Apple Silicon Zero-Knowledge Proving: Mobile Halo2 and Tachyon Acceleration on M-Series and A-Series Chips

[strahncryptography]

Hey folks! Strahn here.

You probably have seen (or not seen) We just achieved a double speedup over the SoTA (pasta_curves) for batched same-base MSM for Halo2 on Apple Silicon! - #3 by strahncryptography , where we achieved a 2x (or rather, 1.5x-1.8x speedup after some memory corruption bugs) over SoTA pasta_curves multiexp prover on 4 threads.

We wish to expand this performance across the ecosystem, and are requesting for a grant to integrate FUJI into Orchard and Tachyon provers for Macs, and most importantly, as proven in the Mac implementation, speedups are possible and will be implemented in iPhones and iPads! (they share ARM architecture thanks to Apple’s craziness for it)

Apple holds a dominating market share in the US (and many other countries) for mobile devices, and what makes it even so much better is that since the Apple ecosystem is surprisingly homogenous, we only have to implement for the M1, M2, M3 chips (Mac) and A14-A17 chips on iPhone to achieve a dominant speedup at the assembly level!

This is not achievable in Windows or Android, since the processor chipsets vary WILDLY.

I hope this grant request is well-received!

Grant Application - Apple Silicon Zero-Knowledge Proving: Mobile Halo2 and Tachyon Acceleration on M-Series and A-Series Chips

[strahncryptography]

God this is petty. I usually don’t see… what is it, Claude? Actually, let me see, the em-dashes… Definitely not ChatGPT, probably Claude. Then again I haven’t used ChatGPT in a long time.

“Before committing $62,000, could the team provide a pinned commit, complete correctness tests across scalar edge cases, reproducible A-series benchmarks, and independent technical validation of the claimed improvement? A high commit count or hours worked is not a substitute for correctness or independent reproducibility in cryptographic software.”

My, my, let us see…

We fixed the corruption bug like 2 full days ago, and announced it on X yesterday. If you bothered to click the FUJI link, you would see:

“First, the proposal repeatedly describes the deliverable as accelerated “mobile Halo2 proving” that could increase shielded Zcash transactions. However, the acceptance criteria measure only the performance of the MSM or SrsContext::commitBatch component.” 255-bit Pasta MSMs are the most taxing part of both Orchard and the future Tachyon provers. By accelerating MSMs themselves, our project is protocol-agnostic as long as Pasta is used. What do you say about it, Claude? I am sure you are aware that MSMs make up 70% of the Orchard proving time, and ~95% of the Tachyon proving time?

But you go on, genius!

[strahncryptography]

But I am not asking for a grant to MAYBE do something, am I? I am not asking Zcash to give me money for a project that I may or may not do in the future. My major project is already done. The performance gains are already delivered on Mac.

[cavalla]

i don’t understand why you are bing so bitter. Some humanities dude found flaws in you application and that makes you freak out?

For the public goods, i will keep professional and keeping the comment on your project, you can find my feedback in the following:

Your response does, however, provide a useful new claim: that MSM accounts for approximately 70% of Orchard proving time and 95% of Tachyon proving time.

If those figures are reproducible, they should be included in the proposal together with the relevant implementation, device, circuit size, benchmark method, and pinned commit. Under Amdahl’s law, a 1.5× MSM speedup would imply approximately a 1.30× end-to-end Orchard speedup—not a 1.5× proving speedup. That is potentially valuable, but it is precisely why the acceptance criteria should measure end-to-end proving rather than only the optimized component.

“Protocol-agnostic” also does not answer the Zcash-specific deliverable question. It makes the library potentially reusable wherever Pasta-curve MSMs are used; it does not demonstrate integration into Orchard, transaction-creation improvements in an existing wallet, or adoption by a wallet maintainer.

If the corruption bug has been fixed, please provide the pinned corrected commit, the added regression tests, and independently reproducible results. That would answer the concern more effectively than speculation about who drafted the question.

The remaining questions concerning wallet integration, independent security validation, the use of 130 million iPhones as an addressable-market proxy, and the budget discrepancies also remain unanswered.

[strahncryptography]

“i don’t understand why you are bing so bitter. Some humanities dude found flaws in you application and that makes you freak out?” My, my, the cope. I am just as acrid as when I was reviewing your application, but sure, make yourself feel better that way. Also, hi, Claude!

“If those figures are reproducible, they should be included in the proposal together with the relevant implementation, device, circuit size, benchmark method, and pinned commit. Under Amdahl’s law, a 1.5× MSM speedup would imply approximately a 1.30× end-to-end Orchard speedup—not a 1.5× proving speedup. That is potentially valuable, but it is precisely why the acceptance criteria should measure end-to-end proving rather than only the optimized component.” First, it’s a 2x MSM speedup. Read the figures I sent you. Wait, you didn’t? Could it be because you are pasting the text and not the image, so the AI missed it? Whoops. Again, if you clicked the “FUJI” link once, you would also see “AMX”. What is AMX, kids? A dedicated hardware accelerator added by Apple to M1-M3 (and later succeeded by SME) whose sole job is to accelerate operations such as NTT…

NTTs make up the other 30% of the proving time… and FUJI implements both AMX and SME.

Not to mention our project is geared towards Tachyon, which is almost completely MSMs (over 95%). Using Amdahl’s law, a 2x speedup on 95% of the proving time is 1.905x the total proving time, is it not?

“If the corruption bug has been fixed, please provide the pinned corrected commit, the added regression tests, and independently reproducible results. That would answer the concern more effectively than speculation about who drafted the question.” It’s on master, but then again, how would the “little bit of software knowledge” know how Git, or for that matter, branches work? Claude, you should be a little bit sensible…

Then again, I’m only being acrid because this is so, so petty. My god.

[strahncryptography]

I have fixed the numbers discrepancy, though. That was embarrassing.