sage: verify Eisenstein integer connection for GLV constants
What the developer wrote
Authored by Justsomebuddy
sage: verify Eisenstein integer connection for GLV constants
Add assertions to verify that the GLV decomposition constants arise
from the Eisenstein integer factorization of the group order N.
The group order factors as N = pi * conj(pi) in Z[w], where pi = A - B*w
is an Eisenstein prime. The GLV eigenvalue LAMBDA = B/A mod N, which is
the image of w^2 under the isomorphism Z[w]/(pi) -> Z/NZ.
What changed, and why it matters
This commit adds mathematical self-checks (assertions) to a SageMath script used to generate internal constants for Bitcoin's secp256k1 library. It does not change any runtime code, cryptographic operations, or user-facing behavior. It only verifies that precomputed GLV constants correctly relate to a known algebraic factorization involving Eisenstein integers. There is no security vulnerability or fix here.
No action required. This is a non-functional verification-only change in a SageMath generator script.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch extends sage/gen_split_lambda_constants.sage with assertions that tie the GLV decomposition constants (A1, B1) to the Eisenstein integer ring Z[w]. It sets A_EIS = -B1, B_EIS = A1 and checks that the Eisenstein norm A_EIS^2 + A_EIS*B_EIS + B_EIS^2 equals the curve order N, and that B_EIS/A_EIS mod N equals the GLV eigenvalue LAMBDA. This is a documentation/verification-only change in a code-generation helper; no C library code, API, or generated constant values are altered.
Changed components
sage/gen_split_lambda_constants.sageInspect captured patch +9 / −0
diff --git a/sage/gen_split_lambda_constants.sage b/sage/gen_split_lambda_constants.sage
index 7d4359e..7a5761a 100644
--- a/sage/gen_split_lambda_constants.sage
+++ b/sage/gen_split_lambda_constants.sage
@@ -81,6 +81,15 @@ assert (A1 + A2)/2 < sqrt(N)
assert B1 < sqrt(N)
assert B2 < sqrt(N)
+# Verify connection to Eisenstein integers Z[w] where w = (-1 + sqrt(-3))/2.
+# The group order N factors as N = pi * conj(pi) in Z[w], where pi = A - B*w
+# is an Eisenstein prime with norm A^2 + A*B + B^2. The GLV endomorphism
+# eigenvalue LAMBDA equals B/A mod N, which is the image of w^2 under the
+# isomorphism Z[w]/(pi) -> Z/NZ (since w -> A/B and (A/B)^2 = B/A in Z/NZ).
+A_EIS, B_EIS = -B1, A1
+assert A_EIS**2 + A_EIS*B_EIS + B_EIS**2 == N
+assert Z(B_EIS / A_EIS) == LAMBDA
+
G1 = round((2**384)*B2/N)
G2 = round((2**384)*(-B1)/N)
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.