bip352: Check each k value in parallel

Start by checking k=0 and subsequently double
the the number values checked in parallel

Author: Eunovo

src/common/bip352.cpp

@@ -398,7 +398,7 @@ std::optional<std::vector<SilentPaymentOutput>> ParallelScanForSilentPaymentOutp
     tx_output_objs.reserve(tx_outputs.size());
 
     Mutex mutex;
-    std::vector<std::future<void>> futures;
+    std::vector<std::future<bool>> futures;
     futures.reserve(tx_outputs.size());
 
     for (auto& tx_output: tx_outputs) {
@@ -423,95 +423,135 @@ std::optional<std::vector<SilentPaymentOutput>> ParallelScanForSilentPaymentOutp
     }
 
     uint32_t k = 0;
-    while (k < tx_outputs.size()) {
-        uint256 tweak;
-
-        if (!secp256k1_silentpayments_recipient_create_tweak(
-            secp256k1_context_static,
-            tweak.data(),
-            UCharCast(scan_key.begin()),
-            prevouts_summary.Get(),
-            &spend_pubkey_obj,
-            k)
-        ) {
-            return {};
+    const size_t max_outputs_size = std::min(SP_RECIPIENT_GROUP_LIMIT, tx_outputs.size());
+    const size_t factor = 2;
+    const size_t min_batch_size = 1;
+    while (true) {
+        bool found = true;
+        for (size_t i = 0; i < futures.size(); i++) {
+            auto& future = futures[i];
+            const bool ready = future.wait_for(std::chrono::seconds::zero()) == std::future_status::ready;
+            if (!ready) continue;
+            // set found to false if even one of the futures returns false
+            found = found & future.get();
+            futures.erase(futures.begin() + i);
         }
 
-        secp256k1_xonly_pubkey unlabeled_output;
-        if (!secp256k1_silentpayments_recipient_create_output_pubkey(
-            secp256k1_context_static,
-            &unlabeled_output,
-            tweak.data(),
-            &spend_pubkey_obj
-        )) {
-            return {};
+        if (futures.size() > 0) {
+            // Join in task processing while
+            // waiting for existing work to complete
+            threadpool.ProcessTask();
+            continue;
         }
 
