foster/bitcoin-bitcoin-core
0
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-02-02 09:46:52 -05:00
Code Issues Activity

Get rid of _t as it is POSIX reserved

Browse source
This commit is contained in:
Pieter Wuille 2015-09-21 20:57:54 +02:00
parent 201819b3bc
commit dd891e0ed5
49 changed files with 943 additions and 943 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

84
include/secp256k1.h
View file

@ -40,7 +40,7 @@ extern "C" {
* Regarding randomization, either do it once at creation time (in which case * Regarding randomization, either do it once at creation time (in which case
* you do not need any locking for the other calls), or use a read-write lock. * you do not need any locking for the other calls), or use a read-write lock.
*/ */
typedef struct secp256k1_context_struct secp256k1_context_t; typedef struct secp256k1_context_struct secp256k1_context;
/** Opaque data structure that holds a parsed and valid public key. /** Opaque data structure that holds a parsed and valid public key.
* *
@ -55,7 +55,7 @@ typedef struct secp256k1_context_struct secp256k1_context_t;
*/ */
typedef struct { typedef struct {
unsigned char data[64]; unsigned char data[64];
} secp256k1_pubkey_t; } secp256k1_pubkey;
/** Opaque data structured that holds a parsed ECDSA signature. /** Opaque data structured that holds a parsed ECDSA signature.
* *
@ -71,7 +71,7 @@ typedef struct {
*/ */
typedef struct { typedef struct {
unsigned char data[64]; unsigned char data[64];
} secp256k1_ecdsa_signature_t; } secp256k1_ecdsa_signature;
/** A pointer to a function to deterministically generate a nonce. /** A pointer to a function to deterministically generate a nonce.
* *
@ -89,7 +89,7 @@ typedef struct {
* Except for test cases, this function should compute some cryptographic hash of * Except for test cases, this function should compute some cryptographic hash of
* the message, the algorithm, the key and the attempt. * the message, the algorithm, the key and the attempt.
*/ */
typedef int (*secp256k1_nonce_function_t)( typedef int (*secp256k1_nonce_function)(
unsigned char *nonce32, unsigned char *nonce32,
const unsigned char *msg32, const unsigned char *msg32,
const unsigned char *key32, const unsigned char *key32,
@ -145,7 +145,7 @@ typedef int (*secp256k1_nonce_function_t)(
* Returns: a newly created context object. * Returns: a newly created context object.
* In: flags: which parts of the context to initialize. * In: flags: which parts of the context to initialize.
*/ */
secp256k1_context_t* secp256k1_context_create( secp256k1_context* secp256k1_context_create(
unsigned int flags unsigned int flags
) SECP256K1_WARN_UNUSED_RESULT; ) SECP256K1_WARN_UNUSED_RESULT;
@ -154,8 +154,8 @@ secp256k1_context_t* secp256k1_context_create(
* Returns: a newly created context object. * Returns: a newly created context object.
* Args: ctx: an existing context to copy (cannot be NULL) * Args: ctx: an existing context to copy (cannot be NULL)
*/ */
secp256k1_context_t* secp256k1_context_clone( secp256k1_context* secp256k1_context_clone(
const secp256k1_context_t* ctx const secp256k1_context* ctx
) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT; ) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
/** Destroy a secp256k1 context object. /** Destroy a secp256k1 context object.
@ -164,7 +164,7 @@ secp256k1_context_t* secp256k1_context_clone(
* Args: ctx: an existing context to destroy (cannot be NULL) * Args: ctx: an existing context to destroy (cannot be NULL)
*/ */
void secp256k1_context_destroy( void secp256k1_context_destroy(
secp256k1_context_t* ctx secp256k1_context* ctx
); );
/** Set a callback function to be called when an illegal argument is passed to /** Set a callback function to be called when an illegal argument is passed to
@ -188,7 +188,7 @@ void secp256k1_context_destroy(
* data: the opaque pointer to pass to fun above. * data: the opaque pointer to pass to fun above.
*/ */
void secp256k1_context_set_illegal_callback( void secp256k1_context_set_illegal_callback(
secp256k1_context_t* ctx, secp256k1_context* ctx,
void (*fun)(const char* message, void* data), void (*fun)(const char* message, void* data),
const void* data const void* data
) SECP256K1_ARG_NONNULL(1); ) SECP256K1_ARG_NONNULL(1);
@ -210,7 +210,7 @@ void secp256k1_context_set_illegal_callback(
* data: the opaque pointer to pass to fun above. * data: the opaque pointer to pass to fun above.
*/ */
void secp256k1_context_set_error_callback( void secp256k1_context_set_error_callback(
secp256k1_context_t* ctx, secp256k1_context* ctx,
void (*fun)(const char* message, void* data), void (*fun)(const char* message, void* data),
const void* data const void* data
) SECP256K1_ARG_NONNULL(1); ) SECP256K1_ARG_NONNULL(1);
@ -230,8 +230,8 @@ void secp256k1_context_set_error_callback(
* byte 0x06 or 0x07) format public keys. * byte 0x06 or 0x07) format public keys.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_parse( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_parse(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t* pubkey, secp256k1_pubkey* pubkey,
const unsigned char *input, const unsigned char *input,
size_t inputlen size_t inputlen
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -244,16 +244,16 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_parse(
* compressed==1) byte array to place the serialized key in. * compressed==1) byte array to place the serialized key in.
* outputlen: a pointer to an integer which will contain the serialized * outputlen: a pointer to an integer which will contain the serialized
* size. * size.
* In: pubkey: a pointer to a secp256k1_pubkey_t containing an initialized * In: pubkey: a pointer to a secp256k1_pubkey containing an initialized
* public key. * public key.
* flags: SECP256K1_EC_COMPRESSED if serialization should be in * flags: SECP256K1_EC_COMPRESSED if serialization should be in
* compressed format. * compressed format.
*/ */
int secp256k1_ec_pubkey_serialize( int secp256k1_ec_pubkey_serialize(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *output, unsigned char *output,
size_t *outputlen, size_t *outputlen,
const secp256k1_pubkey_t* pubkey, const secp256k1_pubkey* pubkey,
unsigned int flags unsigned int flags
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
@ -268,8 +268,8 @@ int secp256k1_ec_pubkey_serialize(
* Note that this function also supports some violations of DER and even BER. * Note that this function also supports some violations of DER and even BER.
*/ */
int secp256k1_ecdsa_signature_parse_der( int secp256k1_ecdsa_signature_parse_der(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_ecdsa_signature_t* sig, secp256k1_ecdsa_signature* sig,
const unsigned char *input, const unsigned char *input,
size_t inputlen size_t inputlen
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -286,10 +286,10 @@ int secp256k1_ecdsa_signature_parse_der(
* In: sig: a pointer to an initialized signature object * In: sig: a pointer to an initialized signature object
*/ */
int secp256k1_ecdsa_signature_serialize_der( int secp256k1_ecdsa_signature_serialize_der(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *output, unsigned char *output,
size_t *outputlen, size_t *outputlen,
const secp256k1_ecdsa_signature_t* sig const secp256k1_ecdsa_signature* sig
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
/** Verify an ECDSA signature. /** Verify an ECDSA signature.
@ -302,20 +302,20 @@ int secp256k1_ecdsa_signature_serialize_der(
* pubkey: pointer to an initialized public key to verify with (cannot be NULL) * pubkey: pointer to an initialized public key to verify with (cannot be NULL)
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
const secp256k1_ecdsa_signature_t *sig, const secp256k1_ecdsa_signature *sig,
const unsigned char *msg32, const unsigned char *msg32,
const secp256k1_pubkey_t *pubkey const secp256k1_pubkey *pubkey
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
/** An implementation of RFC6979 (using HMAC-SHA256) as nonce generation function. /** An implementation of RFC6979 (using HMAC-SHA256) as nonce generation function.
* If a data pointer is passed, it is assumed to be a pointer to 32 bytes of * If a data pointer is passed, it is assumed to be a pointer to 32 bytes of
* extra entropy. * extra entropy.
*/ */
extern const secp256k1_nonce_function_t secp256k1_nonce_function_rfc6979; extern const secp256k1_nonce_function secp256k1_nonce_function_rfc6979;
/** A default safe nonce generation function (currently equal to secp256k1_nonce_function_rfc6979). */ /** A default safe nonce generation function (currently equal to secp256k1_nonce_function_rfc6979). */
extern const secp256k1_nonce_function_t secp256k1_nonce_function_default; extern const secp256k1_nonce_function secp256k1_nonce_function_default;
/** Create an ECDSA signature. /** Create an ECDSA signature.
* *
@ -356,11 +356,11 @@ extern const secp256k1_nonce_function_t secp256k1_nonce_function_default;
* be taken when this property is required for an application. * be taken when this property is required for an application.
*/ */
int secp256k1_ecdsa_sign( int secp256k1_ecdsa_sign(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_ecdsa_signature_t *sig, secp256k1_ecdsa_signature *sig,
const unsigned char *msg32, const unsigned char *msg32,
const unsigned char *seckey, const unsigned char *seckey,
secp256k1_nonce_function_t noncefp, secp256k1_nonce_function noncefp,
const void *ndata const void *ndata
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
@ -372,7 +372,7 @@ int secp256k1_ecdsa_sign(
* In: seckey: pointer to a 32-byte secret key (cannot be NULL) * In: seckey: pointer to a 32-byte secret key (cannot be NULL)
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
const unsigned char *seckey const unsigned char *seckey
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
@ -385,8 +385,8 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify(
* In: seckey: pointer to a 32-byte private key (cannot be NULL) * In: seckey: pointer to a 32-byte private key (cannot be NULL)
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t *pubkey, secp256k1_pubkey *pubkey,
const unsigned char *seckey const unsigned char *seckey
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -411,7 +411,7 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create(
* guaranteed to be parsable by secp256k1_ec_privkey_import. * guaranteed to be parsable by secp256k1_ec_privkey_import.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_export( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_export(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *privkey, unsigned char *privkey,
size_t *privkeylen, size_t *privkeylen,
const unsigned char *seckey, const unsigned char *seckey,
@ -433,7 +433,7 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_export(
* key. * key.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_import( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_import(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *seckey, unsigned char *seckey,
const unsigned char *privkey, const unsigned char *privkey,
size_t privkeylen size_t privkeylen
@ -449,7 +449,7 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_import(
* In: tweak: pointer to a 32-byte tweak. * In: tweak: pointer to a 32-byte tweak.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_add( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_add(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *seckey, unsigned char *seckey,
const unsigned char *tweak const unsigned char *tweak
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -465,8 +465,8 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_add(
* In: tweak: pointer to a 32-byte tweak. * In: tweak: pointer to a 32-byte tweak.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_add( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_add(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t *pubkey, secp256k1_pubkey *pubkey,
const unsigned char *tweak const unsigned char *tweak
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -478,7 +478,7 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_add(
* In: tweak: pointer to a 32-byte tweak. * In: tweak: pointer to a 32-byte tweak.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_mul( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_mul(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *seckey, unsigned char *seckey,
const unsigned char *tweak const unsigned char *tweak
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -492,8 +492,8 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_mul(
* In: tweak: pointer to a 32-byte tweak. * In: tweak: pointer to a 32-byte tweak.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_mul( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_mul(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t *pubkey, secp256k1_pubkey *pubkey,
const unsigned char *tweak const unsigned char *tweak
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -504,7 +504,7 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_mul(
* In: seed32: pointer to a 32-byte random seed (NULL resets to initial state) * In: seed32: pointer to a 32-byte random seed (NULL resets to initial state)
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize( SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize(
secp256k1_context_t* ctx, secp256k1_context* ctx,
const unsigned char *seed32 const unsigned char *seed32
) SECP256K1_ARG_NONNULL(1); ) SECP256K1_ARG_NONNULL(1);
@ -520,9 +520,9 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize(
* uncompressed format is needed. * uncompressed format is needed.
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_combine( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_combine(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t *out, secp256k1_pubkey *out,
const secp256k1_pubkey_t * const * ins, const secp256k1_pubkey * const * ins,
int n int n
) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);

4
include/secp256k1_ecdh.h
View file

@ -17,9 +17,9 @@ extern "C" {
* scalar: a 32-byte scalar with which to multiply the point * scalar: a 32-byte scalar with which to multiply the point
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdh( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdh(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *result, unsigned char *result,
const secp256k1_pubkey_t *point, const secp256k1_pubkey *point,
const unsigned char *scalar const unsigned char *scalar
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);

28
include/secp256k1_recovery.h
View file

@ -23,7 +23,7 @@ extern "C" {
*/ */
typedef struct { typedef struct {
unsigned char data[65]; unsigned char data[65];
} secp256k1_ecdsa_recoverable_signature_t; } secp256k1_ecdsa_recoverable_signature;
/** Parse a compact ECDSA signature (64 bytes + recovery id). /** Parse a compact ECDSA signature (64 bytes + recovery id).
* *
@ -34,8 +34,8 @@ typedef struct {
* recid: the recovery id (0, 1, 2 or 3) * recid: the recovery id (0, 1, 2 or 3)
*/ */
int secp256k1_ecdsa_recoverable_signature_parse_compact( int secp256k1_ecdsa_recoverable_signature_parse_compact(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_ecdsa_recoverable_signature_t* sig, secp256k1_ecdsa_recoverable_signature* sig,
const unsigned char *input64, const unsigned char *input64,
int recid int recid
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@ -47,9 +47,9 @@ int secp256k1_ecdsa_recoverable_signature_parse_compact(
* In: sigin: a pointer to a recoverable signature (cannot be NULL). * In: sigin: a pointer to a recoverable signature (cannot be NULL).
*/ */
int secp256k1_ecdsa_recoverable_signature_convert( int secp256k1_ecdsa_recoverable_signature_convert(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_ecdsa_signature_t* sig, secp256k1_ecdsa_signature* sig,
const secp256k1_ecdsa_recoverable_signature_t* sigin const secp256k1_ecdsa_recoverable_signature* sigin
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
/** Serialize an ECDSA signature in compact format (64 bytes + recovery id). /** Serialize an ECDSA signature in compact format (64 bytes + recovery id).
@ -61,10 +61,10 @@ int secp256k1_ecdsa_recoverable_signature_convert(
* In: sig: a pointer to an initialized signature object (cannot be NULL) * In: sig: a pointer to an initialized signature object (cannot be NULL)
*/ */
int secp256k1_ecdsa_recoverable_signature_serialize_compact( int secp256k1_ecdsa_recoverable_signature_serialize_compact(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *output64, unsigned char *output64,
int *recid, int *recid,
const secp256k1_ecdsa_recoverable_signature_t* sig const secp256k1_ecdsa_recoverable_signature* sig
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
/** Create a recoverable ECDSA signature. /** Create a recoverable ECDSA signature.
@ -79,11 +79,11 @@ int secp256k1_ecdsa_recoverable_signature_serialize_compact(
* ndata: pointer to arbitrary data used by the nonce generation function (can be NULL) * ndata: pointer to arbitrary data used by the nonce generation function (can be NULL)
*/ */
int secp256k1_ecdsa_sign_recoverable( int secp256k1_ecdsa_sign_recoverable(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_ecdsa_recoverable_signature_t *sig, secp256k1_ecdsa_recoverable_signature *sig,
const unsigned char *msg32, const unsigned char *msg32,
const unsigned char *seckey, const unsigned char *seckey,
secp256k1_nonce_function_t noncefp, secp256k1_nonce_function noncefp,
const void *ndata const void *ndata
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
@ -97,9 +97,9 @@ int secp256k1_ecdsa_sign_recoverable(
* msg32: the 32-byte message hash assumed to be signed (cannot be NULL) * msg32: the 32-byte message hash assumed to be signed (cannot be NULL)
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_recover( SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_recover(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t *pubkey, secp256k1_pubkey *pubkey,
const secp256k1_ecdsa_recoverable_signature_t *sig, const secp256k1_ecdsa_recoverable_signature *sig,
const unsigned char *msg32 const unsigned char *msg32
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);

24
include/secp256k1_schnorr.h
View file

@ -25,11 +25,11 @@ extern "C" {
* function (can be NULL) * function (can be NULL)
*/ */
int secp256k1_schnorr_sign( int secp256k1_schnorr_sign(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *sig64, unsigned char *sig64,
const unsigned char *msg32, const unsigned char *msg32,
const unsigned char *seckey, const unsigned char *seckey,
secp256k1_nonce_function_t noncefp, secp256k1_nonce_function noncefp,
const void *ndata const void *ndata
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
@ -42,10 +42,10 @@ int secp256k1_schnorr_sign(
* pubkey: the public key to verify with (cannot be NULL) * pubkey: the public key to verify with (cannot be NULL)
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_verify( SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_verify(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
const unsigned char *sig64, const unsigned char *sig64,
const unsigned char *msg32, const unsigned char *msg32,
const secp256k1_pubkey_t *pubkey const secp256k1_pubkey *pubkey
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
/** Recover an EC public key from a Schnorr signature created using /** Recover an EC public key from a Schnorr signature created using
@ -62,8 +62,8 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_verify(
* be NULL) * be NULL)
*/ */
int secp256k1_schnorr_recover( int secp256k1_schnorr_recover(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t *pubkey, secp256k1_pubkey *pubkey,
const unsigned char *sig64, const unsigned char *sig64,
const unsigned char *msg32 const unsigned char *msg32
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
@ -87,12 +87,12 @@ int secp256k1_schnorr_recover(
* Do not use the output as a private/public key pair for signing/validation. * Do not use the output as a private/public key pair for signing/validation.
*/ */
int secp256k1_schnorr_generate_nonce_pair( int secp256k1_schnorr_generate_nonce_pair(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
secp256k1_pubkey_t *pubnonce, secp256k1_pubkey *pubnonce,
unsigned char *privnonce32, unsigned char *privnonce32,
const unsigned char *msg32, const unsigned char *msg32,
const unsigned char *sec32, const unsigned char *sec32,
secp256k1_nonce_function_t noncefp, secp256k1_nonce_function noncefp,
const void* noncedata const void* noncedata
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7);
@ -139,11 +139,11 @@ int secp256k1_schnorr_generate_nonce_pair(
* by calling the function again (they are commutative and associative). * by calling the function again (they are commutative and associative).
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_partial_sign( SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_partial_sign(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *sig64, unsigned char *sig64,
const unsigned char *msg32, const unsigned char *msg32,
const unsigned char *sec32, const unsigned char *sec32,
const secp256k1_pubkey_t *pubnonce_others, const secp256k1_pubkey *pubnonce_others,
const unsigned char *secnonce32 const unsigned char *secnonce32
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6); ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6);
@ -160,7 +160,7 @@ SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_partial_sign(
* n: the number of signatures to combine (at least 1) * n: the number of signatures to combine (at least 1)
*/ */
SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_partial_combine( SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_partial_combine(
const secp256k1_context_t* ctx, const secp256k1_context* ctx,
unsigned char *sig64, unsigned char *sig64,
const unsigned char * const * sig64sin, const unsigned char * const * sig64sin,
int n int n

4
src/bench_ecdh.c
View file

@ -12,8 +12,8 @@
#include "bench.h" #include "bench.h"
typedef struct { typedef struct {
secp256k1_context_t *ctx; secp256k1_context *ctx;
secp256k1_pubkey_t point; secp256k1_pubkey point;
unsigned char scalar[32]; unsigned char scalar[32];
} bench_ecdh_t; } bench_ecdh_t;

10
src/bench_internal.c
View file

@ -19,10 +19,10 @@
#include "secp256k1.c" #include "secp256k1.c"
typedef struct { typedef struct {
secp256k1_scalar_t scalar_x, scalar_y; secp256k1_scalar scalar_x, scalar_y;
secp256k1_fe_t fe_x, fe_y; secp256k1_fe fe_x, fe_y;
secp256k1_ge_t ge_x, ge_y; secp256k1_ge ge_x, ge_y;
secp256k1_gej_t gej_x, gej_y; secp256k1_gej gej_x, gej_y;
unsigned char data[64]; unsigned char data[64];
int wnaf[256]; int wnaf[256];
} bench_inv_t; } bench_inv_t;
@ -98,7 +98,7 @@ void bench_scalar_split(void* arg) {
bench_inv_t *data = (bench_inv_t*)arg; bench_inv_t *data = (bench_inv_t*)arg;
for (i = 0; i < 20000; i++) { for (i = 0; i < 20000; i++) {
secp256k1_scalar_t l, r; secp256k1_scalar l, r;
secp256k1_scalar_split_lambda(&l, &r, &data->scalar_x); secp256k1_scalar_split_lambda(&l, &r, &data->scalar_x);
secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y); secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
} }

6
src/bench_recover.c
View file

@ -10,7 +10,7 @@
#include "bench.h" #include "bench.h"
typedef struct { typedef struct {
secp256k1_context_t *ctx; secp256k1_context *ctx;
unsigned char msg[32]; unsigned char msg[32];
unsigned char sig[64]; unsigned char sig[64];
} bench_recover_t; } bench_recover_t;
@ -18,13 +18,13 @@ typedef struct {
void bench_recover(void* arg) { void bench_recover(void* arg) {
int i; int i;
bench_recover_t *data = (bench_recover_t*)arg; bench_recover_t *data = (bench_recover_t*)arg;
secp256k1_pubkey_t pubkey; secp256k1_pubkey pubkey;
unsigned char pubkeyc[33]; unsigned char pubkeyc[33];
for (i = 0; i < 20000; i++) { for (i = 0; i < 20000; i++) {
int j; int j;
size_t pubkeylen = 33; size_t pubkeylen = 33;
secp256k1_ecdsa_recoverable_signature_t sig; secp256k1_ecdsa_recoverable_signature sig;
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(data->ctx, &sig, data->sig, i % 2)); CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(data->ctx, &sig, data->sig, i % 2));
CHECK(secp256k1_ecdsa_recover(data->ctx, &pubkey, &sig, data->msg)); CHECK(secp256k1_ecdsa_recover(data->ctx, &pubkey, &sig, data->msg));
CHECK(secp256k1_ec_pubkey_serialize(data->ctx, pubkeyc, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED)); CHECK(secp256k1_ec_pubkey_serialize(data->ctx, pubkeyc, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED));

6
src/bench_schnorr_verify.c
View file

@ -20,7 +20,7 @@ typedef struct {
} benchmark_schnorr_sig_t; } benchmark_schnorr_sig_t;
typedef struct { typedef struct {
secp256k1_context_t *ctx; secp256k1_context *ctx;
unsigned char msg[32]; unsigned char msg[32];
benchmark_schnorr_sig_t sigs[64]; benchmark_schnorr_sig_t sigs[64];
int numsigs; int numsigs;
@ -34,7 +34,7 @@ static void benchmark_schnorr_init(void* arg) {
data->msg[i] = 1 + i; data->msg[i] = 1 + i;
} }
for (k = 0; k < data->numsigs; k++) { for (k = 0; k < data->numsigs; k++) {
secp256k1_pubkey_t pubkey; secp256k1_pubkey pubkey;
for (i = 0; i < 32; i++) { for (i = 0; i < 32; i++) {
data->sigs[k].key[i] = 33 + i + k; data->sigs[k].key[i] = 33 + i + k;
} }
@ -50,7 +50,7 @@ static void benchmark_schnorr_verify(void* arg) {
benchmark_schnorr_verify_t* data = (benchmark_schnorr_verify_t*)arg; benchmark_schnorr_verify_t* data = (benchmark_schnorr_verify_t*)arg;
for (i = 0; i < 20000 / data->numsigs; i++) { for (i = 0; i < 20000 / data->numsigs; i++) {
secp256k1_pubkey_t pubkey; secp256k1_pubkey pubkey;
data->sigs[0].sig[(i >> 8) % 64] ^= (i & 0xFF); data->sigs[0].sig[(i >> 8) % 64] ^= (i & 0xFF);
CHECK(secp256k1_ec_pubkey_parse(data->ctx, &pubkey, data->sigs[0].pubkey, data->sigs[0].pubkeylen)); CHECK(secp256k1_ec_pubkey_parse(data->ctx, &pubkey, data->sigs[0].pubkey, data->sigs[0].pubkeylen));
CHECK(secp256k1_schnorr_verify(data->ctx, data->sigs[0].sig, data->msg, &pubkey) == ((i & 0xFF) == 0)); CHECK(secp256k1_schnorr_verify(data->ctx, data->sigs[0].sig, data->msg, &pubkey) == ((i & 0xFF) == 0));

4
src/bench_sign.c
View file

@ -9,7 +9,7 @@
#include "bench.h" #include "bench.h"
typedef struct { typedef struct {
secp256k1_context_t* ctx; secp256k1_context* ctx;
unsigned char msg[32]; unsigned char msg[32];
unsigned char key[32]; unsigned char key[32];
} bench_sign_t; } bench_sign_t;
@ -34,7 +34,7 @@ static void bench_sign(void* arg) {
for (i = 0; i < 20000; i++) { for (i = 0; i < 20000; i++) {
size_t siglen = 74; size_t siglen = 74;
int j; int j;
secp256k1_ecdsa_signature_t signature; secp256k1_ecdsa_signature signature;
CHECK(secp256k1_ecdsa_sign(data->ctx, &signature, data->msg, data->key, NULL, NULL)); CHECK(secp256k1_ecdsa_sign(data->ctx, &signature, data->msg, data->key, NULL, NULL));
CHECK(secp256k1_ecdsa_signature_serialize_der(data->ctx, sig, &siglen, &signature)); CHECK(secp256k1_ecdsa_signature_serialize_der(data->ctx, sig, &siglen, &signature));
for (j = 0; j < 32; j++) { for (j = 0; j < 32; j++) {

10
src/bench_verify.c
View file

@ -12,7 +12,7 @@
#include "bench.h" #include "bench.h"
typedef struct { typedef struct {
secp256k1_context_t *ctx; secp256k1_context *ctx;
unsigned char msg[32]; unsigned char msg[32];
unsigned char key[32]; unsigned char key[32];
unsigned char sig[72]; unsigned char sig[72];
@ -26,8 +26,8 @@ static void benchmark_verify(void* arg) {
benchmark_verify_t* data = (benchmark_verify_t*)arg; benchmark_verify_t* data = (benchmark_verify_t*)arg;
for (i = 0; i < 20000; i++) { for (i = 0; i < 20000; i++) {
secp256k1_pubkey_t pubkey; secp256k1_pubkey pubkey;
secp256k1_ecdsa_signature_t sig; secp256k1_ecdsa_signature sig;
data->sig[data->siglen - 1] ^= (i & 0xFF); data->sig[data->siglen - 1] ^= (i & 0xFF);
data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF); data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF); data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
@ -42,8 +42,8 @@ static void benchmark_verify(void* arg) {
int main(void) { int main(void) {
int i; int i;
secp256k1_pubkey_t pubkey; secp256k1_pubkey pubkey;
secp256k1_ecdsa_signature_t sig; secp256k1_ecdsa_signature sig;
benchmark_verify_t data; benchmark_verify_t data;
data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY); data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);

10
src/ecdsa.h
View file

@ -13,10 +13,10 @@
#include "group.h" #include "group.h"
#include "ecmult.h" #include "ecmult.h"
static int secp256k1_ecdsa_sig_parse(secp256k1_scalar_t *r, secp256k1_scalar_t *s, const unsigned char *sig, size_t size); static int secp256k1_ecdsa_sig_parse(secp256k1_scalar *r, secp256k1_scalar *s, const unsigned char *sig, size_t size);
static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar_t *r, const secp256k1_scalar_t *s); static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar *r, const secp256k1_scalar *s);
static int secp256k1_ecdsa_sig_verify(const secp256k1_ecmult_context_t *ctx, const secp256k1_scalar_t* r, const secp256k1_scalar_t* s, const secp256k1_ge_t *pubkey, const secp256k1_scalar_t *message); static int secp256k1_ecdsa_sig_verify(const secp256k1_ecmult_context *ctx, const secp256k1_scalar* r, const secp256k1_scalar* s, const secp256k1_ge *pubkey, const secp256k1_scalar *message);
static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context_t *ctx, secp256k1_scalar_t* r, secp256k1_scalar_t* s, const secp256k1_scalar_t *seckey, const secp256k1_scalar_t *message, const secp256k1_scalar_t *nonce, int *recid); static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid);
static int secp256k1_ecdsa_sig_recover(const secp256k1_ecmult_context_t *ctx, const secp256k1_scalar_t* r, const secp256k1_scalar_t* s, secp256k1_ge_t *pubkey, const secp256k1_scalar_t *message, int recid); static int secp256k1_ecdsa_sig_recover(const secp256k1_ecmult_context *ctx, const secp256k1_scalar* r, const secp256k1_scalar* s, secp256k1_ge *pubkey, const secp256k1_scalar *message, int recid);
#endif #endif

