mirror of https://github.com/hashcat/hashcat.git
philsmd
5 years ago
parent
d07f002337
commit
9cbeab9793
@ -1,50 +0,0 @@
|
|||||||
bench_inv
|
|
||||||
bench_ecdh
|
|
||||||
bench_ecmult
|
|
||||||
bench_sign
|
|
||||||
bench_verify
|
|
||||||
bench_schnorr_verify
|
|
||||||
bench_recover
|
|
||||||
bench_internal
|
|
||||||
tests
|
|
||||||
exhaustive_tests
|
|
||||||
gen_context
|
|
||||||
*.exe
|
|
||||||
*.so
|
|
||||||
*.a
|
|
||||||
!.gitignore
|
|
||||||
|
|
||||||
Makefile
|
|
||||||
configure
|
|
||||||
.libs/
|
|
||||||
Makefile.in
|
|
||||||
aclocal.m4
|
|
||||||
autom4te.cache/
|
|
||||||
config.log
|
|
||||||
config.status
|
|
||||||
*.tar.gz
|
|
||||||
*.la
|
|
||||||
libtool
|
|
||||||
.deps/
|
|
||||||
.dirstamp
|
|
||||||
*.lo
|
|
||||||
*.o
|
|
||||||
*~
|
|
||||||
src/libsecp256k1-config.h
|
|
||||||
src/libsecp256k1-config.h.in
|
|
||||||
src/ecmult_static_context.h
|
|
||||||
build-aux/config.guess
|
|
||||||
build-aux/config.sub
|
|
||||||
build-aux/depcomp
|
|
||||||
build-aux/install-sh
|
|
||||||
build-aux/ltmain.sh
|
|
||||||
build-aux/m4/libtool.m4
|
|
||||||
build-aux/m4/lt~obsolete.m4
|
|
||||||
build-aux/m4/ltoptions.m4
|
|
||||||
build-aux/m4/ltsugar.m4
|
|
||||||
build-aux/m4/ltversion.m4
|
|
||||||
build-aux/missing
|
|
||||||
build-aux/compile
|
|
||||||
build-aux/test-driver
|
|
||||||
src/stamp-h1
|
|
||||||
libsecp256k1.pc
|
|
||||||
@ -1,19 +0,0 @@
|
|||||||
Copyright (c) 2013 Pieter Wuille
|
|
||||||
|
|
||||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
||||||
of this software and associated documentation files (the "Software"), to deal
|
|
||||||
in the Software without restriction, including without limitation the rights
|
|
||||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
||||||
copies of the Software, and to permit persons to whom the Software is
|
|
||||||
furnished to do so, subject to the following conditions:
|
|
||||||
|
|
||||||
The above copyright notice and this permission notice shall be included in
|
|
||||||
all copies or substantial portions of the Software.
|
|
||||||
|
|
||||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
||||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
||||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
||||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
||||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
||||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
||||||
THE SOFTWARE.
|
|
||||||
@ -1,183 +0,0 @@
|
|||||||
ACLOCAL_AMFLAGS = -I build-aux/m4
|
|
||||||
|
|
||||||
lib_LTLIBRARIES = libsecp256k1.la
|
|
||||||
if USE_JNI
|
|
||||||
JNI_LIB = libsecp256k1_jni.la
|
|
||||||
noinst_LTLIBRARIES = $(JNI_LIB)
|
|
||||||
else
|
|
||||||
JNI_LIB =
|
|
||||||
endif
|
|
||||||
include_HEADERS = include/secp256k1.h
|
|
||||||
include_HEADERS += include/secp256k1_preallocated.h
|
|
||||||
noinst_HEADERS =
|
|
||||||
noinst_HEADERS += src/scalar.h
|
|
||||||
noinst_HEADERS += src/scalar_4x64.h
|
|
||||||
noinst_HEADERS += src/scalar_8x32.h
|
|
||||||
noinst_HEADERS += src/scalar_low.h
|
|
||||||
noinst_HEADERS += src/scalar_impl.h
|
|
||||||
noinst_HEADERS += src/scalar_4x64_impl.h
|
|
||||||
noinst_HEADERS += src/scalar_8x32_impl.h
|
|
||||||
noinst_HEADERS += src/scalar_low_impl.h
|
|
||||||
noinst_HEADERS += src/group.h
|
|
||||||
noinst_HEADERS += src/group_impl.h
|
|
||||||
noinst_HEADERS += src/num_gmp.h
|
|
||||||
noinst_HEADERS += src/num_gmp_impl.h
|
|
||||||
noinst_HEADERS += src/ecdsa.h
|
|
||||||
noinst_HEADERS += src/ecdsa_impl.h
|
|
||||||
noinst_HEADERS += src/eckey.h
|
|
||||||
noinst_HEADERS += src/eckey_impl.h
|
|
||||||
noinst_HEADERS += src/ecmult.h
|
|
||||||
noinst_HEADERS += src/ecmult_impl.h
|
|
||||||
noinst_HEADERS += src/ecmult_const.h
|
|
||||||
noinst_HEADERS += src/ecmult_const_impl.h
|
|
||||||
noinst_HEADERS += src/ecmult_gen.h
|
|
||||||
noinst_HEADERS += src/ecmult_gen_impl.h
|
|
||||||
noinst_HEADERS += src/num.h
|
|
||||||
noinst_HEADERS += src/num_impl.h
|
|
||||||
noinst_HEADERS += src/field_10x26.h
|
|
||||||
noinst_HEADERS += src/field_10x26_impl.h
|
|
||||||
noinst_HEADERS += src/field_5x52.h
|
|
||||||
noinst_HEADERS += src/field_5x52_impl.h
|
|
||||||
noinst_HEADERS += src/field_5x52_int128_impl.h
|
|
||||||
noinst_HEADERS += src/field_5x52_asm_impl.h
|
|
||||||
noinst_HEADERS += src/java/org_bitcoin_NativeSecp256k1.h
|
|
||||||
noinst_HEADERS += src/java/org_bitcoin_Secp256k1Context.h
|
|
||||||
noinst_HEADERS += src/util.h
|
|
||||||
noinst_HEADERS += src/scratch.h
|
|
||||||
noinst_HEADERS += src/scratch_impl.h
|
|
||||||
noinst_HEADERS += src/testrand.h
|
|
||||||
noinst_HEADERS += src/testrand_impl.h
|
|
||||||
noinst_HEADERS += src/hash.h
|
|
||||||
noinst_HEADERS += src/hash_impl.h
|
|
||||||
noinst_HEADERS += src/field.h
|
|
||||||
noinst_HEADERS += src/field_impl.h
|
|
||||||
noinst_HEADERS += src/bench.h
|
|
||||||
noinst_HEADERS += contrib/lax_der_parsing.h
|
|
||||||
noinst_HEADERS += contrib/lax_der_parsing.c
|
|
||||||
noinst_HEADERS += contrib/lax_der_privatekey_parsing.h
|
|
||||||
noinst_HEADERS += contrib/lax_der_privatekey_parsing.c
|
|
||||||
|
|
||||||
if USE_EXTERNAL_ASM
|
|
||||||
COMMON_LIB = libsecp256k1_common.la
|
|
||||||
noinst_LTLIBRARIES = $(COMMON_LIB)
|
|
||||||
else
|
|
||||||
COMMON_LIB =
|
|
||||||
endif
|
|
||||||
|
|
||||||
pkgconfigdir = $(libdir)/pkgconfig
|
|
||||||
pkgconfig_DATA = libsecp256k1.pc
|
|
||||||
|
|
||||||
if USE_EXTERNAL_ASM
|
|
||||||
if USE_ASM_ARM
|
|
||||||
libsecp256k1_common_la_SOURCES = src/asm/field_10x26_arm.s
|
|
||||||
endif
|
|
||||||
endif
|
|
||||||
|
|
||||||
libsecp256k1_la_SOURCES = src/secp256k1.c
|
|
||||||
libsecp256k1_la_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/include -I$(top_srcdir)/src $(SECP_INCLUDES)
|
|
||||||
libsecp256k1_la_LIBADD = $(JNI_LIB) $(SECP_LIBS) $(COMMON_LIB)
|
|
||||||
|
|
||||||
libsecp256k1_jni_la_SOURCES = src/java/org_bitcoin_NativeSecp256k1.c src/java/org_bitcoin_Secp256k1Context.c
|
|
||||||
libsecp256k1_jni_la_CPPFLAGS = -DSECP256K1_BUILD $(JNI_INCLUDES)
|
|
||||||
|
|
||||||
noinst_PROGRAMS =
|
|
||||||
if USE_BENCHMARK
|
|
||||||
noinst_PROGRAMS += bench_verify bench_sign bench_internal bench_ecmult
|
|
||||||
bench_verify_SOURCES = src/bench_verify.c
|
|
||||||
bench_verify_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
|
|
||||||
bench_sign_SOURCES = src/bench_sign.c
|
|
||||||
bench_sign_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
|
|
||||||
bench_internal_SOURCES = src/bench_internal.c
|
|
||||||
bench_internal_LDADD = $(SECP_LIBS) $(COMMON_LIB)
|
|
||||||
bench_internal_CPPFLAGS = -DSECP256K1_BUILD $(SECP_INCLUDES)
|
|
||||||
bench_ecmult_SOURCES = src/bench_ecmult.c
|
|
||||||
bench_ecmult_LDADD = $(SECP_LIBS) $(COMMON_LIB)
|
|
||||||
bench_ecmult_CPPFLAGS = -DSECP256K1_BUILD $(SECP_INCLUDES)
|
|
||||||
endif
|
|
||||||
|
|
||||||
TESTS =
|
|
||||||
if USE_TESTS
|
|
||||||
noinst_PROGRAMS += tests
|
|
||||||
tests_SOURCES = src/tests.c
|
|
||||||
tests_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/src -I$(top_srcdir)/include $(SECP_INCLUDES) $(SECP_TEST_INCLUDES)
|
|
||||||
if !ENABLE_COVERAGE
|
|
||||||
tests_CPPFLAGS += -DVERIFY
|
|
||||||
endif
|
|
||||||
tests_LDADD = $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
|
|
||||||
tests_LDFLAGS = -static
|
|
||||||
TESTS += tests
|
|
||||||
endif
|
|
||||||
|
|
||||||
if USE_EXHAUSTIVE_TESTS
|
|
||||||
noinst_PROGRAMS += exhaustive_tests
|
|
||||||
exhaustive_tests_SOURCES = src/tests_exhaustive.c
|
|
||||||
exhaustive_tests_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/src $(SECP_INCLUDES)
|
|
||||||
if !ENABLE_COVERAGE
|
|
||||||
exhaustive_tests_CPPFLAGS += -DVERIFY
|
|
||||||
endif
|
|
||||||
exhaustive_tests_LDADD = $(SECP_LIBS) $(COMMON_LIB)
|
|
||||||
exhaustive_tests_LDFLAGS = -static
|
|
||||||
TESTS += exhaustive_tests
|
|
||||||
endif
|
|
||||||
|
|
||||||
JAVAROOT=src/java
|
|
||||||
JAVAORG=org/bitcoin
|
|
||||||
JAVA_GUAVA=$(srcdir)/$(JAVAROOT)/guava/guava-18.0.jar
|
|
||||||
CLASSPATH_ENV=CLASSPATH=$(JAVA_GUAVA)
|
|
||||||
JAVA_FILES= \
|
|
||||||
$(JAVAROOT)/$(JAVAORG)/NativeSecp256k1.java \
|
|
||||||
$(JAVAROOT)/$(JAVAORG)/NativeSecp256k1Test.java \
|
|
||||||
$(JAVAROOT)/$(JAVAORG)/NativeSecp256k1Util.java \
|
|
||||||
$(JAVAROOT)/$(JAVAORG)/Secp256k1Context.java
|
|
||||||
|
|
||||||
if USE_JNI
|
|
||||||
|
|
||||||
$(JAVA_GUAVA):
|
|
||||||
@echo Guava is missing. Fetch it via: \
|
|
||||||
wget https://search.maven.org/remotecontent?filepath=com/google/guava/guava/18.0/guava-18.0.jar -O $(@)
|
|
||||||
@false
|
|
||||||
|
|
||||||
.stamp-java: $(JAVA_FILES)
|
|
||||||
@echo Compiling $^
|
|
||||||
$(AM_V_at)$(CLASSPATH_ENV) javac $^
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
if USE_TESTS
|
|
||||||
|
|
||||||
check-java: libsecp256k1.la $(JAVA_GUAVA) .stamp-java
|
|
||||||
$(AM_V_at)java -Djava.library.path="./:./src:./src/.libs:.libs/" -cp "$(JAVA_GUAVA):$(JAVAROOT)" $(JAVAORG)/NativeSecp256k1Test
|
|
||||||
|
|
||||||
endif
|
|
||||||
endif
|
|
||||||
|
|
||||||
if USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
CPPFLAGS_FOR_BUILD +=-I$(top_srcdir) -I$(builddir)/src
|
|
||||||
|
|
||||||
gen_context_OBJECTS = gen_context.o
|
|
||||||
gen_context_BIN = gen_context$(BUILD_EXEEXT)
|
|
||||||
gen_%.o: src/gen_%.c src/libsecp256k1-config.h
|
|
||||||
$(CC_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c $< -o $@
|
|
||||||
|
|
||||||
$(gen_context_BIN): $(gen_context_OBJECTS)
|
|
||||||
$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $^ -o $@
|
|
||||||
|
|
||||||
$(libsecp256k1_la_OBJECTS): src/ecmult_static_context.h
|
|
||||||
$(tests_OBJECTS): src/ecmult_static_context.h
|
|
||||||
$(bench_internal_OBJECTS): src/ecmult_static_context.h
|
|
||||||
$(bench_ecmult_OBJECTS): src/ecmult_static_context.h
|
|
||||||
|
|
||||||
src/ecmult_static_context.h: $(gen_context_BIN)
|
|
||||||
./$(gen_context_BIN)
|
|
||||||
|
|
||||||
CLEANFILES = $(gen_context_BIN) src/ecmult_static_context.h $(JAVAROOT)/$(JAVAORG)/*.class .stamp-java
|
|
||||||
endif
|
|
||||||
|
|
||||||
EXTRA_DIST = autogen.sh src/gen_context.c src/basic-config.h $(JAVA_FILES)
|
|
||||||
|
|
||||||
if ENABLE_MODULE_ECDH
|
|
||||||
include src/modules/ecdh/Makefile.am.include
|
|
||||||
endif
|
|
||||||
|
|
||||||
if ENABLE_MODULE_RECOVERY
|
|
||||||
include src/modules/recovery/Makefile.am.include
|
|
||||||
endif
|
|
||||||
@ -1,73 +0,0 @@
|
|||||||
libsecp256k1
|
|
||||||
============
|
|
||||||
|
|
||||||
[](https://travis-ci.org/bitcoin-core/secp256k1)
|
|
||||||
|
|
||||||
Optimized C library for EC operations on curve secp256k1.
|
|
||||||
|
|
||||||
This library is a work in progress and is being used to research best practices. Use at your own risk.
|
|
||||||
|
|
||||||
Features:
|
|
||||||
* secp256k1 ECDSA signing/verification and key generation.
|
|
||||||
* Adding/multiplying private/public keys.
|
|
||||||
* Serialization/parsing of private keys, public keys, signatures.
|
|
||||||
* Constant time, constant memory access signing and pubkey generation.
|
|
||||||
* Derandomized DSA (via RFC6979 or with a caller provided function.)
|
|
||||||
* Very efficient implementation.
|
|
||||||
|
|
||||||
Implementation details
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
* General
|
|
||||||
* No runtime heap allocation.
|
|
||||||
* Extensive testing infrastructure.
|
|
||||||
* Structured to facilitate review and analysis.
|
|
||||||
* Intended to be portable to any system with a C89 compiler and uint64_t support.
|
|
||||||
* No use of floating types, except in benchmarks.
|
|
||||||
* Expose only higher level interfaces to minimize the API surface and improve application security. ("Be difficult to use insecurely.")
|
|
||||||
* Field operations
|
|
||||||
* Optimized implementation of arithmetic modulo the curve's field size (2^256 - 0x1000003D1).
|
|
||||||
* Using 5 52-bit limbs (including hand-optimized assembly for x86_64, by Diederik Huys).
|
|
||||||
* Using 10 26-bit limbs.
|
|
||||||
* Field inverses and square roots using a sliding window over blocks of 1s (by Peter Dettman).
|
|
||||||
* Scalar operations
|
|
||||||
* Optimized implementation without data-dependent branches of arithmetic modulo the curve's order.
|
|
||||||
* Using 4 64-bit limbs (relying on __int128 support in the compiler).
|
|
||||||
* Using 8 32-bit limbs.
|
|
||||||
* Group operations
|
|
||||||
* Point addition formula specifically simplified for the curve equation (y^2 = x^3 + 7).
|
|
||||||
* Use addition between points in Jacobian and affine coordinates where possible.
|
|
||||||
* Use a unified addition/doubling formula where necessary to avoid data-dependent branches.
|
|
||||||
* Point/x comparison without a field inversion by comparison in the Jacobian coordinate space.
|
|
||||||
* Point multiplication for verification (a*P + b*G).
|
|
||||||
* Use wNAF notation for point multiplicands.
|
|
||||||
* Use a much larger window for multiples of G, using precomputed multiples.
|
|
||||||
* Use Shamir's trick to do the multiplication with the public key and the generator simultaneously.
|
|
||||||
* Optionally (off by default) use secp256k1's efficiently-computable endomorphism to split the P multiplicand into 2 half-sized ones.
|
|
||||||
* Point multiplication for signing
|
|
||||||
* Use a precomputed table of multiples of powers of 16 multiplied with the generator, so general multiplication becomes a series of additions.
|
|
||||||
* Intended to be completely free of timing sidechannels for secret-key operations (on reasonable hardware/toolchains)
|
|
||||||
* Access the table with branch-free conditional moves so memory access is uniform.
|
|
||||||
* No data-dependent branches
|
|
||||||
* Optional runtime blinding which attempts to frustrate differential power analysis.
|
|
||||||
* The precomputed tables add and eventually subtract points for which no known scalar (private key) is known, preventing even an attacker with control over the private key used to control the data internally.
|
|
||||||
|
|
||||||
Build steps
|
|
||||||
-----------
|
|
||||||
|
|
||||||
libsecp256k1 is built using autotools:
|
|
||||||
|
|
||||||
$ ./autogen.sh
|
|
||||||
$ ./configure
|
|
||||||
$ make
|
|
||||||
$ make check
|
|
||||||
$ sudo make install # optional
|
|
||||||
|
|
||||||
Exhaustive tests
|
|
||||||
-----------
|
|
||||||
|
|
||||||
$ ./exhaustive_tests
|
|
||||||
|
|
||||||
With valgrind, you might need to increase the max stack size:
|
|
||||||
|
|
||||||
$ valgrind --max-stackframe=2500000 ./exhaustive_tests
|
|
||||||
@ -1,3 +0,0 @@
|
|||||||
* Unit tests for fieldelem/groupelem, including ones intended to
|
|
||||||
trigger fieldelem's boundary cases.
|
|
||||||
* Complete constant-time operations for signing/keygen
|
|
||||||
@ -1,3 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
set -e
|
|
||||||
autoreconf -if --warnings=all
|
|
||||||
@ -1,145 +0,0 @@
|
|||||||
# ===========================================================================
|
|
||||||
# https://www.gnu.org/software/autoconf-archive/ax_jni_include_dir.html
|
|
||||||
# ===========================================================================
|
|
||||||
#
|
|
||||||
# SYNOPSIS
|
|
||||||
#
|
|
||||||
# AX_JNI_INCLUDE_DIR
|
|
||||||
#
|
|
||||||
# DESCRIPTION
|
|
||||||
#
|
|
||||||
# AX_JNI_INCLUDE_DIR finds include directories needed for compiling
|
|
||||||
# programs using the JNI interface.
|
|
||||||
#
|
|
||||||
# JNI include directories are usually in the Java distribution. This is
|
|
||||||
# deduced from the value of $JAVA_HOME, $JAVAC, or the path to "javac", in
|
|
||||||
# that order. When this macro completes, a list of directories is left in
|
|
||||||
# the variable JNI_INCLUDE_DIRS.
|
|
||||||
#
|
|
||||||
# Example usage follows:
|
|
||||||
#
|
|
||||||
# AX_JNI_INCLUDE_DIR
|
|
||||||
#
|
|
||||||
# for JNI_INCLUDE_DIR in $JNI_INCLUDE_DIRS
|
|
||||||
# do
|
|
||||||
# CPPFLAGS="$CPPFLAGS -I$JNI_INCLUDE_DIR"
|
|
||||||
# done
|
|
||||||
#
|
|
||||||
# If you want to force a specific compiler:
|
|
||||||
#
|
|
||||||
# - at the configure.in level, set JAVAC=yourcompiler before calling
|
|
||||||
# AX_JNI_INCLUDE_DIR
|
|
||||||
#
|
|
||||||
# - at the configure level, setenv JAVAC
|
|
||||||
#
|
|
||||||
# Note: This macro can work with the autoconf M4 macros for Java programs.
|
|
||||||
# This particular macro is not part of the original set of macros.
|
|
||||||
#
|
|
||||||
# LICENSE
|
|
||||||
#
|
|
||||||
# Copyright (c) 2008 Don Anderson <dda@sleepycat.com>
|
|
||||||
#
|
|
||||||
# Copying and distribution of this file, with or without modification, are
|
|
||||||
# permitted in any medium without royalty provided the copyright notice
|
|
||||||
# and this notice are preserved. This file is offered as-is, without any
|
|
||||||
# warranty.
|
|
||||||
|
|
||||||
#serial 14
|
|
||||||
|
|
||||||
AU_ALIAS([AC_JNI_INCLUDE_DIR], [AX_JNI_INCLUDE_DIR])
|
|
||||||
AC_DEFUN([AX_JNI_INCLUDE_DIR],[
|
|
||||||
|
|
||||||
JNI_INCLUDE_DIRS=""
|
|
||||||
|
|
||||||
if test "x$JAVA_HOME" != x; then
|
|
||||||
_JTOPDIR="$JAVA_HOME"
|
|
||||||
else
|
|
||||||
if test "x$JAVAC" = x; then
|
|
||||||
JAVAC=javac
|
|
||||||
fi
|
|
||||||
AC_PATH_PROG([_ACJNI_JAVAC], [$JAVAC], [no])
|
|
||||||
if test "x$_ACJNI_JAVAC" = xno; then
|
|
||||||
AC_MSG_WARN([cannot find JDK; try setting \$JAVAC or \$JAVA_HOME])
|
|
||||||
fi
|
|
||||||
_ACJNI_FOLLOW_SYMLINKS("$_ACJNI_JAVAC")
|
|
||||||
_JTOPDIR=`echo "$_ACJNI_FOLLOWED" | sed -e 's://*:/:g' -e 's:/[[^/]]*$::'`
|
|
||||||
fi
|
|
||||||
|
|
||||||
case "$host_os" in
|
|
||||||
darwin*) # Apple Java headers are inside the Xcode bundle.
|
|
||||||
macos_version=$(sw_vers -productVersion | sed -n -e 's/^@<:@0-9@:>@*.\(@<:@0-9@:>@*\).@<:@0-9@:>@*/\1/p')
|
|
||||||
if @<:@ "$macos_version" -gt "7" @:>@; then
|
|
||||||
_JTOPDIR="$(xcrun --show-sdk-path)/System/Library/Frameworks/JavaVM.framework"
|
|
||||||
_JINC="$_JTOPDIR/Headers"
|
|
||||||
else
|
|
||||||
_JTOPDIR="/System/Library/Frameworks/JavaVM.framework"
|
|
||||||
_JINC="$_JTOPDIR/Headers"
|
|
||||||
fi
|
|
||||||
;;
|
|
||||||
*) _JINC="$_JTOPDIR/include";;
|
|
||||||
esac
|
|
||||||
_AS_ECHO_LOG([_JTOPDIR=$_JTOPDIR])
|
|
||||||
_AS_ECHO_LOG([_JINC=$_JINC])
|
|
||||||
|
|
||||||
# On Mac OS X 10.6.4, jni.h is a symlink:
|
|
||||||
# /System/Library/Frameworks/JavaVM.framework/Versions/Current/Headers/jni.h
|
|
||||||
# -> ../../CurrentJDK/Headers/jni.h.
|
|
||||||
AC_CACHE_CHECK(jni headers, ac_cv_jni_header_path,
|
|
||||||
[
|
|
||||||
if test -f "$_JINC/jni.h"; then
|
|
||||||
ac_cv_jni_header_path="$_JINC"
|
|
||||||
JNI_INCLUDE_DIRS="$JNI_INCLUDE_DIRS $ac_cv_jni_header_path"
|
|
||||||
else
|
|
||||||
_JTOPDIR=`echo "$_JTOPDIR" | sed -e 's:/[[^/]]*$::'`
|
|
||||||
if test -f "$_JTOPDIR/include/jni.h"; then
|
|
||||||
ac_cv_jni_header_path="$_JTOPDIR/include"
|
|
||||||
JNI_INCLUDE_DIRS="$JNI_INCLUDE_DIRS $ac_cv_jni_header_path"
|
|
||||||
else
|
|
||||||
ac_cv_jni_header_path=none
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
])
|
|
||||||
|
|
||||||
# get the likely subdirectories for system specific java includes
|
|
||||||
case "$host_os" in
|
|
||||||
bsdi*) _JNI_INC_SUBDIRS="bsdos";;
|
|
||||||
freebsd*) _JNI_INC_SUBDIRS="freebsd";;
|
|
||||||
darwin*) _JNI_INC_SUBDIRS="darwin";;
|
|
||||||
linux*) _JNI_INC_SUBDIRS="linux genunix";;
|
|
||||||
osf*) _JNI_INC_SUBDIRS="alpha";;
|
|
||||||
solaris*) _JNI_INC_SUBDIRS="solaris";;
|
|
||||||
mingw*) _JNI_INC_SUBDIRS="win32";;
|
|
||||||
cygwin*) _JNI_INC_SUBDIRS="win32";;
|
|
||||||
*) _JNI_INC_SUBDIRS="genunix";;
|
|
||||||
esac
|
|
||||||
|
|
||||||
if test "x$ac_cv_jni_header_path" != "xnone"; then
|
|
||||||
# add any subdirectories that are present
|
|
||||||
for JINCSUBDIR in $_JNI_INC_SUBDIRS
|
|
||||||
do
|
|
||||||
if test -d "$_JTOPDIR/include/$JINCSUBDIR"; then
|
|
||||||
JNI_INCLUDE_DIRS="$JNI_INCLUDE_DIRS $_JTOPDIR/include/$JINCSUBDIR"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
])
|
|
||||||
|
|
||||||
# _ACJNI_FOLLOW_SYMLINKS <path>
|
|
||||||
# Follows symbolic links on <path>,
|
|
||||||
# finally setting variable _ACJNI_FOLLOWED
|
|
||||||
# ----------------------------------------
|
|
||||||
AC_DEFUN([_ACJNI_FOLLOW_SYMLINKS],[
|
|
||||||
# find the include directory relative to the javac executable
|
|
||||||
_cur="$1"
|
|
||||||
while ls -ld "$_cur" 2>/dev/null | grep " -> " >/dev/null; do
|
|
||||||
AC_MSG_CHECKING([symlink for $_cur])
|
|
||||||
_slink=`ls -ld "$_cur" | sed 's/.* -> //'`
|
|
||||||
case "$_slink" in
|
|
||||||
/*) _cur="$_slink";;
|
|
||||||
# 'X' avoids triggering unwanted echo options.
|
|
||||||
*) _cur=`echo "X$_cur" | sed -e 's/^X//' -e 's:[[^/]]*$::'`"$_slink";;
|
|
||||||
esac
|
|
||||||
AC_MSG_RESULT([$_cur])
|
|
||||||
done
|
|
||||||
_ACJNI_FOLLOWED="$_cur"
|
|
||||||
])# _ACJNI
|
|
||||||
@ -1,125 +0,0 @@
|
|||||||
# ===========================================================================
|
|
||||||
# http://www.gnu.org/software/autoconf-archive/ax_prog_cc_for_build.html
|
|
||||||
# ===========================================================================
|
|
||||||
#
|
|
||||||
# SYNOPSIS
|
|
||||||
#
|
|
||||||
# AX_PROG_CC_FOR_BUILD
|
|
||||||
#
|
|
||||||
# DESCRIPTION
|
|
||||||
#
|
|
||||||
# This macro searches for a C compiler that generates native executables,
|
|
||||||
# that is a C compiler that surely is not a cross-compiler. This can be
|
|
||||||
# useful if you have to generate source code at compile-time like for
|
|
||||||
# example GCC does.
|
|
||||||
#
|
|
||||||
# The macro sets the CC_FOR_BUILD and CPP_FOR_BUILD macros to anything
|
|
||||||
# needed to compile or link (CC_FOR_BUILD) and preprocess (CPP_FOR_BUILD).
|
|
||||||
# The value of these variables can be overridden by the user by specifying
|
|
||||||
# a compiler with an environment variable (like you do for standard CC).
|
|
||||||
#
|
|
||||||
# It also sets BUILD_EXEEXT and BUILD_OBJEXT to the executable and object
|
|
||||||
# file extensions for the build platform, and GCC_FOR_BUILD to `yes' if
|
|
||||||
# the compiler we found is GCC. All these variables but GCC_FOR_BUILD are
|
|
||||||
# substituted in the Makefile.
|
|
||||||
#
|
|
||||||
# LICENSE
|
|
||||||
#
|
|
||||||
# Copyright (c) 2008 Paolo Bonzini <bonzini@gnu.org>
|
|
||||||
#
|
|
||||||
# Copying and distribution of this file, with or without modification, are
|
|
||||||
# permitted in any medium without royalty provided the copyright notice
|
|
||||||
# and this notice are preserved. This file is offered as-is, without any
|
|
||||||
# warranty.
|
|
||||||
|
|
||||||
#serial 8
|
|
||||||
|
|
||||||
AU_ALIAS([AC_PROG_CC_FOR_BUILD], [AX_PROG_CC_FOR_BUILD])
|
|
||||||
AC_DEFUN([AX_PROG_CC_FOR_BUILD], [dnl
|
|
||||||
AC_REQUIRE([AC_PROG_CC])dnl
|
|
||||||
AC_REQUIRE([AC_PROG_CPP])dnl
|
|
||||||
AC_REQUIRE([AC_EXEEXT])dnl
|
|
||||||
AC_REQUIRE([AC_CANONICAL_HOST])dnl
|
|
||||||
|
|
||||||
dnl Use the standard macros, but make them use other variable names
|
|
||||||
dnl
|
|
||||||
pushdef([ac_cv_prog_CPP], ac_cv_build_prog_CPP)dnl
|
|
||||||
pushdef([ac_cv_prog_gcc], ac_cv_build_prog_gcc)dnl
|
|
||||||
pushdef([ac_cv_prog_cc_works], ac_cv_build_prog_cc_works)dnl
|
|
||||||
pushdef([ac_cv_prog_cc_cross], ac_cv_build_prog_cc_cross)dnl
|
|
||||||
pushdef([ac_cv_prog_cc_g], ac_cv_build_prog_cc_g)dnl
|
|
||||||
pushdef([ac_cv_exeext], ac_cv_build_exeext)dnl
|
|
||||||
pushdef([ac_cv_objext], ac_cv_build_objext)dnl
|
|
||||||
pushdef([ac_exeext], ac_build_exeext)dnl
|
|
||||||
pushdef([ac_objext], ac_build_objext)dnl
|
|
||||||
pushdef([CC], CC_FOR_BUILD)dnl
|
|
||||||
pushdef([CPP], CPP_FOR_BUILD)dnl
|
|
||||||
pushdef([CFLAGS], CFLAGS_FOR_BUILD)dnl
|
|
||||||
pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl
|
|
||||||
pushdef([LDFLAGS], LDFLAGS_FOR_BUILD)dnl
|
|
||||||
pushdef([host], build)dnl
|
|
||||||
pushdef([host_alias], build_alias)dnl
|
|
||||||
pushdef([host_cpu], build_cpu)dnl
|
|
||||||
pushdef([host_vendor], build_vendor)dnl
|
|
||||||
pushdef([host_os], build_os)dnl
|
|
||||||
pushdef([ac_cv_host], ac_cv_build)dnl
|
|
||||||
pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl
|
|
||||||
pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl
|
|
||||||
pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl
|
|
||||||
pushdef([ac_cv_host_os], ac_cv_build_os)dnl
|
|
||||||
pushdef([ac_cpp], ac_build_cpp)dnl
|
|
||||||
pushdef([ac_compile], ac_build_compile)dnl
|
|
||||||
pushdef([ac_link], ac_build_link)dnl
|
|
||||||
|
|
||||||
save_cross_compiling=$cross_compiling
|
|
||||||
save_ac_tool_prefix=$ac_tool_prefix
|
|
||||||
cross_compiling=no
|
|
||||||
ac_tool_prefix=
|
|
||||||
|
|
||||||
AC_PROG_CC
|
|
||||||
AC_PROG_CPP
|
|
||||||
AC_EXEEXT
|
|
||||||
|
|
||||||
ac_tool_prefix=$save_ac_tool_prefix
|
|
||||||
cross_compiling=$save_cross_compiling
|
|
||||||
|
|
||||||
dnl Restore the old definitions
|
|
||||||
dnl
|
|
||||||
popdef([ac_link])dnl
|
|
||||||
popdef([ac_compile])dnl
|
|
||||||
popdef([ac_cpp])dnl
|
|
||||||
popdef([ac_cv_host_os])dnl
|
|
||||||
popdef([ac_cv_host_vendor])dnl
|
|
||||||
popdef([ac_cv_host_cpu])dnl
|
|
||||||
popdef([ac_cv_host_alias])dnl
|
|
||||||
popdef([ac_cv_host])dnl
|
|
||||||
popdef([host_os])dnl
|
|
||||||
popdef([host_vendor])dnl
|
|
||||||
popdef([host_cpu])dnl
|
|
||||||
popdef([host_alias])dnl
|
|
||||||
popdef([host])dnl
|
|
||||||
popdef([LDFLAGS])dnl
|
|
||||||
popdef([CPPFLAGS])dnl
|
|
||||||
popdef([CFLAGS])dnl
|
|
||||||
popdef([CPP])dnl
|
|
||||||
popdef([CC])dnl
|
|
||||||
popdef([ac_objext])dnl
|
|
||||||
popdef([ac_exeext])dnl
|
|
||||||
popdef([ac_cv_objext])dnl
|
|
||||||
popdef([ac_cv_exeext])dnl
|
|
||||||
popdef([ac_cv_prog_cc_g])dnl
|
|
||||||
popdef([ac_cv_prog_cc_cross])dnl
|
|
||||||
popdef([ac_cv_prog_cc_works])dnl
|
|
||||||
popdef([ac_cv_prog_gcc])dnl
|
|
||||||
popdef([ac_cv_prog_CPP])dnl
|
|
||||||
|
|
||||||
dnl Finally, set Makefile variables
|
|
||||||
dnl
|
|
||||||
BUILD_EXEEXT=$ac_build_exeext
|
|
||||||
BUILD_OBJEXT=$ac_build_objext
|
|
||||||
AC_SUBST(BUILD_EXEEXT)dnl
|
|
||||||
AC_SUBST(BUILD_OBJEXT)dnl
|
|
||||||
AC_SUBST([CFLAGS_FOR_BUILD])dnl
|
|
||||||
AC_SUBST([CPPFLAGS_FOR_BUILD])dnl
|
|
||||||
AC_SUBST([LDFLAGS_FOR_BUILD])dnl
|
|
||||||
])
|
|
||||||
@ -1,68 +0,0 @@
|
|||||||
dnl libsecp25k1 helper checks
|
|
||||||
AC_DEFUN([SECP_INT128_CHECK],[
|
|
||||||
has_int128=$ac_cv_type___int128
|
|
||||||
])
|
|
||||||
|
|
||||||
dnl escape "$0x" below using the m4 quadrigaph @S|@, and escape it again with a \ for the shell.
|
|
||||||
AC_DEFUN([SECP_64BIT_ASM_CHECK],[
|
|
||||||
AC_MSG_CHECKING(for x86_64 assembly availability)
|
|
||||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
|
|
||||||
#include <stdint.h>]],[[
|
|
||||||
uint64_t a = 11, tmp;
|
|
||||||
__asm__ __volatile__("movq \@S|@0x100000000,%1; mulq %%rsi" : "+a"(a) : "S"(tmp) : "cc", "%rdx");
|
|
||||||
]])],[has_64bit_asm=yes],[has_64bit_asm=no])
|
|
||||||
AC_MSG_RESULT([$has_64bit_asm])
|
|
||||||
])
|
|
||||||
|
|
||||||
dnl
|
|
||||||
AC_DEFUN([SECP_OPENSSL_CHECK],[
|
|
||||||
has_libcrypto=no
|
|
||||||
m4_ifdef([PKG_CHECK_MODULES],[
|
|
||||||
PKG_CHECK_MODULES([CRYPTO], [libcrypto], [has_libcrypto=yes],[has_libcrypto=no])
|
|
||||||
if test x"$has_libcrypto" = x"yes"; then
|
|
||||||
TEMP_LIBS="$LIBS"
|
|
||||||
LIBS="$LIBS $CRYPTO_LIBS"
|
|
||||||
AC_CHECK_LIB(crypto, main,[AC_DEFINE(HAVE_LIBCRYPTO,1,[Define this symbol if libcrypto is installed])],[has_libcrypto=no])
|
|
||||||
LIBS="$TEMP_LIBS"
|
|
||||||
fi
|
|
||||||
])
|
|
||||||
if test x$has_libcrypto = xno; then
|
|
||||||
AC_CHECK_HEADER(openssl/crypto.h,[
|
|
||||||
AC_CHECK_LIB(crypto, main,[
|
|
||||||
has_libcrypto=yes
|
|
||||||
CRYPTO_LIBS=-lcrypto
|
|
||||||
AC_DEFINE(HAVE_LIBCRYPTO,1,[Define this symbol if libcrypto is installed])
|
|
||||||
])
|
|
||||||
])
|
|
||||||
LIBS=
|
|
||||||
fi
|
|
||||||
if test x"$has_libcrypto" = x"yes" && test x"$has_openssl_ec" = x; then
|
|
||||||
AC_MSG_CHECKING(for EC functions in libcrypto)
|
|
||||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
|
|
||||||
#include <openssl/ec.h>
|
|
||||||
#include <openssl/ecdsa.h>
|
|
||||||
#include <openssl/obj_mac.h>]],[[
|
|
||||||
EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_secp256k1);
|
|
||||||
ECDSA_sign(0, NULL, 0, NULL, NULL, eckey);
|
|
||||||
ECDSA_verify(0, NULL, 0, NULL, 0, eckey);
|
|
||||||
EC_KEY_free(eckey);
|
|
||||||
ECDSA_SIG *sig_openssl;
|
|
||||||
sig_openssl = ECDSA_SIG_new();
|
|
||||||
ECDSA_SIG_free(sig_openssl);
|
|
||||||
]])],[has_openssl_ec=yes],[has_openssl_ec=no])
|
|
||||||
AC_MSG_RESULT([$has_openssl_ec])
|
|
||||||
fi
|
|
||||||
])
|
|
||||||
|
|
||||||
dnl
|
|
||||||
AC_DEFUN([SECP_GMP_CHECK],[
|
|
||||||
if test x"$has_gmp" != x"yes"; then
|
|
||||||
CPPFLAGS_TEMP="$CPPFLAGS"
|
|
||||||
CPPFLAGS="$GMP_CPPFLAGS $CPPFLAGS"
|
|
||||||
LIBS_TEMP="$LIBS"
|
|
||||||
LIBS="$GMP_LIBS $LIBS"
|
|
||||||
AC_CHECK_HEADER(gmp.h,[AC_CHECK_LIB(gmp, __gmpz_init,[has_gmp=yes; GMP_LIBS="$GMP_LIBS -lgmp"; AC_DEFINE(HAVE_LIBGMP,1,[Define this symbol if libgmp is installed])])])
|
|
||||||
CPPFLAGS="$CPPFLAGS_TEMP"
|
|
||||||
LIBS="$LIBS_TEMP"
|
|
||||||
fi
|
|
||||||
])
|
|
||||||
@ -1,150 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#include <string.h>
|
|
||||||
#include <secp256k1.h>
|
|
||||||
|
|
||||||
#include "lax_der_parsing.h"
|
|
||||||
|
|
||||||
int ecdsa_signature_parse_der_lax(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
|
|
||||||
size_t rpos, rlen, spos, slen;
|
|
||||||
size_t pos = 0;
|
|
||||||
size_t lenbyte;
|
|
||||||
unsigned char tmpsig[64] = {0};
|
|
||||||
int overflow = 0;
|
|
||||||
|
|
||||||
/* Hack to initialize sig with a correctly-parsed but invalid signature. */
|
|
||||||
secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
|
|
||||||
|
|
||||||
/* Sequence tag byte */
|
|
||||||
if (pos == inputlen || input[pos] != 0x30) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
pos++;
|
|
||||||
|
|
||||||
/* Sequence length bytes */
|
|
||||||
if (pos == inputlen) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
lenbyte = input[pos++];
|
|
||||||
if (lenbyte & 0x80) {
|
|
||||||
lenbyte -= 0x80;
|
|
||||||
if (lenbyte > inputlen - pos) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
pos += lenbyte;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Integer tag byte for R */
|
|
||||||
if (pos == inputlen || input[pos] != 0x02) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
pos++;
|
|
||||||
|
|
||||||
/* Integer length for R */
|
|
||||||
if (pos == inputlen) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
lenbyte = input[pos++];
|
|
||||||
if (lenbyte & 0x80) {
|
|
||||||
lenbyte -= 0x80;
|
|
||||||
if (lenbyte > inputlen - pos) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
while (lenbyte > 0 && input[pos] == 0) {
|
|
||||||
pos++;
|
|
||||||
lenbyte--;
|
|
||||||
}
|
|
||||||
if (lenbyte >= sizeof(size_t)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
rlen = 0;
|
|
||||||
while (lenbyte > 0) {
|
|
||||||
rlen = (rlen << 8) + input[pos];
|
|
||||||
pos++;
|
|
||||||
lenbyte--;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
rlen = lenbyte;
|
|
||||||
}
|
|
||||||
if (rlen > inputlen - pos) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
rpos = pos;
|
|
||||||
pos += rlen;
|
|
||||||
|
|
||||||
/* Integer tag byte for S */
|
|
||||||
if (pos == inputlen || input[pos] != 0x02) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
pos++;
|
|
||||||
|
|
||||||
/* Integer length for S */
|
|
||||||
if (pos == inputlen) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
lenbyte = input[pos++];
|
|
||||||
if (lenbyte & 0x80) {
|
|
||||||
lenbyte -= 0x80;
|
|
||||||
if (lenbyte > inputlen - pos) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
while (lenbyte > 0 && input[pos] == 0) {
|
|
||||||
pos++;
|
|
||||||
lenbyte--;
|
|
||||||
}
|
|
||||||
if (lenbyte >= sizeof(size_t)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
slen = 0;
|
|
||||||
while (lenbyte > 0) {
|
|
||||||
slen = (slen << 8) + input[pos];
|
|
||||||
pos++;
|
|
||||||
lenbyte--;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
slen = lenbyte;
|
|
||||||
}
|
|
||||||
if (slen > inputlen - pos) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
spos = pos;
|
|
||||||
pos += slen;
|
|
||||||
|
|
||||||
/* Ignore leading zeroes in R */
|
|
||||||
while (rlen > 0 && input[rpos] == 0) {
|
|
||||||
rlen--;
|
|
||||||
rpos++;
|
|
||||||
}
|
|
||||||
/* Copy R value */
|
|
||||||
if (rlen > 32) {
|
|
||||||
overflow = 1;
|
|
||||||
} else {
|
|
||||||
memcpy(tmpsig + 32 - rlen, input + rpos, rlen);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Ignore leading zeroes in S */
|
|
||||||
while (slen > 0 && input[spos] == 0) {
|
|
||||||
slen--;
|
|
||||||
spos++;
|
|
||||||
}
|
|
||||||
/* Copy S value */
|
|
||||||
if (slen > 32) {
|
|
||||||
overflow = 1;
|
|
||||||
} else {
|
|
||||||
memcpy(tmpsig + 64 - slen, input + spos, slen);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!overflow) {
|
|
||||||
overflow = !secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
|
|
||||||
}
|
|
||||||
if (overflow) {
|
|
||||||
memset(tmpsig, 0, 64);
|
|
||||||
secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -1,91 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
/****
|
|
||||||
* Please do not link this file directly. It is not part of the libsecp256k1
|
|
||||||
* project and does not promise any stability in its API, functionality or
|
|
||||||
* presence. Projects which use this code should instead copy this header
|
|
||||||
* and its accompanying .c file directly into their codebase.
|
|
||||||
****/
|
|
||||||
|
|
||||||
/* This file defines a function that parses DER with various errors and
|
|
||||||
* violations. This is not a part of the library itself, because the allowed
|
|
||||||
* violations are chosen arbitrarily and do not follow or establish any
|
|
||||||
* standard.
|
|
||||||
*
|
|
||||||
* In many places it matters that different implementations do not only accept
|
|
||||||
* the same set of valid signatures, but also reject the same set of signatures.
|
|
||||||
* The only means to accomplish that is by strictly obeying a standard, and not
|
|
||||||
* accepting anything else.
|
|
||||||
*
|
|
||||||
* Nonetheless, sometimes there is a need for compatibility with systems that
|
|
||||||
* use signatures which do not strictly obey DER. The snippet below shows how
|
|
||||||
* certain violations are easily supported. You may need to adapt it.
|
|
||||||
*
|
|
||||||
* Do not use this for new systems. Use well-defined DER or compact signatures
|
|
||||||
* instead if you have the choice (see secp256k1_ecdsa_signature_parse_der and
|
|
||||||
* secp256k1_ecdsa_signature_parse_compact).
|
|
||||||
*
|
|
||||||
* The supported violations are:
|
|
||||||
* - All numbers are parsed as nonnegative integers, even though X.609-0207
|
|
||||||
* section 8.3.3 specifies that integers are always encoded as two's
|
|
||||||
* complement.
|
|
||||||
* - Integers can have length 0, even though section 8.3.1 says they can't.
|
|
||||||
* - Integers with overly long padding are accepted, violation section
|
|
||||||
* 8.3.2.
|
|
||||||
* - 127-byte long length descriptors are accepted, even though section
|
|
||||||
* 8.1.3.5.c says that they are not.
|
|
||||||
* - Trailing garbage data inside or after the signature is ignored.
|
|
||||||
* - The length descriptor of the sequence is ignored.
|
|
||||||
*
|
|
||||||
* Compared to for example OpenSSL, many violations are NOT supported:
|
|
||||||
* - Using overly long tag descriptors for the sequence or integers inside,
|
|
||||||
* violating section 8.1.2.2.
|
|
||||||
* - Encoding primitive integers as constructed values, violating section
|
|
||||||
* 8.3.1.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_CONTRIB_LAX_DER_PARSING_H
|
|
||||||
#define SECP256K1_CONTRIB_LAX_DER_PARSING_H
|
|
||||||
|
|
||||||
#include <secp256k1.h>
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
extern "C" {
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Parse a signature in "lax DER" format
|
|
||||||
*
|
|
||||||
* Returns: 1 when the signature could be parsed, 0 otherwise.
|
|
||||||
* Args: ctx: a secp256k1 context object
|
|
||||||
* Out: sig: a pointer to a signature object
|
|
||||||
* In: input: a pointer to the signature to be parsed
|
|
||||||
* inputlen: the length of the array pointed to be input
|
|
||||||
*
|
|
||||||
* This function will accept any valid DER encoded signature, even if the
|
|
||||||
* encoded numbers are out of range. In addition, it will accept signatures
|
|
||||||
* which violate the DER spec in various ways. Its purpose is to allow
|
|
||||||
* validation of the Bitcoin blockchain, which includes non-DER signatures
|
|
||||||
* from before the network rules were updated to enforce DER. Note that
|
|
||||||
* the set of supported violations is a strict subset of what OpenSSL will
|
|
||||||
* accept.
|
|
||||||
*
|
|
||||||
* After the call, sig will always be initialized. If parsing failed or the
|
|
||||||
* encoded numbers are out of range, signature validation with it is
|
|
||||||
* guaranteed to fail for every message and public key.
|
|
||||||
*/
|
|
||||||
int ecdsa_signature_parse_der_lax(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
secp256k1_ecdsa_signature* sig,
|
|
||||||
const unsigned char *input,
|
|
||||||
size_t inputlen
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_CONTRIB_LAX_DER_PARSING_H */
|
|
||||||
@ -1,113 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014, 2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#include <string.h>
|
|
||||||
#include <secp256k1.h>
|
|
||||||
|
|
||||||
#include "lax_der_privatekey_parsing.h"
|
|
||||||
|
|
||||||
int ec_privkey_import_der(const secp256k1_context* ctx, unsigned char *out32, const unsigned char *privkey, size_t privkeylen) {
|
|
||||||
const unsigned char *end = privkey + privkeylen;
|
|
||||||
int lenb = 0;
|
|
||||||
int len = 0;
|
|
||||||
memset(out32, 0, 32);
|
|
||||||
/* sequence header */
|
|
||||||
if (end < privkey+1 || *privkey != 0x30) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
privkey++;
|
|
||||||
/* sequence length constructor */
|
|
||||||
if (end < privkey+1 || !(*privkey & 0x80)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
lenb = *privkey & ~0x80; privkey++;
|
|
||||||
if (lenb < 1 || lenb > 2) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (end < privkey+lenb) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
/* sequence length */
|
|
||||||
len = privkey[lenb-1] | (lenb > 1 ? privkey[lenb-2] << 8 : 0);
|
|
||||||
privkey += lenb;
|
|
||||||
if (end < privkey+len) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
/* sequence element 0: version number (=1) */
|
|
||||||
if (end < privkey+3 || privkey[0] != 0x02 || privkey[1] != 0x01 || privkey[2] != 0x01) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
privkey += 3;
|
|
||||||
/* sequence element 1: octet string, up to 32 bytes */
|
|
||||||
if (end < privkey+2 || privkey[0] != 0x04 || privkey[1] > 0x20 || end < privkey+2+privkey[1]) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
memcpy(out32 + 32 - privkey[1], privkey + 2, privkey[1]);
|
|
||||||
if (!secp256k1_ec_seckey_verify(ctx, out32)) {
|
|
||||||
memset(out32, 0, 32);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
int ec_privkey_export_der(const secp256k1_context *ctx, unsigned char *privkey, size_t *privkeylen, const unsigned char *key32, int compressed) {
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
size_t pubkeylen = 0;
|
|
||||||
if (!secp256k1_ec_pubkey_create(ctx, &pubkey, key32)) {
|
|
||||||
*privkeylen = 0;
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (compressed) {
|
|
||||||
static const unsigned char begin[] = {
|
|
||||||
0x30,0x81,0xD3,0x02,0x01,0x01,0x04,0x20
|
|
||||||
};
|
|
||||||
static const unsigned char middle[] = {
|
|
||||||
0xA0,0x81,0x85,0x30,0x81,0x82,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
|
|
||||||
0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
|
|
||||||
0x21,0x02,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
|
|
||||||
0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
|
|
||||||
0x17,0x98,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
|
|
||||||
0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x24,0x03,0x22,0x00
|
|
||||||
};
|
|
||||||
unsigned char *ptr = privkey;
|
|
||||||
memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
|
|
||||||
memcpy(ptr, key32, 32); ptr += 32;
|
|
||||||
memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
|
|
||||||
pubkeylen = 33;
|
|
||||||
secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
|
|
||||||
ptr += pubkeylen;
|
|
||||||
*privkeylen = ptr - privkey;
|
|
||||||
} else {
|
|
||||||
static const unsigned char begin[] = {
|
|
||||||
0x30,0x82,0x01,0x13,0x02,0x01,0x01,0x04,0x20
|
|
||||||
};
|
|
||||||
static const unsigned char middle[] = {
|
|
||||||
0xA0,0x81,0xA5,0x30,0x81,0xA2,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
|
|
||||||
0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
|
|
||||||
0x41,0x04,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
|
|
||||||
0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
|
|
||||||
0x17,0x98,0x48,0x3A,0xDA,0x77,0x26,0xA3,0xC4,0x65,0x5D,0xA4,0xFB,0xFC,0x0E,0x11,
|
|
||||||
0x08,0xA8,0xFD,0x17,0xB4,0x48,0xA6,0x85,0x54,0x19,0x9C,0x47,0xD0,0x8F,0xFB,0x10,
|
|
||||||
0xD4,0xB8,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
|
|
||||||
0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x44,0x03,0x42,0x00
|
|
||||||
};
|
|
||||||
unsigned char *ptr = privkey;
|
|
||||||
memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
|
|
||||||
memcpy(ptr, key32, 32); ptr += 32;
|
|
||||||
memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
|
|
||||||
pubkeylen = 65;
|
|
||||||
secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
|
|
||||||
ptr += pubkeylen;
|
|
||||||
*privkeylen = ptr - privkey;
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
@ -1,90 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014, 2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
/****
|
|
||||||
* Please do not link this file directly. It is not part of the libsecp256k1
|
|
||||||
* project and does not promise any stability in its API, functionality or
|
|
||||||
* presence. Projects which use this code should instead copy this header
|
|
||||||
* and its accompanying .c file directly into their codebase.
|
|
||||||
****/
|
|
||||||
|
|
||||||
/* This file contains code snippets that parse DER private keys with
|
|
||||||
* various errors and violations. This is not a part of the library
|
|
||||||
* itself, because the allowed violations are chosen arbitrarily and
|
|
||||||
* do not follow or establish any standard.
|
|
||||||
*
|
|
||||||
* It also contains code to serialize private keys in a compatible
|
|
||||||
* manner.
|
|
||||||
*
|
|
||||||
* These functions are meant for compatibility with applications
|
|
||||||
* that require BER encoded keys. When working with secp256k1-specific
|
|
||||||
* code, the simple 32-byte private keys normally used by the
|
|
||||||
* library are sufficient.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_CONTRIB_BER_PRIVATEKEY_H
|
|
||||||
#define SECP256K1_CONTRIB_BER_PRIVATEKEY_H
|
|
||||||
|
|
||||||
#include <secp256k1.h>
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
extern "C" {
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Export a private key in DER format.
|
|
||||||
*
|
|
||||||
* Returns: 1 if the private key was valid.
|
|
||||||
* Args: ctx: pointer to a context object, initialized for signing (cannot
|
|
||||||
* be NULL)
|
|
||||||
* Out: privkey: pointer to an array for storing the private key in BER.
|
|
||||||
* Should have space for 279 bytes, and cannot be NULL.
|
|
||||||
* privkeylen: Pointer to an int where the length of the private key in
|
|
||||||
* privkey will be stored.
|
|
||||||
* In: seckey: pointer to a 32-byte secret key to export.
|
|
||||||
* compressed: 1 if the key should be exported in
|
|
||||||
* compressed format, 0 otherwise
|
|
||||||
*
|
|
||||||
* This function is purely meant for compatibility with applications that
|
|
||||||
* require BER encoded keys. When working with secp256k1-specific code, the
|
|
||||||
* simple 32-byte private keys are sufficient.
|
|
||||||
*
|
|
||||||
* Note that this function does not guarantee correct DER output. It is
|
|
||||||
* guaranteed to be parsable by secp256k1_ec_privkey_import_der
|
|
||||||
*/
|
|
||||||
SECP256K1_WARN_UNUSED_RESULT int ec_privkey_export_der(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
unsigned char *privkey,
|
|
||||||
size_t *privkeylen,
|
|
||||||
const unsigned char *seckey,
|
|
||||||
int compressed
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
|
|
||||||
|
|
||||||
/** Import a private key in DER format.
|
|
||||||
* Returns: 1 if a private key was extracted.
|
|
||||||
* Args: ctx: pointer to a context object (cannot be NULL).
|
|
||||||
* Out: seckey: pointer to a 32-byte array for storing the private key.
|
|
||||||
* (cannot be NULL).
|
|
||||||
* In: privkey: pointer to a private key in DER format (cannot be NULL).
|
|
||||||
* privkeylen: length of the DER private key pointed to be privkey.
|
|
||||||
*
|
|
||||||
* This function will accept more than just strict DER, and even allow some BER
|
|
||||||
* violations. The public key stored inside the DER-encoded private key is not
|
|
||||||
* verified for correctness, nor are the curve parameters. Use this function
|
|
||||||
* only if you know in advance it is supposed to contain a secp256k1 private
|
|
||||||
* key.
|
|
||||||
*/
|
|
||||||
SECP256K1_WARN_UNUSED_RESULT int ec_privkey_import_der(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
unsigned char *seckey,
|
|
||||||
const unsigned char *privkey,
|
|
||||||
size_t privkeylen
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_CONTRIB_BER_PRIVATEKEY_H */
|
|
||||||
@ -1,55 +0,0 @@
|
|||||||
#ifndef SECP256K1_ECDH_H
|
|
||||||
#define SECP256K1_ECDH_H
|
|
||||||
|
|
||||||
#include "secp256k1.h"
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
extern "C" {
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** A pointer to a function that applies hash function to a point
|
|
||||||
*
|
|
||||||
* Returns: 1 if a point was successfully hashed. 0 will cause ecdh to fail
|
|
||||||
* Out: output: pointer to an array to be filled by the function
|
|
||||||
* In: x: pointer to a 32-byte x coordinate
|
|
||||||
* y: pointer to a 32-byte y coordinate
|
|
||||||
* data: Arbitrary data pointer that is passed through
|
|
||||||
*/
|
|
||||||
typedef int (*secp256k1_ecdh_hash_function)(
|
|
||||||
unsigned char *output,
|
|
||||||
const unsigned char *x,
|
|
||||||
const unsigned char *y,
|
|
||||||
void *data
|
|
||||||
);
|
|
||||||
|
|
||||||
/** An implementation of SHA256 hash function that applies to compressed public key. */
|
|
||||||
SECP256K1_API extern const secp256k1_ecdh_hash_function secp256k1_ecdh_hash_function_sha256;
|
|
||||||
|
|
||||||
/** A default ecdh hash function (currently equal to secp256k1_ecdh_hash_function_sha256). */
|
|
||||||
SECP256K1_API extern const secp256k1_ecdh_hash_function secp256k1_ecdh_hash_function_default;
|
|
||||||
|
|
||||||
/** Compute an EC Diffie-Hellman secret in constant time
|
|
||||||
* Returns: 1: exponentiation was successful
|
|
||||||
* 0: scalar was invalid (zero or overflow)
|
|
||||||
* Args: ctx: pointer to a context object (cannot be NULL)
|
|
||||||
* Out: output: pointer to an array to be filled by the function
|
|
||||||
* In: pubkey: a pointer to a secp256k1_pubkey containing an
|
|
||||||
* initialized public key
|
|
||||||
* privkey: a 32-byte scalar with which to multiply the point
|
|
||||||
* hashfp: pointer to a hash function. If NULL, secp256k1_ecdh_hash_function_sha256 is used
|
|
||||||
* data: Arbitrary data pointer that is passed through
|
|
||||||
*/
|
|
||||||
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdh(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
unsigned char *output,
|
|
||||||
const secp256k1_pubkey *pubkey,
|
|
||||||
const unsigned char *privkey,
|
|
||||||
secp256k1_ecdh_hash_function hashfp,
|
|
||||||
void *data
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECDH_H */
|
|
||||||
@ -1,128 +0,0 @@
|
|||||||
#ifndef SECP256K1_PREALLOCATED_H
|
|
||||||
#define SECP256K1_PREALLOCATED_H
|
|
||||||
|
|
||||||
#include "secp256k1.h"
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
extern "C" {
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* The module provided by this header file is intended for settings in which it
|
|
||||||
* is not possible or desirable to rely on dynamic memory allocation. It provides
|
|
||||||
* functions for creating, cloning, and destroying secp256k1 context objects in a
|
|
||||||
* contiguous fixed-size block of memory provided by the caller.
|
|
||||||
*
|
|
||||||
* Context objects created by functions in this module can be used like contexts
|
|
||||||
* objects created by functions in secp256k1.h, i.e., they can be passed to any
|
|
||||||
* API function that expects a context object (see secp256k1.h for details). The
|
|
||||||
* only exception is that context objects created by functions in this module
|
|
||||||
* must be destroyed using secp256k1_context_preallocated_destroy (in this
|
|
||||||
* module) instead of secp256k1_context_destroy (in secp256k1.h).
|
|
||||||
*
|
|
||||||
* It is guaranteed that functions in this module will not call malloc or its
|
|
||||||
* friends realloc, calloc, and free.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/** Determine the memory size of a secp256k1 context object to be created in
|
|
||||||
* caller-provided memory.
|
|
||||||
*
|
|
||||||
* The purpose of this function is to determine how much memory must be provided
|
|
||||||
* to secp256k1_context_preallocated_create.
|
|
||||||
*
|
|
||||||
* Returns: the required size of the caller-provided memory block
|
|
||||||
* In: flags: which parts of the context to initialize.
|
|
||||||
*/
|
|
||||||
SECP256K1_API size_t secp256k1_context_preallocated_size(
|
|
||||||
unsigned int flags
|
|
||||||
) SECP256K1_WARN_UNUSED_RESULT;
|
|
||||||
|
|
||||||
/** Create a secp256k1 context object in caller-provided memory.
|
|
||||||
*
|
|
||||||
* The caller must provide a pointer to a rewritable contiguous block of memory
|
|
||||||
* of size at least secp256k1_context_preallocated_size(flags) bytes, suitably
|
|
||||||
* aligned to hold an object of any type.
|
|
||||||
*
|
|
||||||
* The block of memory is exclusively owned by the created context object during
|
|
||||||
* the lifetime of this context object, which begins with the call to this
|
|
||||||
* function and ends when a call to secp256k1_context_preallocated_destroy
|
|
||||||
* (which destroys the context object again) returns. During the lifetime of the
|
|
||||||
* context object, the caller is obligated not to access this block of memory,
|
|
||||||
* i.e., the caller may not read or write the memory, e.g., by copying the memory
|
|
||||||
* contents to a different location or trying to create a second context object
|
|
||||||
* in the memory. In simpler words, the prealloc pointer (or any pointer derived
|
|
||||||
* from it) should not be used during the lifetime of the context object.
|
|
||||||
*
|
|
||||||
* Returns: a newly created context object.
|
|
||||||
* In: prealloc: a pointer to a rewritable contiguous block of memory of
|
|
||||||
* size at least secp256k1_context_preallocated_size(flags)
|
|
||||||
* bytes, as detailed above (cannot be NULL)
|
|
||||||
* flags: which parts of the context to initialize.
|
|
||||||
*
|
|
||||||
* See also secp256k1_context_randomize (in secp256k1.h)
|
|
||||||
* and secp256k1_context_preallocated_destroy.
|
|
||||||
*/
|
|
||||||
SECP256K1_API secp256k1_context* secp256k1_context_preallocated_create(
|
|
||||||
void* prealloc,
|
|
||||||
unsigned int flags
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
|
|
||||||
|
|
||||||
/** Determine the memory size of a secp256k1 context object to be copied into
|
|
||||||
* caller-provided memory.
|
|
||||||
*
|
|
||||||
* Returns: the required size of the caller-provided memory block.
|
|
||||||
* In: ctx: an existing context to copy (cannot be NULL)
|
|
||||||
*/
|
|
||||||
SECP256K1_API size_t secp256k1_context_preallocated_clone_size(
|
|
||||||
const secp256k1_context* ctx
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
|
|
||||||
|
|
||||||
/** Copy a secp256k1 context object into caller-provided memory.
|
|
||||||
*
|
|
||||||
* The caller must provide a pointer to a rewritable contiguous block of memory
|
|
||||||
* of size at least secp256k1_context_preallocated_size(flags) bytes, suitably
|
|
||||||
* aligned to hold an object of any type.
|
|
||||||
*
|
|
||||||
* The block of memory is exclusively owned by the created context object during
|
|
||||||
* the lifetime of this context object, see the description of
|
|
||||||
* secp256k1_context_preallocated_create for details.
|
|
||||||
*
|
|
||||||
* Returns: a newly created context object.
|
|
||||||
* Args: ctx: an existing context to copy (cannot be NULL)
|
|
||||||
* In: prealloc: a pointer to a rewritable contiguous block of memory of
|
|
||||||
* size at least secp256k1_context_preallocated_size(flags)
|
|
||||||
* bytes, as detailed above (cannot be NULL)
|
|
||||||
*/
|
|
||||||
SECP256K1_API secp256k1_context* secp256k1_context_preallocated_clone(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
void* prealloc
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_WARN_UNUSED_RESULT;
|
|
||||||
|
|
||||||
/** Destroy a secp256k1 context object that has been created in
|
|
||||||
* caller-provided memory.
|
|
||||||
*
|
|
||||||
* The context pointer may not be used afterwards.
|
|
||||||
*
|
|
||||||
* The context to destroy must have been created using
|
|
||||||
* secp256k1_context_preallocated_create or secp256k1_context_preallocated_clone.
|
|
||||||
* If the context has instead been created using secp256k1_context_create or
|
|
||||||
* secp256k1_context_clone, the behaviour is undefined. In that case,
|
|
||||||
* secp256k1_context_destroy must be used instead.
|
|
||||||
*
|
|
||||||
* If required, it is the responsibility of the caller to deallocate the block
|
|
||||||
* of memory properly after this function returns, e.g., by calling free on the
|
|
||||||
* preallocated pointer given to secp256k1_context_preallocated_create or
|
|
||||||
* secp256k1_context_preallocated_clone.
|
|
||||||
*
|
|
||||||
* Args: ctx: an existing context to destroy, constructed using
|
|
||||||
* secp256k1_context_preallocated_create or
|
|
||||||
* secp256k1_context_preallocated_clone (cannot be NULL)
|
|
||||||
*/
|
|
||||||
SECP256K1_API void secp256k1_context_preallocated_destroy(
|
|
||||||
secp256k1_context* ctx
|
|
||||||
);
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_PREALLOCATED_H */
|
|
||||||
@ -1,110 +0,0 @@
|
|||||||
#ifndef SECP256K1_RECOVERY_H
|
|
||||||
#define SECP256K1_RECOVERY_H
|
|
||||||
|
|
||||||
#include "secp256k1.h"
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
extern "C" {
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Opaque data structured that holds a parsed ECDSA signature,
|
|
||||||
* supporting pubkey recovery.
|
|
||||||
*
|
|
||||||
* The exact representation of data inside is implementation defined and not
|
|
||||||
* guaranteed to be portable between different platforms or versions. It is
|
|
||||||
* however guaranteed to be 65 bytes in size, and can be safely copied/moved.
|
|
||||||
* If you need to convert to a format suitable for storage or transmission, use
|
|
||||||
* the secp256k1_ecdsa_signature_serialize_* and
|
|
||||||
* secp256k1_ecdsa_signature_parse_* functions.
|
|
||||||
*
|
|
||||||
* Furthermore, it is guaranteed that identical signatures (including their
|
|
||||||
* recoverability) will have identical representation, so they can be
|
|
||||||
* memcmp'ed.
|
|
||||||
*/
|
|
||||||
typedef struct {
|
|
||||||
unsigned char data[65];
|
|
||||||
} secp256k1_ecdsa_recoverable_signature;
|
|
||||||
|
|
||||||
/** Parse a compact ECDSA signature (64 bytes + recovery id).
|
|
||||||
*
|
|
||||||
* Returns: 1 when the signature could be parsed, 0 otherwise
|
|
||||||
* Args: ctx: a secp256k1 context object
|
|
||||||
* Out: sig: a pointer to a signature object
|
|
||||||
* In: input64: a pointer to a 64-byte compact signature
|
|
||||||
* recid: the recovery id (0, 1, 2 or 3)
|
|
||||||
*/
|
|
||||||
SECP256K1_API int secp256k1_ecdsa_recoverable_signature_parse_compact(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
secp256k1_ecdsa_recoverable_signature* sig,
|
|
||||||
const unsigned char *input64,
|
|
||||||
int recid
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
|
|
||||||
|
|
||||||
/** Convert a recoverable signature into a normal signature.
|
|
||||||
*
|
|
||||||
* Returns: 1
|
|
||||||
* Out: sig: a pointer to a normal signature (cannot be NULL).
|
|
||||||
* In: sigin: a pointer to a recoverable signature (cannot be NULL).
|
|
||||||
*/
|
|
||||||
SECP256K1_API int secp256k1_ecdsa_recoverable_signature_convert(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
secp256k1_ecdsa_signature* sig,
|
|
||||||
const secp256k1_ecdsa_recoverable_signature* sigin
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
|
|
||||||
|
|
||||||
/** Serialize an ECDSA signature in compact format (64 bytes + recovery id).
|
|
||||||
*
|
|
||||||
* Returns: 1
|
|
||||||
* Args: ctx: a secp256k1 context object
|
|
||||||
* Out: output64: a pointer to a 64-byte array of the compact signature (cannot be NULL)
|
|
||||||
* recid: a pointer to an integer to hold the recovery id (can be NULL).
|
|
||||||
* In: sig: a pointer to an initialized signature object (cannot be NULL)
|
|
||||||
*/
|
|
||||||
SECP256K1_API int secp256k1_ecdsa_recoverable_signature_serialize_compact(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
unsigned char *output64,
|
|
||||||
int *recid,
|
|
||||||
const secp256k1_ecdsa_recoverable_signature* sig
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
|
|
||||||
|
|
||||||
/** Create a recoverable ECDSA signature.
|
|
||||||
*
|
|
||||||
* Returns: 1: signature created
|
|
||||||
* 0: the nonce generation function failed, or the private key was invalid.
|
|
||||||
* Args: ctx: pointer to a context object, initialized for signing (cannot be NULL)
|
|
||||||
* Out: sig: pointer to an array where the signature will be placed (cannot be NULL)
|
|
||||||
* In: msg32: the 32-byte message hash being signed (cannot be NULL)
|
|
||||||
* seckey: pointer to a 32-byte secret key (cannot be NULL)
|
|
||||||
* noncefp:pointer to a nonce generation function. If NULL, secp256k1_nonce_function_default is used
|
|
||||||
* ndata: pointer to arbitrary data used by the nonce generation function (can be NULL)
|
|
||||||
*/
|
|
||||||
SECP256K1_API int secp256k1_ecdsa_sign_recoverable(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
secp256k1_ecdsa_recoverable_signature *sig,
|
|
||||||
const unsigned char *msg32,
|
|
||||||
const unsigned char *seckey,
|
|
||||||
secp256k1_nonce_function noncefp,
|
|
||||||
const void *ndata
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
|
|
||||||
|
|
||||||
/** Recover an ECDSA public key from a signature.
|
|
||||||
*
|
|
||||||
* Returns: 1: public key successfully recovered (which guarantees a correct signature).
|
|
||||||
* 0: otherwise.
|
|
||||||
* Args: ctx: pointer to a context object, initialized for verification (cannot be NULL)
|
|
||||||
* Out: pubkey: pointer to the recovered public key (cannot be NULL)
|
|
||||||
* In: sig: pointer to initialized signature that supports pubkey recovery (cannot be NULL)
|
|
||||||
* msg32: the 32-byte message hash assumed to be signed (cannot be NULL)
|
|
||||||
*/
|
|
||||||
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_recover(
|
|
||||||
const secp256k1_context* ctx,
|
|
||||||
secp256k1_pubkey *pubkey,
|
|
||||||
const secp256k1_ecdsa_recoverable_signature *sig,
|
|
||||||
const unsigned char *msg32
|
|
||||||
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_RECOVERY_H */
|
|
||||||
@ -1,13 +0,0 @@
|
|||||||
prefix=@prefix@
|
|
||||||
exec_prefix=@exec_prefix@
|
|
||||||
libdir=@libdir@
|
|
||||||
includedir=@includedir@
|
|
||||||
|
|
||||||
Name: libsecp256k1
|
|
||||||
Description: Optimized C library for EC operations on curve secp256k1
|
|
||||||
URL: https://github.com/bitcoin-core/secp256k1
|
|
||||||
Version: @PACKAGE_VERSION@
|
|
||||||
Cflags: -I${includedir}
|
|
||||||
Libs: -L${libdir} -lsecp256k1
|
|
||||||
Libs.private: @SECP_LIBS@
|
|
||||||
|
|
||||||
@ -1,322 +0,0 @@
|
|||||||
# This code supports verifying group implementations which have branches
|
|
||||||
# or conditional statements (like cmovs), by allowing each execution path
|
|
||||||
# to independently set assumptions on input or intermediary variables.
|
|
||||||
#
|
|
||||||
# The general approach is:
|
|
||||||
# * A constraint is a tuple of two sets of symbolic expressions:
|
|
||||||
# the first of which are required to evaluate to zero, the second of which
|
|
||||||
# are required to evaluate to nonzero.
|
|
||||||
# - A constraint is said to be conflicting if any of its nonzero expressions
|
|
||||||
# is in the ideal with basis the zero expressions (in other words: when the
|
|
||||||
# zero expressions imply that one of the nonzero expressions are zero).
|
|
||||||
# * There is a list of laws that describe the intended behaviour, including
|
|
||||||
# laws for addition and doubling. Each law is called with the symbolic point
|
|
||||||
# coordinates as arguments, and returns:
|
|
||||||
# - A constraint describing the assumptions under which it is applicable,
|
|
||||||
# called "assumeLaw"
|
|
||||||
# - A constraint describing the requirements of the law, called "require"
|
|
||||||
# * Implementations are transliterated into functions that operate as well on
|
|
||||||
# algebraic input points, and are called once per combination of branches
|
|
||||||
# executed. Each execution returns:
|
|
||||||
# - A constraint describing the assumptions this implementation requires
|
|
||||||
# (such as Z1=1), called "assumeFormula"
|
|
||||||
# - A constraint describing the assumptions this specific branch requires,
|
|
||||||
# but which is by construction guaranteed to cover the entire space by
|
|
||||||
# merging the results from all branches, called "assumeBranch"
|
|
||||||
# - The result of the computation
|
|
||||||
# * All combinations of laws with implementation branches are tried, and:
|
|
||||||
# - If the combination of assumeLaw, assumeFormula, and assumeBranch results
|
|
||||||
# in a conflict, it means this law does not apply to this branch, and it is
|
|
||||||
# skipped.
|
|
||||||
# - For others, we try to prove the require constraints hold, assuming the
|
|
||||||
# information in assumeLaw + assumeFormula + assumeBranch, and if this does
|
|
||||||
# not succeed, we fail.
|
|
||||||
# + To prove an expression is zero, we check whether it belongs to the
|
|
||||||
# ideal with the assumed zero expressions as basis. This test is exact.
|
|
||||||
# + To prove an expression is nonzero, we check whether each of its
|
|
||||||
# factors is contained in the set of nonzero assumptions' factors.
|
|
||||||
# This test is not exact, so various combinations of original and
|
|
||||||
# reduced expressions' factors are tried.
|
|
||||||
# - If we succeed, we print out the assumptions from assumeFormula that
|
|
||||||
# weren't implied by assumeLaw already. Those from assumeBranch are skipped,
|
|
||||||
# as we assume that all constraints in it are complementary with each other.
|
|
||||||
#
|
|
||||||
# Based on the sage verification scripts used in the Explicit-Formulas Database
|
|
||||||
# by Tanja Lange and others, see http://hyperelliptic.org/EFD
|
|
||||||
|
|
||||||
class fastfrac:
|
|
||||||
"""Fractions over rings."""
|
|
||||||
|
|
||||||
def __init__(self,R,top,bot=1):
|
|
||||||
"""Construct a fractional, given a ring, a numerator, and denominator."""
|
|
||||||
self.R = R
|
|
||||||
if parent(top) == ZZ or parent(top) == R:
|
|
||||||
self.top = R(top)
|
|
||||||
self.bot = R(bot)
|
|
||||||
elif top.__class__ == fastfrac:
|
|
||||||
self.top = top.top
|
|
||||||
self.bot = top.bot * bot
|
|
||||||
else:
|
|
||||||
self.top = R(numerator(top))
|
|
||||||
self.bot = R(denominator(top)) * bot
|
|
||||||
|
|
||||||
def iszero(self,I):
|
|
||||||
"""Return whether this fraction is zero given an ideal."""
|
|
||||||
return self.top in I and self.bot not in I
|
|
||||||
|
|
||||||
def reduce(self,assumeZero):
|
|
||||||
zero = self.R.ideal(map(numerator, assumeZero))
|
|
||||||
return fastfrac(self.R, zero.reduce(self.top)) / fastfrac(self.R, zero.reduce(self.bot))
|
|
||||||
|
|
||||||
def __add__(self,other):
|
|
||||||
"""Add two fractions."""
|
|
||||||
if parent(other) == ZZ:
|
|
||||||
return fastfrac(self.R,self.top + self.bot * other,self.bot)
|
|
||||||
if other.__class__ == fastfrac:
|
|
||||||
return fastfrac(self.R,self.top * other.bot + self.bot * other.top,self.bot * other.bot)
|
|
||||||
return NotImplemented
|
|
||||||
|
|
||||||
def __sub__(self,other):
|
|
||||||
"""Subtract two fractions."""
|
|
||||||
if parent(other) == ZZ:
|
|
||||||
return fastfrac(self.R,self.top - self.bot * other,self.bot)
|
|
||||||
if other.__class__ == fastfrac:
|
|
||||||
return fastfrac(self.R,self.top * other.bot - self.bot * other.top,self.bot * other.bot)
|
|
||||||
return NotImplemented
|
|
||||||
|
|
||||||
def __neg__(self):
|
|
||||||
"""Return the negation of a fraction."""
|
|
||||||
return fastfrac(self.R,-self.top,self.bot)
|
|
||||||
|
|
||||||
def __mul__(self,other):
|
|
||||||
"""Multiply two fractions."""
|
|
||||||
if parent(other) == ZZ:
|
|
||||||
return fastfrac(self.R,self.top * other,self.bot)
|
|
||||||
if other.__class__ == fastfrac:
|
|
||||||
return fastfrac(self.R,self.top * other.top,self.bot * other.bot)
|
|
||||||
return NotImplemented
|
|
||||||
|
|
||||||
def __rmul__(self,other):
|
|
||||||
"""Multiply something else with a fraction."""
|
|
||||||
return self.__mul__(other)
|
|
||||||
|
|
||||||
def __div__(self,other):
|
|
||||||
"""Divide two fractions."""
|
|
||||||
if parent(other) == ZZ:
|
|
||||||
return fastfrac(self.R,self.top,self.bot * other)
|
|
||||||
if other.__class__ == fastfrac:
|
|
||||||
return fastfrac(self.R,self.top * other.bot,self.bot * other.top)
|
|
||||||
return NotImplemented
|
|
||||||
|
|
||||||
def __pow__(self,other):
|
|
||||||
"""Compute a power of a fraction."""
|
|
||||||
if parent(other) == ZZ:
|
|
||||||
if other < 0:
|
|
||||||
# Negative powers require flipping top and bottom
|
|
||||||
return fastfrac(self.R,self.bot ^ (-other),self.top ^ (-other))
|
|
||||||
else:
|
|
||||||
return fastfrac(self.R,self.top ^ other,self.bot ^ other)
|
|
||||||
return NotImplemented
|
|
||||||
|
|
||||||
def __str__(self):
|
|
||||||
return "fastfrac((" + str(self.top) + ") / (" + str(self.bot) + "))"
|
|
||||||
def __repr__(self):
|
|
||||||
return "%s" % self
|
|
||||||
|
|
||||||
def numerator(self):
|
|
||||||
return self.top
|
|
||||||
|
|
||||||
class constraints:
|
|
||||||
"""A set of constraints, consisting of zero and nonzero expressions.
|
|
||||||
|
|
||||||
Constraints can either be used to express knowledge or a requirement.
|
|
||||||
|
|
||||||
Both the fields zero and nonzero are maps from expressions to description
|
|
||||||
strings. The expressions that are the keys in zero are required to be zero,
|
|
||||||
and the expressions that are the keys in nonzero are required to be nonzero.
|
|
||||||
|
|
||||||
Note that (a != 0) and (b != 0) is the same as (a*b != 0), so all keys in
|
|
||||||
nonzero could be multiplied into a single key. This is often much less
|
|
||||||
efficient to work with though, so we keep them separate inside the
|
|
||||||
constraints. This allows higher-level code to do fast checks on the individual
|
|
||||||
nonzero elements, or combine them if needed for stronger checks.
|
|
||||||
|
|
||||||
We can't multiply the different zero elements, as it would suffice for one of
|
|
||||||
the factors to be zero, instead of all of them. Instead, the zero elements are
|
|
||||||
typically combined into an ideal first.
