7#ifndef SECP256K1_ECMULT_CONST_IMPL_H
8#define SECP256K1_ECMULT_CONST_IMPL_H
16#define ECMULT_CONST_TABLE_GET_GE(r,pre,n,w) do { \
19 int mask = (n) >> (sizeof(n) * CHAR_BIT - 1); \
20 int abs_n = ((n) + mask) ^ mask; \
21 int idx_n = abs_n >> 1; \
23 VERIFY_CHECK(((n) & 1) == 1); \
24 VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \
25 VERIFY_CHECK((n) <= ((1 << ((w)-1)) - 1)); \
26 VERIFY_SETUP(secp256k1_fe_clear(&(r)->x)); \
27 VERIFY_SETUP(secp256k1_fe_clear(&(r)->y)); \
30 (r)->x = (pre)[m].x; \
31 (r)->y = (pre)[m].y; \
32 for (m = 1; m < ECMULT_TABLE_SIZE(w); m++) { \
35 secp256k1_fe_cmov(&(r)->x, &(pre)[m].x, m == idx_n); \
36 secp256k1_fe_cmov(&(r)->y, &(pre)[m].y, m == idx_n); \
39 secp256k1_fe_negate(&neg_y, &(r)->y, 1); \
40 secp256k1_fe_cmov(&(r)->y, &neg_y, (n) != abs_n); \
113 even = ((u & 1) == 0);
129 }
while (
word * w < size);
#define ECMULT_CONST_TABLE_GET_GE(r, pre, n, w)
static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, const secp256k1_scalar *scalar, int size)
static int secp256k1_wnaf_const(int *wnaf, const secp256k1_scalar *scalar, int w, int size)
Convert a number to WNAF notation.
static void secp256k1_ecmult_odd_multiples_table_globalz_windowa(secp256k1_ge *pre, secp256k1_fe *globalz, const secp256k1_gej *a)
Fill a table 'pre' with precomputed odd multiples of a.
#define ECMULT_TABLE_SIZE(w)
The number of entries a table with precomputed multiples needs to have.
#define WNAF_SIZE_BITS(bits, w)
static void secp256k1_fe_normalize_weak(secp256k1_fe *r)
Weakly normalize a field element: reduce its magnitude to 1, but don't fully normalize.
static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *SECP256K1_RESTRICT b)
Sets a field element to be the product of two others.
static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr)
Set r equal to the double of a.
static void secp256k1_ge_mul_lambda(secp256k1_ge *r, const secp256k1_ge *a)
Set r to be equal to lambda times a, where lambda is chosen in a way such that this is very fast.
static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b)
Set r equal to the sum of a and b (with b given in affine coordinates, and not infinity).
static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a)
Convert a group element back from the storage type.
static void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag)
If flag is true, set *r equal to *a; otherwise leave it.
static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a)
Set a group element equal to another which is given in jacobian coordinates.
static void secp256k1_ge_neg(secp256k1_ge *r, const secp256k1_ge *a)
Set r equal to the inverse of a (i.e., mirrored around the X axis)
static void secp256k1_gej_double(secp256k1_gej *r, const secp256k1_gej *a)
Set r equal to the double of a.
static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a)
Set a group element (jacobian) equal to another which is given in affine coordinates.
static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge *a)
Convert a group element to the storage type.
T GetRand(T nMax=std::numeric_limits< T >::max()) noexcept
Generate a uniform random integer of type T in the range [0..nMax) nMax defaults to std::numeric_limi...
static int secp256k1_scalar_is_even(const secp256k1_scalar *a)
Check whether a scalar, considered as an nonnegative integer, is even.
static int secp256k1_scalar_is_zero(const secp256k1_scalar *a)
Check whether a scalar equals zero.
static int secp256k1_scalar_cond_negate(secp256k1_scalar *a, int flag)
Conditionally negate a number, in constant time.
static int secp256k1_scalar_is_one(const secp256k1_scalar *a)
Check whether a scalar equals one.
static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a)
Compute the complement of a scalar (modulo the group order).
static int secp256k1_scalar_is_high(const secp256k1_scalar *a)
Check whether a scalar is higher than the group order divided by 2.
static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag)
Conditionally add a power of two to a scalar.
static void secp256k1_scalar_split_lambda(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *k)
Find r1 and r2 such that r1+r2*lambda = k, where r1 and r2 or their negations are maximum 128 bits lo...
static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n)
Shift a scalar right by some amount strictly between 0 and 16, returning the low bits that were shift...
#define VERIFY_CHECK(cond)
A group element of the secp256k1 curve, in affine coordinates.
A group element of the secp256k1 curve, in jacobian coordinates.
A scalar modulo the group order of the secp256k1 curve.