38
src/ecdsa_impl.h
View file

@ -28,7 +28,7 @@
* sage: '%x' % (EllipticCurve ([F (a), F (b)]).order()) * sage: '%x' % (EllipticCurve ([F (a), F (b)]).order())
* 'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141' * 'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'
*/ */
static const secp256k1_fe_t secp256k1_ecdsa_const_order_as_fe = SECP256K1_FE_CONST( static const secp256k1_fe secp256k1_ecdsa_const_order_as_fe = SECP256K1_FE_CONST(
0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
0xBAAEDCE6UL, 0xAF48A03BUL, 0xBFD25E8CUL, 0xD0364141UL 0xBAAEDCE6UL, 0xAF48A03BUL, 0xBFD25E8CUL, 0xD0364141UL
); );
@ -42,11 +42,11 @@ static const secp256k1_fe_t secp256k1_ecdsa_const_order_as_fe = SECP256K1_FE_CON
* sage: '%x' % (p - EllipticCurve ([F (a), F (b)]).order()) * sage: '%x' % (p - EllipticCurve ([F (a), F (b)]).order())
* '14551231950b75fc4402da1722fc9baee' * '14551231950b75fc4402da1722fc9baee'
*/ */
static const secp256k1_fe_t secp256k1_ecdsa_const_p_minus_order = SECP256K1_FE_CONST( static const secp256k1_fe secp256k1_ecdsa_const_p_minus_order = SECP256K1_FE_CONST(
0, 0, 0, 1, 0x45512319UL, 0x50B75FC4UL, 0x402DA172UL, 0x2FC9BAEEUL 0, 0, 0, 1, 0x45512319UL, 0x50B75FC4UL, 0x402DA172UL, 0x2FC9BAEEUL
); );
static int secp256k1_ecdsa_sig_parse(secp256k1_scalar_t *rr, secp256k1_scalar_t *rs, const unsigned char *sig, size_t size) { static int secp256k1_ecdsa_sig_parse(secp256k1_scalar *rr, secp256k1_scalar *rs, const unsigned char *sig, size_t size) {
unsigned char ra[32] = {0}, sa[32] = {0}; unsigned char ra[32] = {0}, sa[32] = {0};
const unsigned char *rp; const unsigned char *rp;
const unsigned char *sp; const unsigned char *sp;
@ -109,7 +109,7 @@ static int secp256k1_ecdsa_sig_parse(secp256k1_scalar_t *rr, secp256k1_scalar_t
return 1; return 1;
} }
static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar_t* ar, const secp256k1_scalar_t* as) { static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar* ar, const secp256k1_scalar* as) {
unsigned char r[33] = {0}, s[33] = {0}; unsigned char r[33] = {0}, s[33] = {0};
unsigned char *rp = r, *sp = s; unsigned char *rp = r, *sp = s;
size_t lenR = 33, lenS = 33; size_t lenR = 33, lenS = 33;
@ -133,12 +133,12 @@ static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const
return 1; return 1;
} }
static int secp256k1_ecdsa_sig_verify(const secp256k1_ecmult_context_t *ctx, const secp256k1_scalar_t *sigr, const secp256k1_scalar_t *sigs, const secp256k1_ge_t *pubkey, const secp256k1_scalar_t *message) { static int secp256k1_ecdsa_sig_verify(const secp256k1_ecmult_context *ctx, const secp256k1_scalar *sigr, const secp256k1_scalar *sigs, const secp256k1_ge *pubkey, const secp256k1_scalar *message) {
unsigned char c[32]; unsigned char c[32];
secp256k1_scalar_t sn, u1, u2; secp256k1_scalar sn, u1, u2;
secp256k1_fe_t xr; secp256k1_fe xr;
secp256k1_gej_t pubkeyj; secp256k1_gej pubkeyj;
secp256k1_gej_t pr; secp256k1_gej pr;
if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) { if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
return 0; return 0;
@ -187,13 +187,13 @@ static int secp256k1_ecdsa_sig_verify(const secp256k1_ecmult_context_t *ctx, con
return 0; return 0;
} }
static int secp256k1_ecdsa_sig_recover(const secp256k1_ecmult_context_t *ctx, const secp256k1_scalar_t *sigr, const secp256k1_scalar_t* sigs, secp256k1_ge_t *pubkey, const secp256k1_scalar_t *message, int recid) { static int secp256k1_ecdsa_sig_recover(const secp256k1_ecmult_context *ctx, const secp256k1_scalar *sigr, const secp256k1_scalar* sigs, secp256k1_ge *pubkey, const secp256k1_scalar *message, int recid) {
unsigned char brx[32]; unsigned char brx[32];
secp256k1_fe_t fx; secp256k1_fe fx;
secp256k1_ge_t x; secp256k1_ge x;
secp256k1_gej_t xj; secp256k1_gej xj;
secp256k1_scalar_t rn, u1, u2; secp256k1_scalar rn, u1, u2;
secp256k1_gej_t qj; secp256k1_gej qj;
if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) { if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
return 0; return 0;
@ -220,11 +220,11 @@ static int secp256k1_ecdsa_sig_recover(const secp256k1_ecmult_context_t *ctx, co
return !secp256k1_gej_is_infinity(&qj); return !secp256k1_gej_is_infinity(&qj);
} }
static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context_t *ctx, secp256k1_scalar_t *sigr, secp256k1_scalar_t *sigs, const secp256k1_scalar_t *seckey, const secp256k1_scalar_t *message, const secp256k1_scalar_t *nonce, int *recid) { static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) {
unsigned char b[32]; unsigned char b[32];
secp256k1_gej_t rp; secp256k1_gej rp;
secp256k1_ge_t r; secp256k1_ge r;
secp256k1_scalar_t n; secp256k1_scalar n;
int overflow = 0; int overflow = 0;
secp256k1_ecmult_gen(ctx, &rp, nonce); secp256k1_ecmult_gen(ctx, &rp, nonce);

16
src/eckey.h
View file

@ -14,15 +14,15 @@
#include "ecmult.h" #include "ecmult.h"
#include "ecmult_gen.h" #include "ecmult_gen.h"
static int secp256k1_eckey_pubkey_parse(secp256k1_ge_t *elem, const unsigned char *pub, size_t size); static int secp256k1_eckey_pubkey_parse(secp256k1_ge *elem, const unsigned char *pub, size_t size);
static int secp256k1_eckey_pubkey_serialize(secp256k1_ge_t *elem, unsigned char *pub, size_t *size, unsigned int flags); static int secp256k1_eckey_pubkey_serialize(secp256k1_ge *elem, unsigned char *pub, size_t *size, unsigned int flags);
static int secp256k1_eckey_privkey_parse(secp256k1_scalar_t *key, const unsigned char *privkey, size_t privkeylen); static int secp256k1_eckey_privkey_parse(secp256k1_scalar *key, const unsigned char *privkey, size_t privkeylen);
static int secp256k1_eckey_privkey_serialize(const secp256k1_ecmult_gen_context_t *ctx, unsigned char *privkey, size_t *privkeylen, const secp256k1_scalar_t *key, unsigned int flags); static int secp256k1_eckey_privkey_serialize(const secp256k1_ecmult_gen_context *ctx, unsigned char *privkey, size_t *privkeylen, const secp256k1_scalar *key, unsigned int flags);
static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar_t *key, const secp256k1_scalar_t *tweak); static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar *key, const secp256k1_scalar *tweak);
static int secp256k1_eckey_pubkey_tweak_add(const secp256k1_ecmult_context_t *ctx, secp256k1_ge_t *key, const secp256k1_scalar_t *tweak); static int secp256k1_eckey_pubkey_tweak_add(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak);
static int secp256k1_eckey_privkey_tweak_mul(secp256k1_scalar_t *key, const secp256k1_scalar_t *tweak); static int secp256k1_eckey_privkey_tweak_mul(secp256k1_scalar *key, const secp256k1_scalar *tweak);
static int secp256k1_eckey_pubkey_tweak_mul(const secp256k1_ecmult_context_t *ctx, secp256k1_ge_t *key, const secp256k1_scalar_t *tweak); static int secp256k1_eckey_pubkey_tweak_mul(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak);
#endif #endif

32
src/eckey_impl.h
View file

@ -14,12 +14,12 @@
#include "group.h" #include "group.h"
#include "ecmult_gen.h" #include "ecmult_gen.h"
static int secp256k1_eckey_pubkey_parse(secp256k1_ge_t *elem, const unsigned char *pub, size_t size) { static int secp256k1_eckey_pubkey_parse(secp256k1_ge *elem, const unsigned char *pub, size_t size) {
if (size == 33 && (pub[0] == 0x02 || pub[0] == 0x03)) { if (size == 33 && (pub[0] == 0x02 || pub[0] == 0x03)) {
secp256k1_fe_t x; secp256k1_fe x;
return secp256k1_fe_set_b32(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == 0x03); return secp256k1_fe_set_b32(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == 0x03);
} else if (size == 65 && (pub[0] == 0x04 || pub[0] == 0x06 || pub[0] == 0x07)) { } else if (size == 65 && (pub[0] == 0x04 || pub[0] == 0x06 || pub[0] == 0x07)) {
secp256k1_fe_t x, y; secp256k1_fe x, y;
if (!secp256k1_fe_set_b32(&x, pub+1) || !secp256k1_fe_set_b32(&y, pub+33)) { if (!secp256k1_fe_set_b32(&x, pub+1) || !secp256k1_fe_set_b32(&y, pub+33)) {
return 0; return 0;
} }
@ -33,7 +33,7 @@ static int secp256k1_eckey_pubkey_parse(secp256k1_ge_t *elem, const unsigned cha
} }
} }
static int secp256k1_eckey_pubkey_serialize(secp256k1_ge_t *elem, unsigned char *pub, size_t *size, unsigned int flags) { static int secp256k1_eckey_pubkey_serialize(secp256k1_ge *elem, unsigned char *pub, size_t *size, unsigned int flags) {
if (secp256k1_ge_is_infinity(elem)) { if (secp256k1_ge_is_infinity(elem)) {
return 0; return 0;
} }
@ -51,7 +51,7 @@ static int secp256k1_eckey_pubkey_serialize(secp256k1_ge_t *elem, unsigned char
return 1; return 1;
} }
static int secp256k1_eckey_privkey_parse(secp256k1_scalar_t *key, const unsigned char *privkey, size_t privkeylen) { static int secp256k1_eckey_privkey_parse(secp256k1_scalar *key, const unsigned char *privkey, size_t privkeylen) {
unsigned char c[32] = {0}; unsigned char c[32] = {0};
const unsigned char *end = privkey + privkeylen; const unsigned char *end = privkey + privkeylen;
int lenb = 0; int lenb = 0;
@ -94,9 +94,9 @@ static int secp256k1_eckey_privkey_parse(secp256k1_scalar_t *key, const unsigned
return !overflow; return !overflow;
} }
static int secp256k1_eckey_privkey_serialize(const secp256k1_ecmult_gen_context_t *ctx, unsigned char *privkey, size_t *privkeylen, const secp256k1_scalar_t *key, unsigned int flags) { static int secp256k1_eckey_privkey_serialize(const secp256k1_ecmult_gen_context *ctx, unsigned char *privkey, size_t *privkeylen, const secp256k1_scalar *key, unsigned int flags) {
secp256k1_gej_t rp; secp256k1_gej rp;
secp256k1_ge_t r; secp256k1_ge r;
size_t pubkeylen = 0; size_t pubkeylen = 0;
secp256k1_ecmult_gen(ctx, &rp, key); secp256k1_ecmult_gen(ctx, &rp, key);
secp256k1_ge_set_gej(&r, &rp); secp256k1_ge_set_gej(&r, &rp);
@ -154,7 +154,7 @@ static int secp256k1_eckey_privkey_serialize(const secp256k1_ecmult_gen_context_
return 1; return 1;
} }
static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar_t *key, const secp256k1_scalar_t *tweak) { static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar *key, const secp256k1_scalar *tweak) {
secp256k1_scalar_add(key, key, tweak); secp256k1_scalar_add(key, key, tweak);
if (secp256k1_scalar_is_zero(key)) { if (secp256k1_scalar_is_zero(key)) {
return 0; return 0;
@ -162,9 +162,9 @@ static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar_t *key, const secp
return 1; return 1;
} }
static int secp256k1_eckey_pubkey_tweak_add(const secp256k1_ecmult_context_t *ctx, secp256k1_ge_t *key, const secp256k1_scalar_t *tweak) { static int secp256k1_eckey_pubkey_tweak_add(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak) {
secp256k1_gej_t pt; secp256k1_gej pt;
secp256k1_scalar_t one; secp256k1_scalar one;
secp256k1_gej_set_ge(&pt, key); secp256k1_gej_set_ge(&pt, key);
secp256k1_scalar_set_int(&one, 1); secp256k1_scalar_set_int(&one, 1);
secp256k1_ecmult(ctx, &pt, &pt, &one, tweak); secp256k1_ecmult(ctx, &pt, &pt, &one, tweak);
@ -176,7 +176,7 @@ static int secp256k1_eckey_pubkey_tweak_add(const secp256k1_ecmult_context_t *ct
return 1; return 1;
} }
static int secp256k1_eckey_privkey_tweak_mul(secp256k1_scalar_t *key, const secp256k1_scalar_t *tweak) { static int secp256k1_eckey_privkey_tweak_mul(secp256k1_scalar *key, const secp256k1_scalar *tweak) {
if (secp256k1_scalar_is_zero(tweak)) { if (secp256k1_scalar_is_zero(tweak)) {
return 0; return 0;
} }
@ -185,9 +185,9 @@ static int secp256k1_eckey_privkey_tweak_mul(secp256k1_scalar_t *key, const secp
return 1; return 1;
} }
static int secp256k1_eckey_pubkey_tweak_mul(const secp256k1_ecmult_context_t *ctx, secp256k1_ge_t *key, const secp256k1_scalar_t *tweak) { static int secp256k1_eckey_pubkey_tweak_mul(const secp256k1_ecmult_context *ctx, secp256k1_ge *key, const secp256k1_scalar *tweak) {
secp256k1_scalar_t zero; secp256k1_scalar zero;
secp256k1_gej_t pt; secp256k1_gej pt;
if (secp256k1_scalar_is_zero(tweak)) { if (secp256k1_scalar_is_zero(tweak)) {
return 0; return 0;
} }

20
src/ecmult.h
View file

@ -12,20 +12,20 @@
typedef struct { typedef struct {
/* For accelerating the computation of a*P + b*G: */ /* For accelerating the computation of a*P + b*G: */
secp256k1_ge_storage_t (*pre_g)[]; /* odd multiples of the generator */ secp256k1_ge_storage (*pre_g)[]; /* odd multiples of the generator */
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
secp256k1_ge_storage_t (*pre_g_128)[]; /* odd multiples of 2^128*generator */ secp256k1_ge_storage (*pre_g_128)[]; /* odd multiples of 2^128*generator */
#endif #endif
} secp256k1_ecmult_context_t; } secp256k1_ecmult_context;
static void secp256k1_ecmult_context_init(secp256k1_ecmult_context_t *ctx); static void secp256k1_ecmult_context_init(secp256k1_ecmult_context *ctx);
static void secp256k1_ecmult_context_build(secp256k1_ecmult_context_t *ctx, const callback_t *cb); static void secp256k1_ecmult_context_build(secp256k1_ecmult_context *ctx, const secp256k1_callback *cb);
static void secp256k1_ecmult_context_clone(secp256k1_ecmult_context_t *dst, static void secp256k1_ecmult_context_clone(secp256k1_ecmult_context *dst,
const secp256k1_ecmult_context_t *src, const callback_t *cb); const secp256k1_ecmult_context *src, const secp256k1_callback *cb);
static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context_t *ctx); static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context *ctx);
static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context_t *ctx); static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context *ctx);
/** Double multiply: R = na*A + ng*G */ /** Double multiply: R = na*A + ng*G */
static void secp256k1_ecmult(const secp256k1_ecmult_context_t *ctx, secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_scalar_t *na, const secp256k1_scalar_t *ng); static void secp256k1_ecmult(const secp256k1_ecmult_context *ctx, secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng);
#endif #endif

2
src/ecmult_const.h
View file

@ -10,6 +10,6 @@
#include "scalar.h" #include "scalar.h"
#include "group.h" #include "group.h"
static void secp256k1_ecmult_const(secp256k1_gej_t *r, const secp256k1_ge_t *a, const secp256k1_scalar_t *q); static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *q);
#endif #endif

30
src/ecmult_const_impl.h
View file

@ -24,7 +24,7 @@
int m; \ int m; \
int abs_n = (n) * (((n) > 0) * 2 - 1); \ int abs_n = (n) * (((n) > 0) * 2 - 1); \
int idx_n = abs_n / 2; \ int idx_n = abs_n / 2; \
secp256k1_fe_t neg_y; \ secp256k1_fe neg_y; \
VERIFY_CHECK(((n) & 1) == 1); \ VERIFY_CHECK(((n) & 1) == 1); \
VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \ VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \
VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \ VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \
@ -54,7 +54,7 @@
* *
* Numbers reference steps of `Algorithm SPA-resistant Width-w NAF with Odd Scalar` on pp. 335 * Numbers reference steps of `Algorithm SPA-resistant Width-w NAF with Odd Scalar` on pp. 335
*/ */
static int secp256k1_wnaf_const(int *wnaf, secp256k1_scalar_t s, int w) { static int secp256k1_wnaf_const(int *wnaf, secp256k1_scalar s, int w) {
int global_sign = 1; int global_sign = 1;
int skew = 0; int skew = 0;
int word = 0; int word = 0;
@ -74,7 +74,7 @@ static int secp256k1_wnaf_const(int *wnaf, secp256k1_scalar_t s, int w) {
/* We add 1 to even numbers, 2 to odd ones, noting that negation flips parity */ /* We add 1 to even numbers, 2 to odd ones, noting that negation flips parity */
int bit = flip ^ (s.d[0] & 1); int bit = flip ^ (s.d[0] & 1);
/* We check for negative one, since adding 2 to it will cause an overflow */ /* We check for negative one, since adding 2 to it will cause an overflow */
secp256k1_scalar_t neg_s; secp256k1_scalar neg_s;
int not_neg_one; int not_neg_one;
secp256k1_scalar_negate(&neg_s, &s); secp256k1_scalar_negate(&neg_s, &s);
not_neg_one = !secp256k1_scalar_is_one(&neg_s); not_neg_one = !secp256k1_scalar_is_one(&neg_s);
@ -120,24 +120,24 @@ static int secp256k1_wnaf_const(int *wnaf, secp256k1_scalar_t s, int w) {
} }
static void secp256k1_ecmult_const(secp256k1_gej_t *r, const secp256k1_ge_t *a, const secp256k1_scalar_t *scalar) { static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *scalar) {
secp256k1_ge_t pre_a[ECMULT_TABLE_SIZE(WINDOW_A)]; secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
secp256k1_ge_t tmpa; secp256k1_ge tmpa;
secp256k1_fe_t Z; secp256k1_fe Z;
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
secp256k1_ge_t pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)]; secp256k1_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];
int wnaf_1[1 + WNAF_SIZE(WINDOW_A - 1)]; int wnaf_1[1 + WNAF_SIZE(WINDOW_A - 1)];
int wnaf_lam[1 + WNAF_SIZE(WINDOW_A - 1)]; int wnaf_lam[1 + WNAF_SIZE(WINDOW_A - 1)];
int skew_1; int skew_1;
int skew_lam; int skew_lam;
secp256k1_scalar_t q_1, q_lam; secp256k1_scalar q_1, q_lam;
#else #else
int wnaf[1 + WNAF_SIZE(WINDOW_A - 1)]; int wnaf[1 + WNAF_SIZE(WINDOW_A - 1)];
#endif #endif
int i; int i;
secp256k1_scalar_t sc = *scalar; secp256k1_scalar sc = *scalar;
/* build wnaf representation for q. */ /* build wnaf representation for q. */
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
@ -223,11 +223,11 @@ static void secp256k1_ecmult_const(secp256k1_gej_t *r, const secp256k1_ge_t *a,
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
{ {
/* Correct for wNAF skew */ /* Correct for wNAF skew */
secp256k1_ge_t correction = *a; secp256k1_ge correction = *a;
secp256k1_ge_storage_t correction_1_stor; secp256k1_ge_storage correction_1_stor;
secp256k1_ge_storage_t correction_lam_stor; secp256k1_ge_storage correction_lam_stor;
secp256k1_ge_storage_t a2_stor; secp256k1_ge_storage a2_stor;
secp256k1_gej_t tmpj; secp256k1_gej tmpj;
secp256k1_gej_set_ge(&tmpj, &correction); secp256k1_gej_set_ge(&tmpj, &correction);
secp256k1_gej_double_var(&tmpj, &tmpj, NULL); secp256k1_gej_double_var(&tmpj, &tmpj, NULL);
secp256k1_ge_set_gej(&correction, &tmpj); secp256k1_ge_set_gej(&correction, &tmpj);

24
src/ecmult_gen.h
View file

@ -23,21 +23,21 @@ typedef struct {
* None of the resulting prec group elements have a known scalar, and neither do any of * None of the resulting prec group elements have a known scalar, and neither do any of
* the intermediate sums while computing a*G. * the intermediate sums while computing a*G.
*/ */
secp256k1_ge_storage_t (*prec)[64][16]; /* prec[j][i] = 16^j * i * G + U_i */ secp256k1_ge_storage (*prec)[64][16]; /* prec[j][i] = 16^j * i * G + U_i */
secp256k1_scalar_t blind; secp256k1_scalar blind;
secp256k1_gej_t initial; secp256k1_gej initial;
} secp256k1_ecmult_gen_context_t; } secp256k1_ecmult_gen_context;
static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context_t* ctx); static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context* ctx);
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context_t* ctx, const callback_t* cb); static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context* ctx, const secp256k1_callback* cb);
static void secp256k1_ecmult_gen_context_clone(secp256k1_ecmult_gen_context_t *dst, static void secp256k1_ecmult_gen_context_clone(secp256k1_ecmult_gen_context *dst,
const secp256k1_ecmult_gen_context_t* src, const callback_t* cb); const secp256k1_ecmult_gen_context* src, const secp256k1_callback* cb);
static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context_t* ctx); static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context* ctx);
static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context_t* ctx); static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx);
/** Multiply with the generator: R = a*G */ /** Multiply with the generator: R = a*G */
static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context_t* ctx, secp256k1_gej_t *r, const secp256k1_scalar_t *a); static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context* ctx, secp256k1_gej *r, const secp256k1_scalar *a);
static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context_t *ctx, const unsigned char *seed32); static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context *ctx, const unsigned char *seed32);
#endif #endif

50
src/ecmult_gen_impl.h
View file

@ -14,15 +14,15 @@
#ifdef USE_ECMULT_STATIC_PRECOMPUTATION #ifdef USE_ECMULT_STATIC_PRECOMPUTATION
#include "ecmult_static_context.h" #include "ecmult_static_context.h"
#endif #endif
static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context_t *ctx) { static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context *ctx) {
ctx->prec = NULL; ctx->prec = NULL;
} }
static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context_t *ctx, const callback_t* cb) { static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context *ctx, const secp256k1_callback* cb) {
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION #ifndef USE_ECMULT_STATIC_PRECOMPUTATION
secp256k1_ge_t prec[1024]; secp256k1_ge prec[1024];
secp256k1_gej_t gj; secp256k1_gej gj;
secp256k1_gej_t nums_gej; secp256k1_gej nums_gej;
int i, j; int i, j;
#endif #endif
@ -30,7 +30,7 @@ static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context_t *c
return; return;
} }
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION #ifndef USE_ECMULT_STATIC_PRECOMPUTATION
ctx->prec = (secp256k1_ge_storage_t (*)[64][16])checked_malloc(cb, sizeof(*ctx->prec)); ctx->prec = (secp256k1_ge_storage (*)[64][16])checked_malloc(cb, sizeof(*ctx->prec));
/* get the generator */ /* get the generator */
secp256k1_gej_set_ge(&gj, &secp256k1_ge_const_g); secp256k1_gej_set_ge(&gj, &secp256k1_ge_const_g);
@ -38,8 +38,8 @@ static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context_t *c
/* Construct a group element with no known corresponding scalar (nothing up my sleeve). */ /* Construct a group element with no known corresponding scalar (nothing up my sleeve). */
{ {
static const unsigned char nums_b32[33] = "The scalar for this x is unknown"; static const unsigned char nums_b32[33] = "The scalar for this x is unknown";
secp256k1_fe_t nums_x; secp256k1_fe nums_x;
secp256k1_ge_t nums_ge; secp256k1_ge nums_ge;
VERIFY_CHECK(secp256k1_fe_set_b32(&nums_x, nums_b32)); VERIFY_CHECK(secp256k1_fe_set_b32(&nums_x, nums_b32));
VERIFY_CHECK(secp256k1_ge_set_xo_var(&nums_ge, &nums_x, 0)); VERIFY_CHECK(secp256k1_ge_set_xo_var(&nums_ge, &nums_x, 0));
secp256k1_gej_set_ge(&nums_gej, &nums_ge); secp256k1_gej_set_ge(&nums_gej, &nums_ge);
@ -49,9 +49,9 @@ static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context_t *c
/* compute prec. */ /* compute prec. */
{ {
secp256k1_gej_t precj[1024]; /* Jacobian versions of prec. */ secp256k1_gej precj[1024]; /* Jacobian versions of prec. */
secp256k1_gej_t gbase; secp256k1_gej gbase;
secp256k1_gej_t numsbase; secp256k1_gej numsbase;
gbase = gj; /* 16^j * G */ gbase = gj; /* 16^j * G */
numsbase = nums_gej; /* 2^j * nums. */ numsbase = nums_gej; /* 2^j * nums. */
for (j = 0; j < 64; j++) { for (j = 0; j < 64; j++) {
@ -81,22 +81,22 @@ static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context_t *c
} }
#else #else
(void)cb; (void)cb;
ctx->prec = (secp256k1_ge_storage_t (*)[64][16])secp256k1_ecmult_static_context; ctx->prec = (secp256k1_ge_storage (*)[64][16])secp256k1_ecmult_static_context;
#endif #endif
secp256k1_ecmult_gen_blind(ctx, NULL); secp256k1_ecmult_gen_blind(ctx, NULL);
} }
static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context_t* ctx) { static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx) {
return ctx->prec != NULL; return ctx->prec != NULL;
} }
static void secp256k1_ecmult_gen_context_clone(secp256k1_ecmult_gen_context_t *dst, static void secp256k1_ecmult_gen_context_clone(secp256k1_ecmult_gen_context *dst,
const secp256k1_ecmult_gen_context_t *src, const callback_t* cb) { const secp256k1_ecmult_gen_context *src, const secp256k1_callback* cb) {
if (src->prec == NULL) { if (src->prec == NULL) {
dst->prec = NULL; dst->prec = NULL;
} else { } else {
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION #ifndef USE_ECMULT_STATIC_PRECOMPUTATION
dst->prec = (secp256k1_ge_storage_t (*)[64][16])checked_malloc(cb, sizeof(*dst->prec)); dst->prec = (secp256k1_ge_storage (*)[64][16])checked_malloc(cb, sizeof(*dst->prec));
memcpy(dst->prec, src->prec, sizeof(*dst->prec)); memcpy(dst->prec, src->prec, sizeof(*dst->prec));
#else #else
(void)cb; (void)cb;
@ -107,7 +107,7 @@ static void secp256k1_ecmult_gen_context_clone(secp256k1_ecmult_gen_context_t *d
} }
} }
static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context_t *ctx) { static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context *ctx) {
#ifndef USE_ECMULT_STATIC_PRECOMPUTATION #ifndef USE_ECMULT_STATIC_PRECOMPUTATION
free(ctx->prec); free(ctx->prec);
#endif #endif
@ -116,10 +116,10 @@ static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context_t *c
ctx->prec = NULL; ctx->prec = NULL;
} }
static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context_t *ctx, secp256k1_gej_t *r, const secp256k1_scalar_t *gn) { static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context *ctx, secp256k1_gej *r, const secp256k1_scalar *gn) {
secp256k1_ge_t add; secp256k1_ge add;
secp256k1_ge_storage_t adds; secp256k1_ge_storage adds;
secp256k1_scalar_t gnb; secp256k1_scalar gnb;
int bits; int bits;
int i, j; int i, j;
memset(&adds, 0, sizeof(adds)); memset(&adds, 0, sizeof(adds));
@ -151,10 +151,10 @@ static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context_t *ctx, secp
} }
/* Setup blinding values for secp256k1_ecmult_gen. */ /* Setup blinding values for secp256k1_ecmult_gen. */
static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context_t *ctx, const unsigned char *seed32) { static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context *ctx, const unsigned char *seed32) {
secp256k1_scalar_t b; secp256k1_scalar b;
secp256k1_gej_t gb; secp256k1_gej gb;
secp256k1_fe_t s; secp256k1_fe s;
unsigned char nonce32[32]; unsigned char nonce32[32];
secp256k1_rfc6979_hmac_sha256_t rng; secp256k1_rfc6979_hmac_sha256_t rng;
int retry; int retry;

