Skip to content

Commit d40ea5f

Browse files
siv2rsiv2r
committed
field: add magnitude check and _fe_verify check for internal field APIs
1. _fe_verify on inputs of the functions: 1. _fe_normalizes_to_zero, _fe_normalizes_to_zero_var 2. _fe_to_storage 3. _fe_inv,_fe_inv_var 4. _fe_equal, _fe_equal_var 5. _fe_sqrt 2. _fe_verify on the result calculated in the functions: 1. _fe_inv,_fe_inv_var 2. _fe_sqrt 3. magnitude checks for inputs of the functions: 1. _fe_inv,_fe_inv_var 2. _fe_equal, _fe_equal_var 3. _fe_sqrt 4. move a VERIFY_CHECK call (in _fe_inv, _fe_inv_var) out of #ifdef VERIFY in `field_5x52_impl.h` 5. move _fe_verify call after else block in _fe_setb32
1 parent c6c44f4 commit d40ea5f

File tree

3 files changed

+59
-19
lines changed

3 files changed

+59
-19
lines changed

‎src/field_10x26_impl.h

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,9 @@ static int secp256k1_fe_normalizes_to_zero(const secp256k1_fe *r) {
200200

201201
/* Reduce t9 at the start so there will be at most a single carry from the first pass */
202202
uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
203-
203+
#ifdef VERIFY
204+
secp256k1_fe_verify(r);
205+
#endif
204206
/* The first pass ensures the magnitude is 1, ... */
205207
t0 += x * 0x3D1UL; t1 += (x << 6);
206208
t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL; z0 = t0; z1 = t0 ^ 0x3D0UL;
@@ -224,7 +226,9 @@ static int secp256k1_fe_normalizes_to_zero_var(const secp256k1_fe *r) {
224226
uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
225227
uint32_t z0, z1;
226228
uint32_t x;
227-
229+
#ifdef VERIFY
230+
secp256k1_fe_verify(r);
231+
#endif
228232
t0 = r->n[0];
229233
t9 = r->n[9];
230234

@@ -348,10 +352,10 @@ static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a) {
348352
r->magnitude = 1;
349353
if (ret) {
350354
r->normalized = 1;
351-
secp256k1_fe_verify(r);
352355
} else {
353356
r->normalized = 0;
354357
}
358+
secp256k1_fe_verify(r);
355359
#endif
356360
return ret;
357361
}
@@ -1151,6 +1155,7 @@ static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r,
11511155
static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
11521156
#ifdef VERIFY
11531157
VERIFY_CHECK(a->normalized);
1158+
secp256k1_fe_verify(a);
11541159
#endif
11551160
r->n[0] = a->n[0] | a->n[1] << 26;
11561161
r->n[1] = a->n[1] >> 6 | a->n[2] << 20;
@@ -1245,26 +1250,36 @@ static const secp256k1_modinv32_modinfo secp256k1_const_modinfo_fe = {
12451250
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
12461251
secp256k1_fe tmp;
12471252
secp256k1_modinv32_signed30 s;
1248-
1253+
#ifdef VERIFY
1254+
VERIFY_CHECK(x->magnitude <= 8);
1255+
secp256k1_fe_verify(x);
1256+
#endif
12491257
tmp = *x;
12501258
secp256k1_fe_normalize(&tmp);
12511259
secp256k1_fe_to_signed30(&s, &tmp);
12521260
secp256k1_modinv32(&s, &secp256k1_const_modinfo_fe);
12531261
secp256k1_fe_from_signed30(r, &s);
1254-
1262+
#ifdef VERIFY
1263+
secp256k1_fe_verify(r);
1264+
#endif
12551265
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
12561266
}
12571267

12581268
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
12591269
secp256k1_fe tmp;
12601270
secp256k1_modinv32_signed30 s;
1261-
1271+
#ifdef VERIFY
1272+
VERIFY_CHECK(x->magnitude <= 8);
1273+
secp256k1_fe_verify(x);
1274+
#endif
12621275
tmp = *x;
12631276
secp256k1_fe_normalize_var(&tmp);
12641277
secp256k1_fe_to_signed30(&s, &tmp);
12651278
secp256k1_modinv32_var(&s, &secp256k1_const_modinfo_fe);
12661279
secp256k1_fe_from_signed30(r, &s);
1267-
1280+
#ifdef VERIFY
1281+
secp256k1_fe_verify(r);
1282+
#endif
12681283
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
12691284
}
12701285

‎src/field_5x52_impl.h

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,9 @@ static int secp256k1_fe_normalizes_to_zero(const secp256k1_fe *r) {
177177

