//

// ec_twisted_edwards.c   Twisted Edwards Curve Implementation

//

// Copyright (c) Microsoft Corporation. Licensed under the MIT license.

//

#include "precomp.h"

VOID

SYMCRYPT_CALL

SymCryptTwistedEdwardsFillScratchSpaces( _In_ PSYMCRYPT_ECURVE pCurve )

{

    UINT32 nDigits = SymCryptDigitsFromBits( pCurve->FModBitsize );

    UINT32 cbModElement = pCurve->cbModElement;

    UINT32 nDigitsFieldLength = pCurve->FModDigits;

    //

    // All the scratch space computations are upper bounded by the SizeofXXX bound (2^19) and

    // the SCRATCH_BYTES_FOR_XXX bound (2^24) (see symcrypt_internal.h).

    //

    // One caveat is SymCryptSizeofEcpointFromCurve and SymCryptSizeofEcpointEx which calculate

    // the size of EcPoint with 4 coordinates (each one a modelement of max size 2^17). Thus upper

    // bounded by 2^20.

    //

    // Another is the precomp points computation where the nPrecompPoints are up to

    // 2^SYMCRYPT_ECURVE_SW_DEF_WINDOW = 2^6 and the nRecodedDigits are equal to the

    // GOrd bitsize < 2^20.

    //

    // Thus cbScratchScalarMulti is upper bounded by 2^6*2^20 + 2*2^20*2^4 ~ 2^26.

    //

    pCurve->cbScratchCommon = 8 * cbModElement + SYMCRYPT_SCRATCH_BYTES_FOR_COMMON_MOD_OPERATIONS( nDigits );

    pCurve->cbScratchScalar =

            (pCurve->cbModElement) +

            2 * SymCryptSizeofEcpointFromCurve( pCurve ) +

            2 * SymCryptSizeofIntFromDigits( pCurve->GOrdDigits ) +

            SYMCRYPT_MAX( pCurve->cbScratchCommon, SYMCRYPT_SCRATCH_BYTES_FOR_COMMON_MOD_OPERATIONS( pCurve->GOrdDigits ));

    pCurve->cbScratchScalarMulti =

            pCurve->info.sw.nPrecompPoints * SymCryptSizeofEcpointFromCurve( pCurve ) +

            ((2*pCurve->info.sw.nRecodedDigits * sizeof(UINT32) + SYMCRYPT_ASYM_ALIGN_VALUE - 1 )/SYMCRYPT_ASYM_ALIGN_VALUE) * SYMCRYPT_ASYM_ALIGN_VALUE;

    pCurve->cbScratchGetSetValue =

        SymCryptSizeofEcpointEx(cbModElement, SYMCRYPT_ECPOINT_FORMAT_MAX_LENGTH) +

        2 * cbModElement +

        SYMCRYPT_MAX(SYMCRYPT_SCRATCH_BYTES_FOR_COMMON_MOD_OPERATIONS(nDigitsFieldLength),

        SYMCRYPT_SCRATCH_BYTES_FOR_MODINV(nDigitsFieldLength));

    pCurve->cbScratchGetSetValue = SYMCRYPT_MAX( pCurve->cbScratchGetSetValue, SymCryptSizeofIntFromDigits( nDigits ) );

    pCurve->cbScratchEckey =

        SYMCRYPT_MAX( pCurve->cbModElement + SymCryptSizeofIntFromDigits(SymCryptEcurveDigitsofScalarMultiplier(pCurve)),

                SymCryptSizeofEcpointFromCurve( pCurve ) ) +

        SYMCRYPT_MAX( pCurve->cbScratchScalar + pCurve->cbScratchScalarMulti, pCurve->cbScratchGetSetValue );

}

VOID

SYMCRYPT_CALL

SymCryptTwistedEdwardsSetDistinguished(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _Out_   PSYMCRYPT_ECPOINT   poDst,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch )

{

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poDst->pCurve) );

    UNREFERENCED_PARAMETER( pbScratch );

    UNREFERENCED_PARAMETER( cbScratch );

    SymCryptEcpointCopy( pCurve, pCurve->G, poDst );

}

UINT32

SYMCRYPT_CALL

SymCryptTwistedEdwardsIsZero(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _In_    PCSYMCRYPT_ECPOINT  poSrc,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch)

