Skip to content

Commit 9ce9984

Browse files
real-or-randomreal-or-random
committed
Merge #1265: Remove bits argument from secp256k1_wnaf_const{_xonly}
a575339 Remove bits argument from secp256k1_wnaf_const (always 256) (Pieter Wuille) Pull request description: There is little reason for having the number of bits in the scalar as a parameter, as I don't think there are any (current) use cases for non-256-bit scalars. ACKs for top commit: jonasnick: ACK a575339 real-or-random: utACK a575339 Tree-SHA512: 994b1f19b4c513f6d070ed259a5d6f221a0c2450271ec824c5eba1cd0ecace276de391c170285bfeae96aaf8f1e0f7fe6260966ded0336c75c522ab6c56d182c
2 parents 566faa1 + a575339 commit 9ce9984

File tree

6 files changed

+43
-63
lines changed

6 files changed

+43
-63
lines changed

‎src/bench_ecmult.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ static void bench_ecmult_const(void* arg, int iters) {
113113
int i;
114114

115115
for (i = 0; i < iters; ++i) {
116-
secp256k1_ecmult_const(&data->output[i], &data->pubkeys[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], 256);
116+
secp256k1_ecmult_const(&data->output[i], &data->pubkeys[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS]);
117117
}
118118
}
119119

‎src/ecmult_const.h

+1-4
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,9 @@
1212

1313
/**
1414
* Multiply: R = q*A (in constant-time)
15-
* Here `bits` should be set to the maximum bitlength of the _absolute value_ of `q`, plus
16-
* one because we internally sometimes add 2 to the number during the WNAF conversion.
1715
* A must not be infinity.
1816
*/
19-
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *q, int bits);
17+
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *q);
2018

2119
/**
2220
* Same as secp256k1_ecmult_const, but takes in an x coordinate of the base point
@@ -35,7 +33,6 @@ static int secp256k1_ecmult_const_xonly(
3533
const secp256k1_fe *n,
3634
const secp256k1_fe *d,
3735
const secp256k1_scalar *q,
38-
int bits,
3936
int known_on_curve
4037
);
4138

‎src/ecmult_const_impl.h

+22-39
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ static int secp256k1_wnaf_const(int *wnaf, const secp256k1_scalar *scalar, int w
130130
return skew;
131131
}
132132

133-
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *scalar, int size) {
133+
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *scalar) {
134134
secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
135135
secp256k1_ge tmpa;
136136
secp256k1_fe Z;
@@ -145,18 +145,10 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
145145
int i;
146146

147147
/* build wnaf representation for q. */
148-
int rsize = size;
149-
if (size > 128) {
150-
rsize = 128;
151-
/* split q into q_1 and q_lam (where q = q_1 + q_lam*lambda, and q_1 and q_lam are ~128 bit) */
152-
secp256k1_scalar_split_lambda(&q_1, &q_lam, scalar);
153-
skew_1 = secp256k1_wnaf_const(wnaf_1, &q_1, WINDOW_A - 1, 128);
154-
skew_lam = secp256k1_wnaf_const(wnaf_lam, &q_lam, WINDOW_A - 1, 128);
155-
} else
156-
{
157-
skew_1 = secp256k1_wnaf_const(wnaf_1, scalar, WINDOW_A - 1, size);
158-
skew_lam = 0;
159-
}
148+
/* split q into q_1 and q_lam (where q = q_1 + q_lam*lambda, and q_1 and q_lam are ~128 bit) */
149+
secp256k1_scalar_split_lambda(&q_1, &q_lam, scalar);
150+
skew_1 = secp256k1_wnaf_const(wnaf_1, &q_1, WINDOW_A - 1, 128);
151+
skew_lam = secp256k1_wnaf_const(wnaf_lam, &q_lam, WINDOW_A - 1, 128);
160152

161153
/* Calculate odd multiples of a.
162154
* All multiples are brought to the same Z 'denominator', which is stored
@@ -170,28 +162,23 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
170162
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
171163
secp256k1_fe_normalize_weak(&pre_a[i].y);
172164
}
173-
if (size > 128) {
174-
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
175-
secp256k1_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]);
176-
}
177-
165+
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
166+
secp256k1_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]);
178167
}
179168

180169
/* first loop iteration (separated out so we can directly set r, rather
181170
* than having it start at infinity, get doubled several times, then have
182171
* its new value added to it) */
183-
i = wnaf_1[WNAF_SIZE_BITS(rsize, WINDOW_A - 1)];
172+
i = wnaf_1[WNAF_SIZE_BITS(128, WINDOW_A - 1)];
184173
VERIFY_CHECK(i != 0);
185174
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, i, WINDOW_A);
186175
secp256k1_gej_set_ge(r, &tmpa);
187-
if (size > 128) {
188-
i = wnaf_lam[WNAF_SIZE_BITS(rsize, WINDOW_A - 1)];
189-
VERIFY_CHECK(i != 0);
190-
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, i, WINDOW_A);
191-
secp256k1_gej_add_ge(r, r, &tmpa);
192-
}
176+
i = wnaf_lam[WNAF_SIZE_BITS(128, WINDOW_A - 1)];
177+
VERIFY_CHECK(i != 0);
178+
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, i, WINDOW_A);
179+
secp256k1_gej_add_ge(r, r, &tmpa);
193180
/* remaining loop iterations */
194-
for (i = WNAF_SIZE_BITS(rsize, WINDOW_A - 1) - 1; i >= 0; i--) {
181+
for (i = WNAF_SIZE_BITS(128, WINDOW_A - 1) - 1; i >= 0; i--) {
195182
int n;
196183
int j;
197184
for (j = 0; j < WINDOW_A - 1; ++j) {
@@ -202,12 +189,10 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
202189
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A);
203190
VERIFY_CHECK(n != 0);
204191
secp256k1_gej_add_ge(r, r, &tmpa);
205-
if (size > 128) {
206-
n = wnaf_lam[i];
207-
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A);
208-
VERIFY_CHECK(n != 0);
209-
secp256k1_gej_add_ge(r, r, &tmpa);
210-
}
192+
n = wnaf_lam[i];
193+
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A);
194+
VERIFY_CHECK(n != 0);
195+
secp256k1_gej_add_ge(r, r, &tmpa);
211196
}
212197

213198
{
@@ -218,17 +203,15 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
218203
secp256k1_gej_add_ge(&tmpj, r, &tmpa);
219204
secp256k1_gej_cmov(r, &tmpj, skew_1);
220205

221-
if (size > 128) {
222-
secp256k1_ge_neg(&tmpa, &pre_a_lam[0]);
223-
secp256k1_gej_add_ge(&tmpj, r, &tmpa);
224-
secp256k1_gej_cmov(r, &tmpj, skew_lam);
225-
}
206+
secp256k1_ge_neg(&tmpa, &pre_a_lam[0]);
207+
secp256k1_gej_add_ge(&tmpj, r, &tmpa);
208+
secp256k1_gej_cmov(r, &tmpj, skew_lam);
226209
}
227210

228211
secp256k1_fe_mul(&r->z, &r->z, &Z);
229212
}
230213

231-
static int secp256k1_ecmult_const_xonly(secp256k1_fe* r, const secp256k1_fe *n, const secp256k1_fe *d, const secp256k1_scalar *q, int bits, int known_on_curve) {
214+
static int secp256k1_ecmult_const_xonly(secp256k1_fe* r, const secp256k1_fe *n, const secp256k1_fe *d, const secp256k1_scalar *q, int known_on_curve) {
232215

233216
/* This algorithm is a generalization of Peter Dettman's technique for
234217
* avoiding the square root in a random-basepoint x-only multiplication
@@ -346,7 +329,7 @@ static int secp256k1_ecmult_const_xonly(secp256k1_fe* r, const secp256k1_fe *n,
346329
#ifdef VERIFY
347330
VERIFY_CHECK(!secp256k1_scalar_is_zero(q));
348331
#endif
349-
secp256k1_ecmult_const(&rj, &p, q, bits);
332+
secp256k1_ecmult_const(&rj, &p, q);
350333
#ifdef VERIFY
351334
VERIFY_CHECK(!secp256k1_gej_is_infinity(&rj));
352335
#endif

‎src/modules/ecdh/main_impl.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ int secp256k1_ecdh(const secp256k1_context* ctx, unsigned char *output, const se
5050
overflow |= secp256k1_scalar_is_zero(&s);
5151
secp256k1_scalar_cmov(&s, &secp256k1_scalar_one, overflow);
5252

