Skip to content

Commit 2b8ab1c

Browse files
tarcieritarcieri
authored
k256: remove non-endomorphism code (#217)
This code was previously gated under the `endomorphism-mul` feature due to lingering concerns about the "GLV" patents, namely US7110538. According to @pwuille, a patent attorney he works with has verified that the patent is expired: https://twitter.com/pwuille/status/1310639051393830912 Likewise non-endomorphism code is being removed from `bitcoin-core/secp256k1`: bitcoin-core/secp256k1#826 This commit does the same for `k256`: it removes all the non-endomorphism code and feature gating from the endomorphism code, making the `endomorphism-mul` feature a no-op. We can remove the feature in the next SemVer-breaking release (v0.6.x)
1 parent 452f702 commit 2b8ab1c

File tree

6 files changed

+69
-125
lines changed

6 files changed

+69
-125
lines changed

‎k256/Cargo.toml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,12 @@ proptest = "0.10"
3434
rand_core = { version = "0.5", features = ["getrandom"] }
3535

3636
[features]
37-
default = ["arithmetic", "endomorphism-mul", "oid", "std"]
37+
default = ["arithmetic", "oid", "std"]
3838
arithmetic = ["elliptic-curve/arithmetic"]
3939
digest = ["elliptic-curve/digest", "ecdsa-core/digest"]
4040
ecdh = ["elliptic-curve/ecdh", "zeroize"]
4141
ecdsa = ["arithmetic", "digest", "ecdsa-core/sign", "ecdsa-core/verify", "zeroize"]
42-
endomorphism-mul = ["arithmetic"]
42+
endomorphism-mul = [] # TODO(tarcieri): remove before v0.6 release
4343
expose-field = ["arithmetic"]
4444
field-montgomery = []
4545
force-32-bit = []

