scalar: update fiat code to v0.0.12-f4c7f3717364cf39b716170bf39f81b78acf544e
This commit is contained in:
George Tankersley
Filippo Valsorda
parent
8b9f5baf25
commit
589b96254b
990
fiat_scalar.go
990
fiat_scalar.go
|
|
@ -1,99 +1,110 @@
|
|||
/* Autogenerated: ./src/ExtractionOCaml/word_by_word_montgomery --lang Go sc255 64 '2^252 + 27742317777372353535851937790883648493' */
|
||||
/* curve description: sc255 */
|
||||
/* machine_wordsize = 64 (from "64") */
|
||||
/* requested operations: (all) */
|
||||
/* m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493") */
|
||||
/* */
|
||||
/* NOTE: In addition to the bounds specified above each function, all */
|
||||
/* functions synthesized for this Montgomery arithmetic require the */
|
||||
/* input to be strictly less than the prime modulus (m), and also */
|
||||
/* require the input to be in the unique saturated representation. */
|
||||
/* All functions also ensure that these two properties are true of */
|
||||
/* return values. */
|
||||
/* */
|
||||
/* Computed values: */
|
||||
/* eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) */
|
||||
/* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */
|
||||
|
||||
// Autogenerated: './src/ExtractionOCaml/word_by_word_montgomery' --lang Go --cmovznz-by-mul sc255 64 '2^252 + 27742317777372353535851937790883648493'
|
||||
//
|
||||
// curve description: sc255
|
||||
//
|
||||
// machine_wordsize = 64 (from "64")
|
||||
//
|
||||
// requested operations: (all)
|
||||
//
|
||||
// m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493")
|
||||
//
|
||||
//
|
||||
//
|
||||
// NOTE: In addition to the bounds specified above each function, all
|
||||
//
|
||||
// functions synthesized for this Montgomery arithmetic require the
|
||||
//
|
||||
// input to be strictly less than the prime modulus (m), and also
|
||||
//
|
||||
// require the input to be in the unique saturated representation.
|
||||
//
|
||||
// All functions also ensure that these two properties are true of
|
||||
//
|
||||
// return values.
|
||||
//
|
||||
//
|
||||
//
|
||||
// Computed values:
|
||||
//
|
||||
// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
|
||||
//
|
||||
// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
|
||||
//
|
||||
// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
|
||||
//
|
||||
// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
|
||||
package edwards25519
|
||||
|
||||
import "math/bits"
|
||||
|
||||
type fiat_sc255_uint1 uint8
|
||||
type fiat_sc255_int1 int8
|
||||
type fiat_sc255_uint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
|
||||
type fiat_sc255_int1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
|
||||
|
||||
/* The function fiat_sc255_addcarryx_u64 is a thin wrapper around bits.Add64 that uses fiat_sc255_uint1 rather than uint64 */
|
||||
// The type fiat_sc255_montgomery_domain_field_element is a field element in the Montgomery domain.
|
||||
//
|
||||
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
type fiat_sc255_montgomery_domain_field_element [4]uint64
|
||||
|
||||
// The type fiat_sc255_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain.
|
||||
//
|
||||
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
type fiat_sc255_non_montgomery_domain_field_element [4]uint64
|
||||
|
||||
// The function fiat_sc255_addcarryx_u64 is a thin wrapper around bits.Add64 that uses fiat_sc255_uint1 rather than uint64
|
||||
func fiat_sc255_addcarryx_u64(x uint64, y uint64, carry fiat_sc255_uint1) (uint64, fiat_sc255_uint1) {
|
||||
var sum uint64
|
||||
var carryOut uint64
|
||||
sum, carryOut = bits.Add64(x, y, uint64(carry))
|
||||
sum, carryOut := bits.Add64(x, y, uint64(carry))
|
||||
return sum, fiat_sc255_uint1(carryOut)
|
||||
}
|
||||
|
||||
/* The function fiat_sc255_subborrowx_u64 is a thin wrapper around bits.Sub64 that uses fiat_sc255_uint1 rather than uint64 */
|
||||
// The function fiat_sc255_subborrowx_u64 is a thin wrapper around bits.Sub64 that uses fiat_sc255_uint1 rather than uint64
|
||||
func fiat_sc255_subborrowx_u64(x uint64, y uint64, carry fiat_sc255_uint1) (uint64, fiat_sc255_uint1) {
|
||||
var sum uint64
|
||||
var carryOut uint64
|
||||
sum, carryOut = bits.Sub64(x, y, uint64(carry))
|
||||
sum, carryOut := bits.Sub64(x, y, uint64(carry))
|
||||
return sum, fiat_sc255_uint1(carryOut)
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_cmovznz_u64 is a single-word conditional move.
|
||||
* Postconditions:
|
||||
* out1 = (if arg1 = 0 then arg2 else arg3)
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [0x0 ~> 0xffffffffffffffff]
|
||||
* arg3: [0x0 ~> 0xffffffffffffffff]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0xffffffffffffffff]
|
||||
*/
|
||||
/*inline*/
|
||||
// The function fiat_sc255_cmovznz_u64 is a single-word conditional move.
|
||||
//
|
||||
// Postconditions:
|
||||
// out1 = (if arg1 = 0 then arg2 else arg3)
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [0x0 ~> 0x1]
|
||||
// arg2: [0x0 ~> 0xffffffffffffffff]
|
||||
// arg3: [0x0 ~> 0xffffffffffffffff]
|
||||
// Output Bounds:
|
||||
// out1: [0x0 ~> 0xffffffffffffffff]
|
||||
func fiat_sc255_cmovznz_u64(out1 *uint64, arg1 fiat_sc255_uint1, arg2 uint64, arg3 uint64) {
|
||||
// var x1 fiat_sc255_uint1 = (! /* TODO: FIX ME */ (! /* TODO: FIX ME */ arg1))
|
||||
// var x2 uint64 = (uint64((fiat_sc255_int1(0x0) - fiat_sc255_int1(x1))) & 0xffffffffffffffff)
|
||||
// var x3 uint64 = ((x2 & arg3) | ((^x2) & arg2))
|
||||
// call with --cmovznz-by-mul for Go
|
||||
var x1 uint64 = (uint64(arg1) * 0xffffffffffffffff)
|
||||
var x2 uint64 = ((x1 & arg3) | ((^x1) & arg2))
|
||||
x1 := (uint64(arg1) * 0xffffffffffffffff)
|
||||
x2 := ((x1 & arg3) | ((^x1) & arg2))
|
||||
*out1 = x2
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_mul multiplies two field elements in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* 0 ≤ eval arg2 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[1])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[3])
|
||||
var x4 uint64 = (arg1[0])
|
||||
// The function fiat_sc255_mul multiplies two field elements in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// 0 ≤ eval arg2 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_mul(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element, arg2 *fiat_sc255_montgomery_domain_field_element) {
|
||||
x1 := arg1[1]
|
||||
x2 := arg1[2]
|
||||
x3 := arg1[3]
|
||||
x4 := arg1[0]
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, (arg2[3]))
|
||||
x6, x5 = bits.Mul64(x4, arg2[3])
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x8, x7 = bits.Mul64(x4, (arg2[2]))
|
||||
x8, x7 = bits.Mul64(x4, arg2[2])
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x10, x9 = bits.Mul64(x4, (arg2[1]))
|
||||
x10, x9 = bits.Mul64(x4, arg2[1])
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x12, x11 = bits.Mul64(x4, (arg2[0]))
|
||||
x12, x11 = bits.Mul64(x4, arg2[0])
|
||||
var x13 uint64
|
||||
var x14 fiat_sc255_uint1
|
||||
x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0)
|
||||
|
|
@ -103,7 +114,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x17 uint64
|
||||
var x18 fiat_sc255_uint1
|
||||
x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16)
|
||||
var x19 uint64 = (uint64(x18) + x6)
|
||||
x19 := (uint64(x18) + x6)
|
||||
var x20 uint64
|
||||
_, x20 = bits.Mul64(x11, 0xd2b51da312547e1b)
