Skip to content

Commit

Permalink
Simpler and faster ecdh skew fixup
Browse files Browse the repository at this point in the history
  • Loading branch information
peterdettman committed Dec 26, 2021
1 parent 39a36db commit 1515099
Show file tree
Hide file tree
Showing 3 changed files with 23 additions and 27 deletions.
39 changes: 12 additions & 27 deletions src/ecmult_const_impl.h
Original file line number Diff line number Diff line change
Expand Up @@ -234,36 +234,21 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons

{
/* Correct for wNAF skew */
secp256k1_ge correction = *a;
secp256k1_ge_storage correction_1_stor;
secp256k1_ge_storage correction_lam_stor;
secp256k1_ge_storage a2_stor;
secp256k1_gej tmpj;
secp256k1_gej_set_ge(&tmpj, &correction);
secp256k1_gej_double_var(&tmpj, &tmpj, NULL);
secp256k1_ge_set_gej(&correction, &tmpj);
secp256k1_ge_to_storage(&correction_1_stor, a);
if (size > 128) {
secp256k1_ge_to_storage(&correction_lam_stor, a);
}
secp256k1_ge_to_storage(&a2_stor, &correction);

/* For odd numbers this is 2a (so replace it), for even ones a (so no-op) */
secp256k1_ge_storage_cmov(&correction_1_stor, &a2_stor, skew_1 == 2);
if (size > 128) {
secp256k1_ge_storage_cmov(&correction_lam_stor, &a2_stor, skew_lam == 2);
}
secp256k1_gej tmp;
secp256k1_ge a_1;

/* Apply the correction */
secp256k1_ge_from_storage(&correction, &correction_1_stor);
secp256k1_ge_neg(&correction, &correction);
secp256k1_gej_add_ge(r, r, &correction);
secp256k1_ge_neg(&a_1, a);
secp256k1_gej_add_ge(r, r, &a_1);
secp256k1_gej_add_ge(&tmp, r, &a_1);
secp256k1_gej_cmov(r, &tmp, skew_1 == 2);

if (size > 128) {
secp256k1_ge_from_storage(&correction, &correction_lam_stor);
secp256k1_ge_neg(&correction, &correction);
secp256k1_ge_mul_lambda(&correction, &correction);
secp256k1_gej_add_ge(r, r, &correction);
secp256k1_ge a_lam;
secp256k1_ge_mul_lambda(&a_lam, &a_1);

secp256k1_gej_add_ge(r, r, &a_lam);
secp256k1_gej_add_ge(&tmp, r, &a_lam);
secp256k1_gej_cmov(r, &tmp, skew_lam == 2);
}
}
}
Expand Down
3 changes: 3 additions & 0 deletions src/group.h
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,9 @@ static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge
/** Convert a group element back from the storage type. */
static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a);

/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. Both *r and *a must be initialized.*/
static void secp256k1_gej_cmov(secp256k1_gej *r, const secp256k1_gej *a, int flag);

/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. Both *r and *a must be initialized.*/
static void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag);

Expand Down
8 changes: 8 additions & 0 deletions src/group_impl.h
Original file line number Diff line number Diff line change
Expand Up @@ -642,6 +642,14 @@ static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storag
r->infinity = 0;
}

static SECP256K1_INLINE void secp256k1_gej_cmov(secp256k1_gej *r, const secp256k1_gej *a, int flag) {
secp256k1_fe_cmov(&r->x, &a->x, flag);
secp256k1_fe_cmov(&r->y, &a->y, flag);
secp256k1_fe_cmov(&r->z, &a->z, flag);

r->infinity ^= (r->infinity ^ a->infinity) & flag;
}

static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag) {
secp256k1_fe_storage_cmov(&r->x, &a->x, flag);
secp256k1_fe_storage_cmov(&r->y, &a->y, flag);
Expand Down

0 comments on commit 1515099

Please sign in to comment.