_ZNK5Botan17Barrett_Reduction4cubeERKNS_6BigIntE: 66| 12| BigInt cube(const BigInt& x) const { return this->multiply(x, this->square(x)); } _ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEmEET_S2_: 28| 4.14M|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) { 29| 4.14M| const T top = CT::value_barrier(a >> (sizeof(T) * 8 - 1)); 30| 4.14M| return static_cast(0) - top; 31| 4.14M|} _ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEmEET_S2_: 37| 4.12M|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) { 38| 4.12M| return ct_expand_top_bit(~x & (x - 1)); 39| 4.12M|} _ZN5Botan6chooseITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 217| 22.7M|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) { 218| | //return (mask & a) | (~mask & b); 219| 22.7M| return (b ^ (mask & (a ^ b))); 220| 22.7M|} _ZN5Botan13ceil_divisionITkNSt3__117unsigned_integralEmEET_S2_S2_: 167| 72|BOTAN_FORCE_INLINE constexpr T ceil_division(T a, T b) { 168| | // Same as `(a + b - 1) / b` but avoids possible overflow 169| 72| return a / b + ((a % b != 0) ? 1 : 0); ------------------ | Branch (169:20): [True: 62, False: 10] ------------------ 170| 72|} _ZN5Botan8high_bitITkNSt3__117unsigned_integralEjEEmT_: 73| 15|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) { 74| 15| size_t hb = 0; 75| | 76| 90| for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) { ------------------ | Branch (76:38): [True: 75, False: 15] ------------------ 77| | // Equivalent to: ((n >> s) == 0) ? 0 : s; 78| 75| const size_t z = s - ct_if_is_zero_ret(n >> s, s); 79| 75| hb += z; 80| 75| n >>= z; 81| 75| } 82| | 83| 15| hb += static_cast(n); 84| | 85| 15| return hb; 86| 15|} _ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEjEEmT_m: 45| 75|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) { 46| | /* 47| | Similar to `return ct_is_zero(x) & s` but has to account for possibility that 48| | sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking 49| | */ 50| 75| const T a = ~x & (x - 1); 51| 75| const size_t a_top = static_cast(CT::value_barrier(a >> (sizeof(T) * 8 - 1))); 52| 75| const size_t mask = static_cast(0) - a_top; 53| 75| return mask & s; 54| 75|} _ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEmEEmT_m: 45| 792|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) { 46| | /* 47| | Similar to `return ct_is_zero(x) & s` but has to account for possibility that 48| | sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking 49| | */ 50| 792| const T a = ~x & (x - 1); 51| 792| const size_t a_top = static_cast(CT::value_barrier(a >> (sizeof(T) * 8 - 1))); 52| 792| const size_t mask = static_cast(0) - a_top; 53| 792| return mask & s; 54| 792|} _ZN5Botan8high_bitITkNSt3__117unsigned_integralEmEEmT_: 73| 132|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) { 74| 132| size_t hb = 0; 75| | 76| 924| for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) { ------------------ | Branch (76:38): [True: 792, False: 132] ------------------ 77| | // Equivalent to: ((n >> s) == 0) ? 0 : s; 78| 792| const size_t z = s - ct_if_is_zero_ret(n >> s, s); 79| 792| hb += z; 80| 792| n >>= z; 81| 792| } 82| | 83| 132| hb += static_cast(n); 84| | 85| 132| return hb; 86| 132|} _ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEmQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_: 25| 85.4k|inline constexpr T reverse_bytes(T x) { 26| | if constexpr(sizeof(T) == 1) { 27| | return x; 28| | } else if constexpr(sizeof(T) == 2) { 29| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16) 30| | return static_cast(__builtin_bswap16(x)); 31| |#else 32| | return static_cast((x << 8) | (x >> 8)); 33| |#endif 34| | } else if constexpr(sizeof(T) == 4) { 35| |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32) 36| | return static_cast(__builtin_bswap32(x)); 37| |#else 38| | // MSVC at least recognizes this as a bswap 39| | return static_cast(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | 40| | ((x & 0xFF000000) >> 24)); 41| |#endif 42| 85.4k| } else if constexpr(sizeof(T) == 8) { 43| 85.4k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64) 44| 85.4k| return static_cast(__builtin_bswap64(x)); 45| |#else 46| | uint32_t hi = static_cast(x >> 32); 47| | uint32_t lo = static_cast(x); 48| | 49| | hi = reverse_bytes(hi); 50| | lo = reverse_bytes(lo); 51| | 52| | return (static_cast(lo) << 32) | hi; 53| |#endif 54| 85.4k| } 55| 85.4k|} _ZN5Botan5CPUID3hasENS_10CPUFeatureES1_: 98| 2.70M| static bool has(CPUID::Feature feat1, CPUID::Feature feat2) { 99| 2.70M| return state().has_bit(feat1.as_u32() | feat2.as_u32()); 100| 2.70M| } _ZN5Botan5CPUID6is_setEjNS_10CPUFeatureE: 126| 5| static inline bool is_set(uint32_t allowed, CPUID::Feature bit) { 127| 5| const uint32_t feat_bit = bit.as_u32(); 128| 5| return ((allowed & feat_bit) == feat_bit); 129| 5| } _ZNK5Botan5CPUID10CPUID_Data7has_bitEj: 143| 2.70M| bool has_bit(uint32_t bit) const { return (m_processor_features & bit) == bit; } _ZN5Botan5CPUID5stateEv: 155| 2.70M| static CPUID_Data& state() { 156| 2.70M| static CPUID::CPUID_Data g_cpuid; 157| 2.70M| return g_cpuid; 158| 2.70M| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_1_bitsEEjmT_NS_10CPUFeatureEj: 116| 7| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 117| 7| const uint64_t flag64 = static_cast(flag); 118| 7| if((cpuid & flag64) == flag64) { ------------------ | Branch (118:13): [True: 7, False: 0] ------------------ 119| 7| return (bit.as_u32() & allowed); 120| 7| } else { 121| 0| return 0; 122| 0| } 123| 7| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_7_bitsEEjmT_NS_10CPUFeatureEj: 116| 8| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 117| 8| const uint64_t flag64 = static_cast(flag); 118| 8| if((cpuid & flag64) == flag64) { ------------------ | Branch (118:13): [True: 5, False: 3] ------------------ 119| 5| return (bit.as_u32() & allowed); 120| 5| } else { 121| 3| return 0; 122| 3| } 123| 8| } cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE18x86_CPUID_7_1_bitsEEjmT_NS_10CPUFeatureEj: 116| 3| static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) { 117| 3| const uint64_t flag64 = static_cast(flag); 118| 3| if((cpuid & flag64) == flag64) { ------------------ | Branch (118:13): [True: 0, False: 3] ------------------ 119| 0| return (bit.as_u32() & allowed); 120| 3| } else { 121| 3| return 0; 122| 3| } 123| 3| } _ZN5Botan10CPUFeatureC2ENS0_3BitE: 54| 5.41M| CPUFeature(Bit b) : m_bit(b) {} // NOLINT(*-explicit-conversions,*-explicit-constructor) _ZNK5Botan10CPUFeature6as_u32Ev: 56| 5.41M| uint32_t as_u32() const { return static_cast(m_bit); } _ZN5Botan2CT6Choice9from_maskEm: 303| 116k| constexpr static Choice from_mask(underlying_type v) { return Choice(v); } _ZN5Botan2CT6Choice2noEv: 307| 12| constexpr static Choice no() { return Choice(0); } _ZNK5Botan2CT6ChoicentEv: 309| 11.5k| constexpr Choice operator!() const { return Choice(~value()); } _ZNK5Botan2CT6ChoiceaaERKS1_: 311| 34.4k| constexpr Choice operator&&(const Choice& other) const { return Choice(value() & other.value()); } _ZNK5Botan2CT6ChoiceooERKS1_: 313| 24.3k| constexpr Choice operator||(const Choice& other) const { return Choice(value() | other.value()); } _ZNK5Botan2CT6Choice7as_boolEv: 329| 57.4k| constexpr bool as_bool() const { return m_value != 0; } _ZNK5Botan2CT6Choice5valueEv: 332| 151k| constexpr underlying_type value() const { return value_barrier(m_value); } _ZN5Botan2CT6ChoiceC2Em: 341| 186k| constexpr explicit Choice(underlying_type v) : m_value(CT::value_barrier(v)) {} _ZN5Botan2CT4MaskImE7is_zeroEm: 437| 4.11M| static constexpr Mask is_zero(T x) { return Mask(ct_is_zero(value_barrier(x))); } _ZNK5Botan2CT4MaskImE5valueEv: 630| 8.02M| constexpr T value() const { return value_barrier(m_mask); } _ZNK5Botan2CT4MaskImEcoEv: 533| 3.85M| constexpr Mask operator~() const { return Mask(~value()); } _ZN5Botan2CT4MaskImE6expandEm: 392| 3.84M| static constexpr Mask expand(T v) { return ~Mask::is_zero(value_barrier(v)); } _ZN5Botan2CT6poisonImEEvPKT_m: 56| 96|constexpr inline void poison(const T* p, size_t n) { 57| |#if defined(BOTAN_HAS_VALGRIND) 58| | if(!std::is_constant_evaluated()) { 59| | VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T)); 60| | } 61| |#endif 62| | 63| 96| BOTAN_UNUSED(p, n); ------------------ | | 151| 96|#define BOTAN_UNUSED Botan::ignore_params ------------------ 64| 96|} _ZN5Botan2CT8unpoisonImEEvPKT_m: 67| 121k|constexpr inline void unpoison(const T* p, size_t n) { 68| |#if defined(BOTAN_HAS_VALGRIND) 69| | if(!std::is_constant_evaluated()) { 70| | VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T)); 71| | } 72| |#endif 73| | 74| 121k| BOTAN_UNUSED(p, n); ------------------ | | 151| 121k|#define BOTAN_UNUSED Botan::ignore_params ------------------ 75| 121k|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt19custom_unpoisonableISC_EEEvRKSC_: 128| 288|constexpr void unpoison(const R& r) { 129| 288| const std::span s{r}; 130| 288| unpoison(s.data(), s.size()); 131| 288|} _ZNK5Botan2CT4MaskImE6selectEmm: 548| 24.0k| constexpr T select(T x, T y) const { return choose(value(), x, y); } _ZN5Botan2CTanENS0_4MaskImEES2_: 518| 1.05k| friend constexpr Mask operator&(Mask x, Mask y) { return Mask(x.value() & y.value()); } _ZN5Botan2CT4MaskImEC2Em: 637| 8.02M| constexpr explicit Mask(T m) : m_mask(m) {} _ZN5Botan2CT9all_zerosImEENS0_4MaskIT_EEPKS3_m: 785| 101k|constexpr inline CT::Mask all_zeros(const T elem[], size_t len) { 786| 101k| T sum = 0; 787| 684k| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (787:22): [True: 582k, False: 101k] ------------------ 788| 582k| sum |= elem[i]; 789| 582k| } 790| 101k| return CT::Mask::is_zero(sum); 791| 101k|} _ZNK5Botan2CT4MaskImE7as_boolEv: 614| 4.13k| constexpr bool as_bool() const { return unpoisoned_value() != 0; } _ZNK5Botan2CT4MaskImE16unpoisoned_valueEv: 598| 120k| constexpr T unpoisoned_value() const { 599| 120k| T r = value(); 600| 120k| CT::unpoison(r); 601| 120k| return r; 602| 120k| } _ZN5Botan2CT8unpoisonITkNSt3__18integralEmEEvRKT_: 112| 120k|constexpr void unpoison(const T& p) { 113| 120k| unpoison(&p, 1); 114| 120k|} _ZN5Botan2CT4MaskImE8is_equalEmm: 442| 24.3k| static constexpr Mask is_equal(T x, T y) { 443| 24.3k| const T diff = value_barrier(x) ^ value_barrier(y); 444| 24.3k| return Mask::is_zero(diff); 445| 24.3k| } _ZNK5Botan2CT4MaskImE13if_set_returnEm: 538| 7.03k| constexpr T if_set_return(T x) const { return value() & x; } _ZN5Botan2CT4MaskImE5is_ltEmm: 450| 27.3k| static constexpr Mask is_lt(T x, T y) { 451| 27.3k| T u = x ^ ((x ^ y) | ((x - y) ^ x)); 452| 27.3k| return Mask::expand_top_bit(u); 453| 27.3k| } _ZN5Botan2CT4MaskImE14expand_top_bitEm: 415| 29.6k| static constexpr Mask expand_top_bit(T v) { return Mask(ct_expand_top_bit(v)); } _ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m: 738| 96|constexpr inline Mask conditional_copy_mem(T cnd, T* dest, const T* if_set, const T* if_unset, size_t elems) { 739| 96| const auto mask = CT::Mask::expand(cnd); 740| 96| return CT::conditional_copy_mem(mask, dest, if_set, if_unset, elems); 741| 96|} _ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m: 732| 96|constexpr inline Mask conditional_copy_mem(Mask mask, T* dest, const T* if_set, const T* if_unset, size_t elems) { 733| 96| mask.select_n(dest, if_set, if_unset, elems); 734| 96| return mask; 735| 96|} _ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m: 565| 3.72M| constexpr void select_n(T output[], const T x[], const T y[], size_t len) const { 566| 3.72M| const T mask = value(); 567| 25.7M| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (567:28): [True: 22.0M, False: 3.72M] ------------------ 568| 22.0M| output[i] = choose(mask, x[i], y[i]); 569| 22.0M| } 570| 3.72M| } _ZN5Botan2CT4MaskImE5is_gtEmm: 458| 1.84k| static constexpr Mask is_gt(T x, T y) { return Mask::is_lt(y, x); } _ZN5Botan2CT4MaskImE6is_gteEmm: 468| 2.56k| static constexpr Mask is_gte(T x, T y) { return ~Mask::is_lt(x, y); } _ZNK5Botan2CT4MaskImE9as_choiceEv: 619| 116k| constexpr CT::Choice as_choice() const { 620| 116k| if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) { 621| 116k| return CT::Choice::from_mask(static_cast(unpoisoned_value())); 622| | } else { 623| | return CT::Choice::from_int(unpoisoned_value()); 624| | } 625| 116k| } _ZNK5Botan2CT4MaskImE11select_maskES2_S2_: 559| 22.0k| Mask select_mask(Mask x, Mask y) const { return Mask(select(x.value(), y.value())); } _ZN5Botan2CT4MaskImEaNES2_: 494| 98| Mask& operator&=(Mask o) { 495| 98| m_mask &= o.value(); 496| 98| return (*this); 497| 98| } _ZN5Botan2CTorENS0_4MaskImEES2_: 528| 3.36k| friend constexpr Mask operator|(Mask x, Mask y) { return Mask(x.value() | y.value()); } _ZN5Botan2CT6Choice8from_intIjQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_: 268| 108| constexpr static Choice from_int(T v) { 269| 108| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 270| 108| return !Choice(ct_is_zero(v)); 271| | } else { 272| | // Mask of T that is either |0| or |1| 273| | const T v_is_0 = ct_is_zero(value_barrier(v)); 274| | 275| | // We want the mask to be set if v != 0 so we must check that 276| | // v_is_0 is itself zero. 277| | // 278| | // Also sizeof(T) may not equal sizeof(underlying_type) so we must 279| | // use ct_is_zero. It's ok to either truncate or 280| | // zero extend v_is_0 to 32 bits since we know it is |0| or |1| 281| | // so even just the low bit is sufficient. 282| | return Choice(ct_is_zero(static_cast(v_is_0))); 283| | } 284| 108| } _ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt17custom_poisonableISB_EEEvRKSB_: 121| 96|constexpr void poison(const R& r) { 122| 96| const std::span s{r}; 123| 96| poison(s.data(), s.size()); 124| 96|} _ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt19custom_unpoisonableISB_EEEvRKSB_: 128| 96|constexpr void unpoison(const R& r) { 129| 96| const std::span s{r}; 130| 96| unpoison(s.data(), s.size()); 131| 96|} _ZN5Botan2CT22conditional_assign_memImEENS0_4MaskIT_EES3_PS3_PKS3_m: 749| 3.72M|constexpr inline Mask conditional_assign_mem(T cnd, T* dest, const T* src, size_t elems) { 750| 3.72M| const auto mask = CT::Mask::expand(cnd); 751| 3.72M| mask.select_n(dest, src, dest, elems); 752| 3.72M| return mask; 753| 3.72M|} _ZN5Botan2CT8is_equalImEENS0_4MaskIT_EEPKS3_S6_m: 798| 24.9k|constexpr inline CT::Mask is_equal(const T x[], const T y[], size_t len) { 799| 24.9k| if(std::is_constant_evaluated()) { ------------------ | Branch (799:7): [Folded, False: 24.9k] ------------------ 800| 0| T difference = 0; 801| | 802| 0| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (802:25): [True: 0, False: 0] ------------------ 803| 0| difference = difference | (x[i] ^ y[i]); 804| 0| } 805| | 806| 0| return CT::Mask::is_zero(difference); 807| 24.9k| } else { 808| 24.9k| volatile T difference = 0; 809| | 810| 154k| for(size_t i = 0; i != len; ++i) { ------------------ | Branch (810:25): [True: 130k, False: 24.9k] ------------------ 811| 130k| difference = difference | (x[i] ^ y[i]); 812| 130k| } 813| | 814| 24.9k| return CT::Mask::is_zero(difference); 815| 24.9k| } 816| 24.9k|} _ZNK5Botan2CT6Choice12into_bitmaskImQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES3_v: 291| 22.8k| constexpr T into_bitmask() const { 292| 22.8k| if constexpr(sizeof(T) <= sizeof(underlying_type)) { 293| | // The inner mask is already |0| or |1| so just truncate 294| 22.8k| return static_cast(value()); 295| | } else { 296| | return ~ct_is_zero(value()); 297| | } 298| 22.8k| } _ZNK5Botan13EC_Group_Data11order_bytesEv: 210| 10.5k| size_t order_bytes() const { return m_order_bytes; } _ZNK5Botan13EC_Group_Data1pEv: 170| 24| const BigInt& p() const { return m_p; } _ZNK5Botan13EC_Group_Data3oidEv: 166| 78| const OID& oid() const { return m_oid; } _ZNK5Botan13EC_Group_Data5montyEv: 185| 60| const Montgomery_Params& monty() const { return m_monty; } _ZNK5Botan13EC_Group_Data7p_wordsEv: 202| 12| size_t p_words() const { return m_p_words; } _ZNK5Botan13EC_Group_Data6pcurveEv: 297| 87.9k| const PCurve::PrimeOrderCurve& pcurve() const { 298| 87.9k| BOTAN_ASSERT_NONNULL(m_pcurve); ------------------ | | 123| 87.9k| do { \ | | 124| 87.9k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 87.9k] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 87.9k| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 87.9k] | | ------------------ ------------------ 299| 87.9k| return *m_pcurve; 300| 87.9k| } _ZN5Botan14EC_Scalar_DataD2Ev: 39| 56.6k| virtual ~EC_Scalar_Data() = default; _ZNK5Botan17EC_Scalar_Data_PC5valueEv: 53| 2.11k| const auto& value() const { return m_v; } _ZN5Botan17EC_Scalar_Data_PCC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_6PCurve15PrimeOrderCurve6ScalarE: 19| 56.6k| m_group(std::move(group)), m_v(std::move(v)) {} _ZN5Botan11checked_mulITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_: 46| 1.03k|constexpr inline std::optional checked_mul(T a, T b) { 47| | // Multiplication by 1U is a hack to work around C's insane 48| | // integer promotion rules. 49| | // https://stackoverflow.com/questions/24795651 50| 1.03k| const T r = (1U * a) * b; 51| | // If a == 0 then the multiply certainly did not overflow 52| | // Otherwise r / a == b unless overflow occurred 53| 1.03k| if(a != 0 && r / a != b) { ------------------ | Branch (53:7): [True: 1.03k, False: 0] | Branch (53:17): [True: 0, False: 1.03k] ------------------ 54| 0| return {}; 55| 0| } 56| 1.03k| return r; 57| 1.03k|} _ZN5Botan11checked_addITkNSt3__117unsigned_integralEjEENS1_8optionalIT_EES3_S3_: 19| 12|constexpr inline std::optional checked_add(T a, T b) { 20| 12| const T r = a + b; 21| 12| if(r < a || r < b) { ------------------ | Branch (21:7): [True: 0, False: 12] | Branch (21:16): [True: 0, False: 12] ------------------ 22| 0| return {}; 23| 0| } 24| 12| return r; 25| 12|} _ZN5Botan13swar_in_rangeITkNSt3__117unsigned_integralEmEET_S2_S2_S2_: 144| 5.64k|constexpr T swar_in_range(T v, T lower, T upper) { 145| | // The constant 0x808080... as a T 146| 5.64k| constexpr T hi1 = (static_cast(-1) / 255) << 7; 147| | // The constant 0x7F7F7F... as a T 148| 5.64k| constexpr T lo7 = ~hi1; 149| | 150| 5.64k| const T sub = ((v | hi1) - (lower & lo7)) ^ ((v ^ (~lower)) & hi1); 151| 5.64k| const T a_lo = sub & lo7; 152| 5.64k| const T a_hi = sub & hi1; 153| 5.64k| return (lo7 - a_lo + upper) & hi1 & ~a_hi; 154| 5.64k|} _ZN5Botan23index_of_first_set_byteITkNSt3__117unsigned_integralEmEEmT_: 160| 5.64k|constexpr size_t index_of_first_set_byte(T v) { 161| | // The constant 0x010101... as a T 162| 5.64k| constexpr T lo1 = (static_cast(-1) / 255); 163| | // The constant 0x808080... as a T 164| 5.64k| constexpr T hi1 = lo1 << 7; 165| | // How many bits to shift in order to get the top byte 166| 5.64k| constexpr size_t bits = (sizeof(T) * 8) - 8; 167| | 168| 5.64k| return static_cast((((((v & hi1) - 1) & lo1) * lo1) >> bits) - 1); 169| 5.64k|} _ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEmEEDaT_: 190| 21.3k|constexpr auto unwrap_strong_type_or_enum(InT t) { 191| | if constexpr(std::is_enum_v) { 192| | // TODO: C++23: use std::to_underlying(in) instead 193| | return static_cast>(t); 194| 21.3k| } else { 195| 21.3k| return Botan::unwrap_strong_type(t); 196| 21.3k| } 197| 21.3k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_: 525| 21.3k|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) { 526| 21.3k| const auto in = detail::unwrap_strong_type_or_enum(wrapped_in); 527| 21.3k| using InT = decltype(in); 528| 21.3k| ranges::assert_exact_byte_length(out_range); 529| 21.3k| const std::span out{out_range}; 530| | 531| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 532| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 533| | // in a `constexpr` context. 534| 21.3k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (534:7): [Folded, False: 21.3k] ------------------ 535| 0| return fallback_store_any(in, std::forward(out_range)); 536| 21.3k| } else { 537| | if constexpr(sizeof(InT) == 1) { 538| | out[0] = static_cast(in); 539| | } else if constexpr(endianness == std::endian::native) { 540| | typecast_copy(out, in); 541| 21.3k| } else { 542| 21.3k| static_assert(opposite(endianness) == std::endian::native); 543| 21.3k| typecast_copy(out, reverse_bytes(in)); 544| 21.3k| } 545| 21.3k| } 546| 21.3k|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 64.0k|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 64.0k| using OutT = detail::wrapped_type; 280| 64.0k| ranges::assert_exact_byte_length(in_range); 281| | 282| 64.0k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 64.0k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 64.0k| return fallback_load_any(std::forward(in_range)); 288| 64.0k| } else { 289| 64.0k| const std::span in{in_range}; 290| 64.0k| if constexpr(sizeof(OutT) == 1) { 291| 64.0k| return static_cast(in[0]); 292| 64.0k| } else if constexpr(endianness == std::endian::native) { 293| 64.0k| return typecast_copy(in); 294| 64.0k| } else { 295| 64.0k| static_assert(opposite(endianness) == std::endian::native); 296| 64.0k| return reverse_bytes(typecast_copy(in)); 297| 64.0k| } 298| 64.0k| } 299| 64.0k| }()); 300| 64.0k|} _ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEmTkNSt3__117unsigned_integralEmEEDaT0_: 200| 64.0k|constexpr auto wrap_strong_type_or_enum(T t) { 201| | if constexpr(std::is_enum_v) { 202| | return static_cast(t); 203| 64.0k| } else { 204| 64.0k| return Botan::wrap_strong_type(t); 205| 64.0k| } 206| 64.0k|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 64.0k| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 64.0k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 64.0k] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 64.0k| } else { 289| 64.0k| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 64.0k| } else { 295| 64.0k| static_assert(opposite(endianness) == std::endian::native); 296| 64.0k| return reverse_bytes(typecast_copy(in)); 297| 64.0k| } 298| 64.0k| } 299| 64.0k| }()); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_: 582| 21.3k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) { 583| 21.3k| ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out); 584| 21.3k| auto store_one = [off = 0](auto o, T i) mutable { 585| 21.3k| store_any(i, o.subspan(off).template first()); 586| 21.3k| off += sizeof(T); 587| 21.3k| }; 588| | 589| 21.3k| (store_one(std::span{out}, ins), ...); 590| 21.3k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clImS7_EEDaS9_SE_: 584| 21.3k| auto store_one = [off = 0](auto o, T i) mutable { 585| 21.3k| store_any(i, o.subspan(off).template first()); 586| 21.3k| off += sizeof(T); 587| 21.3k| }; _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmEET0_PKhm: 454| 63.6k|inline constexpr OutT load_any(const uint8_t in[], size_t off) { 455| | // asserts that *in points to enough bytes to read at offset off 456| 63.6k| constexpr size_t out_size = sizeof(OutT); 457| 63.6k| return load_any(std::span(in + off * out_size, out_size)); 458| 63.6k|} _ZN5Botan7load_beImJNSt3__14spanIKhLm8EEEEEEDaDpOT0_: 504| 348|inline constexpr auto load_be(ParamTs&&... params) { 505| 348| return detail::load_any(std::forward(params)...); 506| 348|} _ZN5Botan7load_beImJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_: 504| 16|inline constexpr auto load_be(ParamTs&&... params) { 505| 16| return detail::load_any(std::forward(params)...); 506| 16|} _ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_: 278| 16|inline constexpr WrappedOutT load_any(InR&& in_range) { 279| 16| using OutT = detail::wrapped_type; 280| 16| ranges::assert_exact_byte_length(in_range); 281| | 282| 16| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 16| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { 287| 16| return fallback_load_any(std::forward(in_range)); 288| 16| } else { 289| 16| const std::span in{in_range}; 290| 16| if constexpr(sizeof(OutT) == 1) { 291| 16| return static_cast(in[0]); 292| 16| } else if constexpr(endianness == std::endian::native) { 293| 16| return typecast_copy(in); 294| 16| } else { 295| 16| static_assert(opposite(endianness) == std::endian::native); 296| 16| return reverse_bytes(typecast_copy(in)); 297| 16| } 298| 16| } 299| 16| }()); 300| 16|} _ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv: 282| 16| return detail::wrap_strong_type_or_enum([&]() -> OutT { 283| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 284| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 285| | // in a `constexpr` context. 286| 16| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (286:10): [Folded, False: 16] ------------------ 287| 0| return fallback_load_any(std::forward(in_range)); 288| 16| } else { 289| 16| const std::span in{in_range}; 290| | if constexpr(sizeof(OutT) == 1) { 291| | return static_cast(in[0]); 292| | } else if constexpr(endianness == std::endian::native) { 293| | return typecast_copy(in); 294| 16| } else { 295| 16| static_assert(opposite(endianness) == std::endian::native); 296| 16| return reverse_bytes(typecast_copy(in)); 297| 16| } 298| 16| } 299| 16| }()); _ZN5Botan7load_beImJPKhmEEEDaDpOT0_: 504| 63.6k|inline constexpr auto load_be(ParamTs&&... params) { 505| 63.6k| return detail::load_any(std::forward(params)...); 506| 63.6k|} _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm32EEERNS3_5arrayImLm4EEEEEEDaDpOT0_: 745| 1.53k|inline constexpr auto store_be(ParamTs&&... params) { 746| 1.53k| return detail::store_any(std::forward(params)...); 747| 1.53k|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 1.53k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 1.53k| ranges::assert_equal_byte_lengths(out, in); 605| 1.53k| using element_type = std::ranges::range_value_t; 606| | 607| 1.53k| const auto store_elementwise = [&] { 608| 1.53k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.53k| std::span out_s(out); 610| 1.53k| for(const auto in_elem : in) { 611| 1.53k| store_any(out_s.template first(), in_elem); 612| 1.53k| out_s = out_s.subspan(bytes_per_element); 613| 1.53k| } 614| 1.53k| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 1.53k| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 1.53k] ------------------ 620| 0| store_elementwise(); 621| 1.53k| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 1.53k| } else { 625| 1.53k| store_elementwise(); 626| 1.53k| } 627| 1.53k| } 628| 1.53k|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 1.53k| const auto store_elementwise = [&] { 608| 1.53k| constexpr size_t bytes_per_element = sizeof(element_type); 609| 1.53k| std::span out_s(out); 610| 6.14k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 6.14k, False: 1.53k] ------------------ 611| 6.14k| store_any(out_s.template first(), in_elem); 612| 6.14k| out_s = out_s.subspan(bytes_per_element); 613| 6.14k| } 614| 1.53k| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm48EEERNS3_5arrayImLm6EEEEEEDaDpOT0_: 745| 637|inline constexpr auto store_be(ParamTs&&... params) { 746| 637| return detail::store_any(std::forward(params)...); 747| 637|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 637|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 637| ranges::assert_equal_byte_lengths(out, in); 605| 637| using element_type = std::ranges::range_value_t; 606| | 607| 637| const auto store_elementwise = [&] { 608| 637| constexpr size_t bytes_per_element = sizeof(element_type); 609| 637| std::span out_s(out); 610| 637| for(const auto in_elem : in) { 611| 637| store_any(out_s.template first(), in_elem); 612| 637| out_s = out_s.subspan(bytes_per_element); 613| 637| } 614| 637| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 637| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 637] ------------------ 620| 0| store_elementwise(); 621| 637| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 637| } else { 625| 637| store_elementwise(); 626| 637| } 627| 637| } 628| 637|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 637| const auto store_elementwise = [&] { 608| 637| constexpr size_t bytes_per_element = sizeof(element_type); 609| 637| std::span out_s(out); 610| 3.82k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 3.82k, False: 637] ------------------ 611| 3.82k| store_any(out_s.template first(), in_elem); 612| 3.82k| out_s = out_s.subspan(bytes_per_element); 613| 3.82k| } 614| 637| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm64EEERNS3_5arrayImLm8EEEEEEDaDpOT0_: 745| 678|inline constexpr auto store_be(ParamTs&&... params) { 746| 678| return detail::store_any(std::forward(params)...); 747| 678|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 678|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 678| ranges::assert_equal_byte_lengths(out, in); 605| 678| using element_type = std::ranges::range_value_t; 606| | 607| 678| const auto store_elementwise = [&] { 608| 678| constexpr size_t bytes_per_element = sizeof(element_type); 609| 678| std::span out_s(out); 610| 678| for(const auto in_elem : in) { 611| 678| store_any(out_s.template first(), in_elem); 612| 678| out_s = out_s.subspan(bytes_per_element); 613| 678| } 614| 678| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 678| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 678] ------------------ 620| 0| store_elementwise(); 621| 678| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 678| } else { 625| 678| store_elementwise(); 626| 678| } 627| 678| } 628| 678|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 678| const auto store_elementwise = [&] { 608| 678| constexpr size_t bytes_per_element = sizeof(element_type); 609| 678| std::span out_s(out); 610| 5.42k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 5.42k, False: 678] ------------------ 611| 5.42k| store_any(out_s.template first(), in_elem); 612| 5.42k| out_s = out_s.subspan(bytes_per_element); 613| 5.42k| } 614| 678| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__15arrayImLm9EEEEEEDaDpOT0_: 745| 298|inline constexpr auto store_be(ParamTs&&... params) { 746| 298| return detail::store_any(std::forward(params)...); 747| 298|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_: 663| 298|inline constexpr auto store_any(InR&& in_range) { 664| 298| auto out = []([[maybe_unused]] const auto& in) { 665| 298| if constexpr(std::same_as) { 666| 298| if constexpr(ranges::statically_spanable_range) { 667| 298| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 298| return std::array(); 669| 298| } else { 670| 298| static_assert( 671| 298| !std::same_as, 672| 298| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 298| } 674| 298| } else if constexpr(concepts::resizable_byte_buffer) { 675| 298| return OutR(std::span{in}.size_bytes()); 676| 298| } else { 677| 298| return OutR{}; 678| 298| } 679| 298| }(in_range); 680| | 681| 298| store_any>(out, std::forward(in_range)); 682| 298| return out; 683| 298|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_: 664| 298| auto out = []([[maybe_unused]] const auto& in) { 665| 298| if constexpr(std::same_as) { 666| 298| if constexpr(ranges::statically_spanable_range) { 667| 298| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 298| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 298| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 298|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 298| ranges::assert_equal_byte_lengths(out, in); 605| 298| using element_type = std::ranges::range_value_t; 606| | 607| 298| const auto store_elementwise = [&] { 608| 298| constexpr size_t bytes_per_element = sizeof(element_type); 609| 298| std::span out_s(out); 610| 298| for(const auto in_elem : in) { 611| 298| store_any(out_s.template first(), in_elem); 612| 298| out_s = out_s.subspan(bytes_per_element); 613| 298| } 614| 298| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 298| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 298] ------------------ 620| 0| store_elementwise(); 621| 298| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 298| } else { 625| 298| store_elementwise(); 626| 298| } 627| 298| } 628| 298|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 298| const auto store_elementwise = [&] { 608| 298| constexpr size_t bytes_per_element = sizeof(element_type); 609| 298| std::span out_s(out); 610| 2.68k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 2.68k, False: 298] ------------------ 611| 2.68k| store_any(out_s.template first(), in_elem); 612| 2.68k| out_s = out_s.subspan(bytes_per_element); 613| 2.68k| } 614| 298| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm24EEERNS3_5arrayImLm3EEEEEEDaDpOT0_: 745| 506|inline constexpr auto store_be(ParamTs&&... params) { 746| 506| return detail::store_any(std::forward(params)...); 747| 506|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm24EEETkNS5_14spanable_rangeENS2_5arrayImLm3EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_: 603| 506|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 506| ranges::assert_equal_byte_lengths(out, in); 605| 506| using element_type = std::ranges::range_value_t; 606| | 607| 506| const auto store_elementwise = [&] { 608| 506| constexpr size_t bytes_per_element = sizeof(element_type); 609| 506| std::span out_s(out); 610| 506| for(const auto in_elem : in) { 611| 506| store_any(out_s.template first(), in_elem); 612| 506| out_s = out_s.subspan(bytes_per_element); 613| 506| } 614| 506| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 506| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 506] ------------------ 620| 0| store_elementwise(); 621| 506| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 506| } else { 625| 506| store_elementwise(); 626| 506| } 627| 506| } 628| 506|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm24EEETkNS5_14spanable_rangeENS2_5arrayImLm3EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv: 607| 506| const auto store_elementwise = [&] { 608| 506| constexpr size_t bytes_per_element = sizeof(element_type); 609| 506| std::span out_s(out); 610| 1.51k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 1.51k, False: 506] ------------------ 611| 1.51k| store_any(out_s.template first(), in_elem); 612| 1.51k| out_s = out_s.subspan(bytes_per_element); 613| 1.51k| } 614| 506| }; _ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__15arrayImLm4EEEEEEDaDpOT0_: 745| 448|inline constexpr auto store_be(ParamTs&&... params) { 746| 448| return detail::store_any(std::forward(params)...); 747| 448|} _ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm4EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_: 663| 448|inline constexpr auto store_any(InR&& in_range) { 664| 448| auto out = []([[maybe_unused]] const auto& in) { 665| 448| if constexpr(std::same_as) { 666| 448| if constexpr(ranges::statically_spanable_range) { 667| 448| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 448| return std::array(); 669| 448| } else { 670| 448| static_assert( 671| 448| !std::same_as, 672| 448| "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| 448| } 674| 448| } else if constexpr(concepts::resizable_byte_buffer) { 675| 448| return OutR(std::span{in}.size_bytes()); 676| 448| } else { 677| 448| return OutR{}; 678| 448| } 679| 448| }(in_range); 680| | 681| 448| store_any>(out, std::forward(in_range)); 682| 448| return out; 683| 448|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm4EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_: 664| 448| auto out = []([[maybe_unused]] const auto& in) { 665| 448| if constexpr(std::same_as) { 666| 448| if constexpr(ranges::statically_spanable_range) { 667| 448| constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t); 668| 448| return std::array(); 669| | } else { 670| | static_assert( 671| | !std::same_as, 672| | "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly"); 673| | } 674| | } else if constexpr(concepts::resizable_byte_buffer) { 675| | return OutR(std::span{in}.size_bytes()); 676| | } else { 677| | return OutR{}; 678| | } 679| 448| }(in_range); _ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm32EEETkNS4_14spanable_rangeENS6_ImLm4EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_: 603| 448|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 604| 448| ranges::assert_equal_byte_lengths(out, in); 605| 448| using element_type = std::ranges::range_value_t; 606| | 607| 448| const auto store_elementwise = [&] { 608| 448| constexpr size_t bytes_per_element = sizeof(element_type); 609| 448| std::span out_s(out); 610| 448| for(const auto in_elem : in) { 611| 448| store_any(out_s.template first(), in_elem); 612| 448| out_s = out_s.subspan(bytes_per_element); 613| 448| } 614| 448| }; 615| | 616| | // At compile time we cannot use `typecast_copy` as it uses `std::memcpy` 617| | // internally to copy ranges on a byte-by-byte basis, which is not allowed 618| | // in a `constexpr` context. 619| 448| if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ { ------------------ | Branch (619:7): [Folded, False: 448] ------------------ 620| 0| store_elementwise(); 621| 448| } else { 622| | if constexpr(endianness == std::endian::native && !custom_storable) { 623| | typecast_copy(out, in); 624| 448| } else { 625| 448| store_elementwise(); 626| 448| } 627| 448| } 628| 448|} _ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm32EEETkNS4_14spanable_rangeENS6_ImLm4EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv: 607| 448| const auto store_elementwise = [&] { 608| 448| constexpr size_t bytes_per_element = sizeof(element_type); 609| 448| std::span out_s(out); 610| 1.79k| for(const auto in_elem : in) { ------------------ | Branch (610:30): [True: 1.79k, False: 448] ------------------ 611| 1.79k| store_any(out_s.template first(), in_elem); 612| 1.79k| out_s = out_s.subspan(bytes_per_element); 613| 1.79k| } 614| 448| }; _ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEmEEvPT_m: 37| 384|inline void zeroize_buffer(T buf[], size_t n) { 38| 384| if(n > 0) { ------------------ | Branch (38:7): [True: 384, False: 0] ------------------ 39| 384| std::memset(buf, 0, sizeof(T) * n); 40| 384| } 41| 384|} _ZNK5Botan17Montgomery_Params1pEv: 41| 48| const BigInt& p() const { return m_data->p(); } _ZNK5Botan17Montgomery_Params2R1Ev: 43| 12| const BigInt& R1() const { return m_data->r1(); } _ZNK5Botan17Montgomery_Params2R2Ev: 45| 48| const BigInt& R2() const { return m_data->r2(); } _ZNK5Botan17Montgomery_Params6p_dashEv: 49| 48| word p_dash() const { return m_data->p_dash(); } _ZNK5Botan17Montgomery_Params7p_wordsEv: 51| 72| size_t p_words() const { return m_data->p_size(); } _ZNK5Botan17Montgomery_Params4Data1pEv: 76| 48| const BigInt& p() const { return m_p; } _ZNK5Botan17Montgomery_Params4Data2r1Ev: 78| 12| const BigInt& r1() const { return m_r1; } _ZNK5Botan17Montgomery_Params4Data2r2Ev: 80| 48| const BigInt& r2() const { return m_r2; } _ZNK5Botan17Montgomery_Params4Data6p_dashEv: 84| 48| word p_dash() const { return m_p_dash; } _ZNK5Botan17Montgomery_Params4Data6p_sizeEv: 86| 72| size_t p_size() const { return m_p_words; } _ZN5Botan10word8_add2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_: 276| 362k|inline constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W { 277| 362k|#if defined(BOTAN_MP_USE_X86_64_ASM) 278| 362k| if constexpr(std::same_as) { 279| 362k| if(!std::is_constant_evaluated()) { ------------------ | Branch (279:10): [True: 362k, Folded] ------------------ 280| 362k| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq")) 281| 362k| : [carry] "=r"(carry) 282| 362k| : [x] "r"(x), [y] "r"(y), "0"(carry) 283| 362k| : "cc", "memory"); 284| 362k| return carry; 285| 362k| } 286| 362k| } 287| 0|#endif 288| | 289| 0| x[0] = word_add(x[0], y[0], &carry); 290| 362k| x[1] = word_add(x[1], y[1], &carry); 291| 362k| x[2] = word_add(x[2], y[2], &carry); 292| 362k| x[3] = word_add(x[3], y[3], &carry); 293| 362k| x[4] = word_add(x[4], y[4], &carry); 294| 362k| x[5] = word_add(x[5], y[5], &carry); 295| 362k| x[6] = word_add(x[6], y[6], &carry); 296| 362k| x[7] = word_add(x[7], y[7], &carry); 297| 362k| return carry; 298| 362k|} _ZN5Botan8word_addITkNS_8WordTypeEmEET_S1_S1_PS1_: 239| 11.2M|inline constexpr auto word_add(W x, W y, W* carry) -> W { 240| 11.2M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc) 241| 11.2M| if(!std::is_constant_evaluated()) { ------------------ | Branch (241:7): [True: 11.2M, Folded] ------------------ 242| | if constexpr(std::same_as) { 243| | return __builtin_addc(x, y, *carry & 1, carry); 244| 11.2M| } else if constexpr(std::same_as) { 245| 11.2M| return __builtin_addcl(x, y, *carry & 1, carry); 246| | } else if constexpr(std::same_as) { 247| | return __builtin_addcll(x, y, *carry & 1, carry); 248| | } 249| 11.2M| } 250| 0|#endif 251| | 252| | if constexpr(WordInfo::dword_is_native && use_dword_for_word_add) { 253| | /* 254| | TODO(Botan4) this is largely a performance hack for GCCs that don't 255| | support __builtin_addc, if we increase the minimum supported version of 256| | GCC to GCC 14 then we can remove this and not worry about it 257| | */ 258| | const W cb = *carry & 1; 259| | const auto s = typename WordInfo::dword(x) + y + cb; 260| | *carry = static_cast(s >> WordInfo::bits); 261| | return static_cast(s); 262| 11.2M| } else { 263| 11.2M| const W cb = *carry & 1; 264| 11.2M| W z = x + y; 265| 11.2M| W c1 = (z < x); 266| 11.2M| z += cb; 267| 11.2M| *carry = c1 | (z < cb); 268| 11.2M| return z; 269| 11.2M| } 270| 11.2M|} _ZN5Botan10word8_sub2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_: 357| 40|inline constexpr auto word8_sub2(W x[8], const W y[8], W carry) -> W { 358| 40|#if defined(BOTAN_MP_USE_X86_64_ASM) 359| 40| if constexpr(std::same_as) { 360| 40| if(!std::is_constant_evaluated()) { ------------------ | Branch (360:10): [True: 40, Folded] ------------------ 361| 40| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq")) 362| 40| : [carry] "=r"(carry) 363| 40| : [x] "r"(x), [y] "r"(y), "0"(carry) 364| 40| : "cc", "memory"); 365| 40| return carry; 366| 40| } 367| 40| } 368| 0|#endif 369| | 370| 0| x[0] = word_sub(x[0], y[0], &carry); 371| 40| x[1] = word_sub(x[1], y[1], &carry); 372| 40| x[2] = word_sub(x[2], y[2], &carry); 373| 40| x[3] = word_sub(x[3], y[3], &carry); 374| 40| x[4] = word_sub(x[4], y[4], &carry); 375| 40| x[5] = word_sub(x[5], y[5], &carry); 376| 40| x[6] = word_sub(x[6], y[6], &carry); 377| 40| x[7] = word_sub(x[7], y[7], &carry); 378| 40| return carry; 379| 40|} _ZN5Botan8word_subITkNS_8WordTypeEmEET_S1_S1_PS1_: 332| 28.7M|inline constexpr auto word_sub(W x, W y, W* carry) -> W { 333| 28.7M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc) 334| 28.7M| if(!std::is_constant_evaluated()) { ------------------ | Branch (334:7): [True: 28.7M, Folded] ------------------ 335| | if constexpr(std::same_as) { 336| | return __builtin_subc(x, y, *carry & 1, carry); 337| 28.7M| } else if constexpr(std::same_as) { 338| 28.7M| return __builtin_subcl(x, y, *carry & 1, carry); 339| | } else if constexpr(std::same_as) { 340| | return __builtin_subcll(x, y, *carry & 1, carry); 341| | } 342| 28.7M| } 343| 0|#endif 344| | 345| 0| const W cb = *carry & 1; 346| 28.7M| W t0 = x - y; 347| 28.7M| W c1 = (t0 > x); 348| 28.7M| W z = t0 - cb; 349| 28.7M| *carry = c1 | (z > t0); 350| 28.7M| return z; 351| 28.7M|} _ZN5Botan10word8_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_: 385| 525k|inline constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W { 386| 525k|#if defined(BOTAN_MP_USE_X86_64_ASM) 387| 525k| if constexpr(std::same_as) { 388| 525k| if(!std::is_constant_evaluated()) { ------------------ | Branch (388:10): [True: 525k, Folded] ------------------ 389| 525k| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq")) 390| 525k| : [carry] "=r"(carry) 391| 525k| : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry) 392| 525k| : "cc", "memory"); 393| 525k| return carry; 394| 525k| } 395| 525k| } 396| 0|#endif 397| | 398| 0| z[0] = word_sub(x[0], y[0], &carry); 399| 525k| z[1] = word_sub(x[1], y[1], &carry); 400| 525k| z[2] = word_sub(x[2], y[2], &carry); 401| 525k| z[3] = word_sub(x[3], y[3], &carry); 402| 525k| z[4] = word_sub(x[4], y[4], &carry); 403| 525k| z[5] = word_sub(x[5], y[5], &carry); 404| 525k| z[6] = word_sub(x[6], y[6], &carry); 405| 525k| z[7] = word_sub(x[7], y[7], &carry); 406| 525k| return carry; 407| 525k|} _ZN5Botan10word8_add3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_: 304| 4|inline constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W { 305| 4|#if defined(BOTAN_MP_USE_X86_64_ASM) 306| 4| if constexpr(std::same_as) { 307| 4| if(!std::is_constant_evaluated()) { ------------------ | Branch (307:10): [True: 4, Folded] ------------------ 308| 4| asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq")) 309| 4| : [carry] "=r"(carry) 310| 4| : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry) 311| 4| : "cc", "memory"); 312| 4| return carry; 313| 4| } 314| 4| } 315| 0|#endif 316| | 317| 0| z[0] = word_add(x[0], y[0], &carry); 318| 4| z[1] = word_add(x[1], y[1], &carry); 319| 4| z[2] = word_add(x[2], y[2], &carry); 320| 4| z[3] = word_add(x[3], y[3], &carry); 321| 4| z[4] = word_add(x[4], y[4], &carry); 322| 4| z[5] = word_add(x[5], y[5], &carry); 323| 4| z[6] = word_add(x[6], y[6], &carry); 324| 4| z[7] = word_add(x[7], y[7], &carry); 325| 4| return carry; 326| 4|} _ZN5Botan10word_madd2ITkNS_8WordTypeEmEET_S1_S1_PS1_: 90| 89.6k|inline constexpr auto word_madd2(W a, W b, W* c) -> W { 91| 89.6k|#if defined(BOTAN_MP_USE_X86_64_ASM) 92| 89.6k| if constexpr(std::same_as) { 93| 89.6k| if(!std::is_constant_evaluated()) { ------------------ | Branch (93:10): [True: 89.6k, Folded] ------------------ 94| 89.6k| asm(R"( 95| 89.6k| mulq %[b] 96| 89.6k| addq %[c],%[a] 97| 89.6k| adcq $0,%[carry] 98| 89.6k| )" 99| 89.6k| : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c) 100| 89.6k| : "0"(a), "1"(b), [c] "g"(*c) 101| 89.6k| : "cc"); 102| | 103| 89.6k| return a; 104| 89.6k| } 105| 89.6k| } 106| |#elif defined(BOTAN_MP_USE_AARCH64_ASM) 107| | if constexpr(std::same_as) { 108| | if(!std::is_constant_evaluated()) { 109| | W lo = 0; 110| | W hi = 0; 111| | asm(R"( 112| | mul %[lo], %[a], %[b] 113| | umulh %[hi], %[a], %[b] 114| | adds %[lo], %[lo], %[c] 115| | adc %[hi], %[hi], xzr 116| | )" 117| | : [lo] "=&r"(lo), [hi] "=&r"(hi) 118| | : [a] "r"(a), [b] "r"(b), [c] "r"(*c) 119| | : "cc"); 120| | 121| | *c = hi; 122| | return lo; 123| | } 124| | } 125| |#endif 126| | 127| 0| typedef typename WordInfo::dword dword; 128| 89.6k| const dword s = dword(a) * b + *c; 129| 89.6k| *c = static_cast(s >> WordInfo::bits); 130| 89.6k| return static_cast(s); 131| 89.6k|} _ZN5Botan11word8_madd3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_: 441| 152|inline constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W { 442| 152|#if defined(BOTAN_MP_USE_X86_64_ASM) 443| 152| if constexpr(std::same_as) { 444| 152| if(!std::is_constant_evaluated()) { ------------------ | Branch (444:10): [True: 152, Folded] ------------------ 445| 152| asm volatile(DO_8_TIMES(MULADD_OP, "") 446| 152| : [carry] "=r"(carry) 447| 152| : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry) 448| 152| : "cc", "%rax", "%rdx", "memory"); 449| 152| return carry; 450| 152| } 451| 152| } 452| 0|#endif 453| | 454| 0| z[0] = word_madd3(x[0], y, z[0], &carry); 455| 152| z[1] = word_madd3(x[1], y, z[1], &carry); 456| 152| z[2] = word_madd3(x[2], y, z[2], &carry); 457| 152| z[3] = word_madd3(x[3], y, z[3], &carry); 458| 152| z[4] = word_madd3(x[4], y, z[4], &carry); 459| 152| z[5] = word_madd3(x[5], y, z[5], &carry); 460| 152| z[6] = word_madd3(x[6], y, z[6], &carry); 461| 152| z[7] = word_madd3(x[7], y, z[7], &carry); 462| 152| return carry; 463| 152|} _ZN5Botan10word_madd3ITkNS_8WordTypeEmEET_S1_S1_S1_PS1_: 137| 580k|inline constexpr auto word_madd3(W a, W b, W c, W* d) -> W { 138| 580k|#if defined(BOTAN_MP_USE_X86_64_ASM) 139| 580k| if constexpr(std::same_as) { 140| 580k| if(!std::is_constant_evaluated()) { ------------------ | Branch (140:10): [True: 580k, Folded] ------------------ 141| 580k| asm(R"( 142| 580k| mulq %[b] 143| 580k| 144| 580k| addq %[c],%[a] 145| 580k| adcq $0,%[carry] 146| 580k| 147| 580k| addq %[d],%[a] 148| 580k| adcq $0,%[carry] 149| 580k| )" 150| 580k| : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d) 151| 580k| : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d) 152| 580k| : "cc"); 153| | 154| 580k| return a; 155| 580k| } 156| 580k| } 157| |#elif defined(BOTAN_MP_USE_AARCH64_ASM) 158| | if constexpr(std::same_as) { 159| | if(!std::is_constant_evaluated()) { 160| | W lo = 0; 161| | W hi = 0; 162| | asm(R"( 163| | mul %[lo], %[a], %[b] 164| | umulh %[hi], %[a], %[b] 165| | adds %[lo], %[lo], %[c] 166| | adc %[hi], %[hi], xzr 167| | adds %[lo], %[lo], %[d] 168| | adc %[hi], %[hi], xzr 169| | )" 170| | : [lo] "=&r"(lo), [hi] "=&r"(hi) 171| | : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d) 172| | : "cc"); 173| | 174| | *d = hi; 175| | return lo; 176| | } 177| | } 178| |#endif 179| | 180| 0| typedef typename WordInfo::dword dword; 181| 580k| const dword s = dword(a) * b + c + *d; 182| 580k| *d = static_cast(s >> WordInfo::bits); 183| 580k| return static_cast(s); 184| 580k|} _ZN5Botan5word3ImE3mulEmm: 480| 104M| inline constexpr void mul(W x, W y) { m_w += static_cast(x) * y; } _ZN5Botan5word3ImE7extractEv: 486| 19.4M| inline constexpr W extract() { 487| 19.4M| W r = static_cast(m_w); 488| 19.4M| m_w >>= WordInfo::bits; 489| 19.4M| return r; 490| 19.4M| } _ZN5Botan5word3ImE3addEm: 484| 31.0M| inline constexpr void add(W x) { m_w += x; } _ZN5Botan5word3ImE10monty_stepEmm: 492| 15.5M| inline constexpr W monty_step(W p0, W p_dash) { 493| 15.5M| const W w0 = static_cast(m_w); 494| 15.5M| const W r = w0 * p_dash; 495| 15.5M| mul(r, p0); 496| 15.5M| m_w >>= WordInfo::bits; 497| 15.5M| return r; 498| 15.5M| } _ZN5Botan5word3ImEC2Ev: 478| 2.85M| constexpr word3() : m_w(0) {} _ZN5Botan11bigint_add2ITkNS_8WordTypeEmEET_PS1_mPKS1_m: 97| 1.04M|inline constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W { 98| 1.04M| W carry = 0; 99| | 100| 1.04M| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 71| 1.04M| do { \ | | 72| 1.04M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 1.04M| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 1.04M] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 1.04M| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 1.04M] | | ------------------ ------------------ 101| | 102| 1.04M| const size_t blocks = y_size - (y_size % 8); 103| | 104| 1.40M| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (104:22): [True: 362k, False: 1.04M] ------------------ 105| 362k| carry = word8_add2(x + i, y + i, carry); 106| 362k| } 107| | 108| 3.99M| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (108:27): [True: 2.95M, False: 1.04M] ------------------ 109| 2.95M| x[i] = word_add(x[i], y[i], &carry); 110| 2.95M| } 111| | 112| 1.45M| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (112:27): [True: 406k, False: 1.04M] ------------------ 113| 406k| x[i] = word_add(x[i], static_cast(0), &carry); 114| 406k| } 115| | 116| 1.04M| return carry; 117| 1.04M|} _ZN5Botan10bigint_cmpITkNS_8WordTypeEmEEiPKT_mS3_m: 462| 145|inline constexpr int32_t bigint_cmp(const W x[], size_t x_size, const W y[], size_t y_size) { 463| 145| static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption"); 464| | 465| 145| const W LT = static_cast(-1); 466| 145| const W EQ = 0; 467| 145| const W GT = 1; 468| | 469| 145| const size_t common_elems = std::min(x_size, y_size); 470| | 471| 145| W result = EQ; // until found otherwise 472| | 473| 986| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (473:22): [True: 841, False: 145] ------------------ 474| 841| const auto is_eq = CT::Mask::is_equal(x[i], y[i]); 475| 841| const auto is_lt = CT::Mask::is_lt(x[i], y[i]); 476| | 477| 841| result = is_eq.select(result, is_lt.select(LT, GT)); 478| 841| } 479| | 480| 145| if(x_size < y_size) { ------------------ | Branch (480:7): [True: 0, False: 145] ------------------ 481| 0| W mask = 0; 482| 0| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (482:30): [True: 0, False: 0] ------------------ 483| 0| mask |= y[i]; 484| 0| } 485| | 486| | // If any bits were set in high part of y, then x < y 487| 0| result = CT::Mask::is_zero(mask).select(result, LT); 488| 145| } else if(y_size < x_size) { ------------------ | Branch (488:14): [True: 12, False: 133] ------------------ 489| 12| W mask = 0; 490| 64| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (490:30): [True: 52, False: 12] ------------------ 491| 52| mask |= x[i]; 492| 52| } 493| | 494| | // If any bits were set in high part of x, then x > y 495| 12| result = CT::Mask::is_zero(mask).select(result, GT); 496| 12| } 497| | 498| 145| CT::unpoison(result); 499| 145| BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ); ------------------ | | 137| 145| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 145| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 145] | | ------------------ ------------------ 500| 145| return static_cast(result); 501| 145|} _ZN5Botan11bigint_sub2ITkNS_8WordTypeEmEET_PS1_mPKS1_m: 151| 96|inline constexpr auto bigint_sub2(W x[], size_t x_size, const W y[], size_t y_size) -> W { 152| 96| W borrow = 0; 153| | 154| 96| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 71| 96| do { \ | | 72| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 96| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 96] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 96| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 96] | | ------------------ ------------------ 155| | 156| 96| const size_t blocks = y_size - (y_size % 8); 157| | 158| 136| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (158:22): [True: 40, False: 96] ------------------ 159| 40| borrow = word8_sub2(x + i, y + i, borrow); 160| 40| } 161| | 162| 480| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (162:27): [True: 384, False: 96] ------------------ 163| 384| x[i] = word_sub(x[i], y[i], &borrow); 164| 384| } 165| | 166| 96| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (166:27): [True: 0, False: 96] ------------------ 167| 0| x[i] = word_sub(x[i], static_cast(0), &borrow); 168| 0| } 169| | 170| 96| return borrow; 171| 96|} _ZN5Botan11bigint_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m: 195| 1.39M|inline constexpr auto bigint_sub3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W { 196| 1.39M| W borrow = 0; 197| | 198| 1.39M| BOTAN_ASSERT(x_size >= y_size, "Expected sizes"); ------------------ | | 71| 1.39M| do { \ | | 72| 1.39M| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 1.39M| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 1.39M] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 1.39M| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 1.39M] | | ------------------ ------------------ 199| | 200| 1.39M| const size_t blocks = y_size - (y_size % 8); 201| | 202| 1.92M| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (202:22): [True: 525k, False: 1.39M] ------------------ 203| 525k| borrow = word8_sub3(z + i, x + i, y + i, borrow); 204| 525k| } 205| | 206| 5.44M| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (206:27): [True: 4.04M, False: 1.39M] ------------------ 207| 4.04M| z[i] = word_sub(x[i], y[i], &borrow); 208| 4.04M| } 209| | 210| 1.39M| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (210:27): [True: 244, False: 1.39M] ------------------ 211| 244| z[i] = word_sub(x[i], static_cast(0), &borrow); 212| 244| } 213| | 214| 1.39M| return borrow; 215| 1.39M|} _ZN5Botan11bigint_add3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m: 123| 25|inline constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W { 124| 25| if(x_size < y_size) { ------------------ | Branch (124:7): [True: 1, False: 24] ------------------ 125| 1| return bigint_add3(z, y, y_size, x, x_size); 126| 1| } 127| | 128| 24| W carry = 0; 129| | 130| 24| const size_t blocks = y_size - (y_size % 8); 131| | 132| 28| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (132:22): [True: 4, False: 24] ------------------ 133| 4| carry = word8_add3(z + i, x + i, y + i, carry); 134| 4| } 135| | 136| 99| for(size_t i = blocks; i != y_size; ++i) { ------------------ | Branch (136:27): [True: 75, False: 24] ------------------ 137| 75| z[i] = word_add(x[i], y[i], &carry); 138| 75| } 139| | 140| 46| for(size_t i = y_size; i != x_size; ++i) { ------------------ | Branch (140:27): [True: 22, False: 24] ------------------ 141| 22| z[i] = word_add(x[i], static_cast(0), &carry); 142| 22| } 143| | 144| 24| return carry; 145| 25|} _ZN5Botan14bigint_cnd_addITkNS_8WordTypeEmEET_S1_PS1_PKS1_m: 48| 264|inline constexpr W bigint_cnd_add(W cnd, W x[], const W y[], size_t size) { 49| 264| const auto mask = CT::Mask::expand(cnd).value(); 50| | 51| 264| W carry = 0; 52| | 53| 1.80k| for(size_t i = 0; i != size; ++i) { ------------------ | Branch (53:22): [True: 1.54k, False: 264] ------------------ 54| 1.54k| x[i] = word_add(x[i], y[i] & mask, &carry); 55| 1.54k| } 56| | 57| 264| return (mask & carry); 58| 264|} _ZN5Botan14divide_precompImEC2Emmmm: 771| 36| m_divisor(divisor), m_shift(shift), m_norm_divisor(norm_divisor), m_reciprocal(reciprocal) {} _ZNK5Botan14divide_precompImE14divmod_2to1_ctEmm: 731| 264| inline constexpr std::pair divmod_2to1_ct(W n1, W n0) const { 732| | /* 733| | * Scale the numerator to match the normalized divisor; the scaling cancels 734| | * in the quotient and is removed from the remainder by the final shift. 735| | */ 736| 264| n1 <<= m_shift; 737| 264| const size_t rshift = WordInfo::bits - m_shift; 738| | /* 739| | * We can't just `n0 >> rshift` because m_shift may be 0 (high bit divisor) 740| | * in which case rshift will be the maximum bit length, and >> by the maximum 741| | * bitlength is undefined behavior despite having an entirely obvious meaning. 742| | * 743| | * However we know m_shift is not equal to the bit length of the word, because 744| | * that would imply that the divisor is 0. Thus rshift must be >= 1. So split 745| | * the shift into two phases (first rshift-1, then 1) 746| | */ 747| 264| n1 |= (n0 >> 1) >> (rshift - 1); 748| 264| n0 <<= m_shift; 749| | 750| 264| const auto [q, scaled_r] = div2by1_preinv(n1, n0, m_norm_divisor, m_reciprocal); 751| 264| const W r = scaled_r >> m_shift; 752| 264| return std::make_pair(q, r); 753| 264| } _ZN5Botan14divide_precompImE14div2by1_preinvEmmmm: 782| 264| static constexpr std::pair div2by1_preinv(W u1, W u0, W D, W v) { 783| | // Steps 1-3: = v*u1; += ; q1 += 1 784| 264| W q1 = u0; 785| 264| const W q0 = word_madd2(u1, v, &q1); // = u1*v + u0 786| 264| q1 += u1 + 1; 787| | 788| | // Step 4 789| 264| W r = u0 - q1 * D; 790| | 791| | // Steps 5-7: If r >= q0 { q1 -= 1; r += d; } 792| 264| const auto fix_down = CT::Mask::is_gt(r, q0); 793| 264| q1 -= fix_down.if_set_return(1); 794| 264| r += fix_down.if_set_return(D); 795| | 796| | // Steps 8-10: if r >= D { q1 += 1; r -= D; } 797| 264| const auto fix_up = CT::Mask::is_gte(r, D); 798| 264| q1 += fix_up.if_set_return(1); 799| 264| r -= fix_up.if_set_return(D); 800| | 801| | // Step 11 802| 264| return std::make_pair(q1, r); 803| 264| } _ZN5Botan17bigint_monty_redcEPmPKmS2_mmS0_m: 1077| 48| word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 1078| 48| const size_t z_size = 2 * p_size; 1079| | 1080| 48| BOTAN_ARG_CHECK(ws_size >= p_size, "Montgomery reduction workspace too small"); ------------------ | | 35| 48| do { \ | | 36| 48| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 48| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 48] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 48| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 48] | | ------------------ ------------------ 1081| | 1082| 48| if(p_size == 4) { ------------------ | Branch (1082:7): [True: 24, False: 24] ------------------ 1083| 24| bigint_monty_redc_4(r, z, p, p_dash, ws); 1084| 24| } else if(p_size == 6) { ------------------ | Branch (1084:14): [True: 8, False: 16] ------------------ 1085| 8| bigint_monty_redc_6(r, z, p, p_dash, ws); 1086| 16| } else if(p_size == 8) { ------------------ | Branch (1086:14): [True: 8, False: 8] ------------------ 1087| 8| bigint_monty_redc_8(r, z, p, p_dash, ws); 1088| 8| } else if(p_size == 12) { ------------------ | Branch (1088:14): [True: 0, False: 8] ------------------ 1089| 0| bigint_monty_redc_12(r, z, p, p_dash, ws); 1090| 8| } else if(p_size == 16) { ------------------ | Branch (1090:14): [True: 0, False: 8] ------------------ 1091| 0| bigint_monty_redc_16(r, z, p, p_dash, ws); 1092| 8| } else if(p_size == 24) { ------------------ | Branch (1092:14): [True: 0, False: 8] ------------------ 1093| 0| bigint_monty_redc_24(r, z, p, p_dash, ws); 1094| 8| } else if(p_size == 32) { ------------------ | Branch (1094:14): [True: 0, False: 8] ------------------ 1095| 0| bigint_monty_redc_32(r, z, p, p_dash, ws); 1096| 8| } else { 1097| 8| bigint_monty_redc_generic(r, z, z_size, p, p_size, p_dash, ws); 1098| 8| } 1099| 48|} _ZN5Botan25bigint_monty_redc_inplaceEPmPKmmmS0_m: 1101| 48|inline void bigint_monty_redc_inplace(word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) { 1102| 48| bigint_monty_redc(z, z, p, p_size, p_dash, ws, ws_size); 1103| 48| zeroize_buffer(z + p_size, p_size); 1104| 48|} _ZN5Botan15bigint_ct_is_eqITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_m: 542| 24|inline constexpr auto bigint_ct_is_eq(const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask { 543| 24| const size_t common_elems = std::min(x_size, y_size); 544| | 545| 24| W diff = 0; 546| | 547| 304| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (547:22): [True: 280, False: 24] ------------------ 548| 280| diff |= (x[i] ^ y[i]); 549| 280| } 550| | 551| | // If any bits were set in high part of x/y, then they are not equal 552| 24| if(x_size < y_size) { ------------------ | Branch (552:7): [True: 2, False: 22] ------------------ 553| 18| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (553:30): [True: 16, False: 2] ------------------ 554| 16| diff |= y[i]; 555| 16| } 556| 22| } else if(y_size < x_size) { ------------------ | Branch (556:14): [True: 0, False: 22] ------------------ 557| 0| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (557:30): [True: 0, False: 0] ------------------ 558| 0| diff |= x[i]; 559| 0| } 560| 0| } 561| | 562| 24| return CT::Mask::is_zero(diff); 563| 24|} _ZN5Botan15bigint_ct_is_ltITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_mb: 510| 4.22k| -> CT::Mask { 511| 4.22k| const size_t common_elems = std::min(x_size, y_size); 512| | 513| 4.22k| auto is_lt = CT::Mask::expand(lt_or_equal); 514| | 515| 26.2k| for(size_t i = 0; i != common_elems; i++) { ------------------ | Branch (515:22): [True: 22.0k, False: 4.22k] ------------------ 516| 22.0k| const auto eq = CT::Mask::is_equal(x[i], y[i]); 517| 22.0k| const auto lt = CT::Mask::is_lt(x[i], y[i]); 518| 22.0k| is_lt = eq.select_mask(is_lt, lt); 519| 22.0k| } 520| | 521| 4.22k| if(x_size < y_size) { ------------------ | Branch (521:7): [True: 0, False: 4.22k] ------------------ 522| 0| W mask = 0; 523| 0| for(size_t i = x_size; i != y_size; i++) { ------------------ | Branch (523:30): [True: 0, False: 0] ------------------ 524| 0| mask |= y[i]; 525| 0| } 526| | // If any bits were set in high part of y, then is_lt should be forced true 527| 0| is_lt |= CT::Mask::expand(mask); 528| 4.22k| } else if(y_size < x_size) { ------------------ | Branch (528:14): [True: 98, False: 4.12k] ------------------ 529| 98| W mask = 0; 530| 746| for(size_t i = y_size; i != x_size; i++) { ------------------ | Branch (530:30): [True: 648, False: 98] ------------------ 531| 648| mask |= x[i]; 532| 648| } 533| | 534| | // If any bits were set in high part of x, then is_lt should be false 535| 98| is_lt &= CT::Mask::is_zero(mask); 536| 98| } 537| | 538| 4.22k| return is_lt; 539| 4.22k|} _ZN5Botan14divide_precompImE5setupEm: 694| 36| static constexpr divide_precomp setup(W divisor) { 695| 36| const size_t shift = WordInfo::bits - high_bit(divisor); 696| 36| const W norm_divisor = divisor << shift; 697| 36| const W reciprocal = reciprocal_word_ct(norm_divisor); 698| 36| return divide_precomp(divisor, shift, norm_divisor, reciprocal); 699| 36| } _ZN5Botan18reciprocal_word_ctITkNS_8WordTypeEmEET_S1_: 649| 36|constexpr W reciprocal_word_ct(W D) { 650| 36| BOTAN_DEBUG_ASSERT((D & WordInfo::top_bit) != 0); ------------------ | | 137| 36| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 36| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 36] | | ------------------ ------------------ 651| | 652| | // Bit serial long division of ((~D) || (2^b - 1)) / D, with all of the 653| | // conditional logic computed via masks 654| 36| W remainder = static_cast(~D); 655| 36| W quotient = 0; 656| | 657| 2.34k| for(size_t i = 0; i != WordInfo::bits; ++i) { ------------------ | Branch (657:22): [True: 2.30k, False: 36] ------------------ 658| 2.30k| const auto carry = CT::Mask::expand_top_bit(remainder); 659| 2.30k| remainder = static_cast((remainder << 1) | 1); 660| 2.30k| quotient <<= 1; 661| | 662| 2.30k| const auto sub = carry | CT::Mask::is_gte(remainder, D); 663| 2.30k| remainder -= sub.if_set_return(D); 664| 2.30k| quotient |= sub.if_set_return(1); 665| 2.30k| } 666| | 667| 36| return quotient; 668| 36|} _ZN5Botan13bigint_submulITkNS_8WordTypeEmEET_PS1_PKS1_mS1_: 442| 264|inline constexpr auto bigint_submul(W z[], const W y[], size_t N, W q) -> W { 443| 264| W mul_carry = 0; 444| 264| W borrow = 0; 445| | 446| 1.80k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (446:22): [True: 1.54k, False: 264] ------------------ 447| 1.54k| const W t = word_madd2(y[i], q, &mul_carry); 448| 1.54k| z[i] = word_sub(z[i], t, &borrow); 449| 1.54k| } 450| | 451| | // Both mul_carry <= W_max - 1 and borrow <= 1, so this cannot overflow 452| 264| return mul_carry + borrow; 453| 264|} _ZN5Botan14bigint_sub_absITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPS3_PKS3_S7_mS5_: 282| 96|inline constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask { 283| | // Subtract in both direction then conditional copy out the result 284| | 285| 96| W* ws0 = ws; 286| 96| W* ws1 = ws + N; 287| | 288| 96| W borrow0 = 0; 289| 96| W borrow1 = 0; 290| | 291| 96| const size_t blocks = N - (N % 8); 292| | 293| 120| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (293:22): [True: 24, False: 96] ------------------ 294| 24| borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0); 295| 24| borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1); 296| 24| } 297| | 298| 512| for(size_t i = blocks; i != N; ++i) { ------------------ | Branch (298:27): [True: 416, False: 96] ------------------ 299| 416| ws0[i] = word_sub(x[i], y[i], &borrow0); 300| 416| ws1[i] = word_sub(y[i], x[i], &borrow1); 301| 416| } 302| | 303| 96| return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N); 304| 96|} _ZN5Botan13monty_inverseITkNS_8WordTypeEmEET_S1_: 856| 12|inline constexpr auto monty_inverse(W a) -> W { 857| 12| BOTAN_ARG_CHECK(a % 2 == 1, "Cannot compute Montgomery inverse of an even integer"); ------------------ | | 35| 12| do { \ | | 36| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 12| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 12] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12] | | ------------------ ------------------ 858| | 859| | // Newton's Method, following https://lemire.me/blog/2017/09/18/computing-the-inverse-of-odd-integers/ 860| | 861| 12| constexpr size_t iter = WordInfo::bits == 64 ? 4 : 3; ------------------ | Branch (861:28): [True: 0, Folded] ------------------ 862| | 863| | // Initial guess provides 5 bits of accuracy 864| 12| W r = (3 * a) ^ 2; 865| | 866| | // Each iteration doubles the accuracy 867| 60| for(size_t i = 0; i != iter; ++i) { ------------------ | Branch (867:22): [True: 48, False: 12] ------------------ 868| 48| r = r * (2 - r * a); 869| 48| } 870| | 871| | // Now invert in addition space 872| 12| r = (WordInfo::max - r) + 1; 873| | 874| 12| return r; 875| 12|} _ZN5Botan22bigint_monty_maybe_subITkNS_8WordTypeEmEEvmPT_S1_PKS1_S4_: 228| 8|inline constexpr void bigint_monty_maybe_sub(size_t N, W z[], W x0, const W x[], const W p[]) { 229| 8| W borrow = 0; 230| | 231| 8| const size_t blocks = N - (N % 8); 232| | 233| 12| for(size_t i = 0; i != blocks; i += 8) { ------------------ | Branch (233:22): [True: 4, False: 8] ------------------ 234| 4| borrow = word8_sub3(z + i, x + i, p + i, borrow); 235| 4| } 236| | 237| 24| for(size_t i = blocks; i != N; ++i) { ------------------ | Branch (237:27): [True: 16, False: 8] ------------------ 238| 16| z[i] = word_sub(x[i], p[i], &borrow); 239| 16| } 240| | 241| 8| borrow = (x0 - borrow) > x0; 242| | 243| 8| CT::conditional_assign_mem(borrow, z, x, N); 244| 8|} _ZN5Botan9comba_sqrILm4ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 785k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 785k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 785k, Folded] ------------------ 1009| 785k| if constexpr(std::same_as && N == 4) { 1010| 785k| return bigint_comba_sqr4(z, x); 1011| 785k| } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 785k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 785k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 785k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 785k|} _ZN5Botan22bigint_monty_maybe_subILm4ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 1.33M|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 1.33M| W borrow = 0; 259| | 260| 6.67M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 5.33M, False: 1.33M] ------------------ 261| 5.33M| z[i] = word_sub(x[i], y[i], &borrow); 262| 5.33M| } 263| | 264| 1.33M| borrow = (x0 - borrow) > x0; 265| | 266| 1.33M| CT::conditional_assign_mem(borrow, z, x, N); 267| 1.33M|} _ZN5Botan9comba_mulILm4ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 289k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 289k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 289k, Folded] ------------------ 973| 289k| if constexpr(std::same_as && N == 4) { 974| 289k| return bigint_comba_mul4(z, x, y); 975| 289k| } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 289k| } 992| | 993| 0| word3 accum; 994| | 995| 289k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 289k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 289k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 39.1k|inline constexpr W shift_left(std::array& x) { 879| 39.1k| static_assert(N >= 1, "Invalid input size"); 880| 39.1k| static_assert(S > 0, "Zero shift not supported"); 881| 39.1k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 39.1k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 156k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 117k, False: 39.1k] ------------------ 886| 117k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 117k| } 888| 39.1k| x[0] <<= S; 889| | 890| 39.1k| return carry; 891| 39.1k|} _ZN5Botan16read_window_bitsILm4EmLm4EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 77.1k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 77.1k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 77.1k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 77.1k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 77.1k| const auto bit_shift = offset % W_bits; 1281| 77.1k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 77.1k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 77.1k, False: 0] | Branch (1283:74): [True: 0, False: 0] ------------------ 1284| | 1285| 77.1k| const auto w0 = words[word_offset]; 1286| | 1287| 77.1k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 77.1k, False: 0] ------------------ 1288| 77.1k| return (w0 >> bit_shift) & WindowMask; 1289| 77.1k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 0| const auto w1 = words[word_offset - 1]; 1292| 0| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 0| return combined & WindowMask; 1294| 0| } 1295| 77.1k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 1.41M|inline constexpr W shift_right(std::array& x) { 895| 1.41M| static_assert(N >= 1, "Invalid input size"); 896| 1.41M| static_assert(S > 0, "Zero shift not supported"); 897| 1.41M| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 1.41M| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 5.64M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 4.23M, False: 1.41M] ------------------ 902| 4.23M| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 4.23M| } 904| 1.41M| x[N - 1] >>= S; 905| | 906| 1.41M| return carry; 907| 1.41M|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm8ELm64EEEDaNSt3__14spanIKhXT1_EEE: 1245| 2.26k|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 2.26k| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 2.26k| std::array r = {}; 1249| | 1250| 2.26k| constexpr size_t full_words = L / WordInfo::bytes; 1251| 2.26k| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 2.26k| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 20.4k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 18.1k, False: 2.26k] ------------------ 1256| 18.1k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 18.1k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 2.26k| return r; 1270| 2.26k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm4ELm32EEEDaNSt3__14spanIKhXT1_EEE: 1245| 1.53k|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 1.53k| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 1.53k| std::array r = {}; 1249| | 1250| 1.53k| constexpr size_t full_words = L / WordInfo::bytes; 1251| 1.53k| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 1.53k| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 7.67k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 6.14k, False: 1.53k] ------------------ 1256| 6.14k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 6.14k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 1.53k| return r; 1270| 1.53k|} _ZN5Botan9comba_sqrILm6ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 396k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 396k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 396k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| 396k| if constexpr(std::same_as && N == 6) { 1013| 396k| return bigint_comba_sqr6(z, x); 1014| 396k| } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 396k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 396k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 396k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 396k|} _ZN5Botan22bigint_monty_maybe_subILm6ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 679k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 679k| W borrow = 0; 259| | 260| 4.75M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 4.07M, False: 679k] ------------------ 261| 4.07M| z[i] = word_sub(x[i], y[i], &borrow); 262| 4.07M| } 263| | 264| 679k| borrow = (x0 - borrow) > x0; 265| | 266| 679k| CT::conditional_assign_mem(borrow, z, x, N); 267| 679k|} _ZN5Botan9comba_mulILm6ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 136k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 136k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 136k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| 136k| if constexpr(std::same_as && N == 6) { 977| 136k| return bigint_comba_mul6(z, x, y); 978| 136k| } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 136k| } 992| | 993| 0| word3 accum; 994| | 995| 136k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 136k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 136k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 19.8k|inline constexpr W shift_left(std::array& x) { 879| 19.8k| static_assert(N >= 1, "Invalid input size"); 880| 19.8k| static_assert(S > 0, "Zero shift not supported"); 881| 19.8k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 19.8k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 119k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 99.2k, False: 19.8k] ------------------ 886| 99.2k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 99.2k| } 888| 19.8k| x[0] <<= S; 889| | 890| 19.8k| return carry; 891| 19.8k|} _ZN5Botan16read_window_bitsILm5EmLm6EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 35.9k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 35.9k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 35.9k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 35.9k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 35.9k| const auto bit_shift = offset % W_bits; 1281| 35.9k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 35.9k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 33.6k, False: 2.33k] | Branch (1283:74): [True: 467, False: 1.86k] ------------------ 1284| | 1285| 35.9k| const auto w0 = words[word_offset]; 1286| | 1287| 35.9k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 34.0k, False: 1.86k] ------------------ 1288| 34.0k| return (w0 >> bit_shift) & WindowMask; 1289| 34.0k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 1.86k| const auto w1 = words[word_offset - 1]; 1292| 1.86k| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 1.86k| return combined & WindowMask; 1294| 1.86k| } 1295| 35.9k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 691k|inline constexpr W shift_right(std::array& x) { 895| 691k| static_assert(N >= 1, "Invalid input size"); 896| 691k| static_assert(S > 0, "Zero shift not supported"); 897| 691k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 691k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 4.14M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 3.45M, False: 691k] ------------------ 902| 3.45M| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 3.45M| } 904| 691k| x[N - 1] >>= S; 905| | 906| 691k| return carry; 907| 691k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm12ELm96EEEDaNSt3__14spanIKhXT1_EEE: 1245| 652|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 652| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 652| std::array r = {}; 1249| | 1250| 652| constexpr size_t full_words = L / WordInfo::bytes; 1251| 652| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 652| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 8.47k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 7.82k, False: 652] ------------------ 1256| 7.82k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 7.82k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 652| return r; 1270| 652|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm6ELm48EEEDaNSt3__14spanIKhXT1_EEE: 1245| 1.16k|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 1.16k| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 1.16k| std::array r = {}; 1249| | 1250| 1.16k| constexpr size_t full_words = L / WordInfo::bytes; 1251| 1.16k| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 1.16k| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 8.15k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 6.99k, False: 1.16k] ------------------ 1256| 6.99k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 6.99k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 1.16k| return r; 1270| 1.16k|} _ZN5Botan9comba_sqrILm8ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 570k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 570k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 570k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| 570k| if constexpr(std::same_as && N == 8) { 1019| 570k| return bigint_comba_sqr8(z, x); 1020| 570k| } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 570k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 570k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 570k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 570k|} _ZN5Botan22bigint_monty_maybe_subILm8ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 981k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 981k| W borrow = 0; 259| | 260| 8.83M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 7.85M, False: 981k] ------------------ 261| 7.85M| z[i] = word_sub(x[i], y[i], &borrow); 262| 7.85M| } 263| | 264| 981k| borrow = (x0 - borrow) > x0; 265| | 266| 981k| CT::conditional_assign_mem(borrow, z, x, N); 267| 981k|} _ZN5Botan9comba_mulILm8ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 207k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 207k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 207k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| 207k| if constexpr(std::same_as && N == 8) { 983| 207k| return bigint_comba_mul8(z, x, y); 984| 207k| } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 207k| } 992| | 993| 0| word3 accum; 994| | 995| 207k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 207k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 207k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 26.3k|inline constexpr W shift_left(std::array& x) { 879| 26.3k| static_assert(N >= 1, "Invalid input size"); 880| 26.3k| static_assert(S > 0, "Zero shift not supported"); 881| 26.3k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 26.3k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 211k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 184k, False: 26.3k] ------------------ 886| 184k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 184k| } 888| 26.3k| x[0] <<= S; 889| | 890| 26.3k| return carry; 891| 26.3k|} _ZN5Botan16read_window_bitsILm5EmLm8EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 105k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 105k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 105k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 105k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 105k| const auto bit_shift = offset % W_bits; 1281| 105k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 105k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 97.9k, False: 7.14k] | Branch (1283:74): [True: 1.02k, False: 6.12k] ------------------ 1284| | 1285| 105k| const auto w0 = words[word_offset]; 1286| | 1287| 105k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 98.9k, False: 6.12k] ------------------ 1288| 98.9k| return (w0 >> bit_shift) & WindowMask; 1289| 98.9k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 6.12k| const auto w1 = words[word_offset - 1]; 1292| 6.12k| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 6.12k| return combined & WindowMask; 1294| 6.12k| } 1295| 105k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 991k|inline constexpr W shift_right(std::array& x) { 895| 991k| static_assert(N >= 1, "Invalid input size"); 896| 991k| static_assert(S > 0, "Zero shift not supported"); 897| 991k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 991k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 7.92M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 6.93M, False: 991k] ------------------ 902| 6.93M| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 6.93M| } 904| 991k| x[N - 1] >>= S; 905| | 906| 991k| return carry; 907| 991k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm16ELm128EEEDaNSt3__14spanIKhXT1_EEE: 1245| 700|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 700| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 700| std::array r = {}; 1249| | 1250| 700| constexpr size_t full_words = L / WordInfo::bytes; 1251| 700| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 700| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 11.9k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 11.2k, False: 700] ------------------ 1256| 11.2k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 11.2k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 700| return r; 1270| 700|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 13.1k|inline constexpr W shift_left(std::array& x) { 879| 13.1k| static_assert(N >= 1, "Invalid input size"); 880| 13.1k| static_assert(S > 0, "Zero shift not supported"); 881| 13.1k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 13.1k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 118k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 105k, False: 13.1k] ------------------ 886| 105k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 105k| } 888| 13.1k| x[0] <<= S; 889| | 890| 13.1k| return carry; 891| 13.1k|} _ZN5Botan22bigint_monty_maybe_subILm9ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 380k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 380k| W borrow = 0; 259| | 260| 3.80M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 3.42M, False: 380k] ------------------ 261| 3.42M| z[i] = word_sub(x[i], y[i], &borrow); 262| 3.42M| } 263| | 264| 380k| borrow = (x0 - borrow) > x0; 265| | 266| 380k| CT::conditional_assign_mem(borrow, z, x, N); 267| 380k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 437k|inline constexpr W shift_right(std::array& x) { 895| 437k| static_assert(N >= 1, "Invalid input size"); 896| 437k| static_assert(S > 0, "Zero shift not supported"); 897| 437k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 437k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 3.93M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 3.49M, False: 437k] ------------------ 902| 3.49M| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 3.49M| } 904| 437k| x[N - 1] >>= S; 905| | 906| 437k| return carry; 907| 437k|} _ZN5Botan13redc_crandallITkNS_8WordTypeEmLm8ETnT_Lm569EEENSt3__15arrayIS1_XT0_EEENS2_4spanIKS1_XmlLi2ET0_EEE: 1167| 58.1k|constexpr std::array redc_crandall(std::span z) { 1168| 58.1k| static_assert(N >= 2); 1169| | 1170| 58.1k| std::array hi = {}; 1171| | 1172| | // hi = hi * c + lo 1173| | 1174| 58.1k| W carry = 0; 1175| 523k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (1175:22): [True: 465k, False: 58.1k] ------------------ 1176| 465k| hi[i] = word_madd3(z[i + N], C, z[i], &carry); 1177| 465k| } 1178| | 1179| | // hi += carry * C 1180| 58.1k| W carry_c[2] = {0}; 1181| 58.1k| carry_c[0] = word_madd2(carry, C, &carry_c[1]); 1182| | 1183| 58.1k| carry = bigint_add2(hi.data(), N, carry_c, 2); 1184| | 1185| 58.1k| constexpr W P0 = WordInfo::max - (C - 1); 1186| | 1187| 58.1k| std::array r = {}; 1188| | 1189| 58.1k| W borrow = 0; 1190| | 1191| | /* 1192| | * For undetermined reasons, on GCC (only) removing this asm block causes 1193| | * massive (up to 20%) performance regressions in secp256k1. 1194| | * 1195| | * The generated code without the asm seems quite reasonable, and timing 1196| | * repeated calls to redc_crandall with the cycle counter show that GCC 1197| | * computes it in about the same number of cycles with or without the asm. 1198| | * 1199| | * So the cause of the regression is unclear. But it is reproducible across 1200| | * machines and GCC versions. 1201| | */ 1202| |#if defined(BOTAN_MP_USE_X86_64_ASM) && defined(__GNUC__) && !defined(__clang__) 1203| | if constexpr(N == 4 && std::same_as) { 1204| | if(!std::is_constant_evaluated()) { 1205| | asm volatile(R"( 1206| | movq 0(%[x]), %[borrow] 1207| | subq %[p0], %[borrow] 1208| | movq %[borrow], 0(%[r]) 1209| | movq 8(%[x]), %[borrow] 1210| | sbbq $-1, %[borrow] 1211| | movq %[borrow], 8(%[r]) 1212| | movq 16(%[x]), %[borrow] 1213| | sbbq $-1, %[borrow] 1214| | movq %[borrow], 16(%[r]) 1215| | movq 24(%[x]), %[borrow] 1216| | sbbq $-1, %[borrow] 1217| | movq %[borrow], 24(%[r]) 1218| | sbbq %[borrow],%[borrow] 1219| | negq %[borrow] 1220| | )" 1221| | : [borrow] "=r"(borrow) 1222| | : [x] "r"(hi.data()), [p0] "r"(P0), [r] "r"(r.data()), "0"(borrow) 1223| | : "cc", "memory"); 1224| | 1225| | borrow = (carry - borrow) > carry; 1226| | CT::conditional_assign_mem(borrow, r.data(), hi.data(), N); 1227| | return r; 1228| | } 1229| | } 1230| |#endif 1231| | 1232| 58.1k| r[0] = word_sub(hi[0], P0, &borrow); 1233| 465k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (1233:22): [True: 407k, False: 58.1k] ------------------ 1234| 407k| r[i] = word_sub(hi[i], WordInfo::max, &borrow); 1235| 407k| } 1236| | 1237| 58.1k| borrow = (carry - borrow) > carry; 1238| | 1239| 58.1k| CT::conditional_assign_mem(borrow, r.data(), hi.data(), N); 1240| | 1241| 58.1k| return r; 1242| 58.1k|} _ZN5Botan9comba_sqrILm3ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 154k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 154k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 154k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| | if constexpr(std::same_as && N == 9) { 1022| | return bigint_comba_sqr9(z, x); 1023| | } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 154k| } 1028| | 1029| 154k| word3 accum; 1030| | 1031| 1.08M| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 926k, False: 154k] ------------------ 1032| 926k| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 308k, False: 617k] ------------------ 1033| 926k| const size_t end = std::min(N, i + 1); 1034| | 1035| 2.31M| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 1.38M, False: 926k] ------------------ 1036| 1.38M| accum.mul(x[j], x[i - j]); 1037| 1.38M| } 1038| 926k| z[i] = accum.extract(); 1039| 926k| } 1040| 154k|} _ZN5Botan9comba_mulILm3ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 61.2k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 61.2k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 61.2k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| | if constexpr(std::same_as && N == 9) { 986| | return bigint_comba_mul9(z, x, y); 987| | } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 61.2k| } 992| | 993| 61.2k| word3 accum; 994| | 995| 428k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 367k, False: 61.2k] ------------------ 996| 367k| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 122k, False: 244k] ------------------ 997| 367k| const size_t end = std::min(N, i + 1); 998| | 999| 918k| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 550k, False: 367k] ------------------ 1000| 550k| accum.mul(x[j], y[i - j]); 1001| 550k| } 1002| 367k| z[i] = accum.extract(); 1003| 367k| } 1004| 61.2k|} _ZN5Botan22bigint_monty_maybe_subILm3ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_: 257| 264k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) { 258| 264k| W borrow = 0; 259| | 260| 1.05M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (260:22): [True: 792k, False: 264k] ------------------ 261| 792k| z[i] = word_sub(x[i], y[i], &borrow); 262| 792k| } 263| | 264| 264k| borrow = (x0 - borrow) > x0; 265| | 266| 264k| CT::conditional_assign_mem(borrow, z, x, N); 267| 264k|} _ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm3EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 5.03k|inline constexpr W shift_left(std::array& x) { 879| 5.03k| static_assert(N >= 1, "Invalid input size"); 880| 5.03k| static_assert(S > 0, "Zero shift not supported"); 881| 5.03k| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 5.03k| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 15.0k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 10.0k, False: 5.03k] ------------------ 886| 10.0k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 10.0k| } 888| 5.03k| x[0] <<= S; 889| | 890| 5.03k| return carry; 891| 5.03k|} _ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm3EEET0_RNSt3__15arrayIS1_XT1_EEE: 894| 275k|inline constexpr W shift_right(std::array& x) { 895| 275k| static_assert(N >= 1, "Invalid input size"); 896| 275k| static_assert(S > 0, "Zero shift not supported"); 897| 275k| static_assert(S < WordInfo::bits, "Shift too large"); 898| | 899| 275k| const W carry = x[0] << (WordInfo::bits - S); 900| | 901| 827k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (901:22): [True: 551k, False: 275k] ------------------ 902| 551k| x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo::bits - S)); 903| 551k| } 904| 275k| x[N - 1] >>= S; 905| | 906| 275k| return carry; 907| 275k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm3ELm24EEEDaNSt3__14spanIKhXT1_EEE: 1245| 506|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 506| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 506| std::array r = {}; 1249| | 1250| 506| constexpr size_t full_words = L / WordInfo::bytes; 1251| 506| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 506| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 2.02k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 1.51k, False: 506] ------------------ 1256| 1.51k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 1.51k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 506| return r; 1270| 506|} _ZN5Botan16read_window_bitsILm4EmLm3EEEmNSt3__14spanIKT0_XT1_EEEm: 1274| 36.4k|constexpr size_t read_window_bits(std::span words, size_t offset) { 1275| 36.4k| static_assert(WindowBits >= 1 && WindowBits <= 7); 1276| | 1277| 36.4k| constexpr uint8_t WindowMask = static_cast(1 << WindowBits) - 1; 1278| | 1279| 36.4k| constexpr size_t W_bits = sizeof(W) * 8; 1280| 36.4k| const auto bit_shift = offset % W_bits; 1281| 36.4k| const auto word_offset = words.size() - 1 - (offset / W_bits); 1282| | 1283| 36.4k| const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0; ------------------ | Branch (1283:36): [True: 36.4k, False: 0] | Branch (1283:74): [True: 0, False: 0] ------------------ 1284| | 1285| 36.4k| const auto w0 = words[word_offset]; 1286| | 1287| 36.4k| if(single_byte_window) { ------------------ | Branch (1287:7): [True: 36.4k, False: 0] ------------------ 1288| 36.4k| return (w0 >> bit_shift) & WindowMask; 1289| 36.4k| } else { 1290| | // Otherwise we must join two words and extract the result 1291| 0| const auto w1 = words[word_offset - 1]; 1292| 0| const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift))); 1293| 0| return combined & WindowMask; 1294| 0| } 1295| 36.4k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm8ELm56EEEDaNSt3__14spanIKhXT1_EEE: 1245| 460|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 460| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 460| std::array r = {}; 1249| | 1250| 460| constexpr size_t full_words = L / WordInfo::bytes; 1251| 460| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 460| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 3.68k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 3.22k, False: 460] ------------------ 1256| 3.22k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 3.22k| } 1258| | 1259| | if constexpr(extra_bytes > 0) { 1260| | constexpr size_t shift = extra_bytes * 8; 1261| | shift_left(r); 1262| | 1263| | for(size_t i = 0; i != extra_bytes; ++i) { 1264| | const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| | r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| | } 1267| | } 1268| | 1269| 460| return r; 1270| 460|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm4ELm28EEEDaNSt3__14spanIKhXT1_EEE: 1245| 448|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 448| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 448| std::array r = {}; 1249| | 1250| 448| constexpr size_t full_words = L / WordInfo::bytes; 1251| 448| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 448| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 1.79k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 1.34k, False: 448] ------------------ 1256| 1.34k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 1.34k| } 1258| | 1259| 448| if constexpr(extra_bytes > 0) { 1260| 448| constexpr size_t shift = extra_bytes * 8; 1261| 448| shift_left(r); 1262| | 1263| 2.24k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (1263:25): [True: 1.79k, False: 448] ------------------ 1264| 1.79k| const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| 1.79k| r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| 1.79k| } 1267| 448| } 1268| | 1269| 448| return r; 1270| 448|} _ZN5Botan10shift_leftILm32ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 448|inline constexpr W shift_left(std::array& x) { 879| 448| static_assert(N >= 1, "Invalid input size"); 880| 448| static_assert(S > 0, "Zero shift not supported"); 881| 448| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 448| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 1.79k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 1.34k, False: 448] ------------------ 886| 1.34k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 1.34k| } 888| 448| x[0] <<= S; 889| | 890| 448| return carry; 891| 448|} _ZN5Botan13redc_crandallITkNS_8WordTypeEmLm4ETnT_Lm4294968273EEENSt3__15arrayIS1_XT0_EEENS2_4spanIKS1_XmlLi2ET0_EEE: 1167| 28.5k|constexpr std::array redc_crandall(std::span z) { 1168| 28.5k| static_assert(N >= 2); 1169| | 1170| 28.5k| std::array hi = {}; 1171| | 1172| | // hi = hi * c + lo 1173| | 1174| 28.5k| W carry = 0; 1175| 142k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (1175:22): [True: 114k, False: 28.5k] ------------------ 1176| 114k| hi[i] = word_madd3(z[i + N], C, z[i], &carry); 1177| 114k| } 1178| | 1179| | // hi += carry * C 1180| 28.5k| W carry_c[2] = {0}; 1181| 28.5k| carry_c[0] = word_madd2(carry, C, &carry_c[1]); 1182| | 1183| 28.5k| carry = bigint_add2(hi.data(), N, carry_c, 2); 1184| | 1185| 28.5k| constexpr W P0 = WordInfo::max - (C - 1); 1186| | 1187| 28.5k| std::array r = {}; 1188| | 1189| 28.5k| W borrow = 0; 1190| | 1191| | /* 1192| | * For undetermined reasons, on GCC (only) removing this asm block causes 1193| | * massive (up to 20%) performance regressions in secp256k1. 