9535058a7b
This commit reworks the way that the pre-computed table which is used to accelerate scalar base multiple is generated and loaded to make use of the go generate infrastructure and greatly reduce the memory needed to compile as well as speed up the compile. Previously, the table was being generated using the in-memory representation directly written into the file. Since the table has a very large number of entries, the Go compiler was taking up to nearly 1GB to compile. It also took a comparatively long period of time to compile. Instead, this commit modifies the generated table to be a serialized, compressed, and base64-encoded byte slice. At init time, this process is reversed to create the in-memory representation. This approach provides fast compile times with much lower memory needed to compile (16MB versus 1GB). In addition, the init time cost is extremely low, especially as compared to computing the entire table. Finally, the automatic generation wasn't really automatic. It is now fully automatic with 'go generate'.
693 lines
28 KiB
Go
693 lines
28 KiB
Go
// Copyright 2010 The Go Authors. All rights reserved.
|
|
// Copyright 2011 ThePiachu. All rights reserved.
|
|
// Copyright 2013-2014 Conformal Systems LLC. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package btcec
|
|
|
|
// References:
|
|
// [SECG]: Recommended Elliptic Curve Domain Parameters
|
|
// http://www.secg.org/sec2-v2.pdf
|
|
|
|
// This package operates, internally, on Jacobian coordinates. For a given
|
|
// (x, y) position on the curve, the Jacobian coordinates are (x1, y1, z1)
|
|
// where x = x1/z1² and y = y1/z1³. The greatest speedups come when the whole
|
|
// calculation can be performed within the transform (as in ScalarMult and
|
|
// ScalarBaseMult). But even for Add and Double, it's faster to apply and
|
|
// reverse the transform than to operate in affine coordinates.
|
|
|
|
import (
|
|
"crypto/elliptic"
|
|
"math/big"
|
|
"sync"
|
|
)
|
|
|
|
//TODO: examine if we need to care about EC optimization as descibed here
|
|
// https://bitcointalk.org/index.php?topic=155054.0;all
|
|
|
|
var (
|
|
// fieldOne is simply the integer 1 in field representation. It is
|
|
// used to avoid needing to create it multiple times during the internal
|
|
// arithmetic.
|
|
fieldOne = new(fieldVal).SetInt(1)
|
|
)
|
|
|
|
// KoblitzCurve supports a koblitz curve implementation that fits the ECC Curve
|
|
// interface from crypto/elliptic.
|
|
type KoblitzCurve struct {
|
|
*elliptic.CurveParams
|
|
q *big.Int
|
|
H int // cofactor of the curve.
|
|
bytePoints *[32][256][3]fieldVal
|
|
}
|
|
|
|
// Params returns the parameters for the curve.
|
|
func (curve *KoblitzCurve) Params() *elliptic.CurveParams {
|
|
return curve.CurveParams
|
|
}
|
|
|
|
// bigAffineToField takes an affine point (x, y) as big integers and converts
|
|
// it to an affine point as field values.
|
|
func (curve *KoblitzCurve) bigAffineToField(x, y *big.Int) (*fieldVal, *fieldVal) {
|
|
x3, y3 := new(fieldVal), new(fieldVal)
|
|
x3.SetByteSlice(x.Bytes())
|
|
y3.SetByteSlice(y.Bytes())
|
|
|
|
return x3, y3
|
|
}
|
|
|
|
// fieldJacobianToBigAffine takes a Jacobian point (x, y, z) as field values and
|
|
// converts it to an affine point as big integers.
|
|
func (curve *KoblitzCurve) fieldJacobianToBigAffine(x, y, z *fieldVal) (*big.Int, *big.Int) {
|
|
// Inversions are expensive and both point addition and point doubling
|
|
// are faster when working with points that have a z value of one. So,
|
|
// if the point needs to be converted to affine, go ahead and normalize
|
|
// the point itself at the same time as the calculation is the same.
|
|
var zInv, tempZ fieldVal
|
|
zInv.Set(z).Inverse() // zInv = Z^-1
|
|
tempZ.SquareVal(&zInv) // tempZ = Z^-2
|
|
x.Mul(&tempZ) // X = X/Z^2 (mag: 1)
|
|
y.Mul(tempZ.Mul(&zInv)) // Y = Y/Z^3 (mag: 1)
|
|
z.SetInt(1) // Z = 1 (mag: 1)
|
|
|
|
// Normalize the x and y values.
|
|
x.Normalize()
|
|
y.Normalize()
|
|
|
|
// Convert the field values for the now affine point to big.Ints.
|
|
x3, y3 := new(big.Int), new(big.Int)
|
|
x3.SetBytes(x.Bytes()[:])
|
|
y3.SetBytes(y.Bytes()[:])
|
|
return x3, y3
|
|
}
|
|
|
|
// IsOnCurve returns boolean if the point (x,y) is on the curve.
|
|
// Part of the elliptic.Curve interface. This function differs from the
|
|
// crypto/elliptic algorithm since a = 0 not -3.
|
|
func (curve *KoblitzCurve) IsOnCurve(x, y *big.Int) bool {
|
|
// Convert big ints to field values for faster arithmetic.
