elliptic-curve: add BasepointTableVartime::lincomb

Uses `WnafBase::multiscalar_mul` added in RustCrypto/group#14 to provide
a variable-time linear combination operation which can use the
precomputed wNAF for a basepoint.

This has been tested in `p256` where it provides a 25% speedup for ECDSA
verification.

Author: tarcieri

Cargo.lock

@@ -57,3 +57,5 @@ unused_qualifications = "warn"
 crypto-common = { path = "crypto-common" }
 digest = { path = "digest" }
 signature = { path = "signature" }
+
+rustcrypto-group = { git = "https://github.com/RustCrypto/group" }

Cargo.toml

@@ -98,6 +98,7 @@ impl<Point, const WINDOW_SIZE: usize> Deref for BasepointTable<Point, WINDOW_SIZ
 #[cfg(feature = "alloc")]
 pub(super) mod vartime {
     use super::LazyLock;
+    use alloc::vec::Vec;
     use core::ops::Mul;
     use group::{Group, WnafBase, WnafScalar};
 
@@ -151,6 +152,36 @@ pub(super) mod vartime {
         pub fn mul(&self, scalar: &Point::Scalar) -> Point {
             self.table.mul(&WnafScalar::new(scalar))
         }
+
+        /// Multiply `Point::generator` by the given scalar in variable-time, then compute a linear
+        /// combination of the remaining points and scalars, i.e.
+        ///
+        /// ```text
+        /// scalar * G + scalars[0] * Points[0] + ...
+        /// ```
+        pub fn lincomb(
+            &self,
+            scalar: &Point::Scalar,
+            points_and_scalars: &[(Point, Point::Scalar)],
+        ) -> Point {
+            let mut bases = Vec::with_capacity(points_and_scalars.len() + 1);
+            bases.push(self.table.clone());
+            bases.extend(
+                points_and_scalars
+                    .iter()
+                    .map(|(point, _)| WnafBase::new(*point)),
+            );
+
+            let mut scalars = Vec::with_capacity(points_and_scalars.len() + 1);
+            scalars.push(WnafScalar::new(scalar));
+            scalars.extend(
+                points_and_scalars
+                    .iter()
+                    .map(|(_, scalar)| WnafScalar::new(scalar)),
+            );
+
+            WnafBase::multiscalar_mul(scalars.iter(), bases.iter())
+        }
     }
 
     impl<Point: Group, const WINDOW_SIZE: usize> Default for BasepointTableVartime<Point, WINDOW_SIZE> {