[timohanke]

The same branch was reviewed in research-ag#16 (CodeRabbit: approved, one finding fixed, see item 18). There is no version bump yet, so merging this does not tag or publish a release.

Optimization work after 0.2.3, one technique per commit. No version bump yet, so this isn't a release PR. Each commit message has its own before/after numbers, and bench/OPTIMIZATIONS.md keeps the running log.

Results (instructions; Δ vs the row above)

Step	ECDSA verify	Δ	Verify heap	Δ	BIP32 depth 5	Δ
0.2.3 (GLV, % p)	158_720_308		6.81 MiB		521_699_275
Reduction specialized to secp256k1's p	138_177_588	−12.9%	11.78 MiB	+73.0%	469_896_817	−9.9%
Field arithmetic on Nat residues	127_092_370	−8.0%	10.67 MiB	−9.4%	442_104_728	−5.9%
Width-5 wNAF, Jacobian tables	116_817_125	−8.1%	9.78 MiB	−8.3%	413_335_328	−6.5%
Combined multiplication in verify	87_478_767	−25.1%	7.18 MiB	−26.6%	412_601_208	−0.2%
Iterative field inversion	86_057_048	−1.6%	7.11 MiB	−1.0%	409_007_176	−0.9%
Verify without affine conversion	83_714_883	−2.7%	6.93 MiB	−2.5%	409_007_176	0%
Precomputed tables for G (width 7)	72_794_211	−13.0%	5.98 MiB	−13.7%	409_009_816	0%
Square root by addition chain	72_813_632	0%	5.99 MiB	0%	320_855_562	−21.6%
G tables in mul and mulBase	72_813_572	0%	5.99 MiB	0%	264_985_466	−17.4%
Doubling formula for a = 0	68_677_192	−5.7%	5.62 MiB	−6.2%	244_672_531	−7.7%
Split G's scalar at 2⁶⁴ (width 6)	68_097_977	−0.8%	5.65 MiB	+0.5%	184_148_568	−24.7%
Keep the field helpers private	68_401_510	+0.4%	5.65 MiB	0%	185_044_210	+0.5%
wNAF recoding on Nat64 words	60_580_051	−11.4%	5.24 MiB	−7.3%	170_790_134	−7.7%
Leaner addition formulas	59_210_804	−2.3%	5.11 MiB	−2.5%	167_182_713	−2.1%

In total, verify is 62.7% cheaper than 0.2.3 and allocates 25% less; BIP32 derivation is 68.0% cheaper. Since the generator tables, bench/ec_ops.bench.mo also tracks full-size operations: public key decompression went from 24.4M to 6.8M (−72%), and mulBase with a 256-bit scalar from 57.0M to 25.9M (−55%). For comparison, motoko_ecdsa 8.0.2 verifies in 110_018_892 instructions with 5.41 MiB of heap, and its optimization branch (research-ag/motoko_ecdsa#4) in 66_070_124 with 5.44 MiB, measured on the same machine and toolchain.

Commits

1. Reduction specialized to secp256k1's p. Folds the bits above 2²⁵⁶ back in using 2²⁵⁶ ≡ 2³² + 977 (mod p), instead of % p.

2. Field arithmetic on Nat residues. Coordinates are canonical residues in [0, p). Products use a fixed two-pass fold, and additions and subtractions use a conditional add or subtract of p. The formulas are unchanged. This also makes the doubling checks in the addition formulas exact: with signed values, a difference ≡ 0 but equal to ±p wasn't recognized.

3. Width-5 wNAF. Tables of odd multiples P…15P and their endomorphism images. Adds Numbers.toWnaf() with property tests. Widths 4 and 6 measured worse. Short scalars get slower (the mul, k < 2⁵⁷ benchmark: +3.7%), because building the table has a fixed cost.

4. Documented experiment: affine tables, not adopted. Converting the tables to affine with one batched inversion brings back mixed additions, but the inversion (about 3.7M instructions with extended Euclid) costs as much as it saves (verify +0.6%).

5. Combined multiplication. Adds Jacobi.mulAdd(P1, a, P2, b) and uses it in Ecdsa.verify. All four GLV half-scalars share one loop, so about 129 doublings instead of 258. Tests compare it with add(mul, mul) on edge cases: zero scalars, points at infinity, equal and opposite points, sums that cancel, and scalars ≥ r.

6. Iterative field inversion. Field.inverse does one bignum division per step instead of two (one inversion 3.14M → 2.44M). Checked against the old implementation on small, composite and degenerate moduli and on random inputs.

7. Verify without affine conversion. It compares X with r·Z² (or (r + n)·Z² when r + n < p) instead of inverting Z. Wycheproof's "k*G has a large x-coordinate" vector covers the second case: the test fails with that branch disabled.

8. Precomputed tables for G. The wNAF tables of G and φ(G) are constants in the generated src/ec/Secp256k1Generator.mo (from scripts/secp256k1_generator_table.py). They're affine and use window 7. mulAdd uses them whenever an input point is the generator. Large Nat literals are built by code at program start, so the cost is Wasm size, plus about 20k instructions once at init. For a canister that calls Ecdsa.verify (243 KB after wasm-opt -O3):

   Width	Wasm	Verify vs no table
   5	+5.4 KB (+2.2%)	−8.7%
   6	+10.8 KB (+4.4%)	−11.5%
   7	+21.4 KB (+8.8%)	−13.0%
   8	+42.5 KB (+17.5%)	−14.4%

9. Benchmarks for full-size operations. Adds bench/ec_ops.bench.mo: key decompression, plus mulBase, mul and mulAdd with 256-bit scalars.

10. Square root by addition chain. Field.mul uses the secp256k1 fold when the modulus is p and the product is below 2⁵¹². Its contract, (a * b) % n, is unchanged. Fp.sqrt() uses the 253-squaring, 13-multiplication chain. Decompression costs 72% less. Verifying against a compressed public key saves the same 17.6M; the verify benchmark doesn't show it because it uses a parsed key.

11. G tables in mul and mulBase. mulBase −19.8%. The table test was rewritten so it no longer depends on mulBase.

12. Doubling formula for a = 0. It uses 7 multiplications instead of 8, plus fewer subtractions: −5.7% to −9.2% across all operations.

13. Split G's scalar at 2⁶⁴. Each GLV half of a multiple of G is split once more against tables for 2⁶⁴·G, so mulBase needs about 65 doublings instead of 129: −29.7%. That benefits BIP32 public key derivation and Taproot tweaking; the library doesn't sign locally. The four tables use width 6, so they hold 64 points, as many as the two width-7 tables before: Wasm +684 B, init +0.4k. Width 7 for all four would save another 1.9M on mulBase and 1.3M on verify, for +21.8 KB of Wasm and +34k init.

14. Keep the field helpers private. Field.secp256k1P, Field.reduceSecp256k1 and Field.sqrtSecp256k1 are no longer public. The fold is reached through Field.mul, and the square-root chain is private to Fp. That costs about +0.4%, from one extra size check and a cross-module call per multiplication. Secp256k1Generator stays a public module (Motoko has no package-private modules), and its doc comment says it's internal.

15. Retire bench/ec_arith.bench.mo. It only used scalars below 2⁵⁷, and its mulPoint row multiplied G. bench/ec_ops.bench.mo gets a 57-bit k column with the same scalar.

16. wNAF recoding on Nat64 words. Comparing primitives with Faster scalar multiplication and ECDSA verify research-ag/motoko_ecdsa#4 showed that Numbers.toWnaf was the main difference. It did a bignum % and / per digit, 2.56M instructions per 128-bit scalar, and verify recodes six scalars. It now runs libsecp256k1's recoding on 64-bit words: 61.5k (42× faster). The output is identical to the old algorithm (checked on more than 4,000 inputs). Verify −11.4%.

17. Leaner addition formulas. The H³ form, with the same multiplications but about half the field additions and subtractions of madd/add-2007-bl. Verify −2.3%.

18. Guard the projective verify check (from CodeRabbit's review). Comparing X with r·Z² and (r + n)·Z² equals x mod n == r only if n < p < 2n, which holds on secp256k1. On other custom Curve values it accepted signatures with r ≥ p (n > p) or rejected valid ones (p > 2n). Verify now takes the projective check only if n < p < 2n and otherwise converts to affine. A test checks every (r, s) on two toy curves against directly computed results and fails without the guard. Cost on secp256k1: +0.006%.

19. secp256r1 as a test-only curve. It's defined in test/ec/Secp256r1.mo and not exported. The tests run all 484 Wycheproof secp256r1 vectors (converted by scripts/wycheproof_ecdsa_to_motoko.py), and ecdsa_verify and ec_ops have a secp256r1 column. It has no GLV and a = −3, so it covers the generic code paths; verify takes 260.5M there. No change to src/.

API additions

• Numbers.toWnaf(n, w)
• Jacobi.mulAdd(point1, a, point2, b)
• Secp256k1Generator: generated tables, documented as internal and not a stable API

All are listed under Unreleased in the CHANGELOG.

Checks

• mops test --locked: 91 passed (85 before, plus tests for wNAF, mulAdd, the square-root chain, the fast reduction, verify on toy curves and the Wycheproof secp256r1 vectors), interpreted and compiled (--mode wasi). The generator tables are checked against Jacobi.add and a plain double-and-add.
• The field reduction was checked against % on edge values and random products in temporary tests
• moc --check with 2.0.0 and with the [requirements] floor 1.4.0: no warnings
• Prettier: clean; doc coverage: 100%

Possible next steps

• Affine tables, retried with the faster inversion: verify −1.1%, BIP32 −1.1%, but short scalars 9–34% slower. Dropped as too small a gain for the extra code (documented in the log).

🤖 Generated with Claude Code