The Tor Browser / file comparison
comparison: security/nss/lib/freebl/ecl/ec2_193.c
security/nss/lib/freebl/ecl/ec2_193.c
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:1860e7e95d19 |
|---|---|
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 #include "ec2.h" | |
| 6 #include "mp_gf2m.h" | |
| 7 #include "mp_gf2m-priv.h" | |
| 8 #include "mpi.h" | |
| 9 #include "mpi-priv.h" | |
| 10 #include <stdlib.h> | |
| 11 | |
| 12 /* Fast reduction for polynomials over a 193-bit curve. Assumes reduction | |
| 13 * polynomial with terms {193, 15, 0}. */ | |
| 14 mp_err | |
| 15 ec_GF2m_193_mod(const mp_int *a, mp_int *r, const GFMethod *meth) | |
| 16 { | |
| 17 mp_err res = MP_OKAY; | |
| 18 mp_digit *u, z; | |
| 19 | |
| 20 if (a != r) { | |
| 21 MP_CHECKOK(mp_copy(a, r)); | |
| 22 } | |
| 23 #ifdef ECL_SIXTY_FOUR_BIT | |
| 24 if (MP_USED(r) < 7) { | |
| 25 MP_CHECKOK(s_mp_pad(r, 7)); | |
| 26 } | |
| 27 u = MP_DIGITS(r); | |
| 28 MP_USED(r) = 7; | |
| 29 | |
| 30 /* u[6] only has 2 significant bits */ | |
| 31 z = u[6]; | |
| 32 u[3] ^= (z << 14) ^ (z >> 1); | |
| 33 u[2] ^= (z << 63); | |
| 34 z = u[5]; | |
| 35 u[3] ^= (z >> 50); | |
| 36 u[2] ^= (z << 14) ^ (z >> 1); | |
| 37 u[1] ^= (z << 63); | |
| 38 z = u[4]; | |
| 39 u[2] ^= (z >> 50); | |
| 40 u[1] ^= (z << 14) ^ (z >> 1); | |
| 41 u[0] ^= (z << 63); | |
| 42 z = u[3] >> 1; /* z only has 63 significant bits */ | |
| 43 u[1] ^= (z >> 49); | |
| 44 u[0] ^= (z << 15) ^ z; | |
| 45 /* clear bits above 193 */ | |
| 46 u[6] = u[5] = u[4] = 0; | |
| 47 u[3] ^= z << 1; | |
| 48 #else | |
| 49 if (MP_USED(r) < 13) { | |
| 50 MP_CHECKOK(s_mp_pad(r, 13)); | |
| 51 } | |
| 52 u = MP_DIGITS(r); | |
| 53 MP_USED(r) = 13; | |
| 54 | |
| 55 /* u[12] only has 2 significant bits */ | |
| 56 z = u[12]; | |
| 57 u[6] ^= (z << 14) ^ (z >> 1); | |
| 58 u[5] ^= (z << 31); | |
| 59 z = u[11]; | |
| 60 u[6] ^= (z >> 18); | |
| 61 u[5] ^= (z << 14) ^ (z >> 1); | |
| 62 u[4] ^= (z << 31); | |
| 63 z = u[10]; | |
| 64 u[5] ^= (z >> 18); | |
| 65 u[4] ^= (z << 14) ^ (z >> 1); | |
| 66 u[3] ^= (z << 31); | |
| 67 z = u[9]; | |
| 68 u[4] ^= (z >> 18); | |
| 69 u[3] ^= (z << 14) ^ (z >> 1); | |
| 70 u[2] ^= (z << 31); | |
| 71 z = u[8]; | |
| 72 u[3] ^= (z >> 18); | |
| 73 u[2] ^= (z << 14) ^ (z >> 1); | |
| 74 u[1] ^= (z << 31); | |
| 75 z = u[7]; | |
| 76 u[2] ^= (z >> 18); | |
| 77 u[1] ^= (z << 14) ^ (z >> 1); | |
| 78 u[0] ^= (z << 31); | |
| 79 z = u[6] >> 1; /* z only has 31 significant bits */ | |
