#![allow(unused_parens)]
#![allow(non_camel_case_types)]
use core::cmp::{Eq, PartialEq};
use core::ops::{Add, Mul, Sub};
use crate::error::*;
pub type fiat_25519_u1 = u8;
pub type fiat_25519_i1 = i8;
pub type fiat_25519_i2 = i8;
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_addcarryx_u51(
out1: &mut u64,
out2: &mut fiat_25519_u1,
arg1: fiat_25519_u1,
arg2: u64,
arg3: u64,
) {
let x1: u64 = (((arg1 as u64).wrapping_add(arg2)).wrapping_add(arg3));
let x2: u64 = (x1 & 0x7ffffffffffff);
let x3: fiat_25519_u1 = ((x1 >> 51) as fiat_25519_u1);
*out1 = x2;
*out2 = x3;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_subborrowx_u51(
out1: &mut u64,
out2: &mut fiat_25519_u1,
arg1: fiat_25519_u1,
arg2: u64,
arg3: u64,
) {
let x1: i64 = ((((((arg2 as i128).wrapping_sub((arg1 as i128))) as i64) as i128)
.wrapping_sub((arg3 as i128))) as i64);
let x2: fiat_25519_i1 = ((x1 >> 51) as fiat_25519_i1);
let x3: u64 = (((x1 as i128) & 0x7ffffffffffff_i128) as u64);
*out1 = x3;
*out2 = ((0x0_i8.wrapping_sub((x2 as fiat_25519_i2))) as fiat_25519_u1);
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_cmovznz_u64(out1: &mut u64, arg1: fiat_25519_u1, arg2: u64, arg3: u64) {
let x1: fiat_25519_u1 = (!(!arg1));
let x2: u64 = (((((0x0_i8.wrapping_sub((x1 as fiat_25519_i2))) as fiat_25519_i1) as i128)
& 0xffffffffffffffff_i128) as u64);
let x3: u64 = ((x2 & arg3) | ((!x2) & arg2));
*out1 = x3;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_carry_mul(out1: &mut [u64; 5], arg1: &[u64; 5], arg2: &[u64; 5]) {
let x1: u128 = (((arg1[4]) as u128).wrapping_mul((((arg2[4]).wrapping_mul(0x13)) as u128)));
let x2: u128 = (((arg1[4]) as u128).wrapping_mul((((arg2[3]).wrapping_mul(0x13)) as u128)));
let x3: u128 = (((arg1[4]) as u128).wrapping_mul((((arg2[2]).wrapping_mul(0x13)) as u128)));
let x4: u128 = (((arg1[4]) as u128).wrapping_mul((((arg2[1]).wrapping_mul(0x13)) as u128)));
let x5: u128 = (((arg1[3]) as u128).wrapping_mul((((arg2[4]).wrapping_mul(0x13)) as u128)));
let x6: u128 = (((arg1[3]) as u128).wrapping_mul((((arg2[3]).wrapping_mul(0x13)) as u128)));
let x7: u128 = (((arg1[3]) as u128).wrapping_mul((((arg2[2]).wrapping_mul(0x13)) as u128)));
let x8: u128 = (((arg1[2]) as u128).wrapping_mul((((arg2[4]).wrapping_mul(0x13)) as u128)));
let x9: u128 = (((arg1[2]) as u128).wrapping_mul((((arg2[3]).wrapping_mul(0x13)) as u128)));
let x10: u128 = (((arg1[1]) as u128).wrapping_mul((((arg2[4]).wrapping_mul(0x13)) as u128)));
let x11: u128 = (((arg1[4]) as u128).wrapping_mul(((arg2[0]) as u128)));
let x12: u128 = (((arg1[3]) as u128).wrapping_mul(((arg2[1]) as u128)));
let x13: u128 = (((arg1[3]) as u128).wrapping_mul(((arg2[0]) as u128)));
