authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-01-01 23:48:26+01:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-01-01 23:56:20+01:00
log1baa127c6561ea604f6250b68b48105d026df575
tree759af91193062c52dab390b9c55e0bbe25c4b4c6
parent2bd02883c7260bb60e3c896bba37a7e6f403769f

crypto.edwards25519: optimize rejectLowOrder

Reject low-order points by checking projective coordinates directly instead of using affine coordinates. Equivalent, but saves CPU cycles (~254 field multiplications total before, 3 field multiplications after).

1 files changed, 4 insertions(+), 6 deletions(-)

lib/std/crypto/25519/edwards25519.zig+4-6
......@@ -127,12 +127,10 @@ pub const Edwards25519 = struct {
127127 /// Check that the point does not generate a low-order group.
128128 /// Return a `WeakPublicKey` error if it does.
129129 pub fn rejectLowOrder(p: Edwards25519) WeakPublicKeyError!void {
130 const zi = p.z.invert();
131 const x = p.x.mul(zi);
132 const y = p.y.mul(zi);
133 const x_neg = x.neg();
134 const iy = Fe.sqrtm1.mul(y);
135 if (x.isZero() or y.isZero() or iy.equivalent(x) or iy.equivalent(x_neg)) {
130 const y_sqrtm1 = Fe.sqrtm1.mul(p.y);
131 if (p.x.isZero() or p.y.isZero() or p.z.isZero() or
132 y_sqrtm1.sub(p.x).isZero() or y_sqrtm1.add(p.x).isZero())
133 {
136134 return error.WeakPublicKey;
137135 }
138136 }