Skip to content

Commit 0af77b5

Browse files
sipasipa
committed
Abstract out verify logic for fe_inv{,_var}
1 parent 10aefdc commit 0af77b5

File tree

4 files changed

+42
-47
lines changed

4 files changed

+42
-47
lines changed

‎src/field.h

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,8 @@ static void secp256k1_fe_verify(const secp256k1_fe *a);
9797
# define secp256k1_fe_cmov secp256k1_fe_impl_cmov
9898
# define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
9999
# define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
100+
# define secp256k1_fe_inv secp256k1_fe_impl_inv
101+
# define secp256k1_fe_inv_var secp256k1_fe_impl_inv_var
100102
#endif /* defined(VERIFY) */
101103

102104
/** Normalize a field element.
@@ -258,11 +260,18 @@ static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a);
258260
*/
259261
static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe *a);
260262

261-
/** Sets a field element to be the (modular) inverse of another. Requires the input's magnitude to be
262-
* at most 8. The output magnitude is 1 (but not guaranteed to be normalized). */
263+
/** Compute the modular inverse of a field element.
264+
*
265+
* On input, a must be a valid field element; r need not be initialized.
266+
* Performs {r = 1/a}.
267+
* On output, r will have magnitude (a.magnitude != 0) and be normalized.
268+
*/
263269
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *a);
264270

265-
/** Potentially faster version of secp256k1_fe_inv, without constant-time guarantee. */
271+
/** Compute the modular inverse of a field element, without constant-time guarantee.
272+
*
273+
* Behaves identically to secp256k1_fe_inv, but is not constant-time in a.
274+
*/
266275
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *a);
267276

268277
/** Convert a field element to secp256k1_fe_storage.

‎src/field_10x26_impl.h

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1085,23 +1085,13 @@ static void secp256k1_fe_from_signed30(secp256k1_fe *r, const secp256k1_modinv32
10851085
r->n[7] = (a6 >> 2 ) & M26;
10861086
r->n[8] = (a6 >> 28 | a7 << 2) & M26;
10871087
r->n[9] = (a7 >> 24 | a8 << 6);
1088-
1089-
#ifdef VERIFY
1090-
r->magnitude = 1;
1091-
r->normalized = 1;
1092-
secp256k1_fe_verify(r);
1093-
#endif
10941088
}
10951089

10961090
static void secp256k1_fe_to_signed30(secp256k1_modinv32_signed30 *r, const secp256k1_fe *a) {
10971091
const uint32_t M30 = UINT32_MAX >> 2;
10981092
const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4],
10991093
a5 = a->n[5], a6 = a->n[6], a7 = a->n[7], a8 = a->n[8], a9 = a->n[9];
11001094

1101-
#ifdef VERIFY
1102-
VERIFY_CHECK(a->normalized);
1103-
#endif
1104-
11051095
r->v[0] = (a0 | a1 << 26) & M30;
11061096
r->v[1] = (a1 >> 4 | a2 << 22) & M30;
11071097
r->v[2] = (a2 >> 8 | a3 << 18) & M30;
@@ -1119,30 +1109,24 @@ static const secp256k1_modinv32_modinfo secp256k1_const_modinfo_fe = {
11191109
0x2DDACACFL
11201110
};
11211111

1122-
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
1123-
secp256k1_fe tmp;
1112+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
1113+
secp256k1_fe tmp = *x;
11241114
secp256k1_modinv32_signed30 s;
11251115

1126-
tmp = *x;
11271116
secp256k1_fe_normalize(&tmp);
11281117
secp256k1_fe_to_signed30(&s, &tmp);
11291118
secp256k1_modinv32(&s, &secp256k1_const_modinfo_fe);
11301119
secp256k1_fe_from_signed30(r, &s);
1131-
1132-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
11331120
}
11341121

1135-
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
1136-
secp256k1_fe tmp;
1122+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
1123+
secp256k1_fe tmp = *x;
11371124
secp256k1_modinv32_signed30 s;
11381125