let x14: u128 = (((arg1[2]) as u128).wrapping_mul(((arg2[2]) as u128)));
let x15: u128 = (((arg1[2]) as u128).wrapping_mul(((arg2[1]) as u128)));
let x16: u128 = (((arg1[2]) as u128).wrapping_mul(((arg2[0]) as u128)));
let x17: u128 = (((arg1[1]) as u128).wrapping_mul(((arg2[3]) as u128)));
let x18: u128 = (((arg1[1]) as u128).wrapping_mul(((arg2[2]) as u128)));
let x19: u128 = (((arg1[1]) as u128).wrapping_mul(((arg2[1]) as u128)));
let x20: u128 = (((arg1[1]) as u128).wrapping_mul(((arg2[0]) as u128)));
let x21: u128 = (((arg1[0]) as u128).wrapping_mul(((arg2[4]) as u128)));
let x22: u128 = (((arg1[0]) as u128).wrapping_mul(((arg2[3]) as u128)));
let x23: u128 = (((arg1[0]) as u128).wrapping_mul(((arg2[2]) as u128)));
let x24: u128 = (((arg1[0]) as u128).wrapping_mul(((arg2[1]) as u128)));
let x25: u128 = (((arg1[0]) as u128).wrapping_mul(((arg2[0]) as u128)));
let x26: u128 =
(x25.wrapping_add((x10.wrapping_add((x9.wrapping_add((x7.wrapping_add(x4))))))));
let x27: u64 = ((x26 >> 51) as u64);
let x28: u64 = ((x26 & 0x7ffffffffffff_u128) as u64);
let x29: u128 =
(x21.wrapping_add((x17.wrapping_add((x14.wrapping_add((x12.wrapping_add(x11))))))));
let x30: u128 =
(x22.wrapping_add((x18.wrapping_add((x15.wrapping_add((x13.wrapping_add(x1))))))));
let x31: u128 =
(x23.wrapping_add((x19.wrapping_add((x16.wrapping_add((x5.wrapping_add(x2))))))));
let x32: u128 =
(x24.wrapping_add((x20.wrapping_add((x8.wrapping_add((x6.wrapping_add(x3))))))));
let x33: u128 = ((x27 as u128).wrapping_add(x32));
let x34: u64 = ((x33 >> 51) as u64);
let x35: u64 = ((x33 & 0x7ffffffffffff_u128) as u64);
let x36: u128 = ((x34 as u128).wrapping_add(x31));
let x37: u64 = ((x36 >> 51) as u64);
let x38: u64 = ((x36 & 0x7ffffffffffff_u128) as u64);
let x39: u128 = ((x37 as u128).wrapping_add(x30));
let x40: u64 = ((x39 >> 51) as u64);
let x41: u64 = ((x39 & 0x7ffffffffffff_u128) as u64);
let x42: u128 = ((x40 as u128).wrapping_add(x29));
let x43: u64 = ((x42 >> 51) as u64);
let x44: u64 = ((x42 & 0x7ffffffffffff_u128) as u64);
let x45: u64 = (x43.wrapping_mul(0x13));
let x46: u64 = (x28.wrapping_add(x45));
let x47: u64 = (x46 >> 51);
let x48: u64 = (x46 & 0x7ffffffffffff);
let x49: u64 = (x47.wrapping_add(x35));
let x50: fiat_25519_u1 = ((x49 >> 51) as fiat_25519_u1);
let x51: u64 = (x49 & 0x7ffffffffffff);
let x52: u64 = ((x50 as u64).wrapping_add(x38));
out1[0] = x48;
out1[1] = x51;
out1[2] = x52;
out1[3] = x41;
out1[4] = x44;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_carry_square(out1: &mut [u64; 5], arg1: &[u64; 5]) {
let x1: u64 = ((arg1[4]).wrapping_mul(0x13));
let x2: u64 = (x1.wrapping_mul(0x2));
let x3: u64 = ((arg1[4]).wrapping_mul(0x2));
let x4: u64 = ((arg1[3]).wrapping_mul(0x13));
