Rewrite the C secp256k1 field arithmetic from 5x52-bit to 4x64-bit limbs,
matching the Kotlin Fe4 representation. This choice was validated by the
existing Kotlin benchmarks which showed 4x64 is faster due to fewer
multiplies (16 vs 25 per field mul).
Critical bugs fixed:
- uint128 overflow: accumulating 4+ cross-products in a single uint128
accumulator overflows (4 * 2^128 > 2^128). Switched to row-based
schoolbook multiplication (mul_wide) which adds one product at a time
- In-place doubling aliasing: gej_double(r, r) corrupted results because
output fields were overwritten while still being read as input. Added
explicit copy-on-alias detection
- 5x52 constant errors: P limbs, R fold constant (0x1000003D10 vs
0x10000003D10), and fe_negate all had wrong values for 5x52
Current status: field arithmetic fully verified, pubkey generation correct,
signing works, 2*G correct. Full verify (ecmult_double_g with large
scalars) still needs GLV/wNAF chain debugging.
https://claude.ai/code/session_011KVZhDcV2G7idNWEBz12GY
Claude
5f90f55fba