diff --git a/README.md b/README.md index 12b504e..add1191 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ And others as well. ### Performance -The library currently takes advantage of Zig's native big integer types, such as `u256` and `u512` for the computations. Unfortunately, LLVM is not very good at legalizing some operations which negatively impacts the performance. In the future, I'm very eager to manually handle the limbs and test out different advanced strategies for doing fast Montgomery operations. I've found [this](https://baincapitalcrypto.com/optimizing-montgomery-multiplication-in-webassembly/) article to be particularly inspiring on the different ways available. +The library currently uses [fiat-crypto](https://github.com/mit-plv/fiat-crypto) to generate Zig code which handles the arithmetics over the curve, in the Montgomery domain. This is useful right now because it's safer than me potentially incorrectly implementing some of the math. Unfortunately, one of the bigger downsides is that the performance is not great. When compared to something like LightPoseidon, which uses the [ark_ff](https://docs.rs/ark-ff/latest/ark_ff/) crate, the benchmarks are quite a bit slower. This is mostly because fiat-crypto always assumes that you need constant-time operations, even though for something like ZKP hashes, we don't. I've manually tweaked the output from fiat-crypto to speed it up, however, in the future, I'm very eager to manually handle the limbs and test out different advanced strategies for doing fast Montgomery operations. I've found [this article](https://baincapitalcrypto.com/optimizing-montgomery-multiplication-in-webassembly/) particularly inspiring regarding the different ways available. Here are the current benchmarks for the library, taken on an Apple M3 MBP. I will replace them with a benchmark from a Ryzen 7950X3D desktop when I have the chance (may forget forever). ```