62
src/ecmult_impl.h
View file

@ -32,9 +32,9 @@
* contain prej[0].z / a.z. The other zr[i] values = prej[i].z / prej[i-1].z. * contain prej[0].z / a.z. The other zr[i] values = prej[i].z / prej[i-1].z.
* Prej's Z values are undefined, except for the last value. * Prej's Z values are undefined, except for the last value.
*/ */
static void secp256k1_ecmult_odd_multiples_table(int n, secp256k1_gej_t *prej, secp256k1_fe_t *zr, const secp256k1_gej_t *a) { static void secp256k1_ecmult_odd_multiples_table(int n, secp256k1_gej *prej, secp256k1_fe *zr, const secp256k1_gej *a) {
secp256k1_gej_t d; secp256k1_gej d;
secp256k1_ge_t a_ge, d_ge; secp256k1_ge a_ge, d_ge;
int i; int i;
VERIFY_CHECK(!a->infinity); VERIFY_CHECK(!a->infinity);
@ -82,9 +82,9 @@ static void secp256k1_ecmult_odd_multiples_table(int n, secp256k1_gej_t *prej, s
* and for G using the second (which requires an inverse, but it only needs to * and for G using the second (which requires an inverse, but it only needs to
* happen once). * happen once).
*/ */
static void secp256k1_ecmult_odd_multiples_table_globalz_windowa(secp256k1_ge_t *pre, secp256k1_fe_t *globalz, const secp256k1_gej_t *a) { static void secp256k1_ecmult_odd_multiples_table_globalz_windowa(secp256k1_ge *pre, secp256k1_fe *globalz, const secp256k1_gej *a) {
secp256k1_gej_t prej[ECMULT_TABLE_SIZE(WINDOW_A)]; secp256k1_gej prej[ECMULT_TABLE_SIZE(WINDOW_A)];
secp256k1_fe_t zr[ECMULT_TABLE_SIZE(WINDOW_A)]; secp256k1_fe zr[ECMULT_TABLE_SIZE(WINDOW_A)];
/* Compute the odd multiples in Jacobian form. */ /* Compute the odd multiples in Jacobian form. */
secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), prej, zr, a); secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), prej, zr, a);
@ -92,10 +92,10 @@ static void secp256k1_ecmult_odd_multiples_table_globalz_windowa(secp256k1_ge_t
secp256k1_ge_globalz_set_table_gej(ECMULT_TABLE_SIZE(WINDOW_A), pre, globalz, prej, zr); secp256k1_ge_globalz_set_table_gej(ECMULT_TABLE_SIZE(WINDOW_A), pre, globalz, prej, zr);
} }
static void secp256k1_ecmult_odd_multiples_table_storage_var(int n, secp256k1_ge_storage_t *pre, const secp256k1_gej_t *a, const callback_t *cb) { static void secp256k1_ecmult_odd_multiples_table_storage_var(int n, secp256k1_ge_storage *pre, const secp256k1_gej *a, const secp256k1_callback *cb) {
secp256k1_gej_t *prej = (secp256k1_gej_t*)checked_malloc(cb, sizeof(secp256k1_gej_t) * n); secp256k1_gej *prej = (secp256k1_gej*)checked_malloc(cb, sizeof(secp256k1_gej) * n);
secp256k1_ge_t *prea = (secp256k1_ge_t*)checked_malloc(cb, sizeof(secp256k1_ge_t) * n); secp256k1_ge *prea = (secp256k1_ge*)checked_malloc(cb, sizeof(secp256k1_ge) * n);
secp256k1_fe_t *zr = (secp256k1_fe_t*)checked_malloc(cb, sizeof(secp256k1_fe_t) * n); secp256k1_fe *zr = (secp256k1_fe*)checked_malloc(cb, sizeof(secp256k1_fe) * n);
int i; int i;
/* Compute the odd multiples in Jacobian form. */ /* Compute the odd multiples in Jacobian form. */
@ -137,15 +137,15 @@ static void secp256k1_ecmult_odd_multiples_table_storage_var(int n, secp256k1_ge
} \ } \
} while(0) } while(0)
static void secp256k1_ecmult_context_init(secp256k1_ecmult_context_t *ctx) { static void secp256k1_ecmult_context_init(secp256k1_ecmult_context *ctx) {
ctx->pre_g = NULL; ctx->pre_g = NULL;
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
ctx->pre_g_128 = NULL; ctx->pre_g_128 = NULL;
#endif #endif
} }
static void secp256k1_ecmult_context_build(secp256k1_ecmult_context_t *ctx, const callback_t *cb) { static void secp256k1_ecmult_context_build(secp256k1_ecmult_context *ctx, const secp256k1_callback *cb) {
secp256k1_gej_t gj; secp256k1_gej gj;
if (ctx->pre_g != NULL) { if (ctx->pre_g != NULL) {
return; return;
@ -154,17 +154,17 @@ static void secp256k1_ecmult_context_build(secp256k1_ecmult_context_t *ctx, cons
/* get the generator */ /* get the generator */
secp256k1_gej_set_ge(&gj, &secp256k1_ge_const_g); secp256k1_gej_set_ge(&gj, &secp256k1_ge_const_g);
ctx->pre_g = (secp256k1_ge_storage_t (*)[])checked_malloc(cb, sizeof((*ctx->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G)); ctx->pre_g = (secp256k1_ge_storage (*)[])checked_malloc(cb, sizeof((*ctx->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G));
/* precompute the tables with odd multiples */ /* precompute the tables with odd multiples */
secp256k1_ecmult_odd_multiples_table_storage_var(ECMULT_TABLE_SIZE(WINDOW_G), *ctx->pre_g, &gj, cb); secp256k1_ecmult_odd_multiples_table_storage_var(ECMULT_TABLE_SIZE(WINDOW_G), *ctx->pre_g, &gj, cb);
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
{ {
secp256k1_gej_t g_128j; secp256k1_gej g_128j;
int i; int i;
ctx->pre_g_128 = (secp256k1_ge_storage_t (*)[])checked_malloc(cb, sizeof((*ctx->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G)); ctx->pre_g_128 = (secp256k1_ge_storage (*)[])checked_malloc(cb, sizeof((*ctx->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G));
/* calculate 2^128*generator */ /* calculate 2^128*generator */
g_128j = gj; g_128j = gj;
@ -176,13 +176,13 @@ static void secp256k1_ecmult_context_build(secp256k1_ecmult_context_t *ctx, cons
#endif #endif
} }
static void secp256k1_ecmult_context_clone(secp256k1_ecmult_context_t *dst, static void secp256k1_ecmult_context_clone(secp256k1_ecmult_context *dst,
const secp256k1_ecmult_context_t *src, const callback_t *cb) { const secp256k1_ecmult_context *src, const secp256k1_callback *cb) {
if (src->pre_g == NULL) { if (src->pre_g == NULL) {
dst->pre_g = NULL; dst->pre_g = NULL;
} else { } else {
size_t size = sizeof((*dst->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G); size_t size = sizeof((*dst->pre_g)[0]) * ECMULT_TABLE_SIZE(WINDOW_G);
dst->pre_g = (secp256k1_ge_storage_t (*)[])checked_malloc(cb, size); dst->pre_g = (secp256k1_ge_storage (*)[])checked_malloc(cb, size);
memcpy(dst->pre_g, src->pre_g, size); memcpy(dst->pre_g, src->pre_g, size);
} }
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
@ -190,17 +190,17 @@ static void secp256k1_ecmult_context_clone(secp256k1_ecmult_context_t *dst,
dst->pre_g_128 = NULL; dst->pre_g_128 = NULL;
} else { } else {
size_t size = sizeof((*dst->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G); size_t size = sizeof((*dst->pre_g_128)[0]) * ECMULT_TABLE_SIZE(WINDOW_G);
dst->pre_g_128 = (secp256k1_ge_storage_t (*)[])checked_malloc(cb, size); dst->pre_g_128 = (secp256k1_ge_storage (*)[])checked_malloc(cb, size);
memcpy(dst->pre_g_128, src->pre_g_128, size); memcpy(dst->pre_g_128, src->pre_g_128, size);
} }
#endif #endif
} }
static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context_t *ctx) { static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context *ctx) {
return ctx->pre_g != NULL; return ctx->pre_g != NULL;
} }
static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context_t *ctx) { static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context *ctx) {
free(ctx->pre_g); free(ctx->pre_g);
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
free(ctx->pre_g_128); free(ctx->pre_g_128);
@ -215,8 +215,8 @@ static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context_t *ctx) {
* - the number of set values in wnaf is returned. This number is at most 256, and at most one more * - the number of set values in wnaf is returned. This number is at most 256, and at most one more
* than the number of bits in the (absolute value) of the input. * than the number of bits in the (absolute value) of the input.
*/ */
static int secp256k1_ecmult_wnaf(int *wnaf, int len, const secp256k1_scalar_t *a, int w) { static int secp256k1_ecmult_wnaf(int *wnaf, int len, const secp256k1_scalar *a, int w) {
secp256k1_scalar_t s = *a; secp256k1_scalar s = *a;
int last_set_bit = -1; int last_set_bit = -1;
int bit = 0; int bit = 0;
int sign = 1; int sign = 1;
@ -266,15 +266,15 @@ static int secp256k1_ecmult_wnaf(int *wnaf, int len, const secp256k1_scalar_t *a
return last_set_bit + 1; return last_set_bit + 1;
} }
static void secp256k1_ecmult(const secp256k1_ecmult_context_t *ctx, secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_scalar_t *na, const secp256k1_scalar_t *ng) { static void secp256k1_ecmult(const secp256k1_ecmult_context *ctx, secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
secp256k1_ge_t pre_a[ECMULT_TABLE_SIZE(WINDOW_A)]; secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
secp256k1_ge_t tmpa; secp256k1_ge tmpa;
secp256k1_fe_t Z; secp256k1_fe Z;
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
secp256k1_ge_t pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)]; secp256k1_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];
secp256k1_scalar_t na_1, na_lam; secp256k1_scalar na_1, na_lam;
/* Splitted G factors. */ /* Splitted G factors. */
secp256k1_scalar_t ng_1, ng_128; secp256k1_scalar ng_1, ng_128;
int wnaf_na_1[130]; int wnaf_na_1[130];
int wnaf_na_lam[130]; int wnaf_na_lam[130];
int bits_na_1; int bits_na_1;

50
src/field.h
View file

@ -31,89 +31,89 @@
#endif #endif
/** Normalize a field element. */ /** Normalize a field element. */
static void secp256k1_fe_normalize(secp256k1_fe_t *r); static void secp256k1_fe_normalize(secp256k1_fe *r);
/** Weakly normalize a field element: reduce it magnitude to 1, but don't fully normalize. */ /** Weakly normalize a field element: reduce it magnitude to 1, but don't fully normalize. */
static void secp256k1_fe_normalize_weak(secp256k1_fe_t *r); static void secp256k1_fe_normalize_weak(secp256k1_fe *r);
/** Normalize a field element, without constant-time guarantee. */ /** Normalize a field element, without constant-time guarantee. */
static void secp256k1_fe_normalize_var(secp256k1_fe_t *r); static void secp256k1_fe_normalize_var(secp256k1_fe *r);
/** Verify whether a field element represents zero i.e. would normalize to a zero value. The field /** Verify whether a field element represents zero i.e. would normalize to a zero value. The field
* implementation may optionally normalize the input, but this should not be relied upon. */ * implementation may optionally normalize the input, but this should not be relied upon. */
static int secp256k1_fe_normalizes_to_zero(secp256k1_fe_t *r); static int secp256k1_fe_normalizes_to_zero(secp256k1_fe *r);
/** Verify whether a field element represents zero i.e. would normalize to a zero value. The field /** Verify whether a field element represents zero i.e. would normalize to a zero value. The field
* implementation may optionally normalize the input, but this should not be relied upon. */ * implementation may optionally normalize the input, but this should not be relied upon. */
static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe_t *r); static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe *r);
/** Set a field element equal to a small integer. Resulting field element is normalized. */ /** Set a field element equal to a small integer. Resulting field element is normalized. */
static void secp256k1_fe_set_int(secp256k1_fe_t *r, int a); static void secp256k1_fe_set_int(secp256k1_fe *r, int a);
/** Verify whether a field element is zero. Requires the input to be normalized. */ /** Verify whether a field element is zero. Requires the input to be normalized. */
static int secp256k1_fe_is_zero(const secp256k1_fe_t *a); static int secp256k1_fe_is_zero(const secp256k1_fe *a);
/** Check the "oddness" of a field element. Requires the input to be normalized. */ /** Check the "oddness" of a field element. Requires the input to be normalized. */
static int secp256k1_fe_is_odd(const secp256k1_fe_t *a); static int secp256k1_fe_is_odd(const secp256k1_fe *a);
/** Compare two field elements. Requires magnitude-1 inputs. */ /** Compare two field elements. Requires magnitude-1 inputs. */
static int secp256k1_fe_equal_var(const secp256k1_fe_t *a, const secp256k1_fe_t *b); static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b);
/** Compare two field elements. Requires both inputs to be normalized */ /** Compare two field elements. Requires both inputs to be normalized */
static int secp256k1_fe_cmp_var(const secp256k1_fe_t *a, const secp256k1_fe_t *b); static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b);
/** Set a field element equal to 32-byte big endian value. If successful, the resulting field element is normalized. */ /** Set a field element equal to 32-byte big endian value. If successful, the resulting field element is normalized. */
static int secp256k1_fe_set_b32(secp256k1_fe_t *r, const unsigned char *a); static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a);
/** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */ /** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe_t *a); static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe *a);
/** Set a field element equal to the additive inverse of another. Takes a maximum magnitude of the input /** Set a field element equal to the additive inverse of another. Takes a maximum magnitude of the input
* as an argument. The magnitude of the output is one higher. */ * as an argument. The magnitude of the output is one higher. */
static void secp256k1_fe_negate(secp256k1_fe_t *r, const secp256k1_fe_t *a, int m); static void secp256k1_fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m);
/** Multiplies the passed field element with a small integer constant. Multiplies the magnitude by that /** Multiplies the passed field element with a small integer constant. Multiplies the magnitude by that
* small integer. */ * small integer. */
static void secp256k1_fe_mul_int(secp256k1_fe_t *r, int a); static void secp256k1_fe_mul_int(secp256k1_fe *r, int a);
/** Adds a field element to another. The result has the sum of the inputs' magnitudes as magnitude. */ /** Adds a field element to another. The result has the sum of the inputs' magnitudes as magnitude. */
static void secp256k1_fe_add(secp256k1_fe_t *r, const secp256k1_fe_t *a); static void secp256k1_fe_add(secp256k1_fe *r, const secp256k1_fe *a);
/** Sets a field element to be the product of two others. Requires the inputs' magnitudes to be at most 8. /** Sets a field element to be the product of two others. Requires the inputs' magnitudes to be at most 8.
* The output magnitude is 1 (but not guaranteed to be normalized). */ * The output magnitude is 1 (but not guaranteed to be normalized). */
static void secp256k1_fe_mul(secp256k1_fe_t *r, const secp256k1_fe_t *a, const secp256k1_fe_t * SECP256K1_RESTRICT b); static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b);
/** Sets a field element to be the square of another. Requires the input's magnitude to be at most 8. /** Sets a field element to be the square of another. Requires the input's magnitude to be at most 8.
* The output magnitude is 1 (but not guaranteed to be normalized). */ * The output magnitude is 1 (but not guaranteed to be normalized). */
static void secp256k1_fe_sqr(secp256k1_fe_t *r, const secp256k1_fe_t *a); static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a);
/** Sets a field element to be the (modular) square root (if any exist) of another. Requires the /** Sets a field element to be the (modular) square root (if any exist) of another. Requires the
* input's magnitude to be at most 8. The output magnitude is 1 (but not guaranteed to be * input's magnitude to be at most 8. The output magnitude is 1 (but not guaranteed to be
* normalized). Return value indicates whether a square root was found. */ * normalized). Return value indicates whether a square root was found. */
static int secp256k1_fe_sqrt_var(secp256k1_fe_t *r, const secp256k1_fe_t *a); static int secp256k1_fe_sqrt_var(secp256k1_fe *r, const secp256k1_fe *a);
/** Sets a field element to be the (modular) inverse of another. Requires the input's magnitude to be /** Sets a field element to be the (modular) inverse of another. Requires the input's magnitude to be
* at most 8. The output magnitude is 1 (but not guaranteed to be normalized). */ * at most 8. The output magnitude is 1 (but not guaranteed to be normalized). */
static void secp256k1_fe_inv(secp256k1_fe_t *r, const secp256k1_fe_t *a); static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *a);
/** Potentially faster version of secp256k1_fe_inv, without constant-time guarantee. */ /** Potentially faster version of secp256k1_fe_inv, without constant-time guarantee. */
static void secp256k1_fe_inv_var(secp256k1_fe_t *r, const secp256k1_fe_t *a); static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *a);
/** Calculate the (modular) inverses of a batch of field elements. Requires the inputs' magnitudes to be /** Calculate the (modular) inverses of a batch of field elements. Requires the inputs' magnitudes to be
* at most 8. The output magnitudes are 1 (but not guaranteed to be normalized). The inputs and * at most 8. The output magnitudes are 1 (but not guaranteed to be normalized). The inputs and
* outputs must not overlap in memory. */ * outputs must not overlap in memory. */
static void secp256k1_fe_inv_all_var(size_t len, secp256k1_fe_t *r, const secp256k1_fe_t *a); static void secp256k1_fe_inv_all_var(size_t len, secp256k1_fe *r, const secp256k1_fe *a);
/** Convert a field element to the storage type. */ /** Convert a field element to the storage type. */
static void secp256k1_fe_to_storage(secp256k1_fe_storage_t *r, const secp256k1_fe_t*); static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe*);
/** Convert a field element back from the storage type. */ /** Convert a field element back from the storage type. */
static void secp256k1_fe_from_storage(secp256k1_fe_t *r, const secp256k1_fe_storage_t*); static void secp256k1_fe_from_storage(secp256k1_fe *r, const secp256k1_fe_storage*);
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */ /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */
static void secp256k1_fe_storage_cmov(secp256k1_fe_storage_t *r, const secp256k1_fe_storage_t *a, int flag); static void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag);
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */ /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */
static void secp256k1_fe_cmov(secp256k1_fe_t *r, const secp256k1_fe_t *a, int flag); static void secp256k1_fe_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag);
#endif #endif

4
src/field_10x26.h
View file

@ -16,7 +16,7 @@ typedef struct {
int magnitude; int magnitude;
int normalized; int normalized;
#endif #endif
} secp256k1_fe_t; } secp256k1_fe;
/* Unpacks a constant into a overlapping multi-limbed FE element. */ /* Unpacks a constant into a overlapping multi-limbed FE element. */
#define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \ #define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \
@ -40,7 +40,7 @@ typedef struct {
typedef struct { typedef struct {
uint32_t n[8]; uint32_t n[8];
} secp256k1_fe_storage_t; } secp256k1_fe_storage;
#define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ (d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7) }} #define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ (d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7) }}
#define SECP256K1_FE_STORAGE_CONST_GET(d) d.n[7], d.n[6], d.n[5], d.n[4],d.n[3], d.n[2], d.n[1], d.n[0] #define SECP256K1_FE_STORAGE_CONST_GET(d) d.n[7], d.n[6], d.n[5], d.n[4],d.n[3], d.n[2], d.n[1], d.n[0]

46
src/field_10x26_impl.h
View file

@ -14,7 +14,7 @@
#include "field.h" #include "field.h"
#ifdef VERIFY #ifdef VERIFY
static void secp256k1_fe_verify(const secp256k1_fe_t *a) { static void secp256k1_fe_verify(const secp256k1_fe *a) {
const uint32_t *d = a->n; const uint32_t *d = a->n;
int m = a->normalized ? 1 : 2 * a->magnitude, r = 1; int m = a->normalized ? 1 : 2 * a->magnitude, r = 1;
r &= (d[0] <= 0x3FFFFFFUL * m); r &= (d[0] <= 0x3FFFFFFUL * m);
@ -41,12 +41,12 @@ static void secp256k1_fe_verify(const secp256k1_fe_t *a) {
VERIFY_CHECK(r == 1); VERIFY_CHECK(r == 1);
} }
#else #else
static void secp256k1_fe_verify(const secp256k1_fe_t *a) { static void secp256k1_fe_verify(const secp256k1_fe *a) {
(void)a; (void)a;
} }
#endif #endif
static void secp256k1_fe_normalize(secp256k1_fe_t *r) { static void secp256k1_fe_normalize(secp256k1_fe *r) {
uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4], uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9]; t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
@ -101,7 +101,7 @@ static void secp256k1_fe_normalize(secp256k1_fe_t *r) {
#endif #endif
} }
static void secp256k1_fe_normalize_weak(secp256k1_fe_t *r) { static void secp256k1_fe_normalize_weak(secp256k1_fe *r) {
uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4], uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9]; t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
@ -132,7 +132,7 @@ static void secp256k1_fe_normalize_weak(secp256k1_fe_t *r) {
#endif #endif
} }
static void secp256k1_fe_normalize_var(secp256k1_fe_t *r) { static void secp256k1_fe_normalize_var(secp256k1_fe *r) {
uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4], uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9]; t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
@ -188,7 +188,7 @@ static void secp256k1_fe_normalize_var(secp256k1_fe_t *r) {
#endif #endif
} }
static int secp256k1_fe_normalizes_to_zero(secp256k1_fe_t *r) { static int secp256k1_fe_normalizes_to_zero(secp256k1_fe *r) {
uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4], uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9]; t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
@ -217,7 +217,7 @@ static int secp256k1_fe_normalizes_to_zero(secp256k1_fe_t *r) {
return (z0 == 0) | (z1 == 0x3FFFFFFUL); return (z0 == 0) | (z1 == 0x3FFFFFFUL);
} }
static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe_t *r) { static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe *r) {
uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9; uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
uint32_t z0, z1; uint32_t z0, z1;
uint32_t x; uint32_t x;
@ -269,7 +269,7 @@ static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe_t *r) {
return (z0 == 0) | (z1 == 0x3FFFFFFUL); return (z0 == 0) | (z1 == 0x3FFFFFFUL);
} }
SECP256K1_INLINE static void secp256k1_fe_set_int(secp256k1_fe_t *r, int a) { SECP256K1_INLINE static void secp256k1_fe_set_int(secp256k1_fe *r, int a) {
r->n[0] = a; r->n[0] = a;
r->n[1] = r->n[2] = r->n[3] = r->n[4] = r->n[5] = r->n[6] = r->n[7] = r->n[8] = r->n[9] = 0; r->n[1] = r->n[2] = r->n[3] = r->n[4] = r->n[5] = r->n[6] = r->n[7] = r->n[8] = r->n[9] = 0;
#ifdef VERIFY #ifdef VERIFY
@ -279,7 +279,7 @@ SECP256K1_INLINE static void secp256k1_fe_set_int(secp256k1_fe_t *r, int a) {
#endif #endif
} }
SECP256K1_INLINE static int secp256k1_fe_is_zero(const secp256k1_fe_t *a) { SECP256K1_INLINE static int secp256k1_fe_is_zero(const secp256k1_fe *a) {
const uint32_t *t = a->n; const uint32_t *t = a->n;
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
@ -288,7 +288,7 @@ SECP256K1_INLINE static int secp256k1_fe_is_zero(const secp256k1_fe_t *a) {
return (t[0] | t[1] | t[2] | t[3] | t[4] | t[5] | t[6] | t[7] | t[8] | t[9]) == 0; return (t[0] | t[1] | t[2] | t[3] | t[4] | t[5] | t[6] | t[7] | t[8] | t[9]) == 0;
} }
SECP256K1_INLINE static int secp256k1_fe_is_odd(const secp256k1_fe_t *a) { SECP256K1_INLINE static int secp256k1_fe_is_odd(const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
@ -296,7 +296,7 @@ SECP256K1_INLINE static int secp256k1_fe_is_odd(const secp256k1_fe_t *a) {
return a->n[0] & 1; return a->n[0] & 1;
} }
SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe_t *a) { SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe *a) {
int i; int i;
#ifdef VERIFY #ifdef VERIFY
a->magnitude = 0; a->magnitude = 0;
@ -307,7 +307,7 @@ SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe_t *a) {
} }
} }
static int secp256k1_fe_cmp_var(const secp256k1_fe_t *a, const secp256k1_fe_t *b) { static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b) {
int i; int i;
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
@ -326,7 +326,7 @@ static int secp256k1_fe_cmp_var(const secp256k1_fe_t *a, const secp256k1_fe_t *b
return 0; return 0;
} }
static int secp256k1_fe_set_b32(secp256k1_fe_t *r, const unsigned char *a) { static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a) {
int i; int i;
r->n[0] = r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0; r->n[0] = r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
r->n[5] = r->n[6] = r->n[7] = r->n[8] = r->n[9] = 0; r->n[5] = r->n[6] = r->n[7] = r->n[8] = r->n[9] = 0;
@ -350,7 +350,7 @@ static int secp256k1_fe_set_b32(secp256k1_fe_t *r, const unsigned char *a) {
} }
/** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */ /** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe_t *a) { static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe *a) {
int i; int i;
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
@ -368,7 +368,7 @@ static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe_t *a) {
} }
} }
SECP256K1_INLINE static void secp256k1_fe_negate(secp256k1_fe_t *r, const secp256k1_fe_t *a, int m) { SECP256K1_INLINE static void secp256k1_fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->magnitude <= m); VERIFY_CHECK(a->magnitude <= m);
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
@ -390,7 +390,7 @@ SECP256K1_INLINE static void secp256k1_fe_negate(secp256k1_fe_t *r, const secp25
#endif #endif
} }
SECP256K1_INLINE static void secp256k1_fe_mul_int(secp256k1_fe_t *r, int a) { SECP256K1_INLINE static void secp256k1_fe_mul_int(secp256k1_fe *r, int a) {
r->n[0] *= a; r->n[0] *= a;
r->n[1] *= a; r->n[1] *= a;
r->n[2] *= a; r->n[2] *= a;
@ -408,7 +408,7 @@ SECP256K1_INLINE static void secp256k1_fe_mul_int(secp256k1_fe_t *r, int a) {
#endif #endif
} }
SECP256K1_INLINE static void secp256k1_fe_add(secp256k1_fe_t *r, const secp256k1_fe_t *a) { SECP256K1_INLINE static void secp256k1_fe_add(secp256k1_fe *r, const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
#endif #endif
@ -1039,7 +1039,7 @@ SECP256K1_INLINE static void secp256k1_fe_sqr_inner(uint32_t *r, const uint32_t
} }
static void secp256k1_fe_mul(secp256k1_fe_t *r, const secp256k1_fe_t *a, const secp256k1_fe_t * SECP256K1_RESTRICT b) { static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->magnitude <= 8); VERIFY_CHECK(a->magnitude <= 8);
VERIFY_CHECK(b->magnitude <= 8); VERIFY_CHECK(b->magnitude <= 8);
@ -1055,7 +1055,7 @@ static void secp256k1_fe_mul(secp256k1_fe_t *r, const secp256k1_fe_t *a, const s
#endif #endif
} }
static void secp256k1_fe_sqr(secp256k1_fe_t *r, const secp256k1_fe_t *a) { static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->magnitude <= 8); VERIFY_CHECK(a->magnitude <= 8);
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
@ -1068,7 +1068,7 @@ static void secp256k1_fe_sqr(secp256k1_fe_t *r, const secp256k1_fe_t *a) {
#endif #endif
} }
static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe_t *r, const secp256k1_fe_t *a, int flag) { static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag) {
uint32_t mask0, mask1; uint32_t mask0, mask1;
mask0 = flag + ~((uint32_t)0); mask0 = flag + ~((uint32_t)0);
mask1 = ~mask0; mask1 = ~mask0;
@ -1090,7 +1090,7 @@ static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe_t *r, const secp256k
#endif #endif
} }
static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage_t *r, const secp256k1_fe_storage_t *a, int flag) { static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag) {
uint32_t mask0, mask1; uint32_t mask0, mask1;
mask0 = flag + ~((uint32_t)0); mask0 = flag + ~((uint32_t)0);
mask1 = ~mask0; mask1 = ~mask0;
@ -1104,7 +1104,7 @@ static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage_t *r
r->n[7] = (r->n[7] & mask0) | (a->n[7] & mask1); r->n[7] = (r->n[7] & mask0) | (a->n[7] & mask1);
} }
static void secp256k1_fe_to_storage(secp256k1_fe_storage_t *r, const secp256k1_fe_t *a) { static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
#endif #endif
@ -1118,7 +1118,7 @@ static void secp256k1_fe_to_storage(secp256k1_fe_storage_t *r, const secp256k1_f
r->n[7] = a->n[8] >> 16 | a->n[9] << 10; r->n[7] = a->n[8] >> 16 | a->n[9] << 10;
} }
static SECP256K1_INLINE void secp256k1_fe_from_storage(secp256k1_fe_t *r, const secp256k1_fe_storage_t *a) { static SECP256K1_INLINE void secp256k1_fe_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a) {
r->n[0] = a->n[0] & 0x3FFFFFFUL; r->n[0] = a->n[0] & 0x3FFFFFFUL;
r->n[1] = a->n[0] >> 26 | ((a->n[1] << 6) & 0x3FFFFFFUL); r->n[1] = a->n[0] >> 26 | ((a->n[1] << 6) & 0x3FFFFFFUL);
r->n[2] = a->n[1] >> 20 | ((a->n[2] << 12) & 0x3FFFFFFUL); r->n[2] = a->n[1] >> 20 | ((a->n[2] << 12) & 0x3FFFFFFUL);

