What is carryless multiplication and why do crypto workloads need it?

Carryless multiplication is a variant of integer multiplication that discards carry bits, producing results in the finite field GF(2^n). It's the core operation behind AES-GCM authentication, GHASH, Reed-Solomon erasure codes, and the polynomial arithmetic used in zk-SNARK provers. Without hardware support, GPUs had to emulate it with slow bit-level shifts and lookup tables.

Which Nvidia GPUs support the new instruction?

Per Blockchain.News, the instruction is exposed on Ampere-generation silicon and everything newer, which covers the RTX 30 series, RTX 40 series, A100, H100, and the Blackwell-based B100 and B200 accelerators. Turing and older cards remain on the software path.

Does this affect wallet users or on-chain transaction fees?

Not directly. End users won't see faster wallets or cheaper gas from a CUDA update. The wins accrue to infrastructure operators, particularly zk-rollup provers and storage miners, who may pass savings downstream over time through lower proving fees or storage costs.

Nvidia's CUDA 13.3 Brings Native Carryless Multiplication, Cutting Crypto Workloads by up to 18x

Nvidia released CUDA 13.3 on Wednesday, exposing native carryless multiplication on Ampere and newer GPUs and delivering up to an 18x speedup on Galois-field cryptographic workloads, according to a Blockchain.News report published July 15. The instruction, long available on x86 CPUs as PCLMULQDQ, has been hidden inside Nvidia's tensor and integer pipelines for years without a documented developer path. CUDA 13.3 finally surfaces it as a first-class primitive, which changes the economics of GPU-accelerated crypto libraries almost overnight.

By Rahul Mehta· AI-assisted· Altcoins & DeFi

What happened

Nvidia shipped CUDA 13. 3 on Wednesday with a single line that will matter more to crypto engineers than the release notes suggest. The toolkit now exposes a hardware carryless multiplication intrinsic on Ampere-generation silicon and everything above it, including Ada Lovelace, Hopper, and Blackwell.

Blockchain. News, which first reported the change, cites internal Nvidia benchmarks showing up to 18x speedups versus the previous software emulation path on Galois-field arithmetic. Carryless multiplication, or CLMUL, is the same primitive that Intel added to x86 in 2010 as PCLMULQDQ.

It's the mathematical backbone of AES-GCM authentication, GHASH, Reed-Solomon erasure coding, and, more recently, the finite-field polynomial multiplications that dominate zk-SNARK proof generation. Until this week, GPU code had to fake it with lookup tables or bitsliced shifts. That tax is now gone.

Why it matters

The 18x figure is a ceiling, not an average, and it's measured on the specific workload where Nvidia had the most to gain. The average won't be 18x. It will still be huge.

Cryptography on GPUs has been bottlenecked by exactly this operation for over a decade, and every zk-rollup prover, every Filecoin storage miner, and every Arweave replicator has been paying the tax in software. Rollup provers running on Nvidia clusters, including infrastructure operated by teams like Ingonyama and Ulvetanna, will see immediate wins on the multi-scalar multiplication and NTT stages that dominate proving time.

The economics of a Nvidia H100 versus a custom FPGA prover shift with it. FPGAs still win on power per proof, but the gap closes.

Nvidia's CUDA 13.3 Brings Native Carryless Multiplication, Cutting Crypto Workloads by up to 18x

What happened

Why it matters

Market impact

What to watch

Disclaimer

Key takeaways

Frequently asked

Sources