frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scalar: Port bitcoin-core/secp256k1#1512 to zkp-specific code

Browse Source
This commit is contained in:
mllwchrry
2026-01-26 14:30:31 +02:00
committed by DarkWindman
parent 8c72644a0e
commit f9cf003d9b
1 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
src/scalar_4x64_impl.h
View File

@@ -882,7 +882,7 @@ static void secp256k1_scalar_mul_512(uint64_t *l8, const secp256k1_scalar *a, co
#endif #endif
} }
static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) { static void secp256k1_scalar_sqr_512(uint64_t *l8, const secp256k1_scalar *a) {
#ifdef USE_ASM_X86_64 #ifdef USE_ASM_X86_64
__asm__ __volatile__( __asm__ __volatile__(
/* Preload */ /* Preload */
@@ -893,7 +893,7 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
/* (rax,rdx) = a0 * a0 */ /* (rax,rdx) = a0 * a0 */
"movq %%r11, %%rax\n" "movq %%r11, %%rax\n"
"mulq %%r11\n" "mulq %%r11\n"
/* Extract l0 */ /* Extract l8[0] */
"movq %%rax, 0(%%rsi)\n" "movq %%rax, 0(%%rsi)\n"
/* (r8,r9,r10) = (rdx,0) */ /* (r8,r9,r10) = (rdx,0) */
"movq %%rdx, %%r8\n" "movq %%rdx, %%r8\n"
@@ -908,7 +908,7 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
"addq %%rax, %%r8\n" "addq %%rax, %%r8\n"
"adcq %%rdx, %%r9\n" "adcq %%rdx, %%r9\n"
"adcq $0, %%r10\n" "adcq $0, %%r10\n"
/* Extract l1 */ /* Extract l8[1] */
"movq %%r8, 8(%%rsi)\n" "movq %%r8, 8(%%rsi)\n"
"xorq %%r8, %%r8\n" "xorq %%r8, %%r8\n"
/* (r9,r10,r8) += 2 * a0 * a2 */ /* (r9,r10,r8) += 2 * a0 * a2 */
@@ -926,7 +926,7 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
"addq %%rax, %%r9\n" "addq %%rax, %%r9\n"
"adcq %%rdx, %%r10\n" "adcq %%rdx, %%r10\n"
"adcq $0, %%r8\n" "adcq $0, %%r8\n"
/* Extract l2 */ /* Extract l8[2] */
"movq %%r9, 16(%%rsi)\n" "movq %%r9, 16(%%rsi)\n"
"xorq %%r9, %%r9\n" "xorq %%r9, %%r9\n"
/* (r10,r8,r9) += 2 * a0 * a3 */ /* (r10,r8,r9) += 2 * a0 * a3 */
@@ -947,7 +947,7 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
"addq %%rax, %%r10\n" "addq %%rax, %%r10\n"
"adcq %%rdx, %%r8\n" "adcq %%rdx, %%r8\n"
"adcq $0, %%r9\n" "adcq $0, %%r9\n"
/* Extract l3 */ /* Extract l8[3] */
"movq %%r10, 24(%%rsi)\n" "movq %%r10, 24(%%rsi)\n"
"xorq %%r10, %%r10\n" "xorq %%r10, %%r10\n"
/* (r8,r9,r10) += 2 * a1 * a3 */ /* (r8,r9,r10) += 2 * a1 * a3 */
@@ -965,7 +965,7 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
"addq %%rax, %%r8\n" "addq %%rax, %%r8\n"
"adcq %%rdx, %%r9\n" "adcq %%rdx, %%r9\n"
"adcq $0, %%r10\n" "adcq $0, %%r10\n"
/* Extract l4 */ /* Extract l8[4] */
"movq %%r8, 32(%%rsi)\n" "movq %%r8, 32(%%rsi)\n"
"xorq %%r8, %%r8\n" "xorq %%r8, %%r8\n"
/* (r9,r10,r8) += 2 * a2 * a3 */ /* (r9,r10,r8) += 2 * a2 * a3 */
@@ -977,45 +977,48 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
"addq %%rax, %%r9\n" "addq %%rax, %%r9\n"
"adcq %%rdx, %%r10\n" "adcq %%rdx, %%r10\n"
"adcq $0, %%r8\n" "adcq $0, %%r8\n"
/* Extract l5 */ /* Extract l8[5] */
"movq %%r9, 40(%%rsi)\n" "movq %%r9, 40(%%rsi)\n"
/* (r10,r8) += a3 * a3 */ /* (r10,r8) += a3 * a3 */
"movq %%r14, %%rax\n" "movq %%r14, %%rax\n"
"mulq %%r14\n" "mulq %%r14\n"
"addq %%rax, %%r10\n" "addq %%rax, %%r10\n"
"adcq %%rdx, %%r8\n" "adcq %%rdx, %%r8\n"
/* Extract l6 */ /* Extract l8[6] */
"movq %%r10, 48(%%rsi)\n" "movq %%r10, 48(%%rsi)\n"
/* Extract l7 */ /* Extract l8[7] */
"movq %%r8, 56(%%rsi)\n" "movq %%r8, 56(%%rsi)\n"
: :
: "S"(l), "D"(a->d) : "S"(l8), "D"(a->d)
: "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc", "memory"); : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc", "memory");
SECP256K1_CHECKMEM_MSAN_DEFINE(l8, sizeof(*l8) * 8);
#else #else
/* 160 bit accumulator. */ /* 160 bit accumulator. */
uint64_t c0 = 0, c1 = 0; uint64_t c0 = 0, c1 = 0;
uint32_t c2 = 0; uint32_t c2 = 0;
/* l[0..7] = a[0..3] * b[0..3]. */ /* l8[0..7] = a[0..3] * b[0..3]. */
muladd_fast(a->d[0], a->d[0]); muladd_fast(a->d[0], a->d[0]);
extract_fast(l[0]); extract_fast(l8[0]);
muladd2(a->d[0], a->d[1]); muladd2(a->d[0], a->d[1]);
extract(l[1]); extract(l8[1]);
muladd2(a->d[0], a->d[2]); muladd2(a->d[0], a->d[2]);
muladd(a->d[1], a->d[1]); muladd(a->d[1], a->d[1]);
extract(l[2]); extract(l8[2]);
muladd2(a->d[0], a->d[3]); muladd2(a->d[0], a->d[3]);
muladd2(a->d[1], a->d[2]); muladd2(a->d[1], a->d[2]);
extract(l[3]); extract(l8[3]);
muladd2(a->d[1], a->d[3]); muladd2(a->d[1], a->d[3]);
muladd(a->d[2], a->d[2]); muladd(a->d[2], a->d[2]);
extract(l[4]); extract(l8[4]);
muladd2(a->d[2], a->d[3]); muladd2(a->d[2], a->d[3]);
extract(l[5]); extract(l8[5]);
muladd_fast(a->d[3], a->d[3]); muladd_fast(a->d[3], a->d[3]);
extract_fast(l[6]); extract_fast(l8[6]);
VERIFY_CHECK(c1 == 0); VERIFY_CHECK(c1 == 0);
l[7] = c0; l8[7] = c0;
#endif #endif
} }