security/nss/lib/freebl/ecl/ecp_fp160.c@b8a032363ba2 (annotated)
security/nss/lib/freebl/ecl/ecp_fp160.c
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | /* This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 2 | * License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 3 | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| michael@0 | 4 | |
| michael@0 | 5 | #include "ecp_fp.h" |
| michael@0 | 6 | #include <stdlib.h> |
| michael@0 | 7 | |
| michael@0 | 8 | #define ECFP_BSIZE 160 |
| michael@0 | 9 | #define ECFP_NUMDOUBLES 7 |
| michael@0 | 10 | |
| michael@0 | 11 | #include "ecp_fpinc.c" |
| michael@0 | 12 | |
| michael@0 | 13 | /* Performs a single step of reduction, just on the uppermost float |
| michael@0 | 14 | * (assumes already tidied), and then retidies. Note, this does not |
| michael@0 | 15 | * guarantee that the result will be less than p, but truncates the number |
| michael@0 | 16 | * of bits. */ |
| michael@0 | 17 | void |
| michael@0 | 18 | ecfp160_singleReduce(double *d, const EC_group_fp * group) |
| michael@0 | 19 | { |
| michael@0 | 20 | double q; |
| michael@0 | 21 | |
| michael@0 | 22 | ECFP_ASSERT(group->doubleBitSize == 24); |
| michael@0 | 23 | ECFP_ASSERT(group->primeBitSize == 160); |
| michael@0 | 24 | ECFP_ASSERT(ECFP_NUMDOUBLES == 7); |
| michael@0 | 25 | |
| michael@0 | 26 | q = d[ECFP_NUMDOUBLES - 1] - ecfp_beta_160; |
| michael@0 | 27 | q += group->bitSize_alpha; |
| michael@0 | 28 | q -= group->bitSize_alpha; |
| michael@0 | 29 | |
| michael@0 | 30 | d[ECFP_NUMDOUBLES - 1] -= q; |
| michael@0 | 31 | d[0] += q * ecfp_twom160; |
| michael@0 | 32 | d[1] += q * ecfp_twom129; |
| michael@0 | 33 | ecfp_positiveTidy(d, group); |
| michael@0 | 34 | |
| michael@0 | 35 | /* Assertions for the highest order term */ |
| michael@0 | 36 | ECFP_ASSERT(d[ECFP_NUMDOUBLES - 1] / ecfp_exp[ECFP_NUMDOUBLES - 1] == |
| michael@0 | 37 | (unsigned long long) (d[ECFP_NUMDOUBLES - 1] / |
| michael@0 | 38 | ecfp_exp[ECFP_NUMDOUBLES - 1])); |
| michael@0 | 39 | ECFP_ASSERT(d[ECFP_NUMDOUBLES - 1] >= 0); |
| michael@0 | 40 | } |
| michael@0 | 41 | |
| michael@0 | 42 | /* Performs imperfect reduction. This might leave some negative terms, |
| michael@0 | 43 | * and one more reduction might be required for the result to be between 0 |
| michael@0 | 44 | * and p-1. x should not already be reduced, i.e. should have |
| michael@0 | 45 | * 2*ECFP_NUMDOUBLES significant terms. x and r can be the same, but then |
| michael@0 | 46 | * the upper parts of r are not zeroed */ |
| michael@0 | 47 | void |
| michael@0 | 48 | ecfp160_reduce(double *r, double *x, const EC_group_fp * group) |
| michael@0 | 49 | { |
| michael@0 | 50 | |
| michael@0 | 51 | double x7, x8, q; |
| michael@0 | 52 | |
| michael@0 | 53 | ECFP_ASSERT(group->doubleBitSize == 24); |
| michael@0 | 54 | ECFP_ASSERT(group->primeBitSize == 160); |
| michael@0 | 55 | ECFP_ASSERT(ECFP_NUMDOUBLES == 7); |
| michael@0 | 56 | |
| michael@0 | 57 | /* Tidy just the upper bits, the lower bits can wait. */ |
| michael@0 | 58 | ecfp_tidyUpper(x, group); |
| michael@0 | 59 | |
| michael@0 | 60 | /* Assume that this is already tidied so that we have enough extra |
| michael@0 | 61 | * bits */ |
| michael@0 | 62 | x7 = x[7] + x[13] * ecfp_twom129; /* adds bits 15-39 */ |
| michael@0 | 63 | |
| michael@0 | 64 | /* Tidy x7, or we won't have enough bits later to add it in */ |
| michael@0 | 65 | q = x7 + group->alpha[8]; |
| michael@0 | 66 | q -= group->alpha[8]; |
| michael@0 | 67 | x7 -= q; /* holds bits 0-24 */ |
| michael@0 | 68 | x8 = x[8] + q; /* holds bits 0-25 */ |
| michael@0 | 69 | |
| michael@0 | 70 | r[6] = x[6] + x[13] * ecfp_twom160 + x[12] * ecfp_twom129; /* adds |
| michael@0 | 71 | * bits |
| michael@0 | 72 | * 8-39 */ |
| michael@0 | 73 | r[5] = x[5] + x[12] * ecfp_twom160 + x[11] * ecfp_twom129; |
