You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

#### 375 lines 13 KiB Raw Blame History

 `/**********************************************************************` ` * Copyright (c) 2013, 2014 Pieter Wuille *` ` * Distributed under the MIT software license, see the accompanying *` ` * file COPYING or http://www.opensource.org/licenses/mit-license.php.*` ` **********************************************************************/` ``` ``` `#ifndef _SECP256K1_ECMULT_IMPL_H_` `#define _SECP256K1_ECMULT_IMPL_H_` `#include "group.h"` `#include "scalar.h"` `#include "ecmult.h"` `/* optimal for 128-bit and 256-bit exponents. */` `#define WINDOW_A 5` `/** larger numbers may result in slightly better performance, at the cost of` ` exponentially larger precomputed tables. */` `#ifdef USE_ENDOMORPHISM` `/** Two tables for window size 15: 1.375 MiB. */` `#define WINDOW_G 15` `#else` `/** One table for window size 16: 1.375 MiB. */` `#define WINDOW_G 16` `#endif` `/** The number of entries a table with precomputed multiples needs to have. */` `#define ECMULT_TABLE_SIZE(w) (1 << ((w)-2))` `/** Fill a table 'prej' with precomputed odd multiples of a. Prej will contain` ` * the values [1*a,3*a,...,(2*n-1)*a], so it space for n values. zr[0] will` ` * contain prej[0].z / a.z. The other zr[i] values = prej[i].z / prej[i-1].z.` ` * Prej's Z values are undefined, except for the last value.` ` */` `static void secp256k1_ecmult_odd_multiples_table(int n, secp256k1_gej_t *prej, secp256k1_fe_t *zr, const secp256k1_gej_t *a) {` ` secp256k1_gej_t d;` ` secp256k1_ge_t a_ge, d_ge;` ` int i;` ``` ``` ` VERIFY_CHECK(!a->infinity);` ``` ``` ` secp256k1_gej_double_var(&d, a, NULL);` ``` ``` ` /*` ` * Perform the additions on an isomorphism where 'd' is affine: drop the z coordinate` ` * of 'd', and scale the 1P starting value's x/y coordinates without changing its z.` ` */` ` d_ge.x = d.x;` ` d_ge.y = d.y;` ` d_ge.infinity = 0;` ``` ``` ` secp256k1_ge_set_gej_zinv(&a_ge, a, &d.z);` ` prej[0].x = a_ge.x;` ` prej[0].y = a_ge.y;` ` prej[0].z = a->z;` ` prej[0].infinity = 0;` ``` ``` ` zr[0] = d.z;` ` for (i = 1; i < n; i++) {` ` secp256k1_gej_add_ge_var(&prej[i], &prej[i-1], &d_ge, &zr[i]);` ` }` ``` ``` ` /*` ` * Each point in 'prej' has a z coordinate too small by a factor of 'd.z'. Only` ` * the final point's z coordinate is actually used though, so just update that.` ` */` ` secp256k1_fe_mul(&prej[n-1].z, &prej[n-1].z, &d.z);` `}` ``` ``` `/** Fill a table 'pre' with precomputed odd multiples of a.` ` *` ` * There are two versions of this function:` ` * - secp256k1_ecmult_odd_multiples_table_globalz_windowa which brings its` ` * resulting point set to a single constant Z denominator, stores the X and Y` ` * coordinates as ge_storage points in pre, and stores the global Z in rz.` ` * It only operates on tables sized for WINDOW_A wnaf multiples.` ` * - secp256k1_ecmult_odd_multiples_table_storage_var, which converts its` ` * resulting point set to actually affine points, and stores those in pre.` ` * It operates on tables of any size, but uses heap-allocated temporaries.` ` *` ` * To compute a*P + b*G, we compute a table for P using the first function,` ` * and for G using the second (which requires an inverse, but it only needs to` ` * happen once).