aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenys Vlasenko <vda.linux@googlemail.com>2021-04-26 20:24:34 +0200
committerDenys Vlasenko <vda.linux@googlemail.com>2021-04-26 20:24:34 +0200
commit120401249a37a77cd2d4c71ad20a9a194bfea409 (patch)
tree45f84378f495d53f6c160f33f117d333c9e2ee58
parent93b886f54bf85ca38f372ddd521f7c5bdbdc5d08 (diff)
downloadbusybox-w32-120401249a37a77cd2d4c71ad20a9a194bfea409.tar.gz
busybox-w32-120401249a37a77cd2d4c71ad20a9a194bfea409.tar.bz2
busybox-w32-120401249a37a77cd2d4c71ad20a9a194bfea409.zip
tls: fix whitespace in P256 code
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
-rw-r--r--networking/tls_sp_c32.c1002
1 files changed, 501 insertions, 501 deletions
diff --git a/networking/tls_sp_c32.c b/networking/tls_sp_c32.c
index 97b2d3de9..8527e7864 100644
--- a/networking/tls_sp_c32.c
+++ b/networking/tls_sp_c32.c
@@ -92,30 +92,30 @@ static const sp_point p256_base = {
92 */ 92 */
93static void sp_256_to_bin(sp_digit* r, uint8_t* a) 93static void sp_256_to_bin(sp_digit* r, uint8_t* a)
94{ 94{
95 int i, j, s = 0, b; 95 int i, j, s = 0, b;
96 96
97 for (i = 0; i < 9; i++) { 97 for (i = 0; i < 9; i++) {
98 r[i+1] += r[i] >> 26; 98 r[i+1] += r[i] >> 26;
99 r[i] &= 0x3ffffff; 99 r[i] &= 0x3ffffff;
100 } 100 }
101 j = 256 / 8 - 1; 101 j = 256 / 8 - 1;
102 a[j] = 0; 102 a[j] = 0;
103 for (i=0; i<10 && j>=0; i++) { 103 for (i = 0; i < 10 && j >= 0; i++) {
104 b = 0; 104 b = 0;
105 a[j--] |= r[i] << s; b += 8 - s; 105 a[j--] |= r[i] << s; b += 8 - s;
106 if (j < 0) 106 if (j < 0)
107 break; 107 break;
108 while (b < 26) { 108 while (b < 26) {
109 a[j--] = r[i] >> b; b += 8; 109 a[j--] = r[i] >> b; b += 8;
110 if (j < 0) 110 if (j < 0)
111 break; 111 break;
112 } 112 }
113 s = 8 - (b - 26); 113 s = 8 - (b - 26);
114 if (j >= 0) 114 if (j >= 0)
115 a[j] = 0; 115 a[j] = 0;
116 if (s != 0) 116 if (s != 0)
117 j++; 117 j++;
118 } 118 }
119} 119}
120 120
121/* Read big endian unsigned byte aray into r. 121/* Read big endian unsigned byte aray into r.
@@ -126,37 +126,37 @@ static void sp_256_to_bin(sp_digit* r, uint8_t* a)
126 */ 126 */
127static void sp_256_from_bin(sp_digit* r, int max, const uint8_t* a, int n) 127static void sp_256_from_bin(sp_digit* r, int max, const uint8_t* a, int n)
128{ 128{
129 int i, j = 0, s = 0; 129 int i, j = 0, s = 0;
130 130
131 r[0] = 0; 131 r[0] = 0;
132 for (i = n-1; i >= 0; i--) { 132 for (i = n-1; i >= 0; i--) {
133 r[j] |= ((sp_digit)a[i]) << s; 133 r[j] |= ((sp_digit)a[i]) << s;
134 if (s >= 18) { 134 if (s >= 18) {
135 r[j] &= 0x3ffffff; 135 r[j] &= 0x3ffffff;
136 s = 26 - s; 136 s = 26 - s;
137 if (j + 1 >= max) 137 if (j + 1 >= max)
138 break; 138 break;
139 r[++j] = a[i] >> s; 139 r[++j] = a[i] >> s;
140 s = 8 - s; 140 s = 8 - s;
141 } 141 }
142 else 142 else
143 s += 8; 143 s += 8;
144 } 144 }
145 145
146 for (j++; j < max; j++) 146 for (j++; j < max; j++)
147 r[j] = 0; 147 r[j] = 0;
148} 148}
149 149
150/* Convert a point of big-endian 32-byte x,y pair to type sp_point. */ 150/* Convert a point of big-endian 32-byte x,y pair to type sp_point. */
151static void sp_256_point_from_bin2x32(sp_point* p, const uint8_t *bin2x32) 151static void sp_256_point_from_bin2x32(sp_point* p, const uint8_t *bin2x32)
152{ 152{
153 memset(p, 0, sizeof(*p)); 153 memset(p, 0, sizeof(*p));
154 /*p->infinity = 0;*/ 154 /*p->infinity = 0;*/
155 sp_256_from_bin(p->x, 2 * 10, bin2x32, 32); 155 sp_256_from_bin(p->x, 2 * 10, bin2x32, 32);
156 sp_256_from_bin(p->y, 2 * 10, bin2x32 + 32, 32); 156 sp_256_from_bin(p->y, 2 * 10, bin2x32 + 32, 32);
157 //static const uint8_t one[1] = { 1 }; 157 //static const uint8_t one[1] = { 1 };
158 //sp_256_from_bin(p->z, 2 * 10, one, 1); 158 //sp_256_from_bin(p->z, 2 * 10, one, 1);
159 p->z[0] = 1; 159 p->z[0] = 1;
160} 160}
161 161
162/* Compare a with b. 162/* Compare a with b.
@@ -166,14 +166,14 @@ static void sp_256_point_from_bin2x32(sp_point* p, const uint8_t *bin2x32)
166 */ 166 */
167static sp_digit sp_256_cmp_10(const sp_digit* a, const sp_digit* b) 167static sp_digit sp_256_cmp_10(const sp_digit* a, const sp_digit* b)
168{ 168{
169 sp_digit r; 169 sp_digit r;
170 int i; 170 int i;
171 for (i = 9; i >= 0; i--) { 171 for (i = 9; i >= 0; i--) {
172 r = a[i] - b[i]; 172 r = a[i] - b[i];
173 if (r != 0) 173 if (r != 0)
174 break; 174 break;
175 } 175 }
176 return r; 176 return r;
177} 177}
178 178
179/* Compare two numbers to determine if they are equal. 179/* Compare two numbers to determine if they are equal.
@@ -182,56 +182,56 @@ static sp_digit sp_256_cmp_10(const sp_digit* a, const sp_digit* b)
182 */ 182 */
183static int sp_256_cmp_equal_10(const sp_digit* a, const sp_digit* b) 183static int sp_256_cmp_equal_10(const sp_digit* a, const sp_digit* b)
184{ 184{
185 return sp_256_cmp_10(a, b) == 0; 185 return sp_256_cmp_10(a, b) == 0;
186} 186}
187 187
188/* Normalize the values in each word to 26 bits. */ 188/* Normalize the values in each word to 26 bits. */
189static void sp_256_norm_10(sp_digit* a) 189static void sp_256_norm_10(sp_digit* a)
190{ 190{
191 int i; 191 int i;
192 for (i = 0; i < 9; i++) { 192 for (i = 0; i < 9; i++) {
193 a[i+1] += a[i] >> 26; 193 a[i+1] += a[i] >> 26;
194 a[i] &= 0x3ffffff; 194 a[i] &= 0x3ffffff;
195 } 195 }
196} 196}
197 197
198/* Add b to a into r. (r = a + b) */ 198/* Add b to a into r. (r = a + b) */
199static void sp_256_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b) 199static void sp_256_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b)
200{ 200{
201 int i; 201 int i;
202 for (i = 0; i < 10; i++) 202 for (i = 0; i < 10; i++)
203 r[i] = a[i] + b[i]; 203 r[i] = a[i] + b[i];
204} 204}
205 205
206/* Conditionally add a and b using the mask m. 206/* Conditionally add a and b using the mask m.
