Cache P-256 curve parameters per thread in p256_verify_impl

[khordadi]

Fixes #1646.

• Cache the secp256r1 curve parameters per thread. DL_GroupParameters_EC<ECP> was constructed on every call; it now lives in a function-local thread_local. Not a shared global: Crypto++'s ECP writes mutable scratch state under Add/Multiply, so one object shared across execution threads would be a data race. This matches the thread_local secp256k1_context pattern in ecrecover_impl.
• Check the (0, 0) infinity public key before the curve equation. Both orders reject identically — (0, 0) is not on the curve since b ≠ 0 for P-256 — so the cheap check runs first.

The issue's remaining suggestion (constexpr empty_result) was already resolved by the zkvm precompiles refactor (1ce42ff).

No consensus-visible behavior change; all 19 p256_verify test instantiations pass (782 geth/wycheproof vectors each). The zkvm build shadows this header and is unaffected.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR optimizes the EIP-7951 p256_verify precompile implementation by reducing per-call Crypto++ curve setup overhead and slightly reordering validation to fail faster on the infinity-key sentinel.

Changes:

• Cache DL_GroupParameters_EC<ECP> as a function-local thread_local in p256_verify_impl to avoid reconstructing P-256 parameters on every call.
• Reorder public key checks to reject (qx, qy) == (0, 0) before invoking ec.VerifyPoint(...).

Verdict: CORRECT

🤖 Generated with Claude Code

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Reviewed per REVIEW.md. No findings.

• The thread_local (rather than static) cache is correct: Crypto++'s ECP writes through a mutable Point m_R scratch member in its const Add/Double methods, so a single shared instance across execution threads would be a data race — the code comment documents this accurately. Per-thread caching eliminates the per-call ASN.1 decode of the secp256r1 parameters without changing behavior.
• No dangling references into the now-persistent object: Multiply returns Point by value, and auto const r_prime = ec.Add(p1, p2) deduces Point and copies out of the scratch before the next use.
• A block-scope thread_local in this header-defined inline function is ODR-safe (function-local statics in inline functions are unique across TUs), and the function has no suspension points, so the thread-bound references cannot outlive their thread even under fiber scheduling.
• Reordering the (0, 0) infinity check ahead of VerifyPoint is behavior-preserving: P-256 has b ≠ 0, so (0, 0) fails the curve equation, meaning both orders reject the identical input set — and the diff comment explains the divergence from the EIP-7951 pseudocode order.
• Existing coverage applies: the p256Verify.json vector suite (precompiles_test.cpp, TYPED_TEST(TraitsTest, p256_verify)) exercises both rejection paths across trait instantiations.
• PR hygiene: single commit, single file, scope is exactly what the title says.

Verdict: CORRECT

🤖 Generated with Claude Code