` ` */` `static void secp256k1_ecmult_odd_multiples_table_globalz_windowa(secp256k1_ge_t *pre, secp256k1_fe_t *globalz, const secp256k1_gej_t *a) {` ` secp256k1_gej_t prej[ECMULT_TABLE_SIZE(WINDOW_A)];` ` secp256k1_fe_t zr[ECMULT_TABLE_SIZE(WINDOW_A)];` ``` ``` ` /* Compute the odd multiples in Jacobian form. */` ` secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), prej, zr, a);` ` /* Bring them to the same Z denominator. */` ` secp256k1_ge_globalz_set_table_gej(ECMULT_TABLE_SIZE(WINDOW_A), pre, globalz, prej, zr);` `}` ``` ``` `static void secp256k1_ecmult_odd_multiples_table_storage_var(int n, secp256k1_ge_storage_t *pre, const secp256k1_gej_t *a) {` ` secp256k1_gej_t *prej = checked_malloc(sizeof(secp256k1_gej_t) * n);` ` secp256k1_ge_t *prea = checked_malloc(sizeof(secp256k1_ge_t) * n);` ` secp256k1_fe_t *zr = checked_malloc(sizeof(secp256k1_fe_t) * n);` ` int i;` ``` ``` ` /* Compute the odd multiples in Jacobian form. */` ` secp256k1_ecmult_odd_multiples_table(n, prej, zr, a);` ` /* Convert them in batch to affine coordinates. */` ` secp256k1_ge_set_table_gej_var(n, prea, prej, zr);` ` /* Convert them to compact storage form. */` ` for (i = 0; i < n; i++) {` ` secp256k1_ge_to_storage(&pre[i], &prea[i]);` ` }` ``` ``` ` free(prea);` ` free(prej);` ` free(zr);` `}` ``` ``` `/** The following two macro retrieves a particular odd multiple from a table` ` * of precomputed multiples. */` `#define ECMULT_TABLE_GET_GE(r,pre,n,w) do { \` ` VERIFY_CHECK(((n) & 1) == 1); \` ` VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \` ` VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \` ` if ((n) > 0) { \` ` *(r) = (pre)[((n)-1)/2]; \` ` } else { \` ` secp256k1_ge_neg((r), &(pre)[(-(n)-1)/2]); \` ` } \` `} while(0)` `#define ECMULT_TABLE_GET_GE_STORAGE(r,pre,n,w) do { \` ` VERIFY_CHECK(((n) & 1) == 1); \` ` VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \` ` VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \` ` if ((n) > 0) { \` ` secp256k1_ge_from_storage((r), &(pre)[((n)-1)/2]); \` ` } else { \` ` secp256k1_ge_from_storage((r), &(pre)[(-(n)-1)/2]); \` ` secp256k1_ge_neg((r), (r)); \` ` } \` `} while(0)` `static void secp256k1_ecmult_context_init(secp256k1_ecmult_context_t *ctx) {` ` ctx->pre_g = NULL;` `#ifdef USE_ENDOMORPHISM` ` ctx->pre_g_128 = NULL;` `#endif` `}` ``` ``` `static void secp256k1_ecmult_context_build(secp256k1_ecmult_context_t *ctx) {` ` secp256k1_gej_t gj;` ``` ``` ` if (ctx->pre_g != NULL) {` ` return;` ` }` ``` ``` ` /* get the generator */` ` secp256k1_gej_set_ge(&gj, &secp256k1_ge_const_g);` ``` ``` ` ctx->pre_g = (secp256k1_ge_storage_t (*)[])checked_malloc(sizeof((*ctx->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G));` ``` ``` ` /* precompute the tables with odd multiples */` ` secp256k1_ecmult_odd_multiples_table_storage_var(ECMULT_TABLE_SIZE(WINDOW_G), *ctx->pre_g, &gj);` ``` ``` `#ifdef USE_ENDOMORPHISM` ` {` ` secp256k1_gej_t g_128j;` ` int i;` ``` ``` ` ctx->pre_g_128 = (secp256k1_ge_storage_t (*)[])checked_malloc(sizeof((*ctx->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G));` ``` ``` ` /* calculate 2^128*generator */` ` g_128j = gj;` ` for (i = 0; i < 128; i++) {` ` secp256k1_gej_double_var(&g_128j, &g_128j, NULL);` ` }` ` secp256k1_ecmult_odd_multiples_table_storage_var(ECMULT_TABLE_SIZE(WINDOW_G), *ctx->pre_g_128, &g_128j);` ` }` `#endif` `}` ``` ``` `static