let x5: u64 = (x4.wrapping_mul(0x2));
let x6: u64 = ((arg1[3]).wrapping_mul(0x2));
let x7: u64 = ((arg1[2]).wrapping_mul(0x2));
let x8: u64 = ((arg1[1]).wrapping_mul(0x2));
let x9: u128 = (((arg1[4]) as u128).wrapping_mul((x1 as u128)));
let x10: u128 = (((arg1[3]) as u128).wrapping_mul((x2 as u128)));
let x11: u128 = (((arg1[3]) as u128).wrapping_mul((x4 as u128)));
let x12: u128 = (((arg1[2]) as u128).wrapping_mul((x2 as u128)));
let x13: u128 = (((arg1[2]) as u128).wrapping_mul((x5 as u128)));
let x14: u128 = (((arg1[2]) as u128).wrapping_mul(((arg1[2]) as u128)));
let x15: u128 = (((arg1[1]) as u128).wrapping_mul((x2 as u128)));
let x16: u128 = (((arg1[1]) as u128).wrapping_mul((x6 as u128)));
let x17: u128 = (((arg1[1]) as u128).wrapping_mul((x7 as u128)));
let x18: u128 = (((arg1[1]) as u128).wrapping_mul(((arg1[1]) as u128)));
let x19: u128 = (((arg1[0]) as u128).wrapping_mul((x3 as u128)));
let x20: u128 = (((arg1[0]) as u128).wrapping_mul((x6 as u128)));
let x21: u128 = (((arg1[0]) as u128).wrapping_mul((x7 as u128)));
let x22: u128 = (((arg1[0]) as u128).wrapping_mul((x8 as u128)));
let x23: u128 = (((arg1[0]) as u128).wrapping_mul(((arg1[0]) as u128)));
let x24: u128 = (x23.wrapping_add((x15.wrapping_add(x13))));
let x25: u64 = ((x24 >> 51) as u64);
let x26: u64 = ((x24 & 0x7ffffffffffff_u128) as u64);
let x27: u128 = (x19.wrapping_add((x16.wrapping_add(x14))));
let x28: u128 = (x20.wrapping_add((x17.wrapping_add(x9))));
let x29: u128 = (x21.wrapping_add((x18.wrapping_add(x10))));
let x30: u128 = (x22.wrapping_add((x12.wrapping_add(x11))));
let x31: u128 = ((x25 as u128).wrapping_add(x30));
let x32: u64 = ((x31 >> 51) as u64);
let x33: u64 = ((x31 & 0x7ffffffffffff_u128) as u64);
let x34: u128 = ((x32 as u128).wrapping_add(x29));
let x35: u64 = ((x34 >> 51) as u64);
let x36: u64 = ((x34 & 0x7ffffffffffff_u128) as u64);
let x37: u128 = ((x35 as u128).wrapping_add(x28));
let x38: u64 = ((x37 >> 51) as u64);
let x39: u64 = ((x37 & 0x7ffffffffffff_u128) as u64);
let x40: u128 = ((x38 as u128).wrapping_add(x27));
let x41: u64 = ((x40 >> 51) as u64);
let x42: u64 = ((x40 & 0x7ffffffffffff_u128) as u64);
let x43: u64 = (x41.wrapping_mul(0x13));
let x44: u64 = (x26.wrapping_add(x43));
let x45: u64 = (x44 >> 51);
let x46: u64 = (x44 & 0x7ffffffffffff);
let x47: u64 = (x45.wrapping_add(x33));
let x48: fiat_25519_u1 = ((x47 >> 51) as fiat_25519_u1);
let x49: u64 = (x47 & 0x7ffffffffffff);
let x50: u64 = ((x48 as u64).wrapping_add(x36));
out1[0] = x46;
out1[1] = x49;
out1[2] = x50;
out1[3] = x39;
out1[4] = x42;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_carry(out1: &mut [u64; 5], arg1: &[u64; 5]) {
let x1: u64 = (arg1[0]);
let x2: u64 = ((x1 >> 51).wrapping_add((arg1[1])));
