michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: #include "mpi.h"
michael@0: #include "mp_gf2m.h"
michael@0: #include "ecl-priv.h"
michael@0: #include "mpi-priv.h"
michael@0: #include <stdlib.h>
michael@0: 
michael@0: /* Allocate memory for a new GFMethod object. */
michael@0: GFMethod *
michael@0: GFMethod_new()
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	GFMethod *meth;
michael@0: 	meth = (GFMethod *) malloc(sizeof(GFMethod));
michael@0: 	if (meth == NULL)
michael@0: 		return NULL;
michael@0: 	meth->constructed = MP_YES;
michael@0: 	MP_DIGITS(&meth->irr) = 0;
michael@0: 	meth->extra_free = NULL;
michael@0: 	MP_CHECKOK(mp_init(&meth->irr));
michael@0: 
michael@0:   CLEANUP:
michael@0: 	if (res != MP_OKAY) {
michael@0: 		GFMethod_free(meth);
michael@0: 		return NULL;
michael@0: 	}
michael@0: 	return meth;
michael@0: }
michael@0: 
michael@0: /* Construct a generic GFMethod for arithmetic over prime fields with
michael@0:  * irreducible irr. */
michael@0: GFMethod *
michael@0: GFMethod_consGFp(const mp_int *irr)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	GFMethod *meth = NULL;
michael@0: 
michael@0: 	meth = GFMethod_new();
michael@0: 	if (meth == NULL)
michael@0: 		return NULL;
michael@0: 
michael@0: 	MP_CHECKOK(mp_copy(irr, &meth->irr));
michael@0: 	meth->irr_arr[0] = mpl_significant_bits(irr);
michael@0: 	meth->irr_arr[1] = meth->irr_arr[2] = meth->irr_arr[3] =
michael@0: 		meth->irr_arr[4] = 0;
michael@0: 	switch(MP_USED(&meth->irr)) {
michael@0: 	/* maybe we need 1 and 2 words here as well?*/
michael@0: 	case 3:
michael@0: 		meth->field_add = &ec_GFp_add_3;
michael@0: 		meth->field_sub = &ec_GFp_sub_3;
michael@0: 		break;
michael@0: 	case 4:
michael@0: 		meth->field_add = &ec_GFp_add_4;
michael@0: 		meth->field_sub = &ec_GFp_sub_4;
michael@0: 		break;
michael@0: 	case 5:
michael@0: 		meth->field_add = &ec_GFp_add_5;
michael@0: 		meth->field_sub = &ec_GFp_sub_5;
michael@0: 		break;
michael@0: 	case 6:
michael@0: 		meth->field_add = &ec_GFp_add_6;
michael@0: 		meth->field_sub = &ec_GFp_sub_6;
michael@0: 		break;
michael@0: 	default:
michael@0: 		meth->field_add = &ec_GFp_add;
michael@0: 		meth->field_sub = &ec_GFp_sub;
michael@0: 	}
michael@0: 	meth->field_neg = &ec_GFp_neg;
michael@0: 	meth->field_mod = &ec_GFp_mod;
michael@0: 	meth->field_mul = &ec_GFp_mul;
michael@0: 	meth->field_sqr = &ec_GFp_sqr;
michael@0: 	meth->field_div = &ec_GFp_div;
michael@0: 	meth->field_enc = NULL;
michael@0: 	meth->field_dec = NULL;
michael@0: 	meth->extra1 = NULL;
michael@0: 	meth->extra2 = NULL;
michael@0: 	meth->extra_free = NULL;
michael@0: 
michael@0:   CLEANUP:
michael@0: 	if (res != MP_OKAY) {
michael@0: 		GFMethod_free(meth);
michael@0: 		return NULL;
michael@0: 	}
michael@0: 	return meth;
michael@0: }
michael@0: 
michael@0: /* Construct a generic GFMethod for arithmetic over binary polynomial
michael@0:  * fields with irreducible irr that has array representation irr_arr (see
michael@0:  * ecl-priv.h for description of the representation).  If irr_arr is NULL, 
michael@0:  * then it is constructed from the bitstring representation. */
michael@0: GFMethod *
michael@0: GFMethod_consGF2m(const mp_int *irr, const unsigned int irr_arr[5])
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	int ret;
michael@0: 	GFMethod *meth = NULL;
michael@0: 
michael@0: 	meth = GFMethod_new();
michael@0: 	if (meth == NULL)
michael@0: 		return NULL;
michael@0: 
michael@0: 	MP_CHECKOK(mp_copy(irr, &meth->irr));
michael@0: 	if (irr_arr != NULL) {
michael@0: 		/* Irreducible polynomials are either trinomials or pentanomials. */
michael@0: 		meth->irr_arr[0] = irr_arr[0];
