Skip to content

Commit 5a44e23

Browse files
gmaxwellFabcien
authored andcommitted
[SECP256K1] Check correctness of lambda split without -DVERIFY
Summary: ``` The VERIFY macro turns on various paranoid consistency checks, but the complete functionality should still be tested without it. This also adds a couple of static test points for extremely small split inputs/outputs. The existing bounds vectors already check extremely large outputs. ``` Partial backport 7/11 of secp256k1 [[bitcoin-core/secp256k1#830 | PR830]]: bitcoin-core/secp256k1@ebad841 Depends on D8042. Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, deadalnix Reviewed By: #bitcoin_abc, deadalnix Differential Revision: https://reviews.bitcoinabc.org/D8043
1 parent 9a85e64 commit 5a44e23

File tree

1 file changed

+15
-1
lines changed

1 file changed

+15
-1
lines changed

src/tests.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3634,12 +3634,17 @@ void run_ecmult_gen_blind(void) {
36343634
#ifdef USE_ENDOMORPHISM
36353635
/***** ENDOMORPHISH TESTS *****/
36363636
void test_scalar_split(const secp256k1_scalar* full) {
3637-
secp256k1_scalar s1, slam;
3637+
secp256k1_scalar s, s1, slam;
36383638
const unsigned char zero[32] = {0};
36393639
unsigned char tmp[32];
36403640

36413641
secp256k1_scalar_split_lambda(&s1, &slam, full);
36423642

3643+
/* check slam*lambda + s1 == full */
3644+
secp256k1_scalar_mul(&s, &secp256k1_const_lambda, &slam);
3645+
secp256k1_scalar_add(&s, &s, &s1);
3646+
CHECK(secp256k1_scalar_eq(&s, full));
3647+
36433648
/* check that both are <= 128 bits in size */
36443649
if (secp256k1_scalar_is_high(&s1)) {
36453650
secp256k1_scalar_negate(&s1, &s1);
@@ -3657,6 +3662,15 @@ void test_scalar_split(const secp256k1_scalar* full) {
36573662

36583663
void run_endomorphism_tests(void) {
36593664
unsigned i;
3665+
static secp256k1_scalar s;
3666+
test_scalar_split(&secp256k1_scalar_zero);
3667+
test_scalar_split(&secp256k1_scalar_one);
3668+
secp256k1_scalar_negate(&s,&secp256k1_scalar_one);
3669+
test_scalar_split(&s);
3670+
test_scalar_split(&secp256k1_const_lambda);
3671+
secp256k1_scalar_add(&s, &secp256k1_const_lambda, &secp256k1_scalar_one);
3672+
test_scalar_split(&s);
3673+
36603674
for (i = 0; i < 100U * count; ++i) {
36613675
secp256k1_scalar full;
36623676
random_scalar_order_test(&full);

0 commit comments

Comments
 (0)