aarch64 assembler support

[embetrix]

from the cmake and sources it's seems that there is no assembler optimization for aarch64 but only arm32 is supported, is this planned for support ?

[real-or-random]

This is not planned.

[embetrix]

On raspberrypi5 with libsecp256k1 I get:

root@raspberrypi5-c8-bf-64:~# secp256k1_bench
Benchmark , Min(us) , Avg(us) , Max(us)

ecdsa_verify , 157.0 , 157.0 , 158.0
ecdsa_sign , 69.5 , 69.5 , 69.5
ec_keygen , 57.8 , 57.9 , 58.0
ecdh , 152.0 , 152.0 , 152.0
schnorrsig_sign , 59.5 , 59.5 , 59.5
schnorrsig_verify , 158.0 , 158.0 , 158.0
ellswift_encode , 44.7 , 44.7 , 44.7
ellswift_decode , 24.2 , 24.3 , 24.3
ellswift_keygen , 102.0 , 103.0 , 103.0
ellswift_ecdh , 158.0 , 158.0 , 158.0

with https://github.com/shrec/UltrafastSecp256k1 here are the perfomance:

root@raspberrypi5-c8-bf-64:~# fastsecp256k1_example
=== UltrafastSecp256k1 — Basic Usage Example ===

[1] Running self-test...
Result: PASS

[2] Key generation
Private key : e8f32e723decf4051aefac8e2c93c9c5b214313817cdb01a1494b917c8436b35
Public (comp): 0339a36013301597daef41fbe593a02cc513d0b55527ec2df1050e2e8ff49c85c2
Public (uncomp): 0439a36013301597daef41fbe593a02cc513d0b55527ec2df1050e2e8ff49c85c23cbe7ded0e7ce6a594896b8f62888fdbc5c8821305e2ea42bf01e37300116281

[3] Point arithmetic
G x = 79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
2G x = c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5
3G x = f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9

[4] Scalar arithmetic
7 * 13 mod n = 000000000000000000000000000000000000000000000000000000000000005b
Expected 91 = ...5b (last byte)

[5] Benchmark: k * G (1000 iterations)
Total : 0.5 ms
Per op: 0.5 us
(sink = 0x00)

=== Done ===

[real-or-random]

This would be more than 100x faster. Not entirely implausible, but I'm not sure if these benchmarks are meaningful.

[sipa]

Looking at that codebase, could it be GPU accelerated?

[embetrix]

Not using GPU nor OpenCL with this test on rpi, just built it withaarch64 optimization, this is why my original question. there are a lot of bitcoin node solutions running on pi or derivative and would benefits greatly from this.

[sipa]

That codebase is computing 1 * G, 2 * G, ..., 1000 * G, using a variable-time multiplication algorithm (which isn't appropriate for private key operations). Because the scalars are so small, it's only doing an non-representative amount of work.

It takes on 0.2 us on my Ryzen 5950X CPU. If I change the benchmark to use random-looking 256-bit scalars, it takes 13.5 us. libsecp256k1 on the same machine takes 13.4 us per point multiplication, with a constant-time algorithm (ec_keygen test).

diff --git a/examples/basic_usage/main.cpp b/examples/basic_usage/main.cpp
index d3d07c1..a22182b 100644
--- a/examples/basic_usage/main.cpp
+++ b/examples/basic_usage/main.cpp
@@ -76,7 +76,7 @@ int main() {
     printf("[5] Benchmark: k * G  (1000 iterations)\n");
     constexpr int ITERS = 1000;
     auto k = Scalar::from_hex(
-        "0000000000000000000000000000000000000000000000000000000000000001");
+        "b5037ebecae0da656179c623f6cb73641db2aa0fabe888ffb78466fa18470379");
     volatile uint8_t sink = 0;
 
     double t0 = now_us();

This is using asm optimizations for both libraries. I don't have arm64 hardware to compare on.

[shrec]

hello can you make new benchmarks of latest version please ? I have improved CPU side and working on CT improvements also will be very helpful