Commit Graph

2829 Commits

Author SHA1 Message Date
Pieter Wuille
7a33db35cd Optimization: move (2^COMB_BITS-1)/2 term into ctx->scalar_offset
It is unnecessary to recompute this term needed by the SDMC algorithm
for every multiplication; move it into the context scalar_offset value
instead.
2024-04-19 11:43:45 -04:00
Pieter Wuille
ed2a056f3d Provide 3 configurations accessible through ./configure 2024-04-19 11:43:26 -04:00
Pieter Wuille
5f7be9f6a5 Always generate tables for current (blocks,teeth) config 2024-04-19 11:43:26 -04:00
Peter Dettman
fde1dfcd8d Signed-digit multi-comb ecmult_gen algorithm
This introduces the signed-digit multi-comb multiplication algorithm
for constant-time G multiplications (ecmult_gen). It is based on
section 3.3 of "Fast and compact elliptic-curve cryptography" by
Mike Hamburg (see https://eprint.iacr.org/2012/309).

Original implementation by Peter Dettman, with changes by Pieter Wuille
to use scalars for recoding, and additional comments.
2024-04-19 11:43:22 -04:00
Pieter Wuille
486518b350 Make exhaustive tests's scalar_inverse(&x,&x) work
The old code overwrote the input at the start of the function,
making a call like secp256k1_scalar_inverse(&x,&x) always fail.
2024-04-19 10:27:15 -04:00
Pieter Wuille
ab45c3e089 Initial gej blinding -> final ge blinding
Instead of having the starting point of the ecmult_gen computation be
offset, do it with the final point. This enables reasoning over the
set of points reachable in intermediary computations, which can be
leveraged by potential future optimization.

Because the final point is in affine coordinates, its projective
blinding is no longer possible. It will be reintroduced again in
a different way, in a later commit.

Also introduce some more comments and more descriptive names.
2024-04-19 10:27:12 -04:00
Tim Ruffing
aa00a6b892 Introduce CEIL_DIV macro and use it 2024-04-15 13:18:27 -04:00
Tim Ruffing
d8311688bd Merge bitcoin-core/secp256k1#1515: ci: Note affected clangs in comment on ASLR quirk
a85e2233e7 ci: Note affected clangs in comment on ASLR quirk (Tim Ruffing)

Pull request description:

  Resolves #1506.

ACKs for top commit:
  fanquake:
    ACK a85e2233e7

Tree-SHA512: a82d6f5e57175434c1f66c7b01c90eb2877db794d7f5213b3652ecb51ebb7c03ff13ab13424b3e6d41b9eaa504af330f16855e32e63d1805c1a475f462c6da66
2024-04-04 11:52:27 +02:00
Tim Ruffing
a85e2233e7 ci: Note affected clangs in comment on ASLR quirk
Resolves #1506.
2024-04-04 11:49:00 +02:00
Tim Ruffing
4b77fec67a Merge bitcoin-core/secp256k1#1512: msan: notate more variable assignments from assembly code
f7f0184ba1 msan: notate more variable assignments from assembly code (Cory Fields)
a61339149f change inconsistent array param to pointer (Cory Fields)

Pull request description:

  This was missed in 31ba404944 because older versions of clang did not complain about it. But clang-17, at least, does.

  The array-as-a-param makes this annoying because `sizeof(l)` is not helpful. I'd be happy to change the size calculation if there are any better suggestions or strong preferences.

ACKs for top commit:
  sipa:
    utACK f7f0184ba1
  real-or-random:
    ACK f7f0184ba1 tests work fine with clang 17 and `./configure CFLAGS="-fsanitize=memory -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer -g -O1 -fno-optimize-sibling-calls" CC=clang`

Tree-SHA512: 8ab22209ef322a10f500b123c82ae5e7141ae1da0e7a890cbf90bd7d2eb11f397db4ccfe15a1666f2f49228585cccbf5bec741effebd1e2c6012cb7ea1689675
2024-04-03 19:06:22 +02:00
Cory Fields
f7f0184ba1 msan: notate more variable assignments from assembly code
This was missed in 31ba404944 because older
versions of clang did not complain about it. But clang-17, at least, does.
2024-04-03 16:03:19 +00:00
Cory Fields
a61339149f change inconsistent array param to pointer
The behavior is identical, but the former syntax suggests guarantees that
don't actually exist.
2024-04-03 16:03:19 +00:00
Tim Ruffing
05bfab69ae Merge bitcoin-core/secp256k1#1507: ci: Add workaround for ASLR bug in sanitizers
a5e8ab2484 ci: Add sanitizer env variables to debug output (Tim Ruffing)
84a93de4d2 ci: Add workaround for ASLR bug in sanitizers (Tim Ruffing)

Pull request description:

  Fixes #1506.

