libsecp256k1 has two implementations, secp256k1_ecmult in ecmult.h and secp256k1_ecmult_gen in ecmult_gen.h, to multiply the points of an elliptic curve.

secp256k1_ecmult_gen supports simple multiplication such as a*G and secp256k1_ecmult supports multiplication involving addition such as a*P + bG. However, secp256k1_ecmult can be used for simple multiplication by setting b=0, actually, it is used as such in eckey_impl.h#secp256k1_eckey_pubkey_tweak_mul.

How should these two functions be used properly? Is there any difference in the performance?


1 Answer 1


How should these two functions be used properly?

A simple answer is "not at all". Those functions are not exposed in the public API of libsecp256k1, and that's the reason why they don't have user-targeted documentation. Instead, they're used as internal subroutines, mostly for the implementation of ECDSA and Schnorr signatures.

Be advised that cryptography should be implemented by experts. It's very easy to shoot yourself in the foot if you don't know what you're doing (and in fact, even if you know what you're doing).

Having said this, here's a high-level overview:

  • secp256k1_ecmult_gen gets as input a scalar a and computes the multiplication aG with the standard generator G. This function is constant-time in the scalar a, i.e., it ensures that the timing of the computation does not leak information about a. That's why it is used whenever the scalar is a secret, e.g., for key generation when computing the public key xG from the secret key x, or for signing when computing the nonce rG from the secret scalar r. In general, the requirement for a constant-time implementation makes makes code slower (for example, you can't have early returns).
  • secp256k1_ecmult gets as input two scalars a, b and a point P, and it computes aP + bG. This function does not ensure constant-time computations. This computation is exactly what is necessary for signature verification, and the function is suitable because no secret values are involved in verification.
  • There's also secp256k1_ecmult_const. It gets as input a scalar a and point P, and it computes aP in constant-time. (So in terms of functionality and security, it is a more general variant of secp256k1_ecmult_gen that works with arbitrary points P. As such it is less efficient because it cannot rely on some precomputation techniques that require to know P upfront.) This is used as a subroutine in the ECDH (Diffie-Hellman) module for computing the shared secret in the key exchange.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.