|
|
||||||
"""
|
|
||||||
|
|
||||||
def __init__(self, **kwargs):
|
|
||||||
if 'zero' in kwargs:
|
|
||||||
self.zero = dict(kwargs['zero'])
|
|
||||||
else:
|
|
||||||
self.zero = dict()
|
|
||||||
if 'nonzero' in kwargs:
|
|
||||||
self.nonzero = dict(kwargs['nonzero'])
|
|
||||||
else:
|
|
||||||
self.nonzero = dict()
|
|
||||||
|
|
||||||
def negate(self):
|
|
||||||
return constraints(zero=self.nonzero, nonzero=self.zero)
|
|
||||||
|
|
||||||
def __add__(self, other):
|
|
||||||
zero = self.zero.copy()
|
|
||||||
zero.update(other.zero)
|
|
||||||
nonzero = self.nonzero.copy()
|
|
||||||
nonzero.update(other.nonzero)
|
|
||||||
return constraints(zero=zero, nonzero=nonzero)
|
|
||||||
|
|
||||||
def __str__(self):
|
|
||||||
return "constraints(zero=%s,nonzero=%s)" % (self.zero, self.nonzero)
|
|
||||||
|
|
||||||
def __repr__(self):
|
|
||||||
return "%s" % self
|
|
||||||
|
|
||||||
|
|
||||||
def conflicts(R, con):
|
|
||||||
"""Check whether any of the passed non-zero assumptions is implied by the zero assumptions"""
|
|
||||||
zero = R.ideal(map(numerator, con.zero))
|
|
||||||
if 1 in zero:
|
|
||||||
return True
|
|
||||||
# First a cheap check whether any of the individual nonzero terms conflict on
|
|
||||||
# their own.
|
|
||||||
for nonzero in con.nonzero:
|
|
||||||
if nonzero.iszero(zero):
|
|
||||||
return True
|
|
||||||
# It can be the case that entries in the nonzero set do not individually
|
|
||||||
# conflict with the zero set, but their combination does. For example, knowing
|
|
||||||
# that either x or y is zero is equivalent to having x*y in the zero set.
|
|
||||||
# Having x or y individually in the nonzero set is not a conflict, but both
|
|
||||||
# simultaneously is, so that is the right thing to check for.
|
|
||||||
if reduce(lambda a,b: a * b, con.nonzero, fastfrac(R, 1)).iszero(zero):
|
|
||||||
return True
|
|
||||||
return False
|
|
||||||
|
|
||||||
|
|
||||||
def get_nonzero_set(R, assume):
|
|
||||||
"""Calculate a simple set of nonzero expressions"""
|
|
||||||
zero = R.ideal(map(numerator, assume.zero))
|
|
||||||
nonzero = set()
|
|
||||||
for nz in map(numerator, assume.nonzero):
|
|
||||||
for (f,n) in nz.factor():
|
|
||||||
nonzero.add(f)
|
|
||||||
rnz = zero.reduce(nz)
|
|
||||||
for (f,n) in rnz.factor():
|
|
||||||
nonzero.add(f)
|
|
||||||
return nonzero
|
|
||||||
|
|
||||||
|
|
||||||
def prove_nonzero(R, exprs, assume):
|
|
||||||
"""Check whether an expression is provably nonzero, given assumptions"""
|
|
||||||
zero = R.ideal(map(numerator, assume.zero))
|
|
||||||
nonzero = get_nonzero_set(R, assume)
|
|
||||||
expl = set()
|
|
||||||
ok = True
|
|
||||||
for expr in exprs:
|
|
||||||
if numerator(expr) in zero:
|
|
||||||
return (False, [exprs[expr]])
|
|
||||||
allexprs = reduce(lambda a,b: numerator(a)*numerator(b), exprs, 1)
|
|
||||||
for (f, n) in allexprs.factor():
|
|
||||||
if f not in nonzero:
|
|
||||||
ok = False
|
|
||||||
if ok:
|
|
||||||
return (True, None)
|
|
||||||
ok = True
|
|
||||||
for (f, n) in zero.reduce(numerator(allexprs)).factor():
|
|
||||||
if f not in nonzero:
|
|
||||||
ok = False
|
|
||||||
if ok:
|
|
||||||
return (True, None)
|
|
||||||
ok = True
|
|
||||||
for expr in exprs:
|
|
||||||
for (f,n) in numerator(expr).factor():
|
|
||||||
if f not in nonzero:
|
|
||||||
ok = False
|
|
||||||
if ok:
|
|
||||||
return (True, None)
|
|
||||||
ok = True
|
|
||||||
for expr in exprs:
|
|
||||||
for (f,n) in zero.reduce(numerator(expr)).factor():
|
|
||||||
if f not in nonzero:
|
|
||||||
expl.add(exprs[expr])
|
|
||||||
if expl:
|
|
||||||
return (False, list(expl))
|
|
||||||
else:
|
|
||||||
return (True, None)
|
|
||||||
|
|
||||||
|
|
||||||
def prove_zero(R, exprs, assume):
|
|
||||||
"""Check whether all of the passed expressions are provably zero, given assumptions"""
|
|
||||||
r, e = prove_nonzero(R, dict(map(lambda x: (fastfrac(R, x.bot, 1), exprs[x]), exprs)), assume)
|
|
||||||
if not r:
|
|
||||||
return (False, map(lambda x: "Possibly zero denominator: %s" % x, e))
|
|
||||||
zero = R.ideal(map(numerator, assume.zero))
|
|
||||||
nonzero = prod(x for x in assume.nonzero)
|
|
||||||
expl = []
|
|
||||||
for expr in exprs:
|
|
||||||
if not expr.iszero(zero):
|
|
||||||
expl.append(exprs[expr])
|
|
||||||
if not expl:
|
|
||||||
return (True, None)
|
|
||||||
return (False, expl)
|
|
||||||
|
|
||||||
|
|
||||||
def describe_extra(R, assume, assumeExtra):
|
|
||||||
"""Describe what assumptions are added, given existing assumptions"""
|
|
||||||
zerox = assume.zero.copy()
|
|
||||||
zerox.update(assumeExtra.zero)
|
|
||||||
zero = R.ideal(map(numerator, assume.zero))
|
|
||||||
zeroextra = R.ideal(map(numerator, zerox))
|
|
||||||
nonzero = get_nonzero_set(R, assume)
|
|
||||||
ret = set()
|
|
||||||
# Iterate over the extra zero expressions
|
|
||||||
for base in assumeExtra.zero:
|
|
||||||
if base not in zero:
|
|
||||||
add = []
|
|
||||||
for (f, n) in numerator(base).factor():
|
|
||||||
if f not in nonzero:
|
|
||||||
add += ["%s" % f]
|
|
||||||
if add:
|
|
||||||
ret.add((" * ".join(add)) + " = 0 [%s]" % assumeExtra.zero[base])
|
|
||||||
# Iterate over the extra nonzero expressions
|
|
||||||
for nz in assumeExtra.nonzero:
|
|
||||||
nzr = zeroextra.reduce(numerator(nz))
|
|
||||||
if nzr not in zeroextra:
|
|
||||||
for (f,n) in nzr.factor():
|
|
||||||
if zeroextra.reduce(f) not in nonzero:
|
|
||||||
ret.add("%s != 0" % zeroextra.reduce(f))
|
|
||||||
return ", ".join(x for x in ret)
|
|
||||||
|
|
||||||
|
|
||||||
def check_symbolic(R, assumeLaw, assumeAssert, assumeBranch, require):
|
|
||||||
"""Check a set of zero and nonzero requirements, given a set of zero and nonzero assumptions"""
|
|
||||||
assume = assumeLaw + assumeAssert + assumeBranch
|
|
||||||
|
|
||||||
if conflicts(R, assume):
|
|
||||||
# This formula does not apply
|
|
||||||
return None
|
|
||||||
|
|
||||||
describe = describe_extra(R, assumeLaw + assumeBranch, assumeAssert)
|
|
||||||
|
|
||||||
ok, msg = prove_zero(R, require.zero, assume)
|
|
||||||
if not ok:
|
|
||||||
return "FAIL, %s fails (assuming %s)" % (str(msg), describe)
|
|
||||||
|
|
||||||
res, expl = prove_nonzero(R, require.nonzero, assume)
|
|
||||||
if not res:
|
|
||||||
return "FAIL, %s fails (assuming %s)" % (str(expl), describe)
|
|
||||||
|
|
||||||
if describe != "":
|
|
||||||
return "OK (assuming %s)" % describe
|
|
||||||
else:
|
|
||||||
return "OK"
|
|
||||||
|
|
||||||
|
|
||||||
def concrete_verify(c):
|
|
||||||
for k in c.zero:
|
|
||||||
if k != 0:
|
|
||||||
return (False, c.zero[k])
|
|
||||||
for k in c.nonzero:
|
|
||||||
if k == 0:
|
|
||||||
return (False, c.nonzero[k])
|
|
||||||
return (True, None)
|
|
||||||
@ -1,306 +0,0 @@
|
|||||||
# Test libsecp256k1' group operation implementations using prover.sage
|
|
||||||
|
|
||||||
import sys
|
|
||||||
|
|
||||||
load("group_prover.sage")
|
|
||||||
load("weierstrass_prover.sage")
|
|
||||||
|
|
||||||
def formula_secp256k1_gej_double_var(a):
|
|
||||||
"""libsecp256k1's secp256k1_gej_double_var, used by various addition functions"""
|
|
||||||
rz = a.Z * a.Y
|
|
||||||
rz = rz * 2
|
|
||||||
t1 = a.X^2
|
|
||||||
t1 = t1 * 3
|
|
||||||
t2 = t1^2
|
|
||||||
t3 = a.Y^2
|
|
||||||
t3 = t3 * 2
|
|
||||||
t4 = t3^2
|
|
||||||
t4 = t4 * 2
|
|
||||||
t3 = t3 * a.X
|
|
||||||
rx = t3
|
|
||||||
rx = rx * 4
|
|
||||||
rx = -rx
|
|
||||||
rx = rx + t2
|
|
||||||
t2 = -t2
|
|
||||||
t3 = t3 * 6
|
|
||||||
t3 = t3 + t2
|
|
||||||
ry = t1 * t3
|
|
||||||
t2 = -t4
|
|
||||||
ry = ry + t2
|
|
||||||
return jacobianpoint(rx, ry, rz)
|
|
||||||
|
|
||||||
def formula_secp256k1_gej_add_var(branch, a, b):
|
|
||||||
"""libsecp256k1's secp256k1_gej_add_var"""
|
|
||||||
if branch == 0:
|
|
||||||
return (constraints(), constraints(nonzero={a.Infinity : 'a_infinite'}), b)
|
|
||||||
if branch == 1:
|
|
||||||
return (constraints(), constraints(zero={a.Infinity : 'a_finite'}, nonzero={b.Infinity : 'b_infinite'}), a)
|
|
||||||
z22 = b.Z^2
|
|
||||||
z12 = a.Z^2
|
|
||||||
u1 = a.X * z22
|
|
||||||
u2 = b.X * z12
|
|
||||||
s1 = a.Y * z22
|
|
||||||
s1 = s1 * b.Z
|
|
||||||
s2 = b.Y * z12
|
|
||||||
s2 = s2 * a.Z
|
|
||||||
h = -u1
|
|
||||||
h = h + u2
|
|
||||||
i = -s1
|
|
||||||
i = i + s2
|
|
||||||
if branch == 2:
|
|
||||||
r = formula_secp256k1_gej_double_var(a)
|
|
||||||
return (constraints(), constraints(zero={h : 'h=0', i : 'i=0', a.Infinity : 'a_finite', b.Infinity : 'b_finite'}), r)
|
|
||||||
if branch == 3:
|
|
||||||
return (constraints(), constraints(zero={h : 'h=0', a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={i : 'i!=0'}), point_at_infinity())
|
|
||||||
i2 = i^2
|
|
||||||
h2 = h^2
|
|
||||||
h3 = h2 * h
|
|
||||||
h = h * b.Z
|
|
||||||
rz = a.Z * h
|
|
||||||
t = u1 * h2
|
|
||||||
rx = t
|
|
||||||
rx = rx * 2
|
|
||||||
rx = rx + h3
|
|
||||||
rx = -rx
|
|
||||||
rx = rx + i2
|
|
||||||
ry = -rx
|
|
||||||
ry = ry + t
|
|
||||||
ry = ry * i
|
|
||||||
h3 = h3 * s1
|
|
||||||
h3 = -h3
|
|
||||||
ry = ry + h3
|
|
||||||
return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={h : 'h!=0'}), jacobianpoint(rx, ry, rz))
|
|
||||||
|
|
||||||
def formula_secp256k1_gej_add_ge_var(branch, a, b):
|
|
||||||
"""libsecp256k1's secp256k1_gej_add_ge_var, which assume bz==1"""
|
|
||||||
if branch == 0:
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(nonzero={a.Infinity : 'a_infinite'}), b)
|
|
||||||
if branch == 1:
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(zero={a.Infinity : 'a_finite'}, nonzero={b.Infinity : 'b_infinite'}), a)
|
|
||||||
z12 = a.Z^2
|
|
||||||
u1 = a.X
|
|
||||||
u2 = b.X * z12
|
|
||||||
s1 = a.Y
|
|
||||||
s2 = b.Y * z12
|
|
||||||
s2 = s2 * a.Z
|
|
||||||
h = -u1
|
|
||||||
h = h + u2
|
|
||||||
i = -s1
|
|
||||||
i = i + s2
|
|
||||||
if (branch == 2):
|
|
||||||
r = formula_secp256k1_gej_double_var(a)
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0', i : 'i=0'}), r)
|
|
||||||
if (branch == 3):
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0'}, nonzero={i : 'i!=0'}), point_at_infinity())
|
|
||||||
i2 = i^2
|
|
||||||
h2 = h^2
|
|
||||||
h3 = h * h2
|
|
||||||
rz = a.Z * h
|
|
||||||
t = u1 * h2
|
|
||||||
rx = t
|
|
||||||
rx = rx * 2
|
|
||||||
rx = rx + h3
|
|
||||||
rx = -rx
|
|
||||||
rx = rx + i2
|
|
||||||
ry = -rx
|
|
||||||
ry = ry + t
|
|
||||||
ry = ry * i
|
|
||||||
h3 = h3 * s1
|
|
||||||
h3 = -h3
|
|
||||||
ry = ry + h3
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={h : 'h!=0'}), jacobianpoint(rx, ry, rz))
|
|
||||||
|
|
||||||
def formula_secp256k1_gej_add_zinv_var(branch, a, b):
|
|
||||||
"""libsecp256k1's secp256k1_gej_add_zinv_var"""
|
|
||||||
bzinv = b.Z^(-1)
|
|
||||||
if branch == 0:
|
|
||||||
return (constraints(), constraints(nonzero={b.Infinity : 'b_infinite'}), a)
|
|
||||||
if branch == 1:
|
|
||||||
bzinv2 = bzinv^2
|
|
||||||
bzinv3 = bzinv2 * bzinv
|
|
||||||
rx = b.X * bzinv2
|
|
||||||
ry = b.Y * bzinv3
|
|
||||||
rz = 1
|
|
||||||
return (constraints(), constraints(zero={b.Infinity : 'b_finite'}, nonzero={a.Infinity : 'a_infinite'}), jacobianpoint(rx, ry, rz))
|
|
||||||
azz = a.Z * bzinv
|
|
||||||
z12 = azz^2
|
|
||||||
u1 = a.X
|
|
||||||
u2 = b.X * z12
|
|
||||||
s1 = a.Y
|
|
||||||
s2 = b.Y * z12
|
|
||||||
s2 = s2 * azz
|
|
||||||
h = -u1
|
|
||||||
h = h + u2
|
|
||||||
i = -s1
|
|
||||||
i = i + s2
|
|
||||||
if branch == 2:
|
|
||||||
r = formula_secp256k1_gej_double_var(a)
|
|
||||||
return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0', i : 'i=0'}), r)
|
|
||||||
if branch == 3:
|
|
||||||
return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0'}, nonzero={i : 'i!=0'}), point_at_infinity())
|
|
||||||
i2 = i^2
|
|
||||||
h2 = h^2
|
|
||||||
h3 = h * h2
|
|
||||||
rz = a.Z
|
|
||||||
rz = rz * h
|
|
||||||
t = u1 * h2
|
|
||||||
rx = t
|
|
||||||
rx = rx * 2
|
|
||||||
rx = rx + h3
|
|
||||||
rx = -rx
|
|
||||||
rx = rx + i2
|
|
||||||
ry = -rx
|
|
||||||
ry = ry + t
|
|
||||||
ry = ry * i
|
|
||||||
h3 = h3 * s1
|
|
||||||
h3 = -h3
|
|
||||||
ry = ry + h3
|
|
||||||
return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={h : 'h!=0'}), jacobianpoint(rx, ry, rz))
|
|
||||||
|
|
||||||
def formula_secp256k1_gej_add_ge(branch, a, b):
|
|
||||||
"""libsecp256k1's secp256k1_gej_add_ge"""
|
|
||||||
zeroes = {}
|
|
||||||
nonzeroes = {}
|
|
||||||
a_infinity = False
|
|
||||||
if (branch & 4) != 0:
|
|
||||||
nonzeroes.update({a.Infinity : 'a_infinite'})
|
|
||||||
a_infinity = True
|
|
||||||
else:
|
|
||||||
zeroes.update({a.Infinity : 'a_finite'})
|
|
||||||
zz = a.Z^2
|
|
||||||
u1 = a.X
|
|
||||||
u2 = b.X * zz
|
|
||||||
s1 = a.Y
|
|
||||||
s2 = b.Y * zz
|
|
||||||
s2 = s2 * a.Z
|
|
||||||
t = u1
|
|
||||||
t = t + u2
|
|
||||||
m = s1
|
|
||||||
m = m + s2
|
|
||||||
rr = t^2
|
|
||||||
m_alt = -u2
|
|
||||||
tt = u1 * m_alt
|
|
||||||
rr = rr + tt
|
|
||||||
degenerate = (branch & 3) == 3
|
|
||||||
if (branch & 1) != 0:
|
|
||||||
zeroes.update({m : 'm_zero'})
|
|
||||||
else:
|
|
||||||
nonzeroes.update({m : 'm_nonzero'})
|
|
||||||
if (branch & 2) != 0:
|
|
||||||
zeroes.update({rr : 'rr_zero'})
|
|
||||||
else:
|
|
||||||
nonzeroes.update({rr : 'rr_nonzero'})
|
|
||||||
rr_alt = s1
|
|
||||||
rr_alt = rr_alt * 2
|
|
||||||
m_alt = m_alt + u1
|
|
||||||
if not degenerate:
|
|
||||||
rr_alt = rr
|
|
||||||
m_alt = m
|
|
||||||
n = m_alt^2
|
|
||||||
q = n * t
|
|
||||||
n = n^2
|
|
||||||
if degenerate:
|
|
||||||
n = m
|
|
||||||
t = rr_alt^2
|
|
||||||
rz = a.Z * m_alt
|
|
||||||
infinity = False
|
|
||||||
if (branch & 8) != 0:
|
|
||||||
if not a_infinity:
|
|
||||||
infinity = True
|
|
||||||
zeroes.update({rz : 'r.z=0'})
|
|
||||||
else:
|
|
||||||
nonzeroes.update({rz : 'r.z!=0'})
|
|
||||||
rz = rz * 2
|
|
||||||
q = -q
|
|
||||||
t = t + q
|
|
||||||
rx = t
|
|
||||||
t = t * 2
|
|
||||||
t = t + q
|
|
||||||
t = t * rr_alt
|
|
||||||
t = t + n
|
|
||||||
ry = -t
|
|
||||||
rx = rx * 4
|
|
||||||
ry = ry * 4
|
|
||||||
if a_infinity:
|
|
||||||
rx = b.X
|
|
||||||
ry = b.Y
|
|
||||||
rz = 1
|
|
||||||
if infinity:
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1', b.Infinity : 'b_finite'}), constraints(zero=zeroes, nonzero=nonzeroes), point_at_infinity())
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1', b.Infinity : 'b_finite'}), constraints(zero=zeroes, nonzero=nonzeroes), jacobianpoint(rx, ry, rz))
|
|
||||||
|
|
||||||
def formula_secp256k1_gej_add_ge_old(branch, a, b):
|
|
||||||
"""libsecp256k1's old secp256k1_gej_add_ge, which fails when ay+by=0 but ax!=bx"""
|
|
||||||
a_infinity = (branch & 1) != 0
|
|
||||||
zero = {}
|
|
||||||
nonzero = {}
|
|
||||||
if a_infinity:
|
|
||||||
nonzero.update({a.Infinity : 'a_infinite'})
|
|
||||||
else:
|
|
||||||
zero.update({a.Infinity : 'a_finite'})
|
|
||||||
zz = a.Z^2
|
|
||||||
u1 = a.X
|
|
||||||
u2 = b.X * zz
|
|
||||||
s1 = a.Y
|
|
||||||
s2 = b.Y * zz
|
|
||||||
s2 = s2 * a.Z
|
|
||||||
z = a.Z
|
|
||||||
t = u1
|
|
||||||
t = t + u2
|
|
||||||
m = s1
|
|
||||||
m = m + s2
|
|
||||||
n = m^2
|
|
||||||
q = n * t
|
|
||||||
n = n^2
|
|
||||||
rr = t^2
|
|
||||||
t = u1 * u2
|
|
||||||
t = -t
|
|
||||||
rr = rr + t
|
|
||||||
t = rr^2
|
|
||||||
rz = m * z
|
|
||||||
infinity = False
|
|
||||||
if (branch & 2) != 0:
|
|
||||||
if not a_infinity:
|
|
||||||
infinity = True
|
|
||||||
else:
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1', b.Infinity : 'b_finite'}), constraints(nonzero={z : 'conflict_a'}, zero={z : 'conflict_b'}), point_at_infinity())
|
|
||||||
zero.update({rz : 'r.z=0'})
|
|
||||||
else:
|
|
||||||
nonzero.update({rz : 'r.z!=0'})
|
|
||||||
rz = rz * (0 if a_infinity else 2)
|
|
||||||
rx = t
|
|
||||||
q = -q
|
|
||||||
rx = rx + q
|
|
||||||
q = q * 3
|
|
||||||
t = t * 2
|
|
||||||
t = t + q
|
|
||||||
t = t * rr
|
|
||||||
t = t + n
|
|
||||||
ry = -t
|
|
||||||
rx = rx * (0 if a_infinity else 4)
|
|
||||||
ry = ry * (0 if a_infinity else 4)
|
|
||||||
t = b.X
|
|
||||||
t = t * (1 if a_infinity else 0)
|
|
||||||
rx = rx + t
|
|
||||||
t = b.Y
|
|
||||||
t = t * (1 if a_infinity else 0)
|
|
||||||
ry = ry + t
|
|
||||||
t = (1 if a_infinity else 0)
|
|
||||||
rz = rz + t
|
|
||||||
if infinity:
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1', b.Infinity : 'b_finite'}), constraints(zero=zero, nonzero=nonzero), point_at_infinity())
|
|
||||||
return (constraints(zero={b.Z - 1 : 'b.z=1', b.Infinity : 'b_finite'}), constraints(zero=zero, nonzero=nonzero), jacobianpoint(rx, ry, rz))
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
check_symbolic_jacobian_weierstrass("secp256k1_gej_add_var", 0, 7, 5, formula_secp256k1_gej_add_var)
|
|
||||||
check_symbolic_jacobian_weierstrass("secp256k1_gej_add_ge_var", 0, 7, 5, formula_secp256k1_gej_add_ge_var)
|
|
||||||
check_symbolic_jacobian_weierstrass("secp256k1_gej_add_zinv_var", 0, 7, 5, formula_secp256k1_gej_add_zinv_var)
|
|
||||||
check_symbolic_jacobian_weierstrass("secp256k1_gej_add_ge", 0, 7, 16, formula_secp256k1_gej_add_ge)
|
|
||||||
check_symbolic_jacobian_weierstrass("secp256k1_gej_add_ge_old [should fail]", 0, 7, 4, formula_secp256k1_gej_add_ge_old)
|
|
||||||
|
|
||||||
if len(sys.argv) >= 2 and sys.argv[1] == "--exhaustive":
|
|
||||||
check_exhaustive_jacobian_weierstrass("secp256k1_gej_add_var", 0, 7, 5, formula_secp256k1_gej_add_var, 43)
|
|
||||||
check_exhaustive_jacobian_weierstrass("secp256k1_gej_add_ge_var", 0, 7, 5, formula_secp256k1_gej_add_ge_var, 43)
|
|
||||||
check_exhaustive_jacobian_weierstrass("secp256k1_gej_add_zinv_var", 0, 7, 5, formula_secp256k1_gej_add_zinv_var, 43)
|
|
||||||
check_exhaustive_jacobian_weierstrass("secp256k1_gej_add_ge", 0, 7, 16, formula_secp256k1_gej_add_ge, 43)
|
|
||||||
check_exhaustive_jacobian_weierstrass("secp256k1_gej_add_ge_old [should fail]", 0, 7, 4, formula_secp256k1_gej_add_ge_old, 43)
|
|
||||||
@ -1,264 +0,0 @@
|
|||||||
# Prover implementation for Weierstrass curves of the form
|
|
||||||
# y^2 = x^3 + A * x + B, specifically with a = 0 and b = 7, with group laws
|
|
||||||
# operating on affine and Jacobian coordinates, including the point at infinity
|
|
||||||
# represented by a 4th variable in coordinates.
|
|
||||||
|
|
||||||
load("group_prover.sage")
|
|
||||||
|
|
||||||
|
|
||||||
class affinepoint:
|
|
||||||
def __init__(self, x, y, infinity=0):
|
|
||||||
self.x = x
|
|
||||||
self.y = y
|
|
||||||
self.infinity = infinity
|
|
||||||
def __str__(self):
|
|
||||||
return "affinepoint(x=%s,y=%s,inf=%s)" % (self.x, self.y, self.infinity)
|
|
||||||
|
|
||||||
|
|
||||||
class jacobianpoint:
|
|
||||||
def __init__(self, x, y, z, infinity=0):
|
|
||||||
self.X = x
|
|
||||||
self.Y = y
|
|
||||||
self.Z = z
|
|
||||||
self.Infinity = infinity
|
|
||||||
def __str__(self):
|
|
||||||
return "jacobianpoint(X=%s,Y=%s,Z=%s,inf=%s)" % (self.X, self.Y, self.Z, self.Infinity)
|
|
||||||
|
|
||||||
|
|
||||||
def point_at_infinity():
|
|
||||||
return jacobianpoint(1, 1, 1, 1)
|
|
||||||
|
|
||||||
|
|
||||||
def negate(p):
|
|
||||||
if p.__class__ == affinepoint:
|
|
||||||
return affinepoint(p.x, -p.y)
|
|
||||||
if p.__class__ == jacobianpoint:
|
|
||||||
return jacobianpoint(p.X, -p.Y, p.Z)
|
|
||||||
assert(False)
|
|
||||||
|
|
||||||
|
|
||||||
def on_weierstrass_curve(A, B, p):
|
|
||||||
"""Return a set of zero-expressions for an affine point to be on the curve"""
|
|
||||||
return constraints(zero={p.x^3 + A*p.x + B - p.y^2: 'on_curve'})
|
|
||||||
|
|
||||||
|
|
||||||
def tangential_to_weierstrass_curve(A, B, p12, p3):
|
|
||||||
"""Return a set of zero-expressions for ((x12,y12),(x3,y3)) to be a line that is tangential to the curve at (x12,y12)"""
|
|
||||||
return constraints(zero={
|
|
||||||
(p12.y - p3.y) * (p12.y * 2) - (p12.x^2 * 3 + A) * (p12.x - p3.x): 'tangential_to_curve'
|
|
||||||
})
|
|
||||||
|
|
||||||
|
|
||||||
def colinear(p1, p2, p3):
|
|
||||||
"""Return a set of zero-expressions for ((x1,y1),(x2,y2),(x3,y3)) to be collinear"""
|
|
||||||
return constraints(zero={
|
|
||||||
(p1.y - p2.y) * (p1.x - p3.x) - (p1.y - p3.y) * (p1.x - p2.x): 'colinear_1',
|
|
||||||
(p2.y - p3.y) * (p2.x - p1.x) - (p2.y - p1.y) * (p2.x - p3.x): 'colinear_2',
|
|
||||||
(p3.y - p1.y) * (p3.x - p2.x) - (p3.y - p2.y) * (p3.x - p1.x): 'colinear_3'
|
|
||||||
})
|
|
||||||
|
|
||||||
|
|
||||||
def good_affine_point(p):
|
|
||||||
return constraints(nonzero={p.x : 'nonzero_x', p.y : 'nonzero_y'})
|
|
||||||
|
|
||||||
|
|
||||||
def good_jacobian_point(p):
|
|
||||||
return constraints(nonzero={p.X : 'nonzero_X', p.Y : 'nonzero_Y', p.Z^6 : 'nonzero_Z'})
|
|
||||||
|
|
||||||
|
|
||||||
def good_point(p):
|
|
||||||
return constraints(nonzero={p.Z^6 : 'nonzero_X'})
|
|
||||||
|
|
||||||
|
|
||||||
def finite(p, *affine_fns):
|
|
||||||
con = good_point(p) + constraints(zero={p.Infinity : 'finite_point'})
|
|
||||||
if p.Z != 0:
|
|
||||||
return con + reduce(lambda a, b: a + b, (f(affinepoint(p.X / p.Z^2, p.Y / p.Z^3)) for f in affine_fns), con)
|
|
||||||
else:
|
|
||||||
return con
|
|
||||||
|
|
||||||
def infinite(p):
|
|
||||||
return constraints(nonzero={p.Infinity : 'infinite_point'})
|
|
||||||
|
|
||||||
|
|
||||||
def law_jacobian_weierstrass_add(A, B, pa, pb, pA, pB, pC):
|
|
||||||
"""Check whether the passed set of coordinates is a valid Jacobian add, given assumptions"""
|
|
||||||
assumeLaw = (good_affine_point(pa) +
|
|
||||||
good_affine_point(pb) +
|
|
||||||
good_jacobian_point(pA) +
|
|
||||||
good_jacobian_point(pB) +
|
|
||||||
on_weierstrass_curve(A, B, pa) +
|
|
||||||
on_weierstrass_curve(A, B, pb) +
|
|
||||||
finite(pA) +
|
|
||||||
finite(pB) +
|
|
||||||
constraints(nonzero={pa.x - pb.x : 'different_x'}))
|
|
||||||
require = (finite(pC, lambda pc: on_weierstrass_curve(A, B, pc) +
|
|
||||||
colinear(pa, pb, negate(pc))))
|
|
||||||
return (assumeLaw, require)
|
|
||||||
|
|
||||||
|
|
||||||
def law_jacobian_weierstrass_double(A, B, pa, pb, pA, pB, pC):
|
|
||||||
"""Check whether the passed set of coordinates is a valid Jacobian doubling, given assumptions"""
|
|
||||||
assumeLaw = (good_affine_point(pa) +
|
|
||||||
good_affine_point(pb) +
|
|
||||||
good_jacobian_point(pA) +
|
|
||||||
good_jacobian_point(pB) +
|
|
||||||
on_weierstrass_curve(A, B, pa) +
|
|
||||||
on_weierstrass_curve(A, B, pb) +
|
|
||||||
finite(pA) +
|
|
||||||
finite(pB) +
|
|
||||||
constraints(zero={pa.x - pb.x : 'equal_x', pa.y - pb.y : 'equal_y'}))
|
|
||||||
require = (finite(pC, lambda pc: on_weierstrass_curve(A, B, pc) +
|
|
||||||
tangential_to_weierstrass_curve(A, B, pa, negate(pc))))
|
|
||||||
return (assumeLaw, require)
|
|
||||||
|
|
||||||
|
|
||||||
def law_jacobian_weierstrass_add_opposites(A, B, pa, pb, pA, pB, pC):
|
|
||||||
assumeLaw = (good_affine_point(pa) +
|
|
||||||
good_affine_point(pb) +
|
|
||||||
good_jacobian_point(pA) +
|
|
||||||
good_jacobian_point(pB) +
|
|
||||||
on_weierstrass_curve(A, B, pa) +
|
|
||||||
on_weierstrass_curve(A, B, pb) +
|
|
||||||
finite(pA) +
|
|
||||||
finite(pB) +
|
|
||||||
constraints(zero={pa.x - pb.x : 'equal_x', pa.y + pb.y : 'opposite_y'}))
|
|
||||||
require = infinite(pC)
|
|
||||||
return (assumeLaw, require)
|
|
||||||
|
|
||||||
|
|
||||||
def law_jacobian_weierstrass_add_infinite_a(A, B, pa, pb, pA, pB, pC):
|
|
||||||
assumeLaw = (good_affine_point(pa) +
|
|
||||||
good_affine_point(pb) +
|
|
||||||
good_jacobian_point(pA) +
|
|
||||||
good_jacobian_point(pB) +
|
|
||||||
on_weierstrass_curve(A, B, pb) +
|
|
||||||
infinite(pA) +
|
|
||||||
finite(pB))
|
|
||||||
require = finite(pC, lambda pc: constraints(zero={pc.x - pb.x : 'c.x=b.x', pc.y - pb.y : 'c.y=b.y'}))
|
|
||||||
return (assumeLaw, require)
|
|
||||||
|
|
||||||
|
|
||||||
def law_jacobian_weierstrass_add_infinite_b(A, B, pa, pb, pA, pB, pC):
|
|
||||||
assumeLaw = (good_affine_point(pa) +
|
|
||||||
good_affine_point(pb) +
|
|
||||||
good_jacobian_point(pA) +
|
|
||||||
good_jacobian_point(pB) +
|
|
||||||
on_weierstrass_curve(A, B, pa) +
|
|
||||||
infinite(pB) +
|
|
||||||
finite(pA))
|
|
||||||
require = finite(pC, lambda pc: constraints(zero={pc.x - pa.x : 'c.x=a.x', pc.y - pa.y : 'c.y=a.y'}))
|
|
||||||
return (assumeLaw, require)
|
|
||||||
|
|
||||||
|
|
||||||
def law_jacobian_weierstrass_add_infinite_ab(A, B, pa, pb, pA, pB, pC):
|
|
||||||
assumeLaw = (good_affine_point(pa) +
|
|
||||||
good_affine_point(pb) +
|
|
||||||
good_jacobian_point(pA) +
|
|
||||||
good_jacobian_point(pB) +
|
|
||||||
infinite(pA) +
|
|
||||||
infinite(pB))
|
|
||||||
require = infinite(pC)
|
|
||||||
return (assumeLaw, require)
|
|
||||||
|
|
||||||
|
|
||||||
laws_jacobian_weierstrass = {
|
|
||||||
'add': law_jacobian_weierstrass_add,
|
|
||||||
'double': law_jacobian_weierstrass_double,
|
|
||||||
'add_opposite': law_jacobian_weierstrass_add_opposites,
|
|
||||||
'add_infinite_a': law_jacobian_weierstrass_add_infinite_a,
|
|
||||||
'add_infinite_b': law_jacobian_weierstrass_add_infinite_b,
|
|
||||||
'add_infinite_ab': law_jacobian_weierstrass_add_infinite_ab
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
def check_exhaustive_jacobian_weierstrass(name, A, B, branches, formula, p):
|
|
||||||
"""Verify an implementation of addition of Jacobian points on a Weierstrass curve, by executing and validating the result for every possible addition in a prime field"""
|
|
||||||
F = Integers(p)
|
|
||||||
print "Formula %s on Z%i:" % (name, p)
|
|
||||||
points = []
|
|
||||||
for x in xrange(0, p):
|
|
||||||
for y in xrange(0, p):
|
|
||||||
point = affinepoint(F(x), F(y))
|
|
||||||
r, e = concrete_verify(on_weierstrass_curve(A, B, point))
|
|
||||||
if r:
|
|
||||||
points.append(point)
|
|
||||||
|
|
||||||
for za in xrange(1, p):
|
|
||||||
for zb in xrange(1, p):
|
|
||||||
for pa in points:
|
|
||||||
for pb in points:
|
|
||||||
for ia in xrange(2):
|
|
||||||
for ib in xrange(2):
|
|
||||||
pA = jacobianpoint(pa.x * F(za)^2, pa.y * F(za)^3, F(za), ia)
|
|
||||||
pB = jacobianpoint(pb.x * F(zb)^2, pb.y * F(zb)^3, F(zb), ib)
|
|
||||||
for branch in xrange(0, branches):
|
|
||||||
assumeAssert, assumeBranch, pC = formula(branch, pA, pB)
|
|
||||||
pC.X = F(pC.X)
|
|
||||||
pC.Y = F(pC.Y)
|
|
||||||
pC.Z = F(pC.Z)
|
|
||||||
pC.Infinity = F(pC.Infinity)
|
|
||||||
r, e = concrete_verify(assumeAssert + assumeBranch)
|
|
||||||
if r:
|
|
||||||
match = False
|
|
||||||
for key in laws_jacobian_weierstrass:
|
|
||||||
assumeLaw, require = laws_jacobian_weierstrass[key](A, B, pa, pb, pA, pB, pC)
|
|
||||||
r, e = concrete_verify(assumeLaw)
|
|
||||||
if r:
|
|
||||||
if match:
|
|
||||||
print " multiple branches for (%s,%s,%s,%s) + (%s,%s,%s,%s)" % (pA.X, pA.Y, pA.Z, pA.Infinity, pB.X, pB.Y, pB.Z, pB.Infinity)
|
|
||||||
else:
|
|
||||||
match = True
|
|
||||||
r, e = concrete_verify(require)
|
|
||||||
if not r:
|
|
||||||
print " failure in branch %i for (%s,%s,%s,%s) + (%s,%s,%s,%s) = (%s,%s,%s,%s): %s" % (branch, pA.X, pA.Y, pA.Z, pA.Infinity, pB.X, pB.Y, pB.Z, pB.Infinity, pC.X, pC.Y, pC.Z, pC.Infinity, e)
|
|
||||||
print
|
|
||||||
|
|
||||||
|
|
||||||
def check_symbolic_function(R, assumeAssert, assumeBranch, f, A, B, pa, pb, pA, pB, pC):
|
|
||||||
assumeLaw, require = f(A, B, pa, pb, pA, pB, pC)
|
|
||||||
return check_symbolic(R, assumeLaw, assumeAssert, assumeBranch, require)
|
|
||||||
|
|
||||||
def check_symbolic_jacobian_weierstrass(name, A, B, branches, formula):
|
|
||||||
"""Verify an implementation of addition of Jacobian points on a Weierstrass curve symbolically"""
|
|
||||||
R.<ax,bx,ay,by,Az,Bz,Ai,Bi> = PolynomialRing(QQ,8,order='invlex')
|
|
||||||
lift = lambda x: fastfrac(R,x)
|
|
||||||
ax = lift(ax)
|
|
||||||
ay = lift(ay)
|
|
||||||
Az = lift(Az)
|
|
||||||
bx = lift(bx)
|
|
||||||
by = lift(by)
|
|
||||||
Bz = lift(Bz)
|
|
||||||
Ai = lift(Ai)
|
|
||||||
Bi = lift(Bi)
|
|
||||||
|
|
||||||
pa = affinepoint(ax, ay, Ai)
|
|
||||||
pb = affinepoint(bx, by, Bi)
|
|
||||||
pA = jacobianpoint(ax * Az^2, ay * Az^3, Az, Ai)
|
|
||||||
pB = jacobianpoint(bx * Bz^2, by * Bz^3, Bz, Bi)
|
|
||||||
|
|
||||||
res = {}
|
|
||||||
|
|
||||||
for key in laws_jacobian_weierstrass:
|
|
||||||
res[key] = []
|
|
||||||
|
|
||||||
print ("Formula " + name + ":")
|
|
||||||
count = 0
|
|
||||||
for branch in xrange(branches):
|
|
||||||
assumeFormula, assumeBranch, pC = formula(branch, pA, pB)
|
|
||||||
pC.X = lift(pC.X)
|
|
||||||
pC.Y = lift(pC.Y)
|
|
||||||
pC.Z = lift(pC.Z)
|
|
||||||
pC.Infinity = lift(pC.Infinity)
|
|
||||||
|
|
||||||
for key in laws_jacobian_weierstrass:
|
|
||||||
res[key].append((check_symbolic_function(R, assumeFormula, assumeBranch, laws_jacobian_weierstrass[key], A, B, pa, pb, pA, pB, pC), branch))
|
|
||||||
|
|
||||||
for key in res:
|
|
||||||
print " %s:" % key
|
|
||||||
val = res[key]
|
|
||||||
for x in val:
|
|
||||||
if x[0] is not None:
|
|
||||||
print " branch %i: %s" % (x[1], x[0])
|
|
||||||
|
|
||||||
print
|
|
||||||
@ -1,913 +0,0 @@
|
|||||||
@ vim: set tabstop=8 softtabstop=8 shiftwidth=8 noexpandtab syntax=armasm:
|
|
||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Wladimir J. van der Laan *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
/*
|
|
||||||
ARM implementation of field_10x26 inner loops.
|
|
||||||
|
|
||||||
Note:
|
|
||||||
|
|
||||||
- To avoid unnecessary loads and make use of available registers, two
|
|
||||||
'passes' have every time been interleaved, with the odd passes accumulating c' and d'
|
|
||||||
which will be added to c and d respectively in the even passes
|
|
||||||
|
|
||||||
*/
|
|
||||||
|
|
||||||
.syntax unified
|
|
||||||
@ eabi attributes - see readelf -A
|
|
||||||
.eabi_attribute 24, 1 @ Tag_ABI_align_needed = 8-byte
|
|
||||||
.eabi_attribute 25, 1 @ Tag_ABI_align_preserved = 8-byte, except leaf SP
|
|
||||||
.text
|
|
||||||
|
|
||||||
@ Field constants
|
|
||||||
.set field_R0, 0x3d10
|
|
||||||
.set field_R1, 0x400
|
|
||||||
.set field_not_M, 0xfc000000 @ ~M = ~0x3ffffff
|
|
||||||
|
|
||||||
.align 2
|
|
||||||
.global secp256k1_fe_mul_inner
|
|
||||||
.type secp256k1_fe_mul_inner, %function
|
|
||||||
@ Arguments:
|
|
||||||
@ r0 r Restrict: can overlap with a, not with b
|
|
||||||
@ r1 a
|
|
||||||
@ r2 b
|
|
||||||
@ Stack (total 4+10*4 = 44)
|
|
||||||
@ sp + #0 saved 'r' pointer
|
|
||||||
@ sp + #4 + 4*X t0,t1,t2,t3,t4,t5,t6,t7,u8,t9
|
|
||||||
secp256k1_fe_mul_inner:
|
|
||||||
stmfd sp!, {r4, r5, r6, r7, r8, r9, r10, r11, r14}
|
|
||||||
sub sp, sp, #48 @ frame=44 + alignment
|
|
||||||
str r0, [sp, #0] @ save result address, we need it only at the end
|
|
||||||
|
|
||||||
/******************************************
|
|
||||||
* Main computation code.
|
|
||||||
******************************************
|
|
||||||
|
|
||||||
Allocation:
|
|
||||||
r0,r14,r7,r8 scratch
|
|
||||||
r1 a (pointer)
|
|
||||||
r2 b (pointer)
|
|
||||||
r3:r4 c
|
|
||||||
r5:r6 d
|
|
||||||
r11:r12 c'
|
|
||||||
r9:r10 d'
|
|
||||||
|
|
||||||
Note: do not write to r[] here, it may overlap with a[]
|
|
||||||
*/
|
|
||||||
|
|
||||||
/* A - interleaved with B */
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]
|
|
||||||
ldr r8, [r2, #9*4] @ b[9]
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]
|
|
||||||
umull r5, r6, r7, r8 @ d = a[0] * b[9]
|
|
||||||
ldr r14, [r2, #8*4] @ b[8]
|
|
||||||
umull r9, r10, r0, r8 @ d' = a[1] * b[9]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]
|
|
||||||
umlal r5, r6, r0, r14 @ d += a[1] * b[8]
|
|
||||||
ldr r8, [r2, #7*4] @ b[7]
|
|
||||||
umlal r9, r10, r7, r14 @ d' += a[2] * b[8]
|
|
||||||
ldr r0, [r1, #3*4] @ a[3]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[2] * b[7]
|
|
||||||
ldr r14, [r2, #6*4] @ b[6]
|
|
||||||
umlal r9, r10, r0, r8 @ d' += a[3] * b[7]
|
|
||||||
ldr r7, [r1, #4*4] @ a[4]
|
|
||||||
umlal r5, r6, r0, r14 @ d += a[3] * b[6]
|
|
||||||
ldr r8, [r2, #5*4] @ b[5]
|
|
||||||
umlal r9, r10, r7, r14 @ d' += a[4] * b[6]
|
|
||||||
ldr r0, [r1, #5*4] @ a[5]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[4] * b[5]
|
|
||||||
ldr r14, [r2, #4*4] @ b[4]
|
|
||||||
umlal r9, r10, r0, r8 @ d' += a[5] * b[5]
|
|
||||||
ldr r7, [r1, #6*4] @ a[6]
|
|
||||||
umlal r5, r6, r0, r14 @ d += a[5] * b[4]
|
|
||||||
ldr r8, [r2, #3*4] @ b[3]
|
|
||||||
umlal r9, r10, r7, r14 @ d' += a[6] * b[4]
|
|
||||||
ldr r0, [r1, #7*4] @ a[7]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[6] * b[3]
|
|
||||||
ldr r14, [r2, #2*4] @ b[2]
|
|
||||||
umlal r9, r10, r0, r8 @ d' += a[7] * b[3]
|
|
||||||
ldr r7, [r1, #8*4] @ a[8]
|
|
||||||
umlal r5, r6, r0, r14 @ d += a[7] * b[2]
|
|
||||||
ldr r8, [r2, #1*4] @ b[1]
|
|
||||||
umlal r9, r10, r7, r14 @ d' += a[8] * b[2]
|
|
||||||
ldr r0, [r1, #9*4] @ a[9]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[8] * b[1]
|
|
||||||
ldr r14, [r2, #0*4] @ b[0]
|
|
||||||
umlal r9, r10, r0, r8 @ d' += a[9] * b[1]
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]
|
|
||||||
umlal r5, r6, r0, r14 @ d += a[9] * b[0]
|
|
||||||
@ r7,r14 used in B
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ t9 = d & M
|
|
||||||
str r0, [sp, #4 + 4*9]
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
|
|
||||||
/* B */
|
|
||||||
umull r3, r4, r7, r14 @ c = a[0] * b[0]
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u0 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u0 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t0 = c & M
|
|
||||||
str r14, [sp, #4 + 0*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u0 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* C - interleaved with D */
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]
|
|
||||||
ldr r8, [r2, #2*4] @ b[2]
|
|
||||||
ldr r14, [r2, #1*4] @ b[1]
|
|
||||||
umull r11, r12, r7, r8 @ c' = a[0] * b[2]
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[0] * b[1]
|
|
||||||
ldr r8, [r2, #0*4] @ b[0]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[1] * b[1]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[1] * b[0]
|
|
||||||
ldr r14, [r2, #9*4] @ b[9]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[2] * b[0]
|
|
||||||
ldr r0, [r1, #3*4] @ a[3]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[2] * b[9]
|
|
||||||
ldr r8, [r2, #8*4] @ b[8]
|
|
||||||
umull r9, r10, r0, r14 @ d' = a[3] * b[9]
|
|
||||||
ldr r7, [r1, #4*4] @ a[4]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[3] * b[8]
|
|
||||||
ldr r14, [r2, #7*4] @ b[7]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[4] * b[8]
|
|
||||||
ldr r0, [r1, #5*4] @ a[5]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[4] * b[7]
|
|
||||||
ldr r8, [r2, #6*4] @ b[6]
|
|
||||||
umlal r9, r10, r0, r14 @ d' += a[5] * b[7]
|
|
||||||
ldr r7, [r1, #6*4] @ a[6]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[5] * b[6]
|
|
||||||
ldr r14, [r2, #5*4] @ b[5]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[6] * b[6]
|
|
||||||
ldr r0, [r1, #7*4] @ a[7]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[6] * b[5]
|
|
||||||
ldr r8, [r2, #4*4] @ b[4]
|
|
||||||
umlal r9, r10, r0, r14 @ d' += a[7] * b[5]
|
|
||||||
ldr r7, [r1, #8*4] @ a[8]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[7] * b[4]
|
|
||||||
ldr r14, [r2, #3*4] @ b[3]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[8] * b[4]
|
|
||||||
ldr r0, [r1, #9*4] @ a[9]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[8] * b[3]
|
|
||||||
ldr r8, [r2, #2*4] @ b[2]
|
|
||||||
umlal r9, r10, r0, r14 @ d' += a[9] * b[3]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[9] * b[2]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u1 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u1 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t1 = c & M
|
|
||||||
str r14, [sp, #4 + 1*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u1 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* D */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u2 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u2 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t2 = c & M
|
|
||||||
str r14, [sp, #4 + 2*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u2 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* E - interleaved with F */
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]
|
|
||||||
ldr r8, [r2, #4*4] @ b[4]
|
|
||||||
umull r11, r12, r7, r8 @ c' = a[0] * b[4]
|
|
||||||
ldr r8, [r2, #3*4] @ b[3]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[0] * b[3]
|
|
||||||
ldr r7, [r1, #1*4] @ a[1]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[1] * b[3]
|
|
||||||
ldr r8, [r2, #2*4] @ b[2]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[1] * b[2]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[2] * b[2]
|
|
||||||
ldr r8, [r2, #1*4] @ b[1]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[2] * b[1]
|
|
||||||
ldr r7, [r1, #3*4] @ a[3]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[3] * b[1]
|
|
||||||
ldr r8, [r2, #0*4] @ b[0]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[3] * b[0]
|
|
||||||
ldr r7, [r1, #4*4] @ a[4]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[4] * b[0]
|
|
||||||
ldr r8, [r2, #9*4] @ b[9]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[4] * b[9]
|
|
||||||
ldr r7, [r1, #5*4] @ a[5]
|
|
||||||
umull r9, r10, r7, r8 @ d' = a[5] * b[9]
|
|
||||||
ldr r8, [r2, #8*4] @ b[8]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[5] * b[8]
|
|
||||||
ldr r7, [r1, #6*4] @ a[6]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[6] * b[8]
|
|
||||||
ldr r8, [r2, #7*4] @ b[7]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[6] * b[7]
|
|
||||||
ldr r7, [r1, #7*4] @ a[7]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[7] * b[7]
|
|
||||||
ldr r8, [r2, #6*4] @ b[6]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[7] * b[6]
|
|
||||||
ldr r7, [r1, #8*4] @ a[8]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[8] * b[6]
|
|
||||||
ldr r8, [r2, #5*4] @ b[5]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[8] * b[5]
|
|
||||||
ldr r7, [r1, #9*4] @ a[9]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[9] * b[5]
|
|
||||||
ldr r8, [r2, #4*4] @ b[4]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[9] * b[4]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u3 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u3 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t3 = c & M
|
|
||||||
str r14, [sp, #4 + 3*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u3 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* F */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u4 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u4 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t4 = c & M
|
|
||||||
str r14, [sp, #4 + 4*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u4 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* G - interleaved with H */
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]
|
|
||||||
ldr r8, [r2, #6*4] @ b[6]
|
|
||||||
ldr r14, [r2, #5*4] @ b[5]
|
|
||||||
umull r11, r12, r7, r8 @ c' = a[0] * b[6]
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[0] * b[5]
|
|
||||||
ldr r8, [r2, #4*4] @ b[4]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[1] * b[5]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[1] * b[4]
|
|
||||||
ldr r14, [r2, #3*4] @ b[3]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[2] * b[4]
|
|
||||||
ldr r0, [r1, #3*4] @ a[3]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[2] * b[3]
|
|
||||||
ldr r8, [r2, #2*4] @ b[2]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[3] * b[3]
|
|
||||||
ldr r7, [r1, #4*4] @ a[4]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[3] * b[2]
|
|
||||||
ldr r14, [r2, #1*4] @ b[1]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[4] * b[2]
|
|
||||||
ldr r0, [r1, #5*4] @ a[5]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[4] * b[1]
|
|
||||||
ldr r8, [r2, #0*4] @ b[0]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[5] * b[1]
|
|
||||||
ldr r7, [r1, #6*4] @ a[6]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[5] * b[0]
|
|
||||||
ldr r14, [r2, #9*4] @ b[9]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[6] * b[0]
|
|
||||||
ldr r0, [r1, #7*4] @ a[7]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[6] * b[9]
|
|
||||||
ldr r8, [r2, #8*4] @ b[8]
|
|
||||||
umull r9, r10, r0, r14 @ d' = a[7] * b[9]
|
|
||||||
ldr r7, [r1, #8*4] @ a[8]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[7] * b[8]
|
|
||||||
ldr r14, [r2, #7*4] @ b[7]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[8] * b[8]
|
|
||||||
ldr r0, [r1, #9*4] @ a[9]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[8] * b[7]
|
|
||||||
ldr r8, [r2, #6*4] @ b[6]
|
|
||||||
umlal r9, r10, r0, r14 @ d' += a[9] * b[7]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[9] * b[6]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u5 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u5 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t5 = c & M
|
|
||||||
str r14, [sp, #4 + 5*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u5 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* H */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u6 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u6 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t6 = c & M
|
|
||||||
str r14, [sp, #4 + 6*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u6 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* I - interleaved with J */
|
|
||||||
ldr r8, [r2, #8*4] @ b[8]
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]
|
|
||||||
ldr r14, [r2, #7*4] @ b[7]
|
|
||||||
umull r11, r12, r7, r8 @ c' = a[0] * b[8]
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[0] * b[7]
|
|
||||||
ldr r8, [r2, #6*4] @ b[6]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[1] * b[7]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[1] * b[6]
|
|
||||||
ldr r14, [r2, #5*4] @ b[5]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[2] * b[6]
|
|
||||||
ldr r0, [r1, #3*4] @ a[3]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[2] * b[5]
|
|
||||||
ldr r8, [r2, #4*4] @ b[4]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[3] * b[5]
|
|
||||||
ldr r7, [r1, #4*4] @ a[4]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[3] * b[4]
|
|
||||||
ldr r14, [r2, #3*4] @ b[3]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[4] * b[4]
|
|
||||||
ldr r0, [r1, #5*4] @ a[5]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[4] * b[3]
|
|
||||||
ldr r8, [r2, #2*4] @ b[2]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[5] * b[3]
|
|
||||||
ldr r7, [r1, #6*4] @ a[6]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[5] * b[2]
|
|
||||||
ldr r14, [r2, #1*4] @ b[1]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[6] * b[2]
|
|
||||||
ldr r0, [r1, #7*4] @ a[7]
|
|
||||||
umlal r3, r4, r7, r14 @ c += a[6] * b[1]
|
|
||||||
ldr r8, [r2, #0*4] @ b[0]
|
|
||||||
umlal r11, r12, r0, r14 @ c' += a[7] * b[1]
|
|
||||||
ldr r7, [r1, #8*4] @ a[8]
|
|
||||||
umlal r3, r4, r0, r8 @ c += a[7] * b[0]
|
|
||||||
ldr r14, [r2, #9*4] @ b[9]
|
|
||||||
umlal r11, r12, r7, r8 @ c' += a[8] * b[0]
|
|
||||||
ldr r0, [r1, #9*4] @ a[9]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[8] * b[9]
|
|
||||||
ldr r8, [r2, #8*4] @ b[8]
|
|
||||||
umull r9, r10, r0, r14 @ d' = a[9] * b[9]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[9] * b[8]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u7 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u7 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
bic r14, r3, field_not_M @ t7 = c & M
|
|
||||||
str r14, [sp, #4 + 7*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u7 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* J */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u8 = d & M
|
|
||||||
str r0, [sp, #4 + 8*4]
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u8 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/******************************************
|
|
||||||
* compute and write back result
|
|
||||||
******************************************
|
|
||||||
Allocation:
|
|
||||||
r0 r
|
|
||||||
r3:r4 c
|
|
||||||
r5:r6 d
|
|
||||||
r7 t0
|
|
||||||
r8 t1
|
|
||||||
r9 t2
|
|
||||||
r11 u8
|
|
||||||
r12 t9
|
|
||||||
r1,r2,r10,r14 scratch
|
|
||||||
|
|
||||||
Note: do not read from a[] after here, it may overlap with r[]
|
|
||||||
*/
|
|
||||||
ldr r0, [sp, #0]
|
|
||||||
add r1, sp, #4 + 3*4 @ r[3..7] = t3..7, r11=u8, r12=t9
|
|
||||||
ldmia r1, {r2,r7,r8,r9,r10,r11,r12}
|
|
||||||
add r1, r0, #3*4
|
|
||||||
stmia r1, {r2,r7,r8,r9,r10}
|
|
||||||
|
|
||||||
bic r2, r3, field_not_M @ r[8] = c & M
|
|
||||||
str r2, [r0, #8*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u8 * R1
|
|
||||||
umlal r3, r4, r11, r14
|
|
||||||
movw r14, field_R0 @ c += d * R0
|
|
||||||
umlal r3, r4, r5, r14
|
|
||||||
adds r3, r3, r12 @ c += t9
|
|
||||||
adc r4, r4, #0
|
|
||||||
|
|
||||||
add r1, sp, #4 + 0*4 @ r7,r8,r9 = t0,t1,t2
|
|
||||||
ldmia r1, {r7,r8,r9}
|
|
||||||
|
|
||||||
ubfx r2, r3, #0, #22 @ r[9] = c & (M >> 4)
|
|
||||||
str r2, [r0, #9*4]
|
|
||||||
mov r3, r3, lsr #22 @ c >>= 22
|
|
||||||
orr r3, r3, r4, asl #10
|
|
||||||
mov r4, r4, lsr #22
|
|
||||||
movw r14, field_R1 << 4 @ c += d * (R1 << 4)
|
|
||||||
umlal r3, r4, r5, r14
|
|
||||||
|
|
||||||
movw r14, field_R0 >> 4 @ d = c * (R0 >> 4) + t0 (64x64 multiply+add)
|
|
||||||
umull r5, r6, r3, r14 @ d = c.lo * (R0 >> 4)
|
|
||||||
adds r5, r5, r7 @ d.lo += t0
|
|
||||||
mla r6, r14, r4, r6 @ d.hi += c.hi * (R0 >> 4)
|
|
||||||
adc r6, r6, 0 @ d.hi += carry
|
|
||||||
|
|
||||||
bic r2, r5, field_not_M @ r[0] = d & M
|
|
||||||
str r2, [r0, #0*4]
|
|
||||||
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
|
|
||||||
movw r14, field_R1 >> 4 @ d += c * (R1 >> 4) + t1 (64x64 multiply+add)
|
|
||||||
umull r1, r2, r3, r14 @ tmp = c.lo * (R1 >> 4)
|
|
||||||
adds r5, r5, r8 @ d.lo += t1
|
|
||||||
adc r6, r6, #0 @ d.hi += carry
|
|
||||||
adds r5, r5, r1 @ d.lo += tmp.lo
|
|
||||||
mla r2, r14, r4, r2 @ tmp.hi += c.hi * (R1 >> 4)
|
|
||||||
adc r6, r6, r2 @ d.hi += carry + tmp.hi
|
|
||||||
|
|
||||||
bic r2, r5, field_not_M @ r[1] = d & M
|
|
||||||
str r2, [r0, #1*4]
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26 (ignore hi)
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
|
|
||||||
add r5, r5, r9 @ d += t2
|
|
||||||
str r5, [r0, #2*4] @ r[2] = d
|
|
||||||
|
|
||||||
add sp, sp, #48
|
|
||||||
ldmfd sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc}
|
|
||||||
.size secp256k1_fe_mul_inner, .-secp256k1_fe_mul_inner
|
|
||||||
|
|
||||||
.align 2
|
|
||||||
.global secp256k1_fe_sqr_inner
|
|
||||||
.type secp256k1_fe_sqr_inner, %function
|
|
||||||
@ Arguments:
|
|
||||||
@ r0 r Can overlap with a
|
|
||||||
@ r1 a
|
|
||||||
@ Stack (total 4+10*4 = 44)
|
|
||||||
@ sp + #0 saved 'r' pointer
|
|
||||||
@ sp + #4 + 4*X t0,t1,t2,t3,t4,t5,t6,t7,u8,t9
|
|
||||||
secp256k1_fe_sqr_inner:
|
|
||||||
stmfd sp!, {r4, r5, r6, r7, r8, r9, r10, r11, r14}
|
|
||||||
sub sp, sp, #48 @ frame=44 + alignment
|
|
||||||
str r0, [sp, #0] @ save result address, we need it only at the end
|
|
||||||
/******************************************
|
|
||||||
* Main computation code.
