fix mul single

risc0 · Aug 7, 2024 · 3493d1d · 3493d1d
1 parent 85ac5ce
commit 3493d1d
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 26 deletions.
diff --git a/p256/src/arithmetic/field/field32.rs b/p256/src/arithmetic/field/field32.rs
@@ -52,26 +52,14 @@ pub(super) fn mul_single(a: U256, rhs: u32) -> U256 {
     let (w5, carry) = a[5].mac(b[5], carry);
     let (w6, carry) = a[6].mac(b[6], carry);
     let (w7, w8) = a[7].mac(b[7], carry);
-    // Attempt to subtract the modulus, to ensure the result is in the field.
-    let modulus = MODULUS.0.as_limbs();
 
-    let (result, _) = sub_inner(
-        [w0, w1, w2, w3, w4, w5, w6, w7, w8],
-        [
-            modulus[0],
-            modulus[1],
-            modulus[2],
-            modulus[3],
-            modulus[4],
-            modulus[5],
-            modulus[6],
-            modulus[7],
-            Limb::ZERO,
-        ],
-    );
-    U256::new([
-        result[0], result[1], result[2], result[3], result[4], result[5], result[6], result[7],
-    ])
+    // Reduce the carry mod prime
+    let carry = U256::from(w8);
+    let (reduced_carry, _) = carry.const_rem(&MODULUS.0);
+
+    // Modular addition of non-carry and reduced carry
+    let non_carries = U256::new([w0, w1, w2, w3, w4, w5, w6, w7]);
+    add(non_carries, reduced_carry)
 }
 
 /// Returns self * rhs mod p

diff --git a/p256/src/arithmetic/field/field64.rs b/p256/src/arithmetic/field/field64.rs
@@ -33,14 +33,13 @@ pub(super) fn mul_single(a: U256, rhs: u32) -> U256 {
     let (w2, carry) = Limb::ZERO.mac(a_limbs[0], rhs_limb, carry);
     let (w3, w4) = Limb::ZERO.mac(a_limbs[0], rhs_limb, carry);
 
-    // Attempt to subtract the modulus from carry, to ensure the result is in the field
-    let modulus = MODULUS.0.as_limbs();
+    // Reduce the carry mod prime
+    let carry = U256::from(w4);
+    let (reduced_carry, _) = carry.const_rem(&MODULUS.0);
 
-    let (result, _) = sub_inner(
-        [w0, w1, w2, w3, w4],
-        [modulus[0], modulus[1], modulus[2], modulus[3], Limb::ZERO],
-    );
-    U256::new([result[0], result[1], result[2], result[3]])
+    // Modular addition of non-carry and reduced carry
+    let non_carries = U256::new([w0, w1, w2, w3]);
+    add(non_carries, reduced_carry)
 }
 
 /// Returns self * rhs mod p