Coverage Report

Created: 2020-06-30 13:58

/src/botan/src/lib/pubkey/ec_group/curve_gfp.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* Elliptic curves over GF(p) Montgomery Representation
3
* (C) 2014,2015,2018 Jack Lloyd
4
*     2016 Matthias Gierlings
5
*
6
* Botan is released under the Simplified BSD License (see license.txt)
7
*/
8
9
#include <botan/curve_gfp.h>
10
#include <botan/curve_nistp.h>
11
#include <botan/numthry.h>
12
#include <botan/reducer.h>
13
#include <botan/internal/mp_core.h>
14
#include <botan/internal/mp_asmi.h>
15
16
namespace Botan {
17
18
namespace {
19
20
class CurveGFp_Montgomery final : public CurveGFp_Repr
21
   {
22
   public:
23
      CurveGFp_Montgomery(const BigInt& p, const BigInt& a, const BigInt& b) :
24
         m_p(p), m_a(a), m_b(b),
25
         m_p_words(m_p.sig_words()),
26
         m_p_dash(monty_inverse(m_p.word_at(0)))
27
635
         {
28
635
         Modular_Reducer mod_p(m_p);
29
635
30
635
         m_r.set_bit(m_p_words * BOTAN_MP_WORD_BITS);
31
635
         m_r = mod_p.reduce(m_r);
32
635
33
635
         m_r2  = mod_p.square(m_r);
34
635
         m_r3  = mod_p.multiply(m_r, m_r2);
35
635
         m_a_r = mod_p.multiply(m_r, m_a);
36
635
         m_b_r = mod_p.multiply(m_r, m_b);
37
635
38
635
         m_a_is_zero = m_a.is_zero();
39
635
         m_a_is_minus_3 = (m_a + 3 == m_p);
40
635
         }
41
42
2.57M
      bool a_is_zero() const override { return m_a_is_zero; }
43
2.43M
      bool a_is_minus_3() const override { return m_a_is_minus_3; }
44
45
5.46k
      const BigInt& get_a() const override { return m_a; }
46
47
5.46k
      const BigInt& get_b() const override { return m_b; }
48
49
4.41M
      const BigInt& get_p() const override { return m_p; }
50
51
2.36M
      const BigInt& get_a_rep() const override { return m_a_r; }
52
53
11.4k
      const BigInt& get_b_rep() const override { return m_b_r; }
54
55
49.2k
      const BigInt& get_1_rep() const override { return m_r; }
56
57
34.6k
      bool is_one(const BigInt& x) const override { return x == m_r; }
58
59
432k
      size_t get_p_words() const override { return m_p_words; }
60
61
57.5M
      size_t get_ws_size() const override { return 2*m_p_words + 4; }
62
63
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
64
65
      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override;
66
67
      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override;
68
69
      void curve_mul_words(BigInt& z,
70
                           const word x_words[],
71
                           const size_t x_size,
72
                           const BigInt& y,
73
                           secure_vector<word>& ws) const override;
74
75
      void curve_sqr_words(BigInt& z,
76
                           const word x_words[],
77
                           size_t x_size,
78
                           secure_vector<word>& ws) const override;
79
80
   private:
81
      BigInt m_p;
82
      BigInt m_a, m_b;
83
      BigInt m_a_r, m_b_r;
84
      size_t m_p_words; // cache of m_p.sig_words()
85
86
      // Montgomery parameters
87
      BigInt m_r, m_r2, m_r3;
88
      word m_p_dash;
89
90
      bool m_a_is_zero;
91
      bool m_a_is_minus_3;
92
   };
93
94
BigInt CurveGFp_Montgomery::invert_element(const BigInt& x, secure_vector<word>& ws) const
95
35.1k
   {
96
35.1k
   // Should we use Montgomery inverse instead?
