1 /**********************************************************************
2 * Copyright (c) 2013, 2014 Pieter Wuille *
3 * Distributed under the MIT software license, see the accompanying *
4 * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
5 **********************************************************************/
7 #ifndef SECP256K1_ECMULT_GEN_H
8 #define SECP256K1_ECMULT_GEN_H
14 /* For accelerating the computation of a*G:
15 * To harden against timing attacks, use the following mechanism:
16 * * Break up the multiplicand into groups of 4 bits, called n_0, n_1, n_2, ..., n_63.
17 * * Compute sum(n_i * 16^i * G + U_i, i=0..63), where:
18 * * U_i = U * 2^i (for i=0..62)
19 * * U_i = U * (1-2^63) (for i=63)
20 * where U is a point with no known corresponding scalar. Note that sum(U_i, i=0..63) = 0.
21 * For each i, and each of the 16 possible values of n_i, (n_i * 16^i * G + U_i) is
22 * precomputed (call it prec(i, n_i)). The formula now becomes sum(prec(i, n_i), i=0..63).
23 * None of the resulting prec group elements have a known scalar, and neither do any of
24 * the intermediate sums while computing a*G.
26 secp256k1_ge_storage (*prec
)[64][16]; /* prec[j][i] = 16^j * i * G + U_i */
27 secp256k1_scalar blind
;
28 secp256k1_gej initial
;
29 } secp256k1_ecmult_gen_context
;
31 static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context
* ctx
);
32 static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context
* ctx
, const secp256k1_callback
* cb
);
33 static void secp256k1_ecmult_gen_context_clone(secp256k1_ecmult_gen_context
*dst
,
34 const secp256k1_ecmult_gen_context
* src
, const secp256k1_callback
* cb
);
35 static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context
* ctx
);
36 static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context
* ctx
);
38 /** Multiply with the generator: R = a*G */
39 static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context
* ctx
, secp256k1_gej
*r
, const secp256k1_scalar
*a
);
41 static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context
*ctx
, const unsigned char *seed32
);
43 #endif /* SECP256K1_ECMULT_GEN_H */