{

    PSYMCRYPT_MODULUS     pmMod = pCurve->FMod;

    UINT32 dResX = 0, dResY = 0;

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrc->pCurve) );

    UNREFERENCED_PARAMETER( pbScratch );

    UNREFERENCED_PARAMETER( cbScratch );

    PSYMCRYPT_MODELEMENT peSrcX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poSrc );

    PSYMCRYPT_MODELEMENT peSrcY = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poSrc );

    PSYMCRYPT_MODELEMENT peSrcZ = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poSrc );

    dResX = SymCryptModElementIsZero( pmMod, peSrcX );

    dResY = SymCryptModElementIsEqual( pmMod, peSrcY, peSrcZ );

    return ( dResX & dResY );

}

//

// Verify that

//   a * x^2 + y^2 = 1 + d * x^2 * y^2

//   x = X/Z, y = Y/Z,

// To avoid mod inv calculation which is expensive,

// we verify Z^2(aX^2 + Y^2) = Z^4 + d * X^2 * Y^2

//

UINT32

SYMCRYPT_CALL

SymCryptTwistedEdwardsOnCurve(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _In_    PCSYMCRYPT_ECPOINT  poSrc,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch)

{

    PSYMCRYPT_MODELEMENT  peTemp[4];

    PSYMCRYPT_MODULUS     pmMod = pCurve->FMod;

    SIZE_T nBytes;

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrc->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_COMMON_ECURVE_OPERATIONS( pCurve ) );

    nBytes = SymCryptSizeofModElementFromModulus( pmMod );

    SYMCRYPT_ASSERT( cbScratch >= 4*nBytes );

    for (UINT32 i = 0; i < 4; ++i)

    {

       peTemp[i] = SymCryptModElementCreate( pbScratch, nBytes, pmMod );

       pbScratch += nBytes;

       cbScratch -= nBytes;

    }

    PSYMCRYPT_MODELEMENT peSrcX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poSrc );

    PSYMCRYPT_MODELEMENT peSrcY = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poSrc );

    PSYMCRYPT_MODELEMENT peSrcZ = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poSrc );

    // peTemp[0] = X^2

    SymCryptModSquare( pmMod, peSrcX, peTemp[0], pbScratch, cbScratch);

    // peTemp[1] = Y^2

    SymCryptModSquare( pmMod, peSrcY, peTemp[1], pbScratch, cbScratch);

    // peTemp[2] = Z^2

    SymCryptModSquare( pmMod, peSrcZ, peTemp[2], pbScratch, cbScratch);

    // peTemp[3] = a * X^2

    SymCryptModMul( pmMod, pCurve->A, peTemp[0], peTemp[3], pbScratch, cbScratch );

    // peTemp[3] = a * X^2 + Y^2

    SymCryptModAdd( pmMod, peTemp[3], peTemp[1], peTemp[3], pbScratch, cbScratch );

    // peTemp[3] = Z^2 (a * X^2 + Y^2)

    SymCryptModMul( pmMod, peTemp[3], peTemp[2], peTemp[3], pbScratch, cbScratch );

    // peTemp[1] = X^2 * Y^2

    SymCryptModMul( pmMod, peTemp[0], peTemp[1], peTemp[1], pbScratch, cbScratch );

    // peTemp[1] = d * X^2 *Y^2

    SymCryptModMul( pmMod, pCurve->B, peTemp[1], peTemp[1], pbScratch, cbScratch );

    // peTemp[2] = Z^4

    SymCryptModMul( pmMod, peTemp[2], peTemp[2], peTemp[2], pbScratch, cbScratch );

    // peTemp[1] = Z^4 + d * X^2 * Y^2

    SymCryptModAdd( pmMod, peTemp[2], peTemp[1], peTemp[1], pbScratch, cbScratch );

    return SymCryptModElementIsEqual( pmMod, peTemp[1], peTemp[3] );

}

//

//  Point doubling: dbl-2008-hwcd, 5Mul + 4Square + 2Add + 5Sub

//

//  poDst (X, Y, Z, T) = 2 * poSrc(X, Y, Z, T)

