rhdl_ed25519_scalable_core/
frontier.rs

1//! Sign / verify throughput frontier on one device.
2//!
3//! Signing and verification share the chip: every field machine, ring and
4//! block RAM spent on one is unavailable to the other. This module counts
5//! both against the same LUT, DSP, BRAM and URAM limits and returns the
6//! Pareto frontier of `(signatures/s, verifications/s)`.
7//!
8#![doc = concat!("<div style=\"overflow-x:auto\">", include_str!("../docs/images/frontier-420k.svg"), "</div>")]
9//!
10//! Key points at 420k LUT (signatures/s, verifications/s). *As built*
11//! uses the measured block costs; *projected* applies the BRAM reductions of
12//! [`slimmed_costs`]. As built, the frontier is BRAM-bound (about 1,965 of
13//! 2,016 BRAM36), so 350k and 420k LUT give the same points.
14//!
15//! | Mode | As built, ≥ 5M sign | Projected, ≥ 5M sign | Projected, equal rates |
16//! |---|---|---|---|
17//! | strict | 5.07M / 0.46M | 5.07M / 1.04M | 1.52M / 1.37M |
18//! | known-key | 5.07M / 2.27M | 5.07M / 4.03M | 4.57M / 4.28M |
19//! | batch (model) | 5.07M / 1.07M | 5.07M / 2.29M | 2.99M / 2.91M |
20//!
21//! Every point, budget and mode is in `docs/frontier.csv` (regenerate with
22//! `cd tools/hostmodel && cargo test --offline frontier_csv`).
23//!
24//! # Block costs
25//!
26//! [`vivado_costs`] are Vivado 2023.2 out-of-context synthesis numbers for the
27//! blocks of profile 15/11/3/1 (hierarchical utilization, 205 MHz target).
28//! Verify-only blocks that are not built yet are derived from them and marked
29//! in their names.
30//!
31//! # Verification modes
32//!
33//! | Mode | Field multiplies per verification | What it checks |
34//! |---|---:|---|
35//! | [`VerifyMode::Strict`] | ~3,050 bundles | full strict verification of any key: decode `A`, `[S]B`, variable-base `[k]A`, encode and compare |
36//! | [`VerifyMode::KnownKey`] | 775 bundles (compiled) | the same checks for keys whose tables were loaded in advance: `[S]B` and `[k]A` both as fixed-base walks |
37//! | [`VerifyMode::Batch`] | ~1,300 (model) | random-linear-combination batches; may differ from strict on crafted inputs |
38//!
39//! Every mode also needs two SHA-512 blocks and one scalar job per
40//! verification, and the result point is encoded by a batch-compress machine.
41//! The bundle counts are program models until the verify programs are
42//! compiled; [`VerifyMode::bundles`] is the single place to update them.
43//!
44//! # Two planners
45//!
46//! [`frontier`] enumerates every sign build and every verify build that fits
47//! the whole [`Device`] and keeps the non-dominated pairs. [`plan_system`]
48//! instead splits a [`SystemBudget`] into two fixed [`Share`]s and picks the
49//! fastest build inside each share independently ([`plan_sign_with`],
50//! [`plan_verify_with`]); it also considers the projected 150-DSP multiplier
51//! and an optional shared SHA-512 pipeline.
52
53use super::config::{CP_BATCH, CP_BUNDLES, FB_BUNDLES, Profile, UTIL_RING, UTIL_SHA};
54
55// One file per part of the model. Everything is re-exported, so paths
56// stay `frontier::Costs`, `frontier::plan_sign_with` and so on.
57mod costs;
58mod verify_profile;
59mod placement;
60mod pareto;
61mod system;
62
63pub use costs::*;
64pub use verify_profile::*;
65pub use placement::*;
66pub use pareto::*;
67pub use system::*;
68
69#[cfg(test)]
70mod tests;
rhdl_ed25519_scalable_core/frontier.rs

rhdl_ed25519_scalable_core/
frontier.rs
