#include "ecp_nistz.h"
void GFp_nistz384_point_mul(P384_POINT *r, const BN_ULONG p_scalar[P384_LIMBS],
const BN_ULONG p_x[P384_LIMBS],
const BN_ULONG p_y[P384_LIMBS]);
static BN_ULONG is_zero(const BN_ULONG a[P384_LIMBS]) {
BN_ULONG acc = 0;
for (size_t i = 0; i < P384_LIMBS; ++i) {
acc |= a[i];
}
return constant_time_is_zero_size_t(acc);
}
void GFp_nistz384_point_double(P384_POINT *r, const P384_POINT *a) {
BN_ULONG S[P384_LIMBS];
BN_ULONG M[P384_LIMBS];
BN_ULONG Zsqr[P384_LIMBS];
BN_ULONG tmp0[P384_LIMBS];
const BN_ULONG *in_x = a->X;
const BN_ULONG *in_y = a->Y;
const BN_ULONG *in_z = a->Z;
BN_ULONG *res_x = r->X;
BN_ULONG *res_y = r->Y;
BN_ULONG *res_z = r->Z;
elem_mul_by_2(S, in_y);
elem_sqr_mont(Zsqr, in_z);
elem_sqr_mont(S, S);
elem_mul_mont(res_z, in_z, in_y);
elem_mul_by_2(res_z, res_z);
elem_add(M, in_x, Zsqr);
elem_sub(Zsqr, in_x, Zsqr);
elem_sqr_mont(res_y, S);
elem_div_by_2(res_y, res_y);
elem_mul_mont(M, M, Zsqr);
elem_mul_by_3(M, M);
elem_mul_mont(S, S, in_x);
elem_mul_by_2(tmp0, S);
elem_sqr_mont(res_x, M);
elem_sub(res_x, res_x, tmp0);
elem_sub(S, S, res_x);
elem_mul_mont(S, S, M);
elem_sub(res_y, S, res_y);
}
void GFp_nistz384_point_add(P384_POINT *r, const P384_POINT *a,
const P384_POINT *b) {
BN_ULONG U2[P384_LIMBS], S2[P384_LIMBS];
BN_ULONG U1[P384_LIMBS], S1[P384_LIMBS];
BN_ULONG Z1sqr[P384_LIMBS];
BN_ULONG Z2sqr[P384_LIMBS];
BN_ULONG H[P384_LIMBS], R[P384_LIMBS];
BN_ULONG Hsqr[P384_LIMBS];
BN_ULONG Rsqr[P384_LIMBS];
BN_ULONG Hcub[P384_LIMBS];
BN_ULONG res_x[P384_LIMBS];
BN_ULONG res_y[P384_LIMBS];
BN_ULONG res_z[P384_LIMBS];
const BN_ULONG *in1_x = a->X;
const BN_ULONG *in1_y = a->Y;
const BN_ULONG *in1_z = a->Z;
const BN_ULONG *in2_x = b->X;
const BN_ULONG *in2_y = b->Y;
const BN_ULONG *in2_z = b->Z;
BN_ULONG in1infty = is_zero(a->Z);
BN_ULONG in2infty = is_zero(b->Z);
elem_sqr_mont(Z2sqr, in2_z);
elem_sqr_mont(Z1sqr, in1_z);
elem_mul_mont(S1, Z2sqr, in2_z);
elem_mul_mont(S2, Z1sqr, in1_z);
elem_mul_mont(S1, S1, in1_y);
elem_mul_mont(S2, S2, in2_y);
elem_sub(R, S2, S1);
elem_mul_mont(U1, in1_x, Z2sqr);
elem_mul_mont(U2, in2_x, Z1sqr);
elem_sub(H, U2, U1);
if (is_equal(U1, U2) && !in1infty && !in2infty) {
if (is_equal(S1, S2)) {
GFp_nistz384_point_double(r, a);
} else {
memset(r, 0, sizeof(*r));
}
return;
}
elem_sqr_mont(Rsqr, R);
elem_mul_mont(res_z, H, in1_z);
elem_sqr_mont(Hsqr, H);
elem_mul_mont(res_z, res_z, in2_z);
elem_mul_mont(Hcub, Hsqr, H);
elem_mul_mont(U2, U1, Hsqr);
elem_mul_by_2(Hsqr, U2);
elem_sub(res_x, Rsqr, Hsqr);
elem_sub(res_x, res_x, Hcub);
elem_sub(res_y, U2, res_x);
elem_mul_mont(S2, S1, Hcub);
elem_mul_mont(res_y, R, res_y);
elem_sub(res_y, res_y, S2);
copy_conditional(res_x, in2_x, in1infty);
copy_conditional(res_y, in2_y, in1infty);
copy_conditional(res_z, in2_z, in1infty);
copy_conditional(res_x, in1_x, in2infty);
copy_conditional(res_y, in1_y, in2infty);
