Skip to content

Commit 78cdcb0

Browse files
peterdettmantheStackreal-or-random
committed
Save _normalize_weak calls in group add methods
Also update the operations count comments in each of the affected functions accordingly and remove a redundant VERIFY_CHECK in secp256k1_gej_add_ge (the infinity value range check [0,1] is already covered by secp256k1_gej_verify above). Co-authored-by: Sebastian Falbesoner <sebastian.falbesoner@gmail.com> Co-authored-by: Tim Ruffing <crypto@timruffing.de>
1 parent 3edd868 commit 78cdcb0

File tree

1 file changed

+26
-27
lines changed

1 file changed

+26
-27
lines changed

‎src/group_impl.h

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -536,7 +536,7 @@ static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, cons
536536
}
537537

538538
static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr) {
539-
/* 8 mul, 3 sqr, 13 add/negate/normalize_weak/normalizes_to_zero (ignoring special cases) */
539+
/* Operations: 8 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
540540
secp256k1_fe z12, u1, u2, s1, s2, h, i, h2, h3, t;
541541
secp256k1_gej_verify(a);
542542
secp256k1_ge_verify(b);
@@ -555,11 +555,11 @@ static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, c
555555
}
556556

557557
secp256k1_fe_sqr(&z12, &a->z);
558-
u1 = a->x; secp256k1_fe_normalize_weak(&u1);
558+
u1 = a->x;
559559
secp256k1_fe_mul(&u2, &b->x, &z12);
560-
s1 = a->y; secp256k1_fe_normalize_weak(&s1);
560+
s1 = a->y;
561561
secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
562-
secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
562+
secp256k1_fe_negate(&h, &u1, 6); secp256k1_fe_add(&h, &u2);
563563
secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
564564
if (secp256k1_fe_normalizes_to_zero_var(&h)) {
565565
if (secp256k1_fe_normalizes_to_zero_var(&i)) {
@@ -599,7 +599,7 @@ static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, c
599599
}
600600

601601
static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv) {
602-
/* 9 mul, 3 sqr, 13 add/negate/normalize_weak/normalizes_to_zero (ignoring special cases) */
602+
/* Operations: 9 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
603603
secp256k1_fe az, z12, u1, u2, s1, s2, h, i, h2, h3, t;
604604
secp256k1_gej_verify(a);
605605
secp256k1_ge_verify(b);
@@ -632,11 +632,11 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a,
632632
secp256k1_fe_mul(&az, &a->z, bzinv);
633633

634634
secp256k1_fe_sqr(&z12, &az);
635-
u1 = a->x; secp256k1_fe_normalize_weak(&u1);
635+
u1 = a->x;
636636
secp256k1_fe_mul(&u2, &b->x, &z12);
637-
s1 = a->y; secp256k1_fe_normalize_weak(&s1);
637+
s1 = a->y;
638638
secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
639-
secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
639+
secp256k1_fe_negate(&h, &u1, 6); secp256k1_fe_add(&h, &u2);
640640
secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
641641
if (secp256k1_fe_normalizes_to_zero_var(&h)) {
642642
if (secp256k1_fe_normalizes_to_zero_var(&i)) {
@@ -670,14 +670,13 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a,
670670

671671

672672
static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b) {
673-
/* Operations: 7 mul, 5 sqr, 24 add/cmov/half/mul_int/negate/normalize_weak/normalizes_to_zero */
673+
/* Operations: 7 mul, 5 sqr, 21 add/cmov/half/mul_int/negate/normalizes_to_zero */
674674
secp256k1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
675675
secp256k1_fe m_alt, rr_alt;
676676
int degenerate;
677677
secp256k1_gej_verify(a);
678678
secp256k1_ge_verify(b);
679679
VERIFY_CHECK(!b->infinity);
680-
VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
681680

682681
/* In:
683682
* Eric Brier and Marc Joye, Weierstrass Elliptic Curves and Side-Channel Attacks.
@@ -730,17 +729,17 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
730729
*/
731730

