Add EIP-5843: EVM Modular Arithmetic Extensions #5843

jwasinger · 2022-10-27T02:13:14Z

No description provided.

eth-bot · 2022-10-27T02:14:01Z

Hi! I'm a bot, and I wanted to automerge your PR, but couldn't because of the following issue(s):

(fail) eip-5843.md

classification
`newEIPFile`

File with name EIPS/eip-5843.md is new and new files must be reviewed
This PR requires review from one of [@lightclient, @gcolvin, @SamWilsn, @Pandapip1]

EIPS/eip-5843.md

mratsim · 2022-10-29T17:39:02Z

EIPS/eip-5843.md

+
+### `SETMODX`
+
+`SETMODX` takes two stack inputs: `(top of stack) mod_offset, mod_limb_count` where `mod_offset` refers to an EVM memory offset where a modulus represented in `mod_limb_count * 8` bytes with little-endian ordering is expected. If `(mod_offset + mod_limb_count * 8) - 1` falls outside the bounds of allocated memory, consume all call gas and return to the caller in an exceptional state.  Charge `gas_setmodx(mod_limb_count)` return to the caller in an exceptional state if there was insufficient gas remaining:


It is unclear what a limb is here.
Usually on 32-bit platforms it's a 32-bit word, on a 64-bit platform it's a 64-bit word.

Here the * 8 suggests a byte to bit conversion to compute the costs but mod_limb_count * 8 is a number of bytes according to the text.

Furthermore the little-endian ordering is a bit unclear, are we talking about word endianness or limb-endianness (more on that below).

EIPS/eip-5843.md

mratsim · 2022-10-29T17:45:27Z

EIPS/eip-5843.md

+
+#### Conversion between Montgomery and normal forms
+
+Conversion of a normal value to Montgomery form can be computed with `mulmont(norm_val, evmmax_state.r_squared, mod) == norm_val * R % mod`.


Suggested change

Conversion of a normal value to Montgomery form can be computed with `mulmont(norm_val, evmmax_state.r_squared, mod) == norm_val * R % mod`.

Conversion of a canonical value to Montgomery representation can be computed with `mulmont(canon_val, evmmax_state.r_squared, mod) == canon_val * R % mod`.

EIPS/eip-5843.md

mratsim · 2022-10-29T19:36:41Z

EIPS/eip-5843.md

+```
+
+TODO:
+* Some derivation of complexity for extended euclidean (https://www.scaler.com/topics/data-structures/extended-euclidean-algorithm/ claims `O(log(min(x, y))`.


The rational is that at each iteration you divide by 2 the number of bits left to process, hence logarithmic. And you stop as soon as one input reaches 1.

mratsim · 2022-10-29T19:45:52Z

EIPS/eip-5843.md

+    # first two bytes are the mod limb count
+    # mod = mod_params_bytes[2:2 + mod_limb_count * 8]
+    offset += mod_limb_count * 8
+    # mod_inv = mod_params_bytes[offset:offset + elem_size]


This is not needed

Can you elaborate? Are you saying that it should be represented more concisely in the spec?

mod_inv is not needed for Montgomery conversion or compute, only mod_inv_small (the 64-bit value is).

Though if it is wanted I forgot that you can compute in O(log(log(n))) as it is a power of 2, see https://github.com/mratsim/constantine/blob/master/constantine/math/arithmetic/limbs_exgcd.nim#L44-L77

Explanation p11 "Dumas iterations" based on Newton-Raphson:

Cetin Kaya Koc (2017), https://eprint.iacr.org/2017/411

Jean-Guillaume Dumas (2012), https://arxiv.org/pdf/1209.6626v2.pdf

Colin Plumb (1994), http://groups.google.com/groups?selm=1994Apr6.093116.27805%40mnemosyne.cs.du.edu
Other sources:

https://crypto.stackexchange.com/questions/47493/how-to-determine-the-multiplicative-inverse-modulo-64-or-other-power-of-two

https://mumble.net/~campbell/2015/01/21/inverse-mod-power-of-two

http://marc-b-reynolds.github.io/math/2017/09/18/ModInverse.html

mratsim · 2022-10-29T19:49:26Z

EIPS/eip-5843.md

+
+TODO:
+* Some derivation of complexity for extended euclidean (https://www.scaler.com/topics/data-structures/extended-euclidean-algorithm/ claims `O(log(min(x, y))`.
+* investigate go standard library which uses Lehmer's algorithm as part of calculating inverse.


The bigint modular inverse is not needed for addmodx or mulmodx.
The only inverse that is needed fits in a word and it's cheap to compute it.

Now if an EIP needs full blown modular inverse, Bernstein-Yang and Pornin's GCDs from 2019 and 2020 are significantly faster (like 5x to 10x) than any other algorithm like Lehmer's, see mratsim/constantine#172

The "full" mod_inv is needed for generic mulmont which is used at larger bit-widths. I think it would be sensible to modify the spec to not compute it if the bitwidth is below a certain cutoff.

Here are 2 implementations of mulmont using CIOS and FIPS, mod_inv is not needed:

https://github.com/mratsim/constantine/blob/928f5155827252c01ee0c7a5c58c8b9deecc928f/constantine/math/arithmetic/limbs_montgomery.nim#L217-L307

m0ninv is the -1/M[0] the negative modular multiplicative inverse of the first limb of the prime modulus.

The way modular reduction works is by multiplying with it you can zero put the bottom bits and then shift by a whole word, one word at a time, you don't need to multiply by the full inverse.

jwasinger · 2022-10-31T21:28:40Z

Hi @mratsim, thanks for the feedback on this work-in-progress draft. I'm working on completing an initial version of the EIP along with a Geth implementation, EVMMAX support in Huff, and a few other resources.