4
src/field_5x52.h
View file

@ -16,7 +16,7 @@ typedef struct {
int magnitude; int magnitude;
int normalized; int normalized;
#endif #endif
} secp256k1_fe_t; } secp256k1_fe;
/* Unpacks a constant into a overlapping multi-limbed FE element. */ /* Unpacks a constant into a overlapping multi-limbed FE element. */
#define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \ #define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \
@ -35,7 +35,7 @@ typedef struct {
typedef struct { typedef struct {
uint64_t n[4]; uint64_t n[4];
} secp256k1_fe_storage_t; } secp256k1_fe_storage;
#define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ \ #define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ \
(d0) | ((uint64_t)(d1)) << 32, \ (d0) | ((uint64_t)(d1)) << 32, \

46
src/field_5x52_impl.h
View file

@ -31,7 +31,7 @@
*/ */
#ifdef VERIFY #ifdef VERIFY
static void secp256k1_fe_verify(const secp256k1_fe_t *a) { static void secp256k1_fe_verify(const secp256k1_fe *a) {
const uint64_t *d = a->n; const uint64_t *d = a->n;
int m = a->normalized ? 1 : 2 * a->magnitude, r = 1; int m = a->normalized ? 1 : 2 * a->magnitude, r = 1;
/* secp256k1 'p' value defined in "Standards for Efficient Cryptography" (SEC2) 2.7.1. */ /* secp256k1 'p' value defined in "Standards for Efficient Cryptography" (SEC2) 2.7.1. */
@ -51,12 +51,12 @@ static void secp256k1_fe_verify(const secp256k1_fe_t *a) {
VERIFY_CHECK(r == 1); VERIFY_CHECK(r == 1);
} }
#else #else
static void secp256k1_fe_verify(const secp256k1_fe_t *a) { static void secp256k1_fe_verify(const secp256k1_fe *a) {
(void)a; (void)a;
} }
#endif #endif
static void secp256k1_fe_normalize(secp256k1_fe_t *r) { static void secp256k1_fe_normalize(secp256k1_fe *r) {
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4]; uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
/* Reduce t4 at the start so there will be at most a single carry from the first pass */ /* Reduce t4 at the start so there will be at most a single carry from the first pass */
@ -99,7 +99,7 @@ static void secp256k1_fe_normalize(secp256k1_fe_t *r) {
#endif #endif
} }
static void secp256k1_fe_normalize_weak(secp256k1_fe_t *r) { static void secp256k1_fe_normalize_weak(secp256k1_fe *r) {
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4]; uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
/* Reduce t4 at the start so there will be at most a single carry from the first pass */ /* Reduce t4 at the start so there will be at most a single carry from the first pass */
@ -123,7 +123,7 @@ static void secp256k1_fe_normalize_weak(secp256k1_fe_t *r) {
#endif #endif
} }
static void secp256k1_fe_normalize_var(secp256k1_fe_t *r) { static void secp256k1_fe_normalize_var(secp256k1_fe *r) {
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4]; uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
/* Reduce t4 at the start so there will be at most a single carry from the first pass */ /* Reduce t4 at the start so there will be at most a single carry from the first pass */
@ -167,7 +167,7 @@ static void secp256k1_fe_normalize_var(secp256k1_fe_t *r) {
#endif #endif
} }
static int secp256k1_fe_normalizes_to_zero(secp256k1_fe_t *r) { static int secp256k1_fe_normalizes_to_zero(secp256k1_fe *r) {
uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4]; uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
/* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */ /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
@ -190,7 +190,7 @@ static int secp256k1_fe_normalizes_to_zero(secp256k1_fe_t *r) {
return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL); return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
} }
static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe_t *r) { static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe *r) {
uint64_t t0, t1, t2, t3, t4; uint64_t t0, t1, t2, t3, t4;
uint64_t z0, z1; uint64_t z0, z1;
uint64_t x; uint64_t x;
@ -231,7 +231,7 @@ static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe_t *r) {
return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL); return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
} }
SECP256K1_INLINE static void secp256k1_fe_set_int(secp256k1_fe_t *r, int a) { SECP256K1_INLINE static void secp256k1_fe_set_int(secp256k1_fe *r, int a) {
r->n[0] = a; r->n[0] = a;
r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0; r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
#ifdef VERIFY #ifdef VERIFY
@ -241,7 +241,7 @@ SECP256K1_INLINE static void secp256k1_fe_set_int(secp256k1_fe_t *r, int a) {
#endif #endif
} }
SECP256K1_INLINE static int secp256k1_fe_is_zero(const secp256k1_fe_t *a) { SECP256K1_INLINE static int secp256k1_fe_is_zero(const secp256k1_fe *a) {
const uint64_t *t = a->n; const uint64_t *t = a->n;
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
@ -250,7 +250,7 @@ SECP256K1_INLINE static int secp256k1_fe_is_zero(const secp256k1_fe_t *a) {
return (t[0] | t[1] | t[2] | t[3] | t[4]) == 0; return (t[0] | t[1] | t[2] | t[3] | t[4]) == 0;
} }
SECP256K1_INLINE static int secp256k1_fe_is_odd(const secp256k1_fe_t *a) { SECP256K1_INLINE static int secp256k1_fe_is_odd(const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
@ -258,7 +258,7 @@ SECP256K1_INLINE static int secp256k1_fe_is_odd(const secp256k1_fe_t *a) {
return a->n[0] & 1; return a->n[0] & 1;
} }
SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe_t *a) { SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe *a) {
int i; int i;
#ifdef VERIFY #ifdef VERIFY
a->magnitude = 0; a->magnitude = 0;
@ -269,7 +269,7 @@ SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe_t *a) {
} }
} }
static int secp256k1_fe_cmp_var(const secp256k1_fe_t *a, const secp256k1_fe_t *b) { static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b) {
int i; int i;
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
@ -288,7 +288,7 @@ static int secp256k1_fe_cmp_var(const secp256k1_fe_t *a, const secp256k1_fe_t *b
return 0; return 0;
} }
static int secp256k1_fe_set_b32(secp256k1_fe_t *r, const unsigned char *a) { static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a) {
int i; int i;
r->n[0] = r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0; r->n[0] = r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
for (i=0; i<32; i++) { for (i=0; i<32; i++) {
@ -311,7 +311,7 @@ static int secp256k1_fe_set_b32(secp256k1_fe_t *r, const unsigned char *a) {
} }
/** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */ /** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe_t *a) { static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe *a) {
int i; int i;
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
@ -329,7 +329,7 @@ static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe_t *a) {
} }
} }
SECP256K1_INLINE static void secp256k1_fe_negate(secp256k1_fe_t *r, const secp256k1_fe_t *a, int m) { SECP256K1_INLINE static void secp256k1_fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->magnitude <= m); VERIFY_CHECK(a->magnitude <= m);
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
@ -346,7 +346,7 @@ SECP256K1_INLINE static void secp256k1_fe_negate(secp256k1_fe_t *r, const secp25
#endif #endif
} }
SECP256K1_INLINE static void secp256k1_fe_mul_int(secp256k1_fe_t *r, int a) { SECP256K1_INLINE static void secp256k1_fe_mul_int(secp256k1_fe *r, int a) {
r->n[0] *= a; r->n[0] *= a;
r->n[1] *= a; r->n[1] *= a;
r->n[2] *= a; r->n[2] *= a;
@ -359,7 +359,7 @@ SECP256K1_INLINE static void secp256k1_fe_mul_int(secp256k1_fe_t *r, int a) {
#endif #endif
} }
SECP256K1_INLINE static void secp256k1_fe_add(secp256k1_fe_t *r, const secp256k1_fe_t *a) { SECP256K1_INLINE static void secp256k1_fe_add(secp256k1_fe *r, const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
#endif #endif
@ -375,7 +375,7 @@ SECP256K1_INLINE static void secp256k1_fe_add(secp256k1_fe_t *r, const secp256k1
#endif #endif
} }
static void secp256k1_fe_mul(secp256k1_fe_t *r, const secp256k1_fe_t *a, const secp256k1_fe_t * SECP256K1_RESTRICT b) { static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->magnitude <= 8); VERIFY_CHECK(a->magnitude <= 8);
VERIFY_CHECK(b->magnitude <= 8); VERIFY_CHECK(b->magnitude <= 8);
@ -391,7 +391,7 @@ static void secp256k1_fe_mul(secp256k1_fe_t *r, const secp256k1_fe_t *a, const s
#endif #endif
} }
static void secp256k1_fe_sqr(secp256k1_fe_t *r, const secp256k1_fe_t *a) { static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->magnitude <= 8); VERIFY_CHECK(a->magnitude <= 8);
secp256k1_fe_verify(a); secp256k1_fe_verify(a);
@ -404,7 +404,7 @@ static void secp256k1_fe_sqr(secp256k1_fe_t *r, const secp256k1_fe_t *a) {
#endif #endif
} }
static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe_t *r, const secp256k1_fe_t *a, int flag) { static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag) {
uint64_t mask0, mask1; uint64_t mask0, mask1;
mask0 = flag + ~((uint64_t)0); mask0 = flag + ~((uint64_t)0);
mask1 = ~mask0; mask1 = ~mask0;
@ -421,7 +421,7 @@ static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe_t *r, const secp256k
#endif #endif
} }
static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage_t *r, const secp256k1_fe_storage_t *a, int flag) { static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag) {
uint64_t mask0, mask1; uint64_t mask0, mask1;
mask0 = flag + ~((uint64_t)0); mask0 = flag + ~((uint64_t)0);
mask1 = ~mask0; mask1 = ~mask0;
@ -431,7 +431,7 @@ static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage_t *r
r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1); r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
} }
static void secp256k1_fe_to_storage(secp256k1_fe_storage_t *r, const secp256k1_fe_t *a) { static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
#ifdef VERIFY #ifdef VERIFY
VERIFY_CHECK(a->normalized); VERIFY_CHECK(a->normalized);
#endif #endif
@ -441,7 +441,7 @@ static void secp256k1_fe_to_storage(secp256k1_fe_storage_t *r, const secp256k1_f
r->n[3] = a->n[3] >> 36 | a->n[4] << 16; r->n[3] = a->n[3] >> 36 | a->n[4] << 16;
} }
static SECP256K1_INLINE void secp256k1_fe_from_storage(secp256k1_fe_t *r, const secp256k1_fe_storage_t *a) { static SECP256K1_INLINE void secp256k1_fe_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a) {
r->n[0] = a->n[0] & 0xFFFFFFFFFFFFFULL; r->n[0] = a->n[0] & 0xFFFFFFFFFFFFFULL;
r->n[1] = a->n[0] >> 52 | ((a->n[1] << 12) & 0xFFFFFFFFFFFFFULL); r->n[1] = a->n[0] >> 52 | ((a->n[1] << 12) & 0xFFFFFFFFFFFFFULL);
r->n[2] = a->n[1] >> 40 | ((a->n[2] << 24) & 0xFFFFFFFFFFFFFULL); r->n[2] = a->n[1] >> 40 | ((a->n[2] << 24) & 0xFFFFFFFFFFFFFULL);

24
src/field_impl.h
View file

@ -21,15 +21,15 @@
#error "Please select field implementation" #error "Please select field implementation"
#endif #endif
SECP256K1_INLINE static int secp256k1_fe_equal_var(const secp256k1_fe_t *a, const secp256k1_fe_t *b) { SECP256K1_INLINE static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b) {
secp256k1_fe_t na; secp256k1_fe na;
secp256k1_fe_negate(&na, a, 1); secp256k1_fe_negate(&na, a, 1);
secp256k1_fe_add(&na, b); secp256k1_fe_add(&na, b);
return secp256k1_fe_normalizes_to_zero_var(&na); return secp256k1_fe_normalizes_to_zero_var(&na);
} }
static int secp256k1_fe_sqrt_var(secp256k1_fe_t *r, const secp256k1_fe_t *a) { static int secp256k1_fe_sqrt_var(secp256k1_fe *r, const secp256k1_fe *a) {
secp256k1_fe_t x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1; secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
int j; int j;
/** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in /** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
@ -117,8 +117,8 @@ static int secp256k1_fe_sqrt_var(secp256k1_fe_t *r, const secp256k1_fe_t *a) {
return secp256k1_fe_equal_var(&t1, a); return secp256k1_fe_equal_var(&t1, a);
} }
static void secp256k1_fe_inv(secp256k1_fe_t *r, const secp256k1_fe_t *a) { static void secp256k1_fe_inv(secp256k1_fe *r, const secp256k1_fe *a) {
secp256k1_fe_t x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1; secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
int j; int j;
/** The binary representation of (p - 2) has 5 blocks of 1s, with lengths in /** The binary representation of (p - 2) has 5 blocks of 1s, with lengths in
@ -207,12 +207,12 @@ static void secp256k1_fe_inv(secp256k1_fe_t *r, const secp256k1_fe_t *a) {
secp256k1_fe_mul(r, a, &t1); secp256k1_fe_mul(r, a, &t1);
} }
static void secp256k1_fe_inv_var(secp256k1_fe_t *r, const secp256k1_fe_t *a) { static void secp256k1_fe_inv_var(secp256k1_fe *r, const secp256k1_fe *a) {
#if defined(USE_FIELD_INV_BUILTIN) #if defined(USE_FIELD_INV_BUILTIN)
secp256k1_fe_inv(r, a); secp256k1_fe_inv(r, a);
#elif defined(USE_FIELD_INV_NUM) #elif defined(USE_FIELD_INV_NUM)
secp256k1_num_t n, m; secp256k1_num n, m;
static const secp256k1_fe_t negone = SECP256K1_FE_CONST( static const secp256k1_fe negone = SECP256K1_FE_CONST(
0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0xFFFFFC2E 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0xFFFFFC2E
); );
@ -224,7 +224,7 @@ static void secp256k1_fe_inv_var(secp256k1_fe_t *r, const secp256k1_fe_t *a) {
0xFF,0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F 0xFF,0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F
}; };
unsigned char b[32]; unsigned char b[32];
secp256k1_fe_t c = *a; secp256k1_fe c = *a;
secp256k1_fe_normalize_var(&c); secp256k1_fe_normalize_var(&c);
secp256k1_fe_get_b32(b, &c); secp256k1_fe_get_b32(b, &c);
secp256k1_num_set_bin(&n, b, 32); secp256k1_num_set_bin(&n, b, 32);
@ -241,8 +241,8 @@ static void secp256k1_fe_inv_var(secp256k1_fe_t *r, const secp256k1_fe_t *a) {
#endif #endif
} }
static void secp256k1_fe_inv_all_var(size_t len, secp256k1_fe_t *r, const secp256k1_fe_t *a) { static void secp256k1_fe_inv_all_var(size_t len, secp256k1_fe *r, const secp256k1_fe *a) {
secp256k1_fe_t u; secp256k1_fe u;
size_t i; size_t i;
if (len < 1) { if (len < 1) {
return; return;

6
src/gen_context.c
View file

@ -19,13 +19,13 @@ static void default_error_callback_fn(const char* str, void* data) {
abort(); abort();
} }
static const callback_t default_error_callback = { static const secp256k1_callback default_error_callback = {
default_error_callback_fn, default_error_callback_fn,
NULL NULL
}; };
int main(int argc, char **argv) { int main(int argc, char **argv) {
secp256k1_ecmult_gen_context_t ctx; secp256k1_ecmult_gen_context ctx;
int inner; int inner;
int outer; int outer;
FILE* fp; FILE* fp;
@ -43,7 +43,7 @@ int main(int argc, char **argv) {
fprintf(fp, "#define _SECP256K1_ECMULT_STATIC_CONTEXT_\n"); fprintf(fp, "#define _SECP256K1_ECMULT_STATIC_CONTEXT_\n");
fprintf(fp, "#include \"group.h\"\n"); fprintf(fp, "#include \"group.h\"\n");
fprintf(fp, "#define SC SECP256K1_GE_STORAGE_CONST\n"); fprintf(fp, "#define SC SECP256K1_GE_STORAGE_CONST\n");
fprintf(fp, "static const secp256k1_ge_storage_t secp256k1_ecmult_static_context[64][16] = {\n"); fprintf(fp, "static const secp256k1_ge_storage secp256k1_ecmult_static_context[64][16] = {\n");
secp256k1_ecmult_gen_context_init(&ctx); secp256k1_ecmult_gen_context_init(&ctx);
secp256k1_ecmult_gen_context_build(&ctx, &default_error_callback); secp256k1_ecmult_gen_context_build(&ctx, &default_error_callback);

82
src/group.h
View file

@ -12,130 +12,130 @@
/** A group element of the secp256k1 curve, in affine coordinates. */ /** A group element of the secp256k1 curve, in affine coordinates. */
typedef struct { typedef struct {
secp256k1_fe_t x; secp256k1_fe x;
secp256k1_fe_t y; secp256k1_fe y;
int infinity; /* whether this represents the point at infinity */ int infinity; /* whether this represents the point at infinity */
} secp256k1_ge_t; } secp256k1_ge;
#define SECP256K1_GE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), 0} #define SECP256K1_GE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), 0}
#define SECP256K1_GE_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1} #define SECP256K1_GE_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
/** A group element of the secp256k1 curve, in jacobian coordinates. */ /** A group element of the secp256k1 curve, in jacobian coordinates. */
typedef struct { typedef struct {
secp256k1_fe_t x; /* actual X: x/z^2 */ secp256k1_fe x; /* actual X: x/z^2 */
secp256k1_fe_t y; /* actual Y: y/z^3 */ secp256k1_fe y; /* actual Y: y/z^3 */
secp256k1_fe_t z; secp256k1_fe z;
int infinity; /* whether this represents the point at infinity */ int infinity; /* whether this represents the point at infinity */
} secp256k1_gej_t; } secp256k1_gej;
#define SECP256K1_GEJ_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1), 0} #define SECP256K1_GEJ_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1), 0}
#define SECP256K1_GEJ_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1} #define SECP256K1_GEJ_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
typedef struct { typedef struct {
secp256k1_fe_storage_t x; secp256k1_fe_storage x;
secp256k1_fe_storage_t y; secp256k1_fe_storage y;
} secp256k1_ge_storage_t; } secp256k1_ge_storage;
#define SECP256K1_GE_STORAGE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_STORAGE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_STORAGE_CONST((i),(j),(k),(l),(m),(n),(o),(p))} #define SECP256K1_GE_STORAGE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_STORAGE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_STORAGE_CONST((i),(j),(k),(l),(m),(n),(o),(p))}
#define SECP256K1_GE_STORAGE_CONST_GET(t) SECP256K1_FE_STORAGE_CONST_GET(t.x), SECP256K1_FE_STORAGE_CONST_GET(t.y) #define SECP256K1_GE_STORAGE_CONST_GET(t) SECP256K1_FE_STORAGE_CONST_GET(t.x), SECP256K1_FE_STORAGE_CONST_GET(t.y)
/** Set a group element equal to the point at infinity */ /** Set a group element equal to the point at infinity */
static void secp256k1_ge_set_infinity(secp256k1_ge_t *r); static void secp256k1_ge_set_infinity(secp256k1_ge *r);
/** Set a group element equal to the point with given X and Y coordinates */ /** Set a group element equal to the point with given X and Y coordinates */
static void secp256k1_ge_set_xy(secp256k1_ge_t *r, const secp256k1_fe_t *x, const secp256k1_fe_t *y); static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y);
/** Set a group element (affine) equal to the point with the given X coordinate, and given oddness /** Set a group element (affine) equal to the point with the given X coordinate, and given oddness
* for Y. Return value indicates whether the result is valid. */ * for Y. Return value indicates whether the result is valid. */
static int secp256k1_ge_set_xo_var(secp256k1_ge_t *r, const secp256k1_fe_t *x, int odd); static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int odd);
/** Check whether a group element is the point at infinity. */ /** Check whether a group element is the point at infinity. */
static int secp256k1_ge_is_infinity(const secp256k1_ge_t *a); static int secp256k1_ge_is_infinity(const secp256k1_ge *a);
/** Check whether a group element is valid (i.e., on the curve). */ /** Check whether a group element is valid (i.e., on the curve). */
static int secp256k1_ge_is_valid_var(const secp256k1_ge_t *a); static int secp256k1_ge_is_valid_var(const secp256k1_ge *a);
static void secp256k1_ge_neg(secp256k1_ge_t *r, const secp256k1_ge_t *a); static void secp256k1_ge_neg(secp256k1_ge *r, const secp256k1_ge *a);
/** Set a group element equal to another which is given in jacobian coordinates */ /** Set a group element equal to another which is given in jacobian coordinates */
static void secp256k1_ge_set_gej(secp256k1_ge_t *r, secp256k1_gej_t *a); static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a);
/** Set a batch of group elements equal to the inputs given in jacobian coordinates */ /** Set a batch of group elements equal to the inputs given in jacobian coordinates */
static void secp256k1_ge_set_all_gej_var(size_t len, secp256k1_ge_t *r, const secp256k1_gej_t *a, const callback_t *cb); static void secp256k1_ge_set_all_gej_var(size_t len, secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_callback *cb);
/** Set a batch of group elements equal to the inputs given in jacobian /** Set a batch of group elements equal to the inputs given in jacobian
* coordinates (with known z-ratios). zr must contain the known z-ratios such * coordinates (with known z-ratios). zr must contain the known z-ratios such
* that mul(a[i].z, zr[i+1]) == a[i+1].z. zr[0] is ignored. */ * that mul(a[i].z, zr[i+1]) == a[i+1].z. zr[0] is ignored. */
static void secp256k1_ge_set_table_gej_var(size_t len, secp256k1_ge_t *r, const secp256k1_gej_t *a, const secp256k1_fe_t *zr); static void secp256k1_ge_set_table_gej_var(size_t len, secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zr);
/** Bring a batch inputs given in jacobian coordinates (with known z-ratios) to /** Bring a batch inputs given in jacobian coordinates (with known z-ratios) to
* the same global z "denominator". zr must contain the known z-ratios such * the same global z "denominator". zr must contain the known z-ratios such
* that mul(a[i].z, zr[i+1]) == a[i+1].z. zr[0] is ignored. The x and y * that mul(a[i].z, zr[i+1]) == a[i+1].z. zr[0] is ignored. The x and y
* coordinates of the result are stored in r, the common z coordinate is * coordinates of the result are stored in r, the common z coordinate is
* stored in globalz. */ * stored in globalz. */
static void secp256k1_ge_globalz_set_table_gej(size_t len, secp256k1_ge_t *r, secp256k1_fe_t *globalz, const secp256k1_gej_t *a, const secp256k1_fe_t *zr); static void secp256k1_ge_globalz_set_table_gej(size_t len, secp256k1_ge *r, secp256k1_fe *globalz, const secp256k1_gej *a, const secp256k1_fe *zr);
/** Set a group element (jacobian) equal to the point at infinity. */ /** Set a group element (jacobian) equal to the point at infinity. */
static void secp256k1_gej_set_infinity(secp256k1_gej_t *r); static void secp256k1_gej_set_infinity(secp256k1_gej *r);
/** Set a group element (jacobian) equal to the point with given X and Y coordinates. */ /** Set a group element (jacobian) equal to the point with given X and Y coordinates. */
static void secp256k1_gej_set_xy(secp256k1_gej_t *r, const secp256k1_fe_t *x, const secp256k1_fe_t *y); static void secp256k1_gej_set_xy(secp256k1_gej *r, const secp256k1_fe *x, const secp256k1_fe *y);
/** Set a group element (jacobian) equal to another which is given in affine coordinates. */ /** Set a group element (jacobian) equal to another which is given in affine coordinates. */
static void secp256k1_gej_set_ge(secp256k1_gej_t *r, const secp256k1_ge_t *a); static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a);
/** Compare the X coordinate of a group element (jacobian). */ /** Compare the X coordinate of a group element (jacobian). */
static int secp256k1_gej_eq_x_var(const secp256k1_fe_t *x, const secp256k1_gej_t *a); static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a);
/** Set r equal to the inverse of a (i.e., mirrored around the X axis) */ /** Set r equal to the inverse of a (i.e., mirrored around the X axis) */
static void secp256k1_gej_neg(secp256k1_gej_t *r, const secp256k1_gej_t *a); static void secp256k1_gej_neg(secp256k1_gej *r, const secp256k1_gej *a);
/** Check whether a group element is the point at infinity. */ /** Check whether a group element is the point at infinity. */
static int secp256k1_gej_is_infinity(const secp256k1_gej_t *a); static int secp256k1_gej_is_infinity(const secp256k1_gej *a);
/** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0). /** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0).
* a may not be zero. Constant time. */ * a may not be zero. Constant time. */
static void secp256k1_gej_double_nonzero(secp256k1_gej_t *r, const secp256k1_gej_t *a, secp256k1_fe_t *rzr); static void secp256k1_gej_double_nonzero(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr);
/** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0). */ /** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0). */
static void secp256k1_gej_double_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, secp256k1_fe_t *rzr); static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr);
/** Set r equal to the sum of a and b. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */ /** Set r equal to the sum of a and b. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */
static void secp256k1_gej_add_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_gej_t *b, secp256k1_fe_t *rzr); static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_gej *b, secp256k1_fe *rzr);
/** Set r equal to the sum of a and b (with b given in affine coordinates, and not infinity). */ /** Set r equal to the sum of a and b (with b given in affine coordinates, and not infinity). */
static void secp256k1_gej_add_ge(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b); static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b);
/** Set r equal to the sum of a and b (with b given in affine coordinates). This is more efficient /** Set r equal to the sum of a and b (with b given in affine coordinates). This is more efficient
than secp256k1_gej_add_var. It is identical to secp256k1_gej_add_ge but without constant-time than secp256k1_gej_add_var. It is identical to secp256k1_gej_add_ge but without constant-time
guarantee, and b is allowed to be infinity. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */ guarantee, and b is allowed to be infinity. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */
static void secp256k1_gej_add_ge_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b, secp256k1_fe_t *rzr); static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr);
/** Set r equal to the sum of a and b (with the inverse of b's Z coordinate passed as bzinv). */ /** Set r equal to the sum of a and b (with the inverse of b's Z coordinate passed as bzinv). */
static void secp256k1_gej_add_zinv_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b, const secp256k1_fe_t *bzinv); static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv);
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
/** Set r to be equal to lambda times a, where lambda is chosen in a way such that this is very fast. */ /** Set r to be equal to lambda times a, where lambda is chosen in a way such that this is very fast. */
static void secp256k1_ge_mul_lambda(secp256k1_ge_t *r, const secp256k1_ge_t *a); static void secp256k1_ge_mul_lambda(secp256k1_ge *r, const secp256k1_ge *a);
#endif #endif
/** Clear a secp256k1_gej_t to prevent leaking sensitive information. */ /** Clear a secp256k1_gej to prevent leaking sensitive information. */
static void secp256k1_gej_clear(secp256k1_gej_t *r); static void secp256k1_gej_clear(secp256k1_gej *r);
/** Clear a secp256k1_ge_t to prevent leaking sensitive information. */ /** Clear a secp256k1_ge to prevent leaking sensitive information. */
static void secp256k1_ge_clear(secp256k1_ge_t *r); static void secp256k1_ge_clear(secp256k1_ge *r);
/** Convert a group element to the storage type. */ /** Convert a group element to the storage type. */
static void secp256k1_ge_to_storage(secp256k1_ge_storage_t *r, const secp256k1_ge_t*); static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge*);
/** Convert a group element back from the storage type. */ /** Convert a group element back from the storage type. */
static void secp256k1_ge_from_storage(secp256k1_ge_t *r, const secp256k1_ge_storage_t*); static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage*);
/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */ /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */
static void secp256k1_ge_storage_cmov(secp256k1_ge_storage_t *r, const secp256k1_ge_storage_t *a, int flag); static void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag);
/** Rescale a jacobian point by b which must be non-zero. Constant-time. */ /** Rescale a jacobian point by b which must be non-zero. Constant-time. */
static void secp256k1_gej_rescale(secp256k1_gej_t *r, const secp256k1_fe_t *b); static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *b);
#endif #endif

