Add an optimized function for linear combination of two points (x * k + y * l)

Author: fjarri

k256/src/arithmetic/mul.rs

@@ -203,6 +203,61 @@ fn mul_windowed(x: &ProjectivePoint, k: &Scalar) -> ProjectivePoint {
     acc
 }
 
+/// Calculates `(x * k + y * l)`.
+pub fn lincomb(
+    x: &ProjectivePoint,
+    y: &ProjectivePoint,
+    k: &Scalar,
+    l: &Scalar,
+) -> ProjectivePoint {
+    let (k_r1, k_r2) = decompose_scalar(k);
+    let (l_r1, l_r2) = decompose_scalar(l);
+    let x_beta = x.endomorphism();
+    let y_beta = y.endomorphism();
+
+    let k_r1_sign = k_r1.is_high();
+    let k_r1_c = Scalar::conditional_select(&k_r1, &-k_r1, k_r1_sign);
+    let k_r2_sign = k_r2.is_high();
+    let k_r2_c = Scalar::conditional_select(&k_r2, &-k_r2, k_r2_sign);
+
+    let l_r1_sign = l_r1.is_high();
+    let l_r1_c = Scalar::conditional_select(&l_r1, &-l_r1, l_r1_sign);
+    let l_r2_sign = l_r2.is_high();
+    let l_r2_c = Scalar::conditional_select(&l_r2, &-l_r2, l_r2_sign);
+
+    let x_table1 = LookupTable::from(&ProjectivePoint::conditional_select(x, &-x, k_r1_sign));
+    let x_table2 = LookupTable::from(&ProjectivePoint::conditional_select(
+        &x_beta, &-x_beta, k_r2_sign,
+    ));
+
+    let y_table1 = LookupTable::from(&ProjectivePoint::conditional_select(y, &-y, l_r1_sign));
+    let y_table2 = LookupTable::from(&ProjectivePoint::conditional_select(
+        &y_beta, &-y_beta, l_r2_sign,
+    ));
+
+    let k_digits1 = to_radix_16_half(&k_r1_c);
+    let k_digits2 = to_radix_16_half(&k_r2_c);
+
+    let l_digits1 = to_radix_16_half(&l_r1_c);
+    let l_digits2 = to_radix_16_half(&l_r2_c);
+
+    let mut acc = x_table1.select(k_digits1[32])
+        + x_table2.select(k_digits2[32])
+        + y_table1.select(l_digits1[32])
+        + y_table2.select(l_digits2[32]);
+    for i in (0..32).rev() {
+        for _j in 0..4 {
+            acc = acc.double();
+        }
+
+        acc += &x_table1.select(k_digits1[i]);
+        acc += &x_table2.select(k_digits2[i]);
+        acc += &y_table1.select(l_digits1[i]);
+        acc += &y_table2.select(l_digits2[i]);
+    }
+    acc
+}
+
 impl Mul<Scalar> for ProjectivePoint {
     type Output = ProjectivePoint;
 
@@ -238,3 +293,23 @@ impl MulAssign<&Scalar> for ProjectivePoint {
         *self = mul_windowed(self, rhs);
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::lincomb;
+    use crate::arithmetic::{ProjectivePoint, Scalar};
+    use elliptic_curve::rand_core::OsRng;
+    use elliptic_curve::{Field, Group};
+
+    #[test]
+    fn test_lincomb() {
+        let x = ProjectivePoint::random(&mut OsRng);
+        let y = ProjectivePoint::random(&mut OsRng);
+        let k = Scalar::random(&mut OsRng);
+        let l = Scalar::random(&mut OsRng);
+
+        let reference = &x * &k + &y * &l;
+        let test = lincomb(&x, &y, &k, &l);
+        assert_eq!(reference, test);
+    }
+}