207 * m is -1 to add and 0 when not. 207 * m is -1 to add and 0 when not.
208 */ 208 */
209static void sp_256_cond_add_10(sp_digit* r, const sp_digit* a, 209static void sp_256_cond_add_10(sp_digit* r, const sp_digit* a,
210 const sp_digit* b, const sp_digit m) 210 const sp_digit* b, const sp_digit m)
211{ 211{
212 int i; 212 int i;
213 for (i = 0; i < 10; i++) 213 for (i = 0; i < 10; i++)
214 r[i] = a[i] + (b[i] & m); 214 r[i] = a[i] + (b[i] & m);
215} 215}
216 216
217/* Conditionally subtract b from a using the mask m. 217/* Conditionally subtract b from a using the mask m.
218 * m is -1 to subtract and 0 when not. 218 * m is -1 to subtract and 0 when not.
219 */ 219 */
220static void sp_256_cond_sub_10(sp_digit* r, const sp_digit* a, 220static void sp_256_cond_sub_10(sp_digit* r, const sp_digit* a,
221 const sp_digit* b, const sp_digit m) 221 const sp_digit* b, const sp_digit m)
222{ 222{
223 int i; 223 int i;
224 for (i = 0; i < 10; i++) 224 for (i = 0; i < 10; i++)
225 r[i] = a[i] - (b[i] & m); 225 r[i] = a[i] - (b[i] & m);
226} 226}
227 227
228/* Shift number left one bit. Bottom bit is lost. */ 228/* Shift number left one bit. Bottom bit is lost. */
229static void sp_256_rshift1_10(sp_digit* r, sp_digit* a) 229static void sp_256_rshift1_10(sp_digit* r, sp_digit* a)
230{ 230{
231 int i; 231 int i;
232 for (i = 0; i < 9; i++) 232 for (i = 0; i < 9; i++)
233 r[i] = ((a[i] >> 1) | (a[i + 1] << 25)) & 0x3ffffff; 233 r[i] = ((a[i] >> 1) | (a[i + 1] << 25)) & 0x3ffffff;
234 r[9] = a[9] >> 1; 234 r[9] = a[9] >> 1;
235} 235}
236 236
237/* Multiply a number by Montogmery normalizer mod modulus (prime). 237/* Multiply a number by Montogmery normalizer mod modulus (prime).
@@ -241,188 +241,188 @@ static void sp_256_rshift1_10(sp_digit* r, sp_digit* a)
241 */ 241 */
242static void sp_256_mod_mul_norm_10(sp_digit* r, const sp_digit* a) 242static void sp_256_mod_mul_norm_10(sp_digit* r, const sp_digit* a)
243{ 243{
244 int64_t t[8]; 244 int64_t t[8];
245 int64_t a32[8]; 245 int64_t a32[8];
246 int64_t o; 246 int64_t o;
247 247
248 a32[0] = a[0]; 248 a32[0] = a[0];
249 a32[0] |= a[1] << 26; 249 a32[0] |= a[1] << 26;
250 a32[0] &= 0xffffffff; 250 a32[0] &= 0xffffffff;
251 a32[1] = (sp_digit)(a[1] >> 6); 251 a32[1] = (sp_digit)(a[1] >> 6);
252 a32[1] |= a[2] << 20; 252 a32[1] |= a[2] << 20;
253 a32[1] &= 0xffffffff; 253 a32[1] &= 0xffffffff;
254 a32[2] = (sp_digit)(a[2] >> 12); 254 a32[2] = (sp_digit)(a[2] >> 12);
255 a32[2] |= a[3] << 14; 255 a32[2] |= a[3] << 14;
256 a32[2] &= 0xffffffff; 256 a32[2] &= 0xffffffff;
257 a32[3] = (sp_digit)(a[3] >> 18); 257 a32[3] = (sp_digit)(a[3] >> 18);
258 a32[3] |= a[4] << 8; 258 a32[3] |= a[4] << 8;
259 a32[3] &= 0xffffffff; 259 a32[3] &= 0xffffffff;
260 a32[4] = (sp_digit)(a[4] >> 24); 260 a32[4] = (sp_digit)(a[4] >> 24);
261 a32[4] |= a[5] << 2; 261 a32[4] |= a[5] << 2;
262 a32[4] |= a[6] << 28; 262 a32[4] |= a[6] << 28;
263 a32[4] &= 0xffffffff; 263 a32[4] &= 0xffffffff;
264 a32[5] = (sp_digit)(a[6] >> 4); 264 a32[5] = (sp_digit)(a[6] >> 4);
265 a32[5] |= a[7] << 22; 265 a32[5] |= a[7] << 22;
266 a32[5] &= 0xffffffff; 266 a32[5] &= 0xffffffff;
267 a32[6] = (sp_digit)(a[7] >> 10); 267 a32[6] = (sp_digit)(a[7] >> 10);
268 a32[6] |= a[8] << 16; 268 a32[6] |= a[8] << 16;
269 a32[6] &= 0xffffffff; 269 a32[6] &= 0xffffffff;
270 a32[7] = (sp_digit)(a[8] >> 16); 270 a32[7] = (sp_digit)(a[8] >> 16);
271 a32[7] |= a[9] << 10; 271 a32[7] |= a[9] << 10;
272 a32[7] &= 0xffffffff; 272 a32[7] &= 0xffffffff;
273 273
274 /* 1 1 0 -1 -1 -1 -1 0 */ 274 /* 1 1 0 -1 -1 -1 -1 0 */
275 t[0] = 0 + a32[0] + a32[1] - a32[3] - a32[4] - a32[5] - a32[6]; 275 t[0] = 0 + a32[0] + a32[1] - a32[3] - a32[4] - a32[5] - a32[6];
276 /* 0 1 1 0 -1 -1 -1 -1 */ 276 /* 0 1 1 0 -1 -1 -1 -1 */
277 t[1] = 0 + a32[1] + a32[2] - a32[4] - a32[5] - a32[6] - a32[7]; 277 t[1] = 0 + a32[1] + a32[2] - a32[4] - a32[5] - a32[6] - a32[7];
278 /* 0 0 1 1 0 -1 -1 -1 */ 278 /* 0 0 1 1 0 -1 -1 -1 */
279 t[2] = 0 + a32[2] + a32[3] - a32[5] - a32[6] - a32[7]; 279 t[2] = 0 + a32[2] + a32[3] - a32[5] - a32[6] - a32[7];
280 /* -1 -1 0 2 2 1 0 -1 */ 280 /* -1 -1 0 2 2 1 0 -1 */
281 t[3] = 0 - a32[0] - a32[1] + 2 * a32[3] + 2 * a32[4] + a32[5] - a32[7]; 281 t[3] = 0 - a32[0] - a32[1] + 2 * a32[3] + 2 * a32[4] + a32[5] - a32[7];
282 /* 0 -1 -1 0 2 2 1 0 */ 282 /* 0 -1 -1 0 2 2 1 0 */
283 t[4] = 0 - a32[1] - a32[2] + 2 * a32[4] + 2 * a32[5] + a32[6]; 283 t[4] = 0 - a32[1] - a32[2] + 2 * a32[4] + 2 * a32[5] + a32[6];
284 /* 0 0 -1 -1 0 2 2 1 */ 284 /* 0 0 -1 -1 0 2 2 1 */
285 t[5] = 0 - a32[2] - a32[3] + 2 * a32[5] + 2 * a32[6] + a32[7]; 285 t[5] = 0 - a32[2] - a32[3] + 2 * a32[5] + 2 * a32[6] + a32[7];
286 /* -1 -1 0 0 0 1 3 2 */ 286 /* -1 -1 0 0 0 1 3 2 */
287 t[6] = 0 - a32[0] - a32[1] + a32[5] + 3 * a32[6] + 2 * a32[7]; 287 t[6] = 0 - a32[0] - a32[1] + a32[5] + 3 * a32[6] + 2 * a32[7];
288 /* 1 0 -1 -1 -1 -1 0 3 */ 288 /* 1 0 -1 -1 -1 -1 0 3 */
289 t[7] = 0 + a32[0] - a32[2] - a32[3] - a32[4] - a32[5] + 3 * a32[7]; 289 t[7] = 0 + a32[0] - a32[2] - a32[3] - a32[4] - a32[5] + 3 * a32[7];
290 290
291 t[1] += t[0] >> 32; t[0] &= 0xffffffff; 291 t[1] += t[0] >> 32; t[0] &= 0xffffffff;
292 t[2] += t[1] >> 32; t[1] &= 0xffffffff; 292 t[2] += t[1] >> 32; t[1] &= 0xffffffff;
293 t[3] += t[2] >> 32; t[2] &= 0xffffffff; 293 t[3] += t[2] >> 32; t[2] &= 0xffffffff;
