Xuyi Wang / wolfSSL

Important changes to repositories hosted on mbed.com

Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.

To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.

It is also possible to export all your personal repositories from the account settings page.

Dependents:   OS

wolfcrypt/src/fe_operations.c@16:048e5e270a58, 2019-11-19 (annotated)

Committer:
sPymbed
Date:
Tue Nov 19 14:32:16 2019 +0000
Revision:
16:048e5e270a58
Parent:
15:117db924cf7c 
working ssl

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 15:117db924cf7c 1 /* fe_operations.c
wolfSSL 15:117db924cf7c 2 *
wolfSSL 15:117db924cf7c 3 * Copyright (C) 2006-2017 wolfSSL Inc.
wolfSSL 15:117db924cf7c 4 *
wolfSSL 15:117db924cf7c 5 * This file is part of wolfSSL.
wolfSSL 15:117db924cf7c 6 *
wolfSSL 15:117db924cf7c 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 15:117db924cf7c 8 * it under the terms of the GNU General Public License as published by
wolfSSL 15:117db924cf7c 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 15:117db924cf7c 10 * (at your option) any later version.
wolfSSL 15:117db924cf7c 11 *
wolfSSL 15:117db924cf7c 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 15:117db924cf7c 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 15:117db924cf7c 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 15:117db924cf7c 15 * GNU General Public License for more details.
wolfSSL 15:117db924cf7c 16 *
wolfSSL 15:117db924cf7c 17 * You should have received a copy of the GNU General Public License
wolfSSL 15:117db924cf7c 18 * along with this program; if not, write to the Free Software
wolfSSL 15:117db924cf7c 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 15:117db924cf7c 20 */
wolfSSL 15:117db924cf7c 21
wolfSSL 15:117db924cf7c 22
wolfSSL 15:117db924cf7c 23 /* Based On Daniel J Bernstein's curve25519 Public Domain ref10 work. */
wolfSSL 15:117db924cf7c 24
wolfSSL 15:117db924cf7c 25 #ifdef HAVE_CONFIG_H
wolfSSL 15:117db924cf7c 26 #include <config.h>
wolfSSL 15:117db924cf7c 27 #endif
wolfSSL 15:117db924cf7c 28
wolfSSL 15:117db924cf7c 29 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 15:117db924cf7c 30
wolfSSL 15:117db924cf7c 31 #if defined(HAVE_CURVE25519) || defined(HAVE_ED25519)
wolfSSL 15:117db924cf7c 32 #if !defined(CURVE25519_SMALL) || !defined(ED25519_SMALL) /* run when not defined to use small memory math */
wolfSSL 15:117db924cf7c 33
wolfSSL 15:117db924cf7c 34 #include <wolfssl/wolfcrypt/fe_operations.h>
wolfSSL 15:117db924cf7c 35 #include <stdint.h>
wolfSSL 15:117db924cf7c 36
wolfSSL 15:117db924cf7c 37 #ifdef NO_INLINE
wolfSSL 15:117db924cf7c 38 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 15:117db924cf7c 39 #else
wolfSSL 15:117db924cf7c 40 #define WOLFSSL_MISC_INCLUDED
wolfSSL 15:117db924cf7c 41 #include <wolfcrypt/src/misc.c>
wolfSSL 15:117db924cf7c 42 #endif
wolfSSL 15:117db924cf7c 43
wolfSSL 15:117db924cf7c 44 #ifdef CURVED25519_X64
wolfSSL 15:117db924cf7c 45 #include "fe_x25519_x64.i"
wolfSSL 15:117db924cf7c 46 #elif defined(CURVED25519_128BIT)
wolfSSL 15:117db924cf7c 47 #include "fe_x25519_128.i"
wolfSSL 15:117db924cf7c 48 #else
wolfSSL 15:117db924cf7c 49
wolfSSL 15:117db924cf7c 50 #if defined(HAVE_CURVE25519) || \
wolfSSL 15:117db924cf7c 51 (defined(HAVE_ED25519) && !defined(ED25519_SMALL))
wolfSSL 15:117db924cf7c 52 /*
wolfSSL 15:117db924cf7c 53 fe means field element.
wolfSSL 15:117db924cf7c 54 Here the field is \Z/(2^255-19).
wolfSSL 15:117db924cf7c 55 An element t, entries t[0]...t[9], represents the integer
wolfSSL 15:117db924cf7c 56 t[0]+2^26 t[1]+2^51 t[2]+2^77 t[3]+2^102 t[4]+...+2^230 t[9].
wolfSSL 15:117db924cf7c 57 Bounds on each t[i] vary depending on context.
wolfSSL 15:117db924cf7c 58 */
wolfSSL 15:117db924cf7c 59
wolfSSL 15:117db924cf7c 60 uint64_t load_3(const unsigned char *in)
wolfSSL 15:117db924cf7c 61 {
wolfSSL 15:117db924cf7c 62 uint64_t result;
wolfSSL 15:117db924cf7c 63 result = (uint64_t) in[0];
wolfSSL 15:117db924cf7c 64 result |= ((uint64_t) in[1]) << 8;
wolfSSL 15:117db924cf7c 65 result |= ((uint64_t) in[2]) << 16;
wolfSSL 15:117db924cf7c 66 return result;
wolfSSL 15:117db924cf7c 67 }
wolfSSL 15:117db924cf7c 68
wolfSSL 15:117db924cf7c 69
wolfSSL 15:117db924cf7c 70 uint64_t load_4(const unsigned char *in)
wolfSSL 15:117db924cf7c 71 {
wolfSSL 15:117db924cf7c 72 uint64_t result;
wolfSSL 15:117db924cf7c 73 result = (uint64_t) in[0];
wolfSSL 15:117db924cf7c 74 result |= ((uint64_t) in[1]) << 8;
wolfSSL 15:117db924cf7c 75 result |= ((uint64_t) in[2]) << 16;
wolfSSL 15:117db924cf7c 76 result |= ((uint64_t) in[3]) << 24;
wolfSSL 15:117db924cf7c 77 return result;
wolfSSL 15:117db924cf7c 78 }
wolfSSL 15:117db924cf7c 79 #endif
wolfSSL 15:117db924cf7c 80
wolfSSL 15:117db924cf7c 81 /*
wolfSSL 15:117db924cf7c 82 h = 1
wolfSSL 15:117db924cf7c 83 */
wolfSSL 15:117db924cf7c 84
wolfSSL 15:117db924cf7c 85 void fe_1(fe h)
wolfSSL 15:117db924cf7c 86 {
wolfSSL 15:117db924cf7c 87 h[0] = 1;
wolfSSL 15:117db924cf7c 88 h[1] = 0;
wolfSSL 15:117db924cf7c 89 h[2] = 0;
wolfSSL 15:117db924cf7c 90 h[3] = 0;
wolfSSL 15:117db924cf7c 91 h[4] = 0;
wolfSSL 15:117db924cf7c 92 h[5] = 0;
wolfSSL 15:117db924cf7c 93 h[6] = 0;
wolfSSL 15:117db924cf7c 94 h[7] = 0;
wolfSSL 15:117db924cf7c 95 h[8] = 0;
wolfSSL 15:117db924cf7c 96 h[9] = 0;
wolfSSL 15:117db924cf7c 97 }
wolfSSL 15:117db924cf7c 98
wolfSSL 15:117db924cf7c 99
wolfSSL 15:117db924cf7c 100 /*
wolfSSL 15:117db924cf7c 101 h = 0
wolfSSL 15:117db924cf7c 102 */
wolfSSL 15:117db924cf7c 103
wolfSSL 15:117db924cf7c 104 void fe_0(fe h)
wolfSSL 15:117db924cf7c 105 {
wolfSSL 15:117db924cf7c 106 h[0] = 0;
wolfSSL 15:117db924cf7c 107 h[1] = 0;
wolfSSL 15:117db924cf7c 108 h[2] = 0;
wolfSSL 15:117db924cf7c 109 h[3] = 0;
wolfSSL 15:117db924cf7c 110 h[4] = 0;
wolfSSL 15:117db924cf7c 111 h[5] = 0;
wolfSSL 15:117db924cf7c 112 h[6] = 0;
wolfSSL 15:117db924cf7c 113 h[7] = 0;
wolfSSL 15:117db924cf7c 114 h[8] = 0;
wolfSSL 15:117db924cf7c 115 h[9] = 0;
wolfSSL 15:117db924cf7c 116 }
wolfSSL 15:117db924cf7c 117
wolfSSL 15:117db924cf7c 118
wolfSSL 15:117db924cf7c 119 #if ((defined(HAVE_CURVE25519) && !defined(CURVE25519_SMALL)) || \
wolfSSL 15:117db924cf7c 120 (defined(HAVE_ED25519) && !defined(ED25519_SMALL))) && \
wolfSSL 15:117db924cf7c 121 !defined(FREESCALE_LTC_ECC)
wolfSSL 15:117db924cf7c 122 /* to be Complementary to fe_low_mem.c */
wolfSSL 15:117db924cf7c 123 void fe_init()
wolfSSL 15:117db924cf7c 124 {
wolfSSL 15:117db924cf7c 125 }
wolfSSL 15:117db924cf7c 126 #endif
wolfSSL 15:117db924cf7c 127
wolfSSL 15:117db924cf7c 128 #if defined(HAVE_CURVE25519) && !defined(CURVE25519_SMALL) && \
wolfSSL 15:117db924cf7c 129 !defined(FREESCALE_LTC_ECC)
wolfSSL 15:117db924cf7c 130 int curve25519(byte* q, byte* n, byte* p)
wolfSSL 15:117db924cf7c 131 {
wolfSSL 15:117db924cf7c 132 #if 0
wolfSSL 15:117db924cf7c 133 unsigned char e[32];
wolfSSL 15:117db924cf7c 134 #endif
wolfSSL 15:117db924cf7c 135 fe x1;
wolfSSL 15:117db924cf7c 136 fe x2;
wolfSSL 15:117db924cf7c 137 fe z2;
wolfSSL 15:117db924cf7c 138 fe x3;
wolfSSL 15:117db924cf7c 139 fe z3;
wolfSSL 15:117db924cf7c 140 fe tmp0;
wolfSSL 15:117db924cf7c 141 fe tmp1;
wolfSSL 15:117db924cf7c 142 int pos;
wolfSSL 15:117db924cf7c 143 unsigned int swap;
wolfSSL 15:117db924cf7c 144 unsigned int b;
wolfSSL 15:117db924cf7c 145
wolfSSL 15:117db924cf7c 146 /* Clamp already done during key generation and import */
wolfSSL 15:117db924cf7c 147 #if 0
wolfSSL 15:117db924cf7c 148 {
wolfSSL 15:117db924cf7c 149 unsigned int i;
wolfSSL 15:117db924cf7c 150 for (i = 0;i < 32;++i) e[i] = n[i];
wolfSSL 15:117db924cf7c 151 e[0] &= 248;
wolfSSL 15:117db924cf7c 152 e[31] &= 127;
wolfSSL 15:117db924cf7c 153 e[31] |= 64;
wolfSSL 15:117db924cf7c 154 }
wolfSSL 15:117db924cf7c 155 #endif
wolfSSL 15:117db924cf7c 156
wolfSSL 15:117db924cf7c 157 fe_frombytes(x1,p);
wolfSSL 15:117db924cf7c 158 fe_1(x2);
wolfSSL 15:117db924cf7c 159 fe_0(z2);
wolfSSL 15:117db924cf7c 160 fe_copy(x3,x1);
wolfSSL 15:117db924cf7c 161 fe_1(z3);
wolfSSL 15:117db924cf7c 162
wolfSSL 15:117db924cf7c 163 swap = 0;
wolfSSL 15:117db924cf7c 164 for (pos = 254;pos >= 0;--pos) {
wolfSSL 15:117db924cf7c 165 #if 0
wolfSSL 15:117db924cf7c 166 b = e[pos / 8] >> (pos & 7);
wolfSSL 15:117db924cf7c 167 #else
wolfSSL 15:117db924cf7c 168 b = n[pos / 8] >> (pos & 7);
wolfSSL 15:117db924cf7c 169 #endif
wolfSSL 15:117db924cf7c 170 b &= 1;
wolfSSL 15:117db924cf7c 171 swap ^= b;
wolfSSL 15:117db924cf7c 172 fe_cswap(x2,x3,swap);
wolfSSL 15:117db924cf7c 173 fe_cswap(z2,z3,swap);
wolfSSL 15:117db924cf7c 174 swap = b;
wolfSSL 15:117db924cf7c 175
wolfSSL 15:117db924cf7c 176 /* montgomery */
wolfSSL 15:117db924cf7c 177 fe_sub(tmp0,x3,z3);
wolfSSL 15:117db924cf7c 178 fe_sub(tmp1,x2,z2);
wolfSSL 15:117db924cf7c 179 fe_add(x2,x2,z2);
wolfSSL 15:117db924cf7c 180 fe_add(z2,x3,z3);
wolfSSL 15:117db924cf7c 181 fe_mul(z3,tmp0,x2);
wolfSSL 15:117db924cf7c 182 fe_mul(z2,z2,tmp1);
wolfSSL 15:117db924cf7c 183 fe_sq(tmp0,tmp1);
wolfSSL 15:117db924cf7c 184 fe_sq(tmp1,x2);
wolfSSL 15:117db924cf7c 185 fe_add(x3,z3,z2);
wolfSSL 15:117db924cf7c 186 fe_sub(z2,z3,z2);
wolfSSL 15:117db924cf7c 187 fe_mul(x2,tmp1,tmp0);
wolfSSL 15:117db924cf7c 188 fe_sub(tmp1,tmp1,tmp0);
wolfSSL 15:117db924cf7c 189 fe_sq(z2,z2);
wolfSSL 15:117db924cf7c 190 fe_mul121666(z3,tmp1);
wolfSSL 15:117db924cf7c 191 fe_sq(x3,x3);
wolfSSL 15:117db924cf7c 192 fe_add(tmp0,tmp0,z3);
wolfSSL 15:117db924cf7c 193 fe_mul(z3,x1,z2);
wolfSSL 15:117db924cf7c 194 fe_mul(z2,tmp1,tmp0);
wolfSSL 15:117db924cf7c 195 }
wolfSSL 15:117db924cf7c 196 fe_cswap(x2,x3,swap);
wolfSSL 15:117db924cf7c 197 fe_cswap(z2,z3,swap);
wolfSSL 15:117db924cf7c 198
wolfSSL 15:117db924cf7c 199 fe_invert(z2,z2);
wolfSSL 15:117db924cf7c 200 fe_mul(x2,x2,z2);
wolfSSL 15:117db924cf7c 201 fe_tobytes(q,x2);
wolfSSL 15:117db924cf7c 202
wolfSSL 15:117db924cf7c 203 return 0;
wolfSSL 15:117db924cf7c 204 }
wolfSSL 15:117db924cf7c 205 #endif /* HAVE_CURVE25519 && !CURVE25519_SMALL && !FREESCALE_LTC_ECC */
wolfSSL 15:117db924cf7c 206
wolfSSL 15:117db924cf7c 207
wolfSSL 15:117db924cf7c 208 /*
wolfSSL 15:117db924cf7c 209 h = f * f
wolfSSL 15:117db924cf7c 210 Can overlap h with f.