|
|
fx, fy := curve.bigAffineToField(x, y)
|
|
|
|
// Elliptic curve equation for secp256k1 is: y^2 = x^3 + 7
|
|
y2 := new(fieldVal).SquareVal(fy).Normalize()
|
|
result := new(fieldVal).SquareVal(fx).Mul(fx).AddInt(7).Normalize()
|
|
return y2.Equals(result)
|
|
}
|
|
|
|
// addZ1AndZ2EqualsOne adds two Jacobian points that are already known to have
|
|
// z values of 1 and stores the result in (x3, y3, z3). That is to say
|
|
// (x1, y1, 1) + (x2, y2, 1) = (x3, y3, z3). It performs faster addition than
|
|
// the generic add routine since less arithmetic is needed due to the ability to
|
|
// avoid the z value multiplications.
|
|
func (curve *KoblitzCurve) addZ1AndZ2EqualsOne(x1, y1, z1, x2, y2, x3, y3, z3 *fieldVal) {
|
|
// To compute the point addition efficiently, this implementation splits
|
|
// the equation into intermediate elements which are used to minimize
|
|
// the number of field multiplications using the method shown at:
|
|
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-mmadd-2007-bl
|
|
//
|
|
// In particular it performs the calculations using the following:
|
|
// H = X2-X1, HH = H^2, I = 4*HH, J = H*I, r = 2*(Y2-Y1), V = X1*I
|
|
// X3 = r^2-J-2*V, Y3 = r*(V-X3)-2*Y1*J, Z3 = 2*H
|
|
//
|
|
// This results in a cost of 4 field multiplications, 2 field squarings,
|
|
// 6 field additions, and 5 integer multiplications.
|
|
|
|
// When the x coordinates are the same for two points on the curve, the
|
|
// y coordinates either must be the same, in which case it is point
|
|
// doubling, or they are opposite and the result is the point at
|
|
// infinity per the group law for elliptic curve cryptography.
|
|
x1.Normalize()
|
|
y1.Normalize()
|
|
x2.Normalize()
|
|
y2.Normalize()
|
|
if x1.Equals(x2) {
|
|
if y1.Equals(y2) {
|
|
// Since x1 == x2 and y1 == y2, point doubling must be
|
|
// done, otherwise the addition would end up dividing
|
|
// by zero.
|
|
curve.doubleJacobian(x1, y1, z1, x3, y3, z3)
|
|
return
|
|
}
|
|
|
|
// Since x1 == x2 and y1 == -y2, the sum is the point at
|
|
// infinity per the group law.
|
|
x3.SetInt(0)
|
|
y3.SetInt(0)
|
|
z3.SetInt(0)
|
|
return
|
|
}
|
|
|
|
// Calculate X3, Y3, and Z3 according to the intermediate elements
|
|
// breakdown above.
|
|
var h, i, j, r, v fieldVal
|
|
var negJ, neg2V, negX3 fieldVal
|
|
h.Set(x1).Negate(1).Add(x2) // H = X2-X1 (mag: 3)
|
|
i.SquareVal(&h).MulInt(4) // I = 4*H^2 (mag: 4)
|
|
j.Mul2(&h, &i) // J = H*I (mag: 1)
|
|
r.Set(y1).Negate(1).Add(y2).MulInt(2) // r = 2*(Y2-Y1) (mag: 6)
|
|
v.Mul2(x1, &i) // V = X1*I (mag: 1)
|
|
negJ.Set(&j).Negate(1) // negJ = -J (mag: 2)
|
|
neg2V.Set(&v).MulInt(2).Negate(2) // neg2V = -(2*V) (mag: 3)
|
|
x3.Set(&r).Square().Add(&negJ).Add(&neg2V) // X3 = r^2-J-2*V (mag: 6)
|
|
negX3.Set(x3).Negate(6) // negX3 = -X3 (mag: 7)
|
|
j.Mul(y1).MulInt(2).Negate(2) // J = -(2*Y1*J) (mag: 3)
|
|
y3.Set(&v).Add(&negX3).Mul(&r).Add(&j) // Y3 = r*(V-X3)-2*Y1*J (mag: 4)
|
|
z3.Set(&h).MulInt(2) // Z3 = 2*H (mag: 6)
|
|
|
|
// Normalize the resulting field values to a magnitude of 1 as needed.
|
|
x3.Normalize()
|
|
y3.Normalize()
|
|
z3.Normalize()
|
|
}
|
|
|
|
// addZ1EqualsZ2 adds two Jacobian points that are already known to have the
|
|
// same z value and stores the result in (x3, y3, z3). That is to say
|
|
// (x1, y1, z1) + (x2, y2, z1) = (x3, y3, z3). It performs faster addition than
|
|
// the generic add routine since less arithmetic is needed due to the known
|
|
// equivalence.