294 t[4] += t[3] >> 32; t[3] &= 0xffffffff; 294 t[4] += t[3] >> 32; t[3] &= 0xffffffff;
295 t[5] += t[4] >> 32; t[4] &= 0xffffffff; 295 t[5] += t[4] >> 32; t[4] &= 0xffffffff;
296 t[6] += t[5] >> 32; t[5] &= 0xffffffff; 296 t[6] += t[5] >> 32; t[5] &= 0xffffffff;
297 t[7] += t[6] >> 32; t[6] &= 0xffffffff; 297 t[7] += t[6] >> 32; t[6] &= 0xffffffff;
298 o = t[7] >> 32; t[7] &= 0xffffffff; 298 o = t[7] >> 32; t[7] &= 0xffffffff;
299 t[0] += o; 299 t[0] += o;
300 t[3] -= o; 300 t[3] -= o;
301 t[6] -= o; 301 t[6] -= o;
302 t[7] += o; 302 t[7] += o;
303 t[1] += t[0] >> 32; t[0] &= 0xffffffff; 303 t[1] += t[0] >> 32; t[0] &= 0xffffffff;
304 t[2] += t[1] >> 32; t[1] &= 0xffffffff; 304 t[2] += t[1] >> 32; t[1] &= 0xffffffff;
305 t[3] += t[2] >> 32; t[2] &= 0xffffffff; 305 t[3] += t[2] >> 32; t[2] &= 0xffffffff;
306 t[4] += t[3] >> 32; t[3] &= 0xffffffff; 306 t[4] += t[3] >> 32; t[3] &= 0xffffffff;
307 t[5] += t[4] >> 32; t[4] &= 0xffffffff; 307 t[5] += t[4] >> 32; t[4] &= 0xffffffff;
308 t[6] += t[5] >> 32; t[5] &= 0xffffffff; 308 t[6] += t[5] >> 32; t[5] &= 0xffffffff;
309 t[7] += t[6] >> 32; t[6] &= 0xffffffff; 309 t[7] += t[6] >> 32; t[6] &= 0xffffffff;
310 310
311 r[0] = (sp_digit)(t[0]) & 0x3ffffff; 311 r[0] = (sp_digit)(t[0]) & 0x3ffffff;
312 r[1] = (sp_digit)(t[0] >> 26); 312 r[1] = (sp_digit)(t[0] >> 26);
313 r[1] |= t[1] << 6; 313 r[1] |= t[1] << 6;
314 r[1] &= 0x3ffffff; 314 r[1] &= 0x3ffffff;
315 r[2] = (sp_digit)(t[1] >> 20); 315 r[2] = (sp_digit)(t[1] >> 20);
316 r[2] |= t[2] << 12; 316 r[2] |= t[2] << 12;
317 r[2] &= 0x3ffffff; 317 r[2] &= 0x3ffffff;
318 r[3] = (sp_digit)(t[2] >> 14); 318 r[3] = (sp_digit)(t[2] >> 14);
319 r[3] |= t[3] << 18; 319 r[3] |= t[3] << 18;
320 r[3] &= 0x3ffffff; 320 r[3] &= 0x3ffffff;
321 r[4] = (sp_digit)(t[3] >> 8); 321 r[4] = (sp_digit)(t[3] >> 8);
322 r[4] |= t[4] << 24; 322 r[4] |= t[4] << 24;
323 r[4] &= 0x3ffffff; 323 r[4] &= 0x3ffffff;
324 r[5] = (sp_digit)(t[4] >> 2) & 0x3ffffff; 324 r[5] = (sp_digit)(t[4] >> 2) & 0x3ffffff;
325 r[6] = (sp_digit)(t[4] >> 28); 325 r[6] = (sp_digit)(t[4] >> 28);
326 r[6] |= t[5] << 4; 326 r[6] |= t[5] << 4;
327 r[6] &= 0x3ffffff; 327 r[6] &= 0x3ffffff;
328 r[7] = (sp_digit)(t[5] >> 22); 328 r[7] = (sp_digit)(t[5] >> 22);
329 r[7] |= t[6] << 10; 329 r[7] |= t[6] << 10;
330 r[7] &= 0x3ffffff; 330 r[7] &= 0x3ffffff;
331 r[8] = (sp_digit)(t[6] >> 16); 331 r[8] = (sp_digit)(t[6] >> 16);
332 r[8] |= t[7] << 16; 332 r[8] |= t[7] << 16;
333 r[8] &= 0x3ffffff; 333 r[8] &= 0x3ffffff;
334 r[9] = (sp_digit)(t[7] >> 10); 334 r[9] = (sp_digit)(t[7] >> 10);
335} 335}
336 336
337/* Mul a by scalar b and add into r. (r += a * b) */ 337/* Mul a by scalar b and add into r. (r += a * b) */
338static void sp_256_mul_add_10(sp_digit* r, const sp_digit* a, sp_digit b) 338static void sp_256_mul_add_10(sp_digit* r, const sp_digit* a, sp_digit b)
339{ 339{
340 int64_t tb = b; 340 int64_t tb = b;
341 int64_t t = 0; 341 int64_t t = 0;
342 int i; 342 int i;
343 343
344 for (i = 0; i < 10; i++) { 344 for (i = 0; i < 10; i++) {
345 t += (tb * a[i]) + r[i]; 345 t += (tb * a[i]) + r[i];
346 r[i] = t & 0x3ffffff; 346 r[i] = t & 0x3ffffff;
347 t >>= 26; 347 t >>= 26;
348 } 348 }
349 r[10] += t; 349 r[10] += t;
350} 350}
351 351
352/* Divide the number by 2 mod the modulus (prime). (r = a / 2 % m) */ 352/* Divide the number by 2 mod the modulus (prime). (r = a / 2 % m) */
353static void sp_256_div2_10(sp_digit* r, const sp_digit* a, const sp_digit* m) 353static void sp_256_div2_10(sp_digit* r, const sp_digit* a, const sp_digit* m)
354{ 354{
355 sp_256_cond_add_10(r, a, m, 0 - (a[0] & 1)); 355 sp_256_cond_add_10(r, a, m, 0 - (a[0] & 1));
356 sp_256_norm_10(r); 356 sp_256_norm_10(r);
357 sp_256_rshift1_10(r, r); 357 sp_256_rshift1_10(r, r);
358} 358}
359 359
360/* Shift the result in the high 256 bits down to the bottom. */ 360/* Shift the result in the high 256 bits down to the bottom. */
361static void sp_256_mont_shift_10(sp_digit* r, const sp_digit* a) 361static void sp_256_mont_shift_10(sp_digit* r, const sp_digit* a)
362{ 362{
363 int i; 363 int i;
364 sp_digit n, s; 364 sp_digit n, s;
365 365
366 s = a[10]; 366 s = a[10];
367 n = a[9] >> 22; 367 n = a[9] >> 22;
368 for (i = 0; i < 9; i++) { 368 for (i = 0; i < 9; i++) {
369 n += (s & 0x3ffffff) << 4; 369 n += (s & 0x3ffffff) << 4;
370 r[i] = n & 0x3ffffff; 370 r[i] = n & 0x3ffffff;
371 n >>= 26; 371 n >>= 26;
372 s = a[11 + i] + (s >> 26); 372 s = a[11 + i] + (s >> 26);
373 } 373 }
374 n += s << 4; 374 n += s << 4;
375 r[9] = n; 375 r[9] = n;
376 memset(&r[10], 0, sizeof(*r) * 10); 376 memset(&r[10], 0, sizeof(*r) * 10);
377} 377}
378 378
379/* Add two Montgomery form numbers (r = a + b % m) */ 379/* Add two Montgomery form numbers (r = a + b % m) */
380static void sp_256_mont_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b, 380static void sp_256_mont_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b,
381 const sp_digit* m) 381 const sp_digit* m)
382{ 382{
383 sp_256_add_10(r, a, b); 383 sp_256_add_10(r, a, b);
384 sp_256_norm_10(r); 384 sp_256_norm_10(r);
385 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); 385 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0));
386 sp_256_norm_10(r); 386 sp_256_norm_10(r);
387} 387}
388 388
389/* Double a Montgomery form number (r = a + a % m) */ 389/* Double a Montgomery form number (r = a + a % m) */