michael@0: 		meth->irr_arr[1] = irr_arr[1];
michael@0: 		meth->irr_arr[2] = irr_arr[2];
michael@0: 		if (irr_arr[2] > 0) {
michael@0: 			meth->irr_arr[3] = irr_arr[3];
michael@0: 			meth->irr_arr[4] = irr_arr[4];
michael@0: 		} else {
michael@0: 			meth->irr_arr[3] = meth->irr_arr[4] = 0;
michael@0: 		}
michael@0: 	} else {
michael@0: 		ret = mp_bpoly2arr(irr, meth->irr_arr, 5);
michael@0: 		/* Irreducible polynomials are either trinomials or pentanomials. */
michael@0: 		if ((ret != 5) && (ret != 3)) {
michael@0: 			res = MP_UNDEF;
michael@0: 			goto CLEANUP;
michael@0: 		}
michael@0: 	}
michael@0: 	meth->field_add = &ec_GF2m_add;
michael@0: 	meth->field_neg = &ec_GF2m_neg;
michael@0: 	meth->field_sub = &ec_GF2m_add;
michael@0: 	meth->field_mod = &ec_GF2m_mod;
michael@0: 	meth->field_mul = &ec_GF2m_mul;
michael@0: 	meth->field_sqr = &ec_GF2m_sqr;
michael@0: 	meth->field_div = &ec_GF2m_div;
michael@0: 	meth->field_enc = NULL;
michael@0: 	meth->field_dec = NULL;
michael@0: 	meth->extra1 = NULL;
michael@0: 	meth->extra2 = NULL;
michael@0: 	meth->extra_free = NULL;
michael@0: 
michael@0:   CLEANUP:
michael@0: 	if (res != MP_OKAY) {
michael@0: 		GFMethod_free(meth);
michael@0: 		return NULL;
michael@0: 	}
michael@0: 	return meth;
michael@0: }
michael@0: 
michael@0: /* Free the memory allocated (if any) to a GFMethod object. */
michael@0: void
michael@0: GFMethod_free(GFMethod *meth)
michael@0: {
michael@0: 	if (meth == NULL)
michael@0: 		return;
michael@0: 	if (meth->constructed == MP_NO)
michael@0: 		return;
michael@0: 	mp_clear(&meth->irr);
michael@0: 	if (meth->extra_free != NULL)
michael@0: 		meth->extra_free(meth);
michael@0: 	free(meth);
michael@0: }
michael@0: 
michael@0: /* Wrapper functions for generic prime field arithmetic. */
michael@0: 
michael@0: /* Add two field elements.  Assumes that 0 <= a, b < meth->irr */
michael@0: mp_err
michael@0: ec_GFp_add(const mp_int *a, const mp_int *b, mp_int *r,
michael@0: 		   const GFMethod *meth)
michael@0: {
michael@0: 	/* PRE: 0 <= a, b < p = meth->irr POST: 0 <= r < p, r = a + b (mod p) */
michael@0: 	mp_err res;
michael@0: 
michael@0: 	if ((res = mp_add(a, b, r)) != MP_OKAY) {
michael@0: 		return res;
michael@0: 	}
michael@0: 	if (mp_cmp(r, &meth->irr) >= 0) {
michael@0: 		return mp_sub(r, &meth->irr, r);
michael@0: 	}
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /* Negates a field element.  Assumes that 0 <= a < meth->irr */
michael@0: mp_err
michael@0: ec_GFp_neg(const mp_int *a, mp_int *r, const GFMethod *meth)
michael@0: {
michael@0: 	/* PRE: 0 <= a < p = meth->irr POST: 0 <= r < p, r = -a (mod p) */
michael@0: 
michael@0: 	if (mp_cmp_z(a) == 0) {
michael@0: 		mp_zero(r);
michael@0: 		return MP_OKAY;
michael@0: 	}
michael@0: 	return mp_sub(&meth->irr, a, r);
michael@0: }
michael@0: 
michael@0: /* Subtracts two field elements.  Assumes that 0 <= a, b < meth->irr */
michael@0: mp_err
michael@0: ec_GFp_sub(const mp_int *a, const mp_int *b, mp_int *r,
michael@0: 		   const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 
michael@0: 	/* PRE: 0 <= a, b < p = meth->irr POST: 0 <= r < p, r = a - b (mod p) */
michael@0: 	res = mp_sub(a, b, r);
michael@0: 	if (res == MP_RANGE) {
michael@0: 		MP_CHECKOK(mp_sub(b, a, r));
michael@0: 		if (mp_cmp_z(r) < 0) {
michael@0: 			MP_CHECKOK(mp_add(r, &meth->irr, r));
michael@0: 		}
michael@0: 		MP_CHECKOK(ec_GFp_neg(r, r, meth));
michael@0: 	}
michael@0: 	if (mp_cmp_z(r) < 0) {
michael@0: 		MP_CHECKOK(mp_add(r, &meth->irr, r));
michael@0: 	}
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: /* 
michael@0:  * Inline adds for small curve lengths.
