security/nss/lib/freebl/ecl/ecp_fp224.c@b8a032363ba2 (annotated)
security/nss/lib/freebl/ecl/ecp_fp224.c
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | /* This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 2 | * License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 3 | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| michael@0 | 4 | |
| michael@0 | 5 | #include "ecp_fp.h" |
| michael@0 | 6 | #include <stdlib.h> |
| michael@0 | 7 | |
| michael@0 | 8 | #define ECFP_BSIZE 224 |
| michael@0 | 9 | #define ECFP_NUMDOUBLES 10 |
| michael@0 | 10 | |
| michael@0 | 11 | #include "ecp_fpinc.c" |
| michael@0 | 12 | |
| michael@0 | 13 | /* Performs a single step of reduction, just on the uppermost float |
| michael@0 | 14 | * (assumes already tidied), and then retidies. Note, this does not |
| michael@0 | 15 | * guarantee that the result will be less than p. */ |
| michael@0 | 16 | void |
| michael@0 | 17 | ecfp224_singleReduce(double *r, const EC_group_fp * group) |
| michael@0 | 18 | { |
| michael@0 | 19 | double q; |
| michael@0 | 20 | |
| michael@0 | 21 | ECFP_ASSERT(group->doubleBitSize == 24); |
| michael@0 | 22 | ECFP_ASSERT(group->primeBitSize == 224); |
| michael@0 | 23 | ECFP_ASSERT(group->numDoubles == 10); |
| michael@0 | 24 | |
| michael@0 | 25 | q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224; |
| michael@0 | 26 | q += group->bitSize_alpha; |
| michael@0 | 27 | q -= group->bitSize_alpha; |
| michael@0 | 28 | |
| michael@0 | 29 | r[ECFP_NUMDOUBLES - 1] -= q; |
| michael@0 | 30 | r[0] -= q * ecfp_twom224; |
| michael@0 | 31 | r[4] += q * ecfp_twom128; |
| michael@0 | 32 | |
| michael@0 | 33 | ecfp_positiveTidy(r, group); |
| michael@0 | 34 | } |
| michael@0 | 35 | |
| michael@0 | 36 | /* |
| michael@0 | 37 | * Performs imperfect reduction. This might leave some negative terms, |
| michael@0 | 38 | * and one more reduction might be required for the result to be between 0 |
| michael@0 | 39 | * and p-1. x should be be an array of at least 20, and r at least 10 x |
| michael@0 | 40 | * and r can be the same, but then the upper parts of r are not zeroed */ |
| michael@0 | 41 | void |
| michael@0 | 42 | ecfp224_reduce(double *r, double *x, const EC_group_fp * group) |
| michael@0 | 43 | { |
| michael@0 | 44 | |
| michael@0 | 45 | double x10, x11, x12, x13, x14, q; |
| michael@0 | 46 | |
| michael@0 | 47 | ECFP_ASSERT(group->doubleBitSize == 24); |
| michael@0 | 48 | ECFP_ASSERT(group->primeBitSize == 224); |
| michael@0 | 49 | ECFP_ASSERT(group->numDoubles == 10); |
| michael@0 | 50 | |
| michael@0 | 51 | /* Tidy just the upper bits of x. Don't need to tidy the lower ones |
| michael@0 | 52 | * yet. */ |
| michael@0 | 53 | ecfp_tidyUpper(x, group); |
| michael@0 | 54 | |
| michael@0 | 55 | x10 = x[10] + x[16] * ecfp_twom128; |
| michael@0 | 56 | x11 = x[11] + x[17] * ecfp_twom128; |
| michael@0 | 57 | x12 = x[12] + x[18] * ecfp_twom128; |
| michael@0 | 58 | x13 = x[13] + x[19] * ecfp_twom128; |
| michael@0 | 59 | |
| michael@0 | 60 | /* Tidy up, or we won't have enough bits later to add it in */ |
| michael@0 | 61 | q = x10 + group->alpha[11]; |
| michael@0 | 62 | q -= group->alpha[11]; |
| michael@0 | 63 | x10 -= q; |
| michael@0 | 64 | x11 = x11 + q; |
| michael@0 | 65 | |
| michael@0 | 66 | q = x11 + group->alpha[12]; |
| michael@0 | 67 | q -= group->alpha[12]; |
| michael@0 | 68 | x11 -= q; |
| michael@0 | 69 | x12 = x12 + q; |
| michael@0 | 70 | |
| michael@0 | 71 | q = x12 + group->alpha[13]; |
| michael@0 | 72 | q -= group->alpha[13]; |
| michael@0 | 73 | x12 -= q; |
| michael@0 | 74 | x13 = x13 + q; |
| michael@0 | 75 | |
| michael@0 | 76 | q = x13 + group->alpha[14]; |
| michael@0 | 77 | q -= group->alpha[14]; |
| michael@0 | 78 | x13 -= q; |
| michael@0 | 79 | x14 = x[14] + q; |
| michael@0 | 80 | |
| michael@0 | 81 | r[9] = x[9] + x[15] * ecfp_twom128 - x[19] * ecfp_twom224; |
