1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/security/nss/lib/freebl/ecl/ecp_fp224.c Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,156 @@
1.4 +/* This Source Code Form is subject to the terms of the Mozilla Public
1.5 + * License, v. 2.0. If a copy of the MPL was not distributed with this
1.6 + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1.7 +
1.8 +#include "ecp_fp.h"
1.9 +#include <stdlib.h>
1.10 +
1.11 +#define ECFP_BSIZE 224
1.12 +#define ECFP_NUMDOUBLES 10
1.13 +
1.14 +#include "ecp_fpinc.c"
1.15 +
1.16 +/* Performs a single step of reduction, just on the uppermost float
1.17 + * (assumes already tidied), and then retidies. Note, this does not
1.18 + * guarantee that the result will be less than p. */
1.19 +void
1.20 +ecfp224_singleReduce(double *r, const EC_group_fp * group)
1.21 +{
1.22 + double q;
1.23 +
1.24 + ECFP_ASSERT(group->doubleBitSize == 24);
1.25 + ECFP_ASSERT(group->primeBitSize == 224);
1.26 + ECFP_ASSERT(group->numDoubles == 10);
1.27 +
1.28 + q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224;
1.29 + q += group->bitSize_alpha;
1.30 + q -= group->bitSize_alpha;
1.31 +
1.32 + r[ECFP_NUMDOUBLES - 1] -= q;
1.33 + r[0] -= q * ecfp_twom224;
1.34 + r[4] += q * ecfp_twom128;
1.35 +
1.36 + ecfp_positiveTidy(r, group);
1.37 +}
1.38 +
1.39 +/*
1.40 + * Performs imperfect reduction. This might leave some negative terms,
1.41 + * and one more reduction might be required for the result to be between 0
1.42 + * and p-1. x should be be an array of at least 20, and r at least 10 x
1.43 + * and r can be the same, but then the upper parts of r are not zeroed */
1.44 +void
1.45 +ecfp224_reduce(double *r, double *x, const EC_group_fp * group)
1.46 +{
1.47 +
1.48 + double x10, x11, x12, x13, x14, q;
1.49 +
1.50 + ECFP_ASSERT(group->doubleBitSize == 24);
1.51 + ECFP_ASSERT(group->primeBitSize == 224);
1.52 + ECFP_ASSERT(group->numDoubles == 10);
1.53 +
1.54 + /* Tidy just the upper bits of x. Don't need to tidy the lower ones
1.55 + * yet. */
1.56 + ecfp_tidyUpper(x, group);
1.57 +
1.58 + x10 = x[10] + x[16] * ecfp_twom128;
1.59 + x11 = x[11] + x[17] * ecfp_twom128;
1.60 + x12 = x[12] + x[18] * ecfp_twom128;
1.61 + x13 = x[13] + x[19] * ecfp_twom128;
1.62 +
1.63 + /* Tidy up, or we won't have enough bits later to add it in */
1.64 + q = x10 + group->alpha[11];
1.65 + q -= group->alpha[11];
1.66 + x10 -= q;
1.67 + x11 = x11 + q;
1.68 +
1.69 + q = x11 + group->alpha[12];
1.70 + q -= group->alpha[12];
1.71 + x11 -= q;
1.72 + x12 = x12 + q;
1.73 +
1.74 + q = x12 + group->alpha[13];
1.75 + q -= group->alpha[13];
1.76 + x12 -= q;
1.77 + x13 = x13 + q;
1.78 +
1.79 + q = x13 + group->alpha[14];
1.80 + q -= group->alpha[14];
1.81 + x13 -= q;
1.82 + x14 = x[14] + q;
1.83 +
1.84 + r[9] = x[9] + x[15] * ecfp_twom128 - x[19] * ecfp_twom224;
