Restructure source tree into serial and vector backends.

This begins to attempt to restructure the source tree so that the common parts
are common and the different parts are different.

The backend is now split into two parts:
- serial (containing the implementation using serial formulas and mixed-model arithmetic).
- vector (containing the implementation using parallel formulas and single-model arithmetic).

The serial scalar_mul tree is now under backend::serial::scalar_mul.
The avx2 scalar_mul tree is now under backend::avx2::scalar_mul.

build.rs

@@ -53,18 +53,16 @@ mod traits;
 
 #[path = "src/field.rs"]
 mod field;
-#[path = "src/curve_models/mod.rs"]
-mod curve_models;
 #[path = "src/backend/mod.rs"]
 mod backend;
 #[path = "src/prelude.rs"]
 mod prelude;
-#[path = "src/scalar_mul/mod.rs"]
-mod scalar_mul;
+#[path = "src/window.rs"]
+mod window;
 
 use edwards::EdwardsBasepointTable;
-use curve_models::AffineNielsPoint;
-use scalar_mul::window::NafLookupTable8;
+use backend::serial::curve_models::AffineNielsPoint;
+use window::NafLookupTable8;
 
 fn main() {
     // Enable the "stage2_build" feature in the main build stage
@@ -81,17 +79,17 @@ fn main() {
         format!(
             "\n
 #[cfg(feature = \"u32_backend\")]
-use backend::u32::field::FieldElement2625;
+use backend::serial::u32::field::FieldElement2625;
 
 #[cfg(feature = \"u64_backend\")]
-use backend::u64::field::FieldElement51;
+use backend::serial::u64::field::FieldElement51;
 
 use edwards::EdwardsBasepointTable;
 
-use curve_models::AffineNielsPoint;
+use backend::serial::curve_models::AffineNielsPoint;
 
-use scalar_mul::window::LookupTable;
-use scalar_mul::window::NafLookupTable8;
+use window::LookupTable;
+use window::NafLookupTable8;
 
 /// Table containing precomputed multiples of the Ed25519 basepoint \\\\(B = (x, 4/5)\\\\).
 pub const ED25519_BASEPOINT_TABLE: EdwardsBasepointTable = ED25519_BASEPOINT_TABLE_INNER_DOC_HIDDEN;

src/backend/mod.rs

@@ -27,12 +27,7 @@ compile_error!(
      please enable one of: u32_backend, u64_backend, avx2_backend"
 );
 
-#[cfg(feature = "u32_backend")]
-pub mod u32;
-
-#[cfg(feature = "u64_backend")]
-pub mod u64;
+pub mod serial;
 
 #[cfg(all(feature = "avx2_backend", target_feature = "avx2"))]
-pub mod avx2;
-
+pub mod vector;

src/backend/serial/mod.rs

@@ -0,0 +1,39 @@
+// -*- mode: rust; -*-
+//
+// This file is part of curve25519-dalek.
+// Copyright (c) 2016-2018 Isis Lovecruft, Henry de Valence
+// See LICENSE for licensing information.
+//
+// Authors:
+// - Isis Agora Lovecruft <isis@patternsinthevoid.net>
+// - Henry de Valence <hdevalence@hdevalence.ca>
+
+//! Pluggable implementations for different architectures.
+//!
+//! The naming of the `u32` and `u64` modules is somewhat unfortunate,
+//! since these are also the names of primitive types.  Since types have
+//! a different namespace than modules, this isn't a problem to the
+//! compiler, but it could cause confusion.
+//!
+//! However, it's unlikely that the names of those modules would be
+//! brought into scope directly, instead of used as
+//! `backend::u32::field` or similar.  Unfortunately we can't use
+//! `32bit` since identifiers can't start with letters, and the backends
+//! do use `u32`/`u64`, so this seems like a least-bad option.
+
+#[cfg(not(any(feature = "u32_backend", feature = "u64_backend")))]
+compile_error!(
+    "no curve25519-dalek backend cargo feature enabled! \
+     please enable one of: u32_backend, u64_backend"
+);
+
+#[cfg(feature = "u32_backend")]
+pub mod u32;
+
+#[cfg(feature = "u64_backend")]
+pub mod u64;
+
+pub mod curve_models;
+
+pub mod scalar_mul;
+

src/backend/serial/scalar_mul/mod.rs

@@ -16,8 +16,6 @@
 //! scalar multiplication implementations, since it only uses one
 //! curve model.
 
