|
| 1 | +/********************************************************************** |
| 2 | + * Copyright (c) 2015 Andrew Poelstra * |
| 3 | + * Distributed under the MIT software license, see the accompanying * |
| 4 | + * file COPYING or http://www.opensource.org/licenses/mit-license.php.* |
| 5 | + **********************************************************************/ |
| 6 | + |
| 7 | +#if defined HAVE_CONFIG_H |
| 8 | +#include "libsecp256k1-config.h" |
| 9 | +#endif |
| 10 | + |
| 11 | +#include <stdio.h> |
| 12 | +#include <stdlib.h> |
| 13 | + |
| 14 | +#include <time.h> |
| 15 | + |
| 16 | +#ifndef EXHAUSTIVE_TEST_ORDER |
| 17 | +#define EXHAUSTIVE_TEST_ORDER 199 |
| 18 | +#endif |
| 19 | + |
| 20 | +#include "include/secp256k1.h" |
| 21 | +#include "group.h" |
| 22 | +#include "secp256k1.c" |
| 23 | +#include "testrand_impl.h" |
| 24 | + |
| 25 | +/** stolen from tests.c */ |
| 26 | +void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) { |
| 27 | + CHECK(a->infinity == b->infinity); |
| 28 | + if (a->infinity) { |
| 29 | + return; |
| 30 | + } |
| 31 | + CHECK(secp256k1_fe_equal_var(&a->x, &b->x)); |
| 32 | + CHECK(secp256k1_fe_equal_var(&a->y, &b->y)); |
| 33 | +} |
| 34 | + |
| 35 | +void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) { |
| 36 | + secp256k1_fe z2s; |
| 37 | + secp256k1_fe u1, u2, s1, s2; |
| 38 | + CHECK(a->infinity == b->infinity); |
| 39 | + if (a->infinity) { |
| 40 | + return; |
| 41 | + } |
| 42 | + /* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */ |
| 43 | + secp256k1_fe_sqr(&z2s, &b->z); |
| 44 | + secp256k1_fe_mul(&u1, &a->x, &z2s); |
| 45 | + u2 = b->x; secp256k1_fe_normalize_weak(&u2); |
| 46 | + secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z); |
| 47 | + s2 = b->y; secp256k1_fe_normalize_weak(&s2); |
| 48 | + CHECK(secp256k1_fe_equal_var(&u1, &u2)); |
| 49 | + CHECK(secp256k1_fe_equal_var(&s1, &s2)); |
| 50 | +} |
| 51 | + |
| 52 | +void random_fe(secp256k1_fe *x) { |
| 53 | + unsigned char bin[32]; |
| 54 | + do { |
| 55 | + secp256k1_rand256(bin); |
| 56 | + if (secp256k1_fe_set_b32(x, bin)) { |
| 57 | + return; |
| 58 | + } |
| 59 | + } while(1); |
| 60 | +} |
| 61 | +/** END stolen from tests.c */ |
| 62 | + |
| 63 | +void test_exhaustive_addition(const secp256k1_ge *group, const secp256k1_gej *groupj, int order) { |
| 64 | + int i, j; |
| 65 | + |
| 66 | + /* Sanity-check (and check infinity functions) */ |
| 67 | + CHECK(secp256k1_ge_is_infinity(&group[0])); |
| 68 | + CHECK(secp256k1_gej_is_infinity(&groupj[0])); |
| 69 | + for (i = 1; i < order; i++) { |
| 70 | + CHECK(!secp256k1_ge_is_infinity(&group[i])); |
| 71 | + CHECK(!secp256k1_gej_is_infinity(&groupj[i])); |
| 72 | + } |
| 73 | + |
| 74 | + /* Check all addition formulae */ |
| 75 | + for (j = 0; j < order; j++) { |
| 76 | + secp256k1_fe fe_inv; |
| 77 | + secp256k1_fe_inv(&fe_inv, &groupj[j].z); |
| 78 | + for (i = 0; i < order; i++) { |
| 79 | + secp256k1_ge zless_gej; |
| 80 | + secp256k1_gej tmp; |
| 81 | + /* add_var */ |
| 82 | + secp256k1_gej_add_var(&tmp, &groupj[i], &groupj[j], NULL); |
| 83 | + ge_equals_gej(&group[(i + j) % order], &tmp); |
| 84 | + /* add_ge */ |
| 85 | + if (j > 0) { |
| 86 | + secp256k1_gej_add_ge(&tmp, &groupj[i], &group[j]); |
| 87 | + ge_equals_gej(&group[(i + j) % order], &tmp); |
| 88 | + } |
