Compare commits
10 commits
306e451b8b
...
e42c4b5eb9
| Author | SHA1 | Date | |
|---|---|---|---|
 DataHoarder
|
e42c4b5eb9
|
||
|
8c58ed0e35 | ||
|
5c60041eec | ||
|
|
63e0935134 | ||
|
|
467a92bcfd | ||
|
|
50a0a9e22d | ||
|
|
755954a498 | ||
|
589b96254b | ||
|
|
8b9f5baf25 | ||
|
|
e69bd0a524 |
2
.github/workflows/test.yml
vendored
2
.github/workflows/test.yml
vendored
|
|
@ -6,7 +6,7 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
go: [ '1.16', '1.x' ]
|
||||
go: [ '1.17', '1.x' ]
|
||||
steps:
|
||||
- uses: actions/setup-go@v2
|
||||
with: { go-version: "${{ matrix.go }}" }
|
||||
|
|
|
|||
2
extra.go
2
extra.go
|
|
@ -143,7 +143,7 @@ func (s *Scalar) Invert(t *Scalar) *Scalar {
|
|||
for i := 0; i < 7; i++ {
|
||||
table[i+1].Multiply(&table[i], &tt)
|
||||
}
|
||||
// Now table = [t**1, t**3, t**7, t**11, t**13, t**15]
|
||||
// Now table = [t**1, t**3, t**5, t**7, t**9, t**11, t**13, t**15]
|
||||
// so t**k = t[k/2] for odd k
|
||||
|
||||
// To compute the sliding window digits, use the following Sage script:
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@ func TestScalarInvert(t *testing.T) {
|
|||
var check Scalar
|
||||
check.Multiply((*Scalar)(&x), &xInv)
|
||||
|
||||
return check.Equal(&scOne) == 1 && isReduced(xInv.Bytes())
|
||||
return check.Equal(scOne) == 1 && isReduced(xInv.Bytes())
|
||||
}
|
||||
|
||||
if err := quick.Check(invertWorks, quickCheckConfig32); err != nil {
|
||||
|
|
@ -119,7 +119,7 @@ func TestScalarInvert(t *testing.T) {
|
|||
var check Scalar
|
||||
check.Multiply(&randomScalar, randomInverse)
|
||||
|
||||
if check.Equal(&scOne) == 0 || !isReduced(randomInverse.Bytes()) {
|
||||
if check.Equal(scOne) == 0 || !isReduced(randomInverse.Bytes()) {
|
||||
t.Error("inversion did not work")
|
||||
}
|
||||
|
||||
|
|
|
|||
1777
fiat_scalar.go
1777
fiat_scalar.go
|
|
@ -1,1777 +0,0 @@
|
|||
/* Autogenerated: ./src/ExtractionOCaml/word_by_word_montgomery --lang Go sc255 64 '2^252 + 27742317777372353535851937790883648493' */
|
||||
/* curve description: sc255 */
|
||||
/* machine_wordsize = 64 (from "64") */
|
||||
/* requested operations: (all) */
|
||||
/* m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493") */
|
||||
/* */
|
||||
/* NOTE: In addition to the bounds specified above each function, all */
|
||||
/* functions synthesized for this Montgomery arithmetic require the */
|
||||
/* input to be strictly less than the prime modulus (m), and also */
|
||||
/* require the input to be in the unique saturated representation. */
|
||||
/* All functions also ensure that these two properties are true of */
|
||||
/* return values. */
|
||||
/* */
|
||||
/* Computed values: */
|
||||
/* eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) */
|
||||
/* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */
|
||||
|
||||
package edwards25519
|
||||
|
||||
import "math/bits"
|
||||
|
||||
type fiat_sc255_uint1 uint8
|
||||
type fiat_sc255_int1 int8
|
||||
|
||||
/* The function fiat_sc255_addcarryx_u64 is a thin wrapper around bits.Add64 that uses fiat_sc255_uint1 rather than uint64 */
|
||||
func fiat_sc255_addcarryx_u64(x uint64, y uint64, carry fiat_sc255_uint1) (uint64, fiat_sc255_uint1) {
|
||||
var sum uint64
|
||||
var carryOut uint64
|
||||
sum, carryOut = bits.Add64(x, y, uint64(carry))
|
||||
return sum, fiat_sc255_uint1(carryOut)
|
||||
}
|
||||
|
||||
/* The function fiat_sc255_subborrowx_u64 is a thin wrapper around bits.Sub64 that uses fiat_sc255_uint1 rather than uint64 */
|
||||
func fiat_sc255_subborrowx_u64(x uint64, y uint64, carry fiat_sc255_uint1) (uint64, fiat_sc255_uint1) {
|
||||
var sum uint64
|
||||
var carryOut uint64
|
||||
sum, carryOut = bits.Sub64(x, y, uint64(carry))
|
||||
return sum, fiat_sc255_uint1(carryOut)
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_cmovznz_u64 is a single-word conditional move.
|
||||
* Postconditions:
|
||||
* out1 = (if arg1 = 0 then arg2 else arg3)
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [0x0 ~> 0xffffffffffffffff]
|
||||
* arg3: [0x0 ~> 0xffffffffffffffff]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0xffffffffffffffff]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_cmovznz_u64(out1 *uint64, arg1 fiat_sc255_uint1, arg2 uint64, arg3 uint64) {
|
||||
// var x1 fiat_sc255_uint1 = (! /* TODO: FIX ME */ (! /* TODO: FIX ME */ arg1))
|
||||
// var x2 uint64 = (uint64((fiat_sc255_int1(0x0) - fiat_sc255_int1(x1))) & 0xffffffffffffffff)
|
||||
// var x3 uint64 = ((x2 & arg3) | ((^x2) & arg2))
|
||||
// call with --cmovznz-by-mul for Go
|
||||
var x1 uint64 = (uint64(arg1) * 0xffffffffffffffff)
|
||||
var x2 uint64 = ((x1 & arg3) | ((^x1) & arg2))
|
||||
*out1 = x2
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_mul multiplies two field elements in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* 0 ≤ eval arg2 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_mul(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[1])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[3])
|
||||
var x4 uint64 = (arg1[0])
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, (arg2[3]))
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x8, x7 = bits.Mul64(x4, (arg2[2]))
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x10, x9 = bits.Mul64(x4, (arg2[1]))
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x12, x11 = bits.Mul64(x4, (arg2[0]))
|
||||
var x13 uint64
|
||||
var x14 fiat_sc255_uint1
|
||||
x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0)
|
||||
var x15 uint64
|
||||
var x16 fiat_sc255_uint1
|
||||
x15, x16 = fiat_sc255_addcarryx_u64(x10, x7, x14)
|
||||
var x17 uint64
|
||||
var x18 fiat_sc255_uint1
|
||||
x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16)
|
||||
var x19 uint64 = (uint64(x18) + x6)
|
||||
var x20 uint64
|
||||
_, x20 = bits.Mul64(x11, 0xd2b51da312547e1b)
|
||||
var x22 uint64
|
||||
var x23 uint64
|
||||
x23, x22 = bits.Mul64(x20, 0x1000000000000000)
|
||||
var x24 uint64
|
||||
var x25 uint64
|
||||
x25, x24 = bits.Mul64(x20, 0x14def9dea2f79cd6)
|
||||
var x26 uint64
|
||||
var x27 uint64
|
||||
x27, x26 = bits.Mul64(x20, 0x5812631a5cf5d3ed)
|
||||
var x28 uint64
|
||||
var x29 fiat_sc255_uint1
|
||||
x28, x29 = fiat_sc255_addcarryx_u64(x27, x24, 0x0)
|
||||
var x30 uint64 = (uint64(x29) + x25)
|
||||
var x32 fiat_sc255_uint1
|
||||
_, x32 = fiat_sc255_addcarryx_u64(x11, x26, 0x0)
|
||||
var x33 uint64
|
||||
var x34 fiat_sc255_uint1
|
||||
x33, x34 = fiat_sc255_addcarryx_u64(x13, x28, x32)
|
||||
var x35 uint64
|
||||
var x36 fiat_sc255_uint1
|
||||
x35, x36 = fiat_sc255_addcarryx_u64(x15, x30, x34)
|
||||
var x37 uint64
|
||||
var x38 fiat_sc255_uint1
|
||||
x37, x38 = fiat_sc255_addcarryx_u64(x17, x22, x36)
|
||||
var x39 uint64
|
||||
var x40 fiat_sc255_uint1
|
||||
x39, x40 = fiat_sc255_addcarryx_u64(x19, x23, x38)
|
||||
var x41 uint64
|
||||
var x42 uint64
|
||||
x42, x41 = bits.Mul64(x1, (arg2[3]))
|
||||
var x43 uint64
|
||||
var x44 uint64
|
||||
x44, x43 = bits.Mul64(x1, (arg2[2]))
|
||||
var x45 uint64
|
||||
var x46 uint64
|
||||
x46, x45 = bits.Mul64(x1, (arg2[1]))
|
||||
var x47 uint64
|
||||
var x48 uint64
|
||||
x48, x47 = bits.Mul64(x1, (arg2[0]))
|
||||
var x49 uint64
|
||||
var x50 fiat_sc255_uint1
|
||||
x49, x50 = fiat_sc255_addcarryx_u64(x48, x45, 0x0)
|
||||
var x51 uint64
|
||||
var x52 fiat_sc255_uint1
|
||||
x51, x52 = fiat_sc255_addcarryx_u64(x46, x43, x50)
|
||||
var x53 uint64
|
||||
var x54 fiat_sc255_uint1
|
||||
x53, x54 = fiat_sc255_addcarryx_u64(x44, x41, x52)
|
||||
var x55 uint64 = (uint64(x54) + x42)
|
||||
var x56 uint64
|
||||
var x57 fiat_sc255_uint1
|
||||
x56, x57 = fiat_sc255_addcarryx_u64(x33, x47, 0x0)
|
||||
var x58 uint64
|
||||
var x59 fiat_sc255_uint1
|
||||
x58, x59 = fiat_sc255_addcarryx_u64(x35, x49, x57)
|
||||
var x60 uint64
|
||||
var x61 fiat_sc255_uint1
|
||||
x60, x61 = fiat_sc255_addcarryx_u64(x37, x51, x59)
|
||||
var x62 uint64
|
||||
var x63 fiat_sc255_uint1
|
||||
x62, x63 = fiat_sc255_addcarryx_u64(x39, x53, x61)
|
||||
var x64 uint64
|
||||
var x65 fiat_sc255_uint1
|
||||
x64, x65 = fiat_sc255_addcarryx_u64(uint64(x40), x55, x63)
|
||||
var x66 uint64
|
||||
_, x66 = bits.Mul64(x56, 0xd2b51da312547e1b)
|
||||
var x68 uint64
|
||||
var x69 uint64
|
||||
x69, x68 = bits.Mul64(x66, 0x1000000000000000)
|
||||
var x70 uint64
|
||||
var x71 uint64
|
||||
x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6)
|
||||
var x72 uint64
|
||||
var x73 uint64
|
||||
x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed)
|
||||
var x74 uint64
|
||||
var x75 fiat_sc255_uint1
|
||||
x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0)
|
||||
var x76 uint64 = (uint64(x75) + x71)
|
||||
var x78 fiat_sc255_uint1
|
||||
_, x78 = fiat_sc255_addcarryx_u64(x56, x72, 0x0)
|
||||
var x79 uint64
|
||||
var x80 fiat_sc255_uint1
|
||||
x79, x80 = fiat_sc255_addcarryx_u64(x58, x74, x78)
|
||||
var x81 uint64
|
||||
var x82 fiat_sc255_uint1
|
||||
x81, x82 = fiat_sc255_addcarryx_u64(x60, x76, x80)
|
||||
var x83 uint64
|
||||
var x84 fiat_sc255_uint1
|
||||
x83, x84 = fiat_sc255_addcarryx_u64(x62, x68, x82)
|
||||
var x85 uint64
|
||||
var x86 fiat_sc255_uint1
|
||||
x85, x86 = fiat_sc255_addcarryx_u64(x64, x69, x84)
|
||||
var x87 uint64 = (uint64(x86) + uint64(x65))
|
||||
var x88 uint64
|
||||
var x89 uint64
|
||||
x89, x88 = bits.Mul64(x2, (arg2[3]))
|
||||
var x90 uint64
|
||||
var x91 uint64
|
||||
x91, x90 = bits.Mul64(x2, (arg2[2]))
|
||||
var x92 uint64
|
||||
var x93 uint64
|
||||
x93, x92 = bits.Mul64(x2, (arg2[1]))
|
||||
var x94 uint64
|
||||
var x95 uint64
|
||||
x95, x94 = bits.Mul64(x2, (arg2[0]))
|
||||
var x96 uint64
|
||||
var x97 fiat_sc255_uint1
|
||||
x96, x97 = fiat_sc255_addcarryx_u64(x95, x92, 0x0)
|
||||
var x98 uint64
|
||||
var x99 fiat_sc255_uint1
|
||||
x98, x99 = fiat_sc255_addcarryx_u64(x93, x90, x97)
|
||||
var x100 uint64
|
||||
var x101 fiat_sc255_uint1
|
||||
x100, x101 = fiat_sc255_addcarryx_u64(x91, x88, x99)
|
||||
var x102 uint64 = (uint64(x101) + x89)
|
||||
var x103 uint64
|
||||
var x104 fiat_sc255_uint1
|
||||
x103, x104 = fiat_sc255_addcarryx_u64(x79, x94, 0x0)
|
||||
var x105 uint64
|
||||
var x106 fiat_sc255_uint1
|
||||
x105, x106 = fiat_sc255_addcarryx_u64(x81, x96, x104)
|
||||
var x107 uint64
|
||||
var x108 fiat_sc255_uint1
|
||||
x107, x108 = fiat_sc255_addcarryx_u64(x83, x98, x106)
|
||||
var x109 uint64
|
||||
var x110 fiat_sc255_uint1
|
||||
x109, x110 = fiat_sc255_addcarryx_u64(x85, x100, x108)
|
||||
var x111 uint64
|
||||
var x112 fiat_sc255_uint1
|
||||
x111, x112 = fiat_sc255_addcarryx_u64(x87, x102, x110)
|
||||
var x113 uint64
|
||||
_, x113 = bits.Mul64(x103, 0xd2b51da312547e1b)
|
||||
var x115 uint64
|
||||
var x116 uint64
|
||||
x116, x115 = bits.Mul64(x113, 0x1000000000000000)
|
||||
var x117 uint64
|
||||
var x118 uint64
|
||||
x118, x117 = bits.Mul64(x113, 0x14def9dea2f79cd6)
|
||||
var x119 uint64
|
||||
var x120 uint64
|
||||
x120, x119 = bits.Mul64(x113, 0x5812631a5cf5d3ed)
|
||||
var x121 uint64
|
||||
var x122 fiat_sc255_uint1
|
||||
x121, x122 = fiat_sc255_addcarryx_u64(x120, x117, 0x0)
|
||||
var x123 uint64 = (uint64(x122) + x118)
|
||||
var x125 fiat_sc255_uint1
|
||||
_, x125 = fiat_sc255_addcarryx_u64(x103, x119, 0x0)
|
||||
var x126 uint64
|
||||
var x127 fiat_sc255_uint1
|
||||
x126, x127 = fiat_sc255_addcarryx_u64(x105, x121, x125)
|
||||
var x128 uint64
|
||||
var x129 fiat_sc255_uint1
|
||||
x128, x129 = fiat_sc255_addcarryx_u64(x107, x123, x127)
|
||||
var x130 uint64
|
||||
var x131 fiat_sc255_uint1
|
||||
x130, x131 = fiat_sc255_addcarryx_u64(x109, x115, x129)
|
||||
var x132 uint64
|
||||
var x133 fiat_sc255_uint1
|
||||
x132, x133 = fiat_sc255_addcarryx_u64(x111, x116, x131)
|
||||
var x134 uint64 = (uint64(x133) + uint64(x112))
|
||||
var x135 uint64
|
||||
var x136 uint64
|
||||
x136, x135 = bits.Mul64(x3, (arg2[3]))
|
||||
var x137 uint64
|
||||
var x138 uint64
|
||||
x138, x137 = bits.Mul64(x3, (arg2[2]))
|
||||
var x139 uint64
|
||||
var x140 uint64
|
||||
x140, x139 = bits.Mul64(x3, (arg2[1]))
|
||||
var x141 uint64
|
||||
var x142 uint64
|
||||
x142, x141 = bits.Mul64(x3, (arg2[0]))
|
||||
var x143 uint64
|
||||
var x144 fiat_sc255_uint1
|
||||
x143, x144 = fiat_sc255_addcarryx_u64(x142, x139, 0x0)
|
||||
var x145 uint64
|
||||
var x146 fiat_sc255_uint1
|
||||
x145, x146 = fiat_sc255_addcarryx_u64(x140, x137, x144)
|
||||
var x147 uint64
|
||||
var x148 fiat_sc255_uint1
|
||||
x147, x148 = fiat_sc255_addcarryx_u64(x138, x135, x146)
|
||||
var x149 uint64 = (uint64(x148) + x136)
|
||||
var x150 uint64
|
||||
var x151 fiat_sc255_uint1
|
||||
x150, x151 = fiat_sc255_addcarryx_u64(x126, x141, 0x0)
|
||||
var x152 uint64
|
||||
var x153 fiat_sc255_uint1
|
||||
x152, x153 = fiat_sc255_addcarryx_u64(x128, x143, x151)
|
||||
var x154 uint64
|
||||
var x155 fiat_sc255_uint1
|
||||
x154, x155 = fiat_sc255_addcarryx_u64(x130, x145, x153)
|
||||
var x156 uint64
|
||||
var x157 fiat_sc255_uint1
|
||||
x156, x157 = fiat_sc255_addcarryx_u64(x132, x147, x155)
|
||||
var x158 uint64
|
||||
var x159 fiat_sc255_uint1
|
||||
x158, x159 = fiat_sc255_addcarryx_u64(x134, x149, x157)
|
||||
var x160 uint64
|
||||
_, x160 = bits.Mul64(x150, 0xd2b51da312547e1b)
|
||||
var x162 uint64
|
||||
var x163 uint64
|
||||
x163, x162 = bits.Mul64(x160, 0x1000000000000000)
|
||||
var x164 uint64
|
||||
var x165 uint64
|
||||
x165, x164 = bits.Mul64(x160, 0x14def9dea2f79cd6)
|
||||
var x166 uint64
|
||||
var x167 uint64
|
||||
x167, x166 = bits.Mul64(x160, 0x5812631a5cf5d3ed)
|
||||
var x168 uint64
|
||||
var x169 fiat_sc255_uint1
|
||||
x168, x169 = fiat_sc255_addcarryx_u64(x167, x164, 0x0)
|
||||
var x170 uint64 = (uint64(x169) + x165)
|
||||
var x172 fiat_sc255_uint1
|
||||
_, x172 = fiat_sc255_addcarryx_u64(x150, x166, 0x0)
|
||||
var x173 uint64
|
||||
var x174 fiat_sc255_uint1
|
||||
x173, x174 = fiat_sc255_addcarryx_u64(x152, x168, x172)
|
||||
var x175 uint64
|
||||
var x176 fiat_sc255_uint1
|
||||
x175, x176 = fiat_sc255_addcarryx_u64(x154, x170, x174)
|
||||
var x177 uint64
|
||||
var x178 fiat_sc255_uint1
|
||||
x177, x178 = fiat_sc255_addcarryx_u64(x156, x162, x176)
|
||||
var x179 uint64
|
||||
var x180 fiat_sc255_uint1
|
||||
x179, x180 = fiat_sc255_addcarryx_u64(x158, x163, x178)
|
||||
var x181 uint64 = (uint64(x180) + uint64(x159))
|
||||
var x182 uint64
|
||||
var x183 fiat_sc255_uint1
|
||||
x182, x183 = fiat_sc255_subborrowx_u64(x173, 0x5812631a5cf5d3ed, 0x0)
|
||||
var x184 uint64
|
||||
var x185 fiat_sc255_uint1
|
||||
x184, x185 = fiat_sc255_subborrowx_u64(x175, 0x14def9dea2f79cd6, x183)
|
||||
var x186 uint64
|
||||
var x187 fiat_sc255_uint1
|
||||
x186, x187 = fiat_sc255_subborrowx_u64(x177, uint64(0x0), x185)
|
||||
var x188 uint64
|
||||
var x189 fiat_sc255_uint1
|
||||
x188, x189 = fiat_sc255_subborrowx_u64(x179, 0x1000000000000000, x187)
|
||||
var x191 fiat_sc255_uint1
|
||||
_, x191 = fiat_sc255_subborrowx_u64(x181, uint64(0x0), x189)
|
||||
var x192 uint64
|
||||
fiat_sc255_cmovznz_u64(&x192, x191, x182, x173)
|
||||
var x193 uint64
|
||||
fiat_sc255_cmovznz_u64(&x193, x191, x184, x175)
|
||||
var x194 uint64
|
||||
fiat_sc255_cmovznz_u64(&x194, x191, x186, x177)
|
||||
var x195 uint64
|
||||
fiat_sc255_cmovznz_u64(&x195, x191, x188, x179)
|
||||
out1[0] = x192
|
||||
out1[1] = x193
|
||||
out1[2] = x194
|
||||
out1[3] = x195
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_square squares a field element in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_square(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[1])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[3])
|
||||
var x4 uint64 = (arg1[0])
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, (arg1[3]))
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x8, x7 = bits.Mul64(x4, (arg1[2]))
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x10, x9 = bits.Mul64(x4, (arg1[1]))
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x12, x11 = bits.Mul64(x4, (arg1[0]))
|
||||
var x13 uint64
|
||||
var x14 fiat_sc255_uint1
|
||||
x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0)
|
||||
var x15 uint64
|
||||
var x16 fiat_sc255_uint1
|
||||
x15, x16 = fiat_sc255_addcarryx_u64(x10, x7, x14)
|
||||
var x17 uint64
|
||||
var x18 fiat_sc255_uint1
|
||||
x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16)
|
||||
var x19 uint64 = (uint64(x18) + x6)
|
||||
var x20 uint64
|
||||
_, x20 = bits.Mul64(x11, 0xd2b51da312547e1b)
|
||||
var x22 uint64
|
||||
var x23 uint64
|
||||
x23, x22 = bits.Mul64(x20, 0x1000000000000000)
|
||||
var x24 uint64
|
||||
var x25 uint64
|
||||
x25, x24 = bits.Mul64(x20, 0x14def9dea2f79cd6)
|
||||
var x26 uint64
|
||||
var x27 uint64
|
||||
x27, x26 = bits.Mul64(x20, 0x5812631a5cf5d3ed)
|
||||
var x28 uint64
|
||||
var x29 fiat_sc255_uint1
|
||||
x28, x29 = fiat_sc255_addcarryx_u64(x27, x24, 0x0)
|
||||
var x30 uint64 = (uint64(x29) + x25)
|
||||
var x32 fiat_sc255_uint1
|
||||
_, x32 = fiat_sc255_addcarryx_u64(x11, x26, 0x0)
|
||||
var x33 uint64
|
||||
var x34 fiat_sc255_uint1
|
||||
x33, x34 = fiat_sc255_addcarryx_u64(x13, x28, x32)
|
||||
var x35 uint64
|
||||
var x36 fiat_sc255_uint1
|
||||
x35, x36 = fiat_sc255_addcarryx_u64(x15, x30, x34)
|
||||
var x37 uint64
|
||||
var x38 fiat_sc255_uint1
|
||||
x37, x38 = fiat_sc255_addcarryx_u64(x17, x22, x36)
|
||||
var x39 uint64
|
||||
var x40 fiat_sc255_uint1
|
||||
x39, x40 = fiat_sc255_addcarryx_u64(x19, x23, x38)
|
||||
var x41 uint64
|
||||
var x42 uint64
|
||||
x42, x41 = bits.Mul64(x1, (arg1[3]))
|
||||
var x43 uint64
|
||||
var x44 uint64
|
||||
x44, x43 = bits.Mul64(x1, (arg1[2]))
|
||||
var x45 uint64
|
||||
var x46 uint64
|
||||
x46, x45 = bits.Mul64(x1, (arg1[1]))
