Paper 2022/1400

EdMSM: Multi-Scalar-Multiplication for SNARKs and Faster Montgomery multiplication

Youssef El Housni, Linea, ConsenSys
Gautam Botrel, Linea, ConsenSys

The bottleneck in the proving algorithm of most of elliptic-curve-based SNARK proof systems is the Multi-Scalar-Multiplication (MSM) algorithm. In this paper we give an overview of a variant of the Pippenger MSM algorithm together with a set of optimizations tailored for curves that admit a twisted Edwards form. We prove that this is the case for SNARK-friendly chains and cycles of elliptic curves, which are useful for recursive constructions. Our contribution is twofold: first, we optimize the arithmetic of finite fields by improving on the well-known Coarsely Integrated Operand Scanning (CIOS) modular multiplication. This is a contribution of independent interest that applies to many different contexts. Second, we propose a new coordinate system for twisted Edwards curves tailored for the Pippenger MSM algorithm. Accelerating the MSM over these curves is critical for deployment of recursive proof systems applications such as proof-carrying-data, blockchain rollups and blockchain light clients. We implement our work in Go and benchmark it on two different CPU architectures (x86 and arm64). We show that our implementation achieves a 40-47% speedup over the state-of-the-art implementation (which was implemented in Rust). This MSM implementation won the first place in the ZPrize competition in the open division “Accelerating MSM on Mobile” and will be deployed in two real-world applications: Linea zkEVM by ConsenSys and probably Celo network.

Note: This work was implemented as part of a submission to the ZPrize competition in the open division “Accelerating MSM on Mobile” ( This is a revised version of the original paper to appear in TCHES 2023, Issue 3.

Available format(s)
Publication info
Published by the IACR in TCHES 2023
elliptic curvesmulti-scalar-multiplicationimplementationSNARKzero-knowledge proofs
Contact author(s)
youssef elhousni @ consensys net
gautam botrel @ consensys net
2023-05-17: last of 2 revisions
2022-10-16: received
See all versions
Short URL
Creative Commons Attribution


      author = {Youssef El Housni and Gautam Botrel},
      title = {EdMSM: Multi-Scalar-Multiplication for SNARKs and Faster Montgomery multiplication},
      howpublished = {Cryptology ePrint Archive, Paper 2022/1400},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.