authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-03-02 11:27:04+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2025-03-02 11:27:04+01:00
logd8d2aa9af438bffa643aabb180011f275afd87d3
treec7ff17b73b194820a1df462bc2055a2b5bfef729
parenta6525c1762733613c13f61ae5cb1fdd1467f7378
signaturebadge-check Signed by PGP key B5690EEEBB952194

crypto.pcurves.common: generalize invert() (#23039)

The Bernstein-Yang inversion code was meant to be used only with the fields we currently use for the NIST curves. But people copied that code and were confused that it didn't work as expected with other field sizes. It doesn't cost anything to make it work with other field sizes, that may support in the future. So let's do it. This also reduces the diff with the example zig code in fiat crypto. Suggested by @Rexicon226 -- Thank you!

1 files changed, 1 insertions(+), 1 deletions(-)

lib/std/crypto/pcurves/common.zig+1-1
...@@ -197,7 +197,7 @@ pub fn Field(comptime params: FieldParams) type {...@@ -197,7 +197,7 @@ pub fn Field(comptime params: FieldParams) type {
197 /// Return the inverse of a field element, or 0 if a=0.197 /// Return the inverse of a field element, or 0 if a=0.
198 // Field inversion from https://eprint.iacr.org/2021/549.pdf198 // Field inversion from https://eprint.iacr.org/2021/549.pdf
199 pub fn invert(a: Fe) Fe {199 pub fn invert(a: Fe) Fe {
200 const iterations = (49 * field_bits + 57) / 17;200 const iterations = (49 * field_bits + if (field_bits < 46) 80 else 57) / 17;
201 const Limbs = @TypeOf(a.limbs);201 const Limbs = @TypeOf(a.limbs);
202 const Word = @TypeOf(a.limbs[0]);202 const Word = @TypeOf(a.limbs[0]);
203 const XLimbs = [a.limbs.len + 1]Word;203 const XLimbs = [a.limbs.len + 1]Word;