pbsd

7 ms·

1.
by pbsd 1mo ago
The cycle count for RDTSC is ~25 cycles on Skylake-era microarchitectures. The 49 number shown in the OP seems off.
2.
by pbsd 6mo ago
I mean, he's comparing 2024 Zen 5 and M4 against two generations behind 2022 Intel Raptor Lake. The Lion Cove should be roughly on par with the M4 on this test.
3.
by pbsd 10mo ago
Because the function is not quite correct. It should be return n ? (1u + popcount(n & n - 1u)) : 0u; which both Clang and GCC promptly optimize to a single popcnt.
4.
by pbsd 10mo ago
This can be translated to the discrete domain pretty easily, just like the NTT. Pick a sufficiently large prime with order 15k, say, p = 2^61-1. 37 generates the whole multiplicative group, and 37^((2^61-2)/3) and 37^((2^61-2)/5)
5.
by pbsd 11mo ago
No, the generated code seems to be mostly the same as the manual version: https://gcc.godbolt.org/z/aK8orbKE8 The main difference there seems to be that GCC treats the if() as unlikely to be taken while the for() as li
6.
by pbsd 1y ago
The SIKE comparison is not particularly inconsistent since Bernstein has been banging the drum that structured lattices may not be as secure as thought for years now. Currently the best attacks on NTRU, Kyber, etc, are essentially the same
7.
by pbsd 1y ago
I thought this was gonna be about the actual Scream stream cipher: https://eprint.iacr.org/2002/019
8.
by pbsd 1y ago
Cimino's Heaven's Gate (1980) is usually pointed as the movie that caused the "no animals were harmed" disclaimer to be added to subsequent movies.
9.
by pbsd 1y ago
Vector ALU instruction latencies are understandably listed as 2 and higher, but this is not strictly the case. From AMD's Zen 5 optimization manual [1], we have The floating point schedulers have a slow region, in the oldest entr
10.
by pbsd 1y ago
>Even after the static variable has been initialised, the overhead of accessing it is still considerable: a function call to __cxa_guard_acquire(), plus atomic_load_explicit(&__b_guard, memory_order::acquire) in __cxa_guard_acquire()
11.
by pbsd 1y ago
The Pentium 4 had branch hints in the form of taken/not taken prefixes. They were not found to be useful and basically ignored in every subsequent Intel microarchitecture, until Redwood Cove brought back the branch taken prefix in 2023
12.
by pbsd 1y ago
This circuit [1] puts it at <=135k bit operations. Bitcoin uses SHA-256, not SHA-1. [1] https://nigelsmart.github.io/MPC-Circuits/sha256.txt
13.
by pbsd 1y ago
Karatsuba is definitely faster than schoolbook multiplication at practical sizes. You presumably mean Strassen.
14.
by pbsd 1y ago
In page 10, should the ring R be GF(2)[X]/(X^32-1) and the map p be from {0,1}^{32} to R?
15.
by pbsd 2y ago
Interestingly enough, the Square attack (otherwise more generally known as integral cryptanalysis) is much more powerful than regular linear or differential cryptanalysis when applied to the AES.
16.
by pbsd 2y ago
Antoine Joux was on the side of classical cryptanalysis on a 2014 bet. This was right after the small-characteristic discrete log advances, so that might no longer be the bet if it was made today. https://x.com/hashbreaker&#
17.
by pbsd 2y ago
Jasmin is something like this. It is essentially a high-level assembler, will handle register allocation (but not spills) for you, has some basic control flow primitives that map 1-to-1 to assembly instructions. There is also an optional fo
18.
by pbsd 2y ago
It goes way back; check the work of the likes of Thorsten Holz or Christof Paar. TU Graz is another one.
19.
by pbsd 2y ago
Trying some perf events confirms that there is no extra inserted uop. Going back to the SHLX R[i], R[i], RCX loop, we have: No anomaly: 2,190,954,207 cpu_core/cycles:u/
20.
by pbsd 2y ago
Interleaving CQO and SHLX results in ~1.33 throughput with the anomaly, ~2.0 without. This ratio is more or less constant whether it's 1:1 or 2:2 or 4:4 or 8:8 (with 1:1 it's slightly lower at ~1.28). This may or may not be consis
21.
by pbsd 2y ago
Same framework but instead of, say, SHLX RAX, RAX, RCX I do SHLX R[i], R[i], RCX for 8 consecutive registers. Yes, it still does go to both ports.
22.
by pbsd 2y ago
While the observation has previously focused on latency it also affects throughput: whereas you could run 2 independent shifts per cycle before, each shift going to either p0 or p6, this anomaly lowers this to a single shift per cycle. Besi
23.
by pbsd 2y ago
An interesting data point is that Kahn's The codebreakers, from 1967, uses "encipher" everywhere except for various US goverment agency quotes, which use "encrypt."
24.
by pbsd 2y ago
Normal for loops can't really make that work, they're too general, but range for loops plausibly could. Something like for(auto&& e : range) { std::print("{}" e); join { std::pri
25.
by pbsd 2y ago
Yes, that is correct.
26.
by pbsd 2y ago
AVX-512 allows arbitrary shuffles, e.g., shuffle the 64 bytes in zmm0 with indices from zmm1 into zmm2. Simple shuffles like unpacks etc aren't really an issue.
27.
by pbsd 2y ago
A credible but unconfirmed rumor I've read is that Intel didn't want to do it because of the 512-bit shuffles. The E-cores (including those using the upcoming Skymont microarchitecture) are natively 128-bit and already double-pump
28.
by pbsd 2y ago
Koblitz in "Elliptic Curve Cryptosystems" [1] dedicated section 3 to how to embed binary strings into points and back, which is of course necessary for elliptic curve ElGamal. [1] https://doi.org/10.1090/S0025
29.
by pbsd 2y ago
Pollard [1], Nicholson [2], and Schonhage-Strassen [3] seem to have come up with it independently around the same time, using different approaches. Strassen is said to have discovered the Pollard approach in 1968 but there is no (written) r
30.
by pbsd 2y ago
The multiplication in CMAC is there to distinguish between full and partial final input blocks. It can't be simply a xor with a constant because that would be easily cancelable in the input, and wouldn't satisfy the required xor-u

More ›