|
||||
var x22 uint64
|
||||
|
|
@ -118,7 +129,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x28 uint64
|
||||
var x29 fiat_sc255_uint1
|
||||
x28, x29 = fiat_sc255_addcarryx_u64(x27, x24, 0x0)
|
||||
var x30 uint64 = (uint64(x29) + x25)
|
||||
x30 := (uint64(x29) + x25)
|
||||
var x32 fiat_sc255_uint1
|
||||
_, x32 = fiat_sc255_addcarryx_u64(x11, x26, 0x0)
|
||||
var x33 uint64
|
||||
|
|
@ -135,16 +146,16 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
x39, x40 = fiat_sc255_addcarryx_u64(x19, x23, x38)
|
||||
var x41 uint64
|
||||
var x42 uint64
|
||||
x42, x41 = bits.Mul64(x1, (arg2[3]))
|
||||
x42, x41 = bits.Mul64(x1, arg2[3])
|
||||
var x43 uint64
|
||||
var x44 uint64
|
||||
x44, x43 = bits.Mul64(x1, (arg2[2]))
|
||||
x44, x43 = bits.Mul64(x1, arg2[2])
|
||||
var x45 uint64
|
||||
var x46 uint64
|
||||
x46, x45 = bits.Mul64(x1, (arg2[1]))
|
||||
x46, x45 = bits.Mul64(x1, arg2[1])
|
||||
var x47 uint64
|
||||
var x48 uint64
|
||||
x48, x47 = bits.Mul64(x1, (arg2[0]))
|
||||
x48, x47 = bits.Mul64(x1, arg2[0])
|
||||
var x49 uint64
|
||||
var x50 fiat_sc255_uint1
|
||||
x49, x50 = fiat_sc255_addcarryx_u64(x48, x45, 0x0)
|
||||
|
|
@ -154,7 +165,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x53 uint64
|
||||
var x54 fiat_sc255_uint1
|
||||
x53, x54 = fiat_sc255_addcarryx_u64(x44, x41, x52)
|
||||
var x55 uint64 = (uint64(x54) + x42)
|
||||
x55 := (uint64(x54) + x42)
|
||||
var x56 uint64
|
||||
var x57 fiat_sc255_uint1
|
||||
x56, x57 = fiat_sc255_addcarryx_u64(x33, x47, 0x0)
|
||||
|
|
@ -184,7 +195,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x74 uint64
|
||||
var x75 fiat_sc255_uint1
|
||||
x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0)
|
||||
var x76 uint64 = (uint64(x75) + x71)
|
||||
x76 := (uint64(x75) + x71)
|
||||
var x78 fiat_sc255_uint1
|
||||
_, x78 = fiat_sc255_addcarryx_u64(x56, x72, 0x0)
|
||||
var x79 uint64
|
||||
|
|
@ -199,19 +210,19 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x85 uint64
|
||||
var x86 fiat_sc255_uint1
|
||||
x85, x86 = fiat_sc255_addcarryx_u64(x64, x69, x84)
|
||||
var x87 uint64 = (uint64(x86) + uint64(x65))
|
||||
x87 := (uint64(x86) + uint64(x65))
|
||||
var x88 uint64
|
||||
var x89 uint64
|
||||
x89, x88 = bits.Mul64(x2, (arg2[3]))
|
||||
x89, x88 = bits.Mul64(x2, arg2[3])
|
||||
var x90 uint64
|
||||
var x91 uint64
|
||||
x91, x90 = bits.Mul64(x2, (arg2[2]))
|
||||
x91, x90 = bits.Mul64(x2, arg2[2])
|
||||
var x92 uint64
|
||||
var x93 uint64
|
||||
x93, x92 = bits.Mul64(x2, (arg2[1]))
|
||||
x93, x92 = bits.Mul64(x2, arg2[1])
|
||||
var x94 uint64
|
||||
var x95 uint64
|
||||
x95, x94 = bits.Mul64(x2, (arg2[0]))
|
||||
x95, x94 = bits.Mul64(x2, arg2[0])
|
||||
var x96 uint64
|
||||
var x97 fiat_sc255_uint1
|
||||
x96, x97 = fiat_sc255_addcarryx_u64(x95, x92, 0x0)
|
||||
|
|
@ -221,7 +232,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x100 uint64
|
||||
var x101 fiat_sc255_uint1
|
||||
x100, x101 = fiat_sc255_addcarryx_u64(x91, x88, x99)
|
||||
var x102 uint64 = (uint64(x101) + x89)
|
||||
x102 := (uint64(x101) + x89)
|
||||
var x103 uint64
|
||||
var x104 fiat_sc255_uint1
|
||||
x103, x104 = fiat_sc255_addcarryx_u64(x79, x94, 0x0)
|
||||
|
|
@ -251,7 +262,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x121 uint64
|
||||
var x122 fiat_sc255_uint1
|
||||
x121, x122 = fiat_sc255_addcarryx_u64(x120, x117, 0x0)
|
||||
var x123 uint64 = (uint64(x122) + x118)
|
||||
x123 := (uint64(x122) + x118)
|
||||
var x125 fiat_sc255_uint1
|
||||
_, x125 = fiat_sc255_addcarryx_u64(x103, x119, 0x0)
|
||||
var x126 uint64
|
||||
|
|
@ -266,19 +277,19 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x132 uint64
|
||||
var x133 fiat_sc255_uint1
|
||||
x132, x133 = fiat_sc255_addcarryx_u64(x111, x116, x131)
|
||||
var x134 uint64 = (uint64(x133) + uint64(x112))
|
||||
x134 := (uint64(x133) + uint64(x112))
|
||||
var x135 uint64
|
||||
var x136 uint64
|
||||
x136, x135 = bits.Mul64(x3, (arg2[3]))
|
||||
x136, x135 = bits.Mul64(x3, arg2[3])
|
||||
var x137 uint64
|
||||
var x138 uint64
|
||||
x138, x137 = bits.Mul64(x3, (arg2[2]))
|
||||
x138, x137 = bits.Mul64(x3, arg2[2])
|
||||
var x139 uint64
|
||||
var x140 uint64
|
||||
x140, x139 = bits.Mul64(x3, (arg2[1]))
|
||||
x140, x139 = bits.Mul64(x3, arg2[1])
|
||||
var x141 uint64
|
||||
var x142 uint64
|
||||
x142, x141 = bits.Mul64(x3, (arg2[0]))
|
||||
x142, x141 = bits.Mul64(x3, arg2[0])
|
||||
var x143 uint64
|
||||
var x144 fiat_sc255_uint1
|
||||
x143, x144 = fiat_sc255_addcarryx_u64(x142, x139, 0x0)
|
||||
|
|
@ -288,7 +299,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x147 uint64
|
||||
var x148 fiat_sc255_uint1
|
||||
x147, x148 = fiat_sc255_addcarryx_u64(x138, x135, x146)
|
||||
var x149 uint64 = (uint64(x148) + x136)
|
||||
x149 := (uint64(x148) + x136)
|
||||
var x150 uint64
|
||||
var x151 fiat_sc255_uint1
|
||||
x150, x151 = fiat_sc255_addcarryx_u64(x126, x141, 0x0)
|
||||
|
|
@ -318,7 +329,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x168 uint64
|
||||
var x169 fiat_sc255_uint1
|
||||
x168, x169 = fiat_sc255_addcarryx_u64(x167, x164, 0x0)
|
||||
var x170 uint64 = (uint64(x169) + x165)
|
||||
x170 := (uint64(x169) + x165)
|
||||
var x172 fiat_sc255_uint1
|
||||
_, x172 = fiat_sc255_addcarryx_u64(x150, x166, 0x0)
|
||||
var x173 uint64
|
||||
|
|
@ -333,7 +344,7 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
var x179 uint64
|
||||
var x180 fiat_sc255_uint1
|
||||
x179, x180 = fiat_sc255_addcarryx_u64(x158, x163, x178)
|
||||
var x181 uint64 = (uint64(x180) + uint64(x159))
|
||||
x181 := (uint64(x180) + uint64(x159))
|
||||
var x182 uint64
|
||||
var x183 fiat_sc255_uint1
|
||||
x182, x183 = fiat_sc255_subborrowx_u64(x173, 0x5812631a5cf5d3ed, 0x0)
|
||||
|
|
@ -362,37 +373,31 @@ func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
out1[3] = x195
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_square squares a field element in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[1])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[3])
|
||||
var x4 uint64 = (arg1[0])
|
||||
// The function fiat_sc255_square squares a field element in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_square(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element) {
|
||||
x1 := arg1[1]
|
||||
x2 := arg1[2]
|
||||
x3 := arg1[3]
|
||||
x4 := arg1[0]
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, (arg1[3]))
|
||||
x6, x5 = bits.Mul64(x4, arg1[3])
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x8, x7 = bits.Mul64(x4, (arg1[2]))
|
||||
x8, x7 = bits.Mul64(x4, arg1[2])
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x10, x9 = bits.Mul64(x4, (arg1[1]))
|
||||
x10, x9 = bits.Mul64(x4, arg1[1])
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x12, x11 = bits.Mul64(x4, (arg1[0]))
|
||||
x12, x11 = bits.Mul64(x4, arg1[0])
|
||||
var x13 uint64
|
||||
var x14 fiat_sc255_uint1
|
||||
x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0)
|
||||
|
|
@ -402,7 +407,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x17 uint64
|
||||
var x18 fiat_sc255_uint1
|
||||
x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16)
|
||||
var x19 uint64 = (uint64(x18) + x6)
|
||||
x19 := (uint64(x18) + x6)
|
||||
var x20 uint64
|
||||
_, x20 = bits.Mul64(x11, 0xd2b51da312547e1b)
|
||||
var x22 uint64
|
||||
|
|
@ -417,7 +422,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x28 uint64
