Coverage Report

Created: 2020-05-23 13:54

/src/botan/src/lib/pubkey/ec_group/curve_gfp.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* Elliptic curves over GF(p) Montgomery Representation
3
* (C) 2014,2015,2018 Jack Lloyd
4
*     2016 Matthias Gierlings
5
*
6
* Botan is released under the Simplified BSD License (see license.txt)
7
*/
8
9
#include <botan/curve_gfp.h>
10
#include <botan/curve_nistp.h>
11
#include <botan/numthry.h>
12
#include <botan/reducer.h>
13
#include <botan/internal/mp_core.h>
14
#include <botan/internal/mp_asmi.h>
15
16
namespace Botan {
17
18
namespace {
19
20
class CurveGFp_Montgomery final : public CurveGFp_Repr
21
   {
22
   public:
23
      CurveGFp_Montgomery(const BigInt& p, const BigInt& a, const BigInt& b) :
24
         m_p(p), m_a(a), m_b(b),
25
         m_p_words(m_p.sig_words()),
26
         m_p_dash(monty_inverse(m_p.word_at(0)))
27
605
         {
28
605
         Modular_Reducer mod_p(m_p);
29
605
30
605
         m_r.set_bit(m_p_words * BOTAN_MP_WORD_BITS);
31
605
         m_r = mod_p.reduce(m_r);
32
605
33
605
         m_r2  = mod_p.square(m_r);
34
605
         m_r3  = mod_p.multiply(m_r, m_r2);
35
605
         m_a_r = mod_p.multiply(m_r, m_a);
36
605
         m_b_r = mod_p.multiply(m_r, m_b);
37
605
38
605
         m_a_is_zero = m_a.is_zero();
39
605
         m_a_is_minus_3 = (m_a + 3 == m_p);
40
605
         }
41
42
2.03M
      bool a_is_zero() const override { return m_a_is_zero; }
43
1.90M
      bool a_is_minus_3() const override { return m_a_is_minus_3; }
44
45
4.32k
      const BigInt& get_a() const override { return m_a; }
46
47
4.32k
      const BigInt& get_b() const override { return m_b; }
48
49
3.53M
      const BigInt& get_p() const override { return m_p; }
50
51
1.83M
      const BigInt& get_a_rep() const override { return m_a_r; }
52
53
8.74k
      const BigInt& get_b_rep() const override { return m_b_r; }
54
55
46.4k
      const BigInt& get_1_rep() const override { return m_r; }
56
57
27.8k
      bool is_one(const BigInt& x) const override { return x == m_r; }
58
59
408k
      size_t get_p_words() const override { return m_p_words; }
60
61
46.4M
      size_t get_ws_size() const override { return 2*m_p_words + 4; }
62
63
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
64
65
      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override;
66
67
      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override;
68
69
      void curve_mul_words(BigInt& z,
70
                           const word x_words[],
71
                           const size_t x_size,
72
                           const BigInt& y,
73
                           secure_vector<word>& ws) const override;
74
75
      void curve_sqr_words(BigInt& z,
76
                           const word x_words[],
77
                           size_t x_size,
78
                           secure_vector<word>& ws) const override;
79
80
   private:
81
      BigInt m_p;
82
      BigInt m_a, m_b;
83
      BigInt m_a_r, m_b_r;
84
      size_t m_p_words; // cache of m_p.sig_words()
85
86
      // Montgomery parameters
87
      BigInt m_r, m_r2, m_r3;
88
      word m_p_dash;
89
90
      bool m_a_is_zero;
91
      bool m_a_is_minus_3;
92
   };
93
94
BigInt CurveGFp_Montgomery::invert_element(const BigInt& x, secure_vector<word>& ws) const
95
28.3k
   {
96
28.3k
   // Should we use Montgomery inverse instead?