|
||||
var x47 uint64
|
||||
var x48 uint64
|
||||
x48, x47 = bits.Mul64(x1, (arg1[0]))
|
||||
var x49 uint64
|
||||
var x50 fiat_sc255_uint1
|
||||
x49, x50 = fiat_sc255_addcarryx_u64(x48, x45, 0x0)
|
||||
var x51 uint64
|
||||
var x52 fiat_sc255_uint1
|
||||
x51, x52 = fiat_sc255_addcarryx_u64(x46, x43, x50)
|
||||
var x53 uint64
|
||||
var x54 fiat_sc255_uint1
|
||||
x53, x54 = fiat_sc255_addcarryx_u64(x44, x41, x52)
|
||||
var x55 uint64 = (uint64(x54) + x42)
|
||||
var x56 uint64
|
||||
var x57 fiat_sc255_uint1
|
||||
x56, x57 = fiat_sc255_addcarryx_u64(x33, x47, 0x0)
|
||||
var x58 uint64
|
||||
var x59 fiat_sc255_uint1
|
||||
x58, x59 = fiat_sc255_addcarryx_u64(x35, x49, x57)
|
||||
var x60 uint64
|
||||
var x61 fiat_sc255_uint1
|
||||
x60, x61 = fiat_sc255_addcarryx_u64(x37, x51, x59)
|
||||
var x62 uint64
|
||||
var x63 fiat_sc255_uint1
|
||||
x62, x63 = fiat_sc255_addcarryx_u64(x39, x53, x61)
|
||||
var x64 uint64
|
||||
var x65 fiat_sc255_uint1
|
||||
x64, x65 = fiat_sc255_addcarryx_u64(uint64(x40), x55, x63)
|
||||
var x66 uint64
|
||||
_, x66 = bits.Mul64(x56, 0xd2b51da312547e1b)
|
||||
var x68 uint64
|
||||
var x69 uint64
|
||||
x69, x68 = bits.Mul64(x66, 0x1000000000000000)
|
||||
var x70 uint64
|
||||
var x71 uint64
|
||||
x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6)
|
||||
var x72 uint64
|
||||
var x73 uint64
|
||||
x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed)
|
||||
var x74 uint64
|
||||
var x75 fiat_sc255_uint1
|
||||
x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0)
|
||||
var x76 uint64 = (uint64(x75) + x71)
|
||||
var x78 fiat_sc255_uint1
|
||||
_, x78 = fiat_sc255_addcarryx_u64(x56, x72, 0x0)
|
||||
var x79 uint64
|
||||
var x80 fiat_sc255_uint1
|
||||
x79, x80 = fiat_sc255_addcarryx_u64(x58, x74, x78)
|
||||
var x81 uint64
|
||||
var x82 fiat_sc255_uint1
|
||||
x81, x82 = fiat_sc255_addcarryx_u64(x60, x76, x80)
|
||||
var x83 uint64
|
||||
var x84 fiat_sc255_uint1
|
||||
x83, x84 = fiat_sc255_addcarryx_u64(x62, x68, x82)
|
||||
var x85 uint64
|
||||
var x86 fiat_sc255_uint1
|
||||
x85, x86 = fiat_sc255_addcarryx_u64(x64, x69, x84)
|
||||
var x87 uint64 = (uint64(x86) + uint64(x65))
|
||||
var x88 uint64
|
||||
var x89 uint64
|
||||
x89, x88 = bits.Mul64(x2, (arg1[3]))
|
||||
var x90 uint64
|
||||
var x91 uint64
|
||||
x91, x90 = bits.Mul64(x2, (arg1[2]))
|
||||
var x92 uint64
|
||||
var x93 uint64
|
||||
x93, x92 = bits.Mul64(x2, (arg1[1]))
|
||||
var x94 uint64
|
||||
var x95 uint64
|
||||
x95, x94 = bits.Mul64(x2, (arg1[0]))
|
||||
var x96 uint64
|
||||
var x97 fiat_sc255_uint1
|
||||
x96, x97 = fiat_sc255_addcarryx_u64(x95, x92, 0x0)
|
||||
var x98 uint64
|
||||
var x99 fiat_sc255_uint1
|
||||
x98, x99 = fiat_sc255_addcarryx_u64(x93, x90, x97)
|
||||
var x100 uint64
|
||||
var x101 fiat_sc255_uint1
|
||||
x100, x101 = fiat_sc255_addcarryx_u64(x91, x88, x99)
|
||||
var x102 uint64 = (uint64(x101) + x89)
|
||||
var x103 uint64
|
||||
var x104 fiat_sc255_uint1
|
||||
x103, x104 = fiat_sc255_addcarryx_u64(x79, x94, 0x0)
|
||||
var x105 uint64
|
||||
var x106 fiat_sc255_uint1
|
||||
x105, x106 = fiat_sc255_addcarryx_u64(x81, x96, x104)
|
||||
var x107 uint64
|
||||
var x108 fiat_sc255_uint1
|
||||
x107, x108 = fiat_sc255_addcarryx_u64(x83, x98, x106)
|
||||
var x109 uint64
|
||||
var x110 fiat_sc255_uint1
|
||||
x109, x110 = fiat_sc255_addcarryx_u64(x85, x100, x108)
|
||||
var x111 uint64
|
||||
var x112 fiat_sc255_uint1
|
||||
x111, x112 = fiat_sc255_addcarryx_u64(x87, x102, x110)
|
||||
var x113 uint64
|
||||
_, x113 = bits.Mul64(x103, 0xd2b51da312547e1b)
|
||||
var x115 uint64
|
||||
var x116 uint64
|
||||
x116, x115 = bits.Mul64(x113, 0x1000000000000000)
|
||||
var x117 uint64
|
||||
var x118 uint64
|
||||
x118, x117 = bits.Mul64(x113, 0x14def9dea2f79cd6)
|
||||
var x119 uint64
|
||||
var x120 uint64
|
||||
x120, x119 = bits.Mul64(x113, 0x5812631a5cf5d3ed)
|
||||
var x121 uint64
|
||||
var x122 fiat_sc255_uint1
|
||||
x121, x122 = fiat_sc255_addcarryx_u64(x120, x117, 0x0)
|
||||
var x123 uint64 = (uint64(x122) + x118)
|
||||
var x125 fiat_sc255_uint1
|
||||
_, x125 = fiat_sc255_addcarryx_u64(x103, x119, 0x0)
|
||||
var x126 uint64
|
||||
var x127 fiat_sc255_uint1
|
||||
x126, x127 = fiat_sc255_addcarryx_u64(x105, x121, x125)
|
||||
var x128 uint64
|
||||
var x129 fiat_sc255_uint1
|
||||
x128, x129 = fiat_sc255_addcarryx_u64(x107, x123, x127)
|
||||
var x130 uint64
|
||||
var x131 fiat_sc255_uint1
|
||||
x130, x131 = fiat_sc255_addcarryx_u64(x109, x115, x129)
|
||||
var x132 uint64
|
||||
var x133 fiat_sc255_uint1
|
||||
x132, x133 = fiat_sc255_addcarryx_u64(x111, x116, x131)
|
||||
var x134 uint64 = (uint64(x133) + uint64(x112))
|
||||
var x135 uint64
|
||||
var x136 uint64
|
||||
x136, x135 = bits.Mul64(x3, (arg1[3]))
|
||||
var x137 uint64
|
||||
var x138 uint64
|
||||
x138, x137 = bits.Mul64(x3, (arg1[2]))
|
||||
var x139 uint64
|
||||
var x140 uint64
|
||||
x140, x139 = bits.Mul64(x3, (arg1[1]))
|
||||
var x141 uint64
|
||||
var x142 uint64
|
||||
x142, x141 = bits.Mul64(x3, (arg1[0]))
|
||||
var x143 uint64
|
||||
var x144 fiat_sc255_uint1
|
||||
x143, x144 = fiat_sc255_addcarryx_u64(x142, x139, 0x0)
|
||||
var x145 uint64
|
||||
var x146 fiat_sc255_uint1
|
||||
x145, x146 = fiat_sc255_addcarryx_u64(x140, x137, x144)
|
||||
var x147 uint64
|
||||
var x148 fiat_sc255_uint1
|
||||
x147, x148 = fiat_sc255_addcarryx_u64(x138, x135, x146)
|
||||
var x149 uint64 = (uint64(x148) + x136)
|
||||
var x150 uint64
|
||||
var x151 fiat_sc255_uint1
|
||||
x150, x151 = fiat_sc255_addcarryx_u64(x126, x141, 0x0)
|
||||
var x152 uint64
|
||||
var x153 fiat_sc255_uint1
|
||||
x152, x153 = fiat_sc255_addcarryx_u64(x128, x143, x151)
|
||||
var x154 uint64
|
||||
var x155 fiat_sc255_uint1
|
||||
x154, x155 = fiat_sc255_addcarryx_u64(x130, x145, x153)
|
||||
var x156 uint64
|
||||
var x157 fiat_sc255_uint1
|
||||
x156, x157 = fiat_sc255_addcarryx_u64(x132, x147, x155)
|
||||
var x158 uint64
|
||||
var x159 fiat_sc255_uint1
|
||||
x158, x159 = fiat_sc255_addcarryx_u64(x134, x149, x157)
|
||||
var x160 uint64
|
||||
_, x160 = bits.Mul64(x150, 0xd2b51da312547e1b)
|
||||
var x162 uint64
|
||||
var x163 uint64
|
||||
x163, x162 = bits.Mul64(x160, 0x1000000000000000)
|
||||
var x164 uint64
|
||||
var x165 uint64
|
||||
x165, x164 = bits.Mul64(x160, 0x14def9dea2f79cd6)
|
||||
var x166 uint64
|
||||
var x167 uint64
|
||||
x167, x166 = bits.Mul64(x160, 0x5812631a5cf5d3ed)
|
||||
var x168 uint64
|
||||
var x169 fiat_sc255_uint1
|
||||
x168, x169 = fiat_sc255_addcarryx_u64(x167, x164, 0x0)
|
||||
var x170 uint64 = (uint64(x169) + x165)
|
||||
var x172 fiat_sc255_uint1
|
||||
_, x172 = fiat_sc255_addcarryx_u64(x150, x166, 0x0)
|
||||
var x173 uint64
|
||||
var x174 fiat_sc255_uint1
|
||||
x173, x174 = fiat_sc255_addcarryx_u64(x152, x168, x172)
|
||||
var x175 uint64
|
||||
var x176 fiat_sc255_uint1
|
||||
x175, x176 = fiat_sc255_addcarryx_u64(x154, x170, x174)
|
||||
var x177 uint64
|
||||
var x178 fiat_sc255_uint1
|
||||
x177, x178 = fiat_sc255_addcarryx_u64(x156, x162, x176)
|
||||
var x179 uint64
|
||||
var x180 fiat_sc255_uint1
|
||||
x179, x180 = fiat_sc255_addcarryx_u64(x158, x163, x178)
|
||||
var x181 uint64 = (uint64(x180) + uint64(x159))
|
||||
var x182 uint64
|
||||
var x183 fiat_sc255_uint1
|
||||
x182, x183 = fiat_sc255_subborrowx_u64(x173, 0x5812631a5cf5d3ed, 0x0)
|
||||
var x184 uint64
|
||||
var x185 fiat_sc255_uint1
|
||||
x184, x185 = fiat_sc255_subborrowx_u64(x175, 0x14def9dea2f79cd6, x183)
|
||||
var x186 uint64
|
||||
var x187 fiat_sc255_uint1
|
||||
x186, x187 = fiat_sc255_subborrowx_u64(x177, uint64(0x0), x185)
|
||||
var x188 uint64
|
||||
var x189 fiat_sc255_uint1
|
||||
x188, x189 = fiat_sc255_subborrowx_u64(x179, 0x1000000000000000, x187)
|
||||
var x191 fiat_sc255_uint1
|
||||
_, x191 = fiat_sc255_subborrowx_u64(x181, uint64(0x0), x189)
|
||||
var x192 uint64
|
||||
fiat_sc255_cmovznz_u64(&x192, x191, x182, x173)
|
||||
var x193 uint64
|
||||
fiat_sc255_cmovznz_u64(&x193, x191, x184, x175)
|
||||
var x194 uint64
|
||||
fiat_sc255_cmovznz_u64(&x194, x191, x186, x177)
|
||||
var x195 uint64
|
||||
fiat_sc255_cmovznz_u64(&x195, x191, x188, x179)
|
||||
out1[0] = x192
|
||||
out1[1] = x193
|
||||
out1[2] = x194
|
||||
out1[3] = x195
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_add adds two field elements in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* 0 ≤ eval arg2 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_add(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
||||
var x1 uint64
|
||||
var x2 fiat_sc255_uint1
|
||||
x1, x2 = fiat_sc255_addcarryx_u64((arg1[0]), (arg2[0]), 0x0)
|
||||
var x3 uint64
|
||||
var x4 fiat_sc255_uint1
|
||||
x3, x4 = fiat_sc255_addcarryx_u64((arg1[1]), (arg2[1]), x2)
|
||||
var x5 uint64
|
||||
var x6 fiat_sc255_uint1
|
||||
x5, x6 = fiat_sc255_addcarryx_u64((arg1[2]), (arg2[2]), x4)
|
||||
var x7 uint64
|
||||
var x8 fiat_sc255_uint1
|
||||
x7, x8 = fiat_sc255_addcarryx_u64((arg1[3]), (arg2[3]), x6)
|
||||
var x9 uint64
|
||||
var x10 fiat_sc255_uint1
|
||||
x9, x10 = fiat_sc255_subborrowx_u64(x1, 0x5812631a5cf5d3ed, 0x0)
|
||||
var x11 uint64
|
||||
var x12 fiat_sc255_uint1
|
||||
x11, x12 = fiat_sc255_subborrowx_u64(x3, 0x14def9dea2f79cd6, x10)
|
||||
var x13 uint64
|
||||
var x14 fiat_sc255_uint1
|
||||
x13, x14 = fiat_sc255_subborrowx_u64(x5, uint64(0x0), x12)
|
||||
var x15 uint64
|
||||
var x16 fiat_sc255_uint1
|
||||
x15, x16 = fiat_sc255_subborrowx_u64(x7, 0x1000000000000000, x14)
|
||||
var x18 fiat_sc255_uint1
|
||||
_, x18 = fiat_sc255_subborrowx_u64(uint64(x8), uint64(0x0), x16)
|
||||
var x19 uint64
|
||||
fiat_sc255_cmovznz_u64(&x19, x18, x9, x1)
|
||||
var x20 uint64
|
||||
fiat_sc255_cmovznz_u64(&x20, x18, x11, x3)
|
||||
var x21 uint64
|
||||
fiat_sc255_cmovznz_u64(&x21, x18, x13, x5)
|
||||
var x22 uint64
|
||||
fiat_sc255_cmovznz_u64(&x22, x18, x15, x7)
|
||||
out1[0] = x19
|
||||
out1[1] = x20
|
||||
out1[2] = x21
|
||||
out1[3] = x22
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_sub subtracts two field elements in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* 0 ≤ eval arg2 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_sub(out1 *[4]uint64, arg1 *[4]uint64, arg2 *[4]uint64) {
|
||||
var x1 uint64
|
||||
var x2 fiat_sc255_uint1
|
||||
x1, x2 = fiat_sc255_subborrowx_u64((arg1[0]), (arg2[0]), 0x0)
|
||||
var x3 uint64
|
||||
var x4 fiat_sc255_uint1
|
||||
x3, x4 = fiat_sc255_subborrowx_u64((arg1[1]), (arg2[1]), x2)
|
||||
var x5 uint64
|
||||
var x6 fiat_sc255_uint1
|
||||
x5, x6 = fiat_sc255_subborrowx_u64((arg1[2]), (arg2[2]), x4)
|
||||
var x7 uint64
|
||||
var x8 fiat_sc255_uint1
|
||||
x7, x8 = fiat_sc255_subborrowx_u64((arg1[3]), (arg2[3]), x6)
|
||||
var x9 uint64
|
||||
fiat_sc255_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff)
|
||||
var x10 uint64
|
||||
var x11 fiat_sc255_uint1
|
||||
x10, x11 = fiat_sc255_addcarryx_u64(x1, (x9 & 0x5812631a5cf5d3ed), 0x0)
|
||||
var x12 uint64
|
||||
var x13 fiat_sc255_uint1
|
||||
x12, x13 = fiat_sc255_addcarryx_u64(x3, (x9 & 0x14def9dea2f79cd6), x11)
|
||||
var x14 uint64
|
||||
var x15 fiat_sc255_uint1
|
||||
x14, x15 = fiat_sc255_addcarryx_u64(x5, uint64(0x0), x13)
|
||||
var x16 uint64
|
||||
x16, _ = fiat_sc255_addcarryx_u64(x7, (x9 & 0x1000000000000000), x15)
|
||||
out1[0] = x10
|
||||
out1[1] = x12
|
||||
out1[2] = x14
|
||||
out1[3] = x16
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_opp negates a field element in the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_opp(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64
|
||||
var x2 fiat_sc255_uint1
|
||||
x1, x2 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[0]), 0x0)
|
||||
var x3 uint64
|
||||
var x4 fiat_sc255_uint1
|
||||
x3, x4 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[1]), x2)
|
||||
var x5 uint64
|
||||
var x6 fiat_sc255_uint1
|
||||
x5, x6 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[2]), x4)
|
||||
var x7 uint64
|
||||
var x8 fiat_sc255_uint1
|
||||
x7, x8 = fiat_sc255_subborrowx_u64(uint64(0x0), (arg1[3]), x6)
|
||||
var x9 uint64
|
||||
fiat_sc255_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff)
|
||||
var x10 uint64
|
||||
var x11 fiat_sc255_uint1
|
||||
x10, x11 = fiat_sc255_addcarryx_u64(x1, (x9 & 0x5812631a5cf5d3ed), 0x0)
|
||||
var x12 uint64
|
||||
var x13 fiat_sc255_uint1
|
||||
x12, x13 = fiat_sc255_addcarryx_u64(x3, (x9 & 0x14def9dea2f79cd6), x11)
|
||||
var x14 uint64
|
||||
var x15 fiat_sc255_uint1
|
||||
x14, x15 = fiat_sc255_addcarryx_u64(x5, uint64(0x0), x13)
|
||||
var x16 uint64
|
||||
x16, _ = fiat_sc255_addcarryx_u64(x7, (x9 & 0x1000000000000000), x15)
|
||||
out1[0] = x10
|
||||
out1[1] = x12
|
||||
out1[2] = x14
|
||||
out1[3] = x16
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_from_montgomery translates a field element out of the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_from_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[0])
|
||||
var x2 uint64
|
||||
_, x2 = bits.Mul64(x1, 0xd2b51da312547e1b)
|
||||
var x4 uint64
|
||||
var x5 uint64
|
||||
x5, x4 = bits.Mul64(x2, 0x1000000000000000)
|
||||
var x6 uint64
|
||||
var x7 uint64
|
||||
x7, x6 = bits.Mul64(x2, 0x14def9dea2f79cd6)
|
||||
var x8 uint64
|
||||
var x9 uint64
|
||||
x9, x8 = bits.Mul64(x2, 0x5812631a5cf5d3ed)
|
||||
var x10 uint64
|
||||
var x11 fiat_sc255_uint1
|
||||
x10, x11 = fiat_sc255_addcarryx_u64(x9, x6, 0x0)
|
||||
var x13 fiat_sc255_uint1
|
||||
_, x13 = fiat_sc255_addcarryx_u64(x1, x8, 0x0)
|
||||
var x14 uint64
|
||||
var x15 fiat_sc255_uint1
|
||||
x14, x15 = fiat_sc255_addcarryx_u64(uint64(0x0), x10, x13)
|
||||
var x16 uint64
|
||||
var x17 fiat_sc255_uint1
|
||||
x16, x17 = fiat_sc255_addcarryx_u64(x14, (arg1[1]), 0x0)
|
||||
var x18 uint64
|
||||
_, x18 = bits.Mul64(x16, 0xd2b51da312547e1b)
|
||||
var x20 uint64
|
||||
var x21 uint64
|
||||
x21, x20 = bits.Mul64(x18, 0x1000000000000000)
|
||||
var x22 uint64
|
||||
var x23 uint64
|
||||
x23, x22 = bits.Mul64(x18, 0x14def9dea2f79cd6)
|
||||
var x24 uint64
|
||||
var x25 uint64
|
||||
x25, x24 = bits.Mul64(x18, 0x5812631a5cf5d3ed)
|
||||
var x26 uint64
|
||||
var x27 fiat_sc255_uint1
|
||||
x26, x27 = fiat_sc255_addcarryx_u64(x25, x22, 0x0)
|
||||
var x29 fiat_sc255_uint1
|
||||
_, x29 = fiat_sc255_addcarryx_u64(x16, x24, 0x0)
|
||||
var x30 uint64
|
||||
var x31 fiat_sc255_uint1
|
||||
x30, x31 = fiat_sc255_addcarryx_u64((uint64(x17) + (uint64(x15) + (uint64(x11) + x7))), x26, x29)
|
||||
var x32 uint64
|
||||
var x33 fiat_sc255_uint1
|
||||
x32, x33 = fiat_sc255_addcarryx_u64(x4, (uint64(x27) + x23), x31)
|
||||
var x34 uint64
|
||||
var x35 fiat_sc255_uint1
|
||||
x34, x35 = fiat_sc255_addcarryx_u64(x5, x20, x33)
|
||||
var x36 uint64
|
||||
var x37 fiat_sc255_uint1
|
||||
x36, x37 = fiat_sc255_addcarryx_u64(x30, (arg1[2]), 0x0)
|
||||
var x38 uint64
|
||||
var x39 fiat_sc255_uint1
|
||||
x38, x39 = fiat_sc255_addcarryx_u64(x32, uint64(0x0), x37)
|
||||
var x40 uint64
|
||||
var x41 fiat_sc255_uint1
|
||||
x40, x41 = fiat_sc255_addcarryx_u64(x34, uint64(0x0), x39)
|
||||
var x42 uint64
|
||||
_, x42 = bits.Mul64(x36, 0xd2b51da312547e1b)
|
||||
var x44 uint64
|
||||
var x45 uint64
|
||||
x45, x44 = bits.Mul64(x42, 0x1000000000000000)
|
||||
var x46 uint64
|
||||
var x47 uint64
|
||||
x47, x46 = bits.Mul64(x42, 0x14def9dea2f79cd6)
|
||||
var x48 uint64
|
||||
var x49 uint64
|
||||
x49, x48 = bits.Mul64(x42, 0x5812631a5cf5d3ed)
|
||||
var x50 uint64
|
||||
var x51 fiat_sc255_uint1
|
||||
x50, x51 = fiat_sc255_addcarryx_u64(x49, x46, 0x0)
|
||||
var x53 fiat_sc255_uint1
|
||||
_, x53 = fiat_sc255_addcarryx_u64(x36, x48, 0x0)
|
||||
var x54 uint64
|
||||
var x55 fiat_sc255_uint1
|
||||
x54, x55 = fiat_sc255_addcarryx_u64(x38, x50, x53)
|
||||
var x56 uint64
|
||||
var x57 fiat_sc255_uint1
|
||||
x56, x57 = fiat_sc255_addcarryx_u64(x40, (uint64(x51) + x47), x55)
|
||||
var x58 uint64
|
||||
var x59 fiat_sc255_uint1
|
||||
x58, x59 = fiat_sc255_addcarryx_u64((uint64(x41) + (uint64(x35) + x21)), x44, x57)
|
||||
var x60 uint64
|
||||
var x61 fiat_sc255_uint1
|
||||
x60, x61 = fiat_sc255_addcarryx_u64(x54, (arg1[3]), 0x0)
|
||||
var x62 uint64
|
||||
var x63 fiat_sc255_uint1
|
||||
x62, x63 = fiat_sc255_addcarryx_u64(x56, uint64(0x0), x61)
|
||||
var x64 uint64
|
||||
var x65 fiat_sc255_uint1
|
||||
x64, x65 = fiat_sc255_addcarryx_u64(x58, uint64(0x0), x63)
|
||||
var x66 uint64
|
||||
_, x66 = bits.Mul64(x60, 0xd2b51da312547e1b)
|
||||
var x68 uint64
|
||||
var x69 uint64
|
||||
x69, x68 = bits.Mul64(x66, 0x1000000000000000)
|
||||
var x70 uint64
|
||||
var x71 uint64
|
||||
x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6)
|
||||
var x72 uint64
|
||||
var x73 uint64
|
||||
x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed)
|
||||
var x74 uint64
|
||||
var x75 fiat_sc255_uint1
|
||||
x74, x75 = fiat_sc255_addcarryx_u64(x73, x70, 0x0)
|
||||
var x77 fiat_sc255_uint1
|
||||
_, x77 = fiat_sc255_addcarryx_u64(x60, x72, 0x0)
|
||||
var x78 uint64
|
||||
var x79 fiat_sc255_uint1
|
||||
x78, x79 = fiat_sc255_addcarryx_u64(x62, x74, x77)
|
||||
var x80 uint64
|
||||
var x81 fiat_sc255_uint1
|
||||
x80, x81 = fiat_sc255_addcarryx_u64(x64, (uint64(x75) + x71), x79)
|
||||
var x82 uint64
|
||||
var x83 fiat_sc255_uint1
|
||||
x82, x83 = fiat_sc255_addcarryx_u64((uint64(x65) + (uint64(x59) + x45)), x68, x81)
|
||||
var x84 uint64 = (uint64(x83) + x69)
|
||||
var x85 uint64
|
||||
var x86 fiat_sc255_uint1
|
||||
x85, x86 = fiat_sc255_subborrowx_u64(x78, 0x5812631a5cf5d3ed, 0x0)
|
||||
var x87 uint64
|
||||
var x88 fiat_sc255_uint1
|
||||
x87, x88 = fiat_sc255_subborrowx_u64(x80, 0x14def9dea2f79cd6, x86)
|
||||
var x89 uint64
