catid / snowshoe Goto Github PK

I know you're not currently actively developing this (though maybe there is more interest in weird curves now that the GLV patent has expired...), but I thought I'd send you a note-- close the issue when you've seen it. :p

Your existing fermat inverse is super duper fast because you mostly only need to work over the base field and mersenne numbers result in really nice ladders but there is a new approach that could be faster that you might be interested in: See https://github.com/bitcoin-core/secp256k1/blob/master/doc/safegcd_implementation.md which describes the implementation in libsecp256k1 (and links to the safegcd paper that inspired the work).

At 256 bits the speedup over a ladder is enormous, for 2^127-1 I expect it to be faster but it's possible that it wouldn't be. If you're ever interested in trying it out, feel free to drop me a line. It should be trivial to modify our code for your sized numbers (it already works but will waste some time due to working with 256 bit numbers) -- I would have done it just to post benchmarks but that would have required me to figure out how to benchmark your code. :P

I haven't been able to reproduce the performance figures that are listed in the README.

I used Intel i5-2500K (Sandy Bridge from 2011) running at 3.29 GHz (Turbo disabled), Windows 10 and binaries built with Visual Studio 2019 in x64 Release configuration.

Snowshoe Unit Tester: EC Scalar Multiplication
RDTSC instruction runs at 3.29252 GHz
+ ec_elligator: `33772` median cycles, `10.3136` avg usec
+ ec_mul_gen: `114412` median cycles, `34.8923` avg usec
+ ec_mul: `337620` median cycles, `102.747` avg usec
+ ec_simul_gen: `389280` median cycles, `118.303` avg usec
+ ec_simul: `469072` median cycles, `142.706` avg usec

This is 2-2.5 times slower than the presented cycle counts for Sandy Bridge. Any explanation for this discrepancy? Are some optimizations not enabled for Windows/MSVC?

Hi. What license does this project use? MIT or BSD or similar?

Can you please remove or rephrase the hand waving comment in the ecdh description to clarify that you're referring only to the double application, not the rough proof as a whole?