| 80 u[1] ^= (z >> 17); | |
| 81 u[0] ^= (z << 15) ^ z; | |
| 82 /* clear bits above 193 */ | |
| 83 u[12] = u[11] = u[10] = u[9] = u[8] = u[7] = 0; | |
| 84 u[6] ^= z << 1; | |
| 85 #endif | |
| 86 s_mp_clamp(r); | |
| 87 | |
| 88 CLEANUP: | |
| 89 return res; | |
| 90 } | |
| 91 | |
| 92 /* Fast squaring for polynomials over a 193-bit curve. Assumes reduction | |
| 93 * polynomial with terms {193, 15, 0}. */ | |
| 94 mp_err | |
| 95 ec_GF2m_193_sqr(const mp_int *a, mp_int *r, const GFMethod *meth) | |
| 96 { | |
| 97 mp_err res = MP_OKAY; | |
| 98 mp_digit *u, *v; | |
| 99 | |
| 100 v = MP_DIGITS(a); | |
| 101 | |
| 102 #ifdef ECL_SIXTY_FOUR_BIT | |
| 103 if (MP_USED(a) < 4) { | |
| 104 return mp_bsqrmod(a, meth->irr_arr, r); | |
| 105 } | |
| 106 if (MP_USED(r) < 7) { | |
| 107 MP_CHECKOK(s_mp_pad(r, 7)); | |
| 108 } | |
| 109 MP_USED(r) = 7; | |
| 110 #else | |
| 111 if (MP_USED(a) < 7) { | |
| 112 return mp_bsqrmod(a, meth->irr_arr, r); | |
| 113 } | |
| 114 if (MP_USED(r) < 13) { | |
| 115 MP_CHECKOK(s_mp_pad(r, 13)); | |
| 116 } | |
| 117 MP_USED(r) = 13; | |
| 118 #endif | |
| 119 u = MP_DIGITS(r); | |
| 120 | |
| 121 #ifdef ECL_THIRTY_TWO_BIT | |
| 122 u[12] = gf2m_SQR0(v[6]); | |
| 123 u[11] = gf2m_SQR1(v[5]); | |
| 124 u[10] = gf2m_SQR0(v[5]); | |
| 125 u[9] = gf2m_SQR1(v[4]); | |
| 126 u[8] = gf2m_SQR0(v[4]); | |
| 127 u[7] = gf2m_SQR1(v[3]); | |
| 128 #endif | |
| 129 u[6] = gf2m_SQR0(v[3]); | |
| 130 u[5] = gf2m_SQR1(v[2]); | |
| 131 u[4] = gf2m_SQR0(v[2]); | |
| 132 u[3] = gf2m_SQR1(v[1]); | |
| 133 u[2] = gf2m_SQR0(v[1]); | |
| 134 u[1] = gf2m_SQR1(v[0]); | |
| 135 u[0] = gf2m_SQR0(v[0]); | |
| 136 return ec_GF2m_193_mod(r, r, meth); | |
| 137 | |
| 138 CLEANUP: | |
| 139 return res; | |
| 140 } | |
| 141 | |
| 142 /* Fast multiplication for polynomials over a 193-bit curve. Assumes | |
| 143 * reduction polynomial with terms {193, 15, 0}. */ | |
| 144 mp_err | |
| 145 ec_GF2m_193_mul(const mp_int *a, const mp_int *b, mp_int *r, | |
| 146 const GFMethod *meth) | |
| 147 { | |
| 148 mp_err res = MP_OKAY; | |
| 149 mp_digit a3 = 0, a2 = 0, a1 = 0, a0, b3 = 0, b2 = 0, b1 = 0, b0; | |
| 150 | |
| 151 #ifdef ECL_THIRTY_TWO_BIT | |
| 152 mp_digit a6 = 0, a5 = 0, a4 = 0, b6 = 0, b5 = 0, b4 = 0; | |
| 153 mp_digit rm[8]; | |
| 154 #endif | |
| 155 | |
| 156 if (a == b) { | |
| 157 return ec_GF2m_193_sqr(a, r, meth); | |
| 158 } else { | |
| 159 switch (MP_USED(a)) { | |
| 160 #ifdef ECL_THIRTY_TWO_BIT | |
| 161 case 7: | |
