diff --git a/fiat_scalar.go b/fiat_scalar.go deleted file mode 100644 index 82c36bc..0000000 --- a/fiat_scalar.go +++ /dev/null @@ -1,1729 +0,0 @@ -// Autogenerated: './src/ExtractionOCaml/word_by_word_montgomery' --lang Go --cmovznz-by-mul sc255 64 '2^252 + 27742317777372353535851937790883648493' -// -// curve description: sc255 -// -// machine_wordsize = 64 (from "64") -// -// requested operations: (all) -// -// m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493") -// -// -// -// NOTE: In addition to the bounds specified above each function, all -// -// functions synthesized for this Montgomery arithmetic require the -// -// input to be strictly less than the prime modulus (m), and also -// -// require the input to be in the unique saturated representation. -// -// All functions also ensure that these two properties are true of -// -// return values. -// -// -// -// Computed values: -// -// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) -// -// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) -// -// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in -// -// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 -package edwards25519 - -import "math/bits" - -type fiat_sc255_uint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 -type fiat_sc255_int1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 - -// The type fiat_sc255_montgomery_domain_field_element is a field element in the Montgomery domain. -// -// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -type fiat_sc255_montgomery_domain_field_element [4]uint64 - -// The type fiat_sc255_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. -// -// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -type fiat_sc255_non_montgomery_domain_field_element [4]uint64 - -// The function fiat_sc255_addcarryx_u64 is a thin wrapper around bits.Add64 that uses fiat_sc255_uint1 rather than uint64 -func fiat_sc255_addcarryx_u64(x uint64, y uint64, carry fiat_sc255_uint1) (uint64, fiat_sc255_uint1) { - sum, carryOut := bits.Add64(x, y, uint64(carry)) - return sum, fiat_sc255_uint1(carryOut) -} - -// The function fiat_sc255_subborrowx_u64 is a thin wrapper around bits.Sub64 that uses fiat_sc255_uint1 rather than uint64 -func fiat_sc255_subborrowx_u64(x uint64, y uint64, carry fiat_sc255_uint1) (uint64, fiat_sc255_uint1) { - sum, carryOut := bits.Sub64(x, y, uint64(carry)) - return sum, fiat_sc255_uint1(carryOut) -} - -// The function fiat_sc255_cmovznz_u64 is a single-word conditional move. -// -// Postconditions: -// out1 = (if arg1 = 0 then arg2 else arg3) -// -// Input Bounds: -// arg1: [0x0 ~> 0x1] -// arg2: [0x0 ~> 0xffffffffffffffff] -// arg3: [0x0 ~> 0xffffffffffffffff] -// Output Bounds: -// out1: [0x0 ~> 0xffffffffffffffff] -func fiat_sc255_cmovznz_u64(out1 *uint64, arg1 fiat_sc255_uint1, arg2 uint64, arg3 uint64) { - x1 := (uint64(arg1) * 0xffffffffffffffff) - x2 := ((x1 & arg3) | ((^x1) & arg2)) - *out1 = x2 -} - -// The function fiat_sc255_mul multiplies two field elements in the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// 0 ≤ eval arg2 < m -// Postconditions: -// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_mul(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element, arg2 *fiat_sc255_montgomery_domain_field_element) { - x1 := arg1[1] - x2 := arg1[2] - x3 := arg1[3] - x4 := arg1[0] - var x5 uint64 - var x6 uint64 - x6, x5 = bits.Mul64(x4, arg2[3]) - var x7 uint64 - var x8 uint64 - x8, x7 = bits.Mul64(x4, arg2[2]) - var x9 uint64 - var x10 uint64 - x10, x9 = bits.Mul64(x4, arg2[1]) - var x11 uint64 - var x12 uint64 - x12, x11 = bits.Mul64(x4, arg2[0]) - var x13 uint64 - var x14 fiat_sc255_uint1 - x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0) - var x15 uint64 - var x16 fiat_sc255_uint1 - x15, x16 = fiat_sc255_addcarryx_u64(x10, x7, x14) - var x17 uint64 - var x18 fiat_sc255_uint1 - x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16) - x19 := (uint64(x18) + x6) - var x20 uint64 - _, x20 = bits.Mul64(x11, 0xd2b51da312547e1b) - var x22 uint64 - var x23 uint64 - x23, x22 = bits.Mul64(x20, 0x1000000000000000) - var x24 uint64 - var x25 uint64 - x25, x24 = bits.Mul64(x20, 0x14def9dea2f79cd6) - var x26 uint64 - var x27 uint64 - x27, x26 = bits.Mul64(x20, 0x5812631a5cf5d3ed) - var x28 uint64 - var x29 fiat_sc255_uint1 - x28, x29 = fiat_sc255_addcarryx_u64(x27, x24, 0x0) - x30 := (uint64(x29) + x25) - var x32 fiat_sc255_uint1 - _, x32 = fiat_sc255_addcarryx_u64(x11, x26, 0x0) - var x33 uint64 - var x34 fiat_sc255_uint1 - x33, x34 = fiat_sc255_addcarryx_u64(x13, x28, x32) - var x35 uint64 - var x36 fiat_sc255_uint1 - x35, x36 = fiat_sc255_addcarryx_u64(x15, x30, x34) - var x37 uint64 - var x38 fiat_sc255_uint1 - x37, x38 = fiat_sc255_addcarryx_u64(x17, x22, x36) - var x39 uint64 - var x40 fiat_sc255_uint1 - x39, x40 = fiat_sc255_addcarryx_u64(x19, x23, x38) - var x41 uint64 - var x42 uint64 - x42, x41 = bits.Mul64(x1, arg2[3]) - var x43 uint64 - var x44 uint64 - x44, x43 = bits.Mul64(x1, arg2[2]) - var x45 uint64 - var x46 uint64 - x46, x45 = bits.Mul64(x1, arg2[1]) - var x47 uint64 - var x48 uint64 - x48, x47 = bits.Mul64(x1, arg2[0]) - var x49 uint64 - var x50 fiat_sc255_uint1 - x49, x50 = fiat_sc255_addcarryx_u64(x48, x45, 0x0) - var x51 uint64 - var x52 fiat_sc255_uint1 - x51, x52 = fiat_sc255_addcarryx_u64(x46, x43, x50) - var x53 uint64 - var x54 fiat_sc255_uint1 - x53, x54 = fiat_sc255_addcarryx_u64(x44, x41, x52) - x55 := (uint64(x54) + x42) - var x56 uint64 - var x57 fiat_sc255_uint1 - x56, x57 = fiat_sc255_addcarryx_u64(x33, x47, 0x0) - var x58 uint64 - var x59 fiat_sc255_uint1 - x58, x59 = fiat_sc255_addcarryx_u64(x35, x49, x57) - var x60 uint64 - var x61 fiat_sc255_uint1 - x60, x61 = fiat_sc255_addcarryx_u64(x37, x51, x59) - var x62 uint64 - var x63 fiat_sc255_uint1 - x62, x63 = fiat_sc255_addcarryx_u64(x39, x53, x61) - var x64 uint64 - var x65 fiat_sc255_uint1 - x64, x65 = fiat_sc255_addcarryx_u64(uint64(x40), x55, x63) - var x66 uint64 - _, x66 = bits.Mul64(x56, 0xd2b51da312547e1b) - var x68 uint64 - var x69 uint64 - x69, x68 = bits.Mul64(x66, 0x1000000000000000) - var x70 uint64 - var x71 uint64 - x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6) - var x72 uint64 - var x73 uint64 - x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed) - var x74 uint64 - var x75 fiat_sc255_uint1 - x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0) - x76 := (uint64(x75) + x71) - var x78 fiat_sc255_uint1 - _, x78 = fiat_sc255_addcarryx_u64(x56, x72, 0x0) - var x79 uint64 - var x80 fiat_sc255_uint1 - x79, x80 = fiat_sc255_addcarryx_u64(x58, x74, x78) - var x81 uint64 - var x82 fiat_sc255_uint1 - x81, x82 = fiat_sc255_addcarryx_u64(x60, x76, x80) - var x83 uint64 - var x84 fiat_sc255_uint1 - x83, x84 = fiat_sc255_addcarryx_u64(x62, x68, x82) - var x85 uint64 - var x86 fiat_sc255_uint1 - x85, x86 = fiat_sc255_addcarryx_u64(x64, x69, x84) - x87 := (uint64(x86) + uint64(x65)) - var x88 uint64 - var x89 uint64 - x89, x88 = bits.Mul64(x2, arg2[3]) - var x90 uint64 - var x91 uint64 - x91, x90 = bits.Mul64(x2, arg2[2]) - var x92 uint64 - var x93 uint64 - x93, x92 = bits.Mul64(x2, arg2[1]) - var x94 uint64 - var x95 uint64 - x95, x94 = bits.Mul64(x2, arg2[0]) - var x96 uint64 - var x97 fiat_sc255_uint1 - x96, x97 = fiat_sc255_addcarryx_u64(x95, x92, 0x0) - var x98 uint64 - var x99 fiat_sc255_uint1 - x98, x99 = fiat_sc255_addcarryx_u64(x93, x90, x97) - var x100 uint64 - var x101 fiat_sc255_uint1 - x100, x101 = fiat_sc255_addcarryx_u64(x91, x88, x99) - x102 := (uint64(x101) + x89) - var x103 uint64 - var x104 fiat_sc255_uint1 - x103, x104 = fiat_sc255_addcarryx_u64(x79, x94, 0x0) - var x105 uint64 - var x106 fiat_sc255_uint1 - x105, x106 = fiat_sc255_addcarryx_u64(x81, x96, x104) - var x107 uint64 - var x108 fiat_sc255_uint1 - x107, x108 = fiat_sc255_addcarryx_u64(x83, x98, x106) - var x109 uint64 - var x110 fiat_sc255_uint1 - x109, x110 = fiat_sc255_addcarryx_u64(x85, x100, x108) - var x111 uint64 - var x112 fiat_sc255_uint1 - x111, x112 = fiat_sc255_addcarryx_u64(x87, x102, x110) - var x113 uint64 - _, x113 = bits.Mul64(x103, 0xd2b51da312547e1b) - var x115 uint64 - var x116 uint64 - x116, x115 = bits.Mul64(x113, 0x1000000000000000) - var x117 uint64 - var x118 uint64 - x118, x117 = bits.Mul64(x113, 0x14def9dea2f79cd6) - var x119 uint64 - var x120 uint64 - x120, x119 = bits.Mul64(x113, 0x5812631a5cf5d3ed) - var x121 uint64 - var x122 fiat_sc255_uint1 - x121, x122 = fiat_sc255_addcarryx_u64(x120, x117, 0x0) - x123 := (uint64(x122) + x118) - var x125 fiat_sc255_uint1 - _, x125 = fiat_sc255_addcarryx_u64(x103, x119, 0x0) - var x126 uint64 - var x127 fiat_sc255_uint1 - x126, x127 = fiat_sc255_addcarryx_u64(x105, x121, x125) - var x128 uint64 - var x129 fiat_sc255_uint1 - x128, x129 = fiat_sc255_addcarryx_u64(x107, x123, x127) - var x130 uint64 - var x131 fiat_sc255_uint1 - x130, x131 = fiat_sc255_addcarryx_u64(x109, x115, x129) - var x132 uint64 - var x133 fiat_sc255_uint1 - x132, x133 = fiat_sc255_addcarryx_u64(x111, x116, x131) - x134 := (uint64(x133) + uint64(x112)) - var x135 uint64 - var x136 uint64 - x136, x135 = bits.Mul64(x3, arg2[3]) - var x137 uint64 - var x138 uint64 - x138, x137 = bits.Mul64(x3, arg2[2]) - var x139 uint64 - var x140 uint64 - x140, x139 = bits.Mul64(x3, arg2[1]) - var x141 uint64 - var x142 uint64 - x142, x141 = bits.Mul64(x3, arg2[0]) - var x143 uint64 - var x144 fiat_sc255_uint1 - x143, x144 = fiat_sc255_addcarryx_u64(x142, x139, 0x0) - var x145 uint64 - var x146 fiat_sc255_uint1 - x145, x146 = fiat_sc255_addcarryx_u64(x140, x137, x144) - var x147 uint64 - var x148 fiat_sc255_uint1 - x147, x148 = fiat_sc255_addcarryx_u64(x138, x135, x146) - x149 := (uint64(x148) + x136) - var x150 uint64 - var x151 fiat_sc255_uint1 - x150, x151 = fiat_sc255_addcarryx_u64(x126, x141, 0x0) - var x152 uint64 - var x153 fiat_sc255_uint1 - x152, x153 = fiat_sc255_addcarryx_u64(x128, x143, x151) - var x154 uint64 - var x155 fiat_sc255_uint1 - x154, x155 = fiat_sc255_addcarryx_u64(x130, x145, x153) - var x156 uint64 - var x157 fiat_sc255_uint1 - x156, x157 = fiat_sc255_addcarryx_u64(x132, x147, x155) - var x158 uint64 - var x159 fiat_sc255_uint1 - x158, x159 = fiat_sc255_addcarryx_u64(x134, x149, x157) - var x160 uint64 - _, x160 = bits.Mul64(x150, 0xd2b51da312547e1b) - var x162 uint64 - var x163 uint64 - x163, x162 = bits.Mul64(x160, 0x1000000000000000) - var x164 uint64 - var x165 uint64 - x165, x164 = bits.Mul64(x160, 0x14def9dea2f79cd6) - var x166 uint64 - var x167 uint64 - x167, x166 = bits.Mul64(x160, 0x5812631a5cf5d3ed) - var x168 uint64 - var x169 fiat_sc255_uint1 - x168, x169 = fiat_sc255_addcarryx_u64(x167, x164, 0x0) - x170 := (uint64(x169) + x165) - var x172 fiat_sc255_uint1 - _, x172 = fiat_sc255_addcarryx_u64(x150, x166, 0x0) - var x173 uint64 - var x174 fiat_sc255_uint1 - x173, x174 = fiat_sc255_addcarryx_u64(x152, x168, x172) - var x175 uint64 - var x176 fiat_sc255_uint1 - x175, x176 = fiat_sc255_addcarryx_u64(x154, x170, x174) - var x177 uint64 - var x178 fiat_sc255_uint1 - x177, x178 = fiat_sc255_addcarryx_u64(x156, x162, x176) - var x179 uint64 - var x180 fiat_sc255_uint1 - x179, x180 = fiat_sc255_addcarryx_u64(x158, x163, x178) - x181 := (uint64(x180) + uint64(x159)) - var x182 uint64 - var x183 fiat_sc255_uint1 - x182, x183 = fiat_sc255_subborrowx_u64(x173, 0x5812631a5cf5d3ed, 0x0) - var x184 uint64 - var x185 fiat_sc255_uint1 - x184, x185 = fiat_sc255_subborrowx_u64(x175, 0x14def9dea2f79cd6, x183) - var x186 uint64 - var x187 fiat_sc255_uint1 - x186, x187 = fiat_sc255_subborrowx_u64(x177, uint64(0x0), x185) - var x188 uint64 - var x189 fiat_sc255_uint1 - x188, x189 = fiat_sc255_subborrowx_u64(x179, 0x1000000000000000, x187) - var