-pub mod window;
-
 pub mod variable_base;
 
 #[cfg(feature = "stage2_build")]

src/backend/serial/scalar_mul/straus.rs

@@ -115,8 +115,8 @@ impl MultiscalarMul for Straus {
     {
         use clear_on_drop::ClearOnDrop;
 
-        use curve_models::ProjectiveNielsPoint;
-        use scalar_mul::window::LookupTable;
+        use backend::serial::curve_models::ProjectiveNielsPoint;
+        use window::LookupTable;
         use traits::Identity;
 
         let lookup_tables: Vec<_> = points
@@ -167,8 +167,8 @@ impl VartimeMultiscalarMul for Straus {
         I::Item: Borrow<Scalar>,
         J: IntoIterator<Item = Option<EdwardsPoint>>,
     {
-        use curve_models::{CompletedPoint, ProjectiveNielsPoint, ProjectivePoint};
-        use scalar_mul::window::NafLookupTable5;
+        use backend::serial::curve_models::{CompletedPoint, ProjectiveNielsPoint, ProjectivePoint};
+        use window::NafLookupTable5;
         use traits::Identity;
 
         let nafs: Vec<_> = scalars

src/backend/serial/scalar_mul/variable_base.rs

@@ -3,8 +3,8 @@
 use traits::Identity;
 use scalar::Scalar;
 use edwards::EdwardsPoint;
-use curve_models::ProjectiveNielsPoint;
-use scalar_mul::window::LookupTable;
+use backend::serial::curve_models::ProjectiveNielsPoint;
+use window::LookupTable;
 
 /// Perform constant-time, variable-base scalar multiplication.
 pub(crate) fn mul(point: &EdwardsPoint, scalar: &Scalar) -> EdwardsPoint {

src/backend/serial/scalar_mul/vartime_double_base.rs

@@ -13,8 +13,8 @@ use constants;
 use traits::Identity;
 use scalar::Scalar;
 use edwards::EdwardsPoint;
-use curve_models::{ProjectiveNielsPoint, ProjectivePoint};
-use scalar_mul::window::NafLookupTable5;
+use backend::serial::curve_models::{ProjectiveNielsPoint, ProjectivePoint};
+use window::NafLookupTable5;
 
 /// Compute \\(aA + bB\\) in variable time, where \\(B\\) is the Ed25519 basepoint.
 pub fn mul(a: &Scalar, A: &EdwardsPoint, b: &Scalar) -> EdwardsPoint {

src/backend/serial/u32/constants.rs

@@ -12,8 +12,8 @@
 //! and useful field elements like `sqrt(-1)`), as well as
 //! lookup tables of pre-computed points.
 
-use backend::u32::field::FieldElement2625;
-use backend::u32::scalar::Scalar29;
+use backend::serial::u32::field::FieldElement2625;
+use backend::serial::u32::scalar::Scalar29;
 use edwards::EdwardsPoint;
 
 /// Edwards `d` value, equal to `-121665/121666 mod p`.

src/backend/serial/u64/constants.rs

@@ -10,8 +10,8 @@
 
 //! This module contains backend-specific constant values, such as the 64-bit limbs of curve constants.
 
