Skip to content

Commit a4e1c1d

Browse files
sipaFabcien
sipa
authored and
Fabcien
committed
[SECP256K1] Rip out non-endomorphism code
Summary: Partial backport 8/11 of secp256k1 [[bitcoin-core/secp256k1#830 | PR830]]: bitcoin-core/secp256k1@4232e5b Updates are necessary to accomodate our build system and Travis variations. Depends on D8043. Test Plan: ninja check-secp256k1 make check Reviewers: #bitcoin_abc, deadalnix Reviewed By: #bitcoin_abc, deadalnix Differential Revision: https://reviews.bitcoinabc.org/D8044
1 parent 9fcb376 commit a4e1c1d

21 files changed

+18
-249
lines changed

‎contrib/teamcity/build-configurations.yml

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -271,13 +271,6 @@ builds:
271271
- secp256k1
272272
timeout: 600
273273

274-
build-secp256k1-without-endomorphism:
275-
cmake_flags:
276-
- "-DSECP256K1_ENABLE_ENDOMORPHISM=OFF"
277-
templates:
278-
- secp256k1
279-
timeout: 600
280-
281274
build-secp256k1-java:
282275
cmake_flags:
283276
- '-DSECP256K1_ENABLE_MODULE_ECDH=ON'

‎src/secp256k1/.travis.yml

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ env:
2929
global:
3030
- WIDEMUL=auto
3131
- BIGNUM=gmp
32-
- ENDOMORPHISM=no
3332
- STATICPRECOMPUTATION=yes
3433
- ECMULTGENPRECISION=auto
3534
- ASM=no
@@ -54,15 +53,12 @@ env:
5453
jobs:
5554
- WIDEMUL=int64 RECOVERY=yes
5655
- WIDEMUL=int64 ECDH=yes EXPERIMENTAL=yes MULTISET=yes SCHNORRSIG=yes
57-
- WIDEMUL=int64 ENDOMORPHISM=yes
5856
- WIDEMUL=int128
5957
- WIDEMUL=int128 RECOVERY=yes EXPERIMENTAL=yes SCHNORRSIG=yes
60-
- WIDEMUL=int128 ENDOMORPHISM=yes
61-
- WIDEMUL=int128 ENDOMORPHISM=yes ECDH=yes EXPERIMENTAL=yes MULTISET=yes SCHNORRSIG=yes
58+
- WIDEMUL=int128 ECDH=yes EXPERIMENTAL=yes MULTISET=yes SCHNORRSIG=yes
6259
- WIDEMUL=int128 ASM=x86_64
63-
- WIDEMUL=int128 ENDOMORPHISM=yes ASM=x86_64
6460
- BIGNUM=no
65-
- BIGNUM=no ENDOMORPHISM=yes RECOVERY=yes EXPERIMENTAL=yes MULTISET=yes SCHNORRSIG=yes
61+
- BIGNUM=no RECOVERY=yes EXPERIMENTAL=yes MULTISET=yes SCHNORRSIG=yes
6662
- BIGNUM=no STATICPRECOMPUTATION=no
6763
- AUTOTOOLS_TARGET=distcheck CMAKE_TARGET=install WITH_VALGRIND=no CTIMETEST=no BENCH=no
6864
- AUTOTOOLS_EXTRA_FLAGS=CPPFLAGS=-DDETERMINISTIC CMAKE_EXTRA_FLAGS=-DCMAKE_C_FLAGS=-DDETERMINISTIC
@@ -71,12 +67,7 @@ env:
7167
- ECMULTGENPRECISION=2
7268
- ECMULTGENPRECISION=8
7369
- RUN_VALGRIND=yes
74-
BIGNUM=no ENDOMORPHISM=yes ASM=x86_64 EXPERIMENTAL=yes ECDH=yes RECOVERY=yes OPENSSL_TESTS=no MULTISET=yes
75-
AUTOTOOLS_TARGET=
76-
CMAKE_EXTRA_FLAGS=-DCMAKE_C_FLAGS=-DVALGRIND CMAKE_TARGET="secp256k1-tests secp256k1-exhaustive_tests"
77-
# The same as above but without endomorphism.
78-
- RUN_VALGRIND=yes
79-
BIGNUM=no ASM=x86_64 EXPERIMENTAL=yes ECDH=yes RECOVERY=yes OPENSSL_TESTS=no MULTISET=yes
70+
BIGNUM=no ASM=x86_64 EXPERIMENTAL=yes ECDH=yes RECOVERY=yes OPENSSL_TESTS=no MULTISET=yes
8071
AUTOTOOLS_TARGET=
8172
CMAKE_EXTRA_FLAGS=-DCMAKE_C_FLAGS=-DVALGRIND CMAKE_TARGET="secp256k1-tests secp256k1-exhaustive_tests"
8273
- SCHNORR=no
@@ -85,13 +76,13 @@ jobs:
8576
include:
8677
- compiler: clang
8778
os: linux
88-
env: HOST=i686-linux-gnu ENDOMORPHISM=yes OPENSSL_TESTS=no
79+
env: HOST=i686-linux-gnu OPENSSL_TESTS=no
8980
- compiler: clang
9081
os: linux
9182
env: HOST=i686-linux-gnu BIGNUM=no OPENSSL_TESTS=no
9283
- compiler: gcc
9384
os: linux
94-
env: HOST=i686-linux-gnu ENDOMORPHISM=yes BIGNUM=no OPENSSL_TESTS=no
85+
env: HOST=i686-linux-gnu BIGNUM=no OPENSSL_TESTS=no
9586
- compiler: gcc
9687
os: linux
9788
env: HOST=i686-linux-gnu OPENSSL_TESTS=no

