void run_sqrt(void) { secp256k1_fe_t ns, x, s, t; /* Check sqrt(0) is 0 */ secp256k1_fe_set_int(&x, 0); secp256k1_fe_sqr(&s, &x); test_sqrt(&s, &x); /* Check sqrt of small squares (and their negatives) */ for (int i=1; i<=100; i++) { secp256k1_fe_set_int(&x, i); secp256k1_fe_sqr(&s, &x); test_sqrt(&s, &x); secp256k1_fe_negate(&t, &s, 1); test_sqrt(&t, NULL); } /* Consistency checks for large random values */ for (int i=0; i<10; i++) { random_fe_non_square(&ns); for (int j=0; j<count; j++) { random_fe(&x); secp256k1_fe_sqr(&s, &x); test_sqrt(&s, &x); secp256k1_fe_negate(&t, &s, 1); test_sqrt(&t, NULL); secp256k1_fe_mul(&t, &s, &ns); test_sqrt(&t, NULL); } } }
void random_field_element_magnitude(secp256k1_fe_t *fe) { secp256k1_fe_normalize(fe); int n = secp256k1_rand32() % 4; for (int i = 0; i < n; i++) { secp256k1_fe_negate(fe, fe, 1 + 2*i); secp256k1_fe_negate(fe, fe, 2 + 2*i); } }
static void secp256k1_gej_add_ge_bl(secp256k1_gej_t *r, const secp256k1_gej_t *a, const secp256k1_ge_t *b, secp256k1_fe_t *rzr) { secp256k1_fe_t z1z1, z1, u2, x1, y1, t0, s2, h, hh, i, j, t1, rr, v, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11; // 7M + 4S + 2 normalize + 22 mul_int/add/negate if (a->infinity) { VERIFY_CHECK(rzr == NULL); secp256k1_gej_set_ge(r, b); return; } if (b->infinity) { if (rzr) { secp256k1_fe_set_int(rzr, 1); } *r = *a; return; } r->infinity = 0; x1 = a->x; secp256k1_fe_normalize_weak(&x1); y1 = a->y; secp256k1_fe_normalize_weak(&y1); secp256k1_fe_sqr(&z1z1, &a->z); // z1z1 = z1^2 secp256k1_fe_mul(&u2, &b->x, &z1z1); // u2 = x2*z1z1 secp256k1_fe_mul(&t0, &a->z, &z1z1); // t0 = z1*z1z1 secp256k1_fe_mul(&s2, &b->y, &t0); // s2 = y2 * t0 secp256k1_fe_negate(&h, &x1, 1); secp256k1_fe_add(&h, &u2); // h = u2-x1 (3) secp256k1_fe_sqr(&hh,&h); // hh = h^2 i = hh; secp256k1_fe_mul_int(&i,4); // i = 4*hh if (secp256k1_fe_normalizes_to_zero_var(&h)) { if (secp256k1_fe_normalizes_to_zero_var(&i)) { secp256k1_gej_double_var(r, a, rzr); } else { if (rzr) { secp256k1_fe_set_int(rzr, 0); } r->infinity = 1; } return; } secp256k1_fe_mul(&j,&h,&i); // j = h*i secp256k1_fe_negate(&t1, &y1, 1); secp256k1_fe_add(&t1, &s2); // t1 = s2-y1 rr = t1; secp256k1_fe_mul_int(&rr, 2); // rr = 2 * t1; secp256k1_fe_mul(&v, &x1, &i); // v = x1 * i secp256k1_fe_sqr(&t2, &rr); // t2 = rr^2 t3 = v; secp256k1_fe_mul_int(&t3, 2); // t3 = 2*v secp256k1_fe_negate(&t4, &j, 1); secp256k1_fe_add(&t4, &t2); // t4 = t2 - j secp256k1_fe_negate(&r->x, &t3, 2); secp256k1_fe_add(&r->x, &t4); // x3 = t4 - t3; //secp256k1_fe_normalize_weak(&r->x); secp256k1_fe_negate(&t5, &r->x, 6); secp256k1_fe_add(&t5, &v); // t5 = v - x3 secp256k1_fe_mul(&t6,&y1,&j); // t6 = y1 * j t7 = t6; secp256k1_fe_mul_int(&t7,2); // t7 = 2*t6; secp256k1_fe_mul(&t8,&rr,&t5); // t8 = rr* t5; secp256k1_fe_negate(&r->y, &t7, 2); secp256k1_fe_add(&r->y,&t8);// y3 = t8-t7 //secp256k1_fe_normalize_weak(&r->y); t9 = h; secp256k1_fe_add(&t9, &a->z); // t9 = z1 + h secp256k1_fe_sqr(&t10, &t9); // t10 = t9^2 secp256k1_fe_negate(&t11, &z1z1, 1); secp256k1_fe_add(&t11, &t10); // t11 = t10-z1z1 secp256k1_fe_negate(&r->z, &hh, 1); secp256k1_fe_add(&r->z, &t11); // z3 = t11 - hh }