| michael@0 | 74 | r[4] = x[4] + x[11] * ecfp_twom160 + x[10] * ecfp_twom129; |
| michael@0 | 75 | r[3] = x[3] + x[10] * ecfp_twom160 + x[9] * ecfp_twom129; |
| michael@0 | 76 | r[2] = x[2] + x[9] * ecfp_twom160 + x8 * ecfp_twom129; /* adds bits |
| michael@0 | 77 | * 8-40 */ |
| michael@0 | 78 | r[1] = x[1] + x8 * ecfp_twom160 + x7 * ecfp_twom129; /* adds bits |
| michael@0 | 79 | * 8-39 */ |
| michael@0 | 80 | r[0] = x[0] + x7 * ecfp_twom160; |
| michael@0 | 81 | |
| michael@0 | 82 | /* Tidy up just r[ECFP_NUMDOUBLES-2] so that the number of reductions |
| michael@0 | 83 | * is accurate plus or minus one. (Rather than tidy all to make it |
| michael@0 | 84 | * totally accurate, which is more costly.) */ |
| michael@0 | 85 | q = r[ECFP_NUMDOUBLES - 2] + group->alpha[ECFP_NUMDOUBLES - 1]; |
| michael@0 | 86 | q -= group->alpha[ECFP_NUMDOUBLES - 1]; |
| michael@0 | 87 | r[ECFP_NUMDOUBLES - 2] -= q; |
| michael@0 | 88 | r[ECFP_NUMDOUBLES - 1] += q; |
| michael@0 | 89 | |
| michael@0 | 90 | /* Tidy up the excess bits on r[ECFP_NUMDOUBLES-1] using reduction */ |
| michael@0 | 91 | /* Use ecfp_beta so we get a positive result */ |
| michael@0 | 92 | q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_160; |
| michael@0 | 93 | q += group->bitSize_alpha; |
| michael@0 | 94 | q -= group->bitSize_alpha; |
| michael@0 | 95 | |
| michael@0 | 96 | r[ECFP_NUMDOUBLES - 1] -= q; |
| michael@0 | 97 | r[0] += q * ecfp_twom160; |
| michael@0 | 98 | r[1] += q * ecfp_twom129; |
| michael@0 | 99 | |
| michael@0 | 100 | /* Tidy the result */ |
| michael@0 | 101 | ecfp_tidyShort(r, group); |
| michael@0 | 102 | } |
| michael@0 | 103 | |
| michael@0 | 104 | /* Sets group to use optimized calculations in this file */ |
| michael@0 | 105 | mp_err |
| michael@0 | 106 | ec_group_set_secp160r1_fp(ECGroup *group) |
| michael@0 | 107 | { |
| michael@0 | 108 | |
| michael@0 | 109 | EC_group_fp *fpg = NULL; |
| michael@0 | 110 | |
| michael@0 | 111 | /* Allocate memory for floating point group data */ |
| michael@0 | 112 | fpg = (EC_group_fp *) malloc(sizeof(EC_group_fp)); |
| michael@0 | 113 | if (fpg == NULL) { |
| michael@0 | 114 | return MP_MEM; |
| michael@0 | 115 | } |
| michael@0 | 116 | |
| michael@0 | 117 | fpg->numDoubles = ECFP_NUMDOUBLES; |
| michael@0 | 118 | fpg->primeBitSize = ECFP_BSIZE; |
| michael@0 | 119 | fpg->orderBitSize = 161; |
| michael@0 | 120 | fpg->doubleBitSize = 24; |
| michael@0 | 121 | fpg->numInts = (ECFP_BSIZE + ECL_BITS - 1) / ECL_BITS; |
| michael@0 | 122 | fpg->aIsM3 = 1; |
| michael@0 | 123 | fpg->ecfp_singleReduce = &ecfp160_singleReduce; |
| michael@0 | 124 | fpg->ecfp_reduce = &ecfp160_reduce; |
| michael@0 | 125 | fpg->ecfp_tidy = &ecfp_tidy; |
| michael@0 | 126 | |
| michael@0 | 127 | fpg->pt_add_jac_aff = &ecfp160_pt_add_jac_aff; |
| michael@0 | 128 | fpg->pt_add_jac = &ecfp160_pt_add_jac; |
| michael@0 | 129 | fpg->pt_add_jm_chud = &ecfp160_pt_add_jm_chud; |
| michael@0 | 130 | fpg->pt_add_chud = &ecfp160_pt_add_chud; |
| michael@0 | 131 | fpg->pt_dbl_jac = &ecfp160_pt_dbl_jac; |
| michael@0 | 132 | fpg->pt_dbl_jm = &ecfp160_pt_dbl_jm; |
| michael@0 | 133 | fpg->pt_dbl_aff2chud = &ecfp160_pt_dbl_aff2chud; |
| michael@0 | 134 | fpg->precompute_chud = &ecfp160_precompute_chud; |
| michael@0 | 135 | fpg->precompute_jac = &ecfp160_precompute_jac; |
| michael@0 | 136 | |
| michael@0 | 137 | group->point_mul = &ec_GFp_point_mul_wNAF_fp; |
| michael@0 | 138 | group->points_mul = &ec_pts_mul_basic; |
| michael@0 | 139 | group->extra1 = fpg; |
| michael@0 | 140 | group->extra_free = &ec_GFp_extra_free_fp; |
| michael@0 | 141 | |
| michael@0 | 142 | ec_set_fp_precision(fpg); |
| michael@0 | 143 | fpg->bitSize_alpha = ECFP_TWO160 * fpg->alpha[0]; |
| michael@0 | 144 | return MP_OKAY; |
| michael@0 | 145 | } |
