github.com/ethereumproject/go-ethereum@v5.5.2+incompatible/crypto/secp256k1/libsecp256k1/src/ecmult_impl.h (about) 1 /********************************************************************** 2 * Copyright (c) 2013, 2014 Pieter Wuille * 3 * Distributed under the MIT software license, see the accompanying * 4 * file COPYING or http://www.opensource.org/licenses/mit-license.php.* 5 **********************************************************************/ 6 7 #ifndef _SECP256K1_ECMULT_IMPL_H_ 8 #define _SECP256K1_ECMULT_IMPL_H_ 9 10 #include "group.h" 11 #include "scalar.h" 12 #include "ecmult.h" 13 14 /* optimal for 128-bit and 256-bit exponents. */ 15 #define WINDOW_A 5 16 17 /** larger numbers may result in slightly better performance, at the cost of 18 exponentially larger precomputed tables. */ 19 #ifdef USE_ENDOMORPHISM 20 /** Two tables for window size 15: 1.375 MiB. */ 21 #define WINDOW_G 15 22 #else 23 /** One table for window size 16: 1.375 MiB. */ 24 #define WINDOW_G 16 25 #endif 26 27 /** The number of entries a table with precomputed multiples needs to have. */ 28 #define ECMULT_TABLE_SIZE(w) (1 << ((w)-2)) 29 30 /** Fill a table 'prej' with precomputed odd multiples of a. Prej will contain 31 * the values [1*a,3*a,...,(2*n-1)*a], so it space for n values. zr[0] will 32 * contain prej[0].z / a.z. The other zr[i] values = prej[i].z / prej[i-1].z. 33 * Prej's Z values are undefined, except for the last value. 34 */ 35 static void secp256k1_ecmult_odd_multiples_table(int n, secp256k1_gej *prej, secp256k1_fe *zr, const secp256k1_gej *a) { 36 secp256k1_gej d; 37 secp256k1_ge a_ge, d_ge; 38 int i; 39 40 VERIFY_CHECK(!a->infinity); 41 42 secp256k1_gej_double_var(&d, a, NULL); 43 44 /* 45 * Perform the additions on an isomorphism where 'd' is affine: drop the z coordinate 46 * of 'd', and scale the 1P starting value's x/y coordinates without changing its z. 47 */ 48 d_ge.x = d.x; 49 d_ge.y = d.y; 50 d_ge.infinity = 0; 51 52 secp256k1_ge_set_gej_zinv(&a_ge, a, &d.z); 53 prej[0].x = a_ge.x; 54 prej[0].y = a_ge.y; 55 prej[0].z = a->z; 56 prej[0].infinity = 0; 57 58 zr[0] = d.z; 59 for (i = 1; i < n; i++) { 60 secp256k1_gej_add_ge_var(&prej[i], &prej[i-1], &d_ge, &zr[i]); 61 } 62 63 /* 64 * Each point in 'prej' has a z coordinate too small by a factor of 'd.z'. Only 65 * the final point's z coordinate is actually used though, so just update that. 66 */ 67 secp256k1_fe_mul(&prej[n-1].z, &prej[n-1].z, &d.z); 68 } 69 70 /** Fill a table 'pre' with precomputed odd multiples of a. 71 * 72 * There are two versions of this function: 73 * - secp256k1_ecmult_odd_multiples_table_globalz_windowa which brings its 74 * resulting point set to a single constant Z denominator, stores the X and Y 75 * coordinates as ge_storage points in pre, and stores the global Z in rz. 76 * It only operates on tables sized for WINDOW_A wnaf multiples. 77 * - secp256k1_ecmult_odd_multiples_table_storage_var, which converts its 78 * resulting point set to actually affine points, and stores those in pre. 79 * It operates on tables of any size, but uses heap-allocated temporaries. 80 * 81 * To compute a*P + b*G, we compute a table for P using the first function, 82 * and for G using the second (which requires an inverse, but it only needs to 83 * happen once). 