| michael@0 | 82 | r[8] = x[8] + x14 * ecfp_twom128 - x[18] * ecfp_twom224; |
| michael@0 | 83 | r[7] = x[7] + x13 * ecfp_twom128 - x[17] * ecfp_twom224; |
| michael@0 | 84 | r[6] = x[6] + x12 * ecfp_twom128 - x[16] * ecfp_twom224; |
| michael@0 | 85 | r[5] = x[5] + x11 * ecfp_twom128 - x[15] * ecfp_twom224; |
| michael@0 | 86 | r[4] = x[4] + x10 * ecfp_twom128 - x14 * ecfp_twom224; |
| michael@0 | 87 | r[3] = x[3] - x13 * ecfp_twom224; |
| michael@0 | 88 | r[2] = x[2] - x12 * ecfp_twom224; |
| michael@0 | 89 | r[1] = x[1] - x11 * ecfp_twom224; |
| michael@0 | 90 | r[0] = x[0] - x10 * ecfp_twom224; |
| michael@0 | 91 | |
| michael@0 | 92 | /* |
| michael@0 | 93 | * Tidy up just r[ECFP_NUMDOUBLES-2] so that the number of reductions |
| michael@0 | 94 | * is accurate plus or minus one. (Rather than tidy all to make it |
| michael@0 | 95 | * totally accurate) */ |
| michael@0 | 96 | q = r[ECFP_NUMDOUBLES - 2] + group->alpha[ECFP_NUMDOUBLES - 1]; |
| michael@0 | 97 | q -= group->alpha[ECFP_NUMDOUBLES - 1]; |
| michael@0 | 98 | r[ECFP_NUMDOUBLES - 2] -= q; |
| michael@0 | 99 | r[ECFP_NUMDOUBLES - 1] += q; |
| michael@0 | 100 | |
| michael@0 | 101 | /* Tidy up the excess bits on r[ECFP_NUMDOUBLES-1] using reduction */ |
| michael@0 | 102 | /* Use ecfp_beta so we get a positive res */ |
| michael@0 | 103 | q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224; |
| michael@0 | 104 | q += group->bitSize_alpha; |
| michael@0 | 105 | q -= group->bitSize_alpha; |
| michael@0 | 106 | |
| michael@0 | 107 | r[ECFP_NUMDOUBLES - 1] -= q; |
| michael@0 | 108 | r[0] -= q * ecfp_twom224; |
| michael@0 | 109 | r[4] += q * ecfp_twom128; |
| michael@0 | 110 | |
| michael@0 | 111 | ecfp_tidyShort(r, group); |
| michael@0 | 112 | } |
| michael@0 | 113 | |
| michael@0 | 114 | /* Sets group to use optimized calculations in this file */ |
| michael@0 | 115 | mp_err |
| michael@0 | 116 | ec_group_set_nistp224_fp(ECGroup *group) |
| michael@0 | 117 | { |
| michael@0 | 118 | |
| michael@0 | 119 | EC_group_fp *fpg; |
| michael@0 | 120 | |
| michael@0 | 121 | /* Allocate memory for floating point group data */ |
| michael@0 | 122 | fpg = (EC_group_fp *) malloc(sizeof(EC_group_fp)); |
| michael@0 | 123 | if (fpg == NULL) { |
| michael@0 | 124 | return MP_MEM; |
| michael@0 | 125 | } |
| michael@0 | 126 | |
| michael@0 | 127 | fpg->numDoubles = ECFP_NUMDOUBLES; |
| michael@0 | 128 | fpg->primeBitSize = ECFP_BSIZE; |
| michael@0 | 129 | fpg->orderBitSize = 224; |
| michael@0 | 130 | fpg->doubleBitSize = 24; |
| michael@0 | 131 | fpg->numInts = (ECFP_BSIZE + ECL_BITS - 1) / ECL_BITS; |
| michael@0 | 132 | fpg->aIsM3 = 1; |
| michael@0 | 133 | fpg->ecfp_singleReduce = &ecfp224_singleReduce; |
| michael@0 | 134 | fpg->ecfp_reduce = &ecfp224_reduce; |
| michael@0 | 135 | fpg->ecfp_tidy = &ecfp_tidy; |
| michael@0 | 136 | |
| michael@0 | 137 | fpg->pt_add_jac_aff = &ecfp224_pt_add_jac_aff; |
| michael@0 | 138 | fpg->pt_add_jac = &ecfp224_pt_add_jac; |
| michael@0 | 139 | fpg->pt_add_jm_chud = &ecfp224_pt_add_jm_chud; |
| michael@0 | 140 | fpg->pt_add_chud = &ecfp224_pt_add_chud; |
| michael@0 | 141 | fpg->pt_dbl_jac = &ecfp224_pt_dbl_jac; |
| michael@0 | 142 | fpg->pt_dbl_jm = &ecfp224_pt_dbl_jm; |
| michael@0 | 143 | fpg->pt_dbl_aff2chud = &ecfp224_pt_dbl_aff2chud; |
| michael@0 | 144 | fpg->precompute_chud = &ecfp224_precompute_chud; |
| michael@0 | 145 | fpg->precompute_jac = &ecfp224_precompute_jac; |
| michael@0 | 146 | |
| michael@0 | 147 | group->point_mul = &ec_GFp_point_mul_wNAF_fp; |
| michael@0 | 148 | group->points_mul = &ec_pts_mul_basic; |
| michael@0 | 149 | group->extra1 = fpg; |
| michael@0 | 150 | group->extra_free = &ec_GFp_extra_free_fp; |
| michael@0 | 151 | |
| michael@0 | 152 | ec_set_fp_precision(fpg); |
| michael@0 | 153 | fpg->bitSize_alpha = ECFP_TWO224 * fpg->alpha[0]; |
| michael@0 | 154 | |
| michael@0 | 155 | return MP_OKAY; |
| michael@0 | 156 | } |
