secp256k1 VS constantine

Just yesterday I was trying to generate a vanity pub key for Nostr. I was using https://github.com/kdmukai/nostr_vanity_npub which uses the python-nostr library which in turn uses https://github.com/bitcoin-core/secp256k1.

The test (single thread with -j1 flag) has some interesting result. Time taken to calculate 1 million keys:

i7 8650U=2m5s,

However, I am trying to find the answer in the Bitcoin core source code, but it's kind of hard to read and could find an answer to it there.

I will be working on a Schnorr batch verification interface for the libsecp256k1. For those unfamiliar with libsecp256k1, it is a library (written in C) used by Bitcoin Core for low-level cryptographic operations. Initially, this library was a personal project of Pieter Wuille, which was later integrated into Bitcoin Core. You can listen to this Chaincode podcast where he talks about the early developments of this library.

That's a binding to the C library https://github.com/bitcoin-core/secp256k1, so it causes the exact same issue OP had with Cryptonite.

The binary GCD has inferior performance to other approaches for big numbers because those min() comparisons require that you had to update the entire numbers at each step.

I submitted a writeup on the safegcd algorithm used by libsecp256k1 a while back, but it got the HN zomg-bitcoin-related quick flagging: https://github.com/bitcoin-core/secp256k1/blob/master/doc/sa...

Safegcd-like functions requires somewhat more iterations but most of the iterations need to only operate on the least significant bits of the numbers, which makes them faster in practice.

For safegcd-ish functions proving a hard upper bound on the number of require iterations is non-trivial. But it's useful to prove the bound in order to make constant time versions. Here is a writeup on our techniques for proving the upper bounds: https://github.com/sipa/safegcd-bounds#bounds-on-divsteps-it...

[4:23 PM] fdov: Soulless | Scamcoin.onlinehttps://github.com/bitcoin-core/secp256k1/issues/451

And the one from libsecp256k1 (which underlies Bitcoin) and is optimized for HMAC: - https://github.com/bitcoin-core/secp256k1/blob/master/src/hash_impl.h

Just build and benckmark this https://github.com/bitcoin-core/secp256k1

Percival cache attacks on Hyperthreading.

I go over some examples here: https://github.com/mratsim/constantine/issues/358#issuecomme...

`when myCondition():` instead of `if myCondition:` is done at compile-time.

Alternatively you can use a `static:` code block to force compile time evaluation. Or tag a function {.compileTime.} or tag function inputs with `static` modifier.

It is possible to create a compiler or an assembler running fully in Nim macros as well:

- https://github.com/mratsim/constantine/blob/master/constanti... (all that file runs at compile-time)

You can also implement Continuation-Passing-Style transformation at compile-time:

At a glance this sounds like a re-discovery of addition chains and using them to construct Pippenger algorithm. But applied to matrices instead of group elements.

See: https://github.com/mratsim/constantine/issues/37

I usually explain extension fields as similar to complex numbers with regards to reals.

I've collected a lot of extension fields references while working on my own implementation: https://github.com/mratsim/constantine/tree/master/constanti...

The best likely being

- Arithmetic of Finite Fields

Regarding your first question, you don't need to attack the hard-drive, for non constant-time crypto you can read power consumption or electromagnetic traces when the secret key is used to reconstruct it: - https://github.com/mratsim/constantine/wiki/Constant-time-arithmetics

Unfortunate name collision with my constant-time pairing-based cryptography library :/.

https://github.com/mratsim/constantine

KZG for sure yes, I actually already started implementing them: https://github.com/mratsim/constantine/tree/c2d716b/research/kzg_poly_commit

I have a small write-up on various details of elliptic curve crypto implementation here: https://github.com/mratsim/constantine/tree/master/constantine/elliptic