Skip to content

Commit ea1225b

Browse files
siv2rsiv2r
committed
field: remove secp256k1_fe_equal_var
`secp256k1_fe_equal_var` was removed since it hits a fast path only when the inputs are unequal. This unequal inputs condition is not common among its callers (public key parsing, ECDSA verify).
1 parent d40ea5f commit ea1225b

File tree

7 files changed

+31
-44
lines changed

7 files changed

+31
-44
lines changed

‎src/field.h‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,12 @@ static int secp256k1_fe_is_zero(const secp256k1_fe *a);
6464
/** Check the "oddness" of a field element. Requires the input to be normalized. */
6565
static int secp256k1_fe_is_odd(const secp256k1_fe *a);
6666

67-
/** Compare two field elements. Requires the first input to have magnitude equal to 1. */
67+
/** Compare two field elements. Requires the first input to have magnitude equal to 1.
68+
* The variable time counterpart of this function `secp256k1_fe_equal_var` was removed
69+
* since it hits fast path only when the inputs are unequal. This unequal inputs
70+
* condition is not common among its callers (public key parsing, ECDSA verify). */
6871
static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b);
6972

70-
/** Same as secp256k1_fe_equal, but may be variable time.
71-
* Requires the first input to have magnitude equal to 1. */
72-
static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b);
73-
7473
/** Compare two field elements. Requires both inputs to be normalized */
7574
static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b);
7675

‎src/field_impl.h‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,18 +33,6 @@ SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp
3333
return secp256k1_fe_normalizes_to_zero(&na);
3434
}
3535

36-
SECP256K1_INLINE static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b) {
37-
secp256k1_fe na;
38-
#ifdef VERIFY
39-
VERIFY_CHECK(a->magnitude == 1);
40-
secp256k1_fe_verify(a);
41-
secp256k1_fe_verify(b);
42-
#endif
43-
secp256k1_fe_negate(&na, a, 1);
44-
secp256k1_fe_add(&na, b);
45-
return secp256k1_fe_normalizes_to_zero_var(&na);
46-
}
47-
4836
static int secp256k1_fe_sqrt(secp256k1_fe *r, const secp256k1_fe * SECP256K1_RESTRICT a) {
4937
/** Given that p is congruent to 3 mod 4, we can compute the square root of
5038
* a mod p as the (p+1)/4'th power of a.

‎src/group_impl.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a)
242242
VERIFY_CHECK(!a->infinity);
243243
secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
244244
r2 = a->x;
245-
return secp256k1_fe_equal_var(&r, &r2);
245+
return secp256k1_fe_equal(&r, &r2);
246246
}
247247

248248
static void secp256k1_gej_neg(secp256k1_gej *r, const secp256k1_gej *a) {
@@ -267,7 +267,7 @@ static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
267267
secp256k1_fe_sqr(&y2, &a->y);
268268
secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
269269
secp256k1_fe_add(&x3, &secp256k1_fe_const_b);
270-
return secp256k1_fe_equal_var(&y2, &x3);
270+
return secp256k1_fe_equal(&y2, &x3);
271271
}
272272

273273
static SECP256K1_INLINE void secp256k1_gej_double(secp256k1_gej *r, const secp256k1_gej *a) {

‎src/modules/extrakeys/tests_exhaustive_impl.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ static void test_exhaustive_extrakeys(const secp256k1_context *ctx, const secp25
4848

4949
/* Compare the xonly_pubkey bytes against the precomputed group. */
5050
secp256k1_fe_set_b32(&fe, xonly_pubkey_bytes[i - 1]);
51-
CHECK(secp256k1_fe_equal_var(&fe, &group[i].x));
51+
CHECK(secp256k1_fe_equal(&fe, &group[i].x));
5252

5353
/* Check the parity against the precomputed group. */
5454
fe = group[i].y;

‎src/modules/schnorrsig/main_impl.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -257,7 +257,7 @@ int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned cha
257257

258258
secp256k1_fe_normalize_var(&r.y);
259259
return !secp256k1_fe_is_odd(&r.y) &&
260-
secp256k1_fe_equal_var(&rx, &r.x);
260+
secp256k1_fe_equal(&rx, &r.x);
261261
}
262262

263263
#endif

‎src/tests.c‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2424,7 +2424,7 @@ int check_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
24242424
secp256k1_fe bn = *b;
24252425
secp256k1_fe_normalize_weak(&an);
24262426
secp256k1_fe_normalize_var(&bn);
2427-
return secp256k1_fe_equal_var(&an, &bn);
2427+
return secp256k1_fe_equal(&an, &bn);
24282428
}
24292429

