Skip to content

Commit 8df6f75

Browse files
sipasipa
committed
Abstract out verify logic for fe_inv{,_var}
1 parent 04c4200 commit 8df6f75

File tree

4 files changed

+42
-47
lines changed

4 files changed

+42
-47
lines changed

‎src/field.h

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ static void secp256k1_fe_verify(const secp256k1_fe *a);
7979
# define secp256k1_fe_cmov secp256k1_fe_impl_cmov
8080
# define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
8181
# define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
82+
# define secp256k1_fe_inv secp256k1_fe_impl_inv
83+
# define secp256k1_fe_inv_var secp256k1_fe_impl_inv_var
8284
#endif /* defined(VERIFY) */
8385

8486
/** Normalize a field element.
@@ -240,11 +242,18 @@ static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a);
240242
*/
241243
static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe *a);
242244

243-
/** Sets a field element to be the (modular) inverse of another. Requires the input's magnitude to be
244-
* at most 8. The output magnitude is 1 (but not guaranteed to be normalized). */
245+
/** Compute the modular inverse of a field element.
246+
*
247+
* On input, a must be a valid field element; r need not be initialized.
248+
* Performs {r = 1/a}.
249+
* On output, r will have magnitude (a.magnitude != 0) and be normalized.
250+
*/
245251
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *a);
246252

247-
/** Potentially faster version of secp256k1_fe_inv, without constant-time guarantee. */
253+
/** Compute the modular inverse of a field element, without constant-time guarantee.
254+
*
255+
* Behaves identically to secp256k1_fe_inv, but is not constant-time in a.
256+
*/
248257
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *a);
249258

250259
/** Convert a field element to secp256k1_fe_storage.

‎src/field_10x26_impl.h

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1078,23 +1078,13 @@ static void secp256k1_fe_from_signed30(secp256k1_fe *r, const secp256k1_modinv32
10781078
r->n[7] = (a6 >> 2 ) & M26;
10791079
r->n[8] = (a6 >> 28 | a7 << 2) & M26;
10801080
r->n[9] = (a7 >> 24 | a8 << 6);
1081-
1082-
#ifdef VERIFY
1083-
r->magnitude = 1;
1084-
r->normalized = 1;
1085-
secp256k1_fe_verify(r);
1086-
#endif
10871081
}
10881082

10891083
static void secp256k1_fe_to_signed30(secp256k1_modinv32_signed30 *r, const secp256k1_fe *a) {
10901084
const uint32_t M30 = UINT32_MAX >> 2;
10911085
const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4],
10921086
a5 = a->n[5], a6 = a->n[6], a7 = a->n[7], a8 = a->n[8], a9 = a->n[9];
10931087

1094-
#ifdef VERIFY
1095-
VERIFY_CHECK(a->normalized);
1096-
#endif
1097-
10981088
r->v[0] = (a0 | a1 << 26) & M30;
10991089
r->v[1] = (a1 >> 4 | a2 << 22) & M30;
11001090
r->v[2] = (a2 >> 8 | a3 << 18) & M30;
@@ -1112,30 +1102,24 @@ static const secp256k1_modinv32_modinfo secp256k1_const_modinfo_fe = {
11121102
0x2DDACACFL
11131103
};
11141104

1115-
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
1116-
secp256k1_fe tmp;
1105+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
1106+
secp256k1_fe tmp = *x;
11171107
secp256k1_modinv32_signed30 s;
11181108

1119-
tmp = *x;
11201109
secp256k1_fe_normalize(&tmp);
11211110
secp256k1_fe_to_signed30(&s, &tmp);
11221111
secp256k1_modinv32(&s, &secp256k1_const_modinfo_fe);
11231112
secp256k1_fe_from_signed30(r, &s);
1124-
1125-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
11261113
}
11271114

1128-
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
1129-
secp256k1_fe tmp;
1115+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
1116+
secp256k1_fe tmp = *x;
11301117
secp256k1_modinv32_signed30 s;
11311118