97
35.1k
   const BigInt inv = inverse_mod(x, m_p);
98
35.1k
   BigInt res;
99
35.1k
   curve_mul(res, inv, m_r3, ws);
100
35.1k
   return res;
101
35.1k
   }
102
103
void CurveGFp_Montgomery::to_curve_rep(BigInt& x, secure_vector<word>& ws) const
104
8.02k
   {
105
8.02k
   const BigInt tx = x;
106
8.02k
   curve_mul(x, tx, m_r2, ws);
107
8.02k
   }
108
109
void CurveGFp_Montgomery::from_curve_rep(BigInt& z, secure_vector<word>& ws) const
110
54.5k
   {
111
54.5k
   if(ws.size() < get_ws_size())
112
322
      ws.resize(get_ws_size());
113
54.5k
114
54.5k
   const size_t output_size = 2*m_p_words + 2;
115
54.5k
   if(z.size() < output_size)
116
11.1k
      z.grow_to(output_size);
117
54.5k
118
54.5k
   bigint_monty_redc(z.mutable_data(),
119
54.5k
                     m_p.data(), m_p_words, m_p_dash,
120
54.5k
                     ws.data(), ws.size());
121
54.5k
   }
122
123
void CurveGFp_Montgomery::curve_mul_words(BigInt& z,
124
                                          const word x_w[],
125
                                          size_t x_size,
126
                                          const BigInt& y,
127
                                          secure_vector<word>& ws) const
128
31.1M
   {
129
31.1M
   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
130
31.1M
131
31.1M
   if(ws.size() < get_ws_size())
132
0
      ws.resize(get_ws_size());
133
31.1M
134
31.1M
   const size_t output_size = 2*m_p_words + 2;
135
31.1M
   if(z.size() < output_size)
136
1.89M
      z.grow_to(output_size);
137
31.1M
138
31.1M
   bigint_mul(z.mutable_data(), z.size(),
139
31.1M
              x_w, x_size, std::min(m_p_words, x_size),
140
31.1M
              y.data(), y.size(), std::min(m_p_words, y.size()),
141
31.1M
              ws.data(), ws.size());
142
31.1M
143
31.1M
   bigint_monty_redc(z.mutable_data(),
144
31.1M
                     m_p.data(), m_p_words, m_p_dash,
145
31.1M
                     ws.data(), ws.size());
146
31.1M
   }
147
148
void CurveGFp_Montgomery::curve_sqr_words(BigInt& z,
149
                                          const word x[],
150
                                          size_t x_size,
151
                                          secure_vector<word>& ws) const
152
21.8M
   {
153
21.8M
   if(ws.size() < get_ws_size())
154
51.9k
      ws.resize(get_ws_size());
155
21.8M
156
21.8M
   const size_t output_size = 2*m_p_words + 2;
157
21.8M
   if(z.size() < output_size)
158
169k
      z.grow_to(output_size);
159
21.8M
160
21.8M
   bigint_sqr(z.mutable_data(), z.size(),
161
21.8M
              x, x_size, std::min(m_p_words, x_size),
162
21.8M
              ws.data(), ws.size());
163
21.8M
164
21.8M
   bigint_monty_redc(z.mutable_data(),
165
21.8M
                     m_p.data(), m_p_words, m_p_dash,
166
21.8M
                     ws.data(), ws.size());
167
21.8M
   }
168
169
class CurveGFp_NIST : public CurveGFp_Repr
170
   {
171
   public:
172
      CurveGFp_NIST(size_t p_bits, const BigInt& a, const BigInt& b) :
173
         m_1(1), m_a(a), m_b(b), m_p_words((p_bits + BOTAN_MP_WORD_BITS - 1) / BOTAN_MP_WORD_BITS)
174
669
         {
175
669
         // All Solinas prime curves are assumed a == -3
176
669
         }
177
178
11.2M
      bool a_is_zero() const override { return false; }
179
11.2M
      bool a_is_minus_3() const override { return true; }
180
181
18.8k