//  1.  A = X1 ^ 2

//  2.  B = Y1 ^ 2

//  3.  C = 2 * Z1 ^ 2

//  4.  D = a * A

//  5.  E = (X1 + Y1) ^ 2 - A - B

//  6.  G = D + B

//  7.  F = G - C

//  8.  H = D - B

//  9.  X3 = E * F

//  10. Y3 = G * H

//  11. T3 = E * H

//  12. Z3 = F * G

//

VOID

SYMCRYPT_CALL

SymCryptTwistedEdwardsDouble(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _In_    PCSYMCRYPT_ECPOINT  poSrc,

    _Out_   PSYMCRYPT_ECPOINT   poDst,

            UINT32              flags,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch)

{

    PSYMCRYPT_MODELEMENT  peTemp[8];

    PSYMCRYPT_MODULUS     pmMod = pCurve->FMod;

    SIZE_T nBytes;

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrc->pCurve) && SymCryptEcurveIsSame(pCurve, poDst->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_COMMON_ECURVE_OPERATIONS( pCurve ) );

    UNREFERENCED_PARAMETER( flags );

    nBytes = SymCryptSizeofModElementFromModulus( pmMod );

    SYMCRYPT_ASSERT( cbScratch >= 8*nBytes );

    for (UINT32 i = 0; i < 8; ++i)

    {

       peTemp[i] = SymCryptModElementCreate( pbScratch, nBytes, pmMod );

       pbScratch += nBytes;

       cbScratch -= nBytes;

    }

    PSYMCRYPT_MODELEMENT peSrcX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poSrc );

    PSYMCRYPT_MODELEMENT peSrcY = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poSrc );

    PSYMCRYPT_MODELEMENT peSrcZ = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poSrc );

    PSYMCRYPT_MODELEMENT peDstX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstY = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstZ = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstT = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 3, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peA = peTemp[0];

    PSYMCRYPT_MODELEMENT peB = peTemp[1];

    PSYMCRYPT_MODELEMENT peC = peTemp[2];

    PSYMCRYPT_MODELEMENT peD = peTemp[3];

    PSYMCRYPT_MODELEMENT peE = peTemp[4];

    PSYMCRYPT_MODELEMENT peF = peTemp[5];

    PSYMCRYPT_MODELEMENT peG = peTemp[6];

    PSYMCRYPT_MODELEMENT peH = peTemp[7];

    // A = X1^2

    SymCryptModSquare( pmMod, peSrcX, peA, pbScratch, cbScratch );

    // B = Y1^2

    SymCryptModSquare( pmMod, peSrcY, peB, pbScratch, cbScratch );

    // C1 = Z1^2

    SymCryptModSquare( pmMod, peSrcZ, peC, pbScratch, cbScratch );

    // C = C1 + C1 = Z1^2 + Z1^2 = 2 * Z1^2

    SymCryptModAdd( pmMod, peC, peC, peC, pbScratch, cbScratch );

    // D = a * A

    SymCryptModMul( pmMod, pCurve->A, peA, peD, pbScratch, cbScratch );

    // E1 = X1 + Y1

    SymCryptModAdd( pmMod, peSrcX, peSrcY, peE, pbScratch, cbScratch );

    // E2 = E1^2 = (X1 + Y1)^2

    SymCryptModSquare( pmMod, peE, peE, pbScratch, cbScratch );

    // E3 = E2 - A = (X1 + Y1)^2 - A

    SymCryptModSub( pmMod, peE, peA, peE, pbScratch, cbScratch );

    // E = E3 - B = (X1 + Y1)^2 - A - B

    SymCryptModSub( pmMod, peE, peB, peE, pbScratch, cbScratch );

    // G = D + B

    SymCryptModAdd( pmMod, peD, peB, peG, pbScratch, cbScratch );

    // F = G - C

    SymCryptModSub( pmMod, peG, peC, peF, pbScratch, cbScratch );

    // H = D - B

    SymCryptModSub( pmMod, peD, peB, peH, pbScratch, cbScratch );

    // X3 = E * F

    SymCryptModMul( pmMod, peE, peF, peDstX, pbScratch, cbScratch );

    // Y3 = G * H

    SymCryptModMul( pmMod, peG, peH, peDstY, pbScratch, cbScratch );

