Add pippenger under multiexp

crypto/frost/src/key_gen.rs

@@ -254,7 +254,7 @@ fn complete_r2<R: RngCore + CryptoRng, C: Curve>(
   // Calculate each user's verification share
   let mut verification_shares = HashMap::new();
   for i in 1 ..= params.n() {
-    verification_shares.insert(i, multiexp_vartime(exponential(i, &stripes), C::LITTLE_ENDIAN));
+    verification_shares.insert(i, multiexp_vartime(&exponential(i, &stripes), C::LITTLE_ENDIAN));
   }
   debug_assert_eq!(C::GENERATOR_TABLE * secret_share, verification_shares[&params.i()]);
 

crypto/frost/src/tests/curve.rs

@@ -1,5 +1,8 @@
 use rand_core::{RngCore, CryptoRng};
 
+use ff::Field;
+use group::Group;
+
 use crate::{Curve, MultisigKeys, tests::key_gen};
 
 // Test generation of FROST keys
@@ -18,6 +21,21 @@ fn keys_serialization<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) {
 pub fn test_curve<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) {
   // TODO: Test the Curve functions themselves
 
+  // Test successful multiexp, with enough pairs to trigger its variety of algorithms
+  // TODO: This should probably be under multiexp
+  {
+    let mut pairs = Vec::with_capacity(1000);
+    let mut sum = C::G::identity();
+    for _ in 0 .. 10 {
+      for _ in 0 .. 100 {
+        pairs.push((C::F::random(&mut *rng), C::GENERATOR * C::F::random(&mut *rng)));
+        sum += pairs[pairs.len() - 1].1 * pairs[pairs.len() - 1].0;
+      }
+      assert_eq!(multiexp::multiexp(&pairs, C::LITTLE_ENDIAN), sum);
+      assert_eq!(multiexp::multiexp_vartime(&pairs, C::LITTLE_ENDIAN), sum);
+    }
+  }
+
   // Test FROST key generation and serialization of MultisigKeys works as expected
   key_generation::<_, C>(rng);
   keys_serialization::<_, C>(rng);

crypto/multiexp/src/batch.rs

@@ -0,0 +1,78 @@
+use rand_core::{RngCore, CryptoRng};
+
+use group::{ff::Field, Group};
+
+use crate::{multiexp, multiexp_vartime};
+
+#[cfg(feature = "batch")]
+pub struct BatchVerifier<Id: Copy, G: Group>(Vec<(Id, Vec<(G::Scalar, G)>)>, bool);
+
+#[cfg(feature = "batch")]
+impl<Id: Copy, G: Group> BatchVerifier<Id, G> {
+  pub fn new(capacity: usize, endian: bool) -> BatchVerifier<Id, G> {
+    BatchVerifier(Vec::with_capacity(capacity), endian)
+  }
+
+  pub fn queue<
+    R: RngCore + CryptoRng,
+    I: IntoIterator<Item = (G::Scalar, G)>
+  >(&mut self, rng: &mut R, id: Id, pairs: I) {
+    // Define a unique scalar factor for this set of variables so individual items can't overlap
+    let u = if self.0.len() == 0 {
+      G::Scalar::one()
+    } else {
+      G::Scalar::random(rng)
+    };
+    self.0.push((id, pairs.into_iter().map(|(scalar, point)| (scalar * u, point)).collect()));
+  }
+
+  pub fn verify(&self) -> bool {
+    multiexp(
+      &self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>(),
+      self.1
+    ).is_identity().into()
+  }
+
+  pub fn verify_vartime(&self) -> bool {
+    multiexp_vartime(
+      &self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>(),
+      self.1
+    ).is_identity().into()
+  }
+
+  // A constant time variant may be beneficial for robust protocols
+  pub fn blame_vartime(&self) -> Option<Id> {
+    let mut slice = self.0.as_slice();
+    while slice.len() > 1 {
+      let split = slice.len() / 2;
+      if multiexp_vartime(
+        &slice[.. split].iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>(),
+        self.1
+      ).is_identity().into() {
+        slice = &slice[split ..];
+      } else {
+        slice = &slice[.. split];
+      }
+    }
+
+    slice.get(0).filter(
+      |(_, value)| !bool::from(multiexp_vartime(value, self.1).is_identity())
+    ).map(|(id, _)| *id)
+  }
+
+  pub fn verify_with_vartime_blame(&self) -> Result<(), Id> {
+    if self.verify() {
+      Ok(())
+    } else {
+      Err(self.blame_vartime().unwrap())
+    }
+  }
+
+  pub fn verify_vartime_with_vartime_blame(&self) -> Result<(), Id> {
+    if self.verify_vartime() {
+      Ok(())
+    } else {
+      Err(self.blame_vartime().unwrap())
+    }
+  }
+}

