decaf/decaf_[field].h[xx] -> decaf/point_[field].h[xx]

Makefile

@@ -176,7 +176,7 @@ define define_curve
 LIBCOMPONENTS += $$(BUILD_OBJ)/$(1)/decaf.o $$(BUILD_OBJ)/$(1)/elligator.o $$(BUILD_OBJ)/$(1)/scalar.o \
 	 $$(BUILD_OBJ)/$(1)/crypto.o $$(BUILD_OBJ)/$(1)/eddsa.o $$(BUILD_OBJ)/$(1)/decaf_tables.o
 PER_OBJ_DIRS += $$(BUILD_OBJ)/$(1)
-GLOBAL_HEADERS_OF_$(1) = $(BUILD_INC)/decaf/decaf_$(3).h $(BUILD_INC)/decaf/decaf_$(3).hxx \
+GLOBAL_HEADERS_OF_$(1) = $(BUILD_INC)/decaf/point_$(3).h $(BUILD_INC)/decaf/point_$(3).hxx \
 		$(BUILD_C)/decaf/crypto_$(3).h $(BUILD_C)/decaf/crypto_$(3).hxx \
 		$(BUILD_INC)/decaf/ed$(3).h $(BUILD_INC)/decaf/ed$(3).hxx
 HEADERS_OF_$(1) = $$(HEADERS_OF_$(2)) $$(GLOBAL_HEADERS_OF_$(1))
@@ -188,7 +188,7 @@ $$(BUILD_C)/$(1)/%.c: src/per_curve/%.tmpl.c src/generator/* Makefile
 $$(BUILD_H)/$(1)/%.h: src/per_curve/%.tmpl.h src/generator/* Makefile
 	python -B src/generator/template.py --per=curve --item=$(1) --guard=$(1)/`basename $$@` -o $$@ $$<
 	
-$$(BUILD_INC)/decaf/decaf_$(3).%: src/per_curve/decaf.tmpl.% src/generator/* Makefile
+$$(BUILD_INC)/decaf/point_$(3).%: src/per_curve/point.tmpl.% src/generator/* Makefile
 	python -B src/generator/template.py --per=curve --item=$(1) --guard=$$(@:$(BUILD_INC)/%=%) -o $$@ $$<
 	
 $$(BUILD_INC)/decaf/ed$(3).%: src/per_curve/eddsa.tmpl.% src/generator/* Makefile
@@ -321,5 +321,5 @@ microbench: $(BUILD_IBIN)/bench
 clean:
 	rm -fr build
 
-clean_generated:
+clean_generated: clean
 	rm -fr $(BUILD_C)/* $(BUILD_H)/* $(BUILD_INC)/*

src/GENERATED/c/curve25519/crypto.c

@@ -1,231 +0,0 @@
-/**
- * @file curve25519/crypto.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @cond internal
- * @brief Example Decaf crypto routines
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include <decaf/crypto.h>
-#include <string.h>
-
-#define API_NAME "decaf_255"
-#define API_NS(_id) decaf_255_##_id
-#define API_NS_TOY(_id) decaf_255_TOY_##_id
-#define SCALAR_BITS DECAF_255_SCALAR_BITS
-#define SCALAR_BYTES ((SCALAR_BITS + 7)/8)
-#define SER_BYTES DECAF_255_SER_BYTES
-
- /* TODO: canonicalize and freeze the STROBE constants in this file
-  * (and STROBE itself for that matter)
-  */
-static const char *DERIVE_MAGIC = API_NAME"::derive_private_key";
-static const char *SIGN_MAGIC = API_NAME"::sign";
-static const char *SHARED_SECRET_MAGIC = API_NAME"::shared_secret";
-static const uint16_t SHARED_SECRET_MAX_BLOCK_SIZE = 1<<12;
-static const unsigned int SCALAR_OVERKILL_BYTES = SCALAR_BYTES + 8;
-
-void API_NS_TOY(derive_private_key) (
-    API_NS_TOY(private_key_t) priv,
-    const API_NS_TOY(symmetric_key_t) proto
-) {
-    uint8_t encoded_scalar[SCALAR_OVERKILL_BYTES];
-    API_NS(point_t) pub;
-    
-    keccak_decaf_TOY_strobe_t strobe;
-    decaf_TOY_strobe_init(strobe, &STROBE_256, DERIVE_MAGIC, 0);
-    decaf_TOY_strobe_fixed_key(strobe, proto, sizeof(API_NS_TOY(symmetric_key_t)));
-    decaf_TOY_strobe_prng(strobe, encoded_scalar, sizeof(encoded_scalar));
-    decaf_TOY_strobe_destroy(strobe);
-    
-    memcpy(priv->sym, proto, sizeof(API_NS_TOY(symmetric_key_t)));
-    API_NS(scalar_decode_long)(priv->secret_scalar, encoded_scalar, sizeof(encoded_scalar));
-    
-    API_NS(precomputed_scalarmul)(pub, API_NS(precomputed_base), priv->secret_scalar);
-    API_NS(point_encode)(priv->pub, pub);
-    
-    decaf_bzero(encoded_scalar, sizeof(encoded_scalar));
-}
-
-void API_NS_TOY(destroy_private_key) (
-    API_NS_TOY(private_key_t) priv
-)  {
-    decaf_bzero((void*)priv, sizeof(API_NS_TOY(private_key_t)));
-}
-
-void API_NS_TOY(private_to_public) (
-    API_NS_TOY(public_key_t) pub,
-    const API_NS_TOY(private_key_t) priv
-) {
-    memcpy(pub, priv->pub, sizeof(API_NS_TOY(public_key_t)));
-}
-
-/* Performance vs consttime tuning.
- * Specifying true here might give better DOS resistance in certain corner
- * cases.  Specifying false gives a tighter result in test_ct.
- */
-#ifndef DECAF_CRYPTO_SHARED_SECRET_SHORT_CIRUIT
-#define DECAF_CRYPTO_SHARED_SECRET_SHORT_CIRUIT DECAF_FALSE
-#endif
-
-decaf_error_t API_NS_TOY(shared_secret) (
-    uint8_t *shared,
-    size_t shared_bytes,
-    const API_NS_TOY(private_key_t) my_privkey,
-    const API_NS_TOY(public_key_t) your_pubkey,
-    int me_first
-) {
-    keccak_decaf_TOY_strobe_t strobe;
-    decaf_TOY_strobe_init(strobe, &STROBE_256, SHARED_SECRET_MAGIC, 0);
-    
-    uint8_t ss_ser[SER_BYTES];
-    
-    if (me_first) {
-        decaf_TOY_strobe_ad(strobe,my_privkey->pub,sizeof(API_NS_TOY(public_key_t)));
-        decaf_TOY_strobe_ad(strobe,your_pubkey,sizeof(API_NS_TOY(public_key_t)));
-    } else {
-        decaf_TOY_strobe_ad(strobe,your_pubkey,sizeof(API_NS_TOY(public_key_t)));
-        decaf_TOY_strobe_ad(strobe,my_privkey->pub,sizeof(API_NS_TOY(public_key_t)));
-    }
-    decaf_error_t ret = API_NS(direct_scalarmul)(
-        ss_ser, your_pubkey, my_privkey->secret_scalar, DECAF_FALSE,
-        DECAF_CRYPTO_SHARED_SECRET_SHORT_CIRUIT
-    );
-    
-    decaf_TOY_strobe_transact(strobe,NULL,ss_ser,sizeof(ss_ser),STROBE_CW_DH_KEY);
-    
-    while (shared_bytes) {
-        uint16_t cando = (shared_bytes > SHARED_SECRET_MAX_BLOCK_SIZE)
-                       ? SHARED_SECRET_MAX_BLOCK_SIZE : shared_bytes;
-        decaf_TOY_strobe_prng(strobe,shared,cando);
-        shared_bytes -= cando;
-        shared += cando;
-    }
-
-    decaf_TOY_strobe_destroy(strobe);
-    decaf_bzero(ss_ser, sizeof(ss_ser));
-    
-    return ret;
-}
-
-void API_NS_TOY(sign_strobe) (
-    keccak_decaf_TOY_strobe_t strobe,
-    API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(private_key_t) priv
-) {
-    uint8_t overkill[SCALAR_OVERKILL_BYTES];
-    API_NS(point_t) point;
-    API_NS(scalar_t) nonce, challenge;
-    
-    /* Stir pubkey */
-    decaf_TOY_strobe_transact(strobe,NULL,priv->pub,sizeof(API_NS_TOY(public_key_t)),STROBE_CW_SIG_PK);
-    
-    /* Derive nonce */
-    keccak_decaf_TOY_strobe_t strobe2;
-    memcpy(strobe2,strobe,sizeof(strobe2));
-    decaf_TOY_strobe_fixed_key(strobe2,priv->sym,sizeof(API_NS_TOY(symmetric_key_t)));
-    decaf_TOY_strobe_prng(strobe2,overkill,sizeof(overkill));
-    decaf_TOY_strobe_destroy(strobe2);
-    
-    API_NS(scalar_decode_long)(nonce, overkill, sizeof(overkill));
-    API_NS(precomputed_scalarmul)(point, API_NS(precomputed_base), nonce);
-    API_NS(point_encode)(sig, point);
-    
-
-    /* Derive challenge */
-    decaf_TOY_strobe_transact(strobe,NULL,sig,SER_BYTES,STROBE_CW_SIG_EPH);
-    decaf_TOY_strobe_transact(strobe,overkill,NULL,sizeof(overkill),STROBE_CW_SIG_CHAL);
-    API_NS(scalar_decode_long)(challenge, overkill, sizeof(overkill));
-    
-    /* Respond */
-    API_NS(scalar_mul)(challenge, challenge, priv->secret_scalar);
-    API_NS(scalar_sub)(nonce, nonce, challenge);
-    
-    /* Save results */
-    API_NS(scalar_encode)(overkill, nonce);
-    decaf_TOY_strobe_transact(strobe,&sig[SER_BYTES],overkill,SCALAR_BYTES,STROBE_CW_SIG_RESP);
-    
-    /* Clean up */
-    API_NS(scalar_destroy)(nonce);
-    API_NS(scalar_destroy)(challenge);
-    decaf_bzero(overkill,sizeof(overkill));
-}
-
-decaf_error_t API_NS_TOY(verify_strobe) (
-    keccak_decaf_TOY_strobe_t strobe,
-    const API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(public_key_t) pub
-) {
-    decaf_bool_t ret;
-    
-    uint8_t overkill[SCALAR_OVERKILL_BYTES];
-    API_NS(point_t) point, pubpoint;
-    API_NS(scalar_t) challenge, response;
-    
-    /* Stir pubkey */
-    decaf_TOY_strobe_transact(strobe,NULL,pub,sizeof(API_NS_TOY(public_key_t)),STROBE_CW_SIG_PK);
-    
-    /* Derive nonce */
-    decaf_TOY_strobe_transact(strobe,NULL,sig,SER_BYTES,STROBE_CW_SIG_EPH);
-    ret = decaf_successful( API_NS(point_decode)(point, sig, DECAF_TRUE) );
-    
-    /* Derive challenge */
-    decaf_TOY_strobe_transact(strobe,overkill,NULL,sizeof(overkill),STROBE_CW_SIG_CHAL);
-    API_NS(scalar_decode_long)(challenge, overkill, sizeof(overkill));
-    
-    /* Decode response */
-    decaf_TOY_strobe_transact(strobe,overkill,&sig[SER_BYTES],SCALAR_BYTES,STROBE_CW_SIG_RESP);
-    ret &= decaf_successful( API_NS(scalar_decode)(response, overkill) );
-    ret &= decaf_successful( API_NS(point_decode)(pubpoint, pub, DECAF_FALSE) );
-
-    API_NS(base_double_scalarmul_non_secret) (
-        pubpoint, response, pubpoint, challenge
-    );
-
-    ret &= API_NS(point_eq)(pubpoint, point);
-    
-    /* Nothing here is secret, so don't do these things:
-        decaf_bzero(overkill,sizeof(overkill));
-        API_NS(point_destroy)(point);
-        API_NS(point_destroy)(pubpoint);
-        API_NS(scalar_destroy)(challenge);
-        API_NS(scalar_destroy)(response);
-    */
-    
-    return decaf_succeed_if(ret);
-}
-
-void
-API_NS_TOY(sign) (
-    API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(private_key_t) priv,
-    const unsigned char *message,
-    size_t message_len
-) {
-    keccak_decaf_TOY_strobe_t ctx;
-    decaf_TOY_strobe_init(ctx,&STROBE_256,SIGN_MAGIC,0);
-    decaf_TOY_strobe_transact(ctx, NULL, message, message_len, STROBE_CW_STREAMING_PLAINTEXT);
-    API_NS_TOY(sign_strobe)(ctx, sig, priv);
-    decaf_TOY_strobe_destroy(ctx);
-}
-
-decaf_error_t
-API_NS_TOY(verify) (
-    const API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(public_key_t) pub,
-    const unsigned char *message,
-    size_t message_len
-) {
-    keccak_decaf_TOY_strobe_t ctx;
-    decaf_TOY_strobe_init(ctx,&STROBE_256,SIGN_MAGIC,0);
-    decaf_TOY_strobe_transact(ctx, NULL, message, message_len, STROBE_CW_STREAMING_PLAINTEXT);
-    decaf_error_t ret = API_NS_TOY(verify_strobe)(ctx, sig, pub);
-    decaf_TOY_strobe_destroy(ctx);
-    return ret;
-}