‎src/secp256k1/CMakeLists.txt

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -251,12 +251,6 @@ if(SECP256K1_ENABLE_EXTERNAL_DEFAULT_CALLBACKS)
251251
set(USE_EXTERNAL_DEFAULT_CALLBACKS 1)
252252
endif()
253253

254-
# Endomorphism
255-
option(SECP256K1_ENABLE_ENDOMORPHISM "Enable endomorphism" ON)
256-
if(SECP256K1_ENABLE_ENDOMORPHISM)
257-
set(USE_ENDOMORPHISM 1)
258-
endif()
259-
260254
# Make the emult window size customizable.
261255
set(SECP256K1_ECMULT_WINDOW_SIZE 15 CACHE STRING "Window size for ecmult precomputation for verification, specified as integer in range [2..24].")
262256
if(${SECP256K1_ECMULT_WINDOW_SIZE} LESS 2 OR ${SECP256K1_ECMULT_WINDOW_SIZE} GREATER 24)

‎src/secp256k1/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ Implementation details
5252
* Use wNAF notation for point multiplicands.
5353
* Use a much larger window for multiples of G, using precomputed multiples.
5454
* Use Shamir's trick to do the multiplication with the public key and the generator simultaneously.
55-
* Optionally (off by default) use secp256k1's efficiently-computable endomorphism to split the P multiplicand into 2 half-sized ones.
55+
* Use secp256k1's efficiently-computable endomorphism to split the P multiplicand into 2 half-sized ones.
5656
* Point multiplication for signing
5757
* Use a precomputed table of multiples of powers of 16 multiplied with the generator, so general multiplication becomes a series of additions.
5858
* Intended to be completely free of timing sidechannels for secret-key operations (on reasonable hardware/toolchains)

‎src/secp256k1/configure.ac

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -116,11 +116,6 @@ AC_ARG_ENABLE(exhaustive_tests,
116116
[use_exhaustive_tests=$enableval],
117117
[use_exhaustive_tests=yes])
118118

119-
AC_ARG_ENABLE(endomorphism,
120-
AS_HELP_STRING([--enable-endomorphism],[enable endomorphism [default=no]]),
121-
[use_endomorphism=$enableval],
122-
[use_endomorphism=no])
123-
124119
AC_ARG_ENABLE(ecmult_static_precomputation,
125120
AS_HELP_STRING([--enable-ecmult-static-precomputation],[enable precomputed ecmult table for signing [default=auto]]),
126121
[use_ecmult_static_precomputation=$enableval],
@@ -179,8 +174,7 @@ AC_ARG_WITH([asm], [AS_HELP_STRING([--with-asm=x86_64|arm|no|auto],
179174
AC_ARG_WITH([ecmult-window], [AS_HELP_STRING([--with-ecmult-window=SIZE|auto],
180175
[window size for ecmult precomputation for verification, specified as integer in range [2..24].]
181176
[Larger values result in possibly better performance at the cost of an exponentially larger precomputed table.]
182-
[The table will store 2^(SIZE-2) * 64 bytes of data but can be larger in memory due to platform-specific padding and alignment.]
183-
[If the endomorphism optimization is enabled, two tables of this size are used instead of only one.]
177+
[The table will store 2^(SIZE-1) * 64 bytes of data but can be larger in memory due to platform-specific padding and alignment.]
184178
["auto" is a reasonable setting for desktop machines (currently 15). [default=auto]]
185179
)],
186180
[req_ecmult_window=$withval], [req_ecmult_window=auto])
@@ -467,10 +461,6 @@ if test x"$set_bignum" = x"gmp"; then
467461
SECP_INCLUDES="$SECP_INCLUDES $GMP_CPPFLAGS"
468462
fi
469463

