mirror of
https://github.com/saymrwulf/betrusted-curve25519-dalek-source.git
synced 2026-09-04 20:24:07 +00:00
wip: trying to get unifying version
This commit is contained in:
David Kotval
parent
e8fdef83b4
commit
7bf60e4a2b
6 changed files with 198 additions and 189 deletions
|
|
@ -57,9 +57,10 @@ serde = { version = "1.0", default-features = false, optional = true, features =
|
|||
zeroize = { version = "1", default-features = false, optional = true }
|
||||
|
||||
# Betrusted/Precursor dependency set, enabled by backend_u32e feature
|
||||
log = { version = "0.4", optional = true}
|
||||
engine25519-as = {git = "https://github.com/betrusted-io/engine25519-as.git", rev = "d249c967556b02ab5439eacb5078fa00c60b93d6", default-features = false, features = [], optional = true}
|
||||
engine-25519 = { git = "https://github.com/betrusted-io/xous-engine-25519.git", rev = "63d3d1f30736022e791deaacf4dd62c00b42fe2e", optional = true}
|
||||
utralib = {version = "0.1.0", optional = true} # this is bogus -- must be patched in the invoking build environment TODO: if this builds, it seems a crate has been released as version 0.1.23 that could replace this
|
||||
utralib = {version = "0.1.24", default-features = false, optional = true}
|
||||
|
||||
[target.'cfg(target_arch = "x86_64")'.dependencies]
|
||||
cpufeatures = "0.2.6"
|
||||
|
|
@ -71,8 +72,8 @@ default = ["alloc", "precomputed-tables", "zeroize"]
|
|||
alloc = ["zeroize?/alloc"]
|
||||
precomputed-tables = []
|
||||
legacy_compatibility = []
|
||||
backend_fiat = ["dep:fiat-crypto"]
|
||||
backend_u32e = ["dep:engine25519-as","dep:engine-25519","dep:utralib"]
|
||||
fiat_backend = ["dep:fiat-crypto"]
|
||||
u32e_backend = ["dep:engine25519-as","dep:engine-25519","dep:utralib","log","group","zeroize","precomputed-tables"]
|
||||
group = ["dep:group", "rand_core"]
|
||||
group-bits = ["group", "ff/bits"]
|
||||
|
||||
|
|
|
|||
|
|
@ -21,7 +21,6 @@ macro_rules! build_debug {
|
|||
fn main() {
|
||||
let target_triplet = std::env::var("TARGET").unwrap();
|
||||
let platform = platforms::Platform::find(&target_triplet).unwrap();
|
||||
//Xous running on
|
||||
let curve25519_dalek_bits = match std::env::var("CARGO_CFG_CURVE25519_DALEK_BITS").as_deref() {
|
||||
Ok("32") => DalekBits::Dalek32,
|
||||
Ok("64") => DalekBits::Dalek64,
|
||||
|
|
@ -54,6 +53,7 @@ fn main() {
|
|||
Ok(arch) => arch,
|
||||
_ => "".to_string(),
|
||||
};
|
||||
build_debug!("target_arch {}",target_arch);
|
||||
|
||||
// Backend overrides / defaults
|
||||
let curve25519_dalek_backend =
|
||||
|
|
|
|||
|
|
@ -322,23 +322,18 @@ impl Engine25519 {
|
|||
}
|
||||
|
||||
/// Construct zero.
|
||||
pub fn zero() -> Engine25519 {
|
||||
Engine25519([ 0 ; 32 ])
|
||||
}
|
||||
pub const ZERO: Engine25519 = Engine25519([ 0 ; 32 ]);
|
||||
|
||||
/// Construct one.
|
||||
pub fn one() -> Engine25519 {
|
||||
Engine25519([ 1, 0, 0, 0, 0, 0, 0, 0,
|
||||
pub const ONE: Engine25519 = Engine25519([ 1, 0, 0, 0, 0, 0, 0, 0,
|
||||
0, 0, 0, 0, 0, 0, 0, 0,
|
||||
0, 0, 0, 0, 0, 0, 0, 0,
|
||||
0, 0, 0, 0, 0, 0, 0, 0,
|
||||
])
|
||||
}
|
||||
]);
|
||||
|
||||
/// Construct -1.
|
||||
pub fn minus_one() -> Engine25519 {
|
||||
Engine25519([236, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 127])
|
||||
}
|
||||
pub const MINUS_ONE: Engine25519 =
|
||||
Engine25519([236, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 127]);
|
||||
|
||||
/// Given `k > 0`, return `self^(2^k)`.
|
||||
pub fn pow2k(&self, k: u32) -> Engine25519 {
|
||||
|
|
@ -371,7 +366,7 @@ impl Engine25519 {
|
|||
|
||||
/// Serialize this `FieldElement51` to a 32-byte array. The
|
||||
/// encoding is canonical.
|
||||
pub fn to_bytes(&self) -> [u8; 32] {
|
||||
pub fn as_bytes(&self) -> [u8; 32] {
|
||||
self.0
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -10,16 +10,26 @@
|
|||
//! -0x1ffffffe00000008 (62 bits with sign bit) to
|
||||
//! 0x43fffffbc0000011 (63 bits), which is still safe.
|
||||
|
||||
use core::fmt::Debug;
|
||||
use core::ops::{Index, IndexMut};
|
||||
|
||||
#[cfg(feature = "zeroize")]
|
||||
use zeroize::Zeroize;
|
||||
|
||||
use crate::constants;
|
||||
|
||||
/// The `Scalar29` struct represents an element in ℤ/lℤ as 9 29-bit limbs
|
||||
#[derive(Copy,Clone)]
|
||||
/// The `Scalar29` struct represents an element in \\(\mathbb{Z} / \ell\mathbb{Z}\\) as 9 29-bit
|
||||
/// limbs
|
||||
#[derive(Copy, Clone)]
|
||||
pub struct Scalar29(pub [u32; 9]);
|
||||
|
||||
impl Debug for Scalar29 {
|
||||
fn fmt(&self, f: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result {
|
||||
write!(f, "Scalar29: {:?}", &self.0[..])