void secp256k1_ecmult_context_clone(secp256k1_ecmult_context_t *dst,` ` const secp256k1_ecmult_context_t *src) {` ` if (src->pre_g == NULL) {` ` dst->pre_g = NULL;` ` } else {` ` size_t size = sizeof((*dst->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G);` ` dst->pre_g = (secp256k1_ge_storage_t (*)[])checked_malloc(size);` ` memcpy(dst->pre_g, src->pre_g, size);` ` }` `#ifdef USE_ENDOMORPHISM` ` if (src->pre_g_128 == NULL) {` ` dst->pre_g_128 = NULL;` ` } else {` ` size_t size = sizeof((*dst->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G);` ` dst->pre_g_128 = (secp256k1_ge_storage_t (*)[])checked_malloc(size);` ` memcpy(dst->pre_g_128, src->pre_g_128, size);` ` }` `#endif` `}` ``` ``` `static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context_t *ctx) {` ` return ctx->pre_g != NULL;` `}` ``` ``` `static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context_t *ctx) {` ` free(ctx->pre_g);` `#ifdef USE_ENDOMORPHISM` ` free(ctx->pre_g_128);` `#endif` ` secp256k1_ecmult_context_init(ctx);` `}` ``` ``` `/** Convert a number to WNAF notation. The number becomes represented by sum(2^i * wnaf[i], i=0..bits),` ` * with the following guarantees:` ` * - each wnaf[i] is either 0, or an odd integer between -(1<<(w-1) - 1) and (1<<(w-1) - 1)` ` * - two non-zero entries in wnaf are separated by at least w-1 zeroes.` ` * - the number of set values in wnaf is returned. This number is at most 256, and at most one more` ` * - than the number of bits in the (absolute value) of the input.` ` */` `static int secp256k1_ecmult_wnaf(int *wnaf, const secp256k1_scalar_t *a, int w) {` ` secp256k1_scalar_t s = *a;` ` int set_bits = 0;` ` int bit = 0;` ` int sign = 1;` ``` ``` ` if (secp256k1_scalar_get_bits(&s, 255, 1)) {` ` secp256k1_scalar_negate(&s, &s);` ` sign = -1;` ` }` ``` ``` ` while (bit < 256) {` ` int now;` ` int word;` ` if (secp256k1_scalar_get_bits(&s, bit, 1) == 0) {` ` bit++;` ` continue;` ` }` ` while (set_bits < bit) {` ` wnaf[set_bits++] = 0;` ` }` ` now = w;` ` if (bit + now > 256) {` ` now = 256 - bit;` ` }` ` word = secp256k1_scalar_get_bits_var(&s, bit, now);` ` if (word & (1 << (w-1))) {` ` secp256k1_scalar_add_bit(&s, bit + w);` ` wnaf[set_bits++] = sign * (word - (1 << w));` ` } else {` ` wnaf[set_bits++] = sign * word;` ` }` ` bit += now;` ` }` ` return set_bits;` `}` ``` ``` `static void secp256k1_ecmult(const secp256k1_ecmult_context_t *ctx, secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_scalar_t *na, const secp256k1_scalar_t *ng) {` ` secp256k1_ge_t pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];` ` secp256k1_ge_t tmpa;` ` secp256k1_fe_t Z;` `#ifdef USE_ENDOMORPHISM` ` secp256k1_ge_t pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];` ` secp256k1_scalar_t na_1, na_lam;` ` /* Splitted G factors. */` ` secp256k1_scalar_t ng_1, ng_128;` ` int wnaf_na_1[130];` ` int wnaf_na_lam[130];` ` int bits_na_1;` ` int bits_na_lam;` ` int wnaf_ng_1[129];` ` int bits_ng_1;` ` int wnaf_ng_128[129];` ` int bits_ng_128;` `#else` ` int wnaf_na[256];` ` int bits_na;` ` int wnaf_ng[257];` ` int bits_ng;` `#endif` ` int i;` ` int bits;` ``` ``` `#ifdef USE_ENDOMORPHISM` ` /* split na into na_1 and na_lam (where na = na_1 + na_lam*lambda, and na_1 and na_lam are ~128 bit) */` ` secp256k1_scalar_split_lambda_var(&na_1, &na_lam, na);` ``` ``` ` /* build