Merge pull request #307 from ocheron/p256-b64
Add 64-bit implementation for P256
This commit is contained in:
Vincent Hanquez
GitHub
commit
be517c9273
@ -40,6 +40,11 @@ extern "C" {
|
||||
#define P256_NDIGITS 8
|
||||
#define P256_NBYTES 32
|
||||
|
||||
// n' such as n * n' = -1 mod (2^32)
|
||||
#define P256_MONTGOMERY_FACTOR 0xEE00BC4F
|
||||
|
||||
#define P256_LITERAL(lo,hi) (lo), (hi)
|
||||
|
||||
typedef int cryptonite_p256_err;
|
||||
typedef uint32_t cryptonite_p256_digit;
|
||||
typedef int32_t cryptonite_p256_sdigit;
|
||||
779
cbits/include32/p256/p256_gf.h
Normal file
779
cbits/include32/p256/p256_gf.h
Normal file
@ -0,0 +1,779 @@
|
||||
/*
|
||||
* Copyright 2013 The Android Open Source Project
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* * Neither the name of Google Inc. nor the names of its contributors may
|
||||
* be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
||||
* EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
||||
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 finite field. It's written to be
|
||||
// portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
//
|
||||
// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include "p256/p256.h"
|
||||
|
||||
typedef uint8_t u8;
|
||||
typedef uint32_t u32;
|
||||
typedef int32_t s32;
|
||||
typedef uint64_t u64;
|
||||
|
||||
/* Our field elements are represented as nine 32-bit limbs.
|
||||
*
|
||||
* The value of an felem (field element) is:
|
||||
* x[0] + (x[1] * 2**29) + (x[2] * 2**57) + ... + (x[8] * 2**228)
|
||||
*
|
||||
* That is, each limb is alternately 29 or 28-bits wide in little-endian
|
||||
* order.
|
||||
*
|
||||
* This means that an felem hits 2**257, rather than 2**256 as we would like. A
|
||||
* 28, 29, ... pattern would cause us to hit 2**256, but that causes problems
|
||||
* when multiplying as terms end up one bit short of a limb which would require
|
||||
* much bit-shifting to correct.
|
||||
*
|
||||
* Finally, the values stored in an felem are in Montgomery form. So the value
|
||||
* |y| is stored as (y*R) mod p, where p is the P-256 prime and R is 2**257.
|
||||
*/
|
||||
typedef u32 limb;
|
||||
#define NLIMBS 9
|
||||
typedef limb felem[NLIMBS];
|
||||
|
||||
static const limb kBottom28Bits = 0xfffffff;
|
||||
static const limb kBottom29Bits = 0x1fffffff;
|
||||
|
||||
/* kOne is the number 1 as an felem. It's 2**257 mod p split up into 29 and
|
||||
* 28-bit words. */
|
||||
static const felem kOne = {
|
||||
2, 0, 0, 0xffff800,
|
||||
0x1fffffff, 0xfffffff, 0x1fbfffff, 0x1ffffff,
|
||||
0
|
||||
};
|
||||
static const felem kZero = {0};
|
||||
static const felem kP = {
|
||||
0x1fffffff, 0xfffffff, 0x1fffffff, 0x3ff,
|
||||
0, 0, 0x200000, 0xf000000,
|
||||
0xfffffff
|
||||
};
|
||||
static const felem k2P = {
|
||||
0x1ffffffe, 0xfffffff, 0x1fffffff, 0x7ff,
|
||||
0, 0, 0x400000, 0xe000000,
|
||||
0x1fffffff
|
||||
};
|
||||
/* kPrecomputed contains precomputed values to aid the calculation of scalar
|
||||
* multiples of the base point, G. It's actually two, equal length, tables
|
||||
* concatenated.
|
||||
*
|
||||
* The first table contains (x,y) felem pairs for 16 multiples of the base
|
||||
* point, G.
|
||||
*
|
||||
* Index | Index (binary) | Value
|
||||
* 0 | 0000 | 0G (all zeros, omitted)
|
||||
* 1 | 0001 | G
|
||||
* 2 | 0010 | 2**64G
|
||||
* 3 | 0011 | 2**64G + G
|
||||
* 4 | 0100 | 2**128G
|
||||
* 5 | 0101 | 2**128G + G
|
||||
* 6 | 0110 | 2**128G + 2**64G
|
||||
* 7 | 0111 | 2**128G + 2**64G + G
|
||||
* 8 | 1000 | 2**192G
|
||||
* 9 | 1001 | 2**192G + G
|
||||
* 10 | 1010 | 2**192G + 2**64G
|
||||
* 11 | 1011 | 2**192G + 2**64G + G
|
||||
* 12 | 1100 | 2**192G + 2**128G
|
||||
* 13 | 1101 | 2**192G + 2**128G + G
|
||||
* 14 | 1110 | 2**192G + 2**128G + 2**64G
|
||||
* 15 | 1111 | 2**192G + 2**128G + 2**64G + G
|
||||
*
|
||||
* The second table follows the same style, but the terms are 2**32G,
|
||||
* 2**96G, 2**160G, 2**224G.
|
||||
*
|
||||
* This is ~2KB of data. */
|
||||
static const limb kPrecomputed[NLIMBS * 2 * 15 * 2] = {
|
||||
0x11522878, 0xe730d41, 0xdb60179, 0x4afe2ff, 0x12883add, 0xcaddd88, 0x119e7edc, 0xd4a6eab, 0x3120bee,
|
||||
0x1d2aac15, 0xf25357c, 0x19e45cdd, 0x5c721d0, 0x1992c5a5, 0xa237487, 0x154ba21, 0x14b10bb, 0xae3fe3,
|
||||
0xd41a576, 0x922fc51, 0x234994f, 0x60b60d3, 0x164586ae, 0xce95f18, 0x1fe49073, 0x3fa36cc, 0x5ebcd2c,
|
||||
0xb402f2f, 0x15c70bf, 0x1561925c, 0x5a26704, 0xda91e90, 0xcdc1c7f, 0x1ea12446, 0xe1ade1e, 0xec91f22,
|
||||
0x26f7778, 0x566847e, 0xa0bec9e, 0x234f453, 0x1a31f21a, 0xd85e75c, 0x56c7109, 0xa267a00, 0xb57c050,
|
||||
0x98fb57, 0xaa837cc, 0x60c0792, 0xcfa5e19, 0x61bab9e, 0x589e39b, 0xa324c5, 0x7d6dee7, 0x2976e4b,
|
||||
0x1fc4124a, 0xa8c244b, 0x1ce86762, 0xcd61c7e, 0x1831c8e0, 0x75774e1, 0x1d96a5a9, 0x843a649, 0xc3ab0fa,
|
||||
0x6e2e7d5, 0x7673a2a, 0x178b65e8, 0x4003e9b, 0x1a1f11c2, 0x7816ea, 0xf643e11, 0x58c43df, 0xf423fc2,
|
||||
0x19633ffa, 0x891f2b2, 0x123c231c, 0x46add8c, 0x54700dd, 0x59e2b17, 0x172db40f, 0x83e277d, 0xb0dd609,
|
||||
0xfd1da12, 0x35c6e52, 0x19ede20c, 0xd19e0c0, 0x97d0f40, 0xb015b19, 0x449e3f5, 0xe10c9e, 0x33ab581,
|
||||
0x56a67ab, 0x577734d, 0x1dddc062, 0xc57b10d, 0x149b39d, 0x26a9e7b, 0xc35df9f, 0x48764cd, 0x76dbcca,
|
||||
0xca4b366, 0xe9303ab, 0x1a7480e7, 0x57e9e81, 0x1e13eb50, 0xf466cf3, 0x6f16b20, 0x4ba3173, 0xc168c33,
|
||||
0x15cb5439, 0x6a38e11, 0x73658bd, 0xb29564f, 0x3f6dc5b, 0x53b97e, 0x1322c4c0, 0x65dd7ff, 0x3a1e4f6,
|
||||
0x14e614aa, 0x9246317, 0x1bc83aca, 0xad97eed, 0xd38ce4a, 0xf82b006, 0x341f077, 0xa6add89, 0x4894acd,
|
||||
0x9f162d5, 0xf8410ef, 0x1b266a56, 0xd7f223, 0x3e0cb92, 0xe39b672, 0x6a2901a, 0x69a8556, 0x7e7c0,
|
||||
0x9b7d8d3, 0x309a80, 0x1ad05f7f, 0xc2fb5dd, 0xcbfd41d, 0x9ceb638, 0x1051825c, 0xda0cf5b, 0x812e881,
|
||||
0x6f35669, 0x6a56f2c, 0x1df8d184, 0x345820, 0x1477d477, 0x1645db1, 0xbe80c51, 0xc22be3e, 0xe35e65a,
|
||||
0x1aeb7aa0, 0xc375315, 0xf67bc99, 0x7fdd7b9, 0x191fc1be, 0x61235d, 0x2c184e9, 0x1c5a839, 0x47a1e26,
|
||||
0xb7cb456, 0x93e225d, 0x14f3c6ed, 0xccc1ac9, 0x17fe37f3, 0x4988989, 0x1a90c502, 0x2f32042, 0xa17769b,
|
||||
0xafd8c7c, 0x8191c6e, 0x1dcdb237, 0x16200c0, 0x107b32a1, 0x66c08db, 0x10d06a02, 0x3fc93, 0x5620023,
|
||||
0x16722b27, 0x68b5c59, 0x270fcfc, 0xfad0ecc, 0xe5de1c2, 0xeab466b, 0x2fc513c, 0x407f75c, 0xbaab133,
|
||||
0x9705fe9, 0xb88b8e7, 0x734c993, 0x1e1ff8f, 0x19156970, 0xabd0f00, 0x10469ea7, 0x3293ac0, 0xcdc98aa,
|
||||
0x1d843fd, 0xe14bfe8, 0x15be825f, 0x8b5212, 0xeb3fb67, 0x81cbd29, 0xbc62f16, 0x2b6fcc7, 0xf5a4e29,
|
||||
0x13560b66, 0xc0b6ac2, 0x51ae690, 0xd41e271, 0xf3e9bd4, 0x1d70aab, 0x1029f72, 0x73e1c35, 0xee70fbc,
|
||||
0xad81baf, 0x9ecc49a, 0x86c741e, 0xfe6be30, 0x176752e7, 0x23d416, 0x1f83de85, 0x27de188, 0x66f70b8,
|
||||
0x181cd51f, 0x96b6e4c, 0x188f2335, 0xa5df759, 0x17a77eb6, 0xfeb0e73, 0x154ae914, 0x2f3ec51, 0x3826b59,
|
||||
0xb91f17d, 0x1c72949, 0x1362bf0a, 0xe23fddf, 0xa5614b0, 0xf7d8f, 0x79061, 0x823d9d2, 0x8213f39,
|
||||
0x1128ae0b, 0xd095d05, 0xb85c0c2, 0x1ecb2ef, 0x24ddc84, 0xe35e901, 0x18411a4a, 0xf5ddc3d, 0x3786689,
|
||||
0x52260e8, 0x5ae3564, 0x542b10d, 0x8d93a45, 0x19952aa4, 0x996cc41, 0x1051a729, 0x4be3499, 0x52b23aa,
|
||||
0x109f307e, 0x6f5b6bb, 0x1f84e1e7, 0x77a0cfa, 0x10c4df3f, 0x25a02ea, 0xb048035, 0xe31de66, 0xc6ecaa3,
|
||||
0x28ea335, 0x2886024, 0x1372f020, 0xf55d35, 0x15e4684c, 0xf2a9e17, 0x1a4a7529, 0xcb7beb1, 0xb2a78a1,
|
||||
0x1ab21f1f, 0x6361ccf, 0x6c9179d, 0xb135627, 0x1267b974, 0x4408bad, 0x1cbff658, 0xe3d6511, 0xc7d76f,
|
||||
0x1cc7a69, 0xe7ee31b, 0x54fab4f, 0x2b914f, 0x1ad27a30, 0xcd3579e, 0xc50124c, 0x50daa90, 0xb13f72,
|
||||
0xb06aa75, 0x70f5cc6, 0x1649e5aa, 0x84a5312, 0x329043c, 0x41c4011, 0x13d32411, 0xb04a838, 0xd760d2d,
|
||||
0x1713b532, 0xbaa0c03, 0x84022ab, 0x6bcf5c1, 0x2f45379, 0x18ae070, 0x18c9e11e, 0x20bca9a, 0x66f496b,
|
||||
0x3eef294, 0x67500d2, 0xd7f613c, 0x2dbbeb, 0xb741038, 0xe04133f, 0x1582968d, 0xbe985f7, 0x1acbc1a,
|
||||
0x1a6a939f, 0x33e50f6, 0xd665ed4, 0xb4b7bd6, 0x1e5a3799, 0x6b33847, 0x17fa56ff, 0x65ef930, 0x21dc4a,
|
||||
0x2b37659, 0x450fe17, 0xb357b65, 0xdf5efac, 0x15397bef, 0x9d35a7f, 0x112ac15f, 0x624e62e, 0xa90ae2f,
|
||||
0x107eecd2, 0x1f69bbe, 0x77d6bce, 0x5741394, 0x13c684fc, 0x950c910, 0x725522b, 0xdc78583, 0x40eeabb,
|
||||
0x1fde328a, 0xbd61d96, 0xd28c387, 0x9e77d89, 0x12550c40, 0x759cb7d, 0x367ef34, 0xae2a960, 0x91b8bdc,
|
||||
0x93462a9, 0xf469ef, 0xb2e9aef, 0xd2ca771, 0x54e1f42, 0x7aaa49, 0x6316abb, 0x2413c8e, 0x5425bf9,
|
||||
0x1bed3e3a, 0xf272274, 0x1f5e7326, 0x6416517, 0xea27072, 0x9cedea7, 0x6e7633, 0x7c91952, 0xd806dce,
|
||||
0x8e2a7e1, 0xe421e1a, 0x418c9e1, 0x1dbc890, 0x1b395c36, 0xa1dc175, 0x1dc4ef73, 0x8956f34, 0xe4b5cf2,
|
||||
0x1b0d3a18, 0x3194a36, 0x6c2641f, 0xe44124c, 0xa2f4eaa, 0xa8c25ba, 0xf927ed7, 0x627b614, 0x7371cca,
|
||||
0xba16694, 0x417bc03, 0x7c0a7e3, 0x9c35c19, 0x1168a205, 0x8b6b00d, 0x10e3edc9, 0x9c19bf2, 0x5882229,
|
||||
0x1b2b4162, 0xa5cef1a, 0x1543622b, 0x9bd433e, 0x364e04d, 0x7480792, 0x5c9b5b3, 0xe85ff25, 0x408ef57,
|
||||
0x1814cfa4, 0x121b41b, 0xd248a0f, 0x3b05222, 0x39bb16a, 0xc75966d, 0xa038113, 0xa4a1769, 0x11fbc6c,
|
||||
0x917e50e, 0xeec3da8, 0x169d6eac, 0x10c1699, 0xa416153, 0xf724912, 0x15cd60b7, 0x4acbad9, 0x5efc5fa,
|
||||
0xf150ed7, 0x122b51, 0x1104b40a, 0xcb7f442, 0xfbb28ff, 0x6ac53ca, 0x196142cc, 0x7bf0fa9, 0x957651,
|
||||
0x4e0f215, 0xed439f8, 0x3f46bd5, 0x5ace82f, 0x110916b6, 0x6db078, 0xffd7d57, 0xf2ecaac, 0xca86dec,
|
||||
0x15d6b2da, 0x965ecc9, 0x1c92b4c2, 0x1f3811, 0x1cb080f5, 0x2d8b804, 0x19d1c12d, 0xf20bd46, 0x1951fa7,
|
||||
0xa3656c3, 0x523a425, 0xfcd0692, 0xd44ddc8, 0x131f0f5b, 0xaf80e4a, 0xcd9fc74, 0x99bb618, 0x2db944c,
|
||||
0xa673090, 0x1c210e1, 0x178c8d23, 0x1474383, 0x10b8743d, 0x985a55b, 0x2e74779, 0x576138, 0x9587927,
|
||||
0x133130fa, 0xbe05516, 0x9f4d619, 0xbb62570, 0x99ec591, 0xd9468fe, 0x1d07782d, 0xfc72e0b, 0x701b298,
|
||||
0x1863863b, 0x85954b8, 0x121a0c36, 0x9e7fedf, 0xf64b429, 0x9b9d71e, 0x14e2f5d8, 0xf858d3a, 0x942eea8,
|
||||
0xda5b765, 0x6edafff, 0xa9d18cc, 0xc65e4ba, 0x1c747e86, 0xe4ea915, 0x1981d7a1, 0x8395659, 0x52ed4e2,
|
||||
0x87d43b7, 0x37ab11b, 0x19d292ce, 0xf8d4692, 0x18c3053f, 0x8863e13, 0x4c146c0, 0x6bdf55a, 0x4e4457d,
|
||||
0x16152289, 0xac78ec2, 0x1a59c5a2, 0x2028b97, 0x71c2d01, 0x295851f, 0x404747b, 0x878558d, 0x7d29aa4,
|
||||
0x13d8341f, 0x8daefd7, 0x139c972d, 0x6b7ea75, 0xd4a9dde, 0xff163d8, 0x81d55d7, 0xa5bef68, 0xb7b30d8,
|
||||
0xbe73d6f, 0xaa88141, 0xd976c81, 0x7e7a9cc, 0x18beb771, 0xd773cbd, 0x13f51951, 0x9d0c177, 0x1c49a78,
|
||||
};
|
||||
|
||||
|
||||
/* Field element operations: */
|
||||
|
||||
/* NON_ZERO_TO_ALL_ONES returns:
|
||||
* 0xffffffff for 0 < x <= 2**31
|
||||
* 0 for x == 0 or x > 2**31.