|
||||
var x29 fiat_sc255_uint1
|
||||
x28, x29 = fiat_sc255_addcarryx_u64(x27, x24, 0x0)
|
||||
var x30 uint64 = (uint64(x29) + x25)
|
||||
x30 := (uint64(x29) + x25)
|
||||
var x32 fiat_sc255_uint1
|
||||
_, x32 = fiat_sc255_addcarryx_u64(x11, x26, 0x0)
|
||||
var x33 uint64
|
||||
|
|
@ -434,16 +439,16 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
x39, x40 = fiat_sc255_addcarryx_u64(x19, x23, x38)
|
||||
var x41 uint64
|
||||
var x42 uint64
|
||||
x42, x41 = bits.Mul64(x1, (arg1[3]))
|
||||
x42, x41 = bits.Mul64(x1, arg1[3])
|
||||
var x43 uint64
|
||||
var x44 uint64
|
||||
x44, x43 = bits.Mul64(x1, (arg1[2]))
|
||||
x44, x43 = bits.Mul64(x1, arg1[2])
|
||||
var x45 uint64
|
||||
var x46 uint64
|
||||
x46, x45 = bits.Mul64(x1, (arg1[1]))
|
||||
x46, x45 = bits.Mul64(x1, arg1[1])
|
||||
var x47 uint64
|
||||
var x48 uint64
|
||||
x48, x47 = bits.Mul64(x1, (arg1[0]))
|
||||
x48, x47 = bits.Mul64(x1, arg1[0])
|
||||
var x49 uint64
|
||||
var x50 fiat_sc255_uint1
|
||||
x49, x50 = fiat_sc255_addcarryx_u64(x48, x45, 0x0)
|
||||
|
|
@ -453,7 +458,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x53 uint64
|
||||
var x54 fiat_sc255_uint1
|
||||
x53, x54 = fiat_sc255_addcarryx_u64(x44, x41, x52)
|
||||
var x55 uint64 = (uint64(x54) + x42)
|
||||
x55 := (uint64(x54) + x42)
|
||||
var x56 uint64
|
||||
var x57 fiat_sc255_uint1
|
||||
x56, x57 = fiat_sc255_addcarryx_u64(x33, x47, 0x0)
|
||||
|
|
@ -483,7 +488,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x74 uint64
|
||||
var x75 fiat_sc255_uint1
|
||||
x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0)
|
||||
var x76 uint64 = (uint64(x75) + x71)
|
||||
x76 := (uint64(x75) + x71)
|
||||
var x78 fiat_sc255_uint1
|
||||
_, x78 = fiat_sc255_addcarryx_u64(x56, x72, 0x0)
|
||||
var x79 uint64
|
||||
|
|
@ -498,19 +503,19 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x85 uint64
|
||||
var x86 fiat_sc255_uint1
|
||||
x85, x86 = fiat_sc255_addcarryx_u64(x64, x69, x84)
|
||||
var x87 uint64 = (uint64(x86) + uint64(x65))
|
||||
x87 := (uint64(x86) + uint64(x65))
|
||||
var x88 uint64
|
||||
var x89 uint64
|
||||
x89, x88 = bits.Mul64(x2, (arg1[3]))
|
||||
x89, x88 = bits.Mul64(x2, arg1[3])
|
||||
var x90 uint64
|
||||
var x91 uint64
|
||||
x91, x90 = bits.Mul64(x2, (arg1[2]))
|
||||
x91, x90 = bits.Mul64(x2, arg1[2])
|
||||
var x92 uint64
|
||||
var x93 uint64
|
||||
x93, x92 = bits.Mul64(x2, (arg1[1]))
|
||||
x93, x92 = bits.Mul64(x2, arg1[1])
|
||||
var x94 uint64
|
||||
var x95 uint64
|
||||
x95, x94 = bits.Mul64(x2, (arg1[0]))
|
||||
x95, x94 = bits.Mul64(x2, arg1[0])
|
||||
var x96 uint64
|
||||
var x97 fiat_sc255_uint1
|
||||
x96, x97 = fiat_sc255_addcarryx_u64(x95, x92, 0x0)
|
||||
|
|
@ -520,7 +525,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x100 uint64
|
||||
var x101 fiat_sc255_uint1
|
||||
x100, x101 = fiat_sc255_addcarryx_u64(x91, x88, x99)
|
||||
var x102 uint64 = (uint64(x101) + x89)
|
||||
x102 := (uint64(x101) + x89)
|
||||
var x103 uint64
|
||||
var x104 fiat_sc255_uint1
|
||||
x103, x104 = fiat_sc255_addcarryx_u64(x79, x94, 0x0)
|
||||
|
|
@ -550,7 +555,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x121 uint64
|
||||
var x122 fiat_sc255_uint1
|
||||
x121, x122 = fiat_sc255_addcarryx_u64(x120, x117, 0x0)
|
||||
var x123 uint64 = (uint64(x122) + x118)
|
||||
x123 := (uint64(x122) + x118)
|
||||
var x125 fiat_sc255_uint1
|
||||
_, x125 = fiat_sc255_addcarryx_u64(x103, x119, 0x0)
|
||||
var x126 uint64
|
||||
|
|
@ -565,19 +570,19 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x132 uint64
|
||||
var x133 fiat_sc255_uint1
|
||||
x132, x133 = fiat_sc255_addcarryx_u64(x111, x116, x131)
|
||||
var x134 uint64 = (uint64(x133) + uint64(x112))
|
||||
x134 := (uint64(x133) + uint64(x112))
|
||||
var x135 uint64
|
||||
var x136 uint64
|
||||
x136, x135 = bits.Mul64(x3, (arg1[3]))
|
||||
x136, x135 = bits.Mul64(x3, arg1[3])
|
||||
var x137 uint64
|
||||
var x138 uint64
|
||||
x138, x137 = bits.Mul64(x3, (arg1[2]))
|
||||
x138, x137 = bits.Mul64(x3, arg1[2])
|
||||
var x139 uint64
|
||||
var x140 uint64
|
||||
x140, x139 = bits.Mul64(x3, (arg1[1]))
|
||||
x140, x139 = bits.Mul64(x3, arg1[1])
|
||||
var x141 uint64
|
||||
var x142 uint64
|
||||
x142, x141 = bits.Mul64(x3, (arg1[0]))
|
||||
x142, x141 = bits.Mul64(x3, arg1[0])
|
||||
var x143 uint64
|
||||
var x144 fiat_sc255_uint1
|
||||
x143, x144 = fiat_sc255_addcarryx_u64(x142, x139, 0x0)
|
||||
|
|
@ -587,7 +592,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x147 uint64
|
||||
var x148 fiat_sc255_uint1
|
||||
x147, x148 = fiat_sc255_addcarryx_u64(x138, x135, x146)
|
||||
var x149 uint64 = (uint64(x148) + x136)
|
||||
x149 := (uint64(x148) + x136)
|
||||
var x150 uint64
|
||||
var x151 fiat_sc255_uint1
|
||||
x150, x151 = fiat_sc255_addcarryx_u64(x126, x141, 0x0)
|
||||
|
|
@ -617,7 +622,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x168 uint64
|
||||
var x169 fiat_sc255_uint1
|
||||
x168, x169 = fiat_sc255_addcarryx_u64(x167, x164, 0x0)
|
||||
var x170 uint64 = (uint64(x169) + x165)
|
||||
x170 := (uint64(x169) + x165)
|
||||
var x172 fiat_sc255_uint1
|
||||
_, x172 = fiat_sc255_addcarryx_u64(x150, x166, 0x0)
|
||||
var x173 uint64
|
||||
|
|
@ -632,7 +637,7 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x179 uint64
|
||||
var x180 fiat_sc255_uint1
|
||||
x179, x180 = fiat_sc255_addcarryx_u64(x158, x163, x178)
|
||||
var x181 uint64 = (uint64(x180) + uint64(x159))
|
||||
x181 := (uint64(x180) + uint64(x159))
|
||||
var x182 uint64
|
||||
var x183 fiat_sc255_uint1
|
||||
x182, x183 = fiat_sc255_subborrowx_u64(x173, 0x5812631a5cf5d3ed, 0x0)
|
||||
|
|
@ -661,35 +666,28 @@ func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
out1[3] = x195
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_add adds two field elements in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* 0 ≤ eval arg2 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_add(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
||||
// The function fiat_sc255_add adds two field elements in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// 0 ≤ eval arg2 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_add(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element, arg2 *fiat_sc255_montgomery_domain_field_element) {
|
||||
var x1 uint64
|
||||
var x2 fiat_sc255_uint1
|
||||
x1, x2 = fiat_sc255_addcarryx_u64((arg1[0]), (arg2[0]), 0x0)
|
||||
x1, x2 = fiat_sc255_addcarryx_u64(arg1[0], arg2[0], 0x0)
|
||||
var x3 uint64
|
||||
var x4 fiat_sc255_uint1
|
||||
x3, x4 = fiat_sc255_addcarryx_u64((arg1[1]), (arg2[1]), x2)
|
||||
x3, x4 = fiat_sc255_addcarryx_u64(arg1[1], arg2[1], x2)
|
||||
var x5 uint64
|
||||
var x6 fiat_sc255_uint1
|
||||
x5, x6 = fiat_sc255_addcarryx_u64((arg1[2]), (arg2[2]), x4)
|
||||
x5, x6 = fiat_sc255_addcarryx_u64(arg1[2], arg2[2], x4)
|
||||
var x7 uint64
|
||||
var x8 fiat_sc255_uint1
|
||||
x7, x8 = fiat_sc255_addcarryx_u64((arg1[3]), (arg2[3]), x6)
|
||||
x7, x8 = fiat_sc255_addcarryx_u64(arg1[3], arg2[3], x6)
|
||||
var x9 uint64
|
||||
var x10 fiat_sc255_uint1
|
||||
x9, x10 = fiat_sc255_subborrowx_u64(x1, 0x5812631a5cf5d3ed, 0x0)
|
||||
|
|
@ -718,35 +716,28 @@ func fiat_sc255_add(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
out1[3] = x22
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_sub subtracts two field elements in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* 0 ≤ eval arg2 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_sub(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