470-
if test x"$use_endomorphism" = x"yes"; then
471-
AC_DEFINE(USE_ENDOMORPHISM, 1, [Define this symbol to use endomorphism optimization])
472-
fi
473-
474464
if test x"$set_precomp" = x"yes"; then
475465
AC_DEFINE(USE_ECMULT_STATIC_PRECOMPUTATION, 1, [Define this symbol to use a statically generated ecmult table])
476466
fi
@@ -567,7 +557,6 @@ AC_OUTPUT
567557

568558
echo
569559
echo "Build Options:"
570-
echo " with endomorphism = $use_endomorphism"
571560
echo " with ecmult precomp = $set_precomp"
572561
echo " with external callbacks = $use_external_default_callbacks"
573562
echo " with jni = $use_jni"

‎src/secp256k1/src/basic-config.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111

1212
#undef USE_ASM_X86_64
1313
#undef USE_ECMULT_STATIC_PRECOMPUTATION
14-
#undef USE_ENDOMORPHISM
1514
#undef USE_EXTERNAL_ASM
1615
#undef USE_EXTERNAL_DEFAULT_CALLBACKS
1716
#undef USE_FIELD_INV_BUILTIN

‎src/secp256k1/src/bench_internal.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,6 @@ void bench_scalar_mul(void* arg, int iters) {
117117
}
118118
}
119119

120-
#ifdef USE_ENDOMORPHISM
121120
void bench_scalar_split(void* arg, int iters) {
122121
int i, j = 0;
123122
bench_inv *data = (bench_inv*)arg;
@@ -128,7 +127,6 @@ void bench_scalar_split(void* arg, int iters) {
128127
}
129128
CHECK(j <= iters);
130129
}
131-
#endif
132130

133131
void bench_scalar_inverse(void* arg, int iters) {
134132
int i, j = 0;
@@ -397,9 +395,7 @@ int main(int argc, char **argv) {
397395
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "negate")) run_benchmark("scalar_negate", bench_scalar_negate, bench_setup, NULL, &data, 10, iters*100);
398396
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "sqr")) run_benchmark("scalar_sqr", bench_scalar_sqr, bench_setup, NULL, &data, 10, iters*10);
399397
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "mul")) run_benchmark("scalar_mul", bench_scalar_mul, bench_setup, NULL, &data, 10, iters*10);
400-
#ifdef USE_ENDOMORPHISM
401398
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "split")) run_benchmark("scalar_split", bench_scalar_split, bench_setup, NULL, &data, 10, iters);
402-
#endif
403399
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "inverse")) run_benchmark("scalar_inverse", bench_scalar_inverse, bench_setup, NULL, &data, 10, 2000);
404400
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "inverse")) run_benchmark("scalar_inverse_var", bench_scalar_inverse_var, bench_setup, NULL, &data, 10, 2000);
405401

‎src/secp256k1/src/ecmult.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,7 @@
1515
typedef struct {
1616
/* For accelerating the computation of a*P + b*G: */
1717
secp256k1_ge_storage (*pre_g)[]; /* odd multiples of the generator */
18-
#ifdef USE_ENDOMORPHISM
1918
secp256k1_ge_storage (*pre_g_128)[]; /* odd multiples of 2^128*generator */
20-
#endif
2119
} secp256k1_ecmult_context;
2220

2321
static const size_t SECP256K1_ECMULT_CONTEXT_PREALLOCATED_SIZE;

‎src/secp256k1/src/ecmult_const_impl.h

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -140,32 +140,26 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
140140
secp256k1_fe Z;
141141

142142
int skew_1;
143-
#ifdef USE_ENDOMORPHISM
144143
secp256k1_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];
145144
int wnaf_lam[1 + WNAF_SIZE(WINDOW_A - 1)];
146145
int skew_lam;
147146
secp256k1_scalar q_1, q_lam;
148-
#endif
149147
int wnaf_1[1 + WNAF_SIZE(WINDOW_A - 1)];
150148