|
|
func (curve *KoblitzCurve) addZ1EqualsZ2(x1, y1, z1, x2, y2, x3, y3, z3 *fieldVal) {
|
|
// To compute the point addition efficiently, this implementation splits
|
|
// the equation into intermediate elements which are used to minimize
|
|
// the number of field multiplications using a slightly modified version
|
|
// of the method shown at:
|
|
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-mmadd-2007-bl
|
|
//
|
|
// In particular it performs the calculations using the following:
|
|
// A = X2-X1, B = A^2, C=Y2-Y1, D = C^2, E = X1*B, F = X2*B
|
|
// X3 = D-E-F, Y3 = C*(E-X3)-Y1*(F-E), Z3 = Z1*A
|
|
//
|
|
// This results in a cost of 5 field multiplications, 2 field squarings,
|
|
// 9 field additions, and 0 integer multiplications.
|
|
|
|
// When the x coordinates are the same for two points on the curve, the
|
|
// y coordinates either must be the same, in which case it is point
|
|
// doubling, or they are opposite and the result is the point at
|
|
// infinity per the group law for elliptic curve cryptography.
|
|
x1.Normalize()
|
|
y1.Normalize()
|
|
x2.Normalize()
|
|
y2.Normalize()
|
|
if x1.Equals(x2) {
|
|
if y1.Equals(y2) {
|
|
// Since x1 == x2 and y1 == y2, point doubling must be
|
|
// done, otherwise the addition would end up dividing
|
|
// by zero.
|
|
curve.doubleJacobian(x1, y1, z1, x3, y3, z3)
|
|
return
|
|
}
|
|
|
|
// Since x1 == x2 and y1 == -y2, the sum is the point at
|
|
// infinity per the group law.
|
|
x3.SetInt(0)
|
|
y3.SetInt(0)
|
|
z3.SetInt(0)
|
|
return
|
|
}
|
|
|
|
// Calculate X3, Y3, and Z3 according to the intermediate elements
|
|
// breakdown above.
|
|
var a, b, c, d, e, f fieldVal
|
|
var negX1, negY1, negE, negX3 fieldVal
|
|
negX1.Set(x1).Negate(1) // negX1 = -X1 (mag: 2)
|
|
negY1.Set(y1).Negate(1) // negY1 = -Y1 (mag: 2)
|
|
a.Set(&negX1).Add(x2) // A = X2-X1 (mag: 3)
|
|
b.SquareVal(&a) // B = A^2 (mag: 1)
|
|
c.Set(&negY1).Add(y2) // C = Y2-Y1 (mag: 3)
|
|
d.SquareVal(&c) // D = C^2 (mag: 1)
|
|
e.Mul2(x1, &b) // E = X1*B (mag: 1)
|
|
negE.Set(&e).Negate(1) // negE = -E (mag: 2)
|
|
f.Mul2(x2, &b) // F = X2*B (mag: 1)
|
|
x3.Add2(&e, &f).Negate(3).Add(&d) // X3 = D-E-F (mag: 5)
|
|
negX3.Set(x3).Negate(5).Normalize() // negX3 = -X3 (mag: 1)
|
|
y3.Set(y1).Mul(f.Add(&negE)).Negate(3) // Y3 = -(Y1*(F-E)) (mag: 4)
|
|
y3.Add(e.Add(&negX3).Mul(&c)) // Y3 = C*(E-X3)+Y3 (mag: 5)
|
|
z3.Mul2(z1, &a) // Z3 = Z1*A (mag: 1)
|
|
|
|
// Normalize the resulting field values to a magnitude of 1 as needed.
|
|
x3.Normalize()
|
|
y3.Normalize()
|
|
}
|
|
|
|
// addZ2EqualsOne adds two Jacobian points when the second point is already
|
|
// known to have a z value of 1 (and the z value for the first point is not 1)
|
|
// and stores the result in (x3, y3, z3). That is to say (x1, y1, z1) +
|
|
// (x2, y2, 1) = (x3, y3, z3). It performs faster addition than the generic
|
|
// add routine since less arithmetic is needed due to the ability to avoid
|
|
// multiplications by the second point's z value.
|
|
func (curve *KoblitzCurve) addZ2EqualsOne(x1, y1, z1, x2, y2, x3, y3, z3 *fieldVal) {
|
|
// To compute the point addition efficiently, this implementation splits
|
|
// the equation into intermediate elements which are used to minimize
|
|
// the number of field multiplications using the method shown at:
|
|
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-madd-2007-bl
|
|
//
|
|
// In particular it performs the calculations using the following:
|
|
// Z1Z1 = Z1^2, U2 = X2*Z1Z1, S2 = Y2*Z1*Z1Z1, H = U2-X1, HH = H^2,
|
|
// I = 4*HH, J = H*I, r = 2*(S2-Y1), V = X1*I
|
|
// X3 = r^2-J-2*V, Y3 = r*(V-X3)-2*Y1*J, Z3 = (Z1+H)^2-Z1Z1-HH
|
|
//
|
|
// This results in a cost of 7 field multiplications, 4 field squarings,
|
|
// 9 field additions, and 4 integer multiplications.
|
|
|
|
// When the x coordinates are the same for two points on the curve, the
|
|
// y coordinates either must be the same, in which case it is point
|
|
// doubling, or they are opposite and the result is the point at
|
|
// infinity per the group law for elliptic curve cryptography. Since
|
|
// any number of Jacobian coordinates can represent the same affine
|
|
// point, the x and y values need to be converted to like terms. Due to
|
|
// the assumption made for this function that the second point has a z
|
|
// value of 1 (z2=1), the first point is already "converted".