x191 fiat_sc255_uint1 - _, x191 = fiat_sc255_subborrowx_u64(x181, uint64(0x0), x189) - var x192 uint64 - fiat_sc255_cmovznz_u64(&x192, x191, x182, x173) - var x193 uint64 - fiat_sc255_cmovznz_u64(&x193, x191, x184, x175) - var x194 uint64 - fiat_sc255_cmovznz_u64(&x194, x191, x186, x177) - var x195 uint64 - fiat_sc255_cmovznz_u64(&x195, x191, x188, x179) - out1[0] = x192 - out1[1] = x193 - out1[2] = x194 - out1[3] = x195 -} - -// The function fiat_sc255_square squares a field element in the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_square(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element) { - x1 := arg1[1] - x2 := arg1[2] - x3 := arg1[3] - x4 := arg1[0] - var x5 uint64 - var x6 uint64 - x6, x5 = bits.Mul64(x4, arg1[3]) - var x7 uint64 - var x8 uint64 - x8, x7 = bits.Mul64(x4, arg1[2]) - var x9 uint64 - var x10 uint64 - x10, x9 = bits.Mul64(x4, arg1[1]) - var x11 uint64 - var x12 uint64 - x12, x11 = bits.Mul64(x4, arg1[0]) - var x13 uint64 - var x14 fiat_sc255_uint1 - x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0) - var x15 uint64 - var x16 fiat_sc255_uint1 - x15, x16 = fiat_sc255_addcarryx_u64(x10, x7, x14) - var x17 uint64 - var x18 fiat_sc255_uint1 - x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16) - x19 := (uint64(x18) + x6) - var x20 uint64 - _, x20 = bits.Mul64(x11, 0xd2b51da312547e1b) - var x22 uint64 - var x23 uint64 - x23, x22 = bits.Mul64(x20, 0x1000000000000000) - var x24 uint64 - var x25 uint64 - x25, x24 = bits.Mul64(x20, 0x14def9dea2f79cd6) - var x26 uint64 - var x27 uint64 - x27, x26 = bits.Mul64(x20, 0x5812631a5cf5d3ed) - var x28 uint64 - var x29 fiat_sc255_uint1 - x28, x29 = fiat_sc255_addcarryx_u64(x27, x24, 0x0) - x30 := (uint64(x29) + x25) - var x32 fiat_sc255_uint1 - _, x32 = fiat_sc255_addcarryx_u64(x11, x26, 0x0) - var x33 uint64 - var x34 fiat_sc255_uint1 - x33, x34 = fiat_sc255_addcarryx_u64(x13, x28, x32) - var x35 uint64 - var x36 fiat_sc255_uint1 - x35, x36 = fiat_sc255_addcarryx_u64(x15, x30, x34) - var x37 uint64 - var x38 fiat_sc255_uint1 - x37, x38 = fiat_sc255_addcarryx_u64(x17, x22, x36) - var x39 uint64 - var x40 fiat_sc255_uint1 - x39, x40 = fiat_sc255_addcarryx_u64(x19, x23, x38) - var x41 uint64 - var x42 uint64 - x42, x41 = bits.Mul64(x1, arg1[3]) - var x43 uint64 - var x44 uint64 - x44, x43 = bits.Mul64(x1, arg1[2]) - var x45 uint64 - var x46 uint64 - x46, x45 = bits.Mul64(x1, arg1[1]) - var x47 uint64 - var x48 uint64 - x48, x47 = bits.Mul64(x1, arg1[0]) - var x49 uint64 - var x50 fiat_sc255_uint1 - x49, x50 = fiat_sc255_addcarryx_u64(x48, x45, 0x0) - var x51 uint64 - var x52 fiat_sc255_uint1 - x51, x52 = fiat_sc255_addcarryx_u64(x46, x43, x50) - var x53 uint64 - var x54 fiat_sc255_uint1 - x53, x54 = fiat_sc255_addcarryx_u64(x44, x41, x52) - x55 := (uint64(x54) + x42) - var x56 uint64 - var x57 fiat_sc255_uint1 - x56, x57 = fiat_sc255_addcarryx_u64(x33, x47, 0x0) - var x58 uint64 - var x59 fiat_sc255_uint1 - x58, x59 = fiat_sc255_addcarryx_u64(x35, x49, x57) - var x60 uint64 - var x61 fiat_sc255_uint1 - x60, x61 = fiat_sc255_addcarryx_u64(x37, x51, x59) - var x62 uint64 - var x63 fiat_sc255_uint1 - x62, x63 = fiat_sc255_addcarryx_u64(x39, x53, x61) - var x64 uint64 - var x65 fiat_sc255_uint1 - x64, x65 = fiat_sc255_addcarryx_u64(uint64(x40), x55, x63) - var x66 uint64 - _, x66 = bits.Mul64(x56, 0xd2b51da312547e1b) - var x68 uint64 - var x69 uint64 - x69, x68 = bits.Mul64(x66, 0x1000000000000000) - var x70 uint64 - var x71 uint64 - x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6) - var x72 uint64 - var x73 uint64 - x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed) - var x74 uint64 - var x75 fiat_sc255_uint1 - x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0) - x76 := (uint64(x75) + x71) - var x78 fiat_sc255_uint1 - _, x78 = fiat_sc255_addcarryx_u64(x56, x72, 0x0) - var x79 uint64 - var x80 fiat_sc255_uint1 - x79, x80 = fiat_sc255_addcarryx_u64(x58, x74, x78) - var x81 uint64 - var x82 fiat_sc255_uint1 - x81, x82 = fiat_sc255_addcarryx_u64(x60, x76, x80) - var x83 uint64 - var x84 fiat_sc255_uint1 - x83, x84 = fiat_sc255_addcarryx_u64(x62, x68, x82) - var x85 uint64 - var x86 fiat_sc255_uint1 - x85, x86 = fiat_sc255_addcarryx_u64(x64, x69, x84) - x87 := (uint64(x86) + uint64(x65)) - var x88 uint64 - var x89 uint64 - x89, x88 = bits.Mul64(x2, arg1[3]) - var x90 uint64 - var x91 uint64 - x91, x90 = bits.Mul64(x2, arg1[2]) - var x92 uint64 - var x93 uint64 - x93, x92 = bits.Mul64(x2, arg1[1]) - var x94 uint64 - var x95 uint64 - x95, x94 = bits.Mul64(x2, arg1[0]) - var x96 uint64 - var x97 fiat_sc255_uint1 - x96, x97 = fiat_sc255_addcarryx_u64(x95, x92, 0x0) - var x98 uint64 - var x99 fiat_sc255_uint1 - x98, x99 = fiat_sc255_addcarryx_u64(x93, x90, x97) - var x100 uint64 - var x101 fiat_sc255_uint1 - x100, x101 = fiat_sc255_addcarryx_u64(x91, x88, x99) - x102 := (uint64(x101) + x89) - var x103 uint64 - var x104 fiat_sc255_uint1 - x103, x104 = fiat_sc255_addcarryx_u64(x79, x94, 0x0) - var x105 uint64 - var x106 fiat_sc255_uint1 - x105, x106 = fiat_sc255_addcarryx_u64(x81, x96, x104) - var x107 uint64 - var x108 fiat_sc255_uint1 - x107, x108 = fiat_sc255_addcarryx_u64(x83, x98, x106) - var x109 uint64 - var x110 fiat_sc255_uint1 - x109, x110 = fiat_sc255_addcarryx_u64(x85, x100, x108) - var x111 uint64 - var x112 fiat_sc255_uint1 - x111, x112 = fiat_sc255_addcarryx_u64(x87, x102, x110) - var x113 uint64 - _, x113 = bits.Mul64(x103, 0xd2b51da312547e1b) - var x115 uint64 - var x116 uint64 - x116, x115 = bits.Mul64(x113, 0x1000000000000000) - var x117 uint64 - var x118 uint64 - x118, x117 = bits.Mul64(x113, 0x14def9dea2f79cd6) - var x119 uint64 - var x120 uint64 - x120, x119 = bits.Mul64(x113, 0x5812631a5cf5d3ed) - var x121 uint64 - var x122 fiat_sc255_uint1 - x121, x122 = fiat_sc255_addcarryx_u64(x120, x117, 0x0) - x123 := (uint64(x122) + x118) - var x125 fiat_sc255_uint1 - _, x125 = fiat_sc255_addcarryx_u64(x103, x119, 0x0) - var x126 uint64 - var x127 fiat_sc255_uint1 - x126, x127 = fiat_sc255_addcarryx_u64(x105, x121, x125) - var x128 uint64 - var x129 fiat_sc255_uint1 - x128, x129 = fiat_sc255_addcarryx_u64(x107, x123, x127) - var x130 uint64 - var x131 fiat_sc255_uint1 - x130, x131 = fiat_sc255_addcarryx_u64(x109, x115, x129) - var x132 uint64 - var x133 fiat_sc255_uint1 - x132, x133 = fiat_sc255_addcarryx_u64(x111, x116, x131) - x134 := (uint64(x133) + uint64(x112)) - var x135 uint64 - var x136 uint64 - x136, x135 = bits.Mul64(x3, arg1[3]) - var x137 uint64 - var x138 uint64 - x138, x137 = bits.Mul64(x3, arg1[2]) - var x139 uint64 - var x140 uint64 - x140, x139 = bits.Mul64(x3, arg1[1]) - var x141 uint64 - var x142 uint64 - x142, x141 = bits.Mul64(x3, arg1[0]) - var x143 uint64 - var x144 fiat_sc255_uint1 - x143, x144 = fiat_sc255_addcarryx_u64(x142, x139, 0x0) - var x145 uint64 - var x146 fiat_sc255_uint1 - x145, x146 = fiat_sc255_addcarryx_u64(x140, x137, x144) - var x147 uint64 - var x148 fiat_sc255_uint1 - x147, x148 = fiat_sc255_addcarryx_u64(x138, x135, x146) - x149 := (uint64(x148) + x136) - var x150 uint64 - var x151 fiat_sc255_uint1 - x150, x151 = fiat_sc255_addcarryx_u64(x126, x141, 0x0) - var x152 uint64 - var x153 fiat_sc255_uint1 - x152, x153 = fiat_sc255_addcarryx_u64(x128, x143, x151) - var x154 uint64 - var x155 fiat_sc255_uint1 - x154, x155 = fiat_sc255_addcarryx_u64(x130, x145, x153) - var x156 uint64 - var x157 fiat_sc255_uint1 - x156, x157 = fiat_sc255_addcarryx_u64(x132, x147, x155) - var x158 uint64 - var x159 fiat_sc255_uint1 - x158, x159 = fiat_sc255_addcarryx_u64(x134, x149, x157) - var x160 uint64 - _, x160 = bits.Mul64(x150, 0xd2b51da312547e1b) - var x162 uint64 - var x163 uint64 - x163, x162 = bits.Mul64(x160, 0x1000000000000000) - var x164 uint64 - var x165 uint64 - x165, x164 = bits.Mul64(x160, 0x14def9dea2f79cd6) - var x166 uint64 - var x167 uint64 - x167, x166 = bits.Mul64(x160, 0x5812631a5cf5d3ed) - var x168 uint64 - var x169 fiat_sc255_uint1 - x168, x169 = fiat_sc255_addcarryx_u64(x167, x164, 0x0) - x170 := (uint64(x169) + x165) - var x172 fiat_sc255_uint1 - _, x172 = fiat_sc255_addcarryx_u64(x150, x166, 0x0) - var x173 uint64 - var x174 fiat_sc255_uint1 - x173, x174 = fiat_sc255_addcarryx_u64(x152, x168, x172) - var x175 uint64 - var x176 fiat_sc255_uint1 - x175, x176 = fiat_sc255_addcarryx_u64(x154, x170, x174) - var x177 uint64 - var x178 fiat_sc255_uint1 - x177, x178 = fiat_sc255_addcarryx_u64(x156, x162, x176) - var x179 uint64 - var x180 fiat_sc255_uint1 - x179, x180 = fiat_sc255_addcarryx_u64(x158, x163, x178) - x181 := (uint64(x180) + uint64(x159)) - var x182 uint64 - var x183 fiat_sc255_uint1 - x182, x183 = fiat_sc255_subborrowx_u64(x173, 0x5812631a5cf5d3ed, 0x0) - var x184 uint64 - var x185 fiat_sc255_uint1 - x184, x185 = fiat_sc255_subborrowx_u64(x175, 0x14def9dea2f79cd6, x183) - var x186 uint64 - var x187 fiat_sc255_uint1 - x186, x187 = fiat_sc255_subborrowx_u64(x177, uint64(0x0), x185) - var x188 uint64 - var x189 fiat_sc255_uint1 - x188, x189 = fiat_sc255_subborrowx_u64(x179, 0x1000000000000000, x187) - var x191 fiat_sc255_uint1 - _, x191 = fiat_sc255_subborrowx_u64(x181, uint64(0x0), x189) - var x192 uint64 - fiat_sc255_cmovznz_u64(&x192, x191, x182, x173) - var x193 uint64 - fiat_sc255_cmovznz_u64(&x193, x191, x184, x175) - var x194 uint64 - fiat_sc255_cmovznz_u64(&x194, x191, x186, x177) - var x195 uint64 - fiat_sc255_cmovznz_u64(&x195, x191, x188, x179) - out1[0] = x192 - out1[1] = x193 - out1[2] = x194 - out1[3] = x195 -} - -// The function fiat_sc255_add adds two field elements in the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// 0 ≤ eval arg2 < m -// Postconditions: -// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_add(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element, arg2 *fiat_sc255_montgomery_domain_field_element) { - var x1 uint64 - var x2 fiat_sc255_uint1 - x1, x2 = fiat_sc255_addcarryx_u64(arg1[0], arg2[0], 0x0) - var x3 uint64 - var x4 fiat_sc255_uint1 - x3, x4 = fiat_sc255_addcarryx_u64(arg1[1], arg2[1], x2) - var x5 uint64 - var x6 fiat_sc255_uint1 - x5, x6 = fiat_sc255_addcarryx_u64(arg1[2], arg2[2], x4) - var x7 uint64 - var x8 fiat_sc255_uint1 - x7, x8 = fiat_sc255_addcarryx_u64(arg1[3], arg2[3], x6) - var x9 uint64 - var x10 fiat_sc255_uint1 - x9, x10 = fiat_sc255_subborrowx_u64(x1, 0x5812631a5cf5d3ed, 0x0) - var x11 uint64 - var x12 fiat_sc255_uint1 - x11, x12 = fiat_sc255_subborrowx_u64(x3, 0x14def9dea2f79cd6, x10) - var x13 uint64 - var x14 fiat_sc255_uint1 - x13, x14 = fiat_sc255_subborrowx_u64(x5, uint64(0x0), x12) - var x15 uint64 - var x16 fiat_sc255_uint1 - x15, x16 = fiat_sc255_subborrowx_u64(x7, 0x1000000000000000, x14) - var x18 fiat_sc255_uint1 - _, x18 = fiat_sc255_subborrowx_u64(uint64(x8), uint64(0x0), x16) - var x19 uint64 - fiat_sc255_cmovznz_u64(&x19, x18, x9, x1) - var x20 uint64 - fiat_sc255_cmovznz_u64(&x20, x18, x11, x3) - var x21 uint64 - fiat_sc255_cmovznz_u64(&x21, x18, x13, x5) - var x22 uint64 - fiat_sc255_cmovznz_u64(&x22, x18, x15, x7) - out1[0] = x19 - out1[1] = x20 - out1[2] = x21 - out1[3] = x22 -} - -// The function fiat_sc255_sub subtracts two field elements in the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// 0 ≤ eval arg2 < m -// Postconditions: -// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_sub(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element, arg2 *fiat_sc255_montgomery_domain_field_element) { - var x1 uint64 - var x2 fiat_sc255_uint1 - x1, x2 = fiat_sc255_subborrowx_u64(arg1[0], arg2[0], 0x0) - var x3 uint64 - var x4 fiat_sc255_uint1 - x3, x4 = fiat_sc255_subborrowx_u64(arg1[1], arg2[1], x2) - var x5 uint64 - var x6 fiat_sc255_uint1 - x5, x6 = fiat_sc255_subborrowx_u64(arg1[2], arg2[2], x4) - var x7 uint64 - var x8 fiat_sc255_uint1 - x7, x8 = fiat_sc255_subborrowx_u64(arg1[3], arg2[3], x6) - var x9 uint64 - fiat_sc255_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff) - var x10 uint64 - var x11 fiat_sc255_uint1 - x10, x11 = fiat_sc255_addcarryx_u64(x1, (x9 & 0x5812631a5cf5d3ed), 0x0) - var x12 uint64 - var x13 fiat_sc255_uint1 - x12, x13 = fiat_sc255_addcarryx_u64(x3, (x9 & 0x14def9dea2f79cd6), x11) - var x14 uint64 - var x15 fiat_sc255_uint1 - x14, x15 = fiat_sc255_addcarryx_u64(x5, uint64(0x0), x13) - var x16 uint64 - x16, _ = fiat_sc255_addcarryx_u64(x7, (x9 & 0x1000000000000000), x15) - out1[0] = x10 - out1[1] = x12 - out1[2] = x14 - out1[3] = x16 -} - -// The function fiat_sc255_opp negates a field element in the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_opp(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element) { - var x1 uint64 - var x2 fiat_sc255_uint1 - x1, x2 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[0], 0x0) - var x3 uint64 - var x4 fiat_sc255_uint1 - x3, x4 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[1], x2) - var x5 uint64 - var x6 fiat_sc255_uint1 - x5, x6 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[2], x4) - var x7 uint64 - var x8 fiat_sc255_uint1 - x7, x8 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[3], x6) - var x9 uint64 - fiat_sc255_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff) - var x10 uint64 - var x11 fiat_sc255_uint1 - x10, x11 = fiat_sc255_addcarryx_u64(x1, (x9 & 0x5812631a5cf5d3ed), 0x0) - var x12 uint64 - var x13 fiat_sc255_uint1 - x12, x13 = fiat_sc255_addcarryx_u64(x3, (x9 & 0x14def9dea2f79cd6), x11) - var x14 uint64 - var x15 fiat_sc255_uint1 - x14, x15 = fiat_sc255_addcarryx_u64(x5, uint64(0x0), x13) - var x16 uint64 - x16, _ = fiat_sc255_addcarryx_u64(x7, (x9 & 0x1000000000000000), x15) - out1[0] = x10 - out1[1] = x12 - out1[2] = x14 - out1[3] = x16 -} - -// The function fiat_sc255_from_montgomery translates a field element out of the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_from_montgomery(out1 *fiat_sc255_non_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element) { - x1 := arg1[0] - var x2 uint64 - _, x2 = bits.Mul64(x1, 0xd2b51da312547e1b) - var x4 uint64 - var x5 uint64 - x5, x4 = bits.Mul64(x2, 0x1000000000000000) - var x6 uint64 - var x7 uint64 - x7, x6 = bits.Mul64(x2, 0x14def9dea2f79cd6) - var x8 uint64 - var x9 uint64 - x9, x8 = bits.Mul64(x2, 0x5812631a5cf5d3ed) - var x10 uint64 - var x11 fiat_sc255_uint1 - x10, x11 = fiat_sc255_addcarryx_u64(x9, x6, 0x0) - var x13 fiat_sc255_uint1 - _, x13 = fiat_sc255_addcarryx_u64(x1, x8, 0x0) - var x14 uint64 - var x15 fiat_sc255_uint1 - x14, x15 = fiat_sc255_addcarryx_u64(uint64(0x0), x10, x13) - var x16 uint64 - var x17 fiat_sc255_uint1 - x16, x17 = fiat_sc255_addcarryx_u64(x14, arg1[1], 0x0) - var x18 uint64 - _, x18 = bits.Mul64(x16, 0xd2b51da312547e1b) - var x20 uint64 - var x21 uint64 - x21, x20 = bits.Mul64(x18, 0x1000000000000000) - var x22 uint64 - var x23 uint64 - x23, x22 = bits.Mul64(x18, 0x14def9dea2f79cd6) - var x24 uint64 - var x25 uint64 - x25, x24 = bits.Mul64(x18, 0x5812631a5cf5d3ed) - var x26 uint64 - var x27 fiat_sc255_uint1 - x26, x27 = fiat_sc255_addcarryx_u64(x25, x22, 0x0) - var x29 fiat_sc255_uint1 - _, x29 = fiat_sc255_addcarryx_u64(x16, x24, 0x0) - var x30 uint64 - var x31 fiat_sc255_uint1 - x30, x31 = fiat_sc255_addcarryx_u64((uint64(x17) + (uint64(x15) + (uint64(x11) + x7))), x26, x29) - var x32 uint64 - var x33 fiat_sc255_uint1 - x32, x33 = fiat_sc255_addcarryx_u64(x4, (uint64(x27) + x23), x31) - var x34 uint64 - var x35 fiat_sc255_uint1 - x34, x35 = fiat_sc255_addcarryx_u64(x5, x20, x33) - var x36 uint64 - var x37 fiat_sc255_uint1 - x36, x37 = fiat_sc255_addcarryx_u64(x30, arg1[2], 0x0) - var x38 uint64 - var x39 fiat_sc255_uint1 - x38, x39 = fiat_sc255_addcarryx_u64(x32, uint64(0x0), x37) - var x40 uint64 - var x41 fiat_sc255_uint1 - x40, x41 = fiat_sc255_addcarryx_u64(x34, uint64(0x0), x39) - var x42 uint64 - _, x42 = bits.Mul64(x36, 0xd2b51da312547e1b) - var x44 uint64 - var x45 uint64 - x45, x44 = bits.Mul64(x42, 0x1000000000000000) - var x46 uint64 - var x47 uint64 - x47, x46 = bits.Mul64(x42, 0x14def9dea2f79cd6) - var x48 uint64 - var x49 uint64 - x49, x48 = bits.Mul64(x42, 0x5812631a5cf5d3ed) - var x50 uint64 - var x51 fiat_sc255_uint1 - x50, x51 = fiat_sc255_addcarryx_u64(x49, x46, 0x0) - var x53 fiat_sc255_uint1 - _, x53 = fiat_sc255_addcarryx_u64(x36, x48, 0x0) - var x54 uint64 - var x55 fiat_sc255_uint1 - x54, x55 = fiat_sc255_addcarryx_u64(x38, x50, x53) - var x56 uint64 - var x57 fiat_sc255_uint1 - x56, x57 = fiat_sc255_addcarryx_u64(x40, (uint64(x51) + x47), x55) - var x58 uint64 - var x59 fiat_sc255_uint1 - x58, x59 = fiat_sc255_addcarryx_u64((uint64(x41) + (uint64(x35) + x21)), x44, x57) - var x60 uint64 - var x61 fiat_sc255_uint1 - x60, x61 = fiat_sc255_addcarryx_u64(x54, arg1[3], 0x0) - var x62 uint64 - var x63 fiat_sc255_uint1 - x62, x63 = fiat_sc255_addcarryx_u64(x56, uint64(0x0), x61) - var x64 uint64 - var x65 fiat_sc255_uint1 - x64, x65 = fiat_sc255_addcarryx_u64(x58, uint64(0x0), x63) - var x66 uint64 - _, x66 = bits.Mul64(x60, 0xd2b51da312547e1b) - var x68 uint64 - var x69 uint64 - x69, x68 = bits.Mul64(x66, 0x1000000000000000) - var x70 uint64 - var x71 uint64 - x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6) - var x72 uint64 - var x73 uint64 - x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed) - var x74 uint64 - var x75 fiat_sc255_uint1 - x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0) - var x77 fiat_sc255_uint1 - _, x77 = fiat_sc255_addcarryx_u64(x60, x72, 0x0) - var x78 uint64 - var x79 fiat_sc255_uint1 - x78, x79 = fiat_sc255_addcarryx_u64(x62, x74, x77) - var x80 uint64 - var x81 fiat_sc255_uint1 - x80, x81 = fiat_sc255_addcarryx_u64(x64, (uint64(x75) + x71), x79) - var x82 uint64 - var x83 fiat_sc255_uint1 - x82, x83 = fiat_sc255_addcarryx_u64((uint64(x65) + (uint64(x59) + x45)), x68, x81) - x84 := (uint64(x83) + x69) - var x85 uint64 - var x86 fiat_sc255_uint1 - x85, x86 = fiat_sc255_subborrowx_u64(x78, 0x5812631a5cf5d3ed, 0x0) - var x87 uint64 - var x88 fiat_sc255_uint1 - x87, x88 = fiat_sc255_subborrowx_u64(x80, 0x14def9dea2f79cd6, x86) - var x89 uint64 - var x90 fiat_sc255_uint1 - x89, x90 = fiat_sc255_subborrowx_u64(x82, uint64(0x0), x88) - var x91 uint64 - var x92 fiat_sc255_uint1 - x91, x92 = fiat_sc255_subborrowx_u64(x84, 0x1000000000000000, x90) - var x94 fiat_sc255_uint1 - _, x94 = fiat_sc255_subborrowx_u64(uint64(0x0), uint64(0x0), x92) - var x95 uint64 - fiat_sc255_cmovznz_u64(&x95, x94, x85, x78) - var x96 uint64 - fiat_sc255_cmovznz_u64(&x96, x94, x87, x80) - var x97 uint64 - fiat_sc255_cmovznz_u64(&x97, x94, x89, x82) - var x98 uint64 - fiat_sc255_cmovznz_u64(&x98, x94, x91, x84) - out1[0] = x95 - out1[1] = x96 - out1[2] = x97 - out1[3] = x98 -} - -// The function fiat_sc255_to_montgomery translates a field element into the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// eval (from_montgomery out1) mod m = eval arg1 mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_to_montgomery(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_non_montgomery_domain_field_element) { - x1 := arg1[1] - x2 := arg1[2] - x3 := arg1[3] - x4 := arg1[0] - var x5 uint64 - var x6 uint64 - x6, x5 = bits.Mul64(x4, 0x399411b7c309a3d) - var x7 uint64 - var x8 uint64 - x8, x7 = bits.Mul64(x4, 0xceec73d217f5be65) - var x9 uint64 - var x10 uint64 - x10, x9 = bits.Mul64(x4, 0xd00e1ba768859347) - var x11 uint64 - var x12 uint64 - x12, x11 = bits.Mul64(x4, 0xa40611e3449c0f01) - var x13 uint64 - var x14 fiat_sc255_uint1 - x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0) - var x15 uint64 - var x16 fiat_sc255_uint1 - x15, x16 = fiat_sc255_addcarryx_u64(x10, x7, x14) - var x17 uint64 - var x18 fiat_sc255_uint1 - x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16) - var x19 uint64 - _, x19 = bits.Mul64(x11, 0xd2b51da312547e1b) - var x21 uint64 - var x22 uint64 - x22, x21 = bits.Mul64(x19, 0x1000000000000000) - var x23 uint64 - var x24 uint64 - x24, x23 = bits.Mul64(x19, 0x14def9dea2f79cd6) - var x25 uint64 - var x26 uint64 - x26, x25 = bits.Mul64(x19, 0x5812631a5cf5d3ed) - var x27 uint64 - var x28 fiat_sc255_uint1 - x27, x28 = fiat_sc255_addcarryx_u64(x26, x23, 0x0) - var x30 fiat_sc255_uint1 - _, x30 = fiat_sc255_addcarryx_u64(x11, x25, 0x0) - var x31 uint64 - var x32 fiat_sc255_uint1 - x31, x32 = fiat_sc255_addcarryx_u64(x13, x27, x30) - var x33 uint64 - var x34 fiat_sc255_uint1 - x33, x34 = fiat_sc255_addcarryx_u64(x15, (uint64(x28) + x24), x32) - var x35 uint64 - var x36 fiat_sc255_uint1 - x35, x36 = fiat_sc255_addcarryx_u64(x17, x21, x34) - var x37 uint64 - var x38 uint64 - x38, x37 = bits.Mul64(x1, 0x399411b7c309a3d) - var x39 uint64 - var x40 uint64 - x40, x39 = bits.Mul64(x1, 0xceec73d217f5be65) - var x41 uint64 - var x42 uint64 - x42, x41 = bits.Mul64(x1, 0xd00e1ba768859347) - var x43 uint64 - var x44 uint64 - x44, x43 = bits.Mul64(x1, 0xa40611e3449c0f01) - var x45 uint64 - var x46 fiat_sc255_uint1 - x45, x46 = fiat_sc255_addcarryx_u64(x44, x41, 0x0) - var x47 uint64 - var x48 fiat_sc255_uint1 - x47, x48 = fiat_sc255_addcarryx_u64(x42, x39, x46) - var x49 uint64 - var x50 fiat_sc255_uint1 - x49, x50 = fiat_sc255_addcarryx_u64(x40, x37, x48) - var x51 uint64 - var x52 fiat_sc255_uint1 - x51, x52 = fiat_sc255_addcarryx_u64(x31, x43, 0x0) - var x53 uint64 - var x54 fiat_sc255_uint1 - x53, x54 = fiat_sc255_addcarryx_u64(x33, x45, x52) - var x55 uint64 - var x56 fiat_sc255_uint1 - x55, x56 = fiat_sc255_addcarryx_u64(x35, x47, x54) - var x57 uint64 - var x58 fiat_sc255_uint1 - x57, x58 = fiat_sc255_addcarryx_u64(((uint64(x36) + (uint64(x18) + x6)) + x22), x49, x56) - var x59 uint64 - _, x59 = bits.Mul64(x51, 0xd2b51da312547e1b) - var x61 uint64 - var x62 uint64 - x62, x61 = bits.Mul64(x59, 0x1000000000000000) - var x63 uint64 - var x64 uint64 - x64, x63 = bits.Mul64(x59, 0x14def9dea2f79cd6) - var x65 uint64 - var x66 uint64 - x66, x65 = bits.Mul64(x59, 0x5812631a5cf5d3ed) - var x67 uint64 - var x68 fiat_sc255_uint1 - x67, x68 = fiat_sc255_addcarryx_u64(x66, x63, 0x0) - var x70 fiat_sc255_uint1 - _, x70 = fiat_sc255_addcarryx_u64(x51, x65, 0x0) - var x71 uint64 - var x72 fiat_sc255_uint1 - x71, x72 = fiat_sc255_addcarryx_u64(x53, x67, x70) - var x73 uint64 - var x74 fiat_sc255_uint1 - x73, x74 = fiat_sc255_addcarryx_u64(x55, (uint64(x68) + x64), x72) - var x75 uint64 - var x76 fiat_sc255_uint1 - x75, x76 = fiat_sc255_addcarryx_u64(x57, x61, x74) - var x77 uint64 - var x78 uint64 - x78, x77 = bits.Mul64(x2, 0x399411b7c309a3d) - var x79 uint64 - var x80 uint64 - x80, x79 = bits.Mul64(x2, 0xceec73d217f5be65) - var x81 uint64 - var x82 uint64 - x82, x81 = bits.Mul64(x2, 0xd00e1ba768859347) - var x83 uint64 - var x84 uint64 - x84, x83 = bits.Mul64(x2, 0xa40611e3449c0f01) - var x85 uint64 - var x86 fiat_sc255_uint1 - x85, x86 = fiat_sc255_addcarryx_u64(x84, x81, 0x0) - var x87 uint64 - var x88 fiat_sc255_uint1 - x87, x88 = fiat_sc255_addcarryx_u64(x82, x79, x86) - var x89 uint64 - var x90 fiat_sc255_uint1 - x89, x90 = fiat_sc255_addcarryx_u64(x80, x77, x88) - var x91 uint64 - var x92 fiat_sc255_uint1 - x91, x92 = fiat_sc255_addcarryx_u64(x71, x83, 0x0) - var x93 uint64 - var x94 fiat_sc255_uint1 - x93, x94 = fiat_sc255_addcarryx_u64(x73, x85, x92) - var x95 uint64 - var x96 fiat_sc255_uint1 - x95, x96 = fiat_sc255_addcarryx_u64(x75, x87, x94) - var x97 uint64 - var x98 fiat_sc255_uint1 - x97, x98 = fiat_sc255_addcarryx_u64(((uint64(x76) + (uint64(x58) + (uint64(x50) + x38))) + x62), x89, x96) - var x99 uint64 - _, x99 = bits.Mul64(x91, 0xd2b51da312547e1b) - var