Commit b9d112d5a7b41f21aeaee17537000ce41eecab42 | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2026-09-27 00:31:09+02:00
committer	Frank Denis <124872+jedisct1@users.noreply.github.com> 2026-09-30 17:19:43+02:00
log	b9d112d5a7b41f21aeaee17537000ce41eecab42
tree	10dc58f132435be177d725472384709d3079e895
parent	087ee6f4efce2bb635c11282a43b0014e56f366f

crypto.ecdsa: speed up signature verification

For ECDSA verification, we can use mulDoubleBasePublic() to
combine the two scalar multiplication like we do for ed25519.

But more importantly, we don't need a field inversion.

The points store x as X/Z, so we can compare X with r*Z instead
of dividing.

A valid x can also be r + n, where n is the curve order, so we
check (r + n)*Z too, when  r + n stays below the field size.

That makes verification 1.5x-2.5x faster depending on the curve.

This optimization was suggest by Jack Boykin -- Thanks!

1 files changed, 12 insertions(+), 5 deletions(-)

lib
- std
  - crypto
    ecdsa.zig

lib/std/crypto/ecdsa.zig+12-5

 @@ -256,6 +256,7 @@ pub fn Ecdsa(comptime C: type, comptime H: type) type {
                 const r = try Curve.scalar.Scalar.fromBytes(sig.r, .big);
                 const s = try Curve.scalar.Scalar.fromBytes(sig.s, .big);
                 if (r.isZero() or s.isZero()) return error.IdentityElement;
+                try public_key.p.rejectIdentity();
                 return Verifier{
                     .h = Hash.init(.{}),
 @@ -287,13 +288,19 @@ pub fn Ecdsa(comptime C: type, comptime H: type) type {
                 const s_inv = self.s.invert();
                 const v1 = z.mul(s_inv).toBytes(.little);
                 const v2 = self.r.mul(s_inv).toBytes(.little);
-                const v1g = try Curve.basePoint.mulPublic(v1, .little);
+                const v = Curve.mulDoubleBasePublic(Curve.basePoint, v1, self.public_key.p, v2, .little) catch
-                const v2pk = try self.public_key.p.mulPublic(v2, .little);
-                const vxs = v1g.add(v2pk).affineCoordinates().x.toBytes(.big);
-                const vr = reduceToScalar(Curve.Fe.encoded_length, vxs);
-                if (!self.r.equivalent(vr)) {
                     return error.SignatureVerificationFailed;
+                const Fe = Curve.Fe;
+                const n = Curve.scalar.field_order;
+                comptime std.debug.assert(n < Fe.field_order and Fe.field_order < 2 * n);
+                const r = Fe.fromBytes(self.r.toBytes(.little), .little) catch unreachable;
+                if (v.x.equivalent(r.mul(v.z))) return;
+                if (r.toInt() < Fe.field_order - n) {
+                    const n_fe = comptime Fe.fromInt(n) catch unreachable;
+                    if (v.x.equivalent(r.add(n_fe).mul(v.z))) return;
                 }
+                return error.SignatureVerificationFailed;
             }
             /// Verify that the signature is valid for the entire message.