/*

* Ed25519

* (C) 2017 Ribose Inc

*

* Based on the public domain code from SUPERCOP ref10 by

* Peter Schwabe, Daniel J. Bernstein, Niels Duif, Tanja Lange, Bo-Yin Yang

*

* Botan is released under the Simplified BSD License (see license.txt)

*/

#ifndef BOTAN_ED25519_INT_H_

#define BOTAN_ED25519_INT_H_

#include <botan/internal/ed25519_fe.h>

#include <botan/internal/loadstor.h>

namespace Botan {

inline uint64_t load_3(const uint8_t in[3])

   {

   return static_cast<uint64_t>(in[0]) |

      (static_cast<uint64_t>(in[1]) << 8) |

      (static_cast<uint64_t>(in[2]) << 16);

   }

inline uint64_t load_4(const uint8_t* in)

   {

   return load_le<uint32_t>(in, 0);

   }

template<size_t S, int64_t MUL=1>

inline void carry(int64_t& h0, int64_t& h1)

   {

   static_assert(S > 0 && S < 64, "Shift in range");

   const int64_t X1 = (static_cast<int64_t>(1) << S);

   const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));

   int64_t c = (h0 + X2)  >> S;

   h1 += c * MUL;

   h0 -= c * X1;

   }

void Botan::carry<21ul, 1l>(long&, long&)

Line

Count

Source

33

1.72k

   {

34

1.72k

   static_assert(S > 0 && S < 64, "Shift in range");

35

36

1.72k

   const int64_t X1 = (static_cast<int64_t>(1) << S);

37

1.72k

   const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));

38

1.72k

   int64_t c = (h0 + X2)  >> S;

39

1.72k

   h1 += c * MUL;

40

1.72k

   h0 -= c * X1;

41

1.72k

   }

void Botan::carry<26ul, 1l>(long&, long&)

Line

Count

Source

33

1.51M

   {

34

1.51M

   static_assert(S > 0 && S < 64, "Shift in range");

35

36

1.51M

   const int64_t X1 = (static_cast<int64_t>(1) << S);

37

1.51M

   const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));

38

1.51M

   int64_t c = (h0 + X2)  >> S;

39

1.51M

   h1 += c * MUL;

40

1.51M

   h0 -= c * X1;

41

1.51M

   }

void Botan::carry<25ul, 1l>(long&, long&)

Line

Count

Source

33

865k

   {

34

865k

   static_assert(S > 0 && S < 64, "Shift in range");

35

36

865k

   const int64_t X1 = (static_cast<int64_t>(1) << S);

37

865k

   const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));

38

865k

   int64_t c = (h0 + X2)  >> S;

39

865k

   h1 += c * MUL;

40

865k

   h0 -= c * X1;

41

865k

   }

void Botan::carry<25ul, 19l>(long&, long&)

Line

Count

Source

33

216k

   {

34

216k

   static_assert(S > 0 && S < 64, "Shift in range");

35

36

216k

   const int64_t X1 = (static_cast<int64_t>(1) << S);

37

216k

   const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));

38

216k

   int64_t c = (h0 + X2)  >> S;

39

216k

   h1 += c * MUL;

40

216k

   h0 -= c * X1;

41

216k

   }

template<size_t S>

inline void carry0(int64_t& h0, int64_t& h1)

   {

   static_assert(S > 0 && S < 64, "Shift in range");

   const int64_t X1 = (static_cast<int64_t>(1) << S);

   int64_t c = h0 >> S;

   h1 += c;

   h0 -= c * X1;

   }

template<size_t S>

inline void carry0(int32_t& h0, int32_t& h1)

   {

   static_assert(S > 0 && S < 32, "Shift in range");

   const int32_t X1 = (static_cast<int64_t>(1) << S);

   int32_t c = h0 >> S;

   h1 += c;

   h0 -= c * X1;

   }

void Botan::carry0<26ul>(int&, int&)

Line

Count

Source

56

1.69k

   {

57

1.69k

   static_assert(S > 0 && S < 32, "Shift in range");

58

59

1.69k

   const int32_t X1 = (static_cast<int64_t>(1) << S);

60

1.69k

   int32_t c = h0 >> S;

61

1.69k

   h1 += c;

62

1.69k

   h0 -= c * X1;

63

1.69k

   }

void Botan::carry0<25ul>(int&, int&)

Line

Count

Source

56

1.35k

   {

57

1.35k

   static_assert(S > 0 && S < 32, "Shift in range");

58

59

1.35k

   const int32_t X1 = (static_cast<int64_t>(1) << S);

60

1.35k

   int32_t c = h0 >> S;

61

1.35k

   h1 += c;

62

1.35k

   h0 -= c * X1;

63

1.35k

   }

inline void redc_mul(int64_t& s1,

                     int64_t& s2,

                     int64_t& s3,

                     int64_t& s4,

                     int64_t& s5,

                     int64_t& s6,

                     int64_t& X)

   {

   s1 += X * 666643;

   s2 += X * 470296;

   s3 += X * 654183;

   s4 -= X * 997805;

   s5 += X * 136657;

   s6 -= X * 683901;

   X = 0;

   }

/*

ge means group element.

Here the group is the set of pairs (x,y) of field elements (see fe.h)

satisfying -x^2 + y^2 = 1 + d x^2y^2

where d = -121665/121666.

Representations:

  ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT

*/

typedef struct

   {

   fe X;

   fe Y;

   fe Z;

   fe T;

   } ge_p3;

int ge_frombytes_negate_vartime(ge_p3*, const uint8_t*);

void ge_scalarmult_base(uint8_t out[32], const uint8_t in[32]);

void ge_double_scalarmult_vartime(uint8_t out[32],

                                  const uint8_t a[],

                                  const ge_p3* A,

                                  const uint8_t b[]);

/*

The set of scalars is \Z/l

where l = 2^252 + 27742317777372353535851937790883648493.

*/

void sc_reduce(uint8_t*);

void sc_muladd(uint8_t*, const uint8_t*, const uint8_t*, const uint8_t*);

}

#endif