Skip to content

Commit be31791

Browse files
sipasipa
committed
Make group order purely compile-time in exhaustive tests
1 parent 4ad408f commit be31791

File tree

1 file changed

+64
-65
lines changed

1 file changed

+64
-65
lines changed

‎src/tests_exhaustive.c‎

Lines changed: 64 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -91,90 +91,90 @@ int secp256k1_nonce_function_smallint(unsigned char *nonce32, const unsigned cha
9191
}
9292

9393
#ifdef USE_ENDOMORPHISM
94-
void test_exhaustive_endomorphism(const secp256k1_ge *group, int order) {
94+
void test_exhaustive_endomorphism(const secp256k1_ge *group) {
9595
int i;
96-
for (i = 0; i < order; i++) {
96+
for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
9797
secp256k1_ge res;
9898
secp256k1_ge_mul_lambda(&res, &group[i]);
9999
ge_equals_ge(&group[i * EXHAUSTIVE_TEST_LAMBDA % EXHAUSTIVE_TEST_ORDER], &res);
100100
}
101101
}
102102
#endif
103103

104-
void test_exhaustive_addition(const secp256k1_ge *group, const secp256k1_gej *groupj, int order) {
104+
void test_exhaustive_addition(const secp256k1_ge *group, const secp256k1_gej *groupj) {
105105
int i, j;
106106

107107
/* Sanity-check (and check infinity functions) */
108108
CHECK(secp256k1_ge_is_infinity(&group[0]));
109109
CHECK(secp256k1_gej_is_infinity(&groupj[0]));
110-
for (i = 1; i < order; i++) {
110+
for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
111111
CHECK(!secp256k1_ge_is_infinity(&group[i]));
112112
CHECK(!secp256k1_gej_is_infinity(&groupj[i]));
113113
}
114114

115115
/* Check all addition formulae */
116-
for (j = 0; j < order; j++) {
116+
for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
117117
secp256k1_fe fe_inv;
118118
secp256k1_fe_inv(&fe_inv, &groupj[j].z);
119-
for (i = 0; i < order; i++) {
119+
for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
120120
secp256k1_ge zless_gej;
121121
secp256k1_gej tmp;
122122
/* add_var */
123123
secp256k1_gej_add_var(&tmp, &groupj[i], &groupj[j], NULL);
124-
ge_equals_gej(&group[(i + j) % order], &tmp);
124+
ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
125125
/* add_ge */
126126
if (j > 0) {
127127
secp256k1_gej_add_ge(&tmp, &groupj[i], &group[j]);
128-
ge_equals_gej(&group[(i + j) % order], &tmp);
128+
ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
129129
}
130130
/* add_ge_var */
131131
secp256k1_gej_add_ge_var(&tmp, &groupj[i], &group[j], NULL);
132-
ge_equals_gej(&group[(i + j) % order], &tmp);
132+
ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
133133
/* add_zinv_var */
134134
zless_gej.infinity = groupj[j].infinity;
135135
zless_gej.x = groupj[j].x;
136136
zless_gej.y = groupj[j].y;
137137
secp256k1_gej_add_zinv_var(&tmp, &groupj[i], &zless_gej, &fe_inv);
138-
ge_equals_gej(&group[(i + j) % order], &tmp);
138+
ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
139139
}
140140
}
141141

142142
/* Check doubling */
143-
for (i = 0; i < order; i++) {
143+
for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
144144
secp256k1_gej tmp;
145145
secp256k1_gej_double(&tmp, &groupj[i]);
146-
ge_equals_gej(&group[(2 * i) % order], &tmp);
146+
ge_equals_gej(&group[(2 * i) % EXHAUSTIVE_TEST_ORDER], &tmp);
147147
secp256k1_gej_double_var(&tmp, &groupj[i], NULL);
148-
ge_equals_gej(&group[(2 * i) % order], &tmp);
148+
ge_equals_gej(&group[(2 * i) % EXHAUSTIVE_TEST_ORDER], &tmp);
149149
}
150150

151151
/* Check negation */
152-
for (i = 1; i < order; i++) {
152+
for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
153153
secp256k1_ge tmp;
154154
secp256k1_gej tmpj;
155155
secp256k1_ge_neg(&tmp, &group[i]);
156-
ge_equals_ge(&group[order - i], &tmp);
156+
ge_equals_ge(&group[EXHAUSTIVE_TEST_ORDER - i], &tmp);
157157
secp256k1_gej_neg(&tmpj, &groupj[i]);
158-
ge_equals_gej(&group[order - i], &tmpj);
158+
ge_equals_gej(&group[EXHAUSTIVE_TEST_ORDER - i], &tmpj);
159159
}
160160
}
161161