I have some other things on my plate right now that take precedence but hope to get these out very soon 🤞

github-actions · 2023-01-16T08:57:25Z

The commit efad4b1 (as a parent of 4d749ee) contains errors.
Please inspect the Run Summary for details.

github-actions · 2023-02-01T00:21:12Z

There has been no activity on this pull request for 2 weeks. It will be closed after 3 months of inactivity. If you would like to move this PR forward, please respond to any outstanding feedback or add a comment indicating that you have addressed all required feedback and are ready for a review.

jwasinger · 2023-03-02T23:31:24Z

Superseded by #6601

Add evmmax library with prototype C++ API for Montgomery-based modular arithmetic. This does not implement all aspects of the EVMMAX spec, but is a good starting point for prototyping EVMMAX usage in C++. See these EIP drafts for more information about EVMMAX: - ethereum/EIPs#5843 - ethereum/EIPs#6601

wip

733f379

github-actions bot added c-new Creates a brand new proposal s-draft This EIP is a Draft labels Oct 27, 2022

update

a5a3d0b

jwasinger changed the title ~~EVMMAX~~ Add EIP-5843: EVM Modular Arithmetic Extensions Oct 27, 2022

update

24de70d

mratsim reviewed Oct 29, 2022

View reviewed changes

poojaranjan mentioned this pull request Nov 1, 2022

EIP Editing Office Hour Meeting 5 ethcatherders/EIPIP#186

Closed

wip

6f7ea36

poojaranjan mentioned this pull request Nov 15, 2022

EIP Editing Office Hour Meeting 6 ethcatherders/EIPIP#188

Closed

jwasinger added 18 commits November 26, 2022 14:56

wip

be4f0e4

update

9d1b793

wip

f887a1a

wip

101e88b

wip

87ccb34

wip

fb7b924

wip:

39767c1

wip

f249d14

wip

d317e92

wip

ce3c606

update

a1583a9

update

67b4fdd

small update

afc7312

wip

499b200

wip

d1bbb9e

update addmodx/submodx cost model. make mulmont explanation clearer

b25b51c

wip

b713d33

wip

8ba5c3a

word

c80853d

github-actions bot added w-ci Waiting on CI to pass and removed w-ci Waiting on CI to pass labels Jan 16, 2023

jwasinger added 4 commits January 15, 2023 21:28

format

85aee1d

fix name

793168f

reword

aff2412

word

32fc64a

github-actions bot added w-ci Waiting on CI to pass and removed w-ci Waiting on CI to pass labels Jan 16, 2023

jwasinger added 4 commits January 15, 2023 22:55

more nitpicks

66287f3

nit

c15f8db

reword

b67e396

typo

6039d70

github-actions bot removed the w-ci Waiting on CI to pass label Jan 16, 2023

typo

ed9ae61

github-actions bot added the w-ci Waiting on CI to pass label Jan 16, 2023

jwasinger added 2 commits January 16, 2023 01:20

input size -> value size

123cb21

fin

e4f88e4

github-actions bot added the t-core label Jan 16, 2023

wording

542a8ef

github-actions bot removed the w-ci Waiting on CI to pass label Jan 16, 2023

typo

efad4b1

github-actions bot added the w-ci Waiting on CI to pass label Jan 16, 2023

github-actions bot added the w-stale Waiting on activity label Feb 1, 2023

jwasinger closed this Mar 2, 2023

chfast mentioned this pull request Jul 28, 2023

EVMMAX: Base C++ API for prototyping ethereum/evmone#673

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add EIP-5843: EVM Modular Arithmetic Extensions #5843

Add EIP-5843: EVM Modular Arithmetic Extensions #5843

jwasinger commented Oct 27, 2022

eth-bot commented Oct 27, 2022 •

edited

Loading

mratsim Oct 29, 2022

mratsim Oct 29, 2022

mratsim Oct 29, 2022

mratsim Oct 29, 2022

jwasinger Oct 31, 2022

mratsim Oct 31, 2022

mratsim Oct 29, 2022

jwasinger Oct 31, 2022

mratsim Oct 31, 2022

jwasinger commented Oct 31, 2022

github-actions bot commented Jan 16, 2023

github-actions bot commented Feb 1, 2023

jwasinger commented Mar 2, 2023


		### `SETMODX`

		`SETMODX` takes two stack inputs: `(top of stack) mod_offset, mod_limb_count` where `mod_offset` refers to an EVM memory offset where a modulus represented in `mod_limb_count * 8` bytes with little-endian ordering is expected. If `(mod_offset + mod_limb_count * 8) - 1` falls outside the bounds of allocated memory, consume all call gas and return to the caller in an exceptional state. Charge `gas_setmodx(mod_limb_count)` return to the caller in an exceptional state if there was insufficient gas remaining:


		#### Conversion between Montgomery and normal forms

		Conversion of a normal value to Montgomery form can be computed with `mulmont(norm_val, evmmax_state.r_squared, mod) == norm_val * R % mod`.

	Conversion of a normal value to Montgomery form can be computed with `mulmont(norm_val, evmmax_state.r_squared, mod) == norm_val * R % mod`.
	Conversion of a canonical value to Montgomery representation can be computed with `mulmont(canon_val, evmmax_state.r_squared, mod) == canon_val * R % mod`.

Add EIP-5843: EVM Modular Arithmetic Extensions #5843

Add EIP-5843: EVM Modular Arithmetic Extensions #5843

Conversation

jwasinger commented Oct 27, 2022

eth-bot commented Oct 27, 2022 • edited Loading

(fail) eip-5843.md

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jwasinger commented Oct 31, 2022

github-actions bot commented Jan 16, 2023

github-actions bot commented Feb 1, 2023

jwasinger commented Mar 2, 2023

eth-bot commented Oct 27, 2022 •

edited

Loading