/*

 * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.

 * Copyright 2014 Cryptography Research, Inc.

 *

 * Licensed under the Apache License 2.0 (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 *

 * Originally written by Mike Hamburg

 */

#ifndef OSSL_CRYPTO_EC_CURVE448_FIELD_H

# define OSSL_CRYPTO_EC_CURVE448_FIELD_H

# include "internal/constant_time.h"

# include <string.h>

# include <assert.h>

# include "word.h"

# define NLIMBS (64/sizeof(word_t))

# define X_SER_BYTES 56

# define SER_BYTES 56

# if defined(__GNUC__) || defined(__clang__)

#  define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__))

#  define RESTRICT __restrict__

#  define ALIGNED __attribute__((__aligned__(16)))

# else

#  define INLINE_UNUSED ossl_inline

#  define RESTRICT

#  define ALIGNED

# endif

typedef struct gf_s {

    word_t limb[NLIMBS];

} ALIGNED gf_s, gf[1];

/* RFC 7748 support */

# define X_PUBLIC_BYTES  X_SER_BYTES

# define X_PRIVATE_BYTES X_PUBLIC_BYTES

# define X_PRIVATE_BITS  448

static INLINE_UNUSED void gf_copy(gf out, const gf a)

{

    *out = *a;

}

curve448.c:gf_copy

Line

Count

Source

45

38

{

46

38

    *out = *a;

47

38

}

Unexecuted instantiation: curve448_tables.c:gf_copy

Unexecuted instantiation: eddsa.c:gf_copy

f_generic.c:gf_copy

Line

Count

Source

45

32

{

46

32

    *out = *a;

47

32

}

Unexecuted instantiation: scalar.c:gf_copy

Unexecuted instantiation: f_impl64.c:gf_copy

static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b);

static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b);

static INLINE_UNUSED void gf_bias(gf inout, int amount);

static INLINE_UNUSED void gf_weak_reduce(gf inout);

void gf_strong_reduce(gf inout);

void gf_add(gf out, const gf a, const gf b);

void gf_sub(gf out, const gf a, const gf b);

void gf_mul(gf_s * RESTRICT out, const gf a, const gf b);

void gf_mulw_unsigned(gf_s * RESTRICT out, const gf a, uint32_t b);

void gf_sqr(gf_s * RESTRICT out, const gf a);

mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */

mask_t gf_eq(const gf x, const gf y);

mask_t gf_lobit(const gf x);

mask_t gf_hibit(const gf x);

void gf_serialize(uint8_t *serial, const gf x, int with_highbit);

mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit,

                      uint8_t hi_nmask);

# define LIMBPERM(i) (i)

# if (ARCH_WORD_BITS == 32)

#  include "arch_32/f_impl.h"    /* Bring in the inline implementations */

#  define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1)

# elif (ARCH_WORD_BITS == 64)

#  include "arch_64/f_impl.h"    /* Bring in the inline implementations */

#  define LIMB_MASK(i) (((1ULL)<<LIMB_PLACE_VALUE(i))-1)

# endif

static const gf ZERO = {{{0}}}, ONE = {{{1}}};

/* Square x, n times. */

static ossl_inline void gf_sqrn(gf_s * RESTRICT y, const gf x, int n)

{

    gf tmp;

    assert(n > 0);

    if (n & 1) {

        gf_sqr(y, x);

        n--;

    } else {

        gf_sqr(tmp, x);

        gf_sqr(y, tmp);

        n -= 2;

    }

    for (; n; n -= 2) {

        gf_sqr(tmp, y);

        gf_sqr(y, tmp);

    }

}

Unexecuted instantiation: curve448.c:gf_sqrn

Unexecuted instantiation: curve448_tables.c:gf_sqrn

Unexecuted instantiation: eddsa.c:gf_sqrn

f_generic.c:gf_sqrn

Line

Count

Source

83

128

{

84

128

    gf tmp;

85

86

128

    assert(n > 0);

87

128

    if (n & 1) {

88

112

        gf_sqr(y, x);

89

112

        n--;

90

112

    } else {

91

16

        gf_sqr(tmp, x);

92

16

        gf_sqr(y, tmp);

93

16

        n -= 2;

94

16

    }

95

3.58k

    for (; n; n -= 2) {

96

3.45k

        gf_sqr(tmp, y);

97

3.45k

        gf_sqr(y, tmp);

98

3.45k

    }

99

128

}

Unexecuted instantiation: scalar.c:gf_sqrn

Unexecuted instantiation: f_impl64.c:gf_sqrn

# define gf_add_nr gf_add_RAW

/* Subtract mod p.  Bias by 2 and don't reduce  */

static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b)

{

    gf_sub_RAW(c, a, b);

    gf_bias(c, 2);

    if (GF_HEADROOM < 3)

        gf_weak_reduce(c);

}

curve448.c:gf_sub_nr

Line

Count

Source

105

7.56k

{

106

7.56k

    gf_sub_RAW(c, a, b);

107

7.56k

    gf_bias(c, 2);

108

7.56k

    if (GF_HEADROOM < 3)

109

0

        gf_weak_reduce(c);

110

7.56k

}

Unexecuted instantiation: curve448_tables.c:gf_sub_nr

Unexecuted instantiation: eddsa.c:gf_sub_nr

Unexecuted instantiation: f_generic.c:gf_sub_nr

Unexecuted instantiation: scalar.c:gf_sub_nr

Unexecuted instantiation: f_impl64.c:gf_sub_nr

/* Subtract mod p. Bias by amt but don't reduce.  */

static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt)