|
||||
*
|
||||
* x must be a u32 or an equivalent type such as limb. */
|
||||
#define NON_ZERO_TO_ALL_ONES(x) ((((u32)(x) - 1) >> 31) - 1)
|
||||
|
||||
/* felem_reduce_carry adds a multiple of p in order to cancel |carry|,
|
||||
* which is a term at 2**257.
|
||||
*
|
||||
* On entry: carry < 2**3, inout[0,2,...] < 2**29, inout[1,3,...] < 2**28.
|
||||
* On exit: inout[0,2,..] < 2**30, inout[1,3,...] < 2**29. */
|
||||
static void felem_reduce_carry(felem inout, limb carry) {
|
||||
const u32 carry_mask = NON_ZERO_TO_ALL_ONES(carry);
|
||||
|
||||
inout[0] += carry << 1;
|
||||
inout[3] += 0x10000000 & carry_mask;
|
||||
/* carry < 2**3 thus (carry << 11) < 2**14 and we added 2**28 in the
|
||||
* previous line therefore this doesn't underflow. */
|
||||
inout[3] -= carry << 11;
|
||||
inout[4] += (0x20000000 - 1) & carry_mask;
|
||||
inout[5] += (0x10000000 - 1) & carry_mask;
|
||||
inout[6] += (0x20000000 - 1) & carry_mask;
|
||||
inout[6] -= carry << 22;
|
||||
/* This may underflow if carry is non-zero but, if so, we'll fix it in the
|
||||
* next line. */
|
||||
inout[7] -= 1 & carry_mask;
|
||||
inout[7] += carry << 25;
|
||||
}
|
||||
|
||||
/* felem_sum sets out = in+in2.
|
||||
*
|
||||
* On entry, in[i]+in2[i] must not overflow a 32-bit word.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29 */
|
||||
static void felem_sum(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
#define two31m3 (((limb)1) << 31) - (((limb)1) << 3)
|
||||
#define two30m2 (((limb)1) << 30) - (((limb)1) << 2)
|
||||
#define two30p13m2 (((limb)1) << 30) + (((limb)1) << 13) - (((limb)1) << 2)
|
||||
#define two31m2 (((limb)1) << 31) - (((limb)1) << 2)
|
||||
#define two31p24m2 (((limb)1) << 31) + (((limb)1) << 24) - (((limb)1) << 2)
|
||||
#define two30m27m2 (((limb)1) << 30) - (((limb)1) << 27) - (((limb)1) << 2)
|
||||
|
||||
/* zero31 is 0 mod p. */
|
||||
static const felem zero31 = { two31m3, two30m2, two31m2, two30p13m2, two31m2, two30m2, two31p24m2, two30m27m2, two31m2 };
|
||||
|
||||
/* felem_diff sets out = in-in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29 and
|
||||
* in2[0,2,...] < 2**30, in2[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_diff(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero31[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero31[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_reduce_degree sets out = tmp/R mod p where tmp contains 64-bit words
|
||||
* with the same 29,28,... bit positions as an felem.
|
||||
*
|
||||
* The values in felems are in Montgomery form: x*R mod p where R = 2**257.
|
||||
* Since we just multiplied two Montgomery values together, the result is
|
||||
* x*y*R*R mod p. We wish to divide by R in order for the result also to be
|
||||
* in Montgomery form.
|
||||
*
|
||||
* On entry: tmp[i] < 2**64
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29 */
|
||||
static void felem_reduce_degree(felem out, u64 tmp[17]) {
|
||||
/* The following table may be helpful when reading this code:
|
||||
*
|
||||
* Limb number: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10...
|
||||
* Width (bits): 29| 28| 29| 28| 29| 28| 29| 28| 29| 28| 29
|
||||
* Start bit: 0 | 29| 57| 86|114|143|171|200|228|257|285
|
||||
* (odd phase): 0 | 28| 57| 85|114|142|171|199|228|256|285 */
|
||||
limb tmp2[18], carry, x, xMask;
|
||||
unsigned i;
|
||||
|
||||
/* tmp contains 64-bit words with the same 29,28,29-bit positions as an
|
||||
* felem. So the top of an element of tmp might overlap with another
|
||||
* element two positions down. The following loop eliminates this
|
||||
* overlap. */
|
||||
tmp2[0] = (limb)(tmp[0] & kBottom29Bits);
|
||||
|
||||
/* In the following we use "(limb) tmp[x]" and "(limb) (tmp[x]>>32)" to try
|
||||
* and hint to the compiler that it can do a single-word shift by selecting
|
||||
* the right register rather than doing a double-word shift and truncating
|
||||
* afterwards. */
|
||||
tmp2[1] = ((limb) tmp[0]) >> 29;
|
||||
tmp2[1] |= (((limb)(tmp[0] >> 32)) << 3) & kBottom28Bits;
|
||||
tmp2[1] += ((limb) tmp[1]) & kBottom28Bits;
|
||||
carry = tmp2[1] >> 28;
|
||||
tmp2[1] &= kBottom28Bits;
|
||||
|
||||
for (i = 2; i < 17; i++) {
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 32)) >> 25;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 28;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 32)) << 4) & kBottom29Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom29Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 29;
|
||||
tmp2[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == 17)
|
||||
break;
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 32)) >> 25;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 29;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 32)) << 3) & kBottom28Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom28Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 28;
|
||||
tmp2[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
tmp2[17] = ((limb)(tmp[15] >> 32)) >> 25;
|
||||
tmp2[17] += ((limb)(tmp[16])) >> 29;
|
||||
tmp2[17] += (((limb)(tmp[16] >> 32)) << 3);
|
||||
tmp2[17] += carry;
|
||||
|
||||
/* Montgomery elimination of terms.
|
||||
*
|
||||
* Since R is 2**257, we can divide by R with a bitwise shift if we can
|
||||
* ensure that the right-most 257 bits are all zero. We can make that true by
|
||||
* adding multiplies of p without affecting the value.
|
||||
*
|
||||
* So we eliminate limbs from right to left. Since the bottom 29 bits of p
|
||||
* are all ones, then by adding tmp2[0]*p to tmp2 we'll make tmp2[0] == 0.
|
||||
* We can do that for 8 further limbs and then right shift to eliminate the
|
||||
* extra factor of R. */
|
||||
for (i = 0;; i += 2) {
|
||||
tmp2[i + 1] += tmp2[i] >> 29;
|
||||
x = tmp2[i] & kBottom29Bits;
|
||||
xMask = NON_ZERO_TO_ALL_ONES(x);
|
||||
tmp2[i] = 0;
|
||||
|
||||
/* The bounds calculations for this loop are tricky. Each iteration of
|
||||
* the loop eliminates two words by adding values to words to their
|
||||
* right.
|
||||
*
|
||||
* The following table contains the amounts added to each word (as an
|
||||
* offset from the value of i at the top of the loop). The amounts are
|
||||
* accounted for from the first and second half of the loop separately
|
||||
* and are written as, for example, 28 to mean a value <2**28.
|
||||
*
|
||||
* Word: 3 4 5 6 7 8 9 10
|
||||
* Added in top half: 28 11 29 21 29 28
|
||||
* 28 29
|
||||
* 29
|
||||
* Added in bottom half: 29 10 28 21 28 28
|
||||
* 29
|
||||
*
|
||||
* The value that is currently offset 7 will be offset 5 for the next
|
||||
* iteration and then offset 3 for the iteration after that. Therefore
|
||||
* the total value added will be the values added at 7, 5 and 3.
|
||||
*
|
||||
* The following table accumulates these values. The sums at the bottom
|
||||
* are written as, for example, 29+28, to mean a value < 2**29+2**28.
|
||||
*
|
||||
* Word: 3 4 5 6 7 8 9 10 11 12 13
|
||||
* 28 11 10 29 21 29 28 28 28 28 28
|
||||
* 29 28 11 28 29 28 29 28 29 28
|
||||
* 29 28 21 21 29 21 29 21
|
||||
* 10 29 28 21 28 21 28
|
||||
* 28 29 28 29 28 29 28
|
||||
* 11 10 29 10 29 10
|
||||
* 29 28 11 28 11
|
||||
* 29 29
|
||||
* --------------------------------------------
|
||||
* 30+ 31+ 30+ 31+ 30+
|
||||
* 28+ 29+ 28+ 29+ 21+
|
||||
* 21+ 28+ 21+ 28+ 10
|
||||
* 10 21+ 10 21+
|
||||
* 11 11
|
||||
*
|
||||
* So the greatest amount is added to tmp2[10] and tmp2[12]. If
|
||||
* tmp2[10/12] has an initial value of <2**29, then the maximum value
|
||||
* will be < 2**31 + 2**30 + 2**28 + 2**21 + 2**11, which is < 2**32,
|
||||
* as required. */
|
||||
tmp2[i + 3] += (x << 10) & kBottom28Bits;
|
||||
tmp2[i + 4] += (x >> 18);
|
||||
|
||||
tmp2[i + 6] += (x << 21) & kBottom29Bits;
|
||||
tmp2[i + 7] += x >> 8;
|
||||
|
||||
/* At position 200, which is the starting bit position for word 7, we
|
||||
* have a factor of 0xf000000 = 2**28 - 2**24. */
|
||||
tmp2[i + 7] += 0x10000000 & xMask;
|
||||
/* Word 7 is 28 bits wide, so the 2**28 term exactly hits word 8. */
|
||||
tmp2[i + 8] += (x - 1) & xMask;
|
||||
tmp2[i + 7] -= (x << 24) & kBottom28Bits;
|
||||
tmp2[i + 8] -= x >> 4;
|
||||
|
||||
tmp2[i + 8] += 0x20000000 & xMask;
|
||||
tmp2[i + 8] -= x;
|
||||
tmp2[i + 8] += (x << 28) & kBottom29Bits;
|
||||
tmp2[i + 9] += ((x >> 1) - 1) & xMask;
|
||||
|
||||
if (i+1 == NLIMBS)
|
||||
break;
|
||||
tmp2[i + 2] += tmp2[i + 1] >> 28;
|
||||
x = tmp2[i + 1] & kBottom28Bits;
|
||||
xMask = NON_ZERO_TO_ALL_ONES(x);
|
||||
tmp2[i + 1] = 0;
|
||||
|
||||
tmp2[i + 4] += (x << 11) & kBottom29Bits;
|
||||
tmp2[i + 5] += (x >> 18);
|
||||
|
||||
tmp2[i + 7] += (x << 21) & kBottom28Bits;
|
||||
tmp2[i + 8] += x >> 7;
|
||||
|
||||
/* At position 199, which is the starting bit of the 8th word when
|
||||
* dealing with a context starting on an odd word, we have a factor of
|
||||
* 0x1e000000 = 2**29 - 2**25. Since we have not updated i, the 8th
|
||||
* word from i+1 is i+8. */
|
||||
tmp2[i + 8] += 0x20000000 & xMask;
|
||||
tmp2[i + 9] += (x - 1) & xMask;
|
||||
tmp2[i + 8] -= (x << 25) & kBottom29Bits;
|
||||
tmp2[i + 9] -= x >> 4;
|
||||
|
||||
tmp2[i + 9] += 0x10000000 & xMask;
|
||||
tmp2[i + 9] -= x;
|
||||
tmp2[i + 10] += (x - 1) & xMask;
|
||||
}
|
||||
|
||||
/* We merge the right shift with a carry chain. The words above 2**257 have
|
||||
* widths of 28,29,... which we need to correct when copying them down. */
|
||||
carry = 0;
|
||||
for (i = 0; i < 8; i++) {
|
||||
/* The maximum value of tmp2[i + 9] occurs on the first iteration and
|
||||
* is < 2**30+2**29+2**28. Adding 2**29 (from tmp2[i + 10]) is
|
||||
* therefore safe. */
|
||||
out[i] = tmp2[i + 9];
|
||||
out[i] += carry;
|
||||
out[i] += (tmp2[i + 10] << 28) & kBottom29Bits;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
out[i] = tmp2[i + 9] >> 1;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
out[8] = tmp2[17];
|
||||
out[8] += carry;
|
||||
carry = out[8] >> 29;
|
||||
out[8] &= kBottom29Bits;
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_square sets out=in*in.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_square(felem out, const felem in) {
|
||||
u64 tmp[17];
|
||||
|
||||
tmp[0] = ((u64) in[0]) * in[0];
|
||||
tmp[1] = ((u64) in[0]) * (in[1] << 1);
|
||||
tmp[2] = ((u64) in[0]) * (in[2] << 1) +
|
||||
((u64) in[1]) * (in[1] << 1);
|
||||
tmp[3] = ((u64) in[0]) * (in[3] << 1) +
|
||||
((u64) in[1]) * (in[2] << 1);
|
||||
tmp[4] = ((u64) in[0]) * (in[4] << 1) +
|
||||
((u64) in[1]) * (in[3] << 2) + ((u64) in[2]) * in[2];
|
||||
tmp[5] = ((u64) in[0]) * (in[5] << 1) + ((u64) in[1]) *
|
||||
(in[4] << 1) + ((u64) in[2]) * (in[3] << 1);
|
||||
tmp[6] = ((u64) in[0]) * (in[6] << 1) + ((u64) in[1]) *
|
||||
(in[5] << 2) + ((u64) in[2]) * (in[4] << 1) +
|
||||
((u64) in[3]) * (in[3] << 1);
|
||||
tmp[7] = ((u64) in[0]) * (in[7] << 1) + ((u64) in[1]) *
|
||||
(in[6] << 1) + ((u64) in[2]) * (in[5] << 1) +
|
||||
((u64) in[3]) * (in[4] << 1);
|
||||
/* tmp[8] has the greatest value of 2**61 + 2**60 + 2**61 + 2**60 + 2**60,
|
||||
* which is < 2**64 as required. */
|
||||
tmp[8] = ((u64) in[0]) * (in[8] << 1) + ((u64) in[1]) *
|
||||
(in[7] << 2) + ((u64) in[2]) * (in[6] << 1) +
|
||||
((u64) in[3]) * (in[5] << 2) + ((u64) in[4]) * in[4];
|
||||
tmp[9] = ((u64) in[1]) * (in[8] << 1) + ((u64) in[2]) *
|
||||
(in[7] << 1) + ((u64) in[3]) * (in[6] << 1) +
|
||||
((u64) in[4]) * (in[5] << 1);
|
||||
tmp[10] = ((u64) in[2]) * (in[8] << 1) + ((u64) in[3]) *
|
||||
(in[7] << 2) + ((u64) in[4]) * (in[6] << 1) +
|
||||
((u64) in[5]) * (in[5] << 1);
|
||||
tmp[11] = ((u64) in[3]) * (in[8] << 1) + ((u64) in[4]) *
|
||||
(in[7] << 1) + ((u64) in[5]) * (in[6] << 1);
|
||||
tmp[12] = ((u64) in[4]) * (in[8] << 1) +
|
||||
((u64) in[5]) * (in[7] << 2) + ((u64) in[6]) * in[6];
|
||||
tmp[13] = ((u64) in[5]) * (in[8] << 1) +
|
||||
((u64) in[6]) * (in[7] << 1);
|
||||
tmp[14] = ((u64) in[6]) * (in[8] << 1) +
|
||||
((u64) in[7]) * (in[7] << 1);
|
||||
tmp[15] = ((u64) in[7]) * (in[8] << 1);
|
||||
tmp[16] = ((u64) in[8]) * in[8];
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
/* felem_mul sets out=in*in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29 and
|
||||
* in2[0,2,...] < 2**30, in2[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_mul(felem out, const felem in, const felem in2) {
|
||||
u64 tmp[17];
|
||||
|
||||
tmp[0] = ((u64) in[0]) * in2[0];
|
||||
tmp[1] = ((u64) in[0]) * (in2[1] << 0) +
|
||||
((u64) in[1]) * (in2[0] << 0);
|
||||
tmp[2] = ((u64) in[0]) * (in2[2] << 0) + ((u64) in[1]) *
|
||||
(in2[1] << 1) + ((u64) in[2]) * (in2[0] << 0);
|
||||
tmp[3] = ((u64) in[0]) * (in2[3] << 0) + ((u64) in[1]) *
|
||||
(in2[2] << 0) + ((u64) in[2]) * (in2[1] << 0) +
|
||||
((u64) in[3]) * (in2[0] << 0);
|
||||
tmp[4] = ((u64) in[0]) * (in2[4] << 0) + ((u64) in[1]) *
|
||||
(in2[3] << 1) + ((u64) in[2]) * (in2[2] << 0) +
|
||||
((u64) in[3]) * (in2[1] << 1) +
|
||||
((u64) in[4]) * (in2[0] << 0);
|
||||
tmp[5] = ((u64) in[0]) * (in2[5] << 0) + ((u64) in[1]) *
|
||||
(in2[4] << 0) + ((u64) in[2]) * (in2[3] << 0) +
|
||||
((u64) in[3]) * (in2[2] << 0) + ((u64) in[4]) *
|
||||
(in2[1] << 0) + ((u64) in[5]) * (in2[0] << 0);
|
||||
tmp[6] = ((u64) in[0]) * (in2[6] << 0) + ((u64) in[1]) *
|
||||
(in2[5] << 1) + ((u64) in[2]) * (in2[4] << 0) +
|
||||
((u64) in[3]) * (in2[3] << 1) + ((u64) in[4]) *
|
||||
(in2[2] << 0) + ((u64) in[5]) * (in2[1] << 1) +
|
||||
((u64) in[6]) * (in2[0] << 0);
|
||||
tmp[7] = ((u64) in[0]) * (in2[7] << 0) + ((u64) in[1]) *
|
||||
(in2[6] << 0) + ((u64) in[2]) * (in2[5] << 0) +
|
||||
((u64) in[3]) * (in2[4] << 0) + ((u64) in[4]) *
|
||||
(in2[3] << 0) + ((u64) in[5]) * (in2[2] << 0) +
