Benchmarking: k256 falls short to fiat-crypto and crypto-bigint about elliptic-curves HOT 7 CLOSED

I don't think it is entirely correct to compare Residue and k256::Scalar multiplication, because for Residue you have to factor in conversion/retrieval time. I expect Residue would be faster when you have to do a long series of calculations, but Scalar is optimized for one-off operations.

from elliptic-curves.

Aah yes, Residue and fiat-crypto are both using Montgomery form internally, and there's a penalty to convert in and out of Montgomery form

from elliptic-curves.

cc @fjarri

from elliptic-curves.

I don't think a whole lot of work has been done on optimizing the scalar field in k256. If either of these are faster it might be worth considering switching.

from elliptic-curves.

Aah yes, Residue and fiat-crypto are both using Montgomery form internally, and there's a penalty to convert in and out of Montgomery form

Convert from which form to Montgomery form?
And where does that penalty take place? When would I need to switch back?

from elliptic-curves.

The other form is "canonical form" and is a normal integer.

The fiat-crypto methods are named: fiat_*_from_montgomery, fiat_*_to_montgomery

from elliptic-curves.

Thanks. I didn't know about these different forms, would research more.

I'll update my benchmarking code and update this issue accordingly, after-which I assume it could be closed.

from elliptic-curves.