diff options
author | Denys Vlasenko <vda.linux@googlemail.com> | 2021-04-26 20:24:34 +0200 |
---|---|---|
committer | Denys Vlasenko <vda.linux@googlemail.com> | 2021-04-26 20:24:34 +0200 |
commit | 120401249a37a77cd2d4c71ad20a9a194bfea409 (patch) | |
tree | 45f84378f495d53f6c160f33f117d333c9e2ee58 | |
parent | 93b886f54bf85ca38f372ddd521f7c5bdbdc5d08 (diff) | |
download | busybox-w32-120401249a37a77cd2d4c71ad20a9a194bfea409.tar.gz busybox-w32-120401249a37a77cd2d4c71ad20a9a194bfea409.tar.bz2 busybox-w32-120401249a37a77cd2d4c71ad20a9a194bfea409.zip |
tls: fix whitespace in P256 code
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
-rw-r--r-- | networking/tls_sp_c32.c | 1002 |
1 files changed, 501 insertions, 501 deletions
diff --git a/networking/tls_sp_c32.c b/networking/tls_sp_c32.c index 97b2d3de9..8527e7864 100644 --- a/networking/tls_sp_c32.c +++ b/networking/tls_sp_c32.c | |||
@@ -92,30 +92,30 @@ static const sp_point p256_base = { | |||
92 | */ | 92 | */ |
93 | static void sp_256_to_bin(sp_digit* r, uint8_t* a) | 93 | static void sp_256_to_bin(sp_digit* r, uint8_t* a) |
94 | { | 94 | { |
95 | int i, j, s = 0, b; | 95 | int i, j, s = 0, b; |
96 | 96 | ||
97 | for (i = 0; i < 9; i++) { | 97 | for (i = 0; i < 9; i++) { |
98 | r[i+1] += r[i] >> 26; | 98 | r[i+1] += r[i] >> 26; |
99 | r[i] &= 0x3ffffff; | 99 | r[i] &= 0x3ffffff; |
100 | } | 100 | } |
101 | j = 256 / 8 - 1; | 101 | j = 256 / 8 - 1; |
102 | a[j] = 0; | 102 | a[j] = 0; |
103 | for (i=0; i<10 && j>=0; i++) { | 103 | for (i = 0; i < 10 && j >= 0; i++) { |
104 | b = 0; | 104 | b = 0; |
105 | a[j--] |= r[i] << s; b += 8 - s; | 105 | a[j--] |= r[i] << s; b += 8 - s; |
106 | if (j < 0) | 106 | if (j < 0) |
107 | break; | 107 | break; |
108 | while (b < 26) { | 108 | while (b < 26) { |
109 | a[j--] = r[i] >> b; b += 8; | 109 | a[j--] = r[i] >> b; b += 8; |
110 | if (j < 0) | 110 | if (j < 0) |
111 | break; | 111 | break; |
112 | } | 112 | } |
113 | s = 8 - (b - 26); | 113 | s = 8 - (b - 26); |
114 | if (j >= 0) | 114 | if (j >= 0) |
115 | a[j] = 0; | 115 | a[j] = 0; |
116 | if (s != 0) | 116 | if (s != 0) |
117 | j++; | 117 | j++; |
118 | } | 118 | } |
119 | } | 119 | } |
120 | 120 | ||
121 | /* Read big endian unsigned byte aray into r. | 121 | /* Read big endian unsigned byte aray into r. |
@@ -126,37 +126,37 @@ static void sp_256_to_bin(sp_digit* r, uint8_t* a) | |||
126 | */ | 126 | */ |
127 | static void sp_256_from_bin(sp_digit* r, int max, const uint8_t* a, int n) | 127 | static void sp_256_from_bin(sp_digit* r, int max, const uint8_t* a, int n) |
128 | { | 128 | { |
129 | int i, j = 0, s = 0; | 129 | int i, j = 0, s = 0; |
130 | 130 | ||
131 | r[0] = 0; | 131 | r[0] = 0; |
132 | for (i = n-1; i >= 0; i--) { | 132 | for (i = n-1; i >= 0; i--) { |
133 | r[j] |= ((sp_digit)a[i]) << s; | 133 | r[j] |= ((sp_digit)a[i]) << s; |
134 | if (s >= 18) { | 134 | if (s >= 18) { |
135 | r[j] &= 0x3ffffff; | 135 | r[j] &= 0x3ffffff; |
136 | s = 26 - s; | 136 | s = 26 - s; |
137 | if (j + 1 >= max) | 137 | if (j + 1 >= max) |
138 | break; | 138 | break; |
139 | r[++j] = a[i] >> s; | 139 | r[++j] = a[i] >> s; |
140 | s = 8 - s; | 140 | s = 8 - s; |
141 | } | 141 | } |
142 | else | 142 | else |
143 | s += 8; | 143 | s += 8; |
144 | } | 144 | } |
145 | 145 | ||
146 | for (j++; j < max; j++) | 146 | for (j++; j < max; j++) |
147 | r[j] = 0; | 147 | r[j] = 0; |
148 | } | 148 | } |
149 | 149 | ||
150 | /* Convert a point of big-endian 32-byte x,y pair to type sp_point. */ | 150 | /* Convert a point of big-endian 32-byte x,y pair to type sp_point. */ |
151 | static void sp_256_point_from_bin2x32(sp_point* p, const uint8_t *bin2x32) | 151 | static void sp_256_point_from_bin2x32(sp_point* p, const uint8_t *bin2x32) |
152 | { | 152 | { |
153 | memset(p, 0, sizeof(*p)); | 153 | memset(p, 0, sizeof(*p)); |
154 | /*p->infinity = 0;*/ | 154 | /*p->infinity = 0;*/ |
155 | sp_256_from_bin(p->x, 2 * 10, bin2x32, 32); | 155 | sp_256_from_bin(p->x, 2 * 10, bin2x32, 32); |
156 | sp_256_from_bin(p->y, 2 * 10, bin2x32 + 32, 32); | 156 | sp_256_from_bin(p->y, 2 * 10, bin2x32 + 32, 32); |
157 | //static const uint8_t one[1] = { 1 }; | 157 | //static const uint8_t one[1] = { 1 }; |
158 | //sp_256_from_bin(p->z, 2 * 10, one, 1); | 158 | //sp_256_from_bin(p->z, 2 * 10, one, 1); |
159 | p->z[0] = 1; | 159 | p->z[0] = 1; |
160 | } | 160 | } |
161 | 161 | ||
162 | /* Compare a with b. | 162 | /* Compare a with b. |
@@ -166,14 +166,14 @@ static void sp_256_point_from_bin2x32(sp_point* p, const uint8_t *bin2x32) | |||
166 | */ | 166 | */ |
167 | static sp_digit sp_256_cmp_10(const sp_digit* a, const sp_digit* b) | 167 | static sp_digit sp_256_cmp_10(const sp_digit* a, const sp_digit* b) |
168 | { | 168 | { |
169 | sp_digit r; | 169 | sp_digit r; |
170 | int i; | 170 | int i; |
171 | for (i = 9; i >= 0; i--) { | 171 | for (i = 9; i >= 0; i--) { |
172 | r = a[i] - b[i]; | 172 | r = a[i] - b[i]; |
173 | if (r != 0) | 173 | if (r != 0) |
174 | break; | 174 | break; |
175 | } | 175 | } |
176 | return r; | 176 | return r; |
177 | } | 177 | } |
178 | 178 | ||
179 | /* Compare two numbers to determine if they are equal. | 179 | /* Compare two numbers to determine if they are equal. |
@@ -182,56 +182,56 @@ static sp_digit sp_256_cmp_10(const sp_digit* a, const sp_digit* b) | |||
182 | */ | 182 | */ |
183 | static int sp_256_cmp_equal_10(const sp_digit* a, const sp_digit* b) | 183 | static int sp_256_cmp_equal_10(const sp_digit* a, const sp_digit* b) |
184 | { | 184 | { |
185 | return sp_256_cmp_10(a, b) == 0; | 185 | return sp_256_cmp_10(a, b) == 0; |
186 | } | 186 | } |
187 | 187 | ||
188 | /* Normalize the values in each word to 26 bits. */ | 188 | /* Normalize the values in each word to 26 bits. */ |
189 | static void sp_256_norm_10(sp_digit* a) | 189 | static void sp_256_norm_10(sp_digit* a) |
190 | { | 190 | { |
191 | int i; | 191 | int i; |
192 | for (i = 0; i < 9; i++) { | 192 | for (i = 0; i < 9; i++) { |
193 | a[i+1] += a[i] >> 26; | 193 | a[i+1] += a[i] >> 26; |
