search

supranational / blst

Multilingual BLS12-381 signature library
Apache License 2.0
474 stars 178 forks source link

Point multiplication behavior for scalars bigger than the main subgroup order #236

Open chfast opened 2 weeks ago

chfast commented 2 weeks ago

I noticed that the blst_p1_mult API can take scalar of any size. But if the scalar value is not less than BLS12_381_r the implementation selects the slower "w5" algorithm.

https://github.com/supranational/blst/blob/master/src/e1.c#L526-L527

I wonder if for scalars of 256 bits it is not better to reduce its value by doing mod BLS12_381_r.

dot-asm commented 1 week ago

As quoted commentary implies, the case is not cared for. With rationale that in real-life application the scalar would be a result of calculation and the said calculation is expected to produce properly bound value. If the application trusts somebody else to perform the calculation (a.k.a. accepting inputs from the internet), then it's expected that application would vet the inputs and take an action (of application choice) if it's found out-of-range, most likely reject it, prior passing it to the library.