mirror of
https://github.com/kazu-yamamoto/crypton.git
synced 2024-10-04 07:50:45 +03:00
Add 64-bit implementation for p256
This commit is contained in:
Olivier Chéron
parent
f9a6a35ce3
commit
b08ce5e3ae
@ -25,7 +25,7 @@
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 finite field. It's written to be
|
||||
// be portable 32-bit, although it's still constant-time.
|
||||
// portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
167
cbits/include64/p256/p256.h
Normal file
167
cbits/include64/p256/p256.h
Normal file
@ -0,0 +1,167 @@
|
||||
/*
|
||||
* Copyright 2013 The Android Open Source Project
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* * Neither the name of Google Inc. nor the names of its contributors may
|
||||
* be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
||||
* EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
||||
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#ifndef SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_
|
||||
#define SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_
|
||||
|
||||
// Collection of routines manipulating 256 bit unsigned integers.
|
||||
// Just enough to implement ecdsa-p256 and related algorithms.
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#define P256_BITSPERDIGIT 64
|
||||
#define P256_NDIGITS 4
|
||||
#define P256_NBYTES 32
|
||||
|
||||
// n' such as n * n' = -1 mod (2^64)
|
||||
#define P256_MONTGOMERY_FACTOR 0xCCD1C8AAEE00BC4F
|
||||
|
||||
#define P256_LITERAL(lo,hi) (((uint32_t) (lo)) + (((uint64_t) (hi)) << 32))
|
||||
|
||||
typedef int cryptonite_p256_err;
|
||||
typedef uint64_t cryptonite_p256_digit;
|
||||
typedef int64_t cryptonite_p256_sdigit;
|
||||
typedef __uint128_t cryptonite_p256_ddigit;
|
||||
typedef __int128_t cryptonite_p256_sddigit;
|
||||
|
||||
// Defining cryptonite_p256_int as struct to leverage struct assigment.
|
||||
typedef struct {
|
||||
cryptonite_p256_digit a[P256_NDIGITS];
|
||||
} cryptonite_p256_int;
|
||||
|
||||
extern const cryptonite_p256_int cryptonite_SECP256r1_n; // Curve order
|
||||
extern const cryptonite_p256_int cryptonite_SECP256r1_p; // Curve prime
|
||||
extern const cryptonite_p256_int cryptonite_SECP256r1_b; // Curve param
|
||||
|
||||
// Initialize a cryptonite_p256_int to zero.
|
||||
void cryptonite_p256_init(cryptonite_p256_int* a);
|
||||
|
||||
// Clear a cryptonite_p256_int to zero.
|
||||
void cryptonite_p256_clear(cryptonite_p256_int* a);
|
||||
|
||||
// Return bit. Index 0 is least significant.
|
||||
int cryptonite_p256_get_bit(const cryptonite_p256_int* a, int index);
|
||||
|
||||
// b := a % MOD
|
||||
void cryptonite_p256_mod(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
cryptonite_p256_int* b);
|
||||
|
||||
// c := a * (top_b | b) % MOD
|
||||
void cryptonite_p256_modmul(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
const cryptonite_p256_digit top_b,
|
||||
const cryptonite_p256_int* b,
|
||||
cryptonite_p256_int* c);
|
||||
|
||||
// b := 1 / a % MOD
|
||||
// MOD best be SECP256r1_n
|
||||
void cryptonite_p256_modinv(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
cryptonite_p256_int* b);
|
||||
|
||||
// b := 1 / a % MOD
|
||||
// MOD best be SECP256r1_n
|
||||
// Faster than cryptonite_p256_modinv()
|
||||
void cryptonite_p256_modinv_vartime(
|
||||
const cryptonite_p256_int* MOD,
|
||||
const cryptonite_p256_int* a,
|
||||
cryptonite_p256_int* b);
|
||||
|
||||
// b := a << (n % P256_BITSPERDIGIT)
|
||||
// Returns the bits shifted out of most significant digit.
|
||||
cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
|
||||
|
||||
// b := a >> (n % P256_BITSPERDIGIT)
|
||||
void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
|
||||
|
||||
int cryptonite_p256_is_zero(const cryptonite_p256_int* a);
|
||||
int cryptonite_p256_is_odd(const cryptonite_p256_int* a);
|
||||
int cryptonite_p256_is_even(const cryptonite_p256_int* a);
|
||||
|
||||
// Returns -1, 0 or 1.
|
||||
int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int *b);
|
||||
|
||||
// c: = a - b
|
||||
// Returns -1 on borrow.
|
||||
int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
|
||||
|
||||
// c := a + b
|
||||
// Returns 1 on carry.
|
||||
int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
|
||||
|
||||
// c := a + (single digit)b
|
||||
// Returns carry 1 on carry.
|
||||
int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit b, cryptonite_p256_int* c);
|
||||
|
||||
// ec routines.
|
||||
|
||||
// {out_x,out_y} := nG
|
||||
void cryptonite_p256_base_point_mul(const cryptonite_p256_int *n,
|
||||
cryptonite_p256_int *out_x,
|
||||
cryptonite_p256_int *out_y);
|
||||
|
||||
// {out_x,out_y} := n{in_x,in_y}
|
||||
void cryptonite_p256_point_mul(const cryptonite_p256_int *n,
|
||||
const cryptonite_p256_int *in_x,
|
||||
const cryptonite_p256_int *in_y,
|
||||
cryptonite_p256_int *out_x,
|
||||
cryptonite_p256_int *out_y);
|
||||
|
||||
// {out_x,out_y} := n1G + n2{in_x,in_y}
|
||||
void cryptonite_p256_points_mul_vartime(
|
||||
const cryptonite_p256_int *n1, const cryptonite_p256_int *n2,
|
||||
const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,
|
||||
cryptonite_p256_int *out_x, cryptonite_p256_int *out_y);
|
||||
|
||||
// Return whether point {x,y} is on curve.