116
src/group_impl.h
View file

@ -16,16 +16,16 @@
/** Generator for secp256k1, value 'g' defined in /** Generator for secp256k1, value 'g' defined in
* "Standards for Efficient Cryptography" (SEC2) 2.7.1. * "Standards for Efficient Cryptography" (SEC2) 2.7.1.
*/ */
static const secp256k1_ge_t secp256k1_ge_const_g = SECP256K1_GE_CONST( static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_GE_CONST(
0x79BE667EUL, 0xF9DCBBACUL, 0x55A06295UL, 0xCE870B07UL, 0x79BE667EUL, 0xF9DCBBACUL, 0x55A06295UL, 0xCE870B07UL,
0x029BFCDBUL, 0x2DCE28D9UL, 0x59F2815BUL, 0x16F81798UL, 0x029BFCDBUL, 0x2DCE28D9UL, 0x59F2815BUL, 0x16F81798UL,
0x483ADA77UL, 0x26A3C465UL, 0x5DA4FBFCUL, 0x0E1108A8UL, 0x483ADA77UL, 0x26A3C465UL, 0x5DA4FBFCUL, 0x0E1108A8UL,
0xFD17B448UL, 0xA6855419UL, 0x9C47D08FUL, 0xFB10D4B8UL 0xFD17B448UL, 0xA6855419UL, 0x9C47D08FUL, 0xFB10D4B8UL
); );
static void secp256k1_ge_set_gej_zinv(secp256k1_ge_t *r, const secp256k1_gej_t *a, const secp256k1_fe_t *zi) { static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zi) {
secp256k1_fe_t zi2; secp256k1_fe zi2;
secp256k1_fe_t zi3; secp256k1_fe zi3;
secp256k1_fe_sqr(&zi2, zi); secp256k1_fe_sqr(&zi2, zi);
secp256k1_fe_mul(&zi3, &zi2, zi); secp256k1_fe_mul(&zi3, &zi2, zi);
secp256k1_fe_mul(&r->x, &a->x, &zi2); secp256k1_fe_mul(&r->x, &a->x, &zi2);
@ -33,28 +33,28 @@ static void secp256k1_ge_set_gej_zinv(secp256k1_ge_t *r, const secp256k1_gej_t *
r->infinity = a->infinity; r->infinity = a->infinity;
} }
static void secp256k1_ge_set_infinity(secp256k1_ge_t *r) { static void secp256k1_ge_set_infinity(secp256k1_ge *r) {
r->infinity = 1; r->infinity = 1;
} }
static void secp256k1_ge_set_xy(secp256k1_ge_t *r, const secp256k1_fe_t *x, const secp256k1_fe_t *y) { static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y) {
r->infinity = 0; r->infinity = 0;
r->x = *x; r->x = *x;
r->y = *y; r->y = *y;
} }
static int secp256k1_ge_is_infinity(const secp256k1_ge_t *a) { static int secp256k1_ge_is_infinity(const secp256k1_ge *a) {
return a->infinity; return a->infinity;
} }
static void secp256k1_ge_neg(secp256k1_ge_t *r, const secp256k1_ge_t *a) { static void secp256k1_ge_neg(secp256k1_ge *r, const secp256k1_ge *a) {
*r = *a; *r = *a;
secp256k1_fe_normalize_weak(&r->y); secp256k1_fe_normalize_weak(&r->y);
secp256k1_fe_negate(&r->y, &r->y, 1); secp256k1_fe_negate(&r->y, &r->y, 1);
} }
static void secp256k1_ge_set_gej(secp256k1_ge_t *r, secp256k1_gej_t *a) { static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a) {
secp256k1_fe_t z2, z3; secp256k1_fe z2, z3;
r->infinity = a->infinity; r->infinity = a->infinity;
secp256k1_fe_inv(&a->z, &a->z); secp256k1_fe_inv(&a->z, &a->z);
secp256k1_fe_sqr(&z2, &a->z); secp256k1_fe_sqr(&z2, &a->z);
@ -66,8 +66,8 @@ static void secp256k1_ge_set_gej(secp256k1_ge_t *r, secp256k1_gej_t *a) {
r->y = a->y; r->y = a->y;
} }
static void secp256k1_ge_set_gej_var(secp256k1_ge_t *r, secp256k1_gej_t *a) { static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a) {
secp256k1_fe_t z2, z3; secp256k1_fe z2, z3;
r->infinity = a->infinity; r->infinity = a->infinity;
if (a->infinity) { if (a->infinity) {
return; return;
@ -82,19 +82,19 @@ static void secp256k1_ge_set_gej_var(secp256k1_ge_t *r, secp256k1_gej_t *a) {
r->y = a->y; r->y = a->y;
} }
static void secp256k1_ge_set_all_gej_var(size_t len, secp256k1_ge_t *r, const secp256k1_gej_t *a, const callback_t *cb) { static void secp256k1_ge_set_all_gej_var(size_t len, secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_callback *cb) {
secp256k1_fe_t *az; secp256k1_fe *az;
secp256k1_fe_t *azi; secp256k1_fe *azi;
size_t i; size_t i;
size_t count = 0; size_t count = 0;
az = (secp256k1_fe_t *)checked_malloc(cb, sizeof(secp256k1_fe_t) * len); az = (secp256k1_fe *)checked_malloc(cb, sizeof(secp256k1_fe) * len);
for (i = 0; i < len; i++) { for (i = 0; i < len; i++) {
if (!a[i].infinity) { if (!a[i].infinity) {
az[count++] = a[i].z; az[count++] = a[i].z;
} }
} }
azi = (secp256k1_fe_t *)checked_malloc(cb, sizeof(secp256k1_fe_t) * count); azi = (secp256k1_fe *)checked_malloc(cb, sizeof(secp256k1_fe) * count);
secp256k1_fe_inv_all_var(count, azi, az); secp256k1_fe_inv_all_var(count, azi, az);
free(az); free(az);
@ -108,9 +108,9 @@ static void secp256k1_ge_set_all_gej_var(size_t len, secp256k1_ge_t *r, const se
free(azi); free(azi);
} }
static void secp256k1_ge_set_table_gej_var(size_t len, secp256k1_ge_t *r, const secp256k1_gej_t *a, const secp256k1_fe_t *zr) { static void secp256k1_ge_set_table_gej_var(size_t len, secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zr) {
size_t i = len - 1; size_t i = len - 1;
secp256k1_fe_t zi; secp256k1_fe zi;
if (len > 0) { if (len > 0) {
/* Compute the inverse of the last z coordinate, and use it to compute the last affine output. */ /* Compute the inverse of the last z coordinate, and use it to compute the last affine output. */
@ -126,9 +126,9 @@ static void secp256k1_ge_set_table_gej_var(size_t len, secp256k1_ge_t *r, const
} }
} }
static void secp256k1_ge_globalz_set_table_gej(size_t len, secp256k1_ge_t *r, secp256k1_fe_t *globalz, const secp256k1_gej_t *a, const secp256k1_fe_t *zr) { static void secp256k1_ge_globalz_set_table_gej(size_t len, secp256k1_ge *r, secp256k1_fe *globalz, const secp256k1_gej *a, const secp256k1_fe *zr) {
size_t i = len - 1; size_t i = len - 1;
secp256k1_fe_t zs; secp256k1_fe zs;
if (len > 0) { if (len > 0) {
/* The z of the final point gives us the "global Z" for the table. */ /* The z of the final point gives us the "global Z" for the table. */
@ -149,35 +149,35 @@ static void secp256k1_ge_globalz_set_table_gej(size_t len, secp256k1_ge_t *r, se
} }
} }
static void secp256k1_gej_set_infinity(secp256k1_gej_t *r) { static void secp256k1_gej_set_infinity(secp256k1_gej *r) {
r->infinity = 1; r->infinity = 1;
secp256k1_fe_set_int(&r->x, 0); secp256k1_fe_set_int(&r->x, 0);
secp256k1_fe_set_int(&r->y, 0); secp256k1_fe_set_int(&r->y, 0);
secp256k1_fe_set_int(&r->z, 0); secp256k1_fe_set_int(&r->z, 0);
} }
static void secp256k1_gej_set_xy(secp256k1_gej_t *r, const secp256k1_fe_t *x, const secp256k1_fe_t *y) { static void secp256k1_gej_set_xy(secp256k1_gej *r, const secp256k1_fe *x, const secp256k1_fe *y) {
r->infinity = 0; r->infinity = 0;
r->x = *x; r->x = *x;
r->y = *y; r->y = *y;
secp256k1_fe_set_int(&r->z, 1); secp256k1_fe_set_int(&r->z, 1);
} }
static void secp256k1_gej_clear(secp256k1_gej_t *r) { static void secp256k1_gej_clear(secp256k1_gej *r) {
r->infinity = 0; r->infinity = 0;
secp256k1_fe_clear(&r->x); secp256k1_fe_clear(&r->x);
secp256k1_fe_clear(&r->y); secp256k1_fe_clear(&r->y);
secp256k1_fe_clear(&r->z); secp256k1_fe_clear(&r->z);
} }
static void secp256k1_ge_clear(secp256k1_ge_t *r) { static void secp256k1_ge_clear(secp256k1_ge *r) {
r->infinity = 0; r->infinity = 0;
secp256k1_fe_clear(&r->x); secp256k1_fe_clear(&r->x);
secp256k1_fe_clear(&r->y); secp256k1_fe_clear(&r->y);
} }
static int secp256k1_ge_set_xo_var(secp256k1_ge_t *r, const secp256k1_fe_t *x, int odd) { static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int odd) {
secp256k1_fe_t x2, x3, c; secp256k1_fe x2, x3, c;
r->x = *x; r->x = *x;
secp256k1_fe_sqr(&x2, x); secp256k1_fe_sqr(&x2, x);
secp256k1_fe_mul(&x3, x, &x2); secp256k1_fe_mul(&x3, x, &x2);
@ -194,22 +194,22 @@ static int secp256k1_ge_set_xo_var(secp256k1_ge_t *r, const secp256k1_fe_t *x, i
return 1; return 1;
} }
static void secp256k1_gej_set_ge(secp256k1_gej_t *r, const secp256k1_ge_t *a) { static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a) {
r->infinity = a->infinity; r->infinity = a->infinity;
r->x = a->x; r->x = a->x;
r->y = a->y; r->y = a->y;
secp256k1_fe_set_int(&r->z, 1); secp256k1_fe_set_int(&r->z, 1);
} }
static int secp256k1_gej_eq_x_var(const secp256k1_fe_t *x, const secp256k1_gej_t *a) { static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a) {
secp256k1_fe_t r, r2; secp256k1_fe r, r2;
VERIFY_CHECK(!a->infinity); VERIFY_CHECK(!a->infinity);
secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x); secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
r2 = a->x; secp256k1_fe_normalize_weak(&r2); r2 = a->x; secp256k1_fe_normalize_weak(&r2);
return secp256k1_fe_equal_var(&r, &r2); return secp256k1_fe_equal_var(&r, &r2);
} }
static void secp256k1_gej_neg(secp256k1_gej_t *r, const secp256k1_gej_t *a) { static void secp256k1_gej_neg(secp256k1_gej *r, const secp256k1_gej *a) {
r->infinity = a->infinity; r->infinity = a->infinity;
r->x = a->x; r->x = a->x;
r->y = a->y; r->y = a->y;
@ -218,12 +218,12 @@ static void secp256k1_gej_neg(secp256k1_gej_t *r, const secp256k1_gej_t *a) {
secp256k1_fe_negate(&r->y, &r->y, 1); secp256k1_fe_negate(&r->y, &r->y, 1);
} }
static int secp256k1_gej_is_infinity(const secp256k1_gej_t *a) { static int secp256k1_gej_is_infinity(const secp256k1_gej *a) {
return a->infinity; return a->infinity;
} }
static int secp256k1_gej_is_valid_var(const secp256k1_gej_t *a) { static int secp256k1_gej_is_valid_var(const secp256k1_gej *a) {
secp256k1_fe_t y2, x3, z2, z6; secp256k1_fe y2, x3, z2, z6;
if (a->infinity) { if (a->infinity) {
return 0; return 0;
} }
@ -242,8 +242,8 @@ static int secp256k1_gej_is_valid_var(const secp256k1_gej_t *a) {
return secp256k1_fe_equal_var(&y2, &x3); return secp256k1_fe_equal_var(&y2, &x3);
} }
static int secp256k1_ge_is_valid_var(const secp256k1_ge_t *a) { static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
secp256k1_fe_t y2, x3, c; secp256k1_fe y2, x3, c;
if (a->infinity) { if (a->infinity) {
return 0; return 0;
} }
@ -256,9 +256,9 @@ static int secp256k1_ge_is_valid_var(const secp256k1_ge_t *a) {
return secp256k1_fe_equal_var(&y2, &x3); return secp256k1_fe_equal_var(&y2, &x3);
} }
static void secp256k1_gej_double_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, secp256k1_fe_t *rzr) { static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
/* Operations: 3 mul, 4 sqr, 0 normalize, 12 mul_int/add/negate */ /* Operations: 3 mul, 4 sqr, 0 normalize, 12 mul_int/add/negate */
secp256k1_fe_t t1,t2,t3,t4; secp256k1_fe t1,t2,t3,t4;
/** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity, /** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity,
* Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have * Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have
* y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p. * y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p.
@ -299,14 +299,14 @@ static void secp256k1_gej_double_var(secp256k1_gej_t *r, const secp256k1_gej_t *
secp256k1_fe_add(&r->y, &t2); /* Y' = 36*X^3*Y^2 - 27*X^6 - 8*Y^4 (4) */ secp256k1_fe_add(&r->y, &t2); /* Y' = 36*X^3*Y^2 - 27*X^6 - 8*Y^4 (4) */
} }
static SECP256K1_INLINE void secp256k1_gej_double_nonzero(secp256k1_gej_t *r, const secp256k1_gej_t *a, secp256k1_fe_t *rzr) { static SECP256K1_INLINE void secp256k1_gej_double_nonzero(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
VERIFY_CHECK(!secp256k1_gej_is_infinity(a)); VERIFY_CHECK(!secp256k1_gej_is_infinity(a));
secp256k1_gej_double_var(r, a, rzr); secp256k1_gej_double_var(r, a, rzr);
} }
static void secp256k1_gej_add_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_gej_t *b, secp256k1_fe_t *rzr) { static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_gej *b, secp256k1_fe *rzr) {
/* Operations: 12 mul, 4 sqr, 2 normalize, 12 mul_int/add/negate */ /* Operations: 12 mul, 4 sqr, 2 normalize, 12 mul_int/add/negate */
secp256k1_fe_t z22, z12, u1, u2, s1, s2, h, i, i2, h2, h3, t; secp256k1_fe z22, z12, u1, u2, s1, s2, h, i, i2, h2, h3, t;
if (a->infinity) { if (a->infinity) {
VERIFY_CHECK(rzr == NULL); VERIFY_CHECK(rzr == NULL);
@ -357,9 +357,9 @@ static void secp256k1_gej_add_var(secp256k1_gej_t *r, const secp256k1_gej_t *a,
secp256k1_fe_add(&r->y, &h3); secp256k1_fe_add(&r->y, &h3);
} }
static void secp256k1_gej_add_ge_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b, secp256k1_fe_t *rzr) { static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr) {
/* 8 mul, 3 sqr, 4 normalize, 12 mul_int/add/negate */ /* 8 mul, 3 sqr, 4 normalize, 12 mul_int/add/negate */
secp256k1_fe_t z12, u1, u2, s1, s2, h, i, i2, h2, h3, t; secp256k1_fe z12, u1, u2, s1, s2, h, i, i2, h2, h3, t;
if (a->infinity) { if (a->infinity) {
VERIFY_CHECK(rzr == NULL); VERIFY_CHECK(rzr == NULL);
secp256k1_gej_set_ge(r, b); secp256k1_gej_set_ge(r, b);
@ -406,16 +406,16 @@ static void secp256k1_gej_add_ge_var(secp256k1_gej_t *r, const secp256k1_gej_t *
secp256k1_fe_add(&r->y, &h3); secp256k1_fe_add(&r->y, &h3);
} }
static void secp256k1_gej_add_zinv_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b, const secp256k1_fe_t *bzinv) { static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv) {
/* 9 mul, 3 sqr, 4 normalize, 12 mul_int/add/negate */ /* 9 mul, 3 sqr, 4 normalize, 12 mul_int/add/negate */
secp256k1_fe_t az, z12, u1, u2, s1, s2, h, i, i2, h2, h3, t; secp256k1_fe az, z12, u1, u2, s1, s2, h, i, i2, h2, h3, t;
if (b->infinity) { if (b->infinity) {
*r = *a; *r = *a;
return; return;
} }
if (a->infinity) { if (a->infinity) {
secp256k1_fe_t bzinv2, bzinv3; secp256k1_fe bzinv2, bzinv3;
r->infinity = b->infinity; r->infinity = b->infinity;
secp256k1_fe_sqr(&bzinv2, bzinv); secp256k1_fe_sqr(&bzinv2, bzinv);
secp256k1_fe_mul(&bzinv3, &bzinv2, bzinv); secp256k1_fe_mul(&bzinv3, &bzinv2, bzinv);
@ -463,11 +463,11 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej_t *r, const secp256k1_gej_t
} }
static void secp256k1_gej_add_ge(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b) { static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b) {
/* Operations: 7 mul, 5 sqr, 4 normalize, 21 mul_int/add/negate/cmov */ /* Operations: 7 mul, 5 sqr, 4 normalize, 21 mul_int/add/negate/cmov */
static const secp256k1_fe_t fe_1 = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1); static const secp256k1_fe fe_1 = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
secp256k1_fe_t zz, u1, u2, s1, s2, t, tt, m, n, q, rr; secp256k1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
secp256k1_fe_t m_alt, rr_alt; secp256k1_fe m_alt, rr_alt;
int infinity, degenerate; int infinity, degenerate;
VERIFY_CHECK(!b->infinity); VERIFY_CHECK(!b->infinity);
VERIFY_CHECK(a->infinity == 0 || a->infinity == 1); VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
@ -585,9 +585,9 @@ static void secp256k1_gej_add_ge(secp256k1_gej_t *r, const secp256k1_gej_t *a, c
r->infinity = infinity; r->infinity = infinity;
} }
static void secp256k1_gej_rescale(secp256k1_gej_t *r, const secp256k1_fe_t *s) { static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *s) {
/* Operations: 4 mul, 1 sqr */ /* Operations: 4 mul, 1 sqr */
secp256k1_fe_t zz; secp256k1_fe zz;
VERIFY_CHECK(!secp256k1_fe_is_zero(s)); VERIFY_CHECK(!secp256k1_fe_is_zero(s));
secp256k1_fe_sqr(&zz, s); secp256k1_fe_sqr(&zz, s);
secp256k1_fe_mul(&r->x, &r->x, &zz); /* r->x *= s^2 */ secp256k1_fe_mul(&r->x, &r->x, &zz); /* r->x *= s^2 */
@ -596,8 +596,8 @@ static void secp256k1_gej_rescale(secp256k1_gej_t *r, const secp256k1_fe_t *s) {
secp256k1_fe_mul(&r->z, &r->z, s); /* r->z *= s */ secp256k1_fe_mul(&r->z, &r->z, s); /* r->z *= s */
} }
static void secp256k1_ge_to_storage(secp256k1_ge_storage_t *r, const secp256k1_ge_t *a) { static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge *a) {
secp256k1_fe_t x, y; secp256k1_fe x, y;
VERIFY_CHECK(!a->infinity); VERIFY_CHECK(!a->infinity);
x = a->x; x = a->x;
secp256k1_fe_normalize(&x); secp256k1_fe_normalize(&x);
@ -607,20 +607,20 @@ static void secp256k1_ge_to_storage(secp256k1_ge_storage_t *r, const secp256k1_g
secp256k1_fe_to_storage(&r->y, &y); secp256k1_fe_to_storage(&r->y, &y);
} }
static void secp256k1_ge_from_storage(secp256k1_ge_t *r, const secp256k1_ge_storage_t *a) { static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a) {
secp256k1_fe_from_storage(&r->x, &a->x); secp256k1_fe_from_storage(&r->x, &a->x);
secp256k1_fe_from_storage(&r->y, &a->y); secp256k1_fe_from_storage(&r->y, &a->y);
r->infinity = 0; r->infinity = 0;
} }
static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage_t *r, const secp256k1_ge_storage_t *a, int flag) { static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag) {
secp256k1_fe_storage_cmov(&r->x, &a->x, flag); secp256k1_fe_storage_cmov(&r->x, &a->x, flag);
secp256k1_fe_storage_cmov(&r->y, &a->y, flag); secp256k1_fe_storage_cmov(&r->y, &a->y, flag);
} }
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
static void secp256k1_ge_mul_lambda(secp256k1_ge_t *r, const secp256k1_ge_t *a) { static void secp256k1_ge_mul_lambda(secp256k1_ge *r, const secp256k1_ge *a) {
static const secp256k1_fe_t beta = SECP256K1_FE_CONST( static const secp256k1_fe beta = SECP256K1_FE_CONST(
0x7ae96a2bul, 0x657c0710ul, 0x6e64479eul, 0xac3434e9ul, 0x7ae96a2bul, 0x657c0710ul, 0x6e64479eul, 0xac3434e9ul,
0x9cf04975ul, 0x12f58995ul, 0xc1396c28ul, 0x719501eeul 0x9cf04975ul, 0x12f58995ul, 0xc1396c28ul, 0x719501eeul
); );

8
src/modules/ecdh/main_impl.h
View file

@ -9,12 +9,12 @@
#include "ecmult_const_impl.h" #include "ecmult_const_impl.h"
int secp256k1_ecdh(const secp256k1_context_t* ctx, unsigned char *result, const secp256k1_pubkey_t *point, const unsigned char *scalar) { int secp256k1_ecdh(const secp256k1_context* ctx, unsigned char *result, const secp256k1_pubkey *point, const unsigned char *scalar) {
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
secp256k1_gej_t res; secp256k1_gej res;
secp256k1_ge_t pt; secp256k1_ge pt;
secp256k1_scalar_t s; secp256k1_scalar s;
ARG_CHECK(result != NULL); ARG_CHECK(result != NULL);
ARG_CHECK(point != NULL); ARG_CHECK(point != NULL);
ARG_CHECK(scalar != NULL); ARG_CHECK(scalar != NULL);

8
src/modules/ecdh/tests_impl.h
View file

@ -9,7 +9,7 @@
void test_ecdh_generator_basepoint(void) { void test_ecdh_generator_basepoint(void) {
unsigned char s_one[32] = { 0 }; unsigned char s_one[32] = { 0 };
secp256k1_pubkey_t point[2]; secp256k1_pubkey point[2];
int i; int i;
s_one[31] = 1; s_one[31] = 1;
@ -21,7 +21,7 @@ void test_ecdh_generator_basepoint(void) {
unsigned char output_ser[32]; unsigned char output_ser[32];
unsigned char point_ser[33]; unsigned char point_ser[33];
size_t point_ser_len = sizeof(point_ser); size_t point_ser_len = sizeof(point_ser);
secp256k1_scalar_t s; secp256k1_scalar s;
random_scalar_order(&s); random_scalar_order(&s);
secp256k1_scalar_get_b32(s_b32, &s); secp256k1_scalar_get_b32(s_b32, &s);
@ -51,8 +51,8 @@ void test_bad_scalar(void) {
}; };
unsigned char s_rand[32] = { 0 }; unsigned char s_rand[32] = { 0 };
unsigned char output[32]; unsigned char output[32];
secp256k1_scalar_t rand; secp256k1_scalar rand;
secp256k1_pubkey_t point; secp256k1_pubkey point;
/* Create random point */ /* Create random point */
random_scalar_order(&rand); random_scalar_order(&rand);

38
src/modules/recovery/main_impl.h
View file

@ -9,11 +9,11 @@
#include "include/secp256k1_recovery.h" #include "include/secp256k1_recovery.h"
static void secp256k1_ecdsa_recoverable_signature_load(const secp256k1_context_t* ctx, secp256k1_scalar_t* r, secp256k1_scalar_t* s, int* recid, const secp256k1_ecdsa_recoverable_signature_t* sig) { static void secp256k1_ecdsa_recoverable_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, int* recid, const secp256k1_ecdsa_recoverable_signature* sig) {
(void)ctx; (void)ctx;
if (sizeof(secp256k1_scalar_t) == 32) { if (sizeof(secp256k1_scalar) == 32) {
/* When the secp256k1_scalar_t type is exactly 32 byte, use its /* When the secp256k1_scalar type is exactly 32 byte, use its
* representation inside secp256k1_ecdsa_signature_t, as conversion is very fast. * representation inside secp256k1_ecdsa_signature, as conversion is very fast.
* Note that secp256k1_ecdsa_signature_save must use the same representation. */ * Note that secp256k1_ecdsa_signature_save must use the same representation. */
memcpy(r, &sig->data[0], 32); memcpy(r, &sig->data[0], 32);
memcpy(s, &sig->data[32], 32); memcpy(s, &sig->data[32], 32);
@ -24,8 +24,8 @@ static void secp256k1_ecdsa_recoverable_signature_load(const secp256k1_context_t
*recid = sig->data[64]; *recid = sig->data[64];
} }
static void secp256k1_ecdsa_recoverable_signature_save(secp256k1_ecdsa_recoverable_signature_t* sig, const secp256k1_scalar_t* r, const secp256k1_scalar_t* s, int recid) { static void secp256k1_ecdsa_recoverable_signature_save(secp256k1_ecdsa_recoverable_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s, int recid) {
if (sizeof(secp256k1_scalar_t) == 32) { if (sizeof(secp256k1_scalar) == 32) {
memcpy(&sig->data[0], r, 32); memcpy(&sig->data[0], r, 32);
memcpy(&sig->data[32], s, 32); memcpy(&sig->data[32], s, 32);
} else { } else {
@ -35,8 +35,8 @@ static void secp256k1_ecdsa_recoverable_signature_save(secp256k1_ecdsa_recoverab
sig->data[64] = recid; sig->data[64] = recid;
} }
int secp256k1_ecdsa_recoverable_signature_parse_compact(const secp256k1_context_t* ctx, secp256k1_ecdsa_recoverable_signature_t* sig, const unsigned char *input64, int recid) { int secp256k1_ecdsa_recoverable_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_recoverable_signature* sig, const unsigned char *input64, int recid) {
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
int ret = 1; int ret = 1;
int overflow = 0; int overflow = 0;
@ -57,8 +57,8 @@ int secp256k1_ecdsa_recoverable_signature_parse_compact(const secp256k1_context_
return ret; return ret;
} }
int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_context_t* ctx, unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature_t* sig) { int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature* sig) {
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
(void)ctx; (void)ctx;
ARG_CHECK(output64 != NULL); ARG_CHECK(output64 != NULL);
@ -70,8 +70,8 @@ int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_cont
return 1; return 1;
} }
int secp256k1_ecdsa_recoverable_signature_convert(const secp256k1_context_t* ctx, secp256k1_ecdsa_signature_t* sig, const secp256k1_ecdsa_recoverable_signature_t* sigin) { int secp256k1_ecdsa_recoverable_signature_convert(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const secp256k1_ecdsa_recoverable_signature* sigin) {
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
int recid; int recid;
(void)ctx; (void)ctx;
@ -83,9 +83,9 @@ int secp256k1_ecdsa_recoverable_signature_convert(const secp256k1_context_t* ctx
return 1; return 1;
} }
int secp256k1_ecdsa_sign_recoverable(const secp256k1_context_t* ctx, secp256k1_ecdsa_recoverable_signature_t *signature, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function_t noncefp, const void* noncedata) { int secp256k1_ecdsa_sign_recoverable(const secp256k1_context* ctx, secp256k1_ecdsa_recoverable_signature *signature, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
secp256k1_scalar_t sec, non, msg; secp256k1_scalar sec, non, msg;
int recid; int recid;
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
@ -130,10 +130,10 @@ int secp256k1_ecdsa_sign_recoverable(const secp256k1_context_t* ctx, secp256k1_e
return ret; return ret;
} }
int secp256k1_ecdsa_recover(const secp256k1_context_t* ctx, secp256k1_pubkey_t *pubkey, const secp256k1_ecdsa_recoverable_signature_t *signature, const unsigned char *msg32) { int secp256k1_ecdsa_recover(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const secp256k1_ecdsa_recoverable_signature *signature, const unsigned char *msg32) {
secp256k1_ge_t q; secp256k1_ge q;
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
secp256k1_scalar_t m; secp256k1_scalar m;
int recid; int recid;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx)); ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));

22
src/modules/recovery/tests_impl.h
View file

@ -11,16 +11,16 @@ void test_ecdsa_recovery_end_to_end(void) {
unsigned char extra[32] = {0x00}; unsigned char extra[32] = {0x00};
unsigned char privkey[32]; unsigned char privkey[32];
unsigned char message[32]; unsigned char message[32];
secp256k1_ecdsa_signature_t signature[5]; secp256k1_ecdsa_signature signature[5];
secp256k1_ecdsa_recoverable_signature_t rsignature[5]; secp256k1_ecdsa_recoverable_signature rsignature[5];
unsigned char sig[74]; unsigned char sig[74];
secp256k1_pubkey_t pubkey; secp256k1_pubkey pubkey;
secp256k1_pubkey_t recpubkey; secp256k1_pubkey recpubkey;
int recid = 0; int recid = 0;
/* Generate a random key and message. */ /* Generate a random key and message. */
{ {
secp256k1_scalar_t msg, key; secp256k1_scalar msg, key;
random_scalar_order_test(&msg); random_scalar_order_test(&msg);
random_scalar_order_test(&key); random_scalar_order_test(&key);
secp256k1_scalar_get_b32(privkey, &key); secp256k1_scalar_get_b32(privkey, &key);
@ -83,7 +83,7 @@ void test_ecdsa_recovery_edge_cases(void) {
0x7D, 0xD7, 0x3E, 0x38, 0x7E, 0xE4, 0xFC, 0x86, 0x7D, 0xD7, 0x3E, 0x38, 0x7E, 0xE4, 0xFC, 0x86,
0x6E, 0x1B, 0xE8, 0xEC, 0xC7, 0xDD, 0x95, 0x57 0x6E, 0x1B, 0xE8, 0xEC, 0xC7, 0xDD, 0x95, 0x57
}; };
secp256k1_pubkey_t pubkey; secp256k1_pubkey pubkey;
/* signature (r,s) = (4,4), which can be recovered with all 4 recids. */ /* signature (r,s) = (4,4), which can be recovered with all 4 recids. */
const unsigned char sigb64[64] = { const unsigned char sigb64[64] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@ -95,9 +95,9 @@ void test_ecdsa_recovery_edge_cases(void) {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04,
}; };
secp256k1_pubkey_t pubkeyb; secp256k1_pubkey pubkeyb;
secp256k1_ecdsa_recoverable_signature_t rsig; secp256k1_ecdsa_recoverable_signature rsig;
secp256k1_ecdsa_signature_t sig; secp256k1_ecdsa_signature sig;
int recid; int recid;
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 0)); CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 0));
@ -157,7 +157,7 @@ void test_ecdsa_recovery_edge_cases(void) {
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 1); CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 1);
CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1); CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1);
for (recid2 = 0; recid2 < 4; recid2++) { for (recid2 = 0; recid2 < 4; recid2++) {
secp256k1_pubkey_t pubkey2b; secp256k1_pubkey pubkey2b;
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigb64, recid2) == 1); CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigb64, recid2) == 1);
CHECK(secp256k1_ecdsa_recover(ctx, &pubkey2b, &rsig, msg32) == 1); CHECK(secp256k1_ecdsa_recover(ctx, &pubkey2b, &rsig, msg32) == 1);
/* Verifying with (order + r,4) should always fail. */ /* Verifying with (order + r,4) should always fail. */
@ -216,7 +216,7 @@ void test_ecdsa_recovery_edge_cases(void) {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
}; };
secp256k1_pubkey_t pubkeyc; secp256k1_pubkey pubkeyc;
CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1); CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1);
CHECK(secp256k1_ecdsa_recover(ctx, &pubkeyc, &rsig, msg32) == 1); CHECK(secp256k1_ecdsa_recover(ctx, &pubkeyc, &rsig, msg32) == 1);
CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1); CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1);

