slowbeardigger:matrix.org: I have one extra testcase on git.gammaspectra.live/P2Pool/consen…o/curve25519/montgomery_test.go#L25 if you want to check compliance (plus other tests)

my implementation is on git.gammaspectra.live/P2Pool/consen…ero/crypto/curve25519/montgomery.go MontgomeryUnclampedScalarMult for reference

<slowbeardigger:matrix.org> Thank you! will check

<slowbeardigger:matrix.org> will check after my coffee is ready

for reference the Go code is no-alloc as well, and runs at 2466 ns/op 0 B/op 0 allocs/op on a ECO-mode low-throttled 9950X3D single-core

I also have a batch unclamped scalar mult api, but that's not alloc-free (some slices that are ephemeral still get tracked as allocs, even when they will most of the time land on stack)

<slowbeardigger:matrix.org> That’s really interesting.

<slowbeardigger:matrix.org> Could you pls share the same result with -cpu=1 or GOMAXPROCS=1? if you get a chance ofc

right, that test is trying to do parallel, my bad. it shouldn't need to be, one sec :D

I never updated this code to use the new nicer single-core methods

<slowbeardigger:matrix.org> DataHoarder: no problemou

<slowbeardigger:matrix.org> I was wondering because 2466 ns/op would be wild for single-call latency

it is wild :)

I was currently profiling it cause it looked fast

BenchmarkX25519ScalarMult-24 198880 30020 ns/op 0 B/op 0 allocs/op

-24 but it's running on one core

<slowbeardigger:matrix.org> -24 suffix is just the GOMAXPROCS setting?

<slowbeardigger:matrix.org> about the same ballpark as my x86 BMI2+ADX result (~28.9 us on a GitHub runner)

<slowbeardigger:matrix.org> fucking impresive

I did optimize the field elements a bit :)

<slowbeardigger:matrix.org> legend

I run a fork on git.gammaspectra.live/P2Pool/edwards25519 and there is asm for field mul / field square

but field inversion / specialized types for x^((p-5)/8) or x^((p-3)/8) were made

<slowbeardigger:matrix.org> DataHoarder: AHHHHHH

and for X25519 I have a method to do x * 121666 specifically

no BMI2 or ADX though!

<slowbeardigger:matrix.org> no BMI2/ADX and still ~30 us is damn good

<slowbeardigger:matrix.org> would love a same-host carrot25519 run on that 9950X3D 👀

<slowbeardigger:matrix.org> just for the numbers 👀 👀 👀 👀 👀

you can run mine :D

<slowbeardigger:matrix.org> will do

off this tree git.gammaspectra.live/P2Pool/consen…aaf36771be85e599ea8783a2f611494a37e

also, 9900X3D, not 9950X3D, I misspoke :P

<slowbeardigger:matrix.org> still a beast

your carrot25519_mul_base has an equivalent on mine, constant time and vartime too:

BenchmarkX25519ScalarBaseMult/Constant 496590 11425 ns/op 0 B/op 0 allocs/op

BenchmarkX25519ScalarBaseMult/VarTime 698203 8371 ns/op 0 B/op 0 allocs/op

in my case it's faster to do the scalar mult and encode to Montgomery :)

for Carrot specific environment that is acceptable when producing them

<slowbeardigger:matrix.org> Agreed that makes sense for carrot key gen

<slowbeardigger:matrix.org> Probably best as a separate scalar fast path? While the mul keeps unchanged

vartime allows precalc stuff yes :)

<slowbeardigger:matrix.org> Ran your commit on my M1 base

<slowbeardigger:matrix.org> 44.16 us for arbitrary point

<slowbeardigger:matrix.org> Your field ops is awesome

<slowbeardigger:matrix.org> My laptop got stupid running some.benchmark

<slowbeardigger:matrix.org> Had to move to my phone here

<jpk68:matrix.org> Good thing isogenies exist, or else we'd just be throwing all of this curve stuff out the window

don't run every benchmark there lol, just the ones on that specific subpath

<slowbeardigger:matrix.org> Too late

<slowbeardigger:matrix.org> laptop goes brrrr

there's some benchmark or tests on mining if you keep pulling deps, so at some point you are mining lol

<slowbeardigger:matrix.org> ill just let it be

<slowbeardigger:matrix.org> turning on my backup laptop

the code you posted still performs faster, ofc, all hail slow compilers

<slowbeardigger:matrix.org> still, your Go numbers are seriously good, and now I have a base fast path to investigate 👀

see VarTimeScalarMultPrecomputed and ScalarMultPrecomputed on that forked repo, it's where I placed that + tables that get computed

<slowbeardigger:matrix.org> noted, will check it out sounds like exactly the direction I need 👀

though most of the speedups I get along the code is due to having DoubleScalarMult or DoubleScalarBaseMult specific paths, which happens a lot in monero (each also has a VarTime option), specially when I can precompute the two bases (like for monero commitments or other areas with monero specific generators)

<slowbeardigger:matrix.org> you’re optimizing the actual monero equations rather than isolated scalar mult 👀

irc.gammaspectra.live/e4e75e2478593cea/image.png

stuff like this

where one generator is G, other is T

so both are public and can be precomputed

<slowbeardigger:matrix.org> Seems like i wont work tomorrow focusing on this

or for scanning carrot irc.gammaspectra.live/a77917e33334f4b4/image.png

sadly a lot of the new stuff ends up with a variable amount of chained scalar mults so I just feed everything to my MultiScalarMult :) but maybe I should add some mixed method there that has a precalc section beforehand as that would be cheaper

<slowbeardigger:matrix.org> that feels like the next move

then there's some batch specific optimizations that work quite well on p2pool, monero had some added my kayaba

by*

specially when we calculate 700 or so outputs we can do a batched invert when converting to bytes :)

but tbh for a bunch of stuff done, whatever comes out of github.com/mit-plv/fiat-crypto is what gets used :)

with maybe some github.com/mmcloughlin/addchain thrown around to generate addchains for specific field exponentation calls usually

<slowbeardigger:matrix.org> Will catch up with you later > <DataHoarder> then there's some batch specific optimizations that work quite well on p2pool, monero had some added my kayaba

<slowbeardigger:matrix.org> Been nonstop