codex-storage/constantine
1
0
Fork 0
mirror of https://github.com/codex-storage/constantine.git synced 2025-01-14 21:14:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
constantine/benchmarks/bench_fp.nim

74 lines
2.0 KiB
Nim
Raw Normal View History

Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
# Constantine
# Copyright (c) 2018-2019 Status Research & Development GmbH
# Copyright (c) 2020-Present Mamy André-Ratsimbazafy
# Licensed and distributed under either of
# * MIT license (license terms in the root directory or at http://opensource.org/licenses/MIT).
# * Apache v2 license (license terms in the root directory or at http://www.apache.org/licenses/LICENSE-2.0).
# at your option. This file may not be copied, modified, or distributed except according to those terms.
import
# Internals
Don't dump all in "backend" (#184) * backend -> math * towers -> extension fields * move ISA and compiler specific code out of math/ * fix export
2022-02-27 01:49:08 +01:00
../constantine/math/config/curves,
../constantine/math/arithmetic,
../constantine/math/io/io_bigints,
Fp12 over fp6 (#201) * introduce sumprod for direct fp6_mul * change curves -> constants * forgotten constants * Full pairing using Fp2->Fp6->Fp12 towering
2022-08-14 09:48:10 +02:00
../constantine/math/constants/zoo_square_roots,
Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
# Helpers
Field sqrt optimization (#168) * add more Fp tests for Twisted Edwards curves * add fused sqrt+division bench * Significant fused sqrt+division improvement for any prime field over algorithm described in "High-Speed High-Security Signature", Bernstein et al, p15 "Fast decompression", https://ed25519.cr.yp.to/ed25519-20110705.pdf * Activate secp256k1 field benches + spring renaming of field multiplication * addition chains for inversion and sqrt of Curve25519 * Make isSquare use addition chains * add double-prec mul/square bench for <256-bit prime fields.
2022-01-01 16:19:35 +01:00
./bench_fields_template
Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
# ############################################################
#
# Benchmark of 𝔽p
#
# ############################################################
Square Root & Inversion addition chains - 20% perf increase (#132) * Addition chain for sqrt BLS12-381: 20% perf improvement * sqrt addchain for BN254_Snarks - 20% perf improvement as well * Fix operation count [skip ci] * BLS12-377 sqrt - 10% perf improvement * sqrt addition chain for BW6-761 - 6% speedup * BN254_Nogami inversion addchain * sqrt addchain for BN254_Nogami * Inversion addchain for BLS12-377 * inversion ddition chain for BW6-761
2021-01-23 20:55:40 +01:00
const Iters = 100_000
const ExponentIters = 100
Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
const AvailableCurves = [
Implement fused sqrt invsqrt on Fp: Accelerate sqrt on Fp2 by 20% (hashToG2 and property-based testing bottleneck, 4 times slower than inversion and 87 times slower than Fp2 multiplication)
2020-06-17 22:44:52 +02:00
# P224,
BLS12-377 (#91) * add Sage for constant time tonelli shanks * Fused sqrt and invsqrt via Tonelli Shanks * isolate sqrt in their own folder * Implement constant-time Tonelli Shanks for any prime * Implement Fp2 sqrt for any non-residue * Add tests for BLS12_377 * Lattice decomposition script for BLS12_377 G1 * BLS12-377 G1 GLV ok, G2 GLV issue * Proper endomorphism acceleration support for BLS12-377 * Add naive pairing support for BLS12-377 * Activate more bench for BLS12-377 * Fix MSB computation * Optimize final exponentiation + add benches
2020-09-27 09:15:14 +02:00
BN254_Nogami,
Properly distinguish between Nogami and Snark/Ethereum BN254 closes #19
2020-04-12 03:01:50 +02:00
BN254_Snarks,
Don't dump all in "backend" (#184) * backend -> math * towers -> extension fields * move ISA and compiler specific code out of math/ * fix export
2022-02-27 01:49:08 +01:00
Edwards25519,
Field sqrt optimization (#168) * add more Fp tests for Twisted Edwards curves * add fused sqrt+division bench * Significant fused sqrt+division improvement for any prime field over algorithm described in "High-Speed High-Security Signature", Bernstein et al, p15 "Fast decompression", https://ed25519.cr.yp.to/ed25519-20110705.pdf * Activate secp256k1 field benches + spring renaming of field multiplication * addition chains for inversion and sqrt of Curve25519 * Make isSquare use addition chains * add double-prec mul/square bench for <256-bit prime fields.