-use backend::u64::field::FieldElement51;
-use backend::u64::scalar::Scalar52;
+use backend::serial::u64::field::FieldElement51;
+use backend::serial::u64::scalar::Scalar52;
 use edwards::EdwardsPoint;
 
 /// Edwards `d` value, equal to `-121665/121666 mod p`.

src/backend/vector/avx2/constants.rs

@@ -12,9 +12,9 @@
 
 use packed_simd::u32x8;
 
-use backend::avx2::edwards::{CachedPoint, ExtendedPoint};
-use backend::avx2::field::FieldElement2625x4;
-use scalar_mul::window::NafLookupTable8;
+use backend::vector::avx2::edwards::{CachedPoint, ExtendedPoint};
+use backend::vector::avx2::field::FieldElement2625x4;
+use window::NafLookupTable8;
 
 /// The identity element as an `ExtendedPoint`.
 pub(crate) static EXTENDEDPOINT_IDENTITY: ExtendedPoint = ExtendedPoint(FieldElement2625x4([

src/backend/vector/avx2/edwards.rs

@@ -41,12 +41,12 @@ use subtle::Choice;
 use subtle::ConditionallySelectable;
 
 use edwards;
-use scalar_mul::window::{LookupTable, NafLookupTable5, NafLookupTable8};
+use window::{LookupTable, NafLookupTable5, NafLookupTable8};
 
 use traits::Identity;
 
-use backend::avx2::field::{FieldElement2625x4, Lanes, Shuffle};
-use backend::avx2::constants;
+use super::constants;
+use super::field::{FieldElement2625x4, Lanes, Shuffle};
 
 /// A point on Curve25519, using parallel Edwards formulas for curve
 /// operations.
@@ -190,7 +190,7 @@ impl From<ExtendedPoint> for CachedPoint {
         x = x.blend(x.diff_sum(), Lanes::AB);
         // x = (X1 - Y1, X2 + Y2, Z2, T2) = (S2 S3 Z2 T2)
 
-        x = x * (121666, 121666, 2*121666, 2*121665);
+        x = x * (121666, 121666, 2 * 121666, 2 * 121665);
         // x = (121666*S2 121666*S3 2*121666*Z2 2*121665*T2)
 
         x = x.blend(-x, Lanes::D);
@@ -247,7 +247,7 @@ impl<'a, 'b> Add<&'b CachedPoint> for &'a ExtendedPoint {
         // coefficients grow by one bit.  So on input, `self` is
         // bounded with `b < 0.007` and `other` is bounded with
         // `b < 1.0`.
-        
+
         let mut tmp = self.0;
 
         tmp = tmp.blend(tmp.diff_sum(), Lanes::AB);
@@ -329,7 +329,7 @@ mod test {
     use super::*;
 
     fn serial_add(P: edwards::EdwardsPoint, Q: edwards::EdwardsPoint) -> edwards::EdwardsPoint {
-        use backend::u64::field::FieldElement51;
+        use backend::serial::u64::field::FieldElement51;
 
         let (X1, Y1, Z1, T1) = (P.X, P.Y, P.Z, P.T);
         let (X2, Y2, Z2, T2) = (Q.X, Q.Y, Q.Z, Q.T);

src/backend/vector/avx2/field.rs

@@ -42,8 +42,8 @@ const D_LANES64: u8 = 0b11_00_00_00;
 use core::ops::{Add, Mul, Neg};
 use packed_simd::{i32x8, u32x8, u64x4, IntoBits};
 
-use backend::avx2::constants::{P_TIMES_16_HI, P_TIMES_16_LO, P_TIMES_2_HI, P_TIMES_2_LO};
-use backend::u64::field::FieldElement51;
+use backend::vector::avx2::constants::{P_TIMES_16_HI, P_TIMES_16_LO, P_TIMES_2_HI, P_TIMES_2_LO};
+use backend::serial::u64::field::FieldElement51;
 
 /// Unpack 32-bit lanes into 64-bit lanes:
 /// ```

src/backend/vector/avx2/mod.rs

@@ -27,4 +27,3 @@ pub(crate) mod edwards;
 
 pub(crate) mod constants;
 