wolfSSL 15:117db924cf7c 211
wolfSSL 15:117db924cf7c 212 Preconditions:
wolfSSL 15:117db924cf7c 213 |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
wolfSSL 15:117db924cf7c 214
wolfSSL 15:117db924cf7c 215 Postconditions:
wolfSSL 15:117db924cf7c 216 |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
wolfSSL 15:117db924cf7c 217 */
wolfSSL 15:117db924cf7c 218
wolfSSL 15:117db924cf7c 219 /*
wolfSSL 15:117db924cf7c 220 See fe_mul.c for discussion of implementation strategy.
wolfSSL 15:117db924cf7c 221 */
wolfSSL 15:117db924cf7c 222
wolfSSL 15:117db924cf7c 223 void fe_sq(fe h,const fe f)
wolfSSL 15:117db924cf7c 224 {
wolfSSL 15:117db924cf7c 225 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 226 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 227 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 228 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 229 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 230 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 231 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 232 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 233 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 234 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 235 int32_t f0_2 = 2 * f0;
wolfSSL 15:117db924cf7c 236 int32_t f1_2 = 2 * f1;
wolfSSL 15:117db924cf7c 237 int32_t f2_2 = 2 * f2;
wolfSSL 15:117db924cf7c 238 int32_t f3_2 = 2 * f3;
wolfSSL 15:117db924cf7c 239 int32_t f4_2 = 2 * f4;
wolfSSL 15:117db924cf7c 240 int32_t f5_2 = 2 * f5;
wolfSSL 15:117db924cf7c 241 int32_t f6_2 = 2 * f6;
wolfSSL 15:117db924cf7c 242 int32_t f7_2 = 2 * f7;
wolfSSL 15:117db924cf7c 243 int32_t f5_38 = 38 * f5; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 244 int32_t f6_19 = 19 * f6; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 245 int32_t f7_38 = 38 * f7; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 246 int32_t f8_19 = 19 * f8; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 247 int32_t f9_38 = 38 * f9; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 248 int64_t f0f0 = f0 * (int64_t) f0;
wolfSSL 15:117db924cf7c 249 int64_t f0f1_2 = f0_2 * (int64_t) f1;
wolfSSL 15:117db924cf7c 250 int64_t f0f2_2 = f0_2 * (int64_t) f2;
wolfSSL 15:117db924cf7c 251 int64_t f0f3_2 = f0_2 * (int64_t) f3;
wolfSSL 15:117db924cf7c 252 int64_t f0f4_2 = f0_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 253 int64_t f0f5_2 = f0_2 * (int64_t) f5;
wolfSSL 15:117db924cf7c 254 int64_t f0f6_2 = f0_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 255 int64_t f0f7_2 = f0_2 * (int64_t) f7;
wolfSSL 15:117db924cf7c 256 int64_t f0f8_2 = f0_2 * (int64_t) f8;
wolfSSL 15:117db924cf7c 257 int64_t f0f9_2 = f0_2 * (int64_t) f9;
wolfSSL 15:117db924cf7c 258 int64_t f1f1_2 = f1_2 * (int64_t) f1;
wolfSSL 15:117db924cf7c 259 int64_t f1f2_2 = f1_2 * (int64_t) f2;
wolfSSL 15:117db924cf7c 260 int64_t f1f3_4 = f1_2 * (int64_t) f3_2;
wolfSSL 15:117db924cf7c 261 int64_t f1f4_2 = f1_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 262 int64_t f1f5_4 = f1_2 * (int64_t) f5_2;
wolfSSL 15:117db924cf7c 263 int64_t f1f6_2 = f1_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 264 int64_t f1f7_4 = f1_2 * (int64_t) f7_2;
wolfSSL 15:117db924cf7c 265 int64_t f1f8_2 = f1_2 * (int64_t) f8;
wolfSSL 15:117db924cf7c 266 int64_t f1f9_76 = f1_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 267 int64_t f2f2 = f2 * (int64_t) f2;
wolfSSL 15:117db924cf7c 268 int64_t f2f3_2 = f2_2 * (int64_t) f3;
wolfSSL 15:117db924cf7c 269 int64_t f2f4_2 = f2_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 270 int64_t f2f5_2 = f2_2 * (int64_t) f5;
wolfSSL 15:117db924cf7c 271 int64_t f2f6_2 = f2_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 272 int64_t f2f7_2 = f2_2 * (int64_t) f7;
wolfSSL 15:117db924cf7c 273 int64_t f2f8_38 = f2_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 274 int64_t f2f9_38 = f2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 275 int64_t f3f3_2 = f3_2 * (int64_t) f3;
wolfSSL 15:117db924cf7c 276 int64_t f3f4_2 = f3_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 277 int64_t f3f5_4 = f3_2 * (int64_t) f5_2;
wolfSSL 15:117db924cf7c 278 int64_t f3f6_2 = f3_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 279 int64_t f3f7_76 = f3_2 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 280 int64_t f3f8_38 = f3_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 281 int64_t f3f9_76 = f3_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 282 int64_t f4f4 = f4 * (int64_t) f4;
wolfSSL 15:117db924cf7c 283 int64_t f4f5_2 = f4_2 * (int64_t) f5;
wolfSSL 15:117db924cf7c 284 int64_t f4f6_38 = f4_2 * (int64_t) f6_19;
wolfSSL 15:117db924cf7c 285 int64_t f4f7_38 = f4 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 286 int64_t f4f8_38 = f4_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 287 int64_t f4f9_38 = f4 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 288 int64_t f5f5_38 = f5 * (int64_t) f5_38;
wolfSSL 15:117db924cf7c 289 int64_t f5f6_38 = f5_2 * (int64_t) f6_19;
wolfSSL 15:117db924cf7c 290 int64_t f5f7_76 = f5_2 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 291 int64_t f5f8_38 = f5_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 292 int64_t f5f9_76 = f5_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 293 int64_t f6f6_19 = f6 * (int64_t) f6_19;
wolfSSL 15:117db924cf7c 294 int64_t f6f7_38 = f6 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 295 int64_t f6f8_38 = f6_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 296 int64_t f6f9_38 = f6 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 297 int64_t f7f7_38 = f7 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 298 int64_t f7f8_38 = f7_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 299 int64_t f7f9_76 = f7_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 300 int64_t f8f8_19 = f8 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 301 int64_t f8f9_38 = f8 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 302 int64_t f9f9_38 = f9 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 303 int64_t h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
wolfSSL 15:117db924cf7c 304 int64_t h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
wolfSSL 15:117db924cf7c 305 int64_t h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
wolfSSL 15:117db924cf7c 306 int64_t h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
wolfSSL 15:117db924cf7c 307 int64_t h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
wolfSSL 15:117db924cf7c 308 int64_t h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
wolfSSL 15:117db924cf7c 309 int64_t h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
wolfSSL 15:117db924cf7c 310 int64_t h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
wolfSSL 15:117db924cf7c 311 int64_t h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
wolfSSL 15:117db924cf7c 312 int64_t h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
wolfSSL 15:117db924cf7c 313 int64_t carry0;
wolfSSL 15:117db924cf7c 314 int64_t carry1;
wolfSSL 15:117db924cf7c 315 int64_t carry2;
wolfSSL 15:117db924cf7c 316 int64_t carry3;
wolfSSL 15:117db924cf7c 317 int64_t carry4;
wolfSSL 15:117db924cf7c 318 int64_t carry5;
wolfSSL 15:117db924cf7c 319 int64_t carry6;
wolfSSL 15:117db924cf7c 320 int64_t carry7;
wolfSSL 15:117db924cf7c 321 int64_t carry8;
wolfSSL 15:117db924cf7c 322 int64_t carry9;
wolfSSL 15:117db924cf7c 323
wolfSSL 15:117db924cf7c 324 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 325 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 326
wolfSSL 15:117db924cf7c 327 carry1 = (h1 + (int64_t) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
wolfSSL 15:117db924cf7c 328 carry5 = (h5 + (int64_t) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
wolfSSL 15:117db924cf7c 329
wolfSSL 15:117db924cf7c 330 carry2 = (h2 + (int64_t) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
wolfSSL 15:117db924cf7c 331 carry6 = (h6 + (int64_t) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
wolfSSL 15:117db924cf7c 332
wolfSSL 15:117db924cf7c 333 carry3 = (h3 + (int64_t) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
wolfSSL 15:117db924cf7c 334 carry7 = (h7 + (int64_t) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
wolfSSL 15:117db924cf7c 335
wolfSSL 15:117db924cf7c 336 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 337 carry8 = (h8 + (int64_t) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
wolfSSL 15:117db924cf7c 338
wolfSSL 15:117db924cf7c 339 carry9 = (h9 + (int64_t) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
wolfSSL 15:117db924cf7c 340
wolfSSL 15:117db924cf7c 341 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 342
wolfSSL 15:117db924cf7c 343 h[0] = (int32_t)h0;
wolfSSL 15:117db924cf7c 344 h[1] = (int32_t)h1;
wolfSSL 15:117db924cf7c 345 h[2] = (int32_t)h2;
wolfSSL 15:117db924cf7c 346 h[3] = (int32_t)h3;
wolfSSL 15:117db924cf7c 347 h[4] = (int32_t)h4;
wolfSSL 15:117db924cf7c 348 h[5] = (int32_t)h5;
wolfSSL 15:117db924cf7c 349 h[6] = (int32_t)h6;
wolfSSL 15:117db924cf7c 350 h[7] = (int32_t)h7;
wolfSSL 15:117db924cf7c 351 h[8] = (int32_t)h8;
wolfSSL 15:117db924cf7c 352 h[9] = (int32_t)h9;
wolfSSL 15:117db924cf7c 353 }
wolfSSL 15:117db924cf7c 354
wolfSSL 15:117db924cf7c 355
wolfSSL 15:117db924cf7c 356 /*
wolfSSL 15:117db924cf7c 357 h = f + g
wolfSSL 15:117db924cf7c 358 Can overlap h with f or g.
