Expose Montgomery ladder with additional output internally

Author: daxpedda

ed448-goldilocks/src/montgomery/x.rs

@@ -71,27 +71,7 @@ impl Mul<&EdwardsScalar> for &MontgomeryXpoint {
 
     #[allow(clippy::suspicious_arithmetic_impl)]
     fn mul(self, scalar: &EdwardsScalar) -> ProjectiveMontgomeryXpoint {
-        // Algorithm 8 of Costello-Smith 2017
-        let affine_u = FieldElement::from_bytes(&self.0);
-        let mut x0 = ProjectiveMontgomeryXpoint::IDENTITY;
-        let mut x1 = ProjectiveMontgomeryXpoint {
-            U: affine_u,
-            W: FieldElement::ONE,
-        };
-
-        let bits = scalar.bits();
-        let mut swap = 0;
-        for s in (0..448).rev() {
-            let bit = bits[s] as u8;
-            let choice: u8 = swap ^ bit;
-
-            ProjectiveMontgomeryXpoint::conditional_swap(&mut x0, &mut x1, Choice::from(choice));
-            differential_add_and_double(&mut x0, &mut x1, &affine_u);
-
-            swap = bit;
-        }
-
-        x0
+        self.mul_internal(scalar).0
     }
 }
 
@@ -134,6 +114,30 @@ impl MontgomeryXpoint {
         self.to_projective().y(sign).to_bytes()
     }
 
+    pub(super) fn mul_internal(
+        &self,
+        scalar: &EdwardsScalar,
+    ) -> (ProjectiveMontgomeryXpoint, ProjectiveMontgomeryXpoint) {
+        // Algorithm 8 of Costello-Smith 2017
+        let mut x0 = ProjectiveMontgomeryXpoint::IDENTITY;
+        let mut x1 = self.to_projective();
+        let diff = x1.U;
+
+        let bits = scalar.bits();
+        let mut swap = 0;
+        for s in (0..448).rev() {
+            let bit = bits[s] as u8;
+            let choice: u8 = swap ^ bit;
+
+            ProjectiveMontgomeryXpoint::conditional_swap(&mut x0, &mut x1, Choice::from(choice));
+            differential_add_and_double(&mut x0, &mut x1, &diff);
+
+            swap = bit;
+        }
+
+        (x0, x1)
+    }
+
     /// Convert the point to a ProjectiveMontgomeryPoint
     pub fn to_projective(&self) -> ProjectiveMontgomeryXpoint {
         ProjectiveMontgomeryXpoint {