-
Notifications
You must be signed in to change notification settings - Fork 377
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Squashed 'src/secp256k1/' changes from 8ab24e8dad..c6b6b8f1bb
c6b6b8f1bb Merge #830: Rip out non-endomorphism code + dependencies c582abade1 Consistency improvements to the comments 63c6b71616 Reorder comments/function around scalar_split_lambda 2edc514c90 WNAF of lambda_split output has max size 129 4232e5b7da Rip out non-endomorphism code ebad8414b0 Check correctness of lambda split without -DVERIFY fe7fc1fda8 Make lambda constant accessible 9d2f2b44d8 Add tests to exercise lambda split near bounds 9aca2f7f07 Add secp256k1_split_lambda_verify acab934d24 Detailed comments for secp256k1_scalar_split_lambda 76ed922a5f Increase precision of g1 and g2 6173839c90 Switch to our own memcmp function 63150ab4da Merge #827: Rename testrand functions to have test in name c5257aed0b Merge #821: travis: Explicitly set --with-valgrind bb1f54280f Merge #818: Add static assertion that uint32_t is unsigned int or wider a45c1fa63c Rename testrand functions to have test in name 5006895bd6 Merge #808: Exhaustive test improvements + exhaustive schnorrsig tests 4eecb4d6ef travis: VALGRIND->RUN_VALGRIND to avoid confusion with WITH_VALGRIND 66a765c775 travis: Explicitly set --with-valgrind d7838ba6a6 Merge #813: Enable configuring Valgrind support 7ceb0b7611 Merge #819: Enable -Wundef warning 8b7dcdd955 Add exhaustive test for extrakeys and schnorrsig 08d7d89299 Make pubkey parsing test whether points are in the correct subgroup 87af00b511 Abstract out challenge computation in schnorrsig 63e1b2aa7d Disable output buffering in tests_exhaustive.c 39f67dd072 Support splitting exhaustive tests across cores e99b26fcd5 Give exhaustive_tests count and seed cmdline inputs 49e6630bca refactor: move RNG seeding to testrand b110c106fa Change exhaustive test groups so they have a point with X=1 cec7b18a34 Select exhaustive lambda in function of order 78f6cdfaae Make the curve B constant a secp256k1_fe d7f39ae4b6 Delete gej_is_valid_var: unused outside tests 8bcd78cd79 Make secp256k1_scalar_b32 detect overflow in scalar_low c498366e5b Move exhaustive tests for recovery to module be31791543 Make group order purely compile-time in exhaustive tests e73ff30922 Enable -Wundef warning c0041b5cfc Add static assertion that uint32_t is unsigned int or wider 4ad408faf3 Merge #782: Check if variable=yes instead of if var is set in travis.sh 412bf874d0 configure: Allow specifying --with[out]-valgrind explicitly 34debf7a6d Modify .travis.yml to explictly pass no in env vars instead of setting to nothing a0e99fc121 Merge #814: tests: Initialize random group elements fully 5738e8622d tests: Initialize random group elements fully c9939ba55d Merge #812: travis: run bench_schnorrsig a51f2af62b travis: run bench_schnorrsig ef37761fee Change travis.sh to check if variables are equal to yes instead of not-empty. Before this, setting `VALGRIND=wat` was considered as true, and to make it evaluate as false you had to unset the variable `VALGRIND=` but not it checks if `VALGRIND=yes` and if it's not `yes` then it's evaluated to false git-subtree-dir: src/secp256k1 git-subtree-split: c6b6b8f1bb044d7d1aa065ebb674adde98a36a8e
- Loading branch information
Showing
39 changed files
with
1,586 additions
and
947 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| # Define field size and field | ||
| P = 2^256 - 2^32 - 977 | ||
| F = GF(P) | ||
| BETA = F(0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee) | ||
|
|
||
| assert(BETA != F(1) and BETA^3 == F(1)) | ||
|
|
||
| orders_done = set() | ||
| results = {} | ||
| first = True | ||
| for b in range(1, P): | ||
| # There are only 6 curves (up to isomorphism) of the form y^2=x^3+B. Stop once we have tried all. | ||
| if len(orders_done) == 6: | ||
| break | ||
|
|
||
| E = EllipticCurve(F, [0, b]) | ||
| print("Analyzing curve y^2 = x^3 + %i" % b) | ||
| n = E.order() | ||
| # Skip curves with an order we've already tried | ||
| if n in orders_done: | ||