src/GENERATED/c/curve25519/decaf_gen_tables.c

@@ -1,116 +0,0 @@
-/**
- * @file curve25519/decaf_gen_tables.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @brief Decaf global constant table precomputation.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#define _XOPEN_SOURCE 600 /* for posix_memalign */
-#include <stdio.h>
-#include <stdlib.h>
-
-#include "field.h"
-#include "f_field.h"
-#include "decaf.h"
-
-#define API_NS(_id) decaf_255_##_id
-static const unsigned char base_point_ser_for_pregen[SER_BYTES] = {
-    0x03
-};
-
- /* To satisfy linker. */
-const gf API_NS(precomputed_base_as_fe)[1];
-const API_NS(point_t) API_NS(point_base);
-
-struct niels_s;
-const gf_s *API_NS(precomputed_wnaf_as_fe);
-extern const size_t API_NS(sizeof_precomputed_wnafs);
-
-void API_NS(precompute_wnafs) (
-    struct niels_s *out,
-    const API_NS(point_t) base
-);
-static void field_print(const gf f) {
-    unsigned char ser[X_SER_BYTES];
-    gf_serialize(ser,f,1);
-    int b=0, i, comma=0;
-    unsigned long long limb = 0;
-    printf("{FIELD_LITERAL(");
-    for (i=0; i<X_SER_BYTES; i++) {
-        limb |= ((uint64_t)ser[i])<<b;
-        b += 8;
-        if (b >= GF_LIT_LIMB_BITS || i == SER_BYTES-1) {
-            limb &= (1ull<<GF_LIT_LIMB_BITS) -1;
-            b -= GF_LIT_LIMB_BITS;
-            if (comma) printf(",");
-            comma = 1;
-            printf("0x%016llx", limb);
-            limb = ((uint64_t)ser[i])>>(8-b);
-        }
-    }
-    printf(")}");
-    assert(b<8);
-}
-
-int main(int argc, char **argv) {
-    (void)argc; (void)argv;
-    
-    API_NS(point_t) real_point_base;
-    int ret = API_NS(point_decode)(real_point_base,base_point_ser_for_pregen,0);
-    if (ret != DECAF_SUCCESS) return 1;
-    
-    API_NS(precomputed_s) *pre;
-    ret = posix_memalign((void**)&pre, API_NS(alignof_precomputed_s), API_NS(sizeof_precomputed_s));
-    if (ret || !pre) return 1;
-    API_NS(precompute)(pre, real_point_base);
-    
-    struct niels_s *pre_wnaf;
-    ret = posix_memalign((void**)&pre_wnaf, API_NS(alignof_precomputed_s), API_NS(sizeof_precomputed_wnafs));
-    if (ret || !pre_wnaf) return 1;
-    API_NS(precompute_wnafs)(pre_wnaf, real_point_base);
-
-    const gf_s *output;
-    unsigned i;
-    
-    printf("/** @warning: this file was automatically generated. */\n");
-    printf("#include \"field.h\"\n\n");
-    printf("#include <decaf.h>\n\n");
-    printf("#define API_NS(_id) decaf_255_##_id\n");
-    
-    output = (const gf_s *)real_point_base;
-    printf("const API_NS(point_t) API_NS(point_base) = {{\n");
-    for (i=0; i < sizeof(API_NS(point_t)); i+=sizeof(gf)) {
-        if (i) printf(",\n  ");
-        field_print(output++);
-    }
-    printf("\n}};\n");
-    
-    output = (const gf_s *)pre;
-    printf("const gf API_NS(precomputed_base_as_fe)[%d]\n", 
-        (int)(API_NS(sizeof_precomputed_s) / sizeof(gf)));
-    printf("__attribute__((aligned(%d),visibility(\"hidden\"))) = {\n  ", (int)API_NS(alignof_precomputed_s));
-    
-    for (i=0; i < API_NS(sizeof_precomputed_s); i+=sizeof(gf)) {
-        if (i) printf(",\n  ");
-        field_print(output++);
-    }
-    printf("\n};\n");
-    
-    output = (const gf_s *)pre_wnaf;
-    printf("const gf API_NS(precomputed_wnaf_as_fe)[%d]\n", 
-        (int)(API_NS(sizeof_precomputed_wnafs) / sizeof(gf)));
-    printf("__attribute__((aligned(%d),visibility(\"hidden\"))) = {\n  ", (int)API_NS(alignof_precomputed_s));
-    for (i=0; i < API_NS(sizeof_precomputed_wnafs); i+=sizeof(gf)) {
-        if (i) printf(",\n  ");
-        field_print(output++);
-    }
-    printf("\n};\n");
-    
-    return 0;
-}

src/GENERATED/c/curve25519/eddsa.c

@@ -1,339 +0,0 @@
-/**
- * @file curve25519/eddsa.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @cond internal
- * @brief EdDSA routines.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include "word.h"
-#include <decaf/ed255.h>
-#include <decaf/shake.h>
-#include <decaf/sha512.h>
-#include <string.h>
-
-#define API_NAME "decaf_255"
-#define API_NS(_id) decaf_255_##_id
-
-#define hash_ctx_t   decaf_sha512_ctx_t
-#define hash_init    decaf_sha512_init
-#define hash_update  decaf_sha512_update
-#define hash_final   decaf_sha512_final
-#define hash_destroy decaf_sha512_destroy
-#define hash_hash    decaf_sha512_hash
-
-#define SUPPORTS_CONTEXTS DECAF_EDDSA_25519_SUPPORTS_CONTEXTS
-#define EDDSA_USE_SIGMA_ISOGENY 1
-#define COFACTOR 8
-
-/* EDDSA_BASE_POINT_RATIO = 1 or 2
- * Because EdDSA25519 is not on E_d but on the isogenous E_sigma_d,
- * its base point is twice ours.
- */
-#define EDDSA_BASE_POINT_RATIO (1+EDDSA_USE_SIGMA_ISOGENY)
-
-static void clamp (
-    uint8_t secret_scalar_ser[DECAF_EDDSA_25519_PRIVATE_BYTES]
-) {
-    /* Blarg */
-    secret_scalar_ser[0] &= -COFACTOR;
-    uint8_t hibit = (1<<7)>>1;
-    if (hibit == 0) {
-        secret_scalar_ser[DECAF_EDDSA_25519_PRIVATE_BYTES - 1] = 0;
-        secret_scalar_ser[DECAF_EDDSA_25519_PRIVATE_BYTES - 2] |= 0x80;
-    } else {
-        secret_scalar_ser[DECAF_EDDSA_25519_PRIVATE_BYTES - 1] &= hibit-1;
-        secret_scalar_ser[DECAF_EDDSA_25519_PRIVATE_BYTES - 1] |= hibit;
-    }
-}
-
-static void hash_init_with_dom(
-    hash_ctx_t hash,
-    uint8_t prehashed,
-    uint8_t for_prehash,
-    const uint8_t *context,
-    uint8_t context_len
-) {
-    hash_init(hash);
-    
-#if SUPPORTS_CONTEXTS
-    const char *dom_s = "";
-    const uint8_t dom[2] = {2+word_is_zero(prehashed)+word_is_zero(for_prehash), context_len};
-    hash_update(hash,(const unsigned char *)dom_s, strlen(dom_s));
-    hash_update(hash,dom,2);
-    hash_update(hash,context,context_len);
-#else
-    (void)prehashed;
-    (void)for_prehash;
-    (void)context;
-    assert(context==NULL);
-    (void)context_len;
-    assert(context_len == 0);
-#endif
-}
-
-void decaf_ed25519_prehash_init (
-    hash_ctx_t hash
-#if DECAF_EDDSA_25519_SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-#if DECAF_EDDSA_25519_SUPPORTS_CONTEXTS
-    hash_init_with_dom(hash,1,1,context,context_len);
-#else
-    hash_init_with_dom(hash,1,1,NULL,0);
-#endif
-}
-
-void decaf_ed25519_derive_public_key (
-    uint8_t pubkey[DECAF_EDDSA_25519_PUBLIC_BYTES],
-    const uint8_t privkey[DECAF_EDDSA_25519_PRIVATE_BYTES]
-) {
-    /* only this much used for keygen */
-    uint8_t secret_scalar_ser[DECAF_EDDSA_25519_PRIVATE_BYTES];
-    
-    hash_hash(
-        secret_scalar_ser,
-        sizeof(secret_scalar_ser),
-        privkey,
-        DECAF_EDDSA_25519_PRIVATE_BYTES
-    );
-    clamp(secret_scalar_ser);
-        
-    API_NS(scalar_t) secret_scalar;
-    API_NS(scalar_decode_long)(secret_scalar, secret_scalar_ser, sizeof(secret_scalar_ser));
-    
-    /* Since we are going to mul_by_cofactor during encoding, divide by it here.
-     * However, the EdDSA base point is not the same as the decaf base point if
-     * the sigma isogeny is in use: the EdDSA base point is on Etwist_d/(1-d) and
-     * the decaf base point is on Etwist_d, and when converted it effectively
-     * picks up a factor of 2 from the isogenies.  So we might start at 2 instead of 1. 
-     */
-    for (unsigned int c = EDDSA_BASE_POINT_RATIO; c < COFACTOR; c <<= 1) {
-        API_NS(scalar_halve)(secret_scalar,secret_scalar);
-    }
-    
-    API_NS(point_t) p;
-    API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),secret_scalar);
-    
-    API_NS(point_mul_by_cofactor_and_encode_like_eddsa)(pubkey, p);
-        
-    /* Cleanup */
-    API_NS(scalar_destroy)(secret_scalar);
-    API_NS(point_destroy)(p);
-    decaf_bzero(secret_scalar_ser, sizeof(secret_scalar_ser));
-}
-
-void decaf_ed25519_sign (
-    uint8_t signature[DECAF_EDDSA_25519_SIGNATURE_BYTES],
-    const uint8_t privkey[DECAF_EDDSA_25519_PRIVATE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_25519_PUBLIC_BYTES],
-    const uint8_t *message,
-    size_t message_len,
-    uint8_t prehashed
-#if SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-#if !SUPPORTS_CONTEXTS
-    const uint8_t *const context = NULL;
-    const uint8_t context_len = 0;
-#endif
-    API_NS(scalar_t) secret_scalar;
-    hash_ctx_t hash;
-    {
-        /* Schedule the secret key */
-        struct {
-            uint8_t secret_scalar_ser[DECAF_EDDSA_25519_PRIVATE_BYTES];
-            uint8_t seed[DECAF_EDDSA_25519_PRIVATE_BYTES];
-        } __attribute__((packed)) expanded;
-        hash_hash(
-            (uint8_t *)&expanded,
-            sizeof(expanded),
-            privkey,
-            DECAF_EDDSA_25519_PRIVATE_BYTES
-        );
-        clamp(expanded.secret_scalar_ser);   
-        API_NS(scalar_decode_long)(secret_scalar, expanded.secret_scalar_ser, sizeof(expanded.secret_scalar_ser));
-    
-        /* Hash to create the nonce */
-        hash_init_with_dom(hash,prehashed,0,context,context_len);
-        hash_update(hash,expanded.seed,sizeof(expanded.seed));
-        hash_update(hash,message,message_len);
-        decaf_bzero(&expanded, sizeof(expanded));
-    }
-    
-    /* Decode the nonce */
-    API_NS(scalar_t) nonce_scalar;
-    {
-        uint8_t nonce[2*DECAF_EDDSA_25519_PRIVATE_BYTES];
-        hash_final(hash,nonce,sizeof(nonce));
-        API_NS(scalar_decode_long)(nonce_scalar, nonce, sizeof(nonce));
-        decaf_bzero(nonce, sizeof(nonce));
-    }
-    
-    uint8_t nonce_point[DECAF_EDDSA_25519_PUBLIC_BYTES] = {0};
-    {
-        /* Scalarmul to create the nonce-point */
-        API_NS(scalar_t) nonce_scalar_2;
-        API_NS(scalar_halve)(nonce_scalar_2,nonce_scalar);
-        for (unsigned int c = 2*EDDSA_BASE_POINT_RATIO; c < COFACTOR; c <<= 1) {
-            API_NS(scalar_halve)(nonce_scalar_2,nonce_scalar_2);
-        }
-        
-        API_NS(point_t) p;
-        API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),nonce_scalar_2);
-        API_NS(point_mul_by_cofactor_and_encode_like_eddsa)(nonce_point, p);
-        API_NS(point_destroy)(p);
-        API_NS(scalar_destroy)(nonce_scalar_2);
-    }
-    
-    API_NS(scalar_t) challenge_scalar;
-    {
-        /* Compute the challenge */
-        hash_init_with_dom(hash,prehashed,0,context,context_len);
-        hash_update(hash,nonce_point,sizeof(nonce_point));
-        hash_update(hash,pubkey,DECAF_EDDSA_25519_PUBLIC_BYTES);
-        hash_update(hash,message,message_len);
-        uint8_t challenge[2*DECAF_EDDSA_25519_PRIVATE_BYTES];
-        hash_final(hash,challenge,sizeof(challenge));
-        hash_destroy(hash);
-        API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));
-        decaf_bzero(challenge,sizeof(challenge));
-    }
-    
-    API_NS(scalar_mul)(challenge_scalar,challenge_scalar,secret_scalar);
-    API_NS(scalar_add)(challenge_scalar,challenge_scalar,nonce_scalar);
-    
-    decaf_bzero(signature,DECAF_EDDSA_25519_SIGNATURE_BYTES);
-    memcpy(signature,nonce_point,sizeof(nonce_point));
-    API_NS(scalar_encode)(&signature[DECAF_EDDSA_25519_PUBLIC_BYTES],challenge_scalar);
-    
-    API_NS(scalar_destroy)(secret_scalar);
-    API_NS(scalar_destroy)(nonce_scalar);
-    API_NS(scalar_destroy)(challenge_scalar);
-}
-
-
-void decaf_ed25519_sign_prehash (
-    uint8_t signature[DECAF_EDDSA_25519_SIGNATURE_BYTES],
-    const uint8_t privkey[DECAF_EDDSA_25519_PRIVATE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_25519_PUBLIC_BYTES],
-    const decaf_ed25519_prehash_ctx_t hash
-#if DECAF_EDDSA_25519_SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-    uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */
-    {
-        decaf_ed25519_prehash_ctx_t hash_too;
-        memcpy(hash_too,hash,sizeof(hash_too));
-        hash_final(hash_too,hash_output,sizeof(hash_output));
-        hash_destroy(hash_too);
-    }
-    
-#if DECAF_EDDSA_25519_SUPPORTS_CONTEXTS
-    decaf_ed25519_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
-#else
-    decaf_ed25519_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1);
-#endif
-    
-    decaf_bzero(hash_output,sizeof(hash_output));
-}
-
-decaf_error_t decaf_ed25519_verify (
-    const uint8_t signature[DECAF_EDDSA_25519_SIGNATURE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_25519_PUBLIC_BYTES],
-    const uint8_t *message,
-    size_t message_len,
-    uint8_t prehashed
-#if SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) { 
-#if !SUPPORTS_CONTEXTS
-    const uint8_t *const context = NULL;
-    const uint8_t context_len = 0;
-#endif
-    API_NS(point_t) pk_point, r_point;
-    decaf_error_t error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(pk_point,pubkey);
-    if (DECAF_SUCCESS != error) { return error; }
-    
-    error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(r_point,signature);
-    if (DECAF_SUCCESS != error) { return error; }
-    
-    API_NS(scalar_t) challenge_scalar;
-    {
-        /* Compute the challenge */
-        hash_ctx_t hash;
-        hash_init_with_dom(hash,prehashed,0,context,context_len);
-        hash_update(hash,signature,DECAF_EDDSA_25519_PUBLIC_BYTES);
-        hash_update(hash,pubkey,DECAF_EDDSA_25519_PUBLIC_BYTES);
-        hash_update(hash,message,message_len);
-        uint8_t challenge[2*DECAF_EDDSA_25519_PRIVATE_BYTES];
-        hash_final(hash,challenge,sizeof(challenge));
-        hash_destroy(hash);
-        API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));
-        decaf_bzero(challenge,sizeof(challenge));
-    }
-    API_NS(scalar_sub)(challenge_scalar, API_NS(scalar_zero), challenge_scalar);
-    
-    API_NS(scalar_t) response_scalar;
-    API_NS(scalar_decode_long)(
-        response_scalar,
-        &signature[DECAF_EDDSA_25519_PUBLIC_BYTES],
-        DECAF_EDDSA_25519_PRIVATE_BYTES
-    );
-#if EDDSA_BASE_POINT_RATIO == 2
-    API_NS(scalar_add)(response_scalar,response_scalar,response_scalar);
-#endif
-    
-    
-    /* pk_point = -c(x(P)) + (cx + k)G = kG */
-    API_NS(base_double_scalarmul_non_secret)(
-        pk_point,
-        response_scalar,
-        pk_point,
-        challenge_scalar
-    );
-    return decaf_succeed_if(API_NS(point_eq(pk_point,r_point)));
-}
-
-
-decaf_error_t decaf_ed25519_verify_prehash (
-    const uint8_t signature[DECAF_EDDSA_25519_SIGNATURE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_25519_PUBLIC_BYTES],
-    const decaf_ed25519_prehash_ctx_t hash
-#if DECAF_EDDSA_25519_SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-    decaf_error_t ret;
-    
-    uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */
-    {
-        decaf_ed25519_prehash_ctx_t hash_too;
-        memcpy(hash_too,hash,sizeof(hash_too));
-        hash_final(hash_too,hash_output,sizeof(hash_output));
-        hash_destroy(hash_too);
-    }
-    
-#if DECAF_EDDSA_25519_SUPPORTS_CONTEXTS
-    ret = decaf_ed25519_verify(signature,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
-#else
-    ret = decaf_ed25519_verify(signature,pubkey,hash_output,sizeof(hash_output),1);
-#endif
-    
-    return ret;
-}