let x3: u64 = ((x2 >> 51).wrapping_add((arg1[2])));
let x4: u64 = ((x3 >> 51).wrapping_add((arg1[3])));
let x5: u64 = ((x4 >> 51).wrapping_add((arg1[4])));
let x6: u64 = ((x1 & 0x7ffffffffffff).wrapping_add(((x5 >> 51).wrapping_mul(0x13))));
let x7: u64 = ((((x6 >> 51) as fiat_25519_u1) as u64).wrapping_add((x2 & 0x7ffffffffffff)));
let x8: u64 = (x6 & 0x7ffffffffffff);
let x9: u64 = (x7 & 0x7ffffffffffff);
let x10: u64 = ((((x7 >> 51) as fiat_25519_u1) as u64).wrapping_add((x3 & 0x7ffffffffffff)));
let x11: u64 = (x4 & 0x7ffffffffffff);
let x12: u64 = (x5 & 0x7ffffffffffff);
out1[0] = x8;
out1[1] = x9;
out1[2] = x10;
out1[3] = x11;
out1[4] = x12;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_add(out1: &mut [u64; 5], arg1: &[u64; 5], arg2: &[u64; 5]) {
let x1: u64 = ((arg1[0]).wrapping_add((arg2[0])));
let x2: u64 = ((arg1[1]).wrapping_add((arg2[1])));
let x3: u64 = ((arg1[2]).wrapping_add((arg2[2])));
let x4: u64 = ((arg1[3]).wrapping_add((arg2[3])));
let x5: u64 = ((arg1[4]).wrapping_add((arg2[4])));
out1[0] = x1;
out1[1] = x2;
out1[2] = x3;
out1[3] = x4;
out1[4] = x5;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_sub(out1: &mut [u64; 5], arg1: &[u64; 5], arg2: &[u64; 5]) {
let x1: u64 = ((0xfffffffffffdau64.wrapping_add((arg1[0]))).wrapping_sub((arg2[0])));
let x2: u64 = ((0xffffffffffffeu64.wrapping_add((arg1[1]))).wrapping_sub((arg2[1])));
let x3: u64 = ((0xffffffffffffeu64.wrapping_add((arg1[2]))).wrapping_sub((arg2[2])));
let x4: u64 = ((0xffffffffffffeu64.wrapping_add((arg1[3]))).wrapping_sub((arg2[3])));
let x5: u64 = ((0xffffffffffffeu64.wrapping_add((arg1[4]))).wrapping_sub((arg2[4])));
out1[0] = x1;
out1[1] = x2;
out1[2] = x3;
out1[3] = x4;
out1[4] = x5;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_opp(out1: &mut [u64; 5], arg1: &[u64; 5]) {
let x1: u64 = (0xfffffffffffdau64.wrapping_sub((arg1[0])));
let x2: u64 = (0xffffffffffffeu64.wrapping_sub((arg1[1])));
let x3: u64 = (0xffffffffffffeu64.wrapping_sub((arg1[2])));
let x4: u64 = (0xffffffffffffeu64.wrapping_sub((arg1[3])));
let x5: u64 = (0xffffffffffffeu64.wrapping_sub((arg1[4])));
out1[0] = x1;
out1[1] = x2;
out1[2] = x3;
out1[3] = x4;
out1[4] = x5;
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn fiat_25519_selectznz(
out1: &mut [u64; 5],
arg1: fiat_25519_u1,
arg2: &[u64; 5],
arg3: &[u64; 5],
) {
let mut x1: u64 = 0;
fiat_25519_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0]));
let mut x2: u64 = 0;
fiat_25519_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1]));
let mut x3: u64 = 0;
fiat_25519_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2]));
let mut x4: u64 = 0;
fiat_25519_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3]));
