From cde0f324000c1eb04832c1b63ae48074d6dc3da8 Mon Sep 17 00:00:00 2001
From: Derek Miller <1340081+derek-miller@users.noreply.github.com>
Date: Sat, 17 Oct 2026 22:18:46 -0500
Subject: [PATCH 1/2] Raise mul's OpenSSL routing threshold to match a Control4
 controller

Measured on the dev controller inside a jit="1" driver (every finitelabs
driver sets it), mul through lua-openssl only beats pure Lua from about 12
limb products per converted limb, not the 4 that divmod, mod and mod_mul
win at. mul now routes at MUL_ROUTE_MIN_RATIO (12); the others keep 4.

The same measurement replaces the pure-Lua mod_exp costs recorded in
2026-08: the current code takes 21 ms + 1.34 ms per exponent bit with the
JIT and 65 ms + 15.5 ms without, so a Pair-Setup exchange is ~2.5 s or
~28 s in pure Lua, against ~0.04 s through bn.powmod, not minutes.
---
 CLAUDE.md             |  40 ++++++++---------
 README.md             |   6 +--
 src/crypto/bignum.lua | 100 +++++++++++++++++++++++-------------------
 src/crypto/srp.lua    |  14 +++---
 4 files changed, 83 insertions(+), 77 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 6aada88..40c1aa3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -166,11 +166,12 @@ Routing is deliberate and hardwired, not runtime-probed:
   in `hkdf.lua`.
 - **bignum** → per operation, behind `Feature.BN` and that operation's own
   multi-limb known-answer check; `bignum.is_accelerated(op)` reports each.
-  `mod_exp` routes at every size; `mul`, `divmod`, `mod` and `mod_mul` once
-  estimated pure-Lua work reaches `ROUTE_MIN_RATIO` limb products per limb
-  converted, so linear-cost calls stay pure Lua. The measurements and the one
-  known loss (narrow `mul` under LuaJIT's JIT) are in `bignum.lua`'s OpenSSL
-  section; measure whether Control4's LuaJIT runs its JIT before changing it.
+  `mod_exp` routes at every size; `divmod`, `mod` and `mod_mul` once estimated
+  pure-Lua work reaches `ROUTE_MIN_RATIO` (4) limb products per limb converted,
+  `mul` at `MUL_ROUTE_MIN_RATIO` (12), so linear-cost calls stay pure Lua. Both
+  ratios come from controller measurements with the driver's JIT on, which every
+  finitelabs driver enables with `jit="1"` on its `<script>` in `driver.xml`;
+  the table is in `bignum.lua`'s OpenSSL section.
 
 ### Feature gating
 
@@ -232,29 +233,28 @@ the rest are not.
 
 ### Why bignum must use OpenSSL on Control4
 
-Measured on a controller (2026-08-07), pure-Lua `mod_exp` over RFC 5054 group 15,
-timed across exponents of 4/8/16/32/64/96 bits and fitted (R² = 0.9962):
+Measured on the dev controller (2026-10-18: arm64, LuaJIT 2.1.1700206165,
+lua-openssl 0.8.5), pure-Lua `mod_exp` over RFC 5054 group 15, fitted across
+small exponents:
 
-```
-ms = 4982 + 669 * exponent_bits
-```
-
-| exponent | pure Lua | `bn.powmod` | ratio |
+| driver | pure-Lua `mod_exp` | 256-bit exponent | full width |
 |---|---|---|---|
-| 256-bit (SRP `A = g^a mod N`) | ~176 s (2.9 min) | 5.08 ms | ~34,000x |
-| 3072-bit (full width) | ~2061 s (34 min) | 60.92 ms | ~34,000x |
+| JIT on (`jit="1"`, every finitelabs driver) | 21 ms + 1.34 ms/bit | ~0.36 s | ~4.1 s |
+| JIT off | 65 ms + 15.5 ms/bit | ~4.0 s | ~48 s |
+| `bn.powmod` | | 5.13 ms | 60.97 ms |
 
