7 curve25519_mul(r->
x, p->
x, p->
t);
8 curve25519_mul(r->
y, p->
y, p->
z);
9 curve25519_mul(r->
z, p->
z, p->
t);
14 curve25519_mul(r->
x, p->
x, p->
t);
15 curve25519_mul(r->
y, p->
y, p->
z);
16 curve25519_mul(r->
z, p->
z, p->
t);
17 curve25519_mul(r->
t, p->
x, p->
y);
22 curve25519_sub(p->
ysubx, r->
y, r->
x);
23 curve25519_add(p->
xaddy, r->
y, r->
x);
24 curve25519_copy(p->
z, r->
z);
25 curve25519_mul(p->
t2d, r->
t, ge25519_ec2d);
36 curve25519_sub(
a, p->
y, p->
x);
37 curve25519_add(b, p->
y, p->
x);
38 curve25519_sub(t, q->
y, q->
x);
39 curve25519_add(u, q->
y, q->
x);
40 curve25519_mul(
a,
a, t);
41 curve25519_mul(b, b, u);
42 curve25519_mul(c, p->
t, q->
t);
43 curve25519_mul(c, c, ge25519_ec2d);
44 curve25519_mul(d, p->
z, q->
z);
45 curve25519_add(d, d, d);
46 curve25519_sub(r->
x, b,
a);
47 curve25519_add(r->
y, b,
a);
49 curve25519_sub_after_basic(r->
t, d, c);
60 curve25519_add_reduce(c, c, c);
61 curve25519_add(r->
x, p->
x, p->
y);
63 curve25519_add(r->
y, b,
a);
64 curve25519_sub(r->
z, b,
a);
65 curve25519_sub_after_basic(r->
x, r->
x, r->
y);
66 curve25519_sub_after_basic(r->
t, c, r->
z);
75 curve25519_sub(
a, p->
y, p->
x);
76 curve25519_add(b, p->
y, p->
x);
77 curve25519_mul(
a,
a, qb[signbit]);
78 curve25519_mul(r->
x, b, qb[signbit^1]);
79 curve25519_add(r->
y, r->
x,
a);
80 curve25519_sub(r->
x, r->
x,
a);
81 curve25519_mul(c, p->
t, q->
t2d);
82 curve25519_add_reduce(r->
t, p->
z, p->
z);
83 curve25519_copy(r->
z, r->
t);
84 curve25519_add(rb[2+signbit], rb[2+signbit], c);
85 curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c);
94 curve25519_sub(
a, p->
y, p->
x);
95 curve25519_add(b, p->
y, p->
x);
96 curve25519_mul(
a,
a, qb[signbit]);
97 curve25519_mul(r->
x, b, qb[signbit^1]);
98 curve25519_add(r->
y, r->
x,
a);
99 curve25519_sub(r->
x, r->
x,
a);
100 curve25519_mul(c, p->
t, q->
t2d);
101 curve25519_mul(r->
t, p->
z, q->
z);
102 curve25519_add_reduce(r->
t, r->
t, r->
t);
103 curve25519_copy(r->
z, r->
t);
104 curve25519_add(rb[2+signbit], rb[2+signbit], c);
105 curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c);
111 ge25519_double_p1p1(&t, p);
112 ge25519_p1p1_to_partial(r, &t);
118 ge25519_double_p1p1(&t, p);
119 ge25519_p1p1_to_full(r, &t);
125 ge25519_add_p1p1(&t, p, q);
126 ge25519_p1p1_to_full(r, &t);
133 curve25519_sub(
a, r->
y, r->
x);
134 curve25519_add(b, r->
y, r->
x);
135 curve25519_mul(
a,
a, q->
ysubx);
136 curve25519_mul(e, b, q->
xaddy);
137 curve25519_add(h, e,
a);
138 curve25519_sub(e, e,
a);
139 curve25519_mul(c, r->
t, q->
t2d);
140 curve25519_add(f, r->
z, r->
z);
142 curve25519_sub_after_basic(f, f, c);
143 curve25519_mul(r->
x, e, f);
144 curve25519_mul(r->
y, h, g);
145 curve25519_mul(r->
z, g, f);
146 curve25519_mul(r->
t, e, h);
153 curve25519_sub(
a, p->
y, p->
x);
154 curve25519_add(b, p->
y, p->
x);
155 curve25519_mul(
a,
a, q->
ysubx);
156 curve25519_mul(x, b, q->
xaddy);
157 curve25519_add(y, x,
a);
158 curve25519_sub(x, x,
a);
159 curve25519_mul(c, p->
t, q->
t2d);
160 curve25519_mul(t, p->
z, q->
z);
161 curve25519_add(t, t, t);
163 curve25519_sub_after_basic(t, t, c);
164 curve25519_mul(r->
xaddy, x, t);
165 curve25519_mul(r->
ysubx, y, z);
166 curve25519_mul(r->
z, z, t);
167 curve25519_mul(r->
t2d, x, y);
168 curve25519_copy(y, r->
ysubx);
171 curve25519_mul(r->
t2d, r->
t2d, ge25519_ec2d);
180 ge25519_pack(
unsigned char r[32],
const ge25519 *p) {
182 unsigned char parity[32];
