From 1bbadb12e6e3e46306e013dbd3b1d1ff222b0e4b Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Wed, 6 May 2026 19:26:53 -0600 Subject: [PATCH 1/2] Add `WnafBase::multiscalar_mul` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Computes a sum-of-products `aA + bB + ...` in variable time with w-NAF multi-exponentiation using the interleaved window method, also known as Straus' method. The key insight is that when computing this sum by means of additions and doublings, the doublings can be shared by performing the additions within an inner loop. The API and implementation are inspired in part by `curve25519-dalek`, namely the `VartimeMultiscalarMul` trait and corresponding implementation in `straus.rs`. This results in ~28% speedup on `p256` for a 3 scalar/point input: ProjectivePoint operations/point-scalar lincomb (variable-time) time: [149.13 µs 149.80 µs 150.84 µs] change: [−27.999% −27.645% −27.267%] (p = 0.00 < 0.05) --- src/wnaf.rs | 50 ++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 42 insertions(+), 8 deletions(-) diff --git a/src/wnaf.rs b/src/wnaf.rs index 6afa918..3cb764f 100644 --- a/src/wnaf.rs +++ b/src/wnaf.rs @@ -156,23 +156,42 @@ pub(crate) fn wnaf_form>(wnaf: &mut Vec, c: S, window: usize /// /// This function must be provided a `table` and `wnaf` that were constructed with /// the same window size; otherwise, it may panic or produce invalid results. +#[inline] pub(crate) fn wnaf_exp(table: &[G], wnaf: &[i64]) -> G { - let mut result = G::identity(); + wnaf_multi_exp(&[table], &[wnaf]) +} +/// Performs w-NAF multi-exponentiation using the interleaved window method, also known as +/// Straus' method. +/// +/// The key insight is that when computing this sum by means of additions and doublings, the +/// doublings can be shared by performing the additions within an inner loop. +/// +/// This function must be provided with `tables` and `wnafs` that were constructed with +/// the same window size; otherwise, it may panic or produce invalid results. +pub(crate) fn wnaf_multi_exp(tables: &[&[G]], wnafs: &[&[i64]]) -> G { + debug_assert_eq!(tables.len(), wnafs.len()); + let window_size = wnafs.iter().map(|w| w.len()).max().unwrap_or(0); + + let mut result = G::identity(); let mut found_one = false; - for n in wnaf.iter().rev() { + for i in (0..window_size).rev() { + // Only double once per iteration of the loop if found_one { result = result.double(); } - if *n != 0 { - found_one = true; + for (&table, &wnaf) in tables.iter().zip(wnafs.iter()) { + let n = wnaf.get(i).copied().unwrap_or(0); + if n != 0 { + found_one = true; - if *n > 0 { - result += &table[(n / 2) as usize]; - } else { - result -= &table[((-n) / 2) as usize]; + if n > 0 { + result += &table[(n / 2) as usize]; + } else { + result -= &table[((-n) / 2) as usize]; + } } } } @@ -505,6 +524,21 @@ impl WnafBase { WnafBase { table } } + + /// Perform a multiscalar multiplication. + pub fn multiscalar_mul<'a, I, J>(scalars: I, bases: J) -> G + where + I: Iterator>, + J: Iterator, + { + let wnafs = scalars + .map(|scalar| scalar.wnaf.as_slice()) + .collect::>(); + + let tables = bases.map(|base| base.table.as_slice()).collect::>(); + + wnaf_multi_exp(tables.as_slice(), wnafs.as_slice()) + } } impl Mul<&WnafScalar> From e7fe8e21be4d51f7e7093315f1a6b15e9d169daa Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Tue, 2 Jun 2026 07:04:10 -0600 Subject: [PATCH 2/2] Use `IntoIterator` for `multiscalar_mul` bounds This is closer to the `VartimeMultiscalarMul` trait in `curve25519-dalek`. --- src/wnaf.rs | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/src/wnaf.rs b/src/wnaf.rs index 3cb764f..984d94d 100644 --- a/src/wnaf.rs +++ b/src/wnaf.rs @@ -169,9 +169,12 @@ pub(crate) fn wnaf_exp(table: &[G], wnaf: &[i64]) -> G { /// /// This function must be provided with `tables` and `wnafs` that were constructed with /// the same window size; otherwise, it may panic or produce invalid results. -pub(crate) fn wnaf_multi_exp(tables: &[&[G]], wnafs: &[&[i64]]) -> G { +pub(crate) fn wnaf_multi_exp, W: AsRef<[i64]>>( + tables: &[T], + wnafs: &[W], +) -> G { debug_assert_eq!(tables.len(), wnafs.len()); - let window_size = wnafs.iter().map(|w| w.len()).max().unwrap_or(0); + let window_size = wnafs.iter().map(|w| w.as_ref().len()).max().unwrap_or(0); let mut result = G::identity(); let mut found_one = false; @@ -182,15 +185,15 @@ pub(crate) fn wnaf_multi_exp(tables: &[&[G]], wnafs: &[&[i64]]) -> G { result = result.double(); } - for (&table, &wnaf) in tables.iter().zip(wnafs.iter()) { - let n = wnaf.get(i).copied().unwrap_or(0); + for (table, wnaf) in tables.iter().zip(wnafs.iter()) { + let n = wnaf.as_ref().get(i).copied().unwrap_or(0); if n != 0 { found_one = true; if n > 0 { - result += &table[(n / 2) as usize]; + result += table.as_ref()[(n / 2) as usize]; } else { - result -= &table[((-n) / 2) as usize]; + result -= table.as_ref()[((-n) / 2) as usize]; } } } @@ -526,17 +529,16 @@ impl WnafBase { } /// Perform a multiscalar multiplication. - pub fn multiscalar_mul<'a, I, J>(scalars: I, bases: J) -> G + /// + /// Computes a sum-of-products `aA + bB + ...` in variable time with w-NAF multi-exponentiation + /// using the interleaved window method, also known as Straus' method. + pub fn multiscalar_mul(scalars: I, bases: J) -> G where - I: Iterator>, - J: Iterator, + I: IntoIterator>, + J: IntoIterator, { - let wnafs = scalars - .map(|scalar| scalar.wnaf.as_slice()) - .collect::>(); - - let tables = bases.map(|base| base.table.as_slice()).collect::>(); - + let wnafs = scalars.into_iter().map(|s| s.wnaf).collect::>(); + let tables = bases.into_iter().map(|b| b.table).collect::>(); wnaf_multi_exp(tables.as_slice(), wnafs.as_slice()) } }