frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Store z-ratios in the 'x' coord they'll recover

Browse Source
This commit is contained in:
Peter Dettman 2018-11-09 14:50:17 +07:00 committed by Andrew Poelstra
parent ffd3b346fe
commit efa783f8f0
1 changed files with 22 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
src/ecmult_impl.h
View File

@ -139,8 +139,7 @@ static void secp256k1_ecmult_odd_multiples_table_globalz_windowa(secp256k1_ge *p
static void secp256k1_ecmult_odd_multiples_table_storage_var(const int n, secp256k1_ge_storage *pre, const secp256k1_gej *a) { static void secp256k1_ecmult_odd_multiples_table_storage_var(const int n, secp256k1_ge_storage *pre, const secp256k1_gej *a) {
secp256k1_gej d; secp256k1_gej d;
secp256k1_ge a_ge, d_ge, p_ge; secp256k1_ge d_ge, p_ge;
secp256k1_ge last_ge;
secp256k1_gej pj; secp256k1_gej pj;
secp256k1_fe zi; secp256k1_fe zi;
secp256k1_fe zr; secp256k1_fe zr;
@ -162,51 +161,48 @@ static void secp256k1_ecmult_odd_multiples_table_storage_var(const int n, secp25
d_ge.y = d.y; d_ge.y = d.y;
d_ge.infinity = 0; d_ge.infinity = 0;
secp256k1_ge_set_gej_zinv(&a_ge, a, &d.z); secp256k1_ge_set_gej_zinv(&p_ge, a, &d.z);
pj.x = a_ge.x; pj.x = p_ge.x;
pj.y = a_ge.y; pj.y = p_ge.y;
pj.z = a->z; pj.z = a->z;
pj.infinity = 0; pj.infinity = 0;
zr = d.z; for (i = 0; i < (n - 1); i++) {
secp256k1_fe_normalize_var(&zr);
secp256k1_fe_to_storage(&pre[0].x, &zr);
secp256k1_fe_normalize_var(&pj.y); secp256k1_fe_normalize_var(&pj.y);
secp256k1_fe_to_storage(&pre[0].y, &pj.y); secp256k1_fe_to_storage(&pre[i].y, &pj.y);
for (i = 1; i < n; i++) {
secp256k1_gej_add_ge_var(&pj, &pj, &d_ge, &zr); secp256k1_gej_add_ge_var(&pj, &pj, &d_ge, &zr);
secp256k1_fe_normalize_var(&zr); secp256k1_fe_normalize_var(&zr);
secp256k1_fe_to_storage(&pre[i].x, &zr); secp256k1_fe_to_storage(&pre[i].x, &zr);
secp256k1_fe_normalize_var(&pj.y);
secp256k1_fe_to_storage(&pre[i].y, &pj.y);
} }
/* Map `pj` back to our curve by multiplying its z-coordinate by `d.z`. */ /* Invert d.z in the same batch, preserving pj.z so we can extract 1/d.z */
zr = pj.z; /* save pj.z so we can use it to extract (d.z)^-1 from zi */ secp256k1_fe_mul(&zi, &pj.z, &d.z);
secp256k1_fe_mul(&pj.z, &pj.z, &d.z); secp256k1_fe_inv_var(&zi, &zi);
/* Directly set `pre[n - 1]` to `pj`, saving the inverted z-coordinate so /* Directly set `pre[n - 1]` to `pj`, saving the inverted z-coordinate so
* that we can combine it with the saved z-ratios to compute the other zs * that we can combine it with the saved z-ratios to compute the other zs
* without any more inversions. */ * without any more inversions. */
secp256k1_fe_inv_var(&zi, &pj.z);
secp256k1_ge_set_gej_zinv(&p_ge, &pj, &zi); secp256k1_ge_set_gej_zinv(&p_ge, &pj, &zi);
secp256k1_ge_from_storage(&last_ge, &pre[n - 1]);
