CyaSSL - A library for setting up Secure Socket Layer (SSL…

MultiTech » Code » CyaSSL

A library for setting up Secure Socket Layer (SSL) connections and verifying remote hosts using certificates. Contains only the source files for mbed platform implementation of the library.

Dependents: HTTPClient-SSL HTTPClient-SSL HTTPClient-SSL HTTPClient-SSL

ctaocrypt/src/integer.c@6:cf58d49e1a86, 2015-03-23 (annotated)

Committer:: Mike Fiore
Date:: Mon Mar 23 16:51:07 2015 -0500
Revision:: 6:cf58d49e1a86
Parent:: 0:b86d15c6ba29

fix whitespace in sha512.c

Who changed what in which revision?

User	Revision	Line number	New contents of line
Vanger	0:b86d15c6ba29	1	/* integer.c
Vanger	0:b86d15c6ba29	2	*
Vanger	0:b86d15c6ba29	3	* Copyright (C) 2006-2014 wolfSSL Inc.
Vanger	0:b86d15c6ba29	4	*
Vanger	0:b86d15c6ba29	5	* This file is part of CyaSSL.
Vanger	0:b86d15c6ba29	6	*
Vanger	0:b86d15c6ba29	7	* CyaSSL is free software; you can redistribute it and/or modify
Vanger	0:b86d15c6ba29	8	* it under the terms of the GNU General Public License as published by
Vanger	0:b86d15c6ba29	9	* the Free Software Foundation; either version 2 of the License, or
Vanger	0:b86d15c6ba29	10	* (at your option) any later version.
Vanger	0:b86d15c6ba29	11	*
Vanger	0:b86d15c6ba29	12	* CyaSSL is distributed in the hope that it will be useful,
Vanger	0:b86d15c6ba29	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
Vanger	0:b86d15c6ba29	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
Vanger	0:b86d15c6ba29	15	* GNU General Public License for more details.
Vanger	0:b86d15c6ba29	16	*
Vanger	0:b86d15c6ba29	17	* You should have received a copy of the GNU General Public License
Vanger	0:b86d15c6ba29	18	* along with this program; if not, write to the Free Software
Vanger	0:b86d15c6ba29	19	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
Vanger	0:b86d15c6ba29	20	*/
Vanger	0:b86d15c6ba29	21
Vanger	0:b86d15c6ba29	22
Vanger	0:b86d15c6ba29	23	/*
Vanger	0:b86d15c6ba29	24	* Based on public domain LibTomMath 0.38 by Tom St Denis, tomstdenis@iahu.ca,
Vanger	0:b86d15c6ba29	25	* http://math.libtomcrypt.com
Vanger	0:b86d15c6ba29	26	*/
Vanger	0:b86d15c6ba29	27
Vanger	0:b86d15c6ba29	28
Vanger	0:b86d15c6ba29	29	#ifdef HAVE_CONFIG_H
Vanger	0:b86d15c6ba29	30	#include <config.h>
Vanger	0:b86d15c6ba29	31	#endif
Vanger	0:b86d15c6ba29	32
Vanger	0:b86d15c6ba29	33	/* in case user set USE_FAST_MATH there */
Vanger	0:b86d15c6ba29	34	#include <cyassl/ctaocrypt/settings.h>
Vanger	0:b86d15c6ba29	35
Vanger	0:b86d15c6ba29	36	#ifndef NO_BIG_INT
Vanger	0:b86d15c6ba29	37
Vanger	0:b86d15c6ba29	38	#ifndef USE_FAST_MATH
Vanger	0:b86d15c6ba29	39
Vanger	0:b86d15c6ba29	40	#include <cyassl/ctaocrypt/integer.h>
Vanger	0:b86d15c6ba29	41
Vanger	0:b86d15c6ba29	42	#ifndef NO_CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	43	#ifndef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	44	#define CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	45	#endif
Vanger	0:b86d15c6ba29	46	#endif
Vanger	0:b86d15c6ba29	47
Vanger	0:b86d15c6ba29	48	static void bn_reverse (unsigned char *s, int len);
Vanger	0:b86d15c6ba29	49
Vanger	0:b86d15c6ba29	50	/* math settings check */
Vanger	0:b86d15c6ba29	51	word32 CheckRunTimeSettings(void)
Vanger	0:b86d15c6ba29	52	{
Vanger	0:b86d15c6ba29	53	return CTC_SETTINGS;
Vanger	0:b86d15c6ba29	54	}
Vanger	0:b86d15c6ba29	55
Vanger	0:b86d15c6ba29	56
Vanger	0:b86d15c6ba29	57	/* handle up to 6 inits */
Vanger	0:b86d15c6ba29	58	int mp_init_multi(mp_int* a, mp_int* b, mp_int* c, mp_int* d, mp_int* e,
Vanger	0:b86d15c6ba29	59	mp_int* f)
Vanger	0:b86d15c6ba29	60	{
Vanger	0:b86d15c6ba29	61	int res = MP_OKAY;
Vanger	0:b86d15c6ba29	62
Vanger	0:b86d15c6ba29	63	if (a && ((res = mp_init(a)) != MP_OKAY))
Vanger	0:b86d15c6ba29	64	return res;
Vanger	0:b86d15c6ba29	65
Vanger	0:b86d15c6ba29	66	if (b && ((res = mp_init(b)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	67	mp_clear(a);
Vanger	0:b86d15c6ba29	68	return res;
Vanger	0:b86d15c6ba29	69	}
Vanger	0:b86d15c6ba29	70
Vanger	0:b86d15c6ba29	71	if (c && ((res = mp_init(c)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	72	mp_clear(a); mp_clear(b);
Vanger	0:b86d15c6ba29	73	return res;
Vanger	0:b86d15c6ba29	74	}
Vanger	0:b86d15c6ba29	75
Vanger	0:b86d15c6ba29	76	if (d && ((res = mp_init(d)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	77	mp_clear(a); mp_clear(b); mp_clear(c);
Vanger	0:b86d15c6ba29	78	return res;
Vanger	0:b86d15c6ba29	79	}
Vanger	0:b86d15c6ba29	80
Vanger	0:b86d15c6ba29	81	if (e && ((res = mp_init(e)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	82	mp_clear(a); mp_clear(b); mp_clear(c); mp_clear(d);
Vanger	0:b86d15c6ba29	83	return res;
Vanger	0:b86d15c6ba29	84	}
Vanger	0:b86d15c6ba29	85
Vanger	0:b86d15c6ba29	86	if (f && ((res = mp_init(f)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	87	mp_clear(a); mp_clear(b); mp_clear(c); mp_clear(d); mp_clear(e);
Vanger	0:b86d15c6ba29	88	return res;
Vanger	0:b86d15c6ba29	89	}
Vanger	0:b86d15c6ba29	90
Vanger	0:b86d15c6ba29	91	return res;
Vanger	0:b86d15c6ba29	92	}
Vanger	0:b86d15c6ba29	93
Vanger	0:b86d15c6ba29	94
Vanger	0:b86d15c6ba29	95	/* init a new mp_int */
Vanger	0:b86d15c6ba29	96	int mp_init (mp_int * a)
Vanger	0:b86d15c6ba29	97	{
Vanger	0:b86d15c6ba29	98	int i;
Vanger	0:b86d15c6ba29	99
Vanger	0:b86d15c6ba29	100	/* allocate memory required and clear it */
Vanger	0:b86d15c6ba29	101	a->dp = OPT_CAST(mp_digit) XMALLOC (sizeof (mp_digit) * MP_PREC, 0,
Vanger	0:b86d15c6ba29	102	DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	103	if (a->dp == NULL) {
Vanger	0:b86d15c6ba29	104	return MP_MEM;
Vanger	0:b86d15c6ba29	105	}
Vanger	0:b86d15c6ba29	106
Vanger	0:b86d15c6ba29	107	/* set the digits to zero */
Vanger	0:b86d15c6ba29	108	for (i = 0; i < MP_PREC; i++) {
Vanger	0:b86d15c6ba29	109	a->dp[i] = 0;
Vanger	0:b86d15c6ba29	110	}
Vanger	0:b86d15c6ba29	111
Vanger	0:b86d15c6ba29	112	/* set the used to zero, allocated digits to the default precision
Vanger	0:b86d15c6ba29	113	* and sign to positive */
Vanger	0:b86d15c6ba29	114	a->used = 0;
Vanger	0:b86d15c6ba29	115	a->alloc = MP_PREC;
Vanger	0:b86d15c6ba29	116	a->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	117
Vanger	0:b86d15c6ba29	118	return MP_OKAY;
Vanger	0:b86d15c6ba29	119	}
Vanger	0:b86d15c6ba29	120
Vanger	0:b86d15c6ba29	121
Vanger	0:b86d15c6ba29	122	/* clear one (frees) */
Vanger	0:b86d15c6ba29	123	void
Vanger	0:b86d15c6ba29	124	mp_clear (mp_int * a)
Vanger	0:b86d15c6ba29	125	{
Vanger	0:b86d15c6ba29	126	int i;
Vanger	0:b86d15c6ba29	127
Vanger	0:b86d15c6ba29	128	if (a == NULL)
Vanger	0:b86d15c6ba29	129	return;
Vanger	0:b86d15c6ba29	130
Vanger	0:b86d15c6ba29	131	/* only do anything if a hasn't been freed previously */
Vanger	0:b86d15c6ba29	132	if (a->dp != NULL) {
Vanger	0:b86d15c6ba29	133	/* first zero the digits */
Vanger	0:b86d15c6ba29	134	for (i = 0; i < a->used; i++) {
Vanger	0:b86d15c6ba29	135	a->dp[i] = 0;
Vanger	0:b86d15c6ba29	136	}
Vanger	0:b86d15c6ba29	137
Vanger	0:b86d15c6ba29	138	/* free ram */
Vanger	0:b86d15c6ba29	139	XFREE(a->dp, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	140
Vanger	0:b86d15c6ba29	141	/* reset members to make debugging easier */
Vanger	0:b86d15c6ba29	142	a->dp = NULL;
Vanger	0:b86d15c6ba29	143	a->alloc = a->used = 0;
Vanger	0:b86d15c6ba29	144	a->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	145	}
Vanger	0:b86d15c6ba29	146	}
Vanger	0:b86d15c6ba29	147
Vanger	0:b86d15c6ba29	148
Vanger	0:b86d15c6ba29	149	/* get the size for an unsigned equivalent */
Vanger	0:b86d15c6ba29	150	int mp_unsigned_bin_size (mp_int * a)
Vanger	0:b86d15c6ba29	151	{
Vanger	0:b86d15c6ba29	152	int size = mp_count_bits (a);
Vanger	0:b86d15c6ba29	153	return (size / 8 + ((size & 7) != 0 ? 1 : 0));
Vanger	0:b86d15c6ba29	154	}
Vanger	0:b86d15c6ba29	155
Vanger	0:b86d15c6ba29	156
Vanger	0:b86d15c6ba29	157	/* returns the number of bits in an int */
Vanger	0:b86d15c6ba29	158	int
Vanger	0:b86d15c6ba29	159	mp_count_bits (mp_int * a)
Vanger	0:b86d15c6ba29	160	{
Vanger	0:b86d15c6ba29	161	int r;
Vanger	0:b86d15c6ba29	162	mp_digit q;
Vanger	0:b86d15c6ba29	163
Vanger	0:b86d15c6ba29	164	/* shortcut */
Vanger	0:b86d15c6ba29	165	if (a->used == 0) {
Vanger	0:b86d15c6ba29	166	return 0;
Vanger	0:b86d15c6ba29	167	}
Vanger	0:b86d15c6ba29	168
Vanger	0:b86d15c6ba29	169	/* get number of digits and add that */
Vanger	0:b86d15c6ba29	170	r = (a->used - 1) * DIGIT_BIT;
Vanger	0:b86d15c6ba29	171
Vanger	0:b86d15c6ba29	172	/* take the last digit and count the bits in it */
Vanger	0:b86d15c6ba29	173	q = a->dp[a->used - 1];
Vanger	0:b86d15c6ba29	174	while (q > ((mp_digit) 0)) {
Vanger	0:b86d15c6ba29	175	++r;
Vanger	0:b86d15c6ba29	176	q >>= ((mp_digit) 1);
Vanger	0:b86d15c6ba29	177	}
Vanger	0:b86d15c6ba29	178	return r;
Vanger	0:b86d15c6ba29	179	}
Vanger	0:b86d15c6ba29	180
Vanger	0:b86d15c6ba29	181
Vanger	0:b86d15c6ba29	182	int mp_leading_bit (mp_int * a)
Vanger	0:b86d15c6ba29	183	{
Vanger	0:b86d15c6ba29	184	int bit = 0;
Vanger	0:b86d15c6ba29	185	mp_int t;
Vanger	0:b86d15c6ba29	186
Vanger	0:b86d15c6ba29	187	if (mp_init_copy(&t, a) != MP_OKAY)
Vanger	0:b86d15c6ba29	188	return 0;
Vanger	0:b86d15c6ba29	189
Vanger	0:b86d15c6ba29	190	while (mp_iszero(&t) == 0) {
Vanger	0:b86d15c6ba29	191	#ifndef MP_8BIT
Vanger	0:b86d15c6ba29	192	bit = (t.dp[0] & 0x80) != 0;
Vanger	0:b86d15c6ba29	193	#else
Vanger	0:b86d15c6ba29	194	bit = (t.dp[0] \| ((t.dp[1] & 0x01) << 7)) & 0x80 != 0;
Vanger	0:b86d15c6ba29	195	#endif
Vanger	0:b86d15c6ba29	196	if (mp_div_2d (&t, 8, &t, NULL) != MP_OKAY)
Vanger	0:b86d15c6ba29	197	break;
Vanger	0:b86d15c6ba29	198	}
Vanger	0:b86d15c6ba29	199	mp_clear(&t);
Vanger	0:b86d15c6ba29	200	return bit;
Vanger	0:b86d15c6ba29	201	}
Vanger	0:b86d15c6ba29	202
Vanger	0:b86d15c6ba29	203
Vanger	0:b86d15c6ba29	204	/* store in unsigned [big endian] format */
Vanger	0:b86d15c6ba29	205	int mp_to_unsigned_bin (mp_int * a, unsigned char *b)
Vanger	0:b86d15c6ba29	206	{
Vanger	0:b86d15c6ba29	207	int x, res;
Vanger	0:b86d15c6ba29	208	mp_int t;
Vanger	0:b86d15c6ba29	209
Vanger	0:b86d15c6ba29	210	if ((res = mp_init_copy (&t, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	211	return res;
Vanger	0:b86d15c6ba29	212	}
Vanger	0:b86d15c6ba29	213
Vanger	0:b86d15c6ba29	214	x = 0;
Vanger	0:b86d15c6ba29	215	while (mp_iszero (&t) == 0) {
Vanger	0:b86d15c6ba29	216	#ifndef MP_8BIT
Vanger	0:b86d15c6ba29	217	b[x++] = (unsigned char) (t.dp[0] & 255);
Vanger	0:b86d15c6ba29	218	#else
Vanger	0:b86d15c6ba29	219	b[x++] = (unsigned char) (t.dp[0] \| ((t.dp[1] & 0x01) << 7));
Vanger	0:b86d15c6ba29	220	#endif
Vanger	0:b86d15c6ba29	221	if ((res = mp_div_2d (&t, 8, &t, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	222	mp_clear (&t);
Vanger	0:b86d15c6ba29	223	return res;
Vanger	0:b86d15c6ba29	224	}
Vanger	0:b86d15c6ba29	225	}
Vanger	0:b86d15c6ba29	226	bn_reverse (b, x);
Vanger	0:b86d15c6ba29	227	mp_clear (&t);
Vanger	0:b86d15c6ba29	228	return MP_OKAY;
Vanger	0:b86d15c6ba29	229	}
Vanger	0:b86d15c6ba29	230
Vanger	0:b86d15c6ba29	231
Vanger	0:b86d15c6ba29	232	/* creates "a" then copies b into it */
Vanger	0:b86d15c6ba29	233	int mp_init_copy (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	234	{
Vanger	0:b86d15c6ba29	235	int res;
Vanger	0:b86d15c6ba29	236
Vanger	0:b86d15c6ba29	237	if ((res = mp_init (a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	238	return res;
Vanger	0:b86d15c6ba29	239	}
Vanger	0:b86d15c6ba29	240	return mp_copy (b, a);
Vanger	0:b86d15c6ba29	241	}
Vanger	0:b86d15c6ba29	242
Vanger	0:b86d15c6ba29	243
Vanger	0:b86d15c6ba29	244	/* copy, b = a */
Vanger	0:b86d15c6ba29	245	int
Vanger	0:b86d15c6ba29	246	mp_copy (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	247	{
Vanger	0:b86d15c6ba29	248	int res, n;
Vanger	0:b86d15c6ba29	249
Vanger	0:b86d15c6ba29	250	/* if dst == src do nothing */
Vanger	0:b86d15c6ba29	251	if (a == b) {
Vanger	0:b86d15c6ba29	252	return MP_OKAY;
Vanger	0:b86d15c6ba29	253	}
Vanger	0:b86d15c6ba29	254
Vanger	0:b86d15c6ba29	255	/* grow dest */
Vanger	0:b86d15c6ba29	256	if (b->alloc < a->used) {
Vanger	0:b86d15c6ba29	257	if ((res = mp_grow (b, a->used)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	258	return res;
Vanger	0:b86d15c6ba29	259	}
Vanger	0:b86d15c6ba29	260	}
Vanger	0:b86d15c6ba29	261
Vanger	0:b86d15c6ba29	262	/* zero b and copy the parameters over */
Vanger	0:b86d15c6ba29	263	{
Vanger	0:b86d15c6ba29	264	register mp_digit tmpa, tmpb;
Vanger	0:b86d15c6ba29	265
Vanger	0:b86d15c6ba29	266	/* pointer aliases */
Vanger	0:b86d15c6ba29	267
Vanger	0:b86d15c6ba29	268	/* source */
Vanger	0:b86d15c6ba29	269	tmpa = a->dp;
Vanger	0:b86d15c6ba29	270
Vanger	0:b86d15c6ba29	271	/* destination */
Vanger	0:b86d15c6ba29	272	tmpb = b->dp;
Vanger	0:b86d15c6ba29	273
Vanger	0:b86d15c6ba29	274	/* copy all the digits */
Vanger	0:b86d15c6ba29	275	for (n = 0; n < a->used; n++) {
Vanger	0:b86d15c6ba29	276	tmpb++ = tmpa++;
Vanger	0:b86d15c6ba29	277	}
Vanger	0:b86d15c6ba29	278
Vanger	0:b86d15c6ba29	279	/* clear high digits */
Vanger	0:b86d15c6ba29	280	for (; n < b->used; n++) {
Vanger	0:b86d15c6ba29	281	*tmpb++ = 0;
Vanger	0:b86d15c6ba29	282	}
Vanger	0:b86d15c6ba29	283	}
Vanger	0:b86d15c6ba29	284
Vanger	0:b86d15c6ba29	285	/* copy used count and sign */
Vanger	0:b86d15c6ba29	286	b->used = a->used;
Vanger	0:b86d15c6ba29	287	b->sign = a->sign;
Vanger	0:b86d15c6ba29	288	return MP_OKAY;
Vanger	0:b86d15c6ba29	289	}
Vanger	0:b86d15c6ba29	290
Vanger	0:b86d15c6ba29	291
Vanger	0:b86d15c6ba29	292	/* grow as required */
Vanger	0:b86d15c6ba29	293	int mp_grow (mp_int * a, int size)
Vanger	0:b86d15c6ba29	294	{
Vanger	0:b86d15c6ba29	295	int i;
Vanger	0:b86d15c6ba29	296	mp_digit *tmp;
Vanger	0:b86d15c6ba29	297
Vanger	0:b86d15c6ba29	298	/* if the alloc size is smaller alloc more ram */
Vanger	0:b86d15c6ba29	299	if (a->alloc < size) {
Vanger	0:b86d15c6ba29	300	/* ensure there are always at least MP_PREC digits extra on top */
Vanger	0:b86d15c6ba29	301	size += (MP_PREC * 2) - (size % MP_PREC);
Vanger	0:b86d15c6ba29	302
Vanger	0:b86d15c6ba29	303	/* reallocate the array a->dp
Vanger	0:b86d15c6ba29	304	*
Vanger	0:b86d15c6ba29	305	* We store the return in a temporary variable
Vanger	0:b86d15c6ba29	306	* in case the operation failed we don't want
Vanger	0:b86d15c6ba29	307	* to overwrite the dp member of a.
Vanger	0:b86d15c6ba29	308	*/
Vanger	0:b86d15c6ba29	309	tmp = OPT_CAST(mp_digit) XREALLOC (a->dp, sizeof (mp_digit) * size, 0,
Vanger	0:b86d15c6ba29	310	DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	311	if (tmp == NULL) {
Vanger	0:b86d15c6ba29	312	/* reallocation failed but "a" is still valid [can be freed] */
Vanger	0:b86d15c6ba29	313	return MP_MEM;
Vanger	0:b86d15c6ba29	314	}
Vanger	0:b86d15c6ba29	315
Vanger	0:b86d15c6ba29	316	/* reallocation succeeded so set a->dp */
Vanger	0:b86d15c6ba29	317	a->dp = tmp;
Vanger	0:b86d15c6ba29	318
Vanger	0:b86d15c6ba29	319	/* zero excess digits */
Vanger	0:b86d15c6ba29	320	i = a->alloc;
Vanger	0:b86d15c6ba29	321	a->alloc = size;
Vanger	0:b86d15c6ba29	322	for (; i < a->alloc; i++) {
Vanger	0:b86d15c6ba29	323	a->dp[i] = 0;
Vanger	0:b86d15c6ba29	324	}
Vanger	0:b86d15c6ba29	325	}
Vanger	0:b86d15c6ba29	326	return MP_OKAY;
Vanger	0:b86d15c6ba29	327	}
Vanger	0:b86d15c6ba29	328
Vanger	0:b86d15c6ba29	329
Vanger	0:b86d15c6ba29	330	/* reverse an array, used for radix code */
Vanger	0:b86d15c6ba29	331	void
Vanger	0:b86d15c6ba29	332	bn_reverse (unsigned char *s, int len)
Vanger	0:b86d15c6ba29	333	{
Vanger	0:b86d15c6ba29	334	int ix, iy;
Vanger	0:b86d15c6ba29	335	unsigned char t;
Vanger	0:b86d15c6ba29	336
Vanger	0:b86d15c6ba29	337	ix = 0;
Vanger	0:b86d15c6ba29	338	iy = len - 1;
Vanger	0:b86d15c6ba29	339	while (ix < iy) {
Vanger	0:b86d15c6ba29	340	t = s[ix];
Vanger	0:b86d15c6ba29	341	s[ix] = s[iy];
Vanger	0:b86d15c6ba29	342	s[iy] = t;
Vanger	0:b86d15c6ba29	343	++ix;
Vanger	0:b86d15c6ba29	344	--iy;
Vanger	0:b86d15c6ba29	345	}
Vanger	0:b86d15c6ba29	346	}
Vanger	0:b86d15c6ba29	347
Vanger	0:b86d15c6ba29	348
Vanger	0:b86d15c6ba29	349	/* shift right by a certain bit count (store quotient in c, optional
Vanger	0:b86d15c6ba29	350	remainder in d) */
Vanger	0:b86d15c6ba29	351	int mp_div_2d (mp_int * a, int b, mp_int * c, mp_int * d)
Vanger	0:b86d15c6ba29	352	{
Vanger	0:b86d15c6ba29	353	int D, res;
Vanger	0:b86d15c6ba29	354	mp_int t;
Vanger	0:b86d15c6ba29	355
Vanger	0:b86d15c6ba29	356
Vanger	0:b86d15c6ba29	357	/* if the shift count is <= 0 then we do no work */
Vanger	0:b86d15c6ba29	358	if (b <= 0) {
Vanger	0:b86d15c6ba29	359	res = mp_copy (a, c);
Vanger	0:b86d15c6ba29	360	if (d != NULL) {
Vanger	0:b86d15c6ba29	361	mp_zero (d);
Vanger	0:b86d15c6ba29	362	}
Vanger	0:b86d15c6ba29	363	return res;
Vanger	0:b86d15c6ba29	364	}
Vanger	0:b86d15c6ba29	365
Vanger	0:b86d15c6ba29	366	if ((res = mp_init (&t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	367	return res;
Vanger	0:b86d15c6ba29	368	}
Vanger	0:b86d15c6ba29	369
Vanger	0:b86d15c6ba29	370	/* get the remainder */
Vanger	0:b86d15c6ba29	371	if (d != NULL) {
Vanger	0:b86d15c6ba29	372	if ((res = mp_mod_2d (a, b, &t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	373	mp_clear (&t);
Vanger	0:b86d15c6ba29	374	return res;
Vanger	0:b86d15c6ba29	375	}
Vanger	0:b86d15c6ba29	376	}
Vanger	0:b86d15c6ba29	377
Vanger	0:b86d15c6ba29	378	/* copy */
Vanger	0:b86d15c6ba29	379	if ((res = mp_copy (a, c)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	380	mp_clear (&t);
Vanger	0:b86d15c6ba29	381	return res;
Vanger	0:b86d15c6ba29	382	}
Vanger	0:b86d15c6ba29	383
Vanger	0:b86d15c6ba29	384	/* shift by as many digits in the bit count */
Vanger	0:b86d15c6ba29	385	if (b >= (int)DIGIT_BIT) {
Vanger	0:b86d15c6ba29	386	mp_rshd (c, b / DIGIT_BIT);
Vanger	0:b86d15c6ba29	387	}
Vanger	0:b86d15c6ba29	388
Vanger	0:b86d15c6ba29	389	/* shift any bit count < DIGIT_BIT */
Vanger	0:b86d15c6ba29	390	D = (b % DIGIT_BIT);
Vanger	0:b86d15c6ba29	391	if (D != 0) {
Vanger	0:b86d15c6ba29	392	mp_rshb(c, D);
Vanger	0:b86d15c6ba29	393	}
Vanger	0:b86d15c6ba29	394	mp_clamp (c);
Vanger	0:b86d15c6ba29	395	if (d != NULL) {
Vanger	0:b86d15c6ba29	396	mp_exch (&t, d);
Vanger	0:b86d15c6ba29	397	}
Vanger	0:b86d15c6ba29	398	mp_clear (&t);
Vanger	0:b86d15c6ba29	399	return MP_OKAY;
Vanger	0:b86d15c6ba29	400	}
Vanger	0:b86d15c6ba29	401
Vanger	0:b86d15c6ba29	402
Vanger	0:b86d15c6ba29	403	/* set to zero */
Vanger	0:b86d15c6ba29	404	void mp_zero (mp_int * a)
Vanger	0:b86d15c6ba29	405	{
Vanger	0:b86d15c6ba29	406	int n;
Vanger	0:b86d15c6ba29	407	mp_digit *tmp;
Vanger	0:b86d15c6ba29	408
Vanger	0:b86d15c6ba29	409	a->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	410	a->used = 0;
Vanger	0:b86d15c6ba29	411
Vanger	0:b86d15c6ba29	412	tmp = a->dp;
Vanger	0:b86d15c6ba29	413	for (n = 0; n < a->alloc; n++) {
Vanger	0:b86d15c6ba29	414	*tmp++ = 0;
Vanger	0:b86d15c6ba29	415	}
Vanger	0:b86d15c6ba29	416	}
Vanger	0:b86d15c6ba29	417
Vanger	0:b86d15c6ba29	418
Vanger	0:b86d15c6ba29	419	/* trim unused digits
Vanger	0:b86d15c6ba29	420	*
Vanger	0:b86d15c6ba29	421	* This is used to ensure that leading zero digits are
Vanger	0:b86d15c6ba29	422	* trimed and the leading "used" digit will be non-zero
Vanger	0:b86d15c6ba29	423	* Typically very fast. Also fixes the sign if there
Vanger	0:b86d15c6ba29	424	* are no more leading digits
Vanger	0:b86d15c6ba29	425	*/
Vanger	0:b86d15c6ba29	426	void
Vanger	0:b86d15c6ba29	427	mp_clamp (mp_int * a)
Vanger	0:b86d15c6ba29	428	{
Vanger	0:b86d15c6ba29	429	/* decrease used while the most significant digit is
Vanger	0:b86d15c6ba29	430	* zero.
Vanger	0:b86d15c6ba29	431	*/
Vanger	0:b86d15c6ba29	432	while (a->used > 0 && a->dp[a->used - 1] == 0) {
Vanger	0:b86d15c6ba29	433	--(a->used);
Vanger	0:b86d15c6ba29	434	}
Vanger	0:b86d15c6ba29	435
Vanger	0:b86d15c6ba29	436	/* reset the sign flag if used == 0 */
Vanger	0:b86d15c6ba29	437	if (a->used == 0) {
Vanger	0:b86d15c6ba29	438	a->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	439	}
Vanger	0:b86d15c6ba29	440	}
Vanger	0:b86d15c6ba29	441
Vanger	0:b86d15c6ba29	442
Vanger	0:b86d15c6ba29	443	/* swap the elements of two integers, for cases where you can't simply swap the
Vanger	0:b86d15c6ba29	444	* mp_int pointers around
Vanger	0:b86d15c6ba29	445	*/
Vanger	0:b86d15c6ba29	446	void
Vanger	0:b86d15c6ba29	447	mp_exch (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	448	{
Vanger	0:b86d15c6ba29	449	mp_int t;
Vanger	0:b86d15c6ba29	450
Vanger	0:b86d15c6ba29	451	t = *a;
Vanger	0:b86d15c6ba29	452	a = b;
Vanger	0:b86d15c6ba29	453	*b = t;
Vanger	0:b86d15c6ba29	454	}
Vanger	0:b86d15c6ba29	455
Vanger	0:b86d15c6ba29	456
Vanger	0:b86d15c6ba29	457	/* shift right a certain number of bits */
Vanger	0:b86d15c6ba29	458	void mp_rshb (mp_int *c, int x)
Vanger	0:b86d15c6ba29	459	{
Vanger	0:b86d15c6ba29	460	register mp_digit *tmpc, mask, shift;
Vanger	0:b86d15c6ba29	461	mp_digit r, rr;
Vanger	0:b86d15c6ba29	462	mp_digit D = x;
Vanger	0:b86d15c6ba29	463
Vanger	0:b86d15c6ba29	464	/* mask */
Vanger	0:b86d15c6ba29	465	mask = (((mp_digit)1) << D) - 1;
Vanger	0:b86d15c6ba29	466
Vanger	0:b86d15c6ba29	467	/* shift for lsb */
Vanger	0:b86d15c6ba29	468	shift = DIGIT_BIT - D;
Vanger	0:b86d15c6ba29	469
Vanger	0:b86d15c6ba29	470	/* alias */
Vanger	0:b86d15c6ba29	471	tmpc = c->dp + (c->used - 1);
Vanger	0:b86d15c6ba29	472
Vanger	0:b86d15c6ba29	473	/* carry */
Vanger	0:b86d15c6ba29	474	r = 0;
Vanger	0:b86d15c6ba29	475	for (x = c->used - 1; x >= 0; x--) {
Vanger	0:b86d15c6ba29	476	/* get the lower bits of this word in a temp */
Vanger	0:b86d15c6ba29	477	rr = *tmpc & mask;
Vanger	0:b86d15c6ba29	478
Vanger	0:b86d15c6ba29	479	/* shift the current word and mix in the carry bits from previous word */
Vanger	0:b86d15c6ba29	480	tmpc = (tmpc >> D) \| (r << shift);
Vanger	0:b86d15c6ba29	481	--tmpc;
Vanger	0:b86d15c6ba29	482
Vanger	0:b86d15c6ba29	483	/* set the carry to the carry bits of the current word found above */
Vanger	0:b86d15c6ba29	484	r = rr;
Vanger	0:b86d15c6ba29	485	}
Vanger	0:b86d15c6ba29	486	}
Vanger	0:b86d15c6ba29	487
Vanger	0:b86d15c6ba29	488
Vanger	0:b86d15c6ba29	489	/* shift right a certain amount of digits */
Vanger	0:b86d15c6ba29	490	void mp_rshd (mp_int * a, int b)
Vanger	0:b86d15c6ba29	491	{
Vanger	0:b86d15c6ba29	492	int x;
Vanger	0:b86d15c6ba29	493
Vanger	0:b86d15c6ba29	494	/* if b <= 0 then ignore it */
Vanger	0:b86d15c6ba29	495	if (b <= 0) {
Vanger	0:b86d15c6ba29	496	return;
Vanger	0:b86d15c6ba29	497	}
Vanger	0:b86d15c6ba29	498
Vanger	0:b86d15c6ba29	499	/* if b > used then simply zero it and return */
Vanger	0:b86d15c6ba29	500	if (a->used <= b) {
Vanger	0:b86d15c6ba29	501	mp_zero (a);
Vanger	0:b86d15c6ba29	502	return;
Vanger	0:b86d15c6ba29	503	}
Vanger	0:b86d15c6ba29	504
Vanger	0:b86d15c6ba29	505	{
Vanger	0:b86d15c6ba29	506	register mp_digit bottom, top;
Vanger	0:b86d15c6ba29	507
Vanger	0:b86d15c6ba29	508	/* shift the digits down */
Vanger	0:b86d15c6ba29	509
Vanger	0:b86d15c6ba29	510	/* bottom */
Vanger	0:b86d15c6ba29	511	bottom = a->dp;
Vanger	0:b86d15c6ba29	512
Vanger	0:b86d15c6ba29	513	/* top [offset into digits] */
Vanger	0:b86d15c6ba29	514	top = a->dp + b;
Vanger	0:b86d15c6ba29	515
Vanger	0:b86d15c6ba29	516	/* this is implemented as a sliding window where
Vanger	0:b86d15c6ba29	517	* the window is b-digits long and digits from
Vanger	0:b86d15c6ba29	518	* the top of the window are copied to the bottom
Vanger	0:b86d15c6ba29	519	*
Vanger	0:b86d15c6ba29	520	* e.g.