|
|
||||||
******************************************
|
|
||||||
|
|
||||||
Allocation:
|
|
||||||
r0,r14,r2,r7,r8 scratch
|
|
||||||
r1 a (pointer)
|
|
||||||
r3:r4 c
|
|
||||||
r5:r6 d
|
|
||||||
r11:r12 c'
|
|
||||||
r9:r10 d'
|
|
||||||
|
|
||||||
Note: do not write to r[] here, it may overlap with a[]
|
|
||||||
*/
|
|
||||||
/* A interleaved with B */
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]*2
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
ldr r14, [r1, #9*4] @ a[9]
|
|
||||||
umull r3, r4, r7, r7 @ c = a[0] * a[0]
|
|
||||||
ldr r8, [r1, #8*4] @ a[8]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
umull r5, r6, r7, r14 @ d = a[0]*2 * a[9]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]*2
|
|
||||||
umull r9, r10, r0, r14 @ d' = a[1]*2 * a[9]
|
|
||||||
ldr r14, [r1, #7*4] @ a[7]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[1]*2 * a[8]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r0, [r1, #3*4] @ a[3]*2
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[2]*2 * a[8]
|
|
||||||
ldr r8, [r1, #6*4] @ a[6]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[2]*2 * a[7]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
ldr r7, [r1, #4*4] @ a[4]*2
|
|
||||||
umlal r9, r10, r0, r14 @ d' += a[3]*2 * a[7]
|
|
||||||
ldr r14, [r1, #5*4] @ a[5]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[3]*2 * a[6]
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[4]*2 * a[6]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[4]*2 * a[5]
|
|
||||||
umlal r9, r10, r14, r14 @ d' += a[5] * a[5]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ t9 = d & M
|
|
||||||
str r0, [sp, #4 + 9*4]
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
|
|
||||||
/* B */
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u0 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u0 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t0 = c & M
|
|
||||||
str r14, [sp, #4 + 0*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u0 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* C interleaved with D */
|
|
||||||
ldr r0, [r1, #0*4] @ a[0]*2
|
|
||||||
ldr r14, [r1, #1*4] @ a[1]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
ldr r8, [r1, #2*4] @ a[2]
|
|
||||||
umlal r3, r4, r0, r14 @ c += a[0]*2 * a[1]
|
|
||||||
mov r7, r8, asl #1 @ a[2]*2
|
|
||||||
umull r11, r12, r14, r14 @ c' = a[1] * a[1]
|
|
||||||
ldr r14, [r1, #9*4] @ a[9]
|
|
||||||
umlal r11, r12, r0, r8 @ c' += a[0]*2 * a[2]
|
|
||||||
ldr r0, [r1, #3*4] @ a[3]*2
|
|
||||||
ldr r8, [r1, #8*4] @ a[8]
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[2]*2 * a[9]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
ldr r7, [r1, #4*4] @ a[4]*2
|
|
||||||
umull r9, r10, r0, r14 @ d' = a[3]*2 * a[9]
|
|
||||||
ldr r14, [r1, #7*4] @ a[7]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[3]*2 * a[8]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r0, [r1, #5*4] @ a[5]*2
|
|
||||||
umlal r9, r10, r7, r8 @ d' += a[4]*2 * a[8]
|
|
||||||
ldr r8, [r1, #6*4] @ a[6]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
umlal r5, r6, r7, r14 @ d += a[4]*2 * a[7]
|
|
||||||
umlal r9, r10, r0, r14 @ d' += a[5]*2 * a[7]
|
|
||||||
umlal r5, r6, r0, r8 @ d += a[5]*2 * a[6]
|
|
||||||
umlal r9, r10, r8, r8 @ d' += a[6] * a[6]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u1 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u1 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t1 = c & M
|
|
||||||
str r14, [sp, #4 + 1*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u1 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* D */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u2 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u2 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t2 = c & M
|
|
||||||
str r14, [sp, #4 + 2*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u2 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* E interleaved with F */
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]*2
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]*2
|
|
||||||
ldr r14, [r1, #2*4] @ a[2]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r8, [r1, #3*4] @ a[3]
|
|
||||||
ldr r2, [r1, #4*4]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[0]*2 * a[3]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
umull r11, r12, r7, r2 @ c' = a[0]*2 * a[4]
|
|
||||||
mov r2, r2, asl #1 @ a[4]*2
|
|
||||||
umlal r11, r12, r0, r8 @ c' += a[1]*2 * a[3]
|
|
||||||
ldr r8, [r1, #9*4] @ a[9]
|
|
||||||
umlal r3, r4, r0, r14 @ c += a[1]*2 * a[2]
|
|
||||||
ldr r0, [r1, #5*4] @ a[5]*2
|
|
||||||
umlal r11, r12, r14, r14 @ c' += a[2] * a[2]
|
|
||||||
ldr r14, [r1, #8*4] @ a[8]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
umlal r5, r6, r2, r8 @ d += a[4]*2 * a[9]
|
|
||||||
ldr r7, [r1, #6*4] @ a[6]*2
|
|
||||||
umull r9, r10, r0, r8 @ d' = a[5]*2 * a[9]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r8, [r1, #7*4] @ a[7]
|
|
||||||
umlal r5, r6, r0, r14 @ d += a[5]*2 * a[8]
|
|
||||||
umlal r9, r10, r7, r14 @ d' += a[6]*2 * a[8]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[6]*2 * a[7]
|
|
||||||
umlal r9, r10, r8, r8 @ d' += a[7] * a[7]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u3 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u3 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t3 = c & M
|
|
||||||
str r14, [sp, #4 + 3*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u3 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* F */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u4 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u4 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t4 = c & M
|
|
||||||
str r14, [sp, #4 + 4*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u4 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* G interleaved with H */
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]*2
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]*2
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r8, [r1, #5*4] @ a[5]
|
|
||||||
ldr r2, [r1, #6*4] @ a[6]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[0]*2 * a[5]
|
|
||||||
ldr r14, [r1, #4*4] @ a[4]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
umull r11, r12, r7, r2 @ c' = a[0]*2 * a[6]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]*2
|
|
||||||
umlal r11, r12, r0, r8 @ c' += a[1]*2 * a[5]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r8, [r1, #3*4] @ a[3]
|
|
||||||
umlal r3, r4, r0, r14 @ c += a[1]*2 * a[4]
|
|
||||||
mov r0, r2, asl #1 @ a[6]*2
|
|
||||||
umlal r11, r12, r7, r14 @ c' += a[2]*2 * a[4]
|
|
||||||
ldr r14, [r1, #9*4] @ a[9]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[2]*2 * a[3]
|
|
||||||
ldr r7, [r1, #7*4] @ a[7]*2
|
|
||||||
umlal r11, r12, r8, r8 @ c' += a[3] * a[3]
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r8, [r1, #8*4] @ a[8]
|
|
||||||
umlal r5, r6, r0, r14 @ d += a[6]*2 * a[9]
|
|
||||||
umull r9, r10, r7, r14 @ d' = a[7]*2 * a[9]
|
|
||||||
umlal r5, r6, r7, r8 @ d += a[7]*2 * a[8]
|
|
||||||
umlal r9, r10, r8, r8 @ d' += a[8] * a[8]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u5 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u5 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t5 = c & M
|
|
||||||
str r14, [sp, #4 + 5*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u5 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* H */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
adds r5, r5, r9 @ d += d'
|
|
||||||
adc r6, r6, r10
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u6 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u6 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t6 = c & M
|
|
||||||
str r14, [sp, #4 + 6*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u6 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* I interleaved with J */
|
|
||||||
ldr r7, [r1, #0*4] @ a[0]*2
|
|
||||||
ldr r0, [r1, #1*4] @ a[1]*2
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
ldr r8, [r1, #7*4] @ a[7]
|
|
||||||
ldr r2, [r1, #8*4] @ a[8]
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[0]*2 * a[7]
|
|
||||||
ldr r14, [r1, #6*4] @ a[6]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
umull r11, r12, r7, r2 @ c' = a[0]*2 * a[8]
|
|
||||||
ldr r7, [r1, #2*4] @ a[2]*2
|
|
||||||
umlal r11, r12, r0, r8 @ c' += a[1]*2 * a[7]
|
|
||||||
ldr r8, [r1, #5*4] @ a[5]
|
|
||||||
umlal r3, r4, r0, r14 @ c += a[1]*2 * a[6]
|
|
||||||
ldr r0, [r1, #3*4] @ a[3]*2
|
|
||||||
mov r7, r7, asl #1
|
|
||||||
umlal r11, r12, r7, r14 @ c' += a[2]*2 * a[6]
|
|
||||||
ldr r14, [r1, #4*4] @ a[4]
|
|
||||||
mov r0, r0, asl #1
|
|
||||||
umlal r3, r4, r7, r8 @ c += a[2]*2 * a[5]
|
|
||||||
mov r2, r2, asl #1 @ a[8]*2
|
|
||||||
umlal r11, r12, r0, r8 @ c' += a[3]*2 * a[5]
|
|
||||||
umlal r3, r4, r0, r14 @ c += a[3]*2 * a[4]
|
|
||||||
umlal r11, r12, r14, r14 @ c' += a[4] * a[4]
|
|
||||||
ldr r8, [r1, #9*4] @ a[9]
|
|
||||||
umlal r5, r6, r2, r8 @ d += a[8]*2 * a[9]
|
|
||||||
@ r8 will be used in J
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u7 = d & M
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u7 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
bic r14, r3, field_not_M @ t7 = c & M
|
|
||||||
str r14, [sp, #4 + 7*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u7 * R1
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/* J */
|
|
||||||
adds r3, r3, r11 @ c += c'
|
|
||||||
adc r4, r4, r12
|
|
||||||
umlal r5, r6, r8, r8 @ d += a[9] * a[9]
|
|
||||||
|
|
||||||
bic r0, r5, field_not_M @ u8 = d & M
|
|
||||||
str r0, [sp, #4 + 8*4]
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
movw r14, field_R0 @ c += u8 * R0
|
|
||||||
umlal r3, r4, r0, r14
|
|
||||||
|
|
||||||
/******************************************
|
|
||||||
* compute and write back result
|
|
||||||
******************************************
|
|
||||||
Allocation:
|
|
||||||
r0 r
|
|
||||||
r3:r4 c
|
|
||||||
r5:r6 d
|
|
||||||
r7 t0
|
|
||||||
r8 t1
|
|
||||||
r9 t2
|
|
||||||
r11 u8
|
|
||||||
r12 t9
|
|
||||||
r1,r2,r10,r14 scratch
|
|
||||||
|
|
||||||
Note: do not read from a[] after here, it may overlap with r[]
|
|
||||||
*/
|
|
||||||
ldr r0, [sp, #0]
|
|
||||||
add r1, sp, #4 + 3*4 @ r[3..7] = t3..7, r11=u8, r12=t9
|
|
||||||
ldmia r1, {r2,r7,r8,r9,r10,r11,r12}
|
|
||||||
add r1, r0, #3*4
|
|
||||||
stmia r1, {r2,r7,r8,r9,r10}
|
|
||||||
|
|
||||||
bic r2, r3, field_not_M @ r[8] = c & M
|
|
||||||
str r2, [r0, #8*4]
|
|
||||||
mov r3, r3, lsr #26 @ c >>= 26
|
|
||||||
orr r3, r3, r4, asl #6
|
|
||||||
mov r4, r4, lsr #26
|
|
||||||
mov r14, field_R1 @ c += u8 * R1
|
|
||||||
umlal r3, r4, r11, r14
|
|
||||||
movw r14, field_R0 @ c += d * R0
|
|
||||||
umlal r3, r4, r5, r14
|
|
||||||
adds r3, r3, r12 @ c += t9
|
|
||||||
adc r4, r4, #0
|
|
||||||
|
|
||||||
add r1, sp, #4 + 0*4 @ r7,r8,r9 = t0,t1,t2
|
|
||||||
ldmia r1, {r7,r8,r9}
|
|
||||||
|
|
||||||
ubfx r2, r3, #0, #22 @ r[9] = c & (M >> 4)
|
|
||||||
str r2, [r0, #9*4]
|
|
||||||
mov r3, r3, lsr #22 @ c >>= 22
|
|
||||||
orr r3, r3, r4, asl #10
|
|
||||||
mov r4, r4, lsr #22
|
|
||||||
movw r14, field_R1 << 4 @ c += d * (R1 << 4)
|
|
||||||
umlal r3, r4, r5, r14
|
|
||||||
|
|
||||||
movw r14, field_R0 >> 4 @ d = c * (R0 >> 4) + t0 (64x64 multiply+add)
|
|
||||||
umull r5, r6, r3, r14 @ d = c.lo * (R0 >> 4)
|
|
||||||
adds r5, r5, r7 @ d.lo += t0
|
|
||||||
mla r6, r14, r4, r6 @ d.hi += c.hi * (R0 >> 4)
|
|
||||||
adc r6, r6, 0 @ d.hi += carry
|
|
||||||
|
|
||||||
bic r2, r5, field_not_M @ r[0] = d & M
|
|
||||||
str r2, [r0, #0*4]
|
|
||||||
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
mov r6, r6, lsr #26
|
|
||||||
|
|
||||||
movw r14, field_R1 >> 4 @ d += c * (R1 >> 4) + t1 (64x64 multiply+add)
|
|
||||||
umull r1, r2, r3, r14 @ tmp = c.lo * (R1 >> 4)
|
|
||||||
adds r5, r5, r8 @ d.lo += t1
|
|
||||||
adc r6, r6, #0 @ d.hi += carry
|
|
||||||
adds r5, r5, r1 @ d.lo += tmp.lo
|
|
||||||
mla r2, r14, r4, r2 @ tmp.hi += c.hi * (R1 >> 4)
|
|
||||||
adc r6, r6, r2 @ d.hi += carry + tmp.hi
|
|
||||||
|
|
||||||
bic r2, r5, field_not_M @ r[1] = d & M
|
|
||||||
str r2, [r0, #1*4]
|
|
||||||
mov r5, r5, lsr #26 @ d >>= 26 (ignore hi)
|
|
||||||
orr r5, r5, r6, asl #6
|
|
||||||
|
|
||||||
add r5, r5, r9 @ d += t2
|
|
||||||
str r5, [r0, #2*4] @ r[2] = d
|
|
||||||
|
|
||||||
add sp, sp, #48
|
|
||||||
ldmfd sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc}
|
|
||||||
.size secp256k1_fe_sqr_inner, .-secp256k1_fe_sqr_inner
|
|
||||||
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_BASIC_CONFIG_H
|
|
||||||
#define SECP256K1_BASIC_CONFIG_H
|
|
||||||
|
|
||||||
#ifdef USE_BASIC_CONFIG
|
|
||||||
|
|
||||||
#undef USE_ASM_X86_64
|
|
||||||
#undef USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
#undef USE_ENDOMORPHISM
|
|
||||||
#undef USE_EXTERNAL_ASM
|
|
||||||
#undef USE_EXTERNAL_DEFAULT_CALLBACKS
|
|
||||||
#undef USE_FIELD_10X26
|
|
||||||
#undef USE_FIELD_5X52
|
|
||||||
#undef USE_FIELD_INV_BUILTIN
|
|
||||||
#undef USE_FIELD_INV_NUM
|
|
||||||
#undef USE_NUM_GMP
|
|
||||||
#undef USE_NUM_NONE
|
|
||||||
#undef USE_SCALAR_4X64
|
|
||||||
#undef USE_SCALAR_8X32
|
|
||||||
#undef USE_SCALAR_INV_BUILTIN
|
|
||||||
#undef USE_SCALAR_INV_NUM
|
|
||||||
#undef ECMULT_WINDOW_SIZE
|
|
||||||
|
|
||||||
#define USE_NUM_NONE 1
|
|
||||||
#define USE_FIELD_INV_BUILTIN 1
|
|
||||||
#define USE_SCALAR_INV_BUILTIN 1
|
|
||||||
#define USE_FIELD_10X26 1
|
|
||||||
#define USE_SCALAR_8X32 1
|
|
||||||
#define ECMULT_WINDOW_SIZE 15
|
|
||||||
|
|
||||||
#endif /* USE_BASIC_CONFIG */
|
|
||||||
|
|
||||||
#endif /* SECP256K1_BASIC_CONFIG_H */
|
|
||||||
@ -1,82 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_BENCH_H
|
|
||||||
#define SECP256K1_BENCH_H
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <string.h>
|
|
||||||
#include <math.h>
|
|
||||||
#include "sys/time.h"
|
|
||||||
|
|
||||||
static double gettimedouble(void) {
|
|
||||||
struct timeval tv;
|
|
||||||
gettimeofday(&tv, NULL);
|
|
||||||
return tv.tv_usec * 0.000001 + tv.tv_sec;
|
|
||||||
}
|
|
||||||
|
|
||||||
void print_number(double x) {
|
|
||||||
double y = x;
|
|
||||||
int c = 0;
|
|
||||||
if (y < 0.0) {
|
|
||||||
y = -y;
|
|
||||||
}
|
|
||||||
while (y > 0 && y < 100.0) {
|
|
||||||
y *= 10.0;
|
|
||||||
c++;
|
|
||||||
}
|
|
||||||
printf("%.*f", c, x);
|
|
||||||
}
|
|
||||||
|
|
||||||
void run_benchmark(char *name, void (*benchmark)(void*), void (*setup)(void*), void (*teardown)(void*), void* data, int count, int iter) {
|
|
||||||
int i;
|
|
||||||
double min = HUGE_VAL;
|
|
||||||
double sum = 0.0;
|
|
||||||
double max = 0.0;
|
|
||||||
for (i = 0; i < count; i++) {
|
|
||||||
double begin, total;
|
|
||||||
if (setup != NULL) {
|
|
||||||
setup(data);
|
|
||||||
}
|
|
||||||
begin = gettimedouble();
|
|
||||||
benchmark(data);
|
|
||||||
total = gettimedouble() - begin;
|
|
||||||
if (teardown != NULL) {
|
|
||||||
teardown(data);
|
|
||||||
}
|
|
||||||
if (total < min) {
|
|
||||||
min = total;
|
|
||||||
}
|
|
||||||
if (total > max) {
|
|
||||||
max = total;
|
|
||||||
}
|
|
||||||
sum += total;
|
|
||||||
}
|
|
||||||
printf("%s: min ", name);
|
|
||||||
print_number(min * 1000000.0 / iter);
|
|
||||||
printf("us / avg ");
|
|
||||||
print_number((sum / count) * 1000000.0 / iter);
|
|
||||||
printf("us / max ");
|
|
||||||
print_number(max * 1000000.0 / iter);
|
|
||||||
printf("us\n");
|
|
||||||
}
|
|
||||||
|
|
||||||
int have_flag(int argc, char** argv, char *flag) {
|
|
||||||
char** argm = argv + argc;
|
|
||||||
argv++;
|
|
||||||
if (argv == argm) {
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
while (argv != NULL && argv != argm) {
|
|
||||||
if (strcmp(*argv, flag) == 0) {
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
argv++;
|
|
||||||
}
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_BENCH_H */
|
|
||||||
@ -1,54 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Pieter Wuille, Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "include/secp256k1_ecdh.h"
|
|
||||||
#include "util.h"
|
|
||||||
#include "bench.h"
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_context *ctx;
|
|
||||||
secp256k1_pubkey point;
|
|
||||||
unsigned char scalar[32];
|
|
||||||
} bench_ecdh_data;
|
|
||||||
|
|
||||||
static void bench_ecdh_setup(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_ecdh_data *data = (bench_ecdh_data*)arg;
|
|
||||||
const unsigned char point[] = {
|
|
||||||
0x03,
|
|
||||||
0x54, 0x94, 0xc1, 0x5d, 0x32, 0x09, 0x97, 0x06,
|
|
||||||
0xc2, 0x39, 0x5f, 0x94, 0x34, 0x87, 0x45, 0xfd,
|
|
||||||
0x75, 0x7c, 0xe3, 0x0e, 0x4e, 0x8c, 0x90, 0xfb,
|
|
||||||
0xa2, 0xba, 0xd1, 0x84, 0xf8, 0x83, 0xc6, 0x9f
|
|
||||||
};
|
|
||||||
|
|
||||||
/* create a context with no capabilities */
|
|
||||||
data->ctx = secp256k1_context_create(SECP256K1_FLAGS_TYPE_CONTEXT);
|
|
||||||
for (i = 0; i < 32; i++) {
|
|
||||||
data->scalar[i] = i + 1;
|
|
||||||
}
|
|
||||||
CHECK(secp256k1_ec_pubkey_parse(data->ctx, &data->point, point, sizeof(point)) == 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void bench_ecdh(void* arg) {
|
|
||||||
int i;
|
|
||||||
unsigned char res[32];
|
|
||||||
bench_ecdh_data *data = (bench_ecdh_data*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
CHECK(secp256k1_ecdh(data->ctx, res, &data->point, data->scalar, NULL, NULL) == 1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(void) {
|
|
||||||
bench_ecdh_data data;
|
|
||||||
|
|
||||||
run_benchmark("ecdh", bench_ecdh, bench_ecdh_setup, NULL, &data, 10, 20000);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@ -1,207 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2017 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
#include <stdio.h>
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "hash_impl.h"
|
|
||||||
#include "num_impl.h"
|
|
||||||
#include "field_impl.h"
|
|
||||||
#include "group_impl.h"
|
|
||||||
#include "scalar_impl.h"
|
|
||||||
#include "ecmult_impl.h"
|
|
||||||
#include "bench.h"
|
|
||||||
#include "secp256k1.c"
|
|
||||||
|
|
||||||
#define POINTS 32768
|
|
||||||
#define ITERS 10000
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
/* Setup once in advance */
|
|
||||||
secp256k1_context* ctx;
|
|
||||||
secp256k1_scratch_space* scratch;
|
|
||||||
secp256k1_scalar* scalars;
|
|
||||||
secp256k1_ge* pubkeys;
|
|
||||||
secp256k1_scalar* seckeys;
|
|
||||||
secp256k1_gej* expected_output;
|
|
||||||
secp256k1_ecmult_multi_func ecmult_multi;
|
|
||||||
|
|
||||||
/* Changes per test */
|
|
||||||
size_t count;
|
|
||||||
int includes_g;
|
|
||||||
|
|
||||||
/* Changes per test iteration */
|
|
||||||
size_t offset1;
|
|
||||||
size_t offset2;
|
|
||||||
|
|
||||||
/* Test output. */
|
|
||||||
secp256k1_gej* output;
|
|
||||||
} bench_data;
|
|
||||||
|
|
||||||
static int bench_callback(secp256k1_scalar* sc, secp256k1_ge* ge, size_t idx, void* arg) {
|
|
||||||
bench_data* data = (bench_data*)arg;
|
|
||||||
if (data->includes_g) ++idx;
|
|
||||||
if (idx == 0) {
|
|
||||||
*sc = data->scalars[data->offset1];
|
|
||||||
*ge = secp256k1_ge_const_g;
|
|
||||||
} else {
|
|
||||||
*sc = data->scalars[(data->offset1 + idx) % POINTS];
|
|
||||||
*ge = data->pubkeys[(data->offset2 + idx - 1) % POINTS];
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void bench_ecmult(void* arg) {
|
|
||||||
bench_data* data = (bench_data*)arg;
|
|
||||||
|
|
||||||
size_t count = data->count;
|
|
||||||
int includes_g = data->includes_g;
|
|
||||||
size_t iters = 1 + ITERS / count;
|
|
||||||
size_t iter;
|
|
||||||
|
|
||||||
for (iter = 0; iter < iters; ++iter) {
|
|
||||||
data->ecmult_multi(&data->ctx->error_callback, &data->ctx->ecmult_ctx, data->scratch, &data->output[iter], data->includes_g ? &data->scalars[data->offset1] : NULL, bench_callback, arg, count - includes_g);
|
|
||||||
data->offset1 = (data->offset1 + count) % POINTS;
|
|
||||||
data->offset2 = (data->offset2 + count - 1) % POINTS;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void bench_ecmult_setup(void* arg) {
|
|
||||||
bench_data* data = (bench_data*)arg;
|
|
||||||
data->offset1 = (data->count * 0x537b7f6f + 0x8f66a481) % POINTS;
|
|
||||||
data->offset2 = (data->count * 0x7f6f537b + 0x6a1a8f49) % POINTS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void bench_ecmult_teardown(void* arg) {
|
|
||||||
bench_data* data = (bench_data*)arg;
|
|
||||||
size_t iters = 1 + ITERS / data->count;
|
|
||||||
size_t iter;
|
|
||||||
/* Verify the results in teardown, to avoid doing comparisons while benchmarking. */
|
|
||||||
for (iter = 0; iter < iters; ++iter) {
|
|
||||||
secp256k1_gej tmp;
|
|
||||||
secp256k1_gej_add_var(&tmp, &data->output[iter], &data->expected_output[iter], NULL);
|
|
||||||
CHECK(secp256k1_gej_is_infinity(&tmp));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void generate_scalar(uint32_t num, secp256k1_scalar* scalar) {
|
|
||||||
secp256k1_sha256 sha256;
|
|
||||||
unsigned char c[11] = {'e', 'c', 'm', 'u', 'l', 't', 0, 0, 0, 0};
|
|
||||||
unsigned char buf[32];
|
|
||||||
int overflow = 0;
|
|
||||||
c[6] = num;
|
|
||||||
c[7] = num >> 8;
|
|
||||||
c[8] = num >> 16;
|
|
||||||
c[9] = num >> 24;
|
|
||||||
secp256k1_sha256_initialize(&sha256);
|
|
||||||
secp256k1_sha256_write(&sha256, c, sizeof(c));
|
|
||||||
secp256k1_sha256_finalize(&sha256, buf);
|
|
||||||
secp256k1_scalar_set_b32(scalar, buf, &overflow);
|
|
||||||
CHECK(!overflow);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void run_test(bench_data* data, size_t count, int includes_g) {
|
|
||||||
char str[32];
|
|
||||||
static const secp256k1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
|
|
||||||
size_t iters = 1 + ITERS / count;
|
|
||||||
size_t iter;
|
|
||||||
|
|
||||||
data->count = count;
|
|
||||||
data->includes_g = includes_g;
|
|
||||||
|
|
||||||
/* Compute (the negation of) the expected results directly. */
|
|
||||||
data->offset1 = (data->count * 0x537b7f6f + 0x8f66a481) % POINTS;
|
|
||||||
data->offset2 = (data->count * 0x7f6f537b + 0x6a1a8f49) % POINTS;
|
|
||||||
for (iter = 0; iter < iters; ++iter) {
|
|
||||||
secp256k1_scalar tmp;
|
|
||||||
secp256k1_scalar total = data->scalars[(data->offset1++) % POINTS];
|
|
||||||
size_t i = 0;
|
|
||||||
for (i = 0; i + 1 < count; ++i) {
|
|
||||||
secp256k1_scalar_mul(&tmp, &data->seckeys[(data->offset2++) % POINTS], &data->scalars[(data->offset1++) % POINTS]);
|
|
||||||
secp256k1_scalar_add(&total, &total, &tmp);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_negate(&total, &total);
|
|
||||||
secp256k1_ecmult(&data->ctx->ecmult_ctx, &data->expected_output[iter], NULL, &zero, &total);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Run the benchmark. */
|
|
||||||
sprintf(str, includes_g ? "ecmult_%ig" : "ecmult_%i", (int)count);
|
|
||||||
run_benchmark(str, bench_ecmult, bench_ecmult_setup, bench_ecmult_teardown, data, 10, count * (1 + ITERS / count));
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(int argc, char **argv) {
|
|
||||||
bench_data data;
|
|
||||||
int i, p;
|
|
||||||
secp256k1_gej* pubkeys_gej;
|
|
||||||
size_t scratch_size;
|
|
||||||
|
|
||||||
data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
|
|
||||||
scratch_size = secp256k1_strauss_scratch_size(POINTS) + STRAUSS_SCRATCH_OBJECTS*16;
|
|
||||||
data.scratch = secp256k1_scratch_space_create(data.ctx, scratch_size);
|
|
||||||
data.ecmult_multi = secp256k1_ecmult_multi_var;
|
|
||||||
|
|
||||||
if (argc > 1) {
|
|
||||||
if(have_flag(argc, argv, "pippenger_wnaf")) {
|
|
||||||
printf("Using pippenger_wnaf:\n");
|
|
||||||
data.ecmult_multi = secp256k1_ecmult_pippenger_batch_single;
|
|
||||||
} else if(have_flag(argc, argv, "strauss_wnaf")) {
|
|
||||||
printf("Using strauss_wnaf:\n");
|
|
||||||
data.ecmult_multi = secp256k1_ecmult_strauss_batch_single;
|
|
||||||
} else if(have_flag(argc, argv, "simple")) {
|
|
||||||
printf("Using simple algorithm:\n");
|
|
||||||
data.ecmult_multi = secp256k1_ecmult_multi_var;
|
|
||||||
secp256k1_scratch_space_destroy(data.ctx, data.scratch);
|
|
||||||
data.scratch = NULL;
|
|
||||||
} else {
|
|
||||||
fprintf(stderr, "%s: unrecognized argument '%s'.\n", argv[0], argv[1]);
|
|
||||||
fprintf(stderr, "Use 'pippenger_wnaf', 'strauss_wnaf', 'simple' or no argument to benchmark a combined algorithm.\n");
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Allocate stuff */
|
|
||||||
data.scalars = malloc(sizeof(secp256k1_scalar) * POINTS);
|
|
||||||
data.seckeys = malloc(sizeof(secp256k1_scalar) * POINTS);
|
|
||||||
data.pubkeys = malloc(sizeof(secp256k1_ge) * POINTS);
|
|
||||||
data.expected_output = malloc(sizeof(secp256k1_gej) * (ITERS + 1));
|
|
||||||
data.output = malloc(sizeof(secp256k1_gej) * (ITERS + 1));
|
|
||||||
|
|
||||||
/* Generate a set of scalars, and private/public keypairs. */
|
|
||||||
pubkeys_gej = malloc(sizeof(secp256k1_gej) * POINTS);
|
|
||||||
secp256k1_gej_set_ge(&pubkeys_gej[0], &secp256k1_ge_const_g);
|
|
||||||
secp256k1_scalar_set_int(&data.seckeys[0], 1);
|
|
||||||
for (i = 0; i < POINTS; ++i) {
|
|
||||||
generate_scalar(i, &data.scalars[i]);
|
|
||||||
if (i) {
|
|
||||||
secp256k1_gej_double_var(&pubkeys_gej[i], &pubkeys_gej[i - 1], NULL);
|
|
||||||
secp256k1_scalar_add(&data.seckeys[i], &data.seckeys[i - 1], &data.seckeys[i - 1]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
secp256k1_ge_set_all_gej_var(data.pubkeys, pubkeys_gej, POINTS);
|
|
||||||
free(pubkeys_gej);
|
|
||||||
|
|
||||||
for (i = 1; i <= 8; ++i) {
|
|
||||||
run_test(&data, i, 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
for (p = 0; p <= 11; ++p) {
|
|
||||||
for (i = 9; i <= 16; ++i) {
|
|
||||||
run_test(&data, i << p, 1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (data.scratch != NULL) {
|
|
||||||
secp256k1_scratch_space_destroy(data.ctx, data.scratch);
|
|
||||||
}
|
|
||||||
secp256k1_context_destroy(data.ctx);
|
|
||||||
free(data.scalars);
|
|
||||||
free(data.pubkeys);
|
|
||||||
free(data.seckeys);
|
|
||||||
free(data.output);
|
|
||||||
free(data.expected_output);
|
|
||||||
|
|
||||||
return(0);
|
|
||||||
}
|
|
||||||
@ -1,369 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014-2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
#include <stdio.h>
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "hash_impl.h"
|
|
||||||
#include "num_impl.h"
|
|
||||||
#include "field_impl.h"
|
|
||||||
#include "group_impl.h"
|
|
||||||
#include "scalar_impl.h"
|
|
||||||
#include "ecmult_const_impl.h"
|
|
||||||
#include "ecmult_impl.h"
|
|
||||||
#include "bench.h"
|
|
||||||
#include "secp256k1.c"
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_scalar scalar_x, scalar_y;
|
|
||||||
secp256k1_fe fe_x, fe_y;
|
|
||||||
secp256k1_ge ge_x, ge_y;
|
|
||||||
secp256k1_gej gej_x, gej_y;
|
|
||||||
unsigned char data[64];
|
|
||||||
int wnaf[256];
|
|
||||||
} bench_inv;
|
|
||||||
|
|
||||||
void bench_setup(void* arg) {
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
static const unsigned char init_x[32] = {
|
|
||||||
0x02, 0x03, 0x05, 0x07, 0x0b, 0x0d, 0x11, 0x13,
|
|
||||||
0x17, 0x1d, 0x1f, 0x25, 0x29, 0x2b, 0x2f, 0x35,
|
|
||||||
0x3b, 0x3d, 0x43, 0x47, 0x49, 0x4f, 0x53, 0x59,
|
|
||||||
0x61, 0x65, 0x67, 0x6b, 0x6d, 0x71, 0x7f, 0x83
|
|
||||||
};
|
|
||||||
|
|
||||||
static const unsigned char init_y[32] = {
|
|
||||||
0x82, 0x83, 0x85, 0x87, 0x8b, 0x8d, 0x81, 0x83,
|
|
||||||
0x97, 0xad, 0xaf, 0xb5, 0xb9, 0xbb, 0xbf, 0xc5,
|
|
||||||
0xdb, 0xdd, 0xe3, 0xe7, 0xe9, 0xef, 0xf3, 0xf9,
|
|
||||||
0x11, 0x15, 0x17, 0x1b, 0x1d, 0xb1, 0xbf, 0xd3
|
|
||||||
};
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&data->scalar_x, init_x, NULL);
|
|
||||||
secp256k1_scalar_set_b32(&data->scalar_y, init_y, NULL);
|
|
||||||
secp256k1_fe_set_b32(&data->fe_x, init_x);
|
|
||||||
secp256k1_fe_set_b32(&data->fe_y, init_y);
|
|
||||||
CHECK(secp256k1_ge_set_xo_var(&data->ge_x, &data->fe_x, 0));
|
|
||||||
CHECK(secp256k1_ge_set_xo_var(&data->ge_y, &data->fe_y, 1));
|
|
||||||
secp256k1_gej_set_ge(&data->gej_x, &data->ge_x);
|
|
||||||
secp256k1_gej_set_ge(&data->gej_y, &data->ge_y);
|
|
||||||
memcpy(data->data, init_x, 32);
|
|
||||||
memcpy(data->data + 32, init_y, 32);
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_scalar_add(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 2000000; i++) {
|
|
||||||
secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_scalar_negate(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 2000000; i++) {
|
|
||||||
secp256k1_scalar_negate(&data->scalar_x, &data->scalar_x);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_scalar_sqr(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_scalar_sqr(&data->scalar_x, &data->scalar_x);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_scalar_mul(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_scalar_mul(&data->scalar_x, &data->scalar_x, &data->scalar_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
void bench_scalar_split(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_scalar l, r;
|
|
||||||
secp256k1_scalar_split_lambda(&l, &r, &data->scalar_x);
|
|
||||||
secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
void bench_scalar_inverse(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 2000; i++) {
|
|
||||||
secp256k1_scalar_inverse(&data->scalar_x, &data->scalar_x);
|
|
||||||
secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_scalar_inverse_var(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 2000; i++) {
|
|
||||||
secp256k1_scalar_inverse_var(&data->scalar_x, &data->scalar_x);
|
|
||||||
secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_field_normalize(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 2000000; i++) {
|
|
||||||
secp256k1_fe_normalize(&data->fe_x);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_field_normalize_weak(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 2000000; i++) {
|
|
||||||
secp256k1_fe_normalize_weak(&data->fe_x);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_field_mul(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_fe_mul(&data->fe_x, &data->fe_x, &data->fe_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_field_sqr(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_fe_sqr(&data->fe_x, &data->fe_x);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_field_inverse(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_fe_inv(&data->fe_x, &data->fe_x);
|
|
||||||
secp256k1_fe_add(&data->fe_x, &data->fe_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_field_inverse_var(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_fe_inv_var(&data->fe_x, &data->fe_x);
|
|
||||||
secp256k1_fe_add(&data->fe_x, &data->fe_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_field_sqrt(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
secp256k1_fe t;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
t = data->fe_x;
|
|
||||||
secp256k1_fe_sqrt(&data->fe_x, &t);
|
|
||||||
secp256k1_fe_add(&data->fe_x, &data->fe_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_group_double_var(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_gej_double_var(&data->gej_x, &data->gej_x, NULL);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_group_add_var(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_gej_add_var(&data->gej_x, &data->gej_x, &data->gej_y, NULL);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_group_add_affine(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_gej_add_ge(&data->gej_x, &data->gej_x, &data->ge_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_group_add_affine_var(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_gej_add_ge_var(&data->gej_x, &data->gej_x, &data->ge_y, NULL);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_group_jacobi_var(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_gej_has_quad_y_var(&data->gej_x);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_ecmult_wnaf(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_ecmult_wnaf(data->wnaf, 256, &data->scalar_x, WINDOW_A);
|
|
||||||
secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_wnaf_const(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_wnaf_const(data->wnaf, &data->scalar_x, WINDOW_A, 256);
|
|
||||||
secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
void bench_sha256(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
secp256k1_sha256 sha;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_sha256_initialize(&sha);
|
|
||||||
secp256k1_sha256_write(&sha, data->data, 32);
|
|
||||||
secp256k1_sha256_finalize(&sha, data->data);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_hmac_sha256(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
secp256k1_hmac_sha256 hmac;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, data->data, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, data->data, 32);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, data->data);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_rfc6979_hmac_sha256(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
secp256k1_rfc6979_hmac_sha256 rng;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_rfc6979_hmac_sha256_initialize(&rng, data->data, 64);
|
|
||||||
secp256k1_rfc6979_hmac_sha256_generate(&rng, data->data, 32);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_context_verify(void* arg) {
|
|
||||||
int i;
|
|
||||||
(void)arg;
|
|
||||||
for (i = 0; i < 20; i++) {
|
|
||||||
secp256k1_context_destroy(secp256k1_context_create(SECP256K1_CONTEXT_VERIFY));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_context_sign(void* arg) {
|
|
||||||
int i;
|
|
||||||
(void)arg;
|
|
||||||
for (i = 0; i < 200; i++) {
|
|
||||||
secp256k1_context_destroy(secp256k1_context_create(SECP256K1_CONTEXT_SIGN));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifndef USE_NUM_NONE
|
|
||||||
void bench_num_jacobi(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_inv *data = (bench_inv*)arg;
|
|
||||||
secp256k1_num nx, norder;
|
|
||||||
|
|
||||||
secp256k1_scalar_get_num(&nx, &data->scalar_x);
|
|
||||||
secp256k1_scalar_order_get_num(&norder);
|
|
||||||
secp256k1_scalar_get_num(&norder, &data->scalar_y);
|
|
||||||
|
|
||||||
for (i = 0; i < 200000; i++) {
|
|
||||||
secp256k1_num_jacobi(&nx, &norder);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
int main(int argc, char **argv) {
|
|
||||||
bench_inv data;
|
|
||||||
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "add")) run_benchmark("scalar_add", bench_scalar_add, bench_setup, NULL, &data, 10, 2000000);
|
|
||||||
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "negate")) run_benchmark("scalar_negate", bench_scalar_negate, bench_setup, NULL, &data, 10, 2000000);
|
|
||||||
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "sqr")) run_benchmark("scalar_sqr", bench_scalar_sqr, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "mul")) run_benchmark("scalar_mul", bench_scalar_mul, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "split")) run_benchmark("scalar_split", bench_scalar_split, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
#endif
|
|
||||||
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "inverse")) run_benchmark("scalar_inverse", bench_scalar_inverse, bench_setup, NULL, &data, 10, 2000);
|
|
||||||
if (have_flag(argc, argv, "scalar") || have_flag(argc, argv, "inverse")) run_benchmark("scalar_inverse_var", bench_scalar_inverse_var, bench_setup, NULL, &data, 10, 2000);
|
|
||||||
|
|
||||||
if (have_flag(argc, argv, "field") || have_flag(argc, argv, "normalize")) run_benchmark("field_normalize", bench_field_normalize, bench_setup, NULL, &data, 10, 2000000);
|
|
||||||
if (have_flag(argc, argv, "field") || have_flag(argc, argv, "normalize")) run_benchmark("field_normalize_weak", bench_field_normalize_weak, bench_setup, NULL, &data, 10, 2000000);
|
|
||||||
if (have_flag(argc, argv, "field") || have_flag(argc, argv, "sqr")) run_benchmark("field_sqr", bench_field_sqr, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
if (have_flag(argc, argv, "field") || have_flag(argc, argv, "mul")) run_benchmark("field_mul", bench_field_mul, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
if (have_flag(argc, argv, "field") || have_flag(argc, argv, "inverse")) run_benchmark("field_inverse", bench_field_inverse, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
if (have_flag(argc, argv, "field") || have_flag(argc, argv, "inverse")) run_benchmark("field_inverse_var", bench_field_inverse_var, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
if (have_flag(argc, argv, "field") || have_flag(argc, argv, "sqrt")) run_benchmark("field_sqrt", bench_field_sqrt, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
|
|
||||||
if (have_flag(argc, argv, "group") || have_flag(argc, argv, "double")) run_benchmark("group_double_var", bench_group_double_var, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
if (have_flag(argc, argv, "group") || have_flag(argc, argv, "add")) run_benchmark("group_add_var", bench_group_add_var, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
if (have_flag(argc, argv, "group") || have_flag(argc, argv, "add")) run_benchmark("group_add_affine", bench_group_add_affine, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
if (have_flag(argc, argv, "group") || have_flag(argc, argv, "add")) run_benchmark("group_add_affine_var", bench_group_add_affine_var, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
if (have_flag(argc, argv, "group") || have_flag(argc, argv, "jacobi")) run_benchmark("group_jacobi_var", bench_group_jacobi_var, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
|
|
||||||
if (have_flag(argc, argv, "ecmult") || have_flag(argc, argv, "wnaf")) run_benchmark("wnaf_const", bench_wnaf_const, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
if (have_flag(argc, argv, "ecmult") || have_flag(argc, argv, "wnaf")) run_benchmark("ecmult_wnaf", bench_ecmult_wnaf, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
|
|
||||||
if (have_flag(argc, argv, "hash") || have_flag(argc, argv, "sha256")) run_benchmark("hash_sha256", bench_sha256, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
if (have_flag(argc, argv, "hash") || have_flag(argc, argv, "hmac")) run_benchmark("hash_hmac_sha256", bench_hmac_sha256, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
if (have_flag(argc, argv, "hash") || have_flag(argc, argv, "rng6979")) run_benchmark("hash_rfc6979_hmac_sha256", bench_rfc6979_hmac_sha256, bench_setup, NULL, &data, 10, 20000);
|
|
||||||
|
|
||||||
if (have_flag(argc, argv, "context") || have_flag(argc, argv, "verify")) run_benchmark("context_verify", bench_context_verify, bench_setup, NULL, &data, 10, 20);
|
|
||||||
if (have_flag(argc, argv, "context") || have_flag(argc, argv, "sign")) run_benchmark("context_sign", bench_context_sign, bench_setup, NULL, &data, 10, 200);
|
|
||||||
|
|
||||||
#ifndef USE_NUM_NONE
|
|
||||||
if (have_flag(argc, argv, "num") || have_flag(argc, argv, "jacobi")) run_benchmark("num_jacobi", bench_num_jacobi, bench_setup, NULL, &data, 10, 200000);
|
|
||||||
#endif
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@ -1,60 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014-2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "include/secp256k1_recovery.h"
|
|
||||||
#include "util.h"
|
|
||||||
#include "bench.h"
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_context *ctx;
|
|
||||||
unsigned char msg[32];
|
|
||||||
unsigned char sig[64];
|
|
||||||
} bench_recover_data;
|
|
||||||
|
|
||||||
void bench_recover(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_recover_data *data = (bench_recover_data*)arg;
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
unsigned char pubkeyc[33];
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
int j;
|
|
||||||
size_t pubkeylen = 33;
|
|
||||||
secp256k1_ecdsa_recoverable_signature sig;
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(data->ctx, &sig, data->sig, i % 2));
|
|
||||||
CHECK(secp256k1_ecdsa_recover(data->ctx, &pubkey, &sig, data->msg));
|
|
||||||
CHECK(secp256k1_ec_pubkey_serialize(data->ctx, pubkeyc, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED));
|
|
||||||
for (j = 0; j < 32; j++) {
|
|
||||||
data->sig[j + 32] = data->msg[j]; /* Move former message to S. */
|
|
||||||
data->msg[j] = data->sig[j]; /* Move former R to message. */
|
|
||||||
data->sig[j] = pubkeyc[j + 1]; /* Move recovered pubkey X coordinate to R (which must be a valid X coordinate). */
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void bench_recover_setup(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_recover_data *data = (bench_recover_data*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 32; i++) {
|
|
||||||
data->msg[i] = 1 + i;
|
|
||||||
}
|
|
||||||
for (i = 0; i < 64; i++) {
|
|
||||||
data->sig[i] = 65 + i;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(void) {
|
|
||||||
bench_recover_data data;
|
|
||||||
|
|
||||||
data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
|
|
||||||
|
|
||||||
run_benchmark("ecdsa_recover", bench_recover, bench_recover_setup, NULL, &data, 10, 20000);
|
|
||||||
|
|
||||||
secp256k1_context_destroy(data.ctx);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@ -1,56 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "util.h"
|
|
||||||
#include "bench.h"
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_context* ctx;
|
|
||||||
unsigned char msg[32];
|
|
||||||
unsigned char key[32];
|
|
||||||
} bench_sign;
|
|
||||||
|
|
||||||
static void bench_sign_setup(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_sign *data = (bench_sign*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 32; i++) {
|
|
||||||
data->msg[i] = i + 1;
|
|
||||||
}
|
|
||||||
for (i = 0; i < 32; i++) {
|
|
||||||
data->key[i] = i + 65;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void bench_sign_run(void* arg) {
|
|
||||||
int i;
|
|
||||||
bench_sign *data = (bench_sign*)arg;
|
|
||||||
|
|
||||||
unsigned char sig[74];
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
size_t siglen = 74;
|
|
||||||
int j;
|
|
||||||
secp256k1_ecdsa_signature signature;
|
|
||||||
CHECK(secp256k1_ecdsa_sign(data->ctx, &signature, data->msg, data->key, NULL, NULL));
|
|
||||||
CHECK(secp256k1_ecdsa_signature_serialize_der(data->ctx, sig, &siglen, &signature));
|
|
||||||
for (j = 0; j < 32; j++) {
|
|
||||||
data->msg[j] = sig[j];
|
|
||||||
data->key[j] = sig[j + 32];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(void) {
|
|
||||||
bench_sign data;
|
|
||||||
|
|
||||||
data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
|
|
||||||
|
|
||||||
run_benchmark("ecdsa_sign", bench_sign_run, bench_sign_setup, NULL, &data, 10, 20000);
|
|
||||||
|
|
||||||
secp256k1_context_destroy(data.ctx);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@ -1,112 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "util.h"
|
|
||||||
#include "bench.h"
|
|
||||||
|
|
||||||
#ifdef ENABLE_OPENSSL_TESTS
|
|
||||||
#include <openssl/bn.h>
|
|
||||||
#include <openssl/ecdsa.h>
|
|
||||||
#include <openssl/obj_mac.h>
|
|
||||||
#endif
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_context *ctx;
|
|
||||||
unsigned char msg[32];
|
|
||||||
unsigned char key[32];
|
|
||||||
unsigned char sig[72];
|
|
||||||
size_t siglen;
|
|
||||||
unsigned char pubkey[33];
|
|
||||||
size_t pubkeylen;
|
|
||||||
#ifdef ENABLE_OPENSSL_TESTS
|
|
||||||
EC_GROUP* ec_group;
|
|
||||||
#endif
|
|
||||||
} benchmark_verify_t;
|
|
||||||
|
|
||||||
static void benchmark_verify(void* arg) {
|
|
||||||
int i;
|
|
||||||
benchmark_verify_t* data = (benchmark_verify_t*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
data->sig[data->siglen - 1] ^= (i & 0xFF);
|
|
||||||
data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
|
|
||||||
data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
|
|
||||||
CHECK(secp256k1_ec_pubkey_parse(data->ctx, &pubkey, data->pubkey, data->pubkeylen) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(data->ctx, &sig, data->sig, data->siglen) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(data->ctx, &sig, data->msg, &pubkey) == (i == 0));
|
|
||||||
data->sig[data->siglen - 1] ^= (i & 0xFF);
|
|
||||||
data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
|
|
||||||
data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef ENABLE_OPENSSL_TESTS
|
|
||||||
static void benchmark_verify_openssl(void* arg) {
|
|
||||||
int i;
|
|
||||||
benchmark_verify_t* data = (benchmark_verify_t*)arg;
|
|
||||||
|
|
||||||
for (i = 0; i < 20000; i++) {
|
|
||||||
data->sig[data->siglen - 1] ^= (i & 0xFF);
|
|
||||||
data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
|
|
||||||
data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
|
|
||||||
{
|
|
||||||
EC_KEY *pkey = EC_KEY_new();
|
|
||||||
const unsigned char *pubkey = &data->pubkey[0];
|
|
||||||
int result;
|
|
||||||
|
|
||||||
CHECK(pkey != NULL);
|
|
||||||
result = EC_KEY_set_group(pkey, data->ec_group);
|
|
||||||
CHECK(result);
|
|
||||||
result = (o2i_ECPublicKey(&pkey, &pubkey, data->pubkeylen)) != NULL;
|
|
||||||
CHECK(result);
|
|
||||||
result = ECDSA_verify(0, &data->msg[0], sizeof(data->msg), &data->sig[0], data->siglen, pkey) == (i == 0);
|
|
||||||
CHECK(result);
|
|
||||||
EC_KEY_free(pkey);
|
|
||||||
}
|
|
||||||
data->sig[data->siglen - 1] ^= (i & 0xFF);
|
|
||||||
data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
|
|
||||||
data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
int main(void) {
|
|
||||||
int i;
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
benchmark_verify_t data;
|
|
||||||
|
|
||||||
data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
|
|
||||||
|
|
||||||
for (i = 0; i < 32; i++) {
|
|
||||||
data.msg[i] = 1 + i;
|
|
||||||
}
|
|
||||||
for (i = 0; i < 32; i++) {
|
|
||||||
data.key[i] = 33 + i;
|
|
||||||
}
|
|
||||||
data.siglen = 72;
|
|
||||||
CHECK(secp256k1_ecdsa_sign(data.ctx, &sig, data.msg, data.key, NULL, NULL));
|
|
||||||
CHECK(secp256k1_ecdsa_signature_serialize_der(data.ctx, data.sig, &data.siglen, &sig));
|
|
||||||
CHECK(secp256k1_ec_pubkey_create(data.ctx, &pubkey, data.key));
|
|
||||||
data.pubkeylen = 33;
|
|
||||||
CHECK(secp256k1_ec_pubkey_serialize(data.ctx, data.pubkey, &data.pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
|
|
||||||
|
|
||||||
run_benchmark("ecdsa_verify", benchmark_verify, NULL, NULL, &data, 10, 20000);
|
|
||||||
#ifdef ENABLE_OPENSSL_TESTS
|
|
||||||
data.ec_group = EC_GROUP_new_by_curve_name(NID_secp256k1);
|
|
||||||
run_benchmark("ecdsa_verify_openssl", benchmark_verify_openssl, NULL, NULL, &data, 10, 20000);
|
|
||||||
EC_GROUP_free(data.ec_group);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
secp256k1_context_destroy(data.ctx);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECDSA_H
|
|
||||||
#define SECP256K1_ECDSA_H
|
|
||||||
|
|
||||||
#include <stddef.h>
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "group.h"
|
|
||||||
#include "ecmult.h"
|
|
||||||
|
|
||||||
static int secp256k1_ecdsa_sig_parse(secp256k1_scalar *r, secp256k1_scalar *s, const unsigned char *sig, size_t size);
|
|
||||||
static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar *r, const secp256k1_scalar *s);
|
|
||||||
static int secp256k1_ecdsa_sig_verify(const secp256k1_ecmult_context *ctx, const secp256k1_scalar* r, const secp256k1_scalar* s, const secp256k1_ge *pubkey, const secp256k1_scalar *message);
|
|
||||||
static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECDSA_H */
|
|
||||||
@ -1,319 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013-2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECDSA_IMPL_H
|
|
||||||
#define SECP256K1_ECDSA_IMPL_H
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "field.h"
|
|
||||||
#include "group.h"
|
|
||||||
#include "ecmult.h"
|
|
||||||
#include "ecmult_gen.h"
|
|
||||||
#include "ecdsa.h"
|
|
||||||
|
|
||||||
/** Group order for secp256k1 defined as 'n' in "Standards for Efficient Cryptography" (SEC2) 2.7.1
|
|
||||||
* sage: for t in xrange(1023, -1, -1):
|
|
||||||
* .. p = 2**256 - 2**32 - t
|
|
||||||
* .. if p.is_prime():
|
|
||||||
* .. print '%x'%p
|
|
||||||
* .. break
|
|
||||||
* 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'
|
|
||||||
* sage: a = 0
|
|
||||||
* sage: b = 7
|
|
||||||
* sage: F = FiniteField (p)
|
|
||||||
* sage: '%x' % (EllipticCurve ([F (a), F (b)]).order())
|
|
||||||
* 'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'
|
|
||||||
*/
|
|
||||||
static const secp256k1_fe secp256k1_ecdsa_const_order_as_fe = SECP256K1_FE_CONST(
|
|
||||||
0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
|
|
||||||
0xBAAEDCE6UL, 0xAF48A03BUL, 0xBFD25E8CUL, 0xD0364141UL
|
|
||||||
);
|
|
||||||
|
|
||||||
/** Difference between field and order, values 'p' and 'n' values defined in
|
|
||||||
* "Standards for Efficient Cryptography" (SEC2) 2.7.1.
|
|
||||||
* sage: p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
|
|
||||||
* sage: a = 0
|
|
||||||
* sage: b = 7
|
|
||||||
* sage: F = FiniteField (p)
|
|
||||||
* sage: '%x' % (p - EllipticCurve ([F (a), F (b)]).order())
|
|
||||||
* '14551231950b75fc4402da1722fc9baee'
|
|
||||||
*/
|
|
||||||
static const secp256k1_fe secp256k1_ecdsa_const_p_minus_order = SECP256K1_FE_CONST(
|
|
||||||
0, 0, 0, 1, 0x45512319UL, 0x50B75FC4UL, 0x402DA172UL, 0x2FC9BAEEUL
|
|
||||||
);
|
|
||||||
|
|
||||||
static int secp256k1_der_read_len(size_t *len, const unsigned char **sigp, const unsigned char *sigend) {
|
|
||||||
size_t lenleft;
|
|
||||||
unsigned char b1;
|
|
||||||
VERIFY_CHECK(len != NULL);
|
|
||||||
*len = 0;
|
|
||||||
if (*sigp >= sigend) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
b1 = *((*sigp)++);
|
|
||||||
if (b1 == 0xFF) {
|
|
||||||
/* X.690-0207 8.1.3.5.c the value 0xFF shall not be used. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if ((b1 & 0x80) == 0) {
|
|
||||||
/* X.690-0207 8.1.3.4 short form length octets */
|
|
||||||
*len = b1;
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
if (b1 == 0x80) {
|
|
||||||
/* Indefinite length is not allowed in DER. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
/* X.690-207 8.1.3.5 long form length octets */
|
|
||||||
lenleft = b1 & 0x7F; /* lenleft is at least 1 */
|
|
||||||
if (lenleft > (size_t)(sigend - *sigp)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (**sigp == 0) {
|
|
||||||
/* Not the shortest possible length encoding. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (lenleft > sizeof(size_t)) {
|
|
||||||
/* The resulting length would exceed the range of a size_t, so
|
|
||||||
* certainly longer than the passed array size.
|
|
||||||
*/
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
while (lenleft > 0) {
|
|
||||||
*len = (*len << 8) | **sigp;
|
|
||||||
(*sigp)++;
|
|
||||||
lenleft--;
|
|
||||||
}
|
|
||||||
if (*len > (size_t)(sigend - *sigp)) {
|
|
||||||
/* Result exceeds the length of the passed array. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (*len < 128) {
|
|
||||||
/* Not the shortest possible length encoding. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_der_parse_integer(secp256k1_scalar *r, const unsigned char **sig, const unsigned char *sigend) {
|
|
||||||
int overflow = 0;
|
|
||||||
unsigned char ra[32] = {0};
|
|
||||||
size_t rlen;
|
|
||||||
|
|
||||||
if (*sig == sigend || **sig != 0x02) {
|
|
||||||
/* Not a primitive integer (X.690-0207 8.3.1). */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
(*sig)++;
|
|
||||||
if (secp256k1_der_read_len(&rlen, sig, sigend) == 0) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (rlen == 0 || *sig + rlen > sigend) {
|
|
||||||
/* Exceeds bounds or not at least length 1 (X.690-0207 8.3.1). */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (**sig == 0x00 && rlen > 1 && (((*sig)[1]) & 0x80) == 0x00) {
|
|
||||||
/* Excessive 0x00 padding. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (**sig == 0xFF && rlen > 1 && (((*sig)[1]) & 0x80) == 0x80) {
|
|
||||||
/* Excessive 0xFF padding. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if ((**sig & 0x80) == 0x80) {
|
|
||||||
/* Negative. */
|
|
||||||
overflow = 1;
|
|
||||||
}
|
|
||||||
/* There is at most one leading zero byte:
|
|
||||||
* if there were two leading zero bytes, we would have failed and returned 0
|
|
||||||
* because of excessive 0x00 padding already. */
|
|
||||||
if (rlen > 0 && **sig == 0) {
|
|
||||||
/* Skip leading zero byte */
|
|
||||||
rlen--;
|
|
||||||
(*sig)++;
|
|
||||||
}
|
|
||||||
if (rlen > 32) {
|
|
||||||
overflow = 1;
|
|
||||||
}
|
|
||||||
if (!overflow) {
|
|
||||||
memcpy(ra + 32 - rlen, *sig, rlen);
|
|
||||||
secp256k1_scalar_set_b32(r, ra, &overflow);
|
|
||||||
}
|
|
||||||
if (overflow) {
|
|
||||||
secp256k1_scalar_set_int(r, 0);
|
|
||||||
}
|
|
||||||
(*sig) += rlen;
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ecdsa_sig_parse(secp256k1_scalar *rr, secp256k1_scalar *rs, const unsigned char *sig, size_t size) {
|
|
||||||
const unsigned char *sigend = sig + size;
|
|
||||||
size_t rlen;
|
|
||||||
if (sig == sigend || *(sig++) != 0x30) {
|
|
||||||
/* The encoding doesn't start with a constructed sequence (X.690-0207 8.9.1). */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (secp256k1_der_read_len(&rlen, &sig, sigend) == 0) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (rlen != (size_t)(sigend - sig)) {
|
|
||||||
/* Tuple exceeds bounds or garage after tuple. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!secp256k1_der_parse_integer(rr, &sig, sigend)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (!secp256k1_der_parse_integer(rs, &sig, sigend)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (sig != sigend) {
|
|
||||||
/* Trailing garbage inside tuple. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar* ar, const secp256k1_scalar* as) {
|
|
||||||
unsigned char r[33] = {0}, s[33] = {0};
|
|
||||||
unsigned char *rp = r, *sp = s;
|
|
||||||
size_t lenR = 33, lenS = 33;
|
|
||||||
secp256k1_scalar_get_b32(&r[1], ar);
|
|
||||||
secp256k1_scalar_get_b32(&s[1], as);
|
|
||||||
while (lenR > 1 && rp[0] == 0 && rp[1] < 0x80) { lenR--; rp++; }
|
|
||||||
while (lenS > 1 && sp[0] == 0 && sp[1] < 0x80) { lenS--; sp++; }
|
|
||||||
if (*size < 6+lenS+lenR) {
|
|
||||||
*size = 6 + lenS + lenR;
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
*size = 6 + lenS + lenR;
|
|
||||||
sig[0] = 0x30;
|
|
||||||
sig[1] = 4 + lenS + lenR;
|
|
||||||
sig[2] = 0x02;
|
|
||||||
sig[3] = lenR;
|
|
||||||
memcpy(sig+4, rp, lenR);
|
|
||||||
sig[4+lenR] = 0x02;
|
|
||||||
sig[5+lenR] = lenS;
|
|
||||||
memcpy(sig+lenR+6, sp, lenS);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ecdsa_sig_verify(const secp256k1_ecmult_context *ctx, const secp256k1_scalar *sigr, const secp256k1_scalar *sigs, const secp256k1_ge *pubkey, const secp256k1_scalar *message) {
|
|
||||||
unsigned char c[32];
|
|
||||||
secp256k1_scalar sn, u1, u2;
|
|
||||||
#if !defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
secp256k1_fe xr;
|
|
||||||
#endif
|
|
||||||
secp256k1_gej pubkeyj;
|
|
||||||
secp256k1_gej pr;
|
|
||||||
|
|
||||||
if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_inverse_var(&sn, sigs);
|
|
||||||
secp256k1_scalar_mul(&u1, &sn, message);
|
|
||||||
secp256k1_scalar_mul(&u2, &sn, sigr);
|
|
||||||
secp256k1_gej_set_ge(&pubkeyj, pubkey);
|
|
||||||
secp256k1_ecmult(ctx, &pr, &pubkeyj, &u2, &u1);
|
|
||||||
if (secp256k1_gej_is_infinity(&pr)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
#if defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
{
|
|
||||||
secp256k1_scalar computed_r;
|
|
||||||
secp256k1_ge pr_ge;
|
|
||||||
secp256k1_ge_set_gej(&pr_ge, &pr);
|
|
||||||
secp256k1_fe_normalize(&pr_ge.x);
|
|
||||||
|
|
||||||
secp256k1_fe_get_b32(c, &pr_ge.x);
|
|
||||||
secp256k1_scalar_set_b32(&computed_r, c, NULL);
|
|
||||||
return secp256k1_scalar_eq(sigr, &computed_r);
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
secp256k1_scalar_get_b32(c, sigr);
|
|
||||||
secp256k1_fe_set_b32(&xr, c);
|
|
||||||
|
|
||||||
/** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n)
|
|
||||||
* in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p),
|
|
||||||
* compute the remainder modulo n, and compare it to xr. However:
|
|
||||||
*
|
|
||||||
* xr == X(pr) mod n
|
|
||||||
* <=> exists h. (xr + h * n < p && xr + h * n == X(pr))
|
|
||||||
* [Since 2 * n > p, h can only be 0 or 1]
|
|
||||||
* <=> (xr == X(pr)) || (xr + n < p && xr + n == X(pr))
|
|
||||||
* [In Jacobian coordinates, X(pr) is pr.x / pr.z^2 mod p]
|
|
||||||
* <=> (xr == pr.x / pr.z^2 mod p) || (xr + n < p && xr + n == pr.x / pr.z^2 mod p)
|
|
||||||
* [Multiplying both sides of the equations by pr.z^2 mod p]
|
|
||||||
* <=> (xr * pr.z^2 mod p == pr.x) || (xr + n < p && (xr + n) * pr.z^2 mod p == pr.x)
|
|
||||||
*
|
|
||||||
* Thus, we can avoid the inversion, but we have to check both cases separately.
|
|
||||||
* secp256k1_gej_eq_x implements the (xr * pr.z^2 mod p == pr.x) test.
|
|
||||||
*/
|
|
||||||
if (secp256k1_gej_eq_x_var(&xr, &pr)) {
|
|
||||||
/* xr * pr.z^2 mod p == pr.x, so the signature is valid. */
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
if (secp256k1_fe_cmp_var(&xr, &secp256k1_ecdsa_const_p_minus_order) >= 0) {
|
|
||||||
/* xr + n >= p, so we can skip testing the second case. */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_fe_add(&xr, &secp256k1_ecdsa_const_order_as_fe);
|
|
||||||
if (secp256k1_gej_eq_x_var(&xr, &pr)) {
|
|
||||||
/* (xr + n) * pr.z^2 mod p == pr.x, so the signature is valid. */
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
return 0;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) {
|
|
||||||
unsigned char b[32];
|
|
||||||
secp256k1_gej rp;
|
|
||||||
secp256k1_ge r;
|
|
||||||
secp256k1_scalar n;
|
|
||||||
int overflow = 0;
|
|
||||||
|
|
||||||
secp256k1_ecmult_gen(ctx, &rp, nonce);
|
|
||||||
secp256k1_ge_set_gej(&r, &rp);
|
|
||||||
secp256k1_fe_normalize(&r.x);
|
|
||||||
secp256k1_fe_normalize(&r.y);
|
|
||||||
secp256k1_fe_get_b32(b, &r.x);
|
|
||||||
secp256k1_scalar_set_b32(sigr, b, &overflow);
|
|
||||||
/* These two conditions should be checked before calling */
|
|
||||||
VERIFY_CHECK(!secp256k1_scalar_is_zero(sigr));
|
|
||||||
VERIFY_CHECK(overflow == 0);
|
|
||||||
|
|
||||||
if (recid) {
|
|
||||||
/* The overflow condition is cryptographically unreachable as hitting it requires finding the discrete log
|
|
||||||
* of some P where P.x >= order, and only 1 in about 2^127 points meet this criteria.
|
|
||||||
*/
|
|
||||||
*recid = (overflow ? 2 : 0) | (secp256k1_fe_is_odd(&r.y) ? 1 : 0);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(&n, sigr, seckey);
|
|
||||||
secp256k1_scalar_add(&n, &n, message);
|
|
||||||
secp256k1_scalar_inverse(sigs, nonce);
|
|
||||||
secp256k1_scalar_mul(sigs, sigs, &n);
|
|
||||||
secp256k1_scalar_clear(&n);
|
|
||||||
secp256k1_gej_clear(&rp);
|
|
||||||
secp256k1_ge_clear(&r);
|
|
||||||
if (secp256k1_scalar_is_zero(sigs)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (secp256k1_scalar_is_high(sigs)) {
|
|
||||||
secp256k1_scalar_negate(sigs, sigs);
|
|
||||||
if (recid) {
|
|
||||||
*recid ^= 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECDSA_IMPL_H */
|
|
||||||
@ -1,25 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECKEY_H
|
|
||||||
#define SECP256K1_ECKEY_H
|
|
||||||
|
|
||||||
#include <stddef.h>
|
|
||||||
|
|
||||||
#include "group.h"
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "ecmult.h"
|
|
||||||
#include "ecmult_gen.h"
|
|
||||||
|
|
||||||
static int secp256k1_eckey_pubkey_parse(secp256k1_ge *elem, const unsigned char *pub, size_t size);
|
|
||||||
static int secp256k1_eckey_pubkey_serialize(secp256k1_ge *elem, unsigned char *pub, size_t *size, int compressed);
|
|
||||||
|
|
||||||
static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar *key, const secp256k1_scalar *tweak);
|
|
||||||
static int secp256k1_eckey_pubkey_tweak_add(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak);
|
|
||||||
static int secp256k1_eckey_privkey_tweak_mul(secp256k1_scalar *key, const secp256k1_scalar *tweak);
|
|
||||||
static int secp256k1_eckey_pubkey_tweak_mul(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECKEY_H */
|
|
||||||
@ -1,100 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECKEY_IMPL_H
|
|
||||||
#define SECP256K1_ECKEY_IMPL_H
|
|
||||||
|
|
||||||
#include "eckey.h"
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "field.h"
|
|
||||||
#include "group.h"
|
|
||||||
#include "ecmult_gen.h"
|
|
||||||
|
|
||||||
static int secp256k1_eckey_pubkey_parse(secp256k1_ge *elem, const unsigned char *pub, size_t size) {
|
|
||||||
if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
|
|
||||||
secp256k1_fe x;
|
|
||||||
return secp256k1_fe_set_b32(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
|
|
||||||
} else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
|
|
||||||
secp256k1_fe x, y;
|
|
||||||
if (!secp256k1_fe_set_b32(&x, pub+1) || !secp256k1_fe_set_b32(&y, pub+33)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_ge_set_xy(elem, &x, &y);
|
|
||||||
if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
|
|
||||||
secp256k1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
return secp256k1_ge_is_valid_var(elem);
|
|
||||||
} else {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_eckey_pubkey_serialize(secp256k1_ge *elem, unsigned char *pub, size_t *size, int compressed) {
|
|
||||||
if (secp256k1_ge_is_infinity(elem)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_fe_normalize_var(&elem->x);
|
|
||||||
secp256k1_fe_normalize_var(&elem->y);
|
|
||||||
secp256k1_fe_get_b32(&pub[1], &elem->x);
|
|
||||||
if (compressed) {
|
|
||||||
*size = 33;
|
|
||||||
pub[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
|
|
||||||
} else {
|
|
||||||
*size = 65;
|
|
||||||
pub[0] = SECP256K1_TAG_PUBKEY_UNCOMPRESSED;
|
|
||||||
secp256k1_fe_get_b32(&pub[33], &elem->y);
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar *key, const secp256k1_scalar *tweak) {
|
|
||||||
secp256k1_scalar_add(key, key, tweak);
|
|
||||||
if (secp256k1_scalar_is_zero(key)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_eckey_pubkey_tweak_add(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak) {
|
|
||||||
secp256k1_gej pt;
|
|
||||||
secp256k1_scalar one;
|
|
||||||
secp256k1_gej_set_ge(&pt, key);
|
|
||||||
secp256k1_scalar_set_int(&one, 1);
|
|
||||||
secp256k1_ecmult(ctx, &pt, &pt, &one, tweak);
|
|
||||||
|
|
||||||
if (secp256k1_gej_is_infinity(&pt)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_ge_set_gej(key, &pt);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_eckey_privkey_tweak_mul(secp256k1_scalar *key, const secp256k1_scalar *tweak) {
|
|
||||||
if (secp256k1_scalar_is_zero(tweak)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_mul(key, key, tweak);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_eckey_pubkey_tweak_mul(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak) {
|
|
||||||
secp256k1_scalar zero;
|
|
||||||
secp256k1_gej pt;
|
|
||||||
if (secp256k1_scalar_is_zero(tweak)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_set_int(&zero, 0);
|
|
||||||
secp256k1_gej_set_ge(&pt, key);
|
|
||||||
secp256k1_ecmult(ctx, &pt, &pt, tweak, &zero);
|
|
||||||
secp256k1_ge_set_gej(key, &pt);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECKEY_IMPL_H */
|
|
||||||
@ -1,48 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014, 2017 Pieter Wuille, Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECMULT_H
|
|
||||||
#define SECP256K1_ECMULT_H
|
|
||||||
|
|
||||||
#include "num.h"
|
|
||||||
#include "group.h"
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "scratch.h"
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
/* For accelerating the computation of a*P + b*G: */
|
|
||||||
secp256k1_ge_storage (*pre_g)[]; /* odd multiples of the generator */
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
secp256k1_ge_storage (*pre_g_128)[]; /* odd multiples of 2^128*generator */
|
|
||||||
#endif
|
|
||||||
} secp256k1_ecmult_context;
|
|
||||||
|
|
||||||
static const size_t SECP256K1_ECMULT_CONTEXT_PREALLOCATED_SIZE;
|
|
||||||
static void secp256k1_ecmult_context_init(secp256k1_ecmult_context *ctx);
|
|
||||||
static void secp256k1_ecmult_context_build(secp256k1_ecmult_context *ctx, void **prealloc);
|
|
||||||
static void secp256k1_ecmult_context_finalize_memcpy(secp256k1_ecmult_context *dst, const secp256k1_ecmult_context *src);
|
|
||||||
static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context *ctx);
|
|
||||||
static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context *ctx);
|
|
||||||
|
|
||||||
/** Double multiply: R = na*A + ng*G */
|
|
||||||
static void secp256k1_ecmult(const secp256k1_ecmult_context *ctx, secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng);
|
|
||||||
|
|
||||||
typedef int (secp256k1_ecmult_multi_callback)(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *data);
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Multi-multiply: R = inp_g_sc * G + sum_i ni * Ai.
|
|
||||||
* Chooses the right algorithm for a given number of points and scratch space
|
|
||||||
* size. Resets and overwrites the given scratch space. If the points do not
|
|
||||||
* fit in the scratch space the algorithm is repeatedly run with batches of
|
|
||||||
* points. If no scratch space is given then a simple algorithm is used that
|
|
||||||
* simply multiplies the points with the corresponding scalars and adds them up.
|
|
||||||
* Returns: 1 on success (including when inp_g_sc is NULL and n is 0)
|
|
||||||
* 0 if there is not enough scratch space for a single point or
|
|
||||||
* callback returns 0
|
|
||||||
*/
|
|
||||||
static int secp256k1_ecmult_multi_var(const secp256k1_callback* error_callback, const secp256k1_ecmult_context *ctx, secp256k1_scratch *scratch, secp256k1_gej *r, const secp256k1_scalar *inp_g_sc, secp256k1_ecmult_multi_callback cb, void *cbdata, size_t n);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECMULT_H */
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECMULT_CONST_H
|
|
||||||
#define SECP256K1_ECMULT_CONST_H
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "group.h"
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Multiply: R = q*A (in constant-time)
|
|
||||||
* Here `bits` should be set to the maximum bitlength of the _absolute value_ of `q`, plus
|
|
||||||
* one because we internally sometimes add 2 to the number during the WNAF conversion.
|
|
||||||
*/
|
|
||||||
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *q, int bits);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECMULT_CONST_H */
|
|
||||||
@ -1,261 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Pieter Wuille, Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECMULT_CONST_IMPL_H
|
|
||||||
#define SECP256K1_ECMULT_CONST_IMPL_H
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "group.h"
|
|
||||||
#include "ecmult_const.h"
|
|
||||||
#include "ecmult_impl.h"
|
|
||||||
|
|
||||||
/* This is like `ECMULT_TABLE_GET_GE` but is constant time */
|
|
||||||
#define ECMULT_CONST_TABLE_GET_GE(r,pre,n,w) do { \
|
|
||||||
int m; \
|
|
||||||
int abs_n = (n) * (((n) > 0) * 2 - 1); \
|
|
||||||
int idx_n = abs_n / 2; \
|
|
||||||
secp256k1_fe neg_y; \
|
|
||||||
VERIFY_CHECK(((n) & 1) == 1); \
|
|
||||||
VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \
|
|
||||||
VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \
|
|
||||||
VERIFY_SETUP(secp256k1_fe_clear(&(r)->x)); \
|
|
||||||
VERIFY_SETUP(secp256k1_fe_clear(&(r)->y)); \
|
|
||||||
for (m = 0; m < ECMULT_TABLE_SIZE(w); m++) { \
|
|
||||||
/* This loop is used to avoid secret data in array indices. See
|
|
||||||
* the comment in ecmult_gen_impl.h for rationale. */ \
|
|
||||||
secp256k1_fe_cmov(&(r)->x, &(pre)[m].x, m == idx_n); \
|
|
||||||
secp256k1_fe_cmov(&(r)->y, &(pre)[m].y, m == idx_n); \
|
|
||||||
} \
|
|
||||||
(r)->infinity = 0; \
|
|
||||||
secp256k1_fe_negate(&neg_y, &(r)->y, 1); \
|
|
||||||
secp256k1_fe_cmov(&(r)->y, &neg_y, (n) != abs_n); \
|
|
||||||
} while(0)
|
|
||||||
|
|
||||||
|
|
||||||
/** Convert a number to WNAF notation.
|
|
||||||
* The number becomes represented by sum(2^{wi} * wnaf[i], i=0..WNAF_SIZE(w)+1) - return_val.
|
|
||||||
* It has the following guarantees:
|
|
||||||
* - each wnaf[i] an odd integer between -(1 << w) and (1 << w)
|
|
||||||
* - each wnaf[i] is nonzero
|
|
||||||
* - the number of words set is always WNAF_SIZE(w) + 1
|
|
||||||
*
|
|
||||||
* Adapted from `The Width-w NAF Method Provides Small Memory and Fast Elliptic Scalar
|
|
||||||
* Multiplications Secure against Side Channel Attacks`, Okeya and Tagaki. M. Joye (Ed.)
|
|
||||||
* CT-RSA 2003, LNCS 2612, pp. 328-443, 2003. Springer-Verlagy Berlin Heidelberg 2003
|
|
||||||
*
|
|
||||||
* Numbers reference steps of `Algorithm SPA-resistant Width-w NAF with Odd Scalar` on pp. 335
|
|
||||||
*/
|
|
||||||
static int secp256k1_wnaf_const(int *wnaf, const secp256k1_scalar *scalar, int w, int size) {
|
|
||||||
int global_sign;
|
|
||||||
int skew = 0;
|
|
||||||
int word = 0;
|
|
||||||
|
|
||||||
/* 1 2 3 */
|
|
||||||
int u_last;
|
|
||||||
int u;
|
|
||||||
|
|
||||||
int flip;
|
|
||||||
int bit;
|
|
||||||
secp256k1_scalar s;
|
|
||||||
int not_neg_one;
|
|
||||||
|
|
||||||
VERIFY_CHECK(w > 0);
|
|
||||||
VERIFY_CHECK(size > 0);
|
|
||||||
|
|
||||||
/* Note that we cannot handle even numbers by negating them to be odd, as is
|
|
||||||
* done in other implementations, since if our scalars were specified to have
|
|
||||||
* width < 256 for performance reasons, their negations would have width 256
|
|
||||||
* and we'd lose any performance benefit. Instead, we use a technique from
|
|
||||||
* Section 4.2 of the Okeya/Tagaki paper, which is to add either 1 (for even)
|
|
||||||
* or 2 (for odd) to the number we are encoding, returning a skew value indicating
|
|
||||||
* this, and having the caller compensate after doing the multiplication.
|
|
||||||
*
|
|
||||||
* In fact, we _do_ want to negate numbers to minimize their bit-lengths (and in
|
|
||||||
* particular, to ensure that the outputs from the endomorphism-split fit into
|
|
||||||
* 128 bits). If we negate, the parity of our number flips, inverting which of
|
|
||||||
* {1, 2} we want to add to the scalar when ensuring that it's odd. Further
|
|
||||||
* complicating things, -1 interacts badly with `secp256k1_scalar_cadd_bit` and
|
|
||||||
* we need to special-case it in this logic. */
|
|
||||||
flip = secp256k1_scalar_is_high(scalar);
|
|
||||||
/* We add 1 to even numbers, 2 to odd ones, noting that negation flips parity */
|
|
||||||
bit = flip ^ !secp256k1_scalar_is_even(scalar);
|
|
||||||
/* We check for negative one, since adding 2 to it will cause an overflow */
|
|
||||||
secp256k1_scalar_negate(&s, scalar);
|
|
||||||
not_neg_one = !secp256k1_scalar_is_one(&s);
|
|
||||||
s = *scalar;
|
|
||||||
secp256k1_scalar_cadd_bit(&s, bit, not_neg_one);
|
|
||||||
/* If we had negative one, flip == 1, s.d[0] == 0, bit == 1, so caller expects
|
|
||||||
* that we added two to it and flipped it. In fact for -1 these operations are
|
|
||||||
* identical. We only flipped, but since skewing is required (in the sense that
|
|
||||||
* the skew must be 1 or 2, never zero) and flipping is not, we need to change
|
|
||||||
* our flags to claim that we only skewed. */
|
|
||||||
global_sign = secp256k1_scalar_cond_negate(&s, flip);
|
|
||||||
global_sign *= not_neg_one * 2 - 1;
|
|
||||||
skew = 1 << bit;
|
|
||||||
|
|
||||||
/* 4 */
|
|
||||||
u_last = secp256k1_scalar_shr_int(&s, w);
|
|
||||||
do {
|
|
||||||
int sign;
|
|
||||||
int even;
|
|
||||||
|
|
||||||
/* 4.1 4.4 */
|
|
||||||
u = secp256k1_scalar_shr_int(&s, w);
|
|
||||||
/* 4.2 */
|
|
||||||
even = ((u & 1) == 0);
|
|
||||||
sign = 2 * (u_last > 0) - 1;
|
|
||||||
u += sign * even;
|
|
||||||
u_last -= sign * even * (1 << w);
|
|
||||||
|
|
||||||
/* 4.3, adapted for global sign change */
|
|
||||||
wnaf[word++] = u_last * global_sign;
|
|
||||||
|
|
||||||
u_last = u;
|
|
||||||
} while (word * w < size);
|
|
||||||
wnaf[word] = u * global_sign;
|
|
||||||
|
|
||||||
VERIFY_CHECK(secp256k1_scalar_is_zero(&s));
|
|
||||||
VERIFY_CHECK(word == WNAF_SIZE_BITS(size, w));
|
|
||||||
return skew;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *scalar, int size) {
|
|
||||||
secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
|
|
||||||
secp256k1_ge tmpa;
|
|
||||||
secp256k1_fe Z;
|
|
||||||
|
|
||||||
int skew_1;
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
secp256k1_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];
|
|
||||||
int wnaf_lam[1 + WNAF_SIZE(WINDOW_A - 1)];
|
|
||||||
int skew_lam;
|
|
||||||
secp256k1_scalar q_1, q_lam;
|
|
||||||
#endif
|
|
||||||
int wnaf_1[1 + WNAF_SIZE(WINDOW_A - 1)];
|
|
||||||
|
|
||||||
int i;
|
|
||||||
|
|
||||||
/* build wnaf representation for q. */
|
|
||||||
int rsize = size;
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (size > 128) {
|
|
||||||
rsize = 128;
|
|
||||||
/* split q into q_1 and q_lam (where q = q_1 + q_lam*lambda, and q_1 and q_lam are ~128 bit) */
|
|
||||||
secp256k1_scalar_split_lambda(&q_1, &q_lam, scalar);
|
|
||||||
skew_1 = secp256k1_wnaf_const(wnaf_1, &q_1, WINDOW_A - 1, 128);
|
|
||||||
skew_lam = secp256k1_wnaf_const(wnaf_lam, &q_lam, WINDOW_A - 1, 128);
|
|
||||||
} else
|
|
||||||
#endif
|
|
||||||
{
|
|
||||||
skew_1 = secp256k1_wnaf_const(wnaf_1, scalar, WINDOW_A - 1, size);
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
skew_lam = 0;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Calculate odd multiples of a.
|
|
||||||
* All multiples are brought to the same Z 'denominator', which is stored
|
|
||||||
* in Z. Due to secp256k1' isomorphism we can do all operations pretending
|
|
||||||
* that the Z coordinate was 1, use affine addition formulae, and correct
|
|
||||||
* the Z coordinate of the result once at the end.
|
|
||||||
*/
|
|
||||||
secp256k1_gej_set_ge(r, a);
|
|
||||||
secp256k1_ecmult_odd_multiples_table_globalz_windowa(pre_a, &Z, r);
|
|
||||||
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
|
|
||||||
secp256k1_fe_normalize_weak(&pre_a[i].y);
|
|
||||||
}
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (size > 128) {
|
|
||||||
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
|
|
||||||
secp256k1_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* first loop iteration (separated out so we can directly set r, rather
|
|
||||||
* than having it start at infinity, get doubled several times, then have
|
|
||||||
* its new value added to it) */
|
|
||||||
i = wnaf_1[WNAF_SIZE_BITS(rsize, WINDOW_A - 1)];
|
|
||||||
VERIFY_CHECK(i != 0);
|
|
||||||
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, i, WINDOW_A);
|
|
||||||
secp256k1_gej_set_ge(r, &tmpa);
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (size > 128) {
|
|
||||||
i = wnaf_lam[WNAF_SIZE_BITS(rsize, WINDOW_A - 1)];
|
|
||||||
VERIFY_CHECK(i != 0);
|
|
||||||
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, i, WINDOW_A);
|
|
||||||
secp256k1_gej_add_ge(r, r, &tmpa);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
/* remaining loop iterations */
|
|
||||||
for (i = WNAF_SIZE_BITS(rsize, WINDOW_A - 1) - 1; i >= 0; i--) {
|
|
||||||
int n;
|
|
||||||
int j;
|
|
||||||
for (j = 0; j < WINDOW_A - 1; ++j) {
|
|
||||||
secp256k1_gej_double_nonzero(r, r, NULL);
|
|
||||||
}
|
|
||||||
|
|
||||||
n = wnaf_1[i];
|
|
||||||
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A);
|
|
||||||
VERIFY_CHECK(n != 0);
|
|
||||||
secp256k1_gej_add_ge(r, r, &tmpa);
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (size > 128) {
|
|
||||||
n = wnaf_lam[i];
|
|
||||||
ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A);
|
|
||||||
VERIFY_CHECK(n != 0);
|
|
||||||
secp256k1_gej_add_ge(r, r, &tmpa);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_fe_mul(&r->z, &r->z, &Z);
|
|
||||||
|
|
||||||
{
|
|
||||||
/* Correct for wNAF skew */
|
|
||||||
secp256k1_ge correction = *a;
|
|
||||||
secp256k1_ge_storage correction_1_stor;
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
secp256k1_ge_storage correction_lam_stor;
|
|
||||||
#endif
|
|
||||||
secp256k1_ge_storage a2_stor;
|
|
||||||
secp256k1_gej tmpj;
|
|
||||||
secp256k1_gej_set_ge(&tmpj, &correction);
|
|
||||||
secp256k1_gej_double_var(&tmpj, &tmpj, NULL);
|
|
||||||
secp256k1_ge_set_gej(&correction, &tmpj);
|
|
||||||
secp256k1_ge_to_storage(&correction_1_stor, a);
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (size > 128) {
|
|
||||||
secp256k1_ge_to_storage(&correction_lam_stor, a);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
secp256k1_ge_to_storage(&a2_stor, &correction);
|
|
||||||
|
|
||||||
/* For odd numbers this is 2a (so replace it), for even ones a (so no-op) */
|
|
||||||
secp256k1_ge_storage_cmov(&correction_1_stor, &a2_stor, skew_1 == 2);
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (size > 128) {
|
|
||||||
secp256k1_ge_storage_cmov(&correction_lam_stor, &a2_stor, skew_lam == 2);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Apply the correction */
|
|
||||||
secp256k1_ge_from_storage(&correction, &correction_1_stor);
|
|
||||||
secp256k1_ge_neg(&correction, &correction);
|
|
||||||
secp256k1_gej_add_ge(r, r, &correction);
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
if (size > 128) {
|
|
||||||
secp256k1_ge_from_storage(&correction, &correction_lam_stor);
|
|
||||||
secp256k1_ge_neg(&correction, &correction);
|
|
||||||
secp256k1_ge_mul_lambda(&correction, &correction);
|
|
||||||
secp256k1_gej_add_ge(r, r, &correction);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECMULT_CONST_IMPL_H */
|
|
||||||
@ -1,50 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECMULT_GEN_H
|
|
||||||
#define SECP256K1_ECMULT_GEN_H
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "group.h"
|
|
||||||
|
|
||||||
#if ECMULT_GEN_PREC_BITS != 2 && ECMULT_GEN_PREC_BITS != 4 && ECMULT_GEN_PREC_BITS != 8
|
|
||||||
# error "Set ECMULT_GEN_PREC_BITS to 2, 4 or 8."
|
|
||||||
#endif
|
|
||||||
#define ECMULT_GEN_PREC_B ECMULT_GEN_PREC_BITS
|
|
||||||
#define ECMULT_GEN_PREC_G (1 << ECMULT_GEN_PREC_B)
|
|
||||||
#define ECMULT_GEN_PREC_N (256 / ECMULT_GEN_PREC_B)
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
/* For accelerating the computation of a*G:
|
|
||||||
* To harden against timing attacks, use the following mechanism:
|
|
||||||
* * Break up the multiplicand into groups of PREC_B bits, called n_0, n_1, n_2, ..., n_(PREC_N-1).
|
|
||||||
* * Compute sum(n_i * (PREC_G)^i * G + U_i, i=0 ... PREC_N-1), where:
|
|
||||||
* * U_i = U * 2^i, for i=0 ... PREC_N-2
|
|
||||||
* * U_i = U * (1-2^(PREC_N-1)), for i=PREC_N-1
|
|
||||||
* where U is a point with no known corresponding scalar. Note that sum(U_i, i=0 ... PREC_N-1) = 0.
|
|
||||||
* For each i, and each of the PREC_G possible values of n_i, (n_i * (PREC_G)^i * G + U_i) is
|
|
||||||
* precomputed (call it prec(i, n_i)). The formula now becomes sum(prec(i, n_i), i=0 ... PREC_N-1).
|
|
||||||
* None of the resulting prec group elements have a known scalar, and neither do any of
|
|
||||||
* the intermediate sums while computing a*G.
|
|
||||||
*/
|
|
||||||
secp256k1_ge_storage (*prec)[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G]; /* prec[j][i] = (PREC_G)^j * i * G + U_i */
|
|
||||||
secp256k1_scalar blind;
|
|
||||||
secp256k1_gej initial;
|
|
||||||
} secp256k1_ecmult_gen_context;
|
|
||||||
|
|
||||||
static const size_t SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE;
|
|
||||||
static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context* ctx);
|
|
||||||
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context* ctx, void **prealloc);
|
|
||||||
static void secp256k1_ecmult_gen_context_finalize_memcpy(secp256k1_ecmult_gen_context *dst, const secp256k1_ecmult_gen_context* src);
|
|
||||||
static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context* ctx);
|
|
||||||
static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx);
|
|
||||||
|
|
||||||
/** Multiply with the generator: R = a*G */
|
|
||||||
static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context* ctx, secp256k1_gej *r, const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context *ctx, const unsigned char *seed32);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECMULT_GEN_H */
|
|
||||||
@ -1,211 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014, 2015 Pieter Wuille, Gregory Maxwell *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_ECMULT_GEN_IMPL_H
|
|
||||||
#define SECP256K1_ECMULT_GEN_IMPL_H
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "group.h"
|
|
||||||
#include "ecmult_gen.h"
|
|
||||||
#include "hash_impl.h"
|
|
||||||
#ifdef USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
#include "ecmult_static_context.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
static const size_t SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE = ROUND_TO_ALIGN(sizeof(*((secp256k1_ecmult_gen_context*) NULL)->prec));
|
|
||||||
#else
|
|
||||||
static const size_t SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE = 0;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context *ctx) {
|
|
||||||
ctx->prec = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context *ctx, void **prealloc) {
|
|
||||||
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
secp256k1_ge prec[ECMULT_GEN_PREC_N * ECMULT_GEN_PREC_G];
|
|
||||||
secp256k1_gej gj;
|
|
||||||
secp256k1_gej nums_gej;
|
|
||||||
int i, j;
|
|
||||||
size_t const prealloc_size = SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE;
|
|
||||||
void* const base = *prealloc;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
if (ctx->prec != NULL) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
ctx->prec = (secp256k1_ge_storage (*)[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G])manual_alloc(prealloc, prealloc_size, base, prealloc_size);
|
|
||||||
|
|
||||||
/* get the generator */
|
|
||||||
secp256k1_gej_set_ge(&gj, &secp256k1_ge_const_g);
|
|
||||||
|
|
||||||
/* Construct a group element with no known corresponding scalar (nothing up my sleeve). */
|
|
||||||
{
|
|
||||||
static const unsigned char nums_b32[33] = "The scalar for this x is unknown";
|
|
||||||
secp256k1_fe nums_x;
|
|
||||||
secp256k1_ge nums_ge;
|
|
||||||
int r;
|
|
||||||
r = secp256k1_fe_set_b32(&nums_x, nums_b32);
|
|
||||||
(void)r;
|
|
||||||
VERIFY_CHECK(r);
|
|
||||||
r = secp256k1_ge_set_xo_var(&nums_ge, &nums_x, 0);
|
|
||||||
(void)r;
|
|
||||||
VERIFY_CHECK(r);
|
|
||||||
secp256k1_gej_set_ge(&nums_gej, &nums_ge);
|
|
||||||
/* Add G to make the bits in x uniformly distributed. */
|
|
||||||
secp256k1_gej_add_ge_var(&nums_gej, &nums_gej, &secp256k1_ge_const_g, NULL);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* compute prec. */
|
|
||||||
{
|
|
||||||
secp256k1_gej precj[ECMULT_GEN_PREC_N * ECMULT_GEN_PREC_G]; /* Jacobian versions of prec. */
|
|
||||||
secp256k1_gej gbase;
|
|
||||||
secp256k1_gej numsbase;
|
|
||||||
gbase = gj; /* PREC_G^j * G */
|
|
||||||
numsbase = nums_gej; /* 2^j * nums. */
|
|
||||||
for (j = 0; j < ECMULT_GEN_PREC_N; j++) {
|
|
||||||
/* Set precj[j*PREC_G .. j*PREC_G+(PREC_G-1)] to (numsbase, numsbase + gbase, ..., numsbase + (PREC_G-1)*gbase). */
|
|
||||||
precj[j*ECMULT_GEN_PREC_G] = numsbase;
|
|
||||||
for (i = 1; i < ECMULT_GEN_PREC_G; i++) {
|
|
||||||
secp256k1_gej_add_var(&precj[j*ECMULT_GEN_PREC_G + i], &precj[j*ECMULT_GEN_PREC_G + i - 1], &gbase, NULL);
|
|
||||||
}
|
|
||||||
/* Multiply gbase by PREC_G. */
|
|
||||||
for (i = 0; i < ECMULT_GEN_PREC_B; i++) {
|
|
||||||
secp256k1_gej_double_var(&gbase, &gbase, NULL);
|
|
||||||
}
|
|
||||||
/* Multiply numbase by 2. */
|
|
||||||
secp256k1_gej_double_var(&numsbase, &numsbase, NULL);
|
|
||||||
if (j == ECMULT_GEN_PREC_N - 2) {
|
|
||||||
/* In the last iteration, numsbase is (1 - 2^j) * nums instead. */
|
|
||||||
secp256k1_gej_neg(&numsbase, &numsbase);
|
|
||||||
secp256k1_gej_add_var(&numsbase, &numsbase, &nums_gej, NULL);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
secp256k1_ge_set_all_gej_var(prec, precj, ECMULT_GEN_PREC_N * ECMULT_GEN_PREC_G);
|
|
||||||
}
|
|
||||||
for (j = 0; j < ECMULT_GEN_PREC_N; j++) {
|
|
||||||
for (i = 0; i < ECMULT_GEN_PREC_G; i++) {
|
|
||||||
secp256k1_ge_to_storage(&(*ctx->prec)[j][i], &prec[j*ECMULT_GEN_PREC_G + i]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
(void)prealloc;
|
|
||||||
ctx->prec = (secp256k1_ge_storage (*)[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G])secp256k1_ecmult_static_context;
|
|
||||||
#endif
|
|
||||||
secp256k1_ecmult_gen_blind(ctx, NULL);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx) {
|
|
||||||
return ctx->prec != NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecmult_gen_context_finalize_memcpy(secp256k1_ecmult_gen_context *dst, const secp256k1_ecmult_gen_context *src) {
|
|
||||||
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
if (src->prec != NULL) {
|
|
||||||
/* We cast to void* first to suppress a -Wcast-align warning. */
|
|
||||||
dst->prec = (secp256k1_ge_storage (*)[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G])(void*)((unsigned char*)dst + ((unsigned char*)src->prec - (unsigned char*)src));
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
(void)dst, (void)src;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context *ctx) {
|
|
||||||
secp256k1_scalar_clear(&ctx->blind);
|
|
||||||
secp256k1_gej_clear(&ctx->initial);
|
|
||||||
ctx->prec = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context *ctx, secp256k1_gej *r, const secp256k1_scalar *gn) {
|
|
||||||
secp256k1_ge add;
|
|
||||||
secp256k1_ge_storage adds;
|
|
||||||
secp256k1_scalar gnb;
|
|
||||||
int bits;
|
|
||||||
int i, j;
|
|
||||||
memset(&adds, 0, sizeof(adds));
|
|
||||||
*r = ctx->initial;
|
|
||||||
/* Blind scalar/point multiplication by computing (n-b)G + bG instead of nG. */
|
|
||||||
secp256k1_scalar_add(&gnb, gn, &ctx->blind);
|
|
||||||
add.infinity = 0;
|
|
||||||
for (j = 0; j < ECMULT_GEN_PREC_N; j++) {
|
|
||||||
bits = secp256k1_scalar_get_bits(&gnb, j * ECMULT_GEN_PREC_B, ECMULT_GEN_PREC_B);
|
|
||||||
for (i = 0; i < ECMULT_GEN_PREC_G; i++) {
|
|
||||||
/** This uses a conditional move to avoid any secret data in array indexes.
|
|
||||||
* _Any_ use of secret indexes has been demonstrated to result in timing
|
|
||||||
* sidechannels, even when the cache-line access patterns are uniform.
|
|
||||||
* See also:
|
|
||||||
* "A word of warning", CHES 2013 Rump Session, by Daniel J. Bernstein and Peter Schwabe
|
|
||||||
* (https://cryptojedi.org/peter/data/chesrump-20130822.pdf) and
|
|
||||||
* "Cache Attacks and Countermeasures: the Case of AES", RSA 2006,
|
|
||||||
* by Dag Arne Osvik, Adi Shamir, and Eran Tromer
|
|
||||||
* (http://www.tau.ac.il/~tromer/papers/cache.pdf)
|
|
||||||
*/
|
|
||||||
secp256k1_ge_storage_cmov(&adds, &(*ctx->prec)[j][i], i == bits);
|
|
||||||
}
|
|
||||||
secp256k1_ge_from_storage(&add, &adds);
|
|
||||||
secp256k1_gej_add_ge(r, r, &add);
|
|
||||||
}
|
|
||||||
bits = 0;
|
|
||||||
secp256k1_ge_clear(&add);
|
|
||||||
secp256k1_scalar_clear(&gnb);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Setup blinding values for secp256k1_ecmult_gen. */
|
|
||||||
static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context *ctx, const unsigned char *seed32) {
|
|
||||||
secp256k1_scalar b;
|
|
||||||
secp256k1_gej gb;
|
|
||||||
secp256k1_fe s;
|
|
||||||
unsigned char nonce32[32];
|
|
||||||
secp256k1_rfc6979_hmac_sha256 rng;
|
|
||||||
int retry;
|
|
||||||
unsigned char keydata[64] = {0};
|
|
||||||
if (seed32 == NULL) {
|
|
||||||
/* When seed is NULL, reset the initial point and blinding value. */
|
|
||||||
secp256k1_gej_set_ge(&ctx->initial, &secp256k1_ge_const_g);
|
|
||||||
secp256k1_gej_neg(&ctx->initial, &ctx->initial);
|
|
||||||
secp256k1_scalar_set_int(&ctx->blind, 1);
|
|
||||||
}
|
|
||||||
/* The prior blinding value (if not reset) is chained forward by including it in the hash. */
|
|
||||||
secp256k1_scalar_get_b32(nonce32, &ctx->blind);
|
|
||||||
/** Using a CSPRNG allows a failure free interface, avoids needing large amounts of random data,
|
|
||||||
* and guards against weak or adversarial seeds. This is a simpler and safer interface than
|
|
||||||
* asking the caller for blinding values directly and expecting them to retry on failure.
|
|
||||||
*/
|
|
||||||
memcpy(keydata, nonce32, 32);
|
|
||||||
if (seed32 != NULL) {
|
|
||||||
memcpy(keydata + 32, seed32, 32);
|
|
||||||
}
|
|
||||||
secp256k1_rfc6979_hmac_sha256_initialize(&rng, keydata, seed32 ? 64 : 32);
|
|
||||||
memset(keydata, 0, sizeof(keydata));
|
|
||||||
/* Retry for out of range results to achieve uniformity. */
|
|
||||||
do {
|
|
||||||
secp256k1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
|
|
||||||
retry = !secp256k1_fe_set_b32(&s, nonce32);
|
|
||||||
retry = retry || secp256k1_fe_is_zero(&s);
|
|
||||||
} while (retry); /* This branch true is cryptographically unreachable. Requires sha256_hmac output > Fp. */
|
|
||||||
/* Randomize the projection to defend against multiplier sidechannels. */
|
|
||||||
secp256k1_gej_rescale(&ctx->initial, &s);
|
|
||||||
secp256k1_fe_clear(&s);
|
|
||||||
do {
|
|
||||||
secp256k1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
|
|
||||||
secp256k1_scalar_set_b32(&b, nonce32, &retry);
|
|
||||||
/* A blinding value of 0 works, but would undermine the projection hardening. */
|
|
||||||
retry = retry || secp256k1_scalar_is_zero(&b);
|
|
||||||
} while (retry); /* This branch true is cryptographically unreachable. Requires sha256_hmac output > order. */
|
|
||||||
secp256k1_rfc6979_hmac_sha256_finalize(&rng);
|
|
||||||
memset(nonce32, 0, 32);
|
|
||||||
secp256k1_ecmult_gen(ctx, &gb, &b);
|
|
||||||
secp256k1_scalar_negate(&b, &b);
|
|
||||||
ctx->blind = b;
|
|
||||||
ctx->initial = gb;
|
|
||||||
secp256k1_scalar_clear(&b);
|
|
||||||
secp256k1_gej_clear(&gb);
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_ECMULT_GEN_IMPL_H */
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -1,132 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_FIELD_H
|
|
||||||
#define SECP256K1_FIELD_H
|
|
||||||
|
|
||||||
/** Field element module.
|
|
||||||
*
|
|
||||||
* Field elements can be represented in several ways, but code accessing
|
|
||||||
* it (and implementations) need to take certain properties into account:
|
|
||||||
* - Each field element can be normalized or not.
