At Clearmatics we have been building privacy solutions for Ethereum, as have others, and we were waiting in anticipation for Byzantium to introduce the new elliptic curve operations.

The result was expected: it was much cheaper to validate ring signatures on-chain, but we noted another problem compared to the previous implementation using secp256k1 — our tools to generate ring signatures were now many times slower and we were still very concerned about the impact of running transactions which cost nearly 1 million gas on Ethereum.

So, why is it that the ecmul operation introduced in Ethereum as part of the Byzantine release costs 40,000 gas? Even though the ECDSA key recovery operation ecrecover requires several underlying ecmul operations but costs only 3000 gas?

There are really two problems: