feat(crypto): comb-accelerated onchip profile — 31.0 s handshake @64 MHz - #62
Merged
Conversation
USE_NISTCURVES_ONCHIP_COMB=1 (implies USE_NISTCURVES_ONCHIP): consume the sibling's comb ecdsa256 + points256_comb + Lim-Lee data (composed from the full onchip archive, trimmed to the P-256 set), add the ec_precompute_256 boot pass (REU bank 2 $0000-$3FFF anchors, SPEC §8.5), and gate out the in-tree no-comb ec_scalar_mul shim under the flag. CRYPTO_HOT can't absorb the +1.1 KB comb code (29 B slack), so the profile uses cfg/c64-https-uci-onchip.cfg — a documented variant that moves RODATA/CRYPTO_RODATA/P256_RODATA + the new LIMLEE segment into the free CRYPTO_OVERLAY (COLD_SHADOW is flush-full). Boot cost: ec_precompute_256 is ~50 s at 64 MHz / ~3.5 min at 16 / ~40 min at stock — bench + e2e scripts grew C64_INIT_WAIT and the bench now boots at the first sweep speed (it used to inherit leftover device config). KAT script grew C64_INIT_TIMEOUT for the same reason. Measured (C64U): verify 49.4/24.9/16.5/12.4 s at 16/32/48/64 MHz (D~0.2 s, C=787 MHz*s); REU-profile crossover drops to ~7 MHz; comb dominates no-comb onchip at every clock. HTTPS e2e: 38.4 s @48, **31.0 s @64** — at the top edge of the 10-30 s real-server window. VICE KAT oracle 3/3 (precompute + comb u1*G path); all hardware runs oracle-gated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UZmMaxyyykvYbCvJAc4QVW
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adopts the comb-accelerated
u1·Gpath on top of the v0.6.0 onchip profile, per the follow-up noted in #62's predecessor (#61).Measurements (C64U)
Integration
USE_NISTCURVES_ONCHIP_COMB=1(implies onchip): archive composed from upstream's full onchip archive trimmed to the P-256 comb set;ec_precompute_256boot pass (REU bank 2 anchors); in-tree no-combec_scalar_mulshim gated out.cfg/c64-https-uci-onchip.cfgvariant (documented deltas): ro segments + LIMLEE →CRYPTO_OVERLAY(CRYPTO_HOT had 29 B slack; COLD_SHADOW is flush-full). Default/onchip-no-comb builds keep the base cfg untouched.C64_INIT_WAIT/C64_INIT_TIMEOUT, and the bench now boots at the first sweep speed instead of inheriting leftover device config.Correctness
u1·G→ CAVP verdicts); all hardware runs oracle-gated PASS.🤖 Generated with Claude Code
https://claude.ai/code/session_01UZmMaxyyykvYbCvJAc4QVW