Skip to content

Commit bb528cf

Browse files
committed
Merge #1518: Add secp256k1_pubkey_sort
7d2591c Add secp256k1_pubkey_sort (Jonas Nick) Pull request description: This PR adds a `secp256k1_pubkey_sort` function the the public API which was originally part of the musig PR (#1479). However, I opened a separate PR because it adds internal functions that are also used by the WIP silent payments module. ACKs for top commit: sipa: ACK 7d2591c josibake: ACK 7d2591c real-or-random: ACK 7d2591c Tree-SHA512: d0e4464dc9cd4bdb35cc5d9bb4c37a7b71233328319165d49bc940d8d3394a2d74a43d2f73ee7bfe8f3f90a466ee8afcdca75cfbbf3969e218d76b89f4af55fb
2 parents da51507 + 7d2591c commit bb528cf

File tree

7 files changed

+437
-0
lines changed

7 files changed

+437
-0
lines changed

CHANGELOG.md

+3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
#### Added
11+
- New function `secp256k1_ec_pubkey_sort` that sorts public keys using lexicographic (of compressed serialization) order.
12+
1013
#### Changed
1114
- The implementation of the point multiplication algorithm used for signing and public key generation was changed, resulting in improved performance for those operations.
1215
- The related configure option `--ecmult-gen-precision` was replaced with `--ecmult-gen-kb` (`ECMULT_GEN_KB` for CMake).

Makefile.am

+2
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ noinst_HEADERS += src/field.h
6464
noinst_HEADERS += src/field_impl.h
6565
noinst_HEADERS += src/bench.h
6666
noinst_HEADERS += src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h
67+
noinst_HEADERS += src/hsort.h
68+
noinst_HEADERS += src/hsort_impl.h
6769
noinst_HEADERS += contrib/lax_der_parsing.h
6870
noinst_HEADERS += contrib/lax_der_parsing.c
6971
noinst_HEADERS += contrib/lax_der_privatekey_parsing.h

include/secp256k1.h

+14
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,20 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_cmp(
474474
const secp256k1_pubkey *pubkey2
475475
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
476476

477+
/** Sort public keys using lexicographic (of compressed serialization) order
478+
*
479+
* Returns: 0 if the arguments are invalid. 1 otherwise.
480+
*
481+
* Args: ctx: pointer to a context object
482+
* In: pubkeys: array of pointers to pubkeys to sort
483+
* n_pubkeys: number of elements in the pubkeys array
484+
*/
485+
SECP256K1_API int secp256k1_ec_pubkey_sort(
486+
const secp256k1_context *ctx,
487+
const secp256k1_pubkey **pubkeys,
488+
size_t n_pubkeys
489+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
490+
477491
/** Parse an ECDSA signature in compact (64 bytes) format.
478492
*
479493
* Returns: 1 when the signature could be parsed, 0 otherwise.

src/hsort.h

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/***********************************************************************
2+
* Copyright (c) 2021 Russell O'Connor, Jonas Nick *
3+
* Distributed under the MIT software license, see the accompanying *
4+
* file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5+
***********************************************************************/
6+
7+
#ifndef SECP256K1_HSORT_H
8+
#define SECP256K1_HSORT_H
9+
10+
#include <stddef.h>
11+
#include <string.h>
12+
13+
/* In-place, iterative heapsort with an interface matching glibc's qsort_r. This
14+
* is preferred over standard library implementations because they generally
15+
* make no guarantee about being fast for malicious inputs.
16+
* Remember that heapsort is unstable.
17+
*
18+
* In/Out: ptr: pointer to the array to sort. The contents of the array are
19+
* sorted in ascending order according to the comparison function.
20+
* In: count: number of elements in the array.
21+
* size: size in bytes of each element.
22+
* cmp: pointer to a comparison function that is called with two
23+
* arguments that point to the objects being compared. The cmp_data
24+
* argument of secp256k1_hsort is passed as third argument. The
25+
* function must return an integer less than, equal to, or greater
26+
* than zero if the first argument is considered to be respectively
27+
* less than, equal to, or greater than the second.
28+
* cmp_data: pointer passed as third argument to cmp.
29+
*/
30+
static void secp256k1_hsort(void *ptr, size_t count, size_t size,
31+
int (*cmp)(const void *, const void *, void *),
32+
void *cmp_data);
33+
#endif