97
28.3k
   const BigInt inv = inverse_mod(x, m_p);
98
28.3k
   BigInt res;
99
28.3k
   curve_mul(res, inv, m_r3, ws);
100
28.3k
   return res;
101
28.3k
   }
102
103
void CurveGFp_Montgomery::to_curve_rep(BigInt& x, secure_vector<word>& ws) const
104
6.30k
   {
105
6.30k
   const BigInt tx = x;
106
6.30k
   curve_mul(x, tx, m_r2, ws);
107
6.30k
   }
108
109
void CurveGFp_Montgomery::from_curve_rep(BigInt& z, secure_vector<word>& ws) const
110
43.1k
   {
111
43.1k
   if(ws.size() < get_ws_size())
112
220
      ws.resize(get_ws_size());
113
43.1k
114
43.1k
   const size_t output_size = 2*m_p_words + 2;
115
43.1k
   if(z.size() < output_size)
116
8.55k
      z.grow_to(output_size);
117
43.1k
118
43.1k
   bigint_monty_redc(z.mutable_data(),
119
43.1k
                     m_p.data(), m_p_words, m_p_dash,
120
43.1k
                     ws.data(), ws.size());
121
43.1k
   }
122
123
void CurveGFp_Montgomery::curve_mul_words(BigInt& z,
124
                                          const word x_w[],
125
                                          size_t x_size,
126
                                          const BigInt& y,
127
                                          secure_vector<word>& ws) const
128
25.3M
   {
129
25.3M
   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
130
25.3M
131
25.3M
   if(ws.size() < get_ws_size())
132
0
      ws.resize(get_ws_size());
133
25.3M
134
25.3M
   const size_t output_size = 2*m_p_words + 2;
135
25.3M
   if(z.size() < output_size)
136
1.74M
      z.grow_to(output_size);
137
25.3M
138
25.3M
   bigint_mul(z.mutable_data(), z.size(),
139
25.3M
              x_w, x_size, std::min(m_p_words, x_size),
140
25.3M
              y.data(), y.size(), std::min(m_p_words, y.size()),
141
25.3M
              ws.data(), ws.size());
142
25.3M
143
25.3M
   bigint_monty_redc(z.mutable_data(),
144
25.3M
                     m_p.data(), m_p_words, m_p_dash,
145
25.3M
                     ws.data(), ws.size());
146
25.3M
   }
147
148
void CurveGFp_Montgomery::curve_sqr_words(BigInt& z,
149
                                          const word x[],
150
                                          size_t x_size,
151
                                          secure_vector<word>& ws) const
152
17.4M
   {
153
17.4M
   if(ws.size() < get_ws_size())
154
41.3k
      ws.resize(get_ws_size());
155
17.4M
156
17.4M
   const size_t output_size = 2*m_p_words + 2;
157
17.4M
   if(z.size() < output_size)
158
154k
      z.grow_to(output_size);
159
17.4M
160
17.4M
   bigint_sqr(z.mutable_data(), z.size(),
161
17.4M
              x, x_size, std::min(m_p_words, x_size),
162
17.4M
              ws.data(), ws.size());
163
17.4M
164
17.4M
   bigint_monty_redc(z.mutable_data(),
165
17.4M
                     m_p.data(), m_p_words, m_p_dash,
166
17.4M
                     ws.data(), ws.size());
167
17.4M
   }
168
169
class CurveGFp_NIST : public CurveGFp_Repr
170
   {
171
   public:
172
      CurveGFp_NIST(size_t p_bits, const BigInt& a, const BigInt& b) :
173
         m_1(1), m_a(a), m_b(b), m_p_words((p_bits + BOTAN_MP_WORD_BITS - 1) / BOTAN_MP_WORD_BITS)
174
610
         {
175
610
         // All Solinas prime curves are assumed a == -3
176
610
         }
177
178
9.90M
      bool a_is_zero() const override { return false; }
179
9.90M
      bool a_is_minus_3() const override { return true; }
180
181
16.8k