src/GENERATED/c/curve25519/scalar.c

@@ -1,339 +0,0 @@
-/**
- * @file curve25519/scalar.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @brief Decaf high-level functions.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include "word.h"
-#include "constant_time.h"
-#include <decaf.h>
-
-/* Template stuff */
-#define API_NS(_id) decaf_255_##_id
-#define SCALAR_BITS DECAF_255_SCALAR_BITS
-#define SCALAR_SER_BYTES DECAF_255_SCALAR_BYTES
-#define SCALAR_LIMBS DECAF_255_SCALAR_LIMBS
-#define scalar_t API_NS(scalar_t)
-
-static const decaf_word_t MONTGOMERY_FACTOR = (decaf_word_t)0xd2b51da312547e1bull;
-static const scalar_t sc_p = {{{
-    SC_LIMB(0x5812631a5cf5d3ed), SC_LIMB(0x14def9dea2f79cd6), SC_LIMB(0x0000000000000000), SC_LIMB(0x1000000000000000)
-}}}, sc_r2 = {{{
-    SC_LIMB(0xa40611e3449c0f01), SC_LIMB(0xd00e1ba768859347), SC_LIMB(0xceec73d217f5be65), SC_LIMB(0x0399411b7c309a3d)
-}}};
-/* End of template stuff */
-
-#define WBITS DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */
-
-const scalar_t API_NS(scalar_one) = {{{1}}}, API_NS(scalar_zero) = {{{0}}};
-
-/** {extra,accum} - sub +? p
- * Must have extra <= 1
- */
-static NOINLINE void sc_subx(
-    scalar_t out,
-    const decaf_word_t accum[SCALAR_LIMBS],
-    const scalar_t sub,
-    const scalar_t p,
-    decaf_word_t extra
-) {
-    decaf_dsword_t chain = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + accum[i]) - sub->limb[i];
-        out->limb[i] = chain;
-        chain >>= WBITS;
-    }
-    decaf_word_t borrow = chain+extra; /* = 0 or -1 */
-    
-    chain = 0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + out->limb[i]) + (p->limb[i] & borrow);
-        out->limb[i] = chain;
-        chain >>= WBITS;
-    }
-}
-
-static NOINLINE void sc_montmul (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    unsigned int i,j;
-    decaf_word_t accum[SCALAR_LIMBS+1] = {0};
-    decaf_word_t hi_carry = 0;
-    
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        decaf_word_t mand = a->limb[i];
-        const decaf_word_t *mier = b->limb;
-        
-        decaf_dword_t chain = 0;
-        for (j=0; j<SCALAR_LIMBS; j++) {
-            chain += ((decaf_dword_t)mand)*mier[j] + accum[j];
-            accum[j] = chain;
-            chain >>= WBITS;
-        }
-        accum[j] = chain;
-        
-        mand = accum[0] * MONTGOMERY_FACTOR;
-        chain = 0;
-        mier = sc_p->limb;
-        for (j=0; j<SCALAR_LIMBS; j++) {
-            chain += (decaf_dword_t)mand*mier[j] + accum[j];
-            if (j) accum[j-1] = chain;
-            chain >>= WBITS;
-        }
-        chain += accum[j];
-        chain += hi_carry;
-        accum[j-1] = chain;
-        hi_carry = chain >> WBITS;
-    }
-    
-    sc_subx(out, accum, sc_p, sc_p, hi_carry);
-}
-
-void API_NS(scalar_mul) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    sc_montmul(out,a,b);
-    sc_montmul(out,out,sc_r2);
-}
-
-/* PERF: could implement this */
-static INLINE void sc_montsqr (scalar_t out, const scalar_t a) {
-    sc_montmul(out,a,a);
-}
-
-decaf_error_t API_NS(scalar_invert) (
-    scalar_t out,
-    const scalar_t a
-) {
-    /* Fermat's little theorem, sliding window.
-     * Sliding window is fine here because the modulus isn't secret.
-     */
-    const int SCALAR_WINDOW_BITS = 3;
-    scalar_t precmp[1<<SCALAR_WINDOW_BITS];
-    const int LAST = (1<<SCALAR_WINDOW_BITS)-1;
-
-    /* Precompute precmp = [a^1,a^3,...] */
-    sc_montmul(precmp[0],a,sc_r2);
-    if (LAST > 0) sc_montmul(precmp[LAST],precmp[0],precmp[0]);
-
-    int i;
-    for (i=1; i<=LAST; i++) {
-        sc_montmul(precmp[i],precmp[i-1],precmp[LAST]);
-    }
-    
-    /* Sliding window */
-    unsigned residue = 0, trailing = 0, started = 0;
-    for (i=SCALAR_BITS-1; i>=-SCALAR_WINDOW_BITS; i--) {
-        
-        if (started) sc_montsqr(out,out);
-        
-        decaf_word_t w = (i>=0) ? sc_p->limb[i/WBITS] : 0;
-        if (i >= 0 && i<WBITS) {
-            assert(w >= 2);
-            w-=2;
-        }
-        
-        residue = (residue<<1) | ((w>>(i%WBITS))&1);
-        if (residue>>SCALAR_WINDOW_BITS != 0) {
-            assert(trailing == 0);
-            trailing = residue;
-            residue = 0;
-        }
-        
-        if (trailing > 0 && (trailing & ((1<<SCALAR_WINDOW_BITS)-1)) == 0) {
-            if (started) {
-                sc_montmul(out,out,precmp[trailing>>(SCALAR_WINDOW_BITS+1)]);
-            } else {
-                API_NS(scalar_copy)(out,precmp[trailing>>(SCALAR_WINDOW_BITS+1)]);
-                started = 1;
-            }
-            trailing = 0;
-        }
-        trailing <<= 1;
-        
-    }
-    assert(residue==0);
-    assert(trailing==0);
-    
-    /* Demontgomerize */
-    sc_montmul(out,out,API_NS(scalar_one));
-    decaf_bzero(precmp, sizeof(precmp));
-    return decaf_succeed_if(~API_NS(scalar_eq)(out,API_NS(scalar_zero)));
-}
-
-void API_NS(scalar_sub) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    sc_subx(out, a->limb, b, sc_p, 0);
-}
-
-void API_NS(scalar_add) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    decaf_dword_t chain = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + a->limb[i]) + b->limb[i];
-        out->limb[i] = chain;
-        chain >>= WBITS;
-    }
-    sc_subx(out, out->limb, sc_p, sc_p, chain);
-}
-
-void
-API_NS(scalar_set_unsigned) (
-    scalar_t out,
-    uint64_t w
-) {
-    memset(out,0,sizeof(scalar_t));
-    unsigned int i = 0;
-    for (; i<sizeof(uint64_t)/sizeof(decaf_word_t); i++) {
-        out->limb[i] = w;
-        w >>= (sizeof(uint64_t) > sizeof(decaf_word_t)) ? 8*sizeof(decaf_word_t) : 0;
-    }
-}
-
-decaf_bool_t
-API_NS(scalar_eq) (
-    const scalar_t a,
-    const scalar_t b
-) {
-    decaf_word_t diff = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        diff |= a->limb[i] ^ b->limb[i];
-    }
-    return mask_to_bool(word_is_zero(diff));
-}
-
-static INLINE void scalar_decode_short (
-    scalar_t s,
-    const unsigned char *ser,
-    unsigned int nbytes
-) {
-    unsigned int i,j,k=0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        decaf_word_t out = 0;
-        for (j=0; j<sizeof(decaf_word_t) && k<nbytes; j++,k++) {
-            out |= ((decaf_word_t)ser[k])<<(8*j);
-        }
-        s->limb[i] = out;
-    }
-}
-
-decaf_error_t API_NS(scalar_decode)(
-    scalar_t s,
-    const unsigned char ser[SCALAR_SER_BYTES]
-) {
-    unsigned int i;
-    scalar_decode_short(s, ser, SCALAR_SER_BYTES);
-    decaf_dsword_t accum = 0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        accum = (accum + s->limb[i] - sc_p->limb[i]) >> WBITS;
-    }
-    /* Here accum == 0 or -1 */
-    
-    API_NS(scalar_mul)(s,s,API_NS(scalar_one)); /* ham-handed reduce */
-    
-    return decaf_succeed_if(~word_is_zero(accum));
-}
-
-void API_NS(scalar_destroy) (
-    scalar_t scalar
-) {
-    decaf_bzero(scalar, sizeof(scalar_t));
-}
-
-void API_NS(scalar_decode_long)(
-    scalar_t s,
-    const unsigned char *ser,
-    size_t ser_len
-) {
-    if (ser_len == 0) {
-        API_NS(scalar_copy)(s, API_NS(scalar_zero));
-        return;
-    }
-    
-    size_t i;
-    scalar_t t1, t2;
-
-    i = ser_len - (ser_len%SCALAR_SER_BYTES);
-    if (i==ser_len) i -= SCALAR_SER_BYTES;
-    
-    scalar_decode_short(t1, &ser[i], ser_len-i);
-
-    if (ser_len == sizeof(scalar_t)) {
-        assert(i==0);
-        /* ham-handed reduce */
-        API_NS(scalar_mul)(s,t1,API_NS(scalar_one));
-        API_NS(scalar_destroy)(t1);
-        return;
-    }
-
-    while (i) {
-        i -= SCALAR_SER_BYTES;
-        sc_montmul(t1,t1,sc_r2);
-        ignore_result( API_NS(scalar_decode)(t2, ser+i) );
-        API_NS(scalar_add)(t1, t1, t2);
-    }
-
-    API_NS(scalar_copy)(s, t1);
-    API_NS(scalar_destroy)(t1);
-    API_NS(scalar_destroy)(t2);
-}
-
-void API_NS(scalar_encode)(
-    unsigned char ser[SCALAR_SER_BYTES],
-    const scalar_t s
-) {
-    unsigned int i,j,k=0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        for (j=0; j<sizeof(decaf_word_t); j++,k++) {
-            ser[k] = s->limb[i] >> (8*j);
-        }
-    }
-}
-
-void API_NS(scalar_cond_sel) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b,
-    decaf_bool_t pick_b
-) {
-    constant_time_select(out,a,b,sizeof(scalar_t),bool_to_mask(pick_b),sizeof(out->limb[0]));
-}
-
-void API_NS(scalar_halve) (
-    scalar_t out,
-    const scalar_t a
-) {
-    decaf_word_t mask = -(a->limb[0] & 1);
-    decaf_dword_t chain = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
-        out->limb[i] = chain;
-        chain >>= DECAF_WORD_BITS;
-    }
-    for (i=0; i<SCALAR_LIMBS-1; i++) {
-        out->limb[i] = out->limb[i]>>1 | out->limb[i+1]<<(WBITS-1);
-    }
-    out->limb[i] = out->limb[i]>>1 | chain<<(WBITS-1);
-}
-

