Perf/ecsm affine selector

.github/workflows/pr_main.yaml

@@ -161,6 +161,9 @@ jobs:
       - name: Run syscalls host tests (keccak differential vs sha3)
         run: make test-syscalls
 
+      - name: Run ethrex-crypto host tests (hint verify-then-fallback + ecrecover)
+        run: make test-ethrex-crypto
+
   # "Test" is a required check — keep this name to avoid branch protection changes.
   # This gate job passes only when CLI, executor, disk-spill, and prover tests succeed.
   test:

Makefile

@@ -93,7 +93,7 @@ ASM_LDFLAGS ?= -fuse-ld=lld -nostdlib -Wl,-e,main
 # Custom RV64IM target spec location
 RV64_TARGET_SPEC=$(CURDIR)/executor/programs/riscv64im-lambda-vm-elf.json
 
-.PHONY: test prepare-sysroot
+.PHONY: test test-syscalls test-ethrex-crypto prepare-sysroot
 
 # The guard checks for include/stdlib.h (not just the include/ dir) so that a PARTIAL
 # sysroot — directories present but missing the C standard library headers — is detected
@@ -512,7 +512,12 @@ check-ethrex-fixture-checksums:
 test-syscalls:
 	cd syscalls && cargo test
 
-test: compile-programs test-syscalls
+# ethrex-crypto is a detached workspace (excluded from the root members), so a
+# root `cargo test` never runs it. Run it explicitly, like test-syscalls.
+test-ethrex-crypto:
+	cd crypto/ethrex-crypto && cargo test
+
+test: compile-programs test-syscalls test-ethrex-crypto
 	cargo test
 
 # === Quick test shortcuts ===

crypto/ecsm/src/curve.rs

@@ -153,11 +153,19 @@ fn schedule(k: &BigUint) -> Vec<(u8, u8, u8)> {
 /// multiplication. Needs no step list or slopes, so it skips all witness work.
 /// `k` must be in `[1, N)` (guaranteed by `prepare`).
 pub fn scalar_mul_affine_x(k: &BigUint, g: &AffinePoint) -> BigUint {
+    scalar_mul_affine(k, g).x
+}
+
+/// Executor fast path: the full affine point `k·g`, so the `ecsm_mul_affine` syscall can
+/// hand `y` back to the guest. `g` is whatever point the caller prepared — the even-`y` lift
+/// of `xG` on the x-only path, the caller's own input point on the affine one — and `k·g`'s
+/// y matches the ECDAS-constrained `y_r` either way.
+pub fn scalar_mul_affine(k: &BigUint, g: &AffinePoint) -> AffinePoint {
     let scalar = Option::<Scalar>::from(Scalar::from_repr(be32(k).into()))
         .expect("ECSM: scalar k must be < N");
     let g_proj = ProjectivePoint::from(to_k256_affine(g));
     let r = (g_proj * scalar).to_affine();
-    from_k256_affine(&r).x
+    from_k256_affine(&r)
 }
 
 /// Jacobian doubling (dbl-2009-l) for `y² = x³ + 7`: on `(X:Y:Z)` with

crypto/ecsm/src/lib.rs

@@ -24,7 +24,7 @@ mod tests;
 use num_bigint::BigUint;
 
 pub use curve::{AffinePoint, recover_y_canonical, replay_double_and_add};
-pub use witness::{EcdasStep, EcsmWitness, compute_witness};
+pub use witness::{EcdasStep, EcsmWitness, compute_witness, compute_witness_with_y};
 
