Pieter Wuille
87bddb7a3a
b0210a9 Merge pull request #135 ee3eb4b Fix a memory leak and add a number of small tests. 4d879a3 Merge pull request #134 d5e8362 Merge pull request #127 7b92cf6 Merge pull request #132 0bf70a5 Merge pull request #133 29ae131 Make scalar_add_bit test's overflow detection exact 9048def Avoid undefined shift behaviour efb7d4b Use constant-time conditional moves instead of byte slicing d220062 Merge pull request #131 82f9254 Fix typo 601ca04 Merge pull request #129 35399e0 Bugfix: b is restricted, not r c35ff1e Convert lambda splitter to pure scalar code. cc604e9 Avoid division when decomposing scalars ff8746d Add secp256k1_scalar_mul_shift_var bd313f7 Merge pull request #119 276f987 Merge pull request #124 25d125e Merge pull request #126 24b3c65 Add a test case for ECDSA recomputing infinity 32600e5 Add a test for r >= order signature handling 4d4eeea Make secp256k1_fe_mul_inner use the r != property be82e92 Require that r and b are different for field multiplication. 597128d Make num optional 659b554 Make constant initializers independent from num 0af5b47 Merge pull request #120 e2e8a36 Merge pull request #117 c76be9e Remove unused num functions 4285a98 Move lambda-splitting code to scalar. f24041d Switch all EC/ECDSA logic from num to scalar 6794be6 Add scalar splitting functions d1502eb Add secp256k1_scalar_inverse_var which delegates to GMP b5c9ee7 Make test_point_times_order test meaningful again 0b73059 Switch wnaf splitting from num-based to scalar-based 1e6c77c Generalize secp256k1_scalar_get_bits 5213207 Add secp256k1_scalar_add_bit 3c0ae43 Merge pull request #122 6e05287 Do signature recovery/verification with 4 possible recid case e3d692f Explain why no y=0 check is necessary for doubling f7dc1c6 Optimize doubling: secp256k1 has no y=0 point 666d3b5 Merge pull request #121 2a54f9b Correct typo in comment 9d64145 Merge pull request #114 99f0728 Fix secp256k1_num_set_bin handling of 0 d907ebc Add bounds checking to field element setters bb2cd94 Merge pull request #116 665775b Don't split the g factor when not using endomorphism 9431d6b Merge pull request #115 e2274c5 build: osx: attempt to work with homebrew keg-only packages git-subtree-dir: src/secp256k1 git-subtree-split: b0210a95da433e048a11d298efbcc14eb423c95f
121 lines
5.1 KiB
C
121 lines
5.1 KiB
C
/**********************************************************************
|
|
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
* Distributed under the MIT software license, see the accompanying *
|
|
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
**********************************************************************/
|
|
|
|
#ifndef _SECP256K1_GROUP_
|
|
#define _SECP256K1_GROUP_
|
|
|
|
#include "num.h"
|
|
#include "field.h"
|
|
|
|
/** A group element of the secp256k1 curve, in affine coordinates. */
|
|
typedef struct {
|
|
secp256k1_fe_t x;
|
|
secp256k1_fe_t y;
|
|
int infinity; /* whether this represents the point at infinity */
|
|
} secp256k1_ge_t;
|
|
|
|
/** A group element of the secp256k1 curve, in jacobian coordinates. */
|
|
typedef struct {
|
|
secp256k1_fe_t x; /* actual X: x/z^2 */
|
|
secp256k1_fe_t y; /* actual Y: y/z^3 */
|
|
secp256k1_fe_t z;
|
|
int infinity; /* whether this represents the point at infinity */
|
|
} secp256k1_gej_t;
|
|
|
|
/** Global constants related to the group */
|
|
typedef struct {
|
|
secp256k1_ge_t g; /* the generator point */
|
|
|
|
#ifdef USE_ENDOMORPHISM
|
|
/* constants related to secp256k1's efficiently computable endomorphism */
|
|
secp256k1_fe_t beta;
|
|
#endif
|
|
} secp256k1_ge_consts_t;
|
|
|
|
static const secp256k1_ge_consts_t *secp256k1_ge_consts = NULL;
|
|
|
|
/** Initialize the group module. */
|
|
static void secp256k1_ge_start(void);
|
|
|
|
/** De-initialize the group module. */
|
|
static void secp256k1_ge_stop(void);
|
|
|
|
/** Set a group element equal to the point at infinity */
|
|
