The Tor Browser / file comparison
comparison: security/nss/lib/freebl/ecl/ecp_fp224.c
security/nss/lib/freebl/ecl/ecp_fp224.c
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
equal
deleted
inserted
replaced
| -1:000000000000 | 0:ba3f621cd686 |
|---|---|
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 #include "ecp_fp.h" | |
| 6 #include <stdlib.h> | |
| 7 | |
| 8 #define ECFP_BSIZE 224 | |
| 9 #define ECFP_NUMDOUBLES 10 | |
| 10 | |
| 11 #include "ecp_fpinc.c" | |
| 12 | |
| 13 /* Performs a single step of reduction, just on the uppermost float | |
| 14 * (assumes already tidied), and then retidies. Note, this does not | |
| 15 * guarantee that the result will be less than p. */ | |
| 16 void | |
| 17 ecfp224_singleReduce(double *r, const EC_group_fp * group) | |
| 18 { | |
| 19 double q; | |
| 20 | |
| 21 ECFP_ASSERT(group->doubleBitSize == 24); | |
| 22 ECFP_ASSERT(group->primeBitSize == 224); | |
| 23 ECFP_ASSERT(group->numDoubles == 10); | |
| 24 | |
| 25 q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224; | |
| 26 q += group->bitSize_alpha; | |
| 27 q -= group->bitSize_alpha; | |
| 28 | |
| 29 r[ECFP_NUMDOUBLES - 1] -= q; | |
| 30 r[0] -= q * ecfp_twom224; | |
| 31 r[4] += q * ecfp_twom128; | |
| 32 | |
| 33 ecfp_positiveTidy(r, group); | |
| 34 } | |
| 35 | |
| 36 /* | |
| 37 * Performs imperfect reduction. This might leave some negative terms, | |
| 38 * and one more reduction might be required for the result to be between 0 | |
| 39 * and p-1. x should be be an array of at least 20, and r at least 10 x | |
| 40 * and r can be the same, but then the upper parts of r are not zeroed */ | |
| 41 void | |
| 42 ecfp224_reduce(double *r, double *x, const EC_group_fp * group) | |
| 43 { | |
| 44 | |
| 45 double x10, x11, x12, x13, x14, q; | |
| 46 | |
| 47 ECFP_ASSERT(group->doubleBitSize == 24); | |
| 48 ECFP_ASSERT(group->primeBitSize == 224); | |
| 49 ECFP_ASSERT(group->numDoubles == 10); | |
| 50 | |
| 51 /* Tidy just the upper bits of x. Don't need to tidy the lower ones | |
| 52 * yet. */ | |
| 53 ecfp_tidyUpper(x, group); | |
| 54 | |
| 55 x10 = x[10] + x[16] * ecfp_twom128; | |
| 56 x11 = x[11] + x[17] * ecfp_twom128; | |
| 57 x12 = x[12] + x[18] * ecfp_twom128; | |
| 58 x13 = x[13] + x[19] * ecfp_twom128; | |
| 59 | |
| 60 /* Tidy up, or we won't have enough bits later to add it in */ | |
| 61 q = x10 + group->alpha[11]; | |
| 62 q -= group->alpha[11]; | |
| 63 x10 -= q; | |
| 64 x11 = x11 + q; | |
| 65 | |
| 66 q = x11 + group->alpha[12]; | |
| 67 q -= group->alpha[12]; | |
| 68 x11 -= q; | |
| 69 x12 = x12 + q; | |
| 70 | |
| 71 q = x12 + group->alpha[13]; | |
| 72 q -= group->alpha[13]; | |
| 73 x12 -= q; | |
| 74 x13 = x13 + q; | |
| 75 | |
| 76 q = x13 + group->alpha[14]; | |
| 77 q -= group->alpha[14]; | |
| 78 x13 -= q; | |
| 79 x14 = x[14] + q; | |
| 80 | |
| 81 r[9] = x[9] + x[15] * ecfp_twom128 - x[19] * ecfp_twom224; | |
| 82 r[8] = x[8] + x14 * ecfp_twom128 - x[18] * ecfp_twom224; | |
