Skip to content

Commit 54058d1

Browse files
siv2rsiv2r
committed
field: remove secp256k1_fe_equal_var
`fe_equal_var` hits a fast path only when the inputs are unequal, which is uncommon among its callers (public key parsing, ECDSA verify).
1 parent bb4efd6 commit 54058d1

File tree

7 files changed

+31
-50
lines changed

7 files changed

+31
-50
lines changed

‎src/field.h

-6
Original file line numberDiff line numberDiff line change
@@ -176,12 +176,6 @@ static int secp256k1_fe_is_odd(const secp256k1_fe *a);
176176
*/
177177
static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b);
178178

179-
/** Determine whether two field elements are equal, without constant-time guarantee.
180-
*
181-
* Identical in behavior to secp256k1_fe_equal, but not constant time in either a or b.
182-
*/
183-
static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b);
184-
185179
/** Compare the values represented by 2 field elements, without constant-time guarantee.
186180
*
187181
* On input, a and b must be valid normalized field elements.

‎src/field_impl.h

+1-14
Original file line numberDiff line numberDiff line change
@@ -31,19 +31,6 @@ SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp
3131
return secp256k1_fe_normalizes_to_zero(&na);
3232
}
3333

34-
SECP256K1_INLINE static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b) {
35-
secp256k1_fe na;
36-
#ifdef VERIFY
37-
secp256k1_fe_verify(a);
38-
secp256k1_fe_verify(b);
39-
secp256k1_fe_verify_magnitude(a, 1);
40-
secp256k1_fe_verify_magnitude(b, 31);
41-
#endif
42-
secp256k1_fe_negate(&na, a, 1);
43-
secp256k1_fe_add(&na, b);
44-
return secp256k1_fe_normalizes_to_zero_var(&na);
45-
}
46-
4734
static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k1_fe * SECP256K1_RESTRICT a) {
4835
/** Given that p is congruent to 3 mod 4, we can compute the square root of
4936
* a mod p as the (p+1)/4'th power of a.
@@ -151,7 +138,7 @@ static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k
151138
if (!ret) {
152139
secp256k1_fe_negate(&t1, &t1, 1);
153140
secp256k1_fe_normalize_var(&t1);
154-
VERIFY_CHECK(secp256k1_fe_equal_var(&t1, a));
141+
VERIFY_CHECK(secp256k1_fe_equal(&t1, a));
155142
}
156143
#endif
157144
return ret;

‎src/group_impl.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a)
367367
#endif
368368

369369
secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
370-
return secp256k1_fe_equal_var(&r, &a->x);
370+
return secp256k1_fe_equal(&r, &a->x);
371371
}
372372

373373
static void secp256k1_gej_neg(secp256k1_gej *r, const secp256k1_gej *a) {
@@ -400,7 +400,7 @@ static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
400400
secp256k1_fe_sqr(&y2, &a->y);
401401
secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
402402
secp256k1_fe_add_int(&x3, SECP256K1_B);
403-
return secp256k1_fe_equal_var(&y2, &x3);
403+
return secp256k1_fe_equal(&y2, &x3);
404404
}
405405

406406
static SECP256K1_INLINE void secp256k1_gej_double(secp256k1_gej *r, const secp256k1_gej *a) {

‎src/modules/extrakeys/tests_exhaustive_impl.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ static void test_exhaustive_extrakeys(const secp256k1_context *ctx, const secp25
4848

4949
/* Compare the xonly_pubkey bytes against the precomputed group. */
5050
secp256k1_fe_set_b32_mod(&fe, xonly_pubkey_bytes[i - 1]);
51-
CHECK(secp256k1_fe_equal_var(&fe, &group[i].x));
51+
CHECK(secp256k1_fe_equal(&fe, &group[i].x));
5252

5353
/* Check the parity against the precomputed group. */
5454
fe = group[i].y;

‎src/modules/schnorrsig/main_impl.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -261,7 +261,7 @@ int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned cha
261261

262262
secp256k1_fe_normalize_var(&r.y);
263263
return !secp256k1_fe_is_odd(&r.y) &&
264-
secp256k1_fe_equal_var(&rx, &r.x);
264+
secp256k1_fe_equal(&rx, &r.x);
265265
}
266266

267267
#endif

‎src/tests.c

+18-18
Original file line numberDiff line numberDiff line change
@@ -2991,7 +2991,7 @@ static int check_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
29912991
secp256k1_fe an = *a;
29922992
secp256k1_fe bn = *b;
29932993
secp256k1_fe_normalize_weak(&an);
2994-
return secp256k1_fe_equal_var(&an, &bn);
2994+
return secp256k1_fe_equal(&an, &bn);
29952995
}
29962996