      const BigInt& get_a() const override { return m_a; }
182
183
16.8k
      const BigInt& get_b() const override { return m_b; }
184
185
102k
      const BigInt& get_1_rep() const override { return m_1; }
186
187
1.02M
      size_t get_p_words() const override { return m_p_words; }
188
189
235M
      size_t get_ws_size() const override { return 2*m_p_words + 4; }
190
191
31.9k
      const BigInt& get_a_rep() const override { return m_a; }
192
193
42.8k
      const BigInt& get_b_rep() const override { return m_b; }
194
195
98.9k
      bool is_one(const BigInt& x) const override { return x == 1; }
196
197
      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override
198
25.5k
         { redc_mod_p(x, ws); }
199
200
      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override
201
173k
         { redc_mod_p(x, ws); }
202
203
      virtual void redc_mod_p(BigInt& z, secure_vector<word>& ws) const = 0;
204
205
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
206
207
      void curve_mul_words(BigInt& z,
208
                           const word x_words[],
209
                           const size_t x_size,
210
                           const BigInt& y,
211
                           secure_vector<word>& ws) const override;
212
213
      void curve_mul_tmp(BigInt& x, const BigInt& y, BigInt& tmp, secure_vector<word>& ws) const
214
1.18M
         {
215
1.18M
         curve_mul(tmp, x, y, ws);
216
1.18M
         x.swap(tmp);
217
1.18M
         }
218
219
      void curve_sqr_tmp(BigInt& x, BigInt& tmp, secure_vector<word>& ws) const
220
40.9M
         {
221
40.9M
         curve_sqr(tmp, x, ws);
222
40.9M
         x.swap(tmp);
223
40.9M
         }
224
225
      void curve_sqr_words(BigInt& z,
226
                           const word x_words[],
227
                           size_t x_size,
228
                           secure_vector<word>& ws) const override;
229
   private:
230
      // Curve parameters
231
      BigInt m_1;
232
      BigInt m_a, m_b;
233
      size_t m_p_words; // cache of m_p.sig_words()
234
   };
235
236
BigInt CurveGFp_NIST::invert_element(const BigInt& x, secure_vector<word>& ws) const
237
396
   {
238
396
   BOTAN_UNUSED(ws);
239
396
   return inverse_mod(x, get_p());
240
396
   }
241
242
void CurveGFp_NIST::curve_mul_words(BigInt& z,
243
                                    const word x_w[],
244
                                    size_t x_size,
245
                                    const BigInt& y,
246
                                    secure_vector<word>& ws) const
247
113M
   {
248
113M
   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
249
113M
250
113M
   if(ws.size() < get_ws_size())
251
0
      ws.resize(get_ws_size());
252
113M
253
113M
   const size_t output_size = 2*m_p_words + 2;
254
113M
   if(z.size() < output_size)
255
3.74M
      z.grow_to(output_size);
256
113M
257
113M
   bigint_mul(z.mutable_data(), z.size(),
258
113M
              x_w, x_size, std::min(m_p_words, x_size),
259
113M
              y.data(), y.size(), std::min(m_p_words, y.size()),
260
113M
              ws.data(), ws.size());
261
113M
262
113M
   this->redc_mod_p(z, ws);
263
113M
   }
264
265
void CurveGFp_NIST::curve_sqr_words(BigInt& z, const word x[], size_t x_size,
266
                                    secure_vector<word>& ws) const
267
105M
   {
268
105M
