use curve cofactor for point verification

since multiplying a point by the order is farily expensive, skipping
it (when safe to do so) greatly increases performance

does not increase the speed.py numbers as point verification happens
outside the signing and verifying operations

Author: tomato42

src/ecdsa/ecdsa.py

@@ -131,7 +131,11 @@ def __init__(self, generator, point, verify=True):
         raise InvalidPointError("Point does not lie on the curve")
     if not n:
       raise InvalidPointError("Generator point must have order.")
-    if verify and not n * point == ellipticcurve.INFINITY:
+    # for curve parameters with base point with cofactor 1, all points
+    # that are on the curve are scalar multiples of the base point, so
+    # verifying that is not necessary. See Section 3.2.2.1 of SEC 1 v2
+    if verify and self.curve.cofactor() != 1 and \
+            not n * point == ellipticcurve.INFINITY:
       raise InvalidPointError("Generator point order is bad.")
 
   def __eq__(self, other):
@@ -272,7 +276,8 @@ def point_is_valid(generator, x, y):
     return False
   if not curve.contains_point(x, y):
     return False
-  if not n * ellipticcurve.PointJacobi(curve, x, y, 1)\
+  if curve.cofactor() != 1 and \
+        not n * ellipticcurve.PointJacobi(curve, x, y, 1)\
         == ellipticcurve.INFINITY:
     return False
   return True
@@ -287,7 +292,7 @@ def point_is_valid(generator, x, y):
 _Gx = 0x188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012
 _Gy = 0x07192b95ffc8da78631011ed6b24cdd573f977a11e794811
 
-curve_192 = ellipticcurve.CurveFp(_p, -3, _b)
+curve_192 = ellipticcurve.CurveFp(_p, -3, _b, 1)
 generator_192 = ellipticcurve.PointJacobi(
     curve_192, _Gx, _Gy, 1, _r, generator=True)
 
@@ -301,7 +306,7 @@ def point_is_valid(generator, x, y):
 _Gx = 0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21
 _Gy = 0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34
 
-curve_224 = ellipticcurve.CurveFp(_p, -3, _b)
+curve_224 = ellipticcurve.CurveFp(_p, -3, _b, 1)
 generator_224 = ellipticcurve.PointJacobi(
     curve_224, _Gx, _Gy, 1, _r, generator=True)
 
@@ -314,7 +319,7 @@ def point_is_valid(generator, x, y):
 _Gx = 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296
 _Gy = 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5
 
-curve_256 = ellipticcurve.CurveFp(_p, -3, _b)
+curve_256 = ellipticcurve.CurveFp(_p, -3, _b, 1)
 generator_256 = ellipticcurve.PointJacobi(
     curve_256, _Gx, _Gy, 1, _r, generator=True)
 
@@ -327,7 +332,7 @@ def point_is_valid(generator, x, y):
 _Gx = 0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7
 _Gy = 0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f
 
-curve_384 = ellipticcurve.CurveFp(_p, -3, _b)
+curve_384 = ellipticcurve.CurveFp(_p, -3, _b, 1)
 generator_384 = ellipticcurve.PointJacobi(
     curve_384, _Gx, _Gy, 1, _r, generator=True)
 
@@ -340,7 +345,7 @@ def point_is_valid(generator, x, y):
 _Gx = 0xc6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66
 _Gy = 0x11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650
 
-curve_521 = ellipticcurve.CurveFp(_p, -3, _b)
+curve_521 = ellipticcurve.CurveFp(_p, -3, _b, 1)
 generator_521 = ellipticcurve.PointJacobi(
     curve_521, _Gx, _Gy, 1, _r, generator=True)
 
@@ -352,7 +357,7 @@ def point_is_valid(generator, x, y):
 _Gy = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8
 _r = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
 
-curve_secp256k1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_secp256k1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_secp256k1 = ellipticcurve.PointJacobi(
     curve_secp256k1, _Gx, _Gy, 1, _r, generator=True)
 
@@ -364,7 +369,7 @@ def point_is_valid(generator, x, y):
 _Gy = 0x1667CB477A1A8EC338F94741669C976316DA6321
 _q = 0xE95E4A5F737059DC60DF5991D45029409E60FC09
 
-curve_brainpoolp160r1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_brainpoolp160r1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_brainpoolp160r1 = ellipticcurve.PointJacobi(
     curve_brainpoolp160r1, _Gx, _Gy, 1, _q, generator=True)
 
