Restore "p521: fiat-constify update (#1003)" (#1014)

This reverts commit 26be150.

Now that we've completed the `elliptic-curve` v0.14.0-pre upgrade, we
can restore the fiat-crypto upgrade.

This commit takes a slightly different approach and puts the macro
implementation for the newest version of `fiat-crypto` into the
new `primefield` crate which was added in #1013.

The goal will be to update all of the crates and then remove the old
macros from `primeorder` entirely.

p521/Cargo.toml

@@ -22,6 +22,7 @@ elliptic-curve = { version = "=0.14.0-pre.2", default-features = false, features
 # optional dependencies
 ecdsa-core = { version = "=0.17.0-pre.2", package = "ecdsa", optional = true, default-features = false, features = ["der"] }
 hex-literal = { version = "0.4", optional = true }
+primefield = { version = "=0.14.0-pre", optional = true, path = "../primefield" }
 primeorder = { version = "=0.14.0-pre", optional = true, path = "../primeorder" }
 rand_core = { version = "0.6", optional = true, default-features = false }
 serdect = { version = "0.2", optional = true, default-features = false }
@@ -34,16 +35,18 @@ hex-literal = "0.4"
 primeorder = { version = "=0.14.0-pre", features = ["dev"], path = "../primeorder" }
 proptest = "1.4"
 rand_core = { version = "0.6", features = ["getrandom"] }
+criterion = "0.5.1"
 
 [features]
 default = ["arithmetic", "ecdsa", "getrandom", "pem", "std"]
 alloc = ["ecdsa-core?/alloc", "elliptic-curve/alloc", "primeorder?/alloc"]
 std = ["alloc", "ecdsa-core?/std", "elliptic-curve/std"]
 
-arithmetic = ["dep:primeorder"]
+arithmetic = ["dep:primefield", "dep:primeorder"]
 digest = ["ecdsa-core/digest", "ecdsa-core/hazmat"]
 ecdh = ["arithmetic", "elliptic-curve/ecdh"]
 ecdsa = ["arithmetic", "ecdsa-core/signing", "ecdsa-core/verifying", "sha512"]
+expose-field = ["arithmetic"]
 getrandom = ["rand_core/getrandom"]
 hash2curve = ["arithmetic", "elliptic-curve/hash2curve"]
 jwk = ["elliptic-curve/jwk"]
@@ -57,3 +60,12 @@ voprf = ["elliptic-curve/voprf", "dep:sha2"]
 [package.metadata.docs.rs]
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
+
+[[bench]]
+name = "field"
+harness = false
+required-features = ["expose-field"]
+
+[[bench]]
+name = "scalar"
+harness = false

p521/benches/field.rs

@@ -0,0 +1,54 @@
+//! secp521r1 field element benchmarks
+
+use criterion::{
+    black_box, criterion_group, criterion_main, measurement::Measurement, BenchmarkGroup, Criterion,
+};
+use hex_literal::hex;
+use p521::{FieldBytes, FieldElement};
+
+fn test_field_element_x() -> FieldElement {
+    black_box(FieldElement::from_bytes(
+        &FieldBytes::clone_from_slice(&hex!("01a7596d38aac7868327ddc1ef5e8178cf052b7ebc512828e8a45955d85bef49494d15278198bbcc5454358c12a2af9a3874e7002e1a2f02fcb36ff3e3b4bc0c69e7"))
+    )
+    .unwrap())
+}
+
+fn test_field_element_y() -> FieldElement {
+    black_box(FieldElement::from_bytes(
+        &FieldBytes::clone_from_slice(&hex!("0184902e515982bb225b8c84f245e61b327c08e94d41c07d0b4101a963e02fe52f6a9f33e8b1de2394e0cb74c40790b4e489b5500e6804cabed0fe8c192443d4027b"))
+    )
+    .unwrap())
+}
+
+fn bench_field_element_mul<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_field_element_x();
+    let y = test_field_element_y();
+    group.bench_function("mul", |b| b.iter(|| &x * &y));
+}
+
+fn bench_field_element_square<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_field_element_x();
+    group.bench_function("square", |b| b.iter(|| x.square()));
+}
+
+fn bench_field_element_sqrt<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_field_element_x();
+    group.bench_function("sqrt", |b| b.iter(|| x.sqrt()));
+}
+
+fn bench_field_element_invert<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_field_element_x();
+    group.bench_function("invert", |b| b.iter(|| x.invert()));
+}
+
+fn bench_field_element(c: &mut Criterion) {
+    let mut group = c.benchmark_group("field element operations");
+    bench_field_element_mul(&mut group);
+    bench_field_element_square(&mut group);
+    bench_field_element_invert(&mut group);
+    bench_field_element_sqrt(&mut group);
+    group.finish();
+}
+
+criterion_group!(benches, bench_field_element);
+criterion_main!(benches);

