Skip to content

Commit b3b57ad

Browse files
roconnor-blockstreamroconnor-blockstream
committed
Eliminate the pre_a_lam array from ecmult_strauss_wnaf.
1 parent ae7ba0f commit b3b57ad

File tree

3 files changed

+41
-30
lines changed

3 files changed

+41
-30
lines changed

‎src/ecmult_impl.h‎

Lines changed: 36 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -114,19 +114,29 @@ static void secp256k1_ecmult_odd_multiples_table(int n, secp256k1_ge *pre_a, sec
114114
secp256k1_fe_mul(z, &ai.z, &d.z);
115115
}
116116

117-
/** The following two macro retrieves a particular odd multiple from a table
118-
* of precomputed multiples. */
119-
#define ECMULT_TABLE_GET_GE(r,pre,n,w) do { \
120-
VERIFY_CHECK(((n) & 1) == 1); \
121-
VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \
122-
VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \
123-
if ((n) > 0) { \
124-
*(r) = (pre)[((n)-1)/2]; \
125-
} else { \
126-
*(r) = (pre)[(-(n)-1)/2]; \
127-
secp256k1_fe_negate(&((r)->y), &((r)->y), 1); \
128-
} \
129-
} while(0)
117+
SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge(secp256k1_ge *r, const secp256k1_ge *pre, int n, int w) {
118+
VERIFY_CHECK((n & 1) == 1);
119+
VERIFY_CHECK(n >= -((1 << (w-1)) - 1));
120+
VERIFY_CHECK(n <= ((1 << (w-1)) - 1));
121+
if (n > 0) {
122+
*r = pre[(n-1)/2];
123+
} else {
124+
*r = pre[(-n-1)/2];
125+
secp256k1_fe_negate(&(r->y), &(r->y), 1);
126+
}
127+
}
128+
129+
SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge_lambda(secp256k1_ge *r, const secp256k1_ge *pre, const secp256k1_fe *x, int n, int w) {
130+
VERIFY_CHECK((n & 1) == 1);
131+
VERIFY_CHECK(n >= -((1 << (w-1)) - 1));
132+
VERIFY_CHECK(n <= ((1 << (w-1)) - 1));
133+
if (n > 0) {
134+
secp256k1_ge_set_xy(r, &x[(n-1)/2], &pre[(n-1)/2].y);
135+
} else {
136+
secp256k1_ge_set_xy(r, &x[(-n-1)/2], &pre[(-n-1)/2].y);
137+
secp256k1_fe_negate(&(r->y), &(r->y), 1);
138+
}
139+
}
130140

131141
#define ECMULT_TABLE_GET_GE_STORAGE(r,pre,n,w) do { \
132142
VERIFY_CHECK(((n) & 1) == 1); \
@@ -209,7 +219,8 @@ struct secp256k1_strauss_point_state {
209219
};
210220

211221
struct secp256k1_strauss_state {
212-
secp256k1_fe* zr;
222+
/* aux is used to hold z-ratios, and then used to hold pre_a[i].x * BETA values. */
223+
secp256k1_fe* aux;
213224
secp256k1_ge* pre_a;
214225
secp256k1_ge* pre_a_lam;
215226
struct secp256k1_strauss_point_state* ps;
@@ -263,25 +274,25 @@ static void secp256k1_ecmult_strauss_wnaf(const struct secp256k1_strauss_state *
263274
*/
264275
if (no > 0) {
265276
/* Compute the odd multiples in Jacobian form. */
266-
secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a, state->zr, &Z, &a[state->ps[0].input_pos]);
277+
secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a, state->aux, &Z, &a[state->ps[0].input_pos]);
267278
for (np = 1; np < no; ++np) {
268279
secp256k1_gej tmp = a[state->ps[np].input_pos];
269280
#ifdef VERIFY
270281
secp256k1_fe_normalize_var(&Z);
271282
#endif
272283
secp256k1_gej_rescale(&tmp, &Z);
273-
secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->zr + np * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
274-
secp256k1_fe_mul(state->zr + np * ECMULT_TABLE_SIZE(WINDOW_A), state->zr + np * ECMULT_TABLE_SIZE(WINDOW_A), &(a[state->ps[np].input_pos].z));
284+
secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
285+
secp256k1_fe_mul(state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), &(a[state->ps[np].input_pos].z));
275286
}
276287
/* Bring them to the same Z denominator. */
277-
secp256k1_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A) * no, state->pre_a, state->zr);
288+
secp256k1_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A) * no, state->pre_a, state->aux);
278289
} else {
279290
secp256k1_fe_set_int(&Z, 1);
280291
}
281292

