What is sc_check function checking?

Question

In crypto-ops.c there is a function called sc_check. It is called with the secret key as a parameter. What exactly is this function checking for? That the key is not too small? But how? What re all these magic numbers?

int sc_check(const unsigned char *s) {
  int64_t s0 = load_4(s);
  int64_t s1 = load_4(s + 4);
  int64_t s2 = load_4(s + 8);
  int64_t s3 = load_4(s + 12);
  int64_t s4 = load_4(s + 16);
  int64_t s5 = load_4(s + 20);
  int64_t s6 = load_4(s + 24);
  int64_t s7 = load_4(s + 28);
  return (signum(1559614444 - s0) + (signum(1477600026 - s1) << 1) + (signum(2734136534 - s2) << 2) + (signum(350157278 - s3) << 3) + (signum(-s4) << 4) + (signum(-s5) << 5) + (signum(-s6) << 6) + (signum(268435456 - s7) << 7)) >> 8;
}

Answer 1

Elliptic curve encryption uses numbers called scalars (which are used as private keys). Valid scalars should be less than the group size of Monero's base point, i.e. the maximum allowable value of a scalar is 2^252 + 27742317777372353535851937790883648492

The sc_check method therefore verifies that the number is not too big. It does so in a strange way so that it runs in constant time. This prevents timing attacks that could leak information about the size of the scalar.

Math.pow(2,252) + 27742317777372353535851937790883648492 ==
1559614444 * Math.pow(2,8*4*0) + 
1477600026 * Math.pow(2,8*4*1) + 
2734136534 * Math.pow(2,8*4*2)  + 
350157278 * Math.pow(2,8*4*3)  + 
0 * Math.pow(2,8*4*4)  + 
0 * Math.pow(2,8*4*5)  + 
0 * Math.pow(2,8*4*6)  + 
268435456 * Math.pow(2,8*4*7)