|
|
@@ -294,9 +294,7 @@ snv decaf_448_subx( |
|
|
|
snv decaf_448_montmul ( |
|
|
|
decaf_448_scalar_t out, |
|
|
|
const decaf_448_scalar_t a, |
|
|
|
const decaf_448_scalar_t b, |
|
|
|
const decaf_448_scalar_t p, |
|
|
|
decaf_word_t montgomery_factor |
|
|
|
const decaf_448_scalar_t b |
|
|
|
) { |
|
|
|
unsigned int i,j; |
|
|
|
decaf_word_t accum[DECAF_448_SCALAR_LIMBS+1] = {0}; |
|
|
@@ -314,9 +312,9 @@ snv decaf_448_montmul ( |
|
|
|
} |
|
|
|
accum[j] = chain; |
|
|
|
|
|
|
|
mand = accum[0] * montgomery_factor; |
|
|
|
mand = accum[0] * DECAF_MONTGOMERY_FACTOR; |
|
|
|
chain = 0; |
|
|
|
mier = p->limb; |
|
|
|
mier = decaf_448_scalar_p->limb; |
|
|
|
for (j=0; j<DECAF_448_SCALAR_LIMBS; j++) { |
|
|
|
chain += (decaf_dword_t)mand*mier[j] + accum[j]; |
|
|
|
if (j) accum[j-1] = chain; |
|
|
@@ -328,7 +326,7 @@ snv decaf_448_montmul ( |
|
|
|
hi_carry = chain >> WBITS; |
|
|
|
} |
|
|
|
|
|
|
|
decaf_448_subx(out, accum, p, p, hi_carry); |
|
|
|
decaf_448_subx(out, accum, decaf_448_scalar_p, decaf_448_scalar_p, hi_carry); |
|
|
|
} |
|
|
|
|
|
|
|
void decaf_448_scalar_mul ( |
|
|
@@ -336,8 +334,8 @@ void decaf_448_scalar_mul ( |
|
|
|
const decaf_448_scalar_t a, |
|
|
|
const decaf_448_scalar_t b |
|
|
|
) { |
|
|
|
decaf_448_montmul(out,a,b,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(out,out,decaf_448_scalar_r2,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(out,a,b); |
|
|
|
decaf_448_montmul(out,out,decaf_448_scalar_r2); |
|
|
|
} |
|
|
|
|
|
|
|
/* PERF: could implement this */ |
|
|
@@ -345,7 +343,7 @@ siv decaf_448_montsqr ( |
|
|
|
decaf_448_scalar_t out, |
|
|
|
const decaf_448_scalar_t a |
|
|
|
) { |
|
|
|
decaf_448_montmul(out,a,a,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(out,a,a); |
|
|
|
} |
|
|
|
|
|
|
|
decaf_bool_t decaf_448_scalar_invert ( |
|
|
@@ -353,17 +351,17 @@ decaf_bool_t decaf_448_scalar_invert ( |
|
|
|
const decaf_448_scalar_t a |
|
|
|
) { |
|
|
|
decaf_448_scalar_t chain[7], tmp; |
|
|
|
decaf_448_montmul(chain[0],a,decaf_448_scalar_r2,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(chain[0],a,decaf_448_scalar_r2); |
|
|
|
|
|
|
|
unsigned int i,j; |
|
|
|
/* Addition chain generated by a not-too-clever SAGE script. First part: compute a^(2^222-1) */ |
|
|
|
struct { uint8_t widx, sidx, sct, midx; } muls [] = { |
|
|
|
const struct { uint8_t widx, sidx, sct, midx; } muls [] = { |
|
|
|
{2,0,1,0}, {3,2,1,0}, {4,3,1,0}, {5,4,1,0}, /* 0x3,7,f,1f */ |
|
|
|
{1,5,1,0}, {1,1,3,3}, {6,1,9,1}, {1,6,1,0}, {6,1,18,6}, /* a^(2^37-1) */ |
