frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge bitcoin-core/secp256k1#1348: tighten group magnitude limits, save normalize_weak calls in group add methods (revival of #1032)

Browse Source 
b7c685e74a Save _normalize_weak calls in group add methods (Peter Dettman)
c83afa66e0 Tighten group magnitude limits (Peter Dettman)
173e8d061a Implement current magnitude assumptions (Peter Dettman)
49afd2f5d8 Take use of _fe_verify_magnitude in field_impl.h (Sebastian Falbesoner)
4e9661fc42 Add _fe_verify_magnitude (no-op unless VERIFY is enabled) (Peter Dettman)
690b0fc05a add missing group element invariant checks (Sebastian Falbesoner)

Pull request description:

  This PR picks up #1032 by peterdettman. It's essentially a rebase on master; the original first commit (09dbba561fdb9d57a2cc9842ce041d9ba29a6189) which introduced group verification methods has mostly been replaced by PR #1299 (commit f20266722a) and what remains now is only adding a few missing checks at some places. The remaining commits are unchanged, though some (easy-to-solve) conflicts appeared through cherry-picking. The last commit which actually removes the `normalize_weak` calls is obviously the critical one and needs the most attention for review.

ACKs for top commit:
  sipa:
    utACK b7c685e74a
  real-or-random:
    ACK b7c685e74a
  jonasnick:
    ACK b7c685e74a

Tree-SHA512: f15167eff7ef6ed971c726a4d738de9a15be95b0c947d7e38329e7b16656202b7113497d36625304e784866349f2293f6f1d8cb97df35393af9ea465a4156da3
This commit is contained in:
Tim Ruffing
2023-08-16 13:51:03 +02:00
parent b2f6712dd3 b7c685e74a
commit eedd781085
5 changed files with 182 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
src/tests.c
View File

@@ -89,9 +89,9 @@ static void uncounting_illegal_callback_fn(const char* str, void* data) {
(*p)--;
}
static void random_field_element_magnitude(secp256k1_fe *fe) {
static void random_field_element_magnitude(secp256k1_fe *fe, int m) {
secp256k1_fe zero;
int n = secp256k1_testrand_int(9);
int n = secp256k1_testrand_int(m + 1);
secp256k1_fe_normalize(fe);
if (n == 0) {
return;
@@ -121,6 +121,30 @@ static void random_fe_non_zero_test(secp256k1_fe *fe) {
} while(secp256k1_fe_is_zero(fe));
}
static void random_fe_magnitude(secp256k1_fe *fe) {
random_field_element_magnitude(fe, 8);
}
static void random_ge_x_magnitude(secp256k1_ge *ge) {
random_field_element_magnitude(&ge->x, SECP256K1_GE_X_MAGNITUDE_MAX);
}
static void random_ge_y_magnitude(secp256k1_ge *ge) {
random_field_element_magnitude(&ge->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
}
static void random_gej_x_magnitude(secp256k1_gej *gej) {
random_field_element_magnitude(&gej->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
}
static void random_gej_y_magnitude(secp256k1_gej *gej) {
random_field_element_magnitude(&gej->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
}
static void random_gej_z_magnitude(secp256k1_gej *gej) {
random_field_element_magnitude(&gej->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
}
static void random_group_element_test(secp256k1_ge *ge) {
secp256k1_fe fe;
do {
@@ -3279,13 +3303,13 @@ static void run_fe_mul(void) {
for (i = 0; i < 100 * COUNT; ++i) {
secp256k1_fe a, b, c, d;
random_fe(&a);
random_field_element_magnitude(&a);
random_fe_magnitude(&a);
random_fe(&b);
random_field_element_magnitude(&b);
random_fe_magnitude(&b);
random_fe_test(&c);
random_field_element_magnitude(&c);
random_fe_magnitude(&c);
random_fe_test(&d);
random_field_element_magnitude(&d);
random_fe_magnitude(&d);
test_fe_mul(&a, &a, 1);
test_fe_mul(&c, &c, 1);
test_fe_mul(&a, &b, 0);
@@ -3759,17 +3783,17 @@ static void test_ge(void) {
secp256k1_gej_set_ge(&gej[3 + 4 * i], &ge[3 + 4 * i]);
random_group_element_jacobian_test(&gej[4 + 4 * i], &ge[4 + 4 * i]);
for (j = 0; j < 4; j++) {
random_field_element_magnitude(&ge[1 + j + 4 * i].x);
random_field_element_magnitude(&ge[1 + j + 4 * i].y);
random_field_element_magnitude(&gej[1 + j + 4 * i].x);
random_field_element_magnitude(&gej[1 + j + 4 * i].y);
random_field_element_magnitude(&gej[1 + j + 4 * i].z);
random_ge_x_magnitude(&ge[1 + j + 4 * i]);
random_ge_y_magnitude(&ge[1 + j + 4 * i]);
random_gej_x_magnitude(&gej[1 + j + 4 * i]);
random_gej_y_magnitude(&gej[1 + j + 4 * i]);
random_gej_z_magnitude(&gej[1 + j + 4 * i]);
}
}
/* Generate random zf, and zfi2 = 1/zf^2, zfi3 = 1/zf^3 */
random_fe_non_zero_test(&zf);
random_field_element_magnitude(&zf);
random_fe_magnitude(&zf);
secp256k1_fe_inv_var(&zfi3, &zf);
secp256k1_fe_sqr(&zfi2, &zfi3);
secp256k1_fe_mul(&zfi3, &zfi3, &zfi2);
@@ -3805,8 +3829,8 @@ static void test_ge(void) {
secp256k1_ge ge2_zfi = ge[i2]; /* the second term with x and y rescaled for z = 1/zf */
secp256k1_fe_mul(&ge2_zfi.x, &ge2_zfi.x, &zfi2);
secp256k1_fe_mul(&ge2_zfi.y, &ge2_zfi.y, &zfi3);
random_field_element_magnitude(&ge2_zfi.x);
random_field_element_magnitude(&ge2_zfi.y);
random_ge_x_magnitude(&ge2_zfi);
random_ge_y_magnitude(&ge2_zfi);
secp256k1_gej_add_zinv_var(&resj, &gej[i1], &ge2_zfi, &zf);
ge_equals_gej(&ref, &resj);
}