732731
secp256k1_fe_sqr(&zz, &a->z); /* z = Z1^2 */
733-
u1 = a->x; secp256k1_fe_normalize_weak(&u1); /* u1 = U1 = X1*Z2^2 (1) */
732+
u1 = a->x; /* u1 = U1 = X1*Z2^2 (6) */
734733
secp256k1_fe_mul(&u2, &b->x, &zz); /* u2 = U2 = X2*Z1^2 (1) */
735-
s1 = a->y; secp256k1_fe_normalize_weak(&s1); /* s1 = S1 = Y1*Z2^3 (1) */
734+
s1 = a->y; /* s1 = S1 = Y1*Z2^3 (4) */
736735
secp256k1_fe_mul(&s2, &b->y, &zz); /* s2 = Y2*Z1^2 (1) */
737736
secp256k1_fe_mul(&s2, &s2, &a->z); /* s2 = S2 = Y2*Z1^3 (1) */
738-
t = u1; secp256k1_fe_add(&t, &u2); /* t = T = U1+U2 (2) */
739-
m = s1; secp256k1_fe_add(&m, &s2); /* m = M = S1+S2 (2) */
737+
t = u1; secp256k1_fe_add(&t, &u2); /* t = T = U1+U2 (7) */
738+
m = s1; secp256k1_fe_add(&m, &s2); /* m = M = S1+S2 (5) */
740739
secp256k1_fe_sqr(&rr, &t); /* rr = T^2 (1) */
741-
secp256k1_fe_negate(&m_alt, &u2, 1); /* Malt = -X2*Z1^2 */
742-
secp256k1_fe_mul(&tt, &u1, &m_alt); /* tt = -U1*U2 (2) */
743-
secp256k1_fe_add(&rr, &tt); /* rr = R = T^2-U1*U2 (3) */
740+
secp256k1_fe_negate(&m_alt, &u2, 1); /* Malt = -X2*Z1^2 (2) */
741+
secp256k1_fe_mul(&tt, &u1, &m_alt); /* tt = -U1*U2 (1) */
742+
secp256k1_fe_add(&rr, &tt); /* rr = R = T^2-U1*U2 (2) */
744743
/* If lambda = R/M = R/0 we have a problem (except in the "trivial"
745744
* case that Z = z1z2 = 0, and this is special-cased later on). */
746745
degenerate = secp256k1_fe_normalizes_to_zero(&m);
@@ -750,34 +749,34 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
750749
* non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
751750
* so we set R/M equal to this. */
752751
rr_alt = s1;
753-
secp256k1_fe_mul_int(&rr_alt, 2); /* rr = Y1*Z2^3 - Y2*Z1^3 (2) */
754-
secp256k1_fe_add(&m_alt, &u1); /* Malt = X1*Z2^2 - X2*Z1^2 */
752+
secp256k1_fe_mul_int(&rr_alt, 2); /* rr_alt = Y1*Z2^3 - Y2*Z1^3 (8) */
753+
secp256k1_fe_add(&m_alt, &u1); /* Malt = X1*Z2^2 - X2*Z1^2 (8) */
755754

756-
secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);
757-
secp256k1_fe_cmov(&m_alt, &m, !degenerate);
755+
secp256k1_fe_cmov(&rr_alt, &rr, !degenerate); /* rr_alt (8) */
756+
secp256k1_fe_cmov(&m_alt, &m, !degenerate); /* m_alt (5) */
758757
/* Now Ralt / Malt = lambda and is guaranteed not to be Ralt / 0.
759758
* From here on out Ralt and Malt represent the numerator
760759
* and denominator of lambda; R and M represent the explicit
761760
* expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
762761
secp256k1_fe_sqr(&n, &m_alt); /* n = Malt^2 (1) */
763-
secp256k1_fe_negate(&q, &t, 2); /* q = -T (3) */
762+
secp256k1_fe_negate(&q, &t, 7); /* q = -T (8) */
764763
secp256k1_fe_mul(&q, &q, &n); /* q = Q = -T*Malt^2 (1) */
765764
/* These two lines use the observation that either M == Malt or M == 0,
766765
* so M^3 * Malt is either Malt^4 (which is computed by squaring), or
767766
* zero (which is "computed" by cmov). So the cost is one squaring
768767
* versus two multiplications. */
769-
secp256k1_fe_sqr(&n, &n);
770-
secp256k1_fe_cmov(&n, &m, degenerate); /* n = M^3 * Malt (2) */
768+
secp256k1_fe_sqr(&n, &n); /* n = Malt^4 (1) */
769+
secp256k1_fe_cmov(&n, &m, degenerate); /* n = M^3 * Malt (5) */
771770
secp256k1_fe_sqr(&t, &rr_alt); /* t = Ralt^2 (1) */
772771
secp256k1_fe_mul(&r->z, &a->z, &m_alt); /* r->z = Z3 = Malt*Z (1) */
773772
secp256k1_fe_add(&t, &q); /* t = Ralt^2 + Q (2) */
774773
r->x = t; /* r->x = X3 = Ralt^2 + Q (2) */
775774
secp256k1_fe_mul_int(&t, 2); /* t = 2*X3 (4) */
776775
secp256k1_fe_add(&t, &q); /* t = 2*X3 + Q (5) */
777776
secp256k1_fe_mul(&t, &t, &rr_alt); /* t = Ralt*(2*X3 + Q) (1) */
778-
secp256k1_fe_add(&t, &n); /* t = Ralt*(2*X3 + Q) + M^3*Malt (3) */
779-
secp256k1_fe_negate(&r->y, &t, 3); /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (4) */
780-
secp256k1_fe_half(&r->y); /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 (3) */
777+
secp256k1_fe_add(&t, &n); /* t = Ralt*(2*X3 + Q) + M^3*Malt (6) */
778+
secp256k1_fe_negate(&r->y, &t, 6); /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (7) */
779+
secp256k1_fe_half(&r->y); /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 (4) */
781780

782781
/* In case a->infinity == 1, replace r with (b->x, b->y, 1). */
783782
secp256k1_fe_cmov(&r->x, &b->x, a->infinity);

0 commit comments

Comments
 (0)