1194| | * 1195| | * The generated code without the asm seems quite reasonable, and timing 1196| | * repeated calls to redc_crandall with the cycle counter show that GCC 1197| | * computes it in about the same number of cycles with or without the asm. 1198| | * 1199| | * So the cause of the regression is unclear. But it is reproducible across 1200| | * machines and GCC versions. 1201| | */ 1202| |#if defined(BOTAN_MP_USE_X86_64_ASM) && defined(__GNUC__) && !defined(__clang__) 1203| | if constexpr(N == 4 && std::same_as) { 1204| | if(!std::is_constant_evaluated()) { 1205| | asm volatile(R"( 1206| | movq 0(%[x]), %[borrow] 1207| | subq %[p0], %[borrow] 1208| | movq %[borrow], 0(%[r]) 1209| | movq 8(%[x]), %[borrow] 1210| | sbbq $-1, %[borrow] 1211| | movq %[borrow], 8(%[r]) 1212| | movq 16(%[x]), %[borrow] 1213| | sbbq $-1, %[borrow] 1214| | movq %[borrow], 16(%[r]) 1215| | movq 24(%[x]), %[borrow] 1216| | sbbq $-1, %[borrow] 1217| | movq %[borrow], 24(%[r]) 1218| | sbbq %[borrow],%[borrow] 1219| | negq %[borrow] 1220| | )" 1221| | : [borrow] "=r"(borrow) 1222| | : [x] "r"(hi.data()), [p0] "r"(P0), [r] "r"(r.data()), "0"(borrow) 1223| | : "cc", "memory"); 1224| | 1225| | borrow = (carry - borrow) > carry; 1226| | CT::conditional_assign_mem(borrow, r.data(), hi.data(), N); 1227| | return r; 1228| | } 1229| | } 1230| |#endif 1231| | 1232| 28.5k| r[0] = word_sub(hi[0], P0, &borrow); 1233| 114k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (1233:22): [True: 85.6k, False: 28.5k] ------------------ 1234| 85.6k| r[i] = word_sub(hi[i], WordInfo::max, &borrow); 1235| 85.6k| } 1236| | 1237| 28.5k| borrow = (carry - borrow) > carry; 1238| | 1239| 28.5k| CT::conditional_assign_mem(borrow, r.data(), hi.data(), N); 1240| | 1241| 28.5k| return r; 1242| 28.5k|} _ZN5Botan9comba_sqrILm9ETkNS_8WordTypeEmEEvPT0_PKS1_: 1007| 245k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) { 1008| 245k| if(!std::is_constant_evaluated()) { ------------------ | Branch (1008:7): [True: 245k, Folded] ------------------ 1009| | if constexpr(std::same_as && N == 4) { 1010| | return bigint_comba_sqr4(z, x); 1011| | } 1012| | if constexpr(std::same_as && N == 6) { 1013| | return bigint_comba_sqr6(z, x); 1014| | } 1015| | if constexpr(std::same_as && N == 7) { 1016| | return bigint_comba_sqr7(z, x); 1017| | } 1018| | if constexpr(std::same_as && N == 8) { 1019| | return bigint_comba_sqr8(z, x); 1020| | } 1021| 245k| if constexpr(std::same_as && N == 9) { 1022| 245k| return bigint_comba_sqr9(z, x); 1023| 245k| } 1024| | if constexpr(std::same_as && N == 16) { 1025| | return bigint_comba_sqr16(z, x); 1026| | } 1027| 245k| } 1028| | 1029| 0| word3 accum; 1030| | 1031| 245k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (1031:22): [True: 0, False: 245k] ------------------ 1032| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (1032:28): [True: 0, False: 0] ------------------ 1033| 0| const size_t end = std::min(N, i + 1); 1034| | 1035| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (1035:29): [True: 0, False: 0] ------------------ 1036| 0| accum.mul(x[j], x[i - j]); 1037| 0| } 1038| 0| z[i] = accum.extract(); 1039| 0| } 1040| 245k|} _ZN5Botan9comba_mulILm9ETkNS_8WordTypeEmEEvPT0_PKS1_S4_: 971| 74.7k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) { 972| 74.7k| if(!std::is_constant_evaluated()) { ------------------ | Branch (972:7): [True: 74.7k, Folded] ------------------ 973| | if constexpr(std::same_as && N == 4) { 974| | return bigint_comba_mul4(z, x, y); 975| | } 976| | if constexpr(std::same_as && N == 6) { 977| | return bigint_comba_mul6(z, x, y); 978| | } 979| | if constexpr(std::same_as && N == 7) { 980| | return bigint_comba_mul7(z, x, y); 981| | } 982| | if constexpr(std::same_as && N == 8) { 983| | return bigint_comba_mul8(z, x, y); 984| | } 985| 74.7k| if constexpr(std::same_as && N == 9) { 986| 74.7k| return bigint_comba_mul9(z, x, y); 987| 74.7k| } 988| | if constexpr(std::same_as && N == 16) { 989| | return bigint_comba_mul16(z, x, y); 990| | } 991| 74.7k| } 992| | 993| 0| word3 accum; 994| | 995| 74.7k| for(size_t i = 0; i != 2 * N; ++i) { ------------------ | Branch (995:22): [True: 0, False: 74.7k] ------------------ 996| 0| const size_t start = i + 1 < N ? 0 : i + 1 - N; ------------------ | Branch (996:28): [True: 0, False: 0] ------------------ 997| 0| const size_t end = std::min(N, i + 1); 998| | 999| 0| for(size_t j = start; j != end; ++j) { ------------------ | Branch (999:29): [True: 0, False: 0] ------------------ 1000| 0| accum.mul(x[j], y[i - j]); 1001| 0| } 1002| 0| z[i] = accum.extract(); 1003| 0| } 1004| 74.7k|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm18ELm132EEEDaNSt3__14spanIKhXT1_EEE: 1245| 308|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 308| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 308| std::array r = {}; 1249| | 1250| 308| constexpr size_t full_words = L / WordInfo::bytes; 1251| 308| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 308| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 5.23k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 4.92k, False: 308] ------------------ 1256| 4.92k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 4.92k| } 1258| | 1259| 308| if constexpr(extra_bytes > 0) { 1260| 308| constexpr size_t shift = extra_bytes * 8; 1261| 308| shift_left(r); 1262| | 1263| 1.54k| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (1263:25): [True: 1.23k, False: 308] ------------------ 1264| 1.23k| const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| 1.23k| r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| 1.23k| } 1267| 308| } 1268| | 1269| 308| return r; 1270| 308|} _ZN5Botan10shift_leftILm32ETkNS_8WordTypeEmLm18EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 308|inline constexpr W shift_left(std::array& x) { 879| 308| static_assert(N >= 1, "Invalid input size"); 880| 308| static_assert(S > 0, "Zero shift not supported"); 881| 308| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 308| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 5.54k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 5.23k, False: 308] ------------------ 886| 5.23k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 5.23k| } 888| 308| x[0] <<= S; 889| | 890| 308| return carry; 891| 308|} _ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm9ELm66EEEDaNSt3__14spanIKhXT1_EEE: 1245| 298|inline constexpr auto bytes_to_words(std::span bytes) { 1246| 298| static_assert(L <= WordInfo::bytes * N); 1247| | 1248| 298| std::array r = {}; 1249| | 1250| 298| constexpr size_t full_words = L / WordInfo::bytes; 1251| 298| constexpr size_t extra_bytes = L % WordInfo::bytes; 1252| | 1253| 298| static_assert(full_words + (extra_bytes ? 1 : 0) <= N); 1254| | 1255| 2.68k| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (1255:22): [True: 2.38k, False: 298] ------------------ 1256| 2.38k| r[i] = load_be(bytes.data(), full_words - 1 - i); 1257| 2.38k| } 1258| | 1259| 298| if constexpr(extra_bytes > 0) { 1260| 298| constexpr size_t shift = extra_bytes * 8; 1261| 298| shift_left(r); 1262| | 1263| 894| for(size_t i = 0; i != extra_bytes; ++i) { ------------------ | Branch (1263:25): [True: 596, False: 298] ------------------ 1264| 596| const W b0 = bytes[WordInfo::bytes * full_words + i]; 1265| 596| r[0] |= (b0 << (8 * (extra_bytes - 1 - i))); 1266| 596| } 1267| 298| } 1268| | 1269| 298| return r; 1270| 298|} _ZN5Botan10shift_leftILm16ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE: 878| 298|inline constexpr W shift_left(std::array& x) { 879| 298| static_assert(N >= 1, "Invalid input size"); 880| 298| static_assert(S > 0, "Zero shift not supported"); 881| 298| static_assert(S < WordInfo::bits, "Shift too large"); 882| | 883| 298| const W carry = x[N - 1] >> (WordInfo::bits - S); 884| | 885| 2.68k| for(size_t i = N - 1; i != 0; --i) { ------------------ | Branch (885:26): [True: 2.38k, False: 298] ------------------ 886| 2.38k| x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo::bits - S)); 887| 2.38k| } 888| 298| x[0] <<= S; 889| | 890| 298| return carry; 891| 298|} _ZN5Botan6PCurve15PrimeOrderCurve6ScalarD2Ev: 73| 178k| ~Scalar() { _zeroize(); } _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2EOS2_: 68| 115k| Scalar(Scalar&& other) = default; _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2ERKS2_: 67| 6.22k| Scalar(const Scalar& other) = default; _ZNK5Botan6PCurve15PrimeOrderCurve6Scalar6_curveEv: 77| 144k| const auto& _curve() const { return m_curve; } _ZNK5Botan6PCurve15PrimeOrderCurve6Scalar6_valueEv: 79| 144k| const auto& _value() const { return m_value; } _ZN5Botan6PCurve15PrimeOrderCurve6Scalar7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEE: 81| 56.6k| static Scalar _create(CurvePtr curve, StorageUnit v) { return Scalar(std::move(curve), v); } _ZN5Botan6PCurve15PrimeOrderCurve6ScalarC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEE: 84| 56.6k| Scalar(CurvePtr curve, StorageUnit v) : m_curve(std::move(curve)), m_value(v) {} _ZN5Botan6PCurve15PrimeOrderCurve6ScalaraSEOS2_: 70| 2.11k| Scalar& operator=(Scalar&& other) = default; _ZN5Botan6PCurve15PrimeOrderCurveD2Ev: 164| 12| virtual ~PrimeOrderCurve() = default; pcurves_brainpool256r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 419| 833|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 420| | // Cost: 1M + 3S + 1A + 1*3 421| 833| const auto z2 = pt.z().square(); 422| 833| const auto m = pt.x().square().mul3() + A * z2.square(); 423| | 424| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 425| 833| const auto y2 = pt.y().square(); 426| 833| const auto s = pt.x().mul4() * y2; 427| 833| const auto nx = m.square() - s.mul2(); 428| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 429| 833| const auto nz = pt.y().mul2() * pt.z(); 430| | 431| 833| return ProjectivePoint(nx, ny, nz); 432| 833|} pcurves_brainpool256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_brainpool256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_brainpool256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_brainpool384r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 419| 1.24k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 420| | // Cost: 1M + 3S + 1A + 1*3 421| 1.24k| const auto z2 = pt.z().square(); 422| 1.24k| const auto m = pt.x().square().mul3() + A * z2.square(); 423| | 424| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 425| 1.24k| const auto y2 = pt.y().square(); 426| 1.24k| const auto s = pt.x().mul4() * y2; 427| 1.24k| const auto nx = m.square() - s.mul2(); 428| 1.24k| const auto ny = m * (s - nx) - y2.square().mul8(); 429| 1.24k| const auto nz = pt.y().mul2() * pt.z(); 430| | 431| 1.24k| return ProjectivePoint(nx, ny, nz); 432| 1.24k|} pcurves_brainpool384r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.09k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.09k| const auto a_is_identity = a.is_identity(); 190| 1.09k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.09k| const auto Z1Z1 = a.z().square(); 193| 1.09k| const auto Z2Z2 = b.z().square(); 194| 1.09k| const auto U1 = a.x() * Z2Z2; 195| 1.09k| const auto U2 = b.x() * Z1Z1; 196| 1.09k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.09k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.09k| const auto H = U2 - U1; 199| 1.09k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.09k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.09k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.09k| const auto HH = H.square(); 216| 1.09k| const auto HHH = H * HH; 217| 1.09k| const auto V = U1 * HH; 218| 1.09k| const auto t2 = r.square(); 219| 1.09k| const auto t3 = V + V; 220| 1.09k| const auto t4 = t2 - HHH; 221| 1.09k| auto X3 = t4 - t3; 222| 1.09k| const auto t5 = V - X3; 223| 1.09k| const auto t6 = S1 * HHH; 224| 1.09k| const auto t7 = r * t5; 225| 1.09k| auto Y3 = t7 - t6; 226| 1.09k| const auto t8 = b.z() * H; 227| 1.09k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.09k| return ProjectivePoint(X3, Y3, Z3); 236| 1.09k|} pcurves_brainpool384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 2.33k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 2.33k, False: 1] ------------------ 118| 2.33k| any_identity = any_identity || pt.is_identity(); 119| 2.33k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 2.33k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 2.33k, False: 1] ------------------ 147| 2.33k| c.push_back(c[i - 1] * projective[i].z()); 148| 2.33k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 2.33k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 2.33k, False: 1] ------------------ 159| 2.33k| const auto& p = projective[i]; 160| | 161| 2.33k| const auto z_inv = s_inv * c[i - 1]; 162| 2.33k| const auto z2_inv = z_inv.square(); 163| 2.33k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 2.33k| s_inv = s_inv * p.z(); 166| | 167| 2.33k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 2.33k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_brainpool384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_brainpool512r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_: 419| 1.64k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) { 420| | // Cost: 1M + 3S + 1A + 1*3 421| 1.64k| const auto z2 = pt.z().square(); 422| 1.64k| const auto m = pt.x().square().mul3() + A * z2.square(); 423| | 424| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 425| 1.64k| const auto y2 = pt.y().square(); 426| 1.64k| const auto s = pt.x().mul4() * y2; 427| 1.64k| const auto nx = m.square() - s.mul2(); 428| 1.64k| const auto ny = m * (s - nx) - y2.square().mul8(); 429| 1.64k| const auto nz = pt.y().mul2() * pt.z(); 430| | 431| 1.64k| return ProjectivePoint(nx, ny, nz); 432| 1.64k|} pcurves_brainpool512r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.45k| const auto a_is_identity = a.is_identity(); 190| 1.45k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.45k| const auto Z1Z1 = a.z().square(); 193| 1.45k| const auto Z2Z2 = b.z().square(); 194| 1.45k| const auto U1 = a.x() * Z2Z2; 195| 1.45k| const auto U2 = b.x() * Z1Z1; 196| 1.45k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.45k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.45k| const auto H = U2 - U1; 199| 1.45k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.45k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.45k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.45k| const auto HH = H.square(); 216| 1.45k| const auto HHH = H * HH; 217| 1.45k| const auto V = U1 * HH; 218| 1.45k| const auto t2 = r.square(); 219| 1.45k| const auto t3 = V + V; 220| 1.45k| const auto t4 = t2 - HHH; 221| 1.45k| auto X3 = t4 - t3; 222| 1.45k| const auto t5 = V - X3; 223| 1.45k| const auto t6 = S1 * HHH; 224| 1.45k| const auto t7 = r * t5; 225| 1.45k| auto Y3 = t7 - t6; 226| 1.45k| const auto t8 = b.z() * H; 227| 1.45k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.45k| return ProjectivePoint(X3, Y3, Z3); 236| 1.45k|} pcurves_brainpool512r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 3.10k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 3.10k, False: 1] ------------------ 118| 3.10k| any_identity = any_identity || pt.is_identity(); 119| 3.10k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 3.10k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 3.10k, False: 1] ------------------ 147| 3.10k| c.push_back(c[i - 1] * projective[i].z()); 148| 3.10k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 3.10k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 3.10k, False: 1] ------------------ 159| 3.10k| const auto& p = projective[i]; 160| | 161| 3.10k| const auto z_inv = s_inv * c[i - 1]; 162| 3.10k| const auto z2_inv = z_inv.square(); 163| 3.10k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 3.10k| s_inv = s_inv * p.z(); 166| | 167| 3.10k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 3.10k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_brainpool512r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_frp256v1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES3_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 833|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 833| const auto z2 = pt.z().square(); 390| 833| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 833| const auto y2 = pt.y().square(); 394| 833| const auto s = pt.x().mul4() * y2; 395| 833| const auto nx = m.square() - s.mul2(); 396| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 833| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 833| return ProjectivePoint(nx, ny, nz); 400| 833|} pcurves_frp256v1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_frp256v1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_18frp256v15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_frp256v1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_18frp256v15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_numsp512d1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 1.64k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 1.64k| const auto z2 = pt.z().square(); 390| 1.64k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 1.64k| const auto y2 = pt.y().square(); 394| 1.64k| const auto s = pt.x().mul4() * y2; 395| 1.64k| const auto nx = m.square() - s.mul2(); 396| 1.64k| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 1.64k| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 1.64k| return ProjectivePoint(nx, ny, nz); 400| 1.64k|} pcurves_numsp512d1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.45k| const auto a_is_identity = a.is_identity(); 190| 1.45k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.45k| const auto Z1Z1 = a.z().square(); 193| 1.45k| const auto Z2Z2 = b.z().square(); 194| 1.45k| const auto U1 = a.x() * Z2Z2; 195| 1.45k| const auto U2 = b.x() * Z1Z1; 196| 1.45k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.45k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.45k| const auto H = U2 - U1; 199| 1.45k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.45k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.45k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.45k| const auto HH = H.square(); 216| 1.45k| const auto HHH = H * HH; 217| 1.45k| const auto V = U1 * HH; 218| 1.45k| const auto t2 = r.square(); 219| 1.45k| const auto t3 = V + V; 220| 1.45k| const auto t4 = t2 - HHH; 221| 1.45k| auto X3 = t4 - t3; 222| 1.45k| const auto t5 = V - X3; 223| 1.45k| const auto t6 = S1 * HHH; 224| 1.45k| const auto t7 = r * t5; 225| 1.45k| auto Y3 = t7 - t6; 226| 1.45k| const auto t8 = b.z() * H; 227| 1.45k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.45k| return ProjectivePoint(X3, Y3, Z3); 236| 1.45k|} pcurves_numsp512d1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_110numsp512d15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 3.10k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 3.10k, False: 1] ------------------ 118| 3.10k| any_identity = any_identity || pt.is_identity(); 119| 3.10k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 3.10k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 3.10k, False: 1] ------------------ 147| 3.10k| c.push_back(c[i - 1] * projective[i].z()); 148| 3.10k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 3.10k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 3.10k, False: 1] ------------------ 159| 3.10k| const auto& p = projective[i]; 160| | 161| 3.10k| const auto z_inv = s_inv * c[i - 1]; 162| 3.10k| const auto z2_inv = z_inv.square(); 163| 3.10k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 3.10k| s_inv = s_inv * p.z(); 166| | 167| 3.10k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 3.10k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_numsp512d1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_110numsp512d15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp192r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 629|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 629| const auto z2 = pt.z().square(); 390| 629| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 629| const auto y2 = pt.y().square(); 394| 629| const auto s = pt.x().mul4() * y2; 395| 629| const auto nx = m.square() - s.mul2(); 396| 629| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 629| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 629| return ProjectivePoint(nx, ny, nz); 400| 629|} pcurves_secp192r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 555|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 555| const auto a_is_identity = a.is_identity(); 190| 555| const auto b_is_identity = b.is_identity(); 191| | 192| 555| const auto Z1Z1 = a.z().square(); 193| 555| const auto Z2Z2 = b.z().square(); 194| 555| const auto U1 = a.x() * Z2Z2; 195| 555| const auto U2 = b.x() * Z1Z1; 196| 555| const auto S1 = a.y() * b.z() * Z2Z2; 197| 555| const auto S2 = b.y() * a.z() * Z1Z1; 198| 555| const auto H = U2 - U1; 199| 555| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 555| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 555] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 555| const auto HH = H.square(); 216| 555| const auto HHH = H * HH; 217| 555| const auto V = U1 * HH; 218| 555| const auto t2 = r.square(); 219| 555| const auto t3 = V + V; 220| 555| const auto t4 = t2 - HHH; 221| 555| auto X3 = t4 - t3; 222| 555| const auto t5 = V - X3; 223| 555| const auto t6 = S1 * HHH; 224| 555| const auto t7 = r * t5; 225| 555| auto Y3 = t7 - t6; 226| 555| const auto t8 = b.z() * H; 227| 555| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 555| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 555| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 555| return ProjectivePoint(X3, Y3, Z3); 236| 555|} pcurves_secp192r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp192r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.18k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.18k, False: 1] ------------------ 118| 1.18k| any_identity = any_identity || pt.is_identity(); 119| 1.18k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.18k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.18k, False: 1] ------------------ 147| 1.18k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.18k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.18k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.18k, False: 1] ------------------ 159| 1.18k| const auto& p = projective[i]; 160| | 161| 1.18k| const auto z_inv = s_inv * c[i - 1]; 162| 1.18k| const auto z2_inv = z_inv.square(); 163| 1.18k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.18k| s_inv = s_inv * p.z(); 166| | 167| 1.18k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.18k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp192r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp192r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp224r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 731|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 731| const auto z2 = pt.z().square(); 390| 731| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 731| const auto y2 = pt.y().square(); 394| 731| const auto s = pt.x().mul4() * y2; 395| 731| const auto nx = m.square() - s.mul2(); 396| 731| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 731| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 731| return ProjectivePoint(nx, ny, nz); 400| 731|} pcurves_secp224r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 645|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 645| const auto a_is_identity = a.is_identity(); 190| 645| const auto b_is_identity = b.is_identity(); 191| | 192| 645| const auto Z1Z1 = a.z().square(); 193| 645| const auto Z2Z2 = b.z().square(); 194| 645| const auto U1 = a.x() * Z2Z2; 195| 645| const auto U2 = b.x() * Z1Z1; 196| 645| const auto S1 = a.y() * b.z() * Z2Z2; 197| 645| const auto S2 = b.y() * a.z() * Z1Z1; 198| 645| const auto H = U2 - U1; 199| 645| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 645| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 645] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 645| const auto HH = H.square(); 216| 645| const auto HHH = H * HH; 217| 645| const auto V = U1 * HH; 218| 645| const auto t2 = r.square(); 219| 645| const auto t3 = V + V; 220| 645| const auto t4 = t2 - HHH; 221| 645| auto X3 = t4 - t3; 222| 645| const auto t5 = V - X3; 223| 645| const auto t6 = S1 * HHH; 224| 645| const auto t7 = r * t5; 225| 645| auto Y3 = t7 - t6; 226| 645| const auto t8 = b.z() * H; 227| 645| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 645| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 645| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 645| return ProjectivePoint(X3, Y3, Z3); 236| 645|} pcurves_secp224r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp224r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.37k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.37k, False: 1] ------------------ 118| 1.37k| any_identity = any_identity || pt.is_identity(); 119| 1.37k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.37k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.37k, False: 1] ------------------ 147| 1.37k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.37k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.37k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.37k, False: 1] ------------------ 159| 1.37k| const auto& p = projective[i]; 160| | 161| 1.37k| const auto z_inv = s_inv * c[i - 1]; 162| 1.37k| const auto z2_inv = z_inv.square(); 163| 1.37k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.37k| s_inv = s_inv * p.z(); 166| | 167| 1.37k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.37k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp224r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp224r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp256k1.cpp:_ZN5Botan10dbl_a_zeroINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 403| 833|inline constexpr ProjectivePoint dbl_a_zero(const ProjectivePoint& pt) { 404| | // If a == 0 then 3*x^2 + a*z^4 == 3*x^2 405| | // Cost: 1S + 1*3 406| 833| const auto m = pt.x().square().mul3(); 407| | 408| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 409| 833| const auto y2 = pt.y().square(); 410| 833| const auto s = pt.x().mul4() * y2; 411| 833| const auto nx = m.square() - s.mul2(); 412| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 413| 833| const auto nz = pt.y().mul2() * pt.z(); 414| | 415| 833| return ProjectivePoint(nx, ny, nz); 416| 833|} pcurves_secp256k1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_secp256k1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256k15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp256k1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256k15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp256r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 833|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 833| const auto z2 = pt.z().square(); 390| 833| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 833| const auto y2 = pt.y().square(); 394| 833| const auto s = pt.x().mul4() * y2; 395| 833| const auto nx = m.square() - s.mul2(); 396| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 833| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 833| return ProjectivePoint(nx, ny, nz); 400| 833|} pcurves_secp256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_secp256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp384r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 1.24k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 1.24k| const auto z2 = pt.z().square(); 390| 1.24k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 1.24k| const auto y2 = pt.y().square(); 394| 1.24k| const auto s = pt.x().mul4() * y2; 395| 1.24k| const auto nx = m.square() - s.mul2(); 396| 1.24k| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 1.24k| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 1.24k| return ProjectivePoint(nx, ny, nz); 400| 1.24k|} pcurves_secp384r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.09k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.09k| const auto a_is_identity = a.is_identity(); 190| 1.09k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.09k| const auto Z1Z1 = a.z().square(); 193| 1.09k| const auto Z2Z2 = b.z().square(); 194| 1.09k| const auto U1 = a.x() * Z2Z2; 195| 1.09k| const auto U2 = b.x() * Z1Z1; 196| 1.09k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.09k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.09k| const auto H = U2 - U1; 199| 1.09k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.09k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.09k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.09k| const auto HH = H.square(); 216| 1.09k| const auto HHH = H * HH; 217| 1.09k| const auto V = U1 * HH; 218| 1.09k| const auto t2 = r.square(); 219| 1.09k| const auto t3 = V + V; 220| 1.09k| const auto t4 = t2 - HHH; 221| 1.09k| auto X3 = t4 - t3; 222| 1.09k| const auto t5 = V - X3; 223| 1.09k| const auto t6 = S1 * HHH; 224| 1.09k| const auto t7 = r * t5; 225| 1.09k| auto Y3 = t7 - t6; 226| 1.09k| const auto t8 = b.z() * H; 227| 1.09k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.09k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.09k| return ProjectivePoint(X3, Y3, Z3); 236| 1.09k|} pcurves_secp384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 2.33k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 2.33k, False: 1] ------------------ 118| 2.33k| any_identity = any_identity || pt.is_identity(); 119| 2.33k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 2.33k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 2.33k, False: 1] ------------------ 147| 2.33k| c.push_back(c[i - 1] * projective[i].z()); 148| 2.33k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 2.33k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 2.33k, False: 1] ------------------ 159| 2.33k| const auto& p = projective[i]; 160| | 161| 2.33k| const auto z_inv = s_inv * c[i - 1]; 162| 2.33k| const auto z2_inv = z_inv.square(); 163| 2.33k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 2.33k| s_inv = s_inv * p.z(); 166| | 167| 2.33k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 2.33k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_secp521r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 1.64k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 1.64k| const auto z2 = pt.z().square(); 390| 1.64k| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 1.64k| const auto y2 = pt.y().square(); 394| 1.64k| const auto s = pt.x().mul4() * y2; 395| 1.64k| const auto nx = m.square() - s.mul2(); 396| 1.64k| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 1.64k| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 1.64k| return ProjectivePoint(nx, ny, nz); 400| 1.64k|} pcurves_secp521r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 1.45k| const auto a_is_identity = a.is_identity(); 190| 1.45k| const auto b_is_identity = b.is_identity(); 191| | 192| 1.45k| const auto Z1Z1 = a.z().square(); 193| 1.45k| const auto Z2Z2 = b.z().square(); 194| 1.45k| const auto U1 = a.x() * Z2Z2; 195| 1.45k| const auto U2 = b.x() * Z1Z1; 196| 1.45k| const auto S1 = a.y() * b.z() * Z2Z2; 197| 1.45k| const auto S2 = b.y() * a.z() * Z1Z1; 198| 1.45k| const auto H = U2 - U1; 199| 1.45k| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 1.45k| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 1.45k] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 1.45k| const auto HH = H.square(); 216| 1.45k| const auto HHH = H * HH; 217| 1.45k| const auto V = U1 * HH; 218| 1.45k| const auto t2 = r.square(); 219| 1.45k| const auto t3 = V + V; 220| 1.45k| const auto t4 = t2 - HHH; 221| 1.45k| auto X3 = t4 - t3; 222| 1.45k| const auto t5 = V - X3; 223| 1.45k| const auto t6 = S1 * HHH; 224| 1.45k| const auto t7 = r * t5; 225| 1.45k| auto Y3 = t7 - t6; 226| 1.45k| const auto t8 = b.z() * H; 227| 1.45k| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 1.45k| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 1.45k| return ProjectivePoint(X3, Y3, Z3); 236| 1.45k|} pcurves_secp521r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 3.10k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 3.10k, False: 1] ------------------ 118| 3.10k| any_identity = any_identity || pt.is_identity(); 119| 3.10k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 3.10k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 3.10k, False: 1] ------------------ 147| 3.10k| c.push_back(c[i - 1] * projective[i].z()); 148| 3.10k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 3.10k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 3.10k, False: 1] ------------------ 159| 3.10k| const auto& p = projective[i]; 160| | 161| 3.10k| const auto z_inv = s_inv * c[i - 1]; 162| 3.10k| const auto z2_inv = z_inv.square(); 163| 3.10k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 3.10k| s_inv = s_inv * p.z(); 166| | 167| 3.10k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 3.10k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_secp521r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_sm2p256v1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_: 384| 833|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) { 385| | /* 386| | if a == -3 then 387| | 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2) 388| | */ 389| 833| const auto z2 = pt.z().square(); 390| 833| const auto m = (pt.x() - z2).mul3() * (pt.x() + z2); 391| | 392| | // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8 393| 833| const auto y2 = pt.y().square(); 394| 833| const auto s = pt.x().mul4() * y2; 395| 833| const auto nx = m.square() - s.mul2(); 396| 833| const auto ny = m * (s - nx) - y2.square().mul8(); 397| 833| const auto nz = pt.y().mul2() * pt.z(); 398| | 399| 833| return ProjectivePoint(nx, ny, nz); 400| 833|} pcurves_sm2p256v1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_: 188| 735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) { 189| 735| const auto a_is_identity = a.is_identity(); 190| 735| const auto b_is_identity = b.is_identity(); 191| | 192| 735| const auto Z1Z1 = a.z().square(); 193| 735| const auto Z2Z2 = b.z().square(); 194| 735| const auto U1 = a.x() * Z2Z2; 195| 735| const auto U2 = b.x() * Z1Z1; 196| 735| const auto S1 = a.y() * b.z() * Z2Z2; 197| 735| const auto S2 = b.y() * a.z() * Z1Z1; 198| 735| const auto H = U2 - U1; 199| 735| const auto r = S2 - S1; 200| | 201| | /* Risky conditional 202| | * 203| | * This implementation uses projective coordinates, which do not have an efficient complete 204| | * addition formula. We rely on the design of the multiplication algorithms to avoid doublings. 205| | * 206| | * This conditional only comes into play for the actual doubling case, not x + (-x) which 207| | * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0, 208| | * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct 209| | * output (the identity element) 210| | */ 211| 735| if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) { ------------------ | Branch (211:7): [True: 0, False: 735] ------------------ 212| 0| return a.dbl(); 213| 0| } 214| | 215| 735| const auto HH = H.square(); 216| 735| const auto HHH = H * HH; 217| 735| const auto V = U1 * HH; 218| 735| const auto t2 = r.square(); 219| 735| const auto t3 = V + V; 220| 735| const auto t4 = t2 - HHH; 221| 735| auto X3 = t4 - t3; 222| 735| const auto t5 = V - X3; 223| 735| const auto t6 = S1 * HHH; 224| 735| const auto t7 = r * t5; 225| 735| auto Y3 = t7 - t6; 226| 735| const auto t8 = b.z() * H; 227| 735| auto Z3 = a.z() * t8; 228| | 229| | // if a is identity then return b 230| 735| FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z()); 231| | 232| | // if b is identity then return a 233| 735| FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z()); 234| | 235| 735| return ProjectivePoint(X3, Y3, Z3); 236| 735|} pcurves_sm2p256v1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19sm2p256v15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE: 108| 1|auto to_affine_batch(std::span projective) { 109| 1| using AffinePoint = typename C::AffinePoint; 110| | 111| 1| const size_t N = projective.size(); 112| 1| std::vector affine; 113| 1| affine.reserve(N); 114| | 115| 1| CT::Choice any_identity = CT::Choice::no(); 116| | 117| 1.56k| for(const auto& pt : projective) { ------------------ | Branch (117:23): [True: 1.56k, False: 1] ------------------ 118| 1.56k| any_identity = any_identity || pt.is_identity(); 119| 1.56k| } 120| | 121| | // Conditional acceptable: N is public. State of points is not necessarily 122| | // public, but we don't leak which point was the identity. In practice with 123| | // the algorithms currently in use, the only time an identity can occur is 124| | // during mul2 where the two points g/h have a small relation (ie h = g*k for 125| | // some k < 16) 126| | 127| 1| if(N <= 2 || any_identity.as_bool()) { ------------------ | Branch (127:7): [True: 0, False: 1] | Branch (127:17): [True: 0, False: 1] ------------------ 128| | // If there are identity elements, using the batch inversion gets 129| | // tricky. It can be done, but this should be a rare situation so 130| | // just punt to the serial conversion if it occurs 131| 0| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (131:25): [True: 0, False: 0] ------------------ 132| 0| affine.push_back(to_affine(projective[i])); 133| 0| } 134| 1| } else { 135| 1| std::vector c; 136| 1| c.reserve(N); 137| | 138| | /* 139| | Batch projective->affine using Montgomery's trick 140| | 141| | See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography" 142| | (Hankerson, Menezes, Vanstone) 143| | */ 144| | 145| 1| c.push_back(projective[0].z()); 146| 1.56k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (146:25): [True: 1.56k, False: 1] ------------------ 147| 1.56k| c.push_back(c[i - 1] * projective[i].z()); 148| 1.56k| } 149| | 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| 1| } else { 154| 1| return invert_field_element(c[N - 1]); 155| 1| } 156| 1| }(); 157| | 158| 1.56k| for(size_t i = N - 1; i > 0; --i) { ------------------ | Branch (158:29): [True: 1.56k, False: 1] ------------------ 159| 1.56k| const auto& p = projective[i]; 160| | 161| 1.56k| const auto z_inv = s_inv * c[i - 1]; 162| 1.56k| const auto z2_inv = z_inv.square(); 163| 1.56k| const auto z3_inv = z_inv * z2_inv; 164| | 165| 1.56k| s_inv = s_inv * p.z(); 166| | 167| 1.56k| affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv)); 168| 1.56k| } 169| | 170| 1| const auto z2_inv = s_inv.square(); 171| 1| const auto z3_inv = s_inv * z2_inv; 172| 1| affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv)); 173| 1| std::reverse(affine.begin(), affine.end()); 174| 1| return affine; 175| 1| } 176| | 177| 0| return affine; 178| 1|} pcurves_sm2p256v1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19sm2p256v15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv: 150| 1| auto s_inv = [&]() { 151| 1| if constexpr(VariableTime) { 152| 1| return c[N - 1].invert_vartime(); 153| | } else { 154| | return invert_field_element(c[N - 1]); 155| | } 156| 1| }(); pcurves_brainpool256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE3oneEv: 101| 1| constexpr static std::array one() { return R1; } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 47.2k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 5| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 4, False: 1] ------------------ 416| 4| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 4| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 4| x.m_val[i] = nx; 419| 4| y.m_val[i] = ny; 420| 4| } 421| 1| } pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 227| 4.51k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 1.56k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| 833| } else { 1187| 833| return dbl_generic(*this, A); 1188| 833| } 1189| 833| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1224| 13.7k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6squareEv: 428| 9.50k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 9.50k| std::array z; // NOLINT(*-member-init) 430| 9.50k| comba_sqr(z.data(), this->data()); 431| 9.50k| return Self(Rep::redc(z)); 432| 9.50k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4dataEv: 898| 53.1k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 31.0k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 31.0k| } else { 110| 31.0k| return monty_redc(z, P, P_dash); 111| 31.0k| } 112| 31.0k| } pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 267| 2.57k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 2.57k| std::array t; // NOLINT(*-member-init) 269| | 270| 2.57k| W carry = 0; 271| 12.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 10.3k, False: 2.57k] ------------------ 272| 10.3k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 10.3k| } 274| | 275| 2.57k| std::array r; // NOLINT(*-member-init) 276| 2.57k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 2.57k| return Self(r); 278| 2.57k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1214| 6.17k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 348| 21.5k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 21.5k| std::array z; // NOLINT(*-member-init) 350| 21.5k| comba_mul(z.data(), a.data(), b.data()); 351| 21.5k| return Self(Rep::redc(z)); 352| 21.5k| } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1219| 6.17k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_: 283| 6.90k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 6.90k| std::array r; // NOLINT(*-member-init) 285| 6.90k| W carry = 0; 286| 34.5k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 27.6k, False: 6.90k] ------------------ 287| 27.6k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 27.6k| } 289| | 290| 6.90k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 6.90k| carry = 0; 293| | 294| 34.5k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 27.6k, False: 6.90k] ------------------ 295| 27.6k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 27.6k| } 297| | 298| 6.90k| return Self(r); 299| 6.90k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 3.03k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 1.47k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 1.47k| const W mask = cond.into_bitmask(); 399| | 400| 7.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 5.88k, False: 1.47k] ------------------ 401| 5.88k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 5.88k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 5.88k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 5.88k| } 405| 1.47k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 177| for(;;) { 620| | // Conditional ok: this function is variable time 621| 177| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 176] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 176| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 176| std::array r; // NOLINT(*-member-init) 642| 176| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 176| if(carry == 0) { ------------------ | Branch (645:16): [True: 94, False: 82] ------------------ 646| | // b > a 647| 94| b.m_val = r; 648| 94| x = nx; 649| 94| Self::_invert_vartime_div2_helper(b, x); 650| 94| } else { 651| | // We know this can't underflow because a > b 652| 82| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 82| a.m_val = r; 654| 82| y = nx; 655| 82| Self::_invert_vartime_div2_helper(a, y); 656| 82| } 657| 176| } 658| 1| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 1| constexpr static std::array from_rep(const std::array& z) { 140| 1| std::array ze = {}; 141| 1| copy_mem(std::span{ze}.template first(), z); 142| 1| return Self::redc(ze); 143| 1| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 178| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 178| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 553| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 375, False: 178] ------------------ 554| 375| shift_right<1>(a.m_val); 555| | 556| 375| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 375| if(borrow) { ------------------ | Branch (559:16): [True: 193, False: 182] ------------------ 560| 193| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 193| } 562| 375| } 563| 178| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 10| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 8, False: 2] ------------------ 460| 8| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 8| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 1| constexpr static std::array to_rep(const std::array& x) { 118| 1| std::array z; // NOLINT(*-member-init) 119| 1| comba_mul(z.data(), x.data(), R2.data()); 120| 1| return Self::redc(z); 121| 1| } pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 1.56k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE8to_wordsEv: 736| 264| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 528| constexpr static std::array from_rep(const std::array& z) { 140| 528| std::array ze = {}; 141| 528| copy_mem(std::span{ze}.template first(), z); 142| 528| return Self::redc(ze); 143| 528| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 131k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 131k| } else { 110| 131k| return monty_redc(z, P, P_dash); 111| 131k| } 112| 131k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 264| constexpr void serialize_to(std::span bytes) const { 742| 264| auto v = Rep::from_rep(m_val); 743| 264| std::reverse(v.begin(), v.end()); 744| | 745| 264| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 264| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 264| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 9.36k| static Self from_stash(const std::array& stash) { 777| 9.36k| static_assert(L >= N); 778| 9.36k| std::array val = {}; 779| 46.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 37.4k, False: 9.36k] ------------------ 780| 37.4k| val[i] = stash[i]; 781| 37.4k| } 782| 9.36k| return Self(val); 783| 9.36k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 61.6k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 3.67k| std::array stash_value() const { 762| 3.67k| static_assert(L >= N); 763| 3.67k| std::array stash = {}; 764| 18.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 14.6k, False: 3.67k] ------------------ 765| 14.6k| stash[i] = m_val[i]; 766| 14.6k| } 767| 3.67k| return stash; 768| 3.67k| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm8EEE: 129| 276| constexpr static std::array wide_to_rep(const std::array& x) { 130| 276| auto redc_x = Self::redc(x); 131| 276| std::array z; // NOLINT(*-member-init) 132| 276| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 276| return Self::redc(z); 134| 276| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 227| 1.35k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 264| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 264| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 264] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 264| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 264| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 264] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 264| return Self::from_words(words); 809| 264| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE: 213| 264| static constexpr Self from_words(std::array w) { 214| 264| if constexpr(L == N) { 215| 264| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 264| } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 528| constexpr static std::array to_rep(const std::array& x) { 118| 528| std::array z; // NOLINT(*-member-init) 119| 528| comba_mul(z.data(), x.data(), R2.data()); 120| 528| return Self::redc(z); 121| 528| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 276| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 276| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 276] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 276| std::array padded_bytes = {}; 838| 276| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 276| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 276| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE3oneEv: 202| 533| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E12ScalarParamsEE3oneEv: 101| 533| constexpr static std::array one() { return R1; } pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEESC_: 267| 42.9k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 42.9k| std::array t; // NOLINT(*-member-init) 269| | 270| 42.9k| W carry = 0; 271| 214k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 171k, False: 42.9k] ------------------ 272| 171k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 171k| } 274| | 275| 42.9k| std::array r; // NOLINT(*-member-init) 276| 42.9k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 42.9k| return Self(r); 278| 42.9k| } pcurves_brainpool256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEESC_: 283| 138| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 138| std::array r; // NOLINT(*-member-init) 285| 138| W carry = 0; 286| 690| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 552, False: 138] ------------------ 287| 552| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 552| } 289| | 290| 138| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 138| carry = 0; 293| | 294| 690| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 552, False: 138] ------------------ 295| 552| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 552| } 297| | 298| 138| return Self(r); 299| 138| } pcurves_brainpool256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEESC_: 348| 3.99k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 3.99k| std::array z; // NOLINT(*-member-init) 350| 3.99k| comba_mul(z.data(), a.data(), b.data()); 351| 3.99k| return Self(Rep::redc(z)); 352| 3.99k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE4dataEv: 898| 299k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE6squareEv: 428| 2.90k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 2.90k| std::array z; // NOLINT(*-member-init) 430| 2.90k| comba_sqr(z.data(), this->data()); 431| 2.90k| return Self(Rep::redc(z)); 432| 2.90k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE6invertEv: 540| 395| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE: 479| 395| constexpr Self pow_vartime(const std::array& exp) const { 480| 395| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [True: 0, Folded] ------------------ 481| 395| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 395| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 395| std::array tbl; 492| | 493| 395| tbl[0] = (*this); 494| | 495| 5.92k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 5.53k, False: 395] ------------------ 496| | // Conditional ok: table indexes are public here 497| 5.53k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 2.76k, False: 2.76k] ------------------ 498| 2.76k| tbl[i] = tbl[i / 2].square(); 499| 2.76k| } else { 500| 2.76k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 2.76k| } 502| 5.53k| } 503| | 504| 395| auto r = Self::one(); 505| | 506| 395| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 395| if(w0 > 0) { ------------------ | Branch (509:13): [True: 395, False: 0] ------------------ 510| 395| r = tbl[w0 - 1]; 511| 395| } 512| | 513| 25.2k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 24.8k, False: 395] ------------------ 514| 24.8k| r.square_n(WindowBits); 515| | 516| 24.8k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 24.8k| if(w > 0) { ------------------ | Branch (519:16): [True: 23.3k, False: 1.58k] ------------------ 520| 23.3k| r *= tbl[w - 1]; 521| 23.3k| } 522| 24.8k| } 523| | 524| 395| return r; 525| 395| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEC2Ev: 182| 5.92k| constexpr IntMod() : m_val({}) {} pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE8square_nEm: 441| 24.8k| constexpr void square_n(size_t n) { 442| 24.8k| std::array z; // NOLINT(*-member-init) 443| 124k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 99.5k, False: 24.8k] ------------------ 444| 99.5k| comba_sqr(z.data(), this->data()); 445| 99.5k| m_val = Rep::redc(z); 446| 99.5k| } 447| 24.8k| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEmLERKSA_: 357| 23.3k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 23.3k| std::array z; // NOLINT(*-member-init) 359| 23.3k| comba_mul(z.data(), data(), other.data()); 360| 23.3k| m_val = Rep::redc(z); 361| 23.3k| return (*this); 362| 23.3k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE14invert_vartimeEv: 600| 264| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 264| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 264] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 264| auto x = Self(std::array{1}); // 1 in standard domain 607| 264| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 264| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 264| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 264| auto y = x; 615| | 616| | // First half of second loop iteration 617| 264| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 42.5k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 42.5k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 264, False: 42.2k] ------------------ 622| | // At this point it should be that a == b == 1 623| 264| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 264| r.m_val = Rep::to_rep(r.m_val); 627| 264| return r; 628| 264| } 629| | 630| 42.2k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 42.2k| std::array r; // NOLINT(*-member-init) 642| 42.2k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 42.2k| if(carry == 0) { ------------------ | Branch (645:16): [True: 15.4k, False: 26.8k] ------------------ 646| | // b > a 647| 15.4k| b.m_val = r; 648| 15.4k| x = nx; 649| 15.4k| Self::_invert_vartime_div2_helper(b, x); 650| 26.8k| } else { 651| | // We know this can't underflow because a > b 652| 26.8k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 26.8k| a.m_val = r; 654| 26.8k| y = nx; 655| 26.8k| Self::_invert_vartime_div2_helper(a, y); 656| 26.8k| } 657| 42.2k| } 658| 264| } pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 42.8k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 42.8k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 140k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 97.7k, False: 42.8k] ------------------ 554| 97.7k| shift_right<1>(a.m_val); 555| | 556| 97.7k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 97.7k| if(borrow) { ------------------ | Branch (559:16): [True: 49.6k, False: 48.0k] ------------------ 560| 49.6k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 49.6k| } 562| 97.7k| } 563| 42.8k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEE6negateEv: 454| 666| constexpr Self negate() const { 455| 666| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 666| std::array r; // NOLINT(*-member-init) 458| 666| W carry = 0; 459| 3.33k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 2.66k, False: 666] ------------------ 460| 2.66k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 2.66k| } 462| | 463| 666| return Self(r); 464| 666| } pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E12ScalarParamsEEEEeqERKSA_: 724| 1.61k| constexpr CT::Choice operator==(const Self& other) const { 725| 1.61k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 1.61k| } pcurves_brainpool384r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE3oneEv: 101| 1| constexpr static std::array one() { return R1; } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 70.3k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 7| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 6, False: 1] ------------------ 416| 6| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 6| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 6| x.m_val[i] = nx; 419| 6| y.m_val[i] = ny; 420| 6| } 421| 1| } pcurves_brainpool384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 227| 6.71k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 2.33k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.24k| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| 1.24k| } else { 1187| 1.24k| return dbl_generic(*this, A); 1188| 1.24k| } 1189| 1.24k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1224| 20.4k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6squareEv: 428| 14.1k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 14.1k| std::array z; // NOLINT(*-member-init) 430| 14.1k| comba_sqr(z.data(), this->data()); 431| 14.1k| return Self(Rep::redc(z)); 432| 14.1k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4dataEv: 898| 79.1k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm12EEE: 106| 46.2k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 46.2k| } else { 110| 46.2k| return monty_redc(z, P, P_dash); 111| 46.2k| } 112| 46.2k| } pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 267| 3.83k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 3.83k| std::array t; // NOLINT(*-member-init) 269| | 270| 3.83k| W carry = 0; 271| 26.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 23.0k, False: 3.83k] ------------------ 272| 23.0k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 23.0k| } 274| | 275| 3.83k| std::array r; // NOLINT(*-member-init) 276| 3.83k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 3.83k| return Self(r); 278| 3.83k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1214| 9.19k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 337| 1.24k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 348| 32.1k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 32.1k| std::array z; // NOLINT(*-member-init) 350| 32.1k| comba_mul(z.data(), a.data(), b.data()); 351| 32.1k| return Self(Rep::redc(z)); 352| 32.1k| } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1219| 9.19k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 340| 1.24k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEEESC_: 283| 10.2k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 10.2k| std::array r; // NOLINT(*-member-init) 285| 10.2k| W carry = 0; 286| 72.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 61.7k, False: 10.2k] ------------------ 287| 61.7k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 61.7k| } 289| | 290| 10.2k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 10.2k| carry = 0; 293| | 294| 72.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 61.7k, False: 10.2k] ------------------ 295| 61.7k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 61.7k| } 297| | 298| 10.2k| return Self(r); 299| 10.2k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 327| 9.92k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 9.92k| std::array t = value(); 329| 9.92k| const W carry = shift_left<1>(t); 330| | 331| 9.92k| std::array r; // NOLINT(*-member-init) 332| 9.92k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 9.92k| return Self(r); 334| 9.92k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE5valueEv: 896| 9.92k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 343| 1.24k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1075| 1.09k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.09k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 4.52k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 2.19k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 2.19k| const W mask = cond.into_bitmask(); 399| | 400| 15.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 13.1k, False: 2.19k] ------------------ 401| 13.1k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 13.1k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 13.1k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 13.1k| } 405| 2.19k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 262| for(;;) { 620| | // Conditional ok: this function is variable time 621| 262| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 261] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 261| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 261| std::array r; // NOLINT(*-member-init) 642| 261| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 261| if(carry == 0) { ------------------ | Branch (645:16): [True: 128, False: 133] ------------------ 646| | // b > a 647| 128| b.m_val = r; 648| 128| x = nx; 649| 128| Self::_invert_vartime_div2_helper(b, x); 650| 133| } else { 651| | // We know this can't underflow because a > b 652| 133| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 133| a.m_val = r; 654| 133| y = nx; 655| 133| Self::_invert_vartime_div2_helper(a, y); 656| 133| } 657| 261| } 658| 1| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm6EEE: 139| 1| constexpr static std::array from_rep(const std::array& z) { 140| 1| std::array ze = {}; 141| 1| copy_mem(std::span{ze}.template first(), z); 142| 1| return Self::redc(ze); 143| 1| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 263| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 263| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 814| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 551, False: 263] ------------------ 554| 551| shift_right<1>(a.m_val); 555| | 556| 551| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 551| if(borrow) { ------------------ | Branch (559:16): [True: 291, False: 260] ------------------ 560| 291| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 291| } 562| 551| } 563| 263| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 14| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 12, False: 2] ------------------ 460| 12| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 12| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm6EEE: 117| 1| constexpr static std::array to_rep(const std::array& x) { 118| 1| std::array z; // NOLINT(*-member-init) 119| 1| comba_mul(z.data(), x.data(), R2.data()); 120| 1| return Self::redc(z); 121| 1| } pcurves_brainpool384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 2.33k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE8to_wordsEv: 736| 311| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm6EEE: 139| 622| constexpr static std::array from_rep(const std::array& z) { 140| 622| std::array ze = {}; 141| 622| copy_mem(std::span{ze}.template first(), z); 142| 622| return Self::redc(ze); 143| 622| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm12EEE: 106| 229k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 229k| } else { 110| 229k| return monty_redc(z, P, P_dash); 111| 229k| } 112| 229k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 741| 311| constexpr void serialize_to(std::span bytes) const { 742| 311| auto v = Rep::from_rep(m_val); 743| 311| std::reverse(v.begin(), v.end()); 744| | 745| 311| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 311| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 311| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 10.8k| static Self from_stash(const std::array& stash) { 777| 10.8k| static_assert(L >= N); 778| 10.8k| std::array val = {}; 779| 76.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 65.3k, False: 10.8k] ------------------ 780| 65.3k| val[i] = stash[i]; 781| 65.3k| } 782| 10.8k| return Self(val); 783| 10.8k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 109k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 4.26k| std::array stash_value() const { 762| 4.26k| static_assert(L >= N); 763| 4.26k| std::array stash = {}; 764| 29.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 25.5k, False: 4.26k] ------------------ 765| 25.5k| stash[i] = m_val[i]; 766| 25.5k| } 767| 4.26k| return stash; 768| 4.26k| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm12EEE: 129| 318| constexpr static std::array wide_to_rep(const std::array& x) { 130| 318| auto redc_x = Self::redc(x); 131| 318| std::array z; // NOLINT(*-member-init) 132| 318| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 318| return Self::redc(z); 134| 318| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 227| 1.57k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 311| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 311| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 311] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 311| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 311| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 311] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 311| return Self::from_words(words); 809| 311| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm6EEESA_NSt3__15arrayImXT_EEE: 213| 311| static constexpr Self from_words(std::array w) { 214| 311| if constexpr(L == N) { 215| 311| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 311| } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm6EEE: 117| 622| constexpr static std::array to_rep(const std::array& x) { 118| 622| std::array z; // NOLINT(*-member-init) 119| 622| comba_mul(z.data(), x.data(), R2.data()); 120| 622| return Self::redc(z); 121| 622| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 318| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 318| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 318] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 318| std::array padded_bytes = {}; 838| 318| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 318| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 318| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE3oneEv: 202| 626| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES0_E12ScalarParamsEE3oneEv: 101| 626| constexpr static std::array one() { return R1; } pcurves_brainpool384r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEESC_: 267| 79.7k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 79.7k| std::array t; // NOLINT(*-member-init) 269| | 270| 79.7k| W carry = 0; 271| 558k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 478k, False: 79.7k] ------------------ 272| 478k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 478k| } 274| | 275| 79.7k| std::array r; // NOLINT(*-member-init) 276| 79.7k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 79.7k| return Self(r); 278| 79.7k| } pcurves_brainpool384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEESC_: 283| 159| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 159| std::array r; // NOLINT(*-member-init) 285| 159| W carry = 0; 286| 1.11k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 954, False: 159] ------------------ 287| 954| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 954| } 289| | 290| 159| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 159| carry = 0; 293| | 294| 1.11k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 954, False: 159] ------------------ 295| 954| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 954| } 297| | 298| 159| return Self(r); 299| 159| } pcurves_brainpool384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEESC_: 348| 8.42k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 8.42k| std::array z; // NOLINT(*-member-init) 350| 8.42k| comba_mul(z.data(), a.data(), b.data()); 351| 8.42k| return Self(Rep::redc(z)); 352| 8.42k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE4dataEv: 898| 523k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE6squareEv: 428| 7.16k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 7.16k| std::array z; // NOLINT(*-member-init) 430| 7.16k| comba_sqr(z.data(), this->data()); 431| 7.16k| return Self(Rep::redc(z)); 432| 7.16k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE6invertEv: 540| 467| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE11pow_vartimeERKNSt3__15arrayImLm6EEE: 479| 467| constexpr Self pow_vartime(const std::array& exp) const { 480| 467| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [Folded, False: 467] ------------------ 481| 467| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 467| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 467| std::array tbl; 492| | 493| 467| tbl[0] = (*this); 494| | 495| 14.4k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 14.0k, False: 467] ------------------ 496| | // Conditional ok: table indexes are public here 497| 14.0k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 7.00k, False: 7.00k] ------------------ 498| 7.00k| tbl[i] = tbl[i / 2].square(); 499| 7.00k| } else { 500| 7.00k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 7.00k| } 502| 14.0k| } 503| | 504| 467| auto r = Self::one(); 505| | 506| 467| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 467| if(w0 > 0) { ------------------ | Branch (509:13): [True: 467, False: 0] ------------------ 510| 467| r = tbl[w0 - 1]; 511| 467| } 512| | 513| 35.9k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 35.4k, False: 467] ------------------ 514| 35.4k| r.square_n(WindowBits); 515| | 516| 35.4k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 35.4k| if(w > 0) { ------------------ | Branch (519:16): [True: 34.5k, False: 934] ------------------ 520| 34.5k| r *= tbl[w - 1]; 521| 34.5k| } 522| 35.4k| } 523| | 524| 467| return r; 525| 467| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEC2Ev: 182| 14.4k| constexpr IntMod() : m_val({}) {} pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE8square_nEm: 441| 35.4k| constexpr void square_n(size_t n) { 442| 35.4k| std::array z; // NOLINT(*-member-init) 443| 212k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 177k, False: 35.4k] ------------------ 444| 177k| comba_sqr(z.data(), this->data()); 445| 177k| m_val = Rep::redc(z); 446| 177k| } 447| 35.4k| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEmLERKSA_: 357| 34.5k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 34.5k| std::array z; // NOLINT(*-member-init) 359| 34.5k| comba_mul(z.data(), data(), other.data()); 360| 34.5k| m_val = Rep::redc(z); 361| 34.5k| return (*this); 362| 34.5k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE14invert_vartimeEv: 600| 311| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 311| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 311] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 311| auto x = Self(std::array{1}); // 1 in standard domain 607| 311| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 311| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 311| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 311| auto y = x; 615| | 616| | // First half of second loop iteration 617| 311| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 79.2k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 79.2k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 311, False: 78.9k] ------------------ 622| | // At this point it should be that a == b == 1 623| 311| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 311| r.m_val = Rep::to_rep(r.m_val); 627| 311| return r; 628| 311| } 629| | 630| 78.9k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 78.9k| std::array r; // NOLINT(*-member-init) 642| 78.9k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 78.9k| if(carry == 0) { ------------------ | Branch (645:16): [True: 33.6k, False: 45.3k] ------------------ 646| | // b > a 647| 33.6k| b.m_val = r; 648| 33.6k| x = nx; 649| 33.6k| Self::_invert_vartime_div2_helper(b, x); 650| 45.3k| } else { 651| | // We know this can't underflow because a > b 652| 45.3k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 45.3k| a.m_val = r; 654| 45.3k| y = nx; 655| 45.3k| Self::_invert_vartime_div2_helper(a, y); 656| 45.3k| } 657| 78.9k| } 658| 311| } pcurves_brainpool384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 79.5k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 79.5k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 249k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 169k, False: 79.5k] ------------------ 554| 169k| shift_right<1>(a.m_val); 555| | 556| 169k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 169k| if(borrow) { ------------------ | Branch (559:16): [True: 85.3k, False: 84.4k] ------------------ 560| 85.3k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 85.3k| } 562| 169k| } 563| 79.5k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEE6negateEv: 454| 781| constexpr Self negate() const { 455| 781| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 781| std::array r; // NOLINT(*-member-init) 458| 781| W carry = 0; 459| 5.46k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 4.68k, False: 781] ------------------ 460| 4.68k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 4.68k| } 462| | 463| 781| return Self(r); 464| 781| } pcurves_brainpool384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool384r16ParamsES1_E12ScalarParamsEEEEeqERKSA_: 724| 1.88k| constexpr CT::Choice operator==(const Self& other) const { 725| 1.88k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 1.88k| } pcurves_brainpool512r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE3oneEv: 101| 1| constexpr static std::array one() { return R1; } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm8EEE: 908| 93.4k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 9| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 8, False: 1] ------------------ 416| 8| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 8| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 8| x.m_val[i] = nx; 419| 8| y.m_val[i] = ny; 420| 8| } 421| 1| } pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 227| 8.92k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 3.10k| m_x(x), m_y(y), m_z(z) {} pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.64k| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| 1.64k| } else { 1187| 1.64k| return dbl_generic(*this, A); 1188| 1.64k| } 1189| 1.64k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1224| 27.1k| constexpr const FieldElement& z() const { return m_z; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6squareEv: 428| 18.8k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 18.8k| std::array z; // NOLINT(*-member-init) 430| 18.8k| comba_sqr(z.data(), this->data()); 431| 18.8k| return Self(Rep::redc(z)); 432| 18.8k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4dataEv: 898| 105k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm16EEE: 106| 61.4k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 61.4k| } else { 110| 61.4k| return monty_redc(z, P, P_dash); 111| 61.4k| } 112| 61.4k| } pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 267| 5.11k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 5.11k| std::array t; // NOLINT(*-member-init) 269| | 270| 5.11k| W carry = 0; 271| 46.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 40.9k, False: 5.11k] ------------------ 272| 40.9k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 40.9k| } 274| | 275| 5.11k| std::array r; // NOLINT(*-member-init) 276| 5.11k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 5.11k| return Self(r); 278| 5.11k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1214| 12.2k| constexpr const FieldElement& x() const { return m_x; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul3Ev: 337| 1.64k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_brainpool512r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 348| 42.6k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 42.6k| std::array z; // NOLINT(*-member-init) 350| 42.6k| comba_mul(z.data(), a.data(), b.data()); 351| 42.6k| return Self(Rep::redc(z)); 352| 42.6k| } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1219| 12.2k| constexpr const FieldElement& y() const { return m_y; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul4Ev: 340| 1.64k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_brainpool512r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_: 283| 13.6k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 13.6k| std::array r; // NOLINT(*-member-init) 285| 13.6k| W carry = 0; 286| 123k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 109k, False: 13.6k] ------------------ 287| 109k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 109k| } 289| | 290| 13.6k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 13.6k| carry = 0; 293| | 294| 123k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 109k, False: 13.6k] ------------------ 295| 109k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 109k| } 297| | 298| 13.6k| return Self(r); 299| 13.6k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul2Ev: 327| 13.1k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 13.1k| std::array t = value(); 329| 13.1k| const W carry = shift_left<1>(t); 330| | 331| 13.1k| std::array r; // NOLINT(*-member-init) 332| 13.1k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 13.1k| return Self(r); 334| 13.1k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE5valueEv: 896| 13.1k| constexpr const std::array& value() const { return m_val; } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul8Ev: 343| 1.64k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1075| 1.45k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.45k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 6.01k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 2.91k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 2.91k| const W mask = cond.into_bitmask(); 399| | 400| 26.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 23.2k, False: 2.91k] ------------------ 401| 23.2k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 23.2k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 23.2k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 23.2k| } 405| 2.91k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 366| for(;;) { 620| | // Conditional ok: this function is variable time 621| 366| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 365] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 365| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 365| std::array r; // NOLINT(*-member-init) 642| 365| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 365| if(carry == 0) { ------------------ | Branch (645:16): [True: 175, False: 190] ------------------ 646| | // b > a 647| 175| b.m_val = r; 648| 175| x = nx; 649| 175| Self::_invert_vartime_div2_helper(b, x); 650| 190| } else { 651| | // We know this can't underflow because a > b 652| 190| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 190| a.m_val = r; 654| 190| y = nx; 655| 190| Self::_invert_vartime_div2_helper(a, y); 656| 190| } 657| 365| } 658| 1| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm8EEE: 139| 1| constexpr static std::array from_rep(const std::array& z) { 140| 1| std::array ze = {}; 141| 1| copy_mem(std::span{ze}.template first(), z); 142| 1| return Self::redc(ze); 143| 1| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 367| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 367| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 1.08k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 713, False: 367] ------------------ 554| 713| shift_right<1>(a.m_val); 555| | 556| 713| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 713| if(borrow) { ------------------ | Branch (559:16): [True: 362, False: 351] ------------------ 560| 362| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 362| } 562| 713| } 563| 367| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 18| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 16, False: 2] ------------------ 460| 16| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 16| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm8EEE: 117| 1| constexpr static std::array to_rep(const std::array& x) { 118| 1| std::array z; // NOLINT(*-member-init) 119| 1| comba_mul(z.data(), x.data(), R2.data()); 120| 1| return Self::redc(z); 121| 1| } pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 3.10k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE8to_wordsEv: 736| 358| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm8EEE: 139| 716| constexpr static std::array from_rep(const std::array& z) { 140| 716| std::array ze = {}; 141| 716| copy_mem(std::span{ze}.template first(), z); 142| 716| return Self::redc(ze); 143| 716| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm16EEE: 106| 346k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 346k| } else { 110| 346k| return monty_redc(z, P, P_dash); 111| 346k| } 112| 346k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm64EEE: 741| 358| constexpr void serialize_to(std::span bytes) const { 742| 358| auto v = Rep::from_rep(m_val); 743| 358| std::reverse(v.begin(), v.end()); 744| | 745| 358| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 358| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 358| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 12.5k| static Self from_stash(const std::array& stash) { 777| 12.5k| static_assert(L >= N); 778| 12.5k| std::array val = {}; 779| 113k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 100k, False: 12.5k] ------------------ 780| 100k| val[i] = stash[i]; 781| 100k| } 782| 12.5k| return Self(val); 783| 12.5k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm8EEE: 908| 152k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 4.92k| std::array stash_value() const { 762| 4.92k| static_assert(L >= N); 763| 4.92k| std::array stash = {}; 764| 44.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 39.3k, False: 4.92k] ------------------ 765| 39.3k| stash[i] = m_val[i]; 766| 39.3k| } 767| 4.92k| return stash; 768| 4.92k| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm16EEE: 129| 368| constexpr static std::array wide_to_rep(const std::array& x) { 130| 368| auto redc_x = Self::redc(x); 131| 368| std::array z; // NOLINT(*-member-init) 132| 368| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 368| return Self::redc(z); 134| 368| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 227| 1.82k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 358| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 358| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 358] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 358| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 358| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 358] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 358| return Self::from_words(words); 809| 358| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE10from_wordsILm8EEESA_NSt3__15arrayImXT_EEE: 213| 358| static constexpr Self from_words(std::array w) { 214| 358| if constexpr(L == N) { 215| 358| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 358| } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm8EEE: 117| 716| constexpr static std::array to_rep(const std::array& x) { 118| 716| std::array z; // NOLINT(*-member-init) 119| 716| comba_mul(z.data(), x.data(), R2.data()); 120| 716| return Self::redc(z); 121| 716| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 368| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 368| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 368] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 368| std::array padded_bytes = {}; 838| 368| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 368| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 368| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE3oneEv: 202| 722| static constexpr Self one() { return Self(Rep::one()); } pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E12ScalarParamsEE3oneEv: 101| 722| constexpr static std::array one() { return R1; } pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEESC_: 267| 119k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 119k| std::array t; // NOLINT(*-member-init) 269| | 270| 119k| W carry = 0; 271| 1.07M| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 952k, False: 119k] ------------------ 272| 952k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 952k| } 274| | 275| 119k| std::array r; // NOLINT(*-member-init) 276| 119k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 119k| return Self(r); 278| 119k| } pcurves_brainpool512r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEESC_: 283| 184| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 184| std::array r; // NOLINT(*-member-init) 285| 184| W carry = 0; 286| 1.65k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 1.47k, False: 184] ------------------ 287| 1.47k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 1.47k| } 289| | 290| 184| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 184| carry = 0; 293| | 294| 1.65k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 1.47k, False: 184] ------------------ 295| 1.47k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 1.47k| } 297| | 298| 184| return Self(r); 299| 184| } pcurves_brainpool512r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEESC_: 348| 9.71k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 9.71k| std::array z; // NOLINT(*-member-init) 350| 9.71k| comba_mul(z.data(), a.data(), b.data()); 351| 9.71k| return Self(Rep::redc(z)); 352| 9.71k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE4dataEv: 898| 794k| constexpr const W* data() const { return m_val.data(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE6squareEv: 428| 8.25k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 8.25k| std::array z; // NOLINT(*-member-init) 430| 8.25k| comba_sqr(z.data(), this->data()); 431| 8.25k| return Self(Rep::redc(z)); 432| 8.25k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE6invertEv: 540| 538| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE11pow_vartimeERKNSt3__15arrayImLm8EEE: 479| 538| constexpr Self pow_vartime(const std::array& exp) const { 480| 538| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [Folded, False: 538] ------------------ 481| 538| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 538| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 538| std::array tbl; 492| | 493| 538| tbl[0] = (*this); 494| | 495| 16.6k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 16.1k, False: 538] ------------------ 496| | // Conditional ok: table indexes are public here 497| 16.1k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 8.07k, False: 8.07k] ------------------ 498| 8.07k| tbl[i] = tbl[i / 2].square(); 499| 8.07k| } else { 500| 8.07k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 8.07k| } 502| 16.1k| } 503| | 504| 538| auto r = Self::one(); 505| | 506| 538| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 538| if(w0 > 0) { ------------------ | Branch (509:13): [True: 538, False: 0] ------------------ 510| 538| r = tbl[w0 - 1]; 511| 538| } 512| | 513| 55.4k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 54.8k, False: 538] ------------------ 514| 54.8k| r.square_n(WindowBits); 515| | 516| 54.8k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 54.8k| if(w > 0) { ------------------ | Branch (519:16): [True: 52.1k, False: 2.69k] ------------------ 520| 52.1k| r *= tbl[w - 1]; 521| 52.1k| } 522| 54.8k| } 523| | 524| 538| return r; 525| 538| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEC2Ev: 182| 16.6k| constexpr IntMod() : m_val({}) {} pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE8square_nEm: 441| 54.8k| constexpr void square_n(size_t n) { 442| 54.8k| std::array z; // NOLINT(*-member-init) 443| 329k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 274k, False: 54.8k] ------------------ 444| 274k| comba_sqr(z.data(), this->data()); 445| 274k| m_val = Rep::redc(z); 446| 274k| } 447| 54.8k| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEmLERKSA_: 357| 52.1k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 52.1k| std::array z; // NOLINT(*-member-init) 359| 52.1k| comba_mul(z.data(), data(), other.data()); 360| 52.1k| m_val = Rep::redc(z); 361| 52.1k| return (*this); 362| 52.1k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE14invert_vartimeEv: 600| 358| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 358| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 358] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 358| auto x = Self(std::array{1}); // 1 in standard domain 607| 358| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 358| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 358| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 358| auto y = x; 615| | 616| | // First half of second loop iteration 617| 358| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 118k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 118k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 358, False: 118k] ------------------ 622| | // At this point it should be that a == b == 1 623| 358| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 358| r.m_val = Rep::to_rep(r.m_val); 627| 358| return r; 628| 358| } 629| | 630| 118k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 118k| std::array r; // NOLINT(*-member-init) 642| 118k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 118k| if(carry == 0) { ------------------ | Branch (645:16): [True: 45.1k, False: 73.0k] ------------------ 646| | // b > a 647| 45.1k| b.m_val = r; 648| 45.1k| x = nx; 649| 45.1k| Self::_invert_vartime_div2_helper(b, x); 650| 73.0k| } else { 651| | // We know this can't underflow because a > b 652| 73.0k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 73.0k| a.m_val = r; 654| 73.0k| y = nx; 655| 73.0k| Self::_invert_vartime_div2_helper(a, y); 656| 73.0k| } 657| 118k| } 658| 358| } pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 118k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 118k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 379k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 260k, False: 118k] ------------------ 554| 260k| shift_right<1>(a.m_val); 555| | 556| 260k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 260k| if(borrow) { ------------------ | Branch (559:16): [True: 130k, False: 129k] ------------------ 560| 130k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 130k| } 562| 260k| } 563| 118k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEE6negateEv: 454| 900| constexpr Self negate() const { 455| 900| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 900| std::array r; // NOLINT(*-member-init) 458| 900| W carry = 0; 459| 8.10k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 7.20k, False: 900] ------------------ 460| 7.20k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 7.20k| } 462| | 463| 900| return Self(r); 464| 900| } pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E12ScalarParamsEEEEeqERKSA_: 724| 2.17k| constexpr CT::Choice operator==(const Self& other) const { 725| 2.17k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 2.17k| } pcurves_frp256v1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_18frp256v15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_frp256v1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_frp256v1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_frp256v1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E11FieldParamsEE3oneEv: 101| 1| constexpr static std::array one() { return R1; } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 46.3k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 5| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 4, False: 1] ------------------ 416| 4| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 4| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 4| x.m_val[i] = nx; 419| 4| y.m_val[i] = ny; 420| 4| } 421| 1| } pcurves_frp256v1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE7is_zeroEv: 227| 4.51k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_frp256v1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 1.56k| m_x(x), m_y(y), m_z(z) {} pcurves_frp256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| 833| if constexpr(Self::A_is_minus_3) { 1183| 833| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 833| } pcurves_frp256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_E1zEv: 1224| 13.7k| constexpr const FieldElement& z() const { return m_z; } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE6squareEv: 428| 7.84k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 7.84k| std::array z; // NOLINT(*-member-init) 430| 7.84k| comba_sqr(z.data(), this->data()); 431| 7.84k| return Self(Rep::redc(z)); 432| 7.84k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE4dataEv: 898| 51.5k| constexpr const W* data() const { return m_val.data(); } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 29.3k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 29.3k| } else { 110| 29.3k| return monty_redc(z, P, P_dash); 111| 29.3k| } 112| 29.3k| } pcurves_frp256v1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEEESC_: 348| 21.5k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 21.5k| std::array z; // NOLINT(*-member-init) 350| 21.5k| comba_mul(z.data(), a.data(), b.data()); 351| 21.5k| return Self(Rep::redc(z)); 352| 21.5k| } pcurves_frp256v1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEEESC_: 283| 7.74k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 7.74k| std::array r; // NOLINT(*-member-init) 285| 7.74k| W carry = 0; 286| 38.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 30.9k, False: 7.74k] ------------------ 287| 30.9k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 30.9k| } 289| | 290| 7.74k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 7.74k| carry = 0; 293| | 294| 38.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 30.9k, False: 7.74k] ------------------ 295| 30.9k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 30.9k| } 297| | 298| 7.74k| return Self(r); 299| 7.74k| } pcurves_frp256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_E1xEv: 1214| 7.00k| constexpr const FieldElement& x() const { return m_x; } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_frp256v1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEEESC_: 267| 2.57k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 2.57k| std::array t; // NOLINT(*-member-init) 269| | 270| 2.57k| W carry = 0; 271| 12.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 10.3k, False: 2.57k] ------------------ 272| 10.3k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 10.3k| } 274| | 275| 2.57k| std::array r; // NOLINT(*-member-init) 276| 2.57k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 2.57k| return Self(r); 278| 2.57k| } pcurves_frp256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_E1yEv: 1219| 6.17k| constexpr const FieldElement& y() const { return m_y; } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_frp256v1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_frp256v1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_frp256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 3.03k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 1.47k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 1.47k| const W mask = cond.into_bitmask(); 399| | 400| 7.