 /// secp256k1 curve coefficient `b`.
 pub const B: u64 = 7;
@@ -65,11 +65,14 @@ pub enum EcsmError {
     ScalarIsZero,
     /// `k >= N`: outside the valid scalar range `[1, N)`.
     ScalarOutOfRange,
-    /// `x^3 + b` is not a quadratic residue, so `xG` is not a valid x-coordinate.
+    /// The input point is not on the curve: on the x-only path `x³ + b` is not a quadratic
+    /// residue, so `xG` is not a valid x-coordinate; on the affine path the caller's own
+    /// `yG` fails `yG² ≡ xG³ + b`.
     NotOnCurve,
-    /// `xG >= p`: not a canonical field element. Reducing it silently would
-    /// diverge from the prover, whose `xR < p` range check makes a non-canonical
-    /// input unprovable (with `k = 1` the input is echoed back as `xR`).
+    /// A coordinate is `>= p`, so it is not a canonical field element — `xG` on either path,
+    /// `yG` on the affine one. Reducing it silently would diverge from the prover, whose
+    /// `xR < p` / `yR < p` range checks make a non-canonical input unprovable (with `k = 1`
+    /// the x-only input is echoed back as `xR`).
     CoordinateOutOfRange,
 }
 
@@ -78,8 +81,8 @@ impl core::fmt::Display for EcsmError {
         match self {
             EcsmError::ScalarIsZero => write!(f, "ECSM scalar k must be non-zero"),
             EcsmError::ScalarOutOfRange => write!(f, "ECSM scalar k must be < N"),
-            EcsmError::NotOnCurve => write!(f, "ECSM xG is not a valid curve x-coordinate"),
-            EcsmError::CoordinateOutOfRange => write!(f, "ECSM xG must be < p"),
+            EcsmError::NotOnCurve => write!(f, "ECSM input point is not on the curve"),
+            EcsmError::CoordinateOutOfRange => write!(f, "ECSM coordinates must be < p"),
         }
     }
 }
@@ -119,6 +122,50 @@ pub(crate) fn prepare(
     Ok((k, AffinePoint { x: xg, y: yg }))
 }
 
+/// Like [`prepare`] but takes an explicit `yG` (the caller's full input point) instead of
+/// lifting `xG` to the canonical even root. Validates `0 < k < N`, `xG < p`, `yG < p`, and
+/// that `(xG, yG)` is on the curve (`yG² ≡ xG³ + b mod p`). Used by the affine path so the
+/// returned `yR` matches the caller's actual point (no parity convention / guest-side sign
+/// flip). `yG`'s value is pinned in the prover by a memory read of the caller's input.
+pub(crate) fn prepare_with_y(
+    k_le: &[u8; 32],
+    xg_le: &[u8; 32],
+    yg_le: &[u8; 32],
+) -> Result<(BigUint, AffinePoint), EcsmError> {
+    let k = BigUint::from_bytes_le(k_le);
+    if k == BigUint::from(0u8) {
+        return Err(EcsmError::ScalarIsZero);
+    }
+    if k >= n() {
+        return Err(EcsmError::ScalarOutOfRange);
+    }
+    let p = p();
+    let xg = BigUint::from_bytes_le(xg_le);
+    let yg = BigUint::from_bytes_le(yg_le);
+    if xg >= p || yg >= p {
+        return Err(EcsmError::CoordinateOutOfRange);
+    }
+    // On-curve: yG² ≡ xG³ + b (mod p).
+    let lhs = (&yg * &yg) % &p;
+    let rhs = (&xg * &xg % &p * &xg + BigUint::from(B)) % &p;
+    if lhs != rhs {
+        return Err(EcsmError::NotOnCurve);
+    }
+    Ok((k, AffinePoint { x: xg, y: yg }))
+}
+
+/// Affine entry point with an explicit input `yG`: both coordinates of `k·(xG, yG)` as
+/// little-endian 32-byte values. The executor writes `xR` then `yR` back (64-byte output).
+pub fn scalar_mul_xy_with_y(
+    k_le: &[u8; 32],
+    xg_le: &[u8; 32],
+    yg_le: &[u8; 32],
+) -> Result<([u8; 32], [u8; 32]), EcsmError> {
+    let (k, g) = prepare_with_y(k_le, xg_le, yg_le)?;
+    let r = curve::scalar_mul_affine(&k, &g);
+    Ok((to_le_32(&r.x), to_le_32(&r.y)))
+}
+
 /// Computes the x-coordinate of `k·G` over secp256k1, given `k` and `xG` as little-endian
 /// 32-byte values. This is the executor's entry point — it writes the returned bytes back
 /// to guest memory at `addr_xR`.

