Skip to content

Commit 1515099

Browse files
committed
Simpler and faster ecdh skew fixup
1 parent 39a36db commit 1515099

File tree

3 files changed

+23
-27
lines changed

3 files changed

+23
-27
lines changed

src/ecmult_const_impl.h

+12-27
Original file line numberDiff line numberDiff line change
@@ -234,36 +234,21 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
234234

235235
{
236236
/* Correct for wNAF skew */
237-
secp256k1_ge correction = *a;
238-
secp256k1_ge_storage correction_1_stor;
239-
secp256k1_ge_storage correction_lam_stor;
240-
secp256k1_ge_storage a2_stor;
241-
secp256k1_gej tmpj;
242-
secp256k1_gej_set_ge(&tmpj, &correction);
243-
secp256k1_gej_double_var(&tmpj, &tmpj, NULL);
244-
secp256k1_ge_set_gej(&correction, &tmpj);
245-
secp256k1_ge_to_storage(&correction_1_stor, a);
246-
if (size > 128) {
247-
secp256k1_ge_to_storage(&correction_lam_stor, a);
248-
}
249-
secp256k1_ge_to_storage(&a2_stor, &correction);
250-
251-
/* For odd numbers this is 2a (so replace it), for even ones a (so no-op) */
252-
secp256k1_ge_storage_cmov(&correction_1_stor, &a2_stor, skew_1 == 2);
253-
if (size > 128) {
254-
secp256k1_ge_storage_cmov(&correction_lam_stor, &a2_stor, skew_lam == 2);
255-
}
237+
secp256k1_gej tmp;
238+
secp256k1_ge a_1;
256239

257-
/* Apply the correction */
258-
secp256k1_ge_from_storage(&correction, &correction_1_stor);
259-
secp256k1_ge_neg(&correction, &correction);
260-
secp256k1_gej_add_ge(r, r, &correction);
240+
secp256k1_ge_neg(&a_1, a);
241+
secp256k1_gej_add_ge(r, r, &a_1);
242+
secp256k1_gej_add_ge(&tmp, r, &a_1);
243+
secp256k1_gej_cmov(r, &tmp, skew_1 == 2);
261244

262245
if (size > 128) {
263-
secp256k1_ge_from_storage(&correction, &correction_lam_stor);
264-
secp256k1_ge_neg(&correction, &correction);
265-
secp256k1_ge_mul_lambda(&correction, &correction);
266-
secp256k1_gej_add_ge(r, r, &correction);
246+
secp256k1_ge a_lam;
247+
secp256k1_ge_mul_lambda(&a_lam, &a_1);
248+
249+
secp256k1_gej_add_ge(r, r, &a_lam);
250+
secp256k1_gej_add_ge(&tmp, r, &a_lam);
251+
secp256k1_gej_cmov(r, &tmp, skew_lam == 2);
267252
}
268253
}
269254
}

src/group.h

+3
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,9 @@ static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge
124124
/** Convert a group element back from the storage type. */
125125
static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a);
126126

127+
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. Both *r and *a must be initialized.*/
128+
static void secp256k1_gej_cmov(secp256k1_gej *r, const secp256k1_gej *a, int flag);
129+
127130
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. Both *r and *a must be initialized.*/
128131
static void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag);
129132

src/group_impl.h

+8
Original file line numberDiff line numberDiff line change
@@ -642,6 +642,14 @@ static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storag
642642
r->infinity = 0;
643643
}
644644

645+
static SECP256K1_INLINE void secp256k1_gej_cmov(secp256k1_gej *r, const secp256k1_gej *a, int flag) {
646+
secp256k1_fe_cmov(&r->x, &a->x, flag);
647+
secp256k1_fe_cmov(&r->y, &a->y, flag);
648+
secp256k1_fe_cmov(&r->z, &a->z, flag);
649+
650+
r->infinity ^= (r->infinity ^ a->infinity) & flag;
651+
}
652+
645653
static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag) {
646654
secp256k1_fe_storage_cmov(&r->x, &a->x, flag);
647655
secp256k1_fe_storage_cmov(&r->y, &a->y, flag);

0 commit comments

Comments
 (0)