From f2e34a80d3fa5f8998b13a78ab169b3891fd2265 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Thu, 1 Jan 2026 23:00:57 +0100 Subject: [PATCH] ge25519_has_small_order: remove the inversion Re-express the affine checks in projective form to avoid the inversion. Based on a suggestion from @Sc00bz in https://github.com/jedisct1/libsodium/discussions/1500 -- Thanks! --- .../crypto_core/ed25519/ref10/ed25519_ref10.c | 20 +++++++------------ 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c index 4b824f6d..55369757 100644 --- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c +++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c @@ -1170,24 +1170,18 @@ ge25519_is_canonical(const unsigned char *s) int ge25519_has_small_order(const ge25519_p3 *p) { - fe25519 recip; - fe25519 x; - fe25519 x_neg; - fe25519 y; fe25519 y_sqrtm1; fe25519 c; int ret = 0; - fe25519_invert(recip, p->Z); - fe25519_mul(x, p->X, recip); - ret |= fe25519_iszero(x); - fe25519_mul(y, p->Y, recip); - ret |= fe25519_iszero(y); - fe25519_neg(x_neg, p->X); - fe25519_mul(y_sqrtm1, y, fe25519_sqrtm1); - fe25519_sub(c, y_sqrtm1, x); + ret |= fe25519_iszero(p->X); + ret |= fe25519_iszero(p->Y); + ret |= fe25519_iszero(p->Z); + fe25519_mul(y_sqrtm1, p->Y, fe25519_sqrtm1); + fe25519_sub(c, y_sqrtm1, p->X); ret |= fe25519_iszero(c); - fe25519_sub(c, y_sqrtm1, x_neg); + fe25519_mul(c, p->X, p->Z); + fe25519_add(c, y_sqrtm1, c); ret |= fe25519_iszero(c); return ret;