Vanger	0:b86d15c6ba29	521
Vanger	0:b86d15c6ba29	522	b-2 \| b-1 \| b0 \| b1 \| b2 \| ... \| bb \| ---->
Vanger	0:b86d15c6ba29	523	/\ \| ---->
Vanger	0:b86d15c6ba29	524	\-------------------/ ---->
Vanger	0:b86d15c6ba29	525	*/
Vanger	0:b86d15c6ba29	526	for (x = 0; x < (a->used - b); x++) {
Vanger	0:b86d15c6ba29	527	bottom++ = top++;
Vanger	0:b86d15c6ba29	528	}
Vanger	0:b86d15c6ba29	529
Vanger	0:b86d15c6ba29	530	/* zero the top digits */
Vanger	0:b86d15c6ba29	531	for (; x < a->used; x++) {
Vanger	0:b86d15c6ba29	532	*bottom++ = 0;
Vanger	0:b86d15c6ba29	533	}
Vanger	0:b86d15c6ba29	534	}
Vanger	0:b86d15c6ba29	535
Vanger	0:b86d15c6ba29	536	/* remove excess digits */
Vanger	0:b86d15c6ba29	537	a->used -= b;
Vanger	0:b86d15c6ba29	538	}
Vanger	0:b86d15c6ba29	539
Vanger	0:b86d15c6ba29	540
Vanger	0:b86d15c6ba29	541	/* calc a value mod 2*b /
Vanger	0:b86d15c6ba29	542	int
Vanger	0:b86d15c6ba29	543	mp_mod_2d (mp_int * a, int b, mp_int * c)
Vanger	0:b86d15c6ba29	544	{
Vanger	0:b86d15c6ba29	545	int x, res;
Vanger	0:b86d15c6ba29	546
Vanger	0:b86d15c6ba29	547	/* if b is <= 0 then zero the int */
Vanger	0:b86d15c6ba29	548	if (b <= 0) {
Vanger	0:b86d15c6ba29	549	mp_zero (c);
Vanger	0:b86d15c6ba29	550	return MP_OKAY;
Vanger	0:b86d15c6ba29	551	}
Vanger	0:b86d15c6ba29	552
Vanger	0:b86d15c6ba29	553	/* if the modulus is larger than the value than return */
Vanger	0:b86d15c6ba29	554	if (b >= (int) (a->used * DIGIT_BIT)) {
Vanger	0:b86d15c6ba29	555	res = mp_copy (a, c);
Vanger	0:b86d15c6ba29	556	return res;
Vanger	0:b86d15c6ba29	557	}
Vanger	0:b86d15c6ba29	558
Vanger	0:b86d15c6ba29	559	/* copy */
Vanger	0:b86d15c6ba29	560	if ((res = mp_copy (a, c)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	561	return res;
Vanger	0:b86d15c6ba29	562	}
Vanger	0:b86d15c6ba29	563
Vanger	0:b86d15c6ba29	564	/* zero digits above the last digit of the modulus */
Vanger	0:b86d15c6ba29	565	for (x = (b / DIGIT_BIT) + ((b % DIGIT_BIT) == 0 ? 0 : 1); x < c->used; x++) {
Vanger	0:b86d15c6ba29	566	c->dp[x] = 0;
Vanger	0:b86d15c6ba29	567	}
Vanger	0:b86d15c6ba29	568	/* clear the digit that is not completely outside/inside the modulus */
Vanger	0:b86d15c6ba29	569	c->dp[b / DIGIT_BIT] &= (mp_digit) ((((mp_digit) 1) <<
Vanger	0:b86d15c6ba29	570	(((mp_digit) b) % DIGIT_BIT)) - ((mp_digit) 1));
Vanger	0:b86d15c6ba29	571	mp_clamp (c);
Vanger	0:b86d15c6ba29	572	return MP_OKAY;
Vanger	0:b86d15c6ba29	573	}
Vanger	0:b86d15c6ba29	574
Vanger	0:b86d15c6ba29	575
Vanger	0:b86d15c6ba29	576	/* reads a unsigned char array, assumes the msb is stored first [big endian] */
Vanger	0:b86d15c6ba29	577	int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c)
Vanger	0:b86d15c6ba29	578	{
Vanger	0:b86d15c6ba29	579	int res;
Vanger	0:b86d15c6ba29	580
Vanger	0:b86d15c6ba29	581	/* make sure there are at least two digits */
Vanger	0:b86d15c6ba29	582	if (a->alloc < 2) {
Vanger	0:b86d15c6ba29	583	if ((res = mp_grow(a, 2)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	584	return res;
Vanger	0:b86d15c6ba29	585	}
Vanger	0:b86d15c6ba29	586	}
Vanger	0:b86d15c6ba29	587
Vanger	0:b86d15c6ba29	588	/* zero the int */
Vanger	0:b86d15c6ba29	589	mp_zero (a);
Vanger	0:b86d15c6ba29	590
Vanger	0:b86d15c6ba29	591	/* read the bytes in */
Vanger	0:b86d15c6ba29	592	while (c-- > 0) {
Vanger	0:b86d15c6ba29	593	if ((res = mp_mul_2d (a, 8, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	594	return res;
Vanger	0:b86d15c6ba29	595	}
Vanger	0:b86d15c6ba29	596
Vanger	0:b86d15c6ba29	597	#ifndef MP_8BIT
Vanger	0:b86d15c6ba29	598	a->dp[0] \|= *b++;
Vanger	0:b86d15c6ba29	599	a->used += 1;
Vanger	0:b86d15c6ba29	600	#else
Vanger	0:b86d15c6ba29	601	a->dp[0] = (*b & MP_MASK);
Vanger	0:b86d15c6ba29	602	a->dp[1] \|= ((*b++ >> 7U) & 1);
Vanger	0:b86d15c6ba29	603	a->used += 2;
Vanger	0:b86d15c6ba29	604	#endif
Vanger	0:b86d15c6ba29	605	}
Vanger	0:b86d15c6ba29	606	mp_clamp (a);
Vanger	0:b86d15c6ba29	607	return MP_OKAY;
Vanger	0:b86d15c6ba29	608	}
Vanger	0:b86d15c6ba29	609
Vanger	0:b86d15c6ba29	610
Vanger	0:b86d15c6ba29	611	/* shift left by a certain bit count */
Vanger	0:b86d15c6ba29	612	int mp_mul_2d (mp_int * a, int b, mp_int * c)
Vanger	0:b86d15c6ba29	613	{
Vanger	0:b86d15c6ba29	614	mp_digit d;
Vanger	0:b86d15c6ba29	615	int res;
Vanger	0:b86d15c6ba29	616
Vanger	0:b86d15c6ba29	617	/* copy */
Vanger	0:b86d15c6ba29	618	if (a != c) {
Vanger	0:b86d15c6ba29	619	if ((res = mp_copy (a, c)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	620	return res;
Vanger	0:b86d15c6ba29	621	}
Vanger	0:b86d15c6ba29	622	}
Vanger	0:b86d15c6ba29	623
Vanger	0:b86d15c6ba29	624	if (c->alloc < (int)(c->used + b/DIGIT_BIT + 1)) {
Vanger	0:b86d15c6ba29	625	if ((res = mp_grow (c, c->used + b / DIGIT_BIT + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	626	return res;
Vanger	0:b86d15c6ba29	627	}
Vanger	0:b86d15c6ba29	628	}
Vanger	0:b86d15c6ba29	629
Vanger	0:b86d15c6ba29	630	/* shift by as many digits in the bit count */
Vanger	0:b86d15c6ba29	631	if (b >= (int)DIGIT_BIT) {
Vanger	0:b86d15c6ba29	632	if ((res = mp_lshd (c, b / DIGIT_BIT)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	633	return res;
Vanger	0:b86d15c6ba29	634	}
Vanger	0:b86d15c6ba29	635	}
Vanger	0:b86d15c6ba29	636
Vanger	0:b86d15c6ba29	637	/* shift any bit count < DIGIT_BIT */
Vanger	0:b86d15c6ba29	638	d = (mp_digit) (b % DIGIT_BIT);
Vanger	0:b86d15c6ba29	639	if (d != 0) {
Vanger	0:b86d15c6ba29	640	register mp_digit *tmpc, shift, mask, r, rr;
Vanger	0:b86d15c6ba29	641	register int x;
Vanger	0:b86d15c6ba29	642
Vanger	0:b86d15c6ba29	643	/* bitmask for carries */
Vanger	0:b86d15c6ba29	644	mask = (((mp_digit)1) << d) - 1;
Vanger	0:b86d15c6ba29	645
Vanger	0:b86d15c6ba29	646	/* shift for msbs */
Vanger	0:b86d15c6ba29	647	shift = DIGIT_BIT - d;
Vanger	0:b86d15c6ba29	648
Vanger	0:b86d15c6ba29	649	/* alias */
Vanger	0:b86d15c6ba29	650	tmpc = c->dp;
Vanger	0:b86d15c6ba29	651
Vanger	0:b86d15c6ba29	652	/* carry */
Vanger	0:b86d15c6ba29	653	r = 0;
Vanger	0:b86d15c6ba29	654	for (x = 0; x < c->used; x++) {
Vanger	0:b86d15c6ba29	655	/* get the higher bits of the current word */
Vanger	0:b86d15c6ba29	656	rr = (*tmpc >> shift) & mask;
Vanger	0:b86d15c6ba29	657
Vanger	0:b86d15c6ba29	658	/* shift the current word and OR in the carry */
Vanger	0:b86d15c6ba29	659	tmpc = ((tmpc << d) \| r) & MP_MASK;
Vanger	0:b86d15c6ba29	660	++tmpc;
Vanger	0:b86d15c6ba29	661
Vanger	0:b86d15c6ba29	662	/* set the carry to the carry bits of the current word */
Vanger	0:b86d15c6ba29	663	r = rr;
Vanger	0:b86d15c6ba29	664	}
Vanger	0:b86d15c6ba29	665
Vanger	0:b86d15c6ba29	666	/* set final carry */
Vanger	0:b86d15c6ba29	667	if (r != 0) {
Vanger	0:b86d15c6ba29	668	c->dp[(c->used)++] = r;
Vanger	0:b86d15c6ba29	669	}
Vanger	0:b86d15c6ba29	670	}
Vanger	0:b86d15c6ba29	671	mp_clamp (c);
Vanger	0:b86d15c6ba29	672	return MP_OKAY;
Vanger	0:b86d15c6ba29	673	}
Vanger	0:b86d15c6ba29	674
Vanger	0:b86d15c6ba29	675
Vanger	0:b86d15c6ba29	676	/* shift left a certain amount of digits */
Vanger	0:b86d15c6ba29	677	int mp_lshd (mp_int * a, int b)
Vanger	0:b86d15c6ba29	678	{
Vanger	0:b86d15c6ba29	679	int x, res;
Vanger	0:b86d15c6ba29	680
Vanger	0:b86d15c6ba29	681	/* if its less than zero return */
Vanger	0:b86d15c6ba29	682	if (b <= 0) {
Vanger	0:b86d15c6ba29	683	return MP_OKAY;
Vanger	0:b86d15c6ba29	684	}
Vanger	0:b86d15c6ba29	685
Vanger	0:b86d15c6ba29	686	/* grow to fit the new digits */
Vanger	0:b86d15c6ba29	687	if (a->alloc < a->used + b) {
Vanger	0:b86d15c6ba29	688	if ((res = mp_grow (a, a->used + b)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	689	return res;
Vanger	0:b86d15c6ba29	690	}
Vanger	0:b86d15c6ba29	691	}
Vanger	0:b86d15c6ba29	692
Vanger	0:b86d15c6ba29	693	{
Vanger	0:b86d15c6ba29	694	register mp_digit top, bottom;
Vanger	0:b86d15c6ba29	695
Vanger	0:b86d15c6ba29	696	/* increment the used by the shift amount then copy upwards */
Vanger	0:b86d15c6ba29	697	a->used += b;
Vanger	0:b86d15c6ba29	698
Vanger	0:b86d15c6ba29	699	/* top */
Vanger	0:b86d15c6ba29	700	top = a->dp + a->used - 1;
Vanger	0:b86d15c6ba29	701
Vanger	0:b86d15c6ba29	702	/* base */
Vanger	0:b86d15c6ba29	703	bottom = a->dp + a->used - 1 - b;
Vanger	0:b86d15c6ba29	704
Vanger	0:b86d15c6ba29	705	/* much like mp_rshd this is implemented using a sliding window
Vanger	0:b86d15c6ba29	706	* except the window goes the otherway around. Copying from
Vanger	0:b86d15c6ba29	707	* the bottom to the top. see bn_mp_rshd.c for more info.
Vanger	0:b86d15c6ba29	708	*/
Vanger	0:b86d15c6ba29	709	for (x = a->used - 1; x >= b; x--) {
Vanger	0:b86d15c6ba29	710	top-- = bottom--;
Vanger	0:b86d15c6ba29	711	}
Vanger	0:b86d15c6ba29	712
Vanger	0:b86d15c6ba29	713	/* zero the lower digits */
Vanger	0:b86d15c6ba29	714	top = a->dp;
Vanger	0:b86d15c6ba29	715	for (x = 0; x < b; x++) {
Vanger	0:b86d15c6ba29	716	*top++ = 0;
Vanger	0:b86d15c6ba29	717	}
Vanger	0:b86d15c6ba29	718	}
Vanger	0:b86d15c6ba29	719	return MP_OKAY;
Vanger	0:b86d15c6ba29	720	}
Vanger	0:b86d15c6ba29	721
Vanger	0:b86d15c6ba29	722
Vanger	0:b86d15c6ba29	723	/* this is a shell function that calls either the normal or Montgomery
Vanger	0:b86d15c6ba29	724	* exptmod functions. Originally the call to the montgomery code was
Vanger	0:b86d15c6ba29	725	* embedded in the normal function but that wasted alot of stack space
Vanger	0:b86d15c6ba29	726	* for nothing (since 99% of the time the Montgomery code would be called)
Vanger	0:b86d15c6ba29	727	*/
Vanger	0:b86d15c6ba29	728	int mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y)
Vanger	0:b86d15c6ba29	729	{
Vanger	0:b86d15c6ba29	730	int dr;
Vanger	0:b86d15c6ba29	731
Vanger	0:b86d15c6ba29	732	/* modulus P must be positive */
Vanger	0:b86d15c6ba29	733	if (P->sign == MP_NEG) {
Vanger	0:b86d15c6ba29	734	return MP_VAL;
Vanger	0:b86d15c6ba29	735	}
Vanger	0:b86d15c6ba29	736
Vanger	0:b86d15c6ba29	737	/* if exponent X is negative we have to recurse */
Vanger	0:b86d15c6ba29	738	if (X->sign == MP_NEG) {
Vanger	0:b86d15c6ba29	739	#ifdef BN_MP_INVMOD_C
Vanger	0:b86d15c6ba29	740	mp_int tmpG, tmpX;
Vanger	0:b86d15c6ba29	741	int err;
Vanger	0:b86d15c6ba29	742
Vanger	0:b86d15c6ba29	743	/* first compute 1/G mod P */
Vanger	0:b86d15c6ba29	744	if ((err = mp_init(&tmpG)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	745	return err;
Vanger	0:b86d15c6ba29	746	}
Vanger	0:b86d15c6ba29	747	if ((err = mp_invmod(G, P, &tmpG)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	748	mp_clear(&tmpG);
Vanger	0:b86d15c6ba29	749	return err;
Vanger	0:b86d15c6ba29	750	}
Vanger	0:b86d15c6ba29	751
Vanger	0:b86d15c6ba29	752	/* now get \|X\| */
Vanger	0:b86d15c6ba29	753	if ((err = mp_init(&tmpX)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	754	mp_clear(&tmpG);
Vanger	0:b86d15c6ba29	755	return err;
Vanger	0:b86d15c6ba29	756	}
Vanger	0:b86d15c6ba29	757	if ((err = mp_abs(X, &tmpX)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	758	mp_clear(&tmpG);
Vanger	0:b86d15c6ba29	759	mp_clear(&tmpX);
Vanger	0:b86d15c6ba29	760	return err;
Vanger	0:b86d15c6ba29	761	}
Vanger	0:b86d15c6ba29	762
Vanger	0:b86d15c6ba29	763	/* and now compute (1/G)\|X\| instead of GX [X < 0] */
Vanger	0:b86d15c6ba29	764	err = mp_exptmod(&tmpG, &tmpX, P, Y);
Vanger	0:b86d15c6ba29	765	mp_clear(&tmpG);
Vanger	0:b86d15c6ba29	766	mp_clear(&tmpX);
Vanger	0:b86d15c6ba29	767	return err;
Vanger	0:b86d15c6ba29	768	#else
Vanger	0:b86d15c6ba29	769	/* no invmod */
Vanger	0:b86d15c6ba29	770	return MP_VAL;
Vanger	0:b86d15c6ba29	771	#endif
Vanger	0:b86d15c6ba29	772	}
Vanger	0:b86d15c6ba29	773
Vanger	0:b86d15c6ba29	774	/* modified diminished radix reduction */
Vanger	0:b86d15c6ba29	775	#if defined(BN_MP_REDUCE_IS_2K_L_C) && defined(BN_MP_REDUCE_2K_L_C) && \
Vanger	0:b86d15c6ba29	776	defined(BN_S_MP_EXPTMOD_C)
Vanger	0:b86d15c6ba29	777	if (mp_reduce_is_2k_l(P) == MP_YES) {
Vanger	0:b86d15c6ba29	778	return s_mp_exptmod(G, X, P, Y, 1);
Vanger	0:b86d15c6ba29	779	}
Vanger	0:b86d15c6ba29	780	#endif
Vanger	0:b86d15c6ba29	781
Vanger	0:b86d15c6ba29	782	#ifdef BN_MP_DR_IS_MODULUS_C
Vanger	0:b86d15c6ba29	783	/* is it a DR modulus? */
Vanger	0:b86d15c6ba29	784	dr = mp_dr_is_modulus(P);
Vanger	0:b86d15c6ba29	785	#else
Vanger	0:b86d15c6ba29	786	/* default to no */
Vanger	0:b86d15c6ba29	787	dr = 0;
Vanger	0:b86d15c6ba29	788	#endif
Vanger	0:b86d15c6ba29	789
Vanger	0:b86d15c6ba29	790	#ifdef BN_MP_REDUCE_IS_2K_C
Vanger	0:b86d15c6ba29	791	/* if not, is it a unrestricted DR modulus? */
Vanger	0:b86d15c6ba29	792	if (dr == 0) {
Vanger	0:b86d15c6ba29	793	dr = mp_reduce_is_2k(P) << 1;
Vanger	0:b86d15c6ba29	794	}
Vanger	0:b86d15c6ba29	795	#endif
Vanger	0:b86d15c6ba29	796
Vanger	0:b86d15c6ba29	797	/* if the modulus is odd or dr != 0 use the montgomery method */
Vanger	0:b86d15c6ba29	798	#ifdef BN_MP_EXPTMOD_FAST_C
Vanger	0:b86d15c6ba29	799	if (mp_isodd (P) == 1 \|\| dr != 0) {
Vanger	0:b86d15c6ba29	800	return mp_exptmod_fast (G, X, P, Y, dr);
Vanger	0:b86d15c6ba29	801	} else {
Vanger	0:b86d15c6ba29	802	#endif
Vanger	0:b86d15c6ba29	803	#ifdef BN_S_MP_EXPTMOD_C
Vanger	0:b86d15c6ba29	804	/* otherwise use the generic Barrett reduction technique */
Vanger	0:b86d15c6ba29	805	return s_mp_exptmod (G, X, P, Y, 0);
Vanger	0:b86d15c6ba29	806	#else
Vanger	0:b86d15c6ba29	807	/* no exptmod for evens */
Vanger	0:b86d15c6ba29	808	return MP_VAL;
Vanger	0:b86d15c6ba29	809	#endif
Vanger	0:b86d15c6ba29	810	#ifdef BN_MP_EXPTMOD_FAST_C
Vanger	0:b86d15c6ba29	811	}
Vanger	0:b86d15c6ba29	812	#endif
Vanger	0:b86d15c6ba29	813	}
Vanger	0:b86d15c6ba29	814
Vanger	0:b86d15c6ba29	815
Vanger	0:b86d15c6ba29	816	/* b = \|a\|
Vanger	0:b86d15c6ba29	817	*
Vanger	0:b86d15c6ba29	818	* Simple function copies the input and fixes the sign to positive
Vanger	0:b86d15c6ba29	819	*/
Vanger	0:b86d15c6ba29	820	int
Vanger	0:b86d15c6ba29	821	mp_abs (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	822	{
Vanger	0:b86d15c6ba29	823	int res;
Vanger	0:b86d15c6ba29	824
Vanger	0:b86d15c6ba29	825	/* copy a to b */
Vanger	0:b86d15c6ba29	826	if (a != b) {
Vanger	0:b86d15c6ba29	827	if ((res = mp_copy (a, b)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	828	return res;
Vanger	0:b86d15c6ba29	829	}
Vanger	0:b86d15c6ba29	830	}
Vanger	0:b86d15c6ba29	831
Vanger	0:b86d15c6ba29	832	/* force the sign of b to positive */
Vanger	0:b86d15c6ba29	833	b->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	834
Vanger	0:b86d15c6ba29	835	return MP_OKAY;
Vanger	0:b86d15c6ba29	836	}
Vanger	0:b86d15c6ba29	837
Vanger	0:b86d15c6ba29	838
Vanger	0:b86d15c6ba29	839	/* hac 14.61, pp608 */
Vanger	0:b86d15c6ba29	840	int mp_invmod (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	841	{
Vanger	0:b86d15c6ba29	842	/* b cannot be negative */
Vanger	0:b86d15c6ba29	843	if (b->sign == MP_NEG \|\| mp_iszero(b) == 1) {
Vanger	0:b86d15c6ba29	844	return MP_VAL;
Vanger	0:b86d15c6ba29	845	}
Vanger	0:b86d15c6ba29	846
Vanger	0:b86d15c6ba29	847	#ifdef BN_FAST_MP_INVMOD_C
Vanger	0:b86d15c6ba29	848	/* if the modulus is odd we can use a faster routine instead */
Vanger	0:b86d15c6ba29	849	if (mp_isodd (b) == 1) {
Vanger	0:b86d15c6ba29	850	return fast_mp_invmod (a, b, c);
Vanger	0:b86d15c6ba29	851	}
Vanger	0:b86d15c6ba29	852	#endif
Vanger	0:b86d15c6ba29	853
Vanger	0:b86d15c6ba29	854	#ifdef BN_MP_INVMOD_SLOW_C
Vanger	0:b86d15c6ba29	855	return mp_invmod_slow(a, b, c);
Vanger	0:b86d15c6ba29	856	#endif
Vanger	0:b86d15c6ba29	857	}
Vanger	0:b86d15c6ba29	858
Vanger	0:b86d15c6ba29	859
Vanger	0:b86d15c6ba29	860	/* computes the modular inverse via binary extended euclidean algorithm,
Vanger	0:b86d15c6ba29	861	* that is c = 1/a mod b
Vanger	0:b86d15c6ba29	862	*
Vanger	0:b86d15c6ba29	863	* Based on slow invmod except this is optimized for the case where b is
Vanger	0:b86d15c6ba29	864	* odd as per HAC Note 14.64 on pp. 610
Vanger	0:b86d15c6ba29	865	*/
Vanger	0:b86d15c6ba29	866	int fast_mp_invmod (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	867	{
Vanger	0:b86d15c6ba29	868	mp_int x, y, u, v, B, D;
Vanger	0:b86d15c6ba29	869	int res, neg;
Vanger	0:b86d15c6ba29	870
Vanger	0:b86d15c6ba29	871	/* 2. [modified] b must be odd */
Vanger	0:b86d15c6ba29	872	if (mp_iseven (b) == 1) {
Vanger	0:b86d15c6ba29	873	return MP_VAL;
Vanger	0:b86d15c6ba29	874	}
Vanger	0:b86d15c6ba29	875
Vanger	0:b86d15c6ba29	876	/* init all our temps */
Vanger	0:b86d15c6ba29	877	if ((res = mp_init_multi(&x, &y, &u, &v, &B, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	878	return res;
Vanger	0:b86d15c6ba29	879	}
Vanger	0:b86d15c6ba29	880
Vanger	0:b86d15c6ba29	881	/* x == modulus, y == value to invert */
Vanger	0:b86d15c6ba29	882	if ((res = mp_copy (b, &x)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	883	goto LBL_ERR;
Vanger	0:b86d15c6ba29	884	}
Vanger	0:b86d15c6ba29	885
Vanger	0:b86d15c6ba29	886	/* we need y = \|a\| */
Vanger	0:b86d15c6ba29	887	if ((res = mp_mod (a, b, &y)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	888	goto LBL_ERR;
Vanger	0:b86d15c6ba29	889	}
Vanger	0:b86d15c6ba29	890
Vanger	0:b86d15c6ba29	891	/* 3. u=x, v=y, A=1, B=0, C=0,D=1 */
Vanger	0:b86d15c6ba29	892	if ((res = mp_copy (&x, &u)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	893	goto LBL_ERR;
Vanger	0:b86d15c6ba29	894	}
Vanger	0:b86d15c6ba29	895	if ((res = mp_copy (&y, &v)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	896	goto LBL_ERR;
Vanger	0:b86d15c6ba29	897	}
Vanger	0:b86d15c6ba29	898	mp_set (&D, 1);
Vanger	0:b86d15c6ba29	899
Vanger	0:b86d15c6ba29	900	top:
Vanger	0:b86d15c6ba29	901	/* 4. while u is even do */
Vanger	0:b86d15c6ba29	902	while (mp_iseven (&u) == 1) {
Vanger	0:b86d15c6ba29	903	/* 4.1 u = u/2 */
Vanger	0:b86d15c6ba29	904	if ((res = mp_div_2 (&u, &u)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	905	goto LBL_ERR;
Vanger	0:b86d15c6ba29	906	}
Vanger	0:b86d15c6ba29	907	/* 4.2 if B is odd then */
Vanger	0:b86d15c6ba29	908	if (mp_isodd (&B) == 1) {
Vanger	0:b86d15c6ba29	909	if ((res = mp_sub (&B, &x, &B)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	910	goto LBL_ERR;
Vanger	0:b86d15c6ba29	911	}
Vanger	0:b86d15c6ba29	912	}
Vanger	0:b86d15c6ba29	913	/* B = B/2 */
Vanger	0:b86d15c6ba29	914	if ((res = mp_div_2 (&B, &B)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	915	goto LBL_ERR;
Vanger	0:b86d15c6ba29	916	}
Vanger	0:b86d15c6ba29	917	}
Vanger	0:b86d15c6ba29	918
Vanger	0:b86d15c6ba29	919	/* 5. while v is even do */
Vanger	0:b86d15c6ba29	920	while (mp_iseven (&v) == 1) {
Vanger	0:b86d15c6ba29	921	/* 5.1 v = v/2 */
Vanger	0:b86d15c6ba29	922	if ((res = mp_div_2 (&v, &v)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	923	goto LBL_ERR;
Vanger	0:b86d15c6ba29	924	}
Vanger	0:b86d15c6ba29	925	/* 5.2 if D is odd then */
Vanger	0:b86d15c6ba29	926	if (mp_isodd (&D) == 1) {
Vanger	0:b86d15c6ba29	927	/* D = (D-x)/2 */
Vanger	0:b86d15c6ba29	928	if ((res = mp_sub (&D, &x, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	929	goto LBL_ERR;
Vanger	0:b86d15c6ba29	930	}
Vanger	0:b86d15c6ba29	931	}
Vanger	0:b86d15c6ba29	932	/* D = D/2 */
Vanger	0:b86d15c6ba29	933	if ((res = mp_div_2 (&D, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	934	goto LBL_ERR;
Vanger	0:b86d15c6ba29	935	}
Vanger	0:b86d15c6ba29	936	}
Vanger	0:b86d15c6ba29	937
Vanger	0:b86d15c6ba29	938	/* 6. if u >= v then */
Vanger	0:b86d15c6ba29	939	if (mp_cmp (&u, &v) != MP_LT) {
Vanger	0:b86d15c6ba29	940	/* u = u - v, B = B - D */
Vanger	0:b86d15c6ba29	941	if ((res = mp_sub (&u, &v, &u)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	942	goto LBL_ERR;
Vanger	0:b86d15c6ba29	943	}
Vanger	0:b86d15c6ba29	944
Vanger	0:b86d15c6ba29	945	if ((res = mp_sub (&B, &D, &B)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	946	goto LBL_ERR;
Vanger	0:b86d15c6ba29	947	}
Vanger	0:b86d15c6ba29	948	} else {
Vanger	0:b86d15c6ba29	949	/* v - v - u, D = D - B */
Vanger	0:b86d15c6ba29	950	if ((res = mp_sub (&v, &u, &v)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	951	goto LBL_ERR;
Vanger	0:b86d15c6ba29	952	}
Vanger	0:b86d15c6ba29	953
Vanger	0:b86d15c6ba29	954	if ((res = mp_sub (&D, &B, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	955	goto LBL_ERR;
Vanger	0:b86d15c6ba29	956	}
Vanger	0:b86d15c6ba29	957	}
Vanger	0:b86d15c6ba29	958
Vanger	0:b86d15c6ba29	959	/* if not zero goto step 4 */
Vanger	0:b86d15c6ba29	960	if (mp_iszero (&u) == 0) {
Vanger	0:b86d15c6ba29	961	goto top;
Vanger	0:b86d15c6ba29	962	}
Vanger	0:b86d15c6ba29	963
Vanger	0:b86d15c6ba29	964	/* now a = C, b = D, gcd == gv /
Vanger	0:b86d15c6ba29	965
Vanger	0:b86d15c6ba29	966	/* if v != 1 then there is no inverse */
Vanger	0:b86d15c6ba29	967	if (mp_cmp_d (&v, 1) != MP_EQ) {
Vanger	0:b86d15c6ba29	968	res = MP_VAL;
Vanger	0:b86d15c6ba29	969	goto LBL_ERR;
Vanger	0:b86d15c6ba29	970	}
Vanger	0:b86d15c6ba29	971
Vanger	0:b86d15c6ba29	972	/* b is now the inverse */
Vanger	0:b86d15c6ba29	973	neg = a->sign;
Vanger	0:b86d15c6ba29	974	while (D.sign == MP_NEG) {
Vanger	0:b86d15c6ba29	975	if ((res = mp_add (&D, b, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	976	goto LBL_ERR;
Vanger	0:b86d15c6ba29	977	}
Vanger	0:b86d15c6ba29	978	}
Vanger	0:b86d15c6ba29	979	mp_exch (&D, c);
Vanger	0:b86d15c6ba29	980	c->sign = neg;
Vanger	0:b86d15c6ba29	981	res = MP_OKAY;
Vanger	0:b86d15c6ba29	982
Vanger	0:b86d15c6ba29	983	LBL_ERR:mp_clear(&x);
Vanger	0:b86d15c6ba29	984	mp_clear(&y);
Vanger	0:b86d15c6ba29	985	mp_clear(&u);
Vanger	0:b86d15c6ba29	986	mp_clear(&v);
Vanger	0:b86d15c6ba29	987	mp_clear(&B);
Vanger	0:b86d15c6ba29	988	mp_clear(&D);
Vanger	0:b86d15c6ba29	989	return res;
Vanger	0:b86d15c6ba29	990	}
Vanger	0:b86d15c6ba29	991
Vanger	0:b86d15c6ba29	992
Vanger	0:b86d15c6ba29	993	/* hac 14.61, pp608 */
Vanger	0:b86d15c6ba29	994	int mp_invmod_slow (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	995	{
Vanger	0:b86d15c6ba29	996	mp_int x, y, u, v, A, B, C, D;
Vanger	0:b86d15c6ba29	997	int res;
Vanger	0:b86d15c6ba29	998
Vanger	0:b86d15c6ba29	999	/* b cannot be negative */
Vanger	0:b86d15c6ba29	1000	if (b->sign == MP_NEG \|\| mp_iszero(b) == 1) {
Vanger	0:b86d15c6ba29	1001	return MP_VAL;
Vanger	0:b86d15c6ba29	1002	}
Vanger	0:b86d15c6ba29	1003
Vanger	0:b86d15c6ba29	1004	/* init temps */
Vanger	0:b86d15c6ba29	1005	if ((res = mp_init_multi(&x, &y, &u, &v,
Vanger	0:b86d15c6ba29	1006	&A, &B)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1007	return res;
Vanger	0:b86d15c6ba29	1008	}
Vanger	0:b86d15c6ba29	1009
Vanger	0:b86d15c6ba29	1010	/* init rest of tmps temps */
Vanger	0:b86d15c6ba29	1011	if ((res = mp_init_multi(&C, &D, 0, 0, 0, 0)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1012	return res;
Vanger	0:b86d15c6ba29	1013	}
Vanger	0:b86d15c6ba29	1014
Vanger	0:b86d15c6ba29	1015	/* x = a, y = b */
Vanger	0:b86d15c6ba29	1016	if ((res = mp_mod(a, b, &x)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1017	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1018	}
Vanger	0:b86d15c6ba29	1019	if ((res = mp_copy (b, &y)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1020	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1021	}
Vanger	0:b86d15c6ba29	1022
Vanger	0:b86d15c6ba29	1023	/* 2. [modified] if x,y are both even then return an error! */
Vanger	0:b86d15c6ba29	1024	if (mp_iseven (&x) == 1 && mp_iseven (&y) == 1) {
Vanger	0:b86d15c6ba29	1025	res = MP_VAL;
Vanger	0:b86d15c6ba29	1026	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1027	}
Vanger	0:b86d15c6ba29	1028
Vanger	0:b86d15c6ba29	1029	/* 3. u=x, v=y, A=1, B=0, C=0,D=1 */
Vanger	0:b86d15c6ba29	1030	if ((res = mp_copy (&x, &u)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1031	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1032	}
Vanger	0:b86d15c6ba29	1033	if ((res = mp_copy (&y, &v)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1034	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1035	}
Vanger	0:b86d15c6ba29	1036	mp_set (&A, 1);
Vanger	0:b86d15c6ba29	1037	mp_set (&D, 1);
Vanger	0:b86d15c6ba29	1038
Vanger	0:b86d15c6ba29	1039	top:
Vanger	0:b86d15c6ba29	1040	/* 4. while u is even do */
Vanger	0:b86d15c6ba29	1041	while (mp_iseven (&u) == 1) {
Vanger	0:b86d15c6ba29	1042	/* 4.1 u = u/2 */
Vanger	0:b86d15c6ba29	1043	if ((res = mp_div_2 (&u, &u)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1044	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1045	}
Vanger	0:b86d15c6ba29	1046	/* 4.2 if A or B is odd then */
Vanger	0:b86d15c6ba29	1047	if (mp_isodd (&A) == 1 \|\| mp_isodd (&B) == 1) {
Vanger	0:b86d15c6ba29	1048	/* A = (A+y)/2, B = (B-x)/2 */
Vanger	0:b86d15c6ba29	1049	if ((res = mp_add (&A, &y, &A)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1050	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1051	}
Vanger	0:b86d15c6ba29	1052	if ((res = mp_sub (&B, &x, &B)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1053	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1054	}
Vanger	0:b86d15c6ba29	1055	}
Vanger	0:b86d15c6ba29	1056	/* A = A/2, B = B/2 */
Vanger	0:b86d15c6ba29	1057	if ((res = mp_div_2 (&A, &A)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1058	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1059	}
Vanger	0:b86d15c6ba29	1060	if ((res = mp_div_2 (&B, &B)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1061	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1062	}
Vanger	0:b86d15c6ba29	1063	}
Vanger	0:b86d15c6ba29	1064
Vanger	0:b86d15c6ba29	1065	/* 5. while v is even do */
Vanger	0:b86d15c6ba29	1066	while (mp_iseven (&v) == 1) {
Vanger	0:b86d15c6ba29	1067	/* 5.1 v = v/2 */
Vanger	0:b86d15c6ba29	1068	if ((res = mp_div_2 (&v, &v)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1069	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1070	}
Vanger	0:b86d15c6ba29	1071	/* 5.2 if C or D is odd then */
Vanger	0:b86d15c6ba29	1072	if (mp_isodd (&C) == 1 \|\| mp_isodd (&D) == 1) {
Vanger	0:b86d15c6ba29	1073	/* C = (C+y)/2, D = (D-x)/2 */
Vanger	0:b86d15c6ba29	1074	if ((res = mp_add (&C, &y, &C)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1075	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1076	}
Vanger	0:b86d15c6ba29	1077	if ((res = mp_sub (&D, &x, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1078	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1079	}
Vanger	0:b86d15c6ba29	1080	}
Vanger	0:b86d15c6ba29	1081	/* C = C/2, D = D/2 */
Vanger	0:b86d15c6ba29	1082	if ((res = mp_div_2 (&C, &C)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1083	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1084	}
Vanger	0:b86d15c6ba29	1085	if ((res = mp_div_2 (&D, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1086	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1087	}
Vanger	0:b86d15c6ba29	1088	}
Vanger	0:b86d15c6ba29	1089
Vanger	0:b86d15c6ba29	1090	/* 6. if u >= v then */
Vanger	0:b86d15c6ba29	1091	if (mp_cmp (&u, &v) != MP_LT) {
Vanger	0:b86d15c6ba29	1092	/* u = u - v, A = A - C, B = B - D */
Vanger	0:b86d15c6ba29	1093	if ((res = mp_sub (&u, &v, &u)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1094	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1095	}
Vanger	0:b86d15c6ba29	1096
Vanger	0:b86d15c6ba29	1097	if ((res = mp_sub (&A, &C, &A)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1098	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1099	}
Vanger	0:b86d15c6ba29	1100
Vanger	0:b86d15c6ba29	1101	if ((res = mp_sub (&B, &D, &B)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1102	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1103	}
Vanger	0:b86d15c6ba29	1104	} else {
Vanger	0:b86d15c6ba29	1105	/* v - v - u, C = C - A, D = D - B */
Vanger	0:b86d15c6ba29	1106	if ((res = mp_sub (&v, &u, &v)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1107	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1108	}
Vanger	0:b86d15c6ba29	1109
Vanger	0:b86d15c6ba29	1110	if ((res = mp_sub (&C, &A, &C)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1111	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1112	}
Vanger	0:b86d15c6ba29	1113
