Perf: faster final exponentiation (hard part) for BW6 curves

[yelhousni]

Description

This PR otpimizes the final exponentiation (hard part) of BW6 curves.
Fixes #457.

Todo:

• BW6-761
• BW6-756
• BW6-633

The PR also removes some unnecessary computations in the Miller loop (some cases do not occur given the loopCounters).

Type of change

• New feature (non-breaking change which adds functionality)

How has this been tested?

Existing pairing tests still apply to the new version.

How has this been benchmarked?

• Benchmark A, on Macbook Air M1, 16GB RAM
• BW6-761

benchmark              old ns/op     new ns/op     delta
BenchmarkPairing-8     2592580       2343537       -9.61%

• BW6-756

benchmark              old ns/op     new ns/op     delta
BenchmarkPairing-8     2566568       2353209       -8.31%

• BW6-633

benchmark              old ns/op     new ns/op     delta
BenchmarkPairing-8     1574459       1463099       -7.07%

• Benchmark B, on AWS z1d.large (Intel(R) Xeon(R) Platinum 8151 CPU @ 3.40GHz)
• BW6-761

benchmark              old ns/op     new ns/op     delta
BenchmarkPairing-2     2250893       2099406       -6.73%

• BW6-756

benchmark              old ns/op     new ns/op     delta
BenchmarkPairing-2     2453394       2321157       -5.39%

• BW6-633

benchmark              old ns/op     new ns/op     delta
BenchmarkPairing-2     1579874       1478325       -6.43%

Checklist:

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I did not modify files generated from templates
• golangci-lint does not output errors locally
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[github-actions]

Summary

✅ Passed: 5943
❌ Failed: 0
🚧 Skipped: 5

🚧 Skipped

• TestAppend (github.com/consensys/gnark-crypto/ecc/bn254/fr/tensor-commitment)
• TestAppendSis (github.com/consensys/gnark-crypto/ecc/bn254/fr/tensor-commitment)
• TestCommitmentSis (github.com/consensys/gnark-crypto/ecc/bn254/fr/tensor-commitment)
• TestReference (github.com/consensys/gnark-crypto/ecc/bn254/fr/sis)
• TestLimbDecomposition (github.com/consensys/gnark-crypto/ecc/bn254/fr/sis)

[github-actions]

Summary

✅ Passed: 5943
❌ Failed: 0
🚧 Skipped: 5

🚧 Skipped

• TestReference (github.com/consensys/gnark-crypto/ecc/bn254/fr/sis)
• TestAppend (github.com/consensys/gnark-crypto/ecc/bn254/fr/tensor-commitment)
• TestLimbDecomposition (github.com/consensys/gnark-crypto/ecc/bn254/fr/sis)
• TestAppendSis (github.com/consensys/gnark-crypto/ecc/bn254/fr/tensor-commitment)
• TestCommitmentSis (github.com/consensys/gnark-crypto/ecc/bn254/fr/tensor-commitment)

[ivokub]

LGTM

[ivokub]

LGTM

[yelhousni]

@ivokub I just added BW6-756 and BW6-633 new final exponentiations. For BW6-756 it's the same algorithm as the BW6-761 you reviewed (case t % r % x₀ = 3 in BW6-BLS12 family and algorithm 4.4 from [PhD:Housni22]). It just happens that Expc1 is a Conjugate and Expc2 is the identity map. For BW6-633, it is different (case t % r % x₀ = 0 in BW6-BLS24 family and algorithm 4.5).

[ivokub]

Looks all good to me.

[ivokub]

Looks all good to me.