-pub(crate) mod scalar_mul;

src/backend/vector/mod.rs

@@ -0,0 +1,32 @@
+// -*- mode: rust; -*-
+//
+// This file is part of curve25519-dalek.
+// Copyright (c) 2016-2018 Isis Lovecruft, Henry de Valence
+// See LICENSE for licensing information.
+//
+// Authors:
+// - Isis Agora Lovecruft <isis@patternsinthevoid.net>
+// - Henry de Valence <hdevalence@hdevalence.ca>
+
+//! Pluggable implementations for different architectures.
+//!
+//! The naming of the `u32` and `u64` modules is somewhat unfortunate,
+//! since these are also the names of primitive types.  Since types have
+//! a different namespace than modules, this isn't a problem to the
+//! compiler, but it could cause confusion.
+//!
+//! However, it's unlikely that the names of those modules would be
+//! brought into scope directly, instead of used as
+//! `backend::u32::field` or similar.  Unfortunately we can't use
+//! `32bit` since identifiers can't start with letters, and the backends
+//! do use `u32`/`u64`, so this seems like a least-bad option.
+
+#[cfg(all(feature = "avx2_backend", target_feature = "avx2"))]
+pub mod avx2;
+#[cfg(all(feature = "avx2_backend", target_feature = "avx2"))]
+pub(crate) use self::avx2::{
+    constants::BASEPOINT_ODD_LOOKUP_TABLE, edwards::CachedPoint, edwards::ExtendedPoint,
+};
+
+pub mod scalar_mul;
+

src/backend/vector/scalar_mul/straus.rs

@@ -14,10 +14,10 @@ use core::borrow::Borrow;
 
 use clear_on_drop::ClearOnDrop;
 
-use backend::avx2::edwards::{CachedPoint, ExtendedPoint};
+use backend::vector::{CachedPoint, ExtendedPoint};
 use edwards::EdwardsPoint;
 use scalar::Scalar;
-use scalar_mul::window::{LookupTable, NafLookupTable5};
+use window::{LookupTable, NafLookupTable5};
 use traits::{Identity, MultiscalarMul, VartimeMultiscalarMul};
 
 #[allow(unused_imports)]

src/backend/vector/scalar_mul/variable_base.rs

@@ -1,10 +1,10 @@
 #![allow(non_snake_case)]
 
-use traits::Identity;
-use scalar::Scalar;
+use backend::vector::{CachedPoint, ExtendedPoint};
 use edwards::EdwardsPoint;
-use backend::avx2::edwards::{ExtendedPoint, CachedPoint};
-use scalar_mul::window::LookupTable;
+use scalar::Scalar;
+use traits::Identity;
+use window::LookupTable;
 
 /// Perform constant-time, variable-base scalar multiplication.
 pub fn mul(point: &EdwardsPoint, scalar: &Scalar) -> EdwardsPoint {

src/backend/vector/scalar_mul/vartime_double_base.rs

@@ -9,12 +9,12 @@
 // - Henry de Valence <hdevalence@hdevalence.ca>
 #![allow(non_snake_case)]
 
-use traits::Identity;
-use scalar::Scalar;
+use backend::vector::BASEPOINT_ODD_LOOKUP_TABLE;
+use backend::vector::{CachedPoint, ExtendedPoint};
 use edwards::EdwardsPoint;
-use scalar_mul::window::NafLookupTable5;
-use backend::avx2::edwards::{CachedPoint, ExtendedPoint};
-use backend::avx2::constants::BASEPOINT_ODD_LOOKUP_TABLE;
+use scalar::Scalar;
+use traits::Identity;
+use window::NafLookupTable5;
 
 /// Compute \\(aA + bB\\) in variable time, where \\(B\\) is the Ed25519 basepoint.
 pub fn mul(a: &Scalar, A: &EdwardsPoint, b: &Scalar) -> EdwardsPoint {

src/constants.rs

@@ -34,9 +34,9 @@ use montgomery::MontgomeryPoint;
 use scalar::Scalar;
 
 #[cfg(feature = "u64_backend")]
-pub use backend::u64::constants::*;
+pub use backend::serial::u64::constants::*;
 #[cfg(feature = "u32_backend")]
-pub use backend::u32::constants::*;
+pub use backend::serial::u32::constants::*;
 