||||
// The function fiat_sc255_sub subtracts two field elements in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// 0 ≤ eval arg2 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_sub(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element, arg2 *fiat_sc255_montgomery_domain_field_element) {
|
||||
var x1 uint64
|
||||
var x2 fiat_sc255_uint1
|
||||
x1, x2 = fiat_sc255_subborrowx_u64((arg1[0]), (arg2[0]), 0x0)
|
||||
x1, x2 = fiat_sc255_subborrowx_u64(arg1[0], arg2[0], 0x0)
|
||||
var x3 uint64
|
||||
var x4 fiat_sc255_uint1
|
||||
x3, x4 = fiat_sc255_subborrowx_u64((arg1[1]), (arg2[1]), x2)
|
||||
x3, x4 = fiat_sc255_subborrowx_u64(arg1[1], arg2[1], x2)
|
||||
var x5 uint64
|
||||
var x6 fiat_sc255_uint1
|
||||
x5, x6 = fiat_sc255_subborrowx_u64((arg1[2]), (arg2[2]), x4)
|
||||
x5, x6 = fiat_sc255_subborrowx_u64(arg1[2], arg2[2], x4)
|
||||
var x7 uint64
|
||||
var x8 fiat_sc255_uint1
|
||||
x7, x8 = fiat_sc255_subborrowx_u64((arg1[3]), (arg2[3]), x6)
|
||||
x7, x8 = fiat_sc255_subborrowx_u64(arg1[3], arg2[3], x6)
|
||||
var x9 uint64
|
||||
fiat_sc255_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff)
|
||||
var x10 uint64
|
||||
|
|
@ -766,33 +757,27 @@ func fiat_sc255_sub(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
|||
out1[3] = x16
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_opp negates a field element in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_opp(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
// The function fiat_sc255_opp negates a field element in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_opp(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element) {
|
||||
var x1 uint64
|
||||
var x2 fiat_sc255_uint1
|
||||
x1, x2 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[0]), 0x0)
|
||||
x1, x2 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[0], 0x0)
|
||||
var x3 uint64
|
||||
var x4 fiat_sc255_uint1
|
||||
x3, x4 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[1]), x2)
|
||||
x3, x4 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[1], x2)
|
||||
var x5 uint64
|
||||
var x6 fiat_sc255_uint1
|
||||
x5, x6 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[2]), x4)
|
||||
x5, x6 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[2], x4)
|
||||
var x7 uint64
|
||||
var x8 fiat_sc255_uint1
|
||||
x7, x8 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[3]), x6)
|
||||
x7, x8 = fiat_sc255_subborrowx_u64(uint64(0x0), arg1[3], x6)
|
||||
var x9 uint64
|
||||
fiat_sc255_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff)
|
||||
var x10 uint64
|
||||
|
|
@ -812,22 +797,16 @@ func fiat_sc255_opp(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
out1[3] = x16
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_from_montgomery translates a field element out of the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_from_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[0])
|
||||
// The function fiat_sc255_from_montgomery translates a field element out of the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_from_montgomery(out1 *fiat_sc255_non_montgomery_domain_field_element, arg1 *fiat_sc255_montgomery_domain_field_element) {
|
||||
x1 := arg1[0]
|
||||
var x2 uint64
|
||||
_, x2 = bits.Mul64(x1, 0xd2b51da312547e1b)
|
||||
var x4 uint64
|
||||
|
|
@ -849,7 +828,7 @@ func fiat_sc255_from_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
x14, x15 = fiat_sc255_addcarryx_u64(uint64(0x0), x10, x13)
|
||||
var x16 uint64
|
||||
var x17 fiat_sc255_uint1
|
||||
x16, x17 = fiat_sc255_addcarryx_u64(x14, (arg1[1]), 0x0)
|
||||
x16, x17 = fiat_sc255_addcarryx_u64(x14, arg1[1], 0x0)
|
||||
var x18 uint64
|
||||
_, x18 = bits.Mul64(x16, 0xd2b51da312547e1b)
|
||||
var x20 uint64
|
||||
|
|
@ -877,7 +856,7 @@ func fiat_sc255_from_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
x34, x35 = fiat_sc255_addcarryx_u64(x5, x20, x33)
|
||||
var x36 uint64
|
||||
var x37 fiat_sc255_uint1
|
||||
x36, x37 = fiat_sc255_addcarryx_u64(x30, (arg1[2]), 0x0)
|
||||
x36, x37 = fiat_sc255_addcarryx_u64(x30, arg1[2], 0x0)
|
||||
var x38 uint64
|
||||
var x39 fiat_sc255_uint1
|
||||
x38, x39 = fiat_sc255_addcarryx_u64(x32, uint64(0x0), x37)
|
||||
|
|
@ -911,7 +890,7 @@ func fiat_sc255_from_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
x58, x59 = fiat_sc255_addcarryx_u64((uint64(x41) + (uint64(x35) + x21)), x44, x57)
|
||||
var x60 uint64
|
||||
var x61 fiat_sc255_uint1
|
||||
x60, x61 = fiat_sc255_addcarryx_u64(x54, (arg1[3]), 0x0)
|
||||
x60, x61 = fiat_sc255_addcarryx_u64(x54, arg1[3], 0x0)
|
||||
var x62 uint64
|
||||
var x63 fiat_sc255_uint1
|
||||
x62, x63 = fiat_sc255_addcarryx_u64(x56, uint64(0x0), x61)
|
||||
|
|
@ -943,7 +922,7 @@ func fiat_sc255_from_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x82 uint64
|
||||
var x83 fiat_sc255_uint1
|
||||
x82, x83 = fiat_sc255_addcarryx_u64((uint64(x65) + (uint64(x59) + x45)), x68, x81)
|
||||
var x84 uint64 = (uint64(x83) + x69)
|
||||
x84 := (uint64(x83) + x69)
|
||||
var x85 uint64
|
||||
var x86 fiat_sc255_uint1
|
||||
x85, x86 = fiat_sc255_subborrowx_u64(x78, 0x5812631a5cf5d3ed, 0x0)
|
||||
|
|
@ -972,25 +951,19 @@ func fiat_sc255_from_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
out1[3] = x98
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_to_montgomery translates a field element into the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = eval arg1 mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_to_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[1])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[3])
|
||||
var x4 uint64 = (arg1[0])
|
||||
// The function fiat_sc255_to_montgomery translates a field element into the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = eval arg1 mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_to_montgomery(out1 *fiat_sc255_montgomery_domain_field_element, arg1 *fiat_sc255_non_montgomery_domain_field_element) {
|
||||
x1 := arg1[1]
|
||||
x2 := arg1[2]
|
||||
x3 := arg1[3]
|
||||
x4 := arg1[0]
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, 0x399411b7c309a3d)
|
||||
|
|
@ -1211,7 +1184,7 @@ func fiat_sc255_to_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
var x155 uint64
|
||||
var x156 fiat_sc255_uint1
|
||||
x155, x156 = fiat_sc255_addcarryx_u64(x137, x141, x154)
|
||||
var x157 uint64 = ((uint64(x156) + (uint64(x138) + (uint64(x130) + x118))) + x142)
|
||||
x157 := ((uint64(x156) + (uint64(x138) + (uint64(x130) + x118))) + x142)
|
||||
var x158 uint64
|
||||
var x159 fiat_sc255_uint1
|
||||
x158, x159 = fiat_sc255_subborrowx_u64(x151, 0x5812631a5cf5d3ed, 0x0)
|
||||
|
|
@ -1240,126 +1213,120 @@ func fiat_sc255_to_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
|||
out1[3] = x171
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0xffffffffffffffff]
|
||||
*/
|
||||
/*inline*/
|
||||
// The function fiat_sc255_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// Output Bounds:
|
||||
// out1: [0x0 ~> 0xffffffffffffffff]
|
||||
func fiat_sc255_nonzero(out1 *uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))))
|
||||
x1 := (arg1[0] | (arg1[1] | (arg1[2] | arg1[3])))
|
||||
*out1 = x1
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_selectznz is a multi-limb conditional select.
