mirror of
https://github.com/oxen-io/session-desktop.git
synced 2023-12-14 02:12:57 +01:00
Remove /native
A relic from the days before the great libaxolotl split. // FREEBIE
This commit is contained in:
lilia
parent
6d445c2ea7
commit
c8d03d9019
|
|
@ -1,870 +0,0 @@
|
|||
/* Copyright 2008, Google Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are
|
||||
* met:
|
||||
*
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following disclaimer
|
||||
* in the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
* * Neither the name of Google Inc. nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* curve25519-donna: Curve25519 elliptic curve, public key function
|
||||
*
|
||||
* http://code.google.com/p/curve25519-donna/
|
||||
*
|
||||
* Adam Langley <agl@imperialviolet.org>
|
||||
*
|
||||
* Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>
|
||||
*
|
||||
* More information about curve25519 can be found here
|
||||
* http://cr.yp.to/ecdh.html
|
||||
*
|
||||
* djb's sample implementation of curve25519 is written in a special assembly
|
||||
* language called qhasm and uses the floating point registers.
|
||||
*
|
||||
* This is, almost, a clean room reimplementation from the curve25519 paper. It
|
||||
* uses many of the tricks described therein. Only the crecip function is taken
|
||||
* from the sample implementation. */
|
||||
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#ifdef _MSC_VER
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
typedef uint8_t u8;
|
||||
typedef int32_t s32;
|
||||
typedef int64_t limb;
|
||||
|
||||
/* Field element representation:
|
||||
*
|
||||
* Field elements are written as an array of signed, 64-bit limbs, least
|
||||
* significant first. The value of the field element is:
|
||||
* x[0] + 2^26·x[1] + x^51·x[2] + 2^102·x[3] + ...
|
||||
*
|
||||
* i.e. the limbs are 26, 25, 26, 25, ... bits wide. */
|
||||
|
||||
/* Sum two numbers: output += in */
|
||||
static void fsum(limb *output, const limb *in) {
|
||||
unsigned i;
|
||||
for (i = 0; i < 10; i += 2) {
|
||||
output[0+i] = output[0+i] + in[0+i];
|
||||
output[1+i] = output[1+i] + in[1+i];
|
||||
}
|
||||
}
|
||||
|
||||
/* Find the difference of two numbers: output = in - output
|
||||
* (note the order of the arguments!). */
|
||||
static void fdifference(limb *output, const limb *in) {
|
||||
unsigned i;
|
||||
for (i = 0; i < 10; ++i) {
|
||||
output[i] = in[i] - output[i];
|
||||
}
|
||||
}
|
||||
|
||||
/* Multiply a number by a scalar: output = in * scalar */
|
||||
static void fscalar_product(limb *output, const limb *in, const limb scalar) {
|
||||
unsigned i;
|
||||
for (i = 0; i < 10; ++i) {
|
||||
output[i] = in[i] * scalar;
|
||||
}
|
||||
}
|
||||
|
||||
/* Multiply two numbers: output = in2 * in
|
||||
*
|
||||
* output must be distinct to both inputs. The inputs are reduced coefficient
|
||||
* form, the output is not.
|
||||
*
|
||||
* output[x] <= 14 * the largest product of the input limbs. */
|
||||
static void fproduct(limb *output, const limb *in2, const limb *in) {
|
||||
output[0] = ((limb) ((s32) in2[0])) * ((s32) in[0]);
|
||||
output[1] = ((limb) ((s32) in2[0])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[0]);
|
||||
output[2] = 2 * ((limb) ((s32) in2[1])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[0]);
|
||||
output[3] = ((limb) ((s32) in2[1])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[0]);
|
||||
output[4] = ((limb) ((s32) in2[2])) * ((s32) in[2]) +
|
||||
2 * (((limb) ((s32) in2[1])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[0]);
|
||||
output[5] = ((limb) ((s32) in2[2])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[0]);
|
||||
output[6] = 2 * (((limb) ((s32) in2[3])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[0]);
|
||||
output[7] = ((limb) ((s32) in2[3])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[0]);
|
||||
output[8] = ((limb) ((s32) in2[4])) * ((s32) in[4]) +
|
||||
2 * (((limb) ((s32) in2[3])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[0]);
|
||||
output[9] = ((limb) ((s32) in2[4])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[0]);
|
||||
output[10] = 2 * (((limb) ((s32) in2[5])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[2]);
|
||||
output[11] = ((limb) ((s32) in2[5])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[2]);
|
||||
output[12] = ((limb) ((s32) in2[6])) * ((s32) in[6]) +
|
||||
2 * (((limb) ((s32) in2[5])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[3])) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[4]);
|
||||
output[13] = ((limb) ((s32) in2[6])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[4]);
|
||||
output[14] = 2 * (((limb) ((s32) in2[7])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[5])) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[6]);
|
||||
output[15] = ((limb) ((s32) in2[7])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[6]);
|
||||
output[16] = ((limb) ((s32) in2[8])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in2[7])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[7]));
|
||||
output[17] = ((limb) ((s32) in2[8])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[8]);
|
||||
output[18] = 2 * ((limb) ((s32) in2[9])) * ((s32) in[9]);
|
||||
}
|
||||
|
||||
/* Reduce a long form to a short form by taking the input mod 2^255 - 19.
|
||||
*
|
||||
* On entry: |output[i]| < 14*2^54
|
||||
* On exit: |output[0..8]| < 280*2^54 */
|
||||
static void freduce_degree(limb *output) {
|
||||
/* Each of these shifts and adds ends up multiplying the value by 19.
|
||||
*
|
||||
* For output[0..8], the absolute entry value is < 14*2^54 and we add, at
|
||||
* most, 19*14*2^54 thus, on exit, |output[0..8]| < 280*2^54. */
|
||||
output[8] += output[18] << 4;
|
||||
output[8] += output[18] << 1;
|
||||
output[8] += output[18];
|
||||
output[7] += output[17] << 4;
|
||||
output[7] += output[17] << 1;
|
||||
output[7] += output[17];
|
||||
output[6] += output[16] << 4;
|
||||
output[6] += output[16] << 1;
|
||||
output[6] += output[16];
|
||||
output[5] += output[15] << 4;
|
||||
output[5] += output[15] << 1;
|
||||
output[5] += output[15];
|
||||
output[4] += output[14] << 4;
|
||||
output[4] += output[14] << 1;
|
||||
output[4] += output[14];
|
||||
output[3] += output[13] << 4;
|
||||
output[3] += output[13] << 1;
|
||||
output[3] += output[13];
|
||||
output[2] += output[12] << 4;
|
||||
output[2] += output[12] << 1;
|
||||
output[2] += output[12];
|
||||
output[1] += output[11] << 4;
|
||||
output[1] += output[11] << 1;
|
||||
output[1] += output[11];
|
||||
output[0] += output[10] << 4;
|
||||
output[0] += output[10] << 1;
|
||||
output[0] += output[10];
|
||||
}
|
||||
|
||||
#if (-1 & 3) != 3
|
||||
#error "This code only works on a two's complement system"
|
||||
#endif
|
||||
|
||||
/* return v / 2^26, using only shifts and adds.
|
||||
*
|
||||
* On entry: v can take any value. */
|
||||
static inline limb
|
||||
div_by_2_26(const limb v)
|
||||
{
|
||||
/* High word of v; no shift needed. */
|
||||
const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
|
||||
/* Set to all 1s if v was negative; else set to 0s. */
|
||||
const int32_t sign = ((int32_t) highword) >> 31;
|
||||
/* Set to 0x3ffffff if v was negative; else set to 0. */
|
||||
const int32_t roundoff = ((uint32_t) sign) >> 6;
|
||||
/* Should return v / (1<<26) */
|
||||
return (v + roundoff) >> 26;
|
||||
}
|
||||
|
||||
/* return v / (2^25), using only shifts and adds.
|
||||
*
|
||||
* On entry: v can take any value. */
|
||||
static inline limb
|
||||
div_by_2_25(const limb v)
|
||||
{
|
||||
/* High word of v; no shift needed*/
|
||||
const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
|
||||
/* Set to all 1s if v was negative; else set to 0s. */
|
||||
const int32_t sign = ((int32_t) highword) >> 31;
|
||||
/* Set to 0x1ffffff if v was negative; else set to 0. */
|
||||
const int32_t roundoff = ((uint32_t) sign) >> 7;
|
||||
/* Should return v / (1<<25) */
|
||||
return (v + roundoff) >> 25;
|
||||
}
|
||||
|
||||
/* return v / (2^25), using only shifts and adds.
|
||||
*
|
||||
* On entry: v can take any value. */
|
||||
static inline s32
|
||||
div_s32_by_2_25(const s32 v)
|
||||
{
|
||||
const s32 roundoff = ((uint32_t)(v >> 31)) >> 7;
|
||||
return (v + roundoff) >> 25;
|
||||
}
|
||||
|
||||
/* Reduce all coefficients of the short form input so that |x| < 2^26.
|
||||
*
|
||||
* On entry: |output[i]| < 280*2^54 */
|
||||
static void freduce_coefficients(limb *output) {
|
||||
unsigned i;
|
||||
|
||||
output[10] = 0;
|
||||
|
||||
for (i = 0; i < 10; i += 2) {
|
||||
limb over = div_by_2_26(output[i]);
|
||||
/* The entry condition (that |output[i]| < 280*2^54) means that over is, at
|
||||
* most, 280*2^28 in the first iteration of this loop. This is added to the
|
||||
* next limb and we can approximate the resulting bound of that limb by
|
||||
* 281*2^54. */
|
||||
output[i] -= over << 26;
|
||||
output[i+1] += over;
|
||||
|
||||
/* For the first iteration, |output[i+1]| < 281*2^54, thus |over| <
|
||||
* 281*2^29. When this is added to the next limb, the resulting bound can
|
||||
* be approximated as 281*2^54.
|
||||
*
|
||||
* For subsequent iterations of the loop, 281*2^54 remains a conservative
|
||||
* bound and no overflow occurs. */
|
||||
over = div_by_2_25(output[i+1]);
|
||||
output[i+1] -= over << 25;
|
||||
output[i+2] += over;
|
||||
}
|
||||
/* Now |output[10]| < 281*2^29 and all other coefficients are reduced. */
|
||||
output[0] += output[10] << 4;
|
||||
output[0] += output[10] << 1;
|
||||
output[0] += output[10];
|
||||
|
||||
output[10] = 0;
|
||||
|
||||
/* Now output[1..9] are reduced, and |output[0]| < 2^26 + 19*281*2^29
|
||||
* So |over| will be no more than 2^16. */
|
||||
{
|
||||
limb over = div_by_2_26(output[0]);
|
||||
output[0] -= over << 26;
|
||||
output[1] += over;
|
||||
}
|
||||
|
||||
/* Now output[0,2..9] are reduced, and |output[1]| < 2^25 + 2^16 < 2^26. The
|
||||
* bound on |output[1]| is sufficient to meet our needs. */
|
||||
}
|
||||
|
||||
/* A helpful wrapper around fproduct: output = in * in2.
|
||||
*
|
||||
* On entry: |in[i]| < 2^27 and |in2[i]| < 2^27.
|
||||
*
|
||||
* output must be distinct to both inputs. The output is reduced degree
|
||||
* (indeed, one need only provide storage for 10 limbs) and |output[i]| < 2^26. */
|
||||
static void
|
||||
fmul(limb *output, const limb *in, const limb *in2) {
|
||||
limb t[19];
|
||||
fproduct(t, in, in2);
|
||||
/* |t[i]| < 14*2^54 */
|
||||
freduce_degree(t);
|
||||
freduce_coefficients(t);
|
||||
/* |t[i]| < 2^26 */
|
||||
memcpy(output, t, sizeof(limb) * 10);
|
||||
}
|
||||
|
||||
/* Square a number: output = in**2
|
||||
*
|
||||
* output must be distinct from the input. The inputs are reduced coefficient
|
||||
* form, the output is not.
|
||||
*
|
||||
* output[x] <= 14 * the largest product of the input limbs. */
|
||||
static void fsquare_inner(limb *output, const limb *in) {
|
||||
output[0] = ((limb) ((s32) in[0])) * ((s32) in[0]);
|
||||
output[1] = 2 * ((limb) ((s32) in[0])) * ((s32) in[1]);
|
||||
output[2] = 2 * (((limb) ((s32) in[1])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[2]));
|
||||
output[3] = 2 * (((limb) ((s32) in[1])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[3]));
|
||||
output[4] = ((limb) ((s32) in[2])) * ((s32) in[2]) +
|
||||
4 * ((limb) ((s32) in[1])) * ((s32) in[3]) +
|
||||
2 * ((limb) ((s32) in[0])) * ((s32) in[4]);
|
||||
output[5] = 2 * (((limb) ((s32) in[2])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[5]));
|
||||
output[6] = 2 * (((limb) ((s32) in[3])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[6]) +
|
||||
2 * ((limb) ((s32) in[1])) * ((s32) in[5]));
|
||||
output[7] = 2 * (((limb) ((s32) in[3])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[7]));
|
||||
output[8] = ((limb) ((s32) in[4])) * ((s32) in[4]) +
|
||||
2 * (((limb) ((s32) in[2])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in[1])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[5])));
|
||||
output[9] = 2 * (((limb) ((s32) in[4])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[9]));
|
||||
output[10] = 2 * (((limb) ((s32) in[5])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in[4])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in[3])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[9])));
|
||||
output[11] = 2 * (((limb) ((s32) in[5])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[4])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[9]));
|
||||
output[12] = ((limb) ((s32) in[6])) * ((s32) in[6]) +
|
||||
2 * (((limb) ((s32) in[4])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in[5])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[9])));
|
||||
output[13] = 2 * (((limb) ((s32) in[6])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[5])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[4])) * ((s32) in[9]));
|
||||
output[14] = 2 * (((limb) ((s32) in[7])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[6])) * ((s32) in[8]) +
|
||||
2 * ((limb) ((s32) in[5])) * ((s32) in[9]));
|
||||
output[15] = 2 * (((limb) ((s32) in[7])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[6])) * ((s32) in[9]));
|
||||
output[16] = ((limb) ((s32) in[8])) * ((s32) in[8]) +
|
||||
4 * ((limb) ((s32) in[7])) * ((s32) in[9]);
|
||||
output[17] = 2 * ((limb) ((s32) in[8])) * ((s32) in[9]);
|
||||
output[18] = 2 * ((limb) ((s32) in[9])) * ((s32) in[9]);
|
||||
}
|
||||
|
||||
/* fsquare sets output = in^2.
|
||||
*
|
||||
* On entry: The |in| argument is in reduced coefficients form and |in[i]| <
|
||||
* 2^27.
|
||||
*
|
||||
* On exit: The |output| argument is in reduced coefficients form (indeed, one
|
||||
* need only provide storage for 10 limbs) and |out[i]| < 2^26. */
|
||||
static void
|
||||
fsquare(limb *output, const limb *in) {
|
||||
limb t[19];
|
||||
fsquare_inner(t, in);
|
||||
/* |t[i]| < 14*2^54 because the largest product of two limbs will be <
|
||||
* 2^(27+27) and fsquare_inner adds together, at most, 14 of those
|
||||
* products. */
|
||||
freduce_degree(t);
|
||||
freduce_coefficients(t);
|
||||
/* |t[i]| < 2^26 */
|
||||
memcpy(output, t, sizeof(limb) * 10);
|
||||
}
|
||||
|
||||
/* Take a little-endian, 32-byte number and expand it into polynomial form */
|
||||
static void
|
||||
fexpand(limb *output, const u8 *input) {
|
||||
#define F(n,start,shift,mask) \
|
||||
output[n] = ((((limb) input[start + 0]) | \
|
||||
((limb) input[start + 1]) << 8 | \
|
||||
((limb) input[start + 2]) << 16 | \
|
||||
((limb) input[start + 3]) << 24) >> shift) & mask;
|
||||
F(0, 0, 0, 0x3ffffff);
|
||||
F(1, 3, 2, 0x1ffffff);
|
||||
F(2, 6, 3, 0x3ffffff);
|
||||
F(3, 9, 5, 0x1ffffff);
|
||||
F(4, 12, 6, 0x3ffffff);
|
||||
F(5, 16, 0, 0x1ffffff);
|
||||
F(6, 19, 1, 0x3ffffff);
|
||||
F(7, 22, 3, 0x1ffffff);
|
||||
F(8, 25, 4, 0x3ffffff);
|
||||
F(9, 28, 6, 0x1ffffff);
|
||||
#undef F
|
||||
}
|
||||
|
||||
#if (-32 >> 1) != -16
|
||||
#error "This code only works when >> does sign-extension on negative numbers"
|
||||
#endif
|
||||
|
||||
/* s32_eq returns 0xffffffff iff a == b and zero otherwise. */
|
||||
static s32 s32_eq(s32 a, s32 b) {
|
||||
a = ~(a ^ b);
|
||||
a &= a << 16;
|
||||
a &= a << 8;
|
||||
a &= a << 4;
|
||||
a &= a << 2;
|
||||
a &= a << 1;
|
||||
return a >> 31;
|
||||
}
|
||||
|
||||
/* s32_gte returns 0xffffffff if a >= b and zero otherwise, where a and b are
|
||||
* both non-negative. */
|
||||
static s32 s32_gte(s32 a, s32 b) {
|
||||
a -= b;
|
||||
/* a >= 0 iff a >= b. */
|
||||
return ~(a >> 31);
|
||||
}
|
||||
|
||||
/* Take a fully reduced polynomial form number and contract it into a
|
||||
* little-endian, 32-byte array.
|
||||
*
|
||||
* On entry: |input_limbs[i]| < 2^26 */
|
||||
static void
|
||||
fcontract(u8 *output, limb *input_limbs) {
|
||||
int i;
|
||||
int j;
|
||||
s32 input[10];
|
||||
s32 mask;
|
||||
|
||||
/* |input_limbs[i]| < 2^26, so it's valid to convert to an s32. */
|
||||
for (i = 0; i < 10; i++) {
|
||||
input[i] = input_limbs[i];
|
||||
}
|
||||
|
||||
for (j = 0; j < 2; ++j) {
|
||||
for (i = 0; i < 9; ++i) {
|
||||
if ((i & 1) == 1) {
|
||||
/* This calculation is a time-invariant way to make input[i]
|
||||
* non-negative by borrowing from the next-larger limb. */
|
||||
const s32 mask = input[i] >> 31;
|
||||
const s32 carry = -((input[i] & mask) >> 25);
|
||||
input[i] = input[i] + (carry << 25);
|
||||
input[i+1] = input[i+1] - carry;
|
||||
} else {
|
||||
const s32 mask = input[i] >> 31;
|
||||
const s32 carry = -((input[i] & mask) >> 26);
|
||||
input[i] = input[i] + (carry << 26);
|
||||
input[i+1] = input[i+1] - carry;
|
||||
}
|
||||
}
|
||||
|
||||
/* There's no greater limb for input[9] to borrow from, but we can multiply
|
||||
* by 19 and borrow from input[0], which is valid mod 2^255-19. */
|
||||
{
|
||||
const s32 mask = input[9] >> 31;
|
||||
const s32 carry = -((input[9] & mask) >> 25);
|
||||
input[9] = input[9] + (carry << 25);
|
||||
input[0] = input[0] - (carry * 19);
|
||||
}
|
||||
|
||||
/* After the first iteration, input[1..9] are non-negative and fit within
|
||||
* 25 or 26 bits, depending on position. However, input[0] may be
|
||||
* negative. */
|
||||
}
|
||||
|
||||
/* The first borrow-propagation pass above ended with every limb
|
||||
except (possibly) input[0] non-negative.
|
||||
|
||||
If input[0] was negative after the first pass, then it was because of a
|
||||
carry from input[9]. On entry, input[9] < 2^26 so the carry was, at most,
|
||||
one, since (2**26-1) >> 25 = 1. Thus input[0] >= -19.
|
||||
|
||||
In the second pass, each limb is decreased by at most one. Thus the second
|
||||
borrow-propagation pass could only have wrapped around to decrease
|
||||
input[0] again if the first pass left input[0] negative *and* input[1]
|
||||
through input[9] were all zero. In that case, input[1] is now 2^25 - 1,
|
||||
and this last borrow-propagation step will leave input[1] non-negative. */
|
||||
{
|
||||
const s32 mask = input[0] >> 31;
|
||||
const s32 carry = -((input[0] & mask) >> 26);
|
||||
input[0] = input[0] + (carry << 26);
|
||||
input[1] = input[1] - carry;
|
||||
}
|
||||
|
||||
/* All input[i] are now non-negative. However, there might be values between
|
||||
* 2^25 and 2^26 in a limb which is, nominally, 25 bits wide. */
|
||||
for (j = 0; j < 2; j++) {
|
||||
for (i = 0; i < 9; i++) {
|
||||
if ((i & 1) == 1) {
|
||||
const s32 carry = input[i] >> 25;
|
||||
input[i] &= 0x1ffffff;
|
||||
input[i+1] += carry;
|
||||
} else {
|
||||
const s32 carry = input[i] >> 26;
|
||||
input[i] &= 0x3ffffff;
|
||||
input[i+1] += carry;
|
||||
}
|
||||
}
|
||||
|
||||
{
|
||||
const s32 carry = input[9] >> 25;
|
||||
input[9] &= 0x1ffffff;
|
||||
input[0] += 19*carry;
|
||||
}
|
||||
}
|
||||
|
||||
/* If the first carry-chain pass, just above, ended up with a carry from
|
||||
* input[9], and that caused input[0] to be out-of-bounds, then input[0] was
|
||||
* < 2^26 + 2*19, because the carry was, at most, two.
|
||||
*
|
||||
* If the second pass carried from input[9] again then input[0] is < 2*19 and
|
||||
* the input[9] -> input[0] carry didn't push input[0] out of bounds. */
|
||||
|
||||
/* It still remains the case that input might be between 2^255-19 and 2^255.
|
||||
* In this case, input[1..9] must take their maximum value and input[0] must
|
||||
* be >= (2^255-19) & 0x3ffffff, which is 0x3ffffed. */
|
||||
mask = s32_gte(input[0], 0x3ffffed);
|
||||
for (i = 1; i < 10; i++) {
|
||||
if ((i & 1) == 1) {
|
||||
mask &= s32_eq(input[i], 0x1ffffff);
|
||||
} else {
|
||||
mask &= s32_eq(input[i], 0x3ffffff);
|
||||
}
|
||||
}
|
||||
|
||||
/* mask is either 0xffffffff (if input >= 2^255-19) and zero otherwise. Thus
|
||||
* this conditionally subtracts 2^255-19. */
|
||||
input[0] -= mask & 0x3ffffed;
|
||||
|
||||
for (i = 1; i < 10; i++) {
|
||||
if ((i & 1) == 1) {
|
||||
input[i] -= mask & 0x1ffffff;
|
||||
} else {
|
||||
input[i] -= mask & 0x3ffffff;
|
||||
}
|
||||
}
|
||||
|
||||
input[1] <<= 2;
|
||||
input[2] <<= 3;
|
||||
input[3] <<= 5;
|
||||
input[4] <<= 6;
|
||||
input[6] <<= 1;
|
||||
input[7] <<= 3;
|
||||
input[8] <<= 4;
|
||||
input[9] <<= 6;
|
||||
#define F(i, s) \
|
||||
output[s+0] |= input[i] & 0xff; \
|
||||
output[s+1] = (input[i] >> 8) & 0xff; \
|
||||
output[s+2] = (input[i] >> 16) & 0xff; \
|
||||
output[s+3] = (input[i] >> 24) & 0xff;
|
||||
output[0] = 0;
|
||||
output[16] = 0;
|
||||
F(0,0);
|
||||
F(1,3);
|
||||
F(2,6);
|
||||
F(3,9);
|
||||
F(4,12);
|
||||
F(5,16);
|
||||
F(6,19);
|
||||
F(7,22);
|
||||
F(8,25);
|
||||
F(9,28);
|
||||
#undef F
|
||||
}
|
||||
|
||||
/* Input: Q, Q', Q-Q'
|
||||
* Output: 2Q, Q+Q'
|
||||
*
|
||||
* x2 z3: long form
|
||||
* x3 z3: long form
|
||||
* x z: short form, destroyed
|
||||
* xprime zprime: short form, destroyed
|
||||
* qmqp: short form, preserved
|
||||
*
|
||||
* On entry and exit, the absolute value of the limbs of all inputs and outputs
|
||||
* are < 2^26. */
|
||||
static void fmonty(limb *x2, limb *z2, /* output 2Q */
|
||||
limb *x3, limb *z3, /* output Q + Q' */
|
||||
limb *x, limb *z, /* input Q */
|
||||
limb *xprime, limb *zprime, /* input Q' */
|
||||
const limb *qmqp /* input Q - Q' */) {
|
||||
limb origx[10], origxprime[10], zzz[19], xx[19], zz[19], xxprime[19],
|
||||
zzprime[19], zzzprime[19], xxxprime[19];
|
||||
|
||||
memcpy(origx, x, 10 * sizeof(limb));
|
||||
fsum(x, z);
|
||||
/* |x[i]| < 2^27 */
|
||||
fdifference(z, origx); /* does x - z */
|
||||
/* |z[i]| < 2^27 */
|
||||
|
||||
memcpy(origxprime, xprime, sizeof(limb) * 10);
|
||||
fsum(xprime, zprime);
|
||||
/* |xprime[i]| < 2^27 */
|
||||
fdifference(zprime, origxprime);
|
||||
/* |zprime[i]| < 2^27 */
|
||||
fproduct(xxprime, xprime, z);
|
||||
/* |xxprime[i]| < 14*2^54: the largest product of two limbs will be <
|
||||
* 2^(27+27) and fproduct adds together, at most, 14 of those products.
