How should these two functions be used properly?
A simple answer is "not at all". Those functions are not exposed in the public API of libsecp256k1, and that's the reason why they don't have user-targeted documentation. Instead, they're used as internal subroutines, mostly for the implementation of ECDSA and Schnorr signatures.
Be advised that cryptography should be implemented by experts. It's very easy to shoot yourself in the foot if you don't know what you're doing (and in fact, even if you know what you're doing).
Having said this, here's a high-level overview:
secp256k1_ecmult_gen gets as input a scalar
a and computes the multiplication
aG with the standard generator
G. This function is constant-time in the scalar
a, i.e., it ensures that the timing of the computation does not leak information about
a. That's why it is used whenever the scalar is a secret, e.g., for key generation when computing the public key
xG from the secret key
x, or for signing when computing the nonce
rG from the secret scalar
r. In general, the requirement for a constant-time implementation makes makes code slower (for example, you can't have early returns).
secp256k1_ecmult gets as input two scalars
b and a point
P, and it computes
aP + bG. This function does not ensure constant-time computations. This computation is exactly what is necessary for signature verification, and the function is suitable because no secret values are involved in verification.
- There's also
secp256k1_ecmult_const. It gets as input a scalar
a and point
P, and it computes
aP in constant-time. (So in terms of functionality and security, it is a more general variant of
secp256k1_ecmult_gen that works with arbitrary points
P. As such it is less efficient because it cannot rely on some precomputation techniques that require to know
P upfront.) This is used as a subroutine in the ECDH (Diffie-Hellman) module for computing the shared secret in the key exchange.