 /// The Ed25519 basepoint, in `CompressedEdwardsY` format.
 ///
@@ -151,7 +151,7 @@ mod test {
     #[test]
     #[cfg(feature = "u32_backend")]
     fn test_d_vs_ratio() {
-        use backend::u32::field::FieldElement2625;
+        use backend::serial::u32::field::FieldElement2625;
         let a = -&FieldElement2625([121665,0,0,0,0,0,0,0,0,0]);
         let b =   FieldElement2625([121666,0,0,0,0,0,0,0,0,0]);
         let d = &a * &b.invert();
@@ -164,7 +164,7 @@ mod test {
     #[test]
     #[cfg(feature = "u64_backend")]
     fn test_d_vs_ratio() {
-        use backend::u64::field::FieldElement51;
+        use backend::serial::u64::field::FieldElement51;
         let a = -&FieldElement51([121665,0,0,0,0]);
         let b =   FieldElement51([121666,0,0,0,0]);
         let d = &a * &b.invert();

src/edwards.rs

@@ -112,16 +112,16 @@ use scalar::Scalar;
 
 use montgomery::MontgomeryPoint;
 
-use curve_models::ProjectivePoint;
-use curve_models::CompletedPoint;
-use curve_models::AffineNielsPoint;
-use curve_models::ProjectiveNielsPoint;
+use backend::serial::curve_models::ProjectivePoint;
+use backend::serial::curve_models::CompletedPoint;
+use backend::serial::curve_models::AffineNielsPoint;
+use backend::serial::curve_models::ProjectiveNielsPoint;
+
+use window::LookupTable;
 
 #[allow(unused_imports)]
 use prelude::*;
 
-use scalar_mul::window::LookupTable;
-
 use traits::{Identity, IsIdentity};
 use traits::ValidityCheck;
 
@@ -575,13 +575,13 @@ impl<'a, 'b> Mul<&'b Scalar> for &'a EdwardsPoint {
         // If we built with AVX2, use the AVX2 backend.
         #[cfg(all(feature="avx2_backend", target_feature="avx2"))]
         {
-            use backend::avx2::scalar_mul::variable_base::mul;
+            use backend::vector::scalar_mul::variable_base::mul;
             mul(self, scalar)
         }
         // Otherwise, use the serial backend:
         #[cfg(not(all(feature="avx2_backend", target_feature="avx2")))]
         {
-            use scalar_mul::variable_base::mul;
+            use backend::serial::scalar_mul::variable_base::mul;
             mul(self, scalar)
         }
     }
@@ -636,10 +636,10 @@ impl MultiscalarMul for EdwardsPoint {
 
         // If we built with AVX2, use the AVX2 backend.
         #[cfg(all(feature="avx2_backend", target_feature="avx2"))]
-        use backend::avx2::scalar_mul::straus::Straus;
+        use backend::vector::scalar_mul::straus::Straus;
         // Otherwise, proceed as normal:
         #[cfg(not(all(feature="avx2_backend", target_feature="avx2")))]
-        use scalar_mul::straus::Straus;
+        use backend::serial::scalar_mul::straus::Straus;
 
         Straus::multiscalar_mul(scalars, points)
     }
@@ -674,10 +674,10 @@ impl VartimeMultiscalarMul for EdwardsPoint {
 
         // If we built with AVX2, use the AVX2 backend.
         #[cfg(all(feature="avx2_backend", target_feature="avx2"))]
-        use backend::avx2::scalar_mul::straus::Straus;
+        use backend::vector::scalar_mul::straus::Straus;
         // Otherwise, proceed as normal:
         #[cfg(not(all(feature="avx2_backend", target_feature="avx2")))]
-        use scalar_mul::straus::Straus;
+        use backend::serial::scalar_mul::straus::Straus;
 
         Straus::optional_multiscalar_mul(scalars, points)
     }
@@ -689,10 +689,10 @@ impl EdwardsPoint {
     pub fn vartime_double_scalar_mul_basepoint(a: &Scalar, A: &EdwardsPoint, b: &Scalar) -> EdwardsPoint {
         // If we built with AVX2, use the AVX2 backend.
         #[cfg(all(feature="avx2_backend", target_feature="avx2"))]
-        use backend::avx2::scalar_mul::vartime_double_base;
+        use backend::vector::scalar_mul::vartime_double_base;
         // Otherwise, use the serial backend:
         #[cfg(not(all(feature="avx2_backend", target_feature="avx2")))]
-        use scalar_mul::vartime_double_base;
+        use backend::serial::scalar_mul::vartime_double_base;
 
         vartime_double_base::mul(a, A, b)
     }

src/field.rs

@@ -33,24 +33,24 @@ use constants;
 use backend;
 
