Guidance on producing smallest WASM binary

[blake-regalia]

I'm currently experimenting with compiling a WASM binary that exports a selection of functions.

Going through issues, comments, and PRs, I've learned that there used to be an option to disable precomputing the tables - but that the current approach does not have an equivalent?

I'm currently using an ecmult-window size of 2 of ecmult-gen-precision of 2 in order to get the smallest binary, with moderate success (240 KB). Is there a configuration or linking setup I'm missing that would allow me to shrink this even further?

Any suggestions are greatly appreciated.

emconfigure ./configure \
  --enable-module-ecdh \
  --enable-module-schnorrsig=no \
  --enable-module-recovery=no \
  --enable-module-ellswift=no \
  --enable-module-extrakeys=no \
  --with-ecmult-window=2 \
  --with-ecmult-gen-precision=2 \
  CFLAGS="-O3"

emmake make FORMAT=wasm
emmake make src/precompute_ecmult-precompute_ecmult FORMAT=wasm

emcc src/precompute_ecmult-precompute_ecmult.o \
  src/libsecp256k1_precomputed_la-precomputed_ecmult.o \
  src/libsecp256k1_precomputed_la-precomputed_ecmult_gen.o \
  src/libsecp256k1_la-secp256k1.o \
  -O3 \
  -s WASM=1 \
  -s "BINARYEN_METHOD='native-wasm'" \
  -s DETERMINISTIC=1 \
  -s EXPORTED_FUNCTIONS="[$sx_funcs]" \
  -s MINIMAL_RUNTIME=1 \
  -s NO_EXIT_RUNTIME=1
  ...

And the functions i'm currently exporting:

• secp256k1_context_create
• secp256k1_ec_seckey_verify
• secp256k1_ec_pubkey_create
• secp256k1_ec_pubkey_parse
• secp256k1_ec_pubkey_serialize
• secp256k1_ecdh
• secp256k1_ecdsa_sign
• secp256k1_ecdsa_verify
• secp256k1_ecdsa_signature_serialize_compact

[real-or-random]

Going through issues, comments, and PRs, I've learned that there used to be an option to disable precomputing the tables - but that the current approach does not have an equivalent?

Yes, that has been removed. That simplified the library a lot, and we believe that setting small numbers for ecmult-window and ecmult-gen-precision should be good enough. (But I see that WASM is of course a bit special because binary size directly translates to network traffic...)

I'm currently using an ecmult-window size of 2 of ecmult-gen-precision of 2 in order to get the smallest binary, with moderate success (240 KB). Is there a configuration or linking setup I'm missing that would allow me to shrink this even further?

You could try this: (Maybe together with --disable-shared -- though I doubt that shared even makes sense for WASM?!)

CFLAGS="-fdata-sections -ffunction-sections -O2 -g" LDFLAGS="-Wl,--gc-sections"

This should drop all unused functions and data during linking. I've never tried this on WASM, and I don't know if it gives you that much. It's mostly useful if you don't need signing or verification (because then the respective table can be dropped).

emconfigure ./configure \
  --enable-module-ecdh \
  --enable-module-schnorrsig=no \
  --enable-module-recovery=no \
  --enable-module-ellswift=no \
  --enable-module-extrakeys=no \
  --with-ecmult-window=2 \
  --with-ecmult-gen-precision=2 \
  CFLAGS="-O3"

Have you tried -O2? We set -O2 because it's faster on "normal" targets, and it should also make the binary a bit smaller because it means less loop unrolling. (Also, -O2 probably is a bit safer when it comes to compilers potentially removing side-channel protections. You could also try -Os but I'd recommend against this for this exact reason.)

By the way, you should also try --with-ecmult-window=4. It should barely increase the binary size, but it's much faster.

We test on many platforms in CI, but we don't test on WASM currently. Perhaps we should do this.

[blake-regalia]

Thanks for the guidance! I definitely overlooked the possible risk to side-channel protection from over optimization.

In case it helps at all, here's the build script and Dockerfile I'm using for our CI.

For posterity's sake in case anyone coming to this by search is curious, the table generated by --with-ecmult-gen-precision=2 adds about 41 KB to the WASM binary (~16% of our binary which covers ecdh, sign, and verify).