Skip to content

Commit 3b0c218

Browse files
real-or-randomreal-or-random
committed
ecmult_gen: Simplify ecmult_gen context after making table static
This is a backwards-compatible API change: Before this commit, a context initialized for signing was required to call functions that rely on ecmult_gen. After this commit, this is no longer necessary because the static ecmult_gen table is always present. In practice this means that the corresponding functions will just work instead of calling the illegal callback when given a context which is not (officially) initialized for signing. This is in line with 6815761, which made the analogous change with respect to ecmult and contexts initialized for signing. But as opposed to 681571, which removed the ecmult context entirely, we cannot remove the ecmult_gen context entirely because it is still used for random blinding. Moreover, since the secp256k1_context_no_precomp context is const and cannot meaningfully support random blinding, we refrain (for now) from changing its API, i.e., the illegal callback will still be called when trying to use ecmult_gen operations with the static secp256k1_context_no_precomp context.
1 parent e43ba02 commit 3b0c218

File tree

8 files changed

+109
-101
lines changed

8 files changed

+109
-101
lines changed

‎src/ecmult_gen.h

+7-19
Original file line numberDiff line numberDiff line change
@@ -18,28 +18,16 @@
1818
#define ECMULT_GEN_PREC_N (256 / ECMULT_GEN_PREC_B)
1919

2020
typedef struct {
21-
/* For accelerating the computation of a*G:
22-
* To harden against timing attacks, use the following mechanism:
23-
* * Break up the multiplicand into groups of PREC_B bits, called n_0, n_1, n_2, ..., n_(PREC_N-1).
24-
* * Compute sum(n_i * (PREC_G)^i * G + U_i, i=0 ... PREC_N-1), where:
25-
* * U_i = U * 2^i, for i=0 ... PREC_N-2
26-
* * U_i = U * (1-2^(PREC_N-1)), for i=PREC_N-1
27-
* where U is a point with no known corresponding scalar. Note that sum(U_i, i=0 ... PREC_N-1) = 0.
28-
* For each i, and each of the PREC_G possible values of n_i, (n_i * (PREC_G)^i * G + U_i) is
29-
* precomputed (call it prec(i, n_i)). The formula now becomes sum(prec(i, n_i), i=0 ... PREC_N-1).
30-
* None of the resulting prec group elements have a known scalar, and neither do any of
31-
* the intermediate sums while computing a*G.
32-
*/
33-
secp256k1_ge_storage (*prec)[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G]; /* prec[j][i] = (PREC_G)^j * i * G + U_i */
34-
secp256k1_scalar blind;
35-
secp256k1_gej initial;
21+
/* Whether the context has been built. */
22+
int built;
23+
24+
/* Blinding values used when computing (n-b)G + bG. */
25+
secp256k1_scalar blind; /* -b */
26+
secp256k1_gej initial; /* bG */
3627
} secp256k1_ecmult_gen_context;
3728

38-
static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context* ctx);
39-
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context* ctx, void **prealloc);
40-
static void secp256k1_ecmult_gen_context_finalize_memcpy(secp256k1_ecmult_gen_context *dst, const secp256k1_ecmult_gen_context* src);
29+
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context* ctx);
4130
static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context* ctx);
42-
static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx);
4331

4432
/** Multiply with the generator: R = a*G */
4533
static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context* ctx, secp256k1_gej *r, const secp256k1_scalar *a);

‎src/ecmult_gen_impl.h

+18-19
Original file line numberDiff line numberDiff line change
@@ -14,35 +14,34 @@
1414
#include "hash_impl.h"
1515
#include "ecmult_static_context.h"
1616

17-
static const size_t SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE = 0;
18-
19-
static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context *ctx) {
20-
ctx->prec = NULL;
21-
}
22-
23-
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context *ctx, void **prealloc) {
24-
if (ctx->prec != NULL) {
25-
return;
26-
}
27-
(void)prealloc;
28-
ctx->prec = (secp256k1_ge_storage (*)[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G])secp256k1_ecmult_static_context;
17+
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context *ctx) {
2918
secp256k1_ecmult_gen_blind(ctx, NULL);
19+
ctx->built = 1;
3020
}
3121

3222
static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx) {
33-
return ctx->prec != NULL;
34-
}
35-
36-
static void secp256k1_ecmult_gen_context_finalize_memcpy(secp256k1_ecmult_gen_context *dst, const secp256k1_ecmult_gen_context *src) {
37-
(void)dst, (void)src;
23+
return ctx->built;
3824
}
3925