|
||||
* Postconditions:
|
||||
* eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
// The function fiat_sc255_selectznz is a multi-limb conditional select.
|
||||
//
|
||||
// Postconditions:
|
||||
// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [0x0 ~> 0x1]
|
||||
// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// Output Bounds:
|
||||
// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
func fiat_sc255_selectznz(out1 *[4]uint64, arg1 fiat_sc255_uint1, arg2 *[4]uint64, arg3 *[4]uint64) {
|
||||
var x1 uint64
|
||||
fiat_sc255_cmovznz_u64(&x1, arg1, (arg2[0]), (arg3[0]))
|
||||
fiat_sc255_cmovznz_u64(&x1, arg1, arg2[0], arg3[0])
|
||||
var x2 uint64
|
||||
fiat_sc255_cmovznz_u64(&x2, arg1, (arg2[1]), (arg3[1]))
|
||||
fiat_sc255_cmovznz_u64(&x2, arg1, arg2[1], arg3[1])
|
||||
var x3 uint64
|
||||
fiat_sc255_cmovznz_u64(&x3, arg1, (arg2[2]), (arg3[2]))
|
||||
fiat_sc255_cmovznz_u64(&x3, arg1, arg2[2], arg3[2])
|
||||
var x4 uint64
|
||||
fiat_sc255_cmovznz_u64(&x4, arg1, (arg2[3]), (arg3[3]))
|
||||
fiat_sc255_cmovznz_u64(&x4, arg1, arg2[3], arg3[3])
|
||||
out1[0] = x1
|
||||
out1[1] = x2
|
||||
out1[2] = x3
|
||||
out1[3] = x4
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_to_bytes(out1 *[32]byte, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[3])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[1])
|
||||
var x4 uint64 = (arg1[0])
|
||||
var x5 uint8 = (uint8(x4) & 0xff)
|
||||
var x6 uint64 = (x4 >> 8)
|
||||
var x7 uint8 = (uint8(x6) & 0xff)
|
||||
var x8 uint64 = (x6 >> 8)
|
||||
var x9 uint8 = (uint8(x8) & 0xff)
|
||||
var x10 uint64 = (x8 >> 8)
|
||||
var x11 uint8 = (uint8(x10) & 0xff)
|
||||
var x12 uint64 = (x10 >> 8)
|
||||
var x13 uint8 = (uint8(x12) & 0xff)
|
||||
var x14 uint64 = (x12 >> 8)
|
||||
var x15 uint8 = (uint8(x14) & 0xff)
|
||||
var x16 uint64 = (x14 >> 8)
|
||||
var x17 uint8 = (uint8(x16) & 0xff)
|
||||
var x18 uint8 = uint8((x16 >> 8))
|
||||
var x19 uint8 = (uint8(x3) & 0xff)
|
||||
var x20 uint64 = (x3 >> 8)
|
||||
var x21 uint8 = (uint8(x20) & 0xff)
|
||||
var x22 uint64 = (x20 >> 8)
|
||||
var x23 uint8 = (uint8(x22) & 0xff)
|
||||
var x24 uint64 = (x22 >> 8)
|
||||
var x25 uint8 = (uint8(x24) & 0xff)
|
||||
var x26 uint64 = (x24 >> 8)
|
||||
var x27 uint8 = (uint8(x26) & 0xff)
|
||||
var x28 uint64 = (x26 >> 8)
|
||||
var x29 uint8 = (uint8(x28) & 0xff)
|
||||
var x30 uint64 = (x28 >> 8)
|
||||
var x31 uint8 = (uint8(x30) & 0xff)
|
||||
var x32 uint8 = uint8((x30 >> 8))
|
||||
var x33 uint8 = (uint8(x2) & 0xff)
|
||||
var x34 uint64 = (x2 >> 8)
|
||||
var x35 uint8 = (uint8(x34) & 0xff)
|
||||
var x36 uint64 = (x34 >> 8)
|
||||
var x37 uint8 = (uint8(x36) & 0xff)
|
||||
var x38 uint64 = (x36 >> 8)
|
||||
var x39 uint8 = (uint8(x38) & 0xff)
|
||||
var x40 uint64 = (x38 >> 8)
|
||||
var x41 uint8 = (uint8(x40) & 0xff)
|
||||
var x42 uint64 = (x40 >> 8)
|
||||
var x43 uint8 = (uint8(x42) & 0xff)
|
||||
var x44 uint64 = (x42 >> 8)
|
||||
var x45 uint8 = (uint8(x44) & 0xff)
|
||||
var x46 uint8 = uint8((x44 >> 8))
|
||||
var x47 uint8 = (uint8(x1) & 0xff)
|
||||
var x48 uint64 = (x1 >> 8)
|
||||
var x49 uint8 = (uint8(x48) & 0xff)
|
||||
var x50 uint64 = (x48 >> 8)
|
||||
var x51 uint8 = (uint8(x50) & 0xff)
|
||||
var x52 uint64 = (x50 >> 8)
|
||||
var x53 uint8 = (uint8(x52) & 0xff)
|
||||
var x54 uint64 = (x52 >> 8)
|
||||
var x55 uint8 = (uint8(x54) & 0xff)
|
||||
var x56 uint64 = (x54 >> 8)
|
||||
var x57 uint8 = (uint8(x56) & 0xff)
|
||||
var x58 uint64 = (x56 >> 8)
|
||||
var x59 uint8 = (uint8(x58) & 0xff)
|
||||
var x60 uint8 = uint8((x58 >> 8))
|
||||
// The function fiat_sc255_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
// Output Bounds:
|
||||
// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
func fiat_sc255_to_bytes(out1 *[32]uint8, arg1 *[4]uint64) {
|
||||
x1 := arg1[3]
|
||||
x2 := arg1[2]
|
||||
x3 := arg1[1]
|
||||
x4 := arg1[0]
|
||||
x5 := (uint8(x4) & 0xff)
|
||||
x6 := (x4 >> 8)
|
||||
x7 := (uint8(x6) & 0xff)
|
||||
x8 := (x6 >> 8)
|
||||
x9 := (uint8(x8) & 0xff)
|
||||
x10 := (x8 >> 8)
|
||||
x11 := (uint8(x10) & 0xff)
|
||||
x12 := (x10 >> 8)
|
||||
x13 := (uint8(x12) & 0xff)
|
||||
x14 := (x12 >> 8)
|
||||
x15 := (uint8(x14) & 0xff)
|
||||
x16 := (x14 >> 8)
|
||||
x17 := (uint8(x16) & 0xff)
|
||||
x18 := uint8((x16 >> 8))
|
||||
x19 := (uint8(x3) & 0xff)
|
||||
x20 := (x3 >> 8)
|
||||
x21 := (uint8(x20) & 0xff)
|
||||
x22 := (x20 >> 8)
|
||||
x23 := (uint8(x22) & 0xff)
|
||||
x24 := (x22 >> 8)
|
||||
x25 := (uint8(x24) & 0xff)
|
||||
x26 := (x24 >> 8)
|
||||
x27 := (uint8(x26) & 0xff)
|
||||
x28 := (x26 >> 8)
|
||||
x29 := (uint8(x28) & 0xff)
|
||||
x30 := (x28 >> 8)
|
||||
x31 := (uint8(x30) & 0xff)
|
||||
x32 := uint8((x30 >> 8))
|
||||
x33 := (uint8(x2) & 0xff)
|
||||
x34 := (x2 >> 8)
|
||||
x35 := (uint8(x34) & 0xff)
|
||||
x36 := (x34 >> 8)
|
||||
x37 := (uint8(x36) & 0xff)
|
||||
x38 := (x36 >> 8)
|
||||
x39 := (uint8(x38) & 0xff)
|
||||
x40 := (x38 >> 8)
|
||||
x41 := (uint8(x40) & 0xff)
|
||||
x42 := (x40 >> 8)
|
||||
x43 := (uint8(x42) & 0xff)
|
||||
x44 := (x42 >> 8)
|
||||
x45 := (uint8(x44) & 0xff)
|
||||
x46 := uint8((x44 >> 8))
|
||||
x47 := (uint8(x1) & 0xff)
|
||||
x48 := (x1 >> 8)
|
||||
x49 := (uint8(x48) & 0xff)
|
||||
x50 := (x48 >> 8)
|
||||
x51 := (uint8(x50) & 0xff)
|
||||
x52 := (x50 >> 8)
|
||||
x53 := (uint8(x52) & 0xff)
|
||||
x54 := (x52 >> 8)
|
||||
x55 := (uint8(x54) & 0xff)
|
||||
x56 := (x54 >> 8)
|
||||
x57 := (uint8(x56) & 0xff)
|
||||
x58 := (x56 >> 8)
|
||||
x59 := (uint8(x58) & 0xff)
|
||||
