Preliminary wNAF support (#1714)

tarcieri · web-flow · commit c8fa2607e529 · 2026-04-08T17:06:15.000-06:00
RustCrypto/group#12 included a workaround that allows curves with a big endian `PrimeField::Repr` to be used for wNAF, by defining a separate `PrimeField::to_le_repr` method which is always guaranteed to be little endian. This may not be the permanent solution to this problem which gets upstreamed, but it unblocks work for now. This commit adds the relevant impls of `to_le_repr`, along with initial `WnafGroup` impls to `ProjectivePoint` in `k256` and `primeorder` (currently hardcoded to a fixed constant of `4` for now to unblock additional work). This also adds a `ProjectivePoint::wnaf` static method to obtain a wNAF context for that particular curve group, feature-gated on `alloc`. Finally, it adds a smoke test to `p256` which checks it against our scalar multiplication test vectors, however it does not check any other curves yet and probably should.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/bignp256/Cargo.toml b/bignp256/Cargo.toml
@@ -18,7 +18,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", features = ["sec1"] }
 
 # optional dependencies
 belt-block = { version = "0.2.0-rc.3", optional = true }
@@ -38,7 +38,7 @@ signature = { version = "3.0.0-rc.10", optional = true }
 
 [dev-dependencies]
 criterion = "0.7"
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["dev"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["dev"] }
 hex-literal = "1"
 primeorder = { version = "0.14.0-rc.8", features = ["dev"] }
 proptest = "1"
diff --git a/bp256/Cargo.toml b/bp256/Cargo.toml
@@ -14,7 +14,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 
 # optional dependencies
 ecdsa = { version = "0.17.0-rc.16", optional = true, default-features = false, features = ["der"] }
@@ -24,7 +24,7 @@ sha2 = { version = "0.11", optional = true, default-features = false }
 
 [dev-dependencies]
 criterion = "0.7"
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["dev"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["dev"] }
 
 [features]
 default = ["pkcs8", "std"]
diff --git a/bp384/Cargo.toml b/bp384/Cargo.toml
@@ -14,7 +14,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 
 # optional dependencies
 ecdsa = { version = "0.17.0-rc.16", optional = true, default-features = false, features = ["der"] }
@@ -24,7 +24,7 @@ sha2 = { version = "0.11", optional = true, default-features = false }
 
 [dev-dependencies]
 criterion = "0.7"
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["dev"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["dev"] }
 
 [features]
 default = ["pkcs8", "std"]
diff --git a/ed448-goldilocks/Cargo.toml b/ed448-goldilocks/Cargo.toml
@@ -16,7 +16,7 @@ This crate also includes signing and verifying of Ed448 signatures.
 """
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", features = ["arithmetic", "pkcs8"] }
+elliptic-curve = { version = "0.14.0-rc.30", features = ["arithmetic", "pkcs8"] }
 hash2curve = "0.14.0-rc.11"
 rand_core = { version = "0.10", default-features = false }
 sha3 = { version = "0.11", default-features = false }
diff --git a/hash2curve/Cargo.toml b/hash2curve/Cargo.toml
@@ -15,7 +15,7 @@ rust-version = "1.85"
 
 [dependencies]
 digest = { version = "0.11" }
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["arithmetic"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["arithmetic"] }
 
 [dev-dependencies]
 hex-literal = "1"
diff --git a/k256/Cargo.toml b/k256/Cargo.toml
@@ -20,7 +20,7 @@ rust-version = "1.85"
 
 [dependencies]
 cpubits = "0.1"
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 hash2curve = { version = "0.14.0-rc.11", optional = true }
 
 # optional dependencies
diff --git a/k256/src/arithmetic/field.rs b/k256/src/arithmetic/field.rs
@@ -28,14 +28,13 @@ use core::{
 };
 use elliptic_curve::{
     Generate,
-    bigint::{Odd, U256, modular::Retrieve},
+    bigint::{ArrayEncoding, Odd, U256, modular::Retrieve},
     ff::{self, Field, PrimeField},
     ops::Invert,
     rand_core::{TryCryptoRng, TryRng},
     subtle::{Choice, ConditionallySelectable, ConstantTimeEq, CtOption},
     zeroize::DefaultIsZeroes,
 };
-
 #[cfg(test)]
 use num_bigint::{BigUint, ToBigUint};
 
