Use mixed-radix decompositions for CurveFFT

halo2_proofs/benches/fft.rs

@@ -14,6 +14,7 @@ use criterion::{BatchSize, BenchmarkId, Criterion};
 use rand::rng;
 
 const ORCHARD_K: u32 = 11;
+const EXTENDED_CURVE_FFT_K: u32 = 13;
 const ORCHARD_EXTENDED_K: u32 = 14;
 
 fn criterion_benchmark(c: &mut Criterion) {
@@ -57,6 +58,38 @@ fn criterion_benchmark(c: &mut Criterion) {
         );
     });
 
+    let extended_params = Params::<EqAffine>::new(EXTENDED_CURVE_FFT_K);
+    let extended_minv = Fp::TWO_INV.pow_vartime([u64::from(EXTENDED_CURVE_FFT_K)]);
+    let extended_curve_fft_input: Vec<Eq> = extended_params
+        .get_g()
+        .iter()
+        .map(|point| Eq::from(*point) * extended_minv)
+        .collect();
+    let mut extended_omega = Fp::ROOT_OF_UNITY_INV;
+    for _ in EXTENDED_CURVE_FFT_K..Fp::S {
+        extended_omega = extended_omega.square();
+    }
+    c.bench_function("curve-fft/affine-eisenstein-k13", |b| {
+        b.iter_batched(
+            || {
+                (
+                    extended_curve_fft_input.clone(),
+                    vec![EqAffine::identity(); extended_curve_fft_input.len()],
+                )
+            },
+            |(points, mut affine)| {
+                assert!(Eq::fft_vartime(
+                    &points,
+                    &mut affine,
+                    extended_omega,
+                    EXTENDED_CURVE_FFT_K,
+                ));
+                affine
+            },
+            BatchSize::LargeInput,
+        );
+    });
+
     c.bench_function("params/new-k11", |b| {
         b.iter(|| Params::<EqAffine>::new(ORCHARD_K));
     });

pasta_curves/CHANGELOG.md

@@ -15,6 +15,11 @@ and this project adheres to Rust's notion of
   16-point codelets. The 16-point transform uses 14 scalar multiplications
   instead of 17 and shares repeated scalar schedules and affine inversion
   stages across its subtransforms.
+- The Pasta curve FFT uses mixed DFT8/DFT16 Cooley–Tukey decompositions for
+  sizes 2^6 and above. Diagonal twiddles are grouped by scalar, their GLV
+  decompositions are reused across tiers, and explicit transposes keep every
+  codelet substage in one contiguous affine inversion batch. At the Orchard
+  size this reduces point-scalar multiplications from 8,833 to 8,193.
 - The GLV batch-affine ladder now interleaves its nonzero Montgomery batch
   inversion across even- and odd-indexed accumulator lanes. The three fixed
   extra multiplications per ladder column expose independent multiplication