Coverage Report

Created: 2020-02-14 15:38

/src/botan/src/lib/pubkey/ed25519/sc_reduce.cpp
Line
Count
Source
1
/*
2
* Ed25519
3
* (C) 2017 Ribose Inc
4
*
5
* Based on the public domain code from SUPERCOP ref10 by
6
* Peter Schwabe, Daniel J. Bernstein, Niels Duif, Tanja Lange, Bo-Yin Yang
7
*
8
* Botan is released under the Simplified BSD License (see license.txt)
9
*/
10
11
#include <botan/internal/ed25519_internal.h>
12
13
namespace Botan {
14
15
/*
16
Input:
17
  s[0]+256*s[1]+...+256^63*s[63] = s
18
19
Output:
20
  s[0]+256*s[1]+...+256^31*s[31] = s mod l
21
  where l = 2^252 + 27742317777372353535851937790883648493.
22
  Overwrites s in place.
23
*/
24
25
void sc_reduce(uint8_t* s)
26
68
   {
27
68
   const uint32_t MASK = 0x1fffff;
28
68
29
68
   int64_t s0 = MASK & load_3(s);
30
68
   int64_t s1 = MASK & (load_4(s + 2) >> 5);
31
68
   int64_t s2 = MASK & (load_3(s + 5) >> 2);
32
68
   int64_t s3 = MASK & (load_4(s + 7) >> 7);
33
68
   int64_t s4 = MASK & (load_4(s + 10) >> 4);
34
68
   int64_t s5 = MASK & (load_3(s + 13) >> 1);
35
68
   int64_t s6 = MASK & (load_4(s + 15) >> 6);
36
68
   int64_t s7 = MASK & (load_3(s + 18) >> 3);
37
68
   int64_t s8 = MASK & load_3(s + 21);
38
68
   int64_t s9 = MASK & (load_4(s + 23) >> 5);
39
68
   int64_t s10 = MASK & (load_3(s + 26) >> 2);
40
68
   int64_t s11 = MASK & (load_4(s + 28) >> 7);
41
68
   int64_t s12 = MASK & (load_4(s + 31) >> 4);
42
68
   int64_t s13 = MASK & (load_3(s + 34) >> 1);
43
68
   int64_t s14 = MASK & (load_4(s + 36) >> 6);
44
68
   int64_t s15 = MASK & (load_3(s + 39) >> 3);
45
68
   int64_t s16 = MASK & load_3(s + 42);
46
68
   int64_t s17 = MASK & (load_4(s + 44) >> 5);
47
68
   int64_t s18 = MASK & (load_3(s + 47) >> 2);
48
68
   int64_t s19 = MASK & (load_4(s + 49) >> 7);
49
68
   int64_t s20 = MASK & (load_4(s + 52) >> 4);
50
68
   int64_t s21 = MASK & (load_3(s + 55) >> 1);
51
68
   int64_t s22 = MASK & (load_4(s + 57) >> 6);
52
68
   int64_t s23 = (load_4(s + 60) >> 3);
53
68
54
68
   redc_mul(s11, s12, s13, s14, s15, s16, s23);
55
68
   redc_mul(s10, s11, s12, s13, s14, s15, s22);
56
68
   redc_mul( s9, s10, s11, s12, s13, s14, s21);
57
68
   redc_mul( s8,  s9, s10, s11, s12, s13, s20);
58
68
   redc_mul( s7,  s8,  s9, s10, s11, s12, s19);
59
68
   redc_mul( s6,  s7,  s8,  s9, s10, s11, s18);
60
68
61
68
   carry<21>(s6, s7);
62
68
   carry<21>(s8, s9);
63
68
   carry<21>(s10, s11);
64
68
   carry<21>(s12, s13);
65
68
   carry<21>(s14, s15);
66
68
   carry<21>(s16, s17);
67
68
68
68
   carry<21>(s7, s8);
69
68
   carry<21>(s9, s10);
70
68
   carry<21>(s11, s12);
71
68
   carry<21>(s13, s14);
72
68
   carry<21>(s15, s16);
73
68
74
68
   redc_mul(s5, s6, s7, s8, s9, s10, s17);
75
68
   redc_mul(s4, s5, s6, s7, s8, s9, s16);
76
68
   redc_mul(s3, s4, s5, s6, s7, s8, s15);
77
68
   redc_mul(s2, s3, s4, s5, s6, s7, s14);
78
68
   redc_mul(s1, s2, s3, s4, s5, s6, s13);
79
68
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
80
68
81
68