      const BigInt& get_a() const override { return m_a; }
182
183
18.8k
      const BigInt& get_b() const override { return m_b; }
184
185
116k
      const BigInt& get_1_rep() const override { return m_1; }
186
187
1.14M
      size_t get_p_words() const override { return m_p_words; }
188
189
267M
      size_t get_ws_size() const override { return 2*m_p_words + 4; }
190
191
35.0k
      const BigInt& get_a_rep() const override { return m_a; }
192
193
47.0k
      const BigInt& get_b_rep() const override { return m_b; }
194
195
115k
      bool is_one(const BigInt& x) const override { return x == 1; }
196
197
      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override
198
28.5k
         { redc_mod_p(x, ws); }
199
200
      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override
201
197k
         { redc_mod_p(x, ws); }
202
203
      virtual void redc_mod_p(BigInt& z, secure_vector<word>& ws) const = 0;
204
205
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
206
207
      void curve_mul_words(BigInt& z,
208
                           const word x_words[],
209
                           const size_t x_size,
210
                           const BigInt& y,
211
                           secure_vector<word>& ws) const override;
212
213
      void curve_mul_tmp(BigInt& x, const BigInt& y, BigInt& tmp, secure_vector<word>& ws) const
214
1.38M
         {
215
1.38M
         curve_mul(tmp, x, y, ws);
216
1.38M
         x.swap(tmp);
217
1.38M
         }
218
219
      void curve_sqr_tmp(BigInt& x, BigInt& tmp, secure_vector<word>& ws) const
220
47.6M
         {
221
47.6M
         curve_sqr(tmp, x, ws);
222
47.6M
         x.swap(tmp);
223
47.6M
         }
224
225
      void curve_sqr_words(BigInt& z,
226
                           const word x_words[],
227
                           size_t x_size,
228
                           secure_vector<word>& ws) const override;
229
   private:
230
      // Curve parameters
231
      BigInt m_1;
232
      BigInt m_a, m_b;
233
      size_t m_p_words; // cache of m_p.sig_words()
234
   };
235
236
BigInt CurveGFp_NIST::invert_element(const BigInt& x, secure_vector<word>& ws) const
237
552
   {
238
552
   BOTAN_UNUSED(ws);
239
552
   return inverse_mod(x, get_p());
240
552
   }
241
242
void CurveGFp_NIST::curve_mul_words(BigInt& z,
243
                                    const word x_w[],
244
                                    size_t x_size,
245
                                    const BigInt& y,
246
                                    secure_vector<word>& ws) const
247
127M
   {
248
127M
   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
249
127M
250
127M
   if(ws.size() < get_ws_size())
251
0
      ws.resize(get_ws_size());
252
127M
253
127M
   const size_t output_size = 2*m_p_words + 2;
254
127M
   if(z.size() < output_size)
255
4.27M
      z.grow_to(output_size);
256
127M
257
127M
   bigint_mul(z.mutable_data(), z.size(),
258
127M
              x_w, x_size, std::min(m_p_words, x_size),
259
127M
              y.data(), y.size(), std::min(m_p_words, y.size()),
260
127M
              ws.data(), ws.size());
261
127M
262
127M
   this->redc_mod_p(z, ws);
263
127M
   }
264
265
void CurveGFp_NIST::curve_sqr_words(BigInt& z, const word x[], size_t x_size,
266
                                    secure_vector<word>& ws) const
267
120M
   {
268
120M
