Refactor the GLV recoding implementation.

bench/bench_bn.c

@@ -1001,11 +1001,9 @@ static void arith(void) {
 #if defined(WITH_EP) && defined(EP_ENDOM) && (EP_MUL == LWNAF || EP_FIX == COMBS || EP_FIX == LWNAF || EP_SIM == INTER || !defined(STRIP))
 	if (ep_param_set_any_endom() == RLC_OK) {
 		BENCH_RUN("bn_rec_glv") {
-			ep_curve_get_v1(d);
-			ep_curve_get_v2(e);
 			ep_curve_get_ord(c);
 			bn_rand_mod(a, c);
-			BENCH_ADD(bn_rec_glv(a, b, a, c, (const bn_t *)d, (const bn_t *)e));
+			BENCH_ADD(bn_rec_glv(a, b, a, c, ep_curve_get_v1(), ep_curve_get_v2()));
 		}
 		BENCH_END;
 	}

include/relic_bn.h

@@ -1525,8 +1525,8 @@ void bn_rec_jsf(int8_t *jsf, size_t *len, const bn_t k, const bn_t l);
  * @param[in] v1			- the set of parameters v1 for the GLV method.
  * @param[in] v2			- the set of parameters v2 for the GLV method.
  */
-void bn_rec_glv(bn_t k0, bn_t k1, const bn_t k, const bn_t n, const bn_t v1[],
-		const bn_t v2[]);
+void bn_rec_glv(bn_t k0, bn_t k1, const bn_t k, const bn_t n, const bn_st *v1,
+		const bn_st *v2);
 
 /**
  * Recodes a scalar in subscalars according to Frobenius endomorphism.
@@ -1545,14 +1545,15 @@ void bn_rec_frb(bn_t *ki, int sub, const bn_t k, const bn_t x, const bn_t n,
  * Recodes subscalars in the signed aligned column representation..
  *
  * @param[out] b			- the recoded subscalars.
- * @param[in] len			- the length in bytes of the recoding.
+ * @param[in,out] len		- the length in bytes of the recoding.
  * @param[in] k				- the subscalars to recode.
  * @param[in] c				- the splitting factor.
  * @param[in] m				- the number of subscalars to recode.
  * @param[in] n				- the bit length of the group order.
  * @throw ERR_NO_BUFFER		- if the buffer capacity is insufficient.
  */
-void bn_rec_sac(int8_t *b, size_t *len, bn_t *k, size_t c, size_t m, size_t n);
+void bn_rec_sac(int8_t *b, size_t *len, const bn_t *k, size_t c, size_t m,
+		size_t n);
 
 /**
  * Computes the coefficients of the polynomial representing the Lagrange

include/relic_ep.h

@@ -540,12 +540,12 @@ dig_t *ep_curve_get_beta(void);
 /**
  * Returns the parameter V1 of the prime curve.
  */
-void ep_curve_get_v1(bn_t v[]);
+const bn_st *ep_curve_get_v1(void);
 
 /**
  * Returns the parameter V2 of the prime curve.
  */
-void ep_curve_get_v2(bn_t v[]);
+const bn_st *ep_curve_get_v2(void);
 
 /**
  * Returns a optimization identifier based on the a-coefficient of the curve.

src/bn/relic_bn_rec.c

@@ -30,6 +30,7 @@
  */
 
 #include "relic_core.h"
+#include "relic_bn_low.h"
 
 /*============================================================================*/
 /* Private definitions                                                        */
@@ -406,7 +407,7 @@ void bn_rec_tnaf_mod(bn_t r0, bn_t r1, const bn_t k, int u, size_t m) {
 			bn_neg(t0, t);
 		}
 
-		/*r 0 = r0 + b0, r1 = r1 + b1. */
+		/* r0 = r0 + b0, r1 = r1 + b1. */
 		bn_add(r0, r0, t2);
 		bn_add(r1, r1, t3);
 	}
@@ -697,56 +698,47 @@ void bn_rec_rtnaf(int8_t *tnaf, size_t *len, const bn_t k, int8_t u, size_t m,
 }
 
 void bn_rec_reg(int8_t *naf, size_t *len, const bn_t k, size_t n, size_t w) {
-	int i, l;
-	bn_t t;
-	dig_t t0, mask;
+	/* Leave some room in case n and w do not align perfectly. */
+	size_t i, l = RLC_CEIL(n, w - 1), d = RLC_CEIL(l * (w - 1), RLC_DIG);
+	dig_t mask = RLC_MASK(w), *t = (dig_t *)RLC_ALLOCA(dig_t, d);
 	int8_t u_i;
 
-	bn_null(t);
-
-	mask = RLC_MASK(w);
-	l = RLC_CEIL(n, w - 1);
+	if (t == NULL) {
+		RLC_THROW(ERR_NO_MEMORY);
+		return;
+	}
 
 	if (*len <= l) {
 		*len = 0;
+		RLC_FREE(t);
 		RLC_THROW(ERR_NO_BUFFER);
 		return;
 	}
 