let mut x5: u64 = 0;
fiat_25519_cmovznz_u64(&mut x5, arg1, (arg2[4]), (arg3[4]));
out1[0] = x1;
out1[1] = x2;
out1[2] = x3;
out1[3] = x4;
out1[4] = x5;
}
pub fn fiat_25519_to_bytes(out1: &mut [u8; 32], arg1: &[u64; 5]) {
let mut x1: u64 = 0;
let mut x2: fiat_25519_u1 = 0;
fiat_25519_subborrowx_u51(&mut x1, &mut x2, 0x0, (arg1[0]), 0x7ffffffffffed);
let mut x3: u64 = 0;
let mut x4: fiat_25519_u1 = 0;
fiat_25519_subborrowx_u51(&mut x3, &mut x4, x2, (arg1[1]), 0x7ffffffffffff);
let mut x5: u64 = 0;
let mut x6: fiat_25519_u1 = 0;
fiat_25519_subborrowx_u51(&mut x5, &mut x6, x4, (arg1[2]), 0x7ffffffffffff);
let mut x7: u64 = 0;
let mut x8: fiat_25519_u1 = 0;
fiat_25519_subborrowx_u51(&mut x7, &mut x8, x6, (arg1[3]), 0x7ffffffffffff);
let mut x9: u64 = 0;
let mut x10: fiat_25519_u1 = 0;
fiat_25519_subborrowx_u51(&mut x9, &mut x10, x8, (arg1[4]), 0x7ffffffffffff);
let mut x11: u64 = 0;
fiat_25519_cmovznz_u64(&mut x11, x10, 0x0_u64, 0xffffffffffffffff);
let mut x12: u64 = 0;
let mut x13: fiat_25519_u1 = 0;
fiat_25519_addcarryx_u51(&mut x12, &mut x13, 0x0, x1, (x11 & 0x7ffffffffffed));
let mut x14: u64 = 0;
let mut x15: fiat_25519_u1 = 0;
fiat_25519_addcarryx_u51(&mut x14, &mut x15, x13, x3, (x11 & 0x7ffffffffffff));
let mut x16: u64 = 0;
let mut x17: fiat_25519_u1 = 0;
fiat_25519_addcarryx_u51(&mut x16, &mut x17, x15, x5, (x11 & 0x7ffffffffffff));
let mut x18: u64 = 0;
let mut x19: fiat_25519_u1 = 0;
fiat_25519_addcarryx_u51(&mut x18, &mut x19, x17, x7, (x11 & 0x7ffffffffffff));
let mut x20: u64 = 0;
let mut x21: fiat_25519_u1 = 0;
fiat_25519_addcarryx_u51(&mut x20, &mut x21, x19, x9, (x11 & 0x7ffffffffffff));
let x22: u64 = (x20 << 4);
let x23: u64 = (x18.wrapping_mul(0x2_u64));
let x24: u64 = (x16 << 6);
let x25: u64 = (x14 << 3);
let x26: u8 = ((x12 & 0xff_u64) as u8);
let x27: u64 = (x12 >> 8);
let x28: u8 = ((x27 & 0xff_u64) as u8);
let x29: u64 = (x27 >> 8);
let x30: u8 = ((x29 & 0xff_u64) as u8);
let x31: u64 = (x29 >> 8);
let x32: u8 = ((x31 & 0xff_u64) as u8);
let x33: u64 = (x31 >> 8);
let x34: u8 = ((x33 & 0xff_u64) as u8);
let x35: u64 = (x33 >> 8);
let x36: u8 = ((x35 & 0xff_u64) as u8);
let x37: u8 = ((x35 >> 8) as u8);
let x38: u64 = (x25.wrapping_add((x37 as u64)));
let x39: u8 = ((x38 & 0xff_u64) as u8);
let x40: u64 = (x38 >> 8);
let x41: u8 = ((x40 & 0xff_u64) as u8);
let x42: u64 = (x40 >> 8);
let x43: u8 = ((x42 & 0xff_u64) as u8);
let x44: u64 = (x42 >> 8);
let x45: u8 = ((x44 & 0xff_u64) as u8);
let x46: u64 = (x44 >> 8);
let x47: u8 = ((x46 & 0xff_u64) as u8);
let x48: u64 = (x46 >> 8);
let x49: u8 = ((x48 & 0xff_u64) as u8);
let x50: u8 = ((x48 >> 8) as u8);
let x51: u64 = (x24.wrapping_add((x50 as u64)));
let x52: u8 = ((x51 & 0xff_u64) as u8);