x101 uint64 - var x102 uint64 - x102, x101 = bits.Mul64(x99, 0x1000000000000000) - var x103 uint64 - var x104 uint64 - x104, x103 = bits.Mul64(x99, 0x14def9dea2f79cd6) - var x105 uint64 - var x106 uint64 - x106, x105 = bits.Mul64(x99, 0x5812631a5cf5d3ed) - var x107 uint64 - var x108 fiat_sc255_uint1 - x107, x108 = fiat_sc255_addcarryx_u64(x106, x103, 0x0) - var x110 fiat_sc255_uint1 - _, x110 = fiat_sc255_addcarryx_u64(x91, x105, 0x0) - var x111 uint64 - var x112 fiat_sc255_uint1 - x111, x112 = fiat_sc255_addcarryx_u64(x93, x107, x110) - var x113 uint64 - var x114 fiat_sc255_uint1 - x113, x114 = fiat_sc255_addcarryx_u64(x95, (uint64(x108) + x104), x112) - var x115 uint64 - var x116 fiat_sc255_uint1 - x115, x116 = fiat_sc255_addcarryx_u64(x97, x101, x114) - var x117 uint64 - var x118 uint64 - x118, x117 = bits.Mul64(x3, 0x399411b7c309a3d) - var x119 uint64 - var x120 uint64 - x120, x119 = bits.Mul64(x3, 0xceec73d217f5be65) - var x121 uint64 - var x122 uint64 - x122, x121 = bits.Mul64(x3, 0xd00e1ba768859347) - var x123 uint64 - var x124 uint64 - x124, x123 = bits.Mul64(x3, 0xa40611e3449c0f01) - var x125 uint64 - var x126 fiat_sc255_uint1 - x125, x126 = fiat_sc255_addcarryx_u64(x124, x121, 0x0) - var x127 uint64 - var x128 fiat_sc255_uint1 - x127, x128 = fiat_sc255_addcarryx_u64(x122, x119, x126) - var x129 uint64 - var x130 fiat_sc255_uint1 - x129, x130 = fiat_sc255_addcarryx_u64(x120, x117, x128) - var x131 uint64 - var x132 fiat_sc255_uint1 - x131, x132 = fiat_sc255_addcarryx_u64(x111, x123, 0x0) - var x133 uint64 - var x134 fiat_sc255_uint1 - x133, x134 = fiat_sc255_addcarryx_u64(x113, x125, x132) - var x135 uint64 - var x136 fiat_sc255_uint1 - x135, x136 = fiat_sc255_addcarryx_u64(x115, x127, x134) - var x137 uint64 - var x138 fiat_sc255_uint1 - x137, x138 = fiat_sc255_addcarryx_u64(((uint64(x116) + (uint64(x98) + (uint64(x90) + x78))) + x102), x129, x136) - var x139 uint64 - _, x139 = bits.Mul64(x131, 0xd2b51da312547e1b) - var x141 uint64 - var x142 uint64 - x142, x141 = bits.Mul64(x139, 0x1000000000000000) - var x143 uint64 - var x144 uint64 - x144, x143 = bits.Mul64(x139, 0x14def9dea2f79cd6) - var x145 uint64 - var x146 uint64 - x146, x145 = bits.Mul64(x139, 0x5812631a5cf5d3ed) - var x147 uint64 - var x148 fiat_sc255_uint1 - x147, x148 = fiat_sc255_addcarryx_u64(x146, x143, 0x0) - var x150 fiat_sc255_uint1 - _, x150 = fiat_sc255_addcarryx_u64(x131, x145, 0x0) - var x151 uint64 - var x152 fiat_sc255_uint1 - x151, x152 = fiat_sc255_addcarryx_u64(x133, x147, x150) - var x153 uint64 - var x154 fiat_sc255_uint1 - x153, x154 = fiat_sc255_addcarryx_u64(x135, (uint64(x148) + x144), x152) - var x155 uint64 - var x156 fiat_sc255_uint1 - x155, x156 = fiat_sc255_addcarryx_u64(x137, x141, x154) - x157 := ((uint64(x156) + (uint64(x138) + (uint64(x130) + x118))) + x142) - var x158 uint64 - var x159 fiat_sc255_uint1 - x158, x159 = fiat_sc255_subborrowx_u64(x151, 0x5812631a5cf5d3ed, 0x0) - var x160 uint64 - var x161 fiat_sc255_uint1 - x160, x161 = fiat_sc255_subborrowx_u64(x153, 0x14def9dea2f79cd6, x159) - var x162 uint64 - var x163 fiat_sc255_uint1 - x162, x163 = fiat_sc255_subborrowx_u64(x155, uint64(0x0), x161) - var x164 uint64 - var x165 fiat_sc255_uint1 - x164, x165 = fiat_sc255_subborrowx_u64(x157, 0x1000000000000000, x163) - var x167 fiat_sc255_uint1 - _, x167 = fiat_sc255_subborrowx_u64(uint64(0x0), uint64(0x0), x165) - var x168 uint64 - fiat_sc255_cmovznz_u64(&x168, x167, x158, x151) - var x169 uint64 - fiat_sc255_cmovznz_u64(&x169, x167, x160, x153) - var x170 uint64 - fiat_sc255_cmovznz_u64(&x170, x167, x162, x155) - var x171 uint64 - fiat_sc255_cmovznz_u64(&x171, x167, x164, x157) - out1[0] = x168 - out1[1] = x169 - out1[2] = x170 - out1[3] = x171 -} - -// The function fiat_sc255_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 -// -// Input Bounds: -// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// Output Bounds: -// out1: [0x0 ~> 0xffffffffffffffff] -func fiat_sc255_nonzero(out1 *uint64, arg1 *[4]uint64) { - x1 := (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))) - *out1 = x1 -} - -// The function fiat_sc255_selectznz is a multi-limb conditional select. -// -// Postconditions: -// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3) -// -// Input Bounds: -// arg1: [0x0 ~> 0x1] -// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// Output Bounds: -// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -func fiat_sc255_selectznz(out1 *[4]uint64, arg1 fiat_sc255_uint1, arg2 *[4]uint64, arg3 *[4]uint64) { - var x1 uint64 - fiat_sc255_cmovznz_u64(&x1, arg1, arg2[0], arg3[0]) - var x2 uint64 - fiat_sc255_cmovznz_u64(&x2, arg1, arg2[1], arg3[1]) - var x3 uint64 - fiat_sc255_cmovznz_u64(&x3, arg1, arg2[2], arg3[2]) - var x4 uint64 - fiat_sc255_cmovznz_u64(&x4, arg1, arg2[3], arg3[3]) - out1[0] = x1 - out1[1] = x2 - out1[2] = x3 - out1[3] = x4 -} - -// The function fiat_sc255_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] -// -// Input Bounds: -// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]] -// Output Bounds: -// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] -func fiat_sc255_to_bytes(out1 *[32]uint8, arg1 *[4]uint64) { - x1 := arg1[3] - x2 := arg1[2] - x3 := arg1[1] - x4 := arg1[0] - x5 := (uint8(x4) & 0xff) - x6 := (x4 >> 8) - x7 := (uint8(x6) & 0xff) - x8 := (x6 >> 8) - x9 := (uint8(x8) & 0xff) - x10 := (x8 >> 8) - x11 := (uint8(x10) & 0xff) - x12 := (x10 >> 8) - x13 := (uint8(x12) & 0xff) - x14 := (x12 >> 8) - x15 := (uint8(x14) & 0xff) - x16 := (x14 >> 8) - x17 := (uint8(x16) & 0xff) - x18 := uint8((x16 >> 8)) - x19 := (uint8(x3) & 0xff) - x20 := (x3 >> 8) - x21 := (uint8(x20) & 0xff) - x22 := (x20 >> 8) - x23 := (uint8(x22) & 0xff) - x24 := (x22 >> 8) - x25 := (uint8(x24) & 0xff) - x26 := (x24 >> 8) - x27 := (uint8(x26) & 0xff) - x28 := (x26 >> 8) - x29 := (uint8(x28) & 0xff) - x30 := (x28 >> 8) - x31 := (uint8(x30) & 0xff) - x32 := uint8((x30 >> 8)) - x33 := (uint8(x2) & 0xff) - x34 := (x2 >> 8) - x35 := (uint8(x34) & 0xff) - x36 := (x34 >> 8) - x37 := (uint8(x36) & 0xff) - x38 := (x36 >> 8) - x39 := (uint8(x38) & 0xff) - x40 := (x38 >> 8) - x41 := (uint8(x40) & 0xff) - x42 := (x40 >> 8) - x43 := (uint8(x42) & 0xff) - x44 := (x42 >> 8) - x45 := (uint8(x44) & 0xff) - x46 := uint8((x44 >> 8)) - x47 := (uint8(x1) & 0xff) - x48 := (x1 >> 8) - x49 := (uint8(x48) & 0xff) - x50 := (x48 >> 8) - x51 := (uint8(x50) & 0xff) - x52 := (x50 >> 8) - x53 := (uint8(x52) & 0xff) - x54 := (x52 >> 8) - x55 := (uint8(x54) & 0xff) - x56 := (x54 >> 8) - x57 := (uint8(x56) & 0xff) - x58 := (x56 >> 8) - x59 := (uint8(x58) & 0xff) - x60 := uint8((x58 >> 8)) - out1[0] = x5 - out1[1] = x7 - out1[2] = x9 - out1[3] = x11 - out1[4] = x13 - out1[5] = x15 - out1[6] = x17 - out1[7] = x18 - out1[8] = x19 - out1[9] = x21 - out1[10] = x23 - out1[11] = x25 - out1[12] = x27 - out1[13] = x29 - out1[14] = x31 - out1[15] = x32 - out1[16] = x33 - out1[17] = x35 - out1[18] = x37 - out1[19] = x39 - out1[20] = x41 - out1[21] = x43 - out1[22] = x45 - out1[23] = x46 - out1[24] = x47 - out1[25] = x49 - out1[26] = x51 - out1[27] = x53 - out1[28] = x55 - out1[29] = x57 - out1[30] = x59 - out1[31] = x60 -} - -// The function fiat_sc255_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. -// -// Preconditions: -// 0 ≤ bytes_eval arg1 < m -// Postconditions: -// eval out1 mod m = bytes_eval arg1 mod m -// 0 ≤ eval out1 < m -// -// Input Bounds: -// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] -// Output Bounds: -// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]] -func fiat_sc255_from_bytes(out1 *[4]uint64, arg1 *[32]uint8) { - x1 := (uint64(arg1[31]) << 56) - x2 := (uint64(arg1[30]) << 48) - x3 := (uint64(arg1[29]) << 40) - x4 := (uint64(arg1[28]) << 32) - x5 := (uint64(arg1[27]) << 24) - x6 := (uint64(arg1[26]) << 16) - x7 := (uint64(arg1[25]) << 8) - x8 := arg1[24] - x9 := (uint64(arg1[23]) << 56) - x10 := (uint64(arg1[22]) << 48) - x11 := (uint64(arg1[21]) << 40) - x12 := (uint64(arg1[20]) << 32) - x13 := (uint64(arg1[19]) << 24) - x14 := (uint64(arg1[18]) << 16) - x15 := (uint64(arg1[17]) << 8) - x16 := arg1[16] - x17 := (uint64(arg1[15]) << 56) - x18 := (uint64(arg1[14]) << 48) - x19 := (uint64(arg1[13]) << 40) - x20 := (uint64(arg1[12]) << 32) - x21 := (uint64(arg1[11]) << 24) - x22 := (uint64(arg1[10]) << 16) - x23 := (uint64(arg1[9]) << 8) - x24 := arg1[8] - x25 := (uint64(arg1[7]) << 56) - x26 := (uint64(arg1[6]) << 48) - x27 := (uint64(arg1[5]) << 40) - x28 := (uint64(arg1[4]) << 32) - x29 := (uint64(arg1[3]) << 24) - x30 := (uint64(arg1[2]) << 16) - x31 := (uint64(arg1[1]) << 8) - x32 := arg1[0] - x33 := (x31 + uint64(x32)) - x34 := (x30 + x33) - x35 := (x29 + x34) - x36 := (x28 + x35) - x37 := (x27 + x36) - x38 := (x26 + x37) - x39 := (x25 + x38) - x40 := (x23 + uint64(x24)) - x41 := (x22 + x40) - x42 := (x21 + x41) - x43 := (x20 + x42) - x44 := (x19 + x43) - x45 := (x18 + x44) - x46 := (x17 + x45) - x47 := (x15 + uint64(x16)) - x48 := (x14 + x47) - x49 := (x13 + x48) - x50 := (x12 + x49) - x51 := (x11 + x50) - x52 := (x10 + x51) - x53 := (x9 + x52) - x54 := (x7 + uint64(x8)) - x55 := (x6 + x54) - x56 := (x5 + x55) - x57 := (x4 + x56) - x58 := (x3 + x57) - x59 := (x2 + x58) - x60 := (x1 + x59) - out1[0] = x39 - out1[1] = x46 - out1[2] = x53 - out1[3] = x60 -} - -// The function fiat_sc255_set_one returns the field element one in the Montgomery domain. -// -// Postconditions: -// eval (from_montgomery out1) mod m = 1 mod m -// 0 ≤ eval out1 < m -// -func fiat_sc255_set_one(out1 *fiat_sc255_montgomery_domain_field_element) { - out1[0] = 0xd6ec31748d98951d - out1[1] = 0xc6ef5bf4737dcf70 - out1[2] = 0xfffffffffffffffe - out1[3] = 0xfffffffffffffff -} - -// The function fiat_sc255_msat returns the saturated representation of the prime modulus. -// -// Postconditions: -// twos_complement_eval out1 = m -// 0 ≤ eval out1 < m -// -// Output Bounds: -// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -func fiat_sc255_msat(out1 *[5]uint64) { - out1[0] = 0x5812631a5cf5d3ed - out1[1] = 0x14def9dea2f79cd6 - out1[2] = uint64(0x0) - out1[3] = 0x1000000000000000 - out1[4] = uint64(0x0) -} - -// The function fiat_sc255_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). -// -// Postconditions: -// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) -// 0 ≤ eval out1 < m -// -// Output Bounds: -// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -func fiat_sc255_divstep_precomp(out1 *[4]uint64) { - out1[0] = 0xd70af84436a7cb92 - out1[1] = 0x5f71c978b0b8b159 - out1[2] = 0xe76d816974947f1a - out1[3] = 0x19a2d36f193e4ff -} - -// The function fiat_sc255_divstep computes a divstep. -// -// Preconditions: -// 0 ≤ eval arg4 < m -// 0 ≤ eval arg5 < m -// Postconditions: -// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) -// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) -// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) -// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) -// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) -// 0 ≤ eval out5 < m -// 0 ≤ eval out5 < m -// 0 ≤ eval out2 < m -// 0 ≤ eval out3 < m -// -// Input Bounds: -// arg1: [0x0 ~> 0xffffffffffffffff] -// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// Output Bounds: -// out1: [0x0 ~> 0xffffffffffffffff] -// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] -func fiat_sc255_divstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4]uint64, out5 *[4]uint64, arg1 uint64, arg2 *[5]uint64, arg3 *[5]uint64, arg4 *[4]uint64, arg5 *[4]uint64) { - var x1 uint64 - x1, _ = fiat_sc255_addcarryx_u64((^arg1), uint64(0x1), 0x0) - x3 := (fiat_sc255_uint1((x1 >> 63)) & (fiat_sc255_uint1(arg3[0]) & 0x1)) - var x4 uint64 - x4, _ = fiat_sc255_addcarryx_u64((^arg1), uint64(0x1), 0x0) - var x6 uint64 - fiat_sc255_cmovznz_u64(&x6, x3, arg1, x4) - var x7 uint64 - fiat_sc255_cmovznz_u64(&x7, x3, arg2[0], arg3[0]) - var x8 uint64 - fiat_sc255_cmovznz_u64(&x8, x3, arg2[1], arg3[1]) - var x9 uint64 - fiat_sc255_cmovznz_u64(&x9, x3, arg2[2], arg3[2]) - var x10 uint64 - fiat_sc255_cmovznz_u64(&x10, x3, arg2[3], arg3[3]) - var x11 uint64 - fiat_sc255_cmovznz_u64(&x11, x3, arg2[4], arg3[4]) - var x12 uint64 - var x13 fiat_sc255_uint1 - x12, x13 = fiat_sc255_addcarryx_u64(uint64(0x1), (^arg2[0]), 0x0) - var x14 uint64 - var x15 fiat_sc255_uint1 - x14, x15 = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[1]), x13) - var x16 uint64 - var x17 fiat_sc255_uint1 - x16, x17 = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[2]), x15) - var x18 uint64 - var x19 fiat_sc255_uint1 - x18, x19 = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[3]), x17) - var x20 uint64 - x20, _ = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[4]), x19) - var x22 uint64 - fiat_sc255_cmovznz_u64(&x22, x3, arg3[0], x12) - var x23 uint64 - fiat_sc255_cmovznz_u64(&x23, x3, arg3[1], x14) - var x24 uint64 - fiat_sc255_cmovznz_u64(&x24, x3, arg3[2], x16) - var x25 uint64 - fiat_sc255_cmovznz_u64(&x25, x3, arg3[3], x18) - var x26 uint64 - fiat_sc255_cmovznz_u64(&x26, x3, arg3[4], x20) - var x27 uint64 - fiat_sc255_cmovznz_u64(&x27, x3, arg4[0], arg5[0]) - var x28 uint64 - fiat_sc255_cmovznz_u64(&x28, x3, arg4[1], arg5[1]) - var x29 uint64 - fiat_sc255_cmovznz_u64(&x29, x3, arg4[2], arg5[2]) - var x30 uint64 - fiat_sc255_cmovznz_u64(&x30, x3, arg4[3], arg5[3]) - var x31 uint64 - var x32 fiat_sc255_uint1 - x31, x32 = fiat_sc255_addcarryx_u64(x27, x27, 0x0) - var x33 uint64 - var x34 fiat_sc255_uint1 - x33, x34 = fiat_sc255_addcarryx_u64(x28, x28, x32) - var x35 uint64 - var x36 fiat_sc255_uint1 - x35, x36 = fiat_sc255_addcarryx_u64(x29, x29, x34) - var x37 uint64 - var x38 fiat_sc255_uint1 - x37, x38 = fiat_sc255_addcarryx_u64(x30, x30, x36) - var x39 uint64 - var x40 fiat_sc255_uint1 - x39, x40 = fiat_sc255_subborrowx_u64(x31, 0x5812631a5cf5d3ed, 0x0) - var x41 uint64 - var x42 fiat_sc255_uint1 - x41, x42 = fiat_sc255_subborrowx_u64(x33, 0x14def9dea2f79cd6, x40) - var x43 uint64 - var x44 fiat_sc255_uint1 - x43, x44 = fiat_sc255_subborrowx_u64(x35, uint64(0x0), x42) - var x45 uint64 - var x46 fiat_sc255_uint1 - x45, x46 = fiat_sc255_subborrowx_u64(x37, 0x1000000000000000, x44) - var x48 fiat_sc255_uint1 - _, x48 = fiat_sc255_subborrowx_u64(uint64(x38), uint64(0x0), x46) - x49 := arg4[3] - x50 := arg4[2] - x51 := arg4[1] - x52 := arg4[0] - var x53 uint64 - var x54 fiat_sc255_uint1 - x53, x54 = fiat_sc255_subborrowx_u64(uint64(0x0), x52, 0x0) - var x55 uint64 - var x56 fiat_sc255_uint1 - x55, x56 = fiat_sc255_subborrowx_u64(uint64(0x0), x51, x54) - var x57 uint64 - var x58 fiat_sc255_uint1 - x57, x58 = fiat_sc255_subborrowx_u64(uint64(0x0), x50, x56) - var x59 uint64 - var x60 fiat_sc255_uint1 - x59, x60 = fiat_sc255_subborrowx_u64(uint64(0x0), x49, x58) - var x61 uint64 - fiat_sc255_cmovznz_u64(&x61, x60, uint64(0x0), 0xffffffffffffffff) - var x62 uint64 - var x63 fiat_sc255_uint1 - x62, x63 = fiat_sc255_addcarryx_u64(x53, (x61 & 0x5812631a5cf5d3ed), 0x0) - var x64 uint64 - var x65 fiat_sc255_uint1 - x64, x65 = fiat_sc255_addcarryx_u64(x55, (x61 & 0x14def9dea2f79cd6), x63) - var x66 uint64 - var x67 fiat_sc255_uint1 - x66, x67 = fiat_sc255_addcarryx_u64(x57, uint64(0x0), x65) - var x68 uint64 - x68, _ = fiat_sc255_addcarryx_u64(x59, (x61 & 0x1000000000000000), x67) - var x70 uint64 - fiat_sc255_cmovznz_u64(&x70, x3, arg5[0], x62) - var x71 uint64 - fiat_sc255_cmovznz_u64(&x71, x3, arg5[1], x64) - var x72 uint64 - fiat_sc255_cmovznz_u64(&x72, x3, arg5[2], x66) - var x73 uint64 - fiat_sc255_cmovznz_u64(&x73, x3, arg5[3], x68) - x74 := (fiat_sc255_uint1(x22) & 0x1) - var x75 uint64 - fiat_sc255_cmovznz_u64(&x75, x74, uint64(0x0), x7) - var x76 uint64 - fiat_sc255_cmovznz_u64(&x76, x74, uint64(0x0), x8) - var x77 uint64 - fiat_sc255_cmovznz_u64(&x77, x74, uint64(0x0), x9) - var x78 uint64 - fiat_sc255_cmovznz_u64(&x78, x74, uint64(0x0), x10) - var x79 uint64 - fiat_sc255_cmovznz_u64(&x79, x74, uint64(0x0), x11) - var x80 uint64 - var x81 fiat_sc255_uint1 - x80, x81 = fiat_sc255_addcarryx_u64(x22, x75, 0x0) - var x82 uint64 - var x83 fiat_sc255_uint1 - x82, x83 = fiat_sc255_addcarryx_u64(x23, x76, x81) - var x84 uint64 - var x85 fiat_sc255_uint1 - x84, x85 = fiat_sc255_addcarryx_u64(x24, x77, x83) - var x86 uint64 - var x87 fiat_sc255_uint1 - x86, x87 = fiat_sc255_addcarryx_u64(x25, x78, x85) - var x88 uint64 - x88, _ = fiat_sc255_addcarryx_u64(x26, x79, x87) - var x90 uint64 - fiat_sc255_cmovznz_u64(&x90, x74, uint64(0x0), x27) - var x91 uint64 - fiat_sc255_cmovznz_u64(&x91, x74, uint64(0x0), x28) - var x92 uint64 - fiat_sc255_cmovznz_u64(&x92, x74, uint64(0x0), x29) - var x93 uint64 - fiat_sc255_cmovznz_u64(&x93, x74, uint64(0x0), x30) - var x94 uint64 - var x95 fiat_sc255_uint1 - x94, x95 = fiat_sc255_addcarryx_u64(x70, x90, 0x0) - var x96 uint64 - var x97 fiat_sc255_uint1 - x96, x97 = fiat_sc255_addcarryx_u64(x71, x91, x95) - var x98 uint64 - var x99 fiat_sc255_uint1 - x98, x99 = fiat_sc255_addcarryx_u64(x72, x92, x97) - var x100 uint64 - var x101 fiat_sc255_uint1 - x100, x101 = fiat_sc255_addcarryx_u64(x73, x93, x99) - var x102 uint64 - var x103 fiat_sc255_uint1 - x102, x103 = fiat_sc255_subborrowx_u64(x94, 0x5812631a5cf5d3ed, 0x0) - var x104 uint64 - var x105 fiat_sc255_uint1 - x104, x105 = fiat_sc255_subborrowx_u64(x96, 0x14def9dea2f79cd6, x103) - var x106 uint64 - var x107 fiat_sc255_uint1 - x106, x107 = fiat_sc255_subborrowx_u64(x98, uint64(0x0), x105) - var x108 uint64 - var x109 fiat_sc255_uint1 - x108, x109 = fiat_sc255_subborrowx_u64(x100, 0x1000000000000000, x107) - var x111 fiat_sc255_uint1 - _, x111 = fiat_sc255_subborrowx_u64(uint64(x101), uint64(0x0), x109) - var x112 uint64 - x112, _ = fiat_sc255_addcarryx_u64(x6, uint64(0x1), 0x0) - x114 := ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)) - x115 := ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)) - x116 := ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)) - x117 := ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)) - x118 := ((x88 & 0x8000000000000000) | (x88 >> 1)) - var x119 uint64 - fiat_sc255_cmovznz_u64(&x119, x48, x39, x31) - var x120 uint64 - fiat_sc255_cmovznz_u64(&x120, x48, x41, x33) - var x121 uint64 - fiat_sc255_cmovznz_u64(&x121, x48, x43, x35) - var x122 uint64 - fiat_sc255_cmovznz_u64(&x122, x48, x45, x37) - var x123 uint64 - fiat_sc255_cmovznz_u64(&x123, x111, x102, x94) - var x124 uint64 - fiat_sc255_cmovznz_u64(&x124, x111, x104, x96) - var x125 uint64 - fiat_sc255_cmovznz_u64(&x125, x111, x106, x98) - var x126 uint64 - fiat_sc255_cmovznz_u64(&x126, x111, x108, x100) - *out1 = x112 - out2[0] = x7 - out2[1] = x8 - out2[2] = x9 - out2[3] = x10 - out2[4] = x11 - out3[0] = x114 - out3[1] = x115 - out3[2] = x116 - out3[3] = x117 - out3[4] = x118 - out4[0] = x119 - out4[1] = x120 - out4[2] = x121 - out4[3] = x122 - out5[0] = x123 - out5[1] = x124 - out5[2] = x125 - out5[3] = x126 -} diff --git a/scalar.go b/scalar.go index bb4e791..d888de6 100644 --- a/scalar.go +++ b/scalar.go @@ -22,9 +22,37 @@ import ( type Scalar struct { // s is the scalar in the Montgomery domain, in the format of the // fiat-crypto implementation. - s fiat_sc255_montgomery_domain_field_element + s fiatScalarMontgomeryDomainFieldElement } +// The field implementation in scalar_fiat.go is generated by the fiat-crypto +// project (https://github.com/mit-plv/fiat-crypto) at version v0.0.9 (23d2dbc) +// from a formally verified model. +// +// fiat-crypto code comes under the following license. +// +// Copyright (c) 2015-2020 The fiat-crypto Authors. All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// 1. Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// +// THIS SOFTWARE IS PROVIDED BY the fiat-crypto authors "AS IS" +// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, +// THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +// PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL Berkeley Software Design, +// Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, +// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +// LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +// NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// + // NewScalar returns a new zero Scalar. func NewScalar() *Scalar { return &Scalar{} @@ -41,28 +69,28 @@ func (s *Scalar) MultiplyAdd(x, y, z *Scalar) *Scalar { // Add sets s = x + y mod l, and returns s. func (s *Scalar) Add(x, y *Scalar) *Scalar { // s = 1 * x + y mod l - fiat_sc255_add(&s.s, &x.s, &y.s) + fiatScalarAdd(&s.s, &x.s, &y.s) return s } // Subtract sets s = x - y mod l, and returns s. func (s *Scalar) Subtract(x, y *Scalar) *Scalar { // s = -1 * y + x mod l - fiat_sc255_sub(&s.s, &x.s, &y.s) + fiatScalarSub(&s.s, &x.s, &y.s) return s } // Negate sets s = -x mod l, and returns s. func (s *Scalar) Negate(x *Scalar) *Scalar { // s = -1 * x + 0 mod l - fiat_sc255_opp(&s.s, &x.s) + fiatScalarOpp(&s.s, &x.s) return s } // Multiply sets s = x * y mod l, and returns s. func (s *Scalar) Multiply(x, y *Scalar) *Scalar { // s = x * y + 0 mod l - fiat_sc255_mul(&s.s, &x.s, &y.s) + fiatScalarMul(&s.s, &x.s, &y.s) return s } @@ -87,8 +115,8 @@ func (s *Scalar) SetUniformBytes(x []byte) (*Scalar, error) { var reduced [32]byte scReduce(&reduced, (*[64]byte)(x)) - fiat_sc255_from_bytes((*[4]uint64)(&s.s), &reduced) - fiat_sc255_to_montgomery(&s.s, (*fiat_sc255_non_montgomery_domain_field_element)(&s.s)) + fiatScalarFromBytes((*[4]uint64)(&s.s), &reduced) + fiatScalarToMontgomery(&s.s, (*fiatScalarNonMontgomeryDomainFieldElement)(&s.s)) return s, nil } @@ -104,8 +132,8 @@ func (s *Scalar) SetCanonicalBytes(x []byte) (*Scalar, error) { return nil, errors.New("invalid scalar encoding") } - fiat_sc255_from_bytes((*[4]uint64)(&s.s), (*[32]byte)(x)) - fiat_sc255_to_montgomery(&s.s, (*fiat_sc255_non_montgomery_domain_field_element)(&s.s)) + fiatScalarFromBytes((*[4]uint64)(&s.s), (*[32]byte)(x)) + fiatScalarToMontgomery(&s.s, (*fiatScalarNonMontgomeryDomainFieldElement)(&s.s)) return s, nil } @@ -161,8 +189,8 @@ func (s *Scalar) SetBytesWithClamping(x []byte) (*Scalar, error) { var reduced [32]byte scReduce(&reduced, &wideBytes) - fiat_sc255_from_bytes((*[4]uint64)(&s.s), &reduced) - fiat_sc255_to_montgomery(&s.s, (*fiat_sc255_non_montgomery_domain_field_element)(&s.s)) + fiatScalarFromBytes((*[4]uint64)(&s.s), &reduced) + fiatScalarToMontgomery(&s.s, (*fiatScalarNonMontgomeryDomainFieldElement)(&s.s)) return s, nil } @@ -176,18 +204,18 @@ func (s *Scalar) Bytes() []byte { } func (s *Scalar) bytes(out *[32]byte) []byte { - var ss fiat_sc255_non_montgomery_domain_field_element - fiat_sc255_from_montgomery(&ss, &s.s) - fiat_sc255_to_bytes(out, (*[4]uint64)(&ss)) + var ss fiatScalarNonMontgomeryDomainFieldElement + fiatScalarFromMontgomery(&ss, &s.s) + fiatScalarToBytes(out, (*[4]uint64)(&ss)) return out[:] } // Equal returns 1 if s and t are equal, and 0 otherwise. func (s *Scalar) Equal(t *Scalar) int { - var diff fiat_sc255_montgomery_domain_field_element - fiat_sc255_sub(&diff, &s.s, &t.s) + var diff fiatScalarMontgomeryDomainFieldElement + fiatScalarSub(&diff, &s.s, &t.s) var nonzero uint64 - fiat_sc255_nonzero(&nonzero, (*[4]uint64)(&diff)) + fiatScalarNonzero(&nonzero, (*[4]uint64)(&diff)) nonzero |= nonzero >> 32 nonzero |= nonzero >> 16 nonzero |= nonzero >> 8 diff --git a/scalar_fiat.go b/scalar_fiat.go new file mode 100644 index 0000000..49e2e4d --- /dev/null +++ b/scalar_fiat.go @@ -0,0 +1,1113 @@ +// Code generated by Fiat Cryptography. DO NOT EDIT. +// +// Autogenerated: word_by_word_montgomery --lang Go --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name edwards25519 Scalar 64 '2^252 + 27742317777372353535851937790883648493' mul add sub opp nonzero from_montgomery to_montgomery to_bytes from_bytes +// +// curve description: Scalar +// +// machine_wordsize = 64 (from "64") +// +// requested operations: mul, add, sub, opp, nonzero, from_montgomery, to_montgomery, to_bytes, from_bytes +// +// m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493") +// +// +// +// NOTE: In addition to the bounds specified above each function, all +// +// functions synthesized for this Montgomery arithmetic require the +// +// input to be strictly less than the prime modulus (m), and also +// +// require the input to be in the unique saturated representation. +// +// All functions also ensure that these two properties are true of +// +// return values. +// +// +// +// Computed values: +// +// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +// +// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +// +// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +// +// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +package edwards25519 + +import "math/bits" + +type fiatScalarUint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 +type fiatScalarInt1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 + +// The type fiatScalarMontgomeryDomainFieldElement is a field element in the Montgomery domain. +// +// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +type fiatScalarMontgomeryDomainFieldElement [4]uint64 + +// The type fiatScalarNonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain. +// +// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +type fiatScalarNonMontgomeryDomainFieldElement [4]uint64 + +// fiatScalarCmovznzU64 is a single-word conditional move. +// +// Postconditions: +// out1 = (if arg1 = 0 then arg2 else arg3) +// +// Input Bounds: +// arg1: [0x0 ~> 0x1] +// arg2: [0x0 ~> 0xffffffffffffffff] +// arg3: [0x0 ~> 0xffffffffffffffff] +// Output Bounds: +// out1: [0x0 ~> 0xffffffffffffffff] +func fiatScalarCmovznzU64(out1 *uint64, arg1 fiatScalarUint1, arg2 uint64, arg3 uint64) { + x1 := (uint64(arg1) * 0xffffffffffffffff) + x2 := ((x1 & arg3) | ((^x1) & arg2)) + *out1 = x2 +} + +// fiatScalarMul multiplies two field elements in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// 0 ≤ eval arg2 < m +// Postconditions: +// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +// 0 ≤ eval out1 < m +// +func fiatScalarMul(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement, arg2 *fiatScalarMontgomeryDomainFieldElement) { + x1 := arg1[1] + x2 := arg1[2] + x3 := arg1[3] + x4 := arg1[0] + var x5 uint64 + var x6 uint64 + x6, x5 = bits.Mul64(x4, arg2[3]) + var x7 uint64 + var x8 uint64 + x8, x7 = bits.Mul64(x4, arg2[2]) + var x9 uint64 + var x10 uint64 + x10, x9 = bits.Mul64(x4, arg2[1]) + var x11 uint64 + var x12 uint64 + x12, x11 = bits.Mul64(x4, arg2[0]) + var x13 uint64 + var x14 uint64 + x13, x14 = bits.Add64(x12, x9, uint64(0x0)) + var x15 uint64 + var x16 uint64 + x15, x16 = bits.Add64(x10, x7, uint64(fiatScalarUint1(x14))) + var x17 uint64 + var x18 uint64 + x17, x18 = bits.Add64(x8, x5, uint64(fiatScalarUint1(x16))) + x19 := (uint64(fiatScalarUint1(x18)) + x6) + var x20 uint64 + _, x20 = bits.Mul64(x11, 0xd2b51da312547e1b) + var x22 uint64 + var x23 uint64 + x23, x22 = bits.Mul64(x20, 0x1000000000000000) + var x24 uint64 + var x25 uint64 + x25, x24 = bits.Mul64(x20, 0x14def9dea2f79cd6) + var x26 uint64 + var x27 uint64 + x27, x26 = bits.Mul64(x20, 0x5812631a5cf5d3ed) + var x28 uint64 + var x29 uint64 + x28, x29 = bits.Add64(x27, x24, uint64(0x0)) + x30 := (uint64(fiatScalarUint1(x29)) + x25) + var x32 uint64 + _, x32 = bits.Add64(x11, x26, uint64(0x0)) + var x33 uint64 + var x34 uint64 + x33, x34 = bits.Add64(x13, x28, uint64(fiatScalarUint1(x32))) + var x35 uint64 + var x36 uint64 + x35, x36 = bits.Add64(x15, x30, uint64(fiatScalarUint1(x34))) + var x37 uint64 + var x38 uint64 + x37, x38 = bits.Add64(x17, x22, uint64(fiatScalarUint1(x36))) + var x39 uint64 + var x40 uint64 + x39, x40 = bits.Add64(x19, x23, uint64(fiatScalarUint1(x38))) + var x41 uint64 + var x42 uint64 + x42, x41 = bits.Mul64(x1, arg2[3]) + var x43 uint64 + var x44 uint64 + x44, x43 = bits.Mul64(x1, arg2[2]) + var x45 uint64 + var x46 uint64 + x46, x45 = bits.Mul64(x1, arg2[1]) + var x47 uint64 + var x48 uint64 + x48, x47 = bits.Mul64(x1, arg2[0]) + var x49 uint64 + var x50 uint64 + x49, x50 = bits.Add64(x48, x45, uint64(0x0)) + var x51 uint64 + var x52 uint64 + x51, x52 = bits.Add64(x46, x43, uint64(fiatScalarUint1(x50))) + var x53 uint64 + var x54 uint64 + x53, x54 = bits.Add64(x44, x41, uint64(fiatScalarUint1(x52))) + x55 := (uint64(fiatScalarUint1(x54)) + x42) + var x56 uint64 + var x57 uint64 + x56, x57 = bits.Add64(x33, x47, uint64(0x0)) + var x58 uint64 + var x59 uint64 + x58, x59 = bits.Add64(x35, x49, uint64(fiatScalarUint1(x57))) + var x60 uint64 + var x61 uint64 + x60, x61 = bits.Add64(x37, x51, uint64(fiatScalarUint1(x59))) + var x62 uint64 + var x63 uint64 + x62, x63 = bits.Add64(x39, x53, uint64(fiatScalarUint1(x61))) + var x64 uint64 + var x65 uint64 + x64, x65 = bits.Add64(uint64(fiatScalarUint1(x40)), x55, uint64(fiatScalarUint1(x63))) + var x66 uint64 + _, x66 = bits.Mul64(x56, 0xd2b51da312547e1b) + var x68 uint64 + var x69 uint64 + x69, x68 = bits.Mul64(x66, 0x1000000000000000) + var x70 uint64 + var x71 uint64 + x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6) + var x72 uint64 + var x73 uint64 + x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed) + var x74 uint64 + var x75 uint64 + x74, x75 = bits.Add64(x73, x70, uint64(0x0)) + x76 := (uint64(fiatScalarUint1(x75)) + x71) + var x78 uint64 + _, x78 = bits.Add64(x56, x72, uint64(0x0)) + var x79 uint64 + var x80 uint64 + x79, x80 = bits.Add64(x58, x74, uint64(fiatScalarUint1(x78))) + var x81 uint64 + var x82 uint64 + x81, x82 = bits.Add64(x60, x76, uint64(fiatScalarUint1(x80))) + var x83 uint64 + var x84 uint64 + x83, x84 = bits.Add64(x62, x68, uint64(fiatScalarUint1(x82))) + var x85 uint64 + var x86 uint64 + x85, x86 = bits.Add64(x64, x69, uint64(fiatScalarUint1(x84))) + x87 := (uint64(fiatScalarUint1(x86)) + uint64(fiatScalarUint1(x65))) + var x88 uint64 + var x89 uint64 + x89, x88 = bits.Mul64(x2, arg2[3]) + var x90 uint64 + var x91 uint64 + x91, x90 = bits.Mul64(x2, arg2[2]) + var x92 uint64 + var x93 uint64 + x93, x92 = bits.Mul64(x2, arg2[1]) + var x94 uint64 + var x95 uint64 + x95, x94 = bits.Mul64(x2, arg2[0]) + var x96 uint64 + var x97 uint64 + x96, x97 = bits.Add64(x95, x92, uint64(0x0)) + var x98 uint64 + var x99 uint64 + x98, x99 = bits.Add64(x93, x90, uint64(fiatScalarUint1(x97))) + var x100 uint64 + var x101 uint64 + x100, x101 = bits.Add64(x91, x88, uint64(fiatScalarUint1(x99))) + x102 := (uint64(fiatScalarUint1(x101)) + x89) + var x103 uint64 + var x104 uint64 + x103, x104 = bits.Add64(x79, x94, uint64(0x0)) + var x105 uint64 + var x106 uint64 + x105, x106 = bits.Add64(x81, x96, uint64(fiatScalarUint1(x104))) + var x107 uint64 + var x108 uint64 + x107, x108 = bits.Add64(x83, x98, uint64(fiatScalarUint1(x106))) + var x109 uint64 + var x110 uint64 + x109, x110 = bits.Add64(x85, x100, uint64(fiatScalarUint1(x108))) + var x111 uint64 + var x112 uint64 + x111, x112 = bits.Add64(x87, x102, uint64(fiatScalarUint1(x110))) + var x113 uint64 + _, x113 = bits.Mul64(x103, 0xd2b51da312547e1b) + var x115 uint64 + var x116 uint64 + x116, x115 = bits.Mul64(x113, 0x1000000000000000) + var x117 uint64 + var x118 uint64 + x118, x117 = bits.Mul64(x113, 0x14def9dea2f79cd6) + var x119 uint64 + var x120 uint64 + x120, x119 = bits.Mul64(x113, 0x5812631a5cf5d3ed) + var x121 uint64 + var x122 uint64 + x121, x122 = bits.Add64(x120, x117, uint64(0x0)) + x123 := (uint64(fiatScalarUint1(x122)) + x118) + var x125 uint64 + _, x125 = bits.Add64(x103, x119, uint64(0x0)) + var x126 uint64 + var x127 uint64 + x126, x127 = bits.Add64(x105, x121, uint64(fiatScalarUint1(x125))) + var x128 uint64 + var x129 uint64 + x128, x129 = bits.Add64(x107, x123, uint64(fiatScalarUint1(x127))) + var x130 uint64 + var x131 uint64 + x130, x131 = bits.Add64(x109, x115, uint64(fiatScalarUint1(x129))) + var x132 uint64 + var x133 uint64 + x132, x133 = bits.Add64(x111, x116, uint64(fiatScalarUint1(x131))) + x134 := (uint64(fiatScalarUint1(x133)) + uint64(fiatScalarUint1(x112))) + var x135 uint64 + var x136 uint64 + x136, x135 = bits.Mul64(x3, arg2[3]) + var x137 uint64 + var x138 uint64 + x138, x137 = bits.Mul64(x3, arg2[2]) + var x139 uint64 + var x140 uint64 + x140, x139 = bits.Mul64(x3, arg2[1]) + var x141 uint64 + var x142 uint64 + x142, x141 = bits.Mul64(x3, arg2[0]) + var x143 uint64 + var x144 uint64 + x143, x144 = bits.Add64(x142, x139, uint64(0x0)) + var x145 uint64 + var x146 uint64 + x145, x146 = bits.Add64(x140, x137, uint64(fiatScalarUint1(x144))) + var x147 uint64 + var x148 uint64 + x147, x148 = bits.Add64(x138, x135, uint64(fiatScalarUint1(x146))) + x149 := (uint64(fiatScalarUint1(x148)) + x136) + var x150 uint64 + var x151 uint64 + x150, x151 = bits.Add64(x126, x141, uint64(0x0)) + var x152 uint64 + var x153 uint64 + x152, x153 = bits.Add64(x128, x143, uint64(fiatScalarUint1(x151))) + var x154 uint64 + var x155 uint64 + x154, x155 = bits.Add64(x130, x145, uint64(fiatScalarUint1(x153))) + var x156 uint64 + var x157 uint64 + x156, x157 = bits.Add64(x132, x147, uint64(fiatScalarUint1(x155))) + var x158 uint64 + var x159 uint64 + x158, x159 = bits.Add64(x134, x149, uint64(fiatScalarUint1(x157))) + var x160 uint64 + _, x160 = bits.Mul64(x150, 0xd2b51da312547e1b) + var x162 uint64 + var x163 uint64 + x163, x162 = bits.Mul64(x160, 0x1000000000000000) + var x164 uint64 + var x165 uint64 + x165, x164 = bits.Mul64(x160, 0x14def9dea2f79cd6) + var x166 uint64 + var x167 uint64 + x167, x166 = bits.Mul64(x160, 0x5812631a5cf5d3ed) + var x168 uint64 + var x169 uint64 + x168, x169 = bits.Add64(x167, x164, uint64(0x0)) + x170 := (uint64(fiatScalarUint1(x169)) + x165) + var x172 uint64 + _, x172 = bits.Add64(x150, x166, uint64(0x0)) + var x173 uint64 + var x174 uint64 + x173, x174 = bits.Add64(x152, x168, uint64(fiatScalarUint1(x172))) + var x175 uint64 + var x176 uint64 + x175, x176 = bits.Add64(x154, x170, uint64(fiatScalarUint1(x174))) + var x177 uint64 + var x178 uint64 + x177, x178 = bits.Add64(x156, x162, uint64(fiatScalarUint1(x176))) + var x179 uint64 + var x180 uint64 + x179, x180 = bits.Add64(x158, x163, uint64(fiatScalarUint1(x178))) + x181 := (uint64(fiatScalarUint1(x180)) + uint64(fiatScalarUint1(x159))) + var x182 uint64 + var x183 uint64 + x182, x183 = bits.Sub64(x173, 0x5812631a5cf5d3ed, uint64(0x0)) + var x184 uint64 + var x185 uint64 + x184, x185 = bits.Sub64(x175, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x183))) + var x186 uint64 + var x187 uint64 + x186, x187 = bits.Sub64(x177, uint64(0x0), uint64(fiatScalarUint1(x185))) + var x188 uint64 + var x189 uint64 + x188, x189 = bits.Sub64(x179, 0x1000000000000000, uint64(fiatScalarUint1(x187))) + var x191 uint64 + _, x191 = bits.Sub64(x181, uint64(0x0), uint64(fiatScalarUint1(x189))) + var x192 uint64 + fiatScalarCmovznzU64(&x192, fiatScalarUint1(x191), x182, x173) + var x193 uint64 + fiatScalarCmovznzU64(&x193, fiatScalarUint1(x191), x184, x175) + var x194 uint64 + fiatScalarCmovznzU64(&x194, fiatScalarUint1(x191), x186, x177) + var x195 uint64 + fiatScalarCmovznzU64(&x195, fiatScalarUint1(x191), x188, x179) + out1[0] = x192 + out1[1] = x193 + out1[2] = x194 + out1[3] = x195 +} + +// fiatScalarAdd adds two field elements