authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-11-15 22:33:01+01:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-11-18 21:45:42-08:00
log3f134cfe5e3837aadd5b197bb0aa28dd191b8a08
treee6a1cd77806038cdc4df08e995a163b4e059696a
parente814f7105214c588f5df4c173ecf84dd3a11b01d

edwards25519 - skip useless operations and duplicate lookup table

Just some trivial changes; no functional changes. Skip useless nul additions and multiplications and comptime the basepoint multiples only once.

1 files changed, 23 insertions(+), 26 deletions(-)

lib/std/crypto/25519/edwards25519.zig+23-26
......@@ -144,7 +144,7 @@ pub const Edwards25519 = struct {
144144
145145 inline fn pcSelect(pc: [16]Edwards25519, b: u8) Edwards25519 {
146146 var t = Edwards25519.identityElement;
147 comptime var i: u8 = 0;
147 comptime var i: u8 = 1;
148148 inline while (i < 16) : (i += 1) {
149149 t.cMov(pc[i], ((@as(usize, b ^ i) -% 1) >> 8) & 1);
150150 }
......@@ -155,7 +155,6 @@ pub const Edwards25519 = struct {
155155 var q = Edwards25519.identityElement;
156156 var pos: usize = 252;
157157 while (true) : (pos -= 4) {
158 q = q.dbl().dbl().dbl().dbl();
159158 const bit = (s[pos >> 3] >> @truncate(u3, pos)) & 0xf;
160159 if (vartime) {
161160 if (bit != 0) {
......@@ -165,6 +164,7 @@ pub const Edwards25519 = struct {
165164 q = q.add(pcSelect(pc, bit));
166165 }
167166 if (pos == 0) break;
167 q = q.dbl().dbl().dbl().dbl();
168168 }
169169 try q.rejectIdentity();
170170 return q;
......@@ -181,32 +181,31 @@ pub const Edwards25519 = struct {
181181 return pc;
182182 }
183183
184 const basePointPc = comptime pc: {
185 @setEvalBranchQuota(10000);
186 break :pc precompute(Edwards25519.basePoint);
187 };
188
184189 /// Multiply an Edwards25519 point by a scalar without clamping it.
185190 /// Return error.WeakPublicKey if the resulting point is
186191 /// the identity element.
187192 pub fn mul(p: Edwards25519, s: [32]u8) !Edwards25519 {
188 var pc: [16]Edwards25519 = undefined;
189 if (p.is_base) {
190 @setEvalBranchQuota(10000);
191 pc = comptime precompute(Edwards25519.basePoint);
192 } else {
193 pc = precompute(p);
194 pc[4].rejectIdentity() catch |_| return error.WeakPublicKey;
195 }
193 const pc = if (p.is_base) basePointPc else pc: {
194 const xpc = precompute(p);
195 xpc[4].rejectIdentity() catch |_| return error.WeakPublicKey;
196 break :pc xpc;
197 };
196198 return pcMul(pc, s, false);
197199 }
198200
199201 /// Multiply an Edwards25519 point by a *PUBLIC* scalar *IN VARIABLE TIME*
200202 /// This can be used for signature verification.
201203 pub fn mulPublic(p: Edwards25519, s: [32]u8) !Edwards25519 {
202 var pc: [16]Edwards25519 = undefined;
203 if (p.is_base) {
204 @setEvalBranchQuota(10000);
205 pc = comptime precompute(Edwards25519.basePoint);
206 } else {
207 pc = precompute(p);
208 pc[4].rejectIdentity() catch |_| return error.WeakPublicKey;
209 }
204 const pc = if (p.is_base) basePointPc else pc: {
205 const xpc = precompute(p);
206 xpc[4].rejectIdentity() catch |_| return error.WeakPublicKey;
207 break :pc xpc;
208 };
210209 return pcMul(pc, s, true);
211210 }
212211
......@@ -215,18 +214,15 @@ pub const Edwards25519 = struct {
215214 pub fn mulMulti(comptime count: usize, ps: [count]Edwards25519, ss: [count][32]u8) !Edwards25519 {
216215 var pcs: [count][16]Edwards25519 = undefined;
217216 for (ps) |p, i| {
218 if (p.is_base) {
219 @setEvalBranchQuota(10000);
220 pcs[i] = comptime precompute(Edwards25519.basePoint);
221 } else {
222 pcs[i] = precompute(p);
223 pcs[i][4].rejectIdentity() catch |_| return error.WeakPublicKey;
224 }
217 pcs[i] = if (p.is_base) basePointPc else pc: {
218 const xpc = precompute(p);
219 xpc[4].rejectIdentity() catch |_| return error.WeakPublicKey;
220 break :pc xpc;
221 };
225222 }
226223 var q = Edwards25519.identityElement;
227224 var pos: usize = 252;
228225 while (true) : (pos -= 4) {
229 q = q.dbl().dbl().dbl().dbl();
230226 for (ss) |s, i| {
231227 const bit = (s[pos >> 3] >> @truncate(u3, pos)) & 0xf;
232228 if (bit != 0) {
......@@ -234,6 +230,7 @@ pub const Edwards25519 = struct {
234230 }
235231 }
236232 if (pos == 0) break;
233 q = q.dbl().dbl().dbl().dbl();
237234 }
238235 try q.rejectIdentity();
239236 return q;