src/GENERATED/c/decaf/crypto_255.h

@@ -19,7 +19,7 @@
 #ifndef __SRC_GENERATED_C_DECAF_CRYPTO_255_H__
 #define __SRC_GENERATED_C_DECAF_CRYPTO_255_H__ 1
 
-#include <decaf/decaf_255.h>
+#include <decaf/point_255.h>
 #include <decaf/strobe.h>
 
 #ifdef __cplusplus

src/GENERATED/c/decaf/crypto_255.hxx

@@ -22,7 +22,7 @@
  * @warning Experimental!  The names, parameter orders etc are likely to change.
  */
 
-#include <decaf/decaf_255.hxx>
+#include <decaf/point_255.hxx>
 #include <decaf/shake.hxx>
 #include <decaf/strobe.hxx>
 

src/GENERATED/c/decaf/crypto_448.h

@@ -19,7 +19,7 @@
 #ifndef __SRC_GENERATED_C_DECAF_CRYPTO_448_H__
 #define __SRC_GENERATED_C_DECAF_CRYPTO_448_H__ 1
 
-#include <decaf/decaf_448.h>
+#include <decaf/point_448.h>
 #include <decaf/strobe.h>
 
 #ifdef __cplusplus

src/GENERATED/c/decaf/crypto_448.hxx

@@ -22,7 +22,7 @@
  * @warning Experimental!  The names, parameter orders etc are likely to change.
  */
 
-#include <decaf/decaf_448.hxx>
+#include <decaf/point_448.hxx>
 #include <decaf/shake.hxx>
 #include <decaf/strobe.hxx>
 

src/GENERATED/c/ed448goldilocks/crypto.c

@@ -1,231 +0,0 @@
-/**
- * @file ed448goldilocks/crypto.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @cond internal
- * @brief Example Decaf crypto routines
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include <decaf/crypto.h>
-#include <string.h>
-
-#define API_NAME "decaf_448"
-#define API_NS(_id) decaf_448_##_id
-#define API_NS_TOY(_id) decaf_448_TOY_##_id
-#define SCALAR_BITS DECAF_448_SCALAR_BITS
-#define SCALAR_BYTES ((SCALAR_BITS + 7)/8)
-#define SER_BYTES DECAF_448_SER_BYTES
-
- /* TODO: canonicalize and freeze the STROBE constants in this file
-  * (and STROBE itself for that matter)
-  */
-static const char *DERIVE_MAGIC = API_NAME"::derive_private_key";
-static const char *SIGN_MAGIC = API_NAME"::sign";
-static const char *SHARED_SECRET_MAGIC = API_NAME"::shared_secret";
-static const uint16_t SHARED_SECRET_MAX_BLOCK_SIZE = 1<<12;
-static const unsigned int SCALAR_OVERKILL_BYTES = SCALAR_BYTES + 8;
-
-void API_NS_TOY(derive_private_key) (
-    API_NS_TOY(private_key_t) priv,
-    const API_NS_TOY(symmetric_key_t) proto
-) {
-    uint8_t encoded_scalar[SCALAR_OVERKILL_BYTES];
-    API_NS(point_t) pub;
-    
-    keccak_decaf_TOY_strobe_t strobe;
-    decaf_TOY_strobe_init(strobe, &STROBE_256, DERIVE_MAGIC, 0);
-    decaf_TOY_strobe_fixed_key(strobe, proto, sizeof(API_NS_TOY(symmetric_key_t)));
-    decaf_TOY_strobe_prng(strobe, encoded_scalar, sizeof(encoded_scalar));
-    decaf_TOY_strobe_destroy(strobe);
-    
-    memcpy(priv->sym, proto, sizeof(API_NS_TOY(symmetric_key_t)));
-    API_NS(scalar_decode_long)(priv->secret_scalar, encoded_scalar, sizeof(encoded_scalar));
-    
-    API_NS(precomputed_scalarmul)(pub, API_NS(precomputed_base), priv->secret_scalar);
-    API_NS(point_encode)(priv->pub, pub);
-    
-    decaf_bzero(encoded_scalar, sizeof(encoded_scalar));
-}
-
-void API_NS_TOY(destroy_private_key) (
-    API_NS_TOY(private_key_t) priv
-)  {
-    decaf_bzero((void*)priv, sizeof(API_NS_TOY(private_key_t)));
-}
-
-void API_NS_TOY(private_to_public) (
-    API_NS_TOY(public_key_t) pub,
-    const API_NS_TOY(private_key_t) priv
-) {
-    memcpy(pub, priv->pub, sizeof(API_NS_TOY(public_key_t)));
-}
-
-/* Performance vs consttime tuning.
- * Specifying true here might give better DOS resistance in certain corner
- * cases.  Specifying false gives a tighter result in test_ct.
- */
-#ifndef DECAF_CRYPTO_SHARED_SECRET_SHORT_CIRUIT
-#define DECAF_CRYPTO_SHARED_SECRET_SHORT_CIRUIT DECAF_FALSE
-#endif
-
-decaf_error_t API_NS_TOY(shared_secret) (
-    uint8_t *shared,
-    size_t shared_bytes,
-    const API_NS_TOY(private_key_t) my_privkey,
-    const API_NS_TOY(public_key_t) your_pubkey,
-    int me_first
-) {
-    keccak_decaf_TOY_strobe_t strobe;
-    decaf_TOY_strobe_init(strobe, &STROBE_256, SHARED_SECRET_MAGIC, 0);
-    
-    uint8_t ss_ser[SER_BYTES];
-    
-    if (me_first) {
-        decaf_TOY_strobe_ad(strobe,my_privkey->pub,sizeof(API_NS_TOY(public_key_t)));
-        decaf_TOY_strobe_ad(strobe,your_pubkey,sizeof(API_NS_TOY(public_key_t)));
-    } else {
-        decaf_TOY_strobe_ad(strobe,your_pubkey,sizeof(API_NS_TOY(public_key_t)));
-        decaf_TOY_strobe_ad(strobe,my_privkey->pub,sizeof(API_NS_TOY(public_key_t)));
-    }
-    decaf_error_t ret = API_NS(direct_scalarmul)(
-        ss_ser, your_pubkey, my_privkey->secret_scalar, DECAF_FALSE,
-        DECAF_CRYPTO_SHARED_SECRET_SHORT_CIRUIT
-    );
-    
-    decaf_TOY_strobe_transact(strobe,NULL,ss_ser,sizeof(ss_ser),STROBE_CW_DH_KEY);
-    
-    while (shared_bytes) {
-        uint16_t cando = (shared_bytes > SHARED_SECRET_MAX_BLOCK_SIZE)
-                       ? SHARED_SECRET_MAX_BLOCK_SIZE : shared_bytes;
-        decaf_TOY_strobe_prng(strobe,shared,cando);
-        shared_bytes -= cando;
-        shared += cando;
-    }
-
-    decaf_TOY_strobe_destroy(strobe);
-    decaf_bzero(ss_ser, sizeof(ss_ser));
-    
-    return ret;
-}
-
-void API_NS_TOY(sign_strobe) (
-    keccak_decaf_TOY_strobe_t strobe,
-    API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(private_key_t) priv
-) {
-    uint8_t overkill[SCALAR_OVERKILL_BYTES];
-    API_NS(point_t) point;
-    API_NS(scalar_t) nonce, challenge;
-    
-    /* Stir pubkey */
-    decaf_TOY_strobe_transact(strobe,NULL,priv->pub,sizeof(API_NS_TOY(public_key_t)),STROBE_CW_SIG_PK);
-    
-    /* Derive nonce */
-    keccak_decaf_TOY_strobe_t strobe2;
-    memcpy(strobe2,strobe,sizeof(strobe2));
-    decaf_TOY_strobe_fixed_key(strobe2,priv->sym,sizeof(API_NS_TOY(symmetric_key_t)));
-    decaf_TOY_strobe_prng(strobe2,overkill,sizeof(overkill));
-    decaf_TOY_strobe_destroy(strobe2);
-    
-    API_NS(scalar_decode_long)(nonce, overkill, sizeof(overkill));
-    API_NS(precomputed_scalarmul)(point, API_NS(precomputed_base), nonce);
-    API_NS(point_encode)(sig, point);
-    
-
-    /* Derive challenge */
-    decaf_TOY_strobe_transact(strobe,NULL,sig,SER_BYTES,STROBE_CW_SIG_EPH);
-    decaf_TOY_strobe_transact(strobe,overkill,NULL,sizeof(overkill),STROBE_CW_SIG_CHAL);
-    API_NS(scalar_decode_long)(challenge, overkill, sizeof(overkill));
-    
-    /* Respond */
-    API_NS(scalar_mul)(challenge, challenge, priv->secret_scalar);
-    API_NS(scalar_sub)(nonce, nonce, challenge);
-    
-    /* Save results */
-    API_NS(scalar_encode)(overkill, nonce);
-    decaf_TOY_strobe_transact(strobe,&sig[SER_BYTES],overkill,SCALAR_BYTES,STROBE_CW_SIG_RESP);
-    
-    /* Clean up */
-    API_NS(scalar_destroy)(nonce);
-    API_NS(scalar_destroy)(challenge);
-    decaf_bzero(overkill,sizeof(overkill));
-}
-
-decaf_error_t API_NS_TOY(verify_strobe) (
-    keccak_decaf_TOY_strobe_t strobe,
-    const API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(public_key_t) pub
-) {
-    decaf_bool_t ret;
-    
-    uint8_t overkill[SCALAR_OVERKILL_BYTES];
-    API_NS(point_t) point, pubpoint;
-    API_NS(scalar_t) challenge, response;
-    
-    /* Stir pubkey */
-    decaf_TOY_strobe_transact(strobe,NULL,pub,sizeof(API_NS_TOY(public_key_t)),STROBE_CW_SIG_PK);
-    
-    /* Derive nonce */
-    decaf_TOY_strobe_transact(strobe,NULL,sig,SER_BYTES,STROBE_CW_SIG_EPH);
-    ret = decaf_successful( API_NS(point_decode)(point, sig, DECAF_TRUE) );
-    
-    /* Derive challenge */
-    decaf_TOY_strobe_transact(strobe,overkill,NULL,sizeof(overkill),STROBE_CW_SIG_CHAL);
-    API_NS(scalar_decode_long)(challenge, overkill, sizeof(overkill));
-    
-    /* Decode response */
-    decaf_TOY_strobe_transact(strobe,overkill,&sig[SER_BYTES],SCALAR_BYTES,STROBE_CW_SIG_RESP);
-    ret &= decaf_successful( API_NS(scalar_decode)(response, overkill) );
-    ret &= decaf_successful( API_NS(point_decode)(pubpoint, pub, DECAF_FALSE) );
-
-    API_NS(base_double_scalarmul_non_secret) (
-        pubpoint, response, pubpoint, challenge
-    );
-
-    ret &= API_NS(point_eq)(pubpoint, point);
-    
-    /* Nothing here is secret, so don't do these things:
-        decaf_bzero(overkill,sizeof(overkill));
-        API_NS(point_destroy)(point);
-        API_NS(point_destroy)(pubpoint);
-        API_NS(scalar_destroy)(challenge);
-        API_NS(scalar_destroy)(response);
-    */
-    
-    return decaf_succeed_if(ret);
-}
-
-void
-API_NS_TOY(sign) (
-    API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(private_key_t) priv,
-    const unsigned char *message,
-    size_t message_len
-) {
-    keccak_decaf_TOY_strobe_t ctx;
-    decaf_TOY_strobe_init(ctx,&STROBE_256,SIGN_MAGIC,0);
-    decaf_TOY_strobe_transact(ctx, NULL, message, message_len, STROBE_CW_STREAMING_PLAINTEXT);
-    API_NS_TOY(sign_strobe)(ctx, sig, priv);
-    decaf_TOY_strobe_destroy(ctx);
-}
-
-decaf_error_t
-API_NS_TOY(verify) (
-    const API_NS_TOY(signature_t) sig,
-    const API_NS_TOY(public_key_t) pub,
-    const unsigned char *message,
-    size_t message_len
-) {
-    keccak_decaf_TOY_strobe_t ctx;
-    decaf_TOY_strobe_init(ctx,&STROBE_256,SIGN_MAGIC,0);
-    decaf_TOY_strobe_transact(ctx, NULL, message, message_len, STROBE_CW_STREAMING_PLAINTEXT);
-    decaf_error_t ret = API_NS_TOY(verify_strobe)(ctx, sig, pub);
-    decaf_TOY_strobe_destroy(ctx);
-    return ret;
-}