|
||||
var x90 fiat_sc255_uint1
|
||||
x89, x90 = fiat_sc255_subborrowx_u64(x82, uint64(0x0), x88)
|
||||
var x91 uint64
|
||||
var x92 fiat_sc255_uint1
|
||||
x91, x92 = fiat_sc255_subborrowx_u64(x84, 0x1000000000000000, x90)
|
||||
var x94 fiat_sc255_uint1
|
||||
_, x94 = fiat_sc255_subborrowx_u64(uint64(0x0), uint64(0x0), x92)
|
||||
var x95 uint64
|
||||
fiat_sc255_cmovznz_u64(&x95, x94, x85, x78)
|
||||
var x96 uint64
|
||||
fiat_sc255_cmovznz_u64(&x96, x94, x87, x80)
|
||||
var x97 uint64
|
||||
fiat_sc255_cmovznz_u64(&x97, x94, x89, x82)
|
||||
var x98 uint64
|
||||
fiat_sc255_cmovznz_u64(&x98, x94, x91, x84)
|
||||
out1[0] = x95
|
||||
out1[1] = x96
|
||||
out1[2] = x97
|
||||
out1[3] = x98
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_to_montgomery translates a field element into the Montgomery domain.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = eval arg1 mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_to_montgomery(out1 *[4]uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[1])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[3])
|
||||
var x4 uint64 = (arg1[0])
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, 0x399411b7c309a3d)
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x8, x7 = bits.Mul64(x4, 0xceec73d217f5be65)
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x10, x9 = bits.Mul64(x4, 0xd00e1ba768859347)
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x12, x11 = bits.Mul64(x4, 0xa40611e3449c0f01)
|
||||
var x13 uint64
|
||||
var x14 fiat_sc255_uint1
|
||||
x13, x14 = fiat_sc255_addcarryx_u64(x12, x9, 0x0)
|
||||
var x15 uint64
|
||||
var x16 fiat_sc255_uint1
|
||||
x15, x16 = fiat_sc255_addcarryx_u64(x10, x7, x14)
|
||||
var x17 uint64
|
||||
var x18 fiat_sc255_uint1
|
||||
x17, x18 = fiat_sc255_addcarryx_u64(x8, x5, x16)
|
||||
var x19 uint64
|
||||
_, x19 = bits.Mul64(x11, 0xd2b51da312547e1b)
|
||||
var x21 uint64
|
||||
var x22 uint64
|
||||
x22, x21 = bits.Mul64(x19, 0x1000000000000000)
|
||||
var x23 uint64
|
||||
var x24 uint64
|
||||
x24, x23 = bits.Mul64(x19, 0x14def9dea2f79cd6)
|
||||
var x25 uint64
|
||||
var x26 uint64
|
||||
x26, x25 = bits.Mul64(x19, 0x5812631a5cf5d3ed)
|
||||
var x27 uint64
|
||||
var x28 fiat_sc255_uint1
|
||||
x27, x28 = fiat_sc255_addcarryx_u64(x26, x23, 0x0)
|
||||
var x30 fiat_sc255_uint1
|
||||
_, x30 = fiat_sc255_addcarryx_u64(x11, x25, 0x0)
|
||||
var x31 uint64
|
||||
var x32 fiat_sc255_uint1
|
||||
x31, x32 = fiat_sc255_addcarryx_u64(x13, x27, x30)
|
||||
var x33 uint64
|
||||
var x34 fiat_sc255_uint1
|
||||
x33, x34 = fiat_sc255_addcarryx_u64(x15, (uint64(x28) + x24), x32)
|
||||
var x35 uint64
|
||||
var x36 fiat_sc255_uint1
|
||||
x35, x36 = fiat_sc255_addcarryx_u64(x17, x21, x34)
|
||||
var x37 uint64
|
||||
var x38 uint64
|
||||
x38, x37 = bits.Mul64(x1, 0x399411b7c309a3d)
|
||||
var x39 uint64
|
||||
var x40 uint64
|
||||
x40, x39 = bits.Mul64(x1, 0xceec73d217f5be65)
|
||||
var x41 uint64
|
||||
var x42 uint64
|
||||
x42, x41 = bits.Mul64(x1, 0xd00e1ba768859347)
|
||||
var x43 uint64
|
||||
var x44 uint64
|
||||
x44, x43 = bits.Mul64(x1, 0xa40611e3449c0f01)
|
||||
var x45 uint64
|
||||
var x46 fiat_sc255_uint1
|
||||
x45, x46 = fiat_sc255_addcarryx_u64(x44, x41, 0x0)
|
||||
var x47 uint64
|
||||
var x48 fiat_sc255_uint1
|
||||
x47, x48 = fiat_sc255_addcarryx_u64(x42, x39, x46)
|
||||
var x49 uint64
|
||||
var x50 fiat_sc255_uint1
|
||||
x49, x50 = fiat_sc255_addcarryx_u64(x40, x37, x48)
|
||||
var x51 uint64
|
||||
var x52 fiat_sc255_uint1
|
||||
x51, x52 = fiat_sc255_addcarryx_u64(x31, x43, 0x0)
|
||||
var x53 uint64
|
||||
var x54 fiat_sc255_uint1
|
||||
x53, x54 = fiat_sc255_addcarryx_u64(x33, x45, x52)
|
||||
var x55 uint64
|
||||
var x56 fiat_sc255_uint1
|
||||
x55, x56 = fiat_sc255_addcarryx_u64(x35, x47, x54)
|
||||
var x57 uint64
|
||||
var x58 fiat_sc255_uint1
|
||||
x57, x58 = fiat_sc255_addcarryx_u64(((uint64(x36) + (uint64(x18) + x6)) + x22), x49, x56)
|
||||
var x59 uint64
|
||||
_, x59 = bits.Mul64(x51, 0xd2b51da312547e1b)
|
||||
var x61 uint64
|
||||
var x62 uint64
|
||||
x62, x61 = bits.Mul64(x59, 0x1000000000000000)
|
||||
var x63 uint64
|
||||
var x64 uint64
|
||||
x64, x63 = bits.Mul64(x59, 0x14def9dea2f79cd6)
|
||||
var x65 uint64
|
||||
var x66 uint64
|
||||
x66, x65 = bits.Mul64(x59, 0x5812631a5cf5d3ed)
|
||||
var x67 uint64
|
||||
var x68 fiat_sc255_uint1
|
||||
x67, x68 = fiat_sc255_addcarryx_u64(x66, x63, 0x0)
|
||||
var x70 fiat_sc255_uint1
|
||||
_, x70 = fiat_sc255_addcarryx_u64(x51, x65, 0x0)
|
||||
var x71 uint64
|
||||
var x72 fiat_sc255_uint1
|
||||
x71, x72 = fiat_sc255_addcarryx_u64(x53, x67, x70)
|
||||
var x73 uint64
|
||||
var x74 fiat_sc255_uint1
|
||||
x73, x74 = fiat_sc255_addcarryx_u64(x55, (uint64(x68) + x64), x72)
|
||||
var x75 uint64
|
||||
var x76 fiat_sc255_uint1
|
||||
x75, x76 = fiat_sc255_addcarryx_u64(x57, x61, x74)
|
||||
var x77 uint64
|
||||
var x78 uint64
|
||||
x78, x77 = bits.Mul64(x2, 0x399411b7c309a3d)
|
||||
var x79 uint64
|
||||
var x80 uint64
|
||||
x80, x79 = bits.Mul64(x2, 0xceec73d217f5be65)
|
||||
var x81 uint64
|
||||
var x82 uint64
|
||||
x82, x81 = bits.Mul64(x2, 0xd00e1ba768859347)
|
||||
var x83 uint64
|
||||
var x84 uint64
|
||||
x84, x83 = bits.Mul64(x2, 0xa40611e3449c0f01)
|
||||
var x85 uint64
|
||||
var x86 fiat_sc255_uint1
|
||||
x85, x86 = fiat_sc255_addcarryx_u64(x84, x81, 0x0)
|
||||
var x87 uint64
|
||||
var x88 fiat_sc255_uint1
|
||||
x87, x88 = fiat_sc255_addcarryx_u64(x82, x79, x86)
|
||||
var x89 uint64
|
||||
var x90 fiat_sc255_uint1
|
||||
x89, x90 = fiat_sc255_addcarryx_u64(x80, x77, x88)
|
||||
var x91 uint64
|
||||
var x92 fiat_sc255_uint1
|
||||
x91, x92 = fiat_sc255_addcarryx_u64(x71, x83, 0x0)
|
||||
var x93 uint64
|
||||
var x94 fiat_sc255_uint1
|
||||
x93, x94 = fiat_sc255_addcarryx_u64(x73, x85, x92)
|
||||
var x95 uint64
|
||||
var x96 fiat_sc255_uint1
|
||||
x95, x96 = fiat_sc255_addcarryx_u64(x75, x87, x94)
|
||||
var x97 uint64
|
||||
var x98 fiat_sc255_uint1
|
||||
x97, x98 = fiat_sc255_addcarryx_u64(((uint64(x76) + (uint64(x58) + (uint64(x50) + x38))) + x62), x89, x96)
|
||||
var x99 uint64
|
||||
_, x99 = bits.Mul64(x91, 0xd2b51da312547e1b)
|
||||
var x101 uint64
|
||||
var x102 uint64
|
||||
x102, x101 = bits.Mul64(x99, 0x1000000000000000)
|
||||
var x103 uint64
|
||||
var x104 uint64
|
||||
x104, x103 = bits.Mul64(x99, 0x14def9dea2f79cd6)
|
||||
var x105 uint64
|
||||
var x106 uint64
|
||||
x106, x105 = bits.Mul64(x99, 0x5812631a5cf5d3ed)
|
||||
var x107 uint64
|
||||
var x108 fiat_sc255_uint1
|
||||
x107, x108 = fiat_sc255_addcarryx_u64(x106, x103, 0x0)
|
||||
var x110 fiat_sc255_uint1
|
||||
_, x110 = fiat_sc255_addcarryx_u64(x91, x105, 0x0)
|
||||
var x111 uint64
|
||||
var x112 fiat_sc255_uint1
|
||||
x111, x112 = fiat_sc255_addcarryx_u64(x93, x107, x110)
|
||||
var x113 uint64
|
||||
var x114 fiat_sc255_uint1
|
||||
x113, x114 = fiat_sc255_addcarryx_u64(x95, (uint64(x108) + x104), x112)
|
||||
var x115 uint64
|
||||
var x116 fiat_sc255_uint1
|
||||
x115, x116 = fiat_sc255_addcarryx_u64(x97, x101, x114)
|
||||
var x117 uint64
|
||||
var x118 uint64
|
||||
x118, x117 = bits.Mul64(x3, 0x399411b7c309a3d)
|
||||
var x119 uint64
|
||||
var x120 uint64
|
||||
x120, x119 = bits.Mul64(x3, 0xceec73d217f5be65)
|
||||
var x121 uint64
|
||||
var x122 uint64
|
||||
x122, x121 = bits.Mul64(x3, 0xd00e1ba768859347)
|
||||
var x123 uint64
|
||||
var x124 uint64
|
||||
x124, x123 = bits.Mul64(x3, 0xa40611e3449c0f01)
|
||||
var x125 uint64
|
||||
var x126 fiat_sc255_uint1
|
||||
x125, x126 = fiat_sc255_addcarryx_u64(x124, x121, 0x0)
|
||||
var x127 uint64
|
||||
var x128 fiat_sc255_uint1
|
||||
x127, x128 = fiat_sc255_addcarryx_u64(x122, x119, x126)
|
||||
var x129 uint64
|
||||
var x130 fiat_sc255_uint1
|
||||
x129, x130 = fiat_sc255_addcarryx_u64(x120, x117, x128)
|
||||
var x131 uint64
|
||||
var x132 fiat_sc255_uint1
|
||||
x131, x132 = fiat_sc255_addcarryx_u64(x111, x123, 0x0)
|
||||
var x133 uint64
|
||||
var x134 fiat_sc255_uint1
|
||||
x133, x134 = fiat_sc255_addcarryx_u64(x113, x125, x132)
|
||||
var x135 uint64
|
||||
var x136 fiat_sc255_uint1
|
||||
x135, x136 = fiat_sc255_addcarryx_u64(x115, x127, x134)
|
||||
var x137 uint64
|
||||
var x138 fiat_sc255_uint1
|
||||
x137, x138 = fiat_sc255_addcarryx_u64(((uint64(x116) + (uint64(x98) + (uint64(x90) + x78))) + x102), x129, x136)
|
||||
var x139 uint64
|
||||
_, x139 = bits.Mul64(x131, 0xd2b51da312547e1b)
|
||||
var x141 uint64
|
||||
var x142 uint64
|
||||
x142, x141 = bits.Mul64(x139, 0x1000000000000000)
|
||||
var x143 uint64
|
||||
var x144 uint64
|
||||
x144, x143 = bits.Mul64(x139, 0x14def9dea2f79cd6)
|
||||
var x145 uint64
|
||||
var x146 uint64
|
||||
x146, x145 = bits.Mul64(x139, 0x5812631a5cf5d3ed)
|
||||
var x147 uint64
|
||||
var x148 fiat_sc255_uint1
|
||||
x147, x148 = fiat_sc255_addcarryx_u64(x146, x143, 0x0)
|
||||
var x150 fiat_sc255_uint1
|
||||
_, x150 = fiat_sc255_addcarryx_u64(x131, x145, 0x0)
|
||||
var x151 uint64
|
||||
var x152 fiat_sc255_uint1
|
||||
x151, x152 = fiat_sc255_addcarryx_u64(x133, x147, x150)
|
||||
var x153 uint64
|
||||
var x154 fiat_sc255_uint1
|
||||
x153, x154 = fiat_sc255_addcarryx_u64(x135, (uint64(x148) + x144), x152)
|
||||
var x155 uint64
|
||||
var x156 fiat_sc255_uint1
|
||||
x155, x156 = fiat_sc255_addcarryx_u64(x137, x141, x154)
|
||||
var x157 uint64 = ((uint64(x156) + (uint64(x138) + (uint64(x130) + x118))) + x142)
|
||||
var x158 uint64
|
||||
var x159 fiat_sc255_uint1
|
||||
x158, x159 = fiat_sc255_subborrowx_u64(x151, 0x5812631a5cf5d3ed, 0x0)
|
||||
var x160 uint64
|
||||
var x161 fiat_sc255_uint1
|
||||
x160, x161 = fiat_sc255_subborrowx_u64(x153, 0x14def9dea2f79cd6, x159)
|
||||
var x162 uint64
|
||||
var x163 fiat_sc255_uint1
|
||||
x162, x163 = fiat_sc255_subborrowx_u64(x155, uint64(0x0), x161)
|
||||
var x164 uint64
|
||||
var x165 fiat_sc255_uint1
|
||||
x164, x165 = fiat_sc255_subborrowx_u64(x157, 0x1000000000000000, x163)
|
||||
var x167 fiat_sc255_uint1
|
||||
_, x167 = fiat_sc255_subborrowx_u64(uint64(0x0), uint64(0x0), x165)
|
||||
var x168 uint64
|
||||
fiat_sc255_cmovznz_u64(&x168, x167, x158, x151)
|
||||
var x169 uint64
|
||||
fiat_sc255_cmovznz_u64(&x169, x167, x160, x153)
|
||||
var x170 uint64
|
||||
fiat_sc255_cmovznz_u64(&x170, x167, x162, x155)
|
||||
var x171 uint64
|
||||
fiat_sc255_cmovznz_u64(&x171, x167, x164, x157)
|
||||
out1[0] = x168
|
||||
out1[1] = x169
|
||||
out1[2] = x170
|
||||
out1[3] = x171
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0xffffffffffffffff]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_nonzero(out1 *uint64, arg1 *[4]uint64) {
|
||||
var x1 uint64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))))
|
||||
*out1 = x1
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_selectznz is a multi-limb conditional select.
|
||||
* Postconditions:
|
||||
* eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_selectznz(out1 *[4]uint64, arg1 fiat_sc255_uint1, arg2 *[4]uint64, arg3 *[4]uint64) {
|
||||
var x1 uint64
|
||||
fiat_sc255_cmovznz_u64(&x1, arg1, (arg2[0]), (arg3[0]))
|
||||
var x2 uint64
|
||||
fiat_sc255_cmovznz_u64(&x2, arg1, (arg2[1]), (arg3[1]))
|
||||
var x3 uint64
|
||||
fiat_sc255_cmovznz_u64(&x3, arg1, (arg2[2]), (arg3[2]))
|
||||
var x4 uint64
|
||||
fiat_sc255_cmovznz_u64(&x4, arg1, (arg2[3]), (arg3[3]))
|
||||
out1[0] = x1
|
||||
out1[1] = x2
|
||||
out1[2] = x3
|
||||
out1[3] = x4
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg1 < m
|
||||
* Postconditions:
|
||||
* out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_to_bytes(out1 *[32]byte, arg1 *[4]uint64) {
|
||||
var x1 uint64 = (arg1[3])
|
||||
var x2 uint64 = (arg1[2])
|
||||
var x3 uint64 = (arg1[1])
|
||||
var x4 uint64 = (arg1[0])
|
||||
var x5 uint8 = (uint8(x4) & 0xff)
|
||||
var x6 uint64 = (x4 >> 8)
|
||||
var x7 uint8 = (uint8(x6) & 0xff)
|
||||
var x8 uint64 = (x6 >> 8)
|
||||
var x9 uint8 = (uint8(x8) & 0xff)
|
||||
var x10 uint64 = (x8 >> 8)
|
||||
var x11 uint8 = (uint8(x10) & 0xff)
|
||||
var x12 uint64 = (x10 >> 8)
|
||||
var x13 uint8 = (uint8(x12) & 0xff)
|
||||
var x14 uint64 = (x12 >> 8)
|
||||
var x15 uint8 = (uint8(x14) & 0xff)
|
||||
var x16 uint64 = (x14 >> 8)
|
||||
var x17 uint8 = (uint8(x16) & 0xff)
|
||||
var x18 uint8 = uint8((x16 >> 8))
|
||||
var x19 uint8 = (uint8(x3) & 0xff)
|
||||
var x20 uint64 = (x3 >> 8)
|
||||
var x21 uint8 = (uint8(x20) & 0xff)
|
||||
var x22 uint64 = (x20 >> 8)
|
||||
var x23 uint8 = (uint8(x22) & 0xff)
|
||||
var x24 uint64 = (x22 >> 8)
|
||||
var x25 uint8 = (uint8(x24) & 0xff)
|
||||
var x26 uint64 = (x24 >> 8)
|
||||
var x27 uint8 = (uint8(x26) & 0xff)
|
||||
var x28 uint64 = (x26 >> 8)
|
||||
var x29 uint8 = (uint8(x28) & 0xff)
|
||||
var x30 uint64 = (x28 >> 8)
|
||||
var x31 uint8 = (uint8(x30) & 0xff)
|
||||
var x32 uint8 = uint8((x30 >> 8))
|
||||
var x33 uint8 = (uint8(x2) & 0xff)
|
||||
var x34 uint64 = (x2 >> 8)
|
||||
var x35 uint8 = (uint8(x34) & 0xff)
|
||||
var x36 uint64 = (x34 >> 8)
|
||||
var x37 uint8 = (uint8(x36) & 0xff)
|
||||
var x38 uint64 = (x36 >> 8)
|
||||
var x39 uint8 = (uint8(x38) & 0xff)
|
||||
var x40 uint64 = (x38 >> 8)
|
||||
var x41 uint8 = (uint8(x40) & 0xff)
|
||||
var x42 uint64 = (x40 >> 8)
|
||||
var x43 uint8 = (uint8(x42) & 0xff)
|
||||
var x44 uint64 = (x42 >> 8)
|
||||
var x45 uint8 = (uint8(x44) & 0xff)
|
||||
var x46 uint8 = uint8((x44 >> 8))
|
||||
var x47 uint8 = (uint8(x1) & 0xff)
|
||||
var x48 uint64 = (x1 >> 8)
|
||||
var x49 uint8 = (uint8(x48) & 0xff)
|
||||
var x50 uint64 = (x48 >> 8)
|
||||
var x51 uint8 = (uint8(x50) & 0xff)
|
||||
var x52 uint64 = (x50 >> 8)
|
||||
var x53 uint8 = (uint8(x52) & 0xff)
|
||||
var x54 uint64 = (x52 >> 8)
|
||||
var x55 uint8 = (uint8(x54) & 0xff)
|
||||
var x56 uint64 = (x54 >> 8)
|
||||
var x57 uint8 = (uint8(x56) & 0xff)
|
||||
var x58 uint64 = (x56 >> 8)
|
||||
var x59 uint8 = (uint8(x58) & 0xff)
|
||||
var x60 uint8 = uint8((x58 >> 8))
|
||||
out1[0] = x5
|
||||
out1[1] = x7
|
||||
out1[2] = x9
|
||||
out1[3] = x11
|
||||
out1[4] = x13
|
||||
out1[5] = x15
|
||||
out1[6] = x17
|
||||
out1[7] = x18
|
||||
out1[8] = x19
|
||||
out1[9] = x21
|
||||
out1[10] = x23
|
||||
out1[11] = x25
|
||||
out1[12] = x27
|
||||
out1[13] = x29
|
||||
out1[14] = x31
|
||||
out1[15] = x32
|
||||
out1[16] = x33
|
||||
out1[17] = x35
|
||||
out1[18] = x37
|
||||
out1[19] = x39
|
||||
out1[20] = x41
|
||||
out1[21] = x43
|
||||
out1[22] = x45
|
||||
out1[23] = x46
|
||||
out1[24] = x47
|
||||
out1[25] = x49
|
||||
out1[26] = x51
|
||||
out1[27] = x53
|
||||
out1[28] = x55
|
||||
out1[29] = x57
|
||||
out1[30] = x59
|
||||
out1[31] = x60
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
|
||||
* Preconditions:
|
||||
* 0 ≤ bytes_eval arg1 < m
|
||||
* Postconditions:
|
||||
* eval out1 mod m = bytes_eval arg1 mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_from_bytes(out1 *[4]uint64, arg1 *[32]byte) {
|
||||
var x1 uint64 = (uint64((arg1[31])) << 56)
|
||||
var x2 uint64 = (uint64((arg1[30])) << 48)
|
||||
var x3 uint64 = (uint64((arg1[29])) << 40)
|
||||
var x4 uint64 = (uint64((arg1[28])) << 32)
|
||||
var x5 uint64 = (uint64((arg1[27])) << 24)
|
||||
var x6 uint64 = (uint64((arg1[26])) << 16)
|
||||
var x7 uint64 = (uint64((arg1[25])) << 8)
|
||||
var x8 uint8 = (arg1[24])
|
||||
var x9 uint64 = (uint64((arg1[23])) << 56)
|
||||
var x10 uint64 = (uint64((arg1[22])) << 48)
|
||||
var x11 uint64 = (uint64((arg1[21])) << 40)
|
||||
var x12 uint64 = (uint64((arg1[20])) << 32)
|
||||
var x13 uint64 = (uint64((arg1[19])) << 24)
|
||||
var x14 uint64 = (uint64((arg1[18])) << 16)
|
||||
var x15 uint64 = (uint64((arg1[17])) << 8)
|
||||
var x16 uint8 = (arg1[16])
|
||||
var x17 uint64 = (uint64((arg1[15])) << 56)
|
||||
var x18 uint64 = (uint64((arg1[14])) << 48)
|
||||
var x19 uint64 = (uint64((arg1[13])) << 40)
|
||||
var x20 uint64 = (uint64((arg1[12])) << 32)
|
||||
var x21 uint64 = (uint64((arg1[11])) << 24)
|
||||
var x22 uint64 = (uint64((arg1[10])) << 16)
|
||||
var x23 uint64 = (uint64((arg1[9])) << 8)
|
||||
var x24 uint8 = (arg1[8])
|
||||
var x25 uint64 = (uint64((arg1[7])) << 56)
|
||||
var x26 uint64 = (uint64((arg1[6])) << 48)
|
||||
var x27 uint64 = (uint64((arg1[5])) << 40)
|
||||
var x28 uint64 = (uint64((arg1[4])) << 32)
|
||||
var x29 uint64 = (uint64((arg1[3])) << 24)
|
||||
var x30 uint64 = (uint64((arg1[2])) << 16)
|
||||
var x31 uint64 = (uint64((arg1[1])) << 8)
|
||||
var x32 uint8 = (arg1[0])
|
||||
var x33 uint64 = (x31 + uint64(x32))
|
||||
var x34 uint64 = (x30 + x33)
|
||||
var x35 uint64 = (x29 + x34)
|
||||
var x36 uint64 = (x28 + x35)
|
||||
var x37 uint64 = (x27 + x36)
|
||||
var x38 uint64 = (x26 + x37)
|
||||
var x39 uint64 = (x25 + x38)
|
||||
var x40 uint64 = (x23 + uint64(x24))
|
||||
var x41 uint64 = (x22 + x40)
|
||||
var x42 uint64 = (x21 + x41)
|
||||
var x43 uint64 = (x20 + x42)
|
||||
var x44 uint64 = (x19 + x43)
|
||||
var x45 uint64 = (x18 + x44)
|
||||
var x46 uint64 = (x17 + x45)
|
||||
var x47 uint64 = (x15 + uint64(x16))
|
||||
var x48 uint64 = (x14 + x47)
|
||||
var x49 uint64 = (x13 + x48)
|
||||
var x50 uint64 = (x12 + x49)
|
||||
var x51 uint64 = (x11 + x50)
|
||||
var x52 uint64 = (x10 + x51)
|
||||
var x53 uint64 = (x9 + x52)
|
||||
var x54 uint64 = (x7 + uint64(x8))
|
||||
var x55 uint64 = (x6 + x54)
|
||||
var x56 uint64 = (x5 + x55)
|
||||
var x57 uint64 = (x4 + x56)
|
||||
var x58 uint64 = (x3 + x57)
|
||||
var x59 uint64 = (x2 + x58)
|
||||
var x60 uint64 = (x1 + x59)
|
||||
out1[0] = x39
|
||||
out1[1] = x46
|
||||
out1[2] = x53
|
||||
out1[3] = x60
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_set_one returns the field element one in the Montgomery domain.