1132-
tmp = *x;
11331119
secp256k1_fe_normalize_var(&tmp);
11341120
secp256k1_fe_to_signed30(&s, &tmp);
11351121
secp256k1_modinv32_var(&s, &secp256k1_const_modinfo_fe);
11361122
secp256k1_fe_from_signed30(r, &s);
1137-
1138-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
11391123
}
11401124

11411125
#endif /* SECP256K1_FIELD_REPR_IMPL_H */

‎src/field_5x52_impl.h

Lines changed: 4 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -394,22 +394,12 @@ static void secp256k1_fe_from_signed62(secp256k1_fe *r, const secp256k1_modinv64
394394
r->n[2] = (a1 >> 42 | a2 << 20) & M52;
395395
r->n[3] = (a2 >> 32 | a3 << 30) & M52;
396396
r->n[4] = (a3 >> 22 | a4 << 40);
397-
398-
#ifdef VERIFY
399-
r->magnitude = 1;
400-
r->normalized = 1;
401-
secp256k1_fe_verify(r);
402-
#endif
403397
}
404398

405399
static void secp256k1_fe_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_fe *a) {
406400
const uint64_t M62 = UINT64_MAX >> 2;
407401
const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4];
408402

409-
#ifdef VERIFY
410-
VERIFY_CHECK(a->normalized);
411-
#endif
412-
413403
r->v[0] = (a0 | a1 << 52) & M62;
414404
r->v[1] = (a1 >> 10 | a2 << 42) & M62;
415405
r->v[2] = (a2 >> 20 | a3 << 32) & M62;
@@ -422,34 +412,24 @@ static const secp256k1_modinv64_modinfo secp256k1_const_modinfo_fe = {
422412
0x27C7F6E22DDACACFLL
423413
};
424414

425-
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
426-
secp256k1_fe tmp;
415+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
416+
secp256k1_fe tmp = *x;
427417
secp256k1_modinv64_signed62 s;
428418

429-
tmp = *x;
430419
secp256k1_fe_normalize(&tmp);
431420
secp256k1_fe_to_signed62(&s, &tmp);
432421
secp256k1_modinv64(&s, &secp256k1_const_modinfo_fe);
433422
secp256k1_fe_from_signed62(r, &s);
434-
435-
#ifdef VERIFY
436-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
437-
#endif
438423
}
439424

440-
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
441-
secp256k1_fe tmp;
425+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
426+
secp256k1_fe tmp = *x;
442427
secp256k1_modinv64_signed62 s;
443428

444-
tmp = *x;
445429
secp256k1_fe_normalize_var(&tmp);
446430
secp256k1_fe_to_signed62(&s, &tmp);
447431
secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_fe);
448432
secp256k1_fe_from_signed62(r, &s);
449-
450-
#ifdef VERIFY
451-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
452-
#endif
453433
}
454434

455435
#endif /* SECP256K1_FIELD_REPR_IMPL_H */

‎src/field_impl.h

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,28 @@ SECP256K1_INLINE static void secp256k1_fe_from_storage(secp256k1_fe *r, const se
343343
r->normalized = 1;
344344
secp256k1_fe_verify(r);
345345
}
346+
347+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x);
348+
SECP256K1_INLINE static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
349+
int input_is_zero = secp256k1_fe_normalizes_to_zero(x);
350+
secp256k1_fe_verify(x);
351+
secp256k1_fe_impl_inv(r, x);
352+
r->magnitude = x->magnitude > 0;
353+
r->normalized = 1;
354+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == input_is_zero);
355+
secp256k1_fe_verify(r);
356+
}
357+
358+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x);
359+
SECP256K1_INLINE static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
360+
int input_is_zero = secp256k1_fe_normalizes_to_zero(x);
361+
secp256k1_fe_verify(x);
362+
secp256k1_fe_impl_inv_var(r, x);
363+
r->magnitude = x->magnitude > 0;
364+
r->normalized = 1;
365+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == input_is_zero);
366+
secp256k1_fe_verify(r);
367+
}
346368
#endif /* defined(VERIFY) */
347369

348370
#endif /* SECP256K1_FIELD_IMPL_H */

0 commit comments

Comments
 (0)