-	RLC_TRY {
-		bn_new(t);
-		bn_abs(t, k);
-
-		memset(naf, 0, *len);
-
-		i = 0;
-		if (w == 2) {
-			for (i = 0; i < l; i++) {
-				u_i = (t->dp[0] & mask) - 2;
-				t->dp[0] -= u_i;
-				naf[i] = u_i;
-				bn_hlv(t, t);
-			}
-			bn_get_dig(&t0, t);
-			naf[i] = t0;
-		} else {
-			for (i = 0; i < l; i++) {
-				u_i = (t->dp[0] & mask) - (1 << (w - 1));
-				t->dp[0] -= u_i;
-				naf[i] = u_i;
-				bn_rsh(t, t, w - 1);
-			}
-			bn_get_dig(&t0, t);
-			naf[i] = t0;
+	memset(naf, 0, *len);
+	dv_zero(t, d);
+	dv_copy(t, k->dp, k->used);
+
+	i = 0;
+	if (w == 2) {
+		for (i = 0; i < l; i++) {
+			u_i = (t[0] & mask) - 2;
+			t[0] -= u_i;
+			naf[i] = u_i;
+			bn_rsh1_low(t, t, d);
 		}
-		*len = l + 1;
-	}
-	RLC_CATCH_ANY {
-		RLC_THROW(ERR_CAUGHT);
-	}
-	RLC_FINALLY {
-		bn_free(t);
+		naf[i] = t[0];
+	} else {
+		for (i = 0; i < l; i++) {
+			u_i = (t[0] & mask) - (1 << (w - 1));
+			t[0] -= u_i;
+			naf[i] = u_i;
+			bn_rshb_low(t, t, d, w - 1);
+		}
+		naf[i] = t[0];
 	}
+	*len = l + 1;
+	RLC_FREE(t);
 }
 
 void bn_rec_jsf(int8_t *jsf, size_t *len, const bn_t k, const bn_t l) {
@@ -825,60 +817,86 @@ void bn_rec_jsf(int8_t *jsf, size_t *len, const bn_t k, const bn_t l) {
 		bn_free(n0);
 		bn_free(n1);
 	}
-
 }
 