28
src/modules/schnorr/main_impl.h
View file

@ -19,8 +19,8 @@ static void secp256k1_schnorr_msghash_sha256(unsigned char *h32, const unsigned
static const unsigned char secp256k1_schnorr_algo16[16] = "Schnorr+SHA256 "; static const unsigned char secp256k1_schnorr_algo16[16] = "Schnorr+SHA256 ";
int secp256k1_schnorr_sign(const secp256k1_context_t* ctx, unsigned char *sig64, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function_t noncefp, const void* noncedata) { int secp256k1_schnorr_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
secp256k1_scalar_t sec, non; secp256k1_scalar sec, non;
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
unsigned int count = 0; unsigned int count = 0;
@ -57,8 +57,8 @@ int secp256k1_schnorr_sign(const secp256k1_context_t* ctx, unsigned char *sig64,
return ret; return ret;
} }
int secp256k1_schnorr_verify(const secp256k1_context_t* ctx, const unsigned char *sig64, const unsigned char *msg32, const secp256k1_pubkey_t *pubkey) { int secp256k1_schnorr_verify(const secp256k1_context* ctx, const unsigned char *sig64, const unsigned char *msg32, const secp256k1_pubkey *pubkey) {
secp256k1_ge_t q; secp256k1_ge q;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx)); ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
ARG_CHECK(msg32 != NULL); ARG_CHECK(msg32 != NULL);
@ -69,8 +69,8 @@ int secp256k1_schnorr_verify(const secp256k1_context_t* ctx, const unsigned char
return secp256k1_schnorr_sig_verify(&ctx->ecmult_ctx, sig64, &q, secp256k1_schnorr_msghash_sha256, msg32); return secp256k1_schnorr_sig_verify(&ctx->ecmult_ctx, sig64, &q, secp256k1_schnorr_msghash_sha256, msg32);
} }
int secp256k1_schnorr_recover(const secp256k1_context_t* ctx, secp256k1_pubkey_t *pubkey, const unsigned char *sig64, const unsigned char *msg32) { int secp256k1_schnorr_recover(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *sig64, const unsigned char *msg32) {
secp256k1_ge_t q; secp256k1_ge q;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx)); ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
@ -87,12 +87,12 @@ int secp256k1_schnorr_recover(const secp256k1_context_t* ctx, secp256k1_pubkey_t
} }
} }
int secp256k1_schnorr_generate_nonce_pair(const secp256k1_context_t* ctx, secp256k1_pubkey_t *pubnonce, unsigned char *privnonce32, const unsigned char *sec32, const unsigned char *msg32, secp256k1_nonce_function_t noncefp, const void* noncedata) { int secp256k1_schnorr_generate_nonce_pair(const secp256k1_context* ctx, secp256k1_pubkey *pubnonce, unsigned char *privnonce32, const unsigned char *sec32, const unsigned char *msg32, secp256k1_nonce_function noncefp, const void* noncedata) {
int count = 0; int count = 0;
int ret = 1; int ret = 1;
secp256k1_gej_t Qj; secp256k1_gej Qj;
secp256k1_ge_t Q; secp256k1_ge Q;
secp256k1_scalar_t sec; secp256k1_scalar sec;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
@ -129,10 +129,10 @@ int secp256k1_schnorr_generate_nonce_pair(const secp256k1_context_t* ctx, secp25
return ret; return ret;
} }
int secp256k1_schnorr_partial_sign(const secp256k1_context_t* ctx, unsigned char *sig64, const unsigned char *msg32, const unsigned char *sec32, const secp256k1_pubkey_t *pubnonce_others, const unsigned char *secnonce32) { int secp256k1_schnorr_partial_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const unsigned char *sec32, const secp256k1_pubkey *pubnonce_others, const unsigned char *secnonce32) {
int overflow = 0; int overflow = 0;
secp256k1_scalar_t sec, non; secp256k1_scalar sec, non;
secp256k1_ge_t pubnon; secp256k1_ge pubnon;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
ARG_CHECK(msg32 != NULL); ARG_CHECK(msg32 != NULL);
@ -153,7 +153,7 @@ int secp256k1_schnorr_partial_sign(const secp256k1_context_t* ctx, unsigned char
return secp256k1_schnorr_sig_sign(&ctx->ecmult_gen_ctx, sig64, &sec, &non, &pubnon, secp256k1_schnorr_msghash_sha256, msg32); return secp256k1_schnorr_sig_sign(&ctx->ecmult_gen_ctx, sig64, &sec, &non, &pubnon, secp256k1_schnorr_msghash_sha256, msg32);
} }
int secp256k1_schnorr_partial_combine(const secp256k1_context_t* ctx, unsigned char *sig64, const unsigned char * const *sig64sin, int n) { int secp256k1_schnorr_partial_combine(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char * const *sig64sin, int n) {
ARG_CHECK(sig64 != NULL); ARG_CHECK(sig64 != NULL);
ARG_CHECK(n >= 1); ARG_CHECK(n >= 1);
ARG_CHECK(sig64sin != NULL); ARG_CHECK(sig64sin != NULL);

8
src/modules/schnorr/schnorr.h
View file

@ -10,11 +10,11 @@
#include "scalar.h" #include "scalar.h"
#include "group.h" #include "group.h"
typedef void (*secp256k1_schnorr_msghash_t)(unsigned char *h32, const unsigned char *r32, const unsigned char *msg32); typedef void (*secp256k1_schnorr_msghash)(unsigned char *h32, const unsigned char *r32, const unsigned char *msg32);
static int secp256k1_schnorr_sig_sign(const secp256k1_ecmult_gen_context_t* ctx, unsigned char *sig64, const secp256k1_scalar_t *key, const secp256k1_scalar_t *nonce, const secp256k1_ge_t *pubnonce, secp256k1_schnorr_msghash_t hash, const unsigned char *msg32); static int secp256k1_schnorr_sig_sign(const secp256k1_ecmult_gen_context* ctx, unsigned char *sig64, const secp256k1_scalar *key, const secp256k1_scalar *nonce, const secp256k1_ge *pubnonce, secp256k1_schnorr_msghash hash, const unsigned char *msg32);
static int secp256k1_schnorr_sig_verify(const secp256k1_ecmult_context_t* ctx, const unsigned char *sig64, const secp256k1_ge_t *pubkey, secp256k1_schnorr_msghash_t hash, const unsigned char *msg32); static int secp256k1_schnorr_sig_verify(const secp256k1_ecmult_context* ctx, const unsigned char *sig64, const secp256k1_ge *pubkey, secp256k1_schnorr_msghash hash, const unsigned char *msg32);
static int secp256k1_schnorr_sig_recover(const secp256k1_ecmult_context_t* ctx, const unsigned char *sig64, secp256k1_ge_t *pubkey, secp256k1_schnorr_msghash_t hash, const unsigned char *msg32); static int secp256k1_schnorr_sig_recover(const secp256k1_ecmult_context* ctx, const unsigned char *sig64, secp256k1_ge *pubkey, secp256k1_schnorr_msghash hash, const unsigned char *msg32);
static int secp256k1_schnorr_sig_combine(unsigned char *sig64, int n, const unsigned char * const *sig64ins); static int secp256k1_schnorr_sig_combine(unsigned char *sig64, int n, const unsigned char * const *sig64ins);
#endif #endif

34
src/modules/schnorr/schnorr_impl.h
View file

@ -59,13 +59,13 @@
* Signature is valid if R + h * Q + s * G == 0. * Signature is valid if R + h * Q + s * G == 0.
*/ */
static int secp256k1_schnorr_sig_sign(const secp256k1_ecmult_gen_context_t* ctx, unsigned char *sig64, const secp256k1_scalar_t *key, const secp256k1_scalar_t *nonce, const secp256k1_ge_t *pubnonce, secp256k1_schnorr_msghash_t hash, const unsigned char *msg32) { static int secp256k1_schnorr_sig_sign(const secp256k1_ecmult_gen_context* ctx, unsigned char *sig64, const secp256k1_scalar *key, const secp256k1_scalar *nonce, const secp256k1_ge *pubnonce, secp256k1_schnorr_msghash hash, const unsigned char *msg32) {
secp256k1_gej_t Rj; secp256k1_gej Rj;
secp256k1_ge_t Ra; secp256k1_ge Ra;
unsigned char h32[32]; unsigned char h32[32];
secp256k1_scalar_t h, s; secp256k1_scalar h, s;
int overflow; int overflow;
secp256k1_scalar_t n; secp256k1_scalar n;
if (secp256k1_scalar_is_zero(key) || secp256k1_scalar_is_zero(nonce)) { if (secp256k1_scalar_is_zero(key) || secp256k1_scalar_is_zero(nonce)) {
return 0; return 0;
@ -103,11 +103,11 @@ static int secp256k1_schnorr_sig_sign(const secp256k1_ecmult_gen_context_t* ctx,
return 1; return 1;
} }
static int secp256k1_schnorr_sig_verify(const secp256k1_ecmult_context_t* ctx, const unsigned char *sig64, const secp256k1_ge_t *pubkey, secp256k1_schnorr_msghash_t hash, const unsigned char *msg32) { static int secp256k1_schnorr_sig_verify(const secp256k1_ecmult_context* ctx, const unsigned char *sig64, const secp256k1_ge *pubkey, secp256k1_schnorr_msghash hash, const unsigned char *msg32) {
secp256k1_gej_t Qj, Rj; secp256k1_gej Qj, Rj;
secp256k1_ge_t Ra; secp256k1_ge Ra;
secp256k1_fe_t Rx; secp256k1_fe Rx;
secp256k1_scalar_t h, s; secp256k1_scalar h, s;
unsigned char hh[32]; unsigned char hh[32];
int overflow; int overflow;
@ -141,11 +141,11 @@ static int secp256k1_schnorr_sig_verify(const secp256k1_ecmult_context_t* ctx, c
return secp256k1_fe_equal_var(&Rx, &Ra.x); return secp256k1_fe_equal_var(&Rx, &Ra.x);
} }
static int secp256k1_schnorr_sig_recover(const secp256k1_ecmult_context_t* ctx, const unsigned char *sig64, secp256k1_ge_t *pubkey, secp256k1_schnorr_msghash_t hash, const unsigned char *msg32) { static int secp256k1_schnorr_sig_recover(const secp256k1_ecmult_context* ctx, const unsigned char *sig64, secp256k1_ge *pubkey, secp256k1_schnorr_msghash hash, const unsigned char *msg32) {
secp256k1_gej_t Qj, Rj; secp256k1_gej Qj, Rj;
secp256k1_ge_t Ra; secp256k1_ge Ra;
secp256k1_fe_t Rx; secp256k1_fe Rx;
secp256k1_scalar_t h, s; secp256k1_scalar h, s;
unsigned char hh[32]; unsigned char hh[32];
int overflow; int overflow;
@ -179,10 +179,10 @@ static int secp256k1_schnorr_sig_recover(const secp256k1_ecmult_context_t* ctx,
} }
static int secp256k1_schnorr_sig_combine(unsigned char *sig64, int n, const unsigned char * const *sig64ins) { static int secp256k1_schnorr_sig_combine(unsigned char *sig64, int n, const unsigned char * const *sig64ins) {
secp256k1_scalar_t s = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0); secp256k1_scalar s = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
int i; int i;
for (i = 0; i < n; i++) { for (i = 0; i < n; i++) {
secp256k1_scalar_t si; secp256k1_scalar si;
int overflow; int overflow;
secp256k1_scalar_set_b32(&si, sig64ins[i] + 32, &overflow); secp256k1_scalar_set_b32(&si, sig64ins[i] + 32, &overflow);
if (overflow) { if (overflow) {

24
src/modules/schnorr/tests_impl.h
View file

@ -11,11 +11,11 @@ void test_schnorr_end_to_end(void) {
unsigned char privkey[32]; unsigned char privkey[32];
unsigned char message[32]; unsigned char message[32];
unsigned char schnorr_signature[64]; unsigned char schnorr_signature[64];
secp256k1_pubkey_t pubkey, recpubkey; secp256k1_pubkey pubkey, recpubkey;
/* Generate a random key and message. */ /* Generate a random key and message. */
{ {
secp256k1_scalar_t key; secp256k1_scalar key;
random_scalar_order_test(&key); random_scalar_order_test(&key);
secp256k1_scalar_get_b32(privkey, &key); secp256k1_scalar_get_b32(privkey, &key);
secp256k1_rand256_test(message); secp256k1_rand256_test(message);
@ -48,9 +48,9 @@ void test_schnorr_hash(unsigned char *h32, const unsigned char *r32, const unsig
void test_schnorr_sign_verify(void) { void test_schnorr_sign_verify(void) {
unsigned char msg32[32]; unsigned char msg32[32];
unsigned char sig64[3][64]; unsigned char sig64[3][64];
secp256k1_gej_t pubkeyj[3]; secp256k1_gej pubkeyj[3];
secp256k1_ge_t pubkey[3]; secp256k1_ge pubkey[3];
secp256k1_scalar_t nonce[3], key[3]; secp256k1_scalar nonce[3], key[3];
int i = 0; int i = 0;
int k; int k;
@ -83,14 +83,14 @@ void test_schnorr_sign_verify(void) {
void test_schnorr_threshold(void) { void test_schnorr_threshold(void) {
unsigned char msg[32]; unsigned char msg[32];
unsigned char sec[5][32]; unsigned char sec[5][32];
secp256k1_pubkey_t pub[5]; secp256k1_pubkey pub[5];
unsigned char nonce[5][32]; unsigned char nonce[5][32];
secp256k1_pubkey_t pubnonce[5]; secp256k1_pubkey pubnonce[5];
unsigned char sig[5][64]; unsigned char sig[5][64];
const unsigned char* sigs[5]; const unsigned char* sigs[5];
unsigned char allsig[64]; unsigned char allsig[64];
const secp256k1_pubkey_t* pubs[5]; const secp256k1_pubkey* pubs[5];
secp256k1_pubkey_t allpub; secp256k1_pubkey allpub;
int n, i; int n, i;
int damage; int damage;
int ret = 0; int ret = 0;
@ -112,8 +112,8 @@ void test_schnorr_threshold(void) {
sec[secp256k1_rand32() % n][secp256k1_rand32() % 32] ^= 1 + (secp256k1_rand32() % 255); sec[secp256k1_rand32() % n][secp256k1_rand32() % 32] ^= 1 + (secp256k1_rand32() % 255);
} }
for (i = 0; i < n; i++) { for (i = 0; i < n; i++) {
secp256k1_pubkey_t allpubnonce; secp256k1_pubkey allpubnonce;
const secp256k1_pubkey_t *pubnonces[4]; const secp256k1_pubkey *pubnonces[4];
int j; int j;
for (j = 0; j < i; j++) { for (j = 0; j < i; j++) {
pubnonces[j] = &pubnonce[j]; pubnonces[j] = &pubnonce[j];
@ -144,7 +144,7 @@ void test_schnorr_threshold(void) {
void test_schnorr_recovery(void) { void test_schnorr_recovery(void) {
unsigned char msg32[32]; unsigned char msg32[32];
unsigned char sig64[64]; unsigned char sig64[64];
secp256k1_ge_t Q; secp256k1_ge Q;
secp256k1_rand256_test(msg32); secp256k1_rand256_test(msg32);
secp256k1_rand256_test(sig64); secp256k1_rand256_test(sig64);

28
src/num.h
View file

@ -20,48 +20,48 @@
#endif #endif
/** Copy a number. */ /** Copy a number. */
static void secp256k1_num_copy(secp256k1_num_t *r, const secp256k1_num_t *a); static void secp256k1_num_copy(secp256k1_num *r, const secp256k1_num *a);
/** Convert a number's absolute value to a binary big-endian string. /** Convert a number's absolute value to a binary big-endian string.
* There must be enough place. */ * There must be enough place. */
static void secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const secp256k1_num_t *a); static void secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const secp256k1_num *a);
/** Set a number to the value of a binary big-endian string. */ /** Set a number to the value of a binary big-endian string. */
static void secp256k1_num_set_bin(secp256k1_num_t *r, const unsigned char *a, unsigned int alen); static void secp256k1_num_set_bin(secp256k1_num *r, const unsigned char *a, unsigned int alen);
/** Compute a modular inverse. The input must be less than the modulus. */ /** Compute a modular inverse. The input must be less than the modulus. */
static void secp256k1_num_mod_inverse(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *m); static void secp256k1_num_mod_inverse(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *m);
/** Compare the absolute value of two numbers. */ /** Compare the absolute value of two numbers. */
static int secp256k1_num_cmp(const secp256k1_num_t *a, const secp256k1_num_t *b); static int secp256k1_num_cmp(const secp256k1_num *a, const secp256k1_num *b);
/** Test whether two number are equal (including sign). */ /** Test whether two number are equal (including sign). */
static int secp256k1_num_eq(const secp256k1_num_t *a, const secp256k1_num_t *b); static int secp256k1_num_eq(const secp256k1_num *a, const secp256k1_num *b);
/** Add two (signed) numbers. */ /** Add two (signed) numbers. */
static void secp256k1_num_add(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b); static void secp256k1_num_add(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b);
/** Subtract two (signed) numbers. */ /** Subtract two (signed) numbers. */
static void secp256k1_num_sub(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b); static void secp256k1_num_sub(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b);
/** Multiply two (signed) numbers. */ /** Multiply two (signed) numbers. */
static void secp256k1_num_mul(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b); static void secp256k1_num_mul(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b);
/** Replace a number by its remainder modulo m. M's sign is ignored. The result is a number between 0 and m-1, /** Replace a number by its remainder modulo m. M's sign is ignored. The result is a number between 0 and m-1,
even if r was negative. */ even if r was negative. */
static void secp256k1_num_mod(secp256k1_num_t *r, const secp256k1_num_t *m); static void secp256k1_num_mod(secp256k1_num *r, const secp256k1_num *m);
/** Right-shift the passed number by bits bits. */ /** Right-shift the passed number by bits bits. */
static void secp256k1_num_shift(secp256k1_num_t *r, int bits); static void secp256k1_num_shift(secp256k1_num *r, int bits);
/** Check whether a number is zero. */ /** Check whether a number is zero. */
static int secp256k1_num_is_zero(const secp256k1_num_t *a); static int secp256k1_num_is_zero(const secp256k1_num *a);
/** Check whether a number is strictly negative. */ /** Check whether a number is strictly negative. */
static int secp256k1_num_is_neg(const secp256k1_num_t *a); static int secp256k1_num_is_neg(const secp256k1_num *a);
/** Change a number's sign. */ /** Change a number's sign. */
static void secp256k1_num_negate(secp256k1_num_t *r); static void secp256k1_num_negate(secp256k1_num *r);
#endif #endif

2
src/num_gmp.h
View file

@ -15,6 +15,6 @@ typedef struct {
mp_limb_t data[2*NUM_LIMBS]; mp_limb_t data[2*NUM_LIMBS];
int neg; int neg;
int limbs; int limbs;
} secp256k1_num_t; } secp256k1_num;
#endif #endif

36
src/num_gmp_impl.h
View file

@ -15,18 +15,18 @@
#include "num.h" #include "num.h"
#ifdef VERIFY #ifdef VERIFY
static void secp256k1_num_sanity(const secp256k1_num_t *a) { static void secp256k1_num_sanity(const secp256k1_num *a) {
VERIFY_CHECK(a->limbs == 1 || (a->limbs > 1 && a->data[a->limbs-1] != 0)); VERIFY_CHECK(a->limbs == 1 || (a->limbs > 1 && a->data[a->limbs-1] != 0));
} }
#else #else
#define secp256k1_num_sanity(a) do { } while(0) #define secp256k1_num_sanity(a) do { } while(0)
#endif #endif
static void secp256k1_num_copy(secp256k1_num_t *r, const secp256k1_num_t *a) { static void secp256k1_num_copy(secp256k1_num *r, const secp256k1_num *a) {
*r = *a; *r = *a;
} }
static void secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const secp256k1_num_t *a) { static void secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const secp256k1_num *a) {
unsigned char tmp[65]; unsigned char tmp[65];
int len = 0; int len = 0;
int shift = 0; int shift = 0;
@ -42,7 +42,7 @@ static void secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const sec
memset(tmp, 0, sizeof(tmp)); memset(tmp, 0, sizeof(tmp));
} }
static void secp256k1_num_set_bin(secp256k1_num_t *r, const unsigned char *a, unsigned int alen) { static void secp256k1_num_set_bin(secp256k1_num *r, const unsigned char *a, unsigned int alen) {
int len; int len;
VERIFY_CHECK(alen > 0); VERIFY_CHECK(alen > 0);
VERIFY_CHECK(alen <= 64); VERIFY_CHECK(alen <= 64);
@ -59,7 +59,7 @@ static void secp256k1_num_set_bin(secp256k1_num_t *r, const unsigned char *a, un
} }
} }
static void secp256k1_num_add_abs(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b) { static void secp256k1_num_add_abs(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
mp_limb_t c = mpn_add(r->data, a->data, a->limbs, b->data, b->limbs); mp_limb_t c = mpn_add(r->data, a->data, a->limbs, b->data, b->limbs);
r->limbs = a->limbs; r->limbs = a->limbs;
if (c != 0) { if (c != 0) {
@ -68,7 +68,7 @@ static void secp256k1_num_add_abs(secp256k1_num_t *r, const secp256k1_num_t *a,
} }
} }
static void secp256k1_num_sub_abs(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b) { static void secp256k1_num_sub_abs(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
mp_limb_t c = mpn_sub(r->data, a->data, a->limbs, b->data, b->limbs); mp_limb_t c = mpn_sub(r->data, a->data, a->limbs, b->data, b->limbs);
VERIFY_CHECK(c == 0); VERIFY_CHECK(c == 0);
r->limbs = a->limbs; r->limbs = a->limbs;
@ -77,7 +77,7 @@ static void secp256k1_num_sub_abs(secp256k1_num_t *r, const secp256k1_num_t *a,
} }
} }
static void secp256k1_num_mod(secp256k1_num_t *r, const secp256k1_num_t *m) { static void secp256k1_num_mod(secp256k1_num *r, const secp256k1_num *m) {
secp256k1_num_sanity(r); secp256k1_num_sanity(r);
secp256k1_num_sanity(m); secp256k1_num_sanity(m);
@ -97,7 +97,7 @@ static void secp256k1_num_mod(secp256k1_num_t *r, const secp256k1_num_t *m) {
} }
} }
static void secp256k1_num_mod_inverse(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *m) { static void secp256k1_num_mod_inverse(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *m) {
int i; int i;
mp_limb_t g[NUM_LIMBS+1]; mp_limb_t g[NUM_LIMBS+1];
mp_limb_t u[NUM_LIMBS+1]; mp_limb_t u[NUM_LIMBS+1];
@ -142,15 +142,15 @@ static void secp256k1_num_mod_inverse(secp256k1_num_t *r, const secp256k1_num_t
memset(v, 0, sizeof(v)); memset(v, 0, sizeof(v));
} }
static int secp256k1_num_is_zero(const secp256k1_num_t *a) { static int secp256k1_num_is_zero(const secp256k1_num *a) {
return (a->limbs == 1 && a->data[0] == 0); return (a->limbs == 1 && a->data[0] == 0);
} }
static int secp256k1_num_is_neg(const secp256k1_num_t *a) { static int secp256k1_num_is_neg(const secp256k1_num *a) {
return (a->limbs > 1 || a->data[0] != 0) && a->neg; return (a->limbs > 1 || a->data[0] != 0) && a->neg;
} }
static int secp256k1_num_cmp(const secp256k1_num_t *a, const secp256k1_num_t *b) { static int secp256k1_num_cmp(const secp256k1_num *a, const secp256k1_num *b) {
if (a->limbs > b->limbs) { if (a->limbs > b->limbs) {
return 1; return 1;
} }
@ -160,7 +160,7 @@ static int secp256k1_num_cmp(const secp256k1_num_t *a, const secp256k1_num_t *b)
return mpn_cmp(a->data, b->data, a->limbs); return mpn_cmp(a->data, b->data, a->limbs);
} }
static int secp256k1_num_eq(const secp256k1_num_t *a, const secp256k1_num_t *b) { static int secp256k1_num_eq(const secp256k1_num *a, const secp256k1_num *b) {
if (a->limbs > b->limbs) { if (a->limbs > b->limbs) {
return 0; return 0;
} }
@ -173,7 +173,7 @@ static int secp256k1_num_eq(const secp256k1_num_t *a, const secp256k1_num_t *b)
return mpn_cmp(a->data, b->data, a->limbs) == 0; return mpn_cmp(a->data, b->data, a->limbs) == 0;
} }
static void secp256k1_num_subadd(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b, int bneg) { static void secp256k1_num_subadd(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b, int bneg) {
if (!(b->neg ^ bneg ^ a->neg)) { /* a and b have the same sign */ if (!(b->neg ^ bneg ^ a->neg)) { /* a and b have the same sign */
r->neg = a->neg; r->neg = a->neg;
if (a->limbs >= b->limbs) { if (a->limbs >= b->limbs) {
@ -192,19 +192,19 @@ static void secp256k1_num_subadd(secp256k1_num_t *r, const secp256k1_num_t *a, c
} }
} }
static void secp256k1_num_add(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b) { static void secp256k1_num_add(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
secp256k1_num_sanity(a); secp256k1_num_sanity(a);
secp256k1_num_sanity(b); secp256k1_num_sanity(b);
secp256k1_num_subadd(r, a, b, 0); secp256k1_num_subadd(r, a, b, 0);
} }
static void secp256k1_num_sub(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b) { static void secp256k1_num_sub(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
secp256k1_num_sanity(a); secp256k1_num_sanity(a);
secp256k1_num_sanity(b); secp256k1_num_sanity(b);
secp256k1_num_subadd(r, a, b, 1); secp256k1_num_subadd(r, a, b, 1);
} }
static void secp256k1_num_mul(secp256k1_num_t *r, const secp256k1_num_t *a, const secp256k1_num_t *b) { static void secp256k1_num_mul(secp256k1_num *r, const secp256k1_num *a, const secp256k1_num *b) {
mp_limb_t tmp[2*NUM_LIMBS+1]; mp_limb_t tmp[2*NUM_LIMBS+1];
secp256k1_num_sanity(a); secp256k1_num_sanity(a);
secp256k1_num_sanity(b); secp256k1_num_sanity(b);
@ -231,7 +231,7 @@ static void secp256k1_num_mul(secp256k1_num_t *r, const secp256k1_num_t *a, cons
memset(tmp, 0, sizeof(tmp)); memset(tmp, 0, sizeof(tmp));
} }
static void secp256k1_num_shift(secp256k1_num_t *r, int bits) { static void secp256k1_num_shift(secp256k1_num *r, int bits) {
int i; int i;
if (bits % GMP_NUMB_BITS) { if (bits % GMP_NUMB_BITS) {
/* Shift within limbs. */ /* Shift within limbs. */
@ -253,7 +253,7 @@ static void secp256k1_num_shift(secp256k1_num_t *r, int bits) {
} }
} }
static void secp256k1_num_negate(secp256k1_num_t *r) { static void secp256k1_num_negate(secp256k1_num *r) {
r->neg ^= 1; r->neg ^= 1;
} }