|
|
var z1z1, u2, s2 fieldVal
|
|
x1.Normalize()
|
|
y1.Normalize()
|
|
z1z1.SquareVal(z1) // Z1Z1 = Z1^2 (mag: 1)
|
|
u2.Set(x2).Mul(&z1z1).Normalize() // U2 = X2*Z1Z1 (mag: 1)
|
|
s2.Set(y2).Mul(&z1z1).Mul(z1).Normalize() // S2 = Y2*Z1*Z1Z1 (mag: 1)
|
|
if x1.Equals(&u2) {
|
|
if y1.Equals(&s2) {
|
|
// Since x1 == x2 and y1 == y2, point doubling must be
|
|
// done, otherwise the addition would end up dividing
|
|
// by zero.
|
|
curve.doubleJacobian(x1, y1, z1, x3, y3, z3)
|
|
return
|
|
}
|
|
|
|
// Since x1 == x2 and y1 == -y2, the sum is the point at
|
|
// infinity per the group law.
|
|
x3.SetInt(0)
|
|
y3.SetInt(0)
|
|
z3.SetInt(0)
|
|
return
|
|
}
|
|
|
|
// Calculate X3, Y3, and Z3 according to the intermediate elements
|
|
// breakdown above.
|
|
var h, hh, i, j, r, rr, v fieldVal
|
|
var negX1, negY1, negX3 fieldVal
|
|
negX1.Set(x1).Negate(1) // negX1 = -X1 (mag: 2)
|
|
h.Add2(&u2, &negX1) // H = U2-X1 (mag: 3)
|
|
hh.SquareVal(&h) // HH = H^2 (mag: 1)
|
|
i.Set(&hh).MulInt(4) // I = 4 * HH (mag: 4)
|
|
j.Mul2(&h, &i) // J = H*I (mag: 1)
|
|
negY1.Set(y1).Negate(1) // negY1 = -Y1 (mag: 2)
|
|
r.Set(&s2).Add(&negY1).MulInt(2) // r = 2*(S2-Y1) (mag: 6)
|
|
rr.SquareVal(&r) // rr = r^2 (mag: 1)
|
|
v.Mul2(x1, &i) // V = X1*I (mag: 1)
|
|
x3.Set(&v).MulInt(2).Add(&j).Negate(3) // X3 = -(J+2*V) (mag: 4)
|
|
x3.Add(&rr) // X3 = r^2+X3 (mag: 5)
|
|
negX3.Set(x3).Negate(5) // negX3 = -X3 (mag: 6)
|
|
y3.Set(y1).Mul(&j).MulInt(2).Negate(2) // Y3 = -(2*Y1*J) (mag: 3)
|
|
y3.Add(v.Add(&negX3).Mul(&r)) // Y3 = r*(V-X3)+Y3 (mag: 4)
|
|
z3.Add2(z1, &h).Square() // Z3 = (Z1+H)^2 (mag: 1)
|
|
z3.Add(z1z1.Add(&hh).Negate(2)) // Z3 = Z3-(Z1Z1+HH) (mag: 4)
|
|
|
|
// Normalize the resulting field values to a magnitude of 1 as needed.
|
|
x3.Normalize()
|
|
y3.Normalize()
|
|
z3.Normalize()
|
|
}
|
|
|
|
// addGeneric adds two Jacobian points (x1, y1, z1) and (x2, y2, z2) without any
|
|
// assumptions about the z values of the two points and stores the result in
|
|
// (x3, y3, z3). That is to say (x1, y1, z1) + (x2, y2, z2) = (x3, y3, z3). It
|
|
// is the slowest of the add routines due to requiring the most arithmetic.
|
|
func (curve *KoblitzCurve) addGeneric(x1, y1, z1, x2, y2, z2, x3, y3, z3 *fieldVal) {
|
|
// To compute the point addition efficiently, this implementation splits
|
|
// the equation into intermediate elements which are used to minimize
|
|
// the number of field multiplications using the method shown at:
|
|
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl
|
|
//
|
|
// In particular it performs the calculations using the following:
|
|
// Z1Z1 = Z1^2, Z2Z2 = Z2^2, U1 = X1*Z2Z2, U2 = X2*Z1Z1, S1 = Y1*Z2*Z2Z2
|
|
// S2 = Y2*Z1*Z1Z1, H = U2-U1, I = (2*H)^2, J = H*I, r = 2*(S2-S1)
|
|
// V = U1*I
|
|
// X3 = r^2-J-2*V, Y3 = r*(V-X3)-2*S1*J, Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2)*H
|
|
//
|
|
// This results in a cost of 11 field multiplications, 5 field squarings,
|
|
// 9 field additions, and 4 integer multiplications.
|
|
|
|
// When the x coordinates are the same for two points on the curve, the
|
|
// y coordinates either must be the same, in which case it is point
|
|
// doubling, or they are opposite and the result is the point at
|
|
// infinity. Since any number of Jacobian coordinates can represent the
|
|
// same affine point, the x and y values need to be converted to like
|
|
// terms.
