Make files mostly self-contained

.gitignore

@@ -37,6 +37,7 @@ libtool
 *.lo
 *.o
 *~
+*.[gp]ch
 
 coverage/
 coverage.html

Makefile.am

@@ -8,6 +8,7 @@ lib_LTLIBRARIES = libsecp256k1.la
 include_HEADERS = include/secp256k1.h
 include_HEADERS += include/secp256k1_preallocated.h
 noinst_HEADERS =
+noinst_HEADERS += src/secp256k1_internal.h
 noinst_HEADERS += src/scalar.h
 noinst_HEADERS += src/scalar_4x64.h
 noinst_HEADERS += src/scalar_8x32.h
@@ -57,6 +58,7 @@ noinst_HEADERS += src/int128_struct_impl.h
 noinst_HEADERS += src/scratch.h
 noinst_HEADERS += src/scratch_impl.h
 noinst_HEADERS += src/selftest.h
+noinst_HEADERS += src/selftest_impl.h
 noinst_HEADERS += src/testrand.h
 noinst_HEADERS += src/testrand_impl.h
 noinst_HEADERS += src/hash.h

sage/gen_exhaustive_groups.sage

@@ -99,7 +99,7 @@ def output_b(b):
     print(f"#define SECP256K1_B {int(b)}")
 
 print()
-print("To be put in src/group_impl.h:")
+print("To be put in src/group.h:")
 print()
 print("/* Begin of section generated by sage/gen_exhaustive_groups.sage. */")
 for f in sorted(solutions.keys()):
@@ -141,7 +141,7 @@ print("/* End of section generated by sage/gen_exhaustive_groups.sage. */")
 
 print()
 print()
-print("To be put in src/scalar_impl.h:")
+print("To be put in src/scalar.h:")
 print()
 print("/* Begin of section generated by sage/gen_exhaustive_groups.sage. */")
 first = True

src/bench_ecmult.c

@@ -336,7 +336,7 @@ int main(int argc, char **argv) {
     data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
     scratch_size = secp256k1_strauss_scratch_size(POINTS) + STRAUSS_SCRATCH_OBJECTS*16;
     if (!have_flag(argc, argv, "simple")) {
-        data.scratch = secp256k1_scratch_space_create(data.ctx, scratch_size);
+        data.scratch = secp256k1_scratch_create(&data.ctx->error_callback, scratch_size);
     } else {
         data.scratch = NULL;
     }
@@ -384,7 +384,7 @@ int main(int argc, char **argv) {
     }
 
     if (data.scratch != NULL) {
-        secp256k1_scratch_space_destroy(data.ctx, data.scratch);
+        secp256k1_scratch_destroy(&data.ctx->error_callback, data.scratch);
     }
     secp256k1_context_destroy(data.ctx);
     free(data.scalars);

src/bench_internal.c

@@ -10,13 +10,8 @@
 #include "../include/secp256k1.h"
 
 #include "assumptions.h"
-#include "util.h"
-#include "hash_impl.h"
-#include "field_impl.h"
-#include "group_impl.h"
-#include "scalar_impl.h"
-#include "ecmult_impl.h"
 #include "bench.h"
+#include "util.h"
 
 static void help(int default_iters) {
     printf("Benchmarks various internal routines.\n");

src/ecdsa.h

@@ -12,6 +12,7 @@
 #include "scalar.h"
 #include "group.h"
 #include "ecmult.h"
+#include "ecmult_gen.h"
 
 static int secp256k1_ecdsa_sig_parse(secp256k1_scalar *r, secp256k1_scalar *s, const unsigned char *sig, size_t size);
 static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar *r, const secp256k1_scalar *s);

src/ecmult_compute_table.h

@@ -7,6 +7,8 @@
 #ifndef SECP256K1_ECMULT_COMPUTE_TABLE_H
 #define SECP256K1_ECMULT_COMPUTE_TABLE_H
 
+#include "group.h"
+
 /* Construct table of all odd multiples of gen in range 1..(2**(window_g-1)-1). */
 static void secp256k1_ecmult_compute_table(secp256k1_ge_storage* table, int window_g, const secp256k1_gej* gen);
 

src/ecmult_gen.h

@@ -134,6 +134,7 @@ typedef struct {
 
 static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context* ctx);
 static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context* ctx);
+static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx);
 
 /** Multiply with the generator: R = a*G */
 static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context* ctx, secp256k1_gej *r, const secp256k1_scalar *a);

src/field.h

@@ -29,13 +29,6 @@
  * implementation also provides a secp256k1_fe_verify routine to verify that
  * these fields match the run-time value and perform internal consistency
  * checks. */
-#ifdef VERIFY
-#  define SECP256K1_FE_VERIFY_FIELDS \
-    int magnitude; \
-    int normalized;
-#else
-#  define SECP256K1_FE_VERIFY_FIELDS
-#endif
 