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(feature = "zeroize")]
|
||||
impl Zeroize for Scalar29 {
|
||||
fn zeroize(&mut self) {
|
||||
self.0.zeroize();
|
||||
|
|
@ -46,12 +56,11 @@ fn m(x: u32, y: u32) -> u64 {
|
|||
}
|
||||
|
||||
impl Scalar29 {
|
||||
/// Return the zero scalar.
|
||||
pub fn zero() -> Scalar29 {
|
||||
Scalar29([0,0,0,0,0,0,0,0,0])
|
||||
}
|
||||
/// The scalar \\( 0 \\).
|
||||
pub const ZERO: Scalar29 = Scalar29([0, 0, 0, 0, 0, 0, 0, 0, 0]);
|
||||
|
||||
/// Unpack a 32 byte / 256 bit scalar into 9 29-bit limbs.
|
||||
#[rustfmt::skip] // keep alignment of s[*] calculations
|
||||
pub fn from_bytes(bytes: &[u8; 32]) -> Scalar29 {
|
||||
let mut words = [0u32; 8];
|
||||
for i in 0..8 {
|
||||
|
|
@ -62,22 +71,23 @@ impl Scalar29 {
|
|||
|
||||
let mask = (1u32 << 29) - 1;
|
||||
let top_mask = (1u32 << 24) - 1;
|
||||
let mut s = Scalar29::zero();
|
||||
let mut s = Scalar29::ZERO;
|
||||
|
||||
s[ 0] = words[0] & mask;
|
||||
s[ 1] = ((words[0] >> 29) | (words[1] << 3)) & mask;
|
||||
s[ 2] = ((words[1] >> 26) | (words[2] << 6)) & mask;
|
||||
s[ 3] = ((words[2] >> 23) | (words[3] << 9)) & mask;
|
||||
s[ 4] = ((words[3] >> 20) | (words[4] << 12)) & mask;
|
||||
s[ 5] = ((words[4] >> 17) | (words[5] << 15)) & mask;
|
||||
s[ 6] = ((words[5] >> 14) | (words[6] << 18)) & mask;
|
||||
s[ 7] = ((words[6] >> 11) | (words[7] << 21)) & mask;
|
||||
s[ 8] = (words[7] >> 8) & top_mask;
|
||||
s[0] = words[0] & mask;
|
||||
s[1] = ((words[0] >> 29) | (words[1] << 3)) & mask;
|
||||
s[2] = ((words[1] >> 26) | (words[2] << 6)) & mask;
|
||||
s[3] = ((words[2] >> 23) | (words[3] << 9)) & mask;
|
||||
s[4] = ((words[3] >> 20) | (words[4] << 12)) & mask;
|
||||
s[5] = ((words[4] >> 17) | (words[5] << 15)) & mask;
|
||||
s[6] = ((words[5] >> 14) | (words[6] << 18)) & mask;
|
||||
s[7] = ((words[6] >> 11) | (words[7] << 21)) & mask;
|
||||
s[8] = (words[7] >> 8) & top_mask;
|
||||
|
||||
s
|
||||
}
|
||||
|
||||
/// Reduce a 64 byte / 512 bit scalar mod l.
|
||||
#[rustfmt::skip] // keep alignment of lo[*] calculations
|
||||
pub fn from_bytes_wide(bytes: &[u8; 64]) -> Scalar29 {
|
||||
let mut words = [0u32; 16];
|
||||
for i in 0..16 {
|
||||
|
|
@ -87,8 +97,8 @@ impl Scalar29 {
|
|||
}
|
||||
|
||||
let mask = (1u32 << 29) - 1;
|
||||
let mut lo = Scalar29::zero();
|
||||
let mut hi = Scalar29::zero();
|
||||
let mut lo = Scalar29::ZERO;
|
||||
let mut hi = Scalar29::ZERO;
|
||||
|
||||
lo[0] = words[ 0] & mask;
|
||||
lo[1] = ((words[ 0] >> 29) | (words[ 1] << 3)) & mask;
|
||||
|
|
@ -116,48 +126,50 @@ impl Scalar29 {
|
|||
}
|
||||
|
||||
/// Pack the limbs of this `Scalar29` into 32 bytes.