Vanger	0:b86d15c6ba29	1114	if ((res = mp_sub (&D, &B, &D)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1115	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1116	}
Vanger	0:b86d15c6ba29	1117	}
Vanger	0:b86d15c6ba29	1118
Vanger	0:b86d15c6ba29	1119	/* if not zero goto step 4 */
Vanger	0:b86d15c6ba29	1120	if (mp_iszero (&u) == 0)
Vanger	0:b86d15c6ba29	1121	goto top;
Vanger	0:b86d15c6ba29	1122
Vanger	0:b86d15c6ba29	1123	/* now a = C, b = D, gcd == gv /
Vanger	0:b86d15c6ba29	1124
Vanger	0:b86d15c6ba29	1125	/* if v != 1 then there is no inverse */
Vanger	0:b86d15c6ba29	1126	if (mp_cmp_d (&v, 1) != MP_EQ) {
Vanger	0:b86d15c6ba29	1127	res = MP_VAL;
Vanger	0:b86d15c6ba29	1128	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1129	}
Vanger	0:b86d15c6ba29	1130
Vanger	0:b86d15c6ba29	1131	/* if its too low */
Vanger	0:b86d15c6ba29	1132	while (mp_cmp_d(&C, 0) == MP_LT) {
Vanger	0:b86d15c6ba29	1133	if ((res = mp_add(&C, b, &C)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1134	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1135	}
Vanger	0:b86d15c6ba29	1136	}
Vanger	0:b86d15c6ba29	1137
Vanger	0:b86d15c6ba29	1138	/* too big */
Vanger	0:b86d15c6ba29	1139	while (mp_cmp_mag(&C, b) != MP_LT) {
Vanger	0:b86d15c6ba29	1140	if ((res = mp_sub(&C, b, &C)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1141	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1142	}
Vanger	0:b86d15c6ba29	1143	}
Vanger	0:b86d15c6ba29	1144
Vanger	0:b86d15c6ba29	1145	/* C is now the inverse */
Vanger	0:b86d15c6ba29	1146	mp_exch (&C, c);
Vanger	0:b86d15c6ba29	1147	res = MP_OKAY;
Vanger	0:b86d15c6ba29	1148	LBL_ERR:mp_clear(&x);
Vanger	0:b86d15c6ba29	1149	mp_clear(&y);
Vanger	0:b86d15c6ba29	1150	mp_clear(&u);
Vanger	0:b86d15c6ba29	1151	mp_clear(&v);
Vanger	0:b86d15c6ba29	1152	mp_clear(&A);
Vanger	0:b86d15c6ba29	1153	mp_clear(&B);
Vanger	0:b86d15c6ba29	1154	mp_clear(&C);
Vanger	0:b86d15c6ba29	1155	mp_clear(&D);
Vanger	0:b86d15c6ba29	1156	return res;
Vanger	0:b86d15c6ba29	1157	}
Vanger	0:b86d15c6ba29	1158
Vanger	0:b86d15c6ba29	1159
Vanger	0:b86d15c6ba29	1160	/* compare maginitude of two ints (unsigned) */
Vanger	0:b86d15c6ba29	1161	int mp_cmp_mag (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	1162	{
Vanger	0:b86d15c6ba29	1163	int n;
Vanger	0:b86d15c6ba29	1164	mp_digit tmpa, tmpb;
Vanger	0:b86d15c6ba29	1165
Vanger	0:b86d15c6ba29	1166	/* compare based on # of non-zero digits */
Vanger	0:b86d15c6ba29	1167	if (a->used > b->used) {
Vanger	0:b86d15c6ba29	1168	return MP_GT;
Vanger	0:b86d15c6ba29	1169	}
Vanger	0:b86d15c6ba29	1170
Vanger	0:b86d15c6ba29	1171	if (a->used < b->used) {
Vanger	0:b86d15c6ba29	1172	return MP_LT;
Vanger	0:b86d15c6ba29	1173	}
Vanger	0:b86d15c6ba29	1174
Vanger	0:b86d15c6ba29	1175	/* alias for a */
Vanger	0:b86d15c6ba29	1176	tmpa = a->dp + (a->used - 1);
Vanger	0:b86d15c6ba29	1177
Vanger	0:b86d15c6ba29	1178	/* alias for b */
Vanger	0:b86d15c6ba29	1179	tmpb = b->dp + (a->used - 1);
Vanger	0:b86d15c6ba29	1180
Vanger	0:b86d15c6ba29	1181	/* compare based on digits */
Vanger	0:b86d15c6ba29	1182	for (n = 0; n < a->used; ++n, --tmpa, --tmpb) {
Vanger	0:b86d15c6ba29	1183	if (tmpa > tmpb) {
Vanger	0:b86d15c6ba29	1184	return MP_GT;
Vanger	0:b86d15c6ba29	1185	}
Vanger	0:b86d15c6ba29	1186
Vanger	0:b86d15c6ba29	1187	if (tmpa < tmpb) {
Vanger	0:b86d15c6ba29	1188	return MP_LT;
Vanger	0:b86d15c6ba29	1189	}
Vanger	0:b86d15c6ba29	1190	}
Vanger	0:b86d15c6ba29	1191	return MP_EQ;
Vanger	0:b86d15c6ba29	1192	}
Vanger	0:b86d15c6ba29	1193
Vanger	0:b86d15c6ba29	1194
Vanger	0:b86d15c6ba29	1195	/* compare two ints (signed)*/
Vanger	0:b86d15c6ba29	1196	int
Vanger	0:b86d15c6ba29	1197	mp_cmp (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	1198	{
Vanger	0:b86d15c6ba29	1199	/* compare based on sign */
Vanger	0:b86d15c6ba29	1200	if (a->sign != b->sign) {
Vanger	0:b86d15c6ba29	1201	if (a->sign == MP_NEG) {
Vanger	0:b86d15c6ba29	1202	return MP_LT;
Vanger	0:b86d15c6ba29	1203	} else {
Vanger	0:b86d15c6ba29	1204	return MP_GT;
Vanger	0:b86d15c6ba29	1205	}
Vanger	0:b86d15c6ba29	1206	}
Vanger	0:b86d15c6ba29	1207
Vanger	0:b86d15c6ba29	1208	/* compare digits */
Vanger	0:b86d15c6ba29	1209	if (a->sign == MP_NEG) {
Vanger	0:b86d15c6ba29	1210	/* if negative compare opposite direction */
Vanger	0:b86d15c6ba29	1211	return mp_cmp_mag(b, a);
Vanger	0:b86d15c6ba29	1212	} else {
Vanger	0:b86d15c6ba29	1213	return mp_cmp_mag(a, b);
Vanger	0:b86d15c6ba29	1214	}
Vanger	0:b86d15c6ba29	1215	}
Vanger	0:b86d15c6ba29	1216
Vanger	0:b86d15c6ba29	1217
Vanger	0:b86d15c6ba29	1218	/* compare a digit */
Vanger	0:b86d15c6ba29	1219	int mp_cmp_d(mp_int * a, mp_digit b)
Vanger	0:b86d15c6ba29	1220	{
Vanger	0:b86d15c6ba29	1221	/* compare based on sign */
Vanger	0:b86d15c6ba29	1222	if (a->sign == MP_NEG) {
Vanger	0:b86d15c6ba29	1223	return MP_LT;
Vanger	0:b86d15c6ba29	1224	}
Vanger	0:b86d15c6ba29	1225
Vanger	0:b86d15c6ba29	1226	/* compare based on magnitude */
Vanger	0:b86d15c6ba29	1227	if (a->used > 1) {
Vanger	0:b86d15c6ba29	1228	return MP_GT;
Vanger	0:b86d15c6ba29	1229	}
Vanger	0:b86d15c6ba29	1230
Vanger	0:b86d15c6ba29	1231	/* compare the only digit of a to b */
Vanger	0:b86d15c6ba29	1232	if (a->dp[0] > b) {
Vanger	0:b86d15c6ba29	1233	return MP_GT;
Vanger	0:b86d15c6ba29	1234	} else if (a->dp[0] < b) {
Vanger	0:b86d15c6ba29	1235	return MP_LT;
Vanger	0:b86d15c6ba29	1236	} else {
Vanger	0:b86d15c6ba29	1237	return MP_EQ;
Vanger	0:b86d15c6ba29	1238	}
Vanger	0:b86d15c6ba29	1239	}
Vanger	0:b86d15c6ba29	1240
Vanger	0:b86d15c6ba29	1241
Vanger	0:b86d15c6ba29	1242	/* set to a digit */
Vanger	0:b86d15c6ba29	1243	void mp_set (mp_int * a, mp_digit b)
Vanger	0:b86d15c6ba29	1244	{
Vanger	0:b86d15c6ba29	1245	mp_zero (a);
Vanger	0:b86d15c6ba29	1246	a->dp[0] = b & MP_MASK;
Vanger	0:b86d15c6ba29	1247	a->used = (a->dp[0] != 0) ? 1 : 0;
Vanger	0:b86d15c6ba29	1248	}
Vanger	0:b86d15c6ba29	1249
Vanger	0:b86d15c6ba29	1250
Vanger	0:b86d15c6ba29	1251	/* c = a mod b, 0 <= c < b */
Vanger	0:b86d15c6ba29	1252	int
Vanger	0:b86d15c6ba29	1253	mp_mod (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	1254	{
Vanger	0:b86d15c6ba29	1255	mp_int t;
Vanger	0:b86d15c6ba29	1256	int res;
Vanger	0:b86d15c6ba29	1257
Vanger	0:b86d15c6ba29	1258	if ((res = mp_init (&t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1259	return res;
Vanger	0:b86d15c6ba29	1260	}
Vanger	0:b86d15c6ba29	1261
Vanger	0:b86d15c6ba29	1262	if ((res = mp_div (a, b, NULL, &t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1263	mp_clear (&t);
Vanger	0:b86d15c6ba29	1264	return res;
Vanger	0:b86d15c6ba29	1265	}
Vanger	0:b86d15c6ba29	1266
Vanger	0:b86d15c6ba29	1267	if (t.sign != b->sign) {
Vanger	0:b86d15c6ba29	1268	res = mp_add (b, &t, c);
Vanger	0:b86d15c6ba29	1269	} else {
Vanger	0:b86d15c6ba29	1270	res = MP_OKAY;
Vanger	0:b86d15c6ba29	1271	mp_exch (&t, c);
Vanger	0:b86d15c6ba29	1272	}
Vanger	0:b86d15c6ba29	1273
Vanger	0:b86d15c6ba29	1274	mp_clear (&t);
Vanger	0:b86d15c6ba29	1275	return res;
Vanger	0:b86d15c6ba29	1276	}
Vanger	0:b86d15c6ba29	1277
Vanger	0:b86d15c6ba29	1278
Vanger	0:b86d15c6ba29	1279	/* slower bit-bang division... also smaller */
Vanger	0:b86d15c6ba29	1280	int mp_div(mp_int * a, mp_int * b, mp_int * c, mp_int * d)
Vanger	0:b86d15c6ba29	1281	{
Vanger	0:b86d15c6ba29	1282	mp_int ta, tb, tq, q;
Vanger	0:b86d15c6ba29	1283	int res, n, n2;
Vanger	0:b86d15c6ba29	1284
Vanger	0:b86d15c6ba29	1285	/* is divisor zero ? */
Vanger	0:b86d15c6ba29	1286	if (mp_iszero (b) == 1) {
Vanger	0:b86d15c6ba29	1287	return MP_VAL;
Vanger	0:b86d15c6ba29	1288	}
Vanger	0:b86d15c6ba29	1289
Vanger	0:b86d15c6ba29	1290	/* if a < b then q=0, r = a */
Vanger	0:b86d15c6ba29	1291	if (mp_cmp_mag (a, b) == MP_LT) {
Vanger	0:b86d15c6ba29	1292	if (d != NULL) {
Vanger	0:b86d15c6ba29	1293	res = mp_copy (a, d);
Vanger	0:b86d15c6ba29	1294	} else {
Vanger	0:b86d15c6ba29	1295	res = MP_OKAY;
Vanger	0:b86d15c6ba29	1296	}
Vanger	0:b86d15c6ba29	1297	if (c != NULL) {
Vanger	0:b86d15c6ba29	1298	mp_zero (c);
Vanger	0:b86d15c6ba29	1299	}
Vanger	0:b86d15c6ba29	1300	return res;
Vanger	0:b86d15c6ba29	1301	}
Vanger	0:b86d15c6ba29	1302
Vanger	0:b86d15c6ba29	1303	/* init our temps */
Vanger	0:b86d15c6ba29	1304	if ((res = mp_init_multi(&ta, &tb, &tq, &q, 0, 0)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1305	return res;
Vanger	0:b86d15c6ba29	1306	}
Vanger	0:b86d15c6ba29	1307
Vanger	0:b86d15c6ba29	1308
Vanger	0:b86d15c6ba29	1309	mp_set(&tq, 1);
Vanger	0:b86d15c6ba29	1310	n = mp_count_bits(a) - mp_count_bits(b);
Vanger	0:b86d15c6ba29	1311	if (((res = mp_abs(a, &ta)) != MP_OKAY) \|\|
Vanger	0:b86d15c6ba29	1312	((res = mp_abs(b, &tb)) != MP_OKAY) \|\|
Vanger	0:b86d15c6ba29	1313	((res = mp_mul_2d(&tb, n, &tb)) != MP_OKAY) \|\|
Vanger	0:b86d15c6ba29	1314	((res = mp_mul_2d(&tq, n, &tq)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	1315	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1316	}
Vanger	0:b86d15c6ba29	1317
Vanger	0:b86d15c6ba29	1318	while (n-- >= 0) {
Vanger	0:b86d15c6ba29	1319	if (mp_cmp(&tb, &ta) != MP_GT) {
Vanger	0:b86d15c6ba29	1320	if (((res = mp_sub(&ta, &tb, &ta)) != MP_OKAY) \|\|
Vanger	0:b86d15c6ba29	1321	((res = mp_add(&q, &tq, &q)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	1322	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1323	}
Vanger	0:b86d15c6ba29	1324	}
Vanger	0:b86d15c6ba29	1325	if (((res = mp_div_2d(&tb, 1, &tb, NULL)) != MP_OKAY) \|\|
Vanger	0:b86d15c6ba29	1326	((res = mp_div_2d(&tq, 1, &tq, NULL)) != MP_OKAY)) {
Vanger	0:b86d15c6ba29	1327	goto LBL_ERR;
Vanger	0:b86d15c6ba29	1328	}
Vanger	0:b86d15c6ba29	1329	}
Vanger	0:b86d15c6ba29	1330
Vanger	0:b86d15c6ba29	1331	/* now q == quotient and ta == remainder */
Vanger	0:b86d15c6ba29	1332	n = a->sign;
Vanger	0:b86d15c6ba29	1333	n2 = (a->sign == b->sign ? MP_ZPOS : MP_NEG);
Vanger	0:b86d15c6ba29	1334	if (c != NULL) {
Vanger	0:b86d15c6ba29	1335	mp_exch(c, &q);
Vanger	0:b86d15c6ba29	1336	c->sign = (mp_iszero(c) == MP_YES) ? MP_ZPOS : n2;
Vanger	0:b86d15c6ba29	1337	}
Vanger	0:b86d15c6ba29	1338	if (d != NULL) {
Vanger	0:b86d15c6ba29	1339	mp_exch(d, &ta);
Vanger	0:b86d15c6ba29	1340	d->sign = (mp_iszero(d) == MP_YES) ? MP_ZPOS : n;
Vanger	0:b86d15c6ba29	1341	}
Vanger	0:b86d15c6ba29	1342	LBL_ERR:
Vanger	0:b86d15c6ba29	1343	mp_clear(&ta);
Vanger	0:b86d15c6ba29	1344	mp_clear(&tb);
Vanger	0:b86d15c6ba29	1345	mp_clear(&tq);
Vanger	0:b86d15c6ba29	1346	mp_clear(&q);
Vanger	0:b86d15c6ba29	1347	return res;
Vanger	0:b86d15c6ba29	1348	}
Vanger	0:b86d15c6ba29	1349
Vanger	0:b86d15c6ba29	1350
Vanger	0:b86d15c6ba29	1351	/* b = a/2 */
Vanger	0:b86d15c6ba29	1352	int mp_div_2(mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	1353	{
Vanger	0:b86d15c6ba29	1354	int x, res, oldused;
Vanger	0:b86d15c6ba29	1355
Vanger	0:b86d15c6ba29	1356	/* copy */
Vanger	0:b86d15c6ba29	1357	if (b->alloc < a->used) {
Vanger	0:b86d15c6ba29	1358	if ((res = mp_grow (b, a->used)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1359	return res;
Vanger	0:b86d15c6ba29	1360	}
Vanger	0:b86d15c6ba29	1361	}
Vanger	0:b86d15c6ba29	1362
Vanger	0:b86d15c6ba29	1363	oldused = b->used;
Vanger	0:b86d15c6ba29	1364	b->used = a->used;
Vanger	0:b86d15c6ba29	1365	{
Vanger	0:b86d15c6ba29	1366	register mp_digit r, rr, tmpa, tmpb;
Vanger	0:b86d15c6ba29	1367
Vanger	0:b86d15c6ba29	1368	/* source alias */
Vanger	0:b86d15c6ba29	1369	tmpa = a->dp + b->used - 1;
Vanger	0:b86d15c6ba29	1370
Vanger	0:b86d15c6ba29	1371	/* dest alias */
Vanger	0:b86d15c6ba29	1372	tmpb = b->dp + b->used - 1;
Vanger	0:b86d15c6ba29	1373
Vanger	0:b86d15c6ba29	1374	/* carry */
Vanger	0:b86d15c6ba29	1375	r = 0;
Vanger	0:b86d15c6ba29	1376	for (x = b->used - 1; x >= 0; x--) {
Vanger	0:b86d15c6ba29	1377	/* get the carry for the next iteration */
Vanger	0:b86d15c6ba29	1378	rr = *tmpa & 1;
Vanger	0:b86d15c6ba29	1379
Vanger	0:b86d15c6ba29	1380	/* shift the current digit, add in carry and store */
Vanger	0:b86d15c6ba29	1381	tmpb-- = (tmpa-- >> 1) \| (r << (DIGIT_BIT - 1));
Vanger	0:b86d15c6ba29	1382
Vanger	0:b86d15c6ba29	1383	/* forward carry to next iteration */
Vanger	0:b86d15c6ba29	1384	r = rr;
Vanger	0:b86d15c6ba29	1385	}
Vanger	0:b86d15c6ba29	1386
Vanger	0:b86d15c6ba29	1387	/* zero excess digits */
Vanger	0:b86d15c6ba29	1388	tmpb = b->dp + b->used;
Vanger	0:b86d15c6ba29	1389	for (x = b->used; x < oldused; x++) {
Vanger	0:b86d15c6ba29	1390	*tmpb++ = 0;
Vanger	0:b86d15c6ba29	1391	}
Vanger	0:b86d15c6ba29	1392	}
Vanger	0:b86d15c6ba29	1393	b->sign = a->sign;
Vanger	0:b86d15c6ba29	1394	mp_clamp (b);
Vanger	0:b86d15c6ba29	1395	return MP_OKAY;
Vanger	0:b86d15c6ba29	1396	}
Vanger	0:b86d15c6ba29	1397
Vanger	0:b86d15c6ba29	1398
Vanger	0:b86d15c6ba29	1399	/* high level addition (handles signs) */
Vanger	0:b86d15c6ba29	1400	int mp_add (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	1401	{
Vanger	0:b86d15c6ba29	1402	int sa, sb, res;
Vanger	0:b86d15c6ba29	1403
Vanger	0:b86d15c6ba29	1404	/* get sign of both inputs */
Vanger	0:b86d15c6ba29	1405	sa = a->sign;
Vanger	0:b86d15c6ba29	1406	sb = b->sign;
Vanger	0:b86d15c6ba29	1407
Vanger	0:b86d15c6ba29	1408	/* handle two cases, not four */
Vanger	0:b86d15c6ba29	1409	if (sa == sb) {
Vanger	0:b86d15c6ba29	1410	/* both positive or both negative */
Vanger	0:b86d15c6ba29	1411	/* add their magnitudes, copy the sign */
Vanger	0:b86d15c6ba29	1412	c->sign = sa;
Vanger	0:b86d15c6ba29	1413	res = s_mp_add (a, b, c);
Vanger	0:b86d15c6ba29	1414	} else {
Vanger	0:b86d15c6ba29	1415	/* one positive, the other negative */
Vanger	0:b86d15c6ba29	1416	/* subtract the one with the greater magnitude from */
Vanger	0:b86d15c6ba29	1417	/* the one of the lesser magnitude. The result gets */
Vanger	0:b86d15c6ba29	1418	/* the sign of the one with the greater magnitude. */
Vanger	0:b86d15c6ba29	1419	if (mp_cmp_mag (a, b) == MP_LT) {
Vanger	0:b86d15c6ba29	1420	c->sign = sb;
Vanger	0:b86d15c6ba29	1421	res = s_mp_sub (b, a, c);
Vanger	0:b86d15c6ba29	1422	} else {
Vanger	0:b86d15c6ba29	1423	c->sign = sa;
Vanger	0:b86d15c6ba29	1424	res = s_mp_sub (a, b, c);
Vanger	0:b86d15c6ba29	1425	}
Vanger	0:b86d15c6ba29	1426	}
Vanger	0:b86d15c6ba29	1427	return res;
Vanger	0:b86d15c6ba29	1428	}
Vanger	0:b86d15c6ba29	1429
Vanger	0:b86d15c6ba29	1430
Vanger	0:b86d15c6ba29	1431	/* low level addition, based on HAC pp.594, Algorithm 14.7 */
Vanger	0:b86d15c6ba29	1432	int
Vanger	0:b86d15c6ba29	1433	s_mp_add (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	1434	{
Vanger	0:b86d15c6ba29	1435	mp_int *x;
Vanger	0:b86d15c6ba29	1436	int olduse, res, min, max;
Vanger	0:b86d15c6ba29	1437
Vanger	0:b86d15c6ba29	1438	/* find sizes, we let \|a\| <= \|b\| which means we have to sort
Vanger	0:b86d15c6ba29	1439	* them. "x" will point to the input with the most digits
Vanger	0:b86d15c6ba29	1440	*/
Vanger	0:b86d15c6ba29	1441	if (a->used > b->used) {
Vanger	0:b86d15c6ba29	1442	min = b->used;
Vanger	0:b86d15c6ba29	1443	max = a->used;
Vanger	0:b86d15c6ba29	1444	x = a;
Vanger	0:b86d15c6ba29	1445	} else {
Vanger	0:b86d15c6ba29	1446	min = a->used;
Vanger	0:b86d15c6ba29	1447	max = b->used;
Vanger	0:b86d15c6ba29	1448	x = b;
Vanger	0:b86d15c6ba29	1449	}
Vanger	0:b86d15c6ba29	1450
Vanger	0:b86d15c6ba29	1451	/* init result */
Vanger	0:b86d15c6ba29	1452	if (c->alloc < max + 1) {
Vanger	0:b86d15c6ba29	1453	if ((res = mp_grow (c, max + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1454	return res;
Vanger	0:b86d15c6ba29	1455	}
Vanger	0:b86d15c6ba29	1456	}
Vanger	0:b86d15c6ba29	1457
Vanger	0:b86d15c6ba29	1458	/* get old used digit count and set new one */
Vanger	0:b86d15c6ba29	1459	olduse = c->used;
Vanger	0:b86d15c6ba29	1460	c->used = max + 1;
Vanger	0:b86d15c6ba29	1461
Vanger	0:b86d15c6ba29	1462	{
Vanger	0:b86d15c6ba29	1463	register mp_digit u, tmpa, tmpb, *tmpc;
Vanger	0:b86d15c6ba29	1464	register int i;
Vanger	0:b86d15c6ba29	1465
Vanger	0:b86d15c6ba29	1466	/* alias for digit pointers */
Vanger	0:b86d15c6ba29	1467
Vanger	0:b86d15c6ba29	1468	/* first input */
Vanger	0:b86d15c6ba29	1469	tmpa = a->dp;
Vanger	0:b86d15c6ba29	1470
Vanger	0:b86d15c6ba29	1471	/* second input */
Vanger	0:b86d15c6ba29	1472	tmpb = b->dp;
Vanger	0:b86d15c6ba29	1473
Vanger	0:b86d15c6ba29	1474	/* destination */
Vanger	0:b86d15c6ba29	1475	tmpc = c->dp;
Vanger	0:b86d15c6ba29	1476
Vanger	0:b86d15c6ba29	1477	/* zero the carry */
Vanger	0:b86d15c6ba29	1478	u = 0;
Vanger	0:b86d15c6ba29	1479	for (i = 0; i < min; i++) {
Vanger	0:b86d15c6ba29	1480	/* Compute the sum at one digit, T[i] = A[i] + B[i] + U */
Vanger	0:b86d15c6ba29	1481	tmpc = tmpa++ + *tmpb++ + u;
Vanger	0:b86d15c6ba29	1482
Vanger	0:b86d15c6ba29	1483	/* U = carry bit of T[i] */
Vanger	0:b86d15c6ba29	1484	u = *tmpc >> ((mp_digit)DIGIT_BIT);
Vanger	0:b86d15c6ba29	1485
Vanger	0:b86d15c6ba29	1486	/* take away carry bit from T[i] */
Vanger	0:b86d15c6ba29	1487	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	1488	}
Vanger	0:b86d15c6ba29	1489
Vanger	0:b86d15c6ba29	1490	/* now copy higher words if any, that is in A+B
Vanger	0:b86d15c6ba29	1491	* if A or B has more digits add those in
Vanger	0:b86d15c6ba29	1492	*/
Vanger	0:b86d15c6ba29	1493	if (min != max) {
Vanger	0:b86d15c6ba29	1494	for (; i < max; i++) {
Vanger	0:b86d15c6ba29	1495	/* T[i] = X[i] + U */
Vanger	0:b86d15c6ba29	1496	*tmpc = x->dp[i] + u;
Vanger	0:b86d15c6ba29	1497
Vanger	0:b86d15c6ba29	1498	/* U = carry bit of T[i] */
Vanger	0:b86d15c6ba29	1499	u = *tmpc >> ((mp_digit)DIGIT_BIT);
Vanger	0:b86d15c6ba29	1500
Vanger	0:b86d15c6ba29	1501	/* take away carry bit from T[i] */
Vanger	0:b86d15c6ba29	1502	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	1503	}
Vanger	0:b86d15c6ba29	1504	}
Vanger	0:b86d15c6ba29	1505
Vanger	0:b86d15c6ba29	1506	/* add carry */
Vanger	0:b86d15c6ba29	1507	*tmpc++ = u;
Vanger	0:b86d15c6ba29	1508
Vanger	0:b86d15c6ba29	1509	/* clear digits above oldused */
Vanger	0:b86d15c6ba29	1510	for (i = c->used; i < olduse; i++) {
Vanger	0:b86d15c6ba29	1511	*tmpc++ = 0;
Vanger	0:b86d15c6ba29	1512	}
Vanger	0:b86d15c6ba29	1513	}
Vanger	0:b86d15c6ba29	1514
Vanger	0:b86d15c6ba29	1515	mp_clamp (c);
Vanger	0:b86d15c6ba29	1516	return MP_OKAY;
Vanger	0:b86d15c6ba29	1517	}
Vanger	0:b86d15c6ba29	1518
Vanger	0:b86d15c6ba29	1519
Vanger	0:b86d15c6ba29	1520	/* low level subtraction (assumes \|a\| > \|b\|), HAC pp.595 Algorithm 14.9 */
Vanger	0:b86d15c6ba29	1521	int
Vanger	0:b86d15c6ba29	1522	s_mp_sub (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	1523	{
Vanger	0:b86d15c6ba29	1524	int olduse, res, min, max;
Vanger	0:b86d15c6ba29	1525
Vanger	0:b86d15c6ba29	1526	/* find sizes */
Vanger	0:b86d15c6ba29	1527	min = b->used;
Vanger	0:b86d15c6ba29	1528	max = a->used;
Vanger	0:b86d15c6ba29	1529
Vanger	0:b86d15c6ba29	1530	/* init result */
Vanger	0:b86d15c6ba29	1531	if (c->alloc < max) {
Vanger	0:b86d15c6ba29	1532	if ((res = mp_grow (c, max)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1533	return res;
Vanger	0:b86d15c6ba29	1534	}
Vanger	0:b86d15c6ba29	1535	}
Vanger	0:b86d15c6ba29	1536	olduse = c->used;
Vanger	0:b86d15c6ba29	1537	c->used = max;
Vanger	0:b86d15c6ba29	1538
Vanger	0:b86d15c6ba29	1539	{
Vanger	0:b86d15c6ba29	1540	register mp_digit u, tmpa, tmpb, *tmpc;
Vanger	0:b86d15c6ba29	1541	register int i;
Vanger	0:b86d15c6ba29	1542
Vanger	0:b86d15c6ba29	1543	/* alias for digit pointers */
Vanger	0:b86d15c6ba29	1544	tmpa = a->dp;
Vanger	0:b86d15c6ba29	1545	tmpb = b->dp;
Vanger	0:b86d15c6ba29	1546	tmpc = c->dp;
Vanger	0:b86d15c6ba29	1547
Vanger	0:b86d15c6ba29	1548	/* set carry to zero */
Vanger	0:b86d15c6ba29	1549	u = 0;
Vanger	0:b86d15c6ba29	1550	for (i = 0; i < min; i++) {
Vanger	0:b86d15c6ba29	1551	/* T[i] = A[i] - B[i] - U */
Vanger	0:b86d15c6ba29	1552	tmpc = tmpa++ - *tmpb++ - u;
Vanger	0:b86d15c6ba29	1553
Vanger	0:b86d15c6ba29	1554	/* U = carry bit of T[i]
Vanger	0:b86d15c6ba29	1555	* Note this saves performing an AND operation since
Vanger	0:b86d15c6ba29	1556	* if a carry does occur it will propagate all the way to the
Vanger	0:b86d15c6ba29	1557	* MSB. As a result a single shift is enough to get the carry
Vanger	0:b86d15c6ba29	1558	*/
Vanger	0:b86d15c6ba29	1559	u = tmpc >> ((mp_digit)(CHAR_BIT sizeof (mp_digit) - 1));
Vanger	0:b86d15c6ba29	1560
Vanger	0:b86d15c6ba29	1561	/* Clear carry from T[i] */
Vanger	0:b86d15c6ba29	1562	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	1563	}
Vanger	0:b86d15c6ba29	1564
Vanger	0:b86d15c6ba29	1565	/* now copy higher words if any, e.g. if A has more digits than B */
Vanger	0:b86d15c6ba29	1566	for (; i < max; i++) {
Vanger	0:b86d15c6ba29	1567	/* T[i] = A[i] - U */
Vanger	0:b86d15c6ba29	1568	tmpc = tmpa++ - u;
Vanger	0:b86d15c6ba29	1569
Vanger	0:b86d15c6ba29	1570	/* U = carry bit of T[i] */
Vanger	0:b86d15c6ba29	1571	u = tmpc >> ((mp_digit)(CHAR_BIT sizeof (mp_digit) - 1));
Vanger	0:b86d15c6ba29	1572
Vanger	0:b86d15c6ba29	1573	/* Clear carry from T[i] */
Vanger	0:b86d15c6ba29	1574	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	1575	}
Vanger	0:b86d15c6ba29	1576
Vanger	0:b86d15c6ba29	1577	/* clear digits above used (since we may not have grown result above) */
Vanger	0:b86d15c6ba29	1578	for (i = c->used; i < olduse; i++) {
Vanger	0:b86d15c6ba29	1579	*tmpc++ = 0;
Vanger	0:b86d15c6ba29	1580	}
Vanger	0:b86d15c6ba29	1581	}
Vanger	0:b86d15c6ba29	1582
Vanger	0:b86d15c6ba29	1583	mp_clamp (c);
Vanger	0:b86d15c6ba29	1584	return MP_OKAY;
Vanger	0:b86d15c6ba29	1585	}
Vanger	0:b86d15c6ba29	1586
Vanger	0:b86d15c6ba29	1587
Vanger	0:b86d15c6ba29	1588	/* high level subtraction (handles signs) */
Vanger	0:b86d15c6ba29	1589	int
Vanger	0:b86d15c6ba29	1590	mp_sub (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	1591	{
Vanger	0:b86d15c6ba29	1592	int sa, sb, res;
Vanger	0:b86d15c6ba29	1593
Vanger	0:b86d15c6ba29	1594	sa = a->sign;
Vanger	0:b86d15c6ba29	1595	sb = b->sign;
Vanger	0:b86d15c6ba29	1596
Vanger	0:b86d15c6ba29	1597	if (sa != sb) {
Vanger	0:b86d15c6ba29	1598	/* subtract a negative from a positive, OR */
Vanger	0:b86d15c6ba29	1599	/* subtract a positive from a negative. */
Vanger	0:b86d15c6ba29	1600	/* In either case, ADD their magnitudes, */
Vanger	0:b86d15c6ba29	1601	/* and use the sign of the first number. */
Vanger	0:b86d15c6ba29	1602	c->sign = sa;
Vanger	0:b86d15c6ba29	1603	res = s_mp_add (a, b, c);
Vanger	0:b86d15c6ba29	1604	} else {
Vanger	0:b86d15c6ba29	1605	/* subtract a positive from a positive, OR */
Vanger	0:b86d15c6ba29	1606	/* subtract a negative from a negative. */
Vanger	0:b86d15c6ba29	1607	/* First, take the difference between their */
Vanger	0:b86d15c6ba29	1608	/* magnitudes, then... */
Vanger	0:b86d15c6ba29	1609	if (mp_cmp_mag (a, b) != MP_LT) {
Vanger	0:b86d15c6ba29	1610	/* Copy the sign from the first */
Vanger	0:b86d15c6ba29	1611	c->sign = sa;
Vanger	0:b86d15c6ba29	1612	/* The first has a larger or equal magnitude */
Vanger	0:b86d15c6ba29	1613	res = s_mp_sub (a, b, c);
Vanger	0:b86d15c6ba29	1614	} else {
Vanger	0:b86d15c6ba29	1615	/* The result has the opposite sign from */
Vanger	0:b86d15c6ba29	1616	/* the first number. */
Vanger	0:b86d15c6ba29	1617	c->sign = (sa == MP_ZPOS) ? MP_NEG : MP_ZPOS;
Vanger	0:b86d15c6ba29	1618	/* The second has a larger magnitude */
Vanger	0:b86d15c6ba29	1619	res = s_mp_sub (b, a, c);
Vanger	0:b86d15c6ba29	1620	}
Vanger	0:b86d15c6ba29	1621	}
Vanger	0:b86d15c6ba29	1622	return res;
Vanger	0:b86d15c6ba29	1623	}
Vanger	0:b86d15c6ba29	1624
Vanger	0:b86d15c6ba29	1625
Vanger	0:b86d15c6ba29	1626	/* determines if reduce_2k_l can be used */
Vanger	0:b86d15c6ba29	1627	int mp_reduce_is_2k_l(mp_int *a)
Vanger	0:b86d15c6ba29	1628	{
Vanger	0:b86d15c6ba29	1629	int ix, iy;
Vanger	0:b86d15c6ba29	1630
Vanger	0:b86d15c6ba29	1631	if (a->used == 0) {
Vanger	0:b86d15c6ba29	1632	return MP_NO;
Vanger	0:b86d15c6ba29	1633	} else if (a->used == 1) {
Vanger	0:b86d15c6ba29	1634	return MP_YES;
Vanger	0:b86d15c6ba29	1635	} else if (a->used > 1) {
Vanger	0:b86d15c6ba29	1636	/* if more than half of the digits are -1 we're sold */
Vanger	0:b86d15c6ba29	1637	for (iy = ix = 0; ix < a->used; ix++) {
Vanger	0:b86d15c6ba29	1638	if (a->dp[ix] == MP_MASK) {
Vanger	0:b86d15c6ba29	1639	++iy;
Vanger	0:b86d15c6ba29	1640	}
Vanger	0:b86d15c6ba29	1641	}
Vanger	0:b86d15c6ba29	1642	return (iy >= (a->used/2)) ? MP_YES : MP_NO;
Vanger	0:b86d15c6ba29	1643
Vanger	0:b86d15c6ba29	1644	}
Vanger	0:b86d15c6ba29	1645	return MP_NO;
Vanger	0:b86d15c6ba29	1646	}
Vanger	0:b86d15c6ba29	1647
Vanger	0:b86d15c6ba29	1648
Vanger	0:b86d15c6ba29	1649	/* determines if mp_reduce_2k can be used */
Vanger	0:b86d15c6ba29	1650	int mp_reduce_is_2k(mp_int *a)
Vanger	0:b86d15c6ba29	1651	{
Vanger	0:b86d15c6ba29	1652	int ix, iy, iw;
Vanger	0:b86d15c6ba29	1653	mp_digit iz;
Vanger	0:b86d15c6ba29	1654
Vanger	0:b86d15c6ba29	1655	if (a->used == 0) {
Vanger	0:b86d15c6ba29	1656	return MP_NO;
Vanger	0:b86d15c6ba29	1657	} else if (a->used == 1) {
Vanger	0:b86d15c6ba29	1658	return MP_YES;
Vanger	0:b86d15c6ba29	1659	} else if (a->used > 1) {
Vanger	0:b86d15c6ba29	1660	iy = mp_count_bits(a);
Vanger	0:b86d15c6ba29	1661	iz = 1;
Vanger	0:b86d15c6ba29	1662	iw = 1;
Vanger	0:b86d15c6ba29	1663
Vanger	0:b86d15c6ba29	1664	/* Test every bit from the second digit up, must be 1 */
Vanger	0:b86d15c6ba29	1665	for (ix = DIGIT_BIT; ix < iy; ix++) {
Vanger	0:b86d15c6ba29	1666	if ((a->dp[iw] & iz) == 0) {
Vanger	0:b86d15c6ba29	1667	return MP_NO;
Vanger	0:b86d15c6ba29	1668	}
Vanger	0:b86d15c6ba29	1669	iz <<= 1;
Vanger	0:b86d15c6ba29	1670	if (iz > (mp_digit)MP_MASK) {
Vanger	0:b86d15c6ba29	1671	++iw;
Vanger	0:b86d15c6ba29	1672	iz = 1;
Vanger	0:b86d15c6ba29	1673	}
Vanger	0:b86d15c6ba29	1674	}
Vanger	0:b86d15c6ba29	1675	}
Vanger	0:b86d15c6ba29	1676	return MP_YES;
Vanger	0:b86d15c6ba29	1677	}
Vanger	0:b86d15c6ba29	1678
Vanger	0:b86d15c6ba29	1679
Vanger	0:b86d15c6ba29	1680	/* determines if a number is a valid DR modulus */
Vanger	0:b86d15c6ba29	1681	int mp_dr_is_modulus(mp_int *a)
Vanger	0:b86d15c6ba29	1682	{
Vanger	0:b86d15c6ba29	1683	int ix;
Vanger	0:b86d15c6ba29	1684
Vanger	0:b86d15c6ba29	1685	/* must be at least two digits */
Vanger	0:b86d15c6ba29	1686	if (a->used < 2) {
Vanger	0:b86d15c6ba29	1687	return 0;
Vanger	0:b86d15c6ba29	1688	}
Vanger	0:b86d15c6ba29	1689
Vanger	0:b86d15c6ba29	1690	/* must be of the form b**k - a [a <= b] so all
Vanger	0:b86d15c6ba29	1691	* but the first digit must be equal to -1 (mod b).
Vanger	0:b86d15c6ba29	1692	*/
Vanger	0:b86d15c6ba29	1693	for (ix = 1; ix < a->used; ix++) {
Vanger	0:b86d15c6ba29	1694	if (a->dp[ix] != MP_MASK) {
Vanger	0:b86d15c6ba29	1695	return 0;
Vanger	0:b86d15c6ba29	1696	}
Vanger	0:b86d15c6ba29	1697	}
Vanger	0:b86d15c6ba29	1698	return 1;
Vanger	0:b86d15c6ba29	1699	}
Vanger	0:b86d15c6ba29	1700
Vanger	0:b86d15c6ba29	1701
Vanger	0:b86d15c6ba29	1702	/* computes Y == G**X mod P, HAC pp.616, Algorithm 14.85
Vanger	0:b86d15c6ba29	1703	*
Vanger	0:b86d15c6ba29	1704	* Uses a left-to-right k-ary sliding window to compute the modular
Vanger	0:b86d15c6ba29	1705	* exponentiation.
Vanger	0:b86d15c6ba29	1706	* The value of k changes based on the size of the exponent.
Vanger	0:b86d15c6ba29	1707	*
Vanger	0:b86d15c6ba29	1708	* Uses Montgomery or Diminished Radix reduction [whichever appropriate]
Vanger	0:b86d15c6ba29	1709	*/
Vanger	0:b86d15c6ba29	1710
Vanger	0:b86d15c6ba29	1711	#ifdef MP_LOW_MEM
Vanger	0:b86d15c6ba29	1712	#define TAB_SIZE 32
Vanger	0:b86d15c6ba29	1713	#else
Vanger	0:b86d15c6ba29	1714	#define TAB_SIZE 256
Vanger	0:b86d15c6ba29	1715	#endif
Vanger	0:b86d15c6ba29	1716
Vanger	0:b86d15c6ba29	1717	int mp_exptmod_fast (mp_int * G, mp_int * X, mp_int * P, mp_int * Y,
Vanger	0:b86d15c6ba29	1718	int redmode)
Vanger	0:b86d15c6ba29	1719	{
Vanger	0:b86d15c6ba29	1720	mp_int M[TAB_SIZE], res;
Vanger	0:b86d15c6ba29	1721	mp_digit buf, mp;
Vanger	0:b86d15c6ba29	1722	int err, bitbuf, bitcpy, bitcnt, mode, digidx, x, y, winsize;
Vanger	0:b86d15c6ba29	1723
Vanger	0:b86d15c6ba29	1724	/* use a pointer to the reduction algorithm. This allows us to use
Vanger	0:b86d15c6ba29	1725	* one of many reduction algorithms without modding the guts of
Vanger	0:b86d15c6ba29	1726	* the code with if statements everywhere.