@@ -319,6 +318,10 @@ impl PrimeField for FieldElement {
         self.to_bytes()
     }
 
+    fn to_le_repr(&self) -> Self::Repr {
+        self.0.normalize().to_u256().to_le_byte_array()
+    }
+
     fn is_odd(&self) -> Choice {
         self.is_odd()
     }
diff --git a/k256/src/arithmetic/projective.rs b/k256/src/arithmetic/projective.rs
@@ -24,7 +24,7 @@ use elliptic_curve::{
 };
 
 #[cfg(feature = "alloc")]
-use alloc::vec::Vec;
+use {alloc::vec::Vec, elliptic_curve::group::WnafGroup};
 
 #[rustfmt::skip]
 const ENDOMORPHISM_BETA: FieldElement = FieldElement::from_bytes_unchecked(&[
@@ -524,6 +524,15 @@ impl PrimeCurve for ProjectivePoint {
 
 impl PrimeGroup for ProjectivePoint {}
 
+#[cfg(feature = "alloc")]
+impl WnafGroup for ProjectivePoint {
+    fn recommended_wnaf_for_num_scalars(_num_scalars: usize) -> usize {
+        // TODO(tarcieri): provide a way for individual curves to configure this
+        // Returns a number between 2 and 22, inclusive.
+        4 // This seems to be a common starting point?
+    }
+}
+
 //
 // `core::ops` trait impls
 //
diff --git a/k256/src/arithmetic/scalar.rs b/k256/src/arithmetic/scalar.rs
@@ -310,6 +310,10 @@ impl PrimeField for Scalar {
         self.to_bytes()
     }
 
+    fn to_le_repr(&self) -> Self::Repr {
+        self.0.to_le_byte_array()
+    }
+
     fn is_odd(&self) -> Choice {
         self.0.is_odd().into()
     }
diff --git a/p192/Cargo.toml b/p192/Cargo.toml
@@ -17,7 +17,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 
 # optional dependencies
 ecdsa-core = { version = "0.17.0-rc.16", package = "ecdsa", optional = true, default-features = false, features = ["der"] }
diff --git a/p224/Cargo.toml b/p224/Cargo.toml
@@ -17,7 +17,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 
 # optional dependencies
 ecdsa-core = { version = "0.17.0-rc.16", package = "ecdsa", optional = true, default-features = false, features = ["der"] }
diff --git a/p256/Cargo.toml b/p256/Cargo.toml
@@ -18,7 +18,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 
 # optional dependencies
 ecdsa-core = { version = "0.17.0-rc.16", package = "ecdsa", optional = true, default-features = false, features = ["der"] }
diff --git a/p256/src/arithmetic/scalar.rs b/p256/src/arithmetic/scalar.rs
@@ -305,6 +305,10 @@ impl PrimeField for Scalar {
         self.to_bytes()
     }
 
+    fn to_le_repr(&self) -> FieldBytes {
+        self.0.to_le_byte_array()
+    }
+
     fn is_odd(&self) -> Choice {
         self.0.is_odd().into()
     }
diff --git a/p256/tests/projective.rs b/p256/tests/projective.rs
@@ -18,6 +18,9 @@ use p256::{
 use primeorder::test_projective_arithmetic;
 use proptest::{prelude::any, prop_compose, proptest};
 
+#[cfg(feature = "alloc")]
+use elliptic_curve::point::AffineCoordinates;
+
 test_projective_arithmetic!(
     AffinePoint,
     ProjectivePoint,
@@ -32,6 +35,21 @@ fn projective_identity_to_bytes() {
     assert_eq!([0; 33], ProjectivePoint::IDENTITY.to_bytes().as_slice());
 }
 
+#[cfg(feature = "alloc")]
+#[test]
+fn wnaf() {
+    for (k, coords) in ADD_TEST_VECTORS.iter().enumerate() {
+        let scalar = Scalar::from(k as u64 + 1);
+        let mut wnaf = ProjectivePoint::wnaf();
+        let mut wnaf_base = wnaf.base(ProjectivePoint::GENERATOR, 1);
+        let p = wnaf_base.scalar(&scalar).to_affine();
+
+        let (x, y) = (p.x(), p.y());
+        assert_eq!(x.0, coords.0);
+        assert_eq!(y.0, coords.1);
+    }
+}
+
 prop_compose! {
     fn non_identity()(bytes in any::<[u8; 32]>()) -> NonIdentity<ProjectivePoint> {
         NonIdentity::mul_by_generator(&NonZeroScalar::reduce_nonzero(&FieldBytes::from(bytes)))
diff --git a/p384/Cargo.toml b/p384/Cargo.toml
@@ -18,7 +18,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 
 # optional dependencies
 ecdsa-core = { version = "0.17.0-rc.16", package = "ecdsa", optional = true, default-features = false, features = ["der"] }
diff --git a/p521/Cargo.toml b/p521/Cargo.toml
@@ -18,7 +18,7 @@ rust-version = "1.85"
 