 #if defined(SECP256K1_WIDEMUL_INT128)
 #include "field_5x52.h"

src/field_10x26.h

@@ -30,7 +30,10 @@ typedef struct {
      *     sum(i=0..9, n[i] << (i*26)) < p
      *     (together these imply n[9] <= 2^22 - 1)
      */
-    SECP256K1_FE_VERIFY_FIELDS
+#ifdef VERIFY
+    int magnitude;
+    int normalized;
+#endif
 } secp256k1_fe;
 
 /* Unpacks a constant into a overlapping multi-limbed FE element. */

src/field_10x26_impl.h

@@ -10,7 +10,7 @@
 #include "checkmem.h"
 #include "util.h"
 #include "field.h"
-#include "modinv32_impl.h"
+#include "modinv32.h"
 
 #ifdef VERIFY
 static void secp256k1_fe_impl_verify(const secp256k1_fe *a) {

src/field_5x52.h

@@ -30,7 +30,10 @@ typedef struct {
      *     sum(i=0..4, n[i] << (i*52)) < p
      *     (together these imply n[4] <= 2^48 - 1)
      */
-    SECP256K1_FE_VERIFY_FIELDS
+#ifdef VERIFY
+    int magnitude;
+    int normalized;
+#endif
 } secp256k1_fe;
 
 /* Unpacks a constant into a overlapping multi-limbed FE element. */

src/field_5x52_impl.h

@@ -10,7 +10,7 @@
 #include "checkmem.h"
 #include "util.h"
 #include "field.h"
-#include "modinv64_impl.h"
+#include "modinv64.h"
 
 #include "field_5x52_int128_impl.h"
 

src/group.h

@@ -52,6 +52,68 @@ typedef struct {
 #define SECP256K1_GEJ_Y_MAGNITUDE_MAX 4
 #define SECP256K1_GEJ_Z_MAGNITUDE_MAX 1
 
+/* Begin of section generated by sage/gen_exhaustive_groups.sage. */
+#define SECP256K1_G_ORDER_7 SECP256K1_GE_CONST(\
+    0x66625d13, 0x317ffe44, 0x63d32cff, 0x1ca02b9b,\
+    0xe5c6d070, 0x50b4b05e, 0x81cc30db, 0xf5166f0a,\
+    0x1e60e897, 0xa7c00c7c, 0x2df53eb6, 0x98274ff4,\
+    0x64252f42, 0x8ca44e17, 0x3b25418c, 0xff4ab0cf\
+)
+#define SECP256K1_G_ORDER_13 SECP256K1_GE_CONST(\
+    0xa2482ff8, 0x4bf34edf, 0xa51262fd, 0xe57921db,\
+    0xe0dd2cb7, 0xa5914790, 0xbc71631f, 0xc09704fb,\
+    0x942536cb, 0xa3e49492, 0x3a701cc3, 0xee3e443f,\
+    0xdf182aa9, 0x15b8aa6a, 0x166d3b19, 0xba84b045\
+)
+#define SECP256K1_G_ORDER_199 SECP256K1_GE_CONST(\
+    0x7fb07b5c, 0xd07c3bda, 0x553902e2, 0x7a87ea2c,\
+    0x35108a7f, 0x051f41e5, 0xb76abad5, 0x1f2703ad,\
+    0x0a251539, 0x5b4c4438, 0x952a634f, 0xac10dd4d,\
+    0x6d6f4745, 0x98990c27, 0x3a4f3116, 0xd32ff969\
+)
+/** Generator for secp256k1, value 'g' defined in
+ *  "Standards for Efficient Cryptography" (SEC2) 2.7.1.
+ */
+#define SECP256K1_G SECP256K1_GE_CONST(\
+    0x79be667e, 0xf9dcbbac, 0x55a06295, 0xce870b07,\
+    0x029bfcdb, 0x2dce28d9, 0x59f2815b, 0x16f81798,\
+    0x483ada77, 0x26a3c465, 0x5da4fbfc, 0x0e1108a8,\
+    0xfd17b448, 0xa6855419, 0x9c47d08f, 0xfb10d4b8\
+)
+/* These exhaustive group test orders and generators are chosen such that:
+ * - The field size is equal to that of secp256k1, so field code is the same.
+ * - The curve equation is of the form y^2=x^3+B for some small constant B.
+ * - The subgroup has a generator 2*P, where P.x is as small as possible.
+ * - The subgroup has size less than 1000 to permit exhaustive testing.
+ * - The subgroup admits an endomorphism of the form lambda*(x,y) == (beta*x,y).
+ */
+#if defined(EXHAUSTIVE_TEST_ORDER)
+#  if EXHAUSTIVE_TEST_ORDER == 7
+
+static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_7;
+#define SECP256K1_B 6
+
+#  elif EXHAUSTIVE_TEST_ORDER == 13
+
+static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_13;
+#define SECP256K1_B 2
+
+#  elif EXHAUSTIVE_TEST_ORDER == 199
+
+static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_199;
+#define SECP256K1_B 4
+
+#  else
+#    error No known generator for the specified exhaustive test group order.
+#  endif
+#else
+
+static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G;
+#define SECP256K1_B 7
+
+#endif
+/* End of section generated by sage/gen_exhaustive_groups.sage. */
+
 /** Set a group element equal to the point with given X and Y coordinates */
 static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y);
 
