Skip to content

Commit f84bc75

Browse files
sipasipa
committed
Abstract out verify logic for fe_inv{,_var}
1 parent f9e912d commit f84bc75

File tree

4 files changed

+43
-47
lines changed

4 files changed

+43
-47
lines changed

‎src/field.h

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@ static void secp256k1_fe_verify(const secp256k1_fe *a);
9898
# define secp256k1_fe_cmov secp256k1_fe_impl_cmov
9999
# define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
100100
# define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
101+
# define secp256k1_fe_inv secp256k1_fe_impl_inv
102+
# define secp256k1_fe_inv_var secp256k1_fe_impl_inv_var
101103
#endif /* defined(VERIFY) */
102104

103105
/** Normalize a field element.
@@ -258,11 +260,19 @@ static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a);
258260
*/
259261
static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe *a);
260262

261-
/** Sets a field element to be the (modular) inverse of another. Requires the input's magnitude to be
262-
* at most 8. The output magnitude is 1 (but not guaranteed to be normalized). */
263+
/** Compute the modular inverse of a field element.
264+
*
265+
* On input, a must be a valid field element; r need not be initialized.
266+
* Performs {r = a**(p-2)} (which maps 0 to 0, and every other element to its
267+
* inverse).
268+
* On output, r will have magnitude (a.magnitude != 0) and be normalized.
269+
*/
263270
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *a);
264271

265-
/** Potentially faster version of secp256k1_fe_inv, without constant-time guarantee. */
272+
/** Compute the modular inverse of a field element, without constant-time guarantee.
273+
*
274+
* Behaves identically to secp256k1_fe_inv, but is not constant-time in a.
275+
*/
266276
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *a);
267277

268278
/** Convert a field element to secp256k1_fe_storage.

‎src/field_10x26_impl.h

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1181,23 +1181,13 @@ static void secp256k1_fe_from_signed30(secp256k1_fe *r, const secp256k1_modinv32
11811181
r->n[7] = (a6 >> 2 ) & M26;
11821182
r->n[8] = (a6 >> 28 | a7 << 2) & M26;
11831183
r->n[9] = (a7 >> 24 | a8 << 6);
1184-
1185-
#ifdef VERIFY
1186-
r->magnitude = 1;
1187-
r->normalized = 1;
1188-
secp256k1_fe_verify(r);
1189-
#endif
11901184
}
11911185

11921186
static void secp256k1_fe_to_signed30(secp256k1_modinv32_signed30 *r, const secp256k1_fe *a) {
11931187
const uint32_t M30 = UINT32_MAX >> 2;
11941188
const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4],
11951189
a5 = a->n[5], a6 = a->n[6], a7 = a->n[7], a8 = a->n[8], a9 = a->n[9];
11961190

1197-
#ifdef VERIFY
1198-
VERIFY_CHECK(a->normalized);
1199-
#endif
1200-
12011191
r->v[0] = (a0 | a1 << 26) & M30;
12021192
r->v[1] = (a1 >> 4 | a2 << 22) & M30;
12031193
r->v[2] = (a2 >> 8 | a3 << 18) & M30;
@@ -1215,30 +1205,24 @@ static const secp256k1_modinv32_modinfo secp256k1_const_modinfo_fe = {
12151205
0x2DDACACFL
12161206
};
12171207

1218-
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
1219-
secp256k1_fe tmp;
1208+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
1209+
secp256k1_fe tmp = *x;
12201210
secp256k1_modinv32_signed30 s;
12211211

1222-
tmp = *x;
12231212
secp256k1_fe_normalize(&tmp);
12241213
secp256k1_fe_to_signed30(&s, &tmp);
12251214
secp256k1_modinv32(&s, &secp256k1_const_modinfo_fe);
12261215
secp256k1_fe_from_signed30(r, &s);
1227-
1228-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
12291216
}
12301217

1231-
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
1232-
secp256k1_fe tmp;
1218+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
1219+
secp256k1_fe tmp = *x;
12331220
secp256k1_modinv32_signed30 s;
12341221

