for benchmarks only: use 128 bit randomizer

This is just a commit for benchmarks and should be improved if 128 bit
randomizers are to be actually used.
1) it does not follow bip-schnorr batch verification
2) the randomizers are not uniformly distributed in [0, 2^128-1] for no reason
3) chacha output is thrown away

doc/speedup-batch/bench_output.txt

@@ -1,67 +1,67 @@
-schnorrsig_sign: min 24.4us / avg 24.5us / max 24.5us
-schnorrsig_verify: min 41.9us / avg 42.1us / max 42.2us
-schnorrsig_batch_verify_1: min 50.2us / avg 50.2us / max 50.3us
-schnorrsig_batch_verify_2: min 44.7us / avg 44.8us / max 44.8us
-schnorrsig_batch_verify_3: min 42.8us / avg 42.8us / max 42.9us
-schnorrsig_batch_verify_4: min 41.8us / avg 41.9us / max 41.9us
-schnorrsig_batch_verify_5: min 41.2us / avg 41.3us / max 41.3us
-schnorrsig_batch_verify_7: min 40.5us / avg 40.6us / max 40.6us
-schnorrsig_batch_verify_9: min 40.1us / avg 40.2us / max 40.2us
-schnorrsig_batch_verify_11: min 39.9us / avg 39.9us / max 39.9us
-schnorrsig_batch_verify_14: min 39.7us / avg 39.7us / max 39.7us
-schnorrsig_batch_verify_17: min 39.5us / avg 39.5us / max 39.5us
-schnorrsig_batch_verify_21: min 39.3us / avg 39.3us / max 39.4us
-schnorrsig_batch_verify_26: min 39.3us / avg 39.3us / max 39.3us
-schnorrsig_batch_verify_32: min 39.1us / avg 39.2us / max 39.2us
-schnorrsig_batch_verify_39: min 39.1us / avg 39.1us / max 39.1us
-schnorrsig_batch_verify_47: min 38.2us / avg 38.3us / max 38.3us
-schnorrsig_batch_verify_57: min 37.2us / avg 37.2us / max 37.2us
-schnorrsig_batch_verify_69: min 36.3us / avg 36.3us / max 36.4us
-schnorrsig_batch_verify_83: min 35.2us / avg 35.3us / max 35.3us
-schnorrsig_batch_verify_100: min 34.2us / avg 34.2us / max 34.3us
-schnorrsig_batch_verify_121: min 33.9us / avg 33.9us / max 33.9us
-schnorrsig_batch_verify_146: min 32.7us / avg 32.7us / max 32.8us
-schnorrsig_batch_verify_176: min 31.7us / avg 31.8us / max 31.8us
-schnorrsig_batch_verify_212: min 31.0us / avg 31.0us / max 31.0us
-schnorrsig_batch_verify_255: min 30.3us / avg 30.3us / max 30.3us
-schnorrsig_batch_verify_307: min 29.7us / avg 29.8us / max 29.8us
-schnorrsig_batch_verify_369: min 29.3us / avg 29.3us / max 29.3us
-schnorrsig_batch_verify_443: min 28.8us / avg 28.8us / max 28.8us
-schnorrsig_batch_verify_532: min 28.5us / avg 28.6us / max 28.6us
-schnorrsig_batch_verify_639: min 28.3us / avg 28.3us / max 28.4us
-schnorrsig_batch_verify_767: min 27.7us / avg 27.7us / max 27.7us
-schnorrsig_batch_verify_921: min 27.0us / avg 27.0us / max 27.0us
-schnorrsig_batch_verify_1106: min 26.5us / avg 26.6us / max 26.6us
-schnorrsig_batch_verify_1328: min 26.1us / avg 26.2us / max 26.2us
-schnorrsig_batch_verify_1594: min 25.9us / avg 25.9us / max 25.9us
-schnorrsig_batch_verify_1913: min 25.6us / avg 25.6us / max 25.6us
-schnorrsig_batch_verify_2296: min 25.3us / avg 25.3us / max 25.4us
-schnorrsig_batch_verify_2756: min 25.0us / avg 25.0us / max 25.1us
-schnorrsig_batch_verify_3308: min 24.7us / avg 24.7us / max 24.7us
-schnorrsig_batch_verify_3970: min 24.6us / avg 24.6us / max 24.6us
-schnorrsig_batch_verify_4765: min 24.3us / avg 24.3us / max 24.3us
-schnorrsig_batch_verify_5719: min 23.9us / avg 24.0us / max 24.0us
-schnorrsig_batch_verify_6863: min 23.7us / avg 23.7us / max 23.8us
-schnorrsig_batch_verify_8236: min 23.5us / avg 23.5us / max 23.5us
-schnorrsig_batch_verify_9884: min 23.2us / avg 23.2us / max 23.2us
-schnorrsig_batch_verify_11861: min 22.9us / avg 23.0us / max 23.0us
-schnorrsig_batch_verify_14234: min 22.7us / avg 22.7us / max 22.8us
-schnorrsig_batch_verify_17081: min 22.6us / avg 22.6us / max 22.7us
-schnorrsig_batch_verify_20498: min 22.4us / avg 22.4us / max 22.5us
-schnorrsig_batch_verify_24598: min 22.3us / avg 22.3us / max 22.3us
-schnorrsig_batch_verify_29518: min 22.2us / avg 22.2us / max 22.2us
-schnorrsig_batch_verify_35422: min 22.1us / avg 22.1us / max 22.1us
-schnorrsig_batch_verify_42507: min 22.1us / avg 22.1us / max 22.1us
-schnorrsig_batch_verify_51009: min 22.0us / avg 22.1us / max 22.1us
-schnorrsig_batch_verify_61211: min 22.0us / avg 22.0us / max 22.0us
-schnorrsig_batch_verify_73454: min 21.9us / avg 21.9us / max 21.9us
-schnorrsig_batch_verify_88145: min 21.9us / avg 21.9us / max 22.0us
-schnorrsig_batch_verify_105775: min 21.9us / avg 21.9us / max 21.9us
-schnorrsig_batch_verify_126931: min 21.9us / avg 21.9us / max 21.9us
-schnorrsig_batch_verify_152318: min 21.8us / avg 21.8us / max 21.8us
-schnorrsig_batch_verify_182782: min 21.7us / avg 21.8us / max 21.8us
-schnorrsig_batch_verify_219339: min 21.8us / avg 21.8us / max 21.8us
-schnorrsig_batch_verify_263207: min 21.7us / avg 21.8us / max 21.8us
