#13 uses the complete padd for the doubling steps of pnsmulFast (binNsmul padd pid), which is correct by completeness. The RCB paper's dedicated a = 0 doubling (Algorithm 9) uses roughly half the multiplications, and the binary ladder is ~255 doublings against ~128 additions, so a proven pdbl — with its own toAffine spec, and the ladder proven equal to the current one — would roughly halve smulFast. Low priority for the MSM-dominated workloads that motivated #13: in Pippenger, doublings appear only in the Horner fold between windows.
🤖 Claude Fable 5
#13 uses the complete
paddfor the doubling steps ofpnsmulFast(binNsmul padd pid), which is correct by completeness. The RCB paper's dedicateda = 0doubling (Algorithm 9) uses roughly half the multiplications, and the binary ladder is ~255 doublings against ~128 additions, so a provenpdbl— with its owntoAffinespec, and the ladder proven equal to the current one — would roughly halvesmulFast. Low priority for the MSM-dominated workloads that motivated #13: in Pippenger, doublings appear only in the Horner fold between windows.🤖 Claude Fable 5