  This also adds the sanitizer env variables to our debug output as suggested in the same issue.

ACKs for top commit:
  sipa:
    utACK a5e8ab2484
  jonasnick:
    ACK a5e8ab2484

Tree-SHA512: 5162d14eeec01e088c600ed77e21c5ffd4dec23327b7e81b5ecac59b7c535cac97cd7b7b744c767766036dfc6d9152a9933eb326cf4065d56c46e2ee858da662
2024-03-20 13:25:32 +01:00
Tim Ruffing
a5e8ab2484 ci: Add sanitizer env variables to debug output 2024-03-19 23:52:15 +01:00
Tim Ruffing
84a93de4d2 ci: Add workaround for ASLR bug in sanitizers
Fixes #1506.
2024-03-19 23:52:15 +01:00
Tim Ruffing
a7907b1af2 Merge BlockstreamResearch/secp256k1-zkp#261: Schnorr (Incremental) Half Aggregation
3a9b1d46a3 New Experimental Module: Incremental Half-Aggregation for Schnorr Signatures (Benedikt)

Pull request description:

  Revisited PR #130 by jonasnick.
  I am happy to hear your thoughts.

  **Summary of changes compared to #130:**

  - Address comments from rustyrussell
  - Use tagged hash
  - Compute hashes with common prefix by copying midstate
  - Allow Incremental Aggregation and make code consistent with the [draft spec](https://github.com/BlockstreamResearch/cross-input-aggregation/blob/master/half-aggregation.mediawiki)

ACKs for top commit:
  real-or-random:
    ACK 3a9b1d46a3

Tree-SHA512: 27239033f8b28ecf87ea310b3dd5a19dbbe6fd07495db71ef7017f8f444ec25a12897087d1bea0a2e9c3df77d7f17c38b183d7fe768858da2180f26624add4aa
2024-03-05 12:17:22 +01:00
Jonas Nick
427e86b9ed Merge bitcoin-core/secp256k1#1490: tests: improve fe_sqr test (issue #1472)
2028069df2 doc: clarify input requirements for secp256k1_fe_mul (Sebastian Falbesoner)
11420a7a28 tests: improve fe_sqr test (Sebastian Falbesoner)

Pull request description:

ACKs for top commit:
  real-or-random:
    utACK 2028069df2
  jonasnick:
    ACK 2028069df2

Tree-SHA512: bb01bf6ceb34f0475a60b8dcb0cec000859a0c20f1009426bd8cab609f1941f44f84802f1565a719f7d2a55466076fb1591a353b1b75e6c0ceac44806d908176
2024-02-27 17:17:00 +00:00
Sebastian Falbesoner
2028069df2 doc: clarify input requirements for secp256k1_fe_mul
"... neither can be equal to b." could suggest that the values are not
allowed to be identical, but what is meant here is that the mentioned
inputs shouldn't point to the same object.
2024-02-27 16:32:49 +01:00
Sebastian Falbesoner
11420a7a28 tests: improve fe_sqr test
Currently the `run_sqr` test doesn't do anything with the
result of the `fe_sqr` call. Improve that by checking that
the equation `(x+y)*(x-y) = x^2 - y^2` holds for some random
values y, as suggested in issue #1471 by real-or-random.
The existing loop for generating the x values is kept as-is.
2024-02-27 16:32:45 +01:00
Jonas Nick
cdc9a6258e Merge bitcoin-core/secp256k1#1489: tests: add missing fe comparison checks for inverse field test cases
e7bdddd9c9 refactor: rename `check_fe_equal` -> `fe_equal` (Sebastian Falbesoner)
00111c9c56 tests: add missing fe comparison checks for inverse field test cases (Sebastian Falbesoner)

Pull request description:

ACKs for top commit:
  real-or-random:
    utACK e7bdddd9c9
  jonasnick:
    ACK e7bdddd9c9

Tree-SHA512: 1d14cb87bf3d190be6e11ae205ed25090758aae589f50793d9bcbdb3c04378ca08f6a3d41567fdf472786ea3234cf1f3b9c95ece8b605b4a7667a81a27b249e2
2024-02-27 15:18:20 +00:00
Tim Ruffing
d926510cf7 Merge bitcoin-core/secp256k1#1496: msan: notate variable assignments from assembly code
31ba404944 msan: notate variable assignments from assembly code (Cory Fields)
e7ea32e30a msan: Add SECP256K1_CHECKMEM_MSAN_DEFINE which applies to memory sanitizer and not valgrind (Cory Fields)

Pull request description:

  msan isn't smart enough to see that these are set without some help.

  This was pointed out here: https://github.com/bitcoin-core/secp256k1/pull/1169#issuecomment-1370003449

  With this commit, msan output is clean even with x86 asm turned on.

ACKs for top commit:
  real-or-random:
    utACK 31ba404944
  hebasto:
    re-ACK 31ba404944.

Tree-SHA512: c9c51fe542247e1e0a93f6d0063d119cf777ca8c1b7e9c8e45e168a2020dc503872eb2a78004725de81267a3ce78c923be1f8546fb92a3e95fc7ef034e5ba932
2024-02-27 14:47:18 +01:00
Benedikt
3a9b1d46a3 New Experimental Module: Incremental Half-Aggregation for Schnorr Signatures 2024-02-27 14:04:40 +01:00
Cory Fields
31ba404944 msan: notate variable assignments from assembly code
msan isn't smart enough to see that these are set without some help.
2024-02-23 17:30:39 +00:00
Cory Fields
e7ea32e30a msan: Add SECP256K1_CHECKMEM_MSAN_DEFINE which applies to memory sanitizer and not valgrind 2024-02-23 17:30:39 +00:00
Jonas Nick
900a4371d3 Merge elementsproject/secp256k1-zkp#290: configure: Clean ups
860e3bb294 configure: Fix reduced surjection proof size (Tim Ruffing)
0873358f77 configure: Reorder modules also for AC_ARG_ENABLE (Tim Ruffing)
9de973f613 configure: Document canonical order of modules (Tim Ruffing)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 860e3bb294

Tree-SHA512: cfbaf9cb8a686aeab43ef6727b38d94467b862746062c1c06876bd98614ada7a00bc617481b0e0059dc294250a94a53581f3ffd685aa05c47a665950b280da51
2024-02-16 14:04:16 +00:00
Tim Ruffing
860e3bb294 configure: Fix reduced surjection proof size
The variable set automatically by AC_ARG_ENABLE is called enable_...
2024-02-16 10:59:25 +01:00
Tim Ruffing
0873358f77 configure: Reorder modules also for AC_ARG_ENABLE 2024-02-16 10:59:25 +01:00
Tim Ruffing
9de973f613 configure: Document canonical order of modules 2024-02-16 10:59:25 +01:00
Jonas Nick
1e04d32447 Merge elementsproject/secp256k1-zkp#288: cmake: Add support for -zkp modules
4228fd1124 cmake: Add support for -zkp modules (Tim Ruffing)

Pull request description:

ACKs for top commit:
  jonasnick:
    utACK 4228fd1124

Tree-SHA512: 72606bb3421a4d6479c5cbc94e2468d6a9a53581f571fd5340edc41595eac18fbb04dcaacce8f39020e32a69b733ba6743aac4b901e1600f5245a4a04cb0e27a
2024-02-02 19:47:59 +00:00
Sebastian Falbesoner
e7bdddd9c9 refactor: rename check_fe_equal -> fe_equal
As this function doesn't do any checking, it's better to rename it,
so that it's less likely to miss the needed `CHECK`.
2024-02-01 15:34:40 +01:00
Sebastian Falbesoner
00111c9c56 tests: add missing fe comparison checks for inverse field test cases
`check_fe_equal` is a wrapper around `secp256k1_fe_equal` that takes
care of normalization. Since it doesn't check anything itself, the
CHECK macro is needed at the call-sites to actually ensure equality.
2024-02-01 00:49:25 +01:00
Tim Ruffing
4228fd1124 cmake: Add support for -zkp modules
Co-authored-by: lightyear15 <g.minist8@gmail.com>
2024-01-25 15:58:52 +01:00
Tim Ruffing
0653a25d50 Merge bitcoin-core/secp256k1#1486: ci: Update cache action
94a14d5290 ci: Update cache action (Hennadii Stepanov)

Pull request description:

  This PR fixes deprecation warnings for Node.js 16 actions in the GHA CI.

  See:
  - https://github.com/marketplace/actions/cache
  - https://github.com/actions/cache/releases/tag/v4.0.0

ACKs for top commit:
  real-or-random:
    ACK 94a14d5290 thanks!

Tree-SHA512: 6f520908aaadf179955255a2b3a93c2cb96f23cf3a9d00a53b3ae635007983337f1a768cb6039e0e0b1bc9630930b143dd1c650f366185fd20727ab97221519b
2024-01-25 14:56:56 +01:00
Hennadii Stepanov
94a14d5290 ci: Update cache action
This change fixes deprecation warnings for Node.js 16 actions in the GHA
CI.

See:
- https://github.com/marketplace/actions/cache
- https://github.com/actions/cache/releases/tag/v4.0.0
2024-01-25 12:09:47 +00:00
Jonas Nick
03aecafe4c Merge elementsproject/secp256k1-zkp#286: shallue_van_de_woestijne rewrite
6b9d335ef6 generator: add shallue_van_de_woestijne test for t = 0 (Jonas Nick)
26522241b4 generators: shallue_van_de_woestijne improve comments (Jonas Nick)
5d87e80c69 shallue_van_de_woestijne rewrite (Russell O'Connor)

Pull request description:

ACKs for top commit:
  real-or-random:
    utACK 6b9d335ef6
  jonasnick:
    ACK 6b9d335ef6

Tree-SHA512: 4a5ca291ec760ea54a43ff0b811ca1fac024002172d4639919fb97f63cfa0e75a580674c86a5a0ac9866e00520be4dd8d1d37b6d2fd8d2057e42a804dbf9127c
2024-01-25 09:07:16 +00:00
Jonas Nick
6b9d335ef6 generator: add shallue_van_de_woestijne test for t = 0 2024-01-24 17:55:38 -05:00
Jonas Nick
26522241b4 generators: shallue_van_de_woestijne improve comments 2024-01-24 17:55:36 -05:00
Russell O'Connor
5d87e80c69 shallue_van_de_woestijne rewrite
The previous implementation returns an off-curve point for the input t=0.

This rewrite addresses that issue by implicity returning the on-curve point
(d, sqrt(1 + b)), which is the point that the paper Indifferentiable Hashing
to Barreto–Naehrig Curves suggests returning in this case.

Note: At the moment it is cryptographically impossible for the input t to be 0.
2024-01-24 17:50:48 -05:00
Jonas Nick
2483627299 Merge bitcoin-core/secp256k1#1483: cmake: Recommend native CMake commands in README
3777e3f36a cmake: Recommend native CMake commands in README (Tim Ruffing)

Pull request description:

ACKs for top commit:
  hebasto:
    ACK 3777e3f36a
  jonasnick:
    ACK 3777e3f36a

Tree-SHA512: 884e54ee3ec9617edbb98d439ccd3fa8b3d9448969a4f5a88d22d034329ec5024238d6f91e28160f82f77eed678100266ac8b5495b6072b48caa0514a9cec881
2024-01-23 19:41:01 +00:00
Jonas Nick
5ad3aa3dcd Merge bitcoin-core/secp256k1#1484: tests: Drop redundant _scalar_check_overflow calls
51df2d9ab3 tests: Drop redundant _scalar_check_overflow calls (Tim Ruffing)

Pull request description:

ACKs for top commit:
  stratospher:
    ACK 51df2d9.
  jonasnick:
    ACK 51df2d9ab3

Tree-SHA512: 52caff34b0cbb8570b6aa962c86c249e216d3a78661715c6adf6804379c60be049e36fcb714cd562d350787949dfccf95d0b9a885480e08513664864abd36928
2024-01-23 19:30:00 +00:00
Jonas Nick
b5a6812bd6 Merge elementsproject/secp256k1-zkp#285: Upstream PRs 1426, 1430, 1184, 1437, 1442, 1441, 1445, 1438, 1393, 1446, 1450, 1451, 1431, 990, 1455, 1380, 1465, 1466, 1473, 1474, 1476, 1480, 1468, 1482, 1249
b673a43090 musig: new upstream def of VERIFY_CHECK (empty in non-VERIFY) (Jonas Nick)
cd173688fb musig: replace point_{save,load} with ge_{to,from}_bytes (Jonas Nick)
33db8edb27 group: add ge_to_bytes and ge_from_bytes (Jonas Nick)
de54a1eff7 musig2: clean up ctx doc in include file (Jonas Nick)
4f65698865 extrakeys: Remove redundant secp256k1_pubkey_cmp (Tim Ruffing)
c29f28e638 include: make docs more consistent (Tim Ruffing)
42f8c51402 cmake: Add `SECP256K1_LATE_CFLAGS` configure option (Hennadii Stepanov)
e6822678ea build: Error if required module explicitly off (Tim Ruffing)
89ec583ccf build: Clean up handling of module dependencies (Tim Ruffing)
b37fdb28ce check-abi: Minor UI improvements (Tim Ruffing)
ad5f589a94 check-abi: Default to HEAD for new version (Tim Ruffing)
9fb7e2f156 release process: Style and formatting nits (Tim Ruffing)
e7053d065b release process: Add email step (Tim Ruffing)
429d21dc79 release process: Run sanity checks on release PR (Tim Ruffing)
ba5d72d626 assumptions: Use new STATIC_ASSERT macro (Tim Ruffing)
e53c2d9ffc Require that sizeof(secp256k1_ge_storage) == 64 (Tim Ruffing)
d0ba2abbff util: Add STATIC_ASSERT macro (Tim Ruffing)
da7bc1b803 include: in doc, remove article in front of "pointer" (Jonas Nick)
aa3dd5280b include: make doc about ctx more consistent (Jonas Nick)
e3f690015a include: remove obvious "cannot be NULL" doc (Jonas Nick)
3dbfb48946 tests: restore scalar_mul test (Jonas Nick)
d77170a88d Fix typos (shuoer86)
4b2e06f460 release cleanup: bump version after 0.4.1 (Jonas Nick)
672053d801 release: prepare for 0.4.1 (Jonas Nick)
74a4d974d5 doc: Add ABI checking with `check-abi.sh` to the Release Process (Hennadii Stepanov)
e7f830e32c Add `tools/check-abi.sh` (Hennadii Stepanov)
3928b7c383 doc: improve secp256k1_fe_set_b32_mod doc (Coding Enthusiast)
e02f313b1f Add comment on length checks when parsing ECDSA sigs (Tim Ruffing)
0e5ea62207 CONTRIBUTING: add some coding and style conventions (Jonas Nick)
1a432cb982 README: update first sentence (Jonas Nick)
0922a047fb docs: move coverage report instructions to CONTRIBUTING (Jonas Nick)
76880e4015 Add CONTRIBUTING.md including scope and guidelines for new code (Jonas Nick)
d2e36a2b81 changelog: add entry for "field: Remove x86_64 asm" (Jonas Nick)
04af0ba162 Replace ge_equals_ge[,j] calls with group.h equality calls (Pieter Wuille)
60525f6c14 Add unit tests for group.h equality functions (Pieter Wuille)
a47cd97d51 Add group.h ge/gej equality functions (Pieter Wuille)
f07cead0ca build: Don't call assembly an optimization (Tim Ruffing)
2f0762fa8f field: Remove x86_64 asm (Tim Ruffing)
bb4672342e remove VERIFY_SETUP define (Sebastian Falbesoner)
a3a3e11acd remove unneeded VERIFY_SETUP uses in ECMULT_CONST_TABLE_GET_GE macro (Sebastian Falbesoner)
a0fb68a2e7 introduce and use SECP256K1_SCALAR_VERIFY macro (Sebastian Falbesoner)
cf25c86d05 introduce and use SECP256K1_{FE,GE,GEJ}_VERIFY macros (Sebastian Falbesoner)
5d89bc031b remove superfluous `#ifdef VERIFY`/`#endif` preprocessor conditions (Sebastian Falbesoner)
c2688f8de9 redefine VERIFY_CHECK to empty in production (non-VERIFY) mode (Sebastian Falbesoner)
dcdda31f2c Tighten secp256k1_fe_mul_inner's VERIFY_BITS checks (Russell O'Connor)
8e2a5fe908 correct assertion for secp256k1_fe_mul_inner (roconnor-blockstream)
1ddd76af0a bench: add --help option to bench_internal (Sebastian Falbesoner)
33dc7e4d3e asm: add .note.GNU-stack section for non-exec stack (fanquake)
10271356c8 Return temporaries to being unsigned in secp256k1_fe_sqr_inner (roconnor-blockstream)
8185e72d29 ci: Ignore internal errors in snapshot compilers (Hennadii Stepanov)
355bbdf38a Add changelog entry for signed-digit ecmult_const algorithm (Pieter Wuille)
21f49d9bec Remove unused secp256k1_scalar_shr_int (Pieter Wuille)
115fdc7232 Remove unused secp256k1_wnaf_const (Pieter Wuille)
aa9f3a3c00 ecmult_const: add/improve tests (Jonas Nick)
4d16e90111 Signed-digit based ecmult_const algorithm (Pieter Wuille)
ba523be067 make SECP256K1_SCALAR_CONST reduce modulo exhaustive group order (Pieter Wuille)
2140da9cd5 Add secp256k1_scalar_half for halving scalars (+ tests/benchmarks). (Pieter Wuille)
5dab0baa80 README: remove CI badge (Jonas Nick)
fa4d6c76b6 ci/cirrus: Add native ARM64 persistent workers (MarcoFalke)
2262d0eaab ci/cirrus: Bring back skeleton .cirrus.yml without jobs (Tim Ruffing)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK b673a43090

Tree-SHA512: fe4f4d1db71518cad80724c21915a6235ffc21aadc06226f6dc29237e786f546189165ffdbe64b90b094ada4c36a031caa712c1f21bf280d33ba221fda2e0019
2024-01-23 19:07:05 +00:00
Jonas Nick
b673a43090 musig: new upstream def of VERIFY_CHECK (empty in non-VERIFY)
Remove explicity VERIFY_CHECKs in keyaggcoef_internal since normalization should
be checked in the fe_* functions.
2024-01-23 16:04:45 +01:00
Jonas Nick
cd173688fb musig: replace point_{save,load} with ge_{to,from}_bytes 2024-01-23 16:04:45 +01:00
Jonas Nick
33db8edb27 group: add ge_to_bytes and ge_from_bytes 2024-01-23 16:04:45 +01:00
Jonas Nick
de54a1eff7 musig2: clean up ctx doc in include file 2024-01-23 16:04:45 +01:00
Tim Ruffing
4f65698865 extrakeys: Remove redundant secp256k1_pubkey_cmp
It was a verbatim copy of secp256k1_ec_pubkey_cmp.
2024-01-23 16:04:45 +01:00
Tim Ruffing
c29f28e638 include: make docs more consistent
Like upstream https://github.com/bitcoin-core/secp256k1/pull/1476 .
2024-01-23 16:04:45 +01:00
Tim Ruffing
e626f00d1e Merge commits 'b314cf28 1f1bb78b 40f50d0f c891c5c2 ea47c82e e7210393 c1b49664 5814d848 07687e81 10e6d29b d3e29db8 e2c9888e 4197d667 5e9a4d7a 77af1da9 1a81df82 1ad5185c efe85c70 79e09451 d373bf6d 74b7c3b5 a9db9f2d 44378867 3bf4d68f e4af41c6 ' into temp-merge-1249 2024-01-23 16:04:45 +01:00
Tim Ruffing
51df2d9ab3 tests: Drop redundant _scalar_check_overflow calls
Redundant since d23da6d557.
2024-01-17 16:54:04 +01:00
Tim Ruffing
3777e3f36a cmake: Recommend native CMake commands in README
Resolves one item in #1235. Closes #1294.
2024-01-17 15:19:53 +01:00