Same instruction count, 23x the wall clock: working-set effects in a deterministic RISC-V interpreter

Дата публикации: 18-09-2026 00:22:13

Follow-up: identical work, different wall-clock time — now across cryptographic primitives
A follow-up to my previous post: the same “identical work, different wall clock” problem shows up again, in a place I didn’t expect.
In the original post, I measured this within a single primitive: two lw sequences with identical opcodes and identical step counts differed by 2.3× in wall-clock time, depending on the memory access pattern (sequential vs. pointer-chasing). The interpreter’s step counter cannot observe cache behavior.
I just measured the same class of surprise between cryptographic primitives, motivated by a different question: if a chain migrates its signing scheme, could it cheaply run a composite signature scheme using two independent cryptographic families, so that breaking one does not automatically compromise both?
I benchmarked:
ML-DSA-44 — lattice-based, Module-LWE
SLH-DSA-128s / SPHINCS+ — hash-based, SHA-2 cascade
For both, I measured decode + verify using the same WASM module across three execution modes:
native
wasmi (pure interpreter)
wasmtime / Cranelift (JIT)
The engine ranking inverts
The relative overhead is surprisingly different between the two primitives:
Primitive
Interpreter / native
JIT / native
ML-DSA-44
28.3×
3.8×
SLH-DSA-128s
8.0×
0.9×
The last number is particularly interesting: in one run, the JIT version of SLH-DSA-128s was actually slightly faster than its native build.
My current hypothesis is that the JIT can compile a long cascade of relatively regular SHA-2 rounds about as effectively as the native compiler, while an interpreter’s per-instruction dispatch overhead is less problematic when the workload is dominated by predictable computation rather than scattered memory access.
The lattice workload appears to be much more sensitive to the execution engine and its interaction with memory — broadly consistent with the cache-line effects I saw in the previous experiment.
Why this matters for the original question
A naive extrapolation from the native benchmarks suggests that the hash-based primitive costs roughly 10× the lattice-based one.
But under the JIT engine that actually determines the phone step-budget in my earlier experiment, the ratio drops to 9.3×.
More importantly, the cost of the composite verification — verifying both signatures, which is the actual cost a chain would pay — comes out at approximately:
4.2× one ML-DSA-44 verification alone.
So the relevant numbers are not simply “10×” or “30×”. The execution engine changes the relative cost substantially, and the cost of running both primitives together is much smaller than a naive multiplication of the individual interpreter penalties might suggest.
Caveat
These measurements are desktop x86-64 only.
The original experiment already showed that phone and desktop can cross different working-set thresholds, so I would not assume that these ratios remain unchanged on ARM. I don’t have a phone run yet.
Data and code


github.com


Geminis/test7-firma-compuesta at main · cristiandkzk/Geminis
Contribute to cristiandkzk/Geminis development by creating an account on GitHub.






I’m particularly interested in whether others have seen this kind of JIT/interpreter inversion between SHA-2-heavy and lattice-heavy workloads in constrained WASM or other deterministic VMs.
Is this a reasonably general property of these workload classes, or is it mostly an artifact of the particular implementations and execution engines I measured?

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	Etheorem update: the complete executable consensus specs written in Lean 4	0	4.8	21-09-2026
2	Cryptographic canaries and backups	0	8.77	18-09-2026
3	Lean4 SSZ library: formally verified and easy to use	0	13.53	13-09-2026
4	[Benchmark] Radeon RX 460 (6.2.6)	0	11.64	21-06-2026
5	[Benchmark] NVIDIA CMP 100-200	0	7.07	30-05-2026
6	ERC-8340: Transaction Metadata Encoding	0	34.21	15-07-2026
7	ERC-8313: Protocol Interaction Manifest	0	7	08-07-2026
8	EIP Editing Office Hour (EIP + ERC ) Meeting #108, July 28, 2026	0	18.32	27-07-2026
9	Deterministic Random Number in EVM for Independent Recomputability	0	12.36	30-07-2026
10	EIP-8355: Precompiles for ML-DSA verification	0	10.71	13-08-2026

Классификация: . Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 10.98. Источник: ethresear.ch.