The Tor Browser: security/nss/lib/freebl/ecl/ecp

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

     1 /* This Source Code Form is subject to the terms of the Mozilla Public

     2  * License, v. 2.0. If a copy of the MPL was not distributed with this

     3  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

     5 #include "ecp_fp.h"

     6 #include <stdlib.h>

     8 #define ECFP_BSIZE 192

     9 #define ECFP_NUMDOUBLES 8

    11 #include "ecp_fpinc.c"

    13 /* Performs a single step of reduction, just on the uppermost float

    14  * (assumes already tidied), and then retidies. Note, this does not

    15  * guarantee that the result will be less than p. */

    16 void

    17 ecfp192_singleReduce(double *d, const EC_group_fp * group)

    18 {

    19 	double q;

    21 	ECFP_ASSERT(group->doubleBitSize == 24);

    22 	ECFP_ASSERT(group->primeBitSize == 192);

    23 	ECFP_ASSERT(group->numDoubles == 8);

    25 	q = d[ECFP_NUMDOUBLES - 1] - ecfp_beta_192;

    26 	q += group->bitSize_alpha;

    27 	q -= group->bitSize_alpha;

    29 	d[ECFP_NUMDOUBLES - 1] -= q;

    30 	d[0] += q * ecfp_twom192;

    31 	d[2] += q * ecfp_twom128;

    32 	ecfp_positiveTidy(d, group);

    33 }

    35 /*

    36  * Performs imperfect reduction.  This might leave some negative terms,

    37  * and one more reduction might be required for the result to be between 0

    38  * and p-1. x should be be an array of at least 16, and r at least 8 x and

    39  * r can be the same, but then the upper parts of r are not zeroed */

    40 void

    41 ecfp_reduce_192(double *r, double *x, const EC_group_fp * group)

    42 {

    43 	double x8, x9, x10, q;

    45 	ECFP_ASSERT(group->doubleBitSize == 24);

    46 	ECFP_ASSERT(group->primeBitSize == 192);

    47 	ECFP_ASSERT(group->numDoubles == 8);

    49 	/* Tidy just the upper portion, the lower part can wait */

    50 	ecfp_tidyUpper(x, group);

    52 	x8 = x[8] + x[14] * ecfp_twom128;	/* adds bits 16-40 */

    53 	x9 = x[9] + x[15] * ecfp_twom128;	/* adds bits 16-40 */

    55 	/* Tidy up, or we won't have enough bits later to add it in */

    57 	q = x8 + group->alpha[9];

    58 	q -= group->alpha[9];

    59 	x8 -= q;

    60 	x9 += q;

    62 	q = x9 + group->alpha[10];

    63 	q -= group->alpha[10];

    64 	x9 -= q;

    65 	x10 = x[10] + q;

    67 	r[7] = x[7] + x[15] * ecfp_twom192 + x[13] * ecfp_twom128;	/* adds

    68 																 * bits

    69 																 * 0-40 */

    70 	r[6] = x[6] + x[14] * ecfp_twom192 + x[12] * ecfp_twom128;

    71 	r[5] = x[5] + x[13] * ecfp_twom192 + x[11] * ecfp_twom128;

    72 	r[4] = x[4] + x[12] * ecfp_twom192 + x10 * ecfp_twom128;

    73 	r[3] = x[3] + x[11] * ecfp_twom192 + x9 * ecfp_twom128;	/* adds bits

    74 															 * 0-40 */

    75 	r[2] = x[2] + x10 * ecfp_twom192 + x8 * ecfp_twom128;

    76 	r[1] = x[1] + x9 * ecfp_twom192;	/* adds bits 16-40 */

    77 	r[0] = x[0] + x8 * ecfp_twom192;

    79 	/*

    80 	 * Tidy up just r[group->numDoubles-2] so that the number of

    81 	 * reductions is accurate plus or minus one.  (Rather than tidy all to

    82 	 * make it totally accurate) */

    83 	q = r[ECFP_NUMDOUBLES - 2] + group->alpha[ECFP_NUMDOUBLES - 1];

    84 	q -= group->alpha[ECFP_NUMDOUBLES - 1];

    85 	r[ECFP_NUMDOUBLES - 2] -= q;

    86 	r[ECFP_NUMDOUBLES - 1] += q;

    88 	/* Tidy up the excess bits on r[group->numDoubles-1] using reduction */

    89 	/* Use ecfp_beta so we get a positive res */

    90 	q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_192;

    91 	q += group->bitSize_alpha;

    92 	q -= group->bitSize_alpha;

    94 	r[ECFP_NUMDOUBLES - 1] -= q;

    95 	r[0] += q * ecfp_twom192;

    96 	r[2] += q * ecfp_twom128;

    98 	/* Tidy the result */

    99 	ecfp_tidyShort(r, group);

   100 }

   102 /* Sets group to use optimized calculations in this file */

   103 mp_err

   104 ec_group_set_nistp192_fp(ECGroup *group)

   105 {

   106 	EC_group_fp *fpg;

   108 	/* Allocate memory for floating point group data */

   109 	fpg = (EC_group_fp *) malloc(sizeof(EC_group_fp));

   110 	if (fpg == NULL) {

   111 		return MP_MEM;

   112 	}

   114 	fpg->numDoubles = ECFP_NUMDOUBLES;

   115 	fpg->primeBitSize = ECFP_BSIZE;

   116 	fpg->orderBitSize = 192;

   117 	fpg->doubleBitSize = 24;

   118 	fpg->numInts = (ECFP_BSIZE + ECL_BITS - 1) / ECL_BITS;

   119 	fpg->aIsM3 = 1;

   120 	fpg->ecfp_singleReduce = &ecfp192_singleReduce;

   121 	fpg->ecfp_reduce = &ecfp_reduce_192;

   122 	fpg->ecfp_tidy = &ecfp_tidy;

   124 	fpg->pt_add_jac_aff = &ecfp192_pt_add_jac_aff;

   125 	fpg->pt_add_jac = &ecfp192_pt_add_jac;

   126 	fpg->pt_add_jm_chud = &ecfp192_pt_add_jm_chud;

   127 	fpg->pt_add_chud = &ecfp192_pt_add_chud;

   128 	fpg->pt_dbl_jac = &ecfp192_pt_dbl_jac;

   129 	fpg->pt_dbl_jm = &ecfp192_pt_dbl_jm;

   130 	fpg->pt_dbl_aff2chud = &ecfp192_pt_dbl_aff2chud;

   131 	fpg->precompute_chud = &ecfp192_precompute_chud;

   132 	fpg->precompute_jac = &ecfp192_precompute_jac;

   134 	group->point_mul = &ec_GFp_point_mul_wNAF_fp;

   135 	group->points_mul = &ec_pts_mul_basic;

   136 	group->extra1 = fpg;

   137 	group->extra_free = &ec_GFp_extra_free_fp;

   139 	ec_set_fp_precision(fpg);

   140 	fpg->bitSize_alpha = ECFP_TWO192 * fpg->alpha[0];

   142 	return MP_OKAY;

   143 }

The Tor Browser / file revision