x60 := uint8((x58 >> 8))
|
||||
out1[0] = x5
|
||||
out1[1] = x7
|
||||
out1[2] = x9
|
||||
|
|
@ -1394,116 +1361,106 @@ func fiat_sc255_to_bytes(out1 *[32]byte, arg1 *[4]uint64) {
|
|||
out1[31] = x60
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
|
||||
* Preconditions:
|
||||
* 0 ≤ bytes_eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval out1 mod m = bytes_eval arg1 mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_from_bytes(out1 *[4]uint64, arg1 *[32]byte) {
|
||||
var x1 uint64 = (uint64((arg1[31])) << 56)
|
||||
var x2 uint64 = (uint64((arg1[30])) << 48)
|
||||
var x3 uint64 = (uint64((arg1[29])) << 40)
|
||||
var x4 uint64 = (uint64((arg1[28])) << 32)
|
||||
var x5 uint64 = (uint64((arg1[27])) << 24)
|
||||
var x6 uint64 = (uint64((arg1[26])) << 16)
|
||||
var x7 uint64 = (uint64((arg1[25])) << 8)
|
||||
var x8 uint8 = (arg1[24])
|
||||
var x9 uint64 = (uint64((arg1[23])) << 56)
|
||||
var x10 uint64 = (uint64((arg1[22])) << 48)
|
||||
var x11 uint64 = (uint64((arg1[21])) << 40)
|
||||
var x12 uint64 = (uint64((arg1[20])) << 32)
|
||||
var x13 uint64 = (uint64((arg1[19])) << 24)
|
||||
var x14 uint64 = (uint64((arg1[18])) << 16)
|
||||
var x15 uint64 = (uint64((arg1[17])) << 8)
|
||||
var x16 uint8 = (arg1[16])
|
||||
var x17 uint64 = (uint64((arg1[15])) << 56)
|
||||
var x18 uint64 = (uint64((arg1[14])) << 48)
|
||||
var x19 uint64 = (uint64((arg1[13])) << 40)
|
||||
var x20 uint64 = (uint64((arg1[12])) << 32)
|
||||
var x21 uint64 = (uint64((arg1[11])) << 24)
|
||||
var x22 uint64 = (uint64((arg1[10])) << 16)
|
||||
var x23 uint64 = (uint64((arg1[9])) << 8)
|
||||
var x24 uint8 = (arg1[8])
|
||||
var x25 uint64 = (uint64((arg1[7])) << 56)
|
||||
var x26 uint64 = (uint64((arg1[6])) << 48)
|
||||
var x27 uint64 = (uint64((arg1[5])) << 40)
|
||||
var x28 uint64 = (uint64((arg1[4])) << 32)
|
||||
var x29 uint64 = (uint64((arg1[3])) << 24)
|
||||
var x30 uint64 = (uint64((arg1[2])) << 16)
|
||||
var x31 uint64 = (uint64((arg1[1])) << 8)
|
||||
var x32 uint8 = (arg1[0])
|
||||
var x33 uint64 = (x31 + uint64(x32))
|
||||
var x34 uint64 = (x30 + x33)
|
||||
var x35 uint64 = (x29 + x34)
|
||||
var x36 uint64 = (x28 + x35)
|
||||
var x37 uint64 = (x27 + x36)
|
||||
var x38 uint64 = (x26 + x37)
|
||||
var x39 uint64 = (x25 + x38)
|
||||
var x40 uint64 = (x23 + uint64(x24))
|
||||
var x41 uint64 = (x22 + x40)
|
||||
var x42 uint64 = (x21 + x41)
|
||||
var x43 uint64 = (x20 + x42)
|
||||
var x44 uint64 = (x19 + x43)
|
||||
var x45 uint64 = (x18 + x44)
|
||||
var x46 uint64 = (x17 + x45)
|
||||
var x47 uint64 = (x15 + uint64(x16))
|
||||
var x48 uint64 = (x14 + x47)
|
||||
var x49 uint64 = (x13 + x48)
|
||||
var x50 uint64 = (x12 + x49)
|
||||
var x51 uint64 = (x11 + x50)
|
||||
var x52 uint64 = (x10 + x51)
|
||||
var x53 uint64 = (x9 + x52)
|
||||
var x54 uint64 = (x7 + uint64(x8))
|
||||
var x55 uint64 = (x6 + x54)
|
||||
var x56 uint64 = (x5 + x55)
|
||||
var x57 uint64 = (x4 + x56)
|
||||
var x58 uint64 = (x3 + x57)
|
||||
var x59 uint64 = (x2 + x58)
|
||||
var x60 uint64 = (x1 + x59)
|
||||
// The function fiat_sc255_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ bytes_eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval out1 mod m = bytes_eval arg1 mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
// Output Bounds:
|
||||
// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
func fiat_sc255_from_bytes(out1 *[4]uint64, arg1 *[32]uint8) {
|
||||
x1 := (uint64(arg1[31]) << 56)
|
||||
x2 := (uint64(arg1[30]) << 48)
|
||||
x3 := (uint64(arg1[29]) << 40)
|
||||
x4 := (uint64(arg1[28]) << 32)
|
||||
x5 := (uint64(arg1[27]) << 24)
|
||||
x6 := (uint64(arg1[26]) << 16)
|
||||
x7 := (uint64(arg1[25]) << 8)
|
||||
x8 := arg1[24]
|
||||
x9 := (uint64(arg1[23]) << 56)
|
||||
x10 := (uint64(arg1[22]) << 48)
|
||||
x11 := (uint64(arg1[21]) << 40)
|
||||
x12 := (uint64(arg1[20]) << 32)
|
||||
x13 := (uint64(arg1[19]) << 24)
|
||||
x14 := (uint64(arg1[18]) << 16)
|
||||
x15 := (uint64(arg1[17]) << 8)
|
||||
x16 := arg1[16]
|
||||
x17 := (uint64(arg1[15]) << 56)
|
||||
x18 := (uint64(arg1[14]) << 48)
|
||||
x19 := (uint64(arg1[13]) << 40)
|
||||
x20 := (uint64(arg1[12]) << 32)
|
||||
x21 := (uint64(arg1[11]) << 24)
|
||||
x22 := (uint64(arg1[10]) << 16)
|
||||
x23 := (uint64(arg1[9]) << 8)
|
||||
x24 := arg1[8]
|
||||
x25 := (uint64(arg1[7]) << 56)
|
||||
x26 := (uint64(arg1[6]) << 48)
|
||||
x27 := (uint64(arg1[5]) << 40)
|
||||
x28 := (uint64(arg1[4]) << 32)
|
||||
x29 := (uint64(arg1[3]) << 24)
|
||||
x30 := (uint64(arg1[2]) << 16)
|
||||
x31 := (uint64(arg1[1]) << 8)
|
||||
x32 := arg1[0]
|
||||
x33 := (x31 + uint64(x32))
|
||||
x34 := (x30 + x33)
|
||||
x35 := (x29 + x34)
|
||||
x36 := (x28 + x35)
|
||||
x37 := (x27 + x36)
|
||||
x38 := (x26 + x37)
|
||||
x39 := (x25 + x38)
|
||||
x40 := (x23 + uint64(x24))
|
||||
x41 := (x22 + x40)
|
||||
x42 := (x21 + x41)
|
||||
x43 := (x20 + x42)
|
||||
x44 := (x19 + x43)
|
||||
x45 := (x18 + x44)
|
||||
x46 := (x17 + x45)
|
||||
x47 := (x15 + uint64(x16))
|
||||
x48 := (x14 + x47)
|
||||
x49 := (x13 + x48)
|
||||
x50 := (x12 + x49)
|
||||
x51 := (x11 + x50)
|
||||
x52 := (x10 + x51)
|
||||
x53 := (x9 + x52)
|
||||
x54 := (x7 + uint64(x8))
|
||||
x55 := (x6 + x54)
|
||||
x56 := (x5 + x55)
|
||||
x57 := (x4 + x56)
|
||||
x58 := (x3 + x57)
|
||||
x59 := (x2 + x58)
|
||||
x60 := (x1 + x59)
|
||||
out1[0] = x39
|
||||
out1[1] = x46
|
||||
out1[2] = x53
|
||||
out1[3] = x60
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_set_one returns the field element one in the Montgomery domain.
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = 1 mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_set_one(out1 *[4]uint64) {
|
||||
// The function fiat_sc255_set_one returns the field element one in the Montgomery domain.
|
||||
//
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = 1 mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiat_sc255_set_one(out1 *fiat_sc255_montgomery_domain_field_element) {
|
||||
out1[0] = 0xd6ec31748d98951d
|
||||
out1[1] = 0xc6ef5bf4737dcf70
|
||||
out1[2] = 0xfffffffffffffffe
|
||||
out1[3] = 0xfffffffffffffff
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_msat returns the saturated represtation of the prime modulus.
|
||||
* Postconditions:
|
||||
* twos_complement_eval out1 = m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
// The function fiat_sc255_msat returns the saturated representation of the prime modulus.
|
||||
//
|
||||
// Postconditions:
|
||||
// twos_complement_eval out1 = m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
// Output Bounds:
|
||||
// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
func fiat_sc255_msat(out1 *[5]uint64) {
|
||||
out1[0] = 0x5812631a5cf5d3ed
|
||||
out1[1] = 0x14def9dea2f79cd6
|
||||
|
|
@ -1512,17 +1469,14 @@ func fiat_sc255_msat(out1 *[5]uint64) {
|
|||
out1[4] = uint64(0x0)
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
// The function fiat_sc255_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
|
||||
//
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋)
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
// Output Bounds:
|
||||
// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
func fiat_sc255_divstep_precomp(out1 *[4]uint64) {
|
||||
out1[0] = 0xd70af84436a7cb92
|
||||
out1[1] = 0x5f71c978b0b8b159
|
||||
|
|
@ -1530,86 +1484,84 @@ func fiat_sc255_divstep_precomp(out1 *[4]uint64) {
|
|||
out1[3] = 0x19a2d36f193e4ff
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_divstep computes a divstep.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg4 < m
|
||||
* 0 ≤ eval arg5 < m
|
||||
* Postconditions:
|
||||
* out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
|
||||
* twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
|
||||
* twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
|
||||
* eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
|
||||
* eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
|
||||
* 0 ≤ eval out5 < m
|
||||
* 0 ≤ eval out5 < m
|
||||
* 0 ≤ eval out2 < m
|
||||
* 0 ≤ eval out3 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0xffffffffffffffff]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0xffffffffffffffff]
|
||||
* out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
// The function fiat_sc255_divstep computes a divstep.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg4 < m
|
||||
// 0 ≤ eval arg5 < m
|
||||
// Postconditions:
|
||||
// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
|
||||
// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
|
||||
// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
|
||||
// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
|
||||
// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
|
||||
// 0 ≤ eval out5 < m
|
||||
// 0 ≤ eval out5 < m
|
||||
// 0 ≤ eval out2 < m
|
||||
// 0 ≤ eval out3 < m
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [0x0 ~> 0xffffffffffffffff]
|
||||
// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// Output Bounds:
|
||||
// out1: [0x0 ~> 0xffffffffffffffff]
|
||||
// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
func fiat_sc255_divstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4]uint64, out5 *[4]uint64, arg1 uint64, arg2 *[5]uint64, arg3 *[5]uint64, arg4 *[4]uint64, arg5 *[4]uint64) {
|
||||
var x1 uint64
|
||||
x1, _ = fiat_sc255_addcarryx_u64((^arg1), uint64(0x1), 0x0)
|
||||
var x3 fiat_sc255_uint1 = (fiat_sc255_uint1((x1 >> 63)) & (fiat_sc255_uint1((arg3[0])) & 0x1))
|
||||
x3 := (fiat_sc255_uint1((x1 >> 63)) & (fiat_sc255_uint1(arg3[0]) & 0x1))
|
||||
var x4 uint64
|
||||
x4, _ = fiat_sc255_addcarryx_u64((^arg1), uint64(0x1), 0x0)
|
||||
var x6 uint64
|
||||
fiat_sc255_cmovznz_u64(&x6, x3, arg1, x4)
|
||||
var x7 uint64
|
||||
fiat_sc255_cmovznz_u64(&x7, x3, (arg2[0]), (arg3[0]))
|
||||
fiat_sc255_cmovznz_u64(&x7, x3, arg2[0], arg3[0])
|
||||
var x8 uint64
|
||||
fiat_sc255_cmovznz_u64(&x8, x3, (arg2[1]), (arg3[1]))
|
||||
fiat_sc255_cmovznz_u64(&x8, x3, arg2[1], arg3[1])
|
||||
var x9 uint64
|
||||
fiat_sc255_cmovznz_u64(&x9, x3, (arg2[2]), (arg3[2]))
|
||||
fiat_sc255_cmovznz_u64(&x9, x3, arg2[2], arg3[2])
|
||||
var x10 uint64
|
||||
fiat_sc255_cmovznz_u64(&x10, x3, (arg2[3]), (arg3[3]))
|
||||
fiat_sc255_cmovznz_u64(&x10, x3, arg2[3], arg3[3])
|
||||
var x11 uint64
|
||||
fiat_sc255_cmovznz_u64(&x11, x3, (arg2[4]), (arg3[4]))
|
||||
fiat_sc255_cmovznz_u64(&x11, x3, arg2[4], arg3[4])
|
||||
var x12 uint64
|
||||
var x13 fiat_sc255_uint1
|
||||
x12, x13 = fiat_sc255_addcarryx_u64(uint64(0x1), (^(arg2[0])), 0x0)
|
||||
x12, x13 = fiat_sc255_addcarryx_u64(uint64(0x1), (^arg2[0]), 0x0)
|
||||
var x14 uint64
|
||||
var x15 fiat_sc255_uint1
|
||||
x14, x15 = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[1])), x13)
|
||||
x14, x15 = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[1]), x13)
|
||||
var x16 uint64
|
||||
var x17 fiat_sc255_uint1
|
||||
x16, x17 = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[2])), x15)
|
||||
x16, x17 = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[2]), x15)
|
||||
var x18 uint64
|
||||
var x19 fiat_sc255_uint1
|
||||
x18, x19 = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[3])), x17)
|
||||
x18, x19 = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[3]), x17)
|
||||
var x20 uint64
|
||||
x20, _ = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[4])), x19)
|
||||
x20, _ = fiat_sc255_addcarryx_u64(uint64(0x0), (^arg2[4]), x19)
|
||||
var x22 uint64
|
||||
fiat_sc255_cmovznz_u64(&x22, x3, (arg3[0]), x12)
|
||||
fiat_sc255_cmovznz_u64(&x22, x3, arg3[0], x12)
|
||||
var x23 uint64
|
||||
fiat_sc255_cmovznz_u64(&x23, x3, (arg3[1]), x14)
|
||||
fiat_sc255_cmovznz_u64(&x23, x3, arg3[1], x14)
|
||||
var x24 uint64
|
||||
fiat_sc255_cmovznz_u64(&x24, x3, (arg3[2]), x16)
|
||||
fiat_sc255_cmovznz_u64(&x24, x3, arg3[2], x16)
|
||||
var x25 uint64
|
||||
fiat_sc255_cmovznz_u64(&x25, x3, (arg3[3]), x18)
|
||||
fiat_sc255_cmovznz_u64(&x25, x3, arg3[3], x18)
|
||||
var x26 uint64
|
||||
fiat_sc255_cmovznz_u64(&x26, x3, (arg3[4]), x20)
|
||||
fiat_sc255_cmovznz_u64(&x26, x3, arg3[4], x20)
|
||||
var x27 uint64
|
||||
fiat_sc255_cmovznz_u64(&x27, x3, (arg4[0]), (arg5[0]))
|
||||
fiat_sc255_cmovznz_u64(&x27, x3, arg4[0], arg5[0])
|
||||
var x28 uint64
|
||||
fiat_sc255_cmovznz_u64(&x28, x3, (arg4[1]), (arg5[1]))
|
||||
fiat_sc255_cmovznz_u64(&x28, x3, arg4[1], arg5[1])