84 */ 85 static void secp256k1_ecmult_odd_multiples_table_globalz_windowa(secp256k1_ge *pre, secp256k1_fe *globalz, const secp256k1_gej *a) { 86 secp256k1_gej prej[ECMULT_TABLE_SIZE(WINDOW_A)]; 87 secp256k1_fe zr[ECMULT_TABLE_SIZE(WINDOW_A)]; 88 89 /* Compute the odd multiples in Jacobian form. */ 90 secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), prej, zr, a); 91 /* Bring them to the same Z denominator. */ 92 secp256k1_ge_globalz_set_table_gej(ECMULT_TABLE_SIZE(WINDOW_A), pre, globalz, prej, zr); 93 } 94 95 static void secp256k1_ecmult_odd_multiples_table_storage_var(int n, secp256k1_ge_storage *pre, const secp256k1_gej *a, const secp256k1_callback *cb) { 96 secp256k1_gej *prej = (secp256k1_gej*)checked_malloc(cb, sizeof(secp256k1_gej) * n); 97 secp256k1_ge *prea = (secp256k1_ge*)checked_malloc(cb, sizeof(secp256k1_ge) * n); 98 secp256k1_fe *zr = (secp256k1_fe*)checked_malloc(cb, sizeof(secp256k1_fe) * n); 99 int i; 100 101 /* Compute the odd multiples in Jacobian form. */ 102 secp256k1_ecmult_odd_multiples_table(n, prej, zr, a); 103 /* Convert them in batch to affine coordinates. */ 104 secp256k1_ge_set_table_gej_var(n, prea, prej, zr); 105 /* Convert them to compact storage form. */ 106 for (i = 0; i < n; i++) { 107 secp256k1_ge_to_storage(&pre[i], &prea[i]); 108 } 109 110 free(prea); 111 free(prej); 112 free(zr); 113 } 114 115 /** The following two macro retrieves a particular odd multiple from a table 116 * of precomputed multiples. */ 117 #define ECMULT_TABLE_GET_GE(r,pre,n,w) do { \ 118 VERIFY_CHECK(((n) & 1) == 1); \ 119 VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \ 120 VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \ 121 if ((n) > 0) { \ 122 *(r) = (pre)[((n)-1)/2]; \ 123 } else { \ 124 secp256k1_ge_neg((r), &(pre)[(-(n)-1)/2]); \ 125 } \ 126 } while(0) 127 128 #define ECMULT_TABLE_GET_GE_STORAGE(r,pre,n,w) do { \ 129 VERIFY_CHECK(((n) & 1) == 1); \ 130 VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \ 131 VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \ 132 if ((n) > 0) { \ 133 secp256k1_ge_from_storage((r), &(pre)[((n)-1)/2]); \ 134 } else { \ 135 secp256k1_ge_from_storage((r), &(pre)[(-(n)-1)/2]); \ 136 secp256k1_ge_neg((r), (r)); \ 137 } \ 138 } while(0) 139 140 static void secp256k1_ecmult_context_init(secp256k1_ecmult_context *ctx) { 141 ctx->pre_g = NULL; 142 #ifdef USE_ENDOMORPHISM 143 ctx->pre_g_128 = NULL; 144 #endif 145 } 146 147 static void secp256k1_ecmult_context_build(secp256k1_ecmult_context *ctx, const secp256k1_callback *cb) { 148 secp256k1_gej gj; 149 150 if (ctx->pre_g != NULL) { 151 return; 152 } 153 154 /* get the generator */ 155 secp256k1_gej_set_ge(&gj, &secp256k1_ge_const_g); 156 157 ctx->pre_g = (secp256k1_ge_storage (*)[])checked_malloc(cb, sizeof((*ctx->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G)); 158 159 /* precompute the tables with odd multiples */ 160 secp256k1_ecmult_odd_multiples_table_storage_var(ECMULT_TABLE_SIZE(WINDOW_G), *ctx->pre_g, &gj, cb); 161 162 #ifdef USE_ENDOMORPHISM 163 { 164 secp256k1_gej g_128j; 165 int i; 166 167 ctx->pre_g_128 = (secp256k1_ge_storage (*)[])checked_malloc(cb, sizeof((*ctx->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G)); 168 169 /* calculate 2^128*generator */ 170 g_128j = gj; 171 for (i = 0; i < 128; i++) { 172 secp256k1_gej_double_var(&g_128j, &g_128j, NULL); 173 } 174 secp256k1_ecmult_odd_multiples_table_storage_var(ECMULT_TABLE_SIZE(WINDOW_G), *ctx->pre_g_128, &g_128j, cb); 175 } 176 #endif 177 } 178 179 static void secp256k1_ecmult_context_clone(secp256k1_ecmult_context *dst, 180 const secp256k1_ecmult_context *src, const secp256k1_callback *cb) { 181 if (src->pre_g == NULL) { 182 dst->pre_g = NULL; 183 } else { 184 size_t size = sizeof((*dst->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G); 185 dst->pre_g = (secp256k1_ge_storage (*)[])checked_malloc(cb, size); 186 memcpy(dst->pre_g, src->pre_g, size); 187 } 188 #ifdef USE_ENDOMORPHISM 189 if (src->pre_g_128 == NULL) { 190 dst->pre_g_128 = NULL; 191 } else { 192 size_t size = sizeof((*dst->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G); 193 dst->pre_g_128 = (secp256k1_ge_storage (*)[])checked_malloc(cb, size); 194 memcpy(dst->pre_g_128, src->pre_g_128, size); 195 } 196 #endif 197 } 198 199 static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context *ctx) { 200 return ctx->pre_g != NULL; 201 } 202 203 static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context *ctx) { 204 free(ctx->pre_g); 205 #ifdef USE_ENDOMORPHISM 206 free(ctx->pre_g_128); 207 #endif 208 secp256k1_ecmult_context_init(ctx); 209 } 210 211 /** Convert a number to WNAF notation. The number becomes represented by sum(2^i * wnaf[i], i=0..bits), 212 * with the following guarantees: 213 * - each wnaf[i] is either 0, or an odd integer between -(1<<(w-1) - 1) and (1<<(w-1) - 1) 214 * - two non-zero entries in wnaf are separated by at least w-1 zeroes. 215 * - the number of set values in wnaf is returned. This number is at most 256, and at most one more 216 * than the number of bits in the (absolute value) of the input. 217 */ 218 static int secp256k1_ecmult_wnaf(int *wnaf, int len, const secp256k1_scalar *a, int w) { 219 secp256k1_scalar s = *a; 220 int last_set_bit = -1; 221 int bit = 0; 222 int sign = 1; 223 int carry = 0; 224 225 VERIFY_CHECK(wnaf != NULL); 226 VERIFY_CHECK(0 <= len && len <= 256); 227 VERIFY_CHECK(a != NULL); 228 VERIFY_CHECK(2 <= w && w <= 31); 229 230 memset(wnaf, 0, len * sizeof(wnaf[0])); 231 232 if (secp256k1_scalar_get_bits(&s, 255, 1)) { 233 secp256k1_scalar_negate(&s, &s); 234 sign = -1; 235 } 236 237 while (bit < len) { 238 int now; 239 int word; 240 if (secp256k1_scalar_get_bits(&s, bit, 1) == (unsigned int)carry) { 241 bit++; 242 continue; 243 } 244 245 now = w; 246 if (now > len - bit) { 247 now = len - bit; 248 } 249 250 word = secp256k1_scalar_get_bits_var(&s, bit, now) + carry; 251 252 carry = (word >> (w-1)) & 1; 253 word -= carry << w; 254 255 wnaf[bit] = sign * word; 256 last_set_bit = bit; 257 258 bit += now; 259 } 260 #ifdef VERIFY 261 CHECK(carry == 0); 262 while (bit < 256) { 263 CHECK(secp256k1_scalar_get_bits(&s, bit++, 1) == 0); 264 } 265 #endif 266 return last_set_bit + 1; 267 } 268 269 static void secp256k1_ecmult(const secp256k1_ecmult_context *ctx, secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) { 270 secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)]; 271 secp256k1_ge tmpa; 272 secp256k1_fe Z; 273 #ifdef USE_ENDOMORPHISM 274 secp256k1_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)]; 275 secp256k1_scalar na_1, na_lam; 276 /* Splitted G factors. */ 277 secp256k1_scalar ng_1, ng_128; 278 int wnaf_na_1[130]; 279 int wnaf_na_lam[130]; 280 int bits_na_1; 281 int bits_na_lam; 282 int wnaf_ng_1[129]; 283 int bits_ng_1; 284 int wnaf_ng_128[129]; 285 int bits_ng_128; 286 #else 287 int wnaf_na[256]; 288 int bits_na; 289 int wnaf_ng[256]; 290 int bits_ng; 291 #endif 292 int i; 293 int bits; 294 295 #ifdef USE_ENDOMORPHISM 296 /* split na into na_1 and na_lam (where na = na_1 + na_lam*lambda, and