-A full Pair-Setup client does three exponentiations, so pure Lua is on the order
-of **15 minutes** against **under 0.05 s** with OpenSSL. Worse, it is not merely
-slow: a direct attempt at a 256-bit exponent blocked the driver's Lua thread long
-enough that the driver was reset before finishing, and while blocked the
-controller stopped servicing other drivers' Lua too.
+A Pair-Setup client raises to 256-, 512- and about 1024-bit exponents: about
+2.5 s in pure Lua with the JIT (1.4 s for the largest call), about 28 s without,
+and about 0.04 s through OpenSSL. Lua execution is effectively serialised across
+drivers there, so a pure-Lua exchange stalls every driver for that long. The
+2026-08-07 figure this replaces, 669 ms per bit, does not reproduce with the
+current code in either mode.
 
 So on Control4 the pure-Lua path is a **correctness reference and a portability
 fallback, not a shippable code path**. `Feature.BN` resolving true is effectively
 a precondition for HAP pairing on this hardware. Anything built on `crypto.srp`
 should check **`crypto.srp.is_accelerated()`** and fail loudly rather than
-silently falling back to something that will hang the controller.
+silently falling back to something that stalls the controller for seconds.
 
 That accessor delegates to `bignum.is_accelerated()`, which applies both of the
 conditions `mod_exp` applies: the feature gate *and* the multi-limb known-answer
diff --git a/README.md b/README.md
index 2f413da..9634af6 100644
--- a/README.md
+++ b/README.md
@@ -99,9 +99,9 @@ precondition instead of making callers read another module's feature map:
 
 ```lua
 if not crypto.srp.is_accelerated() then
-  -- 3072-bit modexp in pure Lua is ~176 s for the client exponent on a Control4
-  -- controller, against ~5 ms via bn.powmod, and Lua execution is serialised
-  -- across drivers there, so it blocks the whole controller. Refuse instead.
+  -- A pure-Lua exchange takes ~2.5 s on a Control4 controller with the driver's
+  -- JIT on (~28 s without), against ~0.04 s via bn.powmod, and Lua execution is
+  -- serialised across drivers there, so it stalls the whole controller. Refuse.
 end
 ```
 
diff --git a/src/crypto/bignum.lua b/src/crypto/bignum.lua
index 7c6ea8a..f7053da 100644
--- a/src/crypto/bignum.lua
+++ b/src/crypto/bignum.lua
@@ -102,9 +102,11 @@ local VEC_MOD_SUB_HEX = "9784715e4b3825112f4d28e4f6afe0c9b9c8d6d5e4f40312"
 local VEC_MOD_MUL_HEX = "c5789ec2c73be1123b996b5bf34a44eba5d1145d374fc548"
 local VEC_MOD_EXP_HEX = "e6663770f70809f8c052b35cc00534b8d5b2c013a9d4874c"
 
---- Minimum pure-Lua limb products per limb converted for mul, divmod, mod and
---- mod_mul to route to OpenSSL; see "INTERNAL: OPENSSL ACCELERATION".
+--- Minimum pure-Lua limb products per limb converted for divmod, mod and mod_mul
+--- to route to OpenSSL, and the higher one mul needs; see "INTERNAL: OPENSSL
+--- ACCELERATION".
 local ROUTE_MIN_RATIO = 4
+local MUL_ROUTE_MIN_RATIO = 12
 