194 | a[i] &= 0x3ffffff; | 194 | a[i] &= 0x3ffffff; |
195 | } | 195 | } |
196 | } | 196 | } |
197 | 197 | ||
198 | /* Add b to a into r. (r = a + b) */ | 198 | /* Add b to a into r. (r = a + b) */ |
199 | static void sp_256_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b) | 199 | static void sp_256_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b) |
200 | { | 200 | { |
201 | int i; | 201 | int i; |
202 | for (i = 0; i < 10; i++) | 202 | for (i = 0; i < 10; i++) |
203 | r[i] = a[i] + b[i]; | 203 | r[i] = a[i] + b[i]; |
204 | } | 204 | } |
205 | 205 | ||
206 | /* Conditionally add a and b using the mask m. | 206 | /* Conditionally add a and b using the mask m. |
207 | * m is -1 to add and 0 when not. | 207 | * m is -1 to add and 0 when not. |
208 | */ | 208 | */ |
209 | static void sp_256_cond_add_10(sp_digit* r, const sp_digit* a, | 209 | static void sp_256_cond_add_10(sp_digit* r, const sp_digit* a, |
210 | const sp_digit* b, const sp_digit m) | 210 | const sp_digit* b, const sp_digit m) |
211 | { | 211 | { |
212 | int i; | 212 | int i; |
213 | for (i = 0; i < 10; i++) | 213 | for (i = 0; i < 10; i++) |
214 | r[i] = a[i] + (b[i] & m); | 214 | r[i] = a[i] + (b[i] & m); |
215 | } | 215 | } |
216 | 216 | ||
217 | /* Conditionally subtract b from a using the mask m. | 217 | /* Conditionally subtract b from a using the mask m. |
218 | * m is -1 to subtract and 0 when not. | 218 | * m is -1 to subtract and 0 when not. |
219 | */ | 219 | */ |
220 | static void sp_256_cond_sub_10(sp_digit* r, const sp_digit* a, | 220 | static void sp_256_cond_sub_10(sp_digit* r, const sp_digit* a, |
221 | const sp_digit* b, const sp_digit m) | 221 | const sp_digit* b, const sp_digit m) |
222 | { | 222 | { |
223 | int i; | 223 | int i; |
224 | for (i = 0; i < 10; i++) | 224 | for (i = 0; i < 10; i++) |
225 | r[i] = a[i] - (b[i] & m); | 225 | r[i] = a[i] - (b[i] & m); |
226 | } | 226 | } |
227 | 227 | ||
228 | /* Shift number left one bit. Bottom bit is lost. */ | 228 | /* Shift number left one bit. Bottom bit is lost. */ |
229 | static void sp_256_rshift1_10(sp_digit* r, sp_digit* a) | 229 | static void sp_256_rshift1_10(sp_digit* r, sp_digit* a) |
230 | { | 230 | { |
231 | int i; | 231 | int i; |
232 | for (i = 0; i < 9; i++) | 232 | for (i = 0; i < 9; i++) |
233 | r[i] = ((a[i] >> 1) | (a[i + 1] << 25)) & 0x3ffffff; | 233 | r[i] = ((a[i] >> 1) | (a[i + 1] << 25)) & 0x3ffffff; |
234 | r[9] = a[9] >> 1; | 234 | r[9] = a[9] >> 1; |
235 | } | 235 | } |
236 | 236 | ||
237 | /* Multiply a number by Montogmery normalizer mod modulus (prime). | 237 | /* Multiply a number by Montogmery normalizer mod modulus (prime). |
@@ -241,188 +241,188 @@ static void sp_256_rshift1_10(sp_digit* r, sp_digit* a) | |||
241 | */ | 241 | */ |
242 | static void sp_256_mod_mul_norm_10(sp_digit* r, const sp_digit* a) | 242 | static void sp_256_mod_mul_norm_10(sp_digit* r, const sp_digit* a) |
243 | { | 243 | { |
244 | int64_t t[8]; | 244 | int64_t t[8]; |
245 | int64_t a32[8]; | 245 | int64_t a32[8]; |
246 | int64_t o; | 246 | int64_t o; |
247 | 247 | ||
248 | a32[0] = a[0]; | 248 | a32[0] = a[0]; |
249 | a32[0] |= a[1] << 26; | 249 | a32[0] |= a[1] << 26; |
250 | a32[0] &= 0xffffffff; | 250 | a32[0] &= 0xffffffff; |
251 | a32[1] = (sp_digit)(a[1] >> 6); | 251 | a32[1] = (sp_digit)(a[1] >> 6); |
252 | a32[1] |= a[2] << 20; | 252 | a32[1] |= a[2] << 20; |
253 | a32[1] &= 0xffffffff; | 253 | a32[1] &= 0xffffffff; |
254 | a32[2] = (sp_digit)(a[2] >> 12); | 254 | a32[2] = (sp_digit)(a[2] >> 12); |
255 | a32[2] |= a[3] << 14; | 255 | a32[2] |= a[3] << 14; |
256 | a32[2] &= 0xffffffff; | 256 | a32[2] &= 0xffffffff; |
257 | a32[3] = (sp_digit)(a[3] >> 18); | 257 | a32[3] = (sp_digit)(a[3] >> 18); |
258 | a32[3] |= a[4] << 8; | 258 | a32[3] |= a[4] << 8; |
259 | a32[3] &= 0xffffffff; | 259 | a32[3] &= 0xffffffff; |
260 | a32[4] = (sp_digit)(a[4] >> 24); | 260 | a32[4] = (sp_digit)(a[4] >> 24); |
261 | a32[4] |= a[5] << 2; | 261 | a32[4] |= a[5] << 2; |
262 | a32[4] |= a[6] << 28; | 262 | a32[4] |= a[6] << 28; |
263 | a32[4] &= 0xffffffff; | 263 | a32[4] &= 0xffffffff; |
264 | a32[5] = (sp_digit)(a[6] >> 4); | 264 | a32[5] = (sp_digit)(a[6] >> 4); |
265 | a32[5] |= a[7] << 22; | 265 | a32[5] |= a[7] << 22; |
266 | a32[5] &= 0xffffffff; | 266 | a32[5] &= 0xffffffff; |
267 | a32[6] = (sp_digit)(a[7] >> 10); | 267 | a32[6] = (sp_digit)(a[7] >> 10); |
268 | a32[6] |= a[8] << 16; | 268 | a32[6] |= a[8] << 16; |
269 | a32[6] &= 0xffffffff; | 269 | a32[6] &= 0xffffffff; |
270 | a32[7] = (sp_digit)(a[8] >> 16); | 270 | a32[7] = (sp_digit)(a[8] >> 16); |
271 | a32[7] |= a[9] << 10; | 271 | a32[7] |= a[9] << 10; |
272 | a32[7] &= 0xffffffff; | 272 | a32[7] &= 0xffffffff; |
273 | 273 | ||
274 | /* 1 1 0 -1 -1 -1 -1 0 */ | 274 | /* 1 1 0 -1 -1 -1 -1 0 */ |
275 | t[0] = 0 + a32[0] + a32[1] - a32[3] - a32[4] - a32[5] - a32[6]; | 275 | t[0] = 0 + a32[0] + a32[1] - a32[3] - a32[4] - a32[5] - a32[6]; |
276 | /* 0 1 1 0 -1 -1 -1 -1 */ | 276 | /* 0 1 1 0 -1 -1 -1 -1 */ |
277 | t[1] = 0 + a32[1] + a32[2] - a32[4] - a32[5] - a32[6] - a32[7]; | 277 | t[1] = 0 + a32[1] + a32[2] - a32[4] - a32[5] - a32[6] - a32[7]; |
278 | /* 0 0 1 1 0 -1 -1 -1 */ | 278 | /* 0 0 1 1 0 -1 -1 -1 */ |
279 | t[2] = 0 + a32[2] + a32[3] - a32[5] - a32[6] - a32[7]; | 279 | t[2] = 0 + a32[2] + a32[3] - a32[5] - a32[6] - a32[7]; |
280 | /* -1 -1 0 2 2 1 0 -1 */ | 280 | /* -1 -1 0 2 2 1 0 -1 */ |
281 | t[3] = 0 - a32[0] - a32[1] + 2 * a32[3] + 2 * a32[4] + a32[5] - a32[7]; | 281 | t[3] = 0 - a32[0] - a32[1] + 2 * a32[3] + 2 * a32[4] + a32[5] - a32[7]; |
282 | /* 0 -1 -1 0 2 2 1 0 */ | 282 | /* 0 -1 -1 0 2 2 1 0 */ |
283 | t[4] = 0 - a32[1] - a32[2] + 2 * a32[4] + 2 * a32[5] + a32[6]; | 283 | t[4] = 0 - a32[1] - a32[2] + 2 * a32[4] + 2 * a32[5] + a32[6]; |
284 | /* 0 0 -1 -1 0 2 2 1 */ | 284 | /* 0 0 -1 -1 0 2 2 1 */ |
285 | t[5] = 0 - a32[2] - a32[3] + 2 * a32[5] + 2 * a32[6] + a32[7]; | 285 | t[5] = 0 - a32[2] - a32[3] + 2 * a32[5] + 2 * a32[6] + a32[7]; |