|
||||
* (Approximating that to 2^58 doesn't work out.) */
|
||||
fproduct(zzprime, x, zprime);
|
||||
/* |zzprime[i]| < 14*2^54 */
|
||||
freduce_degree(xxprime);
|
||||
freduce_coefficients(xxprime);
|
||||
/* |xxprime[i]| < 2^26 */
|
||||
freduce_degree(zzprime);
|
||||
freduce_coefficients(zzprime);
|
||||
/* |zzprime[i]| < 2^26 */
|
||||
memcpy(origxprime, xxprime, sizeof(limb) * 10);
|
||||
fsum(xxprime, zzprime);
|
||||
/* |xxprime[i]| < 2^27 */
|
||||
fdifference(zzprime, origxprime);
|
||||
/* |zzprime[i]| < 2^27 */
|
||||
fsquare(xxxprime, xxprime);
|
||||
/* |xxxprime[i]| < 2^26 */
|
||||
fsquare(zzzprime, zzprime);
|
||||
/* |zzzprime[i]| < 2^26 */
|
||||
fproduct(zzprime, zzzprime, qmqp);
|
||||
/* |zzprime[i]| < 14*2^52 */
|
||||
freduce_degree(zzprime);
|
||||
freduce_coefficients(zzprime);
|
||||
/* |zzprime[i]| < 2^26 */
|
||||
memcpy(x3, xxxprime, sizeof(limb) * 10);
|
||||
memcpy(z3, zzprime, sizeof(limb) * 10);
|
||||
|
||||
fsquare(xx, x);
|
||||
/* |xx[i]| < 2^26 */
|
||||
fsquare(zz, z);
|
||||
/* |zz[i]| < 2^26 */
|
||||
fproduct(x2, xx, zz);
|
||||
/* |x2[i]| < 14*2^52 */
|
||||
freduce_degree(x2);
|
||||
freduce_coefficients(x2);
|
||||
/* |x2[i]| < 2^26 */
|
||||
fdifference(zz, xx); // does zz = xx - zz
|
||||
/* |zz[i]| < 2^27 */
|
||||
memset(zzz + 10, 0, sizeof(limb) * 9);
|
||||
fscalar_product(zzz, zz, 121665);
|
||||
/* |zzz[i]| < 2^(27+17) */
|
||||
/* No need to call freduce_degree here:
|
||||
fscalar_product doesn't increase the degree of its input. */
|
||||
freduce_coefficients(zzz);
|
||||
/* |zzz[i]| < 2^26 */
|
||||
fsum(zzz, xx);
|
||||
/* |zzz[i]| < 2^27 */
|
||||
fproduct(z2, zz, zzz);
|
||||
/* |z2[i]| < 14*2^(26+27) */
|
||||
freduce_degree(z2);
|
||||
freduce_coefficients(z2);
|
||||
/* |z2|i| < 2^26 */
|
||||
}
|
||||
|
||||
/* Conditionally swap two reduced-form limb arrays if 'iswap' is 1, but leave
|
||||
* them unchanged if 'iswap' is 0. Runs in data-invariant time to avoid
|
||||
* side-channel attacks.
|
||||
*
|
||||
* NOTE that this function requires that 'iswap' be 1 or 0; other values give
|
||||
* wrong results. Also, the two limb arrays must be in reduced-coefficient,
|
||||
* reduced-degree form: the values in a[10..19] or b[10..19] aren't swapped,
|
||||
* and all all values in a[0..9],b[0..9] must have magnitude less than
|
||||
* INT32_MAX. */
|
||||
static void
|
||||
swap_conditional(limb a[19], limb b[19], limb iswap) {
|
||||
unsigned i;
|
||||
const s32 swap = (s32) -iswap;
|
||||
|
||||
for (i = 0; i < 10; ++i) {
|
||||
const s32 x = swap & ( ((s32)a[i]) ^ ((s32)b[i]) );
|
||||
a[i] = ((s32)a[i]) ^ x;
|
||||
b[i] = ((s32)b[i]) ^ x;
|
||||
}
|
||||
}
|
||||
|
||||
/* Calculates nQ where Q is the x-coordinate of a point on the curve
|
||||
*
|
||||
* resultx/resultz: the x coordinate of the resulting curve point (short form)
|
||||
* n: a little endian, 32-byte number
|
||||
* q: a point of the curve (short form) */
|
||||
static void
|
||||
cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) {
|
||||
limb a[19] = {0}, b[19] = {1}, c[19] = {1}, d[19] = {0};
|
||||
limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t;
|
||||
limb e[19] = {0}, f[19] = {1}, g[19] = {0}, h[19] = {1};
|
||||
limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h;
|
||||
|
||||
unsigned i, j;
|
||||
|
||||
memcpy(nqpqx, q, sizeof(limb) * 10);
|
||||
|
||||
for (i = 0; i < 32; ++i) {
|
||||
u8 byte = n[31 - i];
|
||||
for (j = 0; j < 8; ++j) {
|
||||
const limb bit = byte >> 7;
|
||||
|
||||
swap_conditional(nqx, nqpqx, bit);
|
||||
swap_conditional(nqz, nqpqz, bit);
|
||||
fmonty(nqx2, nqz2,
|
||||
nqpqx2, nqpqz2,
|
||||
nqx, nqz,
|
||||
nqpqx, nqpqz,
|
||||
q);
|
||||
swap_conditional(nqx2, nqpqx2, bit);
|
||||
swap_conditional(nqz2, nqpqz2, bit);
|
||||
|
||||
t = nqx;
|
||||
nqx = nqx2;
|
||||
nqx2 = t;
|
||||
t = nqz;
|
||||
nqz = nqz2;
|
||||
nqz2 = t;
|
||||
t = nqpqx;
|
||||
nqpqx = nqpqx2;
|
||||
nqpqx2 = t;
|
||||
t = nqpqz;
|
||||
nqpqz = nqpqz2;
|
||||
nqpqz2 = t;
|
||||
|
||||
byte <<= 1;
|
||||
}
|
||||
}
|
||||
|
||||
memcpy(resultx, nqx, sizeof(limb) * 10);
|
||||
memcpy(resultz, nqz, sizeof(limb) * 10);
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// Shamelessly copied from djb's code
|
||||
// -----------------------------------------------------------------------------
|
||||
static void
|
||||
crecip(limb *out, const limb *z) {
|
||||
limb z2[10];
|
||||
limb z9[10];
|
||||
limb z11[10];
|
||||
limb z2_5_0[10];
|
||||
limb z2_10_0[10];
|
||||
limb z2_20_0[10];
|
||||
limb z2_50_0[10];
|
||||
limb z2_100_0[10];
|
||||
limb t0[10];
|
||||
limb t1[10];
|
||||
int i;
|
||||
|
||||
/* 2 */ fsquare(z2,z);
|
||||
/* 4 */ fsquare(t1,z2);
|
||||
/* 8 */ fsquare(t0,t1);
|
||||
/* 9 */ fmul(z9,t0,z);
|
||||
/* 11 */ fmul(z11,z9,z2);
|
||||
/* 22 */ fsquare(t0,z11);
|
||||
/* 2^5 - 2^0 = 31 */ fmul(z2_5_0,t0,z9);
|
||||
|
||||
/* 2^6 - 2^1 */ fsquare(t0,z2_5_0);
|
||||
/* 2^7 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^8 - 2^3 */ fsquare(t0,t1);
|
||||
/* 2^9 - 2^4 */ fsquare(t1,t0);
|
||||
/* 2^10 - 2^5 */ fsquare(t0,t1);
|
||||
/* 2^10 - 2^0 */ fmul(z2_10_0,t0,z2_5_0);
|
||||
|
||||
/* 2^11 - 2^1 */ fsquare(t0,z2_10_0);
|
||||
/* 2^12 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^20 - 2^0 */ fmul(z2_20_0,t1,z2_10_0);
|
||||
|
||||
/* 2^21 - 2^1 */ fsquare(t0,z2_20_0);
|
||||
/* 2^22 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^40 - 2^0 */ fmul(t0,t1,z2_20_0);
|
||||
|
||||
/* 2^41 - 2^1 */ fsquare(t1,t0);
|
||||
/* 2^42 - 2^2 */ fsquare(t0,t1);
|
||||
/* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
|
||||
/* 2^50 - 2^0 */ fmul(z2_50_0,t0,z2_10_0);
|
||||
|
||||
/* 2^51 - 2^1 */ fsquare(t0,z2_50_0);
|
||||
/* 2^52 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^100 - 2^0 */ fmul(z2_100_0,t1,z2_50_0);
|
||||
|
||||
/* 2^101 - 2^1 */ fsquare(t1,z2_100_0);
|
||||
/* 2^102 - 2^2 */ fsquare(t0,t1);
|
||||
/* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
|
||||
/* 2^200 - 2^0 */ fmul(t1,t0,z2_100_0);
|
||||
|
||||
/* 2^201 - 2^1 */ fsquare(t0,t1);
|
||||
/* 2^202 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^250 - 2^0 */ fmul(t0,t1,z2_50_0);
|
||||
|
||||
/* 2^251 - 2^1 */ fsquare(t1,t0);
|
||||
/* 2^252 - 2^2 */ fsquare(t0,t1);
|
||||
/* 2^253 - 2^3 */ fsquare(t1,t0);
|
||||
/* 2^254 - 2^4 */ fsquare(t0,t1);
|
||||
/* 2^255 - 2^5 */ fsquare(t1,t0);
|
||||
/* 2^255 - 21 */ fmul(out,t1,z11);
|
||||
}
|
||||
|
||||
int
|
||||
curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
|
||||
limb bp[10], x[10], z[11], zmone[10];
|
||||
uint8_t e[32];
|
||||
int i;
|
||||
|
||||
for (i = 0; i < 32; ++i) e[i] = secret[i];
|
||||
// e[0] &= 248;
|
||||
// e[31] &= 127;
|
||||
// e[31] |= 64;
|
||||
|
||||
fexpand(bp, basepoint);
|
||||
cmult(x, z, e, bp);
|
||||
crecip(zmone, z);
|
||||
fmul(z, x, zmone);
|
||||
fcontract(mypublic, z);
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
#include <string.h>
|
||||
#include "compare.h"
|
||||
|
||||
/* Const-time comparison from SUPERCOP, but here it's only used for
|
||||
signature verification, so doesn't need to be const-time. But
|
||||
copied the nacl version anyways. */
|
||||
int crypto_verify_32_ref(const unsigned char *x, const unsigned char *y)
|
||||
{
|
||||
unsigned int differentbits = 0;
|
||||
#define F(i) differentbits |= x[i] ^ y[i];
|
||||
F(0)
|
||||
F(1)
|
||||
F(2)
|
||||
F(3)
|
||||
F(4)
|
||||
F(5)
|
||||
F(6)
|
||||
F(7)
|
||||
F(8)
|
||||
F(9)
|
||||
F(10)
|
||||
F(11)
|
||||
F(12)
|
||||
F(13)
|
||||
F(14)
|
||||
F(15)
|
||||
F(16)
|
||||
F(17)
|
||||
F(18)
|
||||
F(19)
|
||||
F(20)
|
||||
F(21)
|
||||
F(22)
|
||||
F(23)
|
||||
F(24)
|
||||
F(25)
|
||||
F(26)
|
||||
F(27)
|
||||
F(28)
|
||||
F(29)
|
||||
F(30)
|
||||
F(31)
|
||||
return (1 & ((differentbits - 1) >> 8)) - 1;
|
||||
}
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
#ifndef __COMPARE_H__
|
||||
#define __COMPARE_H__
|
||||
|
||||
int crypto_verify_32_ref(const unsigned char *b1, const unsigned char *b2);
|
||||
|
||||
#endif
|
||||
|
|
@ -1,97 +0,0 @@
|
|||
#include <string.h>
|
||||
#include "ge.h"
|
||||
#include "curve_sigs.h"
|
||||
#include "crypto_sign.h"
|
||||
|
||||
void curve25519_keygen(unsigned char* curve25519_pubkey_out,
|
||||
unsigned char* curve25519_privkey_in)
|
||||
{
|
||||
ge_p3 ed_pubkey_point; /* Ed25519 pubkey point */
|
||||
unsigned char ed_pubkey[32]; /* privkey followed by pubkey */
|
||||
fe ed_y, one, ed_y_plus_one, one_minus_ed_y, inv_one_minus_ed_y;
|
||||
fe mont_x;
|
||||
|
||||
/* Perform a fixed-base multiplication of the Edwards base point,
|
||||
(which is efficient due to precalculated tables), then convert
|
||||
to the Curve25519 montgomery-format public key. In particular,
|
||||
convert Curve25519's "montgomery" x-coordinate into an Ed25519
|
||||
"edwards" y-coordinate:
|
||||
|
||||
mont_x = (ed_y +1 1) / (1 - ed_y)
|
||||
*/
|
||||
|
||||
ge_scalarmult_base(&ed_pubkey_point, curve25519_privkey_in);
|
||||
ge_p3_tobytes(ed_pubkey, &ed_pubkey_point);
|
||||
ed_pubkey[31] = ed_pubkey[31] & 0x7F; /* Mask off sign bit */
|
||||
fe_frombytes(ed_y, ed_pubkey);
|
||||
|
||||
fe_1(one);
|
||||
fe_add(ed_y_plus_one, ed_y, one);
|
||||
fe_sub(one_minus_ed_y, one, ed_y);
|
||||
fe_invert(inv_one_minus_ed_y, one_minus_ed_y);
|
||||
fe_mul(mont_x, ed_y_plus_one, inv_one_minus_ed_y);
|
||||
fe_tobytes(curve25519_pubkey_out, mont_x);
|
||||
}
|
||||
|
||||
void curve25519_sign(unsigned char* signature_out,
|
||||
unsigned char* curve25519_privkey,
|
||||
unsigned char* msg, unsigned long msg_len)
|
||||
{
|
||||
ge_p3 ed_pubkey_point; /* Ed25519 pubkey point */
|
||||
unsigned char ed_keypair[64]; /* privkey followed by pubkey */
|
||||
unsigned char sigbuf[msg_len + 64]; /* working buffer */
|
||||
unsigned long long sigbuf_out_len = 0;
|
||||
unsigned char sign_bit = 0;
|
||||
|
||||
/* Convert the Curve25519 privkey to an Ed25519 keypair */
|
||||
memmove(ed_keypair, curve25519_privkey, 32);
|
||||
ge_scalarmult_base(&ed_pubkey_point, curve25519_privkey);
|
||||
ge_p3_tobytes(ed_keypair + 32, &ed_pubkey_point);
|
||||
sign_bit = ed_keypair[63] & 0x80;
|
||||
|
||||
/* Perform an Ed25519 signature with explicit private key */
|
||||
crypto_sign_modified(sigbuf, &sigbuf_out_len, msg, msg_len, ed_keypair);
|
||||
memmove(signature_out, sigbuf, 64);
|
||||
|
||||
/* Encode the sign bit into signature (in unused high bit of S) */
|
||||
signature_out[63] |= sign_bit;
|
||||
}
|
||||
|
||||
int curve25519_verify(unsigned char* signature,
|
||||
unsigned char* curve25519_pubkey,
|
||||
unsigned char* msg, unsigned long msg_len)
|
||||
{
|
||||
fe mont_x, mont_x_minus_one, mont_x_plus_one, inv_mont_x_plus_one;
|
||||
fe one;
|
||||
fe ed_y;
|
||||
unsigned char ed_pubkey[32];
|
||||
unsigned long long some_retval;
|
||||
unsigned char verifybuf[msg_len + 64]; /* working buffer */
|
||||
unsigned char verifybuf2[msg_len + 64]; /* working buffer #2 */
|
||||
|
||||
/* Convert the Curve25519 public key into an Ed25519 public key. In
|
||||
particular, convert Curve25519's "montgomery" x-coordinate into an
|
||||
Ed25519 "edwards" y-coordinate:
|
||||
|
||||
ed_y = (mont_x - 1) / (mont_x + 1)
|
||||
|
||||
Then move the sign bit into the pubkey from the signature.
|
||||
*/
|
||||
fe_frombytes(mont_x, curve25519_pubkey);
|
||||
fe_1(one);
|
||||
fe_sub(mont_x_minus_one, mont_x, one);
|
||||
fe_add(mont_x_plus_one, mont_x, one);
|
||||
fe_invert(inv_mont_x_plus_one, mont_x_plus_one);
|
||||
fe_mul(ed_y, mont_x_minus_one, inv_mont_x_plus_one);
|
||||
fe_tobytes(ed_pubkey, ed_y);
|
||||
|
||||
/* Copy the sign bit, and remove it from signature */
|
||||
ed_pubkey[31] |= (signature[63] & 0x80);
|
||||
signature[63] &= 0x7F;
|
||||
|
||||
memmove(verifybuf, signature, 64);
|
||||
memmove(verifybuf+64, msg, msg_len);
|
||||
|
||||
/* Then perform a normal Ed25519 verification, return 0 on success */
|
||||
return crypto_sign_open(verifybuf2, &some_retval, verifybuf, 64 + msg_len, ed_pubkey);
|
||||
}
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
|
||||
#ifndef __CURVE_SIGS_H__
|
||||
#define __CURVE_SIGS_H__
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
void curve25519_keygen(unsigned char* curve25519_pubkey_out,
|
||||
unsigned char* curve25519_privkey_in);
|
||||
|
||||
void curve25519_sign(unsigned char* signature_out,
|
||||
unsigned char* curve25519_privkey,
|
||||
unsigned char* msg, unsigned long msg_len);
|
||||
|
||||
/* returns 0 on success */
|
||||
int curve25519_verify(unsigned char* signature,
|
||||
unsigned char* curve25519_pubkey,
|
||||
unsigned char* msg, unsigned long msg_len);
|
||||
|
||||
/* helper function - modified version of crypto_sign() to use
|
||||
explicit private key */
|
||||
int crypto_sign_modified(
|
||||
unsigned char *sm,unsigned long long *smlen,
|
||||
const unsigned char *m,unsigned long long mlen,
|
||||
const unsigned char *sk
|
||||
);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
#include "sha512.h"
|
||||
#include "sph_sha2.h"
|
||||
|
||||
int crypto_hash_sha512_ref(unsigned char *output ,const unsigned char *input,
|
||||
unsigned long long len)
|
||||
{
|
||||
sph_sha512_context ctx;
|
||||
sph_sha512_init(&ctx);
|
||||
sph_sha512(&ctx, input, len);
|
||||
sph_sha512_close(&ctx, output);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
#ifndef __SHA512_H__
|
||||
#define __SHA512_H__
|
||||
|
||||
#include "sha512.h"
|
||||
#include "sph_sha2.h"
|
||||
|
||||
int crypto_hash_sha512_ref(unsigned char *output ,const unsigned char *input,
|
||||
unsigned long long len);
|
||||
|
||||
#endif
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
#include <string.h>
|
||||
#include "crypto_sign.h"
|
||||
#include "crypto_hash_sha512.h"
|
||||
#include "ge.h"
|
||||
#include "sc.h"
|
||||
|
||||
/* NEW: Compare to pristine crypto_sign()
|
||||
Uses explicit private key for nonce derivation and as scalar,
|
||||
instead of deriving both from a master key.
|
||||
*/
|
||||
int crypto_sign_modified(
|
||||
unsigned char *sm,unsigned long long *smlen,
|
||||
const unsigned char *m,unsigned long long mlen,
|
||||
const unsigned char *sk
|
||||
)
|
||||
{
|
||||
unsigned char pk[32];
|
||||
//unsigned char az[64];
|
||||
unsigned char nonce[64];
|
||||
unsigned char hram[64];
|
||||
ge_p3 R;
|
||||
|
||||
memmove(pk,sk + 32,32);
|
||||
|
||||
*smlen = mlen + 64;
|
||||
memmove(sm + 64,m,mlen);
|
||||
memmove(sm + 32,sk,32); /* NEW: Use privkey directly for nonce derivation */
|
||||
crypto_hash_sha512(nonce,sm + 32,mlen + 32);
|
||||
memmove(sm + 32,pk,32);
|
||||
|
||||
sc_reduce(nonce);
|
||||
ge_scalarmult_base(&R,nonce);
|
||||
ge_p3_tobytes(sm,&R);
|
||||
|
||||
crypto_hash_sha512(hram,sm,mlen + 64);
|
||||
sc_reduce(hram);
|
||||
sc_muladd(sm + 32,hram,sk,nonce); /* NEW: Use privkey directly */
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#define CRYPTO_SECRETKEYBYTES 64
|
||||
#define CRYPTO_PUBLICKEYBYTES 32
|
||||
#define CRYPTO_BYTES 64
|
||||
#define CRYPTO_DETERMINISTIC 1
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,40 +0,0 @@
|
|||
{
|
||||
{ 25967493,-14356035,29566456,3660896,-12694345,4014787,27544626,-11754271,-6079156,2047605 },
|
||||
{ -12545711,934262,-2722910,3049990,-727428,9406986,12720692,5043384,19500929,-15469378 },
|
||||
{ -8738181,4489570,9688441,-14785194,10184609,-12363380,29287919,11864899,-24514362,-4438546 },
|
||||
},
|
||||
{
|
||||
{ 15636291,-9688557,24204773,-7912398,616977,-16685262,27787600,-14772189,28944400,-1550024 },
|
||||
{ 16568933,4717097,-11556148,-1102322,15682896,-11807043,16354577,-11775962,7689662,11199574 },
|
||||
{ 30464156,-5976125,-11779434,-15670865,23220365,15915852,7512774,10017326,-17749093,-9920357 },
|
||||
},
|
||||
{
|
||||
{ 10861363,11473154,27284546,1981175,-30064349,12577861,32867885,14515107,-15438304,10819380 },
|
||||
{ 4708026,6336745,20377586,9066809,-11272109,6594696,-25653668,12483688,-12668491,5581306 },
|
||||
{ 19563160,16186464,-29386857,4097519,10237984,-4348115,28542350,13850243,-23678021,-15815942 },
|
||||
},
|
||||
{
|
||||
{ 5153746,9909285,1723747,-2777874,30523605,5516873,19480852,5230134,-23952439,-15175766 },
|
||||
{ -30269007,-3463509,7665486,10083793,28475525,1649722,20654025,16520125,30598449,7715701 },
|
||||
{ 28881845,14381568,9657904,3680757,-20181635,7843316,-31400660,1370708,29794553,-1409300 },
|
||||
},
|
||||
{
|
||||
{ -22518993,-6692182,14201702,-8745502,-23510406,8844726,18474211,-1361450,-13062696,13821877 },
|
||||
{ -6455177,-7839871,3374702,-4740862,-27098617,-10571707,31655028,-7212327,18853322,-14220951 },
|
||||
{ 4566830,-12963868,-28974889,-12240689,-7602672,-2830569,-8514358,-10431137,2207753,-3209784 },
|
||||
},
|
||||
{
|
||||
{ -25154831,-4185821,29681144,7868801,-6854661,-9423865,-12437364,-663000,-31111463,-16132436 },
|
||||
{ 25576264,-2703214,7349804,-11814844,16472782,9300885,3844789,15725684,171356,6466918 },
|
||||
{ 23103977,13316479,9739013,-16149481,817875,-15038942,8965339,-14088058,-30714912,16193877 },
|
||||
},
|
||||
{
|
||||
{ -33521811,3180713,-2394130,14003687,-16903474,-16270840,17238398,4729455,-18074513,9256800 },
|
||||
{ -25182317,-4174131,32336398,5036987,-21236817,11360617,22616405,9761698,-19827198,630305 },
|
||||
{ -13720693,2639453,-24237460,-7406481,9494427,-5774029,-6554551,-15960994,-2449256,-14291300 },
|
||||
},
|
||||
{
|
||||
{ -3151181,-5046075,9282714,6866145,-31907062,-863023,-18940575,15033784,25105118,-7894876 },
|
||||
{ -24326370,15950226,-31801215,-14592823,-11662737,-5090925,1573892,-2625887,2198790,-15804619 },
|
||||
{ -3099351,10324967,-2241613,7453183,-5446979,-2735503,-13812022,-16236442,-32461234,-12290683 },
|
||||
},
|
||||
|
|
@ -1 +0,0 @@
|
|||
-10913610,13857413,-15372611,6949391,114729,-8787816,-6275908,-3247719,-18696448,-12055116
|
||||
|
|
@ -1 +0,0 @@
|
|||
-21827239,-5839606,-30745221,13898782,229458,15978800,-12551817,-6495438,29715968,9444199
|
||||
|
|
@ -1,56 +0,0 @@
|
|||
#ifndef FE_H
|
||||
#define FE_H
|
||||
|
||||
#include "crypto_int32.h"
|
||||
|
||||
typedef crypto_int32 fe[10];
|
||||
|
||||
/*
|
||||
fe means field element.
|
||||
Here the field is \Z/(2^255-19).
|
||||
An element t, entries t[0]...t[9], represents the integer
|
||||
t[0]+2^26 t[1]+2^51 t[2]+2^77 t[3]+2^102 t[4]+...+2^230 t[9].
|
||||
Bounds on each t[i] vary depending on context.
