saymrwulf/curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/curve25519-dalek-source.git synced 2026-09-05 20:30:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Replace batch inversion for FieldElement with sequential variant of Montgomery's trick.

Browse source
This commit is contained in:
Sean Bowe 2018-06-30 16:50:07 -06:00
parent 6294c02b52
commit 02af12b81a
No known key found for this signature in database
GPG key ID: 95684257D8F8B031
1 changed files with 27 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

73
src/field.rs
View file

@ -142,58 +142,34 @@ impl FieldElement {
/// Given a slice of public `FieldElements`, replace each with its inverse. /// Given a slice of public `FieldElements`, replace each with its inverse.
/// ///
/// All input `FieldElements` **MUST** be nonzero. /// All input `FieldElements` **MUST** be nonzero.
///
/// This function is most efficient when the batch size (slice
/// length) is a power of 2.
#[cfg(any(feature = "alloc", feature = "std"))] #[cfg(any(feature = "alloc", feature = "std"))]
pub fn batch_invert(inputs: &mut [FieldElement]) { pub fn batch_invert(inputs: &mut [FieldElement]) {
// First, compute the product of all inputs using a product // Montgomery’s Trick and Fast Implementation of Masked AES
// tree: // Genelle, Prouff and Quisquater
// // Section 3.2
// Inputs: [x_0, x_1, x_2]
//
// Tree:
//
// x_0*x_1*x_2*1 tree[1]
// / \
// x_0*x_1 x_2*1 tree[2,3]
// / \ / \
// x_0 x_1 x_2 1 tree[4,5,6,7]
//
// The leaves of the tree are the inputs. We store the tree in
// an array of length 2*n, similar to a binary heap.
//
// To initialize the tree, set every node to 1, then fill in
// the leaf nodes with the input variables. Finally, set every
// non-leaf node to be the product of its children.
let n = inputs.len().next_power_of_two(); let n = inputs.len();
let mut tree = vec![FieldElement::one(); 2*n]; let mut scratch = vec![FieldElement::one(); n];
tree[n..n+inputs.len()].copy_from_slice(inputs);
for i in (1..n).rev() { // Keep an accumulator of all of the previous products
tree[i] = &tree[2*i] * &tree[2*i+1]; let mut acc = FieldElement::one();
// Pass through the input vector, recording the previous
// products in the scratch space
for (input, scratch) in inputs.iter().zip(scratch.iter_mut()) {
*scratch = acc;
acc = &acc * input;
} }
// The root of the tree is the product of all inputs, and is // Compute the inverse of all products
// stored at index 1. Compute its inverse. acc = acc.invert();
let allinv = tree[1].invert();
// To compute y_i = 1/x_i, start at the i-th leaf node of the // Pass through the vector backwards to compute the inverses
// tree, and walk up to the root of the tree, multiplying // in place
// `allinv` by each sibling. This computes for (input, scratch) in inputs.iter_mut().rev().zip(scratch.into_iter().rev()) {
// let tmp = &acc * input;
// y_i = y * (all x_j except x_i) *input = &acc * &scratch;
// acc = tmp;
// using lg(n) multiplications for each y_i, taking n*lg(n) in
// total.
for i in 0..inputs.len() {
let mut inv = allinv;
let mut node = n + i;
while node > 1 {
inv *= &tree[node ^ 1];
node = node >> 1;
}
inputs[i] = inv;
} }
} }
@ -496,4 +472,9 @@ mod test {
assert_eq!(one_bytes[i], 0); assert_eq!(one_bytes[i], 0);
} }
} }
#[test]
fn batch_invert_empty() {
FieldElement::batch_invert(&mut []);
}
} }