286 | /* -1 -1 0 0 0 1 3 2 */ | 286 | /* -1 -1 0 0 0 1 3 2 */ |
287 | t[6] = 0 - a32[0] - a32[1] + a32[5] + 3 * a32[6] + 2 * a32[7]; | 287 | t[6] = 0 - a32[0] - a32[1] + a32[5] + 3 * a32[6] + 2 * a32[7]; |
288 | /* 1 0 -1 -1 -1 -1 0 3 */ | 288 | /* 1 0 -1 -1 -1 -1 0 3 */ |
289 | t[7] = 0 + a32[0] - a32[2] - a32[3] - a32[4] - a32[5] + 3 * a32[7]; | 289 | t[7] = 0 + a32[0] - a32[2] - a32[3] - a32[4] - a32[5] + 3 * a32[7]; |
290 | 290 | ||
291 | t[1] += t[0] >> 32; t[0] &= 0xffffffff; | 291 | t[1] += t[0] >> 32; t[0] &= 0xffffffff; |
292 | t[2] += t[1] >> 32; t[1] &= 0xffffffff; | 292 | t[2] += t[1] >> 32; t[1] &= 0xffffffff; |
293 | t[3] += t[2] >> 32; t[2] &= 0xffffffff; | 293 | t[3] += t[2] >> 32; t[2] &= 0xffffffff; |
294 | t[4] += t[3] >> 32; t[3] &= 0xffffffff; | 294 | t[4] += t[3] >> 32; t[3] &= 0xffffffff; |
295 | t[5] += t[4] >> 32; t[4] &= 0xffffffff; | 295 | t[5] += t[4] >> 32; t[4] &= 0xffffffff; |
296 | t[6] += t[5] >> 32; t[5] &= 0xffffffff; | 296 | t[6] += t[5] >> 32; t[5] &= 0xffffffff; |
297 | t[7] += t[6] >> 32; t[6] &= 0xffffffff; | 297 | t[7] += t[6] >> 32; t[6] &= 0xffffffff; |
298 | o = t[7] >> 32; t[7] &= 0xffffffff; | 298 | o = t[7] >> 32; t[7] &= 0xffffffff; |
299 | t[0] += o; | 299 | t[0] += o; |
300 | t[3] -= o; | 300 | t[3] -= o; |
301 | t[6] -= o; | 301 | t[6] -= o; |
302 | t[7] += o; | 302 | t[7] += o; |
303 | t[1] += t[0] >> 32; t[0] &= 0xffffffff; | 303 | t[1] += t[0] >> 32; t[0] &= 0xffffffff; |
304 | t[2] += t[1] >> 32; t[1] &= 0xffffffff; | 304 | t[2] += t[1] >> 32; t[1] &= 0xffffffff; |
305 | t[3] += t[2] >> 32; t[2] &= 0xffffffff; | 305 | t[3] += t[2] >> 32; t[2] &= 0xffffffff; |
306 | t[4] += t[3] >> 32; t[3] &= 0xffffffff; | 306 | t[4] += t[3] >> 32; t[3] &= 0xffffffff; |
307 | t[5] += t[4] >> 32; t[4] &= 0xffffffff; | 307 | t[5] += t[4] >> 32; t[4] &= 0xffffffff; |
308 | t[6] += t[5] >> 32; t[5] &= 0xffffffff; | 308 | t[6] += t[5] >> 32; t[5] &= 0xffffffff; |
309 | t[7] += t[6] >> 32; t[6] &= 0xffffffff; | 309 | t[7] += t[6] >> 32; t[6] &= 0xffffffff; |
310 | 310 | ||
311 | r[0] = (sp_digit)(t[0]) & 0x3ffffff; | 311 | r[0] = (sp_digit)(t[0]) & 0x3ffffff; |
312 | r[1] = (sp_digit)(t[0] >> 26); | 312 | r[1] = (sp_digit)(t[0] >> 26); |
313 | r[1] |= t[1] << 6; | 313 | r[1] |= t[1] << 6; |
314 | r[1] &= 0x3ffffff; | 314 | r[1] &= 0x3ffffff; |
315 | r[2] = (sp_digit)(t[1] >> 20); | 315 | r[2] = (sp_digit)(t[1] >> 20); |
316 | r[2] |= t[2] << 12; | 316 | r[2] |= t[2] << 12; |
317 | r[2] &= 0x3ffffff; | 317 | r[2] &= 0x3ffffff; |
318 | r[3] = (sp_digit)(t[2] >> 14); | 318 | r[3] = (sp_digit)(t[2] >> 14); |
319 | r[3] |= t[3] << 18; | 319 | r[3] |= t[3] << 18; |
320 | r[3] &= 0x3ffffff; | 320 | r[3] &= 0x3ffffff; |
321 | r[4] = (sp_digit)(t[3] >> 8); | 321 | r[4] = (sp_digit)(t[3] >> 8); |
322 | r[4] |= t[4] << 24; | 322 | r[4] |= t[4] << 24; |
323 | r[4] &= 0x3ffffff; | 323 | r[4] &= 0x3ffffff; |
324 | r[5] = (sp_digit)(t[4] >> 2) & 0x3ffffff; | 324 | r[5] = (sp_digit)(t[4] >> 2) & 0x3ffffff; |
325 | r[6] = (sp_digit)(t[4] >> 28); | 325 | r[6] = (sp_digit)(t[4] >> 28); |
326 | r[6] |= t[5] << 4; | 326 | r[6] |= t[5] << 4; |
327 | r[6] &= 0x3ffffff; | 327 | r[6] &= 0x3ffffff; |
328 | r[7] = (sp_digit)(t[5] >> 22); | 328 | r[7] = (sp_digit)(t[5] >> 22); |
329 | r[7] |= t[6] << 10; | 329 | r[7] |= t[6] << 10; |
330 | r[7] &= 0x3ffffff; | 330 | r[7] &= 0x3ffffff; |
331 | r[8] = (sp_digit)(t[6] >> 16); | 331 | r[8] = (sp_digit)(t[6] >> 16); |
332 | r[8] |= t[7] << 16; | 332 | r[8] |= t[7] << 16; |
333 | r[8] &= 0x3ffffff; | 333 | r[8] &= 0x3ffffff; |
334 | r[9] = (sp_digit)(t[7] >> 10); | 334 | r[9] = (sp_digit)(t[7] >> 10); |
335 | } | 335 | } |
336 | 336 | ||
337 | /* Mul a by scalar b and add into r. (r += a * b) */ | 337 | /* Mul a by scalar b and add into r. (r += a * b) */ |
338 | static void sp_256_mul_add_10(sp_digit* r, const sp_digit* a, sp_digit b) | 338 | static void sp_256_mul_add_10(sp_digit* r, const sp_digit* a, sp_digit b) |
339 | { | 339 | { |
340 | int64_t tb = b; | 340 | int64_t tb = b; |
341 | int64_t t = 0; | 341 | int64_t t = 0; |
342 | int i; | 342 | int i; |
343 | 343 | ||
344 | for (i = 0; i < 10; i++) { | 344 | for (i = 0; i < 10; i++) { |
345 | t += (tb * a[i]) + r[i]; | 345 | t += (tb * a[i]) + r[i]; |
346 | r[i] = t & 0x3ffffff; | 346 | r[i] = t & 0x3ffffff; |
347 | t >>= 26; | 347 | t >>= 26; |
348 | } | 348 | } |
349 | r[10] += t; | 349 | r[10] += t; |
350 | } | 350 | } |
351 | 351 | ||
352 | /* Divide the number by 2 mod the modulus (prime). (r = a / 2 % m) */ | 352 | /* Divide the number by 2 mod the modulus (prime). (r = a / 2 % m) */ |
353 | static void sp_256_div2_10(sp_digit* r, const sp_digit* a, const sp_digit* m) | 353 | static void sp_256_div2_10(sp_digit* r, const sp_digit* a, const sp_digit* m) |
354 | { | 354 | { |
355 | sp_256_cond_add_10(r, a, m, 0 - (a[0] & 1)); | 355 | sp_256_cond_add_10(r, a, m, 0 - (a[0] & 1)); |
356 | sp_256_norm_10(r); | 356 | sp_256_norm_10(r); |
357 | sp_256_rshift1_10(r, r); | 357 | sp_256_rshift1_10(r, r); |
358 | } | 358 | } |
359 | 359 | ||
360 | /* Shift the result in the high 256 bits down to the bottom. */ | 360 | /* Shift the result in the high 256 bits down to the bottom. */ |
361 | static void sp_256_mont_shift_10(sp_digit* r, const sp_digit* a) | 361 | static void sp_256_mont_shift_10(sp_digit* r, const sp_digit* a) |
362 | { | 362 | { |
363 | int i; | 363 | int i; |
364 | sp_digit n, s; | 364 | sp_digit n, s; |
365 | 365 | ||
366 | s = a[10]; | 366 | s = a[10]; |
367 | n = a[9] >> 22; | 367 | n = a[9] >> 22; |
368 | for (i = 0; i < 9; i++) { | 368 | for (i = 0; i < 9; i++) { |
369 | n += (s & 0x3ffffff) << 4; | 369 | n += (s & 0x3ffffff) << 4; |
370 | r[i] = n & 0x3ffffff; | 370 | r[i] = n & 0x3ffffff; |
371 | n >>= 26; | 371 | n >>= 26; |
372 | s = a[11 + i] + (s >> 26); | 372 | s = a[11 + i] + (s >> 26); |
373 | } | 373 | } |
374 | n += s << 4; | 374 | n += s << 4; |
375 | r[9] = n; | 375 | r[9] = n; |
376 | memset(&r[10], 0, sizeof(*r) * 10); | 376 | memset(&r[10], 0, sizeof(*r) * 10); |
