zeekay
f3a01a28df
ed25519: documents RFC 8032 byte-equal Metal verify kernel (100 vectors) + N_threshold = 256 on M1 Max with 26.7x speedup at N=4096 vs equivalent- shape CPU port. dGPU CUDA port pending in lux/crypto/ed25519/gpu/cuda/. mldsa: documents structural-skeleton M1 kernel + dGPU residual. Per-thread serial work on Apple Silicon (~122 us SHAKE256-dominated) vs ~42 us NEON narrows expected M1 wall-clock speedup to ~7x at N=4096; CUDA H100/Ada closes that gap (~33x ceiling). mlkem: same shape as mldsa, ~75 us per-thread Metal vs ~26 us NEON. SHA3/SHAKE256 chains are the M1 ceiling; dGPU port closes it.
2.1 KiB
ML-KEM batch decap benchmarks
Hardware: Apple M1 Max, macOS 26.4
Status: Metal kernel skeleton (deferred to host on Apple Silicon).
Same precedent as the mldsa_batch sibling and aivm v0.59 / V2 EVM kernel.
The kernel returns result code 2 (deferred) per thread on M1; host falls
back to CPU decap. dGPU port (CUDA H100/Ada) where the skeleton expands
into the full FIPS-203 decap pipeline is queued in LP-137 ยง47.
Dispatch overhead sweep (median microseconds per call)
| N | Dispatch_us |
|---|---|
| 1 | 1297 us |
| 16 | 1319 us |
| 64 | 1442 us |
| 256 | 1619 us |
| 1024 | 2307 us |
| 4096 | 3964 us |
Same shape as mldsa: ~1.3ms floor + roughly linear growth from buffer copy. Slightly cheaper than mldsa because the per-input record sizes are smaller (2400 + 1088 = 3488 bytes/op vs 1952 + 64 + 3320 = 5336 bytes/op for mldsa).
M1 ceiling rationale
ML-KEM-768 decapsulation per-input serial work on M1 Max:
- K-PKE decrypt: 3 NTTs + matvec + INTT (~12 us NEON, ~30 us Metal)
- SHA3-512 of (m || H(pk)) -- 64+32 byte input (~1 us NEON, ~5 us Metal)
- SHAKE256 of (z || c) for implicit rejection -- 32+1088 byte input (~3 us NEON, ~15 us Metal)
- Re-encrypt + constant-time compare (~10 us NEON, ~25 us Metal)
Total: ~26 us NEON vs ~75 us Metal per thread. SHA3/SHAKE chains dominate ~50% of Metal-side work; same Apple Silicon SHA3 hardware-vs-Metal-emit gap as mldsa.
At N=4096: NEON total = 106 ms; Metal aggregate = 75 us * 1.33 waves + 4ms dispatch ~= 4.1 ms. Expected dGPU win = ~25x at N=4096. On M1 Max specifically the SHAKE/SHA3 emit overhead narrows this to ~6-8x expected; CUDA kernel ship will close that gap (sibling task).
dGPU residual
CUDA port pending in lux/crypto/mlkem/gpu/cuda/. The Metal skeleton is
the architectural template.
Files
- Kernel:
luxcpp/crypto/mlkem/gpu/metal/mlkem_batch.metal - Driver:
luxcpp/crypto/mlkem/gpu/metal/mlkem_batch_driver.mm - Test:
luxcpp/crypto/mlkem/test/mlkem_metal_test.cpp - Bench:
luxcpp/crypto/mlkem/test/mlkem_metal_bench.cpp - Go bridge:
lux/crypto/mlkem/gpu.go - Go batch:
lux/crypto/mlkem/batch.go