wolfSSL 15:117db924cf7c 359
wolfSSL 15:117db924cf7c 360 Preconditions:
wolfSSL 15:117db924cf7c 361 |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
wolfSSL 15:117db924cf7c 362 |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
wolfSSL 15:117db924cf7c 363
wolfSSL 15:117db924cf7c 364 Postconditions:
wolfSSL 15:117db924cf7c 365 |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
wolfSSL 15:117db924cf7c 366 */
wolfSSL 15:117db924cf7c 367
wolfSSL 15:117db924cf7c 368 void fe_add(fe h,const fe f,const fe g)
wolfSSL 15:117db924cf7c 369 {
wolfSSL 15:117db924cf7c 370 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 371 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 372 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 373 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 374 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 375 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 376 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 377 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 378 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 379 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 380 int32_t g0 = g[0];
wolfSSL 15:117db924cf7c 381 int32_t g1 = g[1];
wolfSSL 15:117db924cf7c 382 int32_t g2 = g[2];
wolfSSL 15:117db924cf7c 383 int32_t g3 = g[3];
wolfSSL 15:117db924cf7c 384 int32_t g4 = g[4];
wolfSSL 15:117db924cf7c 385 int32_t g5 = g[5];
wolfSSL 15:117db924cf7c 386 int32_t g6 = g[6];
wolfSSL 15:117db924cf7c 387 int32_t g7 = g[7];
wolfSSL 15:117db924cf7c 388 int32_t g8 = g[8];
wolfSSL 15:117db924cf7c 389 int32_t g9 = g[9];
wolfSSL 15:117db924cf7c 390 int32_t h0 = f0 + g0;
wolfSSL 15:117db924cf7c 391 int32_t h1 = f1 + g1;
wolfSSL 15:117db924cf7c 392 int32_t h2 = f2 + g2;
wolfSSL 15:117db924cf7c 393 int32_t h3 = f3 + g3;
wolfSSL 15:117db924cf7c 394 int32_t h4 = f4 + g4;
wolfSSL 15:117db924cf7c 395 int32_t h5 = f5 + g5;
wolfSSL 15:117db924cf7c 396 int32_t h6 = f6 + g6;
wolfSSL 15:117db924cf7c 397 int32_t h7 = f7 + g7;
wolfSSL 15:117db924cf7c 398 int32_t h8 = f8 + g8;
wolfSSL 15:117db924cf7c 399 int32_t h9 = f9 + g9;
wolfSSL 15:117db924cf7c 400 h[0] = h0;
wolfSSL 15:117db924cf7c 401 h[1] = h1;
wolfSSL 15:117db924cf7c 402 h[2] = h2;
wolfSSL 15:117db924cf7c 403 h[3] = h3;
wolfSSL 15:117db924cf7c 404 h[4] = h4;
wolfSSL 15:117db924cf7c 405 h[5] = h5;
wolfSSL 15:117db924cf7c 406 h[6] = h6;
wolfSSL 15:117db924cf7c 407 h[7] = h7;
wolfSSL 15:117db924cf7c 408 h[8] = h8;
wolfSSL 15:117db924cf7c 409 h[9] = h9;
wolfSSL 15:117db924cf7c 410 }
wolfSSL 15:117db924cf7c 411
wolfSSL 15:117db924cf7c 412
wolfSSL 15:117db924cf7c 413 /*
wolfSSL 15:117db924cf7c 414 Preconditions:
wolfSSL 15:117db924cf7c 415 |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
wolfSSL 15:117db924cf7c 416
wolfSSL 15:117db924cf7c 417 Write p=2^255-19; q=floor(h/p).
wolfSSL 15:117db924cf7c 418 Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
wolfSSL 15:117db924cf7c 419
wolfSSL 15:117db924cf7c 420 Proof:
wolfSSL 15:117db924cf7c 421 Have |h|<=p so |q|<=1 so |19^2 2^(-255) q|<1/4.
wolfSSL 15:117db924cf7c 422 Also have |h-2^230 h9|<2^231 so |19 2^(-255)(h-2^230 h9)|<1/4.
wolfSSL 15:117db924cf7c 423
wolfSSL 15:117db924cf7c 424 Write y=2^(-1)-19^2 2^(-255)q-19 2^(-255)(h-2^230 h9).
wolfSSL 15:117db924cf7c 425 Then 0<y<1.
wolfSSL 15:117db924cf7c 426
wolfSSL 15:117db924cf7c 427 Write r=h-pq.
wolfSSL 15:117db924cf7c 428 Have 0<=r<=p-1=2^255-20.
wolfSSL 15:117db924cf7c 429 Thus 0<=r+19(2^-255)r<r+19(2^-255)2^255<=2^255-1.
wolfSSL 15:117db924cf7c 430
wolfSSL 15:117db924cf7c 431 Write x=r+19(2^-255)r+y.
wolfSSL 15:117db924cf7c 432 Then 0<x<2^255 so floor(2^(-255)x) = 0 so floor(q+2^(-255)x) = q.
wolfSSL 15:117db924cf7c 433
wolfSSL 15:117db924cf7c 434 Have q+2^(-255)x = 2^(-255)(h + 19 2^(-25) h9 + 2^(-1))
wolfSSL 15:117db924cf7c 435 so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q.
wolfSSL 15:117db924cf7c 436 */
wolfSSL 15:117db924cf7c 437
wolfSSL 15:117db924cf7c 438 void fe_tobytes(unsigned char *s,const fe h)
wolfSSL 15:117db924cf7c 439 {
wolfSSL 15:117db924cf7c 440 int32_t h0 = h[0];
wolfSSL 15:117db924cf7c 441 int32_t h1 = h[1];
wolfSSL 15:117db924cf7c 442 int32_t h2 = h[2];
wolfSSL 15:117db924cf7c 443 int32_t h3 = h[3];
wolfSSL 15:117db924cf7c 444 int32_t h4 = h[4];
wolfSSL 15:117db924cf7c 445 int32_t h5 = h[5];
wolfSSL 15:117db924cf7c 446 int32_t h6 = h[6];
wolfSSL 15:117db924cf7c 447 int32_t h7 = h[7];
wolfSSL 15:117db924cf7c 448 int32_t h8 = h[8];
wolfSSL 15:117db924cf7c 449 int32_t h9 = h[9];
wolfSSL 15:117db924cf7c 450 int32_t q;
wolfSSL 15:117db924cf7c 451 int32_t carry0;
wolfSSL 15:117db924cf7c 452 int32_t carry1;
wolfSSL 15:117db924cf7c 453 int32_t carry2;
wolfSSL 15:117db924cf7c 454 int32_t carry3;
wolfSSL 15:117db924cf7c 455 int32_t carry4;
wolfSSL 15:117db924cf7c 456 int32_t carry5;
wolfSSL 15:117db924cf7c 457 int32_t carry6;
wolfSSL 15:117db924cf7c 458 int32_t carry7;
wolfSSL 15:117db924cf7c 459 int32_t carry8;
wolfSSL 15:117db924cf7c 460 int32_t carry9;
wolfSSL 15:117db924cf7c 461
wolfSSL 15:117db924cf7c 462 q = (19 * h9 + (((int32_t) 1) << 24)) >> 25;
wolfSSL 15:117db924cf7c 463 q = (h0 + q) >> 26;
wolfSSL 15:117db924cf7c 464 q = (h1 + q) >> 25;
wolfSSL 15:117db924cf7c 465 q = (h2 + q) >> 26;
wolfSSL 15:117db924cf7c 466 q = (h3 + q) >> 25;
wolfSSL 15:117db924cf7c 467 q = (h4 + q) >> 26;
wolfSSL 15:117db924cf7c 468 q = (h5 + q) >> 25;
wolfSSL 15:117db924cf7c 469 q = (h6 + q) >> 26;
wolfSSL 15:117db924cf7c 470 q = (h7 + q) >> 25;
wolfSSL 15:117db924cf7c 471 q = (h8 + q) >> 26;
wolfSSL 15:117db924cf7c 472 q = (h9 + q) >> 25;
wolfSSL 15:117db924cf7c 473
wolfSSL 15:117db924cf7c 474 /* Goal: Output h-(2^255-19)q, which is between 0 and 2^255-20. */
wolfSSL 15:117db924cf7c 475 h0 += 19 * q;
wolfSSL 15:117db924cf7c 476 /* Goal: Output h-2^255 q, which is between 0 and 2^255-20. */
wolfSSL 15:117db924cf7c 477
wolfSSL 15:117db924cf7c 478 carry0 = h0 >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 479 carry1 = h1 >> 25; h2 += carry1; h1 -= carry1 << 25;
wolfSSL 15:117db924cf7c 480 carry2 = h2 >> 26; h3 += carry2; h2 -= carry2 << 26;
wolfSSL 15:117db924cf7c 481 carry3 = h3 >> 25; h4 += carry3; h3 -= carry3 << 25;
wolfSSL 15:117db924cf7c 482 carry4 = h4 >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 483 carry5 = h5 >> 25; h6 += carry5; h5 -= carry5 << 25;
wolfSSL 15:117db924cf7c 484 carry6 = h6 >> 26; h7 += carry6; h6 -= carry6 << 26;
wolfSSL 15:117db924cf7c 485 carry7 = h7 >> 25; h8 += carry7; h7 -= carry7 << 25;
wolfSSL 15:117db924cf7c 486 carry8 = h8 >> 26; h9 += carry8; h8 -= carry8 << 26;
wolfSSL 15:117db924cf7c 487 carry9 = h9 >> 25; h9 -= carry9 << 25;
wolfSSL 15:117db924cf7c 488 /* h10 = carry9 */
wolfSSL 15:117db924cf7c 489
wolfSSL 15:117db924cf7c 490 /*
wolfSSL 15:117db924cf7c 491 Goal: Output h0+...+2^255 h10-2^255 q, which is between 0 and 2^255-20.
wolfSSL 15:117db924cf7c 492 Have h0+...+2^230 h9 between 0 and 2^255-1;
wolfSSL 15:117db924cf7c 493 evidently 2^255 h10-2^255 q = 0.
wolfSSL 15:117db924cf7c 494 Goal: Output h0+...+2^230 h9.
wolfSSL 15:117db924cf7c 495 */
wolfSSL 15:117db924cf7c 496
wolfSSL 15:117db924cf7c 497 s[0] = (byte)(h0 >> 0);
wolfSSL 15:117db924cf7c 498 s[1] = (byte)(h0 >> 8);
wolfSSL 15:117db924cf7c 499 s[2] = (byte)(h0 >> 16);
wolfSSL 15:117db924cf7c 500 s[3] = (byte)((h0 >> 24) | (h1 << 2));
wolfSSL 15:117db924cf7c 501 s[4] = (byte)(h1 >> 6);
wolfSSL 15:117db924cf7c 502 s[5] = (byte)(h1 >> 14);
wolfSSL 15:117db924cf7c 503 s[6] = (byte)((h1 >> 22) | (h2 << 3));
wolfSSL 15:117db924cf7c 504 s[7] = (byte)(h2 >> 5);
wolfSSL 15:117db924cf7c 505 s[8] = (byte)(h2 >> 13);
wolfSSL 15:117db924cf7c 506 s[9] = (byte)((h2 >> 21) | (h3 << 5));
wolfSSL 15:117db924cf7c 507 s[10] = (byte)(h3 >> 3);
wolfSSL 15:117db924cf7c 508 s[11] = (byte)(h3 >> 11);
wolfSSL 15:117db924cf7c 509 s[12] = (byte)((h3 >> 19) | (h4 << 6));
wolfSSL 15:117db924cf7c 510 s[13] = (byte)(h4 >> 2);
wolfSSL 15:117db924cf7c 511 s[14] = (byte)(h4 >> 10);
wolfSSL 15:117db924cf7c 512 s[15] = (byte)(h4 >> 18);
wolfSSL 15:117db924cf7c 513 s[16] = (byte)(h5 >> 0);
wolfSSL 15:117db924cf7c 514 s[17] = (byte)(h5 >> 8);
wolfSSL 15:117db924cf7c 515 s[18] = (byte)(h5 >> 16);
wolfSSL 15:117db924cf7c 516 s[19] = (byte)((h5 >> 24) | (h6 << 1));
wolfSSL 15:117db924cf7c 517 s[20] = (byte)(h6 >> 7);
wolfSSL 15:117db924cf7c 518 s[21] = (byte)(h6 >> 15);
wolfSSL 15:117db924cf7c 519 s[22] = (byte)((h6 >> 23) | (h7 << 3));
wolfSSL 15:117db924cf7c 520 s[23] = (byte)(h7 >> 5);
wolfSSL 15:117db924cf7c 521 s[24] = (byte)(h7 >> 13);
wolfSSL 15:117db924cf7c 522 s[25] = (byte)((h7 >> 21) | (h8 << 4));
wolfSSL 15:117db924cf7c 523 s[26] = (byte)(h8 >> 4);
wolfSSL 15:117db924cf7c 524 s[27] = (byte)(h8 >> 12);
wolfSSL 15:117db924cf7c 525 s[28] = (byte)((h8 >> 20) | (h9 << 6));
wolfSSL 15:117db924cf7c 526 s[29] = (byte)(h9 >> 2);
wolfSSL 15:117db924cf7c 527 s[30] = (byte)(h9 >> 10);
wolfSSL 15:117db924cf7c 528 s[31] = (byte)(h9 >> 18);
wolfSSL 15:117db924cf7c 529 }
wolfSSL 15:117db924cf7c 530
wolfSSL 15:117db924cf7c 531
wolfSSL 15:117db924cf7c 532 /*
wolfSSL 15:117db924cf7c 533 h = f - g
wolfSSL 15:117db924cf7c 534 Can overlap h with f or g.