162-
void test_exhaustive_ecmult(const secp256k1_context *ctx, const secp256k1_ge *group, const secp256k1_gej *groupj, int order) {
162+
void test_exhaustive_ecmult(const secp256k1_context *ctx, const secp256k1_ge *group, const secp256k1_gej *groupj) {
163163
int i, j, r_log;
164-
for (r_log = 1; r_log < order; r_log++) {
165-
for (j = 0; j < order; j++) {
166-
for (i = 0; i < order; i++) {
164+
for (r_log = 1; r_log < EXHAUSTIVE_TEST_ORDER; r_log++) {
165+
for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
166+
for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
167167
secp256k1_gej tmp;
168168
secp256k1_scalar na, ng;
169169
secp256k1_scalar_set_int(&na, i);
170170
secp256k1_scalar_set_int(&ng, j);
171171

172172
secp256k1_ecmult(&ctx->ecmult_ctx, &tmp, &groupj[r_log], &na, &ng);
173-
ge_equals_gej(&group[(i * r_log + j) % order], &tmp);
173+
ge_equals_gej(&group[(i * r_log + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
174174

175175
if (i > 0) {
176176
secp256k1_ecmult_const(&tmp, &group[i], &ng, 256);
177-
ge_equals_gej(&group[(i * j) % order], &tmp);
177+
ge_equals_gej(&group[(i * j) % EXHAUSTIVE_TEST_ORDER], &tmp);
178178
}
179179
}
180180
}
@@ -193,14 +193,14 @@ static int ecmult_multi_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t
193193
return 1;
194194
}
195195

196-
void test_exhaustive_ecmult_multi(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
196+
void test_exhaustive_ecmult_multi(const secp256k1_context *ctx, const secp256k1_ge *group) {
197197
int i, j, k, x, y;
198198
secp256k1_scratch *scratch = secp256k1_scratch_create(&ctx->error_callback, 4096);
199-
for (i = 0; i < order; i++) {
200-
for (j = 0; j < order; j++) {
201-
for (k = 0; k < order; k++) {
202-
for (x = 0; x < order; x++) {
203-
for (y = 0; y < order; y++) {
199+
for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
200+
for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
201+
for (k = 0; k < EXHAUSTIVE_TEST_ORDER; k++) {
202+
for (x = 0; x < EXHAUSTIVE_TEST_ORDER; x++) {
203+
for (y = 0; y < EXHAUSTIVE_TEST_ORDER; y++) {
204204
secp256k1_gej tmp;
205205
secp256k1_scalar g_sc;
206206
ecmult_multi_data data;
@@ -212,7 +212,7 @@ void test_exhaustive_ecmult_multi(const secp256k1_context *ctx, const secp256k1_
212212
data.pt[1] = group[y];
213213

214214
secp256k1_ecmult_multi_var(&ctx->error_callback, &ctx->ecmult_ctx, scratch, &tmp, &g_sc, ecmult_multi_callback, &data, 2);
215-
ge_equals_gej(&group[(i * x + j * y + k) % order], &tmp);
215+
ge_equals_gej(&group[(i * x + j * y + k) % EXHAUSTIVE_TEST_ORDER], &tmp);
216216
}
217217
}
218218
}
@@ -231,12 +231,12 @@ void r_from_k(secp256k1_scalar *r, const secp256k1_ge *group, int k) {
231231
secp256k1_scalar_set_b32(r, x_bin, NULL);
232232
}
233233

234-
void test_exhaustive_verify(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
234+
void test_exhaustive_verify(const secp256k1_context *ctx, const secp256k1_ge *group) {
235235
int s, r, msg, key;
236-
for (s = 1; s < order; s++) {
237-
for (r = 1; r < order; r++) {
238-
for (msg = 1; msg < order; msg++) {
239-
for (key = 1; key < order; key++) {
236+
for (s = 1; s < EXHAUSTIVE_TEST_ORDER; s++) {
237+
for (r = 1; r < EXHAUSTIVE_TEST_ORDER; r++) {
238+
for (msg = 1; msg < EXHAUSTIVE_TEST_ORDER; msg++) {
239+
for (key = 1; key < EXHAUSTIVE_TEST_ORDER; key++) {
240240
secp256k1_ge nonconst_ge;
241241
secp256k1_ecdsa_signature sig;
242242
secp256k1_pubkey pk;
@@ -254,7 +254,7 @@ void test_exhaustive_verify(const secp256k1_context *ctx, const secp256k1_ge *gr
254254
/* Run through every k value that gives us this r and check that *one* works.
255255
* Note there could be none, there could be multiple, ECDSA is weird. */
256256
should_verify = 0;
257-
for (k = 0; k < order; k++) {
257+
for (k = 0; k < EXHAUSTIVE_TEST_ORDER; k++) {
258258
secp256k1_scalar check_x_s;
259259
r_from_k(&check_x_s, group, k);
260260
if (r_s == check_x_s) {
@@ -281,13 +281,13 @@ void test_exhaustive_verify(const secp256k1_context *ctx, const secp256k1_ge *gr
281281
}
282282
}
283283