29972997
static void run_field_convert(void) {
@@ -3014,9 +3014,9 @@ static void run_field_convert(void) {
30143014
secp256k1_fe_storage fes2;
30153015
/* Check conversions to fe. */
30163016
CHECK(secp256k1_fe_set_b32_limit(&fe2, b32));
3017-
CHECK(secp256k1_fe_equal_var(&fe, &fe2));
3017+
CHECK(secp256k1_fe_equal(&fe, &fe2));
30183018
secp256k1_fe_from_storage(&fe2, &fes);
3019-
CHECK(secp256k1_fe_equal_var(&fe, &fe2));
3019+
CHECK(secp256k1_fe_equal(&fe, &fe2));
30203020
/* Check conversion from fe. */
30213021
secp256k1_fe_get_b32(b322, &fe);
30223022
CHECK(secp256k1_memcmp_var(b322, b32, 32) == 0);
@@ -3173,7 +3173,7 @@ static void run_field_misc(void) {
31733173
CHECK(check_fe_equal(&q, &z));
31743174
/* Test the fe equality and comparison operations. */
31753175
CHECK(secp256k1_fe_cmp_var(&x, &x) == 0);
3176-
CHECK(secp256k1_fe_equal_var(&x, &x));
3176+
CHECK(secp256k1_fe_equal(&x, &x));
31773177
z = x;
31783178
secp256k1_fe_add(&z,&y);
31793179
/* Test fe conditional move; z is not normalized here. */
@@ -3198,7 +3198,7 @@ static void run_field_misc(void) {
31983198
q = z;
31993199
secp256k1_fe_normalize_var(&x);
32003200
secp256k1_fe_normalize_var(&z);
3201-
CHECK(!secp256k1_fe_equal_var(&x, &z));
3201+
CHECK(!secp256k1_fe_equal(&x, &z));
32023202
secp256k1_fe_normalize_var(&q);
32033203
secp256k1_fe_cmov(&q, &z, (i&1));
32043204
#ifdef VERIFY
@@ -3703,8 +3703,8 @@ static void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
37033703
if (a->infinity) {
37043704
return;
37053705
}
3706-
CHECK(secp256k1_fe_equal_var(&a->x, &b->x));
3707-
CHECK(secp256k1_fe_equal_var(&a->y, &b->y));
3706+
CHECK(secp256k1_fe_equal(&a->x, &b->x));
3707+
CHECK(secp256k1_fe_equal(&a->y, &b->y));
37083708
}
37093709

37103710
/* This compares jacobian points including their Z, not just their geometric meaning. */
@@ -3742,8 +3742,8 @@ static void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
37423742
u2 = b->x;
37433743
secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
37443744
s2 = b->y;
3745-
CHECK(secp256k1_fe_equal_var(&u1, &u2));
3746-
CHECK(secp256k1_fe_equal_var(&s1, &s2));
3745+
CHECK(secp256k1_fe_equal(&u1, &u2));
3746+
CHECK(secp256k1_fe_equal(&s1, &s2));
37473747
}
37483748

37493749
static void test_ge(void) {
@@ -3811,7 +3811,7 @@ static void test_ge(void) {
38113811
/* Check Z ratio. */
38123812
if (!secp256k1_gej_is_infinity(&gej[i1]) && !secp256k1_gej_is_infinity(&refj)) {
38133813
secp256k1_fe zrz; secp256k1_fe_mul(&zrz, &zr, &gej[i1].z);
3814-
CHECK(secp256k1_fe_equal_var(&zrz, &refj.z));
3814+
CHECK(secp256k1_fe_equal(&zrz, &refj.z));
38153815
}
38163816
secp256k1_ge_set_gej_var(&ref, &refj);
38173817

@@ -3820,7 +3820,7 @@ static void test_ge(void) {
38203820
ge_equals_gej(&ref, &resj);
38213821
if (!secp256k1_gej_is_infinity(&gej[i1]) && !secp256k1_gej_is_infinity(&resj)) {
38223822
secp256k1_fe zrz; secp256k1_fe_mul(&zrz, &zr, &gej[i1].z);
3823-
CHECK(secp256k1_fe_equal_var(&zrz, &resj.z));
3823+
CHECK(secp256k1_fe_equal(&zrz, &resj.z));
38243824
}
38253825

38263826
/* Test gej + ge (var, with additional Z factor). */
@@ -3849,7 +3849,7 @@ static void test_ge(void) {
38493849
ge_equals_gej(&ref, &resj);
38503850
/* Check Z ratio. */
38513851
secp256k1_fe_mul(&zr2, &zr2, &gej[i1].z);
3852-
CHECK(secp256k1_fe_equal_var(&zr2, &resj.z));
3852+
CHECK(secp256k1_fe_equal(&zr2, &resj.z));
38533853
/* Normal doubling. */
38543854
secp256k1_gej_double_var(&resj, &gej[i2], NULL);
38553855
ge_equals_gej(&ref, &resj);
@@ -3932,7 +3932,7 @@ static void test_ge(void) {
39323932
ret_set_xo = secp256k1_ge_set_xo_var(&q, &r, 0);
39333933
CHECK(ret_on_curve == ret_frac_on_curve);
39343934
CHECK(ret_on_curve == ret_set_xo);
3935-
if (ret_set_xo) CHECK(secp256k1_fe_equal_var(&r, &q.x));
3935+
if (ret_set_xo) CHECK(secp256k1_fe_equal(&r, &q.x));
39363936
}
39373937