static void secp256k1_ge_set_infinity(secp256k1_ge_t *r);
|
|
|
|
/** Set a group element equal to the point with given X and Y coordinates */
|
|
static void secp256k1_ge_set_xy(secp256k1_ge_t *r, const secp256k1_fe_t *x, const secp256k1_fe_t *y);
|
|
|
|
/** Set a group element (affine) equal to the point with the given X coordinate, and given oddness
|
|
* for Y. Return value indicates whether the result is valid. */
|
|
static int secp256k1_ge_set_xo(secp256k1_ge_t *r, const secp256k1_fe_t *x, int odd);
|
|
|
|
/** Check whether a group element is the point at infinity. */
|
|
static int secp256k1_ge_is_infinity(const secp256k1_ge_t *a);
|
|
|
|
/** Check whether a group element is valid (i.e., on the curve). */
|
|
static int secp256k1_ge_is_valid(const secp256k1_ge_t *a);
|
|
|
|
static void secp256k1_ge_neg(secp256k1_ge_t *r, const secp256k1_ge_t *a);
|
|
|
|
/** Get a hex representation of a point. *rlen will be overwritten with the real length. */
|
|
static void secp256k1_ge_get_hex(char *r, int *rlen, const secp256k1_ge_t *a);
|
|
|
|
/** Set a group element equal to another which is given in jacobian coordinates */
|
|
static void secp256k1_ge_set_gej(secp256k1_ge_t *r, secp256k1_gej_t *a);
|
|
|
|
/** Set a batch of group elements equal to the inputs given in jacobian coordinates */
|
|
static void secp256k1_ge_set_all_gej_var(size_t len, secp256k1_ge_t r[len], const secp256k1_gej_t a[len]);
|
|
|
|
|
|
/** Set a group element (jacobian) equal to the point at infinity. */
|
|
static void secp256k1_gej_set_infinity(secp256k1_gej_t *r);
|
|
|
|
/** Set a group element (jacobian) equal to the point with given X and Y coordinates. */
|
|
static void secp256k1_gej_set_xy(secp256k1_gej_t *r, const secp256k1_fe_t *x, const secp256k1_fe_t *y);
|
|
|
|
/** Set a group element (jacobian) equal to another which is given in affine coordinates. */
|
|
static void secp256k1_gej_set_ge(secp256k1_gej_t *r, const secp256k1_ge_t *a);
|
|
|
|
/** Get the X coordinate of a group element (jacobian). */
|
|
static void secp256k1_gej_get_x_var(secp256k1_fe_t *r, const secp256k1_gej_t *a);
|
|
|
|
/** Set r equal to the inverse of a (i.e., mirrored around the X axis) */
|
|
static void secp256k1_gej_neg(secp256k1_gej_t *r, const secp256k1_gej_t *a);
|
|
|
|
/** Check whether a group element is the point at infinity. */
|
|
static int secp256k1_gej_is_infinity(const secp256k1_gej_t *a);
|
|
|
|
/** Set r equal to the double of a. */
|
|
static void secp256k1_gej_double_var(secp256k1_gej_t *r, const secp256k1_gej_t *a);
|
|
|
|
/** Set r equal to the sum of a and b. */
|
|
static void secp256k1_gej_add_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_gej_t *b);
|
|
|
|
/** Set r equal to the sum of a and b (with b given in affine coordinates, and not infinity). */
|
|
static void secp256k1_gej_add_ge(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b);
|
|
|
|
/** Set r equal to the sum of a and b (with b given in affine coordinates). This is more efficient
|
|
than secp256k1_gej_add_var. It is identical to secp256k1_gej_add_ge but without constant-time
|
|
guarantee, and b is allowed to be infinity. */
|
|
static void secp256k1_gej_add_ge_var(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b);
|
|
|
|
/** Get a hex representation of a point. *rlen will be overwritten with the real length. */
|
|
static void secp256k1_gej_get_hex(char *r, int *rlen, const secp256k1_gej_t *a);
|
|
|
|
#ifdef USE_ENDOMORPHISM
|
|
/** Set r to be equal to lambda times a, where lambda is chosen in a way such that this is very fast. */
|
|
static void secp256k1_gej_mul_lambda(secp256k1_gej_t *r, const secp256k1_gej_t *a);
|
|
#endif
|
|
|
|
/** Clear a secp256k1_gej_t to prevent leaking sensitive information. */
|
|
static void secp256k1_gej_clear(secp256k1_gej_t *r);
|
|
|
|
/** Clear a secp256k1_ge_t to prevent leaking sensitive information. */
|
|
static void secp256k1_ge_clear(secp256k1_ge_t *r);
|
|
|
|
#endif
|