1 /**********************************************************************
2 * Copyright (c) 2013, 2014 Pieter Wuille *
3 * Distributed under the MIT software license, see the accompanying *
4 * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
5 **********************************************************************/
7 #ifndef SECP256K1_GROUP_H
8 #define SECP256K1_GROUP_H
13 /** A group element of the secp256k1 curve, in affine coordinates. */
17 int infinity
; /* whether this represents the point at infinity */
20 #define SECP256K1_GE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), 0}
21 #define SECP256K1_GE_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
23 /** A group element of the secp256k1 curve, in jacobian coordinates. */
25 secp256k1_fe x
; /* actual X: x/z^2 */
26 secp256k1_fe y
; /* actual Y: y/z^3 */
28 int infinity
; /* whether this represents the point at infinity */
31 #define SECP256K1_GEJ_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1), 0}
32 #define SECP256K1_GEJ_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
35 secp256k1_fe_storage x
;
36 secp256k1_fe_storage y
;
37 } secp256k1_ge_storage
;
39 #define SECP256K1_GE_STORAGE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_STORAGE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_STORAGE_CONST((i),(j),(k),(l),(m),(n),(o),(p))}
41 #define SECP256K1_GE_STORAGE_CONST_GET(t) SECP256K1_FE_STORAGE_CONST_GET(t.x), SECP256K1_FE_STORAGE_CONST_GET(t.y)
43 /** Set a group element equal to the point with given X and Y coordinates */
44 static void secp256k1_ge_set_xy(secp256k1_ge
*r
, const secp256k1_fe
*x
, const secp256k1_fe
*y
);
46 /** Set a group element (affine) equal to the point with the given X coordinate
47 * and a Y coordinate that is a quadratic residue modulo p. The return value
48 * is true iff a coordinate with the given X coordinate exists.
50 static int secp256k1_ge_set_xquad(secp256k1_ge
*r
, const secp256k1_fe
*x
);
52 /** Set a group element (affine) equal to the point with the given X coordinate, and given oddness
53 * for Y. Return value indicates whether the result is valid. */
54 static int secp256k1_ge_set_xo_var(secp256k1_ge
*r
, const secp256k1_fe
*x
, int odd
);
56 /** Check whether a group element is the point at infinity. */
57 static int secp256k1_ge_is_infinity(const secp256k1_ge
*a
);
59 /** Check whether a group element is valid (i.e., on the curve). */
60 static int secp256k1_ge_is_valid_var(const secp256k1_ge
*a
);
62 static void secp256k1_ge_neg(secp256k1_ge
*r
, const secp256k1_ge
*a
);
64 /** Set a group element equal to another which is given in jacobian coordinates */
65 static void secp256k1_ge_set_gej(secp256k1_ge
*r
, secp256k1_gej
*a
);
67 /** Set a batch of group elements equal to the inputs given in jacobian coordinates */
68 static void secp256k1_ge_set_all_gej_var(secp256k1_ge
*r
, const secp256k1_gej
*a
, size_t len
, const secp256k1_callback
*cb
);
70 /** Set a batch of group elements equal to the inputs given in jacobian
71 * coordinates (with known z-ratios). zr must contain the known z-ratios such
72 * that mul(a[i].z, zr[i+1]) == a[i+1].z. zr[0] is ignored. */
73 static void secp256k1_ge_set_table_gej_var(secp256k1_ge
*r
, const secp256k1_gej
*a
, const secp256k1_fe
*zr
, size_t len
);
75 /** Bring a batch inputs given in jacobian coordinates (with known z-ratios) to
76 * the same global z "denominator". zr must contain the known z-ratios such
77 * that mul(a[i].z, zr[i+1]) == a[i+1].z. zr[0] is ignored. The x and y
78 * coordinates of the result are stored in r, the common z coordinate is
79 * stored in globalz. */
80 static void secp256k1_ge_globalz_set_table_gej(size_t len
, secp256k1_ge
*r
, secp256k1_fe
*globalz
, const secp256k1_gej
*a
, const secp256k1_fe
*zr
);
82 /** Set a group element (jacobian) equal to the point at infinity. */
83 static void secp256k1_gej_set_infinity(secp256k1_gej
*r
);
85 /** Set a group element (jacobian) equal to another which is given in affine coordinates. */
86 static void secp256k1_gej_set_ge(secp256k1_gej
*r
, const secp256k1_ge
*a
);
88 /** Compare the X coordinate of a group element (jacobian). */
89 static int secp256k1_gej_eq_x_var(const secp256k1_fe
*x
, const secp256k1_gej
*a
);
91 /** Set r equal to the inverse of a (i.e., mirrored around the X axis) */
92 static void secp256k1_gej_neg(secp256k1_gej
*r
, const secp256k1_gej
*a
);
94 /** Check whether a group element is the point at infinity. */
95 static int secp256k1_gej_is_infinity(const secp256k1_gej
*a
);
97 /** Check whether a group element's y coordinate is a quadratic residue. */
98 static int secp256k1_gej_has_quad_y_var(const secp256k1_gej
*a
);
100 /** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0).