151149
int i;
152150

153151
/* build wnaf representation for q. */
154152
int rsize = size;
155-
#ifdef USE_ENDOMORPHISM
156153
if (size > 128) {
157154
rsize = 128;
158155
/* split q into q_1 and q_lam (where q = q_1 + q_lam*lambda, and q_1 and q_lam are ~128 bit) */
159156
secp256k1_scalar_split_lambda(&q_1, &q_lam, scalar);
160157
skew_1 = secp256k1_wnaf_const(wnaf_1, &q_1, WINDOW_A - 1, 128);
161158
skew_lam = secp256k1_wnaf_const(wnaf_lam, &q_lam, WINDOW_A - 1, 128);
162159
} else
163-
#endif
164160
{
165161
skew_1 = secp256k1_wnaf_const(wnaf_1, scalar, WINDOW_A - 1, size);
166-
#ifdef USE_ENDOMORPHISM
167162
skew_lam = 0;
168-
#endif
169163
}
170164

171165
/* Calculate odd multiples of a.
@@ -179,14 +173,12 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
179173
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
180174
secp256k1_fe_normalize_weak(&pre_a[i].y);
181175
}
182-
#ifdef USE_ENDOMORPHISM
183176
if (size > 128) {
184177
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
185178
secp256k1_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]);
186179
}
187180

188181
}
189-
#endif
190182

191183
/* first loop iteration (separated out so we can directly set r, rather
192184
* than having it start at infinity, get doubled several times, then have
@@ -195,14 +187,12 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
195187
VERIFY_CHECK(i != 0);
196188
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, i, WINDOW_A);
197189
secp256k1_gej_set_ge(r, &tmpa);
198-
#ifdef USE_ENDOMORPHISM
199190
if (size > 128) {
200191
i = wnaf_lam[WNAF_SIZE_BITS(rsize, WINDOW_A - 1)];
201192
VERIFY_CHECK(i != 0);
202193
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, i, WINDOW_A);
203194
secp256k1_gej_add_ge(r, r, &tmpa);
204195
}
205-
#endif
206196
/* remaining loop iterations */
207197
for (i = WNAF_SIZE_BITS(rsize, WINDOW_A - 1) - 1; i >= 0; i--) {
208198
int n;
@@ -215,14 +205,12 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
215205
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A);
216206
VERIFY_CHECK(n != 0);
217207
secp256k1_gej_add_ge(r, r, &tmpa);
218-
#ifdef USE_ENDOMORPHISM
219208
if (size > 128) {
220209
n = wnaf_lam[i];
221210
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A);
222211
VERIFY_CHECK(n != 0);
223212
secp256k1_gej_add_ge(r, r, &tmpa);
224213
}
225-
#endif
226214
}
227215

228216
secp256k1_fe_mul(&r->z, &r->z, &Z);
@@ -231,43 +219,35 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
231219
/* Correct for wNAF skew */
232220
secp256k1_ge correction = *a;
233221
secp256k1_ge_storage correction_1_stor;
234-
#ifdef USE_ENDOMORPHISM
235222
secp256k1_ge_storage correction_lam_stor;
236-
#endif
237223
secp256k1_ge_storage a2_stor;
238224
secp256k1_gej tmpj;
239225
secp256k1_gej_set_ge(&tmpj, &correction);
240226
secp256k1_gej_double_var(&tmpj, &tmpj, NULL);
241227
secp256k1_ge_set_gej(&correction, &tmpj);
242228
secp256k1_ge_to_storage(&correction_1_stor, a);
243-
#ifdef USE_ENDOMORPHISM
244229
if (size > 128) {
245230
secp256k1_ge_to_storage(&correction_lam_stor, a);
246231
}
247-
#endif
248232
secp256k1_ge_to_storage(&a2_stor, &correction);
249233

250234
/* For odd numbers this is 2a (so replace it), for even ones a (so no-op) */
251235
secp256k1_ge_storage_cmov(&correction_1_stor, &a2_stor, skew_1 == 2);
252-
#ifdef USE_ENDOMORPHISM
253236
if (size > 128) {
254237
secp256k1_ge_storage_cmov(&correction_lam_stor, &a2_stor, skew_lam == 2);
255238
}
256-
#endif
257239

258240
/* Apply the correction */
259241
secp256k1_ge_from_storage(&correction, &correction_1_stor);
260242
secp256k1_ge_neg(&correction, &correction);
261243
secp256k1_gej_add_ge(r, r, &correction);
262244

263-
#ifdef USE_ENDOMORPHISM
264245
if (size > 128) {
265246
secp256k1_ge_from_storage(&correction, &correction_lam_stor);
266247
secp256k1_ge_neg(&correction, &correction);
267248
secp256k1_ge_mul_lambda(&correction, &correction);
268249
secp256k1_gej_add_ge(r, r, &correction);
269250
}
270-
#endif
271251
}
272252
}
273253

0 commit comments

Comments
 (0)