|
||||
*/
|
||||
|
||||
#define fe_frombytes crypto_sign_ed25519_ref10_fe_frombytes
|
||||
#define fe_tobytes crypto_sign_ed25519_ref10_fe_tobytes
|
||||
#define fe_copy crypto_sign_ed25519_ref10_fe_copy
|
||||
#define fe_isnonzero crypto_sign_ed25519_ref10_fe_isnonzero
|
||||
#define fe_isnegative crypto_sign_ed25519_ref10_fe_isnegative
|
||||
#define fe_0 crypto_sign_ed25519_ref10_fe_0
|
||||
#define fe_1 crypto_sign_ed25519_ref10_fe_1
|
||||
#define fe_cswap crypto_sign_ed25519_ref10_fe_cswap
|
||||
#define fe_cmov crypto_sign_ed25519_ref10_fe_cmov
|
||||
#define fe_add crypto_sign_ed25519_ref10_fe_add
|
||||
#define fe_sub crypto_sign_ed25519_ref10_fe_sub
|
||||
#define fe_neg crypto_sign_ed25519_ref10_fe_neg
|
||||
#define fe_mul crypto_sign_ed25519_ref10_fe_mul
|
||||
#define fe_sq crypto_sign_ed25519_ref10_fe_sq
|
||||
#define fe_sq2 crypto_sign_ed25519_ref10_fe_sq2
|
||||
#define fe_mul121666 crypto_sign_ed25519_ref10_fe_mul121666
|
||||
#define fe_invert crypto_sign_ed25519_ref10_fe_invert
|
||||
#define fe_pow22523 crypto_sign_ed25519_ref10_fe_pow22523
|
||||
|
||||
extern void fe_frombytes(fe,const unsigned char *);
|
||||
extern void fe_tobytes(unsigned char *,const fe);
|
||||
|
||||
extern void fe_copy(fe,const fe);
|
||||
extern int fe_isnonzero(const fe);
|
||||
extern int fe_isnegative(const fe);
|
||||
extern void fe_0(fe);
|
||||
extern void fe_1(fe);
|
||||
extern void fe_cswap(fe,fe,unsigned int);
|
||||
extern void fe_cmov(fe,const fe,unsigned int);
|
||||
|
||||
extern void fe_add(fe,const fe,const fe);
|
||||
extern void fe_sub(fe,const fe,const fe);
|
||||
extern void fe_neg(fe,const fe);
|
||||
extern void fe_mul(fe,const fe,const fe);
|
||||
extern void fe_sq(fe,const fe);
|
||||
extern void fe_sq2(fe,const fe);
|
||||
extern void fe_mul121666(fe,const fe);
|
||||
extern void fe_invert(fe,const fe);
|
||||
extern void fe_pow22523(fe,const fe);
|
||||
|
||||
#endif
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = 0
|
||||
*/
|
||||
|
||||
void fe_0(fe h)
|
||||
{
|
||||
h[0] = 0;
|
||||
h[1] = 0;
|
||||
h[2] = 0;
|
||||
h[3] = 0;
|
||||
h[4] = 0;
|
||||
h[5] = 0;
|
||||
h[6] = 0;
|
||||
h[7] = 0;
|
||||
h[8] = 0;
|
||||
h[9] = 0;
|
||||
}
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = 1
|
||||
*/
|
||||
|
||||
void fe_1(fe h)
|
||||
{
|
||||
h[0] = 1;
|
||||
h[1] = 0;
|
||||
h[2] = 0;
|
||||
h[3] = 0;
|
||||
h[4] = 0;
|
||||
h[5] = 0;
|
||||
h[6] = 0;
|
||||
h[7] = 0;
|
||||
h[8] = 0;
|
||||
h[9] = 0;
|
||||
}
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = f + g
|
||||
Can overlap h with f or g.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
void fe_add(fe h,const fe f,const fe g)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 h0 = f0 + g0;
|
||||
crypto_int32 h1 = f1 + g1;
|
||||
crypto_int32 h2 = f2 + g2;
|
||||
crypto_int32 h3 = f3 + g3;
|
||||
crypto_int32 h4 = f4 + g4;
|
||||
crypto_int32 h5 = f5 + g5;
|
||||
crypto_int32 h6 = f6 + g6;
|
||||
crypto_int32 h7 = f7 + g7;
|
||||
crypto_int32 h8 = f8 + g8;
|
||||
crypto_int32 h9 = f9 + g9;
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
Replace (f,g) with (g,g) if b == 1;
|
||||
replace (f,g) with (f,g) if b == 0.
|
||||
|
||||
Preconditions: b in {0,1}.
|
||||
*/
|
||||
|
||||
void fe_cmov(fe f,const fe g,unsigned int b)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 x0 = f0 ^ g0;
|
||||
crypto_int32 x1 = f1 ^ g1;
|
||||
crypto_int32 x2 = f2 ^ g2;
|
||||
crypto_int32 x3 = f3 ^ g3;
|
||||
crypto_int32 x4 = f4 ^ g4;
|
||||
crypto_int32 x5 = f5 ^ g5;
|
||||
crypto_int32 x6 = f6 ^ g6;
|
||||
crypto_int32 x7 = f7 ^ g7;
|
||||
crypto_int32 x8 = f8 ^ g8;
|
||||
crypto_int32 x9 = f9 ^ g9;
|
||||
b = -b;
|
||||
x0 &= b;
|
||||
x1 &= b;
|
||||
x2 &= b;
|
||||
x3 &= b;
|
||||
x4 &= b;
|
||||
x5 &= b;
|
||||
x6 &= b;
|
||||
x7 &= b;
|
||||
x8 &= b;
|
||||
x9 &= b;
|
||||
f[0] = f0 ^ x0;
|
||||
f[1] = f1 ^ x1;
|
||||
f[2] = f2 ^ x2;
|
||||
f[3] = f3 ^ x3;
|
||||
f[4] = f4 ^ x4;
|
||||
f[5] = f5 ^ x5;
|
||||
f[6] = f6 ^ x6;
|
||||
f[7] = f7 ^ x7;
|
||||
f[8] = f8 ^ x8;
|
||||
f[9] = f9 ^ x9;
|
||||
}
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = f
|
||||
*/
|
||||
|
||||
void fe_copy(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
h[0] = f0;
|
||||
h[1] = f1;
|
||||
h[2] = f2;
|
||||
h[3] = f3;
|
||||
h[4] = f4;
|
||||
h[5] = f5;
|
||||
h[6] = f6;
|
||||
h[7] = f7;
|
||||
h[8] = f8;
|
||||
h[9] = f9;
|
||||
}
|
||||
|
|
@ -1,73 +0,0 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
#include "crypto_uint64.h"
|
||||
|
||||
static crypto_uint64 load_3(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
return result;
|
||||
}
|
||||
|
||||
static crypto_uint64 load_4(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
result |= ((crypto_uint64) in[3]) << 24;
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
Ignores top bit of h.
|
||||
*/
|
||||
|
||||
void fe_frombytes(fe h,const unsigned char *s)
|
||||
{
|
||||
crypto_int64 h0 = load_4(s);
|
||||
crypto_int64 h1 = load_3(s + 4) << 6;
|
||||
crypto_int64 h2 = load_3(s + 7) << 5;
|
||||
crypto_int64 h3 = load_3(s + 10) << 3;
|
||||
crypto_int64 h4 = load_3(s + 13) << 2;
|
||||
crypto_int64 h5 = load_4(s + 16);
|
||||
crypto_int64 h6 = load_3(s + 20) << 7;
|
||||
crypto_int64 h7 = load_3(s + 23) << 5;
|
||||
crypto_int64 h8 = load_3(s + 26) << 4;
|
||||
crypto_int64 h9 = (load_3(s + 29) & 8388607) << 2;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
void fe_invert(fe out,const fe z)
|
||||
{
|
||||
fe t0;
|
||||
fe t1;
|
||||
fe t2;
|
||||
fe t3;
|
||||
int i;
|
||||
|
||||
#include "pow225521.h"
|
||||
|
||||
return;
|
||||
}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
return 1 if f is in {1,3,5,...,q-2}
|
||||
return 0 if f is in {0,2,4,...,q-1}
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
int fe_isnegative(const fe f)
|
||||
{
|
||||
unsigned char s[32];
|
||||
fe_tobytes(s,f);
|
||||
return s[0] & 1;
|
||||
}
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_verify_32.h"
|
||||
|
||||
/*
|
||||
return 1 if f == 0
|
||||
return 0 if f != 0
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
static const unsigned char zero[32];
|
||||
|
||||
int fe_isnonzero(const fe f)
|
||||
{
|
||||
unsigned char s[32];
|
||||
fe_tobytes(s,f);
|
||||
return crypto_verify_32(s,zero);
|
||||
}
|
||||
|
|
@ -1,253 +0,0 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
|
||||
/*
|
||||
h = f * g
|
||||
Can overlap h with f or g.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|g| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||
*/
|
||||
|
||||
/*
|
||||
Notes on implementation strategy:
|
||||
|
||||
Using schoolbook multiplication.
|
||||
Karatsuba would save a little in some cost models.
|
||||
|
||||
Most multiplications by 2 and 19 are 32-bit precomputations;
|
||||
cheaper than 64-bit postcomputations.
|
||||
|
||||
There is one remaining multiplication by 19 in the carry chain;
|
||||
one *19 precomputation can be merged into this,
|
||||
but the resulting data flow is considerably less clean.
|
||||
|
||||
There are 12 carries below.
|
||||
10 of them are 2-way parallelizable and vectorizable.
|
||||
Can get away with 11 carries, but then data flow is much deeper.
|
||||
|
||||
With tighter constraints on inputs can squeeze carries into int32.
|
||||
*/
|
||||
|
||||
void fe_mul(fe h,const fe f,const fe g)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 g1_19 = 19 * g1; /* 1.959375*2^29 */
|
||||
crypto_int32 g2_19 = 19 * g2; /* 1.959375*2^30; still ok */
|
||||
crypto_int32 g3_19 = 19 * g3;
|
||||
crypto_int32 g4_19 = 19 * g4;
|
||||
crypto_int32 g5_19 = 19 * g5;
|
||||
crypto_int32 g6_19 = 19 * g6;
|
||||
crypto_int32 g7_19 = 19 * g7;
|
||||
crypto_int32 g8_19 = 19 * g8;
|
||||
crypto_int32 g9_19 = 19 * g9;
|
||||
crypto_int32 f1_2 = 2 * f1;
|
||||
crypto_int32 f3_2 = 2 * f3;
|
||||
crypto_int32 f5_2 = 2 * f5;
|
||||
crypto_int32 f7_2 = 2 * f7;
|
||||
crypto_int32 f9_2 = 2 * f9;
|
||||
crypto_int64 f0g0 = f0 * (crypto_int64) g0;
|
||||
crypto_int64 f0g1 = f0 * (crypto_int64) g1;
|
||||
crypto_int64 f0g2 = f0 * (crypto_int64) g2;
|
||||
crypto_int64 f0g3 = f0 * (crypto_int64) g3;
|
||||
crypto_int64 f0g4 = f0 * (crypto_int64) g4;
|
||||
crypto_int64 f0g5 = f0 * (crypto_int64) g5;
|
||||
crypto_int64 f0g6 = f0 * (crypto_int64) g6;
|
||||
crypto_int64 f0g7 = f0 * (crypto_int64) g7;
|
||||
crypto_int64 f0g8 = f0 * (crypto_int64) g8;
|
||||
crypto_int64 f0g9 = f0 * (crypto_int64) g9;
|
||||
crypto_int64 f1g0 = f1 * (crypto_int64) g0;
|
||||
crypto_int64 f1g1_2 = f1_2 * (crypto_int64) g1;
|
||||
crypto_int64 f1g2 = f1 * (crypto_int64) g2;
|
||||
crypto_int64 f1g3_2 = f1_2 * (crypto_int64) g3;
|
||||
crypto_int64 f1g4 = f1 * (crypto_int64) g4;
|
||||
crypto_int64 f1g5_2 = f1_2 * (crypto_int64) g5;
|
||||
crypto_int64 f1g6 = f1 * (crypto_int64) g6;
|
||||
crypto_int64 f1g7_2 = f1_2 * (crypto_int64) g7;
|
||||
crypto_int64 f1g8 = f1 * (crypto_int64) g8;
|
||||
crypto_int64 f1g9_38 = f1_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f2g0 = f2 * (crypto_int64) g0;
|
||||
crypto_int64 f2g1 = f2 * (crypto_int64) g1;
|
||||
crypto_int64 f2g2 = f2 * (crypto_int64) g2;
|
||||
crypto_int64 f2g3 = f2 * (crypto_int64) g3;
|
||||
crypto_int64 f2g4 = f2 * (crypto_int64) g4;
|
||||
crypto_int64 f2g5 = f2 * (crypto_int64) g5;
|
||||
crypto_int64 f2g6 = f2 * (crypto_int64) g6;
|
||||
crypto_int64 f2g7 = f2 * (crypto_int64) g7;
|
||||
crypto_int64 f2g8_19 = f2 * (crypto_int64) g8_19;
|
||||
crypto_int64 f2g9_19 = f2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f3g0 = f3 * (crypto_int64) g0;
|
||||
crypto_int64 f3g1_2 = f3_2 * (crypto_int64) g1;
|
||||
crypto_int64 f3g2 = f3 * (crypto_int64) g2;
|
||||
crypto_int64 f3g3_2 = f3_2 * (crypto_int64) g3;
|
||||
crypto_int64 f3g4 = f3 * (crypto_int64) g4;
|
||||
crypto_int64 f3g5_2 = f3_2 * (crypto_int64) g5;
|
||||
crypto_int64 f3g6 = f3 * (crypto_int64) g6;
|
||||
crypto_int64 f3g7_38 = f3_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f3g8_19 = f3 * (crypto_int64) g8_19;
|
||||
crypto_int64 f3g9_38 = f3_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f4g0 = f4 * (crypto_int64) g0;
|
||||
crypto_int64 f4g1 = f4 * (crypto_int64) g1;
|
||||
crypto_int64 f4g2 = f4 * (crypto_int64) g2;
|
||||
crypto_int64 f4g3 = f4 * (crypto_int64) g3;
|
||||
crypto_int64 f4g4 = f4 * (crypto_int64) g4;
|
||||
crypto_int64 f4g5 = f4 * (crypto_int64) g5;
|
||||
crypto_int64 f4g6_19 = f4 * (crypto_int64) g6_19;
|
||||
crypto_int64 f4g7_19 = f4 * (crypto_int64) g7_19;
|
||||
crypto_int64 f4g8_19 = f4 * (crypto_int64) g8_19;
|
||||
crypto_int64 f4g9_19 = f4 * (crypto_int64) g9_19;
|
||||
crypto_int64 f5g0 = f5 * (crypto_int64) g0;
|
||||
crypto_int64 f5g1_2 = f5_2 * (crypto_int64) g1;
|
||||
crypto_int64 f5g2 = f5 * (crypto_int64) g2;
|
||||
crypto_int64 f5g3_2 = f5_2 * (crypto_int64) g3;
|
||||
crypto_int64 f5g4 = f5 * (crypto_int64) g4;
|
||||
crypto_int64 f5g5_38 = f5_2 * (crypto_int64) g5_19;
|
||||
crypto_int64 f5g6_19 = f5 * (crypto_int64) g6_19;
|
||||
crypto_int64 f5g7_38 = f5_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f5g8_19 = f5 * (crypto_int64) g8_19;
|
||||
crypto_int64 f5g9_38 = f5_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f6g0 = f6 * (crypto_int64) g0;
|
||||
crypto_int64 f6g1 = f6 * (crypto_int64) g1;
|
||||
crypto_int64 f6g2 = f6 * (crypto_int64) g2;
|
||||
crypto_int64 f6g3 = f6 * (crypto_int64) g3;
|
||||
crypto_int64 f6g4_19 = f6 * (crypto_int64) g4_19;
|
||||
crypto_int64 f6g5_19 = f6 * (crypto_int64) g5_19;
|
||||
crypto_int64 f6g6_19 = f6 * (crypto_int64) g6_19;
|
||||
crypto_int64 f6g7_19 = f6 * (crypto_int64) g7_19;
|
||||
crypto_int64 f6g8_19 = f6 * (crypto_int64) g8_19;
|
||||
crypto_int64 f6g9_19 = f6 * (crypto_int64) g9_19;
|
||||
crypto_int64 f7g0 = f7 * (crypto_int64) g0;
|
||||
crypto_int64 f7g1_2 = f7_2 * (crypto_int64) g1;
|
||||
crypto_int64 f7g2 = f7 * (crypto_int64) g2;
|
||||
crypto_int64 f7g3_38 = f7_2 * (crypto_int64) g3_19;
|
||||
crypto_int64 f7g4_19 = f7 * (crypto_int64) g4_19;
|
||||
crypto_int64 f7g5_38 = f7_2 * (crypto_int64) g5_19;
|
||||
crypto_int64 f7g6_19 = f7 * (crypto_int64) g6_19;
|
||||
crypto_int64 f7g7_38 = f7_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f7g8_19 = f7 * (crypto_int64) g8_19;
|
||||
crypto_int64 f7g9_38 = f7_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f8g0 = f8 * (crypto_int64) g0;
|
||||
crypto_int64 f8g1 = f8 * (crypto_int64) g1;
|
||||
crypto_int64 f8g2_19 = f8 * (crypto_int64) g2_19;
|
||||
crypto_int64 f8g3_19 = f8 * (crypto_int64) g3_19;
|
||||
crypto_int64 f8g4_19 = f8 * (crypto_int64) g4_19;
|
||||
crypto_int64 f8g5_19 = f8 * (crypto_int64) g5_19;
|
||||
crypto_int64 f8g6_19 = f8 * (crypto_int64) g6_19;
|
||||
crypto_int64 f8g7_19 = f8 * (crypto_int64) g7_19;
|
||||
crypto_int64 f8g8_19 = f8 * (crypto_int64) g8_19;
|
||||
crypto_int64 f8g9_19 = f8 * (crypto_int64) g9_19;
|
||||
crypto_int64 f9g0 = f9 * (crypto_int64) g0;
|
||||
crypto_int64 f9g1_38 = f9_2 * (crypto_int64) g1_19;
|
||||
crypto_int64 f9g2_19 = f9 * (crypto_int64) g2_19;
|
||||
crypto_int64 f9g3_38 = f9_2 * (crypto_int64) g3_19;
|
||||
crypto_int64 f9g4_19 = f9 * (crypto_int64) g4_19;
|
||||
crypto_int64 f9g5_38 = f9_2 * (crypto_int64) g5_19;
|
||||
crypto_int64 f9g6_19 = f9 * (crypto_int64) g6_19;
|
||||
crypto_int64 f9g7_38 = f9_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f9g8_19 = f9 * (crypto_int64) g8_19;
|
||||
crypto_int64 f9g9_38 = f9_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 h0 = f0g0+f1g9_38+f2g8_19+f3g7_38+f4g6_19+f5g5_38+f6g4_19+f7g3_38+f8g2_19+f9g1_38;
|
||||
crypto_int64 h1 = f0g1+f1g0 +f2g9_19+f3g8_19+f4g7_19+f5g6_19+f6g5_19+f7g4_19+f8g3_19+f9g2_19;
|
||||
crypto_int64 h2 = f0g2+f1g1_2 +f2g0 +f3g9_38+f4g8_19+f5g7_38+f6g6_19+f7g5_38+f8g4_19+f9g3_38;
|
||||
crypto_int64 h3 = f0g3+f1g2 +f2g1 +f3g0 +f4g9_19+f5g8_19+f6g7_19+f7g6_19+f8g5_19+f9g4_19;
|
||||
crypto_int64 h4 = f0g4+f1g3_2 +f2g2 +f3g1_2 +f4g0 +f5g9_38+f6g8_19+f7g7_38+f8g6_19+f9g5_38;
|
||||
crypto_int64 h5 = f0g5+f1g4 +f2g3 +f3g2 +f4g1 +f5g0 +f6g9_19+f7g8_19+f8g7_19+f9g6_19;
|
||||
crypto_int64 h6 = f0g6+f1g5_2 +f2g4 +f3g3_2 +f4g2 +f5g1_2 +f6g0 +f7g9_38+f8g8_19+f9g7_38;
|
||||
crypto_int64 h7 = f0g7+f1g6 +f2g5 +f3g4 +f4g3 +f5g2 +f6g1 +f7g0 +f8g9_19+f9g8_19;
|
||||
crypto_int64 h8 = f0g8+f1g7_2 +f2g6 +f3g5_2 +f4g4 +f5g3_2 +f6g2 +f7g1_2 +f8g0 +f9g9_38;
|
||||
crypto_int64 h9 = f0g9+f1g8 +f2g7 +f3g6 +f4g5 +f5g4 +f6g3 +f7g2 +f8g1 +f9g0 ;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
/*
|
||||
|h0| <= (1.65*1.65*2^52*(1+19+19+19+19)+1.65*1.65*2^50*(38+38+38+38+38))
|
||||
i.e. |h0| <= 1.4*2^60; narrower ranges for h2, h4, h6, h8
|
||||
|h1| <= (1.65*1.65*2^51*(1+1+19+19+19+19+19+19+19+19))
|
||||
i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9
|
||||
*/
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
/* |h0| <= 2^25 */
|
||||
/* |h4| <= 2^25 */
|
||||
/* |h1| <= 1.71*2^59 */
|
||||
/* |h5| <= 1.71*2^59 */
|
||||
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
/* |h1| <= 2^24; from now on fits into int32 */
|
||||
/* |h5| <= 2^24; from now on fits into int32 */
|
||||
/* |h2| <= 1.41*2^60 */
|
||||
/* |h6| <= 1.41*2^60 */
|
||||
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
/* |h2| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h6| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h3| <= 1.71*2^59 */
|
||||
/* |h7| <= 1.71*2^59 */
|
||||
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
/* |h3| <= 2^24; from now on fits into int32 unchanged */
|
||||
/* |h7| <= 2^24; from now on fits into int32 unchanged */
|
||||
/* |h4| <= 1.72*2^34 */
|
||||
/* |h8| <= 1.41*2^60 */
|
||||
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
/* |h4| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h8| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h5| <= 1.01*2^24 */
|
||||
/* |h9| <= 1.71*2^59 */
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
/* |h9| <= 2^24; from now on fits into int32 unchanged */
|
||||
/* |h0| <= 1.1*2^39 */
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
/* |h0| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h1| <= 1.01*2^24 */
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = -f
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
*/
|
||||
|
||||
void fe_neg(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 h0 = -f0;
|
||||
crypto_int32 h1 = -f1;
|
||||
crypto_int32 h2 = -f2;
|
||||
crypto_int32 h3 = -f3;
|
||||
crypto_int32 h4 = -f4;
|
||||
crypto_int32 h5 = -f5;
|
||||
crypto_int32 h6 = -f6;
|
||||
crypto_int32 h7 = -f7;
|
||||
crypto_int32 h8 = -f8;
|
||||
crypto_int32 h9 = -f9;
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
void fe_pow22523(fe out,const fe z)
|
||||
{
|
||||
fe t0;
|
||||
fe t1;
|
||||
fe t2;
|
||||
int i;
|
||||
|
||||
#include "pow22523.h"
|
||||
|
||||
return;
|
||||
}
|
||||
|
|
@ -1,149 +0,0 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
|
||||
/*
|
||||
h = f * f
|
||||
Can overlap h with f.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||
*/
|
||||
|
||||
/*
|
||||
See fe_mul.c for discussion of implementation strategy.
|
||||
*/
|
||||
|
||||
void fe_sq(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 f0_2 = 2 * f0;
|
||||
crypto_int32 f1_2 = 2 * f1;
|
||||
crypto_int32 f2_2 = 2 * f2;
|
||||
crypto_int32 f3_2 = 2 * f3;
|
||||
crypto_int32 f4_2 = 2 * f4;
|
||||
crypto_int32 f5_2 = 2 * f5;
|
||||
crypto_int32 f6_2 = 2 * f6;
|
||||
crypto_int32 f7_2 = 2 * f7;
|
||||
crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
|
||||
crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
|
||||
crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
|
||||
crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
|
||||
crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
|
||||
crypto_int64 f0f0 = f0 * (crypto_int64) f0;
|
||||
crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1;
|
||||
crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2;
|
||||
crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3;
|
||||
crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4;
|
||||
crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5;
|
||||
crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6;
|
||||
crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7;
|
||||
crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8;
|
||||
crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9;
|
||||
crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1;
|
||||
crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2;
|
||||
crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2;
|
||||
crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4;
|
||||
crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6;
|
||||
crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2;
|
||||
crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8;
|
||||
crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f2f2 = f2 * (crypto_int64) f2;
|
||||
crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3;
|
||||
crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4;
|
||||
crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5;
|
||||
crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6;
|
||||
crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7;
|
||||
crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3;
|
||||
crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4;
|
||||
crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6;
|
||||
crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f4f4 = f4 * (crypto_int64) f4;
|
||||
crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5;
|
||||
crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38;
|
||||
crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38;
|
||||
crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38;
|
||||
crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19;
|
||||
crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38;
|
||||
crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38;
|
||||
crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38;
|
||||
crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19;
|
||||
crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38;
|
||||
crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38;
|
||||
crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
|
||||
crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
|
||||
crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
|
||||
crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
|
||||
crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
|
||||
crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
|
||||
crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
|
||||
crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
|
||||
crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
|
||||
crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -1,160 +0,0 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
|
||||
/*
|
||||
h = 2 * f * f
|
||||
Can overlap h with f.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||
*/
|
||||
|
||||
/*
|
||||
See fe_mul.c for discussion of implementation strategy.