53-
secp256k1_ecmult_const(&res, &pt, &s, 256);
53+
secp256k1_ecmult_const(&res, &pt, &s);
5454
secp256k1_ge_set_gej(&pt, &res);
5555

5656
/* Compute a hash of the point */

‎src/tests.c

+15-15
Original file line numberDiff line numberDiff line change
@@ -4338,9 +4338,9 @@ static void test_ecmult_target(const secp256k1_scalar* target, int mode) {
43384338
secp256k1_ecmult(&p2j, &pj, &n2, &zero);
43394339
secp256k1_ecmult(&ptj, &pj, target, &zero);
43404340
} else {
4341-
secp256k1_ecmult_const(&p1j, &p, &n1, 256);
4342-
secp256k1_ecmult_const(&p2j, &p, &n2, 256);
4343-
secp256k1_ecmult_const(&ptj, &p, target, 256);
4341+
secp256k1_ecmult_const(&p1j, &p, &n1);
4342+
secp256k1_ecmult_const(&p2j, &p, &n2);
4343+
secp256k1_ecmult_const(&ptj, &p, target);
43444344
}
43454345

43464346
/* Add them all up: n1*P + n2*P + target*P = (n1+n2+target)*P = (n1+n1-n1-n2)*P = 0. */
@@ -4403,7 +4403,7 @@ static void ecmult_const_random_mult(void) {
44034403
0xb84e4e1b, 0xfb77e21f, 0x96baae2a, 0x63dec956
44044404
);
44054405
secp256k1_gej b;
4406-
secp256k1_ecmult_const(&b, &a, &xn, 256);
4406+
secp256k1_ecmult_const(&b, &a, &xn);
44074407

44084408
CHECK(secp256k1_ge_is_valid_var(&a));
44094409
ge_equals_gej(&expected_b, &b);
@@ -4419,12 +4419,12 @@ static void ecmult_const_commutativity(void) {
44194419
random_scalar_order_test(&a);
44204420
random_scalar_order_test(&b);
44214421

4422-
secp256k1_ecmult_const(&res1, &secp256k1_ge_const_g, &a, 256);
4423-
secp256k1_ecmult_const(&res2, &secp256k1_ge_const_g, &b, 256);
4422+
secp256k1_ecmult_const(&res1, &secp256k1_ge_const_g, &a);
4423+
secp256k1_ecmult_const(&res2, &secp256k1_ge_const_g, &b);
44244424
secp256k1_ge_set_gej(&mid1, &res1);
44254425
secp256k1_ge_set_gej(&mid2, &res2);
4426-
secp256k1_ecmult_const(&res1, &mid1, &b, 256);
4427-
secp256k1_ecmult_const(&res2, &mid2, &a, 256);
4426+
secp256k1_ecmult_const(&res1, &mid1, &b);
4427+
secp256k1_ecmult_const(&res2, &mid2, &a);
44284428
secp256k1_ge_set_gej(&mid1, &res1);
44294429
secp256k1_ge_set_gej(&mid2, &res2);
44304430
ge_equals_ge(&mid1, &mid2);
@@ -4440,13 +4440,13 @@ static void ecmult_const_mult_zero_one(void) {
44404440
secp256k1_scalar_negate(&negone, &one);
44414441