39383938
/* Test batch gej -> ge conversion with many infinities. */
@@ -4172,8 +4172,8 @@ static void test_group_decompress(const secp256k1_fe* x) {
41724172
CHECK(!ge_odd.infinity);
41734173

41744174
/* Check that the x coordinates check out. */
4175-
CHECK(secp256k1_fe_equal_var(&ge_even.x, x));
4176-
CHECK(secp256k1_fe_equal_var(&ge_odd.x, x));
4175+
CHECK(secp256k1_fe_equal(&ge_even.x, x));
4176+
CHECK(secp256k1_fe_equal(&ge_odd.x, x));
41774177

41784178
/* Check odd/even Y in ge_odd, ge_even. */
41794179
CHECK(secp256k1_fe_is_odd(&ge_odd.y));
@@ -4231,12 +4231,12 @@ static void test_pre_g_table(const secp256k1_ge_storage * pre_g, size_t n) {
42314231
CHECK(!secp256k1_fe_normalizes_to_zero_var(&dqx) || !secp256k1_fe_normalizes_to_zero_var(&dqy));
42324232

42334233
/* Check that -q is not equal to p */
4234-
CHECK(!secp256k1_fe_equal_var(&dpx, &dqx) || !secp256k1_fe_equal_var(&dpy, &dqy));
4234+
CHECK(!secp256k1_fe_equal(&dpx, &dqx) || !secp256k1_fe_equal(&dpy, &dqy));
42354235

42364236
/* Check that p, -q and gg are colinear */
42374237
secp256k1_fe_mul(&dpx, &dpx, &dqy);
42384238
secp256k1_fe_mul(&dpy, &dpy, &dqx);
4239-
CHECK(secp256k1_fe_equal_var(&dpx, &dpy));
4239+
CHECK(secp256k1_fe_equal(&dpx, &dpy));
42404240

42414241
p = q;
42424242
}
@@ -4455,7 +4455,7 @@ static void run_point_times_order(void) {
44554455
secp256k1_fe_sqr(&x, &x);
44564456
}
44574457
secp256k1_fe_normalize_var(&x);
4458-
CHECK(secp256k1_fe_equal_var(&x, &xr));
4458+
CHECK(secp256k1_fe_equal(&x, &xr));
44594459
}
44604460

44614461
static void ecmult_const_random_mult(void) {

‎src/tests_exhaustive.c

+8-8
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ static void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
3838
if (a->infinity) {
3939
return;
4040
}
41-
CHECK(secp256k1_fe_equal_var(&a->x, &b->x));
42-
CHECK(secp256k1_fe_equal_var(&a->y, &b->y));
41+
CHECK(secp256k1_fe_equal(&a->x, &b->x));
42+
CHECK(secp256k1_fe_equal(&a->y, &b->y));
4343
}
4444

4545
static void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
@@ -55,8 +55,8 @@ static void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
5555
u2 = b->x;
5656
secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
5757
s2 = b->y;
58-
CHECK(secp256k1_fe_equal_var(&u1, &u2));
59-
CHECK(secp256k1_fe_equal_var(&s1, &s2));
58+
CHECK(secp256k1_fe_equal(&u1, &u2));
59+
CHECK(secp256k1_fe_equal(&s1, &s2));
6060
}
6161

6262
static void random_fe(secp256k1_fe *x) {
@@ -219,14 +219,14 @@ static void test_exhaustive_ecmult(const secp256k1_ge *group, const secp256k1_ge
219219
/* Test secp256k1_ecmult_const_xonly with all curve X coordinates, and xd=NULL. */
220220
ret = secp256k1_ecmult_const_xonly(&tmpf, &group[i].x, NULL, &ng, 0);
221221
CHECK(ret);
222-
CHECK(secp256k1_fe_equal_var(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
222+
CHECK(secp256k1_fe_equal(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
223223

224224
/* Test secp256k1_ecmult_const_xonly with all curve X coordinates, with random xd. */
225225
random_fe_non_zero(&xd);
226226
secp256k1_fe_mul(&xn, &xd, &group[i].x);
227227
ret = secp256k1_ecmult_const_xonly(&tmpf, &xn, &xd, &ng, 0);
228228
CHECK(ret);
229-
CHECK(secp256k1_fe_equal_var(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
229+
CHECK(secp256k1_fe_equal(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
230230
}
231231
}
232232
}
@@ -475,8 +475,8 @@ int main(int argc, char** argv) {
475475

476476
CHECK(group[i].infinity == 0);
477477
CHECK(generated.infinity == 0);
478-
CHECK(secp256k1_fe_equal_var(&generated.x, &group[i].x));
479-
CHECK(secp256k1_fe_equal_var(&generated.y, &group[i].y));
478+
CHECK(secp256k1_fe_equal(&generated.x, &group[i].x));
479+
CHECK(secp256k1_fe_equal(&generated.y, &group[i].y));
480480
}
481481
}
482482

0 commit comments

Comments
 (0)