1235-
tmp = *x;
12361222
secp256k1_fe_normalize_var(&tmp);
12371223
secp256k1_fe_to_signed30(&s, &tmp);
12381224
secp256k1_modinv32_var(&s, &secp256k1_const_modinfo_fe);
12391225
secp256k1_fe_from_signed30(r, &s);
1240-
1241-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
12421226
}
12431227

12441228
#endif /* SECP256K1_FIELD_REPR_IMPL_H */

‎src/field_5x52_impl.h

Lines changed: 4 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -480,22 +480,12 @@ static void secp256k1_fe_from_signed62(secp256k1_fe *r, const secp256k1_modinv64
480480
r->n[2] = (a1 >> 42 | a2 << 20) & M52;
481481
r->n[3] = (a2 >> 32 | a3 << 30) & M52;
482482
r->n[4] = (a3 >> 22 | a4 << 40);
483-
484-
#ifdef VERIFY
485-
r->magnitude = 1;
486-
r->normalized = 1;
487-
secp256k1_fe_verify(r);
488-
#endif
489483
}
490484

491485
static void secp256k1_fe_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_fe *a) {
492486
const uint64_t M62 = UINT64_MAX >> 2;
493487
const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4];
494488

495-
#ifdef VERIFY
496-
VERIFY_CHECK(a->normalized);
497-
#endif
498-
499489
r->v[0] = (a0 | a1 << 52) & M62;
500490
r->v[1] = (a1 >> 10 | a2 << 42) & M62;
501491
r->v[2] = (a2 >> 20 | a3 << 32) & M62;
@@ -508,34 +498,24 @@ static const secp256k1_modinv64_modinfo secp256k1_const_modinfo_fe = {
508498
0x27C7F6E22DDACACFLL
509499
};
510500

511-
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
512-
secp256k1_fe tmp;
501+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
502+
secp256k1_fe tmp = *x;
513503
secp256k1_modinv64_signed62 s;
514504

515-
tmp = *x;
516505
secp256k1_fe_normalize(&tmp);
517506
secp256k1_fe_to_signed62(&s, &tmp);
518507
secp256k1_modinv64(&s, &secp256k1_const_modinfo_fe);
519508
secp256k1_fe_from_signed62(r, &s);
520-
521-
#ifdef VERIFY
522-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
523-
#endif
524509
}
525510

526-
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
527-
secp256k1_fe tmp;
511+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
512+
secp256k1_fe tmp = *x;
528513
secp256k1_modinv64_signed62 s;
529514

530-
tmp = *x;
531515
secp256k1_fe_normalize_var(&tmp);
532516
secp256k1_fe_to_signed62(&s, &tmp);
533517
secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_fe);
534518
secp256k1_fe_from_signed62(r, &s);
535-
536-
#ifdef VERIFY
537-
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == secp256k1_fe_normalizes_to_zero(&tmp));
538-
#endif
539519
}
540520

541521
#endif /* SECP256K1_FIELD_REPR_IMPL_H */

‎src/field_impl.h

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,28 @@ SECP256K1_INLINE static void secp256k1_fe_from_storage(secp256k1_fe *r, const se
343343
r->normalized = 1;
344344
secp256k1_fe_verify(r);
345345
}
346+
347+
static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x);
348+
SECP256K1_INLINE static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *x) {
349+
int input_is_zero = secp256k1_fe_normalizes_to_zero(x);
350+
secp256k1_fe_verify(x);
351+
secp256k1_fe_impl_inv(r, x);
352+
r->magnitude = x->magnitude > 0;
353+
r->normalized = 1;
354+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == input_is_zero);
355+
secp256k1_fe_verify(r);
356+
}
357+
358+
static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x);
359+
SECP256K1_INLINE static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
360+
int input_is_zero = secp256k1_fe_normalizes_to_zero(x);
361+
secp256k1_fe_verify(x);
362+
secp256k1_fe_impl_inv_var(r, x);
363+
r->magnitude = x->magnitude > 0;
364+
r->normalized = 1;
365+
VERIFY_CHECK(secp256k1_fe_normalizes_to_zero(r) == input_is_zero);
366+
secp256k1_fe_verify(r);
367+
}
346368
#endif /* defined(VERIFY) */
347369

348370
#endif /* SECP256K1_FIELD_IMPL_H */

0 commit comments

Comments
 (0)