Mikeo/lowmem improvements by ounsworth · Pull Request #136 · bcgit/bc-rust

ounsworth · 2026-09-17T05:14:30Z

In short, I had Claude do a review for silent copies in the mlkem and mldsa lowmemory crates and it found a couple of instance of:

moves that were being compiled as a pass-by-value copy
.try_into() that created a copy as a result of needing an intermediate owned copy.
And similar patterns.
Adjusted the size of the SHAKE pre-buffer in SampleNTT() / RejNTTPoly() to match exactly a SHAKE block size boundary.

The net result is about a 2 - 4 kb reduction across the whole lowmemory suite, and also some tightening up in the non-optimized implementation.

…git#88)

… notes (PR bcgit#87)

… their HMAC variants

bcgit#95 not already on this branch

… and CLI wiring (PR bcgit#89)

… bits in the MSBs, unused low bits ignored

…ke the other hashes

… sites

…ptor with multi-block and one-shot methods (PR bcgit#107)

…-free bit-sliced AES permutation (PR bcgit#105)

…nd aes*-cbc CLI subcommands (PR bcgit#106)

…ryptor/PaddedDecryptor) (PR bcgit#97)

…me lengths, AES_CBC_* aliases, simpler CLI (PR bcgit#109)

…mmands and shared block-mode CLI (PR bcgit#111)

…locks8, SymmetricCipherEncryptor/Decryptor (from feature/sm4); CFB follows suit

…cb CLI subcommands; block-mode CLI generic over INIT_DATA_LEN

…S_PADS; SymmetricCipherEncryptor::do_final reports its output length

…with API changes and per-commit summaries

…rams/HashMLDSAParams/MLKEMParams traits, one impl per parameter set (bcgit#117)

…eamCipherDecryptor pair, shaped like the block cipher pair (in place, any length, generated init data); TestFrameworkStreamCipher implemented in place of its todo!()

… and Cfb8 (SP 800-38A Sec 6.3, s = 8) is added, with AES_CFB8_* aliases, aes*-cfb8 CLI subcommands and a shared stream-mode CLI

…, CFB8 is added, and the StreamCipher trait is replaced by the split encryptor/decryptor pair; re-measured throughput and mutation figures

…inst real AES at all three key lengths, not only the toy permutation

…th picks the counter width (max 4 bytes) and which errors rather than repeat a counter, with AES_CTR_* aliases and aes*-ctr CLI subcommands

… the nonce-plus-counter construction, pinning the 1, 2 and 3-byte counter widths that the ACVP and OpenSSL vectors cannot reach

…git#88)

… notes (PR bcgit#87)

… their HMAC variants

bcgit#95 not already on this branch

… and CLI wiring (PR bcgit#89)

…es of the ct [u8]

…s on the stack

…eing held in a Polynomial [i32; 256], it's now bit-packed into a [u8; 32].

…LVM lays out stack frames and give slightly better numbers

…nd sig on the heap, thus under-reporting

…lemtations.

…pansion so that it doesn't get sucked into the caller's stack frame.

…ill memory-hygiene-in-rust.

…skill The Architecture paragraph introducing memory hygiene already names the skill; the stand-alone sentence under Stack Usage Benchmarks repeated it. Also "cast" -> "cost" in that paragraph. Assisted-by: Claude:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ode.

ounsworth · 2026-10-24T15:27:23Z

Closing, as this has been replaced by #177

dghgit and others added 30 commits September 6, 2026 12:02

sha2: partial-bit messages, compile-time IVs, CAVP SHAVS tests (PR bc…

31affff

…git#88)

sha3: partial-byte fixes, CAVP SHA3VS tests, mem-usage bench, release…

aec1ae4

… notes (PR bcgit#87)

sha2, hmac: add SHA-512/224 and SHA-512/256 (FIPS 180-4 s. 5.3.6) and…

d604906

… their HMAC variants

rng: use core::fmt in hash_drbg80090a.rs; the only part of PRs bcgit#92-

a57d508

bcgit#95 not already on this branch

sm3: add bouncycastle-sm3 (GB/T 32905-2016) and HMAC-SM3 with factory…

fa0be5d

… and CLI wiring (PR bcgit#89)

