Two major optimizations targeting ARM64 mobile phones:
1. LAZY FIELD ADDITION (both platforms):
fe_add no longer calls fe_normalize. Values may be in [0, 2^256)
between operations. This is safe because:
- fe_mul/fe_sqr reduction handles any 256-bit input
- fe_negate normalizes its input before P - a
- fe_is_zero/fe_equal/fe_to_bytes normalize their copies
Saves ~6 normalize calls per gej_double (called 130x per verify).
Impact: gej_add_ge 372→316ns (15%), gej_double 224→206ns (8%).
2. FULL ARM64 ASM fe_mul (ARM64 only):
Complete 4x4 multiply + reduction in inline assembly using:
- LDP/STP for load/store pairs (halves memory instructions)
- MUL+UMULH with interleaved scheduling across columns
(hides 3-cycle multiply latency behind independent additions)
- Full reduction in ASM with MUL+UMULH+ADDS carry chain
- 20 registers used (ARM64 has 31 — zero stack spills)
- Row 1 and 3 interleave b0+b2 products with b1+b3 for ILP
Expected ARM64 improvement: fe_mul ~20-25ns → ~13-15ns
x86_64 benchmark (measured on this machine):
gej_add_ge: 372→316ns (15% faster)
ECDH: 35.4→32.6µs (8% faster, now tied with ACINQ)
batch(200): 1596→1437µs (10% faster, 7.2µs/event)
https://claude.ai/code/session_011KVZhDcV2G7idNWEBz12GY
Claude
41a49b639f