na_1 and na_lam are ~128 bit) */ 297 secp256k1_scalar_split_lambda(&na_1, &na_lam, na); 298 299 /* build wnaf representation for na_1 and na_lam. */ 300 bits_na_1 = secp256k1_ecmult_wnaf(wnaf_na_1, 130, &na_1, WINDOW_A); 301 bits_na_lam = secp256k1_ecmult_wnaf(wnaf_na_lam, 130, &na_lam, WINDOW_A); 302 VERIFY_CHECK(bits_na_1 <= 130); 303 VERIFY_CHECK(bits_na_lam <= 130); 304 bits = bits_na_1; 305 if (bits_na_lam > bits) { 306 bits = bits_na_lam; 307 } 308 #else 309 /* build wnaf representation for na. */ 310 bits_na = secp256k1_ecmult_wnaf(wnaf_na, 256, na, WINDOW_A); 311 bits = bits_na; 312 #endif 313 314 /* Calculate odd multiples of a. 315 * All multiples are brought to the same Z 'denominator', which is stored 316 * in Z. Due to secp256k1' isomorphism we can do all operations pretending 317 * that the Z coordinate was 1, use affine addition formulae, and correct 318 * the Z coordinate of the result once at the end. 319 * The exception is the precomputed G table points, which are actually 320 * affine. Compared to the base used for other points, they have a Z ratio 321 * of 1/Z, so we can use secp256k1_gej_add_zinv_var, which uses the same 322 * isomorphism to efficiently add with a known Z inverse. 323 */ 324 secp256k1_ecmult_odd_multiples_table_globalz_windowa(pre_a, &Z, a); 325 326 #ifdef USE_ENDOMORPHISM 327 for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) { 328 secp256k1_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]); 329 } 330 331 /* split ng into ng_1 and ng_128 (where gn = gn_1 + gn_128*2^128, and gn_1 and gn_128 are ~128 bit) */ 332 secp256k1_scalar_split_128(&ng_1, &ng_128, ng); 333 334 /* Build wnaf representation for ng_1 and ng_128 */ 335 bits_ng_1 = secp256k1_ecmult_wnaf(wnaf_ng_1, 129, &ng_1, WINDOW_G); 336 bits_ng_128 = secp256k1_ecmult_wnaf(wnaf_ng_128, 129, &ng_128, WINDOW_G); 337 if (bits_ng_1 > bits) { 338 bits = bits_ng_1; 339 } 340 if (bits_ng_128 > bits) { 341 bits = bits_ng_128; 342 } 343 #else 344 bits_ng = secp256k1_ecmult_wnaf(wnaf_ng, 256, ng, WINDOW_G); 345 if (bits_ng > bits) { 346 bits = bits_ng; 347 } 348 #endif 349 350 secp256k1_gej_set_infinity(r); 351 352 for (i = bits - 1; i >= 0; i--) { 353 int n; 354 secp256k1_gej_double_var(r, r, NULL); 355 #ifdef USE_ENDOMORPHISM 356 if (i < bits_na_1 && (n = wnaf_na_1[i])) { 357 ECMULT_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A); 358 secp256k1_gej_add_ge_var(r, r, &tmpa, NULL); 359 } 360 if (i < bits_na_lam && (n = wnaf_na_lam[i])) { 361 ECMULT_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A); 362 secp256k1_gej_add_ge_var(r, r, &tmpa, NULL); 363 } 364 if (i < bits_ng_1 && (n = wnaf_ng_1[i])) { 365 ECMULT_TABLE_GET_GE_STORAGE(&tmpa, *ctx->pre_g, n, WINDOW_G); 366 secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z); 367 } 368 if (i < bits_ng_128 && (n = wnaf_ng_128[i])) { 369 ECMULT_TABLE_GET_GE_STORAGE(&tmpa, *ctx->pre_g_128, n, WINDOW_G); 370 secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z); 371 } 372 #else 373 if (i < bits_na && (n = wnaf_na[i])) { 374 ECMULT_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A); 375 secp256k1_gej_add_ge_var(r, r, &tmpa, NULL); 376 } 377 if (i < bits_ng && (n = wnaf_ng[i])) { 378 ECMULT_TABLE_GET_GE_STORAGE(&tmpa, *ctx->pre_g, n, WINDOW_G); 379 secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z); 380 } 381 #endif 382 } 383 384 if (!r->infinity) { 385 secp256k1_fe_mul(&r->z, &r->z, &Z); 386 } 387 } 388 389 #endif