|
|
||||||
* - Each field element has a magnitude, which represents how far away
|
|
||||||
* its representation is away from normalization. Normalized elements
|
|
||||||
* always have a magnitude of 1, but a magnitude of 1 doesn't imply
|
|
||||||
* normality.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if defined(USE_FIELD_10X26)
|
|
||||||
#include "field_10x26.h"
|
|
||||||
#elif defined(USE_FIELD_5X52)
|
|
||||||
#include "field_5x52.h"
|
|
||||||
#else
|
|
||||||
#error "Please select field implementation"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
|
|
||||||
/** Normalize a field element. */
|
|
||||||
static void secp256k1_fe_normalize(secp256k1_fe *r);
|
|
||||||
|
|
||||||
/** Weakly normalize a field element: reduce it magnitude to 1, but don't fully normalize. */
|
|
||||||
static void secp256k1_fe_normalize_weak(secp256k1_fe *r);
|
|
||||||
|
|
||||||
/** Normalize a field element, without constant-time guarantee. */
|
|
||||||
static void secp256k1_fe_normalize_var(secp256k1_fe *r);
|
|
||||||
|
|
||||||
/** Verify whether a field element represents zero i.e. would normalize to a zero value. The field
|
|
||||||
* implementation may optionally normalize the input, but this should not be relied upon. */
|
|
||||||
static int secp256k1_fe_normalizes_to_zero(secp256k1_fe *r);
|
|
||||||
|
|
||||||
/** Verify whether a field element represents zero i.e. would normalize to a zero value. The field
|
|
||||||
* implementation may optionally normalize the input, but this should not be relied upon. */
|
|
||||||
static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe *r);
|
|
||||||
|
|
||||||
/** Set a field element equal to a small integer. Resulting field element is normalized. */
|
|
||||||
static void secp256k1_fe_set_int(secp256k1_fe *r, int a);
|
|
||||||
|
|
||||||
/** Sets a field element equal to zero, initializing all fields. */
|
|
||||||
static void secp256k1_fe_clear(secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Verify whether a field element is zero. Requires the input to be normalized. */
|
|
||||||
static int secp256k1_fe_is_zero(const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Check the "oddness" of a field element. Requires the input to be normalized. */
|
|
||||||
static int secp256k1_fe_is_odd(const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Compare two field elements. Requires magnitude-1 inputs. */
|
|
||||||
static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b);
|
|
||||||
|
|
||||||
/** Same as secp256k1_fe_equal, but may be variable time. */
|
|
||||||
static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b);
|
|
||||||
|
|
||||||
/** Compare two field elements. Requires both inputs to be normalized */
|
|
||||||
static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b);
|
|
||||||
|
|
||||||
/** Set a field element equal to 32-byte big endian value. If successful, the resulting field element is normalized. */
|
|
||||||
static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a);
|
|
||||||
|
|
||||||
/** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
|
|
||||||
static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Set a field element equal to the additive inverse of another. Takes a maximum magnitude of the input
|
|
||||||
* as an argument. The magnitude of the output is one higher. */
|
|
||||||
static void secp256k1_fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m);
|
|
||||||
|
|
||||||
/** Multiplies the passed field element with a small integer constant. Multiplies the magnitude by that
|
|
||||||
* small integer. */
|
|
||||||
static void secp256k1_fe_mul_int(secp256k1_fe *r, int a);
|
|
||||||
|
|
||||||
/** Adds a field element to another. The result has the sum of the inputs' magnitudes as magnitude. */
|
|
||||||
static void secp256k1_fe_add(secp256k1_fe *r, const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Sets a field element to be the product of two others. Requires the inputs' magnitudes to be at most 8.
|
|
||||||
* The output magnitude is 1 (but not guaranteed to be normalized). */
|
|
||||||
static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b);
|
|
||||||
|
|
||||||
/** Sets a field element to be the square of another. Requires the input's magnitude to be at most 8.
|
|
||||||
* The output magnitude is 1 (but not guaranteed to be normalized). */
|
|
||||||
static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** If a has a square root, it is computed in r and 1 is returned. If a does not
|
|
||||||
* have a square root, the root of its negation is computed and 0 is returned.
|
|
||||||
* The input's magnitude can be at most 8. The output magnitude is 1 (but not
|
|
||||||
* guaranteed to be normalized). The result in r will always be a square
|
|
||||||
* itself. */
|
|
||||||
static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Checks whether a field element is a quadratic residue. */
|
|
||||||
static int secp256k1_fe_is_quad_var(const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Sets a field element to be the (modular) inverse of another. Requires the input's magnitude to be
|
|
||||||
* at most 8. The output magnitude is 1 (but not guaranteed to be normalized). */
|
|
||||||
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Potentially faster version of secp256k1_fe_inv, without constant-time guarantee. */
|
|
||||||
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Calculate the (modular) inverses of a batch of field elements. Requires the inputs' magnitudes to be
|
|
||||||
* at most 8. The output magnitudes are 1 (but not guaranteed to be normalized). The inputs and
|
|
||||||
* outputs must not overlap in memory. */
|
|
||||||
static void secp256k1_fe_inv_all_var(secp256k1_fe *r, const secp256k1_fe *a, size_t len);
|
|
||||||
|
|
||||||
/** Convert a field element to the storage type. */
|
|
||||||
static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a);
|
|
||||||
|
|
||||||
/** Convert a field element back from the storage type. */
|
|
||||||
static void secp256k1_fe_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a);
|
|
||||||
|
|
||||||
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */
|
|
||||||
static void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag);
|
|
||||||
|
|
||||||
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */
|
|
||||||
static void secp256k1_fe_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_FIELD_H */
|
|
||||||
@ -1,50 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_FIELD_REPR_H
|
|
||||||
#define SECP256K1_FIELD_REPR_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
/* X = sum(i=0..9, n[i]*2^(i*26)) mod p
|
|
||||||
* where p = 2^256 - 0x1000003D1
|
|
||||||
*/
|
|
||||||
uint32_t n[10];
|
|
||||||
#ifdef VERIFY
|
|
||||||
int magnitude;
|
|
||||||
int normalized;
|
|
||||||
#endif
|
|
||||||
} secp256k1_fe;
|
|
||||||
|
|
||||||
/* Unpacks a constant into a overlapping multi-limbed FE element. */
|
|
||||||
#define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \
|
|
||||||
(d0) & 0x3FFFFFFUL, \
|
|
||||||
(((uint32_t)d0) >> 26) | (((uint32_t)(d1) & 0xFFFFFUL) << 6), \
|
|
||||||
(((uint32_t)d1) >> 20) | (((uint32_t)(d2) & 0x3FFFUL) << 12), \
|
|
||||||
(((uint32_t)d2) >> 14) | (((uint32_t)(d3) & 0xFFUL) << 18), \
|
|
||||||
(((uint32_t)d3) >> 8) | (((uint32_t)(d4) & 0x3UL) << 24), \
|
|
||||||
(((uint32_t)d4) >> 2) & 0x3FFFFFFUL, \
|
|
||||||
(((uint32_t)d4) >> 28) | (((uint32_t)(d5) & 0x3FFFFFUL) << 4), \
|
|
||||||
(((uint32_t)d5) >> 22) | (((uint32_t)(d6) & 0xFFFFUL) << 10), \
|
|
||||||
(((uint32_t)d6) >> 16) | (((uint32_t)(d7) & 0x3FFUL) << 16), \
|
|
||||||
(((uint32_t)d7) >> 10) \
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0)), 1, 1}
|
|
||||||
#else
|
|
||||||
#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0))}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
uint32_t n[8];
|
|
||||||
} secp256k1_fe_storage;
|
|
||||||
|
|
||||||
#define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ (d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7) }}
|
|
||||||
#define SECP256K1_FE_STORAGE_CONST_GET(d) d.n[7], d.n[6], d.n[5], d.n[4],d.n[3], d.n[2], d.n[1], d.n[0]
|
|
||||||
|
|
||||||
#endif /* SECP256K1_FIELD_REPR_H */
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -1,49 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_FIELD_REPR_H
|
|
||||||
#define SECP256K1_FIELD_REPR_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
/* X = sum(i=0..4, n[i]*2^(i*52)) mod p
|
|
||||||
* where p = 2^256 - 0x1000003D1
|
|
||||||
*/
|
|
||||||
uint64_t n[5];
|
|
||||||
#ifdef VERIFY
|
|
||||||
int magnitude;
|
|
||||||
int normalized;
|
|
||||||
#endif
|
|
||||||
} secp256k1_fe;
|
|
||||||
|
|
||||||
/* Unpacks a constant into a overlapping multi-limbed FE element. */
|
|
||||||
#define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \
|
|
||||||
(d0) | (((uint64_t)(d1) & 0xFFFFFUL) << 32), \
|
|
||||||
((uint64_t)(d1) >> 20) | (((uint64_t)(d2)) << 12) | (((uint64_t)(d3) & 0xFFUL) << 44), \
|
|
||||||
((uint64_t)(d3) >> 8) | (((uint64_t)(d4) & 0xFFFFFFFUL) << 24), \
|
|
||||||
((uint64_t)(d4) >> 28) | (((uint64_t)(d5)) << 4) | (((uint64_t)(d6) & 0xFFFFUL) << 36), \
|
|
||||||
((uint64_t)(d6) >> 16) | (((uint64_t)(d7)) << 16) \
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0)), 1, 1}
|
|
||||||
#else
|
|
||||||
#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0))}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
uint64_t n[4];
|
|
||||||
} secp256k1_fe_storage;
|
|
||||||
|
|
||||||
#define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ \
|
|
||||||
(d0) | (((uint64_t)(d1)) << 32), \
|
|
||||||
(d2) | (((uint64_t)(d3)) << 32), \
|
|
||||||
(d4) | (((uint64_t)(d5)) << 32), \
|
|
||||||
(d6) | (((uint64_t)(d7)) << 32) \
|
|
||||||
}}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_FIELD_REPR_H */
|
|
||||||
@ -1,502 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013-2014 Diederik Huys, Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Changelog:
|
|
||||||
* - March 2013, Diederik Huys: original version
|
|
||||||
* - November 2014, Pieter Wuille: updated to use Peter Dettman's parallel multiplication algorithm
|
|
||||||
* - December 2014, Pieter Wuille: converted from YASM to GCC inline assembly
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_FIELD_INNER5X52_IMPL_H
|
|
||||||
#define SECP256K1_FIELD_INNER5X52_IMPL_H
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
|
|
||||||
/**
|
|
||||||
* Registers: rdx:rax = multiplication accumulator
|
|
||||||
* r9:r8 = c
|
|
||||||
* r15:rcx = d
|
|
||||||
* r10-r14 = a0-a4
|
|
||||||
* rbx = b
|
|
||||||
* rdi = r
|
|
||||||
* rsi = a / t?
|
|
||||||
*/
|
|
||||||
uint64_t tmp1, tmp2, tmp3;
|
|
||||||
__asm__ __volatile__(
|
|
||||||
"movq 0(%%rsi),%%r10\n"
|
|
||||||
"movq 8(%%rsi),%%r11\n"
|
|
||||||
"movq 16(%%rsi),%%r12\n"
|
|
||||||
"movq 24(%%rsi),%%r13\n"
|
|
||||||
"movq 32(%%rsi),%%r14\n"
|
|
||||||
|
|
||||||
/* d += a3 * b0 */
|
|
||||||
"movq 0(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"movq %%rax,%%rcx\n"
|
|
||||||
"movq %%rdx,%%r15\n"
|
|
||||||
/* d += a2 * b1 */
|
|
||||||
"movq 8(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a1 * b2 */
|
|
||||||
"movq 16(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d = a0 * b3 */
|
|
||||||
"movq 24(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* c = a4 * b4 */
|
|
||||||
"movq 32(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"movq %%rax,%%r8\n"
|
|
||||||
"movq %%rdx,%%r9\n"
|
|
||||||
/* d += (c & M) * R */
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* c >>= 52 (%%r8 only) */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
/* t3 (tmp1) = d & M */
|
|
||||||
"movq %%rcx,%%rsi\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rsi\n"
|
|
||||||
"movq %%rsi,%q1\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%r15,%%rcx\n"
|
|
||||||
"xorq %%r15,%%r15\n"
|
|
||||||
/* d += a4 * b0 */
|
|
||||||
"movq 0(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a3 * b1 */
|
|
||||||
"movq 8(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a2 * b2 */
|
|
||||||
"movq 16(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a1 * b3 */
|
|
||||||
"movq 24(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a0 * b4 */
|
|
||||||
"movq 32(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += c * R */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* t4 = d & M (%%rsi) */
|
|
||||||
"movq %%rcx,%%rsi\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rsi\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%r15,%%rcx\n"
|
|
||||||
"xorq %%r15,%%r15\n"
|
|
||||||
/* tx = t4 >> 48 (tmp3) */
|
|
||||||
"movq %%rsi,%%rax\n"
|
|
||||||
"shrq $48,%%rax\n"
|
|
||||||
"movq %%rax,%q3\n"
|
|
||||||
/* t4 &= (M >> 4) (tmp2) */
|
|
||||||
"movq $0xffffffffffff,%%rax\n"
|
|
||||||
"andq %%rax,%%rsi\n"
|
|
||||||
"movq %%rsi,%q2\n"
|
|
||||||
/* c = a0 * b0 */
|
|
||||||
"movq 0(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
"movq %%rax,%%r8\n"
|
|
||||||
"movq %%rdx,%%r9\n"
|
|
||||||
/* d += a4 * b1 */
|
|
||||||
"movq 8(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a3 * b2 */
|
|
||||||
"movq 16(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a2 * b3 */
|
|
||||||
"movq 24(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a1 * b4 */
|
|
||||||
"movq 32(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* u0 = d & M (%%rsi) */
|
|
||||||
"movq %%rcx,%%rsi\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rsi\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%r15,%%rcx\n"
|
|
||||||
"xorq %%r15,%%r15\n"
|
|
||||||
/* u0 = (u0 << 4) | tx (%%rsi) */
|
|
||||||
"shlq $4,%%rsi\n"
|
|
||||||
"movq %q3,%%rax\n"
|
|
||||||
"orq %%rax,%%rsi\n"
|
|
||||||
/* c += u0 * (R >> 4) */
|
|
||||||
"movq $0x1000003d1,%%rax\n"
|
|
||||||
"mulq %%rsi\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* r[0] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rax\n"
|
|
||||||
"movq %%rax,0(%%rdi)\n"
|
|
||||||
/* c >>= 52 */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
"xorq %%r9,%%r9\n"
|
|
||||||
/* c += a1 * b0 */
|
|
||||||
"movq 0(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* c += a0 * b1 */
|
|
||||||
"movq 8(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* d += a4 * b2 */
|
|
||||||
"movq 16(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a3 * b3 */
|
|
||||||
"movq 24(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a2 * b4 */
|
|
||||||
"movq 32(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* c += (d & M) * R */
|
|
||||||
"movq %%rcx,%%rax\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%r15,%%rcx\n"
|
|
||||||
"xorq %%r15,%%r15\n"
|
|
||||||
/* r[1] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rax\n"
|
|
||||||
"movq %%rax,8(%%rdi)\n"
|
|
||||||
/* c >>= 52 */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
"xorq %%r9,%%r9\n"
|
|
||||||
/* c += a2 * b0 */
|
|
||||||
"movq 0(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* c += a1 * b1 */
|
|
||||||
"movq 8(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* c += a0 * b2 (last use of %%r10 = a0) */
|
|
||||||
"movq 16(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* fetch t3 (%%r10, overwrites a0), t4 (%%rsi) */
|
|
||||||
"movq %q2,%%rsi\n"
|
|
||||||
"movq %q1,%%r10\n"
|
|
||||||
/* d += a4 * b3 */
|
|
||||||
"movq 24(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* d += a3 * b4 */
|
|
||||||
"movq 32(%%rbx),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax,%%rcx\n"
|
|
||||||
"adcq %%rdx,%%r15\n"
|
|
||||||
/* c += (d & M) * R */
|
|
||||||
"movq %%rcx,%%rax\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* d >>= 52 (%%rcx only) */
|
|
||||||
"shrdq $52,%%r15,%%rcx\n"
|
|
||||||
/* r[2] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rax\n"
|
|
||||||
"movq %%rax,16(%%rdi)\n"
|
|
||||||
/* c >>= 52 */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
"xorq %%r9,%%r9\n"
|
|
||||||
/* c += t3 */
|
|
||||||
"addq %%r10,%%r8\n"
|
|
||||||
/* c += d * R */
|
|
||||||
"movq %%rcx,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* r[3] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"movq $0xfffffffffffff,%%rdx\n"
|
|
||||||
"andq %%rdx,%%rax\n"
|
|
||||||
"movq %%rax,24(%%rdi)\n"
|
|
||||||
/* c >>= 52 (%%r8 only) */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
/* c += t4 (%%r8 only) */
|
|
||||||
"addq %%rsi,%%r8\n"
|
|
||||||
/* r[4] = c */
|
|
||||||
"movq %%r8,32(%%rdi)\n"
|
|
||||||
: "+S"(a), "=m"(tmp1), "=m"(tmp2), "=m"(tmp3)
|
|
||||||
: "b"(b), "D"(r)
|
|
||||||
: "%rax", "%rcx", "%rdx", "%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15", "cc", "memory"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
|
|
||||||
/**
|
|
||||||
* Registers: rdx:rax = multiplication accumulator
|
|
||||||
* r9:r8 = c
|
|
||||||
* rcx:rbx = d
|
|
||||||
* r10-r14 = a0-a4
|
|
||||||
* r15 = M (0xfffffffffffff)
|
|
||||||
* rdi = r
|
|
||||||
* rsi = a / t?
|
|
||||||
*/
|
|
||||||
uint64_t tmp1, tmp2, tmp3;
|
|
||||||
__asm__ __volatile__(
|
|
||||||
"movq 0(%%rsi),%%r10\n"
|
|
||||||
"movq 8(%%rsi),%%r11\n"
|
|
||||||
"movq 16(%%rsi),%%r12\n"
|
|
||||||
"movq 24(%%rsi),%%r13\n"
|
|
||||||
"movq 32(%%rsi),%%r14\n"
|
|
||||||
"movq $0xfffffffffffff,%%r15\n"
|
|
||||||
|
|
||||||
/* d = (a0*2) * a3 */
|
|
||||||
"leaq (%%r10,%%r10,1),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"movq %%rax,%%rbx\n"
|
|
||||||
"movq %%rdx,%%rcx\n"
|
|
||||||
/* d += (a1*2) * a2 */
|
|
||||||
"leaq (%%r11,%%r11,1),%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* c = a4 * a4 */
|
|
||||||
"movq %%r14,%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"movq %%rax,%%r8\n"
|
|
||||||
"movq %%rdx,%%r9\n"
|
|
||||||
/* d += (c & M) * R */
|
|
||||||
"andq %%r15,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* c >>= 52 (%%r8 only) */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
/* t3 (tmp1) = d & M */
|
|
||||||
"movq %%rbx,%%rsi\n"
|
|
||||||
"andq %%r15,%%rsi\n"
|
|
||||||
"movq %%rsi,%q1\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%rcx,%%rbx\n"
|
|
||||||
"xorq %%rcx,%%rcx\n"
|
|
||||||
/* a4 *= 2 */
|
|
||||||
"addq %%r14,%%r14\n"
|
|
||||||
/* d += a0 * a4 */
|
|
||||||
"movq %%r10,%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* d+= (a1*2) * a3 */
|
|
||||||
"leaq (%%r11,%%r11,1),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* d += a2 * a2 */
|
|
||||||
"movq %%r12,%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* d += c * R */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* t4 = d & M (%%rsi) */
|
|
||||||
"movq %%rbx,%%rsi\n"
|
|
||||||
"andq %%r15,%%rsi\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%rcx,%%rbx\n"
|
|
||||||
"xorq %%rcx,%%rcx\n"
|
|
||||||
/* tx = t4 >> 48 (tmp3) */
|
|
||||||
"movq %%rsi,%%rax\n"
|
|
||||||
"shrq $48,%%rax\n"
|
|
||||||
"movq %%rax,%q3\n"
|
|
||||||
/* t4 &= (M >> 4) (tmp2) */
|
|
||||||
"movq $0xffffffffffff,%%rax\n"
|
|
||||||
"andq %%rax,%%rsi\n"
|
|
||||||
"movq %%rsi,%q2\n"
|
|
||||||
/* c = a0 * a0 */
|
|
||||||
"movq %%r10,%%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
"movq %%rax,%%r8\n"
|
|
||||||
"movq %%rdx,%%r9\n"
|
|
||||||
/* d += a1 * a4 */
|
|
||||||
"movq %%r11,%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* d += (a2*2) * a3 */
|
|
||||||
"leaq (%%r12,%%r12,1),%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* u0 = d & M (%%rsi) */
|
|
||||||
"movq %%rbx,%%rsi\n"
|
|
||||||
"andq %%r15,%%rsi\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%rcx,%%rbx\n"
|
|
||||||
"xorq %%rcx,%%rcx\n"
|
|
||||||
/* u0 = (u0 << 4) | tx (%%rsi) */
|
|
||||||
"shlq $4,%%rsi\n"
|
|
||||||
"movq %q3,%%rax\n"
|
|
||||||
"orq %%rax,%%rsi\n"
|
|
||||||
/* c += u0 * (R >> 4) */
|
|
||||||
"movq $0x1000003d1,%%rax\n"
|
|
||||||
"mulq %%rsi\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* r[0] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"andq %%r15,%%rax\n"
|
|
||||||
"movq %%rax,0(%%rdi)\n"
|
|
||||||
/* c >>= 52 */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
"xorq %%r9,%%r9\n"
|
|
||||||
/* a0 *= 2 */
|
|
||||||
"addq %%r10,%%r10\n"
|
|
||||||
/* c += a0 * a1 */
|
|
||||||
"movq %%r10,%%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* d += a2 * a4 */
|
|
||||||
"movq %%r12,%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* d += a3 * a3 */
|
|
||||||
"movq %%r13,%%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* c += (d & M) * R */
|
|
||||||
"movq %%rbx,%%rax\n"
|
|
||||||
"andq %%r15,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* d >>= 52 */
|
|
||||||
"shrdq $52,%%rcx,%%rbx\n"
|
|
||||||
"xorq %%rcx,%%rcx\n"
|
|
||||||
/* r[1] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"andq %%r15,%%rax\n"
|
|
||||||
"movq %%rax,8(%%rdi)\n"
|
|
||||||
/* c >>= 52 */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
"xorq %%r9,%%r9\n"
|
|
||||||
/* c += a0 * a2 (last use of %%r10) */
|
|
||||||
"movq %%r10,%%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* fetch t3 (%%r10, overwrites a0),t4 (%%rsi) */
|
|
||||||
"movq %q2,%%rsi\n"
|
|
||||||
"movq %q1,%%r10\n"
|
|
||||||
/* c += a1 * a1 */
|
|
||||||
"movq %%r11,%%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* d += a3 * a4 */
|
|
||||||
"movq %%r13,%%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax,%%rbx\n"
|
|
||||||
"adcq %%rdx,%%rcx\n"
|
|
||||||
/* c += (d & M) * R */
|
|
||||||
"movq %%rbx,%%rax\n"
|
|
||||||
"andq %%r15,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* d >>= 52 (%%rbx only) */
|
|
||||||
"shrdq $52,%%rcx,%%rbx\n"
|
|
||||||
/* r[2] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"andq %%r15,%%rax\n"
|
|
||||||
"movq %%rax,16(%%rdi)\n"
|
|
||||||
/* c >>= 52 */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
"xorq %%r9,%%r9\n"
|
|
||||||
/* c += t3 */
|
|
||||||
"addq %%r10,%%r8\n"
|
|
||||||
/* c += d * R */
|
|
||||||
"movq %%rbx,%%rax\n"
|
|
||||||
"movq $0x1000003d10,%%rdx\n"
|
|
||||||
"mulq %%rdx\n"
|
|
||||||
"addq %%rax,%%r8\n"
|
|
||||||
"adcq %%rdx,%%r9\n"
|
|
||||||
/* r[3] = c & M */
|
|
||||||
"movq %%r8,%%rax\n"
|
|
||||||
"andq %%r15,%%rax\n"
|
|
||||||
"movq %%rax,24(%%rdi)\n"
|
|
||||||
/* c >>= 52 (%%r8 only) */
|
|
||||||
"shrdq $52,%%r9,%%r8\n"
|
|
||||||
/* c += t4 (%%r8 only) */
|
|
||||||
"addq %%rsi,%%r8\n"
|
|
||||||
/* r[4] = c */
|
|
||||||
"movq %%r8,32(%%rdi)\n"
|
|
||||||
: "+S"(a), "=m"(tmp1), "=m"(tmp2), "=m"(tmp3)
|
|
||||||
: "D"(r)
|
|
||||||
: "%rax", "%rbx", "%rcx", "%rdx", "%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15", "cc", "memory"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_FIELD_INNER5X52_IMPL_H */
|
|
||||||
@ -1,496 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_FIELD_REPR_IMPL_H
|
|
||||||
#define SECP256K1_FIELD_REPR_IMPL_H
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "field.h"
|
|
||||||
|
|
||||||
#if defined(USE_ASM_X86_64)
|
|
||||||
#include "field_5x52_asm_impl.h"
|
|
||||||
#else
|
|
||||||
#include "field_5x52_int128_impl.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Implements arithmetic modulo FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F,
|
|
||||||
* represented as 5 uint64_t's in base 2^52. The values are allowed to contain >52 each. In particular,
|
|
||||||
* each FieldElem has a 'magnitude' associated with it. Internally, a magnitude M means each element
|
|
||||||
* is at most M*(2^53-1), except the most significant one, which is limited to M*(2^49-1). All operations
|
|
||||||
* accept any input with magnitude at most M, and have different rules for propagating magnitude to their
|
|
||||||
* output.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
static void secp256k1_fe_verify(const secp256k1_fe *a) {
|
|
||||||
const uint64_t *d = a->n;
|
|
||||||
int m = a->normalized ? 1 : 2 * a->magnitude, r = 1;
|
|
||||||
/* secp256k1 'p' value defined in "Standards for Efficient Cryptography" (SEC2) 2.7.1. */
|
|
||||||
r &= (d[0] <= 0xFFFFFFFFFFFFFULL * m);
|
|
||||||
r &= (d[1] <= 0xFFFFFFFFFFFFFULL * m);
|
|
||||||
r &= (d[2] <= 0xFFFFFFFFFFFFFULL * m);
|
|
||||||
r &= (d[3] <= 0xFFFFFFFFFFFFFULL * m);
|
|
||||||
r &= (d[4] <= 0x0FFFFFFFFFFFFULL * m);
|
|
||||||
r &= (a->magnitude >= 0);
|
|
||||||
r &= (a->magnitude <= 2048);
|
|
||||||
if (a->normalized) {
|
|
||||||
r &= (a->magnitude <= 1);
|
|
||||||
if (r && (d[4] == 0x0FFFFFFFFFFFFULL) && ((d[3] & d[2] & d[1]) == 0xFFFFFFFFFFFFFULL)) {
|
|
||||||
r &= (d[0] < 0xFFFFEFFFFFC2FULL);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
VERIFY_CHECK(r == 1);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void secp256k1_fe_normalize(secp256k1_fe *r) {
|
|
||||||
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
|
|
||||||
|
|
||||||
/* Reduce t4 at the start so there will be at most a single carry from the first pass */
|
|
||||||
uint64_t m;
|
|
||||||
uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
/* The first pass ensures the magnitude is 1, ... */
|
|
||||||
t0 += x * 0x1000003D1ULL;
|
|
||||||
t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
|
|
||||||
t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
|
|
||||||
t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
|
|
||||||
|
|
||||||
/* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
|
|
||||||
VERIFY_CHECK(t4 >> 49 == 0);
|
|
||||||
|
|
||||||
/* At most a single final reduction is needed; check if the value is >= the field characteristic */
|
|
||||||
x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
|
|
||||||
& (t0 >= 0xFFFFEFFFFFC2FULL));
|
|
||||||
|
|
||||||
/* Apply the final reduction (for constant-time behaviour, we do it always) */
|
|
||||||
t0 += x * 0x1000003D1ULL;
|
|
||||||
t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
/* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
|
|
||||||
VERIFY_CHECK(t4 >> 48 == x);
|
|
||||||
|
|
||||||
/* Mask off the possible multiple of 2^256 from the final reduction */
|
|
||||||
t4 &= 0x0FFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
r->normalized = 1;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_normalize_weak(secp256k1_fe *r) {
|
|
||||||
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
|
|
||||||
|
|
||||||
/* Reduce t4 at the start so there will be at most a single carry from the first pass */
|
|
||||||
uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
/* The first pass ensures the magnitude is 1, ... */
|
|
||||||
t0 += x * 0x1000003D1ULL;
|
|
||||||
t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
/* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
|
|
||||||
VERIFY_CHECK(t4 >> 49 == 0);
|
|
||||||
|
|
||||||
r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_normalize_var(secp256k1_fe *r) {
|
|
||||||
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
|
|
||||||
|
|
||||||
/* Reduce t4 at the start so there will be at most a single carry from the first pass */
|
|
||||||
uint64_t m;
|
|
||||||
uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
/* The first pass ensures the magnitude is 1, ... */
|
|
||||||
t0 += x * 0x1000003D1ULL;
|
|
||||||
t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
|
|
||||||
t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
|
|
||||||
t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
|
|
||||||
|
|
||||||
/* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
|
|
||||||
VERIFY_CHECK(t4 >> 49 == 0);
|
|
||||||
|
|
||||||
/* At most a single final reduction is needed; check if the value is >= the field characteristic */
|
|
||||||
x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
|
|
||||||
& (t0 >= 0xFFFFEFFFFFC2FULL));
|
|
||||||
|
|
||||||
if (x) {
|
|
||||||
t0 += 0x1000003D1ULL;
|
|
||||||
t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
/* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
|
|
||||||
VERIFY_CHECK(t4 >> 48 == x);
|
|
||||||
|
|
||||||
/* Mask off the possible multiple of 2^256 from the final reduction */
|
|
||||||
t4 &= 0x0FFFFFFFFFFFFULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
r->normalized = 1;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_fe_normalizes_to_zero(secp256k1_fe *r) {
|
|
||||||
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
|
|
||||||
|
|
||||||
/* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
|
|
||||||
uint64_t z0, z1;
|
|
||||||
|
|
||||||
/* Reduce t4 at the start so there will be at most a single carry from the first pass */
|
|
||||||
uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
/* The first pass ensures the magnitude is 1, ... */
|
|
||||||
t0 += x * 0x1000003D1ULL;
|
|
||||||
t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL; z0 = t0; z1 = t0 ^ 0x1000003D0ULL;
|
|
||||||
t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
|
|
||||||
t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
|
|
||||||
t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
|
|
||||||
z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
|
|
||||||
|
|
||||||
/* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
|
|
||||||
VERIFY_CHECK(t4 >> 49 == 0);
|
|
||||||
|
|
||||||
return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe *r) {
|
|
||||||
uint64_t t0, t1, t2, t3, t4;
|
|
||||||
uint64_t z0, z1;
|
|
||||||
uint64_t x;
|
|
||||||
|
|
||||||
t0 = r->n[0];
|
|
||||||
t4 = r->n[4];
|
|
||||||
|
|
||||||
/* Reduce t4 at the start so there will be at most a single carry from the first pass */
|
|
||||||
x = t4 >> 48;
|
|
||||||
|
|
||||||
/* The first pass ensures the magnitude is 1, ... */
|
|
||||||
t0 += x * 0x1000003D1ULL;
|
|
||||||
|
|
||||||
/* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
|
|
||||||
z0 = t0 & 0xFFFFFFFFFFFFFULL;
|
|
||||||
z1 = z0 ^ 0x1000003D0ULL;
|
|
||||||
|
|
||||||
/* Fast return path should catch the majority of cases */
|
|
||||||
if ((z0 != 0ULL) & (z1 != 0xFFFFFFFFFFFFFULL)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
t1 = r->n[1];
|
|
||||||
t2 = r->n[2];
|
|
||||||
t3 = r->n[3];
|
|
||||||
|
|
||||||
t4 &= 0x0FFFFFFFFFFFFULL;
|
|
||||||
|
|
||||||
t1 += (t0 >> 52);
|
|
||||||
t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
|
|
||||||
t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
|
|
||||||
t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
|
|
||||||
z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
|
|
||||||
|
|
||||||
/* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
|
|
||||||
VERIFY_CHECK(t4 >> 49 == 0);
|
|
||||||
|
|
||||||
return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_set_int(secp256k1_fe *r, int a) {
|
|
||||||
r->n[0] = a;
|
|
||||||
r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
r->normalized = 1;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_fe_is_zero(const secp256k1_fe *a) {
|
|
||||||
const uint64_t *t = a->n;
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->normalized);
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
#endif
|
|
||||||
return (t[0] | t[1] | t[2] | t[3] | t[4]) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_fe_is_odd(const secp256k1_fe *a) {
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->normalized);
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
#endif
|
|
||||||
return a->n[0] & 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe *a) {
|
|
||||||
int i;
|
|
||||||
#ifdef VERIFY
|
|
||||||
a->magnitude = 0;
|
|
||||||
a->normalized = 1;
|
|
||||||
#endif
|
|
||||||
for (i=0; i<5; i++) {
|
|
||||||
a->n[i] = 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b) {
|
|
||||||
int i;
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->normalized);
|
|
||||||
VERIFY_CHECK(b->normalized);
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
secp256k1_fe_verify(b);
|
|
||||||
#endif
|
|
||||||
for (i = 4; i >= 0; i--) {
|
|
||||||
if (a->n[i] > b->n[i]) {
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
if (a->n[i] < b->n[i]) {
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a) {
|
|
||||||
r->n[0] = (uint64_t)a[31]
|
|
||||||
| ((uint64_t)a[30] << 8)
|
|
||||||
| ((uint64_t)a[29] << 16)
|
|
||||||
| ((uint64_t)a[28] << 24)
|
|
||||||
| ((uint64_t)a[27] << 32)
|
|
||||||
| ((uint64_t)a[26] << 40)
|
|
||||||
| ((uint64_t)(a[25] & 0xF) << 48);
|
|
||||||
r->n[1] = (uint64_t)((a[25] >> 4) & 0xF)
|
|
||||||
| ((uint64_t)a[24] << 4)
|
|
||||||
| ((uint64_t)a[23] << 12)
|
|
||||||
| ((uint64_t)a[22] << 20)
|
|
||||||
| ((uint64_t)a[21] << 28)
|
|
||||||
| ((uint64_t)a[20] << 36)
|
|
||||||
| ((uint64_t)a[19] << 44);
|
|
||||||
r->n[2] = (uint64_t)a[18]
|
|
||||||
| ((uint64_t)a[17] << 8)
|
|
||||||
| ((uint64_t)a[16] << 16)
|
|
||||||
| ((uint64_t)a[15] << 24)
|
|
||||||
| ((uint64_t)a[14] << 32)
|
|
||||||
| ((uint64_t)a[13] << 40)
|
|
||||||
| ((uint64_t)(a[12] & 0xF) << 48);
|
|
||||||
r->n[3] = (uint64_t)((a[12] >> 4) & 0xF)
|
|
||||||
| ((uint64_t)a[11] << 4)
|
|
||||||
| ((uint64_t)a[10] << 12)
|
|
||||||
| ((uint64_t)a[9] << 20)
|
|
||||||
| ((uint64_t)a[8] << 28)
|
|
||||||
| ((uint64_t)a[7] << 36)
|
|
||||||
| ((uint64_t)a[6] << 44);
|
|
||||||
r->n[4] = (uint64_t)a[5]
|
|
||||||
| ((uint64_t)a[4] << 8)
|
|
||||||
| ((uint64_t)a[3] << 16)
|
|
||||||
| ((uint64_t)a[2] << 24)
|
|
||||||
| ((uint64_t)a[1] << 32)
|
|
||||||
| ((uint64_t)a[0] << 40);
|
|
||||||
if (r->n[4] == 0x0FFFFFFFFFFFFULL && (r->n[3] & r->n[2] & r->n[1]) == 0xFFFFFFFFFFFFFULL && r->n[0] >= 0xFFFFEFFFFFC2FULL) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
r->normalized = 1;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
|
|
||||||
static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe *a) {
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->normalized);
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
#endif
|
|
||||||
r[0] = (a->n[4] >> 40) & 0xFF;
|
|
||||||
r[1] = (a->n[4] >> 32) & 0xFF;
|
|
||||||
r[2] = (a->n[4] >> 24) & 0xFF;
|
|
||||||
r[3] = (a->n[4] >> 16) & 0xFF;
|
|
||||||
r[4] = (a->n[4] >> 8) & 0xFF;
|
|
||||||
r[5] = a->n[4] & 0xFF;
|
|
||||||
r[6] = (a->n[3] >> 44) & 0xFF;
|
|
||||||
r[7] = (a->n[3] >> 36) & 0xFF;
|
|
||||||
r[8] = (a->n[3] >> 28) & 0xFF;
|
|
||||||
r[9] = (a->n[3] >> 20) & 0xFF;
|
|
||||||
r[10] = (a->n[3] >> 12) & 0xFF;
|
|
||||||
r[11] = (a->n[3] >> 4) & 0xFF;
|
|
||||||
r[12] = ((a->n[2] >> 48) & 0xF) | ((a->n[3] & 0xF) << 4);
|
|
||||||
r[13] = (a->n[2] >> 40) & 0xFF;
|
|
||||||
r[14] = (a->n[2] >> 32) & 0xFF;
|
|
||||||
r[15] = (a->n[2] >> 24) & 0xFF;
|
|
||||||
r[16] = (a->n[2] >> 16) & 0xFF;
|
|
||||||
r[17] = (a->n[2] >> 8) & 0xFF;
|
|
||||||
r[18] = a->n[2] & 0xFF;
|
|
||||||
r[19] = (a->n[1] >> 44) & 0xFF;
|
|
||||||
r[20] = (a->n[1] >> 36) & 0xFF;
|
|
||||||
r[21] = (a->n[1] >> 28) & 0xFF;
|
|
||||||
r[22] = (a->n[1] >> 20) & 0xFF;
|
|
||||||
r[23] = (a->n[1] >> 12) & 0xFF;
|
|
||||||
r[24] = (a->n[1] >> 4) & 0xFF;
|
|
||||||
r[25] = ((a->n[0] >> 48) & 0xF) | ((a->n[1] & 0xF) << 4);
|
|
||||||
r[26] = (a->n[0] >> 40) & 0xFF;
|
|
||||||
r[27] = (a->n[0] >> 32) & 0xFF;
|
|
||||||
r[28] = (a->n[0] >> 24) & 0xFF;
|
|
||||||
r[29] = (a->n[0] >> 16) & 0xFF;
|
|
||||||
r[30] = (a->n[0] >> 8) & 0xFF;
|
|
||||||
r[31] = a->n[0] & 0xFF;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m) {
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->magnitude <= m);
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
#endif
|
|
||||||
r->n[0] = 0xFFFFEFFFFFC2FULL * 2 * (m + 1) - a->n[0];
|
|
||||||
r->n[1] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[1];
|
|
||||||
r->n[2] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[2];
|
|
||||||
r->n[3] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[3];
|
|
||||||
r->n[4] = 0x0FFFFFFFFFFFFULL * 2 * (m + 1) - a->n[4];
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = m + 1;
|
|
||||||
r->normalized = 0;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_mul_int(secp256k1_fe *r, int a) {
|
|
||||||
r->n[0] *= a;
|
|
||||||
r->n[1] *= a;
|
|
||||||
r->n[2] *= a;
|
|
||||||
r->n[3] *= a;
|
|
||||||
r->n[4] *= a;
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude *= a;
|
|
||||||
r->normalized = 0;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_add(secp256k1_fe *r, const secp256k1_fe *a) {
|
|
||||||
#ifdef VERIFY
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
#endif
|
|
||||||
r->n[0] += a->n[0];
|
|
||||||
r->n[1] += a->n[1];
|
|
||||||
r->n[2] += a->n[2];
|
|
||||||
r->n[3] += a->n[3];
|
|
||||||
r->n[4] += a->n[4];
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude += a->magnitude;
|
|
||||||
r->normalized = 0;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b) {
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->magnitude <= 8);
|
|
||||||
VERIFY_CHECK(b->magnitude <= 8);
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
secp256k1_fe_verify(b);
|
|
||||||
VERIFY_CHECK(r != b);
|
|
||||||
VERIFY_CHECK(a != b);
|
|
||||||
#endif
|
|
||||||
secp256k1_fe_mul_inner(r->n, a->n, b->n);
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
r->normalized = 0;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->magnitude <= 8);
|
|
||||||
secp256k1_fe_verify(a);
|
|
||||||
#endif
|
|
||||||
secp256k1_fe_sqr_inner(r->n, a->n);
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
r->normalized = 0;
|
|
||||||
secp256k1_fe_verify(r);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag) {
|
|
||||||
uint64_t mask0, mask1;
|
|
||||||
mask0 = flag + ~((uint64_t)0);
|
|
||||||
mask1 = ~mask0;
|
|
||||||
r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
|
|
||||||
r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
|
|
||||||
r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
|
|
||||||
r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
|
|
||||||
r->n[4] = (r->n[4] & mask0) | (a->n[4] & mask1);
|
|
||||||
#ifdef VERIFY
|
|
||||||
if (a->magnitude > r->magnitude) {
|
|
||||||
r->magnitude = a->magnitude;
|
|
||||||
}
|
|
||||||
r->normalized &= a->normalized;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag) {
|
|
||||||
uint64_t mask0, mask1;
|
|
||||||
mask0 = flag + ~((uint64_t)0);
|
|
||||||
mask1 = ~mask0;
|
|
||||||
r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
|
|
||||||
r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
|
|
||||||
r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
|
|
||||||
r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(a->normalized);
|
|
||||||
#endif
|
|
||||||
r->n[0] = a->n[0] | a->n[1] << 52;
|
|
||||||
r->n[1] = a->n[1] >> 12 | a->n[2] << 40;
|
|
||||||
r->n[2] = a->n[2] >> 24 | a->n[3] << 28;
|
|
||||||
r->n[3] = a->n[3] >> 36 | a->n[4] << 16;
|
|
||||||
}
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void secp256k1_fe_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a) {
|
|
||||||
r->n[0] = a->n[0] & 0xFFFFFFFFFFFFFULL;
|
|
||||||
r->n[1] = a->n[0] >> 52 | ((a->n[1] << 12) & 0xFFFFFFFFFFFFFULL);
|
|
||||||
r->n[2] = a->n[1] >> 40 | ((a->n[2] << 24) & 0xFFFFFFFFFFFFFULL);
|
|
||||||
r->n[3] = a->n[2] >> 28 | ((a->n[3] << 36) & 0xFFFFFFFFFFFFFULL);
|
|
||||||
r->n[4] = a->n[3] >> 16;
|
|
||||||
#ifdef VERIFY
|
|
||||||
r->magnitude = 1;
|
|
||||||
r->normalized = 1;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_FIELD_REPR_IMPL_H */
|
|
||||||
@ -1,279 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_FIELD_INNER5X52_IMPL_H
|
|
||||||
#define SECP256K1_FIELD_INNER5X52_IMPL_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
#define VERIFY_BITS(x, n) VERIFY_CHECK(((x) >> (n)) == 0)
|
|
||||||
#else
|
|
||||||
#define VERIFY_BITS(x, n) do { } while(0)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
|
|
||||||
uint128_t c, d;
|
|
||||||
uint64_t t3, t4, tx, u0;
|
|
||||||
uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
|
|
||||||
const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
|
|
||||||
|
|
||||||
VERIFY_BITS(a[0], 56);
|
|
||||||
VERIFY_BITS(a[1], 56);
|
|
||||||
VERIFY_BITS(a[2], 56);
|
|
||||||
VERIFY_BITS(a[3], 56);
|
|
||||||
VERIFY_BITS(a[4], 52);
|
|
||||||
VERIFY_BITS(b[0], 56);
|
|
||||||
VERIFY_BITS(b[1], 56);
|
|
||||||
VERIFY_BITS(b[2], 56);
|
|
||||||
VERIFY_BITS(b[3], 56);
|
|
||||||
VERIFY_BITS(b[4], 52);
|
|
||||||
VERIFY_CHECK(r != b);
|
|
||||||
VERIFY_CHECK(a != b);
|
|
||||||
|
|
||||||
/* [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
|
|
||||||
* for 0 <= x <= 4, px is a shorthand for sum(a[i]*b[x-i], i=0..x).
|
|
||||||
* for 4 <= x <= 8, px is a shorthand for sum(a[i]*b[x-i], i=(x-4)..4)
|
|
||||||
* Note that [x 0 0 0 0 0] = [x*R].
|
|
||||||
*/
|
|
||||||
|
|
||||||
d = (uint128_t)a0 * b[3]
|
|
||||||
+ (uint128_t)a1 * b[2]
|
|
||||||
+ (uint128_t)a2 * b[1]
|
|
||||||
+ (uint128_t)a3 * b[0];
|
|
||||||
VERIFY_BITS(d, 114);
|
|
||||||
/* [d 0 0 0] = [p3 0 0 0] */
|
|
||||||
c = (uint128_t)a4 * b[4];
|
|
||||||
VERIFY_BITS(c, 112);
|
|
||||||
/* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
|
|
||||||
d += (c & M) * R; c >>= 52;
|
|
||||||
VERIFY_BITS(d, 115);
|
|
||||||
VERIFY_BITS(c, 60);
|
|
||||||
/* [c 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
|
|
||||||
t3 = d & M; d >>= 52;
|
|
||||||
VERIFY_BITS(t3, 52);
|
|
||||||
VERIFY_BITS(d, 63);
|
|
||||||
/* [c 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
|
|
||||||
|
|
||||||
d += (uint128_t)a0 * b[4]
|
|
||||||
+ (uint128_t)a1 * b[3]
|
|
||||||
+ (uint128_t)a2 * b[2]
|
|
||||||
+ (uint128_t)a3 * b[1]
|
|
||||||
+ (uint128_t)a4 * b[0];
|
|
||||||
VERIFY_BITS(d, 115);
|
|
||||||
/* [c 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
d += c * R;
|
|
||||||
VERIFY_BITS(d, 116);
|
|
||||||
/* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
t4 = d & M; d >>= 52;
|
|
||||||
VERIFY_BITS(t4, 52);
|
|
||||||
VERIFY_BITS(d, 64);
|
|
||||||
/* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
tx = (t4 >> 48); t4 &= (M >> 4);
|
|
||||||
VERIFY_BITS(tx, 4);
|
|
||||||
VERIFY_BITS(t4, 48);
|
|
||||||
/* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
|
|
||||||
c = (uint128_t)a0 * b[0];
|
|
||||||
VERIFY_BITS(c, 112);
|
|
||||||
/* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
|
|
||||||
d += (uint128_t)a1 * b[4]
|
|
||||||
+ (uint128_t)a2 * b[3]
|
|
||||||
+ (uint128_t)a3 * b[2]
|
|
||||||
+ (uint128_t)a4 * b[1];
|
|
||||||
VERIFY_BITS(d, 115);
|
|
||||||
/* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
u0 = d & M; d >>= 52;
|
|
||||||
VERIFY_BITS(u0, 52);
|
|
||||||
VERIFY_BITS(d, 63);
|
|
||||||
/* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
/* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
u0 = (u0 << 4) | tx;
|
|
||||||
VERIFY_BITS(u0, 56);
|
|
||||||
/* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
c += (uint128_t)u0 * (R >> 4);
|
|
||||||
VERIFY_BITS(c, 115);
|
|
||||||
/* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
r[0] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[0], 52);
|
|
||||||
VERIFY_BITS(c, 61);
|
|
||||||
/* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
|
|
||||||
c += (uint128_t)a0 * b[1]
|
|
||||||
+ (uint128_t)a1 * b[0];
|
|
||||||
VERIFY_BITS(c, 114);
|
|
||||||
/* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
|
|
||||||
d += (uint128_t)a2 * b[4]
|
|
||||||
+ (uint128_t)a3 * b[3]
|
|
||||||
+ (uint128_t)a4 * b[2];
|
|
||||||
VERIFY_BITS(d, 114);
|
|
||||||
/* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
|
|
||||||
c += (d & M) * R; d >>= 52;
|
|
||||||
VERIFY_BITS(c, 115);
|
|
||||||
VERIFY_BITS(d, 62);
|
|
||||||
/* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
|
|
||||||
r[1] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[1], 52);
|
|
||||||
VERIFY_BITS(c, 63);
|
|
||||||
/* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
|
|
||||||
|
|
||||||
c += (uint128_t)a0 * b[2]
|
|
||||||
+ (uint128_t)a1 * b[1]
|
|
||||||
+ (uint128_t)a2 * b[0];
|
|
||||||
VERIFY_BITS(c, 114);
|
|
||||||
/* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
d += (uint128_t)a3 * b[4]
|
|
||||||
+ (uint128_t)a4 * b[3];
|
|
||||||
VERIFY_BITS(d, 114);
|
|
||||||
/* [d 0 0 t4 t3 c t1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
c += (d & M) * R; d >>= 52;
|
|
||||||
VERIFY_BITS(c, 115);
|
|
||||||
VERIFY_BITS(d, 62);
|
|
||||||
/* [d 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
|
|
||||||
/* [d 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
r[2] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[2], 52);
|
|
||||||
VERIFY_BITS(c, 63);
|
|
||||||
/* [d 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
c += d * R + t3;
|
|
||||||
VERIFY_BITS(c, 100);
|
|
||||||
/* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
r[3] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[3], 52);
|
|
||||||
VERIFY_BITS(c, 48);
|
|
||||||
/* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
c += t4;
|
|
||||||
VERIFY_BITS(c, 49);
|
|
||||||
/* [c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
r[4] = c;
|
|
||||||
VERIFY_BITS(r[4], 49);
|
|
||||||
/* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
|
|
||||||
uint128_t c, d;
|
|
||||||
uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
|
|
||||||
int64_t t3, t4, tx, u0;
|
|
||||||
const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
|
|
||||||
|
|
||||||
VERIFY_BITS(a[0], 56);
|
|
||||||
VERIFY_BITS(a[1], 56);
|
|
||||||
VERIFY_BITS(a[2], 56);
|
|
||||||
VERIFY_BITS(a[3], 56);
|
|
||||||
VERIFY_BITS(a[4], 52);
|
|
||||||
|
|
||||||
/** [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
|
|
||||||
* px is a shorthand for sum(a[i]*a[x-i], i=0..x).
|
|
||||||
* Note that [x 0 0 0 0 0] = [x*R].
|
|
||||||
*/
|
|
||||||
|
|
||||||
d = (uint128_t)(a0*2) * a3
|
|
||||||
+ (uint128_t)(a1*2) * a2;
|
|
||||||
VERIFY_BITS(d, 114);
|
|
||||||
/* [d 0 0 0] = [p3 0 0 0] */
|
|
||||||
c = (uint128_t)a4 * a4;
|
|
||||||
VERIFY_BITS(c, 112);
|
|
||||||
/* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
|
|
||||||
d += (c & M) * R; c >>= 52;
|
|
||||||
VERIFY_BITS(d, 115);
|
|
||||||
VERIFY_BITS(c, 60);
|
|
||||||
/* [c 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
|
|
||||||
t3 = d & M; d >>= 52;
|
|
||||||
VERIFY_BITS(t3, 52);
|
|
||||||
VERIFY_BITS(d, 63);
|
|
||||||
/* [c 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
|
|
||||||
|
|
||||||
a4 *= 2;
|
|
||||||
d += (uint128_t)a0 * a4
|
|
||||||
+ (uint128_t)(a1*2) * a3
|
|
||||||
+ (uint128_t)a2 * a2;
|
|
||||||
VERIFY_BITS(d, 115);
|
|
||||||
/* [c 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
d += c * R;
|
|
||||||
VERIFY_BITS(d, 116);
|
|
||||||
/* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
t4 = d & M; d >>= 52;
|
|
||||||
VERIFY_BITS(t4, 52);
|
|
||||||
VERIFY_BITS(d, 64);
|
|
||||||
/* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
tx = (t4 >> 48); t4 &= (M >> 4);
|
|
||||||
VERIFY_BITS(tx, 4);
|
|
||||||
VERIFY_BITS(t4, 48);
|
|
||||||
/* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
|
|
||||||
|
|
||||||
c = (uint128_t)a0 * a0;
|
|
||||||
VERIFY_BITS(c, 112);
|
|
||||||
/* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
|
|
||||||
d += (uint128_t)a1 * a4
|
|
||||||
+ (uint128_t)(a2*2) * a3;
|
|
||||||
VERIFY_BITS(d, 114);
|
|
||||||
/* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
u0 = d & M; d >>= 52;
|
|
||||||
VERIFY_BITS(u0, 52);
|
|
||||||
VERIFY_BITS(d, 62);
|
|
||||||
/* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
/* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
u0 = (u0 << 4) | tx;
|
|
||||||
VERIFY_BITS(u0, 56);
|
|
||||||
/* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
c += (uint128_t)u0 * (R >> 4);
|
|
||||||
VERIFY_BITS(c, 113);
|
|
||||||
/* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
r[0] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[0], 52);
|
|
||||||
VERIFY_BITS(c, 61);
|
|
||||||
/* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
|
|
||||||
|
|
||||||
a0 *= 2;
|
|
||||||
c += (uint128_t)a0 * a1;
|
|
||||||
VERIFY_BITS(c, 114);
|
|
||||||
/* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
|
|
||||||
d += (uint128_t)a2 * a4
|
|
||||||
+ (uint128_t)a3 * a3;
|
|
||||||
VERIFY_BITS(d, 114);
|
|
||||||
/* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
|
|
||||||
c += (d & M) * R; d >>= 52;
|
|
||||||
VERIFY_BITS(c, 115);
|
|
||||||
VERIFY_BITS(d, 62);
|
|
||||||
/* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
|
|
||||||
r[1] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[1], 52);
|
|
||||||
VERIFY_BITS(c, 63);
|
|
||||||
/* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
|
|
||||||
|
|
||||||
c += (uint128_t)a0 * a2
|
|
||||||
+ (uint128_t)a1 * a1;
|
|
||||||
VERIFY_BITS(c, 114);
|
|
||||||
/* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
d += (uint128_t)a3 * a4;
|
|
||||||
VERIFY_BITS(d, 114);
|
|
||||||
/* [d 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
c += (d & M) * R; d >>= 52;
|
|
||||||
VERIFY_BITS(c, 115);
|
|
||||||
VERIFY_BITS(d, 62);
|
|
||||||
/* [d 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
r[2] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[2], 52);
|
|
||||||
VERIFY_BITS(c, 63);
|
|
||||||
/* [d 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
|
|
||||||
c += d * R + t3;
|
|
||||||
VERIFY_BITS(c, 100);
|
|
||||||
/* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
r[3] = c & M; c >>= 52;
|
|
||||||
VERIFY_BITS(r[3], 52);
|
|
||||||
VERIFY_BITS(c, 48);
|
|
||||||
/* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
c += t4;
|
|
||||||
VERIFY_BITS(c, 49);
|
|
||||||
/* [c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
r[4] = c;
|
|
||||||
VERIFY_BITS(r[4], 49);
|
|
||||||
/* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_FIELD_INNER5X52_IMPL_H */
|
|
||||||
@ -1,318 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_FIELD_IMPL_H
|
|
||||||
#define SECP256K1_FIELD_IMPL_H
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "num.h"
|
|
||||||
|
|
||||||
#if defined(USE_FIELD_10X26)
|
|
||||||
#include "field_10x26_impl.h"
|
|
||||||
#elif defined(USE_FIELD_5X52)
|
|
||||||
#include "field_5x52_impl.h"
|
|
||||||
#else
|
|
||||||
#error "Please select field implementation"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
|
|
||||||
secp256k1_fe na;
|
|
||||||
secp256k1_fe_negate(&na, a, 1);
|
|
||||||
secp256k1_fe_add(&na, b);
|
|
||||||
return secp256k1_fe_normalizes_to_zero(&na);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b) {
|
|
||||||
secp256k1_fe na;
|
|
||||||
secp256k1_fe_negate(&na, a, 1);
|
|
||||||
secp256k1_fe_add(&na, b);
|
|
||||||
return secp256k1_fe_normalizes_to_zero_var(&na);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe *a) {
|
|
||||||
/** Given that p is congruent to 3 mod 4, we can compute the square root of
|
|
||||||
* a mod p as the (p+1)/4'th power of a.
|
|
||||||
*
|
|
||||||
* As (p+1)/4 is an even number, it will have the same result for a and for
|
|
||||||
* (-a). Only one of these two numbers actually has a square root however,
|
|
||||||
* so we test at the end by squaring and comparing to the input.
|
|
||||||
* Also because (p+1)/4 is an even number, the computed square root is
|
|
||||||
* itself always a square (a ** ((p+1)/4) is the square of a ** ((p+1)/8)).
|
|
||||||
*/
|
|
||||||
secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
|
|
||||||
int j;
|
|
||||||
|
|
||||||
VERIFY_CHECK(r != a);
|
|
||||||
|
|
||||||
/** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
|
|
||||||
* { 2, 22, 223 }. Use an addition chain to calculate 2^n - 1 for each block:
|
|
||||||
* 1, [2], 3, 6, 9, 11, [22], 44, 88, 176, 220, [223]
|
|
||||||
*/
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&x2, a);
|
|
||||||
secp256k1_fe_mul(&x2, &x2, a);
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&x3, &x2);
|
|
||||||
secp256k1_fe_mul(&x3, &x3, a);
|
|
||||||
|
|
||||||
x6 = x3;
|
|
||||||
for (j=0; j<3; j++) {
|
|
||||||
secp256k1_fe_sqr(&x6, &x6);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x6, &x6, &x3);
|
|
||||||
|
|
||||||
x9 = x6;
|
|
||||||
for (j=0; j<3; j++) {
|
|
||||||
secp256k1_fe_sqr(&x9, &x9);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x9, &x9, &x3);
|
|
||||||
|
|
||||||
x11 = x9;
|
|
||||||
for (j=0; j<2; j++) {
|
|
||||||
secp256k1_fe_sqr(&x11, &x11);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x11, &x11, &x2);
|
|
||||||
|
|
||||||
x22 = x11;
|
|
||||||
for (j=0; j<11; j++) {
|
|
||||||
secp256k1_fe_sqr(&x22, &x22);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x22, &x22, &x11);
|
|
||||||
|
|
||||||
x44 = x22;
|
|
||||||
for (j=0; j<22; j++) {
|
|
||||||
secp256k1_fe_sqr(&x44, &x44);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x44, &x44, &x22);
|
|
||||||
|
|
||||||
x88 = x44;
|
|
||||||
for (j=0; j<44; j++) {
|
|
||||||
secp256k1_fe_sqr(&x88, &x88);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x88, &x88, &x44);
|
|
||||||
|
|
||||||
x176 = x88;
|
|
||||||
for (j=0; j<88; j++) {
|
|
||||||
secp256k1_fe_sqr(&x176, &x176);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x176, &x176, &x88);
|
|
||||||
|
|
||||||
x220 = x176;
|
|
||||||
for (j=0; j<44; j++) {
|
|
||||||
secp256k1_fe_sqr(&x220, &x220);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x220, &x220, &x44);
|
|
||||||
|
|
||||||
x223 = x220;
|
|
||||||
for (j=0; j<3; j++) {
|
|
||||||
secp256k1_fe_sqr(&x223, &x223);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x223, &x223, &x3);
|
|
||||||
|
|
||||||
/* The final result is then assembled using a sliding window over the blocks. */
|
|
||||||
|
|
||||||
t1 = x223;
|
|
||||||
for (j=0; j<23; j++) {
|
|
||||||
secp256k1_fe_sqr(&t1, &t1);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&t1, &t1, &x22);
|
|
||||||
for (j=0; j<6; j++) {
|
|
||||||
secp256k1_fe_sqr(&t1, &t1);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&t1, &t1, &x2);
|
|
||||||
secp256k1_fe_sqr(&t1, &t1);
|
|
||||||
secp256k1_fe_sqr(r, &t1);
|
|
||||||
|
|
||||||
/* Check that a square root was actually calculated */
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&t1, r);
|
|
||||||
return secp256k1_fe_equal(&t1, a);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *a) {
|
|
||||||
secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
|
|
||||||
int j;
|
|
||||||
|
|
||||||
/** The binary representation of (p - 2) has 5 blocks of 1s, with lengths in
|
|
||||||
* { 1, 2, 22, 223 }. Use an addition chain to calculate 2^n - 1 for each block:
|
|
||||||
* [1], [2], 3, 6, 9, 11, [22], 44, 88, 176, 220, [223]
|
|
||||||
*/
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&x2, a);
|
|
||||||
secp256k1_fe_mul(&x2, &x2, a);
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&x3, &x2);
|
|
||||||
secp256k1_fe_mul(&x3, &x3, a);
|
|
||||||
|
|
||||||
x6 = x3;
|
|
||||||
for (j=0; j<3; j++) {
|
|
||||||
secp256k1_fe_sqr(&x6, &x6);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x6, &x6, &x3);
|
|
||||||
|
|
||||||
x9 = x6;
|
|
||||||
for (j=0; j<3; j++) {
|
|
||||||
secp256k1_fe_sqr(&x9, &x9);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x9, &x9, &x3);
|
|
||||||
|
|
||||||
x11 = x9;
|
|
||||||
for (j=0; j<2; j++) {
|
|
||||||
secp256k1_fe_sqr(&x11, &x11);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x11, &x11, &x2);
|
|
||||||
|
|
||||||
x22 = x11;
|
|
||||||
for (j=0; j<11; j++) {
|
|
||||||
secp256k1_fe_sqr(&x22, &x22);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x22, &x22, &x11);
|
|
||||||
|
|
||||||
x44 = x22;
|
|
||||||
for (j=0; j<22; j++) {
|
|
||||||
secp256k1_fe_sqr(&x44, &x44);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x44, &x44, &x22);
|
|
||||||
|
|
||||||
x88 = x44;
|
|
||||||
for (j=0; j<44; j++) {
|
|
||||||
secp256k1_fe_sqr(&x88, &x88);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x88, &x88, &x44);
|
|
||||||
|
|
||||||
x176 = x88;
|
|
||||||
for (j=0; j<88; j++) {
|
|
||||||
secp256k1_fe_sqr(&x176, &x176);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x176, &x176, &x88);
|
|
||||||
|
|
||||||
x220 = x176;
|
|
||||||
for (j=0; j<44; j++) {
|
|
||||||
secp256k1_fe_sqr(&x220, &x220);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x220, &x220, &x44);
|
|
||||||
|
|
||||||
x223 = x220;
|
|
||||||
for (j=0; j<3; j++) {
|
|
||||||
secp256k1_fe_sqr(&x223, &x223);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&x223, &x223, &x3);
|
|
||||||
|
|
||||||
/* The final result is then assembled using a sliding window over the blocks. */
|
|
||||||
|
|
||||||
t1 = x223;
|
|
||||||
for (j=0; j<23; j++) {
|
|
||||||
secp256k1_fe_sqr(&t1, &t1);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&t1, &t1, &x22);
|
|
||||||
for (j=0; j<5; j++) {
|
|
||||||
secp256k1_fe_sqr(&t1, &t1);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&t1, &t1, a);
|
|
||||||
for (j=0; j<3; j++) {
|
|
||||||
secp256k1_fe_sqr(&t1, &t1);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&t1, &t1, &x2);
|
|
||||||
for (j=0; j<2; j++) {
|
|
||||||
secp256k1_fe_sqr(&t1, &t1);
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(r, a, &t1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *a) {
|
|
||||||
#if defined(USE_FIELD_INV_BUILTIN)
|
|
||||||
secp256k1_fe_inv(r, a);
|
|
||||||
#elif defined(USE_FIELD_INV_NUM)
|
|
||||||
secp256k1_num n, m;
|
|
||||||
static const secp256k1_fe negone = SECP256K1_FE_CONST(
|
|
||||||
0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
|
|
||||||
0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL, 0xFFFFFC2EUL
|
|
||||||
);
|
|
||||||
/* secp256k1 field prime, value p defined in "Standards for Efficient Cryptography" (SEC2) 2.7.1. */
|
|
||||||
static const unsigned char prime[32] = {
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F
|
|
||||||
};
|
|
||||||
unsigned char b[32];
|
|
||||||
int res;
|
|
||||||
secp256k1_fe c = *a;
|
|
||||||
secp256k1_fe_normalize_var(&c);
|
|
||||||
secp256k1_fe_get_b32(b, &c);
|
|
||||||
secp256k1_num_set_bin(&n, b, 32);
|
|
||||||
secp256k1_num_set_bin(&m, prime, 32);
|
|
||||||
secp256k1_num_mod_inverse(&n, &n, &m);
|
|
||||||
secp256k1_num_get_bin(b, 32, &n);
|
|
||||||
res = secp256k1_fe_set_b32(r, b);
|
|
||||||
(void)res;
|
|
||||||
VERIFY_CHECK(res);
|
|
||||||
/* Verify the result is the (unique) valid inverse using non-GMP code. */
|
|
||||||
secp256k1_fe_mul(&c, &c, r);
|
|
||||||
secp256k1_fe_add(&c, &negone);
|
|
||||||
CHECK(secp256k1_fe_normalizes_to_zero_var(&c));
|
|
||||||
#else
|
|
||||||
#error "Please select field inverse implementation"
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_fe_inv_all_var(secp256k1_fe *r, const secp256k1_fe *a, size_t len) {
|
|
||||||
secp256k1_fe u;
|
|
||||||
size_t i;
|
|
||||||
if (len < 1) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
VERIFY_CHECK((r + len <= a) || (a + len <= r));
|
|
||||||
|
|
||||||
r[0] = a[0];
|
|
||||||
|
|
||||||
i = 0;
|
|
||||||
while (++i < len) {
|
|
||||||
secp256k1_fe_mul(&r[i], &r[i - 1], &a[i]);
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_fe_inv_var(&u, &r[--i]);
|
|
||||||
|
|
||||||
while (i > 0) {
|
|
||||||
size_t j = i--;
|
|
||||||
secp256k1_fe_mul(&r[j], &r[i], &u);
|
|
||||||
secp256k1_fe_mul(&u, &u, &a[j]);
|
|
||||||
}
|
|
||||||
|
|
||||||
r[0] = u;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_fe_is_quad_var(const secp256k1_fe *a) {
|
|
||||||
#ifndef USE_NUM_NONE
|
|
||||||
unsigned char b[32];
|
|
||||||
secp256k1_num n;
|
|
||||||
secp256k1_num m;
|
|
||||||
/* secp256k1 field prime, value p defined in "Standards for Efficient Cryptography" (SEC2) 2.7.1. */
|
|
||||||
static const unsigned char prime[32] = {
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F
|
|
||||||
};
|
|
||||||
|
|
||||||
secp256k1_fe c = *a;
|
|
||||||
secp256k1_fe_normalize_var(&c);
|
|
||||||
secp256k1_fe_get_b32(b, &c);
|
|
||||||
secp256k1_num_set_bin(&n, b, 32);
|
|
||||||
secp256k1_num_set_bin(&m, prime, 32);
|
|
||||||
return secp256k1_num_jacobi(&n, &m) >= 0;
|
|
||||||
#else
|
|
||||||
secp256k1_fe r;
|
|
||||||
return secp256k1_fe_sqrt(&r, a);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_FIELD_IMPL_H */
|
|
||||||
@ -1,87 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014, 2015 Thomas Daede, Cory Fields *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
// Autotools creates libsecp256k1-config.h, of which ECMULT_GEN_PREC_BITS is needed.
|
|
||||||
// ifndef guard so downstream users can define their own if they do not use autotools.
|
|
||||||
#if !defined(ECMULT_GEN_PREC_BITS)
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
#define USE_BASIC_CONFIG 1
|
|
||||||
#include "basic-config.h"
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "util.h"
|
|
||||||
#include "field_impl.h"
|
|
||||||
#include "scalar_impl.h"
|
|
||||||
#include "group_impl.h"
|
|
||||||
#include "ecmult_gen_impl.h"
|
|
||||||
|
|
||||||
static void default_error_callback_fn(const char* str, void* data) {
|
|
||||||
(void)data;
|
|
||||||
fprintf(stderr, "[libsecp256k1] internal consistency check failed: %s\n", str);
|
|
||||||
abort();
|
|
||||||
}
|
|
||||||
|
|
||||||
static const secp256k1_callback default_error_callback = {
|
|
||||||
default_error_callback_fn,
|
|
||||||
NULL
|
|
||||||
};
|
|
||||||
|
|
||||||
int main(int argc, char **argv) {
|
|
||||||
secp256k1_ecmult_gen_context ctx;
|
|
||||||
void *prealloc, *base;
|
|
||||||
int inner;
|
|
||||||
int outer;
|
|
||||||
FILE* fp;
|
|
||||||
|
|
||||||
(void)argc;
|
|
||||||
(void)argv;
|
|
||||||
|
|
||||||
fp = fopen("src/ecmult_static_context.h","w");
|
|
||||||
if (fp == NULL) {
|
|
||||||
fprintf(stderr, "Could not open src/ecmult_static_context.h for writing!\n");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
fprintf(fp, "#ifndef _SECP256K1_ECMULT_STATIC_CONTEXT_\n");
|
|
||||||
fprintf(fp, "#define _SECP256K1_ECMULT_STATIC_CONTEXT_\n");
|
|
||||||
fprintf(fp, "#include \"src/group.h\"\n");
|
|
||||||
fprintf(fp, "#define SC SECP256K1_GE_STORAGE_CONST\n");
|
|
||||||
fprintf(fp, "#if ECMULT_GEN_PREC_N != %d || ECMULT_GEN_PREC_G != %d\n", ECMULT_GEN_PREC_N, ECMULT_GEN_PREC_G);
|
|
||||||
fprintf(fp, " #error configuration mismatch, invalid ECMULT_GEN_PREC_N, ECMULT_GEN_PREC_G. Try deleting ecmult_static_context.h before the build.\n");
|
|
||||||
fprintf(fp, "#endif\n");
|
|
||||||
fprintf(fp, "static const secp256k1_ge_storage secp256k1_ecmult_static_context[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G] = {\n");
|
|
||||||
|
|
||||||
base = checked_malloc(&default_error_callback, SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE);
|
|
||||||
prealloc = base;
|
|
||||||
secp256k1_ecmult_gen_context_init(&ctx);
|
|
||||||
secp256k1_ecmult_gen_context_build(&ctx, &prealloc);
|
|
||||||
for(outer = 0; outer != ECMULT_GEN_PREC_N; outer++) {
|
|
||||||
fprintf(fp,"{\n");
|
|
||||||
for(inner = 0; inner != ECMULT_GEN_PREC_G; inner++) {
|
|
||||||
fprintf(fp," SC(%uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu)", SECP256K1_GE_STORAGE_CONST_GET((*ctx.prec)[outer][inner]));
|
|
||||||
if (inner != ECMULT_GEN_PREC_G - 1) {
|
|
||||||
fprintf(fp,",\n");
|
|
||||||
} else {
|
|
||||||
fprintf(fp,"\n");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (outer != ECMULT_GEN_PREC_N - 1) {
|
|
||||||
fprintf(fp,"},\n");
|
|
||||||
} else {
|
|
||||||
fprintf(fp,"}\n");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
fprintf(fp,"};\n");
|
|
||||||
secp256k1_ecmult_gen_context_clear(&ctx);
|
|
||||||
free(base);
|
|
||||||
|
|
||||||
fprintf(fp, "#undef SC\n");
|
|
||||||
fprintf(fp, "#endif\n");
|
|
||||||
fclose(fp);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@ -1,142 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_GROUP_H
|
|
||||||
#define SECP256K1_GROUP_H
|
|
||||||
|
|
||||||
#include "num.h"
|
|
||||||
#include "field.h"
|
|
||||||
|
|
||||||
/** A group element of the secp256k1 curve, in affine coordinates. */
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_fe x;
|
|
||||||
secp256k1_fe y;
|
|
||||||
int infinity; /* whether this represents the point at infinity */
|
|
||||||
} secp256k1_ge;
|
|
||||||
|
|
||||||
#define SECP256K1_GE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), 0}
|
|
||||||
#define SECP256K1_GE_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
|
|
||||||
|
|
||||||
/** A group element of the secp256k1 curve, in jacobian coordinates. */
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_fe x; /* actual X: x/z^2 */
|
|
||||||
secp256k1_fe y; /* actual Y: y/z^3 */
|
|
||||||
secp256k1_fe z;
|
|
||||||
int infinity; /* whether this represents the point at infinity */
|
|
||||||
} secp256k1_gej;
|
|
||||||
|
|
||||||
#define SECP256K1_GEJ_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1), 0}
|
|
||||||
#define SECP256K1_GEJ_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_fe_storage x;
|
|
||||||
secp256k1_fe_storage y;
|
|
||||||
} secp256k1_ge_storage;
|
|
||||||
|
|
||||||
#define SECP256K1_GE_STORAGE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_STORAGE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_STORAGE_CONST((i),(j),(k),(l),(m),(n),(o),(p))}
|
|
||||||
|
|
||||||
#define SECP256K1_GE_STORAGE_CONST_GET(t) SECP256K1_FE_STORAGE_CONST_GET(t.x), SECP256K1_FE_STORAGE_CONST_GET(t.y)
|
|
||||||
|
|
||||||
/** Set a group element equal to the point with given X and Y coordinates */
|
|
||||||
static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y);
|
|
||||||
|
|
||||||
/** Set a group element (affine) equal to the point with the given X coordinate
|
|
||||||
* and a Y coordinate that is a quadratic residue modulo p. The return value
|
|
||||||
* is true iff a coordinate with the given X coordinate exists.
|
|
||||||
*/
|
|
||||||
static int secp256k1_ge_set_xquad(secp256k1_ge *r, const secp256k1_fe *x);
|
|
||||||
|
|
||||||
/** Set a group element (affine) equal to the point with the given X coordinate, and given oddness
|
|
||||||
* for Y. Return value indicates whether the result is valid. */
|
|
||||||
static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int odd);
|
|
||||||
|
|
||||||
/** Check whether a group element is the point at infinity. */
|
|
||||||
static int secp256k1_ge_is_infinity(const secp256k1_ge *a);
|
|
||||||
|
|
||||||
/** Check whether a group element is valid (i.e., on the curve). */
|
|
||||||
static int secp256k1_ge_is_valid_var(const secp256k1_ge *a);
|
|
||||||
|
|
||||||
static void secp256k1_ge_neg(secp256k1_ge *r, const secp256k1_ge *a);
|
|
||||||
|
|
||||||
/** Set a group element equal to another which is given in jacobian coordinates */
|
|
||||||
static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a);
|
|
||||||
|
|
||||||
/** Set a batch of group elements equal to the inputs given in jacobian coordinates */
|
|
||||||
static void secp256k1_ge_set_all_gej_var(secp256k1_ge *r, const secp256k1_gej *a, size_t len);
|
|
||||||
|
|
||||||
/** Bring a batch inputs given in jacobian coordinates (with known z-ratios) to
|
|
||||||
* the same global z "denominator". zr must contain the known z-ratios such
|
|
||||||
* that mul(a[i].z, zr[i+1]) == a[i+1].z. zr[0] is ignored. The x and y
|
|
||||||
* coordinates of the result are stored in r, the common z coordinate is
|
|
||||||
* stored in globalz. */
|
|
||||||
static void secp256k1_ge_globalz_set_table_gej(size_t len, secp256k1_ge *r, secp256k1_fe *globalz, const secp256k1_gej *a, const secp256k1_fe *zr);
|
|
||||||
|
|
||||||
/** Set a group element (affine) equal to the point at infinity. */
|
|
||||||
static void secp256k1_ge_set_infinity(secp256k1_ge *r);
|
|
||||||
|
|
||||||
/** Set a group element (jacobian) equal to the point at infinity. */
|
|
||||||
static void secp256k1_gej_set_infinity(secp256k1_gej *r);
|
|
||||||
|
|
||||||
/** Set a group element (jacobian) equal to another which is given in affine coordinates. */
|
|
||||||
static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a);
|
|
||||||
|
|
||||||
/** Compare the X coordinate of a group element (jacobian). */
|
|
||||||
static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a);
|
|
||||||
|
|
||||||
/** Set r equal to the inverse of a (i.e., mirrored around the X axis) */
|
|
||||||
static void secp256k1_gej_neg(secp256k1_gej *r, const secp256k1_gej *a);
|
|
||||||
|
|
||||||
/** Check whether a group element is the point at infinity. */
|
|
||||||
static int secp256k1_gej_is_infinity(const secp256k1_gej *a);
|
|
||||||
|
|
||||||
/** Check whether a group element's y coordinate is a quadratic residue. */
|
|
||||||
static int secp256k1_gej_has_quad_y_var(const secp256k1_gej *a);
|
|
||||||
|
|
||||||
/** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0).
|
|
||||||
* a may not be zero. Constant time. */
|
|
||||||
static void secp256k1_gej_double_nonzero(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr);
|
|
||||||
|
|
||||||
/** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0). */
|
|
||||||
static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr);
|
|
||||||
|
|
||||||
/** Set r equal to the sum of a and b. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */
|
|
||||||
static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_gej *b, secp256k1_fe *rzr);
|
|
||||||
|
|
||||||
/** Set r equal to the sum of a and b (with b given in affine coordinates, and not infinity). */
|
|
||||||
static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b);
|
|
||||||
|
|
||||||
/** Set r equal to the sum of a and b (with b given in affine coordinates). This is more efficient
|
|
||||||
than secp256k1_gej_add_var. It is identical to secp256k1_gej_add_ge but without constant-time
|
|
||||||
guarantee, and b is allowed to be infinity. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */
|
|
||||||
static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr);
|
|
||||||
|
|
||||||
/** Set r equal to the sum of a and b (with the inverse of b's Z coordinate passed as bzinv). */
|
|
||||||
static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv);
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
/** Set r to be equal to lambda times a, where lambda is chosen in a way such that this is very fast. */
|
|
||||||
static void secp256k1_ge_mul_lambda(secp256k1_ge *r, const secp256k1_ge *a);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Clear a secp256k1_gej to prevent leaking sensitive information. */
|
|
||||||
static void secp256k1_gej_clear(secp256k1_gej *r);
|
|
||||||
|
|
||||||
/** Clear a secp256k1_ge to prevent leaking sensitive information. */
|
|
||||||
static void secp256k1_ge_clear(secp256k1_ge *r);
|
|
||||||
|
|
||||||
/** Convert a group element to the storage type. */
|
|
||||||
static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge *a);
|
|
||||||
|
|
||||||
/** Convert a group element back from the storage type. */
|
|
||||||
static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a);
|
|
||||||
|
|
||||||
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */
|
|
||||||
static void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag);
|
|
||||||
|
|
||||||
/** Rescale a jacobian point by b which must be non-zero. Constant-time. */
|
|
||||||
static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *b);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_GROUP_H */
|
|
||||||
@ -1,705 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_GROUP_IMPL_H
|
|
||||||
#define SECP256K1_GROUP_IMPL_H
|
|
||||||
|
|
||||||
#include "num.h"
|
|
||||||
#include "field.h"
|
|
||||||
#include "group.h"
|
|
||||||
|
|
||||||
/* These points can be generated in sage as follows:
|
|
||||||
*
|
|
||||||
* 0. Setup a worksheet with the following parameters.
|
|
||||||
* b = 4 # whatever CURVE_B will be set to
|
|
||||||
* F = FiniteField (0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F)
|
|
||||||
* C = EllipticCurve ([F (0), F (b)])
|
|
||||||
*
|
|
||||||
* 1. Determine all the small orders available to you. (If there are
|
|
||||||
* no satisfactory ones, go back and change b.)
|
|
||||||
* print C.order().factor(limit=1000)
|
|
||||||
*
|
|
||||||
* 2. Choose an order as one of the prime factors listed in the above step.
|
|
||||||
* (You can also multiply some to get a composite order, though the
|
|
||||||
* tests will crash trying to invert scalars during signing.) We take a
|
|
||||||
* random point and scale it to drop its order to the desired value.
|
|
||||||
* There is some probability this won't work; just try again.
|
|
||||||
* order = 199
|
|
||||||
* P = C.random_point()
|
|
||||||
* P = (int(P.order()) / int(order)) * P
|
|
||||||
* assert(P.order() == order)
|
|
||||||
*
|
|
||||||
* 3. Print the values. You'll need to use a vim macro or something to
|
|
||||||
* split the hex output into 4-byte chunks.
|
|
||||||
* print "%x %x" % P.xy()
|
|
||||||
*/
|
|
||||||
#if defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
# if EXHAUSTIVE_TEST_ORDER == 199
|
|
||||||
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_GE_CONST(
|
|
||||||
0xFA7CC9A7, 0x0737F2DB, 0xA749DD39, 0x2B4FB069,
|
|
||||||
0x3B017A7D, 0xA808C2F1, 0xFB12940C, 0x9EA66C18,
|
|
||||||
0x78AC123A, 0x5ED8AEF3, 0x8732BC91, 0x1F3A2868,
|
|
||||||
0x48DF246C, 0x808DAE72, 0xCFE52572, 0x7F0501ED
|
|
||||||
);
|
|
||||||
|
|
||||||
static const int CURVE_B = 4;
|
|
||||||
# elif EXHAUSTIVE_TEST_ORDER == 13
|
|
||||||
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_GE_CONST(
|
|
||||||
0xedc60018, 0xa51a786b, 0x2ea91f4d, 0x4c9416c0,
|
|
||||||
0x9de54c3b, 0xa1316554, 0x6cf4345c, 0x7277ef15,
|
|
||||||
0x54cb1b6b, 0xdc8c1273, 0x087844ea, 0x43f4603e,
|
|
||||||
0x0eaf9a43, 0xf6effe55, 0x939f806d, 0x37adf8ac
|
|
||||||
);
|
|
||||||
static const int CURVE_B = 2;
|
|
||||||
# else
|
|
||||||
# error No known generator for the specified exhaustive test group order.
|
|
||||||
# endif
|
|
||||||
#else
|
|
||||||
/** Generator for secp256k1, value 'g' defined in
|
|
||||||
* "Standards for Efficient Cryptography" (SEC2) 2.7.1.