src/hsort_impl.h

+125
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
/***********************************************************************
2+
* Copyright (c) 2021 Russell O'Connor, Jonas Nick *
3+
* Distributed under the MIT software license, see the accompanying *
4+
* file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5+
***********************************************************************/
6+
7+
#ifndef SECP256K1_HSORT_IMPL_H
8+
#define SECP256K1_HSORT_IMPL_H
9+
10+
#include "hsort.h"
11+
12+
/* An array is a heap when, for all non-zero indexes i, the element at index i
13+
* compares as less than or equal to the element at index parent(i) = (i-1)/2.
14+
*/
15+
16+
static SECP256K1_INLINE size_t secp256k1_heap_child1(size_t i) {
17+
VERIFY_CHECK(i <= (SIZE_MAX - 1)/2);
18+
return 2*i + 1;
19+
}
20+
21+
static SECP256K1_INLINE size_t secp256k1_heap_child2(size_t i) {
22+
VERIFY_CHECK(i <= SIZE_MAX/2 - 1);
23+
return secp256k1_heap_child1(i)+1;
24+
}
25+
26+
static SECP256K1_INLINE void secp256k1_heap_swap64(unsigned char *a, unsigned char *b, size_t len) {
27+
unsigned char tmp[64];
28+
VERIFY_CHECK(len <= 64);
29+
memcpy(tmp, a, len);
30+
memmove(a, b, len);
31+
memcpy(b, tmp, len);
32+
}
33+
34+
static SECP256K1_INLINE void secp256k1_heap_swap(unsigned char *arr, size_t i, size_t j, size_t stride) {
35+
unsigned char *a = arr + i*stride;
36+
unsigned char *b = arr + j*stride;
37+
size_t len = stride;
38+
while (64 < len) {
39+
secp256k1_heap_swap64(a + (len - 64), b + (len - 64), 64);
40+
len -= 64;
41+
}
42+
secp256k1_heap_swap64(a, b, len);
43+
}
44+
45+
/* This function accepts an array arr containing heap_size elements, each of
46+
* size stride. The elements in the array at indices >i satisfy the max-heap
47+
* property, i.e., for any element at index j (where j > i), all of its children
48+
* are smaller than the element itself. The purpose of the function is to update
49+
* the array so that all elements at indices >=i satisfy the max-heap
50+
* property. */
51+
static SECP256K1_INLINE void secp256k1_heap_down(unsigned char *arr, size_t i, size_t heap_size, size_t stride,
52+
int (*cmp)(const void *, const void *, void *), void *cmp_data) {
53+
while (i < heap_size/2) {
54+
VERIFY_CHECK(i <= SIZE_MAX/2 - 1);
55+
/* Proof:
56+
* i < heap_size/2
57+
* i + 1 <= heap_size/2
58+
* 2*i + 2 <= heap_size <= SIZE_MAX
59+
* 2*i <= SIZE_MAX - 2
60+
*/
61+
62+
VERIFY_CHECK(secp256k1_heap_child1(i) < heap_size);
63+
/* Proof:
64+
* i < heap_size/2
65+
* i + 1 <= heap_size/2
66+
* 2*i + 2 <= heap_size
67+
* 2*i + 1 < heap_size
68+
* child1(i) < heap_size
69+
*/
70+
71+
/* Let [x] be notation for the contents at arr[x*stride].
72+
*
73+
* If [child1(i)] > [i] and [child2(i)] > [i],
74+
* swap [i] with the larger child to ensure the new parent is larger
75+
* than both children. When [child1(i)] == [child2(i)], swap [i] with
76+
* [child2(i)].
77+
* Else if [child1(i)] > [i], swap [i] with [child1(i)].
78+
* Else if [child2(i)] > [i], swap [i] with [child2(i)].
79+
*/
80+
if (secp256k1_heap_child2(i) < heap_size
81+
&& 0 <= cmp(arr + secp256k1_heap_child2(i)*stride, arr + secp256k1_heap_child1(i)*stride, cmp_data)) {
82+
if (0 < cmp(arr + secp256k1_heap_child2(i)*stride, arr + i*stride, cmp_data)) {
83+
secp256k1_heap_swap(arr, i, secp256k1_heap_child2(i), stride);
84+
i = secp256k1_heap_child2(i);
85+
} else {
86+
/* At this point we have [child2(i)] >= [child1(i)] and we have
87+
* [child2(i)] <= [i], and thus [child1(i)] <= [i] which means
88+
* that the next comparison can be skipped. */
89+
return;
90+
}
91+
} else if (0 < cmp(arr + secp256k1_heap_child1(i)*stride, arr + i*stride, cmp_data)) {
92+
secp256k1_heap_swap(arr, i, secp256k1_heap_child1(i), stride);
93+
i = secp256k1_heap_child1(i);
94+
} else {
95+
return;
96+
}
97+
}
98+
/* heap_size/2 <= i
99+
* heap_size/2 < i + 1
100+
* heap_size < 2*i + 2
101+
* heap_size <= 2*i + 1
102+
* heap_size <= child1(i)
103+
* Thus child1(i) and child2(i) are now out of bounds and we are at a leaf.
104+
*/
105+
}
106+
107+
/* In-place heap sort. */
108+
static void secp256k1_hsort(void *ptr, size_t count, size_t size,
109+
int (*cmp)(const void *, const void *, void *),
110+
void *cmp_data) {
111+
size_t i;
112+
113+
for (i = count/2; 0 < i; --i) {
114+
secp256k1_heap_down(ptr, i-1, count, size, cmp, cmp_data);
115+
}
116+
for (i = count; 1 < i; --i) {
117+
/* Extract the largest value from the heap */
118+
secp256k1_heap_swap(ptr, 0, i-1, size);
119+
120+
/* Repair the heap condition */
121+
secp256k1_heap_down(ptr, 0, i-1, size, cmp, cmp_data);
122+
}
123+
}
124+
125+
#endif