   if(ws.size() < get_ws_size())
269
160k
      ws.resize(get_ws_size());
270
105M
271
105M
   const size_t output_size = 2*m_p_words + 2;
272
105M
   if(z.size() < output_size)
273
10.3M
      z.grow_to(output_size);
274
105M
275
105M
   bigint_sqr(z.mutable_data(), output_size,
276
105M
              x, x_size, std::min(m_p_words, x_size),
277
105M
              ws.data(), ws.size());
278
105M
279
105M
   this->redc_mod_p(z, ws);
280
105M
   }
281
282
/**
283
* The NIST P-192 curve
284
*/
285
class CurveGFp_P192 final : public CurveGFp_NIST
286
   {
287
   public:
288
28
      CurveGFp_P192(const BigInt& a, const BigInt& b) : CurveGFp_NIST(192, a, b) {}
289
24.6k
      const BigInt& get_p() const override { return prime_p192(); }
290
   private:
291
423k
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p192(x, ws); }
292
   };
293
294
/**
295
* The NIST P-224 curve
296
*/
297
class CurveGFp_P224 final : public CurveGFp_NIST
298
   {
299
   public:
300
271
      CurveGFp_P224(const BigInt& a, const BigInt& b) : CurveGFp_NIST(224, a, b) {}
301
309k
      const BigInt& get_p() const override { return prime_p224(); }
302
   private:
303
5.28M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p224(x, ws); }
304
   };
305
306
/**
307
* The NIST P-256 curve
308
*/
309
class CurveGFp_P256 final : public CurveGFp_NIST
310
   {
311
   public:
312
22
      CurveGFp_P256(const BigInt& a, const BigInt& b) : CurveGFp_NIST(256, a, b) {}
313
2.71M
      const BigInt& get_p() const override { return prime_p256(); }
314
   private:
315
34.7M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p256(x, ws); }
316
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
317
   };
318
319
BigInt CurveGFp_P256::invert_element(const BigInt& x, secure_vector<word>& ws) const
320
27.1k
   {
321
27.1k
   BigInt r, p2, p4, p8, p16, p32, tmp;
322
27.1k
323
27.1k
   curve_sqr(r, x, ws);
324
27.1k
325
27.1k
   curve_mul(p2, r, x, ws);
326
27.1k
   curve_sqr(r, p2, ws);
327
27.1k
   curve_sqr_tmp(r, tmp, ws);
328
27.1k
329
27.1k
   curve_mul(p4, r, p2, ws);
330
27.1k
331
27.1k
   curve_sqr(r, p4, ws);
332
108k
   for(size_t i = 0; i != 3; ++i)
333
81.3k
      curve_sqr_tmp(r, tmp, ws);
334
27.1k
   curve_mul(p8, r, p4, ws);
335
27.1k
336
27.1k
   curve_sqr(r, p8, ws);
337
216k
   for(size_t i = 0; i != 7; ++i)
338
189k
      curve_sqr_tmp(r, tmp, ws);
339
27.1k
   curve_mul(p16, r, p8, ws);
340
27.1k
341
27.1k
   curve_sqr(r, p16, ws);
342
433k
   for(size_t i = 0; i != 15; ++i)
343
406k
      curve_sqr_tmp(r, tmp, ws);
344
27.1k
   curve_mul(p32, r, p16, ws);
345
27.1k
346
27.1k
   curve_sqr(r, p32, ws);
347
867k
   for(size_t i = 0; i != 31; ++i)
348
840k
      curve_sqr_tmp(r, tmp, ws);
349
27.1k
   curve_mul_tmp(r, x, tmp, ws);
350
27.1k
351
3.49M
   for(size_t i = 0; i != 32*4; ++i)
352
3.47M
      curve_sqr_tmp(r, tmp, ws);
353
27.1k
   curve_mul_tmp(r, p32, tmp, ws);
354
27.1k
355
894k
   for(size_t i = 0; i != 32; ++i)
356
867k
      curve_sqr_tmp(r, tmp, ws);
357
27.1k
   curve_mul_tmp(r, p32, tmp, ws);
358
27.1k
359
461k
   for(size_t i = 0; i != 16; ++i)
360
433k
      curve_sqr_tmp(r, tmp, ws);
361
27.1k
   curve_mul_tmp(r, p16, tmp, ws);
362
244k
   for(size_t i = 0; i != 8; ++i)
363
216k
      curve_sqr_tmp(r, tmp, ws);
364
27.1k
   curve_mul_tmp(r, p8, tmp, ws);
365
27.1k
366
135k
   for(size_t i = 0; i != 4; ++i)