|
|
||||||
*/
|
|
||||||
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_GE_CONST(
|
|
||||||
0x79BE667EUL, 0xF9DCBBACUL, 0x55A06295UL, 0xCE870B07UL,
|
|
||||||
0x029BFCDBUL, 0x2DCE28D9UL, 0x59F2815BUL, 0x16F81798UL,
|
|
||||||
0x483ADA77UL, 0x26A3C465UL, 0x5DA4FBFCUL, 0x0E1108A8UL,
|
|
||||||
0xFD17B448UL, 0xA6855419UL, 0x9C47D08FUL, 0xFB10D4B8UL
|
|
||||||
);
|
|
||||||
|
|
||||||
static const int CURVE_B = 7;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zi) {
|
|
||||||
secp256k1_fe zi2;
|
|
||||||
secp256k1_fe zi3;
|
|
||||||
secp256k1_fe_sqr(&zi2, zi);
|
|
||||||
secp256k1_fe_mul(&zi3, &zi2, zi);
|
|
||||||
secp256k1_fe_mul(&r->x, &a->x, &zi2);
|
|
||||||
secp256k1_fe_mul(&r->y, &a->y, &zi3);
|
|
||||||
r->infinity = a->infinity;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y) {
|
|
||||||
r->infinity = 0;
|
|
||||||
r->x = *x;
|
|
||||||
r->y = *y;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ge_is_infinity(const secp256k1_ge *a) {
|
|
||||||
return a->infinity;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_neg(secp256k1_ge *r, const secp256k1_ge *a) {
|
|
||||||
*r = *a;
|
|
||||||
secp256k1_fe_normalize_weak(&r->y);
|
|
||||||
secp256k1_fe_negate(&r->y, &r->y, 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a) {
|
|
||||||
secp256k1_fe z2, z3;
|
|
||||||
r->infinity = a->infinity;
|
|
||||||
secp256k1_fe_inv(&a->z, &a->z);
|
|
||||||
secp256k1_fe_sqr(&z2, &a->z);
|
|
||||||
secp256k1_fe_mul(&z3, &a->z, &z2);
|
|
||||||
secp256k1_fe_mul(&a->x, &a->x, &z2);
|
|
||||||
secp256k1_fe_mul(&a->y, &a->y, &z3);
|
|
||||||
secp256k1_fe_set_int(&a->z, 1);
|
|
||||||
r->x = a->x;
|
|
||||||
r->y = a->y;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a) {
|
|
||||||
secp256k1_fe z2, z3;
|
|
||||||
r->infinity = a->infinity;
|
|
||||||
if (a->infinity) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
secp256k1_fe_inv_var(&a->z, &a->z);
|
|
||||||
secp256k1_fe_sqr(&z2, &a->z);
|
|
||||||
secp256k1_fe_mul(&z3, &a->z, &z2);
|
|
||||||
secp256k1_fe_mul(&a->x, &a->x, &z2);
|
|
||||||
secp256k1_fe_mul(&a->y, &a->y, &z3);
|
|
||||||
secp256k1_fe_set_int(&a->z, 1);
|
|
||||||
r->x = a->x;
|
|
||||||
r->y = a->y;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_set_all_gej_var(secp256k1_ge *r, const secp256k1_gej *a, size_t len) {
|
|
||||||
secp256k1_fe u;
|
|
||||||
size_t i;
|
|
||||||
size_t last_i = SIZE_MAX;
|
|
||||||
|
|
||||||
for (i = 0; i < len; i++) {
|
|
||||||
if (!a[i].infinity) {
|
|
||||||
/* Use destination's x coordinates as scratch space */
|
|
||||||
if (last_i == SIZE_MAX) {
|
|
||||||
r[i].x = a[i].z;
|
|
||||||
} else {
|
|
||||||
secp256k1_fe_mul(&r[i].x, &r[last_i].x, &a[i].z);
|
|
||||||
}
|
|
||||||
last_i = i;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (last_i == SIZE_MAX) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
secp256k1_fe_inv_var(&u, &r[last_i].x);
|
|
||||||
|
|
||||||
i = last_i;
|
|
||||||
while (i > 0) {
|
|
||||||
i--;
|
|
||||||
if (!a[i].infinity) {
|
|
||||||
secp256k1_fe_mul(&r[last_i].x, &r[i].x, &u);
|
|
||||||
secp256k1_fe_mul(&u, &u, &a[last_i].z);
|
|
||||||
last_i = i;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
VERIFY_CHECK(!a[last_i].infinity);
|
|
||||||
r[last_i].x = u;
|
|
||||||
|
|
||||||
for (i = 0; i < len; i++) {
|
|
||||||
r[i].infinity = a[i].infinity;
|
|
||||||
if (!a[i].infinity) {
|
|
||||||
secp256k1_ge_set_gej_zinv(&r[i], &a[i], &r[i].x);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_globalz_set_table_gej(size_t len, secp256k1_ge *r, secp256k1_fe *globalz, const secp256k1_gej *a, const secp256k1_fe *zr) {
|
|
||||||
size_t i = len - 1;
|
|
||||||
secp256k1_fe zs;
|
|
||||||
|
|
||||||
if (len > 0) {
|
|
||||||
/* The z of the final point gives us the "global Z" for the table. */
|
|
||||||
r[i].x = a[i].x;
|
|
||||||
r[i].y = a[i].y;
|
|
||||||
/* Ensure all y values are in weak normal form for fast negation of points */
|
|
||||||
secp256k1_fe_normalize_weak(&r[i].y);
|
|
||||||
*globalz = a[i].z;
|
|
||||||
r[i].infinity = 0;
|
|
||||||
zs = zr[i];
|
|
||||||
|
|
||||||
/* Work our way backwards, using the z-ratios to scale the x/y values. */
|
|
||||||
while (i > 0) {
|
|
||||||
if (i != len - 1) {
|
|
||||||
secp256k1_fe_mul(&zs, &zs, &zr[i]);
|
|
||||||
}
|
|
||||||
i--;
|
|
||||||
secp256k1_ge_set_gej_zinv(&r[i], &a[i], &zs);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_set_infinity(secp256k1_gej *r) {
|
|
||||||
r->infinity = 1;
|
|
||||||
secp256k1_fe_clear(&r->x);
|
|
||||||
secp256k1_fe_clear(&r->y);
|
|
||||||
secp256k1_fe_clear(&r->z);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_set_infinity(secp256k1_ge *r) {
|
|
||||||
r->infinity = 1;
|
|
||||||
secp256k1_fe_clear(&r->x);
|
|
||||||
secp256k1_fe_clear(&r->y);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_clear(secp256k1_gej *r) {
|
|
||||||
r->infinity = 0;
|
|
||||||
secp256k1_fe_clear(&r->x);
|
|
||||||
secp256k1_fe_clear(&r->y);
|
|
||||||
secp256k1_fe_clear(&r->z);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_clear(secp256k1_ge *r) {
|
|
||||||
r->infinity = 0;
|
|
||||||
secp256k1_fe_clear(&r->x);
|
|
||||||
secp256k1_fe_clear(&r->y);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ge_set_xquad(secp256k1_ge *r, const secp256k1_fe *x) {
|
|
||||||
secp256k1_fe x2, x3, c;
|
|
||||||
r->x = *x;
|
|
||||||
secp256k1_fe_sqr(&x2, x);
|
|
||||||
secp256k1_fe_mul(&x3, x, &x2);
|
|
||||||
r->infinity = 0;
|
|
||||||
secp256k1_fe_set_int(&c, CURVE_B);
|
|
||||||
secp256k1_fe_add(&c, &x3);
|
|
||||||
return secp256k1_fe_sqrt(&r->y, &c);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int odd) {
|
|
||||||
if (!secp256k1_ge_set_xquad(r, x)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_fe_normalize_var(&r->y);
|
|
||||||
if (secp256k1_fe_is_odd(&r->y) != odd) {
|
|
||||||
secp256k1_fe_negate(&r->y, &r->y, 1);
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a) {
|
|
||||||
r->infinity = a->infinity;
|
|
||||||
r->x = a->x;
|
|
||||||
r->y = a->y;
|
|
||||||
secp256k1_fe_set_int(&r->z, 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a) {
|
|
||||||
secp256k1_fe r, r2;
|
|
||||||
VERIFY_CHECK(!a->infinity);
|
|
||||||
secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
|
|
||||||
r2 = a->x; secp256k1_fe_normalize_weak(&r2);
|
|
||||||
return secp256k1_fe_equal_var(&r, &r2);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_neg(secp256k1_gej *r, const secp256k1_gej *a) {
|
|
||||||
r->infinity = a->infinity;
|
|
||||||
r->x = a->x;
|
|
||||||
r->y = a->y;
|
|
||||||
r->z = a->z;
|
|
||||||
secp256k1_fe_normalize_weak(&r->y);
|
|
||||||
secp256k1_fe_negate(&r->y, &r->y, 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_gej_is_infinity(const secp256k1_gej *a) {
|
|
||||||
return a->infinity;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_gej_is_valid_var(const secp256k1_gej *a) {
|
|
||||||
secp256k1_fe y2, x3, z2, z6;
|
|
||||||
if (a->infinity) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
/** y^2 = x^3 + 7
|
|
||||||
* (Y/Z^3)^2 = (X/Z^2)^3 + 7
|
|
||||||
* Y^2 / Z^6 = X^3 / Z^6 + 7
|
|
||||||
* Y^2 = X^3 + 7*Z^6
|
|
||||||
*/
|
|
||||||
secp256k1_fe_sqr(&y2, &a->y);
|
|
||||||
secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
|
|
||||||
secp256k1_fe_sqr(&z2, &a->z);
|
|
||||||
secp256k1_fe_sqr(&z6, &z2); secp256k1_fe_mul(&z6, &z6, &z2);
|
|
||||||
secp256k1_fe_mul_int(&z6, CURVE_B);
|
|
||||||
secp256k1_fe_add(&x3, &z6);
|
|
||||||
secp256k1_fe_normalize_weak(&x3);
|
|
||||||
return secp256k1_fe_equal_var(&y2, &x3);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
|
|
||||||
secp256k1_fe y2, x3, c;
|
|
||||||
if (a->infinity) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
/* y^2 = x^3 + 7 */
|
|
||||||
secp256k1_fe_sqr(&y2, &a->y);
|
|
||||||
secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
|
|
||||||
secp256k1_fe_set_int(&c, CURVE_B);
|
|
||||||
secp256k1_fe_add(&x3, &c);
|
|
||||||
secp256k1_fe_normalize_weak(&x3);
|
|
||||||
return secp256k1_fe_equal_var(&y2, &x3);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
|
|
||||||
/* Operations: 3 mul, 4 sqr, 0 normalize, 12 mul_int/add/negate.
|
|
||||||
*
|
|
||||||
* Note that there is an implementation described at
|
|
||||||
* https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
|
|
||||||
* which trades a multiply for a square, but in practice this is actually slower,
|
|
||||||
* mainly because it requires more normalizations.
|
|
||||||
*/
|
|
||||||
secp256k1_fe t1,t2,t3,t4;
|
|
||||||
/** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity,
|
|
||||||
* Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have
|
|
||||||
* y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p.
|
|
||||||
*
|
|
||||||
* Having said this, if this function receives a point on a sextic twist, e.g. by
|
|
||||||
* a fault attack, it is possible for y to be 0. This happens for y^2 = x^3 + 6,
|
|
||||||
* since -6 does have a cube root mod p. For this point, this function will not set
|
|
||||||
* the infinity flag even though the point doubles to infinity, and the result
|
|
||||||
* point will be gibberish (z = 0 but infinity = 0).
|
|
||||||
*/
|
|
||||||
r->infinity = a->infinity;
|
|
||||||
if (r->infinity) {
|
|
||||||
if (rzr != NULL) {
|
|
||||||
secp256k1_fe_set_int(rzr, 1);
|
|
||||||
}
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (rzr != NULL) {
|
|
||||||
*rzr = a->y;
|
|
||||||
secp256k1_fe_normalize_weak(rzr);
|
|
||||||
secp256k1_fe_mul_int(rzr, 2);
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_fe_mul(&r->z, &a->z, &a->y);
|
|
||||||
secp256k1_fe_mul_int(&r->z, 2); /* Z' = 2*Y*Z (2) */
|
|
||||||
secp256k1_fe_sqr(&t1, &a->x);
|
|
||||||
secp256k1_fe_mul_int(&t1, 3); /* T1 = 3*X^2 (3) */
|
|
||||||
secp256k1_fe_sqr(&t2, &t1); /* T2 = 9*X^4 (1) */
|
|
||||||
secp256k1_fe_sqr(&t3, &a->y);
|
|
||||||
secp256k1_fe_mul_int(&t3, 2); /* T3 = 2*Y^2 (2) */
|
|
||||||
secp256k1_fe_sqr(&t4, &t3);
|
|
||||||
secp256k1_fe_mul_int(&t4, 2); /* T4 = 8*Y^4 (2) */
|
|
||||||
secp256k1_fe_mul(&t3, &t3, &a->x); /* T3 = 2*X*Y^2 (1) */
|
|
||||||
r->x = t3;
|
|
||||||
secp256k1_fe_mul_int(&r->x, 4); /* X' = 8*X*Y^2 (4) */
|
|
||||||
secp256k1_fe_negate(&r->x, &r->x, 4); /* X' = -8*X*Y^2 (5) */
|
|
||||||
secp256k1_fe_add(&r->x, &t2); /* X' = 9*X^4 - 8*X*Y^2 (6) */
|
|
||||||
secp256k1_fe_negate(&t2, &t2, 1); /* T2 = -9*X^4 (2) */
|
|
||||||
secp256k1_fe_mul_int(&t3, 6); /* T3 = 12*X*Y^2 (6) */
|
|
||||||
secp256k1_fe_add(&t3, &t2); /* T3 = 12*X*Y^2 - 9*X^4 (8) */
|
|
||||||
secp256k1_fe_mul(&r->y, &t1, &t3); /* Y' = 36*X^3*Y^2 - 27*X^6 (1) */
|
|
||||||
secp256k1_fe_negate(&t2, &t4, 2); /* T2 = -8*Y^4 (3) */
|
|
||||||
secp256k1_fe_add(&r->y, &t2); /* Y' = 36*X^3*Y^2 - 27*X^6 - 8*Y^4 (4) */
|
|
||||||
}
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void secp256k1_gej_double_nonzero(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
|
|
||||||
VERIFY_CHECK(!secp256k1_gej_is_infinity(a));
|
|
||||||
secp256k1_gej_double_var(r, a, rzr);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_gej *b, secp256k1_fe *rzr) {
|
|
||||||
/* Operations: 12 mul, 4 sqr, 2 normalize, 12 mul_int/add/negate */
|
|
||||||
secp256k1_fe z22, z12, u1, u2, s1, s2, h, i, i2, h2, h3, t;
|
|
||||||
|
|
||||||
if (a->infinity) {
|
|
||||||
VERIFY_CHECK(rzr == NULL);
|
|
||||||
*r = *b;
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (b->infinity) {
|
|
||||||
if (rzr != NULL) {
|
|
||||||
secp256k1_fe_set_int(rzr, 1);
|
|
||||||
}
|
|
||||||
*r = *a;
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
r->infinity = 0;
|
|
||||||
secp256k1_fe_sqr(&z22, &b->z);
|
|
||||||
secp256k1_fe_sqr(&z12, &a->z);
|
|
||||||
secp256k1_fe_mul(&u1, &a->x, &z22);
|
|
||||||
secp256k1_fe_mul(&u2, &b->x, &z12);
|
|
||||||
secp256k1_fe_mul(&s1, &a->y, &z22); secp256k1_fe_mul(&s1, &s1, &b->z);
|
|
||||||
secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
|
|
||||||
secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
|
|
||||||
secp256k1_fe_negate(&i, &s1, 1); secp256k1_fe_add(&i, &s2);
|
|
||||||
if (secp256k1_fe_normalizes_to_zero_var(&h)) {
|
|
||||||
if (secp256k1_fe_normalizes_to_zero_var(&i)) {
|
|
||||||
secp256k1_gej_double_var(r, a, rzr);
|
|
||||||
} else {
|
|
||||||
if (rzr != NULL) {
|
|
||||||
secp256k1_fe_set_int(rzr, 0);
|
|
||||||
}
|
|
||||||
r->infinity = 1;
|
|
||||||
}
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
secp256k1_fe_sqr(&i2, &i);
|
|
||||||
secp256k1_fe_sqr(&h2, &h);
|
|
||||||
secp256k1_fe_mul(&h3, &h, &h2);
|
|
||||||
secp256k1_fe_mul(&h, &h, &b->z);
|
|
||||||
if (rzr != NULL) {
|
|
||||||
*rzr = h;
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&r->z, &a->z, &h);
|
|
||||||
secp256k1_fe_mul(&t, &u1, &h2);
|
|
||||||
r->x = t; secp256k1_fe_mul_int(&r->x, 2); secp256k1_fe_add(&r->x, &h3); secp256k1_fe_negate(&r->x, &r->x, 3); secp256k1_fe_add(&r->x, &i2);
|
|
||||||
secp256k1_fe_negate(&r->y, &r->x, 5); secp256k1_fe_add(&r->y, &t); secp256k1_fe_mul(&r->y, &r->y, &i);
|
|
||||||
secp256k1_fe_mul(&h3, &h3, &s1); secp256k1_fe_negate(&h3, &h3, 1);
|
|
||||||
secp256k1_fe_add(&r->y, &h3);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr) {
|
|
||||||
/* 8 mul, 3 sqr, 4 normalize, 12 mul_int/add/negate */
|
|
||||||
secp256k1_fe z12, u1, u2, s1, s2, h, i, i2, h2, h3, t;
|
|
||||||
if (a->infinity) {
|
|
||||||
VERIFY_CHECK(rzr == NULL);
|
|
||||||
secp256k1_gej_set_ge(r, b);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (b->infinity) {
|
|
||||||
if (rzr != NULL) {
|
|
||||||
secp256k1_fe_set_int(rzr, 1);
|
|
||||||
}
|
|
||||||
*r = *a;
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
r->infinity = 0;
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&z12, &a->z);
|
|
||||||
u1 = a->x; secp256k1_fe_normalize_weak(&u1);
|
|
||||||
secp256k1_fe_mul(&u2, &b->x, &z12);
|
|
||||||
s1 = a->y; secp256k1_fe_normalize_weak(&s1);
|
|
||||||
secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
|
|
||||||
secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
|
|
||||||
secp256k1_fe_negate(&i, &s1, 1); secp256k1_fe_add(&i, &s2);
|
|
||||||
if (secp256k1_fe_normalizes_to_zero_var(&h)) {
|
|
||||||
if (secp256k1_fe_normalizes_to_zero_var(&i)) {
|
|
||||||
secp256k1_gej_double_var(r, a, rzr);
|
|
||||||
} else {
|
|
||||||
if (rzr != NULL) {
|
|
||||||
secp256k1_fe_set_int(rzr, 0);
|
|
||||||
}
|
|
||||||
r->infinity = 1;
|
|
||||||
}
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
secp256k1_fe_sqr(&i2, &i);
|
|
||||||
secp256k1_fe_sqr(&h2, &h);
|
|
||||||
secp256k1_fe_mul(&h3, &h, &h2);
|
|
||||||
if (rzr != NULL) {
|
|
||||||
*rzr = h;
|
|
||||||
}
|
|
||||||
secp256k1_fe_mul(&r->z, &a->z, &h);
|
|
||||||
secp256k1_fe_mul(&t, &u1, &h2);
|
|
||||||
r->x = t; secp256k1_fe_mul_int(&r->x, 2); secp256k1_fe_add(&r->x, &h3); secp256k1_fe_negate(&r->x, &r->x, 3); secp256k1_fe_add(&r->x, &i2);
|
|
||||||
secp256k1_fe_negate(&r->y, &r->x, 5); secp256k1_fe_add(&r->y, &t); secp256k1_fe_mul(&r->y, &r->y, &i);
|
|
||||||
secp256k1_fe_mul(&h3, &h3, &s1); secp256k1_fe_negate(&h3, &h3, 1);
|
|
||||||
secp256k1_fe_add(&r->y, &h3);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv) {
|
|
||||||
/* 9 mul, 3 sqr, 4 normalize, 12 mul_int/add/negate */
|
|
||||||
secp256k1_fe az, z12, u1, u2, s1, s2, h, i, i2, h2, h3, t;
|
|
||||||
|
|
||||||
if (b->infinity) {
|
|
||||||
*r = *a;
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (a->infinity) {
|
|
||||||
secp256k1_fe bzinv2, bzinv3;
|
|
||||||
r->infinity = b->infinity;
|
|
||||||
secp256k1_fe_sqr(&bzinv2, bzinv);
|
|
||||||
secp256k1_fe_mul(&bzinv3, &bzinv2, bzinv);
|
|
||||||
secp256k1_fe_mul(&r->x, &b->x, &bzinv2);
|
|
||||||
secp256k1_fe_mul(&r->y, &b->y, &bzinv3);
|
|
||||||
secp256k1_fe_set_int(&r->z, 1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
r->infinity = 0;
|
|
||||||
|
|
||||||
/** We need to calculate (rx,ry,rz) = (ax,ay,az) + (bx,by,1/bzinv). Due to
|
|
||||||
* secp256k1's isomorphism we can multiply the Z coordinates on both sides
|
|
||||||
* by bzinv, and get: (rx,ry,rz*bzinv) = (ax,ay,az*bzinv) + (bx,by,1).
|
|
||||||
* This means that (rx,ry,rz) can be calculated as
|
|
||||||
* (ax,ay,az*bzinv) + (bx,by,1), when not applying the bzinv factor to rz.
|
|
||||||
* The variable az below holds the modified Z coordinate for a, which is used
|
|
||||||
* for the computation of rx and ry, but not for rz.
|
|
||||||
*/
|
|
||||||
secp256k1_fe_mul(&az, &a->z, bzinv);
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&z12, &az);
|
|
||||||
u1 = a->x; secp256k1_fe_normalize_weak(&u1);
|
|
||||||
secp256k1_fe_mul(&u2, &b->x, &z12);
|
|
||||||
s1 = a->y; secp256k1_fe_normalize_weak(&s1);
|
|
||||||
secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
|
|
||||||
secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
|
|
||||||
secp256k1_fe_negate(&i, &s1, 1); secp256k1_fe_add(&i, &s2);
|
|
||||||
if (secp256k1_fe_normalizes_to_zero_var(&h)) {
|
|
||||||
if (secp256k1_fe_normalizes_to_zero_var(&i)) {
|
|
||||||
secp256k1_gej_double_var(r, a, NULL);
|
|
||||||
} else {
|
|
||||||
r->infinity = 1;
|
|
||||||
}
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
secp256k1_fe_sqr(&i2, &i);
|
|
||||||
secp256k1_fe_sqr(&h2, &h);
|
|
||||||
secp256k1_fe_mul(&h3, &h, &h2);
|
|
||||||
r->z = a->z; secp256k1_fe_mul(&r->z, &r->z, &h);
|
|
||||||
secp256k1_fe_mul(&t, &u1, &h2);
|
|
||||||
r->x = t; secp256k1_fe_mul_int(&r->x, 2); secp256k1_fe_add(&r->x, &h3); secp256k1_fe_negate(&r->x, &r->x, 3); secp256k1_fe_add(&r->x, &i2);
|
|
||||||
secp256k1_fe_negate(&r->y, &r->x, 5); secp256k1_fe_add(&r->y, &t); secp256k1_fe_mul(&r->y, &r->y, &i);
|
|
||||||
secp256k1_fe_mul(&h3, &h3, &s1); secp256k1_fe_negate(&h3, &h3, 1);
|
|
||||||
secp256k1_fe_add(&r->y, &h3);
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b) {
|
|
||||||
/* Operations: 7 mul, 5 sqr, 4 normalize, 21 mul_int/add/negate/cmov */
|
|
||||||
static const secp256k1_fe fe_1 = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
|
|
||||||
secp256k1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
|
|
||||||
secp256k1_fe m_alt, rr_alt;
|
|
||||||
int infinity, degenerate;
|
|
||||||
VERIFY_CHECK(!b->infinity);
|
|
||||||
VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
|
|
||||||
|
|
||||||
/** In:
|
|
||||||
* Eric Brier and Marc Joye, Weierstrass Elliptic Curves and Side-Channel Attacks.
|
|
||||||
* In D. Naccache and P. Paillier, Eds., Public Key Cryptography, vol. 2274 of Lecture Notes in Computer Science, pages 335-345. Springer-Verlag, 2002.
|
|
||||||
* we find as solution for a unified addition/doubling formula:
|
|
||||||
* lambda = ((x1 + x2)^2 - x1 * x2 + a) / (y1 + y2), with a = 0 for secp256k1's curve equation.
|
|
||||||
* x3 = lambda^2 - (x1 + x2)
|
|
||||||
* 2*y3 = lambda * (x1 + x2 - 2 * x3) - (y1 + y2).
|
|
||||||
*
|
|
||||||
* Substituting x_i = Xi / Zi^2 and yi = Yi / Zi^3, for i=1,2,3, gives:
|
|
||||||
* U1 = X1*Z2^2, U2 = X2*Z1^2
|
|
||||||
* S1 = Y1*Z2^3, S2 = Y2*Z1^3
|
|
||||||
* Z = Z1*Z2
|
|
||||||
* T = U1+U2
|
|
||||||
* M = S1+S2
|
|
||||||
* Q = T*M^2
|
|
||||||
* R = T^2-U1*U2
|
|
||||||
* X3 = 4*(R^2-Q)
|
|
||||||
* Y3 = 4*(R*(3*Q-2*R^2)-M^4)
|
|
||||||
* Z3 = 2*M*Z
|
|
||||||
* (Note that the paper uses xi = Xi / Zi and yi = Yi / Zi instead.)
|
|
||||||
*
|
|
||||||
* This formula has the benefit of being the same for both addition
|
|
||||||
* of distinct points and doubling. However, it breaks down in the
|
|
||||||
* case that either point is infinity, or that y1 = -y2. We handle
|
|
||||||
* these cases in the following ways:
|
|
||||||
*
|
|
||||||
* - If b is infinity we simply bail by means of a VERIFY_CHECK.
|
|
||||||
*
|
|
||||||
* - If a is infinity, we detect this, and at the end of the
|
|
||||||
* computation replace the result (which will be meaningless,
|
|
||||||
* but we compute to be constant-time) with b.x : b.y : 1.
|
|
||||||
*
|
|
||||||
* - If a = -b, we have y1 = -y2, which is a degenerate case.
|
|
||||||
* But here the answer is infinity, so we simply set the
|
|
||||||
* infinity flag of the result, overriding the computed values
|
|
||||||
* without even needing to cmov.
|
|
||||||
*
|
|
||||||
* - If y1 = -y2 but x1 != x2, which does occur thanks to certain
|
|
||||||
* properties of our curve (specifically, 1 has nontrivial cube
|
|
||||||
* roots in our field, and the curve equation has no x coefficient)
|
|
||||||
* then the answer is not infinity but also not given by the above
|
|
||||||
* equation. In this case, we cmov in place an alternate expression
|
|
||||||
* for lambda. Specifically (y1 - y2)/(x1 - x2). Where both these
|
|
||||||
* expressions for lambda are defined, they are equal, and can be
|
|
||||||
* obtained from each other by multiplication by (y1 + y2)/(y1 + y2)
|
|
||||||
* then substitution of x^3 + 7 for y^2 (using the curve equation).
|
|
||||||
* For all pairs of nonzero points (a, b) at least one is defined,
|
|
||||||
* so this covers everything.
|
|
||||||
*/
|
|
||||||
|
|
||||||
secp256k1_fe_sqr(&zz, &a->z); /* z = Z1^2 */
|
|
||||||
u1 = a->x; secp256k1_fe_normalize_weak(&u1); /* u1 = U1 = X1*Z2^2 (1) */
|
|
||||||
secp256k1_fe_mul(&u2, &b->x, &zz); /* u2 = U2 = X2*Z1^2 (1) */
|
|
||||||
s1 = a->y; secp256k1_fe_normalize_weak(&s1); /* s1 = S1 = Y1*Z2^3 (1) */
|
|
||||||
secp256k1_fe_mul(&s2, &b->y, &zz); /* s2 = Y2*Z1^2 (1) */
|
|
||||||
secp256k1_fe_mul(&s2, &s2, &a->z); /* s2 = S2 = Y2*Z1^3 (1) */
|
|
||||||
t = u1; secp256k1_fe_add(&t, &u2); /* t = T = U1+U2 (2) */
|
|
||||||
m = s1; secp256k1_fe_add(&m, &s2); /* m = M = S1+S2 (2) */
|
|
||||||
secp256k1_fe_sqr(&rr, &t); /* rr = T^2 (1) */
|
|
||||||
secp256k1_fe_negate(&m_alt, &u2, 1); /* Malt = -X2*Z1^2 */
|
|
||||||
secp256k1_fe_mul(&tt, &u1, &m_alt); /* tt = -U1*U2 (2) */
|
|
||||||
secp256k1_fe_add(&rr, &tt); /* rr = R = T^2-U1*U2 (3) */
|
|
||||||
/** If lambda = R/M = 0/0 we have a problem (except in the "trivial"
|
|
||||||
* case that Z = z1z2 = 0, and this is special-cased later on). */
|
|
||||||
degenerate = secp256k1_fe_normalizes_to_zero(&m) &
|
|
||||||
secp256k1_fe_normalizes_to_zero(&rr);
|
|
||||||
/* This only occurs when y1 == -y2 and x1^3 == x2^3, but x1 != x2.
|
|
||||||
* This means either x1 == beta*x2 or beta*x1 == x2, where beta is
|
|
||||||
* a nontrivial cube root of one. In either case, an alternate
|
|
||||||
* non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
|
|
||||||
* so we set R/M equal to this. */
|
|
||||||
rr_alt = s1;
|
|
||||||
secp256k1_fe_mul_int(&rr_alt, 2); /* rr = Y1*Z2^3 - Y2*Z1^3 (2) */
|
|
||||||
secp256k1_fe_add(&m_alt, &u1); /* Malt = X1*Z2^2 - X2*Z1^2 */
|
|
||||||
|
|
||||||
secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);
|
|
||||||
secp256k1_fe_cmov(&m_alt, &m, !degenerate);
|
|
||||||
/* Now Ralt / Malt = lambda and is guaranteed not to be 0/0.
|
|
||||||
* From here on out Ralt and Malt represent the numerator
|
|
||||||
* and denominator of lambda; R and M represent the explicit
|
|
||||||
* expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
|
|
||||||
secp256k1_fe_sqr(&n, &m_alt); /* n = Malt^2 (1) */
|
|
||||||
secp256k1_fe_mul(&q, &n, &t); /* q = Q = T*Malt^2 (1) */
|
|
||||||
/* These two lines use the observation that either M == Malt or M == 0,
|
|
||||||
* so M^3 * Malt is either Malt^4 (which is computed by squaring), or
|
|
||||||
* zero (which is "computed" by cmov). So the cost is one squaring
|
|
||||||
* versus two multiplications. */
|
|
||||||
secp256k1_fe_sqr(&n, &n);
|
|
||||||
secp256k1_fe_cmov(&n, &m, degenerate); /* n = M^3 * Malt (2) */
|
|
||||||
secp256k1_fe_sqr(&t, &rr_alt); /* t = Ralt^2 (1) */
|
|
||||||
secp256k1_fe_mul(&r->z, &a->z, &m_alt); /* r->z = Malt*Z (1) */
|
|
||||||
infinity = secp256k1_fe_normalizes_to_zero(&r->z) * (1 - a->infinity);
|
|
||||||
secp256k1_fe_mul_int(&r->z, 2); /* r->z = Z3 = 2*Malt*Z (2) */
|
|
||||||
secp256k1_fe_negate(&q, &q, 1); /* q = -Q (2) */
|
|
||||||
secp256k1_fe_add(&t, &q); /* t = Ralt^2-Q (3) */
|
|
||||||
secp256k1_fe_normalize_weak(&t);
|
|
||||||
r->x = t; /* r->x = Ralt^2-Q (1) */
|
|
||||||
secp256k1_fe_mul_int(&t, 2); /* t = 2*x3 (2) */
|
|
||||||
secp256k1_fe_add(&t, &q); /* t = 2*x3 - Q: (4) */
|
|
||||||
secp256k1_fe_mul(&t, &t, &rr_alt); /* t = Ralt*(2*x3 - Q) (1) */
|
|
||||||
secp256k1_fe_add(&t, &n); /* t = Ralt*(2*x3 - Q) + M^3*Malt (3) */
|
|
||||||
secp256k1_fe_negate(&r->y, &t, 3); /* r->y = Ralt*(Q - 2x3) - M^3*Malt (4) */
|
|
||||||
secp256k1_fe_normalize_weak(&r->y);
|
|
||||||
secp256k1_fe_mul_int(&r->x, 4); /* r->x = X3 = 4*(Ralt^2-Q) */
|
|
||||||
secp256k1_fe_mul_int(&r->y, 4); /* r->y = Y3 = 4*Ralt*(Q - 2x3) - 4*M^3*Malt (4) */
|
|
||||||
|
|
||||||
/** In case a->infinity == 1, replace r with (b->x, b->y, 1). */
|
|
||||||
secp256k1_fe_cmov(&r->x, &b->x, a->infinity);
|
|
||||||
secp256k1_fe_cmov(&r->y, &b->y, a->infinity);
|
|
||||||
secp256k1_fe_cmov(&r->z, &fe_1, a->infinity);
|
|
||||||
r->infinity = infinity;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *s) {
|
|
||||||
/* Operations: 4 mul, 1 sqr */
|
|
||||||
secp256k1_fe zz;
|
|
||||||
VERIFY_CHECK(!secp256k1_fe_is_zero(s));
|
|
||||||
secp256k1_fe_sqr(&zz, s);
|
|
||||||
secp256k1_fe_mul(&r->x, &r->x, &zz); /* r->x *= s^2 */
|
|
||||||
secp256k1_fe_mul(&r->y, &r->y, &zz);
|
|
||||||
secp256k1_fe_mul(&r->y, &r->y, s); /* r->y *= s^3 */
|
|
||||||
secp256k1_fe_mul(&r->z, &r->z, s); /* r->z *= s */
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge *a) {
|
|
||||||
secp256k1_fe x, y;
|
|
||||||
VERIFY_CHECK(!a->infinity);
|
|
||||||
x = a->x;
|
|
||||||
secp256k1_fe_normalize(&x);
|
|
||||||
y = a->y;
|
|
||||||
secp256k1_fe_normalize(&y);
|
|
||||||
secp256k1_fe_to_storage(&r->x, &x);
|
|
||||||
secp256k1_fe_to_storage(&r->y, &y);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a) {
|
|
||||||
secp256k1_fe_from_storage(&r->x, &a->x);
|
|
||||||
secp256k1_fe_from_storage(&r->y, &a->y);
|
|
||||||
r->infinity = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag) {
|
|
||||||
secp256k1_fe_storage_cmov(&r->x, &a->x, flag);
|
|
||||||
secp256k1_fe_storage_cmov(&r->y, &a->y, flag);
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
static void secp256k1_ge_mul_lambda(secp256k1_ge *r, const secp256k1_ge *a) {
|
|
||||||
static const secp256k1_fe beta = SECP256K1_FE_CONST(
|
|
||||||
0x7ae96a2bul, 0x657c0710ul, 0x6e64479eul, 0xac3434e9ul,
|
|
||||||
0x9cf04975ul, 0x12f58995ul, 0xc1396c28ul, 0x719501eeul
|
|
||||||
);
|
|
||||||
*r = *a;
|
|
||||||
secp256k1_fe_mul(&r->x, &r->x, &beta);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static int secp256k1_gej_has_quad_y_var(const secp256k1_gej *a) {
|
|
||||||
secp256k1_fe yz;
|
|
||||||
|
|
||||||
if (a->infinity) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* We rely on the fact that the Jacobi symbol of 1 / a->z^3 is the same as
|
|
||||||
* that of a->z. Thus a->y / a->z^3 is a quadratic residue iff a->y * a->z
|
|
||||||
is */
|
|
||||||
secp256k1_fe_mul(&yz, &a->y, &a->z);
|
|
||||||
return secp256k1_fe_is_quad_var(&yz);
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_GROUP_IMPL_H */
|
|
||||||
@ -1,41 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_HASH_H
|
|
||||||
#define SECP256K1_HASH_H
|
|
||||||
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <stdint.h>
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
uint32_t s[8];
|
|
||||||
uint32_t buf[16]; /* In big endian */
|
|
||||||
size_t bytes;
|
|
||||||
} secp256k1_sha256;
|
|
||||||
|
|
||||||
static void secp256k1_sha256_initialize(secp256k1_sha256 *hash);
|
|
||||||
static void secp256k1_sha256_write(secp256k1_sha256 *hash, const unsigned char *data, size_t size);
|
|
||||||
static void secp256k1_sha256_finalize(secp256k1_sha256 *hash, unsigned char *out32);
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_sha256 inner, outer;
|
|
||||||
} secp256k1_hmac_sha256;
|
|
||||||
|
|
||||||
static void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256 *hash, const unsigned char *key, size_t size);
|
|
||||||
static void secp256k1_hmac_sha256_write(secp256k1_hmac_sha256 *hash, const unsigned char *data, size_t size);
|
|
||||||
static void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256 *hash, unsigned char *out32);
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
unsigned char v[32];
|
|
||||||
unsigned char k[32];
|
|
||||||
int retry;
|
|
||||||
} secp256k1_rfc6979_hmac_sha256;
|
|
||||||
|
|
||||||
static void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen);
|
|
||||||
static void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen);
|
|
||||||
static void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256 *rng);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_HASH_H */
|
|
||||||
@ -1,283 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_HASH_IMPL_H
|
|
||||||
#define SECP256K1_HASH_IMPL_H
|
|
||||||
|
|
||||||
#include "hash.h"
|
|
||||||
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <stdint.h>
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
|
|
||||||
#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
|
|
||||||
#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
|
|
||||||
#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
|
|
||||||
#define sigma0(x) (((x) >> 7 | (x) << 25) ^ ((x) >> 18 | (x) << 14) ^ ((x) >> 3))
|
|
||||||
#define sigma1(x) (((x) >> 17 | (x) << 15) ^ ((x) >> 19 | (x) << 13) ^ ((x) >> 10))
|
|
||||||
|
|
||||||
#define Round(a,b,c,d,e,f,g,h,k,w) do { \
|
|
||||||
uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
|
|
||||||
uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
|
|
||||||
(d) += t1; \
|
|
||||||
(h) = t1 + t2; \
|
|
||||||
} while(0)
|
|
||||||
|
|
||||||
#ifdef WORDS_BIGENDIAN
|
|
||||||
#define BE32(x) (x)
|
|
||||||
#else
|
|
||||||
#define BE32(p) ((((p) & 0xFF) << 24) | (((p) & 0xFF00) << 8) | (((p) & 0xFF0000) >> 8) | (((p) & 0xFF000000) >> 24))
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void secp256k1_sha256_initialize(secp256k1_sha256 *hash) {
|
|
||||||
hash->s[0] = 0x6a09e667ul;
|
|
||||||
hash->s[1] = 0xbb67ae85ul;
|
|
||||||
hash->s[2] = 0x3c6ef372ul;
|
|
||||||
hash->s[3] = 0xa54ff53aul;
|
|
||||||
hash->s[4] = 0x510e527ful;
|
|
||||||
hash->s[5] = 0x9b05688cul;
|
|
||||||
hash->s[6] = 0x1f83d9abul;
|
|
||||||
hash->s[7] = 0x5be0cd19ul;
|
|
||||||
hash->bytes = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Perform one SHA-256 transformation, processing 16 big endian 32-bit words. */
|
|
||||||
static void secp256k1_sha256_transform(uint32_t* s, const uint32_t* chunk) {
|
|
||||||
uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
|
|
||||||
uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
|
|
||||||
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0x428a2f98, w0 = BE32(chunk[0]));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0x71374491, w1 = BE32(chunk[1]));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf, w2 = BE32(chunk[2]));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0xe9b5dba5, w3 = BE32(chunk[3]));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0x3956c25b, w4 = BE32(chunk[4]));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0x59f111f1, w5 = BE32(chunk[5]));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0x923f82a4, w6 = BE32(chunk[6]));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0xab1c5ed5, w7 = BE32(chunk[7]));
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0xd807aa98, w8 = BE32(chunk[8]));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0x12835b01, w9 = BE32(chunk[9]));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0x243185be, w10 = BE32(chunk[10]));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0x550c7dc3, w11 = BE32(chunk[11]));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0x72be5d74, w12 = BE32(chunk[12]));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0x80deb1fe, w13 = BE32(chunk[13]));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0x9bdc06a7, w14 = BE32(chunk[14]));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0xc19bf174, w15 = BE32(chunk[15]));
|
|
||||||
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0xe49b69c1, w0 += sigma1(w14) + w9 + sigma0(w1));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0xefbe4786, w1 += sigma1(w15) + w10 + sigma0(w2));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0x0fc19dc6, w2 += sigma1(w0) + w11 + sigma0(w3));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0x240ca1cc, w3 += sigma1(w1) + w12 + sigma0(w4));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0x2de92c6f, w4 += sigma1(w2) + w13 + sigma0(w5));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0x4a7484aa, w5 += sigma1(w3) + w14 + sigma0(w6));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0x5cb0a9dc, w6 += sigma1(w4) + w15 + sigma0(w7));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0x76f988da, w7 += sigma1(w5) + w0 + sigma0(w8));
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0x983e5152, w8 += sigma1(w6) + w1 + sigma0(w9));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0xa831c66d, w9 += sigma1(w7) + w2 + sigma0(w10));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0xb00327c8, w10 += sigma1(w8) + w3 + sigma0(w11));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0xbf597fc7, w11 += sigma1(w9) + w4 + sigma0(w12));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0xc6e00bf3, w12 += sigma1(w10) + w5 + sigma0(w13));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0xd5a79147, w13 += sigma1(w11) + w6 + sigma0(w14));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0x06ca6351, w14 += sigma1(w12) + w7 + sigma0(w15));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0x14292967, w15 += sigma1(w13) + w8 + sigma0(w0));
|
|
||||||
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0x27b70a85, w0 += sigma1(w14) + w9 + sigma0(w1));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0x2e1b2138, w1 += sigma1(w15) + w10 + sigma0(w2));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc, w2 += sigma1(w0) + w11 + sigma0(w3));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0x53380d13, w3 += sigma1(w1) + w12 + sigma0(w4));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0x650a7354, w4 += sigma1(w2) + w13 + sigma0(w5));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0x766a0abb, w5 += sigma1(w3) + w14 + sigma0(w6));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0x81c2c92e, w6 += sigma1(w4) + w15 + sigma0(w7));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0x92722c85, w7 += sigma1(w5) + w0 + sigma0(w8));
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1, w8 += sigma1(w6) + w1 + sigma0(w9));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0xa81a664b, w9 += sigma1(w7) + w2 + sigma0(w10));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0xc24b8b70, w10 += sigma1(w8) + w3 + sigma0(w11));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0xc76c51a3, w11 += sigma1(w9) + w4 + sigma0(w12));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0xd192e819, w12 += sigma1(w10) + w5 + sigma0(w13));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0xd6990624, w13 += sigma1(w11) + w6 + sigma0(w14));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0xf40e3585, w14 += sigma1(w12) + w7 + sigma0(w15));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0x106aa070, w15 += sigma1(w13) + w8 + sigma0(w0));
|
|
||||||
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0x19a4c116, w0 += sigma1(w14) + w9 + sigma0(w1));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0x1e376c08, w1 += sigma1(w15) + w10 + sigma0(w2));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0x2748774c, w2 += sigma1(w0) + w11 + sigma0(w3));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0x34b0bcb5, w3 += sigma1(w1) + w12 + sigma0(w4));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0x391c0cb3, w4 += sigma1(w2) + w13 + sigma0(w5));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0x4ed8aa4a, w5 += sigma1(w3) + w14 + sigma0(w6));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0x5b9cca4f, w6 += sigma1(w4) + w15 + sigma0(w7));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0x682e6ff3, w7 += sigma1(w5) + w0 + sigma0(w8));
|
|
||||||
Round(a, b, c, d, e, f, g, h, 0x748f82ee, w8 += sigma1(w6) + w1 + sigma0(w9));
|
|
||||||
Round(h, a, b, c, d, e, f, g, 0x78a5636f, w9 += sigma1(w7) + w2 + sigma0(w10));
|
|
||||||
Round(g, h, a, b, c, d, e, f, 0x84c87814, w10 += sigma1(w8) + w3 + sigma0(w11));
|
|
||||||
Round(f, g, h, a, b, c, d, e, 0x8cc70208, w11 += sigma1(w9) + w4 + sigma0(w12));
|
|
||||||
Round(e, f, g, h, a, b, c, d, 0x90befffa, w12 += sigma1(w10) + w5 + sigma0(w13));
|
|
||||||
Round(d, e, f, g, h, a, b, c, 0xa4506ceb, w13 += sigma1(w11) + w6 + sigma0(w14));
|
|
||||||
Round(c, d, e, f, g, h, a, b, 0xbef9a3f7, w14 + sigma1(w12) + w7 + sigma0(w15));
|
|
||||||
Round(b, c, d, e, f, g, h, a, 0xc67178f2, w15 + sigma1(w13) + w8 + sigma0(w0));
|
|
||||||
|
|
||||||
s[0] += a;
|
|
||||||
s[1] += b;
|
|
||||||
s[2] += c;
|
|
||||||
s[3] += d;
|
|
||||||
s[4] += e;
|
|
||||||
s[5] += f;
|
|
||||||
s[6] += g;
|
|
||||||
s[7] += h;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_sha256_write(secp256k1_sha256 *hash, const unsigned char *data, size_t len) {
|
|
||||||
size_t bufsize = hash->bytes & 0x3F;
|
|
||||||
hash->bytes += len;
|
|
||||||
VERIFY_CHECK(hash->bytes >= len);
|
|
||||||
while (len >= 64 - bufsize) {
|
|
||||||
/* Fill the buffer, and process it. */
|
|
||||||
size_t chunk_len = 64 - bufsize;
|
|
||||||
memcpy(((unsigned char*)hash->buf) + bufsize, data, chunk_len);
|
|
||||||
data += chunk_len;
|
|
||||||
len -= chunk_len;
|
|
||||||
secp256k1_sha256_transform(hash->s, hash->buf);
|
|
||||||
bufsize = 0;
|
|
||||||
}
|
|
||||||
if (len) {
|
|
||||||
/* Fill the buffer with what remains. */
|
|
||||||
memcpy(((unsigned char*)hash->buf) + bufsize, data, len);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_sha256_finalize(secp256k1_sha256 *hash, unsigned char *out32) {
|
|
||||||
static const unsigned char pad[64] = {0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
|
|
||||||
uint32_t sizedesc[2];
|
|
||||||
uint32_t out[8];
|
|
||||||
int i = 0;
|
|
||||||
sizedesc[0] = BE32(hash->bytes >> 29);
|
|
||||||
sizedesc[1] = BE32(hash->bytes << 3);
|
|
||||||
secp256k1_sha256_write(hash, pad, 1 + ((119 - (hash->bytes % 64)) % 64));
|
|
||||||
secp256k1_sha256_write(hash, (const unsigned char*)sizedesc, 8);
|
|
||||||
for (i = 0; i < 8; i++) {
|
|
||||||
out[i] = BE32(hash->s[i]);
|
|
||||||
hash->s[i] = 0;
|
|
||||||
}
|
|
||||||
memcpy(out32, (const unsigned char*)out, 32);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256 *hash, const unsigned char *key, size_t keylen) {
|
|
||||||
size_t n;
|
|
||||||
unsigned char rkey[64];
|
|
||||||
if (keylen <= sizeof(rkey)) {
|
|
||||||
memcpy(rkey, key, keylen);
|
|
||||||
memset(rkey + keylen, 0, sizeof(rkey) - keylen);
|
|
||||||
} else {
|
|
||||||
secp256k1_sha256 sha256;
|
|
||||||
secp256k1_sha256_initialize(&sha256);
|
|
||||||
secp256k1_sha256_write(&sha256, key, keylen);
|
|
||||||
secp256k1_sha256_finalize(&sha256, rkey);
|
|
||||||
memset(rkey + 32, 0, 32);
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_sha256_initialize(&hash->outer);
|
|
||||||
for (n = 0; n < sizeof(rkey); n++) {
|
|
||||||
rkey[n] ^= 0x5c;
|
|
||||||
}
|
|
||||||
secp256k1_sha256_write(&hash->outer, rkey, sizeof(rkey));
|
|
||||||
|
|
||||||
secp256k1_sha256_initialize(&hash->inner);
|
|
||||||
for (n = 0; n < sizeof(rkey); n++) {
|
|
||||||
rkey[n] ^= 0x5c ^ 0x36;
|
|
||||||
}
|
|
||||||
secp256k1_sha256_write(&hash->inner, rkey, sizeof(rkey));
|
|
||||||
memset(rkey, 0, sizeof(rkey));
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_hmac_sha256_write(secp256k1_hmac_sha256 *hash, const unsigned char *data, size_t size) {
|
|
||||||
secp256k1_sha256_write(&hash->inner, data, size);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256 *hash, unsigned char *out32) {
|
|
||||||
unsigned char temp[32];
|
|
||||||
secp256k1_sha256_finalize(&hash->inner, temp);
|
|
||||||
secp256k1_sha256_write(&hash->outer, temp, 32);
|
|
||||||
memset(temp, 0, 32);
|
|
||||||
secp256k1_sha256_finalize(&hash->outer, out32);
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
static void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen) {
|
|
||||||
secp256k1_hmac_sha256 hmac;
|
|
||||||
static const unsigned char zero[1] = {0x00};
|
|
||||||
static const unsigned char one[1] = {0x01};
|
|
||||||
|
|
||||||
memset(rng->v, 0x01, 32); /* RFC6979 3.2.b. */
|
|
||||||
memset(rng->k, 0x00, 32); /* RFC6979 3.2.c. */
|
|
||||||
|
|
||||||
/* RFC6979 3.2.d. */
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, zero, 1);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, key, keylen);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, rng->k);
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, rng->v);
|
|
||||||
|
|
||||||
/* RFC6979 3.2.f. */
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, one, 1);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, key, keylen);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, rng->k);
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, rng->v);
|
|
||||||
rng->retry = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen) {
|
|
||||||
/* RFC6979 3.2.h. */
|
|
||||||
static const unsigned char zero[1] = {0x00};
|
|
||||||
if (rng->retry) {
|
|
||||||
secp256k1_hmac_sha256 hmac;
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, zero, 1);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, rng->k);
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, rng->v);
|
|
||||||
}
|
|
||||||
|
|
||||||
while (outlen > 0) {
|
|
||||||
secp256k1_hmac_sha256 hmac;
|
|
||||||
int now = outlen;
|
|
||||||
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
|
|
||||||
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
|
|
||||||
secp256k1_hmac_sha256_finalize(&hmac, rng->v);
|
|
||||||
if (now > 32) {
|
|
||||||
now = 32;
|
|
||||||
}
|
|
||||||
memcpy(out, rng->v, now);
|
|
||||||
out += now;
|
|
||||||
outlen -= now;
|
|
||||||
}
|
|
||||||
|
|
||||||
rng->retry = 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256 *rng) {
|
|
||||||
memset(rng->k, 0, 32);
|
|
||||||
memset(rng->v, 0, 32);
|
|
||||||
rng->retry = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
#undef BE32
|
|
||||||
#undef Round
|
|
||||||
#undef sigma1
|
|
||||||
#undef sigma0
|
|
||||||
#undef Sigma1
|
|
||||||
#undef Sigma0
|
|
||||||
#undef Maj
|
|
||||||
#undef Ch
|
|
||||||
|
|
||||||
#endif /* SECP256K1_HASH_IMPL_H */
|
|
||||||
@ -1,446 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright 2013 Google Inc.
|
|
||||||
* Copyright 2014-2016 the libsecp256k1 contributors
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package org.bitcoin;
|
|
||||||
|
|
||||||
import java.nio.ByteBuffer;
|
|
||||||
import java.nio.ByteOrder;
|
|
||||||
|
|
||||||
import java.math.BigInteger;
|
|
||||||
import com.google.common.base.Preconditions;
|
|
||||||
import java.util.concurrent.locks.Lock;
|
|
||||||
import java.util.concurrent.locks.ReentrantReadWriteLock;
|
|
||||||
import static org.bitcoin.NativeSecp256k1Util.*;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* <p>This class holds native methods to handle ECDSA verification.</p>
|
|
||||||
*
|
|
||||||
* <p>You can find an example library that can be used for this at https://github.com/bitcoin/secp256k1</p>
|
|
||||||
*
|
|
||||||
* <p>To build secp256k1 for use with bitcoinj, run
|
|
||||||
* `./configure --enable-jni --enable-experimental --enable-module-ecdh`
|
|
||||||
* and `make` then copy `.libs/libsecp256k1.so` to your system library path
|
|
||||||
* or point the JVM to the folder containing it with -Djava.library.path
|
|
||||||
* </p>
|
|
||||||
*/
|
|
||||||
public class NativeSecp256k1 {
|
|
||||||
|
|
||||||
private static final ReentrantReadWriteLock rwl = new ReentrantReadWriteLock();
|
|
||||||
private static final Lock r = rwl.readLock();
|
|
||||||
private static final Lock w = rwl.writeLock();
|
|
||||||
private static ThreadLocal<ByteBuffer> nativeECDSABuffer = new ThreadLocal<ByteBuffer>();
|
|
||||||
/**
|
|
||||||
* Verifies the given secp256k1 signature in native code.
|
|
||||||
* Calling when enabled == false is undefined (probably library not loaded)
|
|
||||||
*
|
|
||||||
* @param data The data which was signed, must be exactly 32 bytes
|
|
||||||
* @param signature The signature
|
|
||||||
* @param pub The public key which did the signing
|
|
||||||
*/
|
|
||||||
public static boolean verify(byte[] data, byte[] signature, byte[] pub) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(data.length == 32 && signature.length <= 520 && pub.length <= 520);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < 520) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(520);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(data);
|
|
||||||
byteBuff.put(signature);
|
|
||||||
byteBuff.put(pub);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
return secp256k1_ecdsa_verify(byteBuff, Secp256k1Context.getContext(), signature.length, pub.length) == 1;
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 Create an ECDSA signature.
|
|
||||||
*
|
|
||||||
* @param data Message hash, 32 bytes
|
|
||||||
* @param key Secret key, 32 bytes
|
|
||||||
*
|
|
||||||
* Return values
|
|
||||||
* @param sig byte array of signature
|
|
||||||
*/
|
|
||||||
public static byte[] sign(byte[] data, byte[] sec) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(data.length == 32 && sec.length <= 32);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < 32 + 32) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(32 + 32);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(data);
|
|
||||||
byteBuff.put(sec);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
retByteArray = secp256k1_ecdsa_sign(byteBuff, Secp256k1Context.getContext());
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
byte[] sigArr = retByteArray[0];
|
|
||||||
int sigLen = new BigInteger(new byte[] { retByteArray[1][0] }).intValue();
|
|
||||||
int retVal = new BigInteger(new byte[] { retByteArray[1][1] }).intValue();
|
|
||||||
|
|
||||||
assertEquals(sigArr.length, sigLen, "Got bad signature length.");
|
|
||||||
|
|
||||||
return retVal == 0 ? new byte[0] : sigArr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 Seckey Verify - returns 1 if valid, 0 if invalid
|
|
||||||
*
|
|
||||||
* @param seckey ECDSA Secret key, 32 bytes
|
|
||||||
*/
|
|
||||||
public static boolean secKeyVerify(byte[] seckey) {
|
|
||||||
Preconditions.checkArgument(seckey.length == 32);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < seckey.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(seckey.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(seckey);
|
|
||||||
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
return secp256k1_ec_seckey_verify(byteBuff,Secp256k1Context.getContext()) == 1;
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 Compute Pubkey - computes public key from secret key
|
|
||||||
*
|
|
||||||
* @param seckey ECDSA Secret key, 32 bytes
|
|
||||||
*
|
|
||||||
* Return values
|
|
||||||
* @param pubkey ECDSA Public key, 33 or 65 bytes
|
|
||||||
*/
|
|
||||||
//TODO add a 'compressed' arg
|
|
||||||
public static byte[] computePubkey(byte[] seckey) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(seckey.length == 32);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < seckey.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(seckey.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(seckey);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
retByteArray = secp256k1_ec_pubkey_create(byteBuff, Secp256k1Context.getContext());
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
byte[] pubArr = retByteArray[0];
|
|
||||||
int pubLen = new BigInteger(new byte[] { retByteArray[1][0] }).intValue();
|
|
||||||
int retVal = new BigInteger(new byte[] { retByteArray[1][1] }).intValue();
|
|
||||||
|
|
||||||
assertEquals(pubArr.length, pubLen, "Got bad pubkey length.");
|
|
||||||
|
|
||||||
return retVal == 0 ? new byte[0]: pubArr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 Cleanup - This destroys the secp256k1 context object
|
|
||||||
* This should be called at the end of the program for proper cleanup of the context.
|
|
||||||
*/
|
|
||||||
public static synchronized void cleanup() {
|
|
||||||
w.lock();
|
|
||||||
try {
|
|
||||||
secp256k1_destroy_context(Secp256k1Context.getContext());
|
|
||||||
} finally {
|
|
||||||
w.unlock();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
public static long cloneContext() {
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
return secp256k1_ctx_clone(Secp256k1Context.getContext());
|
|
||||||
} finally { r.unlock(); }
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 PrivKey Tweak-Mul - Tweak privkey by multiplying to it
|
|
||||||
*
|
|
||||||
* @param tweak some bytes to tweak with
|
|
||||||
* @param seckey 32-byte seckey
|
|
||||||
*/
|
|
||||||
public static byte[] privKeyTweakMul(byte[] privkey, byte[] tweak) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(privkey.length == 32);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < privkey.length + tweak.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(privkey.length + tweak.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(privkey);
|
|
||||||
byteBuff.put(tweak);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
retByteArray = secp256k1_privkey_tweak_mul(byteBuff,Secp256k1Context.getContext());
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
byte[] privArr = retByteArray[0];
|
|
||||||
|
|
||||||
int privLen = (byte) new BigInteger(new byte[] { retByteArray[1][0] }).intValue() & 0xFF;
|
|
||||||
int retVal = new BigInteger(new byte[] { retByteArray[1][1] }).intValue();
|
|
||||||
|
|
||||||
assertEquals(privArr.length, privLen, "Got bad pubkey length.");
|
|
||||||
|
|
||||||
assertEquals(retVal, 1, "Failed return value check.");
|
|
||||||
|
|
||||||
return privArr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 PrivKey Tweak-Add - Tweak privkey by adding to it
|
|
||||||
*
|
|
||||||
* @param tweak some bytes to tweak with
|
|
||||||
* @param seckey 32-byte seckey
|
|
||||||
*/
|
|
||||||
public static byte[] privKeyTweakAdd(byte[] privkey, byte[] tweak) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(privkey.length == 32);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < privkey.length + tweak.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(privkey.length + tweak.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(privkey);
|
|
||||||
byteBuff.put(tweak);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
retByteArray = secp256k1_privkey_tweak_add(byteBuff,Secp256k1Context.getContext());
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
byte[] privArr = retByteArray[0];
|
|
||||||
|
|
||||||
int privLen = (byte) new BigInteger(new byte[] { retByteArray[1][0] }).intValue() & 0xFF;
|
|
||||||
int retVal = new BigInteger(new byte[] { retByteArray[1][1] }).intValue();
|
|
||||||
|
|
||||||
assertEquals(privArr.length, privLen, "Got bad pubkey length.");
|
|
||||||
|
|
||||||
assertEquals(retVal, 1, "Failed return value check.");
|
|
||||||
|
|
||||||
return privArr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 PubKey Tweak-Add - Tweak pubkey by adding to it
|
|
||||||
*
|
|
||||||
* @param tweak some bytes to tweak with
|
|
||||||
* @param pubkey 32-byte seckey
|
|
||||||
*/
|
|
||||||
public static byte[] pubKeyTweakAdd(byte[] pubkey, byte[] tweak) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(pubkey.length == 33 || pubkey.length == 65);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < pubkey.length + tweak.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(pubkey.length + tweak.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(pubkey);
|
|
||||||
byteBuff.put(tweak);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
retByteArray = secp256k1_pubkey_tweak_add(byteBuff,Secp256k1Context.getContext(), pubkey.length);
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
byte[] pubArr = retByteArray[0];
|
|
||||||
|
|
||||||
int pubLen = (byte) new BigInteger(new byte[] { retByteArray[1][0] }).intValue() & 0xFF;
|
|
||||||
int retVal = new BigInteger(new byte[] { retByteArray[1][1] }).intValue();
|
|
||||||
|
|
||||||
assertEquals(pubArr.length, pubLen, "Got bad pubkey length.");
|
|
||||||
|
|
||||||
assertEquals(retVal, 1, "Failed return value check.");
|
|
||||||
|
|
||||||
return pubArr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 PubKey Tweak-Mul - Tweak pubkey by multiplying to it
|
|
||||||
*
|
|
||||||
* @param tweak some bytes to tweak with
|
|
||||||
* @param pubkey 32-byte seckey
|
|
||||||
*/
|
|
||||||
public static byte[] pubKeyTweakMul(byte[] pubkey, byte[] tweak) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(pubkey.length == 33 || pubkey.length == 65);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < pubkey.length + tweak.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(pubkey.length + tweak.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(pubkey);
|
|
||||||
byteBuff.put(tweak);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
retByteArray = secp256k1_pubkey_tweak_mul(byteBuff,Secp256k1Context.getContext(), pubkey.length);
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
byte[] pubArr = retByteArray[0];
|
|
||||||
|
|
||||||
int pubLen = (byte) new BigInteger(new byte[] { retByteArray[1][0] }).intValue() & 0xFF;
|
|
||||||
int retVal = new BigInteger(new byte[] { retByteArray[1][1] }).intValue();
|
|
||||||
|
|
||||||
assertEquals(pubArr.length, pubLen, "Got bad pubkey length.");
|
|
||||||
|
|
||||||
assertEquals(retVal, 1, "Failed return value check.");
|
|
||||||
|
|
||||||
return pubArr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 create ECDH secret - constant time ECDH calculation
|
|
||||||
*
|
|
||||||
* @param seckey byte array of secret key used in exponentiaion
|
|
||||||
* @param pubkey byte array of public key used in exponentiaion
|
|
||||||
*/
|
|
||||||
public static byte[] createECDHSecret(byte[] seckey, byte[] pubkey) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(seckey.length <= 32 && pubkey.length <= 65);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < 32 + pubkey.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(32 + pubkey.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(seckey);
|
|
||||||
byteBuff.put(pubkey);
|
|
||||||
|
|
||||||
byte[][] retByteArray;
|
|
||||||
r.lock();
|
|
||||||
try {
|
|
||||||
retByteArray = secp256k1_ecdh(byteBuff, Secp256k1Context.getContext(), pubkey.length);
|
|
||||||
} finally {
|
|
||||||
r.unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
byte[] resArr = retByteArray[0];
|
|
||||||
int retVal = new BigInteger(new byte[] { retByteArray[1][0] }).intValue();
|
|
||||||
|
|
||||||
assertEquals(resArr.length, 32, "Got bad result length.");
|
|
||||||
assertEquals(retVal, 1, "Failed return value check.");
|
|
||||||
|
|
||||||
return resArr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* libsecp256k1 randomize - updates the context randomization
|
|
||||||
*
|
|
||||||
* @param seed 32-byte random seed
|
|
||||||
*/
|
|
||||||
public static synchronized boolean randomize(byte[] seed) throws AssertFailException{
|
|
||||||
Preconditions.checkArgument(seed.length == 32 || seed == null);
|
|
||||||
|
|
||||||
ByteBuffer byteBuff = nativeECDSABuffer.get();
|
|
||||||
if (byteBuff == null || byteBuff.capacity() < seed.length) {
|
|
||||||
byteBuff = ByteBuffer.allocateDirect(seed.length);
|
|
||||||
byteBuff.order(ByteOrder.nativeOrder());
|
|
||||||
nativeECDSABuffer.set(byteBuff);
|
|
||||||
}
|
|
||||||
byteBuff.rewind();
|
|
||||||
byteBuff.put(seed);
|
|
||||||
|
|
||||||
w.lock();
|
|
||||||
try {
|
|
||||||
return secp256k1_context_randomize(byteBuff, Secp256k1Context.getContext()) == 1;
|
|
||||||
} finally {
|
|
||||||
w.unlock();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private static native long secp256k1_ctx_clone(long context);
|
|
||||||
|
|
||||||
private static native int secp256k1_context_randomize(ByteBuffer byteBuff, long context);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_privkey_tweak_add(ByteBuffer byteBuff, long context);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_privkey_tweak_mul(ByteBuffer byteBuff, long context);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_pubkey_tweak_add(ByteBuffer byteBuff, long context, int pubLen);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_pubkey_tweak_mul(ByteBuffer byteBuff, long context, int pubLen);
|
|
||||||
|
|
||||||
private static native void secp256k1_destroy_context(long context);
|
|
||||||
|
|
||||||
private static native int secp256k1_ecdsa_verify(ByteBuffer byteBuff, long context, int sigLen, int pubLen);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_ecdsa_sign(ByteBuffer byteBuff, long context);
|
|
||||||
|
|
||||||
private static native int secp256k1_ec_seckey_verify(ByteBuffer byteBuff, long context);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_ec_pubkey_create(ByteBuffer byteBuff, long context);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_ec_pubkey_parse(ByteBuffer byteBuff, long context, int inputLen);
|
|
||||||
|
|
||||||
private static native byte[][] secp256k1_ecdh(ByteBuffer byteBuff, long context, int inputLen);
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,225 +0,0 @@
|
|||||||
package org.bitcoin;
|
|
||||||
|
|
||||||
import com.google.common.io.BaseEncoding;
|
|
||||||
import java.util.Arrays;
|
|
||||||
import java.math.BigInteger;
|
|
||||||
import static org.bitcoin.NativeSecp256k1Util.*;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This class holds test cases defined for testing this library.
|
|
||||||
*/
|
|
||||||
public class NativeSecp256k1Test {
|
|
||||||
|
|
||||||
//TODO improve comments/add more tests
|
|
||||||
/**
|
|
||||||
* This tests verify() for a valid signature
|
|
||||||
*/
|
|
||||||
public static void testVerifyPos() throws AssertFailException{
|
|
||||||
boolean result = false;
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("CF80CD8AED482D5D1527D7DC72FCEFF84E6326592848447D2DC0B0E87DFC9A90".toLowerCase()); //sha256hash of "testing"
|
|
||||||
byte[] sig = BaseEncoding.base16().lowerCase().decode("3044022079BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F817980220294F14E883B3F525B5367756C2A11EF6CF84B730B36C17CB0C56F0AAB2C98589".toLowerCase());
|
|
||||||
byte[] pub = BaseEncoding.base16().lowerCase().decode("040A629506E1B65CD9D2E0BA9C75DF9C4FED0DB16DC9625ED14397F0AFC836FAE595DC53F8B0EFE61E703075BD9B143BAC75EC0E19F82A2208CAEB32BE53414C40".toLowerCase());
|
|
||||||
|
|
||||||
result = NativeSecp256k1.verify( data, sig, pub);
|
|
||||||
assertEquals( result, true , "testVerifyPos");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests verify() for a non-valid signature
|
|
||||||
*/
|
|
||||||
public static void testVerifyNeg() throws AssertFailException{
|
|
||||||
boolean result = false;
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("CF80CD8AED482D5D1527D7DC72FCEFF84E6326592848447D2DC0B0E87DFC9A91".toLowerCase()); //sha256hash of "testing"
|
|
||||||
byte[] sig = BaseEncoding.base16().lowerCase().decode("3044022079BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F817980220294F14E883B3F525B5367756C2A11EF6CF84B730B36C17CB0C56F0AAB2C98589".toLowerCase());
|
|
||||||
byte[] pub = BaseEncoding.base16().lowerCase().decode("040A629506E1B65CD9D2E0BA9C75DF9C4FED0DB16DC9625ED14397F0AFC836FAE595DC53F8B0EFE61E703075BD9B143BAC75EC0E19F82A2208CAEB32BE53414C40".toLowerCase());
|
|
||||||
|
|
||||||
result = NativeSecp256k1.verify( data, sig, pub);
|
|
||||||
//System.out.println(" TEST " + new BigInteger(1, resultbytes).toString(16));
|
|
||||||
assertEquals( result, false , "testVerifyNeg");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests secret key verify() for a valid secretkey
|
|
||||||
*/
|
|
||||||
public static void testSecKeyVerifyPos() throws AssertFailException{
|
|
||||||
boolean result = false;
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".toLowerCase());
|
|
||||||
|
|
||||||
result = NativeSecp256k1.secKeyVerify( sec );
|
|
||||||
//System.out.println(" TEST " + new BigInteger(1, resultbytes).toString(16));
|
|
||||||
assertEquals( result, true , "testSecKeyVerifyPos");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests secret key verify() for an invalid secretkey
|
|
||||||
*/
|
|
||||||
public static void testSecKeyVerifyNeg() throws AssertFailException{
|
|
||||||
boolean result = false;
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF".toLowerCase());
|
|
||||||
|
|
||||||
result = NativeSecp256k1.secKeyVerify( sec );
|
|
||||||
//System.out.println(" TEST " + new BigInteger(1, resultbytes).toString(16));
|
|
||||||
assertEquals( result, false , "testSecKeyVerifyNeg");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests public key create() for a valid secretkey
|
|
||||||
*/
|
|
||||||
public static void testPubKeyCreatePos() throws AssertFailException{
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".toLowerCase());
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.computePubkey( sec);
|
|
||||||
String pubkeyString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( pubkeyString , "04C591A8FF19AC9C4E4E5793673B83123437E975285E7B442F4EE2654DFFCA5E2D2103ED494718C697AC9AEBCFD19612E224DB46661011863ED2FC54E71861E2A6" , "testPubKeyCreatePos");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests public key create() for a invalid secretkey
|
|
||||||
*/
|
|
||||||
public static void testPubKeyCreateNeg() throws AssertFailException{
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF".toLowerCase());
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.computePubkey( sec);
|
|
||||||
String pubkeyString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( pubkeyString, "" , "testPubKeyCreateNeg");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests sign() for a valid secretkey
|
|
||||||
*/
|
|
||||||
public static void testSignPos() throws AssertFailException{
|
|
||||||
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("CF80CD8AED482D5D1527D7DC72FCEFF84E6326592848447D2DC0B0E87DFC9A90".toLowerCase()); //sha256hash of "testing"
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".toLowerCase());
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.sign(data, sec);
|
|
||||||
String sigString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( sigString, "30440220182A108E1448DC8F1FB467D06A0F3BB8EA0533584CB954EF8DA112F1D60E39A202201C66F36DA211C087F3AF88B50EDF4F9BDAA6CF5FD6817E74DCA34DB12390C6E9" , "testSignPos");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests sign() for a invalid secretkey
|
|
||||||
*/
|
|
||||||
public static void testSignNeg() throws AssertFailException{
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("CF80CD8AED482D5D1527D7DC72FCEFF84E6326592848447D2DC0B0E87DFC9A90".toLowerCase()); //sha256hash of "testing"
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF".toLowerCase());
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.sign(data, sec);
|
|
||||||
String sigString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( sigString, "" , "testSignNeg");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests private key tweak-add
|
|
||||||
*/
|
|
||||||
public static void testPrivKeyTweakAdd_1() throws AssertFailException {
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".toLowerCase());
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("3982F19BEF1615BCCFBB05E321C10E1D4CBA3DF0E841C2E41EEB6016347653C3".toLowerCase()); //sha256hash of "tweak"
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.privKeyTweakAdd( sec , data );
|
|
||||||
String sigString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( sigString , "A168571E189E6F9A7E2D657A4B53AE99B909F7E712D1C23CED28093CD57C88F3" , "testPrivKeyAdd_1");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests private key tweak-mul
|
|
||||||
*/
|
|
||||||
public static void testPrivKeyTweakMul_1() throws AssertFailException {
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".toLowerCase());
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("3982F19BEF1615BCCFBB05E321C10E1D4CBA3DF0E841C2E41EEB6016347653C3".toLowerCase()); //sha256hash of "tweak"
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.privKeyTweakMul( sec , data );
|
|
||||||
String sigString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( sigString , "97F8184235F101550F3C71C927507651BD3F1CDB4A5A33B8986ACF0DEE20FFFC" , "testPrivKeyMul_1");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests private key tweak-add uncompressed
|
|
||||||
*/
|
|
||||||
public static void testPrivKeyTweakAdd_2() throws AssertFailException {
|
|
||||||
byte[] pub = BaseEncoding.base16().lowerCase().decode("040A629506E1B65CD9D2E0BA9C75DF9C4FED0DB16DC9625ED14397F0AFC836FAE595DC53F8B0EFE61E703075BD9B143BAC75EC0E19F82A2208CAEB32BE53414C40".toLowerCase());
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("3982F19BEF1615BCCFBB05E321C10E1D4CBA3DF0E841C2E41EEB6016347653C3".toLowerCase()); //sha256hash of "tweak"
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.pubKeyTweakAdd( pub , data );
|
|
||||||
String sigString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( sigString , "0411C6790F4B663CCE607BAAE08C43557EDC1A4D11D88DFCB3D841D0C6A941AF525A268E2A863C148555C48FB5FBA368E88718A46E205FABC3DBA2CCFFAB0796EF" , "testPrivKeyAdd_2");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests private key tweak-mul uncompressed
|
|
||||||
*/
|
|
||||||
public static void testPrivKeyTweakMul_2() throws AssertFailException {
|
|
||||||
byte[] pub = BaseEncoding.base16().lowerCase().decode("040A629506E1B65CD9D2E0BA9C75DF9C4FED0DB16DC9625ED14397F0AFC836FAE595DC53F8B0EFE61E703075BD9B143BAC75EC0E19F82A2208CAEB32BE53414C40".toLowerCase());
|
|
||||||
byte[] data = BaseEncoding.base16().lowerCase().decode("3982F19BEF1615BCCFBB05E321C10E1D4CBA3DF0E841C2E41EEB6016347653C3".toLowerCase()); //sha256hash of "tweak"
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.pubKeyTweakMul( pub , data );
|
|
||||||
String sigString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( sigString , "04E0FE6FE55EBCA626B98A807F6CAF654139E14E5E3698F01A9A658E21DC1D2791EC060D4F412A794D5370F672BC94B722640B5F76914151CFCA6E712CA48CC589" , "testPrivKeyMul_2");
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This tests seed randomization
|
|
||||||
*/
|
|
||||||
public static void testRandomize() throws AssertFailException {
|
|
||||||
byte[] seed = BaseEncoding.base16().lowerCase().decode("A441B15FE9A3CF56661190A0B93B9DEC7D04127288CC87250967CF3B52894D11".toLowerCase()); //sha256hash of "random"
|
|
||||||
boolean result = NativeSecp256k1.randomize(seed);
|
|
||||||
assertEquals( result, true, "testRandomize");
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void testCreateECDHSecret() throws AssertFailException{
|
|
||||||
|
|
||||||
byte[] sec = BaseEncoding.base16().lowerCase().decode("67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".toLowerCase());
|
|
||||||
byte[] pub = BaseEncoding.base16().lowerCase().decode("040A629506E1B65CD9D2E0BA9C75DF9C4FED0DB16DC9625ED14397F0AFC836FAE595DC53F8B0EFE61E703075BD9B143BAC75EC0E19F82A2208CAEB32BE53414C40".toLowerCase());
|
|
||||||
|
|
||||||
byte[] resultArr = NativeSecp256k1.createECDHSecret(sec, pub);
|
|
||||||
String ecdhString = BaseEncoding.base16().encode(resultArr);
|
|
||||||
assertEquals( ecdhString, "2A2A67007A926E6594AF3EB564FC74005B37A9C8AEF2033C4552051B5C87F043" , "testCreateECDHSecret");
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void main(String[] args) throws AssertFailException{
|
|
||||||
|
|
||||||
|
|
||||||
System.out.println("\n libsecp256k1 enabled: " + Secp256k1Context.isEnabled() + "\n");
|
|
||||||
|
|
||||||
assertEquals( Secp256k1Context.isEnabled(), true, "isEnabled" );
|
|
||||||
|
|
||||||
//Test verify() success/fail
|
|
||||||
testVerifyPos();
|
|
||||||
testVerifyNeg();
|
|
||||||
|
|
||||||
//Test secKeyVerify() success/fail
|
|
||||||
testSecKeyVerifyPos();
|
|
||||||
testSecKeyVerifyNeg();
|
|
||||||
|
|
||||||
//Test computePubkey() success/fail
|
|
||||||
testPubKeyCreatePos();
|
|
||||||
testPubKeyCreateNeg();
|
|
||||||
|
|
||||||
//Test sign() success/fail
|
|
||||||
testSignPos();
|
|
||||||
testSignNeg();
|
|
||||||
|
|
||||||
//Test privKeyTweakAdd() 1
|
|
||||||
testPrivKeyTweakAdd_1();
|
|
||||||
|
|
||||||
//Test privKeyTweakMul() 2
|
|
||||||
testPrivKeyTweakMul_1();
|
|
||||||
|
|
||||||
//Test privKeyTweakAdd() 3
|
|
||||||
testPrivKeyTweakAdd_2();
|
|
||||||
|
|
||||||
//Test privKeyTweakMul() 4
|
|
||||||
testPrivKeyTweakMul_2();
|
|
||||||
|
|
||||||
//Test randomize()
|
|
||||||
testRandomize();
|
|
||||||
|
|
||||||
//Test ECDH
|
|
||||||
testCreateECDHSecret();
|
|
||||||
|
|
||||||
NativeSecp256k1.cleanup();
|
|
||||||
|
|
||||||
System.out.println(" All tests passed." );
|
|
||||||
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,45 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright 2014-2016 the libsecp256k1 contributors
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package org.bitcoin;
|
|
||||||
|
|
||||||
public class NativeSecp256k1Util{
|
|
||||||
|
|
||||||
public static void assertEquals( int val, int val2, String message ) throws AssertFailException{
|
|
||||||
if( val != val2 )
|
|
||||||
throw new AssertFailException("FAIL: " + message);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void assertEquals( boolean val, boolean val2, String message ) throws AssertFailException{
|
|
||||||
if( val != val2 )
|
|
||||||
throw new AssertFailException("FAIL: " + message);
|
|
||||||
else
|
|
||||||
System.out.println("PASS: " + message);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void assertEquals( String val, String val2, String message ) throws AssertFailException{
|
|
||||||
if( !val.equals(val2) )
|
|
||||||
throw new AssertFailException("FAIL: " + message);
|
|
||||||
else
|
|
||||||
System.out.println("PASS: " + message);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static class AssertFailException extends Exception {
|
|
||||||
public AssertFailException(String message) {
|
|
||||||
super( message );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,51 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright 2014-2016 the libsecp256k1 contributors
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package org.bitcoin;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This class holds the context reference used in native methods
|
|
||||||
* to handle ECDSA operations.