| 89 | + /* add_ge_var */ |
| 90 | + secp256k1_gej_add_ge_var(&tmp, &groupj[i], &group[j], NULL); |
| 91 | + ge_equals_gej(&group[(i + j) % order], &tmp); |
| 92 | + /* add_zinv_var */ |
| 93 | + zless_gej.infinity = groupj[j].infinity; |
| 94 | + zless_gej.x = groupj[j].x; |
| 95 | + zless_gej.y = groupj[j].y; |
| 96 | + secp256k1_gej_add_zinv_var(&tmp, &groupj[i], &zless_gej, &fe_inv); |
| 97 | + ge_equals_gej(&group[(i + j) % order], &tmp); |
| 98 | + } |
| 99 | + } |
| 100 | + |
| 101 | + /* Check doubling */ |
| 102 | + for (i = 0; i < order; i++) { |
| 103 | + secp256k1_gej tmp; |
| 104 | + if (i > 0) { |
| 105 | + secp256k1_gej_double_nonzero(&tmp, &groupj[i], NULL); |
| 106 | + ge_equals_gej(&group[(2 * i) % order], &tmp); |
| 107 | + } |
| 108 | + secp256k1_gej_double_var(&tmp, &groupj[i], NULL); |
| 109 | + ge_equals_gej(&group[(2 * i) % order], &tmp); |
| 110 | + } |
| 111 | + |
| 112 | + /* Check negation */ |
| 113 | + for (i = 1; i < order; i++) { |
| 114 | + secp256k1_ge tmp; |
| 115 | + secp256k1_gej tmpj; |
| 116 | + secp256k1_ge_neg(&tmp, &group[i]); |
| 117 | + ge_equals_ge(&group[order - i], &tmp); |
| 118 | + secp256k1_gej_neg(&tmpj, &groupj[i]); |
| 119 | + ge_equals_gej(&group[order - i], &tmpj); |
| 120 | + } |
| 121 | +} |
| 122 | + |
| 123 | +void test_exhaustive_ecmult(secp256k1_context *ctx, secp256k1_ge *group, secp256k1_gej *groupj, int order) { |
| 124 | + int i, j; |
| 125 | + const int r_log = secp256k1_rand32() % order; /* TODO be less biased */ |
| 126 | + for (j = 0; j < order; j++) { |
| 127 | + for (i = 0; i < order; i++) { |
| 128 | + secp256k1_gej tmp; |
| 129 | + secp256k1_scalar na, ng; |
| 130 | + secp256k1_scalar_set_int(&na, i); |
| 131 | + secp256k1_scalar_set_int(&ng, j); |
| 132 | + |
| 133 | + secp256k1_ecmult(&ctx->ecmult_ctx, &tmp, &groupj[r_log], &na, &ng); |
| 134 | + ge_equals_gej(&group[(i * r_log + j) % order], &tmp); |
| 135 | + |
| 136 | + /* TODO we cannot exhaustively test ecmult_const as it does a scalar |
| 137 | + * negation for even numbers, and our code is not designed to handle |
| 138 | + * such a small scalar modulus. */ |
| 139 | + } |
| 140 | + } |
| 141 | +} |
| 142 | + |
| 143 | +int main(void) { |
| 144 | + int i; |
| 145 | + secp256k1_gej groupj[EXHAUSTIVE_TEST_ORDER]; |
| 146 | + secp256k1_ge group[EXHAUSTIVE_TEST_ORDER]; |
| 147 | + |
| 148 | + /* Build context */ |
| 149 | + secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY); |
| 150 | + |
| 151 | + /* TODO set z = 1, then do num_tests runs with random z values */ |
| 152 | + |
| 153 | + /* Generate the entire group */ |
| 154 | + secp256k1_ge_set_infinity(&group[0]); |
| 155 | + secp256k1_gej_set_infinity(&groupj[0]); |
| 156 | + for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) { |
| 157 | + secp256k1_fe z; |
| 158 | + random_fe(&z); |
| 159 | + |
| 160 | + secp256k1_gej_add_ge(&groupj[i], &groupj[i - 1], &secp256k1_ge_const_g); |
| 161 | + secp256k1_ge_set_gej(&group[i], &groupj[i]); |
| 162 | + secp256k1_gej_rescale(&groupj[i], &z); |
| 163 | + } |
| 164 | + |
| 165 | + /* Run the tests */ |
| 166 | + test_exhaustive_addition(group, groupj, EXHAUSTIVE_TEST_ORDER); |
| 167 | + test_exhaustive_ecmult(ctx, group, groupj, EXHAUSTIVE_TEST_ORDER); |
| 168 | + |
| 169 | + return 0; |
| 170 | +} |
| 171 | + |
0 commit comments