|
|
var z1z1, z2z2, u1, u2, s1, s2 fieldVal
|
|
z1z1.SquareVal(z1) // Z1Z1 = Z1^2 (mag: 1)
|
|
z2z2.SquareVal(z2) // Z2Z2 = Z2^2 (mag: 1)
|
|
u1.Set(x1).Mul(&z2z2).Normalize() // U1 = X1*Z2Z2 (mag: 1)
|
|
u2.Set(x2).Mul(&z1z1).Normalize() // U2 = X2*Z1Z1 (mag: 1)
|
|
s1.Set(y1).Mul(&z2z2).Mul(z2).Normalize() // S1 = Y1*Z2*Z2Z2 (mag: 1)
|
|
s2.Set(y2).Mul(&z1z1).Mul(z1).Normalize() // S2 = Y2*Z1*Z1Z1 (mag: 1)
|
|
if u1.Equals(&u2) {
|
|
if s1.Equals(&s2) {
|
|
// Since x1 == x2 and y1 == y2, point doubling must be
|
|
// done, otherwise the addition would end up dividing
|
|
// by zero.
|
|
curve.doubleJacobian(x1, y1, z1, x3, y3, z3)
|
|
return
|
|
}
|
|
|
|
// Since x1 == x2 and y1 == -y2, the sum is the point at
|
|
// infinity per the group law.
|
|
x3.SetInt(0)
|
|
y3.SetInt(0)
|
|
z3.SetInt(0)
|
|
return
|
|
}
|
|
|
|
// Calculate X3, Y3, and Z3 according to the intermediate elements
|
|
// breakdown above.
|
|
var h, i, j, r, rr, v fieldVal
|
|
var negU1, negS1, negX3 fieldVal
|
|
negU1.Set(&u1).Negate(1) // negU1 = -U1 (mag: 2)
|
|
h.Add2(&u2, &negU1) // H = U2-U1 (mag: 3)
|
|
i.Set(&h).MulInt(2).Square() // I = (2*H)^2 (mag: 2)
|
|
j.Mul2(&h, &i) // J = H*I (mag: 1)
|
|
negS1.Set(&s1).Negate(1) // negS1 = -S1 (mag: 2)
|
|
r.Set(&s2).Add(&negS1).MulInt(2) // r = 2*(S2-S1) (mag: 6)
|
|
rr.SquareVal(&r) // rr = r^2 (mag: 1)
|
|
v.Mul2(&u1, &i) // V = U1*I (mag: 1)
|
|
x3.Set(&v).MulInt(2).Add(&j).Negate(3) // X3 = -(J+2*V) (mag: 4)
|
|
x3.Add(&rr) // X3 = r^2+X3 (mag: 5)
|
|
negX3.Set(x3).Negate(5) // negX3 = -X3 (mag: 6)
|
|
y3.Mul2(&s1, &j).MulInt(2).Negate(2) // Y3 = -(2*S1*J) (mag: 3)
|
|
y3.Add(v.Add(&negX3).Mul(&r)) // Y3 = r*(V-X3)+Y3 (mag: 4)
|
|
z3.Add2(z1, z2).Square() // Z3 = (Z1+Z2)^2 (mag: 1)
|
|
z3.Add(z1z1.Add(&z2z2).Negate(2)) // Z3 = Z3-(Z1Z1+Z2Z2) (mag: 4)
|
|
z3.Mul(&h) // Z3 = Z3*H (mag: 1)
|
|
|
|
// Normalize the resulting field values to a magnitude of 1 as needed.
|
|
x3.Normalize()
|
|
y3.Normalize()
|
|
}
|
|
|
|
// addJacobian adds the passed Jacobian points (x1, y1, z1) and (x2, y2, z2)
|
|
// together and stores the result in (x3, y3, z3).
|
|
func (curve *KoblitzCurve) addJacobian(x1, y1, z1, x2, y2, z2, x3, y3, z3 *fieldVal) {
|
|
// A point at infinity is the identity according to the group law for
|
|
// elliptic curve cryptography. Thus, ∞ + P = P and P + ∞ = P.
|
|
if (x1.IsZero() && y1.IsZero()) || z1.IsZero() {
|
|
x3.Set(x2)
|
|
y3.Set(y2)
|
|
z3.Set(z2)
|
|
return
|
|
}
|
|
if (x2.IsZero() && y2.IsZero()) || z2.IsZero() {
|
|
x3.Set(x1)
|
|
y3.Set(y1)
|
|
z3.Set(z1)
|
|
return
|
|
}
|
|
|
|
// Faster point addition can be achieved when certain assumptions are
|
|
// met. For example, when both points have the same z value, arithmetic
|
|
// on the z values can be avoided. This section thus checks for these
|
|
// conditions and calls an appropriate add function which is accelerated
|
|
// by using those assumptions.