|
||||
pub fn to_bytes(&self) -> [u8; 32] {
|
||||
#[rustfmt::skip] // keep alignment of s[*] calculations
|
||||
#[allow(clippy::identity_op)]
|
||||
pub fn as_bytes(&self) -> [u8; 32] {
|
||||
let mut s = [0u8; 32];
|
||||
|
||||
s[0] = (self.0[ 0] >> 0) as u8;
|
||||
s[1] = (self.0[ 0] >> 8) as u8;
|
||||
s[2] = (self.0[ 0] >> 16) as u8;
|
||||
s[3] = ((self.0[ 0] >> 24) | (self.0[ 1] << 5)) as u8;
|
||||
s[4] = (self.0[ 1] >> 3) as u8;
|
||||
s[5] = (self.0[ 1] >> 11) as u8;
|
||||
s[6] = (self.0[ 1] >> 19) as u8;
|
||||
s[7] = ((self.0[ 1] >> 27) | (self.0[ 2] << 2)) as u8;
|
||||
s[8] = (self.0[ 2] >> 6) as u8;
|
||||
s[9] = (self.0[ 2] >> 14) as u8;
|
||||
s[10] = ((self.0[ 2] >> 22) | (self.0[ 3] << 7)) as u8;
|
||||
s[11] = (self.0[ 3] >> 1) as u8;
|
||||
s[12] = (self.0[ 3] >> 9) as u8;
|
||||
s[13] = (self.0[ 3] >> 17) as u8;
|
||||
s[14] = ((self.0[ 3] >> 25) | (self.0[ 4] << 4)) as u8;
|
||||
s[15] = (self.0[ 4] >> 4) as u8;
|
||||
s[16] = (self.0[ 4] >> 12) as u8;
|
||||
s[17] = (self.0[ 4] >> 20) as u8;
|
||||
s[18] = ((self.0[ 4] >> 28) | (self.0[ 5] << 1)) as u8;
|
||||
s[19] = (self.0[ 5] >> 7) as u8;
|
||||
s[20] = (self.0[ 5] >> 15) as u8;
|
||||
s[21] = ((self.0[ 5] >> 23) | (self.0[ 6] << 6)) as u8;
|
||||
s[22] = (self.0[ 6] >> 2) as u8;
|
||||
s[23] = (self.0[ 6] >> 10) as u8;
|
||||
s[24] = (self.0[ 6] >> 18) as u8;
|
||||
s[25] = ((self.0[ 6] >> 26) | (self.0[ 7] << 3)) as u8;
|
||||
s[26] = (self.0[ 7] >> 5) as u8;
|
||||
s[27] = (self.0[ 7] >> 13) as u8;
|
||||
s[28] = (self.0[ 7] >> 21) as u8;
|
||||
s[29] = (self.0[ 8] >> 0) as u8;
|
||||
s[30] = (self.0[ 8] >> 8) as u8;
|
||||
s[31] = (self.0[ 8] >> 16) as u8;
|
||||
s[ 0] = (self.0[0] >> 0) as u8;
|
||||
s[ 1] = (self.0[0] >> 8) as u8;
|
||||
s[ 2] = (self.0[0] >> 16) as u8;
|
||||
s[ 3] = ((self.0[0] >> 24) | (self.0[1] << 5)) as u8;
|
||||
s[ 4] = (self.0[1] >> 3) as u8;
|
||||
s[ 5] = (self.0[1] >> 11) as u8;
|
||||
s[ 6] = (self.0[1] >> 19) as u8;
|
||||
s[ 7] = ((self.0[1] >> 27) | (self.0[2] << 2)) as u8;
|
||||
s[ 8] = (self.0[2] >> 6) as u8;
|
||||
s[ 9] = (self.0[2] >> 14) as u8;
|
||||
s[10] = ((self.0[2] >> 22) | (self.0[3] << 7)) as u8;
|
||||
s[11] = (self.0[3] >> 1) as u8;
|
||||
s[12] = (self.0[3] >> 9) as u8;
|
||||
s[13] = (self.0[3] >> 17) as u8;
|
||||
s[14] = ((self.0[3] >> 25) | (self.0[4] << 4)) as u8;
|
||||
s[15] = (self.0[4] >> 4) as u8;
|
||||
s[16] = (self.0[4] >> 12) as u8;
|
||||
s[17] = (self.0[4] >> 20) as u8;
|
||||
s[18] = ((self.0[4] >> 28) | (self.0[5] << 1)) as u8;
|
||||
s[19] = (self.0[5] >> 7) as u8;
|
||||
s[20] = (self.0[5] >> 15) as u8;
|
||||
s[21] = ((self.0[5] >> 23) | (self.0[6] << 6)) as u8;
|
||||
s[22] = (self.0[6] >> 2) as u8;
|
||||
s[23] = (self.0[6] >> 10) as u8;
|
||||
s[24] = (self.0[6] >> 18) as u8;
|
||||
s[25] = ((self.0[6] >> 26) | (self.0[7] << 3)) as u8;
|
||||
s[26] = (self.0[7] >> 5) as u8;
|
||||
s[27] = (self.0[7] >> 13) as u8;
|
||||
s[28] = (self.0[7] >> 21) as u8;
|
||||
s[29] = (self.0[8] >> 0) as u8;
|
||||
s[30] = (self.0[8] >> 8) as u8;
|
||||
s[31] = (self.0[8] >> 16) as u8;
|
||||
|
||||
s
|
||||
}
|
||||
|
||||
/// Compute `a + b` (mod l).
|
||||
pub fn add(a: &Scalar29, b: &Scalar29) -> Scalar29 {
|
||||
let mut sum = Scalar29::zero();
|
||||
let mut sum = Scalar29::ZERO;
|
||||
let mask = (1u32 << 29) - 1;
|
||||
|
||||
// a + b
|
||||
|
|
@ -173,7 +185,7 @@ impl Scalar29 {
|
|||
|
||||
/// Compute `a - b` (mod l).