   carry<21>(s0, s1);
82
68
   carry<21>(s2, s3);
83
68
   carry<21>(s4, s5);
84
68
   carry<21>(s6, s7);
85
68
   carry<21>(s8, s9);
86
68
   carry<21>(s10, s11);
87
68
88
68
   carry<21>(s1, s2);
89
68
   carry<21>(s3, s4);
90
68
   carry<21>(s5, s6);
91
68
   carry<21>(s7, s8);
92
68
   carry<21>(s9, s10);
93
68
   carry<21>(s11, s12);
94
68
95
68
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
96
68
97
68
   carry0<21>(s0, s1);
98
68
   carry0<21>(s1, s2);
99
68
   carry0<21>(s2, s3);
100
68
   carry0<21>(s3, s4);
101
68
   carry0<21>(s4, s5);
102
68
   carry0<21>(s5, s6);
103
68
   carry0<21>(s6, s7);
104
68
   carry0<21>(s7, s8);
105
68
   carry0<21>(s8, s9);
106
68
   carry0<21>(s9, s10);
107
68
   carry0<21>(s10, s11);
108
68
   carry0<21>(s11, s12);
109
68
110
68
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
111
68
112
68
   carry0<21>(s0, s1);
113
68
   carry0<21>(s1, s2);
114
68
   carry0<21>(s2, s3);
115
68
   carry0<21>(s3, s4);
116
68
   carry0<21>(s4, s5);
117
68
   carry0<21>(s5, s6);
118
68
   carry0<21>(s6, s7);
119
68
   carry0<21>(s7, s8);
120
68
   carry0<21>(s8, s9);
121
68
   carry0<21>(s9, s10);
122
68
   carry0<21>(s10, s11);
123
68
   carry0<21>(s11, s12);
124
68
125
68
   s[0] = static_cast<uint8_t>(s0 >> 0);
126
68
   s[1] = static_cast<uint8_t>(s0 >> 8);
127
68
   s[2] = static_cast<uint8_t>((s0 >> 16) | (s1 << 5));
128
68
   s[3] = static_cast<uint8_t>(s1 >> 3);
129
68
   s[4] = static_cast<uint8_t>(s1 >> 11);
130
68
   s[5] = static_cast<uint8_t>((s1 >> 19) | (s2 << 2));
131
68
   s[6] = static_cast<uint8_t>(s2 >> 6);
132
68
   s[7] = static_cast<uint8_t>((s2 >> 14) | (s3 << 7));
133
68
   s[8] = static_cast<uint8_t>(s3 >> 1);
134
68
   s[9] = static_cast<uint8_t>(s3 >> 9);
135
68
   s[10] = static_cast<uint8_t>((s3 >> 17) | (s4 << 4));
136
68
   s[11] = static_cast<uint8_t>(s4 >> 4);
137
68
   s[12] = static_cast<uint8_t>(s4 >> 12);
138
68
   s[13] = static_cast<uint8_t>((s4 >> 20) | (s5 << 1));
139
68
   s[14] = static_cast<uint8_t>(s5 >> 7);
140
68
   s[15] = static_cast<uint8_t>((s5 >> 15) | (s6 << 6));
141
68
   s[16] = static_cast<uint8_t>(s6 >> 2);
142
68
   s[17] = static_cast<uint8_t>(s6 >> 10);
143
68
   s[18] = static_cast<uint8_t>((s6 >> 18) | (s7 << 3));
144
68
   s[19] = static_cast<uint8_t>(s7 >> 5);
145
68
   s[20] = static_cast<uint8_t>(s7 >> 13);
146
68
   s[21] = static_cast<uint8_t>(s8 >> 0);
147
68
   s[22] = static_cast<uint8_t>(s8 >> 8);
148
68
   s[23] = static_cast<uint8_t>((s8 >> 16) | (s9 << 5));
149
68
   s[24] = static_cast<uint8_t>(s9 >> 3);
150
68
   s[25] = static_cast<uint8_t>(s9 >> 11);
151
68
   s[26] = static_cast<uint8_t>((s9 >> 19) | (s10 << 2));
152
68
   s[27] = static_cast<uint8_t>(s10 >> 6);
153
68
   s[28] = static_cast<uint8_t>((s10 >> 14) | (s11 << 7));
154
68
   s[29] = static_cast<uint8_t>(s11 >> 1);
155
68
   s[30] = static_cast<uint8_t>(s11 >> 9);
156
68
   s[31] = static_cast<uint8_t>(s11 >> 17);
157
68
   }
158
159
}