|
|
z1.Normalize()
|
|
z2.Normalize()
|
|
isZ1One := z1.Equals(fieldOne)
|
|
isZ2One := z2.Equals(fieldOne)
|
|
switch {
|
|
case isZ1One && isZ2One:
|
|
curve.addZ1AndZ2EqualsOne(x1, y1, z1, x2, y2, x3, y3, z3)
|
|
return
|
|
case z1.Equals(z2):
|
|
curve.addZ1EqualsZ2(x1, y1, z1, x2, y2, x3, y3, z3)
|
|
return
|
|
case isZ2One:
|
|
curve.addZ2EqualsOne(x1, y1, z1, x2, y2, x3, y3, z3)
|
|
return
|
|
}
|
|
|
|
// None of the above assumptions are true, so fall back to generic
|
|
// point addition.
|
|
curve.addGeneric(x1, y1, z1, x2, y2, z2, x3, y3, z3)
|
|
}
|
|
|
|
// Add returns the sum of (x1,y1) and (x2,y2). Part of the elliptic.Curve
|
|
// interface.
|
|
func (curve *KoblitzCurve) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
|
|
// A point at infinity is the identity according to the group law for
|
|
// elliptic curve cryptography. Thus, ∞ + P = P and P + ∞ = P.
|
|
if x1.Sign() == 0 && y1.Sign() == 0 {
|
|
return x2, y2
|
|
}
|
|
if x2.Sign() == 0 && y2.Sign() == 0 {
|
|
return x1, y1
|
|
}
|
|
|
|
// Convert the affine coordinates from big integers to field values
|
|
// and do the point addition in Jacobian projective space.
|
|
fx1, fy1 := curve.bigAffineToField(x1, y1)
|
|
fx2, fy2 := curve.bigAffineToField(x2, y2)
|
|
fx3, fy3, fz3 := new(fieldVal), new(fieldVal), new(fieldVal)
|
|
fOne := new(fieldVal).SetInt(1)
|
|
curve.addJacobian(fx1, fy1, fOne, fx2, fy2, fOne, fx3, fy3, fz3)
|
|
|
|
// Convert the Jacobian coordinate field values back to affine big
|
|
// integers.
|
|
return curve.fieldJacobianToBigAffine(fx3, fy3, fz3)
|
|
}
|
|
|
|
// doubleZ1EqualsOne performs point doubling on the passed Jacobian point
|
|
// when the point is already known to have a z value of 1 and stores
|
|
// the result in (x3, y3, z3). That is to say (x3, y3, z3) = 2*(x1, y1, 1). It
|
|
// performs faster point doubling than the generic routine since less arithmetic
|
|
// is needed due to the ability to avoid multiplication by the z value.
|
|
func (curve *KoblitzCurve) doubleZ1EqualsOne(x1, y1, x3, y3, z3 *fieldVal) {
|
|
// This function uses the assumptions that z1 is 1, thus the point
|
|
// doubling formulas reduce to:
|
|
//
|
|
// X3 = (3*X1^2)^2 - 8*X1*Y1^2
|
|
// Y3 = (3*X1^2)*(4*X1*Y1^2 - X3) - 8*Y1^4
|
|
// Z3 = 2*Y1
|
|
//
|
|
// To compute the above efficiently, this implementation splits the
|
|
// equation into intermediate elements which are used to minimize the
|
|
// number of field multiplications in favor of field squarings which
|
|
// are roughly 35% faster than field multiplications with the current
|
|
// implementation at the time this was written.
|
|
//
|
|
// This uses a slightly modified version of the method shown at:
|
|
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-mdbl-2007-bl
|
|
//
|
|
// In particular it performs the calculations using the following:
|
|
// A = X1^2, B = Y1^2, C = B^2, D = 2*((X1+B)^2-A-C)
|
|
// E = 3*A, F = E^2, X3 = F-2*D, Y3 = E*(D-X3)-8*C
|
|
// Z3 = 2*Y1
|
|
//
|
|
// This results in a cost of 1 field multiplication, 5 field squarings,
|
|
// 6 field additions, and 5 integer multiplications.
|
|
var a, b, c, d, e, f fieldVal
|
|
z3.Set(y1).MulInt(2) // Z3 = 2*Y1 (mag: 2)
|
|
a.SquareVal(x1) // A = X1^2 (mag: 1)
|
|
b.SquareVal(y1) // B = Y1^2 (mag: 1)
|
|
c.SquareVal(&b) // C = B^2 (mag: 1)
|
|
b.Add(x1).Square() // B = (X1+B)^2 (mag: 1)
|
|
d.Set(&a).Add(&c).Negate(2) // D = -(A+C) (mag: 3)
|
|
d.Add(&b).MulInt(2) // D = 2*(B+D)(mag: 8)
|
|
e.Set(&a).MulInt(3) // E = 3*A (mag: 3)
|
|
f.SquareVal(&e) // F = E^2 (mag: 1)
|
|
x3.Set(&d).MulInt(2).Negate(16) // X3 = -(2*D) (mag: 17)
|
|
x3.Add(&f) // X3 = F+X3 (mag: 18)
|
|
f.Set(x3).Negate(18).Add(&d).Normalize() // F = D-X3 (mag: 1)
|
|
y3.Set(&c).MulInt(8).Negate(8) // Y3 = -(8*C) (mag: 9)
|
|
y3.Add(f.Mul(&e)) // Y3 = E*F+Y3 (mag: 10)
|
|
|
|
// Normalize the field values back to a magnitude of 1.