1139-
tmp = *x;
11401126
secp256k1_fe_normalize_var(&tmp);
11411127
secp256k1_fe_to_signed30(&s, &tmp);
11421128
secp256k1_modinv32_var(&s, &secp256k1_const_modinfo_fe);
11431129
secp256k1_fe_from_signed30(r, &s);
1144-
1145-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
11461130
}
11471131

11481132
#endif /* SECP256K1_FIELD_REPR_IMPL_H */

‎src/field_5x52_impl.h

Lines changed: 4 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -400,22 +400,12 @@ static void secp256k1_fe_from_signed62(secp256k1_fe *r, const secp256k1_modinv64
400400
r->n[2] = (a1 >> 42 | a2 << 20) & M52;
401401
r->n[3] = (a2 >> 32 | a3 << 30) & M52;
402402
r->n[4] = (a3 >> 22 | a4 << 40);
403-
404-
#ifdef VERIFY
405-
r->magnitude = 1;
406-
r->normalized = 1;
407-
secp256k1_fe_verify(r);
408-
#endif
409403
}
410404

411405
static void secp256k1_fe_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_fe *a) {
412406
const uint64_t M62 = UINT64_MAX >> 2;
413407
const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4];
414408

415-
#ifdef VERIFY
416-
VERIFY_CHECK(a->normalized);
417-
#endif
418-
419409
r->v[0] = (a0 | a1 << 52) & M62;
420410
r->v[1] = (a1 >> 10 | a2 << 42) & M62;
421411
r->v[2] = (a2 >> 20 | a3 << 32) & M62;
@@ -428,34 +418,24 @@ static const secp256k1_modinv64_modinfo secp256k1_const_modinfo_fe = {
428418
0x27C7F6E22DDACACFLL
429419
};
430420

431-
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
432-
secp256k1_fe tmp;
421+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
422+
secp256k1_fe tmp = *x;
433423
secp256k1_modinv64_signed62 s;
434424

435-
tmp = *x;
436425
secp256k1_fe_normalize(&tmp);
437426
secp256k1_fe_to_signed62(&s, &tmp);
438427
secp256k1_modinv64(&s, &secp256k1_const_modinfo_fe);
439428
secp256k1_fe_from_signed62(r, &s);
440-
441-
#ifdef VERIFY
442-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
443-
#endif
444429
}
445430

446-
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
447-
secp256k1_fe tmp;
431+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
432+
secp256k1_fe tmp = *x;
448433
secp256k1_modinv64_signed62 s;
449434

450-
tmp = *x;
451435
secp256k1_fe_normalize_var(&tmp);
452436
secp256k1_fe_to_signed62(&s, &tmp);
453437
secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_fe);
454438
secp256k1_fe_from_signed62(r, &s);
455-
456-
#ifdef VERIFY
457-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
458-
#endif
459439
}
460440

461441
#endif /* SECP256K1_FIELD_REPR_IMPL_H */

‎src/field_impl.h

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,28 @@ SECP256K1_INLINE static void secp256k1_fe_from_storage(secp256k1_fe *r, const se
343343
r->normalized = 1;
344344
secp256k1_fe_verify(r);
345345
}
346+
347+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x);
348+
SECP256K1_INLINE static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
349+
int input_is_zero = secp256k1_fe_normalizes_to_zero(x);
350+
secp256k1_fe_verify(x);
351+
secp256k1_fe_impl_inv(r, x);
352+
r->magnitude = x->magnitude > 0;
353+
r->normalized = 1;
354+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == input_is_zero);
355+
secp256k1_fe_verify(r);
356+
}
357+
358+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x);
359+
SECP256K1_INLINE static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
360+
int input_is_zero = secp256k1_fe_normalizes_to_zero(x);
361+
secp256k1_fe_verify(x);
362+
secp256k1_fe_impl_inv_var(r, x);
363+
r->magnitude = x->magnitude > 0;
364+
r->normalized = 1;
365+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == input_is_zero);
366+
secp256k1_fe_verify(r);
367+
}
346368
#endif /* defined(VERIFY) */
347369

348370
#endif /* SECP256K1_FIELD_IMPL_H */

0 commit comments

Comments
 (0)