| 83 r[7] = x[7] + x13 * ecfp_twom128 - x[17] * ecfp_twom224; | |
| 84 r[6] = x[6] + x12 * ecfp_twom128 - x[16] * ecfp_twom224; | |
| 85 r[5] = x[5] + x11 * ecfp_twom128 - x[15] * ecfp_twom224; | |
| 86 r[4] = x[4] + x10 * ecfp_twom128 - x14 * ecfp_twom224; | |
| 87 r[3] = x[3] - x13 * ecfp_twom224; | |
| 88 r[2] = x[2] - x12 * ecfp_twom224; | |
| 89 r[1] = x[1] - x11 * ecfp_twom224; | |
| 90 r[0] = x[0] - x10 * ecfp_twom224; | |
| 91 | |
| 92 /* | |
| 93 * Tidy up just r[ECFP_NUMDOUBLES-2] so that the number of reductions | |
| 94 * is accurate plus or minus one. (Rather than tidy all to make it | |
| 95 * totally accurate) */ | |
| 96 q = r[ECFP_NUMDOUBLES - 2] + group->alpha[ECFP_NUMDOUBLES - 1]; | |
| 97 q -= group->alpha[ECFP_NUMDOUBLES - 1]; | |
| 98 r[ECFP_NUMDOUBLES - 2] -= q; | |
| 99 r[ECFP_NUMDOUBLES - 1] += q; | |
| 100 | |
| 101 /* Tidy up the excess bits on r[ECFP_NUMDOUBLES-1] using reduction */ | |
| 102 /* Use ecfp_beta so we get a positive res */ | |
| 103 q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224; | |
| 104 q += group->bitSize_alpha; | |
| 105 q -= group->bitSize_alpha; | |
| 106 | |
| 107 r[ECFP_NUMDOUBLES - 1] -= q; | |
| 108 r[0] -= q * ecfp_twom224; | |
| 109 r[4] += q * ecfp_twom128; | |
| 110 | |
| 111 ecfp_tidyShort(r, group); | |
| 112 } | |
| 113 | |
| 114 /* Sets group to use optimized calculations in this file */ | |
| 115 mp_err | |
| 116 ec_group_set_nistp224_fp(ECGroup *group) | |
| 117 { | |
| 118 | |
| 119 EC_group_fp *fpg; | |
| 120 | |
| 121 /* Allocate memory for floating point group data */ | |
| 122 fpg = (EC_group_fp *) malloc(sizeof(EC_group_fp)); | |
| 123 if (fpg == NULL) { | |
| 124 return MP_MEM; | |
| 125 } | |
| 126 | |
| 127 fpg->numDoubles = ECFP_NUMDOUBLES; | |
| 128 fpg->primeBitSize = ECFP_BSIZE; | |
| 129 fpg->orderBitSize = 224; | |
| 130 fpg->doubleBitSize = 24; | |
| 131 fpg->numInts = (ECFP_BSIZE + ECL_BITS - 1) / ECL_BITS; | |
| 132 fpg->aIsM3 = 1; | |
| 133 fpg->ecfp_singleReduce = &ecfp224_singleReduce; | |
| 134 fpg->ecfp_reduce = &ecfp224_reduce; | |
| 135 fpg->ecfp_tidy = &ecfp_tidy; | |
| 136 | |
| 137 fpg->pt_add_jac_aff = &ecfp224_pt_add_jac_aff; | |
| 138 fpg->pt_add_jac = &ecfp224_pt_add_jac; | |
| 139 fpg->pt_add_jm_chud = &ecfp224_pt_add_jm_chud; | |
| 140 fpg->pt_add_chud = &ecfp224_pt_add_chud; | |
| 141 fpg->pt_dbl_jac = &ecfp224_pt_dbl_jac; | |
| 142 fpg->pt_dbl_jm = &ecfp224_pt_dbl_jm; | |
| 143 fpg->pt_dbl_aff2chud = &ecfp224_pt_dbl_aff2chud; | |
| 144 fpg->precompute_chud = &ecfp224_precompute_chud; | |
| 145 fpg->precompute_jac = &ecfp224_precompute_jac; | |
| 146 | |
| 147 group->point_mul = &ec_GFp_point_mul_wNAF_fp; | |
| 148 group->points_mul = &ec_pts_mul_basic; | |
| 149 group->extra1 = fpg; | |
| 150 group->extra_free = &ec_GFp_extra_free_fp; | |
| 151 | |
| 152 ec_set_fp_precision(fpg); | |
| 153 fpg->bitSize_alpha = ECFP_TWO224 * fpg->alpha[0]; | |
| 154 | |
| 155 return MP_OKAY; | |
| 156 } |
