Assessment reports>Biconomy Secp256r1>Discussion>Modular subtraction trick

Validity of modular subtraction in _jAdd and _modifiedJacobianDouble

As the EVM does not have a submod instruction, the functions _jAdd and _modifiedJacobianDouble use the following pattern several times.

assembly {
    if lt(a, b) {
        a := add(p, a)
    let c := sub(a, b)

The assumption here is that and both satisfy , and the intention is to have c = (a - b) % p. If , then holds, so plain subtraction can be used. In the case , it holds that , so is the value needed for .

We note that while the add instruction could overflow (as is a 256-bit number), as both add and sub are calculated modulo , the end result for will still be correct.

Zellic © 2023Back to top ↑