crypto/multiexp/src/lib.rs

@@ -1,156 +1,49 @@
-use group::{ff::PrimeField, Group};
+use group::Group;
+
+mod straus;
+use straus::*;
+
+mod pippenger;
+use pippenger::*;
 
 #[cfg(feature = "batch")]
-use group::ff::Field;
+mod batch;
 #[cfg(feature = "batch")]
-use rand_core::{RngCore, CryptoRng};
+pub use batch::BatchVerifier;
 
-fn prep<
-  G: Group,
-  I: IntoIterator<Item = (G::Scalar, G)>
->(pairs: I, little: bool) -> (Vec<Vec<u8>>, Vec<[G; 16]>) {
-  let mut nibbles = vec![];
-  let mut tables = vec![];
-  for pair in pairs.into_iter() {
-    let p = nibbles.len();
-    nibbles.push(vec![]);
-    {
-      let mut repr = pair.0.to_repr();
-      let bytes = repr.as_mut();
-      if !little {
-        bytes.reverse();
-      }
-
-      nibbles[p].resize(bytes.len() * 2, 0);
-      for i in 0 .. bytes.len() {
-        nibbles[p][i * 2] = bytes[i] & 0b1111;
-        nibbles[p][(i * 2) + 1] = (bytes[i] >> 4) & 0b1111;
-      }
-    }
-
-    tables.push([G::identity(); 16]);
-    let mut accum = G::identity();
-    for i in 1 .. 16 {
-      accum += pair.1;
-      tables[p][i] = accum;
-    }
-  }
-
-  (nibbles, tables)
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+enum Algorithm {
+  Straus,
+  Pippenger
 }
 