 #[cfg(feature = "u64_backend")]
-pub use backend::u64::field::*;
+pub use backend::serial::u64::field::*;
 /// A `FieldElement` represents an element of the field
 /// \\( \mathbb Z / (2\^{255} - 19)\\).
 ///
 /// The `FieldElement` type is an alias for one of the platform-specific
 /// implementations.
 #[cfg(feature = "u64_backend")]
-pub type FieldElement = backend::u64::field::FieldElement51;
+pub type FieldElement = backend::serial::u64::field::FieldElement51;
 
 #[cfg(feature = "u32_backend")]
-pub use backend::u32::field::*;
+pub use backend::serial::u32::field::*;
 /// A `FieldElement` represents an element of the field
 /// \\( \mathbb Z / (2\^{255} - 19)\\).
 ///
 /// The `FieldElement` type is an alias for one of the platform-specific
 /// implementations.
 #[cfg(feature = "u32_backend")]
-pub type FieldElement = backend::u32::field::FieldElement2625;
+pub type FieldElement = backend::serial::u32::field::FieldElement2625;
 
 impl Eq for FieldElement {}
 

src/lib.rs

@@ -90,11 +90,9 @@ pub(crate) mod field;
 // Arithmetic backends (using u32, u64, etc) live here
 pub(crate) mod backend;
 
-// Internal curve models which are not part of the public API.
-pub(crate) mod curve_models;
-
 // Crate-local prelude (for alloc-dependent features like `Vec`)
 pub(crate) mod prelude;
 
-// Implementations of scalar mul algorithms live here
-pub(crate) mod scalar_mul;
+// Generic code for window lookups
+pub(crate) mod window;
+

src/ristretto.rs

@@ -185,8 +185,6 @@ use prelude::*;
 
 use scalar::Scalar;
 
-use curve_models::CompletedPoint;
-
 use traits::Identity;
 #[cfg(any(feature = "alloc", feature = "std"))]
 use traits::{MultiscalarMul, VartimeMultiscalarMul};
@@ -596,6 +594,8 @@ impl RistrettoPoint {
         let N_t = &(&(&c * &(&r - &one)) * &d_minus_one_sq) - &D;
         let s_sq = s.square();
 
+        use backend::serial::curve_models::CompletedPoint;
+
         // The conversion from W_i is exactly the conversion from P1xP1.
         RistrettoPoint(CompletedPoint{
             X: &(&s + &s) * &D,

src/scalar.rs

@@ -168,14 +168,14 @@ use constants;
 /// This is a type alias for one of the scalar types in the `backend`
 /// module.
 #[cfg(feature = "u64_backend")]
-type UnpackedScalar = backend::u64::scalar::Scalar52;
+type UnpackedScalar = backend::serial::u64::scalar::Scalar52;
 
 /// An `UnpackedScalar` represents an element of the field GF(l), optimized for speed.
 ///
 /// This is a type alias for one of the scalar types in the `backend`
 /// module.
 #[cfg(feature = "u32_backend")]
-type UnpackedScalar = backend::u32::scalar::Scalar29;
+type UnpackedScalar = backend::serial::u32::scalar::Scalar29;
 
 
 /// The `Scalar` struct holds an integer \\(s < 2\^{255} \\) which

src/window.rs

@@ -22,8 +22,8 @@ use subtle::Choice;
 use traits::Identity;
 
 use edwards::EdwardsPoint;
-use curve_models::ProjectiveNielsPoint;
-use curve_models::AffineNielsPoint;
+use backend::serial::curve_models::ProjectiveNielsPoint;
+use backend::serial::curve_models::AffineNielsPoint;
 
 /// A lookup table of precomputed multiples of a point \\(P\\), used to
 /// compute \\( xP \\) for \\( -8 \leq x \leq 8 \\).