What is carryless multiplication and why do crypto workloads need it?

Carryless multiplication is a variant of integer multiplication that discards carry bits, producing results in the finite field GF(2^n). It's the core operation behind AES-GCM authentication, GHASH, Reed-Solomon erasure codes, and the polynomial arithmetic used in zk-SNARK provers. Without hardware support, GPUs had to emulate it with slow bit-level shifts and lookup tables.

Which Nvidia GPUs support the new instruction?

Per Blockchain.News, the instruction is exposed on Ampere-generation silicon and everything newer, which covers the RTX 30 series, RTX 40 series, A100, H100, and the Blackwell-based B100 and B200 accelerators. Turing and older cards remain on the software path.

Does this affect wallet users or on-chain transaction fees?

Not directly. End users won't see faster wallets or cheaper gas from a CUDA update. The wins accrue to infrastructure operators, particularly zk-rollup provers and storage miners, who may pass savings downstream over time through lower proving fees or storage costs.

Nvidia's CUDA 13.3 Brings Native Carryless Multiplication, Cutting Crypto Workloads by up to 18x

Market impact

There's no ticker to trade off this. The headline looks bullish for zk infrastructure names, but the picture is messier. Faster GPU provers cut margins for hardware-arbitrage shops that were quietly running underpriced proving on rented cloud GPUs.

Prover-as-a-service outfits like Succinct Labs, Gevulot, and =nil; Foundation now compete on a rebased cost curve, and the projects that had been building custom silicon justifications, RISC Zero and Ingonyama among them, will need to redraw their internal comparisons. Filecoin storage providers running Ampere or Hopper cards for windowPoSt and winningPoSt should see meaningful runtime reductions once lotus-miner and rust-fil-proofs land patched builds.

FIL itself doesn't move on toolkit releases, and it shouldn't. But operator margins improve, which is the kind of quiet tailwind that matters over quarters.

Nvidia released CUDA 13.3 on Wednesday, exposing native carryless multiplication on Ampere and newer GPUs and delivering up to an 18x speedup on Galois-field cryptographic workloads, according to a Blockchain.News report published July 15. The instruction, long available on x86 CPUs as PCLMULQDQ, has been hidden inside Nvidia's tensor and integer pipelines for years without a documented developer path. CUDA 13.3 finally surfaces it as a first-class primitive, which changes the economics of GPU-accelerated crypto libraries almost overnight.

By Rahul Mehta· AI-assisted· Altcoins & DeFi

What happened

Nvidia shipped CUDA 13. 3 on Wednesday with a single line that will matter more to crypto engineers than the release notes suggest. The toolkit now exposes a hardware carryless multiplication intrinsic on Ampere-generation silicon and everything above it, including Ada Lovelace, Hopper, and Blackwell.

Blockchain. News, which first reported the change, cites internal Nvidia benchmarks showing up to 18x speedups versus the previous software emulation path on Galois-field arithmetic. Carryless multiplication, or CLMUL, is the same primitive that Intel added to x86 in 2010 as PCLMULQDQ.

It's the mathematical backbone of AES-GCM authentication, GHASH, Reed-Solomon erasure coding, and, more recently, the finite-field polynomial multiplications that dominate zk-SNARK proof generation. Until this week, GPU code had to fake it with lookup tables or bitsliced shifts. That tax is now gone.

Why it matters

The 18x figure is a ceiling, not an average, and it's measured on the specific workload where Nvidia had the most to gain. The average won't be 18x. It will still be huge.

Cryptography on GPUs has been bottlenecked by exactly this operation for over a decade, and every zk-rollup prover, every Filecoin storage miner, and every Arweave replicator has been paying the tax in software. Rollup provers running on Nvidia clusters, including infrastructure operated by teams like Ingonyama and Ulvetanna, will see immediate wins on the multi-scalar multiplication and NTT stages that dominate proving time.

The economics of a Nvidia H100 versus a custom FPGA prover shift with it. FPGAs still win on power per proof, but the gap closes.

Market impact

Nvidia's CUDA 13.3 Brings Native Carryless Multiplication, Cutting Crypto Workloads by up to 18x

What happened

Why it matters

Market impact

What to watch

Disclaimer

Key takeaways

Frequently asked

Sources