282293
for (np = 0; np < no; ++np) {
283294
for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
284-
secp256k1_ge_mul_lambda(&state->pre_a_lam[np * ECMULT_TABLE_SIZE(WINDOW_A) + i], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + i]);
295+
secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + i], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + i].x, &secp256k1_const_beta);
285296
}
286297
}
287298

@@ -307,11 +318,11 @@ static void secp256k1_ecmult_strauss_wnaf(const struct secp256k1_strauss_state *
307318
secp256k1_gej_double_var(r, r, NULL);
308319
for (np = 0; np < no; ++np) {
309320
if (i < state->ps[np].bits_na_1 && (n = state->ps[np].wnaf_na_1[i])) {
310-
ECMULT_TABLE_GET_GE(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
321+
secp256k1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
311322
secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
312323
}
313324
if (i < state->ps[np].bits_na_lam && (n = state->ps[np].wnaf_na_lam[i])) {
314-
ECMULT_TABLE_GET_GE(&tmpa, state->pre_a_lam + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
325+
secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
315326
secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
316327
}
317328
}
@@ -331,13 +342,13 @@ static void secp256k1_ecmult_strauss_wnaf(const struct secp256k1_strauss_state *
331342
}
332343

333344
static void secp256k1_ecmult(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
334-
secp256k1_fe zr[ECMULT_TABLE_SIZE(WINDOW_A)];
345+
secp256k1_fe aux[ECMULT_TABLE_SIZE(WINDOW_A)];
335346
secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
336347
struct secp256k1_strauss_point_state ps[1];
337348
secp256k1_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];
338349
struct secp256k1_strauss_state state;
339350

340-
state.zr = zr;
351+
state.aux = aux;
341352
state.pre_a = pre_a;
342353
state.pre_a_lam = pre_a_lam;
343354
state.ps = ps;
@@ -366,12 +377,12 @@ static int secp256k1_ecmult_strauss_batch(const secp256k1_callback* error_callba
366377
* constant and strauss_scratch_size accordingly. */
367378
points = (secp256k1_gej*)secp256k1_scratch_alloc(error_callback, scratch, n_points * sizeof(secp256k1_gej));
368379
scalars = (secp256k1_scalar*)secp256k1_scratch_alloc(error_callback, scratch, n_points * sizeof(secp256k1_scalar));
369-
state.zr = (secp256k1_fe*)secp256k1_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(secp256k1_fe));
380+
state.aux = (secp256k1_fe*)secp256k1_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(secp256k1_fe));
370381
state.pre_a = (secp256k1_ge*)secp256k1_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(secp256k1_ge));
371382
state.pre_a_lam = (secp256k1_ge*)secp256k1_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(secp256k1_ge));
372383
state.ps = (struct secp256k1_strauss_point_state*)secp256k1_scratch_alloc(error_callback, scratch, n_points * sizeof(struct secp256k1_strauss_point_state));
373384

374-
if (points == NULL || scalars == NULL || state.zr == NULL || state.pre_a == NULL || state.pre_a_lam == NULL || state.ps == NULL) {
385+
if (points == NULL || scalars == NULL || state.aux == NULL || state.pre_a == NULL || state.pre_a_lam == NULL || state.ps == NULL) {
375386
secp256k1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
376387
return 0;
377388
}

‎src/field.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@
3333
#endif
3434

3535
static const secp256k1_fe secp256k1_fe_one = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
36+
static const secp256k1_fe secp256k1_const_beta = SECP256K1_FE_CONST(
37+
0x7ae96a2bul, 0x657c0710ul, 0x6e64479eul, 0xac3434e9ul,
38+
0x9cf04975ul, 0x12f58995ul, 0xc1396c28ul, 0x719501eeul
39+
);
3640

3741
/** Normalize a field element. This brings the field element to a canonical representation, reduces
3842
* its magnitude to 1, and reduces it modulo field size `p`.

‎src/group_impl.h‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -654,12 +654,8 @@ static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r,
654654
}
655655

656656
static void secp256k1_ge_mul_lambda(secp256k1_ge *r, const secp256k1_ge *a) {
657-
static const secp256k1_fe beta = SECP256K1_FE_CONST(
658-
0x7ae96a2bul, 0x657c0710ul, 0x6e64479eul, 0xac3434e9ul,
659-
0x9cf04975ul, 0x12f58995ul, 0xc1396c28ul, 0x719501eeul
660-
);
661657
*r = *a;
662-
secp256k1_fe_mul(&r->x, &r->x, &beta);
658+
secp256k1_fe_mul(&r->x, &r->x, &secp256k1_const_beta);
663659
}
664660

665661
static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge) {

0 commit comments

Comments
 (0)