|
||||
pub fn sub(a: &Scalar29, b: &Scalar29) -> Scalar29 {
|
||||
let mut difference = Scalar29::zero();
|
||||
let mut difference = Scalar29::ZERO;
|
||||
let mask = (1u32 << 29) - 1;
|
||||
|
||||
// a - b
|
||||
|
|
@ -198,26 +210,27 @@ impl Scalar29 {
|
|||
///
|
||||
/// This is implemented with a one-level refined Karatsuba decomposition
|
||||
#[inline(always)]
|
||||
#[rustfmt::skip] // keep alignment of z[*] calculations
|
||||
pub (crate) fn mul_internal(a: &Scalar29, b: &Scalar29) -> [u64; 17] {
|
||||
let mut z = [0u64; 17];
|
||||
|
||||
z[0] = m(a[0],b[0]); // c00
|
||||
z[1] = m(a[0],b[1]) + m(a[1],b[0]); // c01
|
||||
z[2] = m(a[0],b[2]) + m(a[1],b[1]) + m(a[2],b[0]); // c02
|
||||
z[3] = m(a[0],b[3]) + m(a[1],b[2]) + m(a[2],b[1]) + m(a[3],b[0]); // c03
|
||||
z[4] = m(a[0],b[4]) + m(a[1],b[3]) + m(a[2],b[2]) + m(a[3],b[1]) + m(a[4],b[0]); // c04
|
||||
z[5] = m(a[1],b[4]) + m(a[2],b[3]) + m(a[3],b[2]) + m(a[4],b[1]); // c05
|
||||
z[6] = m(a[2],b[4]) + m(a[3],b[3]) + m(a[4],b[2]); // c06
|
||||
z[7] = m(a[3],b[4]) + m(a[4],b[3]); // c07
|
||||
z[8] = (m(a[4],b[4])).wrapping_sub(z[3]); // c08 - c03
|
||||
z[0] = m(a[0], b[0]); // c00
|
||||
z[1] = m(a[0], b[1]) + m(a[1], b[0]); // c01
|
||||
z[2] = m(a[0], b[2]) + m(a[1], b[1]) + m(a[2], b[0]); // c02
|
||||
z[3] = m(a[0], b[3]) + m(a[1], b[2]) + m(a[2], b[1]) + m(a[3], b[0]); // c03
|
||||
z[4] = m(a[0], b[4]) + m(a[1], b[3]) + m(a[2], b[2]) + m(a[3], b[1]) + m(a[4], b[0]); // c04
|
||||
z[5] = m(a[1], b[4]) + m(a[2], b[3]) + m(a[3], b[2]) + m(a[4], b[1]); // c05
|
||||
z[6] = m(a[2], b[4]) + m(a[3], b[3]) + m(a[4], b[2]); // c06
|
||||
z[7] = m(a[3], b[4]) + m(a[4], b[3]); // c07
|
||||
z[8] = (m(a[4], b[4])).wrapping_sub(z[3]); // c08 - c03
|
||||
|
||||
z[10] = z[5].wrapping_sub(m(a[5],b[5])); // c05mc10
|
||||
z[11] = z[6].wrapping_sub(m(a[5],b[6]) + m(a[6],b[5])); // c06mc11
|
||||
z[12] = z[7].wrapping_sub(m(a[5],b[7]) + m(a[6],b[6]) + m(a[7],b[5])); // c07mc12
|
||||
z[13] = m(a[5],b[8]) + m(a[6],b[7]) + m(a[7],b[6]) + m(a[8],b[5]); // c13
|
||||
z[14] = m(a[6],b[8]) + m(a[7],b[7]) + m(a[8],b[6]); // c14
|
||||
z[15] = m(a[7],b[8]) + m(a[8],b[7]); // c15
|
||||
z[16] = m(a[8],b[8]); // c16
|
||||
z[10] = z[5].wrapping_sub(m(a[5], b[5])); // c05mc10
|
||||
z[11] = z[6].wrapping_sub(m(a[5], b[6]) + m(a[6], b[5])); // c06mc11
|
||||
z[12] = z[7].wrapping_sub(m(a[5], b[7]) + m(a[6], b[6]) + m(a[7], b[5])); // c07mc12
|
||||
z[13] = m(a[5], b[8]) + m(a[6], b[7]) + m(a[7], b[6]) + m(a[8], b[5]); // c13
|
||||
z[14] = m(a[6], b[8]) + m(a[7], b[7]) + m(a[8], b[6]); // c14
|
||||
z[15] = m(a[7], b[8]) + m(a[8], b[7]); // c15
|
||||
z[16] = m(a[8], b[8]); // c16
|
||||
|
||||
z[ 5] = z[10].wrapping_sub(z[ 0]); // c05mc10 - c00
|
||||
z[ 6] = z[11].wrapping_sub(z[ 1]); // c06mc11 - c01
|
||||
|
|
@ -228,68 +241,70 @@ impl Scalar29 {
|
|||
z[11] = z[16].wrapping_add(z[11]); // c16 + c06mc11
|
||||
|
||||
let aa = [
|
||||
a[0]+a[5],
|
||||
a[1]+a[6],
|
||||
a[2]+a[7],
|
||||
a[3]+a[8]
|
||||
a[0] + a[5],
|
||||
a[1] + a[6],
|
||||
a[2] + a[7],
|
||||
a[3] + a[8]
|
||||
];
|
||||
|
||||
let bb = [
|
||||
b[0]+b[5],
|
||||
b[1]+b[6],
|
||||
b[2]+b[7],
|
||||
b[3]+b[8]
|
||||
b[0] + b[5],
|
||||
b[1] + b[6],
|
||||
b[2] + b[7],
|
||||
b[3] + b[8]
|
||||
];
|
||||
|
||||
z[ 5] = (m(aa[0],bb[0])) .wrapping_add(z[ 5]); // c20 + c05mc10 - c00
|
||||
z[ 6] = (m(aa[0],bb[1]) + m(aa[1],bb[0])) .wrapping_add(z[ 6]); // c21 + c06mc11 - c01
|
||||