p521/benches/scalar.rs

@@ -0,0 +1,73 @@
+//! secp521r1 scalar arithmetic benchmarks
+
+use criterion::{
+    black_box, criterion_group, criterion_main, measurement::Measurement, BenchmarkGroup, Criterion,
+};
+use hex_literal::hex;
+use p521::{elliptic_curve::group::ff::PrimeField, FieldBytes, ProjectivePoint, Scalar};
+
+fn test_scalar_x() -> Scalar {
+    black_box(Scalar::from_repr(
+        FieldBytes::clone_from_slice(&hex!("01d7bb864c5b5ecae019296cf9b5c63a166f5f1113942819b1933d889a96d12245777a99428f93de4fc9a18d709bf91889d7f8dddd522b4c364aeae13c983e9fae46"))
+    ).unwrap())
+}
+
+fn test_scalar_y() -> Scalar {
+    black_box(Scalar::from_repr(
+        FieldBytes::clone_from_slice(&hex!("017e49b8ea8f9d1b7c0378e378a7a42e68e12cf78779ed41dcd29a090ae7e0f883b0d0f2cbc8f0473c0ad6732bea40d371a7f363bc6537d075bd1a4c23e558b0bc73"))
+    ).unwrap())
+}
+
+fn bench_point_mul<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let p = ProjectivePoint::GENERATOR;
+    let m = test_scalar_x();
+    let s = Scalar::from_repr(m.into()).unwrap();
+    group.bench_function("point-scalar mul", |b| b.iter(|| &p * &s));
+}
+
+fn bench_scalar_sub<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_scalar_x();
+    let y = test_scalar_y();
+    group.bench_function("sub", |b| b.iter(|| &x - &y));
+}
+
+fn bench_scalar_add<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_scalar_x();
+    let y = test_scalar_y();
+    group.bench_function("add", |b| b.iter(|| &x + &y));
+}
+
+fn bench_scalar_mul<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_scalar_x();
+    let y = test_scalar_y();
+    group.bench_function("mul", |b| b.iter(|| &x * &y));
+}
+
+fn bench_scalar_negate<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_scalar_x();
+    group.bench_function("negate", |b| b.iter(|| -x));
+}
+
+fn bench_scalar_invert<'a, M: Measurement>(group: &mut BenchmarkGroup<'a, M>) {
+    let x = test_scalar_x();
+    group.bench_function("invert", |b| b.iter(|| x.invert()));
+}
+
+fn bench_point(c: &mut Criterion) {
+    let mut group = c.benchmark_group("point operations");
+    bench_point_mul(&mut group);
+    group.finish();
+}
+
+fn bench_scalar(c: &mut Criterion) {
+    let mut group = c.benchmark_group("scalar operations");
+    bench_scalar_sub(&mut group);
+    bench_scalar_add(&mut group);
+    bench_scalar_mul(&mut group);
+    bench_scalar_negate(&mut group);
+    bench_scalar_invert(&mut group);
+    group.finish();
+}
+
+criterion_group!(benches, bench_point, bench_scalar);
+criterion_main!(benches);

p521/src/arithmetic/field.rs

@@ -397,13 +397,15 @@ impl From<u128> for FieldElement {
 
 impl ConditionallySelectable for FieldElement {
     fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self {
-        let mut ret = Self::ZERO;
+        let mut ret = Self::ZERO.0.into_inner();
+        let a = a.0.as_inner();
+        let b = b.0.as_inner();
 
-        for i in 0..ret.0.len() {
-            ret.0[i] = u64::conditional_select(&a.0[i], &b.0[i], choice);
+        for i in 0..ret.len() {
+            ret[i] = u64::conditional_select(&a[i], &b[i], choice);
         }
 
-        ret
+        Self(fiat_p521_tight_field_element(ret))
     }
 }
 
@@ -666,7 +668,7 @@ mod tests {
     use super::FieldElement;
     use elliptic_curve::ff::PrimeField;
     use hex_literal::hex;
-    use primeorder::{
+    use primefield::{
         impl_field_identity_tests, impl_field_invert_tests, impl_field_sqrt_tests,
         impl_primefield_tests,
     };