44424442
random_group_element_test(&point);
4443-
secp256k1_ecmult_const(&res1, &point, &zero, 3);
4443+
secp256k1_ecmult_const(&res1, &point, &zero);
44444444
secp256k1_ge_set_gej(&res2, &res1);
44454445
CHECK(secp256k1_ge_is_infinity(&res2));
4446-
secp256k1_ecmult_const(&res1, &point, &one, 2);
4446+
secp256k1_ecmult_const(&res1, &point, &one);
44474447
secp256k1_ge_set_gej(&res2, &res1);
44484448
ge_equals_ge(&res2, &point);
4449-
secp256k1_ecmult_const(&res1, &point, &negone, 256);
4449+
secp256k1_ecmult_const(&res1, &point, &negone);
44504450
secp256k1_gej_neg(&res1, &res1);
44514451
secp256k1_ge_set_gej(&res2, &res1);
44524452
ge_equals_ge(&res2, &point);
@@ -4476,7 +4476,7 @@ static void ecmult_const_mult_xonly(void) {
44764476
n = base.x;
44774477
}
44784478
/* Perform x-only multiplication. */
4479-
res = secp256k1_ecmult_const_xonly(&resx, &n, (i & 1) ? &d : NULL, &q, 256, i & 2);
4479+
res = secp256k1_ecmult_const_xonly(&resx, &n, (i & 1) ? &d : NULL, &q, i & 2);
44804480
CHECK(res);
44814481
/* Perform normal multiplication. */
44824482
secp256k1_gej_set_ge(&basej, &base);
@@ -4509,7 +4509,7 @@ static void ecmult_const_mult_xonly(void) {
45094509
} else {
45104510
n = x;
45114511
}
4512-
res = secp256k1_ecmult_const_xonly(&r, &n, (i & 1) ? &d : NULL, &q, 256, 0);
4512+
res = secp256k1_ecmult_const_xonly(&r, &n, (i & 1) ? &d : NULL, &q, 0);
45134513
CHECK(res == 0);
45144514
}
45154515
}
@@ -4534,7 +4534,7 @@ static void ecmult_const_chain_multiply(void) {
45344534
for (i = 0; i < 100; ++i) {
45354535
secp256k1_ge tmp;
45364536
secp256k1_ge_set_gej(&tmp, &point);
4537-
secp256k1_ecmult_const(&point, &tmp, &scalar, 256);
4537+
secp256k1_ecmult_const(&point, &tmp, &scalar);
45384538
}
45394539
secp256k1_ge_set_gej(&res, &point);
45404540
ge_equals_gej(&res, &expected_point);
@@ -5432,7 +5432,7 @@ static void test_ecmult_accumulate(secp256k1_sha256* acc, const secp256k1_scalar
54325432
secp256k1_ecmult(&rj3, &infj, &zero, x);
54335433
secp256k1_ecmult_multi_var(NULL, scratch, &rj4, x, NULL, NULL, 0);
54345434
secp256k1_ecmult_multi_var(NULL, scratch, &rj5, &zero, test_ecmult_accumulate_cb, (void*)x, 1);
5435-
secp256k1_ecmult_const(&rj6, &secp256k1_ge_const_g, x, 256);
5435+
secp256k1_ecmult_const(&rj6, &secp256k1_ge_const_g, x);
54365436
secp256k1_ge_set_gej_var(&r, &rj1);
54375437
ge_equals_gej(&r, &rj2);
54385438
ge_equals_gej(&r, &rj3);

‎src/tests_exhaustive.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -203,19 +203,19 @@ static void test_exhaustive_ecmult(const secp256k1_ge *group, const secp256k1_ge
203203
secp256k1_scalar_set_int(&ng, j);
204204

205205
/* Test secp256k1_ecmult_const. */
206-
secp256k1_ecmult_const(&tmp, &group[i], &ng, 256);
206+
secp256k1_ecmult_const(&tmp, &group[i], &ng);
207207
ge_equals_gej(&group[(i * j) % EXHAUSTIVE_TEST_ORDER], &tmp);
208208

209209
if (j != 0) {
210210
/* Test secp256k1_ecmult_const_xonly with all curve X coordinates, and xd=NULL. */
211-
ret = secp256k1_ecmult_const_xonly(&tmpf, &group[i].x, NULL, &ng, 256, 0);
211+
ret = secp256k1_ecmult_const_xonly(&tmpf, &group[i].x, NULL, &ng, 0);
212212
CHECK(ret);
213213
CHECK(secp256k1_fe_equal_var(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
214214

215215
/* Test secp256k1_ecmult_const_xonly with all curve X coordinates, with random xd. */
216216
random_fe_non_zero(&xd);
217217
secp256k1_fe_mul(&xn, &xd, &group[i].x);
218-
ret = secp256k1_ecmult_const_xonly(&tmpf, &xn, &xd, &ng, 256, 0);
218+
ret = secp256k1_ecmult_const_xonly(&tmpf, &xn, &xd, &ng, 0);
219219
CHECK(ret);
220220
CHECK(secp256k1_fe_equal_var(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
221221
}

0 commit comments

Comments
 (0)