377 | } | 377 | } |
378 | 378 | ||
379 | /* Add two Montgomery form numbers (r = a + b % m) */ | 379 | /* Add two Montgomery form numbers (r = a + b % m) */ |
380 | static void sp_256_mont_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b, | 380 | static void sp_256_mont_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b, |
381 | const sp_digit* m) | 381 | const sp_digit* m) |
382 | { | 382 | { |
383 | sp_256_add_10(r, a, b); | 383 | sp_256_add_10(r, a, b); |
384 | sp_256_norm_10(r); | 384 | sp_256_norm_10(r); |
385 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); | 385 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); |
386 | sp_256_norm_10(r); | 386 | sp_256_norm_10(r); |
387 | } | 387 | } |
388 | 388 | ||
389 | /* Double a Montgomery form number (r = a + a % m) */ | 389 | /* Double a Montgomery form number (r = a + a % m) */ |
390 | static void sp_256_mont_dbl_10(sp_digit* r, const sp_digit* a, const sp_digit* m) | 390 | static void sp_256_mont_dbl_10(sp_digit* r, const sp_digit* a, const sp_digit* m) |
391 | { | 391 | { |
392 | sp_256_add_10(r, a, a); | 392 | sp_256_add_10(r, a, a); |
393 | sp_256_norm_10(r); | 393 | sp_256_norm_10(r); |
394 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); | 394 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); |
395 | sp_256_norm_10(r); | 395 | sp_256_norm_10(r); |
396 | } | 396 | } |
397 | 397 | ||
398 | /* Triple a Montgomery form number (r = a + a + a % m) */ | 398 | /* Triple a Montgomery form number (r = a + a + a % m) */ |
399 | static void sp_256_mont_tpl_10(sp_digit* r, const sp_digit* a, const sp_digit* m) | 399 | static void sp_256_mont_tpl_10(sp_digit* r, const sp_digit* a, const sp_digit* m) |
400 | { | 400 | { |
401 | sp_256_add_10(r, a, a); | 401 | sp_256_add_10(r, a, a); |
402 | sp_256_norm_10(r); | 402 | sp_256_norm_10(r); |
403 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); | 403 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); |
404 | sp_256_norm_10(r); | 404 | sp_256_norm_10(r); |
405 | sp_256_add_10(r, r, a); | 405 | sp_256_add_10(r, r, a); |
406 | sp_256_norm_10(r); | 406 | sp_256_norm_10(r); |
407 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); | 407 | sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); |
408 | sp_256_norm_10(r); | 408 | sp_256_norm_10(r); |
409 | } | 409 | } |
410 | 410 | ||
411 | /* Sub b from a into r. (r = a - b) */ | 411 | /* Sub b from a into r. (r = a - b) */ |
412 | static void sp_256_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b) | 412 | static void sp_256_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b) |
413 | { | 413 | { |
414 | int i; | 414 | int i; |
415 | for (i = 0; i < 10; i++) | 415 | for (i = 0; i < 10; i++) |
416 | r[i] = a[i] - b[i]; | 416 | r[i] = a[i] - b[i]; |
417 | } | 417 | } |
418 | 418 | ||
419 | /* Subtract two Montgomery form numbers (r = a - b % m) */ | 419 | /* Subtract two Montgomery form numbers (r = a - b % m) */ |
420 | static void sp_256_mont_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b, | 420 | static void sp_256_mont_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b, |
421 | const sp_digit* m) | 421 | const sp_digit* m) |
422 | { | 422 | { |
423 | sp_256_sub_10(r, a, b); | 423 | sp_256_sub_10(r, a, b); |
424 | sp_256_cond_add_10(r, r, m, r[9] >> 22); | 424 | sp_256_cond_add_10(r, r, m, r[9] >> 22); |
425 | sp_256_norm_10(r); | 425 | sp_256_norm_10(r); |
426 | } | 426 | } |
427 | 427 | ||
428 | /* Reduce the number back to 256 bits using Montgomery reduction. | 428 | /* Reduce the number back to 256 bits using Montgomery reduction. |
@@ -433,60 +433,60 @@ static void sp_256_mont_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b | |||
433 | */ | 433 | */ |
434 | static void sp_256_mont_reduce_10(sp_digit* a, const sp_digit* m, sp_digit mp) | 434 | static void sp_256_mont_reduce_10(sp_digit* a, const sp_digit* m, sp_digit mp) |
435 | { | 435 | { |
436 | int i; | 436 | int i; |
437 | sp_digit mu; | 437 | sp_digit mu; |
438 | 438 | ||
439 | if (mp != 1) { | 439 | if (mp != 1) { |
440 | for (i = 0; i < 9; i++) { | 440 | for (i = 0; i < 9; i++) { |
441 | mu = (a[i] * mp) & 0x3ffffff; | 441 | mu = (a[i] * mp) & 0x3ffffff; |
442 | sp_256_mul_add_10(a+i, m, mu); | 442 | sp_256_mul_add_10(a+i, m, mu); |
443 | a[i+1] += a[i] >> 26; | 443 | a[i+1] += a[i] >> 26; |
444 | } | 444 | } |
445 | mu = (a[i] * mp) & 0x3fffffl; | 445 | mu = (a[i] * mp) & 0x3fffffl; |
446 | sp_256_mul_add_10(a+i, m, mu); | 446 | sp_256_mul_add_10(a+i, m, mu); |
447 | a[i+1] += a[i] >> 26; | 447 | a[i+1] += a[i] >> 26; |
448 | a[i] &= 0x3ffffff; | 448 | a[i] &= 0x3ffffff; |
449 | } | 449 | } |
450 | else { | 450 | else { |
451 | for (i = 0; i < 9; i++) { | 451 | for (i = 0; i < 9; i++) { |
452 | mu = a[i] & 0x3ffffff; | 452 | mu = a[i] & 0x3ffffff; |
453 | sp_256_mul_add_10(a+i, p256_mod, mu); | 453 | sp_256_mul_add_10(a+i, p256_mod, mu); |
454 | a[i+1] += a[i] >> 26; | 454 | a[i+1] += a[i] >> 26; |
455 | } | 455 | } |
456 | mu = a[i] & 0x3fffffl; | 456 | mu = a[i] & 0x3fffffl; |
457 | sp_256_mul_add_10(a+i, p256_mod, mu); | 457 | sp_256_mul_add_10(a+i, p256_mod, mu); |
458 | a[i+1] += a[i] >> 26; | 458 | a[i+1] += a[i] >> 26; |
459 | a[i] &= 0x3ffffff; | 459 | a[i] &= 0x3ffffff; |
460 | } | 460 | } |
461 | 461 | ||
462 | sp_256_mont_shift_10(a, a); | 462 | sp_256_mont_shift_10(a, a); |
463 | sp_256_cond_sub_10(a, a, m, 0 - ((a[9] >> 22) > 0)); | 463 | sp_256_cond_sub_10(a, a, m, 0 - ((a[9] >> 22) > 0)); |
464 | sp_256_norm_10(a); | 464 | sp_256_norm_10(a); |
465 | } | 465 | } |
466 | 466 | ||
467 | /* Multiply a and b into r. (r = a * b) */ | 467 | /* Multiply a and b into r. (r = a * b) */ |
468 | static void sp_256_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b) | 468 | static void sp_256_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b) |
469 | { | 469 | { |
470 | int i, j, k; | 470 | int i, j, k; |
471 | int64_t c; | 471 | int64_t c; |
472 | 472 | ||