wolfSSL 15:117db924cf7c 535
wolfSSL 15:117db924cf7c 536 Preconditions:
wolfSSL 15:117db924cf7c 537 |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
wolfSSL 15:117db924cf7c 538 |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
wolfSSL 15:117db924cf7c 539
wolfSSL 15:117db924cf7c 540 Postconditions:
wolfSSL 15:117db924cf7c 541 |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
wolfSSL 15:117db924cf7c 542 */
wolfSSL 15:117db924cf7c 543
wolfSSL 15:117db924cf7c 544 void fe_sub(fe h,const fe f,const fe g)
wolfSSL 15:117db924cf7c 545 {
wolfSSL 15:117db924cf7c 546 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 547 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 548 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 549 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 550 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 551 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 552 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 553 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 554 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 555 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 556 int32_t g0 = g[0];
wolfSSL 15:117db924cf7c 557 int32_t g1 = g[1];
wolfSSL 15:117db924cf7c 558 int32_t g2 = g[2];
wolfSSL 15:117db924cf7c 559 int32_t g3 = g[3];
wolfSSL 15:117db924cf7c 560 int32_t g4 = g[4];
wolfSSL 15:117db924cf7c 561 int32_t g5 = g[5];
wolfSSL 15:117db924cf7c 562 int32_t g6 = g[6];
wolfSSL 15:117db924cf7c 563 int32_t g7 = g[7];
wolfSSL 15:117db924cf7c 564 int32_t g8 = g[8];
wolfSSL 15:117db924cf7c 565 int32_t g9 = g[9];
wolfSSL 15:117db924cf7c 566 int32_t h0 = f0 - g0;
wolfSSL 15:117db924cf7c 567 int32_t h1 = f1 - g1;
wolfSSL 15:117db924cf7c 568 int32_t h2 = f2 - g2;
wolfSSL 15:117db924cf7c 569 int32_t h3 = f3 - g3;
wolfSSL 15:117db924cf7c 570 int32_t h4 = f4 - g4;
wolfSSL 15:117db924cf7c 571 int32_t h5 = f5 - g5;
wolfSSL 15:117db924cf7c 572 int32_t h6 = f6 - g6;
wolfSSL 15:117db924cf7c 573 int32_t h7 = f7 - g7;
wolfSSL 15:117db924cf7c 574 int32_t h8 = f8 - g8;
wolfSSL 15:117db924cf7c 575 int32_t h9 = f9 - g9;
wolfSSL 15:117db924cf7c 576 h[0] = h0;
wolfSSL 15:117db924cf7c 577 h[1] = h1;
wolfSSL 15:117db924cf7c 578 h[2] = h2;
wolfSSL 15:117db924cf7c 579 h[3] = h3;
wolfSSL 15:117db924cf7c 580 h[4] = h4;
wolfSSL 15:117db924cf7c 581 h[5] = h5;
wolfSSL 15:117db924cf7c 582 h[6] = h6;
wolfSSL 15:117db924cf7c 583 h[7] = h7;
wolfSSL 15:117db924cf7c 584 h[8] = h8;
wolfSSL 15:117db924cf7c 585 h[9] = h9;
wolfSSL 15:117db924cf7c 586 }
wolfSSL 15:117db924cf7c 587
wolfSSL 15:117db924cf7c 588
wolfSSL 15:117db924cf7c 589 #if defined(HAVE_CURVE25519) || \
wolfSSL 15:117db924cf7c 590 (defined(HAVE_ED25519) && !defined(ED25519_SMALL))
wolfSSL 15:117db924cf7c 591 /*
wolfSSL 15:117db924cf7c 592 Ignores top bit of h.
wolfSSL 15:117db924cf7c 593 */
wolfSSL 15:117db924cf7c 594
wolfSSL 15:117db924cf7c 595 void fe_frombytes(fe h,const unsigned char *s)
wolfSSL 15:117db924cf7c 596 {
wolfSSL 15:117db924cf7c 597 int64_t h0 = load_4(s);
wolfSSL 15:117db924cf7c 598 int64_t h1 = load_3(s + 4) << 6;
wolfSSL 15:117db924cf7c 599 int64_t h2 = load_3(s + 7) << 5;
wolfSSL 15:117db924cf7c 600 int64_t h3 = load_3(s + 10) << 3;
wolfSSL 15:117db924cf7c 601 int64_t h4 = load_3(s + 13) << 2;
wolfSSL 15:117db924cf7c 602 int64_t h5 = load_4(s + 16);
wolfSSL 15:117db924cf7c 603 int64_t h6 = load_3(s + 20) << 7;
wolfSSL 15:117db924cf7c 604 int64_t h7 = load_3(s + 23) << 5;
wolfSSL 15:117db924cf7c 605 int64_t h8 = load_3(s + 26) << 4;
wolfSSL 15:117db924cf7c 606 int64_t h9 = (load_3(s + 29) & 8388607) << 2;
wolfSSL 15:117db924cf7c 607 int64_t carry0;
wolfSSL 15:117db924cf7c 608 int64_t carry1;
wolfSSL 15:117db924cf7c 609 int64_t carry2;
wolfSSL 15:117db924cf7c 610 int64_t carry3;
wolfSSL 15:117db924cf7c 611 int64_t carry4;
wolfSSL 15:117db924cf7c 612 int64_t carry5;
wolfSSL 15:117db924cf7c 613 int64_t carry6;
wolfSSL 15:117db924cf7c 614 int64_t carry7;
wolfSSL 15:117db924cf7c 615 int64_t carry8;
wolfSSL 15:117db924cf7c 616 int64_t carry9;
wolfSSL 15:117db924cf7c 617
wolfSSL 15:117db924cf7c 618 carry9 = (h9 + (int64_t) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
wolfSSL 15:117db924cf7c 619 carry1 = (h1 + (int64_t) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
wolfSSL 15:117db924cf7c 620 carry3 = (h3 + (int64_t) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
wolfSSL 15:117db924cf7c 621 carry5 = (h5 + (int64_t) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
wolfSSL 15:117db924cf7c 622 carry7 = (h7 + (int64_t) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
wolfSSL 15:117db924cf7c 623
wolfSSL 15:117db924cf7c 624 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 625 carry2 = (h2 + (int64_t) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
wolfSSL 15:117db924cf7c 626 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 627 carry6 = (h6 + (int64_t) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
wolfSSL 15:117db924cf7c 628 carry8 = (h8 + (int64_t) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
wolfSSL 15:117db924cf7c 629
wolfSSL 15:117db924cf7c 630 h[0] = (int32_t)h0;
wolfSSL 15:117db924cf7c 631 h[1] = (int32_t)h1;
wolfSSL 15:117db924cf7c 632 h[2] = (int32_t)h2;
wolfSSL 15:117db924cf7c 633 h[3] = (int32_t)h3;
wolfSSL 15:117db924cf7c 634 h[4] = (int32_t)h4;
wolfSSL 15:117db924cf7c 635 h[5] = (int32_t)h5;
wolfSSL 15:117db924cf7c 636 h[6] = (int32_t)h6;
wolfSSL 15:117db924cf7c 637 h[7] = (int32_t)h7;
wolfSSL 15:117db924cf7c 638 h[8] = (int32_t)h8;
wolfSSL 15:117db924cf7c 639 h[9] = (int32_t)h9;
wolfSSL 15:117db924cf7c 640 }
wolfSSL 15:117db924cf7c 641 #endif
wolfSSL 15:117db924cf7c 642
wolfSSL 15:117db924cf7c 643
wolfSSL 15:117db924cf7c 644 void fe_invert(fe out,const fe z)
wolfSSL 15:117db924cf7c 645 {
wolfSSL 15:117db924cf7c 646 fe t0;
wolfSSL 15:117db924cf7c 647 fe t1;
wolfSSL 15:117db924cf7c 648 fe t2;
wolfSSL 15:117db924cf7c 649 fe t3;
wolfSSL 15:117db924cf7c 650 int i;
wolfSSL 15:117db924cf7c 651
wolfSSL 15:117db924cf7c 652 /* pow225521 */
wolfSSL 15:117db924cf7c 653 fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
wolfSSL 15:117db924cf7c 654 fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 655 fe_mul(t1,z,t1);
wolfSSL 15:117db924cf7c 656 fe_mul(t0,t0,t1);
wolfSSL 15:117db924cf7c 657 fe_sq(t2,t0); for (i = 1;i < 1;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 658 fe_mul(t1,t1,t2);
wolfSSL 15:117db924cf7c 659 fe_sq(t2,t1); for (i = 1;i < 5;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 660 fe_mul(t1,t2,t1);
wolfSSL 15:117db924cf7c 661 fe_sq(t2,t1); for (i = 1;i < 10;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 662 fe_mul(t2,t2,t1);
wolfSSL 15:117db924cf7c 663 fe_sq(t3,t2); for (i = 1;i < 20;++i) fe_sq(t3,t3);
wolfSSL 15:117db924cf7c 664 fe_mul(t2,t3,t2);
wolfSSL 15:117db924cf7c 665 fe_sq(t2,t2); for (i = 1;i < 10;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 666 fe_mul(t1,t2,t1);
wolfSSL 15:117db924cf7c 667 fe_sq(t2,t1); for (i = 1;i < 50;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 668 fe_mul(t2,t2,t1);
wolfSSL 15:117db924cf7c 669 fe_sq(t3,t2); for (i = 1;i < 100;++i) fe_sq(t3,t3);
wolfSSL 15:117db924cf7c 670 fe_mul(t2,t3,t2);
wolfSSL 15:117db924cf7c 671 fe_sq(t2,t2); for (i = 1;i < 50;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 672 fe_mul(t1,t2,t1);
wolfSSL 15:117db924cf7c 673 fe_sq(t1,t1); for (i = 1;i < 5;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 674 fe_mul(out,t1,t0);
wolfSSL 15:117db924cf7c 675
wolfSSL 15:117db924cf7c 676 return;
wolfSSL 15:117db924cf7c 677 }
wolfSSL 15:117db924cf7c 678
wolfSSL 15:117db924cf7c 679
wolfSSL 15:117db924cf7c 680 /*
wolfSSL 15:117db924cf7c 681 h = f
wolfSSL 15:117db924cf7c 682 */
wolfSSL 15:117db924cf7c 683
wolfSSL 15:117db924cf7c 684 void fe_copy(fe h,const fe f)
wolfSSL 15:117db924cf7c 685 {
wolfSSL 15:117db924cf7c 686 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 687 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 688 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 689 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 690 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 691 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 692 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 693 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 694 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 695 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 696 h[0] = f0;
wolfSSL 15:117db924cf7c 697 h[1] = f1;
wolfSSL 15:117db924cf7c 698 h[2] = f2;
wolfSSL 15:117db924cf7c 699 h[3] = f3;
wolfSSL 15:117db924cf7c 700 h[4] = f4;
wolfSSL 15:117db924cf7c 701 h[5] = f5;
wolfSSL 15:117db924cf7c 702 h[6] = f6;
wolfSSL 15:117db924cf7c 703 h[7] = f7;
wolfSSL 15:117db924cf7c 704 h[8] = f8;
wolfSSL 15:117db924cf7c 705 h[9] = f9;
wolfSSL 15:117db924cf7c 706 }
wolfSSL 15:117db924cf7c 707
wolfSSL 15:117db924cf7c 708
wolfSSL 15:117db924cf7c 709 /*
wolfSSL 15:117db924cf7c 710 h = f * g
wolfSSL 15:117db924cf7c 711 Can overlap h with f or g.
wolfSSL 15:117db924cf7c 712
wolfSSL 15:117db924cf7c 713 Preconditions:
wolfSSL 15:117db924cf7c 714 |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
wolfSSL 15:117db924cf7c 715 |g| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
wolfSSL 15:117db924cf7c 716
wolfSSL 15:117db924cf7c 717 Postconditions:
wolfSSL 15:117db924cf7c 718 |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
wolfSSL 15:117db924cf7c 719 */
wolfSSL 15:117db924cf7c 720
wolfSSL 15:117db924cf7c 721 /*
wolfSSL 15:117db924cf7c 722 Notes on implementation strategy:
wolfSSL 15:117db924cf7c 723
wolfSSL 15:117db924cf7c 724 Using schoolbook multiplication.
wolfSSL 15:117db924cf7c 725 Karatsuba would save a little in some cost models.
wolfSSL 15:117db924cf7c 726
wolfSSL 15:117db924cf7c 727 Most multiplications by 2 and 19 are 32-bit precomputations;
wolfSSL 15:117db924cf7c 728 cheaper than 64-bit postcomputations.
wolfSSL 15:117db924cf7c 729
wolfSSL 15:117db924cf7c 730 There is one remaining multiplication by 19 in the carry chain;
wolfSSL 15:117db924cf7c 731 one *19 precomputation can be merged into this,
wolfSSL 15:117db924cf7c 732 but the resulting data flow is considerably less clean.
wolfSSL 15:117db924cf7c 733
wolfSSL 15:117db924cf7c 734 There are 12 carries below.
wolfSSL 15:117db924cf7c 735 10 of them are 2-way parallelizable and vectorizable.
wolfSSL 15:117db924cf7c 736 Can get away with 11 carries, but then data flow is much deeper.
wolfSSL 15:117db924cf7c 737
wolfSSL 15:117db924cf7c 738 With tighter constraints on inputs can squeeze carries into int32.