void random_fe_non_square(secp256k1_fe_t *ns) { random_fe_non_zero(ns); secp256k1_fe_t r; if (secp256k1_fe_sqrt(&r, ns)) { secp256k1_fe_negate(ns, ns, 1); } }
void test_sqrt(const secp256k1_fe_t *a, const secp256k1_fe_t *k) { secp256k1_fe_t r1, r2; int v = secp256k1_fe_sqrt(&r1, a); CHECK((v == 0) == (k == NULL)); if (k != NULL) { /* Check that the returned root is +/- the given known answer */ secp256k1_fe_negate(&r2, &r1, 1); secp256k1_fe_add(&r1, k); secp256k1_fe_add(&r2, k); secp256k1_fe_normalize(&r1); secp256k1_fe_normalize(&r2); CHECK(secp256k1_fe_is_zero(&r1) || secp256k1_fe_is_zero(&r2)); } }
void run_sqr(void) { secp256k1_fe_t x, s; { secp256k1_fe_set_int(&x, 1); secp256k1_fe_negate(&x, &x, 1); for (int i=1; i<=512; ++i) { secp256k1_fe_mul_int(&x, 2); secp256k1_fe_normalize(&x); secp256k1_fe_sqr(&s, &x); } } }
void test_ge(void) { char ca[135]; char cb[68]; int rlen; secp256k1_ge_t a, b, i, n; random_group_element_test(&a); random_group_element_test(&b); rlen = sizeof(ca); secp256k1_ge_get_hex(ca,&rlen,&a); CHECK(rlen > 4 && rlen <= (int)sizeof(ca)); rlen = sizeof(cb); secp256k1_ge_get_hex(cb,&rlen,&b); /* Intentionally undersized buffer. */ n = a; secp256k1_fe_normalize(&a.y); secp256k1_fe_negate(&n.y, &a.y, 1); secp256k1_ge_set_infinity(&i); random_field_element_magnitude(&a.x); random_field_element_magnitude(&a.y); random_field_element_magnitude(&b.x); random_field_element_magnitude(&b.y); random_field_element_magnitude(&n.x); random_field_element_magnitude(&n.y); secp256k1_gej_t aj, bj, ij, nj; random_group_element_jacobian_test(&aj, &a); random_group_element_jacobian_test(&bj, &b); secp256k1_gej_set_infinity(&ij); random_group_element_jacobian_test(&nj, &n); random_field_element_magnitude(&aj.x); random_field_element_magnitude(&aj.y); random_field_element_magnitude(&aj.z); random_field_element_magnitude(&bj.x); random_field_element_magnitude(&bj.y); random_field_element_magnitude(&bj.z); random_field_element_magnitude(&nj.x); random_field_element_magnitude(&nj.y); random_field_element_magnitude(&nj.z); /* gej + gej adds */ secp256k1_gej_t aaj; secp256k1_gej_add_var(&aaj, &aj, &aj); secp256k1_gej_t abj; secp256k1_gej_add_var(&abj, &aj, &bj); secp256k1_gej_t aij; secp256k1_gej_add_var(&aij, &aj, &ij); secp256k1_gej_t anj; secp256k1_gej_add_var(&anj, &aj, &nj); secp256k1_gej_t iaj; secp256k1_gej_add_var(&iaj, &ij, &aj); secp256k1_gej_t iij; secp256k1_gej_add_var(&iij, &ij, &ij); /* gej + ge adds */ secp256k1_gej_t aa; secp256k1_gej_add_ge_var(&aa, &aj, &a); secp256k1_gej_t ab; secp256k1_gej_add_ge_var(&ab, &aj, &b); secp256k1_gej_t ai; secp256k1_gej_add_ge_var(&ai, &aj, &i); secp256k1_gej_t an; secp256k1_gej_add_ge_var(&an, &aj, &n); secp256k1_gej_t ia; secp256k1_gej_add_ge_var(&ia, &ij, &a); secp256k1_gej_t ii; secp256k1_gej_add_ge_var(&ii, &ij, &i); /* const gej + ge adds */ secp256k1_gej_t aac; secp256k1_gej_add_ge(&aac, &aj, &a); secp256k1_gej_t abc; secp256k1_gej_add_ge(&abc, &aj, &b); secp256k1_gej_t