src/GENERATED/c/ed448goldilocks/decaf_gen_tables.c

@@ -1,116 +0,0 @@
-/**
- * @file ed448goldilocks/decaf_gen_tables.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @brief Decaf global constant table precomputation.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#define _XOPEN_SOURCE 600 /* for posix_memalign */
-#include <stdio.h>
-#include <stdlib.h>
-
-#include "field.h"
-#include "f_field.h"
-#include "decaf.h"
-
-#define API_NS(_id) decaf_448_##_id
-static const unsigned char base_point_ser_for_pregen[SER_BYTES] = {
-    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01
-};
-
- /* To satisfy linker. */
-const gf API_NS(precomputed_base_as_fe)[1];
-const API_NS(point_t) API_NS(point_base);
-
-struct niels_s;
-const gf_s *API_NS(precomputed_wnaf_as_fe);
-extern const size_t API_NS(sizeof_precomputed_wnafs);
-
-void API_NS(precompute_wnafs) (
-    struct niels_s *out,
-    const API_NS(point_t) base
-);
-static void field_print(const gf f) {
-    unsigned char ser[X_SER_BYTES];
-    gf_serialize(ser,f,1);
-    int b=0, i, comma=0;
-    unsigned long long limb = 0;
-    printf("{FIELD_LITERAL(");
-    for (i=0; i<X_SER_BYTES; i++) {
-        limb |= ((uint64_t)ser[i])<<b;
-        b += 8;
-        if (b >= GF_LIT_LIMB_BITS || i == SER_BYTES-1) {
-            limb &= (1ull<<GF_LIT_LIMB_BITS) -1;
-            b -= GF_LIT_LIMB_BITS;
-            if (comma) printf(",");
-            comma = 1;
-            printf("0x%016llx", limb);
-            limb = ((uint64_t)ser[i])>>(8-b);
-        }
-    }
-    printf(")}");
-    assert(b<8);
-}
-
-int main(int argc, char **argv) {
-    (void)argc; (void)argv;
-    
-    API_NS(point_t) real_point_base;
-    int ret = API_NS(point_decode)(real_point_base,base_point_ser_for_pregen,0);
-    if (ret != DECAF_SUCCESS) return 1;
-    
-    API_NS(precomputed_s) *pre;
-    ret = posix_memalign((void**)&pre, API_NS(alignof_precomputed_s), API_NS(sizeof_precomputed_s));
-    if (ret || !pre) return 1;
-    API_NS(precompute)(pre, real_point_base);
-    
-    struct niels_s *pre_wnaf;
-    ret = posix_memalign((void**)&pre_wnaf, API_NS(alignof_precomputed_s), API_NS(sizeof_precomputed_wnafs));
-    if (ret || !pre_wnaf) return 1;
-    API_NS(precompute_wnafs)(pre_wnaf, real_point_base);
-
-    const gf_s *output;
-    unsigned i;
-    
-    printf("/** @warning: this file was automatically generated. */\n");
-    printf("#include \"field.h\"\n\n");
-    printf("#include <decaf.h>\n\n");
-    printf("#define API_NS(_id) decaf_448_##_id\n");
-    
-    output = (const gf_s *)real_point_base;
-    printf("const API_NS(point_t) API_NS(point_base) = {{\n");
-    for (i=0; i < sizeof(API_NS(point_t)); i+=sizeof(gf)) {
-        if (i) printf(",\n  ");
-        field_print(output++);
-    }
-    printf("\n}};\n");
-    
-    output = (const gf_s *)pre;
-    printf("const gf API_NS(precomputed_base_as_fe)[%d]\n", 
-        (int)(API_NS(sizeof_precomputed_s) / sizeof(gf)));
-    printf("__attribute__((aligned(%d),visibility(\"hidden\"))) = {\n  ", (int)API_NS(alignof_precomputed_s));
-    
-    for (i=0; i < API_NS(sizeof_precomputed_s); i+=sizeof(gf)) {
-        if (i) printf(",\n  ");
-        field_print(output++);
-    }
-    printf("\n};\n");
-    
-    output = (const gf_s *)pre_wnaf;
-    printf("const gf API_NS(precomputed_wnaf_as_fe)[%d]\n", 
-        (int)(API_NS(sizeof_precomputed_wnafs) / sizeof(gf)));
-    printf("__attribute__((aligned(%d),visibility(\"hidden\"))) = {\n  ", (int)API_NS(alignof_precomputed_s));
-    for (i=0; i < API_NS(sizeof_precomputed_wnafs); i+=sizeof(gf)) {
-        if (i) printf(",\n  ");
-        field_print(output++);
-    }
-    printf("\n};\n");
-    
-    return 0;
-}

src/GENERATED/c/ed448goldilocks/eddsa.c

@@ -1,339 +0,0 @@
-/**
- * @file ed448goldilocks/eddsa.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @cond internal
- * @brief EdDSA routines.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include "word.h"
-#include <decaf/ed448.h>
-#include <decaf/shake.h>
-#include <decaf/sha512.h>
-#include <string.h>
-
-#define API_NAME "decaf_448"
-#define API_NS(_id) decaf_448_##_id
-
-#define hash_ctx_t   decaf_shake256_ctx_t
-#define hash_init    decaf_shake256_init
-#define hash_update  decaf_shake256_update
-#define hash_final   decaf_shake256_final
-#define hash_destroy decaf_shake256_destroy
-#define hash_hash    decaf_shake256_hash
-
-#define SUPPORTS_CONTEXTS DECAF_EDDSA_448_SUPPORTS_CONTEXTS
-#define EDDSA_USE_SIGMA_ISOGENY 0
-#define COFACTOR 4
-
-/* EDDSA_BASE_POINT_RATIO = 1 or 2
- * Because EdDSA25519 is not on E_d but on the isogenous E_sigma_d,
- * its base point is twice ours.
- */
-#define EDDSA_BASE_POINT_RATIO (1+EDDSA_USE_SIGMA_ISOGENY)
-
-static void clamp (
-    uint8_t secret_scalar_ser[DECAF_EDDSA_448_PRIVATE_BYTES]
-) {
-    /* Blarg */
-    secret_scalar_ser[0] &= -COFACTOR;
-    uint8_t hibit = (1<<0)>>1;
-    if (hibit == 0) {
-        secret_scalar_ser[DECAF_EDDSA_448_PRIVATE_BYTES - 1] = 0;
-        secret_scalar_ser[DECAF_EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;
-    } else {
-        secret_scalar_ser[DECAF_EDDSA_448_PRIVATE_BYTES - 1] &= hibit-1;
-        secret_scalar_ser[DECAF_EDDSA_448_PRIVATE_BYTES - 1] |= hibit;
-    }
-}
-
-static void hash_init_with_dom(
-    hash_ctx_t hash,
-    uint8_t prehashed,
-    uint8_t for_prehash,
-    const uint8_t *context,
-    uint8_t context_len
-) {
-    hash_init(hash);
-    
-#if SUPPORTS_CONTEXTS
-    const char *dom_s = "SigEd448";
-    const uint8_t dom[2] = {2+word_is_zero(prehashed)+word_is_zero(for_prehash), context_len};
-    hash_update(hash,(const unsigned char *)dom_s, strlen(dom_s));
-    hash_update(hash,dom,2);
-    hash_update(hash,context,context_len);
-#else
-    (void)prehashed;
-    (void)for_prehash;
-    (void)context;
-    assert(context==NULL);
-    (void)context_len;
-    assert(context_len == 0);
-#endif
-}
-
-void decaf_ed448_prehash_init (
-    hash_ctx_t hash
-#if DECAF_EDDSA_448_SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-#if DECAF_EDDSA_448_SUPPORTS_CONTEXTS
-    hash_init_with_dom(hash,1,1,context,context_len);
-#else
-    hash_init_with_dom(hash,1,1,NULL,0);
-#endif
-}
-
-void decaf_ed448_derive_public_key (
-    uint8_t pubkey[DECAF_EDDSA_448_PUBLIC_BYTES],
-    const uint8_t privkey[DECAF_EDDSA_448_PRIVATE_BYTES]
-) {
-    /* only this much used for keygen */
-    uint8_t secret_scalar_ser[DECAF_EDDSA_448_PRIVATE_BYTES];
-    
-    hash_hash(
-        secret_scalar_ser,
-        sizeof(secret_scalar_ser),
-        privkey,
-        DECAF_EDDSA_448_PRIVATE_BYTES
-    );
-    clamp(secret_scalar_ser);
-        
-    API_NS(scalar_t) secret_scalar;
-    API_NS(scalar_decode_long)(secret_scalar, secret_scalar_ser, sizeof(secret_scalar_ser));
-    
-    /* Since we are going to mul_by_cofactor during encoding, divide by it here.
-     * However, the EdDSA base point is not the same as the decaf base point if
-     * the sigma isogeny is in use: the EdDSA base point is on Etwist_d/(1-d) and
-     * the decaf base point is on Etwist_d, and when converted it effectively
-     * picks up a factor of 2 from the isogenies.  So we might start at 2 instead of 1. 
-     */
-    for (unsigned int c = EDDSA_BASE_POINT_RATIO; c < COFACTOR; c <<= 1) {
-        API_NS(scalar_halve)(secret_scalar,secret_scalar);
-    }
-    
-    API_NS(point_t) p;
-    API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),secret_scalar);
-    
-    API_NS(point_mul_by_cofactor_and_encode_like_eddsa)(pubkey, p);
-        
-    /* Cleanup */
-    API_NS(scalar_destroy)(secret_scalar);
-    API_NS(point_destroy)(p);
-    decaf_bzero(secret_scalar_ser, sizeof(secret_scalar_ser));
-}
-
-void decaf_ed448_sign (
-    uint8_t signature[DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t privkey[DECAF_EDDSA_448_PRIVATE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_448_PUBLIC_BYTES],
-    const uint8_t *message,
-    size_t message_len,
-    uint8_t prehashed
-#if SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-#if !SUPPORTS_CONTEXTS
-    const uint8_t *const context = NULL;
-    const uint8_t context_len = 0;
-#endif
-    API_NS(scalar_t) secret_scalar;
-    hash_ctx_t hash;
-    {
-        /* Schedule the secret key */
-        struct {
-            uint8_t secret_scalar_ser[DECAF_EDDSA_448_PRIVATE_BYTES];
-            uint8_t seed[DECAF_EDDSA_448_PRIVATE_BYTES];
-        } __attribute__((packed)) expanded;
-        hash_hash(
-            (uint8_t *)&expanded,
-            sizeof(expanded),
-            privkey,
-            DECAF_EDDSA_448_PRIVATE_BYTES
-        );
-        clamp(expanded.secret_scalar_ser);   
-        API_NS(scalar_decode_long)(secret_scalar, expanded.secret_scalar_ser, sizeof(expanded.secret_scalar_ser));
-    
-        /* Hash to create the nonce */
-        hash_init_with_dom(hash,prehashed,0,context,context_len);
-        hash_update(hash,expanded.seed,sizeof(expanded.seed));
-        hash_update(hash,message,message_len);
-        decaf_bzero(&expanded, sizeof(expanded));
-    }
-    
-    /* Decode the nonce */
-    API_NS(scalar_t) nonce_scalar;
-    {
-        uint8_t nonce[2*DECAF_EDDSA_448_PRIVATE_BYTES];
-        hash_final(hash,nonce,sizeof(nonce));
-        API_NS(scalar_decode_long)(nonce_scalar, nonce, sizeof(nonce));
-        decaf_bzero(nonce, sizeof(nonce));
-    }
-    
-    uint8_t nonce_point[DECAF_EDDSA_448_PUBLIC_BYTES] = {0};
-    {
-        /* Scalarmul to create the nonce-point */
-        API_NS(scalar_t) nonce_scalar_2;
-        API_NS(scalar_halve)(nonce_scalar_2,nonce_scalar);
-        for (unsigned int c = 2*EDDSA_BASE_POINT_RATIO; c < COFACTOR; c <<= 1) {
-            API_NS(scalar_halve)(nonce_scalar_2,nonce_scalar_2);
-        }
-        
-        API_NS(point_t) p;
-        API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),nonce_scalar_2);
-        API_NS(point_mul_by_cofactor_and_encode_like_eddsa)(nonce_point, p);
-        API_NS(point_destroy)(p);
-        API_NS(scalar_destroy)(nonce_scalar_2);
-    }
-    
-    API_NS(scalar_t) challenge_scalar;
-    {
-        /* Compute the challenge */
-        hash_init_with_dom(hash,prehashed,0,context,context_len);
-        hash_update(hash,nonce_point,sizeof(nonce_point));
-        hash_update(hash,pubkey,DECAF_EDDSA_448_PUBLIC_BYTES);
-        hash_update(hash,message,message_len);
-        uint8_t challenge[2*DECAF_EDDSA_448_PRIVATE_BYTES];
-        hash_final(hash,challenge,sizeof(challenge));
-        hash_destroy(hash);
-        API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));
-        decaf_bzero(challenge,sizeof(challenge));
-    }
-    
-    API_NS(scalar_mul)(challenge_scalar,challenge_scalar,secret_scalar);
-    API_NS(scalar_add)(challenge_scalar,challenge_scalar,nonce_scalar);
-    
-    decaf_bzero(signature,DECAF_EDDSA_448_SIGNATURE_BYTES);
-    memcpy(signature,nonce_point,sizeof(nonce_point));
-    API_NS(scalar_encode)(&signature[DECAF_EDDSA_448_PUBLIC_BYTES],challenge_scalar);
-    
-    API_NS(scalar_destroy)(secret_scalar);
-    API_NS(scalar_destroy)(nonce_scalar);
-    API_NS(scalar_destroy)(challenge_scalar);
-}
-
-
-void decaf_ed448_sign_prehash (
-    uint8_t signature[DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t privkey[DECAF_EDDSA_448_PRIVATE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_448_PUBLIC_BYTES],
-    const decaf_ed448_prehash_ctx_t hash
-#if DECAF_EDDSA_448_SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-    uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */
-    {
-        decaf_ed448_prehash_ctx_t hash_too;
-        memcpy(hash_too,hash,sizeof(hash_too));
-        hash_final(hash_too,hash_output,sizeof(hash_output));
-        hash_destroy(hash_too);
-    }
-    
-#if DECAF_EDDSA_448_SUPPORTS_CONTEXTS
-    decaf_ed448_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
-#else
-    decaf_ed448_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1);
-#endif
-    
-    decaf_bzero(hash_output,sizeof(hash_output));
-}
-
-decaf_error_t decaf_ed448_verify (
-    const uint8_t signature[DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_448_PUBLIC_BYTES],
-    const uint8_t *message,
-    size_t message_len,
-    uint8_t prehashed
-#if SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) { 
-#if !SUPPORTS_CONTEXTS
-    const uint8_t *const context = NULL;
-    const uint8_t context_len = 0;
-#endif
-    API_NS(point_t) pk_point, r_point;
-    decaf_error_t error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(pk_point,pubkey);
-    if (DECAF_SUCCESS != error) { return error; }
-    
-    error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(r_point,signature);
-    if (DECAF_SUCCESS != error) { return error; }
-    
-    API_NS(scalar_t) challenge_scalar;
-    {
-        /* Compute the challenge */
-        hash_ctx_t hash;
-        hash_init_with_dom(hash,prehashed,0,context,context_len);
-        hash_update(hash,signature,DECAF_EDDSA_448_PUBLIC_BYTES);
-        hash_update(hash,pubkey,DECAF_EDDSA_448_PUBLIC_BYTES);
-        hash_update(hash,message,message_len);
-        uint8_t challenge[2*DECAF_EDDSA_448_PRIVATE_BYTES];
-        hash_final(hash,challenge,sizeof(challenge));
-        hash_destroy(hash);
-        API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));
-        decaf_bzero(challenge,sizeof(challenge));
-    }
-    API_NS(scalar_sub)(challenge_scalar, API_NS(scalar_zero), challenge_scalar);
-    
-    API_NS(scalar_t) response_scalar;
-    API_NS(scalar_decode_long)(
-        response_scalar,
-        &signature[DECAF_EDDSA_448_PUBLIC_BYTES],
-        DECAF_EDDSA_448_PRIVATE_BYTES
-    );
-#if EDDSA_BASE_POINT_RATIO == 2
-    API_NS(scalar_add)(response_scalar,response_scalar,response_scalar);
-#endif
-    
-    
-    /* pk_point = -c(x(P)) + (cx + k)G = kG */
-    API_NS(base_double_scalarmul_non_secret)(
-        pk_point,
-        response_scalar,
-        pk_point,
-        challenge_scalar
-    );
-    return decaf_succeed_if(API_NS(point_eq(pk_point,r_point)));
-}
-
-
-decaf_error_t decaf_ed448_verify_prehash (
-    const uint8_t signature[DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t pubkey[DECAF_EDDSA_448_PUBLIC_BYTES],
-    const decaf_ed448_prehash_ctx_t hash
-#if DECAF_EDDSA_448_SUPPORTS_CONTEXTS
-    , const uint8_t *context,
-    uint8_t context_len
-#endif
-) {
-    decaf_error_t ret;
-    
-    uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */
-    {
-        decaf_ed448_prehash_ctx_t hash_too;
-        memcpy(hash_too,hash,sizeof(hash_too));
-        hash_final(hash_too,hash_output,sizeof(hash_output));
-        hash_destroy(hash_too);
-    }
-    
-#if DECAF_EDDSA_448_SUPPORTS_CONTEXTS
-    ret = decaf_ed448_verify(signature,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
-#else
-    ret = decaf_ed448_verify(signature,pubkey,hash_output,sizeof(hash_output),1);
-#endif
-    
-    return ret;
-}

