Faster polynomial evaluation in Lagrange basis with rhizomes algorithm.

[armfazh]

Use of faster polynomial evaluation in the Lagrange basis from the rhizomes paper.

• It is applied to FLP.Query algorithm to evaluate several polynomials at a random value.
• In the paper, Algorithm 6 evaluates a single polynomial, while Alg. 7 is its batched version that is implemented.
• Savings are around 2x faster for PrepInit in all VDAFs.
• Unlike Prio2 optimization: use barycentric interpolation formula in poly_interpret_eval() #571, our method uses no field inverses.

Reference:
link Rhizomes and the Roots of Efficiency, Latincrypt 2025.

Running Benchmarks

git checkout main
cargo bench --features experimental --bench speed_tests -- "prio3.*prepare_init" --quiet --save-baseline baseline

git checkout pr
cargo bench --features experimental --bench speed_tests -- "prio3.*prepare_init" --quiet --save-baseline rhizomes
critcmp baseline rhizomes

Timings

Plot of the timings for PrepInit step.

[jcjones]

Only weighing in on the Rust, not the cryptographic implementation

[jcjones]

Perhaps we should avoid this potential access panic the way it's done on line 99. Something like:

Suggested change

	u.extend(polynomials.iter().map(|poly| poly[0]));
	u.extend(polynomials.iter().map(|poly| poly.get(0).copied().unwrap_or_else(F::zero)));

[jcjones]

There's no prior art in this file, but perhaps this should be a method that is fallible with a Result<Vec<F>> return type instead of the panics here.