hanfei-shu 术 — GPU Multi-Scalar Multiplication for Halo2
Multi-scalar multiplication eats 60–70% of Halo2 proving time. hanfei-shu moves it to the GPU: 3.3–4.8× over single-threaded CPU Pippenger on the Pallas curve. Published on crates.io, and the layer the NanoZK ICICS paper is built on.
// DESCRIPTION
If you are building on Halo2 zero-knowledge proofs — for AI verification, blockchain privacy, or anything on the Pallas curve — one operation dominates: multi-scalar multiplication (MSM), essentially a giant dot product over elliptic-curve points. It accounts for 60–70% of proving time. On CPU a single MSM over half a million points takes roughly 300 ms, which compounds badly when you are proving neural-network layers one at a time.
hanfei-shu moves that computation to an NVIDIA GPU. Same math, same results.
Measured (RTX 3090 vs Ryzen 9 5950X, installed from crates.io)
| Points | CPU Pippenger (single-thread) | GPU | Speedup |
|---|---|---|---|
| 64K (k=16) | 516 ms | 110 ms | 4.7× |
| 128K (k=17) | 961 ms | 202 ms | 4.8× |
| 256K (k=18) | 1780 ms | 386 ms | 4.6× |
| 512K (k=19) | 3453 ms | 1043 ms | 3.3× |
| 1M (k=20) | 6744 ms | 1776 ms | 3.8× |
Where it is used
This is the GPU cryptography layer underneath NanoZK (ICICS 2026, main track), which decomposes transformer inference into per-layer proofs. Proving a language model layer by layer means running a great many MSMs, so the constant factor here is the difference between a demo and something that runs at a size anyone cares about.
Its sibling crate hanfei-fa 法 answers a different question in the same family —
verifying that a set of ML model weights is what it claims to be, and saying exactly what changed
if it is not.
法不阿贵，绳不挠曲。 The law does not favour the noble; the plumb line does not bend for the crooked. — 韩非子
// HIGHLIGHTS
- Published Rust crate:
cargo add hanfei-shu - 3.3–4.8× over single-threaded CPU Pippenger, benchmarked from the published crate
- MSM is 60–70% of Halo2 proving time — this is the hot path, not a micro-optimisation
- The GPU layer beneath NanoZK (ICICS 2026 main track)
- CPU-only sibling
hanfei-fafor deployments without CUDA