|
||||
*/
|
||||
|
||||
void fe_sq2(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 f0_2 = 2 * f0;
|
||||
crypto_int32 f1_2 = 2 * f1;
|
||||
crypto_int32 f2_2 = 2 * f2;
|
||||
crypto_int32 f3_2 = 2 * f3;
|
||||
crypto_int32 f4_2 = 2 * f4;
|
||||
crypto_int32 f5_2 = 2 * f5;
|
||||
crypto_int32 f6_2 = 2 * f6;
|
||||
crypto_int32 f7_2 = 2 * f7;
|
||||
crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
|
||||
crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
|
||||
crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
|
||||
crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
|
||||
crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
|
||||
crypto_int64 f0f0 = f0 * (crypto_int64) f0;
|
||||
crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1;
|
||||
crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2;
|
||||
crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3;
|
||||
crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4;
|
||||
crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5;
|
||||
crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6;
|
||||
crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7;
|
||||
crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8;
|
||||
crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9;
|
||||
crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1;
|
||||
crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2;
|
||||
crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2;
|
||||
crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4;
|
||||
crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6;
|
||||
crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2;
|
||||
crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8;
|
||||
crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f2f2 = f2 * (crypto_int64) f2;
|
||||
crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3;
|
||||
crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4;
|
||||
crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5;
|
||||
crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6;
|
||||
crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7;
|
||||
crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3;
|
||||
crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4;
|
||||
crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6;
|
||||
crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f4f4 = f4 * (crypto_int64) f4;
|
||||
crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5;
|
||||
crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38;
|
||||
crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38;
|
||||
crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38;
|
||||
crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19;
|
||||
crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38;
|
||||
crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38;
|
||||
crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38;
|
||||
crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19;
|
||||
crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38;
|
||||
crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38;
|
||||
crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
|
||||
crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
|
||||
crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
|
||||
crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
|
||||
crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
|
||||
crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
|
||||
crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
|
||||
crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
|
||||
crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
|
||||
crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
h0 += h0;
|
||||
h1 += h1;
|
||||
h2 += h2;
|
||||
h3 += h3;
|
||||
h4 += h4;
|
||||
h5 += h5;
|
||||
h6 += h6;
|
||||
h7 += h7;
|
||||
h8 += h8;
|
||||
h9 += h9;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = f - g
|
||||
Can overlap h with f or g.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
void fe_sub(fe h,const fe f,const fe g)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 h0 = f0 - g0;
|
||||
crypto_int32 h1 = f1 - g1;
|
||||
crypto_int32 h2 = f2 - g2;
|
||||
crypto_int32 h3 = f3 - g3;
|
||||
crypto_int32 h4 = f4 - g4;
|
||||
crypto_int32 h5 = f5 - g5;
|
||||
crypto_int32 h6 = f6 - g6;
|
||||
crypto_int32 h7 = f7 - g7;
|
||||
crypto_int32 h8 = f8 - g8;
|
||||
crypto_int32 h9 = f9 - g9;
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -1,119 +0,0 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
Preconditions:
|
||||
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
|
||||
Write p=2^255-19; q=floor(h/p).
|
||||
Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
|
||||
|
||||
Proof:
|
||||
Have |h|<=p so |q|<=1 so |19^2 2^(-255) q|<1/4.
|
||||
Also have |h-2^230 h9|<2^231 so |19 2^(-255)(h-2^230 h9)|<1/4.
|
||||
|
||||
Write y=2^(-1)-19^2 2^(-255)q-19 2^(-255)(h-2^230 h9).
|
||||
Then 0<y<1.
|
||||
|
||||
Write r=h-pq.
|
||||
Have 0<=r<=p-1=2^255-20.
|
||||
Thus 0<=r+19(2^-255)r<r+19(2^-255)2^255<=2^255-1.
|
||||
|
||||
Write x=r+19(2^-255)r+y.
|
||||
Then 0<x<2^255 so floor(2^(-255)x) = 0 so floor(q+2^(-255)x) = q.
|
||||
|
||||
Have q+2^(-255)x = 2^(-255)(h + 19 2^(-25) h9 + 2^(-1))
|
||||
so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q.
|
||||
*/
|
||||
|
||||
void fe_tobytes(unsigned char *s,const fe h)
|
||||
{
|
||||
crypto_int32 h0 = h[0];
|
||||
crypto_int32 h1 = h[1];
|
||||
crypto_int32 h2 = h[2];
|
||||
crypto_int32 h3 = h[3];
|
||||
crypto_int32 h4 = h[4];
|
||||
crypto_int32 h5 = h[5];
|
||||
crypto_int32 h6 = h[6];
|
||||
crypto_int32 h7 = h[7];
|
||||
crypto_int32 h8 = h[8];
|
||||
crypto_int32 h9 = h[9];
|
||||
crypto_int32 q;
|
||||
crypto_int32 carry0;
|
||||
crypto_int32 carry1;
|
||||
crypto_int32 carry2;
|
||||
crypto_int32 carry3;
|
||||
crypto_int32 carry4;
|
||||
crypto_int32 carry5;
|
||||
crypto_int32 carry6;
|
||||
crypto_int32 carry7;
|
||||
crypto_int32 carry8;
|
||||
crypto_int32 carry9;
|
||||
|
||||
q = (19 * h9 + (((crypto_int32) 1) << 24)) >> 25;
|
||||
q = (h0 + q) >> 26;
|
||||
q = (h1 + q) >> 25;
|
||||
q = (h2 + q) >> 26;
|
||||
q = (h3 + q) >> 25;
|
||||
q = (h4 + q) >> 26;
|
||||
q = (h5 + q) >> 25;
|
||||
q = (h6 + q) >> 26;
|
||||
q = (h7 + q) >> 25;
|
||||
q = (h8 + q) >> 26;
|
||||
q = (h9 + q) >> 25;
|
||||
|
||||
/* Goal: Output h-(2^255-19)q, which is between 0 and 2^255-20. */
|
||||
h0 += 19 * q;
|
||||
/* Goal: Output h-2^255 q, which is between 0 and 2^255-20. */
|
||||
|
||||
carry0 = h0 >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry1 = h1 >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry2 = h2 >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry3 = h3 >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry4 = h4 >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry5 = h5 >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
carry6 = h6 >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
carry7 = h7 >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
carry8 = h8 >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
carry9 = h9 >> 25; h9 -= carry9 << 25;
|
||||
/* h10 = carry9 */
|
||||
|
||||
/*
|
||||
Goal: Output h0+...+2^255 h10-2^255 q, which is between 0 and 2^255-20.
|
||||
Have h0+...+2^230 h9 between 0 and 2^255-1;
|
||||
evidently 2^255 h10-2^255 q = 0.
|
||||
Goal: Output h0+...+2^230 h9.
|
||||
*/
|
||||
|
||||
s[0] = h0 >> 0;
|
||||
s[1] = h0 >> 8;
|
||||
s[2] = h0 >> 16;
|
||||
s[3] = (h0 >> 24) | (h1 << 2);
|
||||
s[4] = h1 >> 6;
|
||||
s[5] = h1 >> 14;
|
||||
s[6] = (h1 >> 22) | (h2 << 3);
|
||||
s[7] = h2 >> 5;
|
||||
s[8] = h2 >> 13;
|
||||
s[9] = (h2 >> 21) | (h3 << 5);
|
||||
s[10] = h3 >> 3;
|
||||
s[11] = h3 >> 11;
|
||||
s[12] = (h3 >> 19) | (h4 << 6);
|
||||
s[13] = h4 >> 2;
|
||||
s[14] = h4 >> 10;
|
||||
s[15] = h4 >> 18;
|
||||
s[16] = h5 >> 0;
|
||||
s[17] = h5 >> 8;
|
||||
s[18] = h5 >> 16;
|
||||
s[19] = (h5 >> 24) | (h6 << 1);
|
||||
s[20] = h6 >> 7;
|
||||
s[21] = h6 >> 15;
|
||||
s[22] = (h6 >> 23) | (h7 << 3);
|
||||
s[23] = h7 >> 5;
|
||||
s[24] = h7 >> 13;
|
||||
s[25] = (h7 >> 21) | (h8 << 4);
|
||||
s[26] = h8 >> 4;
|
||||
s[27] = h8 >> 12;
|
||||
s[28] = (h8 >> 20) | (h9 << 6);
|
||||
s[29] = h9 >> 2;
|
||||
s[30] = h9 >> 10;
|
||||
s[31] = h9 >> 18;
|
||||
}
|
||||
|
|
@ -1,95 +0,0 @@
|
|||
#ifndef GE_H
|
||||
#define GE_H
|
||||
|
||||
/*
|
||||
ge means group element.
|
||||
|
||||
Here the group is the set of pairs (x,y) of field elements (see fe.h)
|
||||
satisfying -x^2 + y^2 = 1 + d x^2y^2
|
||||
where d = -121665/121666.
|
||||
|
||||
Representations:
|
||||
ge_p2 (projective): (X:Y:Z) satisfying x=X/Z, y=Y/Z
|
||||
ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT
|
||||
ge_p1p1 (completed): ((X:Z),(Y:T)) satisfying x=X/Z, y=Y/T
|
||||
ge_precomp (Duif): (y+x,y-x,2dxy)
|
||||
*/
|
||||
|
||||
#include "fe.h"
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
} ge_p2;
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
fe T;
|
||||
} ge_p3;
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
fe T;
|
||||
} ge_p1p1;
|
||||
|
||||
typedef struct {
|
||||
fe yplusx;
|
||||
fe yminusx;
|
||||
fe xy2d;
|
||||
} ge_precomp;
|
||||
|
||||
typedef struct {
|
||||
fe YplusX;
|
||||
fe YminusX;
|
||||
fe Z;
|
||||
fe T2d;
|
||||
} ge_cached;
|
||||
|
||||
#define ge_frombytes_negate_vartime crypto_sign_ed25519_ref10_ge_frombytes_negate_vartime
|
||||
#define ge_tobytes crypto_sign_ed25519_ref10_ge_tobytes
|
||||
#define ge_p3_tobytes crypto_sign_ed25519_ref10_ge_p3_tobytes
|
||||
|
||||
#define ge_p2_0 crypto_sign_ed25519_ref10_ge_p2_0
|
||||
#define ge_p3_0 crypto_sign_ed25519_ref10_ge_p3_0
|
||||
#define ge_precomp_0 crypto_sign_ed25519_ref10_ge_precomp_0
|
||||
#define ge_p3_to_p2 crypto_sign_ed25519_ref10_ge_p3_to_p2
|
||||
#define ge_p3_to_cached crypto_sign_ed25519_ref10_ge_p3_to_cached
|
||||
#define ge_p1p1_to_p2 crypto_sign_ed25519_ref10_ge_p1p1_to_p2
|
||||
#define ge_p1p1_to_p3 crypto_sign_ed25519_ref10_ge_p1p1_to_p3
|
||||
#define ge_p2_dbl crypto_sign_ed25519_ref10_ge_p2_dbl
|
||||
#define ge_p3_dbl crypto_sign_ed25519_ref10_ge_p3_dbl
|
||||
|
||||
#define ge_madd crypto_sign_ed25519_ref10_ge_madd
|
||||
#define ge_msub crypto_sign_ed25519_ref10_ge_msub
|
||||
#define ge_add crypto_sign_ed25519_ref10_ge_add
|
||||
#define ge_sub crypto_sign_ed25519_ref10_ge_sub
|
||||
#define ge_scalarmult_base crypto_sign_ed25519_ref10_ge_scalarmult_base
|
||||
#define ge_double_scalarmult_vartime crypto_sign_ed25519_ref10_ge_double_scalarmult_vartime
|
||||
|
||||
extern void ge_tobytes(unsigned char *,const ge_p2 *);
|
||||
extern void ge_p3_tobytes(unsigned char *,const ge_p3 *);
|
||||
extern int ge_frombytes_negate_vartime(ge_p3 *,const unsigned char *);
|
||||
|
||||
extern void ge_p2_0(ge_p2 *);
|
||||
extern void ge_p3_0(ge_p3 *);
|
||||
extern void ge_precomp_0(ge_precomp *);
|
||||
extern void ge_p3_to_p2(ge_p2 *,const ge_p3 *);
|
||||
extern void ge_p3_to_cached(ge_cached *,const ge_p3 *);
|
||||
extern void ge_p1p1_to_p2(ge_p2 *,const ge_p1p1 *);
|
||||
extern void ge_p1p1_to_p3(ge_p3 *,const ge_p1p1 *);
|
||||
extern void ge_p2_dbl(ge_p1p1 *,const ge_p2 *);
|
||||
extern void ge_p3_dbl(ge_p1p1 *,const ge_p3 *);
|
||||
|
||||
extern void ge_madd(ge_p1p1 *,const ge_p3 *,const ge_precomp *);
|
||||
extern void ge_msub(ge_p1p1 *,const ge_p3 *,const ge_precomp *);
|
||||
extern void ge_add(ge_p1p1 *,const ge_p3 *,const ge_cached *);
|
||||
extern void ge_sub(ge_p1p1 *,const ge_p3 *,const ge_cached *);
|
||||
extern void ge_scalarmult_base(ge_p3 *,const unsigned char *);
|
||||
extern void ge_double_scalarmult_vartime(ge_p2 *,const unsigned char *,const ge_p3 *,const unsigned char *);
|
||||
|
||||
#endif
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p + q
|
||||
*/
|
||||
|
||||
void ge_add(ge_p1p1 *r,const ge_p3 *p,const ge_cached *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_add.h"
|
||||
}
|
||||
|
|
@ -1,97 +0,0 @@
|
|||
|
||||
/* qhasm: enter ge_add */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe Z2 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ZZ */
|
||||
|
||||
/* qhasm: fe YpX2 */
|
||||
|
||||
/* qhasm: fe YmX2 */
|
||||
|
||||
/* qhasm: fe T2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*YpX2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<YpX2=fe#15); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<YpX2=q->YplusX); */
|
||||
fe_mul(r->Z,r->X,q->YplusX);
|
||||
|
||||
/* qhasm: B = YmX1*YmX2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<YmX2=fe#16); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<YmX2=q->YminusX); */
|
||||
fe_mul(r->Y,r->Y,q->YminusX);
|
||||
|
||||
/* qhasm: C = T2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<T2d2=fe#18,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<T2d2=q->T2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->T2d,p->T);
|
||||
|
||||
/* qhasm: ZZ = Z1*Z2 */
|
||||
/* asm 1: fe_mul(>ZZ=fe#1,<Z1=fe#13,<Z2=fe#17); */
|
||||
/* asm 2: fe_mul(>ZZ=r->X,<Z1=p->Z,<Z2=q->Z); */
|
||||
fe_mul(r->X,p->Z,q->Z);
|
||||
|
||||
/* qhasm: D = 2*ZZ */
|
||||
/* asm 1: fe_add(>D=fe#5,<ZZ=fe#1,<ZZ=fe#1); */
|
||||
/* asm 2: fe_add(>D=t0,<ZZ=r->X,<ZZ=r->X); */
|
||||
fe_add(t0,r->X,r->X);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D+C */
|
||||
/* asm 1: fe_add(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_add(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D-C */
|
||||
/* asm 1: fe_sub(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_sub(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -1,96 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
static void slide(signed char *r,const unsigned char *a)
|
||||
{
|
||||
int i;
|
||||
int b;
|
||||
int k;
|
||||
|
||||
for (i = 0;i < 256;++i)
|
||||
r[i] = 1 & (a[i >> 3] >> (i & 7));
|
||||
|
||||
for (i = 0;i < 256;++i)
|
||||
if (r[i]) {
|
||||
for (b = 1;b <= 6 && i + b < 256;++b) {
|
||||
if (r[i + b]) {
|
||||
if (r[i] + (r[i + b] << b) <= 15) {
|
||||
r[i] += r[i + b] << b; r[i + b] = 0;
|
||||
} else if (r[i] - (r[i + b] << b) >= -15) {
|
||||
r[i] -= r[i + b] << b;
|
||||
for (k = i + b;k < 256;++k) {
|
||||
if (!r[k]) {
|
||||
r[k] = 1;
|
||||
break;
|
||||
}
|
||||
r[k] = 0;
|
||||
}
|
||||
} else
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static ge_precomp Bi[8] = {
|
||||
#include "base2.h"
|
||||
} ;
|
||||
|
||||
/*
|
||||
r = a * A + b * B
|
||||
where a = a[0]+256*a[1]+...+256^31 a[31].
|
||||
and b = b[0]+256*b[1]+...+256^31 b[31].
|
||||
B is the Ed25519 base point (x,4/5) with x positive.
|
||||
*/
|
||||
|
||||
void ge_double_scalarmult_vartime(ge_p2 *r,const unsigned char *a,const ge_p3 *A,const unsigned char *b)
|
||||
{
|
||||
signed char aslide[256];
|
||||
signed char bslide[256];
|
||||
ge_cached Ai[8]; /* A,3A,5A,7A,9A,11A,13A,15A */
|
||||
ge_p1p1 t;
|
||||
ge_p3 u;
|
||||
ge_p3 A2;
|
||||
int i;
|
||||
|
||||
slide(aslide,a);
|
||||
slide(bslide,b);
|
||||
|
||||
ge_p3_to_cached(&Ai[0],A);
|
||||
ge_p3_dbl(&t,A); ge_p1p1_to_p3(&A2,&t);
|
||||
ge_add(&t,&A2,&Ai[0]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[1],&u);
|
||||
ge_add(&t,&A2,&Ai[1]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[2],&u);
|
||||
ge_add(&t,&A2,&Ai[2]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[3],&u);
|
||||
ge_add(&t,&A2,&Ai[3]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[4],&u);
|
||||
ge_add(&t,&A2,&Ai[4]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[5],&u);
|
||||
ge_add(&t,&A2,&Ai[5]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[6],&u);
|
||||
ge_add(&t,&A2,&Ai[6]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[7],&u);
|
||||
|
||||
ge_p2_0(r);
|
||||
|
||||
for (i = 255;i >= 0;--i) {
|
||||
if (aslide[i] || bslide[i]) break;
|
||||
}
|
||||
|
||||
for (;i >= 0;--i) {
|
||||
ge_p2_dbl(&t,r);
|
||||
|
||||
if (aslide[i] > 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_add(&t,&u,&Ai[aslide[i]/2]);
|
||||
} else if (aslide[i] < 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_sub(&t,&u,&Ai[(-aslide[i])/2]);
|
||||
}
|
||||
|
||||
if (bslide[i] > 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_madd(&t,&u,&Bi[bslide[i]/2]);
|
||||
} else if (bslide[i] < 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_msub(&t,&u,&Bi[(-bslide[i])/2]);
|
||||
}
|
||||
|
||||
ge_p1p1_to_p2(r,&t);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
static const fe d = {
|
||||
#include "d.h"
|
||||
} ;
|
||||
|
||||
static const fe sqrtm1 = {
|
||||
#include "sqrtm1.h"
|
||||
} ;
|
||||
|
||||
int ge_frombytes_negate_vartime(ge_p3 *h,const unsigned char *s)
|
||||
{
|
||||
fe u;
|
||||
fe v;
|
||||
fe v3;
|
||||
fe vxx;
|
||||
fe check;
|
||||
|
||||
fe_frombytes(h->Y,s);
|
||||
fe_1(h->Z);
|
||||
fe_sq(u,h->Y);
|
||||
fe_mul(v,u,d);
|
||||
fe_sub(u,u,h->Z); /* u = y^2-1 */
|
||||
fe_add(v,v,h->Z); /* v = dy^2+1 */
|
||||
|
||||
fe_sq(v3,v);
|
||||
fe_mul(v3,v3,v); /* v3 = v^3 */
|
||||
fe_sq(h->X,v3);
|
||||
fe_mul(h->X,h->X,v);
|
||||
fe_mul(h->X,h->X,u); /* x = uv^7 */
|
||||
|
||||
fe_pow22523(h->X,h->X); /* x = (uv^7)^((q-5)/8) */
|
||||
fe_mul(h->X,h->X,v3);
|
||||
fe_mul(h->X,h->X,u); /* x = uv^3(uv^7)^((q-5)/8) */
|
||||
|
||||
fe_sq(vxx,h->X);
|
||||
fe_mul(vxx,vxx,v);
|
||||
fe_sub(check,vxx,u); /* vx^2-u */
|
||||
if (fe_isnonzero(check)) {
|
||||
fe_add(check,vxx,u); /* vx^2+u */
|
||||
if (fe_isnonzero(check)) return -1;
|
||||
fe_mul(h->X,h->X,sqrtm1);
|
||||
}
|
||||
|
||||
if (fe_isnegative(h->X) == (s[31] >> 7))
|
||||
fe_neg(h->X,h->X);
|
||||
|
||||
fe_mul(h->T,h->X,h->Y);
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p + q
|
||||
*/
|
||||
|
||||
void ge_madd(ge_p1p1 *r,const ge_p3 *p,const ge_precomp *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_madd.h"
|
||||
}
|
||||
|
|
@ -1,88 +0,0 @@
|
|||
|
||||
/* qhasm: enter ge_madd */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ypx2 */
|
||||
|
||||
/* qhasm: fe ymx2 */
|
||||
|
||||
/* qhasm: fe xy2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*ypx2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<ypx2=fe#15); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<ypx2=q->yplusx); */
|
||||
fe_mul(r->Z,r->X,q->yplusx);
|
||||
|
||||
/* qhasm: B = YmX1*ymx2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<ymx2=fe#16); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<ymx2=q->yminusx); */
|
||||
fe_mul(r->Y,r->Y,q->yminusx);
|
||||
|
||||
/* qhasm: C = xy2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<xy2d2=fe#17,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<xy2d2=q->xy2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->xy2d,p->T);
|
||||
|
||||
/* qhasm: D = 2*Z1 */
|
||||
/* asm 1: fe_add(>D=fe#5,<Z1=fe#13,<Z1=fe#13); */
|
||||
/* asm 2: fe_add(>D=t0,<Z1=p->Z,<Z1=p->Z); */
|
||||
fe_add(t0,p->Z,p->Z);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D+C */
|
||||
/* asm 1: fe_add(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_add(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D-C */
|
||||
/* asm 1: fe_sub(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_sub(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p - q
|
||||
*/
|
||||
|
||||
void ge_msub(ge_p1p1 *r,const ge_p3 *p,const ge_precomp *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_msub.h"
|
||||
}
|
||||
|
|
@ -1,88 +0,0 @@
|
|||
|
||||
/* qhasm: enter ge_msub */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ypx2 */
|
||||
|
||||
/* qhasm: fe ymx2 */
|
||||
|
||||
/* qhasm: fe xy2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*ymx2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<ymx2=fe#16); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<ymx2=q->yminusx); */
|
||||
fe_mul(r->Z,r->X,q->yminusx);
|
||||
|
||||
/* qhasm: B = YmX1*ypx2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<ypx2=fe#15); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<ypx2=q->yplusx); */
|
||||
fe_mul(r->Y,r->Y,q->yplusx);
|
||||
|
||||
/* qhasm: C = xy2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<xy2d2=fe#17,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<xy2d2=q->xy2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->xy2d,p->T);
|
||||
|
||||
/* qhasm: D = 2*Z1 */
|
||||
/* asm 1: fe_add(>D=fe#5,<Z1=fe#13,<Z1=fe#13); */
|
||||
/* asm 2: fe_add(>D=t0,<Z1=p->Z,<Z1=p->Z); */
|
||||
fe_add(t0,p->Z,p->Z);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D-C */
|
||||
/* asm 1: fe_sub(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_sub(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D+C */
|
||||
/* asm 1: fe_add(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_add(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
extern void ge_p1p1_to_p2(ge_p2 *r,const ge_p1p1 *p)
|
||||
{
|
||||
fe_mul(r->X,p->X,p->T);
|
||||
fe_mul(r->Y,p->Y,p->Z);
|
||||
fe_mul(r->Z,p->Z,p->T);
|
||||
}
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
extern void ge_p1p1_to_p3(ge_p3 *r,const ge_p1p1 *p)
|
||||
{
|
||||
fe_mul(r->X,p->X,p->T);
|
||||
fe_mul(r->Y,p->Y,p->Z);
|
||||
fe_mul(r->Z,p->Z,p->T);
|
||||
fe_mul(r->T,p->X,p->Y);
|
||||
}
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_p2_0(ge_p2 *h)
|
||||
{
|
||||
fe_0(h->X);
|
||||
fe_1(h->Y);
|
||||
fe_1(h->Z);
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = 2 * p
|
||||
*/
|
||||
|
||||
void ge_p2_dbl(ge_p1p1 *r,const ge_p2 *p)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_p2_dbl.h"
|
||||
}
|
||||
|
|
@ -1,73 +0,0 @@
|
|||
|
||||
/* qhasm: enter ge_p2_dbl */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe AA */
|
||||
|
||||
/* qhasm: fe XX */
|
||||
|
||||
/* qhasm: fe YY */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: XX=X1^2 */
|
||||
/* asm 1: fe_sq(>XX=fe#1,<X1=fe#11); */
|
||||
/* asm 2: fe_sq(>XX=r->X,<X1=p->X); */
|
||||
fe_sq(r->X,p->X);
|
||||
|
||||
/* qhasm: YY=Y1^2 */
|
||||
/* asm 1: fe_sq(>YY=fe#3,<Y1=fe#12); */
|
||||
/* asm 2: fe_sq(>YY=r->Z,<Y1=p->Y); */
|
||||
fe_sq(r->Z,p->Y);
|
||||
|
||||
/* qhasm: B=2*Z1^2 */
|
||||
/* asm 1: fe_sq2(>B=fe#4,<Z1=fe#13); */
|
||||
/* asm 2: fe_sq2(>B=r->T,<Z1=p->Z); */
|
||||
fe_sq2(r->T,p->Z);
|
||||
|
||||
/* qhasm: A=X1+Y1 */
|
||||
/* asm 1: fe_add(>A=fe#2,<X1=fe#11,<Y1=fe#12); */
|
||||
/* asm 2: fe_add(>A=r->Y,<X1=p->X,<Y1=p->Y); */
|
||||
fe_add(r->Y,p->X,p->Y);
|
||||
|
||||
/* qhasm: AA=A^2 */
|
||||
/* asm 1: fe_sq(>AA=fe#5,<A=fe#2); */
|
||||
/* asm 2: fe_sq(>AA=t0,<A=r->Y); */
|
||||
fe_sq(t0,r->Y);
|
||||
|
||||
/* qhasm: Y3=YY+XX */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<YY=fe#3,<XX=fe#1); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<YY=r->Z,<XX=r->X); */
|
||||
fe_add(r->Y,r->Z,r->X);
|
||||
|
||||
/* qhasm: Z3=YY-XX */
|
||||
/* asm 1: fe_sub(>Z3=fe#3,<YY=fe#3,<XX=fe#1); */
|
||||
/* asm 2: fe_sub(>Z3=r->Z,<YY=r->Z,<XX=r->X); */
|
||||
fe_sub(r->Z,r->Z,r->X);
|
||||
|
||||
/* qhasm: X3=AA-Y3 */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<AA=fe#5,<Y3=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<AA=t0,<Y3=r->Y); */
|
||||
fe_sub(r->X,t0,r->Y);
|
||||
|
||||
/* qhasm: T3=B-Z3 */
|
||||
/* asm 1: fe_sub(>T3=fe#4,<B=fe#4,<Z3=fe#3); */
|
||||
/* asm 2: fe_sub(>T3=r->T,<B=r->T,<Z3=r->Z); */
|
||||
fe_sub(r->T,r->T,r->Z);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_p3_0(ge_p3 *h)
|
||||
{
|
||||
fe_0(h->X);
|
||||
fe_1(h->Y);
|
||||
fe_1(h->Z);
|
||||
fe_0(h->T);
|
||||
}
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = 2 * p
|
||||
*/
|
||||
|
||||
void ge_p3_dbl(ge_p1p1 *r,const ge_p3 *p)
|
||||
{
|
||||
ge_p2 q;
|
||||
ge_p3_to_p2(&q,p);
|
||||
ge_p2_dbl(r,&q);
|
||||
}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
static const fe d2 = {
|
||||
#include "d2.h"
|
||||
} ;
|
||||
|
||||
extern void ge_p3_to_cached(ge_cached *r,const ge_p3 *p)
|
||||
{
|
||||
fe_add(r->YplusX,p->Y,p->X);
|
||||
fe_sub(r->YminusX,p->Y,p->X);
|
||||
fe_copy(r->Z,p->Z);
|
||||
fe_mul(r->T2d,p->T,d2);
|
||||
}
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
extern void ge_p3_to_p2(ge_p2 *r,const ge_p3 *p)
|
||||
{
|
||||
fe_copy(r->X,p->X);
|
||||
fe_copy(r->Y,p->Y);
|
||||
fe_copy(r->Z,p->Z);
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_p3_tobytes(unsigned char *s,const ge_p3 *h)
|
||||
{
|
||||
fe recip;
|
||||
fe x;
|
||||
fe y;
|
||||
|
||||
fe_invert(recip,h->Z);
|
||||
fe_mul(x,h->X,recip);
|
||||
fe_mul(y,h->Y,recip);
|
||||
fe_tobytes(s,y);
|
||||
s[31] ^= fe_isnegative(x) << 7;
|
||||
}
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_precomp_0(ge_precomp *h)
|
||||
{
|
||||
fe_1(h->yplusx);
|
||||
fe_1(h->yminusx);
|
||||
fe_0(h->xy2d);
|
||||
}
|
||||
|
|
@ -1,105 +0,0 @@
|
|||
#include "ge.h"
|
||||
#include "crypto_uint32.h"
|
||||
|
||||
static unsigned char equal(signed char b,signed char c)
|
||||
{
|
||||
unsigned char ub = b;
|
||||
unsigned char uc = c;
|
||||
unsigned char x = ub ^ uc; /* 0: yes; 1..255: no */
|
||||
crypto_uint32 y = x; /* 0: yes; 1..255: no */
|
||||
y -= 1; /* 4294967295: yes; 0..254: no */
|
||||
y >>= 31; /* 1: yes; 0: no */
|
||||
return y;
|
||||
}
|
||||
|
||||
static unsigned char negative(signed char b)
|
||||
{
|
||||
unsigned long long x = b; /* 18446744073709551361..18446744073709551615: yes; 0..255: no */
|
||||
x >>= 63; /* 1: yes; 0: no */
|
||||
return x;
|
||||
}
|
||||
|
||||
static void cmov(ge_precomp *t,ge_precomp *u,unsigned char b)
|
||||
{
|
||||
fe_cmov(t->yplusx,u->yplusx,b);
|
||||
fe_cmov(t->yminusx,u->yminusx,b);
|
||||
fe_cmov(t->xy2d,u->xy2d,b);
|
||||
}
|
||||
|
||||
/* base[i][j] = (j+1)*256^i*B */
|
||||
static ge_precomp base[32][8] = {
|
||||
#include "base.h"
|
||||
} ;
|
||||
|
||||
static void select(ge_precomp *t,int pos,signed char b)
|
||||
{
|
||||
ge_precomp minust;
|
||||
unsigned char bnegative = negative(b);
|
||||
unsigned char babs = b - (((-bnegative) & b) << 1);
|
||||
|
||||
ge_precomp_0(t);
|
||||
cmov(t,&base[pos][0],equal(babs,1));
|
||||
cmov(t,&base[pos][1],equal(babs,2));
|
||||
cmov(t,&base[pos][2],equal(babs,3));
|
||||
cmov(t,&base[pos][3],equal(babs,4));
|
||||
cmov(t,&base[pos][4],equal(babs,5));
|
||||
cmov(t,&base[pos][5],equal(babs,6));
|
||||
cmov(t,&base[pos][6],equal(babs,7));
|
||||
cmov(t,&base[pos][7],equal(babs,8));
|
||||
fe_copy(minust.yplusx,t->yminusx);
|
||||
fe_copy(minust.yminusx,t->yplusx);
|
||||
fe_neg(minust.xy2d,t->xy2d);
|
||||
cmov(t,&minust,bnegative);
|
||||
}
|
||||
|
||||
/*
|
||||
h = a * B
|
||||
where a = a[0]+256*a[1]+...+256^31 a[31]
|
||||
B is the Ed25519 base point (x,4/5) with x positive.