Vanger	0:b86d15c6ba29	1727	*/
Vanger	0:b86d15c6ba29	1728	int (redux)(mp_int,mp_int*,mp_digit);
Vanger	0:b86d15c6ba29	1729
Vanger	0:b86d15c6ba29	1730	/* find window size */
Vanger	0:b86d15c6ba29	1731	x = mp_count_bits (X);
Vanger	0:b86d15c6ba29	1732	if (x <= 7) {
Vanger	0:b86d15c6ba29	1733	winsize = 2;
Vanger	0:b86d15c6ba29	1734	} else if (x <= 36) {
Vanger	0:b86d15c6ba29	1735	winsize = 3;
Vanger	0:b86d15c6ba29	1736	} else if (x <= 140) {
Vanger	0:b86d15c6ba29	1737	winsize = 4;
Vanger	0:b86d15c6ba29	1738	} else if (x <= 450) {
Vanger	0:b86d15c6ba29	1739	winsize = 5;
Vanger	0:b86d15c6ba29	1740	} else if (x <= 1303) {
Vanger	0:b86d15c6ba29	1741	winsize = 6;
Vanger	0:b86d15c6ba29	1742	} else if (x <= 3529) {
Vanger	0:b86d15c6ba29	1743	winsize = 7;
Vanger	0:b86d15c6ba29	1744	} else {
Vanger	0:b86d15c6ba29	1745	winsize = 8;
Vanger	0:b86d15c6ba29	1746	}
Vanger	0:b86d15c6ba29	1747
Vanger	0:b86d15c6ba29	1748	#ifdef MP_LOW_MEM
Vanger	0:b86d15c6ba29	1749	if (winsize > 5) {
Vanger	0:b86d15c6ba29	1750	winsize = 5;
Vanger	0:b86d15c6ba29	1751	}
Vanger	0:b86d15c6ba29	1752	#endif
Vanger	0:b86d15c6ba29	1753
Vanger	0:b86d15c6ba29	1754	/* init M array */
Vanger	0:b86d15c6ba29	1755	/* init first cell */
Vanger	0:b86d15c6ba29	1756	if ((err = mp_init(&M[1])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1757	return err;
Vanger	0:b86d15c6ba29	1758	}
Vanger	0:b86d15c6ba29	1759
Vanger	0:b86d15c6ba29	1760	/* now init the second half of the array */
Vanger	0:b86d15c6ba29	1761	for (x = 1<<(winsize-1); x < (1 << winsize); x++) {
Vanger	0:b86d15c6ba29	1762	if ((err = mp_init(&M[x])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1763	for (y = 1<<(winsize-1); y < x; y++) {
Vanger	0:b86d15c6ba29	1764	mp_clear (&M[y]);
Vanger	0:b86d15c6ba29	1765	}
Vanger	0:b86d15c6ba29	1766	mp_clear(&M[1]);
Vanger	0:b86d15c6ba29	1767	return err;
Vanger	0:b86d15c6ba29	1768	}
Vanger	0:b86d15c6ba29	1769	}
Vanger	0:b86d15c6ba29	1770
Vanger	0:b86d15c6ba29	1771	/* determine and setup reduction code */
Vanger	0:b86d15c6ba29	1772	if (redmode == 0) {
Vanger	0:b86d15c6ba29	1773	#ifdef BN_MP_MONTGOMERY_SETUP_C
Vanger	0:b86d15c6ba29	1774	/* now setup montgomery */
Vanger	0:b86d15c6ba29	1775	if ((err = mp_montgomery_setup (P, &mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1776	goto LBL_M;
Vanger	0:b86d15c6ba29	1777	}
Vanger	0:b86d15c6ba29	1778	#else
Vanger	0:b86d15c6ba29	1779	err = MP_VAL;
Vanger	0:b86d15c6ba29	1780	goto LBL_M;
Vanger	0:b86d15c6ba29	1781	#endif
Vanger	0:b86d15c6ba29	1782
Vanger	0:b86d15c6ba29	1783	/* automatically pick the comba one if available (saves quite a few
Vanger	0:b86d15c6ba29	1784	calls/ifs) */
Vanger	0:b86d15c6ba29	1785	#ifdef BN_FAST_MP_MONTGOMERY_REDUCE_C
Vanger	0:b86d15c6ba29	1786	if (((P->used * 2 + 1) < MP_WARRAY) &&
Vanger	0:b86d15c6ba29	1787	P->used < (1 << ((CHAR_BIT * sizeof (mp_word)) - (2 * DIGIT_BIT)))) {
Vanger	0:b86d15c6ba29	1788	redux = fast_mp_montgomery_reduce;
Vanger	0:b86d15c6ba29	1789	} else
Vanger	0:b86d15c6ba29	1790	#endif
Vanger	0:b86d15c6ba29	1791	{
Vanger	0:b86d15c6ba29	1792	#ifdef BN_MP_MONTGOMERY_REDUCE_C
Vanger	0:b86d15c6ba29	1793	/* use slower baseline Montgomery method */
Vanger	0:b86d15c6ba29	1794	redux = mp_montgomery_reduce;
Vanger	0:b86d15c6ba29	1795	#else
Vanger	0:b86d15c6ba29	1796	err = MP_VAL;
Vanger	0:b86d15c6ba29	1797	goto LBL_M;
Vanger	0:b86d15c6ba29	1798	#endif
Vanger	0:b86d15c6ba29	1799	}
Vanger	0:b86d15c6ba29	1800	} else if (redmode == 1) {
Vanger	0:b86d15c6ba29	1801	#if defined(BN_MP_DR_SETUP_C) && defined(BN_MP_DR_REDUCE_C)
Vanger	0:b86d15c6ba29	1802	/* setup DR reduction for moduli of the form B*k - b /
Vanger	0:b86d15c6ba29	1803	mp_dr_setup(P, &mp);
Vanger	0:b86d15c6ba29	1804	redux = mp_dr_reduce;
Vanger	0:b86d15c6ba29	1805	#else
Vanger	0:b86d15c6ba29	1806	err = MP_VAL;
Vanger	0:b86d15c6ba29	1807	goto LBL_M;
Vanger	0:b86d15c6ba29	1808	#endif
Vanger	0:b86d15c6ba29	1809	} else {
Vanger	0:b86d15c6ba29	1810	#if defined(BN_MP_REDUCE_2K_SETUP_C) && defined(BN_MP_REDUCE_2K_C)
Vanger	0:b86d15c6ba29	1811	/* setup DR reduction for moduli of the form 2*k - b /
Vanger	0:b86d15c6ba29	1812	if ((err = mp_reduce_2k_setup(P, &mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1813	goto LBL_M;
Vanger	0:b86d15c6ba29	1814	}
Vanger	0:b86d15c6ba29	1815	redux = mp_reduce_2k;
Vanger	0:b86d15c6ba29	1816	#else
Vanger	0:b86d15c6ba29	1817	err = MP_VAL;
Vanger	0:b86d15c6ba29	1818	goto LBL_M;
Vanger	0:b86d15c6ba29	1819	#endif
Vanger	0:b86d15c6ba29	1820	}
Vanger	0:b86d15c6ba29	1821
Vanger	0:b86d15c6ba29	1822	/* setup result */
Vanger	0:b86d15c6ba29	1823	if ((err = mp_init (&res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1824	goto LBL_M;
Vanger	0:b86d15c6ba29	1825	}
Vanger	0:b86d15c6ba29	1826
Vanger	0:b86d15c6ba29	1827	/* create M table
Vanger	0:b86d15c6ba29	1828	*
Vanger	0:b86d15c6ba29	1829
Vanger	0:b86d15c6ba29	1830	*
Vanger	0:b86d15c6ba29	1831	* The first half of the table is not computed though accept for M[0] and M[1]
Vanger	0:b86d15c6ba29	1832	*/
Vanger	0:b86d15c6ba29	1833
Vanger	0:b86d15c6ba29	1834	if (redmode == 0) {
Vanger	0:b86d15c6ba29	1835	#ifdef BN_MP_MONTGOMERY_CALC_NORMALIZATION_C
Vanger	0:b86d15c6ba29	1836	/* now we need R mod m */
Vanger	0:b86d15c6ba29	1837	if ((err = mp_montgomery_calc_normalization (&res, P)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1838	goto LBL_RES;
Vanger	0:b86d15c6ba29	1839	}
Vanger	0:b86d15c6ba29	1840	#else
Vanger	0:b86d15c6ba29	1841	err = MP_VAL;
Vanger	0:b86d15c6ba29	1842	goto LBL_RES;
Vanger	0:b86d15c6ba29	1843	#endif
Vanger	0:b86d15c6ba29	1844
Vanger	0:b86d15c6ba29	1845	/* now set M[1] to G * R mod m */
Vanger	0:b86d15c6ba29	1846	if ((err = mp_mulmod (G, &res, P, &M[1])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1847	goto LBL_RES;
Vanger	0:b86d15c6ba29	1848	}
Vanger	0:b86d15c6ba29	1849	} else {
Vanger	0:b86d15c6ba29	1850	mp_set(&res, 1);
Vanger	0:b86d15c6ba29	1851	if ((err = mp_mod(G, P, &M[1])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1852	goto LBL_RES;
Vanger	0:b86d15c6ba29	1853	}
Vanger	0:b86d15c6ba29	1854	}
Vanger	0:b86d15c6ba29	1855
Vanger	0:b86d15c6ba29	1856	/* compute the value at M[1<<(winsize-1)] by squaring M[1] (winsize-1) times*/
Vanger	0:b86d15c6ba29	1857	if ((err = mp_copy (&M[1], &M[(mp_digit)(1 << (winsize - 1))])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1858	goto LBL_RES;
Vanger	0:b86d15c6ba29	1859	}
Vanger	0:b86d15c6ba29	1860
Vanger	0:b86d15c6ba29	1861	for (x = 0; x < (winsize - 1); x++) {
Vanger	0:b86d15c6ba29	1862	if ((err = mp_sqr (&M[(mp_digit)(1 << (winsize - 1))], &M[(mp_digit)(1 << (winsize - 1))])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1863	goto LBL_RES;
Vanger	0:b86d15c6ba29	1864	}
Vanger	0:b86d15c6ba29	1865	if ((err = redux (&M[(mp_digit)(1 << (winsize - 1))], P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1866	goto LBL_RES;
Vanger	0:b86d15c6ba29	1867	}
Vanger	0:b86d15c6ba29	1868	}
Vanger	0:b86d15c6ba29	1869
Vanger	0:b86d15c6ba29	1870	/* create upper table */
Vanger	0:b86d15c6ba29	1871	for (x = (1 << (winsize - 1)) + 1; x < (1 << winsize); x++) {
Vanger	0:b86d15c6ba29	1872	if ((err = mp_mul (&M[x - 1], &M[1], &M[x])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1873	goto LBL_RES;
Vanger	0:b86d15c6ba29	1874	}
Vanger	0:b86d15c6ba29	1875	if ((err = redux (&M[x], P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1876	goto LBL_RES;
Vanger	0:b86d15c6ba29	1877	}
Vanger	0:b86d15c6ba29	1878	}
Vanger	0:b86d15c6ba29	1879
Vanger	0:b86d15c6ba29	1880	/* set initial mode and bit cnt */
Vanger	0:b86d15c6ba29	1881	mode = 0;
Vanger	0:b86d15c6ba29	1882	bitcnt = 1;
Vanger	0:b86d15c6ba29	1883	buf = 0;
Vanger	0:b86d15c6ba29	1884	digidx = X->used - 1;
Vanger	0:b86d15c6ba29	1885	bitcpy = 0;
Vanger	0:b86d15c6ba29	1886	bitbuf = 0;
Vanger	0:b86d15c6ba29	1887
Vanger	0:b86d15c6ba29	1888	for (;;) {
Vanger	0:b86d15c6ba29	1889	/* grab next digit as required */
Vanger	0:b86d15c6ba29	1890	if (--bitcnt == 0) {
Vanger	0:b86d15c6ba29	1891	/* if digidx == -1 we are out of digits so break */
Vanger	0:b86d15c6ba29	1892	if (digidx == -1) {
Vanger	0:b86d15c6ba29	1893	break;
Vanger	0:b86d15c6ba29	1894	}
Vanger	0:b86d15c6ba29	1895	/* read next digit and reset bitcnt */
Vanger	0:b86d15c6ba29	1896	buf = X->dp[digidx--];
Vanger	0:b86d15c6ba29	1897	bitcnt = (int)DIGIT_BIT;
Vanger	0:b86d15c6ba29	1898	}
Vanger	0:b86d15c6ba29	1899
Vanger	0:b86d15c6ba29	1900	/* grab the next msb from the exponent */
Vanger	0:b86d15c6ba29	1901	y = (int)(buf >> (DIGIT_BIT - 1)) & 1;
Vanger	0:b86d15c6ba29	1902	buf <<= (mp_digit)1;
Vanger	0:b86d15c6ba29	1903
Vanger	0:b86d15c6ba29	1904	/* if the bit is zero and mode == 0 then we ignore it
Vanger	0:b86d15c6ba29	1905	* These represent the leading zero bits before the first 1 bit
Vanger	0:b86d15c6ba29	1906	* in the exponent. Technically this opt is not required but it
Vanger	0:b86d15c6ba29	1907	* does lower the # of trivial squaring/reductions used
Vanger	0:b86d15c6ba29	1908	*/
Vanger	0:b86d15c6ba29	1909	if (mode == 0 && y == 0) {
Vanger	0:b86d15c6ba29	1910	continue;
Vanger	0:b86d15c6ba29	1911	}
Vanger	0:b86d15c6ba29	1912
Vanger	0:b86d15c6ba29	1913	/* if the bit is zero and mode == 1 then we square */
Vanger	0:b86d15c6ba29	1914	if (mode == 1 && y == 0) {
Vanger	0:b86d15c6ba29	1915	if ((err = mp_sqr (&res, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1916	goto LBL_RES;
Vanger	0:b86d15c6ba29	1917	}
Vanger	0:b86d15c6ba29	1918	if ((err = redux (&res, P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1919	goto LBL_RES;
Vanger	0:b86d15c6ba29	1920	}
Vanger	0:b86d15c6ba29	1921	continue;
Vanger	0:b86d15c6ba29	1922	}
Vanger	0:b86d15c6ba29	1923
Vanger	0:b86d15c6ba29	1924	/* else we add it to the window */
Vanger	0:b86d15c6ba29	1925	bitbuf \|= (y << (winsize - ++bitcpy));
Vanger	0:b86d15c6ba29	1926	mode = 2;
Vanger	0:b86d15c6ba29	1927
Vanger	0:b86d15c6ba29	1928	if (bitcpy == winsize) {
Vanger	0:b86d15c6ba29	1929	/* ok window is filled so square as required and multiply */
Vanger	0:b86d15c6ba29	1930	/* square first */
Vanger	0:b86d15c6ba29	1931	for (x = 0; x < winsize; x++) {
Vanger	0:b86d15c6ba29	1932	if ((err = mp_sqr (&res, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1933	goto LBL_RES;
Vanger	0:b86d15c6ba29	1934	}
Vanger	0:b86d15c6ba29	1935	if ((err = redux (&res, P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1936	goto LBL_RES;
Vanger	0:b86d15c6ba29	1937	}
Vanger	0:b86d15c6ba29	1938	}
Vanger	0:b86d15c6ba29	1939
Vanger	0:b86d15c6ba29	1940	/* then multiply */
Vanger	0:b86d15c6ba29	1941	if ((err = mp_mul (&res, &M[bitbuf], &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1942	goto LBL_RES;
Vanger	0:b86d15c6ba29	1943	}
Vanger	0:b86d15c6ba29	1944	if ((err = redux (&res, P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1945	goto LBL_RES;
Vanger	0:b86d15c6ba29	1946	}
Vanger	0:b86d15c6ba29	1947
Vanger	0:b86d15c6ba29	1948	/* empty window and reset */
Vanger	0:b86d15c6ba29	1949	bitcpy = 0;
Vanger	0:b86d15c6ba29	1950	bitbuf = 0;
Vanger	0:b86d15c6ba29	1951	mode = 1;
Vanger	0:b86d15c6ba29	1952	}
Vanger	0:b86d15c6ba29	1953	}
Vanger	0:b86d15c6ba29	1954
Vanger	0:b86d15c6ba29	1955	/* if bits remain then square/multiply */
Vanger	0:b86d15c6ba29	1956	if (mode == 2 && bitcpy > 0) {
Vanger	0:b86d15c6ba29	1957	/* square then multiply if the bit is set */
Vanger	0:b86d15c6ba29	1958	for (x = 0; x < bitcpy; x++) {
Vanger	0:b86d15c6ba29	1959	if ((err = mp_sqr (&res, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1960	goto LBL_RES;
Vanger	0:b86d15c6ba29	1961	}
Vanger	0:b86d15c6ba29	1962	if ((err = redux (&res, P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1963	goto LBL_RES;
Vanger	0:b86d15c6ba29	1964	}
Vanger	0:b86d15c6ba29	1965
Vanger	0:b86d15c6ba29	1966	/* get next bit of the window */
Vanger	0:b86d15c6ba29	1967	bitbuf <<= 1;
Vanger	0:b86d15c6ba29	1968	if ((bitbuf & (1 << winsize)) != 0) {
Vanger	0:b86d15c6ba29	1969	/* then multiply */
Vanger	0:b86d15c6ba29	1970	if ((err = mp_mul (&res, &M[1], &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1971	goto LBL_RES;
Vanger	0:b86d15c6ba29	1972	}
Vanger	0:b86d15c6ba29	1973	if ((err = redux (&res, P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1974	goto LBL_RES;
Vanger	0:b86d15c6ba29	1975	}
Vanger	0:b86d15c6ba29	1976	}
Vanger	0:b86d15c6ba29	1977	}
Vanger	0:b86d15c6ba29	1978	}
Vanger	0:b86d15c6ba29	1979
Vanger	0:b86d15c6ba29	1980	if (redmode == 0) {
Vanger	0:b86d15c6ba29	1981	/* fixup result if Montgomery reduction is used
Vanger	0:b86d15c6ba29	1982	* recall that any value in a Montgomery system is
Vanger	0:b86d15c6ba29	1983	* actually multiplied by R mod n. So we have
Vanger	0:b86d15c6ba29	1984	* to reduce one more time to cancel out the factor
Vanger	0:b86d15c6ba29	1985	* of R.
Vanger	0:b86d15c6ba29	1986	*/
Vanger	0:b86d15c6ba29	1987	if ((err = redux(&res, P, mp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	1988	goto LBL_RES;
Vanger	0:b86d15c6ba29	1989	}
Vanger	0:b86d15c6ba29	1990	}
Vanger	0:b86d15c6ba29	1991
Vanger	0:b86d15c6ba29	1992	/* swap res with Y */
Vanger	0:b86d15c6ba29	1993	mp_exch (&res, Y);
Vanger	0:b86d15c6ba29	1994	err = MP_OKAY;
Vanger	0:b86d15c6ba29	1995	LBL_RES:mp_clear (&res);
Vanger	0:b86d15c6ba29	1996	LBL_M:
Vanger	0:b86d15c6ba29	1997	mp_clear(&M[1]);
Vanger	0:b86d15c6ba29	1998	for (x = 1<<(winsize-1); x < (1 << winsize); x++) {
Vanger	0:b86d15c6ba29	1999	mp_clear (&M[x]);
Vanger	0:b86d15c6ba29	2000	}
Vanger	0:b86d15c6ba29	2001	return err;
Vanger	0:b86d15c6ba29	2002	}
Vanger	0:b86d15c6ba29	2003
Vanger	0:b86d15c6ba29	2004
Vanger	0:b86d15c6ba29	2005	/* setups the montgomery reduction stuff */
Vanger	0:b86d15c6ba29	2006	int
Vanger	0:b86d15c6ba29	2007	mp_montgomery_setup (mp_int * n, mp_digit * rho)
Vanger	0:b86d15c6ba29	2008	{
Vanger	0:b86d15c6ba29	2009	mp_digit x, b;
Vanger	0:b86d15c6ba29	2010
Vanger	0:b86d15c6ba29	2011	/* fast inversion mod 2**k
Vanger	0:b86d15c6ba29	2012	*
Vanger	0:b86d15c6ba29	2013	* Based on the fact that
Vanger	0:b86d15c6ba29	2014	*
Vanger	0:b86d15c6ba29	2015	* XA = 1 (mod 2n) => (X(2-XA)) A = 1 (mod 22n)
Vanger	0:b86d15c6ba29	2016	* => 2XA - XXA*A = 1
Vanger	0:b86d15c6ba29	2017	* => 2*(1) - (1) = 1
Vanger	0:b86d15c6ba29	2018	*/
Vanger	0:b86d15c6ba29	2019	b = n->dp[0];
Vanger	0:b86d15c6ba29	2020
Vanger	0:b86d15c6ba29	2021	if ((b & 1) == 0) {
Vanger	0:b86d15c6ba29	2022	return MP_VAL;
Vanger	0:b86d15c6ba29	2023	}
Vanger	0:b86d15c6ba29	2024
Vanger	0:b86d15c6ba29	2025	x = (((b + 2) & 4) << 1) + b; /* here xa==1 mod 24 /
Vanger	0:b86d15c6ba29	2026	x = 2 - b x; /* here xa==1 mod 28 /
Vanger	0:b86d15c6ba29	2027	#if !defined(MP_8BIT)
Vanger	0:b86d15c6ba29	2028	x = 2 - b x; /* here xa==1 mod 216 /
Vanger	0:b86d15c6ba29	2029	#endif
Vanger	0:b86d15c6ba29	2030	#if defined(MP_64BIT) \|\| !(defined(MP_8BIT) \|\| defined(MP_16BIT))
Vanger	0:b86d15c6ba29	2031	x = 2 - b x; /* here xa==1 mod 232 /
Vanger	0:b86d15c6ba29	2032	#endif
Vanger	0:b86d15c6ba29	2033	#ifdef MP_64BIT
Vanger	0:b86d15c6ba29	2034	x = 2 - b x; /* here xa==1 mod 264 /
Vanger	0:b86d15c6ba29	2035	#endif
Vanger	0:b86d15c6ba29	2036
Vanger	0:b86d15c6ba29	2037	/* rho = -1/m mod b */
Vanger	0:b86d15c6ba29	2038	/* TAO, switched mp_word casts to mp_digit to shut up compiler */
Vanger	0:b86d15c6ba29	2039	*rho = (((mp_digit)1 << ((mp_digit) DIGIT_BIT)) - x) & MP_MASK;
Vanger	0:b86d15c6ba29	2040
Vanger	0:b86d15c6ba29	2041	return MP_OKAY;
Vanger	0:b86d15c6ba29	2042	}
Vanger	0:b86d15c6ba29	2043
Vanger	0:b86d15c6ba29	2044
Vanger	0:b86d15c6ba29	2045	/* computes xR**-1 == x (mod N) via Montgomery Reduction
Vanger	0:b86d15c6ba29	2046	*
Vanger	0:b86d15c6ba29	2047	* This is an optimized implementation of montgomery_reduce
Vanger	0:b86d15c6ba29	2048	* which uses the comba method to quickly calculate the columns of the
Vanger	0:b86d15c6ba29	2049	* reduction.
Vanger	0:b86d15c6ba29	2050	*
Vanger	0:b86d15c6ba29	2051	* Based on Algorithm 14.32 on pp.601 of HAC.
Vanger	0:b86d15c6ba29	2052	*/
Vanger	0:b86d15c6ba29	2053	int fast_mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho)
Vanger	0:b86d15c6ba29	2054	{
Vanger	0:b86d15c6ba29	2055	int ix, res, olduse;
Vanger	0:b86d15c6ba29	2056	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2057	mp_word* W; /* uses dynamic memory and slower */
Vanger	0:b86d15c6ba29	2058	#else
Vanger	0:b86d15c6ba29	2059	mp_word W[MP_WARRAY];
Vanger	0:b86d15c6ba29	2060	#endif
Vanger	0:b86d15c6ba29	2061
Vanger	0:b86d15c6ba29	2062	/* get old used count */
Vanger	0:b86d15c6ba29	2063	olduse = x->used;
Vanger	0:b86d15c6ba29	2064
Vanger	0:b86d15c6ba29	2065	/* grow a as required */
Vanger	0:b86d15c6ba29	2066	if (x->alloc < n->used + 1) {
Vanger	0:b86d15c6ba29	2067	if ((res = mp_grow (x, n->used + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2068	return res;
Vanger	0:b86d15c6ba29	2069	}
Vanger	0:b86d15c6ba29	2070	}
Vanger	0:b86d15c6ba29	2071
Vanger	0:b86d15c6ba29	2072	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2073	W = (mp_word)XMALLOC(sizeof(mp_word) MP_WARRAY, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	2074	if (W == NULL)
Vanger	0:b86d15c6ba29	2075	return MP_MEM;
Vanger	0:b86d15c6ba29	2076	#endif
Vanger	0:b86d15c6ba29	2077
Vanger	0:b86d15c6ba29	2078	/* first we have to get the digits of the input into
Vanger	0:b86d15c6ba29	2079	* an array of double precision words W[...]
Vanger	0:b86d15c6ba29	2080	*/
Vanger	0:b86d15c6ba29	2081	{
Vanger	0:b86d15c6ba29	2082	register mp_word *_W;
Vanger	0:b86d15c6ba29	2083	register mp_digit *tmpx;
Vanger	0:b86d15c6ba29	2084
Vanger	0:b86d15c6ba29	2085	/* alias for the W[] array */
Vanger	0:b86d15c6ba29	2086	_W = W;
Vanger	0:b86d15c6ba29	2087
Vanger	0:b86d15c6ba29	2088	/* alias for the digits of x*/
Vanger	0:b86d15c6ba29	2089	tmpx = x->dp;
Vanger	0:b86d15c6ba29	2090
Vanger	0:b86d15c6ba29	2091	/* copy the digits of a into W[0..a->used-1] */
Vanger	0:b86d15c6ba29	2092	for (ix = 0; ix < x->used; ix++) {
Vanger	0:b86d15c6ba29	2093	_W++ = tmpx++;
Vanger	0:b86d15c6ba29	2094	}
Vanger	0:b86d15c6ba29	2095
Vanger	0:b86d15c6ba29	2096	/* zero the high words of W[a->used..m->used2] /
Vanger	0:b86d15c6ba29	2097	for (; ix < n->used * 2 + 1; ix++) {
Vanger	0:b86d15c6ba29	2098	*_W++ = 0;
Vanger	0:b86d15c6ba29	2099	}
Vanger	0:b86d15c6ba29	2100	}
Vanger	0:b86d15c6ba29	2101
Vanger	0:b86d15c6ba29	2102	/* now we proceed to zero successive digits
Vanger	0:b86d15c6ba29	2103	* from the least significant upwards
Vanger	0:b86d15c6ba29	2104	*/
Vanger	0:b86d15c6ba29	2105	for (ix = 0; ix < n->used; ix++) {
Vanger	0:b86d15c6ba29	2106	/* mu = ai * m' mod b
Vanger	0:b86d15c6ba29	2107	*
Vanger	0:b86d15c6ba29	2108	* We avoid a double precision multiplication (which isn't required)
Vanger	0:b86d15c6ba29	2109	* by casting the value down to a mp_digit. Note this requires
Vanger	0:b86d15c6ba29	2110	* that W[ix-1] have the carry cleared (see after the inner loop)
Vanger	0:b86d15c6ba29	2111	*/
Vanger	0:b86d15c6ba29	2112	register mp_digit mu;
Vanger	0:b86d15c6ba29	2113	mu = (mp_digit) (((W[ix] & MP_MASK) * rho) & MP_MASK);
Vanger	0:b86d15c6ba29	2114
Vanger	0:b86d15c6ba29	2115	/* a = a + mu * m * b**i
Vanger	0:b86d15c6ba29	2116	*
Vanger	0:b86d15c6ba29	2117	* This is computed in place and on the fly. The multiplication
Vanger	0:b86d15c6ba29	2118	* by b**i is handled by offseting which columns the results
Vanger	0:b86d15c6ba29	2119	* are added to.
Vanger	0:b86d15c6ba29	2120	*
Vanger	0:b86d15c6ba29	2121	* Note the comba method normally doesn't handle carries in the
Vanger	0:b86d15c6ba29	2122	* inner loop In this case we fix the carry from the previous
Vanger	0:b86d15c6ba29	2123	* column since the Montgomery reduction requires digits of the
Vanger	0:b86d15c6ba29	2124	* result (so far) [see above] to work. This is
Vanger	0:b86d15c6ba29	2125	* handled by fixing up one carry after the inner loop. The
Vanger	0:b86d15c6ba29	2126	* carry fixups are done in order so after these loops the
Vanger	0:b86d15c6ba29	2127	* first m->used words of W[] have the carries fixed
Vanger	0:b86d15c6ba29	2128	*/
Vanger	0:b86d15c6ba29	2129	{
Vanger	0:b86d15c6ba29	2130	register int iy;
Vanger	0:b86d15c6ba29	2131	register mp_digit *tmpn;
Vanger	0:b86d15c6ba29	2132	register mp_word *_W;
Vanger	0:b86d15c6ba29	2133
Vanger	0:b86d15c6ba29	2134	/* alias for the digits of the modulus */
Vanger	0:b86d15c6ba29	2135	tmpn = n->dp;
Vanger	0:b86d15c6ba29	2136
Vanger	0:b86d15c6ba29	2137	/* Alias for the columns set by an offset of ix */
Vanger	0:b86d15c6ba29	2138	_W = W + ix;
Vanger	0:b86d15c6ba29	2139
Vanger	0:b86d15c6ba29	2140	/* inner loop */
Vanger	0:b86d15c6ba29	2141	for (iy = 0; iy < n->used; iy++) {
Vanger	0:b86d15c6ba29	2142	_W++ += ((mp_word)mu) ((mp_word)*tmpn++);
Vanger	0:b86d15c6ba29	2143	}
Vanger	0:b86d15c6ba29	2144	}
Vanger	0:b86d15c6ba29	2145
Vanger	0:b86d15c6ba29	2146	/* now fix carry for next digit, W[ix+1] */
Vanger	0:b86d15c6ba29	2147	W[ix + 1] += W[ix] >> ((mp_word) DIGIT_BIT);
Vanger	0:b86d15c6ba29	2148	}
Vanger	0:b86d15c6ba29	2149
Vanger	0:b86d15c6ba29	2150	/* now we have to propagate the carries and
Vanger	0:b86d15c6ba29	2151	* shift the words downward [all those least
Vanger	0:b86d15c6ba29	2152	* significant digits we zeroed].
Vanger	0:b86d15c6ba29	2153	*/
Vanger	0:b86d15c6ba29	2154	{
Vanger	0:b86d15c6ba29	2155	register mp_digit *tmpx;
Vanger	0:b86d15c6ba29	2156	register mp_word _W, _W1;
Vanger	0:b86d15c6ba29	2157
Vanger	0:b86d15c6ba29	2158	/* nox fix rest of carries */
Vanger	0:b86d15c6ba29	2159
Vanger	0:b86d15c6ba29	2160	/* alias for current word */
Vanger	0:b86d15c6ba29	2161	_W1 = W + ix;
Vanger	0:b86d15c6ba29	2162
Vanger	0:b86d15c6ba29	2163	/* alias for next word, where the carry goes */
Vanger	0:b86d15c6ba29	2164	_W = W + ++ix;
Vanger	0:b86d15c6ba29	2165
Vanger	0:b86d15c6ba29	2166	for (; ix <= n->used * 2 + 1; ix++) {
Vanger	0:b86d15c6ba29	2167	_W++ += _W1++ >> ((mp_word) DIGIT_BIT);
Vanger	0:b86d15c6ba29	2168	}
Vanger	0:b86d15c6ba29	2169
Vanger	0:b86d15c6ba29	2170	/* copy out, A = A/b**n
Vanger	0:b86d15c6ba29	2171	*
Vanger	0:b86d15c6ba29	2172	* The result is A/b**n but instead of converting from an
Vanger	0:b86d15c6ba29	2173	* array of mp_word to mp_digit than calling mp_rshd
Vanger	0:b86d15c6ba29	2174	* we just copy them in the right order
Vanger	0:b86d15c6ba29	2175	*/
Vanger	0:b86d15c6ba29	2176
Vanger	0:b86d15c6ba29	2177	/* alias for destination word */
Vanger	0:b86d15c6ba29	2178	tmpx = x->dp;
Vanger	0:b86d15c6ba29	2179
Vanger	0:b86d15c6ba29	2180	/* alias for shifted double precision result */
Vanger	0:b86d15c6ba29	2181	_W = W + n->used;
Vanger	0:b86d15c6ba29	2182
Vanger	0:b86d15c6ba29	2183	for (ix = 0; ix < n->used + 1; ix++) {
Vanger	0:b86d15c6ba29	2184	tmpx++ = (mp_digit)(_W++ & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	2185	}
Vanger	0:b86d15c6ba29	2186
Vanger	0:b86d15c6ba29	2187	/* zero oldused digits, if the input a was larger than
Vanger	0:b86d15c6ba29	2188	* m->used+1 we'll have to clear the digits
Vanger	0:b86d15c6ba29	2189	*/
Vanger	0:b86d15c6ba29	2190	for (; ix < olduse; ix++) {
Vanger	0:b86d15c6ba29	2191	*tmpx++ = 0;
Vanger	0:b86d15c6ba29	2192	}
Vanger	0:b86d15c6ba29	2193	}
Vanger	0:b86d15c6ba29	2194
Vanger	0:b86d15c6ba29	2195	/* set the max used and clamp */
Vanger	0:b86d15c6ba29	2196	x->used = n->used + 1;
Vanger	0:b86d15c6ba29	2197	mp_clamp (x);
Vanger	0:b86d15c6ba29	2198
Vanger	0:b86d15c6ba29	2199	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2200	XFREE(W, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	2201	#endif
Vanger	0:b86d15c6ba29	2202
Vanger	0:b86d15c6ba29	2203	/* if A >= m then A = A - m */
Vanger	0:b86d15c6ba29	2204	if (mp_cmp_mag (x, n) != MP_LT) {
Vanger	0:b86d15c6ba29	2205	return s_mp_sub (x, n, x);
Vanger	0:b86d15c6ba29	2206	}
Vanger	0:b86d15c6ba29	2207	return MP_OKAY;
Vanger	0:b86d15c6ba29	2208	}
Vanger	0:b86d15c6ba29	2209
Vanger	0:b86d15c6ba29	2210
Vanger	0:b86d15c6ba29	2211	/* computes xR*-1 == x (mod N) via Montgomery Reduction /
Vanger	0:b86d15c6ba29	2212	int
Vanger	0:b86d15c6ba29	2213	mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho)
Vanger	0:b86d15c6ba29	2214	{
Vanger	0:b86d15c6ba29	2215	int ix, res, digs;
Vanger	0:b86d15c6ba29	2216	mp_digit mu;
Vanger	0:b86d15c6ba29	2217
Vanger	0:b86d15c6ba29	2218	/* can the fast reduction [comba] method be used?
Vanger	0:b86d15c6ba29	2219	*
Vanger	0:b86d15c6ba29	2220	* Note that unlike in mul you're safely allowed less
Vanger	0:b86d15c6ba29	2221	* than the available columns [255 per default] since carries
Vanger	0:b86d15c6ba29	2222	* are fixed up in the inner loop.
Vanger	0:b86d15c6ba29	2223	*/
Vanger	0:b86d15c6ba29	2224	digs = n->used * 2 + 1;
Vanger	0:b86d15c6ba29	2225	if ((digs < MP_WARRAY) &&
Vanger	0:b86d15c6ba29	2226	n->used <
Vanger	0:b86d15c6ba29	2227	(1 << ((CHAR_BIT * sizeof (mp_word)) - (2 * DIGIT_BIT)))) {
Vanger	0:b86d15c6ba29	2228	return fast_mp_montgomery_reduce (x, n, rho);
Vanger	0:b86d15c6ba29	2229	}
Vanger	0:b86d15c6ba29	2230
Vanger	0:b86d15c6ba29	2231	/* grow the input as required */
Vanger	0:b86d15c6ba29	2232	if (x->alloc < digs) {
Vanger	0:b86d15c6ba29	2233	if ((res = mp_grow (x, digs)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2234	return res;
Vanger	0:b86d15c6ba29	2235	}
Vanger	0:b86d15c6ba29	2236	}
Vanger	0:b86d15c6ba29	2237	x->used = digs;
Vanger	0:b86d15c6ba29	2238
Vanger	0:b86d15c6ba29	2239	for (ix = 0; ix < n->used; ix++) {
Vanger	0:b86d15c6ba29	2240	/* mu = ai * rho mod b
Vanger	0:b86d15c6ba29	2241	*
Vanger	0:b86d15c6ba29	2242	* The value of rho must be precalculated via
Vanger	0:b86d15c6ba29	2243	* montgomery_setup() such that
Vanger	0:b86d15c6ba29	2244	* it equals -1/n0 mod b this allows the
Vanger	0:b86d15c6ba29	2245	* following inner loop to reduce the
Vanger	0:b86d15c6ba29	2246	* input one digit at a time
Vanger	0:b86d15c6ba29	2247	*/
Vanger	0:b86d15c6ba29	2248	mu = (mp_digit) (((mp_word)x->dp[ix]) * ((mp_word)rho) & MP_MASK);
Vanger	0:b86d15c6ba29	2249
Vanger	0:b86d15c6ba29	2250	/* a = a + mu * m * b*i /
Vanger	0:b86d15c6ba29	2251	{
Vanger	0:b86d15c6ba29	2252	register int iy;
Vanger	0:b86d15c6ba29	2253	register mp_digit tmpn, tmpx, u;
Vanger	0:b86d15c6ba29	2254	register mp_word r;
Vanger	0:b86d15c6ba29	2255
Vanger	0:b86d15c6ba29	2256	/* alias for digits of the modulus */
Vanger	0:b86d15c6ba29	2257	tmpn = n->dp;
Vanger	0:b86d15c6ba29	2258
Vanger	0:b86d15c6ba29	2259	/* alias for the digits of x [the input] */
Vanger	0:b86d15c6ba29	2260	tmpx = x->dp + ix;
Vanger	0:b86d15c6ba29	2261
Vanger	0:b86d15c6ba29	2262	/* set the carry to zero */
Vanger	0:b86d15c6ba29	2263	u = 0;
Vanger	0:b86d15c6ba29	2264
Vanger	0:b86d15c6ba29	2265	/* Multiply and add in place */
Vanger	0:b86d15c6ba29	2266	for (iy = 0; iy < n->used; iy++) {
Vanger	0:b86d15c6ba29	2267	/* compute product and sum */
Vanger	0:b86d15c6ba29	2268	r = ((mp_word)mu) * ((mp_word)*tmpn++) +
Vanger	0:b86d15c6ba29	2269	((mp_word) u) + ((mp_word) * tmpx);
Vanger	0:b86d15c6ba29	2270
Vanger	0:b86d15c6ba29	2271	/* get carry */
Vanger	0:b86d15c6ba29	2272	u = (mp_digit)(r >> ((mp_word) DIGIT_BIT));
Vanger	0:b86d15c6ba29	2273
Vanger	0:b86d15c6ba29	2274	/* fix digit */
Vanger	0:b86d15c6ba29	2275	*tmpx++ = (mp_digit)(r & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	2276	}
Vanger	0:b86d15c6ba29	2277	/* At this point the ix'th digit of x should be zero */
Vanger	0:b86d15c6ba29	2278
Vanger	0:b86d15c6ba29	2279
Vanger	0:b86d15c6ba29	2280	/* propagate carries upwards as required*/
Vanger	0:b86d15c6ba29	2281	while (u) {
Vanger	0:b86d15c6ba29	2282	*tmpx += u;
Vanger	0:b86d15c6ba29	2283	u = *tmpx >> DIGIT_BIT;
Vanger	0:b86d15c6ba29	2284	*tmpx++ &= MP_MASK;
Vanger	0:b86d15c6ba29	2285	}
Vanger	0:b86d15c6ba29	2286	}
Vanger	0:b86d15c6ba29	2287	}
Vanger	0:b86d15c6ba29	2288
Vanger	0:b86d15c6ba29	2289	/* at this point the n.used'th least
Vanger	0:b86d15c6ba29	2290	* significant digits of x are all zero
Vanger	0:b86d15c6ba29	2291	* which means we can shift x to the
Vanger	0:b86d15c6ba29	2292	* right by n.used digits and the
Vanger	0:b86d15c6ba29	2293	* residue is unchanged.