390static void sp_256_mont_dbl_10(sp_digit* r, const sp_digit* a, const sp_digit* m) 390static void sp_256_mont_dbl_10(sp_digit* r, const sp_digit* a, const sp_digit* m)
391{ 391{
392 sp_256_add_10(r, a, a); 392 sp_256_add_10(r, a, a);
393 sp_256_norm_10(r); 393 sp_256_norm_10(r);
394 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); 394 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0));
395 sp_256_norm_10(r); 395 sp_256_norm_10(r);
396} 396}
397 397
398/* Triple a Montgomery form number (r = a + a + a % m) */ 398/* Triple a Montgomery form number (r = a + a + a % m) */
399static void sp_256_mont_tpl_10(sp_digit* r, const sp_digit* a, const sp_digit* m) 399static void sp_256_mont_tpl_10(sp_digit* r, const sp_digit* a, const sp_digit* m)
400{ 400{
401 sp_256_add_10(r, a, a); 401 sp_256_add_10(r, a, a);
402 sp_256_norm_10(r); 402 sp_256_norm_10(r);
403 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); 403 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0));
404 sp_256_norm_10(r); 404 sp_256_norm_10(r);
405 sp_256_add_10(r, r, a); 405 sp_256_add_10(r, r, a);
406 sp_256_norm_10(r); 406 sp_256_norm_10(r);
407 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0)); 407 sp_256_cond_sub_10(r, r, m, 0 - ((r[9] >> 22) > 0));
408 sp_256_norm_10(r); 408 sp_256_norm_10(r);
409} 409}
410 410
411/* Sub b from a into r. (r = a - b) */ 411/* Sub b from a into r. (r = a - b) */
412static void sp_256_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b) 412static void sp_256_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b)
413{ 413{
414 int i; 414 int i;
415 for (i = 0; i < 10; i++) 415 for (i = 0; i < 10; i++)
416 r[i] = a[i] - b[i]; 416 r[i] = a[i] - b[i];
417} 417}
418 418
419/* Subtract two Montgomery form numbers (r = a - b % m) */ 419/* Subtract two Montgomery form numbers (r = a - b % m) */
420static void sp_256_mont_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b, 420static void sp_256_mont_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b,
421 const sp_digit* m) 421 const sp_digit* m)
422{ 422{
423 sp_256_sub_10(r, a, b); 423 sp_256_sub_10(r, a, b);
424 sp_256_cond_add_10(r, r, m, r[9] >> 22); 424 sp_256_cond_add_10(r, r, m, r[9] >> 22);
425 sp_256_norm_10(r); 425 sp_256_norm_10(r);
426} 426}
427 427
428/* Reduce the number back to 256 bits using Montgomery reduction. 428/* Reduce the number back to 256 bits using Montgomery reduction.
@@ -433,60 +433,60 @@ static void sp_256_mont_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b
433 */ 433 */
434static void sp_256_mont_reduce_10(sp_digit* a, const sp_digit* m, sp_digit mp) 434static void sp_256_mont_reduce_10(sp_digit* a, const sp_digit* m, sp_digit mp)
435{ 435{
436 int i; 436 int i;
437 sp_digit mu; 437 sp_digit mu;
438 438
439 if (mp != 1) { 439 if (mp != 1) {
440 for (i = 0; i < 9; i++) { 440 for (i = 0; i < 9; i++) {
441 mu = (a[i] * mp) & 0x3ffffff; 441 mu = (a[i] * mp) & 0x3ffffff;
442 sp_256_mul_add_10(a+i, m, mu); 442 sp_256_mul_add_10(a+i, m, mu);
443 a[i+1] += a[i] >> 26; 443 a[i+1] += a[i] >> 26;
444 } 444 }
445 mu = (a[i] * mp) & 0x3fffffl; 445 mu = (a[i] * mp) & 0x3fffffl;
446 sp_256_mul_add_10(a+i, m, mu); 446 sp_256_mul_add_10(a+i, m, mu);
447 a[i+1] += a[i] >> 26; 447 a[i+1] += a[i] >> 26;
448 a[i] &= 0x3ffffff; 448 a[i] &= 0x3ffffff;
449 } 449 }
450 else { 450 else {
451 for (i = 0; i < 9; i++) { 451 for (i = 0; i < 9; i++) {
452 mu = a[i] & 0x3ffffff; 452 mu = a[i] & 0x3ffffff;
453 sp_256_mul_add_10(a+i, p256_mod, mu); 453 sp_256_mul_add_10(a+i, p256_mod, mu);
454 a[i+1] += a[i] >> 26; 454 a[i+1] += a[i] >> 26;
455 } 455 }
456 mu = a[i] & 0x3fffffl; 456 mu = a[i] & 0x3fffffl;
457 sp_256_mul_add_10(a+i, p256_mod, mu); 457 sp_256_mul_add_10(a+i, p256_mod, mu);
458 a[i+1] += a[i] >> 26; 458 a[i+1] += a[i] >> 26;
459 a[i] &= 0x3ffffff; 459 a[i] &= 0x3ffffff;
460 } 460 }
461 461
462 sp_256_mont_shift_10(a, a); 462 sp_256_mont_shift_10(a, a);
463 sp_256_cond_sub_10(a, a, m, 0 - ((a[9] >> 22) > 0)); 463 sp_256_cond_sub_10(a, a, m, 0 - ((a[9] >> 22) > 0));
464 sp_256_norm_10(a); 464 sp_256_norm_10(a);
465} 465}
466 466
467/* Multiply a and b into r. (r = a * b) */ 467/* Multiply a and b into r. (r = a * b) */
468static void sp_256_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b) 468static void sp_256_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b)
469{ 469{
470 int i, j, k; 470 int i, j, k;
471 int64_t c; 471 int64_t c;
472 472
473 c = ((int64_t)a[9]) * b[9]; 473 c = ((int64_t)a[9]) * b[9];
474 r[19] = (sp_digit)(c >> 26); 474 r[19] = (sp_digit)(c >> 26);
475 c = (c & 0x3ffffff) << 26; 475 c = (c & 0x3ffffff) << 26;
476 for (k = 17; k >= 0; k--) { 476 for (k = 17; k >= 0; k--) {
477 for (i = 9; i >= 0; i--) { 477 for (i = 9; i >= 0; i--) {
478 j = k - i; 478 j = k - i;
479 if (j >= 10) 479 if (j >= 10)
480 break; 480 break;
481 if (j < 0) 481 if (j < 0)
482 continue; 482 continue;
483 c += ((int64_t)a[i]) * b[j]; 483 c += ((int64_t)a[i]) * b[j];
484 } 484 }
485 r[k + 2] += c >> 52; 485 r[k + 2] += c >> 52;
486 r[k + 1] = (c >> 26) & 0x3ffffff; 486 r[k + 1] = (c >> 26) & 0x3ffffff;
487 c = (c & 0x3ffffff) << 26; 487 c = (c & 0x3ffffff) << 26;
488 } 488 }
489 r[0] = (sp_digit)(c >> 26); 489 r[0] = (sp_digit)(c >> 26);
490} 490}
491 491
492/* Multiply two Montogmery form numbers mod the modulus (prime). 492/* Multiply two Montogmery form numbers mod the modulus (prime).