| print("- Isomorphic to earlier curve") | ||
| continue | ||
| orders_done.add(n) | ||
| # Skip curves isomorphic to the real secp256k1 | ||
| if n.is_pseudoprime(): | ||
| print(" - Isomorphic to secp256k1") | ||
| continue | ||
|
|
||
| print("- Finding subgroups") | ||
|
|
||
| # Find what prime subgroups exist | ||
| for f, _ in n.factor(): | ||
| print("- Analyzing subgroup of order %i" % f) | ||
| # Skip subgroups of order >1000 | ||
| if f < 4 or f > 1000: | ||
| print(" - Bad size") | ||
| continue | ||
|
|
||
| # Iterate over X coordinates until we find one that is on the curve, has order f, | ||
| # and for which curve isomorphism exists that maps it to X coordinate 1. | ||
| for x in range(1, P): | ||
| # Skip X coordinates not on the curve, and construct the full point otherwise. | ||
| if not E.is_x_coord(x): | ||
| continue | ||
| G = E.lift_x(F(x)) | ||
|
|
||
| print(" - Analyzing (multiples of) point with X=%i" % x) | ||
|
|
||
| # Skip points whose order is not a multiple of f. Project the point to have | ||
| # order f otherwise. | ||
| if (G.order() % f): | ||
| print(" - Bad order") | ||
| continue | ||
| G = G * (G.order() // f) | ||
|
|
||
| # Find lambda for endomorphism. Skip if none can be found. | ||
| lam = None | ||
| for l in Integers(f)(1).nth_root(3, all=True): | ||
| if int(l)*G == E(BETA*G[0], G[1]): | ||
| lam = int(l) | ||
| break | ||
| if lam is None: | ||
| print(" - No endomorphism for this subgroup") | ||
| break | ||
|
|
||
| # Now look for an isomorphism of the curve that gives this point an X | ||
| # coordinate equal to 1. | ||
| # If (x,y) is on y^2 = x^3 + b, then (a^2*x, a^3*y) is on y^2 = x^3 + a^6*b. | ||
| # So look for m=a^2=1/x. | ||
| m = F(1)/G[0] | ||
| if not m.is_square(): | ||
| print(" - No curve isomorphism maps it to a point with X=1") | ||
| continue | ||
| a = m.sqrt() | ||
| rb = a^6*b | ||
| RE = EllipticCurve(F, [0, rb]) | ||
|
|
||
| # Use as generator twice the image of G under the above isormorphism. | ||
| # This means that generator*(1/2 mod f) will have X coordinate 1. | ||
| RG = RE(1, a^3*G[1]) * 2 | ||
| # And even Y coordinate. | ||
| if int(RG[1]) % 2: | ||
| RG = -RG | ||
| assert(RG.order() == f) | ||
| assert(lam*RG == RE(BETA*RG[0], RG[1])) | ||
|
|
||
| # We have found curve RE:y^2=x^3+rb with generator RG of order f. Remember it | ||
| results[f] = {"b": rb, "G": RG, "lambda": lam} | ||
| print(" - Found solution") | ||
| break | ||
|
|
||
| print("") | ||
|
|
||
| print("") | ||
| print("") | ||
| print("/* To be put in src/group_impl.h: */") | ||
| first = True | ||
| for f in sorted(results.keys()): | ||
| b = results[f]["b"] | ||
| G = results[f]["G"] | ||
| print("# %s EXHAUSTIVE_TEST_ORDER == %i" % ("if" if first else "elif", f)) | ||
| first = False | ||
| print("static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_GE_CONST(") | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x" % tuple((int(G[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8))) | ||
| print(");") | ||
| print("static const secp256k1_fe secp256k1_fe_const_b = SECP256K1_FE_CONST(") | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(b) >> (32 * (7 - i))) & 0xffffffff for i in range(4))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x" % tuple((int(b) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8))) | ||
| print(");") | ||
| print("# else") | ||
| print("# error No known generator for the specified exhaustive test group order.") | ||
| print("# endif") | ||
|
|
||
| print("") | ||
| print("") | ||
| print("/* To be put in src/scalar_impl.h: */") | ||
| first = True | ||
| for f in sorted(results.keys()): | ||
| lam = results[f]["lambda"] | ||
| print("# %s EXHAUSTIVE_TEST_ORDER == %i" % ("if" if first else "elif", f)) | ||
| first = False | ||
| print("# define EXHAUSTIVE_TEST_LAMBDA %i" % lam) | ||
| print("# else") | ||
| print("# error No known lambda for the specified exhaustive test group order.") | ||
| print("# endif") | ||
| print("") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.