z[ 7] = (m(aa[0],bb[2]) + m(aa[1],bb[1]) + m(aa[2],bb[0])) .wrapping_add(z[ 7]); // c22 + c07mc12 - c02
|
||||
z[ 8] = (m(aa[0],bb[3]) + m(aa[1],bb[2]) + m(aa[2],bb[1]) + m(aa[3],bb[0])) .wrapping_add(z[ 8]); // c23 + c08mc13 - c03
|
||||
z[ 9] = (m(aa[0], b[4]) + m(aa[1],bb[3]) + m(aa[2],bb[2]) + m(aa[3],bb[1]) + m(a[4],bb[0])).wrapping_sub(z[ 9]); // c24 - c14 - c04
|
||||
z[10] = ( m(aa[1], b[4]) + m(aa[2],bb[3]) + m(aa[3],bb[2]) + m(a[4],bb[1])).wrapping_sub(z[10]); // c25 - c15 - c05mc10
|
||||
z[11] = ( m(aa[2], b[4]) + m(aa[3],bb[3]) + m(a[4],bb[2])).wrapping_sub(z[11]); // c26 - c16 - c06mc11
|
||||
z[12] = ( m(aa[3], b[4]) + m(a[4],bb[3])).wrapping_sub(z[12]); // c27 - c07mc12
|
||||
z[ 5] = (m(aa[0], bb[0])) .wrapping_add(z[ 5]); // c20 + c05mc10 - c00
|
||||
z[ 6] = (m(aa[0], bb[1]) + m(aa[1], bb[0])) .wrapping_add(z[ 6]); // c21 + c06mc11 - c01
|
||||
z[ 7] = (m(aa[0], bb[2]) + m(aa[1], bb[1]) + m(aa[2], bb[0])) .wrapping_add(z[ 7]); // c22 + c07mc12 - c02
|
||||
z[ 8] = (m(aa[0], bb[3]) + m(aa[1], bb[2]) + m(aa[2], bb[1]) + m(aa[3], bb[0])) .wrapping_add(z[ 8]); // c23 + c08mc13 - c03
|
||||
z[ 9] = (m(aa[0], b[4]) + m(aa[1], bb[3]) + m(aa[2], bb[2]) + m(aa[3], bb[1]) + m(a[4], bb[0])).wrapping_sub(z[ 9]); // c24 - c14 - c04
|
||||
z[10] = ( m(aa[1], b[4]) + m(aa[2], bb[3]) + m(aa[3], bb[2]) + m(a[4], bb[1])).wrapping_sub(z[10]); // c25 - c15 - c05mc10
|
||||
z[11] = ( m(aa[2], b[4]) + m(aa[3], bb[3]) + m(a[4], bb[2])).wrapping_sub(z[11]); // c26 - c16 - c06mc11
|
||||
z[12] = ( m(aa[3], b[4]) + m(a[4], bb[3])).wrapping_sub(z[12]); // c27 - c07mc12
|
||||
|
||||
z
|
||||
}
|
||||
|
||||
/// Compute `a^2`.
|
||||
#[inline(always)]
|
||||
#[rustfmt::skip] // keep alignment of calculations
|
||||
fn square_internal(a: &Scalar29) -> [u64; 17] {
|
||||
let aa = [
|
||||
a[0]*2,
|
||||
a[1]*2,
|
||||
a[2]*2,
|
||||
a[3]*2,
|
||||
a[4]*2,
|
||||
a[5]*2,
|
||||
a[6]*2,
|
||||
a[7]*2
|
||||
a[0] * 2,
|
||||
a[1] * 2,
|
||||
a[2] * 2,
|
||||
a[3] * 2,
|
||||
a[4] * 2,
|
||||
a[5] * 2,
|
||||
a[6] * 2,
|
||||
a[7] * 2
|
||||
];
|
||||
|
||||
[
|
||||
m( a[0],a[0]),
|
||||
m(aa[0],a[1]),
|
||||
m(aa[0],a[2]) + m( a[1],a[1]),
|
||||
m(aa[0],a[3]) + m(aa[1],a[2]),
|
||||
m(aa[0],a[4]) + m(aa[1],a[3]) + m( a[2],a[2]),
|
||||
m(aa[0],a[5]) + m(aa[1],a[4]) + m(aa[2],a[3]),
|
||||
m(aa[0],a[6]) + m(aa[1],a[5]) + m(aa[2],a[4]) + m( a[3],a[3]),
|
||||
m(aa[0],a[7]) + m(aa[1],a[6]) + m(aa[2],a[5]) + m(aa[3],a[4]),
|
||||
m(aa[0],a[8]) + m(aa[1],a[7]) + m(aa[2],a[6]) + m(aa[3],a[5]) + m( a[4],a[4]),
|
||||
m(aa[1],a[8]) + m(aa[2],a[7]) + m(aa[3],a[6]) + m(aa[4],a[5]),
|
||||
m(aa[2],a[8]) + m(aa[3],a[7]) + m(aa[4],a[6]) + m( a[5],a[5]),
|
||||
m(aa[3],a[8]) + m(aa[4],a[7]) + m(aa[5],a[6]),
|
||||
m(aa[4],a[8]) + m(aa[5],a[7]) + m( a[6],a[6]),
|
||||
m(aa[5],a[8]) + m(aa[6],a[7]),
|
||||
m(aa[6],a[8]) + m( a[7],a[7]),
|
||||
m(aa[7],a[8]),
|
||||
m( a[8],a[8]),
|
||||
m( a[0], a[0]),
|
||||
m(aa[0], a[1]),
|
||||
m(aa[0], a[2]) + m( a[1], a[1]),
|
||||
m(aa[0], a[3]) + m(aa[1], a[2]),
|
||||
m(aa[0], a[4]) + m(aa[1], a[3]) + m( a[2], a[2]),
|
||||
m(aa[0], a[5]) + m(aa[1], a[4]) + m(aa[2], a[3]),
|
||||
m(aa[0], a[6]) + m(aa[1], a[5]) + m(aa[2], a[4]) + m( a[3], a[3]),
|
||||
m(aa[0], a[7]) + m(aa[1], a[6]) + m(aa[2], a[5]) + m(aa[3], a[4]),
|
||||
m(aa[0], a[8]) + m(aa[1], a[7]) + m(aa[2], a[6]) + m(aa[3], a[5]) + m( a[4], a[4]),
|
||||
m(aa[1], a[8]) + m(aa[2], a[7]) + m(aa[3], a[6]) + m(aa[4], a[5]),
|
||||
m(aa[2], a[8]) + m(aa[3], a[7]) + m(aa[4], a[6]) + m( a[5], a[5]),