24302430
void run_field_convert(void) {
@@ -2447,9 +2447,9 @@ void run_field_convert(void) {
24472447
secp256k1_fe_storage fes2;
24482448
/* Check conversions to fe. */
24492449
CHECK(secp256k1_fe_set_b32(&fe2, b32));
2450-
CHECK(secp256k1_fe_equal_var(&fe, &fe2));
2450+
CHECK(secp256k1_fe_equal(&fe, &fe2));
24512451
secp256k1_fe_from_storage(&fe2, &fes);
2452-
CHECK(secp256k1_fe_equal_var(&fe, &fe2));
2452+
CHECK(secp256k1_fe_equal(&fe, &fe2));
24532453
/* Check conversion from fe. */
24542454
secp256k1_fe_get_b32(b322, &fe);
24552455
CHECK(secp256k1_memcmp_var(b322, b32, 32) == 0);
@@ -2482,7 +2482,7 @@ void run_field_misc(void) {
24822482
random_fe_non_zero(&y);
24832483
/* Test the fe equality and comparison operations. */
24842484
CHECK(secp256k1_fe_cmp_var(&x, &x) == 0);
2485-
CHECK(secp256k1_fe_equal_var(&x, &x));
2485+
CHECK(secp256k1_fe_equal(&x, &x));
24862486
z = x;
24872487
secp256k1_fe_add(&z,&y);
24882488
/* Test fe conditional move; z is not normalized here. */
@@ -2501,7 +2501,7 @@ void run_field_misc(void) {
25012501
CHECK(fe_identical(&q, &z));
25022502
secp256k1_fe_normalize_var(&x);
25032503
secp256k1_fe_normalize_var(&z);
2504-
CHECK(!secp256k1_fe_equal_var(&x, &z));
2504+
CHECK(!secp256k1_fe_equal(&x, &z));
25052505
secp256k1_fe_normalize_var(&q);
25062506
secp256k1_fe_cmov(&q, &z, (i&1));
25072507
#ifdef VERIFY
@@ -2996,8 +2996,8 @@ void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
29962996
if (a->infinity) {
29972997
return;
29982998
}
2999-
CHECK(secp256k1_fe_equal_var(&a->x, &b->x));
3000-
CHECK(secp256k1_fe_equal_var(&a->y, &b->y));
2999+
CHECK(secp256k1_fe_equal(&a->x, &b->x));
3000+
CHECK(secp256k1_fe_equal(&a->y, &b->y));
30013001
}
30023002

30033003
/* This compares jacobian points including their Z, not just their geometric meaning. */
@@ -3035,8 +3035,8 @@ void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
30353035
u2 = b->x;
30363036
secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
30373037
s2 = b->y;
3038-
CHECK(secp256k1_fe_equal_var(&u1, &u2));
3039-
CHECK(secp256k1_fe_equal_var(&s1, &s2));
3038+
CHECK(secp256k1_fe_equal(&u1, &u2));
3039+
CHECK(secp256k1_fe_equal(&s1, &s2));
30403040
}
30413041

30423042
void test_ge(void) {
@@ -3103,7 +3103,7 @@ void test_ge(void) {
31033103
/* Check Z ratio. */
31043104
if (!secp256k1_gej_is_infinity(&gej[i1]) && !secp256k1_gej_is_infinity(&refj)) {
31053105
secp256k1_fe zrz; secp256k1_fe_mul(&zrz, &zr, &gej[i1].z);
3106-
CHECK(secp256k1_fe_equal_var(&zrz, &refj.z));
3106+
CHECK(secp256k1_fe_equal(&zrz, &refj.z));
31073107
}
31083108
secp256k1_ge_set_gej_var(&ref, &refj);
31093109

@@ -3112,7 +3112,7 @@ void test_ge(void) {
31123112
ge_equals_gej(&ref, &resj);
31133113
if (!secp256k1_gej_is_infinity(&gej[i1]) && !secp256k1_gej_is_infinity(&resj)) {
31143114
secp256k1_fe zrz; secp256k1_fe_mul(&zrz, &zr, &gej[i1].z);
3115-
CHECK(secp256k1_fe_equal_var(&zrz, &resj.z));
3115+
CHECK(secp256k1_fe_equal(&zrz, &resj.z));
31163116
}
31173117