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 5.88k, False: 1.47k] ------------------ 401| 5.88k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 5.88k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 5.88k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 5.88k| } 405| 1.47k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 179| for(;;) { 620| | // Conditional ok: this function is variable time 621| 179| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 178] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 178| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 178| std::array r; // NOLINT(*-member-init) 642| 178| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 178| if(carry == 0) { ------------------ | Branch (645:16): [True: 82, False: 96] ------------------ 646| | // b > a 647| 82| b.m_val = r; 648| 82| x = nx; 649| 82| Self::_invert_vartime_div2_helper(b, x); 650| 96| } else { 651| | // We know this can't underflow because a > b 652| 96| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 96| a.m_val = r; 654| 96| y = nx; 655| 96| Self::_invert_vartime_div2_helper(a, y); 656| 96| } 657| 178| } 658| 1| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 1| constexpr static std::array from_rep(const std::array& z) { 140| 1| std::array ze = {}; 141| 1| copy_mem(std::span{ze}.template first(), z); 142| 1| return Self::redc(ze); 143| 1| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 180| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 180| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 535| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 355, False: 180] ------------------ 554| 355| shift_right<1>(a.m_val); 555| | 556| 355| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 355| if(borrow) { ------------------ | Branch (559:16): [True: 171, False: 184] ------------------ 560| 171| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 171| } 562| 355| } 563| 180| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 10| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 8, False: 2] ------------------ 460| 8| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 8| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 1| constexpr static std::array to_rep(const std::array& x) { 118| 1| std::array z; // NOLINT(*-member-init) 119| 1| comba_mul(z.data(), x.data(), R2.data()); 120| 1| return Self::redc(z); 121| 1| } pcurves_frp256v1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 1.56k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE8to_wordsEv: 736| 252| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 504| constexpr static std::array from_rep(const std::array& z) { 140| 504| std::array ze = {}; 141| 504| copy_mem(std::span{ze}.template first(), z); 142| 504| return Self::redc(ze); 143| 504| } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 125k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 125k| } else { 110| 125k| return monty_redc(z, P, P_dash); 111| 125k| } 112| 125k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 252| constexpr void serialize_to(std::span bytes) const { 742| 252| auto v = Rep::from_rep(m_val); 743| 252| std::reverse(v.begin(), v.end()); 744| | 745| 252| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 252| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 252| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE: 776| 8.86k| static Self from_stash(const std::array& stash) { 777| 8.86k| static_assert(L >= N); 778| 8.86k| std::array val = {}; 779| 44.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 35.4k, False: 8.86k] ------------------ 780| 35.4k| val[i] = stash[i]; 781| 35.4k| } 782| 8.86k| return Self(val); 783| 8.86k| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 58.7k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 3.47k| std::array stash_value() const { 762| 3.47k| static_assert(L >= N); 763| 3.47k| std::array stash = {}; 764| 17.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 13.8k, False: 3.47k] ------------------ 765| 13.8k| stash[i] = m_val[i]; 766| 13.8k| } 767| 3.47k| return stash; 768| 3.47k| } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm8EEE: 129| 260| constexpr static std::array wide_to_rep(const std::array& x) { 130| 260| auto redc_x = Self::redc(x); 131| 260| std::array z; // NOLINT(*-member-init) 132| 260| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 260| return Self::redc(z); 134| 260| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE7is_zeroEv: 227| 1.28k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 252| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 252| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 252] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 252| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 252| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 252] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 252| return Self::from_words(words); 809| 252| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE: 213| 252| static constexpr Self from_words(std::array w) { 214| 252| if constexpr(L == N) { 215| 252| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 252| } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 504| constexpr static std::array to_rep(const std::array& x) { 118| 504| std::array z; // NOLINT(*-member-init) 119| 504| comba_mul(z.data(), x.data(), R2.data()); 120| 504| return Self::redc(z); 121| 504| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 260| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 260| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 260] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 260| std::array padded_bytes = {}; 838| 260| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 260| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 260| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE3oneEv: 202| 506| static constexpr Self one() { return Self(Rep::one()); } pcurves_frp256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES0_E12ScalarParamsEE3oneEv: 101| 506| constexpr static std::array one() { return R1; } pcurves_frp256v1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEEESC_: 267| 41.0k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 41.0k| std::array t; // NOLINT(*-member-init) 269| | 270| 41.0k| W carry = 0; 271| 205k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 164k, False: 41.0k] ------------------ 272| 164k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 164k| } 274| | 275| 41.0k| std::array r; // NOLINT(*-member-init) 276| 41.0k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 41.0k| return Self(r); 278| 41.0k| } pcurves_frp256v1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEEESC_: 283| 130| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 130| std::array r; // NOLINT(*-member-init) 285| 130| W carry = 0; 286| 650| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 520, False: 130] ------------------ 287| 520| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 520| } 289| | 290| 130| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 130| carry = 0; 293| | 294| 650| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 520, False: 130] ------------------ 295| 520| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 520| } 297| | 298| 130| return Self(r); 299| 130| } pcurves_frp256v1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEEESC_: 348| 3.79k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 3.79k| std::array z; // NOLINT(*-member-init) 350| 3.79k| comba_mul(z.data(), a.data(), b.data()); 351| 3.79k| return Self(Rep::redc(z)); 352| 3.79k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE4dataEv: 898| 285k| constexpr const W* data() const { return m_val.data(); } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE6squareEv: 428| 2.76k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 2.76k| std::array z; // NOLINT(*-member-init) 430| 2.76k| comba_sqr(z.data(), this->data()); 431| 2.76k| return Self(Rep::redc(z)); 432| 2.76k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE6invertEv: 540| 376| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE: 479| 376| constexpr Self pow_vartime(const std::array& exp) const { 480| 376| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [True: 0, Folded] ------------------ 481| 376| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 376| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 376| std::array tbl; 492| | 493| 376| tbl[0] = (*this); 494| | 495| 5.64k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 5.26k, False: 376] ------------------ 496| | // Conditional ok: table indexes are public here 497| 5.26k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 2.63k, False: 2.63k] ------------------ 498| 2.63k| tbl[i] = tbl[i / 2].square(); 499| 2.63k| } else { 500| 2.63k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 2.63k| } 502| 5.26k| } 503| | 504| 376| auto r = Self::one(); 505| | 506| 376| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 376| if(w0 > 0) { ------------------ | Branch (509:13): [True: 376, False: 0] ------------------ 510| 376| r = tbl[w0 - 1]; 511| 376| } 512| | 513| 24.0k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 23.6k, False: 376] ------------------ 514| 23.6k| r.square_n(WindowBits); 515| | 516| 23.6k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 23.6k| if(w > 0) { ------------------ | Branch (519:16): [True: 22.5k, False: 1.12k] ------------------ 520| 22.5k| r *= tbl[w - 1]; 521| 22.5k| } 522| 23.6k| } 523| | 524| 376| return r; 525| 376| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEEC2Ev: 182| 5.64k| constexpr IntMod() : m_val({}) {} pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE8square_nEm: 441| 23.6k| constexpr void square_n(size_t n) { 442| 23.6k| std::array z; // NOLINT(*-member-init) 443| 118k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 94.7k, False: 23.6k] ------------------ 444| 94.7k| comba_sqr(z.data(), this->data()); 445| 94.7k| m_val = Rep::redc(z); 446| 94.7k| } 447| 23.6k| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEEmLERKSA_: 357| 22.5k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 22.5k| std::array z; // NOLINT(*-member-init) 359| 22.5k| comba_mul(z.data(), data(), other.data()); 360| 22.5k| m_val = Rep::redc(z); 361| 22.5k| return (*this); 362| 22.5k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE14invert_vartimeEv: 600| 252| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 252| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 252] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 252| auto x = Self(std::array{1}); // 1 in standard domain 607| 252| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 252| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 252| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 252| auto y = x; 615| | 616| | // First half of second loop iteration 617| 252| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 40.6k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 40.6k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 252, False: 40.3k] ------------------ 622| | // At this point it should be that a == b == 1 623| 252| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 252| r.m_val = Rep::to_rep(r.m_val); 627| 252| return r; 628| 252| } 629| | 630| 40.3k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 40.3k| std::array r; // NOLINT(*-member-init) 642| 40.3k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 40.3k| if(carry == 0) { ------------------ | Branch (645:16): [True: 14.7k, False: 25.6k] ------------------ 646| | // b > a 647| 14.7k| b.m_val = r; 648| 14.7k| x = nx; 649| 14.7k| Self::_invert_vartime_div2_helper(b, x); 650| 25.6k| } else { 651| | // We know this can't underflow because a > b 652| 25.6k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 25.6k| a.m_val = r; 654| 25.6k| y = nx; 655| 25.6k| Self::_invert_vartime_div2_helper(a, y); 656| 25.6k| } 657| 40.3k| } 658| 252| } pcurves_frp256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 40.8k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 40.8k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 132k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 91.8k, False: 40.8k] ------------------ 554| 91.8k| shift_right<1>(a.m_val); 555| | 556| 91.8k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 91.8k| if(borrow) { ------------------ | Branch (559:16): [True: 46.7k, False: 45.0k] ------------------ 560| 46.7k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 46.7k| } 562| 91.8k| } 563| 40.8k| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEE6negateEv: 454| 634| constexpr Self negate() const { 455| 634| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 634| std::array r; // NOLINT(*-member-init) 458| 634| W carry = 0; 459| 3.17k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 2.53k, False: 634] ------------------ 460| 2.53k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 2.53k| } 462| | 463| 634| return Self(r); 464| 634| } pcurves_frp256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_18frp256v16ParamsES1_E12ScalarParamsEEEEeqERKSA_: 724| 1.53k| constexpr CT::Choice operator==(const Self& other) const { 725| 1.53k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 1.53k| } pcurves_numsp512d1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_110numsp512d15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_13Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_numsp512d1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_numsp512d1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_numsp512d1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm8EEE: 908| 91.8k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 9| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 8, False: 1] ------------------ 416| 8| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 8| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 8| x.m_val[i] = nx; 419| 8| y.m_val[i] = ny; 420| 8| } 421| 1| } pcurves_numsp512d1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 8.92k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_numsp512d1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 3.10k| m_x(x), m_y(y), m_z(z) {} pcurves_numsp512d1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.64k| constexpr Self dbl() const { 1182| 1.64k| if constexpr(Self::A_is_minus_3) { 1183| 1.64k| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 1.64k| } pcurves_numsp512d1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 27.1k| constexpr const FieldElement& z() const { return m_z; } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 15.5k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 15.5k| std::array z; // NOLINT(*-member-init) 430| 15.5k| comba_sqr(z.data(), this->data()); 431| 15.5k| return Self(Rep::redc(z)); 432| 15.5k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 102k| constexpr const W* data() const { return m_val.data(); } pcurves_numsp512d1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 42.6k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 42.6k| std::array z; // NOLINT(*-member-init) 350| 42.6k| comba_mul(z.data(), a.data(), b.data()); 351| 42.6k| return Self(Rep::redc(z)); 352| 42.6k| } pcurves_numsp512d1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 15.3k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 15.3k| std::array r; // NOLINT(*-member-init) 285| 15.3k| W carry = 0; 286| 137k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 122k, False: 15.3k] ------------------ 287| 122k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 122k| } 289| | 290| 15.3k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 15.3k| carry = 0; 293| | 294| 137k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 122k, False: 15.3k] ------------------ 295| 122k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 122k| } 297| | 298| 15.3k| return Self(r); 299| 15.3k| } pcurves_numsp512d1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 13.8k| constexpr const FieldElement& x() const { return m_x; } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 1.64k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_numsp512d1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 5.12k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 5.12k| std::array t; // NOLINT(*-member-init) 269| | 270| 5.12k| W carry = 0; 271| 46.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 41.0k, False: 5.12k] ------------------ 272| 41.0k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 41.0k| } 274| | 275| 5.12k| std::array r; // NOLINT(*-member-init) 276| 5.12k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 5.12k| return Self(r); 278| 5.12k| } pcurves_numsp512d1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 12.2k| constexpr const FieldElement& y() const { return m_y; } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 1.64k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 13.1k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 13.1k| std::array t = value(); 329| 13.1k| const W carry = shift_left<1>(t); 330| | 331| 13.1k| std::array r; // NOLINT(*-member-init) 332| 13.1k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 13.1k| return Self(r); 334| 13.1k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 13.1k| constexpr const std::array& value() const { return m_val; } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 1.64k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_numsp512d1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 1.45k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_numsp512d1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.45k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_numsp512d1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 6.01k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 2.91k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 2.91k| const W mask = cond.into_bitmask(); 399| | 400| 26.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 23.2k, False: 2.91k] ------------------ 401| 23.2k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 23.2k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 23.2k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 23.2k| } 405| 2.91k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 375| for(;;) { 620| | // Conditional ok: this function is variable time 621| 375| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 374] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 374| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 374| std::array r; // NOLINT(*-member-init) 642| 374| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 374| if(carry == 0) { ------------------ | Branch (645:16): [True: 177, False: 197] ------------------ 646| | // b > a 647| 177| b.m_val = r; 648| 177| x = nx; 649| 177| Self::_invert_vartime_div2_helper(b, x); 650| 197| } else { 651| | // We know this can't underflow because a > b 652| 197| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 197| a.m_val = r; 654| 197| y = nx; 655| 197| Self::_invert_vartime_div2_helper(a, y); 656| 197| } 657| 374| } 658| 1| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 376| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 376| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 1.09k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 715, False: 376] ------------------ 554| 715| shift_right<1>(a.m_val); 555| | 556| 715| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 715| if(borrow) { ------------------ | Branch (559:16): [True: 363, False: 352] ------------------ 560| 363| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 363| } 562| 715| } 563| 376| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 18| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 16, False: 2] ------------------ 460| 16| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 16| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_numsp512d1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 3.10k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE8to_wordsEv: 736| 320| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_numsp512d1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS4_13Numsp512d1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm8EEE: 139| 640| constexpr static std::array from_rep(const std::array& z) { 140| 640| std::array ze = {}; 141| 640| copy_mem(std::span{ze}.template first(), z); 142| 640| return Self::redc(ze); 143| 640| } pcurves_numsp512d1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS4_13Numsp512d1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm16EEE: 106| 313k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 313k| } else { 110| 313k| return monty_redc(z, P, P_dash); 111| 313k| } 112| 313k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm64EEE: 741| 320| constexpr void serialize_to(std::span bytes) const { 742| 320| auto v = Rep::from_rep(m_val); 743| 320| std::reverse(v.begin(), v.end()); 744| | 745| 320| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 320| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 320| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 11.3k| static Self from_stash(const std::array& stash) { 777| 11.3k| static_assert(L >= N); 778| 11.3k| std::array val = {}; 779| 101k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 90.4k, False: 11.3k] ------------------ 780| 90.4k| val[i] = stash[i]; 781| 90.4k| } 782| 11.3k| return Self(val); 783| 11.3k| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm8EEE: 908| 134k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 4.43k| std::array stash_value() const { 762| 4.43k| static_assert(L >= N); 763| 4.43k| std::array stash = {}; 764| 39.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 35.4k, False: 4.43k] ------------------ 765| 35.4k| stash[i] = m_val[i]; 766| 35.4k| } 767| 4.43k| return stash; 768| 4.43k| } pcurves_numsp512d1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS4_13Numsp512d1RepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm16EEE: 129| 332| constexpr static std::array wide_to_rep(const std::array& x) { 130| 332| auto redc_x = Self::redc(x); 131| 332| std::array z; // NOLINT(*-member-init) 132| 332| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 332| return Self::redc(z); 134| 332| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 1.63k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 320| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 320| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 320] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 320| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 320| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 320] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 320| return Self::from_words(words); 809| 320| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE10from_wordsILm8EEESB_NSt3__15arrayImXT_EEE: 213| 320| static constexpr Self from_words(std::array w) { 214| 320| if constexpr(L == N) { 215| 320| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 320| } pcurves_numsp512d1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS4_13Numsp512d1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm8EEE: 117| 640| constexpr static std::array to_rep(const std::array& x) { 118| 640| std::array z; // NOLINT(*-member-init) 119| 640| comba_mul(z.data(), x.data(), R2.data()); 120| 640| return Self::redc(z); 121| 640| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 332| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 332| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 332] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 332| std::array padded_bytes = {}; 838| 332| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 332| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 332| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE3oneEv: 202| 648| static constexpr Self one() { return Self(Rep::one()); } pcurves_numsp512d1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS4_13Numsp512d1RepEE12ScalarParamsEE3oneEv: 101| 648| constexpr static std::array one() { return R1; } pcurves_numsp512d1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEEESD_: 267| 104k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 104k| std::array t; // NOLINT(*-member-init) 269| | 270| 104k| W carry = 0; 271| 938k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 834k, False: 104k] ------------------ 272| 834k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 834k| } 274| | 275| 104k| std::array r; // NOLINT(*-member-init) 276| 104k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 104k| return Self(r); 278| 104k| } pcurves_numsp512d1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEEESD_: 283| 166| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 166| std::array r; // NOLINT(*-member-init) 285| 166| W carry = 0; 286| 1.49k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 1.32k, False: 166] ------------------ 287| 1.32k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 1.32k| } 289| | 290| 166| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 166| carry = 0; 293| | 294| 1.49k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 1.32k, False: 166] ------------------ 295| 1.32k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 1.32k| } 297| | 298| 166| return Self(r); 299| 166| } pcurves_numsp512d1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEEESD_: 348| 8.71k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 8.71k| std::array z; // NOLINT(*-member-init) 350| 8.71k| comba_mul(z.data(), a.data(), b.data()); 351| 8.71k| return Self(Rep::redc(z)); 352| 8.71k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE4dataEv: 898| 714k| constexpr const W* data() const { return m_val.data(); } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE6squareEv: 428| 7.39k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 7.39k| std::array z; // NOLINT(*-member-init) 430| 7.39k| comba_sqr(z.data(), this->data()); 431| 7.39k| return Self(Rep::redc(z)); 432| 7.39k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE6invertEv: 540| 482| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE11pow_vartimeERKNSt3__15arrayImLm8EEE: 479| 482| constexpr Self pow_vartime(const std::array& exp) const { 480| 482| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [Folded, False: 482] ------------------ 481| 482| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 482| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 482| std::array tbl; 492| | 493| 482| tbl[0] = (*this); 494| | 495| 14.9k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 14.4k, False: 482] ------------------ 496| | // Conditional ok: table indexes are public here 497| 14.4k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 7.23k, False: 7.23k] ------------------ 498| 7.23k| tbl[i] = tbl[i / 2].square(); 499| 7.23k| } else { 500| 7.23k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 7.23k| } 502| 14.4k| } 503| | 504| 482| auto r = Self::one(); 505| | 506| 482| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 482| if(w0 > 0) { ------------------ | Branch (509:13): [True: 482, False: 0] ------------------ 510| 482| r = tbl[w0 - 1]; 511| 482| } 512| | 513| 49.6k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 49.1k, False: 482] ------------------ 514| 49.1k| r.square_n(WindowBits); 515| | 516| 49.1k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 49.1k| if(w > 0) { ------------------ | Branch (519:16): [True: 49.1k, False: 0] ------------------ 520| 49.1k| r *= tbl[w - 1]; 521| 49.1k| } 522| 49.1k| } 523| | 524| 482| return r; 525| 482| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEEC2Ev: 182| 14.9k| constexpr IntMod() : m_val({}) {} pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE8square_nEm: 441| 49.1k| constexpr void square_n(size_t n) { 442| 49.1k| std::array z; // NOLINT(*-member-init) 443| 294k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 245k, False: 49.1k] ------------------ 444| 245k| comba_sqr(z.data(), this->data()); 445| 245k| m_val = Rep::redc(z); 446| 245k| } 447| 49.1k| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEEmLERKSB_: 357| 49.1k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 49.1k| std::array z; // NOLINT(*-member-init) 359| 49.1k| comba_mul(z.data(), data(), other.data()); 360| 49.1k| m_val = Rep::redc(z); 361| 49.1k| return (*this); 362| 49.1k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 320| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 320| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 320] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 320| auto x = Self(std::array{1}); // 1 in standard domain 607| 320| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 320| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 320| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 320| auto y = x; 615| | 616| | // First half of second loop iteration 617| 320| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 103k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 103k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 320, False: 103k] ------------------ 622| | // At this point it should be that a == b == 1 623| 320| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 320| r.m_val = Rep::to_rep(r.m_val); 627| 320| return r; 628| 320| } 629| | 630| 103k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 103k| std::array r; // NOLINT(*-member-init) 642| 103k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 103k| if(carry == 0) { ------------------ | Branch (645:16): [True: 36.6k, False: 66.8k] ------------------ 646| | // b > a 647| 36.6k| b.m_val = r; 648| 36.6k| x = nx; 649| 36.6k| Self::_invert_vartime_div2_helper(b, x); 650| 66.8k| } else { 651| | // We know this can't underflow because a > b 652| 66.8k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 66.8k| a.m_val = r; 654| 66.8k| y = nx; 655| 66.8k| Self::_invert_vartime_div2_helper(a, y); 656| 66.8k| } 657| 103k| } 658| 320| } pcurves_numsp512d1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 104k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 104k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 337k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 233k, False: 104k] ------------------ 554| 233k| shift_right<1>(a.m_val); 555| | 556| 233k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 233k| if(borrow) { ------------------ | Branch (559:16): [True: 119k, False: 114k] ------------------ 560| 119k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 119k| } 562| 233k| } 563| 104k| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEE6negateEv: 454| 806| constexpr Self negate() const { 455| 806| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 806| std::array r; // NOLINT(*-member-init) 458| 806| W carry = 0; 459| 7.25k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 6.44k, False: 806] ------------------ 460| 6.44k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 6.44k| } 462| | 463| 806| return Self(r); 464| 806| } pcurves_numsp512d1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_110numsp512d16ParamsENS5_13Numsp512d1RepEE12ScalarParamsEEEEeqERKSB_: 724| 1.95k| constexpr CT::Choice operator==(const Self& other) const { 725| 1.95k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 1.95k| } pcurves_secp192r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp192r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_12Secp192r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp192r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_secp192r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_secp192r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm3EEE: 908| 35.0k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 4| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 3, False: 1] ------------------ 416| 3| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 3| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 3| x.m_val[i] = nx; 419| 3| y.m_val[i] = ny; 420| 3| } 421| 1| } pcurves_secp192r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 3.40k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp192r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 1.18k| m_x(x), m_y(y), m_z(z) {} pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 629| constexpr Self dbl() const { 1182| 629| if constexpr(Self::A_is_minus_3) { 1183| 629| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 629| } pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 10.3k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 5.92k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 5.92k| std::array z; // NOLINT(*-member-init) 430| 5.92k| comba_sqr(z.data(), this->data()); 431| 5.92k| return Self(Rep::redc(z)); 432| 5.92k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 38.9k| constexpr const W* data() const { return m_val.data(); } pcurves_secp192r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 16.2k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 16.2k| std::array z; // NOLINT(*-member-init) 350| 16.2k| comba_mul(z.data(), a.data(), b.data()); 351| 16.2k| return Self(Rep::redc(z)); 352| 16.2k| } pcurves_secp192r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 5.84k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 5.84k| std::array r; // NOLINT(*-member-init) 285| 5.84k| W carry = 0; 286| 23.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 17.5k, False: 5.84k] ------------------ 287| 17.5k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 17.5k| } 289| | 290| 5.84k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 5.84k| carry = 0; 293| | 294| 23.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 17.5k, False: 5.84k] ------------------ 295| 17.5k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 17.5k| } 297| | 298| 5.84k| return Self(r); 299| 5.84k| } pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 5.29k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 629| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp192r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 1.95k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 1.95k| std::array t; // NOLINT(*-member-init) 269| | 270| 1.95k| W carry = 0; 271| 7.82k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 5.86k, False: 1.95k] ------------------ 272| 5.86k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 5.86k| } 274| | 275| 1.95k| std::array r; // NOLINT(*-member-init) 276| 1.95k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 1.95k| return Self(r); 278| 1.95k| } pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 4.66k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 629| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 5.03k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 5.03k| std::array t = value(); 329| 5.03k| const W carry = shift_left<1>(t); 330| | 331| 5.03k| std::array r; // NOLINT(*-member-init) 332| 5.03k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 5.03k| return Self(r); 334| 5.03k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 5.03k| constexpr const std::array& value() const { return m_val; } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 629| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp192r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 555| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp192r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 555| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 2.29k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 1.11k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 1.11k| const W mask = cond.into_bitmask(); 399| | 400| 4.44k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 3.33k, False: 1.11k] ------------------ 401| 3.33k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 3.33k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 3.33k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 3.33k| } 405| 1.11k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 144| for(;;) { 620| | // Conditional ok: this function is variable time 621| 144| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 143] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 143| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 143| std::array r; // NOLINT(*-member-init) 642| 143| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 143| if(carry == 0) { ------------------ | Branch (645:16): [True: 74, False: 69] ------------------ 646| | // b > a 647| 74| b.m_val = r; 648| 74| x = nx; 649| 74| Self::_invert_vartime_div2_helper(b, x); 650| 74| } else { 651| | // We know this can't underflow because a > b 652| 69| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 69| a.m_val = r; 654| 69| y = nx; 655| 69| Self::_invert_vartime_div2_helper(a, y); 656| 69| } 657| 143| } 658| 1| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 145| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 145| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 402| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 257, False: 145] ------------------ 554| 257| shift_right<1>(a.m_val); 555| | 556| 257| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 257| if(borrow) { ------------------ | Branch (559:16): [True: 110, False: 147] ------------------ 560| 110| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 110| } 562| 257| } 563| 145| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 8| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 6, False: 2] ------------------ 460| 6| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 6| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_secp192r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 1.18k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE8to_wordsEv: 736| 506| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp192r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS4_12Secp192r1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm3EEE: 139| 1.01k| constexpr static std::array from_rep(const std::array& z) { 140| 1.01k| std::array ze = {}; 141| 1.01k| copy_mem(std::span{ze}.template first(), z); 142| 1.01k| return Self::redc(ze); 143| 1.01k| } pcurves_secp192r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS4_12Secp192r1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm6EEE: 106| 194k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 194k| } else { 110| 194k| return monty_redc(z, P, P_dash); 111| 194k| } 112| 194k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm24EEE: 741| 506| constexpr void serialize_to(std::span bytes) const { 742| 506| auto v = Rep::from_rep(m_val); 743| 506| std::reverse(v.begin(), v.end()); 744| | 745| 506| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 506| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 506| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 17.9k| static Self from_stash(const std::array& stash) { 777| 17.9k| static_assert(L >= N); 778| 17.9k| std::array val = {}; 779| 71.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 53.8k, False: 17.9k] ------------------ 780| 53.8k| val[i] = stash[i]; 781| 53.8k| } 782| 17.9k| return Self(val); 783| 17.9k| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm3EEE: 908| 98.2k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 7.03k| std::array stash_value() const { 762| 7.03k| static_assert(L >= N); 763| 7.03k| std::array stash = {}; 764| 28.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 21.0k, False: 7.03k] ------------------ 765| 21.0k| stash[i] = m_val[i]; 766| 21.0k| } 767| 7.03k| return stash; 768| 7.03k| } pcurves_secp192r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS4_12Secp192r1RepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm6EEE: 129| 528| constexpr static std::array wide_to_rep(const std::array& x) { 130| 528| auto redc_x = Self::redc(x); 131| 528| std::array z; // NOLINT(*-member-init) 132| 528| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 528| return Self::redc(z); 134| 528| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 2.59k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 506| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 506| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 506] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 506| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 506| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 506] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 506| return Self::from_words(words); 809| 506| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE10from_wordsILm3EEESB_NSt3__15arrayImXT_EEE: 213| 506| static constexpr Self from_words(std::array w) { 214| 506| if constexpr(L == N) { 215| 506| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 506| } pcurves_secp192r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS4_12Secp192r1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm3EEE: 117| 1.01k| constexpr static std::array to_rep(const std::array& x) { 118| 1.01k| std::array z; // NOLINT(*-member-init) 119| 1.01k| comba_mul(z.data(), x.data(), R2.data()); 120| 1.01k| return Self::redc(z); 121| 1.01k| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 528| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 528| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 528] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 528| std::array padded_bytes = {}; 838| 528| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 528| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 528| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE3oneEv: 202| 1.02k| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp192r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS4_12Secp192r1RepEE12ScalarParamsEE3oneEv: 101| 1.02k| constexpr static std::array one() { return R1; } pcurves_secp192r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEEESD_: 267| 62.3k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 62.3k| std::array t; // NOLINT(*-member-init) 269| | 270| 62.3k| W carry = 0; 271| 249k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 187k, False: 62.3k] ------------------ 272| 187k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 187k| } 274| | 275| 62.3k| std::array r; // NOLINT(*-member-init) 276| 62.3k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 62.3k| return Self(r); 278| 62.3k| } pcurves_secp192r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEEESD_: 283| 264| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 264| std::array r; // NOLINT(*-member-init) 285| 264| W carry = 0; 286| 1.05k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 792, False: 264] ------------------ 287| 792| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 792| } 289| | 290| 264| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 264| carry = 0; 293| | 294| 1.05k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 792, False: 264] ------------------ 295| 792| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 792| } 297| | 298| 264| return Self(r); 299| 264| } pcurves_secp192r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEEESD_: 348| 7.67k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 7.67k| std::array z; // NOLINT(*-member-init) 350| 7.67k| comba_mul(z.data(), a.data(), b.data()); 351| 7.67k| return Self(Rep::redc(z)); 352| 7.67k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE4dataEv: 898| 443k| constexpr const W* data() const { return m_val.data(); } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE6squareEv: 428| 5.58k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 5.58k| std::array z; // NOLINT(*-member-init) 430| 5.58k| comba_sqr(z.data(), this->data()); 431| 5.58k| return Self(Rep::redc(z)); 432| 5.58k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE6invertEv: 540| 760| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE11pow_vartimeERKNSt3__15arrayImLm3EEE: 479| 760| constexpr Self pow_vartime(const std::array& exp) const { 480| 760| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [True: 0, Folded] ------------------ 481| 760| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 760| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 760| std::array tbl; 492| | 493| 760| tbl[0] = (*this); 494| | 495| 11.4k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 10.6k, False: 760] ------------------ 496| | // Conditional ok: table indexes are public here 497| 10.6k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 5.32k, False: 5.32k] ------------------ 498| 5.32k| tbl[i] = tbl[i / 2].square(); 499| 5.32k| } else { 500| 5.32k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 5.32k| } 502| 10.6k| } 503| | 504| 760| auto r = Self::one(); 505| | 506| 760| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 760| if(w0 > 0) { ------------------ | Branch (509:13): [True: 760, False: 0] ------------------ 510| 760| r = tbl[w0 - 1]; 511| 760| } 512| | 513| 36.4k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 35.7k, False: 760] ------------------ 514| 35.7k| r.square_n(WindowBits); 515| | 516| 35.7k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 35.7k| if(w > 0) { ------------------ | Branch (519:16): [True: 35.7k, False: 0] ------------------ 520| 35.7k| r *= tbl[w - 1]; 521| 35.7k| } 522| 35.7k| } 523| | 524| 760| return r; 525| 760| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEEC2Ev: 182| 11.4k| constexpr IntMod() : m_val({}) {} pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE8square_nEm: 441| 35.7k| constexpr void square_n(size_t n) { 442| 35.7k| std::array z; // NOLINT(*-member-init) 443| 178k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 142k, False: 35.7k] ------------------ 444| 142k| comba_sqr(z.data(), this->data()); 445| 142k| m_val = Rep::redc(z); 446| 142k| } 447| 35.7k| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEEmLERKSB_: 357| 35.7k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 35.7k| std::array z; // NOLINT(*-member-init) 359| 35.7k| comba_mul(z.data(), data(), other.data()); 360| 35.7k| m_val = Rep::redc(z); 361| 35.7k| return (*this); 362| 35.7k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 506| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 506| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 506] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 506| auto x = Self(std::array{1}); // 1 in standard domain 607| 506| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 506| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 506| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 506| auto y = x; 615| | 616| | // First half of second loop iteration 617| 506| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 61.5k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 61.5k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 506, False: 61.0k] ------------------ 622| | // At this point it should be that a == b == 1 623| 506| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 506| r.m_val = Rep::to_rep(r.m_val); 627| 506| return r; 628| 506| } 629| | 630| 61.0k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 61.0k| std::array r; // NOLINT(*-member-init) 642| 61.0k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 61.0k| if(carry == 0) { ------------------ | Branch (645:16): [True: 21.5k, False: 39.5k] ------------------ 646| | // b > a 647| 21.5k| b.m_val = r; 648| 21.5k| x = nx; 649| 21.5k| Self::_invert_vartime_div2_helper(b, x); 650| 39.5k| } else { 651| | // We know this can't underflow because a > b 652| 39.5k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 39.5k| a.m_val = r; 654| 39.5k| y = nx; 655| 39.5k| Self::_invert_vartime_div2_helper(a, y); 656| 39.5k| } 657| 61.0k| } 658| 506| } pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 62.0k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 62.0k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 199k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 137k, False: 62.0k] ------------------ 554| 137k| shift_right<1>(a.m_val); 555| | 556| 137k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 137k| if(borrow) { ------------------ | Branch (559:16): [True: 69.3k, False: 68.3k] ------------------ 560| 69.3k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 69.3k| } 562| 137k| } 563| 62.0k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEE6negateEv: 454| 1.27k| constexpr Self negate() const { 455| 1.27k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 1.27k| std::array r; // NOLINT(*-member-init) 458| 1.27k| W carry = 0; 459| 5.10k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 3.82k, False: 1.27k] ------------------ 460| 3.82k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 3.82k| } 462| | 463| 1.27k| return Self(r); 464| 1.27k| } pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS5_12Secp192r1RepEE12ScalarParamsEEEEeqERKSB_: 724| 3.09k| constexpr CT::Choice operator==(const Self& other) const { 725| 3.09k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 3.09k| } pcurves_secp224r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_12Secp224r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 40.7k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 5| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 4, False: 1] ------------------ 416| 4| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 4| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 4| x.m_val[i] = nx; 419| 4| y.m_val[i] = ny; 420| 4| } 421| 1| } pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 3.95k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 1.37k| m_x(x), m_y(y), m_z(z) {} pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 731| constexpr Self dbl() const { 1182| 731| if constexpr(Self::A_is_minus_3) { 1183| 731| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 731| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 12.0k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 6.88k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 6.88k| std::array z; // NOLINT(*-member-init) 430| 6.88k| comba_sqr(z.data(), this->data()); 431| 6.88k| return Self(Rep::redc(z)); 432| 6.88k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 45.1k| constexpr const W* data() const { return m_val.data(); } pcurves_secp224r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 18.9k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 18.9k| std::array z; // NOLINT(*-member-init) 350| 18.9k| comba_mul(z.data(), a.data(), b.data()); 351| 18.9k| return Self(Rep::redc(z)); 352| 18.9k| } pcurves_secp224r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 6.79k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 6.79k| std::array r; // NOLINT(*-member-init) 285| 6.79k| W carry = 0; 286| 33.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 27.1k, False: 6.79k] ------------------ 287| 27.1k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 27.1k| } 289| | 290| 6.79k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 6.79k| carry = 0; 293| | 294| 33.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 27.1k, False: 6.79k] ------------------ 295| 27.1k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 27.1k| } 297| | 298| 6.79k| return Self(r); 299| 6.79k| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 6.14k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 731| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp224r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 2.25k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 2.25k| std::array t; // NOLINT(*-member-init) 269| | 270| 2.25k| W carry = 0; 271| 11.2k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 9.03k, False: 2.25k] ------------------ 272| 9.03k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 9.03k| } 274| | 275| 2.25k| std::array r; // NOLINT(*-member-init) 276| 2.25k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 2.25k| return Self(r); 278| 2.25k| } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 5.41k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 731| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 5.84k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 5.84k| std::array t = value(); 329| 5.84k| const W carry = shift_left<1>(t); 330| | 331| 5.84k| std::array r; // NOLINT(*-member-init) 332| 5.84k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 5.84k| return Self(r); 334| 5.84k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 5.84k| constexpr const std::array& value() const { return m_val; } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 731| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp224r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 645| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 645| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 2.66k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 1.29k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 1.29k| const W mask = cond.into_bitmask(); 399| | 400| 6.45k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 5.16k, False: 1.29k] ------------------ 401| 5.16k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 5.16k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 5.16k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 5.16k| } 405| 1.29k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 153| for(;;) { 620| | // Conditional ok: this function is variable time 621| 153| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 152] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 152| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 152| std::array r; // NOLINT(*-member-init) 642| 152| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 152| if(carry == 0) { ------------------ | Branch (645:16): [True: 81, False: 71] ------------------ 646| | // b > a 647| 81| b.m_val = r; 648| 81| x = nx; 649| 81| Self::_invert_vartime_div2_helper(b, x); 650| 81| } else { 651| | // We know this can't underflow because a > b 652| 71| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 71| a.m_val = r; 654| 71| y = nx; 655| 71| Self::_invert_vartime_div2_helper(a, y); 656| 71| } 657| 152| } 658| 1| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 154| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 154| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 479| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 325, False: 154] ------------------ 554| 325| shift_right<1>(a.m_val); 555| | 556| 325| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 325| if(borrow) { ------------------ | Branch (559:16): [True: 200, False: 125] ------------------ 560| 200| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 200| } 562| 325| } 563| 154| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 10| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 8, False: 2] ------------------ 460| 8| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 8| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_secp224r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 1.37k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE8to_wordsEv: 736| 448| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 896| constexpr static std::array from_rep(const std::array& z) { 140| 896| std::array ze = {}; 141| 896| copy_mem(std::span{ze}.template first(), z); 142| 896| return Self::redc(ze); 143| 896| } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 176k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 176k| } else { 110| 176k| return monty_redc(z, P, P_dash); 111| 176k| } 112| 176k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm28EEE: 741| 448| constexpr void serialize_to(std::span bytes) const { 742| 448| auto v = Rep::from_rep(m_val); 743| 448| std::reverse(v.begin(), v.end()); 744| | 745| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| | store_be(bytes, v); 747| 448| } else { 748| | // Remove leading zero bytes 749| 448| const auto padded_bytes = store_be(v); 750| 448| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| 448| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| 448| } 753| 448| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 15.7k| static Self from_stash(const std::array& stash) { 777| 15.7k| static_assert(L >= N); 778| 15.7k| std::array val = {}; 779| 78.5k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 62.8k, False: 15.7k] ------------------ 780| 62.8k| val[i] = stash[i]; 781| 62.8k| } 782| 15.7k| return Self(val); 783| 15.7k| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 94.8k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 6.15k| std::array stash_value() const { 762| 6.15k| static_assert(L >= N); 763| 6.15k| std::array stash = {}; 764| 30.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 24.6k, False: 6.15k] ------------------ 765| 24.6k| stash[i] = m_val[i]; 766| 24.6k| } 767| 6.15k| return stash; 768| 6.15k| } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm8EEE: 129| 460| constexpr static std::array wide_to_rep(const std::array& x) { 130| 460| auto redc_x = Self::redc(x); 131| 460| std::array z; // NOLINT(*-member-init) 132| 460| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 460| return Self::redc(z); 134| 460| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 2.27k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 448| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 448| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 448] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 448| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 448| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 448] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 448| return Self::from_words(words); 809| 448| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 213| 448| static constexpr Self from_words(std::array w) { 214| 448| if constexpr(L == N) { 215| 448| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 448| } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 896| constexpr static std::array to_rep(const std::array& x) { 118| 896| std::array z; // NOLINT(*-member-init) 119| 896| comba_mul(z.data(), x.data(), R2.data()); 120| 896| return Self::redc(z); 121| 896| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 460| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 460| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 460] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 460| std::array padded_bytes = {}; 838| 460| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 460| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 460| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE3oneEv: 202| 230| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp224r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS4_12Secp224r1RepEE12ScalarParamsEE3oneEv: 101| 230| constexpr static std::array one() { return R1; } pcurves_secp224r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEEESD_: 267| 64.0k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 64.0k| std::array t; // NOLINT(*-member-init) 269| | 270| 64.0k| W carry = 0; 271| 320k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 256k, False: 64.0k] ------------------ 272| 256k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 256k| } 274| | 275| 64.0k| std::array r; // NOLINT(*-member-init) 276| 64.0k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 64.0k| return Self(r); 278| 64.0k| } pcurves_secp224r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEEESD_: 283| 230| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 230| std::array r; // NOLINT(*-member-init) 285| 230| W carry = 0; 286| 1.15k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 920, False: 230] ------------------ 287| 920| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 920| } 289| | 290| 230| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 230| carry = 0; 293| | 294| 1.15k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 920, False: 230] ------------------ 295| 920| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 920| } 297| | 298| 230| return Self(r); 299| 230| } pcurves_secp224r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEEESD_: 348| 8.76k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 8.76k| std::array z; // NOLINT(*-member-init) 350| 8.76k| comba_mul(z.data(), a.data(), b.data()); 351| 8.76k| return Self(Rep::redc(z)); 352| 8.76k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE4dataEv: 898| 417k| constexpr const W* data() const { return m_val.data(); } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE6squareEv: 428| 2.91k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 2.91k| std::array z; // NOLINT(*-member-init) 430| 2.91k| comba_sqr(z.data(), this->data()); 431| 2.91k| return Self(Rep::redc(z)); 432| 2.91k| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEEmLERKSB_: 357| 16.1k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 16.1k| std::array z; // NOLINT(*-member-init) 359| 16.1k| comba_mul(z.data(), data(), other.data()); 360| 16.1k| m_val = Rep::redc(z); 361| 16.1k| return (*this); 362| 16.1k| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE8square_nEm: 441| 14.7k| constexpr void square_n(size_t n) { 442| 14.7k| std::array z; // NOLINT(*-member-init) 443| 160k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 145k, False: 14.7k] ------------------ 444| 145k| comba_sqr(z.data(), this->data()); 445| 145k| m_val = Rep::redc(z); 446| 145k| } 447| 14.7k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 448| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 448| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 448] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 448| auto x = Self(std::array{1}); // 1 in standard domain 607| 448| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 448| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 448| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 448| auto y = x; 615| | 616| | // First half of second loop iteration 617| 448| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 63.3k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 63.3k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 448, False: 62.8k] ------------------ 622| | // At this point it should be that a == b == 1 623| 448| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 448| r.m_val = Rep::to_rep(r.m_val); 627| 448| return r; 628| 448| } 629| | 630| 62.8k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 62.8k| std::array r; // NOLINT(*-member-init) 642| 62.8k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 62.8k| if(carry == 0) { ------------------ | Branch (645:16): [True: 19.2k, False: 43.6k] ------------------ 646| | // b > a 647| 19.2k| b.m_val = r; 648| 19.2k| x = nx; 649| 19.2k| Self::_invert_vartime_div2_helper(b, x); 650| 43.6k| } else { 651| | // We know this can't underflow because a > b 652| 43.6k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 43.6k| a.m_val = r; 654| 43.6k| y = nx; 655| 43.6k| Self::_invert_vartime_div2_helper(a, y); 656| 43.6k| } 657| 62.8k| } 658| 448| } pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 63.7k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 63.7k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 204k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 141k, False: 63.7k] ------------------ 554| 141k| shift_right<1>(a.m_val); 555| | 556| 141k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 141k| if(borrow) { ------------------ | Branch (559:16): [True: 71.0k, False: 70.1k] ------------------ 560| 71.0k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 71.0k| } 562| 141k| } 563| 63.7k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEE6negateEv: 454| 1.12k| constexpr Self negate() const { 455| 1.12k| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 1.12k| std::array r; // NOLINT(*-member-init) 458| 1.12k| W carry = 0; 459| 5.63k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 4.50k, False: 1.12k] ------------------ 460| 4.50k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 4.50k| } 462| | 463| 1.12k| return Self(r); 464| 1.12k| } pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS5_12Secp224r1RepEE12ScalarParamsEEEEeqERKSB_: 724| 2.71k| constexpr CT::Choice operator==(const Self& other) const { 725| 2.71k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 2.71k| } pcurves_secp256k1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_12Secp256k1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_secp256k1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256k1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 43.8k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 5| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 4, False: 1] ------------------ 416| 4| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 4| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 4| x.m_val[i] = nx; 419| 4| y.m_val[i] = ny; 420| 4| } 421| 1| } pcurves_secp256k1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 4.51k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 1.56k| m_x(x), m_y(y), m_z(z) {} pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| | if constexpr(Self::A_is_minus_3) { 1183| | return dbl_a_minus_3(*this); 1184| 833| } else if constexpr(Self::A_is_zero) { 1185| 833| return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 833| } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 6.17k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 7.84k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 7.84k| std::array z; // NOLINT(*-member-init) 430| 7.84k| comba_sqr(z.data(), this->data()); 431| 7.84k| return Self(Rep::redc(z)); 432| 7.84k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 49.7k| constexpr const W* data() const { return m_val.data(); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp256k1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 1.74k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 1.74k| std::array t; // NOLINT(*-member-init) 269| | 270| 1.74k| W carry = 0; 271| 8.71k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 6.97k, False: 1.74k] ------------------ 272| 6.97k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 6.97k| } 274| | 275| 1.74k| std::array r; // NOLINT(*-member-init) 276| 1.74k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 1.74k| return Self(r); 278| 1.74k| } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 6.17k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256k1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 20.7k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 20.7k| std::array z; // NOLINT(*-member-init) 350| 20.7k| comba_mul(z.data(), a.data(), b.data()); 351| 20.7k| return Self(Rep::redc(z)); 352| 20.7k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp256k1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 6.90k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 6.90k| std::array r; // NOLINT(*-member-init) 285| 6.90k| W carry = 0; 286| 34.5k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 27.6k, False: 6.90k] ------------------ 287| 27.6k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 27.6k| } 289| | 290| 6.90k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 6.90k| carry = 0; 293| | 294| 34.5k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 27.6k, False: 6.90k] ------------------ 295| 27.6k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 27.6k| } 297| | 298| 6.90k| return Self(r); 299| 6.90k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 12.8k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp256k1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp256k1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp256k1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 3.03k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 1.47k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 1.47k| const W mask = cond.into_bitmask(); 399| | 400| 7.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 5.88k, False: 1.47k] ------------------ 401| 5.88k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 5.88k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 5.88k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 5.88k| } 405| 1.47k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 176| for(;;) { 620| | // Conditional ok: this function is variable time 621| 176| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 175] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 175| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 175| std::array r; // NOLINT(*-member-init) 642| 175| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 175| if(carry == 0) { ------------------ | Branch (645:16): [True: 105, False: 70] ------------------ 646| | // b > a 647| 105| b.m_val = r; 648| 105| x = nx; 649| 105| Self::_invert_vartime_div2_helper(b, x); 650| 105| } else { 651| | // We know this can't underflow because a > b 652| 70| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 70| a.m_val = r; 654| 70| y = nx; 655| 70| Self::_invert_vartime_div2_helper(a, y); 656| 70| } 657| 175| } 658| 1| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 177| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 177| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 541| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 364, False: 177] ------------------ 554| 364| shift_right<1>(a.m_val); 555| | 556| 364| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 364| if(borrow) { ------------------ | Branch (559:16): [True: 186, False: 178] ------------------ 560| 186| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 186| } 562| 364| } 563| 177| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 10| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 8, False: 2] ------------------ 460| 8| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 8| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_secp256k1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 1.56k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE8to_wordsEv: 736| 353| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 706| constexpr static std::array from_rep(const std::array& z) { 140| 706| std::array ze = {}; 141| 706| copy_mem(std::span{ze}.template first(), z); 142| 706| return Self::redc(ze); 143| 706| } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 159k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 159k| } else { 110| 159k| return monty_redc(z, P, P_dash); 111| 159k| } 112| 159k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 353| constexpr void serialize_to(std::span bytes) const { 742| 353| auto v = Rep::from_rep(m_val); 743| 353| std::reverse(v.begin(), v.end()); 744| | 745| 353| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 353| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 353| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 12.5k| static Self from_stash(const std::array& stash) { 777| 12.5k| static_assert(L >= N); 778| 12.5k| std::array val = {}; 779| 62.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 50.2k, False: 12.5k] ------------------ 780| 50.2k| val[i] = stash[i]; 781| 50.2k| } 782| 12.5k| return Self(val); 783| 12.5k| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 80.8k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 4.92k| std::array stash_value() const { 762| 4.92k| static_assert(L >= N); 763| 4.92k| std::array stash = {}; 764| 24.6k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 19.6k, False: 4.92k] ------------------ 765| 19.6k| stash[i] = m_val[i]; 766| 19.6k| } 767| 4.92k| return stash; 768| 4.92k| } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm8EEE: 129| 370| constexpr static std::array wide_to_rep(const std::array& x) { 130| 370| auto redc_x = Self::redc(x); 131| 370| std::array z; // NOLINT(*-member-init) 132| 370| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 370| return Self::redc(z); 134| 370| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 1.81k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 353| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 353| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 353] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 353| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 353| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 353] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 353| return Self::from_words(words); 809| 353| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 213| 353| static constexpr Self from_words(std::array w) { 214| 353| if constexpr(L == N) { 215| 353| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 353| } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 706| constexpr static std::array to_rep(const std::array& x) { 118| 706| std::array z; // NOLINT(*-member-init) 119| 706| comba_mul(z.data(), x.data(), R2.data()); 120| 706| return Self::redc(z); 121| 706| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 370| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 370| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 370] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 370| std::array padded_bytes = {}; 838| 370| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 370| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 370| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE3oneEv: 202| 185| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp256k1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS4_12Secp256k1RepEE12ScalarParamsEE3oneEv: 101| 185| constexpr static std::array one() { return R1; } pcurves_secp256k1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEEESD_: 267| 57.3k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 57.3k| std::array t; // NOLINT(*-member-init) 269| | 270| 57.3k| W carry = 0; 271| 286k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 229k, False: 57.3k] ------------------ 272| 229k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 229k| } 274| | 275| 57.3k| std::array r; // NOLINT(*-member-init) 276| 57.3k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 57.3k| return Self(r); 278| 57.3k| } pcurves_secp256k1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEEESD_: 283| 185| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 185| std::array r; // NOLINT(*-member-init) 285| 185| W carry = 0; 286| 925| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 740, False: 185] ------------------ 287| 740| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 740| } 289| | 290| 185| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 185| carry = 0; 293| | 294| 925| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 740, False: 185] ------------------ 295| 740| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 740| } 297| | 298| 185| return Self(r); 299| 185| } pcurves_secp256k1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEEESD_: 348| 5.36k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 5.36k| std::array z; // NOLINT(*-member-init) 350| 5.36k| comba_mul(z.data(), a.data(), b.data()); 351| 5.36k| return Self(Rep::redc(z)); 352| 5.36k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE4dataEv: 898| 372k| constexpr const W* data() const { return m_val.data(); } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE6squareEv: 428| 2.84k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 2.84k| std::array z; // NOLINT(*-member-init) 430| 2.84k| comba_sqr(z.data(), this->data()); 431| 2.84k| return Self(Rep::redc(z)); 432| 2.84k| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE8square_nEm: 441| 17.5k| constexpr void square_n(size_t n) { 442| 17.5k| std::array z; // NOLINT(*-member-init) 443| 149k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 131k, False: 17.5k] ------------------ 444| 131k| comba_sqr(z.data(), this->data()); 445| 131k| m_val = Rep::redc(z); 446| 131k| } 447| 17.5k| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEEmLERKSB_: 357| 17.5k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 17.5k| std::array z; // NOLINT(*-member-init) 359| 17.5k| comba_mul(z.data(), data(), other.data()); 360| 17.5k| m_val = Rep::redc(z); 361| 17.5k| return (*this); 362| 17.5k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 353| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 353| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 353] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 353| auto x = Self(std::array{1}); // 1 in standard domain 607| 353| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 353| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 353| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 353| auto y = x; 615| | 616| | // First half of second loop iteration 617| 353| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 56.7k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 56.7k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 353, False: 56.4k] ------------------ 622| | // At this point it should be that a == b == 1 623| 353| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 353| r.m_val = Rep::to_rep(r.m_val); 627| 353| return r; 628| 353| } 629| | 630| 56.4k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 56.4k| std::array r; // NOLINT(*-member-init) 642| 56.4k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 56.4k| if(carry == 0) { ------------------ | Branch (645:16): [True: 19.2k, False: 37.1k] ------------------ 646| | // b > a 647| 19.2k| b.m_val = r; 648| 19.2k| x = nx; 649| 19.2k| Self::_invert_vartime_div2_helper(b, x); 650| 37.1k| } else { 651| | // We know this can't underflow because a > b 652| 37.1k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 37.1k| a.m_val = r; 654| 37.1k| y = nx; 655| 37.1k| Self::_invert_vartime_div2_helper(a, y); 656| 37.1k| } 657| 56.4k| } 658| 353| } pcurves_secp256k1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 57.1k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 57.1k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 187k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 130k, False: 57.1k] ------------------ 554| 130k| shift_right<1>(a.m_val); 555| | 556| 130k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 130k| if(borrow) { ------------------ | Branch (559:16): [True: 65.1k, False: 65.4k] ------------------ 560| 65.1k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 65.1k| } 562| 130k| } 563| 57.1k| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEE6negateEv: 454| 891| constexpr Self negate() const { 455| 891| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 891| std::array r; // NOLINT(*-member-init) 458| 891| W carry = 0; 459| 4.45k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 3.56k, False: 891] ------------------ 460| 3.56k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 3.56k| } 462| | 463| 891| return Self(r); 464| 891| } pcurves_secp256k1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256k16ParamsENS5_12Secp256k1RepEE12ScalarParamsEEEEeqERKSB_: 724| 2.16k| constexpr CT::Choice operator==(const Self& other) const { 725| 2.16k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 2.16k| } pcurves_secp256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_22Secp256r1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 46.3k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 5| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 4, False: 1] ------------------ 416| 4| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 4| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 4| x.m_val[i] = nx; 419| 4| y.m_val[i] = ny; 420| 4| } 421| 1| } pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE7is_zeroEv: 227| 4.51k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 1.56k| m_x(x), m_y(y), m_z(z) {} pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| 833| if constexpr(Self::A_is_minus_3) { 1183| 833| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 833| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1zEv: 1224| 13.7k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6squareEv: 428| 7.84k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 7.84k| std::array z; // NOLINT(*-member-init) 430| 7.84k| comba_sqr(z.data(), this->data()); 431| 7.84k| return Self(Rep::redc(z)); 432| 7.84k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4dataEv: 898| 51.4k| constexpr const W* data() const { return m_val.data(); } pcurves_secp256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 348| 21.5k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 21.5k| std::array z; // NOLINT(*-member-init) 350| 21.5k| comba_mul(z.data(), a.data(), b.data()); 351| 21.5k| return Self(Rep::redc(z)); 352| 21.5k| } pcurves_secp256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 283| 7.74k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 7.74k| std::array r; // NOLINT(*-member-init) 285| 7.74k| W carry = 0; 286| 38.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 30.9k, False: 7.74k] ------------------ 287| 30.9k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 30.9k| } 289| | 290| 7.74k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 7.74k| carry = 0; 293| | 294| 38.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 30.9k, False: 7.74k] ------------------ 295| 30.9k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 30.9k| } 297| | 298| 7.74k| return Self(r); 299| 7.74k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1xEv: 1214| 7.00k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp256r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_: 267| 2.57k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 2.57k| std::array t; // NOLINT(*-member-init) 269| | 270| 2.57k| W carry = 0; 271| 12.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 10.3k, False: 2.57k] ------------------ 272| 10.3k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 10.3k| } 274| | 275| 2.57k| std::array r; // NOLINT(*-member-init) 276| 2.57k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 2.57k| return Self(r); 278| 2.57k| } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1yEv: 1219| 6.17k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 3.03k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 1.47k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 1.47k| const W mask = cond.into_bitmask(); 399| | 400| 7.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 5.88k, False: 1.47k] ------------------ 401| 5.88k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 5.88k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 5.88k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 5.88k| } 405| 1.47k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 176| for(;;) { 620| | // Conditional ok: this function is variable time 621| 176| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 175] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 175| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 175| std::array r; // NOLINT(*-member-init) 642| 175| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 175| if(carry == 0) { ------------------ | Branch (645:16): [True: 85, False: 90] ------------------ 646| | // b > a 647| 85| b.m_val = r; 648| 85| x = nx; 649| 85| Self::_invert_vartime_div2_helper(b, x); 650| 90| } else { 651| | // We know this can't underflow because a > b 652| 90| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 90| a.m_val = r; 654| 90| y = nx; 655| 90| Self::_invert_vartime_div2_helper(a, y); 656| 90| } 657| 175| } 658| 1| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 177| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 177| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 545| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 368, False: 177] ------------------ 554| 368| shift_right<1>(a.m_val); 555| | 556| 368| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 368| if(borrow) { ------------------ | Branch (559:16): [True: 129, False: 239] ------------------ 560| 129| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 129| } 562| 368| } 563| 177| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 10| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 8, False: 2] ------------------ 460| 8| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 8| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 1.56k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE8to_wordsEv: 736| 377| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 754| constexpr static std::array from_rep(const std::array& z) { 140| 754| std::array ze = {}; 141| 754| copy_mem(std::span{ze}.template first(), z); 142| 754| return Self::redc(ze); 143| 754| } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 170k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 170k| } else { 110| 170k| return monty_redc(z, P, P_dash); 111| 170k| } 112| 170k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 377| constexpr void serialize_to(std::span bytes) const { 742| 377| auto v = Rep::from_rep(m_val); 743| 377| std::reverse(v.begin(), v.end()); 744| | 745| 377| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 377| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 377| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 13.2k| static Self from_stash(const std::array& stash) { 777| 13.2k| static_assert(L >= N); 778| 13.2k| std::array val = {}; 779| 66.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 52.8k, False: 13.2k] ------------------ 780| 52.8k| val[i] = stash[i]; 781| 52.8k| } 782| 13.2k| return Self(val); 783| 13.2k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 89.1k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 5.17k| std::array stash_value() const { 762| 5.17k| static_assert(L >= N); 763| 5.17k| std::array stash = {}; 764| 25.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 20.6k, False: 5.17k] ------------------ 765| 20.6k| stash[i] = m_val[i]; 766| 20.6k| } 767| 5.17k| return stash; 768| 5.17k| } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm8EEE: 129| 386| constexpr static std::array wide_to_rep(const std::array& x) { 130| 386| auto redc_x = Self::redc(x); 131| 386| std::array z; // NOLINT(*-member-init) 132| 386| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 386| return Self::redc(z); 134| 386| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE7is_zeroEv: 227| 1.91k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 377| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 377| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 377] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 377| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 377| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 377] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 377| return Self::from_words(words); 809| 377| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 213| 377| static constexpr Self from_words(std::array w) { 214| 377| if constexpr(L == N) { 215| 377| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 377| } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 754| constexpr static std::array to_rep(const std::array& x) { 118| 754| std::array z; // NOLINT(*-member-init) 119| 754| comba_mul(z.data(), x.data(), R2.data()); 120| 754| return Self::redc(z); 121| 754| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 386| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 386| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 386] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 386| std::array padded_bytes = {}; 838| 386| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 386| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 386| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE3oneEv: 202| 193| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS3_22Secp256r1MontgomeryRepEE12ScalarParamsEE3oneEv: 101| 193| constexpr static std::array one() { return R1; } pcurves_secp256r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEESD_: 267| 60.9k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 60.9k| std::array t; // NOLINT(*-member-init) 269| | 270| 60.9k| W carry = 0; 271| 304k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 243k, False: 60.9k] ------------------ 272| 243k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 243k| } 274| | 275| 60.9k| std::array r; // NOLINT(*-member-init) 276| 60.9k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 60.9k| return Self(r); 278| 60.9k| } pcurves_secp256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEESD_: 283| 193| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 193| std::array r; // NOLINT(*-member-init) 285| 193| W carry = 0; 286| 965| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 772, False: 193] ------------------ 287| 772| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 772| } 289| | 290| 193| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 193| carry = 0; 293| | 294| 965| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 772, False: 193] ------------------ 295| 772| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 772| } 297| | 298| 193| return Self(r); 299| 193| } pcurves_secp256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEESD_: 348| 10.2k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 10.2k| std::array z; // NOLINT(*-member-init) 350| 10.2k| comba_mul(z.data(), a.data(), b.data()); 351| 10.2k| return Self(Rep::redc(z)); 352| 10.2k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE4dataEv: 898| 399k| constexpr const W* data() const { return m_val.data(); } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE6squareEv: 428| 1.89k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 1.89k| std::array z; // NOLINT(*-member-init) 430| 1.89k| comba_sqr(z.data(), this->data()); 431| 1.89k| return Self(Rep::redc(z)); 432| 1.89k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEmLERKSB_: 357| 15.8k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 15.8k| std::array z; // NOLINT(*-member-init) 359| 15.8k| comba_mul(z.data(), data(), other.data()); 360| 15.8k| m_val = Rep::redc(z); 361| 15.8k| return (*this); 362| 15.8k| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE8square_nEm: 441| 11.8k| constexpr void square_n(size_t n) { 442| 11.8k| std::array z; // NOLINT(*-member-init) 443| 152k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 140k, False: 11.8k] ------------------ 444| 140k| comba_sqr(z.data(), this->data()); 445| 140k| m_val = Rep::redc(z); 446| 140k| } 447| 11.8k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 377| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 377| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 377] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 377| auto x = Self(std::array{1}); // 1 in standard domain 607| 377| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 377| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 377| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 377| auto y = x; 615| | 616| | // First half of second loop iteration 617| 377| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 60.3k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 60.3k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 377, False: 59.9k] ------------------ 622| | // At this point it should be that a == b == 1 623| 377| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 377| r.m_val = Rep::to_rep(r.m_val); 627| 377| return r; 628| 377| } 629| | 630| 59.9k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 59.9k| std::array r; // NOLINT(*-member-init) 642| 59.9k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 59.9k| if(carry == 0) { ------------------ | Branch (645:16): [True: 20.2k, False: 39.7k] ------------------ 646| | // b > a 647| 20.2k| b.m_val = r; 648| 20.2k| x = nx; 649| 20.2k| Self::_invert_vartime_div2_helper(b, x); 650| 39.7k| } else { 651| | // We know this can't underflow because a > b 652| 39.7k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 39.7k| a.m_val = r; 654| 39.7k| y = nx; 655| 39.7k| Self::_invert_vartime_div2_helper(a, y); 656| 39.7k| } 657| 59.9k| } 658| 377| } pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 60.7k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 60.7k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 197k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 137k, False: 60.7k] ------------------ 554| 137k| shift_right<1>(a.m_val); 555| | 556| 137k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 137k| if(borrow) { ------------------ | Branch (559:16): [True: 68.1k, False: 69.0k] ------------------ 560| 68.1k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 68.1k| } 562| 137k| } 563| 60.7k| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEE6negateEv: 454| 947| constexpr Self negate() const { 455| 947| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 947| std::array r; // NOLINT(*-member-init) 458| 947| W carry = 0; 459| 4.73k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 3.78k, False: 947] ------------------ 460| 3.78k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 3.78k| } 462| | 463| 947| return Self(r); 464| 947| } pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS4_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEeqERKSB_: 724| 2.28k| constexpr CT::Choice operator==(const Self& other) const { 725| 2.28k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 2.28k| } pcurves_secp384r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 69.0k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 7| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 6, False: 1] ------------------ 416| 6| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 6| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 6| x.m_val[i] = nx; 419| 6| y.m_val[i] = ny; 420| 6| } 421| 1| } pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE7is_zeroEv: 227| 6.71k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 2.33k| m_x(x), m_y(y), m_z(z) {} pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.24k| constexpr Self dbl() const { 1182| 1.24k| if constexpr(Self::A_is_minus_3) { 1183| 1.24k| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 1.24k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1zEv: 1224| 20.4k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6squareEv: 428| 11.6k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 11.6k| std::array z; // NOLINT(*-member-init) 430| 11.6k| comba_sqr(z.data(), this->data()); 431| 11.6k| return Self(Rep::redc(z)); 432| 11.6k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4dataEv: 898| 76.6k| constexpr const W* data() const { return m_val.data(); } pcurves_secp384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 348| 32.1k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 32.1k| std::array z; // NOLINT(*-member-init) 350| 32.1k| comba_mul(z.data(), a.data(), b.data()); 351| 32.1k| return Self(Rep::redc(z)); 352| 32.1k| } pcurves_secp384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 283| 11.5k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 11.5k| std::array r; // NOLINT(*-member-init) 285| 11.5k| W carry = 0; 286| 80.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 69.2k, False: 11.5k] ------------------ 287| 69.2k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 69.2k| } 289| | 290| 11.5k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 11.5k| carry = 0; 293| | 294| 80.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 69.2k, False: 11.5k] ------------------ 295| 69.2k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 69.2k| } 297| | 298| 11.5k| return Self(r); 299| 11.5k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1xEv: 1214| 10.4k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul3Ev: 337| 1.24k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp384r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_: 267| 3.82k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 3.82k| std::array t; // NOLINT(*-member-init) 269| | 270| 3.82k| W carry = 0; 271| 26.