agl/curve25519-donna — pull request #23 by nmathewson (2012-12-23 19:37:57+00:00)
Title: Add an optimized curve25519_base_donna

In many protocols, it doesn't hurt security for a timing attacker to
know whether we're computing SK*9 ==> PUBKEY or whether we're
computing SK*PUBKEY ==> SHARED_SECRET. For example, when you're doing
Diffie-Hellman, everybody will do one scalarmult of the basepoint (9),
and one scalarmult of the other party's public key.

For this kind of application, we can improve handshake speed by having
an optimized curve25519_base_donna function (name taken from nacl's
"crypto_scalarmult_base") that computes SK*BP.

Here I've only done the most obvious version of the optimization by
making an alternate fmonty_bp that does a scalar multiplication by 9
in place of fmul(.,.,qmqp). On my laptop, the 64-bit
curve25519_base_donna is 11.5% faster than the regular 64-bit
curve25519_donna, and the 32-bit curve25519_base_donna is faster than
its counterpart by 4.7%.