ecmult in pubkey_tweak_mul #387

Is there any sense of using secp256k1_ecmult instead secp256k1_ecmult_const in pubkey_tweak_mul?

cc @axic

Yes, the non-const version is faster, and this API call does not work on secret data that needs timing attack resistance.

Sorry, I hadn't seen benchmarks, secp256k1_ecmult will be faster even if the second scalar will be zero? (i.e. na*A + 0*G)

I don't think there are direct benchmarks of these functions (though maybe you can infer data from the benchmarks for ECDH and ecdsa_verify). I hacked some in to see what the results are, and on my system ecmult takes 0.8 times as long as ecmult_const (though this increases to 0.9 if the second scalar is not zero).

So yes, ecmult is faster than even a single call to ecmult_const, even though it appears to do twice-ish as much work.

The catch is that it's variable time, so it can notice the G multiplier is 0, and no do work for it :)

@sipa @apoelstra thank you