src/GENERATED/c/ed448goldilocks/elligator.c

@@ -1,199 +0,0 @@
-/**
- * @file ed448goldilocks/elligator.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @brief Elligator high-level functions.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include "word.h"
-#include "field.h"
-#include <decaf.h>
-
-/* Template stuff */
-#define API_NS(_id) decaf_448_##_id
-#define point_t API_NS(point_t)
-#define IMAGINE_TWIST 0
-#define COFACTOR 4
-static const int EDWARDS_D = -39081;
-/* End of template stuff */
-
-extern void API_NS(deisogenize) (
-    gf_s *__restrict__ s,
-    gf_s *__restrict__ minus_t_over_s,
-    const point_t p,
-    mask_t toggle_hibit_s,
-    mask_t toggle_hibit_t_over_s,
-    mask_t toggle_rotation
-);
-
-void API_NS(point_from_hash_nonuniform) (
-    point_t p,
-    const unsigned char ser[SER_BYTES]
-) {
-    gf r0,r,a,b,c,N,e;
-    ignore_result(gf_deserialize(r0,ser,0));
-    gf_strong_reduce(r0);
-    gf_sqr(a,r0);
-    gf_mul_qnr(r,a);
-
-    /* Compute D@c := (dr+a-d)(dr-ar-d) with a=1 */
-    gf_sub(a,r,ONE);
-    gf_mulw(b,a,EDWARDS_D); /* dr-d */
-    gf_add(a,b,ONE);
-    gf_sub(b,b,r);
-    gf_mul(c,a,b);
-    
-    /* compute N := (r+1)(a-2d) */
-    gf_add(a,r,ONE);
-    gf_mulw(N,a,1-2*EDWARDS_D);
-    
-    /* e = +-sqrt(1/ND) or +-r0 * sqrt(qnr/ND) */
-    gf_mul(a,c,N);
-    mask_t square = gf_isr(b,a);
-    gf_cond_sel(c,r0,ONE,square); /* r? = square ? 1 : r0 */
-    gf_mul(e,b,c);
-    
-    /* s@a = +-|N.e| */
-    gf_mul(a,N,e);
-    gf_cond_neg(a,gf_hibit(a)^square); /* NB this is - what is listen in the paper */
-    
-    /* t@b = -+ cN(r-1)((a-2d)e)^2 - 1 */
-    gf_mulw(c,e,1-2*EDWARDS_D); /* (a-2d)e */
-    gf_sqr(b,c);
-    gf_sub(e,r,ONE);
-    gf_mul(c,b,e);
-    gf_mul(b,c,N);
-    gf_cond_neg(b,square);
-    gf_sub(b,b,ONE);
-
-    /* isogenize */
-#if IMAGINE_TWIST
-    gf_mul(c,a,SQRT_MINUS_ONE);
-    gf_copy(a,c);
-#endif
-    
-    gf_sqr(c,a); /* s^2 */
-    gf_add(a,a,a); /* 2s */
-    gf_add(e,c,ONE);
-    gf_mul(p->t,a,e); /* 2s(1+s^2) */
-    gf_mul(p->x,a,b); /* 2st */
-    gf_sub(a,ONE,c);
-    gf_mul(p->y,e,a); /* (1+s^2)(1-s^2) */
-    gf_mul(p->z,a,b); /* (1-s^2)t */
-    
-    assert(API_NS(point_valid)(p));
-}
-
-void API_NS(point_from_hash_uniform) (
-    point_t pt,
-    const unsigned char hashed_data[2*SER_BYTES]
-) {
-    point_t pt2;
-    API_NS(point_from_hash_nonuniform)(pt,hashed_data);
-    API_NS(point_from_hash_nonuniform)(pt2,&hashed_data[SER_BYTES]);
-    API_NS(point_add)(pt,pt,pt2);
-}
-
-/* Elligator_onto:
- * Make elligator-inverse onto at the cost of roughly halving the success probability.
- * Currently no effect for curves with field size 1 bit mod 8 (where the top bit
- * is chopped off).  FUTURE MAGIC: automatic at least for brainpool-style curves; support
- * log p == 1 mod 8 brainpool curves maybe?
- */
-#define MAX(A,B) (((A)>(B)) ? (A) : (B))
-#define PKP_MASK ((1<<(MAX(8*SER_BYTES + 0 - 448,0)))-1)
-#if PKP_MASK != 0
-static UNUSED mask_t plus_k_p (
-    uint8_t x[SER_BYTES],
-    uint32_t factor_
-) {
-    uint32_t carry = 0;
-    uint64_t factor = factor_;
-    const uint8_t p[SER_BYTES] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-    for (unsigned int i=0; i<SER_BYTES; i++) {
-        uint64_t tmp = carry + p[i] * factor + x[i];
-        /* tmp <= 2^32-1 + (2^32-1)*(2^8-1) + (2^8-1) = 2^40-1 */
-        x[i] = tmp; carry = tmp>>8;
-    }
-    return word_is_zero(carry);
-}
-#endif
-
-decaf_error_t
-API_NS(invert_elligator_nonuniform) (
-    unsigned char recovered_hash[SER_BYTES],
-    const point_t p,
-    uint32_t hint_
-) {
-    mask_t hint = hint_;
-    mask_t sgn_s = -(hint & 1),
-        sgn_t_over_s = -(hint>>1 & 1),
-        sgn_r0 = -(hint>>2 & 1),
-        /* FUTURE MAGIC: eventually if there's a curve which needs sgn_ed_T but not sgn_r0,
-         * change this mask extraction.
-         */
-        sgn_ed_T = -(hint>>3 & 1);
-    gf a, b, c, d;
-    API_NS(deisogenize)(a,c,p,sgn_s,sgn_t_over_s,sgn_ed_T);
-    
-#if 448 == 8*SER_BYTES + 1 /* p521. */
-    sgn_r0 = 0;
-#endif
-    
-    /* ok, a = s; c = -t/s */
-    gf_mul(b,c,a);
-    gf_sub(b,ONE,b); /* t+1 */
-    gf_sqr(c,a); /* s^2 */
-    mask_t is_identity = gf_eq(p->t,ZERO);
-
-    /* identity adjustments */
-    /* in case of identity, currently c=0, t=0, b=1, will encode to 1 */
-    /* if hint is 0, -> 0 */
-    /* if hint is to neg t/s, then go to infinity, effectively set s to 1 */
-    gf_cond_sel(c,c,ONE,is_identity & sgn_t_over_s);
-    gf_cond_sel(b,b,ZERO,is_identity & ~sgn_t_over_s & ~sgn_s);
-        
-    gf_mulw(d,c,2*EDWARDS_D-1); /* $d = (2d-a)s^2 */
-    gf_add(a,b,d); /* num? */
-    gf_sub(d,d,b); /* den? */
-    gf_mul(b,a,d); /* n*d */
-    gf_cond_sel(a,d,a,sgn_s);
-    gf_mul_qnr(d,b);
-    mask_t succ = gf_isr(c,d)|gf_eq(d,ZERO);
-    gf_mul(b,a,c);
-    gf_cond_neg(b, sgn_r0^gf_hibit(b));
-    
-    succ &= ~(gf_eq(b,ZERO) & sgn_r0);
-    #if COFACTOR == 8
-        succ &= ~(is_identity & sgn_ed_T); /* NB: there are no preimages of rotated identity. */
-    #endif
-    
-    #if 448 == 8*SER_BYTES + 1 /* p521 */
-        gf_serialize(recovered_hash,b,0);
-    #else
-        gf_serialize(recovered_hash,b,1);
-        #if PKP_MASK != 0
-            /* Add a multiple of p to make the result either almost-onto or completely onto. */
-            succ &= plus_k_p(recovered_hash, (hint >> ((COFACTOR==8)?4:3)) & PKP_MASK);
-        #endif
-    #endif
-    return decaf_succeed_if(mask_to_bool(succ));
-}
-
-decaf_error_t
-API_NS(invert_elligator_uniform) (
-    unsigned char partial_hash[2*SER_BYTES],
-    const point_t p,
-    uint32_t hint
-) {
-    point_t pt2;
-    API_NS(point_from_hash_nonuniform)(pt2,&partial_hash[SER_BYTES]);
-    API_NS(point_sub)(pt2,p,pt2);
-    return API_NS(invert_elligator_nonuniform)(partial_hash,pt2,hint);
-}

