/* return sqrt(this) mod Modulus */ public FP sqrt() { reduce(); BIG b = new BIG(p); if (ROM.MOD8 == 5) { b.dec(5); b.norm(); b.shr(3); FP i = new FP(this); i.x.shl(1); FP v = i.pow(b); i.mul(v); i.mul(v); i.x.dec(1); FP r = new FP(this); r.mul(v); r.mul(i); r.reduce(); return(r); } else { b.inc(1); b.norm(); b.shr(2); return(pow(b)); } }
/* a=1/a mod 2^256. This is very fast! */ public virtual void invmod2m() { int i; BIG U = new BIG(0); BIG b = new BIG(0); BIG c = new BIG(0); U.inc(invmod256(lastbits(8))); for (i = 8; i < 256; i <<= 1) { b.copy(this); b.mod2m(i); BIG t1 = BIG.smul(U, b); t1.shr(i); c.copy(this); c.shr(i); c.mod2m(i); BIG t2 = BIG.smul(U, c); t2.mod2m(i); t1.add(t2); b = BIG.smul(t1, U); t1.copy(b); t1.mod2m(i); t2.one(); t2.shl(i); t1.rsub(t2); t1.norm(); t1.shl(i); U.add(t1); } this.copy(U); }
/* these next two functions implement elligator squared - http://eprint.iacr.org/2014/043 */ /* Elliptic curve point E in format (0x04,x,y} is converted to form {0x0-,u,v} */ /* Note that u and v are indistinguisible from random strings */ public static int ENCODING(RAND rng, sbyte[] E) { int rn, m, su, sv; sbyte[] T = new sbyte[EFS]; for (int i = 0; i < EFS; i++) { T[i] = E[i + 1]; } BIG u = BIG.fromBytes(T); for (int i = 0; i < EFS; i++) { T[i] = E[i + EFS + 1]; } BIG v = BIG.fromBytes(T); ECP P = new ECP(u, v); if (P.is_infinity()) { return(INVALID_POINT); } BIG p = new BIG(ROM.Modulus); u = BIG.randomnum(p, rng); su = rng.Byte; //if (su<0) su=-su; su %= 2; ECP W = map(u, su); P.sub(W); sv = P.S; rn = unmap(v, P); m = rng.Byte; //if (m<0) m=-m; m %= rn; v.inc(m + 1); E[0] = (sbyte)(su + 2 * sv); u.toBytes(T); for (int i = 0; i < EFS; i++) { E[i + 1] = T[i]; } v.toBytes(T); for (int i = 0; i < EFS; i++) { E[i + EFS + 1] = T[i]; } return(0); }
/* needed for SOK */ public static ECP2 mapit2(sbyte[] h) { BIG q = new BIG(ROM.Modulus); BIG x = BIG.fromBytes(h); BIG one = new BIG(1); FP2 X; ECP2 Q, T, K; x.mod(q); while (true) { X = new FP2(one, x); Q = new ECP2(X); if (!Q.is_infinity()) { break; } x.inc(1); x.norm(); } /* Fast Hashing to G2 - Fuentes-Castaneda, Knapp and Rodriguez-Henriquez */ BIG Fra = new BIG(ROM.CURVE_Fra); BIG Frb = new BIG(ROM.CURVE_Frb); X = new FP2(Fra, Frb); x = new BIG(ROM.CURVE_Bnx); T = new ECP2(); T.copy(Q); T.mul(x); T.neg(); K = new ECP2(); K.copy(T); K.dbl(); K.add(T); K.affine(); K.frob(X); Q.frob(X); Q.frob(X); Q.frob(X); Q.add(T); Q.add(K); T.frob(X); T.frob(X); Q.add(T); Q.affine(); return(Q); }
/* these next two functions help to implement elligator squared - http://eprint.iacr.org/2014/043 */ /* maps a random u to a point on the curve */ public static ECP map(BIG u, int cb) { ECP P; BIG x = new BIG(u); BIG p = new BIG(ROM.Modulus); x.mod(p); while (true) { P = new ECP(x, cb); if (!P.is_infinity()) { break; } x.inc(1); x.norm(); } return(P); }
public static ECP mapit(sbyte[] h) { BIG q = new BIG(ROM.Modulus); BIG x = BIG.fromBytes(h); x.mod(q); ECP P; while (true) { P = new ECP(x, 0); if (!P.is_infinity()) { break; } x.inc(1); x.norm(); } return(P); }
/* return e.this */ public ECP mul(BIG e) { if (e.iszilch() || is_infinity()) { return(new ECP()); } ECP P = new ECP(); if (ROM.CURVETYPE == ROM.MONTGOMERY) { /* use Ladder */ int nb, i, b; ECP D = new ECP(); ECP R0 = new ECP(); R0.copy(this); ECP R1 = new ECP(); R1.copy(this); R1.dbl(); D.copy(this); D.affine(); nb = e.nbits(); for (i = nb - 2; i >= 0; i--) { b = e.bit(i); P.copy(R1); P.dadd(R0, D); R0.cswap(R1, b); R1.copy(P); R0.dbl(); R0.cswap(R1, b); } P.copy(R0); } else { // fixed size windows int i, b, nb, m, s, ns; BIG mt = new BIG(); BIG t = new BIG(); ECP Q = new ECP(); ECP C = new ECP(); ECP[] W = new ECP[8]; sbyte[] w = new sbyte[1 + (ROM.NLEN * ROM.BASEBITS + 3) / 4]; affine(); // precompute table Q.copy(this); Q.dbl(); W[0] = new ECP(); W[0].copy(this); for (i = 1; i < 8; i++) { W[i] = new ECP(); W[i].copy(W[i - 1]); W[i].add(Q); } // convert the table to affine if (ROM.CURVETYPE == ROM.WEIERSTRASS) { multiaffine(8, W); } // make exponent odd - add 2P if even, P if odd t.copy(e); s = t.parity(); t.inc(1); t.norm(); ns = t.parity(); mt.copy(t); mt.inc(1); mt.norm(); t.cmove(mt, s); Q.cmove(this, ns); C.copy(Q); nb = 1 + (t.nbits() + 3) / 4; // convert exponent to signed 4-bit window for (i = 0; i < nb; i++) { w[i] = (sbyte)(t.lastbits(5) - 16); t.dec(w[i]); t.norm(); t.fshr(4); } w[nb] = (sbyte)t.lastbits(5); P.copy(W[(w[nb] - 1) / 2]); for (i = nb - 1; i >= 0; i--) { Q.select(W, w[i]); P.dbl(); P.dbl(); P.dbl(); P.dbl(); P.add(Q); } P.sub(C); // apply correction } P.affine(); return(P); }
/* Return e.this+f.Q */ public ECP mul2(BIG e, ECP Q, BIG f) { BIG te = new BIG(); BIG tf = new BIG(); BIG mt = new BIG(); ECP S = new ECP(); ECP T = new ECP(); ECP C = new ECP(); ECP[] W = new ECP[8]; sbyte[] w = new sbyte[1 + (ROM.NLEN * ROM.BASEBITS + 1) / 2]; int i, s, ns, nb; sbyte a, b; affine(); Q.affine(); te.copy(e); tf.copy(f); // precompute table W[1] = new ECP(); W[1].copy(this); W[1].sub(Q); W[2] = new ECP(); W[2].copy(this); W[2].add(Q); S.copy(Q); S.dbl(); W[0] = new ECP(); W[0].copy(W[1]); W[0].sub(S); W[3] = new ECP(); W[3].copy(W[2]); W[3].add(S); T.copy(this); T.dbl(); W[5] = new ECP(); W[5].copy(W[1]); W[5].add(T); W[6] = new ECP(); W[6].copy(W[2]); W[6].add(T); W[4] = new ECP(); W[4].copy(W[5]); W[4].sub(S); W[7] = new ECP(); W[7].copy(W[6]); W[7].add(S); // convert the table to affine if (ROM.CURVETYPE == ROM.WEIERSTRASS) { multiaffine(8, W); } // if multiplier is odd, add 2, else add 1 to multiplier, and add 2P or P to correction s = te.parity(); te.inc(1); te.norm(); ns = te.parity(); mt.copy(te); mt.inc(1); mt.norm(); te.cmove(mt, s); T.cmove(this, ns); C.copy(T); s = tf.parity(); tf.inc(1); tf.norm(); ns = tf.parity(); mt.copy(tf); mt.inc(1); mt.norm(); tf.cmove(mt, s); S.cmove(Q, ns); C.add(S); mt.copy(te); mt.add(tf); mt.norm(); nb = 1 + (mt.nbits() + 1) / 2; // convert exponent to signed 2-bit window for (i = 0; i < nb; i++) { a = (sbyte)(te.lastbits(3) - 4); te.dec(a); te.norm(); te.fshr(2); b = (sbyte)(tf.lastbits(3) - 4); tf.dec(b); tf.norm(); tf.fshr(2); w[i] = (sbyte)(4 * a + b); } w[nb] = (sbyte)(4 * te.lastbits(3) + tf.lastbits(3)); S.copy(W[(w[nb] - 1) / 2]); for (i = nb - 1; i >= 0; i--) { T.select(W, w[i]); S.dbl(); S.dbl(); S.add(T); } S.sub(C); // apply correction S.affine(); return(S); }
/* P*=e */ public ECP2 mul(BIG e) { /* fixed size windows */ int i, b, nb, m, s, ns; BIG mt = new BIG(); BIG t = new BIG(); ECP2 P = new ECP2(); ECP2 Q = new ECP2(); ECP2 C = new ECP2(); ECP2[] W = new ECP2[8]; sbyte[] w = new sbyte[1 + (ROM.NLEN * ROM.BASEBITS + 3) / 4]; if (is_infinity()) { return(new ECP2()); } affine(); /* precompute table */ Q.copy(this); Q.dbl(); W[0] = new ECP2(); W[0].copy(this); for (i = 1; i < 8; i++) { W[i] = new ECP2(); W[i].copy(W[i - 1]); W[i].add(Q); } /* convert the table to affine */ multiaffine(8, W); /* make exponent odd - add 2P if even, P if odd */ t.copy(e); s = t.parity(); t.inc(1); t.norm(); ns = t.parity(); mt.copy(t); mt.inc(1); mt.norm(); t.cmove(mt, s); Q.cmove(this, ns); C.copy(Q); nb = 1 + (t.nbits() + 3) / 4; /* convert exponent to signed 4-bit window */ for (i = 0; i < nb; i++) { w[i] = (sbyte)(t.lastbits(5) - 16); t.dec(w[i]); t.norm(); t.fshr(4); } w[nb] = (sbyte)t.lastbits(5); P.copy(W[(w[nb] - 1) / 2]); for (i = nb - 1; i >= 0; i--) { Q.select(W, w[i]); P.dbl(); P.dbl(); P.dbl(); P.dbl(); P.add(Q); } P.sub(C); P.affine(); return(P); }