can improve the performance for QM31, which also works for \nBabyBear4 and reduces the multiplication cost down from 21992 to 16483 for BabyBear4.\n\nA windowing method is used to reduce the multiplication overhead further, making it from 16483 to 14404 for BabyBear4, but it was not as powerful as expected.\n\nThe introduction of a dual form, `v31`, for which `u31 + v31` are more efficient than `u31 + u31` or `v31 + v31`, brings \nthe cost from 1505 to 1415 for BabyBear and from 14404 to 13594 for BabyBear4.\n\nWhen multiplying a degree-4 element with a degree-1 base element, we reuse the bit decomposition, this avoids the redundancy \nof doing the bit decomposition multiple times, from 5660 to 4702. We note that an alternative route is to produce a \nlarger lookup table for the degree-1 base element and share this table between the four subelements in the degree-4 \nelement. But our attempts show that it is slower than this naive approach (which is expected because the naive method \nalready uses a lookup table). \n\nIn case one of the multipliers is a constant, we can have more efficient multiplication using a relaxed NAF representation, \nwhich saves from 1415 down to \\~738 for BabyBear on degree-1 element multiplication in this special case. We use \"\\~\" to \nemphasize that this cost is variable and depends on the constant.\n\nThe BabyBear4's multiplication overhead slightly goes down from 13594 to 13576 because we switched the extension polynomial \ninto x^4 + 11 (the one used by RISC Zero) from x^4 - 11 (the one used by Plonky3) as the former is more heavily used in \nproduction. This slightly reduces the cost because multiplication by -11 can be done slightly cheaper than multiplication \nby 11.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FBitVM%2Frust-bitcoin-m31-or-babybear","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FBitVM%2Frust-bitcoin-m31-or-babybear","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FBitVM%2Frust-bitcoin-m31-or-babybear/lists"}