4026
static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context *ctx) {
27+
ctx->built = 0;
4128
secp256k1_scalar_clear(&ctx->blind);
4229
secp256k1_gej_clear(&ctx->initial);
43-
ctx->prec = NULL;
4430
}
4531

32+
/* For accelerating the computation of a*G:
33+
* To harden against timing attacks, use the following mechanism:
34+
* * Break up the multiplicand into groups of PREC_B bits, called n_0, n_1, n_2, ..., n_(PREC_N-1).
35+
* * Compute sum(n_i * (PREC_G)^i * G + U_i, i=0 ... PREC_N-1), where:
36+
* * U_i = U * 2^i, for i=0 ... PREC_N-2
37+
* * U_i = U * (1-2^(PREC_N-1)), for i=PREC_N-1
38+
* where U is a point with no known corresponding scalar. Note that sum(U_i, i=0 ... PREC_N-1) = 0.
39+
* For each i, and each of the PREC_G possible values of n_i, (n_i * (PREC_G)^i * G + U_i) is
40+
* precomputed (call it prec(i, n_i)). The formula now becomes sum(prec(i, n_i), i=0 ... PREC_N-1).
41+
* None of the resulting prec group elements have a known scalar, and neither do any of
42+
* the intermediate sums while computing a*G.
43+
* The prec values are stored in secp256k1_ecmult_gen_prec_table[j][i] = (PREC_G)^j * i * G + U_i.
44+
*/
4645
static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context *ctx, secp256k1_gej *r, const secp256k1_scalar *gn) {
4746
secp256k1_ge add;
4847
secp256k1_ge_storage adds;
@@ -67,7 +66,7 @@ static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context *ctx, secp25
6766
* by Dag Arne Osvik, Adi Shamir, and Eran Tromer
6867
* (https://www.tau.ac.il/~tromer/papers/cache.pdf)
6968
*/
70-
secp256k1_ge_storage_cmov(&adds, &(*ctx->prec)[j][i], i == bits);
69+
secp256k1_ge_storage_cmov(&adds, &secp256k1_ecmult_gen_prec_table[j][i], i == bits);
7170
}
7271
secp256k1_ge_from_storage(&add, &adds);
7372
secp256k1_gej_add_ge(r, r, &add);

‎src/gen_context.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ int main(int argc, char **argv) {
5656
fprintf(fp, "#if ECMULT_GEN_PREC_N != %d || ECMULT_GEN_PREC_G != %d\n", ECMULT_GEN_PREC_N, ECMULT_GEN_PREC_G);
5757
fprintf(fp, " #error configuration mismatch, invalid ECMULT_GEN_PREC_N, ECMULT_GEN_PREC_G. Try deleting ecmult_static_context.h before the build.\n");
5858
fprintf(fp, "#endif\n");
59-
fprintf(fp, "static const secp256k1_ge_storage secp256k1_ecmult_static_context[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G] = {\n");
59+
fprintf(fp, "static const secp256k1_ge_storage secp256k1_ecmult_gen_prec_table[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G] = {\n");
6060

6161
table = checked_malloc(&default_error_callback, ECMULT_GEN_PREC_TABLE_SIZE);
6262
secp256k1_ecmult_gen_create_prec_table(table);

‎src/modules/extrakeys/tests_impl.h

+15-7
Original file line numberDiff line numberDiff line change
@@ -359,25 +359,32 @@ void test_keypair(void) {
359359
secp256k1_context *none = api_test_context(SECP256K1_CONTEXT_NONE, &ecount);
360360
secp256k1_context *sign = api_test_context(SECP256K1_CONTEXT_SIGN, &ecount);
361361
secp256k1_context *verify = api_test_context(SECP256K1_CONTEXT_VERIFY, &ecount);
362+
secp256k1_context *sttc = secp256k1_context_clone(secp256k1_context_no_precomp);
363+
secp256k1_context_set_error_callback(sttc, counting_illegal_callback_fn, &ecount);
364+
secp256k1_context_set_illegal_callback(sttc, counting_illegal_callback_fn, &ecount);
362365

