Off your direct point, but I found this line in the article interesting: ""Jerry Solinas did provide the seeds to me sometime in Fall 1997."
The seed for P-224 uses a timestamp from 1998, and they also said the four binary curve seeds were timestamps from 1984 that were doubled - someone did srand48(time / 2) not srand48(time).
Did the P-224 seed get updated later / was not provided in 1997, or is there some other reason for this? Otherwise, it looks like one third of these values need additional excuses to get them to map to the time range in question...
The first version of the X9.62-1998 standard, where these curves first showed up, only had P-192, P-256, and the prime192v{1,2,3} and prime239v{1,2,3} curves. These also happen to be the curves with the earliest timestamps (along with P-384 and P-521). It also contained 163-bit curves, but none of those correspond to the later B-163 curve.
So yeah, it seems plausible P-224 and the B-* curves were generated at a later date.
An old version of binutils [1] explains what DDS means:
How to encode VEX.vvvv:
0: VEX.vvvv must be 1111b.
1: VEX.NDS. Register-only source is encoded in VEX.vvvv where
the content of source registers will be preserved.
VEX.DDS. The second register operand is encoded in VEX.vvvv
where the content of first source register will be overwritten
by the result.
VEX.NDD2. The second destination register operand is encoded in
VEX.vvvv for instructions with 2 destination register operands.
For assembler, there are no difference between VEX.NDS, VEX.DDS
and VEX.NDD2.
2. VEX.NDD. Register destination is encoded in VEX.vvvv for
instructions with 1 destination register operand.
3. VEX.LWP. Register destination is encoded in VEX.vvvv and one
of the operands can access a memory location.
It's actually benchmarking 1000 repetitions of the RDTSC instruction running in parallel.
My guess... On Skylake, multiple in-flight RDTSC instructions slow each other down for some reason?
Possibly because it's attempting to provide a strict monotonic guarantee, that no two RSTSC instructions will return the same timestamp. Intel's manual only claims monotonic, which theoretically allows for two RSTSC instructions to return the same timestamp.
I mean, he's comparing 2024 Zen 5 and M4 against two generations behind 2022 Intel Raptor Lake. The Lion Cove should be roughly on par with the M4 on this test.
This can be translated to the discrete domain pretty easily, just like the NTT. Pick a sufficiently large prime with order 15k, say, p = 2^61-1. 37 generates the whole multiplicative group, and 37^((2^61-2)/3) and 37^((2^61-2)/5) are appropriate roots of unity. Putting it all together yields
This involves 6 exponentiations by n with constant bases. Because in fizzbuzz the inputs are sequential, one can further precompute c^(2^i) and c^(-2^i) and, having c^n, one can go to c^(n+1) in average 2 modular multiplications by multiplying the appropriate powers c^(+-2^i) corresponding to the flipped bits.
The SIKE comparison is not particularly inconsistent since Bernstein has been banging the drum that structured lattices may not be as secure as thought for years now.
Currently the best attacks on NTRU, Kyber, etc, are essentially the same generic attacks that work for something like Frodo, which works on unstructured lattices. And while the resistance of unstructured attacks is pretty well studied at this point, it is not unreasonable to suspect that the algebraic structure in the more efficient lattice schemes can lead to more efficient attacks. How efficient? Who knows.