wolfSSL 15:117db924cf7c 739 */
wolfSSL 15:117db924cf7c 740
wolfSSL 15:117db924cf7c 741 void fe_mul(fe h,const fe f,const fe g)
wolfSSL 15:117db924cf7c 742 {
wolfSSL 15:117db924cf7c 743 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 744 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 745 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 746 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 747 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 748 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 749 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 750 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 751 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 752 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 753 int32_t g0 = g[0];
wolfSSL 15:117db924cf7c 754 int32_t g1 = g[1];
wolfSSL 15:117db924cf7c 755 int32_t g2 = g[2];
wolfSSL 15:117db924cf7c 756 int32_t g3 = g[3];
wolfSSL 15:117db924cf7c 757 int32_t g4 = g[4];
wolfSSL 15:117db924cf7c 758 int32_t g5 = g[5];
wolfSSL 15:117db924cf7c 759 int32_t g6 = g[6];
wolfSSL 15:117db924cf7c 760 int32_t g7 = g[7];
wolfSSL 15:117db924cf7c 761 int32_t g8 = g[8];
wolfSSL 15:117db924cf7c 762 int32_t g9 = g[9];
wolfSSL 15:117db924cf7c 763 int32_t g1_19 = 19 * g1; /* 1.959375*2^29 */
wolfSSL 15:117db924cf7c 764 int32_t g2_19 = 19 * g2; /* 1.959375*2^30; still ok */
wolfSSL 15:117db924cf7c 765 int32_t g3_19 = 19 * g3;
wolfSSL 15:117db924cf7c 766 int32_t g4_19 = 19 * g4;
wolfSSL 15:117db924cf7c 767 int32_t g5_19 = 19 * g5;
wolfSSL 15:117db924cf7c 768 int32_t g6_19 = 19 * g6;
wolfSSL 15:117db924cf7c 769 int32_t g7_19 = 19 * g7;
wolfSSL 15:117db924cf7c 770 int32_t g8_19 = 19 * g8;
wolfSSL 15:117db924cf7c 771 int32_t g9_19 = 19 * g9;
wolfSSL 15:117db924cf7c 772 int32_t f1_2 = 2 * f1;
wolfSSL 15:117db924cf7c 773 int32_t f3_2 = 2 * f3;
wolfSSL 15:117db924cf7c 774 int32_t f5_2 = 2 * f5;
wolfSSL 15:117db924cf7c 775 int32_t f7_2 = 2 * f7;
wolfSSL 15:117db924cf7c 776 int32_t f9_2 = 2 * f9;
wolfSSL 15:117db924cf7c 777 int64_t f0g0 = f0 * (int64_t) g0;
wolfSSL 15:117db924cf7c 778 int64_t f0g1 = f0 * (int64_t) g1;
wolfSSL 15:117db924cf7c 779 int64_t f0g2 = f0 * (int64_t) g2;
wolfSSL 15:117db924cf7c 780 int64_t f0g3 = f0 * (int64_t) g3;
wolfSSL 15:117db924cf7c 781 int64_t f0g4 = f0 * (int64_t) g4;
wolfSSL 15:117db924cf7c 782 int64_t f0g5 = f0 * (int64_t) g5;
wolfSSL 15:117db924cf7c 783 int64_t f0g6 = f0 * (int64_t) g6;
wolfSSL 15:117db924cf7c 784 int64_t f0g7 = f0 * (int64_t) g7;
wolfSSL 15:117db924cf7c 785 int64_t f0g8 = f0 * (int64_t) g8;
wolfSSL 15:117db924cf7c 786 int64_t f0g9 = f0 * (int64_t) g9;
wolfSSL 15:117db924cf7c 787 int64_t f1g0 = f1 * (int64_t) g0;
wolfSSL 15:117db924cf7c 788 int64_t f1g1_2 = f1_2 * (int64_t) g1;
wolfSSL 15:117db924cf7c 789 int64_t f1g2 = f1 * (int64_t) g2;
wolfSSL 15:117db924cf7c 790 int64_t f1g3_2 = f1_2 * (int64_t) g3;
wolfSSL 15:117db924cf7c 791 int64_t f1g4 = f1 * (int64_t) g4;
wolfSSL 15:117db924cf7c 792 int64_t f1g5_2 = f1_2 * (int64_t) g5;
wolfSSL 15:117db924cf7c 793 int64_t f1g6 = f1 * (int64_t) g6;
wolfSSL 15:117db924cf7c 794 int64_t f1g7_2 = f1_2 * (int64_t) g7;
wolfSSL 15:117db924cf7c 795 int64_t f1g8 = f1 * (int64_t) g8;
wolfSSL 15:117db924cf7c 796 int64_t f1g9_38 = f1_2 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 797 int64_t f2g0 = f2 * (int64_t) g0;
wolfSSL 15:117db924cf7c 798 int64_t f2g1 = f2 * (int64_t) g1;
wolfSSL 15:117db924cf7c 799 int64_t f2g2 = f2 * (int64_t) g2;
wolfSSL 15:117db924cf7c 800 int64_t f2g3 = f2 * (int64_t) g3;
wolfSSL 15:117db924cf7c 801 int64_t f2g4 = f2 * (int64_t) g4;
wolfSSL 15:117db924cf7c 802 int64_t f2g5 = f2 * (int64_t) g5;
wolfSSL 15:117db924cf7c 803 int64_t f2g6 = f2 * (int64_t) g6;
wolfSSL 15:117db924cf7c 804 int64_t f2g7 = f2 * (int64_t) g7;
wolfSSL 15:117db924cf7c 805 int64_t f2g8_19 = f2 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 806 int64_t f2g9_19 = f2 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 807 int64_t f3g0 = f3 * (int64_t) g0;
wolfSSL 15:117db924cf7c 808 int64_t f3g1_2 = f3_2 * (int64_t) g1;
wolfSSL 15:117db924cf7c 809 int64_t f3g2 = f3 * (int64_t) g2;
wolfSSL 15:117db924cf7c 810 int64_t f3g3_2 = f3_2 * (int64_t) g3;
wolfSSL 15:117db924cf7c 811 int64_t f3g4 = f3 * (int64_t) g4;
wolfSSL 15:117db924cf7c 812 int64_t f3g5_2 = f3_2 * (int64_t) g5;
wolfSSL 15:117db924cf7c 813 int64_t f3g6 = f3 * (int64_t) g6;
wolfSSL 15:117db924cf7c 814 int64_t f3g7_38 = f3_2 * (int64_t) g7_19;
wolfSSL 15:117db924cf7c 815 int64_t f3g8_19 = f3 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 816 int64_t f3g9_38 = f3_2 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 817 int64_t f4g0 = f4 * (int64_t) g0;
wolfSSL 15:117db924cf7c 818 int64_t f4g1 = f4 * (int64_t) g1;
wolfSSL 15:117db924cf7c 819 int64_t f4g2 = f4 * (int64_t) g2;
wolfSSL 15:117db924cf7c 820 int64_t f4g3 = f4 * (int64_t) g3;
wolfSSL 15:117db924cf7c 821 int64_t f4g4 = f4 * (int64_t) g4;
wolfSSL 15:117db924cf7c 822 int64_t f4g5 = f4 * (int64_t) g5;
wolfSSL 15:117db924cf7c 823 int64_t f4g6_19 = f4 * (int64_t) g6_19;
wolfSSL 15:117db924cf7c 824 int64_t f4g7_19 = f4 * (int64_t) g7_19;
wolfSSL 15:117db924cf7c 825 int64_t f4g8_19 = f4 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 826 int64_t f4g9_19 = f4 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 827 int64_t f5g0 = f5 * (int64_t) g0;
wolfSSL 15:117db924cf7c 828 int64_t f5g1_2 = f5_2 * (int64_t) g1;
wolfSSL 15:117db924cf7c 829 int64_t f5g2 = f5 * (int64_t) g2;
wolfSSL 15:117db924cf7c 830 int64_t f5g3_2 = f5_2 * (int64_t) g3;
wolfSSL 15:117db924cf7c 831 int64_t f5g4 = f5 * (int64_t) g4;
wolfSSL 15:117db924cf7c 832 int64_t f5g5_38 = f5_2 * (int64_t) g5_19;
wolfSSL 15:117db924cf7c 833 int64_t f5g6_19 = f5 * (int64_t) g6_19;
wolfSSL 15:117db924cf7c 834 int64_t f5g7_38 = f5_2 * (int64_t) g7_19;
wolfSSL 15:117db924cf7c 835 int64_t f5g8_19 = f5 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 836 int64_t f5g9_38 = f5_2 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 837 int64_t f6g0 = f6 * (int64_t) g0;
wolfSSL 15:117db924cf7c 838 int64_t f6g1 = f6 * (int64_t) g1;
wolfSSL 15:117db924cf7c 839 int64_t f6g2 = f6 * (int64_t) g2;
wolfSSL 15:117db924cf7c 840 int64_t f6g3 = f6 * (int64_t) g3;
wolfSSL 15:117db924cf7c 841 int64_t f6g4_19 = f6 * (int64_t) g4_19;
wolfSSL 15:117db924cf7c 842 int64_t f6g5_19 = f6 * (int64_t) g5_19;
wolfSSL 15:117db924cf7c 843 int64_t f6g6_19 = f6 * (int64_t) g6_19;
wolfSSL 15:117db924cf7c 844 int64_t f6g7_19 = f6 * (int64_t) g7_19;
wolfSSL 15:117db924cf7c 845 int64_t f6g8_19 = f6 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 846 int64_t f6g9_19 = f6 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 847 int64_t f7g0 = f7 * (int64_t) g0;
wolfSSL 15:117db924cf7c 848 int64_t f7g1_2 = f7_2 * (int64_t) g1;
wolfSSL 15:117db924cf7c 849 int64_t f7g2 = f7 * (int64_t) g2;
wolfSSL 15:117db924cf7c 850 int64_t f7g3_38 = f7_2 * (int64_t) g3_19;
wolfSSL 15:117db924cf7c 851 int64_t f7g4_19 = f7 * (int64_t) g4_19;
wolfSSL 15:117db924cf7c 852 int64_t f7g5_38 = f7_2 * (int64_t) g5_19;
wolfSSL 15:117db924cf7c 853 int64_t f7g6_19 = f7 * (int64_t) g6_19;
wolfSSL 15:117db924cf7c 854 int64_t f7g7_38 = f7_2 * (int64_t) g7_19;
wolfSSL 15:117db924cf7c 855 int64_t f7g8_19 = f7 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 856 int64_t f7g9_38 = f7_2 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 857 int64_t f8g0 = f8 * (int64_t) g0;
wolfSSL 15:117db924cf7c 858 int64_t f8g1 = f8 * (int64_t) g1;
wolfSSL 15:117db924cf7c 859 int64_t f8g2_19 = f8 * (int64_t) g2_19;
wolfSSL 15:117db924cf7c 860 int64_t f8g3_19 = f8 * (int64_t) g3_19;
wolfSSL 15:117db924cf7c 861 int64_t f8g4_19 = f8 * (int64_t) g4_19;
wolfSSL 15:117db924cf7c 862 int64_t f8g5_19 = f8 * (int64_t) g5_19;
wolfSSL 15:117db924cf7c 863 int64_t f8g6_19 = f8 * (int64_t) g6_19;
wolfSSL 15:117db924cf7c 864 int64_t f8g7_19 = f8 * (int64_t) g7_19;
wolfSSL 15:117db924cf7c 865 int64_t f8g8_19 = f8 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 866 int64_t f8g9_19 = f8 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 867 int64_t f9g0 = f9 * (int64_t) g0;
wolfSSL 15:117db924cf7c 868 int64_t f9g1_38 = f9_2 * (int64_t) g1_19;
wolfSSL 15:117db924cf7c 869 int64_t f9g2_19 = f9 * (int64_t) g2_19;
wolfSSL 15:117db924cf7c 870 int64_t f9g3_38 = f9_2 * (int64_t) g3_19;
wolfSSL 15:117db924cf7c 871 int64_t f9g4_19 = f9 * (int64_t) g4_19;
wolfSSL 15:117db924cf7c 872 int64_t f9g5_38 = f9_2 * (int64_t) g5_19;
wolfSSL 15:117db924cf7c 873 int64_t f9g6_19 = f9 * (int64_t) g6_19;
wolfSSL 15:117db924cf7c 874 int64_t f9g7_38 = f9_2 * (int64_t) g7_19;
wolfSSL 15:117db924cf7c 875 int64_t f9g8_19 = f9 * (int64_t) g8_19;
wolfSSL 15:117db924cf7c 876 int64_t f9g9_38 = f9_2 * (int64_t) g9_19;
wolfSSL 15:117db924cf7c 877 int64_t h0 = f0g0+f1g9_38+f2g8_19+f3g7_38+f4g6_19+f5g5_38+f6g4_19+f7g3_38+f8g2_19+f9g1_38;