101 * a may not be zero. Constant time. */
102 static void secp256k1_gej_double_nonzero(secp256k1_gej
*r
, const secp256k1_gej
*a
, secp256k1_fe
*rzr
);
104 /** Set r equal to the double of a. If rzr is not-NULL, r->z = a->z * *rzr (where infinity means an implicit z = 0). */
105 static void secp256k1_gej_double_var(secp256k1_gej
*r
, const secp256k1_gej
*a
, secp256k1_fe
*rzr
);
107 /** Set r equal to the sum of a and b. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */
108 static void secp256k1_gej_add_var(secp256k1_gej
*r
, const secp256k1_gej
*a
, const secp256k1_gej
*b
, secp256k1_fe
*rzr
);
110 /** Set r equal to the sum of a and b (with b given in affine coordinates, and not infinity). */
111 static void secp256k1_gej_add_ge(secp256k1_gej
*r
, const secp256k1_gej
*a
, const secp256k1_ge
*b
);
113 /** Set r equal to the sum of a and b (with b given in affine coordinates). This is more efficient
114 than secp256k1_gej_add_var. It is identical to secp256k1_gej_add_ge but without constant-time
115 guarantee, and b is allowed to be infinity. If rzr is non-NULL, r->z = a->z * *rzr (a cannot be infinity in that case). */
116 static void secp256k1_gej_add_ge_var(secp256k1_gej
*r
, const secp256k1_gej
*a
, const secp256k1_ge
*b
, secp256k1_fe
*rzr
);
118 /** Set r equal to the sum of a and b (with the inverse of b's Z coordinate passed as bzinv). */
119 static void secp256k1_gej_add_zinv_var(secp256k1_gej
*r
, const secp256k1_gej
*a
, const secp256k1_ge
*b
, const secp256k1_fe
*bzinv
);
121 #ifdef USE_ENDOMORPHISM
122 /** Set r to be equal to lambda times a, where lambda is chosen in a way such that this is very fast. */
123 static void secp256k1_ge_mul_lambda(secp256k1_ge
*r
, const secp256k1_ge
*a
);
126 /** Clear a secp256k1_gej to prevent leaking sensitive information. */
127 static void secp256k1_gej_clear(secp256k1_gej
*r
);
129 /** Clear a secp256k1_ge to prevent leaking sensitive information. */
130 static void secp256k1_ge_clear(secp256k1_ge
*r
);
132 /** Convert a group element to the storage type. */
133 static void secp256k1_ge_to_storage(secp256k1_ge_storage
*r
, const secp256k1_ge
*a
);
135 /** Convert a group element back from the storage type. */
136 static void secp256k1_ge_from_storage(secp256k1_ge
*r
, const secp256k1_ge_storage
*a
);
138 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time. */
139 static void secp256k1_ge_storage_cmov(secp256k1_ge_storage
*r
, const secp256k1_ge_storage
*a
, int flag
);
141 /** Rescale a jacobian point by b which must be non-zero. Constant-time. */
142 static void secp256k1_gej_rescale(secp256k1_gej
*r
, const secp256k1_fe
*b
);
144 #endif /* SECP256K1_GROUP_H */