    // T3 = E * H

    SymCryptModMul( pmMod, peE, peH, peDstT, pbScratch, cbScratch );

    // Z3 = F * G

    SymCryptModMul( pmMod, peF, peG, peDstZ, pbScratch, cbScratch );

}

//

//  Point addition: add-2008-hwcd  11Mul + 3add + 4sub

//

//  poDst(X, Y, Z, T) = poSrc(X, Y, Z, T) + poSrc2(X, Y, Z, T)

//  1.  A = X1 * X2

//  2.  B = Y1 * Y2

//  3.  C = d * T1 * T2

//  4.  D = Z1 * Z2

//  5.  E = (X1 + Y1) * (X2 + Y2) - A - B

//  6.  F = D - C

//  7.  G = D + C

//  8.  H = B - a * A

//  9.  X3 = E * F

//  10. Y3 = G * H

//  11. T3 = E * H

//  12. Z3 = F * G

//

VOID

SYMCRYPT_CALL

SymCryptTwistedEdwardsAdd(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _In_    PCSYMCRYPT_ECPOINT  poSrc1,

    _In_    PCSYMCRYPT_ECPOINT  poSrc2,

    _Out_   PSYMCRYPT_ECPOINT   poDst,

            UINT32              flags,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch )

{

    PSYMCRYPT_MODELEMENT  peTemp[8];

    PSYMCRYPT_MODULUS     pmMod = pCurve->FMod;

    SIZE_T nBytes;

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrc1->pCurve) && SymCryptEcurveIsSame(pCurve, poSrc2->pCurve) && SymCryptEcurveIsSame(pCurve, poDst->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_COMMON_ECURVE_OPERATIONS( pCurve ) );

    UNREFERENCED_PARAMETER( flags );

    nBytes = SymCryptSizeofModElementFromModulus( pmMod );

    SYMCRYPT_ASSERT( cbScratch >= 8*nBytes );

    for (UINT32 i = 0; i < 8; ++i)

    {

       peTemp[i] = SymCryptModElementCreate( pbScratch, nBytes, pmMod );

       pbScratch += nBytes;

       cbScratch -= nBytes;

    }

    PSYMCRYPT_MODELEMENT peSrc1X = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poSrc1 );

    PSYMCRYPT_MODELEMENT peSrc1Y = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poSrc1 );

    PSYMCRYPT_MODELEMENT peSrc1Z = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poSrc1 );

    PSYMCRYPT_MODELEMENT peSrc1T = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 3, pCurve, poSrc1 );

    PSYMCRYPT_MODELEMENT peSrc2X = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poSrc2 );

    PSYMCRYPT_MODELEMENT peSrc2Y = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poSrc2 );

    PSYMCRYPT_MODELEMENT peSrc2Z = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poSrc2 );

    PSYMCRYPT_MODELEMENT peSrc2T = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 3, pCurve, poSrc2 );

    PSYMCRYPT_MODELEMENT peDstX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstY = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstZ = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstT = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 3, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peA = peTemp[0];

    PSYMCRYPT_MODELEMENT peB = peTemp[1];

    PSYMCRYPT_MODELEMENT peC = peTemp[2];

    PSYMCRYPT_MODELEMENT peD = peTemp[3];

    PSYMCRYPT_MODELEMENT peE = peTemp[4];

    PSYMCRYPT_MODELEMENT peF = peTemp[5];

    PSYMCRYPT_MODELEMENT peG = peTemp[6];

    PSYMCRYPT_MODELEMENT peH = peTemp[7];

    // A = X1 * X2

    SymCryptModMul( pmMod, peSrc1X, peSrc2X, peA, pbScratch, cbScratch );

    // B = Y1 * Y2

    SymCryptModMul( pmMod, peSrc1Y, peSrc2Y, peB, pbScratch, cbScratch );

    // C1 = T1 * T2

    SymCryptModMul( pmMod, peSrc1T, peSrc2T, peC, pbScratch, cbScratch );

    // C = d * C1 = d * T1 * T2

    SymCryptModMul( pmMod, pCurve->B, peC, peC, pbScratch, cbScratch );

    // D = Z1 * Z2

    SymCryptModMul( pmMod, peSrc1Z, peSrc2Z, peD, pbScratch, cbScratch );