|
||||
|
||||
Preconditions:
|
||||
a[31] <= 127
|
||||
*/
|
||||
|
||||
void ge_scalarmult_base(ge_p3 *h,const unsigned char *a)
|
||||
{
|
||||
signed char e[64];
|
||||
signed char carry;
|
||||
ge_p1p1 r;
|
||||
ge_p2 s;
|
||||
ge_precomp t;
|
||||
int i;
|
||||
|
||||
for (i = 0;i < 32;++i) {
|
||||
e[2 * i + 0] = (a[i] >> 0) & 15;
|
||||
e[2 * i + 1] = (a[i] >> 4) & 15;
|
||||
}
|
||||
/* each e[i] is between 0 and 15 */
|
||||
/* e[63] is between 0 and 7 */
|
||||
|
||||
carry = 0;
|
||||
for (i = 0;i < 63;++i) {
|
||||
e[i] += carry;
|
||||
carry = e[i] + 8;
|
||||
carry >>= 4;
|
||||
e[i] -= carry << 4;
|
||||
}
|
||||
e[63] += carry;
|
||||
/* each e[i] is between -8 and 8 */
|
||||
|
||||
ge_p3_0(h);
|
||||
for (i = 1;i < 64;i += 2) {
|
||||
select(&t,i / 2,e[i]);
|
||||
ge_madd(&r,h,&t); ge_p1p1_to_p3(h,&r);
|
||||
}
|
||||
|
||||
ge_p3_dbl(&r,h); ge_p1p1_to_p2(&s,&r);
|
||||
ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
|
||||
ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
|
||||
ge_p2_dbl(&r,&s); ge_p1p1_to_p3(h,&r);
|
||||
|
||||
for (i = 0;i < 64;i += 2) {
|
||||
select(&t,i / 2,e[i]);
|
||||
ge_madd(&r,h,&t); ge_p1p1_to_p3(h,&r);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p - q
|
||||
*/
|
||||
|
||||
void ge_sub(ge_p1p1 *r,const ge_p3 *p,const ge_cached *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_sub.h"
|
||||
}
|
||||
|
|
@ -1,97 +0,0 @@
|
|||
|
||||
/* qhasm: enter ge_sub */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe Z2 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ZZ */
|
||||
|
||||
/* qhasm: fe YpX2 */
|
||||
|
||||
/* qhasm: fe YmX2 */
|
||||
|
||||
/* qhasm: fe T2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*YmX2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<YmX2=fe#16); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<YmX2=q->YminusX); */
|
||||
fe_mul(r->Z,r->X,q->YminusX);
|
||||
|
||||
/* qhasm: B = YmX1*YpX2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<YpX2=fe#15); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<YpX2=q->YplusX); */
|
||||
fe_mul(r->Y,r->Y,q->YplusX);
|
||||
|
||||
/* qhasm: C = T2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<T2d2=fe#18,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<T2d2=q->T2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->T2d,p->T);
|
||||
|
||||
/* qhasm: ZZ = Z1*Z2 */
|
||||
/* asm 1: fe_mul(>ZZ=fe#1,<Z1=fe#13,<Z2=fe#17); */
|
||||
/* asm 2: fe_mul(>ZZ=r->X,<Z1=p->Z,<Z2=q->Z); */
|
||||
fe_mul(r->X,p->Z,q->Z);
|
||||
|
||||
/* qhasm: D = 2*ZZ */
|
||||
/* asm 1: fe_add(>D=fe#5,<ZZ=fe#1,<ZZ=fe#1); */
|
||||
/* asm 2: fe_add(>D=t0,<ZZ=r->X,<ZZ=r->X); */
|
||||
fe_add(t0,r->X,r->X);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D-C */
|
||||
/* asm 1: fe_sub(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_sub(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D+C */
|
||||
/* asm 1: fe_add(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_add(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_tobytes(unsigned char *s,const ge_p2 *h)
|
||||
{
|
||||
fe recip;
|
||||
fe x;
|
||||
fe y;
|
||||
|
||||
fe_invert(recip,h->Z);
|
||||
fe_mul(x,h->X,recip);
|
||||
fe_mul(y,h->Y,recip);
|
||||
fe_tobytes(s,y);
|
||||
s[31] ^= fe_isnegative(x) << 7;
|
||||
}
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include "sha512.h"
|
||||
#include "curve_sigs.h"
|
||||
|
||||
int main(int argc, char* argv[])
|
||||
{
|
||||
unsigned char privkey[32];
|
||||
unsigned char pubkey[32];
|
||||
unsigned char signature[64];
|
||||
unsigned char msg[100];
|
||||
unsigned long long msg_len = 100;
|
||||
|
||||
/* Initialize pubkey, privkey, msg */
|
||||
memset(msg, 0, 100);
|
||||
memset(privkey, 0, 32);
|
||||
memset(pubkey, 0, 32);
|
||||
privkey[0] &= 248;
|
||||
privkey[31] &= 63;
|
||||
privkey[31] |= 64;
|
||||
|
||||
privkey[8] = 189; /* just so there's some bits set */
|
||||
|
||||
curve25519_keygen(pubkey, privkey);
|
||||
|
||||
curve25519_sign(signature, privkey, msg, msg_len);
|
||||
|
||||
if (curve25519_verify(signature, pubkey, msg, msg_len) == 0)
|
||||
printf("success #1\n");
|
||||
else
|
||||
printf("failure #1\n");
|
||||
|
||||
signature[0] ^= 1;
|
||||
|
||||
if (curve25519_verify(signature, pubkey, msg, msg_len) == 0)
|
||||
printf("failure #2\n");
|
||||
else
|
||||
printf("success #2\n");
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
#ifndef crypto_hash_sha512_H
|
||||
#define crypto_hash_sha512_H
|
||||
|
||||
#define crypto_hash_sha512_ref_BYTES 64
|
||||
#ifdef __cplusplus
|
||||
#include <string>
|
||||
extern std::string crypto_hash_sha512_ref(const std::string &);
|
||||
extern "C" {
|
||||
#endif
|
||||
extern int crypto_hash_sha512_ref(unsigned char *,const unsigned char *,unsigned long long);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#define crypto_hash_sha512 crypto_hash_sha512_ref
|
||||
#define crypto_hash_sha512_BYTES crypto_hash_sha512_ref_BYTES
|
||||
#define crypto_hash_sha512_IMPLEMENTATION "crypto_hash/sha512/ref"
|
||||
#ifndef crypto_hash_sha512_ref_VERSION
|
||||
#define crypto_hash_sha512_ref_VERSION "-"
|
||||
#endif
|
||||
#define crypto_hash_sha512_VERSION crypto_hash_sha512_ref_VERSION
|
||||
|
||||
#endif
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
#ifndef crypto_int32_h
|
||||
#define crypto_int32_h
|
||||
|
||||
typedef int crypto_int32;
|
||||
|
||||
#endif
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
#ifndef crypto_int64_h
|
||||
#define crypto_int64_h
|
||||
|
||||
typedef long long crypto_int64;
|
||||
|
||||
#endif
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
#ifndef crypto_sign_H
|
||||
#define crypto_sign_H
|
||||
|
||||
#include "crypto_sign_edwards25519sha512batch.h"
|
||||
|
||||
#define crypto_sign crypto_sign_edwards25519sha512batch
|
||||
#define crypto_sign_open crypto_sign_edwards25519sha512batch_open
|
||||
#define crypto_sign_keypair crypto_sign_edwards25519sha512batch_keypair
|
||||
#define crypto_sign_BYTES crypto_sign_edwards25519sha512batch_BYTES
|
||||
#define crypto_sign_PUBLICKEYBYTES crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES
|
||||
#define crypto_sign_SECRETKEYBYTES crypto_sign_edwards25519sha512batch_SECRETKEYBYTES
|
||||
#define crypto_sign_PRIMITIVE "edwards25519sha512batch"
|
||||
#define crypto_sign_IMPLEMENTATION crypto_sign_edwards25519sha512batch_IMPLEMENTATION
|
||||
#define crypto_sign_VERSION crypto_sign_edwards25519sha512batch_VERSION
|
||||
|
||||
#endif
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
#ifndef crypto_sign_edwards25519sha512batch_H
|
||||
#define crypto_sign_edwards25519sha512batch_H
|
||||
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_SECRETKEYBYTES 64
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_PUBLICKEYBYTES 32
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_BYTES 64
|
||||
#ifdef __cplusplus
|
||||
#include <string>
|
||||
extern std::string crypto_sign_edwards25519sha512batch_ref10(const std::string &,const std::string &);
|
||||
extern std::string crypto_sign_edwards25519sha512batch_ref10_open(const std::string &,const std::string &);
|
||||
extern std::string crypto_sign_edwards25519sha512batch_ref10_keypair(std::string *);
|
||||
extern "C" {
|
||||
#endif
|
||||
extern int crypto_sign_edwards25519sha512batch_ref10(unsigned char *,unsigned long long *,const unsigned char *,unsigned long long,const unsigned char *);
|
||||
extern int crypto_sign_edwards25519sha512batch_ref10_open(unsigned char *,unsigned long long *,const unsigned char *,unsigned long long,const unsigned char *);
|
||||
extern int crypto_sign_edwards25519sha512batch_ref10_keypair(unsigned char *,unsigned char *);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#define crypto_sign_edwards25519sha512batch crypto_sign_edwards25519sha512batch_ref10
|
||||
#define crypto_sign_edwards25519sha512batch_open crypto_sign_edwards25519sha512batch_ref10_open
|
||||
#define crypto_sign_edwards25519sha512batch_keypair crypto_sign_edwards25519sha512batch_ref10_keypair
|
||||
#define crypto_sign_edwards25519sha512batch_BYTES crypto_sign_edwards25519sha512batch_ref10_BYTES
|
||||
#define crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES crypto_sign_edwards25519sha512batch_ref10_PUBLICKEYBYTES
|
||||
#define crypto_sign_edwards25519sha512batch_SECRETKEYBYTES crypto_sign_edwards25519sha512batch_ref10_SECRETKEYBYTES
|
||||
#define crypto_sign_edwards25519sha512batch_IMPLEMENTATION "crypto_sign/edwards25519sha512batch/ref10"
|
||||
#ifndef crypto_sign_edwards25519sha512batch_ref10_VERSION
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_VERSION "-"
|
||||
#endif
|
||||
#define crypto_sign_edwards25519sha512batch_VERSION crypto_sign_edwards25519sha512batch_ref10_VERSION
|
||||
|
||||
#endif
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
#ifndef crypto_uint32_h
|
||||
#define crypto_uint32_h
|
||||
|
||||
typedef unsigned int crypto_uint32;
|
||||
|
||||
#endif
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
#ifndef crypto_uint64_h
|
||||
#define crypto_uint64_h
|
||||
|
||||
typedef unsigned long long crypto_uint64;
|
||||
|
||||
#endif
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
#ifndef crypto_verify_32_H
|
||||
#define crypto_verify_32_H
|
||||
|
||||
#define crypto_verify_32_ref_BYTES 32
|
||||
#ifdef __cplusplus
|
||||
#include <string>
|
||||
extern "C" {
|
||||
#endif
|
||||
extern int crypto_verify_32_ref(const unsigned char *,const unsigned char *);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#define crypto_verify_32 crypto_verify_32_ref
|
||||
#define crypto_verify_32_BYTES crypto_verify_32_ref_BYTES
|
||||
#define crypto_verify_32_IMPLEMENTATION "crypto_verify/32/ref"
|
||||
#ifndef crypto_verify_32_ref_VERSION
|
||||
#define crypto_verify_32_ref_VERSION "-"
|
||||
#endif
|
||||
#define crypto_verify_32_VERSION crypto_verify_32_ref_VERSION
|
||||
|
||||
#endif
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
#include <string.h>
|
||||
#include "crypto_sign.h"
|
||||
#include "crypto_hash_sha512.h"
|
||||
#include "crypto_verify_32.h"
|
||||
#include "ge.h"
|
||||
#include "sc.h"
|
||||
|
||||
int crypto_sign_open(
|
||||
unsigned char *m,unsigned long long *mlen,
|
||||
const unsigned char *sm,unsigned long long smlen,
|
||||
const unsigned char *pk
|
||||
)
|
||||
{
|
||||
unsigned char pkcopy[32];
|
||||
unsigned char rcopy[32];
|
||||
unsigned char scopy[32];
|
||||
unsigned char h[64];
|
||||
unsigned char rcheck[32];
|
||||
ge_p3 A;
|
||||
ge_p2 R;
|
||||
|
||||
if (smlen < 64) goto badsig;
|
||||
if (sm[63] & 224) goto badsig;
|
||||
if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
|
||||
|
||||
memmove(pkcopy,pk,32);
|
||||
memmove(rcopy,sm,32);
|
||||
memmove(scopy,sm + 32,32);
|
||||
|
||||
memmove(m,sm,smlen);
|
||||
memmove(m + 32,pkcopy,32);
|
||||
crypto_hash_sha512(h,m,smlen);
|
||||
sc_reduce(h);
|
||||
|
||||
ge_double_scalarmult_vartime(&R,h,&A,scopy);
|
||||
ge_tobytes(rcheck,&R);
|
||||
if (crypto_verify_32(rcheck,rcopy) == 0) {
|
||||
memmove(m,m + 64,smlen - 64);
|
||||
memset(m + smlen - 64,0,64);
|
||||
*mlen = smlen - 64;
|
||||
return 0;
|
||||
}
|
||||
|
||||
badsig:
|
||||
*mlen = -1;
|
||||
memset(m,0,smlen);
|
||||
return -1;
|
||||
}
|
||||
|
|
@ -1,160 +0,0 @@
|
|||
|
||||
/* qhasm: fe z1 */
|
||||
|
||||
/* qhasm: fe z2 */
|
||||
|
||||
/* qhasm: fe z8 */
|
||||
|
||||
/* qhasm: fe z9 */
|
||||
|
||||
/* qhasm: fe z11 */
|
||||
|
||||
/* qhasm: fe z22 */
|
||||
|
||||
/* qhasm: fe z_5_0 */
|
||||
|
||||
/* qhasm: fe z_10_5 */
|
||||
|
||||
/* qhasm: fe z_10_0 */
|
||||
|
||||
/* qhasm: fe z_20_10 */
|
||||
|
||||
/* qhasm: fe z_20_0 */
|
||||
|
||||
/* qhasm: fe z_40_20 */
|
||||
|
||||
/* qhasm: fe z_40_0 */
|
||||
|
||||
/* qhasm: fe z_50_10 */
|
||||
|
||||
/* qhasm: fe z_50_0 */
|
||||
|
||||
/* qhasm: fe z_100_50 */
|
||||
|
||||
/* qhasm: fe z_100_0 */
|
||||
|
||||
/* qhasm: fe z_200_100 */
|
||||
|
||||
/* qhasm: fe z_200_0 */
|
||||
|
||||
/* qhasm: fe z_250_50 */
|
||||
|
||||
/* qhasm: fe z_250_0 */
|
||||
|
||||
/* qhasm: fe z_252_2 */
|
||||
|
||||
/* qhasm: fe z_252_3 */
|
||||
|
||||
/* qhasm: enter pow22523 */
|
||||
|
||||
/* qhasm: z2 = z1^2^1 */
|
||||
/* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
|
||||
/* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
|
||||
fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z8 = z2^2^2 */
|
||||
/* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
|
||||
/* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z9 = z1*z8 */
|
||||
/* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
|
||||
/* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
|
||||
fe_mul(t1,z,t1);
|
||||
|
||||
/* qhasm: z11 = z2*z9 */
|
||||
/* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
|
||||
/* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
|
||||
fe_mul(t0,t0,t1);
|
||||
|
||||
/* qhasm: z22 = z11^2^1 */
|
||||
/* asm 1: fe_sq(>z22=fe#1,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#1,>z22=fe#1); */
|
||||
/* asm 2: fe_sq(>z22=t0,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t0,>z22=t0); */
|
||||
fe_sq(t0,t0); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z_5_0 = z9*z22 */
|
||||
/* asm 1: fe_mul(>z_5_0=fe#1,<z9=fe#2,<z22=fe#1); */
|
||||
/* asm 2: fe_mul(>z_5_0=t0,<z9=t1,<z22=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_10_5 = z_5_0^2^5 */
|
||||
/* asm 1: fe_sq(>z_10_5=fe#2,<z_5_0=fe#1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#2,>z_10_5=fe#2); */
|
||||
/* asm 2: fe_sq(>z_10_5=t1,<z_5_0=t0); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t1,>z_10_5=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 5;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_10_0 = z_10_5*z_5_0 */
|
||||
/* asm 1: fe_mul(>z_10_0=fe#1,<z_10_5=fe#2,<z_5_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_10_0=t0,<z_10_5=t1,<z_5_0=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_20_10 = z_10_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_20_10=fe#2,<z_10_0=fe#1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#2,>z_20_10=fe#2); */
|
||||
/* asm 2: fe_sq(>z_20_10=t1,<z_10_0=t0); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t1,>z_20_10=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 10;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_20_0 = z_20_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_20_0=fe#2,<z_20_10=fe#2,<z_10_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_20_0=t1,<z_20_10=t1,<z_10_0=t0); */
|
||||
fe_mul(t1,t1,t0);
|
||||
|
||||
/* qhasm: z_40_20 = z_20_0^2^20 */
|
||||
/* asm 1: fe_sq(>z_40_20=fe#3,<z_20_0=fe#2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#3,>z_40_20=fe#3); */
|
||||
/* asm 2: fe_sq(>z_40_20=t2,<z_20_0=t1); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t2,>z_40_20=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 20;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_40_0 = z_40_20*z_20_0 */
|
||||
/* asm 1: fe_mul(>z_40_0=fe#2,<z_40_20=fe#3,<z_20_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_40_0=t1,<z_40_20=t2,<z_20_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_50_10 = z_40_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_50_10=fe#2,<z_40_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#2,>z_50_10=fe#2); */
|
||||
/* asm 2: fe_sq(>z_50_10=t1,<z_40_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t1,>z_50_10=t1); */
|
||||
fe_sq(t1,t1); for (i = 1;i < 10;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_50_0 = z_50_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_50_0=fe#1,<z_50_10=fe#2,<z_10_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_50_0=t0,<z_50_10=t1,<z_10_0=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_100_50 = z_50_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_100_50=fe#2,<z_50_0=fe#1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#2,>z_100_50=fe#2); */
|
||||
/* asm 2: fe_sq(>z_100_50=t1,<z_50_0=t0); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t1,>z_100_50=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 50;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_100_0 = z_100_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_100_0=fe#2,<z_100_50=fe#2,<z_50_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_100_0=t1,<z_100_50=t1,<z_50_0=t0); */
|
||||
fe_mul(t1,t1,t0);
|
||||
|
||||
/* qhasm: z_200_100 = z_100_0^2^100 */
|
||||
/* asm 1: fe_sq(>z_200_100=fe#3,<z_100_0=fe#2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#3,>z_200_100=fe#3); */
|
||||
/* asm 2: fe_sq(>z_200_100=t2,<z_100_0=t1); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t2,>z_200_100=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 100;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_200_0 = z_200_100*z_100_0 */
|
||||
/* asm 1: fe_mul(>z_200_0=fe#2,<z_200_100=fe#3,<z_100_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_200_0=t1,<z_200_100=t2,<z_100_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_250_50 = z_200_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_250_50=fe#2,<z_200_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#2,>z_250_50=fe#2); */
|
||||
/* asm 2: fe_sq(>z_250_50=t1,<z_200_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t1,>z_250_50=t1); */
|
||||
fe_sq(t1,t1); for (i = 1;i < 50;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_250_0 = z_250_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_250_0=fe#1,<z_250_50=fe#2,<z_50_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_250_0=t0,<z_250_50=t1,<z_50_0=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_252_2 = z_250_0^2^2 */
|
||||
/* asm 1: fe_sq(>z_252_2=fe#1,<z_250_0=fe#1); for (i = 1;i < 2;++i) fe_sq(>z_252_2=fe#1,>z_252_2=fe#1); */
|
||||
/* asm 2: fe_sq(>z_252_2=t0,<z_250_0=t0); for (i = 1;i < 2;++i) fe_sq(>z_252_2=t0,>z_252_2=t0); */
|
||||