anc; secp256k1_gej_add_ge(&anc, &aj, &n); secp256k1_gej_t iac; secp256k1_gej_add_ge(&iac, &ij, &a); CHECK(secp256k1_gej_is_infinity(&an)); CHECK(secp256k1_gej_is_infinity(&anj)); CHECK(secp256k1_gej_is_infinity(&anc)); gej_equals_gej(&aa, &aaj); gej_equals_gej(&aa, &aac); gej_equals_gej(&ab, &abj); gej_equals_gej(&ab, &abc); gej_equals_gej(&an, &anj); gej_equals_gej(&an, &anc); gej_equals_gej(&ia, &iaj); gej_equals_gej(&ai, &aij); gej_equals_gej(&ii, &iij); ge_equals_gej(&a, &ai); ge_equals_gej(&a, &ai); ge_equals_gej(&a, &iaj); ge_equals_gej(&a, &iaj); ge_equals_gej(&a, &iac); }
void test_ge(void) { secp256k1_ge_t a, b, i, n; random_group_element_test(&a); random_group_element_test(&b); n = a; secp256k1_fe_normalize(&a.y); secp256k1_fe_negate(&n.y, &a.y, 1); secp256k1_ge_set_infinity(&i); random_field_element_magnitude(&a.x); random_field_element_magnitude(&a.y); random_field_element_magnitude(&b.x); random_field_element_magnitude(&b.y); random_field_element_magnitude(&n.x); random_field_element_magnitude(&n.y); secp256k1_gej_t aj, bj, ij, nj; random_group_element_jacobian_test(&aj, &a); random_group_element_jacobian_test(&bj, &b); secp256k1_gej_set_infinity(&ij); random_group_element_jacobian_test(&nj, &n); random_field_element_magnitude(&aj.x); random_field_element_magnitude(&aj.y); random_field_element_magnitude(&aj.z); random_field_element_magnitude(&bj.x); random_field_element_magnitude(&bj.y); random_field_element_magnitude(&bj.z); random_field_element_magnitude(&nj.x); random_field_element_magnitude(&nj.y); random_field_element_magnitude(&nj.z); /* gej + gej adds */ secp256k1_gej_t aaj; secp256k1_gej_add_var(&aaj, &aj, &aj); secp256k1_gej_t abj; secp256k1_gej_add_var(&abj, &aj, &bj); secp256k1_gej_t aij; secp256k1_gej_add_var(&aij, &aj, &ij); secp256k1_gej_t anj; secp256k1_gej_add_var(&anj, &aj, &nj); secp256k1_gej_t iaj; secp256k1_gej_add_var(&iaj, &ij, &aj); secp256k1_gej_t iij; secp256k1_gej_add_var(&iij, &ij, &ij); /* gej + ge adds */ secp256k1_gej_t aa; secp256k1_gej_add_ge_var(&aa, &aj, &a); secp256k1_gej_t ab; secp256k1_gej_add_ge_var(&ab, &aj, &b); secp256k1_gej_t ai; secp256k1_gej_add_ge_var(&ai, &aj, &i); secp256k1_gej_t an; secp256k1_gej_add_ge_var(&an, &aj, &n); secp256k1_gej_t ia; secp256k1_gej_add_ge_var(&ia, &ij, &a); secp256k1_gej_t ii; secp256k1_gej_add_ge_var(&ii, &ij, &i); /* const gej + ge adds */ secp256k1_gej_t aac; secp256k1_gej_add_ge(&aac, &aj, &a); secp256k1_gej_t abc; secp256k1_gej_add_ge(&abc, &aj, &b); secp256k1_gej_t anc; secp256k1_gej_add_ge(&anc, &aj, &n); secp256k1_gej_t iac; secp256k1_gej_add_ge(&iac, &ij, &a); CHECK(secp256k1_gej_is_infinity(&an)); CHECK(secp256k1_gej_is_infinity(&anj)); CHECK(secp256k1_gej_is_infinity(&anc)); gej_equals_gej(&aa, &aaj); gej_equals_gej(&aa, &aac); gej_equals_gej(&ab, &abj); gej_equals_gej(&ab, &abc); gej_equals_gej(&an, &anj); gej_equals_gej(&an, &anc); gej_equals_gej(&ia, &iaj); gej_equals_gej(&ai, &aij); gej_equals_gej(&ii, &iij); ge_equals_gej(&a, &ai); ge_equals_gej(&a, &ai); ge_equals_gej(&a, &iaj); ge_equals_gej(&a, &iaj); ge_equals_gej(&a, &iac); }