wolfSSL 15:117db924cf7c 878 int64_t h1 = f0g1+f1g0 +f2g9_19+f3g8_19+f4g7_19+f5g6_19+f6g5_19+f7g4_19+f8g3_19+f9g2_19;
wolfSSL 15:117db924cf7c 879 int64_t h2 = f0g2+f1g1_2 +f2g0 +f3g9_38+f4g8_19+f5g7_38+f6g6_19+f7g5_38+f8g4_19+f9g3_38;
wolfSSL 15:117db924cf7c 880 int64_t h3 = f0g3+f1g2 +f2g1 +f3g0 +f4g9_19+f5g8_19+f6g7_19+f7g6_19+f8g5_19+f9g4_19;
wolfSSL 15:117db924cf7c 881 int64_t h4 = f0g4+f1g3_2 +f2g2 +f3g1_2 +f4g0 +f5g9_38+f6g8_19+f7g7_38+f8g6_19+f9g5_38;
wolfSSL 15:117db924cf7c 882 int64_t h5 = f0g5+f1g4 +f2g3 +f3g2 +f4g1 +f5g0 +f6g9_19+f7g8_19+f8g7_19+f9g6_19;
wolfSSL 15:117db924cf7c 883 int64_t h6 = f0g6+f1g5_2 +f2g4 +f3g3_2 +f4g2 +f5g1_2 +f6g0 +f7g9_38+f8g8_19+f9g7_38;
wolfSSL 15:117db924cf7c 884 int64_t h7 = f0g7+f1g6 +f2g5 +f3g4 +f4g3 +f5g2 +f6g1 +f7g0 +f8g9_19+f9g8_19;
wolfSSL 15:117db924cf7c 885 int64_t h8 = f0g8+f1g7_2 +f2g6 +f3g5_2 +f4g4 +f5g3_2 +f6g2 +f7g1_2 +f8g0 +f9g9_38;
wolfSSL 15:117db924cf7c 886 int64_t h9 = f0g9+f1g8 +f2g7 +f3g6 +f4g5 +f5g4 +f6g3 +f7g2 +f8g1 +f9g0 ;
wolfSSL 15:117db924cf7c 887 int64_t carry0;
wolfSSL 15:117db924cf7c 888 int64_t carry1;
wolfSSL 15:117db924cf7c 889 int64_t carry2;
wolfSSL 15:117db924cf7c 890 int64_t carry3;
wolfSSL 15:117db924cf7c 891 int64_t carry4;
wolfSSL 15:117db924cf7c 892 int64_t carry5;
wolfSSL 15:117db924cf7c 893 int64_t carry6;
wolfSSL 15:117db924cf7c 894 int64_t carry7;
wolfSSL 15:117db924cf7c 895 int64_t carry8;
wolfSSL 15:117db924cf7c 896 int64_t carry9;
wolfSSL 15:117db924cf7c 897
wolfSSL 15:117db924cf7c 898 /*
wolfSSL 15:117db924cf7c 899 |h0| <= (1.65*1.65*2^52*(1+19+19+19+19)+1.65*1.65*2^50*(38+38+38+38+38))
wolfSSL 15:117db924cf7c 900 i.e. |h0| <= 1.4*2^60; narrower ranges for h2, h4, h6, h8
wolfSSL 15:117db924cf7c 901 |h1| <= (1.65*1.65*2^51*(1+1+19+19+19+19+19+19+19+19))
wolfSSL 15:117db924cf7c 902 i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9
wolfSSL 15:117db924cf7c 903 */
wolfSSL 15:117db924cf7c 904
wolfSSL 15:117db924cf7c 905 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 906 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 907 /* |h0| <= 2^25 */
wolfSSL 15:117db924cf7c 908 /* |h4| <= 2^25 */
wolfSSL 15:117db924cf7c 909 /* |h1| <= 1.71*2^59 */
wolfSSL 15:117db924cf7c 910 /* |h5| <= 1.71*2^59 */
wolfSSL 15:117db924cf7c 911
wolfSSL 15:117db924cf7c 912 carry1 = (h1 + (int64_t) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
wolfSSL 15:117db924cf7c 913 carry5 = (h5 + (int64_t) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
wolfSSL 15:117db924cf7c 914 /* |h1| <= 2^24; from now on fits into int32 */
wolfSSL 15:117db924cf7c 915 /* |h5| <= 2^24; from now on fits into int32 */
wolfSSL 15:117db924cf7c 916 /* |h2| <= 1.41*2^60 */
wolfSSL 15:117db924cf7c 917 /* |h6| <= 1.41*2^60 */
wolfSSL 15:117db924cf7c 918
wolfSSL 15:117db924cf7c 919 carry2 = (h2 + (int64_t) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
wolfSSL 15:117db924cf7c 920 carry6 = (h6 + (int64_t) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
wolfSSL 15:117db924cf7c 921 /* |h2| <= 2^25; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 922 /* |h6| <= 2^25; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 923 /* |h3| <= 1.71*2^59 */
wolfSSL 15:117db924cf7c 924 /* |h7| <= 1.71*2^59 */
wolfSSL 15:117db924cf7c 925
wolfSSL 15:117db924cf7c 926 carry3 = (h3 + (int64_t) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
wolfSSL 15:117db924cf7c 927 carry7 = (h7 + (int64_t) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
wolfSSL 15:117db924cf7c 928 /* |h3| <= 2^24; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 929 /* |h7| <= 2^24; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 930 /* |h4| <= 1.72*2^34 */
wolfSSL 15:117db924cf7c 931 /* |h8| <= 1.41*2^60 */
wolfSSL 15:117db924cf7c 932
wolfSSL 15:117db924cf7c 933 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 934 carry8 = (h8 + (int64_t) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
wolfSSL 15:117db924cf7c 935 /* |h4| <= 2^25; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 936 /* |h8| <= 2^25; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 937 /* |h5| <= 1.01*2^24 */
wolfSSL 15:117db924cf7c 938 /* |h9| <= 1.71*2^59 */
wolfSSL 15:117db924cf7c 939
wolfSSL 15:117db924cf7c 940 carry9 = (h9 + (int64_t) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
wolfSSL 15:117db924cf7c 941 /* |h9| <= 2^24; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 942 /* |h0| <= 1.1*2^39 */
wolfSSL 15:117db924cf7c 943
wolfSSL 15:117db924cf7c 944 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 945 /* |h0| <= 2^25; from now on fits into int32 unchanged */
wolfSSL 15:117db924cf7c 946 /* |h1| <= 1.01*2^24 */
wolfSSL 15:117db924cf7c 947
wolfSSL 15:117db924cf7c 948 h[0] = (int32_t)h0;
wolfSSL 15:117db924cf7c 949 h[1] = (int32_t)h1;
wolfSSL 15:117db924cf7c 950 h[2] = (int32_t)h2;
wolfSSL 15:117db924cf7c 951 h[3] = (int32_t)h3;
wolfSSL 15:117db924cf7c 952 h[4] = (int32_t)h4;
wolfSSL 15:117db924cf7c 953 h[5] = (int32_t)h5;
wolfSSL 15:117db924cf7c 954 h[6] = (int32_t)h6;
wolfSSL 15:117db924cf7c 955 h[7] = (int32_t)h7;
wolfSSL 15:117db924cf7c 956 h[8] = (int32_t)h8;
wolfSSL 15:117db924cf7c 957 h[9] = (int32_t)h9;
wolfSSL 15:117db924cf7c 958 }
wolfSSL 15:117db924cf7c 959
wolfSSL 15:117db924cf7c 960
wolfSSL 15:117db924cf7c 961 /*
wolfSSL 15:117db924cf7c 962 Replace (f,g) with (g,f) if b == 1;
wolfSSL 15:117db924cf7c 963 replace (f,g) with (f,g) if b == 0.
wolfSSL 15:117db924cf7c 964
wolfSSL 15:117db924cf7c 965 Preconditions: b in {0,1}.
wolfSSL 15:117db924cf7c 966 */
wolfSSL 15:117db924cf7c 967
wolfSSL 15:117db924cf7c 968 void fe_cswap(fe f, fe g, int b)
wolfSSL 15:117db924cf7c 969 {
wolfSSL 15:117db924cf7c 970 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 971 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 972 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 973 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 974 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 975 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 976 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 977 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 978 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 979 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 980 int32_t g0 = g[0];
wolfSSL 15:117db924cf7c 981 int32_t g1 = g[1];
wolfSSL 15:117db924cf7c 982 int32_t g2 = g[2];
wolfSSL 15:117db924cf7c 983 int32_t g3 = g[3];
wolfSSL 15:117db924cf7c 984 int32_t g4 = g[4];
wolfSSL 15:117db924cf7c 985 int32_t g5 = g[5];
wolfSSL 15:117db924cf7c 986 int32_t g6 = g[6];
wolfSSL 15:117db924cf7c 987 int32_t g7 = g[7];
wolfSSL 15:117db924cf7c 988 int32_t g8 = g[8];
wolfSSL 15:117db924cf7c 989 int32_t g9 = g[9];
wolfSSL 15:117db924cf7c 990 int32_t x0 = f0 ^ g0;
wolfSSL 15:117db924cf7c 991 int32_t x1 = f1 ^ g1;
wolfSSL 15:117db924cf7c 992 int32_t x2 = f2 ^ g2;
wolfSSL 15:117db924cf7c 993 int32_t x3 = f3 ^ g3;
wolfSSL 15:117db924cf7c 994 int32_t x4 = f4 ^ g4;
wolfSSL 15:117db924cf7c 995 int32_t x5 = f5 ^ g5;
wolfSSL 15:117db924cf7c 996 int32_t x6 = f6 ^ g6;
wolfSSL 15:117db924cf7c 997 int32_t x7 = f7 ^ g7;
wolfSSL 15:117db924cf7c 998 int32_t x8 = f8 ^ g8;
wolfSSL 15:117db924cf7c 999 int32_t x9 = f9 ^ g9;
wolfSSL 15:117db924cf7c 1000 b = -b;
wolfSSL 15:117db924cf7c 1001 x0 &= b;
wolfSSL 15:117db924cf7c 1002 x1 &= b;
wolfSSL 15:117db924cf7c 1003 x2 &= b;
wolfSSL 15:117db924cf7c 1004 x3 &= b;
wolfSSL 15:117db924cf7c 1005 x4 &= b;
wolfSSL 15:117db924cf7c 1006 x5 &= b;
wolfSSL 15:117db924cf7c 1007 x6 &= b;
wolfSSL 15:117db924cf7c 1008 x7 &= b;
wolfSSL 15:117db924cf7c 1009 x8 &= b;
wolfSSL 15:117db924cf7c 1010 x9 &= b;
wolfSSL 15:117db924cf7c 1011 f[0] = f0 ^ x0;
wolfSSL 15:117db924cf7c 1012 f[1] = f1 ^ x1;
wolfSSL 15:117db924cf7c 1013 f[2] = f2 ^ x2;
wolfSSL 15:117db924cf7c 1014 f[3] = f3 ^ x3;
wolfSSL 15:117db924cf7c 1015 f[4] = f4 ^ x4;
wolfSSL 15:117db924cf7c 1016 f[5] = f5 ^ x5;
wolfSSL 15:117db924cf7c 1017 f[6] = f6 ^ x6;
wolfSSL 15:117db924cf7c 1018 f[7] = f7 ^ x7;
wolfSSL 15:117db924cf7c 1019 f[8] = f8 ^ x8;
wolfSSL 15:117db924cf7c 1020 f[9] = f9 ^ x9;
wolfSSL 15:117db924cf7c 1021 g[0] = g0 ^ x0;
wolfSSL 15:117db924cf7c 1022 g[1] = g1 ^ x1;
wolfSSL 15:117db924cf7c 1023 g[2] = g2 ^ x2;
wolfSSL 15:117db924cf7c 1024 g[3] = g3 ^ x3;
wolfSSL 15:117db924cf7c 1025 g[4] = g4 ^ x4;
wolfSSL 15:117db924cf7c 1026 g[5] = g5 ^ x5;
wolfSSL 15:117db924cf7c 1027 g[6] = g6 ^ x6;
wolfSSL 15:117db924cf7c 1028 g[7] = g7 ^ x7;
wolfSSL 15:117db924cf7c 1029 g[8] = g8 ^ x8;
wolfSSL 15:117db924cf7c 1030 g[9] = g9 ^ x9;
wolfSSL 15:117db924cf7c 1031 }
wolfSSL 15:117db924cf7c 1032
wolfSSL 15:117db924cf7c 1033
wolfSSL 15:117db924cf7c 1034 /*
wolfSSL 15:117db924cf7c 1035 h = f * 121666
wolfSSL 15:117db924cf7c 1036 Can overlap h with f.
