msm for 4 values

Author: rodiazet

lib/evmone_precompiles/ecc.hpp

@@ -484,6 +484,71 @@ inline ProjPoint<Curve> shamir_multiply(const typename Curve::uint_type& u,
     return r;
 }
 
+template <typename Curve>
+inline ProjPoint<Curve> shamir_multiply(const typename Curve::uint_type& u1,
+    const AffinePoint<Curve>& p1, const typename Curve::uint_type& u2, const AffinePoint<Curve>& p2,
+    const typename Curve::uint_type& u3, const AffinePoint<Curve>& p3,
+    const typename Curve::uint_type& u4, const AffinePoint<Curve>& p4)
+{
+    ProjPoint<Curve> r;
+
+    const auto w = u1 | u2 | u3 | u4;
+    const auto bit_width = sizeof(w) * 8 - intx::clz(w);
+    if (bit_width == 0)
+        return r;
+
+    const auto p1p2 = add(p1, p2);
+    const auto p1p3 = add(p1, p3);
+    const auto p1p4 = add(p1, p4);
+    const auto p2p3 = add(p2, p3);
+    const auto p2p4 = add(p2, p4);
+    const auto p3p4 = add(p3, p4);
+
+    const auto p1p2p3 = add(p1p2, p3);
+    const auto p1p2p4 = add(p1p2, p4);
+
+    const auto p1p3p4 = add(p1p3, p4);
+
+    const auto p2p3p4 = add(p2p3, p4);
+
+    const auto p1p2p3p4 = add(p1p2, p3p4);
+
+    const AffinePoint<Curve>* const points[]{
+        nullptr,
+        &p1,        // 0001
+        &p2,        // 0010
+        &p1p2,      // 0011
+        &p3,        // 0100
+        &p1p3,      // 0101
+        &p2p3,      // 0110
+        &p1p2p3,    // 0111
+        &p4,        // 1000
+        &p1p4,      // 1001
+        &p2p4,      // 1010
+        &p1p2p4,    // 1011
+        &p3p4,      // 1100
+        &p1p3p4,    // 1101
+        &p2p3p4,    // 1110
+        &p1p2p3p4,  // 1111
+    };
+
+    for (auto i = bit_width; i != 0; --i)
+    {
+        r = dbl(r);
+
+        const auto u1_bit = bit_test(u1, i - 1);
+        const auto u2_bit = bit_test(u2, i - 1);
+        const auto u3_bit = bit_test(u3, i - 1);
+        const auto u4_bit = bit_test(u4, i - 1);
+        const auto idx = u1_bit | (u2_bit << 1) | (u3_bit << 2) | (u4_bit << 3);
+        if (idx == 0)
+            continue;
+        r = add(r, *points[idx]);
+    }
+
+    return r;
+}
+
 // Decomposes scalar k into k₁ and k₂ such that k₁ + k₂λ ≡ k mod n
 // Returns ((is_negative, k1), (is_negative, k2))
 template <typename ConfigT, typename UIntT>

lib/evmone_precompiles/secp256k1.cpp

@@ -115,14 +115,10 @@ std::optional<AffinePoint> secp256k1_ecdsa_recover(
 
     const auto LG = AffinePoint{BETA * G.x, !u1k2.first ? G.y : -G.y};
     const auto LR = AffinePoint{BETA * R.x, !u2k2.first ? R.y : -R.y};
+    
+    const auto Q = shamir_multiply(u1k1.second, !u1k1.first ? G : AffinePoint{G.x, -G.y},
+        u1k2.second, LG, u2k1.second, !u2k1.first ? R : AffinePoint{R.x, -R.y}, u2k2.second, LR);
 
-    const auto T1 =
-        shamir_multiply(u1k1.second, !u1k1.first ? G : AffinePoint{G.x, -G.y}, u1k2.second, LG);
-    const auto T2 =
-        shamir_multiply(u2k1.second, !u2k1.first ? R : AffinePoint{R.x, -R.y}, u2k2.second, LR);
-    assert(T2 != 0);  // Because u2 != 0 and R != 0.
-
-    const auto Q = ecc::add(T1, T2);
     // Any other validity check needed?
     if (Q == 0)
         return std::nullopt;