-schnorrsig_batch_verify_315849: min 21.8us / avg 21.8us / max 21.9us
-schnorrsig_batch_verify_379019: min 21.7us / avg 21.8us / max 21.9us
-schnorrsig_batch_verify_454823: min 21.8us / avg 21.8us / max 21.9us
+schnorrsig_sign: min 24.5us / avg 24.6us / max 24.6us
+schnorrsig_verify: min 42.1us / avg 42.1us / max 42.2us
+schnorrsig_batch_verify_1: min 50.2us / avg 50.3us / max 50.3us
+schnorrsig_batch_verify_2: min 43.5us / avg 43.5us / max 43.5us
+schnorrsig_batch_verify_3: min 41.1us / avg 41.1us / max 41.1us
+schnorrsig_batch_verify_4: min 40.0us / avg 40.0us / max 40.0us
+schnorrsig_batch_verify_5: min 39.2us / avg 39.2us / max 39.3us
+schnorrsig_batch_verify_7: min 38.4us / avg 38.5us / max 38.5us
+schnorrsig_batch_verify_9: min 38.0us / avg 38.0us / max 38.0us
+schnorrsig_batch_verify_11: min 37.7us / avg 37.7us / max 37.8us
+schnorrsig_batch_verify_14: min 37.4us / avg 37.4us / max 37.5us
+schnorrsig_batch_verify_17: min 37.3us / avg 37.3us / max 37.3us
+schnorrsig_batch_verify_21: min 37.1us / avg 37.1us / max 37.2us
+schnorrsig_batch_verify_26: min 37.0us / avg 37.0us / max 37.0us
+schnorrsig_batch_verify_32: min 37.0us / avg 37.0us / max 37.0us
+schnorrsig_batch_verify_39: min 36.9us / avg 36.9us / max 36.9us
+schnorrsig_batch_verify_47: min 35.2us / avg 35.3us / max 35.3us
+schnorrsig_batch_verify_57: min 34.2us / avg 34.2us / max 34.2us
+schnorrsig_batch_verify_69: min 33.8us / avg 33.8us / max 33.9us
+schnorrsig_batch_verify_83: min 32.6us / avg 32.6us / max 32.7us
+schnorrsig_batch_verify_100: min 31.7us / avg 31.7us / max 31.7us
+schnorrsig_batch_verify_121: min 31.6us / avg 31.6us / max 31.6us
+schnorrsig_batch_verify_146: min 30.5us / avg 30.5us / max 30.5us
+schnorrsig_batch_verify_176: min 29.5us / avg 29.5us / max 29.5us
+schnorrsig_batch_verify_212: min 28.7us / avg 28.7us / max 28.7us
+schnorrsig_batch_verify_255: min 28.0us / avg 28.0us / max 28.0us
+schnorrsig_batch_verify_307: min 27.5us / avg 27.5us / max 27.5us
+schnorrsig_batch_verify_369: min 27.0us / avg 27.0us / max 27.0us
+schnorrsig_batch_verify_443: min 26.6us / avg 26.7us / max 26.7us
+schnorrsig_batch_verify_532: min 26.3us / avg 26.3us / max 26.4us
+schnorrsig_batch_verify_639: min 26.5us / avg 26.5us / max 26.5us
+schnorrsig_batch_verify_767: min 25.8us / avg 25.8us / max 25.8us
+schnorrsig_batch_verify_921: min 25.2us / avg 25.2us / max 25.2us
+schnorrsig_batch_verify_1106: min 24.7us / avg 24.7us / max 24.7us
+schnorrsig_batch_verify_1328: min 24.3us / avg 24.3us / max 24.3us
+schnorrsig_batch_verify_1594: min 24.0us / avg 24.0us / max 24.1us
+schnorrsig_batch_verify_1913: min 23.7us / avg 23.7us / max 23.8us
+schnorrsig_batch_verify_2296: min 23.7us / avg 23.7us / max 23.7us
+schnorrsig_batch_verify_2756: min 23.3us / avg 23.3us / max 23.3us
+schnorrsig_batch_verify_3308: min 22.9us / avg 23.0us / max 23.0us
+schnorrsig_batch_verify_3970: min 23.0us / avg 23.0us / max 23.0us
+schnorrsig_batch_verify_4765: min 22.7us / avg 22.7us / max 22.7us
+schnorrsig_batch_verify_5719: min 22.3us / avg 22.4us / max 22.4us
+schnorrsig_batch_verify_6863: min 22.1us / avg 22.1us / max 22.1us
+schnorrsig_batch_verify_8236: min 22.0us / avg 22.0us / max 22.0us
+schnorrsig_batch_verify_9884: min 21.7us / avg 21.7us / max 21.7us
+schnorrsig_batch_verify_11861: min 21.4us / avg 21.5us / max 21.5us
+schnorrsig_batch_verify_14234: min 21.2us / avg 21.2us / max 21.3us
+schnorrsig_batch_verify_17081: min 21.1us / avg 21.1us / max 21.1us
+schnorrsig_batch_verify_20498: min 20.9us / avg 21.0us / max 21.0us
+schnorrsig_batch_verify_24598: min 20.8us / avg 20.9us / max 20.9us
+schnorrsig_batch_verify_29518: min 20.7us / avg 20.7us / max 20.8us
+schnorrsig_batch_verify_35422: min 20.7us / avg 20.7us / max 20.7us
+schnorrsig_batch_verify_42507: min 20.6us / avg 20.6us / max 20.6us
+schnorrsig_batch_verify_51009: min 20.5us / avg 20.5us / max 20.6us
+schnorrsig_batch_verify_61211: min 20.5us / avg 20.5us / max 20.5us
+schnorrsig_batch_verify_73454: min 20.4us / avg 20.4us / max 20.4us
+schnorrsig_batch_verify_88145: min 20.4us / avg 20.4us / max 20.4us
+schnorrsig_batch_verify_105775: min 20.4us / avg 20.4us / max 20.4us
+schnorrsig_batch_verify_126931: min 20.3us / avg 20.4us / max 20.4us
+schnorrsig_batch_verify_152318: min 20.3us / avg 20.3us / max 20.3us
+schnorrsig_batch_verify_182782: min 20.3us / avg 20.3us / max 20.3us
+schnorrsig_batch_verify_219339: min 20.3us / avg 20.3us / max 20.4us
+schnorrsig_batch_verify_263207: min 20.3us / avg 20.3us / max 20.4us
+schnorrsig_batch_verify_315849: min 20.3us / avg 20.3us / max 20.3us
+schnorrsig_batch_verify_379019: min 20.3us / avg 20.3us / max 20.4us
+schnorrsig_batch_verify_454823: min 20.3us / avg 20.3us / max 20.4us