-void bn_rec_glv(bn_t k0, bn_t k1, const bn_t k, const bn_t n, const bn_t *v1,
-		const bn_t *v2) {
-	bn_t t, b1, b2;
-	int r1, r2;
-	size_t bits;
-
-	bn_null(b1);
-	bn_null(b2);
-	bn_null(t);
-
-	RLC_TRY {
-		bn_new(b1);
-		bn_new(b2);
-		bn_new(t);
-
-		bn_abs(t, k);
-		bits = bn_bits(n);
-
-		bn_mul(b1, t, v1[0]);
-		r1 = bn_get_bit(b1, bits);
-		bn_rsh(b1, b1, bits + 1);
-		bn_add_dig(b1, b1, r1);
-
-		bn_mul(b2, t, v2[0]);
-		r2 = bn_get_bit(b2, bits);
-		bn_rsh(b2, b2, bits + 1);
-		bn_add_dig(b2, b2, r2);
-
-		bn_mul(k0, b1, v1[1]);
-		bn_mul(k1, b2, v2[1]);
-		bn_add(k0, k0, k1);
-		bn_sub(k0, t, k0);
-
-		bn_mul(k1, b1, v1[2]);
-		bn_mul(t, b2, v2[2]);
-		bn_add(k1, k1, t);
-		bn_neg(k1, k1);
-	}
-	RLC_CATCH_ANY {
-		RLC_THROW(ERR_CAUGHT);
-	}
-	RLC_FINALLY {
-		bn_free(b1);
-		bn_free(b2);
-		bn_free(t);
-	}
+void bn_rec_glv(bn_t k0, bn_t k1, const bn_t k, const bn_t n, const bn_st *v1,
+		const bn_st *v2) {
+	size_t bits = bn_bits(n), d = bits >> RLC_DIG_LOG, b = bits % RLC_DIG;
+	dig_t r, b1[2 * RLC_FP_DIGS + 1] = { 0 }, b2[2 * RLC_FP_DIGS + 1] = { 0 };
+	dig_t _k[2 * RLC_FP_DIGS + 1] = { 0 }, _v[2 * RLC_FP_DIGS] = { 0 };
+
+	/* Constant-time, except for the first scalar copy. */
+
+	/* b1 = (k * v10) >> (bits + 1). */
+	dv_copy(_k, k->dp, k->used);
+	dv_copy(_v, v1[0].dp, v1[0].used);
+	bn_muln_low(b1, _k, _v, RLC_FP_DIGS);
+	r = (b1[d] >> b) & (dig_t)1;
+	dv_rshd(b1, b1, 2 * RLC_FP_DIGS + 1, d);
+	bn_rshb_low(b1, b1, 2 * RLC_FP_DIGS + 1, b);
+	bn_rsh1_low(b1, b1, 2 * RLC_FP_DIGS + 1);
+	bn_add1_low(b1, b1, r, 2 * RLC_FP_DIGS + 1);
+
+	/* b2 = (k * v20) >> (bits + 1). */
+	dv_zero(_v, 2 * RLC_FP_DIGS);
+	dv_copy(_v, v2[0].dp, v2[0].used);
+	bn_muln_low(b2, _k, _v, RLC_FP_DIGS);
+	r = (b2[d] >> b) & (dig_t)1;
+	dv_rshd(b2, b2, 2 * RLC_FP_DIGS + 1, d);
+	bn_rshb_low(b2, b2, 2 * RLC_FP_DIGS + 1, b);
+	bn_rsh1_low(b2, b2, 2 * RLC_FP_DIGS + 1);
+	bn_add1_low(b2, b2, r, 2 * RLC_FP_DIGS + 1);
+
+	/* k0 = b1 * v11 */
+	dv_zero(_v, 2 * RLC_FP_DIGS);
+	dv_copy(_v, v1[1].dp, v1[1].used);
+	bn_muln_low(k0->dp, b1, _v, RLC_FP_DIGS);
+	k0->dp[2 * RLC_FP_DIGS] = 0;
+	k0->sign = v1[0].sign ^ v1[1].sign;
+
+	/* k1 = b2 * v21 */
+	dv_zero(_v, 2 * RLC_FP_DIGS);
+	dv_copy(_v, v2[1].dp, v2[1].used);
+	bn_muln_low(k1->dp, b2, _v, RLC_FP_DIGS);
+	k1->dp[2 * RLC_FP_DIGS] = 0;
+	k1->sign = v2[0].sign ^ v2[1].sign;
+
+	/* k0 = k - k0 - k1. */
+	bn_negs_low(k0->dp, k0->dp, k0->sign ^ 1, 2 * RLC_FP_DIGS + 1);
+	bn_negs_low(k1->dp, k1->dp, k1->sign ^ 1, 2 * RLC_FP_DIGS + 1);
+	bn_addn_low(k0->dp, k0->dp, k1->dp, 2 * RLC_FP_DIGS + 1);
+	bn_addn_low(k0->dp, k0->dp, _k, 2 * RLC_FP_DIGS + 1);
+	k0->sign = k0->dp[2 * RLC_FP_DIGS] & 1;
+	bn_negs_low(k0->dp, k0->dp, k0->sign, 2 * RLC_FP_DIGS + 1);
+	k0->used = 2 * RLC_FP_DIGS;
+	bn_trim(k0);
+
+	/* k1 = 0 - b1 * v21 - b2 * v21. */
+	dv_zero(_v, 2 * RLC_FP_DIGS);
+	dv_copy(_v, v1[2].dp, v1[2].used);
+	bn_muln_low(k1->dp, b1, _v, RLC_FP_DIGS);
+	k1->dp[2 * RLC_FP_DIGS] = 0;
+	k1->sign = v1[0].sign ^ v1[2].sign;
+
+	dv_zero(_v, 2 * RLC_FP_DIGS);
+	dv_copy(_v, v2[2].dp, v2[2].used);
+	bn_muln_low(_k, b2, _v, RLC_FP_DIGS);
+	_k[2 * RLC_FP_DIGS] = 0;
+	r = v2[0].sign ^ v2[2].sign;
+
+	bn_negs_low(_k, _k, r ^ 1, 2 * RLC_FP_DIGS + 1);
+	bn_negs_low(k1->dp, k1->dp, k1->sign ^ 1, 2 * RLC_FP_DIGS + 1);
+	bn_addn_low(k1->dp, k1->dp, _k, 2 * RLC_FP_DIGS + 1);
+	k1->sign = k1->dp[2 * RLC_FP_DIGS] & 1;
+	bn_negs_low(k1->dp, k1->dp, k1->sign, 2 * RLC_FP_DIGS + 1);
+	k1->used = 2 * RLC_FP_DIGS;
+	bn_trim(k1);
 }
 
-void bn_rec_sac(int8_t *b, size_t *len, bn_t *k, size_t c, size_t m, size_t n) {
+void bn_rec_sac(int8_t *b, size_t *len, const bn_t *k, size_t c, size_t m,
+		size_t n) {
 	/* Assume k0 is the sign-aligner. */
-	bn_t *t = RLC_ALLOCA(bn_t, m);
+	bn_t *t = (bn_t *)RLC_ALLOCA(bn_t, m);
 	size_t l = RLC_CEIL(n, c * m) + 1;
 	int8_t bji;
 
@@ -895,11 +913,14 @@ void bn_rec_sac(int8_t *b, size_t *len, bn_t *k, size_t c, size_t m, size_t n) {
 	}
 
 	RLC_TRY {
-		fp_prime_get_par(t[0]);
-		l = RLC_MAX(l, bn_bits(t[0]) + 1);
 		for (size_t i = 0; i < m; i++) {
 			bn_null(t[i]);
 			bn_new(t[i]);
+		}
+
+		fp_prime_get_par(t[0]);
+		l = RLC_MAX(l, bn_bits(t[0]) + 1);
+		for (size_t i = 0; i < m; i++) {
 			bn_copy(t[i], k[i]);
 			/* The current basis for some curves might be one bit longer. */
 			if (ep_curve_is_pairf() == EP_BN) {