178178
/* Reduce t4 at the start so there will be at most a single carry from the first pass */
179179
uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
180-
180+
#ifdef VERIFY
181+
secp256k1_fe_verify(r);
182+
#endif
181183
/* The first pass ensures the magnitude is 1, ... */
182184
t0 += x * 0x1000003D1ULL;
183185
t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL; z0 = t0; z1 = t0 ^ 0x1000003D0ULL;
@@ -196,7 +198,9 @@ static int secp256k1_fe_normalizes_to_zero_var(const secp256k1_fe *r) {
196198
uint64_t t0, t1, t2, t3, t4;
197199
uint64_t z0, z1;
198200
uint64_t x;
199-
201+
#ifdef VERIFY
202+
secp256k1_fe_verify(r);
203+
#endif
200204
t0 = r->n[0];
201205
t4 = r->n[4];
202206

@@ -332,10 +336,10 @@ static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a) {
332336
r->magnitude = 1;
333337
if (ret) {
334338
r->normalized = 1;
335-
secp256k1_fe_verify(r);
336339
} else {
337340
r->normalized = 0;
338341
}
342+
secp256k1_fe_verify(r);
339343
#endif
340344
return ret;
341345
}
@@ -491,6 +495,7 @@ static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r,
491495
static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
492496
#ifdef VERIFY
493497
VERIFY_CHECK(a->normalized);
498+
secp256k1_fe_verify(a);
494499
#endif
495500
r->n[0] = a->n[0] | a->n[1] << 52;
496501
r->n[1] = a->n[1] >> 12 | a->n[2] << 40;
@@ -560,31 +565,37 @@ static const secp256k1_modinv64_modinfo secp256k1_const_modinfo_fe = {
560565
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
561566
secp256k1_fe tmp;
562567
secp256k1_modinv64_signed62 s;
563-
568+
#ifdef VERIFY
569+
VERIFY_CHECK(x->magnitude <= 8);
570+
secp256k1_fe_verify(x);
571+
#endif
564572
tmp = *x;
565573
secp256k1_fe_normalize(&tmp);
566574
secp256k1_fe_to_signed62(&s, &tmp);
567575
secp256k1_modinv64(&s, &secp256k1_const_modinfo_fe);
568576
secp256k1_fe_from_signed62(r, &s);
569-
570577
#ifdef VERIFY
571-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
578+
secp256k1_fe_verify(r);
572579
#endif
580+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
573581
}
574582

575583
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
576584
secp256k1_fe tmp;
577585
secp256k1_modinv64_signed62 s;
578-
586+
#ifdef VERIFY
587+
VERIFY_CHECK(x->magnitude <= 8);
588+
secp256k1_fe_verify(x);
589+
#endif
579590
tmp = *x;
580591
secp256k1_fe_normalize_var(&tmp);
581592
secp256k1_fe_to_signed62(&s, &tmp);
582593
secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_fe);
583594
secp256k1_fe_from_signed62(r, &s);
584-
585595
#ifdef VERIFY
586-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
596+
secp256k1_fe_verify(r);
587597
#endif
598+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
588599
}
589600

590601
#endif /* SECP256K1_FIELD_REPR_IMPL_H */

‎src/field_impl.h

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,23 @@
2323

2424
SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
2525
secp256k1_fe na;
26+
#ifdef VERIFY
27+
VERIFY_CHECK(a->magnitude == 1);
28+
secp256k1_fe_verify(a);
29+
secp256k1_fe_verify(b);
30+
#endif
2631
secp256k1_fe_negate(&na, a, 1);
2732
secp256k1_fe_add(&na, b);
2833
return secp256k1_fe_normalizes_to_zero(&na);
2934
}
3035

3136
SECP256K1_INLINE static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b) {
3237
secp256k1_fe na;
38+
#ifdef VERIFY
39+
VERIFY_CHECK(a->magnitude == 1);
40+
secp256k1_fe_verify(a);
41+
secp256k1_fe_verify(b);
42+
#endif
3343
secp256k1_fe_negate(&na, a, 1);
3444
secp256k1_fe_add(&na, b);
3545
return secp256k1_fe_normalizes_to_zero_var(&na);
@@ -47,7 +57,10 @@ static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe * SECP256K1_RES
4757
*/
4858
secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
4959
int j;
50-
60+
#ifdef VERIFY
61+
VERIFY_CHECK(a->magnitude <= 8);
62+
secp256k1_fe_verify(a);
63+
#endif
5164
VERIFY_CHECK(r != a);
5265

5366
/** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
@@ -128,9 +141,10 @@ static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe * SECP256K1_RES
128141
secp256k1_fe_mul(&t1, &t1, &x2);
129142
secp256k1_fe_sqr(&t1, &t1);
130143
secp256k1_fe_sqr(r, &t1);
131-
144+
#ifdef VERIFY
145+
secp256k1_fe_verify(r);
146+
#endif
132147
/* Check that a square root was actually calculated */
133-
134148
secp256k1_fe_sqr(&t1, r);
135149
return secp256k1_fe_equal(&t1, a);
136150
}

0 commit comments

Comments
 (0)