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) mod m = 1 mod m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_set_one(out1 *[4]uint64) {
|
||||
out1[0] = 0xd6ec31748d98951d
|
||||
out1[1] = 0xc6ef5bf4737dcf70
|
||||
out1[2] = 0xfffffffffffffffe
|
||||
out1[3] = 0xfffffffffffffff
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_msat returns the saturated represtation of the prime modulus.
|
||||
* Postconditions:
|
||||
* twos_complement_eval out1 = m
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_msat(out1 *[5]uint64) {
|
||||
out1[0] = 0x5812631a5cf5d3ed
|
||||
out1[1] = 0x14def9dea2f79cd6
|
||||
out1[2] = uint64(0x0)
|
||||
out1[3] = 0x1000000000000000
|
||||
out1[4] = uint64(0x0)
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
|
||||
* Postconditions:
|
||||
* eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)
|
||||
* 0 ≤ eval out1 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_divstep_precomp(out1 *[4]uint64) {
|
||||
out1[0] = 0xd70af84436a7cb92
|
||||
out1[1] = 0x5f71c978b0b8b159
|
||||
out1[2] = 0xe76d816974947f1a
|
||||
out1[3] = 0x19a2d36f193e4ff
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_sc255_divstep computes a divstep.
|
||||
* Preconditions:
|
||||
* 0 ≤ eval arg4 < m
|
||||
* 0 ≤ eval arg5 < m
|
||||
* Postconditions:
|
||||
* out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
|
||||
* twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
|
||||
* twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
|
||||
* eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
|
||||
* eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
|
||||
* 0 ≤ eval out5 < m
|
||||
* 0 ≤ eval out5 < m
|
||||
* 0 ≤ eval out2 < m
|
||||
* 0 ≤ eval out3 < m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0xffffffffffffffff]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0xffffffffffffffff]
|
||||
* out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
/*inline*/
|
||||
func fiat_sc255_divstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4]uint64, out5 *[4]uint64, arg1 uint64, arg2 *[5]uint64, arg3 *[5]uint64, arg4 *[4]uint64, arg5 *[4]uint64) {
|
||||
var x1 uint64
|
||||
x1, _ = fiat_sc255_addcarryx_u64((^arg1), uint64(0x1), 0x0)
|
||||
var x3 fiat_sc255_uint1 = (fiat_sc255_uint1((x1 >> 63)) & (fiat_sc255_uint1((arg3[0])) & 0x1))
|
||||
var x4 uint64
|
||||
x4, _ = fiat_sc255_addcarryx_u64((^arg1), uint64(0x1), 0x0)
|
||||
var x6 uint64
|
||||
fiat_sc255_cmovznz_u64(&x6, x3, arg1, x4)
|
||||
var x7 uint64
|
||||
fiat_sc255_cmovznz_u64(&x7, x3, (arg2[0]), (arg3[0]))
|
||||
var x8 uint64
|
||||
fiat_sc255_cmovznz_u64(&x8, x3, (arg2[1]), (arg3[1]))
|
||||
var x9 uint64
|
||||
fiat_sc255_cmovznz_u64(&x9, x3, (arg2[2]), (arg3[2]))
|
||||
var x10 uint64
|
||||
fiat_sc255_cmovznz_u64(&x10, x3, (arg2[3]), (arg3[3]))
|
||||
var x11 uint64
|
||||
fiat_sc255_cmovznz_u64(&x11, x3, (arg2[4]), (arg3[4]))
|
||||
var x12 uint64
|
||||
var x13 fiat_sc255_uint1
|
||||
x12, x13 = fiat_sc255_addcarryx_u64(uint64(0x1), (^(arg2[0])), 0x0)
|
||||
var x14 uint64
|
||||
var x15 fiat_sc255_uint1
|
||||
x14, x15 = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[1])), x13)
|
||||
var x16 uint64
|
||||
var x17 fiat_sc255_uint1
|
||||
x16, x17 = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[2])), x15)
|
||||
var x18 uint64
|
||||
var x19 fiat_sc255_uint1
|
||||
x18, x19 = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[3])), x17)
|
||||
var x20 uint64
|
||||
x20, _ = fiat_sc255_addcarryx_u64(uint64(0x0), (^(arg2[4])), x19)
|
||||
var x22 uint64
|
||||
fiat_sc255_cmovznz_u64(&x22, x3, (arg3[0]), x12)
|
||||
var x23 uint64
|
||||
fiat_sc255_cmovznz_u64(&x23, x3, (arg3[1]), x14)
|
||||
var x24 uint64
|
||||
fiat_sc255_cmovznz_u64(&x24, x3, (arg3[2]), x16)
|
||||
var x25 uint64
|
||||
fiat_sc255_cmovznz_u64(&x25, x3, (arg3[3]), x18)
|
||||
var x26 uint64
|
||||
fiat_sc255_cmovznz_u64(&x26, x3, (arg3[4]), x20)
|
||||
var x27 uint64
|
||||
fiat_sc255_cmovznz_u64(&x27, x3, (arg4[0]), (arg5[0]))
|
||||
var x28 uint64
|
||||
fiat_sc255_cmovznz_u64(&x28, x3, (arg4[1]), (arg5[1]))
|
||||
var x29 uint64
|
||||
fiat_sc255_cmovznz_u64(&x29, x3, (arg4[2]), (arg5[2]))
|
||||
var x30 uint64
|
||||
fiat_sc255_cmovznz_u64(&x30, x3, (arg4[3]), (arg5[3]))
|
||||
var x31 uint64
|
||||
var x32 fiat_sc255_uint1
|
||||
x31, x32 = fiat_sc255_addcarryx_u64(x27, x27, 0x0)
|
||||
var x33 uint64
|
||||
var x34 fiat_sc255_uint1
|
||||
x33, x34 = fiat_sc255_addcarryx_u64(x28, x28, x32)
|
||||
var x35 uint64
|
||||
var x36 fiat_sc255_uint1
|
||||
x35, x36 = fiat_sc255_addcarryx_u64(x29, x29, x34)
|
||||
var x37 uint64
|
||||
var x38 fiat_sc255_uint1
|
||||
x37, x38 = fiat_sc255_addcarryx_u64(x30, x30, x36)
|
||||
var x39 uint64
|
||||
var x40 fiat_sc255_uint1
|
||||
x39, x40 = fiat_sc255_subborrowx_u64(x31, 0x5812631a5cf5d3ed, 0x0)
|
||||
var x41 uint64
|
||||
var x42 fiat_sc255_uint1
|
||||
x41, x42 = fiat_sc255_subborrowx_u64(x33, 0x14def9dea2f79cd6, x40)
|
||||
var x43 uint64
|
||||
var x44 fiat_sc255_uint1
|
||||
x43, x44 = fiat_sc255_subborrowx_u64(x35, uint64(0x0), x42)
|
||||
var x45 uint64
|
||||
var x46 fiat_sc255_uint1
|
||||
x45, x46 = fiat_sc255_subborrowx_u64(x37, 0x1000000000000000, x44)
|
||||
var x48 fiat_sc255_uint1
|
||||
_, x48 = fiat_sc255_subborrowx_u64(uint64(x38), uint64(0x0), x46)
|
||||
var x49 uint64 = (arg4[3])
|
||||
var x50 uint64 = (arg4[2])
|
||||
var x51 uint64 = (arg4[1])
|
||||
var x52 uint64 = (arg4[0])
|
||||
var x53 uint64
|
||||
var x54 fiat_sc255_uint1
|
||||
x53, x54 = fiat_sc255_subborrowx_u64(uint64(0x0), x52, 0x0)
|
||||
var x55 uint64
|
||||
var x56 fiat_sc255_uint1
|
||||
x55, x56 = fiat_sc255_subborrowx_u64(uint64(0x0), x51, x54)
|
||||
var x57 uint64
|
||||
var x58 fiat_sc255_uint1
|
||||
x57, x58 = fiat_sc255_subborrowx_u64(uint64(0x0), x50, x56)
|
||||
var x59 uint64
|
||||
var x60 fiat_sc255_uint1
|
||||
x59, x60 = fiat_sc255_subborrowx_u64(uint64(0x0), x49, x58)
|
||||
var x61 uint64
|
||||
fiat_sc255_cmovznz_u64(&x61, x60, uint64(0x0), 0xffffffffffffffff)
|
||||
var x62 uint64
|
||||
var x63 fiat_sc255_uint1
|
||||
x62, x63 = fiat_sc255_addcarryx_u64(x53, (x61 & 0x5812631a5cf5d3ed), 0x0)
|
||||
var x64 uint64
|
||||
var x65 fiat_sc255_uint1
|
||||
x64, x65 = fiat_sc255_addcarryx_u64(x55, (x61 & 0x14def9dea2f79cd6), x63)
|
||||
var x66 uint64
|
||||
var x67 fiat_sc255_uint1
|
||||
x66, x67 = fiat_sc255_addcarryx_u64(x57, uint64(0x0), x65)
|
||||
var x68 uint64
|
||||
x68, _ = fiat_sc255_addcarryx_u64(x59, (x61 & 0x1000000000000000), x67)
|
||||
var x70 uint64
|
||||
fiat_sc255_cmovznz_u64(&x70, x3, (arg5[0]), x62)
|
||||
var x71 uint64
|
||||
fiat_sc255_cmovznz_u64(&x71, x3, (arg5[1]), x64)
|
||||
var x72 uint64
|
||||
fiat_sc255_cmovznz_u64(&x72, x3, (arg5[2]), x66)
|
||||
var x73 uint64
|
||||
fiat_sc255_cmovznz_u64(&x73, x3, (arg5[3]), x68)
|
||||
var x74 fiat_sc255_uint1 = (fiat_sc255_uint1(x22) & 0x1)
|
||||
var x75 uint64
|
||||
fiat_sc255_cmovznz_u64(&x75, x74, uint64(0x0), x7)
|
||||
var x76 uint64
|
||||
fiat_sc255_cmovznz_u64(&x76, x74, uint64(0x0), x8)
|
||||
var x77 uint64
|
||||
fiat_sc255_cmovznz_u64(&x77, x74, uint64(0x0), x9)
|
||||
var x78 uint64
|
||||
fiat_sc255_cmovznz_u64(&x78, x74, uint64(0x0), x10)
|
||||
var x79 uint64
|
||||
fiat_sc255_cmovznz_u64(&x79, x74, uint64(0x0), x11)
|
||||
var x80 uint64
|
||||
var x81 fiat_sc255_uint1
|
||||
x80, x81 = fiat_sc255_addcarryx_u64(x22, x75, 0x0)
|
||||
var x82 uint64
|
||||
var x83 fiat_sc255_uint1
|
||||
x82, x83 = fiat_sc255_addcarryx_u64(x23, x76, x81)
|
||||
var x84 uint64
|
||||
var x85 fiat_sc255_uint1
|
||||
x84, x85 = fiat_sc255_addcarryx_u64(x24, x77, x83)
|
||||
var x86 uint64
|
||||
var x87 fiat_sc255_uint1
|
||||
x86, x87 = fiat_sc255_addcarryx_u64(x25, x78, x85)
|
||||
var x88 uint64
|
||||
x88, _ = fiat_sc255_addcarryx_u64(x26, x79, x87)
|
||||
var x90 uint64
|
||||
fiat_sc255_cmovznz_u64(&x90, x74, uint64(0x0), x27)
|
||||
var x91 uint64
|
||||
fiat_sc255_cmovznz_u64(&x91, x74, uint64(0x0), x28)
|
||||
var x92 uint64
|
||||
fiat_sc255_cmovznz_u64(&x92, x74, uint64(0x0), x29)
|
||||
var x93 uint64
|
||||
fiat_sc255_cmovznz_u64(&x93, x74, uint64(0x0), x30)
|
||||
var x94 uint64
|
||||
var x95 fiat_sc255_uint1
|
||||
x94, x95 = fiat_sc255_addcarryx_u64(x70, x90, 0x0)
|
||||
var x96 uint64
|
||||
var x97 fiat_sc255_uint1
|
||||
x96, x97 = fiat_sc255_addcarryx_u64(x71, x91, x95)
|
||||
var x98 uint64
|
||||
var x99 fiat_sc255_uint1
|
||||
x98, x99 = fiat_sc255_addcarryx_u64(x72, x92, x97)
|
||||
var x100 uint64
|
||||
var x101 fiat_sc255_uint1
|
||||
x100, x101 = fiat_sc255_addcarryx_u64(x73, x93, x99)
|
||||
var x102 uint64
|
||||
var x103 fiat_sc255_uint1
|
||||
x102, x103 = fiat_sc255_subborrowx_u64(x94, 0x5812631a5cf5d3ed, 0x0)
|
||||
var x104 uint64
|
||||
var x105 fiat_sc255_uint1
|
||||
x104, x105 = fiat_sc255_subborrowx_u64(x96, 0x14def9dea2f79cd6, x103)
|
||||
var x106 uint64
|
||||
var x107 fiat_sc255_uint1
|
||||
x106, x107 = fiat_sc255_subborrowx_u64(x98, uint64(0x0), x105)
|
||||
var x108 uint64
|
||||
var x109 fiat_sc255_uint1
|
||||
x108, x109 = fiat_sc255_subborrowx_u64(x100, 0x1000000000000000, x107)
|
||||
var x111 fiat_sc255_uint1
|
||||
_, x111 = fiat_sc255_subborrowx_u64(uint64(x101), uint64(0x0), x109)
|
||||
var x112 uint64
|
||||
x112, _ = fiat_sc255_addcarryx_u64(x6, uint64(0x1), 0x0)
|
||||
var x114 uint64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff))
|
||||
var x115 uint64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff))
|
||||
var x116 uint64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff))
|
||||
var x117 uint64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff))
|
||||
var x118 uint64 = ((x88 & 0x8000000000000000) | (x88 >> 1))
|
||||
var x119 uint64
|
||||
fiat_sc255_cmovznz_u64(&x119, x48, x39, x31)
|
||||
var x120 uint64
|
||||
fiat_sc255_cmovznz_u64(&x120, x48, x41, x33)
|
||||
var x121 uint64
|
||||
fiat_sc255_cmovznz_u64(&x121, x48, x43, x35)
|
||||
var x122 uint64
|
||||
fiat_sc255_cmovznz_u64(&x122, x48, x45, x37)
|
||||
var x123 uint64
|
||||
fiat_sc255_cmovznz_u64(&x123, x111, x102, x94)
|
||||
var x124 uint64
|
||||
fiat_sc255_cmovznz_u64(&x124, x111, x104, x96)
|
||||
var x125 uint64
|
||||
fiat_sc255_cmovznz_u64(&x125, x111, x106, x98)
|
||||
var x126 uint64
|
||||
fiat_sc255_cmovznz_u64(&x126, x111, x108, x100)
|
||||
*out1 = x112
|
||||
out2[0] = x7
|
||||
out2[1] = x8
|
||||
out2[2] = x9
|
||||
out2[3] = x10
|
||||
out2[4] = x11
|
||||
out3[0] = x114
|
||||
out3[1] = x115
|
||||
out3[2] = x116
|
||||
out3[3] = x117
|
||||
out3[4] = x118
|
||||
out4[0] = x119
|
||||
out4[1] = x120
|
||||
out4[2] = x121
|
||||
out4[3] = x122
|
||||
out5[0] = x123
|
||||
out5[1] = x124
|
||||
out5[2] = x125
|
||||
out5[3] = x126
|
||||
}
|
||||
950
scalar.go
950
scalar.go
|
|
@ -5,7 +5,6 @@
|
|||
package edwards25519
|
||||
|
||||
import (
|
||||
"crypto/subtle"
|
||||
"encoding/binary"
|
||||
"errors"
|
||||
)
|
||||
|
|
@ -21,72 +20,77 @@ import (
|
|||
//
|
||||
// The zero value is a valid zero element.
|
||||
type Scalar struct {
|
||||
// A Scalar is an integer modulo l = 2^252 + 27742317777372353535851937790883648493.
|
||||
// Internally, this implementation keeps the scalar in the Montgomery domain.
|
||||
s [4]uint64
|
||||
// s is the scalar in the Montgomery domain, in the format of the
|
||||
// fiat-crypto implementation.
|
||||
s fiatScalarMontgomeryDomainFieldElement
|
||||
}
|
||||
|
||||
var (
|
||||
scZeroBytes = [32]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
|
||||
scOneBytes = [32]byte{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
|
||||
scMinusOneBytes = [32]byte{236, 211, 245, 92, 26, 99, 18, 88, 214, 156, 247, 162, 222, 249, 222, 20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16}
|
||||
|
||||
scOne = Scalar{[4]uint64{0xd6ec31748d98951d, 0xc6ef5bf4737dcf70, 0xfffffffffffffffe, 0xfffffffffffffff}}
|
||||
scMinusOne = Scalar{[4]uint64{0x812631a5cf5d3ed0, 0x4def9dea2f79cd65, 1, 0}}
|
||||
)
|
||||
// The field implementation in scalar_fiat.go is generated by the fiat-crypto
|
||||
// project (https://github.com/mit-plv/fiat-crypto) at version v0.0.9 (23d2dbc)
|
||||
// from a formally verified model.
|
||||
//
|
||||
// fiat-crypto code comes under the following license.
|
||||
//
|
||||
// Copyright (c) 2015-2020 The fiat-crypto Authors. All rights reserved.
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// 1. Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY the fiat-crypto authors "AS IS"
|
||||
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
|
||||
// THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
// PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL Berkeley Software Design,
|
||||
// Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
||||
// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
||||
// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
||||
// LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
||||
// NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
||||
// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
//
|
||||
|
||||
// NewScalar returns a new zero Scalar.
|
||||
func NewScalar() *Scalar {
|
||||
return &Scalar{}
|
||||
}
|
||||
|
||||
// MultiplyAdd sets s = x * y + z mod l, and returns s. DEPRECATED. Use the individual Add and Multiply methods instead.
|
||||
// MultiplyAdd sets s = x * y + z mod l, and returns s. It is equivalent to
|
||||
// using Multiply and then Add.
|
||||
func (s *Scalar) MultiplyAdd(x, y, z *Scalar) *Scalar {
|
||||
var tempFieldElement [4]uint64
|
||||
var xRepr, yRepr, zRepr, tempResult [32]byte
|
||||
|
||||
fiat_sc255_from_montgomery(&tempFieldElement, (*[4]uint64)(&x.s))
|
||||
fiat_sc255_to_bytes(&xRepr, &tempFieldElement)
|
||||
|
||||
fiat_sc255_from_montgomery(&tempFieldElement, (*[4]uint64)(&y.s))
|
||||
fiat_sc255_to_bytes(&yRepr, &tempFieldElement)
|
||||
|
||||
fiat_sc255_from_montgomery(&tempFieldElement, (*[4]uint64)(&z.s))
|
||||
fiat_sc255_to_bytes(&zRepr, &tempFieldElement)
|
||||
|
||||
scMulAdd(&tempResult, &xRepr, &yRepr, &zRepr)
|
||||
|
||||
fiat_sc255_from_bytes(&tempFieldElement, &tempResult)
|
||||
fiat_sc255_to_montgomery((*[4]uint64)(&s.s), &tempFieldElement)
|
||||
|
||||
return s
|
||||
// Make a copy of z in case it aliases s.
|
||||
zCopy := new(Scalar).Set(z)
|
||||
return s.Multiply(x, y).Add(s, zCopy)
|
||||
}
|
||||
|
||||
// Add sets s = x + y mod l, and returns s.
|
||||
func (s *Scalar) Add(x, y *Scalar) *Scalar {
|
||||
// s = 1 * x + y mod l
|
||||
fiat_sc255_add((*[4]uint64)(&s.s), (*[4]uint64)(&x.s), (*[4]uint64)(&y.s))
|
||||
fiatScalarAdd(&s.s, &x.s, &y.s)
|
||||
return s
|
||||
}
|
||||
|
||||
// Subtract sets s = x - y mod l, and returns s.
|
||||
func (s *Scalar) Subtract(x, y *Scalar) *Scalar {
|
||||
// s = -1 * y + x mod l
|
||||
fiat_sc255_sub((*[4]uint64)(&s.s), (*[4]uint64)(&x.s), (*[4]uint64)(&y.s))
|
||||
fiatScalarSub(&s.s, &x.s, &y.s)
|
||||
return s
|
||||
}
|
||||
|
||||
// Negate sets s = -x mod l, and returns s.
|
||||
func (s *Scalar) Negate(x *Scalar) *Scalar {
|
||||
// s = -1 * x + 0 mod l
|
||||
fiat_sc255_opp((*[4]uint64)(&s.s), (*[4]uint64)(&x.s))
|
||||
fiatScalarOpp(&s.s, &x.s)
|
||||
return s
|
||||
}
|
||||
|
||||
// Multiply sets s = x * y mod l, and returns s.
|
||||
func (s *Scalar) Multiply(x, y *Scalar) *Scalar {
|
||||
// s = x * y + 0 mod l
|
||||
fiat_sc255_mul((*[4]uint64)(&s.s), (*[4]uint64)(&x.s), (*[4]uint64)(&y.s))
|
||||
fiatScalarMul(&s.s, &x.s, &y.s)
|
||||
return s
|
||||
}
|
||||
|
||||
|
|
@ -106,19 +110,48 @@ func (s *Scalar) SetUniformBytes(x []byte) (*Scalar, error) {
|
|||
if len(x) != 64 {
|
||||
return nil, errors.New("edwards25519: invalid SetUniformBytes input length")
|
||||
}
|
||||
var wideBytes [64]byte
|
||||
copy(wideBytes[:], x[:])
|
||||
|
||||
// TODO: We should deprecate scReduce as well, but we retain it here for consistent behavior
|
||||
var reduced [32]byte
|
||||
scReduce(&reduced, &wideBytes)
|
||||
// We have a value x of 512 bits, but our fiatScalarFromBytes function
|
||||
// expects an input lower than l, which is a little over 252 bits.
|
||||
//
|
||||
// Instead of writing a reduction function that operates on wider inputs, we
|
||||
// can interpret x as the sum of three shorter values a, b, and c.
|
||||
//
|
||||
// x = a + b * 2^168 + c * 2^336 mod l
|
||||
//
|
||||
// We then precompute 2^168 and 2^336 modulo l, and perform the reduction
|
||||
// with two multiplications and two additions.
|
||||
|
||||
fiat_sc255_from_bytes((*[4]uint64)(&s.s), &reduced)
|
||||
fiat_sc255_to_montgomery((*[4]uint64)(&s.s), (*[4]uint64)(&s.s))
|
||||
s.setShortBytes(x[:21])
|
||||
t := new(Scalar).setShortBytes(x[21:42])
|
||||
s.Add(s, t.Multiply(t, scalarTwo168))
|
||||
t.setShortBytes(x[42:])
|
||||
s.Add(s, t.Multiply(t, scalarTwo336))
|
||||
|
||||
return s, nil
|
||||
}
|
||||
|
||||
// scalarTwo168 and scalarTwo336 are 2^168 and 2^336 modulo l, encoded as a
|
||||
// fiatScalarMontgomeryDomainFieldElement, which is a little-endian 4-limb value
|
||||
// in the 2^256 Montgomery domain.
|
||||
var scalarTwo168 = &Scalar{s: [4]uint64{0x5b8ab432eac74798, 0x38afddd6de59d5d7,
|
||||
0xa2c131b399411b7c, 0x6329a7ed9ce5a30}}
|
||||
var scalarTwo336 = &Scalar{s: [4]uint64{0xbd3d108e2b35ecc5, 0x5c3a3718bdf9c90b,
|
||||
0x63aa97a331b4f2ee, 0x3d217f5be65cb5c}}
|
||||
|
||||
// setShortBytes sets s = x mod l, where x is a little-endian integer shorter
|
||||
// than 32 bytes.
|
||||
func (s *Scalar) setShortBytes(x []byte) *Scalar {
|
||||
if len(x) >= 32 {
|
||||
panic("edwards25519: internal error: setShortBytes called with a long string")
|
||||
}
|
||||
var buf [32]byte
|
||||
copy(buf[:], x)
|
||||
fiatScalarFromBytes((*[4]uint64)(&s.s), &buf)
|
||||
fiatScalarToMontgomery(&s.s, (*fiatScalarNonMontgomeryDomainFieldElement)(&s.s))
|
||||
return s
|
||||
}
|
||||
|
||||
// SetCanonicalBytes sets s = x, where x is a 32-byte little-endian encoding of
|
||||
// s, and returns s. If x is not a canonical encoding of s, SetCanonicalBytes
|
||||
// returns nil and an error, and the receiver is unchanged.
|
||||
|
|
@ -126,21 +159,21 @@ func (s *Scalar) SetCanonicalBytes(x []byte) (*Scalar, error) {
|
|||
if len(x) != 32 {
|
||||
return nil, errors.New("invalid scalar length")
|
||||
}
|
||||
|
||||
// Use bytes here because the original logic assumed the old 32-byte LE representation
|
||||
ss := [32]byte{}
|
||||
copy(ss[:], x)
|
||||
if !isReduced(ss[:]) {
|
||||
if !isReduced(x) {
|
||||
return nil, errors.New("invalid scalar encoding")
|
||||
}
|
||||
|
||||
fiat_sc255_from_bytes((*[4]uint64)(&s.s), &ss)
|
||||
fiat_sc255_to_montgomery((*[4]uint64)(&s.s), (*[4]uint64)(&s.s))
|
||||
fiatScalarFromBytes((*[4]uint64)(&s.s), (*[32]byte)(x))
|
||||
fiatScalarToMontgomery(&s.s, (*fiatScalarNonMontgomeryDomainFieldElement)(&s.s))
|
||||
|
||||
return s, nil
|
||||
}
|
||||
|
||||
// isReduced returns whether the given scalar in 32-byte little endian encoded form is reduced modulo l.
|
||||
// scalarMinusOneBytes is l - 1 in little endian.
|
||||
var scalarMinusOneBytes = [32]byte{236, 211, 245, 92, 26, 99, 18, 88, 214, 156, 247, 162, 222, 249, 222, 20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16}
|
||||
|
||||
// isReduced returns whether the given scalar in 32-byte little endian encoded
|
||||
// form is reduced modulo l.
|
||||
func isReduced(s []byte) bool {
|
||||
if len(s) != 32 {
|
||||
return false
|
||||
|
|
@ -148,9 +181,9 @@ func isReduced(s []byte) bool {
|
|||
|
||||
for i := len(s) - 1; i >= 0; i-- {
|
||||
switch {
|
||||
case s[i] > scMinusOneBytes[i]:
|
||||
case s[i] > scalarMinusOneBytes[i]:
|
||||
return false
|
||||
case s[i] < scMinusOneBytes[i]:
|
||||
case s[i] < scalarMinusOneBytes[i]:
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
|
@ -176,818 +209,45 @@ func (s *Scalar) SetBytesWithClamping(x []byte) (*Scalar, error) {
|
|||
if len(x) != 32 {
|
||||
return nil, errors.New("edwards25519: invalid SetBytesWithClamping input length")
|
||||
}
|
||||
|
||||
// We need to use the wide reduction from SetUniformBytes, since clamping
|
||||
// sets the 2^254 bit, making the value higher than the order.
|
||||
var wideBytes [64]byte
|
||||
copy(wideBytes[:], x[:])
|
||||
wideBytes[0] &= 248
|
||||
wideBytes[31] &= 63
|
||||
wideBytes[31] |= 64
|
||||
var reduced [32]byte
|
||||
scReduce(&reduced, &wideBytes)
|
||||
fiat_sc255_from_bytes((*[4]uint64)(&s.s), &reduced)
|
||||
fiat_sc255_to_montgomery((*[4]uint64)(&s.s), (*[4]uint64)(&s.s))
|
||||
return s, nil
|
||||
return s.SetUniformBytes(wideBytes[:])
|
||||
}
|
||||
|
||||
// Bytes returns the canonical 32-byte little-endian encoding of s.
|
||||
func (s *Scalar) Bytes() []byte {
|
||||
// This pattern, called "outlining", allows this function to inline so the
|
||||
// allocations can occur on the caller stack rather than escaping to the heap.