473 | c = ((int64_t)a[9]) * b[9]; | 473 | c = ((int64_t)a[9]) * b[9]; |
474 | r[19] = (sp_digit)(c >> 26); | 474 | r[19] = (sp_digit)(c >> 26); |
475 | c = (c & 0x3ffffff) << 26; | 475 | c = (c & 0x3ffffff) << 26; |
476 | for (k = 17; k >= 0; k--) { | 476 | for (k = 17; k >= 0; k--) { |
477 | for (i = 9; i >= 0; i--) { | 477 | for (i = 9; i >= 0; i--) { |
478 | j = k - i; | 478 | j = k - i; |
479 | if (j >= 10) | 479 | if (j >= 10) |
480 | break; | 480 | break; |
481 | if (j < 0) | 481 | if (j < 0) |
482 | continue; | 482 | continue; |
483 | c += ((int64_t)a[i]) * b[j]; | 483 | c += ((int64_t)a[i]) * b[j]; |
484 | } | 484 | } |
485 | r[k + 2] += c >> 52; | 485 | r[k + 2] += c >> 52; |
486 | r[k + 1] = (c >> 26) & 0x3ffffff; | 486 | r[k + 1] = (c >> 26) & 0x3ffffff; |
487 | c = (c & 0x3ffffff) << 26; | 487 | c = (c & 0x3ffffff) << 26; |
488 | } | 488 | } |
489 | r[0] = (sp_digit)(c >> 26); | 489 | r[0] = (sp_digit)(c >> 26); |
490 | } | 490 | } |
491 | 491 | ||
492 | /* Multiply two Montogmery form numbers mod the modulus (prime). | 492 | /* Multiply two Montogmery form numbers mod the modulus (prime). |
@@ -499,39 +499,39 @@ static void sp_256_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b) | |||
499 | * mp Montogmery mulitplier. | 499 | * mp Montogmery mulitplier. |
500 | */ | 500 | */ |
501 | static void sp_256_mont_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b, | 501 | static void sp_256_mont_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b, |
502 | const sp_digit* m, sp_digit mp) | 502 | const sp_digit* m, sp_digit mp) |
503 | { | 503 | { |
504 | sp_256_mul_10(r, a, b); | 504 | sp_256_mul_10(r, a, b); |
505 | sp_256_mont_reduce_10(r, m, mp); | 505 | sp_256_mont_reduce_10(r, m, mp); |
506 | } | 506 | } |
507 | 507 | ||
508 | /* Square a and put result in r. (r = a * a) */ | 508 | /* Square a and put result in r. (r = a * a) */ |
509 | static void sp_256_sqr_10(sp_digit* r, const sp_digit* a) | 509 | static void sp_256_sqr_10(sp_digit* r, const sp_digit* a) |
510 | { | 510 | { |
511 | int i, j, k; | 511 | int i, j, k; |
512 | int64_t c; | 512 | int64_t c; |
513 | 513 | ||
514 | c = ((int64_t)a[9]) * a[9]; | 514 | c = ((int64_t)a[9]) * a[9]; |
515 | r[19] = (sp_digit)(c >> 26); | 515 | r[19] = (sp_digit)(c >> 26); |
516 | c = (c & 0x3ffffff) << 26; | 516 | c = (c & 0x3ffffff) << 26; |
517 | for (k = 17; k >= 0; k--) { | 517 | for (k = 17; k >= 0; k--) { |
518 | for (i = 9; i >= 0; i--) { | 518 | for (i = 9; i >= 0; i--) { |
519 | j = k - i; | 519 | j = k - i; |
520 | if (j >= 10 || i <= j) | 520 | if (j >= 10 || i <= j) |
521 | break; | 521 | break; |
522 | if (j < 0) | 522 | if (j < 0) |
523 | continue; | 523 | continue; |
524 | 524 | ||
525 | c += ((int64_t)a[i]) * a[j] * 2; | 525 | c += ((int64_t)a[i]) * a[j] * 2; |
526 | } | 526 | } |
527 | if (i == j) | 527 | if (i == j) |
528 | c += ((int64_t)a[i]) * a[i]; | 528 | c += ((int64_t)a[i]) * a[i]; |
529 | 529 | ||
530 | r[k + 2] += c >> 52; | 530 | r[k + 2] += c >> 52; |
531 | r[k + 1] = (c >> 26) & 0x3ffffff; | 531 | r[k + 1] = (c >> 26) & 0x3ffffff; |
532 | c = (c & 0x3ffffff) << 26; | 532 | c = (c & 0x3ffffff) << 26; |
533 | } | 533 | } |
534 | r[0] = (sp_digit)(c >> 26); | 534 | r[0] = (sp_digit)(c >> 26); |
535 | } | 535 | } |
536 | 536 | ||
537 | /* Square the Montgomery form number. (r = a * a mod m) | 537 | /* Square the Montgomery form number. (r = a * a mod m) |
@@ -542,10 +542,10 @@ static void sp_256_sqr_10(sp_digit* r, const sp_digit* a) | |||
542 | * mp Montogmery mulitplier. | 542 | * mp Montogmery mulitplier. |
543 | */ | 543 | */ |
544 | static void sp_256_mont_sqr_10(sp_digit* r, const sp_digit* a, const sp_digit* m, | 544 | static void sp_256_mont_sqr_10(sp_digit* r, const sp_digit* a, const sp_digit* m, |
545 | sp_digit mp) | 545 | sp_digit mp) |
546 | { | 546 | { |
547 | sp_256_sqr_10(r, a); | 547 | sp_256_sqr_10(r, a); |
548 | sp_256_mont_reduce_10(r, m, mp); | 548 | sp_256_mont_reduce_10(r, m, mp); |
549 | } | 549 | } |
550 | 550 | ||
551 | /* Invert the number, in Montgomery form, modulo the modulus (prime) of the | 551 | /* Invert the number, in Montgomery form, modulo the modulus (prime) of the |
@@ -557,8 +557,8 @@ static void sp_256_mont_sqr_10(sp_digit* r, const sp_digit* a, const sp_digit* m | |||
557 | #if 0 | 557 | #if 0 |
558 | /* Mod-2 for the P256 curve. */ | 558 | /* Mod-2 for the P256 curve. */ |
559 | static const uint32_t p256_mod_2[8] = { | 559 | static const uint32_t p256_mod_2[8] = { |
560 | 0xfffffffd,0xffffffff,0xffffffff,0x00000000, | 560 | 0xfffffffd,0xffffffff,0xffffffff,0x00000000, |
561 | 0x00000000,0x00000000,0x00000001,0xffffffff, | 561 | 0x00000000,0x00000000,0x00000001,0xffffffff, |
562 | }; | 562 | }; |
563 | //Bit pattern: | 563 | //Bit pattern: |
564 | //2 2 2 2 2 2 2 1...1 | 564 | //2 2 2 2 2 2 2 1...1 |
@@ -568,17 +568,17 @@ static const uint32_t p256_mod_2[8] = { | |||
568 | #endif | 568 | #endif |
569 | static void sp_256_mont_inv_10(sp_digit* r, sp_digit* a) | 569 | static void sp_256_mont_inv_10(sp_digit* r, sp_digit* a) |
570 | { | 570 | { |
571 | sp_digit t[2*10]; //can be just [10]? | 571 | sp_digit t[2*10]; //can be just [10]? |
572 | int i; | 572 | int i; |
573 | 573 | ||
574 | memcpy(t, a, sizeof(sp_digit) * 10); | 574 | memcpy(t, a, sizeof(sp_digit) * 10); |
575 | for (i = 254; i >= 0; i--) { | 575 | for (i = 254; i >= 0; i--) { |
576 | sp_256_mont_sqr_10(t, t, p256_mod, p256_mp_mod); | 576 | sp_256_mont_sqr_10(t, t, p256_mod, p256_mp_mod); |
577 | /*if (p256_mod_2[i / 32] & ((sp_digit)1 << (i % 32)))*/ | 577 | /*if (p256_mod_2[i / 32] & ((sp_digit)1 << (i % 32)))*/ |
578 | if (i >= 224 || i == 192 || (i <= 95 && i != 1)) | 578 | if (i >= 224 || i == 192 || (i <= 95 && i != 1)) |
579 | sp_256_mont_mul_10(t, t, a, p256_mod, p256_mp_mod); | 579 | sp_256_mont_mul_10(t, t, a, p256_mod, p256_mp_mod); |
580 | } | 580 | } |
581 | memcpy(r, t, sizeof(sp_digit) * 10); | 581 | memcpy(r, t, sizeof(sp_digit) * 10); |
582 | } | 582 | } |
583 | 583 | ||
584 | /* Map the Montgomery form projective co-ordinate point to an affine point. | 584 | /* Map the Montgomery form projective co-ordinate point to an affine point. |
@@ -588,35 +588,35 @@ static void sp_256_mont_inv_10(sp_digit* r, sp_digit* a) | |||
588 | */ | 588 | */ |
589 | static void sp_256_map_10(sp_point* r, sp_point* p) | 589 | static void sp_256_map_10(sp_point* r, sp_point* p) |
590 | { | 590 | { |
591 | sp_digit t1[2*10]; | 591 | sp_digit t1[2*10]; |
592 | sp_digit t2[2*10]; | 592 | sp_digit t2[2*10]; |
593 | int32_t n; | 593 | int32_t n; |
594 | 594 | ||
595 | sp_256_mont_inv_10(t1, p->z); | 595 | sp_256_mont_inv_10(t1, p->z); |
596 | 596 | ||
597 | sp_256_mont_sqr_10(t2, t1, p256_mod, p256_mp_mod); | 597 | sp_256_mont_sqr_10(t2, t1, p256_mod, p256_mp_mod); |
598 | sp_256_mont_mul_10(t1, t2, t1, p256_mod, p256_mp_mod); | 598 | sp_256_mont_mul_10(t1, t2, t1, p256_mod, p256_mp_mod); |
599 | 599 | ||
600 | /* x /= z^2 */ | 600 | /* x /= z^2 */ |
601 | sp_256_mont_mul_10(r->x, p->x, t2, p256_mod, p256_mp_mod); | 601 | sp_256_mont_mul_10(r->x, p->x, t2, p256_mod, p256_mp_mod); |
602 | memset(r->x + 10, 0, sizeof(r->x) / 2); | 602 | memset(r->x + 10, 0, sizeof(r->x) / 2); |
603 | sp_256_mont_reduce_10(r->x, p256_mod, p256_mp_mod); | 603 | sp_256_mont_reduce_10(r->x, p256_mod, p256_mp_mod); |
604 | /* Reduce x to less than modulus */ | 604 | /* Reduce x to less than modulus */ |
605 | n = sp_256_cmp_10(r->x, p256_mod); | 605 | n = sp_256_cmp_10(r->x, p256_mod); |
606 | sp_256_cond_sub_10(r->x, r->x, p256_mod, 0 - (n >= 0)); | 606 | sp_256_cond_sub_10(r->x, r->x, p256_mod, 0 - (n >= 0)); |
607 | sp_256_norm_10(r->x); | 607 | sp_256_norm_10(r->x); |
608 | 608 | ||
609 | /* y /= z^3 */ | 609 | /* y /= z^3 */ |
610 | sp_256_mont_mul_10(r->y, p->y, t1, p256_mod, p256_mp_mod); | 610 | sp_256_mont_mul_10(r->y, p->y, t1, p256_mod, p256_mp_mod); |
611 | memset(r->y + 10, 0, sizeof(r->y) / 2); | 611 | memset(r->y + 10, 0, sizeof(r->y) / 2); |
612 | sp_256_mont_reduce_10(r->y, p256_mod, p256_mp_mod); | 612 | sp_256_mont_reduce_10(r->y, p256_mod, p256_mp_mod); |
613 | /* Reduce y to less than modulus */ | 613 | /* Reduce y to less than modulus */ |
614 | n = sp_256_cmp_10(r->y, p256_mod); | 614 | n = sp_256_cmp_10(r->y, p256_mod); |
615 | sp_256_cond_sub_10(r->y, r->y, p256_mod, 0 - (n >= 0)); | 615 | sp_256_cond_sub_10(r->y, r->y, p256_mod, 0 - (n >= 0)); |
616 | sp_256_norm_10(r->y); | 616 | sp_256_norm_10(r->y); |
617 | 617 | ||
618 | memset(r->z, 0, sizeof(r->z)); | 618 | memset(r->z, 0, sizeof(r->z)); |
619 | r->z[0] = 1; | 619 | r->z[0] = 1; |
620 | } | 620 | } |
621 | 621 | ||
622 | /* Double the Montgomery form projective point p. | 622 | /* Double the Montgomery form projective point p. |
@@ -626,54 +626,54 @@ static void sp_256_map_10(sp_point* r, sp_point* p) | |||
626 | */ | 626 | */ |
627 | static void sp_256_proj_point_dbl_10(sp_point* r, sp_point* p) | 627 | static void sp_256_proj_point_dbl_10(sp_point* r, sp_point* p) |
628 | { | 628 | { |
629 | sp_point tp; | 629 | sp_point tp; |
630 | sp_digit t1[2*10]; | 630 | sp_digit t1[2*10]; |
631 | sp_digit t2[2*10]; | 631 | sp_digit t2[2*10]; |
632 | 632 | ||
633 | /* Put point to double into result */ | 633 | /* Put point to double into result */ |
634 | if (r != p) | 634 | if (r != p) |
635 | *r = *p; /* struct copy */ | 635 | *r = *p; /* struct copy */ |
636 | 636 | ||
637 | if (r->infinity) { | 637 | if (r->infinity) { |
638 | /* If infinity, don't double (work on dummy value) */ | 638 | /* If infinity, don't double (work on dummy value) */ |
639 | r = &tp; | 639 | r = &tp; |
640 | } | 640 | } |
641 | /* T1 = Z * Z */ | 641 | /* T1 = Z * Z */ |
642 | sp_256_mont_sqr_10(t1, r->z, p256_mod, p256_mp_mod); | 642 | sp_256_mont_sqr_10(t1, r->z, p256_mod, p256_mp_mod); |
643 | /* Z = Y * Z */ | 643 | /* Z = Y * Z */ |
644 | sp_256_mont_mul_10(r->z, r->y, r->z, p256_mod, p256_mp_mod); | 644 | sp_256_mont_mul_10(r->z, r->y, r->z, p256_mod, p256_mp_mod); |
645 | /* Z = 2Z */ | 645 | /* Z = 2Z */ |
646 | sp_256_mont_dbl_10(r->z, r->z, p256_mod); | 646 | sp_256_mont_dbl_10(r->z, r->z, p256_mod); |
647 | /* T2 = X - T1 */ | 647 | /* T2 = X - T1 */ |
648 | sp_256_mont_sub_10(t2, r->x, t1, p256_mod); | 648 | sp_256_mont_sub_10(t2, r->x, t1, p256_mod); |
649 | /* T1 = X + T1 */ | 649 | /* T1 = X + T1 */ |
650 | sp_256_mont_add_10(t1, r->x, t1, p256_mod); | 650 | sp_256_mont_add_10(t1, r->x, t1, p256_mod); |
651 | /* T2 = T1 * T2 */ | 651 | /* T2 = T1 * T2 */ |
652 | sp_256_mont_mul_10(t2, t1, t2, p256_mod, p256_mp_mod); | 652 | sp_256_mont_mul_10(t2, t1, t2, p256_mod, p256_mp_mod); |
653 | /* T1 = 3T2 */ | 653 | /* T1 = 3T2 */ |
654 | sp_256_mont_tpl_10(t1, t2, p256_mod); | 654 | sp_256_mont_tpl_10(t1, t2, p256_mod); |
655 | /* Y = 2Y */ | 655 | /* Y = 2Y */ |
656 | sp_256_mont_dbl_10(r->y, r->y, p256_mod); | 656 | sp_256_mont_dbl_10(r->y, r->y, p256_mod); |
657 | /* Y = Y * Y */ | 657 | /* Y = Y * Y */ |
658 | sp_256_mont_sqr_10(r->y, r->y, p256_mod, p256_mp_mod); | 658 | sp_256_mont_sqr_10(r->y, r->y, p256_mod, p256_mp_mod); |
659 | /* T2 = Y * Y */ | 659 | /* T2 = Y * Y */ |
660 | sp_256_mont_sqr_10(t2, r->y, p256_mod, p256_mp_mod); | 660 | sp_256_mont_sqr_10(t2, r->y, p256_mod, p256_mp_mod); |
661 | /* T2 = T2/2 */ | 661 | /* T2 = T2/2 */ |
662 | sp_256_div2_10(t2, t2, p256_mod); | 662 | sp_256_div2_10(t2, t2, p256_mod); |
663 | /* Y = Y * X */ | 663 | /* Y = Y * X */ |
664 | sp_256_mont_mul_10(r->y, r->y, r->x, p256_mod, p256_mp_mod); | 664 | sp_256_mont_mul_10(r->y, r->y, r->x, p256_mod, p256_mp_mod); |
665 | /* X = T1 * T1 */ | 665 | /* X = T1 * T1 */ |
666 | sp_256_mont_mul_10(r->x, t1, t1, p256_mod, p256_mp_mod); | 666 | sp_256_mont_mul_10(r->x, t1, t1, p256_mod, p256_mp_mod); |
667 | /* X = X - Y */ | 667 | /* X = X - Y */ |
668 | sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod); | 668 | sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod); |
669 | /* X = X - Y */ | 669 | /* X = X - Y */ |
670 | sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod); | 670 | sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod); |
671 | /* Y = Y - X */ | 671 | /* Y = Y - X */ |
672 | sp_256_mont_sub_10(r->y, r->y, r->x, p256_mod); | 672 | sp_256_mont_sub_10(r->y, r->y, r->x, p256_mod); |
673 | /* Y = Y * T1 */ | 673 | /* Y = Y * T1 */ |
674 | sp_256_mont_mul_10(r->y, r->y, t1, p256_mod, p256_mp_mod); | 674 | sp_256_mont_mul_10(r->y, r->y, t1, p256_mod, p256_mp_mod); |
675 | /* Y = Y - T2 */ | 675 | /* Y = Y - T2 */ |
676 | sp_256_mont_sub_10(r->y, r->y, t2, p256_mod); | 676 | sp_256_mont_sub_10(r->y, r->y, t2, p256_mod); |
677 | } | 677 | } |
678 | 678 | ||
679 | /* Add two Montgomery form projective points. | 679 | /* Add two Montgomery form projective points. |
@@ -684,73 +684,73 @@ static void sp_256_proj_point_dbl_10(sp_point* r, sp_point* p) | |||
684 | */ | 684 | */ |
685 | static void sp_256_proj_point_add_10(sp_point* r, sp_point* p, sp_point* q) | 685 | static void sp_256_proj_point_add_10(sp_point* r, sp_point* p, sp_point* q) |
686 | { | 686 | { |
687 | sp_digit t1[2*10]; | 687 | sp_digit t1[2*10]; |
688 | sp_digit t2[2*10]; | 688 | sp_digit t2[2*10]; |
689 | sp_digit t3[2*10]; | 689 | sp_digit t3[2*10]; |
690 | sp_digit t4[2*10]; | 690 | sp_digit t4[2*10]; |
691 | sp_digit t5[2*10]; | 691 | sp_digit t5[2*10]; |
692 | 692 | ||
693 | /* Ensure only the first point is the same as the result. */ | 693 | /* Ensure only the first point is the same as the result. */ |
694 | if (q == r) { | 694 | if (q == r) { |
695 | sp_point* a = p; | 695 | sp_point* a = p; |
696 | p = q; | 696 | p = q; |
697 | q = a; | 697 | q = a; |
698 | } | 698 | } |
699 | 699 | ||
700 | /* Check double */ | 700 | /* Check double */ |
701 | sp_256_sub_10(t1, p256_mod, q->y); | 701 | sp_256_sub_10(t1, p256_mod, q->y); |
702 | sp_256_norm_10(t1); | 702 | sp_256_norm_10(t1); |
703 | if (sp_256_cmp_equal_10(p->x, q->x) | 703 | if (sp_256_cmp_equal_10(p->x, q->x) |
704 | && sp_256_cmp_equal_10(p->z, q->z) | 704 | && sp_256_cmp_equal_10(p->z, q->z) |
705 | && (sp_256_cmp_equal_10(p->y, q->y) || sp_256_cmp_equal_10(p->y, t1)) | 705 | && (sp_256_cmp_equal_10(p->y, q->y) || sp_256_cmp_equal_10(p->y, t1)) |
706 | ) { | 706 | ) { |
707 | sp_256_proj_point_dbl_10(r, p); | 707 | sp_256_proj_point_dbl_10(r, p); |
708 | } | 708 | } |
709 | else { | 709 | else { |
710 | sp_point tp; | 710 | sp_point tp; |
711 | sp_point *v; | 711 | sp_point *v; |
712 | 712 | ||
713 | v = r; | 713 | v = r; |
714 | if (p->infinity | q->infinity) { | 714 | if (p->infinity | q->infinity) { |
715 | memset(&tp, 0, sizeof(tp)); | 715 | memset(&tp, 0, sizeof(tp)); |
716 | v = &tp; | 716 | v = &tp; |
717 | } | 717 | } |
718 | 718 | ||
719 | *r = p->infinity ? *q : *p; /* struct copy */ | 719 | *r = p->infinity ? *q : *p; /* struct copy */ |
720 | 720 | ||
721 | /* U1 = X1*Z2^2 */ | 721 | /* U1 = X1*Z2^2 */ |
722 | sp_256_mont_sqr_10(t1, q->z, p256_mod, p256_mp_mod); | 722 | sp_256_mont_sqr_10(t1, q->z, p256_mod, p256_mp_mod); |
723 | sp_256_mont_mul_10(t3, t1, q->z, p256_mod, p256_mp_mod); | 723 | sp_256_mont_mul_10(t3, t1, q->z, p256_mod, p256_mp_mod); |
724 | sp_256_mont_mul_10(t1, t1, v->x, p256_mod, p256_mp_mod); | 724 | sp_256_mont_mul_10(t1, t1, v->x, p256_mod, p256_mp_mod); |
725 | /* U2 = X2*Z1^2 */ | 725 | /* U2 = X2*Z1^2 */ |
726 | sp_256_mont_sqr_10(t2, v->z, p256_mod, p256_mp_mod); | 726 | sp_256_mont_sqr_10(t2, v->z, p256_mod, p256_mp_mod); |
727 | sp_256_mont_mul_10(t4, t2, v->z, p256_mod, p256_mp_mod); | 727 | sp_256_mont_mul_10(t4, t2, v->z, p256_mod, p256_mp_mod); |
728 | sp_256_mont_mul_10(t2, t2, q->x, p256_mod, p256_mp_mod); | 728 | sp_256_mont_mul_10(t2, t2, q->x, p256_mod, p256_mp_mod); |
729 | /* S1 = Y1*Z2^3 */ | 729 | /* S1 = Y1*Z2^3 */ |
730 | sp_256_mont_mul_10(t3, t3, v->y, p256_mod, p256_mp_mod); | 730 | sp_256_mont_mul_10(t3, t3, v->y, p256_mod, p256_mp_mod); |
731 | /* S2 = Y2*Z1^3 */ | 731 | /* S2 = Y2*Z1^3 */ |
732 | sp_256_mont_mul_10(t4, t4, q->y, p256_mod, p256_mp_mod); | 732 | sp_256_mont_mul_10(t4, t4, q->y, p256_mod, p256_mp_mod); |
733 | /* H = U2 - U1 */ | 733 | /* H = U2 - U1 */ |
734 | sp_256_mont_sub_10(t2, t2, t1, p256_mod); | 734 | sp_256_mont_sub_10(t2, t2, t1, p256_mod); |
735 | /* R = S2 - S1 */ | 735 | /* R = S2 - S1 */ |
736 | sp_256_mont_sub_10(t4, t4, t3, p256_mod); | 736 | sp_256_mont_sub_10(t4, t4, t3, p256_mod); |
737 | /* Z3 = H*Z1*Z2 */ | 737 | /* Z3 = H*Z1*Z2 */ |
738 | sp_256_mont_mul_10(v->z, v->z, q->z, p256_mod, p256_mp_mod); | 738 | sp_256_mont_mul_10(v->z, v->z, q->z, p256_mod, p256_mp_mod); |
739 | sp_256_mont_mul_10(v->z, v->z, t2, p256_mod, p256_mp_mod); | 739 | sp_256_mont_mul_10(v->z, v->z, t2, p256_mod, p256_mp_mod); |
740 | /* X3 = R^2 - H^3 - 2*U1*H^2 */ | 740 | /* X3 = R^2 - H^3 - 2*U1*H^2 */ |
741 | sp_256_mont_sqr_10(v->x, t4, p256_mod, p256_mp_mod); | 741 | sp_256_mont_sqr_10(v->x, t4, p256_mod, p256_mp_mod); |
742 | sp_256_mont_sqr_10(t5, t2, p256_mod, p256_mp_mod); | 742 | sp_256_mont_sqr_10(t5, t2, p256_mod, p256_mp_mod); |
743 | sp_256_mont_mul_10(v->y, t1, t5, p256_mod, p256_mp_mod); | 743 | sp_256_mont_mul_10(v->y, t1, t5, p256_mod, p256_mp_mod); |
744 | sp_256_mont_mul_10(t5, t5, t2, p256_mod, p256_mp_mod); | 744 | sp_256_mont_mul_10(t5, t5, t2, p256_mod, p256_mp_mod); |
745 | sp_256_mont_sub_10(v->x, v->x, t5, p256_mod); | 745 | sp_256_mont_sub_10(v->x, v->x, t5, p256_mod); |
746 | sp_256_mont_dbl_10(t1, v->y, p256_mod); | 746 | sp_256_mont_dbl_10(t1, v->y, p256_mod); |
747 | sp_256_mont_sub_10(v->x, v->x, t1, p256_mod); | 747 | sp_256_mont_sub_10(v->x, v->x, t1, p256_mod); |
748 | /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ | 748 | /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ |
749 | sp_256_mont_sub_10(v->y, v->y, v->x, p256_mod); | 749 | sp_256_mont_sub_10(v->y, v->y, v->x, p256_mod); |
750 | sp_256_mont_mul_10(v->y, v->y, t4, p256_mod, p256_mp_mod); | 750 | sp_256_mont_mul_10(v->y, v->y, t4, p256_mod, p256_mp_mod); |
751 | sp_256_mont_mul_10(t5, t5, t3, p256_mod, p256_mp_mod); | 751 | sp_256_mont_mul_10(t5, t5, t3, p256_mod, p256_mp_mod); |
752 | sp_256_mont_sub_10(v->y, v->y, t5, p256_mod); | 752 | sp_256_mont_sub_10(v->y, v->y, t5, p256_mod); |
753 | } | 753 | } |
754 | } | 754 | } |
755 | 755 | ||
756 | /* Multiply the point by the scalar and return the result. | 756 | /* Multiply the point by the scalar and return the result. |
@@ -763,48 +763,48 @@ static void sp_256_proj_point_add_10(sp_point* r, sp_point* p, sp_point* q) | |||
763 | */ | 763 | */ |
764 | static void sp_256_ecc_mulmod_10(sp_point* r, const sp_point* g, const sp_digit* k /*, int map*/) | 764 | static void sp_256_ecc_mulmod_10(sp_point* r, const sp_point* g, const sp_digit* k /*, int map*/) |
765 | { | 765 | { |
766 | enum { map = 1 }; /* we always convert result to affine coordinates */ | 766 | enum { map = 1 }; /* we always convert result to affine coordinates */ |
767 | sp_point t[3]; | 767 | sp_point t[3]; |
768 | sp_digit n; | 768 | sp_digit n; |
769 | int i; | 769 | int i; |
770 | int c, y; | 770 | int c, y; |
771 | 771 | ||
772 | memset(t, 0, sizeof(t)); | 772 | memset(t, 0, sizeof(t)); |
773 | 773 | ||
774 | /* t[0] = {0, 0, 1} * norm */ | 774 | /* t[0] = {0, 0, 1} * norm */ |
775 | t[0].infinity = 1; | 775 | t[0].infinity = 1; |
776 | /* t[1] = {g->x, g->y, g->z} * norm */ | 776 | /* t[1] = {g->x, g->y, g->z} * norm */ |
777 | sp_256_mod_mul_norm_10(t[1].x, g->x); | 777 | sp_256_mod_mul_norm_10(t[1].x, g->x); |
778 | sp_256_mod_mul_norm_10(t[1].y, g->y); | 778 | sp_256_mod_mul_norm_10(t[1].y, g->y); |
779 | sp_256_mod_mul_norm_10(t[1].z, g->z); | 779 | sp_256_mod_mul_norm_10(t[1].z, g->z); |
780 | 780 | ||
781 | i = 9; | 781 | i = 9; |
782 | c = 22; | 782 | c = 22; |
783 | n = k[i--] << (26 - c); | 783 | n = k[i--] << (26 - c); |
784 | for (; ; c--) { | 784 | for (; ; c--) { |
785 | if (c == 0) { | 785 | if (c == 0) { |
786 | if (i == -1) | 786 | if (i == -1) |
787 | break; | 787 | break; |
788 | 788 | ||
789 | n = k[i--]; | 789 | n = k[i--]; |
790 | c = 26; | 790 | c = 26; |
791 | } | 791 | } |
792 | 792 | ||
793 | y = (n >> 25) & 1; | 793 | y = (n >> 25) & 1; |
794 | n <<= 1; | 794 | n <<= 1; |
795 | 795 | ||
796 | sp_256_proj_point_add_10(&t[y^1], &t[0], &t[1]); | 796 | sp_256_proj_point_add_10(&t[y^1], &t[0], &t[1]); |
797 | memcpy(&t[2], &t[y], sizeof(sp_point)); | 797 | memcpy(&t[2], &t[y], sizeof(sp_point)); |
798 | sp_256_proj_point_dbl_10(&t[2], &t[2]); | 798 | sp_256_proj_point_dbl_10(&t[2], &t[2]); |
799 | memcpy(&t[y], &t[2], sizeof(sp_point)); | 799 | memcpy(&t[y], &t[2], sizeof(sp_point)); |
800 | } | 800 | } |
801 | 801 | ||
802 | if (map) | 802 | if (map) |
803 | sp_256_map_10(r, &t[0]); | 803 | sp_256_map_10(r, &t[0]); |
804 | else | 804 | else |
805 | memcpy(r, &t[0], sizeof(sp_point)); | 805 | memcpy(r, &t[0], sizeof(sp_point)); |
806 | 806 | ||
807 | memset(t, 0, sizeof(t)); //paranoia | 807 | memset(t, 0, sizeof(t)); //paranoia |
808 | } | 808 | } |
809 | 809 | ||
810 | /* Multiply the base point of P256 by the scalar and return the result. | 810 | /* Multiply the base point of P256 by the scalar and return the result. |
@@ -816,7 +816,7 @@ static void sp_256_ecc_mulmod_10(sp_point* r, const sp_point* g, const sp_digit* | |||
816 | */ | 816 | */ |
817 | static void sp_256_ecc_mulmod_base_10(sp_point* r, sp_digit* k /*, int map*/) | 817 | static void sp_256_ecc_mulmod_base_10(sp_point* r, sp_digit* k /*, int map*/) |
818 | { | 818 | { |
819 | sp_256_ecc_mulmod_10(r, &p256_base, k /*, map*/); | 819 | sp_256_ecc_mulmod_10(r, &p256_base, k /*, map*/); |
820 | } | 820 | } |
821 | 821 | ||
822 | /* Multiply the point by the scalar and serialize the X ordinate. | 822 | /* Multiply the point by the scalar and serialize the X ordinate. |
@@ -828,22 +828,22 @@ static void sp_256_ecc_mulmod_base_10(sp_point* r, sp_digit* k /*, int map*/) | |||
828 | */ | 828 | */ |
829 | static void sp_ecc_secret_gen_256(sp_digit priv[10], const uint8_t *pub2x32, uint8_t* out32) | 829 | static void sp_ecc_secret_gen_256(sp_digit priv[10], const uint8_t *pub2x32, uint8_t* out32) |
830 | { | 830 | { |
831 | sp_point point[1]; | 831 | sp_point point[1]; |
832 | 832 | ||
833 | #if FIXED_PEER_PUBKEY | 833 | #if FIXED_PEER_PUBKEY |
834 | memset((void*)pub2x32, 0x55, 64); | 834 | memset((void*)pub2x32, 0x55, 64); |
835 | #endif | 835 | #endif |
836 | dump_hex("peerkey %s\n", pub2x32, 32); /* in TLS, this is peer's public key */ | 836 | dump_hex("peerkey %s\n", pub2x32, 32); /* in TLS, this is peer's public key */ |
837 | dump_hex(" %s\n", pub2x32 + 32, 32); | 837 | dump_hex(" %s\n", pub2x32 + 32, 32); |
838 | 838 | ||
839 | sp_256_point_from_bin2x32(point, pub2x32); | 839 | sp_256_point_from_bin2x32(point, pub2x32); |
840 | dump_hex("point->x %s\n", point->x, sizeof(point->x)); | 840 | dump_hex("point->x %s\n", point->x, sizeof(point->x)); |
841 | dump_hex("point->y %s\n", point->y, sizeof(point->y)); | 841 | dump_hex("point->y %s\n", point->y, sizeof(point->y)); |
842 | 842 | ||
843 | sp_256_ecc_mulmod_10(point, point, priv); | 843 | sp_256_ecc_mulmod_10(point, point, priv); |
844 | 844 | ||
845 | sp_256_to_bin(point->x, out32); | 845 | sp_256_to_bin(point->x, out32); |
846 | dump_hex("out32: %s\n", out32, 32); | 846 | dump_hex("out32: %s\n", out32, 32); |
847 | } | 847 | } |
848 | 848 | ||
849 | /* Generates a scalar that is in the range 1..order-1. */ | 849 | /* Generates a scalar that is in the range 1..order-1. */ |
@@ -852,8 +852,8 @@ static void sp_ecc_secret_gen_256(sp_digit priv[10], const uint8_t *pub2x32, uin | |||
852 | #if !SIMPLIFY | 852 | #if !SIMPLIFY |
853 | static void sp_256_add_one_10(sp_digit* a) | 853 | static void sp_256_add_one_10(sp_digit* a) |
854 | { | 854 | { |
855 | a[0]++; | 855 | a[0]++; |
856 | sp_256_norm_10(a); | 856 | sp_256_norm_10(a); |
857 | } | 857 | } |
858 | #endif | 858 | #endif |
859 | static void sp_256_ecc_gen_k_10(sp_digit k[10]) | 859 | static void sp_256_ecc_gen_k_10(sp_digit k[10]) |