The Tor Browser: security/nss/lib/freebl/ecl/ecp

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

     1 /* This Source Code Form is subject to the terms of the Mozilla Public

     2  * License, v. 2.0. If a copy of the MPL was not distributed with this

     3  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

     5 #include "ecp_fp.h"

     6 #include <stdlib.h>

     8 #define ECFP_BSIZE 224

     9 #define ECFP_NUMDOUBLES 10

    11 #include "ecp_fpinc.c"

    13 /* Performs a single step of reduction, just on the uppermost float

    14  * (assumes already tidied), and then retidies. Note, this does not

    15  * guarantee that the result will be less than p. */

    16 void

    17 ecfp224_singleReduce(double *r, const EC_group_fp * group)

    18 {

    19 	double q;

    21 	ECFP_ASSERT(group->doubleBitSize == 24);

    22 	ECFP_ASSERT(group->primeBitSize == 224);

    23 	ECFP_ASSERT(group->numDoubles == 10);

    25 	q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224;

    26 	q += group->bitSize_alpha;

    27 	q -= group->bitSize_alpha;

    29 	r[ECFP_NUMDOUBLES - 1] -= q;

    30 	r[0] -= q * ecfp_twom224;

    31 	r[4] += q * ecfp_twom128;

    33 	ecfp_positiveTidy(r, group);

    34 }

    36 /*

    37  * Performs imperfect reduction.  This might leave some negative terms,

    38  * and one more reduction might be required for the result to be between 0

    39  * and p-1. x should be be an array of at least 20, and r at least 10 x

    40  * and r can be the same, but then the upper parts of r are not zeroed */

    41 void

    42 ecfp224_reduce(double *r, double *x, const EC_group_fp * group)

    43 {

    45 	double x10, x11, x12, x13, x14, q;

    47 	ECFP_ASSERT(group->doubleBitSize == 24);

    48 	ECFP_ASSERT(group->primeBitSize == 224);

    49 	ECFP_ASSERT(group->numDoubles == 10);

    51 	/* Tidy just the upper bits of x.  Don't need to tidy the lower ones

    52 	 * yet. */

    53 	ecfp_tidyUpper(x, group);

    55 	x10 = x[10] + x[16] * ecfp_twom128;

    56 	x11 = x[11] + x[17] * ecfp_twom128;

    57 	x12 = x[12] + x[18] * ecfp_twom128;

    58 	x13 = x[13] + x[19] * ecfp_twom128;

    60 	/* Tidy up, or we won't have enough bits later to add it in */

    61 	q = x10 + group->alpha[11];

    62 	q -= group->alpha[11];

    63 	x10 -= q;

    64 	x11 = x11 + q;

    66 	q = x11 + group->alpha[12];

    67 	q -= group->alpha[12];

    68 	x11 -= q;

    69 	x12 = x12 + q;

    71 	q = x12 + group->alpha[13];

    72 	q -= group->alpha[13];

    73 	x12 -= q;

    74 	x13 = x13 + q;

    76 	q = x13 + group->alpha[14];

    77 	q -= group->alpha[14];

    78 	x13 -= q;

    79 	x14 = x[14] + q;

    81 	r[9] = x[9] + x[15] * ecfp_twom128 - x[19] * ecfp_twom224;

    82 	r[8] = x[8] + x14 * ecfp_twom128 - x[18] * ecfp_twom224;

    83 	r[7] = x[7] + x13 * ecfp_twom128 - x[17] * ecfp_twom224;

    84 	r[6] = x[6] + x12 * ecfp_twom128 - x[16] * ecfp_twom224;

    85 	r[5] = x[5] + x11 * ecfp_twom128 - x[15] * ecfp_twom224;

    86 	r[4] = x[4] + x10 * ecfp_twom128 - x14 * ecfp_twom224;

    87 	r[3] = x[3] - x13 * ecfp_twom224;

    88 	r[2] = x[2] - x12 * ecfp_twom224;

    89 	r[1] = x[1] - x11 * ecfp_twom224;

    90 	r[0] = x[0] - x10 * ecfp_twom224;

    92 	/*

    93 	 * Tidy up just r[ECFP_NUMDOUBLES-2] so that the number of reductions

    94 	 * is accurate plus or minus one.  (Rather than tidy all to make it

    95 	 * totally accurate) */

    96 	q = r[ECFP_NUMDOUBLES - 2] + group->alpha[ECFP_NUMDOUBLES - 1];

    97 	q -= group->alpha[ECFP_NUMDOUBLES - 1];

    98 	r[ECFP_NUMDOUBLES - 2] -= q;

    99 	r[ECFP_NUMDOUBLES - 1] += q;

   101 	/* Tidy up the excess bits on r[ECFP_NUMDOUBLES-1] using reduction */

   102 	/* Use ecfp_beta so we get a positive res */

   103 	q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_224;

   104 	q += group->bitSize_alpha;

   105 	q -= group->bitSize_alpha;

   107 	r[ECFP_NUMDOUBLES - 1] -= q;

   108 	r[0] -= q * ecfp_twom224;

   109 	r[4] += q * ecfp_twom128;

   111 	ecfp_tidyShort(r, group);

   112 }

   114 /* Sets group to use optimized calculations in this file */

   115 mp_err

   116 ec_group_set_nistp224_fp(ECGroup *group)

   117 {

   119 	EC_group_fp *fpg;

   121 	/* Allocate memory for floating point group data */

   122 	fpg = (EC_group_fp *) malloc(sizeof(EC_group_fp));

   123 	if (fpg == NULL) {

   124 		return MP_MEM;

   125 	}

   127 	fpg->numDoubles = ECFP_NUMDOUBLES;

   128 	fpg->primeBitSize = ECFP_BSIZE;

   129 	fpg->orderBitSize = 224;

   130 	fpg->doubleBitSize = 24;

   131 	fpg->numInts = (ECFP_BSIZE + ECL_BITS - 1) / ECL_BITS;

   132 	fpg->aIsM3 = 1;

   133 	fpg->ecfp_singleReduce = &ecfp224_singleReduce;

   134 	fpg->ecfp_reduce = &ecfp224_reduce;

   135 	fpg->ecfp_tidy = &ecfp_tidy;

   137 	fpg->pt_add_jac_aff = &ecfp224_pt_add_jac_aff;

   138 	fpg->pt_add_jac = &ecfp224_pt_add_jac;

   139 	fpg->pt_add_jm_chud = &ecfp224_pt_add_jm_chud;

   140 	fpg->pt_add_chud = &ecfp224_pt_add_chud;

   141 	fpg->pt_dbl_jac = &ecfp224_pt_dbl_jac;

   142 	fpg->pt_dbl_jm = &ecfp224_pt_dbl_jm;

   143 	fpg->pt_dbl_aff2chud = &ecfp224_pt_dbl_aff2chud;

   144 	fpg->precompute_chud = &ecfp224_precompute_chud;

   145 	fpg->precompute_jac = &ecfp224_precompute_jac;

   147 	group->point_mul = &ec_GFp_point_mul_wNAF_fp;

   148 	group->points_mul = &ec_pts_mul_basic;

   149 	group->extra1 = fpg;

   150 	group->extra_free = &ec_GFp_extra_free_fp;

   152 	ec_set_fp_precision(fpg);

   153 	fpg->bitSize_alpha = ECFP_TWO224 * fpg->alpha[0];

   155 	return MP_OKAY;

   156 }

The Tor Browser / file revision