|
||||
// See https://blog.filippo.io/efficient-go-apis-with-the-inliner for more details.
|
||||
// This function is outlined to make the allocations inline in the caller
|
||||
// rather than happen on the heap.
|
||||
var encoded [32]byte
|
||||
return s.bytes(&encoded)
|
||||
}
|
||||
|
||||
func (s *Scalar) bytes(out *[32]byte) []byte {
|
||||
var limbs [4]uint64
|
||||
fiat_sc255_from_montgomery(&limbs, (*[4]uint64)(&s.s))
|
||||
fiat_sc255_to_bytes(out, &limbs)
|
||||
var ss fiatScalarNonMontgomeryDomainFieldElement
|
||||
fiatScalarFromMontgomery(&ss, &s.s)
|
||||
fiatScalarToBytes(out, (*[4]uint64)(&ss))
|
||||
return out[:]
|
||||
}
|
||||
|
||||
// Equal returns 1 if s and t are equal, and 0 otherwise.
|
||||
func (s *Scalar) Equal(t *Scalar) int {
|
||||
st := t.Bytes()
|
||||
ss := s.Bytes()
|
||||
return subtle.ConstantTimeCompare(ss[:], st[:])
|
||||
}
|
||||
|
||||
// scMulAdd and scReduce are ported from the public domain, “ref10”
|
||||
// implementation of ed25519 from SUPERCOP.
|
||||
|
||||
func load3(in []byte) int64 {
|
||||
r := int64(in[0])
|
||||
r |= int64(in[1]) << 8
|
||||
r |= int64(in[2]) << 16
|
||||
return r
|
||||
}
|
||||
|
||||
func load4(in []byte) int64 {
|
||||
r := int64(in[0])
|
||||
r |= int64(in[1]) << 8
|
||||
r |= int64(in[2]) << 16
|
||||
r |= int64(in[3]) << 24
|
||||
return r
|
||||
}
|
||||
|
||||
// Input:
|
||||
//
|
||||
// a[0]+256*a[1]+...+256^31*a[31] = a
|
||||
// b[0]+256*b[1]+...+256^31*b[31] = b
|
||||
// c[0]+256*c[1]+...+256^31*c[31] = c
|
||||
//
|
||||
// Output:
|
||||
//
|
||||
// s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
|
||||
// where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
func scMulAdd(s, a, b, c *[32]byte) {
|
||||
a0 := 2097151 & load3(a[:])
|
||||
a1 := 2097151 & (load4(a[2:]) >> 5)
|
||||
a2 := 2097151 & (load3(a[5:]) >> 2)
|
||||
a3 := 2097151 & (load4(a[7:]) >> 7)
|
||||
a4 := 2097151 & (load4(a[10:]) >> 4)
|
||||
a5 := 2097151 & (load3(a[13:]) >> 1)
|
||||
a6 := 2097151 & (load4(a[15:]) >> 6)
|
||||
a7 := 2097151 & (load3(a[18:]) >> 3)
|
||||
a8 := 2097151 & load3(a[21:])
|
||||
a9 := 2097151 & (load4(a[23:]) >> 5)
|
||||
a10 := 2097151 & (load3(a[26:]) >> 2)
|
||||
a11 := (load4(a[28:]) >> 7)
|
||||
b0 := 2097151 & load3(b[:])
|
||||
b1 := 2097151 & (load4(b[2:]) >> 5)
|
||||
b2 := 2097151 & (load3(b[5:]) >> 2)
|
||||
b3 := 2097151 & (load4(b[7:]) >> 7)
|
||||
b4 := 2097151 & (load4(b[10:]) >> 4)
|
||||
b5 := 2097151 & (load3(b[13:]) >> 1)
|
||||
b6 := 2097151 & (load4(b[15:]) >> 6)
|
||||
b7 := 2097151 & (load3(b[18:]) >> 3)
|
||||
b8 := 2097151 & load3(b[21:])
|
||||
b9 := 2097151 & (load4(b[23:]) >> 5)
|
||||
b10 := 2097151 & (load3(b[26:]) >> 2)
|
||||
b11 := (load4(b[28:]) >> 7)
|
||||
c0 := 2097151 & load3(c[:])
|
||||
c1 := 2097151 & (load4(c[2:]) >> 5)
|
||||
c2 := 2097151 & (load3(c[5:]) >> 2)
|
||||
c3 := 2097151 & (load4(c[7:]) >> 7)
|
||||
c4 := 2097151 & (load4(c[10:]) >> 4)
|
||||
c5 := 2097151 & (load3(c[13:]) >> 1)
|
||||
c6 := 2097151 & (load4(c[15:]) >> 6)
|
||||
c7 := 2097151 & (load3(c[18:]) >> 3)
|
||||
c8 := 2097151 & load3(c[21:])
|
||||
c9 := 2097151 & (load4(c[23:]) >> 5)
|
||||
c10 := 2097151 & (load3(c[26:]) >> 2)
|
||||
c11 := (load4(c[28:]) >> 7)
|
||||
var carry [23]int64
|
||||
|
||||
s0 := c0 + a0*b0
|
||||
s1 := c1 + a0*b1 + a1*b0
|
||||
s2 := c2 + a0*b2 + a1*b1 + a2*b0
|
||||
s3 := c3 + a0*b3 + a1*b2 + a2*b1 + a3*b0
|
||||
s4 := c4 + a0*b4 + a1*b3 + a2*b2 + a3*b1 + a4*b0
|
||||
s5 := c5 + a0*b5 + a1*b4 + a2*b3 + a3*b2 + a4*b1 + a5*b0
|
||||
s6 := c6 + a0*b6 + a1*b5 + a2*b4 + a3*b3 + a4*b2 + a5*b1 + a6*b0
|
||||
s7 := c7 + a0*b7 + a1*b6 + a2*b5 + a3*b4 + a4*b3 + a5*b2 + a6*b1 + a7*b0
|
||||
s8 := c8 + a0*b8 + a1*b7 + a2*b6 + a3*b5 + a4*b4 + a5*b3 + a6*b2 + a7*b1 + a8*b0
|
||||
s9 := c9 + a0*b9 + a1*b8 + a2*b7 + a3*b6 + a4*b5 + a5*b4 + a6*b3 + a7*b2 + a8*b1 + a9*b0
|
||||
s10 := c10 + a0*b10 + a1*b9 + a2*b8 + a3*b7 + a4*b6 + a5*b5 + a6*b4 + a7*b3 + a8*b2 + a9*b1 + a10*b0
|
||||
s11 := c11 + a0*b11 + a1*b10 + a2*b9 + a3*b8 + a4*b7 + a5*b6 + a6*b5 + a7*b4 + a8*b3 + a9*b2 + a10*b1 + a11*b0
|
||||
s12 := a1*b11 + a2*b10 + a3*b9 + a4*b8 + a5*b7 + a6*b6 + a7*b5 + a8*b4 + a9*b3 + a10*b2 + a11*b1
|
||||
s13 := a2*b11 + a3*b10 + a4*b9 + a5*b8 + a6*b7 + a7*b6 + a8*b5 + a9*b4 + a10*b3 + a11*b2
|
||||
s14 := a3*b11 + a4*b10 + a5*b9 + a6*b8 + a7*b7 + a8*b6 + a9*b5 + a10*b4 + a11*b3
|
||||
s15 := a4*b11 + a5*b10 + a6*b9 + a7*b8 + a8*b7 + a9*b6 + a10*b5 + a11*b4
|
||||
s16 := a5*b11 + a6*b10 + a7*b9 + a8*b8 + a9*b7 + a10*b6 + a11*b5
|
||||
s17 := a6*b11 + a7*b10 + a8*b9 + a9*b8 + a10*b7 + a11*b6
|
||||
s18 := a7*b11 + a8*b10 + a9*b9 + a10*b8 + a11*b7
|
||||
s19 := a8*b11 + a9*b10 + a10*b9 + a11*b8
|
||||
s20 := a9*b11 + a10*b10 + a11*b9
|
||||
s21 := a10*b11 + a11*b10
|
||||
s22 := a11 * b11
|
||||
s23 := int64(0)
|
||||
|
||||
carry[0] = (s0 + (1 << 20)) >> 21
|
||||
s1 += carry[0]
|
||||
s0 -= carry[0] << 21
|
||||
carry[2] = (s2 + (1 << 20)) >> 21
|
||||
s3 += carry[2]
|
||||
s2 -= carry[2] << 21
|
||||
carry[4] = (s4 + (1 << 20)) >> 21
|
||||
s5 += carry[4]
|
||||
s4 -= carry[4] << 21
|
||||
carry[6] = (s6 + (1 << 20)) >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[8] = (s8 + (1 << 20)) >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[10] = (s10 + (1 << 20)) >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
carry[12] = (s12 + (1 << 20)) >> 21
|
||||
s13 += carry[12]
|
||||
s12 -= carry[12] << 21
|
||||
carry[14] = (s14 + (1 << 20)) >> 21
|
||||
s15 += carry[14]
|
||||
s14 -= carry[14] << 21
|
||||
carry[16] = (s16 + (1 << 20)) >> 21
|
||||
s17 += carry[16]
|
||||
s16 -= carry[16] << 21
|
||||
carry[18] = (s18 + (1 << 20)) >> 21
|
||||
s19 += carry[18]
|
||||
s18 -= carry[18] << 21
|
||||
carry[20] = (s20 + (1 << 20)) >> 21
|
||||
s21 += carry[20]
|
||||
s20 -= carry[20] << 21
|
||||
carry[22] = (s22 + (1 << 20)) >> 21
|
||||
s23 += carry[22]
|
||||
s22 -= carry[22] << 21
|
||||
|
||||
carry[1] = (s1 + (1 << 20)) >> 21
|
||||
s2 += carry[1]
|
||||
s1 -= carry[1] << 21
|
||||
carry[3] = (s3 + (1 << 20)) >> 21
|
||||
s4 += carry[3]
|
||||
s3 -= carry[3] << 21
|
||||
carry[5] = (s5 + (1 << 20)) >> 21
|
||||
s6 += carry[5]
|
||||
s5 -= carry[5] << 21
|
||||
carry[7] = (s7 + (1 << 20)) >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[9] = (s9 + (1 << 20)) >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[11] = (s11 + (1 << 20)) >> 21
|
||||
s12 += carry[11]
|
||||
s11 -= carry[11] << 21
|
||||
carry[13] = (s13 + (1 << 20)) >> 21
|
||||
s14 += carry[13]
|
||||
s13 -= carry[13] << 21
|
||||
carry[15] = (s15 + (1 << 20)) >> 21
|
||||
s16 += carry[15]
|
||||
s15 -= carry[15] << 21
|
||||
carry[17] = (s17 + (1 << 20)) >> 21
|
||||
s18 += carry[17]
|
||||
s17 -= carry[17] << 21
|
||||
carry[19] = (s19 + (1 << 20)) >> 21
|
||||
s20 += carry[19]
|
||||
s19 -= carry[19] << 21
|
||||
carry[21] = (s21 + (1 << 20)) >> 21
|
||||
s22 += carry[21]
|
||||
s21 -= carry[21] << 21
|
||||
|
||||
s11 += s23 * 666643
|
||||
s12 += s23 * 470296
|
||||
s13 += s23 * 654183
|
||||
s14 -= s23 * 997805
|
||||
s15 += s23 * 136657
|
||||
s16 -= s23 * 683901
|
||||
s23 = 0
|
||||
|
||||
s10 += s22 * 666643
|
||||
s11 += s22 * 470296
|
||||
s12 += s22 * 654183
|
||||
s13 -= s22 * 997805
|
||||
s14 += s22 * 136657
|
||||
s15 -= s22 * 683901
|
||||
s22 = 0
|
||||
|
||||
s9 += s21 * 666643
|
||||
s10 += s21 * 470296
|
||||
s11 += s21 * 654183
|
||||
s12 -= s21 * 997805
|
||||
s13 += s21 * 136657
|
||||
s14 -= s21 * 683901
|
||||
s21 = 0
|
||||
|
||||
s8 += s20 * 666643
|
||||
s9 += s20 * 470296
|
||||
s10 += s20 * 654183
|
||||
s11 -= s20 * 997805
|
||||
s12 += s20 * 136657
|
||||
s13 -= s20 * 683901
|
||||
s20 = 0
|
||||
|
||||
s7 += s19 * 666643
|
||||
s8 += s19 * 470296
|
||||
s9 += s19 * 654183
|
||||
s10 -= s19 * 997805
|
||||
s11 += s19 * 136657
|
||||
s12 -= s19 * 683901
|
||||
s19 = 0
|
||||
|
||||
s6 += s18 * 666643
|
||||
s7 += s18 * 470296
|
||||
s8 += s18 * 654183
|
||||
s9 -= s18 * 997805
|
||||
s10 += s18 * 136657
|
||||
s11 -= s18 * 683901
|
||||
s18 = 0
|
||||
|
||||
carry[6] = (s6 + (1 << 20)) >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[8] = (s8 + (1 << 20)) >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[10] = (s10 + (1 << 20)) >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
carry[12] = (s12 + (1 << 20)) >> 21
|
||||
s13 += carry[12]
|
||||
s12 -= carry[12] << 21
|
||||
carry[14] = (s14 + (1 << 20)) >> 21
|
||||
s15 += carry[14]
|
||||
s14 -= carry[14] << 21
|
||||
carry[16] = (s16 + (1 << 20)) >> 21
|
||||
s17 += carry[16]
|
||||
s16 -= carry[16] << 21
|
||||
|
||||
carry[7] = (s7 + (1 << 20)) >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[9] = (s9 + (1 << 20)) >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[11] = (s11 + (1 << 20)) >> 21
|
||||
s12 += carry[11]
|
||||
s11 -= carry[11] << 21
|
||||
carry[13] = (s13 + (1 << 20)) >> 21
|
||||
s14 += carry[13]
|
||||
s13 -= carry[13] << 21
|
||||
carry[15] = (s15 + (1 << 20)) >> 21
|
||||
s16 += carry[15]
|
||||
s15 -= carry[15] << 21
|
||||
|
||||
s5 += s17 * 666643
|
||||
s6 += s17 * 470296
|
||||
s7 += s17 * 654183
|
||||
s8 -= s17 * 997805
|
||||
s9 += s17 * 136657
|
||||
s10 -= s17 * 683901
|
||||
s17 = 0
|
||||
|
||||
s4 += s16 * 666643
|
||||
s5 += s16 * 470296
|
||||
s6 += s16 * 654183
|
||||
s7 -= s16 * 997805
|
||||
s8 += s16 * 136657
|
||||
s9 -= s16 * 683901
|
||||
s16 = 0
|
||||
|
||||
s3 += s15 * 666643
|
||||
s4 += s15 * 470296
|
||||
s5 += s15 * 654183
|
||||
s6 -= s15 * 997805
|
||||
s7 += s15 * 136657
|
||||
s8 -= s15 * 683901
|
||||
s15 = 0
|
||||
|
||||
s2 += s14 * 666643
|
||||
s3 += s14 * 470296
|
||||
s4 += s14 * 654183
|
||||
s5 -= s14 * 997805
|
||||
s6 += s14 * 136657
|
||||
s7 -= s14 * 683901
|
||||
s14 = 0
|
||||
|
||||
s1 += s13 * 666643
|
||||
s2 += s13 * 470296
|
||||
s3 += s13 * 654183
|
||||
s4 -= s13 * 997805
|
||||
s5 += s13 * 136657
|
||||
s6 -= s13 * 683901
|
||||
s13 = 0
|
||||
|
||||
s0 += s12 * 666643
|
||||
s1 += s12 * 470296
|
||||
s2 += s12 * 654183
|
||||
s3 -= s12 * 997805
|
||||
s4 += s12 * 136657
|
||||
s5 -= s12 * 683901
|
||||
s12 = 0
|
||||
|
||||
carry[0] = (s0 + (1 << 20)) >> 21
|
||||
s1 += carry[0]
|
||||
s0 -= carry[0] << 21
|
||||
carry[2] = (s2 + (1 << 20)) >> 21
|
||||
s3 += carry[2]
|
||||
s2 -= carry[2] << 21
|
||||
carry[4] = (s4 + (1 << 20)) >> 21
|
||||
s5 += carry[4]
|
||||
s4 -= carry[4] << 21
|
||||
carry[6] = (s6 + (1 << 20)) >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[8] = (s8 + (1 << 20)) >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[10] = (s10 + (1 << 20)) >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
|
||||
carry[1] = (s1 + (1 << 20)) >> 21
|
||||
s2 += carry[1]
|
||||
s1 -= carry[1] << 21
|
||||
carry[3] = (s3 + (1 << 20)) >> 21
|
||||
s4 += carry[3]
|
||||
s3 -= carry[3] << 21
|
||||
carry[5] = (s5 + (1 << 20)) >> 21
|
||||
s6 += carry[5]
|
||||
s5 -= carry[5] << 21
|
||||
carry[7] = (s7 + (1 << 20)) >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[9] = (s9 + (1 << 20)) >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[11] = (s11 + (1 << 20)) >> 21
|
||||
s12 += carry[11]
|
||||
s11 -= carry[11] << 21
|
||||
|
||||
s0 += s12 * 666643
|
||||
s1 += s12 * 470296
|
||||
s2 += s12 * 654183
|
||||
s3 -= s12 * 997805
|
||||
s4 += s12 * 136657
|
||||
s5 -= s12 * 683901
|
||||
s12 = 0
|
||||
|
||||
carry[0] = s0 >> 21
|
||||
s1 += carry[0]
|
||||
s0 -= carry[0] << 21
|
||||
carry[1] = s1 >> 21
|
||||
s2 += carry[1]
|
||||
s1 -= carry[1] << 21
|
||||
carry[2] = s2 >> 21
|
||||
s3 += carry[2]
|
||||
s2 -= carry[2] << 21
|
||||
carry[3] = s3 >> 21
|
||||
s4 += carry[3]
|
||||
s3 -= carry[3] << 21
|
||||
carry[4] = s4 >> 21
|
||||
s5 += carry[4]
|
||||
s4 -= carry[4] << 21
|
||||
carry[5] = s5 >> 21
|
||||
s6 += carry[5]
|
||||
s5 -= carry[5] << 21
|
||||
carry[6] = s6 >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[7] = s7 >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[8] = s8 >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[9] = s9 >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[10] = s10 >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
carry[11] = s11 >> 21
|
||||
s12 += carry[11]
|
||||
s11 -= carry[11] << 21
|
||||
|
||||
s0 += s12 * 666643
|
||||
s1 += s12 * 470296
|
||||
s2 += s12 * 654183
|
||||
s3 -= s12 * 997805
|
||||
s4 += s12 * 136657
|
||||
s5 -= s12 * 683901
|
||||
s12 = 0
|
||||
|
||||
carry[0] = s0 >> 21
|
||||
s1 += carry[0]
|
||||
s0 -= carry[0] << 21
|
||||
carry[1] = s1 >> 21
|
||||
s2 += carry[1]
|
||||
s1 -= carry[1] << 21
|
||||
carry[2] = s2 >> 21
|
||||
s3 += carry[2]
|
||||
s2 -= carry[2] << 21
|
||||
carry[3] = s3 >> 21
|
||||
s4 += carry[3]
|
||||
s3 -= carry[3] << 21
|
||||
carry[4] = s4 >> 21
|
||||
s5 += carry[4]
|
||||
s4 -= carry[4] << 21
|
||||
carry[5] = s5 >> 21
|
||||
s6 += carry[5]
|
||||
s5 -= carry[5] << 21
|
||||
carry[6] = s6 >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[7] = s7 >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[8] = s8 >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[9] = s9 >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[10] = s10 >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
|
||||
s[0] = byte(s0 >> 0)
|
||||
s[1] = byte(s0 >> 8)
|
||||
s[2] = byte((s0 >> 16) | (s1 << 5))
|
||||
s[3] = byte(s1 >> 3)
|
||||
s[4] = byte(s1 >> 11)
|
||||
s[5] = byte((s1 >> 19) | (s2 << 2))
|
||||
s[6] = byte(s2 >> 6)
|
||||
s[7] = byte((s2 >> 14) | (s3 << 7))
|
||||
s[8] = byte(s3 >> 1)
|
||||
s[9] = byte(s3 >> 9)
|
||||
s[10] = byte((s3 >> 17) | (s4 << 4))
|
||||
s[11] = byte(s4 >> 4)
|
||||
s[12] = byte(s4 >> 12)
|
||||
s[13] = byte((s4 >> 20) | (s5 << 1))
|
||||
s[14] = byte(s5 >> 7)
|
||||
s[15] = byte((s5 >> 15) | (s6 << 6))
|
||||
s[16] = byte(s6 >> 2)
|
||||
s[17] = byte(s6 >> 10)
|
||||
s[18] = byte((s6 >> 18) | (s7 << 3))
|
||||
s[19] = byte(s7 >> 5)
|
||||
s[20] = byte(s7 >> 13)
|
||||
s[21] = byte(s8 >> 0)
|
||||
s[22] = byte(s8 >> 8)
|
||||
s[23] = byte((s8 >> 16) | (s9 << 5))
|
||||
s[24] = byte(s9 >> 3)
|
||||
s[25] = byte(s9 >> 11)
|
||||
s[26] = byte((s9 >> 19) | (s10 << 2))
|
||||
s[27] = byte(s10 >> 6)
|
||||
s[28] = byte((s10 >> 14) | (s11 << 7))
|
||||
s[29] = byte(s11 >> 1)
|
||||
s[30] = byte(s11 >> 9)
|
||||
s[31] = byte(s11 >> 17)
|
||||
}
|
||||
|
||||
// Input:
|
||||
//
|
||||
// s[0]+256*s[1]+...+256^63*s[63] = s
|
||||
//
|
||||
// Output:
|
||||
//
|
||||
// s[0]+256*s[1]+...+256^31*s[31] = s mod l
|
||||
// where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
func scReduce(out *[32]byte, s *[64]byte) {
|
||||
s0 := 2097151 & load3(s[:])
|
||||
s1 := 2097151 & (load4(s[2:]) >> 5)
|
||||
s2 := 2097151 & (load3(s[5:]) >> 2)
|
||||
s3 := 2097151 & (load4(s[7:]) >> 7)
|
||||
s4 := 2097151 & (load4(s[10:]) >> 4)
|
||||
s5 := 2097151 & (load3(s[13:]) >> 1)
|
||||
s6 := 2097151 & (load4(s[15:]) >> 6)
|
||||
s7 := 2097151 & (load3(s[18:]) >> 3)
|
||||
s8 := 2097151 & load3(s[21:])
|
||||
s9 := 2097151 & (load4(s[23:]) >> 5)
|
||||
s10 := 2097151 & (load3(s[26:]) >> 2)
|
||||
s11 := 2097151 & (load4(s[28:]) >> 7)
|
||||
s12 := 2097151 & (load4(s[31:]) >> 4)
|
||||
s13 := 2097151 & (load3(s[34:]) >> 1)
|
||||
s14 := 2097151 & (load4(s[36:]) >> 6)
|
||||
s15 := 2097151 & (load3(s[39:]) >> 3)
|
||||
s16 := 2097151 & load3(s[42:])
|
||||
s17 := 2097151 & (load4(s[44:]) >> 5)
|
||||
s18 := 2097151 & (load3(s[47:]) >> 2)
|
||||
s19 := 2097151 & (load4(s[49:]) >> 7)
|
||||
s20 := 2097151 & (load4(s[52:]) >> 4)
|
||||
s21 := 2097151 & (load3(s[55:]) >> 1)
|
||||
s22 := 2097151 & (load4(s[57:]) >> 6)
|
||||
s23 := (load4(s[60:]) >> 3)
|
||||
|
||||
s11 += s23 * 666643
|
||||
s12 += s23 * 470296
|
||||
s13 += s23 * 654183
|
||||
s14 -= s23 * 997805
|
||||
s15 += s23 * 136657
|
||||
s16 -= s23 * 683901
|
||||
s23 = 0
|
||||
|
||||
s10 += s22 * 666643
|
||||
s11 += s22 * 470296
|
||||
s12 += s22 * 654183
|
||||
s13 -= s22 * 997805
|
||||
s14 += s22 * 136657
|
||||
s15 -= s22 * 683901
|
||||
s22 = 0
|
||||
|
||||
s9 += s21 * 666643
|
||||
s10 += s21 * 470296
|
||||
s11 += s21 * 654183
|
||||
s12 -= s21 * 997805
|
||||
s13 += s21 * 136657
|
||||
s14 -= s21 * 683901
|
||||
s21 = 0
|
||||
|
||||
s8 += s20 * 666643
|
||||
s9 += s20 * 470296
|
||||
s10 += s20 * 654183
|
||||
s11 -= s20 * 997805
|
||||
s12 += s20 * 136657
|
||||
s13 -= s20 * 683901
|
||||
s20 = 0
|
||||
|
||||
s7 += s19 * 666643
|
||||
s8 += s19 * 470296
|
||||
s9 += s19 * 654183
|
||||
s10 -= s19 * 997805
|
||||
s11 += s19 * 136657
|
||||
s12 -= s19 * 683901
|
||||
s19 = 0
|
||||
|
||||
s6 += s18 * 666643
|
||||
s7 += s18 * 470296
|
||||
s8 += s18 * 654183
|
||||
s9 -= s18 * 997805
|
||||
s10 += s18 * 136657
|
||||
s11 -= s18 * 683901
|
||||
s18 = 0
|
||||
|
||||
var carry [17]int64
|
||||
|
||||
carry[6] = (s6 + (1 << 20)) >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[8] = (s8 + (1 << 20)) >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[10] = (s10 + (1 << 20)) >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
carry[12] = (s12 + (1 << 20)) >> 21
|
||||
s13 += carry[12]
|
||||
s12 -= carry[12] << 21
|
||||
carry[14] = (s14 + (1 << 20)) >> 21
|
||||
s15 += carry[14]
|
||||
s14 -= carry[14] << 21
|
||||
carry[16] = (s16 + (1 << 20)) >> 21
|
||||
s17 += carry[16]
|
||||
s16 -= carry[16] << 21
|
||||
|
||||
carry[7] = (s7 + (1 << 20)) >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[9] = (s9 + (1 << 20)) >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[11] = (s11 + (1 << 20)) >> 21
|
||||
s12 += carry[11]
|
||||
s11 -= carry[11] << 21
|
||||
carry[13] = (s13 + (1 << 20)) >> 21
|
||||
s14 += carry[13]
|
||||
s13 -= carry[13] << 21
|
||||
carry[15] = (s15 + (1 << 20)) >> 21
|
||||
s16 += carry[15]
|
||||
s15 -= carry[15] << 21
|
||||
|
||||
s5 += s17 * 666643
|
||||
s6 += s17 * 470296
|
||||
s7 += s17 * 654183
|
||||
s8 -= s17 * 997805
|
||||
s9 += s17 * 136657
|
||||
s10 -= s17 * 683901
|
||||
s17 = 0
|
||||
|
||||
s4 += s16 * 666643
|
||||
s5 += s16 * 470296
|
||||
s6 += s16 * 654183
|
||||
s7 -= s16 * 997805
|
||||
s8 += s16 * 136657
|
||||
s9 -= s16 * 683901
|
||||
s16 = 0
|
||||
|
||||
s3 += s15 * 666643
|
