Splitting PR #44: Optimize cycles in FRI rounds in BaseFold verifier

[yczhangsjtu]

Summary

Resolves #47. This PR computes the verifier_folding_coeffs_level(log2_height, idx) in a iterative way.

Math

The underlying math behind this new iterative algorithm is

1. For level $L$, we have the coeff $c = 1/2 * g^{-bitrev(i)}$ where $g^{2^L} = -1$.
2. Given the little-endian bits representation of $i$ we have $i = i_0 + i_1 * 2^1 + ... + i_{L-1} * 2^{L-1}$;
3. It's easy to see $bitrev(i) = bitrev(i/2) + i_0 * 2^{L-1}$;
4. For level $L-1$, we have the coeff $c' = 1/2 * g'^{-bitrev(i/2)}$ where $g' = g^2$;
5. This is equivalent to $c' = 1/2 * g^{-2*bitrev(i) + i_0 * 2^L} = 2 * c^2 * (-1)^{i_0} $.

Therefore we have this recursive formula

$$c' = 2 * c^2 * (-1)^{i_0}$$

Performance

ceno guest program	cycle (before)	cycle (after)
fib(2^10)	1402187	1292138 (8%⬇️)
fib(2^20)	1899653	1698723 (10%⬇️)