webgpu_groth16/lib.rs
1//! GPU-accelerated Groth16 zero-knowledge proof system with curve-pluggable
2//! abstractions.
3//!
4//! The two most expensive proof operations — **MSM** (multi-scalar
5//! multiplication) and **NTT** (number theoretic transform) — are offloaded to
6//! GPU compute shaders written in WGSL and dispatched via [wgpu](https://docs.rs/wgpu).
7//!
8//! # Architecture
9//!
10//! - [`gpu`] — WebGPU context, pipeline management, and kernel dispatchers
11//! (MSM, NTT, H-polynomial). Field arithmetic uses 13-bit limbs for Fq and
12//! 32-bit limbs for Fr.
13//! - [`prover`] — Groth16 proof construction orchestration: circuit synthesis,
14//! witness evaluation, H-polynomial computation, and MSM scheduling.
15//! - [`bucket`] — Pippenger bucket sorting with signed-digit scalar
16//! decomposition and sub-bucket chunking for GPU load balancing.
17//! - [`glv`] — curve-specific GLV endomorphism implementations (where
18//! available).
19//!
20//! # MSM Pipeline
21//!
22//! G1 MSMs use curve-capability-aware Pippenger. For curves with GLV support,
23//! each scalar is decomposed into `k1·P + k2·φ(P)`, halving the number of
24//! windows. The GPU pipeline runs 5 kernels per MSM:
25//!
26//! `to_montgomery → aggregate_buckets → [reduce_sub_buckets] → weight_buckets →
27//! subsum`
28//!
29//! Persistent GPU bases ([`prover::GpuProvingKey`]) can be pre-uploaded once
30//! and reused across proofs, eliminating per-proof base transfers.
31
32pub mod bucket;
33pub mod glv;
34pub mod gpu;
35pub mod prover;
36
37#[cfg(feature = "bellman-provider-bellman")]
38pub use bellman;
39#[cfg(feature = "bellman-provider-nam-bellperson")]
40pub use nam_bellperson as bellman;