| 162 a6 = MP_DIGIT(a, 6); | |
| 163 case 6: | |
| 164 a5 = MP_DIGIT(a, 5); | |
| 165 case 5: | |
| 166 a4 = MP_DIGIT(a, 4); | |
| 167 #endif | |
| 168 case 4: | |
| 169 a3 = MP_DIGIT(a, 3); | |
| 170 case 3: | |
| 171 a2 = MP_DIGIT(a, 2); | |
| 172 case 2: | |
| 173 a1 = MP_DIGIT(a, 1); | |
| 174 default: | |
| 175 a0 = MP_DIGIT(a, 0); | |
| 176 } | |
| 177 switch (MP_USED(b)) { | |
| 178 #ifdef ECL_THIRTY_TWO_BIT | |
| 179 case 7: | |
| 180 b6 = MP_DIGIT(b, 6); | |
| 181 case 6: | |
| 182 b5 = MP_DIGIT(b, 5); | |
| 183 case 5: | |
| 184 b4 = MP_DIGIT(b, 4); | |
| 185 #endif | |
| 186 case 4: | |
| 187 b3 = MP_DIGIT(b, 3); | |
| 188 case 3: | |
| 189 b2 = MP_DIGIT(b, 2); | |
| 190 case 2: | |
| 191 b1 = MP_DIGIT(b, 1); | |
| 192 default: | |
| 193 b0 = MP_DIGIT(b, 0); | |
| 194 } | |
| 195 #ifdef ECL_SIXTY_FOUR_BIT | |
| 196 MP_CHECKOK(s_mp_pad(r, 8)); | |
| 197 s_bmul_4x4(MP_DIGITS(r), a3, a2, a1, a0, b3, b2, b1, b0); | |
| 198 MP_USED(r) = 8; | |
| 199 s_mp_clamp(r); | |
| 200 #else | |
| 201 MP_CHECKOK(s_mp_pad(r, 14)); | |
| 202 s_bmul_3x3(MP_DIGITS(r) + 8, a6, a5, a4, b6, b5, b4); | |
| 203 s_bmul_4x4(MP_DIGITS(r), a3, a2, a1, a0, b3, b2, b1, b0); | |
| 204 s_bmul_4x4(rm, a3, a6 ^ a2, a5 ^ a1, a4 ^ a0, b3, b6 ^ b2, b5 ^ b1, | |
| 205 b4 ^ b0); | |
| 206 rm[7] ^= MP_DIGIT(r, 7); | |
| 207 rm[6] ^= MP_DIGIT(r, 6); | |
| 208 rm[5] ^= MP_DIGIT(r, 5) ^ MP_DIGIT(r, 13); | |
| 209 rm[4] ^= MP_DIGIT(r, 4) ^ MP_DIGIT(r, 12); | |
| 210 rm[3] ^= MP_DIGIT(r, 3) ^ MP_DIGIT(r, 11); | |
| 211 rm[2] ^= MP_DIGIT(r, 2) ^ MP_DIGIT(r, 10); | |
| 212 rm[1] ^= MP_DIGIT(r, 1) ^ MP_DIGIT(r, 9); | |
| 213 rm[0] ^= MP_DIGIT(r, 0) ^ MP_DIGIT(r, 8); | |
| 214 MP_DIGIT(r, 11) ^= rm[7]; | |
| 215 MP_DIGIT(r, 10) ^= rm[6]; | |
| 216 MP_DIGIT(r, 9) ^= rm[5]; | |
| 217 MP_DIGIT(r, 8) ^= rm[4]; | |
| 218 MP_DIGIT(r, 7) ^= rm[3]; | |
| 219 MP_DIGIT(r, 6) ^= rm[2]; | |
| 220 MP_DIGIT(r, 5) ^= rm[1]; | |
| 221 MP_DIGIT(r, 4) ^= rm[0]; | |
| 222 MP_USED(r) = 14; | |
| 223 s_mp_clamp(r); | |
| 224 #endif | |
| 225 return ec_GF2m_193_mod(r, r, meth); | |
| 226 } | |
| 227 | |
| 228 CLEANUP: | |
| 229 return res; | |
| 230 } | |
| 231 | |
| 232 /* Wire in fast field arithmetic for 193-bit curves. */ | |
| 233 mp_err | |
| 234 ec_group_set_gf2m193(ECGroup *group, ECCurveName name) | |
| 235 { | |
| 236 group->meth->field_mod = &ec_GF2m_193_mod; | |
| 237 group->meth->field_mul = &ec_GF2m_193_mul; | |
| 238 group->meth->field_sqr = &ec_GF2m_193_sqr; | |
| 239 return MP_OKAY; | |
| 240 } |