michael@0:  */
michael@0: /* 3 words */
michael@0: mp_err
michael@0: ec_GFp_add_3(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit a0 = 0, a1 = 0, a2 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0;
michael@0: 	mp_digit carry;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 3:
michael@0: 		a2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		a1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		a0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 	MP_ADD_CARRY(a0, r0, r0, 0,     carry);
michael@0: 	MP_ADD_CARRY(a1, r1, r1, carry, carry);
michael@0: 	MP_ADD_CARRY(a2, r2, r2, carry, carry);
michael@0: #else
michael@0: 	__asm__ (
michael@0:                 "xorq   %3,%3           \n\t"
michael@0:                 "addq   %4,%0           \n\t"
michael@0:                 "adcq   %5,%1           \n\t"
michael@0:                 "adcq   %6,%2           \n\t"
michael@0:                 "adcq   $0,%3           \n\t"
michael@0:                 : "=r"(r0), "=r"(r1), "=r"(r2), "=r"(carry)
michael@0:                 : "r" (a0), "r" (a1), "r" (a2),
michael@0: 		  "0" (r0), "1" (r1), "2" (r2)
michael@0:                 : "%cc" );
michael@0: #endif
michael@0: 
michael@0: 	MP_CHECKOK(s_mp_pad(r, 3));
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 3;
michael@0: 
michael@0: 	/* Do quick 'subract' if we've gone over 
michael@0: 	 * (add the 2's complement of the curve field) */
michael@0: 	 a2 = MP_DIGIT(&meth->irr,2);
michael@0: 	if (carry ||  r2 >  a2 ||
michael@0: 		((r2 == a2) && mp_cmp(r,&meth->irr) != MP_LT)) {
michael@0: 		a1 = MP_DIGIT(&meth->irr,1);
michael@0: 		a0 = MP_DIGIT(&meth->irr,0);
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 		MP_SUB_BORROW(r0, a0, r0, 0,     carry);
michael@0: 		MP_SUB_BORROW(r1, a1, r1, carry, carry);
michael@0: 		MP_SUB_BORROW(r2, a2, r2, carry, carry);
michael@0: #else
michael@0: 		__asm__ (
michael@0: 			"subq   %3,%0           \n\t"
michael@0: 			"sbbq   %4,%1           \n\t"
michael@0: 			"sbbq   %5,%2           \n\t"
michael@0: 			: "=r"(r0), "=r"(r1), "=r"(r2)
michael@0: 			: "r" (a0), "r" (a1), "r" (a2),
michael@0: 			  "0" (r0), "1" (r1), "2" (r2)
michael@0: 			: "%cc" );
michael@0: #endif
michael@0: 		MP_DIGIT(r, 2) = r2;
michael@0: 		MP_DIGIT(r, 1) = r1;
michael@0: 		MP_DIGIT(r, 0) = r0;
michael@0: 	}
michael@0: 	
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /* 4 words */
michael@0: mp_err
michael@0: ec_GFp_add_4(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit a0 = 0, a1 = 0, a2 = 0, a3 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0, r3 = 0;
michael@0: 	mp_digit carry;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 4:
michael@0: 		a3 = MP_DIGIT(a,3);
michael@0: 	case 3:
michael@0: 		a2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		a1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		a0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 4:
michael@0: 		r3 = MP_DIGIT(b,3);
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 	MP_ADD_CARRY(a0, r0, r0, 0,     carry);
michael@0: 	MP_ADD_CARRY(a1, r1, r1, carry, carry);
michael@0: 	MP_ADD_CARRY(a2, r2, r2, carry, carry);
michael@0: 	MP_ADD_CARRY(a3, r3, r3, carry, carry);
michael@0: #else
michael@0: 	__asm__ (
michael@0:                 "xorq   %4,%4           \n\t"
michael@0:                 "addq   %5,%0           \n\t"
michael@0:                 "adcq   %6,%1           \n\t"
michael@0:                 "adcq   %7,%2           \n\t"
michael@0:                 "adcq   %8,%3           \n\t"
michael@0:                 "adcq   $0,%4           \n\t"
michael@0:                 : "=r"(r0), "=r"(r1), "=r"(r2), "=r"(r3), "=r"(carry)
michael@0:                 : "r" (a0), "r" (a1), "r" (a2), "r" (a3),
michael@0: 		  "0" (r0), "1" (r1), "2" (r2), "3" (r3)
michael@0:                 : "%cc" );
michael@0: #endif
michael@0: 
michael@0: 	MP_CHECKOK(s_mp_pad(r, 4));
michael@0: 	MP_DIGIT(r, 3) = r3;