fe_sq(t0,t0); for (i = 1;i < 2;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z_252_3 = z_252_2*z1 */
|
||||
/* asm 1: fe_mul(>z_252_3=fe#12,<z_252_2=fe#1,<z1=fe#11); */
|
||||
/* asm 2: fe_mul(>z_252_3=out,<z_252_2=t0,<z1=z); */
|
||||
fe_mul(out,t0,z);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -1,160 +0,0 @@
|
|||
|
||||
/* qhasm: fe z1 */
|
||||
|
||||
/* qhasm: fe z2 */
|
||||
|
||||
/* qhasm: fe z8 */
|
||||
|
||||
/* qhasm: fe z9 */
|
||||
|
||||
/* qhasm: fe z11 */
|
||||
|
||||
/* qhasm: fe z22 */
|
||||
|
||||
/* qhasm: fe z_5_0 */
|
||||
|
||||
/* qhasm: fe z_10_5 */
|
||||
|
||||
/* qhasm: fe z_10_0 */
|
||||
|
||||
/* qhasm: fe z_20_10 */
|
||||
|
||||
/* qhasm: fe z_20_0 */
|
||||
|
||||
/* qhasm: fe z_40_20 */
|
||||
|
||||
/* qhasm: fe z_40_0 */
|
||||
|
||||
/* qhasm: fe z_50_10 */
|
||||
|
||||
/* qhasm: fe z_50_0 */
|
||||
|
||||
/* qhasm: fe z_100_50 */
|
||||
|
||||
/* qhasm: fe z_100_0 */
|
||||
|
||||
/* qhasm: fe z_200_100 */
|
||||
|
||||
/* qhasm: fe z_200_0 */
|
||||
|
||||
/* qhasm: fe z_250_50 */
|
||||
|
||||
/* qhasm: fe z_250_0 */
|
||||
|
||||
/* qhasm: fe z_255_5 */
|
||||
|
||||
/* qhasm: fe z_255_21 */
|
||||
|
||||
/* qhasm: enter pow225521 */
|
||||
|
||||
/* qhasm: z2 = z1^2^1 */
|
||||
/* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
|
||||
/* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
|
||||
fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z8 = z2^2^2 */
|
||||
/* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
|
||||
/* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z9 = z1*z8 */
|
||||
/* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
|
||||
/* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
|
||||
fe_mul(t1,z,t1);
|
||||
|
||||
/* qhasm: z11 = z2*z9 */
|
||||
/* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
|
||||
/* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
|
||||
fe_mul(t0,t0,t1);
|
||||
|
||||
/* qhasm: z22 = z11^2^1 */
|
||||
/* asm 1: fe_sq(>z22=fe#3,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#3,>z22=fe#3); */
|
||||
/* asm 2: fe_sq(>z22=t2,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t2,>z22=t2); */
|
||||
fe_sq(t2,t0); for (i = 1;i < 1;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_5_0 = z9*z22 */
|
||||
/* asm 1: fe_mul(>z_5_0=fe#2,<z9=fe#2,<z22=fe#3); */
|
||||
/* asm 2: fe_mul(>z_5_0=t1,<z9=t1,<z22=t2); */
|
||||
fe_mul(t1,t1,t2);
|
||||
|
||||
/* qhasm: z_10_5 = z_5_0^2^5 */
|
||||
/* asm 1: fe_sq(>z_10_5=fe#3,<z_5_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#3,>z_10_5=fe#3); */
|
||||
/* asm 2: fe_sq(>z_10_5=t2,<z_5_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t2,>z_10_5=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 5;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_10_0 = z_10_5*z_5_0 */
|
||||
/* asm 1: fe_mul(>z_10_0=fe#2,<z_10_5=fe#3,<z_5_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_10_0=t1,<z_10_5=t2,<z_5_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_20_10 = z_10_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_20_10=fe#3,<z_10_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#3,>z_20_10=fe#3); */
|
||||
/* asm 2: fe_sq(>z_20_10=t2,<z_10_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t2,>z_20_10=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 10;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_20_0 = z_20_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_20_0=fe#3,<z_20_10=fe#3,<z_10_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_20_0=t2,<z_20_10=t2,<z_10_0=t1); */
|
||||
fe_mul(t2,t2,t1);
|
||||
|
||||
/* qhasm: z_40_20 = z_20_0^2^20 */
|
||||
/* asm 1: fe_sq(>z_40_20=fe#4,<z_20_0=fe#3); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#4,>z_40_20=fe#4); */
|
||||
/* asm 2: fe_sq(>z_40_20=t3,<z_20_0=t2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t3,>z_40_20=t3); */
|
||||
fe_sq(t3,t2); for (i = 1;i < 20;++i) fe_sq(t3,t3);
|
||||
|
||||
/* qhasm: z_40_0 = z_40_20*z_20_0 */
|
||||
/* asm 1: fe_mul(>z_40_0=fe#3,<z_40_20=fe#4,<z_20_0=fe#3); */
|
||||
/* asm 2: fe_mul(>z_40_0=t2,<z_40_20=t3,<z_20_0=t2); */
|
||||
fe_mul(t2,t3,t2);
|
||||
|
||||
/* qhasm: z_50_10 = z_40_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_50_10=fe#3,<z_40_0=fe#3); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#3,>z_50_10=fe#3); */
|
||||
/* asm 2: fe_sq(>z_50_10=t2,<z_40_0=t2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t2,>z_50_10=t2); */
|
||||
fe_sq(t2,t2); for (i = 1;i < 10;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_50_0 = z_50_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_50_0=fe#2,<z_50_10=fe#3,<z_10_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_50_0=t1,<z_50_10=t2,<z_10_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_100_50 = z_50_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_100_50=fe#3,<z_50_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#3,>z_100_50=fe#3); */
|
||||
/* asm 2: fe_sq(>z_100_50=t2,<z_50_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t2,>z_100_50=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 50;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_100_0 = z_100_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_100_0=fe#3,<z_100_50=fe#3,<z_50_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_100_0=t2,<z_100_50=t2,<z_50_0=t1); */
|
||||
fe_mul(t2,t2,t1);
|
||||
|
||||
/* qhasm: z_200_100 = z_100_0^2^100 */
|
||||
/* asm 1: fe_sq(>z_200_100=fe#4,<z_100_0=fe#3); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#4,>z_200_100=fe#4); */
|
||||
/* asm 2: fe_sq(>z_200_100=t3,<z_100_0=t2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t3,>z_200_100=t3); */
|
||||
fe_sq(t3,t2); for (i = 1;i < 100;++i) fe_sq(t3,t3);
|
||||
|
||||
/* qhasm: z_200_0 = z_200_100*z_100_0 */
|
||||
/* asm 1: fe_mul(>z_200_0=fe#3,<z_200_100=fe#4,<z_100_0=fe#3); */
|
||||
/* asm 2: fe_mul(>z_200_0=t2,<z_200_100=t3,<z_100_0=t2); */
|
||||
fe_mul(t2,t3,t2);
|
||||
|
||||
/* qhasm: z_250_50 = z_200_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_250_50=fe#3,<z_200_0=fe#3); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#3,>z_250_50=fe#3); */
|
||||
/* asm 2: fe_sq(>z_250_50=t2,<z_200_0=t2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t2,>z_250_50=t2); */
|
||||
fe_sq(t2,t2); for (i = 1;i < 50;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_250_0 = z_250_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_250_0=fe#2,<z_250_50=fe#3,<z_50_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_250_0=t1,<z_250_50=t2,<z_50_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_255_5 = z_250_0^2^5 */
|
||||
/* asm 1: fe_sq(>z_255_5=fe#2,<z_250_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_255_5=fe#2,>z_255_5=fe#2); */
|
||||
/* asm 2: fe_sq(>z_255_5=t1,<z_250_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_255_5=t1,>z_255_5=t1); */
|
||||
fe_sq(t1,t1); for (i = 1;i < 5;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_255_21 = z_255_5*z11 */
|
||||
/* asm 1: fe_mul(>z_255_21=fe#12,<z_255_5=fe#2,<z11=fe#1); */
|
||||
/* asm 2: fe_mul(>z_255_21=out,<z_255_5=t1,<z11=t0); */
|
||||
fe_mul(out,t1,t0);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
#ifndef SC_H
|
||||
#define SC_H
|
||||
|
||||
/*
|
||||
The set of scalars is \Z/l
|
||||
where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
*/
|
||||
|
||||
#define sc_reduce crypto_sign_ed25519_ref10_sc_reduce
|
||||
#define sc_muladd crypto_sign_ed25519_ref10_sc_muladd
|
||||
|
||||
extern void sc_reduce(unsigned char *);
|
||||
extern void sc_muladd(unsigned char *,const unsigned char *,const unsigned char *,const unsigned char *);
|
||||
|
||||
#endif
|
||||
|
|
@ -1,368 +0,0 @@
|
|||
#include "sc.h"
|
||||
#include "crypto_int64.h"
|
||||
#include "crypto_uint32.h"
|
||||
#include "crypto_uint64.h"
|
||||
|
||||
static crypto_uint64 load_3(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
return result;
|
||||
}
|
||||
|
||||
static crypto_uint64 load_4(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
result |= ((crypto_uint64) in[3]) << 24;
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
Input:
|
||||
a[0]+256*a[1]+...+256^31*a[31] = a
|
||||
b[0]+256*b[1]+...+256^31*b[31] = b
|
||||
c[0]+256*c[1]+...+256^31*c[31] = c
|
||||
|
||||
Output:
|
||||
s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
|
||||
where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
*/
|
||||
|
||||
void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,const unsigned char *c)
|
||||
{
|
||||
crypto_int64 a0 = 2097151 & load_3(a);
|
||||
crypto_int64 a1 = 2097151 & (load_4(a + 2) >> 5);
|
||||
crypto_int64 a2 = 2097151 & (load_3(a + 5) >> 2);
|
||||
crypto_int64 a3 = 2097151 & (load_4(a + 7) >> 7);
|
||||
crypto_int64 a4 = 2097151 & (load_4(a + 10) >> 4);
|
||||
crypto_int64 a5 = 2097151 & (load_3(a + 13) >> 1);
|
||||
crypto_int64 a6 = 2097151 & (load_4(a + 15) >> 6);
|
||||
crypto_int64 a7 = 2097151 & (load_3(a + 18) >> 3);
|
||||
crypto_int64 a8 = 2097151 & load_3(a + 21);
|
||||
crypto_int64 a9 = 2097151 & (load_4(a + 23) >> 5);
|
||||
crypto_int64 a10 = 2097151 & (load_3(a + 26) >> 2);
|
||||
crypto_int64 a11 = (load_4(a + 28) >> 7);
|
||||
crypto_int64 b0 = 2097151 & load_3(b);
|
||||
crypto_int64 b1 = 2097151 & (load_4(b + 2) >> 5);
|
||||
crypto_int64 b2 = 2097151 & (load_3(b + 5) >> 2);
|
||||
crypto_int64 b3 = 2097151 & (load_4(b + 7) >> 7);
|
||||
crypto_int64 b4 = 2097151 & (load_4(b + 10) >> 4);
|
||||
crypto_int64 b5 = 2097151 & (load_3(b + 13) >> 1);
|
||||
crypto_int64 b6 = 2097151 & (load_4(b + 15) >> 6);
|
||||
crypto_int64 b7 = 2097151 & (load_3(b + 18) >> 3);
|
||||
crypto_int64 b8 = 2097151 & load_3(b + 21);
|
||||
crypto_int64 b9 = 2097151 & (load_4(b + 23) >> 5);
|
||||
crypto_int64 b10 = 2097151 & (load_3(b + 26) >> 2);
|
||||
crypto_int64 b11 = (load_4(b + 28) >> 7);
|
||||
crypto_int64 c0 = 2097151 & load_3(c);
|
||||
crypto_int64 c1 = 2097151 & (load_4(c + 2) >> 5);
|
||||
crypto_int64 c2 = 2097151 & (load_3(c + 5) >> 2);
|
||||
crypto_int64 c3 = 2097151 & (load_4(c + 7) >> 7);
|
||||
crypto_int64 c4 = 2097151 & (load_4(c + 10) >> 4);
|
||||
crypto_int64 c5 = 2097151 & (load_3(c + 13) >> 1);
|
||||
crypto_int64 c6 = 2097151 & (load_4(c + 15) >> 6);
|
||||
crypto_int64 c7 = 2097151 & (load_3(c + 18) >> 3);
|
||||
crypto_int64 c8 = 2097151 & load_3(c + 21);
|
||||
crypto_int64 c9 = 2097151 & (load_4(c + 23) >> 5);
|
||||
crypto_int64 c10 = 2097151 & (load_3(c + 26) >> 2);
|
||||
crypto_int64 c11 = (load_4(c + 28) >> 7);
|
||||
crypto_int64 s0;
|
||||
crypto_int64 s1;
|
||||
crypto_int64 s2;
|
||||
crypto_int64 s3;
|
||||
crypto_int64 s4;
|
||||
crypto_int64 s5;
|
||||
crypto_int64 s6;
|
||||
crypto_int64 s7;
|
||||
crypto_int64 s8;
|
||||
crypto_int64 s9;
|
||||
crypto_int64 s10;
|
||||
crypto_int64 s11;
|
||||
crypto_int64 s12;
|
||||
crypto_int64 s13;
|
||||
crypto_int64 s14;
|
||||
crypto_int64 s15;
|
||||
crypto_int64 s16;
|
||||
crypto_int64 s17;
|
||||
crypto_int64 s18;
|
||||
crypto_int64 s19;
|
||||
crypto_int64 s20;
|
||||
crypto_int64 s21;
|
||||
crypto_int64 s22;
|
||||
crypto_int64 s23;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
crypto_int64 carry10;
|
||||
crypto_int64 carry11;
|
||||
crypto_int64 carry12;
|
||||
crypto_int64 carry13;
|
||||
crypto_int64 carry14;
|
||||
crypto_int64 carry15;
|
||||
crypto_int64 carry16;
|
||||
crypto_int64 carry17;
|
||||
crypto_int64 carry18;
|
||||
crypto_int64 carry19;
|
||||
crypto_int64 carry20;
|
||||
crypto_int64 carry21;
|
||||
crypto_int64 carry22;
|
||||
|
||||
s0 = c0 + a0*b0;
|
||||
s1 = c1 + a0*b1 + a1*b0;
|
||||
s2 = c2 + a0*b2 + a1*b1 + a2*b0;
|
||||
s3 = c3 + a0*b3 + a1*b2 + a2*b1 + a3*b0;
|
||||
s4 = c4 + a0*b4 + a1*b3 + a2*b2 + a3*b1 + a4*b0;
|
||||
s5 = c5 + a0*b5 + a1*b4 + a2*b3 + a3*b2 + a4*b1 + a5*b0;
|
||||
s6 = c6 + a0*b6 + a1*b5 + a2*b4 + a3*b3 + a4*b2 + a5*b1 + a6*b0;
|
||||
s7 = c7 + a0*b7 + a1*b6 + a2*b5 + a3*b4 + a4*b3 + a5*b2 + a6*b1 + a7*b0;
|
||||
s8 = c8 + a0*b8 + a1*b7 + a2*b6 + a3*b5 + a4*b4 + a5*b3 + a6*b2 + a7*b1 + a8*b0;
|
||||
s9 = c9 + a0*b9 + a1*b8 + a2*b7 + a3*b6 + a4*b5 + a5*b4 + a6*b3 + a7*b2 + a8*b1 + a9*b0;
|
||||
s10 = c10 + a0*b10 + a1*b9 + a2*b8 + a3*b7 + a4*b6 + a5*b5 + a6*b4 + a7*b3 + a8*b2 + a9*b1 + a10*b0;
|
||||
s11 = c11 + a0*b11 + a1*b10 + a2*b9 + a3*b8 + a4*b7 + a5*b6 + a6*b5 + a7*b4 + a8*b3 + a9*b2 + a10*b1 + a11*b0;
|
||||
s12 = a1*b11 + a2*b10 + a3*b9 + a4*b8 + a5*b7 + a6*b6 + a7*b5 + a8*b4 + a9*b3 + a10*b2 + a11*b1;
|
||||
s13 = a2*b11 + a3*b10 + a4*b9 + a5*b8 + a6*b7 + a7*b6 + a8*b5 + a9*b4 + a10*b3 + a11*b2;
|
||||
s14 = a3*b11 + a4*b10 + a5*b9 + a6*b8 + a7*b7 + a8*b6 + a9*b5 + a10*b4 + a11*b3;
|
||||
s15 = a4*b11 + a5*b10 + a6*b9 + a7*b8 + a8*b7 + a9*b6 + a10*b5 + a11*b4;
|
||||
s16 = a5*b11 + a6*b10 + a7*b9 + a8*b8 + a9*b7 + a10*b6 + a11*b5;
|
||||
s17 = a6*b11 + a7*b10 + a8*b9 + a9*b8 + a10*b7 + a11*b6;
|
||||
s18 = a7*b11 + a8*b10 + a9*b9 + a10*b8 + a11*b7;
|
||||
s19 = a8*b11 + a9*b10 + a10*b9 + a11*b8;
|
||||
s20 = a9*b11 + a10*b10 + a11*b9;
|
||||
s21 = a10*b11 + a11*b10;
|
||||
s22 = a11*b11;
|
||||
s23 = 0;
|
||||
|
||||
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
||||
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
||||
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
||||
carry18 = (s18 + (1<<20)) >> 21; s19 += carry18; s18 -= carry18 << 21;
|
||||
carry20 = (s20 + (1<<20)) >> 21; s21 += carry20; s20 -= carry20 << 21;
|
||||
carry22 = (s22 + (1<<20)) >> 21; s23 += carry22; s22 -= carry22 << 21;
|
||||
|
||||
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
||||
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
||||
carry17 = (s17 + (1<<20)) >> 21; s18 += carry17; s17 -= carry17 << 21;
|
||||
carry19 = (s19 + (1<<20)) >> 21; s20 += carry19; s19 -= carry19 << 21;
|
||||
carry21 = (s21 + (1<<20)) >> 21; s22 += carry21; s21 -= carry21 << 21;
|
||||
|
||||
s11 += s23 * 666643;
|
||||
s12 += s23 * 470296;
|
||||
s13 += s23 * 654183;
|
||||
s14 -= s23 * 997805;
|
||||
s15 += s23 * 136657;
|
||||
s16 -= s23 * 683901;
|
||||
s23 = 0;
|
||||
|
||||
s10 += s22 * 666643;
|
||||
s11 += s22 * 470296;
|
||||
s12 += s22 * 654183;
|
||||
s13 -= s22 * 997805;
|
||||
s14 += s22 * 136657;
|
||||
s15 -= s22 * 683901;
|
||||
s22 = 0;
|
||||
|
||||
s9 += s21 * 666643;
|
||||
s10 += s21 * 470296;
|
||||
s11 += s21 * 654183;
|
||||
s12 -= s21 * 997805;
|
||||
s13 += s21 * 136657;
|
||||
s14 -= s21 * 683901;
|
||||
s21 = 0;
|
||||
|
||||
s8 += s20 * 666643;
|
||||
s9 += s20 * 470296;
|
||||
s10 += s20 * 654183;
|
||||
s11 -= s20 * 997805;
|
||||
s12 += s20 * 136657;
|
||||
s13 -= s20 * 683901;
|
||||
s20 = 0;
|
||||
|
||||
s7 += s19 * 666643;
|
||||
s8 += s19 * 470296;
|
||||
s9 += s19 * 654183;
|
||||
s10 -= s19 * 997805;
|
||||
s11 += s19 * 136657;
|
||||
s12 -= s19 * 683901;
|
||||
s19 = 0;
|
||||
|
||||
s6 += s18 * 666643;
|
||||
s7 += s18 * 470296;
|
||||
s8 += s18 * 654183;
|
||||
s9 -= s18 * 997805;
|
||||
s10 += s18 * 136657;
|
||||
s11 -= s18 * 683901;
|
||||
s18 = 0;
|
||||
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
||||
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
||||
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
||||
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
||||
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
||||
|
||||
s5 += s17 * 666643;
|
||||
s6 += s17 * 470296;
|
||||
s7 += s17 * 654183;
|
||||
s8 -= s17 * 997805;
|
||||
s9 += s17 * 136657;
|
||||
s10 -= s17 * 683901;
|
||||
s17 = 0;
|
||||
|
||||
s4 += s16 * 666643;
|
||||
s5 += s16 * 470296;
|
||||
s6 += s16 * 654183;
|
||||
s7 -= s16 * 997805;
|
||||
s8 += s16 * 136657;
|
||||
s9 -= s16 * 683901;
|
||||
s16 = 0;
|
||||
|
||||
s3 += s15 * 666643;
|
||||
s4 += s15 * 470296;
|
||||
s5 += s15 * 654183;
|
||||
s6 -= s15 * 997805;
|
||||
s7 += s15 * 136657;
|
||||
s8 -= s15 * 683901;
|
||||
s15 = 0;
|
||||
|
||||
s2 += s14 * 666643;
|
||||
s3 += s14 * 470296;
|
||||
s4 += s14 * 654183;
|
||||
s5 -= s14 * 997805;
|
||||
s6 += s14 * 136657;
|
||||
s7 -= s14 * 683901;
|
||||
s14 = 0;
|
||||
|
||||
s1 += s13 * 666643;
|
||||
s2 += s13 * 470296;
|
||||
s3 += s13 * 654183;
|
||||
s4 -= s13 * 997805;
|
||||
s5 += s13 * 136657;
|
||||
s6 -= s13 * 683901;
|
||||
s13 = 0;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
s[0] = s0 >> 0;
|
||||
s[1] = s0 >> 8;
|
||||
s[2] = (s0 >> 16) | (s1 << 5);
|
||||
s[3] = s1 >> 3;
|
||||
s[4] = s1 >> 11;
|
||||
s[5] = (s1 >> 19) | (s2 << 2);
|
||||
s[6] = s2 >> 6;
|
||||
s[7] = (s2 >> 14) | (s3 << 7);
|
||||
s[8] = s3 >> 1;
|
||||
s[9] = s3 >> 9;
|
||||
s[10] = (s3 >> 17) | (s4 << 4);
|
||||
s[11] = s4 >> 4;
|
||||
s[12] = s4 >> 12;
|
||||
s[13] = (s4 >> 20) | (s5 << 1);
|
||||
s[14] = s5 >> 7;
|
||||
s[15] = (s5 >> 15) | (s6 << 6);
|
||||
s[16] = s6 >> 2;
|
||||
s[17] = s6 >> 10;
|
||||
s[18] = (s6 >> 18) | (s7 << 3);
|
||||
s[19] = s7 >> 5;
|
||||
s[20] = s7 >> 13;
|
||||
s[21] = s8 >> 0;
|
||||
s[22] = s8 >> 8;
|
||||
s[23] = (s8 >> 16) | (s9 << 5);
|
||||
s[24] = s9 >> 3;
|
||||
s[25] = s9 >> 11;
|
||||
s[26] = (s9 >> 19) | (s10 << 2);
|
||||
s[27] = s10 >> 6;
|
||||
s[28] = (s10 >> 14) | (s11 << 7);
|
||||
s[29] = s11 >> 1;
|
||||
s[30] = s11 >> 9;
|
||||
s[31] = s11 >> 17;
|
||||
}
|
||||
|
|
@ -1,275 +0,0 @@
|
|||
#include "sc.h"
|
||||
#include "crypto_int64.h"
|
||||
#include "crypto_uint32.h"
|
||||
#include "crypto_uint64.h"
|
||||
|
||||
static crypto_uint64 load_3(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
return result;
|
||||
}
|
||||
|
||||
static crypto_uint64 load_4(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
result |= ((crypto_uint64) in[3]) << 24;
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
Input:
|
||||
s[0]+256*s[1]+...+256^63*s[63] = s
|
||||
|
||||
Output:
|
||||
s[0]+256*s[1]+...+256^31*s[31] = s mod l
|
||||
where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
Overwrites s in place.