 -- ============================================================================
 -- INTERNAL: CORE HELPERS
@@ -671,35 +673,37 @@ end
 -- it, and selftest() asserts exactly that.
 --
 -- Conversion runs in Lua and is linear in the limbs moved; the pure-Lua cost is
--- the schoolbook limb products. So mul, divmod, mod and mod_mul route only once
--- estimated work reaches ROUTE_MIN_RATIO limb products per limb converted,
--- which keeps linear-cost calls here at any width: a one-limb factor or
--- divisor, a quotient of a limb or two, operands already reduced. add and sub
--- never route, and mod_add/mod_sub reach the binding only through `mod` with an
--- unreduced operand. mod_exp routes at every size: even a small one does
--- quadratic work per exponent bit.
+-- the schoolbook limb products. So an operation routes only once its estimated
+-- work reaches a ratio of limb products per limb converted, which keeps
+-- linear-cost calls here at any width: a one-limb factor or divisor, a quotient
+-- of a limb or two, operands already reduced. add and sub never route, and
+-- mod_add/mod_sub reach the binding only through `mod` with an unreduced
+-- operand. mod_exp routes at every size: even a small one does quadratic work
+-- per exponent bit.
 --
--- Pure-Lua time over OpenSSL time including both conversions; lua-openssl
--- 0.8.5 over OpenSSL 3.5 on Apple Silicon (2026-10-17), best of several warm
--- runs, widths in 24-bit limbs (128 = 3072 bits):
+-- Pure-Lua time over OpenSSL time including both conversions, measured on a
+-- Control4 dev controller (2026-10-18: arm64, LuaJIT 2.1.1700206165, lua-openssl
+-- 0.8.5) inside a driver with and without its JIT, widths in 24-bit limbs
+-- (128 = 3072 bits):
 --
---   call                              Lua 5.4   LuaJIT    LuaJIT -joff
---   mul 128x128                        16.3x    5.2-6.0x     11.8x
---   divmod 256/128                     14.1x    5.2-7.4x     15.7x
---   mod_mul 128,128,128                29.5x   12.7-13.4x    25.2x
---   mod_mul 22,128,128 (SRP's k*v)      8.8x      3.6x        6.8x
---   mul 22x22 (SRP's u*x)               2.7x    0.6-0.7x      2.1x
---   mul 9x128                           2.2x    0.5-0.6x      1.6x
---   mod 129/128 (quotient of 2 limbs)   0.9x    0.5-0.6x      0.8x
---   divmod 300/1                        0.3x    0.2x          0.3x
---   add, sub 128                        0.1x      0.0x        0.2x
+--   call                              JIT on   JIT off
+--   mul 16x16                          0.34x     1.60x
+--   mul 22x22 (SRP's u*x)              0.38x     2.18x
+--   mul 48x48                          0.94x
+--   mul 64x64                          1.30x
+--   mul 128x128                        2.39x    14.69x
+--   mul 24x128                         1.04x
+--   divmod 40/20                       1.26x     2.07x
+--   divmod 256/128                     7.94x
+--   mod_mul 8,8,8                      1.06x     1.89x
+--   mod_mul 22,128,128 (SRP's k*v)     3.97x
+--   mod 129/128 (not routed)           0.29x
 --
--- At 4, every routed shape wins by 1.5x or more under Lua 5.4 and LuaJIT -joff.
--- With the JIT on, mul loses about 2x (2-3 us for SRP's u*x) when its narrower
--- factor is under about 24 limbs, or a square under 32. No floor is set: one
--- would give up the interpreter's 1.6-2.7x on those shapes, and whether
--- Control4's LuaJIT runs its JIT is not recorded. Divides and mod_mul win or
--- come within about 15% even there.
+-- Every finitelabs driver sets jit="1", so the JIT column decides. divmod, mod
+-- and mod_mul win at ROUTE_MIN_RATIO (4) in both modes. mul, whose pure-Lua
+-- loop the JIT speeds up most, breaks even near 12 with the JIT on (about 3
+-- without), hence MUL_ROUTE_MIN_RATIO; without the JIT that gives up at most a
+-- few tenths of a millisecond per mid-size multiply.
 