|
|
||||||
*/
|
|
||||||
public class Secp256k1Context {
|
|
||||||
private static final boolean enabled; //true if the library is loaded
|
|
||||||
private static final long context; //ref to pointer to context obj
|
|
||||||
|
|
||||||
static { //static initializer
|
|
||||||
boolean isEnabled = true;
|
|
||||||
long contextRef = -1;
|
|
||||||
try {
|
|
||||||
System.loadLibrary("secp256k1");
|
|
||||||
contextRef = secp256k1_init_context();
|
|
||||||
} catch (UnsatisfiedLinkError e) {
|
|
||||||
System.out.println("UnsatisfiedLinkError: " + e.toString());
|
|
||||||
isEnabled = false;
|
|
||||||
}
|
|
||||||
enabled = isEnabled;
|
|
||||||
context = contextRef;
|
|
||||||
}
|
|
||||||
|
|
||||||
public static boolean isEnabled() {
|
|
||||||
return enabled;
|
|
||||||
}
|
|
||||||
|
|
||||||
public static long getContext() {
|
|
||||||
if(!enabled) return -1; //sanity check
|
|
||||||
return context;
|
|
||||||
}
|
|
||||||
|
|
||||||
private static native long secp256k1_init_context();
|
|
||||||
}
|
|
||||||
@ -1,379 +0,0 @@
|
|||||||
#include <stdlib.h>
|
|
||||||
#include <stdint.h>
|
|
||||||
#include <string.h>
|
|
||||||
#include "org_bitcoin_NativeSecp256k1.h"
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "include/secp256k1_ecdh.h"
|
|
||||||
#include "include/secp256k1_recovery.h"
|
|
||||||
|
|
||||||
|
|
||||||
SECP256K1_API jlong JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ctx_1clone
|
|
||||||
(JNIEnv* env, jclass classObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
const secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
|
|
||||||
jlong ctx_clone_l = (uintptr_t) secp256k1_context_clone(ctx);
|
|
||||||
|
|
||||||
(void)classObject;(void)env;
|
|
||||||
|
|
||||||
return ctx_clone_l;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jint JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1context_1randomize
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
|
|
||||||
const unsigned char* seed = (unsigned char*) (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return secp256k1_context_randomize(ctx, seed);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API void JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1destroy_1context
|
|
||||||
(JNIEnv* env, jclass classObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
|
|
||||||
secp256k1_context_destroy(ctx);
|
|
||||||
|
|
||||||
(void)classObject;(void)env;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jint JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ecdsa_1verify
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l, jint siglen, jint publen)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
|
|
||||||
unsigned char* data = (unsigned char*) (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
const unsigned char* sigdata = { (unsigned char*) (data + 32) };
|
|
||||||
const unsigned char* pubdata = { (unsigned char*) (data + siglen + 32) };
|
|
||||||
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
|
|
||||||
int ret = secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigdata, siglen);
|
|
||||||
|
|
||||||
if( ret ) {
|
|
||||||
ret = secp256k1_ec_pubkey_parse(ctx, &pubkey, pubdata, publen);
|
|
||||||
|
|
||||||
if( ret ) {
|
|
||||||
ret = secp256k1_ecdsa_verify(ctx, &sig, data, &pubkey);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ecdsa_1sign
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
unsigned char* data = (unsigned char*) (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
unsigned char* secKey = (unsigned char*) (data + 32);
|
|
||||||
|
|
||||||
jobjectArray retArray;
|
|
||||||
jbyteArray sigArray, intsByteArray;
|
|
||||||
unsigned char intsarray[2];
|
|
||||||
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
|
|
||||||
int ret = secp256k1_ecdsa_sign(ctx, &sig, data, secKey, NULL, NULL);
|
|
||||||
|
|
||||||
unsigned char outputSer[72];
|
|
||||||
size_t outputLen = 72;
|
|
||||||
|
|
||||||
if( ret ) {
|
|
||||||
int ret2 = secp256k1_ecdsa_signature_serialize_der(ctx,outputSer, &outputLen, &sig ); (void)ret2;
|
|
||||||
}
|
|
||||||
|
|
||||||
intsarray[0] = outputLen;
|
|
||||||
intsarray[1] = ret;
|
|
||||||
|
|
||||||
retArray = (*env)->NewObjectArray(env, 2,
|
|
||||||
(*env)->FindClass(env, "[B"),
|
|
||||||
(*env)->NewByteArray(env, 1));
|
|
||||||
|
|
||||||
sigArray = (*env)->NewByteArray(env, outputLen);
|
|
||||||
(*env)->SetByteArrayRegion(env, sigArray, 0, outputLen, (jbyte*)outputSer);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 0, sigArray);
|
|
||||||
|
|
||||||
intsByteArray = (*env)->NewByteArray(env, 2);
|
|
||||||
(*env)->SetByteArrayRegion(env, intsByteArray, 0, 2, (jbyte*)intsarray);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 1, intsByteArray);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return retArray;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jint JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ec_1seckey_1verify
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
unsigned char* secKey = (unsigned char*) (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return secp256k1_ec_seckey_verify(ctx, secKey);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ec_1pubkey_1create
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
const unsigned char* secKey = (unsigned char*) (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
|
|
||||||
jobjectArray retArray;
|
|
||||||
jbyteArray pubkeyArray, intsByteArray;
|
|
||||||
unsigned char intsarray[2];
|
|
||||||
|
|
||||||
int ret = secp256k1_ec_pubkey_create(ctx, &pubkey, secKey);
|
|
||||||
|
|
||||||
unsigned char outputSer[65];
|
|
||||||
size_t outputLen = 65;
|
|
||||||
|
|
||||||
if( ret ) {
|
|
||||||
int ret2 = secp256k1_ec_pubkey_serialize(ctx,outputSer, &outputLen, &pubkey,SECP256K1_EC_UNCOMPRESSED );(void)ret2;
|
|
||||||
}
|
|
||||||
|
|
||||||
intsarray[0] = outputLen;
|
|
||||||
intsarray[1] = ret;
|
|
||||||
|
|
||||||
retArray = (*env)->NewObjectArray(env, 2,
|
|
||||||
(*env)->FindClass(env, "[B"),
|
|
||||||
(*env)->NewByteArray(env, 1));
|
|
||||||
|
|
||||||
pubkeyArray = (*env)->NewByteArray(env, outputLen);
|
|
||||||
(*env)->SetByteArrayRegion(env, pubkeyArray, 0, outputLen, (jbyte*)outputSer);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 0, pubkeyArray);
|
|
||||||
|
|
||||||
intsByteArray = (*env)->NewByteArray(env, 2);
|
|
||||||
(*env)->SetByteArrayRegion(env, intsByteArray, 0, 2, (jbyte*)intsarray);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 1, intsByteArray);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return retArray;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1privkey_1tweak_1add
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
unsigned char* privkey = (unsigned char*) (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
const unsigned char* tweak = (unsigned char*) (privkey + 32);
|
|
||||||
|
|
||||||
jobjectArray retArray;
|
|
||||||
jbyteArray privArray, intsByteArray;
|
|
||||||
unsigned char intsarray[2];
|
|
||||||
|
|
||||||
int privkeylen = 32;
|
|
||||||
|
|
||||||
int ret = secp256k1_ec_privkey_tweak_add(ctx, privkey, tweak);
|
|
||||||
|
|
||||||
intsarray[0] = privkeylen;
|
|
||||||
intsarray[1] = ret;
|
|
||||||
|
|
||||||
retArray = (*env)->NewObjectArray(env, 2,
|
|
||||||
(*env)->FindClass(env, "[B"),
|
|
||||||
(*env)->NewByteArray(env, 1));
|
|
||||||
|
|
||||||
privArray = (*env)->NewByteArray(env, privkeylen);
|
|
||||||
(*env)->SetByteArrayRegion(env, privArray, 0, privkeylen, (jbyte*)privkey);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 0, privArray);
|
|
||||||
|
|
||||||
intsByteArray = (*env)->NewByteArray(env, 2);
|
|
||||||
(*env)->SetByteArrayRegion(env, intsByteArray, 0, 2, (jbyte*)intsarray);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 1, intsByteArray);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return retArray;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1privkey_1tweak_1mul
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
unsigned char* privkey = (unsigned char*) (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
const unsigned char* tweak = (unsigned char*) (privkey + 32);
|
|
||||||
|
|
||||||
jobjectArray retArray;
|
|
||||||
jbyteArray privArray, intsByteArray;
|
|
||||||
unsigned char intsarray[2];
|
|
||||||
|
|
||||||
int privkeylen = 32;
|
|
||||||
|
|
||||||
int ret = secp256k1_ec_privkey_tweak_mul(ctx, privkey, tweak);
|
|
||||||
|
|
||||||
intsarray[0] = privkeylen;
|
|
||||||
intsarray[1] = ret;
|
|
||||||
|
|
||||||
retArray = (*env)->NewObjectArray(env, 2,
|
|
||||||
(*env)->FindClass(env, "[B"),
|
|
||||||
(*env)->NewByteArray(env, 1));
|
|
||||||
|
|
||||||
privArray = (*env)->NewByteArray(env, privkeylen);
|
|
||||||
(*env)->SetByteArrayRegion(env, privArray, 0, privkeylen, (jbyte*)privkey);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 0, privArray);
|
|
||||||
|
|
||||||
intsByteArray = (*env)->NewByteArray(env, 2);
|
|
||||||
(*env)->SetByteArrayRegion(env, intsByteArray, 0, 2, (jbyte*)intsarray);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 1, intsByteArray);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return retArray;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1pubkey_1tweak_1add
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l, jint publen)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
/* secp256k1_pubkey* pubkey = (secp256k1_pubkey*) (*env)->GetDirectBufferAddress(env, byteBufferObject);*/
|
|
||||||
unsigned char* pkey = (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
const unsigned char* tweak = (unsigned char*) (pkey + publen);
|
|
||||||
|
|
||||||
jobjectArray retArray;
|
|
||||||
jbyteArray pubArray, intsByteArray;
|
|
||||||
unsigned char intsarray[2];
|
|
||||||
unsigned char outputSer[65];
|
|
||||||
size_t outputLen = 65;
|
|
||||||
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
int ret = secp256k1_ec_pubkey_parse(ctx, &pubkey, pkey, publen);
|
|
||||||
|
|
||||||
if( ret ) {
|
|
||||||
ret = secp256k1_ec_pubkey_tweak_add(ctx, &pubkey, tweak);
|
|
||||||
}
|
|
||||||
|
|
||||||
if( ret ) {
|
|
||||||
int ret2 = secp256k1_ec_pubkey_serialize(ctx,outputSer, &outputLen, &pubkey,SECP256K1_EC_UNCOMPRESSED );(void)ret2;
|
|
||||||
}
|
|
||||||
|
|
||||||
intsarray[0] = outputLen;
|
|
||||||
intsarray[1] = ret;
|
|
||||||
|
|
||||||
retArray = (*env)->NewObjectArray(env, 2,
|
|
||||||
(*env)->FindClass(env, "[B"),
|
|
||||||
(*env)->NewByteArray(env, 1));
|
|
||||||
|
|
||||||
pubArray = (*env)->NewByteArray(env, outputLen);
|
|
||||||
(*env)->SetByteArrayRegion(env, pubArray, 0, outputLen, (jbyte*)outputSer);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 0, pubArray);
|
|
||||||
|
|
||||||
intsByteArray = (*env)->NewByteArray(env, 2);
|
|
||||||
(*env)->SetByteArrayRegion(env, intsByteArray, 0, 2, (jbyte*)intsarray);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 1, intsByteArray);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return retArray;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1pubkey_1tweak_1mul
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l, jint publen)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
unsigned char* pkey = (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
const unsigned char* tweak = (unsigned char*) (pkey + publen);
|
|
||||||
|
|
||||||
jobjectArray retArray;
|
|
||||||
jbyteArray pubArray, intsByteArray;
|
|
||||||
unsigned char intsarray[2];
|
|
||||||
unsigned char outputSer[65];
|
|
||||||
size_t outputLen = 65;
|
|
||||||
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
int ret = secp256k1_ec_pubkey_parse(ctx, &pubkey, pkey, publen);
|
|
||||||
|
|
||||||
if ( ret ) {
|
|
||||||
ret = secp256k1_ec_pubkey_tweak_mul(ctx, &pubkey, tweak);
|
|
||||||
}
|
|
||||||
|
|
||||||
if( ret ) {
|
|
||||||
int ret2 = secp256k1_ec_pubkey_serialize(ctx,outputSer, &outputLen, &pubkey,SECP256K1_EC_UNCOMPRESSED );(void)ret2;
|
|
||||||
}
|
|
||||||
|
|
||||||
intsarray[0] = outputLen;
|
|
||||||
intsarray[1] = ret;
|
|
||||||
|
|
||||||
retArray = (*env)->NewObjectArray(env, 2,
|
|
||||||
(*env)->FindClass(env, "[B"),
|
|
||||||
(*env)->NewByteArray(env, 1));
|
|
||||||
|
|
||||||
pubArray = (*env)->NewByteArray(env, outputLen);
|
|
||||||
(*env)->SetByteArrayRegion(env, pubArray, 0, outputLen, (jbyte*)outputSer);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 0, pubArray);
|
|
||||||
|
|
||||||
intsByteArray = (*env)->NewByteArray(env, 2);
|
|
||||||
(*env)->SetByteArrayRegion(env, intsByteArray, 0, 2, (jbyte*)intsarray);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 1, intsByteArray);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return retArray;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jlong JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ecdsa_1pubkey_1combine
|
|
||||||
(JNIEnv * env, jclass classObject, jobject byteBufferObject, jlong ctx_l, jint numkeys)
|
|
||||||
{
|
|
||||||
(void)classObject;(void)env;(void)byteBufferObject;(void)ctx_l;(void)numkeys;
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ecdh
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l, jint publen)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = (secp256k1_context*)(uintptr_t)ctx_l;
|
|
||||||
const unsigned char* secdata = (*env)->GetDirectBufferAddress(env, byteBufferObject);
|
|
||||||
const unsigned char* pubdata = (const unsigned char*) (secdata + 32);
|
|
||||||
|
|
||||||
jobjectArray retArray;
|
|
||||||
jbyteArray outArray, intsByteArray;
|
|
||||||
unsigned char intsarray[1];
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
unsigned char nonce_res[32];
|
|
||||||
size_t outputLen = 32;
|
|
||||||
|
|
||||||
int ret = secp256k1_ec_pubkey_parse(ctx, &pubkey, pubdata, publen);
|
|
||||||
|
|
||||||
if (ret) {
|
|
||||||
ret = secp256k1_ecdh(
|
|
||||||
ctx,
|
|
||||||
nonce_res,
|
|
||||||
&pubkey,
|
|
||||||
secdata,
|
|
||||||
NULL,
|
|
||||||
NULL
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
intsarray[0] = ret;
|
|
||||||
|
|
||||||
retArray = (*env)->NewObjectArray(env, 2,
|
|
||||||
(*env)->FindClass(env, "[B"),
|
|
||||||
(*env)->NewByteArray(env, 1));
|
|
||||||
|
|
||||||
outArray = (*env)->NewByteArray(env, outputLen);
|
|
||||||
(*env)->SetByteArrayRegion(env, outArray, 0, 32, (jbyte*)nonce_res);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 0, outArray);
|
|
||||||
|
|
||||||
intsByteArray = (*env)->NewByteArray(env, 1);
|
|
||||||
(*env)->SetByteArrayRegion(env, intsByteArray, 0, 1, (jbyte*)intsarray);
|
|
||||||
(*env)->SetObjectArrayElement(env, retArray, 1, intsByteArray);
|
|
||||||
|
|
||||||
(void)classObject;
|
|
||||||
|
|
||||||
return retArray;
|
|
||||||
}
|
|
||||||
@ -1,119 +0,0 @@
|
|||||||
/* DO NOT EDIT THIS FILE - it is machine generated */
|
|
||||||
#include <jni.h>
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
/* Header for class org_bitcoin_NativeSecp256k1 */
|
|
||||||
|
|
||||||
#ifndef _Included_org_bitcoin_NativeSecp256k1
|
|
||||||
#define _Included_org_bitcoin_NativeSecp256k1
|
|
||||||
#ifdef __cplusplus
|
|
||||||
extern "C" {
|
|
||||||
#endif
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_ctx_clone
|
|
||||||
* Signature: (J)J
|
|
||||||
*/
|
|
||||||
SECP256K1_API jlong JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ctx_1clone
|
|
||||||
(JNIEnv *, jclass, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_context_randomize
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;J)I
|
|
||||||
*/
|
|
||||||
SECP256K1_API jint JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1context_1randomize
|
|
||||||
(JNIEnv *, jclass, jobject, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_privkey_tweak_add
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;J)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1privkey_1tweak_1add
|
|
||||||
(JNIEnv *, jclass, jobject, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_privkey_tweak_mul
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;J)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1privkey_1tweak_1mul
|
|
||||||
(JNIEnv *, jclass, jobject, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_pubkey_tweak_add
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;JI)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1pubkey_1tweak_1add
|
|
||||||
(JNIEnv *, jclass, jobject, jlong, jint);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_pubkey_tweak_mul
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;JI)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1pubkey_1tweak_1mul
|
|
||||||
(JNIEnv *, jclass, jobject, jlong, jint);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_destroy_context
|
|
||||||
* Signature: (J)V
|
|
||||||
*/
|
|
||||||
SECP256K1_API void JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1destroy_1context
|
|
||||||
(JNIEnv *, jclass, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_ecdsa_verify
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;JII)I
|
|
||||||
*/
|
|
||||||
SECP256K1_API jint JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ecdsa_1verify
|
|
||||||
(JNIEnv *, jclass, jobject, jlong, jint, jint);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_ecdsa_sign
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;J)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ecdsa_1sign
|
|
||||||
(JNIEnv *, jclass, jobject, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_ec_seckey_verify
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;J)I
|
|
||||||
*/
|
|
||||||
SECP256K1_API jint JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ec_1seckey_1verify
|
|
||||||
(JNIEnv *, jclass, jobject, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_ec_pubkey_create
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;J)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ec_1pubkey_1create
|
|
||||||
(JNIEnv *, jclass, jobject, jlong);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_ec_pubkey_parse
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;JI)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ec_1pubkey_1parse
|
|
||||||
(JNIEnv *, jclass, jobject, jlong, jint);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_NativeSecp256k1
|
|
||||||
* Method: secp256k1_ecdh
|
|
||||||
* Signature: (Ljava/nio/ByteBuffer;JI)[[B
|
|
||||||
*/
|
|
||||||
SECP256K1_API jobjectArray JNICALL Java_org_bitcoin_NativeSecp256k1_secp256k1_1ecdh
|
|
||||||
(JNIEnv* env, jclass classObject, jobject byteBufferObject, jlong ctx_l, jint publen);
|
|
||||||
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
#include <stdlib.h>
|
|
||||||
#include <stdint.h>
|
|
||||||
#include "org_bitcoin_Secp256k1Context.h"
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
|
|
||||||
SECP256K1_API jlong JNICALL Java_org_bitcoin_Secp256k1Context_secp256k1_1init_1context
|
|
||||||
(JNIEnv* env, jclass classObject)
|
|
||||||
{
|
|
||||||
secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
|
|
||||||
|
|
||||||
(void)classObject;(void)env;
|
|
||||||
|
|
||||||
return (uintptr_t)ctx;
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -1,22 +0,0 @@
|
|||||||
/* DO NOT EDIT THIS FILE - it is machine generated */
|
|
||||||
#include <jni.h>
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
/* Header for class org_bitcoin_Secp256k1Context */
|
|
||||||
|
|
||||||
#ifndef _Included_org_bitcoin_Secp256k1Context
|
|
||||||
#define _Included_org_bitcoin_Secp256k1Context
|
|
||||||
#ifdef __cplusplus
|
|
||||||
extern "C" {
|
|
||||||
#endif
|
|
||||||
/*
|
|
||||||
* Class: org_bitcoin_Secp256k1Context
|
|
||||||
* Method: secp256k1_init_context
|
|
||||||
* Signature: ()J
|
|
||||||
*/
|
|
||||||
SECP256K1_API jlong JNICALL Java_org_bitcoin_Secp256k1Context_secp256k1_1init_1context
|
|
||||||
(JNIEnv *, jclass);
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
@ -1,8 +0,0 @@
|
|||||||
include_HEADERS += include/secp256k1_ecdh.h
|
|
||||||
noinst_HEADERS += src/modules/ecdh/main_impl.h
|
|
||||||
noinst_HEADERS += src/modules/ecdh/tests_impl.h
|
|
||||||
if USE_BENCHMARK
|
|
||||||
noinst_PROGRAMS += bench_ecdh
|
|
||||||
bench_ecdh_SOURCES = src/bench_ecdh.c
|
|
||||||
bench_ecdh_LDADD = libsecp256k1.la $(SECP_LIBS) $(COMMON_LIB)
|
|
||||||
endif
|
|
||||||
@ -1,67 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_MODULE_ECDH_MAIN_H
|
|
||||||
#define SECP256K1_MODULE_ECDH_MAIN_H
|
|
||||||
|
|
||||||
#include "include/secp256k1_ecdh.h"
|
|
||||||
#include "ecmult_const_impl.h"
|
|
||||||
|
|
||||||
static int ecdh_hash_function_sha256(unsigned char *output, const unsigned char *x, const unsigned char *y, void *data) {
|
|
||||||
unsigned char version = (y[31] & 0x01) | 0x02;
|
|
||||||
secp256k1_sha256 sha;
|
|
||||||
(void)data;
|
|
||||||
|
|
||||||
secp256k1_sha256_initialize(&sha);
|
|
||||||
secp256k1_sha256_write(&sha, &version, 1);
|
|
||||||
secp256k1_sha256_write(&sha, x, 32);
|
|
||||||
secp256k1_sha256_finalize(&sha, output);
|
|
||||||
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
const secp256k1_ecdh_hash_function secp256k1_ecdh_hash_function_sha256 = ecdh_hash_function_sha256;
|
|
||||||
const secp256k1_ecdh_hash_function secp256k1_ecdh_hash_function_default = ecdh_hash_function_sha256;
|
|
||||||
|
|
||||||
int secp256k1_ecdh(const secp256k1_context* ctx, unsigned char *output, const secp256k1_pubkey *point, const unsigned char *scalar, secp256k1_ecdh_hash_function hashfp, void *data) {
|
|
||||||
int ret = 0;
|
|
||||||
int overflow = 0;
|
|
||||||
secp256k1_gej res;
|
|
||||||
secp256k1_ge pt;
|
|
||||||
secp256k1_scalar s;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(output != NULL);
|
|
||||||
ARG_CHECK(point != NULL);
|
|
||||||
ARG_CHECK(scalar != NULL);
|
|
||||||
if (hashfp == NULL) {
|
|
||||||
hashfp = secp256k1_ecdh_hash_function_default;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_pubkey_load(ctx, &pt, point);
|
|
||||||
secp256k1_scalar_set_b32(&s, scalar, &overflow);
|
|
||||||
if (overflow || secp256k1_scalar_is_zero(&s)) {
|
|
||||||
ret = 0;
|
|
||||||
} else {
|
|
||||||
unsigned char x[32];
|
|
||||||
unsigned char y[32];
|
|
||||||
|
|
||||||
secp256k1_ecmult_const(&res, &pt, &s, 256);
|
|
||||||
secp256k1_ge_set_gej(&pt, &res);
|
|
||||||
|
|
||||||
/* Compute a hash of the point */
|
|
||||||
secp256k1_fe_normalize(&pt.x);
|
|
||||||
secp256k1_fe_normalize(&pt.y);
|
|
||||||
secp256k1_fe_get_b32(x, &pt.x);
|
|
||||||
secp256k1_fe_get_b32(y, &pt.y);
|
|
||||||
|
|
||||||
ret = hashfp(output, x, y, data);
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_clear(&s);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_MODULE_ECDH_MAIN_H */
|
|
||||||
@ -1,132 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_MODULE_ECDH_TESTS_H
|
|
||||||
#define SECP256K1_MODULE_ECDH_TESTS_H
|
|
||||||
|
|
||||||
int ecdh_hash_function_test_fail(unsigned char *output, const unsigned char *x, const unsigned char *y, void *data) {
|
|
||||||
(void)output;
|
|
||||||
(void)x;
|
|
||||||
(void)y;
|
|
||||||
(void)data;
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
int ecdh_hash_function_custom(unsigned char *output, const unsigned char *x, const unsigned char *y, void *data) {
|
|
||||||
(void)data;
|
|
||||||
/* Save x and y as uncompressed public key */
|
|
||||||
output[0] = 0x04;
|
|
||||||
memcpy(output + 1, x, 32);
|
|
||||||
memcpy(output + 33, y, 32);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_ecdh_api(void) {
|
|
||||||
/* Setup context that just counts errors */
|
|
||||||
secp256k1_context *tctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
|
|
||||||
secp256k1_pubkey point;
|
|
||||||
unsigned char res[32];
|
|
||||||
unsigned char s_one[32] = { 0 };
|
|
||||||
int32_t ecount = 0;
|
|
||||||
s_one[31] = 1;
|
|
||||||
|
|
||||||
secp256k1_context_set_error_callback(tctx, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_illegal_callback(tctx, counting_illegal_callback_fn, &ecount);
|
|
||||||
CHECK(secp256k1_ec_pubkey_create(tctx, &point, s_one) == 1);
|
|
||||||
|
|
||||||
/* Check all NULLs are detected */
|
|
||||||
CHECK(secp256k1_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
|
|
||||||
CHECK(ecount == 0);
|
|
||||||
CHECK(secp256k1_ecdh(tctx, NULL, &point, s_one, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 1);
|
|
||||||
CHECK(secp256k1_ecdh(tctx, res, NULL, s_one, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdh(tctx, res, &point, NULL, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 3);
|
|
||||||
CHECK(secp256k1_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
|
|
||||||
CHECK(ecount == 3);
|
|
||||||
|
|
||||||
/* Cleanup */
|
|
||||||
secp256k1_context_destroy(tctx);
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_ecdh_generator_basepoint(void) {
|
|
||||||
unsigned char s_one[32] = { 0 };
|
|
||||||
secp256k1_pubkey point[2];
|
|
||||||
int i;
|
|
||||||
|
|
||||||
s_one[31] = 1;
|
|
||||||
/* Check against pubkey creation when the basepoint is the generator */
|
|
||||||
for (i = 0; i < 100; ++i) {
|
|
||||||
secp256k1_sha256 sha;
|
|
||||||
unsigned char s_b32[32];
|
|
||||||
unsigned char output_ecdh[65];
|
|
||||||
unsigned char output_ser[32];
|
|
||||||
unsigned char point_ser[65];
|
|
||||||
size_t point_ser_len = sizeof(point_ser);
|
|
||||||
secp256k1_scalar s;
|
|
||||||
|
|
||||||
random_scalar_order(&s);
|
|
||||||
secp256k1_scalar_get_b32(s_b32, &s);
|
|
||||||
|
|
||||||
CHECK(secp256k1_ec_pubkey_create(ctx, &point[0], s_one) == 1);
|
|
||||||
CHECK(secp256k1_ec_pubkey_create(ctx, &point[1], s_b32) == 1);
|
|
||||||
|
|
||||||
/* compute using ECDH function with custom hash function */
|
|
||||||
CHECK(secp256k1_ecdh(ctx, output_ecdh, &point[0], s_b32, ecdh_hash_function_custom, NULL) == 1);
|
|
||||||
/* compute "explicitly" */
|
|
||||||
CHECK(secp256k1_ec_pubkey_serialize(ctx, point_ser, &point_ser_len, &point[1], SECP256K1_EC_UNCOMPRESSED) == 1);
|
|
||||||
/* compare */
|
|
||||||
CHECK(memcmp(output_ecdh, point_ser, 65) == 0);
|
|
||||||
|
|
||||||
/* compute using ECDH function with default hash function */
|
|
||||||
CHECK(secp256k1_ecdh(ctx, output_ecdh, &point[0], s_b32, NULL, NULL) == 1);
|
|
||||||
/* compute "explicitly" */
|
|
||||||
CHECK(secp256k1_ec_pubkey_serialize(ctx, point_ser, &point_ser_len, &point[1], SECP256K1_EC_COMPRESSED) == 1);
|
|
||||||
secp256k1_sha256_initialize(&sha);
|
|
||||||
secp256k1_sha256_write(&sha, point_ser, point_ser_len);
|
|
||||||
secp256k1_sha256_finalize(&sha, output_ser);
|
|
||||||
/* compare */
|
|
||||||
CHECK(memcmp(output_ecdh, output_ser, 32) == 0);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_bad_scalar(void) {
|
|
||||||
unsigned char s_zero[32] = { 0 };
|
|
||||||
unsigned char s_overflow[32] = {
|
|
||||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
||||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
|
|
||||||
0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
|
|
||||||
0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x41
|
|
||||||
};
|
|
||||||
unsigned char s_rand[32] = { 0 };
|
|
||||||
unsigned char output[32];
|
|
||||||
secp256k1_scalar rand;
|
|
||||||
secp256k1_pubkey point;
|
|
||||||
|
|
||||||
/* Create random point */
|
|
||||||
random_scalar_order(&rand);
|
|
||||||
secp256k1_scalar_get_b32(s_rand, &rand);
|
|
||||||
CHECK(secp256k1_ec_pubkey_create(ctx, &point, s_rand) == 1);
|
|
||||||
|
|
||||||
/* Try to multiply it by bad values */
|
|
||||||
CHECK(secp256k1_ecdh(ctx, output, &point, s_zero, NULL, NULL) == 0);
|
|
||||||
CHECK(secp256k1_ecdh(ctx, output, &point, s_overflow, NULL, NULL) == 0);
|
|
||||||
/* ...and a good one */
|
|
||||||
s_overflow[31] -= 1;
|
|
||||||
CHECK(secp256k1_ecdh(ctx, output, &point, s_overflow, NULL, NULL) == 1);
|
|
||||||
|
|
||||||
/* Hash function failure results in ecdh failure */
|
|
||||||
CHECK(secp256k1_ecdh(ctx, output, &point, s_overflow, ecdh_hash_function_test_fail, NULL) == 0);
|
|
||||||
}
|
|
||||||
|
|
||||||
void run_ecdh_tests(void) {
|
|
||||||
test_ecdh_api();
|
|
||||||
test_ecdh_generator_basepoint();
|
|
||||||
test_bad_scalar();
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_MODULE_ECDH_TESTS_H */
|
|
||||||
@ -1,8 +0,0 @@
|
|||||||
include_HEADERS += include/secp256k1_recovery.h
|
|
||||||
noinst_HEADERS += src/modules/recovery/main_impl.h
|
|
||||||
noinst_HEADERS += src/modules/recovery/tests_impl.h
|
|
||||||
if USE_BENCHMARK
|
|
||||||
noinst_PROGRAMS += bench_recover
|
|
||||||
bench_recover_SOURCES = src/bench_recover.c
|
|
||||||
bench_recover_LDADD = libsecp256k1.la $(SECP_LIBS) $(COMMON_LIB)
|
|
||||||
endif
|
|
||||||
@ -1,193 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013-2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_MODULE_RECOVERY_MAIN_H
|
|
||||||
#define SECP256K1_MODULE_RECOVERY_MAIN_H
|
|
||||||
|
|
||||||
#include "include/secp256k1_recovery.h"
|
|
||||||
|
|
||||||
static void secp256k1_ecdsa_recoverable_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, int* recid, const secp256k1_ecdsa_recoverable_signature* sig) {
|
|
||||||
(void)ctx;
|
|
||||||
if (sizeof(secp256k1_scalar) == 32) {
|
|
||||||
/* When the secp256k1_scalar type is exactly 32 byte, use its
|
|
||||||
* representation inside secp256k1_ecdsa_signature, as conversion is very fast.
|
|
||||||
* Note that secp256k1_ecdsa_signature_save must use the same representation. */
|
|
||||||
memcpy(r, &sig->data[0], 32);
|
|
||||||
memcpy(s, &sig->data[32], 32);
|
|
||||||
} else {
|
|
||||||
secp256k1_scalar_set_b32(r, &sig->data[0], NULL);
|
|
||||||
secp256k1_scalar_set_b32(s, &sig->data[32], NULL);
|
|
||||||
}
|
|
||||||
*recid = sig->data[64];
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecdsa_recoverable_signature_save(secp256k1_ecdsa_recoverable_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s, int recid) {
|
|
||||||
if (sizeof(secp256k1_scalar) == 32) {
|
|
||||||
memcpy(&sig->data[0], r, 32);
|
|
||||||
memcpy(&sig->data[32], s, 32);
|
|
||||||
} else {
|
|
||||||
secp256k1_scalar_get_b32(&sig->data[0], r);
|
|
||||||
secp256k1_scalar_get_b32(&sig->data[32], s);
|
|
||||||
}
|
|
||||||
sig->data[64] = recid;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_recoverable_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_recoverable_signature* sig, const unsigned char *input64, int recid) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
int ret = 1;
|
|
||||||
int overflow = 0;
|
|
||||||
|
|
||||||
(void)ctx;
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
ARG_CHECK(input64 != NULL);
|
|
||||||
ARG_CHECK(recid >= 0 && recid <= 3);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&r, &input64[0], &overflow);
|
|
||||||
ret &= !overflow;
|
|
||||||
secp256k1_scalar_set_b32(&s, &input64[32], &overflow);
|
|
||||||
ret &= !overflow;
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_ecdsa_recoverable_signature_save(sig, &r, &s, recid);
|
|
||||||
} else {
|
|
||||||
memset(sig, 0, sizeof(*sig));
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature* sig) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
|
|
||||||
(void)ctx;
|
|
||||||
ARG_CHECK(output64 != NULL);
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
ARG_CHECK(recid != NULL);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, recid, sig);
|
|
||||||
secp256k1_scalar_get_b32(&output64[0], &r);
|
|
||||||
secp256k1_scalar_get_b32(&output64[32], &s);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_recoverable_signature_convert(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const secp256k1_ecdsa_recoverable_signature* sigin) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
int recid;
|
|
||||||
|
|
||||||
(void)ctx;
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
ARG_CHECK(sigin != NULL);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, sigin);
|
|
||||||
secp256k1_ecdsa_signature_save(sig, &r, &s);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_ecdsa_sig_recover(const secp256k1_ecmult_context *ctx, const secp256k1_scalar *sigr, const secp256k1_scalar* sigs, secp256k1_ge *pubkey, const secp256k1_scalar *message, int recid) {
|
|
||||||
unsigned char brx[32];
|
|
||||||
secp256k1_fe fx;
|
|
||||||
secp256k1_ge x;
|
|
||||||
secp256k1_gej xj;
|
|
||||||
secp256k1_scalar rn, u1, u2;
|
|
||||||
secp256k1_gej qj;
|
|
||||||
int r;
|
|
||||||
|
|
||||||
if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_get_b32(brx, sigr);
|
|
||||||
r = secp256k1_fe_set_b32(&fx, brx);
|
|
||||||
(void)r;
|
|
||||||
VERIFY_CHECK(r); /* brx comes from a scalar, so is less than the order; certainly less than p */
|
|
||||||
if (recid & 2) {
|
|
||||||
if (secp256k1_fe_cmp_var(&fx, &secp256k1_ecdsa_const_p_minus_order) >= 0) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_fe_add(&fx, &secp256k1_ecdsa_const_order_as_fe);
|
|
||||||
}
|
|
||||||
if (!secp256k1_ge_set_xo_var(&x, &fx, recid & 1)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_gej_set_ge(&xj, &x);
|
|
||||||
secp256k1_scalar_inverse_var(&rn, sigr);
|
|
||||||
secp256k1_scalar_mul(&u1, &rn, message);
|
|
||||||
secp256k1_scalar_negate(&u1, &u1);
|
|
||||||
secp256k1_scalar_mul(&u2, &rn, sigs);
|
|
||||||
secp256k1_ecmult(ctx, &qj, &xj, &u2, &u1);
|
|
||||||
secp256k1_ge_set_gej_var(pubkey, &qj);
|
|
||||||
return !secp256k1_gej_is_infinity(&qj);
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_sign_recoverable(const secp256k1_context* ctx, secp256k1_ecdsa_recoverable_signature *signature, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
secp256k1_scalar sec, non, msg;
|
|
||||||
int recid;
|
|
||||||
int ret = 0;
|
|
||||||
int overflow = 0;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
|
|
||||||
ARG_CHECK(msg32 != NULL);
|
|
||||||
ARG_CHECK(signature != NULL);
|
|
||||||
ARG_CHECK(seckey != NULL);
|
|
||||||
if (noncefp == NULL) {
|
|
||||||
noncefp = secp256k1_nonce_function_default;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&sec, seckey, &overflow);
|
|
||||||
/* Fail if the secret key is invalid. */
|
|
||||||
if (!overflow && !secp256k1_scalar_is_zero(&sec)) {
|
|
||||||
unsigned char nonce32[32];
|
|
||||||
unsigned int count = 0;
|
|
||||||
secp256k1_scalar_set_b32(&msg, msg32, NULL);
|
|
||||||
while (1) {
|
|
||||||
ret = noncefp(nonce32, msg32, seckey, NULL, (void*)noncedata, count);
|
|
||||||
if (!ret) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
secp256k1_scalar_set_b32(&non, nonce32, &overflow);
|
|
||||||
if (!overflow && !secp256k1_scalar_is_zero(&non)) {
|
|
||||||
if (secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, &r, &s, &sec, &msg, &non, &recid)) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
count++;
|
|
||||||
}
|
|
||||||
memset(nonce32, 0, 32);
|
|
||||||
secp256k1_scalar_clear(&msg);
|
|
||||||
secp256k1_scalar_clear(&non);
|
|
||||||
secp256k1_scalar_clear(&sec);
|
|
||||||
}
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_ecdsa_recoverable_signature_save(signature, &r, &s, recid);
|
|
||||||
} else {
|
|
||||||
memset(signature, 0, sizeof(*signature));
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_recover(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const secp256k1_ecdsa_recoverable_signature *signature, const unsigned char *msg32) {
|
|
||||||
secp256k1_ge q;
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
secp256k1_scalar m;
|
|
||||||
int recid;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
|
|
||||||
ARG_CHECK(msg32 != NULL);
|
|
||||||
ARG_CHECK(signature != NULL);
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, signature);
|
|
||||||
VERIFY_CHECK(recid >= 0 && recid < 4); /* should have been caught in parse_compact */
|
|
||||||
secp256k1_scalar_set_b32(&m, msg32, NULL);
|
|
||||||
if (secp256k1_ecdsa_sig_recover(&ctx->ecmult_ctx, &r, &s, &q, &m, recid)) {
|
|
||||||
secp256k1_pubkey_save(pubkey, &q);
|
|
||||||
return 1;
|
|
||||||
} else {
|
|
||||||
memset(pubkey, 0, sizeof(*pubkey));
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_MODULE_RECOVERY_MAIN_H */
|
|
||||||
@ -1,393 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013-2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_MODULE_RECOVERY_TESTS_H
|
|
||||||
#define SECP256K1_MODULE_RECOVERY_TESTS_H
|
|
||||||
|
|
||||||
static int recovery_test_nonce_function(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
|
|
||||||
(void) msg32;
|
|
||||||
(void) key32;
|
|
||||||
(void) algo16;
|
|
||||||
(void) data;
|
|
||||||
|
|
||||||
/* On the first run, return 0 to force a second run */
|
|
||||||
if (counter == 0) {
|
|
||||||
memset(nonce32, 0, 32);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
/* On the second run, return an overflow to force a third run */
|
|
||||||
if (counter == 1) {
|
|
||||||
memset(nonce32, 0xff, 32);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
/* On the next run, return a valid nonce, but flip a coin as to whether or not to fail signing. */
|
|
||||||
memset(nonce32, 1, 32);
|
|
||||||
return secp256k1_rand_bits(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_ecdsa_recovery_api(void) {
|
|
||||||
/* Setup contexts that just count errors */
|
|
||||||
secp256k1_context *none = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
|
|
||||||
secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
|
|
||||||
secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
|
|
||||||
secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
secp256k1_pubkey recpubkey;
|
|
||||||
secp256k1_ecdsa_signature normal_sig;
|
|
||||||
secp256k1_ecdsa_recoverable_signature recsig;
|
|
||||||
unsigned char privkey[32] = { 1 };
|
|
||||||
unsigned char message[32] = { 2 };
|
|
||||||
int32_t ecount = 0;
|
|
||||||
int recid = 0;
|
|
||||||
unsigned char sig[74];
|
|
||||||
unsigned char zero_privkey[32] = { 0 };
|
|
||||||
unsigned char over_privkey[32] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
||||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
||||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
||||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
|
|
||||||
|
|
||||||
secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_error_callback(both, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
|
|
||||||
secp256k1_context_set_illegal_callback(both, counting_illegal_callback_fn, &ecount);
|
|
||||||
|
|
||||||
/* Construct and verify corresponding public key. */
|
|
||||||
CHECK(secp256k1_ec_seckey_verify(ctx, privkey) == 1);
|
|
||||||
CHECK(secp256k1_ec_pubkey_create(ctx, &pubkey, privkey) == 1);
|
|
||||||
|
|
||||||
/* Check bad contexts and NULLs for signing */
|
|
||||||
ecount = 0;
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(none, &recsig, message, privkey, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(sign, &recsig, message, privkey, NULL, NULL) == 1);
|
|
||||||
CHECK(ecount == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(vrfy, &recsig, message, privkey, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, privkey, NULL, NULL) == 1);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, NULL, message, privkey, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 3);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, NULL, privkey, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 4);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, NULL, NULL, NULL) == 0);
|
|
||||||
CHECK(ecount == 5);
|
|
||||||
/* This will fail or succeed randomly, and in either case will not ARG_CHECK failure */
|
|
||||||
secp256k1_ecdsa_sign_recoverable(both, &recsig, message, privkey, recovery_test_nonce_function, NULL);
|
|
||||||
CHECK(ecount == 5);
|
|
||||||
/* These will all fail, but not in ARG_CHECK way */
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, zero_privkey, NULL, NULL) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, over_privkey, NULL, NULL) == 0);
|
|
||||||
/* This one will succeed. */
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, privkey, NULL, NULL) == 1);
|
|
||||||
CHECK(ecount == 5);
|
|
||||||
|
|
||||||
/* Check signing with a goofy nonce function */
|
|
||||||
|
|
||||||
/* Check bad contexts and NULLs for recovery */
|
|
||||||
ecount = 0;
|
|
||||||
CHECK(secp256k1_ecdsa_recover(none, &recpubkey, &recsig, message) == 0);
|
|
||||||
CHECK(ecount == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(sign, &recpubkey, &recsig, message) == 0);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(vrfy, &recpubkey, &recsig, message) == 1);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(both, &recpubkey, &recsig, message) == 1);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(both, NULL, &recsig, message) == 0);
|
|
||||||
CHECK(ecount == 3);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(both, &recpubkey, NULL, message) == 0);
|
|
||||||
CHECK(ecount == 4);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(both, &recpubkey, &recsig, NULL) == 0);
|
|
||||||
CHECK(ecount == 5);
|
|
||||||
|
|
||||||
/* Check NULLs for conversion */
|
|
||||||
CHECK(secp256k1_ecdsa_sign(both, &normal_sig, message, privkey, NULL, NULL) == 1);
|
|
||||||
ecount = 0;
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_convert(both, NULL, &recsig) == 0);
|
|
||||||
CHECK(ecount == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_convert(both, &normal_sig, NULL) == 0);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_convert(both, &normal_sig, &recsig) == 1);
|
|
||||||
|
|
||||||
/* Check NULLs for de/serialization */
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, privkey, NULL, NULL) == 1);
|
|
||||||
ecount = 0;
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(both, NULL, &recid, &recsig) == 0);
|
|
||||||
CHECK(ecount == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(both, sig, NULL, &recsig) == 0);
|
|
||||||
CHECK(ecount == 2);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(both, sig, &recid, NULL) == 0);
|
|
||||||
CHECK(ecount == 3);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(both, sig, &recid, &recsig) == 1);
|
|
||||||
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(both, NULL, sig, recid) == 0);
|
|
||||||
CHECK(ecount == 4);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(both, &recsig, NULL, recid) == 0);
|
|
||||||
CHECK(ecount == 5);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(both, &recsig, sig, -1) == 0);
|
|
||||||
CHECK(ecount == 6);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(both, &recsig, sig, 5) == 0);
|
|
||||||
CHECK(ecount == 7);
|
|
||||||
/* overflow in signature will fail but not affect ecount */
|
|
||||||
memcpy(sig, over_privkey, 32);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(both, &recsig, sig, recid) == 0);
|
|
||||||
CHECK(ecount == 7);
|
|
||||||
|
|
||||||
/* cleanup */
|
|
||||||
secp256k1_context_destroy(none);
|
|
||||||
secp256k1_context_destroy(sign);
|
|
||||||
secp256k1_context_destroy(vrfy);
|
|
||||||
secp256k1_context_destroy(both);
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_ecdsa_recovery_end_to_end(void) {
|
|
||||||
unsigned char extra[32] = {0x00};
|
|
||||||
unsigned char privkey[32];
|
|
||||||
unsigned char message[32];
|
|
||||||
secp256k1_ecdsa_signature signature[5];
|
|
||||||
secp256k1_ecdsa_recoverable_signature rsignature[5];
|
|
||||||
unsigned char sig[74];
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
secp256k1_pubkey recpubkey;
|
|
||||||
int recid = 0;
|
|
||||||
|
|
||||||
/* Generate a random key and message. */
|
|
||||||
{
|
|
||||||
secp256k1_scalar msg, key;
|
|
||||||
random_scalar_order_test(&msg);
|
|
||||||
random_scalar_order_test(&key);
|
|
||||||
secp256k1_scalar_get_b32(privkey, &key);
|
|
||||||
secp256k1_scalar_get_b32(message, &msg);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Construct and verify corresponding public key. */
|
|
||||||
CHECK(secp256k1_ec_seckey_verify(ctx, privkey) == 1);
|
|
||||||
CHECK(secp256k1_ec_pubkey_create(ctx, &pubkey, privkey) == 1);
|
|
||||||
|
|
||||||
/* Serialize/parse compact and verify/recover. */
|
|
||||||
extra[0] = 0;
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(ctx, &rsignature[0], message, privkey, NULL, NULL) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_sign(ctx, &signature[0], message, privkey, NULL, NULL) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(ctx, &rsignature[4], message, privkey, NULL, NULL) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(ctx, &rsignature[1], message, privkey, NULL, extra) == 1);
|
|
||||||
extra[31] = 1;
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(ctx, &rsignature[2], message, privkey, NULL, extra) == 1);
|
|
||||||
extra[31] = 0;
|
|
||||||
extra[0] = 1;
|
|
||||||
CHECK(secp256k1_ecdsa_sign_recoverable(ctx, &rsignature[3], message, privkey, NULL, extra) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &rsignature[4]) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_convert(ctx, &signature[4], &rsignature[4]) == 1);
|
|
||||||
CHECK(memcmp(&signature[4], &signature[0], 64) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &signature[4], message, &pubkey) == 1);
|
|
||||||
memset(&rsignature[4], 0, sizeof(rsignature[4]));
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsignature[4], sig, recid) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_convert(ctx, &signature[4], &rsignature[4]) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &signature[4], message, &pubkey) == 1);
|
|
||||||
/* Parse compact (with recovery id) and recover. */
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsignature[4], sig, recid) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &recpubkey, &rsignature[4], message) == 1);
|
|
||||||
CHECK(memcmp(&pubkey, &recpubkey, sizeof(pubkey)) == 0);
|
|
||||||
/* Serialize/destroy/parse signature and verify again. */
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &rsignature[4]) == 1);
|
|
||||||
sig[secp256k1_rand_bits(6)] += 1 + secp256k1_rand_int(255);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsignature[4], sig, recid) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_convert(ctx, &signature[4], &rsignature[4]) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &signature[4], message, &pubkey) == 0);
|
|
||||||
/* Recover again */
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &recpubkey, &rsignature[4], message) == 0 ||
|
|
||||||
memcmp(&pubkey, &recpubkey, sizeof(pubkey)) != 0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Tests several edge cases. */
|
|
||||||
void test_ecdsa_recovery_edge_cases(void) {
|
|
||||||
const unsigned char msg32[32] = {
|
|
||||||
'T', 'h', 'i', 's', ' ', 'i', 's', ' ',
|
|
||||||
'a', ' ', 'v', 'e', 'r', 'y', ' ', 's',
|
|
||||||
'e', 'c', 'r', 'e', 't', ' ', 'm', 'e',
|
|
||||||
's', 's', 'a', 'g', 'e', '.', '.', '.'
|
|
||||||
};
|
|
||||||
const unsigned char sig64[64] = {
|
|
||||||
/* Generated by signing the above message with nonce 'This is the nonce we will use...'
|
|
||||||
* and secret key 0 (which is not valid), resulting in recid 1. */
|
|
||||||
0x67, 0xCB, 0x28, 0x5F, 0x9C, 0xD1, 0x94, 0xE8,
|
|
||||||
0x40, 0xD6, 0x29, 0x39, 0x7A, 0xF5, 0x56, 0x96,
|
|
||||||
0x62, 0xFD, 0xE4, 0x46, 0x49, 0x99, 0x59, 0x63,
|
|
||||||
0x17, 0x9A, 0x7D, 0xD1, 0x7B, 0xD2, 0x35, 0x32,
|
|
||||||
0x4B, 0x1B, 0x7D, 0xF3, 0x4C, 0xE1, 0xF6, 0x8E,
|
|
||||||
0x69, 0x4F, 0xF6, 0xF1, 0x1A, 0xC7, 0x51, 0xDD,
|
|
||||||
0x7D, 0xD7, 0x3E, 0x38, 0x7E, 0xE4, 0xFC, 0x86,
|
|
||||||
0x6E, 0x1B, 0xE8, 0xEC, 0xC7, 0xDD, 0x95, 0x57
|
|
||||||
};
|
|
||||||
secp256k1_pubkey pubkey;
|
|
||||||
/* signature (r,s) = (4,4), which can be recovered with all 4 recids. */
|
|
||||||
const unsigned char sigb64[64] = {
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04,
|
|
||||||
};
|
|
||||||
secp256k1_pubkey pubkeyb;
|
|
||||||
secp256k1_ecdsa_recoverable_signature rsig;
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
int recid;
|
|
||||||
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 0));
|
|
||||||
CHECK(!secp256k1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 1));
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 2));
|
|
||||||
CHECK(!secp256k1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 3));
|
|
||||||
CHECK(!secp256k1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
|
|
||||||
|
|
||||||
for (recid = 0; recid < 4; recid++) {
|
|
||||||
int i;
|
|
||||||
int recid2;
|
|
||||||
/* (4,4) encoded in DER. */
|
|
||||||
unsigned char sigbder[8] = {0x30, 0x06, 0x02, 0x01, 0x04, 0x02, 0x01, 0x04};
|
|
||||||
unsigned char sigcder_zr[7] = {0x30, 0x05, 0x02, 0x00, 0x02, 0x01, 0x01};
|
|
||||||
unsigned char sigcder_zs[7] = {0x30, 0x05, 0x02, 0x01, 0x01, 0x02, 0x00};
|
|
||||||
unsigned char sigbderalt1[39] = {
|
|
||||||
0x30, 0x25, 0x02, 0x20, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x04, 0x02, 0x01, 0x04,
|
|
||||||
};
|
|
||||||
unsigned char sigbderalt2[39] = {
|
|
||||||
0x30, 0x25, 0x02, 0x01, 0x04, 0x02, 0x20, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04,
|
|
||||||
};
|
|
||||||
unsigned char sigbderalt3[40] = {
|
|
||||||
0x30, 0x26, 0x02, 0x21, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x04, 0x02, 0x01, 0x04,
|
|
||||||
};
|
|
||||||
unsigned char sigbderalt4[40] = {
|
|
||||||
0x30, 0x26, 0x02, 0x01, 0x04, 0x02, 0x21, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04,
|
|
||||||
};
|
|
||||||
/* (order + r,4) encoded in DER. */
|
|
||||||
unsigned char sigbderlong[40] = {
|
|
||||||
0x30, 0x26, 0x02, 0x21, 0x00, 0xFF, 0xFF, 0xFF,
|
|
||||||
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
|
|
||||||
0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xBA, 0xAE, 0xDC,
|
|
||||||
0xE6, 0xAF, 0x48, 0xA0, 0x3B, 0xBF, 0xD2, 0x5E,
|
|
||||||
0x8C, 0xD0, 0x36, 0x41, 0x45, 0x02, 0x01, 0x04
|
|
||||||
};
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigb64, recid) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &pubkeyb, &rsig, msg32) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1);
|
|
||||||
for (recid2 = 0; recid2 < 4; recid2++) {
|
|
||||||
secp256k1_pubkey pubkey2b;
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigb64, recid2) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &pubkey2b, &rsig, msg32) == 1);
|
|
||||||
/* Verifying with (order + r,4) should always fail. */
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderlong, sizeof(sigbderlong)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
|
|
||||||
}
|
|
||||||
/* DER parsing tests. */
|
|
||||||
/* Zero length r/s. */
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder_zr, sizeof(sigcder_zr)) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder_zs, sizeof(sigcder_zs)) == 0);
|
|
||||||
/* Leading zeros. */
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt1, sizeof(sigbderalt1)) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt2, sizeof(sigbderalt2)) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt3, sizeof(sigbderalt3)) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt4, sizeof(sigbderalt4)) == 0);
|
|
||||||
sigbderalt3[4] = 1;
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt3, sizeof(sigbderalt3)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
|
|
||||||
sigbderalt4[7] = 1;
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt4, sizeof(sigbderalt4)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
|
|
||||||
/* Damage signature. */
|
|
||||||
sigbder[7]++;
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
|
|
||||||
sigbder[7]--;
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, 6) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder) - 1) == 0);
|
|
||||||
for(i = 0; i < 8; i++) {
|
|
||||||
int c;
|
|
||||||
unsigned char orig = sigbder[i];
|
|
||||||
/*Try every single-byte change.*/
|
|
||||||
for (c = 0; c < 256; c++) {
|
|
||||||
if (c == orig ) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
sigbder[i] = c;
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 0 || secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
|
|
||||||
}
|
|
||||||
sigbder[i] = orig;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Test r/s equal to zero */
|
|
||||||
{
|
|
||||||
/* (1,1) encoded in DER. */
|
|
||||||
unsigned char sigcder[8] = {0x30, 0x06, 0x02, 0x01, 0x01, 0x02, 0x01, 0x01};
|
|
||||||
unsigned char sigc64[64] = {
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
|
|
||||||
};
|
|
||||||
secp256k1_pubkey pubkeyc;
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &pubkeyc, &rsig, msg32) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyc) == 1);
|
|
||||||
sigcder[4] = 0;
|
|
||||||
sigc64[31] = 0;
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &pubkeyb, &rsig, msg32) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyc) == 0);
|
|
||||||
sigcder[4] = 1;
|
|
||||||
sigcder[7] = 0;
|
|
||||||
sigc64[31] = 1;
|
|
||||||
sigc64[63] = 0;
|
|
||||||
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_recover(ctx, &pubkeyb, &rsig, msg32) == 0);
|
|
||||||
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1);
|
|
||||||
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyc) == 0);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void run_recovery_tests(void) {
|
|
||||||
int i;
|
|
||||||
for (i = 0; i < count; i++) {
|
|
||||||
test_ecdsa_recovery_api();
|
|
||||||
}
|
|
||||||
for (i = 0; i < 64*count; i++) {
|
|
||||||
test_ecdsa_recovery_end_to_end();
|
|
||||||
}
|
|
||||||
test_ecdsa_recovery_edge_cases();
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_MODULE_RECOVERY_TESTS_H */
|
|
||||||
@ -1,74 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_NUM_H
|
|
||||||
#define SECP256K1_NUM_H
|
|
||||||
|
|
||||||
#ifndef USE_NUM_NONE
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if defined(USE_NUM_GMP)
|
|
||||||
#include "num_gmp.h"
|
|
||||||
#else
|
|
||||||
#error "Please select num implementation"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Copy a number. */
|
|
||||||
static void secp256k1_num_copy(secp256k1_num *r, const secp256k1_num *a);
|
|
||||||
|
|
||||||
/** Convert a number's absolute value to a binary big-endian string.
|
|
||||||
* There must be enough place. */
|
|
||||||
static void secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const secp256k1_num *a);
|
|
||||||
|
|
||||||
/** Set a number to the value of a binary big-endian string. */
|
|
||||||
static void secp256k1_num_set_bin(secp256k1_num *r, const unsigned char *a, unsigned int alen);
|
|
||||||
|
|
||||||
/** Compute a modular inverse. The input must be less than the modulus. */
|
|
||||||
static void secp256k1_num_mod_inverse(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *m);
|
|
||||||
|
|
||||||
/** Compute the jacobi symbol (a|b). b must be positive and odd. */
|
|
||||||
static int secp256k1_num_jacobi(const secp256k1_num *a, const secp256k1_num *b);
|
|
||||||
|
|
||||||
/** Compare the absolute value of two numbers. */
|
|
||||||
static int secp256k1_num_cmp(const secp256k1_num *a, const secp256k1_num *b);
|
|
||||||
|
|
||||||
/** Test whether two number are equal (including sign). */
|
|
||||||
static int secp256k1_num_eq(const secp256k1_num *a, const secp256k1_num *b);
|
|
||||||
|
|
||||||
/** Add two (signed) numbers. */
|
|
||||||
static void secp256k1_num_add(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b);
|
|
||||||
|
|
||||||
/** Subtract two (signed) numbers. */
|
|
||||||
static void secp256k1_num_sub(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b);
|
|
||||||
|
|
||||||
/** Multiply two (signed) numbers. */
|
|
||||||
static void secp256k1_num_mul(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b);
|
|
||||||
|
|
||||||
/** Replace a number by its remainder modulo m. M's sign is ignored. The result is a number between 0 and m-1,
|
|
||||||
even if r was negative. */
|
|
||||||
static void secp256k1_num_mod(secp256k1_num *r, const secp256k1_num *m);
|
|
||||||
|
|
||||||
/** Right-shift the passed number by bits bits. */
|
|
||||||
static void secp256k1_num_shift(secp256k1_num *r, int bits);
|
|
||||||
|
|
||||||
/** Check whether a number is zero. */
|
|
||||||
static int secp256k1_num_is_zero(const secp256k1_num *a);
|
|
||||||
|
|
||||||
/** Check whether a number is one. */
|
|
||||||
static int secp256k1_num_is_one(const secp256k1_num *a);
|
|
||||||
|
|
||||||
/** Check whether a number is strictly negative. */
|
|
||||||
static int secp256k1_num_is_neg(const secp256k1_num *a);
|
|
||||||
|
|
||||||
/** Change a number's sign. */
|
|
||||||
static void secp256k1_num_negate(secp256k1_num *r);
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_NUM_H */
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_NUM_REPR_H
|
|
||||||
#define SECP256K1_NUM_REPR_H
|
|
||||||
|
|
||||||
#include <gmp.h>
|
|
||||||
|
|
||||||
#define NUM_LIMBS ((256+GMP_NUMB_BITS-1)/GMP_NUMB_BITS)
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
mp_limb_t data[2*NUM_LIMBS];
|
|
||||||
int neg;
|
|
||||||
int limbs;
|
|
||||||
} secp256k1_num;
|
|
||||||
|
|
||||||
#endif /* SECP256K1_NUM_REPR_H */
|
|
||||||
@ -1,288 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_NUM_REPR_IMPL_H
|
|
||||||
#define SECP256K1_NUM_REPR_IMPL_H
|
|
||||||
|
|
||||||
#include <string.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <gmp.h>
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "num.h"
|
|
||||||
|
|
||||||
#ifdef VERIFY
|
|
||||||
static void secp256k1_num_sanity(const secp256k1_num *a) {
|
|
||||||
VERIFY_CHECK(a->limbs == 1 || (a->limbs > 1 && a->data[a->limbs-1] != 0));
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
#define secp256k1_num_sanity(a) do { } while(0)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void secp256k1_num_copy(secp256k1_num *r, const secp256k1_num *a) {
|
|
||||||
*r = *a;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const secp256k1_num *a) {
|
|
||||||
unsigned char tmp[65];
|
|
||||||
int len = 0;
|
|
||||||
int shift = 0;
|
|
||||||
if (a->limbs>1 || a->data[0] != 0) {
|
|
||||||
len = mpn_get_str(tmp, 256, (mp_limb_t*)a->data, a->limbs);
|
|
||||||
}
|
|
||||||
while (shift < len && tmp[shift] == 0) shift++;
|
|
||||||
VERIFY_CHECK(len-shift <= (int)rlen);
|
|
||||||
memset(r, 0, rlen - len + shift);
|
|
||||||
if (len > shift) {
|
|
||||||
memcpy(r + rlen - len + shift, tmp + shift, len - shift);
|
|
||||||
}
|
|
||||||
memset(tmp, 0, sizeof(tmp));
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_set_bin(secp256k1_num *r, const unsigned char *a, unsigned int alen) {
|
|
||||||
int len;
|
|
||||||
VERIFY_CHECK(alen > 0);
|
|
||||||
VERIFY_CHECK(alen <= 64);
|
|
||||||
len = mpn_set_str(r->data, a, alen, 256);
|
|
||||||
if (len == 0) {
|
|
||||||
r->data[0] = 0;
|
|
||||||
len = 1;
|
|
||||||
}
|
|
||||||
VERIFY_CHECK(len <= NUM_LIMBS*2);
|
|
||||||
r->limbs = len;
|
|
||||||
r->neg = 0;
|
|
||||||
while (r->limbs > 1 && r->data[r->limbs-1]==0) {
|
|
||||||
r->limbs--;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_add_abs(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
mp_limb_t c = mpn_add(r->data, a->data, a->limbs, b->data, b->limbs);
|
|
||||||
r->limbs = a->limbs;
|
|
||||||
if (c != 0) {
|
|
||||||
VERIFY_CHECK(r->limbs < 2*NUM_LIMBS);
|
|
||||||
r->data[r->limbs++] = c;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_sub_abs(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
mp_limb_t c = mpn_sub(r->data, a->data, a->limbs, b->data, b->limbs);
|
|
||||||
(void)c;
|
|
||||||
VERIFY_CHECK(c == 0);
|
|
||||||
r->limbs = a->limbs;
|
|
||||||
while (r->limbs > 1 && r->data[r->limbs-1]==0) {
|
|
||||||
r->limbs--;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_mod(secp256k1_num *r, const secp256k1_num *m) {
|
|
||||||
secp256k1_num_sanity(r);
|
|
||||||
secp256k1_num_sanity(m);
|
|
||||||
|
|
||||||
if (r->limbs >= m->limbs) {
|
|
||||||
mp_limb_t t[2*NUM_LIMBS];
|
|
||||||
mpn_tdiv_qr(t, r->data, 0, r->data, r->limbs, m->data, m->limbs);
|
|
||||||
memset(t, 0, sizeof(t));
|
|
||||||
r->limbs = m->limbs;
|
|
||||||
while (r->limbs > 1 && r->data[r->limbs-1]==0) {
|
|
||||||
r->limbs--;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (r->neg && (r->limbs > 1 || r->data[0] != 0)) {
|
|
||||||
secp256k1_num_sub_abs(r, m, r);
|
|
||||||
r->neg = 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_mod_inverse(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *m) {
|
|
||||||
int i;
|
|
||||||
mp_limb_t g[NUM_LIMBS+1];
|
|
||||||
mp_limb_t u[NUM_LIMBS+1];
|
|
||||||
mp_limb_t v[NUM_LIMBS+1];
|
|
||||||
mp_size_t sn;
|
|
||||||
mp_size_t gn;
|
|
||||||
secp256k1_num_sanity(a);
|
|
||||||
secp256k1_num_sanity(m);
|
|
||||||
|
|
||||||
/** mpn_gcdext computes: (G,S) = gcdext(U,V), where
|
|
||||||
* * G = gcd(U,V)
|
|
||||||
* * G = U*S + V*T
|
|
||||||
* * U has equal or more limbs than V, and V has no padding
|
|
||||||
* If we set U to be (a padded version of) a, and V = m:
|
|
||||||
* G = a*S + m*T
|
|
||||||
* G = a*S mod m
|
|
||||||
* Assuming G=1:
|
|
||||||
* S = 1/a mod m
|
|
||||||
*/
|
|
||||||
VERIFY_CHECK(m->limbs <= NUM_LIMBS);
|
|
||||||
VERIFY_CHECK(m->data[m->limbs-1] != 0);
|
|
||||||
for (i = 0; i < m->limbs; i++) {
|
|
||||||
u[i] = (i < a->limbs) ? a->data[i] : 0;
|
|
||||||
v[i] = m->data[i];
|
|
||||||
}
|
|
||||||
sn = NUM_LIMBS+1;
|
|
||||||
gn = mpn_gcdext(g, r->data, &sn, u, m->limbs, v, m->limbs);
|
|
||||||
(void)gn;
|
|
||||||
VERIFY_CHECK(gn == 1);
|
|
||||||
VERIFY_CHECK(g[0] == 1);
|
|
||||||
r->neg = a->neg ^ m->neg;
|
|
||||||
if (sn < 0) {
|
|
||||||
mpn_sub(r->data, m->data, m->limbs, r->data, -sn);
|
|
||||||
r->limbs = m->limbs;
|
|
||||||
while (r->limbs > 1 && r->data[r->limbs-1]==0) {
|
|
||||||
r->limbs--;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
r->limbs = sn;
|
|
||||||
}
|
|
||||||
memset(g, 0, sizeof(g));
|
|
||||||
memset(u, 0, sizeof(u));
|
|
||||||
memset(v, 0, sizeof(v));
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_num_jacobi(const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
int ret;
|
|
||||||
mpz_t ga, gb;
|
|
||||||
secp256k1_num_sanity(a);
|
|
||||||
secp256k1_num_sanity(b);
|
|
||||||
VERIFY_CHECK(!b->neg && (b->limbs > 0) && (b->data[0] & 1));
|
|
||||||
|
|
||||||
mpz_inits(ga, gb, NULL);
|
|
||||||
|
|
||||||
mpz_import(gb, b->limbs, -1, sizeof(mp_limb_t), 0, 0, b->data);
|
|
||||||
mpz_import(ga, a->limbs, -1, sizeof(mp_limb_t), 0, 0, a->data);
|
|
||||||
if (a->neg) {
|
|
||||||
mpz_neg(ga, ga);
|
|
||||||
}
|
|
||||||
|
|
||||||
ret = mpz_jacobi(ga, gb);
|
|
||||||
|
|
||||||
mpz_clears(ga, gb, NULL);
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_num_is_one(const secp256k1_num *a) {
|
|
||||||
return (a->limbs == 1 && a->data[0] == 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_num_is_zero(const secp256k1_num *a) {
|
|
||||||
return (a->limbs == 1 && a->data[0] == 0);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_num_is_neg(const secp256k1_num *a) {
|
|
||||||
return (a->limbs > 1 || a->data[0] != 0) && a->neg;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_num_cmp(const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
if (a->limbs > b->limbs) {
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
if (a->limbs < b->limbs) {
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
return mpn_cmp(a->data, b->data, a->limbs);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_num_eq(const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
if (a->limbs > b->limbs) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (a->limbs < b->limbs) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if ((a->neg && !secp256k1_num_is_zero(a)) != (b->neg && !secp256k1_num_is_zero(b))) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
return mpn_cmp(a->data, b->data, a->limbs) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_subadd(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b, int bneg) {
|
|
||||||
if (!(b->neg ^ bneg ^ a->neg)) { /* a and b have the same sign */
|
|
||||||
r->neg = a->neg;
|
|
||||||
if (a->limbs >= b->limbs) {
|
|
||||||
secp256k1_num_add_abs(r, a, b);
|
|
||||||
} else {
|
|
||||||
secp256k1_num_add_abs(r, b, a);
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
if (secp256k1_num_cmp(a, b) > 0) {
|
|
||||||
r->neg = a->neg;
|
|
||||||
secp256k1_num_sub_abs(r, a, b);
|
|
||||||
} else {
|
|
||||||
r->neg = b->neg ^ bneg;
|
|
||||||
secp256k1_num_sub_abs(r, b, a);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_add(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
secp256k1_num_sanity(a);
|
|
||||||
secp256k1_num_sanity(b);
|
|
||||||
secp256k1_num_subadd(r, a, b, 0);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_sub(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
secp256k1_num_sanity(a);
|
|
||||||
secp256k1_num_sanity(b);
|
|
||||||
secp256k1_num_subadd(r, a, b, 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_mul(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
|
|
||||||
mp_limb_t tmp[2*NUM_LIMBS+1];
|
|
||||||
secp256k1_num_sanity(a);
|
|
||||||
secp256k1_num_sanity(b);
|
|
||||||
|
|
||||||
VERIFY_CHECK(a->limbs + b->limbs <= 2*NUM_LIMBS+1);
|
|
||||||
if ((a->limbs==1 && a->data[0]==0) || (b->limbs==1 && b->data[0]==0)) {
|
|
||||||
r->limbs = 1;
|
|
||||||
r->neg = 0;
|
|
||||||
r->data[0] = 0;
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (a->limbs >= b->limbs) {
|
|
||||||
mpn_mul(tmp, a->data, a->limbs, b->data, b->limbs);
|
|
||||||
} else {
|
|
||||||
mpn_mul(tmp, b->data, b->limbs, a->data, a->limbs);
|
|
||||||
}
|
|
||||||
r->limbs = a->limbs + b->limbs;
|
|
||||||
if (r->limbs > 1 && tmp[r->limbs - 1]==0) {
|
|
||||||
r->limbs--;
|
|
||||||
}
|
|
||||||
VERIFY_CHECK(r->limbs <= 2*NUM_LIMBS);
|
|
||||||
mpn_copyi(r->data, tmp, r->limbs);
|
|
||||||
r->neg = a->neg ^ b->neg;
|
|
||||||
memset(tmp, 0, sizeof(tmp));
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_shift(secp256k1_num *r, int bits) {
|
|
||||||
if (bits % GMP_NUMB_BITS) {
|
|
||||||
/* Shift within limbs. */
|
|
||||||
mpn_rshift(r->data, r->data, r->limbs, bits % GMP_NUMB_BITS);
|
|
||||||
}
|
|
||||||
if (bits >= GMP_NUMB_BITS) {
|
|
||||||
int i;
|
|
||||||
/* Shift full limbs. */
|
|
||||||
for (i = 0; i < r->limbs; i++) {
|
|
||||||
int index = i + (bits / GMP_NUMB_BITS);
|
|
||||||
if (index < r->limbs && index < 2*NUM_LIMBS) {
|
|
||||||
r->data[i] = r->data[index];
|
|
||||||
} else {
|
|
||||||
r->data[i] = 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
while (r->limbs>1 && r->data[r->limbs-1]==0) {
|
|
||||||
r->limbs--;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_num_negate(secp256k1_num *r) {
|
|
||||||
r->neg ^= 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_NUM_REPR_IMPL_H */
|
|
||||||
@ -1,24 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_NUM_IMPL_H
|
|
||||||
#define SECP256K1_NUM_IMPL_H
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include "num.h"
|
|
||||||
|
|
||||||
#if defined(USE_NUM_GMP)
|
|
||||||
#include "num_gmp_impl.h"
|
|
||||||
#elif defined(USE_NUM_NONE)
|
|
||||||
/* Nothing. */
|
|
||||||
#else
|
|
||||||
#error "Please select num implementation"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_NUM_IMPL_H */
|
|
||||||
@ -1,106 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_H
|
|
||||||
#define SECP256K1_SCALAR_H
|
|
||||||
|
|
||||||
#include "num.h"
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
#include "scalar_low.h"
|
|
||||||
#elif defined(USE_SCALAR_4X64)
|
|
||||||
#include "scalar_4x64.h"
|
|
||||||
#elif defined(USE_SCALAR_8X32)
|
|
||||||
#include "scalar_8x32.h"
|
|
||||||
#else
|
|
||||||
#error "Please select scalar implementation"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Clear a scalar to prevent the leak of sensitive data. */
|
|
||||||
static void secp256k1_scalar_clear(secp256k1_scalar *r);
|
|
||||||
|
|
||||||
/** Access bits from a scalar. All requested bits must belong to the same 32-bit limb. */
|
|
||||||
static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count);
|
|
||||||
|
|
||||||
/** Access bits from a scalar. Not constant time. */
|
|
||||||
static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count);
|
|
||||||
|
|
||||||
/** Set a scalar from a big endian byte array. */
|
|
||||||
static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *bin, int *overflow);
|
|
||||||
|
|
||||||
/** Set a scalar to an unsigned integer. */
|
|
||||||
static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v);
|
|
||||||
|
|
||||||
/** Convert a scalar to a byte array. */
|
|
||||||
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a);
|
|
||||||
|
|
||||||
/** Add two scalars together (modulo the group order). Returns whether it overflowed. */
|
|
||||||
static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b);
|
|
||||||
|
|
||||||
/** Conditionally add a power of two to a scalar. The result is not allowed to overflow. */
|
|
||||||
static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag);
|
|
||||||
|
|
||||||
/** Multiply two scalars (modulo the group order). */
|
|
||||||
static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b);
|
|
||||||
|
|
||||||
/** Shift a scalar right by some amount strictly between 0 and 16, returning
|
|
||||||
* the low bits that were shifted off */
|
|
||||||
static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n);
|
|
||||||
|
|
||||||
/** Compute the square of a scalar (modulo the group order). */
|
|
||||||
static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Compute the inverse of a scalar (modulo the group order). */
|
|
||||||
static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Compute the inverse of a scalar (modulo the group order), without constant-time guarantee. */
|
|
||||||
static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Compute the complement of a scalar (modulo the group order). */
|
|
||||||
static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Check whether a scalar equals zero. */
|
|
||||||
static int secp256k1_scalar_is_zero(const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Check whether a scalar equals one. */
|
|
||||||
static int secp256k1_scalar_is_one(const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Check whether a scalar, considered as an nonnegative integer, is even. */
|
|
||||||
static int secp256k1_scalar_is_even(const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Check whether a scalar is higher than the group order divided by 2. */
|
|
||||||
static int secp256k1_scalar_is_high(const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Conditionally negate a number, in constant time.