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 22.9k, False: 3.82k] ------------------ 272| 22.9k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 22.9k| } 274| | 275| 3.82k| std::array r; // NOLINT(*-member-init) 276| 3.82k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 3.82k| return Self(r); 278| 3.82k| } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1yEv: 1219| 9.19k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul4Ev: 340| 1.24k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul2Ev: 327| 9.92k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 9.92k| std::array t = value(); 329| 9.92k| const W carry = shift_left<1>(t); 330| | 331| 9.92k| std::array r; // NOLINT(*-member-init) 332| 9.92k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 9.92k| return Self(r); 334| 9.92k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE5valueEv: 896| 9.92k| constexpr const std::array& value() const { return m_val; } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul8Ev: 343| 1.24k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EESE_: 1075| 1.09k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.09k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 4.52k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 2.19k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 2.19k| const W mask = cond.into_bitmask(); 399| | 400| 15.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 13.1k, False: 2.19k] ------------------ 401| 13.1k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 13.1k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 13.1k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 13.1k| } 405| 2.19k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 252| for(;;) { 620| | // Conditional ok: this function is variable time 621| 252| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 251] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 251| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 251| std::array r; // NOLINT(*-member-init) 642| 251| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 251| if(carry == 0) { ------------------ | Branch (645:16): [True: 118, False: 133] ------------------ 646| | // b > a 647| 118| b.m_val = r; 648| 118| x = nx; 649| 118| Self::_invert_vartime_div2_helper(b, x); 650| 133| } else { 651| | // We know this can't underflow because a > b 652| 133| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 133| a.m_val = r; 654| 133| y = nx; 655| 133| Self::_invert_vartime_div2_helper(a, y); 656| 133| } 657| 251| } 658| 1| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 253| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 253| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 809| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 556, False: 253] ------------------ 554| 556| shift_right<1>(a.m_val); 555| | 556| 556| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 556| if(borrow) { ------------------ | Branch (559:16): [True: 248, False: 308] ------------------ 560| 248| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 248| } 562| 556| } 563| 253| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 14| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 12, False: 2] ------------------ 460| 12| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 12| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 2.33k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE8to_wordsEv: 736| 326| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm6EEE: 139| 652| constexpr static std::array from_rep(const std::array& z) { 140| 652| std::array ze = {}; 141| 652| copy_mem(std::span{ze}.template first(), z); 142| 652| return Self::redc(ze); 143| 652| } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm12EEE: 106| 215k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 215k| } else { 110| 215k| return monty_redc(z, P, P_dash); 111| 215k| } 112| 215k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm48EEE: 741| 326| constexpr void serialize_to(std::span bytes) const { 742| 326| auto v = Rep::from_rep(m_val); 743| 326| std::reverse(v.begin(), v.end()); 744| | 745| 326| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 326| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 326| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 11.4k| static Self from_stash(const std::array& stash) { 777| 11.4k| static_assert(L >= N); 778| 11.4k| std::array val = {}; 779| 79.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 68.5k, False: 11.4k] ------------------ 780| 68.5k| val[i] = stash[i]; 781| 68.5k| } 782| 11.4k| return Self(val); 783| 11.4k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm6EEE: 908| 102k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 4.47k| std::array stash_value() const { 762| 4.47k| static_assert(L >= N); 763| 4.47k| std::array stash = {}; 764| 31.3k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 26.8k, False: 4.47k] ------------------ 765| 26.8k| stash[i] = m_val[i]; 766| 26.8k| } 767| 4.47k| return stash; 768| 4.47k| } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm12EEE: 129| 334| constexpr static std::array wide_to_rep(const std::array& x) { 130| 334| auto redc_x = Self::redc(x); 131| 334| std::array z; // NOLINT(*-member-init) 132| 334| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 334| return Self::redc(z); 134| 334| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE7is_zeroEv: 227| 1.65k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 326| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 326| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 326] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 326| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 326| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 326] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 326| return Self::from_words(words); 809| 326| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE10from_wordsILm6EEESB_NSt3__15arrayImXT_EEE: 213| 326| static constexpr Self from_words(std::array w) { 214| 326| if constexpr(L == N) { 215| 326| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 326| } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm6EEE: 117| 652| constexpr static std::array to_rep(const std::array& x) { 118| 652| std::array z; // NOLINT(*-member-init) 119| 652| comba_mul(z.data(), x.data(), R2.data()); 120| 652| return Self::redc(z); 121| 652| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 334| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 334| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 334] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 334| std::array padded_bytes = {}; 838| 334| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 334| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 334| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE3oneEv: 202| 167| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp384r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS3_12Secp384r1RepEE12ScalarParamsEE3oneEv: 101| 167| constexpr static std::array one() { return R1; } pcurves_secp384r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEESD_: 267| 80.8k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 80.8k| std::array t; // NOLINT(*-member-init) 269| | 270| 80.8k| W carry = 0; 271| 565k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 484k, False: 80.8k] ------------------ 272| 484k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 484k| } 274| | 275| 80.8k| std::array r; // NOLINT(*-member-init) 276| 80.8k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 80.8k| return Self(r); 278| 80.8k| } pcurves_secp384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEESD_: 283| 167| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 167| std::array r; // NOLINT(*-member-init) 285| 167| W carry = 0; 286| 1.16k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 1.00k, False: 167] ------------------ 287| 1.00k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 1.00k| } 289| | 290| 167| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 167| carry = 0; 293| | 294| 1.16k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 1.00k, False: 167] ------------------ 295| 1.00k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 1.00k| } 297| | 298| 167| return Self(r); 299| 167| } pcurves_secp384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEESD_: 348| 4.42k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 4.42k| std::array z; // NOLINT(*-member-init) 350| 4.42k| comba_mul(z.data(), a.data(), b.data()); 351| 4.42k| return Self(Rep::redc(z)); 352| 4.42k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE4dataEv: 898| 506k| constexpr const W* data() const { return m_val.data(); } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE6squareEv: 428| 3.10k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 3.10k| std::array z; // NOLINT(*-member-init) 430| 3.10k| comba_sqr(z.data(), this->data()); 431| 3.10k| return Self(Rep::redc(z)); 432| 3.10k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEmLERKSB_: 357| 22.9k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 22.9k| std::array z; // NOLINT(*-member-init) 359| 22.9k| comba_mul(z.data(), data(), other.data()); 360| 22.9k| m_val = Rep::redc(z); 361| 22.9k| return (*this); 362| 22.9k| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE8square_nEm: 441| 21.0k| constexpr void square_n(size_t n) { 442| 21.0k| std::array z; // NOLINT(*-member-init) 443| 204k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 183k, False: 21.0k] ------------------ 444| 183k| comba_sqr(z.data(), this->data()); 445| 183k| m_val = Rep::redc(z); 446| 183k| } 447| 21.0k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 326| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 326| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 326] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 326| auto x = Self(std::array{1}); // 1 in standard domain 607| 326| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 326| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 326| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 326| auto y = x; 615| | 616| | // First half of second loop iteration 617| 326| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 80.3k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 80.3k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 326, False: 79.9k] ------------------ 622| | // At this point it should be that a == b == 1 623| 326| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 326| r.m_val = Rep::to_rep(r.m_val); 627| 326| return r; 628| 326| } 629| | 630| 79.9k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 79.9k| std::array r; // NOLINT(*-member-init) 642| 79.9k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 79.9k| if(carry == 0) { ------------------ | Branch (645:16): [True: 29.9k, False: 50.0k] ------------------ 646| | // b > a 647| 29.9k| b.m_val = r; 648| 29.9k| x = nx; 649| 29.9k| Self::_invert_vartime_div2_helper(b, x); 650| 50.0k| } else { 651| | // We know this can't underflow because a > b 652| 50.0k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 50.0k| a.m_val = r; 654| 50.0k| y = nx; 655| 50.0k| Self::_invert_vartime_div2_helper(a, y); 656| 50.0k| } 657| 79.9k| } 658| 326| } pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 80.6k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 80.6k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 255k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 174k, False: 80.6k] ------------------ 554| 174k| shift_right<1>(a.m_val); 555| | 556| 174k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 174k| if(borrow) { ------------------ | Branch (559:16): [True: 88.0k, False: 86.8k] ------------------ 560| 88.0k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 88.0k| } 562| 174k| } 563| 80.6k| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEE6negateEv: 454| 819| constexpr Self negate() const { 455| 819| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 819| std::array r; // NOLINT(*-member-init) 458| 819| W carry = 0; 459| 5.73k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 4.91k, False: 819] ------------------ 460| 4.91k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 4.91k| } 462| | 463| 819| return Self(r); 464| 819| } pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS4_12Secp384r1RepEE12ScalarParamsEEEEeqERKSB_: 724| 1.97k| constexpr CT::Choice operator==(const Self& other) const { 725| 1.97k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 1.97k| } pcurves_secp521r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm9EEE: 908| 91.8k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 10| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 9, False: 1] ------------------ 416| 9| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 9| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 9| x.m_val[i] = nx; 419| 9| y.m_val[i] = ny; 420| 9| } 421| 1| } pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 8.92k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 3.10k| m_x(x), m_y(y), m_z(z) {} pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 1.64k| constexpr Self dbl() const { 1182| 1.64k| if constexpr(Self::A_is_minus_3) { 1183| 1.64k| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 1.64k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 27.1k| constexpr const FieldElement& z() const { return m_z; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 15.5k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 15.5k| std::array z; // NOLINT(*-member-init) 430| 15.5k| comba_sqr(z.data(), this->data()); 431| 15.5k| return Self(Rep::redc(z)); 432| 15.5k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 101k| constexpr const W* data() const { return m_val.data(); } pcurves_secp521r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 42.6k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 42.6k| std::array z; // NOLINT(*-member-init) 350| 42.6k| comba_mul(z.data(), a.data(), b.data()); 351| 42.6k| return Self(Rep::redc(z)); 352| 42.6k| } pcurves_secp521r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 15.3k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 15.3k| std::array r; // NOLINT(*-member-init) 285| 15.3k| W carry = 0; 286| 153k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 137k, False: 15.3k] ------------------ 287| 137k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 137k| } 289| | 290| 15.3k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 15.3k| carry = 0; 293| | 294| 153k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 137k, False: 15.3k] ------------------ 295| 137k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 137k| } 297| | 298| 15.3k| return Self(r); 299| 15.3k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 13.8k| constexpr const FieldElement& x() const { return m_x; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 1.64k| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_secp521r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 5.10k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 5.10k| std::array t; // NOLINT(*-member-init) 269| | 270| 5.10k| W carry = 0; 271| 51.0k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 45.9k, False: 5.10k] ------------------ 272| 45.9k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 45.9k| } 274| | 275| 5.10k| std::array r; // NOLINT(*-member-init) 276| 5.10k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 5.10k| return Self(r); 278| 5.10k| } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 12.2k| constexpr const FieldElement& y() const { return m_y; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 1.64k| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 13.1k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 13.1k| std::array t = value(); 329| 13.1k| const W carry = shift_left<1>(t); 330| | 331| 13.1k| std::array r; // NOLINT(*-member-init) 332| 13.1k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 13.1k| return Self(r); 334| 13.1k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 13.1k| constexpr const std::array& value() const { return m_val; } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 1.64k| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_secp521r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 1.45k| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 1.45k| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 6.01k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 2.91k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 2.91k| const W mask = cond.into_bitmask(); 399| | 400| 29.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 26.1k, False: 2.91k] ------------------ 401| 26.1k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 26.1k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 26.1k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 26.1k| } 405| 2.91k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 350| for(;;) { 620| | // Conditional ok: this function is variable time 621| 350| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 349] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 349| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 349| std::array r; // NOLINT(*-member-init) 642| 349| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 349| if(carry == 0) { ------------------ | Branch (645:16): [True: 170, False: 179] ------------------ 646| | // b > a 647| 170| b.m_val = r; 648| 170| x = nx; 649| 170| Self::_invert_vartime_div2_helper(b, x); 650| 179| } else { 651| | // We know this can't underflow because a > b 652| 179| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 179| a.m_val = r; 654| 179| y = nx; 655| 179| Self::_invert_vartime_div2_helper(a, y); 656| 179| } 657| 349| } 658| 1| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 351| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 351| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 1.09k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 742, False: 351] ------------------ 554| 742| shift_right<1>(a.m_val); 555| | 556| 742| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 742| if(borrow) { ------------------ | Branch (559:16): [True: 109, False: 633] ------------------ 560| 109| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 109| } 562| 742| } 563| 351| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 20| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 18, False: 2] ------------------ 460| 18| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 18| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 3.10k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE8to_wordsEv: 736| 298| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm9EEE: 139| 596| constexpr static std::array from_rep(const std::array& z) { 140| 596| std::array ze = {}; 141| 596| copy_mem(std::span{ze}.template first(), z); 142| 596| return Self::redc(ze); 143| 596| } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm18EEE: 106| 262k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 262k| } else { 110| 262k| return monty_redc(z, P, P_dash); 111| 262k| } 112| 262k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm66EEE: 741| 298| constexpr void serialize_to(std::span bytes) const { 742| 298| auto v = Rep::from_rep(m_val); 743| 298| std::reverse(v.begin(), v.end()); 744| | 745| | if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| | store_be(bytes, v); 747| 298| } else { 748| | // Remove leading zero bytes 749| 298| const auto padded_bytes = store_be(v); 750| 298| constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| 298| copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| 298| } 753| 298| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 10.4k| static Self from_stash(const std::array& stash) { 777| 10.4k| static_assert(L >= N); 778| 10.4k| std::array val = {}; 779| 104k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 94.4k, False: 10.4k] ------------------ 780| 94.4k| val[i] = stash[i]; 781| 94.4k| } 782| 10.4k| return Self(val); 783| 10.4k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm9EEE: 908| 123k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 4.11k| std::array stash_value() const { 762| 4.11k| static_assert(L >= N); 763| 4.11k| std::array stash = {}; 764| 41.1k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 36.9k, False: 4.11k] ------------------ 765| 36.9k| stash[i] = m_val[i]; 766| 36.9k| } 767| 4.11k| return stash; 768| 4.11k| } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm18EEE: 129| 308| constexpr static std::array wide_to_rep(const std::array& x) { 130| 308| auto redc_x = Self::redc(x); 131| 308| std::array z; // NOLINT(*-member-init) 132| 308| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 308| return Self::redc(z); 134| 308| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE7is_zeroEv: 227| 1.52k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 298| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 298| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 298] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 298| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 298| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 298] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 298| return Self::from_words(words); 809| 298| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE10from_wordsILm9EEESB_NSt3__15arrayImXT_EEE: 213| 298| static constexpr Self from_words(std::array w) { 214| 298| if constexpr(L == N) { 215| 298| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 298| } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm9EEE: 117| 596| constexpr static std::array to_rep(const std::array& x) { 118| 596| std::array z; // NOLINT(*-member-init) 119| 596| comba_mul(z.data(), x.data(), R2.data()); 120| 596| return Self::redc(z); 121| 596| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 308| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 308| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 308] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 308| std::array padded_bytes = {}; 838| 308| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 308| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 308| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE3oneEv: 202| 154| static constexpr Self one() { return Self(Rep::one()); } pcurves_secp521r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS4_7P521RepEE12ScalarParamsEE3oneEv: 101| 154| constexpr static std::array one() { return R1; } pcurves_secp521r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEESD_: 267| 99.5k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 99.5k| std::array t; // NOLINT(*-member-init) 269| | 270| 99.5k| W carry = 0; 271| 995k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 896k, False: 99.5k] ------------------ 272| 896k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 896k| } 274| | 275| 99.5k| std::array r; // NOLINT(*-member-init) 276| 99.5k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 99.5k| return Self(r); 278| 99.5k| } pcurves_secp521r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEESD_: 283| 154| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 154| std::array r; // NOLINT(*-member-init) 285| 154| W carry = 0; 286| 1.54k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 1.38k, False: 154] ------------------ 287| 1.38k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 1.38k| } 289| | 290| 154| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 154| carry = 0; 293| | 294| 1.54k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 1.38k, False: 154] ------------------ 295| 1.38k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 1.38k| } 297| | 298| 154| return Self(r); 299| 154| } pcurves_secp521r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEESD_: 348| 10.2k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 10.2k| std::array z; // NOLINT(*-member-init) 350| 10.2k| comba_mul(z.data(), a.data(), b.data()); 351| 10.2k| return Self(Rep::redc(z)); 352| 10.2k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE4dataEv: 898| 621k| constexpr const W* data() const { return m_val.data(); } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE6squareEv: 428| 1.04k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 1.04k| std::array z; // NOLINT(*-member-init) 430| 1.04k| comba_sqr(z.data(), this->data()); 431| 1.04k| return Self(Rep::redc(z)); 432| 1.04k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEmLERKSB_: 357| 20.9k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 20.9k| std::array z; // NOLINT(*-member-init) 359| 20.9k| comba_mul(z.data(), data(), other.data()); 360| 20.9k| m_val = Rep::redc(z); 361| 20.9k| return (*this); 362| 20.9k| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE8square_nEm: 441| 19.5k| constexpr void square_n(size_t n) { 442| 19.5k| std::array z; // NOLINT(*-member-init) 443| 248k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 228k, False: 19.5k] ------------------ 444| 228k| comba_sqr(z.data(), this->data()); 445| 228k| m_val = Rep::redc(z); 446| 228k| } 447| 19.5k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 298| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 298| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 298] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 298| auto x = Self(std::array{1}); // 1 in standard domain 607| 298| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 298| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 298| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 298| auto y = x; 615| | 616| | // First half of second loop iteration 617| 298| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 99.0k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 99.0k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 298, False: 98.7k] ------------------ 622| | // At this point it should be that a == b == 1 623| 298| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 298| r.m_val = Rep::to_rep(r.m_val); 627| 298| return r; 628| 298| } 629| | 630| 98.7k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 98.7k| std::array r; // NOLINT(*-member-init) 642| 98.7k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 98.7k| if(carry == 0) { ------------------ | Branch (645:16): [True: 35.0k, False: 63.7k] ------------------ 646| | // b > a 647| 35.0k| b.m_val = r; 648| 35.0k| x = nx; 649| 35.0k| Self::_invert_vartime_div2_helper(b, x); 650| 63.7k| } else { 651| | // We know this can't underflow because a > b 652| 63.7k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 63.7k| a.m_val = r; 654| 63.7k| y = nx; 655| 63.7k| Self::_invert_vartime_div2_helper(a, y); 656| 63.7k| } 657| 98.7k| } 658| 298| } pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 99.3k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 99.3k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 317k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 217k, False: 99.3k] ------------------ 554| 217k| shift_right<1>(a.m_val); 555| | 556| 217k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 217k| if(borrow) { ------------------ | Branch (559:16): [True: 111k, False: 106k] ------------------ 560| 111k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 111k| } 562| 217k| } 563| 99.3k| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEE6negateEv: 454| 750| constexpr Self negate() const { 455| 750| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 750| std::array r; // NOLINT(*-member-init) 458| 750| W carry = 0; 459| 7.50k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 6.75k, False: 750] ------------------ 460| 6.75k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 6.75k| } 462| | 463| 750| return Self(r); 464| 750| } pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS5_7P521RepEE12ScalarParamsEEEEeqERKSB_: 724| 1.81k| constexpr CT::Choice operator==(const Self& other) const { 725| 1.81k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 1.81k| } pcurves_sm2p256v1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19sm2p256v15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_22Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE: 1630| 1| m_table(basemul_booth_setup(p, BlindedScalar::Bits + 1)) {} pcurves_sm2p256v1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE: 1027| 1| static constexpr Self from_affine(const AffinePoint& pt) { 1028| | /* 1029| | * If the point is the identity element (x=0, y=0) then instead of 1030| | * creating (x, y, 1) = (0, 0, 1) we want our projective identity 1031| | * encoding of (0, 1, 0) 1032| | * 1033| | * Which we can achieve by a conditional swap of y and z if the 1034| | * affine point is the identity. 1035| | */ 1036| | 1037| 1| const auto x = pt.x(); 1038| 1| auto y = pt.y(); 1039| 1| auto z = FieldElement::one(); 1040| | 1041| 1| FieldElement::conditional_swap(pt.is_identity(), y, z); 1042| | 1043| 1| return ProjectiveCurvePoint(x, y, z); 1044| 1| } pcurves_sm2p256v1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv: 982| 2| constexpr const FieldElement& x() const { return m_x; } pcurves_sm2p256v1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv: 987| 2| constexpr const FieldElement& y() const { return m_y; } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv: 202| 1| static constexpr Self one() { return Self(Rep::one()); } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 46.3k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_: 412| 1| static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) { 413| 1| const W mask = cond.into_bitmask(); 414| | 415| 5| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (415:28): [True: 4, False: 1] ------------------ 416| 4| const auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]); 417| 4| const auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]); 418| 4| x.m_val[i] = nx; 419| 4| y.m_val[i] = ny; 420| 4| } 421| 1| } pcurves_sm2p256v1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv: 939| 1| constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv: 227| 4.51k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_sm2p256v1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_: 1067| 1.56k| m_x(x), m_y(y), m_z(z) {} pcurves_sm2p256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv: 1181| 833| constexpr Self dbl() const { 1182| 833| if constexpr(Self::A_is_minus_3) { 1183| 833| return dbl_a_minus_3(*this); 1184| | } else if constexpr(Self::A_is_zero) { 1185| | return dbl_a_zero(*this); 1186| | } else { 1187| | return dbl_generic(*this, A); 1188| | } 1189| 833| } pcurves_sm2p256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv: 1224| 13.7k| constexpr const FieldElement& z() const { return m_z; } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv: 428| 7.84k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 7.84k| std::array z; // NOLINT(*-member-init) 430| 7.84k| comba_sqr(z.data(), this->data()); 431| 7.84k| return Self(Rep::redc(z)); 432| 7.84k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv: 898| 51.5k| constexpr const W* data() const { return m_val.data(); } pcurves_sm2p256v1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 348| 21.5k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 21.5k| std::array z; // NOLINT(*-member-init) 350| 21.5k| comba_mul(z.data(), a.data(), b.data()); 351| 21.5k| return Self(Rep::redc(z)); 352| 21.5k| } pcurves_sm2p256v1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 283| 7.74k| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 7.74k| std::array r; // NOLINT(*-member-init) 285| 7.74k| W carry = 0; 286| 38.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 30.9k, False: 7.74k] ------------------ 287| 30.9k| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 30.9k| } 289| | 290| 7.74k| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 7.74k| carry = 0; 293| | 294| 38.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 30.9k, False: 7.74k] ------------------ 295| 30.9k| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 30.9k| } 297| | 298| 7.74k| return Self(r); 299| 7.74k| } pcurves_sm2p256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv: 1214| 7.00k| constexpr const FieldElement& x() const { return m_x; } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev: 337| 833| constexpr inline Self mul3() const { return mul2() + (*this); } pcurves_sm2p256v1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_: 267| 2.58k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 2.58k| std::array t; // NOLINT(*-member-init) 269| | 270| 2.58k| W carry = 0; 271| 12.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 10.3k, False: 2.58k] ------------------ 272| 10.3k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 10.3k| } 274| | 275| 2.58k| std::array r; // NOLINT(*-member-init) 276| 2.58k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 2.58k| return Self(r); 278| 2.58k| } pcurves_sm2p256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv: 1219| 6.17k| constexpr const FieldElement& y() const { return m_y; } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev: 340| 833| constexpr inline Self mul4() const { return mul2().mul2(); } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev: 327| 6.66k| constexpr BOTAN_FORCE_INLINE Self mul2() const { 328| 6.66k| std::array t = value(); 329| 6.66k| const W carry = shift_left<1>(t); 330| | 331| 6.66k| std::array r; // NOLINT(*-member-init) 332| 6.66k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 333| 6.66k| return Self(r); 334| 6.66k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv: 896| 6.66k| constexpr const std::array& value() const { return m_val; } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev: 343| 833| constexpr inline Self mul8() const { return mul2().mul2().mul2(); } pcurves_sm2p256v1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_: 1075| 735| friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); } pcurves_sm2p256v1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_: 1138| 735| constexpr static Self add(const Self& a, const Self& b) { return point_add(a, b); } pcurves_sm2p256v1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv: 1093| 3.03k| constexpr CT::Choice is_identity() const { return z().is_zero(); } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_: 397| 1.47k| Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) { 398| 1.47k| const W mask = cond.into_bitmask(); 399| | 400| 7.35k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (400:28): [True: 5.88k, False: 1.47k] ------------------ 401| 5.88k| x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]); 402| 5.88k| y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]); 403| 5.88k| z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]); 404| 5.88k| } 405| 1.47k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv: 600| 1| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 1| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 1] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 1| auto x = Self(std::array{1}); // 1 in standard domain 607| 1| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 1| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 1| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 1| auto y = x; 615| | 616| | // First half of second loop iteration 617| 1| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 184| for(;;) { 620| | // Conditional ok: this function is variable time 621| 184| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 1, False: 183] ------------------ 622| | // At this point it should be that a == b == 1 623| 1| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 1| r.m_val = Rep::to_rep(r.m_val); 627| 1| return r; 628| 1| } 629| | 630| 183| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 183| std::array r; // NOLINT(*-member-init) 642| 183| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 183| if(carry == 0) { ------------------ | Branch (645:16): [True: 87, False: 96] ------------------ 646| | // b > a 647| 87| b.m_val = r; 648| 87| x = nx; 649| 87| Self::_invert_vartime_div2_helper(b, x); 650| 96| } else { 651| | // We know this can't underflow because a > b 652| 96| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 96| a.m_val = r; 654| 96| y = nx; 655| 96| Self::_invert_vartime_div2_helper(a, y); 656| 96| } 657| 183| } 658| 1| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv: 736| 1| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_: 549| 185| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 185| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 545| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 360, False: 185] ------------------ 554| 360| shift_right<1>(a.m_val); 555| | 556| 360| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 360| if(borrow) { ------------------ | Branch (559:16): [True: 162, False: 198] ------------------ 560| 162| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 162| } 562| 360| } 563| 185| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv: 454| 2| constexpr Self negate() const { 455| 2| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 2| std::array r; // NOLINT(*-member-init) 458| 2| W carry = 0; 459| 10| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 8, False: 2] ------------------ 460| 8| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 8| } 462| | 463| 2| return Self(r); 464| 2| } pcurves_sm2p256v1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_: 928| 1.56k| constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {} pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE8to_wordsEv: 736| 289| constexpr std::array to_words() const { return Rep::from_rep(m_val); } pcurves_sm2p256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS4_22Sm2p256v1MontgomeryRepEE12ScalarParamsEE8from_repERKNSt3__15arrayImLm4EEE: 139| 578| constexpr static std::array from_rep(const std::array& z) { 140| 578| std::array ze = {}; 141| 578| copy_mem(std::span{ze}.template first(), z); 142| 578| return Self::redc(ze); 143| 578| } pcurves_sm2p256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS4_22Sm2p256v1MontgomeryRepEE12ScalarParamsEE4redcERKNSt3__15arrayImLm8EEE: 106| 145k| constexpr static std::array redc(const std::array& z) { 107| | if constexpr(P_dash == 1) { 108| | return monty_redc_pdash1(z, P); 109| 145k| } else { 110| 145k| return monty_redc(z, P, P_dash); 111| 145k| } 112| 145k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE12serialize_toENSt3__14spanIhLm32EEE: 741| 289| constexpr void serialize_to(std::span bytes) const { 742| 289| auto v = Rep::from_rep(m_val); 743| 289| std::reverse(v.begin(), v.end()); 744| | 745| 289| if constexpr(Self::BYTES == N * WordInfo::bytes) { 746| 289| store_be(bytes, v); 747| | } else { 748| | // Remove leading zero bytes 749| | const auto padded_bytes = store_be(v); 750| | constexpr size_t extra = N * WordInfo::bytes - Self::BYTES; 751| | copy_mem(bytes, std::span{padded_bytes}.template subspan()); 752| | } 753| 289| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE10from_stashILm9EEESB_RKNSt3__15arrayImXT_EEE: 776| 10.1k| static Self from_stash(const std::array& stash) { 777| 10.1k| static_assert(L >= N); 778| 10.1k| std::array val = {}; 779| 50.8k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (779:28): [True: 40.6k, False: 10.1k] ------------------ 780| 40.6k| val[i] = stash[i]; 781| 40.6k| } 782| 10.1k| return Self(val); 783| 10.1k| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEC2ENSt3__15arrayImLm4EEE: 908| 66.2k| explicit constexpr IntMod(std::array v) : m_val(v) {} pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv: 761| 3.98k| std::array stash_value() const { 762| 3.98k| static_assert(L >= N); 763| 3.98k| std::array stash = {}; 764| 19.9k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (764:28): [True: 15.9k, False: 3.98k] ------------------ 765| 15.9k| stash[i] = m_val[i]; 766| 15.9k| } 767| 3.98k| return stash; 768| 3.98k| } pcurves_sm2p256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS4_22Sm2p256v1MontgomeryRepEE12ScalarParamsEE11wide_to_repERKNSt3__15arrayImLm8EEE: 129| 298| constexpr static std::array wide_to_rep(const std::array& x) { 130| 298| auto redc_x = Self::redc(x); 131| 298| std::array z; // NOLINT(*-member-init) 132| 298| comba_mul(z.data(), redc_x.data(), R3.data()); 133| 298| return Self::redc(z); 134| 298| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE7is_zeroEv: 227| 1.47k| constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE: 794| 289| static std::optional deserialize(std::span bytes) { 795| | // Conditional ok: input length is public 796| 289| if(bytes.size() != Self::BYTES) { ------------------ | Branch (796:13): [True: 0, False: 289] ------------------ 797| 0| return {}; 798| 0| } 799| | 800| 289| const auto words = bytes_to_words(bytes.first()); 801| | 802| | // Conditional acceptable: std::optional is implicitly not constant time 803| 289| if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) { ------------------ | Branch (803:13): [True: 0, False: 289] ------------------ 804| 0| return {}; 805| 0| } 806| | 807| | // Safe because we checked above that words is an integer < P 808| 289| return Self::from_words(words); 809| 289| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE10from_wordsILm4EEESB_NSt3__15arrayImXT_EEE: 213| 289| static constexpr Self from_words(std::array w) { 214| 289| if constexpr(L == N) { 215| 289| return Self(Rep::to_rep(w)); 216| | } else { 217| | static_assert(L < N); 218| | std::array ew = {}; 219| | copy_mem(std::span{ew}.template first(), w); 220| | return Self(Rep::to_rep(ew)); 221| | } 222| 289| } pcurves_sm2p256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS4_22Sm2p256v1MontgomeryRepEE12ScalarParamsEE6to_repERKNSt3__15arrayImLm4EEE: 117| 578| constexpr static std::array to_rep(const std::array& x) { 118| 578| std::array z; // NOLINT(*-member-init) 119| 578| comba_mul(z.data(), x.data(), R2.data()); 120| 578| return Self::redc(z); 121| 578| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE22from_wide_bytes_varlenENSt3__14spanIKhLm18446744073709551615EEE: 831| 298| static constexpr std::optional from_wide_bytes_varlen(std::span bytes) { 832| | // Conditional ok: input length is public 833| 298| if(bytes.size() > 2 * Self::BYTES) { ------------------ | Branch (833:13): [True: 0, False: 298] ------------------ 834| 0| return {}; 835| 0| } 836| | 837| 298| std::array padded_bytes = {}; 838| 298| copy_mem(std::span{padded_bytes}.last(bytes.size()), bytes); 839| 298| return Self(Rep::wide_to_rep(bytes_to_words(std::span{padded_bytes}))); 840| 298| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE3oneEv: 202| 584| static constexpr Self one() { return Self(Rep::one()); } pcurves_sm2p256v1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS4_22Sm2p256v1MontgomeryRepEE12ScalarParamsEE3oneEv: 101| 584| constexpr static std::array one() { return R1; } pcurves_sm2p256v1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEESD_: 267| 45.8k| friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) { 268| 45.8k| std::array t; // NOLINT(*-member-init) 269| | 270| 45.8k| W carry = 0; 271| 229k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (271:28): [True: 183k, False: 45.8k] ------------------ 272| 183k| t[i] = word_add(a.m_val[i], b.m_val[i], &carry); 273| 183k| } 274| | 275| 45.8k| std::array r; // NOLINT(*-member-init) 276| 45.8k| bigint_monty_maybe_sub(r.data(), carry, t.data(), P.data()); 277| 45.8k| return Self(r); 278| 45.8k| } pcurves_sm2p256v1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEESD_: 283| 149| friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) { 284| 149| std::array r; // NOLINT(*-member-init) 285| 149| W carry = 0; 286| 745| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (286:28): [True: 596, False: 149] ------------------ 287| 596| r[i] = word_sub(a.m_val[i], b.m_val[i], &carry); 288| 596| } 289| | 290| 149| const auto mask = CT::Mask::expand(carry).value(); 291| | 292| 149| carry = 0; 293| | 294| 745| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (294:28): [True: 596, False: 149] ------------------ 295| 596| r[i] = word_add(r[i], P[i] & mask, &carry); 296| 596| } 297| | 298| 149| return Self(r); 299| 149| } pcurves_sm2p256v1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEESD_: 348| 4.37k| friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) { 349| 4.37k| std::array z; // NOLINT(*-member-init) 350| 4.37k| comba_mul(z.data(), a.data(), b.data()); 351| 4.37k| return Self(Rep::redc(z)); 352| 4.37k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE4dataEv: 898| 331k| constexpr const W* data() const { return m_val.data(); } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE6squareEv: 428| 3.19k| constexpr BOTAN_FORCE_INLINE Self square() const { 429| 3.19k| std::array z; // NOLINT(*-member-init) 430| 3.19k| comba_sqr(z.data(), this->data()); 431| 3.19k| return Self(Rep::redc(z)); 432| 3.19k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE6invertEv: 540| 435| constexpr Self invert() const { return pow_vartime(Self::P_MINUS_2); } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE: 479| 435| constexpr Self pow_vartime(const std::array& exp) const { 480| 435| constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5; ------------------ | Branch (480:40): [True: 0, Folded] ------------------ 481| 435| constexpr size_t WindowElements = (1 << WindowBits) - 1; 482| | 483| 435| constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits; 484| | 485| | /* 486| | A simple fixed width window modular multiplication. 487| | 488| | TODO: investigate using sliding window here 489| | */ 490| | 491| 435| std::array tbl; 492| | 493| 435| tbl[0] = (*this); 494| | 495| 6.52k| for(size_t i = 1; i != WindowElements; ++i) { ------------------ | Branch (495:28): [True: 6.09k, False: 435] ------------------ 496| | // Conditional ok: table indexes are public here 497| 6.09k| if(i % 2 == 1) { ------------------ | Branch (497:16): [True: 3.04k, False: 3.04k] ------------------ 498| 3.04k| tbl[i] = tbl[i / 2].square(); 499| 3.04k| } else { 500| 3.04k| tbl[i] = tbl[i - 1] * tbl[0]; 501| 3.04k| } 502| 6.09k| } 503| | 504| 435| auto r = Self::one(); 505| | 506| 435| const size_t w0 = read_window_bits(std::span{exp}, (Windows - 1) * WindowBits); 507| | 508| | // Conditional ok: this function is variable time 509| 435| if(w0 > 0) { ------------------ | Branch (509:13): [True: 435, False: 0] ------------------ 510| 435| r = tbl[w0 - 1]; 511| 435| } 512| | 513| 27.8k| for(size_t i = 1; i != Windows; ++i) { ------------------ | Branch (513:28): [True: 27.4k, False: 435] ------------------ 514| 27.4k| r.square_n(WindowBits); 515| | 516| 27.4k| const size_t w = read_window_bits(std::span{exp}, (Windows - i - 1) * WindowBits); 517| | 518| | // Conditional ok: this function is variable time 519| 27.4k| if(w > 0) { ------------------ | Branch (519:16): [True: 26.1k, False: 1.30k] ------------------ 520| 26.1k| r *= tbl[w - 1]; 521| 26.1k| } 522| 27.4k| } 523| | 524| 435| return r; 525| 435| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEC2Ev: 182| 6.52k| constexpr IntMod() : m_val({}) {} pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE8square_nEm: 441| 27.4k| constexpr void square_n(size_t n) { 442| 27.4k| std::array z; // NOLINT(*-member-init) 443| 137k| for(size_t i = 0; i != n; ++i) { ------------------ | Branch (443:28): [True: 109k, False: 27.4k] ------------------ 444| 109k| comba_sqr(z.data(), this->data()); 445| 109k| m_val = Rep::redc(z); 446| 109k| } 447| 27.4k| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEmLERKSB_: 357| 26.1k| constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) { 358| 26.1k| std::array z; // NOLINT(*-member-init) 359| 26.1k| comba_mul(z.data(), data(), other.data()); 360| 26.1k| m_val = Rep::redc(z); 361| 26.1k| return (*this); 362| 26.1k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE14invert_vartimeEv: 600| 289| constexpr Self invert_vartime() const { 601| | // Conditional ok: this function is variable time 602| 289| if(this->is_zero().as_bool()) { ------------------ | Branch (602:13): [True: 0, False: 289] ------------------ 603| 0| return Self::zero(); 604| 0| } 605| | 606| 289| auto x = Self(std::array{1}); // 1 in standard domain 607| 289| auto b = Self(this->to_words()); // *this in standard domain 608| | 609| | // First loop iteration 610| 289| Self::_invert_vartime_div2_helper(b, x); 611| | 612| 289| auto a = b.negate(); 613| | // y += x but y is zero at the outset 614| 289| auto y = x; 615| | 616| | // First half of second loop iteration 617| 289| Self::_invert_vartime_div2_helper(a, y); 618| | 619| 45.4k| for(;;) { 620| | // Conditional ok: this function is variable time 621| 45.4k| if(a.m_val == b.m_val) { ------------------ | Branch (621:16): [True: 289, False: 45.1k] ------------------ 622| | // At this point it should be that a == b == 1 623| 289| auto r = y.negate(); 624| | 625| | // Convert back to Montgomery if required 626| 289| r.m_val = Rep::to_rep(r.m_val); 627| 289| return r; 628| 289| } 629| | 630| 45.1k| const auto nx = x + y; 631| | 632| | /* 633| | * Otherwise either b > a or a > b 634| | * 635| | * If b > a we want to set b to b - a 636| | * Otherwise we want to set a to a - b 637| | * 638| | * Compute r = b - a and check if it underflowed 639| | * If it did not then we are in the b > a path 640| | */ 641| 45.1k| std::array r; // NOLINT(*-member-init) 642| 45.1k| const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N); 643| | 644| | // Conditional ok: this function is variable time 645| 45.1k| if(carry == 0) { ------------------ | Branch (645:16): [True: 13.5k, False: 31.5k] ------------------ 646| | // b > a 647| 13.5k| b.m_val = r; 648| 13.5k| x = nx; 649| 13.5k| Self::_invert_vartime_div2_helper(b, x); 650| 31.5k| } else { 651| | // We know this can't underflow because a > b 652| 31.5k| bigint_sub3(r.data(), a.data(), N, b.data(), N); 653| 31.5k| a.m_val = r; 654| 31.5k| y = nx; 655| 31.5k| Self::_invert_vartime_div2_helper(a, y); 656| 31.5k| } 657| 45.1k| } 658| 289| } pcurves_sm2p256v1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE27_invert_vartime_div2_helperERSB_SC_: 549| 45.7k| static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) { 550| 45.7k| constexpr auto INV_2 = p_div_2_plus_1(Rep::P); 551| | 552| | // Conditional ok: this function is variable time 553| 150k| while((a.m_val[0] & 1) != 1) { ------------------ | Branch (553:16): [True: 105k, False: 45.7k] ------------------ 554| 105k| shift_right<1>(a.m_val); 555| | 556| 105k| const W borrow = shift_right<1>(x.m_val); 557| | 558| | // Conditional ok: this function is variable time 559| 105k| if(borrow) { ------------------ | Branch (559:16): [True: 52.3k, False: 52.7k] ------------------ 560| 52.3k| bigint_add2(x.m_val.data(), N, INV_2.data(), N); 561| 52.3k| } 562| 105k| } 563| 45.7k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEE6negateEv: 454| 727| constexpr Self negate() const { 455| 727| const W x_is_zero = ~CT::all_zeros(this->data(), N).value(); 456| | 457| 727| std::array r; // NOLINT(*-member-init) 458| 727| W carry = 0; 459| 3.63k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (459:28): [True: 2.90k, False: 727] ------------------ 460| 2.90k| r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry); 461| 2.90k| } 462| | 463| 727| return Self(r); 464| 727| } pcurves_sm2p256v1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_19sm2p256v16ParamsENS5_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEeqERKSB_: 724| 1.75k| constexpr CT::Choice operator==(const Self& other) const { 725| 1.75k| return CT::is_equal(this->data(), other.data(), N).as_choice(); 726| 1.75k| } pcurves_brainpool256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_brainpool384r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool384r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 74| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 73, False: 1] ------------------ 196| 73| table.push_back(accum); 197| | 198| 2.33k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 2.26k, False: 73] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 2.26k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.16k, False: 1.09k] ------------------ 201| 1.16k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.16k| } else { 203| 1.09k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.09k| } 205| 2.26k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 73| accum = table[i + WindowElements - 1].dbl(); 210| 73| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_brainpool512r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 98| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 97, False: 1] ------------------ 196| 97| table.push_back(accum); 197| | 198| 3.10k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 3.00k, False: 97] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 3.00k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.55k, False: 1.45k] ------------------ 201| 1.55k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.55k| } else { 203| 1.45k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.45k| } 205| 3.00k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 97| accum = table[i + WindowElements - 1].dbl(); 210| 97| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_frp256v1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_18frp256v15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_numsp512d1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_110numsp512d15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 98| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 97, False: 1] ------------------ 196| 97| table.push_back(accum); 197| | 198| 3.10k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 3.00k, False: 97] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 3.00k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.55k, False: 1.45k] ------------------ 201| 1.55k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.55k| } else { 203| 1.45k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.45k| } 205| 3.00k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 97| accum = table[i + WindowElements - 1].dbl(); 210| 97| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp192r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp192r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 38| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 37, False: 1] ------------------ 196| 37| table.push_back(accum); 197| | 198| 1.18k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.14k, False: 37] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.14k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 592, False: 555] ------------------ 201| 592| table.emplace_back(table[i + j / 2].dbl()); 202| 592| } else { 203| 555| table.emplace_back(table[i + j - 1] + table[i]); 204| 555| } 205| 1.14k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 37| accum = table[i + WindowElements - 1].dbl(); 210| 37| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp224r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 44| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 43, False: 1] ------------------ 196| 43| table.push_back(accum); 197| | 198| 1.37k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.33k, False: 43] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.33k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 688, False: 645] ------------------ 201| 688| table.emplace_back(table[i + j / 2].dbl()); 202| 688| } else { 203| 645| table.emplace_back(table[i + j - 1] + table[i]); 204| 645| } 205| 1.33k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 43| accum = table[i + WindowElements - 1].dbl(); 210| 43| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp256k1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp256k15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp384r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 74| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 73, False: 1] ------------------ 196| 73| table.push_back(accum); 197| | 198| 2.33k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 2.26k, False: 73] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 2.26k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.16k, False: 1.09k] ------------------ 201| 1.16k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.16k| } else { 203| 1.09k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.09k| } 205| 2.26k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 73| accum = table[i + WindowElements - 1].dbl(); 210| 73| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_secp521r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 98| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 97, False: 1] ------------------ 196| 97| table.push_back(accum); 197| | 198| 3.10k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 3.00k, False: 97] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 3.00k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 1.55k, False: 1.45k] ------------------ 201| 1.55k| table.emplace_back(table[i + j / 2].dbl()); 202| 1.55k| } else { 203| 1.45k| table.emplace_back(table[i + j - 1] + table[i]); 204| 1.45k| } 205| 3.00k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 97| accum = table[i + WindowElements - 1].dbl(); 210| 97| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} pcurves_sm2p256v1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19sm2p256v15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m: 180| 1|std::vector basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) { 181| 1| static_assert(WindowBits >= 1 && WindowBits <= 8); 182| | 183| | // 2^(W-1) elements per window [1*base .. 2^(W-1)*base] 184| 1| constexpr size_t WindowElements = 1 << (WindowBits - 1); 185| | 186| 1| const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits; 187| | 188| 1| const size_t TableSize = Windows * WindowElements; 189| | 190| 1| std::vector table; 191| 1| table.reserve(TableSize); 192| | 193| 1| auto accum = C::ProjectivePoint::from_affine(p); 194| | 195| 50| for(size_t i = 0; i != TableSize; i += WindowElements) { ------------------ | Branch (195:22): [True: 49, False: 1] ------------------ 196| 49| table.push_back(accum); 197| | 198| 1.56k| for(size_t j = 1; j != WindowElements; ++j) { ------------------ | Branch (198:25): [True: 1.51k, False: 49] ------------------ 199| | // Conditional ok: loop iteration count is public 200| 1.51k| if(j % 2 == 1) { ------------------ | Branch (200:13): [True: 784, False: 735] ------------------ 201| 784| table.emplace_back(table[i + j / 2].dbl()); 202| 784| } else { 203| 735| table.emplace_back(table[i + j - 1] + table[i]); 204| 735| } 205| 1.51k| } 206| | 207| | // Advance to next window's base: 2^W * current_base 208| | // The last entry is 2^(W-1) * base, so doubling gives 2^W * base 209| 49| accum = table[i + WindowElements - 1].dbl(); 210| 49| } 211| | 212| | // Variable time batch conversion is fine since generator is public 213| 1| return to_affine_batch(table); 214| 1|} _ZN5Botan20solinas_correct_redcILm3ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_: 84| 22.1k|constexpr inline void solinas_correct_redc(std::array& r, const std::array& P, const std::array& C) { 85| 22.1k| W borrow = 0; 86| 88.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (86:22): [True: 66.5k, False: 22.1k] ------------------ 87| 66.5k| r[i] = word_sub(r[i], C[i], &borrow); 88| 66.5k| } 89| | 90| | // borrow is either 0 or 1, perfect for setting up a mask without extra work 91| 22.1k| const W mask = CT::value_barrier(0 - borrow); 92| | 93| 22.1k| W carry = 0; 94| | 95| 88.7k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (95:22): [True: 66.5k, False: 22.1k] ------------------ 96| 66.5k| r[i] = word_add(r[i], P[i] & mask, &carry); 97| 66.5k| } 98| 22.1k|} _ZN5Botan10get_uint32ITkNS_8WordTypeEmEEjPKT_m: 33| 1.41M|constexpr uint32_t get_uint32(const W xw[], size_t i) { 34| 1.41M| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 35| | 36| | if constexpr(WordInfo::bits == 32) { 37| | return xw[i]; 38| 1.41M| } else { 39| 1.41M| return static_cast(xw[i / 2] >> ((i % 2) * 32)); 40| 1.41M| } 41| 1.41M|} _ZN5Botan12SolinasAccumImLm4EEC2ERNSt3__15arrayImLm4EEE: 50| 25.7k| constexpr explicit SolinasAccum(std::array& r) : m_r(r) {} _ZN5Botan12SolinasAccumImLm4EE5accumEl: 52| 180k| constexpr void accum(int64_t v) { 53| 180k| BOTAN_DEBUG_ASSERT(m_idx < N32); ------------------ | | 137| 180k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 180k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 180k] | | ------------------ ------------------ 54| | 55| 180k| m_S += v; 56| 180k| const uint32_t r = static_cast(m_S); 57| 180k| m_S >>= 32; 58| | 59| | if constexpr(WordInfo::bits == 32) { 60| | m_r[m_idx] = r; 61| 180k| } else { 62| 180k| m_r[m_idx / 2] |= static_cast(r) << (32 * (m_idx % 2)); 63| 180k| } 64| | 65| 180k| m_idx += 1; 66| 180k| } _ZN5Botan12SolinasAccumImLm4EE11final_carryEl: 68| 25.7k| constexpr W final_carry(int64_t C) { 69| 25.7k| m_S += C; 70| 25.7k| BOTAN_DEBUG_ASSERT(m_S >= 0); ------------------ | | 137| 25.7k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 25.7k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 25.7k] | | ------------------ ------------------ 71| 25.7k| return static_cast(m_S); 72| 25.7k| } _ZN5Botan20solinas_correct_redcILm4ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_: 84| 25.7k|constexpr inline void solinas_correct_redc(std::array& r, const std::array& P, const std::array& C) { 85| 25.7k| W borrow = 0; 86| 128k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (86:22): [True: 103k, False: 25.7k] ------------------ 87| 103k| r[i] = word_sub(r[i], C[i], &borrow); 88| 103k| } 89| | 90| | // borrow is either 0 or 1, perfect for setting up a mask without extra work 91| 25.7k| const W mask = CT::value_barrier(0 - borrow); 92| | 93| 25.7k| W carry = 0; 94| | 95| 128k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (95:22): [True: 103k, False: 25.7k] ------------------ 96| 103k| r[i] = word_add(r[i], P[i] & mask, &carry); 97| 103k| } 98| 25.7k|} _ZN5Botan12SolinasAccumImLm6EEC2ERNSt3__15arrayImLm6EEE: 50| 43.7k| constexpr explicit SolinasAccum(std::array& r) : m_r(r) {} _ZN5Botan12SolinasAccumImLm6EE5accumEl: 52| 525k| constexpr void accum(int64_t v) { 53| 525k| BOTAN_DEBUG_ASSERT(m_idx < N32); ------------------ | | 137| 525k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 525k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 525k] | | ------------------ ------------------ 54| | 55| 525k| m_S += v; 56| 525k| const uint32_t r = static_cast(m_S); 57| 525k| m_S >>= 32; 58| | 59| | if constexpr(WordInfo::bits == 32) { 60| | m_r[m_idx] = r; 61| 525k| } else { 62| 525k| m_r[m_idx / 2] |= static_cast(r) << (32 * (m_idx % 2)); 63| 525k| } 64| | 65| 525k| m_idx += 1; 66| 525k| } _ZN5Botan12SolinasAccumImLm6EE11final_carryEl: 68| 43.7k| constexpr W final_carry(int64_t C) { 69| 43.7k| m_S += C; 70| 43.7k| BOTAN_DEBUG_ASSERT(m_S >= 0); ------------------ | | 137| 43.7k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 43.7k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 43.7k] | | ------------------ ------------------ 71| 43.7k| return static_cast(m_S); 72| 43.7k| } _ZN5Botan20solinas_correct_redcILm6ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_: 84| 43.7k|constexpr inline void solinas_correct_redc(std::array& r, const std::array& P, const std::array& C) { 85| 43.7k| W borrow = 0; 86| 306k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (86:22): [True: 262k, False: 43.7k] ------------------ 87| 262k| r[i] = word_sub(r[i], C[i], &borrow); 88| 262k| } 89| | 90| | // borrow is either 0 or 1, perfect for setting up a mask without extra work 91| 43.7k| const W mask = CT::value_barrier(0 - borrow); 92| | 93| 43.7k| W carry = 0; 94| | 95| 306k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (95:22): [True: 262k, False: 43.7k] ------------------ 96| 262k| r[i] = word_add(r[i], P[i] & mask, &carry); 97| 262k| } 98| 43.7k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm4EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 968k| -> std::array { 111| 968k| static_assert(N >= 1); 112| | 113| 968k| std::array ws; // NOLINT(*-member-init) 114| 968k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 968k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 968k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| 968k| if constexpr(N == 4) { 120| 968k| bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| 968k| return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 968k| } 136| | 137| 0| word3 accum; 138| | 139| 968k| accum.add(z[0]); 140| | 141| 968k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 968k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 968k] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 968k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 968k] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 968k| accum.add(z[2 * N - 1]); 164| | 165| 968k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 968k| const W w1 = accum.extract(); 168| | 169| 968k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 968k| return r; 172| 968k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm6EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 491k| -> std::array { 111| 491k| static_assert(N >= 1); 112| | 113| 491k| std::array ws; // NOLINT(*-member-init) 114| 491k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 491k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 491k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| 491k| } else if constexpr(N == 6) { 123| 491k| bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| 491k| return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 491k| } 136| | 137| 0| word3 accum; 138| | 139| 491k| accum.add(z[0]); 140| | 141| 491k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 491k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 491k] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 491k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 491k] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 491k| accum.add(z[2 * N - 1]); 164| | 165| 491k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 491k| const W w1 = accum.extract(); 168| | 169| 491k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 491k| return r; 172| 491k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm8EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 721k| -> std::array { 111| 721k| static_assert(N >= 1); 112| | 113| 721k| std::array ws; // NOLINT(*-member-init) 114| 721k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 721k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 721k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| 721k| } else if constexpr(N == 8) { 126| 721k| bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| 721k| return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| | } else if constexpr(N == 16) { 132| | bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| | return r; 134| | } 135| 721k| } 136| | 137| 0| word3 accum; 138| | 139| 721k| accum.add(z[0]); 140| | 141| 721k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 721k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 0, False: 721k] ------------------ 144| 0| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 0, False: 0] ------------------ 145| 0| accum.mul(ws[j], p[i - j]); 146| 0| } 147| | 148| 0| accum.add(z[i]); 149| | 150| 0| ws[i] = accum.monty_step(p[0], p_dash); 151| 0| } 152| | 153| 721k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 0, False: 721k] ------------------ 154| 0| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 0, False: 0] ------------------ 155| 0| accum.mul(ws[j], p[N + i - j]); 156| 0| } 157| | 158| 0| accum.add(z[N + i]); 159| | 160| 0| ws[i] = accum.extract(); 161| 0| } 162| | 163| 721k| accum.add(z[2 * N - 1]); 164| | 165| 721k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 721k| const W w1 = accum.extract(); 168| | 169| 721k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 721k| return r; 172| 721k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm3EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 194k| -> std::array { 111| 194k| static_assert(N >= 1); 112| | 113| 194k| std::array ws; // NOLINT(*-member-init) 114| 194k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 194k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 194k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| 194k| } else if constexpr(N == 16) { 132| 194k| bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| 194k| return r; 134| 194k| } 135| 194k| } 136| | 137| 194k| word3 accum; 138| | 139| 194k| accum.add(z[0]); 140| | 141| 194k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 584k| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 389k, False: 194k] ------------------ 144| 974k| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 584k, False: 389k] ------------------ 145| 584k| accum.mul(ws[j], p[i - j]); 146| 584k| } 147| | 148| 389k| accum.add(z[i]); 149| | 150| 389k| ws[i] = accum.monty_step(p[0], p_dash); 151| 389k| } 152| | 153| 584k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 389k, False: 194k] ------------------ 154| 974k| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 584k, False: 389k] ------------------ 155| 584k| accum.mul(ws[j], p[N + i - j]); 156| 584k| } 157| | 158| 389k| accum.add(z[N + i]); 159| | 160| 389k| ws[i] = accum.extract(); 161| 389k| } 162| | 163| 194k| accum.add(z[2 * N - 1]); 164| | 165| 194k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 194k| const W w1 = accum.extract(); 168| | 169| 194k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 194k| return r; 172| 194k|} _ZN5Botan10monty_redcITkNS_8WordTypeEmLm9EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_: 110| 262k| -> std::array { 111| 262k| static_assert(N >= 1); 112| | 113| 262k| std::array ws; // NOLINT(*-member-init) 114| 262k| std::array r; // NOLINT(*-member-init) 115| | 116| | // Conditional ok: the parameter size is public 117| 262k| if(!std::is_constant_evaluated()) { ------------------ | Branch (117:7): [True: 262k, Folded] ------------------ 118| | // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words 119| | if constexpr(N == 4) { 120| | bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data()); 121| | return r; 122| | } else if constexpr(N == 6) { 123| | bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data()); 124| | return r; 125| | } else if constexpr(N == 8) { 126| | bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data()); 127| | return r; 128| | } else if constexpr(N == 12) { 129| | bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data()); 130| | return r; 131| 262k| } else if constexpr(N == 16) { 132| 262k| bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data()); 133| 262k| return r; 134| 262k| } 135| 262k| } 136| | 137| 262k| word3 accum; 138| | 139| 262k| accum.add(z[0]); 140| | 141| 262k| ws[0] = accum.monty_step(p[0], p_dash); 142| | 143| 2.36M| for(size_t i = 1; i != N; ++i) { ------------------ | Branch (143:22): [True: 2.10M, False: 262k] ------------------ 144| 11.5M| for(size_t j = 0; j < i; ++j) { ------------------ | Branch (144:25): [True: 9.45M, False: 2.10M] ------------------ 145| 9.45M| accum.mul(ws[j], p[i - j]); 146| 9.45M| } 147| | 148| 2.10M| accum.add(z[i]); 149| | 150| 2.10M| ws[i] = accum.monty_step(p[0], p_dash); 151| 2.10M| } 152| | 153| 2.36M| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (153:22): [True: 2.10M, False: 262k] ------------------ 154| 11.5M| for(size_t j = i + 1; j != N; ++j) { ------------------ | Branch (154:29): [True: 9.45M, False: 2.10M] ------------------ 155| 9.45M| accum.mul(ws[j], p[N + i - j]); 156| 9.45M| } 157| | 158| 2.10M| accum.add(z[N + i]); 159| | 160| 2.10M| ws[i] = accum.extract(); 161| 2.10M| } 162| | 163| 262k| accum.add(z[2 * N - 1]); 164| | 165| 262k| ws[N - 1] = accum.extract(); 166| | // w1 is the final part, which is not stored in the workspace 167| 262k| const W w1 = accum.extract(); 168| | 169| 262k| bigint_monty_maybe_sub(r.data(), w1, ws.data(), p.data()); 170| | 171| 262k| return r; 172| 262k|} pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE8instanceEv: 341| 13.0k| static std::shared_ptr instance() { 342| 13.0k| static const auto g_curve = std::make_shared>(); 343| 13.0k| return g_curve; 344| 13.0k| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 9.36k| static typename C::Scalar from_stash(const Scalar& s) { 352| 9.36k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 9.36k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 9.36k| return C::Scalar::from_stash(s._value()); 356| 9.36k| } pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 347| 3.67k| static Scalar stash(const typename C::Scalar& s) { 348| 3.67k| return Scalar::_create(instance(), s.template stash_value()); 349| 3.67k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 264| std::optional deserialize_scalar(std::span bytes) const override { 222| 264| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 264, False: 0] ------------------ 223| 264| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 264, False: 0] ------------------ 224| 264| return stash(*scalar); 225| 264| } 226| 264| } 227| | 228| 0| return {}; 229| 264| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 276| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 276| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 276, False: 0] ------------------ 233| 276| return stash(*s); 234| 276| } else { 235| 0| return {}; 236| 0| } 237| 276| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 264| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 264| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 264| do { \ | | 36| 264| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 264| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 264] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 264| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 264] | | ------------------ ------------------ 218| 264| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 264| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10scalar_oneEv: 335| 138| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 690| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 690| return stash(from_stash(a) + from_stash(b)); 301| 690| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 138| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 138| return stash(from_stash(a) - from_stash(b)); 305| 138| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.23k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.23k| return stash(from_stash(a) * from_stash(b)); 309| 1.23k| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 138| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 395| Scalar scalar_invert(const Scalar& ss) const override { 314| 395| const auto s = from_stash(ss); 315| | if constexpr(curve_supports_scalar_invert) { 316| | return stash(C::scalar_invert(s)); 317| 395| } else { 318| 395| return stash(s.invert()); 319| 395| } 320| 395| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 264| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 264| const auto s = from_stash(ss); 324| 264| return stash(s.invert_vartime()); 325| 264| } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 138| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 828| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 1.61k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 1.61k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 1.61k| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE8instanceEv: 341| 15.1k| static std::shared_ptr instance() { 342| 15.1k| static const auto g_curve = std::make_shared>(); 343| 15.1k| return g_curve; 344| 15.1k| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 10.8k| static typename C::Scalar from_stash(const Scalar& s) { 352| 10.8k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 10.8k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 10.8k| return C::Scalar::from_stash(s._value()); 356| 10.8k| } pcurves_brainpool384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 347| 4.26k| static Scalar stash(const typename C::Scalar& s) { 348| 4.26k| return Scalar::_create(instance(), s.template stash_value()); 349| 4.26k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 311| std::optional deserialize_scalar(std::span bytes) const override { 222| 311| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 311, False: 0] ------------------ 223| 311| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 311, False: 0] ------------------ 224| 311| return stash(*scalar); 225| 311| } 226| 311| } 227| | 228| 0| return {}; 229| 311| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 318| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 318| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 318, False: 0] ------------------ 233| 318| return stash(*s); 234| 318| } else { 235| 0| return {}; 236| 0| } 237| 318| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 311| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 311| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 311| do { \ | | 36| 311| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 311| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 311] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 311| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 311] | | ------------------ ------------------ 218| 311| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 311| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10scalar_oneEv: 335| 159| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 795| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 795| return stash(from_stash(a) + from_stash(b)); 301| 795| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 159| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 159| return stash(from_stash(a) - from_stash(b)); 305| 159| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.42k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.42k| return stash(from_stash(a) * from_stash(b)); 309| 1.42k| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 159| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 467| Scalar scalar_invert(const Scalar& ss) const override { 314| 467| const auto s = from_stash(ss); 315| | if constexpr(curve_supports_scalar_invert) { 316| | return stash(C::scalar_invert(s)); 317| 467| } else { 318| 467| return stash(s.invert()); 319| 467| } 320| 467| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 311| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 311| const auto s = from_stash(ss); 324| 311| return stash(s.invert_vartime()); 325| 311| } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 159| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 954| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool384r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 1.88k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 1.88k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 1.88k| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE8instanceEv: 341| 17.4k| static std::shared_ptr instance() { 342| 17.4k| static const auto g_curve = std::make_shared>(); 343| 17.4k| return g_curve; 344| 17.4k| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 12.5k| static typename C::Scalar from_stash(const Scalar& s) { 352| 12.5k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 12.5k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 12.5k| return C::Scalar::from_stash(s._value()); 356| 12.5k| } pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 347| 4.92k| static Scalar stash(const typename C::Scalar& s) { 348| 4.92k| return Scalar::_create(instance(), s.template stash_value()); 349| 4.92k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 358| std::optional deserialize_scalar(std::span bytes) const override { 222| 358| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 358, False: 0] ------------------ 223| 358| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 358, False: 0] ------------------ 224| 358| return stash(*scalar); 225| 358| } 226| 358| } 227| | 228| 0| return {}; 229| 358| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 368| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 368| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 368, False: 0] ------------------ 233| 368| return stash(*s); 234| 368| } else { 235| 0| return {}; 236| 0| } 237| 368| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 358| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 358| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 358| do { \ | | 36| 358| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 358| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 358] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 358| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 358] | | ------------------ ------------------ 218| 358| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 358| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10scalar_oneEv: 335| 184| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 920| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 920| return stash(from_stash(a) + from_stash(b)); 301| 920| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 184| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 184| return stash(from_stash(a) - from_stash(b)); 305| 184| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.64k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.64k| return stash(from_stash(a) * from_stash(b)); 309| 1.64k| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 184| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 538| Scalar scalar_invert(const Scalar& ss) const override { 314| 538| const auto s = from_stash(ss); 315| | if constexpr(curve_supports_scalar_invert) { 316| | return stash(C::scalar_invert(s)); 317| 538| } else { 318| 538| return stash(s.invert()); 319| 538| } 320| 538| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 358| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 358| const auto s = from_stash(ss); 324| 358| return stash(s.invert_vartime()); 325| 358| } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 184| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 1.10k| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 2.17k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 2.17k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 2.17k| } pcurves_frp256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE8instanceEv: 341| 12.3k| static std::shared_ptr instance() { 342| 12.3k| static const auto g_curve = std::make_shared>(); 343| 12.3k| return g_curve; 344| 12.3k| } pcurves_frp256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_frp256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 8.86k| static typename C::Scalar from_stash(const Scalar& s) { 352| 8.86k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 8.86k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 8.86k| return C::Scalar::from_stash(s._value()); 356| 8.86k| } pcurves_frp256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES7_E12ScalarParamsEEEEE: 347| 3.47k| static Scalar stash(const typename C::Scalar& s) { 348| 3.47k| return Scalar::_create(instance(), s.template stash_value()); 349| 3.47k| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 252| std::optional deserialize_scalar(std::span bytes) const override { 222| 252| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 252, False: 0] ------------------ 223| 252| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 252, False: 0] ------------------ 224| 252| return stash(*scalar); 225| 252| } 226| 252| } 227| | 228| 0| return {}; 229| 252| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 260| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 260| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 260, False: 0] ------------------ 233| 260| return stash(*s); 234| 260| } else { 235| 0| return {}; 236| 0| } 237| 260| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 252| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 252| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 252| do { \ | | 36| 252| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 252| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 252] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 252| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 252] | | ------------------ ------------------ 218| 252| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 252| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE10scalar_oneEv: 335| 130| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 650| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 650| return stash(from_stash(a) + from_stash(b)); 301| 650| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 130| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 130| return stash(from_stash(a) - from_stash(b)); 305| 130| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.16k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.16k| return stash(from_stash(a) * from_stash(b)); 309| 1.16k| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 130| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 376| Scalar scalar_invert(const Scalar& ss) const override { 314| 376| const auto s = from_stash(ss); 315| | if constexpr(curve_supports_scalar_invert) { 316| | return stash(C::scalar_invert(s)); 317| 376| } else { 318| 376| return stash(s.invert()); 319| 376| } 320| 376| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 252| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 252| const auto s = from_stash(ss); 324| 252| return stash(s.invert_vartime()); 325| 252| } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 130| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 780| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_frp256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_18frp256v15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 1.53k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 1.53k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 1.53k| } pcurves_numsp512d1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE8instanceEv: 341| 15.7k| static std::shared_ptr instance() { 342| 15.7k| static const auto g_curve = std::make_shared>(); 343| 15.7k| return g_curve; 344| 15.7k| } pcurves_numsp512d1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_numsp512d1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 11.3k| static typename C::Scalar from_stash(const Scalar& s) { 352| 11.3k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 11.3k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 11.3k| return C::Scalar::from_stash(s._value()); 356| 11.3k| } pcurves_numsp512d1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_13Numsp512d1RepEE12ScalarParamsEEEEE: 347| 4.43k| static Scalar stash(const typename C::Scalar& s) { 348| 4.43k| return Scalar::_create(instance(), s.template stash_value()); 349| 4.43k| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 320| std::optional deserialize_scalar(std::span bytes) const override { 222| 320| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 320, False: 0] ------------------ 223| 320| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 320, False: 0] ------------------ 224| 320| return stash(*scalar); 225| 320| } 226| 320| } 227| | 228| 0| return {}; 229| 320| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 332| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 332| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 332, False: 0] ------------------ 233| 332| return stash(*s); 234| 332| } else { 235| 0| return {}; 236| 0| } 237| 332| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 320| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 320| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 320| do { \ | | 36| 320| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 320| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 320] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 320| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 320] | | ------------------ ------------------ 218| 320| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 320| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE10scalar_oneEv: 335| 166| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 830| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 830| return stash(from_stash(a) + from_stash(b)); 301| 830| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 166| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 166| return stash(from_stash(a) - from_stash(b)); 305| 166| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.48k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.48k| return stash(from_stash(a) * from_stash(b)); 309| 1.48k| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 166| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 482| Scalar scalar_invert(const Scalar& ss) const override { 314| 482| const auto s = from_stash(ss); 315| | if constexpr(curve_supports_scalar_invert) { 316| | return stash(C::scalar_invert(s)); 317| 482| } else { 318| 482| return stash(s.invert()); 319| 482| } 320| 482| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 320| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 320| const auto s = from_stash(ss); 324| 320| return stash(s.invert_vartime()); 325| 320| } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 166| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 996| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_numsp512d1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_110numsp512d15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 1.95k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 1.95k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 1.95k| } pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE8instanceEv: 341| 24.9k| static std::shared_ptr instance() { 342| 24.9k| static const auto g_curve = std::make_shared>(); 343| 24.9k| return g_curve; 344| 24.9k| } pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 17.9k| static typename C::Scalar from_stash(const Scalar& s) { 352| 17.9k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 17.9k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 17.9k| return C::Scalar::from_stash(s._value()); 356| 17.9k| } pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp192r1RepEE12ScalarParamsEEEEE: 347| 7.03k| static Scalar stash(const typename C::Scalar& s) { 348| 7.03k| return Scalar::_create(instance(), s.template stash_value()); 349| 7.03k| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 506| std::optional deserialize_scalar(std::span bytes) const override { 222| 506| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 506, False: 0] ------------------ 223| 506| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 506, False: 0] ------------------ 224| 506| return stash(*scalar); 225| 506| } 226| 506| } 227| | 228| 0| return {}; 229| 506| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 528| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 528| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 528, False: 0] ------------------ 233| 528| return stash(*s); 234| 528| } else { 235| 0| return {}; 236| 0| } 237| 528| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 506| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 506| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 506| do { \ | | 36| 506| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 506| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 506] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 506| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 506] | | ------------------ ------------------ 218| 506| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 506| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE10scalar_oneEv: 335| 264| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 1.32k| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 1.32k| return stash(from_stash(a) + from_stash(b)); 301| 1.32k| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 264| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 264| return stash(from_stash(a) - from_stash(b)); 305| 264| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 2.35k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 2.35k| return stash(from_stash(a) * from_stash(b)); 309| 2.35k| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 264| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 760| Scalar scalar_invert(const Scalar& ss) const override { 314| 760| const auto s = from_stash(ss); 315| | if constexpr(curve_supports_scalar_invert) { 316| | return stash(C::scalar_invert(s)); 317| 760| } else { 318| 760| return stash(s.invert()); 319| 760| } 320| 760| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 506| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 506| const auto s = from_stash(ss); 324| 506| return stash(s.invert_vartime()); 325| 506| } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 264| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 1.58k| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 3.09k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 3.09k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 3.09k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE8instanceEv: 341| 21.8k| static std::shared_ptr instance() { 342| 21.8k| static const auto g_curve = std::make_shared>(); 343| 21.8k| return g_curve; 344| 21.8k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 15.7k| static typename C::Scalar from_stash(const Scalar& s) { 352| 15.7k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 15.7k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 15.7k| return C::Scalar::from_stash(s._value()); 356| 15.7k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp224r1RepEE12ScalarParamsEEEEE: 347| 6.15k| static Scalar stash(const typename C::Scalar& s) { 348| 6.15k| return Scalar::_create(instance(), s.template stash_value()); 349| 6.15k| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 448| std::optional deserialize_scalar(std::span bytes) const override { 222| 448| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 448, False: 0] ------------------ 223| 448| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 448, False: 0] ------------------ 224| 448| return stash(*scalar); 225| 448| } 226| 448| } 227| | 228| 0| return {}; 229| 448| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 460| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 460| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 460, False: 0] ------------------ 233| 460| return stash(*s); 234| 460| } else { 235| 0| return {}; 236| 0| } 237| 460| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 448| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 448| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 448| do { \ | | 36| 448| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 448| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 448] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 448| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 448] | | ------------------ ------------------ 218| 448| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 448| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10scalar_oneEv: 335| 230| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 1.15k| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 1.15k| return stash(from_stash(a) + from_stash(b)); 301| 1.15k| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 230| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 230| return stash(from_stash(a) - from_stash(b)); 305| 230| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 2.05k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 2.05k| return stash(from_stash(a) * from_stash(b)); 309| 2.05k| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 230| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 671| Scalar scalar_invert(const Scalar& ss) const override { 314| 671| const auto s = from_stash(ss); 315| 671| if constexpr(curve_supports_scalar_invert) { 316| 671| return stash(C::scalar_invert(s)); 317| | } else { 318| | return stash(s.invert()); 319| | } 320| 671| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 448| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 448| const auto s = from_stash(ss); 324| 448| return