|
||||
int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y);
|
||||
|
||||
// Outputs big-endian binary form. No leading zero skips.
|
||||
void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES]);
|
||||
|
||||
// Reads from big-endian binary form,
|
||||
// thus pre-pad with leading zeros if short.
|
||||
void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst);
|
||||
|
||||
#define P256_DIGITS(x) ((x)->a)
|
||||
#define P256_DIGIT(x,y) ((x)->a[y])
|
||||
|
||||
#define P256_ZERO {{0}}
|
||||
#define P256_ONE {{1}}
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_
|
||||
707
cbits/include64/p256/p256_gf.h
Normal file
707
cbits/include64/p256/p256_gf.h
Normal file
@ -0,0 +1,707 @@
|
||||
/*
|
||||
* Copyright 2013 The Android Open Source Project
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* * Neither the name of Google Inc. nor the names of its contributors may
|
||||
* be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
||||
* EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
||||
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||||
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||||
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 finite field. It's written to be
|
||||
// portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
//
|
||||
// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include "p256/p256.h"
|
||||
|
||||
typedef uint8_t u8;
|
||||
typedef uint32_t u32;
|
||||
typedef uint64_t u64;
|
||||
typedef int64_t s64;
|
||||
typedef __uint128_t u128;
|
||||
|
||||
/* Our field elements are represented as five 64-bit limbs.
|
||||
*
|
||||
* The value of an felem (field element) is:
|
||||
* x[0] + (x[1] * 2**51) + (x[2] * 2**103) + ... + (x[4] * 2**206)
|
||||
*
|
||||
* That is, each limb is alternately 51 or 52-bits wide in little-endian
|
||||
* order.
|
||||
*
|
||||
* This means that an felem hits 2**257, rather than 2**256 as we would like.
|
||||
*
|
||||
* Finally, the values stored in an felem are in Montgomery form. So the value
|
||||
* |y| is stored as (y*R) mod p, where p is the P-256 prime and R is 2**257.
|
||||
*/
|
||||
typedef u64 limb;
|
||||
#define NLIMBS 5
|
||||
typedef limb felem[NLIMBS];
|
||||
|
||||
static const limb kBottom51Bits = 0x7ffffffffffff;
|
||||
static const limb kBottom52Bits = 0xfffffffffffff;
|
||||
|
||||
/* kOne is the number 1 as an felem. It's 2**257 mod p split up into 51 and
|
||||
* 52-bit words. */
|
||||
static const felem kOne = {
|
||||
2, 0xfc00000000000, 0x7ffffffffffff, 0xfff7fffffffff, 0x7ffff
|
||||
};
|
||||
static const felem kZero = {0};
|
||||
static const felem kP = {
|
||||
0x7ffffffffffff, 0x1fffffffffff, 0, 0x4000000000, 0x3fffffffc0000
|
||||
};
|
||||
static const felem k2P = {
|
||||
0x7fffffffffffe, 0x3fffffffffff, 0, 0x8000000000, 0x7fffffff80000
|
||||
};
|
||||
/* kPrecomputed contains precomputed values to aid the calculation of scalar
|
||||
* multiples of the base point, G. It's actually two, equal length, tables
|
||||
* concatenated.
|
||||
*
|
||||
* The first table contains (x,y) felem pairs for 16 multiples of the base
|
||||
* point, G.
|
||||
*
|
||||
* Index | Index (binary) | Value
|
||||
* 0 | 0000 | 0G (all zeros, omitted)
|
||||
* 1 | 0001 | G
|
||||
* 2 | 0010 | 2**64G
|
||||
* 3 | 0011 | 2**64G + G
|
||||
* 4 | 0100 | 2**128G
|
||||
* 5 | 0101 | 2**128G + G
|
||||
* 6 | 0110 | 2**128G + 2**64G
|
||||
* 7 | 0111 | 2**128G + 2**64G + G
|
||||
* 8 | 1000 | 2**192G
|
||||
* 9 | 1001 | 2**192G + G
|
||||
* 10 | 1010 | 2**192G + 2**64G
|
||||
* 11 | 1011 | 2**192G + 2**64G + G
|
||||
* 12 | 1100 | 2**192G + 2**128G
|
||||
* 13 | 1101 | 2**192G + 2**128G + G
|
||||
* 14 | 1110 | 2**192G + 2**128G + 2**64G
|
||||
* 15 | 1111 | 2**192G + 2**128G + 2**64G + G
|
||||
*
|
||||
* The second table follows the same style, but the terms are 2**32G,
|
||||
* 2**96G, 2**160G, 2**224G.