 --- Binding whose behaviour has been checked, and the verdict per operation.
 --- @type table?
@@ -722,9 +726,10 @@ end
 --- @param work integer Estimated pure-Lua cost, in limb products
 --- @param limbs_in integer Limbs converted into the binding (the operands)
 --- @param limbs_out integer Most limbs converted back out (the results)
+--- @param ratio integer Minimum limb products per limb converted
 --- @return boolean
-local function worth_routing(work, limbs_in, limbs_out)
-  return work > 0 and work >= ROUTE_MIN_RATIO * (limbs_in + limbs_out)
+local function worth_routing(work, limbs_in, limbs_out, ratio)
+  return work > 0 and work >= ratio * (limbs_in + limbs_out)
 end
 
 --- Resolve this build's modular-exponentiation entry point.
@@ -1095,7 +1100,7 @@ end
 --- @param b BigNum Second factor
 --- @return BigNum product
 function bignum.mul(a, b)
-  if worth_routing(#a * #b, #a + #b, #a + #b) then
+  if worth_routing(#a * #b, #a + #b, #a + #b, MUL_ROUTE_MIN_RATIO) then
     local product = run_openssl("mul", a, b)
     if product then
       return product
@@ -1111,7 +1116,7 @@ end
 --- @return BigNum remainder a - quotient * b
 function bignum.divmod(a, b)
   -- Out: a quotient of up to #a - #b + 1 limbs and a remainder of up to #b.
-  if worth_routing(div_work(#a, #b), #a + #b, #a + 1) then
+  if worth_routing(div_work(#a, #b), #a + #b, #a + 1, ROUTE_MIN_RATIO) then
     local quotient, remainder = run_openssl("divmod", a, b)
     if quotient and remainder then
       return quotient, remainder
@@ -1125,7 +1130,7 @@ end
 --- @param b BigNum Modulus (must be non-zero)
 --- @return BigNum remainder
 function bignum.mod(a, b)
-  if worth_routing(div_work(#a, #b), #a + #b, #b) then
+  if worth_routing(div_work(#a, #b), #a + #b, #b, ROUTE_MIN_RATIO) then
     local remainder = run_openssl("mod", a, b)
     if remainder then
       return remainder
@@ -1167,7 +1172,7 @@ end
 --- @return BigNum result (a * b) mod m
 function bignum.mod_mul(a, b, m)
   local product_limbs = (#a == 0 or #b == 0) and 0 or #a + #b
-  if worth_routing(#a * #b + div_work(product_limbs, #m), #a + #b + #m, #m) then
+  if worth_routing(#a * #b + div_work(product_limbs, #m), #a + #b + #m, #m, ROUTE_MIN_RATIO) then
     local result = run_openssl("mod_mul", a, b, m)
     if result then
       return result
@@ -1221,9 +1226,10 @@ end
 ---
 --- Each operation is checked separately, so the answers can differ. For mul,
 --- divmod, mod and mod_mul, true covers only calls wide enough to route. Losing
---- one costs up to about a second per 3072-bit call on Control4 (extrapolated
---- from pure-Lua mod_exp's 669 ms per exponent bit); losing mod_exp costs
---- minutes, which is why `srp.is_accelerated` asks about it alone.
+--- one costs milliseconds per 3072-bit call on Control4 (mod_mul: 3.6 ms in pure
+--- Lua against 0.28 ms). Losing mod_exp costs seconds per call (1.34 ms per
+--- exponent bit with the driver's JIT on, 15.5 without, against about 0.02),
+--- which is why `srp.is_accelerated` asks about it alone.
 ---
 --- The verdict is not static: it changes with `crypto.use_openssl()`.
 ---
@@ -2083,15 +2089,15 @@ function bignum.selftest()
         local B = from_hex(SRP_EXP_B_HEX)
         local wide = mul_raw(N, B)
         local seven, byte = from_number(7), from_number(255)
-        local a15, a16, b16 =
-          from_hex(string_rep("ab", 45)), from_hex(string_rep("ab", 48)), from_hex(string_rep("cd", 48))
+        local a47, a48, b48 =
+          from_hex(string_rep("ab", 141)), from_hex(string_rep("ab", 144)), from_hex(string_rep("cd", 144))
         --- @type table[]
         local shapes = {
           { false, bignum.mul, X, Y }, -- narrow operands
           { false, bignum.divmod, X, Y },
           { false, bignum.mod, X, M },
-          { false, bignum.mul, a15, b16 }, -- 240 limb products for 62 limbs converted: under 4
-          { "mul", bignum.mul, a16, b16 }, -- 256 for 64: exactly 4
+          { false, bignum.mul, a47, b48 }, -- 2256 limb products for 190 limbs converted: under 12
+          { "mul", bignum.mul, a48, b48 }, -- 2304 for 192: exactly 12
           { false, bignum.mul, seven, wide }, -- a one-limb factor, either side
           { false, bignum.mul, wide, seven },
           { false, bignum.mul, bignum.zero(), bignum.zero() },
@@ -2123,7 +2129,7 @@ function bignum.selftest()
             error("shape " .. i .. " routed wrongly or changed its answer")
           end
         end
-        return #a15 == 15 and #a16 == 16
+        return #a47 == 47 and #a48 == 48
       end,
     },
     {
@@ -2213,14 +2219,16 @@ function bignum.selftest()
     {
       name = "signed hex from the binding is refused, not read as negative limbs",
       test = function()
+        -- X * 16^112 is 30 limbs, wide enough against N to route. N times it is
+        -- 944 hex digits, not a multiple of a limb's 6, so the "-" shares a chunk
+        -- with digits and from_hex alone would read it as a negative limb.
+        local wide_x = from_hex(VEC_X_HEX .. string_rep("0", 112))
         install(nil)
-        local pure = bignum.mul(N, X)
+        local pure = bignum.mul(N, wide_x)
         local binding, calls = make_binding({ signed_hex = true })
         install(binding)
-        local product = bignum.mul(N, X)
+        local product = bignum.mul(N, wide_x)
         install(nil)
-        -- N*X is 832 hex digits, not a multiple of a limb's 6, so the "-" shares
-        -- a chunk with digits and from_hex alone would read it as a negative limb.
         return calls("mul") == 2 and equals(product, pure)
       end,
     },
diff --git a/src/crypto/srp.lua b/src/crypto/srp.lua
index 2e3d794..4a70080 100644
--- a/src/crypto/srp.lua
+++ b/src/crypto/srp.lua
@@ -390,14 +390,12 @@ end
 