|
|
x3.Normalize()
|
|
y3.Normalize()
|
|
z3.Normalize()
|
|
}
|
|
|
|
// doubleGeneric performs point doubling on the passed Jacobian point without
|
|
// any assumptions about the z value and stores the result in (x3, y3, z3).
|
|
// That is to say (x3, y3, z3) = 2*(x1, y1, z1). It is the slowest of the point
|
|
// doubling routines due to requiring the most arithmetic.
|
|
func (cuve *KoblitzCurve) doubleGeneric(x1, y1, z1, x3, y3, z3 *fieldVal) {
|
|
// Point doubling formula for Jacobian coordinates for the secp256k1
|
|
// curve:
|
|
// X3 = (3*X1^2)^2 - 8*X1*Y1^2
|
|
// Y3 = (3*X1^2)*(4*X1*Y1^2 - X3) - 8*Y1^4
|
|
// Z3 = 2*Y1*Z1
|
|
//
|
|
// To compute the above efficiently, this implementation splits the
|
|
// equation into intermediate elements which are used to minimize the
|
|
// number of field multiplications in favor of field squarings which
|
|
// are roughly 35% faster than field multiplications with the current
|
|
// implementation at the time this was written.
|
|
//
|
|
// This uses a slightly modified version of the method shown at:
|
|
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
|
|
//
|
|
// In particular it performs the calculations using the following:
|
|
// A = X1^2, B = Y1^2, C = B^2, D = 2*((X1+B)^2-A-C)
|
|
// E = 3*A, F = E^2, X3 = F-2*D, Y3 = E*(D-X3)-8*C
|
|
// Z3 = 2*Y1*Z1
|
|
//
|
|
// This results in a cost of 1 field multiplication, 5 field squarings,
|
|
// 6 field additions, and 5 integer multiplications.
|
|
var a, b, c, d, e, f fieldVal
|
|
z3.Mul2(y1, z1).MulInt(2) // Z3 = 2*Y1*Z1 (mag: 2)
|
|
a.SquareVal(x1) // A = X1^2 (mag: 1)
|
|
b.SquareVal(y1) // B = Y1^2 (mag: 1)
|
|
c.SquareVal(&b) // C = B^2 (mag: 1)
|
|
b.Add(x1).Square() // B = (X1+B)^2 (mag: 1)
|
|
d.Set(&a).Add(&c).Negate(2) // D = -(A+C) (mag: 3)
|
|
d.Add(&b).MulInt(2) // D = 2*(B+D)(mag: 8)
|
|
e.Set(&a).MulInt(3) // E = 3*A (mag: 3)
|
|
f.SquareVal(&e) // F = E^2 (mag: 1)
|
|
x3.Set(&d).MulInt(2).Negate(16) // X3 = -(2*D) (mag: 17)
|
|
x3.Add(&f) // X3 = F+X3 (mag: 18)
|
|
f.Set(x3).Negate(18).Add(&d).Normalize() // F = D-X3 (mag: 1)
|
|
y3.Set(&c).MulInt(8).Negate(8) // Y3 = -(8*C) (mag: 9)
|
|
y3.Add(f.Mul(&e)) // Y3 = E*F+Y3 (mag: 10)
|
|
|
|
// Normalize the field values back to a magnitude of 1.
|
|
x3.Normalize()
|
|
y3.Normalize()
|
|
z3.Normalize()
|
|
}
|
|
|
|
// doubleJacobian doubles the passed Jacobian point (x1, y1, z1) and stores the
|
|
// result in (x3, y3, z3).
|
|
func (curve *KoblitzCurve) doubleJacobian(x1, y1, z1, x3, y3, z3 *fieldVal) {
|
|
// Doubling a point at infinity is still infinity.
|
|
if y1.IsZero() || z1.IsZero() {
|
|
x3.SetInt(0)
|
|
y3.SetInt(0)
|
|
z3.SetInt(0)
|
|
return
|
|
}
|
|
|
|
// Slightly faster point doubling can be achieved when the z value is 1
|
|
// by avoiding the multiplication on the z value. This section calls
|
|
// a point doubling function which is accelerated by using that
|
|
// assumption when possible.
|
|
if z1.Normalize().Equals(fieldOne) {
|
|
curve.doubleZ1EqualsOne(x1, y1, x3, y3, z3)
|
|
return
|
|
}
|
|
|
|
// Fall back to generic point doubling which works with arbitrary z
|
|
// values.
|
|
curve.doubleGeneric(x1, y1, z1, x3, y3, z3)
|
|
}
|
|
|
|
// Double returns 2*(x1,y1). Part of the elliptic.Curve interface.
|
|
func (curve *KoblitzCurve) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
|
|
if y1.Sign() == 0 {
|
|
return new(big.Int), new(big.Int)
|
|
}
|
|
|
|
// Convert the affine coordinates from big integers to field values
|
|
// and do the point doubling in Jacobian projective space.
