SLH-DSA verification can compete with ECC

[conduition]

Hi List,

In follow up to my previous thread about SLH-DSA performance optimization, I published a short new article directly comparing the signature verification throughput of my highly-parallelized SLH-DSA verification shader code against libsecp256k1, mostly to answer some questions I'd received from Ethan Heilman.

https://conduition.io/code/fast-slh-dsa-verification/

The results were very surprising to me. The benchmarks seem to show SLH-DSA can perform about as well under load as a naive single-threaded BIP340 schnorr signature verifier, if properly optimized.

If the BIP340 verifier is parallelized as well, SLH-DSA compares much less favorably, but still within a single order of magnitude.

Bear in mind I only benchmarked a single (slower) SLH-DSA parameter set, and I used the NIST FIPS-205 algorithm, without any aftermarket add-ons like WOTS+C or FORS+C which would've sped up verification even more (see Jonas and Mikhail's paper, ref this thread). I also did not benchmark BIP340 batch verification as I have seen its effects are mild compared to parallelism.

regards,

conduition

[Mikhail Kudinov]

Thank you for your work. That is really helpful to see such comparisons. 

Best,
Mike

--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/80f409f8-2ffd-453b-b133-d54d1dcc5b43n%40googlegroups.com.