 --- Whether an exchange will run at usable speed on this host.
 ---
---- SRP-6a's cost is dominated by modular exponentiation over the group modulus,
---- and for the 3072-bit HAP group the gap between backends is not a matter of
---- taste. Measured on a Control4 controller (2026-08-07): `bn.powmod` takes
---- 5.08 ms, while the pure-Lua path extrapolates to roughly 176 s for the
---- 256-bit client exponent -- a factor of about 34,000. Worse, Lua execution is
---- effectively serialised across drivers there, so an unaccelerated exchange
---- does not merely run slowly, it blocks the controller until the watchdog
---- resets the driver.
+--- SRP-6a's cost is dominated by modular exponentiation over the group modulus.
+--- Measured on a Control4 controller (2026-10-18), a client exchange's three
+--- exponentiations take about 2.5 s in pure Lua with the driver's JIT on and
+--- about 28 s without it, against about 0.04 s through `bn.powmod`. Lua
+--- execution is effectively serialised across drivers there, so an
+--- unaccelerated exchange stalls every driver on the controller for that long.
 ---
 --- This is deliberately advisory. `crypto.bignum` stays portable and will
 --- compute the same answer either way, because the pure path is what makes the

From a9537862304418588557e41d399db5bd8e124452 Mon Sep 17 00:00:00 2001
From: Derek Miller <1340081+derek-miller@users.noreply.github.com>
Date: Sun, 18 Oct 2026 00:18:52 -0500
Subject: [PATCH 2/2] Trim the routing comments and keep them independent of
 any one consumer