Partial bytes follow ASN.1 BIT STRING order (X.690 s. 8.6.2): message…

34d7953

… bits in the MSBs, unused low bits ignored

release notes: SM3 partial bytes follow the ASN.1 BIT STRING order li…

1140a61

…ke the other hashes

sha2, sm3: document the surviving cargo-mutants equivalences at their…

1ad97fd

… sites

core: split BlockCipher into block-aligned BlockCipherEncryptor/Decry…

fe6fd58

…ptor with multi-block and one-shot methods (PR bcgit#107)

aes-lowmemory: add bouncycastle-aes-lowmemory, a constant-time, table…

58a1fed

…-free bit-sliced AES permutation (PR bcgit#105)

modes: add BlockPermutation trait, bouncycastle-modes with AES CBC, a…

aa9454d

…nd aes*-cbc CLI subcommands (PR bcgit#106)

padding: add Padding trait and bouncycastle-padding (PKCS7, PaddedEnc…

f56802e

…ryptor/PaddedDecryptor) (PR bcgit#97)

core, modes, aes-lowmemory: in-place block cipher API with compile-ti…

78a4021

…me lengths, AES_CBC_* aliases, simpler CLI (PR bcgit#109)

modes: add AES CFB128 mode with AES_CFB_* aliases, aes*-cfb CLI subco…

c5f60fb

…mmands and shared block-mode CLI (PR bcgit#111)

core: ElectronicCodeBook (was BlockPermutation), slice block hooks, b…

2c0567e

…locks8, SymmetricCipherEncryptor/Decryptor (from feature/sm4); CFB follows suit

modes: add Ecb (SP 800-38A Sec 6.1) with AES_ECB_* aliases and aes*-e…

157b1c8

…cb CLI subcommands; block-mode CLI generic over INIT_DATA_LEN

padding: add NoPadding (errors when asked to pad) with Padding::ALWAY…

f6cb787

…S_PADS; SymmetricCipherEncryptor::do_final reports its output length

skills: add commit-range-report, a Markdown report of a commit range …

a1c4e41

…with API changes and per-commit summaries

mldsa, mlkem: replace the const-generic turbofish with sealed MLDSAPa…

9c65521

…rams/HashMLDSAParams/MLKEMParams traits, one impl per parameter set (bcgit#117)

core: replace StreamCipher with the split StreamCipherEncryptor / Str…

57dd3d0

…eamCipherDecryptor pair, shaped like the block cipher pair (in place, any length, generated init data); TestFrameworkStreamCipher implemented in place of its todo!()

modes: Cfb becomes a stream cipher taking any length with no padding,…

97ac6e3

… and Cfb8 (SP 800-38A Sec 6.3, s = 8) is added, with AES_CFB8_* aliases, aes*-cfb8 CLI subcommands and a shared stream-mode CLI

release notes: CFB becomes a stream cipher with a short final segment…

5c73617

…, CFB8 is added, and the StreamCipher trait is replaced by the split encryptor/decryptor pair; re-measured throughput and mutation figures

modes: pin the single-call vs chunked equivalence of Cfb and Cfb8 aga…

e2b534d

…inst real AES at all three key lengths, not only the toy permutation

modes: add Ctr (SP 800-38A Sec 6.5), a stream cipher whose nonce leng…

f72bfe6

…th picks the counter width (max 4 bytes) and which errors rather than repeat a counter, with AES_CTR_* aliases and aes*-ctr CLI subcommands

modes: cross-check Ctr against BC Java's SICBlockCipher, which shares…

0404ab9

… the nonce-plus-counter construction, pinning the 1, 2 and 3-byte counter widths that the ACVP and OpenSSL vectors cannot reach