|
||||
((u64) in[6]) * (in2[1] << 0) +
|
||||
((u64) in[7]) * (in2[0] << 0);
|
||||
/* tmp[8] has the greatest value but doesn't overflow. See logic in
|
||||
* felem_square. */
|
||||
tmp[8] = ((u64) in[0]) * (in2[8] << 0) + ((u64) in[1]) *
|
||||
(in2[7] << 1) + ((u64) in[2]) * (in2[6] << 0) +
|
||||
((u64) in[3]) * (in2[5] << 1) + ((u64) in[4]) *
|
||||
(in2[4] << 0) + ((u64) in[5]) * (in2[3] << 1) +
|
||||
((u64) in[6]) * (in2[2] << 0) + ((u64) in[7]) *
|
||||
(in2[1] << 1) + ((u64) in[8]) * (in2[0] << 0);
|
||||
tmp[9] = ((u64) in[1]) * (in2[8] << 0) + ((u64) in[2]) *
|
||||
(in2[7] << 0) + ((u64) in[3]) * (in2[6] << 0) +
|
||||
((u64) in[4]) * (in2[5] << 0) + ((u64) in[5]) *
|
||||
(in2[4] << 0) + ((u64) in[6]) * (in2[3] << 0) +
|
||||
((u64) in[7]) * (in2[2] << 0) +
|
||||
((u64) in[8]) * (in2[1] << 0);
|
||||
tmp[10] = ((u64) in[2]) * (in2[8] << 0) + ((u64) in[3]) *
|
||||
(in2[7] << 1) + ((u64) in[4]) * (in2[6] << 0) +
|
||||
((u64) in[5]) * (in2[5] << 1) + ((u64) in[6]) *
|
||||
(in2[4] << 0) + ((u64) in[7]) * (in2[3] << 1) +
|
||||
((u64) in[8]) * (in2[2] << 0);
|
||||
tmp[11] = ((u64) in[3]) * (in2[8] << 0) + ((u64) in[4]) *
|
||||
(in2[7] << 0) + ((u64) in[5]) * (in2[6] << 0) +
|
||||
((u64) in[6]) * (in2[5] << 0) + ((u64) in[7]) *
|
||||
(in2[4] << 0) + ((u64) in[8]) * (in2[3] << 0);
|
||||
tmp[12] = ((u64) in[4]) * (in2[8] << 0) + ((u64) in[5]) *
|
||||
(in2[7] << 1) + ((u64) in[6]) * (in2[6] << 0) +
|
||||
((u64) in[7]) * (in2[5] << 1) +
|
||||
((u64) in[8]) * (in2[4] << 0);
|
||||
tmp[13] = ((u64) in[5]) * (in2[8] << 0) + ((u64) in[6]) *
|
||||
(in2[7] << 0) + ((u64) in[7]) * (in2[6] << 0) +
|
||||
((u64) in[8]) * (in2[5] << 0);
|
||||
tmp[14] = ((u64) in[6]) * (in2[8] << 0) + ((u64) in[7]) *
|
||||
(in2[7] << 1) + ((u64) in[8]) * (in2[6] << 0);
|
||||
tmp[15] = ((u64) in[7]) * (in2[8] << 0) +
|
||||
((u64) in[8]) * (in2[7] << 0);
|
||||
tmp[16] = ((u64) in[8]) * (in2[8] << 0);
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
static void felem_assign(felem out, const felem in) {
|
||||
memcpy(out, in, sizeof(felem));
|
||||
}
|
||||
|
||||
/* felem_scalar_3 sets out=3*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_scalar_3(felem out) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_4 sets out=4*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_scalar_4(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 27;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom29Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 29);
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 26;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom28Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 28);
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_8 sets out=8*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_scalar_8(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 26;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom29Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 29);
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 25;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom28Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 28);
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_is_zero_vartime returns 1 iff |in| == 0. It takes a variable amount of
|
||||
* time depending on the value of |in|. */
|
||||
static char felem_is_zero_vartime(const felem in) {
|
||||
limb carry;
|
||||
int i;
|
||||
limb tmp[NLIMBS];
|
||||
|
||||
felem_assign(tmp, in);
|
||||
|
||||
/* First, reduce tmp to a minimal form. */
|
||||
do {
|
||||
carry = 0;
|
||||
for (i = 0;; i++) {
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 29;
|
||||
tmp[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 28;
|
||||
tmp[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(tmp, carry);
|
||||
} while (carry);
|
||||
|
||||
/* tmp < 2**257, so the only possible zero values are 0, p and 2p. */
|
||||
return memcmp(tmp, kZero, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, kP, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, k2P, sizeof(tmp)) == 0;
|
||||
}
|
||||
|
||||
|
||||
/* Montgomery operations: */
|
||||
|
||||
#define kRDigits {2, 0, 0, 0xfffffffe, 0xffffffff, 0xffffffff, 0xfffffffd, 1} // 2^257 mod p256.p
|
||||
|
||||
#define kRInvDigits {0x80000000, 1, 0xffffffff, 0, 0x80000001, 0xfffffffe, 1, 0x7fffffff} // 1 / 2^257 mod p256.p
|
||||
|
||||
static const cryptonite_p256_int kR = { kRDigits };
|
||||
static const cryptonite_p256_int kRInv = { kRInvDigits };
|
||||
|
||||
/* to_montgomery sets out = R*in. */
|
||||
static void to_montgomery(felem out, const cryptonite_p256_int* in) {
|
||||
cryptonite_p256_int in_shifted;
|
||||
int i;
|
||||
|
||||
cryptonite_p256_init(&in_shifted);
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);
|
||||
|
||||
for (i = 0; i < NLIMBS; i++) {
|
||||
if ((i & 1) == 0) {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom29Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 29, &in_shifted);
|
||||
} else {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom28Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 28, &in_shifted);
|
||||
}
|
||||
}
|
||||
|
||||
cryptonite_p256_clear(&in_shifted);
|
||||
}
|
||||
|
||||
/* from_montgomery sets out=in/R. */
|
||||
static void from_montgomery(cryptonite_p256_int* out, const felem in) {
|
||||
cryptonite_p256_int result, tmp;
|
||||
int i, top;
|
||||
|
||||
cryptonite_p256_init(&result);
|
||||
cryptonite_p256_init(&tmp);
|
||||
|
||||
cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);
|
||||
for (i = NLIMBS - 2; i >= 0; i--) {
|
||||
if ((i & 1) == 0) {
|
||||
top = cryptonite_p256_shl(&result, 29, &tmp);
|
||||
} else {
|
||||
top = cryptonite_p256_shl(&result, 28, &tmp);
|
||||
}
|
||||
top |= cryptonite_p256_add_d(&tmp, in[i], &result);
|
||||
}
|
||||
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);
|
||||
|
||||
cryptonite_p256_clear(&result);
|
||||
cryptonite_p256_clear(&tmp);
|
||||
}
|
||||
167
cbits/include64/p256/p256.h
Normal file
167
cbits/include64/p256/p256.h
Normal file
@ -0,0 +1,167 @@
|
||||
/*
|
||||
* Copyright 2013 The Android Open Source Project
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* * Neither the name of Google Inc. nor the names of its contributors may
|
||||
* be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
||||
* EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
||||
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#ifndef SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_
|
||||
#define SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_
|
||||
|
||||
// Collection of routines manipulating 256 bit unsigned integers.
|
||||
// Just enough to implement ecdsa-p256 and related algorithms.
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#define P256_BITSPERDIGIT 64
|
||||
#define P256_NDIGITS 4
|
||||
#define P256_NBYTES 32
|
||||
|
||||
// n' such as n * n' = -1 mod (2^64)
|
||||
#define P256_MONTGOMERY_FACTOR 0xCCD1C8AAEE00BC4F
|
||||
|
||||
#define P256_LITERAL(lo,hi) (((uint32_t) (lo)) + (((uint64_t) (hi)) << 32))
|
||||
|
||||
typedef int cryptonite_p256_err;
|
||||
typedef uint64_t cryptonite_p256_digit;
|
||||
typedef int64_t cryptonite_p256_sdigit;
|
||||
typedef __uint128_t cryptonite_p256_ddigit;
|
||||
typedef __int128_t cryptonite_p256_sddigit;
|
||||
|
||||
// Defining cryptonite_p256_int as struct to leverage struct assigment.
|
||||
typedef struct {
|
||||
cryptonite_p256_digit a[P256_NDIGITS];
|
||||
} cryptonite_p256_int;
|
||||
|
||||
extern const cryptonite_p256_int cryptonite_SECP256r1_n; // Curve order
|
||||
extern const cryptonite_p256_int cryptonite_SECP256r1_p; // Curve prime
|
||||
extern const cryptonite_p256_int cryptonite_SECP256r1_b; // Curve param
|
||||
|
||||
// Initialize a cryptonite_p256_int to zero.
|
||||
void cryptonite_p256_init(cryptonite_p256_int* a);
|
||||
|
||||
// Clear a cryptonite_p256_int to zero.
|
||||
void cryptonite_p256_clear(cryptonite_p256_int* a);
|
||||
|
||||
// Return bit. Index 0 is least significant.
|
||||
int cryptonite_p256_get_bit(const cryptonite_p256_int* a, int index);
|
||||
|
||||
// b := a % MOD
|
||||
void cryptonite_p256_mod(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
cryptonite_p256_int* b);
|
||||
|
||||
// c := a * (top_b | b) % MOD
|
||||
void cryptonite_p256_modmul(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
const cryptonite_p256_digit top_b,
|
||||
const cryptonite_p256_int* b,
|
||||
cryptonite_p256_int* c);
|
||||
|
||||
// b := 1 / a % MOD
|
||||
// MOD best be SECP256r1_n
|
||||
void cryptonite_p256_modinv(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
cryptonite_p256_int* b);
|
||||
|
||||
// b := 1 / a % MOD
|
||||
// MOD best be SECP256r1_n
|
||||
// Faster than cryptonite_p256_modinv()
|
||||
void cryptonite_p256_modinv_vartime(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
cryptonite_p256_int* b);
|
||||
|
||||
// b := a << (n % P256_BITSPERDIGIT)
|
||||
// Returns the bits shifted out of most significant digit.
|
||||
cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
|
||||
|
||||
// b := a >> (n % P256_BITSPERDIGIT)
|
||||
void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
|
||||
|
||||
int cryptonite_p256_is_zero(const cryptonite_p256_int* a);
|
||||
int cryptonite_p256_is_odd(const cryptonite_p256_int* a);
|
||||
int cryptonite_p256_is_even(const cryptonite_p256_int* a);
|
||||
|
||||
// Returns -1, 0 or 1.
|
||||
int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int *b);
|
||||
|
||||
// c: = a - b
|
||||
// Returns -1 on borrow.
|
||||
int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
|
||||
|
||||
// c := a + b
|
||||
// Returns 1 on carry.
|
||||
int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
|
||||
|
||||
// c := a + (single digit)b
|
||||
// Returns carry 1 on carry.
|
||||
int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit b, cryptonite_p256_int* c);
|
||||
|
||||
// ec routines.
|
||||
|
||||
// {out_x,out_y} := nG
|
||||
void cryptonite_p256_base_point_mul(const cryptonite_p256_int *n,
|
||||
cryptonite_p256_int *out_x,
|
||||
cryptonite_p256_int *out_y);
|
||||
|
||||
// {out_x,out_y} := n{in_x,in_y}
|
||||
void cryptonite_p256_point_mul(const cryptonite_p256_int *n,
|
||||
const cryptonite_p256_int *in_x,
|
||||
const cryptonite_p256_int *in_y,
|
||||
cryptonite_p256_int *out_x,
|
||||
cryptonite_p256_int *out_y);
|
||||
|
||||
// {out_x,out_y} := n1G + n2{in_x,in_y}
|
||||
void cryptonite_p256_points_mul_vartime(
|
||||
const cryptonite_p256_int *n1, const cryptonite_p256_int *n2,
|
||||
const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,
|
||||
cryptonite_p256_int *out_x, cryptonite_p256_int *out_y);
|
||||
|
||||
// Return whether point {x,y} is on curve.
|
||||
int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y);
|
||||
|
||||
// Outputs big-endian binary form. No leading zero skips.
|
||||
void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES]);
|
||||
|
||||
// Reads from big-endian binary form,
|
||||
// thus pre-pad with leading zeros if short.
|
||||
void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst);
|
||||
|
||||
#define P256_DIGITS(x) ((x)->a)
|
||||
#define P256_DIGIT(x,y) ((x)->a[y])
|
||||
|
||||
#define P256_ZERO {{0}}
|
||||
#define P256_ONE {{1}}
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_
|
||||
713
cbits/include64/p256/p256_gf.h
Normal file
713
cbits/include64/p256/p256_gf.h
Normal file
@ -0,0 +1,713 @@
|
||||
/*
|
||||
* Copyright 2013 The Android Open Source Project
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* * Neither the name of Google Inc. nor the names of its contributors may
|
||||
* be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
||||
* EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
||||
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 finite field. It's written to be
|
||||
// portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
//
|
||||
// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include "p256/p256.h"
|
||||
|
||||
typedef uint8_t u8;
|
||||
typedef uint32_t u32;
|
||||
typedef uint64_t u64;
|
||||
typedef int64_t s64;
|
||||
typedef __uint128_t u128;
|
||||
|
||||
/* Our field elements are represented as five 64-bit limbs.
|
||||
*
|
||||
* The value of an felem (field element) is:
|
||||
* x[0] + (x[1] * 2**51) + (x[2] * 2**103) + ... + (x[4] * 2**206)
|
||||
*
|
||||
* That is, each limb is alternately 51 or 52-bits wide in little-endian
|
||||
* order.
|
||||
*
|
||||
* This means that an felem hits 2**257, rather than 2**256 as we would like.
|
||||
*
|
||||
* Finally, the values stored in an felem are in Montgomery form. So the value
|
||||
* |y| is stored as (y*R) mod p, where p is the P-256 prime and R is 2**257.
|
||||
*/
|
||||
typedef u64 limb;
|
||||
#define NLIMBS 5
|
||||
typedef limb felem[NLIMBS];
|
||||
|
||||
static const limb kBottom51Bits = 0x7ffffffffffff;
|
||||
static const limb kBottom52Bits = 0xfffffffffffff;
|
||||
|
||||
/* kOne is the number 1 as an felem. It's 2**257 mod p split up into 51 and
|
||||
* 52-bit words. */
|
||||
static const felem kOne = {
|
||||
2, 0xfc00000000000, 0x7ffffffffffff, 0xfff7fffffffff, 0x7ffff
|
||||
};
|
||||
static const felem kZero = {0};
|
||||
static const felem kP = {
|
||||
0x7ffffffffffff, 0x1fffffffffff, 0, 0x4000000000, 0x3fffffffc0000
|
||||
};
|
||||
static const felem k2P = {
|
||||
0x7fffffffffffe, 0x3fffffffffff, 0, 0x8000000000, 0x7fffffff80000
|
||||
};
|
||||
/* kPrecomputed contains precomputed values to aid the calculation of scalar
|
||||
* multiples of the base point, G. It's actually two, equal length, tables
|
||||
* concatenated.