31183118
/* Test gej + ge (var, with additional Z factor). */
@@ -3141,7 +3141,7 @@ void test_ge(void) {
31413141
ge_equals_gej(&ref, &resj);
31423142
/* Check Z ratio. */
31433143
secp256k1_fe_mul(&zr2, &zr2, &gej[i1].z);
3144-
CHECK(secp256k1_fe_equal_var(&zr2, &resj.z));
3144+
CHECK(secp256k1_fe_equal(&zr2, &resj.z));
31453145
/* Normal doubling. */
31463146
secp256k1_gej_double_var(&resj, &gej[i2], NULL);
31473147
ge_equals_gej(&ref, &resj);
@@ -3436,8 +3436,8 @@ void test_group_decompress(const secp256k1_fe* x) {
34363436
CHECK(!ge_odd.infinity);
34373437

34383438
/* Check that the x coordinates check out. */
3439-
CHECK(secp256k1_fe_equal_var(&ge_even.x, x));
3440-
CHECK(secp256k1_fe_equal_var(&ge_odd.x, x));
3439+
CHECK(secp256k1_fe_equal(&ge_even.x, x));
3440+
CHECK(secp256k1_fe_equal(&ge_odd.x, x));
34413441

34423442
/* Check odd/even Y in ge_odd, ge_even. */
34433443
CHECK(secp256k1_fe_is_odd(&ge_odd.y));
@@ -3495,12 +3495,12 @@ void test_pre_g_table(const secp256k1_ge_storage * pre_g, size_t n) {
34953495
CHECK(!secp256k1_fe_normalizes_to_zero_var(&dqx) || !secp256k1_fe_normalizes_to_zero_var(&dqy));
34963496

34973497
/* Check that -q is not equal to p */
3498-
CHECK(!secp256k1_fe_equal_var(&dpx, &dqx) || !secp256k1_fe_equal_var(&dpy, &dqy));
3498+
CHECK(!secp256k1_fe_equal(&dpx, &dqx) || !secp256k1_fe_equal(&dpy, &dqy));
34993499

35003500
/* Check that p, -q and gg are colinear */
35013501
secp256k1_fe_mul(&dpx, &dpx, &dqy);
35023502
secp256k1_fe_mul(&dpy, &dpy, &dqx);
3503-
CHECK(secp256k1_fe_equal_var(&dpx, &dpy));
3503+
CHECK(secp256k1_fe_equal(&dpx, &dpy));
35043504

35053505
p = q;
35063506
}
@@ -3727,7 +3727,7 @@ void run_point_times_order(void) {
37273727
secp256k1_fe_sqr(&x, &x);
37283728
}
37293729
secp256k1_fe_normalize_var(&x);
3730-
CHECK(secp256k1_fe_equal_var(&x, &xr));
3730+
CHECK(secp256k1_fe_equal(&x, &xr));
37313731
}
37323732

37333733
void ecmult_const_random_mult(void) {

‎src/tests_exhaustive.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
3333
if (a->infinity) {
3434
return;
3535
}
36-
CHECK(secp256k1_fe_equal_var(&a->x, &b->x));
37-
CHECK(secp256k1_fe_equal_var(&a->y, &b->y));
36+
CHECK(secp256k1_fe_equal(&a->x, &b->x));
37+
CHECK(secp256k1_fe_equal(&a->y, &b->y));
3838
}
3939

4040
void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
@@ -50,8 +50,8 @@ void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
5050
u2 = b->x; secp256k1_fe_normalize_weak(&u2);
5151
secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
5252
s2 = b->y; secp256k1_fe_normalize_weak(&s2);
53-
CHECK(secp256k1_fe_equal_var(&u1, &u2));
54-
CHECK(secp256k1_fe_equal_var(&s1, &s2));
53+
CHECK(secp256k1_fe_equal(&u1, &u2));
54+
CHECK(secp256k1_fe_equal(&s1, &s2));
5555
}
5656

5757
void random_fe(secp256k1_fe *x) {
@@ -426,8 +426,8 @@ int main(int argc, char** argv) {
426426

427427
CHECK(group[i].infinity == 0);
428428
CHECK(generated.infinity == 0);
429-
CHECK(secp256k1_fe_equal_var(&generated.x, &group[i].x));
430-
CHECK(secp256k1_fe_equal_var(&generated.y, &group[i].y));
429+
CHECK(secp256k1_fe_equal(&generated.x, &group[i].x));
430+
CHECK(secp256k1_fe_equal(&generated.y, &group[i].y));
431431
}
432432
}
433433

0 commit comments

Comments
 (0)