<blockquote>
<p>How should these two functions be used properly?</p>
</blockquote>
<p>A simple answer is &quot;not at all&quot;. Those functions are not exposed in the public API of libsecp256k1, and that's the reason why they don't have user-targeted documentation. Instead, they're used as internal subroutines, mostly for the implementation of ECDSA and Schnorr signatures.</p>
<p>Be advised that cryptography should be implemented by experts. It's very easy to shoot yourself in the foot if you don't know what you're doing (and in fact, even if you know what you're doing).</p>
<p>Having said this, here's a high-level overview:</p>
<ul>
<li><code>secp256k1_ecmult_gen</code> gets as input a scalar <code>a</code> and computes the multiplication <code>aG</code> with the standard generator <code>G</code>. This function is constant-time in the scalar <code>a</code>, i.e., it ensures that the timing of the computation does not leak information about <code>a</code>. That's why it is used whenever the scalar is a secret, e.g., for key generation when computing the public key <code>xG</code> from the secret key <code>x</code>, or for signing when computing the nonce <code>rG</code> from the secret scalar <code>r</code>. In general, the requirement for a constant-time implementation makes makes code slower (for example, you can't have early returns).</li>
<li><code>secp256k1_ecmult</code> gets as input two scalars <code>a</code>, <code>b</code> and a point <code>P</code>, and it computes <code>aP + bG</code>. This function does not ensure constant-time computations. This computation is exactly what is necessary for signature verification, and the function is suitable because no secret values are involved in verification.</li>
<li>There's also <code>secp256k1_ecmult_const</code>. It gets as input a scalar <code>a</code> and point <code>P</code>, and it computes <code>aP</code> in constant-time. (So in terms of functionality and security, it is a more general variant of <code>secp256k1_ecmult_gen</code> that works with arbitrary points <code>P</code>. As such it is less efficient because it cannot rely on some precomputation techniques that require to know <code>P</code> upfront.) This is used as a subroutine in the ECDH (Diffie-Hellman) module for computing the shared secret in the key exchange.</li>
</ul>

CC BY-SA 4.0
2021-02-26T13:44:47.260Z
2021-02-26T21:29:34.630Z
2021-02-26T21:29:34.630Z
real-or-random
<p>libsecp256k1 has two implementations, <code>secp256k1_ecmult</code> in <code>ecmult.h</code> and <code>secp256k1_ecmult_gen</code> in <code>ecmult_gen.h</code>, to multiply the points of an elliptic curve.</p>
<p><code>secp256k1_ecmult_gen</code> supports simple multiplication such as <code>a*G</code> and <code>secp256k1_ecmult</code> supports multiplication involving addition such as <code>a*P + bG</code>. However, <code>secp256k1_ecmult</code> can be used for simple multiplication by setting <code>b=0</code>, actually, it is used as such in <code>eckey_impl.h#secp256k1_eckey_pubkey_tweak_mul</code>.</p>
<p>How should these two functions be used properly? Is there any difference in the performance?</p>

CC BY-SA 4.0
2021-02-26T22:18:30.130Z
The files ecmult.h and ecmult_gen.h can be found here: https://github.com/bitcoin-core/secp256k1/tree/master/src . The implementations are found here: https://github.com/bitcoin-core/secp256k1/blob/master/src/ecmult_impl.h ; https://github.com/bitcoin-core/secp256k1/blob/master/src/ecmult_gen_impl.h
Nayuki
<api><secp256k1>
What is the difference between secp256k1_ecmult_gen and secp256k1_ecmult?
Shigeyuki Azuchi
# What is the difference between secp256k1_ecmult_gen and secp256k1_ecmult?

(Asked by: username_0 on 2021-02-26)

libsecp256k1 has two implementations, `secp256k1_ecmult` in `ecmult.h` and `secp256k1_ecmult_gen` in `ecmult_gen.h`, to multiply the points of an elliptic curve.

`secp256k1_ecmult_gen` supports simple multiplication such as `a*G` and `secp256k1_ecmult` supports multiplication involving addition such as `a*P + bG`. However, `secp256k1_ecmult` can be used for simple multiplication by setting `b=0`, actually, it is used as such in `eckey_impl.h#secp256k1_eckey_pubkey_tweak_mul`.

How should these two functions be used properly? Is there any difference in the performance?

**Tags:** api, secp256k1

> **Comments:**
> **username_1**: The files ecmult.h and ecmult_gen.h can be found here: https://github.com/bitcoin-core/secp256k1/tree/master/src . The implementations are found here: https://github.com/bitcoin-core/secp256k1/blob/master/src/ecmult_impl.h ; https://github.com/bitcoin-core/secp256k1/blob/master/src/ecmult_gen_impl.h  

---

## 1 answers

### Answer by username_2 on 2021-02-26. Score: 9 | Accepted answer

> How should these two functions be used properly?

A simple answer is "not at all". Those functions are not exposed in the public API of libsecp256k1, and that's the reason why they don't have user-targeted documentation. Instead, they're used as internal subroutines, mostly for the implementation of ECDSA and Schnorr signatures.

Be advised that cryptography should be implemented by experts. It's very easy to shoot yourself in the foot if you don't know what you're doing (and in fact, even if you know what you're doing).

Having said this, here's a high-level overview:

* `secp256k1_ecmult_gen` gets as input a scalar `a` and computes the multiplication `aG` with the standard generator `G`. This function is constant-time in the scalar `a`, i.e., it ensures that the timing of the computation does not leak information about `a`. That's why it is used whenever the scalar is a secret, e.g., for key generation when computing the public key `xG` from the secret key `x`, or for signing when computing the nonce `rG` from the secret scalar `r`. In general, the requirement for a constant-time implementation makes makes code slower (for example, you can't have early returns).
* `secp256k1_ecmult` gets as input two scalars `a`, `b` and a point `P`, and it computes `aP + bG`. This function does not ensure constant-time computations. This computation is exactly what is necessary for signature verification, and the function is suitable because no secret values are involved in verification.
* There's also `secp256k1_ecmult_const`. It gets as input a scalar `a` and point `P`, and it computes `aP` in constant-time. (So in terms of functionality and security, it is a more general variant of `secp256k1_ecmult_gen` that works with arbitrary points `P`. As such it is less efficient because it cannot rely on some precomputation techniques that require to know `P` upfront.) This is used as a subroutine in the ECDH (Diffie-Hellman) module for computing the shared secret in the key exchange.


---

