frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,528 Commits 14 Branches 0 Tags
Commit Graph

33 Commits

Author SHA1 Message Date
Pieter Wuille
5437e7bdfb Remove unused scalar_sqr 2021-03-12 10:06:18 -08:00
Pieter Wuille
1e0e885c8a Make field/scalar code use the new modinv modules for inverses 2021-03-12 10:06:14 -08:00
Pieter Wuille
aa404d53be Move secp256k1_scalar_{inverse{_var},is_even} to per-impl files 
This temporarily duplicates the inversion code across the 4x64 and 8x32
implementations. Those implementations will be replaced in a later commit.
 2021-03-11 10:25:26 -08:00
Dimitris Apostolou
07aa4c70ff
Fix insecure links 2020-12-18 00:24:22 +02:00
Pieter Wuille
4232e5b7da Rip out non-endomorphism code 2020-10-13 11:31:13 -07:00
Russell O'Connor
acab934d24 Detailed comments for secp256k1_scalar_split_lambda 2020-10-13 11:31:13 -07:00
Tim Ruffing
5b196338f0 Remove redundant "? 1 : 0" after comparisons in scalar code 
This prevents GCC from generating branches on PowerPC in certain
cases.

Fixes #771.
 2020-07-26 14:59:56 +02:00
Elichai Turkel
f79a7adcf5
Add valgrind uninit check to cmovs output 2020-05-26 23:30:56 +03:00
Gregory Maxwell
34a67c773b Eliminate harmless non-constant time operations on secret data. 
There were several places where the code was non-constant time
 for invalid secret inputs.  These are harmless under sane use
 but get in the way of automatic const-time validation.

(Nonce overflow in signing is not addressed, nor is s==0 in
 signing)
 2020-02-20 17:27:03 +00:00
Gregory Maxwell
d58bc93f2c Switch x86_64 asm to use "i" instead of "n" for immediate values. 
The constraint "n" is a more obscure setting which is needed for
 special cases that don't apply to our use.

Use of "n" exposed some bugs in pre-release versions of clang.
This fixes #594
 2019-03-10 22:52:12 +00:00
Dan Raviv
abe2d3e84b Fix header guards using reserved identifiers 
Identifiers starting with an underscore and followed immediately by a capital letter are reserved by the C++ standard.

The only header guards not fixed are those in the headers auto-generated from java.
 2017-08-26 18:44:21 +03:00
Alex-GR
9d67afad96 Update scalar_4x64_impl.h 
XOR reg,reg instead of MOV 0 to reg. It should be at least equal in all architectures and faster in some else.
 2016-10-09 00:16:50 +03:00
Gregory Maxwell
9f6993f370 Remove some dead code. 2015-09-28 05:43:51 +00:00
Gregory Maxwell
cfe0ed916a Fix miscellaneous style nits that irritate overactive static analysis. 
Also increase consistency with how overflow && zero is tested, and
 avoid some mixed declarations and code that GCC wasn't detecting.
 2015-09-24 08:42:37 +00:00
Pieter Wuille
dd891e0ed5 Get rid of _t as it is POSIX reserved 2015-09-21 21:03:37 +02:00
Andrew Poelstra
ed35d43a0c Make secp256k1_scalar_add_bit conditional; make secp256k1_scalar_split_lambda_var constant time 
This has the effect of making `secp256k1_scalar_mul_shift_var` constant
time in both input scalars. Keep the _var name because it is NOT constant
time in the shift amount.

As used in `secp256k1_scalar_split_lambda_var`, the shift is always
the constant 272, so this function becomes constant time, and it
loses the `_var` suffix.
 2015-08-01 10:57:36 -05:00
Andrew Poelstra
4401500060 Add constant-time multiply secp256k1_ecmult_const for ECDH 
Designed with clear separation of the wNAF conversion, precomputation
and exponentiation (since the precomp at least we will probably want
to separate in the API for users who reuse points a lot.

Future work:
  - actually separate precomp in the API
  - do multiexp rather than single exponentiation
 2015-07-31 12:39:09 -05:00
Pieter Wuille
ffccfd2d00 x86_64 assembly optimization for scalar_4x64 2015-02-06 11:32:46 -08:00
Gregory Maxwell
4be8d6fc42 Centralize the definition of uint128_t and use it uniformly. 
This needs to be renamed along with the other _t types, because _t
 is reserved.  But that will be done later.
 2015-01-25 05:10:40 +00:00
Gregory Maxwell
d9543c904f Switch scalar code to C89. 2015-01-25 05:09:57 +00:00
Pieter Wuille
4d879a3a66
Merge pull request #134 
29ae131 Make scalar_add_bit test's overflow detection exact (Pieter Wuille)
 2014-12-04 12:21:06 +01:00
Pieter Wuille
d5e8362ae5
Merge pull request #127 
c35ff1e Convert lambda splitter to pure scalar code. (Pieter Wuille)
cc604e9 Avoid division when decomposing scalars (Peter Dettman)
ff8746d Add secp256k1_scalar_mul_shift_var (Pieter Wuille)
 2014-12-03 21:22:57 +01:00
Pieter Wuille
29ae1310ce Make scalar_add_bit test's overflow detection exact 2014-12-03 18:54:01 +01:00
Pieter Wuille
9048def7c7 Avoid undefined shift behaviour 2014-12-03 18:10:52 +01:00
Pieter Wuille
ff8746d457 Add secp256k1_scalar_mul_shift_var 2014-12-02 16:50:00 +01:00
Pieter Wuille
f24041d6aa Switch all EC/ECDSA logic from num to scalar 2014-11-30 23:38:01 +01:00
Pieter Wuille
6794be6080 Add scalar splitting functions 
Which currently delegate to the lambda-splitter in group.
 2014-11-30 23:38:01 +01:00
Pieter Wuille
1e6c77c321 Generalize secp256k1_scalar_get_bits 2014-11-30 23:38:01 +01:00
Pieter Wuille
5213207856 Add secp256k1_scalar_add_bit 2014-11-30 23:37:58 +01:00
Gregory Maxwell
71712b27e5 Switch to C89 comments in prep for making the whole codebase C89 compatible. 
This should be whitespace/comment only changes and should produce the same
object code.
 2014-11-15 07:33:07 -08:00
Gregory Maxwell
850562e3f1 Avoid unsigned comparison in scalar arith. 2014-11-12 15:47:12 -08:00
Gregory Maxwell
a4a43d7543 Reorder static to comply with C99 and switch to the inline macro. 2014-11-12 13:07:55 -08:00
Pieter Wuille
1d52a8b155 Implementations for scalar without data-dependent branches. 2014-11-04 03:01:55 -08:00