Carry-less multiplication is the hot arithmetic primitive in the binary-field proof stack. The node selects an x86-64 or ARM64 kernel at startup, while the field representation, witness layout and serialized proof remain fixed. The AVX2+VPCLMUL path improved Poseidon2b batch hashing by 5.4× on the reference laptop and reduced the measured 2^24-position proof from 34.9 to 18.9 seconds.
Why binary-field kernels dominate
ParanO(1)d's proof machinery works over the binary extension field GF(2128), which contains 2128 elements. Poseidon2b—the cryptographic permutation used by the proof stack and proof-of-work hash—is implemented over the same field. Addition is XOR. Multiplication is carry-less polynomial multiplication followed by reduction. That makes hardware carry-less multiply—not ordinary integer multiply—the key primitive for prover throughput, verifier throughput and proof-of-work hashing.
The architectural constraint was stricter than “make the fast machine faster.” Proof shapes, witness layout and transcript bytes had to remain identical across machines. A backend specialized for one instruction-set architecture (ISA) may change execution, never the statement being proved.
One layout, runtime dispatch
| Platform | Baseline | Wider path | Lane model |
|---|---|---|---|
| x86-64 | SSE4.1 + PCLMULQDQ | AVX2 + VPCLMULQDQ | Two packed field elements |
| x86-64 | — | AVX-512 + VPCLMULQDQ | Four-lane arithmetic, wider batch chunks |
| ARM64 | NEON + PMULL | Register-domain batch kernel | One field element per 128-bit vector |
The released binary detects the host at startup and selects the widest supported implementation. The logical packed type stays fixed. AVX-512 operates on adjacent logical packs rather than redefining their meaning, so enabling it cannot change proof or witness serialization.
Keeping Poseidon2b in registers
A naïve vector implementation still loses time if every round crosses between scalar memory representation and vector registers. The register-domain kernel keeps the four-lane permutation state in vectors across the complete schedule. Squaring uses the specialized binary-field path; multiplications use VPCLMULQDQ or PMULL; round constants and linear layers are applied without leaving the selected domain.
The July 9 AVX2+VPCLMULQDQ implementation produced two connected measurements on the development laptop:
The proof-time improvement is smaller than the isolated hashing speedup because the complete prover also performs witness assembly, polynomial-commitment (PCS) work and non-hash algebra. That difference is useful: it locates the next bottleneck instead of turning a microbenchmark into an end-to-end claim.
Flat basis at the right boundary
The code uses a flat 128-bit polynomial-basis representation compatible with the carry-less field multiplication used by Galois/Counter Mode (GCM). A tower basis represents the same field as a sequence of smaller nested extensions, which is convenient for parts of the proof algebra. Repeatedly converting every scalar operation between those two representations would erase the instruction-set advantage. Multilinear-extension (MLE) evaluation and Poseidon2b batching therefore keep long hot loops in the flat basis and cross representation boundaries only at explicit protocol edges.
The field element is the same mathematical element on every backend. Runtime dispatch chooses an implementation of multiplication and hashing; it does not choose consensus parameters.
Portability without a silent scalar mode
The production node requires hardware support that can sustain the proof workload. On x86-64 that means SSE4.1 and PCLMULQDQ; on ARM64 it means NEON and PMULL. Wider paths are optional accelerators. A scalar implementation remains useful as a reference and for differential tests, but silently running a production node on it would turn a compatibility feature into a liveness failure.
This is especially relevant on virtual machines. A physical processor may support PCLMULQDQ while a hypervisor exposes a generic guest CPU without it. The node checks guest-visible features and reports the missing instruction rather than entering an unexpectedly slow mode.
How the backends are checked
Each optimized path is compared against the canonical scalar semantics. Batch digests must match scalar digests for complete and partial chunks; field multiplication must match the reference reduction; runtime selection must never call a target-feature function before its gate has passed.
The resulting design has three useful properties:
- proof bytes are portable between machines;
- validators do not trust a miner's optimized result—they recompute the canonical digest;
- new ISA tiers can be added behind the same dispatch surface without adding protocol branches.
Why the field choice survived implementation
Frobenius operations—the repeated-squaring maps that are linear in a binary field—simplify the proof algebra, while carry-less multiplication makes the same field practical on current CPUs. The 5.4× kernel result mattered only because the unchanged proof format also produced a measurable end-to-end improvement. Protocol arithmetic and machine arithmetic met at one stable representation.