@@ -87,6 +149,12 @@ static void secp256k1_ge_set_all_gej(secp256k1_ge *r, const secp256k1_gej *a, si
 /** Set group elements r[0:len] (affine) equal to group elements a[0:len] (jacobian). */
 static void secp256k1_ge_set_all_gej_var(secp256k1_ge *r, const secp256k1_gej *a, size_t len);
 
+/** Set a group element (affine) equal to the group element with jacobian coordinates (a.x, a.y, 1/zi). */
+static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zi);
+
+/** Set a group element (affine) equal to the group element with jacobian coordinates (a.x, a.y, 1/zi). */
+static void secp256k1_ge_set_ge_zinv(secp256k1_ge *r, const secp256k1_ge *a, const secp256k1_fe *zi);
+
 /** Bring a batch of inputs to the same global z "denominator", based on ratios between
  *  (omitted) z coordinates of adjacent elements.
  *

src/group_impl.h

@@ -13,68 +13,6 @@
 #include "group.h"
 #include "util.h"
 
-/* Begin of section generated by sage/gen_exhaustive_groups.sage. */
-#define SECP256K1_G_ORDER_7 SECP256K1_GE_CONST(\
-    0x66625d13, 0x317ffe44, 0x63d32cff, 0x1ca02b9b,\
-    0xe5c6d070, 0x50b4b05e, 0x81cc30db, 0xf5166f0a,\
-    0x1e60e897, 0xa7c00c7c, 0x2df53eb6, 0x98274ff4,\
-    0x64252f42, 0x8ca44e17, 0x3b25418c, 0xff4ab0cf\
-)
-#define SECP256K1_G_ORDER_13 SECP256K1_GE_CONST(\
-    0xa2482ff8, 0x4bf34edf, 0xa51262fd, 0xe57921db,\
-    0xe0dd2cb7, 0xa5914790, 0xbc71631f, 0xc09704fb,\
-    0x942536cb, 0xa3e49492, 0x3a701cc3, 0xee3e443f,\
-    0xdf182aa9, 0x15b8aa6a, 0x166d3b19, 0xba84b045\
-)
-#define SECP256K1_G_ORDER_199 SECP256K1_GE_CONST(\
-    0x7fb07b5c, 0xd07c3bda, 0x553902e2, 0x7a87ea2c,\
-    0x35108a7f, 0x051f41e5, 0xb76abad5, 0x1f2703ad,\
-    0x0a251539, 0x5b4c4438, 0x952a634f, 0xac10dd4d,\
-    0x6d6f4745, 0x98990c27, 0x3a4f3116, 0xd32ff969\
-)
-/** Generator for secp256k1, value 'g' defined in
- *  "Standards for Efficient Cryptography" (SEC2) 2.7.1.
- */
-#define SECP256K1_G SECP256K1_GE_CONST(\
-    0x79be667e, 0xf9dcbbac, 0x55a06295, 0xce870b07,\
-    0x029bfcdb, 0x2dce28d9, 0x59f2815b, 0x16f81798,\
-    0x483ada77, 0x26a3c465, 0x5da4fbfc, 0x0e1108a8,\
-    0xfd17b448, 0xa6855419, 0x9c47d08f, 0xfb10d4b8\
-)
-/* These exhaustive group test orders and generators are chosen such that:
- * - The field size is equal to that of secp256k1, so field code is the same.
- * - The curve equation is of the form y^2=x^3+B for some small constant B.
- * - The subgroup has a generator 2*P, where P.x is as small as possible.
- * - The subgroup has size less than 1000 to permit exhaustive testing.
- * - The subgroup admits an endomorphism of the form lambda*(x,y) == (beta*x,y).
- */
-#if defined(EXHAUSTIVE_TEST_ORDER)
-#  if EXHAUSTIVE_TEST_ORDER == 7
-
-static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_7;
-#define SECP256K1_B 6
-
-#  elif EXHAUSTIVE_TEST_ORDER == 13
-
-static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_13;
-#define SECP256K1_B 2
-
-#  elif EXHAUSTIVE_TEST_ORDER == 199
-
-static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G_ORDER_199;
-#define SECP256K1_B 4
-
-#  else
-#    error No known generator for the specified exhaustive test group order.
-#  endif
-#else
-
-static const secp256k1_ge secp256k1_ge_const_g = SECP256K1_G;
-#define SECP256K1_B 7
-
-#endif
-/* End of section generated by sage/gen_exhaustive_groups.sage. */
-
 static void secp256k1_ge_verify(const secp256k1_ge *a) {
     SECP256K1_FE_VERIFY(&a->x);
     SECP256K1_FE_VERIFY(&a->y);
@@ -95,7 +33,6 @@ static void secp256k1_gej_verify(const secp256k1_gej *a) {
     (void)a;
 }
 
