# experiments/signature_benchmarks — Research Axis B (ECDSA / BIP340 Schnorr)

Benchmarks of legitimate secp256k1 signature implementations on synthetic keys (mandate §5, §9; research questions B2 and B5). Nothing here touches real keys: every secret key, message, aux-rand value and batch weight is drawn from a ChaCha20 RNG seeded with --seed (default 34).

# Layout

# Running

# laptop (repository root)
PYTHONPATH=src .venv/bin/python experiments/signature_benchmarks/run_bench.py --seed 34 --label "Laptop (Apple M5 Max)"

# cluster node (crate + src/wp34 + data/vectors rsync'ed to ~/wp34-sigbench, cargo in PATH)
ssh M3U96a 'cd ~/wp34-sigbench && PYTHONPATH=src python3 experiments/signature_benchmarks/run_bench.py --seed 34 --label "M3U96a (Apple M3 Ultra)"'
rsync -a M3U96a:~/wp34-sigbench/results/signature_benchmarks/ results/signature_benchmarks/

.venv/bin/python experiments/signature_benchmarks/summarize.py
.venv/bin/python figures/make_sig_figures.py
.venv/bin/python -m pytest tests/test_sig_crosscheck.py -q

Binary options (sigbench --help): --seed, --reps (7), --batch-ops (2000 operations per repetition), --batch-min-sigs (≥ 2000 signatures per repetition in the batch benchmark), --batch-sizes, --crosscheck-n (1000), --python-crosscheck-n (200), --bootstrap (2000 resamples), --pippenger-c (0 = size heuristic), --ct-lincomb-max-batch (256). Everything runs on the main thread; macOS has no hard CPU pinning from user space, so "pinned single thread" means single-threaded with no parallelism.

# What is measured

1. Correctness gates (all recorded in the JSON under measurements.correctness_gates): (a) 19/19 BIP340 vectors with both libraries (verification column + byte-identical signing for the 8 vectors with a secret key); (b) 1000 cross-library checks in each direction for ECDSA (RFC 6979, SHA-256 prehash, low-S) and Schnorr (with aux_rand) — signatures are also byte-identical across libraries because both nonce derivations are deterministic; (c) 200 triples verified and re-signed by the pure-Python references (python_reference_crosscheck); (d) own wNAF scalar multiplication agrees with k256 on 64 cases; (e) batch negative controls (one signature with s+1, a flipped message bit, or r+1 inside a batch of 64) rejected by all four MSM back-ends.
2. Sign / verify ns per op (median, IQR over 7 reps × 2000 ops): ECDSA and Schnorr, libsecp256k1 and k256.
3. Batch verification Σ a_i s_i G = Σ a_i R_i + Σ a_i e_i P_i (a_1 = 1, a_i random 128-bit), merged into one MSM with 2b + 1 terms (points negated instead of scalars so the weights stay 128-bit), b ∈ {1, …, 2048}, with four back-ends: own Straus, own Pippenger, k256 lincomb_vartime (GLV + wNAF), k256 lincomb (constant time, up to b = 256). Reported per signature: wall-clock, MSM-only time, operation counts, and speed-up S(b) relative to single verification (k256 verify_raw and libsecp256k1) with bootstrap 95 % CI.
4. Scalar multiplication: k256 constant-time (GLV, generic point and generator), k256 mul_by_generator (precomputed table), k256 vartime (GLV + wNAF), own wNAF-5 double-and-add without GLV (with op counts), libsecp256k1 ecmult_gen (PublicKey::from_secret_key) and ecmult_const (PublicKey::mul_tweak). GLV cannot be toggled from either library's public API (see scalar_mult.glv_note in the JSON); the only non-GLV data point is our own implementation.
5. Python baselines for the implementation spread (pure Python ≈ milliseconds, CFFI ≈ C).

# Headline numbers (seed 34, 2026-11-01)

Full digest: results/signature_benchmarks/summary.json; interpretation and classification: research_log/2026-11-01-signatures.md.