1.85 + r[8] = x[8] + x14 * ecfp_twom128 - x[18] * ecfp_twom224;
1.86 + r[7] = x[7] + x13 * ecfp_twom128 - x[17] * ecfp_twom224;
1.87 + r[6] = x[6] + x12 * ecfp_twom128 - x[16] * ecfp_twom224;
1.88 + r[5] = x[5] + x11 * ecfp_twom128 - x[15] * ecfp_twom224;
1.89 + r[4] = x[4] + x10 * ecfp_twom128 - x14 * ecfp_twom224;
1.90 + r[3] = x[3] - x13 * ecfp_twom224;
1.91 + r[2] = x[2] - x12 * ecfp_twom224;
1.92 + r[1] = x[1] - x11 * ecfp_twom224;
1.93 + r[0] = x[0] - x10 * ecfp_twom224;
1.94 +
1.95 + /*
1.96 + * Tidy up just r[ECFP_NUMDOUBLES-2] so that the number of reductions
1.97 + * is accurate plus or minus one. (Rather than tidy all to make it
1.98 + * totally accurate) */
1.99 + q = r[ECFP_NUMDOUBLES - 2] + group->alpha[ECFP_NUMDOUBLES - 1];
1.100 + q -= group->alpha[ECFP_NUMDOUBLES - 1];
1.101 + r[ECFP_NUMDOUBLES - 2] -= q;
1.102 + r[ECFP_NUMDOUBLES - 1] += q;
1.103 +
1.104 + /* Tidy up the excess bits on r[ECFP_NUMDOUBLES-1] using reduction */
1.105 + /* Use ecfp_beta so we get a positive res */
1.106 + q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224;
1.107 + q += group->bitSize_alpha;
1.108 + q -= group->bitSize_alpha;
1.109 +
1.110 + r[ECFP_NUMDOUBLES - 1] -= q;
1.111 + r[0] -= q * ecfp_twom224;
1.112 + r[4] += q * ecfp_twom128;
1.113 +
1.114 + ecfp_tidyShort(r, group);
1.115 +}
1.116 +
1.117 +/* Sets group to use optimized calculations in this file */
1.118 +mp_err
1.119 +ec_group_set_nistp224_fp(ECGroup *group)
1.120 +{
1.121 +
1.122 + EC_group_fp *fpg;
1.123 +
1.124 + /* Allocate memory for floating point group data */
1.125 + fpg = (EC_group_fp *) malloc(sizeof(EC_group_fp));
1.126 + if (fpg == NULL) {
1.127 + return MP_MEM;
1.128 + }
1.129 +
1.130 + fpg->numDoubles = ECFP_NUMDOUBLES;
1.131 + fpg->primeBitSize = ECFP_BSIZE;
1.132 + fpg->orderBitSize = 224;
1.133 + fpg->doubleBitSize = 24;
1.134 + fpg->numInts = (ECFP_BSIZE + ECL_BITS - 1) / ECL_BITS;
1.135 + fpg->aIsM3 = 1;
1.136 + fpg->ecfp_singleReduce = &ecfp224_singleReduce;
1.137 + fpg->ecfp_reduce = &ecfp224_reduce;
1.138 + fpg->ecfp_tidy = &ecfp_tidy;
1.139 +
1.140 + fpg->pt_add_jac_aff = &ecfp224_pt_add_jac_aff;
1.141 + fpg->pt_add_jac = &ecfp224_pt_add_jac;
1.142 + fpg->pt_add_jm_chud = &ecfp224_pt_add_jm_chud;
1.143 + fpg->pt_add_chud = &ecfp224_pt_add_chud;
1.144 + fpg->pt_dbl_jac = &ecfp224_pt_dbl_jac;
1.145 + fpg->pt_dbl_jm = &ecfp224_pt_dbl_jm;
1.146 + fpg->pt_dbl_aff2chud = &ecfp224_pt_dbl_aff2chud;
1.147 + fpg->precompute_chud = &ecfp224_precompute_chud;
1.148 + fpg->precompute_jac = &ecfp224_precompute_jac;
1.149 +
1.150 + group->point_mul = &ec_GFp_point_mul_wNAF_fp;
1.151 + group->points_mul = &ec_pts_mul_basic;
1.152 + group->extra1 = fpg;
1.153 + group->extra_free = &ec_GFp_extra_free_fp;
1.154 +
1.155 + ec_set_fp_precision(fpg);
1.156 + fpg->bitSize_alpha = ECFP_TWO224 * fpg->alpha[0];
1.157 +
1.158 + return MP_OKAY;
1.159 +}
