Overview
Multiscalar multiplication (MSM) is a core cryptographic operation used heavily during the Aztec proof generation process. Because MSM consists of many independent elliptic-curve operations, it is highly parallelizable and a natural candidate for GPU acceleration. Aztec’s CPU implementation is already highly optimized and performs well for smaller MSMs. As MSM size grows, however, CPU parallelism eventually becomes limited by the available hardware, while GPUs continue to benefit from higher parallel throughput.
GPU acceleration comes with additional infrastructure cost. Faster hardware generally means higher hourly instance pricing, and production deployments must balance wall-clock performance against overall proving cost. This benchmark focuses on practical deployment questions, including:
- At what MSM sizes does GPU acceleration become worthwhile?
- How much do different GPU backends improve MSM throughput?
- How much of end-to-end proof generation time can actually be reduced by accelerating MSMs?
- Does a faster GPU translate into lower proving cost, or do CPU bottlenecks become the limiting factor?
Key Results
The raw MSM benchmarks show that GPU acceleration provides a large improvement at higher MSM sizes. For a single 2^24 MSM, the native GPU implementation on an A10G finishes in roughly 196ms, compared with 4,255ms on a 32 vCPU CPU-only instance. Comparing costs at this size, the 16 vCPU CPU-only instance produces 786 MSMs/$, while the 8 vCPU A10G can output 15,055 MSMs/$.
However, pure speed and MSMs/$ are not enough to justify GPU costs for full proof generation, because the rest of the proof is still generated on the CPU. Looking at a ROOT_ROLLUP proof shows how these costs balance out. On a T4 instance with 8 vCPUs, the commitments/MSM portion drops from 67.2 s to 5.5 s, saving about 61.7 s. End-to-end, the proof improves from 144.6 s to 84.7 s, while proofs/$ improves from 32 to 55.
This is the key result: even though full proving is not purely MSM-bound, the cheaper T4 GPU instance is able to convert MSM acceleration into better end-to-end proof cost efficiency. In this case, it reaches about 55 proofs/$, slightly higher than the 53 proofs/$ from the 16 vCPU CPU-only instance.
What This Means For Provers
The optimal setup is not necessarily the fastest GPU. The better question is how to balance GPU throughput, CPU capacity, hourly instance cost, and scheduling. A lower-cost GPU instance can be more cost-effective than a faster one if the remaining CPU work dominates the end-to-end proof.
For production provers, the goal may be less about adding multiple GPUs and more about keeping one GPU saturated. Individual MSM calls are relatively short, so a single proof job may not fully utilize the GPU. With multiple proving agents running concurrently, one shared GPU could potentially serve many MSM workloads while CPU-heavy phases continue in parallel, improving cost efficiency without requiring a multi-GPU setup.
The full benchmark is linked here.