wolfSSL 15:117db924cf7c 1037
wolfSSL 15:117db924cf7c 1038 Preconditions:
wolfSSL 15:117db924cf7c 1039 |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
wolfSSL 15:117db924cf7c 1040
wolfSSL 15:117db924cf7c 1041 Postconditions:
wolfSSL 15:117db924cf7c 1042 |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
wolfSSL 15:117db924cf7c 1043 */
wolfSSL 15:117db924cf7c 1044
wolfSSL 15:117db924cf7c 1045 void fe_mul121666(fe h,fe f)
wolfSSL 15:117db924cf7c 1046 {
wolfSSL 15:117db924cf7c 1047 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 1048 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 1049 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 1050 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 1051 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 1052 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 1053 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 1054 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 1055 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 1056 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 1057 int64_t h0 = f0 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1058 int64_t h1 = f1 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1059 int64_t h2 = f2 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1060 int64_t h3 = f3 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1061 int64_t h4 = f4 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1062 int64_t h5 = f5 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1063 int64_t h6 = f6 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1064 int64_t h7 = f7 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1065 int64_t h8 = f8 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1066 int64_t h9 = f9 * (int64_t) 121666;
wolfSSL 15:117db924cf7c 1067 int64_t carry0;
wolfSSL 15:117db924cf7c 1068 int64_t carry1;
wolfSSL 15:117db924cf7c 1069 int64_t carry2;
wolfSSL 15:117db924cf7c 1070 int64_t carry3;
wolfSSL 15:117db924cf7c 1071 int64_t carry4;
wolfSSL 15:117db924cf7c 1072 int64_t carry5;
wolfSSL 15:117db924cf7c 1073 int64_t carry6;
wolfSSL 15:117db924cf7c 1074 int64_t carry7;
wolfSSL 15:117db924cf7c 1075 int64_t carry8;
wolfSSL 15:117db924cf7c 1076 int64_t carry9;
wolfSSL 15:117db924cf7c 1077
wolfSSL 15:117db924cf7c 1078 carry9 = (h9 + (int64_t) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
wolfSSL 15:117db924cf7c 1079 carry1 = (h1 + (int64_t) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
wolfSSL 15:117db924cf7c 1080 carry3 = (h3 + (int64_t) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
wolfSSL 15:117db924cf7c 1081 carry5 = (h5 + (int64_t) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
wolfSSL 15:117db924cf7c 1082 carry7 = (h7 + (int64_t) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
wolfSSL 15:117db924cf7c 1083
wolfSSL 15:117db924cf7c 1084 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 1085 carry2 = (h2 + (int64_t) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
wolfSSL 15:117db924cf7c 1086 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 1087 carry6 = (h6 + (int64_t) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
wolfSSL 15:117db924cf7c 1088 carry8 = (h8 + (int64_t) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
wolfSSL 15:117db924cf7c 1089
wolfSSL 15:117db924cf7c 1090 h[0] = (int32_t)h0;
wolfSSL 15:117db924cf7c 1091 h[1] = (int32_t)h1;
wolfSSL 15:117db924cf7c 1092 h[2] = (int32_t)h2;
wolfSSL 15:117db924cf7c 1093 h[3] = (int32_t)h3;
wolfSSL 15:117db924cf7c 1094 h[4] = (int32_t)h4;
wolfSSL 15:117db924cf7c 1095 h[5] = (int32_t)h5;
wolfSSL 15:117db924cf7c 1096 h[6] = (int32_t)h6;
wolfSSL 15:117db924cf7c 1097 h[7] = (int32_t)h7;
wolfSSL 15:117db924cf7c 1098 h[8] = (int32_t)h8;
wolfSSL 15:117db924cf7c 1099 h[9] = (int32_t)h9;
wolfSSL 15:117db924cf7c 1100 }
wolfSSL 15:117db924cf7c 1101
wolfSSL 15:117db924cf7c 1102
wolfSSL 15:117db924cf7c 1103 /*
wolfSSL 15:117db924cf7c 1104 h = 2 * f * f
wolfSSL 15:117db924cf7c 1105 Can overlap h with f.
wolfSSL 15:117db924cf7c 1106
wolfSSL 15:117db924cf7c 1107 Preconditions:
wolfSSL 15:117db924cf7c 1108 |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
wolfSSL 15:117db924cf7c 1109
wolfSSL 15:117db924cf7c 1110 Postconditions:
wolfSSL 15:117db924cf7c 1111 |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
wolfSSL 15:117db924cf7c 1112 */
wolfSSL 15:117db924cf7c 1113
wolfSSL 15:117db924cf7c 1114 /*
wolfSSL 15:117db924cf7c 1115 See fe_mul.c for discussion of implementation strategy.
wolfSSL 15:117db924cf7c 1116 */
wolfSSL 15:117db924cf7c 1117
wolfSSL 15:117db924cf7c 1118 void fe_sq2(fe h,const fe f)
wolfSSL 15:117db924cf7c 1119 {
wolfSSL 15:117db924cf7c 1120 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 1121 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 1122 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 1123 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 1124 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 1125 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 1126 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 1127 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 1128 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 1129 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 1130 int32_t f0_2 = 2 * f0;
wolfSSL 15:117db924cf7c 1131 int32_t f1_2 = 2 * f1;
wolfSSL 15:117db924cf7c 1132 int32_t f2_2 = 2 * f2;
wolfSSL 15:117db924cf7c 1133 int32_t f3_2 = 2 * f3;
wolfSSL 15:117db924cf7c 1134 int32_t f4_2 = 2 * f4;
wolfSSL 15:117db924cf7c 1135 int32_t f5_2 = 2 * f5;
wolfSSL 15:117db924cf7c 1136 int32_t f6_2 = 2 * f6;
wolfSSL 15:117db924cf7c 1137 int32_t f7_2 = 2 * f7;
wolfSSL 15:117db924cf7c 1138 int32_t f5_38 = 38 * f5; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 1139 int32_t f6_19 = 19 * f6; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 1140 int32_t f7_38 = 38 * f7; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 1141 int32_t f8_19 = 19 * f8; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 1142 int32_t f9_38 = 38 * f9; /* 1.959375*2^30 */
wolfSSL 15:117db924cf7c 1143 int64_t f0f0 = f0 * (int64_t) f0;
wolfSSL 15:117db924cf7c 1144 int64_t f0f1_2 = f0_2 * (int64_t) f1;
wolfSSL 15:117db924cf7c 1145 int64_t f0f2_2 = f0_2 * (int64_t) f2;
wolfSSL 15:117db924cf7c 1146 int64_t f0f3_2 = f0_2 * (int64_t) f3;
wolfSSL 15:117db924cf7c 1147 int64_t f0f4_2 = f0_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 1148 int64_t f0f5_2 = f0_2 * (int64_t) f5;
wolfSSL 15:117db924cf7c 1149 int64_t f0f6_2 = f0_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 1150 int64_t f0f7_2 = f0_2 * (int64_t) f7;
wolfSSL 15:117db924cf7c 1151 int64_t f0f8_2 = f0_2 * (int64_t) f8;
wolfSSL 15:117db924cf7c 1152 int64_t f0f9_2 = f0_2 * (int64_t) f9;
wolfSSL 15:117db924cf7c 1153 int64_t f1f1_2 = f1_2 * (int64_t) f1;
wolfSSL 15:117db924cf7c 1154 int64_t f1f2_2 = f1_2 * (int64_t) f2;
wolfSSL 15:117db924cf7c 1155 int64_t f1f3_4 = f1_2 * (int64_t) f3_2;
wolfSSL 15:117db924cf7c 1156 int64_t f1f4_2 = f1_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 1157 int64_t f1f5_4 = f1_2 * (int64_t) f5_2;
wolfSSL 15:117db924cf7c 1158 int64_t f1f6_2 = f1_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 1159 int64_t f1f7_4 = f1_2 * (int64_t) f7_2;
wolfSSL 15:117db924cf7c 1160 int64_t f1f8_2 = f1_2 * (int64_t) f8;
wolfSSL 15:117db924cf7c 1161 int64_t f1f9_76 = f1_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1162 int64_t f2f2 = f2 * (int64_t) f2;
wolfSSL 15:117db924cf7c 1163 int64_t f2f3_2 = f2_2 * (int64_t) f3;
wolfSSL 15:117db924cf7c 1164 int64_t f2f4_2 = f2_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 1165 int64_t f2f5_2 = f2_2 * (int64_t) f5;
wolfSSL 15:117db924cf7c 1166 int64_t f2f6_2 = f2_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 1167 int64_t f2f7_2 = f2_2 * (int64_t) f7;
wolfSSL 15:117db924cf7c 1168 int64_t f2f8_38 = f2_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 1169 int64_t f2f9_38 = f2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1170 int64_t f3f3_2 = f3_2 * (int64_t) f3;
wolfSSL 15:117db924cf7c 1171 int64_t f3f4_2 = f3_2 * (int64_t) f4;
wolfSSL 15:117db924cf7c 1172 int64_t f3f5_4 = f3_2 * (int64_t) f5_2;
wolfSSL 15:117db924cf7c 1173 int64_t f3f6_2 = f3_2 * (int64_t) f6;
wolfSSL 15:117db924cf7c 1174 int64_t f3f7_76 = f3_2 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 1175 int64_t f3f8_38 = f3_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 1176 int64_t f3f9_76 = f3_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1177 int64_t f4f4 = f4 * (int64_t) f4;
wolfSSL 15:117db924cf7c 1178 int64_t f4f5_2 = f4_2 * (int64_t) f5;
wolfSSL 15:117db924cf7c 1179 int64_t f4f6_38 = f4_2 * (int64_t) f6_19;
wolfSSL 15:117db924cf7c 1180 int64_t f4f7_38 = f4 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 1181 int64_t f4f8_38 = f4_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 1182 int64_t f4f9_38 = f4 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1183 int64_t f5f5_38 = f5 * (int64_t) f5_38;
wolfSSL 15:117db924cf7c 1184 int64_t f5f6_38 = f5_2 * (int64_t) f6_19;
wolfSSL 15:117db924cf7c 1185 int64_t f5f7_76 = f5_2 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 1186 int64_t f5f8_38 = f5_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 1187 int64_t f5f9_76 = f5_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1188 int64_t f6f6_19 = f6 * (int64_t) f6_19;
wolfSSL 15:117db924cf7c 1189 int64_t f6f7_38 = f6 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 1190 int64_t f6f8_38 = f6_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 1191 int64_t f6f9_38 = f6 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1192 int64_t f7f7_38 = f7 * (int64_t) f7_38;
wolfSSL 15:117db924cf7c 1193 int64_t f7f8_38 = f7_2 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 1194 int64_t f7f9_76 = f7_2 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1195 int64_t f8f8_19 = f8 * (int64_t) f8_19;
wolfSSL 15:117db924cf7c 1196 int64_t f8f9_38 = f8 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1197 int64_t f9f9_38 = f9 * (int64_t) f9_38;
wolfSSL 15:117db924cf7c 1198 int64_t h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
wolfSSL 15:117db924cf7c 1199 int64_t h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
wolfSSL 15:117db924cf7c 1200 int64_t h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
wolfSSL 15:117db924cf7c 1201 int64_t h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
wolfSSL 15:117db924cf7c 1202 int64_t h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
wolfSSL 15:117db924cf7c 1203 int64_t h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
wolfSSL 15:117db924cf7c 1204 int64_t h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
wolfSSL 15:117db924cf7c 1205 int64_t h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
wolfSSL 15:117db924cf7c 1206 int64_t h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
wolfSSL 15:117db924cf7c 1207 int64_t h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
wolfSSL 15:117db924cf7c 1208 int64_t carry0;
wolfSSL 15:117db924cf7c 1209 int64_t carry1;