    // E1 = X1 + Y1

    SymCryptModAdd( pmMod, peSrc1X, peSrc1Y, peE, pbScratch, cbScratch );

    // E2 = X2 + Y2

    SymCryptModAdd( pmMod, peSrc2X, peSrc2Y, peF, pbScratch, cbScratch );

    // E = E * F

    SymCryptModMul( pmMod, peE, peF, peE, pbScratch, cbScratch );

    // E = E - A

    SymCryptModSub( pmMod, peE, peA, peE, pbScratch, cbScratch );

    // E = E - B

    SymCryptModSub( pmMod, peE, peB, peE, pbScratch, cbScratch );

    // F = D - C

    SymCryptModSub( pmMod, peD, peC, peF, pbScratch, cbScratch );

    // G = D + C

    SymCryptModAdd( pmMod, peD, peC, peG, pbScratch, cbScratch );

    // H = a * A

    SymCryptModMul( pmMod, pCurve->A, peA, peH, pbScratch, cbScratch );

    // H = B - a * A

    SymCryptModSub( pmMod, peB, peH, peH, pbScratch, cbScratch );

    // X3 = E * F

    SymCryptModMul( pmMod, peE, peF, peDstX, pbScratch, cbScratch );

    // Y3 = G * H

    SymCryptModMul( pmMod, peG, peH, peDstY, pbScratch, cbScratch );

    // T3 = E * H

    SymCryptModMul( pmMod, peE, peH, peDstT, pbScratch, cbScratch );

    // Y3 = F * G

    SymCryptModMul( pmMod, peF, peG, peDstZ, pbScratch, cbScratch );

}

VOID

SYMCRYPT_CALL

SymCryptTwistedEdwardsAddDiffNonZero(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _In_    PCSYMCRYPT_ECPOINT  poSrc1,

    _In_    PCSYMCRYPT_ECPOINT  poSrc2,

    _Out_   PSYMCRYPT_ECPOINT   poDst,

    _Out_writes_bytes_(cbScratch)

            PBYTE               pbScratch,

            SIZE_T              cbScratch )

{

    SymCryptTwistedEdwardsAdd( pCurve, poSrc1, poSrc2, poDst, 0, pbScratch, cbScratch );

}

//

//  Verify poSrc1(X1, Y1, Z1, T1) = poSrc2(X2, Y2, Z2, T2)

//  To avoid ModInv for 1/Z, we do

//     X1 * Z2 = X2 * Z1, and

//     Y1 * Z2 = Y2 * Z1

//

//  This function also do poSrc1 = -1 * poSrc check as flags indicates

//

UINT32

SYMCRYPT_CALL

SymCryptTwistedEdwardsIsEqual(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _In_    PCSYMCRYPT_ECPOINT  poSrc1,

    _In_    PCSYMCRYPT_ECPOINT  poSrc2,

            UINT32              flags,

    _Out_writes_bytes_(cbScratch)

            PBYTE               pbScratch,

            SIZE_T              cbScratch)

{

    PSYMCRYPT_MODELEMENT  peTemp[2];

    PSYMCRYPT_MODELEMENT  peSrc1X, peSrc1Y, peSrc1Z;

    PSYMCRYPT_MODELEMENT  peSrc2X, peSrc2Y, peSrc2Z;

    PSYMCRYPT_MODULUS     pmMod = pCurve->FMod;

    SIZE_T nBytes;

    UINT32  dResX = 0;

    UINT32  dResXN = 0;

    UINT32  dResY = 0;

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrc1->pCurve) && SymCryptEcurveIsSame(pCurve, poSrc2->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_COMMON_ECURVE_OPERATIONS( pCurve ) );

    nBytes = SymCryptSizeofModElementFromModulus( pmMod );

    SYMCRYPT_ASSERT( cbScratch >= 2*nBytes );

    for (UINT32 i = 0; i < 2; ++i)

    {

        peTemp[i] = SymCryptModElementCreate( pbScratch, nBytes, pmMod );

        pbScratch += nBytes;

        cbScratch -= nBytes;

    }

    peSrc1X = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poSrc1 );

    peSrc1Y = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poSrc1 );

    peSrc1Z = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poSrc1 );

    peSrc2X = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poSrc2 );

    peSrc2Y = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poSrc2 );

    peSrc2Z = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poSrc2 );

