Reduce scalar reduction from byte-wise to limb-wise arithmetic - #12
Merged
Merged
Conversation
zz-sol
approved these changes
Aug 28, 2026
| /// | ||
| /// Evaluated at compile time so that limb constants are derived from their byte | ||
| /// counterparts rather than transcribed by hand a second time. | ||
| const fn to_le_limbs(bytes: [u8; 32]) -> [u64; 4] { |
Collaborator
There was a problem hiding this comment.
For my own learning. my instinct is to do a unsafe transmute here -- but LLM told me that this would not save anything as for SBF programs, const functions are always 0 cost. Interesting!
| // chain, so it is cross-checked against curve25519-dalek's own wide | ||
| // reduction rather than against a second copy of the same reasoning. | ||
| #[test] | ||
| fn matches_curve25519_dalek_wide_reduction() { |
Collaborator
There was a problem hiding this comment.
should we add a few randomized tests with inputs >= order?
Contributor
Author
There was a problem hiding this comment.
Okay, yep I'll add this in a follow-up PR since I still need to add Barret Reduction.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
Currently, the
reduce_widefunction performs 512-iteration long division over[u8; 32], doing a 32-byte shift and a 32-byte borrow thereby propagating subtract per iteration. I tried carrying the remainder as[u64; 4]and fusing the comparison with the subtraction, which cut per-iteration cost from ~418 CU to ~52 CU.Verifying one signature over a 38-byte message got reduced significantly 217,045 → 29,858 CU (7.3×). One can test this by calling
make cu-programon the main branch and in this PR branch.On a follow-up, I want to try replacing the 512-iteration loop with Barrett reduction. I think our CUs are still quite high compared to other similar cryptographic libraries.