Vanger	0:b86d15c6ba29	2294	*/
Vanger	0:b86d15c6ba29	2295
Vanger	0:b86d15c6ba29	2296	/* x = x/b*n.used /
Vanger	0:b86d15c6ba29	2297	mp_clamp(x);
Vanger	0:b86d15c6ba29	2298	mp_rshd (x, n->used);
Vanger	0:b86d15c6ba29	2299
Vanger	0:b86d15c6ba29	2300	/* if x >= n then x = x - n */
Vanger	0:b86d15c6ba29	2301	if (mp_cmp_mag (x, n) != MP_LT) {
Vanger	0:b86d15c6ba29	2302	return s_mp_sub (x, n, x);
Vanger	0:b86d15c6ba29	2303	}
Vanger	0:b86d15c6ba29	2304
Vanger	0:b86d15c6ba29	2305	return MP_OKAY;
Vanger	0:b86d15c6ba29	2306	}
Vanger	0:b86d15c6ba29	2307
Vanger	0:b86d15c6ba29	2308
Vanger	0:b86d15c6ba29	2309	/* determines the setup value */
Vanger	0:b86d15c6ba29	2310	void mp_dr_setup(mp_int a, mp_digit d)
Vanger	0:b86d15c6ba29	2311	{
Vanger	0:b86d15c6ba29	2312	/* the casts are required if DIGIT_BIT is one less than
Vanger	0:b86d15c6ba29	2313	* the number of bits in a mp_digit [e.g. DIGIT_BIT==31]
Vanger	0:b86d15c6ba29	2314	*/
Vanger	0:b86d15c6ba29	2315	*d = (mp_digit)((((mp_word)1) << ((mp_word)DIGIT_BIT)) -
Vanger	0:b86d15c6ba29	2316	((mp_word)a->dp[0]));
Vanger	0:b86d15c6ba29	2317	}
Vanger	0:b86d15c6ba29	2318
Vanger	0:b86d15c6ba29	2319
Vanger	0:b86d15c6ba29	2320	/* reduce "x" in place modulo "n" using the Diminished Radix algorithm.
Vanger	0:b86d15c6ba29	2321	*
Vanger	0:b86d15c6ba29	2322	* Based on algorithm from the paper
Vanger	0:b86d15c6ba29	2323	*
Vanger	0:b86d15c6ba29	2324	* "Generating Efficient Primes for Discrete Log Cryptosystems"
Vanger	0:b86d15c6ba29	2325	* Chae Hoon Lim, Pil Joong Lee,
Vanger	0:b86d15c6ba29	2326	* POSTECH Information Research Laboratories
Vanger	0:b86d15c6ba29	2327	*
Vanger	0:b86d15c6ba29	2328	* The modulus must be of a special format [see manual]
Vanger	0:b86d15c6ba29	2329	*
Vanger	0:b86d15c6ba29	2330	* Has been modified to use algorithm 7.10 from the LTM book instead
Vanger	0:b86d15c6ba29	2331	*
Vanger	0:b86d15c6ba29	2332	* Input x must be in the range 0 <= x <= (n-1)**2
Vanger	0:b86d15c6ba29	2333	*/
Vanger	0:b86d15c6ba29	2334	int
Vanger	0:b86d15c6ba29	2335	mp_dr_reduce (mp_int * x, mp_int * n, mp_digit k)
Vanger	0:b86d15c6ba29	2336	{
Vanger	0:b86d15c6ba29	2337	int err, i, m;
Vanger	0:b86d15c6ba29	2338	mp_word r;
Vanger	0:b86d15c6ba29	2339	mp_digit mu, tmpx1, tmpx2;
Vanger	0:b86d15c6ba29	2340
Vanger	0:b86d15c6ba29	2341	/* m = digits in modulus */
Vanger	0:b86d15c6ba29	2342	m = n->used;
Vanger	0:b86d15c6ba29	2343
Vanger	0:b86d15c6ba29	2344	/* ensure that "x" has at least 2m digits */
Vanger	0:b86d15c6ba29	2345	if (x->alloc < m + m) {
Vanger	0:b86d15c6ba29	2346	if ((err = mp_grow (x, m + m)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2347	return err;
Vanger	0:b86d15c6ba29	2348	}
Vanger	0:b86d15c6ba29	2349	}
Vanger	0:b86d15c6ba29	2350
Vanger	0:b86d15c6ba29	2351	/* top of loop, this is where the code resumes if
Vanger	0:b86d15c6ba29	2352	* another reduction pass is required.
Vanger	0:b86d15c6ba29	2353	*/
Vanger	0:b86d15c6ba29	2354	top:
Vanger	0:b86d15c6ba29	2355	/* aliases for digits */
Vanger	0:b86d15c6ba29	2356	/* alias for lower half of x */
Vanger	0:b86d15c6ba29	2357	tmpx1 = x->dp;
Vanger	0:b86d15c6ba29	2358
Vanger	0:b86d15c6ba29	2359	/* alias for upper half of x, or x/B*m /
Vanger	0:b86d15c6ba29	2360	tmpx2 = x->dp + m;
Vanger	0:b86d15c6ba29	2361
Vanger	0:b86d15c6ba29	2362	/* set carry to zero */
Vanger	0:b86d15c6ba29	2363	mu = 0;
Vanger	0:b86d15c6ba29	2364
Vanger	0:b86d15c6ba29	2365	/* compute (x mod B*m) + k [x/B*m] inline and inplace /
Vanger	0:b86d15c6ba29	2366	for (i = 0; i < m; i++) {
Vanger	0:b86d15c6ba29	2367	r = ((mp_word)tmpx2++) ((mp_word)k) + *tmpx1 + mu;
Vanger	0:b86d15c6ba29	2368	*tmpx1++ = (mp_digit)(r & MP_MASK);
Vanger	0:b86d15c6ba29	2369	mu = (mp_digit)(r >> ((mp_word)DIGIT_BIT));
Vanger	0:b86d15c6ba29	2370	}
Vanger	0:b86d15c6ba29	2371
Vanger	0:b86d15c6ba29	2372	/* set final carry */
Vanger	0:b86d15c6ba29	2373	*tmpx1++ = mu;
Vanger	0:b86d15c6ba29	2374
Vanger	0:b86d15c6ba29	2375	/* zero words above m */
Vanger	0:b86d15c6ba29	2376	for (i = m + 1; i < x->used; i++) {
Vanger	0:b86d15c6ba29	2377	*tmpx1++ = 0;
Vanger	0:b86d15c6ba29	2378	}
Vanger	0:b86d15c6ba29	2379
Vanger	0:b86d15c6ba29	2380	/* clamp, sub and return */
Vanger	0:b86d15c6ba29	2381	mp_clamp (x);
Vanger	0:b86d15c6ba29	2382
Vanger	0:b86d15c6ba29	2383	/* if x >= n then subtract and reduce again
Vanger	0:b86d15c6ba29	2384	* Each successive "recursion" makes the input smaller and smaller.
Vanger	0:b86d15c6ba29	2385	*/
Vanger	0:b86d15c6ba29	2386	if (mp_cmp_mag (x, n) != MP_LT) {
Vanger	0:b86d15c6ba29	2387	s_mp_sub(x, n, x);
Vanger	0:b86d15c6ba29	2388	goto top;
Vanger	0:b86d15c6ba29	2389	}
Vanger	0:b86d15c6ba29	2390	return MP_OKAY;
Vanger	0:b86d15c6ba29	2391	}
Vanger	0:b86d15c6ba29	2392
Vanger	0:b86d15c6ba29	2393
Vanger	0:b86d15c6ba29	2394	/* reduces a modulo n where n is of the form 2*p - d /
Vanger	0:b86d15c6ba29	2395	int mp_reduce_2k(mp_int a, mp_int n, mp_digit d)
Vanger	0:b86d15c6ba29	2396	{
Vanger	0:b86d15c6ba29	2397	mp_int q;
Vanger	0:b86d15c6ba29	2398	int p, res;
Vanger	0:b86d15c6ba29	2399
Vanger	0:b86d15c6ba29	2400	if ((res = mp_init(&q)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2401	return res;
Vanger	0:b86d15c6ba29	2402	}
Vanger	0:b86d15c6ba29	2403
Vanger	0:b86d15c6ba29	2404	p = mp_count_bits(n);
Vanger	0:b86d15c6ba29	2405	top:
Vanger	0:b86d15c6ba29	2406	/* q = a/2p, a = a mod 2p */
Vanger	0:b86d15c6ba29	2407	if ((res = mp_div_2d(a, p, &q, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2408	goto ERR;
Vanger	0:b86d15c6ba29	2409	}
Vanger	0:b86d15c6ba29	2410
Vanger	0:b86d15c6ba29	2411	if (d != 1) {
Vanger	0:b86d15c6ba29	2412	/* q = q * d */
Vanger	0:b86d15c6ba29	2413	if ((res = mp_mul_d(&q, d, &q)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2414	goto ERR;
Vanger	0:b86d15c6ba29	2415	}
Vanger	0:b86d15c6ba29	2416	}
Vanger	0:b86d15c6ba29	2417
Vanger	0:b86d15c6ba29	2418	/* a = a + q */
Vanger	0:b86d15c6ba29	2419	if ((res = s_mp_add(a, &q, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2420	goto ERR;
Vanger	0:b86d15c6ba29	2421	}
Vanger	0:b86d15c6ba29	2422
Vanger	0:b86d15c6ba29	2423	if (mp_cmp_mag(a, n) != MP_LT) {
Vanger	0:b86d15c6ba29	2424	s_mp_sub(a, n, a);
Vanger	0:b86d15c6ba29	2425	goto top;
Vanger	0:b86d15c6ba29	2426	}
Vanger	0:b86d15c6ba29	2427
Vanger	0:b86d15c6ba29	2428	ERR:
Vanger	0:b86d15c6ba29	2429	mp_clear(&q);
Vanger	0:b86d15c6ba29	2430	return res;
Vanger	0:b86d15c6ba29	2431	}
Vanger	0:b86d15c6ba29	2432
Vanger	0:b86d15c6ba29	2433
Vanger	0:b86d15c6ba29	2434	/* determines the setup value */
Vanger	0:b86d15c6ba29	2435	int mp_reduce_2k_setup(mp_int a, mp_digit d)
Vanger	0:b86d15c6ba29	2436	{
Vanger	0:b86d15c6ba29	2437	int res, p;
Vanger	0:b86d15c6ba29	2438	mp_int tmp;
Vanger	0:b86d15c6ba29	2439
Vanger	0:b86d15c6ba29	2440	if ((res = mp_init(&tmp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2441	return res;
Vanger	0:b86d15c6ba29	2442	}
Vanger	0:b86d15c6ba29	2443
Vanger	0:b86d15c6ba29	2444	p = mp_count_bits(a);
Vanger	0:b86d15c6ba29	2445	if ((res = mp_2expt(&tmp, p)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2446	mp_clear(&tmp);
Vanger	0:b86d15c6ba29	2447	return res;
Vanger	0:b86d15c6ba29	2448	}
Vanger	0:b86d15c6ba29	2449
Vanger	0:b86d15c6ba29	2450	if ((res = s_mp_sub(&tmp, a, &tmp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2451	mp_clear(&tmp);
Vanger	0:b86d15c6ba29	2452	return res;
Vanger	0:b86d15c6ba29	2453	}
Vanger	0:b86d15c6ba29	2454
Vanger	0:b86d15c6ba29	2455	*d = tmp.dp[0];
Vanger	0:b86d15c6ba29	2456	mp_clear(&tmp);
Vanger	0:b86d15c6ba29	2457	return MP_OKAY;
Vanger	0:b86d15c6ba29	2458	}
Vanger	0:b86d15c6ba29	2459
Vanger	0:b86d15c6ba29	2460
Vanger	0:b86d15c6ba29	2461	/* computes a = 2**b
Vanger	0:b86d15c6ba29	2462	*
Vanger	0:b86d15c6ba29	2463	* Simple algorithm which zeroes the int, grows it then just sets one bit
Vanger	0:b86d15c6ba29	2464	* as required.
Vanger	0:b86d15c6ba29	2465	*/
Vanger	0:b86d15c6ba29	2466	int
Vanger	0:b86d15c6ba29	2467	mp_2expt (mp_int * a, int b)
Vanger	0:b86d15c6ba29	2468	{
Vanger	0:b86d15c6ba29	2469	int res;
Vanger	0:b86d15c6ba29	2470
Vanger	0:b86d15c6ba29	2471	/* zero a as per default */
Vanger	0:b86d15c6ba29	2472	mp_zero (a);
Vanger	0:b86d15c6ba29	2473
Vanger	0:b86d15c6ba29	2474	/* grow a to accomodate the single bit */
Vanger	0:b86d15c6ba29	2475	if ((res = mp_grow (a, b / DIGIT_BIT + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2476	return res;
Vanger	0:b86d15c6ba29	2477	}
Vanger	0:b86d15c6ba29	2478
Vanger	0:b86d15c6ba29	2479	/* set the used count of where the bit will go */
Vanger	0:b86d15c6ba29	2480	a->used = b / DIGIT_BIT + 1;
Vanger	0:b86d15c6ba29	2481
Vanger	0:b86d15c6ba29	2482	/* put the single bit in its place */
Vanger	0:b86d15c6ba29	2483	a->dp[b / DIGIT_BIT] = ((mp_digit)1) << (b % DIGIT_BIT);
Vanger	0:b86d15c6ba29	2484
Vanger	0:b86d15c6ba29	2485	return MP_OKAY;
Vanger	0:b86d15c6ba29	2486	}
Vanger	0:b86d15c6ba29	2487
Vanger	0:b86d15c6ba29	2488
Vanger	0:b86d15c6ba29	2489	/* multiply by a digit */
Vanger	0:b86d15c6ba29	2490	int
Vanger	0:b86d15c6ba29	2491	mp_mul_d (mp_int * a, mp_digit b, mp_int * c)
Vanger	0:b86d15c6ba29	2492	{
Vanger	0:b86d15c6ba29	2493	mp_digit u, tmpa, tmpc;
Vanger	0:b86d15c6ba29	2494	mp_word r;
Vanger	0:b86d15c6ba29	2495	int ix, res, olduse;
Vanger	0:b86d15c6ba29	2496
Vanger	0:b86d15c6ba29	2497	/* make sure c is big enough to hold ab /
Vanger	0:b86d15c6ba29	2498	if (c->alloc < a->used + 1) {
Vanger	0:b86d15c6ba29	2499	if ((res = mp_grow (c, a->used + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2500	return res;
Vanger	0:b86d15c6ba29	2501	}
Vanger	0:b86d15c6ba29	2502	}
Vanger	0:b86d15c6ba29	2503
Vanger	0:b86d15c6ba29	2504	/* get the original destinations used count */
Vanger	0:b86d15c6ba29	2505	olduse = c->used;
Vanger	0:b86d15c6ba29	2506
Vanger	0:b86d15c6ba29	2507	/* set the sign */
Vanger	0:b86d15c6ba29	2508	c->sign = a->sign;
Vanger	0:b86d15c6ba29	2509
Vanger	0:b86d15c6ba29	2510	/* alias for a->dp [source] */
Vanger	0:b86d15c6ba29	2511	tmpa = a->dp;
Vanger	0:b86d15c6ba29	2512
Vanger	0:b86d15c6ba29	2513	/* alias for c->dp [dest] */
Vanger	0:b86d15c6ba29	2514	tmpc = c->dp;
Vanger	0:b86d15c6ba29	2515
Vanger	0:b86d15c6ba29	2516	/* zero carry */
Vanger	0:b86d15c6ba29	2517	u = 0;
Vanger	0:b86d15c6ba29	2518
Vanger	0:b86d15c6ba29	2519	/* compute columns */
Vanger	0:b86d15c6ba29	2520	for (ix = 0; ix < a->used; ix++) {
Vanger	0:b86d15c6ba29	2521	/* compute product and carry sum for this term */
Vanger	0:b86d15c6ba29	2522	r = ((mp_word) u) + ((mp_word)tmpa++) ((mp_word)b);
Vanger	0:b86d15c6ba29	2523
Vanger	0:b86d15c6ba29	2524	/* mask off higher bits to get a single digit */
Vanger	0:b86d15c6ba29	2525	*tmpc++ = (mp_digit) (r & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	2526
Vanger	0:b86d15c6ba29	2527	/* send carry into next iteration */
Vanger	0:b86d15c6ba29	2528	u = (mp_digit) (r >> ((mp_word) DIGIT_BIT));
Vanger	0:b86d15c6ba29	2529	}
Vanger	0:b86d15c6ba29	2530
Vanger	0:b86d15c6ba29	2531	/* store final carry [if any] and increment ix offset */
Vanger	0:b86d15c6ba29	2532	*tmpc++ = u;
Vanger	0:b86d15c6ba29	2533	++ix;
Vanger	0:b86d15c6ba29	2534
Vanger	0:b86d15c6ba29	2535	/* now zero digits above the top */
Vanger	0:b86d15c6ba29	2536	while (ix++ < olduse) {
Vanger	0:b86d15c6ba29	2537	*tmpc++ = 0;
Vanger	0:b86d15c6ba29	2538	}
Vanger	0:b86d15c6ba29	2539
Vanger	0:b86d15c6ba29	2540	/* set used count */
Vanger	0:b86d15c6ba29	2541	c->used = a->used + 1;
Vanger	0:b86d15c6ba29	2542	mp_clamp(c);
Vanger	0:b86d15c6ba29	2543
Vanger	0:b86d15c6ba29	2544	return MP_OKAY;
Vanger	0:b86d15c6ba29	2545	}
Vanger	0:b86d15c6ba29	2546
Vanger	0:b86d15c6ba29	2547
Vanger	0:b86d15c6ba29	2548	/* d = a * b (mod c) */
Vanger	0:b86d15c6ba29	2549	int mp_mulmod (mp_int * a, mp_int * b, mp_int * c, mp_int * d)
Vanger	0:b86d15c6ba29	2550	{
Vanger	0:b86d15c6ba29	2551	int res;
Vanger	0:b86d15c6ba29	2552	mp_int t;
Vanger	0:b86d15c6ba29	2553
Vanger	0:b86d15c6ba29	2554	if ((res = mp_init (&t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2555	return res;
Vanger	0:b86d15c6ba29	2556	}
Vanger	0:b86d15c6ba29	2557
Vanger	0:b86d15c6ba29	2558	if ((res = mp_mul (a, b, &t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2559	mp_clear (&t);
Vanger	0:b86d15c6ba29	2560	return res;
Vanger	0:b86d15c6ba29	2561	}
Vanger	0:b86d15c6ba29	2562	res = mp_mod (&t, c, d);
Vanger	0:b86d15c6ba29	2563	mp_clear (&t);
Vanger	0:b86d15c6ba29	2564	return res;
Vanger	0:b86d15c6ba29	2565	}
Vanger	0:b86d15c6ba29	2566
Vanger	0:b86d15c6ba29	2567
Vanger	0:b86d15c6ba29	2568	/* computes b = aa /
Vanger	0:b86d15c6ba29	2569	int
Vanger	0:b86d15c6ba29	2570	mp_sqr (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	2571	{
Vanger	0:b86d15c6ba29	2572	int res;
Vanger	0:b86d15c6ba29	2573
Vanger	0:b86d15c6ba29	2574	{
Vanger	0:b86d15c6ba29	2575	#ifdef BN_FAST_S_MP_SQR_C
Vanger	0:b86d15c6ba29	2576	/* can we use the fast comba multiplier? */
Vanger	0:b86d15c6ba29	2577	if ((a->used * 2 + 1) < MP_WARRAY &&
Vanger	0:b86d15c6ba29	2578	a->used <
Vanger	0:b86d15c6ba29	2579	(1 << (sizeof(mp_word) * CHAR_BIT - 2*DIGIT_BIT - 1))) {
Vanger	0:b86d15c6ba29	2580	res = fast_s_mp_sqr (a, b);
Vanger	0:b86d15c6ba29	2581	} else
Vanger	0:b86d15c6ba29	2582	#endif
Vanger	0:b86d15c6ba29	2583	#ifdef BN_S_MP_SQR_C
Vanger	0:b86d15c6ba29	2584	res = s_mp_sqr (a, b);
Vanger	0:b86d15c6ba29	2585	#else
Vanger	0:b86d15c6ba29	2586	res = MP_VAL;
Vanger	0:b86d15c6ba29	2587	#endif
Vanger	0:b86d15c6ba29	2588	}
Vanger	0:b86d15c6ba29	2589	b->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	2590	return res;
Vanger	0:b86d15c6ba29	2591	}
Vanger	0:b86d15c6ba29	2592
Vanger	0:b86d15c6ba29	2593
Vanger	0:b86d15c6ba29	2594	/* high level multiplication (handles sign) */
Vanger	0:b86d15c6ba29	2595	int mp_mul (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	2596	{
Vanger	0:b86d15c6ba29	2597	int res, neg;
Vanger	0:b86d15c6ba29	2598	neg = (a->sign == b->sign) ? MP_ZPOS : MP_NEG;
Vanger	0:b86d15c6ba29	2599
Vanger	0:b86d15c6ba29	2600	{
Vanger	0:b86d15c6ba29	2601	/* can we use the fast multiplier?
Vanger	0:b86d15c6ba29	2602	*
Vanger	0:b86d15c6ba29	2603	* The fast multiplier can be used if the output will
Vanger	0:b86d15c6ba29	2604	* have less than MP_WARRAY digits and the number of
Vanger	0:b86d15c6ba29	2605	* digits won't affect carry propagation
Vanger	0:b86d15c6ba29	2606	*/
Vanger	0:b86d15c6ba29	2607	int digs = a->used + b->used + 1;
Vanger	0:b86d15c6ba29	2608
Vanger	0:b86d15c6ba29	2609	#ifdef BN_FAST_S_MP_MUL_DIGS_C
Vanger	0:b86d15c6ba29	2610	if ((digs < MP_WARRAY) &&
Vanger	0:b86d15c6ba29	2611	MIN(a->used, b->used) <=
Vanger	0:b86d15c6ba29	2612	(1 << ((CHAR_BIT * sizeof (mp_word)) - (2 * DIGIT_BIT)))) {
Vanger	0:b86d15c6ba29	2613	res = fast_s_mp_mul_digs (a, b, c, digs);
Vanger	0:b86d15c6ba29	2614	} else
Vanger	0:b86d15c6ba29	2615	#endif
Vanger	0:b86d15c6ba29	2616	#ifdef BN_S_MP_MUL_DIGS_C
Vanger	0:b86d15c6ba29	2617	res = s_mp_mul (a, b, c); /* uses s_mp_mul_digs */
Vanger	0:b86d15c6ba29	2618	#else
Vanger	0:b86d15c6ba29	2619	res = MP_VAL;
Vanger	0:b86d15c6ba29	2620	#endif
Vanger	0:b86d15c6ba29	2621
Vanger	0:b86d15c6ba29	2622	}
Vanger	0:b86d15c6ba29	2623	c->sign = (c->used > 0) ? neg : MP_ZPOS;
Vanger	0:b86d15c6ba29	2624	return res;
Vanger	0:b86d15c6ba29	2625	}
Vanger	0:b86d15c6ba29	2626
Vanger	0:b86d15c6ba29	2627
Vanger	0:b86d15c6ba29	2628	/* b = a2 /
Vanger	0:b86d15c6ba29	2629	int mp_mul_2(mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	2630	{
Vanger	0:b86d15c6ba29	2631	int x, res, oldused;
Vanger	0:b86d15c6ba29	2632
Vanger	0:b86d15c6ba29	2633	/* grow to accomodate result */
Vanger	0:b86d15c6ba29	2634	if (b->alloc < a->used + 1) {
Vanger	0:b86d15c6ba29	2635	if ((res = mp_grow (b, a->used + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2636	return res;
Vanger	0:b86d15c6ba29	2637	}
Vanger	0:b86d15c6ba29	2638	}
Vanger	0:b86d15c6ba29	2639
Vanger	0:b86d15c6ba29	2640	oldused = b->used;
Vanger	0:b86d15c6ba29	2641	b->used = a->used;
Vanger	0:b86d15c6ba29	2642
Vanger	0:b86d15c6ba29	2643	{
Vanger	0:b86d15c6ba29	2644	register mp_digit r, rr, tmpa, tmpb;
Vanger	0:b86d15c6ba29	2645
Vanger	0:b86d15c6ba29	2646	/* alias for source */
Vanger	0:b86d15c6ba29	2647	tmpa = a->dp;
Vanger	0:b86d15c6ba29	2648
Vanger	0:b86d15c6ba29	2649	/* alias for dest */
Vanger	0:b86d15c6ba29	2650	tmpb = b->dp;
Vanger	0:b86d15c6ba29	2651
Vanger	0:b86d15c6ba29	2652	/* carry */
Vanger	0:b86d15c6ba29	2653	r = 0;
Vanger	0:b86d15c6ba29	2654	for (x = 0; x < a->used; x++) {
Vanger	0:b86d15c6ba29	2655
Vanger	0:b86d15c6ba29	2656	/* get what will be the next carry bit from the
Vanger	0:b86d15c6ba29	2657	* MSB of the current digit
Vanger	0:b86d15c6ba29	2658	*/
Vanger	0:b86d15c6ba29	2659	rr = *tmpa >> ((mp_digit)(DIGIT_BIT - 1));
Vanger	0:b86d15c6ba29	2660
Vanger	0:b86d15c6ba29	2661	/* now shift up this digit, add in the carry [from the previous] */
Vanger	0:b86d15c6ba29	2662	tmpb++ = ((tmpa++ << ((mp_digit)1)) \| r) & MP_MASK;
Vanger	0:b86d15c6ba29	2663
Vanger	0:b86d15c6ba29	2664	/* copy the carry that would be from the source
Vanger	0:b86d15c6ba29	2665	* digit into the next iteration
Vanger	0:b86d15c6ba29	2666	*/
Vanger	0:b86d15c6ba29	2667	r = rr;
Vanger	0:b86d15c6ba29	2668	}
Vanger	0:b86d15c6ba29	2669
Vanger	0:b86d15c6ba29	2670	/* new leading digit? */
Vanger	0:b86d15c6ba29	2671	if (r != 0) {
Vanger	0:b86d15c6ba29	2672	/* add a MSB which is always 1 at this point */
Vanger	0:b86d15c6ba29	2673	*tmpb = 1;
Vanger	0:b86d15c6ba29	2674	++(b->used);
Vanger	0:b86d15c6ba29	2675	}
Vanger	0:b86d15c6ba29	2676
Vanger	0:b86d15c6ba29	2677	/* now zero any excess digits on the destination
Vanger	0:b86d15c6ba29	2678	* that we didn't write to
Vanger	0:b86d15c6ba29	2679	*/
Vanger	0:b86d15c6ba29	2680	tmpb = b->dp + b->used;
Vanger	0:b86d15c6ba29	2681	for (x = b->used; x < oldused; x++) {
Vanger	0:b86d15c6ba29	2682	*tmpb++ = 0;
Vanger	0:b86d15c6ba29	2683	}
Vanger	0:b86d15c6ba29	2684	}
Vanger	0:b86d15c6ba29	2685	b->sign = a->sign;
Vanger	0:b86d15c6ba29	2686	return MP_OKAY;
Vanger	0:b86d15c6ba29	2687	}
Vanger	0:b86d15c6ba29	2688
Vanger	0:b86d15c6ba29	2689
Vanger	0:b86d15c6ba29	2690	/* divide by three (based on routine from MPI and the GMP manual) */
Vanger	0:b86d15c6ba29	2691	int
Vanger	0:b86d15c6ba29	2692	mp_div_3 (mp_int * a, mp_int c, mp_digit d)
Vanger	0:b86d15c6ba29	2693	{
Vanger	0:b86d15c6ba29	2694	mp_int q;
Vanger	0:b86d15c6ba29	2695	mp_word w, t;
Vanger	0:b86d15c6ba29	2696	mp_digit b;
Vanger	0:b86d15c6ba29	2697	int res, ix;
Vanger	0:b86d15c6ba29	2698
Vanger	0:b86d15c6ba29	2699	/* b = 2*DIGIT_BIT / 3 /
Vanger	0:b86d15c6ba29	2700	b = (((mp_word)1) << ((mp_word)DIGIT_BIT)) / ((mp_word)3);
Vanger	0:b86d15c6ba29	2701
Vanger	0:b86d15c6ba29	2702	if ((res = mp_init_size(&q, a->used)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2703	return res;
Vanger	0:b86d15c6ba29	2704	}
Vanger	0:b86d15c6ba29	2705
Vanger	0:b86d15c6ba29	2706	q.used = a->used;
Vanger	0:b86d15c6ba29	2707	q.sign = a->sign;
Vanger	0:b86d15c6ba29	2708	w = 0;
Vanger	0:b86d15c6ba29	2709	for (ix = a->used - 1; ix >= 0; ix--) {
Vanger	0:b86d15c6ba29	2710	w = (w << ((mp_word)DIGIT_BIT)) \| ((mp_word)a->dp[ix]);
Vanger	0:b86d15c6ba29	2711
Vanger	0:b86d15c6ba29	2712	if (w >= 3) {
Vanger	0:b86d15c6ba29	2713	/* multiply w by [1/3] */
Vanger	0:b86d15c6ba29	2714	t = (w * ((mp_word)b)) >> ((mp_word)DIGIT_BIT);
Vanger	0:b86d15c6ba29	2715
Vanger	0:b86d15c6ba29	2716	/* now subtract 3 * [w/3] from w, to get the remainder */
Vanger	0:b86d15c6ba29	2717	w -= t+t+t;
Vanger	0:b86d15c6ba29	2718
Vanger	0:b86d15c6ba29	2719	/* fixup the remainder as required since
Vanger	0:b86d15c6ba29	2720	* the optimization is not exact.
Vanger	0:b86d15c6ba29	2721	*/
Vanger	0:b86d15c6ba29	2722	while (w >= 3) {
Vanger	0:b86d15c6ba29	2723	t += 1;
Vanger	0:b86d15c6ba29	2724	w -= 3;
Vanger	0:b86d15c6ba29	2725	}
Vanger	0:b86d15c6ba29	2726	} else {
Vanger	0:b86d15c6ba29	2727	t = 0;
Vanger	0:b86d15c6ba29	2728	}
Vanger	0:b86d15c6ba29	2729	q.dp[ix] = (mp_digit)t;
Vanger	0:b86d15c6ba29	2730	}
Vanger	0:b86d15c6ba29	2731
Vanger	0:b86d15c6ba29	2732	/* [optional] store the remainder */
Vanger	0:b86d15c6ba29	2733	if (d != NULL) {
Vanger	0:b86d15c6ba29	2734	*d = (mp_digit)w;
Vanger	0:b86d15c6ba29	2735	}
Vanger	0:b86d15c6ba29	2736
Vanger	0:b86d15c6ba29	2737	/* [optional] store the quotient */
Vanger	0:b86d15c6ba29	2738	if (c != NULL) {
Vanger	0:b86d15c6ba29	2739	mp_clamp(&q);
Vanger	0:b86d15c6ba29	2740	mp_exch(&q, c);
Vanger	0:b86d15c6ba29	2741	}
Vanger	0:b86d15c6ba29	2742	mp_clear(&q);
Vanger	0:b86d15c6ba29	2743
Vanger	0:b86d15c6ba29	2744	return res;
Vanger	0:b86d15c6ba29	2745	}
Vanger	0:b86d15c6ba29	2746
Vanger	0:b86d15c6ba29	2747
Vanger	0:b86d15c6ba29	2748	/* init an mp_init for a given size */
Vanger	0:b86d15c6ba29	2749	int mp_init_size (mp_int * a, int size)
Vanger	0:b86d15c6ba29	2750	{
Vanger	0:b86d15c6ba29	2751	int x;
Vanger	0:b86d15c6ba29	2752
Vanger	0:b86d15c6ba29	2753	/* pad size so there are always extra digits */
Vanger	0:b86d15c6ba29	2754	size += (MP_PREC * 2) - (size % MP_PREC);
Vanger	0:b86d15c6ba29	2755
Vanger	0:b86d15c6ba29	2756	/* alloc mem */
Vanger	0:b86d15c6ba29	2757	a->dp = OPT_CAST(mp_digit) XMALLOC (sizeof (mp_digit) * size, 0,
Vanger	0:b86d15c6ba29	2758	DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	2759	if (a->dp == NULL) {
Vanger	0:b86d15c6ba29	2760	return MP_MEM;
Vanger	0:b86d15c6ba29	2761	}
Vanger	0:b86d15c6ba29	2762
Vanger	0:b86d15c6ba29	2763	/* set the members */
Vanger	0:b86d15c6ba29	2764	a->used = 0;
Vanger	0:b86d15c6ba29	2765	a->alloc = size;
Vanger	0:b86d15c6ba29	2766	a->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	2767
Vanger	0:b86d15c6ba29	2768	/* zero the digits */
Vanger	0:b86d15c6ba29	2769	for (x = 0; x < size; x++) {
Vanger	0:b86d15c6ba29	2770	a->dp[x] = 0;
Vanger	0:b86d15c6ba29	2771	}
Vanger	0:b86d15c6ba29	2772
Vanger	0:b86d15c6ba29	2773	return MP_OKAY;
Vanger	0:b86d15c6ba29	2774	}
Vanger	0:b86d15c6ba29	2775
Vanger	0:b86d15c6ba29	2776
Vanger	0:b86d15c6ba29	2777	/* the jist of squaring...
Vanger	0:b86d15c6ba29	2778	* you do like mult except the offset of the tmpx [one that
Vanger	0:b86d15c6ba29	2779	* starts closer to zero] can't equal the offset of tmpy.
Vanger	0:b86d15c6ba29	2780	* So basically you set up iy like before then you min it with
Vanger	0:b86d15c6ba29	2781	* (ty-tx) so that it never happens. You double all those
Vanger	0:b86d15c6ba29	2782	* you add in the inner loop
Vanger	0:b86d15c6ba29	2783
Vanger	0:b86d15c6ba29	2784	After that loop you do the squares and add them in.
Vanger	0:b86d15c6ba29	2785	*/
Vanger	0:b86d15c6ba29	2786
Vanger	0:b86d15c6ba29	2787	int fast_s_mp_sqr (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	2788	{
Vanger	0:b86d15c6ba29	2789	int olduse, res, pa, ix, iz;
Vanger	0:b86d15c6ba29	2790	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2791	mp_digit* W; /* uses dynamic memory and slower */
Vanger	0:b86d15c6ba29	2792	#else
Vanger	0:b86d15c6ba29	2793	mp_digit W[MP_WARRAY];
Vanger	0:b86d15c6ba29	2794	#endif
Vanger	0:b86d15c6ba29	2795	mp_digit *tmpx;
Vanger	0:b86d15c6ba29	2796	mp_word W1;
Vanger	0:b86d15c6ba29	2797
Vanger	0:b86d15c6ba29	2798	/* grow the destination as required */
Vanger	0:b86d15c6ba29	2799	pa = a->used + a->used;
Vanger	0:b86d15c6ba29	2800	if (b->alloc < pa) {
Vanger	0:b86d15c6ba29	2801	if ((res = mp_grow (b, pa)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2802	return res;
Vanger	0:b86d15c6ba29	2803	}
Vanger	0:b86d15c6ba29	2804	}
Vanger	0:b86d15c6ba29	2805
Vanger	0:b86d15c6ba29	2806	if (pa > MP_WARRAY)
Vanger	0:b86d15c6ba29	2807	return MP_RANGE; /* TAO range check */
Vanger	0:b86d15c6ba29	2808
Vanger	0:b86d15c6ba29	2809	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2810	W = (mp_digit)XMALLOC(sizeof(mp_digit) MP_WARRAY, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	2811	if (W == NULL)
Vanger	0:b86d15c6ba29	2812	return MP_MEM;
Vanger	0:b86d15c6ba29	2813	#endif
Vanger	0:b86d15c6ba29	2814
Vanger	0:b86d15c6ba29	2815	/* number of output digits to produce */
Vanger	0:b86d15c6ba29	2816	W1 = 0;
Vanger	0:b86d15c6ba29	2817	for (ix = 0; ix < pa; ix++) {
Vanger	0:b86d15c6ba29	2818	int tx, ty, iy;
Vanger	0:b86d15c6ba29	2819	mp_word _W;
Vanger	0:b86d15c6ba29	2820	mp_digit *tmpy;
Vanger	0:b86d15c6ba29	2821
Vanger	0:b86d15c6ba29	2822	/* clear counter */
Vanger	0:b86d15c6ba29	2823	_W = 0;
Vanger	0:b86d15c6ba29	2824
Vanger	0:b86d15c6ba29	2825	/* get offsets into the two bignums */
Vanger	0:b86d15c6ba29	2826	ty = MIN(a->used-1, ix);
Vanger	0:b86d15c6ba29	2827	tx = ix - ty;
Vanger	0:b86d15c6ba29	2828
Vanger	0:b86d15c6ba29	2829	/* setup temp aliases */
Vanger	0:b86d15c6ba29	2830	tmpx = a->dp + tx;
Vanger	0:b86d15c6ba29	2831	tmpy = a->dp + ty;
Vanger	0:b86d15c6ba29	2832
Vanger	0:b86d15c6ba29	2833	/* this is the number of times the loop will iterrate, essentially
Vanger	0:b86d15c6ba29	2834	while (tx++ < a->used && ty-- >= 0) { ... }
Vanger	0:b86d15c6ba29	2835	*/
Vanger	0:b86d15c6ba29	2836	iy = MIN(a->used-tx, ty+1);
Vanger	0:b86d15c6ba29	2837
Vanger	0:b86d15c6ba29	2838	/* now for squaring tx can never equal ty
Vanger	0:b86d15c6ba29	2839	* we halve the distance since they approach at a rate of 2x
Vanger	0:b86d15c6ba29	2840	* and we have to round because odd cases need to be executed
Vanger	0:b86d15c6ba29	2841	*/
Vanger	0:b86d15c6ba29	2842	iy = MIN(iy, (ty-tx+1)>>1);
Vanger	0:b86d15c6ba29	2843
Vanger	0:b86d15c6ba29	2844	/* execute loop */
Vanger	0:b86d15c6ba29	2845	for (iz = 0; iz < iy; iz++) {
Vanger	0:b86d15c6ba29	2846	_W += ((mp_word)tmpx++)((mp_word)*tmpy--);
Vanger	0:b86d15c6ba29	2847	}
Vanger	0:b86d15c6ba29	2848
Vanger	0:b86d15c6ba29	2849	/* double the inner product and add carry */
Vanger	0:b86d15c6ba29	2850	_W = _W + _W + W1;
Vanger	0:b86d15c6ba29	2851
Vanger	0:b86d15c6ba29	2852	/* even columns have the square term in them */
Vanger	0:b86d15c6ba29	2853	if ((ix&1) == 0) {
Vanger	0:b86d15c6ba29	2854	_W += ((mp_word)a->dp[ix>>1])*((mp_word)a->dp[ix>>1]);
Vanger	0:b86d15c6ba29	2855	}
Vanger	0:b86d15c6ba29	2856
Vanger	0:b86d15c6ba29	2857	/* store it */
Vanger	0:b86d15c6ba29	2858	W[ix] = (mp_digit)(_W & MP_MASK);
Vanger	0:b86d15c6ba29	2859
Vanger	0:b86d15c6ba29	2860	/* make next carry */
Vanger	0:b86d15c6ba29	2861	W1 = _W >> ((mp_word)DIGIT_BIT);
Vanger	0:b86d15c6ba29	2862	}
Vanger	0:b86d15c6ba29	2863
Vanger	0:b86d15c6ba29	2864	/* setup dest */
Vanger	0:b86d15c6ba29	2865	olduse = b->used;
Vanger	0:b86d15c6ba29	2866	b->used = a->used+a->used;
Vanger	0:b86d15c6ba29	2867
Vanger	0:b86d15c6ba29	2868	{
Vanger	0:b86d15c6ba29	2869	mp_digit *tmpb;
Vanger	0:b86d15c6ba29	2870	tmpb = b->dp;
Vanger	0:b86d15c6ba29	2871	for (ix = 0; ix < pa; ix++) {
Vanger	0:b86d15c6ba29	2872	*tmpb++ = W[ix] & MP_MASK;
Vanger	0:b86d15c6ba29	2873	}
Vanger	0:b86d15c6ba29	2874
Vanger	0:b86d15c6ba29	2875	/* clear unused digits [that existed in the old copy of c] */
Vanger	0:b86d15c6ba29	2876	for (; ix < olduse; ix++) {
Vanger	0:b86d15c6ba29	2877	*tmpb++ = 0;
Vanger	0:b86d15c6ba29	2878	}
Vanger	0:b86d15c6ba29	2879	}
Vanger	0:b86d15c6ba29	2880	mp_clamp (b);
Vanger	0:b86d15c6ba29	2881
Vanger	0:b86d15c6ba29	2882	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2883	XFREE(W, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	2884	#endif
Vanger	0:b86d15c6ba29	2885
Vanger	0:b86d15c6ba29	2886	return MP_OKAY;
Vanger	0:b86d15c6ba29	2887	}
Vanger	0:b86d15c6ba29	2888
Vanger	0:b86d15c6ba29	2889
Vanger	0:b86d15c6ba29	2890	/* Fast (comba) multiplier
Vanger	0:b86d15c6ba29	2891	*
Vanger	0:b86d15c6ba29	2892	* This is the fast column-array [comba] multiplier. It is
Vanger	0:b86d15c6ba29	2893	* designed to compute the columns of the product first
Vanger	0:b86d15c6ba29	2894	* then handle the carries afterwards. This has the effect
Vanger	0:b86d15c6ba29	2895	* of making the nested loops that compute the columns very
Vanger	0:b86d15c6ba29	2896	* simple and schedulable on super-scalar processors.