|
|
fx1, fy1 := curve.bigAffineToField(x1, y1)
|
|
fx3, fy3, fz3 := new(fieldVal), new(fieldVal), new(fieldVal)
|
|
fOne := new(fieldVal).SetInt(1)
|
|
curve.doubleJacobian(fx1, fy1, fOne, fx3, fy3, fz3)
|
|
|
|
// Convert the Jacobian coordinate field values back to affine big
|
|
// integers.
|
|
return curve.fieldJacobianToBigAffine(fx3, fy3, fz3)
|
|
}
|
|
|
|
// ScalarMult returns k*(Bx, By) where k is a big endian integer.
|
|
// Part of the elliptic.Curve interface.
|
|
func (curve *KoblitzCurve) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
|
|
// This uses the left to right binary method for point multiplication:
|
|
|
|
// Point Q = ∞ (point at infinity).
|
|
qx, qy, qz := new(fieldVal), new(fieldVal), new(fieldVal)
|
|
|
|
// Point P = the point to multiply the scalar with.
|
|
px, py := curve.bigAffineToField(Bx, By)
|
|
pz := new(fieldVal).SetInt(1)
|
|
|
|
// Double and add as necessary depending on the bits set in the scalar.
|
|
for _, byteVal := range k {
|
|
for bitNum := 0; bitNum < 8; bitNum++ {
|
|
// Q = 2*Q
|
|
curve.doubleJacobian(qx, qy, qz, qx, qy, qz)
|
|
if byteVal&0x80 == 0x80 {
|
|
// Q = Q + P
|
|
curve.addJacobian(qx, qy, qz, px, py, pz, qx,
|
|
qy, qz)
|
|
}
|
|
byteVal <<= 1
|
|
}
|
|
}
|
|
|
|
// Convert the Jacobian coordinate field values back to affine big.Ints.
|
|
return curve.fieldJacobianToBigAffine(qx, qy, qz)
|
|
}
|
|
|
|
// ScalarBaseMult returns k*G where G is the base point of the group and k is a
|
|
// big endian integer.
|
|
// Part of the elliptic.Curve interface.
|
|
func (curve *KoblitzCurve) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
|
|
// Fall back to slower generic scalar point multiplication when the integer is
|
|
// larger than what can be used with the precomputed table which enables
|
|
// accelerated multiplication by the known fixed point.
|
|
if len(k) > len(curve.bytePoints) {
|
|
return curve.ScalarMult(curve.Gx, curve.Gy, k)
|
|
}
|
|
|
|
diff := len(curve.bytePoints) - len(k)
|
|
|
|
// Point Q = ∞ (point at infinity).
|
|
qx, qy, qz := new(fieldVal), new(fieldVal), new(fieldVal)
|
|
|
|
// curve.bytePoints has all 256 byte points for each 8-bit window. The
|
|
// strategy is to add up the byte points. This is best understood by
|
|
// expressing k in base-256 which it already sort of is.
|
|
// Each "digit" in the 8-bit window can be looked up using bytePoints
|
|
// and added together.
|
|
for i, byteVal := range k {
|
|
point := curve.bytePoints[diff+i][byteVal]
|
|
curve.addJacobian(qx, qy, qz, &point[0], &point[1], &point[2], qx, qy, qz)
|
|
}
|
|
return curve.fieldJacobianToBigAffine(qx, qy, qz)
|
|
}
|
|
|
|
// QPlus1Div4 returns the Q+1/4 constant for the curve for use in calculating
|
|
// square roots via exponention.
|
|
func (curve *KoblitzCurve) QPlus1Div4() *big.Int {
|
|
return curve.q
|
|
}
|
|
|
|
var initonce sync.Once
|
|
var secp256k1 KoblitzCurve
|
|
|
|
func initAll() {
|
|
initS256()
|
|
}
|
|
|
|
func initS256() {
|
|
// Curve parameters taken from [SECG] section 2.4.1.
|
|
secp256k1.CurveParams = new(elliptic.CurveParams)
|
|
secp256k1.P, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", 16)
|
|
secp256k1.N, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 16)
|
|
secp256k1.B, _ = new(big.Int).SetString("0000000000000000000000000000000000000000000000000000000000000007", 16)
|
|
secp256k1.Gx, _ = new(big.Int).SetString("79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 16)
|
|
secp256k1.Gy, _ = new(big.Int).SetString("483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", 16)
|
|
secp256k1.BitSize = 256
|
|
secp256k1.H = 1
|
|
secp256k1.q = new(big.Int).Div(new(big.Int).Add(secp256k1.P,
|
|
big.NewInt(1)), big.NewInt(4))
|
|
|
|
// Deserialize and set the pre-computed table used to accelerate scalar
|
|
// base multiplication. This is hard-coded data, so any errors are
|
|
// panics because it means something is wrong in the source code.
|
|
if err := loadS256BytePoints(); err != nil {
|
|
panic(err)
|
|
}
|
|
}
|
|
|
|
// S256 returns a Curve which implements secp256k1.
|
|
func S256() *KoblitzCurve {
|
|
initonce.Do(initAll)
|
|
return &secp256k1
|
|
}
|