|
||||
*
|
||||
* The first table contains (x,y) felem pairs for 16 multiples of the base
|
||||
* point, G.
|
||||
*
|
||||
* Index | Index (binary) | Value
|
||||
* 0 | 0000 | 0G (all zeros, omitted)
|
||||
* 1 | 0001 | G
|
||||
* 2 | 0010 | 2**64G
|
||||
* 3 | 0011 | 2**64G + G
|
||||
* 4 | 0100 | 2**128G
|
||||
* 5 | 0101 | 2**128G + G
|
||||
* 6 | 0110 | 2**128G + 2**64G
|
||||
* 7 | 0111 | 2**128G + 2**64G + G
|
||||
* 8 | 1000 | 2**192G
|
||||
* 9 | 1001 | 2**192G + G
|
||||
* 10 | 1010 | 2**192G + 2**64G
|
||||
* 11 | 1011 | 2**192G + 2**64G + G
|
||||
* 12 | 1100 | 2**192G + 2**128G
|
||||
* 13 | 1101 | 2**192G + 2**128G + G
|
||||
* 14 | 1110 | 2**192G + 2**128G + 2**64G
|
||||
* 15 | 1111 | 2**192G + 2**128G + 2**64G + G
|
||||
*
|
||||
* The second table follows the same style, but the terms are 2**32G,
|
||||
* 2**96G, 2**160G, 2**224G.
|
||||
*
|
||||
* This is ~2KB of data. */
|
||||
static const limb kPrecomputed[NLIMBS * 2 * 15 * 2] = {
|
||||
0x661a831522878, 0xf17fb6d805e79, 0x5889441d6ea57, 0xae33cfdb995bb, 0xc482fbb529ba,
|
||||
0x4a6af9d2aac15, 0x90e867917377c, 0x487cc962d2ae3, 0xec2a97443446e, 0x2b8ff8c52c42,
|
||||
0x45f8a2d41a576, 0xb06988d2653e4, 0x718b22c357305, 0x33fc920e79d2b, 0x17af34b0fe8db,
|
||||
0x38e17eb402f2f, 0x3382558649705, 0x47f6d48f482d1, 0x7bd42488d9b83, 0x3b247c8b86b78,
|
||||
0x4d08fc26f7778, 0x7a29a82fb2795, 0x75cd18f90d11a, 0xad8e213b0bc, 0x2d5f0142899e8,
|
||||
0x506f98098fb57, 0x2f0c98301e4aa, 0x39b30dd5cf67d, 0x9c146498ab13c, 0xa5db92df5b7b,
|
||||
0x184897fc4124a, 0xe3f73a19d8aa, 0x4e1c18e47066b, 0x27b2d4b52eaee, 0x30eac3ea10e99,
|
||||
0x4e74546e2e7d5, 0x1f4dde2d97a1d, 0x6ead0f88e1200, 0x7dec87c220f02, 0x3d08ff096310f,
|
||||
0x23e5659633ffa, 0x6ec648f08c722, 0x3172a3806ea35, 0xf6e5b681eb3c5, 0x2c3758260f89d,
|
||||
0x38dca4fd1da12, 0xf06067b78830d, 0x3194be87a068c, 0x78893c7eb602b, 0xcead60438432,
|
||||
0x6ee69a56a67ab, 0xd886f77701895, 0x67b0a4d9cee2b, 0x3586bbf3e4d53, 0x1db6f32921d93,
|
||||
0x260756ca4b366, 0x4f40e9d2039fa, 0x4f3f09f5a82bf, 0xccde2d641e8cd, 0x305a30cd2e8c5,
|
||||
0x471c235cb5439, 0xab279cd962f5a, 0x17e1fb6e2dd94, 0xfe64589800a77, 0xe8793d99775f,
|
||||
0x48c62f4e614aa, 0xbf76ef20eb2a4, 0x669c672556c, 0x24683e0eff056, 0x12252b369ab76,
|
||||
0x821de9f162d5, 0xf911ec99a95be, 0x6721f065c906b, 0x58d452035c736, 0x1f9f01a6a15,
|
||||
0x6135009b7d8d3, 0xdaeeeb417dfc0, 0x63865fea0ee17, 0x6e0a304b939d6, 0x204ba2076833d,
|
||||
0x4ade586f35669, 0x2c1077e34611a, 0x5b1a3bea3b81a, 0xf97d018a22c8b, 0x38d7996b08af8,
|
||||
0x6ea62baeb7aa0, 0xebdcbd9ef2670, 0x35dc8fe0df3fe, 0xe458309d20c24, 0x11e87898716a0,
|
||||
0x7c44bab7cb456, 0xd64d3cf1bb64, 0x189bff1bf9e66, 0xb5218a049311, 0x285dda6cbcc81,
|
||||
0x3238dcafd8c7c, 0x607736c8de0, 0xdb83d99508b1, 0x4e1a0d404cd81, 0x1588008c00ff2,
|
||||
0x16b8b36722b27, 0x876609c3f3f1a, 0x66b72ef0e17d6, 0x705f8a279d568, 0x2eaac4cd01fdd,
|
||||
0x1171ce9705fe9, 0xffc79cd3264ee, 0x700c8ab4b80f0, 0x208d3d4f57a1, 0x337262a8ca4eb,
|
||||
0x297fd01d843fd, 0xa90956fa097f8, 0x529759fdb3845, 0x1d78c5e2d0397, 0x3d6938a4adbf3,
|
||||
0x16d5853560b66, 0xf138946b9a430, 0x2ab79f4dea6a0, 0xd42053ee43ae1, 0x3b9c3ef1cf870,
|
||||
0x598934ad81baf, 0x5f1821b1d07a7, 0x416bb3a973ff3, 0x23f07bd0a047a, 0x19bdc2e09f786,
|
||||
0x56dc9981cd51f, 0xfbace23c8cd65, 0x673bd3bf5b52e, 0x46a95d229fd61, 0xe09ad64bcfb1,
|
||||
0xe5292b91f17d, 0xfeefcd8afc287, 0x58f52b0a58711, 0x4800f20c201ef, 0x2084fce608f67,
|
||||
0x12ba0b128ae0b, 0x5977ae17030b4, 0x101126ee420f6, 0xf70823495c6bd, 0xde19a27d7770,
|
||||
0x5c6ac852260e8, 0x9d22950ac4356, 0x441cca955246c, 0x660a34e5332d9, 0x14ac8ea92f8d2,
|
||||
0x6b6d7709f307e, 0x67d7e13879db, 0x2ea8626f9fbbd, 0x99609006a4b40, 0x31bb2a8f8c779,
|
||||
0x10c04828ea335, 0xae9acdcbc080a, 0x617af2342607a, 0xc7494ea53e553, 0x2ca9e2872defa,
|
||||
0x6c399fab21f1f, 0xab139b245e758, 0x3ad933dcba589, 0x4797fecb08811, 0x31f5dbf8f594,
|
||||
0x7dc6361cc7a69, 0xc8a7953ead3f9, 0x79ed693d18015, 0x418a024999a6a, 0x2c4fdc9436aa,
|
||||
0x1eb98cb06aa75, 0x2989592796a9c, 0x11194821e425, 0xe27a648228388, 0x35d834b6c12a0,
|
||||
0x541807713b532, 0x7ae0a1008aaee, 0x7017a29bcb5e, 0x6b193c23c315c, 0x19bd25ac82f2a,
|
||||
0x6a01a43eef294, 0xddf5b5fd84f19, 0x33f5ba081c016, 0xdeb052d1bc082, 0x6b2f06afa617,
|
||||
0x7ca1eda6a939f, 0xbdeb35997b50c, 0x47f2d1bccda5, 0xc2ff4adfed667, 0x87712997be4,
|
||||
0x21fc2e2b37659, 0xf7d62cd5ed951, 0x27fa9cbdf7efa, 0xba25582bf3a6b, 0x2a42b8bd89398,
|
||||
0x6d377d07eecd2, 0x9ca1df5af387, 0x1109e3427e2ba, 0xce4aa4572a19, 0x103baaef71e16,
|
||||
0x2c3b2dfde328a, 0xbec4b4a30e1ef, 0x37d92a86204f3, 0x806cfde68eb39, 0x246e2f72b8aa5,
|
||||
0x68d3de93462a9, 0x53b8acba6bbc3, 0x2492a70fa1696, 0x38c62d5760f55, 0x15096fe4904f2,
|
||||
0x4e44e9bed3e3a, 0xb28bfd79cc9bc, 0x6a77513839320, 0x480dcec6739db, 0x3601b739f2465,
|
||||
0x43c348e2a7e1, 0xe448106327879, 0x175d9cae1b0ed, 0xd3b89dee743b8, 0x392d73ca255bc,
|
||||
0x32946db0d3a18, 0x9261b09907cc, 0x5ba517a755722, 0x51f24fdaf5184, 0x1cdc732989ed8,
|
||||
0x2f7806ba16694, 0xae0c9f029f8d0, 0xd8b45102ce1, 0xca1c7db9316d6, 0x162088a67066f,
|
||||
0x39de35b2b4162, 0xa19f550d88ae9, 0x7921b27026cde, 0x94b936b66e900, 0x1023bd5fa17fc,
|
||||
0x436837814cfa4, 0x29113492283c4, 0x66d1cdd8b51d8, 0xa540702278eb2, 0x47ef1b29285d,
|
||||
0x587b50917e50e, 0xb4cda75bab3b, 0x112520b0a9886, 0x66b9ac16fee49, 0x17bf17e92b2eb,
|
||||
0x2456a2f150ed7, 0xfa214412d0280, 0x3ca7dd947fe5b, 0xa72c28598d58a, 0x255d945efc3e,
|
||||
0x2873f04e0f215, 0x74178fd1af57b, 0x788848b5b2d6, 0xb1ffafaae0db6, 0x32a1b7b3cbb2a,
|
||||
0x4bd9935d6b2da, 0x9c08f24ad30a5, 0x4e58407a80f, 0x1b3a3825a5b17, 0x6547e9fc82f5,
|
||||
0x47484aa3656c3, 0x6ee43f341a494, 0x64a98f87adea2, 0x619b3f8e95f01, 0xb6e513266ed8,
|
||||
0x421c2a673090, 0xa1c1de32348c7, 0x55b85c3a1e8a3, 0xe05ce8ef330b4, 0x2561e49c15d84,
|
||||
0x40aa2d33130fa, 0x12b827d35866f, 0xfe4cf62c8ddb, 0x2fa0ef05bb28d, 0x1c06ca63f1cb8,
|
||||
0x32a971863863b, 0xff6fc86830da1, 0x71e7b25a14cf3, 0xea9c5ebb1373a, 0x250bbaa3e1634,
|
||||
0x5b5ffeda5b765, 0xf25d2a746331b, 0x115e3a3f43632, 0x67303af43c9d5, 0x14bb538a0e559,
|
||||
0x75623687d43b7, 0xa349674a4b38d, 0x613c61829ffc6, 0x689828d8110c7, 0x139115f5af7d5,
|
||||
0xf1d856152289, 0x45cbe967168ab, 0x51f38e1680901, 0x34808e8f652b0, 0x1f4a6a921e156,
|
||||
0x35dfaf3d8341f, 0xf53ace725cb63, 0x3d86a54eef35b, 0xa103aabaffe2c, 0x2decc36296fbd,
|
||||
0x510282be73d6f, 0xd4e6365db206a, 0x4bdc5f5bb8bf3, 0xde7ea32a3aee7, 0x71269e274305,
|
||||
};
|
||||
|
||||
|
||||
/* Field element operations: */
|
||||
|
||||
/* NON_ZERO_TO_ALL_ONES returns:
|
||||
* 0xffffffffffffffff for 0 < x <= 2**63
|
||||
* 0 for x == 0 or x > 2**63.
|
||||
*
|
||||
* x must be a u64 or an equivalent type such as limb. */
|
||||
#define NON_ZERO_TO_ALL_ONES(x) ((((u64)(x) - 1) >> 63) - 1)
|
||||
|
||||
/* felem_reduce_carry adds a multiple of p in order to cancel |carry|,
|
||||
* which is a term at 2**257.
|
||||
*
|
||||
* On entry: carry < 2**6, inout[0,2,...] < 2**51, inout[1,3,...] < 2**52.
|
||||
* On exit: inout[0,2,..] < 2**52, inout[1,3,...] < 2**53. */
|
||||
static void felem_reduce_carry(felem inout, limb carry) {
|
||||
const u64 carry_mask = NON_ZERO_TO_ALL_ONES(carry);
|
||||
|
||||
inout[0] += carry << 1;
|
||||
inout[1] += 0x10000000000000 & carry_mask;
|
||||
/* carry < 2**6 thus (carry << 46) < 2**52 and we added 2**52 in the
|
||||
* previous line therefore this doesn't underflow. */
|
||||
inout[1] -= carry << 46;
|
||||
inout[2] += (0x8000000000000 - 1) & carry_mask;
|
||||
inout[3] += (0x10000000000000 - 1) & carry_mask;
|
||||
inout[3] -= carry << 39;
|
||||
/* This may underflow if carry is non-zero but, if so, we'll fix it in the
|
||||
* next line. */
|
||||
inout[4] -= 1 & carry_mask;
|
||||
inout[4] += carry << 19;
|
||||
}
|
||||
|
||||
/* felem_sum sets out = in+in2.
|
||||
*
|
||||
* On entry, in[i]+in2[i] must not overflow a 64-bit word.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53 */
|
||||
static void felem_sum(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
#define two53m3 (((limb)1) << 53) - (((limb)1) << 3)
|
||||
#define two54m52p48m2 (((limb)1) << 54) - (((limb)1) << 52) + (((limb)1) << 48) - (((limb)1) << 2)
|
||||
#define two53m2p0 (((limb)1) << 53) - (((limb)1) << 2) + (((limb)1) << 0)
|
||||
#define two54m52p41m2 (((limb)1) << 54) - (((limb)1) << 52) + (((limb)1) << 41) - (((limb)1) << 2)
|
||||
#define two53m21m2p0 (((limb)1) << 53) - (((limb)1) << 21) - (((limb)1) << 2) + (((limb)1) << 0)
|
||||
|
||||
/* zero53 is 0 mod p. */
|
||||
static const felem zero53 = { two53m3, two54m52p48m2, two53m2p0, two54m52p41m2, two53m21m2p0 };
|
||||
|
||||
/* felem_diff sets out = in-in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**52, in[1,3,...] < 2**53 and
|
||||
* in2[0,2,...] < 2**52, in2[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_diff(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero53[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero53[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_reduce_degree sets out = tmp/R mod p where tmp contains 64-bit words
|
||||
* with the same 51,52,... bit positions as an felem.
|
||||
*
|
||||
* The values in felems are in Montgomery form: x*R mod p where R = 2**257.
|
||||
* Since we just multiplied two Montgomery values together, the result is
|
||||
* x*y*R*R mod p. We wish to divide by R in order for the result also to be
|
||||
* in Montgomery form.
|
||||
*
|
||||
* On entry: tmp[i] < 2**128
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53 */
|
||||
static void felem_reduce_degree(felem out, u128 tmp[9]) {
|
||||
/* The following table may be helpful when reading this code:
|
||||
*
|
||||
* Limb number: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10
|
||||
* Width (bits): 51| 52| 51| 52| 51| 52| 51| 52| 51| 52| 51
|
||||
* Start bit: 0 | 51|103|154|206|257|309|360|412|463|515
|
||||
* (odd phase): 0 | 52|103|155|206|258|309|361|412|464|515 */
|
||||
limb tmp2[10], carry, x, xShiftedMask;
|
||||
unsigned i;
|
||||
|
||||
/* tmp contains 128-bit words with the same 51,52,51-bit positions as an
|
||||
* felem. So the top of an element of tmp might overlap with another
|
||||
* element two positions down. The following loop eliminates this
|
||||
* overlap. */
|
||||
tmp2[0] = (limb)(tmp[0] & kBottom51Bits);
|
||||
|
||||
/* In the following we use "(limb) tmp[x]" and "(limb) (tmp[x]>>64)" to try
|
||||
* and hint to the compiler that it can do a single-word shift by selecting
|
||||
* the right register rather than doing a double-word shift and truncating
|
||||
* afterwards. */
|
||||
tmp2[1] = ((limb) tmp[0]) >> 51;
|
||||
tmp2[1] |= (((limb)(tmp[0] >> 64)) << 13) & kBottom52Bits;
|
||||
tmp2[1] += ((limb) tmp[1]) & kBottom52Bits;
|
||||
carry = tmp2[1] >> 52;
|
||||
tmp2[1] &= kBottom52Bits;
|
||||
|
||||
for (i = 2; i < 9; i++) {
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 64)) >> 39;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 52;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 64)) << 12) & kBottom51Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom51Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 51;
|
||||
tmp2[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == 9)
|
||||
break;
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 64)) >> 39;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 51;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 64)) << 13) & kBottom52Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom52Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 52;
|
||||
tmp2[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
tmp2[9] = ((limb)(tmp[7] >> 64)) >> 39;
|
||||
tmp2[9] += ((limb)(tmp[8])) >> 51;
|
||||
tmp2[9] += (((limb)(tmp[8] >> 64)) << 13);
|
||||
tmp2[9] += carry;
|
||||
|
||||
/* Montgomery elimination of terms.
|
||||
*
|
||||
* Since R is 2**257, we can divide by R with a bitwise shift if we can
|
||||
* ensure that the right-most 257 bits are all zero. We can make that true by
|
||||
* adding multiplies of p without affecting the value.
|
||||
*
|
||||
* So we eliminate limbs from right to left. Since the bottom 51 bits of p
|
||||
* are all ones, then by adding tmp2[0]*p to tmp2 we'll make tmp2[0] == 0.
|
||||
* We can do that for 8 further limbs and then right shift to eliminate the
|
||||
* extra factor of R. */
|
||||
for (i = 0;; i += 2) {
|
||||
tmp2[i + 1] += tmp2[i] >> 51;
|
||||
x = tmp2[i] & kBottom51Bits;
|
||||
xShiftedMask = NON_ZERO_TO_ALL_ONES(x >> 1);
|
||||
tmp2[i] = 0;
|
||||
|
||||
/* The bounds calculations for this loop are tricky. Each iteration of
|
||||
* the loop eliminates two words by adding values to words to their
|
||||
* right.
|
||||
*
|
||||
* The following table contains the amounts added to each word (as an
|
||||
* offset from the value of i at the top of the loop). The amounts are
|
||||
* accounted for from the first and second half of the loop separately
|
||||
* and are written as, for example, 51 to mean a value <2**51.
|
||||
*
|
||||
* Word: 1 2 3 4 5 6
|
||||
* Added in top half: 52 44 52 37 50
|
||||
* 51
|
||||
* 51
|
||||
* Added in bottom half: 51 45 51 38 50
|
||||
* 52
|
||||
* 52
|
||||
*
|
||||
* The value that is currently offset 5 will be offset 3 for the next
|
||||
* iteration and then offset 1 for the iteration after that. Therefore
|
||||
* the total value added will be the values added at 5, 3 and 1.
|
||||
*
|
||||
* The following table accumulates these values. The sums at the bottom
|
||||
* are written as, for example, 53+45, to mean a value < 2**53+2**45.
|
||||
*
|
||||
* Word: 1 2 3 4 5 6 7 8 9
|
||||
* 52 44 52 37 50 50 50 50 50
|
||||
* 51 45 51 38 37 38 37
|
||||
* 52 51 52 51 52 51
|
||||
* 51 52 51 52 51
|
||||
* 44 52 51 52
|
||||
* 51 45 44
|
||||
* 52
|
||||
* ------------------------------------
|
||||
* 53+ 53+ 54+ 52+ 53+ 52+
|
||||
* 45 44+ 50+ 51+ 52+ 50+
|
||||
* 37 45+ 50+ 50+ 37
|
||||
* 38 44+ 38
|
||||
* 37
|
||||
*
|
||||
* So the greatest amount is added to tmp2[5]. If tmp2[5] has an initial
|
||||
* value of <2**52, then the maximum value will be < 2**54 + 2**52 + 2**50 +
|
||||
* 2**45 + 2**38, which is < 2**64, as required. */
|
||||
tmp2[i + 1] += (x << 45) & kBottom52Bits;
|
||||
tmp2[i + 2] += x >> 7;
|
||||
|
||||
tmp2[i + 3] += (x << 38) & kBottom52Bits;
|
||||
tmp2[i + 4] += x >> 14;
|
||||
|
||||
/* On tmp2[i + 4], when x < 2**1, the subtraction with (x << 18) will not
|
||||
* underflow because it is balanced with the (x << 50) term. On the next
|
||||
* word tmp2[i + 5], terms with (x >> 1) and (x >> 33) are both zero and
|
||||
* there is no underflow either.
|
||||
*
|
||||
* When x >= 2**1, we add 2**51 to tmp2[i + 4] to avoid an underflow.
|
||||
* Removing 1 from tmp2[i + 5] is safe because (x >> 1) - (x >> 33) is
|
||||
* strictly positive.
|
||||
*/
|
||||
tmp2[i + 4] += 0x8000000000000 & xShiftedMask;
|
||||
tmp2[i + 5] -= 1 & xShiftedMask;
|
||||
|
||||
tmp2[i + 4] -= (x << 18) & kBottom51Bits;
|
||||
tmp2[i + 4] += (x << 50) & kBottom51Bits;
|
||||
tmp2[i + 5] += (x >> 1) - (x >> 33);
|
||||
|
||||
if (i+1 == NLIMBS)
|
||||
break;
|
||||
tmp2[i + 2] += tmp2[i + 1] >> 52;
|
||||
x = tmp2[i + 1] & kBottom52Bits;
|
||||
xShiftedMask = NON_ZERO_TO_ALL_ONES(x >> 2);
|
||||
tmp2[i + 1] = 0;
|
||||
|
||||
tmp2[i + 2] += (x << 44) & kBottom51Bits;
|
||||
tmp2[i + 3] += x >> 7;
|
||||
|
||||
tmp2[i + 4] += (x << 37) & kBottom51Bits;
|
||||
tmp2[i + 5] += x >> 14;
|
||||
|
||||
/* On tmp2[i + 5], when x < 2**2, the subtraction with (x << 18) will not
|
||||
* underflow because it is balanced with the (x << 50) term. On the next
|
||||
* word tmp2[i + 6], terms with (x >> 2) and (x >> 34) are both zero and
|
||||
* there is no underflow either.
|
||||
*
|
||||
* When x >= 2**2, we add 2**52 to tmp2[i + 5] to avoid an underflow.
|
||||
* Removing 1 from tmp2[i + 6] is safe because (x >> 2) - (x >> 34) is
|
||||
* stricly positive.
|
||||
*/
|
||||
tmp2[i + 5] += 0x10000000000000 & xShiftedMask;
|
||||
tmp2[i + 6] -= 1 & xShiftedMask;
|
||||
|
||||
tmp2[i + 5] -= (x << 18) & kBottom52Bits;
|
||||
tmp2[i + 5] += (x << 50) & kBottom52Bits;
|
||||
tmp2[i + 6] += (x >> 2) - (x >> 34);
|
||||
}
|
||||
|
||||
/* We merge the right shift with a carry chain. The words above 2**257 have
|
||||
* widths of 52,51,... which we need to correct when copying them down. */
|
||||
carry = 0;
|
||||
for (i = 0; i < 4; i++) {
|
||||
out[i] = tmp2[i + 5];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
out[i] = tmp2[i + 5] << 1;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
out[4] = tmp2[9];
|
||||
out[4] += carry;
|
||||
carry = out[4] >> 51;
|
||||
out[4] &= kBottom51Bits;
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_square sets out=in*in.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**52, in[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_square(felem out, const felem in) {
|
||||
u128 tmp[9], x1x1, x3x3;
|
||||
|
||||
x1x1 = ((u128) in[1]) * in[1];
|
||||
x3x3 = ((u128) in[3]) * in[3];
|
||||
|
||||
tmp[0] = ((u128) in[0]) * (in[0] << 0);
|
||||
tmp[1] = ((u128) in[0]) * (in[1] << 1) + ((x1x1 & 1) << 51);
|
||||
tmp[2] = ((u128) in[0]) * (in[2] << 1) + (x1x1 >> 1);
|
||||
tmp[3] = ((u128) in[0]) * (in[3] << 1) +
|
||||
((u128) in[1]) * (in[2] << 1);
|
||||
tmp[4] = ((u128) in[0]) * (in[4] << 1) +
|
||||
((u128) in[1]) * (in[3] << 0) +
|
||||
((u128) in[2]) * (in[2] << 0);
|
||||
tmp[5] = ((u128) in[1]) * (in[4] << 1) +
|
||||
((u128) in[2]) * (in[3] << 1) + ((x3x3 & 1) << 51);
|
||||
tmp[6] = ((u128) in[2]) * (in[4] << 1) + (x3x3 >> 1);
|
||||
tmp[7] = ((u128) in[3]) * (in[4] << 1);
|
||||
tmp[8] = ((u128) in[4]) * (in[4] << 0);
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
/* felem_mul sets out=in*in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**52, in[1,3,...] < 2**53 and
|
||||
* in2[0,2,...] < 2**52, in2[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_mul(felem out, const felem in, const felem in2) {
|
||||
u128 tmp[9], x1y1, x1y3, x3y1, x3y3;
|
||||
|
||||
x1y1 = ((u128) in[1]) * in2[1];
|
||||
x1y3 = ((u128) in[1]) * in2[3];
|
||||
x3y1 = ((u128) in[3]) * in2[1];
|
||||
x3y3 = ((u128) in[3]) * in2[3];
|
||||
|
||||
tmp[0] = ((u128) in[0]) * in2[0];
|
||||
tmp[1] = ((u128) in[0]) * in2[1] +
|
||||
((u128) in[1]) * in2[0] + ((x1y1 & 1) << 51);
|
||||
tmp[2] = ((u128) in[0]) * in2[2] + (x1y1 >> 1) +
|
||||
((u128) in[2]) * in2[0];
|
||||
tmp[3] = ((u128) in[0]) * in2[3] +
|
||||
((u128) in[1]) * in2[2] +
|
||||
((u128) in[2]) * in2[1] + ((x1y3 & 1) << 51) +
|
||||
((u128) in[3]) * in2[0] + ((x3y1 & 1) << 51);
|
||||
tmp[4] = ((u128) in[0]) * in2[4] + (x1y3 >> 1) +
|
||||
((u128) in[2]) * in2[2] + (x3y1 >> 1) +
|
||||
((u128) in[4]) * in2[0];
|
||||
tmp[5] = ((u128) in[1]) * in2[4] +
|
||||
((u128) in[2]) * in2[3] +
|
||||
((u128) in[3]) * in2[2] +
|
||||
((u128) in[4]) * in2[1] + ((x3y3 & 1) << 51);
|
||||
tmp[6] = ((u128) in[2]) * in2[4] + (x3y3 >> 1) +
|
||||
((u128) in[4]) * in2[2];
|
||||
tmp[7] = ((u128) in[3]) * in2[4] +
|
||||
((u128) in[4]) * in2[3];
|
||||
tmp[8] = ((u128) in[4]) * in2[4];
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
static void felem_assign(felem out, const felem in) {
|
||||
memcpy(out, in, sizeof(felem));
|
||||
}
|
||||
|
||||
/* felem_scalar_3 sets out=3*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**52, out[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_scalar_3(felem out) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_4 sets out=4*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**52, out[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_scalar_4(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 49;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom51Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 51);
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 50;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom52Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 52);
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_8 sets out=8*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**52, out[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_scalar_8(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 48;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom51Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 51);
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 49;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom52Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 52);
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_is_zero_vartime returns 1 iff |in| == 0. It takes a variable amount of
|
||||
* time depending on the value of |in|. */
|
||||
static char felem_is_zero_vartime(const felem in) {
|
||||
limb carry;
|
||||
int i;
|
||||
limb tmp[NLIMBS];
|
||||
|
||||
felem_assign(tmp, in);
|
||||
|
||||
/* First, reduce tmp to a minimal form. */
|
||||
do {
|
||||
carry = 0;
|
||||
for (i = 0;; i++) {
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 51;
|
||||
tmp[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 52;
|
||||
tmp[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(tmp, carry);
|
||||
} while (carry);
|
||||
|
||||
/* tmp < 2**257, so the only possible zero values are 0, p and 2p. */
|
||||
return memcmp(tmp, kZero, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, kP, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, k2P, sizeof(tmp)) == 0;
|
||||
}
|
||||
|
||||
|
||||
/* Montgomery operations: */
|
||||
|
||||
#define kRDigits {2, 0xfffffffe00000000, 0xffffffffffffffff, 0x1fffffffd} // 2^257 mod p256.p
|
||||
|
||||
#define kRInvDigits {0x180000000, 0xffffffff, 0xfffffffe80000001, 0x7fffffff00000001} // 1 / 2^257 mod p256.p
|
||||
|
||||
static const cryptonite_p256_int kR = { kRDigits };
|
||||
static const cryptonite_p256_int kRInv = { kRInvDigits };
|
||||
|
||||
/* to_montgomery sets out = R*in. */
|
||||
static void to_montgomery(felem out, const cryptonite_p256_int* in) {
|
||||
cryptonite_p256_int in_shifted;
|
||||
int i;
|
||||
|
||||
cryptonite_p256_init(&in_shifted);
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);
|
||||
|
||||
for (i = 0; i < NLIMBS; i++) {
|
||||
if ((i & 1) == 0) {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom51Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 51, &in_shifted);
|
||||
} else {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom52Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 52, &in_shifted);
|
||||
}
|
||||
}
|
||||
|
||||
cryptonite_p256_clear(&in_shifted);
|
||||
}
|
||||
|
||||
/* from_montgomery sets out=in/R. */
|
||||
static void from_montgomery(cryptonite_p256_int* out, const felem in) {
|
||||
cryptonite_p256_int result, tmp;
|
||||
int i, top;
|
||||
|
||||
cryptonite_p256_init(&result);
|
||||
cryptonite_p256_init(&tmp);
|
||||
|
||||
cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);
|
||||
for (i = NLIMBS - 2; i >= 0; i--) {
|
||||
if ((i & 1) == 0) {
|
||||
top = cryptonite_p256_shl(&result, 51, &tmp);
|
||||
} else {
|
||||
top = cryptonite_p256_shl(&result, 52, &tmp);
|
||||
}
|
||||
top += cryptonite_p256_add_d(&tmp, in[i], &result);
|
||||
}
|
||||
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);
|
||||
|
||||
cryptonite_p256_clear(&result);
|
||||
cryptonite_p256_clear(&tmp);
|
||||
}
|
||||
@ -25,7 +25,7 @@
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 elliptic curve group. It's written to
|
||||
// be portable 32-bit, although it's still constant-time.
|
||||
// be portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
@ -40,14 +40,16 @@
|
||||
#include "p256/p256.h"
|
||||
|
||||
const cryptonite_p256_int cryptonite_SECP256r1_n = // curve order
|
||||
{{0xfc632551, 0xf3b9cac2, 0xa7179e84, 0xbce6faad, -1, -1, 0, -1}};
|
||||
{{P256_LITERAL(0xfc632551, 0xf3b9cac2), P256_LITERAL(0xa7179e84, 0xbce6faad),
|
||||
P256_LITERAL(-1, -1), P256_LITERAL(0, -1)}};
|
||||
|
||||
const cryptonite_p256_int cryptonite_SECP256r1_p = // curve field size
|
||||
{{-1, -1, -1, 0, 0, 0, 1, -1 }};
|
||||
{{P256_LITERAL(-1, -1), P256_LITERAL(-1, 0),
|
||||
P256_LITERAL(0, 0), P256_LITERAL(1, -1) }};
|
||||
|
||||
const cryptonite_p256_int cryptonite_SECP256r1_b = // curve b
|
||||
{{0x27d2604b, 0x3bce3c3e, 0xcc53b0f6, 0x651d06b0,
|
||||
0x769886bc, 0xb3ebbd55, 0xaa3a93e7, 0x5ac635d8}};
|
||||
{{P256_LITERAL(0x27d2604b, 0x3bce3c3e), P256_LITERAL(0xcc53b0f6, 0x651d06b0),
|
||||
P256_LITERAL(0x769886bc, 0xb3ebbd55), P256_LITERAL(0xaa3a93e7, 0x5ac635d8)}};
|
||||
|
||||
void cryptonite_p256_init(cryptonite_p256_int* a) {
|
||||
memset(a, 0, sizeof(*a));
|
||||
@ -61,9 +63,10 @@ int cryptonite_p256_get_bit(const cryptonite_p256_int* scalar, int bit) {
|
||||
}
|
||||
|
||||
int cryptonite_p256_is_zero(const cryptonite_p256_int* a) {
|
||||
int i, result = 0;
|
||||
cryptonite_p256_digit result = 0;
|
||||
int i = 0;
|
||||
for (i = 0; i < P256_NDIGITS; ++i) result |= P256_DIGIT(a, i);
|
||||
return !result;
|
||||
return result == 0;
|
||||
}
|
||||
|
||||
// top, c[] += a[] * b
|
||||
@ -167,6 +170,10 @@ void cryptonite_p256_modmul(const cryptonite_p256_int* MOD,
|
||||
// top can be any value at this point.