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 4;
michael@0: 
michael@0: 	/* Do quick 'subract' if we've gone over 
michael@0: 	 * (add the 2's complement of the curve field) */
michael@0: 	 a3 = MP_DIGIT(&meth->irr,3);
michael@0: 	if (carry ||  r3 >  a3 ||
michael@0: 		((r3 == a3) && mp_cmp(r,&meth->irr) != MP_LT)) {
michael@0: 		a2 = MP_DIGIT(&meth->irr,2);
michael@0: 		a1 = MP_DIGIT(&meth->irr,1);
michael@0: 		a0 = MP_DIGIT(&meth->irr,0);
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 		MP_SUB_BORROW(r0, a0, r0, 0,     carry);
michael@0: 		MP_SUB_BORROW(r1, a1, r1, carry, carry);
michael@0: 		MP_SUB_BORROW(r2, a2, r2, carry, carry);
michael@0: 		MP_SUB_BORROW(r3, a3, r3, carry, carry);
michael@0: #else
michael@0: 		__asm__ (
michael@0: 			"subq   %4,%0           \n\t"
michael@0: 			"sbbq   %5,%1           \n\t"
michael@0: 			"sbbq   %6,%2           \n\t"
michael@0: 			"sbbq   %7,%3           \n\t"
michael@0: 			: "=r"(r0), "=r"(r1), "=r"(r2), "=r"(r3)
michael@0: 			: "r" (a0), "r" (a1), "r" (a2), "r" (a3),
michael@0: 			  "0" (r0), "1" (r1), "2" (r2), "3" (r3)
michael@0: 			: "%cc" );
michael@0: #endif
michael@0: 		MP_DIGIT(r, 3) = r3;
michael@0: 		MP_DIGIT(r, 2) = r2;
michael@0: 		MP_DIGIT(r, 1) = r1;
michael@0: 		MP_DIGIT(r, 0) = r0;
michael@0: 	}
michael@0: 	
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /* 5 words */
michael@0: mp_err
michael@0: ec_GFp_add_5(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit a0 = 0, a1 = 0, a2 = 0, a3 = 0, a4 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0, r3 = 0, r4 = 0;
michael@0: 	mp_digit carry;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 5:
michael@0: 		a4 = MP_DIGIT(a,4);
michael@0: 	case 4:
michael@0: 		a3 = MP_DIGIT(a,3);
michael@0: 	case 3:
michael@0: 		a2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		a1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		a0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 5:
michael@0: 		r4 = MP_DIGIT(b,4);
michael@0: 	case 4:
michael@0: 		r3 = MP_DIGIT(b,3);
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: 	MP_ADD_CARRY(a0, r0, r0, 0,     carry);
michael@0: 	MP_ADD_CARRY(a1, r1, r1, carry, carry);
michael@0: 	MP_ADD_CARRY(a2, r2, r2, carry, carry);
michael@0: 	MP_ADD_CARRY(a3, r3, r3, carry, carry);
michael@0: 	MP_ADD_CARRY(a4, r4, r4, carry, carry);
michael@0: 
michael@0: 	MP_CHECKOK(s_mp_pad(r, 5));
michael@0: 	MP_DIGIT(r, 4) = r4;
michael@0: 	MP_DIGIT(r, 3) = r3;
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 5;
michael@0: 
michael@0: 	/* Do quick 'subract' if we've gone over 
michael@0: 	 * (add the 2's complement of the curve field) */
michael@0: 	 a4 = MP_DIGIT(&meth->irr,4);
michael@0: 	if (carry ||  r4 >  a4 ||
michael@0: 		((r4 == a4) && mp_cmp(r,&meth->irr) != MP_LT)) {
michael@0: 		a3 = MP_DIGIT(&meth->irr,3);
michael@0: 		a2 = MP_DIGIT(&meth->irr,2);
michael@0: 		a1 = MP_DIGIT(&meth->irr,1);
michael@0: 		a0 = MP_DIGIT(&meth->irr,0);
michael@0: 		MP_SUB_BORROW(r0, a0, r0, 0,     carry);
michael@0: 		MP_SUB_BORROW(r1, a1, r1, carry, carry);
michael@0: 		MP_SUB_BORROW(r2, a2, r2, carry, carry);
michael@0: 		MP_SUB_BORROW(r3, a3, r3, carry, carry);
michael@0: 		MP_SUB_BORROW(r4, a4, r4, carry, carry);
michael@0: 		MP_DIGIT(r, 4) = r4;
michael@0: 		MP_DIGIT(r, 3) = r3;
michael@0: 		MP_DIGIT(r, 2) = r2;
michael@0: 		MP_DIGIT(r, 1) = r1;
michael@0: 		MP_DIGIT(r, 0) = r0;
michael@0: 	}
michael@0: 	
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /* 6 words */
michael@0: mp_err
michael@0: ec_GFp_add_6(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit a0 = 0, a1 = 0, a2 = 0, a3 = 0, a4 = 0, a5 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0, r3 = 0, r4 = 0, r5 = 0;
michael@0: 	mp_digit carry;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 6:
michael@0: 		a5 = MP_DIGIT(a,5);
michael@0: 	case 5:
michael@0: 		a4 = MP_DIGIT(a,4);
michael@0: 	case 4:
michael@0: 		a3 = MP_DIGIT(a,3);
michael@0: 	case 3:
michael@0: 		a2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		a1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		a0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 6:
michael@0: 		r5 = MP_DIGIT(b,5);
michael@0: 	case 5:
michael@0: 		r4 = MP_DIGIT(b,4);
michael@0: 	case 4:
michael@0: 		r3 = MP_DIGIT(b,3);
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: 	MP_ADD_CARRY(a0, r0, r0, 0,     carry);
michael@0: 	MP_ADD_CARRY(a1, r1, r1, carry, carry);
michael@0: 	MP_ADD_CARRY(a2, r2, r2, carry, carry);
michael@0: 	MP_ADD_CARRY(a3, r3, r3, carry, carry);
michael@0: 	MP_ADD_CARRY(a4, r4, r4, carry, carry);
michael@0: 	MP_ADD_CARRY(a5, r5, r5, carry, carry);
michael@0: 
michael@0: 	MP_CHECKOK(s_mp_pad(r, 6));
michael@0: 	MP_DIGIT(r, 5) = r5;
michael@0: 	MP_DIGIT(r, 4) = r4;
michael@0: 	MP_DIGIT(r, 3) = r3;
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 6;
michael@0: 
michael@0: 	/* Do quick 'subract' if we've gone over 
michael@0: 	 * (add the 2's complement of the curve field) */
michael@0: 	a5 = MP_DIGIT(&meth->irr,5);
michael@0: 	if (carry ||  r5 >  a5 ||
michael@0: 		((r5 == a5) && mp_cmp(r,&meth->irr) != MP_LT)) {
michael@0: 		a4 = MP_DIGIT(&meth->irr,4);
michael@0: 		a3 = MP_DIGIT(&meth->irr,3);
michael@0: 		a2 = MP_DIGIT(&meth->irr,2);
michael@0: 		a1 = MP_DIGIT(&meth->irr,1);
michael@0: 		a0 = MP_DIGIT(&meth->irr,0);
michael@0: 		MP_SUB_BORROW(r0, a0, r0, 0,     carry);
michael@0: 		MP_SUB_BORROW(r1, a1, r1, carry, carry);
michael@0: 		MP_SUB_BORROW(r2, a2, r2, carry, carry);
michael@0: 		MP_SUB_BORROW(r3, a3, r3, carry, carry);
michael@0: 		MP_SUB_BORROW(r4, a4, r4, carry, carry);
michael@0: 		MP_SUB_BORROW(r5, a5, r5, carry, carry);
michael@0: 		MP_DIGIT(r, 5) = r5;
michael@0: 		MP_DIGIT(r, 4) = r4;
michael@0: 		MP_DIGIT(r, 3) = r3;
michael@0: 		MP_DIGIT(r, 2) = r2;
michael@0: 		MP_DIGIT(r, 1) = r1;
michael@0: 		MP_DIGIT(r, 0) = r0;
michael@0: 	}
michael@0: 	
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * The following subraction functions do in-line subractions based
michael@0:  * on our curve size.
michael@0:  *
michael@0:  * ... 3 words
michael@0:  */
michael@0: mp_err
michael@0: ec_GFp_sub_3(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit b0 = 0, b1 = 0, b2 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0;
michael@0: 	mp_digit borrow;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 3:
michael@0: 		b2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		b1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		b0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 	MP_SUB_BORROW(r0, b0, r0, 0,     borrow);
michael@0: 	MP_SUB_BORROW(r1, b1, r1, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r2, b2, r2, borrow, borrow);
michael@0: #else
michael@0: 	__asm__ (
michael@0:                 "xorq   %3,%3           \n\t"
michael@0:                 "subq   %4,%0           \n\t"
michael@0:                 "sbbq   %5,%1           \n\t"
michael@0:                 "sbbq   %6,%2           \n\t"
michael@0:                 "adcq   $0,%3           \n\t"
michael@0:                 : "=r"(r0), "=r"(r1), "=r"(r2), "=r" (borrow)
michael@0:                 : "r" (b0), "r" (b1), "r" (b2), 
michael@0: 		  "0" (r0), "1" (r1), "2" (r2)
michael@0:                 : "%cc" );
michael@0: #endif
michael@0: 
michael@0: 	/* Do quick 'add' if we've gone under 0
michael@0: 	 * (subtract the 2's complement of the curve field) */
michael@0: 	if (borrow) {
michael@0: 	 	b2 = MP_DIGIT(&meth->irr,2);
michael@0: 		b1 = MP_DIGIT(&meth->irr,1);
michael@0: 		b0 = MP_DIGIT(&meth->irr,0);
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 		MP_ADD_CARRY(b0, r0, r0, 0,      borrow);
michael@0: 		MP_ADD_CARRY(b1, r1, r1, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b2, r2, r2, borrow, borrow);
michael@0: #else
michael@0: 		__asm__ (
michael@0: 			"addq   %3,%0           \n\t"
michael@0: 			"adcq   %4,%1           \n\t"