src/GENERATED/c/ed448goldilocks/scalar.c

@@ -1,339 +0,0 @@
-/**
- * @file ed448goldilocks/scalar.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @brief Decaf high-level functions.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include "word.h"
-#include "constant_time.h"
-#include <decaf.h>
-
-/* Template stuff */
-#define API_NS(_id) decaf_448_##_id
-#define SCALAR_BITS DECAF_448_SCALAR_BITS
-#define SCALAR_SER_BYTES DECAF_448_SCALAR_BYTES
-#define SCALAR_LIMBS DECAF_448_SCALAR_LIMBS
-#define scalar_t API_NS(scalar_t)
-
-static const decaf_word_t MONTGOMERY_FACTOR = (decaf_word_t)0x3bd440fae918bc5ull;
-static const scalar_t sc_p = {{{
-    SC_LIMB(0x2378c292ab5844f3), SC_LIMB(0x216cc2728dc58f55), SC_LIMB(0xc44edb49aed63690), SC_LIMB(0xffffffff7cca23e9), SC_LIMB(0xffffffffffffffff), SC_LIMB(0xffffffffffffffff), SC_LIMB(0x3fffffffffffffff)
-}}}, sc_r2 = {{{
-    SC_LIMB(0xe3539257049b9b60), SC_LIMB(0x7af32c4bc1b195d9), SC_LIMB(0x0d66de2388ea1859), SC_LIMB(0xae17cf725ee4d838), SC_LIMB(0x1a9cc14ba3c47c44), SC_LIMB(0x2052bcb7e4d070af), SC_LIMB(0x3402a939f823b729)
-}}};
-/* End of template stuff */
-
-#define WBITS DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */
-
-const scalar_t API_NS(scalar_one) = {{{1}}}, API_NS(scalar_zero) = {{{0}}};
-
-/** {extra,accum} - sub +? p
- * Must have extra <= 1
- */
-static NOINLINE void sc_subx(
-    scalar_t out,
-    const decaf_word_t accum[SCALAR_LIMBS],
-    const scalar_t sub,
-    const scalar_t p,
-    decaf_word_t extra
-) {
-    decaf_dsword_t chain = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + accum[i]) - sub->limb[i];
-        out->limb[i] = chain;
-        chain >>= WBITS;
-    }
-    decaf_word_t borrow = chain+extra; /* = 0 or -1 */
-    
-    chain = 0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + out->limb[i]) + (p->limb[i] & borrow);
-        out->limb[i] = chain;
-        chain >>= WBITS;
-    }
-}
-
-static NOINLINE void sc_montmul (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    unsigned int i,j;
-    decaf_word_t accum[SCALAR_LIMBS+1] = {0};
-    decaf_word_t hi_carry = 0;
-    
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        decaf_word_t mand = a->limb[i];
-        const decaf_word_t *mier = b->limb;
-        
-        decaf_dword_t chain = 0;
-        for (j=0; j<SCALAR_LIMBS; j++) {
-            chain += ((decaf_dword_t)mand)*mier[j] + accum[j];
-            accum[j] = chain;
-            chain >>= WBITS;
-        }
-        accum[j] = chain;
-        
-        mand = accum[0] * MONTGOMERY_FACTOR;
-        chain = 0;
-        mier = sc_p->limb;
-        for (j=0; j<SCALAR_LIMBS; j++) {
-            chain += (decaf_dword_t)mand*mier[j] + accum[j];
-            if (j) accum[j-1] = chain;
-            chain >>= WBITS;
-        }
-        chain += accum[j];
-        chain += hi_carry;
-        accum[j-1] = chain;
-        hi_carry = chain >> WBITS;
-    }
-    
-    sc_subx(out, accum, sc_p, sc_p, hi_carry);
-}
-
-void API_NS(scalar_mul) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    sc_montmul(out,a,b);
-    sc_montmul(out,out,sc_r2);
-}
-
-/* PERF: could implement this */
-static INLINE void sc_montsqr (scalar_t out, const scalar_t a) {
-    sc_montmul(out,a,a);
-}
-
-decaf_error_t API_NS(scalar_invert) (
-    scalar_t out,
-    const scalar_t a
-) {
-    /* Fermat's little theorem, sliding window.
-     * Sliding window is fine here because the modulus isn't secret.
-     */
-    const int SCALAR_WINDOW_BITS = 3;
-    scalar_t precmp[1<<SCALAR_WINDOW_BITS];
-    const int LAST = (1<<SCALAR_WINDOW_BITS)-1;
-
-    /* Precompute precmp = [a^1,a^3,...] */
-    sc_montmul(precmp[0],a,sc_r2);
-    if (LAST > 0) sc_montmul(precmp[LAST],precmp[0],precmp[0]);
-
-    int i;
-    for (i=1; i<=LAST; i++) {
-        sc_montmul(precmp[i],precmp[i-1],precmp[LAST]);
-    }
-    
-    /* Sliding window */
-    unsigned residue = 0, trailing = 0, started = 0;
-    for (i=SCALAR_BITS-1; i>=-SCALAR_WINDOW_BITS; i--) {
-        
-        if (started) sc_montsqr(out,out);
-        
-        decaf_word_t w = (i>=0) ? sc_p->limb[i/WBITS] : 0;
-        if (i >= 0 && i<WBITS) {
-            assert(w >= 2);
-            w-=2;
-        }
-        
-        residue = (residue<<1) | ((w>>(i%WBITS))&1);
-        if (residue>>SCALAR_WINDOW_BITS != 0) {
-            assert(trailing == 0);
-            trailing = residue;
-            residue = 0;
-        }
-        
-        if (trailing > 0 && (trailing & ((1<<SCALAR_WINDOW_BITS)-1)) == 0) {
-            if (started) {
-                sc_montmul(out,out,precmp[trailing>>(SCALAR_WINDOW_BITS+1)]);
-            } else {
-                API_NS(scalar_copy)(out,precmp[trailing>>(SCALAR_WINDOW_BITS+1)]);
-                started = 1;
-            }
-            trailing = 0;
-        }
-        trailing <<= 1;
-        
-    }
-    assert(residue==0);
-    assert(trailing==0);
-    
-    /* Demontgomerize */
-    sc_montmul(out,out,API_NS(scalar_one));
-    decaf_bzero(precmp, sizeof(precmp));
-    return decaf_succeed_if(~API_NS(scalar_eq)(out,API_NS(scalar_zero)));
-}
-
-void API_NS(scalar_sub) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    sc_subx(out, a->limb, b, sc_p, 0);
-}
-
-void API_NS(scalar_add) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b
-) {
-    decaf_dword_t chain = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + a->limb[i]) + b->limb[i];
-        out->limb[i] = chain;
-        chain >>= WBITS;
-    }
-    sc_subx(out, out->limb, sc_p, sc_p, chain);
-}
-
-void
-API_NS(scalar_set_unsigned) (
-    scalar_t out,
-    uint64_t w
-) {
-    memset(out,0,sizeof(scalar_t));
-    unsigned int i = 0;
-    for (; i<sizeof(uint64_t)/sizeof(decaf_word_t); i++) {
-        out->limb[i] = w;
-        w >>= (sizeof(uint64_t) > sizeof(decaf_word_t)) ? 8*sizeof(decaf_word_t) : 0;
-    }
-}
-
-decaf_bool_t
-API_NS(scalar_eq) (
-    const scalar_t a,
-    const scalar_t b
-) {
-    decaf_word_t diff = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        diff |= a->limb[i] ^ b->limb[i];
-    }
-    return mask_to_bool(word_is_zero(diff));
-}
-
-static INLINE void scalar_decode_short (
-    scalar_t s,
-    const unsigned char *ser,
-    unsigned int nbytes
-) {
-    unsigned int i,j,k=0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        decaf_word_t out = 0;
-        for (j=0; j<sizeof(decaf_word_t) && k<nbytes; j++,k++) {
-            out |= ((decaf_word_t)ser[k])<<(8*j);
-        }
-        s->limb[i] = out;
-    }
-}
-
-decaf_error_t API_NS(scalar_decode)(
-    scalar_t s,
-    const unsigned char ser[SCALAR_SER_BYTES]
-) {
-    unsigned int i;
-    scalar_decode_short(s, ser, SCALAR_SER_BYTES);
-    decaf_dsword_t accum = 0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        accum = (accum + s->limb[i] - sc_p->limb[i]) >> WBITS;
-    }
-    /* Here accum == 0 or -1 */
-    
-    API_NS(scalar_mul)(s,s,API_NS(scalar_one)); /* ham-handed reduce */
-    
-    return decaf_succeed_if(~word_is_zero(accum));
-}
-
-void API_NS(scalar_destroy) (
-    scalar_t scalar
-) {
-    decaf_bzero(scalar, sizeof(scalar_t));
-}
-
-void API_NS(scalar_decode_long)(
-    scalar_t s,
-    const unsigned char *ser,
-    size_t ser_len
-) {
-    if (ser_len == 0) {
-        API_NS(scalar_copy)(s, API_NS(scalar_zero));
-        return;
-    }
-    
-    size_t i;
-    scalar_t t1, t2;
-
-    i = ser_len - (ser_len%SCALAR_SER_BYTES);
-    if (i==ser_len) i -= SCALAR_SER_BYTES;
-    
-    scalar_decode_short(t1, &ser[i], ser_len-i);
-
-    if (ser_len == sizeof(scalar_t)) {
-        assert(i==0);
-        /* ham-handed reduce */
-        API_NS(scalar_mul)(s,t1,API_NS(scalar_one));
-        API_NS(scalar_destroy)(t1);
-        return;
-    }
-
-    while (i) {
-        i -= SCALAR_SER_BYTES;
-        sc_montmul(t1,t1,sc_r2);
-        ignore_result( API_NS(scalar_decode)(t2, ser+i) );
-        API_NS(scalar_add)(t1, t1, t2);
-    }
-
-    API_NS(scalar_copy)(s, t1);
-    API_NS(scalar_destroy)(t1);
-    API_NS(scalar_destroy)(t2);
-}
-
-void API_NS(scalar_encode)(
-    unsigned char ser[SCALAR_SER_BYTES],
-    const scalar_t s
-) {
-    unsigned int i,j,k=0;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        for (j=0; j<sizeof(decaf_word_t); j++,k++) {
-            ser[k] = s->limb[i] >> (8*j);
-        }
-    }
-}
-
-void API_NS(scalar_cond_sel) (
-    scalar_t out,
-    const scalar_t a,
-    const scalar_t b,
-    decaf_bool_t pick_b
-) {
-    constant_time_select(out,a,b,sizeof(scalar_t),bool_to_mask(pick_b),sizeof(out->limb[0]));
-}
-
-void API_NS(scalar_halve) (
-    scalar_t out,
-    const scalar_t a
-) {
-    decaf_word_t mask = -(a->limb[0] & 1);
-    decaf_dword_t chain = 0;
-    unsigned int i;
-    for (i=0; i<SCALAR_LIMBS; i++) {
-        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
-        out->limb[i] = chain;
-        chain >>= DECAF_WORD_BITS;
-    }
-    for (i=0; i<SCALAR_LIMBS-1; i++) {
-        out->limb[i] = out->limb[i]>>1 | out->limb[i+1]<<(WBITS-1);
-    }
-    out->limb[i] = out->limb[i]>>1 | chain<<(WBITS-1);
-}
-