|
||||
m(aa[3], a[8]) + m(aa[4], a[7]) + m(aa[5], a[6]),
|
||||
m(aa[4], a[8]) + m(aa[5], a[7]) + m( a[6], a[6]),
|
||||
m(aa[5], a[8]) + m(aa[6], a[7]),
|
||||
m(aa[6], a[8]) + m( a[7], a[7]),
|
||||
m(aa[7], a[8]),
|
||||
m( a[8], a[8]),
|
||||
]
|
||||
}
|
||||
|
||||
/// Compute `limbs/R` (mod l), where R is the Montgomery modulus 2^261
|
||||
#[inline(always)]
|
||||
#[rustfmt::skip] // keep alignment of part1() and part2() computations
|
||||
pub (crate) fn montgomery_reduce(limbs: &[u64; 17]) -> Scalar29 {
|
||||
|
||||
#[inline(always)]
|
||||
|
|
@ -362,11 +377,12 @@ impl Scalar29 {
|
|||
|
||||
/// Puts a Scalar29 in to Montgomery form, i.e. computes `a*R (mod l)`
|
||||
#[inline(never)]
|
||||
pub fn to_montgomery(&self) -> Scalar29 {
|
||||
pub fn as_montgomery(&self) -> Scalar29 {
|
||||
Scalar29::montgomery_mul(self, &constants::RR)
|
||||
}
|
||||
|
||||
/// Takes a Scalar29 out of Montgomery form, i.e. computes `a/R (mod l)`
|
||||
#[allow(clippy::wrong_self_convention)]
|
||||
pub fn from_montgomery(&self) -> Scalar29 {
|
||||
let mut limbs = [0u64; 17];
|
||||
for i in 0..9 {
|
||||
|
|
@ -376,7 +392,6 @@ impl Scalar29 {
|
|||
}
|
||||
}
|
||||
|
||||
|
||||
#[cfg(test)]
|
||||
mod test {
|
||||
use super::*;
|
||||
|
|
@ -387,65 +402,65 @@ mod test {
|
|||
/// x = 2^253-1 = 14474011154664524427946373126085988481658748083205070504932198000989141204991
|
||||
/// x = 7237005577332262213973186563042994240801631723825162898930247062703686954002 mod l
|
||||
/// x = 5147078182513738803124273553712992179887200054963030844803268920753008712037*R mod l in Montgomery form
|
||||
pub static X: Scalar29 = Scalar29(
|
||||
[0x1fffffff, 0x1fffffff, 0x1fffffff, 0x1fffffff,
|
||||
0x1fffffff, 0x1fffffff, 0x1fffffff, 0x1fffffff,
|
||||
0x001fffff]);
|
||||
pub static X: Scalar29 = Scalar29([
|
||||
0x1fffffff, 0x1fffffff, 0x1fffffff, 0x1fffffff, 0x1fffffff, 0x1fffffff, 0x1fffffff,
|
||||
0x1fffffff, 0x001fffff,
|
||||
]);
|
||||
|
||||
/// x^2 = 3078544782642840487852506753550082162405942681916160040940637093560259278169 mod l
|
||||
pub static XX: Scalar29 = Scalar29(
|
||||
[0x00217559, 0x000b3401, 0x103ff43b, 0x1462a62c,
|
||||
0x1d6f9f38, 0x18e7a42f, 0x09a3dcee, 0x008dbe18,
|
||||
0x0006ce65]);
|
||||
pub static XX: Scalar29 = Scalar29([
|
||||
0x00217559, 0x000b3401, 0x103ff43b, 0x1462a62c, 0x1d6f9f38, 0x18e7a42f, 0x09a3dcee,
|
||||
0x008dbe18, 0x0006ce65,
|
||||
]);
|
||||
|
||||
/// x^2 = 2912514428060642753613814151688322857484807845836623976981729207238463947987*R mod l in Montgomery form
|
||||
pub static XX_MONT: Scalar29 = Scalar29(
|
||||
[0x152b4d2e, 0x0571d53b, 0x1da6d964, 0x188663b6,
|
||||
0x1d1b5f92, 0x19d50e3f, 0x12306c29, 0x0c6f26fe,
|
||||
0x00030edb]);
|
||||
pub static XX_MONT: Scalar29 = Scalar29([
|
||||
0x152b4d2e, 0x0571d53b, 0x1da6d964, 0x188663b6, 0x1d1b5f92, 0x19d50e3f, 0x12306c29,
|
||||
0x0c6f26fe, 0x00030edb,
|
||||
]);
|
||||
|
||||
/// y = 6145104759870991071742105800796537629880401874866217824609283457819451087098
|
||||
pub static Y: Scalar29 = Scalar29(
|
||||
[0x1e1458fa, 0x165ba838, 0x1d787b36, 0x0e577f3a,
|
||||
0x1d2baf06, 0x1d689a19, 0x1fff3047, 0x117704ab,
|
||||
0x000d9601]);
|
||||
pub static Y: Scalar29 = Scalar29([
|
||||
0x1e1458fa, 0x165ba838, 0x1d787b36, 0x0e577f3a, 0x1d2baf06, 0x1d689a19, 0x1fff3047,
|
||||
0x117704ab, 0x000d9601,
|
||||
]);
|
||||
|
||||
/// x*y = 36752150652102274958925982391442301741
|
||||
pub static XY: Scalar29 = Scalar29(