|
|
||||||
* Returns -1 if the number was negated, 1 otherwise */
|
|
||||||
static int secp256k1_scalar_cond_negate(secp256k1_scalar *a, int flag);
|
|
||||||
|
|
||||||
#ifndef USE_NUM_NONE
|
|
||||||
/** Convert a scalar to a number. */
|
|
||||||
static void secp256k1_scalar_get_num(secp256k1_num *r, const secp256k1_scalar *a);
|
|
||||||
|
|
||||||
/** Get the order of the group as a number. */
|
|
||||||
static void secp256k1_scalar_order_get_num(secp256k1_num *r);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Compare two scalars. */
|
|
||||||
static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b);
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
/** Find r1 and r2 such that r1+r2*2^128 = a. */
|
|
||||||
static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a);
|
|
||||||
/** Find r1 and r2 such that r1+r2*lambda = a, and r1 and r2 are maximum 128 bits long (see secp256k1_gej_mul_lambda). */
|
|
||||||
static void secp256k1_scalar_split_lambda(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** Multiply a and b (without taking the modulus!), divide by 2**shift, and round to the nearest integer. Shift must be at least 256. */
|
|
||||||
static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_H */
|
|
||||||
@ -1,19 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_REPR_H
|
|
||||||
#define SECP256K1_SCALAR_REPR_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
|
|
||||||
/** A scalar modulo the group order of the secp256k1 curve. */
|
|
||||||
typedef struct {
|
|
||||||
uint64_t d[4];
|
|
||||||
} secp256k1_scalar;
|
|
||||||
|
|
||||||
#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_REPR_H */
|
|
||||||
@ -1,949 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_REPR_IMPL_H
|
|
||||||
#define SECP256K1_SCALAR_REPR_IMPL_H
|
|
||||||
|
|
||||||
/* Limbs of the secp256k1 order. */
|
|
||||||
#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
|
|
||||||
#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
|
|
||||||
#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
|
|
||||||
#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
|
|
||||||
|
|
||||||
/* Limbs of 2^256 minus the secp256k1 order. */
|
|
||||||
#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
|
|
||||||
#define SECP256K1_N_C_1 (~SECP256K1_N_1)
|
|
||||||
#define SECP256K1_N_C_2 (1)
|
|
||||||
|
|
||||||
/* Limbs of half the secp256k1 order. */
|
|
||||||
#define SECP256K1_N_H_0 ((uint64_t)0xDFE92F46681B20A0ULL)
|
|
||||||
#define SECP256K1_N_H_1 ((uint64_t)0x5D576E7357A4501DULL)
|
|
||||||
#define SECP256K1_N_H_2 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
|
|
||||||
#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) {
|
|
||||||
r->d[0] = 0;
|
|
||||||
r->d[1] = 0;
|
|
||||||
r->d[2] = 0;
|
|
||||||
r->d[3] = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v) {
|
|
||||||
r->d[0] = v;
|
|
||||||
r->d[1] = 0;
|
|
||||||
r->d[2] = 0;
|
|
||||||
r->d[3] = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
|
|
||||||
VERIFY_CHECK((offset + count - 1) >> 6 == offset >> 6);
|
|
||||||
return (a->d[offset >> 6] >> (offset & 0x3F)) & ((((uint64_t)1) << count) - 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
|
|
||||||
VERIFY_CHECK(count < 32);
|
|
||||||
VERIFY_CHECK(offset + count <= 256);
|
|
||||||
if ((offset + count - 1) >> 6 == offset >> 6) {
|
|
||||||
return secp256k1_scalar_get_bits(a, offset, count);
|
|
||||||
} else {
|
|
||||||
VERIFY_CHECK((offset >> 6) + 1 < 4);
|
|
||||||
return ((a->d[offset >> 6] >> (offset & 0x3F)) | (a->d[(offset >> 6) + 1] << (64 - (offset & 0x3F)))) & ((((uint64_t)1) << count) - 1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) {
|
|
||||||
int yes = 0;
|
|
||||||
int no = 0;
|
|
||||||
no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */
|
|
||||||
no |= (a->d[2] < SECP256K1_N_2);
|
|
||||||
yes |= (a->d[2] > SECP256K1_N_2) & ~no;
|
|
||||||
no |= (a->d[1] < SECP256K1_N_1);
|
|
||||||
yes |= (a->d[1] > SECP256K1_N_1) & ~no;
|
|
||||||
yes |= (a->d[0] >= SECP256K1_N_0) & ~no;
|
|
||||||
return yes;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, unsigned int overflow) {
|
|
||||||
uint128_t t;
|
|
||||||
VERIFY_CHECK(overflow <= 1);
|
|
||||||
t = (uint128_t)r->d[0] + overflow * SECP256K1_N_C_0;
|
|
||||||
r->d[0] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)r->d[1] + overflow * SECP256K1_N_C_1;
|
|
||||||
r->d[1] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)r->d[2] + overflow * SECP256K1_N_C_2;
|
|
||||||
r->d[2] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint64_t)r->d[3];
|
|
||||||
r->d[3] = t & 0xFFFFFFFFFFFFFFFFULL;
|
|
||||||
return overflow;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
int overflow;
|
|
||||||
uint128_t t = (uint128_t)a->d[0] + b->d[0];
|
|
||||||
r->d[0] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)a->d[1] + b->d[1];
|
|
||||||
r->d[1] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)a->d[2] + b->d[2];
|
|
||||||
r->d[2] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)a->d[3] + b->d[3];
|
|
||||||
r->d[3] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
overflow = t + secp256k1_scalar_check_overflow(r);
|
|
||||||
VERIFY_CHECK(overflow == 0 || overflow == 1);
|
|
||||||
secp256k1_scalar_reduce(r, overflow);
|
|
||||||
return overflow;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
|
|
||||||
uint128_t t;
|
|
||||||
VERIFY_CHECK(bit < 256);
|
|
||||||
bit += ((uint32_t) flag - 1) & 0x100; /* forcing (bit >> 6) > 3 makes this a noop */
|
|
||||||
t = (uint128_t)r->d[0] + (((uint64_t)((bit >> 6) == 0)) << (bit & 0x3F));
|
|
||||||
r->d[0] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)r->d[1] + (((uint64_t)((bit >> 6) == 1)) << (bit & 0x3F));
|
|
||||||
r->d[1] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)r->d[2] + (((uint64_t)((bit >> 6) == 2)) << (bit & 0x3F));
|
|
||||||
r->d[2] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
|
|
||||||
t += (uint128_t)r->d[3] + (((uint64_t)((bit >> 6) == 3)) << (bit & 0x3F));
|
|
||||||
r->d[3] = t & 0xFFFFFFFFFFFFFFFFULL;
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK((t >> 64) == 0);
|
|
||||||
VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
|
|
||||||
int over;
|
|
||||||
r->d[0] = (uint64_t)b32[31] | (uint64_t)b32[30] << 8 | (uint64_t)b32[29] << 16 | (uint64_t)b32[28] << 24 | (uint64_t)b32[27] << 32 | (uint64_t)b32[26] << 40 | (uint64_t)b32[25] << 48 | (uint64_t)b32[24] << 56;
|
|
||||||
r->d[1] = (uint64_t)b32[23] | (uint64_t)b32[22] << 8 | (uint64_t)b32[21] << 16 | (uint64_t)b32[20] << 24 | (uint64_t)b32[19] << 32 | (uint64_t)b32[18] << 40 | (uint64_t)b32[17] << 48 | (uint64_t)b32[16] << 56;
|
|
||||||
r->d[2] = (uint64_t)b32[15] | (uint64_t)b32[14] << 8 | (uint64_t)b32[13] << 16 | (uint64_t)b32[12] << 24 | (uint64_t)b32[11] << 32 | (uint64_t)b32[10] << 40 | (uint64_t)b32[9] << 48 | (uint64_t)b32[8] << 56;
|
|
||||||
r->d[3] = (uint64_t)b32[7] | (uint64_t)b32[6] << 8 | (uint64_t)b32[5] << 16 | (uint64_t)b32[4] << 24 | (uint64_t)b32[3] << 32 | (uint64_t)b32[2] << 40 | (uint64_t)b32[1] << 48 | (uint64_t)b32[0] << 56;
|
|
||||||
over = secp256k1_scalar_reduce(r, secp256k1_scalar_check_overflow(r));
|
|
||||||
if (overflow) {
|
|
||||||
*overflow = over;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
|
|
||||||
bin[0] = a->d[3] >> 56; bin[1] = a->d[3] >> 48; bin[2] = a->d[3] >> 40; bin[3] = a->d[3] >> 32; bin[4] = a->d[3] >> 24; bin[5] = a->d[3] >> 16; bin[6] = a->d[3] >> 8; bin[7] = a->d[3];
|
|
||||||
bin[8] = a->d[2] >> 56; bin[9] = a->d[2] >> 48; bin[10] = a->d[2] >> 40; bin[11] = a->d[2] >> 32; bin[12] = a->d[2] >> 24; bin[13] = a->d[2] >> 16; bin[14] = a->d[2] >> 8; bin[15] = a->d[2];
|
|
||||||
bin[16] = a->d[1] >> 56; bin[17] = a->d[1] >> 48; bin[18] = a->d[1] >> 40; bin[19] = a->d[1] >> 32; bin[20] = a->d[1] >> 24; bin[21] = a->d[1] >> 16; bin[22] = a->d[1] >> 8; bin[23] = a->d[1];
|
|
||||||
bin[24] = a->d[0] >> 56; bin[25] = a->d[0] >> 48; bin[26] = a->d[0] >> 40; bin[27] = a->d[0] >> 32; bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0];
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
|
|
||||||
return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
|
|
||||||
uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (secp256k1_scalar_is_zero(a) == 0);
|
|
||||||
uint128_t t = (uint128_t)(~a->d[0]) + SECP256K1_N_0 + 1;
|
|
||||||
r->d[0] = t & nonzero; t >>= 64;
|
|
||||||
t += (uint128_t)(~a->d[1]) + SECP256K1_N_1;
|
|
||||||
r->d[1] = t & nonzero; t >>= 64;
|
|
||||||
t += (uint128_t)(~a->d[2]) + SECP256K1_N_2;
|
|
||||||
r->d[2] = t & nonzero; t >>= 64;
|
|
||||||
t += (uint128_t)(~a->d[3]) + SECP256K1_N_3;
|
|
||||||
r->d[3] = t & nonzero;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
|
|
||||||
return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3]) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
|
|
||||||
int yes = 0;
|
|
||||||
int no = 0;
|
|
||||||
no |= (a->d[3] < SECP256K1_N_H_3);
|
|
||||||
yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
|
|
||||||
no |= (a->d[2] < SECP256K1_N_H_2) & ~yes; /* No need for a > check. */
|
|
||||||
no |= (a->d[1] < SECP256K1_N_H_1) & ~yes;
|
|
||||||
yes |= (a->d[1] > SECP256K1_N_H_1) & ~no;
|
|
||||||
yes |= (a->d[0] > SECP256K1_N_H_0) & ~no;
|
|
||||||
return yes;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
|
|
||||||
/* If we are flag = 0, mask = 00...00 and this is a no-op;
|
|
||||||
* if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */
|
|
||||||
uint64_t mask = !flag - 1;
|
|
||||||
uint64_t nonzero = (secp256k1_scalar_is_zero(r) != 0) - 1;
|
|
||||||
uint128_t t = (uint128_t)(r->d[0] ^ mask) + ((SECP256K1_N_0 + 1) & mask);
|
|
||||||
r->d[0] = t & nonzero; t >>= 64;
|
|
||||||
t += (uint128_t)(r->d[1] ^ mask) + (SECP256K1_N_1 & mask);
|
|
||||||
r->d[1] = t & nonzero; t >>= 64;
|
|
||||||
t += (uint128_t)(r->d[2] ^ mask) + (SECP256K1_N_2 & mask);
|
|
||||||
r->d[2] = t & nonzero; t >>= 64;
|
|
||||||
t += (uint128_t)(r->d[3] ^ mask) + (SECP256K1_N_3 & mask);
|
|
||||||
r->d[3] = t & nonzero;
|
|
||||||
return 2 * (mask == 0) - 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Inspired by the macros in OpenSSL's crypto/bn/asm/x86_64-gcc.c. */
|
|
||||||
|
|
||||||
/** Add a*b to the number defined by (c0,c1,c2). c2 must never overflow. */
|
|
||||||
#define muladd(a,b) { \
|
|
||||||
uint64_t tl, th; \
|
|
||||||
{ \
|
|
||||||
uint128_t t = (uint128_t)a * b; \
|
|
||||||
th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
|
|
||||||
tl = t; \
|
|
||||||
} \
|
|
||||||
c0 += tl; /* overflow is handled on the next line */ \
|
|
||||||
th += (c0 < tl) ? 1 : 0; /* at most 0xFFFFFFFFFFFFFFFF */ \
|
|
||||||
c1 += th; /* overflow is handled on the next line */ \
|
|
||||||
c2 += (c1 < th) ? 1 : 0; /* never overflows by contract (verified in the next line) */ \
|
|
||||||
VERIFY_CHECK((c1 >= th) || (c2 != 0)); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add a*b to the number defined by (c0,c1). c1 must never overflow. */
|
|
||||||
#define muladd_fast(a,b) { \
|
|
||||||
uint64_t tl, th; \
|
|
||||||
{ \
|
|
||||||
uint128_t t = (uint128_t)a * b; \
|
|
||||||
th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
|
|
||||||
tl = t; \
|
|
||||||
} \
|
|
||||||
c0 += tl; /* overflow is handled on the next line */ \
|
|
||||||
th += (c0 < tl) ? 1 : 0; /* at most 0xFFFFFFFFFFFFFFFF */ \
|
|
||||||
c1 += th; /* never overflows by contract (verified in the next line) */ \
|
|
||||||
VERIFY_CHECK(c1 >= th); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add 2*a*b to the number defined by (c0,c1,c2). c2 must never overflow. */
|
|
||||||
#define muladd2(a,b) { \
|
|
||||||
uint64_t tl, th, th2, tl2; \
|
|
||||||
{ \
|
|
||||||
uint128_t t = (uint128_t)a * b; \
|
|
||||||
th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
|
|
||||||
tl = t; \
|
|
||||||
} \
|
|
||||||
th2 = th + th; /* at most 0xFFFFFFFFFFFFFFFE (in case th was 0x7FFFFFFFFFFFFFFF) */ \
|
|
||||||
c2 += (th2 < th) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((th2 >= th) || (c2 != 0)); \
|
|
||||||
tl2 = tl + tl; /* at most 0xFFFFFFFFFFFFFFFE (in case the lowest 63 bits of tl were 0x7FFFFFFFFFFFFFFF) */ \
|
|
||||||
th2 += (tl2 < tl) ? 1 : 0; /* at most 0xFFFFFFFFFFFFFFFF */ \
|
|
||||||
c0 += tl2; /* overflow is handled on the next line */ \
|
|
||||||
th2 += (c0 < tl2) ? 1 : 0; /* second overflow is handled on the next line */ \
|
|
||||||
c2 += (c0 < tl2) & (th2 == 0); /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((c0 >= tl2) || (th2 != 0) || (c2 != 0)); \
|
|
||||||
c1 += th2; /* overflow is handled on the next line */ \
|
|
||||||
c2 += (c1 < th2) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((c1 >= th2) || (c2 != 0)); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add a to the number defined by (c0,c1,c2). c2 must never overflow. */
|
|
||||||
#define sumadd(a) { \
|
|
||||||
unsigned int over; \
|
|
||||||
c0 += (a); /* overflow is handled on the next line */ \
|
|
||||||
over = (c0 < (a)) ? 1 : 0; \
|
|
||||||
c1 += over; /* overflow is handled on the next line */ \
|
|
||||||
c2 += (c1 < over) ? 1 : 0; /* never overflows by contract */ \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add a to the number defined by (c0,c1). c1 must never overflow, c2 must be zero. */
|
|
||||||
#define sumadd_fast(a) { \
|
|
||||||
c0 += (a); /* overflow is handled on the next line */ \
|
|
||||||
c1 += (c0 < (a)) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((c1 != 0) | (c0 >= (a))); \
|
|
||||||
VERIFY_CHECK(c2 == 0); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Extract the lowest 64 bits of (c0,c1,c2) into n, and left shift the number 64 bits. */
|
|
||||||
#define extract(n) { \
|
|
||||||
(n) = c0; \
|
|
||||||
c0 = c1; \
|
|
||||||
c1 = c2; \
|
|
||||||
c2 = 0; \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Extract the lowest 64 bits of (c0,c1,c2) into n, and left shift the number 64 bits. c2 is required to be zero. */
|
|
||||||
#define extract_fast(n) { \
|
|
||||||
(n) = c0; \
|
|
||||||
c0 = c1; \
|
|
||||||
c1 = 0; \
|
|
||||||
VERIFY_CHECK(c2 == 0); \
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_reduce_512(secp256k1_scalar *r, const uint64_t *l) {
|
|
||||||
#ifdef USE_ASM_X86_64
|
|
||||||
/* Reduce 512 bits into 385. */
|
|
||||||
uint64_t m0, m1, m2, m3, m4, m5, m6;
|
|
||||||
uint64_t p0, p1, p2, p3, p4;
|
|
||||||
uint64_t c;
|
|
||||||
|
|
||||||
__asm__ __volatile__(
|
|
||||||
/* Preload. */
|
|
||||||
"movq 32(%%rsi), %%r11\n"
|
|
||||||
"movq 40(%%rsi), %%r12\n"
|
|
||||||
"movq 48(%%rsi), %%r13\n"
|
|
||||||
"movq 56(%%rsi), %%r14\n"
|
|
||||||
/* Initialize r8,r9,r10 */
|
|
||||||
"movq 0(%%rsi), %%r8\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
"xorq %%r10, %%r10\n"
|
|
||||||
/* (r8,r9) += n0 * c0 */
|
|
||||||
"movq %8, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
/* extract m0 */
|
|
||||||
"movq %%r8, %q0\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r10) += l1 */
|
|
||||||
"addq 8(%%rsi), %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r9,r10,r8) += n1 * c0 */
|
|
||||||
"movq %8, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += n0 * c1 */
|
|
||||||
"movq %9, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* extract m1 */
|
|
||||||
"movq %%r9, %q1\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += l2 */
|
|
||||||
"addq 16(%%rsi), %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += n2 * c0 */
|
|
||||||
"movq %8, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += n1 * c1 */
|
|
||||||
"movq %9, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += n0 */
|
|
||||||
"addq %%r11, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* extract m2 */
|
|
||||||
"movq %%r10, %q2\n"
|
|
||||||
"xorq %%r10, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += l3 */
|
|
||||||
"addq 24(%%rsi), %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += n3 * c0 */
|
|
||||||
"movq %8, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += n2 * c1 */
|
|
||||||
"movq %9, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += n1 */
|
|
||||||
"addq %%r12, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* extract m3 */
|
|
||||||
"movq %%r8, %q3\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += n3 * c1 */
|
|
||||||
"movq %9, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += n2 */
|
|
||||||
"addq %%r13, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* extract m4 */
|
|
||||||
"movq %%r9, %q4\n"
|
|
||||||
/* (r10,r8) += n3 */
|
|
||||||
"addq %%r14, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* extract m5 */
|
|
||||||
"movq %%r10, %q5\n"
|
|
||||||
/* extract m6 */
|
|
||||||
"movq %%r8, %q6\n"
|
|
||||||
: "=g"(m0), "=g"(m1), "=g"(m2), "=g"(m3), "=g"(m4), "=g"(m5), "=g"(m6)
|
|
||||||
: "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
|
|
||||||
: "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc");
|
|
||||||
|
|
||||||
/* Reduce 385 bits into 258. */
|
|
||||||
__asm__ __volatile__(
|
|
||||||
/* Preload */
|
|
||||||
"movq %q9, %%r11\n"
|
|
||||||
"movq %q10, %%r12\n"
|
|
||||||
"movq %q11, %%r13\n"
|
|
||||||
/* Initialize (r8,r9,r10) */
|
|
||||||
"movq %q5, %%r8\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
"xorq %%r10, %%r10\n"
|
|
||||||
/* (r8,r9) += m4 * c0 */
|
|
||||||
"movq %12, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
/* extract p0 */
|
|
||||||
"movq %%r8, %q0\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r10) += m1 */
|
|
||||||
"addq %q6, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r9,r10,r8) += m5 * c0 */
|
|
||||||
"movq %12, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += m4 * c1 */
|
|
||||||
"movq %13, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* extract p1 */
|
|
||||||
"movq %%r9, %q1\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += m2 */
|
|
||||||
"addq %q7, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += m6 * c0 */
|
|
||||||
"movq %12, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += m5 * c1 */
|
|
||||||
"movq %13, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += m4 */
|
|
||||||
"addq %%r11, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* extract p2 */
|
|
||||||
"movq %%r10, %q2\n"
|
|
||||||
/* (r8,r9) += m3 */
|
|
||||||
"addq %q8, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r8,r9) += m6 * c1 */
|
|
||||||
"movq %13, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
/* (r8,r9) += m5 */
|
|
||||||
"addq %%r12, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* extract p3 */
|
|
||||||
"movq %%r8, %q3\n"
|
|
||||||
/* (r9) += m6 */
|
|
||||||
"addq %%r13, %%r9\n"
|
|
||||||
/* extract p4 */
|
|
||||||
"movq %%r9, %q4\n"
|
|
||||||
: "=&g"(p0), "=&g"(p1), "=&g"(p2), "=g"(p3), "=g"(p4)
|
|
||||||
: "g"(m0), "g"(m1), "g"(m2), "g"(m3), "g"(m4), "g"(m5), "g"(m6), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
|
|
||||||
: "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc");
|
|
||||||
|
|
||||||
/* Reduce 258 bits into 256. */
|
|
||||||
__asm__ __volatile__(
|
|
||||||
/* Preload */
|
|
||||||
"movq %q5, %%r10\n"
|
|
||||||
/* (rax,rdx) = p4 * c0 */
|
|
||||||
"movq %7, %%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
/* (rax,rdx) += p0 */
|
|
||||||
"addq %q1, %%rax\n"
|
|
||||||
"adcq $0, %%rdx\n"
|
|
||||||
/* extract r0 */
|
|
||||||
"movq %%rax, 0(%q6)\n"
|
|
||||||
/* Move to (r8,r9) */
|
|
||||||
"movq %%rdx, %%r8\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
/* (r8,r9) += p1 */
|
|
||||||
"addq %q2, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r8,r9) += p4 * c1 */
|
|
||||||
"movq %8, %%rax\n"
|
|
||||||
"mulq %%r10\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
/* Extract r1 */
|
|
||||||
"movq %%r8, 8(%q6)\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r8) += p4 */
|
|
||||||
"addq %%r10, %%r9\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r8) += p2 */
|
|
||||||
"addq %q3, %%r9\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* Extract r2 */
|
|
||||||
"movq %%r9, 16(%q6)\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
/* (r8,r9) += p3 */
|
|
||||||
"addq %q4, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* Extract r3 */
|
|
||||||
"movq %%r8, 24(%q6)\n"
|
|
||||||
/* Extract c */
|
|
||||||
"movq %%r9, %q0\n"
|
|
||||||
: "=g"(c)
|
|
||||||
: "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
|
|
||||||
: "rax", "rdx", "r8", "r9", "r10", "cc", "memory");
|
|
||||||
#else
|
|
||||||
uint128_t c;
|
|
||||||
uint64_t c0, c1, c2;
|
|
||||||
uint64_t n0 = l[4], n1 = l[5], n2 = l[6], n3 = l[7];
|
|
||||||
uint64_t m0, m1, m2, m3, m4, m5;
|
|
||||||
uint32_t m6;
|
|
||||||
uint64_t p0, p1, p2, p3;
|
|
||||||
uint32_t p4;
|
|
||||||
|
|
||||||
/* Reduce 512 bits into 385. */
|
|
||||||
/* m[0..6] = l[0..3] + n[0..3] * SECP256K1_N_C. */
|
|
||||||
c0 = l[0]; c1 = 0; c2 = 0;
|
|
||||||
muladd_fast(n0, SECP256K1_N_C_0);
|
|
||||||
extract_fast(m0);
|
|
||||||
sumadd_fast(l[1]);
|
|
||||||
muladd(n1, SECP256K1_N_C_0);
|
|
||||||
muladd(n0, SECP256K1_N_C_1);
|
|
||||||
extract(m1);
|
|
||||||
sumadd(l[2]);
|
|
||||||
muladd(n2, SECP256K1_N_C_0);
|
|
||||||
muladd(n1, SECP256K1_N_C_1);
|
|
||||||
sumadd(n0);
|
|
||||||
extract(m2);
|
|
||||||
sumadd(l[3]);
|
|
||||||
muladd(n3, SECP256K1_N_C_0);
|
|
||||||
muladd(n2, SECP256K1_N_C_1);
|
|
||||||
sumadd(n1);
|
|
||||||
extract(m3);
|
|
||||||
muladd(n3, SECP256K1_N_C_1);
|
|
||||||
sumadd(n2);
|
|
||||||
extract(m4);
|
|
||||||
sumadd_fast(n3);
|
|
||||||
extract_fast(m5);
|
|
||||||
VERIFY_CHECK(c0 <= 1);
|
|
||||||
m6 = c0;
|
|
||||||
|
|
||||||
/* Reduce 385 bits into 258. */
|
|
||||||
/* p[0..4] = m[0..3] + m[4..6] * SECP256K1_N_C. */
|
|
||||||
c0 = m0; c1 = 0; c2 = 0;
|
|
||||||
muladd_fast(m4, SECP256K1_N_C_0);
|
|
||||||
extract_fast(p0);
|
|
||||||
sumadd_fast(m1);
|
|
||||||
muladd(m5, SECP256K1_N_C_0);
|
|
||||||
muladd(m4, SECP256K1_N_C_1);
|
|
||||||
extract(p1);
|
|
||||||
sumadd(m2);
|
|
||||||
muladd(m6, SECP256K1_N_C_0);
|
|
||||||
muladd(m5, SECP256K1_N_C_1);
|
|
||||||
sumadd(m4);
|
|
||||||
extract(p2);
|
|
||||||
sumadd_fast(m3);
|
|
||||||
muladd_fast(m6, SECP256K1_N_C_1);
|
|
||||||
sumadd_fast(m5);
|
|
||||||
extract_fast(p3);
|
|
||||||
p4 = c0 + m6;
|
|
||||||
VERIFY_CHECK(p4 <= 2);
|
|
||||||
|
|
||||||
/* Reduce 258 bits into 256. */
|
|
||||||
/* r[0..3] = p[0..3] + p[4] * SECP256K1_N_C. */
|
|
||||||
c = p0 + (uint128_t)SECP256K1_N_C_0 * p4;
|
|
||||||
r->d[0] = c & 0xFFFFFFFFFFFFFFFFULL; c >>= 64;
|
|
||||||
c += p1 + (uint128_t)SECP256K1_N_C_1 * p4;
|
|
||||||
r->d[1] = c & 0xFFFFFFFFFFFFFFFFULL; c >>= 64;
|
|
||||||
c += p2 + (uint128_t)p4;
|
|
||||||
r->d[2] = c & 0xFFFFFFFFFFFFFFFFULL; c >>= 64;
|
|
||||||
c += p3;
|
|
||||||
r->d[3] = c & 0xFFFFFFFFFFFFFFFFULL; c >>= 64;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Final reduction of r. */
|
|
||||||
secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_mul_512(uint64_t l[8], const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
#ifdef USE_ASM_X86_64
|
|
||||||
const uint64_t *pb = b->d;
|
|
||||||
__asm__ __volatile__(
|
|
||||||
/* Preload */
|
|
||||||
"movq 0(%%rdi), %%r15\n"
|
|
||||||
"movq 8(%%rdi), %%rbx\n"
|
|
||||||
"movq 16(%%rdi), %%rcx\n"
|
|
||||||
"movq 0(%%rdx), %%r11\n"
|
|
||||||
"movq 8(%%rdx), %%r12\n"
|
|
||||||
"movq 16(%%rdx), %%r13\n"
|
|
||||||
"movq 24(%%rdx), %%r14\n"
|
|
||||||
/* (rax,rdx) = a0 * b0 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
/* Extract l0 */
|
|
||||||
"movq %%rax, 0(%%rsi)\n"
|
|
||||||
/* (r8,r9,r10) = (rdx) */
|
|
||||||
"movq %%rdx, %%r8\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
"xorq %%r10, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += a0 * b1 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += a1 * b0 */
|
|
||||||
"movq %%rbx, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* Extract l1 */
|
|
||||||
"movq %%r8, 8(%%rsi)\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += a0 * b2 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += a1 * b1 */
|
|
||||||
"movq %%rbx, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += a2 * b0 */
|
|
||||||
"movq %%rcx, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* Extract l2 */
|
|
||||||
"movq %%r9, 16(%%rsi)\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += a0 * b3 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* Preload a3 */
|
|
||||||
"movq 24(%%rdi), %%r15\n"
|
|
||||||
/* (r10,r8,r9) += a1 * b2 */
|
|
||||||
"movq %%rbx, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += a2 * b1 */
|
|
||||||
"movq %%rcx, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += a3 * b0 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* Extract l3 */
|
|
||||||
"movq %%r10, 24(%%rsi)\n"
|
|
||||||
"xorq %%r10, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += a1 * b3 */
|
|
||||||
"movq %%rbx, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += a2 * b2 */
|
|
||||||
"movq %%rcx, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += a3 * b1 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* Extract l4 */
|
|
||||||
"movq %%r8, 32(%%rsi)\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += a2 * b3 */
|
|
||||||
"movq %%rcx, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += a3 * b2 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* Extract l5 */
|
|
||||||
"movq %%r9, 40(%%rsi)\n"
|
|
||||||
/* (r10,r8) += a3 * b3 */
|
|
||||||
"movq %%r15, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
/* Extract l6 */
|
|
||||||
"movq %%r10, 48(%%rsi)\n"
|
|
||||||
/* Extract l7 */
|
|
||||||
"movq %%r8, 56(%%rsi)\n"
|
|
||||||
: "+d"(pb)
|
|
||||||
: "S"(l), "D"(a->d)
|
|
||||||
: "rax", "rbx", "rcx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory");
|
|
||||||
#else
|
|
||||||
/* 160 bit accumulator. */
|
|
||||||
uint64_t c0 = 0, c1 = 0;
|
|
||||||
uint32_t c2 = 0;
|
|
||||||
|
|
||||||
/* l[0..7] = a[0..3] * b[0..3]. */
|
|
||||||
muladd_fast(a->d[0], b->d[0]);
|
|
||||||
extract_fast(l[0]);
|
|
||||||
muladd(a->d[0], b->d[1]);
|
|
||||||
muladd(a->d[1], b->d[0]);
|
|
||||||
extract(l[1]);
|
|
||||||
muladd(a->d[0], b->d[2]);
|
|
||||||
muladd(a->d[1], b->d[1]);
|
|
||||||
muladd(a->d[2], b->d[0]);
|
|
||||||
extract(l[2]);
|
|
||||||
muladd(a->d[0], b->d[3]);
|
|
||||||
muladd(a->d[1], b->d[2]);
|
|
||||||
muladd(a->d[2], b->d[1]);
|
|
||||||
muladd(a->d[3], b->d[0]);
|
|
||||||
extract(l[3]);
|
|
||||||
muladd(a->d[1], b->d[3]);
|
|
||||||
muladd(a->d[2], b->d[2]);
|
|
||||||
muladd(a->d[3], b->d[1]);
|
|
||||||
extract(l[4]);
|
|
||||||
muladd(a->d[2], b->d[3]);
|
|
||||||
muladd(a->d[3], b->d[2]);
|
|
||||||
extract(l[5]);
|
|
||||||
muladd_fast(a->d[3], b->d[3]);
|
|
||||||
extract_fast(l[6]);
|
|
||||||
VERIFY_CHECK(c1 == 0);
|
|
||||||
l[7] = c0;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
|
|
||||||
#ifdef USE_ASM_X86_64
|
|
||||||
__asm__ __volatile__(
|
|
||||||
/* Preload */
|
|
||||||
"movq 0(%%rdi), %%r11\n"
|
|
||||||
"movq 8(%%rdi), %%r12\n"
|
|
||||||
"movq 16(%%rdi), %%r13\n"
|
|
||||||
"movq 24(%%rdi), %%r14\n"
|
|
||||||
/* (rax,rdx) = a0 * a0 */
|
|
||||||
"movq %%r11, %%rax\n"
|
|
||||||
"mulq %%r11\n"
|
|
||||||
/* Extract l0 */
|
|
||||||
"movq %%rax, 0(%%rsi)\n"
|
|
||||||
/* (r8,r9,r10) = (rdx,0) */
|
|
||||||
"movq %%rdx, %%r8\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
"xorq %%r10, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += 2 * a0 * a1 */
|
|
||||||
"movq %%r11, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* Extract l1 */
|
|
||||||
"movq %%r8, 8(%%rsi)\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += 2 * a0 * a2 */
|
|
||||||
"movq %%r11, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += a1 * a1 */
|
|
||||||
"movq %%r12, %%rax\n"
|
|
||||||
"mulq %%r12\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* Extract l2 */
|
|
||||||
"movq %%r9, 16(%%rsi)\n"
|
|
||||||
"xorq %%r9, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += 2 * a0 * a3 */
|
|
||||||
"movq %%r11, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* (r10,r8,r9) += 2 * a1 * a2 */
|
|
||||||
"movq %%r12, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
"adcq $0, %%r9\n"
|
|
||||||
/* Extract l3 */
|
|
||||||
"movq %%r10, 24(%%rsi)\n"
|
|
||||||
"xorq %%r10, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += 2 * a1 * a3 */
|
|
||||||
"movq %%r12, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* (r8,r9,r10) += a2 * a2 */
|
|
||||||
"movq %%r13, %%rax\n"
|
|
||||||
"mulq %%r13\n"
|
|
||||||
"addq %%rax, %%r8\n"
|
|
||||||
"adcq %%rdx, %%r9\n"
|
|
||||||
"adcq $0, %%r10\n"
|
|
||||||
/* Extract l4 */
|
|
||||||
"movq %%r8, 32(%%rsi)\n"
|
|
||||||
"xorq %%r8, %%r8\n"
|
|
||||||
/* (r9,r10,r8) += 2 * a2 * a3 */
|
|
||||||
"movq %%r13, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
"addq %%rax, %%r9\n"
|
|
||||||
"adcq %%rdx, %%r10\n"
|
|
||||||
"adcq $0, %%r8\n"
|
|
||||||
/* Extract l5 */
|
|
||||||
"movq %%r9, 40(%%rsi)\n"
|
|
||||||
/* (r10,r8) += a3 * a3 */
|
|
||||||
"movq %%r14, %%rax\n"
|
|
||||||
"mulq %%r14\n"
|
|
||||||
"addq %%rax, %%r10\n"
|
|
||||||
"adcq %%rdx, %%r8\n"
|
|
||||||
/* Extract l6 */
|
|
||||||
"movq %%r10, 48(%%rsi)\n"
|
|
||||||
/* Extract l7 */
|
|
||||||
"movq %%r8, 56(%%rsi)\n"
|
|
||||||
:
|
|
||||||
: "S"(l), "D"(a->d)
|
|
||||||
: "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc", "memory");
|
|
||||||
#else
|
|
||||||
/* 160 bit accumulator. */
|
|
||||||
uint64_t c0 = 0, c1 = 0;
|
|
||||||
uint32_t c2 = 0;
|
|
||||||
|
|
||||||
/* l[0..7] = a[0..3] * b[0..3]. */
|
|
||||||
muladd_fast(a->d[0], a->d[0]);
|
|
||||||
extract_fast(l[0]);
|
|
||||||
muladd2(a->d[0], a->d[1]);
|
|
||||||
extract(l[1]);
|
|
||||||
muladd2(a->d[0], a->d[2]);
|
|
||||||
muladd(a->d[1], a->d[1]);
|
|
||||||
extract(l[2]);
|
|
||||||
muladd2(a->d[0], a->d[3]);
|
|
||||||
muladd2(a->d[1], a->d[2]);
|
|
||||||
extract(l[3]);
|
|
||||||
muladd2(a->d[1], a->d[3]);
|
|
||||||
muladd(a->d[2], a->d[2]);
|
|
||||||
extract(l[4]);
|
|
||||||
muladd2(a->d[2], a->d[3]);
|
|
||||||
extract(l[5]);
|
|
||||||
muladd_fast(a->d[3], a->d[3]);
|
|
||||||
extract_fast(l[6]);
|
|
||||||
VERIFY_CHECK(c1 == 0);
|
|
||||||
l[7] = c0;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
#undef sumadd
|
|
||||||
#undef sumadd_fast
|
|
||||||
#undef muladd
|
|
||||||
#undef muladd_fast
|
|
||||||
#undef muladd2
|
|
||||||
#undef extract
|
|
||||||
#undef extract_fast
|
|
||||||
|
|
||||||
static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
uint64_t l[8];
|
|
||||||
secp256k1_scalar_mul_512(l, a, b);
|
|
||||||
secp256k1_scalar_reduce_512(r, l);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
|
|
||||||
int ret;
|
|
||||||
VERIFY_CHECK(n > 0);
|
|
||||||
VERIFY_CHECK(n < 16);
|
|
||||||
ret = r->d[0] & ((1 << n) - 1);
|
|
||||||
r->d[0] = (r->d[0] >> n) + (r->d[1] << (64 - n));
|
|
||||||
r->d[1] = (r->d[1] >> n) + (r->d[2] << (64 - n));
|
|
||||||
r->d[2] = (r->d[2] >> n) + (r->d[3] << (64 - n));
|
|
||||||
r->d[3] = (r->d[3] >> n);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a) {
|
|
||||||
uint64_t l[8];
|
|
||||||
secp256k1_scalar_sqr_512(l, a);
|
|
||||||
secp256k1_scalar_reduce_512(r, l);
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
|
|
||||||
r1->d[0] = a->d[0];
|
|
||||||
r1->d[1] = a->d[1];
|
|
||||||
r1->d[2] = 0;
|
|
||||||
r1->d[3] = 0;
|
|
||||||
r2->d[0] = a->d[2];
|
|
||||||
r2->d[1] = a->d[3];
|
|
||||||
r2->d[2] = 0;
|
|
||||||
r2->d[3] = 0;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3])) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift) {
|
|
||||||
uint64_t l[8];
|
|
||||||
unsigned int shiftlimbs;
|
|
||||||
unsigned int shiftlow;
|
|
||||||
unsigned int shifthigh;
|
|
||||||
VERIFY_CHECK(shift >= 256);
|
|
||||||
secp256k1_scalar_mul_512(l, a, b);
|
|
||||||
shiftlimbs = shift >> 6;
|
|
||||||
shiftlow = shift & 0x3F;
|
|
||||||
shifthigh = 64 - shiftlow;
|
|
||||||
r->d[0] = shift < 512 ? (l[0 + shiftlimbs] >> shiftlow | (shift < 448 && shiftlow ? (l[1 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[1] = shift < 448 ? (l[1 + shiftlimbs] >> shiftlow | (shift < 384 && shiftlow ? (l[2 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[2] = shift < 384 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[3] = shift < 320 ? (l[3 + shiftlimbs] >> shiftlow) : 0;
|
|
||||||
secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_REPR_IMPL_H */
|
|
||||||
@ -1,19 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_REPR_H
|
|
||||||
#define SECP256K1_SCALAR_REPR_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
|
|
||||||
/** A scalar modulo the group order of the secp256k1 curve. */
|
|
||||||
typedef struct {
|
|
||||||
uint32_t d[8];
|
|
||||||
} secp256k1_scalar;
|
|
||||||
|
|
||||||
#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{(d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7)}}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_REPR_H */
|
|
||||||
@ -1,721 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_REPR_IMPL_H
|
|
||||||
#define SECP256K1_SCALAR_REPR_IMPL_H
|
|
||||||
|
|
||||||
/* Limbs of the secp256k1 order. */
|
|
||||||
#define SECP256K1_N_0 ((uint32_t)0xD0364141UL)
|
|
||||||
#define SECP256K1_N_1 ((uint32_t)0xBFD25E8CUL)
|
|
||||||
#define SECP256K1_N_2 ((uint32_t)0xAF48A03BUL)
|
|
||||||
#define SECP256K1_N_3 ((uint32_t)0xBAAEDCE6UL)
|
|
||||||
#define SECP256K1_N_4 ((uint32_t)0xFFFFFFFEUL)
|
|
||||||
#define SECP256K1_N_5 ((uint32_t)0xFFFFFFFFUL)
|
|
||||||
#define SECP256K1_N_6 ((uint32_t)0xFFFFFFFFUL)
|
|
||||||
#define SECP256K1_N_7 ((uint32_t)0xFFFFFFFFUL)
|
|
||||||
|
|
||||||
/* Limbs of 2^256 minus the secp256k1 order. */
|
|
||||||
#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
|
|
||||||
#define SECP256K1_N_C_1 (~SECP256K1_N_1)
|
|
||||||
#define SECP256K1_N_C_2 (~SECP256K1_N_2)
|
|
||||||
#define SECP256K1_N_C_3 (~SECP256K1_N_3)
|
|
||||||
#define SECP256K1_N_C_4 (1)
|
|
||||||
|
|
||||||
/* Limbs of half the secp256k1 order. */
|
|
||||||
#define SECP256K1_N_H_0 ((uint32_t)0x681B20A0UL)
|
|
||||||
#define SECP256K1_N_H_1 ((uint32_t)0xDFE92F46UL)
|
|
||||||
#define SECP256K1_N_H_2 ((uint32_t)0x57A4501DUL)
|
|
||||||
#define SECP256K1_N_H_3 ((uint32_t)0x5D576E73UL)
|
|
||||||
#define SECP256K1_N_H_4 ((uint32_t)0xFFFFFFFFUL)
|
|
||||||
#define SECP256K1_N_H_5 ((uint32_t)0xFFFFFFFFUL)
|
|
||||||
#define SECP256K1_N_H_6 ((uint32_t)0xFFFFFFFFUL)
|
|
||||||
#define SECP256K1_N_H_7 ((uint32_t)0x7FFFFFFFUL)
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) {
|
|
||||||
r->d[0] = 0;
|
|
||||||
r->d[1] = 0;
|
|
||||||
r->d[2] = 0;
|
|
||||||
r->d[3] = 0;
|
|
||||||
r->d[4] = 0;
|
|
||||||
r->d[5] = 0;
|
|
||||||
r->d[6] = 0;
|
|
||||||
r->d[7] = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v) {
|
|
||||||
r->d[0] = v;
|
|
||||||
r->d[1] = 0;
|
|
||||||
r->d[2] = 0;
|
|
||||||
r->d[3] = 0;
|
|
||||||
r->d[4] = 0;
|
|
||||||
r->d[5] = 0;
|
|
||||||
r->d[6] = 0;
|
|
||||||
r->d[7] = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
|
|
||||||
VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5);
|
|
||||||
return (a->d[offset >> 5] >> (offset & 0x1F)) & ((1 << count) - 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
|
|
||||||
VERIFY_CHECK(count < 32);
|
|
||||||
VERIFY_CHECK(offset + count <= 256);
|
|
||||||
if ((offset + count - 1) >> 5 == offset >> 5) {
|
|
||||||
return secp256k1_scalar_get_bits(a, offset, count);
|
|
||||||
} else {
|
|
||||||
VERIFY_CHECK((offset >> 5) + 1 < 8);
|
|
||||||
return ((a->d[offset >> 5] >> (offset & 0x1F)) | (a->d[(offset >> 5) + 1] << (32 - (offset & 0x1F)))) & ((((uint32_t)1) << count) - 1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) {
|
|
||||||
int yes = 0;
|
|
||||||
int no = 0;
|
|
||||||
no |= (a->d[7] < SECP256K1_N_7); /* No need for a > check. */
|
|
||||||
no |= (a->d[6] < SECP256K1_N_6); /* No need for a > check. */
|
|
||||||
no |= (a->d[5] < SECP256K1_N_5); /* No need for a > check. */
|
|
||||||
no |= (a->d[4] < SECP256K1_N_4);
|
|
||||||
yes |= (a->d[4] > SECP256K1_N_4) & ~no;
|
|
||||||
no |= (a->d[3] < SECP256K1_N_3) & ~yes;
|
|
||||||
yes |= (a->d[3] > SECP256K1_N_3) & ~no;
|
|
||||||
no |= (a->d[2] < SECP256K1_N_2) & ~yes;
|
|
||||||
yes |= (a->d[2] > SECP256K1_N_2) & ~no;
|
|
||||||
no |= (a->d[1] < SECP256K1_N_1) & ~yes;
|
|
||||||
yes |= (a->d[1] > SECP256K1_N_1) & ~no;
|
|
||||||
yes |= (a->d[0] >= SECP256K1_N_0) & ~no;
|
|
||||||
return yes;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, uint32_t overflow) {
|
|
||||||
uint64_t t;
|
|
||||||
VERIFY_CHECK(overflow <= 1);
|
|
||||||
t = (uint64_t)r->d[0] + overflow * SECP256K1_N_C_0;
|
|
||||||
r->d[0] = t & 0xFFFFFFFFUL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[1] + overflow * SECP256K1_N_C_1;
|
|
||||||
r->d[1] = t & 0xFFFFFFFFUL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[2] + overflow * SECP256K1_N_C_2;
|
|
||||||
r->d[2] = t & 0xFFFFFFFFUL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[3] + overflow * SECP256K1_N_C_3;
|
|
||||||
r->d[3] = t & 0xFFFFFFFFUL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[4] + overflow * SECP256K1_N_C_4;
|
|
||||||
r->d[4] = t & 0xFFFFFFFFUL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[5];
|
|
||||||
r->d[5] = t & 0xFFFFFFFFUL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[6];
|
|
||||||
r->d[6] = t & 0xFFFFFFFFUL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[7];
|
|
||||||
r->d[7] = t & 0xFFFFFFFFUL;
|
|
||||||
return overflow;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
int overflow;
|
|
||||||
uint64_t t = (uint64_t)a->d[0] + b->d[0];
|
|
||||||
r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)a->d[1] + b->d[1];
|
|
||||||
r->d[1] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)a->d[2] + b->d[2];
|
|
||||||
r->d[2] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)a->d[3] + b->d[3];
|
|
||||||
r->d[3] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)a->d[4] + b->d[4];
|
|
||||||
r->d[4] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)a->d[5] + b->d[5];
|
|
||||||
r->d[5] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)a->d[6] + b->d[6];
|
|
||||||
r->d[6] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)a->d[7] + b->d[7];
|
|
||||||
r->d[7] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
overflow = t + secp256k1_scalar_check_overflow(r);
|
|
||||||
VERIFY_CHECK(overflow == 0 || overflow == 1);
|
|
||||||
secp256k1_scalar_reduce(r, overflow);
|
|
||||||
return overflow;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
|
|
||||||
uint64_t t;
|
|
||||||
VERIFY_CHECK(bit < 256);
|
|
||||||
bit += ((uint32_t) flag - 1) & 0x100; /* forcing (bit >> 5) > 7 makes this a noop */
|
|
||||||
t = (uint64_t)r->d[0] + (((uint32_t)((bit >> 5) == 0)) << (bit & 0x1F));
|
|
||||||
r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[1] + (((uint32_t)((bit >> 5) == 1)) << (bit & 0x1F));
|
|
||||||
r->d[1] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[2] + (((uint32_t)((bit >> 5) == 2)) << (bit & 0x1F));
|
|
||||||
r->d[2] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[3] + (((uint32_t)((bit >> 5) == 3)) << (bit & 0x1F));
|
|
||||||
r->d[3] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[4] + (((uint32_t)((bit >> 5) == 4)) << (bit & 0x1F));
|
|
||||||
r->d[4] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[5] + (((uint32_t)((bit >> 5) == 5)) << (bit & 0x1F));
|
|
||||||
r->d[5] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[6] + (((uint32_t)((bit >> 5) == 6)) << (bit & 0x1F));
|
|
||||||
r->d[6] = t & 0xFFFFFFFFULL; t >>= 32;
|
|
||||||
t += (uint64_t)r->d[7] + (((uint32_t)((bit >> 5) == 7)) << (bit & 0x1F));
|
|
||||||
r->d[7] = t & 0xFFFFFFFFULL;
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK((t >> 32) == 0);
|
|
||||||
VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
|
|
||||||
int over;
|
|
||||||
r->d[0] = (uint32_t)b32[31] | (uint32_t)b32[30] << 8 | (uint32_t)b32[29] << 16 | (uint32_t)b32[28] << 24;
|
|
||||||
r->d[1] = (uint32_t)b32[27] | (uint32_t)b32[26] << 8 | (uint32_t)b32[25] << 16 | (uint32_t)b32[24] << 24;
|
|
||||||
r->d[2] = (uint32_t)b32[23] | (uint32_t)b32[22] << 8 | (uint32_t)b32[21] << 16 | (uint32_t)b32[20] << 24;
|
|
||||||
r->d[3] = (uint32_t)b32[19] | (uint32_t)b32[18] << 8 | (uint32_t)b32[17] << 16 | (uint32_t)b32[16] << 24;
|
|
||||||
r->d[4] = (uint32_t)b32[15] | (uint32_t)b32[14] << 8 | (uint32_t)b32[13] << 16 | (uint32_t)b32[12] << 24;
|
|
||||||
r->d[5] = (uint32_t)b32[11] | (uint32_t)b32[10] << 8 | (uint32_t)b32[9] << 16 | (uint32_t)b32[8] << 24;
|
|
||||||
r->d[6] = (uint32_t)b32[7] | (uint32_t)b32[6] << 8 | (uint32_t)b32[5] << 16 | (uint32_t)b32[4] << 24;
|
|
||||||
r->d[7] = (uint32_t)b32[3] | (uint32_t)b32[2] << 8 | (uint32_t)b32[1] << 16 | (uint32_t)b32[0] << 24;
|
|
||||||
over = secp256k1_scalar_reduce(r, secp256k1_scalar_check_overflow(r));
|
|
||||||
if (overflow) {
|
|
||||||
*overflow = over;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
|
|
||||||
bin[0] = a->d[7] >> 24; bin[1] = a->d[7] >> 16; bin[2] = a->d[7] >> 8; bin[3] = a->d[7];
|
|
||||||
bin[4] = a->d[6] >> 24; bin[5] = a->d[6] >> 16; bin[6] = a->d[6] >> 8; bin[7] = a->d[6];
|
|
||||||
bin[8] = a->d[5] >> 24; bin[9] = a->d[5] >> 16; bin[10] = a->d[5] >> 8; bin[11] = a->d[5];
|
|
||||||
bin[12] = a->d[4] >> 24; bin[13] = a->d[4] >> 16; bin[14] = a->d[4] >> 8; bin[15] = a->d[4];
|
|
||||||
bin[16] = a->d[3] >> 24; bin[17] = a->d[3] >> 16; bin[18] = a->d[3] >> 8; bin[19] = a->d[3];
|
|
||||||
bin[20] = a->d[2] >> 24; bin[21] = a->d[2] >> 16; bin[22] = a->d[2] >> 8; bin[23] = a->d[2];
|
|
||||||
bin[24] = a->d[1] >> 24; bin[25] = a->d[1] >> 16; bin[26] = a->d[1] >> 8; bin[27] = a->d[1];
|
|
||||||
bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0];
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
|
|
||||||
return (a->d[0] | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
|
|
||||||
uint32_t nonzero = 0xFFFFFFFFUL * (secp256k1_scalar_is_zero(a) == 0);
|
|
||||||
uint64_t t = (uint64_t)(~a->d[0]) + SECP256K1_N_0 + 1;
|
|
||||||
r->d[0] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(~a->d[1]) + SECP256K1_N_1;
|
|
||||||
r->d[1] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(~a->d[2]) + SECP256K1_N_2;
|
|
||||||
r->d[2] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(~a->d[3]) + SECP256K1_N_3;
|
|
||||||
r->d[3] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(~a->d[4]) + SECP256K1_N_4;
|
|
||||||
r->d[4] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(~a->d[5]) + SECP256K1_N_5;
|
|
||||||
r->d[5] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(~a->d[6]) + SECP256K1_N_6;
|
|
||||||
r->d[6] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(~a->d[7]) + SECP256K1_N_7;
|
|
||||||
r->d[7] = t & nonzero;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
|
|
||||||
return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
|
|
||||||
int yes = 0;
|
|
||||||
int no = 0;
|
|
||||||
no |= (a->d[7] < SECP256K1_N_H_7);
|
|
||||||
yes |= (a->d[7] > SECP256K1_N_H_7) & ~no;
|
|
||||||
no |= (a->d[6] < SECP256K1_N_H_6) & ~yes; /* No need for a > check. */
|
|
||||||
no |= (a->d[5] < SECP256K1_N_H_5) & ~yes; /* No need for a > check. */
|
|
||||||
no |= (a->d[4] < SECP256K1_N_H_4) & ~yes; /* No need for a > check. */
|
|
||||||
no |= (a->d[3] < SECP256K1_N_H_3) & ~yes;
|
|
||||||
yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
|
|
||||||
no |= (a->d[2] < SECP256K1_N_H_2) & ~yes;
|
|
||||||
yes |= (a->d[2] > SECP256K1_N_H_2) & ~no;
|
|
||||||
no |= (a->d[1] < SECP256K1_N_H_1) & ~yes;
|
|
||||||
yes |= (a->d[1] > SECP256K1_N_H_1) & ~no;
|
|
||||||
yes |= (a->d[0] > SECP256K1_N_H_0) & ~no;
|
|
||||||
return yes;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
|
|
||||||
/* If we are flag = 0, mask = 00...00 and this is a no-op;
|
|
||||||
* if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */
|
|
||||||
uint32_t mask = !flag - 1;
|
|
||||||
uint32_t nonzero = 0xFFFFFFFFUL * (secp256k1_scalar_is_zero(r) == 0);
|
|
||||||
uint64_t t = (uint64_t)(r->d[0] ^ mask) + ((SECP256K1_N_0 + 1) & mask);
|
|
||||||
r->d[0] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(r->d[1] ^ mask) + (SECP256K1_N_1 & mask);
|
|
||||||
r->d[1] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(r->d[2] ^ mask) + (SECP256K1_N_2 & mask);
|
|
||||||
r->d[2] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(r->d[3] ^ mask) + (SECP256K1_N_3 & mask);
|
|
||||||
r->d[3] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(r->d[4] ^ mask) + (SECP256K1_N_4 & mask);
|
|
||||||
r->d[4] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(r->d[5] ^ mask) + (SECP256K1_N_5 & mask);
|
|
||||||
r->d[5] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(r->d[6] ^ mask) + (SECP256K1_N_6 & mask);
|
|
||||||
r->d[6] = t & nonzero; t >>= 32;
|
|
||||||
t += (uint64_t)(r->d[7] ^ mask) + (SECP256K1_N_7 & mask);
|
|
||||||
r->d[7] = t & nonzero;
|
|
||||||
return 2 * (mask == 0) - 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
/* Inspired by the macros in OpenSSL's crypto/bn/asm/x86_64-gcc.c. */
|
|
||||||
|
|
||||||
/** Add a*b to the number defined by (c0,c1,c2). c2 must never overflow. */
|
|
||||||
#define muladd(a,b) { \
|
|
||||||
uint32_t tl, th; \
|
|
||||||
{ \
|
|
||||||
uint64_t t = (uint64_t)a * b; \
|
|
||||||
th = t >> 32; /* at most 0xFFFFFFFE */ \
|
|
||||||
tl = t; \
|
|
||||||
} \
|
|
||||||
c0 += tl; /* overflow is handled on the next line */ \
|
|
||||||
th += (c0 < tl) ? 1 : 0; /* at most 0xFFFFFFFF */ \
|
|
||||||
c1 += th; /* overflow is handled on the next line */ \
|
|
||||||
c2 += (c1 < th) ? 1 : 0; /* never overflows by contract (verified in the next line) */ \
|
|
||||||
VERIFY_CHECK((c1 >= th) || (c2 != 0)); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add a*b to the number defined by (c0,c1). c1 must never overflow. */
|
|
||||||
#define muladd_fast(a,b) { \
|
|
||||||
uint32_t tl, th; \
|
|
||||||
{ \
|
|
||||||
uint64_t t = (uint64_t)a * b; \
|
|
||||||
th = t >> 32; /* at most 0xFFFFFFFE */ \
|
|
||||||
tl = t; \
|
|
||||||
} \
|
|
||||||
c0 += tl; /* overflow is handled on the next line */ \
|
|
||||||
th += (c0 < tl) ? 1 : 0; /* at most 0xFFFFFFFF */ \
|
|
||||||
c1 += th; /* never overflows by contract (verified in the next line) */ \
|
|
||||||
VERIFY_CHECK(c1 >= th); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add 2*a*b to the number defined by (c0,c1,c2). c2 must never overflow. */
|
|
||||||
#define muladd2(a,b) { \
|
|
||||||
uint32_t tl, th, th2, tl2; \
|
|
||||||
{ \
|
|
||||||
uint64_t t = (uint64_t)a * b; \
|
|
||||||
th = t >> 32; /* at most 0xFFFFFFFE */ \
|
|
||||||
tl = t; \
|
|
||||||
} \
|
|
||||||
th2 = th + th; /* at most 0xFFFFFFFE (in case th was 0x7FFFFFFF) */ \
|
|
||||||
c2 += (th2 < th) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((th2 >= th) || (c2 != 0)); \
|
|
||||||
tl2 = tl + tl; /* at most 0xFFFFFFFE (in case the lowest 63 bits of tl were 0x7FFFFFFF) */ \
|
|
||||||
th2 += (tl2 < tl) ? 1 : 0; /* at most 0xFFFFFFFF */ \
|
|
||||||
c0 += tl2; /* overflow is handled on the next line */ \
|
|
||||||
th2 += (c0 < tl2) ? 1 : 0; /* second overflow is handled on the next line */ \
|
|
||||||
c2 += (c0 < tl2) & (th2 == 0); /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((c0 >= tl2) || (th2 != 0) || (c2 != 0)); \
|
|
||||||
c1 += th2; /* overflow is handled on the next line */ \
|
|
||||||
c2 += (c1 < th2) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((c1 >= th2) || (c2 != 0)); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add a to the number defined by (c0,c1,c2). c2 must never overflow. */
|
|
||||||
#define sumadd(a) { \
|
|
||||||
unsigned int over; \
|
|
||||||
c0 += (a); /* overflow is handled on the next line */ \
|
|
||||||
over = (c0 < (a)) ? 1 : 0; \
|
|
||||||
c1 += over; /* overflow is handled on the next line */ \
|
|
||||||
c2 += (c1 < over) ? 1 : 0; /* never overflows by contract */ \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Add a to the number defined by (c0,c1). c1 must never overflow, c2 must be zero. */
|
|
||||||
#define sumadd_fast(a) { \
|
|
||||||
c0 += (a); /* overflow is handled on the next line */ \
|
|
||||||
c1 += (c0 < (a)) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
|
|
||||||
VERIFY_CHECK((c1 != 0) | (c0 >= (a))); \
|
|
||||||
VERIFY_CHECK(c2 == 0); \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Extract the lowest 32 bits of (c0,c1,c2) into n, and left shift the number 32 bits. */
|
|
||||||
#define extract(n) { \
|
|
||||||
(n) = c0; \
|
|
||||||
c0 = c1; \
|
|
||||||
c1 = c2; \
|
|
||||||
c2 = 0; \
|
|
||||||
}
|
|
||||||
|
|
||||||
/** Extract the lowest 32 bits of (c0,c1,c2) into n, and left shift the number 32 bits. c2 is required to be zero. */
|
|
||||||
#define extract_fast(n) { \
|
|
||||||
(n) = c0; \
|
|
||||||
c0 = c1; \
|
|
||||||
c1 = 0; \
|
|
||||||
VERIFY_CHECK(c2 == 0); \
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_reduce_512(secp256k1_scalar *r, const uint32_t *l) {
|
|
||||||
uint64_t c;
|
|
||||||
uint32_t n0 = l[8], n1 = l[9], n2 = l[10], n3 = l[11], n4 = l[12], n5 = l[13], n6 = l[14], n7 = l[15];
|
|
||||||
uint32_t m0, m1, m2, m3, m4, m5, m6, m7, m8, m9, m10, m11, m12;
|
|
||||||
uint32_t p0, p1, p2, p3, p4, p5, p6, p7, p8;
|
|
||||||
|
|
||||||
/* 96 bit accumulator. */
|
|
||||||
uint32_t c0, c1, c2;
|
|
||||||
|
|
||||||
/* Reduce 512 bits into 385. */
|
|
||||||
/* m[0..12] = l[0..7] + n[0..7] * SECP256K1_N_C. */
|
|
||||||
c0 = l[0]; c1 = 0; c2 = 0;
|
|
||||||
muladd_fast(n0, SECP256K1_N_C_0);
|
|
||||||
extract_fast(m0);
|
|
||||||
sumadd_fast(l[1]);
|
|
||||||
muladd(n1, SECP256K1_N_C_0);
|
|
||||||
muladd(n0, SECP256K1_N_C_1);
|
|
||||||
extract(m1);
|
|
||||||
sumadd(l[2]);
|
|
||||||
muladd(n2, SECP256K1_N_C_0);
|
|
||||||
muladd(n1, SECP256K1_N_C_1);
|
|
||||||
muladd(n0, SECP256K1_N_C_2);
|
|
||||||
extract(m2);
|
|
||||||
sumadd(l[3]);
|
|
||||||
muladd(n3, SECP256K1_N_C_0);
|
|
||||||
muladd(n2, SECP256K1_N_C_1);
|
|
||||||
muladd(n1, SECP256K1_N_C_2);
|
|
||||||
muladd(n0, SECP256K1_N_C_3);
|
|
||||||
extract(m3);
|
|
||||||
sumadd(l[4]);
|
|
||||||
muladd(n4, SECP256K1_N_C_0);
|
|
||||||
muladd(n3, SECP256K1_N_C_1);
|
|
||||||
muladd(n2, SECP256K1_N_C_2);
|
|
||||||
muladd(n1, SECP256K1_N_C_3);
|
|
||||||
sumadd(n0);
|
|
||||||
extract(m4);
|
|
||||||
sumadd(l[5]);
|
|
||||||
muladd(n5, SECP256K1_N_C_0);
|
|
||||||
muladd(n4, SECP256K1_N_C_1);
|
|
||||||
muladd(n3, SECP256K1_N_C_2);
|
|
||||||
muladd(n2, SECP256K1_N_C_3);
|
|
||||||
sumadd(n1);
|
|
||||||
extract(m5);
|
|
||||||
sumadd(l[6]);
|
|
||||||
muladd(n6, SECP256K1_N_C_0);
|
|
||||||
muladd(n5, SECP256K1_N_C_1);
|
|
||||||
muladd(n4, SECP256K1_N_C_2);
|
|
||||||
muladd(n3, SECP256K1_N_C_3);
|
|
||||||
sumadd(n2);
|
|
||||||
extract(m6);
|
|
||||||
sumadd(l[7]);
|
|
||||||
muladd(n7, SECP256K1_N_C_0);
|
|
||||||
muladd(n6, SECP256K1_N_C_1);
|
|
||||||
muladd(n5, SECP256K1_N_C_2);
|
|
||||||
muladd(n4, SECP256K1_N_C_3);
|
|
||||||
sumadd(n3);
|
|
||||||
extract(m7);
|
|
||||||
muladd(n7, SECP256K1_N_C_1);
|
|
||||||
muladd(n6, SECP256K1_N_C_2);
|
|
||||||
muladd(n5, SECP256K1_N_C_3);
|
|
||||||
sumadd(n4);
|
|
||||||
extract(m8);
|
|
||||||
muladd(n7, SECP256K1_N_C_2);
|
|
||||||
muladd(n6, SECP256K1_N_C_3);
|
|
||||||
sumadd(n5);
|
|
||||||
extract(m9);
|
|
||||||
muladd(n7, SECP256K1_N_C_3);
|
|
||||||
sumadd(n6);
|
|
||||||
extract(m10);
|
|
||||||
sumadd_fast(n7);
|
|
||||||
extract_fast(m11);
|
|
||||||
VERIFY_CHECK(c0 <= 1);
|
|
||||||
m12 = c0;
|
|
||||||
|
|
||||||
/* Reduce 385 bits into 258. */
|
|
||||||
/* p[0..8] = m[0..7] + m[8..12] * SECP256K1_N_C. */
|
|
||||||
c0 = m0; c1 = 0; c2 = 0;
|
|
||||||
muladd_fast(m8, SECP256K1_N_C_0);
|
|
||||||
extract_fast(p0);
|
|
||||||
sumadd_fast(m1);
|
|
||||||
muladd(m9, SECP256K1_N_C_0);
|
|
||||||
muladd(m8, SECP256K1_N_C_1);
|
|
||||||
extract(p1);
|
|
||||||
sumadd(m2);
|
|
||||||
muladd(m10, SECP256K1_N_C_0);
|
|
||||||
muladd(m9, SECP256K1_N_C_1);
|
|
||||||
muladd(m8, SECP256K1_N_C_2);
|
|
||||||
extract(p2);
|
|
||||||
sumadd(m3);
|
|
||||||
muladd(m11, SECP256K1_N_C_0);
|
|
||||||
muladd(m10, SECP256K1_N_C_1);
|
|
||||||
muladd(m9, SECP256K1_N_C_2);
|
|
||||||
muladd(m8, SECP256K1_N_C_3);
|
|
||||||
extract(p3);
|
|
||||||
sumadd(m4);
|
|
||||||
muladd(m12, SECP256K1_N_C_0);
|
|
||||||
muladd(m11, SECP256K1_N_C_1);
|
|
||||||
muladd(m10, SECP256K1_N_C_2);
|
|
||||||
muladd(m9, SECP256K1_N_C_3);
|
|
||||||
sumadd(m8);
|
|
||||||
extract(p4);
|
|
||||||
sumadd(m5);
|
|
||||||
muladd(m12, SECP256K1_N_C_1);
|
|
||||||
muladd(m11, SECP256K1_N_C_2);
|
|
||||||
muladd(m10, SECP256K1_N_C_3);
|
|
||||||
sumadd(m9);
|
|
||||||
extract(p5);
|
|
||||||
sumadd(m6);
|
|
||||||
muladd(m12, SECP256K1_N_C_2);
|
|
||||||
muladd(m11, SECP256K1_N_C_3);
|
|
||||||
sumadd(m10);
|
|
||||||
extract(p6);
|
|
||||||
sumadd_fast(m7);
|
|
||||||
muladd_fast(m12, SECP256K1_N_C_3);
|
|
||||||
sumadd_fast(m11);
|
|
||||||
extract_fast(p7);
|
|
||||||
p8 = c0 + m12;
|
|
||||||
VERIFY_CHECK(p8 <= 2);
|
|
||||||
|
|
||||||
/* Reduce 258 bits into 256. */
|
|
||||||
/* r[0..7] = p[0..7] + p[8] * SECP256K1_N_C. */
|
|
||||||
c = p0 + (uint64_t)SECP256K1_N_C_0 * p8;
|
|
||||||
r->d[0] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
c += p1 + (uint64_t)SECP256K1_N_C_1 * p8;
|
|
||||||
r->d[1] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
c += p2 + (uint64_t)SECP256K1_N_C_2 * p8;
|
|
||||||
r->d[2] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
c += p3 + (uint64_t)SECP256K1_N_C_3 * p8;
|
|
||||||
r->d[3] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
c += p4 + (uint64_t)p8;
|
|
||||||
r->d[4] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
c += p5;
|
|
||||||
r->d[5] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
c += p6;
|
|
||||||
r->d[6] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
c += p7;
|
|
||||||
r->d[7] = c & 0xFFFFFFFFUL; c >>= 32;
|
|
||||||
|
|
||||||
/* Final reduction of r. */
|
|
||||||
secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_mul_512(uint32_t *l, const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
/* 96 bit accumulator. */
|
|
||||||
uint32_t c0 = 0, c1 = 0, c2 = 0;
|
|
||||||
|
|
||||||
/* l[0..15] = a[0..7] * b[0..7]. */
|
|
||||||
muladd_fast(a->d[0], b->d[0]);
|
|
||||||
extract_fast(l[0]);
|
|
||||||
muladd(a->d[0], b->d[1]);
|
|
||||||
muladd(a->d[1], b->d[0]);
|
|
||||||
extract(l[1]);
|
|
||||||
muladd(a->d[0], b->d[2]);
|
|
||||||
muladd(a->d[1], b->d[1]);
|
|
||||||
muladd(a->d[2], b->d[0]);
|
|
||||||
extract(l[2]);
|
|
||||||
muladd(a->d[0], b->d[3]);
|
|
||||||
muladd(a->d[1], b->d[2]);
|
|
||||||
muladd(a->d[2], b->d[1]);
|
|
||||||
muladd(a->d[3], b->d[0]);
|
|
||||||
extract(l[3]);
|
|
||||||
muladd(a->d[0], b->d[4]);
|
|
||||||
muladd(a->d[1], b->d[3]);
|
|
||||||
muladd(a->d[2], b->d[2]);
|
|
||||||
muladd(a->d[3], b->d[1]);
|
|
||||||
muladd(a->d[4], b->d[0]);
|
|
||||||
extract(l[4]);
|
|
||||||
muladd(a->d[0], b->d[5]);
|
|
||||||
muladd(a->d[1], b->d[4]);
|
|
||||||
muladd(a->d[2], b->d[3]);
|
|
||||||
muladd(a->d[3], b->d[2]);
|
|
||||||
muladd(a->d[4], b->d[1]);
|
|
||||||
muladd(a->d[5], b->d[0]);
|
|
||||||
extract(l[5]);
|
|
||||||
muladd(a->d[0], b->d[6]);
|
|
||||||
muladd(a->d[1], b->d[5]);
|
|
||||||
muladd(a->d[2], b->d[4]);
|
|
||||||
muladd(a->d[3], b->d[3]);
|
|
||||||
muladd(a->d[4], b->d[2]);
|
|
||||||
muladd(a->d[5], b->d[1]);
|
|
||||||
muladd(a->d[6], b->d[0]);
|
|
||||||
extract(l[6]);
|
|
||||||
muladd(a->d[0], b->d[7]);
|
|
||||||
muladd(a->d[1], b->d[6]);
|
|
||||||
muladd(a->d[2], b->d[5]);
|
|
||||||
muladd(a->d[3], b->d[4]);
|
|
||||||
muladd(a->d[4], b->d[3]);
|
|
||||||
muladd(a->d[5], b->d[2]);
|
|
||||||
muladd(a->d[6], b->d[1]);
|
|
||||||
muladd(a->d[7], b->d[0]);
|
|
||||||
extract(l[7]);
|
|
||||||
muladd(a->d[1], b->d[7]);
|
|
||||||
muladd(a->d[2], b->d[6]);
|
|
||||||
muladd(a->d[3], b->d[5]);
|
|
||||||
muladd(a->d[4], b->d[4]);
|
|
||||||
muladd(a->d[5], b->d[3]);
|
|
||||||
muladd(a->d[6], b->d[2]);
|
|
||||||
muladd(a->d[7], b->d[1]);
|
|
||||||
extract(l[8]);
|
|
||||||
muladd(a->d[2], b->d[7]);
|
|
||||||
muladd(a->d[3], b->d[6]);
|
|
||||||
muladd(a->d[4], b->d[5]);
|
|
||||||
muladd(a->d[5], b->d[4]);
|
|
||||||
muladd(a->d[6], b->d[3]);
|
|
||||||
muladd(a->d[7], b->d[2]);
|
|
||||||
extract(l[9]);
|
|
||||||
muladd(a->d[3], b->d[7]);
|
|
||||||
muladd(a->d[4], b->d[6]);
|
|
||||||
muladd(a->d[5], b->d[5]);
|
|
||||||
muladd(a->d[6], b->d[4]);
|
|
||||||
muladd(a->d[7], b->d[3]);
|
|
||||||
extract(l[10]);
|
|
||||||
muladd(a->d[4], b->d[7]);
|
|
||||||
muladd(a->d[5], b->d[6]);
|
|
||||||
muladd(a->d[6], b->d[5]);
|
|
||||||
muladd(a->d[7], b->d[4]);
|
|
||||||
extract(l[11]);
|
|
||||||
muladd(a->d[5], b->d[7]);
|
|
||||||
muladd(a->d[6], b->d[6]);
|
|
||||||
muladd(a->d[7], b->d[5]);
|
|
||||||
extract(l[12]);
|
|
||||||
muladd(a->d[6], b->d[7]);
|
|
||||||
muladd(a->d[7], b->d[6]);
|
|
||||||
extract(l[13]);
|
|
||||||
muladd_fast(a->d[7], b->d[7]);
|
|
||||||
extract_fast(l[14]);
|
|
||||||
VERIFY_CHECK(c1 == 0);
|
|
||||||
l[15] = c0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_sqr_512(uint32_t *l, const secp256k1_scalar *a) {
|
|
||||||
/* 96 bit accumulator. */
|
|
||||||
uint32_t c0 = 0, c1 = 0, c2 = 0;
|
|
||||||
|
|
||||||
/* l[0..15] = a[0..7]^2. */
|
|
||||||
muladd_fast(a->d[0], a->d[0]);
|
|
||||||
extract_fast(l[0]);
|
|
||||||
muladd2(a->d[0], a->d[1]);
|
|
||||||
extract(l[1]);
|
|
||||||
muladd2(a->d[0], a->d[2]);
|
|
||||||
muladd(a->d[1], a->d[1]);
|
|
||||||
extract(l[2]);
|
|
||||||
muladd2(a->d[0], a->d[3]);
|
|
||||||
muladd2(a->d[1], a->d[2]);
|
|
||||||
extract(l[3]);
|
|
||||||
muladd2(a->d[0], a->d[4]);
|
|
||||||
muladd2(a->d[1], a->d[3]);
|
|
||||||
muladd(a->d[2], a->d[2]);
|
|
||||||
extract(l[4]);
|
|
||||||
muladd2(a->d[0], a->d[5]);
|
|
||||||
muladd2(a->d[1], a->d[4]);
|
|
||||||
muladd2(a->d[2], a->d[3]);
|
|
||||||
extract(l[5]);
|
|
||||||
muladd2(a->d[0], a->d[6]);
|
|
||||||
muladd2(a->d[1], a->d[5]);
|
|
||||||
muladd2(a->d[2], a->d[4]);
|
|
||||||
muladd(a->d[3], a->d[3]);
|
|
||||||
extract(l[6]);
|
|
||||||
muladd2(a->d[0], a->d[7]);
|
|
||||||
muladd2(a->d[1], a->d[6]);
|
|
||||||
muladd2(a->d[2], a->d[5]);
|
|
||||||
muladd2(a->d[3], a->d[4]);
|
|
||||||
extract(l[7]);
|
|
||||||
muladd2(a->d[1], a->d[7]);
|
|
||||||
muladd2(a->d[2], a->d[6]);
|
|
||||||
muladd2(a->d[3], a->d[5]);
|
|
||||||
muladd(a->d[4], a->d[4]);
|
|
||||||
extract(l[8]);
|
|
||||||
muladd2(a->d[2], a->d[7]);
|
|
||||||
muladd2(a->d[3], a->d[6]);
|
|
||||||
muladd2(a->d[4], a->d[5]);
|
|
||||||
extract(l[9]);
|
|
||||||
muladd2(a->d[3], a->d[7]);
|
|
||||||
muladd2(a->d[4], a->d[6]);
|
|
||||||
muladd(a->d[5], a->d[5]);
|
|
||||||
extract(l[10]);
|
|
||||||
muladd2(a->d[4], a->d[7]);
|
|
||||||
muladd2(a->d[5], a->d[6]);
|
|
||||||
extract(l[11]);
|
|
||||||
muladd2(a->d[5], a->d[7]);
|
|
||||||
muladd(a->d[6], a->d[6]);
|
|
||||||
extract(l[12]);
|
|
||||||
muladd2(a->d[6], a->d[7]);
|
|
||||||
extract(l[13]);
|
|
||||||
muladd_fast(a->d[7], a->d[7]);
|
|
||||||
extract_fast(l[14]);
|
|
||||||
VERIFY_CHECK(c1 == 0);
|
|
||||||
l[15] = c0;
|
|
||||||
}
|
|
||||||
|
|
||||||
#undef sumadd
|
|
||||||
#undef sumadd_fast
|
|
||||||
#undef muladd
|
|
||||||
#undef muladd_fast
|
|
||||||
#undef muladd2
|
|
||||||
#undef extract
|
|
||||||
#undef extract_fast
|
|
||||||
|
|
||||||
static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
uint32_t l[16];
|
|
||||||
secp256k1_scalar_mul_512(l, a, b);
|
|
||||||
secp256k1_scalar_reduce_512(r, l);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
|
|
||||||
int ret;
|
|
||||||
VERIFY_CHECK(n > 0);
|
|
||||||
VERIFY_CHECK(n < 16);
|
|
||||||
ret = r->d[0] & ((1 << n) - 1);
|
|
||||||
r->d[0] = (r->d[0] >> n) + (r->d[1] << (32 - n));
|
|
||||||
r->d[1] = (r->d[1] >> n) + (r->d[2] << (32 - n));
|
|
||||||
r->d[2] = (r->d[2] >> n) + (r->d[3] << (32 - n));
|
|
||||||
r->d[3] = (r->d[3] >> n) + (r->d[4] << (32 - n));
|
|
||||||
r->d[4] = (r->d[4] >> n) + (r->d[5] << (32 - n));
|
|
||||||
r->d[5] = (r->d[5] >> n) + (r->d[6] << (32 - n));
|
|
||||||
r->d[6] = (r->d[6] >> n) + (r->d[7] << (32 - n));
|
|
||||||
r->d[7] = (r->d[7] >> n);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a) {
|
|
||||||
uint32_t l[16];
|
|
||||||
secp256k1_scalar_sqr_512(l, a);
|
|
||||||
secp256k1_scalar_reduce_512(r, l);
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
|
|
||||||
r1->d[0] = a->d[0];
|
|
||||||
r1->d[1] = a->d[1];
|
|
||||||
r1->d[2] = a->d[2];
|
|
||||||
r1->d[3] = a->d[3];
|
|
||||||
r1->d[4] = 0;
|
|
||||||
r1->d[5] = 0;
|
|
||||||
r1->d[6] = 0;
|
|
||||||
r1->d[7] = 0;
|
|
||||||
r2->d[0] = a->d[4];
|
|
||||||
r2->d[1] = a->d[5];
|
|
||||||
r2->d[2] = a->d[6];
|
|
||||||
r2->d[3] = a->d[7];
|
|
||||||
r2->d[4] = 0;
|
|
||||||
r2->d[5] = 0;
|
|
||||||
r2->d[6] = 0;
|
|
||||||
r2->d[7] = 0;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3]) | (a->d[4] ^ b->d[4]) | (a->d[5] ^ b->d[5]) | (a->d[6] ^ b->d[6]) | (a->d[7] ^ b->d[7])) == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift) {
|
|
||||||
uint32_t l[16];
|
|
||||||
unsigned int shiftlimbs;
|
|
||||||
unsigned int shiftlow;
|
|
||||||
unsigned int shifthigh;
|
|
||||||
VERIFY_CHECK(shift >= 256);
|
|
||||||
secp256k1_scalar_mul_512(l, a, b);
|
|
||||||
shiftlimbs = shift >> 5;
|
|
||||||
shiftlow = shift & 0x1F;
|
|
||||||
shifthigh = 32 - shiftlow;
|
|
||||||
r->d[0] = shift < 512 ? (l[0 + shiftlimbs] >> shiftlow | (shift < 480 && shiftlow ? (l[1 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[1] = shift < 480 ? (l[1 + shiftlimbs] >> shiftlow | (shift < 448 && shiftlow ? (l[2 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[2] = shift < 448 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 416 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[3] = shift < 416 ? (l[3 + shiftlimbs] >> shiftlow | (shift < 384 && shiftlow ? (l[4 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[4] = shift < 384 ? (l[4 + shiftlimbs] >> shiftlow | (shift < 352 && shiftlow ? (l[5 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[5] = shift < 352 ? (l[5 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[6 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[6] = shift < 320 ? (l[6 + shiftlimbs] >> shiftlow | (shift < 288 && shiftlow ? (l[7 + shiftlimbs] << shifthigh) : 0)) : 0;
|
|
||||||
r->d[7] = shift < 288 ? (l[7 + shiftlimbs] >> shiftlow) : 0;
|
|
||||||
secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 5] >> ((shift - 1) & 0x1f)) & 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_REPR_IMPL_H */
|
|
||||||
@ -1,333 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_IMPL_H
|
|
||||||
#define SECP256K1_SCALAR_IMPL_H
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
#include "util.h"
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
#include "scalar_low_impl.h"
|
|
||||||
#elif defined(USE_SCALAR_4X64)
|
|
||||||
#include "scalar_4x64_impl.h"
|
|
||||||
#elif defined(USE_SCALAR_8X32)
|
|
||||||
#include "scalar_8x32_impl.h"
|
|
||||||
#else
|
|
||||||
#error "Please select scalar implementation"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifndef USE_NUM_NONE
|
|
||||||
static void secp256k1_scalar_get_num(secp256k1_num *r, const secp256k1_scalar *a) {
|
|
||||||
unsigned char c[32];
|
|
||||||
secp256k1_scalar_get_b32(c, a);
|
|
||||||
secp256k1_num_set_bin(r, c, 32);
|
|
||||||
}
|
|
||||||
|
|
||||||
/** secp256k1 curve order, see secp256k1_ecdsa_const_order_as_fe in ecdsa_impl.h */
|
|
||||||
static void secp256k1_scalar_order_get_num(secp256k1_num *r) {
|
|
||||||
#if defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
static const unsigned char order[32] = {
|
|
||||||
0,0,0,0,0,0,0,0,
|
|
||||||
0,0,0,0,0,0,0,0,
|
|
||||||
0,0,0,0,0,0,0,0,
|
|
||||||
0,0,0,0,0,0,0,EXHAUSTIVE_TEST_ORDER
|
|
||||||
};
|
|
||||||
#else
|
|
||||||
static const unsigned char order[32] = {
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
|
|
||||||
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFE,
|
|
||||||
0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,
|
|
||||||
0xBF,0xD2,0x5E,0x8C,0xD0,0x36,0x41,0x41
|
|
||||||
};
|
|
||||||
#endif
|
|
||||||
secp256k1_num_set_bin(r, order, 32);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *x) {
|
|
||||||
#if defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
int i;
|
|
||||||
*r = 0;
|
|
||||||
for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++)
|
|
||||||
if ((i * *x) % EXHAUSTIVE_TEST_ORDER == 1)
|
|
||||||
*r = i;
|
|
||||||
/* If this VERIFY_CHECK triggers we were given a noninvertible scalar (and thus
|
|
||||||
* have a composite group order; fix it in exhaustive_tests.c). */
|
|
||||||
VERIFY_CHECK(*r != 0);
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
secp256k1_scalar *t;
|
|
||||||
int i;
|
|
||||||
/* First compute xN as x ^ (2^N - 1) for some values of N,
|
|
||||||
* and uM as x ^ M for some values of M. */
|
|
||||||
secp256k1_scalar x2, x3, x6, x8, x14, x28, x56, x112, x126;
|
|
||||||
secp256k1_scalar u2, u5, u9, u11, u13;
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&u2, x);
|
|
||||||
secp256k1_scalar_mul(&x2, &u2, x);
|
|
||||||
secp256k1_scalar_mul(&u5, &u2, &x2);
|
|
||||||
secp256k1_scalar_mul(&x3, &u5, &u2);
|
|
||||||
secp256k1_scalar_mul(&u9, &x3, &u2);
|
|
||||||
secp256k1_scalar_mul(&u11, &u9, &u2);
|
|
||||||
secp256k1_scalar_mul(&u13, &u11, &u2);
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&x6, &u13);
|
|
||||||
secp256k1_scalar_sqr(&x6, &x6);
|
|
||||||
secp256k1_scalar_mul(&x6, &x6, &u11);
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&x8, &x6);
|
|
||||||
secp256k1_scalar_sqr(&x8, &x8);
|
|
||||||
secp256k1_scalar_mul(&x8, &x8, &x2);
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&x14, &x8);
|
|
||||||
for (i = 0; i < 5; i++) {
|
|
||||||
secp256k1_scalar_sqr(&x14, &x14);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(&x14, &x14, &x6);
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&x28, &x14);
|
|
||||||
for (i = 0; i < 13; i++) {
|
|
||||||
secp256k1_scalar_sqr(&x28, &x28);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(&x28, &x28, &x14);
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&x56, &x28);
|
|
||||||
for (i = 0; i < 27; i++) {
|
|
||||||
secp256k1_scalar_sqr(&x56, &x56);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(&x56, &x56, &x28);
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&x112, &x56);
|
|
||||||
for (i = 0; i < 55; i++) {
|
|
||||||
secp256k1_scalar_sqr(&x112, &x112);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(&x112, &x112, &x56);
|
|
||||||
|
|
||||||
secp256k1_scalar_sqr(&x126, &x112);
|
|
||||||
for (i = 0; i < 13; i++) {
|
|
||||||
secp256k1_scalar_sqr(&x126, &x126);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(&x126, &x126, &x14);
|
|
||||||
|
|
||||||
/* Then accumulate the final result (t starts at x126). */
|
|
||||||
t = &x126;
|
|
||||||
for (i = 0; i < 3; i++) {
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u5); /* 101 */
|
|
||||||
for (i = 0; i < 4; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x3); /* 111 */
|
|
||||||
for (i = 0; i < 4; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u5); /* 101 */
|
|
||||||
for (i = 0; i < 5; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u11); /* 1011 */
|
|
||||||
for (i = 0; i < 4; i++) {
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u11); /* 1011 */
|
|
||||||
for (i = 0; i < 4; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x3); /* 111 */
|
|
||||||
for (i = 0; i < 5; i++) { /* 00 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x3); /* 111 */
|
|
||||||
for (i = 0; i < 6; i++) { /* 00 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u13); /* 1101 */
|
|
||||||
for (i = 0; i < 4; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u5); /* 101 */
|
|
||||||
for (i = 0; i < 3; i++) {
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x3); /* 111 */
|
|
||||||
for (i = 0; i < 5; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u9); /* 1001 */
|
|
||||||
for (i = 0; i < 6; i++) { /* 000 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u5); /* 101 */
|
|
||||||
for (i = 0; i < 10; i++) { /* 0000000 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x3); /* 111 */
|
|
||||||
for (i = 0; i < 4; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x3); /* 111 */
|
|
||||||
for (i = 0; i < 9; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x8); /* 11111111 */
|
|
||||||
for (i = 0; i < 5; i++) { /* 0 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u9); /* 1001 */
|
|
||||||
for (i = 0; i < 6; i++) { /* 00 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u11); /* 1011 */
|
|
||||||
for (i = 0; i < 4; i++) {
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u13); /* 1101 */
|
|
||||||
for (i = 0; i < 5; i++) {
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &x2); /* 11 */
|
|
||||||
for (i = 0; i < 6; i++) { /* 00 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u13); /* 1101 */
|
|
||||||
for (i = 0; i < 10; i++) { /* 000000 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u13); /* 1101 */
|
|
||||||
for (i = 0; i < 4; i++) {
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, &u9); /* 1001 */
|
|
||||||
for (i = 0; i < 6; i++) { /* 00000 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(t, t, x); /* 1 */
|
|
||||||
for (i = 0; i < 8; i++) { /* 00 */
|
|
||||||
secp256k1_scalar_sqr(t, t);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_mul(r, t, &x6); /* 111111 */
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_even(const secp256k1_scalar *a) {
|
|
||||||
return !(a->d[0] & 1);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *x) {
|
|
||||||
#if defined(USE_SCALAR_INV_BUILTIN)
|
|
||||||
secp256k1_scalar_inverse(r, x);
|
|
||||||
#elif defined(USE_SCALAR_INV_NUM)
|
|
||||||
unsigned char b[32];
|
|
||||||
secp256k1_num n, m;
|
|
||||||
secp256k1_scalar t = *x;
|
|
||||||
secp256k1_scalar_get_b32(b, &t);
|
|
||||||
secp256k1_num_set_bin(&n, b, 32);
|
|
||||||
secp256k1_scalar_order_get_num(&m);
|
|
||||||
secp256k1_num_mod_inverse(&n, &n, &m);
|
|
||||||
secp256k1_num_get_bin(b, 32, &n);
|
|
||||||
secp256k1_scalar_set_b32(r, b, NULL);
|
|
||||||
/* Verify that the inverse was computed correctly, without GMP code. */
|
|
||||||
secp256k1_scalar_mul(&t, &t, r);
|
|
||||||
CHECK(secp256k1_scalar_is_one(&t));
|
|
||||||
#else
|
|
||||||
#error "Please select scalar inverse implementation"
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
#if defined(EXHAUSTIVE_TEST_ORDER)
|
|
||||||
/**
|
|
||||||
* Find k1 and k2 given k, such that k1 + k2 * lambda == k mod n; unlike in the
|
|
||||||
* full case we don't bother making k1 and k2 be small, we just want them to be
|
|
||||||
* nontrivial to get full test coverage for the exhaustive tests. We therefore
|
|
||||||
* (arbitrarily) set k2 = k + 5 and k1 = k - k2 * lambda.
|
|
||||||
*/
|
|
||||||
static void secp256k1_scalar_split_lambda(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
|
|
||||||
*r2 = (*a + 5) % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
*r1 = (*a + (EXHAUSTIVE_TEST_ORDER - *r2) * EXHAUSTIVE_TEST_LAMBDA) % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
/**
|
|
||||||
* The Secp256k1 curve has an endomorphism, where lambda * (x, y) = (beta * x, y), where
|
|
||||||
* lambda is {0x53,0x63,0xad,0x4c,0xc0,0x5c,0x30,0xe0,0xa5,0x26,0x1c,0x02,0x88,0x12,0x64,0x5a,
|
|
||||||
* 0x12,0x2e,0x22,0xea,0x20,0x81,0x66,0x78,0xdf,0x02,0x96,0x7c,0x1b,0x23,0xbd,0x72}
|
|
||||||
*
|
|
||||||
* "Guide to Elliptic Curve Cryptography" (Hankerson, Menezes, Vanstone) gives an algorithm
|
|
||||||
* (algorithm 3.74) to find k1 and k2 given k, such that k1 + k2 * lambda == k mod n, and k1
|
|
||||||
* and k2 have a small size.
|
|
||||||
* It relies on constants a1, b1, a2, b2. These constants for the value of lambda above are:
|
|
||||||
*
|
|
||||||
* - a1 = {0x30,0x86,0xd2,0x21,0xa7,0xd4,0x6b,0xcd,0xe8,0x6c,0x90,0xe4,0x92,0x84,0xeb,0x15}
|
|
||||||
* - b1 = -{0xe4,0x43,0x7e,0xd6,0x01,0x0e,0x88,0x28,0x6f,0x54,0x7f,0xa9,0x0a,0xbf,0xe4,0xc3}
|
|
||||||
* - a2 = {0x01,0x14,0xca,0x50,0xf7,0xa8,0xe2,0xf3,0xf6,0x57,0xc1,0x10,0x8d,0x9d,0x44,0xcf,0xd8}
|
|
||||||
* - b2 = {0x30,0x86,0xd2,0x21,0xa7,0xd4,0x6b,0xcd,0xe8,0x6c,0x90,0xe4,0x92,0x84,0xeb,0x15}
|
|
||||||
*
|
|
||||||
* The algorithm then computes c1 = round(b1 * k / n) and c2 = round(b2 * k / n), and gives
|
|
||||||
* k1 = k - (c1*a1 + c2*a2) and k2 = -(c1*b1 + c2*b2). Instead, we use modular arithmetic, and
|
|
||||||
* compute k1 as k - k2 * lambda, avoiding the need for constants a1 and a2.
