absolutebi/serai
1
0
Fork 0
mirror of https://github.com/serai-dex/serai.git synced 2025-12-08 12:19:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add a batch verifier to multiexp, along with constant time variants

Browse Source 
Saves ~8% during FROST key gen, even with dropping a vartime for a 
constant time (as needed to be secure), as the new batch verifier is 
used where batch verification previously wasn't. The new multiexp API 
itself also offered a very slight performance boost, which may solely be 
a measurement error.

Handles most of https://github.com/serai-dex/serai/issues/10. The blame 
function isn't binary searched nor randomly sorted yet.
This commit is contained in:
Luke Parker
2022-05-27 00:52:44 -04:00
parent c398b246ff
commit c90e957e6a
10 changed files with 161 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
crypto/frost/src/lib.rs
View File

@@ -4,9 +4,7 @@ use std::collections::HashMap;
use thiserror::Error;
use ff::{Field, PrimeField};
use group::{Group, GroupOps, ScalarMul};
pub use multiexp::multiexp_vartime;
use group::{Group, GroupOps};
mod schnorr;
@@ -38,7 +36,7 @@ pub trait Curve: Clone + Copy + PartialEq + Eq + Debug {
// This is available via G::Scalar yet `C::G::Scalar` is ambiguous, forcing horrific accesses
type F: PrimeField;
/// Group element type
type G: Group + GroupOps + ScalarMul<Self::F>;
type G: Group<Scalar = Self::F> + GroupOps;
/// Precomputed table type
type T: Mul<Self::F, Output = Self::G>;
@@ -57,12 +55,8 @@ pub trait Curve: Clone + Copy + PartialEq + Eq + Debug {
/// If there isn't a precomputed table available, the generator itself should be used
fn generator_table() -> Self::T;
/// Multiexponentation function, presumably Straus or Pippenger
/// This library does forward an implementation of Straus which should increase key generation
/// performance by around 4x, also named multiexp_vartime, with a similar API. However, if a more
/// performant implementation is available, that should be used instead
// This could also be written as -> Option<C::G> with None for not implemented
fn multiexp_vartime(scalars: &[Self::F], points: &[Self::G]) -> Self::G;
/// If little endian is used for the scalar field's Repr
fn little_endian() -> bool;
/// Hash the message as needed to calculate the binding factor
/// H3 from the IETF draft