---
 CLAUDE.md             | 12 +++++------
 README.md             |  5 ++---
 src/crypto/bignum.lua | 47 +++++++++++--------------------------------
 src/crypto/srp.lua    | 11 +++++-----
 4 files changed, 24 insertions(+), 51 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 40c1aa3..0681075 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -169,9 +169,9 @@ Routing is deliberate and hardwired, not runtime-probed:
   `mod_exp` routes at every size; `divmod`, `mod` and `mod_mul` once estimated
   pure-Lua work reaches `ROUTE_MIN_RATIO` (4) limb products per limb converted,
   `mul` at `MUL_ROUTE_MIN_RATIO` (12), so linear-cost calls stay pure Lua. Both
-  ratios come from controller measurements with the driver's JIT on, which every
-  finitelabs driver enables with `jit="1"` on its `<script>` in `driver.xml`;
-  the table is in `bignum.lua`'s OpenSSL section.
+  ratios were measured on a Control4 controller with LuaJIT's JIT on (a driver
+  enables it with `jit="1"` on its `<script>` in `driver.xml`); see `bignum.lua`'s
+  OpenSSL section.
 
 ### Feature gating
 
@@ -239,16 +239,14 @@ small exponents:
 
 | driver | pure-Lua `mod_exp` | 256-bit exponent | full width |
 |---|---|---|---|
-| JIT on (`jit="1"`, every finitelabs driver) | 21 ms + 1.34 ms/bit | ~0.36 s | ~4.1 s |
+| JIT on (`jit="1"` in `driver.xml`) | 21 ms + 1.34 ms/bit | ~0.36 s | ~4.1 s |
 | JIT off | 65 ms + 15.5 ms/bit | ~4.0 s | ~48 s |
 | `bn.powmod` | | 5.13 ms | 60.97 ms |
 
 A Pair-Setup client raises to 256-, 512- and about 1024-bit exponents: about
 2.5 s in pure Lua with the JIT (1.4 s for the largest call), about 28 s without,
 and about 0.04 s through OpenSSL. Lua execution is effectively serialised across
-drivers there, so a pure-Lua exchange stalls every driver for that long. The
-2026-08-07 figure this replaces, 669 ms per bit, does not reproduce with the
-current code in either mode.
+drivers there, so a pure-Lua exchange stalls every driver for that long.
 
 So on Control4 the pure-Lua path is a **correctness reference and a portability
 fallback, not a shippable code path**. `Feature.BN` resolving true is effectively
diff --git a/README.md b/README.md
index 9634af6..5906ebc 100644
--- a/README.md
+++ b/README.md
@@ -99,9 +99,8 @@ precondition instead of making callers read another module's feature map:
 
 ```lua
 if not crypto.srp.is_accelerated() then
-  -- A pure-Lua exchange takes ~2.5 s on a Control4 controller with the driver's
-  -- JIT on (~28 s without), against ~0.04 s via bn.powmod, and Lua execution is
-  -- serialised across drivers there, so it stalls the whole controller. Refuse.
+  -- Pure Lua takes ~2.5 s per exchange on a Control4 controller (~28 s without
+  -- the JIT) against ~0.04 s via bn.powmod, stalling every driver. Refuse.
 end
 ```
 
