Poseidon is slower than that in plonky2

[dreamATD]

Initial look at the benchmarks is a bit mystifying: broke down the parts of the permutation bench into full rounds and partial rounds, and both of these are slower in the Ceno port. Further benchmarked the parts of a full round -- the round constant update, the monomial S-box, and the MDS matrix transform -- and strangely, at this level the performance difference vanished.

Probably would be worth applying some more in-depth analysis tools to the respective Poseidon::full_rounds functions to see what is going on. If I have time soon I might give it a look, but I don't have a ton of background in this level of optimization if there's anyone else who already knows the right tools.

Originally posted by @bgillesp in #180 (comment)

[matthiasgoergens]

Btw, are we using Poseidon version 1 or 2?

[bgillesp]

Looks like version 1 from what I can tell... The port was directly from the Plonky2 codebase, and their implementation starts with the following comment:

//! Implementation of the Poseidon hash function, as described in
//! <https://eprint.iacr.org/2019/458.pdf>

To make sure, is https://eprint.iacr.org/2023/323 the version 2 you're referring to?

[matthiasgoergens]

Yes, I think that's the one. https://github.com/0xmozak/mozak-vm also has an implementation with plony2 Goldilocks.