secp256k1_ge_to_storage(&pre[n - 1], &p_ge); secp256k1_ge_to_storage(&pre[n - 1], &p_ge);
/* Compute the actual x-coordinate of D, which will be needed below. */ /* Compute the actual x-coordinate of D, which will be needed below. */
secp256k1_fe_mul(&d.z, &zi, &zr); /* d.z = 1/d.z */ secp256k1_fe_mul(&d.z, &zi, &pj.z); /* d.z = 1/d.z */
secp256k1_fe_sqr(&dx_over_dz_squared, &d.z); secp256k1_fe_sqr(&dx_over_dz_squared, &d.z);
secp256k1_fe_mul(&dx_over_dz_squared, &dx_over_dz_squared, &d.x); secp256k1_fe_mul(&dx_over_dz_squared, &dx_over_dz_squared, &d.x);
i = n - 1; i = n - 1;
while (i > 0) { while (i > 0) {
secp256k1_fe zi2, zi3; secp256k1_fe zi2, zi3;
const secp256k1_fe *rzr;
i--; i--;
secp256k1_ge_from_storage(&p_ge, &pre[i]);
/* For the remaining points, we extract the z-ratio from the stored /* For the remaining points, we extract the z-ratio from the stored
* x-coordinate, compute its z^-1 from that, and compute the full * x-coordinate, compute its z^-1 from that, and compute the full
* point from that. The z-ratio for the next iteration is stored in * point from that. */
* the x-coordinate at the end of the loop. */ rzr = &p_ge.x;
secp256k1_fe_mul(&zi, &zi, &last_ge.x); secp256k1_fe_mul(&zi, &zi, rzr);
secp256k1_fe_sqr(&zi2, &zi); secp256k1_fe_sqr(&zi2, &zi);
secp256k1_fe_mul(&zi3, &zi2, &zi); secp256k1_fe_mul(&zi3, &zi2, &zi);
/* To compute the actual x-coordinate, we use the stored z ratio and /* To compute the actual x-coordinate, we use the stored z ratio and
@ -217,7 +213,7 @@ static void secp256k1_ecmult_odd_multiples_table_storage_var(const int n, secp25
* multiplying by each z-ratio in turn. * multiplying by each z-ratio in turn.
* *
* Denoting the z-ratio as `rzr` (though the actual variable binding * Denoting the z-ratio as `rzr` (though the actual variable binding
* is `last_ge.x`), we observe that it equal to `h` from the inside * is `p_ge.x`), we observe that it equal to `h` from the inside
* of the above `gej_add_ge_var` call. This satisfies * of the above `gej_add_ge_var` call. This satisfies
* *
* rzr = d_x * z^2 - x * rzr = d_x * z^2 - x
@ -230,12 +226,11 @@ static void secp256k1_ecmult_odd_multiples_table_storage_var(const int n, secp25
* x = d_x - rzr / z^2 * x = d_x - rzr / z^2
* = d_x - rzr * zi2 * = d_x - rzr * zi2
*/ */
secp256k1_fe_mul(&p_ge.x, &last_ge.x, &zi2); secp256k1_fe_mul(&p_ge.x, rzr, &zi2);
secp256k1_fe_negate(&p_ge.x, &p_ge.x, 1); secp256k1_fe_negate(&p_ge.x, &p_ge.x, 1);
secp256k1_fe_add(&p_ge.x, &dx_over_dz_squared); secp256k1_fe_add(&p_ge.x, &dx_over_dz_squared);
/* y is stored_y/z^3, as we expect */ /* y is stored_y/z^3, as we expect */
secp256k1_ge_from_storage(&last_ge, &pre[i]); secp256k1_fe_mul(&p_ge.y, &p_ge.y, &zi3);
secp256k1_fe_mul(&p_ge.y, &last_ge.y, &zi3);
/* Store */ /* Store */
secp256k1_ge_to_storage(&pre[i], &p_ge); secp256k1_ge_to_storage(&pre[i], &p_ge);
} }