let x53: u64 = (x51 >> 8);
let x54: u8 = ((x53 & 0xff_u64) as u8);
let x55: u64 = (x53 >> 8);
let x56: u8 = ((x55 & 0xff_u64) as u8);
let x57: u64 = (x55 >> 8);
let x58: u8 = ((x57 & 0xff_u64) as u8);
let x59: u64 = (x57 >> 8);
let x60: u8 = ((x59 & 0xff_u64) as u8);
let x61: u64 = (x59 >> 8);
let x62: u8 = ((x61 & 0xff_u64) as u8);
let x63: u64 = (x61 >> 8);
let x64: u8 = ((x63 & 0xff_u64) as u8);
let x65: fiat_25519_u1 = ((x63 >> 8) as fiat_25519_u1);
let x66: u64 = (x23.wrapping_add((x65 as u64)));
let x67: u8 = ((x66 & 0xff_u64) as u8);
let x68: u64 = (x66 >> 8);
let x69: u8 = ((x68 & 0xff_u64) as u8);
let x70: u64 = (x68 >> 8);
let x71: u8 = ((x70 & 0xff_u64) as u8);
let x72: u64 = (x70 >> 8);
let x73: u8 = ((x72 & 0xff_u64) as u8);
let x74: u64 = (x72 >> 8);
let x75: u8 = ((x74 & 0xff_u64) as u8);
let x76: u64 = (x74 >> 8);
let x77: u8 = ((x76 & 0xff_u64) as u8);
let x78: u8 = ((x76 >> 8) as u8);
let x79: u64 = (x22.wrapping_add((x78 as u64)));
let x80: u8 = ((x79 & 0xff_u64) as u8);
let x81: u64 = (x79 >> 8);
let x82: u8 = ((x81 & 0xff_u64) as u8);
let x83: u64 = (x81 >> 8);
let x84: u8 = ((x83 & 0xff_u64) as u8);
let x85: u64 = (x83 >> 8);
let x86: u8 = ((x85 & 0xff_u64) as u8);
let x87: u64 = (x85 >> 8);
let x88: u8 = ((x87 & 0xff_u64) as u8);
let x89: u64 = (x87 >> 8);
let x90: u8 = ((x89 & 0xff_u64) as u8);
let x91: u8 = ((x89 >> 8) as u8);
out1[0] = x26;
out1[1] = x28;
out1[2] = x30;
out1[3] = x32;
out1[4] = x34;
out1[5] = x36;
out1[6] = x39;
out1[7] = x41;
out1[8] = x43;
out1[9] = x45;
out1[10] = x47;
out1[11] = x49;
out1[12] = x52;
out1[13] = x54;
out1[14] = x56;
out1[15] = x58;
out1[16] = x60;
out1[17] = x62;
out1[18] = x64;
out1[19] = x67;
out1[20] = x69;
out1[21] = x71;
out1[22] = x73;
out1[23] = x75;
out1[24] = x77;
out1[25] = x80;
out1[26] = x82;
out1[27] = x84;
out1[28] = x86;
out1[29] = x88;
out1[30] = x90;
out1[31] = x91;
}
#[derive(Clone, Default, Copy)]
pub struct Fe(pub [u64; 5]);
impl PartialEq for Fe {
fn eq(&self, other: &Fe) -> bool {
let &Fe(self_elems) = self;
let &Fe(other_elems) = other;
self_elems == other_elems
}
}
impl Eq for Fe {}
pub static FE_ZERO: Fe = Fe([0, 0, 0, 0, 0]);
pub static FE_ONE: Fe = Fe([1, 0, 0, 0, 0]);
pub static FE_SQRTM1: Fe = Fe([
1718705420411056,
234908883556509,
2233514472574048,
2117202627021982,
765476049583133,
]);
pub(crate) static FE_D: Fe = Fe([
929955233495203,
466365720129213,
1662059464998953,
2033849074728123,
1442794654840575,
]);
pub(crate) static FE_D2: Fe = Fe([
1859910466990425,
932731440258426,
1072319116312658,
1815898335770999,
633789495995903,
]);
#[cfg(feature = "x25519")]
pub(crate) static FE_CURVE25519_BASEPOINT: Fe = Fe([9, 0, 0, 0, 0]);
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