src/GENERATED/c/p448/f_generic.c

@@ -1,133 +0,0 @@
-/**
- * @file p448/f_generic.c
- * @author Mike Hamburg
- *
- * @copyright
- *   Copyright (c) 2015-2016 Cryptography Research, Inc.  \n
- *   Released under the MIT License.  See LICENSE.txt for license information.
- *
- * @brief Generic arithmetic which has to be compiled per field.
- *
- * @warning This file was automatically generated in Python.
- * Please do not edit it.
- */
-#include "field.h"
-
-static const gf MODULUS = {FIELD_LITERAL(
-    0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff, 0xfffffffffffffe, 0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff
-)};
-    
-#if P_MOD_8 == 5
-    const gf SQRT_MINUS_ONE = {FIELD_LITERAL(
-        /* NOPE */
-    )};
-#endif
-
-/** Serialize to wire format. */
-void gf_serialize (uint8_t serial[SER_BYTES], const gf x, int with_hibit) {
-    gf red;
-    gf_copy(red, x);
-    gf_strong_reduce(red);
-    if (!with_hibit) { assert(gf_hibit(red) == 0); }
-    
-    unsigned int j=0, fill=0;
-    dword_t buffer = 0;
-    UNROLL for (unsigned int i=0; i<(with_hibit ? X_SER_BYTES : SER_BYTES); i++) {
-        if (fill < 8 && j < NLIMBS) {
-            buffer |= ((dword_t)red->limb[LIMBPERM(j)]) << fill;
-            fill += LIMB_PLACE_VALUE(LIMBPERM(j));
-            j++;
-        }
-        serial[i] = buffer;
-        fill -= 8;
-        buffer >>= 8;
-    }
-}
-
-/** Return high bit of x = low bit of 2x mod p */
-mask_t gf_hibit(const gf x) {
-    gf y;
-    gf_add(y,x,x);
-    gf_strong_reduce(y);
-    return -(y->limb[0]&1);
-}
-
-/** Deserialize from wire format; return -1 on success and 0 on failure. */
-mask_t gf_deserialize (gf x, const uint8_t serial[SER_BYTES], int with_hibit) {
-    unsigned int j=0, fill=0;
-    dword_t buffer = 0;
-    dsword_t scarry = 0;
-    UNROLL for (unsigned int i=0; i<NLIMBS; i++) {
-        UNROLL while (fill < LIMB_PLACE_VALUE(LIMBPERM(i)) && j < (with_hibit ? X_SER_BYTES : SER_BYTES)) {
-            buffer |= ((dword_t)serial[j]) << fill;
-            fill += 8;
-            j++;
-        }
-        x->limb[LIMBPERM(i)] = (i<NLIMBS-1) ? buffer & LIMB_MASK(LIMBPERM(i)) : buffer;
-        fill -= LIMB_PLACE_VALUE(LIMBPERM(i));
-        buffer >>= LIMB_PLACE_VALUE(LIMBPERM(i));
-        scarry = (scarry + x->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)]) >> (8*sizeof(word_t));
-    }
-    mask_t succ = with_hibit ? -(mask_t)1 : ~gf_hibit(x);
-    return succ & word_is_zero(buffer) & ~word_is_zero(scarry);
-}
-
-/** Reduce to canonical form. */
-void gf_strong_reduce (gf a) {
-    /* first, clear high */
-    gf_weak_reduce(a); /* Determined to have negligible perf impact. */
-
-    /* now the total is less than 2p */
-
-    /* compute total_value - p.  No need to reduce mod p. */
-    dsword_t scarry = 0;
-    for (unsigned int i=0; i<NLIMBS; i++) {
-        scarry = scarry + a->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)];
-        a->limb[LIMBPERM(i)] = scarry & LIMB_MASK(LIMBPERM(i));
-        scarry >>= LIMB_PLACE_VALUE(LIMBPERM(i));
-    }
-
-    /* uncommon case: it was >= p, so now scarry = 0 and this = x
-     * common case: it was < p, so now scarry = -1 and this = x - p + 2^255
-     * so let's add back in p.  will carry back off the top for 2^255.
-     */
-    assert(word_is_zero(scarry) | word_is_zero(scarry+1));
-
-    word_t scarry_0 = scarry;
-    dword_t carry = 0;
-
-    /* add it back */
-    for (unsigned int i=0; i<NLIMBS; i++) {
-        carry = carry + a->limb[LIMBPERM(i)] + (scarry_0 & MODULUS->limb[LIMBPERM(i)]);
-        a->limb[LIMBPERM(i)] = carry & LIMB_MASK(LIMBPERM(i));
-        carry >>= LIMB_PLACE_VALUE(LIMBPERM(i));
-    }
-
-    assert(word_is_zero(carry + scarry_0));
-}
-
-/** Add two gf elements */
-void gf_sub (gf d, const gf a, const gf b) {
-    gf_sub_RAW ( d, a, b );
-    gf_bias( d, 2 );
-    gf_weak_reduce ( d );
-}
-
-/** Subtract d = a-b */
-void gf_add (gf d, const gf a, const gf b) {
-    gf_add_RAW ( d, a, b );
-    gf_weak_reduce ( d );
-}
-
-/** Compare a==b */
-mask_t gf_eq(const gf a, const gf b) {
-    gf c;
-    gf_sub(c,a,b);
-    gf_strong_reduce(c);
-    mask_t ret=0;
-    for (unsigned int i=0; i<NLIMBS; i++) {
-        ret |= c->limb[LIMBPERM(i)];
-    }
-
-    return word_is_zero(ret);
-}

src/GENERATED/include/decaf.h

@@ -26,7 +26,7 @@
 #ifndef __DECAF_H__
 #define __DECAF_H__ 1
 
-#include <decaf/decaf_255.h>
-#include <decaf/decaf_448.h>
+#include <decaf/point_255.h>
+#include <decaf/point_448.h>
 
 #endif /* __DECAF_H__ */

src/GENERATED/include/decaf.hxx

@@ -15,8 +15,8 @@
 #ifndef __DECAF_HXX__
 #define __DECAF_HXX__ 1
 
-#include <decaf/decaf_255.hxx>
-#include <decaf/decaf_448.hxx>
+#include <decaf/point_255.hxx>
+#include <decaf/point_448.hxx>
 
 namespace decaf {
     template <template<typename Group> class Run>

src/GENERATED/include/decaf/ed255.h

@@ -15,7 +15,7 @@
 #ifndef __DECAF_ED255_H__
 #define __DECAF_ED255_H__ 1
 
-#include <decaf/decaf_255.h>
+#include <decaf/point_255.h>
 #include <decaf/shake.h>
 #include <decaf/sha512.h>
 

src/GENERATED/include/decaf/ed255.hxx

@@ -24,7 +24,7 @@
  */
 
 #include <decaf/eddsa.hxx>
-#include <decaf/decaf_255.hxx>
+#include <decaf/point_255.hxx>
 #include <decaf/ed255.h>
 
 #include <decaf/shake.hxx>

src/GENERATED/include/decaf/ed448.h

@@ -15,7 +15,7 @@
 #ifndef __DECAF_ED448_H__
 #define __DECAF_ED448_H__ 1
 
-#include <decaf/decaf_448.h>
+#include <decaf/point_448.h>
 #include <decaf/shake.h>
 #include <decaf/sha512.h>
 

src/GENERATED/include/decaf/ed448.hxx

@@ -24,7 +24,7 @@
  */
 
 #include <decaf/eddsa.hxx>
-#include <decaf/decaf_448.hxx>
+#include <decaf/point_448.hxx>
 #include <decaf/ed448.h>
 
 #include <decaf/shake.hxx>

src/GENERATED/include/decaf/decaf_255.h → src/GENERATED/include/decaf/point_255.h

@@ -1,5 +1,5 @@
 /**
- * @file decaf/decaf_255.h
+ * @file decaf/point_255.h
  * @author Mike Hamburg
  *
  * @copyright
@@ -12,8 +12,8 @@
  * Please do not edit it.
  */
 
-#ifndef __DECAF_DECAF_255_H__
-#define __DECAF_DECAF_255_H__ 1
+#ifndef __DECAF_POINT_255_H__
+#define __DECAF_POINT_255_H__ 1
 
 #include <decaf/common.h>
 
@@ -703,4 +703,4 @@ void decaf_255_precomputed_destroy (
 } /* extern "C" */
 #endif
 
-#endif /* __DECAF_DECAF_255_H__ */
+#endif /* __DECAF_POINT_255_H__ */

src/GENERATED/include/decaf/decaf_255.hxx → src/GENERATED/include/decaf/point_255.hxx

@@ -1,5 +1,5 @@
 /**
- * @file decaf/decaf_255.hxx
+ * @file decaf/point_255.hxx
  * @author Mike Hamburg
  *
  * @copyright
@@ -23,8 +23,8 @@
  * Please do not edit it.
  */
 
-#ifndef __DECAF_DECAF_255_HXX__
-#define __DECAF_DECAF_255_HXX__ 1
+#ifndef __DECAF_POINT_255_HXX__
+#define __DECAF_POINT_255_HXX__ 1
 
 /** This code uses posix_memalign. */
 #ifndef _XOPEN_SOURCE
@@ -33,7 +33,7 @@
 #include <stdlib.h>
 #include <string.h> /* for memcpy */
 
-#include <decaf/decaf_255.h>
+#include <decaf/point_255.h>
 #include <decaf/ed255.h>
 #include <decaf/secure_buffer.hxx>
 #include <string>
@@ -711,4 +711,4 @@ inline SecureBuffer IsoEd25519::Scalar::direct_scalarmul (
 #undef NOEXCEPT
 } /* namespace decaf */
 
-#endif /* __DECAF_DECAF_255_HXX__ */
+#endif /* __DECAF_POINT_255_HXX__ */

src/GENERATED/include/decaf/decaf_448.h → src/GENERATED/include/decaf/point_448.h

@@ -1,5 +1,5 @@
 /**
- * @file decaf/decaf_448.h
+ * @file decaf/point_448.h
  * @author Mike Hamburg
  *
  * @copyright
@@ -12,8 +12,8 @@
  * Please do not edit it.
  */
 
-#ifndef __DECAF_DECAF_448_H__
-#define __DECAF_DECAF_448_H__ 1
+#ifndef __DECAF_POINT_448_H__
+#define __DECAF_POINT_448_H__ 1
 
 #include <decaf/common.h>
 
@@ -703,4 +703,4 @@ void decaf_448_precomputed_destroy (
 } /* extern "C" */
 #endif
 
-#endif /* __DECAF_DECAF_448_H__ */
+#endif /* __DECAF_POINT_448_H__ */

src/GENERATED/include/decaf/decaf_448.hxx → src/GENERATED/include/decaf/point_448.hxx

@@ -1,5 +1,5 @@
 /**
- * @file decaf/decaf_448.hxx
+ * @file decaf/point_448.hxx
  * @author Mike Hamburg
  *
  * @copyright
@@ -23,8 +23,8 @@
  * Please do not edit it.
  */
 
-#ifndef __DECAF_DECAF_448_HXX__
-#define __DECAF_DECAF_448_HXX__ 1
+#ifndef __DECAF_POINT_448_HXX__
+#define __DECAF_POINT_448_HXX__ 1
 
 /** This code uses posix_memalign. */
 #ifndef _XOPEN_SOURCE
@@ -33,7 +33,7 @@
 #include <stdlib.h>
 #include <string.h> /* for memcpy */
 
-#include <decaf/decaf_448.h>
+#include <decaf/point_448.h>
 #include <decaf/ed448.h>
 #include <decaf/secure_buffer.hxx>
 #include <string>
@@ -711,4 +711,4 @@ inline SecureBuffer Ed448Goldilocks::Scalar::direct_scalarmul (
 #undef NOEXCEPT
 } /* namespace decaf */
 
-#endif /* __DECAF_DECAF_448_HXX__ */
+#endif /* __DECAF_POINT_448_HXX__ */

src/per_curve/crypto.tmpl.h

@@ -6,7 +6,7 @@
  * @warning Experimental!  The names, parameter orders etc are likely to change.
  */
 
-#include <decaf/$(c_ns).h>
+#include <decaf/point_$(gf_bits).h>
 #include <decaf/strobe.h>
 
 #ifdef __cplusplus

src/per_curve/crypto.tmpl.hxx

@@ -6,7 +6,7 @@
  * @warning Experimental!  The names, parameter orders etc are likely to change.
  */
 
-#include <decaf/decaf_$(gf_bits).hxx>
+#include <decaf/point_$(gf_bits).hxx>
 #include <decaf/shake.hxx>
 #include <decaf/strobe.hxx>
 

src/per_curve/eddsa.tmpl.h

@@ -1,6 +1,6 @@
 /** @brief A group of prime order p, based on $(iso_to). */
 
-#include <decaf/decaf_$(gf_bits).h>
+#include <decaf/point_$(gf_bits).h>
 #include <decaf/shake.h>
 #include <decaf/sha512.h>
 

src/per_curve/eddsa.tmpl.hxx

@@ -8,7 +8,7 @@
  */
 
 #include <decaf/eddsa.hxx>
-#include <decaf/decaf_$(gf_bits).hxx>
+#include <decaf/point_$(gf_bits).hxx>
 #include <decaf/ed$(gf_bits).h>
 
 #include <decaf/shake.hxx>

src/per_curve/decaf.tmpl.hxx → src/per_curve/point.tmpl.hxx

@@ -20,7 +20,7 @@
 #include <stdlib.h>
 #include <string.h> /* for memcpy */
 
-#include <decaf/decaf_$(gf_bits).h>
+#include <decaf/point_$(gf_bits).h>
 #include <decaf/ed$(gf_bits).h>
 #include <decaf/secure_buffer.hxx>
 #include <string>

src/public_include/decaf.tmpl.h

@@ -14,5 +14,5 @@
  */
 
 $("\n".join([
-    "#include <decaf/decaf_%s.h>" % g for g in sorted([c["bits"] for _,c in curve.iteritems()])
+    "#include <decaf/point_%s.h>" % g for g in sorted([c["bits"] for _,c in curve.iteritems()])
 ]))

src/public_include/decaf.tmpl.hxx

@@ -1,7 +1,7 @@
 /** Master header for Decaf library, C++ version. */
 
 $("\n".join([
-    "#include <decaf/decaf_%s.hxx>" % g for g in sorted([c["bits"] for _,c in curve.iteritems()])
+    "#include <decaf/point_%s.hxx>" % g for g in sorted([c["bits"] for _,c in curve.iteritems()])
 ]))
 
 namespace decaf {