|
||||
// Guestimate reducer as top * MOD, since msw of MOD is -1.
|
||||
top_reducer = mulAdd(MOD, top, 0, reducer);
|
||||
#if P256_BITSPERDIGIT > 32
|
||||
// Correction when msw of MOD has only high 32 bits set
|
||||
top_reducer += mulAdd(MOD, top >> 32, 0, reducer);
|
||||
#endif
|
||||
|
||||
// Subtract reducer from top | tmp.
|
||||
top = subTop(top_reducer, reducer, top, tmp + i);
|
||||
@ -229,7 +236,7 @@ static void cryptonite_p256_shr1(const cryptonite_p256_int* a, int highbit, cryp
|
||||
P256_DIGIT(b, i) = accu;
|
||||
}
|
||||
P256_DIGIT(b, i) = (P256_DIGIT(a, i) >> 1) |
|
||||
(highbit << (P256_BITSPERDIGIT - 1));
|
||||
(((cryptonite_p256_sdigit) highbit) << (P256_BITSPERDIGIT - 1));
|
||||
}
|
||||
|
||||
// Return -1, 0, 1 for a < b, a == b or a > b respectively.
|
||||
@ -359,31 +366,32 @@ int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonit
|
||||
}
|
||||
|
||||
void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst) {
|
||||
int i;
|
||||
int i, n;
|
||||
const uint8_t* p = &src[0];
|
||||
|
||||
for (i = P256_NDIGITS - 1; i >= 0; --i) {
|
||||
P256_DIGIT(dst, i) =
|
||||
(p[0] << 24) |
|
||||
(p[1] << 16) |
|
||||
(p[2] << 8) |
|
||||
p[3];
|
||||
p += 4;
|
||||
cryptonite_p256_digit dig = 0;
|
||||
n = P256_BITSPERDIGIT;
|
||||
while (n > 0) {
|
||||
n -= 8;
|
||||
dig |= ((cryptonite_p256_digit) *(p++)) << n;
|
||||
}
|
||||
P256_DIGIT(dst, i) = dig;
|
||||
}
|
||||
}
|
||||
|
||||
void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES])
|
||||
{
|
||||
int i;
|
||||
int i, n;
|
||||
uint8_t* p = &dst[0];
|
||||
|
||||
for (i = P256_NDIGITS -1; i >= 0; --i) {
|
||||
const cryptonite_p256_digit dig = P256_DIGIT(src, i);
|
||||
p[0] = dig >> 24;
|
||||
p[1] = dig >> 16;
|
||||
p[2] = dig >> 8;
|
||||
p[3] = dig;
|
||||
p += 4;
|
||||
n = P256_BITSPERDIGIT;
|
||||
while (n > 0) {
|
||||
n -= 8;
|
||||
*(p++) = dig >> n;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -395,6 +403,7 @@ void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBY
|
||||
|
||||
// c = a + b mod MOD
|
||||
void cryptonite_p256e_modadd(const cryptonite_p256_int* MOD, const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {
|
||||
assert(c); /* avoid repeated checks inside inlined cryptonite_p256_add */
|
||||
cryptonite_p256_digit top = cryptonite_p256_add(a, b, c);
|
||||
top = subM(MOD, top, P256_DIGITS(c), -1);
|
||||
top = subM(MOD, top, P256_DIGITS(c), MSB_COMPLEMENT(top));
|
||||
@ -403,15 +412,13 @@ void cryptonite_p256e_modadd(const cryptonite_p256_int* MOD, const cryptonite_p2
|
||||
|
||||
// c = a - b mod MOD
|
||||
void cryptonite_p256e_modsub(const cryptonite_p256_int* MOD, const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {
|
||||
assert(c); /* avoid repeated checks inside inlined cryptonite_p256_sub */
|
||||
cryptonite_p256_digit top = cryptonite_p256_sub(a, b, c);
|
||||
top = addM(MOD, top, P256_DIGITS(c), ~MSB_COMPLEMENT(top));
|
||||
top = subM(MOD, top, P256_DIGITS(c), MSB_COMPLEMENT(top));
|
||||
addM(MOD, 0, P256_DIGITS(c), top);
|
||||
}
|
||||
|
||||
// n' such as n * n' = -1 mod (2^32)
|
||||
#define MONTGOMERY_FACTOR 0xEE00BC4F
|
||||
|
||||
#define NTH_DOUBLE_THEN_ADD(i, a, nth, b, out) \
|
||||
cryptonite_p256e_montmul(a, a, out); \
|
||||
for (i = 1; i < nth; i++) \
|
||||
@ -419,8 +426,8 @@ void cryptonite_p256e_modsub(const cryptonite_p256_int* MOD, const cryptonite_p2
|
||||
cryptonite_p256e_montmul(out, b, out);
|
||||
|
||||
const cryptonite_p256_int cryptonite_SECP256r1_r2 = // r^2 mod n
|
||||
{{0xBE79EEA2, 0x83244C95, 0x49BD6FA6, 0x4699799C,
|
||||
0x2B6BEC59, 0x2845B239, 0xF3D95620, 0x66E12D94}};
|
||||
{{P256_LITERAL(0xBE79EEA2, 0x83244C95), P256_LITERAL(0x49BD6FA6, 0x4699799C),
|
||||
P256_LITERAL(0x2B6BEC59, 0x2845B239), P256_LITERAL(0xF3D95620, 0x66E12D94)}};
|
||||
|
||||
const cryptonite_p256_int cryptonite_SECP256r1_one = {{1}};
|
||||
|
||||
@ -443,7 +450,7 @@ static void cryptonite_p256e_montmul(const cryptonite_p256_int* a, const crypton
|
||||
}
|
||||
accum[j] = chain;
|
||||
|
||||
mand = accum[0] * MONTGOMERY_FACTOR;
|
||||
mand = accum[0] * P256_MONTGOMERY_FACTOR;
|
||||
chain = 0;
|
||||
mier = P256_DIGITS(&cryptonite_SECP256r1_n);
|
||||
for (j=0; j<P256_NDIGITS; j++) {
|
||||
|
||||
@ -25,580 +25,18 @@
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 elliptic curve group. It's written to
|
||||
// be portable 32-bit, although it's still constant-time.
|
||||
// be portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
//
|
||||
// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include "p256/p256.h"
|
||||
|
||||
typedef uint8_t u8;
|
||||
typedef uint32_t u32;
|
||||
typedef int32_t s32;
|
||||
typedef uint64_t u64;
|
||||
|
||||
/* Our field elements are represented as nine 32-bit limbs.
|
||||
*
|
||||
* The value of an felem (field element) is:
|
||||
* x[0] + (x[1] * 2**29) + (x[2] * 2**57) + ... + (x[8] * 2**228)
|
||||
*
|
||||
* That is, each limb is alternately 29 or 28-bits wide in little-endian
|
||||
* order.
|
||||
*
|
||||
* This means that an felem hits 2**257, rather than 2**256 as we would like. A
|
||||
* 28, 29, ... pattern would cause us to hit 2**256, but that causes problems
|
||||
* when multiplying as terms end up one bit short of a limb which would require
|
||||
* much bit-shifting to correct.
|
||||
*
|
||||
* Finally, the values stored in an felem are in Montgomery form. So the value
|
||||
* |y| is stored as (y*R) mod p, where p is the P-256 prime and R is 2**257.
|
||||
*/
|
||||
typedef u32 limb;
|
||||
#define NLIMBS 9
|
||||
typedef limb felem[NLIMBS];
|
||||
|
||||
static const limb kBottom28Bits = 0xfffffff;
|
||||
static const limb kBottom29Bits = 0x1fffffff;
|
||||
|
||||
/* kOne is the number 1 as an felem. It's 2**257 mod p split up into 29 and
|
||||
* 28-bit words. */
|
||||
static const felem kOne = {
|
||||
2, 0, 0, 0xffff800,
|
||||
0x1fffffff, 0xfffffff, 0x1fbfffff, 0x1ffffff,
|
||||
0
|
||||
};
|
||||
static const felem kZero = {0};
|
||||
static const felem kP = {
|
||||
0x1fffffff, 0xfffffff, 0x1fffffff, 0x3ff,
|
||||
0, 0, 0x200000, 0xf000000,
|
||||
0xfffffff
|
||||
};
|
||||
static const felem k2P = {
|
||||
0x1ffffffe, 0xfffffff, 0x1fffffff, 0x7ff,
|
||||
0, 0, 0x400000, 0xe000000,
|
||||
0x1fffffff
|
||||
};
|
||||
/* kPrecomputed contains precomputed values to aid the calculation of scalar
|
||||
* multiples of the base point, G. It's actually two, equal length, tables
|
||||
* concatenated.
|
||||
*
|
||||
* The first table contains (x,y) felem pairs for 16 multiples of the base
|
||||
* point, G.
|
||||
*
|
||||
* Index | Index (binary) | Value
|
||||
* 0 | 0000 | 0G (all zeros, omitted)
|
||||
* 1 | 0001 | G
|
||||
* 2 | 0010 | 2**64G
|
||||
* 3 | 0011 | 2**64G + G
|
||||
* 4 | 0100 | 2**128G
|
||||
* 5 | 0101 | 2**128G + G
|
||||
* 6 | 0110 | 2**128G + 2**64G
|
||||
* 7 | 0111 | 2**128G + 2**64G + G
|
||||
* 8 | 1000 | 2**192G
|
||||
* 9 | 1001 | 2**192G + G
|
||||
* 10 | 1010 | 2**192G + 2**64G
|
||||
* 11 | 1011 | 2**192G + 2**64G + G
|
||||
* 12 | 1100 | 2**192G + 2**128G
|
||||
* 13 | 1101 | 2**192G + 2**128G + G
|
||||
* 14 | 1110 | 2**192G + 2**128G + 2**64G
|
||||
* 15 | 1111 | 2**192G + 2**128G + 2**64G + G
|
||||
*
|
||||
* The second table follows the same style, but the terms are 2**32G,
|
||||
* 2**96G, 2**160G, 2**224G.
|
||||
*
|
||||
* This is ~2KB of data. */
|
||||
static const limb kPrecomputed[NLIMBS * 2 * 15 * 2] = {
|
||||
0x11522878, 0xe730d41, 0xdb60179, 0x4afe2ff, 0x12883add, 0xcaddd88, 0x119e7edc, 0xd4a6eab, 0x3120bee,
|
||||
0x1d2aac15, 0xf25357c, 0x19e45cdd, 0x5c721d0, 0x1992c5a5, 0xa237487, 0x154ba21, 0x14b10bb, 0xae3fe3,
|
||||
0xd41a576, 0x922fc51, 0x234994f, 0x60b60d3, 0x164586ae, 0xce95f18, 0x1fe49073, 0x3fa36cc, 0x5ebcd2c,
|
||||
0xb402f2f, 0x15c70bf, 0x1561925c, 0x5a26704, 0xda91e90, 0xcdc1c7f, 0x1ea12446, 0xe1ade1e, 0xec91f22,
|
||||
0x26f7778, 0x566847e, 0xa0bec9e, 0x234f453, 0x1a31f21a, 0xd85e75c, 0x56c7109, 0xa267a00, 0xb57c050,
|
||||
0x98fb57, 0xaa837cc, 0x60c0792, 0xcfa5e19, 0x61bab9e, 0x589e39b, 0xa324c5, 0x7d6dee7, 0x2976e4b,
|
||||
0x1fc4124a, 0xa8c244b, 0x1ce86762, 0xcd61c7e, 0x1831c8e0, 0x75774e1, 0x1d96a5a9, 0x843a649, 0xc3ab0fa,
|
||||
0x6e2e7d5, 0x7673a2a, 0x178b65e8, 0x4003e9b, 0x1a1f11c2, 0x7816ea, 0xf643e11, 0x58c43df, 0xf423fc2,
|
||||
0x19633ffa, 0x891f2b2, 0x123c231c, 0x46add8c, 0x54700dd, 0x59e2b17, 0x172db40f, 0x83e277d, 0xb0dd609,
|
||||
0xfd1da12, 0x35c6e52, 0x19ede20c, 0xd19e0c0, 0x97d0f40, 0xb015b19, 0x449e3f5, 0xe10c9e, 0x33ab581,
|
||||
0x56a67ab, 0x577734d, 0x1dddc062, 0xc57b10d, 0x149b39d, 0x26a9e7b, 0xc35df9f, 0x48764cd, 0x76dbcca,
|
||||
0xca4b366, 0xe9303ab, 0x1a7480e7, 0x57e9e81, 0x1e13eb50, 0xf466cf3, 0x6f16b20, 0x4ba3173, 0xc168c33,
|
||||
0x15cb5439, 0x6a38e11, 0x73658bd, 0xb29564f, 0x3f6dc5b, 0x53b97e, 0x1322c4c0, 0x65dd7ff, 0x3a1e4f6,
|
||||
0x14e614aa, 0x9246317, 0x1bc83aca, 0xad97eed, 0xd38ce4a, 0xf82b006, 0x341f077, 0xa6add89, 0x4894acd,
|
||||
0x9f162d5, 0xf8410ef, 0x1b266a56, 0xd7f223, 0x3e0cb92, 0xe39b672, 0x6a2901a, 0x69a8556, 0x7e7c0,
|
||||
0x9b7d8d3, 0x309a80, 0x1ad05f7f, 0xc2fb5dd, 0xcbfd41d, 0x9ceb638, 0x1051825c, 0xda0cf5b, 0x812e881,
|
||||
0x6f35669, 0x6a56f2c, 0x1df8d184, 0x345820, 0x1477d477, 0x1645db1, 0xbe80c51, 0xc22be3e, 0xe35e65a,
|
||||
0x1aeb7aa0, 0xc375315, 0xf67bc99, 0x7fdd7b9, 0x191fc1be, 0x61235d, 0x2c184e9, 0x1c5a839, 0x47a1e26,
|
||||
0xb7cb456, 0x93e225d, 0x14f3c6ed, 0xccc1ac9, 0x17fe37f3, 0x4988989, 0x1a90c502, 0x2f32042, 0xa17769b,
|
||||
0xafd8c7c, 0x8191c6e, 0x1dcdb237, 0x16200c0, 0x107b32a1, 0x66c08db, 0x10d06a02, 0x3fc93, 0x5620023,
|
||||
0x16722b27, 0x68b5c59, 0x270fcfc, 0xfad0ecc, 0xe5de1c2, 0xeab466b, 0x2fc513c, 0x407f75c, 0xbaab133,
|
||||
0x9705fe9, 0xb88b8e7, 0x734c993, 0x1e1ff8f, 0x19156970, 0xabd0f00, 0x10469ea7, 0x3293ac0, 0xcdc98aa,
|
||||
0x1d843fd, 0xe14bfe8, 0x15be825f, 0x8b5212, 0xeb3fb67, 0x81cbd29, 0xbc62f16, 0x2b6fcc7, 0xf5a4e29,
|
||||
0x13560b66, 0xc0b6ac2, 0x51ae690, 0xd41e271, 0xf3e9bd4, 0x1d70aab, 0x1029f72, 0x73e1c35, 0xee70fbc,
|
||||
0xad81baf, 0x9ecc49a, 0x86c741e, 0xfe6be30, 0x176752e7, 0x23d416, 0x1f83de85, 0x27de188, 0x66f70b8,
|
||||
0x181cd51f, 0x96b6e4c, 0x188f2335, 0xa5df759, 0x17a77eb6, 0xfeb0e73, 0x154ae914, 0x2f3ec51, 0x3826b59,
|
||||
0xb91f17d, 0x1c72949, 0x1362bf0a, 0xe23fddf, 0xa5614b0, 0xf7d8f, 0x79061, 0x823d9d2, 0x8213f39,
|
||||
0x1128ae0b, 0xd095d05, 0xb85c0c2, 0x1ecb2ef, 0x24ddc84, 0xe35e901, 0x18411a4a, 0xf5ddc3d, 0x3786689,
|
||||
0x52260e8, 0x5ae3564, 0x542b10d, 0x8d93a45, 0x19952aa4, 0x996cc41, 0x1051a729, 0x4be3499, 0x52b23aa,
|
||||
0x109f307e, 0x6f5b6bb, 0x1f84e1e7, 0x77a0cfa, 0x10c4df3f, 0x25a02ea, 0xb048035, 0xe31de66, 0xc6ecaa3,
|
||||
0x28ea335, 0x2886024, 0x1372f020, 0xf55d35, 0x15e4684c, 0xf2a9e17, 0x1a4a7529, 0xcb7beb1, 0xb2a78a1,
|
||||
0x1ab21f1f, 0x6361ccf, 0x6c9179d, 0xb135627, 0x1267b974, 0x4408bad, 0x1cbff658, 0xe3d6511, 0xc7d76f,
|
||||
0x1cc7a69, 0xe7ee31b, 0x54fab4f, 0x2b914f, 0x1ad27a30, 0xcd3579e, 0xc50124c, 0x50daa90, 0xb13f72,
|
||||
0xb06aa75, 0x70f5cc6, 0x1649e5aa, 0x84a5312, 0x329043c, 0x41c4011, 0x13d32411, 0xb04a838, 0xd760d2d,
|
||||
0x1713b532, 0xbaa0c03, 0x84022ab, 0x6bcf5c1, 0x2f45379, 0x18ae070, 0x18c9e11e, 0x20bca9a, 0x66f496b,
|
||||
0x3eef294, 0x67500d2, 0xd7f613c, 0x2dbbeb, 0xb741038, 0xe04133f, 0x1582968d, 0xbe985f7, 0x1acbc1a,
|
||||
0x1a6a939f, 0x33e50f6, 0xd665ed4, 0xb4b7bd6, 0x1e5a3799, 0x6b33847, 0x17fa56ff, 0x65ef930, 0x21dc4a,
|
||||
0x2b37659, 0x450fe17, 0xb357b65, 0xdf5efac, 0x15397bef, 0x9d35a7f, 0x112ac15f, 0x624e62e, 0xa90ae2f,
|
||||
0x107eecd2, 0x1f69bbe, 0x77d6bce, 0x5741394, 0x13c684fc, 0x950c910, 0x725522b, 0xdc78583, 0x40eeabb,
|
||||
0x1fde328a, 0xbd61d96, 0xd28c387, 0x9e77d89, 0x12550c40, 0x759cb7d, 0x367ef34, 0xae2a960, 0x91b8bdc,
|
||||
0x93462a9, 0xf469ef, 0xb2e9aef, 0xd2ca771, 0x54e1f42, 0x7aaa49, 0x6316abb, 0x2413c8e, 0x5425bf9,
|
||||
0x1bed3e3a, 0xf272274, 0x1f5e7326, 0x6416517, 0xea27072, 0x9cedea7, 0x6e7633, 0x7c91952, 0xd806dce,
|
||||
0x8e2a7e1, 0xe421e1a, 0x418c9e1, 0x1dbc890, 0x1b395c36, 0xa1dc175, 0x1dc4ef73, 0x8956f34, 0xe4b5cf2,
|
||||
0x1b0d3a18, 0x3194a36, 0x6c2641f, 0xe44124c, 0xa2f4eaa, 0xa8c25ba, 0xf927ed7, 0x627b614, 0x7371cca,
|
||||
0xba16694, 0x417bc03, 0x7c0a7e3, 0x9c35c19, 0x1168a205, 0x8b6b00d, 0x10e3edc9, 0x9c19bf2, 0x5882229,
|
||||
0x1b2b4162, 0xa5cef1a, 0x1543622b, 0x9bd433e, 0x364e04d, 0x7480792, 0x5c9b5b3, 0xe85ff25, 0x408ef57,
|
||||
0x1814cfa4, 0x121b41b, 0xd248a0f, 0x3b05222, 0x39bb16a, 0xc75966d, 0xa038113, 0xa4a1769, 0x11fbc6c,
|
||||
0x917e50e, 0xeec3da8, 0x169d6eac, 0x10c1699, 0xa416153, 0xf724912, 0x15cd60b7, 0x4acbad9, 0x5efc5fa,
|
||||
0xf150ed7, 0x122b51, 0x1104b40a, 0xcb7f442, 0xfbb28ff, 0x6ac53ca, 0x196142cc, 0x7bf0fa9, 0x957651,
|
||||
0x4e0f215, 0xed439f8, 0x3f46bd5, 0x5ace82f, 0x110916b6, 0x6db078, 0xffd7d57, 0xf2ecaac, 0xca86dec,
|
||||
0x15d6b2da, 0x965ecc9, 0x1c92b4c2, 0x1f3811, 0x1cb080f5, 0x2d8b804, 0x19d1c12d, 0xf20bd46, 0x1951fa7,
|
||||
0xa3656c3, 0x523a425, 0xfcd0692, 0xd44ddc8, 0x131f0f5b, 0xaf80e4a, 0xcd9fc74, 0x99bb618, 0x2db944c,
|
||||
0xa673090, 0x1c210e1, 0x178c8d23, 0x1474383, 0x10b8743d, 0x985a55b, 0x2e74779, 0x576138, 0x9587927,
|
||||
0x133130fa, 0xbe05516, 0x9f4d619, 0xbb62570, 0x99ec591, 0xd9468fe, 0x1d07782d, 0xfc72e0b, 0x701b298,
|
||||
0x1863863b, 0x85954b8, 0x121a0c36, 0x9e7fedf, 0xf64b429, 0x9b9d71e, 0x14e2f5d8, 0xf858d3a, 0x942eea8,
|
||||
0xda5b765, 0x6edafff, 0xa9d18cc, 0xc65e4ba, 0x1c747e86, 0xe4ea915, 0x1981d7a1, 0x8395659, 0x52ed4e2,
|
||||
0x87d43b7, 0x37ab11b, 0x19d292ce, 0xf8d4692, 0x18c3053f, 0x8863e13, 0x4c146c0, 0x6bdf55a, 0x4e4457d,
|
||||
0x16152289, 0xac78ec2, 0x1a59c5a2, 0x2028b97, 0x71c2d01, 0x295851f, 0x404747b, 0x878558d, 0x7d29aa4,
|
||||
0x13d8341f, 0x8daefd7, 0x139c972d, 0x6b7ea75, 0xd4a9dde, 0xff163d8, 0x81d55d7, 0xa5bef68, 0xb7b30d8,
|
||||
0xbe73d6f, 0xaa88141, 0xd976c81, 0x7e7a9cc, 0x18beb771, 0xd773cbd, 0x13f51951, 0x9d0c177, 0x1c49a78,
|
||||
};
|
||||
#include "p256/p256_gf.h"
|
||||
|
||||
|
||||
/* Field element operations: */
|
||||
|
||||
/* NON_ZERO_TO_ALL_ONES returns:
|
||||
* 0xffffffff for 0 < x <= 2**31
|
||||
* 0 for x == 0 or x > 2**31.
|
||||
*
|
||||
* x must be a u32 or an equivalent type such as limb. */
|
||||
#define NON_ZERO_TO_ALL_ONES(x) ((((u32)(x) - 1) >> 31) - 1)
|
||||
|
||||
/* felem_reduce_carry adds a multiple of p in order to cancel |carry|,
|
||||
* which is a term at 2**257.
|
||||
*
|
||||
* On entry: carry < 2**3, inout[0,2,...] < 2**29, inout[1,3,...] < 2**28.
|
||||
* On exit: inout[0,2,..] < 2**30, inout[1,3,...] < 2**29. */
|
||||
static void felem_reduce_carry(felem inout, limb carry) {
|
||||
const u32 carry_mask = NON_ZERO_TO_ALL_ONES(carry);
|
||||
|
||||
inout[0] += carry << 1;
|
||||
inout[3] += 0x10000000 & carry_mask;
|
||||
/* carry < 2**3 thus (carry << 11) < 2**14 and we added 2**28 in the
|
||||
* previous line therefore this doesn't underflow. */
|
||||
inout[3] -= carry << 11;
|
||||
inout[4] += (0x20000000 - 1) & carry_mask;
|
||||
inout[5] += (0x10000000 - 1) & carry_mask;
|
||||
inout[6] += (0x20000000 - 1) & carry_mask;
|
||||
inout[6] -= carry << 22;
|
||||
/* This may underflow if carry is non-zero but, if so, we'll fix it in the
|
||||
* next line. */
|
||||
inout[7] -= 1 & carry_mask;
|
||||
inout[7] += carry << 25;
|
||||
}
|
||||
|
||||
/* felem_sum sets out = in+in2.
|
||||
*
|
||||
* On entry, in[i]+in2[i] must not overflow a 32-bit word.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29 */
|
||||
static void felem_sum(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
#define two31m3 (((limb)1) << 31) - (((limb)1) << 3)
|
||||
#define two30m2 (((limb)1) << 30) - (((limb)1) << 2)
|
||||
#define two30p13m2 (((limb)1) << 30) + (((limb)1) << 13) - (((limb)1) << 2)
|
||||
#define two31m2 (((limb)1) << 31) - (((limb)1) << 2)
|
||||
#define two31p24m2 (((limb)1) << 31) + (((limb)1) << 24) - (((limb)1) << 2)
|
||||
#define two30m27m2 (((limb)1) << 30) - (((limb)1) << 27) - (((limb)1) << 2)
|
||||
|
||||
/* zero31 is 0 mod p. */
|
||||
static const felem zero31 = { two31m3, two30m2, two31m2, two30p13m2, two31m2, two30m2, two31p24m2, two30m27m2, two31m2 };
|
||||
|
||||
/* felem_diff sets out = in-in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29 and
|
||||
* in2[0,2,...] < 2**30, in2[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_diff(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero31[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero31[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_reduce_degree sets out = tmp/R mod p where tmp contains 64-bit words
|
||||
* with the same 29,28,... bit positions as an felem.
|
||||
*
|
||||
* The values in felems are in Montgomery form: x*R mod p where R = 2**257.
|
||||
* Since we just multiplied two Montgomery values together, the result is
|
||||
* x*y*R*R mod p. We wish to divide by R in order for the result also to be
|
||||
* in Montgomery form.
|
||||
*
|
||||
* On entry: tmp[i] < 2**64
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29 */
|
||||
static void felem_reduce_degree(felem out, u64 tmp[17]) {
|
||||
/* The following table may be helpful when reading this code:
|
||||
*
|
||||
* Limb number: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10...
|
||||
* Width (bits): 29| 28| 29| 28| 29| 28| 29| 28| 29| 28| 29
|
||||
* Start bit: 0 | 29| 57| 86|114|143|171|200|228|257|285
|
||||
* (odd phase): 0 | 28| 57| 85|114|142|171|199|228|256|285 */
|
||||
limb tmp2[18], carry, x, xMask;
|
||||
unsigned i;
|
||||
|
||||
/* tmp contains 64-bit words with the same 29,28,29-bit positions as an
|
||||
* felem. So the top of an element of tmp might overlap with another
|
||||
* element two positions down. The following loop eliminates this
|
||||
* overlap. */
|
||||
tmp2[0] = (limb)(tmp[0] & kBottom29Bits);
|
||||
|
||||
/* In the following we use "(limb) tmp[x]" and "(limb) (tmp[x]>>32)" to try
|
||||
* and hint to the compiler that it can do a single-word shift by selecting
|
||||
* the right register rather than doing a double-word shift and truncating
|
||||
* afterwards. */
|
||||
tmp2[1] = ((limb) tmp[0]) >> 29;
|
||||
tmp2[1] |= (((limb)(tmp[0] >> 32)) << 3) & kBottom28Bits;
|
||||
tmp2[1] += ((limb) tmp[1]) & kBottom28Bits;
|
||||
carry = tmp2[1] >> 28;
|
||||
tmp2[1] &= kBottom28Bits;
|
||||
|
||||
for (i = 2; i < 17; i++) {
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 32)) >> 25;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 28;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 32)) << 4) & kBottom29Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom29Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 29;
|
||||
tmp2[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == 17)
|
||||
break;
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 32)) >> 25;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 29;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 32)) << 3) & kBottom28Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom28Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 28;
|
||||
tmp2[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
tmp2[17] = ((limb)(tmp[15] >> 32)) >> 25;
|
||||
tmp2[17] += ((limb)(tmp[16])) >> 29;
|
||||
tmp2[17] += (((limb)(tmp[16] >> 32)) << 3);
|
||||
tmp2[17] += carry;
|
||||
|
||||
/* Montgomery elimination of terms.
|
||||
*
|
||||
* Since R is 2**257, we can divide by R with a bitwise shift if we can
|
||||
* ensure that the right-most 257 bits are all zero. We can make that true by
|
||||
* adding multiplies of p without affecting the value.
|
||||
*
|
||||
* So we eliminate limbs from right to left. Since the bottom 29 bits of p
|
||||
* are all ones, then by adding tmp2[0]*p to tmp2 we'll make tmp2[0] == 0.
|
||||
* We can do that for 8 further limbs and then right shift to eliminate the
|
||||
* extra factor of R. */
|
||||
for (i = 0;; i += 2) {
|
||||
tmp2[i + 1] += tmp2[i] >> 29;
|
||||
x = tmp2[i] & kBottom29Bits;
|
||||
xMask = NON_ZERO_TO_ALL_ONES(x);
|
||||
tmp2[i] = 0;
|
||||
|
||||
/* The bounds calculations for this loop are tricky. Each iteration of
|
||||
* the loop eliminates two words by adding values to words to their
|
||||
* right.
|
||||
*
|
||||
* The following table contains the amounts added to each word (as an
|
||||
* offset from the value of i at the top of the loop). The amounts are
|
||||
* accounted for from the first and second half of the loop separately
|
||||
* and are written as, for example, 28 to mean a value <2**28.
|
||||
*
|
||||
* Word: 3 4 5 6 7 8 9 10
|
||||
* Added in top half: 28 11 29 21 29 28
|
||||
* 28 29
|
||||
* 29
|
||||
* Added in bottom half: 29 10 28 21 28 28
|
||||
* 29
|
||||
*
|
||||
* The value that is currently offset 7 will be offset 5 for the next
|
||||
* iteration and then offset 3 for the iteration after that. Therefore
|
||||
* the total value added will be the values added at 7, 5 and 3.
|
||||
*
|
||||
* The following table accumulates these values. The sums at the bottom
|
||||
* are written as, for example, 29+28, to mean a value < 2**29+2**28.