crypto/ecsm/src/witness.rs

@@ -23,7 +23,7 @@ use num_traits::{Signed, Zero};
 use rayon::prelude::*;
 
 use crate::curve::{StepPts, replay_double_and_add};
-use crate::{B, EcsmError, P_BYTES, R_BYTES, n, p, prepare, to_le_32};
+use crate::{B, EcsmError, P_BYTES, R_BYTES, n, p, prepare, prepare_with_y, to_le_32};
 
 /// Full ECSM-chip witness for one scalar multiplication (one ECSM row).
 #[derive(Debug, Clone)]
@@ -47,6 +47,11 @@ pub struct EcsmWitness {
     pub k_sub_n: [u8; 32],
     /// `(xR - p) mod 2^256`
     pub x_r_sub_p: [u8; 32],
+    /// `(yR - p) mod 2^256`. Forces `yR < p`: without it the byte range checks only
+    /// bound `yR < 2^256`, and the quotient columns absorb a multiple of `p`, so a
+    /// witness could publish `yR + p` for any `yR < 2^256 - p` (~2^32) — points with
+    /// such a tiny `y` are constructible, since `3 | p-1` makes cubing 3-to-1.
+    pub y_r_sub_p: [u8; 32],
     /// position of the most significant set bit of `k`
     pub len_k: u8,
     pub x_r: [u8; 32],
@@ -280,7 +285,26 @@ fn shifted_quotient(relation: &str, numerator: &BigInt, p_big: &BigInt, r_big: &
 /// little-endian 32-byte values. This is the prover's entry point.
 pub fn compute_witness(k_le: &[u8; 32], xg_le: &[u8; 32]) -> Result<EcsmWitness, EcsmError> {
     let (k, g) = prepare(k_le, xg_le)?;
+    compute_witness_inner(k_le, k, g)
+}
+
+/// Like [`compute_witness`] but with an explicit input `yG` (the caller's full point),
+/// validated on-curve by [`prepare_with_y`]. The affine path uses this so the witnessed
+/// `yG`/`yR` match the caller's actual point rather than the canonical even lift.
+pub fn compute_witness_with_y(
+    k_le: &[u8; 32],
+    xg_le: &[u8; 32],
+    yg_le: &[u8; 32],
+) -> Result<EcsmWitness, EcsmError> {
+    let (k, g) = prepare_with_y(k_le, xg_le, yg_le)?;
+    compute_witness_inner(k_le, k, g)
+}
 
+fn compute_witness_inner(
+    k_le: &[u8; 32],
+    k: BigUint,
+    g: crate::curve::AffinePoint,
+) -> Result<EcsmWitness, EcsmError> {
     let p_big = BigInt::from(p());
     let r_big = BigInt::from(BigUint::from_bytes_le(&R_BYTES)); // r = 3p
 
@@ -328,6 +352,7 @@ pub fn compute_witness(k_le: &[u8; 32], xg_le: &[u8; 32]) -> Result<EcsmWitness,
     let x_r = to_le_32(&result.x);
     let y_r = to_le_32(&result.y);
     let x_r_sub_p = to_le_32(&((&two_256 + &result.x) - p()));
+    let y_r_sub_p = to_le_32(&((&two_256 + &result.y) - p()));
 
     // Steps are independent witnesses (each builds its own λ/quotient/carry data
     // from one StepPts), so they parallelize freely when rayon is available.
@@ -354,6 +379,7 @@ pub fn compute_witness(k_le: &[u8; 32], xg_le: &[u8; 32]) -> Result<EcsmWitness,
         x_g_sub_p,
         k_sub_n,
         x_r_sub_p,
+        y_r_sub_p,
         len_k,
         x_r,
         y_r,