183 curve25519_recip(zi, p->
z);
184 curve25519_mul(tx, p->
x, zi);
185 curve25519_mul(ty, p->
y, zi);
186 curve25519_contract(r, ty);
187 curve25519_contract(parity, tx);
188 r[31] ^= ((parity[0] & 1) << 7);
192 ge25519_unpack_negative_vartime(
ge25519 *r,
const unsigned char p[32]) {
193 static const unsigned char zero[32] = {0};
195 unsigned char parity = p[31] >> 7;
196 unsigned char check[32];
199 curve25519_expand(r->
y, p);
200 curve25519_copy(r->
z, one);
202 curve25519_mul(den, num, ge25519_ecd);
203 curve25519_sub_reduce(num, num, r->
z);
204 curve25519_add(den, den, r->
z);
209 curve25519_mul(d3, t, den);
211 curve25519_mul(r->
x, r->
x, den);
212 curve25519_mul(r->
x, r->
x, num);
213 curve25519_pow_two252m3(r->
x, r->
x);
216 curve25519_mul(r->
x, r->
x, d3);
217 curve25519_mul(r->
x, r->
x, num);
221 curve25519_mul(t, t, den);
222 curve25519_sub_reduce(root, t, num);
223 curve25519_contract(check, root);
224 if (!ed25519_verify(check,
zero, 32)) {
225 curve25519_add_reduce(t, t, num);
226 curve25519_contract(check, t);
227 if (!ed25519_verify(check,
zero, 32))
229 curve25519_mul(r->
x, r->
x, ge25519_sqrtneg1);
232 curve25519_contract(check, r->
x);
233 if ((check[0] & 1) == parity) {
234 curve25519_copy(t, r->
x);
235 curve25519_neg(r->
x, t);
237 curve25519_mul(r->
t, r->
x, r->
y);
246 #define S1_SWINDOWSIZE 5 247 #define S1_TABLE_SIZE (1<<(S1_SWINDOWSIZE-2)) 248 #define S2_SWINDOWSIZE 7 249 #define S2_TABLE_SIZE (1<<(S2_SWINDOWSIZE-2)) 254 signed char slide1[256], slide2[256];
263 ge25519_double(&d1, p1);
264 ge25519_full_to_pniels(pre1, p1);
266 ge25519_pnielsadd(&pre1[i+1], &d1, &pre1[i]);
274 while ((i >= 0) && !(slide1[i] | slide2[i]))
277 for (; i >= 0; i--) {
278 ge25519_double_p1p1(&t, r);
281 ge25519_p1p1_to_full(r, &t);
282 ge25519_pnielsadd_p1p1(&t, r, &pre1[abs(slide1[i]) / 2], (
unsigned char)slide1[i] >> 7);
286 ge25519_p1p1_to_full(r, &t);
287 ge25519_nielsadd2_p1p1(&t, r, &ge25519_niels_sliding_multiples[abs(slide2[i]) / 2], (
unsigned char)slide2[i] >> 7);
290 ge25519_p1p1_to_partial(r, &t);
296 #if !defined(HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS) 300 return ((b ^ c) - 1) >> 31;
316 for (i = 0; i < 8; i++)
317 curve25519_move_conditional_bytes(packed,
table[(pos * 8) + i], ge25519_windowb_equal(u, i + 1));
320 curve25519_expand(t->
ysubx, packed + 0);
321 curve25519_expand(t->
xaddy, packed + 32);
322 curve25519_expand(t->
t2d , packed + 64);
325 curve25519_swap_conditional(t->
ysubx, t->
xaddy, sign);
326 curve25519_neg(neg, t->
t2d);
327 curve25519_swap_conditional(t->
t2d, neg, sign);
340 contract256_window4_modm(b, s);
342 ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[1]);
346 curve25519_copy(r->
t, t.
t2d);
348 for (i = 3; i < 64; i += 2) {
349 ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
350 ge25519_nielsadd2(r, &t);
352 ge25519_double_partial(r, r);
353 ge25519_double_partial(r, r);
354 ge25519_double_partial(r, r);
355 ge25519_double(r, r);
356 ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[0]);
357 curve25519_mul(t.
t2d, t.
t2d, ge25519_ecd);
358 ge25519_nielsadd2(r, &t);
359 for(i = 2; i < 64; i += 2) {
360 ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
361 ge25519_nielsadd2(r, &t);
std::vector< std::vector< _variant_t > > table
#define curve25519_square(r, n)
#define curve25519_add_after_basic
const GenericPointer< typename T::ValueType > T2 T::AllocatorType & a
bignum256modm_element_t bignum256modm[9]