@@ -499,39 +499,39 @@ static void sp_256_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b)
499 * mp Montogmery mulitplier. 499 * mp Montogmery mulitplier.
500 */ 500 */
501static void sp_256_mont_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b, 501static void sp_256_mont_mul_10(sp_digit* r, const sp_digit* a, const sp_digit* b,
502 const sp_digit* m, sp_digit mp) 502 const sp_digit* m, sp_digit mp)
503{ 503{
504 sp_256_mul_10(r, a, b); 504 sp_256_mul_10(r, a, b);
505 sp_256_mont_reduce_10(r, m, mp); 505 sp_256_mont_reduce_10(r, m, mp);
506} 506}
507 507
508/* Square a and put result in r. (r = a * a) */ 508/* Square a and put result in r. (r = a * a) */
509static void sp_256_sqr_10(sp_digit* r, const sp_digit* a) 509static void sp_256_sqr_10(sp_digit* r, const sp_digit* a)
510{ 510{
511 int i, j, k; 511 int i, j, k;
512 int64_t c; 512 int64_t c;
513 513
514 c = ((int64_t)a[9]) * a[9]; 514 c = ((int64_t)a[9]) * a[9];
515 r[19] = (sp_digit)(c >> 26); 515 r[19] = (sp_digit)(c >> 26);
516 c = (c & 0x3ffffff) << 26; 516 c = (c & 0x3ffffff) << 26;
517 for (k = 17; k >= 0; k--) { 517 for (k = 17; k >= 0; k--) {
518 for (i = 9; i >= 0; i--) { 518 for (i = 9; i >= 0; i--) {
519 j = k - i; 519 j = k - i;
520 if (j >= 10 || i <= j) 520 if (j >= 10 || i <= j)
521 break; 521 break;
522 if (j < 0) 522 if (j < 0)
523 continue; 523 continue;
524 524
525 c += ((int64_t)a[i]) * a[j] * 2; 525 c += ((int64_t)a[i]) * a[j] * 2;
526 } 526 }
527 if (i == j) 527 if (i == j)
528 c += ((int64_t)a[i]) * a[i]; 528 c += ((int64_t)a[i]) * a[i];
529 529
530 r[k + 2] += c >> 52; 530 r[k + 2] += c >> 52;
531 r[k + 1] = (c >> 26) & 0x3ffffff; 531 r[k + 1] = (c >> 26) & 0x3ffffff;
532 c = (c & 0x3ffffff) << 26; 532 c = (c & 0x3ffffff) << 26;
533 } 533 }
534 r[0] = (sp_digit)(c >> 26); 534 r[0] = (sp_digit)(c >> 26);
535} 535}
536 536
537/* Square the Montgomery form number. (r = a * a mod m) 537/* Square the Montgomery form number. (r = a * a mod m)
@@ -542,10 +542,10 @@ static void sp_256_sqr_10(sp_digit* r, const sp_digit* a)
542 * mp Montogmery mulitplier. 542 * mp Montogmery mulitplier.
543 */ 543 */
544static void sp_256_mont_sqr_10(sp_digit* r, const sp_digit* a, const sp_digit* m, 544static void sp_256_mont_sqr_10(sp_digit* r, const sp_digit* a, const sp_digit* m,
545 sp_digit mp) 545 sp_digit mp)
546{ 546{
547 sp_256_sqr_10(r, a); 547 sp_256_sqr_10(r, a);
548 sp_256_mont_reduce_10(r, m, mp); 548 sp_256_mont_reduce_10(r, m, mp);
549} 549}
550 550
551/* Invert the number, in Montgomery form, modulo the modulus (prime) of the 551/* Invert the number, in Montgomery form, modulo the modulus (prime) of the
@@ -557,8 +557,8 @@ static void sp_256_mont_sqr_10(sp_digit* r, const sp_digit* a, const sp_digit* m
557#if 0 557#if 0
558/* Mod-2 for the P256 curve. */ 558/* Mod-2 for the P256 curve. */
559static const uint32_t p256_mod_2[8] = { 559static const uint32_t p256_mod_2[8] = {
560 0xfffffffd,0xffffffff,0xffffffff,0x00000000, 560 0xfffffffd,0xffffffff,0xffffffff,0x00000000,
561 0x00000000,0x00000000,0x00000001,0xffffffff, 561 0x00000000,0x00000000,0x00000001,0xffffffff,
562}; 562};
563//Bit pattern: 563//Bit pattern:
564//2 2 2 2 2 2 2 1...1 564//2 2 2 2 2 2 2 1...1
@@ -568,17 +568,17 @@ static const uint32_t p256_mod_2[8] = {
568#endif 568#endif
569static void sp_256_mont_inv_10(sp_digit* r, sp_digit* a) 569static void sp_256_mont_inv_10(sp_digit* r, sp_digit* a)
570{ 570{
571 sp_digit t[2*10]; //can be just [10]? 571 sp_digit t[2*10]; //can be just [10]?
572 int i; 572 int i;
573 573
574 memcpy(t, a, sizeof(sp_digit) * 10); 574 memcpy(t, a, sizeof(sp_digit) * 10);
575 for (i = 254; i >= 0; i--) { 575 for (i = 254; i >= 0; i--) {
576 sp_256_mont_sqr_10(t, t, p256_mod, p256_mp_mod); 576 sp_256_mont_sqr_10(t, t, p256_mod, p256_mp_mod);
577 /*if (p256_mod_2[i / 32] & ((sp_digit)1 << (i % 32)))*/ 577 /*if (p256_mod_2[i / 32] & ((sp_digit)1 << (i % 32)))*/
578 if (i >= 224 || i == 192 || (i <= 95 && i != 1)) 578 if (i >= 224 || i == 192 || (i <= 95 && i != 1))
579 sp_256_mont_mul_10(t, t, a, p256_mod, p256_mp_mod); 579 sp_256_mont_mul_10(t, t, a, p256_mod, p256_mp_mod);
580 } 580 }
581 memcpy(r, t, sizeof(sp_digit) * 10); 581 memcpy(r, t, sizeof(sp_digit) * 10);
582} 582}
583 583
584/* Map the Montgomery form projective co-ordinate point to an affine point. 584/* Map the Montgomery form projective co-ordinate point to an affine point.
