Skip to content

Commit 8a007cd

Browse files
real-or-randomreal-or-random
committed
group: Move definitions of constants to header
 SECP256K1_B and secp256k1_ge_const_g are used outside of group_impl.h, e.g., in ecmult_const_impl.h and ecmult_gen_impl.h, respectively.
1 parent f05a89e commit 8a007cd

File tree

3 files changed

+63
-64
lines changed

3 files changed

+63
-64
lines changed

‎sage/gen_exhaustive_groups.sage‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ def output_b(b):
9999
print(f"#define SECP256K1_B {int(b)}")
100100

101101
print()
102-
print("To be put in src/group_impl.h:")
102+
print("To be put in src/group.h:")
103103
print()
104104
print("/* Begin of section generated by sage/gen_exhaustive_groups.sage. */")
105105
for f in sorted(solutions.keys()):

‎src/group.h‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ typedef struct {
2121

2222
#define SECP256K1_GE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), 0}
2323
#define SECP256K1_GE_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
24-
static const secp256k1_ge secp256k1_ge_const_g;
2524

2625
/** A group element of the secp256k1 curve, in jacobian coordinates.
2726
* Note: For exhastive test mode, secp256k1 is replaced by a small subgroup of a different curve.
@@ -53,6 +52,68 @@ typedef struct {
5352
#define SECP256K1_GEJ_Y_MAGNITUDE_MAX 4
5453
#define SECP256K1_GEJ_Z_MAGNITUDE_MAX 1
5554

55+
/* Begin of section generated by sage/gen_exhaustive_groups.sage. */
56+
#define SECP256K1_G_ORDER_7 SECP256K1_GE_CONST(\
57+
0x66625d13, 0x317ffe44, 0x63d32cff, 0x1ca02b9b,\
58+
0xe5c6d070, 0x50b4b05e, 0x81cc30db, 0xf5166f0a,\
59+
0x1e60e897, 0xa7c00c7c, 0x2df53eb6, 0x98274ff4,\
60+
0x64252f42, 0x8ca44e17, 0x3b25418c, 0xff4ab0cf\
61+
)
62+
#define SECP256K1_G_ORDER_13 SECP256K1_GE_CONST(\
63+
0xa2482ff8, 0x4bf34edf, 0xa51262fd, 0xe57921db,\
64+
0xe0dd2cb7, 0xa5914790, 0xbc71631f, 0xc09704fb,\
65+
0x942536cb, 0xa3e49492, 0x3a701cc3, 0xee3e443f,\
66+
0xdf182aa9, 0x15b8aa6a, 0x166d3b19, 0xba84b045\
67+
)
68+
#define SECP256K1_G_ORDER_199 SECP256K1_GE_CONST(\
69+
0x7fb07b5c, 0xd07c3bda, 0x553902e2, 0x7a87ea2c,\
70+
0x35108a7f, 0x051f41e5, 0xb76abad5, 0x1f2703ad,\
71+
0x0a251539, 0x5b4c4438, 0x952a634f, 0xac10dd4d,\
72+
0x6d6f4745, 0x98990c27, 0x3a4f3116, 0xd32ff969\
73+
)
74+
/** Generator for secp256k1, value 'g' defined in
75+
* "Standards for Efficient Cryptography" (SEC2) 2.7.1.
76+
*/
77+
#define SECP256K1_G SECP256K1_GE_CONST(\
78+
0x79be667e, 0xf9dcbbac, 0x55a06295, 0xce870b07,\
79+
0x029bfcdb, 0x2dce28d9, 0x59f2815b, 0x16f81798,\
80+
0x483ada77, 0x26a3c465, 0x5da4fbfc, 0x0e1108a8,\
81+
0xfd17b448, 0xa6855419, 0x9c47d08f, 0xfb10d4b8\
82+
)
83+
/* These exhaustive group test orders and generators are chosen such that:
84+
* - The field size is equal to that of secp256k1, so field code is the same.
85+
* - The curve equation is of the form y^2=x^3+B for some small constant B.
86+
* - The subgroup has a generator 2*P, where P.x is as small as possible.
87+
* - The subgroup has size less than 1000 to permit exhaustive testing.
88+
* - The subgroup admits an endomorphism of the form lambda*(x,y) == (beta*x,y).
89+
*/
90+
#if defined(EXHAUSTIVE_TEST_ORDER)
91+
# if EXHAUSTIVE_TEST_ORDER == 7
92+
93+
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_7;
94+
#define SECP256K1_B 6
95+
96+
# elif EXHAUSTIVE_TEST_ORDER == 13
97+
98+
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_13;
99+
#define SECP256K1_B 2
100+
101+
# elif EXHAUSTIVE_TEST_ORDER == 199
102+
103+
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_199;
104+
#define SECP256K1_B 4
105+
106+
# else
107+
# error No known generator for the specified exhaustive test group order.
108+
# endif
109+
#else
110+
111+
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G;
112+
#define SECP256K1_B 7
113+
114+
#endif
115+
/* End of section generated by sage/gen_exhaustive_groups.sage. */
116+
56117
/** Set a group element equal to the point with given X and Y coordinates */
57118
static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y);
58119