‎k256/src/arithmetic/mul.rs

Lines changed: 67 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,70 @@
1+
//! From libsecp256k1:
2+
//!
3+
//! The Secp256k1 curve has an endomorphism, where lambda * (x, y) = (beta * x, y), where
4+
//! lambda is {0x53,0x63,0xad,0x4c,0xc0,0x5c,0x30,0xe0,0xa5,0x26,0x1c,0x02,0x88,0x12,0x64,0x5a,
5+
//! 0x12,0x2e,0x22,0xea,0x20,0x81,0x66,0x78,0xdf,0x02,0x96,0x7c,0x1b,0x23,0xbd,0x72}
6+
//!
7+
//! "Guide to Elliptic Curve Cryptography" (Hankerson, Menezes, Vanstone) gives an algorithm
8+
//! (algorithm 3.74) to find k1 and k2 given k, such that k1 + k2 * lambda == k mod n, and k1
9+
//! and k2 have a small size.
10+
//! It relies on constants a1, b1, a2, b2. These constants for the value of lambda above are:
11+
//!
12+
//! - a1 = {0x30,0x86,0xd2,0x21,0xa7,0xd4,0x6b,0xcd,0xe8,0x6c,0x90,0xe4,0x92,0x84,0xeb,0x15}
13+
//! - b1 = -{0xe4,0x43,0x7e,0xd6,0x01,0x0e,0x88,0x28,0x6f,0x54,0x7f,0xa9,0x0a,0xbf,0xe4,0xc3}
14+
//! - a2 = {0x01,0x14,0xca,0x50,0xf7,0xa8,0xe2,0xf3,0xf6,0x57,0xc1,0x10,0x8d,0x9d,0x44,0xcf,0xd8}
15+
//! - b2 = {0x30,0x86,0xd2,0x21,0xa7,0xd4,0x6b,0xcd,0xe8,0x6c,0x90,0xe4,0x92,0x84,0xeb,0x15}
16+
//!
17+
//! The algorithm then computes c1 = round(b1 * k / n) and c2 = round(b2 * k / n), and gives
18+
//! k1 = k - (c1*a1 + c2*a2) and k2 = -(c1*b1 + c2*b2). Instead, we use modular arithmetic, and
19+
//! compute k1 as k - k2 * lambda, avoiding the need for constants a1 and a2.
20+
//!
21+
//! g1, g2 are precomputed constants used to replace division with a rounded multiplication
22+
//! when decomposing the scalar for an endomorphism-based point multiplication.
23+
//!
24+
//! The possibility of using precomputed estimates is mentioned in "Guide to Elliptic Curve
25+
//! Cryptography" (Hankerson, Menezes, Vanstone) in section 3.5.
26+
//!
27+
//! The derivation is described in the paper "Efficient Software Implementation of Public-Key
28+
//! Cryptography on Sensor Networks Using the MSP430X Microcontroller" (Gouvea, Oliveira, Lopez),
29+
//! Section 4.3 (here we use a somewhat higher-precision estimate):
30+
//! d = a1*b2 - b1*a2
31+
//! g1 = round((2^272)*b2/d)
32+
//! g2 = round((2^272)*b1/d)
33+
//!
34+
//! (Note that 'd' is also equal to the curve order here because [a1,b1] and [a2,b2] are found
35+
//! as outputs of the Extended Euclidean Algorithm on inputs 'order' and 'lambda').
36+
//!
37+
//! @fjarri:
38+
//!
39+
//! To be precise, the method used here is based on "An Alternate Decomposition of an Integer for
40+
//! Faster Point Multiplication on Certain Elliptic Curves" by Young-Ho Park, Sangtae Jeong,
41+
//! Chang Han Kim, and Jongin Lim
42+
//! (https://link.springer.com/chapter/10.1007%2F3-540-45664-3_23)
43+
//!
44+
//! The precision used for `g1` and `g2` is not enough to ensure correct approximation at all times.
45+
//! For example, `2^272 * b1 / n` used to calculate `g2` is rounded down.
46+
//! This means that the approximation `z' = k * g2 / 2^272` always slightly underestimates
47+
//! the real value `z = b1 * k / n`. Therefore, when the fractional part of `z` is just slightly
48+
//! above 0.5, it will be rounded up, but `z'` will have the fractional part slightly below 0.5 and
49+
//! will be rounded down.
50+
//!
51+
//! The difference `z - z' = k * delta / 2^272`, where `delta = b1 * 2^272 mod n`.
52+
//! The closest `z` can get to the fractional part equal to .5 is `1 / (2n)` (since `n` is odd).
53+
//! Therefore, to guarantee that `z'` will always be rounded to the same value, one must have
54+
//! `delta / 2^m < 1 / (2n * (n - 1))`, where `m` is the power of 2 used for the approximation.
55+
//! This means that one should use at least `m = 512` (since `0 < delta < 1`).
56+
//! Indeed, tests show that with only `m = 272` the approximation produces off-by-1 errors
57+
//! occasionally.
58+
//!
59+
//! Now since `r1` is calculated as `k - r2 * lambda mod n`, the contract
60+
//! `r1 + r2 * lambda = k mod n` is always satisfied. The method guarantees both `r1` and `r2` to be
61+
//! less than `sqrt(n)` (so, fit in 128 bits) if the rounding is applied correctly - but in our case
62+
//! the off-by-1 errors will produce different `r1` and `r2` which are not necessarily bounded by
63+
//! `sqrt(n)`.
64+
//!
65+
//! In experiments, I was not able to detect any case where they would go outside the 128 bit bound,
66+
//! but I cannot be sure that it cannot happen.
67+
168
use crate::arithmetic::{scalar::Scalar, ProjectivePoint};
269
use core::ops::{Mul, MulAssign};
370
use elliptic_curve::subtle::{Choice, ConditionallySelectable, ConstantTimeEq};
@@ -41,146 +108,32 @@ impl LookupTable {
41108
}
42109
}
43110