||||
s4 += s15 * 470296
|
||||
s5 += s15 * 654183
|
||||
s6 -= s15 * 997805
|
||||
s7 += s15 * 136657
|
||||
s8 -= s15 * 683901
|
||||
s15 = 0
|
||||
|
||||
s2 += s14 * 666643
|
||||
s3 += s14 * 470296
|
||||
s4 += s14 * 654183
|
||||
s5 -= s14 * 997805
|
||||
s6 += s14 * 136657
|
||||
s7 -= s14 * 683901
|
||||
s14 = 0
|
||||
|
||||
s1 += s13 * 666643
|
||||
s2 += s13 * 470296
|
||||
s3 += s13 * 654183
|
||||
s4 -= s13 * 997805
|
||||
s5 += s13 * 136657
|
||||
s6 -= s13 * 683901
|
||||
s13 = 0
|
||||
|
||||
s0 += s12 * 666643
|
||||
s1 += s12 * 470296
|
||||
s2 += s12 * 654183
|
||||
s3 -= s12 * 997805
|
||||
s4 += s12 * 136657
|
||||
s5 -= s12 * 683901
|
||||
s12 = 0
|
||||
|
||||
carry[0] = (s0 + (1 << 20)) >> 21
|
||||
s1 += carry[0]
|
||||
s0 -= carry[0] << 21
|
||||
carry[2] = (s2 + (1 << 20)) >> 21
|
||||
s3 += carry[2]
|
||||
s2 -= carry[2] << 21
|
||||
carry[4] = (s4 + (1 << 20)) >> 21
|
||||
s5 += carry[4]
|
||||
s4 -= carry[4] << 21
|
||||
carry[6] = (s6 + (1 << 20)) >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[8] = (s8 + (1 << 20)) >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[10] = (s10 + (1 << 20)) >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
|
||||
carry[1] = (s1 + (1 << 20)) >> 21
|
||||
s2 += carry[1]
|
||||
s1 -= carry[1] << 21
|
||||
carry[3] = (s3 + (1 << 20)) >> 21
|
||||
s4 += carry[3]
|
||||
s3 -= carry[3] << 21
|
||||
carry[5] = (s5 + (1 << 20)) >> 21
|
||||
s6 += carry[5]
|
||||
s5 -= carry[5] << 21
|
||||
carry[7] = (s7 + (1 << 20)) >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[9] = (s9 + (1 << 20)) >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[11] = (s11 + (1 << 20)) >> 21
|
||||
s12 += carry[11]
|
||||
s11 -= carry[11] << 21
|
||||
|
||||
s0 += s12 * 666643
|
||||
s1 += s12 * 470296
|
||||
s2 += s12 * 654183
|
||||
s3 -= s12 * 997805
|
||||
s4 += s12 * 136657
|
||||
s5 -= s12 * 683901
|
||||
s12 = 0
|
||||
|
||||
carry[0] = s0 >> 21
|
||||
s1 += carry[0]
|
||||
s0 -= carry[0] << 21
|
||||
carry[1] = s1 >> 21
|
||||
s2 += carry[1]
|
||||
s1 -= carry[1] << 21
|
||||
carry[2] = s2 >> 21
|
||||
s3 += carry[2]
|
||||
s2 -= carry[2] << 21
|
||||
carry[3] = s3 >> 21
|
||||
s4 += carry[3]
|
||||
s3 -= carry[3] << 21
|
||||
carry[4] = s4 >> 21
|
||||
s5 += carry[4]
|
||||
s4 -= carry[4] << 21
|
||||
carry[5] = s5 >> 21
|
||||
s6 += carry[5]
|
||||
s5 -= carry[5] << 21
|
||||
carry[6] = s6 >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[7] = s7 >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[8] = s8 >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[9] = s9 >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[10] = s10 >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
carry[11] = s11 >> 21
|
||||
s12 += carry[11]
|
||||
s11 -= carry[11] << 21
|
||||
|
||||
s0 += s12 * 666643
|
||||
s1 += s12 * 470296
|
||||
s2 += s12 * 654183
|
||||
s3 -= s12 * 997805
|
||||
s4 += s12 * 136657
|
||||
s5 -= s12 * 683901
|
||||
s12 = 0
|
||||
|
||||
carry[0] = s0 >> 21
|
||||
s1 += carry[0]
|
||||
s0 -= carry[0] << 21
|
||||
carry[1] = s1 >> 21
|
||||
s2 += carry[1]
|
||||
s1 -= carry[1] << 21
|
||||
carry[2] = s2 >> 21
|
||||
s3 += carry[2]
|
||||
s2 -= carry[2] << 21
|
||||
carry[3] = s3 >> 21
|
||||
s4 += carry[3]
|
||||
s3 -= carry[3] << 21
|
||||
carry[4] = s4 >> 21
|
||||
s5 += carry[4]
|
||||
s4 -= carry[4] << 21
|
||||
carry[5] = s5 >> 21
|
||||
s6 += carry[5]
|
||||
s5 -= carry[5] << 21
|
||||
carry[6] = s6 >> 21
|
||||
s7 += carry[6]
|
||||
s6 -= carry[6] << 21
|
||||
carry[7] = s7 >> 21
|
||||
s8 += carry[7]
|
||||
s7 -= carry[7] << 21
|
||||
carry[8] = s8 >> 21
|
||||
s9 += carry[8]
|
||||
s8 -= carry[8] << 21
|
||||
carry[9] = s9 >> 21
|
||||
s10 += carry[9]
|
||||
s9 -= carry[9] << 21
|
||||
carry[10] = s10 >> 21
|
||||
s11 += carry[10]
|
||||
s10 -= carry[10] << 21
|
||||
|
||||
out[0] = byte(s0 >> 0)
|
||||
out[1] = byte(s0 >> 8)
|
||||
out[2] = byte((s0 >> 16) | (s1 << 5))
|
||||
out[3] = byte(s1 >> 3)
|
||||
out[4] = byte(s1 >> 11)
|
||||
out[5] = byte((s1 >> 19) | (s2 << 2))
|
||||
out[6] = byte(s2 >> 6)
|
||||
out[7] = byte((s2 >> 14) | (s3 << 7))
|
||||
out[8] = byte(s3 >> 1)
|
||||
out[9] = byte(s3 >> 9)
|
||||
out[10] = byte((s3 >> 17) | (s4 << 4))
|
||||
out[11] = byte(s4 >> 4)
|
||||
out[12] = byte(s4 >> 12)
|
||||
out[13] = byte((s4 >> 20) | (s5 << 1))
|
||||
out[14] = byte(s5 >> 7)
|
||||
out[15] = byte((s5 >> 15) | (s6 << 6))
|
||||
out[16] = byte(s6 >> 2)
|
||||
out[17] = byte(s6 >> 10)
|
||||
out[18] = byte((s6 >> 18) | (s7 << 3))
|
||||
out[19] = byte(s7 >> 5)
|
||||
out[20] = byte(s7 >> 13)
|
||||
out[21] = byte(s8 >> 0)
|
||||
out[22] = byte(s8 >> 8)
|
||||
out[23] = byte((s8 >> 16) | (s9 << 5))
|
||||
out[24] = byte(s9 >> 3)
|
||||
out[25] = byte(s9 >> 11)
|
||||
out[26] = byte((s9 >> 19) | (s10 << 2))
|
||||
out[27] = byte(s10 >> 6)
|
||||
out[28] = byte((s10 >> 14) | (s11 << 7))
|
||||
out[29] = byte(s11 >> 1)
|
||||
out[30] = byte(s11 >> 9)
|
||||
out[31] = byte(s11 >> 17)
|
||||
var diff fiatScalarMontgomeryDomainFieldElement
|
||||
fiatScalarSub(&diff, &s.s, &t.s)
|
||||
var nonzero uint64
|
||||
fiatScalarNonzero(&nonzero, (*[4]uint64)(&diff))
|
||||
nonzero |= nonzero >> 32
|
||||
nonzero |= nonzero >> 16
|
||||
nonzero |= nonzero >> 8
|
||||
nonzero |= nonzero >> 4
|
||||
nonzero |= nonzero >> 2
|
||||
nonzero |= nonzero >> 1
|
||||
return int(^nonzero) & 1
|
||||
}
|
||||
|
||||
// nonAdjacentForm computes a width-w non-adjacent form for this scalar.
|
||||
|
|
|
|||
|
|
@ -75,6 +75,9 @@ func TestScalarAliasing(t *testing.T) {
|
|||
"Negate": func(v, x Scalar) bool {
|
||||
return checkAliasingOneArg((*Scalar).Negate, v, x)
|
||||
},
|
||||
"Invert": func(v, x Scalar) bool {
|
||||
return checkAliasingOneArg((*Scalar).Invert, v, x)
|
||||
},
|
||||
"Multiply": func(v, x, y Scalar) bool {
|
||||
return checkAliasingTwoArgs((*Scalar).Multiply, v, x, y)
|
||||
},
|
||||
|
|
@ -84,6 +87,21 @@ func TestScalarAliasing(t *testing.T) {
|
|||
"Subtract": func(v, x, y Scalar) bool {
|
||||
return checkAliasingTwoArgs((*Scalar).Subtract, v, x, y)
|
||||
},
|
||||
"MultiplyAdd1": func(v, x, y, fixed Scalar) bool {
|
||||
return checkAliasingTwoArgs(func(v, x, y *Scalar) *Scalar {
|
||||
return v.MultiplyAdd(&fixed, x, y)
|
||||
}, v, x, y)
|
||||
},
|
||||
"MultiplyAdd2": func(v, x, y, fixed Scalar) bool {
|
||||
return checkAliasingTwoArgs(func(v, x, y *Scalar) *Scalar {
|
||||
return v.MultiplyAdd(x, &fixed, y)
|
||||
}, v, x, y)
|
||||
},
|
||||
"MultiplyAdd3": func(v, x, y, fixed Scalar) bool {
|
||||
return checkAliasingTwoArgs(func(v, x, y *Scalar) *Scalar {
|
||||
return v.MultiplyAdd(x, y, &fixed)
|
||||
}, v, x, y)
|
||||
},
|
||||
} {
|
||||
err := quick.Check(f, &quick.Config{MaxCountScale: 1 << 5})
|
||||
if err != nil {
|
||||
|
|
|
|||
1113
scalar_fiat.go
Normal file
1113
scalar_fiat.go
Normal file
|
|
@ -0,0 +1,1113 @@
|
|||
// Code generated by Fiat Cryptography. DO NOT EDIT.
|
||||
//
|
||||
// Autogenerated: word_by_word_montgomery --lang Go --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name edwards25519 Scalar 64 '2^252 + 27742317777372353535851937790883648493' mul add sub opp nonzero from_montgomery to_montgomery to_bytes from_bytes
|
||||
//
|
||||
// curve description: Scalar
|
||||
//
|
||||
// machine_wordsize = 64 (from "64")
|
||||
//
|
||||
// requested operations: mul, add, sub, opp, nonzero, from_montgomery, to_montgomery, to_bytes, from_bytes
|
||||
//
|
||||
// m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493")
|
||||
//
|
||||
//
|
||||
//
|
||||
// NOTE: In addition to the bounds specified above each function, all
|
||||
//
|
||||
// functions synthesized for this Montgomery arithmetic require the
|
||||
//
|
||||
// input to be strictly less than the prime modulus (m), and also
|
||||
//
|
||||
// require the input to be in the unique saturated representation.
|
||||
//
|
||||
// All functions also ensure that these two properties are true of
|
||||
//
|
||||
// return values.
|
||||
//
|
||||
//
|
||||
//
|
||||
// Computed values:
|
||||
//
|
||||
// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
|
||||
//
|
||||
// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
|
||||
//
|
||||
// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
|
||||
//
|
||||
// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
|
||||
|
||||
package edwards25519
|
||||
|
||||
import "math/bits"
|
||||
|
||||
type fiatScalarUint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
|
||||
type fiatScalarInt1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
|
||||
|
||||
// The type fiatScalarMontgomeryDomainFieldElement is a field element in the Montgomery domain.
|
||||
//
|
||||
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
type fiatScalarMontgomeryDomainFieldElement [4]uint64
|
||||
|
||||
// The type fiatScalarNonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain.
|
||||
//
|
||||
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
type fiatScalarNonMontgomeryDomainFieldElement [4]uint64
|
||||
|
||||
// fiatScalarCmovznzU64 is a single-word conditional move.
|
||||
//
|
||||
// Postconditions:
|
||||
// out1 = (if arg1 = 0 then arg2 else arg3)
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [0x0 ~> 0x1]
|
||||
// arg2: [0x0 ~> 0xffffffffffffffff]
|
||||
// arg3: [0x0 ~> 0xffffffffffffffff]
|
||||
// Output Bounds:
|
||||
// out1: [0x0 ~> 0xffffffffffffffff]
|
||||
func fiatScalarCmovznzU64(out1 *uint64, arg1 fiatScalarUint1, arg2 uint64, arg3 uint64) {
|
||||
x1 := (uint64(arg1) * 0xffffffffffffffff)
|
||||
x2 := ((x1 & arg3) | ((^x1) & arg2))
|
||||
*out1 = x2
|
||||
}
|
||||
|
||||
// fiatScalarMul multiplies two field elements in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// 0 ≤ eval arg2 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiatScalarMul(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement, arg2 *fiatScalarMontgomeryDomainFieldElement) {
|
||||
x1 := arg1[1]
|
||||
x2 := arg1[2]
|
||||
x3 := arg1[3]
|
||||
x4 := arg1[0]
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, arg2[3])
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x8, x7 = bits.Mul64(x4, arg2[2])
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x10, x9 = bits.Mul64(x4, arg2[1])
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x12, x11 = bits.Mul64(x4, arg2[0])
|
||||
var x13 uint64
|
||||
var x14 uint64
|
||||
x13, x14 = bits.Add64(x12, x9, uint64(0x0))
|
||||
var x15 uint64
|
||||
var x16 uint64
|
||||
x15, x16 = bits.Add64(x10, x7, uint64(fiatScalarUint1(x14)))
|
||||
var x17 uint64
|
||||
var x18 uint64
|
||||
x17, x18 = bits.Add64(x8, x5, uint64(fiatScalarUint1(x16)))
|
||||
x19 := (uint64(fiatScalarUint1(x18)) + x6)
|
||||
var x20 uint64
|
||||
_, x20 = bits.Mul64(x11, 0xd2b51da312547e1b)
|
||||
var x22 uint64
|
||||
var x23 uint64
|
||||
x23, x22 = bits.Mul64(x20, 0x1000000000000000)
|
||||
var x24 uint64
|
||||
var x25 uint64
|
||||
x25, x24 = bits.Mul64(x20, 0x14def9dea2f79cd6)
|
||||
var x26 uint64
|
||||
var x27 uint64
|
||||
x27, x26 = bits.Mul64(x20, 0x5812631a5cf5d3ed)
|
||||
var x28 uint64
|
||||
var x29 uint64
|
||||
x28, x29 = bits.Add64(x27, x24, uint64(0x0))
|
||||
x30 := (uint64(fiatScalarUint1(x29)) + x25)
|
||||
var x32 uint64
|
||||
_, x32 = bits.Add64(x11, x26, uint64(0x0))
|
||||
var x33 uint64
|
||||
var x34 uint64
|
||||
x33, x34 = bits.Add64(x13, x28, uint64(fiatScalarUint1(x32)))
|
||||
var x35 uint64
|
||||
var x36 uint64
|
||||
x35, x36 = bits.Add64(x15, x30, uint64(fiatScalarUint1(x34)))
|
||||
var x37 uint64
|
||||
var x38 uint64
|
||||
x37, x38 = bits.Add64(x17, x22, uint64(fiatScalarUint1(x36)))
|
||||
var x39 uint64
|
||||
var x40 uint64
|
||||
x39, x40 = bits.Add64(x19, x23, uint64(fiatScalarUint1(x38)))
|
||||
var x41 uint64
|
||||
var x42 uint64
|
||||
x42, x41 = bits.Mul64(x1, arg2[3])
|
||||
var x43 uint64
|
||||
var x44 uint64
|
||||
x44, x43 = bits.Mul64(x1, arg2[2])
|
||||
var x45 uint64
|
||||
var x46 uint64
|
||||
x46, x45 = bits.Mul64(x1, arg2[1])
|
||||
var x47 uint64
|
||||
var x48 uint64
|
||||
x48, x47 = bits.Mul64(x1, arg2[0])
|
||||
var x49 uint64
|
||||
var x50 uint64
|
||||
x49, x50 = bits.Add64(x48, x45, uint64(0x0))
|
||||
var x51 uint64
|
||||
var x52 uint64
|
||||
x51, x52 = bits.Add64(x46, x43, uint64(fiatScalarUint1(x50)))
|
||||
var x53 uint64
|
||||
var x54 uint64
|
||||
x53, x54 = bits.Add64(x44, x41, uint64(fiatScalarUint1(x52)))
|
||||
x55 := (uint64(fiatScalarUint1(x54)) + x42)
|
||||
var x56 uint64
|
||||
var x57 uint64
|
||||
x56, x57 = bits.Add64(x33, x47, uint64(0x0))
|
||||
var x58 uint64
|
||||
var x59 uint64
|
||||
x58, x59 = bits.Add64(x35, x49, uint64(fiatScalarUint1(x57)))
|
||||
var x60 uint64
|
||||
var x61 uint64
|
||||
x60, x61 = bits.Add64(x37, x51, uint64(fiatScalarUint1(x59)))
|
||||
var x62 uint64
|
||||
var x63 uint64
|
||||
x62, x63 = bits.Add64(x39, x53, uint64(fiatScalarUint1(x61)))
|
||||
var x64 uint64
|
||||
var x65 uint64
|
||||
x64, x65 = bits.Add64(uint64(fiatScalarUint1(x40)), x55, uint64(fiatScalarUint1(x63)))
|
||||
var x66 uint64
|
||||
_, x66 = bits.Mul64(x56, 0xd2b51da312547e1b)
|
||||
var x68 uint64
|
||||
var x69 uint64
|
||||
x69, x68 = bits.Mul64(x66, 0x1000000000000000)
|
||||
var x70 uint64
|
||||
var x71 uint64
|
||||
x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6)
|
||||
var x72 uint64
|
||||
var x73 uint64
|
||||
x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed)
|
||||
var x74 uint64
|
||||
var x75 uint64
|
||||
x74, x75 = bits.Add64(x73, x70, uint64(0x0))
|
||||
x76 := (uint64(fiatScalarUint1(x75)) + x71)
|
||||
var x78 uint64
|
||||
_, x78 = bits.Add64(x56, x72, uint64(0x0))
|
||||
var x79 uint64
|
||||
var x80 uint64
|
||||
x79, x80 = bits.Add64(x58, x74, uint64(fiatScalarUint1(x78)))
|
||||
var x81 uint64
|
||||
var x82 uint64
|
||||
x81, x82 = bits.Add64(x60, x76, uint64(fiatScalarUint1(x80)))
|
||||
var x83 uint64
|
||||
var x84 uint64
|
||||
x83, x84 = bits.Add64(x62, x68, uint64(fiatScalarUint1(x82)))
|
||||
var x85 uint64
|
||||
var x86 uint64
|
||||
x85, x86 = bits.Add64(x64, x69, uint64(fiatScalarUint1(x84)))
|
||||
x87 := (uint64(fiatScalarUint1(x86)) + uint64(fiatScalarUint1(x65)))
|
||||
var x88 uint64
|
||||
var x89 uint64
|
||||
x89, x88 = bits.Mul64(x2, arg2[3])
|
||||
var x90 uint64
|
||||
var x91 uint64
|
||||
x91, x90 = bits.Mul64(x2, arg2[2])
|
||||
var x92 uint64
|
||||
var x93 uint64
|
||||
x93, x92 = bits.Mul64(x2, arg2[1])
|
||||
var x94 uint64
|
||||
var x95 uint64
|
||||
x95, x94 = bits.Mul64(x2, arg2[0])
|
||||
var x96 uint64
|
||||
var x97 uint64
|
||||
x96, x97 = bits.Add64(x95, x92, uint64(0x0))
|
||||
var x98 uint64
|
||||
var x99 uint64
|
||||
x98, x99 = bits.Add64(x93, x90, uint64(fiatScalarUint1(x97)))
|
||||
var x100 uint64
|
||||
var x101 uint64
|
||||
x100, x101 = bits.Add64(x91, x88, uint64(fiatScalarUint1(x99)))
|
||||
x102 := (uint64(fiatScalarUint1(x101)) + x89)
|
||||
var x103 uint64
|
||||
var x104 uint64
|
||||
x103, x104 = bits.Add64(x79, x94, uint64(0x0))
|
||||
var x105 uint64
|
||||
var x106 uint64
|
||||
x105, x106 = bits.Add64(x81, x96, uint64(fiatScalarUint1(x104)))
|
||||
var x107 uint64
|
||||
var x108 uint64
|
||||
x107, x108 = bits.Add64(x83, x98, uint64(fiatScalarUint1(x106)))
|
||||
var x109 uint64
|
||||
var x110 uint64
|
||||
x109, x110 = bits.Add64(x85, x100, uint64(fiatScalarUint1(x108)))
|
||||
var x111 uint64
|
||||
var x112 uint64
|
||||
x111, x112 = bits.Add64(x87, x102, uint64(fiatScalarUint1(x110)))
|
||||
var x113 uint64
|
||||
_, x113 = bits.Mul64(x103, 0xd2b51da312547e1b)
|
||||
var x115 uint64
|
||||
var x116 uint64
|
||||
x116, x115 = bits.Mul64(x113, 0x1000000000000000)
|
||||
var x117 uint64
|
||||
var x118 uint64
|
||||
x118, x117 = bits.Mul64(x113, 0x14def9dea2f79cd6)
|
||||
var x119 uint64
|
||||
var x120 uint64
|
||||
x120, x119 = bits.Mul64(x113, 0x5812631a5cf5d3ed)
|
||||
var x121 uint64
|
||||
var x122 uint64
|
||||
x121, x122 = bits.Add64(x120, x117, uint64(0x0))
|
||||
x123 := (uint64(fiatScalarUint1(x122)) + x118)
|
||||
var x125 uint64
|
||||
_, x125 = bits.Add64(x103, x119, uint64(0x0))
|
||||
var x126 uint64
|
||||
var x127 uint64
|
||||
x126, x127 = bits.Add64(x105, x121, uint64(fiatScalarUint1(x125)))
|
||||
var x128 uint64
|
||||
var x129 uint64
|
||||
x128, x129 = bits.Add64(x107, x123, uint64(fiatScalarUint1(x127)))
|
||||
var x130 uint64
|
||||
var x131 uint64
|
||||
x130, x131 = bits.Add64(x109, x115, uint64(fiatScalarUint1(x129)))
|
||||
var x132 uint64
|
||||
var x133 uint64
|
||||
x132, x133 = bits.Add64(x111, x116, uint64(fiatScalarUint1(x131)))
|
||||
x134 := (uint64(fiatScalarUint1(x133)) + uint64(fiatScalarUint1(x112)))
|
||||
var x135 uint64
|
||||
var x136 uint64
|
||||
x136, x135 = bits.Mul64(x3, arg2[3])
|
||||
var x137 uint64
|
||||
var x138 uint64
|
||||
x138, x137 = bits.Mul64(x3, arg2[2])
|
||||
var x139 uint64
|
||||
var x140 uint64
|
||||
x140, x139 = bits.Mul64(x3, arg2[1])
|
||||
var x141 uint64
|
||||
var x142 uint64
|
||||
x142, x141 = bits.Mul64(x3, arg2[0])
|
||||
var x143 uint64
|
||||
var x144 uint64
|
||||
x143, x144 = bits.Add64(x142, x139, uint64(0x0))
|
||||
var x145 uint64
|
||||
var x146 uint64
|
||||
x145, x146 = bits.Add64(x140, x137, uint64(fiatScalarUint1(x144)))
|
||||
var x147 uint64
|
||||
var x148 uint64
|
||||
x147, x148 = bits.Add64(x138, x135, uint64(fiatScalarUint1(x146)))
|
||||
x149 := (uint64(fiatScalarUint1(x148)) + x136)
|
||||
var x150 uint64
|
||||
var x151 uint64
|
||||
x150, x151 = bits.Add64(x126, x141, uint64(0x0))
|
||||
var x152 uint64
|
||||
var x153 uint64
|
||||
x152, x153 = bits.Add64(x128, x143, uint64(fiatScalarUint1(x151)))
|
||||
var x154 uint64
|
||||
var x155 uint64
|
||||
x154, x155 = bits.Add64(x130, x145, uint64(fiatScalarUint1(x153)))
|
||||
var x156 uint64
|
||||
var x157 uint64
|
||||
x156, x157 = bits.Add64(x132, x147, uint64(fiatScalarUint1(x155)))
|
||||
var x158 uint64
|
||||
var x159 uint64
|
||||
x158, x159 = bits.Add64(x134, x149, uint64(fiatScalarUint1(x157)))
|
||||
var x160 uint64
|
||||
_, x160 = bits.Mul64(x150, 0xd2b51da312547e1b)
|
||||
var x162 uint64
