# About the endomorphism-based optimization in halo **URL:** \ **Category:** Technology\ **Created:** [July 1, 2021, 5:56am UTC](https://forum.zcashcommunity.com/t/about-the-endomorphism-based-optimization-in-halo/39528 "2021-07-01T05:56:48Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![valuka](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/valuka/32/18303_2.png) [@valuka](https://forum.zcashcommunity.com/u/valuka)\ **Post date:** [July 1, 2021, 5:56am UTC](https://forum.zcashcommunity.com/t/about-the-endomorphism-based-optimization-in-halo/39528/1 "2021-07-01T05:56:48Z")
Halo has this endomorphism-based optimization which nearly halves the number of constraints in scalar multiplication [r]G for a challenge r, and it is used to aggregate a bunch of polynomial commitments into one, as C = \sum\_i^m [r^i] C\_i. But to aggregate the corresponding openings, instead of v = \sum\_i^m z^i \* v\_i and then one single scalar multiplication V = [v]G, with endomorphism we have to do more scalar multiplication V\_i = [v\_i]G and then V = \sum\_i^m [r^i]V\_i, and hence the total number of scalar multiplications doubles… In this case, how does endomorphism help to the number of constraints? Hope someone may clarify this for me, thanks! ---
**Author:** ![ebfull](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/ebfull/32/34_2.png) [@ebfull](https://forum.zcashcommunity.com/u/ebfull)\ **Post date:** [July 1, 2021, 5:58pm UTC](https://forum.zcashcommunity.com/t/about-the-endomorphism-based-optimization-in-halo/39528/3 "2021-07-01T17:58:57Z")
When needing to compute a scalar multiplication where the scalar is some function of the challenges, like you indicate, the “endoscaling” algorithm is no longer helpful in the circuit; you need to compute the “effective” scalar that each challenge maps to in the field’s challenge space, which you can do by following a version of the same algorithm where instead of multiplying or doubling group elements you’re multiplying scalars. Then you can compute the scalar, and do an arbitrary-scalar multiplication of the group element. It turns out that in Halo-like protocols, very rarely do you need to do the arbitrary-scalar multiplication. It only happens in, I think, two or three circumstances in the inner product argument. And you can defer computing these particular scalars to outside the circuit or, in 2-cycle recursion, to the other field where they are more efficient to evaluate. You can launder the result of the computation through public inputs. ---
**Author:** ![valuka](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/valuka/32/18303_2.png) [@valuka](https://forum.zcashcommunity.com/u/valuka)\ **Post date:** [July 2, 2021, 9:28am UTC](https://forum.zcashcommunity.com/t/about-the-endomorphism-based-optimization-in-halo/39528/4 "2021-07-02T09:28:44Z")
I think I get what you’re saying. Thank you very much for the reply!