sha2: partial-bit messages, compile-time IVs, CAVP SHAVS tests (PR bc…

921e2b5

…git#88)

sha3: partial-byte fixes, CAVP SHA3VS tests, mem-usage bench, release…

7b4e7fc

… notes (PR bcgit#87)

sha2, hmac: add SHA-512/224 and SHA-512/256 (FIPS 180-4 s. 5.3.6) and…

c34c2f9

… their HMAC variants

rng: use core::fmt in hash_drbg80090a.rs; the only part of PRs bcgit#92-

7df74a6

bcgit#95 not already on this branch

sm3: add bouncycastle-sm3 (GB/T 32905-2016) and HMAC-SM3 with factory…

ac896e2

… and CLI wiring (PR bcgit#89)

ounsworth and others added 21 commits September 29, 2026 17:44

Re-ran mem benches to get new values.

90afcc4

Claude found some sloppy pass-by-values that resulted in 2 extra copi…

74595a9

…es of the ct [u8]

Claude found reconstruction of pk from sk lead to unintentional copie…

66893c9

…s on the stack

Claude optimized pass-by-reference function signatures

5433b65

Claude optimized placing a short-lived value into its own scope.

9614bc0

Claude optimized variable usage to avoid duplicate copies

362ff35

Claude found an insidious .try_into() that made a silent copy

fbbea01

Claude optimized the Hint, which is one bit per coeff -- instead of b…

f12e1a4

…eing held in a Polynomial [i32; 256], it's now bit-packed into a [u8; 32].

Avoiding a .try_into() that makes a silent copy.

d333337

Optimized buffer reuse.

cb48a99

Misc cleanup.

4831203

Updated bench tables.

37d0ecf

Tweaked the SHAKE buffering to match the SHAKE internal block size.

f587491

Minor aesthetic cleanup of the new packed make_hint.

1f08985

Fable adjusted the memory benchmarking harnesses to account for how L…

e25aaf8

…LVM lays out stack frames and give slightly better numbers

Fixed a bug in memory benches where mldsa verify had the public key a…

95ad2d1

…nd sig on the heap, thus under-reporting

Fable optimized away some uneccessary copies in the non-lowmemory imp…

0c52a6b

…lemtations.

Fable optimization to put #[inline(never)] guards around the A_hat ex…

ecc4466

…pansion so that it doesn't get sucked into the caller's stack frame.

Saving the Fable lessons-learned from memory hygiene into a claude sk…

c05869b

…ill memory-hygiene-in-rust.

Claude pointed out comments that were now out of alignment with the c…

681ead7

…ode.

dghgit force-pushed the mikeo/lowmem_bench_tweaks branch from 367fc40 to 681ead7 Compare September 29, 2026 07:51

dghgit changed the base branch from release/0.1.3alpha to feature/simple-ciphers September 29, 2026 07:52

ounsworth added this to the 0.1.3alpha milestone Oct 7, 2026

ounsworth closed this Oct 24, 2026

ounsworth reopened this Oct 24, 2026

ounsworth changed the base branch from feature/simple-ciphers to release/0.1.3alpha October 24, 2026 15:08

ounsworth mentioned this pull request Oct 24, 2026

Mikeo/lowmem bench tweaks v2 #177

Open

ounsworth closed this Oct 24, 2026

Navigation Menu

Repository navigation

Mikeo/lowmem improvements - #136

Mikeo/lowmem improvements#136
ounsworth wants to merge 249 commits into
bcgit:release/0.1.3alphafrom
ounsworth:mikeo/lowmem_bench_tweaks

ounsworth commented Sep 17, 2026 •

edited

Loading

Uh oh!

ounsworth commented Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

ounsworth commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ounsworth commented Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ounsworth commented Sep 17, 2026 •

edited

Loading