stash(s.invert_vartime()); 325| 448| } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 230| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 1.38k| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 2.71k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 2.71k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 2.71k| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE8instanceEv: 341| 17.4k| static std::shared_ptr instance() { 342| 17.4k| static const auto g_curve = std::make_shared>(); 343| 17.4k| return g_curve; 344| 17.4k| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 12.5k| static typename C::Scalar from_stash(const Scalar& s) { 352| 12.5k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 12.5k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 12.5k| return C::Scalar::from_stash(s._value()); 356| 12.5k| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_12Secp256k1RepEE12ScalarParamsEEEEE: 347| 4.92k| static Scalar stash(const typename C::Scalar& s) { 348| 4.92k| return Scalar::_create(instance(), s.template stash_value()); 349| 4.92k| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 353| std::optional deserialize_scalar(std::span bytes) const override { 222| 353| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 353, False: 0] ------------------ 223| 353| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 353, False: 0] ------------------ 224| 353| return stash(*scalar); 225| 353| } 226| 353| } 227| | 228| 0| return {}; 229| 353| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 370| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 370| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 370, False: 0] ------------------ 233| 370| return stash(*s); 234| 370| } else { 235| 0| return {}; 236| 0| } 237| 370| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 353| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 353| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 353| do { \ | | 36| 353| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 353| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 353] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 353| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 353] | | ------------------ ------------------ 218| 353| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 353| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10scalar_oneEv: 335| 185| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 925| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 925| return stash(from_stash(a) + from_stash(b)); 301| 925| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 185| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 185| return stash(from_stash(a) - from_stash(b)); 305| 185| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.64k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.64k| return stash(from_stash(a) * from_stash(b)); 309| 1.64k| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 185| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 531| Scalar scalar_invert(const Scalar& ss) const override { 314| 531| const auto s = from_stash(ss); 315| 531| if constexpr(curve_supports_scalar_invert) { 316| 531| return stash(C::scalar_invert(s)); 317| | } else { 318| | return stash(s.invert()); 319| | } 320| 531| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 353| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 353| const auto s = from_stash(ss); 324| 353| return stash(s.invert_vartime()); 325| 353| } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 185| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 1.11k| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp256k1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256k15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 2.16k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 2.16k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 2.16k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE8instanceEv: 341| 18.3k| static std::shared_ptr instance() { 342| 18.3k| static const auto g_curve = std::make_shared>(); 343| 18.3k| return g_curve; 344| 18.3k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 13.2k| static typename C::Scalar from_stash(const Scalar& s) { 352| 13.2k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 13.2k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 13.2k| return C::Scalar::from_stash(s._value()); 356| 13.2k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEE: 347| 5.17k| static Scalar stash(const typename C::Scalar& s) { 348| 5.17k| return Scalar::_create(instance(), s.template stash_value()); 349| 5.17k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 377| std::optional deserialize_scalar(std::span bytes) const override { 222| 377| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 377, False: 0] ------------------ 223| 377| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 377, False: 0] ------------------ 224| 377| return stash(*scalar); 225| 377| } 226| 377| } 227| | 228| 0| return {}; 229| 377| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 386| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 386| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 386, False: 0] ------------------ 233| 386| return stash(*s); 234| 386| } else { 235| 0| return {}; 236| 0| } 237| 386| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 377| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 377| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 377| do { \ | | 36| 377| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 377| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 377] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 377| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 377] | | ------------------ ------------------ 218| 377| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 377| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10scalar_oneEv: 335| 193| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 965| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 965| return stash(from_stash(a) + from_stash(b)); 301| 965| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 193| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 193| return stash(from_stash(a) - from_stash(b)); 305| 193| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.72k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.72k| return stash(from_stash(a) * from_stash(b)); 309| 1.72k| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 193| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 566| Scalar scalar_invert(const Scalar& ss) const override { 314| 566| const auto s = from_stash(ss); 315| 566| if constexpr(curve_supports_scalar_invert) { 316| 566| return stash(C::scalar_invert(s)); 317| | } else { 318| | return stash(s.invert()); 319| | } 320| 566| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 377| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 377| const auto s = from_stash(ss); 324| 377| return stash(s.invert_vartime()); 325| 377| } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 193| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 1.15k| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 2.28k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 2.28k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 2.28k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE8instanceEv: 341| 15.8k| static std::shared_ptr instance() { 342| 15.8k| static const auto g_curve = std::make_shared>(); 343| 15.8k| return g_curve; 344| 15.8k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 11.4k| static typename C::Scalar from_stash(const Scalar& s) { 352| 11.4k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 11.4k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 11.4k| return C::Scalar::from_stash(s._value()); 356| 11.4k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS2_12Secp384r1RepEE12ScalarParamsEEEEE: 347| 4.47k| static Scalar stash(const typename C::Scalar& s) { 348| 4.47k| return Scalar::_create(instance(), s.template stash_value()); 349| 4.47k| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 326| std::optional deserialize_scalar(std::span bytes) const override { 222| 326| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 326, False: 0] ------------------ 223| 326| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 326, False: 0] ------------------ 224| 326| return stash(*scalar); 225| 326| } 226| 326| } 227| | 228| 0| return {}; 229| 326| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 334| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 334| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 334, False: 0] ------------------ 233| 334| return stash(*s); 234| 334| } else { 235| 0| return {}; 236| 0| } 237| 334| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 326| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 326| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 326| do { \ | | 36| 326| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 326| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 326] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 326| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 326] | | ------------------ ------------------ 218| 326| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 326| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10scalar_oneEv: 335| 167| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 835| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 835| return stash(from_stash(a) + from_stash(b)); 301| 835| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 167| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 167| return stash(from_stash(a) - from_stash(b)); 305| 167| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.49k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.49k| return stash(from_stash(a) * from_stash(b)); 309| 1.49k| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 167| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 489| Scalar scalar_invert(const Scalar& ss) const override { 314| 489| const auto s = from_stash(ss); 315| 489| if constexpr(curve_supports_scalar_invert) { 316| 489| return stash(C::scalar_invert(s)); 317| | } else { 318| | return stash(s.invert()); 319| | } 320| 489| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 326| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 326| const auto s = from_stash(ss); 324| 326| return stash(s.invert_vartime()); 325| 326| } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 167| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 1.00k| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 1.97k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 1.97k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 1.97k| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE8instanceEv: 341| 14.6k| static std::shared_ptr instance() { 342| 14.6k| static const auto g_curve = std::make_shared>(); 343| 14.6k| return g_curve; 344| 14.6k| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 10.4k| static typename C::Scalar from_stash(const Scalar& s) { 352| 10.4k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 10.4k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 10.4k| return C::Scalar::from_stash(s._value()); 356| 10.4k| } pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_7P521RepEE12ScalarParamsEEEEE: 347| 4.11k| static Scalar stash(const typename C::Scalar& s) { 348| 4.11k| return Scalar::_create(instance(), s.template stash_value()); 349| 4.11k| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 298| std::optional deserialize_scalar(std::span bytes) const override { 222| 298| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 298, False: 0] ------------------ 223| 298| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 298, False: 0] ------------------ 224| 298| return stash(*scalar); 225| 298| } 226| 298| } 227| | 228| 0| return {}; 229| 298| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 308| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 308| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 308, False: 0] ------------------ 233| 308| return stash(*s); 234| 308| } else { 235| 0| return {}; 236| 0| } 237| 308| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 298| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 298| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 298| do { \ | | 36| 298| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 298| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 298] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 298| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 298] | | ------------------ ------------------ 218| 298| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 298| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10scalar_oneEv: 335| 154| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 770| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 770| return stash(from_stash(a) + from_stash(b)); 301| 770| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 154| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 154| return stash(from_stash(a) - from_stash(b)); 305| 154| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.37k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.37k| return stash(from_stash(a) * from_stash(b)); 309| 1.37k| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 154| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 445| Scalar scalar_invert(const Scalar& ss) const override { 314| 445| const auto s = from_stash(ss); 315| 445| if constexpr(curve_supports_scalar_invert) { 316| 445| return stash(C::scalar_invert(s)); 317| | } else { 318| | return stash(s.invert()); 319| | } 320| 445| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 298| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 298| const auto s = from_stash(ss); 324| 298| return stash(s.invert_vartime()); 325| 298| } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 154| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 924| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 1.81k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 1.81k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 1.81k| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE8instanceEv: 341| 14.1k| static std::shared_ptr instance() { 342| 14.1k| static const auto g_curve = std::make_shared>(); 343| 14.1k| return g_curve; 344| 14.1k| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEEC2Ev: 339| 1| PrimeOrderCurveImpl() : m_mul_by_g(C::G) {} pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE10from_stashERKNS0_15PrimeOrderCurve6ScalarE: 351| 10.1k| static typename C::Scalar from_stash(const Scalar& s) { 352| 10.1k| if(s._curve() != instance()) { ------------------ | Branch (352:13): [True: 0, False: 10.1k] ------------------ 353| 0| throw Invalid_Argument("Curve mismatch"); 354| 0| } 355| 10.1k| return C::Scalar::from_stash(s._value()); 356| 10.1k| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE5stashERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsENS3_22Sm2p256v1MontgomeryRepEE12ScalarParamsEEEEE: 347| 3.98k| static Scalar stash(const typename C::Scalar& s) { 348| 3.98k| return Scalar::_create(instance(), s.template stash_value()); 349| 3.98k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE18deserialize_scalarENSt3__14spanIKhLm18446744073709551615EEE: 221| 289| std::optional deserialize_scalar(std::span bytes) const override { 222| 289| if(auto scalar = C::Scalar::deserialize(bytes)) { ------------------ | Branch (222:18): [True: 289, False: 0] ------------------ 223| 289| if(!scalar->is_zero().as_bool()) { ------------------ | Branch (223:16): [True: 289, False: 0] ------------------ 224| 289| return stash(*scalar); 225| 289| } 226| 289| } 227| | 228| 0| return {}; 229| 289| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE22scalar_from_wide_bytesENSt3__14spanIKhLm18446744073709551615EEE: 231| 298| std::optional scalar_from_wide_bytes(std::span bytes) const override { 232| 298| if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) { ------------------ | Branch (232:18): [True: 298, False: 0] ------------------ 233| 298| return stash(*s); 234| 298| } else { 235| 0| return {}; 236| 0| } 237| 298| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE16serialize_scalarENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve6ScalarE: 216| 289| void serialize_scalar(std::span bytes, const Scalar& scalar) const override { 217| 289| BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar"); ------------------ | | 35| 289| do { \ | | 36| 289| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 289| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 289] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 289| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 289] | | ------------------ ------------------ 218| 289| return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>()); 219| 289| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE10scalar_oneEv: 335| 149| Scalar scalar_one() const override { return stash(C::Scalar::one()); } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE10scalar_addERKNS0_15PrimeOrderCurve6ScalarES9_: 299| 745| Scalar scalar_add(const Scalar& a, const Scalar& b) const override { 300| 745| return stash(from_stash(a) + from_stash(b)); 301| 745| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE10scalar_subERKNS0_15PrimeOrderCurve6ScalarES9_: 303| 149| Scalar scalar_sub(const Scalar& a, const Scalar& b) const override { 304| 149| return stash(from_stash(a) - from_stash(b)); 305| 149| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE10scalar_mulERKNS0_15PrimeOrderCurve6ScalarES9_: 307| 1.33k| Scalar scalar_mul(const Scalar& a, const Scalar& b) const override { 308| 1.33k| return stash(from_stash(a) * from_stash(b)); 309| 1.33k| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE13scalar_squareERKNS0_15PrimeOrderCurve6ScalarE: 311| 149| Scalar scalar_square(const Scalar& s) const override { return stash(from_stash(s).square()); } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE13scalar_invertERKNS0_15PrimeOrderCurve6ScalarE: 313| 435| Scalar scalar_invert(const Scalar& ss) const override { 314| 435| const auto s = from_stash(ss); 315| | if constexpr(curve_supports_scalar_invert) { 316| | return stash(C::scalar_invert(s)); 317| 435| } else { 318| 435| return stash(s.invert()); 319| 435| } 320| 435| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE21scalar_invert_vartimeERKNS0_15PrimeOrderCurve6ScalarE: 322| 289| Scalar scalar_invert_vartime(const Scalar& ss) const override { 323| 289| const auto s = from_stash(ss); 324| 289| return stash(s.invert_vartime()); 325| 289| } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE13scalar_negateERKNS0_15PrimeOrderCurve6ScalarE: 327| 149| Scalar scalar_negate(const Scalar& s) const override { return stash(from_stash(s).negate()); } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE14scalar_is_zeroERKNS0_15PrimeOrderCurve6ScalarE: 329| 894| bool scalar_is_zero(const Scalar& s) const override { return from_stash(s).is_zero().as_bool(); } pcurves_sm2p256v1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19sm2p256v15CurveEE12scalar_equalERKNS0_15PrimeOrderCurve6ScalarES9_: 331| 1.75k| bool scalar_equal(const Scalar& a, const Scalar& b) const override { 332| 1.75k| return (from_stash(a) == from_stash(b)).as_bool(); 333| 1.75k| } _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEmQntsr3stdE7same_asIbT_EEES3_S3_: 43| 20.8M|constexpr inline T value_barrier(T x) { 44| 20.8M| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 20.8M] ------------------ 45| 0| return x; 46| 20.8M| } else { 47| 20.8M|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 20.8M| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 20.8M| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 20.8M| } 64| 20.8M|} _ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEjQntsr3stdE7same_asIbT_EEES3_S3_: 43| 75|constexpr inline T value_barrier(T x) { 44| 75| if(std::is_constant_evaluated()) { ------------------ | Branch (44:7): [Folded, False: 75] ------------------ 45| 0| return x; 46| 75| } else { 47| 75|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM) 48| | /* 49| | * We may want a "stronger" statement such as 50| | * asm volatile("" : "+r,m"(x) : : "memory); 51| | * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html) 52| | * however the current approach seems sufficient with current compilers, 53| | * and is minimally damaging with regards to degrading code generation. 54| | */ 55| 75| asm("" : "+r"(x) : /* no input */); // NOLINT(*-no-assembler) 56| 75| return x; 57| |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE) 58| | volatile T vx = x; 59| | return vx; 60| |#else 61| | return x; 62| |#endif 63| 75| } 64| 75|} _ZN5Botan21Allocator_InitializerC2Ev: 57| 1| Allocator_Initializer() { initialize_allocator(); } _ZNK5Botan3OID5emptyEv: 468| 36| bool empty() const { return m_id.empty(); } _ZNK5Botan3OID9has_valueEv: 474| 24| bool has_value() const { return !empty(); } _ZNK5Botan3OIDeqERKS0_: 510| 240| bool operator==(const OID& other) const { return m_id == other.m_id; } _ZN5BotanneERKNS_3OIDES2_: 561| 12|inline bool operator!=(const OID& a, const OID& b) { 562| 12| return !(a == b); 563| 12|} _ZNKSt3__14hashIN5Botan3OIDEEclERKS2_: 761| 4| size_t operator()(const Botan::OID& oid) const noexcept { return static_cast(oid.hash_code()); } _ZN5Botan11ASN1_ObjectC2Ev: 146| 196| ASN1_Object() = default; _ZN5Botan11ASN1_ObjectD2Ev: 168| 288| virtual ~ASN1_Object() = default; _ZN5Botan11ASN1_ObjectC2ERKS0_: 151| 46| ASN1_Object(const ASN1_Object&) = default; _ZN5Botan11ASN1_ObjectC2EOS0_: 161| 46| ASN1_Object(ASN1_Object&&) = default; _ZN5Botan13ignore_paramsIJPKmmEEEvDpRKT_: 149| 122k|constexpr void ignore_params([[maybe_unused]] const T&... args) {} _ZN5Botan6BigIntC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 98| 72| explicit BigInt(std::string_view str) { *this = BigInt::from_string(str); } _ZN5Botan6BigIntC2EOS0_: 183| 60| BigInt(BigInt&& other) noexcept { this->swap(other); } _ZN5Botan6BigIntD2Ev: 185| 828| ~BigInt() { _const_time_unpoison(); } _ZN5Botan6BigIntaSEOS0_: 190| 204| BigInt& operator=(BigInt&& other) noexcept { 191| 204| if(this != &other) { ------------------ | Branch (191:13): [True: 204, False: 0] ------------------ 192| 204| this->swap(other); 193| 204| } 194| | 195| 204| return (*this); 196| 204| } _ZN5Botan6BigInt4swapERS0_: 207| 300| void swap(BigInt& other) noexcept { 208| 300| m_data.swap(other.m_data); 209| 300| std::swap(m_signedness, other.m_signedness); 210| 300| } _ZN5Botan6BigInt5clearEv: 441| 72| void clear() { 442| 72| m_data.set_to_zero(); 443| 72| m_signedness = Positive; 444| 72| } _ZNK5Botan6BigInt7is_evenEv: 481| 12| bool is_even() const { return !get_bit(0); } _ZNK5Botan6BigInt6signumEv: 493| 432| int signum() const { 494| 432| if(sig_words() == 0) { ------------------ | Branch (494:13): [True: 1, False: 431] ------------------ 495| 1| return 0; 496| 1| } 497| 431| return (sign() == Negative) ? -1 : 1; ------------------ | Branch (497:17): [True: 0, False: 431] ------------------ 498| 432| } _ZNK5Botan6BigInt7is_zeroEv: 510| 12| bool is_zero() const { return sig_words() == 0; } _ZN5Botan6BigInt7set_bitEm: 516| 48| void set_bit(size_t n) { conditionally_set_bit(n, true); } _ZN5Botan6BigInt21conditionally_set_bitEmb: 526| 48| void conditionally_set_bit(size_t n, bool set_it) { 527| 48| const size_t which = n / (sizeof(word) * 8); 528| 48| const word mask = static_cast(set_it) << (n % (sizeof(word) * 8)); 529| 48| m_data.set_word_at(which, word_at(which) | mask); 530| 48| } _ZNK5Botan6BigInt7get_bitEm: 549| 12| bool get_bit(size_t n) const { return ((word_at(n / (sizeof(word) * 8)) >> (n % (sizeof(word) * 8))) & 1) == 1; } _ZNK5Botan6BigInt7word_atEm: 601| 132| word word_at(size_t n) const { return m_data.get_word_at(n); } _ZNK5Botan6BigInt4signEv: 641| 575| Sign sign() const { return (m_signedness); } _ZN5Botan6BigInt8set_signENS0_4SignE: 663| 108| void set_sign(Sign sign) { 664| 108| if(sign == Negative && is_zero()) { ------------------ | Branch (664:13): [True: 0, False: 108] | Branch (664:33): [True: 0, False: 0] ------------------ 665| 0| sign = Positive; 666| 0| } 667| | 668| 108| m_signedness = sign; 669| 108| } _ZNK5Botan6BigInt4sizeEv: 681| 936| size_t size() const { return m_data.size(); } _ZNK5Botan6BigInt9sig_wordsEv: 687| 1.12k| size_t sig_words() const { return m_data.sig_words(); } _ZN5Botan6BigInt12mutable_dataEv: 712| 132| BOTAN_DEPRECATED("Deprecated no replacement") word* mutable_data() { return m_data.mutable_data(); } _ZNK5Botan6BigInt4dataEv: 718| 24| BOTAN_DEPRECATED("Deprecated no replacement") const word* data() const { return m_data.const_data(); } _ZNK5Botan6BigInt7grow_toEm: 738| 166| BOTAN_DEPRECATED("Deprecated no replacement") void grow_to(size_t n) const { m_data.grow_to(n); } _ZN5Botan6BigInt10power_of_2Em: 906| 48| static BigInt power_of_2(size_t n) { 907| 48| BigInt b; 908| 48| b.set_bit(n); 909| 48| return b; 910| 48| } _ZNK5Botan6BigInt8_as_spanEv: 1023| 24| std::span _as_span() const { return m_data.const_span(); } _ZNK5Botan6BigInt5_dataEv: 1033| 1.68k| const word* _data() const { return m_data.const_data(); } _ZN5Botan6BigInt11_from_wordsERNSt3__16vectorImNS_16secure_allocatorImEEEE: 1052| 168| static BigInt _from_words(secure_vector& words) { 1053| 168| BigInt bn; 1054| 168| bn.m_data.swap(words); 1055| 168| return bn; 1056| 168| } _ZN5Botan6BigInt4Data12mutable_dataEv: 1083| 132| word* mutable_data() { 1084| 132| invalidate_sig_words(); 1085| 132| return m_reg.data(); 1086| 132| } _ZNK5Botan6BigInt4Data10const_dataEv: 1088| 2.53k| const word* const_data() const { return m_reg.data(); } _ZNK5Botan6BigInt4Data10const_spanEv: 1090| 24| std::span const_span() const { return std::span{m_reg}; } _ZNK5Botan6BigInt4Data11get_word_atEm: 1099| 132| word get_word_at(size_t n) const { 1100| 132| if(n < m_reg.size()) { ------------------ | Branch (1100:19): [True: 84, False: 48] ------------------ 1101| 84| return m_reg[n]; 1102| 84| } 1103| 48| return 0; 1104| 132| } _ZN5Botan6BigInt4Data11set_word_atEmm: 1106| 60| void set_word_at(size_t i, word w) { 1107| 60| invalidate_sig_words(); 1108| 60| if(i >= m_reg.size()) { ------------------ | Branch (1108:19): [True: 60, False: 0] ------------------ 1109| 60| if(w == 0) { ------------------ | Branch (1109:22): [True: 0, False: 60] ------------------ 1110| 0| return; 1111| 0| } 1112| 60| grow_to(i + 1); 1113| 60| } 1114| 60| m_reg[i] = w; 1115| 60| } _ZNK5Botan6BigInt4Data7grow_toEm: 1126| 226| void grow_to(size_t n) const { 1127| 226| if(n > size()) { ------------------ | Branch (1127:19): [True: 208, False: 18] ------------------ 1128| 208| if(n <= m_reg.capacity()) { ------------------ | Branch (1128:22): [True: 0, False: 208] ------------------ 1129| 0| m_reg.resize(n); 1130| 208| } else { 1131| 208| m_reg.resize(n + (8 - (n % 8))); 1132| 208| } 1133| 208| } 1134| 226| } _ZNK5Botan6BigInt4Data4sizeEv: 1136| 1.99k| size_t size() const { return m_reg.size(); } _ZN5Botan6BigInt4Data4swapERS1_: 1151| 300| void swap(Data& other) noexcept { 1152| 300| m_reg.swap(other.m_reg); 1153| 300| std::swap(m_sig_words, other.m_sig_words); 1154| 300| } _ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE: 1156| 240| void swap(secure_vector& reg) noexcept { 1157| 240| m_reg.swap(reg); 1158| 240| invalidate_sig_words(); 1159| 240| } _ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv: 1161| 432| void invalidate_sig_words() const noexcept { m_sig_words = sig_words_npos; } _ZNK5Botan6BigInt4Data9sig_wordsEv: 1163| 1.12k| size_t sig_words() const { 1164| 1.12k| if(m_sig_words == sig_words_npos) { ------------------ | Branch (1164:19): [True: 264, False: 864] ------------------ 1165| 264| m_sig_words = calc_sig_words(); 1166| 264| } 1167| 1.12k| return m_sig_words; 1168| 1.12k| } _ZN5BotanplERKNS_6BigIntES2_: 1189| 24|inline BigInt operator+(const BigInt& x, const BigInt& y) { 1190| 24| return BigInt::add2(x, y._data(), y.sig_words(), y.sign()); 1191| 24|} _ZN5BotanmiERKNS_6BigIntEm: 1229| 12|inline BigInt operator-(const BigInt& x, word y) { 1230| 12| return BigInt::add2(x, &y, 1, BigInt::Negative); 1231| 12|} _ZN5BotaneqERKNS_6BigIntES2_: 1313| 12|inline bool operator==(const BigInt& a, const BigInt& b) { 1314| 12| return a.is_equal(b); 1315| 12|} _ZN5BotanneERKNS_6BigIntES2_: 1323| 12|inline bool operator!=(const BigInt& a, const BigInt& b) { 1324| 12| return !a.is_equal(b); 1325| 12|} _ZN5BotangeERKNS_6BigIntES2_: 1343| 24|inline bool operator>=(const BigInt& a, const BigInt& b) { 1344| 24| return (a.cmp(b) >= 0); 1345| 24|} _ZN5BotanltERKNS_6BigIntES2_: 1353| 12|inline bool operator<(const BigInt& a, const BigInt& b) { 1354| 12| return a.is_less_than(b); 1355| 12|} _ZN5BotanneERKNS_6BigIntEm: 1383| 12|inline bool operator!=(const BigInt& a, word b) { 1384| 12| return (a.cmp_word(b) != 0); 1385| 12|} _ZN5BotanltERKNS_6BigIntEm: 1413| 36|inline bool operator<(const BigInt& a, word b) { 1414| 36| return (a.cmp_word(b) < 0); 1415| 36|} _ZN5Botan6BigIntC2Ev: 45| 528| BigInt() = default; _ZN5Botan6BigIntC2ERKS0_: 88| 156| BigInt(const BigInt& other) = default; _ZN5Botan6BigIntaSERKS0_: 201| 12| BigInt& operator=(const BigInt&) = default; _ZN5Botan8CurveGFp4swapERS0_: 82| 12| void swap(CurveGFp& other) noexcept { std::swap(m_group, other.m_group); } _ZN5Botan8CurveGFpC2Ev: 75| 24| CurveGFp() = default; _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassENSt3__14spanIKhLm18446744073709551615EEE: 410| 12| DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, std::span rep) { 411| 12| return add_object(type_tag, class_tag, rep.data(), rep.size()); 412| 12| } _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS3_9allocatorIhEEEE: 421| 12| DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const std::vector& rep) { 422| 12| return add_object(type_tag, class_tag, std::span{rep}); 423| 12| } _ZNK5Botan8EC_Group5_dataEv: 604| 10.4k| const std::shared_ptr& _data() const { return m_data; } _ZN5Botan8EC_PointaSEOS0_: 75| 12| EC_Point& operator=(EC_Point&& other) noexcept { 76| 12| if(this != &other) { ------------------ | Branch (76:13): [True: 12, False: 0] ------------------ 77| 12| this->swap(other); 78| 12| } 79| 12| return (*this); 80| 12| } _ZN5Botan8EC_PointD2Ev: 82| 24| ~EC_Point() = default; _ZN5Botan8EC_PointC2Ev: 49| 12| EC_Point() = default; _ZN5BotanmiERKNS_9EC_ScalarES2_: 244| 2.11k| friend EC_Scalar operator-(const EC_Scalar& x, const EC_Scalar& y) { return x.sub(y); } _ZN5BotanplERKNS_9EC_ScalarES2_: 242| 10.5k| friend EC_Scalar operator+(const EC_Scalar& x, const EC_Scalar& y) { return x.add(y); } _ZN5BotaneqERKNS_9EC_ScalarES2_: 248| 24.9k| friend bool operator==(const EC_Scalar& x, const EC_Scalar& y) { return x.is_eq(y); } _ZN5BotanmlERKNS_9EC_ScalarES2_: 246| 18.9k| friend EC_Scalar operator*(const EC_Scalar& x, const EC_Scalar& y) { return x.mul(y); } _ZNK5Botan9EC_Scalar5innerEv: 296| 257k| const EC_Scalar_Data& inner() const { return *m_scalar; } _ZN5Botan11clear_bytesEPvm: 101| 349|inline constexpr void clear_bytes(void* ptr, size_t bytes) { 102| 349| if(bytes > 0) { ------------------ | Branch (102:7): [True: 277, False: 72] ------------------ 103| 277| std::memset(ptr, 0, bytes); 104| 277| } 105| 349|} _ZN5Botan9clear_memImEEvPT_m: 118| 168|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 168| clear_bytes(ptr, sizeof(T) * n); 120| 168|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEETkNS1_16contiguous_rangeENS3_IKmLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_: 176| 21.3k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 21.3k| ranges::assert_equal_byte_lengths(out, in); 178| 21.3k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 21.3k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEEmQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_: 199| 21.3k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) { 200| 21.3k| typecast_copy(out, std::span(&in, 1)); 201| 21.3k|} _ZN5Botan9clear_memIhEEvPT_m: 118| 79|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 79| clear_bytes(ptr, sizeof(T) * n); 120| 79|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_: 210| 64.0k|inline constexpr ToT typecast_copy(const FromR& src) { 211| 64.0k| ToT dst; // NOLINT(*-member-init) 212| 64.0k| typecast_copy(dst, src); 213| 64.0k| return dst; 214| 64.0k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_: 188| 64.0k|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 64.0k| typecast_copy(std::span(&out, 1), in); 190| 64.0k|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IKhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_: 176| 64.0k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 64.0k| ranges::assert_equal_byte_lengths(out, in); 178| 64.0k| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 64.0k|} _ZN5Botan8copy_memImQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m: 144| 74.9k|inline constexpr void copy_mem(T* out, const T* in, size_t n) { 145| 74.9k| BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null"); ------------------ | | 110| 74.9k| do { \ | | 111| 74.9k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 112| 149k| if((expr1) && !(expr2)) { \ | | ------------------ | | | Branch (112:10): [True: 74.9k, False: 0] | | | Branch (112:23): [True: 74.9k, False: 0] | | | Branch (112:23): [True: 74.9k, False: 0] | | ------------------ | | 113| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 114| 0| Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \ | | 115| 0| } \ | | 116| 74.9k| } while(0) | | ------------------ | | | Branch (116:12): [Folded, False: 74.9k] | | ------------------ ------------------ 146| | 147| 74.9k| if(in != nullptr && out != nullptr && n > 0) { ------------------ | Branch (147:7): [True: 74.9k, False: 0] | Branch (147:24): [True: 74.9k, False: 0] | Branch (147:42): [True: 74.9k, False: 0] ------------------ 148| 74.9k| std::memmove(out, in, sizeof(T) * n); 149| 74.9k| } 150| 74.9k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 4.25k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 4.25k| ranges::assert_equal_byte_lengths(out, in); 162| 4.25k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 4.25k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 4.25k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 4.25k, False: 0] ------------------ 165| 4.25k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 4.25k| } 167| 4.25k|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_: 210| 16|inline constexpr ToT typecast_copy(const FromR& src) { 211| 16| ToT dst; // NOLINT(*-member-init) 212| 16| typecast_copy(dst, src); 213| 16| return dst; 214| 16|} _ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_: 188| 16|inline constexpr void typecast_copy(ToT& out, const FromR& in) { 189| 16| typecast_copy(std::span(&out, 1), in); 190| 16|} _ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_: 176| 16|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) { 177| 16| ranges::assert_equal_byte_lengths(out, in); 178| 16| std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 179| 16|} _ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm18446744073709551615EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS5_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEE: 132| 96|{ 133| 96| clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem)); 134| 96|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm4EEETkNS1_16contiguous_rangeENS2_5arrayImLm4EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 3.97k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 3.97k| ranges::assert_equal_byte_lengths(out, in); 162| 3.97k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 3.97k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 3.97k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 3.97k, False: 0] ------------------ 165| 3.97k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 3.97k| } 167| 3.97k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm6EEETkNS1_16contiguous_rangeENS2_5arrayImLm6EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 1.27k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.27k| ranges::assert_equal_byte_lengths(out, in); 162| 1.27k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.27k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.27k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.27k, False: 0] ------------------ 165| 1.27k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.27k| } 167| 1.27k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm8EEETkNS1_16contiguous_rangeENS2_5arrayImLm8EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 1.35k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.35k| ranges::assert_equal_byte_lengths(out, in); 162| 1.35k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.35k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.35k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.35k, False: 0] ------------------ 165| 1.35k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.35k| } 167| 1.35k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm9EEETkNS1_16contiguous_rangeENS2_5arrayImLm9EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 596|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 596| ranges::assert_equal_byte_lengths(out, in); 162| 596| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 596] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 596| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 596, False: 0] ------------------ 165| 596| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 596| } 167| 596|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm3EEETkNS1_16contiguous_rangeENS2_5arrayImLm3EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_: 160| 1.01k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 1.01k| ranges::assert_equal_byte_lengths(out, in); 162| 1.01k| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 1.01k] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 1.01k| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 1.01k, False: 0] ------------------ 165| 1.01k| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 1.01k| } 167| 1.01k|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm28EEETkNS1_16contiguous_rangeENS3_IKhLm28EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 448|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 448| ranges::assert_equal_byte_lengths(out, in); 162| 448| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 448] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 448| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 448, False: 0] ------------------ 165| 448| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 448| } 167| 448|} _ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm66EEETkNS1_16contiguous_rangeENS3_IKhLm66EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_: 160| 298|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) { 161| 298| ranges::assert_equal_byte_lengths(out, in); 162| 298| if(std::is_constant_evaluated()) { ------------------ | Branch (162:7): [Folded, False: 298] ------------------ 163| 0| std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out)); 164| 298| } else if(ranges::size_bytes(out) > 0) { ------------------ | Branch (164:14): [True: 298, False: 0] ------------------ 165| 298| std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out)); 166| 298| } 167| 298|} _ZN5Botan9clear_memIjEEvPT_m: 118| 6|inline constexpr void clear_mem(T* ptr, size_t n) { 119| 6| clear_bytes(ptr, sizeof(T) * n); 120| 6|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 4.25k|{ 101| 4.25k| const std::span s0{r0}; 102| | 103| | if constexpr(statically_spanable_range) { 104| | constexpr size_t expected_size = s0.size_bytes(); 105| | (assert_exact_byte_length(rs), ...); 106| 4.25k| } else { 107| 4.25k| const size_t expected_size = s0.size_bytes(); 108| 4.25k| const bool correct_size = 109| 4.25k| ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| 4.25k| if(!correct_size) { ------------------ | Branch (111:10): [True: 0, False: 4.25k] ------------------ 112| 0| memory_region_size_violation(); 113| 0| } 114| 4.25k| } 115| 4.25k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEmRKT_: 59| 8.50k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 8.50k| return std::span{r}.size_bytes(); 61| 8.50k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm32ETkNS0_14spanable_rangeENSt3__15arrayImLm4EEEEEvRKT0_: 77| 5.95k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 5.95k| const std::span s{r}; 79| 5.95k| if constexpr(statically_spanable_range) { 80| 5.95k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 5.95k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm32EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.53k|{ 101| 1.53k| const std::span s0{r0}; 102| | 103| 1.53k| if constexpr(statically_spanable_range) { 104| 1.53k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.53k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.53k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEvRKT0_: 77| 42.7k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 42.7k| const std::span s{r}; 79| 42.7k| if constexpr(statically_spanable_range) { 80| 42.7k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 42.7k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKmLm1EEEEEvRKT0_: 77| 21.3k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 21.3k| const std::span s{r}; 79| 21.3k| if constexpr(statically_spanable_range) { 80| 21.3k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 21.3k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm8EEETpTkNS0_14spanable_rangeEJNS3_IKmLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 21.3k|{ 101| 21.3k| const std::span s0{r0}; 102| | 103| 21.3k| if constexpr(statically_spanable_range) { 104| 21.3k| constexpr size_t expected_size = s0.size_bytes(); 105| 21.3k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 21.3k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEmRKT_: 59| 21.3k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 21.3k| return std::span{r}.size_bytes(); 61| 21.3k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKhLm8EEEEEvRKT0_: 77| 128k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 128k| const std::span s{r}; 79| 128k| if constexpr(statically_spanable_range) { 80| 128k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 128k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 64.0k|{ 101| 64.0k| const std::span s0{r0}; 102| | 103| 64.0k| if constexpr(statically_spanable_range) { 104| 64.0k| constexpr size_t expected_size = s0.size_bytes(); 105| 64.0k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 64.0k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm1EEEEEmRKT_: 59| 64.0k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 64.0k| return std::span{r}.size_bytes(); 61| 64.0k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEEEEmRKT_: 59| 96|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 96| return std::span{r}.size_bytes(); 61| 96|} _ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEvRKT0_: 77| 16|inline constexpr void assert_exact_byte_length(const R& r) { 78| 16| const std::span s{r}; 79| 16| if constexpr(statically_spanable_range) { 80| 16| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 16|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 16|{ 101| 16| const std::span s0{r0}; 102| | 103| 16| if constexpr(statically_spanable_range) { 104| 16| constexpr size_t expected_size = s0.size_bytes(); 105| 16| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 16|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm4EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 3.97k|{ 101| 3.97k| const std::span s0{r0}; 102| | 103| 3.97k| if constexpr(statically_spanable_range) { 104| 3.97k| constexpr size_t expected_size = s0.size_bytes(); 105| 3.97k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 3.97k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm4EEEEEmRKT_: 59| 7.94k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 7.94k| return std::span{r}.size_bytes(); 61| 7.94k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm6EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm6EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.27k|{ 101| 1.27k| const std::span s0{r0}; 102| | 103| 1.27k| if constexpr(statically_spanable_range) { 104| 1.27k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.27k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.27k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm48ETkNS0_14spanable_rangeENSt3__15arrayImLm6EEEEEvRKT0_: 77| 1.91k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.91k| const std::span s{r}; 79| 1.91k| if constexpr(statically_spanable_range) { 80| 1.91k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.91k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm6EEEEEmRKT_: 59| 2.55k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2.55k| return std::span{r}.size_bytes(); 61| 2.55k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm48EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm6EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 637|{ 101| 637| const std::span s0{r0}; 102| | 103| 637| if constexpr(statically_spanable_range) { 104| 637| constexpr size_t expected_size = s0.size_bytes(); 105| 637| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 637|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm8EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.35k|{ 101| 1.35k| const std::span s0{r0}; 102| | 103| 1.35k| if constexpr(statically_spanable_range) { 104| 1.35k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.35k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.35k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm64ETkNS0_14spanable_rangeENSt3__15arrayImLm8EEEEEvRKT0_: 77| 2.03k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 2.03k| const std::span s{r}; 79| 2.03k| if constexpr(statically_spanable_range) { 80| 2.03k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 2.03k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm8EEEEEmRKT_: 59| 2.71k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2.71k| return std::span{r}.size_bytes(); 61| 2.71k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm64EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 678|{ 101| 678| const std::span s0{r0}; 102| | 103| 678| if constexpr(statically_spanable_range) { 104| 678| constexpr size_t expected_size = s0.size_bytes(); 105| 678| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 678|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm9EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm9EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 596|{ 101| 596| const std::span s0{r0}; 102| | 103| 596| if constexpr(statically_spanable_range) { 104| 596| constexpr size_t expected_size = s0.size_bytes(); 105| 596| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 596|} _ZN5Botan6ranges24assert_exact_byte_lengthILm72ETkNS0_14spanable_rangeENSt3__15arrayImLm9EEEEEvRKT0_: 77| 894|inline constexpr void assert_exact_byte_length(const R& r) { 78| 894| const std::span s{r}; 79| 894| if constexpr(statically_spanable_range) { 80| 894| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 894|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm9EEEEEmRKT_: 59| 1.19k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 1.19k| return std::span{r}.size_bytes(); 61| 1.19k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm72EEETpTkNS0_14spanable_rangeEJNS3_ImLm9EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 298|{ 101| 298| const std::span s0{r0}; 102| | 103| 298| if constexpr(statically_spanable_range) { 104| 298| constexpr size_t expected_size = s0.size_bytes(); 105| 298| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 298|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm3EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm3EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 1.01k|{ 101| 1.01k| const std::span s0{r0}; 102| | 103| 1.01k| if constexpr(statically_spanable_range) { 104| 1.01k| constexpr size_t expected_size = s0.size_bytes(); 105| 1.01k| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 1.01k|} _ZN5Botan6ranges24assert_exact_byte_lengthILm24ETkNS0_14spanable_rangeENSt3__15arrayImLm3EEEEEvRKT0_: 77| 1.51k|inline constexpr void assert_exact_byte_length(const R& r) { 78| 1.51k| const std::span s{r}; 79| 1.51k| if constexpr(statically_spanable_range) { 80| 1.51k| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 1.51k|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm3EEEEEmRKT_: 59| 2.02k|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 2.02k| return std::span{r}.size_bytes(); 61| 2.02k|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm24EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm3EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 506|{ 101| 506| const std::span s0{r0}; 102| | 103| 506| if constexpr(statically_spanable_range) { 104| 506| constexpr size_t expected_size = s0.size_bytes(); 105| 506| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 506|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm32EEETpTkNS0_14spanable_rangeEJNS3_ImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 448|{ 101| 448| const std::span s0{r0}; 102| | 103| 448| if constexpr(statically_spanable_range) { 104| 448| constexpr size_t expected_size = s0.size_bytes(); 105| 448| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 448|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm28EEETpTkNS0_14spanable_rangeEJNS3_IKhLm28EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 448|{ 101| 448| const std::span s0{r0}; 102| | 103| 448| if constexpr(statically_spanable_range) { 104| 448| constexpr size_t expected_size = s0.size_bytes(); 105| 448| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 448|} _ZN5Botan6ranges24assert_exact_byte_lengthILm28ETkNS0_14spanable_rangeENSt3__14spanIKhLm28EEEEEvRKT0_: 77| 448|inline constexpr void assert_exact_byte_length(const R& r) { 78| 448| const std::span s{r}; 79| 448| if constexpr(statically_spanable_range) { 80| 448| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 448|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm28EEEEEmRKT_: 59| 896|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 896| return std::span{r}.size_bytes(); 61| 896|} _ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm66EEETpTkNS0_14spanable_rangeEJNS3_IKhLm66EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E: 100| 298|{ 101| 298| const std::span s0{r0}; 102| | 103| 298| if constexpr(statically_spanable_range) { 104| 298| constexpr size_t expected_size = s0.size_bytes(); 105| 298| (assert_exact_byte_length(rs), ...); 106| | } else { 107| | const size_t expected_size = s0.size_bytes(); 108| | const bool correct_size = 109| | ((std::span>{rs}.size_bytes() == expected_size) && ...); 110| | 111| | if(!correct_size) { 112| | memory_region_size_violation(); 113| | } 114| | } 115| 298|} _ZN5Botan6ranges24assert_exact_byte_lengthILm66ETkNS0_14spanable_rangeENSt3__14spanIKhLm66EEEEEvRKT0_: 77| 298|inline constexpr void assert_exact_byte_length(const R& r) { 78| 298| const std::span s{r}; 79| 298| if constexpr(statically_spanable_range) { 80| 298| static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths"); 81| | } else { 82| | if(s.size_bytes() != expected) { 83| | memory_region_size_violation(); 84| | } 85| | } 86| 298|} _ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm66EEEEEmRKT_: 59| 596|inline constexpr size_t size_bytes(const spanable_range auto& r) { 60| 596| return std::span{r}.size_bytes(); 61| 596|} _ZN5Botan16secure_allocatorIhE10deallocateEPhm: 102| 86| void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); } _ZN5Botan16secure_allocatorIhE8allocateEm: 95| 86| T* allocate(std::size_t n) { return static_cast(allocate_memory(n, sizeof(T))); } _ZN5Botan16secure_allocatorImE10deallocateEPmm: 102| 952| void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); } _ZN5Botan16secure_allocatorImE8allocateEm: 95| 952| T* allocate(std::size_t n) { return static_cast(allocate_memory(n, sizeof(T))); } _ZN5BotanneIhhEEbRKNS_16secure_allocatorIT_EERKNS1_IT0_EE: 123| 72|inline bool operator!=(const secure_allocator& /*a*/, const secure_allocator& /*b*/) { 124| 72| return false; 125| 72|} _ZN5BotanpLIhNS_16secure_allocatorIhEES2_EERNSt3__16vectorIT_T0_EES8_RKNS4_IS5_T1_EE: 168| 7|std::vector& operator+=(std::vector& out, const std::vector& in) { 169| 7| out.insert(out.end(), in.begin(), in.end()); 170| 7| return out; 171| 7|} _ZN5Botan18unwrap_strong_typeIRmEEDcOT_: 119| 21.3k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) { 120| 21.3k| if constexpr(!concepts::strong_type>) { 121| | // If the parameter type isn't a strong type, return it as is. 122| 21.3k| return std::forward(t); 123| | } else { 124| | // Unwrap the strong type and return the underlying value. 125| | return std::forward(t).get(); 126| | } 127| 21.3k|} _ZN5Botan16wrap_strong_typeImRmQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_: 144| 64.0k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) { 145| 64.0k| if constexpr(std::same_as, T>) { 146| | // Noop, if the parameter type already is the desired return type. 147| 64.0k| return std::forward(t); 148| | } else if constexpr(std::constructible_from) { 149| | // Implicit conversion from the parameter type to the return type. 150| | return T{std::forward(t)}; 151| | } else { 152| | // Explicitly calling the wrapped type's constructor to support 153| | // implicit conversions on types that mark their constructors as explicit. 154| | static_assert(concepts::strong_type && std::constructible_from); 155| | return T{typename T::wrapped_type{std::forward(t)}}; 156| | } 157| 64.0k|} _Z4fuzzNSt3__14spanIKhLm18446744073709551615EEE: 96| 2.16k|void fuzz(std::span in) { 97| | // First byte selects the curve 98| 2.16k| if(in.empty()) { ------------------ | Branch (98:7): [True: 0, False: 2.16k] ------------------ 99| 0| return; 100| 0| } 101| | 102| 2.16k| const uint8_t curve_id = in[0]; 103| 2.16k| const auto data = in.subspan(1); 104| | 105| 2.16k| static const Botan::EC_Group p192 = Botan::EC_Group::from_name("secp192r1"); 106| 2.16k| static const Botan::EC_Group p224 = Botan::EC_Group::from_name("secp224r1"); 107| 2.16k| static const Botan::EC_Group p256 = Botan::EC_Group::from_name("secp256r1"); 108| 2.16k| static const Botan::EC_Group p384 = Botan::EC_Group::from_name("secp384r1"); 109| 2.16k| static const Botan::EC_Group p521 = Botan::EC_Group::from_name("secp521r1"); 110| 2.16k| static const Botan::EC_Group bp256 = Botan::EC_Group::from_name("brainpool256r1"); 111| 2.16k| static const Botan::EC_Group bp384 = Botan::EC_Group::from_name("brainpool384r1"); 112| 2.16k| static const Botan::EC_Group bp512 = Botan::EC_Group::from_name("brainpool512r1"); 113| 2.16k| static const Botan::EC_Group k256 = Botan::EC_Group::from_name("secp256k1"); 114| 2.16k| static const Botan::EC_Group frp256 = Botan::EC_Group::from_name("frp256v1"); 115| 2.16k| static const Botan::EC_Group sm2 = Botan::EC_Group::from_name("sm2p256v1"); 116| 2.16k| static const Botan::EC_Group numsp512 = Botan::EC_Group::from_name("numsp512d1"); 117| | 118| 2.16k| constexpr size_t total_curves = 12; 119| | 120| | // NOLINTNEXTLINE(*-avoid-c-arrays) 121| 2.16k| std::array curves{ 122| 2.16k| &p192, 123| 2.16k| &p224, 124| 2.16k| &p256, 125| 2.16k| &p384, 126| 2.16k| &p521, 127| 2.16k| &bp256, 128| 2.16k| &bp384, 129| 2.16k| &bp512, 130| 2.16k| &k256, 131| 2.16k| &frp256, 132| 2.16k| &sm2, 133| 2.16k| &numsp512, 134| 2.16k| }; 135| | 136| 2.16k| const auto& group = *curves[curve_id % total_curves]; 137| 2.16k| check_scalar_arith(group, data); 138| 2.16k|} ec_scalar.cpp:_ZN12_GLOBAL__N_118check_scalar_arithERKN5Botan8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 14| 2.16k|void check_scalar_arith(const Botan::EC_Group& group, std::span in) { 15| | // Need at least 2 scalars worth of input 16| 2.16k| const size_t scalar_bytes = group.get_order_bytes(); 17| | 18| 2.16k| if(in.size() < 2 * scalar_bytes || in.size() > 2 * 2 * scalar_bytes) { ------------------ | Branch (18:7): [True: 11, False: 2.15k] | Branch (18:39): [True: 38, False: 2.11k] ------------------ 19| 49| return; 20| 49| } 21| | 22| 2.11k| const auto a = Botan::EC_Scalar::from_bytes_mod_order(group, in.first(in.size() / 2)); 23| 2.11k| const auto b = Botan::EC_Scalar::from_bytes_mod_order(group, in.last(in.size() / 2)); 24| | 25| 2.11k| const auto one = Botan::EC_Scalar::one(group); 26| | 27| | // a - a == 0 28| 2.11k| FUZZER_ASSERT_TRUE((a - a).is_zero()); ------------------ | | 89| 2.11k| do { \ | | 90| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.11k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.11k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.11k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.11k] | | ------------------ ------------------ 29| | 30| | // a + (-a) == 0 31| 2.11k| FUZZER_ASSERT_TRUE((a + a.negate()).is_zero()); ------------------ | | 89| 2.11k| do { \ | | 90| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.11k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.11k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.11k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.11k] | | ------------------ ------------------ 32| | 33| | // a * 1 == a 34| 2.11k| FUZZER_ASSERT_TRUE((a * one) == a); ------------------ | | 89| 2.11k| do { \ | | 90| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.11k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.11k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.11k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.11k] | | ------------------ ------------------ 35| | 36| | // a + b == b + a (commutativity) 37| 2.11k| FUZZER_ASSERT_TRUE((a + b) == (b + a)); ------------------ | | 89| 2.11k| do { \ | | 90| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.11k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.11k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.11k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.11k] | | ------------------ ------------------ 38| | 39| | // a * b == b * a (commutativity) 40| 2.11k| FUZZER_ASSERT_TRUE((a * b) == (b * a)); ------------------ | | 89| 2.11k| do { \ | | 90| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.11k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.11k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.11k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.11k] | | ------------------ ------------------ 41| | 42| 2.11k| if(!a.is_zero()) { ------------------ | Branch (42:7): [True: 2.05k, False: 66] ------------------ 43| 2.05k| const auto a_inv = a.invert(); 44| 2.05k| const auto a_inv_vt = a.invert_vartime(); 45| | 46| | // invert and invert_vartime agree 47| 2.05k| FUZZER_ASSERT_TRUE(a_inv == a_inv_vt); ------------------ | | 89| 2.05k| do { \ | | 90| 2.05k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.05k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.05k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.05k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.05k] | | ------------------ ------------------ 48| | 49| | // a * a^-1 == 1 50| 2.05k| FUZZER_ASSERT_TRUE((a * a_inv) == one); ------------------ | | 89| 2.05k| do { \ | | 90| 2.05k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.05k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.05k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.05k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.05k] | | ------------------ ------------------ 51| | 52| | // (a^-1)^-1 == a 53| 2.05k| FUZZER_ASSERT_TRUE(a_inv.invert() == a); ------------------ | | 89| 2.05k| do { \ | | 90| 2.05k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.05k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.05k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.05k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.05k] | | ------------------ ------------------ 54| 2.05k| } 55| | 56| 2.11k| if(!b.is_zero()) { ------------------ | Branch (56:7): [True: 2.04k, False: 70] ------------------ 57| 2.04k| const auto b_inv = b.invert(); 58| 2.04k| const auto b_inv_vt = b.invert_vartime(); 59| | 60| 2.04k| FUZZER_ASSERT_TRUE(b_inv == b_inv_vt); ------------------ | | 89| 2.04k| do { \ | | 90| 2.04k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.04k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.04k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.04k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.04k] | | ------------------ ------------------ 61| 2.04k| FUZZER_ASSERT_TRUE((b * b_inv) == one); ------------------ | | 89| 2.04k| do { \ | | 90| 2.04k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.04k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.04k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.04k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.04k] | | ------------------ ------------------ 62| 2.04k| } 63| | 64| | // (a + b) * c == a*c + b*c for c = a (distributivity, reusing a as c) 65| 2.11k| FUZZER_ASSERT_TRUE((a + b) * a == (a * a + b * a)); ------------------ | | 89| 2.11k| do { \ | | 90| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.11k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.11k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.11k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.11k] | | ------------------ ------------------ 66| | 67| | // square_self: a^2 == a * a 68| 2.11k| auto a_sq = Botan::EC_Scalar(a); 69| 2.11k| a_sq.square_self(); 70| 2.11k| FUZZER_ASSERT_TRUE(a_sq == (a * a)); ------------------ | | 89| 2.11k| do { \ | | 90| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.11k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.11k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.11k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.11k] | | ------------------ ------------------ 71| | 72| | /* 73| | Serialization round-trip tests 74| | 75| | The value of zero can be serialized but *not* deserialized 76| | */ 77| 2.11k| if(!a.is_zero()) { ------------------ | Branch (77:7): [True: 2.05k, False: 66] ------------------ 78| 2.05k| std::vector a_bytes(scalar_bytes); 79| 2.05k| a.serialize_to(a_bytes); 80| 2.05k| const auto a_rt = Botan::EC_Scalar::deserialize(group, a_bytes); 81| 2.05k| FUZZER_ASSERT_TRUE(a_rt.has_value()); ------------------ | | 89| 2.05k| do { \ | | 90| 2.05k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.05k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.05k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.05k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.05k] | | ------------------ ------------------ 82| 2.05k| FUZZER_ASSERT_TRUE(a_rt.value() == a); ------------------ | | 89| 2.05k| do { \ | | 90| 2.05k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.05k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.05k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.05k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.05k] | | ------------------ ------------------ 83| 2.05k| } 84| | 85| 2.11k| if(!b.is_zero()) { ------------------ | Branch (85:7): [True: 2.04k, False: 70] ------------------ 86| 2.04k| std::vector b_bytes(scalar_bytes); 87| 2.04k| b.serialize_to(b_bytes); 88| 2.04k| const auto b_rt = Botan::EC_Scalar::deserialize(group, b_bytes); 89| 2.04k| FUZZER_ASSERT_TRUE(b_rt.has_value()); ------------------ | | 89| 2.04k| do { \ | | 90| 2.04k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.04k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.04k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.04k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.04k] | | ------------------ ------------------ 90| 2.04k| FUZZER_ASSERT_TRUE(b_rt.value() == b); ------------------ | | 89| 2.04k| do { \ | | 90| 2.04k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 91| 2.04k| if(!(e)) { \ | | ------------------ | | | Branch (91:10): [True: 0, False: 2.04k] | | ------------------ | | 92| 0| FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \ | | ------------------ | | | | 70| 0| do { \ | | | | 71| 0| std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \ | | | | 72| 0| abort(); \ | | | | 73| 0| } while(0) | | | | ------------------ | | | | | Branch (73:12): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 93| 0| } \ | | 94| 2.04k| } while(0) | | ------------------ | | | Branch (94:12): [Folded, False: 2.04k] | | ------------------ ------------------ 91| 2.04k| } 92| 2.11k|} LLVMFuzzerInitialize: 28| 2|extern "C" int LLVMFuzzerInitialize(int* /*argc*/, char*** /*argv*/) { 29| | /* 30| | * This disables the mlock pool, as overwrites within the pool are 31| | * opaque to ASan or other instrumentation. 32| | */ 33| 2| ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1); 34| 2| return 0; 35| 2|} LLVMFuzzerTestOneInput: 39| 2.17k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) { 40| 2.17k| if(len <= max_fuzzer_input_size) { ------------------ | Branch (40:7): [True: 2.16k, False: 7] ------------------ 41| 2.16k| try { 42| 2.16k| fuzz(std::span(in, len)); 43| 2.16k| } catch(const std::exception& e) { 44| 0| std::cerr << "Uncaught exception from fuzzer driver " << e.what() << "\n"; 45| 0| abort(); 46| 0| } catch(...) { 47| 0| std::cerr << "Uncaught exception from fuzzer driver (unknown type)\n"; 48| 0| abort(); 49| 0| } 50| 2.16k| } 51| 2.17k| return 0; 52| 2.17k|} _ZN5Botan3OID9from_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 66| 12|std::optional OID::from_name(std::string_view name) { 67| 12| if(name.empty()) { ------------------ | Branch (67:7): [True: 0, False: 12] ------------------ 68| 0| throw Invalid_Argument("OID::from_name argument must be non-empty"); 69| 0| } 70| | 71| 12| OID o = OID_Map::global_registry().str2oid(name); 72| 12| if(o.has_value()) { ------------------ | Branch (72:7): [True: 12, False: 0] ------------------ 73| 12| return std::optional(o); 74| 12| } 75| | 76| 0| return std::nullopt; 77| 12|} _ZN5Botan3OIDC2ESt16initializer_listIjE: 98| 196|OID::OID(std::initializer_list init) : m_id(init) { 99| 196| oid_valid_check(m_id); 100| 196|} _ZNK5Botan3OID15registered_nameEv: 149| 12|std::optional OID::registered_name() const { 150| 12| return OID_Map::global_registry().oid2str(*this); 151| 12|} _ZNK5Botan3OID7matchesESt16initializer_listIjE: 157| 12|bool OID::matches(std::initializer_list other) const { 158| | // TODO: once all target compilers support it, use std::ranges::equal 159| 12| return std::equal(m_id.begin(), m_id.end(), other.begin(), other.end()); 160| 12|} _ZNK5Botan3OID9hash_codeEv: 162| 16|uint64_t OID::hash_code() const { 163| | // If this is changed also update gen_oids.py to match 164| 16| uint64_t hash = 0x621F302327D9A49A; 165| 119| for(const auto id : m_id) { ------------------ | Branch (165:22): [True: 119, False: 16] ------------------ 166| 119| hash *= 193; 167| 119| hash += id; 168| 119| } 169| 16| return hash; 170| 16|} _ZNK5Botan3OID11encode_intoERNS_11DER_EncoderE: 185| 12|void OID::encode_into(DER_Encoder& der) const { 186| 12| if(m_id.size() < 2) { ------------------ | Branch (186:7): [True: 0, False: 12] ------------------ 187| 0| throw Invalid_Argument("OID::encode_into: OID is invalid"); 188| 0| } 189| | 190| 12| const auto append = [](std::vector& encoding, uint32_t z) { 191| 12| if(z <= 0x7F) { 192| 12| encoding.push_back(static_cast(z)); 193| 12| } else { 194| 12| const size_t z7 = (high_bit(z) + 7 - 1) / 7; 195| | 196| 12| for(size_t j = 0; j != z7; ++j) { 197| 12| uint8_t zp = static_cast(z >> (7 * (z7 - j - 1)) & 0x7F); 198| | 199| 12| if(j != z7 - 1) { 200| 12| zp |= 0x80; 201| 12| } 202| | 203| 12| encoding.push_back(zp); 204| 12| } 205| 12| } 206| 12| }; 207| | 208| 12| std::vector encoding; 209| | 210| | // We know 40 * root can't overflow because root is between 0 and 2 211| 12| auto first = checked_add(40 * m_id[0], m_id[1]); 212| 12| BOTAN_ASSERT_NOMSG(first.has_value()); ------------------ | | 84| 12| do { \ | | 85| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 12| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 12] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 12| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 12] | | ------------------ ------------------ 213| | 214| 12| append(encoding, *first); 215| | 216| 75| for(size_t i = 2; i != m_id.size(); ++i) { ------------------ | Branch (216:22): [True: 63, False: 12] ------------------ 217| 63| append(encoding, m_id[i]); 218| 63| } 219| 12| der.add_object(ASN1_Type::ObjectId, ASN1_Class::Universal, encoding); 220| 12|} asn1_oid.cpp:_ZN5Botan12_GLOBAL__N_115oid_valid_checkENSt3__14spanIKjLm18446744073709551615EEE: 26| 196|void oid_valid_check(std::span oid) { 27| 196| BOTAN_ARG_CHECK(oid.size() >= 2, "OID too short to be valid"); ------------------ | | 35| 196| do { \ | | 36| 196| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 196| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 196] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 196| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 196] | | ------------------ ------------------ 28| 196| BOTAN_ARG_CHECK(oid[0] <= 2, "OID root out of range"); ------------------ | | 35| 196| do { \ | | 36| 196| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 196| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 196] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 196| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 196] | | ------------------ ------------------ 29| 196| BOTAN_ARG_CHECK(oid[1] <= 39 || oid[0] == 2, "OID second arc too large"); ------------------ | | 35| 196| do { \ | | 36| 196| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 196| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 196, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 196| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 196] | | ------------------ ------------------ 30| | // This last is a limitation of using 32 bit integers when decoding 31| | // not a limitation of ASN.1 object identifiers in general 32| 196| BOTAN_ARG_CHECK(oid[1] <= 0xFFFFFFAF, "OID second arc too large"); ------------------ | | 35| 196| do { \ | | 36| 196| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 196| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 196] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 196| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 196] | | ------------------ ------------------ 33| 196|} asn1_oid.cpp:_ZZNK5Botan3OID11encode_intoERNS_11DER_EncoderEENK3$_0clERNSt3__16vectorIhNS4_9allocatorIhEEEEj: 190| 75| const auto append = [](std::vector& encoding, uint32_t z) { 191| 75| if(z <= 0x7F) { ------------------ | Branch (191:10): [True: 60, False: 15] ------------------ 192| 60| encoding.push_back(static_cast(z)); 193| 60| } else { 194| 15| const size_t z7 = (high_bit(z) + 7 - 1) / 7; 195| | 196| 46| for(size_t j = 0; j != z7; ++j) { ------------------ | Branch (196:28): [True: 31, False: 15] ------------------ 197| 31| uint8_t zp = static_cast(z >> (7 * (z7 - j - 1)) & 0x7F); 198| | 199| 31| if(j != z7 - 1) { ------------------ | Branch (199:16): [True: 16, False: 15] ------------------ 200| 16| zp |= 0x80; 201| 16| } 202| | 203| 31| encoding.push_back(zp); 204| 31| } 205| 15| } 206| 75| }; _ZN5Botan11DER_EncoderC2ERNSt3__16vectorIhNS1_9allocatorIhEEEE: 89| 12|DER_Encoder::DER_Encoder(std::vector& vec) { 90| 12| m_append_output = [&vec](const uint8_t b[], size_t l) { 91| 12| if(l > 0) { 92| 12| vec.insert(vec.end(), b, b + l); 93| 12| } 94| 12| }; 95| 12|} _ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassEPKhm: 285| 12|DER_Encoder& DER_Encoder::add_object(ASN1_Type type_tag, ASN1_Class class_tag, const uint8_t rep[], size_t length) { 286| 12| std::vector hdr; 287| 12| encode_tag(hdr, type_tag, class_tag); 288| 12| encode_length(hdr, length); 289| | 290| 12| if(!m_subsequences.empty()) { ------------------ | Branch (290:7): [True: 0, False: 12] ------------------ 291| 0| m_subsequences[m_subsequences.size() - 1].add_bytes(hdr.data(), hdr.size(), rep, length); 292| 12| } else if(m_append_output) { ------------------ | Branch (292:14): [True: 12, False: 0] ------------------ 293| 12| m_append_output(hdr.data(), hdr.size()); 294| 12| m_append_output(rep, length); 295| 12| } else { 296| 0| m_default_outbuf += hdr; 297| 0| m_default_outbuf += std::make_pair(rep, length); 298| 0| } 299| | 300| 12| return (*this); 301| 12|} _ZN5Botan11DER_Encoder6encodeERKNS_11ASN1_ObjectE: 467| 12|DER_Encoder& DER_Encoder::encode(const ASN1_Object& obj) { 468| 12| obj.encode_into(*this); 469| 12| return (*this); 470| 12|} der_enc.cpp:_ZN5Botan12_GLOBAL__N_110encode_tagERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeENS_10ASN1_ClassE: 26| 12|void encode_tag(std::vector& encoded_tag, ASN1_Type type_tag_e, ASN1_Class class_tag_e) { 27| 12| const uint32_t type_tag = static_cast(type_tag_e); 28| 12| const uint32_t class_tag = static_cast(class_tag_e); 29| | 30| 12| if((class_tag | 0xE0) != 0xE0) { ------------------ | Branch (30:7): [True: 0, False: 12] ------------------ 31| 0| throw Encoding_Error(fmt("DER_Encoder: Invalid class tag {}", std::to_string(class_tag))); 32| 0| } 33| | 34| 12| if(type_tag <= 30) { ------------------ | Branch (34:7): [True: 12, False: 0] ------------------ 35| 12| encoded_tag.push_back(static_cast(type_tag | class_tag)); 36| 12| } else { 37| 0| size_t blocks = high_bit(static_cast(type_tag)) + 6; 38| 0| blocks = (blocks - (blocks % 7)) / 7; 39| | 40| 0| BOTAN_ASSERT_NOMSG(blocks > 0); ------------------ | | 84| 0| do { \ | | 85| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 0| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 0] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 0| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 0] | | ------------------ ------------------ 41| | 42| 0| encoded_tag.push_back(static_cast(class_tag | 0x1F)); 43| 0| for(size_t i = 0; i != blocks - 1; ++i) { ------------------ | Branch (43:25): [True: 0, False: 0] ------------------ 44| 0| encoded_tag.push_back(0x80 | ((type_tag >> 7 * (blocks - i - 1)) & 0x7F)); 45| 0| } 46| 0| encoded_tag.push_back(type_tag & 0x7F); 47| 0| } 48| 12|} der_enc.cpp:_ZN5Botan12_GLOBAL__N_113encode_lengthERNSt3__16vectorIhNS1_9allocatorIhEEEEm: 53| 12|void encode_length(std::vector& encoded_length, size_t length) { 54| 12| if(length <= 127) { ------------------ | Branch (54:7): [True: 12, False: 0] ------------------ 55| 12| encoded_length.push_back(static_cast(length)); 56| 12| } else { 57| 0| const size_t bytes_needed = significant_bytes(length); 58| | 59| 0| encoded_length.push_back(static_cast(0x80 | bytes_needed)); 60| | 61| 0| for(size_t i = sizeof(length) - bytes_needed; i < sizeof(length); ++i) { ------------------ | Branch (61:53): [True: 0, False: 0] ------------------ 62| 0| encoded_length.push_back(get_byte_var(i, length)); 63| 0| } 64| 0| } 65| 12|} der_enc.cpp:_ZZN5Botan11DER_EncoderC1ERNSt3__16vectorIhNS1_9allocatorIhEEEEENK3$_0clEPKhm: 90| 24| m_append_output = [&vec](const uint8_t b[], size_t l) { 91| 24| if(l > 0) { ------------------ | Branch (91:10): [True: 24, False: 0] ------------------ 92| 24| vec.insert(vec.end(), b, b + l); 93| 24| } 94| 24| }; _ZN5Botan7OID_MapC2Ev: 11| 1|OID_Map::OID_Map() { 12| 1| m_str2oid = OID_Map::load_str2oid_map(); 13| 1| m_oid2str = OID_Map::load_oid2str_map(); 14| 1|} _ZN5Botan7OID_Map15global_registryEv: 16| 24|OID_Map& OID_Map::global_registry() { 17| 24| static OID_Map g_map; 18| 24| return g_map; 19| 24|} _ZN5Botan7OID_Map7oid2strERKNS_3OIDE: 73| 12|std::optional OID_Map::oid2str(const OID& oid) { 74| 12| if(auto name = lookup_static_oid(oid)) { ------------------ | Branch (74:12): [True: 12, False: 0] ------------------ 75| 12| return std::string(*name); 76| 12| } 77| | 78| 0| const lock_guard_type lock(m_mutex); 79| | 80| 0| const auto i = m_oid2str.find(oid); 81| 0| if(i != m_oid2str.end()) { ------------------ | Branch (81:7): [True: 0, False: 0] ------------------ 82| 0| return i->second; 83| 0| } 84| | 85| 0| return {}; 86| 0|} _ZN5Botan7OID_Map7str2oidENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 88| 12|OID OID_Map::str2oid(std::string_view str) { 89| 12| if(auto oid = lookup_static_oid_name(str)) { ------------------ | Branch (89:12): [True: 12, False: 0] ------------------ 90| 12| return std::move(*oid); 91| 12| } 92| | 93| 0| const lock_guard_type lock(m_mutex); 94| 0| const auto i = m_str2oid.find(std::string(str)); 95| 0| if(i != m_str2oid.end()) { ------------------ | Branch (95:7): [True: 0, False: 0] ------------------ 96| 0| return i->second; 97| 0| } 98| | 99| 0| return OID(); 100| 0|} _ZN5Botan7OID_Map17lookup_static_oidERKNS_3OIDE: 48| 12|std::optional OID_Map::lookup_static_oid(const OID& oid) { 49| 12| const uint32_t hc = static_cast(oid.hash_code() % 858701); 50| | 51| 12| switch(hc) { 52| 0| case 0x01506: ------------------ | Branch (52:7): [True: 0, False: 12] ------------------ 53| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 1}, "ECDSA/SHA-224"); 54| 0| case 0x01507: ------------------ | Branch (54:7): [True: 0, False: 12] ------------------ 55| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 2}, "ECDSA/SHA-256"); 56| 0| case 0x01508: ------------------ | Branch (56:7): [True: 0, False: 12] ------------------ 57| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 3}, "ECDSA/SHA-384"); 58| 0| case 0x01509: ------------------ | Branch (58:7): [True: 0, False: 12] ------------------ 59| 0| return if_match(oid, {1, 2, 840, 10045, 4, 3, 4}, "ECDSA/SHA-512"); 60| 0| case 0x04C1E: ------------------ | Branch (60:7): [True: 0, False: 12] ------------------ 61| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1}, "ElGamal"); 62| 0| case 0x04E61: ------------------ | Branch (62:7): [True: 0, False: 12] ------------------ 63| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1}, "OpenPGP.Curve25519"); 64| 0| case 0x0779B: ------------------ | Branch (64:7): [True: 0, False: 12] ------------------ 65| 0| return if_match(oid, {1, 2, 840, 113549, 2, 5}, "MD5"); 66| 0| case 0x0779D: ------------------ | Branch (66:7): [True: 0, False: 12] ------------------ 67| 0| return if_match(oid, {1, 2, 840, 113549, 2, 7}, "HMAC(SHA-1)"); 68| 0| case 0x0779E: ------------------ | Branch (68:7): [True: 0, False: 12] ------------------ 69| 0| return if_match(oid, {1, 2, 840, 113549, 2, 8}, "HMAC(SHA-224)"); 70| 0| case 0x0779F: ------------------ | Branch (70:7): [True: 0, False: 12] ------------------ 71| 0| return if_match(oid, {1, 2, 840, 113549, 2, 9}, "HMAC(SHA-256)"); 72| 0| case 0x077A0: ------------------ | Branch (72:7): [True: 0, False: 12] ------------------ 73| 0| return if_match(oid, {1, 2, 840, 113549, 2, 10}, "HMAC(SHA-384)"); 74| 0| case 0x077A1: ------------------ | Branch (74:7): [True: 0, False: 12] ------------------ 75| 0| return if_match(oid, {1, 2, 840, 113549, 2, 11}, "HMAC(SHA-512)"); 76| 0| case 0x077A3: ------------------ | Branch (76:7): [True: 0, False: 12] ------------------ 77| 0| return if_match(oid, {1, 2, 840, 113549, 2, 13}, "HMAC(SHA-512-256)"); 78| 0| case 0x0785E: ------------------ | Branch (78:7): [True: 0, False: 12] ------------------ 79| 0| return if_match(oid, {1, 2, 840, 113549, 3, 7}, "TripleDES/CBC"); 80| 0| case 0x0C904: ------------------ | Branch (80:7): [True: 0, False: 12] ------------------ 81| 0| return if_match(oid, {1, 0, 14888, 3, 0, 5}, "ECKCDSA"); 82| 0| case 0x11547: ------------------ | Branch (82:7): [True: 0, False: 12] ------------------ 83| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1}, "SphincsPlus-shake-128s-r3.1"); 84| 0| case 0x11548: ------------------ | Branch (84:7): [True: 0, False: 12] ------------------ 85| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2}, "SphincsPlus-shake-128f-r3.1"); 86| 0| case 0x11549: ------------------ | Branch (86:7): [True: 0, False: 12] ------------------ 87| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3}, "SphincsPlus-shake-192s-r3.1"); 88| 0| case 0x1154A: ------------------ | Branch (88:7): [True: 0, False: 12] ------------------ 89| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4}, "SphincsPlus-shake-192f-r3.1"); 90| 0| case 0x1154B: ------------------ | Branch (90:7): [True: 0, False: 12] ------------------ 91| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5}, "SphincsPlus-shake-256s-r3.1"); 92| 0| case 0x1154C: ------------------ | Branch (92:7): [True: 0, False: 12] ------------------ 93| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6}, "SphincsPlus-shake-256f-r3.1"); 94| 0| case 0x11608: ------------------ | Branch (94:7): [True: 0, False: 12] ------------------ 95| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1}, "SphincsPlus-sha2-128s-r3.1"); 96| 0| case 0x11609: ------------------ | Branch (96:7): [True: 0, False: 12] ------------------ 97| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2}, "SphincsPlus-sha2-128f-r3.1"); 98| 0| case 0x1160A: ------------------ | Branch (98:7): [True: 0, False: 12] ------------------ 99| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3}, "SphincsPlus-sha2-192s-r3.1"); 100| 0| case 0x1160B: ------------------ | Branch (100:7): [True: 0, False: 12] ------------------ 101| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4}, "SphincsPlus-sha2-192f-r3.1"); 102| 0| case 0x1160C: ------------------ | Branch (102:7): [True: 0, False: 12] ------------------ 103| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5}, "SphincsPlus-sha2-256s-r3.1"); 104| 0| case 0x1160D: ------------------ | Branch (104:7): [True: 0, False: 12] ------------------ 105| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6}, "SphincsPlus-sha2-256f-r3.1"); 106| 0| case 0x116C9: ------------------ | Branch (106:7): [True: 0, False: 12] ------------------ 107| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1}, "SphincsPlus-haraka-128s-r3.1"); 108| 0| case 0x116CA: ------------------ | Branch (108:7): [True: 0, False: 12] ------------------ 109| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2}, "SphincsPlus-haraka-128f-r3.1"); 110| 0| case 0x116CB: ------------------ | Branch (110:7): [True: 0, False: 12] ------------------ 111| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3}, "SphincsPlus-haraka-192s-r3.1"); 112| 0| case 0x116CC: ------------------ | Branch (112:7): [True: 0, False: 12] ------------------ 113| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4}, "SphincsPlus-haraka-192f-r3.1"); 114| 0| case 0x116CD: ------------------ | Branch (114:7): [True: 0, False: 12] ------------------ 115| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5}, "SphincsPlus-haraka-256s-r3.1"); 116| 0| case 0x116CE: ------------------ | Branch (116:7): [True: 0, False: 12] ------------------ 117| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6}, "SphincsPlus-haraka-256f-r3.1"); 118| 0| case 0x1533B: ------------------ | Branch (118:7): [True: 0, False: 12] ------------------ 119| 0| return if_match(oid, {1, 2, 156, 10197, 1, 104, 2}, "SM4/CBC"); 120| 0| case 0x15341: ------------------ | Branch (120:7): [True: 0, False: 12] ------------------ 121| 0| return if_match(oid, {1, 2, 156, 10197, 1, 104, 8}, "SM4/GCM"); 122| 0| case 0x1539D: ------------------ | Branch (122:7): [True: 0, False: 12] ------------------ 123| 0| return if_match(oid, {1, 2, 156, 10197, 1, 104, 100}, "SM4/OCB"); 124| 0| case 0x187D7: ------------------ | Branch (124:7): [True: 0, False: 12] ------------------ 125| 0| return if_match(oid, {1, 3, 14, 3, 2, 7}, "DES/CBC"); 126| 0| case 0x187EA: ------------------ | Branch (126:7): [True: 0, False: 12] ------------------ 127| 0| return if_match(oid, {1, 3, 14, 3, 2, 26}, "SHA-1"); 128| 0| case 0x19933: ------------------ | Branch (128:7): [True: 0, False: 12] ------------------ 129| 0| return if_match(oid, {1, 3, 132, 0, 8}, "secp160r1"); 130| 0| case 0x19934: ------------------ | Branch (130:7): [True: 0, False: 12] ------------------ 131| 0| return if_match(oid, {1, 3, 132, 0, 9}, "secp160k1"); 132| 1| case 0x19935: ------------------ | Branch (132:7): [True: 1, False: 11] ------------------ 133| 1| return if_match(oid, {1, 3, 132, 0, 10}, "secp256k1"); 134| 0| case 0x19949: ------------------ | Branch (134:7): [True: 0, False: 12] ------------------ 135| 0| return if_match(oid, {1, 3, 132, 0, 30}, "secp160r2"); 136| 0| case 0x1994A: ------------------ | Branch (136:7): [True: 0, False: 12] ------------------ 137| 0| return if_match(oid, {1, 3, 132, 0, 31}, "secp192k1"); 138| 0| case 0x1994B: ------------------ | Branch (138:7): [True: 0, False: 12] ------------------ 139| 0| return if_match(oid, {1, 3, 132, 0, 32}, "secp224k1"); 140| 1| case 0x1994C: ------------------ | Branch (140:7): [True: 1, False: 11] ------------------ 141| 1| return if_match(oid, {1, 3, 132, 0, 33}, "secp224r1"); 142| 1| case 0x1994D: ------------------ | Branch (142:7): [True: 1, False: 11] ------------------ 143| 1| return if_match(oid, {1, 3, 132, 0, 34}, "secp384r1"); 144| 1| case 0x1994E: ------------------ | Branch (144:7): [True: 1, False: 11] ------------------ 145| 1| return if_match(oid, {1, 3, 132, 0, 35}, "secp521r1"); 146| 0| case 0x199F8: ------------------ | Branch (146:7): [True: 0, False: 12] ------------------ 147| 0| return if_match(oid, {1, 3, 132, 1, 12}, "ECDH"); 148| 0| case 0x1E7BF: ------------------ | Branch (148:7): [True: 0, False: 12] ------------------ 149| 0| return if_match(oid, {1, 2, 156, 10197, 1, 301, 1}, "SM2"); 150| 0| case 0x1E7C0: ------------------ | Branch (150:7): [True: 0, False: 12] ------------------ 151| 0| return if_match(oid, {1, 2, 156, 10197, 1, 301, 2}, "SM2_Kex"); 152| 0| case 0x1E7C1: ------------------ | Branch (152:7): [True: 0, False: 12] ------------------ 153| 0| return if_match(oid, {1, 2, 156, 10197, 1, 301, 3}, "SM2_Enc"); 154| 0| case 0x21960: ------------------ | Branch (154:7): [True: 0, False: 12] ------------------ 155| 0| return if_match(oid, {1, 3, 36, 3, 3, 1, 2}, "RSA/PKCS1v15(RIPEMD-160)"); 156| 0| case 0x2198A: ------------------ | Branch (156:7): [True: 0, False: 12] ------------------ 157| 0| return if_match(oid, {1, 2, 840, 113533, 7, 66, 10}, "CAST-128/CBC"); 158| 0| case 0x2198F: ------------------ | Branch (158:7): [True: 0, False: 12] ------------------ 159| 0| return if_match(oid, {1, 2, 840, 113533, 7, 66, 15}, "KeyWrap.CAST-128"); 160| 0| case 0x227C0: ------------------ | Branch (160:7): [True: 0, False: 12] ------------------ 161| 0| return if_match(oid, {1, 3, 101, 110}, "X25519"); 162| 0| case 0x227C1: ------------------ | Branch (162:7): [True: 0, False: 12] ------------------ 163| 0| return if_match(oid, {1, 3, 101, 111}, "X448"); 164| 0| case 0x227C2: ------------------ | Branch (164:7): [True: 0, False: 12] ------------------ 165| 0| return if_match(oid, {1, 3, 101, 112}, "Ed25519"); 166| 0| case 0x227C3: ------------------ | Branch (166:7): [True: 0, False: 12] ------------------ 167| 0| return if_match(oid, {1, 3, 101, 113}, "Ed448"); 168| 0| case 0x27565: ------------------ | Branch (168:7): [True: 0, False: 12] ------------------ 169| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 1}, "PKIX.OCSP.BasicResponse"); 170| 0| case 0x27566: ------------------ | Branch (170:7): [True: 0, False: 12] ------------------ 171| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 2}, "PKIX.OCSP.Nonce"); 172| 0| case 0x27569: ------------------ | Branch (172:7): [True: 0, False: 12] ------------------ 173| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 5}, "PKIX.OCSP.NoCheck"); 174| 0| case 0x29F7C: ------------------ | Branch (174:7): [True: 0, False: 12] ------------------ 175| 0| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 3}, "ECKCDSA/SHA-1"); 176| 0| case 0x29F7D: ------------------ | Branch (176:7): [True: 0, False: 12] ------------------ 177| 0| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 4}, "ECKCDSA/SHA-224"); 178| 0| case 0x29F7E: ------------------ | Branch (178:7): [True: 0, False: 12] ------------------ 179| 0| return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 5}, "ECKCDSA/SHA-256"); 180| 0| case 0x2AC3B: ------------------ | Branch (180:7): [True: 0, False: 12] ------------------ 181| 0| return if_match(oid, {2, 5, 29, 32, 0}, "X509v3.AnyPolicy"); 182| 0| case 0x2B000: ------------------ | Branch (182:7): [True: 0, False: 12] ------------------ 183| 0| return if_match(oid, {2, 5, 29, 37, 0}, "X509v3.AnyExtendedKeyUsage"); 184| 0| case 0x2B5C9: ------------------ | Branch (184:7): [True: 0, False: 12] ------------------ 185| 0| return if_match(oid, {1, 2, 840, 10045, 2, 1}, "ECDSA"); 186| 0| case 0x2B74B: ------------------ | Branch (186:7): [True: 0, False: 12] ------------------ 187| 0| return if_match(oid, {1, 2, 840, 10045, 4, 1}, "ECDSA/SHA-1"); 188| 0| case 0x3474A: ------------------ | Branch (188:7): [True: 0, False: 12] ------------------ 189| 0| return if_match(oid, {1, 2, 840, 10046, 2, 1}, "DH"); 190| 0| case 0x38D6D: ------------------ | Branch (190:7): [True: 0, False: 12] ------------------ 191| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 1}, "gost_256A"); 192| 0| case 0x38D6E: ------------------ | Branch (192:7): [True: 0, False: 12] ------------------ 193| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 2}, "gost_256B"); 194| 0| case 0x38E2E: ------------------ | Branch (194:7): [True: 0, False: 12] ------------------ 195| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 1}, "gost_512A"); 196| 0| case 0x38E2F: ------------------ | Branch (196:7): [True: 0, False: 12] ------------------ 197| 0| return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 2}, "gost_512B"); 198| 0| case 0x38F2C: ------------------ | Branch (198:7): [True: 0, False: 12] ------------------ 199| 0| return if_match(oid, {1, 2, 643, 2, 2, 3}, "GOST-34.10/GOST-R-34.11-94"); 200| 0| case 0x38F3C: ------------------ | Branch (200:7): [True: 0, False: 12] ------------------ 201| 0| return if_match(oid, {1, 2, 643, 2, 2, 19}, "GOST-34.10"); 202| 0| case 0x3D7B8: ------------------ | Branch (202:7): [True: 0, False: 12] ------------------ 203| 0| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 6}, "Camellia-128/GCM"); 204| 0| case 0x3D7CC: ------------------ | Branch (204:7): [True: 0, False: 12] ------------------ 205| 0| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 26}, "Camellia-192/GCM"); 206| 0| case 0x3D7E0: ------------------ | Branch (206:7): [True: 0, False: 12] ------------------ 207| 0| return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 46}, "Camellia-256/GCM"); 208| 0| case 0x3F20F: ------------------ | Branch (208:7): [True: 0, False: 12] ------------------ 209| 0| return if_match(oid, {1, 3, 36, 3, 2, 1}, "RIPEMD-160"); 210| 0| case 0x4266E: ------------------ | Branch (210:7): [True: 0, False: 12] ------------------ 211| 0| return if_match(oid, {0, 4, 0, 127, 0, 15, 1, 1, 13, 0}, "XMSS"); 212| 0| case 0x478C4: ------------------ | Branch (212:7): [True: 0, False: 12] ------------------ 213| 0| return if_match(oid, {1, 2, 410, 200004, 1, 4}, "SEED/CBC"); 214| 1| case 0x47D98: ------------------ | Branch (214:7): [True: 1, False: 11] ------------------ 215| 1| return if_match(oid, {1, 2, 156, 10197, 1, 301}, "sm2p256v1"); 216| 0| case 0x47DFC: ------------------ | Branch (216:7): [True: 0, False: 12] ------------------ 217| 0| return if_match(oid, {1, 2, 156, 10197, 1, 401}, "SM3"); 218| 0| case 0x47E60: ------------------ | Branch (218:7): [True: 0, False: 12] ------------------ 219| 0| return if_match(oid, {1, 2, 156, 10197, 1, 501}, "SM2_Sig/SM3"); 220| 0| case 0x47E63: ------------------ | Branch (220:7): [True: 0, False: 12] ------------------ 221| 0| return if_match(oid, {1, 2, 156, 10197, 1, 504}, "RSA/PKCS1v15(SM3)"); 222| 0| case 0x52B13: ------------------ | Branch (222:7): [True: 0, False: 12] ------------------ 223| 0| return if_match(oid, {1, 2, 643, 3, 131, 1, 1}, "GOST.INN"); 224| 1| case 0x635AE: ------------------ | Branch (224:7): [True: 1, False: 11] ------------------ 225| 1| return if_match(oid, {1, 2, 250, 1, 223, 101, 256, 1}, "frp256v1"); 226| 0| case 0x6A784: ------------------ | Branch (226:7): [True: 0, False: 12] ------------------ 227| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 1}, "PKCS12.KeyBag"); 228| 0| case 0x6A785: ------------------ | Branch (228:7): [True: 0, False: 12] ------------------ 229| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 2}, "PKCS12.PKCS8ShroudedKeyBag"); 230| 0| case 0x6A786: ------------------ | Branch (230:7): [True: 0, False: 12] ------------------ 231| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 3}, "PKCS12.CertBag"); 232| 0| case 0x6A787: ------------------ | Branch (232:7): [True: 0, False: 12] ------------------ 233| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 4}, "PKCS12.CRLBag"); 234| 0| case 0x6A788: ------------------ | Branch (234:7): [True: 0, False: 12] ------------------ 235| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 5}, "PKCS12.SecretBag"); 236| 0| case 0x6A789: ------------------ | Branch (236:7): [True: 0, False: 12] ------------------ 237| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 6}, "PKCS12.SafeContentsBag"); 238| 0| case 0x6EB86: ------------------ | Branch (238:7): [True: 0, False: 12] ------------------ 239| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1}, "GOST-34.10-2012-256/SHA-256"); 240| 0| case 0x6EC47: ------------------ | Branch (240:7): [True: 0, False: 12] ------------------ 241| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1}, "Kyber-512-r3"); 242| 0| case 0x6EC48: ------------------ | Branch (242:7): [True: 0, False: 12] ------------------ 243| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2}, "Kyber-768-r3"); 244| 0| case 0x6EC49: ------------------ | Branch (244:7): [True: 0, False: 12] ------------------ 245| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3}, "Kyber-1024-r3"); 246| 0| case 0x6EDC9: ------------------ | Branch (246:7): [True: 0, False: 12] ------------------ 247| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1}, "Dilithium-4x4-r3"); 248| 0| case 0x6EDCA: ------------------ | Branch (248:7): [True: 0, False: 12] ------------------ 249| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2}, "Dilithium-6x5-r3"); 250| 0| case 0x6EDCB: ------------------ | Branch (250:7): [True: 0, False: 12] ------------------ 251| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3}, "Dilithium-8x7-r3"); 252| 0| case 0x6EE8A: ------------------ | Branch (252:7): [True: 0, False: 12] ------------------ 253| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1}, "Dilithium-4x4-AES-r3"); 254| 0| case 0x6EE8B: ------------------ | Branch (254:7): [True: 0, False: 12] ------------------ 255| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2}, "Dilithium-6x5-AES-r3"); 256| 0| case 0x6EE8C: ------------------ | Branch (256:7): [True: 0, False: 12] ------------------ 257| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3}, "Dilithium-8x7-AES-r3"); 258| 0| case 0x6EF4B: ------------------ | Branch (258:7): [True: 0, False: 12] ------------------ 259| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1}, "Kyber-512-90s-r3"); 260| 0| case 0x6EF4C: ------------------ | Branch (260:7): [True: 0, False: 12] ------------------ 261| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2}, "Kyber-768-90s-r3"); 262| 0| case 0x6EF4D: ------------------ | Branch (262:7): [True: 0, False: 12] ------------------ 263| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3}, "Kyber-1024-90s-r3"); 264| 0| case 0x6F18E: ------------------ | Branch (264:7): [True: 0, False: 12] ------------------ 265| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1}, "FrodoKEM-640-SHAKE"); 266| 0| case 0x6F18F: ------------------ | Branch (266:7): [True: 0, False: 12] ------------------ 267| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2}, "FrodoKEM-976-SHAKE"); 268| 0| case 0x6F190: ------------------ | Branch (268:7): [True: 0, False: 12] ------------------ 269| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3}, "FrodoKEM-1344-SHAKE"); 270| 0| case 0x6F24F: ------------------ | Branch (270:7): [True: 0, False: 12] ------------------ 271| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1}, "FrodoKEM-640-AES"); 272| 0| case 0x6F250: ------------------ | Branch (272:7): [True: 0, False: 12] ------------------ 273| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2}, "FrodoKEM-976-AES"); 274| 0| case 0x6F251: ------------------ | Branch (274:7): [True: 0, False: 12] ------------------ 275| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3}, "FrodoKEM-1344-AES"); 276| 0| case 0x6F310: ------------------ | Branch (276:7): [True: 0, False: 12] ------------------ 277| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1}, "eFrodoKEM-640-SHAKE"); 278| 0| case 0x6F311: ------------------ | Branch (278:7): [True: 0, False: 12] ------------------ 279| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2}, "eFrodoKEM-976-SHAKE"); 280| 0| case 0x6F312: ------------------ | Branch (280:7): [True: 0, False: 12] ------------------ 281| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3}, "eFrodoKEM-1344-SHAKE"); 282| 0| case 0x6F3D1: ------------------ | Branch (282:7): [True: 0, False: 12] ------------------ 283| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1}, "eFrodoKEM-640-AES"); 284| 0| case 0x6F3D2: ------------------ | Branch (284:7): [True: 0, False: 12] ------------------ 285| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2}, "eFrodoKEM-976-AES"); 286| 0| case 0x6F3D3: ------------------ | Branch (286:7): [True: 0, False: 12] ------------------ 287| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3}, "eFrodoKEM-1344-AES"); 288| 0| case 0x6F492: ------------------ | Branch (288:7): [True: 0, False: 12] ------------------ 289| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1}, "ClassicMcEliece_6688128pc"); 290| 0| case 0x6F493: ------------------ | Branch (290:7): [True: 0, False: 12] ------------------ 291| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2}, "ClassicMcEliece_6688128pcf"); 292| 0| case 0x6F494: ------------------ | Branch (292:7): [True: 0, False: 12] ------------------ 293| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3}, "ClassicMcEliece_6960119pc"); 294| 0| case 0x6F495: ------------------ | Branch (294:7): [True: 0, False: 12] ------------------ 295| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4}, "ClassicMcEliece_6960119pcf"); 296| 0| case 0x6F496: ------------------ | Branch (296:7): [True: 0, False: 12] ------------------ 297| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5}, "ClassicMcEliece_8192128pc"); 298| 0| case 0x6F497: ------------------ | Branch (298:7): [True: 0, False: 12] ------------------ 299| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6}, "ClassicMcEliece_8192128pcf"); 300| 0| case 0x6F79D: ------------------ | Branch (300:7): [True: 0, False: 12] ------------------ 301| 0| return if_match(oid, {2, 16, 840, 1, 113730, 1, 13}, "Certificate Comment"); 302| 0| case 0x701A0: ------------------ | Branch (302:7): [True: 0, False: 12] ------------------ 303| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 2, 1}, "ECGDSA"); 304| 0| case 0x70322: ------------------ | Branch (304:7): [True: 0, False: 12] ------------------ 305| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 1}, "ECGDSA/RIPEMD-160"); 306| 0| case 0x70323: ------------------ | Branch (306:7): [True: 0, False: 12] ------------------ 307| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 2}, "ECGDSA/SHA-1"); 308| 0| case 0x70324: ------------------ | Branch (308:7): [True: 0, False: 12] ------------------ 309| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 3}, "ECGDSA/SHA-224"); 310| 0| case 0x70325: ------------------ | Branch (310:7): [True: 0, False: 12] ------------------ 311| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 4}, "ECGDSA/SHA-256"); 312| 0| case 0x70326: ------------------ | Branch (312:7): [True: 0, False: 12] ------------------ 313| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 5}, "ECGDSA/SHA-384"); 314| 0| case 0x70327: ------------------ | Branch (314:7): [True: 0, False: 12] ------------------ 315| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 6}, "ECGDSA/SHA-512"); 316| 0| case 0x72B21: ------------------ | Branch (316:7): [True: 0, False: 12] ------------------ 317| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 1}, "GOST-34.10-2012-256"); 318| 0| case 0x72B22: ------------------ | Branch (318:7): [True: 0, False: 12] ------------------ 319| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 2}, "GOST-34.10-2012-512"); 320| 0| case 0x72BE3: ------------------ | Branch (320:7): [True: 0, False: 12] ------------------ 321| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 2}, "Streebog-256"); 322| 0| case 0x72BE4: ------------------ | Branch (322:7): [True: 0, False: 12] ------------------ 323| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 3}, "Streebog-512"); 324| 0| case 0x72CA4: ------------------ | Branch (324:7): [True: 0, False: 12] ------------------ 325| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 2}, "GOST-34.10-2012-256/Streebog-256"); 326| 0| case 0x72CA5: ------------------ | Branch (326:7): [True: 0, False: 12] ------------------ 327| 0| return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 3}, "GOST-34.10-2012-512/Streebog-512"); 328| 0| case 0x7C7C7: ------------------ | Branch (328:7): [True: 0, False: 12] ------------------ 329| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 1}, "PKCS9.X509Certificate"); 330| 0| case 0x7C7C8: ------------------ | Branch (330:7): [True: 0, False: 12] ------------------ 331| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 2}, "PKCS9.SDSICertificate"); 332| 0| case 0x7C888: ------------------ | Branch (332:7): [True: 0, False: 12] ------------------ 333| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 23, 1}, "PKCS9.X509CRL"); 334| 0| case 0x7E10F: ------------------ | Branch (334:7): [True: 0, False: 12] ------------------ 335| 0| return if_match(oid, {2, 5, 4, 3}, "X520.CommonName"); 336| 0| case 0x7E110: ------------------ | Branch (336:7): [True: 0, False: 12] ------------------ 337| 0| return if_match(oid, {2, 5, 4, 4}, "X520.Surname"); 338| 0| case 0x7E111: ------------------ | Branch (338:7): [True: 0, False: 12] ------------------ 339| 0| return if_match(oid, {2, 5, 4, 5}, "X520.SerialNumber"); 340| 0| case 0x7E112: ------------------ | Branch (340:7): [True: 0, False: 12] ------------------ 341| 0| return if_match(oid, {2, 5, 4, 6}, "X520.Country"); 342| 0| case 0x7E113: ------------------ | Branch (342:7): [True: 0, False: 12] ------------------ 343| 0| return if_match(oid, {2, 5, 4, 7}, "X520.Locality"); 344| 0| case 0x7E114: ------------------ | Branch (344:7): [True: 0, False: 12] ------------------ 345| 0| return if_match(oid, {2, 5, 4, 8}, "X520.State"); 346| 0| case 0x7E115: ------------------ | Branch (346:7): [True: 0, False: 12] ------------------ 347| 0| return if_match(oid, {2, 5, 4, 9}, "X520.StreetAddress"); 348| 0| case 0x7E116: ------------------ | Branch (348:7): [True: 0, False: 12] ------------------ 349| 0| return if_match(oid, {2, 5, 4, 10}, "X520.Organization"); 350| 0| case 0x7E117: ------------------ | Branch (350:7): [True: 0, False: 12] ------------------ 351| 0| return if_match(oid, {2, 5, 4, 11}, "X520.OrganizationalUnit"); 352| 0| case 0x7E118: ------------------ | Branch (352:7): [True: 0, False: 12] ------------------ 353| 0| return if_match(oid, {2, 5, 4, 12}, "X520.Title"); 354| 0| case 0x7E136: ------------------ | Branch (354:7): [True: 0, False: 12] ------------------ 355| 0| return if_match(oid, {2, 5, 4, 42}, "X520.GivenName"); 356| 0| case 0x7E137: ------------------ | Branch (356:7): [True: 0, False: 12] ------------------ 357| 0| return if_match(oid, {2, 5, 4, 43}, "X520.Initials"); 358| 0| case 0x7E138: ------------------ | Branch (358:7): [True: 0, False: 12] ------------------ 359| 0| return if_match(oid, {2, 5, 4, 44}, "X520.GenerationalQualifier"); 360| 0| case 0x7E13A: ------------------ | Branch (360:7): [True: 0, False: 12] ------------------ 361| 0| return if_match(oid, {2, 5, 4, 46}, "X520.DNQualifier"); 362| 0| case 0x7E14D: ------------------ | Branch (362:7): [True: 0, False: 12] ------------------ 363| 0| return if_match(oid, {2, 5, 4, 65}, "X520.Pseudonym"); 364| 0| case 0x7F3F3: ------------------ | Branch (364:7): [True: 0, False: 12] ------------------ 365| 0| return if_match(oid, {2, 5, 29, 14}, "X509v3.SubjectKeyIdentifier"); 366| 0| case 0x7F3F4: ------------------ | Branch (366:7): [True: 0, False: 12] ------------------ 367| 0| return if_match(oid, {2, 5, 29, 15}, "X509v3.KeyUsage"); 368| 0| case 0x7F3F5: ------------------ | Branch (368:7): [True: 0, False: 12] ------------------ 369| 0| return if_match(oid, {2, 5, 29, 16}, "X509v3.PrivateKeyUsagePeriod"); 370| 0| case 0x7F3F6: ------------------ | Branch (370:7): [True: 0, False: 12] ------------------ 371| 0| return if_match(oid, {2, 5, 29, 17}, "X509v3.SubjectAlternativeName"); 372| 0| case 0x7F3F7: ------------------ | Branch (372:7): [True: 0, False: 12] ------------------ 373| 0| return if_match(oid, {2, 5, 29, 18}, "X509v3.IssuerAlternativeName"); 374| 0| case 0x7F3F8: ------------------ | Branch (374:7): [True: 0, False: 12] ------------------ 375| 0| return if_match(oid, {2, 5, 29, 19}, "X509v3.BasicConstraints"); 376| 0| case 0x7F3F9: ------------------ | Branch (376:7): [True: 0, False: 12] ------------------ 377| 0| return if_match(oid, {2, 5, 29, 20}, "X509v3.CRLNumber"); 378| 0| case 0x7F3FA: ------------------ | Branch (378:7): [True: 0, False: 12] ------------------ 379| 0| return if_match(oid, {2, 5, 29, 21}, "X509v3.ReasonCode"); 380| 0| case 0x7F3FC: ------------------ | Branch (380:7): [True: 0, False: 12] ------------------ 381| 0| return if_match(oid, {2, 5, 29, 23}, "X509v3.HoldInstructionCode"); 382| 0| case 0x7F3FD: ------------------ | Branch (382:7): [True: 0, False: 12] ------------------ 383| 0| return if_match(oid, {2, 5, 29, 24}, "X509v3.InvalidityDate"); 384| 0| case 0x7F401: ------------------ | Branch (384:7): [True: 0, False: 12] ------------------ 385| 0| return if_match(oid, {2, 5, 29, 28}, "X509v3.CRLIssuingDistributionPoint"); 386| 0| case 0x7F403: ------------------ | Branch (386:7): [True: 0, False: 12] ------------------ 387| 0| return if_match(oid, {2, 5, 29, 30}, "X509v3.NameConstraints"); 388| 0| case 0x7F404: ------------------ | Branch (388:7): [True: 0, False: 12] ------------------ 389| 0| return if_match(oid, {2, 5, 29, 31}, "X509v3.CRLDistributionPoints"); 390| 0| case 0x7F405: ------------------ | Branch (390:7): [True: 0, False: 12] ------------------ 391| 0| return if_match(oid, {2, 5, 29, 32}, "X509v3.CertificatePolicies"); 392| 0| case 0x7F408: ------------------ | Branch (392:7): [True: 0, False: 12] ------------------ 393| 0| return if_match(oid, {2, 5, 29, 35}, "X509v3.AuthorityKeyIdentifier"); 394| 0| case 0x7F409: ------------------ | Branch (394:7): [True: 0, False: 12] ------------------ 395| 0| return if_match(oid, {2, 5, 29, 36}, "X509v3.PolicyConstraints"); 396| 0| case 0x7F40A: ------------------ | Branch (396:7): [True: 0, False: 12] ------------------ 397| 0| return if_match(oid, {2, 5, 29, 37}, "X509v3.ExtendedKeyUsage"); 398| 0| case 0x7F41D: ------------------ | Branch (398:7): [True: 0, False: 12] ------------------ 399| 0| return if_match(oid, {2, 5, 29, 56}, "X509v3.NoRevocationAvailable"); 400| 0| case 0x80B84: ------------------ | Branch (400:7): [True: 0, False: 12] ------------------ 401| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1}, "AES-128/OCB"); 402| 0| case 0x80B85: ------------------ | Branch (402:7): [True: 0, False: 12] ------------------ 403| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2}, "AES-192/OCB"); 404| 0| case 0x80B86: ------------------ | Branch (404:7): [True: 0, False: 12] ------------------ 405| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3}, "AES-256/OCB"); 406| 0| case 0x80B87: ------------------ | Branch (406:7): [True: 0, False: 12] ------------------ 407| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4}, "Serpent/OCB"); 408| 0| case 0x80B88: ------------------ | Branch (408:7): [True: 0, False: 12] ------------------ 409| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5}, "Twofish/OCB"); 410| 0| case 0x80B89: ------------------ | Branch (410:7): [True: 0, False: 12] ------------------ 411| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6}, "Camellia-128/OCB"); 412| 0| case 0x80B8A: ------------------ | Branch (412:7): [True: 0, False: 12] ------------------ 413| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7}, "Camellia-192/OCB"); 414| 0| case 0x80B8B: ------------------ | Branch (414:7): [True: 0, False: 12] ------------------ 415| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8}, "Camellia-256/OCB"); 416| 0| case 0x80D06: ------------------ | Branch (416:7): [True: 0, False: 12] ------------------ 417| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1}, "AES-128/SIV"); 418| 0| case 0x80D07: ------------------ | Branch (418:7): [True: 0, False: 12] ------------------ 419| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2}, "AES-192/SIV"); 420| 0| case 0x80D08: ------------------ | Branch (420:7): [True: 0, False: 12] ------------------ 421| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3}, "AES-256/SIV"); 422| 0| case 0x80D09: ------------------ | Branch (422:7): [True: 0, False: 12] ------------------ 423| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4}, "Serpent/SIV"); 424| 0| case 0x80D0A: ------------------ | Branch (424:7): [True: 0, False: 12] ------------------ 425| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5}, "Twofish/SIV"); 426| 0| case 0x80D0B: ------------------ | Branch (426:7): [True: 0, False: 12] ------------------ 427| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6}, "Camellia-128/SIV"); 428| 0| case 0x80D0C: ------------------ | Branch (428:7): [True: 0, False: 12] ------------------ 429| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7}, "Camellia-192/SIV"); 430| 0| case 0x80D0D: ------------------ | Branch (430:7): [True: 0, False: 12] ------------------ 431| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8}, "Camellia-256/SIV"); 432| 0| case 0x80D0E: ------------------ | Branch (432:7): [True: 0, False: 12] ------------------ 433| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9}, "SM4/SIV"); 434| 0| case 0x84C6A: ------------------ | Branch (434:7): [True: 0, False: 12] ------------------ 435| 0| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 2}, "Camellia-128/CBC"); 436| 0| case 0x84C6B: ------------------ | Branch (436:7): [True: 0, False: 12] ------------------ 437| 0| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 3}, "Camellia-192/CBC"); 438| 0| case 0x84C6C: ------------------ | Branch (438:7): [True: 0, False: 12] ------------------ 439| 0| return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 4}, "Camellia-256/CBC"); 440| 0| case 0x88CD3: ------------------ | Branch (440:7): [True: 0, False: 12] ------------------ 441| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 6}, "KeyWrap.TripleDES"); 442| 0| case 0x88CD5: ------------------ | Branch (442:7): [True: 0, False: 12] ------------------ 443| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 8}, "Compression.Zlib"); 444| 0| case 0x88CDE: ------------------ | Branch (444:7): [True: 0, False: 12] ------------------ 445| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 17}, "HSS-LMS"); 446| 0| case 0x88CDF: ------------------ | Branch (446:7): [True: 0, False: 12] ------------------ 447| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 18}, "ChaCha20Poly1305"); 448| 0| case 0x92296: ------------------ | Branch (448:7): [True: 0, False: 12] ------------------ 449| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 2}, "AES-128/CBC"); 450| 0| case 0x92299: ------------------ | Branch (450:7): [True: 0, False: 12] ------------------ 451| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 5}, "KeyWrap.AES-128"); 452| 0| case 0x9229A: ------------------ | Branch (452:7): [True: 0, False: 12] ------------------ 453| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 6}, "AES-128/GCM"); 454| 0| case 0x9229B: ------------------ | Branch (454:7): [True: 0, False: 12] ------------------ 455| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 7}, "AES-128/CCM"); 456| 0| case 0x922AA: ------------------ | Branch (456:7): [True: 0, False: 12] ------------------ 457| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 22}, "AES-192/CBC"); 458| 0| case 0x922AD: ------------------ | Branch (458:7): [True: 0, False: 12] ------------------ 459| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 25}, "KeyWrap.AES-192"); 460| 0| case 0x922AE: ------------------ | Branch (460:7): [True: 0, False: 12] ------------------ 461| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 26}, "AES-192/GCM"); 462| 0| case 0x922AF: ------------------ | Branch (462:7): [True: 0, False: 12] ------------------ 463| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 27}, "AES-192/CCM"); 464| 0| case 0x922BE: ------------------ | Branch (464:7): [True: 0, False: 12] ------------------ 465| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 42}, "AES-256/CBC"); 466| 0| case 0x922C1: ------------------ | Branch (466:7): [True: 0, False: 12] ------------------ 467| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 45}, "KeyWrap.AES-256"); 468| 0| case 0x922C2: ------------------ | Branch (468:7): [True: 0, False: 12] ------------------ 469| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 46}, "AES-256/GCM"); 470| 0| case 0x922C3: ------------------ | Branch (470:7): [True: 0, False: 12] ------------------ 471| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 47}, "AES-256/CCM"); 472| 0| case 0x92356: ------------------ | Branch (472:7): [True: 0, False: 12] ------------------ 473| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 1}, "SHA-256"); 474| 0| case 0x92357: ------------------ | Branch (474:7): [True: 0, False: 12] ------------------ 475| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 2}, "SHA-384"); 476| 0| case 0x92358: ------------------ | Branch (476:7): [True: 0, False: 12] ------------------ 477| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 3}, "SHA-512"); 478| 0| case 0x92359: ------------------ | Branch (478:7): [True: 0, False: 12] ------------------ 479| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 4}, "SHA-224"); 480| 0| case 0x9235B: ------------------ | Branch (480:7): [True: 0, False: 12] ------------------ 481| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 6}, "SHA-512-256"); 482| 0| case 0x9235C: ------------------ | Branch (482:7): [True: 0, False: 12] ------------------ 483| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 7}, "SHA-3(224)"); 484| 0| case 0x9235D: ------------------ | Branch (484:7): [True: 0, False: 12] ------------------ 485| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 8}, "SHA-3(256)"); 486| 0| case 0x9235E: ------------------ | Branch (486:7): [True: 0, False: 12] ------------------ 487| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 9}, "SHA-3(384)"); 488| 0| case 0x9235F: ------------------ | Branch (488:7): [True: 0, False: 12] ------------------ 489| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 10}, "SHA-3(512)"); 490| 0| case 0x92360: ------------------ | Branch (490:7): [True: 0, False: 12] ------------------ 491| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 11}, "SHAKE-128"); 492| 0| case 0x92361: ------------------ | Branch (492:7): [True: 0, False: 12] ------------------ 493| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 12}, "SHAKE-256"); 494| 0| case 0x92417: ------------------ | Branch (494:7): [True: 0, False: 12] ------------------ 495| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 1}, "DSA/SHA-224"); 496| 0| case 0x92418: ------------------ | Branch (496:7): [True: 0, False: 12] ------------------ 497| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 2}, "DSA/SHA-256"); 498| 0| case 0x92419: ------------------ | Branch (498:7): [True: 0, False: 12] ------------------ 499| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 3}, "DSA/SHA-384"); 500| 0| case 0x9241A: ------------------ | Branch (500:7): [True: 0, False: 12] ------------------ 501| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 4}, "DSA/SHA-512"); 502| 0| case 0x9241B: ------------------ | Branch (502:7): [True: 0, False: 12] ------------------ 503| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 5}, "DSA/SHA-3(224)"); 504| 0| case 0x9241C: ------------------ | Branch (504:7): [True: 0, False: 12] ------------------ 505| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 6}, "DSA/SHA-3(256)"); 506| 0| case 0x9241D: ------------------ | Branch (506:7): [True: 0, False: 12] ------------------ 507| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 7}, "DSA/SHA-3(384)"); 508| 0| case 0x9241E: ------------------ | Branch (508:7): [True: 0, False: 12] ------------------ 509| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 8}, "DSA/SHA-3(512)"); 510| 0| case 0x9241F: ------------------ | Branch (510:7): [True: 0, False: 12] ------------------ 511| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 9}, "ECDSA/SHA-3(224)"); 512| 0| case 0x92420: ------------------ | Branch (512:7): [True: 0, False: 12] ------------------ 513| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 10}, "ECDSA/SHA-3(256)"); 514| 0| case 0x92421: ------------------ | Branch (514:7): [True: 0, False: 12] ------------------ 515| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 11}, "ECDSA/SHA-3(384)"); 516| 0| case 0x92422: ------------------ | Branch (516:7): [True: 0, False: 12] ------------------ 517| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 12}, "ECDSA/SHA-3(512)"); 518| 0| case 0x92423: ------------------ | Branch (518:7): [True: 0, False: 12] ------------------ 519| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 13}, "RSA/PKCS1v15(SHA-3(224))"); 520| 0| case 0x92424: ------------------ | Branch (520:7): [True: 0, False: 12] ------------------ 521| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 14}, "RSA/PKCS1v15(SHA-3(256))"); 522| 0| case 0x92425: ------------------ | Branch (522:7): [True: 0, False: 12] ------------------ 523| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 15}, "RSA/PKCS1v15(SHA-3(384))"); 524| 0| case 0x92426: ------------------ | Branch (524:7): [True: 0, False: 12] ------------------ 525| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 16}, "RSA/PKCS1v15(SHA-3(512))"); 526| 0| case 0x92427: ------------------ | Branch (526:7): [True: 0, False: 12] ------------------ 527| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 17}, "ML-DSA-4x4"); 528| 0| case 0x92428: ------------------ | Branch (528:7): [True: 0, False: 12] ------------------ 529| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 18}, "ML-DSA-6x5"); 530| 0| case 0x92429: ------------------ | Branch (530:7): [True: 0, False: 12] ------------------ 531| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 19}, "ML-DSA-8x7"); 532| 0| case 0x9242A: ------------------ | Branch (532:7): [True: 0, False: 12] ------------------ 533| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 20}, "SLH-DSA-SHA2-128s"); 534| 0| case 0x9242B: ------------------ | Branch (534:7): [True: 0, False: 12] ------------------ 535| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 21}, "SLH-DSA-SHA2-128f"); 536| 0| case 0x9242C: ------------------ | Branch (536:7): [True: 0, False: 12] ------------------ 537| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 22}, "SLH-DSA-SHA2-192s"); 538| 0| case 0x9242D: ------------------ | Branch (538:7): [True: 0, False: 12] ------------------ 539| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 23}, "SLH-DSA-SHA2-192f"); 540| 0| case 0x9242E: ------------------ | Branch (540:7): [True: 0, False: 12] ------------------ 541| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 24}, "SLH-DSA-SHA2-256s"); 542| 0| case 0x9242F: ------------------ | Branch (542:7): [True: 0, False: 12] ------------------ 543| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 25}, "SLH-DSA-SHA2-256f"); 544| 0| case 0x92430: ------------------ | Branch (544:7): [True: 0, False: 12] ------------------ 545| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 26}, "SLH-DSA-SHAKE-128s"); 546| 0| case 0x92431: ------------------ | Branch (546:7): [True: 0, False: 12] ------------------ 547| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 27}, "SLH-DSA-SHAKE-128f"); 548| 0| case 0x92432: ------------------ | Branch (548:7): [True: 0, False: 12] ------------------ 549| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 28}, "SLH-DSA-SHAKE-192s"); 550| 0| case 0x92433: ------------------ | Branch (550:7): [True: 0, False: 12] ------------------ 551| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 29}, "SLH-DSA-SHAKE-192f"); 552| 0| case 0x92434: ------------------ | Branch (552:7): [True: 0, False: 12] ------------------ 553| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 30}, "SLH-DSA-SHAKE-256s"); 554| 0| case 0x92435: ------------------ | Branch (554:7): [True: 0, False: 12] ------------------ 555| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 31}, "SLH-DSA-SHAKE-256f"); 556| 0| case 0x924D8: ------------------ | Branch (556:7): [True: 0, False: 12] ------------------ 557| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 1}, "ML-KEM-512"); 558| 0| case 0x924D9: ------------------ | Branch (558:7): [True: 0, False: 12] ------------------ 559| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 2}, "ML-KEM-768"); 560| 0| case 0x924DA: ------------------ | Branch (560:7): [True: 0, False: 12] ------------------ 561| 0| return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 3}, "ML-KEM-1024"); 562| 0| case 0x9479F: ------------------ | Branch (562:7): [True: 0, False: 12] ------------------ 563| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 1}, "PKIX.AuthorityInformationAccess"); 564| 0| case 0x947A5: ------------------ | Branch (564:7): [True: 0, False: 12] ------------------ 565| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 7}, "PKIX.IpAddrBlocks"); 566| 0| case 0x947A6: ------------------ | Branch (566:7): [True: 0, False: 12] ------------------ 567| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 8}, "PKIX.AutonomousSysIds"); 568| 0| case 0x947B8: ------------------ | Branch (568:7): [True: 0, False: 12] ------------------ 569| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 26}, "PKIX.TNAuthList"); 570| 0| case 0x94921: ------------------ | Branch (570:7): [True: 0, False: 12] ------------------ 571| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 1}, "PKIX.ServerAuth"); 572| 0| case 0x94922: ------------------ | Branch (572:7): [True: 0, False: 12] ------------------ 573| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 2}, "PKIX.ClientAuth"); 574| 0| case 0x94923: ------------------ | Branch (574:7): [True: 0, False: 12] ------------------ 575| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 3}, "PKIX.CodeSigning"); 576| 0| case 0x94924: ------------------ | Branch (576:7): [True: 0, False: 12] ------------------ 577| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 4}, "PKIX.EmailProtection"); 578| 0| case 0x94925: ------------------ | Branch (578:7): [True: 0, False: 12] ------------------ 579| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 5}, "PKIX.IPsecEndSystem"); 580| 0| case 0x94926: ------------------ | Branch (580:7): [True: 0, False: 12] ------------------ 581| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 6}, "PKIX.IPsecTunnel"); 582| 0| case 0x94927: ------------------ | Branch (582:7): [True: 0, False: 12] ------------------ 583| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 7}, "PKIX.IPsecUser"); 584| 0| case 0x94928: ------------------ | Branch (584:7): [True: 0, False: 12] ------------------ 585| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 8}, "PKIX.TimeStamping"); 586| 0| case 0x94929: ------------------ | Branch (586:7): [True: 0, False: 12] ------------------ 587| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 9}, "PKIX.OCSPSigning"); 588| 0| case 0x94CEA: ------------------ | Branch (588:7): [True: 0, False: 12] ------------------ 589| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 8, 5}, "PKIX.XMPPAddr"); 590| 0| case 0x94CEE: ------------------ | Branch (590:7): [True: 0, False: 12] ------------------ 591| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 8, 9}, "PKIX.SmtpUTF8Mailbox"); 592| 0| case 0x954DB: ------------------ | Branch (592:7): [True: 0, False: 12] ------------------ 593| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 2}, "Microsoft SmartcardLogon"); 594| 0| case 0x954DC: ------------------ | Branch (594:7): [True: 0, False: 12] ------------------ 595| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 3}, "Microsoft UPN"); 596| 0| case 0x96B0E: ------------------ | Branch (596:7): [True: 0, False: 12] ------------------ 597| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1}, "PKIX.OCSP"); 598| 0| case 0x96B0F: ------------------ | Branch (598:7): [True: 0, False: 12] ------------------ 599| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 2}, "PKIX.CertificateAuthorityIssuers"); 600| 0| case 0x96B1B: ------------------ | Branch (600:7): [True: 0, False: 12] ------------------ 601| 0| return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 14}, "PKIX.STIRTNList"); 602| 0| case 0x96C77: ------------------ | Branch (602:7): [True: 0, False: 12] ------------------ 603| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 3}, "PBE-SHA1-3DES"); 604| 0| case 0x96C78: ------------------ | Branch (604:7): [True: 0, False: 12] ------------------ 605| 0| return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 4}, "PBE-SHA1-2DES"); 606| 0| case 0x9A008: ------------------ | Branch (606:7): [True: 0, False: 12] ------------------ 607| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 1}, "brainpool160r1"); 608| 0| case 0x9A00A: ------------------ | Branch (608:7): [True: 0, False: 12] ------------------ 609| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 3}, "brainpool192r1"); 610| 0| case 0x9A00C: ------------------ | Branch (610:7): [True: 0, False: 12] ------------------ 611| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 5}, "brainpool224r1"); 612| 1| case 0x9A00E: ------------------ | Branch (612:7): [True: 1, False: 11] ------------------ 613| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 7}, "brainpool256r1"); 614| 0| case 0x9A010: ------------------ | Branch (614:7): [True: 0, False: 12] ------------------ 615| 0| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 9}, "brainpool320r1"); 616| 1| case 0x9A012: ------------------ | Branch (616:7): [True: 1, False: 11] ------------------ 617| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 11}, "brainpool384r1"); 618| 1| case 0x9A014: ------------------ | Branch (618:7): [True: 1, False: 11] ------------------ 619| 1| return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 13}, "brainpool512r1"); 620| 0| case 0xA0D61: ------------------ | Branch (620:7): [True: 0, False: 12] ------------------ 621| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 3}, "McEliece"); 622| 0| case 0xA0D63: ------------------ | Branch (622:7): [True: 0, False: 12] ------------------ 623| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 5}, "XMSS-draft6"); 624| 0| case 0xA0D66: ------------------ | Branch (624:7): [True: 0, False: 12] ------------------ 625| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 8}, "XMSS-draft12"); 626| 0| case 0xA0D6B: ------------------ | Branch (626:7): [True: 0, False: 12] ------------------ 627| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 13}, "HSS-LMS-Private-Key"); 628| 0| case 0xA0EE1: ------------------ | Branch (628:7): [True: 0, False: 12] ------------------ 629| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 1}, "Serpent/CBC"); 630| 0| case 0xA0EE2: ------------------ | Branch (630:7): [True: 0, False: 12] ------------------ 631| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2}, "Threefish-512/CBC"); 632| 0| case 0xA0EE3: ------------------ | Branch (632:7): [True: 0, False: 12] ------------------ 633| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 3}, "Twofish/CBC"); 634| 0| case 0xA0F45: ------------------ | Branch (634:7): [True: 0, False: 12] ------------------ 635| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 101}, "Serpent/GCM"); 636| 0| case 0xA0F46: ------------------ | Branch (636:7): [True: 0, False: 12] ------------------ 637| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 102}, "Twofish/GCM"); 638| 0| case 0xA0FA2: ------------------ | Branch (638:7): [True: 0, False: 12] ------------------ 639| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 1}, "numsp256d1"); 640| 0| case 0xA0FA3: ------------------ | Branch (640:7): [True: 0, False: 12] ------------------ 641| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 2}, "numsp384d1"); 642| 1| case 0xA0FA4: ------------------ | Branch (642:7): [True: 1, False: 11] ------------------ 643| 1| return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 3}, "numsp512d1"); 644| 0| case 0xA244B: ------------------ | Branch (644:7): [True: 0, False: 12] ------------------ 645| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1}, "ClassicMcEliece_348864"); 646| 0| case 0xA244C: ------------------ | Branch (646:7): [True: 0, False: 12] ------------------ 647| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2}, "ClassicMcEliece_348864f"); 648| 0| case 0xA244D: ------------------ | Branch (648:7): [True: 0, False: 12] ------------------ 649| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3}, "ClassicMcEliece_460896"); 650| 0| case 0xA244E: ------------------ | Branch (650:7): [True: 0, False: 12] ------------------ 651| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4}, "ClassicMcEliece_460896f"); 652| 0| case 0xA244F: ------------------ | Branch (652:7): [True: 0, False: 12] ------------------ 653| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5}, "ClassicMcEliece_6688128"); 654| 0| case 0xA2450: ------------------ | Branch (654:7): [True: 0, False: 12] ------------------ 655| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6}, "ClassicMcEliece_6688128f"); 656| 0| case 0xA2451: ------------------ | Branch (656:7): [True: 0, False: 12] ------------------ 657| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7}, "ClassicMcEliece_6960119"); 658| 0| case 0xA2452: ------------------ | Branch (658:7): [True: 0, False: 12] ------------------ 659| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8}, "ClassicMcEliece_6960119f"); 660| 0| case 0xA2453: ------------------ | Branch (660:7): [True: 0, False: 12] ------------------ 661| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9}, "ClassicMcEliece_8192128"); 662| 0| case 0xA2454: ------------------ | Branch (662:7): [True: 0, False: 12] ------------------ 663| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10}, "ClassicMcEliece_8192128f"); 664| 0| case 0xAF989: ------------------ | Branch (664:7): [True: 0, False: 12] ------------------ 665| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 1}, "RSA"); 666| 0| case 0xAF98A: ------------------ | Branch (666:7): [True: 0, False: 12] ------------------ 667| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 2}, "RSA/PKCS1v15(MD2)"); 668| 0| case 0xAF98C: ------------------ | Branch (668:7): [True: 0, False: 12] ------------------ 669| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 4}, "RSA/PKCS1v15(MD5)"); 670| 0| case 0xAF98D: ------------------ | Branch (670:7): [True: 0, False: 12] ------------------ 671| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 5}, "RSA/PKCS1v15(SHA-1)"); 672| 0| case 0xAF98F: ------------------ | Branch (672:7): [True: 0, False: 12] ------------------ 673| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 7}, "RSA/OAEP"); 674| 0| case 0xAF990: ------------------ | Branch (674:7): [True: 0, False: 12] ------------------ 675| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 8}, "MGF1"); 676| 0| case 0xAF992: ------------------ | Branch (676:7): [True: 0, False: 12] ------------------ 677| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 10}, "RSA/PSS"); 678| 0| case 0xAF993: ------------------ | Branch (678:7): [True: 0, False: 12] ------------------ 679| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 11}, "RSA/PKCS1v15(SHA-256)"); 680| 0| case 0xAF994: ------------------ | Branch (680:7): [True: 0, False: 12] ------------------ 681| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 12}, "RSA/PKCS1v15(SHA-384)"); 682| 0| case 0xAF995: ------------------ | Branch (682:7): [True: 0, False: 12] ------------------ 683| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 13}, "RSA/PKCS1v15(SHA-512)"); 684| 0| case 0xAF996: ------------------ | Branch (684:7): [True: 0, False: 12] ------------------ 685| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 14}, "RSA/PKCS1v15(SHA-224)"); 686| 0| case 0xAF998: ------------------ | Branch (686:7): [True: 0, False: 12] ------------------ 687| 0| return if_match(oid, {1, 2, 840, 113549, 1, 1, 16}, "RSA/PKCS1v15(SHA-512-256)"); 688| 0| case 0xAFC98: ------------------ | Branch (688:7): [True: 0, False: 12] ------------------ 689| 0| return if_match(oid, {1, 2, 840, 113549, 1, 5, 12}, "PKCS5.PBKDF2"); 690| 0| case 0xAFC99: ------------------ | Branch (690:7): [True: 0, False: 12] ------------------ 691| 0| return if_match(oid, {1, 2, 840, 113549, 1, 5, 13}, "PBE-PKCS5v20"); 692| 0| case 0xAFE0F: ------------------ | Branch (692:7): [True: 0, False: 12] ------------------ 693| 0| return if_match(oid, {1, 2, 840, 113549, 1, 7, 1}, "PKCS7.Data"); 694| 0| case 0xAFE14: ------------------ | Branch (694:7): [True: 0, False: 12] ------------------ 695| 0| return if_match(oid, {1, 2, 840, 113549, 1, 7, 6}, "PKCS7.EncryptedData"); 696| 0| case 0xAFF91: ------------------ | Branch (696:7): [True: 0, False: 12] ------------------ 697| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 1}, "PKCS9.EmailAddress"); 698| 0| case 0xAFF92: ------------------ | Branch (698:7): [True: 0, False: 12] ------------------ 699| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 2}, "PKCS9.UnstructuredName"); 700| 0| case 0xAFF93: ------------------ | Branch (700:7): [True: 0, False: 12] ------------------ 701| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 3}, "PKCS9.ContentType"); 702| 0| case 0xAFF94: ------------------ | Branch (702:7): [True: 0, False: 12] ------------------ 703| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 4}, "PKCS9.MessageDigest"); 704| 0| case 0xAFF97: ------------------ | Branch (704:7): [True: 0, False: 12] ------------------ 705| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 7}, "PKCS9.ChallengePassword"); 706| 0| case 0xAFF9E: ------------------ | Branch (706:7): [True: 0, False: 12] ------------------ 707| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 14}, "PKCS9.ExtensionRequest"); 708| 0| case 0xAFFA4: ------------------ | Branch (708:7): [True: 0, False: 12] ------------------ 709| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 20}, "PKCS9.FriendlyName"); 710| 0| case 0xAFFA5: ------------------ | Branch (710:7): [True: 0, False: 12] ------------------ 711| 0| return if_match(oid, {1, 2, 840, 113549, 1, 9, 21}, "PKCS9.LocalKeyId"); 712| 0| case 0xC0226: ------------------ | Branch (712:7): [True: 0, False: 12] ------------------ 713| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 4, 11}, "Scrypt"); 714| 0| case 0xC0A67: ------------------ | Branch (714:7): [True: 0, False: 12] ------------------ 715| 0| return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 15, 1}, "OpenPGP.Ed25519"); 716| 0| case 0xC4CE5: ------------------ | Branch (716:7): [True: 0, False: 12] ------------------ 717| 0| return if_match(oid, {1, 2, 643, 100, 1}, "GOST.OGRN"); 718| 0| case 0xC4D53: ------------------ | Branch (718:7): [True: 0, False: 12] ------------------ 719| 0| return if_match(oid, {1, 2, 643, 100, 111}, "GOST.SubjectSigningTool"); 720| 0| case 0xC4D54: ------------------ | Branch (720:7): [True: 0, False: 12] ------------------ 721| 0| return if_match(oid, {1, 2, 643, 100, 112}, "GOST.IssuerSigningTool"); 722| 1| case 0xC9C50: ------------------ | Branch (722:7): [True: 1, False: 11] ------------------ 723| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 1}, "secp192r1"); 724| 0| case 0xC9C51: ------------------ | Branch (724:7): [True: 0, False: 12] ------------------ 725| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 2}, "x962_p192v2"); 726| 0| case 0xC9C52: ------------------ | Branch (726:7): [True: 0, False: 12] ------------------ 727| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 3}, "x962_p192v3"); 728| 0| case 0xC9C53: ------------------ | Branch (728:7): [True: 0, False: 12] ------------------ 729| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 4}, "x962_p239v1"); 730| 0| case 0xC9C54: ------------------ | Branch (730:7): [True: 0, False: 12] ------------------ 731| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 5}, "x962_p239v2"); 732| 0| case 0xC9C55: ------------------ | Branch (732:7): [True: 0, False: 12] ------------------ 733| 0| return if_match(oid, {1, 2, 840, 10045, 3, 1, 6}, "x962_p239v3"); 734| 1| case 0xC9C56: ------------------ | Branch (734:7): [True: 1, False: 11] ------------------ 735| 1| return if_match(oid, {1, 2, 840, 10045, 3, 1, 7}, "secp256r1"); 736| 0| case 0xCFA13: ------------------ | Branch (736:7): [True: 0, False: 12] ------------------ 737| 0| return if_match(oid, {1, 2, 840, 10040, 4, 1}, "DSA"); 738| 0| case 0xCFA15: ------------------ | Branch (738:7): [True: 0, False: 12] ------------------ 739| 0| return if_match(oid, {1, 2, 840, 10040, 4, 3}, "DSA/SHA-1"); 740| 0| default: ------------------ | Branch (740:7): [True: 0, False: 12] ------------------ 741| 0| return {}; 742| 12| } 743| 12|} _ZN5Botan7OID_Map22lookup_static_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 746| 12|std::optional OID_Map::lookup_static_oid_name(std::string_view req) { 747| 12| const uint32_t hc = hash_oid_name(req); 748| | 749| 12| switch(hc) { 750| 0| case 0x00545: ------------------ | Branch (750:7): [True: 0, False: 12] ------------------ 751| 0| return if_match(req, "Twofish/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 102}); 752| 0| case 0x00CF3: ------------------ | Branch (752:7): [True: 0, False: 12] ------------------ 753| 0| return if_match(req, "SphincsPlus-sha2-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4}); 754| 0| case 0x015FE: ------------------ | Branch (754:7): [True: 0, False: 12] ------------------ 755| 0| return if_match(req, "FrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1}); 756| 0| case 0x01F9E: ------------------ | Branch (756:7): [True: 0, False: 12] ------------------ 757| 0| return if_match(req, "MD5", {1, 2, 840, 113549, 2, 5}); 758| 0| case 0x02293: ------------------ | Branch (758:7): [True: 0, False: 12] ------------------ 759| 0| return if_match(req, "SphincsPlus-shake-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4}); 760| 0| case 0x02B93: ------------------ | Branch (760:7): [True: 0, False: 12] ------------------ 761| 0| return if_match(req, "Microsoft SmartcardLogon", {1, 3, 6, 1, 4, 1, 311, 20, 2, 2}); 762| 0| case 0x041D5: ------------------ | Branch (762:7): [True: 0, False: 12] ------------------ 763| 0| return if_match(req, "secp160k1", {1, 3, 132, 0, 9}); 764| 0| case 0x044B3: ------------------ | Branch (764:7): [True: 0, False: 12] ------------------ 765| 0| return if_match(req, "Camellia-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8}); 766| 0| case 0x048B2: ------------------ | Branch (766:7): [True: 0, False: 12] ------------------ 767| 0| return if_match(req, "secp160r1", {1, 3, 132, 0, 8}); 768| 0| case 0x048B3: ------------------ | Branch (768:7): [True: 0, False: 12] ------------------ 769| 0| return if_match(req, "secp160r2", {1, 3, 132, 0, 30}); 770| 0| case 0x05CDA: ------------------ | Branch (770:7): [True: 0, False: 12] ------------------ 771| 0| return if_match(req, "X520.Country", {2, 5, 4, 6}); 772| 0| case 0x07783: ------------------ | Branch (772:7): [True: 0, False: 12] ------------------ 773| 0| return if_match(req, "PKIX.ServerAuth", {1, 3, 6, 1, 5, 5, 7, 3, 1}); 774| 0| case 0x086C7: ------------------ | Branch (774:7): [True: 0, False: 12] ------------------ 775| 0| return if_match(req, "numsp384d1", {1, 3, 6, 1, 4, 1, 25258, 4, 2}); 776| 0| case 0x08A92: ------------------ | Branch (776:7): [True: 0, False: 12] ------------------ 777| 0| return if_match(req, "RSA/PKCS1v15(SHA-1)", {1, 2, 840, 113549, 1, 1, 5}); 778| 0| case 0x09EA0: ------------------ | Branch (778:7): [True: 0, False: 12] ------------------ 779| 0| return if_match(req, "DES/CBC", {1, 3, 14, 3, 2, 7}); 780| 0| case 0x0B2D6: ------------------ | Branch (780:7): [True: 0, False: 12] ------------------ 781| 0| return if_match(req, "ECDSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 12}); 782| 0| case 0x0BA72: ------------------ | Branch (782:7): [True: 0, False: 12] ------------------ 783| 0| return if_match(req, "SphincsPlus-sha2-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1}); 784| 0| case 0x0BE23: ------------------ | Branch (784:7): [True: 0, False: 12] ------------------ 785| 0| return if_match(req, "ECGDSA", {1, 3, 36, 3, 3, 2, 5, 2, 1}); 786| 0| case 0x0C109: ------------------ | Branch (786:7): [True: 0, False: 12] ------------------ 787| 0| return if_match(req, "PKCS9.FriendlyName", {1, 2, 840, 113549, 1, 9, 20}); 788| 0| case 0x0D012: ------------------ | Branch (788:7): [True: 0, False: 12] ------------------ 789| 0| return if_match(req, "SphincsPlus-shake-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1}); 790| 0| case 0x0DCE9: ------------------ | Branch (790:7): [True: 0, False: 12] ------------------ 791| 0| return if_match(req, "ClassicMcEliece_8192128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10}); 792| 1| case 0x0E52A: ------------------ | Branch (792:7): [True: 1, False: 11] ------------------ 793| 1| return if_match(req, "numsp512d1", {1, 3, 6, 1, 4, 1, 25258, 4, 3}); 794| 0| case 0x0F9CC: ------------------ | Branch (794:7): [True: 0, False: 12] ------------------ 795| 0| return if_match(req, "PKCS9.UnstructuredName", {1, 2, 840, 113549, 1, 9, 2}); 796| 0| case 0x0FF45: ------------------ | Branch (796:7): [True: 0, False: 12] ------------------ 797| 0| return if_match(req, "Camellia-256/GCM", {0, 3, 4401, 5, 3, 1, 9, 46}); 798| 0| case 0x1033D: ------------------ | Branch (798:7): [True: 0, False: 12] ------------------ 799| 0| return if_match(req, "DSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 7}); 800| 0| case 0x1139D: ------------------ | Branch (800:7): [True: 0, False: 12] ------------------ 801| 0| return if_match(req, "secp192k1", {1, 3, 132, 0, 31}); 802| 0| case 0x113D6: ------------------ | Branch (802:7): [True: 0, False: 12] ------------------ 803| 0| return if_match(req, "X520.DNQualifier", {2, 5, 4, 46}); 804| 1| case 0x11A7A: ------------------ | Branch (804:7): [True: 1, False: 11] ------------------ 805| 1| return if_match(req, "secp192r1", {1, 2, 840, 10045, 3, 1, 1}); 806| 0| case 0x12096: ------------------ | Branch (806:7): [True: 0, False: 12] ------------------ 807| 0| return if_match(req, "SM2_Kex", {1, 2, 156, 10197, 1, 301, 2}); 808| 0| case 0x13FC1: ------------------ | Branch (808:7): [True: 0, False: 12] ------------------ 809| 0| return if_match(req, "X520.GenerationalQualifier", {2, 5, 4, 44}); 810| 0| case 0x1445B: ------------------ | Branch (810:7): [True: 0, False: 12] ------------------ 811| 0| return if_match(req, "PKCS5.PBKDF2", {1, 2, 840, 113549, 1, 5, 12}); 812| 0| case 0x1495D: ------------------ | Branch (812:7): [True: 0, False: 12] ------------------ 813| 0| return if_match(req, "eFrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3}); 814| 0| case 0x14E30: ------------------ | Branch (814:7): [True: 0, False: 12] ------------------ 815| 0| return if_match(req, "ClassicMcEliece_460896", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3}); 816| 0| case 0x14FB1: ------------------ | Branch (816:7): [True: 0, False: 12] ------------------ 817| 0| return if_match(req, "XMSS-draft12", {1, 3, 6, 1, 4, 1, 25258, 1, 8}); 818| 0| case 0x156E3: ------------------ | Branch (818:7): [True: 0, False: 12] ------------------ 819| 0| return if_match(req, "Compression.Zlib", {1, 2, 840, 113549, 1, 9, 16, 3, 8}); 820| 0| case 0x1579E: ------------------ | Branch (820:7): [True: 0, False: 12] ------------------ 821| 0| return if_match(req, "Streebog-512", {1, 2, 643, 7, 1, 1, 2, 3}); 822| 0| case 0x1701A: ------------------ | Branch (822:7): [True: 0, False: 12] ------------------ 823| 0| return if_match(req, "X509v3.AnyExtendedKeyUsage", {2, 5, 29, 37, 0}); 824| 0| case 0x175EF: ------------------ | Branch (824:7): [True: 0, False: 12] ------------------ 825| 0| return if_match(req, "Kyber-1024-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3}); 826| 0| case 0x17709: ------------------ | Branch (826:7): [True: 0, False: 12] ------------------ 827| 0| return if_match(req, "X520.GivenName", {2, 5, 4, 42}); 828| 0| case 0x17AD9: ------------------ | Branch (828:7): [True: 0, False: 12] ------------------ 829| 0| return if_match(req, "RSA/PKCS1v15(SM3)", {1, 2, 156, 10197, 1, 504}); 830| 0| case 0x17CE2: ------------------ | Branch (830:7): [True: 0, False: 12] ------------------ 831| 0| return if_match(req, "SLH-DSA-SHA2-256f", {2, 16, 840, 1, 101, 3, 4, 3, 25}); 832| 0| case 0x17CEF: ------------------ | Branch (832:7): [True: 0, False: 12] ------------------ 833| 0| return if_match(req, "SLH-DSA-SHA2-256s", {2, 16, 840, 1, 101, 3, 4, 3, 24}); 834| 0| case 0x18618: ------------------ | Branch (834:7): [True: 0, False: 12] ------------------ 835| 0| return if_match(req, "FrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2}); 836| 0| case 0x19480: ------------------ | Branch (836:7): [True: 0, False: 12] ------------------ 837| 0| return if_match(req, "eFrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3}); 838| 0| case 0x1958A: ------------------ | Branch (838:7): [True: 0, False: 12] ------------------ 839| 0| return if_match(req, "X509v3.InvalidityDate", {2, 5, 29, 24}); 840| 0| case 0x19851: ------------------ | Branch (840:7): [True: 0, False: 12] ------------------ 841| 0| return if_match(req, "DSA/SHA-1", {1, 2, 840, 10040, 4, 3}); 842| 0| case 0x1B2E7: ------------------ | Branch (842:7): [True: 0, False: 12] ------------------ 843| 0| return if_match(req, "KeyWrap.AES-128", {2, 16, 840, 1, 101, 3, 4, 1, 5}); 844| 0| case 0x1B9BE: ------------------ | Branch (844:7): [True: 0, False: 12] ------------------ 845| 0| return if_match(req, "KeyWrap.AES-192", {2, 16, 840, 1, 101, 3, 4, 1, 25}); 846| 0| case 0x1D439: ------------------ | Branch (846:7): [True: 0, False: 12] ------------------ 847| 0| return if_match(req, "SphincsPlus-haraka-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4}); 848| 0| case 0x2065B: ------------------ | Branch (848:7): [True: 0, False: 12] ------------------ 849| 0| return if_match(req, "KeyWrap.CAST-128", {1, 2, 840, 113533, 7, 66, 15}); 850| 0| case 0x216A0: ------------------ | Branch (850:7): [True: 0, False: 12] ------------------ 851| 0| return if_match(req, "ML-KEM-512", {2, 16, 840, 1, 101, 3, 4, 4, 1}); 852| 0| case 0x2216B: ------------------ | Branch (852:7): [True: 0, False: 12] ------------------ 853| 0| return if_match(req, "GOST-34.10-2012-512", {1, 2, 643, 7, 1, 1, 1, 2}); 854| 0| case 0x22C2C: ------------------ | Branch (854:7): [True: 0, False: 12] ------------------ 855| 0| return if_match(req, "ElGamal", {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1}); 856| 0| case 0x2559A: ------------------ | Branch (856:7): [True: 0, False: 12] ------------------ 857| 0| return if_match(req, "X520.Initials", {2, 5, 4, 43}); 858| 0| case 0x271AC: ------------------ | Branch (858:7): [True: 0, False: 12] ------------------ 859| 0| return if_match(req, "PKIX.AutonomousSysIds", {1, 3, 6, 1, 5, 5, 7, 1, 8}); 860| 0| case 0x2808B: ------------------ | Branch (860:7): [True: 0, False: 12] ------------------ 861| 0| return if_match(req, "PKCS7.Data", {1, 2, 840, 113549, 1, 7, 1}); 862| 0| case 0x281B8: ------------------ | Branch (862:7): [True: 0, False: 12] ------------------ 863| 0| return if_match(req, "SphincsPlus-haraka-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1}); 864| 0| case 0x282FE: ------------------ | Branch (864:7): [True: 0, False: 12] ------------------ 865| 0| return if_match(req, "PKIX.OCSP.Nonce", {1, 3, 6, 1, 5, 5, 7, 48, 1, 2}); 866| 0| case 0x29999: ------------------ | Branch (866:7): [True: 0, False: 12] ------------------ 867| 0| return if_match(req, "DSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 6}); 868| 0| case 0x2A83D: ------------------ | Branch (868:7): [True: 0, False: 12] ------------------ 869| 0| return if_match(req, "SHA-224", {2, 16, 840, 1, 101, 3, 4, 2, 4}); 870| 0| case 0x2AB30: ------------------ | Branch (870:7): [True: 0, False: 12] ------------------ 871| 0| return if_match(req, "SHA-256", {2, 16, 840, 1, 101, 3, 4, 2, 1}); 872| 0| case 0x2ABEF: ------------------ | Branch (872:7): [True: 0, False: 12] ------------------ 873| 0| return if_match(req, "KeyWrap.AES-256", {2, 16, 840, 1, 101, 3, 4, 1, 45}); 874| 0| case 0x2BAEF: ------------------ | Branch (874:7): [True: 0, False: 12] ------------------ 875| 0| return if_match(req, "SM2_Sig/SM3", {1, 2, 156, 10197, 1, 501}); 876| 0| case 0x2C39A: ------------------ | Branch (876:7): [True: 0, False: 12] ------------------ 877| 0| return if_match(req, "ECGDSA/RIPEMD-160", {1, 3, 36, 3, 3, 2, 5, 4, 1}); 878| 0| case 0x2C54F: ------------------ | Branch (878:7): [True: 0, False: 12] ------------------ 879| 0| return if_match(req, "ECDSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 9}); 880| 0| case 0x2EEA6: ------------------ | Branch (880:7): [True: 0, False: 12] ------------------ 881| 0| return if_match(req, "RSA/PKCS1v15(RIPEMD-160)", {1, 3, 36, 3, 3, 1, 2}); 882| 0| case 0x2EFBA: ------------------ | Branch (882:7): [True: 0, False: 12] ------------------ 883| 0| return if_match(req, "Kyber-512-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1}); 884| 0| case 0x2F0AD: ------------------ | Branch (884:7): [True: 0, False: 12] ------------------ 885| 0| return if_match(req, "PKCS7.EncryptedData", {1, 2, 840, 113549, 1, 7, 6}); 886| 0| case 0x2F219: ------------------ | Branch (886:7): [True: 0, False: 12] ------------------ 887| 0| return if_match(req, "PBE-SHA1-2DES", {1, 2, 840, 113549, 1, 12, 1, 4}); 888| 0| case 0x3133E: ------------------ | Branch (888:7): [True: 0, False: 12] ------------------ 889| 0| return if_match(req, "SLH-DSA-SHA2-128f", {2, 16, 840, 1, 101, 3, 4, 3, 21}); 890| 0| case 0x3134B: ------------------ | Branch (890:7): [True: 0, False: 12] ------------------ 891| 0| return if_match(req, "SLH-DSA-SHA2-128s", {2, 16, 840, 1, 101, 3, 4, 3, 20}); 892| 0| case 0x3160D: ------------------ | Branch (892:7): [True: 0, False: 12] ------------------ 893| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(224))", {2, 16, 840, 1, 101, 3, 4, 3, 13}); 894| 0| case 0x319E0: ------------------ | Branch (894:7): [True: 0, False: 12] ------------------ 895| 0| return if_match(req, "GOST-34.10-2012-256/Streebog-256", {1, 2, 643, 7, 1, 1, 3, 2}); 896| 0| case 0x31B3D: ------------------ | Branch (896:7): [True: 0, False: 12] ------------------ 897| 0| return if_match(req, "HMAC(SHA-512)", {1, 2, 840, 113549, 2, 11}); 898| 1| case 0x31C6D: ------------------ | Branch (898:7): [True: 1, False: 11] ------------------ 899| 1| return if_match(req, "secp384r1", {1, 3, 132, 0, 34}); 900| 0| case 0x32899: ------------------ | Branch (900:7): [True: 0, False: 12] ------------------ 901| 0| return if_match(req, "TripleDES/CBC", {1, 2, 840, 113549, 3, 7}); 902| 0| case 0x33C9C: ------------------ | Branch (902:7): [True: 0, False: 12] ------------------ 903| 0| return if_match(req, "PKIX.SmtpUTF8Mailbox", {1, 3, 6, 1, 5, 5, 7, 8, 9}); 904| 0| case 0x33D04: ------------------ | Branch (904:7): [True: 0, False: 12] ------------------ 905| 0| return if_match(req, "PKCS12.SecretBag", {1, 2, 840, 113549, 1, 12, 10, 1, 5}); 906| 0| case 0x3615D: ------------------ | Branch (906:7): [True: 0, False: 12] ------------------ 907| 0| return if_match(req, "FrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2}); 908| 0| case 0x361B8: ------------------ | Branch (908:7): [True: 0, False: 12] ------------------ 909| 0| return if_match(req, "Ed25519", {1, 3, 101, 112}); 910| 0| case 0x3649D: ------------------ | Branch (910:7): [True: 0, False: 12] ------------------ 911| 0| return if_match(req, "SHAKE-128", {2, 16, 840, 1, 101, 3, 4, 2, 11}); 912| 0| case 0x36693: ------------------ | Branch (912:7): [True: 0, False: 12] ------------------ 913| 0| return if_match(req, "ClassicMcEliece_348864", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1}); 914| 0| case 0x373C7: ------------------ | Branch (914:7): [True: 0, False: 12] ------------------ 915| 0| return if_match(req, "ML-DSA-4x4", {2, 16, 840, 1, 101, 3, 4, 3, 17}); 916| 0| case 0x3750B: ------------------ | Branch (916:7): [True: 0, False: 12] ------------------ 917| 0| return if_match(req, "ClassicMcEliece_8192128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9}); 918| 0| case 0x39890: ------------------ | Branch (918:7): [True: 0, False: 12] ------------------ 919| 0| return if_match(req, "Ed448", {1, 3, 101, 113}); 920| 0| case 0x3A438: ------------------ | Branch (920:7): [True: 0, False: 12] ------------------ 921| 0| return if_match(req, "SHA-384", {2, 16, 840, 1, 101, 3, 4, 2, 2}); 922| 0| case 0x3A963: ------------------ | Branch (922:7): [True: 0, False: 12] ------------------ 923| 0| return if_match(req, "DH", {1, 2, 840, 10046, 2, 1}); 924| 0| case 0x3AC83: ------------------ | Branch (924:7): [True: 0, False: 12] ------------------ 925| 0| return if_match(req, "MGF1", {1, 2, 840, 113549, 1, 1, 8}); 926| 0| case 0x3ACBA: ------------------ | Branch (926:7): [True: 0, False: 12] ------------------ 927| 0| return if_match(req, "X509v3.IssuerAlternativeName", {2, 5, 29, 18}); 928| 0| case 0x3B273: ------------------ | Branch (928:7): [True: 0, False: 12] ------------------ 929| 0| return if_match(req, "KeyWrap.TripleDES", {1, 2, 840, 113549, 1, 9, 16, 3, 6}); 930| 0| case 0x3B91E: ------------------ | Branch (930:7): [True: 0, False: 12] ------------------ 931| 0| return if_match(req, "X509v3.PrivateKeyUsagePeriod", {2, 5, 29, 16}); 932| 0| case 0x3BC8A: ------------------ | Branch (932:7): [True: 0, False: 12] ------------------ 933| 0| return if_match(req, "SLH-DSA-SHAKE-192f", {2, 16, 840, 1, 101, 3, 4, 3, 29}); 934| 0| case 0x3BC97: ------------------ | Branch (934:7): [True: 0, False: 12] ------------------ 935| 0| return if_match(req, "SLH-DSA-SHAKE-192s", {2, 16, 840, 1, 101, 3, 4, 3, 28}); 936| 0| case 0x3D127: ------------------ | Branch (936:7): [True: 0, False: 12] ------------------ 937| 0| return if_match(req, "DSA", {1, 2, 840, 10040, 4, 1}); 938| 0| case 0x3E249: ------------------ | Branch (938:7): [True: 0, False: 12] ------------------ 939| 0| return if_match(req, "HSS-LMS", {1, 2, 840, 113549, 1, 9, 16, 3, 17}); 940| 0| case 0x3E7D5: ------------------ | Branch (940:7): [True: 0, False: 12] ------------------ 941| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(256))", {2, 16, 840, 1, 101, 3, 4, 3, 14}); 942| 0| case 0x3F748: ------------------ | Branch (942:7): [True: 0, False: 12] ------------------ 943| 0| return if_match(req, "GOST.OGRN", {1, 2, 643, 100, 1}); 944| 0| case 0x3F99F: ------------------ | Branch (944:7): [True: 0, False: 12] ------------------ 945| 0| return if_match(req, "X509v3.BasicConstraints", {2, 5, 29, 19}); 946| 0| case 0x40726: ------------------ | Branch (946:7): [True: 0, False: 12] ------------------ 947| 0| return if_match(req, "SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 2, 10}); 948| 0| case 0x407BF: ------------------ | Branch (948:7): [True: 0, False: 12] ------------------ 949| 0| return if_match(req, "ML-KEM-768", {2, 16, 840, 1, 101, 3, 4, 4, 2}); 950| 0| case 0x41334: ------------------ | Branch (950:7): [True: 0, False: 12] ------------------ 951| 0| return if_match(req, "ECDSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 11}); 952| 0| case 0x42DF3: ------------------ | Branch (952:7): [True: 0, False: 12] ------------------ 953| 0| return if_match(req, "X509v3.CRLDistributionPoints", {2, 5, 29, 31}); 954| 0| case 0x437FB: ------------------ | Branch (954:7): [True: 0, False: 12] ------------------ 955| 0| return if_match(req, "brainpool160r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 1}); 956| 0| case 0x441F5: ------------------ | Branch (956:7): [True: 0, False: 12] ------------------ 957| 0| return if_match(req, "gost_256A", {1, 2, 643, 7, 1, 2, 1, 1, 1}); 958| 0| case 0x441F6: ------------------ | Branch (958:7): [True: 0, False: 12] ------------------ 959| 0| return if_match(req, "gost_256B", {1, 2, 643, 7, 1, 2, 1, 1, 2}); 960| 0| case 0x44221: ------------------ | Branch (960:7): [True: 0, False: 12] ------------------ 961| 0| return if_match(req, "GOST-34.10-2012-512/Streebog-512", {1, 2, 643, 7, 1, 1, 3, 3}); 962| 0| case 0x44322: ------------------ | Branch (962:7): [True: 0, False: 12] ------------------ 963| 0| return if_match(req, "ClassicMcEliece_6960119pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3}); 964| 0| case 0x44973: ------------------ | Branch (964:7): [True: 0, False: 12] ------------------ 965| 0| return if_match(req, "Kyber-512-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1}); 966| 0| case 0x45C27: ------------------ | Branch (966:7): [True: 0, False: 12] ------------------ 967| 0| return if_match(req, "RSA/PKCS1v15(SHA-512-256)", {1, 2, 840, 113549, 1, 1, 16}); 968| 0| case 0x45C85: ------------------ | Branch (968:7): [True: 0, False: 12] ------------------ 969| 0| return if_match(req, "X509v3.ReasonCode", {2, 5, 29, 21}); 970| 0| case 0x45DA5: ------------------ | Branch (970:7): [True: 0, False: 12] ------------------ 971| 0| return if_match(req, "SHAKE-256", {2, 16, 840, 1, 101, 3, 4, 2, 12}); 972| 0| case 0x4663C: ------------------ | Branch (972:7): [True: 0, False: 12] ------------------ 973| 0| return if_match(req, "X509v3.PolicyConstraints", {2, 5, 29, 36}); 974| 0| case 0x480F7: ------------------ | Branch (974:7): [True: 0, False: 12] ------------------ 975| 0| return if_match(req, "Serpent/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4}); 976| 0| case 0x48627: ------------------ | Branch (976:7): [True: 0, False: 12] ------------------ 977| 0| return if_match(req, "Dilithium-4x4-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1}); 978| 0| case 0x48861: ------------------ | Branch (978:7): [True: 0, False: 12] ------------------ 979| 0| return if_match(req, "ChaCha20Poly1305", {1, 2, 840, 113549, 1, 9, 16, 3, 18}); 980| 1| case 0x4A292: ------------------ | Branch (980:7): [True: 1, False: 11] ------------------ 981| 1| return if_match(req, "frp256v1", {1, 2, 250, 1, 223, 101, 256, 1}); 982| 0| case 0x4A9EE: ------------------ | Branch (982:7): [True: 0, False: 12] ------------------ 983| 0| return if_match(req, "ClassicMcEliece_6960119f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8}); 984| 0| case 0x4BF87: ------------------ | Branch (984:7): [True: 0, False: 12] ------------------ 985| 0| return if_match(req, "PKIX.TNAuthList", {1, 3, 6, 1, 5, 5, 7, 1, 26}); 986| 0| case 0x4C088: ------------------ | Branch (986:7): [True: 0, False: 12] ------------------ 987| 0| return if_match(req, "eFrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2}); 988| 0| case 0x4C513: ------------------ | Branch (988:7): [True: 0, False: 12] ------------------ 989| 0| return if_match(req, "DSA/SHA-224", {2, 16, 840, 1, 101, 3, 4, 3, 1}); 990| 0| case 0x4C806: ------------------ | Branch (990:7): [True: 0, False: 12] ------------------ 991| 0| return if_match(req, "DSA/SHA-256", {2, 16, 840, 1, 101, 3, 4, 3, 2}); 992| 0| case 0x4D740: ------------------ | Branch (992:7): [True: 0, False: 12] ------------------ 993| 0| return if_match(req, "X509v3.AnyPolicy", {2, 5, 29, 32, 0}); 994| 0| case 0x4DE49: ------------------ | Branch (994:7): [True: 0, False: 12] ------------------ 995| 0| return if_match(req, "RSA/PKCS1v15(SHA-512)", {1, 2, 840, 113549, 1, 1, 13}); 996| 0| case 0x4ED5D: ------------------ | Branch (996:7): [True: 0, False: 12] ------------------ 997| 0| return if_match(req, "CAST-128/CBC", {1, 2, 840, 113533, 7, 66, 10}); 998| 0| case 0x4FCDC: ------------------ | Branch (998:7): [True: 0, False: 12] ------------------ 999| 0| return if_match(req, "RSA", {1, 2, 840, 113549, 1, 1, 1}); 1000| 0| case 0x501CB: ------------------ | Branch (1000:7): [True: 0, False: 12] ------------------ 1001| 0| return if_match(req, "ECDSA/SHA-224", {1, 2, 840, 10045, 4, 3, 1}); 1002| 0| case 0x50395: ------------------ | Branch (1002:7): [True: 0, False: 12] ------------------ 1003| 0| return if_match(req, "GOST-34.10/GOST-R-34.11-94", {1, 2, 643, 2, 2, 3}); 1004| 0| case 0x504BE: ------------------ | Branch (1004:7): [True: 0, False: 12] ------------------ 1005| 0| return if_match(req, "ECDSA/SHA-256", {1, 2, 840, 10045, 4, 3, 2}); 1006| 0| case 0x509C3: ------------------ | Branch (1006:7): [True: 0, False: 12] ------------------ 1007| 0| return if_match(req, "brainpool192r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 3}); 1008| 0| case 0x509F9: ------------------ | Branch (1008:7): [True: 0, False: 12] ------------------ 1009| 0| return if_match(req, "PKCS9.ContentType", {1, 2, 840, 113549, 1, 9, 3}); 1010| 0| case 0x50B26: ------------------ | Branch (1010:7): [True: 0, False: 12] ------------------ 1011| 0| return if_match(req, "FrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1}); 1012| 0| case 0x50D78: ------------------ | Branch (1012:7): [True: 0, False: 12] ------------------ 1013| 0| return if_match(req, "x962_p192v2", {1, 2, 840, 10045, 3, 1, 2}); 1014| 0| case 0x50D79: ------------------ | Branch (1014:7): [True: 0, False: 12] ------------------ 1015| 0| return if_match(req, "x962_p192v3", {1, 2, 840, 10045, 3, 1, 3}); 1016| 0| case 0x51DC6: ------------------ | Branch (1016:7): [True: 0, False: 12] ------------------ 1017| 0| return if_match(req, "AES-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1}); 1018| 0| case 0x52DB6: ------------------ | Branch (1018:7): [True: 0, False: 12] ------------------ 1019| 0| return if_match(req, "HMAC(SHA-224)", {1, 2, 840, 113549, 2, 8}); 1020| 0| case 0x53E11: ------------------ | Branch (1020:7): [True: 0, False: 12] ------------------ 1021| 0| return if_match(req, "FrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3}); 1022| 0| case 0x54012: ------------------ | Branch (1022:7): [True: 0, False: 12] ------------------ 1023| 0| return if_match(req, "PKIX.TimeStamping", {1, 3, 6, 1, 5, 5, 7, 3, 8}); 1024| 0| case 0x5407A: ------------------ | Branch (1024:7): [True: 0, False: 12] ------------------ 1025| 0| return if_match(req, "Serpent/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 1}); 1026| 0| case 0x5576D: ------------------ | Branch (1026:7): [True: 0, False: 12] ------------------ 1027| 0| return if_match(req, "SphincsPlus-sha2-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2}); 1028| 0| case 0x55EF6: ------------------ | Branch (1028:7): [True: 0, False: 12] ------------------ 1029| 0| return if_match(req, "AES-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2}); 1030| 0| case 0x55FFA: ------------------ | Branch (1030:7): [True: 0, False: 12] ------------------ 1031| 0| return if_match(req, "ML-DSA-6x5", {2, 16, 840, 1, 101, 3, 4, 3, 18}); 1032| 0| case 0x56826: ------------------ | Branch (1032:7): [True: 0, False: 12] ------------------ 1033| 0| return if_match(req, "brainpool320r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 9}); 1034| 0| case 0x56D0D: ------------------ | Branch (1034:7): [True: 0, False: 12] ------------------ 1035| 0| return if_match(req, "SphincsPlus-shake-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2}); 1036| 0| case 0x57077: ------------------ | Branch (1036:7): [True: 0, False: 12] ------------------ 1037| 0| return if_match(req, "XMSS-draft6", {1, 3, 6, 1, 4, 1, 25258, 1, 5}); 1038| 0| case 0x5818B: ------------------ | Branch (1038:7): [True: 0, False: 12] ------------------ 1039| 0| return if_match(req, "ECGDSA/SHA-224", {1, 3, 36, 3, 3, 2, 5, 4, 3}); 1040| 0| case 0x5847E: ------------------ | Branch (1040:7): [True: 0, False: 12] ------------------ 1041| 0| return if_match(req, "ECGDSA/SHA-256", {1, 3, 36, 3, 3, 2, 5, 4, 4}); 1042| 0| case 0x5898B: ------------------ | Branch (1042:7): [True: 0, False: 12] ------------------ 1043| 0| return if_match(req, "SHA-512", {2, 16, 840, 1, 101, 3, 4, 2, 3}); 1044| 0| case 0x58991: ------------------ | Branch (1044:7): [True: 0, False: 12] ------------------ 1045| 0| return if_match(req, "PKIX.OCSP.NoCheck", {1, 3, 6, 1, 5, 5, 7, 48, 1, 5}); 1046| 0| case 0x59717: ------------------ | Branch (1046:7): [True: 0, False: 12] ------------------ 1047| 0| return if_match(req, "X509v3.SubjectKeyIdentifier", {2, 5, 29, 14}); 1048| 0| case 0x5A1E1: ------------------ | Branch (1048:7): [True: 0, False: 12] ------------------ 1049| 0| return if_match(req, "PKCS12.KeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 1}); 1050| 0| case 0x5A570: ------------------ | Branch (1050:7): [True: 0, False: 12] ------------------ 1051| 0| return if_match(req, "X520.CommonName", {2, 5, 4, 3}); 1052| 0| case 0x5A990: ------------------ | Branch (1052:7): [True: 0, False: 12] ------------------ 1053| 0| return if_match(req, "ECDSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 10}); 1054| 0| case 0x5AB0E: ------------------ | Branch (1054:7): [True: 0, False: 12] ------------------ 1055| 0| return if_match(req, "SphincsPlus-sha2-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5}); 1056| 0| case 0x5AC4A: ------------------ | Branch (1056:7): [True: 0, False: 12] ------------------ 1057| 0| return if_match(req, "X520.Surname", {2, 5, 4, 4}); 1058| 0| case 0x5AF2C: ------------------ | Branch (1058:7): [True: 0, False: 12] ------------------ 1059| 0| return if_match(req, "ClassicMcEliece_8192128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5}); 1060| 0| case 0x5BC39: ------------------ | Branch (1060:7): [True: 0, False: 12] ------------------ 1061| 0| return if_match(req, "X509v3.KeyUsage", {2, 5, 29, 15}); 1062| 0| case 0x5BDDB: ------------------ | Branch (1062:7): [True: 0, False: 12] ------------------ 1063| 0| return if_match(req, "numsp256d1", {1, 3, 6, 1, 4, 1, 25258, 4, 1}); 1064| 0| case 0x5C0AE: ------------------ | Branch (1064:7): [True: 0, False: 12] ------------------ 1065| 0| return if_match(req, "SphincsPlus-shake-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5}); 1066| 0| case 0x5C10E: ------------------ | Branch (1066:7): [True: 0, False: 12] ------------------ 1067| 0| return if_match(req, "DSA/SHA-384", {2, 16, 840, 1, 101, 3, 4, 3, 3}); 1068| 0| case 0x5CFE5: ------------------ | Branch (1068:7): [True: 0, False: 12] ------------------ 1069| 0| return if_match(req, "PKCS9.X509Certificate", {1, 2, 840, 113549, 1, 9, 22, 1}); 1070| 0| case 0x5D1CF: ------------------ | Branch (1070:7): [True: 0, False: 12] ------------------ 1071| 0| return if_match(req, "X520.SerialNumber", {2, 5, 4, 5}); 1072| 0| case 0x5D375: ------------------ | Branch (1072:7): [True: 0, False: 12] ------------------ 1073| 0| return if_match(req, "SM4/OCB", {1, 2, 156, 10197, 1, 104, 100}); 1074| 0| case 0x5DD49: ------------------ | Branch (1074:7): [True: 0, False: 12] ------------------ 1075| 0| return if_match(req, "AES-128/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 2}); 1076| 0| case 0x5DE4E: ------------------ | Branch (1076:7): [True: 0, False: 12] ------------------ 1077| 0| return if_match(req, "AES-128/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 7}); 1078| 0| case 0x5DF23: ------------------ | Branch (1078:7): [True: 0, False: 12] ------------------ 1079| 0| return if_match(req, "HMAC(SHA-512-256)", {1, 2, 840, 113549, 2, 13}); 1080| 0| case 0x5ED04: ------------------ | Branch (1080:7): [True: 0, False: 12] ------------------ 1081| 0| return if_match(req, "SM2", {1, 2, 156, 10197, 1, 301, 1}); 1082| 0| case 0x5ED05: ------------------ | Branch (1082:7): [True: 0, False: 12] ------------------ 1083| 0| return if_match(req, "SM3", {1, 2, 156, 10197, 1, 401}); 1084| 0| case 0x5FDC6: ------------------ | Branch (1084:7): [True: 0, False: 12] ------------------ 1085| 0| return if_match(req, "ECDSA/SHA-384", {1, 2, 840, 10045, 4, 3, 3}); 1086| 0| case 0x6199F: ------------------ | Branch (1086:7): [True: 0, False: 12] ------------------ 1087| 0| return if_match(req, "SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 2, 7}); 1088| 0| case 0x61E79: ------------------ | Branch (1088:7): [True: 0, False: 12] ------------------ 1089| 0| return if_match(req, "AES-192/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 22}); 1090| 0| case 0x61F7E: ------------------ | Branch (1090:7): [True: 0, False: 12] ------------------ 1091| 0| return if_match(req, "AES-192/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 27}); 1092| 0| case 0x64947: ------------------ | Branch (1092:7): [True: 0, False: 12] ------------------ 1093| 0| return if_match(req, "OpenPGP.Ed25519", {1, 3, 6, 1, 4, 1, 11591, 15, 1}); 1094| 1| case 0x652E7: ------------------ | Branch (1094:7): [True: 1, False: 11] ------------------ 1095| 1| return if_match(req, "sm2p256v1", {1, 2, 156, 10197, 1, 301}); 1096| 0| case 0x6697B: ------------------ | Branch (1096:7): [True: 0, False: 12] ------------------ 1097| 0| return if_match(req, "FrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3}); 1098| 0| case 0x67B2C: ------------------ | Branch (1098:7): [True: 0, False: 12] ------------------ 1099| 0| return if_match(req, "X520.State", {2, 5, 4, 8}); 1100| 0| case 0x67B9B: ------------------ | Branch (1100:7): [True: 0, False: 12] ------------------ 1101| 0| return if_match(req, "HMAC(SHA-384)", {1, 2, 840, 113549, 2, 10}); 1102| 0| case 0x67D86: ------------------ | Branch (1102:7): [True: 0, False: 12] ------------------ 1103| 0| return if_match(req, "ECGDSA/SHA-384", {1, 3, 36, 3, 3, 2, 5, 4, 5}); 1104| 0| case 0x68A0B: ------------------ | Branch (1104:7): [True: 0, False: 12] ------------------ 1105| 0| return if_match(req, "Camellia-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6}); 1106| 0| case 0x68E33: ------------------ | Branch (1106:7): [True: 0, False: 12] ------------------ 1107| 0| return if_match(req, "PKCS9.ExtensionRequest", {1, 2, 840, 113549, 1, 9, 14}); 1108| 0| case 0x69126: ------------------ | Branch (1108:7): [True: 0, False: 12] ------------------ 1109| 0| return if_match(req, "X509v3.SubjectAlternativeName", {2, 5, 29, 17}); 1110| 0| case 0x692F8: ------------------ | Branch (1110:7): [True: 0, False: 12] ------------------ 1111| 0| return if_match(req, "SM4/CBC", {1, 2, 156, 10197, 1, 104, 2}); 1112| 0| case 0x695E1: ------------------ | Branch (1112:7): [True: 0, False: 12] ------------------ 1113| 0| return if_match(req, "Dilithium-4x4-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1}); 1114| 0| case 0x696DC: ------------------ | Branch (1114:7): [True: 0, False: 12] ------------------ 1115| 0| return if_match(req, "PKIX.IpAddrBlocks", {1, 3, 6, 1, 5, 5, 7, 1, 7}); 1116| 0| case 0x6A7CA: ------------------ | Branch (1116:7): [True: 0, False: 12] ------------------ 1117| 0| return if_match(req, "ECDSA", {1, 2, 840, 10045, 2, 1}); 1118| 0| case 0x6BD26: ------------------ | Branch (1118:7): [True: 0, False: 12] ------------------ 1119| 0| return if_match(req, "GOST.INN", {1, 2, 643, 3, 131, 1, 1}); 1120| 0| case 0x6CB3B: ------------------ | Branch (1120:7): [True: 0, False: 12] ------------------ 1121| 0| return if_match(req, "Camellia-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7}); 1122| 0| case 0x6E602: ------------------ | Branch (1122:7): [True: 0, False: 12] ------------------ 1123| 0| return if_match(req, "Dilithium-8x7-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3}); 1124| 0| case 0x6F0C2: ------------------ | Branch (1124:7): [True: 0, False: 12] ------------------ 1125| 0| return if_match(req, "RSA/PKCS1v15(SHA-224)", {1, 2, 840, 113549, 1, 1, 14}); 1126| 0| case 0x6F9F8: ------------------ | Branch (1126:7): [True: 0, False: 12] ------------------ 1127| 0| return if_match(req, "PKCS12.SafeContentsBag", {1, 2, 840, 113549, 1, 12, 10, 1, 6}); 1128| 0| case 0x6FB26: ------------------ | Branch (1128:7): [True: 0, False: 12] ------------------ 1129| 0| return if_match(req, "PKIX.AuthorityInformationAccess", {1, 3, 6, 1, 5, 5, 7, 1, 1}); 1130| 1| case 0x70BB6: ------------------ | Branch (1130:7): [True: 1, False: 11] ------------------ 1131| 1| return if_match(req, "brainpool384r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 11}); 1132| 0| case 0x70EA6: ------------------ | Branch (1132:7): [True: 0, False: 12] ------------------ 1133| 0| return if_match(req, "PKCS12.PKCS8ShroudedKeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 2}); 1134| 0| case 0x71EB3: ------------------ | Branch (1134:7): [True: 0, False: 12] ------------------ 1135| 0| return if_match(req, "SphincsPlus-haraka-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2}); 1136| 0| case 0x7382C: ------------------ | Branch (1136:7): [True: 0, False: 12] ------------------ 1137| 0| return if_match(req, "ML-KEM-1024", {2, 16, 840, 1, 101, 3, 4, 4, 3}); 1138| 0| case 0x743BD: ------------------ | Branch (1138:7): [True: 0, False: 12] ------------------ 1139| 0| return if_match(req, "AES-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3}); 1140| 0| case 0x7498E: ------------------ | Branch (1140:7): [True: 0, False: 12] ------------------ 1141| 0| return if_match(req, "Camellia-128/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 2}); 1142| 0| case 0x74C2E: ------------------ | Branch (1142:7): [True: 0, False: 12] ------------------ 1143| 0| return if_match(req, "ML-DSA-8x7", {2, 16, 840, 1, 101, 3, 4, 3, 19}); 1144| 0| case 0x7505F: ------------------ | Branch (1144:7): [True: 0, False: 12] ------------------ 1145| 0| return if_match(req, "PKIX.XMPPAddr", {1, 3, 6, 1, 5, 5, 7, 8, 5}); 1146| 0| case 0x7517A: ------------------ | Branch (1146:7): [True: 0, False: 12] ------------------ 1147| 0| return if_match(req, "RSA/PKCS1v15(MD2)", {1, 2, 840, 113549, 1, 1, 2}); 1148| 0| case 0x7546B: ------------------ | Branch (1148:7): [True: 0, False: 12] ------------------ 1149| 0| return if_match(req, "RSA/PKCS1v15(MD5)", {1, 2, 840, 113549, 1, 1, 4}); 1150| 0| case 0x75921: ------------------ | Branch (1150:7): [True: 0, False: 12] ------------------ 1151| 0| return if_match(req, "ClassicMcEliece_348864f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2}); 1152| 0| case 0x76784: ------------------ | Branch (1152:7): [True: 0, False: 12] ------------------ 1153| 0| return if_match(req, "SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 2, 9}); 1154| 0| case 0x768FD: ------------------ | Branch (1154:7): [True: 0, False: 12] ------------------ 1155| 0| return if_match(req, "PKCS9.LocalKeyId", {1, 2, 840, 113549, 1, 9, 21}); 1156| 1| case 0x76A19: ------------------ | Branch (1156:7): [True: 1, False: 11] ------------------ 1157| 1| return if_match(req, "brainpool512r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 13}); 1158| 0| case 0x77254: ------------------ | Branch (1158:7): [True: 0, False: 12] ------------------ 1159| 0| return if_match(req, "SphincsPlus-haraka-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5}); 1160| 0| case 0x77ADC: ------------------ | Branch (1160:7): [True: 0, False: 12] ------------------ 1161| 0| return if_match(req, "secp224k1", {1, 3, 132, 0, 32}); 1162| 1| case 0x781B9: ------------------ | Branch (1162:7): [True: 1, False: 11] ------------------ 1163| 1| return if_match(req, "secp224r1", {1, 3, 132, 0, 33}); 1164| 0| case 0x78ABE: ------------------ | Branch (1164:7): [True: 0, False: 12] ------------------ 1165| 0| return if_match(req, "Camellia-192/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 3}); 1166| 0| case 0x792F2: ------------------ | Branch (1166:7): [True: 0, False: 12] ------------------ 1167| 0| return if_match(req, "ClassicMcEliece_6688128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1}); 1168| 0| case 0x7A661: ------------------ | Branch (1168:7): [True: 0, False: 12] ------------------ 1169| 0| return if_match(req, "DSA/SHA-512", {2, 16, 840, 1, 101, 3, 4, 3, 4}); 1170| 0| case 0x7A977: ------------------ | Branch (1170:7): [True: 0, False: 12] ------------------ 1171| 0| return if_match(req, "X509v3.ExtendedKeyUsage", {2, 5, 29, 37}); 1172| 0| case 0x7AE67: ------------------ | Branch (1172:7): [True: 0, False: 12] ------------------ 1173| 0| return if_match(req, "SM2_Enc", {1, 2, 156, 10197, 1, 301, 3}); 1174| 0| case 0x7B602: ------------------ | Branch (1174:7): [True: 0, False: 12] ------------------ 1175| 0| return if_match(req, "Twofish/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5}); 1176| 0| case 0x7B9A1: ------------------ | Branch (1176:7): [True: 0, False: 12] ------------------ 1177| 0| return if_match(req, "SphincsPlus-sha2-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3}); 1178| 0| case 0x7BB0A: ------------------ | Branch (1178:7): [True: 0, False: 12] ------------------ 1179| 0| return if_match(req, "SLH-DSA-SHAKE-256f", {2, 16, 840, 1, 101, 3, 4, 3, 31}); 1180| 0| case 0x7BB17: ------------------ | Branch (1180:7): [True: 0, False: 12] ------------------ 1181| 0| return if_match(req, "SLH-DSA-SHAKE-256s", {2, 16, 840, 1, 101, 3, 4, 3, 30}); 1182| 0| case 0x7BCF3: ------------------ | Branch (1182:7): [True: 0, False: 12] ------------------ 1183| 0| return if_match(req, "PKIX.EmailProtection", {1, 3, 6, 1, 5, 5, 7, 3, 4}); 1184| 0| case 0x7CC2C: ------------------ | Branch (1184:7): [True: 0, False: 12] ------------------ 1185| 0| return if_match(req, "SHA-512-256", {2, 16, 840, 1, 101, 3, 4, 2, 6}); 1186| 0| case 0x7CF41: ------------------ | Branch (1186:7): [True: 0, False: 12] ------------------ 1187| 0| return if_match(req, "SphincsPlus-shake-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3}); 1188| 0| case 0x7DB91: ------------------ | Branch (1188:7): [True: 0, False: 12] ------------------ 1189| 0| return if_match(req, "GOST-34.10", {1, 2, 643, 2, 2, 19}); 1190| 0| case 0x7E319: ------------------ | Branch (1190:7): [True: 0, False: 12] ------------------ 1191| 0| return if_match(req, "ECDSA/SHA-512", {1, 2, 840, 10045, 4, 3, 4}); 1192| 0| case 0x7E874: ------------------ | Branch (1192:7): [True: 0, False: 12] ------------------ 1193| 0| return if_match(req, "ClassicMcEliece_6688128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6}); 1194| 0| case 0x7EAAF: ------------------ | Branch (1194:7): [True: 0, False: 12] ------------------ 1195| 0| return if_match(req, "eFrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1}); 1196| 0| case 0x7F51F: ------------------ | Branch (1196:7): [True: 0, False: 12] ------------------ 1197| 0| return if_match(req, "PKIX.IPsecTunnel", {1, 3, 6, 1, 5, 5, 7, 3, 6}); 1198| 0| case 0x80272: ------------------ | Branch (1198:7): [True: 0, False: 12] ------------------ 1199| 0| return if_match(req, "X520.Organization", {2, 5, 4, 10}); 1200| 0| case 0x80340: ------------------ | Branch (1200:7): [True: 0, False: 12] ------------------ 1201| 0| return if_match(req, "AES-256/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 42}); 1202| 0| case 0x80445: ------------------ | Branch (1202:7): [True: 0, False: 12] ------------------ 1203| 0| return if_match(req, "AES-256/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 47}); 1204| 0| case 0x80E71: ------------------ | Branch (1204:7): [True: 0, False: 12] ------------------ 1205| 0| return if_match(req, "PKIX.STIRTNList", {1, 3, 6, 1, 5, 5, 7, 48, 14}); 1206| 0| case 0x811F7: ------------------ | Branch (1206:7): [True: 0, False: 12] ------------------ 1207| 0| return if_match(req, "HMAC(SHA-256)", {1, 2, 840, 113549, 2, 9}); 1208| 0| case 0x82434: ------------------ | Branch (1208:7): [True: 0, False: 12] ------------------ 1209| 0| return if_match(req, "PKCS9.X509CRL", {1, 2, 840, 113549, 1, 9, 23, 1}); 1210| 0| case 0x82B47: ------------------ | Branch (1210:7): [True: 0, False: 12] ------------------ 1211| 0| return if_match(req, "Threefish-512/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 2}); 1212| 0| case 0x83EA7: ------------------ | Branch (1212:7): [True: 0, False: 12] ------------------ 1213| 0| return if_match(req, "RSA/PKCS1v15(SHA-384)", {1, 2, 840, 113549, 1, 1, 12}); 1214| 0| case 0x84596: ------------------ | Branch (1214:7): [True: 0, False: 12] ------------------ 1215| 0| return if_match(req, "eFrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1}); 1216| 0| case 0x8469F: ------------------ | Branch (1216:7): [True: 0, False: 12] ------------------ 1217| 0| return if_match(req, "ClassicMcEliece_6960119pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4}); 1218| 1| case 0x84CA4: ------------------ | Branch (1218:7): [True: 1, False: 11] ------------------ 1219| 1| return if_match(req, "secp256k1", {1, 3, 132, 0, 10}); 1220| 1| case 0x85381: ------------------ | Branch (1220:7): [True: 1, False: 11] ------------------ 1221| 1| return if_match(req, "secp256r1", {1, 2, 840, 10045, 3, 1, 7}); 1222| 0| case 0x854FC: ------------------ | Branch (1222:7): [True: 0, False: 12] ------------------ 1223| 0| return if_match(req, "PKIX.IPsecUser", {1, 3, 6, 1, 5, 5, 7, 3, 7}); 1224| 0| case 0x85F51: ------------------ | Branch (1224:7): [True: 0, False: 12] ------------------ 1225| 0| return if_match(req, "Serpent/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4}); 1226| 0| case 0x862D9: ------------------ | Branch (1226:7): [True: 0, False: 12] ------------------ 1227| 0| return if_match(req, "ECGDSA/SHA-512", {1, 3, 36, 3, 3, 2, 5, 4, 6}); 1228| 0| case 0x87585: ------------------ | Branch (1228:7): [True: 0, False: 12] ------------------ 1229| 0| return if_match(req, "Twofish/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 3}); 1230| 0| case 0x877D1: ------------------ | Branch (1230:7): [True: 0, False: 12] ------------------ 1231| 0| return if_match(req, "PKCS9.EmailAddress", {1, 2, 840, 113549, 1, 9, 1}); 1232| 0| case 0x87D27: ------------------ | Branch (1232:7): [True: 0, False: 12] ------------------ 1233| 0| return if_match(req, "PKIX.CertificateAuthorityIssuers", {1, 3, 6, 1, 5, 5, 7, 48, 2}); 1234| 0| case 0x87E42: ------------------ | Branch (1234:7): [True: 0, False: 12] ------------------ 1235| 0| return if_match(req, "X509v3.AuthorityKeyIdentifier", {2, 5, 29, 35}); 1236| 0| case 0x889B1: ------------------ | Branch (1236:7): [True: 0, False: 12] ------------------ 1237| 0| return if_match(req, "ECDSA/SHA-1", {1, 2, 840, 10045, 4, 1}); 1238| 0| case 0x89658: ------------------ | Branch (1238:7): [True: 0, False: 12] ------------------ 1239| 0| return if_match(req, "PBE-PKCS5v20", {1, 2, 840, 113549, 1, 5, 13}); 1240| 0| case 0x8976D: ------------------ | Branch (1240:7): [True: 0, False: 12] ------------------ 1241| 0| return if_match(req, "PKCS9.MessageDigest", {1, 2, 840, 113549, 1, 9, 4}); 1242| 0| case 0x8B002: ------------------ | Branch (1242:7): [True: 0, False: 12] ------------------ 1243| 0| return if_match(req, "Camellia-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8}); 1244| 0| case 0x8B935: ------------------ | Branch (1244:7): [True: 0, False: 12] ------------------ 1245| 0| return if_match(req, "ClassicMcEliece_6688128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5}); 1246| 0| case 0x8BB11: ------------------ | Branch (1246:7): [True: 0, False: 12] ------------------ 1247| 0| return if_match(req, "X509v3.NoRevocationAvailable", {2, 5, 29, 56}); 1248| 0| case 0x8CE3D: ------------------ | Branch (1248:7): [True: 0, False: 12] ------------------ 1249| 0| return if_match(req, "PKCS9.ChallengePassword", {1, 2, 840, 113549, 1, 9, 7}); 1250| 0| case 0x8D45C: ------------------ | Branch (1250:7): [True: 0, False: 12] ------------------ 1251| 0| return if_match(req, "ECKCDSA", {1, 0, 14888, 3, 0, 5}); 1252| 0| case 0x8E0C1: ------------------ | Branch (1252:7): [True: 0, False: 12] ------------------ 1253| 0| return if_match(req, "X509v3.CertificatePolicies", {2, 5, 29, 32}); 1254| 0| case 0x8E39A: ------------------ | Branch (1254:7): [True: 0, False: 12] ------------------ 1255| 0| return if_match(req, "HSS-LMS-Private-Key", {1, 3, 6, 1, 4, 1, 25258, 1, 13}); 1256| 0| case 0x8EC51: ------------------ | Branch (1256:7): [True: 0, False: 12] ------------------ 1257| 0| return if_match(req, "Kyber-768-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2}); 1258| 0| case 0x8F94A: ------------------ | Branch (1258:7): [True: 0, False: 12] ------------------ 1259| 0| return if_match(req, "Dilithium-6x5-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2}); 1260| 0| case 0x8FC20: ------------------ | Branch (1260:7): [True: 0, False: 12] ------------------ 1261| 0| return if_match(req, "AES-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1}); 1262| 0| case 0x8FDE0: ------------------ | Branch (1262:7): [True: 0, False: 12] ------------------ 1263| 0| return if_match(req, "SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 2, 8}); 1264| 0| case 0x919E3: ------------------ | Branch (1264:7): [True: 0, False: 12] ------------------ 1265| 0| return if_match(req, "Serpent/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 101}); 1266| 0| case 0x91C1A: ------------------ | Branch (1266:7): [True: 0, False: 12] ------------------ 1267| 0| return if_match(req, "X25519", {1, 3, 101, 110}); 1268| 0| case 0x91DC4: ------------------ | Branch (1268:7): [True: 0, False: 12] ------------------ 1269| 0| return if_match(req, "McEliece", {1, 3, 6, 1, 4, 1, 25258, 1, 3}); 1270| 0| case 0x93467: ------------------ | Branch (1270:7): [True: 0, False: 12] ------------------ 1271| 0| return if_match(req, "Dilithium-6x5-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2}); 1272| 0| case 0x93D50: ------------------ | Branch (1272:7): [True: 0, False: 12] ------------------ 1273| 0| return if_match(req, "AES-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2}); 1274| 0| case 0x95166: ------------------ | Branch (1274:7): [True: 0, False: 12] ------------------ 1275| 0| return if_match(req, "SLH-DSA-SHAKE-128f", {2, 16, 840, 1, 101, 3, 4, 3, 27}); 1276| 0| case 0x95173: ------------------ | Branch (1276:7): [True: 0, False: 12] ------------------ 1277| 0| return if_match(req, "SLH-DSA-SHAKE-128s", {2, 16, 840, 1, 101, 3, 4, 3, 26}); 1278| 0| case 0x952D6: ------------------ | Branch (1278:7): [True: 0, False: 12] ------------------ 1279| 0| return if_match(req, "PKIX.OCSP", {1, 3, 6, 1, 5, 5, 7, 48, 1}); 1280| 0| case 0x959B9: ------------------ | Branch (1280:7): [True: 0, False: 12] ------------------ 1281| 0| return if_match(req, "PKIX.IPsecEndSystem", {1, 3, 6, 1, 5, 5, 7, 3, 5}); 1282| 0| case 0x96F85: ------------------ | Branch (1282:7): [True: 0, False: 12] ------------------ 1283| 0| return if_match(req, "Camellia-256/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 4}); 1284| 0| case 0x97D5E: ------------------ | Branch (1284:7): [True: 0, False: 12] ------------------ 1285| 0| return if_match(req, "HMAC(SHA-1)", {1, 2, 840, 113549, 2, 7}); 1286| 0| case 0x9805C: ------------------ | Branch (1286:7): [True: 0, False: 12] ------------------ 1287| 0| return if_match(req, "SEED/CBC", {1, 2, 410, 200004, 1, 4}); 1288| 0| case 0x980E7: ------------------ | Branch (1288:7): [True: 0, False: 12] ------------------ 1289| 0| return if_match(req, "SphincsPlus-haraka-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3}); 1290| 0| case 0x980F5: ------------------ | Branch (1290:7): [True: 0, False: 12] ------------------ 1291| 0| return if_match(req, "GOST.SubjectSigningTool", {1, 2, 643, 100, 111}); 1292| 0| case 0x98B03: ------------------ | Branch (1292:7): [True: 0, False: 12] ------------------ 1293| 0| return if_match(req, "XMSS", {0, 4, 0, 127, 0, 15, 1, 1, 13, 0}); 1294| 0| case 0x9A6B2: ------------------ | Branch (1294:7): [True: 0, False: 12] ------------------ 1295| 0| return if_match(req, "ECKCDSA/SHA-1", {1, 2, 410, 200004, 1, 100, 4, 3}); 1296| 0| case 0x9B1CF: ------------------ | Branch (1296:7): [True: 0, False: 12] ------------------ 1297| 0| return if_match(req, "SM4/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9}); 1298| 0| case 0x9B6B2: ------------------ | Branch (1298:7): [True: 0, False: 12] ------------------ 1299| 0| return if_match(req, "AES-128/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 6}); 1300| 0| case 0x9B6BB: ------------------ | Branch (1300:7): [True: 0, False: 12] ------------------ 1301| 0| return if_match(req, "X520.OrganizationalUnit", {2, 5, 4, 11}); 1302| 0| case 0x9B851: ------------------ | Branch (1302:7): [True: 0, False: 12] ------------------ 1303| 0| return if_match(req, "OpenPGP.Curve25519", {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1}); 1304| 0| case 0x9C80B: ------------------ | Branch (1304:7): [True: 0, False: 12] ------------------ 1305| 0| return if_match(req, "SLH-DSA-SHA2-192f", {2, 16, 840, 1, 101, 3, 4, 3, 23}); 1306| 0| case 0x9C818: ------------------ | Branch (1306:7): [True: 0, False: 12] ------------------ 1307| 0| return if_match(req, "SLH-DSA-SHA2-192s", {2, 16, 840, 1, 101, 3, 4, 3, 22}); 1308| 0| case 0x9CD2B: ------------------ | Branch (1308:7): [True: 0, False: 12] ------------------ 1309| 0| return if_match(req, "Scrypt", {1, 3, 6, 1, 4, 1, 11591, 4, 11}); 1310| 0| case 0x9CDE1: ------------------ | Branch (1310:7): [True: 0, False: 12] ------------------ 1311| 0| return if_match(req, "GOST-34.10-2012-256/SHA-256", {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1}); 1312| 0| case 0x9CF73: ------------------ | Branch (1312:7): [True: 0, False: 12] ------------------ 1313| 0| return if_match(req, "ClassicMcEliece_460896f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4}); 1314| 0| case 0x9D354: ------------------ | Branch (1314:7): [True: 0, False: 12] ------------------ 1315| 0| return if_match(req, "RIPEMD-160", {1, 3, 36, 3, 2, 1}); 1316| 0| case 0x9D503: ------------------ | Branch (1316:7): [True: 0, False: 12] ------------------ 1317| 0| return if_match(req, "RSA/PKCS1v15(SHA-256)", {1, 2, 840, 113549, 1, 1, 11}); 1318| 0| case 0x9EC88: ------------------ | Branch (1318:7): [True: 0, False: 12] ------------------ 1319| 0| return if_match(req, "DSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 8}); 1320| 0| case 0x9EF36: ------------------ | Branch (1320:7): [True: 0, False: 12] ------------------ 1321| 0| return if_match(req, "ClassicMcEliece_6960119", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7}); 1322| 0| case 0x9F764: ------------------ | Branch (1322:7): [True: 0, False: 12] ------------------ 1323| 0| return if_match(req, "X448", {1, 3, 101, 111}); 1324| 0| case 0x9F7E2: ------------------ | Branch (1324:7): [True: 0, False: 12] ------------------ 1325| 0| return if_match(req, "AES-192/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 26}); 1326| 0| case 0x9F9C5: ------------------ | Branch (1326:7): [True: 0, False: 12] ------------------ 1327| 0| return if_match(req, "ClassicMcEliece_6688128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2}); 