|
||||
var x163 uint64
|
||||
x163, x162 = bits.Mul64(x160, 0x1000000000000000)
|
||||
var x164 uint64
|
||||
var x165 uint64
|
||||
x165, x164 = bits.Mul64(x160, 0x14def9dea2f79cd6)
|
||||
var x166 uint64
|
||||
var x167 uint64
|
||||
x167, x166 = bits.Mul64(x160, 0x5812631a5cf5d3ed)
|
||||
var x168 uint64
|
||||
var x169 uint64
|
||||
x168, x169 = bits.Add64(x167, x164, uint64(0x0))
|
||||
x170 := (uint64(fiatScalarUint1(x169)) + x165)
|
||||
var x172 uint64
|
||||
_, x172 = bits.Add64(x150, x166, uint64(0x0))
|
||||
var x173 uint64
|
||||
var x174 uint64
|
||||
x173, x174 = bits.Add64(x152, x168, uint64(fiatScalarUint1(x172)))
|
||||
var x175 uint64
|
||||
var x176 uint64
|
||||
x175, x176 = bits.Add64(x154, x170, uint64(fiatScalarUint1(x174)))
|
||||
var x177 uint64
|
||||
var x178 uint64
|
||||
x177, x178 = bits.Add64(x156, x162, uint64(fiatScalarUint1(x176)))
|
||||
var x179 uint64
|
||||
var x180 uint64
|
||||
x179, x180 = bits.Add64(x158, x163, uint64(fiatScalarUint1(x178)))
|
||||
x181 := (uint64(fiatScalarUint1(x180)) + uint64(fiatScalarUint1(x159)))
|
||||
var x182 uint64
|
||||
var x183 uint64
|
||||
x182, x183 = bits.Sub64(x173, 0x5812631a5cf5d3ed, uint64(0x0))
|
||||
var x184 uint64
|
||||
var x185 uint64
|
||||
x184, x185 = bits.Sub64(x175, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x183)))
|
||||
var x186 uint64
|
||||
var x187 uint64
|
||||
x186, x187 = bits.Sub64(x177, uint64(0x0), uint64(fiatScalarUint1(x185)))
|
||||
var x188 uint64
|
||||
var x189 uint64
|
||||
x188, x189 = bits.Sub64(x179, 0x1000000000000000, uint64(fiatScalarUint1(x187)))
|
||||
var x191 uint64
|
||||
_, x191 = bits.Sub64(x181, uint64(0x0), uint64(fiatScalarUint1(x189)))
|
||||
var x192 uint64
|
||||
fiatScalarCmovznzU64(&x192, fiatScalarUint1(x191), x182, x173)
|
||||
var x193 uint64
|
||||
fiatScalarCmovznzU64(&x193, fiatScalarUint1(x191), x184, x175)
|
||||
var x194 uint64
|
||||
fiatScalarCmovznzU64(&x194, fiatScalarUint1(x191), x186, x177)
|
||||
var x195 uint64
|
||||
fiatScalarCmovznzU64(&x195, fiatScalarUint1(x191), x188, x179)
|
||||
out1[0] = x192
|
||||
out1[1] = x193
|
||||
out1[2] = x194
|
||||
out1[3] = x195
|
||||
}
|
||||
|
||||
// fiatScalarAdd adds two field elements in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// 0 ≤ eval arg2 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiatScalarAdd(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement, arg2 *fiatScalarMontgomeryDomainFieldElement) {
|
||||
var x1 uint64
|
||||
var x2 uint64
|
||||
x1, x2 = bits.Add64(arg1[0], arg2[0], uint64(0x0))
|
||||
var x3 uint64
|
||||
var x4 uint64
|
||||
x3, x4 = bits.Add64(arg1[1], arg2[1], uint64(fiatScalarUint1(x2)))
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x5, x6 = bits.Add64(arg1[2], arg2[2], uint64(fiatScalarUint1(x4)))
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x7, x8 = bits.Add64(arg1[3], arg2[3], uint64(fiatScalarUint1(x6)))
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x9, x10 = bits.Sub64(x1, 0x5812631a5cf5d3ed, uint64(0x0))
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x11, x12 = bits.Sub64(x3, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x10)))
|
||||
var x13 uint64
|
||||
var x14 uint64
|
||||
x13, x14 = bits.Sub64(x5, uint64(0x0), uint64(fiatScalarUint1(x12)))
|
||||
var x15 uint64
|
||||
var x16 uint64
|
||||
x15, x16 = bits.Sub64(x7, 0x1000000000000000, uint64(fiatScalarUint1(x14)))
|
||||
var x18 uint64
|
||||
_, x18 = bits.Sub64(uint64(fiatScalarUint1(x8)), uint64(0x0), uint64(fiatScalarUint1(x16)))
|
||||
var x19 uint64
|
||||
fiatScalarCmovznzU64(&x19, fiatScalarUint1(x18), x9, x1)
|
||||
var x20 uint64
|
||||
fiatScalarCmovznzU64(&x20, fiatScalarUint1(x18), x11, x3)
|
||||
var x21 uint64
|
||||
fiatScalarCmovznzU64(&x21, fiatScalarUint1(x18), x13, x5)
|
||||
var x22 uint64
|
||||
fiatScalarCmovznzU64(&x22, fiatScalarUint1(x18), x15, x7)
|
||||
out1[0] = x19
|
||||
out1[1] = x20
|
||||
out1[2] = x21
|
||||
out1[3] = x22
|
||||
}
|
||||
|
||||
// fiatScalarSub subtracts two field elements in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// 0 ≤ eval arg2 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiatScalarSub(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement, arg2 *fiatScalarMontgomeryDomainFieldElement) {
|
||||
var x1 uint64
|
||||
var x2 uint64
|
||||
x1, x2 = bits.Sub64(arg1[0], arg2[0], uint64(0x0))
|
||||
var x3 uint64
|
||||
var x4 uint64
|
||||
x3, x4 = bits.Sub64(arg1[1], arg2[1], uint64(fiatScalarUint1(x2)))
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x5, x6 = bits.Sub64(arg1[2], arg2[2], uint64(fiatScalarUint1(x4)))
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x7, x8 = bits.Sub64(arg1[3], arg2[3], uint64(fiatScalarUint1(x6)))
|
||||
var x9 uint64
|
||||
fiatScalarCmovznzU64(&x9, fiatScalarUint1(x8), uint64(0x0), 0xffffffffffffffff)
|
||||
var x10 uint64
|
||||
var x11 uint64
|
||||
x10, x11 = bits.Add64(x1, (x9 & 0x5812631a5cf5d3ed), uint64(0x0))
|
||||
var x12 uint64
|
||||
var x13 uint64
|
||||
x12, x13 = bits.Add64(x3, (x9 & 0x14def9dea2f79cd6), uint64(fiatScalarUint1(x11)))
|
||||
var x14 uint64
|
||||
var x15 uint64
|
||||
x14, x15 = bits.Add64(x5, uint64(0x0), uint64(fiatScalarUint1(x13)))
|
||||
var x16 uint64
|
||||
x16, _ = bits.Add64(x7, (x9 & 0x1000000000000000), uint64(fiatScalarUint1(x15)))
|
||||
out1[0] = x10
|
||||
out1[1] = x12
|
||||
out1[2] = x14
|
||||
out1[3] = x16
|
||||
}
|
||||
|
||||
// fiatScalarOpp negates a field element in the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiatScalarOpp(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement) {
|
||||
var x1 uint64
|
||||
var x2 uint64
|
||||
x1, x2 = bits.Sub64(uint64(0x0), arg1[0], uint64(0x0))
|
||||
var x3 uint64
|
||||
var x4 uint64
|
||||
x3, x4 = bits.Sub64(uint64(0x0), arg1[1], uint64(fiatScalarUint1(x2)))
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x5, x6 = bits.Sub64(uint64(0x0), arg1[2], uint64(fiatScalarUint1(x4)))
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x7, x8 = bits.Sub64(uint64(0x0), arg1[3], uint64(fiatScalarUint1(x6)))
|
||||
var x9 uint64
|
||||
fiatScalarCmovznzU64(&x9, fiatScalarUint1(x8), uint64(0x0), 0xffffffffffffffff)
|
||||
var x10 uint64
|
||||
var x11 uint64
|
||||
x10, x11 = bits.Add64(x1, (x9 & 0x5812631a5cf5d3ed), uint64(0x0))
|
||||
var x12 uint64
|
||||
var x13 uint64
|
||||
x12, x13 = bits.Add64(x3, (x9 & 0x14def9dea2f79cd6), uint64(fiatScalarUint1(x11)))
|
||||
var x14 uint64
|
||||
var x15 uint64
|
||||
x14, x15 = bits.Add64(x5, uint64(0x0), uint64(fiatScalarUint1(x13)))
|
||||
var x16 uint64
|
||||
x16, _ = bits.Add64(x7, (x9 & 0x1000000000000000), uint64(fiatScalarUint1(x15)))
|
||||
out1[0] = x10
|
||||
out1[1] = x12
|
||||
out1[2] = x14
|
||||
out1[3] = x16
|
||||
}
|
||||
|
||||
// fiatScalarNonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
// Output Bounds:
|
||||
// out1: [0x0 ~> 0xffffffffffffffff]
|
||||
func fiatScalarNonzero(out1 *uint64, arg1 *[4]uint64) {
|
||||
x1 := (arg1[0] | (arg1[1] | (arg1[2] | arg1[3])))
|
||||
*out1 = x1
|
||||
}
|
||||
|
||||
// fiatScalarFromMontgomery translates a field element out of the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiatScalarFromMontgomery(out1 *fiatScalarNonMontgomeryDomainFieldElement, arg1 *fiatScalarMontgomeryDomainFieldElement) {
|
||||
x1 := arg1[0]
|
||||
var x2 uint64
|
||||
_, x2 = bits.Mul64(x1, 0xd2b51da312547e1b)
|
||||
var x4 uint64
|
||||
var x5 uint64
|
||||
x5, x4 = bits.Mul64(x2, 0x1000000000000000)
|
||||
var x6 uint64
|
||||
var x7 uint64
|
||||
x7, x6 = bits.Mul64(x2, 0x14def9dea2f79cd6)
|
||||
var x8 uint64
|
||||
var x9 uint64
|
||||
x9, x8 = bits.Mul64(x2, 0x5812631a5cf5d3ed)
|
||||
var x10 uint64
|
||||
var x11 uint64
|
||||
x10, x11 = bits.Add64(x9, x6, uint64(0x0))
|
||||
var x13 uint64
|
||||
_, x13 = bits.Add64(x1, x8, uint64(0x0))
|
||||
var x14 uint64
|
||||
var x15 uint64
|
||||
x14, x15 = bits.Add64(uint64(0x0), x10, uint64(fiatScalarUint1(x13)))
|
||||
var x16 uint64
|
||||
var x17 uint64
|
||||
x16, x17 = bits.Add64(x14, arg1[1], uint64(0x0))
|
||||
var x18 uint64
|
||||
_, x18 = bits.Mul64(x16, 0xd2b51da312547e1b)
|
||||
var x20 uint64
|
||||
var x21 uint64
|
||||
x21, x20 = bits.Mul64(x18, 0x1000000000000000)
|
||||
var x22 uint64
|
||||
var x23 uint64
|
||||
x23, x22 = bits.Mul64(x18, 0x14def9dea2f79cd6)
|
||||
var x24 uint64
|
||||
var x25 uint64
|
||||
x25, x24 = bits.Mul64(x18, 0x5812631a5cf5d3ed)
|
||||
var x26 uint64
|
||||
var x27 uint64
|
||||
x26, x27 = bits.Add64(x25, x22, uint64(0x0))
|
||||
var x29 uint64
|
||||
_, x29 = bits.Add64(x16, x24, uint64(0x0))
|
||||
var x30 uint64
|
||||
var x31 uint64
|
||||
x30, x31 = bits.Add64((uint64(fiatScalarUint1(x17)) + (uint64(fiatScalarUint1(x15)) + (uint64(fiatScalarUint1(x11)) + x7))), x26, uint64(fiatScalarUint1(x29)))
|
||||
var x32 uint64
|
||||
var x33 uint64
|
||||
x32, x33 = bits.Add64(x4, (uint64(fiatScalarUint1(x27)) + x23), uint64(fiatScalarUint1(x31)))
|
||||
var x34 uint64
|
||||
var x35 uint64
|
||||
x34, x35 = bits.Add64(x5, x20, uint64(fiatScalarUint1(x33)))
|
||||
var x36 uint64
|
||||
var x37 uint64
|
||||
x36, x37 = bits.Add64(x30, arg1[2], uint64(0x0))
|
||||
var x38 uint64
|
||||
var x39 uint64
|
||||
x38, x39 = bits.Add64(x32, uint64(0x0), uint64(fiatScalarUint1(x37)))
|
||||
var x40 uint64
|
||||
var x41 uint64
|
||||
x40, x41 = bits.Add64(x34, uint64(0x0), uint64(fiatScalarUint1(x39)))
|
||||
var x42 uint64
|
||||
_, x42 = bits.Mul64(x36, 0xd2b51da312547e1b)
|
||||
var x44 uint64
|
||||
var x45 uint64
|
||||
x45, x44 = bits.Mul64(x42, 0x1000000000000000)
|
||||
var x46 uint64
|
||||
var x47 uint64
|
||||
x47, x46 = bits.Mul64(x42, 0x14def9dea2f79cd6)
|
||||
var x48 uint64
|
||||
var x49 uint64
|
||||
x49, x48 = bits.Mul64(x42, 0x5812631a5cf5d3ed)
|
||||
var x50 uint64
|
||||
var x51 uint64
|
||||
x50, x51 = bits.Add64(x49, x46, uint64(0x0))
|
||||
var x53 uint64
|
||||
_, x53 = bits.Add64(x36, x48, uint64(0x0))
|
||||
var x54 uint64
|
||||
var x55 uint64
|
||||
x54, x55 = bits.Add64(x38, x50, uint64(fiatScalarUint1(x53)))
|
||||
var x56 uint64
|
||||
var x57 uint64
|
||||
x56, x57 = bits.Add64(x40, (uint64(fiatScalarUint1(x51)) + x47), uint64(fiatScalarUint1(x55)))
|
||||
var x58 uint64
|
||||
var x59 uint64
|
||||
x58, x59 = bits.Add64((uint64(fiatScalarUint1(x41)) + (uint64(fiatScalarUint1(x35)) + x21)), x44, uint64(fiatScalarUint1(x57)))
|
||||
var x60 uint64
|
||||
var x61 uint64
|
||||
x60, x61 = bits.Add64(x54, arg1[3], uint64(0x0))
|
||||
var x62 uint64
|
||||
var x63 uint64
|
||||
x62, x63 = bits.Add64(x56, uint64(0x0), uint64(fiatScalarUint1(x61)))
|
||||
var x64 uint64
|
||||
var x65 uint64
|
||||
x64, x65 = bits.Add64(x58, uint64(0x0), uint64(fiatScalarUint1(x63)))
|
||||
var x66 uint64
|
||||
_, x66 = bits.Mul64(x60, 0xd2b51da312547e1b)
|
||||
var x68 uint64
|
||||
var x69 uint64
|
||||
x69, x68 = bits.Mul64(x66, 0x1000000000000000)
|
||||
var x70 uint64
|
||||
var x71 uint64
|
||||
x71, x70 = bits.Mul64(x66, 0x14def9dea2f79cd6)
|
||||
var x72 uint64
|
||||
var x73 uint64
|
||||
x73, x72 = bits.Mul64(x66, 0x5812631a5cf5d3ed)
|
||||
var x74 uint64
|
||||
var x75 uint64
|
||||
x74, x75 = bits.Add64(x73, x70, uint64(0x0))
|
||||
var x77 uint64
|
||||
_, x77 = bits.Add64(x60, x72, uint64(0x0))
|
||||
var x78 uint64
|
||||
var x79 uint64
|
||||
x78, x79 = bits.Add64(x62, x74, uint64(fiatScalarUint1(x77)))
|
||||
var x80 uint64
|
||||
var x81 uint64
|
||||
x80, x81 = bits.Add64(x64, (uint64(fiatScalarUint1(x75)) + x71), uint64(fiatScalarUint1(x79)))
|
||||
var x82 uint64
|
||||
var x83 uint64
|
||||
x82, x83 = bits.Add64((uint64(fiatScalarUint1(x65)) + (uint64(fiatScalarUint1(x59)) + x45)), x68, uint64(fiatScalarUint1(x81)))
|
||||
x84 := (uint64(fiatScalarUint1(x83)) + x69)
|
||||
var x85 uint64
|
||||
var x86 uint64
|
||||
x85, x86 = bits.Sub64(x78, 0x5812631a5cf5d3ed, uint64(0x0))
|
||||
var x87 uint64
|
||||
var x88 uint64
|
||||
x87, x88 = bits.Sub64(x80, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x86)))
|
||||
var x89 uint64
|
||||
var x90 uint64
|
||||
x89, x90 = bits.Sub64(x82, uint64(0x0), uint64(fiatScalarUint1(x88)))
|
||||
var x91 uint64
|
||||
var x92 uint64
|
||||
x91, x92 = bits.Sub64(x84, 0x1000000000000000, uint64(fiatScalarUint1(x90)))
|
||||
var x94 uint64
|
||||
_, x94 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(fiatScalarUint1(x92)))
|
||||
var x95 uint64
|
||||
fiatScalarCmovznzU64(&x95, fiatScalarUint1(x94), x85, x78)
|
||||
var x96 uint64
|
||||
fiatScalarCmovznzU64(&x96, fiatScalarUint1(x94), x87, x80)
|
||||
var x97 uint64
|
||||
fiatScalarCmovznzU64(&x97, fiatScalarUint1(x94), x89, x82)
|
||||
var x98 uint64
|
||||
fiatScalarCmovznzU64(&x98, fiatScalarUint1(x94), x91, x84)
|
||||
out1[0] = x95
|
||||
out1[1] = x96
|
||||
out1[2] = x97
|
||||
out1[3] = x98
|
||||
}
|
||||
|
||||
// fiatScalarToMontgomery translates a field element into the Montgomery domain.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval (from_montgomery out1) mod m = eval arg1 mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
func fiatScalarToMontgomery(out1 *fiatScalarMontgomeryDomainFieldElement, arg1 *fiatScalarNonMontgomeryDomainFieldElement) {
|
||||
x1 := arg1[1]
|
||||
x2 := arg1[2]
|
||||
x3 := arg1[3]
|
||||
x4 := arg1[0]
|
||||
var x5 uint64
|
||||
var x6 uint64
|
||||
x6, x5 = bits.Mul64(x4, 0x399411b7c309a3d)
|
||||
var x7 uint64
|
||||
var x8 uint64
|
||||
x8, x7 = bits.Mul64(x4, 0xceec73d217f5be65)
|
||||
var x9 uint64
|
||||
var x10 uint64
|
||||
x10, x9 = bits.Mul64(x4, 0xd00e1ba768859347)
|
||||
var x11 uint64
|
||||
var x12 uint64
|
||||
x12, x11 = bits.Mul64(x4, 0xa40611e3449c0f01)
|
||||
var x13 uint64
|
||||
var x14 uint64
|
||||
x13, x14 = bits.Add64(x12, x9, uint64(0x0))
|
||||
var x15 uint64
|
||||
var x16 uint64
|
||||
x15, x16 = bits.Add64(x10, x7, uint64(fiatScalarUint1(x14)))
|
||||
var x17 uint64
|
||||
var x18 uint64
|
||||
x17, x18 = bits.Add64(x8, x5, uint64(fiatScalarUint1(x16)))
|
||||
var x19 uint64
|
||||
_, x19 = bits.Mul64(x11, 0xd2b51da312547e1b)
|
||||
var x21 uint64
|
||||
var x22 uint64
|
||||
x22, x21 = bits.Mul64(x19, 0x1000000000000000)
|
||||
var x23 uint64
|
||||
var x24 uint64
|
||||
x24, x23 = bits.Mul64(x19, 0x14def9dea2f79cd6)
|
||||
var x25 uint64
|
||||
var x26 uint64
|
||||
x26, x25 = bits.Mul64(x19, 0x5812631a5cf5d3ed)
|
||||
var x27 uint64
|
||||
var x28 uint64
|
||||
x27, x28 = bits.Add64(x26, x23, uint64(0x0))
|
||||
var x30 uint64
|
||||
_, x30 = bits.Add64(x11, x25, uint64(0x0))
|
||||
var x31 uint64
|
||||
var x32 uint64
|
||||
x31, x32 = bits.Add64(x13, x27, uint64(fiatScalarUint1(x30)))
|
||||
var x33 uint64
|
||||
var x34 uint64
|
||||
x33, x34 = bits.Add64(x15, (uint64(fiatScalarUint1(x28)) + x24), uint64(fiatScalarUint1(x32)))
|
||||
var x35 uint64
|
||||
var x36 uint64
|
||||
x35, x36 = bits.Add64(x17, x21, uint64(fiatScalarUint1(x34)))
|
||||
var x37 uint64
|
||||
var x38 uint64
|
||||
x38, x37 = bits.Mul64(x1, 0x399411b7c309a3d)
|
||||
var x39 uint64
|
||||
var x40 uint64
|
||||
x40, x39 = bits.Mul64(x1, 0xceec73d217f5be65)
|
||||
var x41 uint64
|
||||
var x42 uint64
|
||||
x42, x41 = bits.Mul64(x1, 0xd00e1ba768859347)
|
||||
var x43 uint64
|
||||
var x44 uint64
|
||||
x44, x43 = bits.Mul64(x1, 0xa40611e3449c0f01)
|
||||
var x45 uint64
|
||||
var x46 uint64
|
||||
x45, x46 = bits.Add64(x44, x41, uint64(0x0))
|
||||
var x47 uint64
|
||||
var x48 uint64
|
||||
x47, x48 = bits.Add64(x42, x39, uint64(fiatScalarUint1(x46)))
|
||||
var x49 uint64
|
||||
var x50 uint64
|
||||
x49, x50 = bits.Add64(x40, x37, uint64(fiatScalarUint1(x48)))
|
||||
var x51 uint64
|
||||
var x52 uint64
|
||||
x51, x52 = bits.Add64(x31, x43, uint64(0x0))
|
||||
var x53 uint64
|
||||
var x54 uint64
|
||||
x53, x54 = bits.Add64(x33, x45, uint64(fiatScalarUint1(x52)))
|
||||
var x55 uint64
|
||||
var x56 uint64
|
||||
x55, x56 = bits.Add64(x35, x47, uint64(fiatScalarUint1(x54)))
|
||||
var x57 uint64
|
||||
var x58 uint64
|
||||
x57, x58 = bits.Add64(((uint64(fiatScalarUint1(x36)) + (uint64(fiatScalarUint1(x18)) + x6)) + x22), x49, uint64(fiatScalarUint1(x56)))
|
||||
var x59 uint64
|
||||
_, x59 = bits.Mul64(x51, 0xd2b51da312547e1b)
|
||||
var x61 uint64
|
||||
var x62 uint64
|
||||
x62, x61 = bits.Mul64(x59, 0x1000000000000000)
|
||||
var x63 uint64
|
||||
var x64 uint64
|
||||
x64, x63 = bits.Mul64(x59, 0x14def9dea2f79cd6)
|
||||
var x65 uint64
|
||||
var x66 uint64
|
||||
x66, x65 = bits.Mul64(x59, 0x5812631a5cf5d3ed)
|
||||
var x67 uint64
|
||||
var x68 uint64
|
||||
x67, x68 = bits.Add64(x66, x63, uint64(0x0))
|
||||
var x70 uint64
|
||||
_, x70 = bits.Add64(x51, x65, uint64(0x0))
|
||||
var x71 uint64
|
||||
var x72 uint64
|
||||
x71, x72 = bits.Add64(x53, x67, uint64(fiatScalarUint1(x70)))
|
||||
var x73 uint64
|
||||
var x74 uint64
|
||||
x73, x74 = bits.Add64(x55, (uint64(fiatScalarUint1(x68)) + x64), uint64(fiatScalarUint1(x72)))
|
||||
var x75 uint64
|
||||
var x76 uint64
|
||||
x75, x76 = bits.Add64(x57, x61, uint64(fiatScalarUint1(x74)))
|
||||
var x77 uint64
|
||||
var x78 uint64
|
||||
x78, x77 = bits.Mul64(x2, 0x399411b7c309a3d)
|
||||
var x79 uint64
|
||||
var x80 uint64
|
||||
x80, x79 = bits.Mul64(x2, 0xceec73d217f5be65)
|
||||
var x81 uint64
|
||||
var x82 uint64
|
||||
x82, x81 = bits.Mul64(x2, 0xd00e1ba768859347)
|
||||
var x83 uint64
|
||||
var x84 uint64
|
||||
x84, x83 = bits.Mul64(x2, 0xa40611e3449c0f01)
|
||||
var x85 uint64
|
||||
var x86 uint64
|
||||
x85, x86 = bits.Add64(x84, x81, uint64(0x0))
|
||||
var x87 uint64
|
||||
var x88 uint64
|
||||
x87, x88 = bits.Add64(x82, x79, uint64(fiatScalarUint1(x86)))
|
||||
var x89 uint64
|
||||
var x90 uint64
|
||||
x89, x90 = bits.Add64(x80, x77, uint64(fiatScalarUint1(x88)))
|
||||
var x91 uint64
|
||||
var x92 uint64
|
||||
x91, x92 = bits.Add64(x71, x83, uint64(0x0))
|
||||
var x93 uint64
|
||||
var x94 uint64
|
||||
x93, x94 = bits.Add64(x73, x85, uint64(fiatScalarUint1(x92)))
|
||||
var x95 uint64
|
||||
var x96 uint64
|
||||
x95, x96 = bits.Add64(x75, x87, uint64(fiatScalarUint1(x94)))
|
||||
var x97 uint64
|
||||
var x98 uint64
|
||||