@@ -588,35 +588,35 @@ static void sp_256_mont_inv_10(sp_digit* r, sp_digit* a)
588 */ 588 */
589static void sp_256_map_10(sp_point* r, sp_point* p) 589static void sp_256_map_10(sp_point* r, sp_point* p)
590{ 590{
591 sp_digit t1[2*10]; 591 sp_digit t1[2*10];
592 sp_digit t2[2*10]; 592 sp_digit t2[2*10];
593 int32_t n; 593 int32_t n;
594 594
595 sp_256_mont_inv_10(t1, p->z); 595 sp_256_mont_inv_10(t1, p->z);
596 596
597 sp_256_mont_sqr_10(t2, t1, p256_mod, p256_mp_mod); 597 sp_256_mont_sqr_10(t2, t1, p256_mod, p256_mp_mod);
598 sp_256_mont_mul_10(t1, t2, t1, p256_mod, p256_mp_mod); 598 sp_256_mont_mul_10(t1, t2, t1, p256_mod, p256_mp_mod);
599 599
600 /* x /= z^2 */ 600 /* x /= z^2 */
601 sp_256_mont_mul_10(r->x, p->x, t2, p256_mod, p256_mp_mod); 601 sp_256_mont_mul_10(r->x, p->x, t2, p256_mod, p256_mp_mod);
602 memset(r->x + 10, 0, sizeof(r->x) / 2); 602 memset(r->x + 10, 0, sizeof(r->x) / 2);
603 sp_256_mont_reduce_10(r->x, p256_mod, p256_mp_mod); 603 sp_256_mont_reduce_10(r->x, p256_mod, p256_mp_mod);
604 /* Reduce x to less than modulus */ 604 /* Reduce x to less than modulus */
605 n = sp_256_cmp_10(r->x, p256_mod); 605 n = sp_256_cmp_10(r->x, p256_mod);
606 sp_256_cond_sub_10(r->x, r->x, p256_mod, 0 - (n >= 0)); 606 sp_256_cond_sub_10(r->x, r->x, p256_mod, 0 - (n >= 0));
607 sp_256_norm_10(r->x); 607 sp_256_norm_10(r->x);
608 608
609 /* y /= z^3 */ 609 /* y /= z^3 */
610 sp_256_mont_mul_10(r->y, p->y, t1, p256_mod, p256_mp_mod); 610 sp_256_mont_mul_10(r->y, p->y, t1, p256_mod, p256_mp_mod);
611 memset(r->y + 10, 0, sizeof(r->y) / 2); 611 memset(r->y + 10, 0, sizeof(r->y) / 2);
612 sp_256_mont_reduce_10(r->y, p256_mod, p256_mp_mod); 612 sp_256_mont_reduce_10(r->y, p256_mod, p256_mp_mod);
613 /* Reduce y to less than modulus */ 613 /* Reduce y to less than modulus */
614 n = sp_256_cmp_10(r->y, p256_mod); 614 n = sp_256_cmp_10(r->y, p256_mod);
615 sp_256_cond_sub_10(r->y, r->y, p256_mod, 0 - (n >= 0)); 615 sp_256_cond_sub_10(r->y, r->y, p256_mod, 0 - (n >= 0));
616 sp_256_norm_10(r->y); 616 sp_256_norm_10(r->y);
617 617
618 memset(r->z, 0, sizeof(r->z)); 618 memset(r->z, 0, sizeof(r->z));
619 r->z[0] = 1; 619 r->z[0] = 1;
620} 620}
621 621
622/* Double the Montgomery form projective point p. 622/* Double the Montgomery form projective point p.
@@ -626,54 +626,54 @@ static void sp_256_map_10(sp_point* r, sp_point* p)
626 */ 626 */
627static void sp_256_proj_point_dbl_10(sp_point* r, sp_point* p) 627static void sp_256_proj_point_dbl_10(sp_point* r, sp_point* p)
628{ 628{
629 sp_point tp; 629 sp_point tp;
630 sp_digit t1[2*10]; 630 sp_digit t1[2*10];
631 sp_digit t2[2*10]; 631 sp_digit t2[2*10];
632 632
633 /* Put point to double into result */ 633 /* Put point to double into result */
634 if (r != p) 634 if (r != p)
635 *r = *p; /* struct copy */ 635 *r = *p; /* struct copy */
636 636
637 if (r->infinity) { 637 if (r->infinity) {
638 /* If infinity, don't double (work on dummy value) */ 638 /* If infinity, don't double (work on dummy value) */
639 r = &tp; 639 r = &tp;
640 } 640 }
641 /* T1 = Z * Z */ 641 /* T1 = Z * Z */
642 sp_256_mont_sqr_10(t1, r->z, p256_mod, p256_mp_mod); 642 sp_256_mont_sqr_10(t1, r->z, p256_mod, p256_mp_mod);
643 /* Z = Y * Z */ 643 /* Z = Y * Z */
644 sp_256_mont_mul_10(r->z, r->y, r->z, p256_mod, p256_mp_mod); 644 sp_256_mont_mul_10(r->z, r->y, r->z, p256_mod, p256_mp_mod);
645 /* Z = 2Z */ 645 /* Z = 2Z */
646 sp_256_mont_dbl_10(r->z, r->z, p256_mod); 646 sp_256_mont_dbl_10(r->z, r->z, p256_mod);
647 /* T2 = X - T1 */ 647 /* T2 = X - T1 */
648 sp_256_mont_sub_10(t2, r->x, t1, p256_mod); 648 sp_256_mont_sub_10(t2, r->x, t1, p256_mod);
649 /* T1 = X + T1 */ 649 /* T1 = X + T1 */
650 sp_256_mont_add_10(t1, r->x, t1, p256_mod); 650 sp_256_mont_add_10(t1, r->x, t1, p256_mod);
651 /* T2 = T1 * T2 */ 651 /* T2 = T1 * T2 */
652 sp_256_mont_mul_10(t2, t1, t2, p256_mod, p256_mp_mod); 652 sp_256_mont_mul_10(t2, t1, t2, p256_mod, p256_mp_mod);
653 /* T1 = 3T2 */ 653 /* T1 = 3T2 */
654 sp_256_mont_tpl_10(t1, t2, p256_mod); 654 sp_256_mont_tpl_10(t1, t2, p256_mod);
655 /* Y = 2Y */ 655 /* Y = 2Y */
656 sp_256_mont_dbl_10(r->y, r->y, p256_mod); 656 sp_256_mont_dbl_10(r->y, r->y, p256_mod);
657 /* Y = Y * Y */ 657 /* Y = Y * Y */
658 sp_256_mont_sqr_10(r->y, r->y, p256_mod, p256_mp_mod); 658 sp_256_mont_sqr_10(r->y, r->y, p256_mod, p256_mp_mod);
659 /* T2 = Y * Y */ 659 /* T2 = Y * Y */
660 sp_256_mont_sqr_10(t2, r->y, p256_mod, p256_mp_mod); 660 sp_256_mont_sqr_10(t2, r->y, p256_mod, p256_mp_mod);
661 /* T2 = T2/2 */ 661 /* T2 = T2/2 */
662 sp_256_div2_10(t2, t2, p256_mod); 662 sp_256_div2_10(t2, t2, p256_mod);
663 /* Y = Y * X */ 663 /* Y = Y * X */
664 sp_256_mont_mul_10(r->y, r->y, r->x, p256_mod, p256_mp_mod); 664 sp_256_mont_mul_10(r->y, r->y, r->x, p256_mod, p256_mp_mod);
665 /* X = T1 * T1 */ 665 /* X = T1 * T1 */
666 sp_256_mont_mul_10(r->x, t1, t1, p256_mod, p256_mp_mod); 666 sp_256_mont_mul_10(r->x, t1, t1, p256_mod, p256_mp_mod);
667 /* X = X - Y */ 667 /* X = X - Y */
668 sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod); 668 sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod);
669 /* X = X - Y */ 669 /* X = X - Y */
670 sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod); 670 sp_256_mont_sub_10(r->x, r->x, r->y, p256_mod);
671 /* Y = Y - X */ 671 /* Y = Y - X */
672 sp_256_mont_sub_10(r->y, r->y, r->x, p256_mod); 672 sp_256_mont_sub_10(r->y, r->y, r->x, p256_mod);
673 /* Y = Y * T1 */ 673 /* Y = Y * T1 */
674 sp_256_mont_mul_10(r->y, r->y, t1, p256_mod, p256_mp_mod); 674 sp_256_mont_mul_10(r->y, r->y, t1, p256_mod, p256_mp_mod);
675 /* Y = Y - T2 */ 675 /* Y = Y - T2 */
676 sp_256_mont_sub_10(r->y, r->y, t2, p256_mod); 676 sp_256_mont_sub_10(r->y, r->y, t2, p256_mod);
677} 677}
678 678
679/* Add two Montgomery form projective points. 679/* Add two Montgomery form projective points.
@@ -684,73 +684,73 @@ static void sp_256_proj_point_dbl_10(sp_point* r, sp_point* p)
684 */ 684 */
685static void sp_256_proj_point_add_10(sp_point* r, sp_point* p, sp_point* q) 685static void sp_256_proj_point_add_10(sp_point* r, sp_point* p, sp_point* q)
686{ 686{
687 sp_digit t1[2*10]; 687 sp_digit t1[2*10];
688 sp_digit t2[2*10]; 688 sp_digit t2[2*10];
689 sp_digit t3[2*10]; 689 sp_digit t3[2*10];
690 sp_digit t4[2*10]; 690 sp_digit t4[2*10];
691 sp_digit t5[2*10]; 691 sp_digit t5[2*10];
692 692
693 /* Ensure only the first point is the same as the result. */ 693 /* Ensure only the first point is the same as the result. */
694 if (q == r) { 694 if (q == r) {
695 sp_point* a = p; 695 sp_point* a = p;
696 p = q; 696 p = q;
697 q = a; 697 q = a;
698 } 698 }
699 699
700 /* Check double */ 700 /* Check double */
701 sp_256_sub_10(t1, p256_mod, q->y); 701 sp_256_sub_10(t1, p256_mod, q->y);
702 sp_256_norm_10(t1); 702 sp_256_norm_10(t1);
703 if (sp_256_cmp_equal_10(p->x, q->x) 703 if (sp_256_cmp_equal_10(p->x, q->x)
704 && sp_256_cmp_equal_10(p->z, q->z) 704 && sp_256_cmp_equal_10(p->z, q->z)
705 && (sp_256_cmp_equal_10(p->y, q->y) || sp_256_cmp_equal_10(p->y, t1)) 705 && (sp_256_cmp_equal_10(p->y, q->y) || sp_256_cmp_equal_10(p->y, t1))
706 ) { 706 ) {
707 sp_256_proj_point_dbl_10(r, p); 707 sp_256_proj_point_dbl_10(r, p);
708 } 708 }
709 else { 709 else {
710 sp_point tp; 710 sp_point tp;
711 sp_point *v; 711 sp_point *v;
712 712
713 v = r; 713 v = r;
714 if (p->infinity | q->infinity) { 714 if (p->infinity | q->infinity) {
715 memset(&tp, 0, sizeof(tp)); 715 memset(&tp, 0, sizeof(tp));
716 v = &tp; 716 v = &tp;
717 } 717 }
718 718
719 *r = p->infinity ? *q : *p; /* struct copy */ 719 *r = p->infinity ? *q : *p; /* struct copy */
720 720
721 /* U1 = X1*Z2^2 */ 721 /* U1 = X1*Z2^2 */
722 sp_256_mont_sqr_10(t1, q->z, p256_mod, p256_mp_mod); 722 sp_256_mont_sqr_10(t1, q->z, p256_mod, p256_mp_mod);
723 sp_256_mont_mul_10(t3, t1, q->z, p256_mod, p256_mp_mod); 723 sp_256_mont_mul_10(t3, t1, q->z, p256_mod, p256_mp_mod);
724 sp_256_mont_mul_10(t1, t1, v->x, p256_mod, p256_mp_mod); 724 sp_256_mont_mul_10(t1, t1, v->x, p256_mod, p256_mp_mod);
725 /* U2 = X2*Z1^2 */ 725 /* U2 = X2*Z1^2 */
726 sp_256_mont_sqr_10(t2, v->z, p256_mod, p256_mp_mod); 726 sp_256_mont_sqr_10(t2, v->z, p256_mod, p256_mp_mod);
727 sp_256_mont_mul_10(t4, t2, v->z, p256_mod, p256_mp_mod); 727 sp_256_mont_mul_10(t4, t2, v->z, p256_mod, p256_mp_mod);
728 sp_256_mont_mul_10(t2, t2, q->x, p256_mod, p256_mp_mod); 728 sp_256_mont_mul_10(t2, t2, q->x, p256_mod, p256_mp_mod);
729 /* S1 = Y1*Z2^3 */ 729 /* S1 = Y1*Z2^3 */
730 sp_256_mont_mul_10(t3, t3, v->y, p256_mod, p256_mp_mod); 730 sp_256_mont_mul_10(t3, t3, v->y, p256_mod, p256_mp_mod);
731 /* S2 = Y2*Z1^3 */ 731 /* S2 = Y2*Z1^3 */
732 sp_256_mont_mul_10(t4, t4, q->y, p256_mod, p256_mp_mod); 732 sp_256_mont_mul_10(t4, t4, q->y, p256_mod, p256_mp_mod);
733 /* H = U2 - U1 */ 733 /* H = U2 - U1 */
734 sp_256_mont_sub_10(t2, t2, t1, p256_mod); 734 sp_256_mont_sub_10(t2, t2, t1, p256_mod);
735 /* R = S2 - S1 */ 735 /* R = S2 - S1 */
736 sp_256_mont_sub_10(t4, t4, t3, p256_mod); 736 sp_256_mont_sub_10(t4, t4, t3, p256_mod);
737 /* Z3 = H*Z1*Z2 */ 737 /* Z3 = H*Z1*Z2 */
738 sp_256_mont_mul_10(v->z, v->z, q->z, p256_mod, p256_mp_mod); 738 sp_256_mont_mul_10(v->z, v->z, q->z, p256_mod, p256_mp_mod);
739 sp_256_mont_mul_10(v->z, v->z, t2, p256_mod, p256_mp_mod); 739 sp_256_mont_mul_10(v->z, v->z, t2, p256_mod, p256_mp_mod);
740 /* X3 = R^2 - H^3 - 2*U1*H^2 */ 740 /* X3 = R^2 - H^3 - 2*U1*H^2 */
741 sp_256_mont_sqr_10(v->x, t4, p256_mod, p256_mp_mod); 741 sp_256_mont_sqr_10(v->x, t4, p256_mod, p256_mp_mod);
742 sp_256_mont_sqr_10(t5, t2, p256_mod, p256_mp_mod); 742 sp_256_mont_sqr_10(t5, t2, p256_mod, p256_mp_mod);
743 sp_256_mont_mul_10(v->y, t1, t5, p256_mod, p256_mp_mod); 743 sp_256_mont_mul_10(v->y, t1, t5, p256_mod, p256_mp_mod);
744 sp_256_mont_mul_10(t5, t5, t2, p256_mod, p256_mp_mod); 744 sp_256_mont_mul_10(t5, t5, t2, p256_mod, p256_mp_mod);
745 sp_256_mont_sub_10(v->x, v->x, t5, p256_mod); 745 sp_256_mont_sub_10(v->x, v->x, t5, p256_mod);
746 sp_256_mont_dbl_10(t1, v->y, p256_mod); 746 sp_256_mont_dbl_10(t1, v->y, p256_mod);
747 sp_256_mont_sub_10(v->x, v->x, t1, p256_mod); 747 sp_256_mont_sub_10(v->x, v->x, t1, p256_mod);
748 /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ 748 /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */
749 sp_256_mont_sub_10(v->y, v->y, v->x, p256_mod); 749 sp_256_mont_sub_10(v->y, v->y, v->x, p256_mod);
750 sp_256_mont_mul_10(v->y, v->y, t4, p256_mod, p256_mp_mod); 750 sp_256_mont_mul_10(v->y, v->y, t4, p256_mod, p256_mp_mod);
751 sp_256_mont_mul_10(t5, t5, t3, p256_mod, p256_mp_mod); 751 sp_256_mont_mul_10(t5, t5, t3, p256_mod, p256_mp_mod);
752 sp_256_mont_sub_10(v->y, v->y, t5, p256_mod); 752 sp_256_mont_sub_10(v->y, v->y, t5, p256_mod);
753 } 753 }
754} 754}
755 755
756/* Multiply the point by the scalar and return the result. 756/* Multiply the point by the scalar and return the result.