in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// 0 ≤ eval arg2 < m +// Postconditions: +// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +// 0 ≤ eval out1 < m +// +func fiatScalarAdd(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement, arg2 *fiatScalarMontgomeryDomainFieldElement) { + var x1 uint64 + var x2 uint64 + x1, x2 = bits.Add64(arg1[0], arg2[0], uint64(0x0)) + var x3 uint64 + var x4 uint64 + x3, x4 = bits.Add64(arg1[1], arg2[1], uint64(fiatScalarUint1(x2))) + var x5 uint64 + var x6 uint64 + x5, x6 = bits.Add64(arg1[2], arg2[2], uint64(fiatScalarUint1(x4))) + var x7 uint64 + var x8 uint64 + x7, x8 = bits.Add64(arg1[3], arg2[3], uint64(fiatScalarUint1(x6))) + var x9 uint64 + var x10 uint64 + x9, x10 = bits.Sub64(x1, 0x5812631a5cf5d3ed, uint64(0x0)) + var x11 uint64 + var x12 uint64 + x11, x12 = bits.Sub64(x3, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x10))) + var x13 uint64 + var x14 uint64 + x13, x14 = bits.Sub64(x5, uint64(0x0), uint64(fiatScalarUint1(x12))) + var x15 uint64 + var x16 uint64 + x15, x16 = bits.Sub64(x7, 0x1000000000000000, uint64(fiatScalarUint1(x14))) + var x18 uint64 + _, x18 = bits.Sub64(uint64(fiatScalarUint1(x8)), uint64(0x0), uint64(fiatScalarUint1(x16))) + var x19 uint64 + fiatScalarCmovznzU64(&x19, fiatScalarUint1(x18), x9, x1) + var x20 uint64 + fiatScalarCmovznzU64(&x20, fiatScalarUint1(x18), x11, x3) + var x21 uint64 + fiatScalarCmovznzU64(&x21, fiatScalarUint1(x18), x13, x5) + var x22 uint64 + fiatScalarCmovznzU64(&x22, fiatScalarUint1(x18), x15, x7) + out1[0] = x19 + out1[1] = x20 + out1[2] = x21 + out1[3] = x22 +} + +// fiatScalarSub subtracts two field elements in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// 0 ≤ eval arg2 < m +// Postconditions: +// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +// 0 ≤ eval out1 < m +// +func fiatScalarSub(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement, arg2 *fiatScalarMontgomeryDomainFieldElement) { + var x1 uint64 + var x2 uint64 + x1, x2 = bits.Sub64(arg1[0], arg2[0], uint64(0x0)) + var x3 uint64 + var x4 uint64 + x3, x4 = bits.Sub64(arg1[1], arg2[1], uint64(fiatScalarUint1(x2))) + var x5 uint64 + var x6 uint64 + x5, x6 = bits.Sub64(arg1[2], arg2[2], uint64(fiatScalarUint1(x4))) + var x7 uint64 + var x8 uint64 + x7, x8 = bits.Sub64(arg1[3], arg2[3], uint64(fiatScalarUint1(x6))) + var x9 uint64 + fiatScalarCmovznzU64(&x9, fiatScalarUint1(x8), uint64(0x0), 0xffffffffffffffff) + var x10 uint64 + var x11 uint64 + x10, x11 = bits.Add64(x1, (x9 & 0x5812631a5cf5d3ed), uint64(0x0)) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(x3, (x9 & 0x14def9dea2f79cd6), uint64(fiatScalarUint1(x11))) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(x5, uint64(0x0), uint64(fiatScalarUint1(x13))) + var x16 uint64 + x16, _ = bits.Add64(x7, (x9 & 0x1000000000000000), uint64(fiatScalarUint1(x15))) + out1[0] = x10 + out1[1] = x12 + out1[2] = x14 + out1[3] = x16 +} + +// fiatScalarOpp negates a field element in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +// 0 ≤ eval out1 < m +// +func fiatScalarOpp(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement) { + var x1 uint64 + var x2 uint64 + x1, x2 = bits.Sub64(uint64(0x0), arg1[0], uint64(0x0)) + var x3 uint64 + var x4 uint64 + x3, x4 = bits.Sub64(uint64(0x0), arg1[1], uint64(fiatScalarUint1(x2))) + var x5 uint64 + var x6 uint64 + x5, x6 = bits.Sub64(uint64(0x0), arg1[2], uint64(fiatScalarUint1(x4))) + var x7 uint64 + var x8 uint64 + x7, x8 = bits.Sub64(uint64(0x0), arg1[3], uint64(fiatScalarUint1(x6))) + var x9 uint64 + fiatScalarCmovznzU64(&x9, fiatScalarUint1(x8), uint64(0x0), 0xffffffffffffffff) + var x10 uint64 + var x11 uint64 + x10, x11 = bits.Add64(x1, (x9 & 0x5812631a5cf5d3ed), uint64(0x0)) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(x3, (x9 & 0x14def9dea2f79cd6), uint64(fiatScalarUint1(x11))) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(x5, uint64(0x0), uint64(fiatScalarUint1(x13))) + var x16 uint64 + x16, _ = bits.Add64(x7, (x9 & 0x1000000000000000), uint64(fiatScalarUint1(x15))) + out1[0] = x10 + out1[1] = x12 + out1[2] = x14 + out1[3] = x16 +} + +// fiatScalarNonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +// +// Input Bounds: +// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// Output Bounds: +// out1: [0x0 ~> 0xffffffffffffffff] +func fiatScalarNonzero(out1 *uint64, arg1 *[4]uint64) { + x1 := (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))) + *out1 = x1 +} + +// fiatScalarFromMontgomery translates a field element out of the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +// 0 ≤ eval out1 < m +// +func fiatScalarFromMontgomery(out1 *fiatScalarNonMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement) { + x1 := arg1[0] + var x2 uint64 + _, x2 = bits.Mul64(x1, 0xd2b51da312547e1b) + var x4 uint64 + var x5 uint64 + x5, x4 = bits.Mul64(x2, 0x1000000000000000) + var x6 uint64 + var x7 uint64 + x7, x6 = bits.Mul64(x2, 0x14def9dea2f79cd6) + var x8 uint64 + var x9 uint64 + x9, x8 = bits.Mul64(x2, 0x5812631a5cf5d3ed) + var x10 uint64 + var x11 uint64 + x10, x11 = bits.Add64(x9, x6, uint64(0x0)) + var x13 uint64 + _, x13 = bits.Add64(x1, x8, uint64(0x0)) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(uint64(0x0), x10, uint64(fiatScalarUint1(x13))) + var x16 uint64 + var x17 uint64 + x16, x17 = bits.Add64(x14, arg1[1], uint64(0x0)) + var x18 uint64 + _, x18 = bits.Mul64(x16, 0xd2b51da312547e1b) + var x20 uint64 + var x21 uint64 + x21, x20 = bits.Mul64(x18, 0x1000000000000000) + var x22 uint64 + var x23 uint64 + x23, x22 = bits.Mul64(x18, 0x14def9dea2f79cd6) + var x24 uint64 + var x25 uint64 + x25, x24 = bits.Mul64(x18, 0x5812631a5cf5d3ed) + var x26 uint64 + var x27 uint64 + x26, x27 = bits.Add64(x25, x22, uint64(0x0)) + var x29 uint64 + _, x29 = bits.Add64(x16, x24, uint64(0x0)) + var x30 uint64 + var x31 uint64 + x30, x31 = bits.Add64((uint64(fiatScalarUint1(x17)) + (uint64(fiatScalarUint1(x15)) + (uint64(fiatScalarUint1(x11)) + x7))), x26, uint64(fiatScalarUint1(x29))) + var x32 uint64 + var x33 uint64 + x32, x33 = bits.Add64(x4, (uint64(fiatScalarUint1(x27)) + x23), uint64(fiatScalarUint1(x31))) + var x34 uint64 + var x35 uint64 + x34, x35 = bits.Add64(x5, x20, uint64(fiatScalarUint1(x33))) + var x36 uint64 + var x37 uint64 + x36, x37 = bits.Add64(x30, arg1[2], uint64(0x0)) + var x38 uint64 + var x39 uint64 + x38, x39 = bits.Add64(x32, uint64(0x0), uint64(fiatScalarUint1(x37))) + var x40 uint64 + var x41 uint64 + x40, x41 = bits.Add64(x34, uint64(0x0), uint64(fiatScalarUint1(x39))) + var x42 uint64 + _, x42 = bits.Mul64(x36, 0xd2b51da312547e1b) + var x44 uint64 + var x45 uint64 + x45, x44 = bits.Mul64(x42, 0x1000000000000000) + var x46 uint64 + var x47 uint64 + x47, x46 = bits.Mul64(x42, 0x14def9dea2f79cd6) + var x48 uint64 + var x49 uint64 + x49, x48 = bits.Mul64(x42, 0x5812631a5cf5d3ed) + var x50 uint64 + var x51 uint64 + x50, x51 = bits.Add64(x49, x46, uint64(0x0)) + var x53 uint64 + _, x53 = bits.Add64(x36, x48, uint64(0x0)) + var x54 uint64 + var x55 uint64 + x54, x55 = bits.Add64(x38, x50, uint64(fiatScalarUint1(x53))) + var x56 uint64 + var x57 uint64 + x56, x57 = bits.Add64(x40, (uint64(fiatScalarUint1(x51)) + x47), uint64(fiatScalarUint1(x55))) + var x58 uint64 + var x59 uint64 + x58, x59 = bits.Add64((uint64(fiatScalarUint1(x41)) + (uint64(fiatScalarUint1(x35)) + x21)), x44, uint64(fiatScalarUint1(x57))) + var x60 uint64 + var x61 uint64 + x60, x61 = bits.Add64(x54, arg1[3], uint64(0x0)) + var x62 uint64 + var x63 uint64 + x62, x63 = bits.Add64(x56, uint64(0x0), uint64(fiatScalarUint1(x61))) + var x64 uint64 + var x65 uint64 + x64, x65 = bits.Add64(x58, uint64(0x0), uint64(fiatScalarUint1(x63))) + var x66 uint64 + _, x66 = bits.Mul64(x60, 0xd2b51da312547e1b) + var x68 uint64 + var x69 uint64 + x69, x68 = bits.Mul64(x66, 0x1000000000000000) + var x70 uint64 + var x71 uint64 + x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6) + var x72 uint64 + var x73 uint64 + x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed) + var x74 uint64 + var x75 uint64 + x74, x75 = bits.Add64(x73, x70, uint64(0x0)) + var x77 uint64 + _, x77 = bits.Add64(x60, x72, uint64(0x0)) + var x78 uint64 + var x79 uint64 + x78, x79 = bits.Add64(x62, x74, uint64(fiatScalarUint1(x77))) + var x80 uint64 + var x81 uint64 + x80, x81 = bits.Add64(x64, (uint64(fiatScalarUint1(x75)) + x71), uint64(fiatScalarUint1(x79))) + var x82 uint64 + var x83 uint64 + x82, x83 = bits.Add64((uint64(fiatScalarUint1(x65)) + (uint64(fiatScalarUint1(x59)) + x45)), x68, uint64(fiatScalarUint1(x81))) + x84 := (uint64(fiatScalarUint1(x83)) + x69) + var x85 uint64 + var x86 uint64 + x85, x86 = bits.Sub64(x78, 0x5812631a5cf5d3ed, uint64(0x0)) + var x87 uint64 + var x88 uint64 + x87, x88 = bits.Sub64(x80, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x86))) + var x89 uint64 + var x90 uint64 + x89, x90 = bits.Sub64(x82, uint64(0x0), uint64(fiatScalarUint1(x88))) + var x91 uint64 + var x92 uint64 + x91, x92 = bits.Sub64(x84, 0x1000000000000000, uint64(fiatScalarUint1(x90))) + var x94 uint64 + _, x94 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(fiatScalarUint1(x92))) + var x95 uint64 + fiatScalarCmovznzU64(&x95, fiatScalarUint1(x94), x85, x78) + var x96 uint64 + fiatScalarCmovznzU64(&x96, fiatScalarUint1(x94), x87, x80) + var x97 uint64 + fiatScalarCmovznzU64(&x97, fiatScalarUint1(x94), x89, x82) + var x98 uint64 + fiatScalarCmovznzU64(&x98, fiatScalarUint1(x94), x91, x84) + out1[0] = x95 + out1[1] = x96 + out1[2] = x97 + out1[3] = x98 +} + +// fiatScalarToMontgomery translates a field element into the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval (from_montgomery out1) mod m = eval arg1 mod m +// 0 ≤ eval out1 < m +// +func fiatScalarToMontgomery(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarNonMontgomeryDomainFieldElement) { + x1 := arg1[1] + x2 := arg1[2] + x3 := arg1[3] + x4 := arg1[0] + var x5 uint64 + var x6 uint64 + x6, x5 = bits.Mul64(x4, 0x399411b7c309a3d) + var x7 uint64 + var x8 uint64 + x8, x7 = bits.Mul64(x4, 0xceec73d217f5be65) + var x9 uint64 + var x10 uint64 + x10, x9 = bits.Mul64(x4, 0xd00e1ba768859347) + var x11 uint64 + var x12 uint64 + x12, x11 = bits.Mul64(x4, 0xa40611e3449c0f01) + var x13 uint64 + var x14 uint64 + x13, x14 = bits.Add64(x12, x9, uint64(0x0)) + var x15 uint64 + var x16 uint64 + x15, x16 = bits.Add64(x10, x7, uint64(fiatScalarUint1(x14))) + var x17 uint64 + var x18 uint64 + x17, x18 = bits.Add64(x8, x5, uint64(fiatScalarUint1(x16))) + var x19 uint64 + _, x19 = bits.Mul64(x11, 0xd2b51da312547e1b) + var x21 uint64 + var x22 uint64 + x22, x21 = bits.Mul64(x19, 0x1000000000000000) + var x23 uint64 + var x24 uint64 + x24, x23 = bits.Mul64(x19, 0x14def9dea2f79cd6) + var x25 uint64 + var x26 uint64 + x26, x25 = bits.Mul64(x19, 0x5812631a5cf5d3ed) + var x27 uint64 + var x28 uint64 + x27, x28 = bits.Add64(x26, x23, uint64(0x0)) + var x30 uint64 + _, x30 = bits.Add64(x11, x25, uint64(0x0)) + var x31 uint64 + var x32 uint64 + x31, x32 = bits.Add64(x13, x27, uint64(fiatScalarUint1(x30))) + var x33 uint64 + var x34 uint64 + x33, x34 = bits.Add64(x15, (uint64(fiatScalarUint1(x28)) + x24), uint64(fiatScalarUint1(x32))) + var x35 uint64 + var x36 uint64 + x35, x36 = bits.Add64(x17, x21, uint64(fiatScalarUint1(x34))) + var x37 uint64 + var x38 uint64 + x38, x37 = bits.Mul64(x1, 0x399411b7c309a3d) + var x39 uint64 + var x40 uint64 + x40, x39 = bits.Mul64(x1, 0xceec73d217f5be65) + var x41 uint64 + var x42 uint64 + x42, x41 = bits.Mul64(x1, 0xd00e1ba768859347) + var x43 uint64 + var x44 uint64 + x44, x43 = bits.Mul64(x1, 0xa40611e3449c0f01) + var x45 uint64 + var x46 uint64 + x45, x46 = bits.Add64(x44, x41, uint64(0x0)) + var