michael@0: 			"adcq   %5,%2           \n\t"
michael@0: 			: "=r"(r0), "=r"(r1), "=r"(r2)
michael@0: 			: "r" (b0), "r" (b1), "r" (b2),
michael@0:   			  "0" (r0), "1" (r1), "2" (r2)
michael@0: 			: "%cc" );
michael@0: #endif
michael@0: 	}
michael@0: 
michael@0: #ifdef MPI_AMD64_ADD
michael@0: 	/* compiler fakeout? */
michael@0: 	if ((r2 == b0) && (r1 == b0) && (r0 == b0)) { 
michael@0: 		MP_CHECKOK(s_mp_pad(r, 4));
michael@0: 	} 
michael@0: #endif
michael@0: 	MP_CHECKOK(s_mp_pad(r, 3));
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 3;
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /* 4 words */
michael@0: mp_err
michael@0: ec_GFp_sub_4(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit b0 = 0, b1 = 0, b2 = 0, b3 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0, r3 = 0;
michael@0: 	mp_digit borrow;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 4:
michael@0: 		r3 = MP_DIGIT(a,3);
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 4:
michael@0: 		b3 = MP_DIGIT(b,3);
michael@0: 	case 3:
michael@0: 		b2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		b1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		b0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 	MP_SUB_BORROW(r0, b0, r0, 0,     borrow);
michael@0: 	MP_SUB_BORROW(r1, b1, r1, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r2, b2, r2, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r3, b3, r3, borrow, borrow);
michael@0: #else
michael@0: 	__asm__ (
michael@0:                 "xorq   %4,%4           \n\t"
michael@0:                 "subq   %5,%0           \n\t"
michael@0:                 "sbbq   %6,%1           \n\t"
michael@0:                 "sbbq   %7,%2           \n\t"
michael@0:                 "sbbq   %8,%3           \n\t"
michael@0:                 "adcq   $0,%4           \n\t"
michael@0:                 : "=r"(r0), "=r"(r1), "=r"(r2), "=r"(r3), "=r" (borrow)
michael@0:                 : "r" (b0), "r" (b1), "r" (b2), "r" (b3),
michael@0: 		  "0" (r0), "1" (r1), "2" (r2), "3" (r3)
michael@0:                 : "%cc" );
michael@0: #endif
michael@0: 
michael@0: 	/* Do quick 'add' if we've gone under 0
michael@0: 	 * (subtract the 2's complement of the curve field) */
michael@0: 	if (borrow) {
michael@0: 	 	b3 = MP_DIGIT(&meth->irr,3);
michael@0: 	 	b2 = MP_DIGIT(&meth->irr,2);
michael@0: 		b1 = MP_DIGIT(&meth->irr,1);
michael@0: 		b0 = MP_DIGIT(&meth->irr,0);
michael@0: #ifndef MPI_AMD64_ADD
michael@0: 		MP_ADD_CARRY(b0, r0, r0, 0,      borrow);
michael@0: 		MP_ADD_CARRY(b1, r1, r1, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b2, r2, r2, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b3, r3, r3, borrow, borrow);
michael@0: #else
michael@0: 		__asm__ (
michael@0: 			"addq   %4,%0           \n\t"
michael@0: 			"adcq   %5,%1           \n\t"
michael@0: 			"adcq   %6,%2           \n\t"
michael@0: 			"adcq   %7,%3           \n\t"
michael@0: 			: "=r"(r0), "=r"(r1), "=r"(r2), "=r"(r3)
michael@0: 			: "r" (b0), "r" (b1), "r" (b2), "r" (b3),
michael@0:   			  "0" (r0), "1" (r1), "2" (r2), "3" (r3)
michael@0: 			: "%cc" );
michael@0: #endif
michael@0: 	}
michael@0: #ifdef MPI_AMD64_ADD
michael@0: 	/* compiler fakeout? */
michael@0: 	if ((r3 == b0) && (r1 == b0) && (r0 == b0)) { 
michael@0: 		MP_CHECKOK(s_mp_pad(r, 4));
michael@0: 	} 
michael@0: #endif
michael@0: 	MP_CHECKOK(s_mp_pad(r, 4));
michael@0: 	MP_DIGIT(r, 3) = r3;
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 4;
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /* 5 words */
michael@0: mp_err
michael@0: ec_GFp_sub_5(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit b0 = 0, b1 = 0, b2 = 0, b3 = 0, b4 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0, r3 = 0, r4 = 0;
michael@0: 	mp_digit borrow;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 5:
michael@0: 		r4 = MP_DIGIT(a,4);
michael@0: 	case 4:
michael@0: 		r3 = MP_DIGIT(a,3);
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 5:
michael@0: 		b4 = MP_DIGIT(b,4);
michael@0: 	case 4:
michael@0: 		b3 = MP_DIGIT(b,3);
michael@0: 	case 3:
michael@0: 		b2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		b1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		b0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: 	MP_SUB_BORROW(r0, b0, r0, 0,     borrow);
michael@0: 	MP_SUB_BORROW(r1, b1, r1, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r2, b2, r2, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r3, b3, r3, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r4, b4, r4, borrow, borrow);
michael@0: 
michael@0: 	/* Do quick 'add' if we've gone under 0
michael@0: 	 * (subtract the 2's complement of the curve field) */
michael@0: 	if (borrow) {
michael@0: 	 	b4 = MP_DIGIT(&meth->irr,4);
michael@0: 	 	b3 = MP_DIGIT(&meth->irr,3);
michael@0: 	 	b2 = MP_DIGIT(&meth->irr,2);
michael@0: 		b1 = MP_DIGIT(&meth->irr,1);
michael@0: 		b0 = MP_DIGIT(&meth->irr,0);
michael@0: 		MP_ADD_CARRY(b0, r0, r0, 0,      borrow);
michael@0: 		MP_ADD_CARRY(b1, r1, r1, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b2, r2, r2, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b3, r3, r3, borrow, borrow);
michael@0: 	}
michael@0: 	MP_CHECKOK(s_mp_pad(r, 5));
michael@0: 	MP_DIGIT(r, 4) = r4;
michael@0: 	MP_DIGIT(r, 3) = r3;
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 5;
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: /* 6 words */
michael@0: mp_err
michael@0: ec_GFp_sub_6(const mp_int *a, const mp_int *b, mp_int *r, 
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_digit b0 = 0, b1 = 0, b2 = 0, b3 = 0, b4 = 0, b5 = 0;
michael@0: 	mp_digit r0 = 0, r1 = 0, r2 = 0, r3 = 0, r4 = 0, r5 = 0;
michael@0: 	mp_digit borrow;
michael@0: 
michael@0: 	switch(MP_USED(a)) {
michael@0: 	case 6:
michael@0: 		r5 = MP_DIGIT(a,5);
michael@0: 	case 5:
michael@0: 		r4 = MP_DIGIT(a,4);
michael@0: 	case 4:
michael@0: 		r3 = MP_DIGIT(a,3);
michael@0: 	case 3:
michael@0: 		r2 = MP_DIGIT(a,2);
michael@0: 	case 2:
michael@0: 		r1 = MP_DIGIT(a,1);
michael@0: 	case 1:
michael@0: 		r0 = MP_DIGIT(a,0);
michael@0: 	}
michael@0: 	switch(MP_USED(b)) {
michael@0: 	case 6:
michael@0: 		b5 = MP_DIGIT(b,5);
michael@0: 	case 5:
michael@0: 		b4 = MP_DIGIT(b,4);
michael@0: 	case 4:
michael@0: 		b3 = MP_DIGIT(b,3);
michael@0: 	case 3:
michael@0: 		b2 = MP_DIGIT(b,2);
michael@0: 	case 2:
michael@0: 		b1 = MP_DIGIT(b,1);
michael@0: 	case 1:
michael@0: 		b0 = MP_DIGIT(b,0);
michael@0: 	}
michael@0: 
michael@0: 	MP_SUB_BORROW(r0, b0, r0, 0,     borrow);
michael@0: 	MP_SUB_BORROW(r1, b1, r1, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r2, b2, r2, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r3, b3, r3, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r4, b4, r4, borrow, borrow);
michael@0: 	MP_SUB_BORROW(r5, b5, r5, borrow, borrow);
michael@0: 
michael@0: 	/* Do quick 'add' if we've gone under 0
michael@0: 	 * (subtract the 2's complement of the curve field) */
michael@0: 	if (borrow) {
michael@0: 	 	b5 = MP_DIGIT(&meth->irr,5);
michael@0: 	 	b4 = MP_DIGIT(&meth->irr,4);
michael@0: 	 	b3 = MP_DIGIT(&meth->irr,3);
michael@0: 	 	b2 = MP_DIGIT(&meth->irr,2);
michael@0: 		b1 = MP_DIGIT(&meth->irr,1);
michael@0: 		b0 = MP_DIGIT(&meth->irr,0);
michael@0: 		MP_ADD_CARRY(b0, r0, r0, 0,      borrow);
michael@0: 		MP_ADD_CARRY(b1, r1, r1, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b2, r2, r2, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b3, r3, r3, borrow, borrow);
michael@0: 		MP_ADD_CARRY(b4, r4, r4, borrow, borrow);
michael@0: 	}
michael@0: 
michael@0: 	MP_CHECKOK(s_mp_pad(r, 6));
michael@0: 	MP_DIGIT(r, 5) = r5;
michael@0: 	MP_DIGIT(r, 4) = r4;
michael@0: 	MP_DIGIT(r, 3) = r3;
michael@0: 	MP_DIGIT(r, 2) = r2;
michael@0: 	MP_DIGIT(r, 1) = r1;
michael@0: 	MP_DIGIT(r, 0) = r0;
michael@0: 	MP_SIGN(r) = MP_ZPOS;
michael@0: 	MP_USED(r) = 6;
michael@0: 	s_mp_clamp(r);
michael@0: 
michael@0:   CLEANUP:
michael@0: 	return res;
michael@0: }
michael@0: 
michael@0: 
michael@0: /* Reduces an integer to a field element. */
michael@0: mp_err
michael@0: ec_GFp_mod(const mp_int *a, mp_int *r, const GFMethod *meth)
michael@0: {
michael@0: 	return mp_mod(a, &meth->irr, r);
michael@0: }
michael@0: 
michael@0: /* Multiplies two field elements. */
michael@0: mp_err
michael@0: ec_GFp_mul(const mp_int *a, const mp_int *b, mp_int *r,
michael@0: 		   const GFMethod *meth)
michael@0: {
michael@0: 	return mp_mulmod(a, b, &meth->irr, r);
michael@0: }
michael@0: 
michael@0: /* Squares a field element. */
michael@0: mp_err
michael@0: ec_GFp_sqr(const mp_int *a, mp_int *r, const GFMethod *meth)
michael@0: {
michael@0: 	return mp_sqrmod(a, &meth->irr, r);
michael@0: }
michael@0: 
michael@0: /* Divides two field elements. If a is NULL, then returns the inverse of
michael@0:  * b. */
michael@0: mp_err
michael@0: ec_GFp_div(const mp_int *a, const mp_int *b, mp_int *r,
michael@0: 		   const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_int t;
michael@0: 
michael@0: 	/* If a is NULL, then return the inverse of b, otherwise return a/b. */
michael@0: 	if (a == NULL) {
michael@0: 		return mp_invmod(b, &meth->irr, r);
michael@0: 	} else {
michael@0: 		/* MPI doesn't support divmod, so we implement it using invmod and 
michael@0: 		 * mulmod. */
michael@0: 		MP_CHECKOK(mp_init(&t));
michael@0: 		MP_CHECKOK(mp_invmod(b, &meth->irr, &t));
michael@0: 		MP_CHECKOK(mp_mulmod(a, &t, &meth->irr, r));
michael@0: 	  CLEANUP:
michael@0: 		mp_clear(&t);
michael@0: 		return res;
michael@0: 	}
michael@0: }
michael@0: 
michael@0: /* Wrapper functions for generic binary polynomial field arithmetic. */
michael@0: 
michael@0: /* Adds two field elements. */
michael@0: mp_err
michael@0: ec_GF2m_add(const mp_int *a, const mp_int *b, mp_int *r,
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	return mp_badd(a, b, r);
michael@0: }
michael@0: 
michael@0: /* Negates a field element. Note that for binary polynomial fields, the
michael@0:  * negation of a field element is the field element itself. */
michael@0: mp_err
michael@0: ec_GF2m_neg(const mp_int *a, mp_int *r, const GFMethod *meth)
michael@0: {
michael@0: 	if (a == r) {
michael@0: 		return MP_OKAY;
michael@0: 	} else {
michael@0: 		return mp_copy(a, r);
michael@0: 	}
michael@0: }
michael@0: 
michael@0: /* Reduces a binary polynomial to a field element. */
michael@0: mp_err
michael@0: ec_GF2m_mod(const mp_int *a, mp_int *r, const GFMethod *meth)
michael@0: {
michael@0: 	return mp_bmod(a, meth->irr_arr, r);
michael@0: }
michael@0: 
michael@0: /* Multiplies two field elements. */
michael@0: mp_err
michael@0: ec_GF2m_mul(const mp_int *a, const mp_int *b, mp_int *r,
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	return mp_bmulmod(a, b, meth->irr_arr, r);
michael@0: }
michael@0: 
michael@0: /* Squares a field element. */
michael@0: mp_err
michael@0: ec_GF2m_sqr(const mp_int *a, mp_int *r, const GFMethod *meth)
michael@0: {
michael@0: 	return mp_bsqrmod(a, meth->irr_arr, r);
michael@0: }
michael@0: 
michael@0: /* Divides two field elements. If a is NULL, then returns the inverse of
michael@0:  * b. */
michael@0: mp_err
michael@0: ec_GF2m_div(const mp_int *a, const mp_int *b, mp_int *r,
michael@0: 			const GFMethod *meth)
michael@0: {
michael@0: 	mp_err res = MP_OKAY;
michael@0: 	mp_int t;
michael@0: 
michael@0: 	/* If a is NULL, then return the inverse of b, otherwise return a/b. */
michael@0: 	if (a == NULL) {
michael@0: 		/* The GF(2^m) portion of MPI doesn't support invmod, so we
michael@0: 		 * compute 1/b. */
michael@0: 		MP_CHECKOK(mp_init(&t));
michael@0: 		MP_CHECKOK(mp_set_int(&t, 1));
michael@0: 		MP_CHECKOK(mp_bdivmod(&t, b, &meth->irr, meth->irr_arr, r));
michael@0: 	  CLEANUP:
michael@0: 		mp_clear(&t);
michael@0: 		return res;
michael@0: 	} else {
michael@0: 		return mp_bdivmod(a, b, &meth->irr, meth->irr_arr, r);
michael@0: 	}
michael@0: }