copy_conditional(res_z, in1_z, in2infty);
memcpy(r->X, res_x, sizeof(res_x));
memcpy(r->Y, res_y, sizeof(res_y));
memcpy(r->Z, res_z, sizeof(res_z));
}
static void add_precomputed_w5(P384_POINT *r, unsigned wvalue,
const P384_POINT table[16]) {
BN_ULONG recoded_is_negative;
unsigned int recoded;
booth_recode(&recoded_is_negative, &recoded, wvalue, 5);
alignas(64) P384_POINT h;
gfp_p384_point_select_w5(&h, table, recoded);
alignas(64) BN_ULONG tmp[P384_LIMBS];
GFp_p384_elem_neg(tmp, h.Y);
copy_conditional(h.Y, tmp, recoded_is_negative);
GFp_nistz384_point_add(r, r, &h);
}
void GFp_nistz384_point_mul(P384_POINT *r, const BN_ULONG p_scalar[P384_LIMBS],
const BN_ULONG p_x[P384_LIMBS],
const BN_ULONG p_y[P384_LIMBS]) {
static const unsigned kWindowSize = 5;
static const unsigned kMask = (1 << (5 + 1)) - 1;
uint8_t p_str[(P384_LIMBS * BN_BYTES) + 1];
gfp_little_endian_bytes_from_scalar(p_str, sizeof(p_str) / sizeof(p_str[0]),
p_scalar, P384_LIMBS);
alignas(64) P384_POINT table[16];
P384_POINT *row = table;
memcpy(row[1 - 1].X, p_x, P384_LIMBS * BN_BYTES);
memcpy(row[1 - 1].Y, p_y, P384_LIMBS * BN_BYTES);
memcpy(row[1 - 1].Z, ONE, P384_LIMBS * BN_BYTES);
GFp_nistz384_point_double(&row[2 - 1], &row[1 - 1]);
GFp_nistz384_point_add(&row[3 - 1], &row[2 - 1], &row[1 - 1]);
GFp_nistz384_point_double(&row[4 - 1], &row[2 - 1]);
GFp_nistz384_point_double(&row[6 - 1], &row[3 - 1]);
GFp_nistz384_point_double(&row[8 - 1], &row[4 - 1]);
GFp_nistz384_point_double(&row[12 - 1], &row[6 - 1]);
GFp_nistz384_point_add(&row[5 - 1], &row[4 - 1], &row[1 - 1]);
GFp_nistz384_point_add(&row[7 - 1], &row[6 - 1], &row[1 - 1]);
GFp_nistz384_point_add(&row[9 - 1], &row[8 - 1], &row[1 - 1]);
GFp_nistz384_point_add(&row[13 - 1], &row[12 - 1], &row[1 - 1]);
GFp_nistz384_point_double(&row[14 - 1], &row[7 - 1]);
GFp_nistz384_point_double(&row[10 - 1], &row[5 - 1]);
GFp_nistz384_point_add(&row[15 - 1], &row[14 - 1], &row[1 - 1]);
GFp_nistz384_point_add(&row[11 - 1], &row[10 - 1], &row[1 - 1]);
GFp_nistz384_point_double(&row[16 - 1], &row[8 - 1]);
static const unsigned START_INDEX = 384 - 4;
unsigned index = START_INDEX;
BN_ULONG recoded_is_negative;
unsigned recoded;
unsigned wvalue = p_str[(index - 1) / 8];
wvalue = (wvalue >> ((index - 1) % 8)) & kMask;
booth_recode(&recoded_is_negative, &recoded, wvalue, 5);
assert(!recoded_is_negative);
gfp_p384_point_select_w5(r, table, recoded);
while (index >= kWindowSize) {
if (index != START_INDEX) {
unsigned off = (index - 1) / 8;
wvalue = p_str[off] | p_str[off + 1] << 8;
wvalue = (wvalue >> ((index - 1) % 8)) & kMask;
add_precomputed_w5(r, wvalue, table);
}
index -= kWindowSize;
GFp_nistz384_point_double(r, r);
GFp_nistz384_point_double(r, r);
GFp_nistz384_point_double(r, r);
GFp_nistz384_point_double(r, r);
GFp_nistz384_point_double(r, r);
}
wvalue = p_str[0];
wvalue = (wvalue << 1) & kMask;
add_precomputed_w5(r, wvalue, table);
}