src/secp256k1.c

+29
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
#include "int128_impl.h"
3737
#include "scratch_impl.h"
3838
#include "selftest.h"
39+
#include "hsort_impl.h"
3940

4041
#ifdef SECP256K1_NO_BUILD
4142
# error "secp256k1.h processed without SECP256K1_BUILD defined while building secp256k1.c"
@@ -325,6 +326,34 @@ int secp256k1_ec_pubkey_cmp(const secp256k1_context* ctx, const secp256k1_pubkey
325326
return secp256k1_memcmp_var(out[0], out[1], sizeof(out[0]));
326327
}
327328

329+
static int secp256k1_ec_pubkey_sort_cmp(const void* pk1, const void* pk2, void *ctx) {
330+
return secp256k1_ec_pubkey_cmp((secp256k1_context *)ctx,
331+
*(secp256k1_pubkey **)pk1,
332+
*(secp256k1_pubkey **)pk2);
333+
}
334+
335+
int secp256k1_ec_pubkey_sort(const secp256k1_context* ctx, const secp256k1_pubkey **pubkeys, size_t n_pubkeys) {
336+
VERIFY_CHECK(ctx != NULL);
337+
ARG_CHECK(pubkeys != NULL);
338+
339+
/* Suppress wrong warning (fixed in MSVC 19.33) */
340+
#if defined(_MSC_VER) && (_MSC_VER < 1933)
341+
#pragma warning(push)
342+
#pragma warning(disable: 4090)
343+
#endif
344+
345+
/* Casting away const is fine because neither secp256k1_hsort nor
346+
* secp256k1_ec_pubkey_sort_cmp modify the data pointed to by the cmp_data
347+
* argument. */
348+
secp256k1_hsort(pubkeys, n_pubkeys, sizeof(*pubkeys), secp256k1_ec_pubkey_sort_cmp, (void *)ctx);
349+
350+
#if defined(_MSC_VER) && (_MSC_VER < 1933)
351+
#pragma warning(pop)
352+
#endif
353+
354+
return 1;
355+
}
356+
328357
static void secp256k1_ecdsa_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_ecdsa_signature* sig) {
329358
(void)ctx;
330359
if (sizeof(secp256k1_scalar) == 32) {

0 commit comments

Comments
 (0)