44-
/// Returns `[a_0, ..., a_64]` such that `sum(a_j * 2^(j * 4)) == x`,
45-
/// and `-8 <= a_j <= 7`.
46-
#[cfg(not(feature = "endomorphism-mul"))]
47-
fn to_radix_16(x: &Scalar) -> [i8; 65] {
48-
// `x` can have up to 256 bits, so we need an additional byte to store the carry.
49-
let mut output = [0i8; 65];
50-
51-
// Step 1: change radix.
52-
// Convert from radix 256 (bytes) to radix 16 (nibbles)
53-
let bytes = x.to_bytes();
54-
for i in 0..32 {
55-
output[2 * i] = (bytes[31 - i] & 0xf) as i8;
56-
output[2 * i + 1] = ((bytes[31 - i] >> 4) & 0xf) as i8;
57-
}
58-
59-
// Step 2: recenter coefficients from [0,16) to [-8,8)
60-
for i in 0..64 {
61-
let carry = (output[i] + 8) >> 4;
62-
output[i] -= carry << 4;
63-
output[i + 1] += carry;
64-
}
65-
66-
output
67-
}
68-
69-
#[cfg(not(feature = "endomorphism-mul"))]
70-
fn mul_windowed(x: &ProjectivePoint, k: &Scalar) -> ProjectivePoint {
71-
let scalar_digits = to_radix_16(k);
72-
let lookup_table = LookupTable::from(x);
73-
let mut acc = lookup_table.select(scalar_digits[64]);
74-
for i in (0..64).rev() {
75-
for _j in 0..4 {
76-
acc = acc.double();
77-
}
78-
acc += &lookup_table.select(scalar_digits[i]);
79-
}
80-
acc
81-
}
82-
83-
/*
84-
From libsecp256k1:
85-
86-
The Secp256k1 curve has an endomorphism, where lambda * (x, y) = (beta * x, y), where
87-
lambda is {0x53,0x63,0xad,0x4c,0xc0,0x5c,0x30,0xe0,0xa5,0x26,0x1c,0x02,0x88,0x12,0x64,0x5a,
88-
0x12,0x2e,0x22,0xea,0x20,0x81,0x66,0x78,0xdf,0x02,0x96,0x7c,0x1b,0x23,0xbd,0x72}
89-
90-
"Guide to Elliptic Curve Cryptography" (Hankerson, Menezes, Vanstone) gives an algorithm
91-
(algorithm 3.74) to find k1 and k2 given k, such that k1 + k2 * lambda == k mod n, and k1
92-
and k2 have a small size.
93-
It relies on constants a1, b1, a2, b2. These constants for the value of lambda above are:
94-
95-
- a1 = {0x30,0x86,0xd2,0x21,0xa7,0xd4,0x6b,0xcd,0xe8,0x6c,0x90,0xe4,0x92,0x84,0xeb,0x15}
96-
- b1 = -{0xe4,0x43,0x7e,0xd6,0x01,0x0e,0x88,0x28,0x6f,0x54,0x7f,0xa9,0x0a,0xbf,0xe4,0xc3}
97-
- a2 = {0x01,0x14,0xca,0x50,0xf7,0xa8,0xe2,0xf3,0xf6,0x57,0xc1,0x10,0x8d,0x9d,0x44,0xcf,0xd8}
98-
- b2 = {0x30,0x86,0xd2,0x21,0xa7,0xd4,0x6b,0xcd,0xe8,0x6c,0x90,0xe4,0x92,0x84,0xeb,0x15}
99-
100-
The algorithm then computes c1 = round(b1 * k / n) and c2 = round(b2 * k / n), and gives
101-
k1 = k - (c1*a1 + c2*a2) and k2 = -(c1*b1 + c2*b2). Instead, we use modular arithmetic, and
102-
compute k1 as k - k2 * lambda, avoiding the need for constants a1 and a2.
103-
104-
g1, g2 are precomputed constants used to replace division with a rounded multiplication
105-
when decomposing the scalar for an endomorphism-based point multiplication.
106-
107-
The possibility of using precomputed estimates is mentioned in "Guide to Elliptic Curve
108-
Cryptography" (Hankerson, Menezes, Vanstone) in section 3.5.
109-
110-
The derivation is described in the paper "Efficient Software Implementation of Public-Key
111-
Cryptography on Sensor Networks Using the MSP430X Microcontroller" (Gouvea, Oliveira, Lopez),
112-
Section 4.3 (here we use a somewhat higher-precision estimate):
113-
d = a1*b2 - b1*a2
114-
g1 = round((2^272)*b2/d)
115-
g2 = round((2^272)*b1/d)
116-
117-
(Note that 'd' is also equal to the curve order here because [a1,b1] and [a2,b2] are found
118-
as outputs of the Extended Euclidean Algorithm on inputs 'order' and 'lambda').
119-
*/
120-
121-
/*
122-
@fjarri:
123-
124-
To be precise, the method used here is based on
125-
"An Alternate Decomposition of an Integer for Faster Point Multiplication on Certain Elliptic Curves"
126-
by Young-Ho Park, Sangtae Jeong, Chang Han Kim, and Jongin Lim
127-
(https://link.springer.com/chapter/10.1007%2F3-540-45664-3_23)
128-
129-
The precision used for `g1` and `g2` is not enough to ensure correct approximation at all times.
130-
For example, `2^272 * b1 / n` used to calculate `g2` is rounded down.
131-
This means that the approximation `z' = k * g2 / 2^272` always slightly underestimates
132-
the real value `z = b1 * k / n`. Therefore, when the fractional part of `z` is just slightly above
133-
0.5, it will be rounded up, but `z'` will have the fractional part slightly below 0.5 and will be
134-
rounded down.
135-
136-
The difference `z - z' = k * delta / 2^272`, where `delta = b1 * 2^272 mod n`.
137-
The closest `z` can get to the fractional part equal to .5 is `1 / (2n)` (since `n` is odd).
138-
Therefore, to guarantee that `z'` will always be rounded to the same value, one must have
139-
`delta / 2^m < 1 / (2n * (n - 1))`, where `m` is the power of 2 used for the approximation.
140-
This means that one should use at least `m = 512` (since `0 < delta < 1`).
141-
Indeed, tests show that with only `m = 272` the approximation produces off-by-1 errors occasionally.
142-
143-
Now since `r1` is calculated as `k - r2 * lambda mod n`, the contract `r1 + r2 * lambda = k mod n`
144-
is always satisfied. The method guarantees both `r1` and `r2` to be less than `sqrt(n)`
145-
(so, fit in 128 bits) if the rounding is applied correctly - but in our case the off-by-1 errors
146-
will produce different `r1` and `r2` which are not necessarily bounded by `sqrt(n)`.
147-
148-
In experiments, I was not able to detect any case where they would go outside the 128 bit bound,
149-
but I cannot be sure that it cannot happen.
150-
*/
151-
152-
#[cfg(feature = "endomorphism-mul")]
153111
const MINUS_LAMBDA: Scalar = Scalar::from_bytes_unchecked(&[
154112
0xac, 0x9c, 0x52, 0xb3, 0x3f, 0xa3, 0xcf, 0x1f, 0x5a, 0xd9, 0xe3, 0xfd, 0x77, 0xed, 0x9b, 0xa4,
155113
0xa8, 0x80, 0xb9, 0xfc, 0x8e, 0xc7, 0x39, 0xc2, 0xe0, 0xcf, 0xc8, 0x10, 0xb5, 0x12, 0x83, 0xcf,
156114
]);
157115

