FRI & Plookup relocated — The fri and plookup packages are gone from all curves. FRI primitives now live under field/koalabear.
Parallel goes public — internal/parallel is now exported as parallel; the worker pool moved to utils.
Stricter EdDSA key parsing:
PublicKey.SetBytes now rejects points outside the prime-order subgroup.
PrivateKey.SetBytes now rejects malformed scalars and public keys that don't match their scalar.
Keys that used to load may now error.
🔒 Security
shplonk & fflonk were missing subgroup membership checks on digests and proof points before verifying.
KZG MPC setup — Verify was checking the ratio on the previous SRS instead of the contributed one, and never bound the G1 update to the proof.
Subgroup membership tests added to all twistededwards curves.
Fp2.Sqrt returned a wrong result on (non-QR, 0) inputs.
Fixed a 4-byte overread in the innerProdVec AVX-512 path.
✨ New
Cube roots in Fp and Fp2.
FFT over degree-6 extensions for koalabear and babybear.
Generic BitReverse / BitReverseCopy helpers in utils.
Fixed-base scalar multiplication on twisted Edwards curves (used by eddsa).
secp256r1: Fp2 tower + Cardano cube-root solver.
⚡ Faster
4-bit sliding window exponentiation across all fields.
Lazy-reduction 𝔽p2 multiplication assembly for BLS12-381, BLS12-377, BLS24-315 & BLS24-317, plus improved Expt/mulBySeed chains and faster hash-to-G1 in the highly 2-adic Fp case.
New SIMD work on the small fields:
AVX-512 & NEON kernels for Poseidon2 compression and VectorE6