doc/speedup-batch/bench_output.txt.log

@@ -1,4 +1,4 @@
-HEAD: 0b631c69
+HEAD: 1e850ba7
 checking build system type... x86_64-pc-linux-gnu
 checking host system type... x86_64-pc-linux-gnu
 checking for a BSD-compatible install... /usr/bin/install -c

src/modules/schnorrsig/main_impl.h

@@ -265,6 +265,7 @@ static int secp256k1_schnorrsig_verify_batch_ecmult_callback(secp256k1_scalar *s
          * (-randomizer_cache[1], R2)
          * (-randomizer_cache[1]*e2, P2) */
         secp256k1_scalar_chacha20(&ecmult_context->randomizer_cache[0], &ecmult_context->randomizer_cache[1], ecmult_context->chacha_seed, idx / 4);
+        secp256k1_scalar_split_128(&ecmult_context->randomizer_cache[0], &ecmult_context->randomizer_cache[1], &ecmult_context->randomizer_cache[1]);
     }
 
     /* R */
@@ -367,6 +368,7 @@ static int secp256k1_schnorrsig_verify_batch_sum_s(secp256k1_scalar *s, unsigned
         secp256k1_scalar term;
         if (i % 2 == 1) {
             secp256k1_scalar_chacha20(&randomizer_cache[0], &randomizer_cache[1], chacha_seed, i / 2);
+            secp256k1_scalar_split_128(&randomizer_cache[0], &randomizer_cache[1], &randomizer_cache[1]);
         }
 
         secp256k1_scalar_set_b32(&term, &sig[i][32], &overflow);