QPQ-AG/libsodium
12
0
Fork 0
mirror of https://github.com/jedisct1/libsodium.git synced 2026-08-25 08:37:13 +09:00
Code Issues Packages Projects Releases Wiki Activity

ge25519_has_small_order: remove the inversion

Browse Source 
Re-express the affine checks in projective form to avoid the inversion.

Based on a suggestion from @Sc00bz in
https://github.com/jedisct1/libsodium/discussions/1500 -- Thanks!
This commit is contained in:
Frank Denis
2026-01-01 23:00:57 +01:00
parent 838c523e64
commit f2e34a80d3
1 changed files with 7 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
+7 -13
View File
@@ -1170,24 +1170,18 @@ ge25519_is_canonical(const unsigned char *s)
int
ge25519_has_small_order(const ge25519_p3 *p)
{
fe25519 recip;
fe25519 x;
fe25519 x_neg;
fe25519 y;
fe25519 y_sqrtm1;
fe25519 c;
int ret = 0;
fe25519_invert(recip, p->Z);
fe25519_mul(x, p->X, recip);
ret |= fe25519_iszero(x);
fe25519_mul(y, p->Y, recip);
ret |= fe25519_iszero(y);
fe25519_neg(x_neg, p->X);
fe25519_mul(y_sqrtm1, y, fe25519_sqrtm1);
fe25519_sub(c, y_sqrtm1, x);
ret |= fe25519_iszero(p->X);
ret |= fe25519_iszero(p->Y);
ret |= fe25519_iszero(p->Z);
fe25519_mul(y_sqrtm1, p->Y, fe25519_sqrtm1);
fe25519_sub(c, y_sqrtm1, p->X);
ret |= fe25519_iszero(c);
fe25519_sub(c, y_sqrtm1, x_neg);
fe25519_mul(c, p->X, p->Z);
fe25519_add(c, y_sqrtm1, c);
ret |= fe25519_iszero(c);
return ret;