|
||||
var x29 uint64
|
||||
fiat_sc255_cmovznz_u64(&x29, x3, (arg4[2]), (arg5[2]))
|
||||
fiat_sc255_cmovznz_u64(&x29, x3, arg4[2], arg5[2])
|
||||
var x30 uint64
|
||||
fiat_sc255_cmovznz_u64(&x30, x3, (arg4[3]), (arg5[3]))
|
||||
fiat_sc255_cmovznz_u64(&x30, x3, arg4[3], arg5[3])
|
||||
var x31 uint64
|
||||
var x32 fiat_sc255_uint1
|
||||
x31, x32 = fiat_sc255_addcarryx_u64(x27, x27, 0x0)
|
||||
|
|
@ -1636,10 +1588,10 @@ func fiat_sc255_divstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4
|
|||
x45, x46 = fiat_sc255_subborrowx_u64(x37, 0x1000000000000000, x44)
|
||||
var x48 fiat_sc255_uint1
|
||||
_, x48 = fiat_sc255_subborrowx_u64(uint64(x38), uint64(0x0), x46)
|
||||
var x49 uint64 = (arg4[3])
|
||||
var x50 uint64 = (arg4[2])
|
||||
var x51 uint64 = (arg4[1])
|
||||
var x52 uint64 = (arg4[0])
|
||||
x49 := arg4[3]
|
||||
x50 := arg4[2]
|
||||
x51 := arg4[1]
|
||||
x52 := arg4[0]
|
||||
var x53 uint64
|
||||
var x54 fiat_sc255_uint1
|
||||
x53, x54 = fiat_sc255_subborrowx_u64(uint64(0x0), x52, 0x0)
|
||||
|
|
@ -1666,14 +1618,14 @@ func fiat_sc255_divstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4
|
|||
var x68 uint64
|
||||
x68, _ = fiat_sc255_addcarryx_u64(x59, (x61 & 0x1000000000000000), x67)
|
||||
var x70 uint64
|
||||
fiat_sc255_cmovznz_u64(&x70, x3, (arg5[0]), x62)
|
||||
fiat_sc255_cmovznz_u64(&x70, x3, arg5[0], x62)
|
||||
var x71 uint64
|
||||
fiat_sc255_cmovznz_u64(&x71, x3, (arg5[1]), x64)
|
||||
fiat_sc255_cmovznz_u64(&x71, x3, arg5[1], x64)
|
||||
var x72 uint64
|
||||
fiat_sc255_cmovznz_u64(&x72, x3, (arg5[2]), x66)
|
||||
fiat_sc255_cmovznz_u64(&x72, x3, arg5[2], x66)
|
||||
var x73 uint64
|
||||
fiat_sc255_cmovznz_u64(&x73, x3, (arg5[3]), x68)
|
||||
var x74 fiat_sc255_uint1 = (fiat_sc255_uint1(x22) & 0x1)
|
||||
fiat_sc255_cmovznz_u64(&x73, x3, arg5[3], x68)
|
||||
x74 := (fiat_sc255_uint1(x22) & 0x1)
|
||||
var x75 uint64
|
||||
fiat_sc255_cmovznz_u64(&x75, x74, uint64(0x0), x7)
|
||||
var x76 uint64
|
||||
|
|
@ -1734,11 +1686,11 @@ func fiat_sc255_divstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4
|
|||
_, x111 = fiat_sc255_subborrowx_u64(uint64(x101), uint64(0x0), x109)
|
||||
var x112 uint64
|
||||
x112, _ = fiat_sc255_addcarryx_u64(x6, uint64(0x1), 0x0)
|
||||
var x114 uint64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff))
|
||||
var x115 uint64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff))
|
||||
var x116 uint64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff))
|
||||
var x117 uint64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff))
|
||||
var x118 uint64 = ((x88 & 0x8000000000000000) | (x88 >> 1))
|
||||
x114 := ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff))
|
||||
x115 := ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff))
|
||||
x116 := ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff))
|
||||
x117 := ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff))
|
||||
x118 := ((x88 & 0x8000000000000000) | (x88 >> 1))
|
||||
var x119 uint64
|
||||
fiat_sc255_cmovznz_u64(&x119, x48, x39, x31)
|
||||
var x120 uint64
|
||||
|
|
|
|||
22
scalar.go
22
scalar.go
|
|
@ -23,7 +23,7 @@ import (
|
|||
type Scalar struct {
|
||||
// A Scalar is an integer modulo l = 2^252 + 27742317777372353535851937790883648493.
|
||||
// Internally, this implementation keeps the scalar in the Montgomery domain.
|
||||
s [4]uint64
|
||||
s fiat_sc255_montgomery_domain_field_element
|
||||
}
|
||||
|
||||
var (
|
||||
|
|
@ -48,28 +48,28 @@ func (s *Scalar) MultiplyAdd(x, y, z *Scalar) *Scalar {
|
|||
// Add sets s = x + y mod l, and returns s.
|
||||
func (s *Scalar) Add(x, y *Scalar) *Scalar {
|
||||
// s = 1 * x + y mod l
|
||||
fiat_sc255_add((*[4]uint64)(&s.s), (*[4]uint64)(&x.s), (*[4]uint64)(&y.s))
|
||||
fiat_sc255_add(&s.s, &x.s, &y.s)
|
||||
return s
|
||||
}
|
||||
|
||||
// Subtract sets s = x - y mod l, and returns s.
|
||||
func (s *Scalar) Subtract(x, y *Scalar) *Scalar {
|
||||
// s = -1 * y + x mod l
|
||||
fiat_sc255_sub((*[4]uint64)(&s.s), (*[4]uint64)(&x.s), (*[4]uint64)(&y.s))
|
||||
fiat_sc255_sub(&s.s, &x.s, &y.s)
|
||||
return s
|
||||
}
|
||||
|
||||
// Negate sets s = -x mod l, and returns s.
|
||||
func (s *Scalar) Negate(x *Scalar) *Scalar {
|
||||
// s = -1 * x + 0 mod l
|
||||
fiat_sc255_opp((*[4]uint64)(&s.s), (*[4]uint64)(&x.s))
|
||||
fiat_sc255_opp(&s.s, &x.s)
|
||||
return s
|
||||
}
|
||||
|
||||
// Multiply sets s = x * y mod l, and returns s.
|
||||
func (s *Scalar) Multiply(x, y *Scalar) *Scalar {
|
||||
// s = x * y + 0 mod l
|
||||
fiat_sc255_mul((*[4]uint64)(&s.s), (*[4]uint64)(&x.s), (*[4]uint64)(&y.s))
|
||||
fiat_sc255_mul(&s.s, &x.s, &y.s)
|
||||
return s
|
||||
}
|
||||
|
||||
|
|
@ -97,7 +97,7 @@ func (s *Scalar) SetUniformBytes(x []byte) (*Scalar, error) {
|
|||
scReduce(&reduced, &wideBytes)
|
||||
|
||||
fiat_sc255_from_bytes((*[4]uint64)(&s.s), &reduced)
|
||||
fiat_sc255_to_montgomery((*[4]uint64)(&s.s), (*[4]uint64)(&s.s))
|
||||
fiat_sc255_to_montgomery(&s.s, (*fiat_sc255_non_montgomery_domain_field_element)(&s.s))
|
||||
|
||||
return s, nil
|
||||
}
|
||||
|
|
@ -118,7 +118,7 @@ func (s *Scalar) SetCanonicalBytes(x []byte) (*Scalar, error) {
|
|||
}
|
||||
|
||||
fiat_sc255_from_bytes((*[4]uint64)(&s.s), &ss)
|
||||
fiat_sc255_to_montgomery((*[4]uint64)(&s.s), (*[4]uint64)(&s.s))
|
||||
fiat_sc255_to_montgomery(&s.s, (*fiat_sc255_non_montgomery_domain_field_element)(&s.s))
|
||||
|
||||
return s, nil
|
||||
}
|
||||
|
|
@ -167,7 +167,7 @@ func (s *Scalar) SetBytesWithClamping(x []byte) (*Scalar, error) {
|
|||
var reduced [32]byte
|
||||
scReduce(&reduced, &wideBytes)
|
||||
fiat_sc255_from_bytes((*[4]uint64)(&s.s), &reduced)
|
||||
fiat_sc255_to_montgomery((*[4]uint64)(&s.s), (*[4]uint64)(&s.s))
|
||||
fiat_sc255_to_montgomery(&s.s, (*fiat_sc255_non_montgomery_domain_field_element)(&s.s))
|
||||
return s, nil
|
||||
}
|
||||
|
||||
|
|
@ -181,9 +181,9 @@ func (s *Scalar) Bytes() []byte {
|
|||
}
|
||||
|
||||
func (s *Scalar) bytes(out *[32]byte) []byte {
|
||||
var limbs [4]uint64
|
||||
fiat_sc255_from_montgomery(&limbs, (*[4]uint64)(&s.s))
|
||||
fiat_sc255_to_bytes(out, &limbs)
|
||||
var limbs fiat_sc255_non_montgomery_domain_field_element
|
||||
fiat_sc255_from_montgomery(&limbs, &s.s)
|
||||
fiat_sc255_to_bytes(out, (*[4]uint64)(&limbs))
|
||||
return out[:]
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -43,8 +43,8 @@ func (Scalar) Generate(rand *mathrand.Rand, size int) reflect.Value {
|
|||
}
|
||||
|
||||
val := Scalar{}
|
||||
fiat_sc255_from_bytes(&val.s, &s)
|
||||
fiat_sc255_to_montgomery(&val.s, &val.s)
|
||||
fiat_sc255_from_bytes((*[4]uint64)(&val.s), &s)
|
||||
fiat_sc255_to_montgomery(&val.s, (*fiat_sc255_non_montgomery_domain_field_element)(&val.s))
|
||||
|
||||
return reflect.ValueOf(val)
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue