2 #include "crypto_int64.h"
3 #include "crypto_uint32.h"
4 #include "crypto_uint64.h"
6 static crypto_uint64
load_3(const unsigned char *in
)
9 result
= (crypto_uint64
) in
[0];
10 result
|= ((crypto_uint64
) in
[1]) << 8;
11 result
|= ((crypto_uint64
) in
[2]) << 16;
15 static crypto_uint64
load_4(const unsigned char *in
)
18 result
= (crypto_uint64
) in
[0];
19 result
|= ((crypto_uint64
) in
[1]) << 8;
20 result
|= ((crypto_uint64
) in
[2]) << 16;
21 result
|= ((crypto_uint64
) in
[3]) << 24;
27 s[0]+256*s[1]+...+256^63*s[63] = s
30 s[0]+256*s[1]+...+256^31*s[31] = s mod l
31 where l = 2^252 + 27742317777372353535851937790883648493.
32 Overwrites s in place.
35 void sc_reduce(unsigned char *s
)
37 crypto_int64 s0
= 2097151 & load_3(s
);
38 crypto_int64 s1
= 2097151 & (load_4(s
+ 2) >> 5);
39 crypto_int64 s2
= 2097151 & (load_3(s
+ 5) >> 2);
40 crypto_int64 s3
= 2097151 & (load_4(s
+ 7) >> 7);
41 crypto_int64 s4
= 2097151 & (load_4(s
+ 10) >> 4);
42 crypto_int64 s5
= 2097151 & (load_3(s
+ 13) >> 1);
43 crypto_int64 s6
= 2097151 & (load_4(s
+ 15) >> 6);
44 crypto_int64 s7
= 2097151 & (load_3(s
+ 18) >> 3);
45 crypto_int64 s8
= 2097151 & load_3(s
+ 21);
46 crypto_int64 s9
= 2097151 & (load_4(s
+ 23) >> 5);
47 crypto_int64 s10
= 2097151 & (load_3(s
+ 26) >> 2);
48 crypto_int64 s11
= 2097151 & (load_4(s
+ 28) >> 7);
49 crypto_int64 s12
= 2097151 & (load_4(s
+ 31) >> 4);
50 crypto_int64 s13
= 2097151 & (load_3(s
+ 34) >> 1);
51 crypto_int64 s14
= 2097151 & (load_4(s
+ 36) >> 6);
52 crypto_int64 s15
= 2097151 & (load_3(s
+ 39) >> 3);
53 crypto_int64 s16
= 2097151 & load_3(s
+ 42);
54 crypto_int64 s17
= 2097151 & (load_4(s
+ 44) >> 5);
55 crypto_int64 s18
= 2097151 & (load_3(s
+ 47) >> 2);
56 crypto_int64 s19
= 2097151 & (load_4(s
+ 49) >> 7);
57 crypto_int64 s20
= 2097151 & (load_4(s
+ 52) >> 4);
58 crypto_int64 s21
= 2097151 & (load_3(s
+ 55) >> 1);
59 crypto_int64 s22
= 2097151 & (load_4(s
+ 57) >> 6);
60 crypto_int64 s23
= (load_4(s
+ 60) >> 3);
127 carry6
= (s6
+ (1<<20)) >> 21; s7
+= carry6
; s6
-= carry6
<< 21;
128 carry8
= (s8
+ (1<<20)) >> 21; s9
+= carry8
; s8
-= carry8
<< 21;
129 carry10
= (s10
+ (1<<20)) >> 21; s11
+= carry10
; s10
-= carry10
<< 21;
130 carry12
= (s12
+ (1<<20)) >> 21; s13
+= carry12
; s12
-= carry12
<< 21;
131 carry14
= (s14
+ (1<<20)) >> 21; s15
+= carry14
; s14
-= carry14
<< 21;
132 carry16
= (s16
+ (1<<20)) >> 21; s17
+= carry16
; s16
-= carry16
<< 21;
134 carry7
= (s7
+ (1<<20)) >> 21; s8
+= carry7
; s7
-= carry7
<< 21;
135 carry9
= (s9
+ (1<<20)) >> 21; s10
+= carry9
; s9
-= carry9
<< 21;
136 carry11
= (s11
+ (1<<20)) >> 21; s12
+= carry11
; s11
-= carry11
<< 21;
137 carry13
= (s13
+ (1<<20)) >> 21; s14
+= carry13
; s13
-= carry13
<< 21;
138 carry15
= (s15
+ (1<<20)) >> 21; s16
+= carry15
; s15
-= carry15
<< 21;
188 carry0
= (s0
+ (1<<20)) >> 21; s1
+= carry0
; s0
-= carry0
<< 21;
189 carry2
= (s2
+ (1<<20)) >> 21; s3
+= carry2
; s2
-= carry2
<< 21;
190 carry4
= (s4
+ (1<<20)) >> 21; s5
+= carry4
; s4
-= carry4
<< 21;
191 carry6
= (s6
+ (1<<20)) >> 21; s7
+= carry6
; s6
-= carry6
<< 21;
192 carry8
= (s8
+ (1<<20)) >> 21; s9
+= carry8
; s8
-= carry8
<< 21;
193 carry10
= (s10
+ (1<<20)) >> 21; s11
+= carry10
; s10
-= carry10
<< 21;
195 carry1
= (s1
+ (1<<20)) >> 21; s2
+= carry1
; s1
-= carry1
<< 21;
196 carry3
= (s3
+ (1<<20)) >> 21; s4
+= carry3
; s3
-= carry3
<< 21;
197 carry5
= (s5
+ (1<<20)) >> 21; s6
+= carry5
; s5
-= carry5
<< 21;
198 carry7
= (s7
+ (1<<20)) >> 21; s8
+= carry7
; s7
-= carry7
<< 21;
199 carry9
= (s9
+ (1<<20)) >> 21; s10
+= carry9
; s9
-= carry9
<< 21;
200 carry11
= (s11
+ (1<<20)) >> 21; s12
+= carry11
; s11
-= carry11
<< 21;
210 carry0
= s0
>> 21; s1
+= carry0
; s0
-= carry0
<< 21;
211 carry1
= s1
>> 21; s2
+= carry1
; s1
-= carry1
<< 21;
212 carry2
= s2
>> 21; s3
+= carry2
; s2
-= carry2
<< 21;
213 carry3
= s3
>> 21; s4
+= carry3
; s3
-= carry3
<< 21;
214 carry4
= s4
>> 21; s5
+= carry4
; s4
-= carry4
<< 21;
215 carry5
= s5
>> 21; s6
+= carry5
; s5
-= carry5
<< 21;
216 carry6
= s6
>> 21; s7
+= carry6
; s6
-= carry6
<< 21;
217 carry7
= s7
>> 21; s8
+= carry7
; s7
-= carry7
<< 21;
218 carry8
= s8
>> 21; s9
+= carry8
; s8
-= carry8
<< 21;
219 carry9
= s9
>> 21; s10
+= carry9
; s9
-= carry9
<< 21;
220 carry10
= s10
>> 21; s11
+= carry10
; s10
-= carry10
<< 21;
221 carry11
= s11
>> 21; s12
+= carry11
; s11
-= carry11
<< 21;
231 carry0
= s0
>> 21; s1
+= carry0
; s0
-= carry0
<< 21;
232 carry1
= s1
>> 21; s2
+= carry1
; s1
-= carry1
<< 21;
233 carry2
= s2
>> 21; s3
+= carry2
; s2
-= carry2
<< 21;
234 carry3
= s3
>> 21; s4
+= carry3
; s3
-= carry3
<< 21;
235 carry4
= s4
>> 21; s5
+= carry4
; s4
-= carry4
<< 21;
236 carry5
= s5
>> 21; s6
+= carry5
; s5
-= carry5
<< 21;
237 carry6
= s6
>> 21; s7
+= carry6
; s6
-= carry6
<< 21;
238 carry7
= s7
>> 21; s8
+= carry7
; s7
-= carry7
<< 21;
239 carry8
= s8
>> 21; s9
+= carry8
; s8
-= carry8
<< 21;
240 carry9
= s9
>> 21; s10
+= carry9
; s9
-= carry9
<< 21;
241 carry10
= s10
>> 21; s11
+= carry10
; s10
-= carry10
<< 21;
245 s
[2] = (s0
>> 16) | (s1
<< 5);
248 s
[5] = (s1
>> 19) | (s2
<< 2);
250 s
[7] = (s2
>> 14) | (s3
<< 7);
253 s
[10] = (s3
>> 17) | (s4
<< 4);
256 s
[13] = (s4
>> 20) | (s5
<< 1);
258 s
[15] = (s5
>> 15) | (s6
<< 6);
261 s
[18] = (s6
>> 18) | (s7
<< 3);
266 s
[23] = (s8
>> 16) | (s9
<< 5);
269 s
[26] = (s9
>> 19) | (s10
<< 2);
271 s
[28] = (s10
>> 14) | (s11
<< 7);