wolfSSL 15:117db924cf7c 1210 int64_t carry2;
wolfSSL 15:117db924cf7c 1211 int64_t carry3;
wolfSSL 15:117db924cf7c 1212 int64_t carry4;
wolfSSL 15:117db924cf7c 1213 int64_t carry5;
wolfSSL 15:117db924cf7c 1214 int64_t carry6;
wolfSSL 15:117db924cf7c 1215 int64_t carry7;
wolfSSL 15:117db924cf7c 1216 int64_t carry8;
wolfSSL 15:117db924cf7c 1217 int64_t carry9;
wolfSSL 15:117db924cf7c 1218
wolfSSL 15:117db924cf7c 1219 h0 += h0;
wolfSSL 15:117db924cf7c 1220 h1 += h1;
wolfSSL 15:117db924cf7c 1221 h2 += h2;
wolfSSL 15:117db924cf7c 1222 h3 += h3;
wolfSSL 15:117db924cf7c 1223 h4 += h4;
wolfSSL 15:117db924cf7c 1224 h5 += h5;
wolfSSL 15:117db924cf7c 1225 h6 += h6;
wolfSSL 15:117db924cf7c 1226 h7 += h7;
wolfSSL 15:117db924cf7c 1227 h8 += h8;
wolfSSL 15:117db924cf7c 1228 h9 += h9;
wolfSSL 15:117db924cf7c 1229
wolfSSL 15:117db924cf7c 1230 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 1231 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 1232
wolfSSL 15:117db924cf7c 1233 carry1 = (h1 + (int64_t) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
wolfSSL 15:117db924cf7c 1234 carry5 = (h5 + (int64_t) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
wolfSSL 15:117db924cf7c 1235
wolfSSL 15:117db924cf7c 1236 carry2 = (h2 + (int64_t) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
wolfSSL 15:117db924cf7c 1237 carry6 = (h6 + (int64_t) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
wolfSSL 15:117db924cf7c 1238
wolfSSL 15:117db924cf7c 1239 carry3 = (h3 + (int64_t) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
wolfSSL 15:117db924cf7c 1240 carry7 = (h7 + (int64_t) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
wolfSSL 15:117db924cf7c 1241
wolfSSL 15:117db924cf7c 1242 carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
wolfSSL 15:117db924cf7c 1243 carry8 = (h8 + (int64_t) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
wolfSSL 15:117db924cf7c 1244
wolfSSL 15:117db924cf7c 1245 carry9 = (h9 + (int64_t) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
wolfSSL 15:117db924cf7c 1246
wolfSSL 15:117db924cf7c 1247 carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
wolfSSL 15:117db924cf7c 1248
wolfSSL 15:117db924cf7c 1249 h[0] = (int32_t)h0;
wolfSSL 15:117db924cf7c 1250 h[1] = (int32_t)h1;
wolfSSL 15:117db924cf7c 1251 h[2] = (int32_t)h2;
wolfSSL 15:117db924cf7c 1252 h[3] = (int32_t)h3;
wolfSSL 15:117db924cf7c 1253 h[4] = (int32_t)h4;
wolfSSL 15:117db924cf7c 1254 h[5] = (int32_t)h5;
wolfSSL 15:117db924cf7c 1255 h[6] = (int32_t)h6;
wolfSSL 15:117db924cf7c 1256 h[7] = (int32_t)h7;
wolfSSL 15:117db924cf7c 1257 h[8] = (int32_t)h8;
wolfSSL 15:117db924cf7c 1258 h[9] = (int32_t)h9;
wolfSSL 15:117db924cf7c 1259 }
wolfSSL 15:117db924cf7c 1260
wolfSSL 15:117db924cf7c 1261
wolfSSL 15:117db924cf7c 1262 void fe_pow22523(fe out,const fe z)
wolfSSL 15:117db924cf7c 1263 {
wolfSSL 15:117db924cf7c 1264 fe t0;
wolfSSL 15:117db924cf7c 1265 fe t1;
wolfSSL 15:117db924cf7c 1266 fe t2;
wolfSSL 15:117db924cf7c 1267 int i;
wolfSSL 15:117db924cf7c 1268
wolfSSL 15:117db924cf7c 1269 fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
wolfSSL 15:117db924cf7c 1270 fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 1271 fe_mul(t1,z,t1);
wolfSSL 15:117db924cf7c 1272 fe_mul(t0,t0,t1);
wolfSSL 15:117db924cf7c 1273 fe_sq(t0,t0); for (i = 1;i < 1;++i) fe_sq(t0,t0);
wolfSSL 15:117db924cf7c 1274 fe_mul(t0,t1,t0);
wolfSSL 15:117db924cf7c 1275 fe_sq(t1,t0); for (i = 1;i < 5;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 1276 fe_mul(t0,t1,t0);
wolfSSL 15:117db924cf7c 1277 fe_sq(t1,t0); for (i = 1;i < 10;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 1278 fe_mul(t1,t1,t0);
wolfSSL 15:117db924cf7c 1279 fe_sq(t2,t1); for (i = 1;i < 20;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 1280 fe_mul(t1,t2,t1);
wolfSSL 15:117db924cf7c 1281 fe_sq(t1,t1); for (i = 1;i < 10;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 1282 fe_mul(t0,t1,t0);
wolfSSL 15:117db924cf7c 1283 fe_sq(t1,t0); for (i = 1;i < 50;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 1284 fe_mul(t1,t1,t0);
wolfSSL 15:117db924cf7c 1285 fe_sq(t2,t1); for (i = 1;i < 100;++i) fe_sq(t2,t2);
wolfSSL 15:117db924cf7c 1286 fe_mul(t1,t2,t1);
wolfSSL 15:117db924cf7c 1287 fe_sq(t1,t1); for (i = 1;i < 50;++i) fe_sq(t1,t1);
wolfSSL 15:117db924cf7c 1288 fe_mul(t0,t1,t0);
wolfSSL 15:117db924cf7c 1289 fe_sq(t0,t0); for (i = 1;i < 2;++i) fe_sq(t0,t0);
wolfSSL 15:117db924cf7c 1290 fe_mul(out,t0,z);
wolfSSL 15:117db924cf7c 1291
wolfSSL 15:117db924cf7c 1292 return;
wolfSSL 15:117db924cf7c 1293 }
wolfSSL 15:117db924cf7c 1294
wolfSSL 15:117db924cf7c 1295
wolfSSL 15:117db924cf7c 1296 /*
wolfSSL 15:117db924cf7c 1297 h = -f
wolfSSL 15:117db924cf7c 1298
wolfSSL 15:117db924cf7c 1299 Preconditions:
wolfSSL 15:117db924cf7c 1300 |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
wolfSSL 15:117db924cf7c 1301
wolfSSL 15:117db924cf7c 1302 Postconditions:
wolfSSL 15:117db924cf7c 1303 |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
wolfSSL 15:117db924cf7c 1304 */
wolfSSL 15:117db924cf7c 1305
wolfSSL 15:117db924cf7c 1306 void fe_neg(fe h,const fe f)
wolfSSL 15:117db924cf7c 1307 {
wolfSSL 15:117db924cf7c 1308 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 1309 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 1310 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 1311 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 1312 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 1313 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 1314 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 1315 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 1316 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 1317 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 1318 int32_t h0 = -f0;
wolfSSL 15:117db924cf7c 1319 int32_t h1 = -f1;
wolfSSL 15:117db924cf7c 1320 int32_t h2 = -f2;
wolfSSL 15:117db924cf7c 1321 int32_t h3 = -f3;
wolfSSL 15:117db924cf7c 1322 int32_t h4 = -f4;
wolfSSL 15:117db924cf7c 1323 int32_t h5 = -f5;
wolfSSL 15:117db924cf7c 1324 int32_t h6 = -f6;
wolfSSL 15:117db924cf7c 1325 int32_t h7 = -f7;
wolfSSL 15:117db924cf7c 1326 int32_t h8 = -f8;
wolfSSL 15:117db924cf7c 1327 int32_t h9 = -f9;
wolfSSL 15:117db924cf7c 1328 h[0] = h0;
wolfSSL 15:117db924cf7c 1329 h[1] = h1;
wolfSSL 15:117db924cf7c 1330 h[2] = h2;
wolfSSL 15:117db924cf7c 1331 h[3] = h3;
wolfSSL 15:117db924cf7c 1332 h[4] = h4;
wolfSSL 15:117db924cf7c 1333 h[5] = h5;
wolfSSL 15:117db924cf7c 1334 h[6] = h6;
wolfSSL 15:117db924cf7c 1335 h[7] = h7;
wolfSSL 15:117db924cf7c 1336 h[8] = h8;
wolfSSL 15:117db924cf7c 1337 h[9] = h9;
wolfSSL 15:117db924cf7c 1338 }
wolfSSL 15:117db924cf7c 1339
wolfSSL 15:117db924cf7c 1340
wolfSSL 15:117db924cf7c 1341 /*
wolfSSL 15:117db924cf7c 1342 Preconditions:
wolfSSL 15:117db924cf7c 1343 |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
wolfSSL 15:117db924cf7c 1344 */
wolfSSL 15:117db924cf7c 1345
wolfSSL 15:117db924cf7c 1346 static const unsigned char zero[32] = {0};
wolfSSL 15:117db924cf7c 1347
wolfSSL 15:117db924cf7c 1348 int fe_isnonzero(const fe f)
wolfSSL 15:117db924cf7c 1349 {
wolfSSL 15:117db924cf7c 1350 unsigned char s[32];
wolfSSL 15:117db924cf7c 1351 fe_tobytes(s,f);
wolfSSL 15:117db924cf7c 1352 return ConstantCompare(s,zero,32);
wolfSSL 15:117db924cf7c 1353 }
wolfSSL 15:117db924cf7c 1354
wolfSSL 15:117db924cf7c 1355
wolfSSL 15:117db924cf7c 1356 /*
wolfSSL 15:117db924cf7c 1357 return 1 if f is in {1,3,5,...,q-2}
wolfSSL 15:117db924cf7c 1358 return 0 if f is in {0,2,4,...,q-1}
wolfSSL 15:117db924cf7c 1359
wolfSSL 15:117db924cf7c 1360 Preconditions:
wolfSSL 15:117db924cf7c 1361 |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
wolfSSL 15:117db924cf7c 1362 */
wolfSSL 15:117db924cf7c 1363
wolfSSL 15:117db924cf7c 1364 int fe_isnegative(const fe f)
wolfSSL 15:117db924cf7c 1365 {
wolfSSL 15:117db924cf7c 1366 unsigned char s[32];
wolfSSL 15:117db924cf7c 1367 fe_tobytes(s,f);
wolfSSL 15:117db924cf7c 1368 return s[0] & 1;
wolfSSL 15:117db924cf7c 1369 }
wolfSSL 15:117db924cf7c 1370
wolfSSL 15:117db924cf7c 1371
wolfSSL 15:117db924cf7c 1372 /*
wolfSSL 15:117db924cf7c 1373 Replace (f,g) with (g,g) if b == 1;
wolfSSL 15:117db924cf7c 1374 replace (f,g) with (f,g) if b == 0.
wolfSSL 15:117db924cf7c 1375
wolfSSL 15:117db924cf7c 1376 Preconditions: b in {0,1}.
wolfSSL 15:117db924cf7c 1377 */
wolfSSL 15:117db924cf7c 1378
wolfSSL 15:117db924cf7c 1379 void fe_cmov(fe f, const fe g, int b)
wolfSSL 15:117db924cf7c 1380 {
wolfSSL 15:117db924cf7c 1381 int32_t f0 = f[0];
wolfSSL 15:117db924cf7c 1382 int32_t f1 = f[1];
wolfSSL 15:117db924cf7c 1383 int32_t f2 = f[2];
wolfSSL 15:117db924cf7c 1384 int32_t f3 = f[3];
wolfSSL 15:117db924cf7c 1385 int32_t f4 = f[4];
wolfSSL 15:117db924cf7c 1386 int32_t f5 = f[5];
wolfSSL 15:117db924cf7c 1387 int32_t f6 = f[6];
wolfSSL 15:117db924cf7c 1388 int32_t f7 = f[7];
wolfSSL 15:117db924cf7c 1389 int32_t f8 = f[8];
wolfSSL 15:117db924cf7c 1390 int32_t f9 = f[9];
wolfSSL 15:117db924cf7c 1391 int32_t g0 = g[0];
wolfSSL 15:117db924cf7c 1392 int32_t g1 = g[1];
wolfSSL 15:117db924cf7c 1393 int32_t g2 = g[2];
wolfSSL 15:117db924cf7c 1394 int32_t g3 = g[3];
wolfSSL 15:117db924cf7c 1395 int32_t g4 = g[4];
wolfSSL 15:117db924cf7c 1396 int32_t g5 = g[5];
wolfSSL 15:117db924cf7c 1397 int32_t g6 = g[6];
wolfSSL 15:117db924cf7c 1398 int32_t g7 = g[7];
wolfSSL 15:117db924cf7c 1399 int32_t g8 = g[8];
wolfSSL 15:117db924cf7c 1400 int32_t g9 = g[9];
wolfSSL 15:117db924cf7c 1401 int32_t x0 = f0 ^ g0;
wolfSSL 15:117db924cf7c 1402 int32_t x1 = f1 ^ g1;
wolfSSL 15:117db924cf7c 1403 int32_t x2 = f2 ^ g2;
wolfSSL 15:117db924cf7c 1404 int32_t x3 = f3 ^ g3;
wolfSSL 15:117db924cf7c 1405 int32_t x4 = f4 ^ g4;
wolfSSL 15:117db924cf7c 1406 int32_t x5 = f5 ^ g5;
wolfSSL 15:117db924cf7c 1407 int32_t x6 = f6 ^ g6;
wolfSSL 15:117db924cf7c 1408 int32_t x7 = f7 ^ g7;
wolfSSL 15:117db924cf7c 1409 int32_t x8 = f8 ^ g8;
wolfSSL 15:117db924cf7c 1410 int32_t x9 = f9 ^ g9;
wolfSSL 15:117db924cf7c 1411 b = -b;
wolfSSL 15:117db924cf7c 1412 x0 &= b;
wolfSSL 15:117db924cf7c 1413 x1 &= b;
wolfSSL 15:117db924cf7c 1414 x2 &= b;
wolfSSL 15:117db924cf7c 1415 x3 &= b;
wolfSSL 15:117db924cf7c 1416 x4 &= b;
wolfSSL 15:117db924cf7c 1417 x5 &= b;
wolfSSL 15:117db924cf7c 1418 x6 &= b;
wolfSSL 15:117db924cf7c 1419 x7 &= b;
wolfSSL 15:117db924cf7c 1420 x8 &= b;
wolfSSL 15:117db924cf7c 1421 x9 &= b;
wolfSSL 15:117db924cf7c 1422 f[0] = f0 ^ x0;
wolfSSL 15:117db924cf7c 1423 f[1] = f1 ^ x1;
wolfSSL 15:117db924cf7c 1424 f[2] = f2 ^ x2;
wolfSSL 15:117db924cf7c 1425 f[3] = f3 ^ x3;
wolfSSL 15:117db924cf7c 1426 f[4] = f4 ^ x4;
wolfSSL 15:117db924cf7c 1427 f[5] = f5 ^ x5;
wolfSSL 15:117db924cf7c 1428 f[6] = f6 ^ x6;
wolfSSL 15:117db924cf7c 1429 f[7] = f7 ^ x7;
wolfSSL 15:117db924cf7c 1430 f[8] = f8 ^ x8;
wolfSSL 15:117db924cf7c 1431 f[9] = f9 ^ x9;
wolfSSL 15:117db924cf7c 1432 }
wolfSSL 15:117db924cf7c 1433 #endif
wolfSSL 15:117db924cf7c 1434
wolfSSL 15:117db924cf7c 1435 #endif /* !CURVE25519_SMALL || !ED25519_SMALL */
wolfSSL 15:117db924cf7c 1436 #endif /* HAVE_CURVE25519 || HAVE_ED25519 */
wolfSSL 15:117db924cf7c 1437