Fast Sorting, Branchless by Design

https://00f.net/2026/02/17/sorting-without-leaking-secrets/

by jedisct1 • 5 months ago

29 9 5 months ago

jstrieb• 5 months ago

Wow, this is jam-packed with interesting information. Thanks for writing it! (Also thanks for all of your other great open source work!)

Are there plans to upstream this into the Zig std library? Seems like it could be useful for more than just the cryptography package, since the benchmarks at the end have it often being faster than std pdqsort. I just checked the issue trackers on Codeberg and GitHub, and didn't see anything mentioning djbsort or NTRU Prime, which leads me to believe there aren't (official) plans to upstream this (yet).

ozgrakkurt• 5 months ago

The blocksort in stdlib can be faster than pqdsort too in my experience

tialaramex• 5 months ago

often being faster than std pdqsort.

pdqsort is a generic comparison sort. Want to sort employee names, customer email addresses, JSON blobs, or Zebras? No problem, pdqsort just needs an ordering, in both Zig and C++ you write this as a single boolean "less" predicate.

DJB's speed-up relies on vectorization, which works great for integers or things you can squint at and see an integer - but obviously can't sort your employee names, customer email addresses, JSON blobs or Zebras. You could write these branchless network designs anyway but I'm pretty sure they'd be markedly slower, at least for some common inputs.

rep_lodsb3• 5 months ago

    const diff = if (order == .asc) b_int - a_int else a_int - b_int;
    const sign_bit: u1 = @truncate(@as(UWInt, @bitCast(diff)) >> @intCast(bits));
    var mask_word = @as(usize, 0) -% @as(usize, sign_bit);

This code in the fallback path (when no constant-time @min/@max is available) will only work if the subtraction doesn't overflow. Or is this not a problem for some reason?

jedisct12• 5 months ago

a_int and b_int are signed values.

rep_lodsb3• 5 months ago

It makes no difference whether they're signed or unsigned. Unless the subtraction is checking for overflow, or using a wider integer type than the numbers being compared, the high bit will not in every case indicate which number is smaller.

e.g.

    0x8000_0000 < 0x0000_0001 for signed numbers
    0x8000_0000 - 0x0000_0001 = 0x7fff_ffff, high bit clear

user____name• 5 months ago

Radix sort also seems to fit the bill?

Fast Sorting, Branchless by Design

Related Stories