 [dependencies]
 base16ct = "1"
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["sec1"] }
 
 # optional dependencies
 ecdsa-core = { version = "0.17.0-rc.16", package = "ecdsa", optional = true, default-features = false, features = ["der"] }
diff --git a/p521/src/arithmetic/field.rs b/p521/src/arithmetic/field.rs
@@ -560,6 +560,13 @@ impl PrimeField for FieldElement {
         self.to_bytes()
     }
 
+    #[inline]
+    fn to_le_repr(&self) -> FieldBytes {
+        let mut ret = [0u8; 66];
+        fiat_p521_to_bytes(&mut ret, &self.0); // natively little-endian
+        ret.into()
+    }
+
     #[inline]
     fn is_odd(&self) -> Choice {
         self.is_odd()
diff --git a/primefield/Cargo.toml b/primefield/Cargo.toml
@@ -19,7 +19,7 @@ rust-version = "1.85"
 [dependencies]
 bigint = { version = "0.7.1", package = "crypto-bigint", default-features = false, features = ["rand_core", "hybrid-array", "subtle"] }
 common = { package = "crypto-common", version = "0.2", features = ["rand_core"] }
-ff = { version = "0.14.0-rc.0", package = "rustcrypto-ff", default-features = false }
+ff = { version = "0.14.0-rc.1", package = "rustcrypto-ff", default-features = false }
 subtle = { version = "2.6", default-features = false, features = ["const-generics"] }
 rand_core = { version = "0.10", default-features = false }
 zeroize = { version = "1.7", default-features = false }
diff --git a/primefield/src/macros.rs b/primefield/src/macros.rs
@@ -346,6 +346,11 @@ macro_rules! monty_field_element {
                 self.0.to_repr()
             }
 
+            #[inline]
+            fn to_le_repr(&self) -> Self::Repr {
+                self.0.to_le_repr()
+            }
+
             #[inline]
             fn is_odd(&self) -> $crate::subtle::Choice {
                 self.0.is_odd()
diff --git a/primefield/src/monty.rs b/primefield/src/monty.rs
@@ -475,6 +475,17 @@ where
         self.to_bytes()
     }
 
+    fn to_le_repr(&self) -> Self::Repr {
+        match MOD::BYTE_ORDER {
+            ByteOrder::BigEndian => {
+                let mut bytes = self.to_bytes();
+                bytes.reverse();
+                bytes
+            }
+            ByteOrder::LittleEndian => self.to_bytes(),
+        }
+    }
+
     fn is_odd(&self) -> Choice {
         self.is_odd()
     }
diff --git a/primeorder/Cargo.toml b/primeorder/Cargo.toml
@@ -18,7 +18,7 @@ edition = "2024"
 rust-version = "1.85"
 
 [dependencies]
-elliptic-curve = { version = "0.14.0-rc.29", default-features = false, features = ["arithmetic", "sec1"] }
+elliptic-curve = { version = "0.14.0-rc.30", default-features = false, features = ["arithmetic", "sec1"] }
 
 # optional dependencies
 serdect = { version = "0.4", optional = true, default-features = false }
diff --git a/primeorder/src/projective.rs b/primeorder/src/projective.rs
diff --git a/sm2/Cargo.toml b/sm2/Cargo.toml

Original file line number	Diff line number	Diff line change
`@@ -310,6 +310,10 @@ impl PrimeField for Scalar {`
`310`	`310`	`self.to_bytes()`
`311`	`311`	`}`
`312`	`312`
	`313`	`+ fn to_le_repr(&self) -> Self::Repr {`
	`314`	`+ self.0.to_le_byte_array()`
	`315`	`+ }`
	`316`	`+`
`313`	`317`	`fn is_odd(&self) -> Choice {`
`314`	`318`	`self.0.is_odd().into()`
`315`	`319`	`}`