wnaf representation for na_1 and na_lam. */` ` bits_na_1 = secp256k1_ecmult_wnaf(wnaf_na_1, &na_1, WINDOW_A);` ` bits_na_lam = secp256k1_ecmult_wnaf(wnaf_na_lam, &na_lam, WINDOW_A);` ` VERIFY_CHECK(bits_na_1 <= 130);` ` VERIFY_CHECK(bits_na_lam <= 130);` ` bits = bits_na_1;` ` if (bits_na_lam > bits) {` ` bits = bits_na_lam;` ` }` `#else` ` /* build wnaf representation for na. */` ` bits_na = secp256k1_ecmult_wnaf(wnaf_na, na, WINDOW_A);` ` bits = bits_na;` `#endif` ` /* Calculate odd multiples of a.` ` * All multiples are brought to the same Z 'denominator', which is stored` ` * in Z. Due to secp256k1' isomorphism we can do all operations pretending` ` * that the Z coordinate was 1, use affine addition formulae, and correct` ` * the Z coordinate of the result once at the end.` ` * The exception is the precomputed G table points, which are actually` ` * affine. Compared to the base used for other points, they have a Z ratio` ` * of 1/Z, so we can use secp256k1_gej_add_zinv_var, which uses the same` ` * isomorphism to efficiently add with a known Z inverse.` ` */` ` secp256k1_ecmult_odd_multiples_table_globalz_windowa(pre_a, &Z, a);` ``` ``` `#ifdef USE_ENDOMORPHISM` ` for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {` ` secp256k1_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]);` ` }` ``` ``` ` /* split ng into ng_1 and ng_128 (where gn = gn_1 + gn_128*2^128, and gn_1 and gn_128 are ~128 bit) */` ` secp256k1_scalar_split_128(&ng_1, &ng_128, ng);` ``` ``` ` /* Build wnaf representation for ng_1 and ng_128 */` ` bits_ng_1 = secp256k1_ecmult_wnaf(wnaf_ng_1, &ng_1, WINDOW_G);` ` bits_ng_128 = secp256k1_ecmult_wnaf(wnaf_ng_128, &ng_128, WINDOW_G);` ` if (bits_ng_1 > bits) {` ` bits = bits_ng_1;` ` }` ` if (bits_ng_128 > bits) {` ` bits = bits_ng_128;` ` }` `#else` ` bits_ng = secp256k1_ecmult_wnaf(wnaf_ng, ng, WINDOW_G);` ` if (bits_ng > bits) {` ` bits = bits_ng;` ` }` `#endif` ` secp256k1_gej_set_infinity(r);` ``` ``` ` for (i = bits - 1; i >= 0; i--) {` ` int n;` ` secp256k1_gej_double_var(r, r, NULL);` `#ifdef USE_ENDOMORPHISM` ` if (i < bits_na_1 && (n = wnaf_na_1[i])) {` ` ECMULT_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A);` ` secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);` ` }` ` if (i < bits_na_lam && (n = wnaf_na_lam[i])) {` ` ECMULT_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A);` ` secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);` ` }` ` if (i < bits_ng_1 && (n = wnaf_ng_1[i])) {` ` ECMULT_TABLE_GET_GE_STORAGE(&tmpa, *ctx->pre_g, n, WINDOW_G);` ` secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);` ` }` ` if (i < bits_ng_128 && (n = wnaf_ng_128[i])) {` ` ECMULT_TABLE_GET_GE_STORAGE(&tmpa, *ctx->pre_g_128, n, WINDOW_G);` ` secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);` ` }` `#else` ` if (i < bits_na && (n = wnaf_na[i])) {` ` ECMULT_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A);` ` secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);` ` }` ` if (i < bits_ng && (n = wnaf_ng[i])) {` ` ECMULT_TABLE_GET_GE_STORAGE(&tmpa, *ctx->pre_g, n, WINDOW_G);` ` secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);` ` }` `#endif` ` }` ``` ``` ` if (!r->infinity) {` ` secp256k1_fe_mul(&r->z, &r->z, &Z);` ` }` `}` ``` ``` ```#endif ``` ``` ```