|
||||
[0x0ba7632d, 0x017736bb, 0x15c76138, 0x0c69daa1,
|
||||
0x000001ba, 0x00000000, 0x00000000, 0x00000000,
|
||||
0x00000000]);
|
||||
pub static XY: Scalar29 = Scalar29([
|
||||
0x0ba7632d, 0x017736bb, 0x15c76138, 0x0c69daa1, 0x000001ba, 0x00000000, 0x00000000,
|
||||
0x00000000, 0x00000000,
|
||||
]);
|
||||
|
||||
/// x*y = 3783114862749659543382438697751927473898937741870308063443170013240655651591*R mod l in Montgomery form
|
||||
pub static XY_MONT: Scalar29 = Scalar29(
|
||||
[0x077b51e1, 0x1c64e119, 0x02a19ef5, 0x18d2129e,
|
||||
0x00de0430, 0x045a7bc8, 0x04cfc7c9, 0x1c002681,
|
||||
0x000bdc1c]);
|
||||
pub static XY_MONT: Scalar29 = Scalar29([
|
||||
0x077b51e1, 0x1c64e119, 0x02a19ef5, 0x18d2129e, 0x00de0430, 0x045a7bc8, 0x04cfc7c9,
|
||||
0x1c002681, 0x000bdc1c,
|
||||
]);
|
||||
|
||||
/// a = 2351415481556538453565687241199399922945659411799870114962672658845158063753
|
||||
pub static A: Scalar29 = Scalar29(
|
||||
[0x07b3be89, 0x02291b60, 0x14a99f03, 0x07dc3787,
|
||||
0x0a782aae, 0x16262525, 0x0cfdb93f, 0x13f5718d,
|
||||
0x000532da]);
|
||||
pub static A: Scalar29 = Scalar29([
|
||||
0x07b3be89, 0x02291b60, 0x14a99f03, 0x07dc3787, 0x0a782aae, 0x16262525, 0x0cfdb93f,
|
||||
0x13f5718d, 0x000532da,
|
||||
]);
|
||||
|
||||
/// b = 4885590095775723760407499321843594317911456947580037491039278279440296187236
|
||||
pub static B: Scalar29 = Scalar29(
|
||||
[0x15421564, 0x1e69fd72, 0x093d9692, 0x161785be,
|
||||
0x1587d69f, 0x09d9dada, 0x130246c0, 0x0c0a8e72,
|
||||
0x000acd25]);
|
||||
pub static B: Scalar29 = Scalar29([
|
||||
0x15421564, 0x1e69fd72, 0x093d9692, 0x161785be, 0x1587d69f, 0x09d9dada, 0x130246c0,
|
||||
0x0c0a8e72, 0x000acd25,
|
||||
]);
|
||||
|
||||
/// a+b = 0
|
||||
/// a-b = 4702830963113076907131374482398799845891318823599740229925345317690316127506
|
||||
pub static AB: Scalar29 = Scalar29(
|
||||
[0x0f677d12, 0x045236c0, 0x09533e06, 0x0fb86f0f,
|
||||
0x14f0555c, 0x0c4c4a4a, 0x19fb727f, 0x07eae31a,
|
||||
0x000a65b5]);
|
||||
pub static AB: Scalar29 = Scalar29([
|
||||
0x0f677d12, 0x045236c0, 0x09533e06, 0x0fb86f0f, 0x14f0555c, 0x0c4c4a4a, 0x19fb727f,
|
||||
0x07eae31a, 0x000a65b5,
|
||||
]);
|
||||
|
||||
// c = (2^512 - 1) % l = 1627715501170711445284395025044413883736156588369414752970002579683115011840
|
||||
pub static C: Scalar29 = Scalar29(
|
||||
[0x049c0f00, 0x00308f1a, 0x0164d1e9, 0x1c374ed1,
|
||||
0x1be65d00, 0x19e90bfa, 0x08f73bb1, 0x036f8613,
|
||||
0x00039941]);
|
||||
pub static C: Scalar29 = Scalar29([
|
||||
0x049c0f00, 0x00308f1a, 0x0164d1e9, 0x1c374ed1, 0x1be65d00, 0x19e90bfa, 0x08f73bb1,
|
||||
0x036f8613, 0x00039941,
|
||||
]);
|
||||
|
||||
#[test]
|
||||
fn mul_max() {
|
||||
|
|
@ -498,7 +513,7 @@ mod test {
|
|||
#[test]
|
||||
fn add() {
|
||||
let res = Scalar29::add(&A, &B);
|
||||
let zero = Scalar29::zero();
|
||||
let zero = Scalar29::ZERO;
|
||||
for i in 0..9 {
|
||||
assert!(res[i] == zero[i]);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -475,8 +475,8 @@ impl ProjectivePoint {
|
|||
for (&src, dst) in mcode.iter().zip(job.ucode.iter_mut()) {
|
||||
*dst = src as u32;
|
||||
}
|
||||
copy_to_rf(self.U.to_bytes(), 29, &mut job.rf);
|
||||
copy_to_rf(self.W.to_bytes(), 30, &mut job.rf);
|
||||
copy_to_rf(self.U.as_bytes(), 29, &mut job.rf);
|
||||
copy_to_rf(self.W.as_bytes(), 30, &mut job.rf);
|
||||
|
||||
// start the run
|
||||
let result_rf = engine.spawn_job(job).expect("couldn't run engine job");
|
||||
|
|