   if(ws.size() < get_ws_size())
269
182k
      ws.resize(get_ws_size());
270
120M
271
120M
   const size_t output_size = 2*m_p_words + 2;
272
120M
   if(z.size() < output_size)
273
11.7M
      z.grow_to(output_size);
274
120M
275
120M
   bigint_sqr(z.mutable_data(), output_size,
276
120M
              x, x_size, std::min(m_p_words, x_size),
277
120M
              ws.data(), ws.size());
278
120M
279
120M
   this->redc_mod_p(z, ws);
280
120M
   }
281
282
/**
283
* The NIST P-192 curve
284
*/
285
class CurveGFp_P192 final : public CurveGFp_NIST
286
   {
287
   public:
288
26
      CurveGFp_P192(const BigInt& a, const BigInt& b) : CurveGFp_NIST(192, a, b) {}
289
22.9k
      const BigInt& get_p() const override { return prime_p192(); }
290
   private:
291
389k
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p192(x, ws); }
292
   };
293
294
/**
295
* The NIST P-224 curve
296
*/
297
class CurveGFp_P224 final : public CurveGFp_NIST
298
   {
299
   public:
300
278
      CurveGFp_P224(const BigInt& a, const BigInt& b) : CurveGFp_NIST(224, a, b) {}
301
329k
      const BigInt& get_p() const override { return prime_p224(); }
302
   private:
303
5.54M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p224(x, ws); }
304
   };
305
306
/**
307
* The NIST P-256 curve
308
*/
309
class CurveGFp_P256 final : public CurveGFp_NIST
310
   {
311
   public:
312
20
      CurveGFp_P256(const BigInt& a, const BigInt& b) : CurveGFp_NIST(256, a, b) {}
313
3.08M
      const BigInt& get_p() const override { return prime_p256(); }
314
   private:
315
39.8M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p256(x, ws); }
316
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
317
   };
318
319
BigInt CurveGFp_P256::invert_element(const BigInt& x, secure_vector<word>& ws) const
320
31.9k
   {
321
31.9k
   BigInt r, p2, p4, p8, p16, p32, tmp;
322
31.9k
323
31.9k
   curve_sqr(r, x, ws);
324
31.9k
325
31.9k
   curve_mul(p2, r, x, ws);
326
31.9k
   curve_sqr(r, p2, ws);
327
31.9k
   curve_sqr_tmp(r, tmp, ws);
328
31.9k
329
31.9k
   curve_mul(p4, r, p2, ws);
330
31.9k
331
31.9k
   curve_sqr(r, p4, ws);
332
127k
   for(size_t i = 0; i != 3; ++i)
333
95.8k
      curve_sqr_tmp(r, tmp, ws);
334
31.9k
   curve_mul(p8, r, p4, ws);
335
31.9k
336
31.9k
   curve_sqr(r, p8, ws);
337
255k
   for(size_t i = 0; i != 7; ++i)
338
223k
      curve_sqr_tmp(r, tmp, ws);
339
31.9k
   curve_mul(p16, r, p8, ws);
340
31.9k
341
31.9k
   curve_sqr(r, p16, ws);
342
511k
   for(size_t i = 0; i != 15; ++i)
343
479k
      curve_sqr_tmp(r, tmp, ws);
344
31.9k
   curve_mul(p32, r, p16, ws);
345
31.9k
346
31.9k
   curve_sqr(r, p32, ws);
347
1.02M
   for(size_t i = 0; i != 31; ++i)
348
990k
      curve_sqr_tmp(r, tmp, ws);
349
31.9k
   curve_mul_tmp(r, x, tmp, ws);
350
31.9k
351
4.12M
   for(size_t i = 0; i != 32*4; ++i)
352
4.09M
      curve_sqr_tmp(r, tmp, ws);
353
31.9k
   curve_mul_tmp(r, p32, tmp, ws);
354
31.9k
355
1.05M
   for(size_t i = 0; i != 32; ++i)
356
1.02M
      curve_sqr_tmp(r, tmp, ws);
357
31.9k
   curve_mul_tmp(r, p32, tmp, ws);
358
31.9k
359
543k
   for(size_t i = 0; i != 16; ++i)
360
511k
      curve_sqr_tmp(r, tmp, ws);
361
31.9k
   curve_mul_tmp(r, p16, tmp, ws);
362
287k
   for(size_t i = 0; i != 8; ++i)
363
255k
      curve_sqr_tmp(r, tmp, ws);
364
31.9k
   curve_mul_tmp(r, p8, tmp, ws);
365
31.9k
366
159k
   for(size_t i = 0; i != 4; ++i)
367
127k
      curve_sqr_tmp(r, tmp, ws);
368
31.9k
   curve_mul_tmp(r, p4, tmp, ws);
369
31.9k
370
95.8k
   for(size_t i = 0; i != 2; ++i)
371
63.9k
      curve_sqr_tmp(r, tmp, ws);
372
31.9k
   curve_mul_tmp(r, p2, tmp, ws);
373
31.9k
374
95.8k
   for(size_t i = 0; i != 2; ++i)
375
63.9k
      curve_sqr_tmp(r, tmp, ws);
376
31.9k
   curve_mul_tmp(r, x, tmp, ws);
377
31.9k
378
31.9k
   return r;
379
31.9k
   }
380
381
/**
382
* The NIST P-384 curve
383
*/
384
class CurveGFp_P384 final : public CurveGFp_NIST
385
   {
386
   public:
387
79
      CurveGFp_P384(const BigInt& a, const BigInt& b) : CurveGFp_NIST(384, a, b) {}
388
4.33M
      const BigInt& get_p() const override { return prime_p384(); }
389
   private:
390
56.5M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p384(x, ws); }
391
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
392
   };
393
394
BigInt CurveGFp_P384::invert_element(const BigInt& x, secure_vector<word>& ws) const
395
30.5k
   {
396
30.5k
   // From https://briansmith.org/ecc-inversion-addition-chains-01
397
30.5k
398
30.5k
   BigInt r, x2, x3, x15, x30, tmp, rl;
399
30.5k
400
30.5k
   r = x;
401
30.5k
   curve_sqr_tmp(r, tmp, ws);
402
30.5k
   curve_mul_tmp(r, x, tmp, ws);
403
30.5k
   x2 = r;
404
30.5k
405
30.5k
   curve_sqr_tmp(r, tmp, ws);
406
30.5k
   curve_mul_tmp(r, x, tmp, ws);
407
30.5k
408
30.5k
   x3 = r;
409
30.5k
410
122k
   for(size_t i = 0; i != 3; ++i)
411
91.7k
      curve_sqr_tmp(r, tmp, ws);
412
30.5k
   curve_mul_tmp(r, x3, tmp, ws);
413
30.5k
414
30.5k
   rl = r;
415
214k
   for(size_t i = 0; i != 6; ++i)
416
183k
      curve_sqr_tmp(r, tmp, ws);
417
30.5k
   curve_mul_tmp(r, rl, tmp, ws);
418
30.5k
419
122k
   for(size_t i = 0; i != 3; ++i)
420
91.7k
      curve_sqr_tmp(r, tmp, ws);
421
30.5k
   curve_mul_tmp(r, x3, tmp, ws);
422
30.5k
423
30.5k
   x15 = r;
424
489k
   for(size_t i = 0; i != 15; ++i)
425
458k
      curve_sqr_tmp(r, tmp, ws);
426
30.5k
   curve_mul_tmp(r, x15, tmp, ws);
427
30.5k
428
30.5k
   x30 = r;
429
948k
   for(size_t i = 0; i != 30; ++i)
430
917k
      curve_sqr_tmp(r, tmp, ws);
431
30.5k
   curve_mul_tmp(r, x30, tmp, ws);
432
30.5k
433
30.5k
   rl = r;
434
1.86M
   for(size_t i = 0; i != 60; ++i)
435
1.83M
      curve_sqr_tmp(r, tmp, ws);
436
30.5k
   curve_mul_tmp(r, rl, tmp, ws);
437
30.5k
438
30.5k
   rl = r;
439
3.70M
   for(size_t i = 0; i != 120; ++i)
440
3.67M
      curve_sqr_tmp(r, tmp, ws);
441
30.5k
   curve_mul_tmp(r, rl, tmp, ws);
442
30.5k
443
489k
   for(size_t i = 0; i != 15; ++i)
444
458k
      curve_sqr_tmp(r, tmp, ws);
445
30.5k
   curve_mul_tmp(r, x15, tmp, ws);
446
30.5k
447
978k
   for(size_t i = 0; i != 31; ++i)
448
948k
      curve_sqr_tmp(r, tmp, ws);
449
30.5k
   curve_mul_tmp(r, x30, tmp, ws);
450
30.5k
451
91.7k
   for(size_t i = 0; i != 2; ++i)
452
61.1k
      curve_sqr_tmp(r, tmp, ws);
453
30.5k
   curve_mul_tmp(r, x2, tmp, ws);
454
30.5k
455
2.90M
   for(size_t i = 0; i != 94; ++i)
456
2.87M
      curve_sqr_tmp(r, tmp, ws);
457
30.5k
   curve_mul_tmp(r, x30, tmp, ws);
458
30.5k
459
91.7k
   for(size_t i = 0; i != 2; ++i)
460
61.1k
      curve_sqr_tmp(r, tmp, ws);
461
30.5k
462
30.5k
   curve_mul_tmp(r, x, tmp, ws);
463
30.5k
464
30.5k
   return r;
465
30.5k
   }
466
467
/**
468
* The NIST P-521 curve
469
*/
470
class CurveGFp_P521 final : public CurveGFp_NIST
471
   {
472
   public:
473
266
      CurveGFp_P521(const BigInt& a, const BigInt& b) : CurveGFp_NIST(521, a, b) {}
474
11.2M
      const BigInt& get_p() const override { return prime_p521(); }
475
   private:
476
146M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p521(x, ws); }
477
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
478
   };
479
480
BigInt CurveGFp_P521::invert_element(const BigInt& x, secure_vector<word>& ws) const
481
53.8k
   {
482
53.8k
   // Addition chain from https://eprint.iacr.org/2014/852.pdf section
483
53.8k
484
53.8k
   BigInt r;
485
53.8k
   BigInt rl;
486
53.8k
   BigInt a7;
487
53.8k
   BigInt tmp;
488
53.8k
489
53.8k
   curve_sqr(r, x, ws);
490
53.8k
   curve_mul_tmp(r, x, tmp, ws);
491
53.8k
492
53.8k
   curve_sqr_tmp(r, tmp, ws);
493
53.8k
   curve_mul_tmp(r, x, tmp, ws);
494
53.8k
495
53.8k
   rl = r;
496
53.8k
497
215k
   for(size_t i = 0; i != 3; ++i)
498
161k
      curve_sqr_tmp(r, tmp, ws);
499
53.8k
   curve_mul_tmp(r, rl, tmp, ws);
500
53.8k
501
53.8k
   curve_sqr_tmp(r, tmp, ws);
502
53.8k
   curve_mul_tmp(r, x, tmp, ws);
503
53.8k
   a7 = r; // need this value later
504
53.8k
505
53.8k
   curve_sqr_tmp(r, tmp, ws);
506
53.8k
   curve_mul_tmp(r, x, tmp, ws);
507
53.8k
508
53.8k
   rl = r;
509
484k
   for(size_t i = 0; i != 8; ++i)
510
430k
      curve_sqr_tmp(r, tmp, ws);
511
53.8k
   curve_mul_tmp(r, rl, tmp, ws);
512
53.8k
513
53.8k
   rl = r;
514
915k
   for(size_t i = 0; i != 16; ++i)
515
861k
      curve_sqr_tmp(r, tmp, ws);
516
53.8k
   curve_mul_tmp(r, rl, tmp, ws);
517
53.8k
518
53.8k
    rl = r;
519
1.77M
    for(size_t i = 0; i != 32; ++i)
520
1.72M
        curve_sqr_tmp(r, tmp, ws);
521
53.8k
    curve_mul_tmp(r, rl, tmp, ws);
522
53.8k
523
53.8k
    rl = r;
524
3.49M
    for(size_t i = 0; i != 64; ++i)
525
3.44M
        curve_sqr_tmp(r, tmp, ws);
526
53.8k
    curve_mul_tmp(r, rl, tmp, ws);
527
53.8k
528
53.8k
    rl = r;
529
6.94M
    for(size_t i = 0; i != 128; ++i)
530
6.88M
        curve_sqr_tmp(r, tmp, ws);
531
53.8k
    curve_mul_tmp(r, rl, tmp, ws);
532
53.8k
533
53.8k
    rl = r;
534
13.8M
    for(size_t i = 0; i != 256; ++i)
535
13.7M
        curve_sqr_tmp(r, tmp, ws);
536
53.8k
    curve_mul_tmp(r, rl, tmp, ws);
537
53.8k
538
430k
    for(size_t i = 0; i != 7; ++i)
539
376k
        curve_sqr_tmp(r, tmp, ws);
540
53.8k
    curve_mul_tmp(r, a7, tmp, ws);
541
53.8k
542
161k
    for(size_t i = 0; i != 2; ++i)
543
107k
       curve_sqr_tmp(r, tmp, ws);
544
53.8k
    curve_mul_tmp(r, x, tmp, ws);
545
53.8k
546
53.8k
    return r;
547
53.8k
   }
548
549
}
550
551
std::shared_ptr<CurveGFp_Repr>
552
CurveGFp::choose_repr(const BigInt& p, const BigInt& a, const BigInt& b)
553
1.30k
   {
554
1.30k
   if(p == prime_p192())
555
26
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P192(a, b));
556
1.27k
   if(p == prime_p224())
557
278
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P224(a, b));
558
1.00k
   if(p == prime_p256())
559
20
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P256(a, b));
560
980
   if(p == prime_p384())
561
79
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P384(a, b));
562
901
   if(p == prime_p521())
563
266
      return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_P521(a, b));
564
635
565
635
   return std::shared_ptr<CurveGFp_Repr>(new CurveGFp_Montgomery(p, a, b));
566
635
   }
567
568
}