1328| 0| case 0xA0805: ------------------ | Branch (1328:7): [True: 0, False: 12] ------------------ 1329| 0| return if_match(req, "PKCS9.SDSICertificate", {1, 2, 840, 113549, 1, 9, 22, 2}); 1330| 0| case 0xA2B5B: ------------------ | Branch (1330:7): [True: 0, False: 12] ------------------ 1331| 0| return if_match(req, "X509v3.CRLNumber", {2, 5, 29, 20}); 1332| 0| case 0xA3005: ------------------ | Branch (1332:7): [True: 0, False: 12] ------------------ 1333| 0| return if_match(req, "X520.Title", {2, 5, 4, 12}); 1334| 0| case 0xA323F: ------------------ | Branch (1334:7): [True: 0, False: 12] ------------------ 1335| 0| return if_match(req, "X509v3.NameConstraints", {2, 5, 29, 30}); 1336| 0| case 0xA3C55: ------------------ | Branch (1336:7): [True: 0, False: 12] ------------------ 1337| 0| return if_match(req, "X520.Pseudonym", {2, 5, 4, 65}); 1338| 0| case 0xA4809: ------------------ | Branch (1338:7): [True: 0, False: 12] ------------------ 1339| 0| return if_match(req, "SphincsPlus-sha2-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6}); 1340| 1| case 0xA57AF: ------------------ | Branch (1340:7): [True: 1, False: 11] ------------------ 1341| 1| return if_match(req, "secp521r1", {1, 3, 132, 0, 35}); 1342| 0| case 0xA5DA9: ------------------ | Branch (1342:7): [True: 0, False: 12] ------------------ 1343| 0| return if_match(req, "SphincsPlus-shake-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6}); 1344| 0| case 0xA6865: ------------------ | Branch (1344:7): [True: 0, False: 12] ------------------ 1345| 0| return if_match(req, "Camellia-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6}); 1346| 0| case 0xA6C61: ------------------ | Branch (1346:7): [True: 0, False: 12] ------------------ 1347| 0| return if_match(req, "SM4/GCM", {1, 2, 156, 10197, 1, 104, 8}); 1348| 0| case 0xA8439: ------------------ | Branch (1348:7): [True: 0, False: 12] ------------------ 1349| 0| return if_match(req, "PKCS12.CertBag", {1, 2, 840, 113549, 1, 12, 10, 1, 3}); 1350| 0| case 0xA9061: ------------------ | Branch (1350:7): [True: 0, False: 12] ------------------ 1351| 0| return if_match(req, "Kyber-768-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2}); 1352| 0| case 0xAA995: ------------------ | Branch (1352:7): [True: 0, False: 12] ------------------ 1353| 0| return if_match(req, "Camellia-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7}); 1354| 0| case 0xAAE2B: ------------------ | Branch (1354:7): [True: 0, False: 12] ------------------ 1355| 0| return if_match(req, "Dilithium-8x7-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3}); 1356| 0| case 0xABCED: ------------------ | Branch (1356:7): [True: 0, False: 12] ------------------ 1357| 0| return if_match(req, "GOST.IssuerSigningTool", {1, 2, 643, 100, 112}); 1358| 0| case 0xABD24: ------------------ | Branch (1358:7): [True: 0, False: 12] ------------------ 1359| 0| return if_match(req, "RSA/OAEP", {1, 2, 840, 113549, 1, 1, 7}); 1360| 0| case 0xAC2EC: ------------------ | Branch (1360:7): [True: 0, False: 12] ------------------ 1361| 0| return if_match(req, "Streebog-256", {1, 2, 643, 7, 1, 1, 2, 2}); 1362| 0| case 0xAC3DD: ------------------ | Branch (1362:7): [True: 0, False: 12] ------------------ 1363| 0| return if_match(req, "Certificate Comment", {2, 16, 840, 1, 113730, 1, 13}); 1364| 0| case 0xAC511: ------------------ | Branch (1364:7): [True: 0, False: 12] ------------------ 1365| 0| return if_match(req, "PBE-SHA1-3DES", {1, 2, 840, 113549, 1, 12, 1, 3}); 1366| 0| case 0xAE6FE: ------------------ | Branch (1366:7): [True: 0, False: 12] ------------------ 1367| 0| return if_match(req, "PKIX.ClientAuth", {1, 3, 6, 1, 5, 5, 7, 3, 2}); 1368| 0| case 0xAE8D3: ------------------ | Branch (1368:7): [True: 0, False: 12] ------------------ 1369| 0| return if_match(req, "ClassicMcEliece_8192128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6}); 1370| 0| case 0xAF476: ------------------ | Branch (1370:7): [True: 0, False: 12] ------------------ 1371| 0| return if_match(req, "ECDH", {1, 3, 132, 1, 12}); 1372| 0| case 0xAFA6A: ------------------ | Branch (1372:7): [True: 0, False: 12] ------------------ 1373| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(384))", {2, 16, 840, 1, 101, 3, 4, 3, 15}); 1374| 0| case 0xB2217: ------------------ | Branch (1374:7): [True: 0, False: 12] ------------------ 1375| 0| return if_match(req, "AES-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3}); 1376| 0| case 0xB22F7: ------------------ | Branch (1376:7): [True: 0, False: 12] ------------------ 1377| 0| return if_match(req, "Camellia-128/GCM", {0, 3, 4401, 5, 3, 1, 9, 6}); 1378| 0| case 0xB23DE: ------------------ | Branch (1378:7): [True: 0, False: 12] ------------------ 1379| 0| return if_match(req, "X520.Locality", {2, 5, 4, 7}); 1380| 0| case 0xB2FBD: ------------------ | Branch (1380:7): [True: 0, False: 12] ------------------ 1381| 0| return if_match(req, "ECKCDSA/SHA-224", {1, 2, 410, 200004, 1, 100, 4, 4}); 1382| 0| case 0xB32B0: ------------------ | Branch (1382:7): [True: 0, False: 12] ------------------ 1383| 0| return if_match(req, "ECKCDSA/SHA-256", {1, 2, 410, 200004, 1, 100, 4, 5}); 1384| 0| case 0xB360E: ------------------ | Branch (1384:7): [True: 0, False: 12] ------------------ 1385| 0| return if_match(req, "eFrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2}); 1386| 0| case 0xB4368: ------------------ | Branch (1386:7): [True: 0, False: 12] ------------------ 1387| 0| return if_match(req, "ECGDSA/SHA-1", {1, 3, 36, 3, 3, 2, 5, 4, 2}); 1388| 0| case 0xB58CD: ------------------ | Branch (1388:7): [True: 0, False: 12] ------------------ 1389| 0| return if_match(req, "RSA/PKCS1v15(SHA-3(512))", {2, 16, 840, 1, 101, 3, 4, 3, 16}); 1390| 0| case 0xB6427: ------------------ | Branch (1390:7): [True: 0, False: 12] ------------------ 1391| 0| return if_match(req, "Camellia-192/GCM", {0, 3, 4401, 5, 3, 1, 9, 26}); 1392| 0| case 0xB7102: ------------------ | Branch (1392:7): [True: 0, False: 12] ------------------ 1393| 0| return if_match(req, "brainpool224r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 5}); 1394| 0| case 0xB710D: ------------------ | Branch (1394:7): [True: 0, False: 12] ------------------ 1395| 0| return if_match(req, "X509v3.CRLIssuingDistributionPoint", {2, 5, 29, 28}); 1396| 0| case 0xB72D4: ------------------ | Branch (1396:7): [True: 0, False: 12] ------------------ 1397| 0| return if_match(req, "Microsoft UPN", {1, 3, 6, 1, 4, 1, 311, 20, 2, 3}); 1398| 0| case 0xB73A5: ------------------ | Branch (1398:7): [True: 0, False: 12] ------------------ 1399| 0| return if_match(req, "RSA/PSS", {1, 2, 840, 113549, 1, 1, 10}); 1400| 0| case 0xB84B3: ------------------ | Branch (1400:7): [True: 0, False: 12] ------------------ 1401| 0| return if_match(req, "PKIX.CodeSigning", {1, 3, 6, 1, 5, 5, 7, 3, 3}); 1402| 0| case 0xB8CB9: ------------------ | Branch (1402:7): [True: 0, False: 12] ------------------ 1403| 0| return if_match(req, "GOST-34.10-2012-256", {1, 2, 643, 7, 1, 1, 1, 1}); 1404| 0| case 0xB945C: ------------------ | Branch (1404:7): [True: 0, False: 12] ------------------ 1405| 0| return if_match(req, "Twofish/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5}); 1406| 0| case 0xB94E4: ------------------ | Branch (1406:7): [True: 0, False: 12] ------------------ 1407| 0| return if_match(req, "gost_512A", {1, 2, 643, 7, 1, 2, 1, 2, 1}); 1408| 0| case 0xB94E5: ------------------ | Branch (1408:7): [True: 0, False: 12] ------------------ 1409| 0| return if_match(req, "gost_512B", {1, 2, 643, 7, 1, 2, 1, 2, 2}); 1410| 0| case 0xBA1D8: ------------------ | Branch (1410:7): [True: 0, False: 12] ------------------ 1411| 0| return if_match(req, "X520.StreetAddress", {2, 5, 4, 9}); 1412| 0| case 0xBCB45: ------------------ | Branch (1412:7): [True: 0, False: 12] ------------------ 1413| 0| return if_match(req, "PKCS12.CRLBag", {1, 2, 840, 113549, 1, 12, 10, 1, 4}); 1414| 0| case 0xBCC82: ------------------ | Branch (1414:7): [True: 0, False: 12] ------------------ 1415| 0| return if_match(req, "x962_p239v1", {1, 2, 840, 10045, 3, 1, 4}); 1416| 0| case 0xBCC83: ------------------ | Branch (1416:7): [True: 0, False: 12] ------------------ 1417| 0| return if_match(req, "x962_p239v2", {1, 2, 840, 10045, 3, 1, 5}); 1418| 0| case 0xBCC84: ------------------ | Branch (1418:7): [True: 0, False: 12] ------------------ 1419| 0| return if_match(req, "x962_p239v3", {1, 2, 840, 10045, 3, 1, 6}); 1420| 0| case 0xBD92B: ------------------ | Branch (1420:7): [True: 0, False: 12] ------------------ 1421| 0| return if_match(req, "X509v3.HoldInstructionCode", {2, 5, 29, 23}); 1422| 0| case 0xBDCA9: ------------------ | Branch (1422:7): [True: 0, False: 12] ------------------ 1423| 0| return if_match(req, "AES-256/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 46}); 1424| 0| case 0xBE48D: ------------------ | Branch (1424:7): [True: 0, False: 12] ------------------ 1425| 0| return if_match(req, "PKIX.OCSP.BasicResponse", {1, 3, 6, 1, 5, 5, 7, 48, 1, 1}); 1426| 0| case 0xBF71E: ------------------ | Branch (1426:7): [True: 0, False: 12] ------------------ 1427| 0| return if_match(req, "Kyber-1024-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3}); 1428| 0| case 0xBFF01: ------------------ | Branch (1428:7): [True: 0, False: 12] ------------------ 1429| 0| return if_match(req, "DSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 5}); 1430| 0| case 0xC0F4F: ------------------ | Branch (1430:7): [True: 0, False: 12] ------------------ 1431| 0| return if_match(req, "SphincsPlus-haraka-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6}); 1432| 0| case 0xC1875: ------------------ | Branch (1432:7): [True: 0, False: 12] ------------------ 1433| 0| return if_match(req, "SHA-1", {1, 3, 14, 3, 2, 26}); 1434| 0| case 0xC28D1: ------------------ | Branch (1434:7): [True: 0, False: 12] ------------------ 1435| 0| return if_match(req, "PKIX.OCSPSigning", {1, 3, 6, 1, 5, 5, 7, 3, 9}); 1436| 1| case 0xC42CA: ------------------ | Branch (1436:7): [True: 1, False: 11] ------------------ 1437| 1| return if_match(req, "brainpool256r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 7}); 1438| 0| default: ------------------ | Branch (1438:7): [True: 0, False: 12] ------------------ 1439| 0| return {}; 1440| 12| } 1441| 12|} _ZN5Botan7OID_Map16load_oid2str_mapEv: 1443| 1|std::unordered_map OID_Map::load_oid2str_map() { 1444| 1| return { 1445| 1| {OID{2, 5, 8, 1, 1}, "RSA"}, 1446| 1| {OID{1, 3, 6, 1, 4, 1, 8301, 3, 1, 2, 9, 0, 38}, "secp521r1"}, 1447| 1| {OID{1, 2, 643, 2, 2, 35, 1}, "gost_256A"}, 1448| 1| {OID{1, 2, 643, 2, 2, 36, 0}, "gost_256A"}, 1449| 1| }; 1450| 1|} _ZN5Botan7OID_Map16load_str2oid_mapEv: 1452| 1|std::unordered_map OID_Map::load_str2oid_map() { 1453| 1| return { 1454| 1| {"Curve25519", OID{1, 3, 101, 110}}, 1455| 1| {"SM2_Sig", OID{1, 2, 156, 10197, 1, 301, 1}}, 1456| 1| {"RSA/EMSA3(MD2)", OID{1, 2, 840, 113549, 1, 1, 2}}, 1457| 1| {"RSA/EMSA3(MD5)", OID{1, 2, 840, 113549, 1, 1, 4}}, 1458| 1| {"RSA/EMSA3(SHA-1)", OID{1, 2, 840, 113549, 1, 1, 5}}, 1459| 1| {"RSA/EMSA3(SHA-256)", OID{1, 2, 840, 113549, 1, 1, 11}}, 1460| 1| {"RSA/EMSA3(SHA-384)", OID{1, 2, 840, 113549, 1, 1, 12}}, 1461| 1| {"RSA/EMSA3(SHA-512)", OID{1, 2, 840, 113549, 1, 1, 13}}, 1462| 1| {"RSA/EMSA3(SHA-224)", OID{1, 2, 840, 113549, 1, 1, 14}}, 1463| 1| {"RSA/EMSA3(SHA-512-256)", OID{1, 2, 840, 113549, 1, 1, 16}}, 1464| 1| {"RSA/EMSA3(SHA-3(224))", OID{2, 16, 840, 1, 101, 3, 4, 3, 13}}, 1465| 1| {"RSA/EMSA3(SHA-3(256))", OID{2, 16, 840, 1, 101, 3, 4, 3, 14}}, 1466| 1| {"RSA/EMSA3(SHA-3(384))", OID{2, 16, 840, 1, 101, 3, 4, 3, 15}}, 1467| 1| {"RSA/EMSA3(SHA-3(512))", OID{2, 16, 840, 1, 101, 3, 4, 3, 16}}, 1468| 1| {"RSA/EMSA3(SM3)", OID{1, 2, 156, 10197, 1, 504}}, 1469| 1| {"RSA/EMSA3(RIPEMD-160)", OID{1, 3, 36, 3, 3, 1, 2}}, 1470| 1| {"RSA/EMSA4", OID{1, 2, 840, 113549, 1, 1, 10}}, 1471| 1| {"PBES2", OID{1, 2, 840, 113549, 1, 5, 13}}, 1472| 1| }; 1473| 1|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchERKNS_3OIDESt16initializer_listIjENSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE: 18| 12|std::optional if_match(const OID& oid, std::initializer_list val, std::string_view name) { 19| 12| if(oid.matches(val)) { ------------------ | Branch (19:7): [True: 12, False: 0] ------------------ 20| 12| return name; 21| 12| } else { 22| 0| return {}; 23| 0| } 24| 12|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_113hash_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 34| 12|uint32_t hash_oid_name(std::string_view s) { 35| 12| uint64_t hash = 0x8188B31879A4879A; 36| | 37| 123| for(const char c : s) { ------------------ | Branch (37:21): [True: 123, False: 12] ------------------ 38| 123| hash *= 251; 39| 123| hash += c; 40| 123| } 41| | 42| 12| return static_cast(hash % 805289); 43| 12|} static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_St16initializer_listIjE: 26| 12|std::optional if_match(std::string_view req, std::string_view actual, std::initializer_list oid) { 27| 12| if(req == actual) { ------------------ | Branch (27:7): [True: 12, False: 0] ------------------ 28| 12| return OID(oid); 29| 12| } else { 30| 0| return {}; 31| 0| } 32| 12|} _ZN5Botan10hex_decodeEPhPKcmRmb: 75| 79|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, size_t& input_consumed, bool ignore_ws) { 76| 79| uint8_t* out_ptr = output; 77| 79| bool top_nibble = true; 78| 79| uint8_t next = 0; 79| | 80| 79| input_consumed = 0; 81| | 82| 79| clear_mem(output, input_length / 2); 83| | 84| 5.72k| for(size_t i = 0; i != input_length; ++i) { ------------------ | Branch (84:22): [True: 5.64k, False: 79] ------------------ 85| 5.64k| const uint8_t bin = hex_char_to_bin(input[i]); 86| | 87| 5.64k| if(bin >= 0x10) { ------------------ | Branch (87:10): [True: 0, False: 5.64k] ------------------ 88| 0| if(bin == 0x80 && ignore_ws) { ------------------ | Branch (88:13): [True: 0, False: 0] | Branch (88:28): [True: 0, False: 0] ------------------ 89| 0| continue; 90| 0| } 91| | 92| 0| throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i]))); 93| 0| } 94| | 95| 5.64k| if(top_nibble) { ------------------ | Branch (95:10): [True: 2.82k, False: 2.82k] ------------------ 96| 2.82k| next = bin << 4; 97| 2.82k| } else { 98| 2.82k| next |= bin; 99| 2.82k| *out_ptr = next; 100| 2.82k| } 101| | 102| 5.64k| top_nibble = !top_nibble; 103| 5.64k| if(top_nibble) { ------------------ | Branch (103:10): [True: 2.82k, False: 2.82k] ------------------ 104| 2.82k| ++out_ptr; 105| 2.82k| input_consumed = i + 1; 106| 2.82k| } 107| 5.64k| } 108| | 109| | /* 110| | * Consume trailing whitespace following the last full byte; a leftover 111| | * unpaired nibble (if any) stops the scan and is left unconsumed. 112| | */ 113| 79| while(input_consumed < input_length && hex_char_to_bin(input[input_consumed]) == 0x80) { ------------------ | Branch (113:10): [True: 0, False: 79] | Branch (113:43): [True: 0, False: 0] ------------------ 114| 0| ++input_consumed; 115| 0| } 116| | 117| 79| return (out_ptr - output); 118| 79|} _ZN5Botan10hex_decodeEPhPKcmb: 120| 79|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, bool ignore_ws) { 121| 79| size_t consumed = 0; 122| 79| const size_t written = hex_decode(output, input, input_length, consumed, ignore_ws); 123| | 124| 79| if(consumed != input_length) { ------------------ | Branch (124:7): [True: 0, False: 79] ------------------ 125| 0| throw Invalid_Argument("hex_decode: input did not have full bytes"); 126| 0| } 127| | 128| 79| return written; 129| 79|} _ZN5Botan17hex_decode_lockedEPKcmb: 142| 79|secure_vector hex_decode_locked(const char input[], size_t input_length, bool ignore_ws) { 143| 79| secure_vector bin(1 + input_length / 2); 144| | 145| 79| const size_t written = hex_decode(bin.data(), input, input_length, ignore_ws); 146| | 147| 79| bin.resize(written); 148| 79| return bin; 149| 79|} _ZN5Botan17hex_decode_lockedENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEb: 151| 62|secure_vector hex_decode_locked(std::string_view input, bool ignore_ws) { 152| 62| return hex_decode_locked(input.data(), input.size(), ignore_ws); 153| 62|} hex.cpp:_ZN5Botan12_GLOBAL__N_115hex_char_to_binEc: 55| 5.64k|uint8_t hex_char_to_bin(char input) { 56| | // Starts of valid value ranges (v_lo) and their lengths (v_range) 57| 5.64k| constexpr uint64_t v_lo = make_uint64(0, '0', 'a', 'A', ' ', '\n', '\t', '\r'); 58| 5.64k| constexpr uint64_t v_range = make_uint64(0, 10, 6, 6, 1, 1, 1, 1); 59| 5.64k| constexpr uint64_t expand8 = 0x0101010101010101; 60| 5.64k| constexpr uint64_t top64 = 0x8000000000000000; 61| | 62| 5.64k| const uint8_t x = static_cast(input); 63| 5.64k| const uint64_t x8 = x * expand8; 64| | 65| 5.64k| const uint64_t v_mask = swar_in_range(x8, v_lo, v_range) ^ top64; 66| | 67| | // This is the offset added to x to get the value we need 68| 5.64k| const uint64_t val_v = 0xd0a9c960767773 ^ static_cast(0xFF - x) << 56; 69| | 70| 5.64k| return x + static_cast(val_v >> (8 * index_of_first_set_byte(v_mask))); 71| 5.64k|} _ZN5Botan6BigInt17from_radix_digitsENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEm: 126| 72|BigInt BigInt::from_radix_digits(std::string_view digits, size_t radix) { 127| 72| if(radix == 16) { ------------------ | Branch (127:7): [True: 72, False: 0] ------------------ 128| 72| secure_vector binary; 129| | 130| 72| if(digits.size() % 2 == 1) { ------------------ | Branch (130:10): [True: 10, False: 62] ------------------ 131| | // Handle lack of leading 0 132| 10| const char buf0_with_leading_0[2] = {'0', digits[0]}; 133| | 134| 10| binary = hex_decode_locked(buf0_with_leading_0, 2); 135| | 136| 10| if(digits.size() > 1) { ------------------ | Branch (136:13): [True: 7, False: 3] ------------------ 137| 7| binary += hex_decode_locked(&digits[1], digits.size() - 1, false); 138| 7| } 139| 62| } else { 140| 62| binary = hex_decode_locked(digits, false); 141| 62| } 142| | 143| 72| return BigInt::from_bytes(binary); 144| 72| } else if(radix == 10) { ------------------ | Branch (144:14): [True: 0, False: 0] ------------------ 145| | // Use the largest power of 10 that fits in a word, accumulating 146| | // groups of digits into word-sized chunks to minimize the number 147| | // of multiprecision multiplications. 148| 0| constexpr word conversion_radix = decimal_conversion_radix(); 149| 0| constexpr size_t radix_digits = decimal_conversion_radix_digits(); 150| | 151| 0| BigInt r; 152| | 153| | // Handle the initial partial block (if digit count is not a multiple of radix_digits) 154| 0| const size_t partial_block = digits.size() % radix_digits; 155| | 156| 0| if(partial_block > 0) { ------------------ | Branch (156:10): [True: 0, False: 0] ------------------ 157| 0| word acc = 0; 158| 0| for(size_t i = 0; i < partial_block; ++i) { ------------------ | Branch (158:28): [True: 0, False: 0] ------------------ 159| 0| const char c = digits[i]; 160| 0| BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 161| 0| acc = acc * 10 + static_cast(c - '0'); 162| 0| } 163| 0| r += acc; 164| 0| } 165| | 166| | // Process full blocks of radix_digits 167| 0| for(size_t i = partial_block; i != digits.size(); i += radix_digits) { ------------------ | Branch (167:37): [True: 0, False: 0] ------------------ 168| 0| word acc = 0; 169| 0| for(size_t j = 0; j < radix_digits; ++j) { ------------------ | Branch (169:28): [True: 0, False: 0] ------------------ 170| 0| const char c = digits[i + j]; 171| 0| BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character"); ------------------ | | 35| 0| do { \ | | 36| 0| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 0| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 0, False: 0] | | | Branch (37:12): [True: 0, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 0| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 0] | | ------------------ ------------------ 172| 0| acc = acc * 10 + static_cast(c - '0'); 173| 0| } 174| 0| r *= conversion_radix; 175| 0| r += acc; 176| 0| } 177| | 178| 0| return r; 179| 0| } else { 180| 0| throw Invalid_Argument("BigInt::from_radix_digits unknown radix"); 181| 0| } 182| 72|} _ZN5Botan6BigInt4add2ERKS0_PKmmNS0_4SignE: 20| 36|BigInt BigInt::add2(const BigInt& x, const word y[], size_t y_size, BigInt::Sign y_sign) { 21| 36| const size_t x_sw = x.sig_words(); 22| | 23| 36| BigInt z = BigInt::with_capacity(std::max(x_sw, y_size) + 1); 24| | 25| 36| if(x.sign() == y_sign) { ------------------ | Branch (25:7): [True: 24, False: 12] ------------------ 26| 24| const word carry = bigint_add3(z.mutable_data(), x._data(), x_sw, y, y_size); 27| 24| z.mutable_data()[std::max(x_sw, y_size)] += carry; 28| 24| z.set_sign(x.sign()); 29| 24| } else { 30| 12| const int32_t relative_size = bigint_cmp(x.data(), x_sw, y, y_size); 31| | 32| 12| if(relative_size < 0) { ------------------ | Branch (32:10): [True: 0, False: 12] ------------------ 33| | // x < y so z = abs(y - x) 34| | // NOLINTNEXTLINE(*-suspicious-call-argument) intentionally swapping x and y here 35| 0| bigint_sub3(z.mutable_data(), y, y_size, x.data(), x_sw); 36| 0| z.set_sign(y_sign); 37| 12| } else if(relative_size == 0) { ------------------ | Branch (37:17): [True: 0, False: 12] ------------------ 38| | // Positive zero (nothing to do in this case) 39| 12| } else { 40| | /* 41| | * We know at this point that x >= y so if y_size is larger than 42| | * x_sw, we are guaranteed they are just leading zeros which can 43| | * be ignored 44| | */ 45| 12| y_size = std::min(x_sw, y_size); 46| 12| bigint_sub3(z.mutable_data(), x.data(), x_sw, y, y_size); 47| 12| z.set_sign(x.sign()); 48| 12| } 49| 12| } 50| | 51| 36| return z; 52| 36|} _ZN5Botan6BigIntC2Em: 18| 12|BigInt::BigInt(uint64_t n) { 19| 12| if constexpr(sizeof(word) == 8) { 20| 12| m_data.set_word_at(0, static_cast(n)); 21| | } else { 22| | m_data.set_word_at(1, static_cast(n >> 32)); 23| | m_data.set_word_at(0, static_cast(n)); 24| | } 25| 12|} _ZN5Botan6BigInt13with_capacityEm: 49| 60|BigInt BigInt::with_capacity(size_t size) { 50| 60| BigInt bn; 51| 60| bn.grow_to(size); 52| 60| return bn; 53| 60|} _ZN5Botan6BigInt11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 55| 72|BigInt BigInt::from_string(std::string_view str) { 56| 72| size_t prefix_bytes = 0; 57| 72| bool negative = false; 58| 72| size_t radix = 10; 59| | 60| 72| if(!str.empty() && str[0] == '-') { ------------------ | Branch (60:7): [True: 72, False: 0] | Branch (60:23): [True: 0, False: 72] ------------------ 61| 0| prefix_bytes += 1; 62| 0| negative = true; 63| 0| } 64| | 65| 72| if(str.length() > prefix_bytes + 2 && str[prefix_bytes] == '0' && str[prefix_bytes + 1] == 'x') { ------------------ | Branch (65:7): [True: 72, False: 0] | Branch (65:42): [True: 72, False: 0] | Branch (65:70): [True: 72, False: 0] ------------------ 66| 72| prefix_bytes += 2; 67| 72| radix = 16; 68| 72| } 69| | 70| 72| BigInt r = BigInt::from_radix_digits(str.substr(prefix_bytes), radix); 71| | 72| 72| if(negative) { ------------------ | Branch (72:7): [True: 0, False: 72] ------------------ 73| 0| r.set_sign(Negative); 74| 72| } else { 75| 72| r.set_sign(Positive); 76| 72| } 77| | 78| 72| return r; 79| 72|} _ZN5Botan6BigInt10from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 81| 72|BigInt BigInt::from_bytes(std::span input) { 82| 72| BigInt r; 83| 72| r.assign_from_bytes(input); 84| 72| return r; 85| 72|} _ZNK5Botan6BigInt8cmp_wordEm: 120| 48|int32_t BigInt::cmp_word(word other) const { 121| 48| if(signum() < 0) { ------------------ | Branch (121:7): [True: 0, False: 48] ------------------ 122| 0| return -1; // other is positive ... 123| 0| } 124| | 125| 48| const size_t sw = this->sig_words(); 126| 48| if(sw > 1) { ------------------ | Branch (126:7): [True: 35, False: 13] ------------------ 127| 35| return 1; // must be larger since other is just one word ... 128| 35| } 129| | 130| 13| return bigint_cmp(this->_data(), sw, &other, 1); 131| 48|} _ZNK5Botan6BigInt3cmpERKS0_b: 136| 24|int32_t BigInt::cmp(const BigInt& other, bool check_signs) const { 137| 24| if(check_signs) { ------------------ | Branch (137:7): [True: 24, False: 0] ------------------ 138| 24| if(other.signum() >= 0 && this->signum() < 0) { ------------------ | Branch (138:10): [True: 24, False: 0] | Branch (138:33): [True: 0, False: 24] ------------------ 139| 0| return -1; 140| 0| } 141| | 142| 24| if(other.signum() < 0 && this->signum() >= 0) { ------------------ | Branch (142:10): [True: 0, False: 24] | Branch (142:32): [True: 0, False: 0] ------------------ 143| 0| return 1; 144| 0| } 145| | 146| 24| if(other.signum() < 0 && this->signum() < 0) { ------------------ | Branch (146:10): [True: 0, False: 24] | Branch (146:32): [True: 0, False: 0] ------------------ 147| 0| return (-bigint_cmp(this->_data(), this->size(), other._data(), other.size())); 148| 0| } 149| 24| } 150| | 151| 24| return bigint_cmp(this->_data(), this->size(), other._data(), other.size()); 152| 24|} _ZNK5Botan6BigInt8is_equalERKS0_: 154| 24|bool BigInt::is_equal(const BigInt& other) const { 155| 24| if(this->sign() != other.sign()) { ------------------ | Branch (155:7): [True: 0, False: 24] ------------------ 156| 0| return false; 157| 0| } 158| | 159| 24| return bigint_ct_is_eq(this->_data(), this->size(), other._data(), other.size()).as_bool(); 160| 24|} _ZNK5Botan6BigInt12is_less_thanERKS0_: 162| 12|bool BigInt::is_less_than(const BigInt& other) const { 163| 12| if(this->signum() < 0 && other.signum() >= 0) { ------------------ | Branch (163:7): [True: 0, False: 12] | Branch (163:29): [True: 0, False: 0] ------------------ 164| 0| return true; 165| 0| } 166| | 167| 12| if(this->signum() >= 0 && other.signum() < 0) { ------------------ | Branch (167:7): [True: 12, False: 0] | Branch (167:30): [True: 0, False: 12] ------------------ 168| 0| return false; 169| 0| } 170| | 171| 12| if(other.signum() < 0 && this->signum() < 0) { ------------------ | Branch (171:7): [True: 0, False: 12] | Branch (171:29): [True: 0, False: 0] ------------------ 172| 0| return bigint_ct_is_lt(other._data(), other.size(), this->_data(), this->size()).as_bool(); 173| 0| } 174| | 175| 12| return bigint_ct_is_lt(this->_data(), this->size(), other._data(), other.size()).as_bool(); 176| 12|} _ZN5Botan6BigInt4Data11set_to_zeroEv: 189| 72|void BigInt::Data::set_to_zero() { 190| 72| m_reg.resize(m_reg.capacity()); 191| 72| clear_mem(m_reg.data(), m_reg.size()); 192| 72| m_sig_words = 0; 193| 72|} _ZNK5Botan6BigInt4Data14calc_sig_wordsEv: 213| 264|size_t BigInt::Data::calc_sig_words() const { 214| 264| const size_t sz = m_reg.size(); 215| 264| size_t sig = sz; 216| | 217| 264| word sub = 1; 218| | 219| 3.48k| for(size_t i = 0; i != sz; ++i) { ------------------ | Branch (219:22): [True: 3.22k, False: 264] ------------------ 220| 3.22k| const word w = m_reg[sz - i - 1]; 221| 3.22k| sub &= ct_is_zero(w); 222| 3.22k| sig -= sub; 223| 3.22k| } 224| | 225| | /* 226| | * This depends on the data so is poisoned, but unpoison it here as 227| | * later conditionals are made on the size. 228| | */ 229| 264| CT::unpoison(sig); 230| | 231| 264| return sig; 232| 264|} _ZNK5Botan6BigInt13top_bits_freeEv: 296| 60|size_t BigInt::top_bits_free() const { 297| 60| const size_t words = sig_words(); 298| | 299| 60| const word top_word = word_at(words - 1); 300| 60| const size_t bits_used = high_bit(CT::value_barrier(top_word)); 301| 60| CT::unpoison(bits_used); 302| 60| return WordInfo::bits - bits_used; 303| 60|} _ZNK5Botan6BigInt4bitsEv: 305| 60|size_t BigInt::bits() const { 306| 60| const size_t words = sig_words(); 307| | 308| 60| if(words == 0) { ------------------ | Branch (308:7): [True: 0, False: 60] ------------------ 309| 0| return 0; 310| 0| } 311| | 312| 60| const size_t full_words = (words - 1) * WordInfo::bits; 313| 60| const size_t top_bits = WordInfo::bits - top_bits_free(); 314| | 315| 60| return full_words + top_bits; 316| 60|} _ZN5Botan6BigInt17assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE: 423| 72|void BigInt::assign_from_bytes(std::span bytes) { 424| 72| clear(); 425| | 426| 72| const size_t length = bytes.size(); 427| 72| const size_t full_words = length / sizeof(word); 428| 72| const size_t extra_bytes = length % sizeof(word); 429| | 430| 72| const size_t total_words = full_words + (extra_bytes > 0 ? 1 : 0); ------------------ | Branch (430:45): [True: 16, False: 56] ------------------ 431| | 432| 72| secure_vector reg(8 * ceil_division(total_words, 8)); 433| | 434| 420| for(size_t i = 0; i != full_words; ++i) { ------------------ | Branch (434:22): [True: 348, False: 72] ------------------ 435| 348| reg[i] = load_be(bytes.last()); 436| 348| bytes = bytes.first(bytes.size() - sizeof(word)); 437| 348| } 438| | 439| 72| if(!bytes.empty()) { ------------------ | Branch (439:7): [True: 16, False: 56] ------------------ 440| 16| BOTAN_ASSERT_NOMSG(extra_bytes == bytes.size()); ------------------ | | 84| 16| do { \ | | 85| 16| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 16| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 16] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 16| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 16] | | ------------------ ------------------ 441| 16| std::array last_partial_word = {0}; 442| 16| copy_mem(std::span{last_partial_word}.last(extra_bytes), bytes); 443| 16| reg[full_words] = load_be(last_partial_word); 444| 16| } 445| | 446| 72| m_data.swap(reg); 447| 72|} _ZNK5Botan6BigInt20_const_time_unpoisonEv: 559| 828|void BigInt::_const_time_unpoison() const { 560| 828| CT::unpoison(m_data.const_data(), m_data.size()); 561| 828|} _ZN5Botan15ct_divide_pow2kEmRKNS_6BigIntE: 194| 36|BigInt ct_divide_pow2k(size_t k, const BigInt& y) { 195| 36| BOTAN_ARG_CHECK(y.signum() != 0, "Cannot divide by zero"); ------------------ | | 35| 36| do { \ | | 36| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36] | | ------------------ ------------------ 196| 36| BOTAN_ARG_CHECK(y.signum() >= 0, "Negative divisor not supported"); ------------------ | | 35| 36| do { \ | | 36| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36] | | ------------------ ------------------ 197| 36| BOTAN_ARG_CHECK(k > 1, "Invalid k"); ------------------ | | 35| 36| do { \ | | 36| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36] | | ------------------ ------------------ 198| | 199| 36| BigInt q; 200| 36| BigInt r; 201| 36| ct_divide_impl(q, r, BigInt::power_of_2(k), y); 202| 36| return q; 203| 36|} divide.cpp:_ZN5Botan12_GLOBAL__N_114ct_divide_implERNS_6BigIntES2_RKS1_S4_: 66| 36|void ct_divide_impl(BigInt& q_out, BigInt& r_out, const BigInt& x, const BigInt& y) { 67| 36| constexpr size_t WB = WordInfo::bits; 68| | 69| 36| const size_t x_words = x.sig_words(); 70| 36| const size_t y_words = y.sig_words(); 71| 36| BOTAN_ASSERT_NOMSG(y_words > 0); ------------------ | | 84| 36| do { \ | | 85| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 36| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 36] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 36| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 36] | | ------------------ ------------------ 72| | 73| 36| if(x_words < y_words) { ------------------ | Branch (73:7): [True: 0, False: 36] ------------------ 74| | // Here |x| < |y| so q = 0 and r = |x| 75| 0| r_out = x.abs(); 76| 0| q_out = BigInt::zero(); 77| 0| return; 78| 0| } 79| | 80| 36| const size_t r_words = x_words + 1; 81| 36| const size_t q_words = x_words - y_words + 1; 82| | 83| | // The number of leading zero bits of y, in [0,WB) 84| 36| const word s = static_cast(WB) - static_cast(high_bit(CT::value_barrier(y._data()[y_words - 1]))); 85| 36| const auto s_mask = CT::Mask::expand(s); 86| 36| const word s_comp = s_mask.if_set_return(static_cast(WB) - s); 87| | 88| 36| secure_vector yn(y_words); 89| 36| secure_vector rw(r_words); 90| 36| secure_vector qw(q_words); 91| | 92| | // Normalize: yn = |y| << s (which sets the top bit of yn) and rw = |x| << s; 93| | // shifting y stays within y_words words, shifting x adds at most one word 94| 36| word carry = 0; 95| 228| for(size_t i = 0; i != y_words; ++i) { ------------------ | Branch (95:22): [True: 192, False: 36] ------------------ 96| 192| const word w = y._data()[i]; 97| 192| yn[i] = (w << s) | carry; 98| 192| carry = s_mask.if_set_return(w >> s_comp); 99| 192| } 100| | 101| 36| carry = 0; 102| 456| for(size_t i = 0; i != x_words; ++i) { ------------------ | Branch (102:22): [True: 420, False: 36] ------------------ 103| 420| const word w = x._data()[i]; 104| 420| rw[i] = (w << s) | carry; 105| 420| carry = s_mask.if_set_return(w >> s_comp); 106| 420| } 107| 36| rw[x_words] = carry; 108| | 109| 36| const auto div_by_yn = divide_precomp::setup(CT::value_barrier(yn[y_words - 1])); 110| | 111| 36| if(y_words == 1) { ------------------ | Branch (111:7): [True: 0, False: 36] ------------------ 112| | /* 113| | * 2/1 word-serial division. The initial remainder is the shift-out 114| | * carry, which is less than 2^s and so less than the divisor. 115| | */ 116| 0| word r = rw[x_words]; 117| 0| for(size_t i = x_words; i > 0; --i) { ------------------ | Branch (117:31): [True: 0, False: 0] ------------------ 118| 0| const auto [qi, ri] = div_by_yn.divmod_2to1_ct(r, rw[i - 1]); 119| 0| qw[i - 1] = qi; 120| 0| r = ri; 121| 0| } 122| | 123| 0| rw[0] = r >> s; 124| 36| } else { 125| 36| const word yn1 = yn[y_words - 1]; 126| 36| const word yn2 = yn[y_words - 2]; 127| | 128| 300| for(size_t i = q_words; i > 0; --i) { ------------------ | Branch (128:31): [True: 264, False: 36] ------------------ 129| 264| const size_t j = i - 1; // current window is rw[j ... j + y_words] 130| | 131| 264| const word u2 = rw[j + y_words]; 132| 264| const word u1 = rw[j + y_words - 1]; 133| 264| const word u0 = rw[j + y_words - 2]; 134| | 135| | /* 136| | * Estimate the quotient digit from the top two words of the window. 137| | * The window invariant gives u2 <= yn1; if u2 == yn1 the 2/1 138| | * division precondition does not hold, and instead the digit 139| | * estimate is the maximum word value. 140| | */ 141| 264| const auto top_eq = CT::Mask::is_equal(u2, yn1); 142| 264| const word q_est = div_by_yn.divmod_2to1_ct(u2, u1).first; 143| 264| word qhat = top_eq.select(WordInfo::max, q_est); 144| | 145| | // Per HAC 14.23, this correction is required at most twice 146| 264| qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1); 147| 264| qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1); 148| | 149| | // Subtract qhat * yn from the window 150| 264| const word bw = bigint_submul(&rw[j], yn.data(), y_words, qhat); 151| 264| word borrow = 0; 152| 264| rw[j + y_words] = word_sub(u2, bw, &borrow); 153| | 154| | // If the digit was still one too large, the subtraction 155| | // underflowed; add back and decrement the digit 156| 264| const word cb = bigint_cnd_add(borrow, &rw[j], yn.data(), y_words); 157| 264| rw[j + y_words] += cb; 158| 264| qhat -= borrow; 159| | 160| 264| qw[j] = qhat; 161| 264| } 162| | 163| | // The remainder is in rw[0:y_words], still shifted left by s, and 164| | // rw[y_words] is zero 165| 228| for(size_t i = 0; i != y_words; ++i) { ------------------ | Branch (165:25): [True: 192, False: 36] ------------------ 166| 192| rw[i] = (rw[i] >> s) | s_mask.if_set_return(CT::value_barrier(rw[i + 1]) << s_comp); 167| 192| } 168| 36| } 169| | 170| 36| BigInt q = BigInt::_from_words(qw); 171| 36| rw.resize(y_words); 172| 36| BigInt r = BigInt::_from_words(rw); 173| | 174| 36| r_out = std::move(r); 175| 36| q_out = std::move(q); 176| 36|} divide.cpp:_ZN5Botan12_GLOBAL__N_117division_check_ctEmmmmmm: 39| 528|inline CT::Mask division_check_ct(word q, word y2, word y1, word x3, word x2, word x1) { 40| 528| word y3 = 0; 41| 528| y1 = word_madd2(q, y1, &y3); 42| 528| y2 = word_madd2(q, y2, &y3); 43| | 44| 528| const auto gt3 = CT::Mask::is_gt(y3, x3); 45| 528| const auto eq3 = CT::Mask::is_equal(y3, x3); 46| 528| const auto gt2 = CT::Mask::is_gt(y2, x2); 47| 528| const auto eq2 = CT::Mask::is_equal(y2, x2); 48| 528| const auto gt1 = CT::Mask::is_gt(y1, x1); 49| | 50| 528| return gt3 | (eq3 & (gt2 | (eq2 & gt1))); 51| 528|} _ZN5Botan17bigint_comba_sqr4EPmPKm: 22| 785k|void bigint_comba_sqr4(word z[8], const word x[4]) { 23| 785k|#if defined(BOTAN_HAS_MP_MULX) 24| 785k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (24:7): [True: 785k, False: 0] ------------------ 25| 785k| return bigint_mulx_sqr4(z, x); 26| 785k| } 27| 0|#endif 28| | 29| 0| word3 accum; 30| | 31| 0| accum.mul(x[0], x[0]); 32| 0| z[0] = accum.extract(); 33| 0| accum.mul_x2(x[0], x[1]); 34| 0| z[1] = accum.extract(); 35| 0| accum.mul_x2(x[0], x[2]); 36| 0| accum.mul(x[1], x[1]); 37| 0| z[2] = accum.extract(); 38| 0| accum.mul_x2(x[0], x[3]); 39| 0| accum.mul_x2(x[1], x[2]); 40| 0| z[3] = accum.extract(); 41| 0| accum.mul_x2(x[1], x[3]); 42| 0| accum.mul(x[2], x[2]); 43| 0| z[4] = accum.extract(); 44| 0| accum.mul_x2(x[2], x[3]); 45| 0| z[5] = accum.extract(); 46| 0| accum.mul(x[3], x[3]); 47| 0| z[6] = accum.extract(); 48| 0| z[7] = accum.extract(); 49| 0|} _ZN5Botan17bigint_comba_mul4EPmPKmS2_: 54| 289k|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) { 55| 289k|#if defined(BOTAN_HAS_MP_MULX) 56| 289k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (56:7): [True: 289k, False: 0] ------------------ 57| 289k| return bigint_mulx_mul4(z, x, y); 58| 289k| } 59| 0|#endif 60| | 61| 0| word3 accum; 62| | 63| 0| accum.mul(x[0], y[0]); 64| 0| z[0] = accum.extract(); 65| 0| accum.mul(x[0], y[1]); 66| 0| accum.mul(x[1], y[0]); 67| 0| z[1] = accum.extract(); 68| 0| accum.mul(x[0], y[2]); 69| 0| accum.mul(x[1], y[1]); 70| 0| accum.mul(x[2], y[0]); 71| 0| z[2] = accum.extract(); 72| 0| accum.mul(x[0], y[3]); 73| 0| accum.mul(x[1], y[2]); 74| 0| accum.mul(x[2], y[1]); 75| 0| accum.mul(x[3], y[0]); 76| 0| z[3] = accum.extract(); 77| 0| accum.mul(x[1], y[3]); 78| 0| accum.mul(x[2], y[2]); 79| 0| accum.mul(x[3], y[1]); 80| 0| z[4] = accum.extract(); 81| 0| accum.mul(x[2], y[3]); 82| 0| accum.mul(x[3], y[2]); 83| 0| z[5] = accum.extract(); 84| 0| accum.mul(x[3], y[3]); 85| 0| z[6] = accum.extract(); 86| 0| z[7] = accum.extract(); 87| 0|} _ZN5Botan17bigint_comba_sqr6EPmPKm: 92| 396k|void bigint_comba_sqr6(word z[12], const word x[6]) { 93| 396k|#if defined(BOTAN_HAS_MP_MULX) 94| 396k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (94:7): [True: 396k, False: 0] ------------------ 95| 396k| return bigint_mulx_sqr6(z, x); 96| 396k| } 97| 0|#endif 98| | 99| 0| word3 accum; 100| | 101| 0| accum.mul(x[0], x[0]); 102| 0| z[0] = accum.extract(); 103| 0| accum.mul_x2(x[0], x[1]); 104| 0| z[1] = accum.extract(); 105| 0| accum.mul_x2(x[0], x[2]); 106| 0| accum.mul(x[1], x[1]); 107| 0| z[2] = accum.extract(); 108| 0| accum.mul_x2(x[0], x[3]); 109| 0| accum.mul_x2(x[1], x[2]); 110| 0| z[3] = accum.extract(); 111| 0| accum.mul_x2(x[0], x[4]); 112| 0| accum.mul_x2(x[1], x[3]); 113| 0| accum.mul(x[2], x[2]); 114| 0| z[4] = accum.extract(); 115| 0| accum.mul_x2(x[0], x[5]); 116| 0| accum.mul_x2(x[1], x[4]); 117| 0| accum.mul_x2(x[2], x[3]); 118| 0| z[5] = accum.extract(); 119| 0| accum.mul_x2(x[1], x[5]); 120| 0| accum.mul_x2(x[2], x[4]); 121| 0| accum.mul(x[3], x[3]); 122| 0| z[6] = accum.extract(); 123| 0| accum.mul_x2(x[2], x[5]); 124| 0| accum.mul_x2(x[3], x[4]); 125| 0| z[7] = accum.extract(); 126| 0| accum.mul_x2(x[3], x[5]); 127| 0| accum.mul(x[4], x[4]); 128| 0| z[8] = accum.extract(); 129| 0| accum.mul_x2(x[4], x[5]); 130| 0| z[9] = accum.extract(); 131| 0| accum.mul(x[5], x[5]); 132| 0| z[10] = accum.extract(); 133| 0| z[11] = accum.extract(); 134| 0|} _ZN5Botan17bigint_comba_mul6EPmPKmS2_: 139| 136k|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) { 140| 136k|#if defined(BOTAN_HAS_MP_MULX) 141| 136k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (141:7): [True: 136k, False: 0] ------------------ 142| 136k| return bigint_mulx_mul6(z, x, y); 143| 136k| } 144| 0|#endif 145| | 146| 0| word3 accum; 147| | 148| 0| accum.mul(x[0], y[0]); 149| 0| z[0] = accum.extract(); 150| 0| accum.mul(x[0], y[1]); 151| 0| accum.mul(x[1], y[0]); 152| 0| z[1] = accum.extract(); 153| 0| accum.mul(x[0], y[2]); 154| 0| accum.mul(x[1], y[1]); 155| 0| accum.mul(x[2], y[0]); 156| 0| z[2] = accum.extract(); 157| 0| accum.mul(x[0], y[3]); 158| 0| accum.mul(x[1], y[2]); 159| 0| accum.mul(x[2], y[1]); 160| 0| accum.mul(x[3], y[0]); 161| 0| z[3] = accum.extract(); 162| 0| accum.mul(x[0], y[4]); 163| 0| accum.mul(x[1], y[3]); 164| 0| accum.mul(x[2], y[2]); 165| 0| accum.mul(x[3], y[1]); 166| 0| accum.mul(x[4], y[0]); 167| 0| z[4] = accum.extract(); 168| 0| accum.mul(x[0], y[5]); 169| 0| accum.mul(x[1], y[4]); 170| 0| accum.mul(x[2], y[3]); 171| 0| accum.mul(x[3], y[2]); 172| 0| accum.mul(x[4], y[1]); 173| 0| accum.mul(x[5], y[0]); 174| 0| z[5] = accum.extract(); 175| 0| accum.mul(x[1], y[5]); 176| 0| accum.mul(x[2], y[4]); 177| 0| accum.mul(x[3], y[3]); 178| 0| accum.mul(x[4], y[2]); 179| 0| accum.mul(x[5], y[1]); 180| 0| z[6] = accum.extract(); 181| 0| accum.mul(x[2], y[5]); 182| 0| accum.mul(x[3], y[4]); 183| 0| accum.mul(x[4], y[3]); 184| 0| accum.mul(x[5], y[2]); 185| 0| z[7] = accum.extract(); 186| 0| accum.mul(x[3], y[5]); 187| 0| accum.mul(x[4], y[4]); 188| 0| accum.mul(x[5], y[3]); 189| 0| z[8] = accum.extract(); 190| 0| accum.mul(x[4], y[5]); 191| 0| accum.mul(x[5], y[4]); 192| 0| z[9] = accum.extract(); 193| 0| accum.mul(x[5], y[5]); 194| 0| z[10] = accum.extract(); 195| 0| z[11] = accum.extract(); 196| 0|} _ZN5Botan17bigint_comba_sqr8EPmPKm: 322| 570k|void bigint_comba_sqr8(word z[16], const word x[8]) { 323| 570k|#if defined(BOTAN_HAS_MP_MULX) 324| 570k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (324:7): [True: 570k, False: 0] ------------------ 325| 570k| return bigint_mulx_sqr8(z, x); 326| 570k| } 327| 0|#endif 328| | 329| 0| word3 accum; 330| | 331| 0| accum.mul(x[0], x[0]); 332| 0| z[0] = accum.extract(); 333| 0| accum.mul_x2(x[0], x[1]); 334| 0| z[1] = accum.extract(); 335| 0| accum.mul_x2(x[0], x[2]); 336| 0| accum.mul(x[1], x[1]); 337| 0| z[2] = accum.extract(); 338| 0| accum.mul_x2(x[0], x[3]); 339| 0| accum.mul_x2(x[1], x[2]); 340| 0| z[3] = accum.extract(); 341| 0| accum.mul_x2(x[0], x[4]); 342| 0| accum.mul_x2(x[1], x[3]); 343| 0| accum.mul(x[2], x[2]); 344| 0| z[4] = accum.extract(); 345| 0| accum.mul_x2(x[0], x[5]); 346| 0| accum.mul_x2(x[1], x[4]); 347| 0| accum.mul_x2(x[2], x[3]); 348| 0| z[5] = accum.extract(); 349| 0| accum.mul_x2(x[0], x[6]); 350| 0| accum.mul_x2(x[1], x[5]); 351| 0| accum.mul_x2(x[2], x[4]); 352| 0| accum.mul(x[3], x[3]); 353| 0| z[6] = accum.extract(); 354| 0| accum.mul_x2(x[0], x[7]); 355| 0| accum.mul_x2(x[1], x[6]); 356| 0| accum.mul_x2(x[2], x[5]); 357| 0| accum.mul_x2(x[3], x[4]); 358| 0| z[7] = accum.extract(); 359| 0| accum.mul_x2(x[1], x[7]); 360| 0| accum.mul_x2(x[2], x[6]); 361| 0| accum.mul_x2(x[3], x[5]); 362| 0| accum.mul(x[4], x[4]); 363| 0| z[8] = accum.extract(); 364| 0| accum.mul_x2(x[2], x[7]); 365| 0| accum.mul_x2(x[3], x[6]); 366| 0| accum.mul_x2(x[4], x[5]); 367| 0| z[9] = accum.extract(); 368| 0| accum.mul_x2(x[3], x[7]); 369| 0| accum.mul_x2(x[4], x[6]); 370| 0| accum.mul(x[5], x[5]); 371| 0| z[10] = accum.extract(); 372| 0| accum.mul_x2(x[4], x[7]); 373| 0| accum.mul_x2(x[5], x[6]); 374| 0| z[11] = accum.extract(); 375| 0| accum.mul_x2(x[5], x[7]); 376| 0| accum.mul(x[6], x[6]); 377| 0| z[12] = accum.extract(); 378| 0| accum.mul_x2(x[6], x[7]); 379| 0| z[13] = accum.extract(); 380| 0| accum.mul(x[7], x[7]); 381| 0| z[14] = accum.extract(); 382| 0| z[15] = accum.extract(); 383| 0|} _ZN5Botan17bigint_comba_mul8EPmPKmS2_: 388| 207k|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) { 389| 207k|#if defined(BOTAN_HAS_MP_MULX) 390| 207k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (390:7): [True: 207k, False: 0] ------------------ 391| 207k| return bigint_mulx_mul8(z, x, y); 392| 207k| } 393| 0|#endif 394| | 395| 0| word3 accum; 396| | 397| 0| accum.mul(x[0], y[0]); 398| 0| z[0] = accum.extract(); 399| 0| accum.mul(x[0], y[1]); 400| 0| accum.mul(x[1], y[0]); 401| 0| z[1] = accum.extract(); 402| 0| accum.mul(x[0], y[2]); 403| 0| accum.mul(x[1], y[1]); 404| 0| accum.mul(x[2], y[0]); 405| 0| z[2] = accum.extract(); 406| 0| accum.mul(x[0], y[3]); 407| 0| accum.mul(x[1], y[2]); 408| 0| accum.mul(x[2], y[1]); 409| 0| accum.mul(x[3], y[0]); 410| 0| z[3] = accum.extract(); 411| 0| accum.mul(x[0], y[4]); 412| 0| accum.mul(x[1], y[3]); 413| 0| accum.mul(x[2], y[2]); 414| 0| accum.mul(x[3], y[1]); 415| 0| accum.mul(x[4], y[0]); 416| 0| z[4] = accum.extract(); 417| 0| accum.mul(x[0], y[5]); 418| 0| accum.mul(x[1], y[4]); 419| 0| accum.mul(x[2], y[3]); 420| 0| accum.mul(x[3], y[2]); 421| 0| accum.mul(x[4], y[1]); 422| 0| accum.mul(x[5], y[0]); 423| 0| z[5] = accum.extract(); 424| 0| accum.mul(x[0], y[6]); 425| 0| accum.mul(x[1], y[5]); 426| 0| accum.mul(x[2], y[4]); 427| 0| accum.mul(x[3], y[3]); 428| 0| accum.mul(x[4], y[2]); 429| 0| accum.mul(x[5], y[1]); 430| 0| accum.mul(x[6], y[0]); 431| 0| z[6] = accum.extract(); 432| 0| accum.mul(x[0], y[7]); 433| 0| accum.mul(x[1], y[6]); 434| 0| accum.mul(x[2], y[5]); 435| 0| accum.mul(x[3], y[4]); 436| 0| accum.mul(x[4], y[3]); 437| 0| accum.mul(x[5], y[2]); 438| 0| accum.mul(x[6], y[1]); 439| 0| accum.mul(x[7], y[0]); 440| 0| z[7] = accum.extract(); 441| 0| accum.mul(x[1], y[7]); 442| 0| accum.mul(x[2], y[6]); 443| 0| accum.mul(x[3], y[5]); 444| 0| accum.mul(x[4], y[4]); 445| 0| accum.mul(x[5], y[3]); 446| 0| accum.mul(x[6], y[2]); 447| 0| accum.mul(x[7], y[1]); 448| 0| z[8] = accum.extract(); 449| 0| accum.mul(x[2], y[7]); 450| 0| accum.mul(x[3], y[6]); 451| 0| accum.mul(x[4], y[5]); 452| 0| accum.mul(x[5], y[4]); 453| 0| accum.mul(x[6], y[3]); 454| 0| accum.mul(x[7], y[2]); 455| 0| z[9] = accum.extract(); 456| 0| accum.mul(x[3], y[7]); 457| 0| accum.mul(x[4], y[6]); 458| 0| accum.mul(x[5], y[5]); 459| 0| accum.mul(x[6], y[4]); 460| 0| accum.mul(x[7], y[3]); 461| 0| z[10] = accum.extract(); 462| 0| accum.mul(x[4], y[7]); 463| 0| accum.mul(x[5], y[6]); 464| 0| accum.mul(x[6], y[5]); 465| 0| accum.mul(x[7], y[4]); 466| 0| z[11] = accum.extract(); 467| 0| accum.mul(x[5], y[7]); 468| 0| accum.mul(x[6], y[6]); 469| 0| accum.mul(x[7], y[5]); 470| 0| z[12] = accum.extract(); 471| 0| accum.mul(x[6], y[7]); 472| 0| accum.mul(x[7], y[6]); 473| 0| z[13] = accum.extract(); 474| 0| accum.mul(x[7], y[7]); 475| 0| z[14] = accum.extract(); 476| 0| z[15] = accum.extract(); 477| 0|} _ZN5Botan17bigint_comba_sqr9EPmPKm: 482| 245k|void bigint_comba_sqr9(word z[18], const word x[9]) { 483| 245k|#if defined(BOTAN_HAS_MP_MULX) 484| 245k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (484:7): [True: 245k, False: 0] ------------------ 485| 245k| return bigint_mulx_sqr9(z, x); 486| 245k| } 487| 0|#endif 488| | 489| 0| word3 accum; 490| | 491| 0| accum.mul(x[0], x[0]); 492| 0| z[0] = accum.extract(); 493| 0| accum.mul_x2(x[0], x[1]); 494| 0| z[1] = accum.extract(); 495| 0| accum.mul_x2(x[0], x[2]); 496| 0| accum.mul(x[1], x[1]); 497| 0| z[2] = accum.extract(); 498| 0| accum.mul_x2(x[0], x[3]); 499| 0| accum.mul_x2(x[1], x[2]); 500| 0| z[3] = accum.extract(); 501| 0| accum.mul_x2(x[0], x[4]); 502| 0| accum.mul_x2(x[1], x[3]); 503| 0| accum.mul(x[2], x[2]); 504| 0| z[4] = accum.extract(); 505| 0| accum.mul_x2(x[0], x[5]); 506| 0| accum.mul_x2(x[1], x[4]); 507| 0| accum.mul_x2(x[2], x[3]); 508| 0| z[5] = accum.extract(); 509| 0| accum.mul_x2(x[0], x[6]); 510| 0| accum.mul_x2(x[1], x[5]); 511| 0| accum.mul_x2(x[2], x[4]); 512| 0| accum.mul(x[3], x[3]); 513| 0| z[6] = accum.extract(); 514| 0| accum.mul_x2(x[0], x[7]); 515| 0| accum.mul_x2(x[1], x[6]); 516| 0| accum.mul_x2(x[2], x[5]); 517| 0| accum.mul_x2(x[3], x[4]); 518| 0| z[7] = accum.extract(); 519| 0| accum.mul_x2(x[0], x[8]); 520| 0| accum.mul_x2(x[1], x[7]); 521| 0| accum.mul_x2(x[2], x[6]); 522| 0| accum.mul_x2(x[3], x[5]); 523| 0| accum.mul(x[4], x[4]); 524| 0| z[8] = accum.extract(); 525| 0| accum.mul_x2(x[1], x[8]); 526| 0| accum.mul_x2(x[2], x[7]); 527| 0| accum.mul_x2(x[3], x[6]); 528| 0| accum.mul_x2(x[4], x[5]); 529| 0| z[9] = accum.extract(); 530| 0| accum.mul_x2(x[2], x[8]); 531| 0| accum.mul_x2(x[3], x[7]); 532| 0| accum.mul_x2(x[4], x[6]); 533| 0| accum.mul(x[5], x[5]); 534| 0| z[10] = accum.extract(); 535| 0| accum.mul_x2(x[3], x[8]); 536| 0| accum.mul_x2(x[4], x[7]); 537| 0| accum.mul_x2(x[5], x[6]); 538| 0| z[11] = accum.extract(); 539| 0| accum.mul_x2(x[4], x[8]); 540| 0| accum.mul_x2(x[5], x[7]); 541| 0| accum.mul(x[6], x[6]); 542| 0| z[12] = accum.extract(); 543| 0| accum.mul_x2(x[5], x[8]); 544| 0| accum.mul_x2(x[6], x[7]); 545| 0| z[13] = accum.extract(); 546| 0| accum.mul_x2(x[6], x[8]); 547| 0| accum.mul(x[7], x[7]); 548| 0| z[14] = accum.extract(); 549| 0| accum.mul_x2(x[7], x[8]); 550| 0| z[15] = accum.extract(); 551| 0| accum.mul(x[8], x[8]); 552| 0| z[16] = accum.extract(); 553| 0| z[17] = accum.extract(); 554| 0|} _ZN5Botan17bigint_comba_mul9EPmPKmS2_: 559| 74.8k|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) { 560| 74.8k|#if defined(BOTAN_HAS_MP_MULX) 561| 74.8k| if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) { ------------------ | Branch (561:7): [True: 74.8k, False: 0] ------------------ 562| 74.8k| return bigint_mulx_mul9(z, x, y); 563| 74.8k| } 564| 0|#endif 565| | 566| 0| word3 accum; 567| | 568| 0| accum.mul(x[0], y[0]); 569| 0| z[0] = accum.extract(); 570| 0| accum.mul(x[0], y[1]); 571| 0| accum.mul(x[1], y[0]); 572| 0| z[1] = accum.extract(); 573| 0| accum.mul(x[0], y[2]); 574| 0| accum.mul(x[1], y[1]); 575| 0| accum.mul(x[2], y[0]); 576| 0| z[2] = accum.extract(); 577| 0| accum.mul(x[0], y[3]); 578| 0| accum.mul(x[1], y[2]); 579| 0| accum.mul(x[2], y[1]); 580| 0| accum.mul(x[3], y[0]); 581| 0| z[3] = accum.extract(); 582| 0| accum.mul(x[0], y[4]); 583| 0| accum.mul(x[1], y[3]); 584| 0| accum.mul(x[2], y[2]); 585| 0| accum.mul(x[3], y[1]); 586| 0| accum.mul(x[4], y[0]); 587| 0| z[4] = accum.extract(); 588| 0| accum.mul(x[0], y[5]); 589| 0| accum.mul(x[1], y[4]); 590| 0| accum.mul(x[2], y[3]); 591| 0| accum.mul(x[3], y[2]); 592| 0| accum.mul(x[4], y[1]); 593| 0| accum.mul(x[5], y[0]); 594| 0| z[5] = accum.extract(); 595| 0| accum.mul(x[0], y[6]); 596| 0| accum.mul(x[1], y[5]); 597| 0| accum.mul(x[2], y[4]); 598| 0| accum.mul(x[3], y[3]); 599| 0| accum.mul(x[4], y[2]); 600| 0| accum.mul(x[5], y[1]); 601| 0| accum.mul(x[6], y[0]); 602| 0| z[6] = accum.extract(); 603| 0| accum.mul(x[0], y[7]); 604| 0| accum.mul(x[1], y[6]); 605| 0| accum.mul(x[2], y[5]); 606| 0| accum.mul(x[3], y[4]); 607| 0| accum.mul(x[4], y[3]); 608| 0| accum.mul(x[5], y[2]); 609| 0| accum.mul(x[6], y[1]); 610| 0| accum.mul(x[7], y[0]); 611| 0| z[7] = accum.extract(); 612| 0| accum.mul(x[0], y[8]); 613| 0| accum.mul(x[1], y[7]); 614| 0| accum.mul(x[2], y[6]); 615| 0| accum.mul(x[3], y[5]); 616| 0| accum.mul(x[4], y[4]); 617| 0| accum.mul(x[5], y[3]); 618| 0| accum.mul(x[6], y[2]); 619| 0| accum.mul(x[7], y[1]); 620| 0| accum.mul(x[8], y[0]); 621| 0| z[8] = accum.extract(); 622| 0| accum.mul(x[1], y[8]); 623| 0| accum.mul(x[2], y[7]); 624| 0| accum.mul(x[3], y[6]); 625| 0| accum.mul(x[4], y[5]); 626| 0| accum.mul(x[5], y[4]); 627| 0| accum.mul(x[6], y[3]); 628| 0| accum.mul(x[7], y[2]); 629| 0| accum.mul(x[8], y[1]); 630| 0| z[9] = accum.extract(); 631| 0| accum.mul(x[2], y[8]); 632| 0| accum.mul(x[3], y[7]); 633| 0| accum.mul(x[4], y[6]); 634| 0| accum.mul(x[5], y[5]); 635| 0| accum.mul(x[6], y[4]); 636| 0| accum.mul(x[7], y[3]); 637| 0| accum.mul(x[8], y[2]); 638| 0| z[10] = accum.extract(); 639| 0| accum.mul(x[3], y[8]); 640| 0| accum.mul(x[4], y[7]); 641| 0| accum.mul(x[5], y[6]); 642| 0| accum.mul(x[6], y[5]); 643| 0| accum.mul(x[7], y[4]); 644| 0| accum.mul(x[8], y[3]); 645| 0| z[11] = accum.extract(); 646| 0| accum.mul(x[4], y[8]); 647| 0| accum.mul(x[5], y[7]); 648| 0| accum.mul(x[6], y[6]); 649| 0| accum.mul(x[7], y[5]); 650| 0| accum.mul(x[8], y[4]); 651| 0| z[12] = accum.extract(); 652| 0| accum.mul(x[5], y[8]); 653| 0| accum.mul(x[6], y[7]); 654| 0| accum.mul(x[7], y[6]); 655| 0| accum.mul(x[8], y[5]); 656| 0| z[13] = accum.extract(); 657| 0| accum.mul(x[6], y[8]); 658| 0| accum.mul(x[7], y[7]); 659| 0| accum.mul(x[8], y[6]); 660| 0| z[14] = accum.extract(); 661| 0| accum.mul(x[7], y[8]); 662| 0| accum.mul(x[8], y[7]); 663| 0| z[15] = accum.extract(); 664| 0| accum.mul(x[8], y[8]); 665| 0| z[16] = accum.extract(); 666| 0| z[17] = accum.extract(); 667| 0|} _ZN5Botan12basecase_mulEPmmPKmmS2_m: 20| 21|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) { 21| 21| if(z_size < x_size + y_size) { ------------------ | Branch (21:7): [True: 0, False: 21] ------------------ 22| 0| throw Invalid_Argument("basecase_mul z_size too small"); 23| 0| } 24| | 25| 21| const size_t x_size_8 = x_size - (x_size % 8); 26| | 27| 21| zeroize_buffer(z, z_size); 28| | 29| 188| for(size_t i = 0; i != y_size; ++i) { ------------------ | Branch (29:22): [True: 167, False: 21] ------------------ 30| 167| const word y_i = y[i]; 31| | 32| 167| word carry = 0; 33| | 34| 319| for(size_t j = 0; j != x_size_8; j += 8) { ------------------ | Branch (34:25): [True: 152, False: 167] ------------------ 35| 152| carry = word8_madd3(z + i + j, x + j, y_i, carry); 36| 152| } 37| | 38| 516| for(size_t j = x_size_8; j != x_size; ++j) { ------------------ | Branch (38:32): [True: 349, False: 167] ------------------ 39| 349| z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry); 40| 349| } 41| | 42| 167| z[x_size + i] = carry; 43| 167| } 44| 21|} _ZN5Botan12basecase_sqrEPmmPKmm: 46| 3|void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size) { 47| 3| if(z_size < 2 * x_size) { ------------------ | Branch (47:7): [True: 0, False: 3] ------------------ 48| 0| throw Invalid_Argument("basecase_sqr z_size too small"); 49| 0| } 50| | 51| 3| const size_t x_size_8 = x_size - (x_size % 8); 52| | 53| 3| zeroize_buffer(z, z_size); 54| | 55| 12| for(size_t i = 0; i != x_size; ++i) { ------------------ | Branch (55:22): [True: 9, False: 3] ------------------ 56| 9| const word x_i = x[i]; 57| | 58| 9| word carry = 0; 59| | 60| 9| for(size_t j = 0; j != x_size_8; j += 8) { ------------------ | Branch (60:25): [True: 0, False: 9] ------------------ 61| 0| carry = word8_madd3(z + i + j, x + j, x_i, carry); 62| 0| } 63| | 64| 36| for(size_t j = x_size_8; j != x_size; ++j) { ------------------ | Branch (64:32): [True: 27, False: 9] ------------------ 65| 27| z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry); 66| 27| } 67| | 68| 9| z[x_size + i] = carry; 69| 9| } 70| 3|} _ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m: 292| 276| size_t ws_size) { 293| 276| zeroize_buffer(z, z_size); 294| | 295| 276| if(x_sw == 1) { ------------------ | Branch (295:7): [True: 0, False: 276] ------------------ 296| 0| bigint_linmul3(z, y, y_sw, x[0]); 297| 276| } else if(y_sw == 1) { ------------------ | Branch (297:14): [True: 0, False: 276] ------------------ 298| 0| bigint_linmul3(z, x, x_sw, y[0]); 299| 276| } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (299:14): [True: 60, False: 216] ------------------ 300| 60| bigint_comba_mul4(z, x, y); 301| 216| } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (301:14): [True: 110, False: 106] ------------------ 302| 110| bigint_comba_mul6(z, x, y); 303| 110| } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (303:14): [True: 46, False: 60] ------------------ 304| 46| bigint_comba_mul8(z, x, y); 305| 60| } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (305:14): [True: 39, False: 21] ------------------ 306| 39| bigint_comba_mul9(z, x, y); 307| 39| } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (307:14): [True: 0, False: 21] ------------------ 308| 0| bigint_comba_mul16(z, x, y); 309| 21| } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) { ------------------ | Branch (309:14): [True: 0, False: 21] ------------------ 310| 0| bigint_comba_mul24(z, x, y); 311| 21| } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) { ------------------ | Branch (311:14): [True: 21, False: 0] | Branch (311:53): [True: 0, False: 0] | Branch (311:92): [True: 0, False: 0] ------------------ 312| 21| basecase_mul(z, z_size, x, x_sw, y, y_sw); 313| 21| } else { 314| 0| const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw); 315| | 316| 0| if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) { ------------------ | Branch (316:10): [True: 0, False: 0] | Branch (316:19): [True: 0, False: 0] | Branch (316:38): [True: 0, False: 0] ------------------ 317| 0| karatsuba_mul(z, x, y, N, workspace); 318| 0| } else { 319| 0| basecase_mul(z, z_size, x, x_sw, y, y_sw); 320| 0| } 321| 0| } 322| 276|} _ZN5Botan10bigint_sqrEPmmPKmmmS0_m: 327| 36|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) { 328| 36| zeroize_buffer(z, z_size); 329| | 330| 36| BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient"); ------------------ | | 71| 36| do { \ | | 72| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 73| 36| if(!(expr)) { \ | | ------------------ | | | Branch (73:10): [True: 0, False: 36] | | ------------------ | | 74| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 75| 0| Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \ | | 76| 0| } \ | | 77| 36| } while(0) | | ------------------ | | | Branch (77:12): [Folded, False: 36] | | ------------------ ------------------ 331| | 332| 36| if(x_sw == 1) { ------------------ | Branch (332:7): [True: 0, False: 36] ------------------ 333| 0| bigint_linmul3(z, x, x_sw, x[0]); 334| 36| } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) { ------------------ | Branch (334:14): [True: 18, False: 18] ------------------ 335| 18| bigint_comba_sqr4(z, x); 336| 18| } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) { ------------------ | Branch (336:14): [True: 6, False: 12] ------------------ 337| 6| bigint_comba_sqr6(z, x); 338| 12| } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) { ------------------ | Branch (338:14): [True: 6, False: 6] ------------------ 339| 6| bigint_comba_sqr8(z, x); 340| 6| } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) { ------------------ | Branch (340:14): [True: 3, False: 3] ------------------ 341| 3| bigint_comba_sqr9(z, x); 342| 3| } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) { ------------------ | Branch (342:14): [True: 0, False: 3] ------------------ 343| 0| bigint_comba_sqr16(z, x); 344| 3| } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) { ------------------ | Branch (344:14): [True: 0, False: 3] ------------------ 345| 0| bigint_comba_sqr24(z, x); 346| 3| } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || workspace == nullptr) { ------------------ | Branch (346:14): [True: 3, False: 0] | Branch (346:53): [True: 0, False: 0] ------------------ 347| 3| basecase_sqr(z, z_size, x, x_sw); 348| 3| } else { 349| 0| const size_t N = karatsuba_size(z_size, x_size, x_sw); 350| | 351| 0| if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) { ------------------ | Branch (351:10): [True: 0, False: 0] | Branch (351:19): [True: 0, False: 0] | Branch (351:38): [True: 0, False: 0] ------------------ 352| 0| karatsuba_sqr(z, x, N, workspace); 353| 0| } else { 354| 0| basecase_sqr(z, z_size, x, x_sw); 355| 0| } 356| 0| } 357| 36|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm: 272| 276|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 276| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 65, False: 211] | Branch (273:26): [True: 65, False: 0] | Branch (273:42): [True: 65, False: 0] | Branch (273:56): [True: 65, False: 0] | Branch (273:72): [True: 60, False: 5] ------------------ 274| 276|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm: 272| 216|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 216| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 115, False: 101] | Branch (273:26): [True: 115, False: 0] | Branch (273:42): [True: 115, False: 0] | Branch (273:56): [True: 115, False: 0] | Branch (273:72): [True: 110, False: 5] ------------------ 274| 216|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm: 272| 106|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 106| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 51, False: 55] | Branch (273:26): [True: 51, False: 0] | Branch (273:42): [True: 51, False: 0] | Branch (273:56): [True: 51, False: 0] | Branch (273:72): [True: 46, False: 5] ------------------ 274| 106|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm: 272| 60|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 60| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 44, False: 16] | Branch (273:26): [True: 40, False: 4] | Branch (273:42): [True: 40, False: 0] | Branch (273:56): [True: 40, False: 0] | Branch (273:72): [True: 39, False: 1] ------------------ 274| 60|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm: 272| 21|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 21| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 21, False: 0] | Branch (273:26): [True: 8, False: 13] | Branch (273:42): [True: 8, False: 0] | Branch (273:56): [True: 8, False: 0] | Branch (273:72): [True: 0, False: 8] ------------------ 274| 21|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm: 272| 21|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) { 273| 21| return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (273:12): [True: 21, False: 0] | Branch (273:26): [True: 0, False: 21] | Branch (273:42): [True: 0, False: 0] | Branch (273:56): [True: 0, False: 0] | Branch (273:72): [True: 0, False: 0] ------------------ 274| 21|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm: 277| 36|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 36| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 21, False: 15] | Branch (278:26): [True: 21, False: 0] | Branch (278:42): [True: 18, False: 3] ------------------ 279| 36|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm: 277| 18|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 18| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 9, False: 9] | Branch (278:26): [True: 9, False: 0] | Branch (278:42): [True: 6, False: 3] ------------------ 279| 18|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm: 277| 12|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 12| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 9, False: 3] | Branch (278:26): [True: 9, False: 0] | Branch (278:42): [True: 6, False: 3] ------------------ 279| 12|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm: 277| 6|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 6| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 6, False: 0] | Branch (278:26): [True: 4, False: 2] | Branch (278:42): [True: 3, False: 1] ------------------ 279| 6|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm16EEEbmmm: 277| 3|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 3| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 3, False: 0] | Branch (278:26): [True: 0, False: 3] | Branch (278:42): [True: 0, False: 0] ------------------ 279| 3|} mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm24EEEbmmm: 277| 3|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) { 278| 3| return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ); ------------------ | Branch (278:12): [True: 3, False: 0] | Branch (278:26): [True: 0, False: 3] | Branch (278:42): [True: 0, False: 0] ------------------ 279| 3|} _ZN5Botan25bigint_monty_redc_genericEPmPKmmS2_mmS0_: 95| 8| word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[]) { 96| 8| BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic"); ------------------ | | 35| 8| do { \ | | 36| 8| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 16| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 8, False: 0] | | | Branch (37:12): [True: 8, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 8| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 8] | | ------------------ ------------------ 97| | 98| 8| word3 accum; 99| | 100| 8| accum.add(z[0]); 101| | 102| 8| ws[0] = accum.monty_step(p[0], p_dash); 103| | 104| 48| for(size_t i = 1; i != p_size; ++i) { ------------------ | Branch (104:22): [True: 40, False: 8] ------------------ 105| 40| mul_rev_range(accum, ws, p, i); 106| 40| accum.add(z[i]); 107| 40| ws[i] = accum.monty_step(p[0], p_dash); 108| 40| } 109| | 110| 48| for(size_t i = 0; i != p_size - 1; ++i) { ------------------ | Branch (110:22): [True: 40, False: 8] ------------------ 111| 40| mul_rev_range(accum, &ws[i + 1], &p[i], p_size - (i + 1)); 112| 40| accum.add(z[p_size + i]); 113| 40| ws[i] = accum.extract(); 114| 40| } 115| | 116| 8| accum.add(z[2 * p_size - 1]); 117| | 118| 8| ws[p_size - 1] = accum.extract(); 119| | // w1 is the final part, which is not stored in the workspace 120| 8| const word w1 = accum.extract(); 121| | 122| | /* 123| | * The result might need to be reduced mod p. To avoid a timing 124| | * channel, always perform the subtraction. If in the computation 125| | * of x - p a borrow is required then x was already < p. 126| | * 127| | * x starts at ws[0] and is p_size bytes long plus a possible high 128| | * digit left over in w1. 129| | * 130| | * x - p starts at z[0] and is also p_size bytes long 131| | * 132| | * If borrow was set after the subtraction, then x was already less 133| | * than p and the subtraction was not needed. In that case overwrite 134| | * z[0:p_size] with the original x in ws[0:p_size]. 135| | * 136| | * We only copy out p_size in the final step because we know 137| | * the Montgomery result is < P 138| | */ 139| | 140| 8| bigint_monty_maybe_sub(p_size, r, w1, ws, p); 141| 8|} mp_monty.cpp:_ZN5Botan12_GLOBAL__N_113mul_rev_rangeERNS_5word3ImEEPKmS5_m: 22| 80|BOTAN_FORCE_INLINE void mul_rev_range(word3& accum, const word ws[], const word p[], size_t bound) { 23| | /* 24| | Unrolled version of: 25| | 26| | for(size_t i = 0; i < bound; ++i) { 27| | accum.mul(ws[i], p[bound - i]); 28| | } 29| | */ 30| | 31| 80| size_t lower = 0; 32| 200| while(lower < bound) { ------------------ | Branch (32:10): [True: 120, False: 80] ------------------ 33| 120| const size_t upper = bound - lower; 34| | 35| 120| if(upper >= 16) { ------------------ | Branch (35:10): [True: 0, False: 120] ------------------ 36| 0| accum.mul(ws[lower], p[upper]); 37| 0| accum.mul(ws[lower + 1], p[upper - 1]); 38| 0| accum.mul(ws[lower + 2], p[upper - 2]); 39| 0| accum.mul(ws[lower + 3], p[upper - 3]); 40| 0| accum.mul(ws[lower + 4], p[upper - 4]); 41| 0| accum.mul(ws[lower + 5], p[upper - 5]); 42| 0| accum.mul(ws[lower + 6], p[upper - 6]); 43| 0| accum.mul(ws[lower + 7], p[upper - 7]); 44| 0| accum.mul(ws[lower + 8], p[upper - 8]); 45| 0| accum.mul(ws[lower + 9], p[upper - 9]); 46| 0| accum.mul(ws[lower + 10], p[upper - 10]); 47| 0| accum.mul(ws[lower + 11], p[upper - 11]); 48| 0| accum.mul(ws[lower + 12], p[upper - 12]); 49| 0| accum.mul(ws[lower + 13], p[upper - 13]); 50| 0| accum.mul(ws[lower + 14], p[upper - 14]); 51| 0| accum.mul(ws[lower + 15], p[upper - 15]); 52| 0| lower += 16; 53| 120| } else if(upper >= 8) { ------------------ | Branch (53:17): [True: 8, False: 112] ------------------ 54| 8| accum.mul(ws[lower], p[upper]); 55| 8| accum.mul(ws[lower + 1], p[upper - 1]); 56| 8| accum.mul(ws[lower + 2], p[upper - 2]); 57| 8| accum.mul(ws[lower + 3], p[upper - 3]); 58| 8| accum.mul(ws[lower + 4], p[upper - 4]); 59| 8| accum.mul(ws[lower + 5], p[upper - 5]); 60| 8| accum.mul(ws[lower + 6], p[upper - 6]); 61| 8| accum.mul(ws[lower + 7], p[upper - 7]); 62| 8| lower += 8; 63| 112| } else if(upper >= 4) { ------------------ | Branch (63:17): [True: 32, False: 80] ------------------ 64| 32| accum.mul(ws[lower], p[upper]); 65| 32| accum.mul(ws[lower + 1], p[upper - 1]); 66| 32| accum.mul(ws[lower + 2], p[upper - 2]); 67| 32| accum.mul(ws[lower + 3], p[upper - 3]); 68| 32| lower += 4; 69| 80| } else if(upper >= 2) { ------------------ | Branch (69:17): [True: 40, False: 40] ------------------ 70| 40| accum.mul(ws[lower], p[upper]); 71| 40| accum.mul(ws[lower + 1], p[upper - 1]); 72| 40| lower += 2; 73| 40| } else { 74| 40| accum.mul(ws[lower], p[upper]); 75| 40| lower += 1; 76| 40| } 77| 120| } 78| 80|} _ZN5Botan19bigint_monty_redc_4EPmPKmS2_mS0_: 12| 968k|void bigint_monty_redc_4(word r[4], const word z[8], const word p[4], word p_dash, word ws[4]) { 13| 968k| word3 accum; 14| 968k| accum.add(z[0]); 15| 968k| ws[0] = accum.monty_step(p[0], p_dash); 16| 968k| accum.mul(ws[0], p[1]); 17| 968k| accum.add(z[1]); 18| 968k| ws[1] = accum.monty_step(p[0], p_dash); 19| 968k| accum.mul(ws[0], p[2]); 20| 968k| accum.mul(ws[1], p[1]); 21| 968k| accum.add(z[2]); 22| 968k| ws[2] = accum.monty_step(p[0], p_dash); 23| 968k| accum.mul(ws[0], p[3]); 24| 968k| accum.mul(ws[1], p[2]); 25| 968k| accum.mul(ws[2], p[1]); 26| 968k| accum.add(z[3]); 27| 968k| ws[3] = accum.monty_step(p[0], p_dash); 28| 968k| accum.mul(ws[1], p[3]); 29| 968k| accum.mul(ws[2], p[2]); 30| 968k| accum.mul(ws[3], p[1]); 31| 968k| accum.add(z[4]); 32| 968k| ws[0] = accum.extract(); 33| 968k| accum.mul(ws[2], p[3]); 34| 968k| accum.mul(ws[3], p[2]); 35| 968k| accum.add(z[5]); 36| 968k| ws[1] = accum.extract(); 37| 968k| accum.mul(ws[3], p[3]); 38| 968k| accum.add(z[6]); 39| 968k| ws[2] = accum.extract(); 40| 968k| accum.add(z[7]); 41| 968k| ws[3] = accum.extract(); 42| 968k| const word w1 = accum.extract(); 43| 968k| bigint_monty_maybe_sub<4>(r, w1, ws, p); 44| 968k|} _ZN5Botan19bigint_monty_redc_6EPmPKmS2_mS0_: 46| 491k|void bigint_monty_redc_6(word r[6], const word z[12], const word p[6], word p_dash, word ws[6]) { 47| 491k| word3 accum; 48| 491k| accum.add(z[0]); 49| 491k| ws[0] = accum.monty_step(p[0], p_dash); 50| 491k| accum.mul(ws[0], p[1]); 51| 491k| accum.add(z[1]); 52| 491k| ws[1] = accum.monty_step(p[0], p_dash); 53| 491k| accum.mul(ws[0], p[2]); 54| 491k| accum.mul(ws[1], p[1]); 55| 491k| accum.add(z[2]); 56| 491k| ws[2] = accum.monty_step(p[0], p_dash); 57| 491k| accum.mul(ws[0], p[3]); 58| 491k| accum.mul(ws[1], p[2]); 59| 491k| accum.mul(ws[2], p[1]); 60| 491k| accum.add(z[3]); 61| 491k| ws[3] = accum.monty_step(p[0], p_dash); 62| 491k| accum.mul(ws[0], p[4]); 63| 491k| accum.mul(ws[1], p[3]); 64| 491k| accum.mul(ws[2], p[2]); 65| 491k| accum.mul(ws[3], p[1]); 66| 491k| accum.add(z[4]); 67| 491k| ws[4] = accum.monty_step(p[0], p_dash); 68| 491k| accum.mul(ws[0], p[5]); 69| 491k| accum.mul(ws[1], p[4]); 70| 491k| accum.mul(ws[2], p[3]); 71| 491k| accum.mul(ws[3], p[2]); 72| 491k| accum.mul(ws[4], p[1]); 73| 491k| accum.add(z[5]); 74| 491k| ws[5] = accum.monty_step(p[0], p_dash); 75| 491k| accum.mul(ws[1], p[5]); 76| 491k| accum.mul(ws[2], p[4]); 77| 491k| accum.mul(ws[3], p[3]); 78| 491k| accum.mul(ws[4], p[2]); 79| 491k| accum.mul(ws[5], p[1]); 80| 491k| accum.add(z[6]); 81| 491k| ws[0] = accum.extract(); 82| 491k| accum.mul(ws[2], p[5]); 83| 491k| accum.mul(ws[3], p[4]); 84| 491k| accum.mul(ws[4], p[3]); 85| 491k| accum.mul(ws[5], p[2]); 86| 491k| accum.add(z[7]); 87| 491k| ws[1] = accum.extract(); 88| 491k| accum.mul(ws[3], p[5]); 89| 491k| accum.mul(ws[4], p[4]); 90| 491k| accum.mul(ws[5], p[3]); 91| 491k| accum.add(z[8]); 92| 491k| ws[2] = accum.extract(); 93| 491k| accum.mul(ws[4], p[5]); 94| 491k| accum.mul(ws[5], p[4]); 95| 491k| accum.add(z[9]); 96| 491k| ws[3] = accum.extract(); 97| 491k| accum.mul(ws[5], p[5]); 98| 491k| accum.add(z[10]); 99| 491k| ws[4] = accum.extract(); 100| 491k| accum.add(z[11]); 101| 491k| ws[5] = accum.extract(); 102| 491k| const word w1 = accum.extract(); 103| 491k| bigint_monty_maybe_sub<6>(r, w1, ws, p); 104| 491k|} _ZN5Botan19bigint_monty_redc_8EPmPKmS2_mS0_: 106| 721k|void bigint_monty_redc_8(word r[8], const word z[16], const word p[8], word p_dash, word ws[8]) { 107| 721k| word3 accum; 108| 721k| accum.add(z[0]); 109| 721k| ws[0] = accum.monty_step(p[0], p_dash); 110| 721k| accum.mul(ws[0], p[1]); 111| 721k| accum.add(z[1]); 112| 721k| ws[1] = accum.monty_step(p[0], p_dash); 113| 721k| accum.mul(ws[0], p[2]); 114| 721k| accum.mul(ws[1], p[1]); 115| 721k| accum.add(z[2]); 116| 721k| ws[2] = accum.monty_step(p[0], p_dash); 117| 721k| accum.mul(ws[0], p[3]); 118| 721k| accum.mul(ws[1], p[2]); 119| 721k| accum.mul(ws[2], p[1]); 120| 721k| accum.add(z[3]); 121| 721k| ws[3] = accum.monty_step(p[0], p_dash); 122| 721k| accum.mul(ws[0], p[4]); 123| 721k| accum.mul(ws[1], p[3]); 124| 721k| accum.mul(ws[2], p[2]); 125| 721k| accum.mul(ws[3], p[1]); 126| 721k| accum.add(z[4]); 127| 721k| ws[4] = accum.monty_step(p[0], p_dash); 128| 721k| accum.mul(ws[0], p[5]); 129| 721k| accum.mul(ws[1], p[4]); 130| 721k| accum.mul(ws[2], p[3]); 131| 721k| accum.mul(ws[3], p[2]); 132| 721k| accum.mul(ws[4], p[1]); 133| 721k| accum.add(z[5]); 134| 721k| ws[5] = accum.monty_step(p[0], p_dash); 135| 721k| accum.mul(ws[0], p[6]); 136| 721k| accum.mul(ws[1], p[5]); 137| 721k| accum.mul(ws[2], p[4]); 138| 721k| accum.mul(ws[3], p[3]); 139| 721k| accum.mul(ws[4], p[2]); 140| 721k| accum.mul(ws[5], p[1]); 141| 721k| accum.add(z[6]); 142| 721k| ws[6] = accum.monty_step(p[0], p_dash); 143| 721k| accum.mul(ws[0], p[7]); 144| 721k| accum.mul(ws[1], p[6]); 145| 721k| accum.mul(ws[2], p[5]); 146| 721k| accum.mul(ws[3], p[4]); 147| 721k| accum.mul(ws[4], p[3]); 148| 721k| accum.mul(ws[5], p[2]); 149| 721k| accum.mul(ws[6], p[1]); 150| 721k| accum.add(z[7]); 151| 721k| ws[7] = accum.monty_step(p[0], p_dash); 152| 721k| accum.mul(ws[1], p[7]); 153| 721k| accum.mul(ws[2], p[6]); 154| 721k| accum.mul(ws[3], p[5]); 155| 721k| accum.mul(ws[4], p[4]); 156| 721k| accum.mul(ws[5], p[3]); 157| 721k| accum.mul(ws[6], p[2]); 158| 721k| accum.mul(ws[7], p[1]); 159| 721k| accum.add(z[8]); 160| 721k| ws[0] = accum.extract(); 161| 721k| accum.mul(ws[2], p[7]); 162| 721k| accum.mul(ws[3], p[6]); 163| 721k| accum.mul(ws[4], p[5]); 164| 721k| accum.mul(ws[5], p[4]); 165| 721k| accum.mul(ws[6], p[3]); 166| 721k| accum.mul(ws[7], p[2]); 167| 721k| accum.add(z[9]); 168| 721k| ws[1] = accum.extract(); 169| 721k| accum.mul(ws[3], p[7]); 170| 721k| accum.mul(ws[4], p[6]); 171| 721k| accum.mul(ws[5], p[5]); 172| 721k| accum.mul(ws[6], p[4]); 173| 721k| accum.mul(ws[7], p[3]); 174| 721k| accum.add(z[10]); 175| 721k| ws[2] = accum.extract(); 176| 721k| accum.mul(ws[4], p[7]); 177| 721k| accum.mul(ws[5], p[6]); 178| 721k| accum.mul(ws[6], p[5]); 179| 721k| accum.mul(ws[7], p[4]); 180| 721k| accum.add(z[11]); 181| 721k| ws[3] = accum.extract(); 182| 721k| accum.mul(ws[5], p[7]); 183| 721k| accum.mul(ws[6], p[6]); 184| 721k| accum.mul(ws[7], p[5]); 185| 721k| accum.add(z[12]); 186| 721k| ws[4] = accum.extract(); 187| 721k| accum.mul(ws[6], p[7]); 188| 721k| accum.mul(ws[7], p[6]); 189| 721k| accum.add(z[13]); 190| 721k| ws[5] = accum.extract(); 191| 721k| accum.mul(ws[7], p[7]); 192| 721k| accum.add(z[14]); 193| 721k| ws[6] = accum.extract(); 194| 721k| accum.add(z[15]); 195| 721k| ws[7] = accum.extract(); 196| 721k| const word w1 = accum.extract(); 197| 721k| bigint_monty_maybe_sub<8>(r, w1, ws, p); 198| 721k|} _ZN5Botan16bigint_mulx_sqr4EPmPKm: 27| 785k|void bigint_mulx_sqr4(word z[8], const word x[4]) { 28| | // clang-format off 29| 785k| asm( 30| 785k| "xorl %%r9d, %%r9d\n\t" 31| 785k| "xorl %%r10d, %%r10d\n\t" 32| 785k| "xorl %%r8d, %%r8d\n\t" 33| | 34| 785k| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..3] 35| 785k| "xorl %%eax, %%eax\n\t" 36| 785k| "mulx 8(%[x]), %%rax, %%rcx\n\t" 37| 785k| "adcx %%rax, %%r9\n\t" 38| 785k| "movq %%r9, 8(%[z])\n\t" 39| 785k| "mulx 16(%[x]), %%rax, %%r9\n\t" 40| 785k| "adox %%rcx, %%rax\n\t" 41| 785k| "adcx %%rax, %%r10\n\t" 42| 785k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 43| 785k| "adox %%r9, %%rax\n\t" 44| 785k| "adcx %%rax, %%r8\n\t" 45| 785k| "movl $0, %%eax\n\t" 46| 785k| "adox %%rax, %%rcx\n\t" 47| 785k| "adcx %%rax, %%rcx\n\t" 48| 785k| "movq %%rcx, %%r9\n\t" 49| 785k| "movq %%r10, 16(%[z])\n\t" 50| | 51| 785k| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..3] 52| 785k| "xorl %%eax, %%eax\n\t" 53| 785k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 54| 785k| "adcx %%rax, %%r8\n\t" 55| 785k| "movq %%r8, 24(%[z])\n\t" 56| 785k| "mulx 24(%[x]), %%rax, %%r10\n\t" 57| 785k| "adox %%rcx, %%rax\n\t" 58| 785k| "adcx %%rax, %%r9\n\t" 59| 785k| "movl $0, %%eax\n\t" 60| 785k| "adox %%rax, %%r10\n\t" 61| 785k| "adcx %%rax, %%r10\n\t" 62| 785k| "movq %%r9, 32(%[z])\n\t" 63| | 64| 785k| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..3] 65| 785k| "xorl %%eax, %%eax\n\t" 66| 785k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 67| 785k| "adcx %%rax, %%r10\n\t" 68| 785k| "movq %%r10, 40(%[z])\n\t" 69| 785k| "movl $0, %%eax\n\t" 70| 785k| "adox %%rax, %%rcx\n\t" 71| 785k| "adcx %%rax, %%rcx\n\t" 72| 785k| "movq %%rcx, %%r8\n\t" 73| 785k| "movq %%r8, 48(%[z])\n\t" 74| | 75| 785k| "movq $0, 56(%[z])\n\t" 76| 785k| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 77| 785k| "movq 0(%[x]), %%rdx\n\t" 78| 785k| "mulx %%rdx, %%rax, %%rcx\n\t" 79| 785k| "movq %%rax, 0(%[z])\n\t" 80| 785k| "movq 8(%[z]), %%r8\n\t" 81| 785k| "adcx %%r8, %%r8\n\t" 82| 785k| "adox %%rcx, %%r8\n\t" 83| 785k| "movq %%r8, 8(%[z])\n\t" 84| 785k| "movq 8(%[x]), %%rdx\n\t" 85| 785k| "mulx %%rdx, %%rax, %%rcx\n\t" 86| 785k| "movq 16(%[z]), %%r8\n\t" 87| 785k| "adcx %%r8, %%r8\n\t" 88| 785k| "adox %%rax, %%r8\n\t" 89| 785k| "movq %%r8, 16(%[z])\n\t" 90| 785k| "movq 24(%[z]), %%r8\n\t" 91| 785k| "adcx %%r8, %%r8\n\t" 92| 785k| "adox %%rcx, %%r8\n\t" 93| 785k| "movq %%r8, 24(%[z])\n\t" 94| 785k| "movq 16(%[x]), %%rdx\n\t" 95| 785k| "mulx %%rdx, %%rax, %%rcx\n\t" 96| 785k| "movq 32(%[z]), %%r8\n\t" 97| 785k| "adcx %%r8, %%r8\n\t" 98| 785k| "adox %%rax, %%r8\n\t" 99| 785k| "movq %%r8, 32(%[z])\n\t" 100| 785k| "movq 40(%[z]), %%r8\n\t" 101| 785k| "adcx %%r8, %%r8\n\t" 102| 785k| "adox %%rcx, %%r8\n\t" 103| 785k| "movq %%r8, 40(%[z])\n\t" 104| 785k| "movq 24(%[x]), %%rdx\n\t" 105| 785k| "mulx %%rdx, %%rax, %%rcx\n\t" 106| 785k| "movq 48(%[z]), %%r8\n\t" 107| 785k| "adcx %%r8, %%r8\n\t" 108| 785k| "adox %%rax, %%r8\n\t" 109| 785k| "movq %%r8, 48(%[z])\n\t" 110| 785k| "movq 56(%[z]), %%r8\n\t" 111| 785k| "adcx %%r8, %%r8\n\t" 112| 785k| "adox %%rcx, %%r8\n\t" 113| 785k| "movq %%r8, 56(%[z])\n\t" 114| 785k| : 115| 785k| : [z] "r"(z), [x] "r"(x) 116| 785k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "cc", "memory"); 117| | // clang-format on 118| 785k|} _ZN5Botan16bigint_mulx_mul4EPmPKmS2_: 120| 289k|void bigint_mulx_mul4(word z[8], const word x[4], const word y[4]) { 121| | // clang-format off 122| 289k| asm( 123| 289k| "xorl %%r8d, %%r8d\n\t" 124| 289k| "xorl %%r9d, %%r9d\n\t" 125| 289k| "xorl %%r10d, %%r10d\n\t" 126| 289k| "xorl %%r11d, %%r11d\n\t" 127| | 128| 289k| "movq 0(%[y]), %%rdx\n\t" // row 0: x * y[0] 129| 289k| "xorl %%eax, %%eax\n\t" 130| 289k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 131| 289k| "adcx %%rax, %%r8\n\t" 132| 289k| "movq %%r8, 0(%[z])\n\t" 133| 289k| "mulx 8(%[x]), %%rax, %%r8\n\t" 134| 289k| "adox %%rcx, %%rax\n\t" 135| 289k| "adcx %%rax, %%r9\n\t" 136| 289k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 137| 289k| "adox %%r8, %%rax\n\t" 138| 289k| "adcx %%rax, %%r10\n\t" 139| 289k| "mulx 24(%[x]), %%rax, %%r8\n\t" 140| 289k| "adox %%rcx, %%rax\n\t" 141| 289k| "adcx %%rax, %%r11\n\t" 142| 289k| "movl $0, %%eax\n\t" 143| 289k| "adox %%rax, %%r8\n\t" 144| 289k| "adcx %%rax, %%r8\n\t" 145| | 146| 289k| "movq 8(%[y]), %%rdx\n\t" // row 1: x * y[1] 147| 289k| "xorl %%eax, %%eax\n\t" 148| 289k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 149| 289k| "adcx %%rax, %%r9\n\t" 150| 289k| "movq %%r9, 8(%[z])\n\t" 151| 289k| "mulx 8(%[x]), %%rax, %%r9\n\t" 152| 289k| "adox %%rcx, %%rax\n\t" 153| 289k| "adcx %%rax, %%r10\n\t" 154| 289k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 155| 289k| "adox %%r9, %%rax\n\t" 156| 289k| "adcx %%rax, %%r11\n\t" 157| 289k| "mulx 24(%[x]), %%rax, %%r9\n\t" 158| 289k| "adox %%rcx, %%rax\n\t" 159| 289k| "adcx %%rax, %%r8\n\t" 160| 289k| "movl $0, %%eax\n\t" 161| 289k| "adox %%rax, %%r9\n\t" 162| 289k| "adcx %%rax, %%r9\n\t" 163| | 164| 289k| "movq 16(%[y]), %%rdx\n\t" // row 2: x * y[2] 165| 289k| "xorl %%eax, %%eax\n\t" 166| 289k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 167| 289k| "adcx %%rax, %%r10\n\t" 168| 289k| "movq %%r10, 16(%[z])\n\t" 169| 289k| "mulx 8(%[x]), %%rax, %%r10\n\t" 170| 289k| "adox %%rcx, %%rax\n\t" 171| 289k| "adcx %%rax, %%r11\n\t" 172| 289k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 173| 289k| "adox %%r10, %%rax\n\t" 174| 289k| "adcx %%rax, %%r8\n\t" 175| 289k| "mulx 24(%[x]), %%rax, %%r10\n\t" 176| 289k| "adox %%rcx, %%rax\n\t" 177| 289k| "adcx %%rax, %%r9\n\t" 178| 289k| "movl $0, %%eax\n\t" 179| 289k| "adox %%rax, %%r10\n\t" 180| 289k| "adcx %%rax, %%r10\n\t" 181| | 182| 289k| "movq 24(%[y]), %%rdx\n\t" // row 3: x * y[3] 183| 289k| "xorl %%eax, %%eax\n\t" 184| 289k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 185| 289k| "adcx %%rax, %%r11\n\t" 186| 289k| "movq %%r11, 24(%[z])\n\t" 187| 289k| "mulx 8(%[x]), %%rax, %%r11\n\t" 188| 289k| "adox %%rcx, %%rax\n\t" 189| 289k| "adcx %%rax, %%r8\n\t" 190| 289k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 191| 289k| "adox %%r11, %%rax\n\t" 192| 289k| "adcx %%rax, %%r9\n\t" 193| 289k| "mulx 24(%[x]), %%rax, %%r11\n\t" 194| 289k| "adox %%rcx, %%rax\n\t" 195| 289k| "adcx %%rax, %%r10\n\t" 196| 289k| "movl $0, %%eax\n\t" 197| 289k| "adox %%rax, %%r11\n\t" 198| 289k| "adcx %%rax, %%r11\n\t" 199| | 200| 289k| "movq %%r8, 32(%[z])\n\t" 201| 289k| "movq %%r9, 40(%[z])\n\t" 202| 289k| "movq %%r10, 48(%[z])\n\t" 203| 289k| "movq %%r11, 56(%[z])\n\t" 204| 289k| : 205| 289k| : [z] "r"(z), [x] "r"(x), [y] "r"(y) 206| 289k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "cc", "memory"); 207| | // clang-format on 208| 289k|} _ZN5Botan16bigint_mulx_sqr6EPmPKm: 210| 396k|void bigint_mulx_sqr6(word z[12], const word x[6]) { 211| | // clang-format off 212| 396k| asm( 213| 396k| "xorl %%r9d, %%r9d\n\t" 214| 396k| "xorl %%r10d, %%r10d\n\t" 215| 396k| "xorl %%r11d, %%r11d\n\t" 216| 396k| "xorl %%r12d, %%r12d\n\t" 217| 396k| "xorl %%r8d, %%r8d\n\t" 218| | 219| 396k| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..5] 220| 396k| "xorl %%eax, %%eax\n\t" 221| 396k| "mulx 8(%[x]), %%rax, %%rcx\n\t" 222| 396k| "adcx %%rax, %%r9\n\t" 223| 396k| "movq %%r9, 8(%[z])\n\t" 224| 396k| "mulx 16(%[x]), %%rax, %%r9\n\t" 225| 396k| "adox %%rcx, %%rax\n\t" 226| 396k| "adcx %%rax, %%r10\n\t" 227| 396k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 228| 396k| "adox %%r9, %%rax\n\t" 229| 396k| "adcx %%rax, %%r11\n\t" 230| 396k| "mulx 32(%[x]), %%rax, %%r9\n\t" 231| 396k| "adox %%rcx, %%rax\n\t" 232| 396k| "adcx %%rax, %%r12\n\t" 233| 396k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 234| 396k| "adox %%r9, %%rax\n\t" 235| 396k| "adcx %%rax, %%r8\n\t" 236| 396k| "movl $0, %%eax\n\t" 237| 396k| "adox %%rax, %%rcx\n\t" 238| 396k| "adcx %%rax, %%rcx\n\t" 239| 396k| "movq %%rcx, %%r9\n\t" 240| 396k| "movq %%r10, 16(%[z])\n\t" 241| | 242| 396k| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..5] 243| 396k| "xorl %%eax, %%eax\n\t" 244| 396k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 245| 396k| "adcx %%rax, %%r11\n\t" 246| 396k| "movq %%r11, 24(%[z])\n\t" 247| 396k| "mulx 24(%[x]), %%rax, %%r10\n\t" 248| 396k| "adox %%rcx, %%rax\n\t" 249| 396k| "adcx %%rax, %%r12\n\t" 250| 396k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 251| 396k| "adox %%r10, %%rax\n\t" 252| 396k| "adcx %%rax, %%r8\n\t" 253| 396k| "mulx 40(%[x]), %%rax, %%r10\n\t" 254| 396k| "adox %%rcx, %%rax\n\t" 255| 396k| "adcx %%rax, %%r9\n\t" 256| 396k| "movl $0, %%eax\n\t" 257| 396k| "adox %%rax, %%r10\n\t" 258| 396k| "adcx %%rax, %%r10\n\t" 259| 396k| "movq %%r12, 32(%[z])\n\t" 260| | 261| 396k| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..5] 262| 396k| "xorl %%eax, %%eax\n\t" 263| 396k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 264| 396k| "adcx %%rax, %%r8\n\t" 265| 396k| "movq %%r8, 40(%[z])\n\t" 266| 396k| "mulx 32(%[x]), %%rax, %%r11\n\t" 267| 396k| "adox %%rcx, %%rax\n\t" 268| 396k| "adcx %%rax, %%r9\n\t" 269| 396k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 270| 396k| "adox %%r11, %%rax\n\t" 271| 396k| "adcx %%rax, %%r10\n\t" 272| 396k| "movl $0, %%eax\n\t" 273| 396k| "adox %%rax, %%rcx\n\t" 274| 396k| "adcx %%rax, %%rcx\n\t" 275| 396k| "movq %%rcx, %%r11\n\t" 276| 396k| "movq %%r9, 48(%[z])\n\t" 277| | 278| 396k| "movq 24(%[x]), %%rdx\n\t" // x[3] * x[4..5] 279| 396k| "xorl %%eax, %%eax\n\t" 280| 396k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 281| 396k| "adcx %%rax, %%r10\n\t" 282| 396k| "movq %%r10, 56(%[z])\n\t" 283| 396k| "mulx 40(%[x]), %%rax, %%r12\n\t" 284| 396k| "adox %%rcx, %%rax\n\t" 285| 396k| "adcx %%rax, %%r11\n\t" 286| 396k| "movl $0, %%eax\n\t" 287| 396k| "adox %%rax, %%r12\n\t" 288| 396k| "adcx %%rax, %%r12\n\t" 289| 396k| "movq %%r11, 64(%[z])\n\t" 290| | 291| 396k| "movq 32(%[x]), %%rdx\n\t" // x[4] * x[5..5] 292| 396k| "xorl %%eax, %%eax\n\t" 293| 396k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 294| 396k| "adcx %%rax, %%r12\n\t" 295| 396k| "movq %%r12, 72(%[z])\n\t" 296| 396k| "movl $0, %%eax\n\t" 297| 396k| "adox %%rax, %%rcx\n\t" 298| 396k| "adcx %%rax, %%rcx\n\t" 299| 396k| "movq %%rcx, %%r8\n\t" 300| 396k| "movq %%r8, 80(%[z])\n\t" 301| | 302| 396k| "movq $0, 88(%[z])\n\t" 303| 396k| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 304| 396k| "movq 0(%[x]), %%rdx\n\t" 305| 396k| "mulx %%rdx, %%rax, %%rcx\n\t" 306| 396k| "movq %%rax, 0(%[z])\n\t" 307| 396k| "movq 8(%[z]), %%r8\n\t" 308| 396k| "adcx %%r8, %%r8\n\t" 309| 396k| "adox %%rcx, %%r8\n\t" 310| 396k| "movq %%r8, 8(%[z])\n\t" 311| 396k| "movq 8(%[x]), %%rdx\n\t" 312| 396k| "mulx %%rdx, %%rax, %%rcx\n\t" 313| 396k| "movq 16(%[z]), %%r8\n\t" 314| 396k| "adcx %%r8, %%r8\n\t" 315| 396k| "adox %%rax, %%r8\n\t" 316| 396k| "movq %%r8, 16(%[z])\n\t" 317| 396k| "movq 24(%[z]), %%r8\n\t" 318| 396k| "adcx %%r8, %%r8\n\t" 319| 396k| "adox %%rcx, %%r8\n\t" 320| 396k| "movq %%r8, 24(%[z])\n\t" 321| 396k| "movq 16(%[x]), %%rdx\n\t" 322| 396k| "mulx %%rdx, %%rax, %%rcx\n\t" 323| 396k| "movq 32(%[z]), %%r8\n\t" 324| 396k| "adcx %%r8, %%r8\n\t" 325| 396k| "adox %%rax, %%r8\n\t" 326| 396k| "movq %%r8, 32(%[z])\n\t" 327| 396k| "movq 40(%[z]), %%r8\n\t" 328| 396k| "adcx %%r8, %%r8\n\t" 329| 396k| "adox %%rcx, %%r8\n\t" 330| 396k| "movq %%r8, 40(%[z])\n\t" 331| 396k| "movq 24(%[x]), %%rdx\n\t" 332| 396k| "mulx %%rdx, %%rax, %%rcx\n\t" 333| 396k| "movq 48(%[z]), %%r8\n\t" 334| 396k| "adcx %%r8, %%r8\n\t" 335| 396k| "adox %%rax, %%r8\n\t" 336| 396k| "movq %%r8, 48(%[z])\n\t" 337| 396k| "movq 56(%[z]), %%r8\n\t" 338| 396k| "adcx %%r8, %%r8\n\t" 339| 396k| "adox %%rcx, %%r8\n\t" 340| 396k| "movq %%r8, 56(%[z])\n\t" 341| 396k| "movq 32(%[x]), %%rdx\n\t" 342| 396k| "mulx %%rdx, %%rax, %%rcx\n\t" 343| 396k| "movq 64(%[z]), %%r8\n\t" 344| 396k| "adcx %%r8, %%r8\n\t" 345| 396k| "adox %%rax, %%r8\n\t" 346| 396k| "movq %%r8, 64(%[z])\n\t" 347| 396k| "movq 72(%[z]), %%r8\n\t" 348| 396k| "adcx %%r8, %%r8\n\t" 349| 396k| "adox %%rcx, %%r8\n\t" 350| 396k| "movq %%r8, 72(%[z])\n\t" 351| 396k| "movq 40(%[x]), %%rdx\n\t" 352| 396k| "mulx %%rdx, %%rax, %%rcx\n\t" 353| 396k| "movq 80(%[z]), %%r8\n\t" 354| 396k| "adcx %%r8, %%r8\n\t" 355| 396k| "adox %%rax, %%r8\n\t" 356| 396k| "movq %%r8, 80(%[z])\n\t" 357| 396k| "movq 88(%[z]), %%r8\n\t" 358| 396k| "adcx %%r8, %%r8\n\t" 359| 396k| "adox %%rcx, %%r8\n\t" 360| 396k| "movq %%r8, 88(%[z])\n\t" 361| 396k| : 362| 396k| : [z] "r"(z), [x] "r"(x) 363| 396k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "cc", "memory"); 364| | // clang-format on 365| 396k|} _ZN5Botan16bigint_mulx_mul6EPmPKmS2_: 367| 136k|void bigint_mulx_mul6(word z[12], const word x[6], const word y[6]) { 368| | // clang-format off 369| 136k| asm( 370| 136k| "xorl %%r8d, %%r8d\n\t" 371| 136k| "xorl %%r9d, %%r9d\n\t" 372| 136k| "xorl %%r10d, %%r10d\n\t" 373| 136k| "xorl %%r11d, %%r11d\n\t" 374| 136k| "xorl %%r12d, %%r12d\n\t" 375| 136k| "xorl %%r13d, %%r13d\n\t" 376| | 377| 136k| "movq 0(%[y]), %%rdx\n\t" // row 0: x * y[0] 378| 136k| "xorl %%eax, %%eax\n\t" 379| 136k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 380| 136k| "adcx %%rax, %%r8\n\t" 381| 136k| "movq %%r8, 0(%[z])\n\t" 382| 136k| "mulx 8(%[x]), %%rax, %%r8\n\t" 383| 136k| "adox %%rcx, %%rax\n\t" 384| 136k| "adcx %%rax, %%r9\n\t" 385| 136k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 386| 136k| "adox %%r8, %%rax\n\t" 387| 136k| "adcx %%rax, %%r10\n\t" 388| 136k| "mulx 24(%[x]), %%rax, %%r8\n\t" 389| 136k| "adox %%rcx, %%rax\n\t" 390| 136k| "adcx %%rax, %%r11\n\t" 391| 136k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 392| 136k| "adox %%r8, %%rax\n\t" 393| 136k| "adcx %%rax, %%r12\n\t" 394| 136k| "mulx 40(%[x]), %%rax, %%r8\n\t" 395| 136k| "adox %%rcx, %%rax\n\t" 396| 136k| "adcx %%rax, %%r13\n\t" 397| 136k| "movl $0, %%eax\n\t" 398| 136k| "adox %%rax, %%r8\n\t" 399| 136k| "adcx %%rax, %%r8\n\t" 400| | 401| 136k| "movq 8(%[y]), %%rdx\n\t" // row 1: x * y[1] 402| 136k| "xorl %%eax, %%eax\n\t" 403| 136k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 404| 136k| "adcx %%rax, %%r9\n\t" 405| 136k| "movq %%r9, 8(%[z])\n\t" 406| 136k| "mulx 8(%[x]), %%rax, %%r9\n\t" 407| 136k| "adox %%rcx, %%rax\n\t" 408| 136k| "adcx %%rax, %%r10\n\t" 409| 136k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 410| 136k| "adox %%r9, %%rax\n\t" 411| 136k| "adcx %%rax, %%r11\n\t" 412| 136k| "mulx 24(%[x]), %%rax, %%r9\n\t" 413| 136k| "adox %%rcx, %%rax\n\t" 414| 136k| "adcx %%rax, %%r12\n\t" 415| 136k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 416| 136k| "adox %%r9, %%rax\n\t" 417| 136k| "adcx %%rax, %%r13\n\t" 418| 136k| "mulx 40(%[x]), %%rax, %%r9\n\t" 419| 136k| "adox %%rcx, %%rax\n\t" 420| 136k| "adcx %%rax, %%r8\n\t" 421| 136k| "movl $0, %%eax\n\t" 422| 136k| "adox %%rax, %%r9\n\t" 423| 136k| "adcx %%rax, %%r9\n\t" 424| | 425| 136k| "movq 16(%[y]), %%rdx\n\t" // row 2: x * y[2] 426| 136k| "xorl %%eax, %%eax\n\t" 427| 136k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 428| 136k| "adcx %%rax, %%r10\n\t" 429| 136k| "movq %%r10, 16(%[z])\n\t" 430| 136k| "mulx 8(%[x]), %%rax, %%r10\n\t" 431| 136k| "adox %%rcx, %%rax\n\t" 432| 136k| "adcx %%rax, %%r11\n\t" 433| 136k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 434| 136k| "adox %%r10, %%rax\n\t" 435| 136k| "adcx %%rax, %%r12\n\t" 436| 136k| "mulx 24(%[x]), %%rax, %%r10\n\t" 437| 136k| "adox %%rcx, %%rax\n\t" 438| 136k| "adcx %%rax, %%r13\n\t" 439| 136k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 440| 136k| "adox %%r10, %%rax\n\t" 441| 136k| "adcx %%rax, %%r8\n\t" 442| 136k| "mulx 40(%[x]), %%rax, %%r10\n\t" 443| 136k| "adox %%rcx, %%rax\n\t" 444| 136k| "adcx %%rax, %%r9\n\t" 445| 136k| "movl $0, %%eax\n\t" 446| 136k| "adox %%rax, %%r10\n\t" 447| 136k| "adcx %%rax, %%r10\n\t" 448| | 449| 136k| "movq 24(%[y]), %%rdx\n\t" // row 3: x * y[3] 450| 136k| "xorl %%eax, %%eax\n\t" 451| 136k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 452| 136k| "adcx %%rax, %%r11\n\t" 453| 136k| "movq %%r11, 24(%[z])\n\t" 454| 136k| "mulx 8(%[x]), %%rax, %%r11\n\t" 455| 136k| "adox %%rcx, %%rax\n\t" 456| 136k| "adcx %%rax, %%r12\n\t" 457| 136k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 458| 136k| "adox %%r11, %%rax\n\t" 459| 136k| "adcx %%rax, %%r13\n\t" 460| 136k| "mulx 24(%[x]), %%rax, %%r11\n\t" 461| 136k| "adox %%rcx, %%rax\n\t" 462| 136k| "adcx %%rax, %%r8\n\t" 463| 136k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 464| 136k| "adox %%r11, %%rax\n\t" 465| 136k| "adcx %%rax, %%r9\n\t" 466| 136k| "mulx 40(%[x]), %%rax, %%r11\n\t" 467| 136k| "adox %%rcx, %%rax\n\t" 468| 136k| "adcx %%rax, %%r10\n\t" 469| 136k| "movl $0, %%eax\n\t" 470| 136k| "adox %%rax, %%r11\n\t" 471| 136k| "adcx %%rax, %%r11\n\t" 472| | 473| 136k| "movq 32(%[y]), %%rdx\n\t" // row 4: x * y[4] 474| 136k| "xorl %%eax, %%eax\n\t" 475| 136k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 476| 136k| "adcx %%rax, %%r12\n\t" 477| 136k| "movq %%r12, 32(%[z])\n\t" 478| 136k| "mulx 8(%[x]), %%rax, %%r12\n\t" 479| 136k| "adox %%rcx, %%rax\n\t" 480| 136k| "adcx %%rax, %%r13\n\t" 481| 136k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 482| 136k| "adox %%r12, %%rax\n\t" 483| 136k| "adcx %%rax, %%r8\n\t" 484| 136k| "mulx 24(%[x]), %%rax, %%r12\n\t" 485| 136k| "adox %%rcx, %%rax\n\t" 486| 136k| "adcx %%rax, %%r9\n\t" 487| 136k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 488| 136k| "adox %%r12, %%rax\n\t" 489| 136k| "adcx %%rax, %%r10\n\t" 490| 136k| "mulx 40(%[x]), %%rax, %%r12\n\t" 491| 136k| "adox %%rcx, %%rax\n\t" 492| 136k| "adcx %%rax, %%r11\n\t" 493| 136k| "movl $0, %%eax\n\t" 494| 136k| "adox %%rax, %%r12\n\t" 495| 136k| "adcx %%rax, %%r12\n\t" 496| | 497| 136k| "movq 40(%[y]), %%rdx\n\t" // row 5: x * y[5] 498| 136k| "xorl %%eax, %%eax\n\t" 499| 136k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 500| 136k| "adcx %%rax, %%r13\n\t" 501| 136k| "movq %%r13, 40(%[z])\n\t" 502| 136k| "mulx 8(%[x]), %%rax, %%r13\n\t" 503| 136k| "adox %%rcx, %%rax\n\t" 504| 136k| "adcx %%rax, %%r8\n\t" 505| 136k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 506| 136k| "adox %%r13, %%rax\n\t" 507| 136k| "adcx %%rax, %%r9\n\t" 508| 136k| "mulx 24(%[x]), %%rax, %%r13\n\t" 509| 136k| "adox %%rcx, %%rax\n\t" 510| 136k| "adcx %%rax, %%r10\n\t" 511| 136k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 512| 136k| "adox %%r13, %%rax\n\t" 513| 136k| "adcx %%rax, %%r11\n\t" 514| 136k| "mulx 40(%[x]), %%rax, %%r13\n\t" 515| 136k| "adox %%rcx, %%rax\n\t" 516| 136k| "adcx %%rax, %%r12\n\t" 517| 136k| "movl $0, %%eax\n\t" 518| 136k| "adox %%rax, %%r13\n\t" 519| 136k| "adcx %%rax, %%r13\n\t" 520| | 521| 136k| "movq %%r8, 48(%[z])\n\t" 522| 136k| "movq %%r9, 56(%[z])\n\t" 523| 136k| "movq %%r10, 64(%[z])\n\t" 524| 136k| "movq %%r11, 72(%[z])\n\t" 525| 136k| "movq %%r12, 80(%[z])\n\t" 526| 136k| "movq %%r13, 88(%[z])\n\t" 527| 136k| : 528| 136k| : [z] "r"(z), [x] "r"(x), [y] "r"(y) 529| 136k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc", "memory"); 530| | // clang-format on 531| 136k|} _ZN5Botan16bigint_mulx_sqr8EPmPKm: 533| 570k|void bigint_mulx_sqr8(word z[16], const word x[8]) { 534| | // clang-format off 535| 570k| asm( 536| 570k| "xorl %%r9d, %%r9d\n\t" 537| 570k| "xorl %%r10d, %%r10d\n\t" 538| 570k| "xorl %%r11d, %%r11d\n\t" 539| 570k| "xorl %%r12d, %%r12d\n\t" 540| 570k| "xorl %%r13d, %%r13d\n\t" 541| 570k| "xorl %%r14d, %%r14d\n\t" 542| 570k| "xorl %%r8d, %%r8d\n\t" 543| | 544| 570k| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..7] 545| 570k| "xorl %%eax, %%eax\n\t" 546| 570k| "mulx 8(%[x]), %%rax, %%rcx\n\t" 547| 570k| "adcx %%rax, %%r9\n\t" 548| 570k| "movq %%r9, 8(%[z])\n\t" 549| 570k| "mulx 16(%[x]), %%rax, %%r9\n\t" 550| 570k| "adox %%rcx, %%rax\n\t" 551| 570k| "adcx %%rax, %%r10\n\t" 552| 570k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 553| 570k| "adox %%r9, %%rax\n\t" 554| 570k| "adcx %%rax, %%r11\n\t" 555| 570k| "mulx 32(%[x]), %%rax, %%r9\n\t" 556| 570k| "adox %%rcx, %%rax\n\t" 557| 570k| "adcx %%rax, %%r12\n\t" 558| 570k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 559| 570k| "adox %%r9, %%rax\n\t" 560| 570k| "adcx %%rax, %%r13\n\t" 561| 570k| "mulx 48(%[x]), %%rax, %%r9\n\t" 562| 570k| "adox %%rcx, %%rax\n\t" 563| 570k| "adcx %%rax, %%r14\n\t" 564| 570k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 565| 570k| "adox %%r9, %%rax\n\t" 566| 570k| "adcx %%rax, %%r8\n\t" 567| 570k| "movl $0, %%eax\n\t" 568| 570k| "adox %%rax, %%rcx\n\t" 569| 570k| "adcx %%rax, %%rcx\n\t" 570| 570k| "movq %%rcx, %%r9\n\t" 571| 570k| "movq %%r10, 16(%[z])\n\t" 572| | 573| 570k| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..7] 574| 570k| "xorl %%eax, %%eax\n\t" 575| 570k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 576| 570k| "adcx %%rax, %%r11\n\t" 577| 570k| "movq %%r11, 24(%[z])\n\t" 578| 570k| "mulx 24(%[x]), %%rax, %%r10\n\t" 579| 570k| "adox %%rcx, %%rax\n\t" 580| 570k| "adcx %%rax, %%r12\n\t" 581| 570k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 582| 570k| "adox %%r10, %%rax\n\t" 583| 570k| "adcx %%rax, %%r13\n\t" 584| 570k| "mulx 40(%[x]), %%rax, %%r10\n\t" 585| 570k| "adox %%rcx, %%rax\n\t" 586| 570k| "adcx %%rax, %%r14\n\t" 587| 570k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 588| 570k| "adox %%r10, %%rax\n\t" 589| 570k| "adcx %%rax, %%r8\n\t" 590| 570k| "mulx 56(%[x]), %%rax, %%r10\n\t" 591| 570k| "adox %%rcx, %%rax\n\t" 