3 /*Arithmetic modulo the group order m = 2^252 + 27742317777372353535851937790883648493 = 7237005577332262213973186563042994240857116359379907606001950938285454250989 */
5 static const crypto_uint32 m
[32] = {0xED, 0xD3, 0xF5, 0x5C, 0x1A, 0x63, 0x12, 0x58, 0xD6, 0x9C, 0xF7, 0xA2, 0xDE, 0xF9, 0xDE, 0x14,
6 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10};
8 static const crypto_uint32 mu
[33] = {0x1B, 0x13, 0x2C, 0x0A, 0xA3, 0xE5, 0x9C, 0xED, 0xA7, 0x29, 0x63, 0x08, 0x5D, 0x21, 0x06, 0x21,
9 0xEB, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x0F};
11 static crypto_uint32
lt(crypto_uint32 a
,crypto_uint32 b
) /* 16-bit inputs */
14 x
-= (unsigned int) b
; /* 0..65535: no; 4294901761..4294967295: yes */
15 x
>>= 31; /* 0: no; 1: yes */
19 /* Reduce coefficients of r before calling reduce_add_sub */
20 static void reduce_add_sub(sc25519
*r
)
32 t
[i
] = r
->v
[i
]-pb
+(b
<<8);
37 r
->v
[i
] ^= mask
& (r
->v
[i
] ^ t
[i
]);
40 /* Reduce coefficients of x before calling barrett_reduce */
41 static void barrett_reduce(sc25519
*r
, const crypto_uint32 x
[64])
43 /* See HAC, Alg. 14.42 */
46 crypto_uint32
*q3
= q2
+ 33;
53 for (i
= 0;i
< 66;++i
) q2
[i
] = 0;
54 for (i
= 0;i
< 33;++i
) r2
[i
] = 0;
58 if(i
+j
>= 31) q2
[i
+j
] += mu
[i
]*x
[j
+31];
64 for(i
=0;i
<33;i
++)r1
[i
] = x
[i
];
67 if(i
+j
< 33) r2
[i
+j
] += m
[i
]*q3
[j
];
80 r
->v
[i
] = r1
[i
]-pb
+(b
<<8);
84 /* XXX: Can it really happen that r<0?, See HAC, Alg 14.42, Step 3
85 * If so: Handle it here!
92 void sc25519_from32bytes(sc25519
*r
, const unsigned char x
[32])
96 for(i
=0;i
<32;i
++) t
[i
] = x
[i
];
97 for(i
=32;i
<64;++i
) t
[i
] = 0;
101 void shortsc25519_from16bytes(shortsc25519
*r
, const unsigned char x
[16])
104 for(i
=0;i
<16;i
++) r
->v
[i
] = x
[i
];
107 void sc25519_from64bytes(sc25519
*r
, const unsigned char x
[64])
111 for(i
=0;i
<64;i
++) t
[i
] = x
[i
];
112 barrett_reduce(r
, t
);
115 void sc25519_from_shortsc(sc25519
*r
, const shortsc25519
*x
)
124 void sc25519_to32bytes(unsigned char r
[32], const sc25519
*x
)
127 for(i
=0;i
<32;i
++) r
[i
] = x
->v
[i
];
130 int sc25519_iszero_vartime(const sc25519
*x
)
134 if(x
->v
[i
] != 0) return 0;
138 int sc25519_isshort_vartime(const sc25519
*x
)
142 if(x
->v
[i
] != 0) return 0;
146 int sc25519_lt_vartime(const sc25519
*x
, const sc25519
*y
)
151 if(x
->v
[i
] < y
->v
[i
]) return 1;
152 if(x
->v
[i
] > y
->v
[i
]) return 0;
157 void sc25519_add(sc25519
*r
, const sc25519
*x
, const sc25519
*y
)
160 for(i
=0;i
<32;i
++) r
->v
[i
] = x
->v
[i
] + y
->v
[i
];
163 carry
= r
->v
[i
] >> 8;
170 void sc25519_sub_nored(sc25519
*r
