crypto_bigint/uint/boxed/
mul_mod.rs

1//! [`BoxedUint`] modular multiplication operations.
2
3use crate::{
4    BoxedUint, ConcatenatingMul, ConcatenatingSquare, Limb, MulMod, NonZero, SquareMod, UintRef,
5    div_limb::mul_rem,
6};
7
8impl BoxedUint {
9    /// Computes `self * rhs mod p` for non-zero `p`.
10    #[must_use]
11    pub fn mul_mod(&self, rhs: &BoxedUint, p: &NonZero<BoxedUint>) -> BoxedUint {
12        self.concatenating_mul(rhs).rem(p)
13    }
14
15    /// Computes `self * rhs mod p` for the special modulus
16    /// `p = MAX+1-c` where `c` is small enough to fit in a single [`Limb`].
17    ///
18    /// For the modulus reduction, this function implements Algorithm 14.47 from
19    /// the "Handbook of Applied Cryptography", by A. Menezes, P. van Oorschot,
20    /// and S. Vanstone, CRC Press, 1996.
21    #[must_use]
22    pub fn mul_mod_special(&self, rhs: &Self, c: Limb) -> Self {
23        debug_assert_eq!(self.bits_precision(), rhs.bits_precision());
24
25        if self.nlimbs() == 1 {
26            let reduced = mul_rem(
27                self.limbs[0],
28                rhs.limbs[0],
29                NonZero::<Limb>::new_unwrap(Limb::ZERO.wrapping_sub(c)),
30            );
31            return Self::from(reduced);
32        }
33
34        let product = self.concatenating_mul(rhs);
35        let (lo, hi) = product.as_uint_ref().split_at(self.nlimbs());
36
37        // Now use Algorithm 14.47 for the reduction
38        let (mut lo, carry) = mac_by_limb(lo, hi, c, Limb::ZERO);
39
40        let carry = {
41            let rhs = carry.wrapping_add(Limb::ONE).widening_mul(c);
42            lo.carrying_add_assign(UintRef::new(&[rhs.0, rhs.1]), Limb::ZERO)
43        };
44
45        {
46            let rhs = carry.wrapping_sub(Limb::ONE) & c;
47            lo.borrowing_sub_assign(rhs, Limb::ZERO);
48        }
49
50        lo
51    }
52
53    /// Computes `self * self mod p`.
54    #[must_use]
55    pub fn square_mod(&self, p: &NonZero<BoxedUint>) -> Self {
56        self.concatenating_square().rem(p)
57    }
58
59    /// Computes `self * self mod p` in variable time with respect to `p`.
60    #[must_use]
61    pub fn square_mod_vartime(&self, p: &NonZero<BoxedUint>) -> Self {
62        self.concatenating_square().rem_vartime(p)
63    }
64}
65
66impl MulMod for BoxedUint {
67    type Output = Self;
68
69    fn mul_mod(&self, rhs: &Self, p: &NonZero<Self>) -> Self {
70        self.mul_mod(rhs, p)
71    }
72}
73
74impl SquareMod for BoxedUint {
75    type Output = Self;
76
77    fn square_mod(&self, p: &NonZero<Self>) -> Self {
78        self.square_mod(p)
79    }
80}
81
82/// Computes `a + (b * c) + carry`, returning the result along with the new carry.
83fn mac_by_limb(a: &UintRef, b: &UintRef, c: Limb, carry: Limb) -> (BoxedUint, Limb) {
84    let mut res = BoxedUint::zero_with_precision(a.bits_precision());
85    let mut carry = carry;
86
87    for i in 0..a.nlimbs() {
88        (res.limbs[i], carry) = b.limbs[i].carrying_mul_add(c, a.limbs[i], carry);
89    }
90
91    (res, carry)
92}
93
94#[cfg(all(test, feature = "rand_core"))]
95mod tests {
96    use crate::{BoxedUint, ConcatenatingMul, Limb, NonZero, Random, RandomMod};
97    use rand_core::SeedableRng;
98
99    #[test]
100    fn mul_mod_special() {
101        let mut rng = chacha20::ChaCha8Rng::seed_from_u64(1);
102        let moduli = [
103            NonZero::<Limb>::random_from_rng(&mut rng),
104            NonZero::<Limb>::random_from_rng(&mut rng),
105        ];
106        let sizes = if cfg!(miri) {
107            &[1, 2, 3][..]
108        } else {
109            &[1, 2, 3, 4, 8, 16][..]
110        };
111
112        for size in sizes.iter().copied() {
113            let bits = size * Limb::BITS;
114
115            for special in &moduli {
116                let zero = BoxedUint::zero_with_precision(bits);
117                let one = BoxedUint::one_with_precision(bits);
118                let p = NonZero::new(zero.wrapping_sub(special.get())).unwrap();
119                let minus_one = p.wrapping_sub(Limb::ONE);
120
121                let base_cases = [
122                    (&zero, &zero, &zero),
123                    (&one, &zero, &zero),
124                    (&zero, &one, &zero),
125                    (&one, &one, &one),
126                    (&minus_one, &minus_one, &one),
127                    (&minus_one, &one, &minus_one),
128                    (&one, &minus_one, &minus_one),
129                ];
130                for (a, b, c) in base_cases {
131                    let x = a.mul_mod_special(b, *special.as_ref());
132                    assert_eq!(&x, c, "{} * {} mod {} = {} != {}", a, b, p, x, c);
133                }
134
135                for _i in 0..100 {
136                    let a = BoxedUint::random_mod_vartime(&mut rng, &p);
137                    let b = BoxedUint::random_mod_vartime(&mut rng, &p);
138
139                    let c = a.mul_mod_special(&b, *special.as_ref());
140                    assert!(c < p.as_ref(), "not reduced: {} >= {} ", c, p);
141
142                    let expected = {
143                        let prod = a.concatenating_mul(&b);
144                        prod.rem_vartime(&p)
145                    };
146                    assert_eq!(c, expected, "incorrect result");
147                }
148            }
149        }
150    }
151}
crypto_bigint/uint/boxed/mul_mod.rs

crypto_bigint/uint/boxed/
mul_mod.rs