|
|
|
{1,6,37,6}, {1,1,37,6}, {1,1,111,1} /* a^(2^222-1) */ |
|
|
|
}; |
|
|
|
/* Second part: sliding window */ |
|
|
|
struct { uint8_t sct, midx; } muls1 [] = { |
|
|
|
const struct { uint8_t sct, midx; } muls1 [] = { |
|
|
|
{6, 5}, {4, 2}, {3, 0}, {2, 0}, {4, 0}, {8, 5}, |
|
|
|
{2, 0}, {5, 3}, {4, 0}, {4, 0}, {5, 3}, {3, 2}, |
|
|
|
{3, 2}, {3, 2}, {2, 0}, {3, 0}, {4, 2}, {2, 0}, |
|
|
@@ -382,7 +380,7 @@ decaf_bool_t decaf_448_scalar_invert ( |
|
|
|
for (j=1; j<muls[i].sct; j++) { |
|
|
|
decaf_448_montsqr(tmp, tmp); |
|
|
|
} |
|
|
|
decaf_448_montmul(chain[muls[i].widx], tmp, chain[muls[i].midx], decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(chain[muls[i].widx], tmp, chain[muls[i].midx]); |
|
|
|
} |
|
|
|
|
|
|
|
for (i=0; i<sizeof(muls1)/sizeof(muls1[0]); i++) { |
|
|
@@ -390,10 +388,10 @@ decaf_bool_t decaf_448_scalar_invert ( |
|
|
|
for (j=1; j<muls1[i].sct; j++) { |
|
|
|
decaf_448_montsqr(tmp, tmp); |
|
|
|
} |
|
|
|
decaf_448_montmul(chain[1], tmp, chain[muls1[i].midx], decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(chain[1], tmp, chain[muls1[i].midx]); |
|
|
|
} |
|
|
|
|
|
|
|
decaf_448_montmul(out,chain[1],decaf_448_scalar_one,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(out,chain[1],decaf_448_scalar_one); |
|
|
|
for (i=0; i<sizeof(chain)/sizeof(chain[0]); i++) { |
|
|
|
decaf_448_scalar_destroy(chain[i]); |
|
|
|
} |
|
|
@@ -701,7 +699,7 @@ decaf_bool_t decaf_448_scalar_decode( |
|
|
|
accum = (accum + s->limb[i] - decaf_448_scalar_p->limb[i]) >> WBITS; |
|
|
|
} |
|
|
|
|
|
|
|
decaf_448_montmul(s,s,decaf_448_scalar_r1,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); /* ham-handed reduce */ |
|
|
|
decaf_448_montmul(s,s,decaf_448_scalar_r1); /* ham-handed reduce */ |
|
|
|
|
|
|
|
return accum; |
|
|
|
} |
|
|
@@ -753,14 +751,14 @@ void decaf_448_scalar_decode_long( |
|
|
|
if (ser_len == sizeof(*ser)) { |
|
|
|
assert(i==0); |
|
|
|
/* ham-handed reduce */ |
|
|
|
decaf_448_montmul(s,t1,decaf_448_scalar_r1,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(s,t1,decaf_448_scalar_r1); |
|
|
|
decaf_448_scalar_destroy(t1); |
|
|
|
return; |
|
|
|
} |
|
|
|
|
|
|
|
while (i) { |
|
|
|
i -= DECAF_448_SER_BYTES; |
|
|
|
decaf_448_montmul(t1,t1,decaf_448_scalar_r2,decaf_448_scalar_p,DECAF_MONTGOMERY_FACTOR); |
|
|
|
decaf_448_montmul(t1,t1,decaf_448_scalar_r2); |
|
|
|
ignore_result( decaf_448_scalar_decode(t2, ser+i) ); |
|
|
|
decaf_448_scalar_add(t1, t1, t2); |
|
|
|
} |
|
|
|