Commit Graph
121 Commits
Author SHA1 Message Date
Pieter Wuille c35ff1ea44 Convert lambda splitter to pure scalar code.
This enables the use of the endomorphism optimization without bignum.
2014-12-02 16:50:00 +01:00
Peter Dettman cc604e9842 Avoid division when decomposing scalars
- In secp256k1_gej_split_exp, there are two divisions used. Since the denominator is a constant known at compile-time, each can be replaced by a multiplication followed by a right-shift (and rounding).
- Add the constants g1, g2 for this purpose and rewrite secp256k1_scalar_split_lambda_var accordingly.
- Remove secp256k1_num_div since no longer used

Rebased-by: Pieter Wuille
2014-12-02 16:50:00 +01:00
Pieter Wuille f24041d6aa Switch all EC/ECDSA logic from num to scalar 2014-11-30 23:38:01 +01:00
Pieter Wuille 0b73059709 Switch wnaf splitting from num-based to scalar-based 2014-11-30 23:38:01 +01:00
Pieter Wuille 3ce74b1266 Tweak precomputed table size for G 2014-11-26 23:45:49 +01:00
Pieter Wuille 665775b2b9 Don't split the g factor when not using endomorphism 2014-11-25 14:29:02 +01:00
Gregory Maxwell 71712b27e5 Switch to C89 comments in prep for making the whole codebase C89 compatible.
This should be whitespace/comment only changes and should produce the same
object code.
2014-11-15 07:33:07 -08:00
Gregory Maxwell a4a43d7543 Reorder static to comply with C99 and switch to the inline macro. 2014-11-12 13:07:55 -08:00
Gregory Maxwell 8563713a4f Add non-null and unused-result warnings for the external API.
GCC (and clang) supports extensions to annotate functions so that their
 results must be used and so that their arguments can't be statically
 provable to be null. If a caller violates these requirements they
 get a warning, so this helps them write correct code.

I deployed this in libopus a couple years ago with good success, and
 the implementation here is basically copied straight from that.

One consideration is that the non-null annotation teaches the optimizer
 and will actually compile out runtime non-nullness checks as dead-code.
 Since this is usually not whats wanted, the non-null annotations are
 disabled when compiling the library itself.

The commit also removes some dead inclusions of assert.h and introduces
 compatibility macros for restrict and inline in preparation for some
 portability improvements.
2014-11-12 12:23:09 -08:00
Pieter Wuille da55986fdf Label variable-time functions correctly and don't use those in sign 2014-11-04 02:50:06 -08:00
Pieter Wuille 501d58f098 Get rid of {num,scalar,ecdsa_sig}_{init,free} 2014-11-03 01:31:04 -08:00
Pieter Wuille 949c1ebb5e Split up ecmult and ecmult_gen entirely 2014-10-26 03:42:24 -07:00
Pieter Wuille c259a7cbc0 Set precomputation table late and unset early.
Set the global pointer to the precomputation table only after initializing
it completely, and unset it before doing any uninitialization.

This causes fail-fast behavior in case of race conditions between
initialization and operations using it.
2014-09-13 17:19:30 +02:00
Pieter Wuille 04e34d18c3 Split up signing and verification initialization 2014-09-13 17:14:17 +02:00
Pieter Wuille 62c3f55a9d Nothing-up-my-sleeving blinding for a*G 2014-09-01 14:56:12 +02:00
Pieter Wuille 1c7fa133a6 Add VERIFY_CHECK/DEBUG_CHECK and use CHECK macros more 2014-08-26 01:23:51 +02:00
Gregory Maxwell 2f6c801911 Try to not leave secret data on the stack or heap.
This makes a basic effort and has not been audited.
Doesn't appear to have a measurable performance impact on bench.

It also adds a secp256k1_num_free to secp256k1_ecdsa_pubkey_create.
2014-08-14 07:06:36 -07:00
Peter Dettman f16be77ffc Use batch inversion in G precomputation 2014-07-17 15:33:00 +07:00
Pieter Wuille 0592d117da Introduce CHECK() for tests that works with NDEBUG. 2014-06-16 01:30:17 +02:00
Peter Dettman d7fd4d0f6b Use endomorphism in precomputations 2014-05-22 10:17:30 +07:00
Pieter Wuille 11ab562203 Move implementations from impl/*.h to *_impl.h 2014-03-12 18:40:02 +01:00