50
src/scalar.h
View file

@ -22,83 +22,83 @@
#endif #endif
/** Clear a scalar to prevent the leak of sensitive data. */ /** Clear a scalar to prevent the leak of sensitive data. */
static void secp256k1_scalar_clear(secp256k1_scalar_t *r); static void secp256k1_scalar_clear(secp256k1_scalar *r);
/** Access bits from a scalar. All requested bits must belong to the same 32-bit limb. */ /** Access bits from a scalar. All requested bits must belong to the same 32-bit limb. */
static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count); static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count);
/** Access bits from a scalar. Not constant time. */ /** Access bits from a scalar. Not constant time. */
static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count); static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count);
/** Set a scalar from a big endian byte array. */ /** Set a scalar from a big endian byte array. */
static void secp256k1_scalar_set_b32(secp256k1_scalar_t *r, const unsigned char *bin, int *overflow); static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *bin, int *overflow);
/** Set a scalar to an unsigned integer. */ /** Set a scalar to an unsigned integer. */
static void secp256k1_scalar_set_int(secp256k1_scalar_t *r, unsigned int v); static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v);
/** Convert a scalar to a byte array. */ /** Convert a scalar to a byte array. */
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar_t* a); static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a);
/** Add two scalars together (modulo the group order). Returns whether it overflowed. */ /** Add two scalars together (modulo the group order). Returns whether it overflowed. */
static int secp256k1_scalar_add(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b); static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b);
/** Conditionally add a power of two to a scalar. The result is not allowed to overflow. */ /** Conditionally add a power of two to a scalar. The result is not allowed to overflow. */
static void secp256k1_scalar_cadd_bit(secp256k1_scalar_t *r, unsigned int bit, int flag); static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag);
/** Multiply two scalars (modulo the group order). */ /** Multiply two scalars (modulo the group order). */
static void secp256k1_scalar_mul(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b); static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b);
/** Shift a scalar right by some amount strictly between 0 and 16, returning /** Shift a scalar right by some amount strictly between 0 and 16, returning
* the low bits that were shifted off */ * the low bits that were shifted off */
static int secp256k1_scalar_shr_int(secp256k1_scalar_t *r, int n); static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n);
/** Compute the square of a scalar (modulo the group order). */ /** Compute the square of a scalar (modulo the group order). */
static void secp256k1_scalar_sqr(secp256k1_scalar_t *r, const secp256k1_scalar_t *a); static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a);
/** Compute the inverse of a scalar (modulo the group order). */ /** Compute the inverse of a scalar (modulo the group order). */
static void secp256k1_scalar_inverse(secp256k1_scalar_t *r, const secp256k1_scalar_t *a); static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *a);
/** Compute the inverse of a scalar (modulo the group order), without constant-time guarantee. */ /** Compute the inverse of a scalar (modulo the group order), without constant-time guarantee. */
static void secp256k1_scalar_inverse_var(secp256k1_scalar_t *r, const secp256k1_scalar_t *a); static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *a);
/** Compute the complement of a scalar (modulo the group order). */ /** Compute the complement of a scalar (modulo the group order). */
static void secp256k1_scalar_negate(secp256k1_scalar_t *r, const secp256k1_scalar_t *a); static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a);
/** Check whether a scalar equals zero. */ /** Check whether a scalar equals zero. */
static int secp256k1_scalar_is_zero(const secp256k1_scalar_t *a); static int secp256k1_scalar_is_zero(const secp256k1_scalar *a);
/** Check whether a scalar equals one. */ /** Check whether a scalar equals one. */
static int secp256k1_scalar_is_one(const secp256k1_scalar_t *a); static int secp256k1_scalar_is_one(const secp256k1_scalar *a);
/** Check whether a scalar, considered as an nonnegative integer, is even. */ /** Check whether a scalar, considered as an nonnegative integer, is even. */
static int secp256k1_scalar_is_even(const secp256k1_scalar_t *a); static int secp256k1_scalar_is_even(const secp256k1_scalar *a);
/** Check whether a scalar is higher than the group order divided by 2. */ /** Check whether a scalar is higher than the group order divided by 2. */
static int secp256k1_scalar_is_high(const secp256k1_scalar_t *a); static int secp256k1_scalar_is_high(const secp256k1_scalar *a);
/** Conditionally negate a number, in constant time. /** Conditionally negate a number, in constant time.
* Returns -1 if the number was negated, 1 otherwise */ * Returns -1 if the number was negated, 1 otherwise */
static int secp256k1_scalar_cond_negate(secp256k1_scalar_t *a, int flag); static int secp256k1_scalar_cond_negate(secp256k1_scalar *a, int flag);
#ifndef USE_NUM_NONE #ifndef USE_NUM_NONE
/** Convert a scalar to a number. */ /** Convert a scalar to a number. */
static void secp256k1_scalar_get_num(secp256k1_num_t *r, const secp256k1_scalar_t *a); static void secp256k1_scalar_get_num(secp256k1_num *r, const secp256k1_scalar *a);
/** Get the order of the group as a number. */ /** Get the order of the group as a number. */
static void secp256k1_scalar_order_get_num(secp256k1_num_t *r); static void secp256k1_scalar_order_get_num(secp256k1_num *r);
#endif #endif
/** Compare two scalars. */ /** Compare two scalars. */
static int secp256k1_scalar_eq(const secp256k1_scalar_t *a, const secp256k1_scalar_t *b); static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b);
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
/** Find r1 and r2 such that r1+r2*2^128 = a. */ /** Find r1 and r2 such that r1+r2*2^128 = a. */
static void secp256k1_scalar_split_128(secp256k1_scalar_t *r1, secp256k1_scalar_t *r2, const secp256k1_scalar_t *a); static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a);
/** Find r1 and r2 such that r1+r2*lambda = a, and r1 and r2 are maximum 128 bits long (see secp256k1_gej_mul_lambda). */ /** Find r1 and r2 such that r1+r2*lambda = a, and r1 and r2 are maximum 128 bits long (see secp256k1_gej_mul_lambda). */
static void secp256k1_scalar_split_lambda(secp256k1_scalar_t *r1, secp256k1_scalar_t *r2, const secp256k1_scalar_t *a); static void secp256k1_scalar_split_lambda(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a);
#endif #endif
/** Multiply a and b (without taking the modulus!), divide by 2**shift, and round to the nearest integer. Shift must be at least 256. */ /** Multiply a and b (without taking the modulus!), divide by 2**shift, and round to the nearest integer. Shift must be at least 256. */
static void secp256k1_scalar_mul_shift_var(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b, unsigned int shift); static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift);
#endif #endif

2
src/scalar_4x64.h
View file

@ -12,7 +12,7 @@
/** A scalar modulo the group order of the secp256k1 curve. */ /** A scalar modulo the group order of the secp256k1 curve. */
typedef struct { typedef struct {
uint64_t d[4]; uint64_t d[4];
} secp256k1_scalar_t; } secp256k1_scalar;
#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}} #define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}

48
src/scalar_4x64_impl.h
View file

@ -24,26 +24,26 @@
#define SECP256K1_N_H_2 ((uint64_t)0xFFFFFFFFFFFFFFFFULL) #define SECP256K1_N_H_2 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL) #define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar_t *r) { SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) {
r->d[0] = 0; r->d[0] = 0;
r->d[1] = 0; r->d[1] = 0;
r->d[2] = 0; r->d[2] = 0;
r->d[3] = 0; r->d[3] = 0;
} }
SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar_t *r, unsigned int v) { SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v) {
r->d[0] = v; r->d[0] = v;
r->d[1] = 0; r->d[1] = 0;
r->d[2] = 0; r->d[2] = 0;
r->d[3] = 0; r->d[3] = 0;
} }
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count) { SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
VERIFY_CHECK((offset + count - 1) >> 6 == offset >> 6); VERIFY_CHECK((offset + count - 1) >> 6 == offset >> 6);
return (a->d[offset >> 6] >> (offset & 0x3F)) & ((((uint64_t)1) << count) - 1); return (a->d[offset >> 6] >> (offset & 0x3F)) & ((((uint64_t)1) << count) - 1);
} }
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count) { SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
VERIFY_CHECK(count < 32); VERIFY_CHECK(count < 32);
VERIFY_CHECK(offset + count <= 256); VERIFY_CHECK(offset + count <= 256);
if ((offset + count - 1) >> 6 == offset >> 6) { if ((offset + count - 1) >> 6 == offset >> 6) {
@ -54,7 +54,7 @@ SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256
} }
} }
SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar_t *a) { SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) {
int yes = 0; int yes = 0;
int no = 0; int no = 0;
no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */ no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */
@ -66,7 +66,7 @@ SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scal
return yes; return yes;
} }
SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar_t *r, unsigned int overflow) { SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, unsigned int overflow) {
uint128_t t; uint128_t t;
VERIFY_CHECK(overflow <= 1); VERIFY_CHECK(overflow <= 1);
t = (uint128_t)r->d[0] + overflow * SECP256K1_N_C_0; t = (uint128_t)r->d[0] + overflow * SECP256K1_N_C_0;
@ -80,7 +80,7 @@ SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar_t *r, unsig
return overflow; return overflow;
} }
static int secp256k1_scalar_add(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
int overflow; int overflow;
uint128_t t = (uint128_t)a->d[0] + b->d[0]; uint128_t t = (uint128_t)a->d[0] + b->d[0];
r->d[0] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64; r->d[0] = t & 0xFFFFFFFFFFFFFFFFULL; t >>= 64;
@ -96,7 +96,7 @@ static int secp256k1_scalar_add(secp256k1_scalar_t *r, const secp256k1_scalar_t
return overflow; return overflow;
} }
static void secp256k1_scalar_cadd_bit(secp256k1_scalar_t *r, unsigned int bit, int flag) { static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
uint128_t t; uint128_t t;
VERIFY_CHECK(bit < 256); VERIFY_CHECK(bit < 256);
bit += ((uint32_t) flag - 1) & 0x100; /* forcing (bit >> 6) > 3 makes this a noop */ bit += ((uint32_t) flag - 1) & 0x100; /* forcing (bit >> 6) > 3 makes this a noop */
@ -114,7 +114,7 @@ static void secp256k1_scalar_cadd_bit(secp256k1_scalar_t *r, unsigned int bit, i
#endif #endif
} }
static void secp256k1_scalar_set_b32(secp256k1_scalar_t *r, const unsigned char *b32, int *overflow) { static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
int over; int over;
r->d[0] = (uint64_t)b32[31] | (uint64_t)b32[30] << 8 | (uint64_t)b32[29] << 16 | (uint64_t)b32[28] << 24 | (uint64_t)b32[27] << 32 | (uint64_t)b32[26] << 40 | (uint64_t)b32[25] << 48 | (uint64_t)b32[24] << 56; r->d[0] = (uint64_t)b32[31] | (uint64_t)b32[30] << 8 | (uint64_t)b32[29] << 16 | (uint64_t)b32[28] << 24 | (uint64_t)b32[27] << 32 | (uint64_t)b32[26] << 40 | (uint64_t)b32[25] << 48 | (uint64_t)b32[24] << 56;
r->d[1] = (uint64_t)b32[23] | (uint64_t)b32[22] << 8 | (uint64_t)b32[21] << 16 | (uint64_t)b32[20] << 24 | (uint64_t)b32[19] << 32 | (uint64_t)b32[18] << 40 | (uint64_t)b32[17] << 48 | (uint64_t)b32[16] << 56; r->d[1] = (uint64_t)b32[23] | (uint64_t)b32[22] << 8 | (uint64_t)b32[21] << 16 | (uint64_t)b32[20] << 24 | (uint64_t)b32[19] << 32 | (uint64_t)b32[18] << 40 | (uint64_t)b32[17] << 48 | (uint64_t)b32[16] << 56;
@ -126,18 +126,18 @@ static void secp256k1_scalar_set_b32(secp256k1_scalar_t *r, const unsigned char
} }
} }
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar_t* a) { static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
bin[0] = a->d[3] >> 56; bin[1] = a->d[3] >> 48; bin[2] = a->d[3] >> 40; bin[3] = a->d[3] >> 32; bin[4] = a->d[3] >> 24; bin[5] = a->d[3] >> 16; bin[6] = a->d[3] >> 8; bin[7] = a->d[3]; bin[0] = a->d[3] >> 56; bin[1] = a->d[3] >> 48; bin[2] = a->d[3] >> 40; bin[3] = a->d[3] >> 32; bin[4] = a->d[3] >> 24; bin[5] = a->d[3] >> 16; bin[6] = a->d[3] >> 8; bin[7] = a->d[3];
bin[8] = a->d[2] >> 56; bin[9] = a->d[2] >> 48; bin[10] = a->d[2] >> 40; bin[11] = a->d[2] >> 32; bin[12] = a->d[2] >> 24; bin[13] = a->d[2] >> 16; bin[14] = a->d[2] >> 8; bin[15] = a->d[2]; bin[8] = a->d[2] >> 56; bin[9] = a->d[2] >> 48; bin[10] = a->d[2] >> 40; bin[11] = a->d[2] >> 32; bin[12] = a->d[2] >> 24; bin[13] = a->d[2] >> 16; bin[14] = a->d[2] >> 8; bin[15] = a->d[2];
bin[16] = a->d[1] >> 56; bin[17] = a->d[1] >> 48; bin[18] = a->d[1] >> 40; bin[19] = a->d[1] >> 32; bin[20] = a->d[1] >> 24; bin[21] = a->d[1] >> 16; bin[22] = a->d[1] >> 8; bin[23] = a->d[1]; bin[16] = a->d[1] >> 56; bin[17] = a->d[1] >> 48; bin[18] = a->d[1] >> 40; bin[19] = a->d[1] >> 32; bin[20] = a->d[1] >> 24; bin[21] = a->d[1] >> 16; bin[22] = a->d[1] >> 8; bin[23] = a->d[1];
bin[24] = a->d[0] >> 56; bin[25] = a->d[0] >> 48; bin[26] = a->d[0] >> 40; bin[27] = a->d[0] >> 32; bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0]; bin[24] = a->d[0] >> 56; bin[25] = a->d[0] >> 48; bin[26] = a->d[0] >> 40; bin[27] = a->d[0] >> 32; bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0];
} }
SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar_t *a) { SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0; return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
} }
static void secp256k1_scalar_negate(secp256k1_scalar_t *r, const secp256k1_scalar_t *a) { static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (secp256k1_scalar_is_zero(a) == 0); uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (secp256k1_scalar_is_zero(a) == 0);
uint128_t t = (uint128_t)(~a->d[0]) + SECP256K1_N_0 + 1; uint128_t t = (uint128_t)(~a->d[0]) + SECP256K1_N_0 + 1;
r->d[0] = t & nonzero; t >>= 64; r->d[0] = t & nonzero; t >>= 64;
@ -149,11 +149,11 @@ static void secp256k1_scalar_negate(secp256k1_scalar_t *r, const secp256k1_scala
r->d[3] = t & nonzero; r->d[3] = t & nonzero;
} }
SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar_t *a) { SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3]) == 0; return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3]) == 0;
} }
static int secp256k1_scalar_is_high(const secp256k1_scalar_t *a) { static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
int yes = 0; int yes = 0;
int no = 0; int no = 0;
no |= (a->d[3] < SECP256K1_N_H_3); no |= (a->d[3] < SECP256K1_N_H_3);
@ -165,7 +165,7 @@ static int secp256k1_scalar_is_high(const secp256k1_scalar_t *a) {
return yes; return yes;
} }
static int secp256k1_scalar_cond_negate(secp256k1_scalar_t *r, int flag) { static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
/* If we are flag = 0, mask = 00...00 and this is a no-op; /* If we are flag = 0, mask = 00...00 and this is a no-op;
* if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */ * if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */
uint64_t mask = !flag - 1; uint64_t mask = !flag - 1;
@ -267,7 +267,7 @@ static int secp256k1_scalar_cond_negate(secp256k1_scalar_t *r, int flag) {
VERIFY_CHECK(c2 == 0); \ VERIFY_CHECK(c2 == 0); \
} }
static void secp256k1_scalar_reduce_512(secp256k1_scalar_t *r, const uint64_t *l) { static void secp256k1_scalar_reduce_512(secp256k1_scalar *r, const uint64_t *l) {
#ifdef USE_ASM_X86_64 #ifdef USE_ASM_X86_64
/* Reduce 512 bits into 385. */ /* Reduce 512 bits into 385. */
uint64_t m0, m1, m2, m3, m4, m5, m6; uint64_t m0, m1, m2, m3, m4, m5, m6;
@ -576,7 +576,7 @@ static void secp256k1_scalar_reduce_512(secp256k1_scalar_t *r, const uint64_t *l
secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r)); secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
} }
static void secp256k1_scalar_mul_512(uint64_t l[8], const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { static void secp256k1_scalar_mul_512(uint64_t l[8], const secp256k1_scalar *a, const secp256k1_scalar *b) {
#ifdef USE_ASM_X86_64 #ifdef USE_ASM_X86_64
const uint64_t *pb = b->d; const uint64_t *pb = b->d;
__asm__ __volatile__( __asm__ __volatile__(
@ -743,7 +743,7 @@ static void secp256k1_scalar_mul_512(uint64_t l[8], const secp256k1_scalar_t *a,
#endif #endif
} }
static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar_t *a) { static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
#ifdef USE_ASM_X86_64 #ifdef USE_ASM_X86_64
__asm__ __volatile__( __asm__ __volatile__(
/* Preload */ /* Preload */
@ -888,13 +888,13 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar_t *a)
#undef extract #undef extract
#undef extract_fast #undef extract_fast
static void secp256k1_scalar_mul(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
uint64_t l[8]; uint64_t l[8];
secp256k1_scalar_mul_512(l, a, b); secp256k1_scalar_mul_512(l, a, b);
secp256k1_scalar_reduce_512(r, l); secp256k1_scalar_reduce_512(r, l);
} }
static int secp256k1_scalar_shr_int(secp256k1_scalar_t *r, int n) { static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
int ret; int ret;
VERIFY_CHECK(n > 0); VERIFY_CHECK(n > 0);
VERIFY_CHECK(n < 16); VERIFY_CHECK(n < 16);
@ -906,13 +906,13 @@ static int secp256k1_scalar_shr_int(secp256k1_scalar_t *r, int n) {
return ret; return ret;
} }
static void secp256k1_scalar_sqr(secp256k1_scalar_t *r, const secp256k1_scalar_t *a) { static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a) {
uint64_t l[8]; uint64_t l[8];
secp256k1_scalar_sqr_512(l, a); secp256k1_scalar_sqr_512(l, a);
secp256k1_scalar_reduce_512(r, l); secp256k1_scalar_reduce_512(r, l);
} }
static void secp256k1_scalar_split_128(secp256k1_scalar_t *r1, secp256k1_scalar_t *r2, const secp256k1_scalar_t *a) { static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
r1->d[0] = a->d[0]; r1->d[0] = a->d[0];
r1->d[1] = a->d[1]; r1->d[1] = a->d[1];
r1->d[2] = 0; r1->d[2] = 0;
@ -923,11 +923,11 @@ static void secp256k1_scalar_split_128(secp256k1_scalar_t *r1, secp256k1_scalar_
r2->d[3] = 0; r2->d[3] = 0;
} }
SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3])) == 0; return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3])) == 0;
} }
SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b, unsigned int shift) { SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift) {
uint64_t l[8]; uint64_t l[8];
unsigned int shiftlimbs; unsigned int shiftlimbs;
unsigned int shiftlow; unsigned int shiftlow;

2
src/scalar_8x32.h
View file

@ -12,7 +12,7 @@
/** A scalar modulo the group order of the secp256k1 curve. */ /** A scalar modulo the group order of the secp256k1 curve. */
typedef struct { typedef struct {
uint32_t d[8]; uint32_t d[8];
} secp256k1_scalar_t; } secp256k1_scalar;
#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{(d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7)}} #define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{(d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7)}}

48
src/scalar_8x32_impl.h
View file

@ -34,7 +34,7 @@
#define SECP256K1_N_H_6 ((uint32_t)0xFFFFFFFFUL) #define SECP256K1_N_H_6 ((uint32_t)0xFFFFFFFFUL)
#define SECP256K1_N_H_7 ((uint32_t)0x7FFFFFFFUL) #define SECP256K1_N_H_7 ((uint32_t)0x7FFFFFFFUL)
SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar_t *r) { SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) {
r->d[0] = 0; r->d[0] = 0;
r->d[1] = 0; r->d[1] = 0;
r->d[2] = 0; r->d[2] = 0;
@ -45,7 +45,7 @@ SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar_t *r) {
r->d[7] = 0; r->d[7] = 0;
} }
SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar_t *r, unsigned int v) { SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v) {
r->d[0] = v; r->d[0] = v;
r->d[1] = 0; r->d[1] = 0;
r->d[2] = 0; r->d[2] = 0;
@ -56,12 +56,12 @@ SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar_t *r, uns
r->d[7] = 0; r->d[7] = 0;
} }
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count) { SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5); VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5);
return (a->d[offset >> 5] >> (offset & 0x1F)) & ((1 << count) - 1); return (a->d[offset >> 5] >> (offset & 0x1F)) & ((1 << count) - 1);
} }
SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count) { SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
VERIFY_CHECK(count < 32); VERIFY_CHECK(count < 32);
VERIFY_CHECK(offset + count <= 256); VERIFY_CHECK(offset + count <= 256);
if ((offset + count - 1) >> 5 == offset >> 5) { if ((offset + count - 1) >> 5 == offset >> 5) {
@ -72,7 +72,7 @@ SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256
} }
} }
SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar_t *a) { SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) {
int yes = 0; int yes = 0;
int no = 0; int no = 0;
no |= (a->d[7] < SECP256K1_N_7); /* No need for a > check. */ no |= (a->d[7] < SECP256K1_N_7); /* No need for a > check. */
@ -90,7 +90,7 @@ SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scal
return yes; return yes;
} }
SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar_t *r, uint32_t overflow) { SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, uint32_t overflow) {
uint64_t t; uint64_t t;
VERIFY_CHECK(overflow <= 1); VERIFY_CHECK(overflow <= 1);
t = (uint64_t)r->d[0] + overflow * SECP256K1_N_C_0; t = (uint64_t)r->d[0] + overflow * SECP256K1_N_C_0;
@ -112,7 +112,7 @@ SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar_t *r, uint3
return overflow; return overflow;
} }
static int secp256k1_scalar_add(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
int overflow; int overflow;
uint64_t t = (uint64_t)a->d[0] + b->d[0]; uint64_t t = (uint64_t)a->d[0] + b->d[0];
r->d[0] = t & 0xFFFFFFFFULL; t >>= 32; r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
@ -136,7 +136,7 @@ static int secp256k1_scalar_add(secp256k1_scalar_t *r, const secp256k1_scalar_t
return overflow; return overflow;
} }
static void secp256k1_scalar_cadd_bit(secp256k1_scalar_t *r, unsigned int bit, int flag) { static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
uint64_t t; uint64_t t;
VERIFY_CHECK(bit < 256); VERIFY_CHECK(bit < 256);
bit += ((uint32_t) flag - 1) & 0x100; /* forcing (bit >> 5) > 7 makes this a noop */ bit += ((uint32_t) flag - 1) & 0x100; /* forcing (bit >> 5) > 7 makes this a noop */
@ -162,7 +162,7 @@ static void secp256k1_scalar_cadd_bit(secp256k1_scalar_t *r, unsigned int bit, i
#endif #endif
} }
static void secp256k1_scalar_set_b32(secp256k1_scalar_t *r, const unsigned char *b32, int *overflow) { static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
int over; int over;
r->d[0] = (uint32_t)b32[31] | (uint32_t)b32[30] << 8 | (uint32_t)b32[29] << 16 | (uint32_t)b32[28] << 24; r->d[0] = (uint32_t)b32[31] | (uint32_t)b32[30] << 8 | (uint32_t)b32[29] << 16 | (uint32_t)b32[28] << 24;
r->d[1] = (uint32_t)b32[27] | (uint32_t)b32[26] << 8 | (uint32_t)b32[25] << 16 | (uint32_t)b32[24] << 24; r->d[1] = (uint32_t)b32[27] | (uint32_t)b32[26] << 8 | (uint32_t)b32[25] << 16 | (uint32_t)b32[24] << 24;
@ -178,7 +178,7 @@ static void secp256k1_scalar_set_b32(secp256k1_scalar_t *r, const unsigned char
} }
} }
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar_t* a) { static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
bin[0] = a->d[7] >> 24; bin[1] = a->d[7] >> 16; bin[2] = a->d[7] >> 8; bin[3] = a->d[7]; bin[0] = a->d[7] >> 24; bin[1] = a->d[7] >> 16; bin[2] = a->d[7] >> 8; bin[3] = a->d[7];
bin[4] = a->d[6] >> 24; bin[5] = a->d[6] >> 16; bin[6] = a->d[6] >> 8; bin[7] = a->d[6]; bin[4] = a->d[6] >> 24; bin[5] = a->d[6] >> 16; bin[6] = a->d[6] >> 8; bin[7] = a->d[6];
bin[8] = a->d[5] >> 24; bin[9] = a->d[5] >> 16; bin[10] = a->d[5] >> 8; bin[11] = a->d[5]; bin[8] = a->d[5] >> 24; bin[9] = a->d[5] >> 16; bin[10] = a->d[5] >> 8; bin[11] = a->d[5];
@ -189,11 +189,11 @@ static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar_
bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0]; bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0];
} }
SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar_t *a) { SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
return (a->d[0] | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0; return (a->d[0] | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
} }
static void secp256k1_scalar_negate(secp256k1_scalar_t *r, const secp256k1_scalar_t *a) { static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
uint32_t nonzero = 0xFFFFFFFFUL * (secp256k1_scalar_is_zero(a) == 0); uint32_t nonzero = 0xFFFFFFFFUL * (secp256k1_scalar_is_zero(a) == 0);
uint64_t t = (uint64_t)(~a->d[0]) + SECP256K1_N_0 + 1; uint64_t t = (uint64_t)(~a->d[0]) + SECP256K1_N_0 + 1;
r->d[0] = t & nonzero; t >>= 32; r->d[0] = t & nonzero; t >>= 32;
@ -213,11 +213,11 @@ static void secp256k1_scalar_negate(secp256k1_scalar_t *r, const secp256k1_scala
r->d[7] = t & nonzero; r->d[7] = t & nonzero;
} }
SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar_t *a) { SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0; return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
} }
static int secp256k1_scalar_is_high(const secp256k1_scalar_t *a) { static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
int yes = 0; int yes = 0;
int no = 0; int no = 0;
no |= (a->d[7] < SECP256K1_N_H_7); no |= (a->d[7] < SECP256K1_N_H_7);
@ -235,7 +235,7 @@ static int secp256k1_scalar_is_high(const secp256k1_scalar_t *a) {
return yes; return yes;
} }
static int secp256k1_scalar_cond_negate(secp256k1_scalar_t *r, int flag) { static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
/* If we are flag = 0, mask = 00...00 and this is a no-op; /* If we are flag = 0, mask = 00...00 and this is a no-op;
* if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */ * if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */
uint32_t mask = !flag - 1; uint32_t mask = !flag - 1;
@ -346,7 +346,7 @@ static int secp256k1_scalar_cond_negate(secp256k1_scalar_t *r, int flag) {
VERIFY_CHECK(c2 == 0); \ VERIFY_CHECK(c2 == 0); \
} }
static void secp256k1_scalar_reduce_512(secp256k1_scalar_t *r, const uint32_t *l) { static void secp256k1_scalar_reduce_512(secp256k1_scalar *r, const uint32_t *l) {
uint64_t c; uint64_t c;
uint32_t n0 = l[8], n1 = l[9], n2 = l[10], n3 = l[11], n4 = l[12], n5 = l[13], n6 = l[14], n7 = l[15]; uint32_t n0 = l[8], n1 = l[9], n2 = l[10], n3 = l[11], n4 = l[12], n5 = l[13], n6 = l[14], n7 = l[15];
uint32_t m0, m1, m2, m3, m4, m5, m6, m7, m8, m9, m10, m11, m12; uint32_t m0, m1, m2, m3, m4, m5, m6, m7, m8, m9, m10, m11, m12;
@ -488,7 +488,7 @@ static void secp256k1_scalar_reduce_512(secp256k1_scalar_t *r, const uint32_t *l
secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r)); secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
} }
static void secp256k1_scalar_mul_512(uint32_t *l, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { static void secp256k1_scalar_mul_512(uint32_t *l, const secp256k1_scalar *a, const secp256k1_scalar *b) {
/* 96 bit accumulator. */ /* 96 bit accumulator. */
uint32_t c0 = 0, c1 = 0, c2 = 0; uint32_t c0 = 0, c1 = 0, c2 = 0;
@ -576,7 +576,7 @@ static void secp256k1_scalar_mul_512(uint32_t *l, const secp256k1_scalar_t *a, c
l[15] = c0; l[15] = c0;
} }
static void secp256k1_scalar_sqr_512(uint32_t *l, const secp256k1_scalar_t *a) { static void secp256k1_scalar_sqr_512(uint32_t *l, const secp256k1_scalar *a) {
/* 96 bit accumulator. */ /* 96 bit accumulator. */
uint32_t c0 = 0, c1 = 0, c2 = 0; uint32_t c0 = 0, c1 = 0, c2 = 0;
@ -644,13 +644,13 @@ static void secp256k1_scalar_sqr_512(uint32_t *l, const secp256k1_scalar_t *a) {
#undef extract #undef extract
#undef extract_fast #undef extract_fast
static void secp256k1_scalar_mul(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
uint32_t l[16]; uint32_t l[16];
secp256k1_scalar_mul_512(l, a, b); secp256k1_scalar_mul_512(l, a, b);
secp256k1_scalar_reduce_512(r, l); secp256k1_scalar_reduce_512(r, l);
} }
static int secp256k1_scalar_shr_int(secp256k1_scalar_t *r, int n) { static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
int ret; int ret;
VERIFY_CHECK(n > 0); VERIFY_CHECK(n > 0);
VERIFY_CHECK(n < 16); VERIFY_CHECK(n < 16);
@ -666,14 +666,14 @@ static int secp256k1_scalar_shr_int(secp256k1_scalar_t *r, int n) {
return ret; return ret;
} }
static void secp256k1_scalar_sqr(secp256k1_scalar_t *r, const secp256k1_scalar_t *a) { static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a) {
uint32_t l[16]; uint32_t l[16];
secp256k1_scalar_sqr_512(l, a); secp256k1_scalar_sqr_512(l, a);
secp256k1_scalar_reduce_512(r, l); secp256k1_scalar_reduce_512(r, l);
} }
#ifdef USE_ENDOMORPHISM #ifdef USE_ENDOMORPHISM
static void secp256k1_scalar_split_128(secp256k1_scalar_t *r1, secp256k1_scalar_t *r2, const secp256k1_scalar_t *a) { static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
r1->d[0] = a->d[0]; r1->d[0] = a->d[0];
r1->d[1] = a->d[1]; r1->d[1] = a->d[1];
r1->d[2] = a->d[2]; r1->d[2] = a->d[2];
@ -693,11 +693,11 @@ static void secp256k1_scalar_split_128(secp256k1_scalar_t *r1, secp256k1_scalar_
} }
#endif #endif
SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) { SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3]) | (a->d[4] ^ b->d[4]) | (a->d[5] ^ b->d[5]) | (a->d[6] ^ b->d[6]) | (a->d[7] ^ b->d[7])) == 0; return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3]) | (a->d[4] ^ b->d[4]) | (a->d[5] ^ b->d[5]) | (a->d[6] ^ b->d[6]) | (a->d[7] ^ b->d[7])) == 0;
} }
SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b, unsigned int shift) { SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift) {
uint32_t l[16]; uint32_t l[16];
unsigned int shiftlimbs; unsigned int shiftlimbs;
unsigned int shiftlow; unsigned int shiftlow;