Vanger	0:b86d15c6ba29	2897	*
Vanger	0:b86d15c6ba29	2898	* This has been modified to produce a variable number of
Vanger	0:b86d15c6ba29	2899	* digits of output so if say only a half-product is required
Vanger	0:b86d15c6ba29	2900	* you don't have to compute the upper half (a feature
Vanger	0:b86d15c6ba29	2901	* required for fast Barrett reduction).
Vanger	0:b86d15c6ba29	2902	*
Vanger	0:b86d15c6ba29	2903	* Based on Algorithm 14.12 on pp.595 of HAC.
Vanger	0:b86d15c6ba29	2904	*
Vanger	0:b86d15c6ba29	2905	*/
Vanger	0:b86d15c6ba29	2906	int fast_s_mp_mul_digs (mp_int * a, mp_int * b, mp_int * c, int digs)
Vanger	0:b86d15c6ba29	2907	{
Vanger	0:b86d15c6ba29	2908	int olduse, res, pa, ix, iz;
Vanger	0:b86d15c6ba29	2909	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2910	mp_digit* W; /* uses dynamic memory and slower */
Vanger	0:b86d15c6ba29	2911	#else
Vanger	0:b86d15c6ba29	2912	mp_digit W[MP_WARRAY];
Vanger	0:b86d15c6ba29	2913	#endif
Vanger	0:b86d15c6ba29	2914	register mp_word _W;
Vanger	0:b86d15c6ba29	2915
Vanger	0:b86d15c6ba29	2916	/* grow the destination as required */
Vanger	0:b86d15c6ba29	2917	if (c->alloc < digs) {
Vanger	0:b86d15c6ba29	2918	if ((res = mp_grow (c, digs)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	2919	return res;
Vanger	0:b86d15c6ba29	2920	}
Vanger	0:b86d15c6ba29	2921	}
Vanger	0:b86d15c6ba29	2922
Vanger	0:b86d15c6ba29	2923	/* number of output digits to produce */
Vanger	0:b86d15c6ba29	2924	pa = MIN(digs, a->used + b->used);
Vanger	0:b86d15c6ba29	2925	if (pa > MP_WARRAY)
Vanger	0:b86d15c6ba29	2926	return MP_RANGE; /* TAO range check */
Vanger	0:b86d15c6ba29	2927
Vanger	0:b86d15c6ba29	2928	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2929	W = (mp_digit)XMALLOC(sizeof(mp_digit) MP_WARRAY, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	2930	if (W == NULL)
Vanger	0:b86d15c6ba29	2931	return MP_MEM;
Vanger	0:b86d15c6ba29	2932	#endif
Vanger	0:b86d15c6ba29	2933
Vanger	0:b86d15c6ba29	2934	/* clear the carry */
Vanger	0:b86d15c6ba29	2935	_W = 0;
Vanger	0:b86d15c6ba29	2936	for (ix = 0; ix < pa; ix++) {
Vanger	0:b86d15c6ba29	2937	int tx, ty;
Vanger	0:b86d15c6ba29	2938	int iy;
Vanger	0:b86d15c6ba29	2939	mp_digit tmpx, tmpy;
Vanger	0:b86d15c6ba29	2940
Vanger	0:b86d15c6ba29	2941	/* get offsets into the two bignums */
Vanger	0:b86d15c6ba29	2942	ty = MIN(b->used-1, ix);
Vanger	0:b86d15c6ba29	2943	tx = ix - ty;
Vanger	0:b86d15c6ba29	2944
Vanger	0:b86d15c6ba29	2945	/* setup temp aliases */
Vanger	0:b86d15c6ba29	2946	tmpx = a->dp + tx;
Vanger	0:b86d15c6ba29	2947	tmpy = b->dp + ty;
Vanger	0:b86d15c6ba29	2948
Vanger	0:b86d15c6ba29	2949	/* this is the number of times the loop will iterrate, essentially
Vanger	0:b86d15c6ba29	2950	while (tx++ < a->used && ty-- >= 0) { ... }
Vanger	0:b86d15c6ba29	2951	*/
Vanger	0:b86d15c6ba29	2952	iy = MIN(a->used-tx, ty+1);
Vanger	0:b86d15c6ba29	2953
Vanger	0:b86d15c6ba29	2954	/* execute loop */
Vanger	0:b86d15c6ba29	2955	for (iz = 0; iz < iy; ++iz) {
Vanger	0:b86d15c6ba29	2956	_W += ((mp_word)tmpx++)((mp_word)*tmpy--);
Vanger	0:b86d15c6ba29	2957
Vanger	0:b86d15c6ba29	2958	}
Vanger	0:b86d15c6ba29	2959
Vanger	0:b86d15c6ba29	2960	/* store term */
Vanger	0:b86d15c6ba29	2961	W[ix] = ((mp_digit)_W) & MP_MASK;
Vanger	0:b86d15c6ba29	2962
Vanger	0:b86d15c6ba29	2963	/* make next carry */
Vanger	0:b86d15c6ba29	2964	_W = _W >> ((mp_word)DIGIT_BIT);
Vanger	0:b86d15c6ba29	2965	}
Vanger	0:b86d15c6ba29	2966
Vanger	0:b86d15c6ba29	2967	/* setup dest */
Vanger	0:b86d15c6ba29	2968	olduse = c->used;
Vanger	0:b86d15c6ba29	2969	c->used = pa;
Vanger	0:b86d15c6ba29	2970
Vanger	0:b86d15c6ba29	2971	{
Vanger	0:b86d15c6ba29	2972	register mp_digit *tmpc;
Vanger	0:b86d15c6ba29	2973	tmpc = c->dp;
Vanger	0:b86d15c6ba29	2974	for (ix = 0; ix < pa+1; ix++) {
Vanger	0:b86d15c6ba29	2975	/* now extract the previous digit [below the carry] */
Vanger	0:b86d15c6ba29	2976	*tmpc++ = W[ix];
Vanger	0:b86d15c6ba29	2977	}
Vanger	0:b86d15c6ba29	2978
Vanger	0:b86d15c6ba29	2979	/* clear unused digits [that existed in the old copy of c] */
Vanger	0:b86d15c6ba29	2980	for (; ix < olduse; ix++) {
Vanger	0:b86d15c6ba29	2981	*tmpc++ = 0;
Vanger	0:b86d15c6ba29	2982	}
Vanger	0:b86d15c6ba29	2983	}
Vanger	0:b86d15c6ba29	2984	mp_clamp (c);
Vanger	0:b86d15c6ba29	2985
Vanger	0:b86d15c6ba29	2986	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	2987	XFREE(W, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	2988	#endif
Vanger	0:b86d15c6ba29	2989
Vanger	0:b86d15c6ba29	2990	return MP_OKAY;
Vanger	0:b86d15c6ba29	2991	}
Vanger	0:b86d15c6ba29	2992
Vanger	0:b86d15c6ba29	2993
Vanger	0:b86d15c6ba29	2994	/* low level squaring, b = aa, HAC pp.596-597, Algorithm 14.16 /
Vanger	0:b86d15c6ba29	2995	int s_mp_sqr (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	2996	{
Vanger	0:b86d15c6ba29	2997	mp_int t;
Vanger	0:b86d15c6ba29	2998	int res, ix, iy, pa;
Vanger	0:b86d15c6ba29	2999	mp_word r;
Vanger	0:b86d15c6ba29	3000	mp_digit u, tmpx, *tmpt;
Vanger	0:b86d15c6ba29	3001
Vanger	0:b86d15c6ba29	3002	pa = a->used;
Vanger	0:b86d15c6ba29	3003	if ((res = mp_init_size (&t, 2*pa + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3004	return res;
Vanger	0:b86d15c6ba29	3005	}
Vanger	0:b86d15c6ba29	3006
Vanger	0:b86d15c6ba29	3007	/* default used is maximum possible size */
Vanger	0:b86d15c6ba29	3008	t.used = 2*pa + 1;
Vanger	0:b86d15c6ba29	3009
Vanger	0:b86d15c6ba29	3010	for (ix = 0; ix < pa; ix++) {
Vanger	0:b86d15c6ba29	3011	/* first calculate the digit at 2ix /
Vanger	0:b86d15c6ba29	3012	/* calculate double precision result */
Vanger	0:b86d15c6ba29	3013	r = ((mp_word) t.dp[2*ix]) +
Vanger	0:b86d15c6ba29	3014	((mp_word)a->dp[ix])*((mp_word)a->dp[ix]);
Vanger	0:b86d15c6ba29	3015
Vanger	0:b86d15c6ba29	3016	/* store lower part in result */
Vanger	0:b86d15c6ba29	3017	t.dp[ix+ix] = (mp_digit) (r & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	3018
Vanger	0:b86d15c6ba29	3019	/* get the carry */
Vanger	0:b86d15c6ba29	3020	u = (mp_digit)(r >> ((mp_word) DIGIT_BIT));
Vanger	0:b86d15c6ba29	3021
Vanger	0:b86d15c6ba29	3022	/* left hand side of A[ix] * A[iy] */
Vanger	0:b86d15c6ba29	3023	tmpx = a->dp[ix];
Vanger	0:b86d15c6ba29	3024
Vanger	0:b86d15c6ba29	3025	/* alias for where to store the results */
Vanger	0:b86d15c6ba29	3026	tmpt = t.dp + (2*ix + 1);
Vanger	0:b86d15c6ba29	3027
Vanger	0:b86d15c6ba29	3028	for (iy = ix + 1; iy < pa; iy++) {
Vanger	0:b86d15c6ba29	3029	/* first calculate the product */
Vanger	0:b86d15c6ba29	3030	r = ((mp_word)tmpx) * ((mp_word)a->dp[iy]);
Vanger	0:b86d15c6ba29	3031
Vanger	0:b86d15c6ba29	3032	/* now calculate the double precision result, note we use
Vanger	0:b86d15c6ba29	3033	* addition instead of *2 since it's easier to optimize
Vanger	0:b86d15c6ba29	3034	*/
Vanger	0:b86d15c6ba29	3035	r = ((mp_word) *tmpt) + r + r + ((mp_word) u);
Vanger	0:b86d15c6ba29	3036
Vanger	0:b86d15c6ba29	3037	/* store lower part */
Vanger	0:b86d15c6ba29	3038	*tmpt++ = (mp_digit) (r & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	3039
Vanger	0:b86d15c6ba29	3040	/* get carry */
Vanger	0:b86d15c6ba29	3041	u = (mp_digit)(r >> ((mp_word) DIGIT_BIT));
Vanger	0:b86d15c6ba29	3042	}
Vanger	0:b86d15c6ba29	3043	/* propagate upwards */
Vanger	0:b86d15c6ba29	3044	while (u != ((mp_digit) 0)) {
Vanger	0:b86d15c6ba29	3045	r = ((mp_word) *tmpt) + ((mp_word) u);
Vanger	0:b86d15c6ba29	3046	*tmpt++ = (mp_digit) (r & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	3047	u = (mp_digit)(r >> ((mp_word) DIGIT_BIT));
Vanger	0:b86d15c6ba29	3048	}
Vanger	0:b86d15c6ba29	3049	}
Vanger	0:b86d15c6ba29	3050
Vanger	0:b86d15c6ba29	3051	mp_clamp (&t);
Vanger	0:b86d15c6ba29	3052	mp_exch (&t, b);
Vanger	0:b86d15c6ba29	3053	mp_clear (&t);
Vanger	0:b86d15c6ba29	3054	return MP_OKAY;
Vanger	0:b86d15c6ba29	3055	}
Vanger	0:b86d15c6ba29	3056
Vanger	0:b86d15c6ba29	3057
Vanger	0:b86d15c6ba29	3058	/* multiplies \|a\| * \|b\| and only computes upto digs digits of result
Vanger	0:b86d15c6ba29	3059	* HAC pp. 595, Algorithm 14.12 Modified so you can control how
Vanger	0:b86d15c6ba29	3060	* many digits of output are created.
Vanger	0:b86d15c6ba29	3061	*/
Vanger	0:b86d15c6ba29	3062	int s_mp_mul_digs (mp_int * a, mp_int * b, mp_int * c, int digs)
Vanger	0:b86d15c6ba29	3063	{
Vanger	0:b86d15c6ba29	3064	mp_int t;
Vanger	0:b86d15c6ba29	3065	int res, pa, pb, ix, iy;
Vanger	0:b86d15c6ba29	3066	mp_digit u;
Vanger	0:b86d15c6ba29	3067	mp_word r;
Vanger	0:b86d15c6ba29	3068	mp_digit tmpx, tmpt, tmpy;
Vanger	0:b86d15c6ba29	3069
Vanger	0:b86d15c6ba29	3070	/* can we use the fast multiplier? */
Vanger	0:b86d15c6ba29	3071	if (((digs) < MP_WARRAY) &&
Vanger	0:b86d15c6ba29	3072	MIN (a->used, b->used) <
Vanger	0:b86d15c6ba29	3073	(1 << ((CHAR_BIT * sizeof (mp_word)) - (2 * DIGIT_BIT)))) {
Vanger	0:b86d15c6ba29	3074	return fast_s_mp_mul_digs (a, b, c, digs);
Vanger	0:b86d15c6ba29	3075	}
Vanger	0:b86d15c6ba29	3076
Vanger	0:b86d15c6ba29	3077	if ((res = mp_init_size (&t, digs)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3078	return res;
Vanger	0:b86d15c6ba29	3079	}
Vanger	0:b86d15c6ba29	3080	t.used = digs;
Vanger	0:b86d15c6ba29	3081
Vanger	0:b86d15c6ba29	3082	/* compute the digits of the product directly */
Vanger	0:b86d15c6ba29	3083	pa = a->used;
Vanger	0:b86d15c6ba29	3084	for (ix = 0; ix < pa; ix++) {
Vanger	0:b86d15c6ba29	3085	/* set the carry to zero */
Vanger	0:b86d15c6ba29	3086	u = 0;
Vanger	0:b86d15c6ba29	3087
Vanger	0:b86d15c6ba29	3088	/* limit ourselves to making digs digits of output */
Vanger	0:b86d15c6ba29	3089	pb = MIN (b->used, digs - ix);
Vanger	0:b86d15c6ba29	3090
Vanger	0:b86d15c6ba29	3091	/* setup some aliases */
Vanger	0:b86d15c6ba29	3092	/* copy of the digit from a used within the nested loop */
Vanger	0:b86d15c6ba29	3093	tmpx = a->dp[ix];
Vanger	0:b86d15c6ba29	3094
Vanger	0:b86d15c6ba29	3095	/* an alias for the destination shifted ix places */
Vanger	0:b86d15c6ba29	3096	tmpt = t.dp + ix;
Vanger	0:b86d15c6ba29	3097
Vanger	0:b86d15c6ba29	3098	/* an alias for the digits of b */
Vanger	0:b86d15c6ba29	3099	tmpy = b->dp;
Vanger	0:b86d15c6ba29	3100
Vanger	0:b86d15c6ba29	3101	/* compute the columns of the output and propagate the carry */
Vanger	0:b86d15c6ba29	3102	for (iy = 0; iy < pb; iy++) {
Vanger	0:b86d15c6ba29	3103	/* compute the column as a mp_word */
Vanger	0:b86d15c6ba29	3104	r = ((mp_word)*tmpt) +
Vanger	0:b86d15c6ba29	3105	((mp_word)tmpx) * ((mp_word)*tmpy++) +
Vanger	0:b86d15c6ba29	3106	((mp_word) u);
Vanger	0:b86d15c6ba29	3107
Vanger	0:b86d15c6ba29	3108	/* the new column is the lower part of the result */
Vanger	0:b86d15c6ba29	3109	*tmpt++ = (mp_digit) (r & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	3110
Vanger	0:b86d15c6ba29	3111	/* get the carry word from the result */
Vanger	0:b86d15c6ba29	3112	u = (mp_digit) (r >> ((mp_word) DIGIT_BIT));
Vanger	0:b86d15c6ba29	3113	}
Vanger	0:b86d15c6ba29	3114	/* set carry if it is placed below digs */
Vanger	0:b86d15c6ba29	3115	if (ix + iy < digs) {
Vanger	0:b86d15c6ba29	3116	*tmpt = u;
Vanger	0:b86d15c6ba29	3117	}
Vanger	0:b86d15c6ba29	3118	}
Vanger	0:b86d15c6ba29	3119
Vanger	0:b86d15c6ba29	3120	mp_clamp (&t);
Vanger	0:b86d15c6ba29	3121	mp_exch (&t, c);
Vanger	0:b86d15c6ba29	3122
Vanger	0:b86d15c6ba29	3123	mp_clear (&t);
Vanger	0:b86d15c6ba29	3124	return MP_OKAY;
Vanger	0:b86d15c6ba29	3125	}
Vanger	0:b86d15c6ba29	3126
Vanger	0:b86d15c6ba29	3127
Vanger	0:b86d15c6ba29	3128	/*
Vanger	0:b86d15c6ba29	3129	* shifts with subtractions when the result is greater than b.
Vanger	0:b86d15c6ba29	3130	*
Vanger	0:b86d15c6ba29	3131	* The method is slightly modified to shift B unconditionally upto just under
Vanger	0:b86d15c6ba29	3132	* the leading bit of b. This saves alot of multiple precision shifting.
Vanger	0:b86d15c6ba29	3133	*/
Vanger	0:b86d15c6ba29	3134	int mp_montgomery_calc_normalization (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	3135	{
Vanger	0:b86d15c6ba29	3136	int x, bits, res;
Vanger	0:b86d15c6ba29	3137
Vanger	0:b86d15c6ba29	3138	/* how many bits of last digit does b use */
Vanger	0:b86d15c6ba29	3139	bits = mp_count_bits (b) % DIGIT_BIT;
Vanger	0:b86d15c6ba29	3140
Vanger	0:b86d15c6ba29	3141	if (b->used > 1) {
Vanger	0:b86d15c6ba29	3142	if ((res = mp_2expt (a, (b->used - 1) * DIGIT_BIT + bits - 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3143	return res;
Vanger	0:b86d15c6ba29	3144	}
Vanger	0:b86d15c6ba29	3145	} else {
Vanger	0:b86d15c6ba29	3146	mp_set(a, 1);
Vanger	0:b86d15c6ba29	3147	bits = 1;
Vanger	0:b86d15c6ba29	3148	}
Vanger	0:b86d15c6ba29	3149
Vanger	0:b86d15c6ba29	3150
Vanger	0:b86d15c6ba29	3151	/* now compute C = A * B mod b */
Vanger	0:b86d15c6ba29	3152	for (x = bits - 1; x < (int)DIGIT_BIT; x++) {
Vanger	0:b86d15c6ba29	3153	if ((res = mp_mul_2 (a, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3154	return res;
Vanger	0:b86d15c6ba29	3155	}
Vanger	0:b86d15c6ba29	3156	if (mp_cmp_mag (a, b) != MP_LT) {
Vanger	0:b86d15c6ba29	3157	if ((res = s_mp_sub (a, b, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3158	return res;
Vanger	0:b86d15c6ba29	3159	}
Vanger	0:b86d15c6ba29	3160	}
Vanger	0:b86d15c6ba29	3161	}
Vanger	0:b86d15c6ba29	3162
Vanger	0:b86d15c6ba29	3163	return MP_OKAY;
Vanger	0:b86d15c6ba29	3164	}
Vanger	0:b86d15c6ba29	3165
Vanger	0:b86d15c6ba29	3166
Vanger	0:b86d15c6ba29	3167	#ifdef MP_LOW_MEM
Vanger	0:b86d15c6ba29	3168	#define TAB_SIZE 32
Vanger	0:b86d15c6ba29	3169	#else
Vanger	0:b86d15c6ba29	3170	#define TAB_SIZE 256
Vanger	0:b86d15c6ba29	3171	#endif
Vanger	0:b86d15c6ba29	3172
Vanger	0:b86d15c6ba29	3173	int s_mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y, int redmode)
Vanger	0:b86d15c6ba29	3174	{
Vanger	0:b86d15c6ba29	3175	mp_int M[TAB_SIZE], res, mu;
Vanger	0:b86d15c6ba29	3176	mp_digit buf;
Vanger	0:b86d15c6ba29	3177	int err, bitbuf, bitcpy, bitcnt, mode, digidx, x, y, winsize;
Vanger	0:b86d15c6ba29	3178	int (redux)(mp_int,mp_int,mp_int);
Vanger	0:b86d15c6ba29	3179
Vanger	0:b86d15c6ba29	3180	/* find window size */
Vanger	0:b86d15c6ba29	3181	x = mp_count_bits (X);
Vanger	0:b86d15c6ba29	3182	if (x <= 7) {
Vanger	0:b86d15c6ba29	3183	winsize = 2;
Vanger	0:b86d15c6ba29	3184	} else if (x <= 36) {
Vanger	0:b86d15c6ba29	3185	winsize = 3;
Vanger	0:b86d15c6ba29	3186	} else if (x <= 140) {
Vanger	0:b86d15c6ba29	3187	winsize = 4;
Vanger	0:b86d15c6ba29	3188	} else if (x <= 450) {
Vanger	0:b86d15c6ba29	3189	winsize = 5;
Vanger	0:b86d15c6ba29	3190	} else if (x <= 1303) {
Vanger	0:b86d15c6ba29	3191	winsize = 6;
Vanger	0:b86d15c6ba29	3192	} else if (x <= 3529) {
Vanger	0:b86d15c6ba29	3193	winsize = 7;
Vanger	0:b86d15c6ba29	3194	} else {
Vanger	0:b86d15c6ba29	3195	winsize = 8;
Vanger	0:b86d15c6ba29	3196	}
Vanger	0:b86d15c6ba29	3197
Vanger	0:b86d15c6ba29	3198	#ifdef MP_LOW_MEM
Vanger	0:b86d15c6ba29	3199	if (winsize > 5) {
Vanger	0:b86d15c6ba29	3200	winsize = 5;
Vanger	0:b86d15c6ba29	3201	}
Vanger	0:b86d15c6ba29	3202	#endif
Vanger	0:b86d15c6ba29	3203
Vanger	0:b86d15c6ba29	3204	/* init M array */
Vanger	0:b86d15c6ba29	3205	/* init first cell */
Vanger	0:b86d15c6ba29	3206	if ((err = mp_init(&M[1])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3207	return err;
Vanger	0:b86d15c6ba29	3208	}
Vanger	0:b86d15c6ba29	3209
Vanger	0:b86d15c6ba29	3210	/* now init the second half of the array */
Vanger	0:b86d15c6ba29	3211	for (x = 1<<(winsize-1); x < (1 << winsize); x++) {
Vanger	0:b86d15c6ba29	3212	if ((err = mp_init(&M[x])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3213	for (y = 1<<(winsize-1); y < x; y++) {
Vanger	0:b86d15c6ba29	3214	mp_clear (&M[y]);
Vanger	0:b86d15c6ba29	3215	}
Vanger	0:b86d15c6ba29	3216	mp_clear(&M[1]);
Vanger	0:b86d15c6ba29	3217	return err;
Vanger	0:b86d15c6ba29	3218	}
Vanger	0:b86d15c6ba29	3219	}
Vanger	0:b86d15c6ba29	3220
Vanger	0:b86d15c6ba29	3221	/* create mu, used for Barrett reduction */
Vanger	0:b86d15c6ba29	3222	if ((err = mp_init (&mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3223	goto LBL_M;
Vanger	0:b86d15c6ba29	3224	}
Vanger	0:b86d15c6ba29	3225
Vanger	0:b86d15c6ba29	3226	if (redmode == 0) {
Vanger	0:b86d15c6ba29	3227	if ((err = mp_reduce_setup (&mu, P)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3228	goto LBL_MU;
Vanger	0:b86d15c6ba29	3229	}
Vanger	0:b86d15c6ba29	3230	redux = mp_reduce;
Vanger	0:b86d15c6ba29	3231	} else {
Vanger	0:b86d15c6ba29	3232	if ((err = mp_reduce_2k_setup_l (P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3233	goto LBL_MU;
Vanger	0:b86d15c6ba29	3234	}
Vanger	0:b86d15c6ba29	3235	redux = mp_reduce_2k_l;
Vanger	0:b86d15c6ba29	3236	}
Vanger	0:b86d15c6ba29	3237
Vanger	0:b86d15c6ba29	3238	/* create M table
Vanger	0:b86d15c6ba29	3239	*
Vanger	0:b86d15c6ba29	3240	* The M table contains powers of the base,
Vanger	0:b86d15c6ba29	3241	* e.g. M[x] = G**x mod P
Vanger	0:b86d15c6ba29	3242	*
Vanger	0:b86d15c6ba29	3243	* The first half of the table is not
Vanger	0:b86d15c6ba29	3244	* computed though accept for M[0] and M[1]
Vanger	0:b86d15c6ba29	3245	*/
Vanger	0:b86d15c6ba29	3246	if ((err = mp_mod (G, P, &M[1])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3247	goto LBL_MU;
Vanger	0:b86d15c6ba29	3248	}
Vanger	0:b86d15c6ba29	3249
Vanger	0:b86d15c6ba29	3250	/* compute the value at M[1<<(winsize-1)] by squaring
Vanger	0:b86d15c6ba29	3251	* M[1] (winsize-1) times
Vanger	0:b86d15c6ba29	3252	*/
Vanger	0:b86d15c6ba29	3253	if ((err = mp_copy (&M[1], &M[(mp_digit)(1 << (winsize - 1))])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3254	goto LBL_MU;
Vanger	0:b86d15c6ba29	3255	}
Vanger	0:b86d15c6ba29	3256
Vanger	0:b86d15c6ba29	3257	for (x = 0; x < (winsize - 1); x++) {
Vanger	0:b86d15c6ba29	3258	/* square it */
Vanger	0:b86d15c6ba29	3259	if ((err = mp_sqr (&M[(mp_digit)(1 << (winsize - 1))],
Vanger	0:b86d15c6ba29	3260	&M[(mp_digit)(1 << (winsize - 1))])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3261	goto LBL_MU;
Vanger	0:b86d15c6ba29	3262	}
Vanger	0:b86d15c6ba29	3263
Vanger	0:b86d15c6ba29	3264	/* reduce modulo P */
Vanger	0:b86d15c6ba29	3265	if ((err = redux (&M[(mp_digit)(1 << (winsize - 1))], P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3266	goto LBL_MU;
Vanger	0:b86d15c6ba29	3267	}
Vanger	0:b86d15c6ba29	3268	}
Vanger	0:b86d15c6ba29	3269
Vanger	0:b86d15c6ba29	3270	/* create upper table, that is M[x] = M[x-1] * M[1] (mod P)
Vanger	0:b86d15c6ba29	3271	* for x = (2(winsize - 1) + 1) to (2winsize - 1)
Vanger	0:b86d15c6ba29	3272	*/
Vanger	0:b86d15c6ba29	3273	for (x = (1 << (winsize - 1)) + 1; x < (1 << winsize); x++) {
Vanger	0:b86d15c6ba29	3274	if ((err = mp_mul (&M[x - 1], &M[1], &M[x])) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3275	goto LBL_MU;
Vanger	0:b86d15c6ba29	3276	}
Vanger	0:b86d15c6ba29	3277	if ((err = redux (&M[x], P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3278	goto LBL_MU;
Vanger	0:b86d15c6ba29	3279	}
Vanger	0:b86d15c6ba29	3280	}
Vanger	0:b86d15c6ba29	3281
Vanger	0:b86d15c6ba29	3282	/* setup result */
Vanger	0:b86d15c6ba29	3283	if ((err = mp_init (&res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3284	goto LBL_MU;
Vanger	0:b86d15c6ba29	3285	}
Vanger	0:b86d15c6ba29	3286	mp_set (&res, 1);
Vanger	0:b86d15c6ba29	3287
Vanger	0:b86d15c6ba29	3288	/* set initial mode and bit cnt */
Vanger	0:b86d15c6ba29	3289	mode = 0;
Vanger	0:b86d15c6ba29	3290	bitcnt = 1;
Vanger	0:b86d15c6ba29	3291	buf = 0;
Vanger	0:b86d15c6ba29	3292	digidx = X->used - 1;
Vanger	0:b86d15c6ba29	3293	bitcpy = 0;
Vanger	0:b86d15c6ba29	3294	bitbuf = 0;
Vanger	0:b86d15c6ba29	3295
Vanger	0:b86d15c6ba29	3296	for (;;) {
Vanger	0:b86d15c6ba29	3297	/* grab next digit as required */
Vanger	0:b86d15c6ba29	3298	if (--bitcnt == 0) {
Vanger	0:b86d15c6ba29	3299	/* if digidx == -1 we are out of digits */
Vanger	0:b86d15c6ba29	3300	if (digidx == -1) {
Vanger	0:b86d15c6ba29	3301	break;
Vanger	0:b86d15c6ba29	3302	}
Vanger	0:b86d15c6ba29	3303	/* read next digit and reset the bitcnt */
Vanger	0:b86d15c6ba29	3304	buf = X->dp[digidx--];
Vanger	0:b86d15c6ba29	3305	bitcnt = (int) DIGIT_BIT;
Vanger	0:b86d15c6ba29	3306	}
Vanger	0:b86d15c6ba29	3307
Vanger	0:b86d15c6ba29	3308	/* grab the next msb from the exponent */
Vanger	0:b86d15c6ba29	3309	y = (int)(buf >> (mp_digit)(DIGIT_BIT - 1)) & 1;
Vanger	0:b86d15c6ba29	3310	buf <<= (mp_digit)1;
Vanger	0:b86d15c6ba29	3311
Vanger	0:b86d15c6ba29	3312	/* if the bit is zero and mode == 0 then we ignore it
Vanger	0:b86d15c6ba29	3313	* These represent the leading zero bits before the first 1 bit
Vanger	0:b86d15c6ba29	3314	* in the exponent. Technically this opt is not required but it
Vanger	0:b86d15c6ba29	3315	* does lower the # of trivial squaring/reductions used
Vanger	0:b86d15c6ba29	3316	*/
Vanger	0:b86d15c6ba29	3317	if (mode == 0 && y == 0) {
Vanger	0:b86d15c6ba29	3318	continue;
Vanger	0:b86d15c6ba29	3319	}
Vanger	0:b86d15c6ba29	3320
Vanger	0:b86d15c6ba29	3321	/* if the bit is zero and mode == 1 then we square */
Vanger	0:b86d15c6ba29	3322	if (mode == 1 && y == 0) {
Vanger	0:b86d15c6ba29	3323	if ((err = mp_sqr (&res, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3324	goto LBL_RES;
Vanger	0:b86d15c6ba29	3325	}
Vanger	0:b86d15c6ba29	3326	if ((err = redux (&res, P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3327	goto LBL_RES;
Vanger	0:b86d15c6ba29	3328	}
Vanger	0:b86d15c6ba29	3329	continue;
Vanger	0:b86d15c6ba29	3330	}
Vanger	0:b86d15c6ba29	3331
Vanger	0:b86d15c6ba29	3332	/* else we add it to the window */
Vanger	0:b86d15c6ba29	3333	bitbuf \|= (y << (winsize - ++bitcpy));
Vanger	0:b86d15c6ba29	3334	mode = 2;
Vanger	0:b86d15c6ba29	3335
Vanger	0:b86d15c6ba29	3336	if (bitcpy == winsize) {
Vanger	0:b86d15c6ba29	3337	/* ok window is filled so square as required and multiply */
Vanger	0:b86d15c6ba29	3338	/* square first */
Vanger	0:b86d15c6ba29	3339	for (x = 0; x < winsize; x++) {
Vanger	0:b86d15c6ba29	3340	if ((err = mp_sqr (&res, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3341	goto LBL_RES;
Vanger	0:b86d15c6ba29	3342	}
Vanger	0:b86d15c6ba29	3343	if ((err = redux (&res, P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3344	goto LBL_RES;
Vanger	0:b86d15c6ba29	3345	}
Vanger	0:b86d15c6ba29	3346	}
Vanger	0:b86d15c6ba29	3347
Vanger	0:b86d15c6ba29	3348	/* then multiply */
Vanger	0:b86d15c6ba29	3349	if ((err = mp_mul (&res, &M[bitbuf], &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3350	goto LBL_RES;
Vanger	0:b86d15c6ba29	3351	}
Vanger	0:b86d15c6ba29	3352	if ((err = redux (&res, P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3353	goto LBL_RES;
Vanger	0:b86d15c6ba29	3354	}
Vanger	0:b86d15c6ba29	3355
Vanger	0:b86d15c6ba29	3356	/* empty window and reset */
Vanger	0:b86d15c6ba29	3357	bitcpy = 0;
Vanger	0:b86d15c6ba29	3358	bitbuf = 0;
Vanger	0:b86d15c6ba29	3359	mode = 1;
Vanger	0:b86d15c6ba29	3360	}
Vanger	0:b86d15c6ba29	3361	}
Vanger	0:b86d15c6ba29	3362
Vanger	0:b86d15c6ba29	3363	/* if bits remain then square/multiply */
Vanger	0:b86d15c6ba29	3364	if (mode == 2 && bitcpy > 0) {
Vanger	0:b86d15c6ba29	3365	/* square then multiply if the bit is set */
Vanger	0:b86d15c6ba29	3366	for (x = 0; x < bitcpy; x++) {
Vanger	0:b86d15c6ba29	3367	if ((err = mp_sqr (&res, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3368	goto LBL_RES;
Vanger	0:b86d15c6ba29	3369	}
Vanger	0:b86d15c6ba29	3370	if ((err = redux (&res, P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3371	goto LBL_RES;
Vanger	0:b86d15c6ba29	3372	}
Vanger	0:b86d15c6ba29	3373
Vanger	0:b86d15c6ba29	3374	bitbuf <<= 1;
Vanger	0:b86d15c6ba29	3375	if ((bitbuf & (1 << winsize)) != 0) {
Vanger	0:b86d15c6ba29	3376	/* then multiply */
Vanger	0:b86d15c6ba29	3377	if ((err = mp_mul (&res, &M[1], &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3378	goto LBL_RES;
Vanger	0:b86d15c6ba29	3379	}
Vanger	0:b86d15c6ba29	3380	if ((err = redux (&res, P, &mu)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3381	goto LBL_RES;
Vanger	0:b86d15c6ba29	3382	}
Vanger	0:b86d15c6ba29	3383	}
Vanger	0:b86d15c6ba29	3384	}
Vanger	0:b86d15c6ba29	3385	}
Vanger	0:b86d15c6ba29	3386
Vanger	0:b86d15c6ba29	3387	mp_exch (&res, Y);
Vanger	0:b86d15c6ba29	3388	err = MP_OKAY;
Vanger	0:b86d15c6ba29	3389	LBL_RES:mp_clear (&res);
Vanger	0:b86d15c6ba29	3390	LBL_MU:mp_clear (&mu);
Vanger	0:b86d15c6ba29	3391	LBL_M:
Vanger	0:b86d15c6ba29	3392	mp_clear(&M[1]);
Vanger	0:b86d15c6ba29	3393	for (x = 1<<(winsize-1); x < (1 << winsize); x++) {
Vanger	0:b86d15c6ba29	3394	mp_clear (&M[x]);
Vanger	0:b86d15c6ba29	3395	}
Vanger	0:b86d15c6ba29	3396	return err;
Vanger	0:b86d15c6ba29	3397	}
Vanger	0:b86d15c6ba29	3398
Vanger	0:b86d15c6ba29	3399
Vanger	0:b86d15c6ba29	3400	/* pre-calculate the value required for Barrett reduction
Vanger	0:b86d15c6ba29	3401	* For a given modulus "b" it calulates the value required in "a"
Vanger	0:b86d15c6ba29	3402	*/
Vanger	0:b86d15c6ba29	3403	int mp_reduce_setup (mp_int * a, mp_int * b)
Vanger	0:b86d15c6ba29	3404	{
Vanger	0:b86d15c6ba29	3405	int res;
Vanger	0:b86d15c6ba29	3406
Vanger	0:b86d15c6ba29	3407	if ((res = mp_2expt (a, b->used * 2 * DIGIT_BIT)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3408	return res;
Vanger	0:b86d15c6ba29	3409	}
Vanger	0:b86d15c6ba29	3410	return mp_div (a, b, a, NULL);
Vanger	0:b86d15c6ba29	3411	}
Vanger	0:b86d15c6ba29	3412
Vanger	0:b86d15c6ba29	3413
Vanger	0:b86d15c6ba29	3414	/* reduces x mod m, assumes 0 < x < m**2, mu is
Vanger	0:b86d15c6ba29	3415	* precomputed via mp_reduce_setup.