, const sc25519
*x
, const sc25519
*y
)
177 t
= x
->v
[i
] - y
->v
[i
] - b
;
183 void sc25519_mul(sc25519
*r
, const sc25519
*x
, const sc25519
*y
)
187 for(i
=0;i
<64;i
++)t
[i
] = 0;
191 t
[i
+j
] += x
->v
[i
] * y
->v
[j
];
193 /* Reduce coefficients */
201 barrett_reduce(r
, t
);
204 void sc25519_mul_shortsc(sc25519
*r
, const sc25519
*x
, const shortsc25519
*y
)
207 sc25519_from_shortsc(&t
, y
);
208 sc25519_mul(r
, x
, &t
);
211 void sc25519_window3(signed char r
[85], const sc25519
*s
)
217 r
[8*i
+0] = s
->v
[3*i
+0] & 7;
218 r
[8*i
+1] = (s
->v
[3*i
+0] >> 3) & 7;
219 r
[8*i
+2] = (s
->v
[3*i
+0] >> 6) & 7;
220 r
[8*i
+2] ^= (s
->v
[3*i
+1] << 2) & 7;
221 r
[8*i
+3] = (s
->v
[3*i
+1] >> 1) & 7;
222 r
[8*i
+4] = (s
->v
[3*i
+1] >> 4) & 7;
223 r
[8*i
+5] = (s
->v
[3*i
+1] >> 7) & 7;
224 r
[8*i
+5] ^= (s
->v
[3*i
+2] << 1) & 7;
225 r
[8*i
+6] = (s
->v
[3*i
+2] >> 2) & 7;
226 r
[8*i
+7] = (s
->v
[3*i
+2] >> 5) & 7;
228 r
[8*i
+0] = s
->v
[3*i
+0] & 7;
229 r
[8*i
+1] = (s
->v
[3*i
+0] >> 3) & 7;
230 r
[8*i
+2] = (s
->v
[3*i
+0] >> 6) & 7;
231 r
[8*i
+2] ^= (s
->v
[3*i
+1] << 2) & 7;
232 r
[8*i
+3] = (s
->v
[3*i
+1] >> 1) & 7;
233 r
[8*i
+4] = (s
->v
[3*i
+1] >> 4) & 7;
235 /* Making it signed */
248 void sc25519_window5(signed char r
[51], const sc25519
*s
)
254 r
[8*i
+0] = s
->v
[5*i
+0] & 31;
255 r
[8*i
+1] = (s
->v
[5*i
+0] >> 5) & 31;
256 r
[8*i
+1] ^= (s
->v
[5*i
+1] << 3) & 31;
257 r
[8*i
+2] = (s
->v
[5*i
+1] >> 2) & 31;
258 r
[8*i
+3] = (s
->v
[5*i
+1] >> 7) & 31;
259 r
[8*i
+3] ^= (s
->v
[5*i
+2] << 1) & 31;
260 r
[8*i
+4] = (s
->v
[5*i
+2] >> 4) & 31;
261 r
[8*i
+4] ^= (s
->v
[5*i
+3] << 4) & 31;
262 r
[8*i
+5] = (s
->v
[5*i
+3] >> 1) & 31;
263 r
[8*i
+6] = (s
->v
[5*i
+3] >> 6) & 31;
264 r
[8*i
+6] ^= (s
->v
[5*i
+4] << 2) & 31;
265 r
[8*i
+7] = (s
->v
[5*i
+4] >> 3) & 31;
267 r
[8*i
+0] = s
->v
[5*i
+0] & 31;
268 r
[8*i
+1] = (s
->v
[5*i
+0] >> 5) & 31;
269 r
[8*i
+1] ^= (s
->v
[5*i
+1] << 3) & 31;
270 r
[8*i
+2] = (s
->v
[5*i
+1] >> 2) & 31;
272 /* Making it signed */
285 void sc25519_2interleave2(unsigned char r
[127], const sc25519
*s1
, const sc25519
*s2
)
290 r
[4*i
] = ( s1
->v
[i
] & 3) ^ (( s2
->v
[i
] & 3) << 2);
291 r
[4*i
+1] = ((s1
->v
[i
] >> 2) & 3) ^ (((s2
->v
[i
] >> 2) & 3) << 2);
292 r
[4*i
+2] = ((s1
->v
[i
] >> 4) & 3) ^ (((s2
->v
[i
] >> 4) & 3) << 2);
293 r
[4*i
+3] = ((s1
->v
[i
] >> 6) & 3) ^ (((s2
->v
[i
] >> 6) & 3) << 2);
295 r
[124] = ( s1
->v
[31] & 3) ^ (( s2
->v
[31] & 3) << 2);
296 r
[125] = ((s1
->v
[31] >> 2) & 3) ^ (((s2
->v
[31] >> 2) & 3) << 2);
297 r
[126] = ((s1
->v
[31] >> 4) & 3) ^ (((s2
->v
[31] >> 4) & 3) << 2);