k256: replace wnaf with built-in vartime scalar mul/lincomb#1810
Merged
Conversation
Follows suit with #1798 and removes the integration with the `wnaf` crate originally added in #1745. This removes `wnaf` as a stabilization block for the time being. We can always add it back. The result is ~20% slower, but doesn't require `alloc`, and avoids the need to stabilize `wnaf` to stabilize `k256`. high-level operations/point-scalar mul (variable-time) time: [33.719 µs 33.895 µs 34.123 µs] change: [+15.985% +18.087% +20.911%] (p = 0.00 < 0.05) Performance has regressed. ecdsa/verify_prehashed time: [55.777 µs 56.194 µs 56.685 µs] change: [+9.2821% +13.258% +17.003%] (p = 0.00 < 0.05) Performance has regressed. The performance regression is fairly significant though, so we should investigate bringing it back when stabilization blockers are resolved.
tarcieri
force-pushed
the
k256/replace-wnaf-with-built-in-vartime
branch
from
b15b88c to
2289110
Compare
tarcieri
added a commit
that referenced
this pull request
Jun 17, 2026
Support for w-NAF was removed in #1810 which replaced it with a variable-time path through the existing scalar multiplication / linear combination implementation, first because that works without an `alloc` dependency, and secondly so we can stabilize `k256` without having to stabilize the `wnaf` crate first (or find a solution to use the upstream implementation in the `group` crate, since we need many changes to make that work with the GLV endomorphism). But that may have been too hasty when there's another option: vendor the parts of the `group`/`wnaf` implementation we actually need, with the goal of eventually migrating onto an upstream crate (most likely `wnaf`, which is located in-repo here and therefore easy to co-develop). This brings back w-NAF support that was removed in #1810 but also leaves the (slower) variable-time implementation that doesn't require `alloc` in-place and using it when it's unavailable, only using w-NAF when `alloc` is enabled. So regardless of if `alloc` is enabled there is a variable-time fast path. The performance gains definitely seem to be worth it: ecdsa/verify_prehashed time: [46.603 µs 46.699 µs 46.802 µs] change: [−18.301% −16.734% −15.271%] (p = 0.00 < 0.05) Performance has improved. high-level operations/point-scalar mul (variable-time) time: [29.060 µs 29.138 µs 29.218 µs] change: [−15.332% −14.118% −12.622%] (p = 0.00 < 0.05) Performance has improved. schnorr/verify time: [44.450 µs 44.554 µs 44.659 µs] change: [−17.402% −16.639% −15.827%] (p = 0.00 < 0.05) Performance has improved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows suit with #1798 and removes the integration with the
wnafcrate originally added in #1745. This removeswnafas a stabilization block for the time being. We can always add it back.The result is ~20% slower, but doesn't require
alloc, and avoids the need to stabilizewnafto stabilizek256.The performance regression is fairly significant though, so we should investigate bringing it back when stabilization blockers are resolved.