363366
CHECK(sizeof(zeros96) == sizeof(keypair));
364367
memset(overflows, 0xFF, sizeof(overflows));
365368

366369
/* Test keypair_create */
367370
ecount = 0;
368371
secp256k1_testrand256(sk);
369-
CHECK(secp256k1_keypair_create(none, &keypair, sk) == 0);
370-
CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
372+
CHECK(secp256k1_keypair_create(none, &keypair, sk) == 1);
373+
CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
374+
CHECK(ecount == 0);
375+
CHECK(secp256k1_keypair_create(verify, &keypair, sk) == 1);
376+
CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
377+
CHECK(ecount == 0);
378+
CHECK(secp256k1_keypair_create(sign, NULL, sk) == 0);
371379
CHECK(ecount == 1);
372-
CHECK(secp256k1_keypair_create(verify, &keypair, sk) == 0);
380+
CHECK(secp256k1_keypair_create(sign, &keypair, NULL) == 0);
373381
CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
374382
CHECK(ecount == 2);
375383
CHECK(secp256k1_keypair_create(sign, &keypair, sk) == 1);
376-
CHECK(secp256k1_keypair_create(sign, NULL, sk) == 0);
377-
CHECK(ecount == 3);
378-
CHECK(secp256k1_keypair_create(sign, &keypair, NULL) == 0);
384+
CHECK(ecount == 2);
385+
CHECK(secp256k1_keypair_create(sttc, &keypair, sk) == 0);
379386
CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
380-
CHECK(ecount == 4);
387+
CHECK(ecount == 3);
381388

382389
/* Invalid secret key */
383390
CHECK(secp256k1_keypair_create(sign, &keypair, zeros96) == 0);
@@ -459,6 +466,7 @@ void test_keypair(void) {
459466
secp256k1_context_destroy(none);
460467
secp256k1_context_destroy(sign);
461468
secp256k1_context_destroy(verify);
469+
secp256k1_context_destroy(sttc);
462470
}
463471

464472
void test_keypair_add(void) {

‎src/modules/recovery/tests_impl.h

+17-11
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ void test_ecdsa_recovery_api(void) {
3434
secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
3535
secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
3636
secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
37+
secp256k1_context *sttc = secp256k1_context_clone(secp256k1_context_no_precomp);
3738
secp256k1_pubkey pubkey;
3839
secp256k1_pubkey recpubkey;
3940
secp256k1_ecdsa_signature normal_sig;
@@ -53,40 +54,44 @@ void test_ecdsa_recovery_api(void) {
5354
secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
5455
secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
5556
secp256k1_context_set_error_callback(both, counting_illegal_callback_fn, &ecount);
57+
secp256k1_context_set_error_callback(sttc, counting_illegal_callback_fn, &ecount);
5658
secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
5759
secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
5860
secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
5961
secp256k1_context_set_illegal_callback(both, counting_illegal_callback_fn, &ecount);
62+
secp256k1_context_set_illegal_callback(sttc, counting_illegal_callback_fn, &ecount);
6063

6164
/* Construct and verify corresponding public key. */
6265
CHECK(secp256k1_ec_seckey_verify(ctx, privkey) == 1);
6366
CHECK(secp256k1_ec_pubkey_create(ctx, &pubkey, privkey) == 1);
6467

6568
/* Check bad contexts and NULLs for signing */
6669
ecount = 0;
67-
CHECK(secp256k1_ecdsa_sign_recoverable(none, &recsig, message, privkey, NULL, NULL) == 0);
68-
CHECK(ecount == 1);
70+
CHECK(secp256k1_ecdsa_sign_recoverable(none, &recsig, message, privkey, NULL, NULL) == 1);
71+
CHECK(ecount == 0);
6972
CHECK(secp256k1_ecdsa_sign_recoverable(sign, &recsig, message, privkey, NULL, NULL) == 1);
70-
CHECK(ecount == 1);
71-
CHECK(secp256k1_ecdsa_sign_recoverable(vrfy, &recsig, message, privkey, NULL, NULL) == 0);
72-
CHECK(ecount == 2);
73+
CHECK(ecount == 0);
74+
CHECK(secp256k1_ecdsa_sign_recoverable(vrfy, &recsig, message, privkey, NULL, NULL) == 1);
75+
CHECK(ecount == 0);
7376
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, privkey, NULL, NULL) == 1);
74-
CHECK(ecount == 2);
77+
CHECK(ecount == 0);
7578
CHECK(secp256k1_ecdsa_sign_recoverable(both, NULL, message, privkey, NULL, NULL) == 0);
76-
CHECK(ecount == 3);
79+
CHECK(ecount == 1);
7780
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, NULL, privkey, NULL, NULL) == 0);
78-
CHECK(ecount == 4);
81+
CHECK(ecount == 2);
7982
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, NULL, NULL, NULL) == 0);
80-
CHECK(ecount == 5);
83+
CHECK(ecount == 3);
84+
CHECK(secp256k1_ecdsa_sign_recoverable(sttc, &recsig, message, privkey, NULL, NULL) == 0);
85+
CHECK(ecount == 4);
8186
/* This will fail or succeed randomly, and in either case will not ARG_CHECK failure */
8287
secp256k1_ecdsa_sign_recoverable(both, &recsig, message, privkey, recovery_test_nonce_function, NULL);
83-
CHECK(ecount == 5);
88+
CHECK(ecount == 4);
8489
/* These will all fail, but not in ARG_CHECK way */
8590
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, zero_privkey, NULL, NULL) == 0);
8691
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, over_privkey, NULL, NULL) == 0);
8792
/* This one will succeed. */
8893
CHECK(secp256k1_ecdsa_sign_recoverable(both, &recsig, message, privkey, NULL, NULL) == 1);
89-
CHECK(ecount == 5);
94+
CHECK(ecount == 4);
9095