@ -564,7 +564,7 @@ fn copy_from_rf(register: usize, rf: &[u32; engine_25519::RF_SIZE_IN_U32]) -> [u
|
|||
|
||||
#[allow(dead_code)] // absorbed into mul, but might be useful later on as a subroutine for something else
|
||||
#[cfg(curve25519_dalek_backend = "u32e_backend")]
|
||||
pub(crate) fn differential_add_and_double_hw(
|
||||
pub(crate) fn differential_add_and_double(
|
||||
P: &mut ProjectivePoint,
|
||||
Q: &mut ProjectivePoint,
|
||||
affine_PmQ: &FieldElement,
|
||||
|
|
@ -670,11 +670,11 @@ pub(crate) fn differential_add_and_double_hw(
|
|||
// Q.U in %22
|
||||
// Q.W in %23
|
||||
// affine_PmQ in %24
|
||||
copy_to_rf(P.U.to_bytes(), 20, &mut job.rf);
|
||||
copy_to_rf(P.W.to_bytes(), 21, &mut job.rf);
|
||||
copy_to_rf(Q.U.to_bytes(), 22, &mut job.rf);
|
||||
copy_to_rf(Q.W.to_bytes(), 23, &mut job.rf);
|
||||
copy_to_rf(affine_PmQ.to_bytes(), 24, &mut job.rf);
|
||||
copy_to_rf(P.U.as_bytes(), 20, &mut job.rf);
|
||||
copy_to_rf(P.W.as_bytes(), 21, &mut job.rf);
|
||||
copy_to_rf(Q.U.as_bytes(), 22, &mut job.rf);
|
||||
copy_to_rf(Q.W.as_bytes(), 23, &mut job.rf);
|
||||
copy_to_rf(affine_PmQ.as_bytes(), 24, &mut job.rf);
|
||||
|
||||
// start the run
|
||||
let result_rf = engine.spawn_job(job).expect("couldn't run engine job");
|
||||
|
|
@ -711,7 +711,7 @@ impl Mul<&Scalar> for &MontgomeryPoint {
|
|||
let mut x0 = ProjectivePoint::identity();
|
||||
let x1 = ProjectivePoint {
|
||||
U: affine_u,
|
||||
W: FieldElement::one(),
|
||||
W: FieldElement::ONE,
|
||||
};
|
||||
|
||||
// for now, prefer to use the fully-accelerated version where this code is local to the server
|
||||
|
|
@ -997,11 +997,11 @@ impl Mul<&Scalar> for &MontgomeryPoint {
|
|||
*dst = src as u32;
|
||||
}
|
||||
|
||||
copy_to_rf(x0.U.to_bytes(), 25, &mut job.rf);
|
||||
copy_to_rf(x0.W.to_bytes(), 26, &mut job.rf);
|
||||
copy_to_rf(x1.U.to_bytes(), 27, &mut job.rf);
|
||||
copy_to_rf(x1.W.to_bytes(), 28, &mut job.rf);
|
||||
copy_to_rf(affine_u.to_bytes(), 24, &mut job.rf);
|
||||
copy_to_rf(x0.U.as_bytes(), 25, &mut job.rf);
|
||||
copy_to_rf(x0.W.as_bytes(), 26, &mut job.rf);
|
||||
copy_to_rf(x1.U.as_bytes(), 27, &mut job.rf);
|
||||
copy_to_rf(x1.W.as_bytes(), 28, &mut job.rf);
|
||||
copy_to_rf(affine_u.as_bytes(), 24, &mut job.rf);
|
||||
copy_to_rf(scalar.bytes, 31, &mut job.rf);
|
||||
// load the number 254 into the loop index register
|
||||
copy_to_rf([
|
||||
|
|
@ -1032,11 +1032,11 @@ impl Mul<&Scalar> for &MontgomeryPoint {
|
|||
} else {
|
||||
let mut engine = engine_25519::Engine25519::new();
|
||||
let job = engine_25519::MontgomeryJob {
|
||||
x0_u: x0.U.to_bytes(),
|
||||
x0_w: x0.W.to_bytes(),
|
||||
x1_u: x1.U.to_bytes(),
|
||||
x1_w: x1.W.to_bytes(),
|
||||
affine_u: affine_u.to_bytes(),
|
||||
x0_u: x0.U.as_bytes(),
|
||||
x0_w: x0.W.as_bytes(),
|
||||
x1_u: x1.U.as_bytes(),
|
||||
x1_w: x1.W.as_bytes(),
|
||||
affine_u: affine_u.as_bytes(),
|
||||
scalar: scalar.bytes,
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -157,8 +157,6 @@ cfg_if! {
|
|||
///
|
||||
/// This is a type alias for one of the scalar types in the `backend`
|
||||
/// module.
|
||||
//TODO: this should be the same as the u32 backend such that we don't even need to have
|
||||
//backend/serial/scalar.rs defined. Double check that to simplify the code.
|
||||
type UnpackedScalar = backend::serial::u32e::scalar::Scalar29;
|
||||
}
|
||||
else if #[cfg(curve25519_dalek_backend = "fiat")] {
|
||||
|
|
|
|||
Loading…
Reference in a new issue