|
||||
*/
|
||||
|
||||
void sc_reduce(unsigned char *s)
|
||||
{
|
||||
crypto_int64 s0 = 2097151 & load_3(s);
|
||||
crypto_int64 s1 = 2097151 & (load_4(s + 2) >> 5);
|
||||
crypto_int64 s2 = 2097151 & (load_3(s + 5) >> 2);
|
||||
crypto_int64 s3 = 2097151 & (load_4(s + 7) >> 7);
|
||||
crypto_int64 s4 = 2097151 & (load_4(s + 10) >> 4);
|
||||
crypto_int64 s5 = 2097151 & (load_3(s + 13) >> 1);
|
||||
crypto_int64 s6 = 2097151 & (load_4(s + 15) >> 6);
|
||||
crypto_int64 s7 = 2097151 & (load_3(s + 18) >> 3);
|
||||
crypto_int64 s8 = 2097151 & load_3(s + 21);
|
||||
crypto_int64 s9 = 2097151 & (load_4(s + 23) >> 5);
|
||||
crypto_int64 s10 = 2097151 & (load_3(s + 26) >> 2);
|
||||
crypto_int64 s11 = 2097151 & (load_4(s + 28) >> 7);
|
||||
crypto_int64 s12 = 2097151 & (load_4(s + 31) >> 4);
|
||||
crypto_int64 s13 = 2097151 & (load_3(s + 34) >> 1);
|
||||
crypto_int64 s14 = 2097151 & (load_4(s + 36) >> 6);
|
||||
crypto_int64 s15 = 2097151 & (load_3(s + 39) >> 3);
|
||||
crypto_int64 s16 = 2097151 & load_3(s + 42);
|
||||
crypto_int64 s17 = 2097151 & (load_4(s + 44) >> 5);
|
||||
crypto_int64 s18 = 2097151 & (load_3(s + 47) >> 2);
|
||||
crypto_int64 s19 = 2097151 & (load_4(s + 49) >> 7);
|
||||
crypto_int64 s20 = 2097151 & (load_4(s + 52) >> 4);
|
||||
crypto_int64 s21 = 2097151 & (load_3(s + 55) >> 1);
|
||||
crypto_int64 s22 = 2097151 & (load_4(s + 57) >> 6);
|
||||
crypto_int64 s23 = (load_4(s + 60) >> 3);
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
crypto_int64 carry10;
|
||||
crypto_int64 carry11;
|
||||
crypto_int64 carry12;
|
||||
crypto_int64 carry13;
|
||||
crypto_int64 carry14;
|
||||
crypto_int64 carry15;
|
||||
crypto_int64 carry16;
|
||||
|
||||
s11 += s23 * 666643;
|
||||
s12 += s23 * 470296;
|
||||
s13 += s23 * 654183;
|
||||
s14 -= s23 * 997805;
|
||||
s15 += s23 * 136657;
|
||||
s16 -= s23 * 683901;
|
||||
s23 = 0;
|
||||
|
||||
s10 += s22 * 666643;
|
||||
s11 += s22 * 470296;
|
||||
s12 += s22 * 654183;
|
||||
s13 -= s22 * 997805;
|
||||
s14 += s22 * 136657;
|
||||
s15 -= s22 * 683901;
|
||||
s22 = 0;
|
||||
|
||||
s9 += s21 * 666643;
|
||||
s10 += s21 * 470296;
|
||||
s11 += s21 * 654183;
|
||||
s12 -= s21 * 997805;
|
||||
s13 += s21 * 136657;
|
||||
s14 -= s21 * 683901;
|
||||
s21 = 0;
|
||||
|
||||
s8 += s20 * 666643;
|
||||
s9 += s20 * 470296;
|
||||
s10 += s20 * 654183;
|
||||
s11 -= s20 * 997805;
|
||||
s12 += s20 * 136657;
|
||||
s13 -= s20 * 683901;
|
||||
s20 = 0;
|
||||
|
||||
s7 += s19 * 666643;
|
||||
s8 += s19 * 470296;
|
||||
s9 += s19 * 654183;
|
||||
s10 -= s19 * 997805;
|
||||
s11 += s19 * 136657;
|
||||
s12 -= s19 * 683901;
|
||||
s19 = 0;
|
||||
|
||||
s6 += s18 * 666643;
|
||||
s7 += s18 * 470296;
|
||||
s8 += s18 * 654183;
|
||||
s9 -= s18 * 997805;
|
||||
s10 += s18 * 136657;
|
||||
s11 -= s18 * 683901;
|
||||
s18 = 0;
|
||||
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
||||
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
||||
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
||||
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
||||
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
||||
|
||||
s5 += s17 * 666643;
|
||||
s6 += s17 * 470296;
|
||||
s7 += s17 * 654183;
|
||||
s8 -= s17 * 997805;
|
||||
s9 += s17 * 136657;
|
||||
s10 -= s17 * 683901;
|
||||
s17 = 0;
|
||||
|
||||
s4 += s16 * 666643;
|
||||
s5 += s16 * 470296;
|
||||
s6 += s16 * 654183;
|
||||
s7 -= s16 * 997805;
|
||||
s8 += s16 * 136657;
|
||||
s9 -= s16 * 683901;
|
||||
s16 = 0;
|
||||
|
||||
s3 += s15 * 666643;
|
||||
s4 += s15 * 470296;
|
||||
s5 += s15 * 654183;
|
||||
s6 -= s15 * 997805;
|
||||
s7 += s15 * 136657;
|
||||
s8 -= s15 * 683901;
|
||||
s15 = 0;
|
||||
|
||||
s2 += s14 * 666643;
|
||||
s3 += s14 * 470296;
|
||||
s4 += s14 * 654183;
|
||||
s5 -= s14 * 997805;
|
||||
s6 += s14 * 136657;
|
||||
s7 -= s14 * 683901;
|
||||
s14 = 0;
|
||||
|
||||
s1 += s13 * 666643;
|
||||
s2 += s13 * 470296;
|
||||
s3 += s13 * 654183;
|
||||
s4 -= s13 * 997805;
|
||||
s5 += s13 * 136657;
|
||||
s6 -= s13 * 683901;
|
||||
s13 = 0;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
s[0] = s0 >> 0;
|
||||
s[1] = s0 >> 8;
|
||||
s[2] = (s0 >> 16) | (s1 << 5);
|
||||
s[3] = s1 >> 3;
|
||||
s[4] = s1 >> 11;
|
||||
s[5] = (s1 >> 19) | (s2 << 2);
|
||||
s[6] = s2 >> 6;
|
||||
s[7] = (s2 >> 14) | (s3 << 7);
|
||||
s[8] = s3 >> 1;
|
||||
s[9] = s3 >> 9;
|
||||
s[10] = (s3 >> 17) | (s4 << 4);
|
||||
s[11] = s4 >> 4;
|
||||
s[12] = s4 >> 12;
|
||||
s[13] = (s4 >> 20) | (s5 << 1);
|
||||
s[14] = s5 >> 7;
|
||||
s[15] = (s5 >> 15) | (s6 << 6);
|
||||
s[16] = s6 >> 2;
|
||||
s[17] = s6 >> 10;
|
||||
s[18] = (s6 >> 18) | (s7 << 3);
|
||||
s[19] = s7 >> 5;
|
||||
s[20] = s7 >> 13;
|
||||
s[21] = s8 >> 0;
|
||||
s[22] = s8 >> 8;
|
||||
s[23] = (s8 >> 16) | (s9 << 5);
|
||||
s[24] = s9 >> 3;
|
||||
s[25] = s9 >> 11;
|
||||
s[26] = (s9 >> 19) | (s10 << 2);
|
||||
s[27] = s10 >> 6;
|
||||
s[28] = (s10 >> 14) | (s11 << 7);
|
||||
s[29] = s11 >> 1;
|
||||
s[30] = s11 >> 9;
|
||||
s[31] = s11 >> 17;
|
||||
}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
Copyright (c) 2007-2011 Projet RNRT SAPHIR
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of this software and associated documentation files (the
|
||||
"Software"), to deal in the Software without restriction, including
|
||||
without limitation the rights to use, copy, modify, merge, publish,
|
||||
distribute, sublicense, and/or sell copies of the Software, and to
|
||||
permit persons to whom the Software is furnished to do so, subject to
|
||||
the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included
|
||||
in all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
|
@ -1,346 +0,0 @@
|
|||
/* $Id: md_helper.c 216 2010-06-08 09:46:57Z tp $ */
|
||||
/*
|
||||
* This file contains some functions which implement the external data
|
||||
* handling and padding for Merkle-Damgard hash functions which follow
|
||||
* the conventions set out by MD4 (little-endian) or SHA-1 (big-endian).
|
||||
*
|
||||
* API: this file is meant to be included, not compiled as a stand-alone
|
||||
* file. Some macros must be defined:
|
||||
* RFUN name for the round function
|
||||
* HASH "short name" for the hash function
|
||||
* BE32 defined for big-endian, 32-bit based (e.g. SHA-1)
|
||||
* LE32 defined for little-endian, 32-bit based (e.g. MD5)
|
||||
* BE64 defined for big-endian, 64-bit based (e.g. SHA-512)
|
||||
* LE64 defined for little-endian, 64-bit based (no example yet)
|
||||
* PW01 if defined, append 0x01 instead of 0x80 (for Tiger)
|
||||
* BLEN if defined, length of a message block (in bytes)
|
||||
* PLW1 if defined, length is defined on one 64-bit word only (for Tiger)
|
||||
* PLW4 if defined, length is defined on four 64-bit words (for WHIRLPOOL)
|
||||
* SVAL if defined, reference to the context state information
|
||||
*
|
||||
* BLEN is used when a message block is not 16 (32-bit or 64-bit) words:
|
||||
* this is used for instance for Tiger, which works on 64-bit words but
|
||||
* uses 512-bit message blocks (eight 64-bit words). PLW1 and PLW4 are
|
||||
* ignored if 32-bit words are used; if 64-bit words are used and PLW1 is
|
||||
* set, then only one word (64 bits) will be used to encode the input
|
||||
* message length (in bits), otherwise two words will be used (as in
|
||||
* SHA-384 and SHA-512). If 64-bit words are used and PLW4 is defined (but
|
||||
* not PLW1), four 64-bit words will be used to encode the message length
|
||||
* (in bits). Note that regardless of those settings, only 64-bit message
|
||||
* lengths are supported (in bits): messages longer than 2 Exabytes will be
|
||||
* improperly hashed (this is unlikely to happen soon: 2 Exabytes is about
|
||||
* 2 millions Terabytes, which is huge).
|
||||
*
|
||||
* If CLOSE_ONLY is defined, then this file defines only the sph_XXX_close()
|
||||
* function. This is used for Tiger2, which is identical to Tiger except
|
||||
* when it comes to the padding (Tiger2 uses the standard 0x80 byte instead
|
||||
* of the 0x01 from original Tiger).
|
||||
*
|
||||
* The RFUN function is invoked with two arguments, the first pointing to
|
||||
* aligned data (as a "const void *"), the second being state information
|
||||
* from the context structure. By default, this state information is the
|
||||
* "val" field from the context, and this field is assumed to be an array
|
||||
* of words ("sph_u32" or "sph_u64", depending on BE32/LE32/BE64/LE64).
|
||||
* from the context structure. The "val" field can have any type, except
|
||||
* for the output encoding which assumes that it is an array of "sph_u32"
|
||||
* values. By defining NO_OUTPUT, this last step is deactivated; the
|
||||
* includer code is then responsible for writing out the hash result. When
|
||||
* NO_OUTPUT is defined, the third parameter to the "close()" function is
|
||||
* ignored.
|
||||
*
|
||||
* ==========================(LICENSE BEGIN)============================
|
||||
*
|
||||
* Copyright (c) 2007-2010 Projet RNRT SAPHIR
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining
|
||||
* a copy of this software and associated documentation files (the
|
||||
* "Software"), to deal in the Software without restriction, including
|
||||
* without limitation the rights to use, copy, modify, merge, publish,
|
||||
* distribute, sublicense, and/or sell copies of the Software, and to
|
||||
* permit persons to whom the Software is furnished to do so, subject to
|
||||
* the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be
|
||||
* included in all copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||
* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||
* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||
* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*
|
||||
* ===========================(LICENSE END)=============================
|
||||
*
|
||||
* @author Thomas Pornin <thomas.pornin@cryptolog.com>
|
||||
*/
|
||||
|
||||
#ifdef _MSC_VER
|
||||
#pragma warning (disable: 4146)
|
||||
#endif
|
||||
|
||||
#undef SPH_XCAT
|
||||
#define SPH_XCAT(a, b) SPH_XCAT_(a, b)
|
||||
#undef SPH_XCAT_
|
||||
#define SPH_XCAT_(a, b) a ## b
|
||||
|
||||
#undef SPH_BLEN
|
||||
#undef SPH_WLEN
|
||||
#if defined BE64 || defined LE64
|
||||
#define SPH_BLEN 128U
|
||||
#define SPH_WLEN 8U
|
||||
#else
|
||||
#define SPH_BLEN 64U
|
||||
#define SPH_WLEN 4U
|
||||
#endif
|
||||
|
||||
#ifdef BLEN
|
||||
#undef SPH_BLEN
|
||||
#define SPH_BLEN BLEN
|
||||
#endif
|
||||
|
||||
#undef SPH_MAXPAD
|
||||
#if defined PLW1
|
||||
#define SPH_MAXPAD (SPH_BLEN - SPH_WLEN)
|
||||
#elif defined PLW4
|
||||
#define SPH_MAXPAD (SPH_BLEN - (SPH_WLEN << 2))
|
||||
#else
|
||||
#define SPH_MAXPAD (SPH_BLEN - (SPH_WLEN << 1))
|
||||
#endif
|
||||
|
||||
#undef SPH_VAL
|
||||
#undef SPH_NO_OUTPUT
|
||||
#ifdef SVAL
|
||||
#define SPH_VAL SVAL
|
||||
#define SPH_NO_OUTPUT 1
|
||||
#else
|
||||
#define SPH_VAL sc->val
|
||||
#endif
|
||||
|
||||
#ifndef CLOSE_ONLY
|
||||
|
||||
#ifdef SPH_UPTR
|
||||
static void
|
||||
SPH_XCAT(HASH, _short)(void *cc, const void *data, size_t len)
|
||||
#else
|
||||
void
|
||||
SPH_XCAT(sph_, HASH)(void *cc, const void *data, size_t len)
|
||||
#endif
|
||||
{
|
||||
SPH_XCAT(sph_, SPH_XCAT(HASH, _context)) *sc;
|
||||
unsigned current;
|
||||
|
||||
sc = cc;
|
||||
#if SPH_64
|
||||
current = (unsigned)sc->count & (SPH_BLEN - 1U);
|
||||
#else
|
||||
current = (unsigned)sc->count_low & (SPH_BLEN - 1U);
|
||||
#endif
|
||||
while (len > 0) {
|
||||
unsigned clen;
|
||||
#if !SPH_64
|
||||
sph_u32 clow, clow2;
|
||||
#endif
|
||||
|
||||
clen = SPH_BLEN - current;
|
||||
if (clen > len)
|
||||
clen = len;
|
||||
memcpy(sc->buf + current, data, clen);
|
||||
data = (const unsigned char *)data + clen;
|
||||
current += clen;
|
||||
len -= clen;
|
||||
if (current == SPH_BLEN) {
|
||||
RFUN(sc->buf, SPH_VAL);
|
||||
current = 0;
|
||||
}
|
||||
#if SPH_64
|
||||
sc->count += clen;
|
||||
#else
|
||||
clow = sc->count_low;
|
||||
clow2 = SPH_T32(clow + clen);
|
||||
sc->count_low = clow2;
|
||||
if (clow2 < clow)
|
||||
sc->count_high ++;
|
||||
#endif
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef SPH_UPTR
|
||||
void
|
||||
SPH_XCAT(sph_, HASH)(void *cc, const void *data, size_t len)
|
||||
{
|
||||
SPH_XCAT(sph_, SPH_XCAT(HASH, _context)) *sc;
|
||||
unsigned current;
|
||||
size_t orig_len;
|
||||
#if !SPH_64
|
||||
sph_u32 clow, clow2;
|
||||
#endif
|
||||
|
||||
if (len < (2 * SPH_BLEN)) {
|
||||
SPH_XCAT(HASH, _short)(cc, data, len);
|
||||
return;
|
||||
}
|
||||
sc = cc;
|
||||
#if SPH_64
|
||||
current = (unsigned)sc->count & (SPH_BLEN - 1U);
|
||||
#else
|
||||
current = (unsigned)sc->count_low & (SPH_BLEN - 1U);
|
||||
#endif
|
||||
if (current > 0) {
|
||||
unsigned t;
|
||||
|
||||
t = SPH_BLEN - current;
|
||||
SPH_XCAT(HASH, _short)(cc, data, t);
|
||||
data = (const unsigned char *)data + t;
|
||||
len -= t;
|
||||
}
|
||||
#if !SPH_UNALIGNED
|
||||
if (((SPH_UPTR)data & (SPH_WLEN - 1U)) != 0) {
|
||||
SPH_XCAT(HASH, _short)(cc, data, len);
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
orig_len = len;
|
||||
while (len >= SPH_BLEN) {
|
||||
RFUN(data, SPH_VAL);
|
||||
len -= SPH_BLEN;
|
||||
data = (const unsigned char *)data + SPH_BLEN;
|
||||
}
|
||||
if (len > 0)
|
||||
memcpy(sc->buf, data, len);
|
||||
#if SPH_64
|
||||
sc->count += (sph_u64)orig_len;
|
||||
#else
|
||||
clow = sc->count_low;
|
||||
clow2 = SPH_T32(clow + orig_len);
|
||||
sc->count_low = clow2;
|
||||
if (clow2 < clow)
|
||||
sc->count_high ++;
|
||||
/*
|
||||
* This code handles the improbable situation where "size_t" is
|
||||
* greater than 32 bits, and yet we do not have a 64-bit type.
|
||||
*/
|
||||
orig_len >>= 12;
|
||||
orig_len >>= 10;
|
||||
orig_len >>= 10;
|
||||
sc->count_high += orig_len;
|
||||
#endif
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Perform padding and produce result. The context is NOT reinitialized
|
||||
* by this function.
|
||||
*/
|
||||
static void
|
||||
SPH_XCAT(HASH, _addbits_and_close)(void *cc,
|
||||
unsigned ub, unsigned n, void *dst, unsigned rnum)
|
||||
{
|
||||
SPH_XCAT(sph_, SPH_XCAT(HASH, _context)) *sc;
|
||||
unsigned current, u;
|
||||
#if !SPH_64
|
||||
sph_u32 low, high;
|
||||
#endif
|
||||
|
||||
sc = cc;
|
||||
#if SPH_64
|
||||
current = (unsigned)sc->count & (SPH_BLEN - 1U);
|
||||
#else
|
||||
current = (unsigned)sc->count_low & (SPH_BLEN - 1U);
|
||||
#endif
|
||||
#ifdef PW01
|
||||
sc->buf[current ++] = (0x100 | (ub & 0xFF)) >> (8 - n);
|
||||
#else
|
||||
{
|
||||
unsigned z;
|
||||
|
||||
z = 0x80 >> n;
|
||||
sc->buf[current ++] = ((ub & -z) | z) & 0xFF;
|
||||
}
|
||||
#endif
|
||||
if (current > SPH_MAXPAD) {
|
||||
memset(sc->buf + current, 0, SPH_BLEN - current);
|
||||
RFUN(sc->buf, SPH_VAL);
|
||||
memset(sc->buf, 0, SPH_MAXPAD);
|
||||
} else {
|
||||
memset(sc->buf + current, 0, SPH_MAXPAD - current);
|
||||
}
|
||||
#if defined BE64
|
||||
#if defined PLW1
|
||||
sph_enc64be_aligned(sc->buf + SPH_MAXPAD,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
#elif defined PLW4
|
||||
memset(sc->buf + SPH_MAXPAD, 0, 2 * SPH_WLEN);
|
||||
sph_enc64be_aligned(sc->buf + SPH_MAXPAD + 2 * SPH_WLEN,
|
||||
sc->count >> 61);
|
||||
sph_enc64be_aligned(sc->buf + SPH_MAXPAD + 3 * SPH_WLEN,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
#else
|
||||
sph_enc64be_aligned(sc->buf + SPH_MAXPAD, sc->count >> 61);
|
||||
sph_enc64be_aligned(sc->buf + SPH_MAXPAD + SPH_WLEN,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
#endif
|
||||
#elif defined LE64
|
||||
#if defined PLW1
|
||||
sph_enc64le_aligned(sc->buf + SPH_MAXPAD,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
#elif defined PLW1
|
||||
sph_enc64le_aligned(sc->buf + SPH_MAXPAD,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
sph_enc64le_aligned(sc->buf + SPH_MAXPAD + SPH_WLEN, sc->count >> 61);
|
||||
memset(sc->buf + SPH_MAXPAD + 2 * SPH_WLEN, 0, 2 * SPH_WLEN);
|
||||
#else
|
||||
sph_enc64le_aligned(sc->buf + SPH_MAXPAD,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
sph_enc64le_aligned(sc->buf + SPH_MAXPAD + SPH_WLEN, sc->count >> 61);
|
||||
#endif
|
||||
#else
|
||||
#if SPH_64
|
||||
#ifdef BE32
|
||||
sph_enc64be_aligned(sc->buf + SPH_MAXPAD,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
#else
|
||||
sph_enc64le_aligned(sc->buf + SPH_MAXPAD,
|
||||
SPH_T64(sc->count << 3) + (sph_u64)n);
|
||||
#endif
|
||||
#else
|
||||
low = sc->count_low;
|
||||
high = SPH_T32((sc->count_high << 3) | (low >> 29));
|
||||
low = SPH_T32(low << 3) + (sph_u32)n;
|
||||
#ifdef BE32
|
||||
sph_enc32be(sc->buf + SPH_MAXPAD, high);
|
||||
sph_enc32be(sc->buf + SPH_MAXPAD + SPH_WLEN, low);
|
||||
#else
|
||||
sph_enc32le(sc->buf + SPH_MAXPAD, low);
|
||||
sph_enc32le(sc->buf + SPH_MAXPAD + SPH_WLEN, high);
|
||||
#endif
|
||||
#endif
|
||||
#endif
|
||||
RFUN(sc->buf, SPH_VAL);
|
||||
#ifdef SPH_NO_OUTPUT
|
||||
(void)dst;
|
||||
(void)rnum;
|
||||
(void)u;
|
||||
#else
|
||||
for (u = 0; u < rnum; u ++) {
|
||||
#if defined BE64
|
||||
sph_enc64be((unsigned char *)dst + 8 * u, sc->val[u]);
|
||||
#elif defined LE64
|
||||
sph_enc64le((unsigned char *)dst + 8 * u, sc->val[u]);
|
||||
#elif defined BE32
|
||||
sph_enc32be((unsigned char *)dst + 4 * u, sc->val[u]);
|
||||
#else
|
||||
sph_enc32le((unsigned char *)dst + 4 * u, sc->val[u]);
|
||||
#endif
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
static void
|
||||
SPH_XCAT(HASH, _close)(void *cc, void *dst, unsigned rnum)
|
||||
{
|
||||
SPH_XCAT(HASH, _addbits_and_close)(cc, 0, 0, dst, rnum);
|
||||
}
|
||||
|
|
@ -1,247 +0,0 @@
|
|||
/* $Id: sha2big.c 216 2010-06-08 09:46:57Z tp $ */
|
||||
/*
|
||||
* SHA-384 / SHA-512 implementation.
|
||||
*
|
||||
* ==========================(LICENSE BEGIN)============================
|
||||
*
|
||||
* Copyright (c) 2007-2010 Projet RNRT SAPHIR
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining
|
||||
* a copy of this software and associated documentation files (the
|
||||
* "Software"), to deal in the Software without restriction, including
|
||||
* without limitation the rights to use, copy, modify, merge, publish,
|
||||
* distribute, sublicense, and/or sell copies of the Software, and to
|
||||
* permit persons to whom the Software is furnished to do so, subject to
|
||||
* the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be
|
||||
* included in all copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||
* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||
* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||
* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*
|
||||
* ===========================(LICENSE END)=============================
|
||||
*
|
||||
* @author Thomas Pornin <thomas.pornin@cryptolog.com>
|
||||
*/
|
||||
|
||||
#include <stddef.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "sph_sha2.h"
|
||||
|
||||
#if SPH_64
|
||||
|
||||
#define CH(X, Y, Z) ((((Y) ^ (Z)) & (X)) ^ (Z))
|
||||
#define MAJ(X, Y, Z) (((X) & (Y)) | (((X) | (Y)) & (Z)))
|
||||
|
||||
#define ROTR64 SPH_ROTR64
|
||||
|
||||
#define BSG5_0(x) (ROTR64(x, 28) ^ ROTR64(x, 34) ^ ROTR64(x, 39))
|
||||
#define BSG5_1(x) (ROTR64(x, 14) ^ ROTR64(x, 18) ^ ROTR64(x, 41))
|
||||
#define SSG5_0(x) (ROTR64(x, 1) ^ ROTR64(x, 8) ^ SPH_T64((x) >> 7))
|
||||
#define SSG5_1(x) (ROTR64(x, 19) ^ ROTR64(x, 61) ^ SPH_T64((x) >> 6))
|
||||
|
||||
static const sph_u64 K512[80] = {
|
||||
SPH_C64(0x428A2F98D728AE22), SPH_C64(0x7137449123EF65CD),
|
||||
SPH_C64(0xB5C0FBCFEC4D3B2F), SPH_C64(0xE9B5DBA58189DBBC),
|
||||
SPH_C64(0x3956C25BF348B538), SPH_C64(0x59F111F1B605D019),
|
||||
SPH_C64(0x923F82A4AF194F9B), SPH_C64(0xAB1C5ED5DA6D8118),
|
||||
SPH_C64(0xD807AA98A3030242), SPH_C64(0x12835B0145706FBE),
|
||||
SPH_C64(0x243185BE4EE4B28C), SPH_C64(0x550C7DC3D5FFB4E2),
|
||||
SPH_C64(0x72BE5D74F27B896F), SPH_C64(0x80DEB1FE3B1696B1),
|
||||
SPH_C64(0x9BDC06A725C71235), SPH_C64(0xC19BF174CF692694),
|
||||
SPH_C64(0xE49B69C19EF14AD2), SPH_C64(0xEFBE4786384F25E3),
|
||||
SPH_C64(0x0FC19DC68B8CD5B5), SPH_C64(0x240CA1CC77AC9C65),
|
||||
SPH_C64(0x2DE92C6F592B0275), SPH_C64(0x4A7484AA6EA6E483),
|
||||
SPH_C64(0x5CB0A9DCBD41FBD4), SPH_C64(0x76F988DA831153B5),
|
||||
SPH_C64(0x983E5152EE66DFAB), SPH_C64(0xA831C66D2DB43210),
|
||||
SPH_C64(0xB00327C898FB213F), SPH_C64(0xBF597FC7BEEF0EE4),
|
||||
SPH_C64(0xC6E00BF33DA88FC2), SPH_C64(0xD5A79147930AA725),
|
||||
SPH_C64(0x06CA6351E003826F), SPH_C64(0x142929670A0E6E70),
|
||||
SPH_C64(0x27B70A8546D22FFC), SPH_C64(0x2E1B21385C26C926),
|
||||
SPH_C64(0x4D2C6DFC5AC42AED), SPH_C64(0x53380D139D95B3DF),
|
||||
SPH_C64(0x650A73548BAF63DE), SPH_C64(0x766A0ABB3C77B2A8),
|
||||
SPH_C64(0x81C2C92E47EDAEE6), SPH_C64(0x92722C851482353B),
|
||||
SPH_C64(0xA2BFE8A14CF10364), SPH_C64(0xA81A664BBC423001),
|
||||
SPH_C64(0xC24B8B70D0F89791), SPH_C64(0xC76C51A30654BE30),
|
||||
SPH_C64(0xD192E819D6EF5218), SPH_C64(0xD69906245565A910),
|
||||
SPH_C64(0xF40E35855771202A), SPH_C64(0x106AA07032BBD1B8),
|
||||
SPH_C64(0x19A4C116B8D2D0C8), SPH_C64(0x1E376C085141AB53),
|
||||
SPH_C64(0x2748774CDF8EEB99), SPH_C64(0x34B0BCB5E19B48A8),
|
||||
SPH_C64(0x391C0CB3C5C95A63), SPH_C64(0x4ED8AA4AE3418ACB),
|
||||
SPH_C64(0x5B9CCA4F7763E373), SPH_C64(0x682E6FF3D6B2B8A3),
|
||||
SPH_C64(0x748F82EE5DEFB2FC), SPH_C64(0x78A5636F43172F60),
|
||||
SPH_C64(0x84C87814A1F0AB72), SPH_C64(0x8CC702081A6439EC),
|
||||
SPH_C64(0x90BEFFFA23631E28), SPH_C64(0xA4506CEBDE82BDE9),
|
||||
SPH_C64(0xBEF9A3F7B2C67915), SPH_C64(0xC67178F2E372532B),
|
||||
SPH_C64(0xCA273ECEEA26619C), SPH_C64(0xD186B8C721C0C207),
|
||||
SPH_C64(0xEADA7DD6CDE0EB1E), SPH_C64(0xF57D4F7FEE6ED178),
|
||||
SPH_C64(0x06F067AA72176FBA), SPH_C64(0x0A637DC5A2C898A6),
|
||||
SPH_C64(0x113F9804BEF90DAE), SPH_C64(0x1B710B35131C471B),
|
||||
SPH_C64(0x28DB77F523047D84), SPH_C64(0x32CAAB7B40C72493),
|
||||
SPH_C64(0x3C9EBE0A15C9BEBC), SPH_C64(0x431D67C49C100D4C),
|
||||
SPH_C64(0x4CC5D4BECB3E42B6), SPH_C64(0x597F299CFC657E2A),
|
||||
SPH_C64(0x5FCB6FAB3AD6FAEC), SPH_C64(0x6C44198C4A475817)
|
||||
};
|
||||
|
||||
static const sph_u64 H384[8] = {
|
||||
SPH_C64(0xCBBB9D5DC1059ED8), SPH_C64(0x629A292A367CD507),
|
||||
SPH_C64(0x9159015A3070DD17), SPH_C64(0x152FECD8F70E5939),
|
||||
SPH_C64(0x67332667FFC00B31), SPH_C64(0x8EB44A8768581511),
|
||||
SPH_C64(0xDB0C2E0D64F98FA7), SPH_C64(0x47B5481DBEFA4FA4)
|
||||
};
|
||||
|
||||
static const sph_u64 H512[8] = {
|
||||
SPH_C64(0x6A09E667F3BCC908), SPH_C64(0xBB67AE8584CAA73B),
|
||||
SPH_C64(0x3C6EF372FE94F82B), SPH_C64(0xA54FF53A5F1D36F1),
|
||||
SPH_C64(0x510E527FADE682D1), SPH_C64(0x9B05688C2B3E6C1F),
|
||||
SPH_C64(0x1F83D9ABFB41BD6B), SPH_C64(0x5BE0CD19137E2179)
|
||||
};
|
||||
|
||||
/*
|
||||
* This macro defines the body for a SHA-384 / SHA-512 compression function
|
||||
* implementation. The "in" parameter should evaluate, when applied to a
|
||||
* numerical input parameter from 0 to 15, to an expression which yields
|
||||
* the corresponding input block. The "r" parameter should evaluate to
|
||||
* an array or pointer expression designating the array of 8 words which
|
||||
* contains the input and output of the compression function.