|
||||
*
|
||||
* Word: 3 4 5 6 7 8 9 10 11 12 13
|
||||
* 28 11 10 29 21 29 28 28 28 28 28
|
||||
* 29 28 11 28 29 28 29 28 29 28
|
||||
* 29 28 21 21 29 21 29 21
|
||||
* 10 29 28 21 28 21 28
|
||||
* 28 29 28 29 28 29 28
|
||||
* 11 10 29 10 29 10
|
||||
* 29 28 11 28 11
|
||||
* 29 29
|
||||
* --------------------------------------------
|
||||
* 30+ 31+ 30+ 31+ 30+
|
||||
* 28+ 29+ 28+ 29+ 21+
|
||||
* 21+ 28+ 21+ 28+ 10
|
||||
* 10 21+ 10 21+
|
||||
* 11 11
|
||||
*
|
||||
* So the greatest amount is added to tmp2[10] and tmp2[12]. If
|
||||
* tmp2[10/12] has an initial value of <2**29, then the maximum value
|
||||
* will be < 2**31 + 2**30 + 2**28 + 2**21 + 2**11, which is < 2**32,
|
||||
* as required. */
|
||||
tmp2[i + 3] += (x << 10) & kBottom28Bits;
|
||||
tmp2[i + 4] += (x >> 18);
|
||||
|
||||
tmp2[i + 6] += (x << 21) & kBottom29Bits;
|
||||
tmp2[i + 7] += x >> 8;
|
||||
|
||||
/* At position 200, which is the starting bit position for word 7, we
|
||||
* have a factor of 0xf000000 = 2**28 - 2**24. */
|
||||
tmp2[i + 7] += 0x10000000 & xMask;
|
||||
/* Word 7 is 28 bits wide, so the 2**28 term exactly hits word 8. */
|
||||
tmp2[i + 8] += (x - 1) & xMask;
|
||||
tmp2[i + 7] -= (x << 24) & kBottom28Bits;
|
||||
tmp2[i + 8] -= x >> 4;
|
||||
|
||||
tmp2[i + 8] += 0x20000000 & xMask;
|
||||
tmp2[i + 8] -= x;
|
||||
tmp2[i + 8] += (x << 28) & kBottom29Bits;
|
||||
tmp2[i + 9] += ((x >> 1) - 1) & xMask;
|
||||
|
||||
if (i+1 == NLIMBS)
|
||||
break;
|
||||
tmp2[i + 2] += tmp2[i + 1] >> 28;
|
||||
x = tmp2[i + 1] & kBottom28Bits;
|
||||
xMask = NON_ZERO_TO_ALL_ONES(x);
|
||||
tmp2[i + 1] = 0;
|
||||
|
||||
tmp2[i + 4] += (x << 11) & kBottom29Bits;
|
||||
tmp2[i + 5] += (x >> 18);
|
||||
|
||||
tmp2[i + 7] += (x << 21) & kBottom28Bits;
|
||||
tmp2[i + 8] += x >> 7;
|
||||
|
||||
/* At position 199, which is the starting bit of the 8th word when
|
||||
* dealing with a context starting on an odd word, we have a factor of
|
||||
* 0x1e000000 = 2**29 - 2**25. Since we have not updated i, the 8th
|
||||
* word from i+1 is i+8. */
|
||||
tmp2[i + 8] += 0x20000000 & xMask;
|
||||
tmp2[i + 9] += (x - 1) & xMask;
|
||||
tmp2[i + 8] -= (x << 25) & kBottom29Bits;
|
||||
tmp2[i + 9] -= x >> 4;
|
||||
|
||||
tmp2[i + 9] += 0x10000000 & xMask;
|
||||
tmp2[i + 9] -= x;
|
||||
tmp2[i + 10] += (x - 1) & xMask;
|
||||
}
|
||||
|
||||
/* We merge the right shift with a carry chain. The words above 2**257 have
|
||||
* widths of 28,29,... which we need to correct when copying them down. */
|
||||
carry = 0;
|
||||
for (i = 0; i < 8; i++) {
|
||||
/* The maximum value of tmp2[i + 9] occurs on the first iteration and
|
||||
* is < 2**30+2**29+2**28. Adding 2**29 (from tmp2[i + 10]) is
|
||||
* therefore safe. */
|
||||
out[i] = tmp2[i + 9];
|
||||
out[i] += carry;
|
||||
out[i] += (tmp2[i + 10] << 28) & kBottom29Bits;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
out[i] = tmp2[i + 9] >> 1;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
out[8] = tmp2[17];
|
||||
out[8] += carry;
|
||||
carry = out[8] >> 29;
|
||||
out[8] &= kBottom29Bits;
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_square sets out=in*in.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_square(felem out, const felem in) {
|
||||
u64 tmp[17];
|
||||
|
||||
tmp[0] = ((u64) in[0]) * in[0];
|
||||
tmp[1] = ((u64) in[0]) * (in[1] << 1);
|
||||
tmp[2] = ((u64) in[0]) * (in[2] << 1) +
|
||||
((u64) in[1]) * (in[1] << 1);
|
||||
tmp[3] = ((u64) in[0]) * (in[3] << 1) +
|
||||
((u64) in[1]) * (in[2] << 1);
|
||||
tmp[4] = ((u64) in[0]) * (in[4] << 1) +
|
||||
((u64) in[1]) * (in[3] << 2) + ((u64) in[2]) * in[2];
|
||||
tmp[5] = ((u64) in[0]) * (in[5] << 1) + ((u64) in[1]) *
|
||||
(in[4] << 1) + ((u64) in[2]) * (in[3] << 1);
|
||||
tmp[6] = ((u64) in[0]) * (in[6] << 1) + ((u64) in[1]) *
|
||||
(in[5] << 2) + ((u64) in[2]) * (in[4] << 1) +
|
||||
((u64) in[3]) * (in[3] << 1);
|
||||
tmp[7] = ((u64) in[0]) * (in[7] << 1) + ((u64) in[1]) *
|
||||
(in[6] << 1) + ((u64) in[2]) * (in[5] << 1) +
|
||||
((u64) in[3]) * (in[4] << 1);
|
||||
/* tmp[8] has the greatest value of 2**61 + 2**60 + 2**61 + 2**60 + 2**60,
|
||||
* which is < 2**64 as required. */
|
||||
tmp[8] = ((u64) in[0]) * (in[8] << 1) + ((u64) in[1]) *
|
||||
(in[7] << 2) + ((u64) in[2]) * (in[6] << 1) +
|
||||
((u64) in[3]) * (in[5] << 2) + ((u64) in[4]) * in[4];
|
||||
tmp[9] = ((u64) in[1]) * (in[8] << 1) + ((u64) in[2]) *
|
||||
(in[7] << 1) + ((u64) in[3]) * (in[6] << 1) +
|
||||
((u64) in[4]) * (in[5] << 1);
|
||||
tmp[10] = ((u64) in[2]) * (in[8] << 1) + ((u64) in[3]) *
|
||||
(in[7] << 2) + ((u64) in[4]) * (in[6] << 1) +
|
||||
((u64) in[5]) * (in[5] << 1);
|
||||
tmp[11] = ((u64) in[3]) * (in[8] << 1) + ((u64) in[4]) *
|
||||
(in[7] << 1) + ((u64) in[5]) * (in[6] << 1);
|
||||
tmp[12] = ((u64) in[4]) * (in[8] << 1) +
|
||||
((u64) in[5]) * (in[7] << 2) + ((u64) in[6]) * in[6];
|
||||
tmp[13] = ((u64) in[5]) * (in[8] << 1) +
|
||||
((u64) in[6]) * (in[7] << 1);
|
||||
tmp[14] = ((u64) in[6]) * (in[8] << 1) +
|
||||
((u64) in[7]) * (in[7] << 1);
|
||||
tmp[15] = ((u64) in[7]) * (in[8] << 1);
|
||||
tmp[16] = ((u64) in[8]) * in[8];
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
/* felem_mul sets out=in*in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29 and
|
||||
* in2[0,2,...] < 2**30, in2[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_mul(felem out, const felem in, const felem in2) {
|
||||
u64 tmp[17];
|
||||
|
||||
tmp[0] = ((u64) in[0]) * in2[0];
|
||||
tmp[1] = ((u64) in[0]) * (in2[1] << 0) +
|
||||
((u64) in[1]) * (in2[0] << 0);
|
||||
tmp[2] = ((u64) in[0]) * (in2[2] << 0) + ((u64) in[1]) *
|
||||
(in2[1] << 1) + ((u64) in[2]) * (in2[0] << 0);
|
||||
tmp[3] = ((u64) in[0]) * (in2[3] << 0) + ((u64) in[1]) *
|
||||
(in2[2] << 0) + ((u64) in[2]) * (in2[1] << 0) +
|
||||
((u64) in[3]) * (in2[0] << 0);
|
||||
tmp[4] = ((u64) in[0]) * (in2[4] << 0) + ((u64) in[1]) *
|
||||
(in2[3] << 1) + ((u64) in[2]) * (in2[2] << 0) +
|
||||
((u64) in[3]) * (in2[1] << 1) +
|
||||
((u64) in[4]) * (in2[0] << 0);
|
||||
tmp[5] = ((u64) in[0]) * (in2[5] << 0) + ((u64) in[1]) *
|
||||
(in2[4] << 0) + ((u64) in[2]) * (in2[3] << 0) +
|
||||
((u64) in[3]) * (in2[2] << 0) + ((u64) in[4]) *
|
||||
(in2[1] << 0) + ((u64) in[5]) * (in2[0] << 0);
|
||||
tmp[6] = ((u64) in[0]) * (in2[6] << 0) + ((u64) in[1]) *
|
||||
(in2[5] << 1) + ((u64) in[2]) * (in2[4] << 0) +
|
||||
((u64) in[3]) * (in2[3] << 1) + ((u64) in[4]) *
|
||||
(in2[2] << 0) + ((u64) in[5]) * (in2[1] << 1) +
|
||||
((u64) in[6]) * (in2[0] << 0);
|
||||
tmp[7] = ((u64) in[0]) * (in2[7] << 0) + ((u64) in[1]) *
|
||||
(in2[6] << 0) + ((u64) in[2]) * (in2[5] << 0) +
|
||||
((u64) in[3]) * (in2[4] << 0) + ((u64) in[4]) *
|
||||
(in2[3] << 0) + ((u64) in[5]) * (in2[2] << 0) +
|
||||
((u64) in[6]) * (in2[1] << 0) +
|
||||
((u64) in[7]) * (in2[0] << 0);
|
||||
/* tmp[8] has the greatest value but doesn't overflow. See logic in
|
||||
* felem_square. */
|
||||
tmp[8] = ((u64) in[0]) * (in2[8] << 0) + ((u64) in[1]) *
|
||||
(in2[7] << 1) + ((u64) in[2]) * (in2[6] << 0) +
|
||||
((u64) in[3]) * (in2[5] << 1) + ((u64) in[4]) *
|
||||
(in2[4] << 0) + ((u64) in[5]) * (in2[3] << 1) +
|
||||
((u64) in[6]) * (in2[2] << 0) + ((u64) in[7]) *
|
||||
(in2[1] << 1) + ((u64) in[8]) * (in2[0] << 0);
|
||||
tmp[9] = ((u64) in[1]) * (in2[8] << 0) + ((u64) in[2]) *
|
||||
(in2[7] << 0) + ((u64) in[3]) * (in2[6] << 0) +
|
||||
((u64) in[4]) * (in2[5] << 0) + ((u64) in[5]) *
|
||||
(in2[4] << 0) + ((u64) in[6]) * (in2[3] << 0) +
|
||||
((u64) in[7]) * (in2[2] << 0) +
|
||||
((u64) in[8]) * (in2[1] << 0);
|
||||
tmp[10] = ((u64) in[2]) * (in2[8] << 0) + ((u64) in[3]) *
|
||||
(in2[7] << 1) + ((u64) in[4]) * (in2[6] << 0) +
|
||||
((u64) in[5]) * (in2[5] << 1) + ((u64) in[6]) *
|
||||
(in2[4] << 0) + ((u64) in[7]) * (in2[3] << 1) +
|
||||
((u64) in[8]) * (in2[2] << 0);
|
||||
tmp[11] = ((u64) in[3]) * (in2[8] << 0) + ((u64) in[4]) *
|
||||
(in2[7] << 0) + ((u64) in[5]) * (in2[6] << 0) +
|
||||
((u64) in[6]) * (in2[5] << 0) + ((u64) in[7]) *
|
||||
(in2[4] << 0) + ((u64) in[8]) * (in2[3] << 0);
|
||||
tmp[12] = ((u64) in[4]) * (in2[8] << 0) + ((u64) in[5]) *
|
||||
(in2[7] << 1) + ((u64) in[6]) * (in2[6] << 0) +
|
||||
((u64) in[7]) * (in2[5] << 1) +
|
||||
((u64) in[8]) * (in2[4] << 0);
|
||||
tmp[13] = ((u64) in[5]) * (in2[8] << 0) + ((u64) in[6]) *
|
||||
(in2[7] << 0) + ((u64) in[7]) * (in2[6] << 0) +
|
||||
((u64) in[8]) * (in2[5] << 0);
|
||||
tmp[14] = ((u64) in[6]) * (in2[8] << 0) + ((u64) in[7]) *
|
||||
(in2[7] << 1) + ((u64) in[8]) * (in2[6] << 0);
|
||||
tmp[15] = ((u64) in[7]) * (in2[8] << 0) +
|
||||
((u64) in[8]) * (in2[7] << 0);
|
||||
tmp[16] = ((u64) in[8]) * (in2[8] << 0);
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
static void felem_assign(felem out, const felem in) {
|
||||
memcpy(out, in, sizeof(felem));
|
||||
}
|
||||
|
||||
/* felem_inv calculates |out| = |in|^{-1}
|
||||
*
|
||||
* Based on Fermat's Little Theorem:
|
||||
@ -667,130 +105,6 @@ static void felem_inv(felem out, const felem in) {
|
||||
felem_mul(out, ftmp2, ftmp); /* 2^256 - 2^224 + 2^192 + 2^96 - 3 */
|
||||
}
|
||||
|
||||
/* felem_scalar_3 sets out=3*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_scalar_3(felem out) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 29;
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 28;
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_4 sets out=4*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_scalar_4(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 27;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom29Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 29);
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 26;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom28Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 28);
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_8 sets out=8*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.
|
||||
* On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */
|
||||
static void felem_scalar_8(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 26;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom29Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 29);
|
||||
out[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 25;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom28Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 28);
|
||||
out[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_is_zero_vartime returns 1 iff |in| == 0. It takes a variable amount of
|
||||
* time depending on the value of |in|. */
|
||||
static char felem_is_zero_vartime(const felem in) {
|
||||
limb carry;
|
||||
int i;
|
||||
limb tmp[NLIMBS];
|
||||
|
||||
felem_assign(tmp, in);
|
||||
|
||||
/* First, reduce tmp to a minimal form. */
|
||||
do {
|
||||
carry = 0;
|
||||
for (i = 0;; i++) {
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 29;
|
||||
tmp[i] &= kBottom29Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 28;
|
||||
tmp[i] &= kBottom28Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(tmp, carry);
|
||||
} while (carry);
|
||||
|
||||
/* tmp < 2**257, so the only possible zero values are 0, p and 2p. */
|
||||
return memcmp(tmp, kZero, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, kP, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, k2P, sizeof(tmp)) == 0;
|
||||
}
|
||||
|
||||
|
||||
/* Group operations:
|
||||
*
|
||||
@ -971,9 +285,9 @@ static void point_add_or_double_vartime(
|
||||
felem_diff(y_out, y_out, tmp);
|
||||
}
|
||||
|
||||
/* copy_conditional sets out=in if mask = 0xffffffff in constant time.
|
||||
/* copy_conditional sets out=in if mask = -1 in constant time.
|
||||
*
|
||||
* On entry: mask is either 0 or 0xffffffff. */
|
||||
* On entry: mask is either 0 or -1. */
|
||||
static void copy_conditional(felem out, const felem in, limb mask) {
|
||||
int i;
|
||||
|
||||
@ -1168,58 +482,6 @@ static void scalar_mult(felem nx, felem ny, felem nz, const felem x,
|
||||
}
|
||||
}
|
||||
|
||||
#define kRDigits {2, 0, 0, 0xfffffffe, 0xffffffff, 0xffffffff, 0xfffffffd, 1} // 2^257 mod p256.p
|
||||
|
||||
#define kRInvDigits {0x80000000, 1, 0xffffffff, 0, 0x80000001, 0xfffffffe, 1, 0x7fffffff} // 1 / 2^257 mod p256.p
|
||||
|
||||
static const cryptonite_p256_int kR = { kRDigits };
|
||||
static const cryptonite_p256_int kRInv = { kRInvDigits };
|
||||
|
||||
/* to_montgomery sets out = R*in. */
|
||||
static void to_montgomery(felem out, const cryptonite_p256_int* in) {
|
||||
cryptonite_p256_int in_shifted;
|
||||
int i;
|
||||
|
||||
cryptonite_p256_init(&in_shifted);
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);
|
||||
|
||||
for (i = 0; i < NLIMBS; i++) {
|
||||
if ((i & 1) == 0) {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom29Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 29, &in_shifted);
|
||||
} else {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom28Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 28, &in_shifted);
|
||||
}
|
||||
}
|
||||
|
||||
cryptonite_p256_clear(&in_shifted);
|
||||
}
|
||||
|
||||
/* from_montgomery sets out=in/R. */
|
||||
static void from_montgomery(cryptonite_p256_int* out, const felem in) {
|
||||
cryptonite_p256_int result, tmp;
|
||||
int i, top;
|
||||
|
||||
cryptonite_p256_init(&result);
|
||||
cryptonite_p256_init(&tmp);
|
||||
|
||||
cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);
|
||||
for (i = NLIMBS - 2; i >= 0; i--) {
|
||||
if ((i & 1) == 0) {
|
||||
top = cryptonite_p256_shl(&result, 29, &tmp);
|
||||
} else {
|
||||
top = cryptonite_p256_shl(&result, 28, &tmp);
|
||||
}
|
||||
top |= cryptonite_p256_add_d(&tmp, in[i], &result);
|
||||
}
|
||||
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);
|
||||
|
||||
cryptonite_p256_clear(&result);
|
||||
cryptonite_p256_clear(&tmp);
|
||||
}
|
||||
|
||||
/* cryptonite_p256_base_point_mul sets {out_x,out_y} = nG, where n is < the
|
||||
* order of the group. */
|
||||
void cryptonite_p256_base_point_mul(const cryptonite_p256_int* n, cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {
|
||||
|
||||
@ -50,7 +50,8 @@ extra-source-files: cbits/*.h
|
||||
cbits/decaf/p448/*.h
|
||||
cbits/decaf/ed448goldilocks/decaf_tables.c
|
||||
cbits/decaf/ed448goldilocks/decaf.c
|
||||
cbits/p256/*.h
|
||||
cbits/include32/p256/*.h
|
||||
cbits/include64/p256/*.h
|
||||
cbits/blake2/ref/*.h
|
||||
cbits/blake2/sse/*.h
|
||||
cbits/argon2/*.h
|
||||
@ -284,6 +285,11 @@ Library
|
||||
, cbits/decaf/include
|
||||
, cbits/decaf/p448
|
||||
|
||||
if arch(x86_64) || arch(aarch64)
|
||||
include-dirs: cbits/include64
|
||||
else
|
||||
include-dirs: cbits/include32
|
||||
|
||||
if arch(x86_64) || arch(aarch64)
|
||||
C-sources: cbits/decaf/p448/arch_ref64/f_impl.c
|
||||
, cbits/decaf/p448/f_generic.c
|
||||
|
||||
Loading…
Reference in New Issue
Block a user