Skip to content

Commit 5d87e80

Browse files
shallue_van_de_woestijne rewrite
The previous implementation returns an off-curve point for the input t=0. This rewrite addresses that issue by implicity returning the on-curve point (d, sqrt(1 + b)), which is the point that the paper Indifferentiable Hashing to Barreto–Naehrig Curves suggests returning in this case. Note: At the moment it is cryptographically impossible for the input t to be 0.
1 parent eb4fb6d commit 5d87e80

File tree

1 file changed

+27
-38
lines changed

1 file changed

+27
-38
lines changed

src/modules/generator/main_impl.h

+27-38
Original file line numberDiff line numberDiff line change
@@ -107,61 +107,50 @@ static void shallue_van_de_woestijne(secp256k1_ge* ge, const secp256k1_fe* t) {
107107
x2 = -(x1 + 1)
108108
x3 = 1 + 1/w^2
109109
110-
To avoid the 2 divisions, compute the above in numerator/denominator form:
111-
wn = c * t
112-
wd = 1 + 7 + t^2
113-
x1n = d*wd - t*wn
114-
x1d = wd
115-
x2n = -(x1n + wd)
116-
x2d = wd
117-
x3n = wd^2 + c^2 * t^2
118-
x3d = (c * t)^2
119-
120-
The joint denominator j = wd * c^2 * t^2, and
121-
1 / x1d = 1/j * c^2 * t^2
122-
1 / x2d = x3d = 1/j * wd
110+
To avoid the 2 divisions, compute the joint denominator j = wd * x3d, where
111+
wd = 1 + b + t^2
112+
x3d = c^2 * t^2 = -3 * t^2
113+
114+
so that
115+
116+
1 / wd = 1/j * x3d
117+
1 / x3d = 1/j * wd
123118
*/
124119

125-
static const secp256k1_fe c = SECP256K1_FE_CONST(0x0a2d2ba9, 0x3507f1df, 0x233770c2, 0xa797962c, 0xc61f6d15, 0xda14ecd4, 0x7d8d27ae, 0x1cd5f852);
120+
static const secp256k1_fe negc = SECP256K1_FE_CONST(0xf5d2d456, 0xcaf80e20, 0xdcc88f3d, 0x586869d3, 0x39e092ea, 0x25eb132b, 0x8272d850, 0xe32a03dd);
126121
static const secp256k1_fe d = SECP256K1_FE_CONST(0x851695d4, 0x9a83f8ef, 0x919bb861, 0x53cbcb16, 0x630fb68a, 0xed0a766a, 0x3ec693d6, 0x8e6afa40);
127-
static const secp256k1_fe b = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 7);
128-
static const secp256k1_fe b_plus_one = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 8);
129122

130-
secp256k1_fe wn, wd, x1n, x2n, x3n, x3d, jinv, tmp, x1, x2, x3, alphain, betain, gammain, y1, y2, y3;
123+
secp256k1_fe wd, x3d, jinv, tmp, x1, x2, x3, alphain, betain, gammain, y1, y2, y3;
131124
int alphaquad, betaquad;
132125

133-
secp256k1_fe_mul(&wn, &c, t); /* mag 1 */
134126
secp256k1_fe_sqr(&wd, t); /* mag 1 */
135-
secp256k1_fe_add(&wd, &b_plus_one); /* mag 2 */
136-
secp256k1_fe_mul(&tmp, t, &wn); /* mag 1 */
137-
secp256k1_fe_negate(&tmp, &tmp, 1); /* mag 2 */
138-
secp256k1_fe_mul(&x1n, &d, &wd); /* mag 1 */
139-
secp256k1_fe_add(&x1n, &tmp); /* mag 3 */
140-
x2n = x1n; /* mag 3 */
141-
secp256k1_fe_add(&x2n, &wd); /* mag 5 */
142-
secp256k1_fe_negate(&x2n, &x2n, 5); /* mag 6 */
143-
secp256k1_fe_mul(&x3d, &c, t); /* mag 1 */
144-
secp256k1_fe_sqr(&x3d, &x3d); /* mag 1 */
145-
secp256k1_fe_sqr(&x3n, &wd); /* mag 1 */
146-
secp256k1_fe_add(&x3n, &x3d); /* mag 2 */
147-
secp256k1_fe_mul(&jinv, &x3d, &wd); /* mag 1 */
127+
secp256k1_fe_mul(&x1, &negc, &wd); /* mag 1 */
128+
x3d = wd; /* mag 1 */
129+
secp256k1_fe_mul_int(&x3d, 3); /* mag 3 */
130+
secp256k1_fe_negate(&x3d, &x3d, 3); /* mag 4 */
131+
secp256k1_fe_add_int(&wd, SECP256K1_B + 1); /* mag 2 */
132+
secp256k1_fe_mul(&jinv, &wd, &x3d); /* mag 1 */
148133
secp256k1_fe_inv(&jinv, &jinv); /* mag 1 */
149-
secp256k1_fe_mul(&x1, &x1n, &x3d); /* mag 1 */
134+
secp256k1_fe_mul(&x1, &x1, &x3d); /* mag 1 */
150135
secp256k1_fe_mul(&x1, &x1, &jinv); /* mag 1 */
151-
secp256k1_fe_mul(&x2, &x2n, &x3d); /* mag 1 */
152-
secp256k1_fe_mul(&x2, &x2, &jinv); /* mag 1 */
153-
secp256k1_fe_mul(&x3, &x3n, &wd); /* mag 1 */
136+
secp256k1_fe_add(&x1, &d); /* mag 2 */
137+
x2 = x1; /* mag 2 */
138+
secp256k1_fe_add_int(&x2, 1); /* mag 3 */
139+
secp256k1_fe_negate(&x2, &x2, 3); /* mag 4 */
140+
secp256k1_fe_sqr(&x3, &wd); /* mag 1 */
141+
secp256k1_fe_mul(&x3, &x3, &wd); /* mag 1 */
154142
secp256k1_fe_mul(&x3, &x3, &jinv); /* mag 1 */
143+
secp256k1_fe_add_int(&x3, 1); /* mag 2 */
155144

156145
secp256k1_fe_sqr(&alphain, &x1); /* mag 1 */
157146
secp256k1_fe_mul(&alphain, &alphain, &x1); /* mag 1 */
158-
secp256k1_fe_add(&alphain, &b); /* mag 2 */
147+
secp256k1_fe_add_int(&alphain, SECP256K1_B); /* mag 2 */
159148
secp256k1_fe_sqr(&betain, &x2); /* mag 1 */
160149
secp256k1_fe_mul(&betain, &betain, &x2); /* mag 1 */
161-
secp256k1_fe_add(&betain, &b); /* mag 2 */
150+
secp256k1_fe_add_int(&betain, SECP256K1_B); /* mag 2 */
162151
secp256k1_fe_sqr(&gammain, &x3); /* mag 1 */
163152
secp256k1_fe_mul(&gammain, &gammain, &x3); /* mag 1 */
164-
secp256k1_fe_add(&gammain, &b); /* mag 2 */
153+
secp256k1_fe_add_int(&gammain, SECP256K1_B); /* mag 2 */
165154

166155
alphaquad = secp256k1_fe_sqrt(&y1, &alphain);
167156
betaquad = secp256k1_fe_sqrt(&y2, &betain);

0 commit comments

Comments
 (0)