367
108k
      curve_sqr_tmp(r, tmp, ws);
368
27.1k
   curve_mul_tmp(r, p4, tmp, ws);
369
27.1k
370
81.3k
   for(size_t i = 0; i != 2; ++i)
371
54.2k
      curve_sqr_tmp(r, tmp, ws);
372
27.1k
   curve_mul_tmp(r, p2, tmp, ws);
373
27.1k
374
81.3k
   for(size_t i = 0; i != 2; ++i)
375
54.2k
      curve_sqr_tmp(r, tmp, ws);
376
27.1k
   curve_mul_tmp(r, x, tmp, ws);
377
27.1k
378
27.1k
   return r;
379
27.1k
   }
380
381
/**
382
* The NIST P-384 curve
383
*/
384
class CurveGFp_P384 final : public CurveGFp_NIST
385
   {
386
   public:
387
70
      CurveGFp_P384(const BigInt& a, const BigInt& b) : CurveGFp_NIST(384, a, b) {}
388
3.85M
      const BigInt& get_p() const override { return prime_p384(); }
389
   private:
390
49.9M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p384(x, ws); }
391
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
392
   };
393
394
BigInt CurveGFp_P384::invert_element(const BigInt& x, secure_vector<word>& ws) const
395
26.2k
   {
396
26.2k
   // From https://briansmith.org/ecc-inversion-addition-chains-01
397
26.2k
398
26.2k
   BigInt r, x2, x3, x15, x30, tmp, rl;
399
26.2k
400
26.2k
   r = x;
401
26.2k
   curve_sqr_tmp(r, tmp, ws);
402
26.2k
   curve_mul_tmp(r, x, tmp, ws);
403
26.2k
   x2 = r;
404
26.2k
405
26.2k
   curve_sqr_tmp(r, tmp, ws);
406
26.2k
   curve_mul_tmp(r, x, tmp, ws);
407
26.2k
408
26.2k
   x3 = r;
409
26.2k
410
105k
   for(size_t i = 0; i != 3; ++i)
411
78.7k
      curve_sqr_tmp(r, tmp, ws);
412
26.2k
   curve_mul_tmp(r, x3, tmp, ws);
413
26.2k
414
26.2k
   rl = r;
415
183k
   for(size_t i = 0; i != 6; ++i)
416
157k
      curve_sqr_tmp(r, tmp, ws);
417
26.2k
   curve_mul_tmp(r, rl, tmp, ws);
418
26.2k
419
105k
   for(size_t i = 0; i != 3; ++i)
420
78.7k
      curve_sqr_tmp(r, tmp, ws);
421
26.2k
   curve_mul_tmp(r, x3, tmp, ws);
422
26.2k
423
26.2k
   x15 = r;
424
420k
   for(size_t i = 0; i != 15; ++i)
425
393k
      curve_sqr_tmp(r, tmp, ws);
426
26.2k
   curve_mul_tmp(r, x15, tmp, ws);
427
26.2k
428
26.2k
   x30 = r;
429
813k
   for(size_t i = 0; i != 30; ++i)
430
787k
      curve_sqr_tmp(r, tmp, ws);
431
26.2k
   curve_mul_tmp(r, x30, tmp, ws);
432
26.2k
433
26.2k
   rl = r;
434
1.60M
   for(size_t i = 0; i != 60; ++i)
435
1.57M
      curve_sqr_tmp(r, tmp, ws);
436
26.2k
   curve_mul_tmp(r, rl, tmp, ws);
437
26.2k
438
26.2k
   rl = r;
439
3.17M
   for(size_t i = 0; i != 120; ++i)
440
3.15M
      curve_sqr_tmp(r, tmp, ws);
441
26.2k
   curve_mul_tmp(r, rl, tmp, ws);
442
26.2k
443
420k
   for(size_t i = 0; i != 15; ++i)
444
393k
      curve_sqr_tmp(r, tmp, ws);
445
26.2k
   curve_mul_tmp(r, x15, tmp, ws);
446
26.2k
447
840k
   for(size_t i = 0; i != 31; ++i)
448
813k
      curve_sqr_tmp(r, tmp, ws);
449
26.2k
   curve_mul_tmp(r, x30, tmp, ws);
450
26.2k
451
78.7k
   for(size_t i = 0; i != 2; ++i)
452
52.5k
      curve_sqr_tmp(r, tmp, ws);
453
26.2k
   curve_mul_tmp(r, x2, tmp, ws);
454
26.2k
455
2.49M
   for(size_t i = 0; i != 94; ++i)
456
2.46M
      curve_sqr_tmp(r, tmp, ws);
457
26.2k
   curve_mul_tmp(r, x30, tmp, ws);
458
26.2k
459
78.7k
   for(size_t i = 0; i != 2; ++i)
460
52.5k
      curve_sqr_tmp(r, tmp, ws);
461
26.2k
462
26.2k
   curve_mul_tmp(r, x, tmp, ws);
463
26.2k
464
26.2k
   return r;
465
26.2k
   }
466
467
/**
468
* The NIST P-521 curve
469
*/
470
class CurveGFp_P521 final : public CurveGFp_NIST
471
   {