@@ -763,48 +763,48 @@ static void sp_256_proj_point_add_10(sp_point* r, sp_point* p, sp_point* q)
763 */ 763 */
764static void sp_256_ecc_mulmod_10(sp_point* r, const sp_point* g, const sp_digit* k /*, int map*/) 764static void sp_256_ecc_mulmod_10(sp_point* r, const sp_point* g, const sp_digit* k /*, int map*/)
765{ 765{
766 enum { map = 1 }; /* we always convert result to affine coordinates */ 766 enum { map = 1 }; /* we always convert result to affine coordinates */
767 sp_point t[3]; 767 sp_point t[3];
768 sp_digit n; 768 sp_digit n;
769 int i; 769 int i;
770 int c, y; 770 int c, y;
771 771
772 memset(t, 0, sizeof(t)); 772 memset(t, 0, sizeof(t));
773 773
774 /* t[0] = {0, 0, 1} * norm */ 774 /* t[0] = {0, 0, 1} * norm */
775 t[0].infinity = 1; 775 t[0].infinity = 1;
776 /* t[1] = {g->x, g->y, g->z} * norm */ 776 /* t[1] = {g->x, g->y, g->z} * norm */
777 sp_256_mod_mul_norm_10(t[1].x, g->x); 777 sp_256_mod_mul_norm_10(t[1].x, g->x);
778 sp_256_mod_mul_norm_10(t[1].y, g->y); 778 sp_256_mod_mul_norm_10(t[1].y, g->y);
779 sp_256_mod_mul_norm_10(t[1].z, g->z); 779 sp_256_mod_mul_norm_10(t[1].z, g->z);
780 780
781 i = 9; 781 i = 9;
782 c = 22; 782 c = 22;
783 n = k[i--] << (26 - c); 783 n = k[i--] << (26 - c);
784 for (; ; c--) { 784 for (; ; c--) {
785 if (c == 0) { 785 if (c == 0) {
786 if (i == -1) 786 if (i == -1)
787 break; 787 break;
788 788
789 n = k[i--]; 789 n = k[i--];
790 c = 26; 790 c = 26;
791 } 791 }
792 792
793 y = (n >> 25) & 1; 793 y = (n >> 25) & 1;
794 n <<= 1; 794 n <<= 1;
795 795
796 sp_256_proj_point_add_10(&t[y^1], &t[0], &t[1]); 796 sp_256_proj_point_add_10(&t[y^1], &t[0], &t[1]);
797 memcpy(&t[2], &t[y], sizeof(sp_point)); 797 memcpy(&t[2], &t[y], sizeof(sp_point));
798 sp_256_proj_point_dbl_10(&t[2], &t[2]); 798 sp_256_proj_point_dbl_10(&t[2], &t[2]);
799 memcpy(&t[y], &t[2], sizeof(sp_point)); 799 memcpy(&t[y], &t[2], sizeof(sp_point));
800 } 800 }
801 801
802 if (map) 802 if (map)
803 sp_256_map_10(r, &t[0]); 803 sp_256_map_10(r, &t[0]);
804 else 804 else
805 memcpy(r, &t[0], sizeof(sp_point)); 805 memcpy(r, &t[0], sizeof(sp_point));
806 806
807 memset(t, 0, sizeof(t)); //paranoia 807 memset(t, 0, sizeof(t)); //paranoia
808} 808}
809 809
810/* Multiply the base point of P256 by the scalar and return the result. 810/* Multiply the base point of P256 by the scalar and return the result.
@@ -816,7 +816,7 @@ static void sp_256_ecc_mulmod_10(sp_point* r, const sp_point* g, const sp_digit*
816 */ 816 */
817static void sp_256_ecc_mulmod_base_10(sp_point* r, sp_digit* k /*, int map*/) 817static void sp_256_ecc_mulmod_base_10(sp_point* r, sp_digit* k /*, int map*/)
818{ 818{
819 sp_256_ecc_mulmod_10(r, &p256_base, k /*, map*/); 819 sp_256_ecc_mulmod_10(r, &p256_base, k /*, map*/);
820} 820}
821 821
822/* Multiply the point by the scalar and serialize the X ordinate. 822/* Multiply the point by the scalar and serialize the X ordinate.
@@ -828,22 +828,22 @@ static void sp_256_ecc_mulmod_base_10(sp_point* r, sp_digit* k /*, int map*/)
828 */ 828 */
829static void sp_ecc_secret_gen_256(sp_digit priv[10], const uint8_t *pub2x32, uint8_t* out32) 829static void sp_ecc_secret_gen_256(sp_digit priv[10], const uint8_t *pub2x32, uint8_t* out32)
830{ 830{
831 sp_point point[1]; 831 sp_point point[1];
832 832
833#if FIXED_PEER_PUBKEY 833#if FIXED_PEER_PUBKEY
834 memset((void*)pub2x32, 0x55, 64); 834 memset((void*)pub2x32, 0x55, 64);
835#endif 835#endif
836 dump_hex("peerkey %s\n", pub2x32, 32); /* in TLS, this is peer's public key */ 836 dump_hex("peerkey %s\n", pub2x32, 32); /* in TLS, this is peer's public key */
837 dump_hex(" %s\n", pub2x32 + 32, 32); 837 dump_hex(" %s\n", pub2x32 + 32, 32);
838 838
839 sp_256_point_from_bin2x32(point, pub2x32); 839 sp_256_point_from_bin2x32(point, pub2x32);
840 dump_hex("point->x %s\n", point->x, sizeof(point->x)); 840 dump_hex("point->x %s\n", point->x, sizeof(point->x));
841 dump_hex("point->y %s\n", point->y, sizeof(point->y)); 841 dump_hex("point->y %s\n", point->y, sizeof(point->y));
842 842
843 sp_256_ecc_mulmod_10(point, point, priv); 843 sp_256_ecc_mulmod_10(point, point, priv);
844 844
845 sp_256_to_bin(point->x, out32); 845 sp_256_to_bin(point->x, out32);
846 dump_hex("out32: %s\n", out32, 32); 846 dump_hex("out32: %s\n", out32, 32);
847} 847}
848 848
849/* Generates a scalar that is in the range 1..order-1. */ 849/* Generates a scalar that is in the range 1..order-1. */
@@ -852,8 +852,8 @@ static void sp_ecc_secret_gen_256(sp_digit priv[10], const uint8_t *pub2x32, uin
852#if !SIMPLIFY 852#if !SIMPLIFY
853static void sp_256_add_one_10(sp_digit* a) 853static void sp_256_add_one_10(sp_digit* a)
854{ 854{
855 a[0]++; 855 a[0]++;
856 sp_256_norm_10(a); 856 sp_256_norm_10(a);
857} 857}
858#endif 858#endif
859static void sp_256_ecc_gen_k_10(sp_digit k[10]) 859static void sp_256_ecc_gen_k_10(sp_digit k[10])