9196
/* Check signing with a goofy nonce function */
9297

@@ -145,6 +150,7 @@ void test_ecdsa_recovery_api(void) {
145150
secp256k1_context_destroy(sign);
146151
secp256k1_context_destroy(vrfy);
147152
secp256k1_context_destroy(both);
153+
secp256k1_context_destroy(sttc);
148154
}
149155

150156
void test_ecdsa_recovery_end_to_end(void) {

‎src/modules/schnorrsig/tests_impl.h

+29-21
Original file line numberDiff line numberDiff line change
@@ -132,16 +132,19 @@ void test_schnorrsig_api(void) {
132132
secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
133133
secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
134134
secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
135+
secp256k1_context *sttc = secp256k1_context_clone(secp256k1_context_no_precomp);
135136
int ecount;
136137

137138
secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
138139
secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
139140
secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
140141
secp256k1_context_set_error_callback(both, counting_illegal_callback_fn, &ecount);
142+
secp256k1_context_set_error_callback(sttc, counting_illegal_callback_fn, &ecount);
141143
secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
142144
secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
143145
secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
144146
secp256k1_context_set_illegal_callback(both, counting_illegal_callback_fn, &ecount);
147+
secp256k1_context_set_illegal_callback(sttc, counting_illegal_callback_fn, &ecount);
145148

146149
secp256k1_testrand256(sk1);
147150
secp256k1_testrand256(sk2);
@@ -157,42 +160,46 @@ void test_schnorrsig_api(void) {
157160

158161
/** main test body **/
159162
ecount = 0;
160-
CHECK(secp256k1_schnorrsig_sign(none, sig, msg, &keypairs[0], NULL) == 0);
161-
CHECK(ecount == 1);
162-
CHECK(secp256k1_schnorrsig_sign(vrfy, sig, msg, &keypairs[0], NULL) == 0);
163-
CHECK(ecount == 2);
163+
CHECK(secp256k1_schnorrsig_sign(none, sig, msg, &keypairs[0], NULL) == 1);
164+
CHECK(ecount == 0);
165+
CHECK(secp256k1_schnorrsig_sign(vrfy, sig, msg, &keypairs[0], NULL) == 1);
166+
CHECK(ecount == 0);
164167
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL) == 1);
165-
CHECK(ecount == 2);
168+
CHECK(ecount == 0);
166169
CHECK(secp256k1_schnorrsig_sign(sign, NULL, msg, &keypairs[0], NULL) == 0);
167-
CHECK(ecount == 3);
170+
CHECK(ecount == 1);
168171
CHECK(secp256k1_schnorrsig_sign(sign, sig, NULL, &keypairs[0], NULL) == 0);
169-
CHECK(ecount == 4);
172+
CHECK(ecount == 2);
170173
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, NULL, NULL) == 0);
171-
CHECK(ecount == 5);
174+
CHECK(ecount == 3);
172175
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &invalid_keypair, NULL) == 0);
173-
CHECK(ecount == 6);
176+
CHECK(ecount == 4);
177+
CHECK(secp256k1_schnorrsig_sign(sttc, sig, msg, &keypairs[0], NULL) == 0);
178+
CHECK(ecount == 5);
174179

175180
ecount = 0;
176-
CHECK(secp256k1_schnorrsig_sign_custom(none, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
177-
CHECK(ecount == 1);
178-
CHECK(secp256k1_schnorrsig_sign_custom(vrfy, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
179-
CHECK(ecount == 2);
181+
CHECK(secp256k1_schnorrsig_sign_custom(none, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
182+
CHECK(ecount == 0);
183+
CHECK(secp256k1_schnorrsig_sign_custom(vrfy, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
184+
CHECK(ecount == 0);
180185
CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
181-
CHECK(ecount == 2);
186+
CHECK(ecount == 0);
182187
CHECK(secp256k1_schnorrsig_sign_custom(sign, NULL, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
183-
CHECK(ecount == 3);
188+
CHECK(ecount == 1);
184189
CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, NULL, sizeof(msg), &keypairs[0], &extraparams) == 0);
185-
CHECK(ecount == 4);
190+
CHECK(ecount == 2);
186191
CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, NULL, 0, &keypairs[0], &extraparams) == 1);
187-
CHECK(ecount == 4);
192+
CHECK(ecount == 2);
188193
CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), NULL, &extraparams) == 0);
189-
CHECK(ecount == 5);
194+
CHECK(ecount == 3);
190195
CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &invalid_keypair, &extraparams) == 0);
191-
CHECK(ecount == 6);
196+
CHECK(ecount == 4);
192197
CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], NULL) == 1);
193-
CHECK(ecount == 6);
198+
CHECK(ecount == 4);
194199
CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams) == 0);
195-
CHECK(ecount == 7);
200+
CHECK(ecount == 5);
201+
CHECK(secp256k1_schnorrsig_sign_custom(sttc, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
202+
CHECK(ecount == 6);
196203

197204
ecount = 0;
198205
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL) == 1);
@@ -217,6 +224,7 @@ void test_schnorrsig_api(void) {
217224
secp256k1_context_destroy(sign);
218225
secp256k1_context_destroy(vrfy);
219226
secp256k1_context_destroy(both);
227+
secp256k1_context_destroy(sttc);
220228
}
221229

222230
/* Checks that hash initialized by secp256k1_schnorrsig_sha256_tagged has the

‎src/secp256k1.c

+1-12
Original file line numberDiff line numberDiff line change
@@ -98,18 +98,12 @@ size_t secp256k1_context_preallocated_size(unsigned int flags) {
9898
return 0;
9999
}
100100

101-
if (flags & SECP256K1_FLAGS_BIT_CONTEXT_SIGN) {
102-
ret += SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE;
103-
}
104101
return ret;
105102
}
106103

107104
size_t secp256k1_context_preallocated_clone_size(const secp256k1_context* ctx) {
108105
size_t ret = ROUND_TO_ALIGN(sizeof(secp256k1_context));
109106
VERIFY_CHECK(ctx != NULL);
110-
if (secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)) {
111-
ret += SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE;
112-
}
113107
return ret;
114108
}
115109

@@ -131,13 +125,9 @@ secp256k1_context* secp256k1_context_preallocated_create(void* prealloc, unsigne
131125
ret->illegal_callback = default_illegal_callback;
132126
ret->error_callback = default_error_callback;
133127

134-
secp256k1_ecmult_gen_context_init(&ret->ecmult_gen_ctx);
135-
136128
/* Flags have been checked by secp256k1_context_preallocated_size. */
137129
VERIFY_CHECK((flags & SECP256K1_FLAGS_TYPE_MASK) == SECP256K1_FLAGS_TYPE_CONTEXT);
138-
if (flags & SECP256K1_FLAGS_BIT_CONTEXT_SIGN) {
139-
secp256k1_ecmult_gen_context_build(&ret->ecmult_gen_ctx, &prealloc);
140-
}
130+
secp256k1_ecmult_gen_context_build(&ret->ecmult_gen_ctx);
141131
ret->declassify = !!(flags & SECP256K1_FLAGS_BIT_CONTEXT_DECLASSIFY);
142132

143133
return (secp256k1_context*) ret;
@@ -163,7 +153,6 @@ secp256k1_context* secp256k1_context_preallocated_clone(const secp256k1_context*
163153
prealloc_size = secp256k1_context_preallocated_clone_size(ctx);
164154
ret = (secp256k1_context*)prealloc;
165155
memcpy(ret, ctx, prealloc_size);
166-
secp256k1_ecmult_gen_context_finalize_memcpy(&ret->ecmult_gen_ctx, &ctx->ecmult_gen_ctx);
167156
return ret;
168157
}
169158

0 commit comments

Comments
 (0)