From 62d43752df7fbfd14ad775d5e605536e9cfaa0ba Mon Sep 17 00:00:00 2001
From: Henry & Isis <henry+isis@en.ciph.re>
Date: Thu, 5 Apr 2018 05:12:13 +0000
Subject: [PATCH] Add NafLookupTable8 and use for pre-computed basepoint table
 generation.

---
 build.rs                              | 10 +++---
 src/scalar_mul/vartime_double_base.rs |  2 +-
 src/scalar_mul/window.rs              | 47 +++++++++++++++++++++++++++
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/build.rs b/build.rs
index 7d06199..389e7bb 100644
--- a/build.rs
+++ b/build.rs
@@ -59,7 +59,7 @@ mod scalar_mul;
 
 use edwards::EdwardsBasepointTable;
 use curve_models::AffineNielsPoint;
-use scalar_mul::window::NafLookupTable5;
+use scalar_mul::window::NafLookupTable8;
 
 fn main() {
     // Enable the "precomputed_tables" feature in the main build stage
@@ -86,7 +86,7 @@ use edwards::EdwardsBasepointTable;
 use curve_models::AffineNielsPoint;
 
 use scalar_mul::window::LookupTable;
-use scalar_mul::window::NafLookupTable5;
+use scalar_mul::window::NafLookupTable8;
 
 /// Table containing precomputed multiples of the Ed25519 basepoint \\\\(B = (x, 4/5)\\\\).
 pub const ED25519_BASEPOINT_TABLE: EdwardsBasepointTable = ED25519_BASEPOINT_TABLE_INNER_DOC_HIDDEN;
@@ -101,13 +101,13 @@ pub const ED25519_BASEPOINT_TABLE_INNER_DOC_HIDDEN: EdwardsBasepointTable = {:?}
 
     // Now generate AFFINE_ODD_MULTIPLES_OF_BASEPOINT
     let B = &constants::ED25519_BASEPOINT_POINT;
-    let odd_multiples = NafLookupTable5::<AffineNielsPoint>::from(B);
+    let odd_multiples = NafLookupTable8::<AffineNielsPoint>::from(B);
 
     f.write_all(
         format!(
             "\n
-/// Odd multiples of the basepoint `[B, 3B, 5B, 7B, 9B, 11B, 13B, 15B]`.
-pub(crate) const AFFINE_ODD_MULTIPLES_OF_BASEPOINT: NafLookupTable5<AffineNielsPoint> = {:?};
+/// Odd multiples of the basepoint `[B, 3B, 5B, 7B, 9B, 11B, 13B, 15B, ..., 127B]`.
+pub(crate) const AFFINE_ODD_MULTIPLES_OF_BASEPOINT: NafLookupTable8<AffineNielsPoint> = {:?};
 \n\n",
             &odd_multiples
         ).as_bytes(),
diff --git a/src/scalar_mul/vartime_double_base.rs b/src/scalar_mul/vartime_double_base.rs
index bdb7005..86022d2 100644
--- a/src/scalar_mul/vartime_double_base.rs
+++ b/src/scalar_mul/vartime_double_base.rs
@@ -19,7 +19,7 @@ use scalar_mul::window::NafLookupTable5;
 /// Compute \\(aA + bB\\) in variable time, where \\(B\\) is the Ed25519 basepoint.
 pub fn mul(a: &Scalar, A: &EdwardsPoint, b: &Scalar) -> EdwardsPoint {
     let a_naf = a.non_adjacent_form(5);
-    let b_naf = b.non_adjacent_form(5);
+    let b_naf = b.non_adjacent_form(8);
 
     // Find starting index
     let mut i: usize = 255;
diff --git a/src/scalar_mul/window.rs b/src/scalar_mul/window.rs
index e0b69c2..91ebb65 100644
--- a/src/scalar_mul/window.rs
+++ b/src/scalar_mul/window.rs
@@ -163,3 +163,50 @@ impl<'a> From<&'a EdwardsPoint> for NafLookupTable5<AffineNielsPoint> {
         NafLookupTable5(Ai)
     }
 }
+
+/// Holds stuff up to 8.
+#[derive(Copy, Clone)]
+pub(crate) struct NafLookupTable8<T>(pub(crate) [T; 64]);
+
+impl<T: Copy> NafLookupTable8<T> {
+    pub fn select(&self, x: usize) -> T {
+        debug_assert_eq!(x & 1, 1);
+        debug_assert!(x < 256);
+
+        self.0[x / 2]
+    }
+}
+
+impl<T: Debug> Debug for NafLookupTable8<T> {
+    fn fmt(&self, f: &mut ::core::fmt::Formatter) -> ::core::fmt::Result {
+        write!(f, "NafLookupTable8([\n")?;
+        for i in 0..64 {
+            write!(f, "\t{:?},\n", &self.0[i])?;
+        }
+        write!(f, "])")
+    }
+}
+
+impl<'a> From<&'a EdwardsPoint> for NafLookupTable8<ProjectiveNielsPoint> {
+    fn from(A: &'a EdwardsPoint) -> Self {
+        let mut Ai = [A.to_projective_niels(); 64];
+        let A2 = A.double();
+        for i in 0..63 {
+            Ai[i + 1] = (&A2 + &Ai[i]).to_extended().to_projective_niels();
+        }
+        // Now Ai = [A, 3A, 5A, 7A, 9A, 11A, 13A, 15A, ..., 127A]
+        NafLookupTable8(Ai)
+    }
+}
+
+impl<'a> From<&'a EdwardsPoint> for NafLookupTable8<AffineNielsPoint> {
+    fn from(A: &'a EdwardsPoint) -> Self {
+        let mut Ai = [A.to_affine_niels(); 64];
+        let A2 = A.double();
+        for i in 0..63 {
+            Ai[i + 1] = (&A2 + &Ai[i]).to_extended().to_affine_niels();
+        }
+        // Now Ai = [A, 3A, 5A, 7A, 9A, 11A, 13A, 15A, ..., 127A]
+        NafLookupTable8(Ai)
+    }
+}