x47 uint64 + var x48 uint64 + x47, x48 = bits.Add64(x42, x39, uint64(fiatScalarUint1(x46))) + var x49 uint64 + var x50 uint64 + x49, x50 = bits.Add64(x40, x37, uint64(fiatScalarUint1(x48))) + var x51 uint64 + var x52 uint64 + x51, x52 = bits.Add64(x31, x43, uint64(0x0)) + var x53 uint64 + var x54 uint64 + x53, x54 = bits.Add64(x33, x45, uint64(fiatScalarUint1(x52))) + var x55 uint64 + var x56 uint64 + x55, x56 = bits.Add64(x35, x47, uint64(fiatScalarUint1(x54))) + var x57 uint64 + var x58 uint64 + x57, x58 = bits.Add64(((uint64(fiatScalarUint1(x36)) + (uint64(fiatScalarUint1(x18)) + x6)) + x22), x49, uint64(fiatScalarUint1(x56))) + var x59 uint64 + _, x59 = bits.Mul64(x51, 0xd2b51da312547e1b) + var x61 uint64 + var x62 uint64 + x62, x61 = bits.Mul64(x59, 0x1000000000000000) + var x63 uint64 + var x64 uint64 + x64, x63 = bits.Mul64(x59, 0x14def9dea2f79cd6) + var x65 uint64 + var x66 uint64 + x66, x65 = bits.Mul64(x59, 0x5812631a5cf5d3ed) + var x67 uint64 + var x68 uint64 + x67, x68 = bits.Add64(x66, x63, uint64(0x0)) + var x70 uint64 + _, x70 = bits.Add64(x51, x65, uint64(0x0)) + var x71 uint64 + var x72 uint64 + x71, x72 = bits.Add64(x53, x67, uint64(fiatScalarUint1(x70))) + var x73 uint64 + var x74 uint64 + x73, x74 = bits.Add64(x55, (uint64(fiatScalarUint1(x68)) + x64), uint64(fiatScalarUint1(x72))) + var x75 uint64 + var x76 uint64 + x75, x76 = bits.Add64(x57, x61, uint64(fiatScalarUint1(x74))) + var x77 uint64 + var x78 uint64 + x78, x77 = bits.Mul64(x2, 0x399411b7c309a3d) + var x79 uint64 + var x80 uint64 + x80, x79 = bits.Mul64(x2, 0xceec73d217f5be65) + var x81 uint64 + var x82 uint64 + x82, x81 = bits.Mul64(x2, 0xd00e1ba768859347) + var x83 uint64 + var x84 uint64 + x84, x83 = bits.Mul64(x2, 0xa40611e3449c0f01) + var x85 uint64 + var x86 uint64 + x85, x86 = bits.Add64(x84, x81, uint64(0x0)) + var x87 uint64 + var x88 uint64 + x87, x88 = bits.Add64(x82, x79, uint64(fiatScalarUint1(x86))) + var x89 uint64 + var x90 uint64 + x89, x90 = bits.Add64(x80, x77, uint64(fiatScalarUint1(x88))) + var x91 uint64 + var x92 uint64 + x91, x92 = bits.Add64(x71, x83, uint64(0x0)) + var x93 uint64 + var x94 uint64 + x93, x94 = bits.Add64(x73, x85, uint64(fiatScalarUint1(x92))) + var x95 uint64 + var x96 uint64 + x95, x96 = bits.Add64(x75, x87, uint64(fiatScalarUint1(x94))) + var x97 uint64 + var x98 uint64 + x97, x98 = bits.Add64(((uint64(fiatScalarUint1(x76)) + (uint64(fiatScalarUint1(x58)) + (uint64(fiatScalarUint1(x50)) + x38))) + x62), x89, uint64(fiatScalarUint1(x96))) + var x99 uint64 + _, x99 = bits.Mul64(x91, 0xd2b51da312547e1b) + var x101 uint64 + var x102 uint64 + x102, x101 = bits.Mul64(x99, 0x1000000000000000) + var x103 uint64 + var x104 uint64 + x104, x103 = bits.Mul64(x99, 0x14def9dea2f79cd6) + var x105 uint64 + var x106 uint64 + x106, x105 = bits.Mul64(x99, 0x5812631a5cf5d3ed) + var x107 uint64 + var x108 uint64 + x107, x108 = bits.Add64(x106, x103, uint64(0x0)) + var x110 uint64 + _, x110 = bits.Add64(x91, x105, uint64(0x0)) + var x111 uint64 + var x112 uint64 + x111, x112 = bits.Add64(x93, x107, uint64(fiatScalarUint1(x110))) + var x113 uint64 + var x114 uint64 + x113, x114 = bits.Add64(x95, (uint64(fiatScalarUint1(x108)) + x104), uint64(fiatScalarUint1(x112))) + var x115 uint64 + var x116 uint64 + x115, x116 = bits.Add64(x97, x101, uint64(fiatScalarUint1(x114))) + var x117 uint64 + var x118 uint64 + x118, x117 = bits.Mul64(x3, 0x399411b7c309a3d) + var x119 uint64 + var x120 uint64 + x120, x119 = bits.Mul64(x3, 0xceec73d217f5be65) + var x121 uint64 + var x122 uint64 + x122, x121 = bits.Mul64(x3, 0xd00e1ba768859347) + var x123 uint64 + var x124 uint64 + x124, x123 = bits.Mul64(x3, 0xa40611e3449c0f01) + var x125 uint64 + var x126 uint64 + x125, x126 = bits.Add64(x124, x121, uint64(0x0)) + var x127 uint64 + var x128 uint64 + x127, x128 = bits.Add64(x122, x119, uint64(fiatScalarUint1(x126))) + var x129 uint64 + var x130 uint64 + x129, x130 = bits.Add64(x120, x117, uint64(fiatScalarUint1(x128))) + var x131 uint64 + var x132 uint64 + x131, x132 = bits.Add64(x111, x123, uint64(0x0)) + var x133 uint64 + var x134 uint64 + x133, x134 = bits.Add64(x113, x125, uint64(fiatScalarUint1(x132))) + var x135 uint64 + var x136 uint64 + x135, x136 = bits.Add64(x115, x127, uint64(fiatScalarUint1(x134))) + var x137 uint64 + var x138 uint64 + x137, x138 = bits.Add64(((uint64(fiatScalarUint1(x116)) + (uint64(fiatScalarUint1(x98)) + (uint64(fiatScalarUint1(x90)) + x78))) + x102), x129, uint64(fiatScalarUint1(x136))) + var x139 uint64 + _, x139 = bits.Mul64(x131, 0xd2b51da312547e1b) + var x141 uint64 + var x142 uint64 + x142, x141 = bits.Mul64(x139, 0x1000000000000000) + var x143 uint64 + var x144 uint64 + x144, x143 = bits.Mul64(x139, 0x14def9dea2f79cd6) + var x145 uint64 + var x146 uint64 + x146, x145 = bits.Mul64(x139, 0x5812631a5cf5d3ed) + var x147 uint64 + var x148 uint64 + x147, x148 = bits.Add64(x146, x143, uint64(0x0)) + var x150 uint64 + _, x150 = bits.Add64(x131, x145, uint64(0x0)) + var x151 uint64 + var x152 uint64 + x151, x152 = bits.Add64(x133, x147, uint64(fiatScalarUint1(x150))) + var x153 uint64 + var x154 uint64 + x153, x154 = bits.Add64(x135, (uint64(fiatScalarUint1(x148)) + x144), uint64(fiatScalarUint1(x152))) + var x155 uint64 + var x156 uint64 + x155, x156 = bits.Add64(x137, x141, uint64(fiatScalarUint1(x154))) + x157 := ((uint64(fiatScalarUint1(x156)) + (uint64(fiatScalarUint1(x138)) + (uint64(fiatScalarUint1(x130)) + x118))) + x142) + var x158 uint64 + var x159 uint64 + x158, x159 = bits.Sub64(x151, 0x5812631a5cf5d3ed, uint64(0x0)) + var x160 uint64 + var x161 uint64 + x160, x161 = bits.Sub64(x153, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x159))) + var x162 uint64 + var x163 uint64 + x162, x163 = bits.Sub64(x155, uint64(0x0), uint64(fiatScalarUint1(x161))) + var x164 uint64 + var x165 uint64 + x164, x165 = bits.Sub64(x157, 0x1000000000000000, uint64(fiatScalarUint1(x163))) + var x167 uint64 + _, x167 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(fiatScalarUint1(x165))) + var x168 uint64 + fiatScalarCmovznzU64(&x168, fiatScalarUint1(x167), x158, x151) + var x169 uint64 + fiatScalarCmovznzU64(&x169, fiatScalarUint1(x167), x160, x153) + var x170 uint64 + fiatScalarCmovznzU64(&x170, fiatScalarUint1(x167), x162, x155) + var x171 uint64 + fiatScalarCmovznzU64(&x171, fiatScalarUint1(x167), x164, x157) + out1[0] = x168 + out1[1] = x169 + out1[2] = x170 + out1[3] = x171 +} + +// fiatScalarToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +// +// Input Bounds: +// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]] +// Output Bounds: +// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] +func fiatScalarToBytes(out1 *[32]uint8, arg1 *[4]uint64) { + x1 := arg1[3] + x2 := arg1[2] + x3 := arg1[1] + x4 := arg1[0] + x5 := (uint8(x4) & 0xff) + x6 := (x4 >> 8) + x7 := (uint8(x6) & 0xff) + x8 := (x6 >> 8) + x9 := (uint8(x8) & 0xff) + x10 := (x8 >> 8) + x11 := (uint8(x10) & 0xff) + x12 := (x10 >> 8) + x13 := (uint8(x12) & 0xff) + x14 := (x12 >> 8) + x15 := (uint8(x14) & 0xff) + x16 := (x14 >> 8) + x17 := (uint8(x16) & 0xff) + x18 := uint8((x16 >> 8)) + x19 := (uint8(x3) & 0xff) + x20 := (x3 >> 8) + x21 := (uint8(x20) & 0xff) + x22 := (x20 >> 8) + x23 := (uint8(x22) & 0xff) + x24 := (x22 >> 8) + x25 := (uint8(x24) & 0xff) + x26 := (x24 >> 8) + x27 := (uint8(x26) & 0xff) + x28 := (x26 >> 8) + x29 := (uint8(x28) & 0xff) + x30 := (x28 >> 8) + x31 := (uint8(x30) & 0xff) + x32 := uint8((x30 >> 8)) + x33 := (uint8(x2) & 0xff) + x34 := (x2 >> 8) + x35 := (uint8(x34) & 0xff) + x36 := (x34 >> 8) + x37 := (uint8(x36) & 0xff) + x38 := (x36 >> 8) + x39 := (uint8(x38) & 0xff) + x40 := (x38 >> 8) + x41 := (uint8(x40) & 0xff) + x42 := (x40 >> 8) + x43 := (uint8(x42) & 0xff) + x44 := (x42 >> 8) + x45 := (uint8(x44) & 0xff) + x46 := uint8((x44 >> 8)) + x47 := (uint8(x1) & 0xff) + x48 := (x1 >> 8) + x49 := (uint8(x48) & 0xff) + x50 := (x48 >> 8) + x51 := (uint8(x50) & 0xff) + x52 := (x50 >> 8) + x53 := (uint8(x52) & 0xff) + x54 := (x52 >> 8) + x55 := (uint8(x54) & 0xff) + x56 := (x54 >> 8) + x57 := (uint8(x56) & 0xff) + x58 := (x56 >> 8) + x59 := (uint8(x58) & 0xff) + x60 := uint8((x58 >> 8)) + out1[0] = x5 + out1[1] = x7 + out1[2] = x9 + out1[3] = x11 + out1[4] = x13 + out1[5] = x15 + out1[6] = x17 + out1[7] = x18 + out1[8] = x19 + out1[9] = x21 + out1[10] = x23 + out1[11] = x25 + out1[12] = x27 + out1[13] = x29 + out1[14] = x31 + out1[15] = x32 + out1[16] = x33 + out1[17] = x35 + out1[18] = x37 + out1[19] = x39 + out1[20] = x41 + out1[21] = x43 + out1[22] = x45 + out1[23] = x46 + out1[24] = x47 + out1[25] = x49 + out1[26] = x51 + out1[27] = x53 + out1[28] = x55 + out1[29] = x57 + out1[30] = x59 + out1[31] = x60 +} + +// fiatScalarFromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +// +// Preconditions: +// 0 ≤ bytes_eval arg1 < m +// Postconditions: +// eval out1 mod m = bytes_eval arg1 mod m +// 0 ≤ eval out1 < m +// +// Input Bounds: +// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] +// Output Bounds: +// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]] +func fiatScalarFromBytes(out1 *[4]uint64, arg1 *[32]uint8) { + x1 := (uint64(arg1[31]) << 56) + x2 := (uint64(arg1[30]) << 48) + x3 := (uint64(arg1[29]) << 40) + x4 := (uint64(arg1[28]) << 32) + x5 := (uint64(arg1[27]) << 24) + x6 := (uint64(arg1[26]) << 16) + x7 := (uint64(arg1[25]) << 8) + x8 := arg1[24] + x9 := (uint64(arg1[23]) << 56) + x10 := (uint64(arg1[22]) << 48) + x11 := (uint64(arg1[21]) << 40) + x12 := (uint64(arg1[20]) << 32) + x13 := (uint64(arg1[19]) << 24) + x14 := (uint64(arg1[18]) << 16) + x15 := (uint64(arg1[17]) << 8) + x16 := arg1[16] + x17 := (uint64(arg1[15]) << 56) + x18 := (uint64(arg1[14]) << 48) + x19 := (uint64(arg1[13]) << 40) + x20 := (uint64(arg1[12]) << 32) + x21 := (uint64(arg1[11]) << 24) + x22 := (uint64(arg1[10]) << 16) + x23 := (uint64(arg1[9]) << 8) + x24 := arg1[8] + x25 := (uint64(arg1[7]) << 56) + x26 := (uint64(arg1[6]) << 48) + x27 := (uint64(arg1[5]) << 40) + x28 := (uint64(arg1[4]) << 32) + x29 := (uint64(arg1[3]) << 24) + x30 := (uint64(arg1[2]) << 16) + x31 := (uint64(arg1[1]) << 8) + x32 := arg1[0] + x33 := (x31 + uint64(x32)) + x34 := (x30 + x33) + x35 := (x29 + x34) + x36 := (x28 + x35) + x37 := (x27 + x36) + x38 := (x26 + x37) + x39 := (x25 + x38) + x40 := (x23 + uint64(x24)) + x41 := (x22 + x40) + x42 := (x21 + x41) + x43 := (x20 + x42) + x44 := (x19 + x43) + x45 := (x18 + x44) + x46 := (x17 + x45) + x47 := (x15 + uint64(x16)) + x48 := (x14 + x47) + x49 := (x13 + x48) + x50 := (x12 + x49) + x51 := (x11 + x50) + x52 := (x10 + x51) + x53 := (x9 + x52) + x54 := (x7 + uint64(x8)) + x55 := (x6 + x54) + x56 := (x5 + x55) + x57 := (x4 + x56) + x58 := (x3 + x57) + x59 := (x2 + x58) + x60 := (x1 + x59) + out1[0] = x39 + out1[1] = x46 + out1[2] = x53 + out1[3] = x60 +} diff --git a/scalar_test.go b/scalar_test.go index 366f0d4..67bcdaf 100644 --- a/scalar_test.go +++ b/scalar_test.go @@ -47,8 +47,8 @@ func (Scalar) Generate(rand *mathrand.Rand, size int) reflect.Value { } val := Scalar{} - fiat_sc255_from_bytes((*[4]uint64)(&val.s), &s) - fiat_sc255_to_montgomery(&val.s, (*fiat_sc255_non_montgomery_domain_field_element)(&val.s)) + fiatScalarFromBytes((*[4]uint64)(&val.s), &s) + fiatScalarToMontgomery(&val.s, (*fiatScalarNonMontgomeryDomainFieldElement)(&val.s)) return reflect.ValueOf(val) } @@ -234,7 +234,7 @@ func (notZeroScalar) Generate(rand *mathrand.Rand, size int) reflect.Value { var isNonZero uint64 for isNonZero == 0 { s = Scalar{}.Generate(rand, size).Interface().(Scalar) - fiat_sc255_nonzero(&isNonZero, (*[4]uint64)(&s.s)) + fiatScalarNonzero(&isNonZero, (*[4]uint64)(&s.s)) } return reflect.ValueOf(notZeroScalar(s)) }