|
||||
*
|
||||
* SHA-512 is hard for the compiler. If the loop is completely unrolled,
|
||||
* then the code will be quite huge (possibly more than 100 kB), and the
|
||||
* performance will be degraded due to cache misses on the code. We
|
||||
* unroll only eight steps, which avoids all needless copies when
|
||||
* 64-bit registers are swapped.
|
||||
*/
|
||||
|
||||
#define SHA3_STEP(A, B, C, D, E, F, G, H, i) do { \
|
||||
sph_u64 T1, T2; \
|
||||
T1 = SPH_T64(H + BSG5_1(E) + CH(E, F, G) + K512[i] + W[i]); \
|
||||
T2 = SPH_T64(BSG5_0(A) + MAJ(A, B, C)); \
|
||||
D = SPH_T64(D + T1); \
|
||||
H = SPH_T64(T1 + T2); \
|
||||
} while (0)
|
||||
|
||||
#define SHA3_ROUND_BODY(in, r) do { \
|
||||
int i; \
|
||||
sph_u64 A, B, C, D, E, F, G, H; \
|
||||
sph_u64 W[80]; \
|
||||
\
|
||||
for (i = 0; i < 16; i ++) \
|
||||
W[i] = in(i); \
|
||||
for (i = 16; i < 80; i ++) \
|
||||
W[i] = SPH_T64(SSG5_1(W[i - 2]) + W[i - 7] \
|
||||
+ SSG5_0(W[i - 15]) + W[i - 16]); \
|
||||
A = (r)[0]; \
|
||||
B = (r)[1]; \
|
||||
C = (r)[2]; \
|
||||
D = (r)[3]; \
|
||||
E = (r)[4]; \
|
||||
F = (r)[5]; \
|
||||
G = (r)[6]; \
|
||||
H = (r)[7]; \
|
||||
for (i = 0; i < 80; i += 8) { \
|
||||
SHA3_STEP(A, B, C, D, E, F, G, H, i + 0); \
|
||||
SHA3_STEP(H, A, B, C, D, E, F, G, i + 1); \
|
||||
SHA3_STEP(G, H, A, B, C, D, E, F, i + 2); \
|
||||
SHA3_STEP(F, G, H, A, B, C, D, E, i + 3); \
|
||||
SHA3_STEP(E, F, G, H, A, B, C, D, i + 4); \
|
||||
SHA3_STEP(D, E, F, G, H, A, B, C, i + 5); \
|
||||
SHA3_STEP(C, D, E, F, G, H, A, B, i + 6); \
|
||||
SHA3_STEP(B, C, D, E, F, G, H, A, i + 7); \
|
||||
} \
|
||||
(r)[0] = SPH_T64((r)[0] + A); \
|
||||
(r)[1] = SPH_T64((r)[1] + B); \
|
||||
(r)[2] = SPH_T64((r)[2] + C); \
|
||||
(r)[3] = SPH_T64((r)[3] + D); \
|
||||
(r)[4] = SPH_T64((r)[4] + E); \
|
||||
(r)[5] = SPH_T64((r)[5] + F); \
|
||||
(r)[6] = SPH_T64((r)[6] + G); \
|
||||
(r)[7] = SPH_T64((r)[7] + H); \
|
||||
} while (0)
|
||||
|
||||
/*
|
||||
* One round of SHA-384 / SHA-512. The data must be aligned for 64-bit access.
|
||||
*/
|
||||
static void
|
||||
sha3_round(const unsigned char *data, sph_u64 r[8])
|
||||
{
|
||||
#define SHA3_IN(x) sph_dec64be_aligned(data + (8 * (x)))
|
||||
SHA3_ROUND_BODY(SHA3_IN, r);
|
||||
#undef SHA3_IN
|
||||
}
|
||||
|
||||
/* see sph_sha3.h */
|
||||
void
|
||||
sph_sha384_init(void *cc)
|
||||
{
|
||||
sph_sha384_context *sc;
|
||||
|
||||
sc = cc;
|
||||
memcpy(sc->val, H384, sizeof H384);
|
||||
sc->count = 0;
|
||||
}
|
||||
|
||||
/* see sph_sha3.h */
|
||||
void
|
||||
sph_sha512_init(void *cc)
|
||||
{
|
||||
sph_sha512_context *sc;
|
||||
|
||||
sc = cc;
|
||||
memcpy(sc->val, H512, sizeof H512);
|
||||
sc->count = 0;
|
||||
}
|
||||
|
||||
#define RFUN sha3_round
|
||||
#define HASH sha384
|
||||
#define BE64 1
|
||||
#include "md_helper.c"
|
||||
|
||||
/* see sph_sha3.h */
|
||||
void
|
||||
sph_sha384_close(void *cc, void *dst)
|
||||
{
|
||||
sha384_close(cc, dst, 6);
|
||||
sph_sha384_init(cc);
|
||||
}
|
||||
|
||||
/* see sph_sha3.h */
|
||||
void
|
||||
sph_sha384_addbits_and_close(void *cc, unsigned ub, unsigned n, void *dst)
|
||||
{
|
||||
sha384_addbits_and_close(cc, ub, n, dst, 6);
|
||||
sph_sha384_init(cc);
|
||||
}
|
||||
|
||||
/* see sph_sha3.h */
|
||||
void
|
||||
sph_sha512_close(void *cc, void *dst)
|
||||
{
|
||||
sha384_close(cc, dst, 8);
|
||||
sph_sha512_init(cc);
|
||||
}
|
||||
|
||||
/* see sph_sha3.h */
|
||||
void
|
||||
sph_sha512_addbits_and_close(void *cc, unsigned ub, unsigned n, void *dst)
|
||||
{
|
||||
sha384_addbits_and_close(cc, ub, n, dst, 8);
|
||||
sph_sha512_init(cc);
|
||||
}
|
||||
|
||||
/* see sph_sha3.h */
|
||||
void
|
||||
sph_sha384_comp(const sph_u64 msg[16], sph_u64 val[8])
|
||||
{
|
||||
#define SHA3_IN(x) msg[x]
|
||||
SHA3_ROUND_BODY(SHA3_IN, val);
|
||||
#undef SHA3_IN
|
||||
}
|
||||
|
||||
#endif
|
||||
|
|
@ -1,370 +0,0 @@
|
|||
/* $Id: sph_sha2.h 216 2010-06-08 09:46:57Z tp $ */
|
||||
/**
|
||||
* SHA-224, SHA-256, SHA-384 and SHA-512 interface.
|
||||
*
|
||||
* SHA-256 has been published in FIPS 180-2, now amended with a change
|
||||
* notice to include SHA-224 as well (which is a simple variation on
|
||||
* SHA-256). SHA-384 and SHA-512 are also defined in FIPS 180-2. FIPS
|
||||
* standards can be found at:
|
||||
* http://csrc.nist.gov/publications/fips/
|
||||
*
|
||||
* ==========================(LICENSE BEGIN)============================
|
||||
*
|
||||
* Copyright (c) 2007-2010 Projet RNRT SAPHIR
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining
|
||||
* a copy of this software and associated documentation files (the
|
||||
* "Software"), to deal in the Software without restriction, including
|
||||
* without limitation the rights to use, copy, modify, merge, publish,
|
||||
* distribute, sublicense, and/or sell copies of the Software, and to
|
||||
* permit persons to whom the Software is furnished to do so, subject to
|
||||
* the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be
|
||||
* included in all copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||
* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||
* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||
* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*
|
||||
* ===========================(LICENSE END)=============================
|
||||
*
|
||||
* @file sph_sha2.h
|
||||
* @author Thomas Pornin <thomas.pornin@cryptolog.com>
|
||||
*/
|
||||
|
||||
#ifndef SPH_SHA2_H__
|
||||
#define SPH_SHA2_H__
|
||||
|
||||
#include <stddef.h>
|
||||
#include "sph_types.h"
|
||||
|
||||
/**
|
||||
* Output size (in bits) for SHA-224.
|
||||
*/
|
||||
#define SPH_SIZE_sha224 224
|
||||
|
||||
/**
|
||||
* Output size (in bits) for SHA-256.
|
||||
*/
|
||||
#define SPH_SIZE_sha256 256
|
||||
|
||||
/**
|
||||
* This structure is a context for SHA-224 computations: it contains the
|
||||
* intermediate values and some data from the last entered block. Once
|
||||
* a SHA-224 computation has been performed, the context can be reused for
|
||||
* another computation.
|
||||
*
|
||||
* The contents of this structure are private. A running SHA-224 computation
|
||||
* can be cloned by copying the context (e.g. with a simple
|
||||
* <code>memcpy()</code>).
|
||||
*/
|
||||
typedef struct {
|
||||
#ifndef DOXYGEN_IGNORE
|
||||
unsigned char buf[64]; /* first field, for alignment */
|
||||
sph_u32 val[8];
|
||||
#if SPH_64
|
||||
sph_u64 count;
|
||||
#else
|
||||
sph_u32 count_high, count_low;
|
||||
#endif
|
||||
#endif
|
||||
} sph_sha224_context;
|
||||
|
||||
/**
|
||||
* This structure is a context for SHA-256 computations. It is identical
|
||||
* to the SHA-224 context. However, a context is initialized for SHA-224
|
||||
* <strong>or</strong> SHA-256, but not both (the internal IV is not the
|
||||
* same).
|
||||
*/
|
||||
typedef sph_sha224_context sph_sha256_context;
|
||||
|
||||
/**
|
||||
* Initialize a SHA-224 context. This process performs no memory allocation.
|
||||
*
|
||||
* @param cc the SHA-224 context (pointer to
|
||||
* a <code>sph_sha224_context</code>)
|
||||
*/
|
||||
void sph_sha224_init(void *cc);
|
||||
|
||||
/**
|
||||
* Process some data bytes. It is acceptable that <code>len</code> is zero
|
||||
* (in which case this function does nothing).
|
||||
*
|
||||
* @param cc the SHA-224 context
|
||||
* @param data the input data
|
||||
* @param len the input data length (in bytes)
|
||||
*/
|
||||
void sph_sha224(void *cc, const void *data, size_t len);
|
||||
|
||||
/**
|
||||
* Terminate the current SHA-224 computation and output the result into the
|
||||
* provided buffer. The destination buffer must be wide enough to
|
||||
* accomodate the result (28 bytes). The context is automatically
|
||||
* reinitialized.
|
||||
*
|
||||
* @param cc the SHA-224 context
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha224_close(void *cc, void *dst);
|
||||
|
||||
/**
|
||||
* Add a few additional bits (0 to 7) to the current computation, then
|
||||
* terminate it and output the result in the provided buffer, which must
|
||||
* be wide enough to accomodate the result (28 bytes). If bit number i
|
||||
* in <code>ub</code> has value 2^i, then the extra bits are those
|
||||
* numbered 7 downto 8-n (this is the big-endian convention at the byte
|
||||
* level). The context is automatically reinitialized.
|
||||
*
|
||||
* @param cc the SHA-224 context
|
||||
* @param ub the extra bits
|
||||
* @param n the number of extra bits (0 to 7)
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha224_addbits_and_close(void *cc, unsigned ub, unsigned n, void *dst);
|
||||
|
||||
/**
|
||||
* Apply the SHA-224 compression function on the provided data. The
|
||||
* <code>msg</code> parameter contains the 16 32-bit input blocks,
|
||||
* as numerical values (hence after the big-endian decoding). The
|
||||
* <code>val</code> parameter contains the 8 32-bit input blocks for
|
||||
* the compression function; the output is written in place in this
|
||||
* array.
|
||||
*
|
||||
* @param msg the message block (16 values)
|
||||
* @param val the function 256-bit input and output
|
||||
*/
|
||||
void sph_sha224_comp(const sph_u32 msg[16], sph_u32 val[8]);
|
||||
|
||||
/**
|
||||
* Initialize a SHA-256 context. This process performs no memory allocation.
|
||||
*
|
||||
* @param cc the SHA-256 context (pointer to
|
||||
* a <code>sph_sha256_context</code>)
|
||||
*/
|
||||
void sph_sha256_init(void *cc);
|
||||
|
||||
#ifdef DOXYGEN_IGNORE
|
||||
/**
|
||||
* Process some data bytes, for SHA-256. This function is identical to
|
||||
* <code>sha_224()</code>
|
||||
*
|
||||
* @param cc the SHA-224 context
|
||||
* @param data the input data
|
||||
* @param len the input data length (in bytes)
|
||||
*/
|
||||
void sph_sha256(void *cc, const void *data, size_t len);
|
||||
#endif
|
||||
|
||||
#ifndef DOXYGEN_IGNORE
|
||||
#define sph_sha256 sph_sha224
|
||||
#endif
|
||||
|
||||
/**
|
||||
* Terminate the current SHA-256 computation and output the result into the
|
||||
* provided buffer. The destination buffer must be wide enough to
|
||||
* accomodate the result (32 bytes). The context is automatically
|
||||
* reinitialized.
|
||||
*
|
||||
* @param cc the SHA-256 context
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha256_close(void *cc, void *dst);
|
||||
|
||||
/**
|
||||
* Add a few additional bits (0 to 7) to the current computation, then
|
||||
* terminate it and output the result in the provided buffer, which must
|
||||
* be wide enough to accomodate the result (32 bytes). If bit number i
|
||||
* in <code>ub</code> has value 2^i, then the extra bits are those
|
||||
* numbered 7 downto 8-n (this is the big-endian convention at the byte
|
||||
* level). The context is automatically reinitialized.
|
||||
*
|
||||
* @param cc the SHA-256 context
|
||||
* @param ub the extra bits
|
||||
* @param n the number of extra bits (0 to 7)
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha256_addbits_and_close(void *cc, unsigned ub, unsigned n, void *dst);
|
||||
|
||||
#ifdef DOXYGEN_IGNORE
|
||||
/**
|
||||
* Apply the SHA-256 compression function on the provided data. This
|
||||
* function is identical to <code>sha224_comp()</code>.
|
||||
*
|
||||
* @param msg the message block (16 values)
|
||||
* @param val the function 256-bit input and output
|
||||
*/
|
||||
void sph_sha256_comp(const sph_u32 msg[16], sph_u32 val[8]);
|
||||
#endif
|
||||
|
||||
#ifndef DOXYGEN_IGNORE
|
||||
#define sph_sha256_comp sph_sha224_comp
|
||||
#endif
|
||||
|
||||
#if SPH_64
|
||||
|
||||
/**
|
||||
* Output size (in bits) for SHA-384.
|
||||
*/
|
||||
#define SPH_SIZE_sha384 384
|
||||
|
||||
/**
|
||||
* Output size (in bits) for SHA-512.
|
||||
*/
|
||||
#define SPH_SIZE_sha512 512
|
||||
|
||||
/**
|
||||
* This structure is a context for SHA-384 computations: it contains the
|
||||
* intermediate values and some data from the last entered block. Once
|
||||
* a SHA-384 computation has been performed, the context can be reused for
|
||||
* another computation.
|
||||
*
|
||||
* The contents of this structure are private. A running SHA-384 computation
|
||||
* can be cloned by copying the context (e.g. with a simple
|
||||
* <code>memcpy()</code>).
|
||||
*/
|
||||
typedef struct {
|
||||
#ifndef DOXYGEN_IGNORE
|
||||
unsigned char buf[128]; /* first field, for alignment */
|
||||
sph_u64 val[8];
|
||||
sph_u64 count;
|
||||
#endif
|
||||
} sph_sha384_context;
|
||||
|
||||
/**
|
||||
* Initialize a SHA-384 context. This process performs no memory allocation.
|
||||
*
|
||||
* @param cc the SHA-384 context (pointer to
|
||||
* a <code>sph_sha384_context</code>)
|
||||
*/
|
||||
void sph_sha384_init(void *cc);
|
||||
|
||||
/**
|
||||
* Process some data bytes. It is acceptable that <code>len</code> is zero
|
||||
* (in which case this function does nothing).
|
||||
*
|
||||
* @param cc the SHA-384 context
|
||||
* @param data the input data
|
||||
* @param len the input data length (in bytes)
|
||||
*/
|
||||
void sph_sha384(void *cc, const void *data, size_t len);
|
||||
|
||||
/**
|
||||
* Terminate the current SHA-384 computation and output the result into the
|
||||
* provided buffer. The destination buffer must be wide enough to
|
||||
* accomodate the result (48 bytes). The context is automatically
|
||||
* reinitialized.
|
||||
*
|
||||
* @param cc the SHA-384 context
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha384_close(void *cc, void *dst);
|
||||
|
||||
/**
|
||||
* Add a few additional bits (0 to 7) to the current computation, then
|
||||
* terminate it and output the result in the provided buffer, which must
|
||||
* be wide enough to accomodate the result (48 bytes). If bit number i
|
||||
* in <code>ub</code> has value 2^i, then the extra bits are those
|
||||
* numbered 7 downto 8-n (this is the big-endian convention at the byte
|
||||
* level). The context is automatically reinitialized.
|
||||
*
|
||||
* @param cc the SHA-384 context
|
||||
* @param ub the extra bits
|
||||
* @param n the number of extra bits (0 to 7)
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha384_addbits_and_close(void *cc, unsigned ub, unsigned n, void *dst);
|
||||
|
||||
/**
|
||||
* Apply the SHA-384 compression function on the provided data. The
|
||||
* <code>msg</code> parameter contains the 16 64-bit input blocks,
|
||||
* as numerical values (hence after the big-endian decoding). The
|
||||
* <code>val</code> parameter contains the 8 64-bit input blocks for
|
||||
* the compression function; the output is written in place in this
|
||||
* array.
|
||||
*
|
||||
* @param msg the message block (16 values)
|
||||
* @param val the function 512-bit input and output
|
||||
*/
|
||||
void sph_sha384_comp(const sph_u64 msg[16], sph_u64 val[8]);
|
||||
|
||||
/**
|
||||
* This structure is a context for SHA-512 computations. It is identical
|
||||
* to the SHA-384 context. However, a context is initialized for SHA-384
|
||||
* <strong>or</strong> SHA-512, but not both (the internal IV is not the
|
||||
* same).
|
||||
*/
|
||||
typedef sph_sha384_context sph_sha512_context;
|
||||
|
||||
/**
|
||||
* Initialize a SHA-512 context. This process performs no memory allocation.
|
||||
*
|
||||
* @param cc the SHA-512 context (pointer to
|
||||
* a <code>sph_sha512_context</code>)
|
||||
*/
|
||||
void sph_sha512_init(void *cc);
|
||||
|
||||
#ifdef DOXYGEN_IGNORE
|
||||
/**
|
||||
* Process some data bytes, for SHA-512. This function is identical to
|
||||
* <code>sph_sha384()</code>.
|
||||
*
|
||||
* @param cc the SHA-384 context
|
||||
* @param data the input data
|
||||
* @param len the input data length (in bytes)
|
||||
*/
|
||||
void sph_sha512(void *cc, const void *data, size_t len);
|
||||
#endif
|
||||
|
||||
#ifndef DOXYGEN_IGNORE
|
||||
#define sph_sha512 sph_sha384
|
||||
#endif
|
||||
|
||||
/**
|
||||
* Terminate the current SHA-512 computation and output the result into the
|
||||
* provided buffer. The destination buffer must be wide enough to
|
||||
* accomodate the result (64 bytes). The context is automatically
|
||||
* reinitialized.
|
||||
*
|
||||
* @param cc the SHA-512 context
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha512_close(void *cc, void *dst);
|
||||
|
||||
/**
|
||||
* Add a few additional bits (0 to 7) to the current computation, then
|
||||
* terminate it and output the result in the provided buffer, which must
|
||||
* be wide enough to accomodate the result (64 bytes). If bit number i
|
||||
* in <code>ub</code> has value 2^i, then the extra bits are those
|
||||
* numbered 7 downto 8-n (this is the big-endian convention at the byte
|
||||
* level). The context is automatically reinitialized.
|
||||
*
|
||||
* @param cc the SHA-512 context
|
||||
* @param ub the extra bits
|
||||
* @param n the number of extra bits (0 to 7)
|
||||
* @param dst the destination buffer
|
||||
*/
|
||||
void sph_sha512_addbits_and_close(void *cc, unsigned ub, unsigned n, void *dst);
|
||||
|
||||
#ifdef DOXYGEN_IGNORE
|
||||
/**
|
||||
* Apply the SHA-512 compression function. This function is identical to
|
||||
* <code>sph_sha384_comp()</code>.
|
||||
*
|
||||
* @param msg the message block (16 values)
|
||||
* @param val the function 512-bit input and output
|
||||
*/
|
||||
void sph_sha512_comp(const sph_u64 msg[16], sph_u64 val[8]);
|
||||
#endif
|
||||
|
||||
#ifndef DOXYGEN_IGNORE
|
||||
#define sph_sha512_comp sph_sha384_comp
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
#endif
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,41 +0,0 @@
|
|||
#include <string.h>
|
||||
#include "crypto_sign.h"
|
||||
#include "crypto_hash_sha512.h"
|
||||
#include "ge.h"
|
||||
#include "sc.h"
|
||||
|
||||
int crypto_sign(
|
||||
unsigned char *sm,unsigned long long *smlen,
|
||||
const unsigned char *m,unsigned long long mlen,
|
||||
const unsigned char *sk
|
||||
)
|
||||
{
|
||||
unsigned char pk[32];
|
||||
unsigned char az[64];
|
||||
unsigned char nonce[64];
|
||||
unsigned char hram[64];
|
||||
ge_p3 R;
|
||||
|
||||
memmove(pk,sk + 32,32);
|
||||
|
||||
crypto_hash_sha512(az,sk,32);
|
||||
az[0] &= 248;
|
||||
az[31] &= 63;
|
||||
az[31] |= 64;
|
||||
|
||||
*smlen = mlen + 64;
|
||||
memmove(sm + 64,m,mlen);
|
||||
memmove(sm + 32,az + 32,32);
|
||||
crypto_hash_sha512(nonce,sm + 32,mlen + 32);
|
||||
memmove(sm + 32,pk,32);
|
||||
|
||||
sc_reduce(nonce);
|
||||
ge_scalarmult_base(&R,nonce);
|
||||
ge_p3_tobytes(sm,&R);
|
||||
|
||||
crypto_hash_sha512(hram,sm,mlen + 64);
|
||||
sc_reduce(hram);
|
||||
sc_muladd(sm + 32,hram,az,nonce);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -1 +0,0 @@
|
|||
-32595792,-7943725,9377950,3500415,12389472,-272473,-25146209,-2005654,326686,11406482
|
||||
Loading…
Reference in a new issue