Add skip_while condition for scalar mul

src/g1.rs

@@ -751,6 +751,29 @@ impl G1Projective {
         G1Projective::conditional_select(&tmp, self, rhs.is_identity())
     }
 
+    /// Multiply this point by a scalar, using variable-time multiplication.
+    pub fn multiply_vartime(&self, by: &Scalar) -> G1Projective {
+        let mut acc = G1Projective::identity();
+
+        // This is a simple double-and-add implementation of point
+        // multiplication, moving from most significant to least
+        // significant bit of the scalar.
+        //
+        // We skip the leading bit as part of the vartime implementation.
+        for bit in by
+            .to_bytes()
+            .iter()
+            .rev()
+            .flat_map(|byte| (0..8).rev().map(move |i| Choice::from((byte >> i) & 1u8)))
+            .skip_while(|c| !bool::from(*c))
+        {
+            acc = acc.double();
+            acc = G1Projective::conditional_select(&acc, &(acc + self), bit);
+        }
+
+        acc
+    }
+
     fn multiply(&self, by: &[u8; 32]) -> G1Projective {
         let mut acc = G1Projective::identity();
 
@@ -1572,6 +1595,10 @@ fn test_projective_scalar_multiplication() {
     let c = a * b;
 
     assert_eq!((g * a) * b, g * c);
+    assert_eq!(
+        g.multiply_vartime(&a).multiply_vartime(&b),
+        g.multiply_vartime(&c)
+    );
 }
 
 #[test]

src/g2.rs

@@ -822,6 +822,29 @@ impl G2Projective {
         G2Projective::conditional_select(&tmp, self, rhs.is_identity())
     }
 
+    /// Multiply this point by a scalar, using variable-time multiplication.
+    pub fn multiply_vartime(&self, by: &Scalar) -> G2Projective {
+        let mut acc = G2Projective::identity();
+
+        // This is a simple double-and-add implementation of point
+        // multiplication, moving from most significant to least
+        // significant bit of the scalar.
+        //
+        // We skip the leading bit as part of the vartime implementation.
+        for bit in by
+            .to_bytes()
+            .iter()
+            .rev()
+            .flat_map(|byte| (0..8).rev().map(move |i| Choice::from((byte >> i) & 1u8)))
+            .skip_while(|c| !bool::from(*c))
+        {
+            acc = acc.double();
+            acc = G2Projective::conditional_select(&acc, &(acc + self), bit);
+        }
+
+        acc
+    }
+
     fn multiply(&self, by: &[u8]) -> G2Projective {
         let mut acc = G2Projective::identity();
 
@@ -1836,6 +1859,10 @@ fn test_projective_scalar_multiplication() {
     let c = a * b;
 
     assert_eq!((g * a) * b, g * c);
+    assert_eq!(
+        g.multiply_vartime(&a).multiply_vartime(&b),
+        g.multiply_vartime(&c)
+    );
 }
 
 #[test]

src/pairings.rs

@@ -255,6 +255,29 @@ impl Gt {
     pub fn double(&self) -> Gt {
         Gt(self.0.square())
     }
+
+    /// Multiply this point by a scalar, using variable-time multiplication.
+    pub fn multiply_vartime(self, other: &Scalar) -> Gt {
+        let mut acc = Gt::identity();
+
+        // This is a simple double-and-add implementation of group element
+        // multiplication, moving from most significant to least
+        // significant bit of the scalar.
+        //
+        // We skip the leading bit as part of the vartime implementation.
+        for bit in other
+            .to_bytes()
+            .iter()
+            .rev()
+            .flat_map(|byte| (0..8).rev().map(move |i| Choice::from((byte >> i) & 1u8)))
+            .skip_while(|c| !bool::from(*c))
+        {
+            acc = acc.double();
+            acc = Gt::conditional_select(&acc, &(acc + self), bit);
+        }
+
+        acc
+    }
 }
 
 impl<'a> Neg for &'a Gt {