|
||||
*
|
||||
* This is ~2KB of data. */
|
||||
static const limb kPrecomputed[NLIMBS * 2 * 15 * 2] = {
|
||||
0x661a831522878, 0xf17fb6d805e79, 0x5889441d6ea57, 0xae33cfdb995bb, 0xc482fbb529ba,
|
||||
0x4a6af9d2aac15, 0x90e867917377c, 0x487cc962d2ae3, 0xec2a97443446e, 0x2b8ff8c52c42,
|
||||
0x45f8a2d41a576, 0xb06988d2653e4, 0x718b22c357305, 0x33fc920e79d2b, 0x17af34b0fe8db,
|
||||
0x38e17eb402f2f, 0x3382558649705, 0x47f6d48f482d1, 0x7bd42488d9b83, 0x3b247c8b86b78,
|
||||
0x4d08fc26f7778, 0x7a29a82fb2795, 0x75cd18f90d11a, 0xad8e213b0bc, 0x2d5f0142899e8,
|
||||
0x506f98098fb57, 0x2f0c98301e4aa, 0x39b30dd5cf67d, 0x9c146498ab13c, 0xa5db92df5b7b,
|
||||
0x184897fc4124a, 0xe3f73a19d8aa, 0x4e1c18e47066b, 0x27b2d4b52eaee, 0x30eac3ea10e99,
|
||||
0x4e74546e2e7d5, 0x1f4dde2d97a1d, 0x6ead0f88e1200, 0x7dec87c220f02, 0x3d08ff096310f,
|
||||
0x23e5659633ffa, 0x6ec648f08c722, 0x3172a3806ea35, 0xf6e5b681eb3c5, 0x2c3758260f89d,
|
||||
0x38dca4fd1da12, 0xf06067b78830d, 0x3194be87a068c, 0x78893c7eb602b, 0xcead60438432,
|
||||
0x6ee69a56a67ab, 0xd886f77701895, 0x67b0a4d9cee2b, 0x3586bbf3e4d53, 0x1db6f32921d93,
|
||||
0x260756ca4b366, 0x4f40e9d2039fa, 0x4f3f09f5a82bf, 0xccde2d641e8cd, 0x305a30cd2e8c5,
|
||||
0x471c235cb5439, 0xab279cd962f5a, 0x17e1fb6e2dd94, 0xfe64589800a77, 0xe8793d99775f,
|
||||
0x48c62f4e614aa, 0xbf76ef20eb2a4, 0x669c672556c, 0x24683e0eff056, 0x12252b369ab76,
|
||||
0x821de9f162d5, 0xf911ec99a95be, 0x6721f065c906b, 0x58d452035c736, 0x1f9f01a6a15,
|
||||
0x6135009b7d8d3, 0xdaeeeb417dfc0, 0x63865fea0ee17, 0x6e0a304b939d6, 0x204ba2076833d,
|
||||
0x4ade586f35669, 0x2c1077e34611a, 0x5b1a3bea3b81a, 0xf97d018a22c8b, 0x38d7996b08af8,
|
||||
0x6ea62baeb7aa0, 0xebdcbd9ef2670, 0x35dc8fe0df3fe, 0xe458309d20c24, 0x11e87898716a0,
|
||||
0x7c44bab7cb456, 0xd64d3cf1bb64, 0x189bff1bf9e66, 0xb5218a049311, 0x285dda6cbcc81,
|
||||
0x3238dcafd8c7c, 0x607736c8de0, 0xdb83d99508b1, 0x4e1a0d404cd81, 0x1588008c00ff2,
|
||||
0x16b8b36722b27, 0x876609c3f3f1a, 0x66b72ef0e17d6, 0x705f8a279d568, 0x2eaac4cd01fdd,
|
||||
0x1171ce9705fe9, 0xffc79cd3264ee, 0x700c8ab4b80f0, 0x208d3d4f57a1, 0x337262a8ca4eb,
|
||||
0x297fd01d843fd, 0xa90956fa097f8, 0x529759fdb3845, 0x1d78c5e2d0397, 0x3d6938a4adbf3,
|
||||
0x16d5853560b66, 0xf138946b9a430, 0x2ab79f4dea6a0, 0xd42053ee43ae1, 0x3b9c3ef1cf870,
|
||||
0x598934ad81baf, 0x5f1821b1d07a7, 0x416bb3a973ff3, 0x23f07bd0a047a, 0x19bdc2e09f786,
|
||||
0x56dc9981cd51f, 0xfbace23c8cd65, 0x673bd3bf5b52e, 0x46a95d229fd61, 0xe09ad64bcfb1,
|
||||
0xe5292b91f17d, 0xfeefcd8afc287, 0x58f52b0a58711, 0x4800f20c201ef, 0x2084fce608f67,
|
||||
0x12ba0b128ae0b, 0x5977ae17030b4, 0x101126ee420f6, 0xf70823495c6bd, 0xde19a27d7770,
|
||||
0x5c6ac852260e8, 0x9d22950ac4356, 0x441cca955246c, 0x660a34e5332d9, 0x14ac8ea92f8d2,
|
||||
0x6b6d7709f307e, 0x67d7e13879db, 0x2ea8626f9fbbd, 0x99609006a4b40, 0x31bb2a8f8c779,
|
||||
0x10c04828ea335, 0xae9acdcbc080a, 0x617af2342607a, 0xc7494ea53e553, 0x2ca9e2872defa,
|
||||
0x6c399fab21f1f, 0xab139b245e758, 0x3ad933dcba589, 0x4797fecb08811, 0x31f5dbf8f594,
|
||||
0x7dc6361cc7a69, 0xc8a7953ead3f9, 0x79ed693d18015, 0x418a024999a6a, 0x2c4fdc9436aa,
|
||||
0x1eb98cb06aa75, 0x2989592796a9c, 0x11194821e425, 0xe27a648228388, 0x35d834b6c12a0,
|
||||
0x541807713b532, 0x7ae0a1008aaee, 0x7017a29bcb5e, 0x6b193c23c315c, 0x19bd25ac82f2a,
|
||||
0x6a01a43eef294, 0xddf5b5fd84f19, 0x33f5ba081c016, 0xdeb052d1bc082, 0x6b2f06afa617,
|
||||
0x7ca1eda6a939f, 0xbdeb35997b50c, 0x47f2d1bccda5, 0xc2ff4adfed667, 0x87712997be4,