fn load_8u(s: &[u8]) -> u64 {
(s[0] as u64)
| ((s[1] as u64) << 8)
| ((s[2] as u64) << 16)
| ((s[3] as u64) << 24)
| ((s[4] as u64) << 32)
| ((s[5] as u64) << 40)
| ((s[6] as u64) << 48)
| ((s[7] as u64) << 56)
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn load_4u(s: &[u8]) -> u64 {
(s[0] as u64) | ((s[1] as u64) << 8) | ((s[2] as u64) << 16) | ((s[3] as u64) << 24)
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn load_4i(s: &[u8]) -> i64 {
load_4u(s) as i64
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn load_3u(s: &[u8]) -> u64 {
(s[0] as u64) | ((s[1] as u64) << 8) | ((s[2] as u64) << 16)
}
#[cfg_attr(feature = "opt_size", inline(never))]
#[cfg_attr(not(feature = "opt_size"), inline)]
pub fn load_3i(s: &[u8]) -> i64 {
load_3u(s) as i64
}
impl Add for Fe {
type Output = Fe;
fn add(self, _rhs: Fe) -> Fe {
let Fe(f) = self;
let Fe(g) = _rhs;
let mut h = Fe::default();
fiat_25519_add(&mut h.0, &f, &g);
h
}
}
impl Sub for Fe {
type Output = Fe;
fn sub(self, _rhs: Fe) -> Fe {
let Fe(f) = self;
let Fe(g) = _rhs;
let mut h = Fe::default();
fiat_25519_sub(&mut h.0, &f, &g);
h.carry()
}
}
impl Mul for Fe {
type Output = Fe;
fn mul(self, _rhs: Fe) -> Fe {
let Fe(f) = self;
let Fe(g) = _rhs;
let mut h = Fe::default();
fiat_25519_carry_mul(&mut h.0, &f, &g);
h
}
}
impl Fe {
pub fn from_bytes(s: &[u8]) -> Fe {
if s.len() != 32 {
panic!("Invalid compressed length")
}
let mut h = Fe::default();
let mask = 0x7ffffffffffff;
h.0[0] = load_8u(&s[0..]) & mask;
h.0[1] = (load_8u(&s[6..]) >> 3) & mask;
h.0[2] = (load_8u(&s[12..]) >> 6) & mask;
h.0[3] = (load_8u(&s[19..]) >> 1) & mask;
h.0[4] = (load_8u(&s[24..]) >> 12) & mask;
h
}
pub fn to_bytes(&self) -> [u8; 32] {
let &Fe(es) = &self.carry();
let mut s_ = [0u8; 32];
fiat_25519_to_bytes(&mut s_, &es);
s_
}
pub fn carry(&self) -> Fe {
let mut h = Fe::default();
fiat_25519_carry(&mut h.0, &self.0);
h
}
pub fn maybe_set(&mut self, other: &Fe, do_swap: u8) {
let &mut Fe(f) = self;
let &Fe(g) = other;
let mut t = [0u64; 5];
fiat_25519_selectznz(&mut t, do_swap, &f, &g);
self.0 = t
}
pub fn square(&self) -> Fe {
let &Fe(f) = &self;
let mut h = Fe::default();
fiat_25519_carry_square(&mut h.0, f);
h
}
pub fn square_and_double(&self) -> Fe {
let h = self.square();
(h + h)
}
pub fn invert(&self) -> Fe {
let z1 = *self;
let z2 = z1.square();
let z8 = z2.square().square();
let z9 = z1 * z8;
let z11 = z2 * z9;
let z22 = z11.square();
let z_5_0 = z9 * z22;
let z_10_5 = (0..5).fold(z_5_0, |z_5_n, _| z_5_n.square());
let z_10_0 = z_10_5 * z_5_0;
let z_20_10 = (0..10).fold(z_10_0, |x, _| x.square());
let z_20_0 = z_20_10 * z_10_0;
let z_40_20 = (0..20).fold(z_20_0, |x, _| x.square());
