Benchmark run Intel(R) Xeon(R) W-1390P @ 3.50GHz · x86-64-v3 · full · ef9e82d3

Run Intel(R) Xeon(R) W-1390P @ 3.50GHz · x86-64-v3 · full · ef9e82d3 started 2026-10-08T18:42:23Z on Intel(R) Xeon(R) W-1390P @ 3.50GHz (?, x86_64) and timed commit ef9e82d39fbf06c605e1740360370f0003dc4ca4, built by rustc 1.98.1 (48a229cea 2026-09-01) with RUSTFLAGS -C target-cpu=x86-64-v3 -C target-feature=+pclmulqdq, in the full profile.

1623 benchmarks from run Intel(R) Xeon(R) W-1390P @ 3.50GHz · x86-64-v3 · full · ef9e82d3. Reading a run report explains the values, colours and tags.

Families compared

Each family’s nominal ${\log }_2$ rho, this run’s costs (addition at throughput; hashing, preparation, encoding and decoding batched), the two regimes of Cost in repeated reconciliation for a set of $n=10^5$ items, a set difference of $d=10^3$ and a sketch of $m=1350$ cells, in which a new item updates $k=13.57$ cells on average, and the mean time over seeds to find a curve and verify its certificate. Dominance is as defined in Measurement methodology. Additions are 89 to 99% of each rebuilt estimate.

Machine

Load averages by phase while the run timed (Measurement methodology).

Group benchmark plan

Which families the group suite’s second pass timed. Its first pass timed every family’s core rows; from them and the comparison maps, bench-run chose the families whose modeled insertion at $m=1350$ was within 50% of the cheapest (lead) and, if none of them was over a field of odd characteristic, the cheapest that was (contrast). The second pass added the batch sweep, subtraction, equality on pure cells and the hashes of IDs (The group plan).

RIBLT benchmark plan

Which RIBLT benchmarks this run generated. Before the RIBLT suite ran, bench-run chose from this run’s group and hash-to-curve results, for each family below, the hash its RIBLT benchmarks use and their scope: every sweep (full), each axis’s endpoints and middle (buffer), or one point of each benchmark (spot); and for full and buffer scope, the field whose projection hashes the family’s IDs cheapest and the one whose projection seeds mappings cheapest, under which it also encodes and peels cells keyed by IDs. The plan records what was measured, not a result; the XOR checksums and ristretto255 are timed in full regardless (The RIBLT plan).

Insertion

Modeled insertion per item into a sketch of $m$ cells: a hash, a prepare, and an addition to each of the $k$ cells the item maps to on average ($m=5$: $k=2.90$; $m=20$: $k=5.29$; $m=150$: $k=9.20$; $m=1350$: $k=13.57$; $m=12150$: $k=17.96$), by compatible recipes (Reading a run report). The references (xor, ristretto255) have no batched hash: they hash one item at a time, add the hash output as is, and are in the figure and the second grid. Each total also counts, the same for every family, the salted SHA-256 map digest and the xoshiro256pp walk through the item’s indices below $m$ (riblt.mapping): 78.2 ns at $m=5$, 101 ns at $m=20$, 138 ns at $m=150$, 175 ns at $m=1350$, 211 ns at $m=12150$. The key XOR and count of each cell are not modelled; riblt.cells measures them with the rest of the cell updates.

Batching

Batched against individual time per element. The inversions-shared column divides the saving by the difference between individual and batched field inversion; it also absorbs allocation and control flow.

Time per element against batch size.

Costs by lifetime

What an insertion into cells keyed by IDs costs by how long each part stays valid, for each family the RIBLT suite timed so (proj=): the ID once per item; the curve and each hash’s keys once per salt; the hash to the addend, the mapping’s seed and its walk once per salt and item; and the addition, encoding and decoding of each cell. Salted SHA-256 hashes the ID anew under each salt; each projection, the checksum’s and the mapping’s in fields chosen apart, multiplies its halves by the salt’s keys. The last row is the measured encoding of n = 3500 items into m = 1350 cells, per item: by salted SHA-256 of the items themselves, and by projections of their IDs, computed beforehand (Costs by lifetime).

binary.109, pornin, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-lambda.109, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-u.109, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-w.109, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary.122, pornin, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary.122-gls, pornin, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-lambda.122-gls, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-u.122-gls, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-w.122-gls, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-lambda.122, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-u.122, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-w.122, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary.127, pornin, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-lambda.127, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-u.127, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

binary-w.127, pornin-addend, checksum projected in $\mathrm{GF}(2^{127})$, mapping in $\mathrm{GF}(2^{127})$

Curve selection

Curve selection as this run timed it, once per seed (16 seeds): find searches a seed’s candidates for an acceptable curve; prove searches them again and certifies each rejection and the acceptance; verify checks that certificate. The figure shows each family’s method that finds fastest, a bar at the seeds’ mean in a box from the fastest seed to the slowest, and how the prover’s time divides among the search’s phases; the table lists every method (Parameter selection and verification). Accepting a curve (69.9 µs to 91.2 µs, curvegen/verify_accept) includes the embedding-degree bound, a baby-step giant-step search for $q^k=1\mathrm{mod}r$ with $k\le 2^{20}$, which alone takes 42.1 µs to 44.4 µs (curvegen/embedding), 49% to 62% of it; rejected candidates do not reach it.

Group operations

The fastest measurement of each operation and mode per family, the hashes over every construction; rows grouped by field.