284-
void test_exhaustive_sign(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
284+
void test_exhaustive_sign(const secp256k1_context *ctx, const secp256k1_ge *group) {
285285
int i, j, k;
286286

287287
/* Loop */
288-
for (i = 1; i < order; i++) { /* message */
289-
for (j = 1; j < order; j++) { /* key */
290-
for (k = 1; k < order; k++) { /* nonce */
288+
for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) { /* message */
289+
for (j = 1; j < EXHAUSTIVE_TEST_ORDER; j++) { /* key */
290+
for (k = 1; k < EXHAUSTIVE_TEST_ORDER; k++) { /* nonce */
291291
const int starting_k = k;
292292
secp256k1_ecdsa_signature sig;
293293
secp256k1_scalar sk, msg, r, s, expected_r;
@@ -305,8 +305,8 @@ void test_exhaustive_sign(const secp256k1_context *ctx, const secp256k1_ge *grou
305305
* signing. */
306306
r_from_k(&expected_r, group, k);
307307
CHECK(r == expected_r);
308-
CHECK((k * s) % order == (i + r * j) % order ||
309-
(k * (EXHAUSTIVE_TEST_ORDER - s)) % order == (i + r * j) % order);
308+
CHECK((k * s) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER ||
309+
(k * (EXHAUSTIVE_TEST_ORDER - s)) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER);
310310

311311
/* Overflow means we've tried every possible nonce */
312312
if (k < starting_k) {
@@ -327,13 +327,13 @@ void test_exhaustive_sign(const secp256k1_context *ctx, const secp256k1_ge *grou
327327
}
328328

329329
#ifdef ENABLE_MODULE_RECOVERY
330-
void test_exhaustive_recovery_sign(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
330+
void test_exhaustive_recovery_sign(const secp256k1_context *ctx, const secp256k1_ge *group) {
331331
int i, j, k;
332332

333333
/* Loop */
334-
for (i = 1; i < order; i++) { /* message */
335-
for (j = 1; j < order; j++) { /* key */
336-
for (k = 1; k < order; k++) { /* nonce */
334+
for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) { /* message */
335+
for (j = 1; j < EXHAUSTIVE_TEST_ORDER; j++) { /* key */
336+
for (k = 1; k < EXHAUSTIVE_TEST_ORDER; k++) { /* nonce */
337337
const int starting_k = k;
338338
secp256k1_fe r_dot_y_normalized;
339339
secp256k1_ecdsa_recoverable_signature rsig;
@@ -353,8 +353,8 @@ void test_exhaustive_recovery_sign(const secp256k1_context *ctx, const secp256k1
353353
secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, &rsig);
354354
r_from_k(&expected_r, group, k);
355355
CHECK(r == expected_r);
356-
CHECK((k * s) % order == (i + r * j) % order ||
357-
(k * (EXHAUSTIVE_TEST_ORDER - s)) % order == (i + r * j) % order);
356+
CHECK((k * s) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER ||
357+
(k * (EXHAUSTIVE_TEST_ORDER - s)) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER);
358358
/* In computing the recid, there is an overflow condition that is disabled in
359359
* scalar_low_impl.h `secp256k1_scalar_set_b32` because almost every r.y value
360360
* will exceed the group order, and our signing code always holds out for r
@@ -363,7 +363,7 @@ void test_exhaustive_recovery_sign(const secp256k1_context *ctx, const secp256k1
363363
r_dot_y_normalized = group[k].y;
364364
secp256k1_fe_normalize(&r_dot_y_normalized);
365365
/* Also the recovery id is flipped depending if we hit the low-s branch */
366-
if ((k * s) % order == (i + r * j) % order) {
366+
if ((k * s) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER) {
367367
expected_recid = secp256k1_fe_is_odd(&r_dot_y_normalized) ? 1 : 0;
368368
} else {
369369
expected_recid = secp256k1_fe_is_odd(&r_dot_y_normalized) ? 0 : 1;
@@ -378,8 +378,8 @@ void test_exhaustive_recovery_sign(const secp256k1_context *ctx, const secp256k1
378378
* signing. */
379379
r_from_k(&expected_r, group, k);
380380
CHECK(r == expected_r);
381-
CHECK((k * s) % order == (i + r * j) % order ||
382-
(k * (EXHAUSTIVE_TEST_ORDER - s)) % order == (i + r * j) % order);
381+
CHECK((k * s) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER ||
382+
(k * (EXHAUSTIVE_TEST_ORDER - s)) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER);
383383