-        bool found = false;
-        uint256 label_tweak;
-        for (size_t i = 0; i < tx_output_objs.size(); i++) {
-            if (found) break;
-            if (secp256k1_xonly_pubkey_cmp(
-                secp256k1_context_static,
-                &tx_output_objs[i],
-                &unlabeled_output
-            ) == 0) {
-                found = true;
-                SilentPaymentOutput found_output{tx_outputs[i], tweak, {}};
-                found_outputs.emplace_back(found_output);
-                break;
-            }
-            if (labels.size() == 0) continue;
-            base_blob<264> label_candidates[2];
-            std::array<unsigned char*, 2> label_candidate_ptrs;
-            label_candidate_ptrs[0] = label_candidates[0].data();
-            label_candidate_ptrs[1] = label_candidates[1].data();
-
-            secp256k1_silentpayments_recipient_create_output_label(
-                secp256k1_context_static,
-                label_candidate_ptrs.data(),
-                &tx_output_objs[i],
-                &unlabeled_output
-            );
-
-            for (auto candidate_ptr: label_candidate_ptrs) {
-                secp256k1_silentpayments_label label_obj;
-                bool ret = secp256k1_silentpayments_recipient_label_parse(
-                    secp256k1_context_static, &label_obj, candidate_ptr);
-                assert(ret);
-                SilentPaymentLabel label{std::move(label_obj)};
-                // Find the pubkey in the map
-                auto it = labels.find(label);
-                if (it != labels.end()) {
-                    // Return a pointer to the uint256 label tweak if found
-                    // so it can be added to t_k
-                    label_tweak = it->second;
-                    found = true;
-                    /* This is extremely unlikely to fail in that it can only really fail if label_tweak
-                    * is the negation of the shared secret tweak. But since both tweak and label_tweak are
-                    * created by hashing data, practically speaking this would only happen if an attacker
-                    * tricked us into using a particular label_tweak (deviating from the protocol).
-                    *
-                    * Furthermore, although technically a failure for ec_seckey_tweak_add, this is not treated
-                    * as a failure for Silent Payments because the output is still spendable with just the
-                    * spend secret key. We set `tweak = 0` for this case.
-                    */
-                    if (!secp256k1_ec_seckey_tweak_add(
+        // Stop if no payment was found for at least one k
+        // or there are no more k values to test
+        if (!found || k >= max_outputs_size) break;
+        size_t current_batch_size = std::max(k * factor, min_batch_size);
+        current_batch_size = std::min(current_batch_size, max_outputs_size - k);
+        for (size_t i = 0; i < current_batch_size; i++) {
+            futures.emplace_back(threadpool.Submit([&, k] {
+                uint256 tweak;
+
+                if (!secp256k1_silentpayments_recipient_create_tweak(
+                    secp256k1_context_static,
+                    tweak.data(),
+                    UCharCast(scan_key.begin()),
+                    prevouts_summary.Get(),
+                    &spend_pubkey_obj,
+                    k)
+                ) {
+                    return false; // TODO should not fail silently
+                }
+
+                secp256k1_xonly_pubkey unlabeled_output;
+                if (!secp256k1_silentpayments_recipient_create_output_pubkey(
+                    secp256k1_context_static,
+                    &unlabeled_output,
+                    tweak.data(),
+                    &spend_pubkey_obj
+                )) {
+                    return false; // TODO should not fail silently
+                }
+
+                uint256 label_tweak;
+                std::optional<SilentPaymentOutput> found_output;
+                secp256k1_xonly_pubkey tx_output_obj;
+                size_t current_index = 0;
+                while (current_index < tx_output_objs.size()) {
+                    {
+                        LOCK(mutex);
+                        if (found_output) {
+                            found_outputs.push_back(std::move(*found_output));
+                            return true;
+                        }
+                        tx_output_obj = tx_output_objs[current_index];
+                    }
+                    if (secp256k1_xonly_pubkey_cmp(
                         secp256k1_context_static,
-                        tweak.data(),
-                        label_tweak.data()
-                    )) {
-                        tweak.SetNull();
+                        &tx_output_obj,
+                        &unlabeled_output
+                    ) == 0) {
+                        found_output = SilentPaymentOutput{tx_outputs[current_index], tweak, {}};
+                        continue;
                     }
-                    SilentPaymentOutput found_output{tx_outputs[i], tweak, label};
-                    found_outputs.emplace_back(found_output);
-                    break;
+
+                    if (labels.size() == 0) continue;
+                    base_blob<264> label_candidates[2];
+                    std::array<unsigned char*, 2> label_candidate_ptrs;
+                    label_candidate_ptrs[0] = label_candidates[0].data();
+                    label_candidate_ptrs[1] = label_candidates[1].data();
+
+                    secp256k1_silentpayments_recipient_create_output_label(
+                        secp256k1_context_static,
+                        label_candidate_ptrs.data(),
+                        &tx_output_obj,
+                        &unlabeled_output
+                    );
+
+                    for (auto candidate_ptr: label_candidate_ptrs) {
+                        secp256k1_silentpayments_label label_obj;
+                        bool ret = secp256k1_silentpayments_recipient_label_parse(
+                            secp256k1_context_static, &label_obj, candidate_ptr);
+                        assert(ret);
+                        SilentPaymentLabel label{std::move(label_obj)};
+                        // Find the pubkey in the map
+                        auto it = labels.find(label);
+                        if (it != labels.end()) {
+                            // Return a pointer to the uint256 label tweak if found
+                            // so it can be added to t_k
+                            label_tweak = it->second;
+                            /* This is extremely unlikely to fail in that it can only really fail if label_tweak
+                            * is the negation of the shared secret tweak. But since both tweak and label_tweak are
+                            * created by hashing data, practically speaking this would only happen if an attacker
+                            * tricked us into using a particular label_tweak (deviating from the protocol).
+                            *
+                            * Furthermore, although technically a failure for ec_seckey_tweak_add, this is not treated
+                            * as a failure for Silent Payments because the output is still spendable with just the
+                            * spend secret key. We set `tweak = 0` for this case.
+                            */
+                            if (!secp256k1_ec_seckey_tweak_add(
+                                secp256k1_context_static,
+                                tweak.data(),
+                                label_tweak.data()
+                            )) {
+                                tweak.SetNull();
+                            }
+                            found_output = SilentPaymentOutput{tx_outputs[current_index], tweak, label};
+                            break;
+                        }
+                    }
+                    current_index++;
                 }
-            }
+                return false;
+            }));
+
+            k++;
         }
+    }
 
-        if (!found) break;
-        k++;
+    for (auto& future: futures) {
+        future.get();
     }
 
     return found_outputs;

src/common/bip352.h

@@ -23,6 +23,8 @@ namespace bip352 {
 
 using PubKey = std::variant<CPubKey, XOnlyPubKey>;
 
+static size_t SP_RECIPIENT_GROUP_LIMIT = 1000;
+
 class PrevoutsSummaryImpl;
 class PrevoutsSummary
 {