158-
#[cfg(feature = "endomorphism-mul")]
159116
const MINUS_B1: Scalar = Scalar::from_bytes_unchecked(&[
160117
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
161118
0xe4, 0x43, 0x7e, 0xd6, 0x01, 0x0e, 0x88, 0x28, 0x6f, 0x54, 0x7f, 0xa9, 0x0a, 0xbf, 0xe4, 0xc3,
162119
]);
163120

164-
#[cfg(feature = "endomorphism-mul")]
165121
const MINUS_B2: Scalar = Scalar::from_bytes_unchecked(&[
166122
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
167123
0x8a, 0x28, 0x0a, 0xc5, 0x07, 0x74, 0x34, 0x6d, 0xd7, 0x65, 0xcd, 0xa8, 0x3d, 0xb1, 0x56, 0x2c,
168124
]);
169125

170-
#[cfg(feature = "endomorphism-mul")]
171126
const G1: Scalar = Scalar::from_bytes_unchecked(&[
172127
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x86,
173128
0xd2, 0x21, 0xa7, 0xd4, 0x6b, 0xcd, 0xe8, 0x6c, 0x90, 0xe4, 0x92, 0x84, 0xeb, 0x15, 0x3d, 0xab,
174129
]);
175130

176-
#[cfg(feature = "endomorphism-mul")]
177131
const G2: Scalar = Scalar::from_bytes_unchecked(&[
178132
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe4, 0x43,
179133
0x7e, 0xd6, 0x01, 0x0e, 0x88, 0x28, 0x6f, 0x54, 0x7f, 0xa9, 0x0a, 0xbf, 0xe4, 0xc4, 0x22, 0x12,
180134
]);
181135

