01:10:46 slowbeardigger:matrix.org: I have one extra testcase on https://git.gammaspectra.live/P2Pool/consensus/src/branch/fcmp++-proof/monero/crypto/curve25519/montgomery_test.go#L25 if you want to check compliance (plus other tests) 01:11:04 my implementation is on https://git.gammaspectra.live/P2Pool/consensus/src/branch/fcmp++-proof/monero/crypto/curve25519/montgomery.go MontgomeryUnclampedScalarMult for reference 01:11:05 Thank you! will check 01:11:39 will check after my coffee is ready 01:15:33 for reference the Go code is no-alloc as well, and runs at 2466 ns/op 0 B/op 0 allocs/op on a ECO-mode low-throttled 9950X3D single-core 01:17:16 I also have a batch unclamped scalar mult api, but that's not alloc-free (some slices that are ephemeral still get tracked as allocs, even when they will most of the time land on stack) 01:18:07 That’s really interesting. 01:18:27 Could you pls share the same result with -cpu=1 or GOMAXPROCS=1? if you get a chance ofc 01:19:09 right, that test is trying to do parallel, my bad. it shouldn't need to be, one sec :D 01:19:29 I never updated this code to use the new nicer single-core methods 01:19:37 DataHoarder: no problemou 01:20:49 I was wondering because 2466 ns/op would be wild for single-call latency 01:20:55 it is wild :) 01:21:03 I was currently profiling it cause it looked fast 01:21:10 BenchmarkX25519ScalarMult-24 198880 30020 ns/op 0 B/op 0 allocs/op 01:21:19 -24 but it's running on one core 01:22:47 -24 suffix is just the GOMAXPROCS setting? 01:22:47 about the same ballpark as my x86 BMI2+ADX result (~28.9 us on a GitHub runner) 01:22:49 fucking impresive 01:23:07 I did optimize the field elements a bit :) 01:23:48 legend 01:24:44 I run a fork on https://git.gammaspectra.live/P2Pool/edwards25519 and there is asm for field mul / field square 01:26:17 but field inversion / specialized types for x^((p-5)/8) or x^((p-3)/8) were made 01:26:25 DataHoarder: AHHHHHH 01:26:27 and for X25519 I have a method to do x * 121666 specifically 01:26:37 no BMI2 or ADX though! 01:27:22 no BMI2/ADX and still ~30 us is damn good 01:27:32 would love a same-host carrot25519 run on that 9950X3D 👀 01:27:44 just for the numbers 👀 👀 👀 👀 👀 01:28:09 you can run mine :D 01:28:20 will do 01:35:57 off this tree https://git.gammaspectra.live/P2Pool/consensus/src/commit/50b53aaf36771be85e599ea8783a2f611494a37e 01:38:13 also, 9900X3D, not 9950X3D, I misspoke :P 01:39:08 still a beast 01:39:20 your carrot25519_mul_base has an equivalent on mine, constant time and vartime too: 01:39:55 BenchmarkX25519ScalarBaseMult/Constant 496590 11425 ns/op 0 B/op 0 allocs/op 01:39:55 BenchmarkX25519ScalarBaseMult/VarTime 698203 8371 ns/op 0 B/op 0 allocs/op 01:40:59 in my case it's faster to do the scalar mult and encode to Montgomery :) 01:41:31 for Carrot specific environment that is acceptable when producing them 01:43:05 Agreed that makes sense for carrot key gen 01:43:32 Probably best as a separate scalar fast path? While the mul keeps unchanged 01:43:53 vartime allows precalc stuff yes :) 01:44:15 Ran your commit on my M1 base 01:44:29 44.16 us for arbitrary point 01:44:56 https://privatebin.net/?2afb4008fb9990ce#BMBRR6jyF98q1cZNcsjoA3YDPnLCTKsatz9DyaHrwwo5 01:45:01 Your field ops is awesome 01:45:14 My laptop got stupid running some.benchmark 01:45:20 Had to move to my phone here 01:46:05 Good thing isogenies exist, or else we'd just be throwing all of this curve stuff out the window 01:46:42 don't run every benchmark there lol, just the ones on that specific subpath 01:46:58 Too late 01:47:04 laptop goes brrrr 01:47:11 there's some benchmark or tests on mining if you keep pulling deps, so at some point you are mining lol 01:47:26 ill just let it be 01:47:37 turning on my backup laptop 01:49:11 the code you posted still performs faster, ofc, all hail slow compilers 01:50:21 still, your Go numbers are seriously good, and now I have a base fast path to investigate 👀 01:51:50 see VarTimeScalarMultPrecomputed and ScalarMultPrecomputed on that forked repo, it's where I placed that + tables that get computed 01:52:38 noted, will check it out sounds like exactly the direction I need 👀 01:53:38 though most of the speedups I get along the code is due to having DoubleScalarMult or DoubleScalarBaseMult specific paths, which happens a lot in monero (each also has a VarTime option), specially when I can precompute the two bases (like for monero commitments or other areas with monero specific generators) 01:55:02 you’re optimizing the actual monero equations rather than isolated scalar mult 👀 01:56:26 https://irc.gammaspectra.live/e4e75e2478593cea/image.png 01:56:28 stuff like this 01:56:35 where one generator is G, other is T 01:56:44 so both are public and can be precomputed 01:57:11 Seems like i wont work tomorrow focusing on this 01:57:35 or for scanning carrot https://irc.gammaspectra.live/a77917e33334f4b4/image.png 01:59:46 sadly a lot of the new stuff ends up with a variable amount of chained scalar mults so I just feed everything to my MultiScalarMult :) but maybe I should add some mixed method there that has a precalc section beforehand as that would be cheaper 02:01:20 that feels like the next move 02:02:02 then there's some batch specific optimizations that work quite well on p2pool, monero had some added my kayaba 02:02:06 by* 02:02:30 specially when we calculate 700 or so outputs we can do a batched invert when converting to bytes :) 02:04:04 but tbh for a bunch of stuff done, whatever comes out of https://github.com/mit-plv/fiat-crypto is what gets used :) 02:05:07 with maybe some https://github.com/mmcloughlin/addchain thrown around to generate addchains for specific field exponentation calls usually 22:19:17 Will catch up with you later > then there's some batch specific optimizations that work quite well on p2pool, monero had some added my kayaba 22:19:18 Been nonstop