2022-01-01 16:19:35 +01:00
Bandersnatch,
Pasta curves (#191) * Pasta curves field arithmetic * implement elliptic curve arith for the Pasta curves
2022-04-27 00:58:48 +02:00
Pallas,
Vesta,
Field sqrt optimization (#168) * add more Fp tests for Twisted Edwards curves * add fused sqrt+division bench * Significant fused sqrt+division improvement for any prime field over algorithm described in "High-Speed High-Security Signature", Bernstein et al, p15 "Fast decompression", https://ed25519.cr.yp.to/ed25519-20110705.pdf * Activate secp256k1 field benches + spring renaming of field multiplication * addition chains for inversion and sqrt of Curve25519 * Make isSquare use addition chains * add double-prec mul/square bench for <256-bit prime fields.
2022-01-01 16:19:35 +01:00
P256,
Secp256k1,
BLS12-377 (#91) * add Sage for constant time tonelli shanks * Fused sqrt and invsqrt via Tonelli Shanks * isolate sqrt in their own folder * Implement constant-time Tonelli Shanks for any prime * Implement Fp2 sqrt for any non-residue * Add tests for BLS12_377 * Lattice decomposition script for BLS12_377 G1 * BLS12-377 G1 GLV ok, G2 GLV issue * Proper endomorphism acceleration support for BLS12-377 * Add naive pairing support for BLS12-377 * Activate more bench for BLS12-377 * Fix MSB computation * Optimize final exponentiation + add benches
2020-09-27 09:15:14 +02:00
BLS12_377,
Add more curves for testing: Curve25519, BLS12-377, BN446, FKM-447, BLS12-461, BN462
2020-03-21 13:05:58 +01:00
BLS12_381,
Square Root & Inversion addition chains - 20% perf increase (#132) * Addition chain for sqrt BLS12-381: 20% perf improvement * sqrt addchain for BN254_Snarks - 20% perf improvement as well * Fix operation count [skip ci] * BLS12-377 sqrt - 10% perf improvement * sqrt addition chain for BW6-761 - 6% speedup * BN254_Nogami inversion addchain * sqrt addchain for BN254_Nogami * Inversion addchain for BLS12-377 * inversion ddition chain for BW6-761
2021-01-23 20:55:40 +01:00
BW6_761
Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
]
proc main() =
Add EC bench on G1 + Add throughput to benches
2020-04-15 19:38:02 +02:00
separator()
Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
staticFor i, 0, AvailableCurves.len:
const curve = AvailableCurves[i]
addBench(Fp[curve], Iters)
subBench(Fp[curve], Iters)
negBench(Fp[curve], Iters)
Jacobian coordinates (#95) * Add projective-> affine bench * Add conditional copy and div2 benches * Fp4 benchmarks * Constant-time Jacobian addition * Jacobian doubling * Use a simpler Add+Dbl complete formula * Update tests * Fix conditional negate * Rollaback complete addition, we were only handling curve coef a == 0
2020-10-02 00:01:09 +02:00
ccopyBench(Fp[curve], Iters)
div2Bench(Fp[curve], Iters)
Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
mulBench(Fp[curve], Iters)
sqrBench(Fp[curve], Iters)
Field sqrt optimization (#168) * add more Fp tests for Twisted Edwards curves * add fused sqrt+division bench * Significant fused sqrt+division improvement for any prime field over algorithm described in "High-Speed High-Security Signature", Bernstein et al, p15 "Fast decompression", https://ed25519.cr.yp.to/ed25519-20110705.pdf * Activate secp256k1 field benches + spring renaming of field multiplication * addition chains for inversion and sqrt of Curve25519 * Make isSquare use addition chains * add double-prec mul/square bench for <256-bit prime fields.
