// does NOT ignore top bit internal static void fe_frombytes2(out FieldElement h, byte[] data, int offset) { Int64 h0 = load_4(data, offset); Int64 h1 = load_3(data, offset + 4) << 6; Int64 h2 = load_3(data, offset + 7) << 5; Int64 h3 = load_3(data, offset + 10) << 3; Int64 h4 = load_3(data, offset + 13) << 2; Int64 h5 = load_4(data, offset + 16); Int64 h6 = load_3(data, offset + 20) << 7; Int64 h7 = load_3(data, offset + 23) << 5; Int64 h8 = load_3(data, offset + 26) << 4; Int64 h9 = load_3(data, offset + 29) << 2; Int64 carry0; Int64 carry1; Int64 carry2; Int64 carry3; Int64 carry4; Int64 carry5; Int64 carry6; Int64 carry7; Int64 carry8; Int64 carry9; carry9 = (h9 + (Int64)(1 << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25; carry1 = (h1 + (Int64)(1 << 24)) >> 25; h2 += carry1; h1 -= carry1 << 25; carry3 = (h3 + (Int64)(1 << 24)) >> 25; h4 += carry3; h3 -= carry3 << 25; carry5 = (h5 + (Int64)(1 << 24)) >> 25; h6 += carry5; h5 -= carry5 << 25; carry7 = (h7 + (Int64)(1 << 24)) >> 25; h8 += carry7; h7 -= carry7 << 25; carry0 = (h0 + (Int64)(1 << 25)) >> 26; h1 += carry0; h0 -= carry0 << 26; carry2 = (h2 + (Int64)(1 << 25)) >> 26; h3 += carry2; h2 -= carry2 << 26; carry4 = (h4 + (Int64)(1 << 25)) >> 26; h5 += carry4; h4 -= carry4 << 26; carry6 = (h6 + (Int64)(1 << 25)) >> 26; h7 += carry6; h6 -= carry6 << 26; carry8 = (h8 + (Int64)(1 << 25)) >> 26; h9 += carry8; h8 -= carry8 << 26; h.x0 = (int)h0; h.x1 = (int)h1; h.x2 = (int)h2; h.x3 = (int)h3; h.x4 = (int)h4; h.x5 = (int)h5; h.x6 = (int)h6; h.x7 = (int)h7; h.x8 = (int)h8; h.x9 = (int)h9; }
/* * Replace (f,g) with (g,f) if b == 1; * replace (f,g) with (f,g) if b == 0. * * Preconditions: b in {0,1}. */ public static void fe_cswap(ref FieldElement f, ref FieldElement g, uint b) { Int32 f0 = f.x0; Int32 f1 = f.x1; Int32 f2 = f.x2; Int32 f3 = f.x3; Int32 f4 = f.x4; Int32 f5 = f.x5; Int32 f6 = f.x6; Int32 f7 = f.x7; Int32 f8 = f.x8; Int32 f9 = f.x9; Int32 g0 = g.x0; Int32 g1 = g.x1; Int32 g2 = g.x2; Int32 g3 = g.x3; Int32 g4 = g.x4; Int32 g5 = g.x5; Int32 g6 = g.x6; Int32 g7 = g.x7; Int32 g8 = g.x8; Int32 g9 = g.x9; Int32 x0 = f0 ^ g0; Int32 x1 = f1 ^ g1; Int32 x2 = f2 ^ g2; Int32 x3 = f3 ^ g3; Int32 x4 = f4 ^ g4; Int32 x5 = f5 ^ g5; Int32 x6 = f6 ^ g6; Int32 x7 = f7 ^ g7; Int32 x8 = f8 ^ g8; Int32 x9 = f9 ^ g9; int negb = unchecked ((int)-b); x0 &= negb; x1 &= negb; x2 &= negb; x3 &= negb; x4 &= negb; x5 &= negb; x6 &= negb; x7 &= negb; x8 &= negb; x9 &= negb; f.x0 = f0 ^ x0; f.x1 = f1 ^ x1; f.x2 = f2 ^ x2; f.x3 = f3 ^ x3; f.x4 = f4 ^ x4; f.x5 = f5 ^ x5; f.x6 = f6 ^ x6; f.x7 = f7 ^ x7; f.x8 = f8 ^ x8; f.x9 = f9 ^ x9; g.x0 = g0 ^ x0; g.x1 = g1 ^ x1; g.x2 = g2 ^ x2; g.x3 = g3 ^ x3; g.x4 = g4 ^ x4; g.x5 = g5 ^ x5; g.x6 = g6 ^ x6; g.x7 = g7 ^ x7; g.x8 = g8 ^ x8; g.x9 = g9 ^ x9; }