@@ -376,7 +381,7 @@ def point_is_valid(generator, x, y):
 _Gy = 0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F
 _q = 0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1
 
-curve_brainpoolp192r1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_brainpoolp192r1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_brainpoolp192r1 = ellipticcurve.PointJacobi(
     curve_brainpoolp192r1, _Gx, _Gy, 1, _q, generator=True)
 
@@ -388,7 +393,7 @@ def point_is_valid(generator, x, y):
 _Gy = 0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD
 _q = 0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F
 
-curve_brainpoolp224r1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_brainpoolp224r1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_brainpoolp224r1 = ellipticcurve.PointJacobi(
     curve_brainpoolp224r1, _Gx, _Gy, 1, _q, generator=True)
 
@@ -400,7 +405,7 @@ def point_is_valid(generator, x, y):
 _Gy = 0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997
 _q = 0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7
 
-curve_brainpoolp256r1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_brainpoolp256r1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_brainpoolp256r1 = ellipticcurve.PointJacobi(
     curve_brainpoolp256r1, _Gx, _Gy, 1, _q, generator=True)
 
@@ -412,7 +417,7 @@ def point_is_valid(generator, x, y):
 _Gy = 0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1
 _q = 0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311
 
-curve_brainpoolp320r1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_brainpoolp320r1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_brainpoolp320r1 = ellipticcurve.PointJacobi(
     curve_brainpoolp320r1, _Gx, _Gy, 1, _q, generator=True)
 
@@ -424,7 +429,7 @@ def point_is_valid(generator, x, y):
 _Gy = 0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315
 _q = 0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565
 
-curve_brainpoolp384r1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_brainpoolp384r1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_brainpoolp384r1 = ellipticcurve.PointJacobi(
     curve_brainpoolp384r1, _Gx, _Gy, 1, _q, generator=True)
 
@@ -436,6 +441,6 @@ def point_is_valid(generator, x, y):
 _Gy = 0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892
 _q = 0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069
 
-curve_brainpoolp512r1 = ellipticcurve.CurveFp(_p, _a, _b)
+curve_brainpoolp512r1 = ellipticcurve.CurveFp(_p, _a, _b, 1)
 generator_brainpoolp512r1 = ellipticcurve.PointJacobi(
     curve_brainpoolp512r1, _Gx, _Gy, 1, _q, generator=True)

src/ecdsa/ellipticcurve.py

@@ -41,11 +41,19 @@
 @python_2_unicode_compatible
 class CurveFp(object):
   """Elliptic Curve over the field of integers modulo a prime."""
-  def __init__(self, p, a, b):
-    """The curve of points satisfying y^2 = x^3 + a*x + b (mod p)."""
+  def __init__(self, p, a, b, h=None):
+    """
+    The curve of points satisfying y^2 = x^3 + a*x + b (mod p).
+
+    h is an integer that is the cofactor of the elliptic curve domain
+    parameters; it is the number of points satisfying the elliptic curve
+    equation divided by the order of the base point. It is used for selection
+    of efficient algorithm for public point verification.
+    """
     self.__p = p
     self.__a = a
     self.__b = b
+    self.__h = h
 
   def __eq__(self, other):
     if isinstance(other, CurveFp):    
@@ -64,12 +72,16 @@ def a(self):
   def b(self):
     return self.__b
 
+  def cofactor(self):
+    return self.__h
+
   def contains_point(self, x, y):
     """Is the point (x,y) on this curve?"""
     return (y * y - ((x * x + self.__a) * x + self.__b)) % self.__p == 0
 
   def __str__(self):
-    return "CurveFp(p=%d, a=%d, b=%d)" % (self.__p, self.__a, self.__b)
+    return "CurveFp(p=%d, a=%d, b=%d, h=%d)" % (
+        self.__p, self.__a, self.__b, self.__h)
 
 
 class PointJacobi(object):
@@ -536,7 +548,10 @@ def __init__(self, curve, x, y, order=None):
     # self.curve is allowed to be None only for INFINITY:
     if self.__curve:
       assert self.__curve.contains_point(x, y)
-    if order:
+    # for curves with cofactor 1, all points that are on the curve are scalar
+    # multiples of the base point, so performing multiplication is not
+    # necessary to verify that. See Section 3.2.2.1 of SEC 1 v2
+    if curve and curve.cofactor() != 1 and order:
       assert self * order == INFINITY
 
   def __eq__(self, other):