x97, x98 = bits.Add64(((uint64(fiatScalarUint1(x76)) + (uint64(fiatScalarUint1(x58)) + (uint64(fiatScalarUint1(x50)) + x38))) + x62), x89, uint64(fiatScalarUint1(x96)))
|
||||
var x99 uint64
|
||||
_, x99 = bits.Mul64(x91, 0xd2b51da312547e1b)
|
||||
var x101 uint64
|
||||
var x102 uint64
|
||||
x102, x101 = bits.Mul64(x99, 0x1000000000000000)
|
||||
var x103 uint64
|
||||
var x104 uint64
|
||||
x104, x103 = bits.Mul64(x99, 0x14def9dea2f79cd6)
|
||||
var x105 uint64
|
||||
var x106 uint64
|
||||
x106, x105 = bits.Mul64(x99, 0x5812631a5cf5d3ed)
|
||||
var x107 uint64
|
||||
var x108 uint64
|
||||
x107, x108 = bits.Add64(x106, x103, uint64(0x0))
|
||||
var x110 uint64
|
||||
_, x110 = bits.Add64(x91, x105, uint64(0x0))
|
||||
var x111 uint64
|
||||
var x112 uint64
|
||||
x111, x112 = bits.Add64(x93, x107, uint64(fiatScalarUint1(x110)))
|
||||
var x113 uint64
|
||||
var x114 uint64
|
||||
x113, x114 = bits.Add64(x95, (uint64(fiatScalarUint1(x108)) + x104), uint64(fiatScalarUint1(x112)))
|
||||
var x115 uint64
|
||||
var x116 uint64
|
||||
x115, x116 = bits.Add64(x97, x101, uint64(fiatScalarUint1(x114)))
|
||||
var x117 uint64
|
||||
var x118 uint64
|
||||
x118, x117 = bits.Mul64(x3, 0x399411b7c309a3d)
|
||||
var x119 uint64
|
||||
var x120 uint64
|
||||
x120, x119 = bits.Mul64(x3, 0xceec73d217f5be65)
|
||||
var x121 uint64
|
||||
var x122 uint64
|
||||
x122, x121 = bits.Mul64(x3, 0xd00e1ba768859347)
|
||||
var x123 uint64
|
||||
var x124 uint64
|
||||
x124, x123 = bits.Mul64(x3, 0xa40611e3449c0f01)
|
||||
var x125 uint64
|
||||
var x126 uint64
|
||||
x125, x126 = bits.Add64(x124, x121, uint64(0x0))
|
||||
var x127 uint64
|
||||
var x128 uint64
|
||||
x127, x128 = bits.Add64(x122, x119, uint64(fiatScalarUint1(x126)))
|
||||
var x129 uint64
|
||||
var x130 uint64
|
||||
x129, x130 = bits.Add64(x120, x117, uint64(fiatScalarUint1(x128)))
|
||||
var x131 uint64
|
||||
var x132 uint64
|
||||
x131, x132 = bits.Add64(x111, x123, uint64(0x0))
|
||||
var x133 uint64
|
||||
var x134 uint64
|
||||
x133, x134 = bits.Add64(x113, x125, uint64(fiatScalarUint1(x132)))
|
||||
var x135 uint64
|
||||
var x136 uint64
|
||||
x135, x136 = bits.Add64(x115, x127, uint64(fiatScalarUint1(x134)))
|
||||
var x137 uint64
|
||||
var x138 uint64
|
||||
x137, x138 = bits.Add64(((uint64(fiatScalarUint1(x116)) + (uint64(fiatScalarUint1(x98)) + (uint64(fiatScalarUint1(x90)) + x78))) + x102), x129, uint64(fiatScalarUint1(x136)))
|
||||
var x139 uint64
|
||||
_, x139 = bits.Mul64(x131, 0xd2b51da312547e1b)
|
||||
var x141 uint64
|
||||
var x142 uint64
|
||||
x142, x141 = bits.Mul64(x139, 0x1000000000000000)
|
||||
var x143 uint64
|
||||
var x144 uint64
|
||||
x144, x143 = bits.Mul64(x139, 0x14def9dea2f79cd6)
|
||||
var x145 uint64
|
||||
var x146 uint64
|
||||
x146, x145 = bits.Mul64(x139, 0x5812631a5cf5d3ed)
|
||||
var x147 uint64
|
||||
var x148 uint64
|
||||
x147, x148 = bits.Add64(x146, x143, uint64(0x0))
|
||||
var x150 uint64
|
||||
_, x150 = bits.Add64(x131, x145, uint64(0x0))
|
||||
var x151 uint64
|
||||
var x152 uint64
|
||||
x151, x152 = bits.Add64(x133, x147, uint64(fiatScalarUint1(x150)))
|
||||
var x153 uint64
|
||||
var x154 uint64
|
||||
x153, x154 = bits.Add64(x135, (uint64(fiatScalarUint1(x148)) + x144), uint64(fiatScalarUint1(x152)))
|
||||
var x155 uint64
|
||||
var x156 uint64
|
||||
x155, x156 = bits.Add64(x137, x141, uint64(fiatScalarUint1(x154)))
|
||||
x157 := ((uint64(fiatScalarUint1(x156)) + (uint64(fiatScalarUint1(x138)) + (uint64(fiatScalarUint1(x130)) + x118))) + x142)
|
||||
var x158 uint64
|
||||
var x159 uint64
|
||||
x158, x159 = bits.Sub64(x151, 0x5812631a5cf5d3ed, uint64(0x0))
|
||||
var x160 uint64
|
||||
var x161 uint64
|
||||
x160, x161 = bits.Sub64(x153, 0x14def9dea2f79cd6, uint64(fiatScalarUint1(x159)))
|
||||
var x162 uint64
|
||||
var x163 uint64
|
||||
x162, x163 = bits.Sub64(x155, uint64(0x0), uint64(fiatScalarUint1(x161)))
|
||||
var x164 uint64
|
||||
var x165 uint64
|
||||
x164, x165 = bits.Sub64(x157, 0x1000000000000000, uint64(fiatScalarUint1(x163)))
|
||||
var x167 uint64
|
||||
_, x167 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(fiatScalarUint1(x165)))
|
||||
var x168 uint64
|
||||
fiatScalarCmovznzU64(&x168, fiatScalarUint1(x167), x158, x151)
|
||||
var x169 uint64
|
||||
fiatScalarCmovznzU64(&x169, fiatScalarUint1(x167), x160, x153)
|
||||
var x170 uint64
|
||||
fiatScalarCmovznzU64(&x170, fiatScalarUint1(x167), x162, x155)
|
||||
var x171 uint64
|
||||
fiatScalarCmovznzU64(&x171, fiatScalarUint1(x167), x164, x157)
|
||||
out1[0] = x168
|
||||
out1[1] = x169
|
||||
out1[2] = x170
|
||||
out1[3] = x171
|
||||
}
|
||||
|
||||
// fiatScalarToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ eval arg1 < m
|
||||
// Postconditions:
|
||||
// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
// Output Bounds:
|
||||
// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
func fiatScalarToBytes(out1 *[32]uint8, arg1 *[4]uint64) {
|
||||
x1 := arg1[3]
|
||||
x2 := arg1[2]
|
||||
x3 := arg1[1]
|
||||
x4 := arg1[0]
|
||||
x5 := (uint8(x4) & 0xff)
|
||||
x6 := (x4 >> 8)
|
||||
x7 := (uint8(x6) & 0xff)
|
||||
x8 := (x6 >> 8)
|
||||
x9 := (uint8(x8) & 0xff)
|
||||
x10 := (x8 >> 8)
|
||||
x11 := (uint8(x10) & 0xff)
|
||||
x12 := (x10 >> 8)
|
||||
x13 := (uint8(x12) & 0xff)
|
||||
x14 := (x12 >> 8)
|
||||
x15 := (uint8(x14) & 0xff)
|
||||
x16 := (x14 >> 8)
|
||||
x17 := (uint8(x16) & 0xff)
|
||||
x18 := uint8((x16 >> 8))
|
||||
x19 := (uint8(x3) & 0xff)
|
||||
x20 := (x3 >> 8)
|
||||
x21 := (uint8(x20) & 0xff)
|
||||
x22 := (x20 >> 8)
|
||||
x23 := (uint8(x22) & 0xff)
|
||||
x24 := (x22 >> 8)
|
||||
x25 := (uint8(x24) & 0xff)
|
||||
x26 := (x24 >> 8)
|
||||
x27 := (uint8(x26) & 0xff)
|
||||
x28 := (x26 >> 8)
|
||||
x29 := (uint8(x28) & 0xff)
|
||||
x30 := (x28 >> 8)
|
||||
x31 := (uint8(x30) & 0xff)
|
||||
x32 := uint8((x30 >> 8))
|
||||
x33 := (uint8(x2) & 0xff)
|
||||
x34 := (x2 >> 8)
|
||||
x35 := (uint8(x34) & 0xff)
|
||||
x36 := (x34 >> 8)
|
||||
x37 := (uint8(x36) & 0xff)
|
||||
x38 := (x36 >> 8)
|
||||
x39 := (uint8(x38) & 0xff)
|
||||
x40 := (x38 >> 8)
|
||||
x41 := (uint8(x40) & 0xff)
|
||||
x42 := (x40 >> 8)
|
||||
x43 := (uint8(x42) & 0xff)
|
||||
x44 := (x42 >> 8)
|
||||
x45 := (uint8(x44) & 0xff)
|
||||
x46 := uint8((x44 >> 8))
|
||||
x47 := (uint8(x1) & 0xff)
|
||||
x48 := (x1 >> 8)
|
||||
x49 := (uint8(x48) & 0xff)
|
||||
x50 := (x48 >> 8)
|
||||
x51 := (uint8(x50) & 0xff)
|
||||
x52 := (x50 >> 8)
|
||||
x53 := (uint8(x52) & 0xff)
|
||||
x54 := (x52 >> 8)
|
||||
x55 := (uint8(x54) & 0xff)
|
||||
x56 := (x54 >> 8)
|
||||
x57 := (uint8(x56) & 0xff)
|
||||
x58 := (x56 >> 8)
|
||||
x59 := (uint8(x58) & 0xff)
|
||||
x60 := uint8((x58 >> 8))
|
||||
out1[0] = x5
|
||||
out1[1] = x7
|
||||
out1[2] = x9
|
||||
out1[3] = x11
|
||||
out1[4] = x13
|
||||
out1[5] = x15
|
||||
out1[6] = x17
|
||||
out1[7] = x18
|
||||
out1[8] = x19
|
||||
out1[9] = x21
|
||||
out1[10] = x23
|
||||
out1[11] = x25
|
||||
out1[12] = x27
|
||||
out1[13] = x29
|
||||
out1[14] = x31
|
||||
out1[15] = x32
|
||||
out1[16] = x33
|
||||
out1[17] = x35
|
||||
out1[18] = x37
|
||||
out1[19] = x39
|
||||
out1[20] = x41
|
||||
out1[21] = x43
|
||||
out1[22] = x45
|
||||
out1[23] = x46
|
||||
out1[24] = x47
|
||||
out1[25] = x49
|
||||
out1[26] = x51
|
||||
out1[27] = x53
|
||||
out1[28] = x55
|
||||
out1[29] = x57
|
||||
out1[30] = x59
|
||||
out1[31] = x60
|
||||
}
|
||||
|
||||
// fiatScalarFromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
|
||||
//
|
||||
// Preconditions:
|
||||
// 0 ≤ bytes_eval arg1 < m
|
||||
// Postconditions:
|
||||
// eval out1 mod m = bytes_eval arg1 mod m
|
||||
// 0 ≤ eval out1 < m
|
||||
//
|
||||
// Input Bounds:
|
||||
// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
|
||||
// Output Bounds:
|
||||
// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
|
||||
func fiatScalarFromBytes(out1 *[4]uint64, arg1 *[32]uint8) {
|
||||
x1 := (uint64(arg1[31]) << 56)
|
||||
x2 := (uint64(arg1[30]) << 48)
|
||||
x3 := (uint64(arg1[29]) << 40)
|
||||
x4 := (uint64(arg1[28]) << 32)
|
||||
x5 := (uint64(arg1[27]) << 24)
|
||||
x6 := (uint64(arg1[26]) << 16)
|
||||
x7 := (uint64(arg1[25]) << 8)
|
||||
x8 := arg1[24]
|
||||
x9 := (uint64(arg1[23]) << 56)
|
||||
x10 := (uint64(arg1[22]) << 48)
|
||||
x11 := (uint64(arg1[21]) << 40)
|
||||
x12 := (uint64(arg1[20]) << 32)
|
||||
x13 := (uint64(arg1[19]) << 24)
|
||||
x14 := (uint64(arg1[18]) << 16)
|
||||
x15 := (uint64(arg1[17]) << 8)
|
||||
x16 := arg1[16]
|
||||
x17 := (uint64(arg1[15]) << 56)
|
||||
x18 := (uint64(arg1[14]) << 48)
|
||||
x19 := (uint64(arg1[13]) << 40)
|
||||
x20 := (uint64(arg1[12]) << 32)
|
||||
x21 := (uint64(arg1[11]) << 24)
|
||||
x22 := (uint64(arg1[10]) << 16)
|
||||
x23 := (uint64(arg1[9]) << 8)
|
||||
x24 := arg1[8]
|
||||
x25 := (uint64(arg1[7]) << 56)
|
||||
x26 := (uint64(arg1[6]) << 48)
|
||||
x27 := (uint64(arg1[5]) << 40)
|
||||
x28 := (uint64(arg1[4]) << 32)
|
||||
x29 := (uint64(arg1[3]) << 24)
|
||||
x30 := (uint64(arg1[2]) << 16)
|
||||
x31 := (uint64(arg1[1]) << 8)
|
||||
x32 := arg1[0]
|
||||
x33 := (x31 + uint64(x32))
|
||||
x34 := (x30 + x33)
|
||||
x35 := (x29 + x34)
|
||||
x36 := (x28 + x35)
|
||||
x37 := (x27 + x36)
|
||||
x38 := (x26 + x37)
|
||||
x39 := (x25 + x38)
|
||||
x40 := (x23 + uint64(x24))
|
||||
x41 := (x22 + x40)
|
||||
x42 := (x21 + x41)
|
||||
x43 := (x20 + x42)
|
||||
x44 := (x19 + x43)
|
||||
x45 := (x18 + x44)
|
||||
x46 := (x17 + x45)
|
||||
x47 := (x15 + uint64(x16))
|
||||
x48 := (x14 + x47)
|
||||
x49 := (x13 + x48)
|
||||
x50 := (x12 + x49)
|
||||
x51 := (x11 + x50)
|
||||
x52 := (x10 + x51)
|
||||
x53 := (x9 + x52)
|
||||
x54 := (x7 + uint64(x8))
|
||||
x55 := (x6 + x54)
|
||||
x56 := (x5 + x55)
|
||||
x57 := (x4 + x56)
|
||||
x58 := (x3 + x57)
|
||||
x59 := (x2 + x58)
|
||||
x60 := (x1 + x59)
|
||||
out1[0] = x39
|
||||
out1[1] = x46
|
||||
out1[2] = x53
|
||||
out1[3] = x60
|
||||
}
|
||||
|
|
@ -14,17 +14,21 @@ import (
|
|||
"testing/quick"
|
||||
)
|
||||
|
||||
var scOneBytes = [32]byte{1}
|
||||
var scOne, _ = new(Scalar).SetCanonicalBytes(scOneBytes[:])
|
||||
var scMinusOne, _ = new(Scalar).SetCanonicalBytes(scalarMinusOneBytes[:])
|
||||
|
||||
// Generate returns a valid (reduced modulo l) Scalar with a distribution
|
||||
// weighted towards high, low, and edge values.
|
||||
func (Scalar) Generate(rand *mathrand.Rand, size int) reflect.Value {
|
||||
s := scZeroBytes
|
||||
var s [32]byte
|
||||
diceRoll := rand.Intn(100)
|
||||
switch {
|
||||
case diceRoll == 0:
|
||||
case diceRoll == 1:
|
||||
s = scOneBytes
|
||||
case diceRoll == 2:
|
||||
s = scMinusOneBytes
|
||||
s = scalarMinusOneBytes
|
||||
case diceRoll < 5:
|
||||
// Generate a low scalar in [0, 2^125).
|
||||
rand.Read(s[:16])
|
||||
|
|
@ -43,8 +47,8 @@ func (Scalar) Generate(rand *mathrand.Rand, size int) reflect.Value {
|
|||
}
|
||||
|
||||
val := Scalar{}
|
||||
fiat_sc255_from_bytes(&val.s, &s)
|
||||
fiat_sc255_to_montgomery(&val.s, &val.s)
|
||||
fiatScalarFromBytes((*[4]uint64)(&val.s), &s)
|
||||
fiatScalarToMontgomery(&val.s, (*fiatScalarNonMontgomeryDomainFieldElement)(&val.s))
|
||||
|
||||
return reflect.ValueOf(val)
|
||||
}
|
||||
|
|
@ -86,7 +90,7 @@ func TestScalarSetCanonicalBytes(t *testing.T) {
|
|||
t.Errorf("failed scalar->bytes->scalar round-trip: %v", err)
|
||||
}
|
||||
|
||||
b := scMinusOneBytes
|
||||
b := scalarMinusOneBytes
|
||||
b[31] += 1
|
||||
s := scOne
|
||||
if out, err := s.SetCanonicalBytes(b[:]); err == nil {
|
||||
|
|
@ -228,17 +232,18 @@ type notZeroScalar Scalar
|
|||
func (notZeroScalar) Generate(rand *mathrand.Rand, size int) reflect.Value {
|
||||
var s Scalar
|
||||
var isNonZero uint64
|
||||
for fiat_sc255_nonzero(&isNonZero, (*[4]uint64)(&s.s)); isNonZero == 0; {
|
||||
for isNonZero == 0 {
|
||||
s = Scalar{}.Generate(rand, size).Interface().(Scalar)
|
||||
fiatScalarNonzero(&isNonZero, (*[4]uint64)(&s.s))
|
||||
}
|
||||
return reflect.ValueOf(notZeroScalar(s))
|
||||
}
|
||||
|
||||
func TestScalarEqual(t *testing.T) {
|
||||
if scOne.Equal(&scMinusOne) == 1 {
|
||||
if scOne.Equal(scMinusOne) == 1 {
|
||||
t.Errorf("scOne.Equal(&scMinusOne) is true")
|
||||
}
|
||||
if scMinusOne.Equal(&scMinusOne) == 0 {
|
||||
if scMinusOne.Equal(scMinusOne) == 0 {
|
||||
t.Errorf("scMinusOne.Equal(&scMinusOne) is false")
|
||||
}
|
||||
}
|
||||
|
|
|
|||
81
unsafe.go
Normal file
81
unsafe.go
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
package edwards25519
|
||||
|
||||
// UnsafeVarTimeScalarMult sets v = x * q, and returns v., and returns v. Execution time depends on the inputs.
|
||||
// Deprecated: Unsafe for private operations
|
||||
func (v *Point) UnsafeVarTimeScalarMult(x *Scalar, q *Point) *Point {
|
||||
checkInitialized(q)
|
||||
|
||||
// Build lookup table for point q
|
||||
var table nafLookupTable5
|
||||
table.FromP3(q)
|
||||
// Compute a NAF for scalar x
|
||||
naf := x.nonAdjacentForm(5)
|
||||
|
||||
multiple := &projCached{}
|
||||
tmp1 := &projP1xP1{}
|
||||
tmp2 := &projP2{}
|
||||
tmp2.Zero()
|
||||
|
||||
// Move from high to low bits, doubling the accumulator
|
||||
// at each iteration and checking whether there is a nonzero
|
||||
// coefficient to look up a multiple of.
|
||||
//
|
||||
// Skip trying to find the first nonzero coefficent, because
|
||||
// searching might be more work than a few extra doublings.
|
||||
for i := 255; i >= 0; i-- {
|
||||
tmp1.Double(tmp2)
|
||||
if naf[i] > 0 {
|
||||
v.fromP1xP1(tmp1)
|
||||
table.SelectInto(multiple, naf[i])
|
||||
tmp1.Add(v, multiple)
|
||||
} else if naf[i] < 0 {
|
||||
v.fromP1xP1(tmp1)
|
||||
table.SelectInto(multiple, -naf[i])
|
||||
tmp1.Sub(v, multiple)
|
||||
}
|
||||
|
||||
tmp2.FromP1xP1(tmp1)
|
||||
}
|
||||
|
||||
v.fromP2(tmp2)
|
||||
return v
|
||||
}
|
||||
|
||||
// UnsafeVarTimeScalarBaseMult sets v = x * B, where B is the canonical generator, and returns v. Execution time depends on the inputs.
|
||||
// Deprecated: Unsafe for private operations
|
||||
// This is not faster than ScalarBaseMult
|
||||
func (v *Point) UnsafeVarTimeScalarBaseMult(x *Scalar) *Point {
|
||||
basepointNafTable := basepointNafTable()
|
||||
// Because the basepoint is fixed, we can use a wider NAF
|
||||
// corresponding to a bigger table.
|
||||
naf := x.nonAdjacentForm(8)
|
||||
|
||||
multiple := &affineCached{}
|
||||
tmp1 := &projP1xP1{}
|
||||
tmp2 := &projP2{}
|
||||
tmp2.Zero()
|
||||
|
||||
// Move from high to low bits, doubling the accumulator
|
||||
// at each iteration and checking whether there is a nonzero
|
||||
// coefficient to look up a multiple of.
|
||||
//
|
||||
// Skip trying to find the first nonzero coefficent, because
|
||||
// searching might be more work than a few extra doublings.
|
||||
for i := 255; i >= 0; i-- {
|
||||
tmp1.Double(tmp2)
|
||||
if naf[i] > 0 {
|
||||
v.fromP1xP1(tmp1)
|
||||
basepointNafTable.SelectInto(multiple, naf[i])
|
||||
tmp1.AddAffine(v, multiple)
|
||||
} else if naf[i] < 0 {
|
||||
v.fromP1xP1(tmp1)
|
||||
basepointNafTable.SelectInto(multiple, -naf[i])
|
||||
tmp1.SubAffine(v, multiple)
|
||||
}
|
||||
|
||||
tmp2.FromP1xP1(tmp1)
|
||||
}
|
||||
|
||||
v.fromP2(tmp2)
|
||||
return v
|
||||
}
|
||||
100
unsafe_test.go
Normal file
100
unsafe_test.go
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
package edwards25519
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"testing/quick"
|
||||
)
|
||||
|
||||
func TestUnsafeVarTimeScalarMultMatchesScalarBaseMult(t *testing.T) {
|
||||
unsafeVarTimeScalarMultMatchesScalarMult := func(x Scalar) bool {
|
||||
var p, check Point
|
||||
|
||||
p.UnsafeVarTimeScalarMult(&x, B)
|
||||
|
||||
check.ScalarBaseMult(&x)
|
||||
|
||||
checkOnCurve(t, &p, &check)
|
||||
return p.Equal(&check) == 1
|
||||
}
|
||||
|
||||
if err := quick.Check(unsafeVarTimeScalarMultMatchesScalarMult, quickCheckConfig32); err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnsafeVarTimeScalarBaseMultMatchesScalarBaseMult(t *testing.T) {
|
||||
unsafeVarTimeScalarBaseMultMatchesScalarMult := func(x Scalar) bool {
|
||||
var p, check Point
|
||||
|
||||
p.UnsafeVarTimeScalarBaseMult(&x)
|
||||
|
||||
check.ScalarBaseMult(&x)
|
||||
|
||||
checkOnCurve(t, &p, &check)
|
||||
return p.Equal(&check) == 1
|
||||
}
|
||||
|
||||
if err := quick.Check(unsafeVarTimeScalarBaseMultMatchesScalarMult, quickCheckConfig32); err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnsafeVarTimeScalarMultNonIdentityPoint(t *testing.T) {
|
||||
// Check whether p.ScalarMult and q.ScalaBaseMult give the same,
|
||||
// when p and q are originally set to the base point.
|
||||
|
||||
unsafeVarTimeScalarMultNonIdentityPoint := func(x Scalar) bool {
|
||||
var p, q Point
|
||||
p.Set(B)
|
||||
q.Set(B)
|
||||
|
||||
p.UnsafeVarTimeScalarMult(&x, B)
|
||||
q.ScalarBaseMult(&x)
|
||||
|
||||
checkOnCurve(t, &p, &q)
|
||||
|
||||
return p.Equal(&q) == 1
|
||||
}
|
||||
|
||||
if err := quick.Check(unsafeVarTimeScalarMultNonIdentityPoint, quickCheckConfig32); err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnsafeVarTimeScalarBaseMultNonIdentityPoint(t *testing.T) {
|
||||
// Check whether p.ScalarMult and q.ScalaBaseMult give the same,
|
||||
// when p and q are originally set to the base point.
|
||||
|
||||
unsafeVarTimeScalarBaseMultNonIdentityPoint := func(x Scalar) bool {
|
||||
var p, q Point
|
||||
p.Set(B)
|
||||
q.Set(B)
|
||||
|
||||
p.UnsafeVarTimeScalarBaseMult(&x)
|
||||
q.ScalarBaseMult(&x)
|
||||
|
||||
checkOnCurve(t, &p, &q)
|
||||
|
||||
return p.Equal(&q) == 1
|
||||
}
|
||||
|
||||
if err := quick.Check(unsafeVarTimeScalarBaseMultNonIdentityPoint, quickCheckConfig32); err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkUnsafeVarTimeScalarMult(b *testing.B) {
|
||||
var p Point
|
||||
|
||||
for i := 0; i < b.N; i++ {
|
||||
p.UnsafeVarTimeScalarMult(dalekScalar, B)
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkUnsafeVarTimeScalarBaseMult(b *testing.B) {
|
||||
var p Point
|
||||
|
||||
for i := 0; i < b.N; i++ {
|
||||
p.UnsafeVarTimeScalarBaseMult(dalekScalar)
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue