On Wed, Sep 23, 2026 at 06:40:56PM +0900, Kazu Yamamoto (山本和彦) via Haskell-Cafe wrote:
I'm currently working on improving the performance of *crypton*, a Haskell cryptography library, and seeing excellent results; for some algorithms, performance is now on par with OpenSSL.
The current challenge lies with P256. I do not expect further performance gains from the existing C implementation, so I'm looking for an assembly implementation. While OpenSSL includes an assembly implementation, I cannot adopt it due to its Apache License.
If you have any good ideas, please share them via the *crypton* issue tracker. Even if the P256 issue remains unresolved, I plan to release version 2.0.0 in the near future.
For the latest status, please refer to the benchmark table in https://github.com/kazu-yamamoto/crypton
Note that performance is generally not the first consideration with an ECDSA (e.g. P-256) implementation. What's most needed is a constant-time implementation of the nonce generation and EC curve arithmetic (Montgomery ladder, ...). The best-practice approach is to use a fixed-size representation of the inputs and intermediate results, with leading zero bytes retained and used in all computations regardless of their value. The most likely to be a good fit is "fiat-crypto" https://github.com/mit-plv/fiat-crypto Gemini purports (Double-check of course): 1. BoringSSL (ISC License) Google’s BoringSSL contains highly optimized, constant-time assembly routines for P-256 curve operations (p256-x86_64.span, p256-armv8-aarch64.span, etc.): License: ISC License (a 2-clause BSD equivalent). Architectures: x86_64 (including ADX/BMI2 paths), aarch64 (ARM64), and 32-bit ARM. Property: Fully constant-time execution to prevent side-channel timing attacks. 2. fiat-crypto / Formally Verified Field Arithmetic (MIT / Apache-2.0 / BSD) Developed at MIT, fiat-crypto synthesizes correct-by-construction, constant-time C and assembly field arithmetic code for P-256: License: MIT License / Apache 2.0 / 2-Clause BSD. Architectures: x86_64, aarch64, riscv64 (and 32-bit targets). Property: Generated code avoids data-dependent branch/memory access patterns, making it constant-time. It is used inside BoringSSL, Go (crypto/internal/nistec), and OpenSSL. 3. RustCrypto p256 / elliptic-curves Project (Apache-2.0 / MIT) The RustCrypto ecosystem includes constant-time implementations of P-256: License: Dual-licensed Apache 2.0 / MIT (permissive BSD-style terms). Architectures: Platform-agnostic (via fiat-crypto backend C/inline assembly extensions for x86_64, aarch64, and riscv64). -- Viktor. 🇺🇦 Слава Україні!