32
src/scalar_impl.h
View file

@ -25,14 +25,14 @@
#endif #endif
#ifndef USE_NUM_NONE #ifndef USE_NUM_NONE
static void secp256k1_scalar_get_num(secp256k1_num_t *r, const secp256k1_scalar_t *a) { static void secp256k1_scalar_get_num(secp256k1_num *r, const secp256k1_scalar *a) {
unsigned char c[32]; unsigned char c[32];
secp256k1_scalar_get_b32(c, a); secp256k1_scalar_get_b32(c, a);
secp256k1_num_set_bin(r, c, 32); secp256k1_num_set_bin(r, c, 32);
} }
/** secp256k1 curve order, see secp256k1_ecdsa_const_order_as_fe in ecdsa_impl.h */ /** secp256k1 curve order, see secp256k1_ecdsa_const_order_as_fe in ecdsa_impl.h */
static void secp256k1_scalar_order_get_num(secp256k1_num_t *r) { static void secp256k1_scalar_order_get_num(secp256k1_num *r) {
static const unsigned char order[32] = { static const unsigned char order[32] = {
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF, 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFE, 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFE,
@ -43,11 +43,11 @@ static void secp256k1_scalar_order_get_num(secp256k1_num_t *r) {
} }
#endif #endif
static void secp256k1_scalar_inverse(secp256k1_scalar_t *r, const secp256k1_scalar_t *x) { static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *x) {
secp256k1_scalar_t *t; secp256k1_scalar *t;
int i; int i;
/* First compute x ^ (2^N - 1) for some values of N. */ /* First compute x ^ (2^N - 1) for some values of N. */
secp256k1_scalar_t x2, x3, x4, x6, x7, x8, x15, x30, x60, x120, x127; secp256k1_scalar x2, x3, x4, x6, x7, x8, x15, x30, x60, x120, x127;
secp256k1_scalar_sqr(&x2, x); secp256k1_scalar_sqr(&x2, x);
secp256k1_scalar_mul(&x2, &x2, x); secp256k1_scalar_mul(&x2, &x2, x);
@ -234,18 +234,18 @@ static void secp256k1_scalar_inverse(secp256k1_scalar_t *r, const secp256k1_scal
secp256k1_scalar_mul(r, t, &x6); /* 111111 */ secp256k1_scalar_mul(r, t, &x6); /* 111111 */
} }
SECP256K1_INLINE static int secp256k1_scalar_is_even(const secp256k1_scalar_t *a) { SECP256K1_INLINE static int secp256k1_scalar_is_even(const secp256k1_scalar *a) {
/* d[0] is present and is the lowest word for all representations */ /* d[0] is present and is the lowest word for all representations */
return !(a->d[0] & 1); return !(a->d[0] & 1);
} }
static void secp256k1_scalar_inverse_var(secp256k1_scalar_t *r, const secp256k1_scalar_t *x) { static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *x) {
#if defined(USE_SCALAR_INV_BUILTIN) #if defined(USE_SCALAR_INV_BUILTIN)
secp256k1_scalar_inverse(r, x); secp256k1_scalar_inverse(r, x);
#elif defined(USE_SCALAR_INV_NUM) #elif defined(USE_SCALAR_INV_NUM)
unsigned char b[32]; unsigned char b[32];
secp256k1_num_t n, m; secp256k1_num n, m;
secp256k1_scalar_t t = *x; secp256k1_scalar t = *x;
secp256k1_scalar_get_b32(b, &t); secp256k1_scalar_get_b32(b, &t);
secp256k1_num_set_bin(&n, b, 32); secp256k1_num_set_bin(&n, b, 32);
secp256k1_scalar_order_get_num(&m); secp256k1_scalar_order_get_num(&m);
@ -299,25 +299,25 @@ static void secp256k1_scalar_inverse_var(secp256k1_scalar_t *r, const secp256k1_
* The function below splits a in r1 and r2, such that r1 + lambda * r2 == a (mod order). * The function below splits a in r1 and r2, such that r1 + lambda * r2 == a (mod order).
*/ */
static void secp256k1_scalar_split_lambda(secp256k1_scalar_t *r1, secp256k1_scalar_t *r2, const secp256k1_scalar_t *a) { static void secp256k1_scalar_split_lambda(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
secp256k1_scalar_t c1, c2; secp256k1_scalar c1, c2;
static const secp256k1_scalar_t minus_lambda = SECP256K1_SCALAR_CONST( static const secp256k1_scalar minus_lambda = SECP256K1_SCALAR_CONST(
0xAC9C52B3UL, 0x3FA3CF1FUL, 0x5AD9E3FDUL, 0x77ED9BA4UL, 0xAC9C52B3UL, 0x3FA3CF1FUL, 0x5AD9E3FDUL, 0x77ED9BA4UL,
0xA880B9FCUL, 0x8EC739C2UL, 0xE0CFC810UL, 0xB51283CFUL 0xA880B9FCUL, 0x8EC739C2UL, 0xE0CFC810UL, 0xB51283CFUL
); );
static const secp256k1_scalar_t minus_b1 = SECP256K1_SCALAR_CONST( static const secp256k1_scalar minus_b1 = SECP256K1_SCALAR_CONST(
0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL,
0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C3UL 0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C3UL
); );
static const secp256k1_scalar_t minus_b2 = SECP256K1_SCALAR_CONST( static const secp256k1_scalar minus_b2 = SECP256K1_SCALAR_CONST(
0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
0x8A280AC5UL, 0x0774346DUL, 0xD765CDA8UL, 0x3DB1562CUL 0x8A280AC5UL, 0x0774346DUL, 0xD765CDA8UL, 0x3DB1562CUL
); );
static const secp256k1_scalar_t g1 = SECP256K1_SCALAR_CONST( static const secp256k1_scalar g1 = SECP256K1_SCALAR_CONST(
0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00003086UL, 0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00003086UL,
0xD221A7D4UL, 0x6BCDE86CUL, 0x90E49284UL, 0xEB153DABUL 0xD221A7D4UL, 0x6BCDE86CUL, 0x90E49284UL, 0xEB153DABUL
); );
static const secp256k1_scalar_t g2 = SECP256K1_SCALAR_CONST( static const secp256k1_scalar g2 = SECP256K1_SCALAR_CONST(
0x00000000UL, 0x00000000UL, 0x00000000UL, 0x0000E443UL, 0x00000000UL, 0x00000000UL, 0x00000000UL, 0x0000E443UL,
0x7ED6010EUL, 0x88286F54UL, 0x7FA90ABFUL, 0xE4C42212UL 0x7ED6010EUL, 0x88286F54UL, 0x7FA90ABFUL, 0xE4C42212UL
); );

144
src/secp256k1.c
View file

@ -22,7 +22,7 @@
#define ARG_CHECK(cond) do { \ #define ARG_CHECK(cond) do { \
if (EXPECT(!(cond), 0)) { \ if (EXPECT(!(cond), 0)) { \
secp256k1_callback(&ctx->illegal_callback, #cond); \ secp256k1_callback_call(&ctx->illegal_callback, #cond); \
return 0; \ return 0; \
} \ } \
} while(0) } while(0)
@ -33,7 +33,7 @@ static void default_illegal_callback_fn(const char* str, void* data) {
abort(); abort();
} }
static const callback_t default_illegal_callback = { static const secp256k1_callback default_illegal_callback = {
default_illegal_callback_fn, default_illegal_callback_fn,
NULL NULL
}; };
@ -44,21 +44,21 @@ static void default_error_callback_fn(const char* str, void* data) {
abort(); abort();
} }
static const callback_t default_error_callback = { static const secp256k1_callback default_error_callback = {
default_error_callback_fn, default_error_callback_fn,
NULL NULL
}; };
struct secp256k1_context_struct { struct secp256k1_context_struct {
secp256k1_ecmult_context_t ecmult_ctx; secp256k1_ecmult_context ecmult_ctx;
secp256k1_ecmult_gen_context_t ecmult_gen_ctx; secp256k1_ecmult_gen_context ecmult_gen_ctx;
callback_t illegal_callback; secp256k1_callback illegal_callback;
callback_t error_callback; secp256k1_callback error_callback;
}; };
secp256k1_context_t* secp256k1_context_create(unsigned int flags) { secp256k1_context* secp256k1_context_create(unsigned int flags) {
secp256k1_context_t* ret = (secp256k1_context_t*)checked_malloc(&default_error_callback, sizeof(secp256k1_context_t)); secp256k1_context* ret = (secp256k1_context*)checked_malloc(&default_error_callback, sizeof(secp256k1_context));
ret->illegal_callback = default_illegal_callback; ret->illegal_callback = default_illegal_callback;
ret->error_callback = default_error_callback; ret->error_callback = default_error_callback;
@ -75,8 +75,8 @@ secp256k1_context_t* secp256k1_context_create(unsigned int flags) {
return ret; return ret;
} }
secp256k1_context_t* secp256k1_context_clone(const secp256k1_context_t* ctx) { secp256k1_context* secp256k1_context_clone(const secp256k1_context* ctx) {
secp256k1_context_t* ret = (secp256k1_context_t*)checked_malloc(&ctx->error_callback, sizeof(secp256k1_context_t)); secp256k1_context* ret = (secp256k1_context*)checked_malloc(&ctx->error_callback, sizeof(secp256k1_context));
ret->illegal_callback = ctx->illegal_callback; ret->illegal_callback = ctx->illegal_callback;
ret->error_callback = ctx->error_callback; ret->error_callback = ctx->error_callback;
secp256k1_ecmult_context_clone(&ret->ecmult_ctx, &ctx->ecmult_ctx, &ctx->error_callback); secp256k1_ecmult_context_clone(&ret->ecmult_ctx, &ctx->ecmult_ctx, &ctx->error_callback);
@ -84,7 +84,7 @@ secp256k1_context_t* secp256k1_context_clone(const secp256k1_context_t* ctx) {
return ret; return ret;
} }
void secp256k1_context_destroy(secp256k1_context_t* ctx) { void secp256k1_context_destroy(secp256k1_context* ctx) {
if (ctx) { if (ctx) {
secp256k1_ecmult_context_clear(&ctx->ecmult_ctx); secp256k1_ecmult_context_clear(&ctx->ecmult_ctx);
secp256k1_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx); secp256k1_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx);
@ -93,7 +93,7 @@ void secp256k1_context_destroy(secp256k1_context_t* ctx) {
} }
} }
void secp256k1_context_set_illegal_callback(secp256k1_context_t* ctx, void (*fun)(const char* message, void* data), const void* data) { void secp256k1_context_set_illegal_callback(secp256k1_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
if (!fun) { if (!fun) {
fun = default_illegal_callback_fn; fun = default_illegal_callback_fn;
} }
@ -101,7 +101,7 @@ void secp256k1_context_set_illegal_callback(secp256k1_context_t* ctx, void (*fun
ctx->illegal_callback.data = data; ctx->illegal_callback.data = data;
} }
void secp256k1_context_set_error_callback(secp256k1_context_t* ctx, void (*fun)(const char* message, void* data), const void* data) { void secp256k1_context_set_error_callback(secp256k1_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
if (!fun) { if (!fun) {
fun = default_error_callback_fn; fun = default_error_callback_fn;
} }
@ -109,17 +109,17 @@ void secp256k1_context_set_error_callback(secp256k1_context_t* ctx, void (*fun)(
ctx->error_callback.data = data; ctx->error_callback.data = data;
} }
static int secp256k1_pubkey_load(const secp256k1_context_t* ctx, secp256k1_ge_t* ge, const secp256k1_pubkey_t* pubkey) { static int secp256k1_pubkey_load(const secp256k1_context* ctx, secp256k1_ge* ge, const secp256k1_pubkey* pubkey) {
if (sizeof(secp256k1_ge_storage_t) == 64) { if (sizeof(secp256k1_ge_storage) == 64) {
/* When the secp256k1_ge_storage_t type is exactly 64 byte, use its /* When the secp256k1_ge_storage type is exactly 64 byte, use its
* representation inside secp256k1_pubkey_t, as conversion is very fast. * representation inside secp256k1_pubkey, as conversion is very fast.
* Note that secp256k1_pubkey_save must use the same representation. */ * Note that secp256k1_pubkey_save must use the same representation. */
secp256k1_ge_storage_t s; secp256k1_ge_storage s;
memcpy(&s, &pubkey->data[0], 64); memcpy(&s, &pubkey->data[0], 64);
secp256k1_ge_from_storage(ge, &s); secp256k1_ge_from_storage(ge, &s);
} else { } else {
/* Otherwise, fall back to 32-byte big endian for X and Y. */ /* Otherwise, fall back to 32-byte big endian for X and Y. */
secp256k1_fe_t x, y; secp256k1_fe x, y;
secp256k1_fe_set_b32(&x, pubkey->data); secp256k1_fe_set_b32(&x, pubkey->data);
secp256k1_fe_set_b32(&y, pubkey->data + 32); secp256k1_fe_set_b32(&y, pubkey->data + 32);
secp256k1_ge_set_xy(ge, &x, &y); secp256k1_ge_set_xy(ge, &x, &y);
@ -128,9 +128,9 @@ static int secp256k1_pubkey_load(const secp256k1_context_t* ctx, secp256k1_ge_t*
return 1; return 1;
} }
static void secp256k1_pubkey_save(secp256k1_pubkey_t* pubkey, secp256k1_ge_t* ge) { static void secp256k1_pubkey_save(secp256k1_pubkey* pubkey, secp256k1_ge* ge) {
if (sizeof(secp256k1_ge_storage_t) == 64) { if (sizeof(secp256k1_ge_storage) == 64) {
secp256k1_ge_storage_t s; secp256k1_ge_storage s;
secp256k1_ge_to_storage(&s, ge); secp256k1_ge_to_storage(&s, ge);
memcpy(&pubkey->data[0], &s, 64); memcpy(&pubkey->data[0], &s, 64);
} else { } else {
@ -142,8 +142,8 @@ static void secp256k1_pubkey_save(secp256k1_pubkey_t* pubkey, secp256k1_ge_t* ge
} }
} }
int secp256k1_ec_pubkey_parse(const secp256k1_context_t* ctx, secp256k1_pubkey_t* pubkey, const unsigned char *input, size_t inputlen) { int secp256k1_ec_pubkey_parse(const secp256k1_context* ctx, secp256k1_pubkey* pubkey, const unsigned char *input, size_t inputlen) {
secp256k1_ge_t Q; secp256k1_ge Q;
(void)ctx; (void)ctx;
if (!secp256k1_eckey_pubkey_parse(&Q, input, inputlen)) { if (!secp256k1_eckey_pubkey_parse(&Q, input, inputlen)) {
@ -155,19 +155,19 @@ int secp256k1_ec_pubkey_parse(const secp256k1_context_t* ctx, secp256k1_pubkey_t
return 1; return 1;
} }
int secp256k1_ec_pubkey_serialize(const secp256k1_context_t* ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey_t* pubkey, unsigned int flags) { int secp256k1_ec_pubkey_serialize(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey* pubkey, unsigned int flags) {
secp256k1_ge_t Q; secp256k1_ge Q;
(void)ctx; (void)ctx;
return (secp256k1_pubkey_load(ctx, &Q, pubkey) && return (secp256k1_pubkey_load(ctx, &Q, pubkey) &&
secp256k1_eckey_pubkey_serialize(&Q, output, outputlen, flags)); secp256k1_eckey_pubkey_serialize(&Q, output, outputlen, flags));
} }
static void secp256k1_ecdsa_signature_load(const secp256k1_context_t* ctx, secp256k1_scalar_t* r, secp256k1_scalar_t* s, const secp256k1_ecdsa_signature_t* sig) { static void secp256k1_ecdsa_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_ecdsa_signature* sig) {
(void)ctx; (void)ctx;
if (sizeof(secp256k1_scalar_t) == 32) { if (sizeof(secp256k1_scalar) == 32) {
/* When the secp256k1_scalar_t type is exactly 32 byte, use its /* When the secp256k1_scalar type is exactly 32 byte, use its
* representation inside secp256k1_ecdsa_signature_t, as conversion is very fast. * representation inside secp256k1_ecdsa_signature, as conversion is very fast.
* Note that secp256k1_ecdsa_signature_save must use the same representation. */ * Note that secp256k1_ecdsa_signature_save must use the same representation. */
memcpy(r, &sig->data[0], 32); memcpy(r, &sig->data[0], 32);
memcpy(s, &sig->data[32], 32); memcpy(s, &sig->data[32], 32);
@ -177,8 +177,8 @@ static void secp256k1_ecdsa_signature_load(const secp256k1_context_t* ctx, secp2
} }
} }
static void secp256k1_ecdsa_signature_save(secp256k1_ecdsa_signature_t* sig, const secp256k1_scalar_t* r, const secp256k1_scalar_t* s) { static void secp256k1_ecdsa_signature_save(secp256k1_ecdsa_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s) {
if (sizeof(secp256k1_scalar_t) == 32) { if (sizeof(secp256k1_scalar) == 32) {
memcpy(&sig->data[0], r, 32); memcpy(&sig->data[0], r, 32);
memcpy(&sig->data[32], s, 32); memcpy(&sig->data[32], s, 32);
} else { } else {
@ -187,8 +187,8 @@ static void secp256k1_ecdsa_signature_save(secp256k1_ecdsa_signature_t* sig, con
} }
} }
int secp256k1_ecdsa_signature_parse_der(const secp256k1_context_t* ctx, secp256k1_ecdsa_signature_t* sig, const unsigned char *input, size_t inputlen) { int secp256k1_ecdsa_signature_parse_der(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
(void)ctx; (void)ctx;
ARG_CHECK(sig != NULL); ARG_CHECK(sig != NULL);
@ -203,8 +203,8 @@ int secp256k1_ecdsa_signature_parse_der(const secp256k1_context_t* ctx, secp256k
} }
} }
int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context_t* ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature_t* sig) { int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature* sig) {
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
(void)ctx; (void)ctx;
ARG_CHECK(output != NULL); ARG_CHECK(output != NULL);
@ -215,10 +215,10 @@ int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context_t* ctx, unsi
return secp256k1_ecdsa_sig_serialize(output, outputlen, &r, &s); return secp256k1_ecdsa_sig_serialize(output, outputlen, &r, &s);
} }
int secp256k1_ecdsa_verify(const secp256k1_context_t* ctx, const secp256k1_ecdsa_signature_t *sig, const unsigned char *msg32, const secp256k1_pubkey_t *pubkey) { int secp256k1_ecdsa_verify(const secp256k1_context* ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msg32, const secp256k1_pubkey *pubkey) {
secp256k1_ge_t q; secp256k1_ge q;
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
secp256k1_scalar_t m; secp256k1_scalar m;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx)); ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
ARG_CHECK(msg32 != NULL); ARG_CHECK(msg32 != NULL);
@ -262,12 +262,12 @@ static int nonce_function_rfc6979(unsigned char *nonce32, const unsigned char *m
return 1; return 1;
} }
const secp256k1_nonce_function_t secp256k1_nonce_function_rfc6979 = nonce_function_rfc6979; const secp256k1_nonce_function secp256k1_nonce_function_rfc6979 = nonce_function_rfc6979;
const secp256k1_nonce_function_t secp256k1_nonce_function_default = nonce_function_rfc6979; const secp256k1_nonce_function secp256k1_nonce_function_default = nonce_function_rfc6979;
int secp256k1_ecdsa_sign(const secp256k1_context_t* ctx, secp256k1_ecdsa_signature_t *signature, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function_t noncefp, const void* noncedata) { int secp256k1_ecdsa_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signature *signature, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
secp256k1_scalar_t r, s; secp256k1_scalar r, s;
secp256k1_scalar_t sec, non, msg; secp256k1_scalar sec, non, msg;
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
unsigned int count = 0; unsigned int count = 0;
@ -311,8 +311,8 @@ int secp256k1_ecdsa_sign(const secp256k1_context_t* ctx, secp256k1_ecdsa_signatu
return ret; return ret;
} }
int secp256k1_ec_seckey_verify(const secp256k1_context_t* ctx, const unsigned char *seckey) { int secp256k1_ec_seckey_verify(const secp256k1_context* ctx, const unsigned char *seckey) {
secp256k1_scalar_t sec; secp256k1_scalar sec;
int ret; int ret;
int overflow; int overflow;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
@ -325,10 +325,10 @@ int secp256k1_ec_seckey_verify(const secp256k1_context_t* ctx, const unsigned ch
return ret; return ret;
} }
int secp256k1_ec_pubkey_create(const secp256k1_context_t* ctx, secp256k1_pubkey_t *pubkey, const unsigned char *seckey) { int secp256k1_ec_pubkey_create(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) {
secp256k1_gej_t pj; secp256k1_gej pj;
secp256k1_ge_t p; secp256k1_ge p;
secp256k1_scalar_t sec; secp256k1_scalar sec;
int overflow; int overflow;
int ret = 0; int ret = 0;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
@ -348,9 +348,9 @@ int secp256k1_ec_pubkey_create(const secp256k1_context_t* ctx, secp256k1_pubkey_
return ret; return ret;
} }
int secp256k1_ec_privkey_tweak_add(const secp256k1_context_t* ctx, unsigned char *seckey, const unsigned char *tweak) { int secp256k1_ec_privkey_tweak_add(const secp256k1_context* ctx, unsigned char *seckey, const unsigned char *tweak) {
secp256k1_scalar_t term; secp256k1_scalar term;
secp256k1_scalar_t sec; secp256k1_scalar sec;
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
@ -371,9 +371,9 @@ int secp256k1_ec_privkey_tweak_add(const secp256k1_context_t* ctx, unsigned char
return ret; return ret;
} }
int secp256k1_ec_pubkey_tweak_add(const secp256k1_context_t* ctx, secp256k1_pubkey_t *pubkey, const unsigned char *tweak) { int secp256k1_ec_pubkey_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *tweak) {
secp256k1_ge_t p; secp256k1_ge p;
secp256k1_scalar_t term; secp256k1_scalar term;
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
@ -394,9 +394,9 @@ int secp256k1_ec_pubkey_tweak_add(const secp256k1_context_t* ctx, secp256k1_pubk
return ret; return ret;
} }
int secp256k1_ec_privkey_tweak_mul(const secp256k1_context_t* ctx, unsigned char *seckey, const unsigned char *tweak) { int secp256k1_ec_privkey_tweak_mul(const secp256k1_context* ctx, unsigned char *seckey, const unsigned char *tweak) {
secp256k1_scalar_t factor; secp256k1_scalar factor;
secp256k1_scalar_t sec; secp256k1_scalar sec;
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
@ -416,9 +416,9 @@ int secp256k1_ec_privkey_tweak_mul(const secp256k1_context_t* ctx, unsigned char
return ret; return ret;
} }
int secp256k1_ec_pubkey_tweak_mul(const secp256k1_context_t* ctx, secp256k1_pubkey_t *pubkey, const unsigned char *tweak) { int secp256k1_ec_pubkey_tweak_mul(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *tweak) {
secp256k1_ge_t p; secp256k1_ge p;
secp256k1_scalar_t factor; secp256k1_scalar factor;
int ret = 0; int ret = 0;
int overflow = 0; int overflow = 0;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
@ -439,8 +439,8 @@ int secp256k1_ec_pubkey_tweak_mul(const secp256k1_context_t* ctx, secp256k1_pubk
return ret; return ret;
} }
int secp256k1_ec_privkey_export(const secp256k1_context_t* ctx, unsigned char *privkey, size_t *privkeylen, const unsigned char *seckey, unsigned int flags) { int secp256k1_ec_privkey_export(const secp256k1_context* ctx, unsigned char *privkey, size_t *privkeylen, const unsigned char *seckey, unsigned int flags) {
secp256k1_scalar_t key; secp256k1_scalar key;
int ret = 0; int ret = 0;
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(seckey != NULL); ARG_CHECK(seckey != NULL);
@ -454,8 +454,8 @@ int secp256k1_ec_privkey_export(const secp256k1_context_t* ctx, unsigned char *p
return ret; return ret;
} }
int secp256k1_ec_privkey_import(const secp256k1_context_t* ctx, unsigned char *seckey, const unsigned char *privkey, size_t privkeylen) { int secp256k1_ec_privkey_import(const secp256k1_context* ctx, unsigned char *seckey, const unsigned char *privkey, size_t privkeylen) {
secp256k1_scalar_t key; secp256k1_scalar key;
int ret = 0; int ret = 0;
ARG_CHECK(seckey != NULL); ARG_CHECK(seckey != NULL);
ARG_CHECK(privkey != NULL); ARG_CHECK(privkey != NULL);
@ -469,17 +469,17 @@ int secp256k1_ec_privkey_import(const secp256k1_context_t* ctx, unsigned char *s
return ret; return ret;
} }
int secp256k1_context_randomize(secp256k1_context_t* ctx, const unsigned char *seed32) { int secp256k1_context_randomize(secp256k1_context* ctx, const unsigned char *seed32) {
VERIFY_CHECK(ctx != NULL); VERIFY_CHECK(ctx != NULL);
ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
secp256k1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, seed32); secp256k1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, seed32);
return 1; return 1;
} }
int secp256k1_ec_pubkey_combine(const secp256k1_context_t* ctx, secp256k1_pubkey_t *pubnonce, const secp256k1_pubkey_t * const *pubnonces, int n) { int secp256k1_ec_pubkey_combine(const secp256k1_context* ctx, secp256k1_pubkey *pubnonce, const secp256k1_pubkey * const *pubnonces, int n) {
int i; int i;
secp256k1_gej_t Qj; secp256k1_gej Qj;
secp256k1_ge_t Q; secp256k1_ge Q;
ARG_CHECK(pubnonce != NULL); ARG_CHECK(pubnonce != NULL);
ARG_CHECK(n >= 1); ARG_CHECK(n >= 1);

474
src/tests.c
View file

File diff suppressed because it is too large Load diff

8
src/util.h
View file

@ -18,9 +18,9 @@
typedef struct { typedef struct {
void (*fn)(const char *text, void* data); void (*fn)(const char *text, void* data);
const void* data; const void* data;
} callback_t; } secp256k1_callback;
static SECP256K1_INLINE void secp256k1_callback(const callback_t * const cb, const char * const text) { static SECP256K1_INLINE void secp256k1_callback_call(const secp256k1_callback * const cb, const char * const text) {
cb->fn(text, (void*)cb->data); cb->fn(text, (void*)cb->data);
} }
@ -65,10 +65,10 @@ static SECP256K1_INLINE void secp256k1_callback(const callback_t * const cb, con
#define VERIFY_SETUP(stmt) #define VERIFY_SETUP(stmt)
#endif #endif
static SECP256K1_INLINE void *checked_malloc(const callback_t* cb, size_t size) { static SECP256K1_INLINE void *checked_malloc(const secp256k1_callback* cb, size_t size) {
void *ret = malloc(size); void *ret = malloc(size);
if (ret == NULL) { if (ret == NULL) {
secp256k1_callback(cb, "Out of memory"); secp256k1_callback_call(cb, "Out of memory");
} }
return ret; return ret;
} }