status-im
/
secp256k1
mirror of https://github.com/status-im/secp256k1.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Don't touch leading zeros in wnaf_fixed.

This commit is contained in:
Jonas Nick 2018-03-22 21:32:11 +00:00
parent 9e36d1bfe2
commit ec0a7b3ae3
2 changed files with 72 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
src/ecmult_impl.h
View File

@ -567,7 +567,9 @@ static size_t secp256k1_strauss_max_points(secp256k1_scratch *scratch) {
*/
static int secp256k1_wnaf_fixed(int *wnaf, const secp256k1_scalar *s, int w) {
int skew = 0;
int pos = 1;
int pos;
int max_pos;
int last_w;
const secp256k1_scalar *work = s;
if (secp256k1_scalar_is_zero(s)) {
@ -582,14 +584,24 @@ static int secp256k1_wnaf_fixed(int *wnaf, const secp256k1_scalar *s, int w) {
}
wnaf[0] = secp256k1_scalar_get_bits_var(work, 0, w) + skew;
/* Compute last window size. Relevant when window size doesn't divide the
* number of bits in the scalar */
last_w = WNAF_BITS - (WNAF_SIZE(w) - 1) * w;
while (pos * w < WNAF_BITS) {
int now = w;
int val;
if (now + pos * w > WNAF_BITS) {
now = WNAF_BITS - pos * w;
/* Store the position of the first nonzero word in max_pos to allow
* skipping leading zeros when calculating the wnaf. */
for (pos = WNAF_SIZE(w) - 1; pos > 0; pos--) {
int val = secp256k1_scalar_get_bits_var(work, pos * w, pos == WNAF_SIZE(w)-1 ? last_w : w);
if(val != 0) {
break;
}
val = secp256k1_scalar_get_bits_var(work, pos * w, now);
wnaf[pos] = 0;
}
max_pos = pos;
pos = 1;
while (pos <= max_pos) {
int val = secp256k1_scalar_get_bits_var(work, pos * w, pos == WNAF_SIZE(w)-1 ? last_w : w);
if ((val & 1) == 0) {
wnaf[pos - 1] -= (1 << w);
wnaf[pos] = (val + 1);
@ -611,7 +623,6 @@ static int secp256k1_wnaf_fixed(int *wnaf, const secp256k1_scalar *s, int w) {
}
++pos;
}
VERIFY_CHECK(pos == WNAF_SIZE(w));
return skew;
}

56
src/tests.c
View File

@ -3040,7 +3040,20 @@ void test_fixed_wnaf(const secp256k1_scalar *number, int w) {
CHECK(secp256k1_scalar_eq(&x, &num));
}
void test_fixed_wnaf_zero(int w) {
/* Checks that the first 8 elements of wnaf are equal to wnaf_expected and the
* rest is 0.*/
void test_fixed_wnaf_small_helper(int *wnaf, int *wnaf_expected, int w) {
int i;
for (i = WNAF_SIZE(w)-1; i >= 8; --i) {
CHECK(wnaf[i] == 0);
}
for (i = 7; i >= 0; --i) {
CHECK(wnaf[i] == wnaf_expected[i]);
}
}
void test_fixed_wnaf_small(void) {
int w = 4;
int wnaf[256] = {0};
int i;
int skew;
@ -3048,12 +3061,49 @@ void test_fixed_wnaf_zero(int w) {
secp256k1_scalar_set_int(&num, 0);
skew = secp256k1_wnaf_fixed(wnaf, &num, w);
for (i = WNAF_SIZE(w)-1; i >= 0; --i) {
int v = wnaf[i];
CHECK(v == 0);
}
CHECK(skew == 0);
secp256k1_scalar_set_int(&num, 1);
skew = secp256k1_wnaf_fixed(wnaf, &num, w);
for (i = WNAF_SIZE(w)-1; i >= 1; --i) {
int v = wnaf[i];
CHECK(v == 0);
}
CHECK(wnaf[0] == 1);
CHECK(skew == 0);
{
int wnaf_expected[8] = { 0xf, 0xf, 0xf, 0xf, 0xf, 0xf, 0xf, 0xf };
secp256k1_scalar_set_int(&num, 0xffffffff);
skew = secp256k1_wnaf_fixed(wnaf, &num, w);
test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
CHECK(skew == 0);
}
{
int wnaf_expected[8] = { -1, -1, -1, -1, -1, -1, -1, 0xf };
secp256k1_scalar_set_int(&num, 0xeeeeeeee);
skew = secp256k1_wnaf_fixed(wnaf, &num, w);
test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
CHECK(skew == 1);
}
{
int wnaf_expected[8] = { 1, 0, 1, 0, 1, 0, 1, 0 };
secp256k1_scalar_set_int(&num, 0x01010101);
skew = secp256k1_wnaf_fixed(wnaf, &num, w);
test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
CHECK(skew == 0);
}
{
int wnaf_expected[8] = { -0xf, 0, 0xf, -0xf, 0, 0xf, 1, 0 };
secp256k1_scalar_set_int(&num, 0x01ef1ef1);
skew = secp256k1_wnaf_fixed(wnaf, &num, w);
test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
CHECK(skew == 0);
}
}
void run_wnaf(void) {
@ -3067,7 +3117,7 @@ void run_wnaf(void) {
n.d[0] = 2;
test_constant_wnaf(&n, 4);
/* Test 0 */
test_fixed_wnaf_zero(4);
test_fixed_wnaf_small();
/* Random tests */
for (i = 0; i < count; i++) {
random_scalar_order(&n);