384384
/* Overflow means we've tried every possible nonce */
385385
if (k < starting_k) {
@@ -390,13 +390,13 @@ void test_exhaustive_recovery_sign(const secp256k1_context *ctx, const secp256k1
390390
}
391391
}
392392

393-
void test_exhaustive_recovery_verify(const secp256k1_context *ctx, const secp256k1_ge *group, int order) {
393+
void test_exhaustive_recovery_verify(const secp256k1_context *ctx, const secp256k1_ge *group) {
394394
/* This is essentially a copy of test_exhaustive_verify, with recovery added */
395395
int s, r, msg, key;
396-
for (s = 1; s < order; s++) {
397-
for (r = 1; r < order; r++) {
398-
for (msg = 1; msg < order; msg++) {
399-
for (key = 1; key < order; key++) {
396+
for (s = 1; s < EXHAUSTIVE_TEST_ORDER; s++) {
397+
for (r = 1; r < EXHAUSTIVE_TEST_ORDER; r++) {
398+
for (msg = 1; msg < EXHAUSTIVE_TEST_ORDER; msg++) {
399+
for (key = 1; key < EXHAUSTIVE_TEST_ORDER; key++) {
400400
secp256k1_ge nonconst_ge;
401401
secp256k1_ecdsa_recoverable_signature rsig;
402402
secp256k1_ecdsa_signature sig;
@@ -417,7 +417,7 @@ void test_exhaustive_recovery_verify(const secp256k1_context *ctx, const secp256
417417
/* Run through every k value that gives us this r and check that *one* works.
418418
* Note there could be none, there could be multiple, ECDSA is weird. */
419419
should_verify = 0;
420-
for (k = 0; k < order; k++) {
420+
for (k = 0; k < EXHAUSTIVE_TEST_ORDER; k++) {
421421
secp256k1_scalar check_x_s;
422422
r_from_k(&check_x_s, group, k);
423423
if (r_s == check_x_s) {
@@ -491,20 +491,19 @@ int main(void) {
491491

492492
/* Run the tests */
493493
#ifdef USE_ENDOMORPHISM
494-
test_exhaustive_endomorphism(group, EXHAUSTIVE_TEST_ORDER);
494+
test_exhaustive_endomorphism(group);
495495
#endif
496-
test_exhaustive_addition(group, groupj, EXHAUSTIVE_TEST_ORDER);
497-
test_exhaustive_ecmult(ctx, group, groupj, EXHAUSTIVE_TEST_ORDER);
498-
test_exhaustive_ecmult_multi(ctx, group, EXHAUSTIVE_TEST_ORDER);
499-
test_exhaustive_sign(ctx, group, EXHAUSTIVE_TEST_ORDER);
500-
test_exhaustive_verify(ctx, group, EXHAUSTIVE_TEST_ORDER);
496+
test_exhaustive_addition(group, groupj);
497+
test_exhaustive_ecmult(ctx, group, groupj);
498+
test_exhaustive_ecmult_multi(ctx, group);
499+
test_exhaustive_sign(ctx, group);
500+
test_exhaustive_verify(ctx, group);
501501

502502
#ifdef ENABLE_MODULE_RECOVERY
503-
test_exhaustive_recovery_sign(ctx, group, EXHAUSTIVE_TEST_ORDER);
504-
test_exhaustive_recovery_verify(ctx, group, EXHAUSTIVE_TEST_ORDER);
503+
test_exhaustive_recovery_sign(ctx, group);
504+
test_exhaustive_recovery_verify(ctx, group);
505505
#endif
506506

507507
secp256k1_context_destroy(ctx);
508508
return 0;
509509
}
510-

0 commit comments

Comments
 (0)