I’m interested in adding a precompile that adds support for Blake3/Blake2s, similar to this issue discussing adding Blake2b.
I left a comment there saying I’m willing to implement this this if people would be willing to help me get the PR merged (this is my first EIP and will be my first geth PR). Opening this up as a space to discuss.
My team forked and benchmarked an existing solidity implementation. Image attached, it basically costs $60 to hash something. This is not great! I’m checking out a decompiled version of it, but I’m not super hopeful about the gains that hand-optimizing this is going to get me.
Blake3 is a merkle-tree-based hash function with cool features like being super-parallelizable, updateable on the fly, indefinitely extensible for KDF’ing, and (my favorite) allows for verified streaming and log(n) verification of randomly selected chunks from files. My team was originally hoping to use it to build an Ethereum-based decentralized incentive layer for IPFS pinning (we are no longer building this), but I can imagine plenty of other fun optimizations of things like optimistic L2s and data availability that could be enabled with this. Blake2s is also necessary to do Wireguard handshakes… if for some reason you are attempting to do that on-chain, you’d need it.
Zooko has a comment detailing the changes between the existing opcode at
0x09- basically, it’s the same code, with four constants changed, and the word size of the function is halved. See the relevant RFC here.
As far as gas fees, the
0x09 Blake2b F function precompile is charged as
Each operation will cost GFROUND * rounds gas, where GFROUND = 1. Blake2b is usually run with 12 rounds, whereas Blake2s is usually run with 10, so most calls would take 10 gas. The input size difference is accounted for with CALL gas computations. On modern 64-bit architectures, assuming a negligible amount of weird packing and unpacking the 32-bit words into 64-bit words, I think it’ll be appropriate to go with the same gas pricing for this precompile as with
I propose that this precompile go at contract
0x0a, which will be compatible with anything that doesn’t assume there’s nothing at that address.
I think the only work left to do is to write this up as an EIP, do a PR (where should that go?), and validate my assumptions above about gas costs.