Skip to content

Commit 944622a

Browse files
peterdettmanpeterdettman
committed
Save _normalize_weak calls in group add methods
1 parent d0aed08 commit 944622a

File tree

1 file changed

+28
-26
lines changed

1 file changed

+28
-26
lines changed

‎src/group_impl.h‎

Lines changed: 28 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,9 @@ static void secp256k1_ge_table_set_globalz(size_t len, secp256k1_ge *a, const se
211211
secp256k1_fe zs;
212212

213213
if (len > 0) {
214+
secp256k1_gej tmpa;
215+
secp256k1_fe_set_int(&tmpa.z, 1);
216+
214217
/* Ensure all y values are in weak normal form for fast negation of points */
215218
secp256k1_fe_normalize_weak(&a[i].y);
216219
VERIFY_GE(&a[i]);
@@ -219,7 +222,6 @@ static void secp256k1_ge_table_set_globalz(size_t len, secp256k1_ge *a, const se
219222

220223
/* Work our way backwards, using the z-ratios to scale the x/y values. */
221224
while (i > 0) {
222-
secp256k1_gej tmpa;
223225
if (i != len - 1) {
224226
secp256k1_fe_mul(&zs, &zs, &zr[i]);
225227
}
@@ -486,12 +488,12 @@ static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, c
486488
r->infinity = 0;
487489

488490
secp256k1_fe_sqr(&z12, &a->z);
489-
u1 = a->x; secp256k1_fe_normalize_weak(&u1);
491+
u1 = a->x;
490492
secp256k1_fe_mul(&u2, &b->x, &z12);
491-
s1 = a->y; secp256k1_fe_normalize_weak(&s1);
493+
s1 = a->y;
492494
secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
493-
secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
494-
secp256k1_fe_negate(&i, &s1, 1); secp256k1_fe_add(&i, &s2);
495+
secp256k1_fe_negate(&h, &u1, 6); secp256k1_fe_add(&h, &u2);
496+
secp256k1_fe_negate(&i, &s1, 4); secp256k1_fe_add(&i, &s2);
495497
if (secp256k1_fe_normalizes_to_zero_var(&h)) {
496498
if (secp256k1_fe_normalizes_to_zero_var(&i)) {
497499
secp256k1_gej_double_var(r, a, rzr);
@@ -554,12 +556,12 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a,
554556
secp256k1_fe_mul(&az, &a->z, bzinv);
555557

556558
secp256k1_fe_sqr(&z12, &az);
557-
u1 = a->x; secp256k1_fe_normalize_weak(&u1);
559+
u1 = a->x;
558560
secp256k1_fe_mul(&u2, &b->x, &z12);
559-
s1 = a->y; secp256k1_fe_normalize_weak(&s1);
561+
s1 = a->y;
560562
secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
561-
secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
562-
secp256k1_fe_negate(&i, &s1, 1); secp256k1_fe_add(&i, &s2);
563+
secp256k1_fe_negate(&h, &u1, 6); secp256k1_fe_add(&h, &u2);
564+
secp256k1_fe_negate(&i, &s1, 4); secp256k1_fe_add(&i, &s2);
563565
if (secp256k1_fe_normalizes_to_zero_var(&h)) {
564566
if (secp256k1_fe_normalizes_to_zero_var(&i)) {
565567
secp256k1_gej_double_var(r, a, NULL);
@@ -643,17 +645,17 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
643645
*/
644646