-// An implementation of Straus, with a extremely minimal API that lets us add other algorithms in
-// the future. Takes in an iterator of scalars and points with a boolean for if the scalars are
-// little endian encoded in their Reprs or not
-pub fn multiexp<
-  G: Group,
-  I: IntoIterator<Item = (G::Scalar, G)>
->(pairs: I, little: bool) -> G {
-  let (nibbles, tables) = prep(pairs, little);
-
-  let mut res = G::identity();
-  for b in (0 .. nibbles[0].len()).rev() {
-    for _ in 0 .. 4 {
-      res = res.double();
-    }
-
-    for s in 0 .. tables.len() {
-      res += tables[s][usize::from(nibbles[s][b])];
-    }
-  }
-  res
-}
-
-pub fn multiexp_vartime<
-  G: Group,
-  I: IntoIterator<Item = (G::Scalar, G)>
->(pairs: I, little: bool) -> G {
-  let (nibbles, tables) = prep(pairs, little);
-
-  let mut res = G::identity();
-  for b in (0 .. nibbles[0].len()).rev() {
-    for _ in 0 .. 4 {
-      res = res.double();
-    }
-
-    for s in 0 .. tables.len() {
-      if nibbles[s][b] != 0 {
-        res += tables[s][usize::from(nibbles[s][b])];
-      }
-    }
-  }
-  res
-}
-
-#[cfg(feature = "batch")]
-pub struct BatchVerifier<Id: Copy, G: Group>(Vec<(Id, Vec<(G::Scalar, G)>)>, bool);
-
-#[cfg(feature = "batch")]
-impl<Id: Copy, G: Group> BatchVerifier<Id, G> {
-  pub fn new(capacity: usize, endian: bool) -> BatchVerifier<Id, G> {
-    BatchVerifier(Vec::with_capacity(capacity), endian)
-  }
-
-  pub fn queue<
-    R: RngCore + CryptoRng,
-    I: IntoIterator<Item = (G::Scalar, G)>
-  >(&mut self, rng: &mut R, id: Id, pairs: I) {
-    // Define a unique scalar factor for this set of variables so individual items can't overlap
-    let u = if self.0.len() == 0 {
-      G::Scalar::one()
-    } else {
-      G::Scalar::random(rng)
-    };
-    self.0.push((id, pairs.into_iter().map(|(scalar, point)| (scalar * u, point)).collect()));
-  }
-
-  pub fn verify(&self) -> bool {
-    multiexp(
-      self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned(),
-      self.1
-    ).is_identity().into()
-  }
-
-  pub fn verify_vartime(&self) -> bool {
-    multiexp_vartime(
-      self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned(),
-      self.1
-    ).is_identity().into()
-  }
-
-  // A constant time variant may be beneficial for robust protocols
-  pub fn blame_vartime(&self) -> Option<Id> {
-    let mut slice = self.0.as_slice();
-    while slice.len() > 1 {
-      let split = slice.len() / 2;
-      if multiexp_vartime(
-        slice[.. split].iter().flat_map(|pairs| pairs.1.iter()).cloned(),
-        self.1
-      ).is_identity().into() {
-        slice = &slice[split ..];
-      } else {
-        slice = &slice[.. split];
-      }
-    }
-
-    slice.get(0).filter(
-      |(_, value)| !bool::from(multiexp_vartime(value.clone(), self.1).is_identity())
-    ).map(|(id, _)| *id)
-  }
-
-  pub fn verify_with_vartime_blame(&self) -> Result<(), Id> {
-    if self.verify() {
-      Ok(())
-    } else {
-      Err(self.blame_vartime().unwrap())
-    }
-  }
-
-  pub fn verify_vartime_with_vartime_blame(&self) -> Result<(), Id> {
-    if self.verify_vartime() {
-      Ok(())
-    } else {
-      Err(self.blame_vartime().unwrap())
-    }
+fn algorithm(pairs: usize) -> Algorithm {
+  // TODO: Replace this with an actual formula determining which will use less additions
+  // Right now, Straus is used until 600, instead of the far more accurate 300, as Pippenger
+  // operates per byte instead of per nibble, and therefore requires a much longer series to be
+  // performant
+  // Technically, 800 is dalek's number for when to use byte Pippenger, yet given Straus's own
+  // implementation limitations...
+  if pairs < 600 {
+    Algorithm::Straus
+  } else {
+    Algorithm::Pippenger
+  }
+}
+
+// Performs a multiexp, automatically selecting the optimal algorithm based on amount of pairs
+// Takes in an iterator of scalars and points, with a boolean for if the scalars are little endian
+// encoded in their Reprs or not
+pub fn multiexp<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> G {
+  match algorithm(pairs.len()) {
+    Algorithm::Straus => straus(pairs, little),
+    Algorithm::Pippenger => pippenger(pairs, little)
+  }
+}
+
+pub fn multiexp_vartime<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> G {
+  match algorithm(pairs.len()) {
+    Algorithm::Straus => straus_vartime(pairs, little),
+    Algorithm::Pippenger => pippenger_vartime(pairs, little)
   }
 }

crypto/multiexp/src/pippenger.rs

@@ -0,0 +1,79 @@
+use group::{ff::PrimeField, Group};
+
+fn prep<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> (Vec<Vec<u8>>, Vec<G>) {
+  let mut res = vec![];
+  let mut points = vec![];
+  for pair in pairs {
+    let p = res.len();
+    res.push(vec![]);
+    {
+      let mut repr = pair.0.to_repr();
+      let bytes = repr.as_mut();
+      if !little {
+        bytes.reverse();
+      }
+
+      res[p].resize(bytes.len(), 0);
+      for i in 0 .. bytes.len() {
+        res[p][i] = bytes[i];
+      }
+    }
+
+    points.push(pair.1);
+  }
+
+  (res, points)
+}
+
+pub(crate) fn pippenger<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> G {
+  let (bytes, points) = prep(pairs, little);
+
+  let mut res = G::identity();
+  for n in (0 .. bytes[0].len()).rev() {
+    for _ in 0 .. 8 {
+      res = res.double();
+    }
+
+    let mut buckets = [G::identity(); 256];
+    for p in 0 .. bytes.len() {
+      buckets[usize::from(bytes[p][n])] += points[p];
+    }
+
+    let mut intermediate_sum = G::identity();
+    for b in (1 .. buckets.len()).rev() {
+      intermediate_sum += buckets[b];
+      res += intermediate_sum;
+    }
+  }
+
+  res
+}
+
+pub(crate) fn pippenger_vartime<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> G {
+  let (bytes, points) = prep(pairs, little);
+
+  let mut res = G::identity();
+  for n in (0 .. bytes[0].len()).rev() {
+    if n != (bytes[0].len() - 1) {
+      for _ in 0 .. 8 {
+        res = res.double();
+      }
+    }
+
+    let mut buckets = [G::identity(); 256];
+    for p in 0 .. bytes.len() {
+      let nibble = usize::from(bytes[p][n]);
+      if nibble != 0 {
+        buckets[nibble] += points[p];
+      }
+    }
+
+    let mut intermediate_sum = G::identity();
+    for b in (1 .. buckets.len()).rev() {
+      intermediate_sum += buckets[b];
+      res += intermediate_sum;
+    }
+  }
+
+  res
+}

crypto/multiexp/src/straus.rs

@@ -0,0 +1,69 @@
+use group::{ff::PrimeField, Group};
+
+fn prep<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> (Vec<Vec<u8>>, Vec<[G; 16]>) {
+  let mut nibbles = vec![];
+  let mut tables = vec![];
+  for pair in pairs {
+    let p = nibbles.len();
+    nibbles.push(vec![]);
+    {
+      let mut repr = pair.0.to_repr();
+      let bytes = repr.as_mut();
+      if !little {
+        bytes.reverse();
+      }
+
+      nibbles[p].resize(bytes.len() * 2, 0);
+      for i in 0 .. bytes.len() {
+        nibbles[p][i * 2] = bytes[i] & 0b1111;
+        nibbles[p][(i * 2) + 1] = (bytes[i] >> 4) & 0b1111;
+      }
+    }
+
+    tables.push([G::identity(); 16]);
+    let mut accum = G::identity();
+    for i in 1 .. 16 {
+      accum += pair.1;
+      tables[p][i] = accum;
+    }
+  }
+
+  (nibbles, tables)
+}
+
+pub(crate) fn straus<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> G {
+  let (nibbles, tables) = prep(pairs, little);
+
+  let mut res = G::identity();
+  for b in (0 .. nibbles[0].len()).rev() {
+    for _ in 0 .. 4 {
+      res = res.double();
+    }
+
+    for s in 0 .. tables.len() {
+      res += tables[s][usize::from(nibbles[s][b])];
+    }
+  }
+  res
+}
+
+pub(crate) fn straus_vartime<G: Group>(pairs: &[(G::Scalar, G)], little: bool) -> G {
+  let (nibbles, tables) = prep(pairs, little);
+
+  let mut res = G::identity();
+  for b in (0 .. nibbles[0].len()).rev() {
+    if b != (nibbles[0].len() - 1) {
+      for _ in 0 .. 4 {
+        res = res.double();
+      }
+    }
+
+    for s in 0 .. tables.len() {
+      if nibbles[s][b] != 0 {
+        res += tables[s][usize::from(nibbles[s][b])];
+      }
+    }
+  }
+
+  res
+}