secp256k1: Optimize k splitting with mod n scalar.

dcrec/secp256k1/bench_test.go

@@ -55,7 +55,7 @@ func BenchmarkAddNonConstNotZOne(b *testing.B) {
 // BenchmarkScalarBaseMultNonConst benchmarks multiplying a scalar by the base
 // point of the curve.
 func BenchmarkScalarBaseMultNonConst(b *testing.B) {
-	k := new(ModNScalar).SetHex("d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575")
+	k := hexToModNScalar("d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575")
 
 	b.ReportAllocs()
 	b.ResetTimer()
@@ -65,10 +65,55 @@ func BenchmarkScalarBaseMultNonConst(b *testing.B) {
 	}
 }
 
+// BenchmarkSplitK benchmarks decomposing scalars into a balanced length-two
+// representation.
+func BenchmarkSplitK(b *testing.B) {
+	// Values computed from the group half order and lambda such that they
+	// exercise the decomposition edge cases and maximize the bit lengths of the
+	// produced scalars.
+	h := "7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0"
+	negOne := new(ModNScalar).NegateVal(oneModN)
+	halfOrder := hexToModNScalar(h)
+	halfOrderMOne := new(ModNScalar).Add2(halfOrder, negOne)
+	halfOrderPOne := new(ModNScalar).Add2(halfOrder, oneModN)
+	lambdaMOne := new(ModNScalar).Add2(endoLambda, negOne)
+	lambdaPOne := new(ModNScalar).Add2(endoLambda, oneModN)
+	negLambda := new(ModNScalar).NegateVal(endoLambda)
+	halfOrderMOneMLambda := new(ModNScalar).Add2(halfOrderMOne, negLambda)
+	halfOrderMLambda := new(ModNScalar).Add2(halfOrder, negLambda)
+	halfOrderPOneMLambda := new(ModNScalar).Add2(halfOrderPOne, negLambda)
+	lambdaPHalfOrder := new(ModNScalar).Add2(endoLambda, halfOrder)
+	lambdaPOnePHalfOrder := new(ModNScalar).Add2(lambdaPOne, halfOrder)
+	scalars := []*ModNScalar{
+		new(ModNScalar),      // zero
+		oneModN,              // one
+		negOne,               // group order - 1 (aka -1 mod N)
+		halfOrderMOneMLambda, // group half order - 1 - lambda
+		halfOrderMLambda,     // group half order - lambda
+		halfOrderPOneMLambda, // group half order + 1 - lambda
+		halfOrderMOne,        // group half order - 1
+		halfOrder,            // group half order
+		halfOrderPOne,        // group half order + 1
+		lambdaMOne,           // lambda - 1
+		endoLambda,           // lambda
+		lambdaPOne,           // lambda + 1
+		lambdaPHalfOrder,     // lambda + group half order
+		lambdaPOnePHalfOrder, // lambda + 1 + group half order
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i += len(scalars) {
+		for j := 0; j < len(scalars); j++ {
+			_, _ = splitK(scalars[j])
+		}
+	}
+}
+
 // BenchmarkScalarMultNonConst benchmarks multiplying a scalar by an arbitrary
 // point on the curve.
 func BenchmarkScalarMultNonConst(b *testing.B) {
-	k := new(ModNScalar).SetHex("d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575")
+	k := hexToModNScalar("d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575")
 	point := jacobianPointFromHex(
 		"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6",
 		"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232",