From 994b35010d1d62383be0ec970582ff4a171f7e84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C5=91rinc?= Date: Sun, 21 Jun 2026 13:37:40 +0200 Subject: [PATCH] field: correct fe_equal's b magnitude bound `secp256k1_fe_equal` negates `a` before adding `b`. That gives the temporary value magnitude 2, and the following field addition requires the input magnitudes to sum to at most 32. So the largest `b` magnitude the implementation can accept is 30, not 31. Lower the documented and checked bound for `b` to 30. Adjust the focused test to use random field elements with randomized magnitudes within the accepted `a <= 1` and `b <= 30` bounds. Co-authored-by: Sebastian Falbesoner Co-authored-by: Tim Ruffing --- src/field.h | 2 +- src/field_impl.h | 2 +- src/tests.c | 13 +++++++++++++ 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/field.h b/src/field.h index 945029ec..8b25d99b 100644 --- a/src/field.h +++ b/src/field.h @@ -166,7 +166,7 @@ static int secp256k1_fe_is_odd(const secp256k1_fe *a); /** Determine whether two field elements are equal. * * On input, a and b must be valid field elements with magnitudes not exceeding - * 1 and 31, respectively. + * 1 and 30, respectively. * Returns a = b (mod p). */ static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b); diff --git a/src/field_impl.h b/src/field_impl.h index 7aa7de43..19af6aa2 100644 --- a/src/field_impl.h +++ b/src/field_impl.h @@ -27,7 +27,7 @@ SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp SECP256K1_FE_VERIFY(a); SECP256K1_FE_VERIFY(b); SECP256K1_FE_VERIFY_MAGNITUDE(a, 1); - SECP256K1_FE_VERIFY_MAGNITUDE(b, 31); + SECP256K1_FE_VERIFY_MAGNITUDE(b, 30); secp256k1_fe_negate(&na, a, 1); secp256k1_fe_add(&na, b); diff --git a/src/tests.c b/src/tests.c index b0d94d6a..e821738d 100644 --- a/src/tests.c +++ b/src/tests.c @@ -3064,6 +3064,18 @@ static int fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) { return secp256k1_fe_equal(&an, &bn); } +static void run_fe_equal_magnitude_boundaries(void) { + int i; + secp256k1_fe a, b; + for (i = 0; i < 100 * COUNT; ++i) { + testutil_random_fe(&a); + b = a; + testutil_random_fe_magnitude(&a, 1); + testutil_random_fe_magnitude(&b, 30); + CHECK(secp256k1_fe_equal(&a, &b)); + } +} + static void run_field_convert(void) { static const unsigned char b32[32] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, @@ -7970,6 +7982,7 @@ static const struct tf_test_entry tests_scalar[] = { static const struct tf_test_entry tests_field[] = { CASE(field_half), CASE(field_misc), + CASE(fe_equal_magnitude_boundaries), CASE(field_convert), CASE(field_be32_overflow), CASE(fe_mul),