472
   public:
473
219
      CurveGFp_P521(const BigInt& a, const BigInt& b) : CurveGFp_NIST(521, a, b) {}
474
9.89M
      const BigInt& get_p() const override { return prime_p521(); }
475
   private:
476
128M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p521(x, ws); }
477
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
478
   };
479
480
BigInt CurveGFp_P521::invert_element(const BigInt& x, secure_vector<word>& ws) const
481
46.4k
   {
482
46.4k
   // Addition chain from https://eprint.iacr.org/2014/852.pdf section
483
46.4k
484
46.4k
   BigInt r;
485
46.4k
   BigInt rl;
486
46.4k
   BigInt a7;
487
46.4k
   BigInt tmp;
488
46.4k
489
46.4k
   curve_sqr(r, x, ws);
490
46.4k
   curve_mul_tmp(r, x, tmp, ws);
491
46.4k
492
46.4k
   curve_sqr_tmp(r, tmp, ws);
493
46.4k
   curve_mul_tmp(r, x, tmp, ws);
494
46.4k
495
46.4k
   rl = r;
496
46.4k
497
185k
   for(size_t i = 0; i != 3; ++i)
498
139k
      curve_sqr_tmp(r, tmp, ws);
499
46.4k
   curve_mul_tmp(r, rl, tmp, ws);
500
46.4k
501
46.4k
   curve_sqr_tmp(r, tmp, ws);
502
46.4k
   curve_mul_tmp(r, x, tmp, ws);
503
46.4k
   a7 = r; // need this value later
504
46.4k
505
46.4k
   curve_sqr_tmp(r, tmp, ws);
506
46.4k
   curve_mul_tmp(r, x, tmp, ws);
507
46.4k
508
46.4k
   rl = r;
509
418k
   for(size_t i = 0; i != 8; ++i)
510
371k
      curve_sqr_tmp(r, tmp, ws);
511
46.4k
   curve_mul_tmp(r, rl, tmp, ws);
512
46.4k
513
46.4k
   rl = r;
514
789k
   for(size_t i = 0; i != 16; ++i)
515
743k
      curve_sqr_tmp(r, tmp, ws);
516
46.4k
   curve_mul_tmp(r, rl, tmp, ws);
517
46.4k
518
46.4k
    rl = r;
519
1.53M
    for(size_t i = 0; i != 32; ++i)
520
1.48M
        curve_sqr_tmp(r, tmp, ws);
521
46.4k
    curve_mul_tmp(r, rl, tmp, ws);
522
46.4k
523
46.4k
    rl = r;
524
3.02M
    for(size_t i = 0; i != 64; ++i)
525
2.97M
        curve_sqr_tmp(r, tmp, ws);
526
46.4k
    curve_mul_tmp(r, rl, tmp, ws);
527
46.4k
528
46.4k
    rl = r;
529
5.99M
    for(size_t i = 0; i != 128; ++i)
530
5.94M
        curve_sqr_tmp(r, tmp, ws);
531
46.4k
    curve_mul_tmp(r, rl, tmp, ws);
532
46.4k
533
46.4k
    rl = r;
534
11.9M
    for(size_t i = 0; i != 256; ++i)
535
11.8M
        curve_sqr_tmp(r, tmp, ws);
536
46.4k
    curve_mul_tmp(r, rl, tmp, ws);
537
46.4k
538
371k
    for(size_t i = 0; i != 7; ++i)
539
325k
        curve_sqr_tmp(r, tmp, ws);
540
46.4k
    curve_mul_tmp(r, a7, tmp, ws);
541
46.4k
542
139k
    for(size_t i = 0; i != 2; ++i)
543
92.9k
       curve_sqr_tmp(r, tmp, ws);
544
46.4k
    curve_mul_tmp(r, x, tmp, ws);
545
46.4k
546
46.4k
    return r;
547
46.4k
   }
548
549
}
550
551
std::shared_ptr<CurveGFp_Repr>
552
CurveGFp::choose_repr(const BigInt& p, const BigInt& a, const BigInt& b)
553
1.21k
   {
554
1.21k
   if(p == prime_p192())
555
28
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P192(a, b));
556
1.18k
   if(p == prime_p224())
557
271
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P224(a, b));
558
916
   if(p == prime_p256())
559
22
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P256(a, b));
560
894
   if(p == prime_p384())
561
70
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P384(a, b));
562
824
   if(p == prime_p521())
563
219
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P521(a, b));
564
605
565
605
   return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_Montgomery(p, a, b));
566
605
   }
567
568
}