Vanger	0:b86d15c6ba29	3416	* From HAC pp.604 Algorithm 14.42
Vanger	0:b86d15c6ba29	3417	*/
Vanger	0:b86d15c6ba29	3418	int mp_reduce (mp_int * x, mp_int * m, mp_int * mu)
Vanger	0:b86d15c6ba29	3419	{
Vanger	0:b86d15c6ba29	3420	mp_int q;
Vanger	0:b86d15c6ba29	3421	int res, um = m->used;
Vanger	0:b86d15c6ba29	3422
Vanger	0:b86d15c6ba29	3423	/* q = x */
Vanger	0:b86d15c6ba29	3424	if ((res = mp_init_copy (&q, x)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3425	return res;
Vanger	0:b86d15c6ba29	3426	}
Vanger	0:b86d15c6ba29	3427
Vanger	0:b86d15c6ba29	3428	/* q1 = x / b*(k-1) /
Vanger	0:b86d15c6ba29	3429	mp_rshd (&q, um - 1);
Vanger	0:b86d15c6ba29	3430
Vanger	0:b86d15c6ba29	3431	/* according to HAC this optimization is ok */
Vanger	0:b86d15c6ba29	3432	if (((mp_word) um) > (((mp_digit)1) << (DIGIT_BIT - 1))) {
Vanger	0:b86d15c6ba29	3433	if ((res = mp_mul (&q, mu, &q)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3434	goto CLEANUP;
Vanger	0:b86d15c6ba29	3435	}
Vanger	0:b86d15c6ba29	3436	} else {
Vanger	0:b86d15c6ba29	3437	#ifdef BN_S_MP_MUL_HIGH_DIGS_C
Vanger	0:b86d15c6ba29	3438	if ((res = s_mp_mul_high_digs (&q, mu, &q, um)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3439	goto CLEANUP;
Vanger	0:b86d15c6ba29	3440	}
Vanger	0:b86d15c6ba29	3441	#elif defined(BN_FAST_S_MP_MUL_HIGH_DIGS_C)
Vanger	0:b86d15c6ba29	3442	if ((res = fast_s_mp_mul_high_digs (&q, mu, &q, um)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3443	goto CLEANUP;
Vanger	0:b86d15c6ba29	3444	}
Vanger	0:b86d15c6ba29	3445	#else
Vanger	0:b86d15c6ba29	3446	{
Vanger	0:b86d15c6ba29	3447	res = MP_VAL;
Vanger	0:b86d15c6ba29	3448	goto CLEANUP;
Vanger	0:b86d15c6ba29	3449	}
Vanger	0:b86d15c6ba29	3450	#endif
Vanger	0:b86d15c6ba29	3451	}
Vanger	0:b86d15c6ba29	3452
Vanger	0:b86d15c6ba29	3453	/* q3 = q2 / b*(k+1) /
Vanger	0:b86d15c6ba29	3454	mp_rshd (&q, um + 1);
Vanger	0:b86d15c6ba29	3455
Vanger	0:b86d15c6ba29	3456	/* x = x mod b*(k+1), quick (no division) /
Vanger	0:b86d15c6ba29	3457	if ((res = mp_mod_2d (x, DIGIT_BIT * (um + 1), x)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3458	goto CLEANUP;
Vanger	0:b86d15c6ba29	3459	}
Vanger	0:b86d15c6ba29	3460
Vanger	0:b86d15c6ba29	3461	/* q = q * m mod b*(k+1), quick (no division) /
Vanger	0:b86d15c6ba29	3462	if ((res = s_mp_mul_digs (&q, m, &q, um + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3463	goto CLEANUP;
Vanger	0:b86d15c6ba29	3464	}
Vanger	0:b86d15c6ba29	3465
Vanger	0:b86d15c6ba29	3466	/* x = x - q */
Vanger	0:b86d15c6ba29	3467	if ((res = mp_sub (x, &q, x)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3468	goto CLEANUP;
Vanger	0:b86d15c6ba29	3469	}
Vanger	0:b86d15c6ba29	3470
Vanger	0:b86d15c6ba29	3471	/* If x < 0, add b*(k+1) to it /
Vanger	0:b86d15c6ba29	3472	if (mp_cmp_d (x, 0) == MP_LT) {
Vanger	0:b86d15c6ba29	3473	mp_set (&q, 1);
Vanger	0:b86d15c6ba29	3474	if ((res = mp_lshd (&q, um + 1)) != MP_OKAY)
Vanger	0:b86d15c6ba29	3475	goto CLEANUP;
Vanger	0:b86d15c6ba29	3476	if ((res = mp_add (x, &q, x)) != MP_OKAY)
Vanger	0:b86d15c6ba29	3477	goto CLEANUP;
Vanger	0:b86d15c6ba29	3478	}
Vanger	0:b86d15c6ba29	3479
Vanger	0:b86d15c6ba29	3480	/* Back off if it's too big */
Vanger	0:b86d15c6ba29	3481	while (mp_cmp (x, m) != MP_LT) {
Vanger	0:b86d15c6ba29	3482	if ((res = s_mp_sub (x, m, x)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3483	goto CLEANUP;
Vanger	0:b86d15c6ba29	3484	}
Vanger	0:b86d15c6ba29	3485	}
Vanger	0:b86d15c6ba29	3486
Vanger	0:b86d15c6ba29	3487	CLEANUP:
Vanger	0:b86d15c6ba29	3488	mp_clear (&q);
Vanger	0:b86d15c6ba29	3489
Vanger	0:b86d15c6ba29	3490	return res;
Vanger	0:b86d15c6ba29	3491	}
Vanger	0:b86d15c6ba29	3492
Vanger	0:b86d15c6ba29	3493
Vanger	0:b86d15c6ba29	3494	/* reduces a modulo n where n is of the form 2**p - d
Vanger	0:b86d15c6ba29	3495	This differs from reduce_2k since "d" can be larger
Vanger	0:b86d15c6ba29	3496	than a single digit.
Vanger	0:b86d15c6ba29	3497	*/
Vanger	0:b86d15c6ba29	3498	int mp_reduce_2k_l(mp_int a, mp_int n, mp_int *d)
Vanger	0:b86d15c6ba29	3499	{
Vanger	0:b86d15c6ba29	3500	mp_int q;
Vanger	0:b86d15c6ba29	3501	int p, res;
Vanger	0:b86d15c6ba29	3502
Vanger	0:b86d15c6ba29	3503	if ((res = mp_init(&q)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3504	return res;
Vanger	0:b86d15c6ba29	3505	}
Vanger	0:b86d15c6ba29	3506
Vanger	0:b86d15c6ba29	3507	p = mp_count_bits(n);
Vanger	0:b86d15c6ba29	3508	top:
Vanger	0:b86d15c6ba29	3509	/* q = a/2p, a = a mod 2p */
Vanger	0:b86d15c6ba29	3510	if ((res = mp_div_2d(a, p, &q, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3511	goto ERR;
Vanger	0:b86d15c6ba29	3512	}
Vanger	0:b86d15c6ba29	3513
Vanger	0:b86d15c6ba29	3514	/* q = q * d */
Vanger	0:b86d15c6ba29	3515	if ((res = mp_mul(&q, d, &q)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3516	goto ERR;
Vanger	0:b86d15c6ba29	3517	}
Vanger	0:b86d15c6ba29	3518
Vanger	0:b86d15c6ba29	3519	/* a = a + q */
Vanger	0:b86d15c6ba29	3520	if ((res = s_mp_add(a, &q, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3521	goto ERR;
Vanger	0:b86d15c6ba29	3522	}
Vanger	0:b86d15c6ba29	3523
Vanger	0:b86d15c6ba29	3524	if (mp_cmp_mag(a, n) != MP_LT) {
Vanger	0:b86d15c6ba29	3525	s_mp_sub(a, n, a);
Vanger	0:b86d15c6ba29	3526	goto top;
Vanger	0:b86d15c6ba29	3527	}
Vanger	0:b86d15c6ba29	3528
Vanger	0:b86d15c6ba29	3529	ERR:
Vanger	0:b86d15c6ba29	3530	mp_clear(&q);
Vanger	0:b86d15c6ba29	3531	return res;
Vanger	0:b86d15c6ba29	3532	}
Vanger	0:b86d15c6ba29	3533
Vanger	0:b86d15c6ba29	3534
Vanger	0:b86d15c6ba29	3535	/* determines the setup value */
Vanger	0:b86d15c6ba29	3536	int mp_reduce_2k_setup_l(mp_int a, mp_int d)
Vanger	0:b86d15c6ba29	3537	{
Vanger	0:b86d15c6ba29	3538	int res;
Vanger	0:b86d15c6ba29	3539	mp_int tmp;
Vanger	0:b86d15c6ba29	3540
Vanger	0:b86d15c6ba29	3541	if ((res = mp_init(&tmp)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3542	return res;
Vanger	0:b86d15c6ba29	3543	}
Vanger	0:b86d15c6ba29	3544
Vanger	0:b86d15c6ba29	3545	if ((res = mp_2expt(&tmp, mp_count_bits(a))) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3546	goto ERR;
Vanger	0:b86d15c6ba29	3547	}
Vanger	0:b86d15c6ba29	3548
Vanger	0:b86d15c6ba29	3549	if ((res = s_mp_sub(&tmp, a, d)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3550	goto ERR;
Vanger	0:b86d15c6ba29	3551	}
Vanger	0:b86d15c6ba29	3552
Vanger	0:b86d15c6ba29	3553	ERR:
Vanger	0:b86d15c6ba29	3554	mp_clear(&tmp);
Vanger	0:b86d15c6ba29	3555	return res;
Vanger	0:b86d15c6ba29	3556	}
Vanger	0:b86d15c6ba29	3557
Vanger	0:b86d15c6ba29	3558
Vanger	0:b86d15c6ba29	3559	/* multiplies \|a\| * \|b\| and does not compute the lower digs digits
Vanger	0:b86d15c6ba29	3560	* [meant to get the higher part of the product]
Vanger	0:b86d15c6ba29	3561	*/
Vanger	0:b86d15c6ba29	3562	int
Vanger	0:b86d15c6ba29	3563	s_mp_mul_high_digs (mp_int * a, mp_int * b, mp_int * c, int digs)
Vanger	0:b86d15c6ba29	3564	{
Vanger	0:b86d15c6ba29	3565	mp_int t;
Vanger	0:b86d15c6ba29	3566	int res, pa, pb, ix, iy;
Vanger	0:b86d15c6ba29	3567	mp_digit u;
Vanger	0:b86d15c6ba29	3568	mp_word r;
Vanger	0:b86d15c6ba29	3569	mp_digit tmpx, tmpt, tmpy;
Vanger	0:b86d15c6ba29	3570
Vanger	0:b86d15c6ba29	3571	/* can we use the fast multiplier? */
Vanger	0:b86d15c6ba29	3572	#ifdef BN_FAST_S_MP_MUL_HIGH_DIGS_C
Vanger	0:b86d15c6ba29	3573	if (((a->used + b->used + 1) < MP_WARRAY)
Vanger	0:b86d15c6ba29	3574	&& MIN (a->used, b->used) < (1 << ((CHAR_BIT * sizeof (mp_word)) - (2 * DIGIT_BIT)))) {
Vanger	0:b86d15c6ba29	3575	return fast_s_mp_mul_high_digs (a, b, c, digs);
Vanger	0:b86d15c6ba29	3576	}
Vanger	0:b86d15c6ba29	3577	#endif
Vanger	0:b86d15c6ba29	3578
Vanger	0:b86d15c6ba29	3579	if ((res = mp_init_size (&t, a->used + b->used + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3580	return res;
Vanger	0:b86d15c6ba29	3581	}
Vanger	0:b86d15c6ba29	3582	t.used = a->used + b->used + 1;
Vanger	0:b86d15c6ba29	3583
Vanger	0:b86d15c6ba29	3584	pa = a->used;
Vanger	0:b86d15c6ba29	3585	pb = b->used;
Vanger	0:b86d15c6ba29	3586	for (ix = 0; ix < pa; ix++) {
Vanger	0:b86d15c6ba29	3587	/* clear the carry */
Vanger	0:b86d15c6ba29	3588	u = 0;
Vanger	0:b86d15c6ba29	3589
Vanger	0:b86d15c6ba29	3590	/* left hand side of A[ix] * B[iy] */
Vanger	0:b86d15c6ba29	3591	tmpx = a->dp[ix];
Vanger	0:b86d15c6ba29	3592
Vanger	0:b86d15c6ba29	3593	/* alias to the address of where the digits will be stored */
Vanger	0:b86d15c6ba29	3594	tmpt = &(t.dp[digs]);
Vanger	0:b86d15c6ba29	3595
Vanger	0:b86d15c6ba29	3596	/* alias for where to read the right hand side from */
Vanger	0:b86d15c6ba29	3597	tmpy = b->dp + (digs - ix);
Vanger	0:b86d15c6ba29	3598
Vanger	0:b86d15c6ba29	3599	for (iy = digs - ix; iy < pb; iy++) {
Vanger	0:b86d15c6ba29	3600	/* calculate the double precision result */
Vanger	0:b86d15c6ba29	3601	r = ((mp_word)*tmpt) +
Vanger	0:b86d15c6ba29	3602	((mp_word)tmpx) * ((mp_word)*tmpy++) +
Vanger	0:b86d15c6ba29	3603	((mp_word) u);
Vanger	0:b86d15c6ba29	3604
Vanger	0:b86d15c6ba29	3605	/* get the lower part */
Vanger	0:b86d15c6ba29	3606	*tmpt++ = (mp_digit) (r & ((mp_word) MP_MASK));
Vanger	0:b86d15c6ba29	3607
Vanger	0:b86d15c6ba29	3608	/* carry the carry */
Vanger	0:b86d15c6ba29	3609	u = (mp_digit) (r >> ((mp_word) DIGIT_BIT));
Vanger	0:b86d15c6ba29	3610	}
Vanger	0:b86d15c6ba29	3611	*tmpt = u;
Vanger	0:b86d15c6ba29	3612	}
Vanger	0:b86d15c6ba29	3613	mp_clamp (&t);
Vanger	0:b86d15c6ba29	3614	mp_exch (&t, c);
Vanger	0:b86d15c6ba29	3615	mp_clear (&t);
Vanger	0:b86d15c6ba29	3616	return MP_OKAY;
Vanger	0:b86d15c6ba29	3617	}
Vanger	0:b86d15c6ba29	3618
Vanger	0:b86d15c6ba29	3619
Vanger	0:b86d15c6ba29	3620	/* this is a modified version of fast_s_mul_digs that only produces
Vanger	0:b86d15c6ba29	3621	* output digits above digs. See the comments for fast_s_mul_digs
Vanger	0:b86d15c6ba29	3622	* to see how it works.
Vanger	0:b86d15c6ba29	3623	*
Vanger	0:b86d15c6ba29	3624	* This is used in the Barrett reduction since for one of the multiplications
Vanger	0:b86d15c6ba29	3625	* only the higher digits were needed. This essentially halves the work.
Vanger	0:b86d15c6ba29	3626	*
Vanger	0:b86d15c6ba29	3627	* Based on Algorithm 14.12 on pp.595 of HAC.
Vanger	0:b86d15c6ba29	3628	*/
Vanger	0:b86d15c6ba29	3629	int fast_s_mp_mul_high_digs (mp_int * a, mp_int * b, mp_int * c, int digs)
Vanger	0:b86d15c6ba29	3630	{
Vanger	0:b86d15c6ba29	3631	int olduse, res, pa, ix, iz;
Vanger	0:b86d15c6ba29	3632	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	3633	mp_digit* W; /* uses dynamic memory and slower */
Vanger	0:b86d15c6ba29	3634	#else
Vanger	0:b86d15c6ba29	3635	mp_digit W[MP_WARRAY];
Vanger	0:b86d15c6ba29	3636	#endif
Vanger	0:b86d15c6ba29	3637	mp_word _W;
Vanger	0:b86d15c6ba29	3638
Vanger	0:b86d15c6ba29	3639	/* grow the destination as required */
Vanger	0:b86d15c6ba29	3640	pa = a->used + b->used;
Vanger	0:b86d15c6ba29	3641	if (c->alloc < pa) {
Vanger	0:b86d15c6ba29	3642	if ((res = mp_grow (c, pa)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3643	return res;
Vanger	0:b86d15c6ba29	3644	}
Vanger	0:b86d15c6ba29	3645	}
Vanger	0:b86d15c6ba29	3646
Vanger	0:b86d15c6ba29	3647	if (pa > MP_WARRAY)
Vanger	0:b86d15c6ba29	3648	return MP_RANGE; /* TAO range check */
Vanger	0:b86d15c6ba29	3649
Vanger	0:b86d15c6ba29	3650	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	3651	W = (mp_digit)XMALLOC(sizeof(mp_digit) MP_WARRAY, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	3652	if (W == NULL)
Vanger	0:b86d15c6ba29	3653	return MP_MEM;
Vanger	0:b86d15c6ba29	3654	#endif
Vanger	0:b86d15c6ba29	3655
Vanger	0:b86d15c6ba29	3656	/* number of output digits to produce */
Vanger	0:b86d15c6ba29	3657	pa = a->used + b->used;
Vanger	0:b86d15c6ba29	3658	_W = 0;
Vanger	0:b86d15c6ba29	3659	for (ix = digs; ix < pa; ix++) {
Vanger	0:b86d15c6ba29	3660	int tx, ty, iy;
Vanger	0:b86d15c6ba29	3661	mp_digit tmpx, tmpy;
Vanger	0:b86d15c6ba29	3662
Vanger	0:b86d15c6ba29	3663	/* get offsets into the two bignums */
Vanger	0:b86d15c6ba29	3664	ty = MIN(b->used-1, ix);
Vanger	0:b86d15c6ba29	3665	tx = ix - ty;
Vanger	0:b86d15c6ba29	3666
Vanger	0:b86d15c6ba29	3667	/* setup temp aliases */
Vanger	0:b86d15c6ba29	3668	tmpx = a->dp + tx;
Vanger	0:b86d15c6ba29	3669	tmpy = b->dp + ty;
Vanger	0:b86d15c6ba29	3670
Vanger	0:b86d15c6ba29	3671	/* this is the number of times the loop will iterrate, essentially its
Vanger	0:b86d15c6ba29	3672	while (tx++ < a->used && ty-- >= 0) { ... }
Vanger	0:b86d15c6ba29	3673	*/
Vanger	0:b86d15c6ba29	3674	iy = MIN(a->used-tx, ty+1);
Vanger	0:b86d15c6ba29	3675
Vanger	0:b86d15c6ba29	3676	/* execute loop */
Vanger	0:b86d15c6ba29	3677	for (iz = 0; iz < iy; iz++) {
Vanger	0:b86d15c6ba29	3678	_W += ((mp_word)tmpx++)((mp_word)*tmpy--);
Vanger	0:b86d15c6ba29	3679	}
Vanger	0:b86d15c6ba29	3680
Vanger	0:b86d15c6ba29	3681	/* store term */
Vanger	0:b86d15c6ba29	3682	W[ix] = ((mp_digit)_W) & MP_MASK;
Vanger	0:b86d15c6ba29	3683
Vanger	0:b86d15c6ba29	3684	/* make next carry */
Vanger	0:b86d15c6ba29	3685	_W = _W >> ((mp_word)DIGIT_BIT);
Vanger	0:b86d15c6ba29	3686	}
Vanger	0:b86d15c6ba29	3687
Vanger	0:b86d15c6ba29	3688	/* setup dest */
Vanger	0:b86d15c6ba29	3689	olduse = c->used;
Vanger	0:b86d15c6ba29	3690	c->used = pa;
Vanger	0:b86d15c6ba29	3691
Vanger	0:b86d15c6ba29	3692	{
Vanger	0:b86d15c6ba29	3693	register mp_digit *tmpc;
Vanger	0:b86d15c6ba29	3694
Vanger	0:b86d15c6ba29	3695	tmpc = c->dp + digs;
Vanger	0:b86d15c6ba29	3696	for (ix = digs; ix <= pa; ix++) {
Vanger	0:b86d15c6ba29	3697	/* now extract the previous digit [below the carry] */
Vanger	0:b86d15c6ba29	3698	*tmpc++ = W[ix];
Vanger	0:b86d15c6ba29	3699	}
Vanger	0:b86d15c6ba29	3700
Vanger	0:b86d15c6ba29	3701	/* clear unused digits [that existed in the old copy of c] */
Vanger	0:b86d15c6ba29	3702	for (; ix < olduse; ix++) {
Vanger	0:b86d15c6ba29	3703	*tmpc++ = 0;
Vanger	0:b86d15c6ba29	3704	}
Vanger	0:b86d15c6ba29	3705	}
Vanger	0:b86d15c6ba29	3706	mp_clamp (c);
Vanger	0:b86d15c6ba29	3707
Vanger	0:b86d15c6ba29	3708	#ifdef CYASSL_SMALL_STACK
Vanger	0:b86d15c6ba29	3709	XFREE(W, 0, DYNAMIC_TYPE_BIGINT);
Vanger	0:b86d15c6ba29	3710	#endif
Vanger	0:b86d15c6ba29	3711
Vanger	0:b86d15c6ba29	3712	return MP_OKAY;
Vanger	0:b86d15c6ba29	3713	}
Vanger	0:b86d15c6ba29	3714
Vanger	0:b86d15c6ba29	3715
Vanger	0:b86d15c6ba29	3716	/* set a 32-bit const */
Vanger	0:b86d15c6ba29	3717	int mp_set_int (mp_int * a, unsigned long b)
Vanger	0:b86d15c6ba29	3718	{
Vanger	0:b86d15c6ba29	3719	int x, res;
Vanger	0:b86d15c6ba29	3720
Vanger	0:b86d15c6ba29	3721	mp_zero (a);
Vanger	0:b86d15c6ba29	3722
Vanger	0:b86d15c6ba29	3723	/* set four bits at a time */
Vanger	0:b86d15c6ba29	3724	for (x = 0; x < 8; x++) {
Vanger	0:b86d15c6ba29	3725	/* shift the number up four bits */
Vanger	0:b86d15c6ba29	3726	if ((res = mp_mul_2d (a, 4, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3727	return res;
Vanger	0:b86d15c6ba29	3728	}
Vanger	0:b86d15c6ba29	3729
Vanger	0:b86d15c6ba29	3730	/* OR in the top four bits of the source */
Vanger	0:b86d15c6ba29	3731	a->dp[0] \|= (b >> 28) & 15;
Vanger	0:b86d15c6ba29	3732
Vanger	0:b86d15c6ba29	3733	/* shift the source up to the next four bits */
Vanger	0:b86d15c6ba29	3734	b <<= 4;
Vanger	0:b86d15c6ba29	3735
Vanger	0:b86d15c6ba29	3736	/* ensure that digits are not clamped off */
Vanger	0:b86d15c6ba29	3737	a->used += 1;
Vanger	0:b86d15c6ba29	3738	}
Vanger	0:b86d15c6ba29	3739	mp_clamp (a);
Vanger	0:b86d15c6ba29	3740	return MP_OKAY;
Vanger	0:b86d15c6ba29	3741	}
Vanger	0:b86d15c6ba29	3742
Vanger	0:b86d15c6ba29	3743
Vanger	0:b86d15c6ba29	3744	#if defined(CYASSL_KEY_GEN) \|\| defined(HAVE_ECC)
Vanger	0:b86d15c6ba29	3745
Vanger	0:b86d15c6ba29	3746	/* c = a * a (mod b) */
Vanger	0:b86d15c6ba29	3747	int mp_sqrmod (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	3748	{
Vanger	0:b86d15c6ba29	3749	int res;
Vanger	0:b86d15c6ba29	3750	mp_int t;
Vanger	0:b86d15c6ba29	3751
Vanger	0:b86d15c6ba29	3752	if ((res = mp_init (&t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3753	return res;
Vanger	0:b86d15c6ba29	3754	}
Vanger	0:b86d15c6ba29	3755
Vanger	0:b86d15c6ba29	3756	if ((res = mp_sqr (a, &t)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3757	mp_clear (&t);
Vanger	0:b86d15c6ba29	3758	return res;
Vanger	0:b86d15c6ba29	3759	}
Vanger	0:b86d15c6ba29	3760	res = mp_mod (&t, b, c);
Vanger	0:b86d15c6ba29	3761	mp_clear (&t);
Vanger	0:b86d15c6ba29	3762	return res;
Vanger	0:b86d15c6ba29	3763	}
Vanger	0:b86d15c6ba29	3764
Vanger	0:b86d15c6ba29	3765	#endif
Vanger	0:b86d15c6ba29	3766
Vanger	0:b86d15c6ba29	3767
Vanger	0:b86d15c6ba29	3768	#if defined(HAVE_ECC) \|\| !defined(NO_PWDBASED) \|\| defined(CYASSL_SNIFFER) \|\| defined(CYASSL_HAVE_WOLFSCEP) \|\| defined(CYASSL_KEY_GEN)
Vanger	0:b86d15c6ba29	3769
Vanger	0:b86d15c6ba29	3770	/* single digit addition */
Vanger	0:b86d15c6ba29	3771	int mp_add_d (mp_int* a, mp_digit b, mp_int* c)
Vanger	0:b86d15c6ba29	3772	{
Vanger	0:b86d15c6ba29	3773	int res, ix, oldused;
Vanger	0:b86d15c6ba29	3774	mp_digit tmpa, tmpc, mu;
Vanger	0:b86d15c6ba29	3775
Vanger	0:b86d15c6ba29	3776	/* grow c as required */
Vanger	0:b86d15c6ba29	3777	if (c->alloc < a->used + 1) {
Vanger	0:b86d15c6ba29	3778	if ((res = mp_grow(c, a->used + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3779	return res;
Vanger	0:b86d15c6ba29	3780	}
Vanger	0:b86d15c6ba29	3781	}
Vanger	0:b86d15c6ba29	3782
Vanger	0:b86d15c6ba29	3783	/* if a is negative and \|a\| >= b, call c = \|a\| - b */
Vanger	0:b86d15c6ba29	3784	if (a->sign == MP_NEG && (a->used > 1 \|\| a->dp[0] >= b)) {
Vanger	0:b86d15c6ba29	3785	/* temporarily fix sign of a */
Vanger	0:b86d15c6ba29	3786	a->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	3787
Vanger	0:b86d15c6ba29	3788	/* c = \|a\| - b */
Vanger	0:b86d15c6ba29	3789	res = mp_sub_d(a, b, c);
Vanger	0:b86d15c6ba29	3790
Vanger	0:b86d15c6ba29	3791	/* fix sign */
Vanger	0:b86d15c6ba29	3792	a->sign = c->sign = MP_NEG;
Vanger	0:b86d15c6ba29	3793
Vanger	0:b86d15c6ba29	3794	/* clamp */
Vanger	0:b86d15c6ba29	3795	mp_clamp(c);
Vanger	0:b86d15c6ba29	3796
Vanger	0:b86d15c6ba29	3797	return res;
Vanger	0:b86d15c6ba29	3798	}
Vanger	0:b86d15c6ba29	3799
Vanger	0:b86d15c6ba29	3800	/* old number of used digits in c */
Vanger	0:b86d15c6ba29	3801	oldused = c->used;
Vanger	0:b86d15c6ba29	3802
Vanger	0:b86d15c6ba29	3803	/* sign always positive */
Vanger	0:b86d15c6ba29	3804	c->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	3805
Vanger	0:b86d15c6ba29	3806	/* source alias */
Vanger	0:b86d15c6ba29	3807	tmpa = a->dp;
Vanger	0:b86d15c6ba29	3808
Vanger	0:b86d15c6ba29	3809	/* destination alias */
Vanger	0:b86d15c6ba29	3810	tmpc = c->dp;
Vanger	0:b86d15c6ba29	3811
Vanger	0:b86d15c6ba29	3812	/* if a is positive */
Vanger	0:b86d15c6ba29	3813	if (a->sign == MP_ZPOS) {
Vanger	0:b86d15c6ba29	3814	/* add digit, after this we're propagating
Vanger	0:b86d15c6ba29	3815	* the carry.