let z_40_0 = z_40_20 * z_20_0;
let z_50_10 = (0..10).fold(z_40_0, |x, _| x.square());
let z_50_0 = z_50_10 * z_10_0;
let z_100_50 = (0..50).fold(z_50_0, |x, _| x.square());
let z_100_0 = z_100_50 * z_50_0;
let z_200_100 = (0..100).fold(z_100_0, |x, _| x.square());
let z_200_0 = z_200_100 * z_100_0;
let z_250_50 = (0..50).fold(z_200_0, |x, _| x.square());
let z_250_0 = z_250_50 * z_50_0;
let z_255_5 = (0..5).fold(z_250_0, |x, _| x.square());
let z_255_21 = z_255_5 * z11;
z_255_21
}
pub fn is_zero(&self) -> bool {
self.to_bytes().iter().fold(0, |acc, x| acc | x) == 0
}
pub fn is_negative(&self) -> bool {
(self.to_bytes()[0] & 1) != 0
}
pub fn neg(&self) -> Fe {
let &Fe(f) = &self;
let mut h = Fe::default();
fiat_25519_opp(&mut h.0, f);
h
}
pub fn pow25523(&self) -> Fe {
let z2 = self.square();
let z8 = (0..2).fold(z2, |x, _| x.square());
let z9 = *self * z8;
let z11 = z2 * z9;
let z22 = z11.square();
let z_5_0 = z9 * z22;
let z_10_5 = (0..5).fold(z_5_0, |x, _| x.square());
let z_10_0 = z_10_5 * z_5_0;
let z_20_10 = (0..10).fold(z_10_0, |x, _| x.square());
let z_20_0 = z_20_10 * z_10_0;
let z_40_20 = (0..20).fold(z_20_0, |x, _| x.square());
let z_40_0 = z_40_20 * z_20_0;
let z_50_10 = (0..10).fold(z_40_0, |x, _| x.square());
let z_50_0 = z_50_10 * z_10_0;
let z_100_50 = (0..50).fold(z_50_0, |x, _| x.square());
let z_100_0 = z_100_50 * z_50_0;
let z_200_100 = (0..100).fold(z_100_0, |x, _| x.square());
let z_200_0 = z_200_100 * z_100_0;
let z_250_50 = (0..50).fold(z_200_0, |x, _| x.square());
let z_250_0 = z_250_50 * z_50_0;
let z_252_2 = (0..2).fold(z_250_0, |x, _| x.square());
let z_252_3 = z_252_2 * *self;
z_252_3
}
#[cfg(feature = "x25519")]
#[inline]
pub fn cswap2(a0: &mut Fe, b0: &mut Fe, a1: &mut Fe, b1: &mut Fe, c: u8) {
let mask: u64 = 0u64.wrapping_sub(c as _);
let mut x0 = *a0;
let mut x1 = *a1;
for i in 0..5 {
x0.0[i] ^= b0.0[i];
x1.0[i] ^= b1.0[i];
}
for i in 0..5 {
x0.0[i] &= mask;
x1.0[i] &= mask;
}
for i in 0..5 {
a0.0[i] ^= x0.0[i];
b0.0[i] ^= x0.0[i];
a1.0[i] ^= x1.0[i];
b1.0[i] ^= x1.0[i];
}
}
#[cfg(feature = "x25519")]
#[inline]
pub fn mul32(&self, n: u32) -> Fe {
let sn = n as u128;
let mut fe = Fe::default();
let mut x: u128 = 8;
for i in 0..5 {
x = self.0[i] as u128 * sn + (x >> 51);
fe.0[i] = (x as u64) & 0x7ffffffffffff;
}
fe.0[0] += (x >> 51) as u64 * 19;
fe
}
pub fn reject_noncanonical(s: &[u8]) -> Result<(), Error> {
if s.len() != 32 {
panic!("Invalid compressed length")
}
let mut c = s[31];
c ^= 0x7f;
let mut i: usize = 30;
while i > 0 {
c |= s[i] ^ 0xff;
i -= 1;
}
c = ((c as u16).wrapping_sub(1) >> 8) as u8;
let d = (((0xed - 1) as u16).wrapping_sub(s[0] as u16) >> 8) as u8;
if c & d & 1 == 0 {
Ok(())
} else {
Err(Error::NonCanonical)
}
}
}