Repository navigation
x86-64 Ed25519: order the comb's affine addition by its dependencies - #1351
Merged
Merged
Conversation
The fixed-base comb's addition of a cached affine point computed each sum or difference immediately before the multiplication that reads it, so a multiplication started while the addition's carry chain was still on its way to memory, and the independent multiplications were spread out. Ordering the operations by their dependencies instead - the three sums and differences, then the three multiplications of them, then the four sums and differences, then the four final multiplications - is the same formula with the same operations, so the proof is unchanged (`evalOps` of the list, by `rfl`), and leaves nothing waiting. On a Sapphire Rapids Xeon restricted to `avx,avx2,bmi1,bmi2,adx` (the `_adx` variants, as on a CPU without AVX512_IFMA), of three interleaved runs: Ed25519 key generation 3.9% faster, signing of 64 bytes 3.4%, X25519 key generation 3.4% and its public keys 4.1%. Verification and the X25519 ladder, which do not use this addition, are unchanged. From the analysis of the rustls provider's handshake signing in #991: without AVX512_IFMA, `vg_ed25519_sign_cached_avx2_adx` spends most of its time in this addition, 52 times per signature. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RLVbycsRXKPfaW1swVZejG
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fixed-base comb's addition of a cached affine point (
pointAddAffineOps) computed each sum or difference immediately before the multiplication that reads it, so a multiplication started while the addition's carry chain was still on its way to memory, and the independent multiplications were spread out.This orders the operations by their dependencies instead — the three sums and differences, then the three multiplications of them, then the four sums and differences, then the four final multiplications. It is the same formula with the same operations, so the proof is unchanged:
pointAddAffine_formulais stillrflonevalOpsof the list, and no proof or contract moved.Measurements
On a Sapphire Rapids Xeon restricted to
VG_CPU_FEATURES=avx,avx2,bmi1,bmi2,adx(the_adxvariants, as on a CPU without AVX512_IFMA), fastest of three interleaved runs of each side:ed25519_keygen/32ed25519_sign/64x25519_generate/32x25519_public_key/32Ed25519 verification and the X25519 ladder, which do not use this addition, are unchanged (within noise).
Why
From the analysis of the rustls provider's handshake signing in #991: on a CPU without AVX512_IFMA, Ed25519 signing is the gap against aws-lc-rs (0.79 of its speed on a Cascade Lake–class Xeon), and nearly all of
vg_ed25519_sign_cached_avx2_adx's time outside SHA-512 is the fixed-base multiplication, which performs this addition 52 times per signature. Measured against s2n-bignum'sedwards25519_pepaddon the same machine, our addition was 117 ns against its 88 ns with the same seven field multiplications; the ordering is most of that difference.🤖 Generated with Claude Code
https://claude.ai/code/session_01RLVbycsRXKPfaW1swVZejG
Generated by Claude Code