2022-01-01 16:19:35 +01:00
smallSeparator()
Fp12 over fp6 (#201) * introduce sumprod for direct fp6_mul * change curves -> constants * forgotten constants * Full pairing using Fp2->Fp6->Fp12 towering
2022-08-14 09:48:10 +02:00
mul2xUnrBench(Fp[curve], Iters)
sqr2xUnrBench(Fp[curve], Iters)
rdc2xBench(Fp[curve], Iters)
smallSeparator()
sumprodBench(Fp[curve], Iters)
Pairings optimizations (#178) * bench for cyclotomic square, exp and rename cyclotomic exp + multipairings for BLS12-377 * refactor/unify lines and cyclotomic functions * Add Karabina's compressed squaring * Use compressed squarings in final exponentiation * Weighted addchain for bn254_snarks * Add new towering options and cost functions * Rearrange bench summaries * fix BW6-761
2022-02-20 20:15:20 +01:00
smallSeparator()
Low-level refactoring (#175) * Add specific fromMont conversion routine. Rename montyResidue to getMont * missed test file * Add x86_64 ASM for fromMont * Add x86_64 MULX/ADCX/ADOX for fromMont * rework Montgomery Multiplication with prefetch/latency hiding techniques * Fix ADX autodetection, closes #174. Rollback faster mul_mont attempt, no improvement and debug pain. * finalSub in fromMont & adx_bmi -> adx * Some {.noInit.} to avoid Nim zeroMem (which should be optimized away but who knows) * Uniformize name 'op+domain': mulmod - mulmont * Fix asm codegen bug "0x0000555555565930 <+896>: sbb 0x20(%r8),%r8" with Clang in final substraction * Prepare for skipping final substraction * Don't forget to copy the result when we skip the final substraction * Seems like we need to stash the idea of skipping the final substraction for now, needs bounds analysis https://eprint.iacr.org/2017/1057.pdf * fix condition for ASM 32-bit * optim modular addition when sparebit is available
2022-02-14 00:16:55 +01:00
toBigBench(Fp[curve], Iters)
toFieldBench(Fp[curve], Iters)
smallSeparator()
Fast modular inversion (#172) * split modular inversion in its own file * Stash fast GCD inversion https://eprint.iacr.org/2020/972.pdf * Stash Pornin's bingcd -> issue with inner modular reduction * Implement Bernstein-Yang inversion * Avoid Nim checks on signed integers (32-bit runtime issue) * cleanup: remove old inversion impls * cleanup: static moduli, move div2 * small comments (skip ci) * comment cleanup (skip ci) * fix total iterations on 32-bit * Add batch conversion to affine coordinates using simultaneous inversion trick * fix conditional setZero and batchAffine conversion * cleanup unneeded branches following affine conversion unification * Fix batchAffine with zero inputs and add fuzz failure to test suite
2022-02-10 14:05:07 +01:00
invBench(Fp[curve], ExponentIters)
bench isSquare
2022-08-07 19:50:28 +02:00
isSquareBench(Fp[curve], ExponentIters)
Field sqrt optimization (#168) * add more Fp tests for Twisted Edwards curves * add fused sqrt+division bench * Significant fused sqrt+division improvement for any prime field over algorithm described in "High-Speed High-Security Signature", Bernstein et al, p15 "Fast decompression", https://ed25519.cr.yp.to/ed25519-20110705.pdf * Activate secp256k1 field benches + spring renaming of field multiplication * addition chains for inversion and sqrt of Curve25519 * Make isSquare use addition chains * add double-prec mul/square bench for <256-bit prime fields.
2022-01-01 16:19:35 +01:00
sqrtBench(Fp[curve], ExponentIters)
sqrtRatioBench(Fp[curve], ExponentIters)
Implement fused sqrt invsqrt on Fp: Accelerate sqrt on Fp2 by 20% (hashToG2 and property-based testing bottleneck, 4 times slower than inversion and 87 times slower than Fp2 multiplication)
2020-06-17 22:44:52 +02:00
# Exponentiation by a "secret" of size ~the curve order
powBench(Fp[curve], ExponentIters)
powUnsafeBench(Fp[curve], ExponentIters)
Add EC bench on G1 + Add throughput to benches
2020-04-15 19:38:02 +02:00
separator()
Benchmark template for 𝔽p, 𝔽p2, 𝔽p6
2020-03-21 02:31:31 +01:00
main()
Assembly backend (#69) * Proof-of-Concept Assembly code generator * Tag inline per procedure so we can easily track the tradeoff on tower fields * Implement Assembly for modular addition (but very curious off-by-one) * Fix off-by one for moduli with non msb set * Stash (super fast) alternative but still off by carry * Fix GCC optimizing ASM away * Save 1 register to allow compiling for BLS12-381 (in the GMP test) * The compiler cannot find enough registers if the ASM file is not compiled with -O3 * Add modsub * Add field negation * Implement no-carry Assembly optimized field multiplication * Expose UseX86ASM to the EC benchmark * omit frame pointer to save registers instead of hardcoding -O3. Also ensure early clobber constraints for Clang * Prepare for assembly fallback * Implement fallback for CPU that don't support ADX and BMI2 * Add CPU runtime detection * Update README closes #66 * Remove commented out code
2020-07-24 22:02:30 +02:00
notes()
Reference in New Issue Copy Permalink