|
|
||||||
*
|
|
||||||
* g1, g2 are precomputed constants used to replace division with a rounded multiplication
|
|
||||||
* when decomposing the scalar for an endomorphism-based point multiplication.
|
|
||||||
*
|
|
||||||
* The possibility of using precomputed estimates is mentioned in "Guide to Elliptic Curve
|
|
||||||
* Cryptography" (Hankerson, Menezes, Vanstone) in section 3.5.
|
|
||||||
*
|
|
||||||
* The derivation is described in the paper "Efficient Software Implementation of Public-Key
|
|
||||||
* Cryptography on Sensor Networks Using the MSP430X Microcontroller" (Gouvea, Oliveira, Lopez),
|
|
||||||
* Section 4.3 (here we use a somewhat higher-precision estimate):
|
|
||||||
* d = a1*b2 - b1*a2
|
|
||||||
* g1 = round((2^272)*b2/d)
|
|
||||||
* g2 = round((2^272)*b1/d)
|
|
||||||
*
|
|
||||||
* (Note that 'd' is also equal to the curve order here because [a1,b1] and [a2,b2] are found
|
|
||||||
* as outputs of the Extended Euclidean Algorithm on inputs 'order' and 'lambda').
|
|
||||||
*
|
|
||||||
* The function below splits a in r1 and r2, such that r1 + lambda * r2 == a (mod order).
|
|
||||||
*/
|
|
||||||
|
|
||||||
static void secp256k1_scalar_split_lambda(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
|
|
||||||
secp256k1_scalar c1, c2;
|
|
||||||
static const secp256k1_scalar minus_lambda = SECP256K1_SCALAR_CONST(
|
|
||||||
0xAC9C52B3UL, 0x3FA3CF1FUL, 0x5AD9E3FDUL, 0x77ED9BA4UL,
|
|
||||||
0xA880B9FCUL, 0x8EC739C2UL, 0xE0CFC810UL, 0xB51283CFUL
|
|
||||||
);
|
|
||||||
static const secp256k1_scalar minus_b1 = SECP256K1_SCALAR_CONST(
|
|
||||||
0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL,
|
|
||||||
0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C3UL
|
|
||||||
);
|
|
||||||
static const secp256k1_scalar minus_b2 = SECP256K1_SCALAR_CONST(
|
|
||||||
0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
|
|
||||||
0x8A280AC5UL, 0x0774346DUL, 0xD765CDA8UL, 0x3DB1562CUL
|
|
||||||
);
|
|
||||||
static const secp256k1_scalar g1 = SECP256K1_SCALAR_CONST(
|
|
||||||
0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00003086UL,
|
|
||||||
0xD221A7D4UL, 0x6BCDE86CUL, 0x90E49284UL, 0xEB153DABUL
|
|
||||||
);
|
|
||||||
static const secp256k1_scalar g2 = SECP256K1_SCALAR_CONST(
|
|
||||||
0x00000000UL, 0x00000000UL, 0x00000000UL, 0x0000E443UL,
|
|
||||||
0x7ED6010EUL, 0x88286F54UL, 0x7FA90ABFUL, 0xE4C42212UL
|
|
||||||
);
|
|
||||||
VERIFY_CHECK(r1 != a);
|
|
||||||
VERIFY_CHECK(r2 != a);
|
|
||||||
/* these _var calls are constant time since the shift amount is constant */
|
|
||||||
secp256k1_scalar_mul_shift_var(&c1, a, &g1, 272);
|
|
||||||
secp256k1_scalar_mul_shift_var(&c2, a, &g2, 272);
|
|
||||||
secp256k1_scalar_mul(&c1, &c1, &minus_b1);
|
|
||||||
secp256k1_scalar_mul(&c2, &c2, &minus_b2);
|
|
||||||
secp256k1_scalar_add(r2, &c1, &c2);
|
|
||||||
secp256k1_scalar_mul(r1, r2, &minus_lambda);
|
|
||||||
secp256k1_scalar_add(r1, r1, a);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_IMPL_H */
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_REPR_H
|
|
||||||
#define SECP256K1_SCALAR_REPR_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
|
|
||||||
/** A scalar modulo the group order of the secp256k1 curve. */
|
|
||||||
typedef uint32_t secp256k1_scalar;
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_REPR_H */
|
|
||||||
@ -1,117 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2015 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_SCALAR_REPR_IMPL_H
|
|
||||||
#define SECP256K1_SCALAR_REPR_IMPL_H
|
|
||||||
|
|
||||||
#include "scalar.h"
|
|
||||||
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_even(const secp256k1_scalar *a) {
|
|
||||||
return !(*a & 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) { *r = 0; }
|
|
||||||
SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v) { *r = v; }
|
|
||||||
|
|
||||||
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
|
|
||||||
if (offset < 32)
|
|
||||||
return ((*a >> offset) & ((((uint32_t)1) << count) - 1));
|
|
||||||
else
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
|
|
||||||
return secp256k1_scalar_get_bits(a, offset, count);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) { return *a >= EXHAUSTIVE_TEST_ORDER; }
|
|
||||||
|
|
||||||
static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
*r = (*a + *b) % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
return *r < *b;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
|
|
||||||
if (flag && bit < 32)
|
|
||||||
*r += ((uint32_t)1 << bit);
|
|
||||||
#ifdef VERIFY
|
|
||||||
VERIFY_CHECK(bit < 32);
|
|
||||||
/* Verify that adding (1 << bit) will not overflow any in-range scalar *r by overflowing the underlying uint32_t. */
|
|
||||||
VERIFY_CHECK(((uint32_t)1 << bit) - 1 <= UINT32_MAX - EXHAUSTIVE_TEST_ORDER);
|
|
||||||
VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
|
|
||||||
const int base = 0x100 % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
int i;
|
|
||||||
*r = 0;
|
|
||||||
for (i = 0; i < 32; i++) {
|
|
||||||
*r = ((*r * base) + b32[i]) % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
}
|
|
||||||
/* just deny overflow, it basically always happens */
|
|
||||||
if (overflow) *overflow = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
|
|
||||||
memset(bin, 0, 32);
|
|
||||||
bin[28] = *a >> 24; bin[29] = *a >> 16; bin[30] = *a >> 8; bin[31] = *a;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
|
|
||||||
return *a == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
|
|
||||||
if (*a == 0) {
|
|
||||||
*r = 0;
|
|
||||||
} else {
|
|
||||||
*r = EXHAUSTIVE_TEST_ORDER - *a;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
|
|
||||||
return *a == 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
|
|
||||||
return *a > EXHAUSTIVE_TEST_ORDER / 2;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
|
|
||||||
if (flag) secp256k1_scalar_negate(r, r);
|
|
||||||
return flag ? -1 : 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
*r = (*a * *b) % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
|
|
||||||
int ret;
|
|
||||||
VERIFY_CHECK(n > 0);
|
|
||||||
VERIFY_CHECK(n < 16);
|
|
||||||
ret = *r & ((1 << n) - 1);
|
|
||||||
*r >>= n;
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a) {
|
|
||||||
*r = (*a * *a) % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
|
|
||||||
*r1 = *a;
|
|
||||||
*r2 = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
|
|
||||||
return *a == *b;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_SCALAR_REPR_IMPL_H */
|
|
||||||
@ -1,42 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2017 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef _SECP256K1_SCRATCH_
|
|
||||||
#define _SECP256K1_SCRATCH_
|
|
||||||
|
|
||||||
/* The typedef is used internally; the struct name is used in the public API
|
|
||||||
* (where it is exposed as a different typedef) */
|
|
||||||
typedef struct secp256k1_scratch_space_struct {
|
|
||||||
/** guard against interpreting this object as other types */
|
|
||||||
unsigned char magic[8];
|
|
||||||
/** actual allocated data */
|
|
||||||
void *data;
|
|
||||||
/** amount that has been allocated (i.e. `data + offset` is the next
|
|
||||||
* available pointer) */
|
|
||||||
size_t alloc_size;
|
|
||||||
/** maximum size available to allocate */
|
|
||||||
size_t max_size;
|
|
||||||
} secp256k1_scratch;
|
|
||||||
|
|
||||||
static secp256k1_scratch* secp256k1_scratch_create(const secp256k1_callback* error_callback, size_t max_size);
|
|
||||||
|
|
||||||
static void secp256k1_scratch_destroy(const secp256k1_callback* error_callback, secp256k1_scratch* scratch);
|
|
||||||
|
|
||||||
/** Returns an opaque object used to "checkpoint" a scratch space. Used
|
|
||||||
* with `secp256k1_scratch_apply_checkpoint` to undo allocations. */
|
|
||||||
static size_t secp256k1_scratch_checkpoint(const secp256k1_callback* error_callback, const secp256k1_scratch* scratch);
|
|
||||||
|
|
||||||
/** Applies a check point received from `secp256k1_scratch_checkpoint`,
|
|
||||||
* undoing all allocations since that point. */
|
|
||||||
static void secp256k1_scratch_apply_checkpoint(const secp256k1_callback* error_callback, secp256k1_scratch* scratch, size_t checkpoint);
|
|
||||||
|
|
||||||
/** Returns the maximum allocation the scratch space will allow */
|
|
||||||
static size_t secp256k1_scratch_max_allocation(const secp256k1_callback* error_callback, const secp256k1_scratch* scratch, size_t n_objects);
|
|
||||||
|
|
||||||
/** Returns a pointer into the most recently allocated frame, or NULL if there is insufficient available space */
|
|
||||||
static void *secp256k1_scratch_alloc(const secp256k1_callback* error_callback, secp256k1_scratch* scratch, size_t n);
|
|
||||||
|
|
||||||
#endif
|
|
||||||
@ -1,88 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2017 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef _SECP256K1_SCRATCH_IMPL_H_
|
|
||||||
#define _SECP256K1_SCRATCH_IMPL_H_
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "scratch.h"
|
|
||||||
|
|
||||||
static secp256k1_scratch* secp256k1_scratch_create(const secp256k1_callback* error_callback, size_t size) {
|
|
||||||
const size_t base_alloc = ((sizeof(secp256k1_scratch) + ALIGNMENT - 1) / ALIGNMENT) * ALIGNMENT;
|
|
||||||
void *alloc = checked_malloc(error_callback, base_alloc + size);
|
|
||||||
secp256k1_scratch* ret = (secp256k1_scratch *)alloc;
|
|
||||||
if (ret != NULL) {
|
|
||||||
memset(ret, 0, sizeof(*ret));
|
|
||||||
memcpy(ret->magic, "scratch", 8);
|
|
||||||
ret->data = (void *) ((char *) alloc + base_alloc);
|
|
||||||
ret->max_size = size;
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scratch_destroy(const secp256k1_callback* error_callback, secp256k1_scratch* scratch) {
|
|
||||||
if (scratch != NULL) {
|
|
||||||
VERIFY_CHECK(scratch->alloc_size == 0); /* all checkpoints should be applied */
|
|
||||||
if (memcmp(scratch->magic, "scratch", 8) != 0) {
|
|
||||||
secp256k1_callback_call(error_callback, "invalid scratch space");
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
memset(scratch->magic, 0, sizeof(scratch->magic));
|
|
||||||
free(scratch);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static size_t secp256k1_scratch_checkpoint(const secp256k1_callback* error_callback, const secp256k1_scratch* scratch) {
|
|
||||||
if (memcmp(scratch->magic, "scratch", 8) != 0) {
|
|
||||||
secp256k1_callback_call(error_callback, "invalid scratch space");
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
return scratch->alloc_size;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_scratch_apply_checkpoint(const secp256k1_callback* error_callback, secp256k1_scratch* scratch, size_t checkpoint) {
|
|
||||||
if (memcmp(scratch->magic, "scratch", 8) != 0) {
|
|
||||||
secp256k1_callback_call(error_callback, "invalid scratch space");
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (checkpoint > scratch->alloc_size) {
|
|
||||||
secp256k1_callback_call(error_callback, "invalid checkpoint");
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
scratch->alloc_size = checkpoint;
|
|
||||||
}
|
|
||||||
|
|
||||||
static size_t secp256k1_scratch_max_allocation(const secp256k1_callback* error_callback, const secp256k1_scratch* scratch, size_t objects) {
|
|
||||||
if (memcmp(scratch->magic, "scratch", 8) != 0) {
|
|
||||||
secp256k1_callback_call(error_callback, "invalid scratch space");
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
if (scratch->max_size - scratch->alloc_size <= objects * (ALIGNMENT - 1)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
return scratch->max_size - scratch->alloc_size - objects * (ALIGNMENT - 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void *secp256k1_scratch_alloc(const secp256k1_callback* error_callback, secp256k1_scratch* scratch, size_t size) {
|
|
||||||
void *ret;
|
|
||||||
size = ROUND_TO_ALIGN(size);
|
|
||||||
|
|
||||||
if (memcmp(scratch->magic, "scratch", 8) != 0) {
|
|
||||||
secp256k1_callback_call(error_callback, "invalid scratch space");
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (size > scratch->max_size - scratch->alloc_size) {
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
ret = (void *) ((char *) scratch->data + scratch->alloc_size);
|
|
||||||
memset(ret, 0, size);
|
|
||||||
scratch->alloc_size += size;
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
@ -1,690 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013-2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "include/secp256k1_preallocated.h"
|
|
||||||
|
|
||||||
#include "util.h"
|
|
||||||
#include "num_impl.h"
|
|
||||||
#include "field_impl.h"
|
|
||||||
#include "scalar_impl.h"
|
|
||||||
#include "group_impl.h"
|
|
||||||
#include "ecmult_impl.h"
|
|
||||||
#include "ecmult_const_impl.h"
|
|
||||||
#include "ecmult_gen_impl.h"
|
|
||||||
#include "ecdsa_impl.h"
|
|
||||||
#include "eckey_impl.h"
|
|
||||||
#include "hash_impl.h"
|
|
||||||
#include "scratch_impl.h"
|
|
||||||
|
|
||||||
#define ARG_CHECK(cond) do { \
|
|
||||||
if (EXPECT(!(cond), 0)) { \
|
|
||||||
secp256k1_callback_call(&ctx->illegal_callback, #cond); \
|
|
||||||
return 0; \
|
|
||||||
} \
|
|
||||||
} while(0)
|
|
||||||
|
|
||||||
#define ARG_CHECK_NO_RETURN(cond) do { \
|
|
||||||
if (EXPECT(!(cond), 0)) { \
|
|
||||||
secp256k1_callback_call(&ctx->illegal_callback, #cond); \
|
|
||||||
} \
|
|
||||||
} while(0)
|
|
||||||
|
|
||||||
#ifndef USE_EXTERNAL_DEFAULT_CALLBACKS
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
static void secp256k1_default_illegal_callback_fn(const char* str, void* data) {
|
|
||||||
(void)data;
|
|
||||||
fprintf(stderr, "[libsecp256k1] illegal argument: %s\n", str);
|
|
||||||
abort();
|
|
||||||
}
|
|
||||||
static void secp256k1_default_error_callback_fn(const char* str, void* data) {
|
|
||||||
(void)data;
|
|
||||||
fprintf(stderr, "[libsecp256k1] internal consistency check failed: %s\n", str);
|
|
||||||
abort();
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
void secp256k1_default_illegal_callback_fn(const char* str, void* data);
|
|
||||||
void secp256k1_default_error_callback_fn(const char* str, void* data);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static const secp256k1_callback default_illegal_callback = {
|
|
||||||
secp256k1_default_illegal_callback_fn,
|
|
||||||
NULL
|
|
||||||
};
|
|
||||||
|
|
||||||
static const secp256k1_callback default_error_callback = {
|
|
||||||
secp256k1_default_error_callback_fn,
|
|
||||||
NULL
|
|
||||||
};
|
|
||||||
|
|
||||||
struct secp256k1_context_struct {
|
|
||||||
secp256k1_ecmult_context ecmult_ctx;
|
|
||||||
secp256k1_ecmult_gen_context ecmult_gen_ctx;
|
|
||||||
secp256k1_callback illegal_callback;
|
|
||||||
secp256k1_callback error_callback;
|
|
||||||
};
|
|
||||||
|
|
||||||
static const secp256k1_context secp256k1_context_no_precomp_ = {
|
|
||||||
{ 0 },
|
|
||||||
{ 0 },
|
|
||||||
{ secp256k1_default_illegal_callback_fn, 0 },
|
|
||||||
{ secp256k1_default_error_callback_fn, 0 }
|
|
||||||
};
|
|
||||||
const secp256k1_context *secp256k1_context_no_precomp = &secp256k1_context_no_precomp_;
|
|
||||||
|
|
||||||
size_t secp256k1_context_preallocated_size(unsigned int flags) {
|
|
||||||
size_t ret = ROUND_TO_ALIGN(sizeof(secp256k1_context));
|
|
||||||
|
|
||||||
if (EXPECT((flags & SECP256K1_FLAGS_TYPE_MASK) != SECP256K1_FLAGS_TYPE_CONTEXT, 0)) {
|
|
||||||
secp256k1_callback_call(&default_illegal_callback,
|
|
||||||
"Invalid flags");
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (flags & SECP256K1_FLAGS_BIT_CONTEXT_SIGN) {
|
|
||||||
ret += SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE;
|
|
||||||
}
|
|
||||||
if (flags & SECP256K1_FLAGS_BIT_CONTEXT_VERIFY) {
|
|
||||||
ret += SECP256K1_ECMULT_CONTEXT_PREALLOCATED_SIZE;
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
size_t secp256k1_context_preallocated_clone_size(const secp256k1_context* ctx) {
|
|
||||||
size_t ret = ROUND_TO_ALIGN(sizeof(secp256k1_context));
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
if (secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)) {
|
|
||||||
ret += SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE;
|
|
||||||
}
|
|
||||||
if (secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx)) {
|
|
||||||
ret += SECP256K1_ECMULT_CONTEXT_PREALLOCATED_SIZE;
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_context* secp256k1_context_preallocated_create(void* prealloc, unsigned int flags) {
|
|
||||||
void* const base = prealloc;
|
|
||||||
size_t prealloc_size;
|
|
||||||
secp256k1_context* ret;
|
|
||||||
|
|
||||||
VERIFY_CHECK(prealloc != NULL);
|
|
||||||
prealloc_size = secp256k1_context_preallocated_size(flags);
|
|
||||||
ret = (secp256k1_context*)manual_alloc(&prealloc, sizeof(secp256k1_context), base, prealloc_size);
|
|
||||||
ret->illegal_callback = default_illegal_callback;
|
|
||||||
ret->error_callback = default_error_callback;
|
|
||||||
|
|
||||||
if (EXPECT((flags & SECP256K1_FLAGS_TYPE_MASK) != SECP256K1_FLAGS_TYPE_CONTEXT, 0)) {
|
|
||||||
secp256k1_callback_call(&ret->illegal_callback,
|
|
||||||
"Invalid flags");
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_ecmult_context_init(&ret->ecmult_ctx);
|
|
||||||
secp256k1_ecmult_gen_context_init(&ret->ecmult_gen_ctx);
|
|
||||||
|
|
||||||
if (flags & SECP256K1_FLAGS_BIT_CONTEXT_SIGN) {
|
|
||||||
secp256k1_ecmult_gen_context_build(&ret->ecmult_gen_ctx, &prealloc);
|
|
||||||
}
|
|
||||||
if (flags & SECP256K1_FLAGS_BIT_CONTEXT_VERIFY) {
|
|
||||||
secp256k1_ecmult_context_build(&ret->ecmult_ctx, &prealloc);
|
|
||||||
}
|
|
||||||
|
|
||||||
return (secp256k1_context*) ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_context* secp256k1_context_create(unsigned int flags) {
|
|
||||||
size_t const prealloc_size = secp256k1_context_preallocated_size(flags);
|
|
||||||
secp256k1_context* ctx = (secp256k1_context*)checked_malloc(&default_error_callback, prealloc_size);
|
|
||||||
if (EXPECT(secp256k1_context_preallocated_create(ctx, flags) == NULL, 0)) {
|
|
||||||
free(ctx);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
return ctx;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_context* secp256k1_context_preallocated_clone(const secp256k1_context* ctx, void* prealloc) {
|
|
||||||
size_t prealloc_size;
|
|
||||||
secp256k1_context* ret;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(prealloc != NULL);
|
|
||||||
|
|
||||||
prealloc_size = secp256k1_context_preallocated_clone_size(ctx);
|
|
||||||
ret = (secp256k1_context*)prealloc;
|
|
||||||
memcpy(ret, ctx, prealloc_size);
|
|
||||||
secp256k1_ecmult_gen_context_finalize_memcpy(&ret->ecmult_gen_ctx, &ctx->ecmult_gen_ctx);
|
|
||||||
secp256k1_ecmult_context_finalize_memcpy(&ret->ecmult_ctx, &ctx->ecmult_ctx);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_context* secp256k1_context_clone(const secp256k1_context* ctx) {
|
|
||||||
secp256k1_context* ret;
|
|
||||||
size_t prealloc_size;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
prealloc_size = secp256k1_context_preallocated_clone_size(ctx);
|
|
||||||
ret = (secp256k1_context*)checked_malloc(&ctx->error_callback, prealloc_size);
|
|
||||||
ret = secp256k1_context_preallocated_clone(ctx, ret);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
void secp256k1_context_preallocated_destroy(secp256k1_context* ctx) {
|
|
||||||
ARG_CHECK_NO_RETURN(ctx != secp256k1_context_no_precomp);
|
|
||||||
if (ctx != NULL) {
|
|
||||||
secp256k1_ecmult_context_clear(&ctx->ecmult_ctx);
|
|
||||||
secp256k1_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void secp256k1_context_destroy(secp256k1_context* ctx) {
|
|
||||||
if (ctx != NULL) {
|
|
||||||
secp256k1_context_preallocated_destroy(ctx);
|
|
||||||
free(ctx);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void secp256k1_context_set_illegal_callback(secp256k1_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
|
|
||||||
ARG_CHECK_NO_RETURN(ctx != secp256k1_context_no_precomp);
|
|
||||||
if (fun == NULL) {
|
|
||||||
fun = secp256k1_default_illegal_callback_fn;
|
|
||||||
}
|
|
||||||
ctx->illegal_callback.fn = fun;
|
|
||||||
ctx->illegal_callback.data = data;
|
|
||||||
}
|
|
||||||
|
|
||||||
void secp256k1_context_set_error_callback(secp256k1_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
|
|
||||||
ARG_CHECK_NO_RETURN(ctx != secp256k1_context_no_precomp);
|
|
||||||
if (fun == NULL) {
|
|
||||||
fun = secp256k1_default_error_callback_fn;
|
|
||||||
}
|
|
||||||
ctx->error_callback.fn = fun;
|
|
||||||
ctx->error_callback.data = data;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scratch_space* secp256k1_scratch_space_create(const secp256k1_context* ctx, size_t max_size) {
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
return secp256k1_scratch_create(&ctx->error_callback, max_size);
|
|
||||||
}
|
|
||||||
|
|
||||||
void secp256k1_scratch_space_destroy(const secp256k1_context *ctx, secp256k1_scratch_space* scratch) {
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
secp256k1_scratch_destroy(&ctx->error_callback, scratch);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int secp256k1_pubkey_load(const secp256k1_context* ctx, secp256k1_ge* ge, const secp256k1_pubkey* pubkey) {
|
|
||||||
if (sizeof(secp256k1_ge_storage) == 64) {
|
|
||||||
/* When the secp256k1_ge_storage type is exactly 64 byte, use its
|
|
||||||
* representation inside secp256k1_pubkey, as conversion is very fast.
|
|
||||||
* Note that secp256k1_pubkey_save must use the same representation. */
|
|
||||||
secp256k1_ge_storage s;
|
|
||||||
memcpy(&s, &pubkey->data[0], sizeof(s));
|
|
||||||
secp256k1_ge_from_storage(ge, &s);
|
|
||||||
} else {
|
|
||||||
/* Otherwise, fall back to 32-byte big endian for X and Y. */
|
|
||||||
secp256k1_fe x, y;
|
|
||||||
secp256k1_fe_set_b32(&x, pubkey->data);
|
|
||||||
secp256k1_fe_set_b32(&y, pubkey->data + 32);
|
|
||||||
secp256k1_ge_set_xy(ge, &x, &y);
|
|
||||||
}
|
|
||||||
ARG_CHECK(!secp256k1_fe_is_zero(&ge->x));
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_pubkey_save(secp256k1_pubkey* pubkey, secp256k1_ge* ge) {
|
|
||||||
if (sizeof(secp256k1_ge_storage) == 64) {
|
|
||||||
secp256k1_ge_storage s;
|
|
||||||
secp256k1_ge_to_storage(&s, ge);
|
|
||||||
memcpy(&pubkey->data[0], &s, sizeof(s));
|
|
||||||
} else {
|
|
||||||
VERIFY_CHECK(!secp256k1_ge_is_infinity(ge));
|
|
||||||
secp256k1_fe_normalize_var(&ge->x);
|
|
||||||
secp256k1_fe_normalize_var(&ge->y);
|
|
||||||
secp256k1_fe_get_b32(pubkey->data, &ge->x);
|
|
||||||
secp256k1_fe_get_b32(pubkey->data + 32, &ge->y);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_pubkey_parse(const secp256k1_context* ctx, secp256k1_pubkey* pubkey, const unsigned char *input, size_t inputlen) {
|
|
||||||
secp256k1_ge Q;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
memset(pubkey, 0, sizeof(*pubkey));
|
|
||||||
ARG_CHECK(input != NULL);
|
|
||||||
if (!secp256k1_eckey_pubkey_parse(&Q, input, inputlen)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_pubkey_save(pubkey, &Q);
|
|
||||||
secp256k1_ge_clear(&Q);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_pubkey_serialize(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey* pubkey, unsigned int flags) {
|
|
||||||
secp256k1_ge Q;
|
|
||||||
size_t len;
|
|
||||||
int ret = 0;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(outputlen != NULL);
|
|
||||||
ARG_CHECK(*outputlen >= ((flags & SECP256K1_FLAGS_BIT_COMPRESSION) ? 33 : 65));
|
|
||||||
len = *outputlen;
|
|
||||||
*outputlen = 0;
|
|
||||||
ARG_CHECK(output != NULL);
|
|
||||||
memset(output, 0, len);
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
ARG_CHECK((flags & SECP256K1_FLAGS_TYPE_MASK) == SECP256K1_FLAGS_TYPE_COMPRESSION);
|
|
||||||
if (secp256k1_pubkey_load(ctx, &Q, pubkey)) {
|
|
||||||
ret = secp256k1_eckey_pubkey_serialize(&Q, output, &len, flags & SECP256K1_FLAGS_BIT_COMPRESSION);
|
|
||||||
if (ret) {
|
|
||||||
*outputlen = len;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecdsa_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_ecdsa_signature* sig) {
|
|
||||||
(void)ctx;
|
|
||||||
if (sizeof(secp256k1_scalar) == 32) {
|
|
||||||
/* When the secp256k1_scalar type is exactly 32 byte, use its
|
|
||||||
* representation inside secp256k1_ecdsa_signature, as conversion is very fast.
|
|
||||||
* Note that secp256k1_ecdsa_signature_save must use the same representation. */
|
|
||||||
memcpy(r, &sig->data[0], 32);
|
|
||||||
memcpy(s, &sig->data[32], 32);
|
|
||||||
} else {
|
|
||||||
secp256k1_scalar_set_b32(r, &sig->data[0], NULL);
|
|
||||||
secp256k1_scalar_set_b32(s, &sig->data[32], NULL);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_ecdsa_signature_save(secp256k1_ecdsa_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s) {
|
|
||||||
if (sizeof(secp256k1_scalar) == 32) {
|
|
||||||
memcpy(&sig->data[0], r, 32);
|
|
||||||
memcpy(&sig->data[32], s, 32);
|
|
||||||
} else {
|
|
||||||
secp256k1_scalar_get_b32(&sig->data[0], r);
|
|
||||||
secp256k1_scalar_get_b32(&sig->data[32], s);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_signature_parse_der(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
ARG_CHECK(input != NULL);
|
|
||||||
|
|
||||||
if (secp256k1_ecdsa_sig_parse(&r, &s, input, inputlen)) {
|
|
||||||
secp256k1_ecdsa_signature_save(sig, &r, &s);
|
|
||||||
return 1;
|
|
||||||
} else {
|
|
||||||
memset(sig, 0, sizeof(*sig));
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input64) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
int ret = 1;
|
|
||||||
int overflow = 0;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
ARG_CHECK(input64 != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&r, &input64[0], &overflow);
|
|
||||||
ret &= !overflow;
|
|
||||||
secp256k1_scalar_set_b32(&s, &input64[32], &overflow);
|
|
||||||
ret &= !overflow;
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_ecdsa_signature_save(sig, &r, &s);
|
|
||||||
} else {
|
|
||||||
memset(sig, 0, sizeof(*sig));
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature* sig) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(output != NULL);
|
|
||||||
ARG_CHECK(outputlen != NULL);
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
|
|
||||||
return secp256k1_ecdsa_sig_serialize(output, outputlen, &r, &s);
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, const secp256k1_ecdsa_signature* sig) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(output64 != NULL);
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
|
|
||||||
secp256k1_scalar_get_b32(&output64[0], &r);
|
|
||||||
secp256k1_scalar_get_b32(&output64[32], &s);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_signature_normalize(const secp256k1_context* ctx, secp256k1_ecdsa_signature *sigout, const secp256k1_ecdsa_signature *sigin) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
int ret = 0;
|
|
||||||
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(sigin != NULL);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_signature_load(ctx, &r, &s, sigin);
|
|
||||||
ret = secp256k1_scalar_is_high(&s);
|
|
||||||
if (sigout != NULL) {
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_scalar_negate(&s, &s);
|
|
||||||
}
|
|
||||||
secp256k1_ecdsa_signature_save(sigout, &r, &s);
|
|
||||||
}
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_verify(const secp256k1_context* ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msg32, const secp256k1_pubkey *pubkey) {
|
|
||||||
secp256k1_ge q;
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
secp256k1_scalar m;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
|
|
||||||
ARG_CHECK(msg32 != NULL);
|
|
||||||
ARG_CHECK(sig != NULL);
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&m, msg32, NULL);
|
|
||||||
secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
|
|
||||||
return (!secp256k1_scalar_is_high(&s) &&
|
|
||||||
secp256k1_pubkey_load(ctx, &q, pubkey) &&
|
|
||||||
secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &r, &s, &q, &m));
|
|
||||||
}
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void buffer_append(unsigned char *buf, unsigned int *offset, const void *data, unsigned int len) {
|
|
||||||
memcpy(buf + *offset, data, len);
|
|
||||||
*offset += len;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int nonce_function_rfc6979(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
|
|
||||||
unsigned char keydata[112];
|
|
||||||
unsigned int offset = 0;
|
|
||||||
secp256k1_rfc6979_hmac_sha256 rng;
|
|
||||||
unsigned int i;
|
|
||||||
/* We feed a byte array to the PRNG as input, consisting of:
|
|
||||||
* - the private key (32 bytes) and message (32 bytes), see RFC 6979 3.2d.
|
|
||||||
* - optionally 32 extra bytes of data, see RFC 6979 3.6 Additional Data.
|
|
||||||
* - optionally 16 extra bytes with the algorithm name.
|
|
||||||
* Because the arguments have distinct fixed lengths it is not possible for
|
|
||||||
* different argument mixtures to emulate each other and result in the same
|
|
||||||
* nonces.
|
|
||||||
*/
|
|
||||||
buffer_append(keydata, &offset, key32, 32);
|
|
||||||
buffer_append(keydata, &offset, msg32, 32);
|
|
||||||
if (data != NULL) {
|
|
||||||
buffer_append(keydata, &offset, data, 32);
|
|
||||||
}
|
|
||||||
if (algo16 != NULL) {
|
|
||||||
buffer_append(keydata, &offset, algo16, 16);
|
|
||||||
}
|
|
||||||
secp256k1_rfc6979_hmac_sha256_initialize(&rng, keydata, offset);
|
|
||||||
memset(keydata, 0, sizeof(keydata));
|
|
||||||
for (i = 0; i <= counter; i++) {
|
|
||||||
secp256k1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
|
|
||||||
}
|
|
||||||
secp256k1_rfc6979_hmac_sha256_finalize(&rng);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
const secp256k1_nonce_function secp256k1_nonce_function_rfc6979 = nonce_function_rfc6979;
|
|
||||||
const secp256k1_nonce_function secp256k1_nonce_function_default = nonce_function_rfc6979;
|
|
||||||
|
|
||||||
int secp256k1_ecdsa_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signature *signature, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
|
|
||||||
secp256k1_scalar r, s;
|
|
||||||
secp256k1_scalar sec, non, msg;
|
|
||||||
int ret = 0;
|
|
||||||
int overflow = 0;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
|
|
||||||
ARG_CHECK(msg32 != NULL);
|
|
||||||
ARG_CHECK(signature != NULL);
|
|
||||||
ARG_CHECK(seckey != NULL);
|
|
||||||
if (noncefp == NULL) {
|
|
||||||
noncefp = secp256k1_nonce_function_default;
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&sec, seckey, &overflow);
|
|
||||||
/* Fail if the secret key is invalid. */
|
|
||||||
if (!overflow && !secp256k1_scalar_is_zero(&sec)) {
|
|
||||||
unsigned char nonce32[32];
|
|
||||||
unsigned int count = 0;
|
|
||||||
secp256k1_scalar_set_b32(&msg, msg32, NULL);
|
|
||||||
while (1) {
|
|
||||||
ret = noncefp(nonce32, msg32, seckey, NULL, (void*)noncedata, count);
|
|
||||||
if (!ret) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
secp256k1_scalar_set_b32(&non, nonce32, &overflow);
|
|
||||||
if (!overflow && !secp256k1_scalar_is_zero(&non)) {
|
|
||||||
if (secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, &r, &s, &sec, &msg, &non, NULL)) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
count++;
|
|
||||||
}
|
|
||||||
memset(nonce32, 0, 32);
|
|
||||||
secp256k1_scalar_clear(&msg);
|
|
||||||
secp256k1_scalar_clear(&non);
|
|
||||||
secp256k1_scalar_clear(&sec);
|
|
||||||
}
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_ecdsa_signature_save(signature, &r, &s);
|
|
||||||
} else {
|
|
||||||
memset(signature, 0, sizeof(*signature));
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_seckey_verify(const secp256k1_context* ctx, const unsigned char *seckey) {
|
|
||||||
secp256k1_scalar sec;
|
|
||||||
int ret;
|
|
||||||
int overflow;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(seckey != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&sec, seckey, &overflow);
|
|
||||||
ret = !overflow && !secp256k1_scalar_is_zero(&sec);
|
|
||||||
secp256k1_scalar_clear(&sec);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_pubkey_create(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) {
|
|
||||||
secp256k1_gej pj;
|
|
||||||
secp256k1_ge p;
|
|
||||||
secp256k1_scalar sec;
|
|
||||||
int overflow;
|
|
||||||
int ret = 0;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
memset(pubkey, 0, sizeof(*pubkey));
|
|
||||||
ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
|
|
||||||
ARG_CHECK(seckey != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&sec, seckey, &overflow);
|
|
||||||
ret = !overflow && !secp256k1_scalar_is_zero(&sec);
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pj, &sec);
|
|
||||||
secp256k1_ge_set_gej(&p, &pj);
|
|
||||||
secp256k1_pubkey_save(pubkey, &p);
|
|
||||||
}
|
|
||||||
secp256k1_scalar_clear(&sec);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_privkey_negate(const secp256k1_context* ctx, unsigned char *seckey) {
|
|
||||||
secp256k1_scalar sec;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(seckey != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&sec, seckey, NULL);
|
|
||||||
secp256k1_scalar_negate(&sec, &sec);
|
|
||||||
secp256k1_scalar_get_b32(seckey, &sec);
|
|
||||||
|
|
||||||
secp256k1_scalar_clear(&sec);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_pubkey_negate(const secp256k1_context* ctx, secp256k1_pubkey *pubkey) {
|
|
||||||
int ret = 0;
|
|
||||||
secp256k1_ge p;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
|
|
||||||
ret = secp256k1_pubkey_load(ctx, &p, pubkey);
|
|
||||||
memset(pubkey, 0, sizeof(*pubkey));
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_ge_neg(&p, &p);
|
|
||||||
secp256k1_pubkey_save(pubkey, &p);
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_privkey_tweak_add(const secp256k1_context* ctx, unsigned char *seckey, const unsigned char *tweak) {
|
|
||||||
secp256k1_scalar term;
|
|
||||||
secp256k1_scalar sec;
|
|
||||||
int ret = 0;
|
|
||||||
int overflow = 0;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(seckey != NULL);
|
|
||||||
ARG_CHECK(tweak != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&term, tweak, &overflow);
|
|
||||||
secp256k1_scalar_set_b32(&sec, seckey, NULL);
|
|
||||||
|
|
||||||
ret = !overflow && secp256k1_eckey_privkey_tweak_add(&sec, &term);
|
|
||||||
memset(seckey, 0, 32);
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_scalar_get_b32(seckey, &sec);
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_clear(&sec);
|
|
||||||
secp256k1_scalar_clear(&term);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_pubkey_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *tweak) {
|
|
||||||
secp256k1_ge p;
|
|
||||||
secp256k1_scalar term;
|
|
||||||
int ret = 0;
|
|
||||||
int overflow = 0;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
ARG_CHECK(tweak != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&term, tweak, &overflow);
|
|
||||||
ret = !overflow && secp256k1_pubkey_load(ctx, &p, pubkey);
|
|
||||||
memset(pubkey, 0, sizeof(*pubkey));
|
|
||||||
if (ret) {
|
|
||||||
if (secp256k1_eckey_pubkey_tweak_add(&ctx->ecmult_ctx, &p, &term)) {
|
|
||||||
secp256k1_pubkey_save(pubkey, &p);
|
|
||||||
} else {
|
|
||||||
ret = 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_privkey_tweak_mul(const secp256k1_context* ctx, unsigned char *seckey, const unsigned char *tweak) {
|
|
||||||
secp256k1_scalar factor;
|
|
||||||
secp256k1_scalar sec;
|
|
||||||
int ret = 0;
|
|
||||||
int overflow = 0;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(seckey != NULL);
|
|
||||||
ARG_CHECK(tweak != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&factor, tweak, &overflow);
|
|
||||||
secp256k1_scalar_set_b32(&sec, seckey, NULL);
|
|
||||||
ret = !overflow && secp256k1_eckey_privkey_tweak_mul(&sec, &factor);
|
|
||||||
memset(seckey, 0, 32);
|
|
||||||
if (ret) {
|
|
||||||
secp256k1_scalar_get_b32(seckey, &sec);
|
|
||||||
}
|
|
||||||
|
|
||||||
secp256k1_scalar_clear(&sec);
|
|
||||||
secp256k1_scalar_clear(&factor);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_pubkey_tweak_mul(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *tweak) {
|
|
||||||
secp256k1_ge p;
|
|
||||||
secp256k1_scalar factor;
|
|
||||||
int ret = 0;
|
|
||||||
int overflow = 0;
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
|
|
||||||
ARG_CHECK(pubkey != NULL);
|
|
||||||
ARG_CHECK(tweak != NULL);
|
|
||||||
|
|
||||||
secp256k1_scalar_set_b32(&factor, tweak, &overflow);
|
|
||||||
ret = !overflow && secp256k1_pubkey_load(ctx, &p, pubkey);
|
|
||||||
memset(pubkey, 0, sizeof(*pubkey));
|
|
||||||
if (ret) {
|
|
||||||
if (secp256k1_eckey_pubkey_tweak_mul(&ctx->ecmult_ctx, &p, &factor)) {
|
|
||||||
secp256k1_pubkey_save(pubkey, &p);
|
|
||||||
} else {
|
|
||||||
ret = 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_context_randomize(secp256k1_context* ctx, const unsigned char *seed32) {
|
|
||||||
VERIFY_CHECK(ctx != NULL);
|
|
||||||
if (secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)) {
|
|
||||||
secp256k1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, seed32);
|
|
||||||
}
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
int secp256k1_ec_pubkey_combine(const secp256k1_context* ctx, secp256k1_pubkey *pubnonce, const secp256k1_pubkey * const *pubnonces, size_t n) {
|
|
||||||
size_t i;
|
|
||||||
secp256k1_gej Qj;
|
|
||||||
secp256k1_ge Q;
|
|
||||||
|
|
||||||
ARG_CHECK(pubnonce != NULL);
|
|
||||||
memset(pubnonce, 0, sizeof(*pubnonce));
|
|
||||||
ARG_CHECK(n >= 1);
|
|
||||||
ARG_CHECK(pubnonces != NULL);
|
|
||||||
|
|
||||||
secp256k1_gej_set_infinity(&Qj);
|
|
||||||
|
|
||||||
for (i = 0; i < n; i++) {
|
|
||||||
secp256k1_pubkey_load(ctx, &Q, pubnonces[i]);
|
|
||||||
secp256k1_gej_add_ge(&Qj, &Qj, &Q);
|
|
||||||
}
|
|
||||||
if (secp256k1_gej_is_infinity(&Qj)) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
secp256k1_ge_set_gej(&Q, &Qj);
|
|
||||||
secp256k1_pubkey_save(pubnonce, &Q);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef ENABLE_MODULE_ECDH
|
|
||||||
# include "modules/ecdh/main_impl.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef ENABLE_MODULE_RECOVERY
|
|
||||||
# include "modules/recovery/main_impl.h"
|
|
||||||
#endif
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_TESTRAND_H
|
|
||||||
#define SECP256K1_TESTRAND_H
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* A non-cryptographic RNG used only for test infrastructure. */
|
|
||||||
|
|
||||||
/** Seed the pseudorandom number generator for testing. */
|
|
||||||
SECP256K1_INLINE static void secp256k1_rand_seed(const unsigned char *seed16);
|
|
||||||
|
|
||||||
/** Generate a pseudorandom number in the range [0..2**32-1]. */
|
|
||||||
static uint32_t secp256k1_rand32(void);
|
|
||||||
|
|
||||||
/** Generate a pseudorandom number in the range [0..2**bits-1]. Bits must be 1 or
|
|
||||||
* more. */
|
|
||||||
static uint32_t secp256k1_rand_bits(int bits);
|
|
||||||
|
|
||||||
/** Generate a pseudorandom number in the range [0..range-1]. */
|
|
||||||
static uint32_t secp256k1_rand_int(uint32_t range);
|
|
||||||
|
|
||||||
/** Generate a pseudorandom 32-byte array. */
|
|
||||||
static void secp256k1_rand256(unsigned char *b32);
|
|
||||||
|
|
||||||
/** Generate a pseudorandom 32-byte array with long sequences of zero and one bits. */
|
|
||||||
static void secp256k1_rand256_test(unsigned char *b32);
|
|
||||||
|
|
||||||
/** Generate pseudorandom bytes with long sequences of zero and one bits. */
|
|
||||||
static void secp256k1_rand_bytes_test(unsigned char *bytes, size_t len);
|
|
||||||
|
|
||||||
#endif /* SECP256K1_TESTRAND_H */
|
|
||||||
@ -1,110 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013-2015 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_TESTRAND_IMPL_H
|
|
||||||
#define SECP256K1_TESTRAND_IMPL_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
#include "testrand.h"
|
|
||||||
#include "hash.h"
|
|
||||||
|
|
||||||
static secp256k1_rfc6979_hmac_sha256 secp256k1_test_rng;
|
|
||||||
static uint32_t secp256k1_test_rng_precomputed[8];
|
|
||||||
static int secp256k1_test_rng_precomputed_used = 8;
|
|
||||||
static uint64_t secp256k1_test_rng_integer;
|
|
||||||
static int secp256k1_test_rng_integer_bits_left = 0;
|
|
||||||
|
|
||||||
SECP256K1_INLINE static void secp256k1_rand_seed(const unsigned char *seed16) {
|
|
||||||
secp256k1_rfc6979_hmac_sha256_initialize(&secp256k1_test_rng, seed16, 16);
|
|
||||||
}
|
|
||||||
|
|
||||||
SECP256K1_INLINE static uint32_t secp256k1_rand32(void) {
|
|
||||||
if (secp256k1_test_rng_precomputed_used == 8) {
|
|
||||||
secp256k1_rfc6979_hmac_sha256_generate(&secp256k1_test_rng, (unsigned char*)(&secp256k1_test_rng_precomputed[0]), sizeof(secp256k1_test_rng_precomputed));
|
|
||||||
secp256k1_test_rng_precomputed_used = 0;
|
|
||||||
}
|
|
||||||
return secp256k1_test_rng_precomputed[secp256k1_test_rng_precomputed_used++];
|
|
||||||
}
|
|
||||||
|
|
||||||
static uint32_t secp256k1_rand_bits(int bits) {
|
|
||||||
uint32_t ret;
|
|
||||||
if (secp256k1_test_rng_integer_bits_left < bits) {
|
|
||||||
secp256k1_test_rng_integer |= (((uint64_t)secp256k1_rand32()) << secp256k1_test_rng_integer_bits_left);
|
|
||||||
secp256k1_test_rng_integer_bits_left += 32;
|
|
||||||
}
|
|
||||||
ret = secp256k1_test_rng_integer;
|
|
||||||
secp256k1_test_rng_integer >>= bits;
|
|
||||||
secp256k1_test_rng_integer_bits_left -= bits;
|
|
||||||
ret &= ((~((uint32_t)0)) >> (32 - bits));
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static uint32_t secp256k1_rand_int(uint32_t range) {
|
|
||||||
/* We want a uniform integer between 0 and range-1, inclusive.
|
|
||||||
* B is the smallest number such that range <= 2**B.
|
|
||||||
* two mechanisms implemented here:
|
|
||||||
* - generate B bits numbers until one below range is found, and return it
|
|
||||||
* - find the largest multiple M of range that is <= 2**(B+A), generate B+A
|
|
||||||
* bits numbers until one below M is found, and return it modulo range
|
|
||||||
* The second mechanism consumes A more bits of entropy in every iteration,
|
|
||||||
* but may need fewer iterations due to M being closer to 2**(B+A) then
|
|
||||||
* range is to 2**B. The array below (indexed by B) contains a 0 when the
|
|
||||||
* first mechanism is to be used, and the number A otherwise.
|
|
||||||
*/
|
|
||||||
static const int addbits[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 2, 1, 0};
|
|
||||||
uint32_t trange, mult;
|
|
||||||
int bits = 0;
|
|
||||||
if (range <= 1) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
trange = range - 1;
|
|
||||||
while (trange > 0) {
|
|
||||||
trange >>= 1;
|
|
||||||
bits++;
|
|
||||||
}
|
|
||||||
if (addbits[bits]) {
|
|
||||||
bits = bits + addbits[bits];
|
|
||||||
mult = ((~((uint32_t)0)) >> (32 - bits)) / range;
|
|
||||||
trange = range * mult;
|
|
||||||
} else {
|
|
||||||
trange = range;
|
|
||||||
mult = 1;
|
|
||||||
}
|
|
||||||
while(1) {
|
|
||||||
uint32_t x = secp256k1_rand_bits(bits);
|
|
||||||
if (x < trange) {
|
|
||||||
return (mult == 1) ? x : (x % range);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_rand256(unsigned char *b32) {
|
|
||||||
secp256k1_rfc6979_hmac_sha256_generate(&secp256k1_test_rng, b32, 32);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_rand_bytes_test(unsigned char *bytes, size_t len) {
|
|
||||||
size_t bits = 0;
|
|
||||||
memset(bytes, 0, len);
|
|
||||||
while (bits < len * 8) {
|
|
||||||
int now;
|
|
||||||
uint32_t val;
|
|
||||||
now = 1 + (secp256k1_rand_bits(6) * secp256k1_rand_bits(5) + 16) / 31;
|
|
||||||
val = secp256k1_rand_bits(1);
|
|
||||||
while (now > 0 && bits < len * 8) {
|
|
||||||
bytes[bits / 8] |= val << (bits % 8);
|
|
||||||
now--;
|
|
||||||
bits++;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void secp256k1_rand256_test(unsigned char *b32) {
|
|
||||||
secp256k1_rand_bytes_test(b32, 32);
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* SECP256K1_TESTRAND_IMPL_H */
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -1,511 +0,0 @@
|
|||||||
/***********************************************************************
|
|
||||||
* Copyright (c) 2016 Andrew Poelstra *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
|
|
||||||
#include <time.h>
|
|
||||||
|
|
||||||
#undef USE_ECMULT_STATIC_PRECOMPUTATION
|
|
||||||
|
|
||||||
#ifndef EXHAUSTIVE_TEST_ORDER
|
|
||||||
/* see group_impl.h for allowable values */
|
|
||||||
#define EXHAUSTIVE_TEST_ORDER 13
|
|
||||||
#define EXHAUSTIVE_TEST_LAMBDA 9 /* cube root of 1 mod 13 */
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include "include/secp256k1.h"
|
|
||||||
#include "group.h"
|
|
||||||
#include "secp256k1.c"
|
|
||||||
#include "testrand_impl.h"
|
|
||||||
|
|
||||||
#ifdef ENABLE_MODULE_RECOVERY
|
|
||||||
#include "src/modules/recovery/main_impl.h"
|
|
||||||
#include "include/secp256k1_recovery.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/** stolen from tests.c */
|
|
||||||
void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
|
|
||||||
CHECK(a->infinity == b->infinity);
|
|
||||||
if (a->infinity) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
CHECK(secp256k1_fe_equal_var(&a->x, &b->x));
|
|
||||||
CHECK(secp256k1_fe_equal_var(&a->y, &b->y));
|
|
||||||
}
|
|
||||||
|
|
||||||
void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
|
|
||||||
secp256k1_fe z2s;
|
|
||||||
secp256k1_fe u1, u2, s1, s2;
|
|
||||||
CHECK(a->infinity == b->infinity);
|
|
||||||
if (a->infinity) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
/* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */
|
|
||||||
secp256k1_fe_sqr(&z2s, &b->z);
|
|
||||||
secp256k1_fe_mul(&u1, &a->x, &z2s);
|
|
||||||
u2 = b->x; secp256k1_fe_normalize_weak(&u2);
|
|
||||||
secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
|
|
||||||
s2 = b->y; secp256k1_fe_normalize_weak(&s2);
|
|
||||||
CHECK(secp256k1_fe_equal_var(&u1, &u2));
|
|
||||||
CHECK(secp256k1_fe_equal_var(&s1, &s2));
|
|
||||||
}
|
|
||||||
|
|
||||||
void random_fe(secp256k1_fe *x) {
|
|
||||||
unsigned char bin[32];
|
|
||||||
do {
|
|
||||||
secp256k1_rand256(bin);
|
|
||||||
if (secp256k1_fe_set_b32(x, bin)) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
} while(1);
|
|
||||||
}
|
|
||||||
/** END stolen from tests.c */
|
|
||||||
|
|
||||||
int secp256k1_nonce_function_smallint(unsigned char *nonce32, const unsigned char *msg32,
|
|
||||||
const unsigned char *key32, const unsigned char *algo16,
|
|
||||||
void *data, unsigned int attempt) {
|
|
||||||
secp256k1_scalar s;
|
|
||||||
int *idata = data;
|
|
||||||
(void)msg32;
|
|
||||||
(void)key32;
|
|
||||||
(void)algo16;
|
|
||||||
/* Some nonces cannot be used because they'd cause s and/or r to be zero.
|
|
||||||
* The signing function has retry logic here that just re-calls the nonce
|
|
||||||
* function with an increased `attempt`. So if attempt > 0 this means we
|
|
||||||
* need to change the nonce to avoid an infinite loop. */
|
|
||||||
if (attempt > 0) {
|
|
||||||
*idata = (*idata + 1) % EXHAUSTIVE_TEST_ORDER;
|
|
||||||
}
|
|
||||||
secp256k1_scalar_set_int(&s, *idata);
|
|
||||||
secp256k1_scalar_get_b32(nonce32, &s);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
void test_exhaustive_endomorphism(const secp256k1_ge *group, int order) {
|
|
||||||
int i;
|
|
||||||
for (i = 0; i < order; i++) {
|
|
||||||
secp256k1_ge res;
|
|
||||||
secp256k1_ge_mul_lambda(&res, &group[i]);
|
|
||||||
ge_equals_ge(&group[i * EXHAUSTIVE_TEST_LAMBDA % EXHAUSTIVE_TEST_ORDER], &res);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
void test_exhaustive_addition(const secp256k1_ge *group, const secp256k1_gej *groupj, int order) {
|
|
||||||
int i, j;
|
|
||||||
|
|
||||||
/* Sanity-check (and check infinity functions) */
|
|
||||||
CHECK(secp256k1_ge_is_infinity(&group[0]));
|
|
||||||
CHECK(secp256k1_gej_is_infinity(&groupj[0]));
|
|
||||||
for (i = 1; i < order; i++) {
|
|
||||||
CHECK(!secp256k1_ge_is_infinity(&group[i]));
|
|
||||||
CHECK(!secp256k1_gej_is_infinity(&groupj[i]));
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Check all addition formulae */
|
|
||||||
for (j = 0; j < order; j++) {
|
|
||||||
secp256k1_fe fe_inv;
|
|
||||||
secp256k1_fe_inv(&fe_inv, &groupj[j].z);
|
|
||||||
for (i = 0; i < order; i++) {
|
|
||||||
secp256k1_ge zless_gej;
|
|
||||||
secp256k1_gej tmp;
|
|
||||||
/* add_var */
|
|
||||||
secp256k1_gej_add_var(&tmp, &groupj[i], &groupj[j], NULL);
|
|
||||||
ge_equals_gej(&group[(i + j) % order], &tmp);
|
|
||||||
/* add_ge */
|
|
||||||
if (j > 0) {
|
|
||||||
secp256k1_gej_add_ge(&tmp, &groupj[i], &group[j]);
|
|
||||||
ge_equals_gej(&group[(i + j) % order], &tmp);
|
|
||||||
}
|
|
||||||
/* add_ge_var */
|
|
||||||
secp256k1_gej_add_ge_var(&tmp, &groupj[i], &group[j], NULL);
|
|
||||||
ge_equals_gej(&group[(i + j) % order], &tmp);
|
|
||||||
/* add_zinv_var */
|
|
||||||
zless_gej.infinity = groupj[j].infinity;
|
|
||||||
zless_gej.x = groupj[j].x;
|
|
||||||
zless_gej.y = groupj[j].y;
|
|
||||||
secp256k1_gej_add_zinv_var(&tmp, &groupj[i], &zless_gej, &fe_inv);
|
|
||||||
ge_equals_gej(&group[(i + j) % order], &tmp);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Check doubling */
|
|
||||||
for (i = 0; i < order; i++) {
|
|
||||||
secp256k1_gej tmp;
|
|
||||||
if (i > 0) {
|
|
||||||
secp256k1_gej_double_nonzero(&tmp, &groupj[i], NULL);
|
|
||||||
ge_equals_gej(&group[(2 * i) % order], &tmp);
|
|
||||||
}
|
|
||||||
secp256k1_gej_double_var(&tmp, &groupj[i], NULL);
|
|
||||||
ge_equals_gej(&group[(2 * i) % order], &tmp);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Check negation */
|
|
||||||
for (i = 1; i < order; i++) {
|
|
||||||
secp256k1_ge tmp;
|
|
||||||
secp256k1_gej tmpj;
|
|
||||||
secp256k1_ge_neg(&tmp, &group[i]);
|
|
||||||
ge_equals_ge(&group[order - i], &tmp);
|
|
||||||
secp256k1_gej_neg(&tmpj, &groupj[i]);
|
|
||||||
ge_equals_gej(&group[order - i], &tmpj);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_exhaustive_ecmult(const secp256k1_context *ctx, const secp256k1_ge *group, const secp256k1_gej *groupj, int order) {
|
|
||||||
int i, j, r_log;
|
|
||||||
for (r_log = 1; r_log < order; r_log++) {
|
|
||||||
for (j = 0; j < order; j++) {
|
|
||||||
for (i = 0; i < order; i++) {
|
|
||||||
secp256k1_gej tmp;
|
|
||||||
secp256k1_scalar na, ng;
|
|
||||||
secp256k1_scalar_set_int(&na, i);
|
|
||||||
secp256k1_scalar_set_int(&ng, j);
|
|
||||||
|
|
||||||
secp256k1_ecmult(&ctx->ecmult_ctx, &tmp, &groupj[r_log], &na, &ng);
|
|
||||||
ge_equals_gej(&group[(i * r_log + j) % order], &tmp);
|
|
||||||
|
|
||||||
if (i > 0) {
|
|
||||||
secp256k1_ecmult_const(&tmp, &group[i], &ng, 256);
|
|
||||||
ge_equals_gej(&group[(i * j) % order], &tmp);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
secp256k1_scalar sc[2];
|
|
||||||
secp256k1_ge pt[2];
|
|
||||||
} ecmult_multi_data;
|
|
||||||
|
|
||||||
static int ecmult_multi_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *cbdata) {
|
|
||||||
ecmult_multi_data *data = (ecmult_multi_data*) cbdata;
|
|
||||||
*sc = data->sc[idx];
|
|
||||||
*pt = data->pt[idx];
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_exhaustive_ecmult_multi(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
|
|
||||||
int i, j, k, x, y;
|
|
||||||
secp256k1_scratch *scratch = secp256k1_scratch_create(&ctx->error_callback, 4096);
|
|
||||||
for (i = 0; i < order; i++) {
|
|
||||||
for (j = 0; j < order; j++) {
|
|
||||||
for (k = 0; k < order; k++) {
|
|
||||||
for (x = 0; x < order; x++) {
|
|
||||||
for (y = 0; y < order; y++) {
|
|
||||||
secp256k1_gej tmp;
|
|
||||||
secp256k1_scalar g_sc;
|
|
||||||
ecmult_multi_data data;
|
|
||||||
|
|
||||||
secp256k1_scalar_set_int(&data.sc[0], i);
|
|
||||||
secp256k1_scalar_set_int(&data.sc[1], j);
|
|
||||||
secp256k1_scalar_set_int(&g_sc, k);
|
|
||||||
data.pt[0] = group[x];
|
|
||||||
data.pt[1] = group[y];
|
|
||||||
|
|
||||||
secp256k1_ecmult_multi_var(&ctx->error_callback, &ctx->ecmult_ctx, scratch, &tmp, &g_sc, ecmult_multi_callback, &data, 2);
|
|
||||||
ge_equals_gej(&group[(i * x + j * y + k) % order], &tmp);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
secp256k1_scratch_destroy(&ctx->error_callback, scratch);
|
|
||||||
}
|
|
||||||
|
|
||||||
void r_from_k(secp256k1_scalar *r, const secp256k1_ge *group, int k) {
|
|
||||||
secp256k1_fe x;
|
|
||||||
unsigned char x_bin[32];
|
|
||||||
k %= EXHAUSTIVE_TEST_ORDER;
|
|
||||||
x = group[k].x;
|
|
||||||
secp256k1_fe_normalize(&x);
|
|
||||||
secp256k1_fe_get_b32(x_bin, &x);
|
|
||||||
secp256k1_scalar_set_b32(r, x_bin, NULL);
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_exhaustive_verify(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
|
|
||||||
int s, r, msg, key;
|
|
||||||
for (s = 1; s < order; s++) {
|
|
||||||
for (r = 1; r < order; r++) {
|
|
||||||
for (msg = 1; msg < order; msg++) {
|
|
||||||
for (key = 1; key < order; key++) {
|
|
||||||
secp256k1_ge nonconst_ge;
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
secp256k1_pubkey pk;
|
|
||||||
secp256k1_scalar sk_s, msg_s, r_s, s_s;
|
|
||||||
secp256k1_scalar s_times_k_s, msg_plus_r_times_sk_s;
|
|
||||||
int k, should_verify;
|
|
||||||
unsigned char msg32[32];
|
|
||||||
|
|
||||||
secp256k1_scalar_set_int(&s_s, s);
|
|
||||||
secp256k1_scalar_set_int(&r_s, r);
|
|
||||||
secp256k1_scalar_set_int(&msg_s, msg);
|
|
||||||
secp256k1_scalar_set_int(&sk_s, key);
|
|
||||||
|
|
||||||
/* Verify by hand */
|
|
||||||
/* Run through every k value that gives us this r and check that *one* works.
|
|
||||||
* Note there could be none, there could be multiple, ECDSA is weird. */
|
|
||||||
should_verify = 0;
|
|
||||||
for (k = 0; k < order; k++) {
|
|
||||||
secp256k1_scalar check_x_s;
|
|
||||||
r_from_k(&check_x_s, group, k);
|
|
||||||
if (r_s == check_x_s) {
|
|
||||||
secp256k1_scalar_set_int(&s_times_k_s, k);
|
|
||||||
secp256k1_scalar_mul(&s_times_k_s, &s_times_k_s, &s_s);
|
|
||||||
secp256k1_scalar_mul(&msg_plus_r_times_sk_s, &r_s, &sk_s);
|
|
||||||
secp256k1_scalar_add(&msg_plus_r_times_sk_s, &msg_plus_r_times_sk_s, &msg_s);
|
|
||||||
should_verify |= secp256k1_scalar_eq(&s_times_k_s, &msg_plus_r_times_sk_s);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
/* nb we have a "high s" rule */
|
|
||||||
should_verify &= !secp256k1_scalar_is_high(&s_s);
|
|
||||||
|
|
||||||
/* Verify by calling verify */
|
|
||||||
secp256k1_ecdsa_signature_save(&sig, &r_s, &s_s);
|
|
||||||
memcpy(&nonconst_ge, &group[sk_s], sizeof(nonconst_ge));
|
|
||||||
secp256k1_pubkey_save(&pk, &nonconst_ge);
|
|
||||||
secp256k1_scalar_get_b32(msg32, &msg_s);
|
|
||||||
CHECK(should_verify ==
|
|
||||||
secp256k1_ecdsa_verify(ctx, &sig, msg32, &pk));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_exhaustive_sign(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
|
|
||||||
int i, j, k;
|
|
||||||
|
|
||||||
/* Loop */
|
|
||||||
for (i = 1; i < order; i++) { /* message */
|
|
||||||
for (j = 1; j < order; j++) { /* key */
|
|
||||||
for (k = 1; k < order; k++) { /* nonce */
|
|
||||||
const int starting_k = k;
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
secp256k1_scalar sk, msg, r, s, expected_r;
|
|
||||||
unsigned char sk32[32], msg32[32];
|
|
||||||
secp256k1_scalar_set_int(&msg, i);
|
|
||||||
secp256k1_scalar_set_int(&sk, j);
|
|
||||||
secp256k1_scalar_get_b32(sk32, &sk);
|
|
||||||
secp256k1_scalar_get_b32(msg32, &msg);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_sign(ctx, &sig, msg32, sk32, secp256k1_nonce_function_smallint, &k);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_signature_load(ctx, &r, &s, &sig);
|
|
||||||
/* Note that we compute expected_r *after* signing -- this is important
|
|
||||||
* because our nonce-computing function function might change k during
|
|
||||||
* signing. */
|
|
||||||
r_from_k(&expected_r, group, k);
|
|
||||||
CHECK(r == expected_r);
|
|
||||||
CHECK((k * s) % order == (i + r * j) % order ||
|
|
||||||
(k * (EXHAUSTIVE_TEST_ORDER - s)) % order == (i + r * j) % order);
|
|
||||||
|
|
||||||
/* Overflow means we've tried every possible nonce */
|
|
||||||
if (k < starting_k) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/* We would like to verify zero-knowledge here by counting how often every
|
|
||||||
* possible (s, r) tuple appears, but because the group order is larger
|
|
||||||
* than the field order, when coercing the x-values to scalar values, some
|
|
||||||
* appear more often than others, so we are actually not zero-knowledge.
|
|
||||||
* (This effect also appears in the real code, but the difference is on the
|
|
||||||
* order of 1/2^128th the field order, so the deviation is not useful to a
|
|
||||||
* computationally bounded attacker.)
|
|
||||||
*/
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef ENABLE_MODULE_RECOVERY
|
|
||||||
void test_exhaustive_recovery_sign(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
|
|
||||||
int i, j, k;
|
|
||||||
|
|
||||||
/* Loop */
|
|
||||||
for (i = 1; i < order; i++) { /* message */
|
|
||||||
for (j = 1; j < order; j++) { /* key */
|
|
||||||
for (k = 1; k < order; k++) { /* nonce */
|
|
||||||
const int starting_k = k;
|
|
||||||
secp256k1_fe r_dot_y_normalized;
|
|
||||||
secp256k1_ecdsa_recoverable_signature rsig;
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
secp256k1_scalar sk, msg, r, s, expected_r;
|
|
||||||
unsigned char sk32[32], msg32[32];
|
|
||||||
int expected_recid;
|
|
||||||
int recid;
|
|
||||||
secp256k1_scalar_set_int(&msg, i);
|
|
||||||
secp256k1_scalar_set_int(&sk, j);
|
|
||||||
secp256k1_scalar_get_b32(sk32, &sk);
|
|
||||||
secp256k1_scalar_get_b32(msg32, &msg);
|
|
||||||
|
|
||||||
secp256k1_ecdsa_sign_recoverable(ctx, &rsig, msg32, sk32, secp256k1_nonce_function_smallint, &k);
|
|
||||||
|
|
||||||
/* Check directly */
|
|
||||||
secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, &rsig);
|
|
||||||
r_from_k(&expected_r, group, k);
|
|
||||||
CHECK(r == expected_r);
|
|
||||||
CHECK((k * s) % order == (i + r * j) % order ||
|
|
||||||
(k * (EXHAUSTIVE_TEST_ORDER - s)) % order == (i + r * j) % order);
|
|
||||||
/* In computing the recid, there is an overflow condition that is disabled in
|
|
||||||
* scalar_low_impl.h `secp256k1_scalar_set_b32` because almost every r.y value
|
|
||||||
* will exceed the group order, and our signing code always holds out for r
|
|
||||||
* values that don't overflow, so with a proper overflow check the tests would
|
|
||||||
* loop indefinitely. */
|
|
||||||
r_dot_y_normalized = group[k].y;
|
|
||||||
secp256k1_fe_normalize(&r_dot_y_normalized);
|
|
||||||
/* Also the recovery id is flipped depending if we hit the low-s branch */
|
|
||||||
if ((k * s) % order == (i + r * j) % order) {
|
|
||||||
expected_recid = secp256k1_fe_is_odd(&r_dot_y_normalized) ? 1 : 0;
|
|
||||||
} else {
|
|
||||||
expected_recid = secp256k1_fe_is_odd(&r_dot_y_normalized) ? 0 : 1;
|
|
||||||
}
|
|
||||||
CHECK(recid == expected_recid);
|
|
||||||
|
|
||||||
/* Convert to a standard sig then check */
|
|
||||||
secp256k1_ecdsa_recoverable_signature_convert(ctx, &sig, &rsig);
|
|
||||||
secp256k1_ecdsa_signature_load(ctx, &r, &s, &sig);
|
|
||||||
/* Note that we compute expected_r *after* signing -- this is important
|
|
||||||
* because our nonce-computing function function might change k during
|
|
||||||
* signing. */
|
|
||||||
r_from_k(&expected_r, group, k);
|
|
||||||
CHECK(r == expected_r);
|
|
||||||
CHECK((k * s) % order == (i + r * j) % order ||
|
|
||||||
(k * (EXHAUSTIVE_TEST_ORDER - s)) % order == (i + r * j) % order);
|
|
||||||
|
|
||||||
/* Overflow means we've tried every possible nonce */
|
|
||||||
if (k < starting_k) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void test_exhaustive_recovery_verify(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
|
|
||||||
/* This is essentially a copy of test_exhaustive_verify, with recovery added */
|
|
||||||
int s, r, msg, key;
|
|
||||||
for (s = 1; s < order; s++) {
|
|
||||||
for (r = 1; r < order; r++) {
|
|
||||||
for (msg = 1; msg < order; msg++) {
|
|
||||||
for (key = 1; key < order; key++) {
|
|
||||||
secp256k1_ge nonconst_ge;
|
|
||||||
secp256k1_ecdsa_recoverable_signature rsig;
|
|
||||||
secp256k1_ecdsa_signature sig;
|
|
||||||
secp256k1_pubkey pk;
|
|
||||||
secp256k1_scalar sk_s, msg_s, r_s, s_s;
|
|
||||||
secp256k1_scalar s_times_k_s, msg_plus_r_times_sk_s;
|
|
||||||
int recid = 0;
|
|
||||||
int k, should_verify;
|
|
||||||
unsigned char msg32[32];
|
|
||||||
|
|
||||||
secp256k1_scalar_set_int(&s_s, s);
|
|
||||||
secp256k1_scalar_set_int(&r_s, r);
|
|
||||||
secp256k1_scalar_set_int(&msg_s, msg);
|
|
||||||
secp256k1_scalar_set_int(&sk_s, key);
|
|
||||||
secp256k1_scalar_get_b32(msg32, &msg_s);
|
|
||||||
|
|
||||||
/* Verify by hand */
|
|
||||||
/* Run through every k value that gives us this r and check that *one* works.
|
|
||||||
* Note there could be none, there could be multiple, ECDSA is weird. */
|
|
||||||
should_verify = 0;
|
|
||||||
for (k = 0; k < order; k++) {
|
|
||||||
secp256k1_scalar check_x_s;
|
|
||||||
r_from_k(&check_x_s, group, k);
|
|
||||||
if (r_s == check_x_s) {
|
|
||||||
secp256k1_scalar_set_int(&s_times_k_s, k);
|
|
||||||
secp256k1_scalar_mul(&s_times_k_s, &s_times_k_s, &s_s);
|
|
||||||
secp256k1_scalar_mul(&msg_plus_r_times_sk_s, &r_s, &sk_s);
|
|
||||||
secp256k1_scalar_add(&msg_plus_r_times_sk_s, &msg_plus_r_times_sk_s, &msg_s);
|
|
||||||
should_verify |= secp256k1_scalar_eq(&s_times_k_s, &msg_plus_r_times_sk_s);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
/* nb we have a "high s" rule */
|
|
||||||
should_verify &= !secp256k1_scalar_is_high(&s_s);
|
|
||||||
|
|
||||||
/* We would like to try recovering the pubkey and checking that it matches,
|
|
||||||
* but pubkey recovery is impossible in the exhaustive tests (the reason
|
|
||||||
* being that there are 12 nonzero r values, 12 nonzero points, and no
|
|
||||||
* overlap between the sets, so there are no valid signatures). */
|
|
||||||
|
|
||||||
/* Verify by converting to a standard signature and calling verify */
|
|
||||||
secp256k1_ecdsa_recoverable_signature_save(&rsig, &r_s, &s_s, recid);
|
|
||||||
secp256k1_ecdsa_recoverable_signature_convert(ctx, &sig, &rsig);
|
|
||||||
memcpy(&nonconst_ge, &group[sk_s], sizeof(nonconst_ge));
|
|
||||||
secp256k1_pubkey_save(&pk, &nonconst_ge);
|
|
||||||
CHECK(should_verify ==
|
|
||||||
secp256k1_ecdsa_verify(ctx, &sig, msg32, &pk));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
int main(void) {
|
|
||||||
int i;
|
|
||||||
secp256k1_gej groupj[EXHAUSTIVE_TEST_ORDER];
|
|
||||||
secp256k1_ge group[EXHAUSTIVE_TEST_ORDER];
|
|
||||||
|
|
||||||
/* Build context */
|
|
||||||
secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
|
|
||||||
|
|
||||||
/* TODO set z = 1, then do num_tests runs with random z values */
|
|
||||||
|
|
||||||
/* Generate the entire group */
|
|
||||||
secp256k1_gej_set_infinity(&groupj[0]);
|
|
||||||
secp256k1_ge_set_gej(&group[0], &groupj[0]);
|
|
||||||
for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
|
|
||||||
/* Set a different random z-value for each Jacobian point */
|
|
||||||
secp256k1_fe z;
|
|
||||||
random_fe(&z);
|
|
||||||
|
|
||||||
secp256k1_gej_add_ge(&groupj[i], &groupj[i - 1], &secp256k1_ge_const_g);
|
|
||||||
secp256k1_ge_set_gej(&group[i], &groupj[i]);
|
|
||||||
secp256k1_gej_rescale(&groupj[i], &z);
|
|
||||||
|
|
||||||
/* Verify against ecmult_gen */
|
|
||||||
{
|
|
||||||
secp256k1_scalar scalar_i;
|
|
||||||
secp256k1_gej generatedj;
|
|
||||||
secp256k1_ge generated;
|
|
||||||
|
|
||||||
secp256k1_scalar_set_int(&scalar_i, i);
|
|
||||||
secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &generatedj, &scalar_i);
|
|
||||||
secp256k1_ge_set_gej(&generated, &generatedj);
|
|
||||||
|
|
||||||
CHECK(group[i].infinity == 0);
|
|
||||||
CHECK(generated.infinity == 0);
|
|
||||||
CHECK(secp256k1_fe_equal_var(&generated.x, &group[i].x));
|
|
||||||
CHECK(secp256k1_fe_equal_var(&generated.y, &group[i].y));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Run the tests */
|
|
||||||
#ifdef USE_ENDOMORPHISM
|
|
||||||
test_exhaustive_endomorphism(group, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
#endif
|
|
||||||
test_exhaustive_addition(group, groupj, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
test_exhaustive_ecmult(ctx, group, groupj, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
test_exhaustive_ecmult_multi(ctx, group, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
test_exhaustive_sign(ctx, group, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
test_exhaustive_verify(ctx, group, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
|
|
||||||
#ifdef ENABLE_MODULE_RECOVERY
|
|
||||||
test_exhaustive_recovery_sign(ctx, group, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
test_exhaustive_recovery_verify(ctx, group, EXHAUSTIVE_TEST_ORDER);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
secp256k1_context_destroy(ctx);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -1,162 +0,0 @@
|
|||||||
/**********************************************************************
|
|
||||||
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
||||||
* Distributed under the MIT software license, see the accompanying *
|
|
||||||
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
||||||
**********************************************************************/
|
|
||||||
|
|
||||||
#ifndef SECP256K1_UTIL_H
|
|
||||||
#define SECP256K1_UTIL_H
|
|
||||||
|
|
||||||
#if defined HAVE_CONFIG_H
|
|
||||||
#include "libsecp256k1-config.h"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <stdint.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
void (*fn)(const char *text, void* data);
|
|
||||||
const void* data;
|
|
||||||
} secp256k1_callback;
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void secp256k1_callback_call(const secp256k1_callback * const cb, const char * const text) {
|
|
||||||
cb->fn(text, (void*)cb->data);
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef DETERMINISTIC
|
|
||||||
#define TEST_FAILURE(msg) do { \
|
|
||||||
fprintf(stderr, "%s\n", msg); \
|
|
||||||
abort(); \
|
|
||||||
} while(0);
|
|
||||||
#else
|
|
||||||
#define TEST_FAILURE(msg) do { \
|
|
||||||
fprintf(stderr, "%s:%d: %s\n", __FILE__, __LINE__, msg); \
|
|
||||||
abort(); \
|
|
||||||
} while(0)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if SECP256K1_GNUC_PREREQ(3, 0)
|
|
||||||
#define EXPECT(x,c) __builtin_expect((x),(c))
|
|
||||||
#else
|
|
||||||
#define EXPECT(x,c) (x)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef DETERMINISTIC
|
|
||||||
#define CHECK(cond) do { \
|
|
||||||
if (EXPECT(!(cond), 0)) { \
|
|
||||||
TEST_FAILURE("test condition failed"); \
|
|
||||||
} \
|
|
||||||
} while(0)
|
|
||||||
#else
|
|
||||||
#define CHECK(cond) do { \
|
|
||||||
if (EXPECT(!(cond), 0)) { \
|
|
||||||
TEST_FAILURE("test condition failed: " #cond); \
|
|
||||||
} \
|
|
||||||
} while(0)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Like assert(), but when VERIFY is defined, and side-effect safe. */
|
|
||||||
#if defined(COVERAGE)
|
|
||||||
#define VERIFY_CHECK(check)
|
|
||||||
#define VERIFY_SETUP(stmt)
|
|
||||||
#elif defined(VERIFY)
|
|
||||||
#define VERIFY_CHECK CHECK
|
|
||||||
#define VERIFY_SETUP(stmt) do { stmt; } while(0)
|
|
||||||
#else
|
|
||||||
#define VERIFY_CHECK(cond) do { (void)(cond); } while(0)
|
|
||||||
#define VERIFY_SETUP(stmt)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void *checked_malloc(const secp256k1_callback* cb, size_t size) {
|
|
||||||
void *ret = malloc(size);
|
|
||||||
if (ret == NULL) {
|
|
||||||
secp256k1_callback_call(cb, "Out of memory");
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static SECP256K1_INLINE void *checked_realloc(const secp256k1_callback* cb, void *ptr, size_t size) {
|
|
||||||
void *ret = realloc(ptr, size);
|
|
||||||
if (ret == NULL) {
|
|
||||||
secp256k1_callback_call(cb, "Out of memory");
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
#if defined(__BIGGEST_ALIGNMENT__)
|
|
||||||
#define ALIGNMENT __BIGGEST_ALIGNMENT__
|
|
||||||
#else
|
|
||||||
/* Using 16 bytes alignment because common architectures never have alignment
|
|
||||||
* requirements above 8 for any of the types we care about. In addition we
|
|
||||||
* leave some room because currently we don't care about a few bytes. */
|
|
||||||
#define ALIGNMENT 16
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#define ROUND_TO_ALIGN(size) (((size + ALIGNMENT - 1) / ALIGNMENT) * ALIGNMENT)
|
|
||||||
|
|
||||||
/* Assume there is a contiguous memory object with bounds [base, base + max_size)
|
|
||||||
* of which the memory range [base, *prealloc_ptr) is already allocated for usage,
|
|
||||||
* where *prealloc_ptr is an aligned pointer. In that setting, this functions
|
|
||||||
* reserves the subobject [*prealloc_ptr, *prealloc_ptr + alloc_size) of
|
|
||||||
* alloc_size bytes by increasing *prealloc_ptr accordingly, taking into account
|
|
||||||
* alignment requirements.
|
|
||||||
*
|
|
||||||
* The function returns an aligned pointer to the newly allocated subobject.
|
|
||||||
*
|
|
||||||
* This is useful for manual memory management: if we're simply given a block
|
|
||||||
* [base, base + max_size), the caller can use this function to allocate memory
|
|
||||||
* in this block and keep track of the current allocation state with *prealloc_ptr.
|
|
||||||
*
|
|
||||||
* It is VERIFY_CHECKed that there is enough space left in the memory object and
|
|
||||||
* *prealloc_ptr is aligned relative to base.
|
|
||||||
*/
|
|
||||||
static SECP256K1_INLINE void *manual_alloc(void** prealloc_ptr, size_t alloc_size, void* base, size_t max_size) {
|
|
||||||
size_t aligned_alloc_size = ROUND_TO_ALIGN(alloc_size);
|
|
||||||
void* ret;
|
|
||||||
VERIFY_CHECK(prealloc_ptr != NULL);
|
|
||||||
VERIFY_CHECK(*prealloc_ptr != NULL);
|
|
||||||
VERIFY_CHECK(base != NULL);
|
|
||||||
VERIFY_CHECK((unsigned char*)*prealloc_ptr >= (unsigned char*)base);
|
|
||||||
VERIFY_CHECK(((unsigned char*)*prealloc_ptr - (unsigned char*)base) % ALIGNMENT == 0);
|
|
||||||
VERIFY_CHECK((unsigned char*)*prealloc_ptr - (unsigned char*)base + aligned_alloc_size <= max_size);
|
|
||||||
ret = *prealloc_ptr;
|
|
||||||
*((unsigned char**)prealloc_ptr) += aligned_alloc_size;
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Macro for restrict, when available and not in a VERIFY build. */
|
|
||||||
#if defined(SECP256K1_BUILD) && defined(VERIFY)
|
|
||||||
# define SECP256K1_RESTRICT
|
|
||||||
#else
|
|
||||||
# if (!defined(__STDC_VERSION__) || (__STDC_VERSION__ < 199901L) )
|
|
||||||
# if SECP256K1_GNUC_PREREQ(3,0)
|
|
||||||
# define SECP256K1_RESTRICT __restrict__
|
|
||||||
# elif (defined(_MSC_VER) && _MSC_VER >= 1400)
|
|
||||||
# define SECP256K1_RESTRICT __restrict
|
|
||||||
# else
|
|
||||||
# define SECP256K1_RESTRICT
|
|
||||||
# endif
|
|
||||||
# else
|
|
||||||
# define SECP256K1_RESTRICT restrict
|
|
||||||
# endif
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if defined(_WIN32)
|
|
||||||
# define I64FORMAT "I64d"
|
|
||||||
# define I64uFORMAT "I64u"
|
|
||||||
#else
|
|
||||||
# define I64FORMAT "lld"
|
|
||||||
# define I64uFORMAT "llu"
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if defined(HAVE___INT128)
|
|
||||||
# if defined(__GNUC__)
|
|
||||||
# define SECP256K1_GNUC_EXT __extension__
|
|
||||||
# else
|
|
||||||
# define SECP256K1_GNUC_EXT
|
|
||||||
# endif
|
|
||||||
SECP256K1_GNUC_EXT typedef unsigned __int128 uint128_t;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* SECP256K1_UTIL_H */
|
|
||||||
Loading…
Reference in new issue