Consensys/gnark-crypto: v0.21.0

⚠️ Breaking Changes

• FRI & Plookup relocated — The fri and plookup packages are gone from all curves. FRI primitives now live under field/koalabear.
• Parallel goes public — internal/parallel is now exported as parallel; the worker pool moved to utils.
• Stricter EdDSA key parsing:
  • PublicKey.SetBytes now rejects points outside the prime-order subgroup.
  • PrivateKey.SetBytes now rejects malformed scalars and public keys that don't match their scalar.
  • Keys that used to load may now error.

🔒 Security

• shplonk & fflonk were missing subgroup membership checks on digests and proof points before verifying.
• KZG MPC setup — Verify was checking the ratio on the previous SRS instead of the contributed one, and never bound the G1 update to the proof.
• Subgroup membership tests added to all twistededwards curves.
• Fp2.Sqrt returned a wrong result on (non-QR, 0) inputs.
• Fixed a 4-byte overread in the innerProdVec AVX-512 path.

✨ New

• Cube roots in Fp and Fp2.
• FFT over degree-6 extensions for koalabear and babybear.
• Generic BitReverse / BitReverseCopy helpers in utils.
• Fixed-base scalar multiplication on twisted Edwards curves (used by eddsa).
• secp256r1: Fp2 tower + Cardano cube-root solver.

⚡ Faster

• 4-bit sliding window exponentiation across all fields.
• Lazy-reduction 𝔽p2 multiplication assembly for BLS12-381, BLS12-377, BLS24-315 & BLS24-317, plus improved Expt/mulBySeed chains and faster hash-to-G1 in the highly 2-adic Fp case.
• New SIMD work on the small fields:
  • AVX-512 & NEON kernels for Poseidon2 compression and VectorE6
  • AVX-512 batch ops for E6 FFT (2.97×)
  • Inlined E6 arithmetic for 31-bit primes (2.07×)
  • Unrolled FFT kernels