internal static void scalarmult( out FieldElement q, byte[] n, int noffset, ref FieldElement p) { byte[] e = new byte[32]; //ToDo: remove allocation UInt32 i; FieldElement x1; FieldElement x2; FieldElement z2; FieldElement x3; FieldElement z3; FieldElement tmp0; FieldElement tmp1; int pos; UInt32 swap; UInt32 b; for (i = 0; i < 32; ++i) { e[i] = n[noffset + i]; } ScalarOperations.sc_clamp(e, 0); x1 = p; FieldOperations.fe_1(out x2); FieldOperations.fe_0(out z2); x3 = x1; FieldOperations.fe_1(out z3); swap = 0; for (pos = 254; pos >= 0; --pos) { b = (uint)(e[pos / 8] >> (pos & 7)); b &= 1; swap ^= b; FieldOperations.fe_cswap(ref x2, ref x3, swap); FieldOperations.fe_cswap(ref z2, ref z3, swap); swap = b; /* qhasm: fe X2 */ /* qhasm: fe Z2 */ /* qhasm: fe X3 */ /* qhasm: fe Z3 */ /* qhasm: fe X4 */ /* qhasm: fe Z4 */ /* qhasm: fe X5 */ /* qhasm: fe Z5 */ /* qhasm: fe A */ /* qhasm: fe B */ /* qhasm: fe C */ /* qhasm: fe D */ /* qhasm: fe E */ /* qhasm: fe AA */ /* qhasm: fe BB */ /* qhasm: fe DA */ /* qhasm: fe CB */ /* qhasm: fe t0 */ /* qhasm: fe t1 */ /* qhasm: fe t2 */ /* qhasm: fe t3 */ /* qhasm: fe t4 */ /* qhasm: enter ladder */ /* qhasm: D = X3-Z3 */ /* asm 1: fe_sub(>D=fe#5,<X3=fe#3,<Z3=fe#4); */ /* asm 2: fe_sub(>D=tmp0,<X3=x3,<Z3=z3); */ FieldOperations.fe_sub(out tmp0, ref x3, ref z3); /* qhasm: B = X2-Z2 */ /* asm 1: fe_sub(>B=fe#6,<X2=fe#1,<Z2=fe#2); */ /* asm 2: fe_sub(>B=tmp1,<X2=x2,<Z2=z2); */ FieldOperations.fe_sub(out tmp1, ref x2, ref z2); /* qhasm: A = X2+Z2 */ /* asm 1: fe_add(>A=fe#1,<X2=fe#1,<Z2=fe#2); */ /* asm 2: fe_add(>A=x2,<X2=x2,<Z2=z2); */ FieldOperations.fe_add(out x2, ref x2, ref z2); /* qhasm: C = X3+Z3 */ /* asm 1: fe_add(>C=fe#2,<X3=fe#3,<Z3=fe#4); */ /* asm 2: fe_add(>C=z2,<X3=x3,<Z3=z3); */ FieldOperations.fe_add(out z2, ref x3, ref z3); /* qhasm: DA = D*A */ /* asm 1: fe_mul(>DA=fe#4,<D=fe#5,<A=fe#1); */ /* asm 2: fe_mul(>DA=z3,<D=tmp0,<A=x2); */ FieldOperations.fe_mul(out z3, ref tmp0, ref x2); /* qhasm: CB = C*B */ /* asm 1: fe_mul(>CB=fe#2,<C=fe#2,<B=fe#6); */ /* asm 2: fe_mul(>CB=z2,<C=z2,<B=tmp1); */ FieldOperations.fe_mul(out z2, ref z2, ref tmp1); /* qhasm: BB = B^2 */ /* asm 1: fe_sq(>BB=fe#5,<B=fe#6); */ /* asm 2: fe_sq(>BB=tmp0,<B=tmp1); */ FieldOperations.fe_sq(out tmp0, ref tmp1); /* qhasm: AA = A^2 */ /* asm 1: fe_sq(>AA=fe#6,<A=fe#1); */ /* asm 2: fe_sq(>AA=tmp1,<A=x2); */ FieldOperations.fe_sq(out tmp1, ref x2); /* qhasm: t0 = DA+CB */ /* asm 1: fe_add(>t0=fe#3,<DA=fe#4,<CB=fe#2); */ /* asm 2: fe_add(>t0=x3,<DA=z3,<CB=z2); */ FieldOperations.fe_add(out x3, ref z3, ref z2); /* qhasm: assign x3 to t0 */ /* qhasm: t1 = DA-CB */ /* asm 1: fe_sub(>t1=fe#2,<DA=fe#4,<CB=fe#2); */ /* asm 2: fe_sub(>t1=z2,<DA=z3,<CB=z2); */ FieldOperations.fe_sub(out z2, ref z3, ref z2); /* qhasm: X4 = AA*BB */ /* asm 1: fe_mul(>X4=fe#1,<AA=fe#6,<BB=fe#5); */ /* asm 2: fe_mul(>X4=x2,<AA=tmp1,<BB=tmp0); */ FieldOperations.fe_mul(out x2, ref tmp1, ref tmp0); /* qhasm: E = AA-BB */ /* asm 1: fe_sub(>E=fe#6,<AA=fe#6,<BB=fe#5); */ /* asm 2: fe_sub(>E=tmp1,<AA=tmp1,<BB=tmp0); */ FieldOperations.fe_sub(out tmp1, ref tmp1, ref tmp0); /* qhasm: t2 = t1^2 */ /* asm 1: fe_sq(>t2=fe#2,<t1=fe#2); */ /* asm 2: fe_sq(>t2=z2,<t1=z2); */ FieldOperations.fe_sq(out z2, ref z2); /* qhasm: t3 = a24*E */ /* asm 1: fe_mul121666(>t3=fe#4,<E=fe#6); */ /* asm 2: fe_mul121666(>t3=z3,<E=tmp1); */ FieldOperations.fe_mul121666(out z3, ref tmp1); /* qhasm: X5 = t0^2 */ /* asm 1: fe_sq(>X5=fe#3,<t0=fe#3); */ /* asm 2: fe_sq(>X5=x3,<t0=x3); */ FieldOperations.fe_sq(out x3, ref x3); /* qhasm: t4 = BB+t3 */ /* asm 1: fe_add(>t4=fe#5,<BB=fe#5,<t3=fe#4); */ /* asm 2: fe_add(>t4=tmp0,<BB=tmp0,<t3=z3); */ FieldOperations.fe_add(out tmp0, ref tmp0, ref z3); /* qhasm: Z5 = X1*t2 */ /* asm 1: fe_mul(>Z5=fe#4,x1,<t2=fe#2); */ /* asm 2: fe_mul(>Z5=z3,x1,<t2=z2); */ FieldOperations.fe_mul(out z3, ref x1, ref z2); /* qhasm: Z4 = E*t4 */ /* asm 1: fe_mul(>Z4=fe#2,<E=fe#6,<t4=fe#5); */ /* asm 2: fe_mul(>Z4=z2,<E=tmp1,<t4=tmp0); */ FieldOperations.fe_mul(out z2, ref tmp1, ref tmp0); /* qhasm: return */ } FieldOperations.fe_cswap(ref x2, ref x3, swap); FieldOperations.fe_cswap(ref z2, ref z3, swap); FieldOperations.fe_invert(out z2, ref z2); FieldOperations.fe_mul(out x2, ref x2, ref z2); q = x2; CryptoBytes.Wipe(e); }
internal static void fe_pow22523(out FieldElement result, ref FieldElement z) { FieldElement t0; FieldElement t1; FieldElement t2; int i; /* qhasm: fe z1 */ /* qhasm: fe z2 */ /* qhasm: fe z8 */ /* qhasm: fe z9 */ /* qhasm: fe z11 */ /* qhasm: fe z22 */ /* qhasm: fe z_5_0 */ /* qhasm: fe z_10_5 */ /* qhasm: fe z_10_0 */ /* qhasm: fe z_20_10 */ /* qhasm: fe z_20_0 */ /* qhasm: fe z_40_20 */ /* qhasm: fe z_40_0 */ /* qhasm: fe z_50_10 */ /* qhasm: fe z_50_0 */ /* qhasm: fe z_100_50 */ /* qhasm: fe z_100_0 */ /* qhasm: fe z_200_100 */ /* qhasm: fe z_200_0 */ /* qhasm: fe z_250_50 */ /* qhasm: fe z_250_0 */ /* qhasm: fe z_252_2 */ /* qhasm: fe z_252_3 */ /* qhasm: enter pow22523 */ /* qhasm: z2 = z1^2^1 */ /* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */ /* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */ fe_sq(out t0, ref z); //for (i = 1; i < 1; ++i) fe_sq(out t0, ref t0); /* qhasm: z8 = z2^2^2 */ /* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */ /* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */ fe_sq(out t1, ref t0); for (i = 1; i < 2; ++i) { fe_sq(out t1, ref t1); } /* qhasm: z9 = z1*z8 */ /* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */ /* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */ fe_mul(out t1, ref z, ref t1); /* qhasm: z11 = z2*z9 */ /* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */ /* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */ fe_mul(out t0, ref t0, ref t1); /* qhasm: z22 = z11^2^1 */ /* asm 1: fe_sq(>z22=fe#1,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#1,>z22=fe#1); */ /* asm 2: fe_sq(>z22=t0,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t0,>z22=t0); */ fe_sq(out t0, ref t0); //for (i = 1; i < 1; ++i) fe_sq(out t0, ref t0); /* qhasm: z_5_0 = z9*z22 */ /* asm 1: fe_mul(>z_5_0=fe#1,<z9=fe#2,<z22=fe#1); */ /* asm 2: fe_mul(>z_5_0=t0,<z9=t1,<z22=t0); */ fe_mul(out t0, ref t1, ref t0); /* qhasm: z_10_5 = z_5_0^2^5 */ /* asm 1: fe_sq(>z_10_5=fe#2,<z_5_0=fe#1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#2,>z_10_5=fe#2); */ /* asm 2: fe_sq(>z_10_5=t1,<z_5_0=t0); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t1,>z_10_5=t1); */ fe_sq(out t1, ref t0); for (i = 1; i < 5; ++i) { fe_sq(out t1, ref t1); } /* qhasm: z_10_0 = z_10_5*z_5_0 */ /* asm 1: fe_mul(>z_10_0=fe#1,<z_10_5=fe#2,<z_5_0=fe#1); */ /* asm 2: fe_mul(>z_10_0=t0,<z_10_5=t1,<z_5_0=t0); */ fe_mul(out t0, ref t1, ref t0); /* qhasm: z_20_10 = z_10_0^2^10 */ /* asm 1: fe_sq(>z_20_10=fe#2,<z_10_0=fe#1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#2,>z_20_10=fe#2); */ /* asm 2: fe_sq(>z_20_10=t1,<z_10_0=t0); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t1,>z_20_10=t1); */ fe_sq(out t1, ref t0); for (i = 1; i < 10; ++i) { fe_sq(out t1, ref t1); } /* qhasm: z_20_0 = z_20_10*z_10_0 */ /* asm 1: fe_mul(>z_20_0=fe#2,<z_20_10=fe#2,<z_10_0=fe#1); */ /* asm 2: fe_mul(>z_20_0=t1,<z_20_10=t1,<z_10_0=t0); */ fe_mul(out t1, ref t1, ref t0); /* qhasm: z_40_20 = z_20_0^2^20 */ /* asm 1: fe_sq(>z_40_20=fe#3,<z_20_0=fe#2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#3,>z_40_20=fe#3); */ /* asm 2: fe_sq(>z_40_20=t2,<z_20_0=t1); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t2,>z_40_20=t2); */ fe_sq(out t2, ref t1); for (i = 1; i < 20; ++i) { fe_sq(out t2, ref t2); } /* qhasm: z_40_0 = z_40_20*z_20_0 */ /* asm 1: fe_mul(>z_40_0=fe#2,<z_40_20=fe#3,<z_20_0=fe#2); */ /* asm 2: fe_mul(>z_40_0=t1,<z_40_20=t2,<z_20_0=t1); */ fe_mul(out t1, ref t2, ref t1); /* qhasm: z_50_10 = z_40_0^2^10 */ /* asm 1: fe_sq(>z_50_10=fe#2,<z_40_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#2,>z_50_10=fe#2); */ /* asm 2: fe_sq(>z_50_10=t1,<z_40_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t1,>z_50_10=t1); */ fe_sq(out t1, ref t1); for (i = 1; i < 10; ++i) { fe_sq(out t1, ref t1); } /* qhasm: z_50_0 = z_50_10*z_10_0 */ /* asm 1: fe_mul(>z_50_0=fe#1,<z_50_10=fe#2,<z_10_0=fe#1); */ /* asm 2: fe_mul(>z_50_0=t0,<z_50_10=t1,<z_10_0=t0); */ fe_mul(out t0, ref t1, ref t0); /* qhasm: z_100_50 = z_50_0^2^50 */ /* asm 1: fe_sq(>z_100_50=fe#2,<z_50_0=fe#1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#2,>z_100_50=fe#2); */ /* asm 2: fe_sq(>z_100_50=t1,<z_50_0=t0); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t1,>z_100_50=t1); */ fe_sq(out t1, ref t0); for (i = 1; i < 50; ++i) { fe_sq(out t1, ref t1); } /* qhasm: z_100_0 = z_100_50*z_50_0 */ /* asm 1: fe_mul(>z_100_0=fe#2,<z_100_50=fe#2,<z_50_0=fe#1); */ /* asm 2: fe_mul(>z_100_0=t1,<z_100_50=t1,<z_50_0=t0); */ fe_mul(out t1, ref t1, ref t0); /* qhasm: z_200_100 = z_100_0^2^100 */ /* asm 1: fe_sq(>z_200_100=fe#3,<z_100_0=fe#2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#3,>z_200_100=fe#3); */ /* asm 2: fe_sq(>z_200_100=t2,<z_100_0=t1); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t2,>z_200_100=t2); */ fe_sq(out t2, ref t1); for (i = 1; i < 100; ++i) { fe_sq(out t2, ref t2); } /* qhasm: z_200_0 = z_200_100*z_100_0 */ /* asm 1: fe_mul(>z_200_0=fe#2,<z_200_100=fe#3,<z_100_0=fe#2); */ /* asm 2: fe_mul(>z_200_0=t1,<z_200_100=t2,<z_100_0=t1); */ fe_mul(out t1, ref t2, ref t1); /* qhasm: z_250_50 = z_200_0^2^50 */ /* asm 1: fe_sq(>z_250_50=fe#2,<z_200_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#2,>z_250_50=fe#2); */ /* asm 2: fe_sq(>z_250_50=t1,<z_200_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t1,>z_250_50=t1); */ fe_sq(out t1, ref t1); for (i = 1; i < 50; ++i) { fe_sq(out t1, ref t1); } /* qhasm: z_250_0 = z_250_50*z_50_0 */ /* asm 1: fe_mul(>z_250_0=fe#1,<z_250_50=fe#2,<z_50_0=fe#1); */ /* asm 2: fe_mul(>z_250_0=t0,<z_250_50=t1,<z_50_0=t0); */ fe_mul(out t0, ref t1, ref t0); /* qhasm: z_252_2 = z_250_0^2^2 */ /* asm 1: fe_sq(>z_252_2=fe#1,<z_250_0=fe#1); for (i = 1;i < 2;++i) fe_sq(>z_252_2=fe#1,>z_252_2=fe#1); */ /* asm 2: fe_sq(>z_252_2=t0,<z_250_0=t0); for (i = 1;i < 2;++i) fe_sq(>z_252_2=t0,>z_252_2=t0); */ fe_sq(out t0, ref t0); for (i = 1; i < 2; ++i) { fe_sq(out t0, ref t0); } /* qhasm: z_252_3 = z_252_2*z1 */ /* asm 1: fe_mul(>z_252_3=fe#12,<z_252_2=fe#1,<z1=fe#11); */ /* asm 2: fe_mul(>z_252_3=out,<z_252_2=t0,<z1=z); */ fe_mul(out result, ref t0, ref z); /* qhasm: return */ }