forked from zcash/zcash
-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Squashed 'src/secp256k1/' changes from 8ab24e8da..c6b6b8f1b
c6b6b8f1b Merge zcash#830: Rip out non-endomorphism code + dependencies c582abade Consistency improvements to the comments 63c6b7161 Reorder comments/function around scalar_split_lambda 2edc514c9 WNAF of lambda_split output has max size 129 4232e5b7d Rip out non-endomorphism code ebad8414b Check correctness of lambda split without -DVERIFY fe7fc1fda Make lambda constant accessible 9d2f2b44d Add tests to exercise lambda split near bounds 9aca2f7f0 Add secp256k1_split_lambda_verify acab934d2 Detailed comments for secp256k1_scalar_split_lambda 76ed922a5 Increase precision of g1 and g2 6173839c9 Switch to our own memcmp function 63150ab4d Merge zcash#827: Rename testrand functions to have test in name c5257aed0 Merge zcash#821: travis: Explicitly set --with-valgrind bb1f54280 Merge zcash#818: Add static assertion that uint32_t is unsigned int or wider a45c1fa63 Rename testrand functions to have test in name 5006895bd Merge zcash#808: Exhaustive test improvements + exhaustive schnorrsig tests 4eecb4d6e travis: VALGRIND->RUN_VALGRIND to avoid confusion with WITH_VALGRIND 66a765c77 travis: Explicitly set --with-valgrind d7838ba6a Merge zcash#813: Enable configuring Valgrind support 7ceb0b761 Merge zcash#819: Enable -Wundef warning 8b7dcdd95 Add exhaustive test for extrakeys and schnorrsig 08d7d8929 Make pubkey parsing test whether points are in the correct subgroup 87af00b51 Abstract out challenge computation in schnorrsig 63e1b2aa7 Disable output buffering in tests_exhaustive.c 39f67dd07 Support splitting exhaustive tests across cores e99b26fcd Give exhaustive_tests count and seed cmdline inputs 49e6630bc refactor: move RNG seeding to testrand b110c106f Change exhaustive test groups so they have a point with X=1 cec7b18a3 Select exhaustive lambda in function of order 78f6cdfaa Make the curve B constant a secp256k1_fe d7f39ae4b Delete gej_is_valid_var: unused outside tests 8bcd78cd7 Make secp256k1_scalar_b32 detect overflow in scalar_low c498366e5 Move exhaustive tests for recovery to module be3179154 Make group order purely compile-time in exhaustive tests e73ff3092 Enable -Wundef warning c0041b5cf Add static assertion that uint32_t is unsigned int or wider 4ad408faf Merge zcash#782: Check if variable=yes instead of if var is set in travis.sh 412bf874d configure: Allow specifying --with[out]-valgrind explicitly 34debf7a6 Modify .travis.yml to explictly pass no in env vars instead of setting to nothing a0e99fc12 Merge zcash#814: tests: Initialize random group elements fully 5738e8622 tests: Initialize random group elements fully c9939ba55 Merge zcash#812: travis: run bench_schnorrsig a51f2af62 travis: run bench_schnorrsig ef37761fe Change travis.sh to check if variables are equal to yes instead of not-empty. Before this, setting `VALGRIND=wat` was considered as true, and to make it evaluate as false you had to unset the variable `VALGRIND=` but not it checks if `VALGRIND=yes` and if it's not `yes` then it's evaluated to false git-subtree-dir: src/secp256k1 git-subtree-split: c6b6b8f1bb044d7d1aa065ebb674adde98a36a8e
- Loading branch information
Showing
39 changed files
with
1,586 additions
and
947 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| # Define field size and field | ||
| P = 2^256 - 2^32 - 977 | ||
| F = GF(P) | ||
| BETA = F(0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee) | ||
|
|
||
| assert(BETA != F(1) and BETA^3 == F(1)) | ||
|
|
||
| orders_done = set() | ||
| results = {} | ||
| first = True | ||
| for b in range(1, P): | ||
| # There are only 6 curves (up to isomorphism) of the form y^2=x^3+B. Stop once we have tried all. | ||
| if len(orders_done) == 6: | ||
| break | ||
|
|
||
| E = EllipticCurve(F, [0, b]) | ||
| print("Analyzing curve y^2 = x^3 + %i" % b) | ||
| n = E.order() | ||
| # Skip curves with an order we've already tried | ||
| if n in orders_done: | ||
| print("- Isomorphic to earlier curve") | ||
| continue | ||
| orders_done.add(n) | ||
| # Skip curves isomorphic to the real secp256k1 | ||
| if n.is_pseudoprime(): | ||
| print(" - Isomorphic to secp256k1") | ||
| continue | ||
|
|
||
| print("- Finding subgroups") | ||
|
|
||
| # Find what prime subgroups exist | ||
| for f, _ in n.factor(): | ||
| print("- Analyzing subgroup of order %i" % f) | ||
| # Skip subgroups of order >1000 | ||
| if f < 4 or f > 1000: | ||
| print(" - Bad size") | ||
| continue | ||
|
|
||
| # Iterate over X coordinates until we find one that is on the curve, has order f, | ||
| # and for which curve isomorphism exists that maps it to X coordinate 1. | ||
| for x in range(1, P): | ||
| # Skip X coordinates not on the curve, and construct the full point otherwise. | ||
| if not E.is_x_coord(x): | ||
| continue | ||
| G = E.lift_x(F(x)) | ||
|
|
||
| print(" - Analyzing (multiples of) point with X=%i" % x) | ||
|
|
||
| # Skip points whose order is not a multiple of f. Project the point to have | ||
| # order f otherwise. | ||
| if (G.order() % f): | ||
| print(" - Bad order") | ||
| continue | ||
| G = G * (G.order() // f) | ||
|
|
||
| # Find lambda for endomorphism. Skip if none can be found. | ||
| lam = None | ||
| for l in Integers(f)(1).nth_root(3, all=True): | ||
| if int(l)*G == E(BETA*G[0], G[1]): | ||
| lam = int(l) | ||
| break | ||
| if lam is None: | ||
| print(" - No endomorphism for this subgroup") | ||
| break | ||
|
|
||
| # Now look for an isomorphism of the curve that gives this point an X | ||
| # coordinate equal to 1. | ||
| # If (x,y) is on y^2 = x^3 + b, then (a^2*x, a^3*y) is on y^2 = x^3 + a^6*b. | ||
| # So look for m=a^2=1/x. | ||
| m = F(1)/G[0] | ||
| if not m.is_square(): | ||
| print(" - No curve isomorphism maps it to a point with X=1") | ||
| continue | ||
| a = m.sqrt() | ||
| rb = a^6*b | ||
| RE = EllipticCurve(F, [0, rb]) | ||
|
|
||
| # Use as generator twice the image of G under the above isormorphism. | ||
| # This means that generator*(1/2 mod f) will have X coordinate 1. | ||
| RG = RE(1, a^3*G[1]) * 2 | ||
| # And even Y coordinate. | ||
| if int(RG[1]) % 2: | ||
| RG = -RG | ||
| assert(RG.order() == f) | ||
| assert(lam*RG == RE(BETA*RG[0], RG[1])) | ||
|
|
||
| # We have found curve RE:y^2=x^3+rb with generator RG of order f. Remember it | ||
| results[f] = {"b": rb, "G": RG, "lambda": lam} | ||
| print(" - Found solution") | ||
| break | ||
|
|
||
| print("") | ||
|
|
||
| print("") | ||
| print("") | ||
| print("/* To be put in src/group_impl.h: */") | ||
| first = True | ||
| for f in sorted(results.keys()): | ||
| b = results[f]["b"] | ||
| G = results[f]["G"] | ||
| print("# %s EXHAUSTIVE_TEST_ORDER == %i" % ("if" if first else "elif", f)) | ||
| first = False | ||
| print("static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_GE_CONST(") | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x" % tuple((int(G[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8))) | ||
| print(");") | ||
| print("static const secp256k1_fe secp256k1_fe_const_b = SECP256K1_FE_CONST(") | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(b) >> (32 * (7 - i))) & 0xffffffff for i in range(4))) | ||
| print(" 0x%08x, 0x%08x, 0x%08x, 0x%08x" % tuple((int(b) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8))) | ||
| print(");") | ||
| print("# else") | ||
| print("# error No known generator for the specified exhaustive test group order.") | ||
| print("# endif") | ||
|
|
||
| print("") | ||
| print("") | ||
| print("/* To be put in src/scalar_impl.h: */") | ||
| first = True | ||
| for f in sorted(results.keys()): | ||
| lam = results[f]["lambda"] | ||
| print("# %s EXHAUSTIVE_TEST_ORDER == %i" % ("if" if first else "elif", f)) | ||
| first = False | ||
| print("# define EXHAUSTIVE_TEST_LAMBDA %i" % lam) | ||
| print("# else") | ||
| print("# error No known lambda for the specified exhaustive test group order.") | ||
| print("# endif") | ||
| print("") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.