# BLS gas costs For comparison: ECRecover on this laptop averages 48 mgas/s, the KZG precompile averages 40mgas/s. | name | killic (no sg checks) (mgas/s) | gnark (mgas/s) | gnark (no sg checks) (mgas/s) | gas/op | |--|--|--|--|--| | Add G1 | 17-51 | 4.5 | 78-90 | 600 | | Mul G1 | 44-99 | 74 | 74-110 | 12.000 | | MulExp G1 | 38-44 | 37-40 | 120 | 14.400 - 89.400 | | Add G2 | 287 | 25 | 520 | 4500 | | Mul G2 | 129-200 | 172 | 200 | 55.000 | | MulExp G2 | 87 | 115 | 200-250 | 126.060 - 409750 | | Pairing | 85-147 | 68-134 | 90-140 | 138.000 - 345.000 | | fp to G1 | 51 | 80 | 76 | 5500 | | fp to G2 | 430 | 377 | 365 | 110.000 | | G1MulExpWorst | 96 | 29 | 531 | 9.997.344 | | G2MulExpWorst | 147 | 103 | 663 | 9.962.370 | ~~As you can see on above's table, the update to the gnark library severly impacts the performance of the BLS precompiles. Most precompiles are within a reasonable range, only a few stand out. ~~The multiplication on G2 and multi-exponentiation on G2 are a bit overpriced. Even the worst case for G2 mulexp is still almost twice as fast as the ecrecover benchmarks. They could from my point of view be repriced a bit. I don't know if the worst possible cases are covered by the benchmark though. ~~The G1 multiplication is slightly underpriced in the worst case. I would recommend a modest increase in gas price. ~~The G1 addition is severly underpriced. The kilic implementation seems to use an optimisation to do the subgroup check on the G1 points. This optimisation has not been proven mathematically, so the gnark maintainers refuse (rightfully imo) to add this optimization to their code. The G1 addition currently costs 600 gas, while the multiplication costs 12.000 gas. I would propose a gas increase of 10x to 6000 gas per G1 addition. Changing the gas resulted in a speed of 39-45 mgas/s, so exactly what we are aiming for. ~~It would be good to know if our benchmarks really capture the worst cases of these operations. The libraries seem not to be constant time, the bounds for gnark are definitely lower than for kilic though. Edit: after talking to Alex Stokes and Antonio Sanso, we might be able to get rid of the subgroup checks for all operations except the pairing.* Edit2: added the gas costs after getting rid of the subgroup checks for all operations except for the pairing. # Appendix ## Test commands ``` go test --bench ECRecover -timeout 2h -count 5 | tee ecrecover.test go test --bench BLS -timeout 2h -count 5 | tee kilic.test go test --bench BLS -timeout 2h -count 5 | tee gnark.test benchstat kilic.test gnark.test > improvement.test