diff --git a/src/crypto/bignum.lua b/src/crypto/bignum.lua
index f7053da..64bbebf 100644
--- a/src/crypto/bignum.lua
+++ b/src/crypto/bignum.lua
@@ -672,38 +672,17 @@ end
 -- accelerator invisible to callers -- results are identical with and without
 -- it, and selftest() asserts exactly that.
 --
--- Conversion runs in Lua and is linear in the limbs moved; the pure-Lua cost is
--- the schoolbook limb products. So an operation routes only once its estimated
--- work reaches a ratio of limb products per limb converted, which keeps
--- linear-cost calls here at any width: a one-limb factor or divisor, a quotient
--- of a limb or two, operands already reduced. add and sub never route, and
--- mod_add/mod_sub reach the binding only through `mod` with an unreduced
--- operand. mod_exp routes at every size: even a small one does quadratic work
--- per exponent bit.
+-- Conversion runs in Lua and is linear in the limbs moved, while the pure-Lua
+-- cost is the schoolbook limb products, so an operation routes only once its
+-- estimated work per limb converted reaches a ratio. Linear-cost calls (a
+-- one-limb factor or divisor, a narrow quotient, reduced operands, add, sub)
+-- stay here at any width. mod_exp routes at every size.
 --
--- Pure-Lua time over OpenSSL time including both conversions, measured on a
--- Control4 dev controller (2026-10-18: arm64, LuaJIT 2.1.1700206165, lua-openssl
--- 0.8.5) inside a driver with and without its JIT, widths in 24-bit limbs
--- (128 = 3072 bits):
---
---   call                              JIT on   JIT off
---   mul 16x16                          0.34x     1.60x
---   mul 22x22 (SRP's u*x)              0.38x     2.18x
---   mul 48x48                          0.94x
---   mul 64x64                          1.30x
---   mul 128x128                        2.39x    14.69x
---   mul 24x128                         1.04x
---   divmod 40/20                       1.26x     2.07x
---   divmod 256/128                     7.94x
---   mod_mul 8,8,8                      1.06x     1.89x
---   mod_mul 22,128,128 (SRP's k*v)     3.97x
---   mod 129/128 (not routed)           0.29x
---
--- Every finitelabs driver sets jit="1", so the JIT column decides. divmod, mod
--- and mod_mul win at ROUTE_MIN_RATIO (4) in both modes. mul, whose pure-Lua
--- loop the JIT speeds up most, breaks even near 12 with the JIT on (about 3
--- without), hence MUL_ROUTE_MIN_RATIO; without the JIT that gives up at most a
--- few tenths of a millisecond per mid-size multiply.
+-- The ratios were measured on a Control4 controller (arm64, LuaJIT 2.1,
+-- lua-openssl 0.8.5, 2026-10-18) with the JIT on, the case that favours pure
+-- Lua most: divmod, mod and mod_mul win from 4, mul only from 12 (48x48 limbs
+-- 0.94x, 64x64 1.30x, 128x128 2.39x). Without the JIT mul wins from about 3, so
+-- there 12 gives up at most a few tenths of a millisecond per multiply.
 
 --- Binding whose behaviour has been checked, and the verdict per operation.
 --- @type table?
@@ -1226,10 +1205,8 @@ end
 ---
 --- Each operation is checked separately, so the answers can differ. For mul,
 --- divmod, mod and mod_mul, true covers only calls wide enough to route. Losing
---- one costs milliseconds per 3072-bit call on Control4 (mod_mul: 3.6 ms in pure
---- Lua against 0.28 ms). Losing mod_exp costs seconds per call (1.34 ms per
---- exponent bit with the driver's JIT on, 15.5 without, against about 0.02),
---- which is why `srp.is_accelerated` asks about it alone.
+--- one of those costs milliseconds per 3072-bit call; losing mod_exp costs
+--- seconds, which is why `srp.is_accelerated` asks about it alone.
 ---
 --- The verdict is not static: it changes with `crypto.use_openssl()`.
 ---
diff --git a/src/crypto/srp.lua b/src/crypto/srp.lua
index 4a70080..6c336a7 100644
--- a/src/crypto/srp.lua
+++ b/src/crypto/srp.lua
@@ -390,12 +390,11 @@ end
 
 --- Whether an exchange will run at usable speed on this host.
 ---
---- SRP-6a's cost is dominated by modular exponentiation over the group modulus.
---- Measured on a Control4 controller (2026-10-18), a client exchange's three
---- exponentiations take about 2.5 s in pure Lua with the driver's JIT on and
---- about 28 s without it, against about 0.04 s through `bn.powmod`. Lua
---- execution is effectively serialised across drivers there, so an
---- unaccelerated exchange stalls every driver on the controller for that long.
+--- SRP-6a's cost is dominated by modular exponentiation. On a Control4
+--- controller (2026-10-18) a client exchange takes about 2.5 s in pure Lua with
+--- LuaJIT's JIT on, about 28 s without it, and about 0.04 s through `bn.powmod`.
+--- Lua there is effectively serialised across drivers, so the pure path stalls
+--- them all for that long.
 ---
 --- This is deliberately advisory. `crypto.bignum` stays portable and will
 --- compute the same answer either way, because the pure path is what makes the