#include "../limbs/limbs.h"
#include <string.h>
#include "ecp_nistz384.h"
#include "../bn/internal.h"
#include "../internal.h"
#include "../limbs/limbs.inl"
typedef Limb Elem[P384_LIMBS];
typedef Limb ScalarMont[P384_LIMBS];
typedef Limb Scalar[P384_LIMBS];
void GFp_p384_elem_add(Elem r, const Elem a, const Elem b);
void GFp_p384_elem_sub(Elem r, const Elem a, const Elem b);
void GFp_p384_elem_div_by_2(Elem r, const Elem a);
void GFp_p384_elem_mul_mont(Elem r, const Elem a, const Elem b);
void GFp_p384_elem_neg(Elem r, const Elem a);
void GFp_p384_scalar_inv_to_mont(ScalarMont r, const Scalar a);
void GFp_p384_scalar_mul_mont(ScalarMont r, const ScalarMont a,
const ScalarMont b);
static const BN_ULONG Q[P384_LIMBS] = {
TOBN(0x00000000, 0xffffffff),
TOBN(0xffffffff, 0x00000000),
TOBN(0xffffffff, 0xfffffffe),
TOBN(0xffffffff, 0xffffffff),
TOBN(0xffffffff, 0xffffffff),
TOBN(0xffffffff, 0xffffffff),
};
static const BN_ULONG N[P384_LIMBS] = {
TOBN(0xecec196a, 0xccc52973),
TOBN(0x581a0db2, 0x48b0a77a),
TOBN(0xc7634d81, 0xf4372ddf),
TOBN(0xffffffff, 0xffffffff),
TOBN(0xffffffff, 0xffffffff),
TOBN(0xffffffff, 0xffffffff),
};
OPENSSL_COMPILE_ASSERT(sizeof(size_t) == sizeof(Limb),
size_t_and_gfp_limb_are_different_sizes);
OPENSSL_COMPILE_ASSERT(sizeof(size_t) == sizeof(BN_ULONG),
size_t_and_bn_ulong_are_different_sizes);
static const BN_ULONG ONE[P384_LIMBS] = {
TOBN(0xffffffff, 1), TOBN(0, 0xffffffff), TOBN(0, 1), TOBN(0, 0), TOBN(0, 0),
TOBN(0, 0),
};
#if defined(_MSC_VER) && defined(OPENSSL_X86)
#define INLINE_IF_POSSIBLE __forceinline
#else
#define INLINE_IF_POSSIBLE inline
#endif
static INLINE_IF_POSSIBLE Limb is_equal(const Elem a, const Elem b) {
return LIMBS_equal(a, b, P384_LIMBS);
}
static INLINE_IF_POSSIBLE void copy_conditional(Elem r, const Elem a,
const Limb condition) {
for (size_t i = 0; i < P384_LIMBS; ++i) {
r[i] = constant_time_select_size_t(condition, a[i], r[i]);
}
}
static void elem_add(Elem r, const Elem a, const Elem b) {
LIMBS_add_mod(r, a, b, Q, P384_LIMBS);
}
static void elem_sub(Elem r, const Elem a, const Elem b) {
LIMBS_sub_mod(r, a, b, Q, P384_LIMBS);
}
static void elem_div_by_2(Elem r, const Elem a) {
Limb is_odd = constant_time_is_nonzero_size_t(a[0] & 1);
Limb carry = a[P384_LIMBS - 1] & 1;
r[P384_LIMBS - 1] = a[P384_LIMBS - 1] >> 1;
for (size_t i = 1; i < P384_LIMBS; ++i) {
Limb new_carry = a[P384_LIMBS - i - 1];
r[P384_LIMBS - i - 1] =
(a[P384_LIMBS - i - 1] >> 1) | (carry << (LIMB_BITS - 1));
carry = new_carry;
}
static const Elem Q_PLUS_1_SHR_1 = {
TOBN(0x00000000, 0x80000000), TOBN(0x7fffffff, 0x80000000),
TOBN(0xffffffff, 0xffffffff), TOBN(0xffffffff, 0xffffffff),
TOBN(0xffffffff, 0xffffffff), TOBN(0x7fffffff, 0xffffffff),
};
Elem adjusted;
BN_ULONG carry2 = limbs_add(adjusted, r, Q_PLUS_1_SHR_1, P384_LIMBS);
#if defined(NDEBUG)
(void)carry2;
#endif
assert(carry2 == 0);
copy_conditional(r, adjusted, is_odd);
}
static inline void elem_mul_mont(Elem r, const Elem a, const Elem b) {
static const BN_ULONG Q_N0[] = {
BN_MONT_CTX_N0(0x1, 0x1)
};
GFp_bn_mul_mont(r, a, b, Q, Q_N0, P384_LIMBS);
}
static inline void elem_mul_by_2(Elem r, const Elem a) {
LIMBS_shl_mod(r, a, Q, P384_LIMBS);
}
static INLINE_IF_POSSIBLE void elem_mul_by_3(Elem r, const Elem a) {
Elem doubled;
elem_add(doubled, a, a);
elem_add(r, doubled, a);
}
static inline void elem_sqr_mont(Elem r, const Elem a) {
elem_mul_mont(r, a, a);
}
void GFp_p384_elem_add(Elem r, const Elem a, const Elem b) {
elem_add(r, a, b);
}
void GFp_p384_elem_sub(Elem r, const Elem a, const Elem b) {
elem_sub(r, a, b);
}
void GFp_p384_elem_div_by_2(Elem r, const Elem a) {
elem_div_by_2(r, a);
}
void GFp_p384_elem_mul_mont(Elem r, const Elem a, const Elem b) {
elem_mul_mont(r, a, b);
}
void GFp_p384_elem_neg(Elem r, const Elem a) {
Limb is_zero = LIMBS_are_zero(a, P384_LIMBS);
Carry borrow = limbs_sub(r, Q, a, P384_LIMBS);
#if defined(NDEBUG)
(void)borrow;
#endif
assert(borrow == 0);
for (size_t i = 0; i < P384_LIMBS; ++i) {
r[i] = constant_time_select_size_t(is_zero, 0, r[i]);
}
}
void GFp_p384_scalar_mul_mont(ScalarMont r, const ScalarMont a,
const ScalarMont b) {
static const BN_ULONG N_N0[] = {
BN_MONT_CTX_N0(0x6ed46089, 0xe88fdc45)
};
GFp_bn_mul_mont(r, a, b, N, N_N0, P384_LIMBS);
}
static void gfp_p384_point_select_w5(P384_POINT *out,
const P384_POINT table[16], size_t index) {
Elem x; memset(x, 0, sizeof(x));
Elem y; memset(y, 0, sizeof(y));
Elem z; memset(z, 0, sizeof(z));
for (size_t i = 0; i < 16; ++i) {
Limb mask = constant_time_eq_size_t(index, i + 1);
for (size_t j = 0; j < P384_LIMBS; ++j) {
x[j] |= table[i].X[j] & mask;
y[j] |= table[i].Y[j] & mask;
z[j] |= table[i].Z[j] & mask;
}
}
memcpy(out->X, x, sizeof(x));
memcpy(out->Y, y, sizeof(y));
memcpy(out->Z, z, sizeof(z));
}
#include "ecp_nistz384.inl"