-/* Set r to the affine coordinates of Jacobian point (a.x, a.y, 1/zi). */
 static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zi) {
     secp256k1_fe zi2;
     secp256k1_fe zi3;
@@ -112,7 +49,6 @@ static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, c
     SECP256K1_GE_VERIFY(r);
 }
 
-/* Set r to the affine coordinates of Jacobian point (a.x, a.y, 1/zi). */
 static void secp256k1_ge_set_ge_zinv(secp256k1_ge *r, const secp256k1_ge *a, const secp256k1_fe *zi) {
     secp256k1_fe zi2;
     secp256k1_fe zi3;

src/hsort_impl.h

@@ -8,6 +8,7 @@
 #define SECP256K1_HSORT_IMPL_H
 
 #include "hsort.h"
+#include "util.h"
 
 /* An array is a heap when, for all non-zero indexes i, the element at index i
  * compares as less than or equal to the element at index parent(i) = (i-1)/2.

src/modinv64.h

@@ -9,6 +9,8 @@
 
 #include "util.h"
 
+#include <stdint.h>
+
 #ifndef SECP256K1_WIDEMUL_INT128
 #error "modinv64 requires 128-bit wide multiplication support"
 #endif

src/precompute_ecmult.c

@@ -16,6 +16,12 @@
 #include "field_impl.h"
 #include "group_impl.h"
 #include "int128_impl.h"
+#include "modinv32_impl.h"
+#ifdef SECP256K1_WIDEMUL_INT128
+/* modinv64 is only available if we have an int128 implementation. */
+#include "modinv64_impl.h"
+#endif
+
 #include "ecmult.h"
 #include "ecmult_compute_table_impl.h"
 

src/precompute_ecmult_gen.c

@@ -15,6 +15,12 @@
 
 #include "group.h"
 #include "int128_impl.h"
+#include "modinv32_impl.h"
+#ifdef SECP256K1_WIDEMUL_INT128
+/* modinv64 is only available if we have an int128 implementation. */
+#include "modinv64_impl.h"
+#endif
+
 #include "ecmult_gen.h"
 #include "ecmult_gen_compute_table_impl.h"
 

src/scalar.h

@@ -10,6 +10,17 @@
 #include "util.h"
 
 #if defined(EXHAUSTIVE_TEST_ORDER)
+/* Begin of section generated by sage/gen_exhaustive_groups.sage. */
+#  if EXHAUSTIVE_TEST_ORDER == 7
+#    define EXHAUSTIVE_TEST_LAMBDA 2
+#  elif EXHAUSTIVE_TEST_ORDER == 13
+#    define EXHAUSTIVE_TEST_LAMBDA 9
+#  elif EXHAUSTIVE_TEST_ORDER == 199
+#    define EXHAUSTIVE_TEST_LAMBDA 92
+#  else
+#    error No known lambda for the specified exhaustive test group order.
+#  endif
+/* End of section generated by sage/gen_exhaustive_groups.sage. */
 #include "scalar_low.h"
 #elif defined(SECP256K1_WIDEMUL_INT128)
 #include "scalar_4x64.h"
@@ -19,6 +30,9 @@
 #error "Please select wide multiplication implementation"
 #endif
 
+static const secp256k1_scalar secp256k1_scalar_one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
+static const secp256k1_scalar secp256k1_scalar_zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
+
 /** Clear a scalar to prevent the leak of sensitive data. */
 static void secp256k1_scalar_clear(secp256k1_scalar *r);