Tim Ruffing

> For now, I'd prefer some clever grep on the assembly. Well ok, the issue with this is that this needs to be something which is statically checkable. This leaves...

> If you want the privacy of the wallet to be a multisignature scheme as well, you need SSS. Note that a somewhat naive method for small M and N...

> * [ ] We need someone to build this on MSVC. I have built this with MSVC 2019 on wine (https://github.com/mstorsjo/msvc-wine) and it works. Tests and exhaustive tests pass....

Indeed. Let me note that also Cirrus apparently offers Windows though I have no idea if it's good and/or reliable: https://cirrus-ci.org/guide/windows/

My above comment about the inclusion stuff was wrong but here's a cleaner version: https://github.com/real-or-random/secp256k1/commits/202201-int128-includes The first commit simply fixes naming of header guards and should belong to this PR....

> I notice that your PR still keeps the `USE_*_WIDEMUL_*` in `util.h`. it still seems we cannot really move it out of `util.h` because it both selects between `INT128_STRUCT` and...

Indeed, we know nothing about the signs of the summands. To convince myself, I also redid the bounds analysis: Counting value bits (i.e., bits that are not the sign bit):...

@roconnor-blockstream Can you rebase this? This will ease benchmarking against master.

Native 128bit performance looks good: $ SECP256K1_BENCH_ITERS=1000000 ./bench_internal inverse ``` gcc 11.2, pr: Benchmark , Min(us) , Avg(us) , Max(us) scalar_inverse , 2.40 , 2.41 , 2.42 scalar_inverse_var , 1.74...

This is about 1% slower on my machine with gcc -O2 but about 1.5% faster with gcc -03. gcc 12.1.0 -O2, x86_64, asm disabled: ``` Benchmark , Min(us) , Avg(us)...