182136
/// Find r1 and r2 given k, such that r1 + r2 * lambda == k mod n.
183-
#[cfg(feature = "endomorphism-mul")]
184137
fn decompose_scalar(k: &Scalar) -> (Scalar, Scalar) {
185138
// these _var calls are constant time since the shift amount is constant
186139
let c1 = k.mul_shift_var(&G1, 272);
@@ -197,7 +150,6 @@ fn decompose_scalar(k: &Scalar) -> (Scalar, Scalar) {
197150
/// Returns `[a_0, ..., a_32]` such that `sum(a_j * 2^(j * 4)) == x`,
198151
/// and `-8 <= a_j <= 7`.
199152
/// Assumes `x < 2^128`.
200-
#[cfg(feature = "endomorphism-mul")]
201153
fn to_radix_16_half(x: &Scalar) -> [i8; 33] {
202154
// `x` can have up to 256 bits, so we need an additional byte to store the carry.
203155
let mut output = [0i8; 33];
@@ -222,7 +174,6 @@ fn to_radix_16_half(x: &Scalar) -> [i8; 33] {
222174
output
223175
}
224176

225-
#[cfg(feature = "endomorphism-mul")]
226177
fn mul_windowed(x: &ProjectivePoint, k: &Scalar) -> ProjectivePoint {
227178
let (r1, r2) = decompose_scalar(k);
228179
let x_beta = x.endomorphism();

‎k256/src/arithmetic/projective.rs

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ use elliptic_curve::{
1616
};
1717

1818
#[rustfmt::skip]
19-
#[cfg(feature = "endomorphism-mul")]
2019
const ENDOMORPHISM_BETA: FieldElement = FieldElement::from_bytes_unchecked(&[
2120
0x7a, 0xe9, 0x6a, 0x2b, 0x65, 0x7c, 0x07, 0x10,
2221
0x6e, 0x64, 0x47, 0x9e, 0xac, 0x34, 0x34, 0xe9,
@@ -239,7 +238,6 @@ impl ProjectivePoint {
239238
}
240239

241240
/// Calculates SECP256k1 endomorphism: `self * lambda`.
242-
#[cfg(feature = "endomorphism-mul")]
243241
pub fn endomorphism(&self) -> Self {
244242
Self {
245243
x: self.x * &ENDOMORPHISM_BETA,

‎k256/src/arithmetic/scalar.rs

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,6 @@ impl Scalar {
179179

180180
/// Attempts to parse the given byte array as a scalar.
181181
/// Does not check the result for being in the correct range.
182-
#[cfg(feature = "endomorphism-mul")]
183182
pub(crate) const fn from_bytes_unchecked(bytes: &[u8; 32]) -> Self {
184183
Self(ScalarImpl::from_bytes_unchecked(bytes))
185184
}
@@ -659,15 +658,13 @@ mod tests {
659658
}
660659

661660
proptest! {
662-
663661
#[test]
664662
fn fuzzy_roundtrip_to_bytes(a in scalar()) {
665663
let a_back = Scalar::from_repr(a.to_bytes()).unwrap();
666664
assert_eq!(a, a_back);
667665
}
668666

669667
#[test]
670-
#[cfg(feature = "endomorphism-mul")]
671668
fn fuzzy_roundtrip_to_bytes_unchecked(a in scalar()) {
672669
let bytes = a.to_bytes();
673670
let a_back = Scalar::from_bytes_unchecked(bytes.as_ref());

‎k256/src/arithmetic/scalar/scalar_4x64.rs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,6 @@ impl Scalar4x64 {
158158
self.0[0] as u32
159159
}
160160

161-
#[cfg(feature = "endomorphism-mul")]
162161
pub(crate) const fn from_bytes_unchecked(bytes: &[u8; 32]) -> Self {
163162
// Interpret the bytes as a big-endian integer w.
164163
let w3 =

‎k256/src/arithmetic/scalar/scalar_8x32.rs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,6 @@ impl Scalar8x32 {
187187
self.0[0]
188188
}
189189

190-
#[cfg(feature = "endomorphism-mul")]
191190
pub(crate) const fn from_bytes_unchecked(bytes: &[u8; 32]) -> Self {
192191
// Interpret the bytes as a big-endian integer w.
193192
let w7 =

0 commit comments

Comments
 (0)