|
||||
0x21fc2e2b37659, 0xf7d62cd5ed951, 0x27fa9cbdf7efa, 0xba25582bf3a6b, 0x2a42b8bd89398,
|
||||
0x6d377d07eecd2, 0x9ca1df5af387, 0x1109e3427e2ba, 0xce4aa4572a19, 0x103baaef71e16,
|
||||
0x2c3b2dfde328a, 0xbec4b4a30e1ef, 0x37d92a86204f3, 0x806cfde68eb39, 0x246e2f72b8aa5,
|
||||
0x68d3de93462a9, 0x53b8acba6bbc3, 0x2492a70fa1696, 0x38c62d5760f55, 0x15096fe4904f2,
|
||||
0x4e44e9bed3e3a, 0xb28bfd79cc9bc, 0x6a77513839320, 0x480dcec6739db, 0x3601b739f2465,
|
||||
0x43c348e2a7e1, 0xe448106327879, 0x175d9cae1b0ed, 0xd3b89dee743b8, 0x392d73ca255bc,
|
||||
0x32946db0d3a18, 0x9261b09907cc, 0x5ba517a755722, 0x51f24fdaf5184, 0x1cdc732989ed8,
|
||||
0x2f7806ba16694, 0xae0c9f029f8d0, 0xd8b45102ce1, 0xca1c7db9316d6, 0x162088a67066f,
|
||||
0x39de35b2b4162, 0xa19f550d88ae9, 0x7921b27026cde, 0x94b936b66e900, 0x1023bd5fa17fc,
|
||||
0x436837814cfa4, 0x29113492283c4, 0x66d1cdd8b51d8, 0xa540702278eb2, 0x47ef1b29285d,
|
||||
0x587b50917e50e, 0xb4cda75bab3b, 0x112520b0a9886, 0x66b9ac16fee49, 0x17bf17e92b2eb,
|
||||
0x2456a2f150ed7, 0xfa214412d0280, 0x3ca7dd947fe5b, 0xa72c28598d58a, 0x255d945efc3e,
|
||||
0x2873f04e0f215, 0x74178fd1af57b, 0x788848b5b2d6, 0xb1ffafaae0db6, 0x32a1b7b3cbb2a,
|
||||
0x4bd9935d6b2da, 0x9c08f24ad30a5, 0x4e58407a80f, 0x1b3a3825a5b17, 0x6547e9fc82f5,
|
||||
0x47484aa3656c3, 0x6ee43f341a494, 0x64a98f87adea2, 0x619b3f8e95f01, 0xb6e513266ed8,
|
||||
0x421c2a673090, 0xa1c1de32348c7, 0x55b85c3a1e8a3, 0xe05ce8ef330b4, 0x2561e49c15d84,
|
||||
0x40aa2d33130fa, 0x12b827d35866f, 0xfe4cf62c8ddb, 0x2fa0ef05bb28d, 0x1c06ca63f1cb8,
|
||||
0x32a971863863b, 0xff6fc86830da1, 0x71e7b25a14cf3, 0xea9c5ebb1373a, 0x250bbaa3e1634,
|
||||
0x5b5ffeda5b765, 0xf25d2a746331b, 0x115e3a3f43632, 0x67303af43c9d5, 0x14bb538a0e559,
|
||||
0x75623687d43b7, 0xa349674a4b38d, 0x613c61829ffc6, 0x689828d8110c7, 0x139115f5af7d5,
|
||||
0xf1d856152289, 0x45cbe967168ab, 0x51f38e1680901, 0x34808e8f652b0, 0x1f4a6a921e156,
|
||||
0x35dfaf3d8341f, 0xf53ace725cb63, 0x3d86a54eef35b, 0xa103aabaffe2c, 0x2decc36296fbd,
|
||||
0x510282be73d6f, 0xd4e6365db206a, 0x4bdc5f5bb8bf3, 0xde7ea32a3aee7, 0x71269e274305,
|
||||
};
|
||||
|
||||
|
||||
/* Field element operations: */
|
||||
|
||||
/* NON_ZERO_TO_ALL_ONES returns:
|
||||
* 0xffffffffffffffff for 0 < x <= 2**63
|
||||
* 0 for x == 0 or x > 2**63.
|
||||
*
|
||||
* x must be a u64 or an equivalent type such as limb. */
|
||||
#define NON_ZERO_TO_ALL_ONES(x) ((((u64)(x) - 1) >> 63) - 1)
|
||||
|
||||
/* felem_reduce_carry adds a multiple of p in order to cancel |carry|,
|
||||
* which is a term at 2**257.
|
||||
*
|
||||
* On entry: carry < 2**6, inout[0,2,...] < 2**51, inout[1,3,...] < 2**52.
|
||||
* On exit: inout[0,2,..] < 2**52, inout[1,3,...] < 2**53. */
|
||||
static void felem_reduce_carry(felem inout, limb carry) {
|
||||
const u64 carry_mask = NON_ZERO_TO_ALL_ONES(carry);
|
||||
|
||||
inout[0] += carry << 1;
|
||||
inout[1] += 0x10000000000000 & carry_mask;
|
||||
/* carry < 2**6 thus (carry << 46) < 2**52 and we added 2**52 in the
|
||||
* previous line therefore this doesn't underflow. */
|
||||
inout[1] -= carry << 46;
|
||||
inout[2] += (0x8000000000000 - 1) & carry_mask;
|
||||
inout[3] += (0x10000000000000 - 1) & carry_mask;
|
||||
inout[3] -= carry << 39;
|
||||
/* This may underflow if carry is non-zero but, if so, we'll fix it in the
|
||||
* next line. */
|
||||
inout[4] -= 1 & carry_mask;
|
||||
inout[4] += carry << 19;
|
||||
}
|
||||
|
||||
/* felem_sum sets out = in+in2.