645647
secp256k1_fe_sqr(&zz, &a->z); /* z = Z1^2 */
646-
u1 = a->x; secp256k1_fe_normalize_weak(&u1); /* u1 = U1 = X1*Z2^2 (1) */
648+
u1 = a->x; /* u1 = U1 = X1*Z2^2 (6) */
647649
secp256k1_fe_mul(&u2, &b->x, &zz); /* u2 = U2 = X2*Z1^2 (1) */
648-
s1 = a->y; secp256k1_fe_normalize_weak(&s1); /* s1 = S1 = Y1*Z2^3 (1) */
650+
s1 = a->y; /* s1 = S1 = Y1*Z2^3 (4) */
649651
secp256k1_fe_mul(&s2, &b->y, &zz); /* s2 = Y2*Z1^2 (1) */
650652
secp256k1_fe_mul(&s2, &s2, &a->z); /* s2 = S2 = Y2*Z1^3 (1) */
651-
t = u1; secp256k1_fe_add(&t, &u2); /* t = T = U1+U2 (2) */
652-
m = s1; secp256k1_fe_add(&m, &s2); /* m = M = S1+S2 (2) */
653+
t = u1; secp256k1_fe_add(&t, &u2); /* t = T = U1+U2 (7) */
654+
m = s1; secp256k1_fe_add(&m, &s2); /* m = M = S1+S2 (5) */
653655
secp256k1_fe_sqr(&rr, &t); /* rr = T^2 (1) */
654-
secp256k1_fe_negate(&m_alt, &u2, 1); /* Malt = -X2*Z1^2 */
655-
secp256k1_fe_mul(&tt, &u1, &m_alt); /* tt = -U1*U2 (2) */
656-
secp256k1_fe_add(&rr, &tt); /* rr = R = T^2-U1*U2 (3) */
656+
secp256k1_fe_negate(&m_alt, &u2, 1); /* Malt = -X2*Z1^2 (2) */
657+
secp256k1_fe_mul(&tt, &u1, &m_alt); /* tt = -U1*U2 (1) */
658+
secp256k1_fe_add(&rr, &tt); /* rr = R = T^2-U1*U2 (2) */
657659
/** If lambda = R/M = 0/0 we have a problem (except in the "trivial"
658660
* case that Z = z1z2 = 0, and this is special-cased later on). */
659661
degenerate = secp256k1_fe_normalizes_to_zero(&m) &
@@ -664,24 +666,24 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
664666
* non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
665667
* so we set R/M equal to this. */
666668
rr_alt = s1;
667-
secp256k1_fe_mul_int(&rr_alt, 2); /* rr = Y1*Z2^3 - Y2*Z1^3 (2) */
668-
secp256k1_fe_add(&m_alt, &u1); /* Malt = X1*Z2^2 - X2*Z1^2 */
669+
secp256k1_fe_mul_int(&rr_alt, 2); /* rr_alt = Y1*Z2^3 - Y2*Z1^3 (8) */
670+
secp256k1_fe_add(&m_alt, &u1); /* Malt = X1*Z2^2 - X2*Z1^2 (8) */
669671

670-
secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);
671-
secp256k1_fe_cmov(&m_alt, &m, !degenerate);
672+
secp256k1_fe_cmov(&rr_alt, &rr, !degenerate); /* rr_alt (8) */
673+
secp256k1_fe_cmov(&m_alt, &m, !degenerate); /* m_alt (5) */
672674
/* Now Ralt / Malt = lambda and is guaranteed not to be 0/0.
673675
* From here on out Ralt and Malt represent the numerator
674676
* and denominator of lambda; R and M represent the explicit
675677
* expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
676678
secp256k1_fe_sqr(&n, &m_alt); /* n = Malt^2 (1) */
677-
secp256k1_fe_negate(&q, &t, 2); /* q = -T (3) */
679+
secp256k1_fe_negate(&q, &t, 7); /* q = -T (8) */
678680
secp256k1_fe_mul(&q, &q, &n); /* q = Q = -T*Malt^2 (1) */
679681
/* These two lines use the observation that either M == Malt or M == 0,
680682
* so M^3 * Malt is either Malt^4 (which is computed by squaring), or
681683
* zero (which is "computed" by cmov). So the cost is one squaring
682684
* versus two multiplications. */
683-
secp256k1_fe_sqr(&n, &n);
684-
secp256k1_fe_cmov(&n, &m, degenerate); /* n = M^3 * Malt (2) */
685+
secp256k1_fe_sqr(&n, &n); /* n = Malt^4 (1) */
686+
secp256k1_fe_cmov(&n, &m, degenerate); /* n = M^3 * Malt (5) */
685687
secp256k1_fe_sqr(&t, &rr_alt); /* t = Ralt^2 (1) */
686688
secp256k1_fe_mul(&r->z, &a->z, &m_alt); /* r->z = Z3 = Malt*Z (1) */
687689
infinity = secp256k1_fe_normalizes_to_zero(&r->z) & ~a->infinity;
@@ -690,9 +692,9 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
690692
secp256k1_fe_mul_int(&t, 2); /* t = 2*X3 (4) */
691693
secp256k1_fe_add(&t, &q); /* t = 2*X3 + Q (5) */
692694
secp256k1_fe_mul(&t, &t, &rr_alt); /* t = Ralt*(2*X3 + Q) (1) */
693-
secp256k1_fe_add(&t, &n); /* t = Ralt*(2*X3 + Q) + M^3*Malt (3) */
694-
secp256k1_fe_negate(&r->y, &t, 3); /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (4) */
695-
secp256k1_fe_half(&r->y); /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 (3) */
695+
secp256k1_fe_add(&t, &n); /* t = Ralt*(2*X3 + Q) + M^3*Malt (6) */
696+
secp256k1_fe_negate(&r->y, &t, 6); /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (7) */
697+
secp256k1_fe_half(&r->y); /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 (4) */
696698

697699
/** In case a->infinity == 1, replace r with (b->x, b->y, 1). */
698700
secp256k1_fe_cmov(&r->x, &b->x, a->infinity);

0 commit comments

Comments
 (0)