{

    gf_sub_RAW(c, a, b);

    gf_bias(c, amt);

    if (GF_HEADROOM < amt + 1)

        gf_weak_reduce(c);

}

curve448.c:gf_subx_nr

Line

Count

Source

114

476

{

115

476

    gf_sub_RAW(c, a, b);

116

476

    gf_bias(c, amt);

117

476

    if (GF_HEADROOM < amt + 1)

118

0

        gf_weak_reduce(c);

119

476

}

Unexecuted instantiation: curve448_tables.c:gf_subx_nr

Unexecuted instantiation: eddsa.c:gf_subx_nr

Unexecuted instantiation: f_generic.c:gf_subx_nr

Unexecuted instantiation: scalar.c:gf_subx_nr

Unexecuted instantiation: f_impl64.c:gf_subx_nr

/* Mul by signed int.  Not constant-time WRT the sign of that int. */

static ossl_inline void gf_mulw(gf c, const gf a, int32_t w)

{

    if (w > 0) {

        gf_mulw_unsigned(c, a, w);

    } else {

        gf_mulw_unsigned(c, a, -w);

        gf_sub(c, ZERO, c);

    }

}

curve448.c:gf_mulw

Line

Count

Source

123

896

{

124

896

    if (w > 0) {

125

896

        gf_mulw_unsigned(c, a, w);

126

896

    } else {

127

0

        gf_mulw_unsigned(c, a, -w);

128

0

        gf_sub(c, ZERO, c);

129

0

    }

130

896

}

Unexecuted instantiation: curve448_tables.c:gf_mulw

Unexecuted instantiation: eddsa.c:gf_mulw

Unexecuted instantiation: f_generic.c:gf_mulw

Unexecuted instantiation: scalar.c:gf_mulw

Unexecuted instantiation: f_impl64.c:gf_mulw

/* Constant time, x = is_z ? z : y */

static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z)

{

    size_t i;

    for (i = 0; i < NLIMBS; i++) {

#if ARCH_WORD_BITS == 32

        x[0].limb[i] = constant_time_select_32(is_z, z[0].limb[i],

                                               y[0].limb[i]);

#else

        /* Must be 64 bit */

        x[0].limb[i] = constant_time_select_64(is_z, z[0].limb[i],

                                               y[0].limb[i]);

#endif

    }

}

curve448.c:gf_cond_sel

Line

Count

Source

134

1.26k

{

135

1.26k

    size_t i;

136

137

11.3k

    for (i = 0; i < NLIMBS; i++) {

138

#if ARCH_WORD_BITS == 32

139

        x[0].limb[i] = constant_time_select_32(is_z, z[0].limb[i],

140

                                               y[0].limb[i]);

141

#else

142

        /* Must be 64 bit */

143

10.0k

        x[0].limb[i] = constant_time_select_64(is_z, z[0].limb[i],

144

10.0k

                                               y[0].limb[i]);

145

10.0k

#endif

146

10.0k

    }

147

1.26k

}

Unexecuted instantiation: curve448_tables.c:gf_cond_sel

Unexecuted instantiation: eddsa.c:gf_cond_sel

Unexecuted instantiation: f_generic.c:gf_cond_sel

Unexecuted instantiation: scalar.c:gf_cond_sel

Unexecuted instantiation: f_impl64.c:gf_cond_sel

/* Constant time, if (neg) x=-x; */

static ossl_inline void gf_cond_neg(gf x, mask_t neg)

{

    gf y;

    gf_sub(y, ZERO, x);

    gf_cond_sel(x, x, y, neg);

}

curve448.c:gf_cond_neg

Line

Count

Source

151

1.26k

{

152

1.26k

    gf y;

153

154

1.26k

    gf_sub(y, ZERO, x);

155

1.26k

    gf_cond_sel(x, x, y, neg);

156

1.26k

}

Unexecuted instantiation: curve448_tables.c:gf_cond_neg

Unexecuted instantiation: eddsa.c:gf_cond_neg

Unexecuted instantiation: f_generic.c:gf_cond_neg

Unexecuted instantiation: scalar.c:gf_cond_neg

Unexecuted instantiation: f_impl64.c:gf_cond_neg

/* Constant time, if (swap) (x,y) = (y,x); */

static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap)

{

    size_t i;

    for (i = 0; i < NLIMBS; i++) {

#if ARCH_WORD_BITS == 32

        constant_time_cond_swap_32(swap, &(x[0].limb[i]), &(y->limb[i]));

#else

        /* Must be 64 bit */

        constant_time_cond_swap_64(swap, &(x[0].limb[i]), &(y->limb[i]));

#endif

    }

}

curve448.c:gf_cond_swap

Line

Count

Source

160

3.05k

{

161

3.05k

    size_t i;

162

163

27.5k

    for (i = 0; i < NLIMBS; i++) {

164

#if ARCH_WORD_BITS == 32

165

        constant_time_cond_swap_32(swap, &(x[0].limb[i]), &(y->limb[i]));

166

#else

167

        /* Must be 64 bit */

168

24.4k

        constant_time_cond_swap_64(swap, &(x[0].limb[i]), &(y->limb[i]));

169

24.4k

#endif

170

24.4k

    }

171

3.05k

}

Unexecuted instantiation: curve448_tables.c:gf_cond_swap

Unexecuted instantiation: eddsa.c:gf_cond_swap

Unexecuted instantiation: f_generic.c:gf_cond_swap

Unexecuted instantiation: scalar.c:gf_cond_swap

Unexecuted instantiation: f_impl64.c:gf_cond_swap

#endif                          /* OSSL_CRYPTO_EC_CURVE448_FIELD_H */