Trait P256ScalarMul

Source

pub trait P256ScalarMul {
    // Required methods
    fn mul_base(k: P256Scalar) -> P256AffinePoint;
    fn mul_affine(k: P256Scalar, p: P256AffinePoint) -> P256AffinePoint;
}

Expand description

P-256 scalar multiplication accelerator.

Scalar multiplication dominates the cost of every P-256 protocol operation (ECDH, ECDSA sign/verify, key generation) by orders of magnitude, so this is the one hook a backend needs to provide for hardware acceleration. Everything else (scalar field arithmetic, point addition, encoding) stays in software, in embassy-crypto.

Input and output are canonical big-endian byte arrays; conversion to and from whatever the backend uses internally happens inside the implementation.

§Contract

The caller guarantees:

k is in the range [0, n-1], where n is the curve order. A zero scalar contributes the identity.
p is a valid, on-curve affine point (and therefore not the identity, which has no affine encoding).

The result is the identity exactly when k is zero. Since the identity has no affine encoding, the implementation signals it by returning the all-zero sentinel coordinates P256AffinePoint::default() (which are not a valid curve point); for non-zero k the result is never the identity, since P-256 has prime order. Whether the result is the identity is not treated as secret.

The implementation must not have secret-dependent timing: k (and, for mul_affine, p) may be secret.