|
||||
*
|
||||
* On entry, in[i]+in2[i] must not overflow a 64-bit word.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53 */
|
||||
static void felem_sum(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] + in2[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* zero31 is 0 mod p. */
|
||||
static const felem zero31 = { 0xffffffffffffc0, 0x1f7ffffffffffe0, 0xf7ffffffffffe1, 0x1f00fffffffffe1, 0xfffffffeffffe1 };
|
||||
|
||||
/* felem_diff sets out = in-in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**52, in[1,3,...] < 2**53 and
|
||||
* in2[0,2,...] < 2**52, in2[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_diff(felem out, const felem in, const felem in2) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero31[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] = in[i] - in2[i];
|
||||
out[i] += zero31[i];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_reduce_degree sets out = tmp/R mod p where tmp contains 64-bit words
|
||||
* with the same 51,52,... bit positions as an felem.
|
||||
*
|
||||
* The values in felems are in Montgomery form: x*R mod p where R = 2**257.
|
||||
* Since we just multiplied two Montgomery values together, the result is
|
||||
* x*y*R*R mod p. We wish to divide by R in order for the result also to be
|
||||
* in Montgomery form.
|
||||
*
|
||||
* On entry: tmp[i] < 2**128
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53 */
|
||||
static void felem_reduce_degree(felem out, u128 tmp[9]) {
|
||||
/* The following table may be helpful when reading this code:
|
||||
*
|
||||
* Limb number: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10
|
||||
* Width (bits): 51| 52| 51| 52| 51| 52| 51| 52| 51| 52| 51
|
||||
* Start bit: 0 | 51|103|154|206|257|309|360|412|463|515
|
||||
* (odd phase): 0 | 52|103|155|206|258|309|361|412|464|515 */
|
||||
limb tmp2[10], carry, x, xShiftedMask;
|
||||
unsigned i;
|
||||
|
||||
/* tmp contains 128-bit words with the same 51,52,51-bit positions as an
|
||||
* felem. So the top of an element of tmp might overlap with another
|
||||
* element two positions down. The following loop eliminates this
|
||||
* overlap. */
|
||||
tmp2[0] = (limb)(tmp[0] & kBottom51Bits);
|
||||
|
||||
/* In the following we use "(limb) tmp[x]" and "(limb) (tmp[x]>>64)" to try
|
||||
* and hint to the compiler that it can do a single-word shift by selecting
|
||||
* the right register rather than doing a double-word shift and truncating
|
||||
* afterwards. */
|
||||
tmp2[1] = ((limb) tmp[0]) >> 51;
|
||||
tmp2[1] |= (((limb)(tmp[0] >> 64)) << 13) & kBottom52Bits;
|
||||
tmp2[1] += ((limb) tmp[1]) & kBottom52Bits;
|
||||
carry = tmp2[1] >> 52;
|
||||
tmp2[1] &= kBottom52Bits;
|
||||
|
||||
for (i = 2; i < 9; i++) {
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 64)) >> 39;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 52;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 64)) << 12) & kBottom51Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom51Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 51;
|
||||
tmp2[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == 9)
|
||||
break;
|
||||
tmp2[i] = ((limb)(tmp[i - 2] >> 64)) >> 39;
|
||||
tmp2[i] += ((limb)(tmp[i - 1])) >> 51;
|
||||
tmp2[i] += (((limb)(tmp[i - 1] >> 64)) << 13) & kBottom52Bits;
|
||||
tmp2[i] += ((limb) tmp[i]) & kBottom52Bits;
|
||||
tmp2[i] += carry;
|
||||
carry = tmp2[i] >> 52;
|
||||
tmp2[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
tmp2[9] = ((limb)(tmp[7] >> 64)) >> 39;
|
||||
tmp2[9] += ((limb)(tmp[8])) >> 51;
|
||||
tmp2[9] += (((limb)(tmp[8] >> 64)) << 13);
|
||||
tmp2[9] += carry;
|
||||
|
||||
/* Montgomery elimination of terms.
|
||||
*
|
||||
* Since R is 2**257, we can divide by R with a bitwise shift if we can
|
||||
* ensure that the right-most 257 bits are all zero. We can make that true by
|
||||
* adding multiplies of p without affecting the value.
|
||||
*
|
||||
* So we eliminate limbs from right to left. Since the bottom 51 bits of p
|
||||
* are all ones, then by adding tmp2[0]*p to tmp2 we'll make tmp2[0] == 0.
|
||||
* We can do that for 8 further limbs and then right shift to eliminate the
|
||||
* extra factor of R. */
|
||||
for (i = 0;; i += 2) {
|
||||
tmp2[i + 1] += tmp2[i] >> 51;
|
||||
x = tmp2[i] & kBottom51Bits;
|
||||
xShiftedMask = NON_ZERO_TO_ALL_ONES(x >> 1);
|
||||
tmp2[i] = 0;
|
||||
|
||||
/* The bounds calculations for this loop are tricky. Each iteration of
|
||||
* the loop eliminates two words by adding values to words to their
|
||||
* right.
|
||||
*
|
||||
* The following table contains the amounts added to each word (as an
|
||||
* offset from the value of i at the top of the loop). The amounts are
|
||||
* accounted for from the first and second half of the loop separately
|
||||
* and are written as, for example, 51 to mean a value <2**51.
|
||||
*
|
||||
* Word: 1 2 3 4 5 6
|
||||
* Added in top half: 52 44 52 37 50
|
||||
* 51
|
||||
* 51
|
||||
* Added in bottom half: 51 45 51 38 50
|
||||
* 52
|
||||
* 52
|
||||
*
|
||||
* The value that is currently offset 5 will be offset 3 for the next
|
||||
* iteration and then offset 1 for the iteration after that. Therefore
|
||||
* the total value added will be the values added at 5, 3 and 1.
|
||||
*
|
||||
* The following table accumulates these values. The sums at the bottom
|
||||
* are written as, for example, 53+45, to mean a value < 2**53+2**45.
|
||||
*
|
||||
* Word: 1 2 3 4 5 6 7 8 9
|
||||
* 52 44 52 37 50 50 50 50 50
|
||||
* 51 45 51 38 37 38 37
|
||||
* 52 51 52 51 52 51
|
||||
* 51 52 51 52 51
|
||||
* 44 52 51 52
|
||||
* 51 45 44
|
||||
* 52
|
||||
* ------------------------------------
|
||||
* 53+ 53+ 54+ 52+ 53+ 52+
|
||||
* 45 44+ 50+ 51+ 52+ 50+
|
||||
* 37 45+ 50+ 50+ 37
|
||||
* 38 44+ 38
|
||||
* 37
|
||||
*
|
||||
* So the greatest amount is added to tmp2[5]. If tmp2[5] has an initial
|
||||
* value of <2**52, then the maximum value will be < 2**54 + 2**52 + 2**50 +
|
||||
* 2**45 + 2**38, which is < 2**64, as required. */
|
||||
tmp2[i + 1] += (x << 45) & kBottom52Bits;
|
||||
tmp2[i + 2] += x >> 7;
|
||||
|
||||
tmp2[i + 3] += (x << 38) & kBottom52Bits;
|
||||
tmp2[i + 4] += x >> 14;
|
||||
|
||||
/* On tmp2[i + 4], when x < 2**1, the subtraction with (x << 18) will not
|
||||
* underflow because it is balanced with the (x << 50) term. On the next
|
||||
* word tmp2[i + 5], terms with (x >> 1) and (x >> 33) are both zero and
|
||||
* there is no underflow either.
|
||||
*
|
||||
* When x >= 2**1, we add 2**51 to tmp2[i + 4] to avoid an underflow.
|
||||
* Removing 1 from tmp2[i + 5] is safe because (x >> 1) - (x >> 33) is
|
||||
* strictly positive.
|
||||
*/
|
||||
tmp2[i + 4] += 0x8000000000000 & xShiftedMask;
|
||||
tmp2[i + 5] -= 1 & xShiftedMask;
|
||||
|
||||
tmp2[i + 4] -= (x << 18) & kBottom51Bits;
|
||||
tmp2[i + 4] += (x << 50) & kBottom51Bits;
|
||||
tmp2[i + 5] += (x >> 1) - (x >> 33);
|
||||
|
||||
if (i+1 == NLIMBS)
|
||||
break;
|
||||
tmp2[i + 2] += tmp2[i + 1] >> 52;
|
||||
x = tmp2[i + 1] & kBottom52Bits;
|
||||
xShiftedMask = NON_ZERO_TO_ALL_ONES(x >> 2);
|
||||
tmp2[i + 1] = 0;
|
||||
|
||||
tmp2[i + 2] += (x << 44) & kBottom51Bits;
|
||||
tmp2[i + 3] += x >> 7;
|
||||
|
||||
tmp2[i + 4] += (x << 37) & kBottom51Bits;
|
||||
tmp2[i + 5] += x >> 14;
|
||||
|
||||
/* On tmp2[i + 5], when x < 2**2, the subtraction with (x << 18) will not
|
||||
* underflow because it is balanced with the (x << 50) term. On the next
|
||||
* word tmp2[i + 6], terms with (x >> 2) and (x >> 34) are both zero and
|
||||
* there is no underflow either.
|
||||
*
|
||||
* When x >= 2**2, we add 2**52 to tmp2[i + 5] to avoid an underflow.
|
||||
* Removing 1 from tmp2[i + 6] is safe because (x >> 2) - (x >> 34) is
|
||||
* stricly positive.
|
||||
*/
|
||||
tmp2[i + 5] += 0x10000000000000 & xShiftedMask;
|
||||
tmp2[i + 6] -= 1 & xShiftedMask;
|
||||
|
||||
tmp2[i + 5] -= (x << 18) & kBottom52Bits;
|
||||
tmp2[i + 5] += (x << 50) & kBottom52Bits;
|
||||
tmp2[i + 6] += (x >> 2) - (x >> 34);
|
||||
}
|
||||
|
||||
/* We merge the right shift with a carry chain. The words above 2**257 have
|
||||
* widths of 52,51,... which we need to correct when copying them down. */
|
||||
carry = 0;
|
||||
for (i = 0; i < 4; i++) {
|
||||
out[i] = tmp2[i + 5];
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
out[i] = tmp2[i + 5] << 1;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
out[4] = tmp2[9];
|
||||
out[4] += carry;
|
||||
carry = out[4] >> 51;
|
||||
out[4] &= kBottom51Bits;
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_square sets out=in*in.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**52, in[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_square(felem out, const felem in) {
|
||||
u128 tmp[9], x1x1, x3x3;
|
||||
|
||||
x1x1 = ((u128) in[1]) * in[1];
|
||||
x3x3 = ((u128) in[3]) * in[3];
|
||||
|
||||
tmp[0] = ((u128) in[0]) * (in[0] << 0);
|
||||
tmp[1] = ((u128) in[0]) * (in[1] << 1) + ((x1x1 & 1) << 51);
|
||||
tmp[2] = ((u128) in[0]) * (in[2] << 1) + (x1x1 >> 1);
|
||||
tmp[3] = ((u128) in[0]) * (in[3] << 1) +
|
||||
((u128) in[1]) * (in[2] << 1);
|
||||
tmp[4] = ((u128) in[0]) * (in[4] << 1) +
|
||||
((u128) in[1]) * (in[3] << 0) +
|
||||
((u128) in[2]) * (in[2] << 0);
|
||||
tmp[5] = ((u128) in[1]) * (in[4] << 1) +
|
||||
((u128) in[2]) * (in[3] << 1) + ((x3x3 & 1) << 51);
|
||||
tmp[6] = ((u128) in[2]) * (in[4] << 1) + (x3x3 >> 1);
|
||||
tmp[7] = ((u128) in[3]) * (in[4] << 1);
|
||||
tmp[8] = ((u128) in[4]) * (in[4] << 0);
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
/* felem_mul sets out=in*in2.
|
||||
*
|
||||
* On entry: in[0,2,...] < 2**52, in[1,3,...] < 2**53 and
|
||||
* in2[0,2,...] < 2**52, in2[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_mul(felem out, const felem in, const felem in2) {
|
||||
u128 tmp[9], x1y1, x1y3, x3y1, x3y3;
|
||||
|
||||
x1y1 = ((u128) in[1]) * in2[1];
|
||||
x1y3 = ((u128) in[1]) * in2[3];
|
||||
x3y1 = ((u128) in[3]) * in2[1];
|
||||
x3y3 = ((u128) in[3]) * in2[3];
|
||||
|
||||
tmp[0] = ((u128) in[0]) * in2[0];
|
||||
tmp[1] = ((u128) in[0]) * in2[1] +
|
||||
((u128) in[1]) * in2[0] + ((x1y1 & 1) << 51);
|
||||
tmp[2] = ((u128) in[0]) * in2[2] + (x1y1 >> 1) +
|
||||
((u128) in[2]) * in2[0];
|
||||
tmp[3] = ((u128) in[0]) * in2[3] +
|
||||
((u128) in[1]) * in2[2] +
|
||||
((u128) in[2]) * in2[1] + ((x1y3 & 1) << 51) +
|
||||
((u128) in[3]) * in2[0] + ((x3y1 & 1) << 51);
|
||||
tmp[4] = ((u128) in[0]) * in2[4] + (x1y3 >> 1) +
|
||||
((u128) in[2]) * in2[2] + (x3y1 >> 1) +
|
||||
((u128) in[4]) * in2[0];
|
||||
tmp[5] = ((u128) in[1]) * in2[4] +
|
||||
((u128) in[2]) * in2[3] +
|
||||
((u128) in[3]) * in2[2] +
|
||||
((u128) in[4]) * in2[1] + ((x3y3 & 1) << 51);
|
||||
tmp[6] = ((u128) in[2]) * in2[4] + (x3y3 >> 1) +
|
||||
((u128) in[4]) * in2[2];
|
||||
tmp[7] = ((u128) in[3]) * in2[4] +
|
||||
((u128) in[4]) * in2[3];
|
||||
tmp[8] = ((u128) in[4]) * in2[4];
|
||||
|
||||
felem_reduce_degree(out, tmp);
|
||||
}
|
||||
|
||||
static void felem_assign(felem out, const felem in) {
|
||||
memcpy(out, in, sizeof(felem));
|
||||
}
|
||||
|
||||
/* felem_scalar_3 sets out=3*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**52, out[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_scalar_3(felem out) {
|
||||
limb carry = 0;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 51;
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
out[i] *= 3;
|
||||
out[i] += carry;
|
||||
carry = out[i] >> 52;
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_4 sets out=4*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**52, out[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_scalar_4(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 49;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom51Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 51);
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 50;
|
||||
out[i] <<= 2;
|
||||
out[i] &= kBottom52Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 52);
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_scalar_8 sets out=8*out.
|
||||
*
|
||||
* On entry: out[0,2,...] < 2**52, out[1,3,...] < 2**53.
|
||||
* On exit: out[0,2,...] < 2**52, out[1,3,...] < 2**53. */
|
||||
static void felem_scalar_8(felem out) {
|
||||
limb carry = 0, next_carry;
|
||||
unsigned i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
next_carry = out[i] >> 48;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom51Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 51);
|
||||
out[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
next_carry = out[i] >> 49;
|
||||
out[i] <<= 3;
|
||||
out[i] &= kBottom52Bits;
|
||||
out[i] += carry;
|
||||
carry = next_carry + (out[i] >> 52);
|
||||
out[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(out, carry);
|
||||
}
|
||||
|
||||
/* felem_is_zero_vartime returns 1 iff |in| == 0. It takes a variable amount of
|
||||
* time depending on the value of |in|. */
|
||||
static char felem_is_zero_vartime(const felem in) {
|
||||
limb carry;
|
||||
int i;
|
||||
limb tmp[NLIMBS];
|
||||
|
||||
felem_assign(tmp, in);
|
||||
|
||||
/* First, reduce tmp to a minimal form. */
|
||||
do {
|
||||
carry = 0;
|
||||
for (i = 0;; i++) {
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 51;
|
||||
tmp[i] &= kBottom51Bits;
|
||||
|
||||
i++;
|
||||
if (i == NLIMBS)
|
||||
break;
|
||||
|
||||
tmp[i] += carry;
|
||||
carry = tmp[i] >> 52;
|
||||
tmp[i] &= kBottom52Bits;
|
||||
}
|
||||
|
||||
felem_reduce_carry(tmp, carry);
|
||||
} while (carry);
|
||||
|
||||
/* tmp < 2**257, so the only possible zero values are 0, p and 2p. */
|
||||
return memcmp(tmp, kZero, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, kP, sizeof(tmp)) == 0 ||
|
||||
memcmp(tmp, k2P, sizeof(tmp)) == 0;
|
||||
}
|
||||
|
||||
|
||||
/* Montgomery operations: */
|
||||
|
||||
#define kRDigits {2, 0xfffffffe00000000, 0xffffffffffffffff, 0x1fffffffd} // 2^257 mod p256.p
|
||||
|
||||
#define kRInvDigits {0x180000000, 0xffffffff, 0xfffffffe80000001, 0x7fffffff00000001} // 1 / 2^257 mod p256.p
|
||||
|
||||
static const cryptonite_p256_int kR = { kRDigits };
|
||||
static const cryptonite_p256_int kRInv = { kRInvDigits };
|
||||
|
||||
/* to_montgomery sets out = R*in. */
|
||||
static void to_montgomery(felem out, const cryptonite_p256_int* in) {
|
||||
cryptonite_p256_int in_shifted;
|
||||
int i;
|
||||
|
||||
cryptonite_p256_init(&in_shifted);
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);
|
||||
|
||||
for (i = 0; i < NLIMBS; i++) {
|
||||
if ((i & 1) == 0) {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom51Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 51, &in_shifted);
|
||||
} else {
|
||||
out[i] = P256_DIGIT(&in_shifted, 0) & kBottom52Bits;
|
||||
cryptonite_p256_shr(&in_shifted, 52, &in_shifted);
|
||||
}
|
||||
}
|
||||
|
||||
cryptonite_p256_clear(&in_shifted);
|
||||
}
|
||||
|
||||
/* from_montgomery sets out=in/R. */
|
||||
static void from_montgomery(cryptonite_p256_int* out, const felem in) {
|
||||
cryptonite_p256_int result, tmp;
|
||||
int i, top;
|
||||
|
||||
cryptonite_p256_init(&result);
|
||||
cryptonite_p256_init(&tmp);
|
||||
|
||||
cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);
|
||||
for (i = NLIMBS - 2; i >= 0; i--) {
|
||||
if ((i & 1) == 0) {
|
||||
top = cryptonite_p256_shl(&result, 51, &tmp);
|
||||
} else {
|
||||
top = cryptonite_p256_shl(&result, 52, &tmp);
|
||||
}
|
||||
top += cryptonite_p256_add_d(&tmp, in[i], &result);
|
||||
}
|
||||
|
||||
cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);
|
||||
|
||||
cryptonite_p256_clear(&result);
|
||||
cryptonite_p256_clear(&tmp);
|
||||
}
|
||||
@ -25,7 +25,7 @@
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 elliptic curve group. It's written to
|
||||
// be portable 32-bit, although it's still constant-time.
|
||||
// be portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
@ -170,6 +170,10 @@ void cryptonite_p256_modmul(const cryptonite_p256_int* MOD,
|
||||
// top can be any value at this point.
|
||||
// Guestimate reducer as top * MOD, since msw of MOD is -1.
|
||||
top_reducer = mulAdd(MOD, top, 0, reducer);
|
||||
#if P256_BITSPERDIGIT > 32
|
||||
// Correction when msw of MOD has only high 32 bits set
|
||||
top_reducer += mulAdd(MOD, top >> 32, 0, reducer);
|
||||
#endif
|
||||
|
||||
// Subtract reducer from top | tmp.
|
||||
top = subTop(top_reducer, reducer, top, tmp + i);
|
||||
|
||||
@ -25,7 +25,7 @@
|
||||
*/
|
||||
|
||||
// This is an implementation of the P256 elliptic curve group. It's written to
|
||||
// be portable 32-bit, although it's still constant-time.
|
||||
// be portable and still constant-time.
|
||||
//
|
||||
// WARNING: Implementing these functions in a constant-time manner is far from
|
||||
// obvious. Be careful when touching this code.
|
||||
@ -285,9 +285,9 @@ static void point_add_or_double_vartime(
|
||||
felem_diff(y_out, y_out, tmp);
|
||||
}
|
||||
|
||||
/* copy_conditional sets out=in if mask = 0xffffffff in constant time.
|
||||
/* copy_conditional sets out=in if mask = -1 in constant time.
|
||||
*
|
||||
* On entry: mask is either 0 or 0xffffffff. */
|
||||
* On entry: mask is either 0 or -1. */
|
||||
static void copy_conditional(felem out, const felem in, limb mask) {
|
||||
int i;
|
||||
|
||||
|
||||
@ -50,7 +50,8 @@ extra-source-files: cbits/*.h
|
||||
cbits/decaf/p448/*.h
|
||||
cbits/decaf/ed448goldilocks/decaf_tables.c
|
||||
cbits/decaf/ed448goldilocks/decaf.c
|
||||
cbits/p256/*.h
|
||||
cbits/include32/p256/*.h
|
||||
cbits/include64/p256/*.h
|
||||
cbits/blake2/ref/*.h
|
||||
cbits/blake2/sse/*.h
|
||||
cbits/argon2/*.h
|
||||
@ -284,6 +285,11 @@ Library
|
||||
, cbits/decaf/include
|
||||
, cbits/decaf/p448
|
||||
|
||||
if arch(x86_64) || arch(aarch64)
|
||||
include-dirs: cbits/include64
|
||||
else
|
||||
include-dirs: cbits/include32
|
||||
|
||||
if arch(x86_64) || arch(aarch64)
|
||||
C-sources: cbits/decaf/p448/arch_ref64/f_impl.c
|
||||
, cbits/decaf/p448/f_generic.c
|
||||
|
||||
Loading…
Reference in New Issue
Block a user