    // Setting the default flag if flags == 0

    flags |= (SYMCRYPT_MASK32_ZERO(flags) & SYMCRYPT_FLAG_ECPOINT_EQUAL);

    // peTemp[0] = X1 * Z2

    SymCryptModMul( pmMod, peSrc1X, peSrc2Z, peTemp[0], pbScratch, cbScratch );

    // peTemp[1] = X2 * Z1

    SymCryptModMul( pmMod, peSrc2X, peSrc1Z, peTemp[1], pbScratch, cbScratch );

    dResX = SymCryptModElementIsEqual( pmMod, peTemp[0], peTemp[1] );

    // Neg peTemp[1]

    SymCryptModNeg(pmMod, peTemp[1], peTemp[1], pbScratch, cbScratch);

    dResXN = SymCryptModElementIsEqual(pmMod, peTemp[0], peTemp[1]);

    // peTemp[0] = Y1 * Z2

    SymCryptModMul( pmMod, peSrc1Y, peSrc2Z, peTemp[0], pbScratch, cbScratch );

    // peTemp[1] = Y2 * Z1

    SymCryptModMul( pmMod, peSrc2Y, peSrc1Z, peTemp[1], pbScratch, cbScratch );

    dResY = SymCryptModElementIsEqual( pmMod, peTemp[0], peTemp[1] );

    return (SYMCRYPT_MASK32_NONZERO( flags & SYMCRYPT_FLAG_ECPOINT_EQUAL ) & dResX & dResY ) |

           (SYMCRYPT_MASK32_NONZERO( flags & SYMCRYPT_FLAG_ECPOINT_NEG_EQUAL ) & dResXN & dResY );

}

VOID

SYMCRYPT_CALL

SymCryptTwistedEdwardsSetZero(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _Out_   PSYMCRYPT_ECPOINT   poDst,

    _Out_writes_bytes_(cbScratch)

            PBYTE               pbScratch,

            SIZE_T              cbScratch)

{

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poDst->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_COMMON_ECURVE_OPERATIONS( pCurve ) );

    PSYMCRYPT_MODULUS  pmMod = pCurve->FMod;

    PSYMCRYPT_MODELEMENT peDstX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstY = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstZ = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poDst );

    PSYMCRYPT_MODELEMENT peDstT = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 3, pCurve, poDst );

    SymCryptModElementSetValueUint32( 0, pmMod, peDstX, pbScratch, cbScratch );

    SymCryptModElementSetValueUint32( 1, pmMod, peDstY, pbScratch, cbScratch );

    SymCryptModElementSetValueUint32( 1, pmMod, peDstZ, pbScratch, cbScratch );

    SymCryptModElementSetValueUint32( 0, pmMod, peDstT, pbScratch, cbScratch );

}

VOID

SYMCRYPT_CALL

SymCryptTwistedEdwardsNegate(

    _In_    PCSYMCRYPT_ECURVE   pCurve,

    _Inout_ PSYMCRYPT_ECPOINT   poSrc,

            UINT32              mask,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch )

{

    PCSYMCRYPT_MODULUS FMod = pCurve->FMod;

    PSYMCRYPT_MODELEMENT peX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0,pCurve, poSrc);

    PSYMCRYPT_MODELEMENT peT = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 3,pCurve, poSrc);

    PSYMCRYPT_MODELEMENT peTmp = NULL;

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrc->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_SCRATCH_BYTES_FOR_COMMON_MOD_OPERATIONS( pCurve->FModDigits ) + pCurve->cbModElement );

    peTmp = SymCryptModElementCreate(

                pbScratch,

                pCurve->cbModElement,

                FMod );

    SYMCRYPT_ASSERT( peTmp != NULL);

    pbScratch += pCurve->cbModElement;

    cbScratch -= pCurve->cbModElement;

    SymCryptModNeg( FMod, peX, peTmp, pbScratch, cbScratch );

    SymCryptModElementMaskedCopy( FMod, peTmp, peX, mask );

    SymCryptModNeg( FMod, peT, peTmp, pbScratch, cbScratch );

    SymCryptModElementMaskedCopy( FMod, peTmp, peT, mask );

}