Vanger	0:b86d15c6ba29	3816	*/
Vanger	0:b86d15c6ba29	3817	tmpc = tmpa++ + b;
Vanger	0:b86d15c6ba29	3818	mu = *tmpc >> DIGIT_BIT;
Vanger	0:b86d15c6ba29	3819	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	3820
Vanger	0:b86d15c6ba29	3821	/* now handle rest of the digits */
Vanger	0:b86d15c6ba29	3822	for (ix = 1; ix < a->used; ix++) {
Vanger	0:b86d15c6ba29	3823	tmpc = tmpa++ + mu;
Vanger	0:b86d15c6ba29	3824	mu = *tmpc >> DIGIT_BIT;
Vanger	0:b86d15c6ba29	3825	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	3826	}
Vanger	0:b86d15c6ba29	3827	/* set final carry */
Vanger	0:b86d15c6ba29	3828	if (mu != 0 && ix < c->alloc) {
Vanger	0:b86d15c6ba29	3829	ix++;
Vanger	0:b86d15c6ba29	3830	*tmpc++ = mu;
Vanger	0:b86d15c6ba29	3831	}
Vanger	0:b86d15c6ba29	3832
Vanger	0:b86d15c6ba29	3833	/* setup size */
Vanger	0:b86d15c6ba29	3834	c->used = a->used + 1;
Vanger	0:b86d15c6ba29	3835	} else {
Vanger	0:b86d15c6ba29	3836	/* a was negative and \|a\| < b */
Vanger	0:b86d15c6ba29	3837	c->used = 1;
Vanger	0:b86d15c6ba29	3838
Vanger	0:b86d15c6ba29	3839	/* the result is a single digit */
Vanger	0:b86d15c6ba29	3840	if (a->used == 1) {
Vanger	0:b86d15c6ba29	3841	*tmpc++ = b - a->dp[0];
Vanger	0:b86d15c6ba29	3842	} else {
Vanger	0:b86d15c6ba29	3843	*tmpc++ = b;
Vanger	0:b86d15c6ba29	3844	}
Vanger	0:b86d15c6ba29	3845
Vanger	0:b86d15c6ba29	3846	/* setup count so the clearing of oldused
Vanger	0:b86d15c6ba29	3847	* can fall through correctly
Vanger	0:b86d15c6ba29	3848	*/
Vanger	0:b86d15c6ba29	3849	ix = 1;
Vanger	0:b86d15c6ba29	3850	}
Vanger	0:b86d15c6ba29	3851
Vanger	0:b86d15c6ba29	3852	/* now zero to oldused */
Vanger	0:b86d15c6ba29	3853	while (ix++ < oldused) {
Vanger	0:b86d15c6ba29	3854	*tmpc++ = 0;
Vanger	0:b86d15c6ba29	3855	}
Vanger	0:b86d15c6ba29	3856	mp_clamp(c);
Vanger	0:b86d15c6ba29	3857
Vanger	0:b86d15c6ba29	3858	return MP_OKAY;
Vanger	0:b86d15c6ba29	3859	}
Vanger	0:b86d15c6ba29	3860
Vanger	0:b86d15c6ba29	3861
Vanger	0:b86d15c6ba29	3862	/* single digit subtraction */
Vanger	0:b86d15c6ba29	3863	int mp_sub_d (mp_int * a, mp_digit b, mp_int * c)
Vanger	0:b86d15c6ba29	3864	{
Vanger	0:b86d15c6ba29	3865	mp_digit tmpa, tmpc, mu;
Vanger	0:b86d15c6ba29	3866	int res, ix, oldused;
Vanger	0:b86d15c6ba29	3867
Vanger	0:b86d15c6ba29	3868	/* grow c as required */
Vanger	0:b86d15c6ba29	3869	if (c->alloc < a->used + 1) {
Vanger	0:b86d15c6ba29	3870	if ((res = mp_grow(c, a->used + 1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	3871	return res;
Vanger	0:b86d15c6ba29	3872	}
Vanger	0:b86d15c6ba29	3873	}
Vanger	0:b86d15c6ba29	3874
Vanger	0:b86d15c6ba29	3875	/* if a is negative just do an unsigned
Vanger	0:b86d15c6ba29	3876	* addition [with fudged signs]
Vanger	0:b86d15c6ba29	3877	*/
Vanger	0:b86d15c6ba29	3878	if (a->sign == MP_NEG) {
Vanger	0:b86d15c6ba29	3879	a->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	3880	res = mp_add_d(a, b, c);
Vanger	0:b86d15c6ba29	3881	a->sign = c->sign = MP_NEG;
Vanger	0:b86d15c6ba29	3882
Vanger	0:b86d15c6ba29	3883	/* clamp */
Vanger	0:b86d15c6ba29	3884	mp_clamp(c);
Vanger	0:b86d15c6ba29	3885
Vanger	0:b86d15c6ba29	3886	return res;
Vanger	0:b86d15c6ba29	3887	}
Vanger	0:b86d15c6ba29	3888
Vanger	0:b86d15c6ba29	3889	/* setup regs */
Vanger	0:b86d15c6ba29	3890	oldused = c->used;
Vanger	0:b86d15c6ba29	3891	tmpa = a->dp;
Vanger	0:b86d15c6ba29	3892	tmpc = c->dp;
Vanger	0:b86d15c6ba29	3893
Vanger	0:b86d15c6ba29	3894	/* if a <= b simply fix the single digit */
Vanger	0:b86d15c6ba29	3895	if ((a->used == 1 && a->dp[0] <= b) \|\| a->used == 0) {
Vanger	0:b86d15c6ba29	3896	if (a->used == 1) {
Vanger	0:b86d15c6ba29	3897	tmpc++ = b - tmpa;
Vanger	0:b86d15c6ba29	3898	} else {
Vanger	0:b86d15c6ba29	3899	*tmpc++ = b;
Vanger	0:b86d15c6ba29	3900	}
Vanger	0:b86d15c6ba29	3901	ix = 1;
Vanger	0:b86d15c6ba29	3902
Vanger	0:b86d15c6ba29	3903	/* negative/1digit */
Vanger	0:b86d15c6ba29	3904	c->sign = MP_NEG;
Vanger	0:b86d15c6ba29	3905	c->used = 1;
Vanger	0:b86d15c6ba29	3906	} else {
Vanger	0:b86d15c6ba29	3907	/* positive/size */
Vanger	0:b86d15c6ba29	3908	c->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	3909	c->used = a->used;
Vanger	0:b86d15c6ba29	3910
Vanger	0:b86d15c6ba29	3911	/* subtract first digit */
Vanger	0:b86d15c6ba29	3912	tmpc = tmpa++ - b;
Vanger	0:b86d15c6ba29	3913	mu = tmpc >> (sizeof(mp_digit) CHAR_BIT - 1);
Vanger	0:b86d15c6ba29	3914	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	3915
Vanger	0:b86d15c6ba29	3916	/* handle rest of the digits */
Vanger	0:b86d15c6ba29	3917	for (ix = 1; ix < a->used; ix++) {
Vanger	0:b86d15c6ba29	3918	tmpc = tmpa++ - mu;
Vanger	0:b86d15c6ba29	3919	mu = tmpc >> (sizeof(mp_digit) CHAR_BIT - 1);
Vanger	0:b86d15c6ba29	3920	*tmpc++ &= MP_MASK;
Vanger	0:b86d15c6ba29	3921	}
Vanger	0:b86d15c6ba29	3922	}
Vanger	0:b86d15c6ba29	3923
Vanger	0:b86d15c6ba29	3924	/* zero excess digits */
Vanger	0:b86d15c6ba29	3925	while (ix++ < oldused) {
Vanger	0:b86d15c6ba29	3926	*tmpc++ = 0;
Vanger	0:b86d15c6ba29	3927	}
Vanger	0:b86d15c6ba29	3928	mp_clamp(c);
Vanger	0:b86d15c6ba29	3929	return MP_OKAY;
Vanger	0:b86d15c6ba29	3930	}
Vanger	0:b86d15c6ba29	3931
Vanger	0:b86d15c6ba29	3932	#endif /* defined(HAVE_ECC) \|\| !defined(NO_PWDBASED) */
Vanger	0:b86d15c6ba29	3933
Vanger	0:b86d15c6ba29	3934
Vanger	0:b86d15c6ba29	3935	#if defined(CYASSL_KEY_GEN) \|\| defined(HAVE_COMP_KEY)
Vanger	0:b86d15c6ba29	3936
Vanger	0:b86d15c6ba29	3937	static const int lnz[16] = {
Vanger	0:b86d15c6ba29	3938	4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0
Vanger	0:b86d15c6ba29	3939	};
Vanger	0:b86d15c6ba29	3940
Vanger	0:b86d15c6ba29	3941	/* Counts the number of lsbs which are zero before the first zero bit */
Vanger	0:b86d15c6ba29	3942	int mp_cnt_lsb(mp_int *a)
Vanger	0:b86d15c6ba29	3943	{
Vanger	0:b86d15c6ba29	3944	int x;
Vanger	0:b86d15c6ba29	3945	mp_digit q, qq;
Vanger	0:b86d15c6ba29	3946
Vanger	0:b86d15c6ba29	3947	/* easy out */
Vanger	0:b86d15c6ba29	3948	if (mp_iszero(a) == 1) {
Vanger	0:b86d15c6ba29	3949	return 0;
Vanger	0:b86d15c6ba29	3950	}
Vanger	0:b86d15c6ba29	3951
Vanger	0:b86d15c6ba29	3952	/* scan lower digits until non-zero */
Vanger	0:b86d15c6ba29	3953	for (x = 0; x < a->used && a->dp[x] == 0; x++);
Vanger	0:b86d15c6ba29	3954	q = a->dp[x];
Vanger	0:b86d15c6ba29	3955	x *= DIGIT_BIT;
Vanger	0:b86d15c6ba29	3956
Vanger	0:b86d15c6ba29	3957	/* now scan this digit until a 1 is found */
Vanger	0:b86d15c6ba29	3958	if ((q & 1) == 0) {
Vanger	0:b86d15c6ba29	3959	do {
Vanger	0:b86d15c6ba29	3960	qq = q & 15;
Vanger	0:b86d15c6ba29	3961	x += lnz[qq];
Vanger	0:b86d15c6ba29	3962	q >>= 4;
Vanger	0:b86d15c6ba29	3963	} while (qq == 0);
Vanger	0:b86d15c6ba29	3964	}
Vanger	0:b86d15c6ba29	3965	return x;
Vanger	0:b86d15c6ba29	3966	}
Vanger	0:b86d15c6ba29	3967
Vanger	0:b86d15c6ba29	3968
Vanger	0:b86d15c6ba29	3969
Vanger	0:b86d15c6ba29	3970
Vanger	0:b86d15c6ba29	3971	static int s_is_power_of_two(mp_digit b, int *p)
Vanger	0:b86d15c6ba29	3972	{
Vanger	0:b86d15c6ba29	3973	int x;
Vanger	0:b86d15c6ba29	3974
Vanger	0:b86d15c6ba29	3975	/* fast return if no power of two */
Vanger	0:b86d15c6ba29	3976	if ((b==0) \|\| (b & (b-1))) {
Vanger	0:b86d15c6ba29	3977	return 0;
Vanger	0:b86d15c6ba29	3978	}
Vanger	0:b86d15c6ba29	3979
Vanger	0:b86d15c6ba29	3980	for (x = 0; x < DIGIT_BIT; x++) {
Vanger	0:b86d15c6ba29	3981	if (b == (((mp_digit)1)<<x)) {
Vanger	0:b86d15c6ba29	3982	*p = x;
Vanger	0:b86d15c6ba29	3983	return 1;
Vanger	0:b86d15c6ba29	3984	}
Vanger	0:b86d15c6ba29	3985	}
Vanger	0:b86d15c6ba29	3986	return 0;
Vanger	0:b86d15c6ba29	3987	}
Vanger	0:b86d15c6ba29	3988
Vanger	0:b86d15c6ba29	3989	/* single digit division (based on routine from MPI) */
Vanger	0:b86d15c6ba29	3990	static int mp_div_d (mp_int * a, mp_digit b, mp_int * c, mp_digit * d)
Vanger	0:b86d15c6ba29	3991	{
Vanger	0:b86d15c6ba29	3992	mp_int q;
Vanger	0:b86d15c6ba29	3993	mp_word w;
Vanger	0:b86d15c6ba29	3994	mp_digit t;
Vanger	0:b86d15c6ba29	3995	int res, ix;
Vanger	0:b86d15c6ba29	3996
Vanger	0:b86d15c6ba29	3997	/* cannot divide by zero */
Vanger	0:b86d15c6ba29	3998	if (b == 0) {
Vanger	0:b86d15c6ba29	3999	return MP_VAL;
Vanger	0:b86d15c6ba29	4000	}
Vanger	0:b86d15c6ba29	4001
Vanger	0:b86d15c6ba29	4002	/* quick outs */
Vanger	0:b86d15c6ba29	4003	if (b == 1 \|\| mp_iszero(a) == 1) {
Vanger	0:b86d15c6ba29	4004	if (d != NULL) {
Vanger	0:b86d15c6ba29	4005	*d = 0;
Vanger	0:b86d15c6ba29	4006	}
Vanger	0:b86d15c6ba29	4007	if (c != NULL) {
Vanger	0:b86d15c6ba29	4008	return mp_copy(a, c);
Vanger	0:b86d15c6ba29	4009	}
Vanger	0:b86d15c6ba29	4010	return MP_OKAY;
Vanger	0:b86d15c6ba29	4011	}
Vanger	0:b86d15c6ba29	4012
Vanger	0:b86d15c6ba29	4013	/* power of two ? */
Vanger	0:b86d15c6ba29	4014	if (s_is_power_of_two(b, &ix) == 1) {
Vanger	0:b86d15c6ba29	4015	if (d != NULL) {
Vanger	0:b86d15c6ba29	4016	*d = a->dp[0] & ((((mp_digit)1)<<ix) - 1);
Vanger	0:b86d15c6ba29	4017	}
Vanger	0:b86d15c6ba29	4018	if (c != NULL) {
Vanger	0:b86d15c6ba29	4019	return mp_div_2d(a, ix, c, NULL);
Vanger	0:b86d15c6ba29	4020	}
Vanger	0:b86d15c6ba29	4021	return MP_OKAY;
Vanger	0:b86d15c6ba29	4022	}
Vanger	0:b86d15c6ba29	4023
Vanger	0:b86d15c6ba29	4024	#ifdef BN_MP_DIV_3_C
Vanger	0:b86d15c6ba29	4025	/* three? */
Vanger	0:b86d15c6ba29	4026	if (b == 3) {
Vanger	0:b86d15c6ba29	4027	return mp_div_3(a, c, d);
Vanger	0:b86d15c6ba29	4028	}
Vanger	0:b86d15c6ba29	4029	#endif
Vanger	0:b86d15c6ba29	4030
Vanger	0:b86d15c6ba29	4031	/* no easy answer [c'est la vie]. Just division */
Vanger	0:b86d15c6ba29	4032	if ((res = mp_init_size(&q, a->used)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4033	return res;
Vanger	0:b86d15c6ba29	4034	}
Vanger	0:b86d15c6ba29	4035
Vanger	0:b86d15c6ba29	4036	q.used = a->used;
Vanger	0:b86d15c6ba29	4037	q.sign = a->sign;
Vanger	0:b86d15c6ba29	4038	w = 0;
Vanger	0:b86d15c6ba29	4039	for (ix = a->used - 1; ix >= 0; ix--) {
Vanger	0:b86d15c6ba29	4040	w = (w << ((mp_word)DIGIT_BIT)) \| ((mp_word)a->dp[ix]);
Vanger	0:b86d15c6ba29	4041
Vanger	0:b86d15c6ba29	4042	if (w >= b) {
Vanger	0:b86d15c6ba29	4043	t = (mp_digit)(w / b);
Vanger	0:b86d15c6ba29	4044	w -= ((mp_word)t) * ((mp_word)b);
Vanger	0:b86d15c6ba29	4045	} else {
Vanger	0:b86d15c6ba29	4046	t = 0;
Vanger	0:b86d15c6ba29	4047	}
Vanger	0:b86d15c6ba29	4048	q.dp[ix] = (mp_digit)t;
Vanger	0:b86d15c6ba29	4049	}
Vanger	0:b86d15c6ba29	4050
Vanger	0:b86d15c6ba29	4051	if (d != NULL) {
Vanger	0:b86d15c6ba29	4052	*d = (mp_digit)w;
Vanger	0:b86d15c6ba29	4053	}
Vanger	0:b86d15c6ba29	4054
Vanger	0:b86d15c6ba29	4055	if (c != NULL) {
Vanger	0:b86d15c6ba29	4056	mp_clamp(&q);
Vanger	0:b86d15c6ba29	4057	mp_exch(&q, c);
Vanger	0:b86d15c6ba29	4058	}
Vanger	0:b86d15c6ba29	4059	mp_clear(&q);
Vanger	0:b86d15c6ba29	4060
Vanger	0:b86d15c6ba29	4061	return res;
Vanger	0:b86d15c6ba29	4062	}
Vanger	0:b86d15c6ba29	4063
Vanger	0:b86d15c6ba29	4064
Vanger	0:b86d15c6ba29	4065	int mp_mod_d (mp_int * a, mp_digit b, mp_digit * c)
Vanger	0:b86d15c6ba29	4066	{
Vanger	0:b86d15c6ba29	4067	return mp_div_d(a, b, NULL, c);
Vanger	0:b86d15c6ba29	4068	}
Vanger	0:b86d15c6ba29	4069
Vanger	0:b86d15c6ba29	4070	#endif /* defined(CYASSL_KEY_GEN) \|\| defined(HAVE_COMP_KEY) */
Vanger	0:b86d15c6ba29	4071
Vanger	0:b86d15c6ba29	4072	#ifdef CYASSL_KEY_GEN
Vanger	0:b86d15c6ba29	4073
Vanger	0:b86d15c6ba29	4074	const mp_digit ltm_prime_tab[] = {
Vanger	0:b86d15c6ba29	4075	0x0002, 0x0003, 0x0005, 0x0007, 0x000B, 0x000D, 0x0011, 0x0013,
Vanger	0:b86d15c6ba29	4076	0x0017, 0x001D, 0x001F, 0x0025, 0x0029, 0x002B, 0x002F, 0x0035,
Vanger	0:b86d15c6ba29	4077	0x003B, 0x003D, 0x0043, 0x0047, 0x0049, 0x004F, 0x0053, 0x0059,
Vanger	0:b86d15c6ba29	4078	0x0061, 0x0065, 0x0067, 0x006B, 0x006D, 0x0071, 0x007F,
Vanger	0:b86d15c6ba29	4079	#ifndef MP_8BIT
Vanger	0:b86d15c6ba29	4080	0x0083,
Vanger	0:b86d15c6ba29	4081	0x0089, 0x008B, 0x0095, 0x0097, 0x009D, 0x00A3, 0x00A7, 0x00AD,
Vanger	0:b86d15c6ba29	4082	0x00B3, 0x00B5, 0x00BF, 0x00C1, 0x00C5, 0x00C7, 0x00D3, 0x00DF,
Vanger	0:b86d15c6ba29	4083	0x00E3, 0x00E5, 0x00E9, 0x00EF, 0x00F1, 0x00FB, 0x0101, 0x0107,
Vanger	0:b86d15c6ba29	4084	0x010D, 0x010F, 0x0115, 0x0119, 0x011B, 0x0125, 0x0133, 0x0137,
Vanger	0:b86d15c6ba29	4085
Vanger	0:b86d15c6ba29	4086	0x0139, 0x013D, 0x014B, 0x0151, 0x015B, 0x015D, 0x0161, 0x0167,
Vanger	0:b86d15c6ba29	4087	0x016F, 0x0175, 0x017B, 0x017F, 0x0185, 0x018D, 0x0191, 0x0199,
Vanger	0:b86d15c6ba29	4088	0x01A3, 0x01A5, 0x01AF, 0x01B1, 0x01B7, 0x01BB, 0x01C1, 0x01C9,
Vanger	0:b86d15c6ba29	4089	0x01CD, 0x01CF, 0x01D3, 0x01DF, 0x01E7, 0x01EB, 0x01F3, 0x01F7,
Vanger	0:b86d15c6ba29	4090	0x01FD, 0x0209, 0x020B, 0x021D, 0x0223, 0x022D, 0x0233, 0x0239,
Vanger	0:b86d15c6ba29	4091	0x023B, 0x0241, 0x024B, 0x0251, 0x0257, 0x0259, 0x025F, 0x0265,
Vanger	0:b86d15c6ba29	4092	0x0269, 0x026B, 0x0277, 0x0281, 0x0283, 0x0287, 0x028D, 0x0293,
Vanger	0:b86d15c6ba29	4093	0x0295, 0x02A1, 0x02A5, 0x02AB, 0x02B3, 0x02BD, 0x02C5, 0x02CF,
Vanger	0:b86d15c6ba29	4094
Vanger	0:b86d15c6ba29	4095	0x02D7, 0x02DD, 0x02E3, 0x02E7, 0x02EF, 0x02F5, 0x02F9, 0x0301,
Vanger	0:b86d15c6ba29	4096	0x0305, 0x0313, 0x031D, 0x0329, 0x032B, 0x0335, 0x0337, 0x033B,
Vanger	0:b86d15c6ba29	4097	0x033D, 0x0347, 0x0355, 0x0359, 0x035B, 0x035F, 0x036D, 0x0371,
Vanger	0:b86d15c6ba29	4098	0x0373, 0x0377, 0x038B, 0x038F, 0x0397, 0x03A1, 0x03A9, 0x03AD,
Vanger	0:b86d15c6ba29	4099	0x03B3, 0x03B9, 0x03C7, 0x03CB, 0x03D1, 0x03D7, 0x03DF, 0x03E5,
Vanger	0:b86d15c6ba29	4100	0x03F1, 0x03F5, 0x03FB, 0x03FD, 0x0407, 0x0409, 0x040F, 0x0419,
Vanger	0:b86d15c6ba29	4101	0x041B, 0x0425, 0x0427, 0x042D, 0x043F, 0x0443, 0x0445, 0x0449,
Vanger	0:b86d15c6ba29	4102	0x044F, 0x0455, 0x045D, 0x0463, 0x0469, 0x047F, 0x0481, 0x048B,
Vanger	0:b86d15c6ba29	4103
Vanger	0:b86d15c6ba29	4104	0x0493, 0x049D, 0x04A3, 0x04A9, 0x04B1, 0x04BD, 0x04C1, 0x04C7,
Vanger	0:b86d15c6ba29	4105	0x04CD, 0x04CF, 0x04D5, 0x04E1, 0x04EB, 0x04FD, 0x04FF, 0x0503,
Vanger	0:b86d15c6ba29	4106	0x0509, 0x050B, 0x0511, 0x0515, 0x0517, 0x051B, 0x0527, 0x0529,
Vanger	0:b86d15c6ba29	4107	0x052F, 0x0551, 0x0557, 0x055D, 0x0565, 0x0577, 0x0581, 0x058F,
Vanger	0:b86d15c6ba29	4108	0x0593, 0x0595, 0x0599, 0x059F, 0x05A7, 0x05AB, 0x05AD, 0x05B3,
Vanger	0:b86d15c6ba29	4109	0x05BF, 0x05C9, 0x05CB, 0x05CF, 0x05D1, 0x05D5, 0x05DB, 0x05E7,
Vanger	0:b86d15c6ba29	4110	0x05F3, 0x05FB, 0x0607, 0x060D, 0x0611, 0x0617, 0x061F, 0x0623,
Vanger	0:b86d15c6ba29	4111	0x062B, 0x062F, 0x063D, 0x0641, 0x0647, 0x0649, 0x064D, 0x0653
Vanger	0:b86d15c6ba29	4112	#endif
Vanger	0:b86d15c6ba29	4113	};
Vanger	0:b86d15c6ba29	4114
Vanger	0:b86d15c6ba29	4115
Vanger	0:b86d15c6ba29	4116	/* Miller-Rabin test of "a" to the base of "b" as described in
Vanger	0:b86d15c6ba29	4117	* HAC pp. 139 Algorithm 4.24
Vanger	0:b86d15c6ba29	4118	*
Vanger	0:b86d15c6ba29	4119	* Sets result to 0 if definitely composite or 1 if probably prime.
Vanger	0:b86d15c6ba29	4120	* Randomly the chance of error is no more than 1/4 and often
Vanger	0:b86d15c6ba29	4121	* very much lower.
Vanger	0:b86d15c6ba29	4122	*/
Vanger	0:b86d15c6ba29	4123	static int mp_prime_miller_rabin (mp_int * a, mp_int * b, int *result)
Vanger	0:b86d15c6ba29	4124	{
Vanger	0:b86d15c6ba29	4125	mp_int n1, y, r;
Vanger	0:b86d15c6ba29	4126	int s, j, err;
Vanger	0:b86d15c6ba29	4127
Vanger	0:b86d15c6ba29	4128	/* default */
Vanger	0:b86d15c6ba29	4129	*result = MP_NO;
Vanger	0:b86d15c6ba29	4130
Vanger	0:b86d15c6ba29	4131	/* ensure b > 1 */
Vanger	0:b86d15c6ba29	4132	if (mp_cmp_d(b, 1) != MP_GT) {
Vanger	0:b86d15c6ba29	4133	return MP_VAL;
Vanger	0:b86d15c6ba29	4134	}
Vanger	0:b86d15c6ba29	4135
Vanger	0:b86d15c6ba29	4136	/* get n1 = a - 1 */
Vanger	0:b86d15c6ba29	4137	if ((err = mp_init_copy (&n1, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4138	return err;
Vanger	0:b86d15c6ba29	4139	}
Vanger	0:b86d15c6ba29	4140	if ((err = mp_sub_d (&n1, 1, &n1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4141	goto LBL_N1;
Vanger	0:b86d15c6ba29	4142	}
Vanger	0:b86d15c6ba29	4143
Vanger	0:b86d15c6ba29	4144	/* set 2*s r = n1 */
Vanger	0:b86d15c6ba29	4145	if ((err = mp_init_copy (&r, &n1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4146	goto LBL_N1;
Vanger	0:b86d15c6ba29	4147	}
Vanger	0:b86d15c6ba29	4148
Vanger	0:b86d15c6ba29	4149	/* count the number of least significant bits
Vanger	0:b86d15c6ba29	4150	* which are zero
Vanger	0:b86d15c6ba29	4151	*/
Vanger	0:b86d15c6ba29	4152	s = mp_cnt_lsb(&r);
Vanger	0:b86d15c6ba29	4153
Vanger	0:b86d15c6ba29	4154	/* now divide n - 1 by 2*s /
Vanger	0:b86d15c6ba29	4155	if ((err = mp_div_2d (&r, s, &r, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4156	goto LBL_R;
Vanger	0:b86d15c6ba29	4157	}
Vanger	0:b86d15c6ba29	4158
Vanger	0:b86d15c6ba29	4159	/* compute y = b*r mod a /
Vanger	0:b86d15c6ba29	4160	if ((err = mp_init (&y)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4161	goto LBL_R;
Vanger	0:b86d15c6ba29	4162	}
Vanger	0:b86d15c6ba29	4163	if ((err = mp_exptmod (b, &r, a, &y)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4164	goto LBL_Y;
Vanger	0:b86d15c6ba29	4165	}
Vanger	0:b86d15c6ba29	4166
Vanger	0:b86d15c6ba29	4167	/* if y != 1 and y != n1 do */
Vanger	0:b86d15c6ba29	4168	if (mp_cmp_d (&y, 1) != MP_EQ && mp_cmp (&y, &n1) != MP_EQ) {
Vanger	0:b86d15c6ba29	4169	j = 1;
Vanger	0:b86d15c6ba29	4170	/* while j <= s-1 and y != n1 */
Vanger	0:b86d15c6ba29	4171	while ((j <= (s - 1)) && mp_cmp (&y, &n1) != MP_EQ) {
Vanger	0:b86d15c6ba29	4172	if ((err = mp_sqrmod (&y, a, &y)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4173	goto LBL_Y;
Vanger	0:b86d15c6ba29	4174	}
Vanger	0:b86d15c6ba29	4175
Vanger	0:b86d15c6ba29	4176	/* if y == 1 then composite */
Vanger	0:b86d15c6ba29	4177	if (mp_cmp_d (&y, 1) == MP_EQ) {
Vanger	0:b86d15c6ba29	4178	goto LBL_Y;
Vanger	0:b86d15c6ba29	4179	}
Vanger	0:b86d15c6ba29	4180
Vanger	0:b86d15c6ba29	4181	++j;
Vanger	0:b86d15c6ba29	4182	}
Vanger	0:b86d15c6ba29	4183
Vanger	0:b86d15c6ba29	4184	/* if y != n1 then composite */
Vanger	0:b86d15c6ba29	4185	if (mp_cmp (&y, &n1) != MP_EQ) {
Vanger	0:b86d15c6ba29	4186	goto LBL_Y;
Vanger	0:b86d15c6ba29	4187	}
Vanger	0:b86d15c6ba29	4188	}
Vanger	0:b86d15c6ba29	4189
Vanger	0:b86d15c6ba29	4190	/* probably prime now */
Vanger	0:b86d15c6ba29	4191	*result = MP_YES;
Vanger	0:b86d15c6ba29	4192	LBL_Y:mp_clear (&y);
Vanger	0:b86d15c6ba29	4193	LBL_R:mp_clear (&r);
Vanger	0:b86d15c6ba29	4194	LBL_N1:mp_clear (&n1);
Vanger	0:b86d15c6ba29	4195	return err;
Vanger	0:b86d15c6ba29	4196	}
Vanger	0:b86d15c6ba29	4197
Vanger	0:b86d15c6ba29	4198
Vanger	0:b86d15c6ba29	4199	/* determines if an integers is divisible by one
Vanger	0:b86d15c6ba29	4200	* of the first PRIME_SIZE primes or not
Vanger	0:b86d15c6ba29	4201	*
Vanger	0:b86d15c6ba29	4202	* sets result to 0 if not, 1 if yes
Vanger	0:b86d15c6ba29	4203	*/
Vanger	0:b86d15c6ba29	4204	static int mp_prime_is_divisible (mp_int * a, int *result)
Vanger	0:b86d15c6ba29	4205	{
Vanger	0:b86d15c6ba29	4206	int err, ix;
Vanger	0:b86d15c6ba29	4207	mp_digit res;
Vanger	0:b86d15c6ba29	4208
Vanger	0:b86d15c6ba29	4209	/* default to not */
Vanger	0:b86d15c6ba29	4210	*result = MP_NO;
Vanger	0:b86d15c6ba29	4211
Vanger	0:b86d15c6ba29	4212	for (ix = 0; ix < PRIME_SIZE; ix++) {
Vanger	0:b86d15c6ba29	4213	/* what is a mod LBL_prime_tab[ix] */
Vanger	0:b86d15c6ba29	4214	if ((err = mp_mod_d (a, ltm_prime_tab[ix], &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4215	return err;
Vanger	0:b86d15c6ba29	4216	}
Vanger	0:b86d15c6ba29	4217
Vanger	0:b86d15c6ba29	4218	/* is the residue zero? */
Vanger	0:b86d15c6ba29	4219	if (res == 0) {
Vanger	0:b86d15c6ba29	4220	*result = MP_YES;
Vanger	0:b86d15c6ba29	4221	return MP_OKAY;
Vanger	0:b86d15c6ba29	4222	}
Vanger	0:b86d15c6ba29	4223	}
Vanger	0:b86d15c6ba29	4224
Vanger	0:b86d15c6ba29	4225	return MP_OKAY;
Vanger	0:b86d15c6ba29	4226	}
Vanger	0:b86d15c6ba29	4227
Vanger	0:b86d15c6ba29	4228
Vanger	0:b86d15c6ba29	4229	/*
Vanger	0:b86d15c6ba29	4230	* Sets result to 1 if probably prime, 0 otherwise
Vanger	0:b86d15c6ba29	4231	*/
Vanger	0:b86d15c6ba29	4232	int mp_prime_is_prime (mp_int * a, int t, int *result)
Vanger	0:b86d15c6ba29	4233	{
Vanger	0:b86d15c6ba29	4234	mp_int b;
Vanger	0:b86d15c6ba29	4235	int ix, err, res;
Vanger	0:b86d15c6ba29	4236
Vanger	0:b86d15c6ba29	4237	/* default to no */
Vanger	0:b86d15c6ba29	4238	*result = MP_NO;
Vanger	0:b86d15c6ba29	4239
Vanger	0:b86d15c6ba29	4240	/* valid value of t? */
Vanger	0:b86d15c6ba29	4241	if (t <= 0 \|\| t > PRIME_SIZE) {
Vanger	0:b86d15c6ba29	4242	return MP_VAL;
Vanger	0:b86d15c6ba29	4243	}
Vanger	0:b86d15c6ba29	4244
Vanger	0:b86d15c6ba29	4245	/* is the input equal to one of the primes in the table? */
Vanger	0:b86d15c6ba29	4246	for (ix = 0; ix < PRIME_SIZE; ix++) {
Vanger	0:b86d15c6ba29	4247	if (mp_cmp_d(a, ltm_prime_tab[ix]) == MP_EQ) {
Vanger	0:b86d15c6ba29	4248	*result = 1;
Vanger	0:b86d15c6ba29	4249	return MP_OKAY;
Vanger	0:b86d15c6ba29	4250	}
Vanger	0:b86d15c6ba29	4251	}
Vanger	0:b86d15c6ba29	4252
Vanger	0:b86d15c6ba29	4253	/* first perform trial division */
Vanger	0:b86d15c6ba29	4254	if ((err = mp_prime_is_divisible (a, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4255	return err;
Vanger	0:b86d15c6ba29	4256	}
Vanger	0:b86d15c6ba29	4257
Vanger	0:b86d15c6ba29	4258	/* return if it was trivially divisible */
Vanger	0:b86d15c6ba29	4259	if (res == MP_YES) {
Vanger	0:b86d15c6ba29	4260	return MP_OKAY;
Vanger	0:b86d15c6ba29	4261	}
Vanger	0:b86d15c6ba29	4262
Vanger	0:b86d15c6ba29	4263	/* now perform the miller-rabin rounds */
Vanger	0:b86d15c6ba29	4264	if ((err = mp_init (&b)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4265	return err;
Vanger	0:b86d15c6ba29	4266	}
Vanger	0:b86d15c6ba29	4267
Vanger	0:b86d15c6ba29	4268	for (ix = 0; ix < t; ix++) {
Vanger	0:b86d15c6ba29	4269	/* set the prime */
Vanger	0:b86d15c6ba29	4270	mp_set (&b, ltm_prime_tab[ix]);
Vanger	0:b86d15c6ba29	4271
Vanger	0:b86d15c6ba29	4272	if ((err = mp_prime_miller_rabin (a, &b, &res)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4273	goto LBL_B;
Vanger	0:b86d15c6ba29	4274	}
Vanger	0:b86d15c6ba29	4275
Vanger	0:b86d15c6ba29	4276	if (res == MP_NO) {
Vanger	0:b86d15c6ba29	4277	goto LBL_B;
Vanger	0:b86d15c6ba29	4278	}
Vanger	0:b86d15c6ba29	4279	}
Vanger	0:b86d15c6ba29	4280
Vanger	0:b86d15c6ba29	4281	/* passed the test */
Vanger	0:b86d15c6ba29	4282	*result = MP_YES;
Vanger	0:b86d15c6ba29	4283	LBL_B:mp_clear (&b);
Vanger	0:b86d15c6ba29	4284	return err;
Vanger	0:b86d15c6ba29	4285	}
Vanger	0:b86d15c6ba29	4286
Vanger	0:b86d15c6ba29	4287
Vanger	0:b86d15c6ba29	4288	/* computes least common multiple as \|ab\|/(a, b) /
Vanger	0:b86d15c6ba29	4289	int mp_lcm (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	4290	{
Vanger	0:b86d15c6ba29	4291	int res;
Vanger	0:b86d15c6ba29	4292	mp_int t1, t2;
Vanger	0:b86d15c6ba29	4293
Vanger	0:b86d15c6ba29	4294
Vanger	0:b86d15c6ba29	4295	if ((res = mp_init_multi (&t1, &t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4296	return res;
Vanger	0:b86d15c6ba29	4297	}
Vanger	0:b86d15c6ba29	4298
Vanger	0:b86d15c6ba29	4299	/* t1 = get the GCD of the two inputs */
Vanger	0:b86d15c6ba29	4300	if ((res = mp_gcd (a, b, &t1)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4301	goto LBL_T;
Vanger	0:b86d15c6ba29	4302	}
Vanger	0:b86d15c6ba29	4303
Vanger	0:b86d15c6ba29	4304	/* divide the smallest by the GCD */
Vanger	0:b86d15c6ba29	4305	if (mp_cmp_mag(a, b) == MP_LT) {
Vanger	0:b86d15c6ba29	4306	/* store quotient in t2 such that t2 * b is the LCM */
Vanger	0:b86d15c6ba29	4307	if ((res = mp_div(a, &t1, &t2, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4308	goto LBL_T;
Vanger	0:b86d15c6ba29	4309	}
Vanger	0:b86d15c6ba29	4310	res = mp_mul(b, &t2, c);
Vanger	0:b86d15c6ba29	4311	} else {
Vanger	0:b86d15c6ba29	4312	/* store quotient in t2 such that t2 * a is the LCM */
Vanger	0:b86d15c6ba29	4313	if ((res = mp_div(b, &t1, &t2, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4314	goto LBL_T;
Vanger	0:b86d15c6ba29	4315	}
Vanger	0:b86d15c6ba29	4316	res = mp_mul(a, &t2, c);
Vanger	0:b86d15c6ba29	4317	}
Vanger	0:b86d15c6ba29	4318
Vanger	0:b86d15c6ba29	4319	/* fix the sign to positive */
Vanger	0:b86d15c6ba29	4320	c->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	4321
Vanger	0:b86d15c6ba29	4322	LBL_T:
Vanger	0:b86d15c6ba29	4323	mp_clear(&t1);
Vanger	0:b86d15c6ba29	4324	mp_clear(&t2);
Vanger	0:b86d15c6ba29	4325	return res;
Vanger	0:b86d15c6ba29	4326	}
Vanger	0:b86d15c6ba29	4327
Vanger	0:b86d15c6ba29	4328
Vanger	0:b86d15c6ba29	4329
Vanger	0:b86d15c6ba29	4330	/* Greatest Common Divisor using the binary method */
Vanger	0:b86d15c6ba29	4331	int mp_gcd (mp_int * a, mp_int * b, mp_int * c)
Vanger	0:b86d15c6ba29	4332	{
Vanger	0:b86d15c6ba29	4333	mp_int u, v;
Vanger	0:b86d15c6ba29	4334	int k, u_lsb, v_lsb, res;
Vanger	0:b86d15c6ba29	4335
Vanger	0:b86d15c6ba29	4336	/* either zero than gcd is the largest */
Vanger	0:b86d15c6ba29	4337	if (mp_iszero (a) == MP_YES) {
Vanger	0:b86d15c6ba29	4338	return mp_abs (b, c);
Vanger	0:b86d15c6ba29	4339	}
Vanger	0:b86d15c6ba29	4340	if (mp_iszero (b) == MP_YES) {
Vanger	0:b86d15c6ba29	4341	return mp_abs (a, c);
Vanger	0:b86d15c6ba29	4342	}
Vanger	0:b86d15c6ba29	4343
Vanger	0:b86d15c6ba29	4344	/* get copies of a and b we can modify */
Vanger	0:b86d15c6ba29	4345	if ((res = mp_init_copy (&u, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4346	return res;
Vanger	0:b86d15c6ba29	4347	}
Vanger	0:b86d15c6ba29	4348
Vanger	0:b86d15c6ba29	4349	if ((res = mp_init_copy (&v, b)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4350	goto LBL_U;
Vanger	0:b86d15c6ba29	4351	}
Vanger	0:b86d15c6ba29	4352
Vanger	0:b86d15c6ba29	4353	/* must be positive for the remainder of the algorithm */
Vanger	0:b86d15c6ba29	4354	u.sign = v.sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	4355
Vanger	0:b86d15c6ba29	4356	/* B1. Find the common power of two for u and v */
Vanger	0:b86d15c6ba29	4357	u_lsb = mp_cnt_lsb(&u);
Vanger	0:b86d15c6ba29	4358	v_lsb = mp_cnt_lsb(&v);
Vanger	0:b86d15c6ba29	4359	k = MIN(u_lsb, v_lsb);
Vanger	0:b86d15c6ba29	4360
Vanger	0:b86d15c6ba29	4361	if (k > 0) {
Vanger	0:b86d15c6ba29	4362	/* divide the power of two out */
Vanger	0:b86d15c6ba29	4363	if ((res = mp_div_2d(&u, k, &u, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4364	goto LBL_V;
Vanger	0:b86d15c6ba29	4365	}
Vanger	0:b86d15c6ba29	4366
Vanger	0:b86d15c6ba29	4367	if ((res = mp_div_2d(&v, k, &v, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4368	goto LBL_V;
Vanger	0:b86d15c6ba29	4369	}
Vanger	0:b86d15c6ba29	4370	}
Vanger	0:b86d15c6ba29	4371
Vanger	0:b86d15c6ba29	4372	/* divide any remaining factors of two out */
Vanger	0:b86d15c6ba29	4373	if (u_lsb != k) {
Vanger	0:b86d15c6ba29	4374	if ((res = mp_div_2d(&u, u_lsb - k, &u, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4375	goto LBL_V;
Vanger	0:b86d15c6ba29	4376	}
Vanger	0:b86d15c6ba29	4377	}
Vanger	0:b86d15c6ba29	4378
Vanger	0:b86d15c6ba29	4379	if (v_lsb != k) {
Vanger	0:b86d15c6ba29	4380	if ((res = mp_div_2d(&v, v_lsb - k, &v, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4381	goto LBL_V;
Vanger	0:b86d15c6ba29	4382	}
Vanger	0:b86d15c6ba29	4383	}
Vanger	0:b86d15c6ba29	4384
Vanger	0:b86d15c6ba29	4385	while (mp_iszero(&v) == 0) {
Vanger	0:b86d15c6ba29	4386	/* make sure v is the largest */
Vanger	0:b86d15c6ba29	4387	if (mp_cmp_mag(&u, &v) == MP_GT) {
Vanger	0:b86d15c6ba29	4388	/* swap u and v to make sure v is >= u */
Vanger	0:b86d15c6ba29	4389	mp_exch(&u, &v);
Vanger	0:b86d15c6ba29	4390	}
Vanger	0:b86d15c6ba29	4391
Vanger	0:b86d15c6ba29	4392	/* subtract smallest from largest */
Vanger	0:b86d15c6ba29	4393	if ((res = s_mp_sub(&v, &u, &v)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4394	goto LBL_V;
Vanger	0:b86d15c6ba29	4395	}
Vanger	0:b86d15c6ba29	4396
Vanger	0:b86d15c6ba29	4397	/* Divide out all factors of two */
Vanger	0:b86d15c6ba29	4398	if ((res = mp_div_2d(&v, mp_cnt_lsb(&v), &v, NULL)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4399	goto LBL_V;
Vanger	0:b86d15c6ba29	4400	}
Vanger	0:b86d15c6ba29	4401	}
Vanger	0:b86d15c6ba29	4402
Vanger	0:b86d15c6ba29	4403	/* multiply by 2*k which we divided out at the beginning /
Vanger	0:b86d15c6ba29	4404	if ((res = mp_mul_2d (&u, k, c)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4405	goto LBL_V;
Vanger	0:b86d15c6ba29	4406	}
Vanger	0:b86d15c6ba29	4407	c->sign = MP_ZPOS;
Vanger	0:b86d15c6ba29	4408	res = MP_OKAY;
Vanger	0:b86d15c6ba29	4409	LBL_V:mp_clear (&u);
Vanger	0:b86d15c6ba29	4410	LBL_U:mp_clear (&v);
Vanger	0:b86d15c6ba29	4411	return res;
Vanger	0:b86d15c6ba29	4412	}
Vanger	0:b86d15c6ba29	4413
Vanger	0:b86d15c6ba29	4414
Vanger	0:b86d15c6ba29	4415
Vanger	0:b86d15c6ba29	4416	#endif /* CYASSL_KEY_GEN */
Vanger	0:b86d15c6ba29	4417
Vanger	0:b86d15c6ba29	4418
Vanger	0:b86d15c6ba29	4419	#ifdef HAVE_ECC
Vanger	0:b86d15c6ba29	4420
Vanger	0:b86d15c6ba29	4421	/* chars used in radix conversions */
Vanger	0:b86d15c6ba29	4422	const char *mp_s_rmap = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/";
Vanger	0:b86d15c6ba29	4423
Vanger	0:b86d15c6ba29	4424	/* read a string [ASCII] in a given radix */
Vanger	0:b86d15c6ba29	4425	int mp_read_radix (mp_int * a, const char *str, int radix)
Vanger	0:b86d15c6ba29	4426	{
Vanger	0:b86d15c6ba29	4427	int y, res, neg;
Vanger	0:b86d15c6ba29	4428	char ch;
Vanger	0:b86d15c6ba29	4429
Vanger	0:b86d15c6ba29	4430	/* zero the digit bignum */
Vanger	0:b86d15c6ba29	4431	mp_zero(a);
Vanger	0:b86d15c6ba29	4432
Vanger	0:b86d15c6ba29	4433	/* make sure the radix is ok */
Vanger	0:b86d15c6ba29	4434	if (radix < 2 \|\| radix > 64) {
Vanger	0:b86d15c6ba29	4435	return MP_VAL;
Vanger	0:b86d15c6ba29	4436	}
Vanger	0:b86d15c6ba29	4437
Vanger	0:b86d15c6ba29	4438	/* if the leading digit is a
Vanger	0:b86d15c6ba29	4439	* minus set the sign to negative.
Vanger	0:b86d15c6ba29	4440	*/
Vanger	0:b86d15c6ba29	4441	if (*str == '-') {
Vanger	0:b86d15c6ba29	4442	++str;
Vanger	0:b86d15c6ba29	4443	neg = MP_NEG;
Vanger	0:b86d15c6ba29	4444	} else {
Vanger	0:b86d15c6ba29	4445	neg = MP_ZPOS;
Vanger	0:b86d15c6ba29	4446	}
Vanger	0:b86d15c6ba29	4447
Vanger	0:b86d15c6ba29	4448	/* set the integer to the default of zero */
Vanger	0:b86d15c6ba29	4449	mp_zero (a);
Vanger	0:b86d15c6ba29	4450
Vanger	0:b86d15c6ba29	4451	/* process each digit of the string */
Vanger	0:b86d15c6ba29	4452	while (*str) {
Vanger	0:b86d15c6ba29	4453	/* if the radix < 36 the conversion is case insensitive
Vanger	0:b86d15c6ba29	4454	* this allows numbers like 1AB and 1ab to represent the same value
Vanger	0:b86d15c6ba29	4455	* [e.g. in hex]
Vanger	0:b86d15c6ba29	4456	*/
Vanger	0:b86d15c6ba29	4457	ch = (char) ((radix < 36) ? XTOUPPER(str) : str);
Vanger	0:b86d15c6ba29	4458	for (y = 0; y < 64; y++) {
Vanger	0:b86d15c6ba29	4459	if (ch == mp_s_rmap[y]) {
Vanger	0:b86d15c6ba29	4460	break;
Vanger	0:b86d15c6ba29	4461	}
Vanger	0:b86d15c6ba29	4462	}
Vanger	0:b86d15c6ba29	4463
Vanger	0:b86d15c6ba29	4464	/* if the char was found in the map
Vanger	0:b86d15c6ba29	4465	* and is less than the given radix add it
Vanger	0:b86d15c6ba29	4466	* to the number, otherwise exit the loop.
Vanger	0:b86d15c6ba29	4467	*/
Vanger	0:b86d15c6ba29	4468	if (y < radix) {
Vanger	0:b86d15c6ba29	4469	if ((res = mp_mul_d (a, (mp_digit) radix, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4470	return res;
Vanger	0:b86d15c6ba29	4471	}
Vanger	0:b86d15c6ba29	4472	if ((res = mp_add_d (a, (mp_digit) y, a)) != MP_OKAY) {
Vanger	0:b86d15c6ba29	4473	return res;
Vanger	0:b86d15c6ba29	4474	}
Vanger	0:b86d15c6ba29	4475	} else {
Vanger	0:b86d15c6ba29	4476	break;
Vanger	0:b86d15c6ba29	4477	}
Vanger	0:b86d15c6ba29	4478	++str;
Vanger	0:b86d15c6ba29	4479	}
Vanger	0:b86d15c6ba29	4480
Vanger	0:b86d15c6ba29	4481	/* set the sign only if a != 0 */
Vanger	0:b86d15c6ba29	4482	if (mp_iszero(a) != 1) {
Vanger	0:b86d15c6ba29	4483	a->sign = neg;
Vanger	0:b86d15c6ba29	4484	}
Vanger	0:b86d15c6ba29	4485	return MP_OKAY;
Vanger	0:b86d15c6ba29	4486	}
Vanger	0:b86d15c6ba29	4487
Vanger	0:b86d15c6ba29	4488	#endif /* HAVE_ECC */
Vanger	0:b86d15c6ba29	4489
Vanger	0:b86d15c6ba29	4490	#endif /* USE_FAST_MATH */
Vanger	0:b86d15c6ba29	4491
Vanger	0:b86d15c6ba29	4492	#endif /* NO_BIG_INT */

Repository toolbox

Export to desktop IDE

Repository details

Type:	Library
Created:	27 Mar 2015
Imports:	27
Forks:	0
Commits:	7
Dependents:	4
Dependencies:	0
Followers:	87

ctaocrypt/src/integer.c@6:cf58d49e1a86, 2015-03-23 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning