Skip to content

Commit a0e696f

Browse files
gmaxwellsipa
authored andcommitted
Make secp256k1_ecmult_const handle infinity
Infinity isn't currently needed here, but correctly handling it is a little more safe against future changes. Update docs for it to make it clear that it is not constant time in A (the input point). It never was constant time in Q (and would be a little complicated to make constant time in A). If it was later made constant time in A, infinity support would be easy to preserve, e.g. by running it on a dummy value and cmoving infinity into the output.
1 parent 24c768a commit a0e696f

File tree

3 files changed

+8
-4
lines changed

3 files changed

+8
-4
lines changed

src/ecmult_const.h

+1-2
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@
1111
#include "group.h"
1212

1313
/**
14-
* Multiply: R = q*A (in constant-time)
15-
* A must not be infinity.
14+
* Multiply: R = q*A (in constant-time for q)
1615
*/
1716
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *q);
1817

src/ecmult_const_impl.h

+5
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,11 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons
144144

145145
int i;
146146

147+
if (secp256k1_ge_is_infinity(a)) {
148+
secp256k1_gej_set_infinity(r);
149+
return;
150+
}
151+
147152
/* build wnaf representation for q. */
148153
/* split q into q_1 and q_lam (where q = q_1 + q_lam*lambda, and q_1 and q_lam are ~128 bit) */
149154
secp256k1_scalar_split_lambda(&q_1, &q_lam, scalar);

src/tests_exhaustive.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ static void test_exhaustive_ecmult(const secp256k1_ge *group, const secp256k1_ge
193193
}
194194

195195
for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
196-
for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
196+
for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
197197
int ret;
198198
secp256k1_gej tmp;
199199
secp256k1_fe xn, xd, tmpf;
@@ -207,7 +207,7 @@ static void test_exhaustive_ecmult(const secp256k1_ge *group, const secp256k1_ge
207207
secp256k1_ecmult_const(&tmp, &group[i], &ng);
208208
ge_equals_gej(&group[(i * j) % EXHAUSTIVE_TEST_ORDER], &tmp);
209209

210-
if (j != 0) {
210+
if (i != 0 && j != 0) {
211211
/* Test secp256k1_ecmult_const_xonly with all curve X coordinates, and xd=NULL. */
212212
ret = secp256k1_ecmult_const_xonly(&tmpf, &group[i].x, NULL, &ng, 0);
213213
CHECK(ret);

0 commit comments

Comments
 (0)