‎src/group_impl.h‎

Lines changed: 0 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -13,68 +13,6 @@
1313
#include "group.h"
1414
#include "util.h"
1515

16-
/* Begin of section generated by sage/gen_exhaustive_groups.sage. */
17-
#define SECP256K1_G_ORDER_7 SECP256K1_GE_CONST(\
18-
0x66625d13, 0x317ffe44, 0x63d32cff, 0x1ca02b9b,\
19-
0xe5c6d070, 0x50b4b05e, 0x81cc30db, 0xf5166f0a,\
20-
0x1e60e897, 0xa7c00c7c, 0x2df53eb6, 0x98274ff4,\
21-
0x64252f42, 0x8ca44e17, 0x3b25418c, 0xff4ab0cf\
22-
)
23-
#define SECP256K1_G_ORDER_13 SECP256K1_GE_CONST(\
24-
0xa2482ff8, 0x4bf34edf, 0xa51262fd, 0xe57921db,\
25-
0xe0dd2cb7, 0xa5914790, 0xbc71631f, 0xc09704fb,\
26-
0x942536cb, 0xa3e49492, 0x3a701cc3, 0xee3e443f,\
27-
0xdf182aa9, 0x15b8aa6a, 0x166d3b19, 0xba84b045\
28-
)
29-
#define SECP256K1_G_ORDER_199 SECP256K1_GE_CONST(\
30-
0x7fb07b5c, 0xd07c3bda, 0x553902e2, 0x7a87ea2c,\
31-
0x35108a7f, 0x051f41e5, 0xb76abad5, 0x1f2703ad,\
32-
0x0a251539, 0x5b4c4438, 0x952a634f, 0xac10dd4d,\
33-
0x6d6f4745, 0x98990c27, 0x3a4f3116, 0xd32ff969\
34-
)
35-
/** Generator for secp256k1, value 'g' defined in
36-
* "Standards for Efficient Cryptography" (SEC2) 2.7.1.
37-
*/
38-
#define SECP256K1_G SECP256K1_GE_CONST(\
39-
0x79be667e, 0xf9dcbbac, 0x55a06295, 0xce870b07,\
40-
0x029bfcdb, 0x2dce28d9, 0x59f2815b, 0x16f81798,\
41-
0x483ada77, 0x26a3c465, 0x5da4fbfc, 0x0e1108a8,\
42-
0xfd17b448, 0xa6855419, 0x9c47d08f, 0xfb10d4b8\
43-
)
44-
/* These exhaustive group test orders and generators are chosen such that:
45-
* - The field size is equal to that of secp256k1, so field code is the same.
46-
* - The curve equation is of the form y^2=x^3+B for some small constant B.
47-
* - The subgroup has a generator 2*P, where P.x is as small as possible.
48-
* - The subgroup has size less than 1000 to permit exhaustive testing.
49-
* - The subgroup admits an endomorphism of the form lambda*(x,y) == (beta*x,y).
50-
*/
51-
#if defined(EXHAUSTIVE_TEST_ORDER)
52-
# if EXHAUSTIVE_TEST_ORDER == 7
53-
54-
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_7;
55-
#define SECP256K1_B 6
56-
57-
# elif EXHAUSTIVE_TEST_ORDER == 13
58-
59-
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_13;
60-
#define SECP256K1_B 2
61-
62-
# elif EXHAUSTIVE_TEST_ORDER == 199
63-
64-
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_199;
65-
#define SECP256K1_B 4
66-
67-
# else
68-
# error No known generator for the specified exhaustive test group order.
69-
# endif
70-
#else
71-
72-
static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G;
73-
#define SECP256K1_B 7
74-
75-
#endif
76-
/* End of section generated by sage/gen_exhaustive_groups.sage. */
77-
7816
static void secp256k1_ge_verify(const secp256k1_ge *a) {
7917
SECP256K1_FE_VERIFY(&a->x);
8018
SECP256K1_FE_VERIFY(&a->y);

0 commit comments

Comments
 (0)