592| 570k| "adcx %%rax, %%r9\n\t" 593| 570k| "movl $0, %%eax\n\t" 594| 570k| "adox %%rax, %%r10\n\t" 595| 570k| "adcx %%rax, %%r10\n\t" 596| 570k| "movq %%r12, 32(%[z])\n\t" 597| | 598| 570k| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..7] 599| 570k| "xorl %%eax, %%eax\n\t" 600| 570k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 601| 570k| "adcx %%rax, %%r13\n\t" 602| 570k| "movq %%r13, 40(%[z])\n\t" 603| 570k| "mulx 32(%[x]), %%rax, %%r11\n\t" 604| 570k| "adox %%rcx, %%rax\n\t" 605| 570k| "adcx %%rax, %%r14\n\t" 606| 570k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 607| 570k| "adox %%r11, %%rax\n\t" 608| 570k| "adcx %%rax, %%r8\n\t" 609| 570k| "mulx 48(%[x]), %%rax, %%r11\n\t" 610| 570k| "adox %%rcx, %%rax\n\t" 611| 570k| "adcx %%rax, %%r9\n\t" 612| 570k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 613| 570k| "adox %%r11, %%rax\n\t" 614| 570k| "adcx %%rax, %%r10\n\t" 615| 570k| "movl $0, %%eax\n\t" 616| 570k| "adox %%rax, %%rcx\n\t" 617| 570k| "adcx %%rax, %%rcx\n\t" 618| 570k| "movq %%rcx, %%r11\n\t" 619| 570k| "movq %%r14, 48(%[z])\n\t" 620| | 621| 570k| "movq 24(%[x]), %%rdx\n\t" // x[3] * x[4..7] 622| 570k| "xorl %%eax, %%eax\n\t" 623| 570k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 624| 570k| "adcx %%rax, %%r8\n\t" 625| 570k| "movq %%r8, 56(%[z])\n\t" 626| 570k| "mulx 40(%[x]), %%rax, %%r12\n\t" 627| 570k| "adox %%rcx, %%rax\n\t" 628| 570k| "adcx %%rax, %%r9\n\t" 629| 570k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 630| 570k| "adox %%r12, %%rax\n\t" 631| 570k| "adcx %%rax, %%r10\n\t" 632| 570k| "mulx 56(%[x]), %%rax, %%r12\n\t" 633| 570k| "adox %%rcx, %%rax\n\t" 634| 570k| "adcx %%rax, %%r11\n\t" 635| 570k| "movl $0, %%eax\n\t" 636| 570k| "adox %%rax, %%r12\n\t" 637| 570k| "adcx %%rax, %%r12\n\t" 638| 570k| "movq %%r9, 64(%[z])\n\t" 639| | 640| 570k| "movq 32(%[x]), %%rdx\n\t" // x[4] * x[5..7] 641| 570k| "xorl %%eax, %%eax\n\t" 642| 570k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 643| 570k| "adcx %%rax, %%r10\n\t" 644| 570k| "movq %%r10, 72(%[z])\n\t" 645| 570k| "mulx 48(%[x]), %%rax, %%r13\n\t" 646| 570k| "adox %%rcx, %%rax\n\t" 647| 570k| "adcx %%rax, %%r11\n\t" 648| 570k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 649| 570k| "adox %%r13, %%rax\n\t" 650| 570k| "adcx %%rax, %%r12\n\t" 651| 570k| "movl $0, %%eax\n\t" 652| 570k| "adox %%rax, %%rcx\n\t" 653| 570k| "adcx %%rax, %%rcx\n\t" 654| 570k| "movq %%rcx, %%r13\n\t" 655| 570k| "movq %%r11, 80(%[z])\n\t" 656| | 657| 570k| "movq 40(%[x]), %%rdx\n\t" // x[5] * x[6..7] 658| 570k| "xorl %%eax, %%eax\n\t" 659| 570k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 660| 570k| "adcx %%rax, %%r12\n\t" 661| 570k| "movq %%r12, 88(%[z])\n\t" 662| 570k| "mulx 56(%[x]), %%rax, %%r14\n\t" 663| 570k| "adox %%rcx, %%rax\n\t" 664| 570k| "adcx %%rax, %%r13\n\t" 665| 570k| "movl $0, %%eax\n\t" 666| 570k| "adox %%rax, %%r14\n\t" 667| 570k| "adcx %%rax, %%r14\n\t" 668| 570k| "movq %%r13, 96(%[z])\n\t" 669| | 670| 570k| "movq 48(%[x]), %%rdx\n\t" // x[6] * x[7..7] 671| 570k| "xorl %%eax, %%eax\n\t" 672| 570k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 673| 570k| "adcx %%rax, %%r14\n\t" 674| 570k| "movq %%r14, 104(%[z])\n\t" 675| 570k| "movl $0, %%eax\n\t" 676| 570k| "adox %%rax, %%rcx\n\t" 677| 570k| "adcx %%rax, %%rcx\n\t" 678| 570k| "movq %%rcx, %%r8\n\t" 679| 570k| "movq %%r8, 112(%[z])\n\t" 680| | 681| 570k| "movq $0, 120(%[z])\n\t" 682| 570k| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 683| 570k| "movq 0(%[x]), %%rdx\n\t" 684| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 685| 570k| "movq %%rax, 0(%[z])\n\t" 686| 570k| "movq 8(%[z]), %%r8\n\t" 687| 570k| "adcx %%r8, %%r8\n\t" 688| 570k| "adox %%rcx, %%r8\n\t" 689| 570k| "movq %%r8, 8(%[z])\n\t" 690| 570k| "movq 8(%[x]), %%rdx\n\t" 691| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 692| 570k| "movq 16(%[z]), %%r8\n\t" 693| 570k| "adcx %%r8, %%r8\n\t" 694| 570k| "adox %%rax, %%r8\n\t" 695| 570k| "movq %%r8, 16(%[z])\n\t" 696| 570k| "movq 24(%[z]), %%r8\n\t" 697| 570k| "adcx %%r8, %%r8\n\t" 698| 570k| "adox %%rcx, %%r8\n\t" 699| 570k| "movq %%r8, 24(%[z])\n\t" 700| 570k| "movq 16(%[x]), %%rdx\n\t" 701| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 702| 570k| "movq 32(%[z]), %%r8\n\t" 703| 570k| "adcx %%r8, %%r8\n\t" 704| 570k| "adox %%rax, %%r8\n\t" 705| 570k| "movq %%r8, 32(%[z])\n\t" 706| 570k| "movq 40(%[z]), %%r8\n\t" 707| 570k| "adcx %%r8, %%r8\n\t" 708| 570k| "adox %%rcx, %%r8\n\t" 709| 570k| "movq %%r8, 40(%[z])\n\t" 710| 570k| "movq 24(%[x]), %%rdx\n\t" 711| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 712| 570k| "movq 48(%[z]), %%r8\n\t" 713| 570k| "adcx %%r8, %%r8\n\t" 714| 570k| "adox %%rax, %%r8\n\t" 715| 570k| "movq %%r8, 48(%[z])\n\t" 716| 570k| "movq 56(%[z]), %%r8\n\t" 717| 570k| "adcx %%r8, %%r8\n\t" 718| 570k| "adox %%rcx, %%r8\n\t" 719| 570k| "movq %%r8, 56(%[z])\n\t" 720| 570k| "movq 32(%[x]), %%rdx\n\t" 721| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 722| 570k| "movq 64(%[z]), %%r8\n\t" 723| 570k| "adcx %%r8, %%r8\n\t" 724| 570k| "adox %%rax, %%r8\n\t" 725| 570k| "movq %%r8, 64(%[z])\n\t" 726| 570k| "movq 72(%[z]), %%r8\n\t" 727| 570k| "adcx %%r8, %%r8\n\t" 728| 570k| "adox %%rcx, %%r8\n\t" 729| 570k| "movq %%r8, 72(%[z])\n\t" 730| 570k| "movq 40(%[x]), %%rdx\n\t" 731| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 732| 570k| "movq 80(%[z]), %%r8\n\t" 733| 570k| "adcx %%r8, %%r8\n\t" 734| 570k| "adox %%rax, %%r8\n\t" 735| 570k| "movq %%r8, 80(%[z])\n\t" 736| 570k| "movq 88(%[z]), %%r8\n\t" 737| 570k| "adcx %%r8, %%r8\n\t" 738| 570k| "adox %%rcx, %%r8\n\t" 739| 570k| "movq %%r8, 88(%[z])\n\t" 740| 570k| "movq 48(%[x]), %%rdx\n\t" 741| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 742| 570k| "movq 96(%[z]), %%r8\n\t" 743| 570k| "adcx %%r8, %%r8\n\t" 744| 570k| "adox %%rax, %%r8\n\t" 745| 570k| "movq %%r8, 96(%[z])\n\t" 746| 570k| "movq 104(%[z]), %%r8\n\t" 747| 570k| "adcx %%r8, %%r8\n\t" 748| 570k| "adox %%rcx, %%r8\n\t" 749| 570k| "movq %%r8, 104(%[z])\n\t" 750| 570k| "movq 56(%[x]), %%rdx\n\t" 751| 570k| "mulx %%rdx, %%rax, %%rcx\n\t" 752| 570k| "movq 112(%[z]), %%r8\n\t" 753| 570k| "adcx %%r8, %%r8\n\t" 754| 570k| "adox %%rax, %%r8\n\t" 755| 570k| "movq %%r8, 112(%[z])\n\t" 756| 570k| "movq 120(%[z]), %%r8\n\t" 757| 570k| "adcx %%r8, %%r8\n\t" 758| 570k| "adox %%rcx, %%r8\n\t" 759| 570k| "movq %%r8, 120(%[z])\n\t" 760| 570k| : 761| 570k| : [z] "r"(z), [x] "r"(x) 762| 570k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc", "memory"); 763| | // clang-format on 764| 570k|} _ZN5Botan16bigint_mulx_mul8EPmPKmS2_: 766| 207k|void bigint_mulx_mul8(word z[16], const word x[8], const word y[8]) { 767| | // clang-format off 768| 207k| asm( 769| 207k| "xorl %%r8d, %%r8d\n\t" 770| 207k| "xorl %%r9d, %%r9d\n\t" 771| 207k| "xorl %%r10d, %%r10d\n\t" 772| 207k| "xorl %%r11d, %%r11d\n\t" 773| 207k| "xorl %%r12d, %%r12d\n\t" 774| 207k| "xorl %%r13d, %%r13d\n\t" 775| 207k| "xorl %%r14d, %%r14d\n\t" 776| 207k| "xorl %%r15d, %%r15d\n\t" 777| | 778| 207k| "movq 0(%[y]), %%rdx\n\t" // row 0: x * y[0] 779| 207k| "xorl %%eax, %%eax\n\t" 780| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 781| 207k| "adcx %%rax, %%r8\n\t" 782| 207k| "movq %%r8, 0(%[z])\n\t" 783| 207k| "mulx 8(%[x]), %%rax, %%r8\n\t" 784| 207k| "adox %%rcx, %%rax\n\t" 785| 207k| "adcx %%rax, %%r9\n\t" 786| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 787| 207k| "adox %%r8, %%rax\n\t" 788| 207k| "adcx %%rax, %%r10\n\t" 789| 207k| "mulx 24(%[x]), %%rax, %%r8\n\t" 790| 207k| "adox %%rcx, %%rax\n\t" 791| 207k| "adcx %%rax, %%r11\n\t" 792| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 793| 207k| "adox %%r8, %%rax\n\t" 794| 207k| "adcx %%rax, %%r12\n\t" 795| 207k| "mulx 40(%[x]), %%rax, %%r8\n\t" 796| 207k| "adox %%rcx, %%rax\n\t" 797| 207k| "adcx %%rax, %%r13\n\t" 798| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 799| 207k| "adox %%r8, %%rax\n\t" 800| 207k| "adcx %%rax, %%r14\n\t" 801| 207k| "mulx 56(%[x]), %%rax, %%r8\n\t" 802| 207k| "adox %%rcx, %%rax\n\t" 803| 207k| "adcx %%rax, %%r15\n\t" 804| 207k| "movl $0, %%eax\n\t" 805| 207k| "adox %%rax, %%r8\n\t" 806| 207k| "adcx %%rax, %%r8\n\t" 807| | 808| 207k| "movq 8(%[y]), %%rdx\n\t" // row 1: x * y[1] 809| 207k| "xorl %%eax, %%eax\n\t" 810| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 811| 207k| "adcx %%rax, %%r9\n\t" 812| 207k| "movq %%r9, 8(%[z])\n\t" 813| 207k| "mulx 8(%[x]), %%rax, %%r9\n\t" 814| 207k| "adox %%rcx, %%rax\n\t" 815| 207k| "adcx %%rax, %%r10\n\t" 816| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 817| 207k| "adox %%r9, %%rax\n\t" 818| 207k| "adcx %%rax, %%r11\n\t" 819| 207k| "mulx 24(%[x]), %%rax, %%r9\n\t" 820| 207k| "adox %%rcx, %%rax\n\t" 821| 207k| "adcx %%rax, %%r12\n\t" 822| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 823| 207k| "adox %%r9, %%rax\n\t" 824| 207k| "adcx %%rax, %%r13\n\t" 825| 207k| "mulx 40(%[x]), %%rax, %%r9\n\t" 826| 207k| "adox %%rcx, %%rax\n\t" 827| 207k| "adcx %%rax, %%r14\n\t" 828| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 829| 207k| "adox %%r9, %%rax\n\t" 830| 207k| "adcx %%rax, %%r15\n\t" 831| 207k| "mulx 56(%[x]), %%rax, %%r9\n\t" 832| 207k| "adox %%rcx, %%rax\n\t" 833| 207k| "adcx %%rax, %%r8\n\t" 834| 207k| "movl $0, %%eax\n\t" 835| 207k| "adox %%rax, %%r9\n\t" 836| 207k| "adcx %%rax, %%r9\n\t" 837| | 838| 207k| "movq 16(%[y]), %%rdx\n\t" // row 2: x * y[2] 839| 207k| "xorl %%eax, %%eax\n\t" 840| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 841| 207k| "adcx %%rax, %%r10\n\t" 842| 207k| "movq %%r10, 16(%[z])\n\t" 843| 207k| "mulx 8(%[x]), %%rax, %%r10\n\t" 844| 207k| "adox %%rcx, %%rax\n\t" 845| 207k| "adcx %%rax, %%r11\n\t" 846| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 847| 207k| "adox %%r10, %%rax\n\t" 848| 207k| "adcx %%rax, %%r12\n\t" 849| 207k| "mulx 24(%[x]), %%rax, %%r10\n\t" 850| 207k| "adox %%rcx, %%rax\n\t" 851| 207k| "adcx %%rax, %%r13\n\t" 852| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 853| 207k| "adox %%r10, %%rax\n\t" 854| 207k| "adcx %%rax, %%r14\n\t" 855| 207k| "mulx 40(%[x]), %%rax, %%r10\n\t" 856| 207k| "adox %%rcx, %%rax\n\t" 857| 207k| "adcx %%rax, %%r15\n\t" 858| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 859| 207k| "adox %%r10, %%rax\n\t" 860| 207k| "adcx %%rax, %%r8\n\t" 861| 207k| "mulx 56(%[x]), %%rax, %%r10\n\t" 862| 207k| "adox %%rcx, %%rax\n\t" 863| 207k| "adcx %%rax, %%r9\n\t" 864| 207k| "movl $0, %%eax\n\t" 865| 207k| "adox %%rax, %%r10\n\t" 866| 207k| "adcx %%rax, %%r10\n\t" 867| | 868| 207k| "movq 24(%[y]), %%rdx\n\t" // row 3: x * y[3] 869| 207k| "xorl %%eax, %%eax\n\t" 870| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 871| 207k| "adcx %%rax, %%r11\n\t" 872| 207k| "movq %%r11, 24(%[z])\n\t" 873| 207k| "mulx 8(%[x]), %%rax, %%r11\n\t" 874| 207k| "adox %%rcx, %%rax\n\t" 875| 207k| "adcx %%rax, %%r12\n\t" 876| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 877| 207k| "adox %%r11, %%rax\n\t" 878| 207k| "adcx %%rax, %%r13\n\t" 879| 207k| "mulx 24(%[x]), %%rax, %%r11\n\t" 880| 207k| "adox %%rcx, %%rax\n\t" 881| 207k| "adcx %%rax, %%r14\n\t" 882| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 883| 207k| "adox %%r11, %%rax\n\t" 884| 207k| "adcx %%rax, %%r15\n\t" 885| 207k| "mulx 40(%[x]), %%rax, %%r11\n\t" 886| 207k| "adox %%rcx, %%rax\n\t" 887| 207k| "adcx %%rax, %%r8\n\t" 888| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 889| 207k| "adox %%r11, %%rax\n\t" 890| 207k| "adcx %%rax, %%r9\n\t" 891| 207k| "mulx 56(%[x]), %%rax, %%r11\n\t" 892| 207k| "adox %%rcx, %%rax\n\t" 893| 207k| "adcx %%rax, %%r10\n\t" 894| 207k| "movl $0, %%eax\n\t" 895| 207k| "adox %%rax, %%r11\n\t" 896| 207k| "adcx %%rax, %%r11\n\t" 897| | 898| 207k| "movq 32(%[y]), %%rdx\n\t" // row 4: x * y[4] 899| 207k| "xorl %%eax, %%eax\n\t" 900| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 901| 207k| "adcx %%rax, %%r12\n\t" 902| 207k| "movq %%r12, 32(%[z])\n\t" 903| 207k| "mulx 8(%[x]), %%rax, %%r12\n\t" 904| 207k| "adox %%rcx, %%rax\n\t" 905| 207k| "adcx %%rax, %%r13\n\t" 906| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 907| 207k| "adox %%r12, %%rax\n\t" 908| 207k| "adcx %%rax, %%r14\n\t" 909| 207k| "mulx 24(%[x]), %%rax, %%r12\n\t" 910| 207k| "adox %%rcx, %%rax\n\t" 911| 207k| "adcx %%rax, %%r15\n\t" 912| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 913| 207k| "adox %%r12, %%rax\n\t" 914| 207k| "adcx %%rax, %%r8\n\t" 915| 207k| "mulx 40(%[x]), %%rax, %%r12\n\t" 916| 207k| "adox %%rcx, %%rax\n\t" 917| 207k| "adcx %%rax, %%r9\n\t" 918| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 919| 207k| "adox %%r12, %%rax\n\t" 920| 207k| "adcx %%rax, %%r10\n\t" 921| 207k| "mulx 56(%[x]), %%rax, %%r12\n\t" 922| 207k| "adox %%rcx, %%rax\n\t" 923| 207k| "adcx %%rax, %%r11\n\t" 924| 207k| "movl $0, %%eax\n\t" 925| 207k| "adox %%rax, %%r12\n\t" 926| 207k| "adcx %%rax, %%r12\n\t" 927| | 928| 207k| "movq 40(%[y]), %%rdx\n\t" // row 5: x * y[5] 929| 207k| "xorl %%eax, %%eax\n\t" 930| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 931| 207k| "adcx %%rax, %%r13\n\t" 932| 207k| "movq %%r13, 40(%[z])\n\t" 933| 207k| "mulx 8(%[x]), %%rax, %%r13\n\t" 934| 207k| "adox %%rcx, %%rax\n\t" 935| 207k| "adcx %%rax, %%r14\n\t" 936| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 937| 207k| "adox %%r13, %%rax\n\t" 938| 207k| "adcx %%rax, %%r15\n\t" 939| 207k| "mulx 24(%[x]), %%rax, %%r13\n\t" 940| 207k| "adox %%rcx, %%rax\n\t" 941| 207k| "adcx %%rax, %%r8\n\t" 942| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 943| 207k| "adox %%r13, %%rax\n\t" 944| 207k| "adcx %%rax, %%r9\n\t" 945| 207k| "mulx 40(%[x]), %%rax, %%r13\n\t" 946| 207k| "adox %%rcx, %%rax\n\t" 947| 207k| "adcx %%rax, %%r10\n\t" 948| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 949| 207k| "adox %%r13, %%rax\n\t" 950| 207k| "adcx %%rax, %%r11\n\t" 951| 207k| "mulx 56(%[x]), %%rax, %%r13\n\t" 952| 207k| "adox %%rcx, %%rax\n\t" 953| 207k| "adcx %%rax, %%r12\n\t" 954| 207k| "movl $0, %%eax\n\t" 955| 207k| "adox %%rax, %%r13\n\t" 956| 207k| "adcx %%rax, %%r13\n\t" 957| | 958| 207k| "movq 48(%[y]), %%rdx\n\t" // row 6: x * y[6] 959| 207k| "xorl %%eax, %%eax\n\t" 960| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 961| 207k| "adcx %%rax, %%r14\n\t" 962| 207k| "movq %%r14, 48(%[z])\n\t" 963| 207k| "mulx 8(%[x]), %%rax, %%r14\n\t" 964| 207k| "adox %%rcx, %%rax\n\t" 965| 207k| "adcx %%rax, %%r15\n\t" 966| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 967| 207k| "adox %%r14, %%rax\n\t" 968| 207k| "adcx %%rax, %%r8\n\t" 969| 207k| "mulx 24(%[x]), %%rax, %%r14\n\t" 970| 207k| "adox %%rcx, %%rax\n\t" 971| 207k| "adcx %%rax, %%r9\n\t" 972| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 973| 207k| "adox %%r14, %%rax\n\t" 974| 207k| "adcx %%rax, %%r10\n\t" 975| 207k| "mulx 40(%[x]), %%rax, %%r14\n\t" 976| 207k| "adox %%rcx, %%rax\n\t" 977| 207k| "adcx %%rax, %%r11\n\t" 978| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 979| 207k| "adox %%r14, %%rax\n\t" 980| 207k| "adcx %%rax, %%r12\n\t" 981| 207k| "mulx 56(%[x]), %%rax, %%r14\n\t" 982| 207k| "adox %%rcx, %%rax\n\t" 983| 207k| "adcx %%rax, %%r13\n\t" 984| 207k| "movl $0, %%eax\n\t" 985| 207k| "adox %%rax, %%r14\n\t" 986| 207k| "adcx %%rax, %%r14\n\t" 987| | 988| 207k| "movq 56(%[y]), %%rdx\n\t" // row 7: x * y[7] 989| 207k| "xorl %%eax, %%eax\n\t" 990| 207k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 991| 207k| "adcx %%rax, %%r15\n\t" 992| 207k| "movq %%r15, 56(%[z])\n\t" 993| 207k| "mulx 8(%[x]), %%rax, %%r15\n\t" 994| 207k| "adox %%rcx, %%rax\n\t" 995| 207k| "adcx %%rax, %%r8\n\t" 996| 207k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 997| 207k| "adox %%r15, %%rax\n\t" 998| 207k| "adcx %%rax, %%r9\n\t" 999| 207k| "mulx 24(%[x]), %%rax, %%r15\n\t" 1000| 207k| "adox %%rcx, %%rax\n\t" 1001| 207k| "adcx %%rax, %%r10\n\t" 1002| 207k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1003| 207k| "adox %%r15, %%rax\n\t" 1004| 207k| "adcx %%rax, %%r11\n\t" 1005| 207k| "mulx 40(%[x]), %%rax, %%r15\n\t" 1006| 207k| "adox %%rcx, %%rax\n\t" 1007| 207k| "adcx %%rax, %%r12\n\t" 1008| 207k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1009| 207k| "adox %%r15, %%rax\n\t" 1010| 207k| "adcx %%rax, %%r13\n\t" 1011| 207k| "mulx 56(%[x]), %%rax, %%r15\n\t" 1012| 207k| "adox %%rcx, %%rax\n\t" 1013| 207k| "adcx %%rax, %%r14\n\t" 1014| 207k| "movl $0, %%eax\n\t" 1015| 207k| "adox %%rax, %%r15\n\t" 1016| 207k| "adcx %%rax, %%r15\n\t" 1017| | 1018| 207k| "movq %%r8, 64(%[z])\n\t" 1019| 207k| "movq %%r9, 72(%[z])\n\t" 1020| 207k| "movq %%r10, 80(%[z])\n\t" 1021| 207k| "movq %%r11, 88(%[z])\n\t" 1022| 207k| "movq %%r12, 96(%[z])\n\t" 1023| 207k| "movq %%r13, 104(%[z])\n\t" 1024| 207k| "movq %%r14, 112(%[z])\n\t" 1025| 207k| "movq %%r15, 120(%[z])\n\t" 1026| 207k| : 1027| 207k| : [z] "r"(z), [x] "r"(x), [y] "r"(y) 1028| 207k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory"); 1029| | // clang-format on 1030| 207k|} _ZN5Botan16bigint_mulx_sqr9EPmPKm: 1032| 245k|void bigint_mulx_sqr9(word z[18], const word x[9]) { 1033| | // clang-format off 1034| 245k| asm( 1035| 245k| "xorl %%r9d, %%r9d\n\t" 1036| 245k| "xorl %%r10d, %%r10d\n\t" 1037| 245k| "xorl %%r11d, %%r11d\n\t" 1038| 245k| "xorl %%r12d, %%r12d\n\t" 1039| 245k| "xorl %%r13d, %%r13d\n\t" 1040| 245k| "xorl %%r14d, %%r14d\n\t" 1041| 245k| "xorl %%r15d, %%r15d\n\t" 1042| 245k| "xorl %%r8d, %%r8d\n\t" 1043| | 1044| 245k| "movq 0(%[x]), %%rdx\n\t" // x[0] * x[1..8] 1045| 245k| "xorl %%eax, %%eax\n\t" 1046| 245k| "mulx 8(%[x]), %%rax, %%rcx\n\t" 1047| 245k| "adcx %%rax, %%r9\n\t" 1048| 245k| "movq %%r9, 8(%[z])\n\t" 1049| 245k| "mulx 16(%[x]), %%rax, %%r9\n\t" 1050| 245k| "adox %%rcx, %%rax\n\t" 1051| 245k| "adcx %%rax, %%r10\n\t" 1052| 245k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 1053| 245k| "adox %%r9, %%rax\n\t" 1054| 245k| "adcx %%rax, %%r11\n\t" 1055| 245k| "mulx 32(%[x]), %%rax, %%r9\n\t" 1056| 245k| "adox %%rcx, %%rax\n\t" 1057| 245k| "adcx %%rax, %%r12\n\t" 1058| 245k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 1059| 245k| "adox %%r9, %%rax\n\t" 1060| 245k| "adcx %%rax, %%r13\n\t" 1061| 245k| "mulx 48(%[x]), %%rax, %%r9\n\t" 1062| 245k| "adox %%rcx, %%rax\n\t" 1063| 245k| "adcx %%rax, %%r14\n\t" 1064| 245k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1065| 245k| "adox %%r9, %%rax\n\t" 1066| 245k| "adcx %%rax, %%r15\n\t" 1067| 245k| "mulx 64(%[x]), %%rax, %%r9\n\t" 1068| 245k| "adox %%rcx, %%rax\n\t" 1069| 245k| "adcx %%rax, %%r8\n\t" 1070| 245k| "movl $0, %%eax\n\t" 1071| 245k| "adox %%rax, %%r9\n\t" 1072| 245k| "adcx %%rax, %%r9\n\t" 1073| 245k| "movq %%r10, 16(%[z])\n\t" 1074| | 1075| 245k| "movq 8(%[x]), %%rdx\n\t" // x[1] * x[2..8] 1076| 245k| "xorl %%eax, %%eax\n\t" 1077| 245k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1078| 245k| "adcx %%rax, %%r11\n\t" 1079| 245k| "movq %%r11, 24(%[z])\n\t" 1080| 245k| "mulx 24(%[x]), %%rax, %%r10\n\t" 1081| 245k| "adox %%rcx, %%rax\n\t" 1082| 245k| "adcx %%rax, %%r12\n\t" 1083| 245k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1084| 245k| "adox %%r10, %%rax\n\t" 1085| 245k| "adcx %%rax, %%r13\n\t" 1086| 245k| "mulx 40(%[x]), %%rax, %%r10\n\t" 1087| 245k| "adox %%rcx, %%rax\n\t" 1088| 245k| "adcx %%rax, %%r14\n\t" 1089| 245k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1090| 245k| "adox %%r10, %%rax\n\t" 1091| 245k| "adcx %%rax, %%r15\n\t" 1092| 245k| "mulx 56(%[x]), %%rax, %%r10\n\t" 1093| 245k| "adox %%rcx, %%rax\n\t" 1094| 245k| "adcx %%rax, %%r8\n\t" 1095| 245k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1096| 245k| "adox %%r10, %%rax\n\t" 1097| 245k| "adcx %%rax, %%r9\n\t" 1098| 245k| "movl $0, %%eax\n\t" 1099| 245k| "adox %%rax, %%rcx\n\t" 1100| 245k| "adcx %%rax, %%rcx\n\t" 1101| 245k| "movq %%rcx, %%r10\n\t" 1102| 245k| "movq %%r12, 32(%[z])\n\t" 1103| | 1104| 245k| "movq 16(%[x]), %%rdx\n\t" // x[2] * x[3..8] 1105| 245k| "xorl %%eax, %%eax\n\t" 1106| 245k| "mulx 24(%[x]), %%rax, %%rcx\n\t" 1107| 245k| "adcx %%rax, %%r13\n\t" 1108| 245k| "movq %%r13, 40(%[z])\n\t" 1109| 245k| "mulx 32(%[x]), %%rax, %%r11\n\t" 1110| 245k| "adox %%rcx, %%rax\n\t" 1111| 245k| "adcx %%rax, %%r14\n\t" 1112| 245k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 1113| 245k| "adox %%r11, %%rax\n\t" 1114| 245k| "adcx %%rax, %%r15\n\t" 1115| 245k| "mulx 48(%[x]), %%rax, %%r11\n\t" 1116| 245k| "adox %%rcx, %%rax\n\t" 1117| 245k| "adcx %%rax, %%r8\n\t" 1118| 245k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1119| 245k| "adox %%r11, %%rax\n\t" 1120| 245k| "adcx %%rax, %%r9\n\t" 1121| 245k| "mulx 64(%[x]), %%rax, %%r11\n\t" 1122| 245k| "adox %%rcx, %%rax\n\t" 1123| 245k| "adcx %%rax, %%r10\n\t" 1124| 245k| "movl $0, %%eax\n\t" 1125| 245k| "adox %%rax, %%r11\n\t" 1126| 245k| "adcx %%rax, %%r11\n\t" 1127| 245k| "movq %%r14, 48(%[z])\n\t" 1128| | 1129| 245k| "movq 24(%[x]), %%rdx\n\t" // x[3] * x[4..8] 1130| 245k| "xorl %%eax, %%eax\n\t" 1131| 245k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1132| 245k| "adcx %%rax, %%r15\n\t" 1133| 245k| "movq %%r15, 56(%[z])\n\t" 1134| 245k| "mulx 40(%[x]), %%rax, %%r12\n\t" 1135| 245k| "adox %%rcx, %%rax\n\t" 1136| 245k| "adcx %%rax, %%r8\n\t" 1137| 245k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1138| 245k| "adox %%r12, %%rax\n\t" 1139| 245k| "adcx %%rax, %%r9\n\t" 1140| 245k| "mulx 56(%[x]), %%rax, %%r12\n\t" 1141| 245k| "adox %%rcx, %%rax\n\t" 1142| 245k| "adcx %%rax, %%r10\n\t" 1143| 245k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1144| 245k| "adox %%r12, %%rax\n\t" 1145| 245k| "adcx %%rax, %%r11\n\t" 1146| 245k| "movl $0, %%eax\n\t" 1147| 245k| "adox %%rax, %%rcx\n\t" 1148| 245k| "adcx %%rax, %%rcx\n\t" 1149| 245k| "movq %%rcx, %%r12\n\t" 1150| 245k| "movq %%r8, 64(%[z])\n\t" 1151| | 1152| 245k| "movq 32(%[x]), %%rdx\n\t" // x[4] * x[5..8] 1153| 245k| "xorl %%eax, %%eax\n\t" 1154| 245k| "mulx 40(%[x]), %%rax, %%rcx\n\t" 1155| 245k| "adcx %%rax, %%r9\n\t" 1156| 245k| "movq %%r9, 72(%[z])\n\t" 1157| 245k| "mulx 48(%[x]), %%rax, %%r13\n\t" 1158| 245k| "adox %%rcx, %%rax\n\t" 1159| 245k| "adcx %%rax, %%r10\n\t" 1160| 245k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1161| 245k| "adox %%r13, %%rax\n\t" 1162| 245k| "adcx %%rax, %%r11\n\t" 1163| 245k| "mulx 64(%[x]), %%rax, %%r13\n\t" 1164| 245k| "adox %%rcx, %%rax\n\t" 1165| 245k| "adcx %%rax, %%r12\n\t" 1166| 245k| "movl $0, %%eax\n\t" 1167| 245k| "adox %%rax, %%r13\n\t" 1168| 245k| "adcx %%rax, %%r13\n\t" 1169| 245k| "movq %%r10, 80(%[z])\n\t" 1170| | 1171| 245k| "movq 40(%[x]), %%rdx\n\t" // x[5] * x[6..8] 1172| 245k| "xorl %%eax, %%eax\n\t" 1173| 245k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1174| 245k| "adcx %%rax, %%r11\n\t" 1175| 245k| "movq %%r11, 88(%[z])\n\t" 1176| 245k| "mulx 56(%[x]), %%rax, %%r14\n\t" 1177| 245k| "adox %%rcx, %%rax\n\t" 1178| 245k| "adcx %%rax, %%r12\n\t" 1179| 245k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1180| 245k| "adox %%r14, %%rax\n\t" 1181| 245k| "adcx %%rax, %%r13\n\t" 1182| 245k| "movl $0, %%eax\n\t" 1183| 245k| "adox %%rax, %%rcx\n\t" 1184| 245k| "adcx %%rax, %%rcx\n\t" 1185| 245k| "movq %%rcx, %%r14\n\t" 1186| 245k| "movq %%r12, 96(%[z])\n\t" 1187| | 1188| 245k| "movq 48(%[x]), %%rdx\n\t" // x[6] * x[7..8] 1189| 245k| "xorl %%eax, %%eax\n\t" 1190| 245k| "mulx 56(%[x]), %%rax, %%rcx\n\t" 1191| 245k| "adcx %%rax, %%r13\n\t" 1192| 245k| "movq %%r13, 104(%[z])\n\t" 1193| 245k| "mulx 64(%[x]), %%rax, %%r15\n\t" 1194| 245k| "adox %%rcx, %%rax\n\t" 1195| 245k| "adcx %%rax, %%r14\n\t" 1196| 245k| "movl $0, %%eax\n\t" 1197| 245k| "adox %%rax, %%r15\n\t" 1198| 245k| "adcx %%rax, %%r15\n\t" 1199| 245k| "movq %%r14, 112(%[z])\n\t" 1200| | 1201| 245k| "movq 56(%[x]), %%rdx\n\t" // x[7] * x[8..8] 1202| 245k| "xorl %%eax, %%eax\n\t" 1203| 245k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1204| 245k| "adcx %%rax, %%r15\n\t" 1205| 245k| "movq %%r15, 120(%[z])\n\t" 1206| 245k| "movl $0, %%eax\n\t" 1207| 245k| "adox %%rax, %%rcx\n\t" 1208| 245k| "adcx %%rax, %%rcx\n\t" 1209| 245k| "movq %%rcx, %%r8\n\t" 1210| 245k| "movq %%r8, 128(%[z])\n\t" 1211| | 1212| 245k| "movq $0, 136(%[z])\n\t" 1213| 245k| "xorl %%eax, %%eax\n\t" // double the cross products and add the squares 1214| 245k| "movq 0(%[x]), %%rdx\n\t" 1215| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1216| 245k| "movq %%rax, 0(%[z])\n\t" 1217| 245k| "movq 8(%[z]), %%r8\n\t" 1218| 245k| "adcx %%r8, %%r8\n\t" 1219| 245k| "adox %%rcx, %%r8\n\t" 1220| 245k| "movq %%r8, 8(%[z])\n\t" 1221| 245k| "movq 8(%[x]), %%rdx\n\t" 1222| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1223| 245k| "movq 16(%[z]), %%r8\n\t" 1224| 245k| "adcx %%r8, %%r8\n\t" 1225| 245k| "adox %%rax, %%r8\n\t" 1226| 245k| "movq %%r8, 16(%[z])\n\t" 1227| 245k| "movq 24(%[z]), %%r8\n\t" 1228| 245k| "adcx %%r8, %%r8\n\t" 1229| 245k| "adox %%rcx, %%r8\n\t" 1230| 245k| "movq %%r8, 24(%[z])\n\t" 1231| 245k| "movq 16(%[x]), %%rdx\n\t" 1232| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1233| 245k| "movq 32(%[z]), %%r8\n\t" 1234| 245k| "adcx %%r8, %%r8\n\t" 1235| 245k| "adox %%rax, %%r8\n\t" 1236| 245k| "movq %%r8, 32(%[z])\n\t" 1237| 245k| "movq 40(%[z]), %%r8\n\t" 1238| 245k| "adcx %%r8, %%r8\n\t" 1239| 245k| "adox %%rcx, %%r8\n\t" 1240| 245k| "movq %%r8, 40(%[z])\n\t" 1241| 245k| "movq 24(%[x]), %%rdx\n\t" 1242| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1243| 245k| "movq 48(%[z]), %%r8\n\t" 1244| 245k| "adcx %%r8, %%r8\n\t" 1245| 245k| "adox %%rax, %%r8\n\t" 1246| 245k| "movq %%r8, 48(%[z])\n\t" 1247| 245k| "movq 56(%[z]), %%r8\n\t" 1248| 245k| "adcx %%r8, %%r8\n\t" 1249| 245k| "adox %%rcx, %%r8\n\t" 1250| 245k| "movq %%r8, 56(%[z])\n\t" 1251| 245k| "movq 32(%[x]), %%rdx\n\t" 1252| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1253| 245k| "movq 64(%[z]), %%r8\n\t" 1254| 245k| "adcx %%r8, %%r8\n\t" 1255| 245k| "adox %%rax, %%r8\n\t" 1256| 245k| "movq %%r8, 64(%[z])\n\t" 1257| 245k| "movq 72(%[z]), %%r8\n\t" 1258| 245k| "adcx %%r8, %%r8\n\t" 1259| 245k| "adox %%rcx, %%r8\n\t" 1260| 245k| "movq %%r8, 72(%[z])\n\t" 1261| 245k| "movq 40(%[x]), %%rdx\n\t" 1262| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1263| 245k| "movq 80(%[z]), %%r8\n\t" 1264| 245k| "adcx %%r8, %%r8\n\t" 1265| 245k| "adox %%rax, %%r8\n\t" 1266| 245k| "movq %%r8, 80(%[z])\n\t" 1267| 245k| "movq 88(%[z]), %%r8\n\t" 1268| 245k| "adcx %%r8, %%r8\n\t" 1269| 245k| "adox %%rcx, %%r8\n\t" 1270| 245k| "movq %%r8, 88(%[z])\n\t" 1271| 245k| "movq 48(%[x]), %%rdx\n\t" 1272| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1273| 245k| "movq 96(%[z]), %%r8\n\t" 1274| 245k| "adcx %%r8, %%r8\n\t" 1275| 245k| "adox %%rax, %%r8\n\t" 1276| 245k| "movq %%r8, 96(%[z])\n\t" 1277| 245k| "movq 104(%[z]), %%r8\n\t" 1278| 245k| "adcx %%r8, %%r8\n\t" 1279| 245k| "adox %%rcx, %%r8\n\t" 1280| 245k| "movq %%r8, 104(%[z])\n\t" 1281| 245k| "movq 56(%[x]), %%rdx\n\t" 1282| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1283| 245k| "movq 112(%[z]), %%r8\n\t" 1284| 245k| "adcx %%r8, %%r8\n\t" 1285| 245k| "adox %%rax, %%r8\n\t" 1286| 245k| "movq %%r8, 112(%[z])\n\t" 1287| 245k| "movq 120(%[z]), %%r8\n\t" 1288| 245k| "adcx %%r8, %%r8\n\t" 1289| 245k| "adox %%rcx, %%r8\n\t" 1290| 245k| "movq %%r8, 120(%[z])\n\t" 1291| 245k| "movq 64(%[x]), %%rdx\n\t" 1292| 245k| "mulx %%rdx, %%rax, %%rcx\n\t" 1293| 245k| "movq 128(%[z]), %%r8\n\t" 1294| 245k| "adcx %%r8, %%r8\n\t" 1295| 245k| "adox %%rax, %%r8\n\t" 1296| 245k| "movq %%r8, 128(%[z])\n\t" 1297| 245k| "movq 136(%[z]), %%r8\n\t" 1298| 245k| "adcx %%r8, %%r8\n\t" 1299| 245k| "adox %%rcx, %%r8\n\t" 1300| 245k| "movq %%r8, 136(%[z])\n\t" 1301| 245k| : 1302| 245k| : [z] "r"(z), [x] "r"(x) 1303| 245k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory"); 1304| | // clang-format on 1305| 245k|} _ZN5Botan16bigint_mulx_mul9EPmPKmS2_: 1307| 74.8k|void bigint_mulx_mul9(word z[18], const word x[9], const word y[9]) { 1308| 74.8k| copy_mem(z + 9, y, 9); 1309| | // clang-format off 1310| 74.8k| asm( 1311| 74.8k| "xorl %%r8d, %%r8d\n\t" 1312| 74.8k| "xorl %%r9d, %%r9d\n\t" 1313| 74.8k| "xorl %%r10d, %%r10d\n\t" 1314| 74.8k| "xorl %%r11d, %%r11d\n\t" 1315| 74.8k| "xorl %%r12d, %%r12d\n\t" 1316| 74.8k| "xorl %%r13d, %%r13d\n\t" 1317| 74.8k| "xorl %%r14d, %%r14d\n\t" 1318| 74.8k| "xorl %%r15d, %%r15d\n\t" 1319| 74.8k| "xorl %%ebx, %%ebx\n\t" 1320| | 1321| 74.8k| "movq 72(%[z]), %%rdx\n\t" // row 0: x * y[0] 1322| 74.8k| "xorl %%eax, %%eax\n\t" 1323| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1324| 74.8k| "adcx %%rax, %%r8\n\t" 1325| 74.8k| "movq %%r8, 0(%[z])\n\t" 1326| 74.8k| "mulx 8(%[x]), %%rax, %%r8\n\t" 1327| 74.8k| "adox %%rcx, %%rax\n\t" 1328| 74.8k| "adcx %%rax, %%r9\n\t" 1329| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1330| 74.8k| "adox %%r8, %%rax\n\t" 1331| 74.8k| "adcx %%rax, %%r10\n\t" 1332| 74.8k| "mulx 24(%[x]), %%rax, %%r8\n\t" 1333| 74.8k| "adox %%rcx, %%rax\n\t" 1334| 74.8k| "adcx %%rax, %%r11\n\t" 1335| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1336| 74.8k| "adox %%r8, %%rax\n\t" 1337| 74.8k| "adcx %%rax, %%r12\n\t" 1338| 74.8k| "mulx 40(%[x]), %%rax, %%r8\n\t" 1339| 74.8k| "adox %%rcx, %%rax\n\t" 1340| 74.8k| "adcx %%rax, %%r13\n\t" 1341| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1342| 74.8k| "adox %%r8, %%rax\n\t" 1343| 74.8k| "adcx %%rax, %%r14\n\t" 1344| 74.8k| "mulx 56(%[x]), %%rax, %%r8\n\t" 1345| 74.8k| "adox %%rcx, %%rax\n\t" 1346| 74.8k| "adcx %%rax, %%r15\n\t" 1347| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1348| 74.8k| "adox %%r8, %%rax\n\t" 1349| 74.8k| "adcx %%rax, %%rbx\n\t" 1350| 74.8k| "movl $0, %%eax\n\t" 1351| 74.8k| "adox %%rax, %%rcx\n\t" 1352| 74.8k| "adcx %%rax, %%rcx\n\t" 1353| 74.8k| "movq %%rcx, %%r8\n\t" 1354| | 1355| 74.8k| "movq 80(%[z]), %%rdx\n\t" // row 1: x * y[1] 1356| 74.8k| "xorl %%eax, %%eax\n\t" 1357| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1358| 74.8k| "adcx %%rax, %%r9\n\t" 1359| 74.8k| "movq %%r9, 8(%[z])\n\t" 1360| 74.8k| "mulx 8(%[x]), %%rax, %%r9\n\t" 1361| 74.8k| "adox %%rcx, %%rax\n\t" 1362| 74.8k| "adcx %%rax, %%r10\n\t" 1363| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1364| 74.8k| "adox %%r9, %%rax\n\t" 1365| 74.8k| "adcx %%rax, %%r11\n\t" 1366| 74.8k| "mulx 24(%[x]), %%rax, %%r9\n\t" 1367| 74.8k| "adox %%rcx, %%rax\n\t" 1368| 74.8k| "adcx %%rax, %%r12\n\t" 1369| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1370| 74.8k| "adox %%r9, %%rax\n\t" 1371| 74.8k| "adcx %%rax, %%r13\n\t" 1372| 74.8k| "mulx 40(%[x]), %%rax, %%r9\n\t" 1373| 74.8k| "adox %%rcx, %%rax\n\t" 1374| 74.8k| "adcx %%rax, %%r14\n\t" 1375| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1376| 74.8k| "adox %%r9, %%rax\n\t" 1377| 74.8k| "adcx %%rax, %%r15\n\t" 1378| 74.8k| "mulx 56(%[x]), %%rax, %%r9\n\t" 1379| 74.8k| "adox %%rcx, %%rax\n\t" 1380| 74.8k| "adcx %%rax, %%rbx\n\t" 1381| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1382| 74.8k| "adox %%r9, %%rax\n\t" 1383| 74.8k| "adcx %%rax, %%r8\n\t" 1384| 74.8k| "movl $0, %%eax\n\t" 1385| 74.8k| "adox %%rax, %%rcx\n\t" 1386| 74.8k| "adcx %%rax, %%rcx\n\t" 1387| 74.8k| "movq %%rcx, %%r9\n\t" 1388| | 1389| 74.8k| "movq 88(%[z]), %%rdx\n\t" // row 2: x * y[2] 1390| 74.8k| "xorl %%eax, %%eax\n\t" 1391| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1392| 74.8k| "adcx %%rax, %%r10\n\t" 1393| 74.8k| "movq %%r10, 16(%[z])\n\t" 1394| 74.8k| "mulx 8(%[x]), %%rax, %%r10\n\t" 1395| 74.8k| "adox %%rcx, %%rax\n\t" 1396| 74.8k| "adcx %%rax, %%r11\n\t" 1397| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1398| 74.8k| "adox %%r10, %%rax\n\t" 1399| 74.8k| "adcx %%rax, %%r12\n\t" 1400| 74.8k| "mulx 24(%[x]), %%rax, %%r10\n\t" 1401| 74.8k| "adox %%rcx, %%rax\n\t" 1402| 74.8k| "adcx %%rax, %%r13\n\t" 1403| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1404| 74.8k| "adox %%r10, %%rax\n\t" 1405| 74.8k| "adcx %%rax, %%r14\n\t" 1406| 74.8k| "mulx 40(%[x]), %%rax, %%r10\n\t" 1407| 74.8k| "adox %%rcx, %%rax\n\t" 1408| 74.8k| "adcx %%rax, %%r15\n\t" 1409| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1410| 74.8k| "adox %%r10, %%rax\n\t" 1411| 74.8k| "adcx %%rax, %%rbx\n\t" 1412| 74.8k| "mulx 56(%[x]), %%rax, %%r10\n\t" 1413| 74.8k| "adox %%rcx, %%rax\n\t" 1414| 74.8k| "adcx %%rax, %%r8\n\t" 1415| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1416| 74.8k| "adox %%r10, %%rax\n\t" 1417| 74.8k| "adcx %%rax, %%r9\n\t" 1418| 74.8k| "movl $0, %%eax\n\t" 1419| 74.8k| "adox %%rax, %%rcx\n\t" 1420| 74.8k| "adcx %%rax, %%rcx\n\t" 1421| 74.8k| "movq %%rcx, %%r10\n\t" 1422| | 1423| 74.8k| "movq 96(%[z]), %%rdx\n\t" // row 3: x * y[3] 1424| 74.8k| "xorl %%eax, %%eax\n\t" 1425| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1426| 74.8k| "adcx %%rax, %%r11\n\t" 1427| 74.8k| "movq %%r11, 24(%[z])\n\t" 1428| 74.8k| "mulx 8(%[x]), %%rax, %%r11\n\t" 1429| 74.8k| "adox %%rcx, %%rax\n\t" 1430| 74.8k| "adcx %%rax, %%r12\n\t" 1431| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1432| 74.8k| "adox %%r11, %%rax\n\t" 1433| 74.8k| "adcx %%rax, %%r13\n\t" 1434| 74.8k| "mulx 24(%[x]), %%rax, %%r11\n\t" 1435| 74.8k| "adox %%rcx, %%rax\n\t" 1436| 74.8k| "adcx %%rax, %%r14\n\t" 1437| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1438| 74.8k| "adox %%r11, %%rax\n\t" 1439| 74.8k| "adcx %%rax, %%r15\n\t" 1440| 74.8k| "mulx 40(%[x]), %%rax, %%r11\n\t" 1441| 74.8k| "adox %%rcx, %%rax\n\t" 1442| 74.8k| "adcx %%rax, %%rbx\n\t" 1443| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1444| 74.8k| "adox %%r11, %%rax\n\t" 1445| 74.8k| "adcx %%rax, %%r8\n\t" 1446| 74.8k| "mulx 56(%[x]), %%rax, %%r11\n\t" 1447| 74.8k| "adox %%rcx, %%rax\n\t" 1448| 74.8k| "adcx %%rax, %%r9\n\t" 1449| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1450| 74.8k| "adox %%r11, %%rax\n\t" 1451| 74.8k| "adcx %%rax, %%r10\n\t" 1452| 74.8k| "movl $0, %%eax\n\t" 1453| 74.8k| "adox %%rax, %%rcx\n\t" 1454| 74.8k| "adcx %%rax, %%rcx\n\t" 1455| 74.8k| "movq %%rcx, %%r11\n\t" 1456| | 1457| 74.8k| "movq 104(%[z]), %%rdx\n\t" // row 4: x * y[4] 1458| 74.8k| "xorl %%eax, %%eax\n\t" 1459| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1460| 74.8k| "adcx %%rax, %%r12\n\t" 1461| 74.8k| "movq %%r12, 32(%[z])\n\t" 1462| 74.8k| "mulx 8(%[x]), %%rax, %%r12\n\t" 1463| 74.8k| "adox %%rcx, %%rax\n\t" 1464| 74.8k| "adcx %%rax, %%r13\n\t" 1465| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1466| 74.8k| "adox %%r12, %%rax\n\t" 1467| 74.8k| "adcx %%rax, %%r14\n\t" 1468| 74.8k| "mulx 24(%[x]), %%rax, %%r12\n\t" 1469| 74.8k| "adox %%rcx, %%rax\n\t" 1470| 74.8k| "adcx %%rax, %%r15\n\t" 1471| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1472| 74.8k| "adox %%r12, %%rax\n\t" 1473| 74.8k| "adcx %%rax, %%rbx\n\t" 1474| 74.8k| "mulx 40(%[x]), %%rax, %%r12\n\t" 1475| 74.8k| "adox %%rcx, %%rax\n\t" 1476| 74.8k| "adcx %%rax, %%r8\n\t" 1477| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1478| 74.8k| "adox %%r12, %%rax\n\t" 1479| 74.8k| "adcx %%rax, %%r9\n\t" 1480| 74.8k| "mulx 56(%[x]), %%rax, %%r12\n\t" 1481| 74.8k| "adox %%rcx, %%rax\n\t" 1482| 74.8k| "adcx %%rax, %%r10\n\t" 1483| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1484| 74.8k| "adox %%r12, %%rax\n\t" 1485| 74.8k| "adcx %%rax, %%r11\n\t" 1486| 74.8k| "movl $0, %%eax\n\t" 1487| 74.8k| "adox %%rax, %%rcx\n\t" 1488| 74.8k| "adcx %%rax, %%rcx\n\t" 1489| 74.8k| "movq %%rcx, %%r12\n\t" 1490| | 1491| 74.8k| "movq 112(%[z]), %%rdx\n\t" // row 5: x * y[5] 1492| 74.8k| "xorl %%eax, %%eax\n\t" 1493| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1494| 74.8k| "adcx %%rax, %%r13\n\t" 1495| 74.8k| "movq %%r13, 40(%[z])\n\t" 1496| 74.8k| "mulx 8(%[x]), %%rax, %%r13\n\t" 1497| 74.8k| "adox %%rcx, %%rax\n\t" 1498| 74.8k| "adcx %%rax, %%r14\n\t" 1499| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1500| 74.8k| "adox %%r13, %%rax\n\t" 1501| 74.8k| "adcx %%rax, %%r15\n\t" 1502| 74.8k| "mulx 24(%[x]), %%rax, %%r13\n\t" 1503| 74.8k| "adox %%rcx, %%rax\n\t" 1504| 74.8k| "adcx %%rax, %%rbx\n\t" 1505| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1506| 74.8k| "adox %%r13, %%rax\n\t" 1507| 74.8k| "adcx %%rax, %%r8\n\t" 1508| 74.8k| "mulx 40(%[x]), %%rax, %%r13\n\t" 1509| 74.8k| "adox %%rcx, %%rax\n\t" 1510| 74.8k| "adcx %%rax, %%r9\n\t" 1511| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1512| 74.8k| "adox %%r13, %%rax\n\t" 1513| 74.8k| "adcx %%rax, %%r10\n\t" 1514| 74.8k| "mulx 56(%[x]), %%rax, %%r13\n\t" 1515| 74.8k| "adox %%rcx, %%rax\n\t" 1516| 74.8k| "adcx %%rax, %%r11\n\t" 1517| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1518| 74.8k| "adox %%r13, %%rax\n\t" 1519| 74.8k| "adcx %%rax, %%r12\n\t" 1520| 74.8k| "movl $0, %%eax\n\t" 1521| 74.8k| "adox %%rax, %%rcx\n\t" 1522| 74.8k| "adcx %%rax, %%rcx\n\t" 1523| 74.8k| "movq %%rcx, %%r13\n\t" 1524| | 1525| 74.8k| "movq 120(%[z]), %%rdx\n\t" // row 6: x * y[6] 1526| 74.8k| "xorl %%eax, %%eax\n\t" 1527| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1528| 74.8k| "adcx %%rax, %%r14\n\t" 1529| 74.8k| "movq %%r14, 48(%[z])\n\t" 1530| 74.8k| "mulx 8(%[x]), %%rax, %%r14\n\t" 1531| 74.8k| "adox %%rcx, %%rax\n\t" 1532| 74.8k| "adcx %%rax, %%r15\n\t" 1533| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1534| 74.8k| "adox %%r14, %%rax\n\t" 1535| 74.8k| "adcx %%rax, %%rbx\n\t" 1536| 74.8k| "mulx 24(%[x]), %%rax, %%r14\n\t" 1537| 74.8k| "adox %%rcx, %%rax\n\t" 1538| 74.8k| "adcx %%rax, %%r8\n\t" 1539| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1540| 74.8k| "adox %%r14, %%rax\n\t" 1541| 74.8k| "adcx %%rax, %%r9\n\t" 1542| 74.8k| "mulx 40(%[x]), %%rax, %%r14\n\t" 1543| 74.8k| "adox %%rcx, %%rax\n\t" 1544| 74.8k| "adcx %%rax, %%r10\n\t" 1545| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1546| 74.8k| "adox %%r14, %%rax\n\t" 1547| 74.8k| "adcx %%rax, %%r11\n\t" 1548| 74.8k| "mulx 56(%[x]), %%rax, %%r14\n\t" 1549| 74.8k| "adox %%rcx, %%rax\n\t" 1550| 74.8k| "adcx %%rax, %%r12\n\t" 1551| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1552| 74.8k| "adox %%r14, %%rax\n\t" 1553| 74.8k| "adcx %%rax, %%r13\n\t" 1554| 74.8k| "movl $0, %%eax\n\t" 1555| 74.8k| "adox %%rax, %%rcx\n\t" 1556| 74.8k| "adcx %%rax, %%rcx\n\t" 1557| 74.8k| "movq %%rcx, %%r14\n\t" 1558| | 1559| 74.8k| "movq 128(%[z]), %%rdx\n\t" // row 7: x * y[7] 1560| 74.8k| "xorl %%eax, %%eax\n\t" 1561| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1562| 74.8k| "adcx %%rax, %%r15\n\t" 1563| 74.8k| "movq %%r15, 56(%[z])\n\t" 1564| 74.8k| "mulx 8(%[x]), %%rax, %%r15\n\t" 1565| 74.8k| "adox %%rcx, %%rax\n\t" 1566| 74.8k| "adcx %%rax, %%rbx\n\t" 1567| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1568| 74.8k| "adox %%r15, %%rax\n\t" 1569| 74.8k| "adcx %%rax, %%r8\n\t" 1570| 74.8k| "mulx 24(%[x]), %%rax, %%r15\n\t" 1571| 74.8k| "adox %%rcx, %%rax\n\t" 1572| 74.8k| "adcx %%rax, %%r9\n\t" 1573| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1574| 74.8k| "adox %%r15, %%rax\n\t" 1575| 74.8k| "adcx %%rax, %%r10\n\t" 1576| 74.8k| "mulx 40(%[x]), %%rax, %%r15\n\t" 1577| 74.8k| "adox %%rcx, %%rax\n\t" 1578| 74.8k| "adcx %%rax, %%r11\n\t" 1579| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1580| 74.8k| "adox %%r15, %%rax\n\t" 1581| 74.8k| "adcx %%rax, %%r12\n\t" 1582| 74.8k| "mulx 56(%[x]), %%rax, %%r15\n\t" 1583| 74.8k| "adox %%rcx, %%rax\n\t" 1584| 74.8k| "adcx %%rax, %%r13\n\t" 1585| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1586| 74.8k| "adox %%r15, %%rax\n\t" 1587| 74.8k| "adcx %%rax, %%r14\n\t" 1588| 74.8k| "movl $0, %%eax\n\t" 1589| 74.8k| "adox %%rax, %%rcx\n\t" 1590| 74.8k| "adcx %%rax, %%rcx\n\t" 1591| 74.8k| "movq %%rcx, %%r15\n\t" 1592| | 1593| 74.8k| "movq 136(%[z]), %%rdx\n\t" // row 8: x * y[8] 1594| 74.8k| "xorl %%eax, %%eax\n\t" 1595| 74.8k| "mulx 0(%[x]), %%rax, %%rcx\n\t" 1596| 74.8k| "adcx %%rax, %%rbx\n\t" 1597| 74.8k| "movq %%rbx, 64(%[z])\n\t" 1598| 74.8k| "mulx 8(%[x]), %%rax, %%rbx\n\t" 1599| 74.8k| "adox %%rcx, %%rax\n\t" 1600| 74.8k| "adcx %%rax, %%r8\n\t" 1601| 74.8k| "mulx 16(%[x]), %%rax, %%rcx\n\t" 1602| 74.8k| "adox %%rbx, %%rax\n\t" 1603| 74.8k| "adcx %%rax, %%r9\n\t" 1604| 74.8k| "mulx 24(%[x]), %%rax, %%rbx\n\t" 1605| 74.8k| "adox %%rcx, %%rax\n\t" 1606| 74.8k| "adcx %%rax, %%r10\n\t" 1607| 74.8k| "mulx 32(%[x]), %%rax, %%rcx\n\t" 1608| 74.8k| "adox %%rbx, %%rax\n\t" 1609| 74.8k| "adcx %%rax, %%r11\n\t" 1610| 74.8k| "mulx 40(%[x]), %%rax, %%rbx\n\t" 1611| 74.8k| "adox %%rcx, %%rax\n\t" 1612| 74.8k| "adcx %%rax, %%r12\n\t" 1613| 74.8k| "mulx 48(%[x]), %%rax, %%rcx\n\t" 1614| 74.8k| "adox %%rbx, %%rax\n\t" 1615| 74.8k| "adcx %%rax, %%r13\n\t" 1616| 74.8k| "mulx 56(%[x]), %%rax, %%rbx\n\t" 1617| 74.8k| "adox %%rcx, %%rax\n\t" 1618| 74.8k| "adcx %%rax, %%r14\n\t" 1619| 74.8k| "mulx 64(%[x]), %%rax, %%rcx\n\t" 1620| 74.8k| "adox %%rbx, %%rax\n\t" 1621| 74.8k| "adcx %%rax, %%r15\n\t" 1622| 74.8k| "movl $0, %%eax\n\t" 1623| 74.8k| "adox %%rax, %%rcx\n\t" 1624| 74.8k| "adcx %%rax, %%rcx\n\t" 1625| 74.8k| "movq %%rcx, %%rbx\n\t" 1626| | 1627| 74.8k| "movq %%r8, 72(%[z])\n\t" 1628| 74.8k| "movq %%r9, 80(%[z])\n\t" 1629| 74.8k| "movq %%r10, 88(%[z])\n\t" 1630| 74.8k| "movq %%r11, 96(%[z])\n\t" 1631| 74.8k| "movq %%r12, 104(%[z])\n\t" 1632| 74.8k| "movq %%r13, 112(%[z])\n\t" 1633| 74.8k| "movq %%r14, 120(%[z])\n\t" 1634| 74.8k| "movq %%r15, 128(%[z])\n\t" 1635| 74.8k| "movq %%rbx, 136(%[z])\n\t" 1636| 74.8k| : 1637| 74.8k| : [z] "r"(z), [x] "r"(x) 1638| 74.8k| : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "rbx", "cc", "memory"); 1639| | // clang-format on 1640| 74.8k|} _ZN5Botan17Barrett_ReductionC2ERKNS_6BigIntES1_m: 17| 36| m_modulus(m), m_mu(std::move(mu)), m_mod_words(mw), m_modulus_bits(m.bits()) { 18| | // Give some extra space for Karatsuba 19| 36| m_modulus.grow_to(m_mod_words + 8); 20| 36| m_mu.grow_to(m_mod_words + 8); 21| 36|} _ZN5Botan17Barrett_Reduction18for_secret_modulusERKNS_6BigIntE: 23| 36|Barrett_Reduction Barrett_Reduction::for_secret_modulus(const BigInt& mod) { 24| 36| BOTAN_ARG_CHECK(mod.signum() > 0, "Modulus must be positive"); ------------------ | | 35| 36| do { \ | | 36| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36] | | ------------------ ------------------ 25| | 26| 36| const size_t mod_words = mod.sig_words(); 27| | 28| | // Compute mu = floor(2^{2k} / m) 29| 36| const size_t mu_bits = 2 * WordInfo::bits * mod_words; 30| 36| return Barrett_Reduction(mod, ct_divide_pow2k(mu_bits, mod), mod_words); 31| 36|} _ZN5Botan17Barrett_Reduction18for_public_modulusERKNS_6BigIntE: 33| 36|Barrett_Reduction Barrett_Reduction::for_public_modulus(const BigInt& mod) { 34| 36| return Barrett_Reduction::for_secret_modulus(mod); 35| 36|} _ZNK5Botan17Barrett_Reduction8multiplyERKNS_6BigIntES3_: 153| 36|BigInt Barrett_Reduction::multiply(const BigInt& x, const BigInt& y) const { 154| 36| BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett multiply"); ------------------ | | 35| 36| do { \ | | 36| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36] | | ------------------ ------------------ 155| 36| BOTAN_ARG_CHECK(acceptable_barrett_input(y, m_modulus).as_bool(), "Invalid y param for Barrett multiply"); ------------------ | | 35| 36| do { \ | | 36| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36] | | ------------------ ------------------ 156| | 157| 36| secure_vector ws(2 * (m_mod_words + 2)); 158| 36| secure_vector xy(2 * m_mod_words); 159| | 160| 36| bigint_mul(xy.data(), 161| 36| xy.size(), 162| 36| x._data(), 163| 36| x.size(), 164| 36| std::min(x.size(), m_mod_words), 165| 36| y._data(), 166| 36| y.size(), 167| 36| std::min(y.size(), m_mod_words), 168| 36| ws.data(), 169| 36| ws.size()); 170| | 171| 36| return barrett_reduce(m_mod_words, m_modulus, m_mu, xy, ws); 172| 36|} _ZNK5Botan17Barrett_Reduction6squareERKNS_6BigIntE: 174| 36|BigInt Barrett_Reduction::square(const BigInt& x) const { 175| 36| BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett square"); ------------------ | | 35| 36| do { \ | | 36| 36| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 36| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 36] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 36| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 36] | | ------------------ ------------------ 176| | 177| 36| secure_vector ws(2 * (m_mod_words + 2)); 178| 36| secure_vector x2(2 * m_mod_words); 179| | 180| 36| bigint_sqr(x2.data(), x2.size(), x._data(), x.size(), std::min(x.size(), m_mod_words), ws.data(), ws.size()); 181| | 182| 36| return barrett_reduce(m_mod_words, m_modulus, m_mu, x2, ws); 183| 36|} _ZNK5Botan17Barrett_Reduction6reduceERKNS_6BigIntE: 185| 24|BigInt Barrett_Reduction::reduce(const BigInt& x) const { 186| 24| BOTAN_ARG_CHECK(x.signum() >= 0, "Argument must be non-negative"); ------------------ | | 35| 24| do { \ | | 36| 24| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 24| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 24] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 24| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 24] | | ------------------ ------------------ 187| | 188| 24| const size_t x_sw = x.sig_words(); 189| 24| BOTAN_ARG_CHECK(x_sw <= 2 * m_mod_words, "Argument is too large for Barrett reduction"); ------------------ | | 35| 24| do { \ | | 36| 24| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 24| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 24] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 24| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 24] | | ------------------ ------------------ 190| | 191| 24| x.grow_to(2 * m_mod_words); 192| | 193| 24| secure_vector ws; 194| 24| return barrett_reduce(m_mod_words, m_modulus, m_mu, x._as_span(), ws); 195| 24|} barrett.cpp:_ZN5Botan12_GLOBAL__N_124acceptable_barrett_inputERKNS_6BigIntES3_: 145| 108|CT::Choice acceptable_barrett_input(const BigInt& x, const BigInt& modulus) { 146| 108| const auto x_is_positive = CT::Choice::from_int(static_cast(x.signum() >= 0)); 147| 108| const auto x_lt_mod = bigint_ct_is_lt(x._data(), x.size(), modulus._data(), modulus.sig_words()).as_choice(); 148| 108| return x_is_positive && x_lt_mod; 149| 108|} barrett.cpp:_ZN5Botan12_GLOBAL__N_114barrett_reduceEmRKNS_6BigIntES3_NSt3__14spanIKmLm18446744073709551615EEERNS4_6vectorImNS_16secure_allocatorImEEEE: 48| 96| size_t mod_words, const BigInt& modulus, const BigInt& mu, std::span x_words, secure_vector& ws) { 49| 96| BOTAN_ASSERT_NOMSG(modulus.sig_words() == mod_words); ------------------ | | 84| 96| do { \ | | 85| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 96| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 96] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 96| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 96] | | ------------------ ------------------ 50| | 51| | // Caller must expand input to be at least this size 52| 96| BOTAN_ASSERT_NOMSG(x_words.size() >= 2 * mod_words); ------------------ | | 84| 96| do { \ | | 85| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 96| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 96] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 96| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 96] | | ------------------ ------------------ 53| | 54| | // Normally mod_words + 1 but can be + 2 if the modulus is a power of 2 55| 96| const size_t mu_words = mu.sig_words(); 56| 96| BOTAN_ASSERT_NOMSG(mu_words <= mod_words + 2); ------------------ | | 84| 96| do { \ | | 85| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 96| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 96] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 96| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 96] | | ------------------ ------------------ 57| | 58| 96| if(ws.size() < 2 * (mod_words + 2)) { ------------------ | Branch (58:7): [True: 24, False: 72] ------------------ 59| 24| ws.resize(2 * (mod_words + 2)); 60| 24| } 61| | 62| 96| CT::poison(x_words); 63| | 64| | /* 65| | * Following the notation of Handbook of Applied Cryptography 66| | * Algorithm 14.42 "Barrett modular reduction", page 604 67| | * 68| | * 69| | * Using `mu` for µ in the code 70| | */ 71| | 72| | // Compute q1 = floor(x / 2^(k - 1)) which is equivalent to ignoring the low (k-1) words 73| | 74| | // 2 * mod_words + 1 is sufficient, extra is to enable Karatsuba 75| 96| secure_vector r(2 * mu_words + 2); 76| | 77| 96| copy_mem(r.data(), x_words.data() + (mod_words - 1), mod_words + 1); 78| | 79| | // Now compute q2 = q1 * µ 80| | 81| | // We allocate more size than required since this allows Karatsuba more often; 82| | // just `mu_words + (mod_words + 1)` is sufficient 83| 96| const size_t q2_size = 2 * mu_words + 2; 84| | 85| 96| secure_vector q2(q2_size); 86| | 87| 96| bigint_mul( 88| 96| q2.data(), q2.size(), r.data(), r.size(), mod_words + 1, mu._data(), mu.size(), mu_words, ws.data(), ws.size()); 89| | 90| | // Compute r2 = (floor(q2 / b^(k+1)) * m) mod 2^(k+1) 91| | // The division/floor is again effected by just ignoring the low k + 1 words 92| 96| bigint_mul(r.data(), 93| 96| r.size(), 94| 96| &q2[mod_words + 1], // ignoring the low mod_words + 1 words of the first product 95| 96| q2.size() - (mod_words + 1), 96| 96| mod_words + 1, 97| 96| modulus._data(), 98| 96| modulus.size(), 99| 96| mod_words, 100| 96| ws.data(), 101| 96| ws.size()); 102| | 103| | // Clear the high words of the product, equivalent to computing mod 2^(k+1) 104| | // TODO add masked mul to avoid computing high bits at all 105| 96| clear_mem(std::span{r}.subspan(mod_words + 1)); 106| | 107| | // Compute r = r1 - r2 108| | 109| | // The return value of bigint_sub_abs isn't quite right for what we need here so first compare 110| 96| const int32_t relative_size = bigint_cmp(r.data(), mod_words + 1, x_words.data(), mod_words + 1); 111| | 112| 96| bigint_sub_abs(r.data(), r.data(), x_words.data(), mod_words + 1, ws.data()); 113| | 114| | /* 115| | If r is negative then we have to set r to r + 2^(k+1) 116| | 117| | However for r negative computing this sum is equivalent to computing 2^(k+1) - abs(r) 118| | */ 119| 96| clear_mem(ws.data(), mod_words + 2); 120| 96| ws[mod_words + 1] = 1; 121| 96| bigint_sub2(ws.data(), mod_words + 2, r.data(), mod_words + 2); 122| | 123| | // If relative_size > 0 then assign r to 2^(k+1) - r 124| 96| CT::Mask::is_equal(static_cast(relative_size), 1).select_n(r.data(), ws.data(), r.data(), mod_words + 2); 125| | 126| | /* 127| | * Per HAC Note 14.44 (ii) "step 4 is repeated at most twice since 0 <= r < 3m" 128| | */ 129| 96| const size_t bound = 2; 130| | 131| 96| BOTAN_ASSERT_NOMSG(r.size() >= mod_words + 1); ------------------ | | 84| 96| do { \ | | 85| 96| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 96| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 96] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 96| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 96] | | ------------------ ------------------ 132| 288| for(size_t i = 0; i != bound; ++i) { ------------------ | Branch (132:22): [True: 192, False: 96] ------------------ 133| 192| const word borrow = bigint_sub3(ws.data(), r.data(), mod_words + 1, modulus._data(), mod_words); 134| 192| CT::Mask::is_zero(borrow).select_n(r.data(), ws.data(), r.data(), mod_words + 1); 135| 192| } 136| | 137| 96| CT::unpoison(q2); 138| 96| CT::unpoison(r); 139| 96| CT::unpoison(ws); 140| 96| CT::unpoison(x_words); 141| | 142| 96| return BigInt::_from_words(r); 143| 96|} _ZN5Botan17Montgomery_Params4DataC2ERKNS_6BigIntERKNS_17Barrett_ReductionE: 40| 12|Montgomery_Params::Data::Data(const BigInt& p, const Barrett_Reduction& mod_p) { 41| 12| if(p.is_even() || p < 3) { ------------------ | Branch (41:7): [True: 0, False: 12] | Branch (41:22): [True: 0, False: 12] ------------------ 42| 0| throw Invalid_Argument("Montgomery_Params invalid modulus"); 43| 0| } 44| | 45| 12| m_p = p; 46| 12| m_p_words = m_p.sig_words(); 47| 12| m_p_dash = monty_inverse(m_p.word_at(0)); 48| | 49| 12| const BigInt r = BigInt::power_of_2(m_p_words * WordInfo::bits); 50| | 51| 12| m_r1 = mod_p.reduce(r); 52| 12| m_r2 = mod_p.square(m_r1); 53| 12| m_r3 = mod_p.multiply(m_r1, m_r2); 54| | 55| | // Barrett should be at least zero prefixing up to modulus size 56| 12| BOTAN_ASSERT_NOMSG(m_r1.size() >= m_p_words); ------------------ | | 84| 12| do { \ | | 85| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 12| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 12] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 12| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 12] | | ------------------ ------------------ 57| 12| BOTAN_ASSERT_NOMSG(m_r2.size() >= m_p_words); ------------------ | | 84| 12| do { \ | | 85| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 12| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 12] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 12| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 12] | | ------------------ ------------------ 58| 12| BOTAN_ASSERT_NOMSG(m_r3.size() >= m_p_words); ------------------ | | 84| 12| do { \ | | 85| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 86| 12| if(!(expr)) { \ | | ------------------ | | | Branch (86:10): [True: 0, False: 12] | | ------------------ | | 87| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 88| 0| Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \ | | 89| 0| } \ | | 90| 12| } while(0) | | ------------------ | | | Branch (90:12): [Folded, False: 12] | | ------------------ ------------------ 59| 12|} _ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntERKNS_17Barrett_ReductionE: 62| 12| m_data(std::make_shared(p, mod_p)) {} _ZNK5Botan17Montgomery_Params3mulERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 90| 24|BigInt Montgomery_Params::mul(const BigInt& x, const BigInt& y, secure_vector& ws) const { 91| 24| const size_t p_size = this->p_words(); 92| 24| BigInt z = BigInt::with_capacity(2 * p_size); 93| 24| this->mul(z, x, y, ws); 94| 24| return z; 95| 24|} _ZNK5Botan17Montgomery_Params3mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 97| 24|void Montgomery_Params::mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector& ws) const { 98| 24| BOTAN_ARG_CHECK(&z != &x && &z != &y, "Montgomery_Params::mul output must not alias inputs"); ------------------ | | 35| 24| do { \ | | 36| 24| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 48| if(!(expr)) { \ | | ------------------ | | | Branch (37:12): [True: 24, False: 0] | | | Branch (37:12): [True: 24, False: 0] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 24| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 24] | | ------------------ ------------------ 99| | 100| 24| const size_t p_size = this->p_words(); 101| | 102| 24| if(ws.size() < 2 * p_size) { ------------------ | Branch (102:7): [True: 12, False: 12] ------------------ 103| 12| ws.resize(2 * p_size); 104| 12| } 105| | 106| 24| BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size); ------------------ | | 137| 24| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 24| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 24] | | ------------------ ------------------ 107| 24| BOTAN_DEBUG_ASSERT(y.sig_words() <= p_size); ------------------ | | 137| 24| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 24| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 24] | | ------------------ ------------------ 108| | 109| 24| if(z.size() < 2 * p_size) { ------------------ | Branch (109:7): [True: 0, False: 24] ------------------ 110| 0| z.grow_to(2 * p_size); 111| 0| } 112| | 113| 24| bigint_mul(z.mutable_data(), 114| 24| z.size(), 115| 24| x._data(), 116| 24| x.size(), 117| 24| std::min(p_size, x.size()), 118| 24| y._data(), 119| 24| y.size(), 120| 24| std::min(p_size, y.size()), 121| 24| ws.data(), 122| 24| ws.size()); 123| | 124| 24| bigint_monty_redc_inplace(z.mutable_data(), this->p()._data(), p_size, this->p_dash(), ws.data(), ws.size()); 125| 24|} _ZNK5Botan17Montgomery_Params6mul_byERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE: 157| 24|void Montgomery_Params::mul_by(BigInt& x, const BigInt& y, secure_vector& ws) const { 158| 24| const size_t p_size = this->p_words(); 159| | 160| 24| if(ws.size() < 4 * p_size) { ------------------ | Branch (160:7): [True: 12, False: 12] ------------------ 161| 12| ws.resize(4 * p_size); 162| 12| } 163| | 164| 24| word* z_data = ws.data(); 165| 24| word* ws_data = &ws[2 * p_size]; 166| | 167| 24| BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size); ------------------ | | 137| 24| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 24| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 24] | | ------------------ ------------------ 168| | 169| 24| bigint_mul(z_data, 170| 24| 2 * p_size, 171| 24| x._data(), 172| 24| x.size(), 173| 24| std::min(p_size, x.size()), 174| 24| y._data(), 175| 24| y.size(), 176| 24| std::min(p_size, y.size()), 177| 24| ws_data, 178| 24| 2 * p_size); 179| | 180| 24| bigint_monty_redc_inplace(z_data, this->p()._data(), p_size, this->p_dash(), ws_data, 2 * p_size); 181| | 182| 24| if(x.size() < 2 * p_size) { ------------------ | Branch (182:7): [True: 10, False: 14] ------------------ 183| 10| x.grow_to(2 * p_size); 184| 10| } 185| 24| copy_mem(x.mutable_data(), z_data, 2 * p_size); 186| 24|} _ZN5Botan6PCurve15PrimeOrderCurve6Scalar8_zeroizeEv: 16| 178k|void PrimeOrderCurve::Scalar::_zeroize() { 17| 178k| secure_zeroize_buffer(m_value.data(), m_value.size() * sizeof(word)); 18| 178k|} _ZN5Botan6PCurve15PrimeOrderCurve15for_named_curveENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE: 32| 12|std::shared_ptr PrimeOrderCurve::for_named_curve(std::string_view name) { 33| 12|#if defined(BOTAN_HAS_PCURVES_SECP256R1) 34| 12| if(name == "secp256r1") { ------------------ | Branch (34:7): [True: 1, False: 11] ------------------ 35| 1| return PCurveInstance::secp256r1(); 36| 1| } 37| 11|#endif 38| | 39| 11|#if defined(BOTAN_HAS_PCURVES_SECP384R1) 40| 11| if(name == "secp384r1") { ------------------ | Branch (40:7): [True: 1, False: 10] ------------------ 41| 1| return PCurveInstance::secp384r1(); 42| 1| } 43| 10|#endif 44| | 45| 10|#if defined(BOTAN_HAS_PCURVES_SECP521R1) 46| 10| if(name == "secp521r1") { ------------------ | Branch (46:7): [True: 1, False: 9] ------------------ 47| 1| return PCurveInstance::secp521r1(); 48| 1| } 49| 9|#endif 50| | 51| 9|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL256R1) 52| 9| if(name == "brainpool256r1") { ------------------ | Branch (52:7): [True: 1, False: 8] ------------------ 53| 1| return PCurveInstance::brainpool256r1(); 54| 1| } 55| 8|#endif 56| | 57| 8|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL384R1) 58| 8| if(name == "brainpool384r1") { ------------------ | Branch (58:7): [True: 1, False: 7] ------------------ 59| 1| return PCurveInstance::brainpool384r1(); 60| 1| } 61| 7|#endif 62| | 63| 7|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL512R1) 64| 7| if(name == "brainpool512r1") { ------------------ | Branch (64:7): [True: 1, False: 6] ------------------ 65| 1| return PCurveInstance::brainpool512r1(); 66| 1| } 67| 6|#endif 68| | 69| 6|#if defined(BOTAN_HAS_PCURVES_FRP256V1) 70| 6| if(name == "frp256v1") { ------------------ | Branch (70:7): [True: 1, False: 5] ------------------ 71| 1| return PCurveInstance::frp256v1(); 72| 1| } 73| 5|#endif 74| | 75| 5|#if defined(BOTAN_HAS_PCURVES_SECP192R1) 76| 5| if(name == "secp192r1") { ------------------ | Branch (76:7): [True: 1, False: 4] ------------------ 77| 1| return PCurveInstance::secp192r1(); 78| 1| } 79| 4|#endif 80| | 81| 4|#if defined(BOTAN_HAS_PCURVES_SECP224R1) 82| 4| if(name == "secp224r1") { ------------------ | Branch (82:7): [True: 1, False: 3] ------------------ 83| 1| return PCurveInstance::secp224r1(); 84| 1| } 85| 3|#endif 86| | 87| 3|#if defined(BOTAN_HAS_PCURVES_SECP256K1) 88| 3| if(name == "secp256k1") { ------------------ | Branch (88:7): [True: 1, False: 2] ------------------ 89| 1| return PCurveInstance::secp256k1(); 90| 1| } 91| 2|#endif 92| | 93| 2|#if defined(BOTAN_HAS_PCURVES_SM2P256V1) 94| 2| if(name == "sm2p256v1") { ------------------ | Branch (94:7): [True: 1, False: 1] ------------------ 95| 1| return PCurveInstance::sm2p256v1(); 96| 1| } 97| 1|#endif 98| | 99| 1|#if defined(BOTAN_HAS_PCURVES_NUMSP512D1) 100| 1| if(name == "numsp512d1") { ------------------ | Branch (100:7): [True: 1, False: 0] ------------------ 101| 1| return PCurveInstance::numsp512d1(); 102| 1| } 103| 0|#endif 104| | 105| 0| BOTAN_UNUSED(name); ------------------ | | 151| 0|#define BOTAN_UNUSED Botan::ignore_params ------------------ 106| 0| return {}; 107| 1|} _ZN5Botan6PCurve14PCurveInstance14brainpool256r1Ev: 37| 1|std::shared_ptr PCurveInstance::brainpool256r1() { 38| 1| return PrimeOrderCurveImpl::instance(); 39| 1|} _ZN5Botan6PCurve14PCurveInstance14brainpool384r1Ev: 37| 1|std::shared_ptr PCurveInstance::brainpool384r1() { 38| 1| return PrimeOrderCurveImpl::instance(); 39| 1|} _ZN5Botan6PCurve14PCurveInstance14brainpool512r1Ev: 37| 1|std::shared_ptr PCurveInstance::brainpool512r1() { 38| 1| return PrimeOrderCurveImpl::instance(); 39| 1|} _ZN5Botan6PCurve14PCurveInstance8frp256v1Ev: 36| 1|std::shared_ptr PCurveInstance::frp256v1() { 37| 1| return PrimeOrderCurveImpl::instance(); 38| 1|} _ZN5Botan6PCurve14PCurveInstance10numsp512d1Ev: 146| 1|std::shared_ptr PCurveInstance::numsp512d1() { 147| 1| return PrimeOrderCurveImpl::instance(); 148| 1|} pcurves_numsp512d1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 26| 1| constexpr static std::array one() { return std::array{1}; } pcurves_numsp512d1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm16EEE: 28| 58.1k| constexpr static std::array redc(const std::array& z) { 29| 58.1k| return redc_crandall(std::span{z}); 30| 58.1k| } pcurves_numsp512d1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm8EEE: 36| 1| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_numsp512d1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_110numsp512d113Numsp512d1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm8EEE: 32| 1| constexpr static std::array to_rep(const std::array& x) { return x; } _ZN5Botan6PCurve14PCurveInstance9secp192r1Ev: 180| 1|std::shared_ptr PCurveInstance::secp192r1() { 181| 1| return PrimeOrderCurveImpl::instance(); 182| 1|} pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 93| 1| constexpr static std::array one() { return std::array{1}; } pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm6EEE: 25| 22.1k| constexpr static std::array redc(const std::array& z) { 26| 22.1k| if constexpr(std::same_as && WordInfo::dword_is_native) { 27| 22.1k| using dword = typename WordInfo::dword; 28| | 29| 22.1k| const dword S01 = dword(z[0]) + z[3] + z[5]; 30| 22.1k| const dword S23 = dword(z[1]) + z[3] + z[4] + z[5]; 31| 22.1k| const dword S45 = dword(z[2]) + z[4] + z[5]; 32| | 33| 22.1k| std::array r = {}; 34| | 35| 22.1k| dword S = S01; 36| 22.1k| r[0] = static_cast(S); 37| 22.1k| S >>= 64; 38| | 39| 22.1k| S += S23; 40| 22.1k| r[1] = static_cast(S); 41| 22.1k| S >>= 64; 42| | 43| 22.1k| S += S45; 44| 22.1k| r[2] = static_cast(S); 45| 22.1k| S >>= 64; 46| | 47| 22.1k| BOTAN_DEBUG_ASSERT(S <= 3); ------------------ | | 137| 22.1k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 22.1k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 22.1k] | | ------------------ ------------------ 48| | 49| 22.1k| solinas_correct_redc(r, P, p192_mul_mod_192(static_cast(S))); 50| | 51| 22.1k| return r; 52| 22.1k| } 53| | 54| 0| const int64_t X00 = get_uint32(z.data(), 0); 55| 22.1k| const int64_t X01 = get_uint32(z.data(), 1); 56| 22.1k| const int64_t X02 = get_uint32(z.data(), 2); 57| 22.1k| const int64_t X03 = get_uint32(z.data(), 3); 58| 22.1k| const int64_t X04 = get_uint32(z.data(), 4); 59| 22.1k| const int64_t X05 = get_uint32(z.data(), 5); 60| 22.1k| const int64_t X06 = get_uint32(z.data(), 6); 61| 22.1k| const int64_t X07 = get_uint32(z.data(), 7); 62| 22.1k| const int64_t X08 = get_uint32(z.data(), 8); 63| 22.1k| const int64_t X09 = get_uint32(z.data(), 9); 64| 22.1k| const int64_t X10 = get_uint32(z.data(), 10); 65| 22.1k| const int64_t X11 = get_uint32(z.data(), 11); 66| | 67| 22.1k| const int64_t S0 = X00 + X06 + X10; 68| 22.1k| const int64_t S1 = X01 + X07 + X11; 69| 22.1k| const int64_t S2 = X02 + X06 + X08 + X10; 70| 22.1k| const int64_t S3 = X03 + X07 + X09 + X11; 71| 22.1k| const int64_t S4 = X04 + X08 + X10; 72| 22.1k| const int64_t S5 = X05 + X09 + X11; 73| | 74| 22.1k| std::array r = {}; 75| | 76| 22.1k| SolinasAccum sum(r); 77| | 78| 22.1k| sum.accum(S0); 79| 22.1k| sum.accum(S1); 80| 22.1k| sum.accum(S2); 81| 22.1k| sum.accum(S3); 82| 22.1k| sum.accum(S4); 83| 22.1k| sum.accum(S5); 84| 22.1k| const auto S = sum.final_carry(0); 85| | 86| 22.1k| BOTAN_DEBUG_ASSERT(S <= 3); ------------------ | | 137| 22.1k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 22.1k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 22.1k] | | ------------------ ------------------ 87| | 88| 22.1k| solinas_correct_redc(r, P, p192_mul_mod_192(S)); 89| | 90| 22.1k| return r; 91| 22.1k| } pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE16p192_mul_mod_192Em: 105| 22.1k| constexpr static std::array p192_mul_mod_192(W i) { 106| 22.1k| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 107| | 108| | // For small i, multiples of P-192 have a simple structure so it's faster to 109| | // compute the value directly vs a (constant time) table lookup 110| | 111| 22.1k| auto r = P; 112| | 113| | if constexpr(WordInfo::bits == 32) { 114| | r[2] -= i; 115| | r[0] -= i; 116| 22.1k| } else { 117| 22.1k| r[1] -= i; 118| 22.1k| r[0] -= i; 119| 22.1k| } 120| 22.1k| return r; 121| 22.1k| } pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm3EEE: 99| 1| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm3EEE: 95| 1| constexpr static std::array to_rep(const std::array& x) { return x; } _ZN5Botan6PCurve14PCurveInstance9secp224r1Ev: 223| 1|std::shared_ptr PCurveInstance::secp224r1() { 224| 1| return PrimeOrderCurveImpl::instance(); 225| 1|} pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 69| 1| constexpr static std::array one() { return std::array{1}; } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 25| 25.7k| constexpr static std::array redc(const std::array& z) { 26| 25.7k| const int64_t X00 = get_uint32(z.data(), 0); 27| 25.7k| const int64_t X01 = get_uint32(z.data(), 1); 28| 25.7k| const int64_t X02 = get_uint32(z.data(), 2); 29| 25.7k| const int64_t X03 = get_uint32(z.data(), 3); 30| 25.7k| const int64_t X04 = get_uint32(z.data(), 4); 31| 25.7k| const int64_t X05 = get_uint32(z.data(), 5); 32| 25.7k| const int64_t X06 = get_uint32(z.data(), 6); 33| 25.7k| const int64_t X07 = get_uint32(z.data(), 7); 34| 25.7k| const int64_t X08 = get_uint32(z.data(), 8); 35| 25.7k| const int64_t X09 = get_uint32(z.data(), 9); 36| 25.7k| const int64_t X10 = get_uint32(z.data(), 10); 37| 25.7k| const int64_t X11 = get_uint32(z.data(), 11); 38| 25.7k| const int64_t X12 = get_uint32(z.data(), 12); 39| 25.7k| const int64_t X13 = get_uint32(z.data(), 13); 40| | 41| 25.7k| const int64_t S0 = 0x00000001 + X00 - X07 - X11; 42| 25.7k| const int64_t S1 = 0x00000000 + X01 - X08 - X12; 43| 25.7k| const int64_t S2 = 0x00000000 + X02 - X09 - X13; 44| 25.7k| const int64_t S3 = 0xFFFFFFFF + X03 + X07 + X11 - X10; 45| 25.7k| const int64_t S4 = 0xFFFFFFFF + X04 + X08 + X12 - X11; 46| 25.7k| const int64_t S5 = 0xFFFFFFFF + X05 + X09 + X13 - X12; 47| 25.7k| const int64_t S6 = 0xFFFFFFFF + X06 + X10 - X13; 48| | 49| 25.7k| std::array r = {}; 50| | 51| 25.7k| SolinasAccum sum(r); 52| | 53| 25.7k| sum.accum(S0); 54| 25.7k| sum.accum(S1); 55| 25.7k| sum.accum(S2); 56| 25.7k| sum.accum(S3); 57| 25.7k| sum.accum(S4); 58| 25.7k| sum.accum(S5); 59| 25.7k| sum.accum(S6); 60| 25.7k| const auto S = sum.final_carry(0); 61| | 62| 25.7k| BOTAN_DEBUG_ASSERT(S <= 2); ------------------ | | 137| 25.7k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 25.7k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 25.7k] | | ------------------ ------------------ 63| | 64| 25.7k| solinas_correct_redc(r, P, p224_mul_mod_224(S)); 65| | 66| 25.7k| return r; 67| 25.7k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE16p224_mul_mod_224Em: 81| 25.7k| constexpr static std::array p224_mul_mod_224(W i) { 82| 25.7k| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 83| | 84| | // For small i, multiples of P-224 have a simple structure so it's faster to 85| | // compute the value directly vs a (constant time) table lookup 86| | 87| 25.7k| auto r = P; 88| | 89| | if constexpr(WordInfo::bits == 32) { 90| | r[3] -= i; 91| | r[0] += i; 92| 25.7k| } else { 93| 25.7k| const W i32 = i << 32; 94| 25.7k| r[1] -= i32; 95| 25.7k| r[0] += i; 96| 25.7k| } 97| 25.7k| return r; 98| 25.7k| } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 75| 1| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 71| 1| constexpr static std::array to_rep(const std::array& x) { return x; } pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r15Curve13scalar_invertERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS2_6ParamsENS2_12Secp224r1RepEE12ScalarParamsEEEEE: 151| 671| static constexpr Scalar scalar_invert(const Scalar& x) { 152| | // Generated using https://github.com/mmcloughlin/addchain 153| 671| auto t6 = x.square(); 154| 671| auto z = t6.square(); 155| 671| auto t3 = x * z; 156| 671| auto t2 = t3 * t6; 157| 671| auto t8 = t2 * z; 158| 671| auto t7 = t8 * z; 159| 671| auto t5 = t7 * z; 160| 671| auto t0 = t5 * t6; 161| 671| auto t1 = t0 * t6; 162| 671| auto t4 = t1 * z; 163| 671| z = t4 * t6; 164| 671| t6 *= z; 165| 671| auto t10 = t6.square(); 166| 671| auto t9 = t10 * x; 167| 671| t10.square_n(5); 168| 671| t9 *= t10; 169| 671| t10.square_n(5); 170| 671| t9 *= t10; 171| 671| t10 = t9; 172| 671| t10.square_n(16); 173| 671| t10 *= t9; 174| 671| auto t11 = t10; 175| 671| t11.square_n(32); 176| 671| t11 *= t10; 177| 671| t11.square_n(32); 178| 671| t10 *= t11; 179| 671| t10.square_n(16); 180| 671| t9 *= t10; 181| 671| t9.square_n(7); 182| 671| t8 *= t9; 183| 671| t8.square_n(4); 184| 671| t8 *= t3; 185| 671| t8.square_n(8); 186| 671| t8 *= t1; 187| 671| t8.square_n(10); 188| 671| t8 *= t1; 189| 671| t8.square_n(7); 190| 671| t7 *= t8; 191| 671| t7.square_n(11); 192| 671| t6 *= t7; 193| 671| t6.square_n(9); 194| 671| t5 *= t6; 195| 671| t5.square_n(5); 196| 671| t4 *= t5; 197| 671| t4.square_n(3); 198| 671| t4 *= t3; 199| 671| t4.square_n(5); 200| 671| t4 *= t3; 201| 671| t4.square_n(5); 202| 671| t3 *= t4; 203| 671| t3.square_n(8); 204| 671| t3 *= t0; 205| 671| t3.square_n(4); 206| 671| t2 *= t3; 207| 671| t2.square_n(8); 208| 671| t1 *= t2; 209| 671| t1.square_n(9); 210| 671| t0 *= t1; 211| 671| t0.square_n(8); 212| 671| z *= t0; 213| 671| z = z.square(); 214| 671| z *= x; 215| 671| return z; 216| 671| } _ZN5Botan6PCurve14PCurveInstance9secp256k1Ev: 233| 1|std::shared_ptr PCurveInstance::secp256k1() { 234| 1| return PrimeOrderCurveImpl::instance(); 235| 1|} pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 28| 1| constexpr static std::array one() { return std::array{1}; } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 30| 28.5k| constexpr static std::array redc(const std::array& z) { 31| 28.5k| return redc_crandall(std::span{z}); 32| 28.5k| } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 38| 1| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k112Secp256k1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 34| 1| constexpr static std::array to_rep(const std::array& x) { return x; } pcurves_secp256k1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256k15Curve13scalar_invertERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS2_6ParamsENS2_12Secp256k1RepEE12ScalarParamsEEEEE: 140| 531| static constexpr Scalar scalar_invert(const Scalar& x) { 141| 531| auto z = x.square(); 142| 531| auto t2 = x * z; 143| 531| auto t6 = t2 * z; 144| 531| auto t5 = t6 * z; 145| 531| auto t0 = t5 * z; 146| 531| auto t3 = t0 * z; 147| 531| auto t1 = t3 * z; 148| 531| z = t1; 149| 531| z.square_n(2); 150| 531| z *= t3; 151| 531| auto t4 = z.square(); 152| 531| auto t7 = t4 * x; 153| 531| t4 = t7.square(); 154| 531| t4 *= x; 155| 531| auto t9 = t4; 156| 531| t9.square_n(3); 157| 531| auto t10 = t9; 158| 531| t10.square_n(2); 159| 531| auto t11 = t10.square(); 160| 531| auto t8 = t11.square(); 161| 531| auto t12 = t8; 162| 531| t12.square_n(7); 163| 531| t11 *= t12; 164| 531| t11.square_n(9); 165| 531| t8 *= t11; 166| 531| t11 = t8; 167| 531| t11.square_n(6); 168| 531| t10 *= t11; 169| 531| t10.square_n(26); 170| 531| t8 *= t10; 171| 531| t10 = t8; 172| 531| t10.square_n(4); 173| 531| t9 *= t10; 174| 531| t9.square_n(60); 175| 531| t8 *= t9; 176| 531| t7 *= t8; 177| 531| t7.square_n(5); 178| 531| t7 *= t3; 179| 531| t7.square_n(3); 180| 531| t7 *= t6; 181| 531| t7.square_n(4); 182| 531| t7 *= t6; 183| 531| t7.square_n(4); 184| 531| t7 *= t5; 185| 531| t7.square_n(5); 186| 531| t7 *= t1; 187| 531| t7.square_n(2); 188| 531| t7 *= t2; 189| 531| t7.square_n(5); 190| 531| t7 *= t5; 191| 531| t7.square_n(6); 192| 531| t7 *= t1; 193| 531| t7.square_n(5); 194| 531| t7 *= t3; 195| 531| t7.square_n(4); 196| 531| t7 *= t1; 197| 531| t7.square_n(3); 198| 531| t7 *= x; 199| 531| t7.square_n(6); 200| 531| t6 *= t7; 201| 531| t6.square_n(10); 202| 531| t6 *= t5; 203| 531| t6.square_n(4); 204| 531| t5 *= t6; 205| 531| t5.square_n(9); 206| 531| t4 *= t5; 207| 531| t4.square_n(5); 208| 531| t4 *= t0; 209| 531| t4.square_n(6); 210| 531| t3 *= t4; 211| 531| t3.square_n(4); 212| 531| t3 *= t1; 213| 531| t3.square_n(5); 214| 531| t2 *= t3; 215| 531| t2.square_n(6); 216| 531| t2 *= t1; 217| 531| t2.square_n(10); 218| 531| t1 *= t2; 219| 531| t1.square_n(4); 220| 531| t0 *= t1; 221| 531| t0.square_n(6); 222| 531| t0 *= x; 223| 531| t0.square_n(8); 224| 531| z *= t0; 225| 531| return z; 226| 531| } _ZN5Botan6PCurve14PCurveInstance9secp256r1Ev: 407| 1|std::shared_ptr PCurveInstance::secp256r1() { 408| 1| return PrimeOrderCurveImpl::instance(); 409| 1|} pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE3oneEv: 138| 1| constexpr static std::array one() { return R1; } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 140| 29.3k| constexpr static BOTAN_FORCE_INLINE std::array redc(const std::array& z) { 141| | // Scalar locals rather than a copy of z: GCC copies arrays using 16 byte 142| | // loads, which stall on the 8 byte stores that just produced z 143| 29.3k| W t1 = z[1]; 144| 29.3k| W t2 = z[2]; 145| 29.3k| W t3 = z[3]; 146| 29.3k| W t4 = z[4]; 147| 29.3k| W t5 = z[5]; 148| 29.3k| W t6 = z[6]; 149| 29.3k| W t7 = z[7]; 150| | 151| | // The carry out from the previous step 152| 29.3k| W pending = 0; 153| | 154| 29.3k| redc_step(z[0], t1, t2, t3, t4, pending); 155| 29.3k| redc_step(t1, t2, t3, t4, t5, pending); 156| 29.3k| redc_step(t2, t3, t4, t5, t6, pending); 157| 29.3k| redc_step(t3, t4, t5, t6, t7, pending); 158| | 159| 29.3k| return final_sub(pending, {t4, t5, t6, t7}); 160| 29.3k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE9redc_stepEmRmS9_S9_S9_S9_: 185| 117k| constexpr static BOTAN_FORCE_INLINE void redc_step(W m, W& t0, W& t1, W& t2, W& t3, W& pending) { 186| 117k| auto [q0, q1, q2, q3] = p256_m_p1_64(m); 187| | 188| | // q3 is at most 2^64 - 2^32, leaving room to add the carry from the 189| | // previous step without worrying about creating a new carry 190| 117k| q3 += pending; 191| | 192| 117k| W carry = 0; 193| 117k| t0 = word_add(t0, q0, &carry); 194| 117k| t1 = word_add(t1, q1, &carry); 195| 117k| t2 = word_add(t2, q2, &carry); 196| 117k| t3 = word_add(t3, q3, &carry); 197| 117k| pending = carry; 198| 117k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE12p256_m_p1_64Em: 204| 117k| constexpr static BOTAN_FORCE_INLINE std::array p256_m_p1_64(W m) { 205| 117k| const W m_lo = m << 32; 206| 117k| const W m_hi = m >> 32; 207| | 208| | /* 209| | * m*(p+1)/2^64 = m*2^32 + m*2^128 + m*2^192 - m*2^160, laid out as 210| | * 211| | * m*2^32 -> word 0 gets m << 32, word 1 gets m >> 32 212| | * m*2^128 -> word 2 gets m 213| | * m*2^192 -> word 3 gets m 214| | * -m*2^160 -> word 2 loses m << 32, word 3 loses m >> 32 plus the borrow 215| | * 216| | * The total is non-negative and below 2^256, so the final borrow is zero 217| | */ 218| 117k| W borrow = 0; 219| 117k| const W q2 = word_sub(m, m_lo, &borrow); 220| 117k| const W q3 = word_sub(m, m_hi, &borrow); 221| | 222| 117k| return {m_lo, m_hi, q2, q3}; 223| 117k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE9final_subEmRKNSt3__15arrayImLm4EEE: 228| 29.3k| constexpr static BOTAN_FORCE_INLINE std::array final_sub(W top, const std::array& t) { 229| 29.3k| W borrow = 0; 230| 29.3k| const W r0 = word_sub(t[0], P[0], &borrow); 231| 29.3k| const W r1 = word_sub(t[1], P[1], &borrow); 232| 29.3k| const W r2 = word_sub(t[2], P[2], &borrow); 233| 29.3k| const W r3 = word_sub(t[3], P[3], &borrow); 234| | 235| | // t is only < p if the subtraction underflowed and top (the 257th bit) is zero 236| 29.3k| const W t_lt_p = CT::value_barrier(static_cast(0) - (borrow & (top ^ 1))); 237| | 238| 29.3k| return { 239| 29.3k| choose(t_lt_p, t[0], r0), 240| 29.3k| choose(t_lt_p, t[1], r1), 241| 29.3k| choose(t_lt_p, t[2], r2), 242| 29.3k| choose(t_lt_p, t[3], r3), 243| 29.3k| }; 244| 29.3k| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 175| 1| constexpr static std::array from_rep(const std::array& z) { 176| 1| std::array ze = {}; 177| 1| copy_mem(std::span{ze}.template first(), z); 178| 1| return redc(ze); 179| 1| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_122Secp256r1MontgomeryRepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 162| 1| constexpr static std::array to_rep(const std::array& x) { 163| 1| std::array z; // NOLINT(*-member-init) 164| 1| comba_mul(z.data(), x.data(), R2.data()); 165| 1| return redc(z); 166| 1| } pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256r15Curve13scalar_invertERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS2_6ParamsENS1_22Secp256r1MontgomeryRepEE12ScalarParamsEEEEE: 328| 566| static constexpr Scalar scalar_invert(const Scalar& x) { 329| 566| auto t1 = x.square(); 330| 566| auto t5 = t1.square(); 331| 566| auto t2 = t5 * x; 332| 566| auto t10 = t2 * x; 333| 566| auto t3 = t2 * t5; 334| 566| auto z = t10 * t3; 335| 566| auto t9 = t3.square(); 336| 566| auto t4 = t10 * z; 337| 566| auto t0 = t10 * t9; 338| 566| auto t13 = t0 * t1; 339| 566| auto t8 = t13 * t4; 340| 566| t4 = t3 * t8; 341| 566| auto t7 = t2 * t4; 342| 566| t2 = t1 * t7; 343| 566| auto t6 = t7 * t9; 344| 566| t3 = t6 * t9; 345| 566| t1 *= t3; 346| 566| auto t12 = t3 * t9; 347| 566| t5 *= t12; 348| 566| auto t11 = t10 * t5; 349| 566| t0 *= t11; 350| 566| t9 *= t0; 351| 566| t10 *= t9; 352| 566| t4 *= t10; 353| 566| t13 *= t4; 354| 566| auto t14 = t13; 355| 566| t14.square_n(8); 356| 566| t13 *= t14; 357| 566| t14 = t13; 358| 566| t14.square_n(16); 359| 566| t14 *= t13; 360| 566| t14.square_n(48); 361| 566| t14 *= t13; 362| 566| t14.square_n(16); 363| 566| t14 *= t13; 364| 566| t14.square_n(16); 365| 566| t14 *= t13; 366| 566| t14.square_n(16); 367| 566| t13 *= t14; 368| 566| t13.square_n(6); 369| 566| t13 *= t8; 370| 566| t13.square_n(9); 371| 566| t12 *= t13; 372| 566| t12.square_n(8); 373| 566| t11 *= t12; 374| 566| t11.square_n(9); 375| 566| t10 *= t11; 376| 566| t10.square_n(8); 377| 566| t9 *= t10; 378| 566| t9.square_n(9); 379| 566| t8 *= t9; 380| 566| t8.square_n(8); 381| 566| t7 *= t8; 382| 566| t7.square_n(11); 383| 566| t6 *= t7; 384| 566| t6.square_n(9); 385| 566| t5 *= t6; 386| 566| t5.square_n(10); 387| 566| t4 *= t5; 388| 566| t4.square_n(8); 389| 566| t3 *= t4; 390| 566| t3.square_n(7); 391| 566| t2 *= t3; 392| 566| t2.square_n(10); 393| 566| t1 *= t2; 394| 566| t1.square_n(10); 395| 566| t0 *= t1; 396| 566| t0.square_n(6); 397| 566| z *= t0; 398| | 399| 566| return z; 400| 566| } _ZN5Botan6PCurve14PCurveInstance9secp384r1Ev: 343| 1|std::shared_ptr PCurveInstance::secp384r1() { 344| 1| return PrimeOrderCurveImpl::instance(); 345| 1|} pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE3oneEv: 88| 1| constexpr static std::array one() { return std::array{1}; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm12EEE: 23| 43.7k| constexpr static std::array redc(const std::array& z) { 24| 43.7k| const int64_t X00 = get_uint32(z.data(), 0); 25| 43.7k| const int64_t X01 = get_uint32(z.data(), 1); 26| 43.7k| const int64_t X02 = get_uint32(z.data(), 2); 27| 43.7k| const int64_t X03 = get_uint32(z.data(), 3); 28| 43.7k| const int64_t X04 = get_uint32(z.data(), 4); 29| 43.7k| const int64_t X05 = get_uint32(z.data(), 5); 30| 43.7k| const int64_t X06 = get_uint32(z.data(), 6); 31| 43.7k| const int64_t X07 = get_uint32(z.data(), 7); 32| 43.7k| const int64_t X08 = get_uint32(z.data(), 8); 33| 43.7k| const int64_t X09 = get_uint32(z.data(), 9); 34| 43.7k| const int64_t X10 = get_uint32(z.data(), 10); 35| 43.7k| const int64_t X11 = get_uint32(z.data(), 11); 36| 43.7k| const int64_t X12 = get_uint32(z.data(), 12); 37| 43.7k| const int64_t X13 = get_uint32(z.data(), 13); 38| 43.7k| const int64_t X14 = get_uint32(z.data(), 14); 39| 43.7k| const int64_t X15 = get_uint32(z.data(), 15); 40| 43.7k| const int64_t X16 = get_uint32(z.data(), 16); 41| 43.7k| const int64_t X17 = get_uint32(z.data(), 17); 42| 43.7k| const int64_t X18 = get_uint32(z.data(), 18); 43| 43.7k| const int64_t X19 = get_uint32(z.data(), 19); 44| 43.7k| const int64_t X20 = get_uint32(z.data(), 20); 45| 43.7k| const int64_t X21 = get_uint32(z.data(), 21); 46| 43.7k| const int64_t X22 = get_uint32(z.data(), 22); 47| 43.7k| const int64_t X23 = get_uint32(z.data(), 23); 48| | 49| | // One copy of P-384 is added to prevent underflow 50| 43.7k| const int64_t S0 = 0xFFFFFFFF + X00 + X12 + X20 + X21 - X23; 51| 43.7k| const int64_t S1 = 0x00000000 + X01 + X13 + X22 + X23 - X12 - X20; 52| 43.7k| const int64_t S2 = 0x00000000 + X02 + X14 + X23 - X13 - X21; 53| 43.7k| const int64_t S3 = 0xFFFFFFFF + X03 + X12 + X15 + X20 + X21 - X14 - X22 - X23; 54| 43.7k| const int64_t S4 = 0xFFFFFFFE + X04 + X12 + X13 + X16 + X20 + X21 * 2 + X22 - X15 - X23 * 2; 55| 43.7k| const int64_t S5 = 0xFFFFFFFF + X05 + X13 + X14 + X17 + X21 + X22 * 2 + X23 - X16; 56| 43.7k| const int64_t S6 = 0xFFFFFFFF + X06 + X14 + X15 + X18 + X22 + X23 * 2 - X17; 57| 43.7k| const int64_t S7 = 0xFFFFFFFF + X07 + X15 + X16 + X19 + X23 - X18; 58| 43.7k| const int64_t S8 = 0xFFFFFFFF + X08 + X16 + X17 + X20 - X19; 59| 43.7k| const int64_t S9 = 0xFFFFFFFF + X09 + X17 + X18 + X21 - X20; 60| 43.7k| const int64_t SA = 0xFFFFFFFF + X10 + X18 + X19 + X22 - X21; 61| 43.7k| const int64_t SB = 0xFFFFFFFF + X11 + X19 + X20 + X23 - X22; 62| | 63| 43.7k| std::array r = {}; 64| | 65| 43.7k| SolinasAccum sum(r); 66| | 67| 43.7k| sum.accum(S0); 68| 43.7k| sum.accum(S1); 69| 43.7k| sum.accum(S2); 70| 43.7k| sum.accum(S3); 71| 43.7k| sum.accum(S4); 72| 43.7k| sum.accum(S5); 73| 43.7k| sum.accum(S6); 74| 43.7k| sum.accum(S7); 75| 43.7k| sum.accum(S8); 76| 43.7k| sum.accum(S9); 77| 43.7k| sum.accum(SA); 78| 43.7k| sum.accum(SB); 79| 43.7k| const auto S = sum.final_carry(0); 80| | 81| 43.7k| BOTAN_DEBUG_ASSERT(S <= 4); ------------------ | | 137| 43.7k| do { /* NOLINT(*-avoid-do-while) */ \ | | 138| 43.7k| } while(0) | | ------------------ | | | Branch (138:15): [Folded, False: 43.7k] | | ------------------ ------------------ 82| | 83| 43.7k| solinas_correct_redc(r, P, p384_mul_mod_384(S)); 84| | 85| 43.7k| return r; 86| 43.7k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE16p384_mul_mod_384Em: 100| 43.7k| constexpr static std::array p384_mul_mod_384(W i) { 101| 43.7k| static_assert(WordInfo::bits == 32 || WordInfo::bits == 64); 102| | 103| | // For small i, multiples of P-384 have a simple structure so it's faster to 104| | // compute the value directly vs a (constant time) table lookup 105| | 106| 43.7k| auto r = P; 107| | if constexpr(WordInfo::bits == 32) { 108| | r[4] -= i; 109| | r[3] -= i; 110| | r[1] += i; 111| | r[0] -= i; 112| 43.7k| } else { 113| 43.7k| const uint64_t i32 = static_cast(i) << 32; 114| 43.7k| r[2] -= i; 115| 43.7k| r[1] -= i32; 116| 43.7k| r[0] += i32; 117| 43.7k| r[0] -= i; 118| 43.7k| } 119| 43.7k| return r; 120| 43.7k| } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm6EEE: 94| 1| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm6EEE: 90| 1| constexpr static std::array to_rep(const std::array& x) { return x; } pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp384r15Curve13scalar_invertERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS2_6ParamsENS1_12Secp384r1RepEE12ScalarParamsEEEEE: 223| 489| static constexpr Scalar scalar_invert(const Scalar& x) { 224| | // Generated using https://github.com/mmcloughlin/addchain 225| | 226| 489| auto t3 = x.square(); 227| 489| auto t1 = x * t3; 228| 489| auto t0 = t3 * t1; 229| 489| auto t2 = t3 * t0; 230| 489| auto t4 = t3 * t2; 231| 489| auto z = t3 * t4; 232| 489| auto t5 = t3 * z; 233| 489| t3 *= t5; 234| 489| auto t6 = t3.square(); 235| 489| t6 *= x; 236| 489| auto t8 = t6; 237| 489| t8.square_n(2); 238| 489| auto t9 = t8.square(); 239| 489| auto t7 = t9.square(); 240| 489| auto t10 = t7; 241| 489| t10.square_n(5); 242| 489| t7 *= t10; 243| 489| t10 = t7; 244| 489| t10.square_n(10); 245| 489| t7 *= t10; 246| 489| t10 = t7; 247| 489| t10.square_n(4); 248| 489| t9 *= t10; 249| 489| t9.square_n(21); 250| 489| t7 *= t9; 251| 489| t9 = t7; 252| 489| t9.square_n(3); 253| 489| t8 *= t9; 254| 489| t8.square_n(47); 255| 489| t7 *= t8; 256| 489| t8 = t7; 257| 489| t8.square_n(95); 258| 489| t7 *= t8; 259| 489| t7 *= t3; 260| 489| t7.square_n(6); 261| 489| t7 *= t2; 262| 489| t7.square_n(3); 263| 489| t7 *= t1; 264| 489| t7.square_n(7); 265| 489| t7 *= t5; 266| 489| t7.square_n(6); 267| 489| t7 *= t5; 268| 489| t7 = t7.square(); 269| 489| t7 *= x; 270| 489| t7.square_n(11); 271| 489| t7 *= t6; 272| 489| t7.square_n(2); 273| 489| t7 *= x; 274| 489| t7.square_n(8); 275| 489| t7 *= t5; 276| 489| t7.square_n(2); 277| 489| t7 *= t1; 278| 489| t7.square_n(6); 279| 489| t7 *= z; 280| 489| t7.square_n(4); 281| 489| t7 *= t2; 282| 489| t7.square_n(6); 283| 489| t6 *= t7; 284| 489| t6.square_n(5); 285| 489| t6 *= z; 286| 489| t6.square_n(10); 287| 489| t6 *= t5; 288| 489| t6.square_n(9); 289| 489| t5 *= t6; 290| 489| t5.square_n(4); 291| 489| t5 *= z; 292| 489| t5.square_n(6); 293| 489| t4 *= t5; 294| 489| t4.square_n(3); 295| 489| t4 *= x; 296| 489| t4.square_n(7); 297| 489| t4 *= z; 298| 489| t4.square_n(7); 299| 489| t4 *= t0; 300| 489| t4.square_n(5); 301| 489| t4 *= t2; 302| 489| t4.square_n(5); 303| 489| t3 *= t4; 304| 489| t3.square_n(5); 305| 489| t3 *= z; 306| 489| t3.square_n(4); 307| 489| t3 *= z; 308| 489| t3.square_n(5); 309| 489| t2 *= t3; 310| 489| t2.square_n(3); 311| 489| t2 *= t1; 312| 489| t2.square_n(7); 313| 489| t2 *= t1; 314| 489| t2.square_n(6); 315| 489| t2 *= z; 316| 489| t2.square_n(4); 317| 489| t2 *= t0; 318| 489| t2.square_n(3); 319| 489| t2 *= t1; 320| 489| t2.square_n(4); 321| 489| t2 *= t1; 322| 489| t2.square_n(4); 323| 489| t1 *= t2; 324| 489| t1.square_n(6); 325| 489| t1 *= t0; 326| 489| t1.square_n(5); 327| 489| t0 *= t1; 328| 489| t0.square_n(6); 329| 489| z *= t0; 330| 489| z = z.square(); 331| 489| z *= x; 332| 489| z.square_n(4); 333| 489| z *= x; 334| | 335| 489| return z; 336| 489| } _ZN5Botan6PCurve14PCurveInstance9secp521r1Ev: 291| 1|std::shared_ptr PCurveInstance::secp521r1() { 292| 1| return PrimeOrderCurveImpl::instance(); 293| 1|} pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 24| 1| constexpr static std::array one() { return std::array{1}; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEE: 26| 58.1k| constexpr static std::array redc(const std::array& z) { 27| | // Regardless of word size (32 or 64) the top word is 9 bits long 28| 58.1k| constexpr W TOP_BITS = static_cast(0x1FF); 29| | // The 23 or 55 bits that should be cleared in the top word 30| 58.1k| constexpr W CLEARED_TOP_BITS = WordInfo::max ^ TOP_BITS; 31| | 32| | /* 33| | * Extract the high part of z (z >> 521) 34| | */ 35| 58.1k| std::array t; // NOLINT(*-member-init) 36| | 37| 581k| for(size_t i = 0; i != N; ++i) { ------------------ | Branch (37:28): [True: 523k, False: 58.1k] ------------------ 38| 523k| t[i] = z[(N - 1) + i] >> 9; 39| 523k| } 40| | 41| 523k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (41:28): [True: 465k, False: 58.1k] ------------------ 42| 465k| t[i] |= z[(N - 1) + i + 1] << (WordInfo::bits - 9); 43| 465k| } 44| | 45| | // Now t += z & (2**521-1) 46| 58.1k| W carry = 0; 47| 523k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (47:28): [True: 465k, False: 58.1k] ------------------ 48| 465k| t[i] = word_add(t[i], z[i], &carry); 49| 465k| } 50| | 51| | // Now add the (partial) top words; this can't carry out 52| | // since both inputs are at most 2**9-1 53| 58.1k| t[N - 1] += (z[N - 1] & TOP_BITS) + carry; 54| | 55| | /* 56| | Since the modulus P is exactly 2**521 - 1 the only way the computed 57| | result can be larger than P is if the top word is larger than TOP_BITS 58| | 59| | Since TOP_BITS has the low 9 bits set, we can check if t[N - 1] > TOP_BITS 60| | by checking if t[N - 1] >> 9 has any bits set. Doing it this way is 61| | faster than a standard comparison since CT::Mask::is_gt requires 62| | several bit operations. 63| | */ 64| | 65| 58.1k| const W is_over_p521 = ~CT::Mask::is_zero(t[N - 1] >> 9).value(); 66| | 67| | /* 68| | * Also must detect/handle x == P 69| | */ 70| 58.1k| const W is_eq_p521 = [&]() { 71| 58.1k| W sum = WordInfo::max; 72| 58.1k| for(size_t i = 0; i != N - 1; ++i) { 73| 58.1k| sum &= t[i]; 74| 58.1k| } 75| 58.1k| sum &= (CLEARED_TOP_BITS | t[N - 1]); 76| | 77| 58.1k| return CT::Mask::is_zero(sum ^ WordInfo::max).value(); 78| 58.1k| }(); 79| | 80| 58.1k| const W need_sub = is_over_p521 | is_eq_p521; 81| | 82| 58.1k| W borrow = 0; 83| 523k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (83:28): [True: 465k, False: 58.1k] ------------------ 84| 465k| t[i] = word_sub(t[i], need_sub & WordInfo::max, &borrow); 85| 465k| } 86| 58.1k| t[N - 1] = word_sub(t[N - 1], need_sub & TOP_BITS, &borrow); 87| | 88| 58.1k| return t; 89| 58.1k| } pcurves_secp521r1.cpp:_ZZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEEENKUlvE_clEv: 70| 58.1k| const W is_eq_p521 = [&]() { 71| 58.1k| W sum = WordInfo::max; 72| 523k| for(size_t i = 0; i != N - 1; ++i) { ------------------ | Branch (72:31): [True: 465k, False: 58.1k] ------------------ 73| 465k| sum &= t[i]; 74| 465k| } 75| 58.1k| sum &= (CLEARED_TOP_BITS | t[N - 1]); 76| | 77| 58.1k| return CT::Mask::is_zero(sum ^ WordInfo::max).value(); 78| 58.1k| }(); pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm9EEE: 95| 1| constexpr static std::array from_rep(const std::array& z) { return z; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm9EEE: 91| 1| constexpr static std::array to_rep(const std::array& x) { return x; } pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r15Curve13scalar_invertERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS2_6ParamsENS2_7P521RepEE12ScalarParamsEEEEE: 161| 445| static constexpr Scalar scalar_invert(const Scalar& x) { 162| | // Generated using https://github.com/mmcloughlin/addchain 163| | 164| 445| auto t2 = x.square(); 165| 445| auto t13 = t2 * x; 166| 445| auto t4 = t13 * x; 167| 445| auto z = t13 * t4; 168| 445| auto t5 = x * z; 169| 445| auto t16 = t13 * t5; 170| 445| auto t10 = t16 * t2; 171| 445| auto t18 = t10 * t2; 172| 445| auto t1 = t18 * t2; 173| 445| auto t12 = t1 * t2; 174| 445| auto t15 = t12 * t4; 175| 445| auto t0 = t15 * t2; 176| 445| auto t3 = t0 * t2; 177| 445| auto t6 = t2 * t3; 178| 445| auto t11 = t5 * t6; 179| 445| auto t14 = t11 * t4; 180| 445| auto t9 = t14 * t4; 181| 445| auto t17 = t2 * t9; 182| 445| auto t7 = t17 * t4; 183| 445| t4 *= t7; 184| 445| auto t8 = t2 * t4; 185| 445| t5 = t2 * t8; 186| 445| t2 *= t5; 187| 445| auto t19 = t2; 188| 445| t19.square_n(3); 189| 445| t15 *= t19; 190| 445| t19 = t15.square(); 191| 445| auto t20 = t19; 192| 445| t20.square_n(8); 193| 445| t20 *= t15; 194| 445| t20.square_n(10); 195| 445| t19 *= t20; 196| 445| t20 = t19; 197| 445| t20.square_n(8); 198| 445| t20 *= t15; 199| 445| t20.square_n(28); 200| 445| t19 *= t20; 201| 445| t20 = t19; 202| 445| t20.square_n(63); 203| 445| t19 *= t20; 204| 445| t20 = t19; 205| 445| t20.square_n(8); 206| 445| t20 *= t15; 207| 445| t20.square_n(127); 208| 445| t19 *= t20; 209| 445| t19 *= x; 210| 445| t19.square_n(7); 211| 445| t19 *= t11; 212| 445| t19.square_n(5); 213| 445| t19 *= t13; 214| 445| t19.square_n(8); 215| 445| t19 *= t10; 216| 445| t19.square_n(8); 217| 445| t19 *= t18; 218| 445| t19.square_n(11); 219| 445| t19 *= t5; 220| 445| t19.square_n(4); 221| 445| t18 *= t19; 222| 445| t18.square_n(8); 223| 445| t17 *= t18; 224| 445| t17.square_n(6); 225| 445| t17 *= t11; 226| 445| t17.square_n(5); 227| 445| t17 *= t12; 228| 445| t17.square_n(5); 229| 445| t16 *= t17; 230| 445| t16.square_n(10); 231| 445| t15 *= t16; 232| 445| t15.square_n(4); 233| 445| t15 *= t13; 234| 445| t15.square_n(15); 235| 445| t14 *= t15; 236| 445| t14.square_n(9); 237| 445| t14 *= t2; 238| 445| t14.square_n(2); 239| 445| t13 *= t14; 240| 445| t13.square_n(9); 241| 445| t12 *= t13; 242| 445| t12.square_n(7); 243| 445| t11 *= t12; 244| 445| t11.square_n(4); 245| 445| t10 *= t11; 246| 445| t10.square_n(12); 247| 445| t10 *= t5; 248| 445| t10.square_n(6); 249| 445| t9 *= t10; 250| 445| t9.square_n(7); 251| 445| t8 *= t9; 252| 445| t8.square_n(8); 253| 445| t8 *= t4; 254| 445| t8.square_n(8); 255| 445| t8 *= t1; 256| 445| t8.square_n(8); 257| 445| t7 *= t8; 258| 445| t7.square_n(5); 259| 445| t7 *= t1; 260| 445| t7.square_n(9); 261| 445| t7 *= t2; 262| 445| t7.square_n(6); 263| 445| t6 *= t7; 264| 445| t6.square_n(7); 265| 445| t5 *= t6; 266| 445| t5.square_n(7); 267| 445| t4 *= t5; 268| 445| t4.square_n(5); 269| 445| t3 *= t4; 270| 445| t3.square_n(4); 271| 445| t3 *= z; 272| 445| t3.square_n(9); 273| 445| t2 *= t3; 274| 445| t2.square_n(7); 275| 445| t1 *= t2; 276| 445| t1.square_n(5); 277| 445| t1 *= z; 278| 445| t1.square_n(9); 279| 445| t0 *= t1; 280| 445| t0.square_n(10); 281| 445| z *= t0; 282| | 283| 445| return z; 284| 445| } _ZN5Botan6PCurve14PCurveInstance9sm2p256v1Ev: 350| 1|std::shared_ptr PCurveInstance::sm2p256v1() { 351| 1| return PrimeOrderCurveImpl::instance(); 352| 1|} pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv: 133| 1| constexpr static std::array one() { return R1; } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE: 135| 29.3k| constexpr static BOTAN_FORCE_INLINE std::array redc(const std::array& z) { 136| | // Scalar locals rather than a copy of z: GCC copies arrays using 16 byte 137| | // loads, which stall on the 8 byte stores that just produced z 138| 29.3k| W t1 = z[1]; 139| 29.3k| W t2 = z[2]; 140| 29.3k| W t3 = z[3]; 141| 29.3k| W t4 = z[4]; 142| 29.3k| W t5 = z[5]; 143| 29.3k| W t6 = z[6]; 144| 29.3k| W t7 = z[7]; 145| | 146| | // The carry out at the end of each step needs to end up in the word 147| | // above t3, which is exactly q3 of the next step since we shift the 148| | // window 1 word at a time 149| 29.3k| W pending = 0; 150| | 151| 29.3k| redc_step(z[0], t1, t2, t3, t4, pending); 152| 29.3k| redc_step(t1, t2, t3, t4, t5, pending); 153| 29.3k| redc_step(t2, t3, t4, t5, t6, pending); 154| 29.3k| redc_step(t3, t4, t5, t6, t7, pending); 155| | 156| 29.3k| return final_sub(pending, {t4, t5, t6, t7}); 157| 29.3k| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE9redc_stepEmRmS9_S9_S9_S9_: 182| 117k| constexpr static BOTAN_FORCE_INLINE void redc_step(W m, W& t0, W& t1, W& t2, W& t3, W& pending) { 183| 117k| auto [q0, q1, q2, q3] = sm2_m_p1_64(m); 184| | 185| | // q3 is at most 2^64 - 2^32 so no carry out is possible here 186| 117k| q3 += pending; 187| | 188| | // Adding m*p would zero the word holding m, which is never read 189| | // again, so only the part above it is added 190| 117k| W carry = 0; 191| 117k| t0 = word_add(t0, q0, &carry); 192| 117k| t1 = word_add(t1, q1, &carry); 193| 117k| t2 = word_add(t2, q2, &carry); 194| 117k| t3 = word_add(t3, q3, &carry); 195| 117k| pending = carry; 196| 117k| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE11sm2_m_p1_64Em: 202| 117k| constexpr static BOTAN_FORCE_INLINE std::array sm2_m_p1_64(W m) { 203| 117k| const W m_lo = m << 32; 204| 117k| const W m_hi = m >> 32; 205| | 206| | /* 207| | * m*(p+1)/2^64 = m + m*2^192 - m*2^32 - m*2^160, laid out as 208| | * 209| | * m -> word 0 gets m 210| | * m*2^192 -> word 3 gets m 211| | * -m*2^32 -> word 0 loses m << 32, word 1 loses m >> 32 plus the borrow 212| | * -m*2^160 -> word 2 loses m << 32, word 3 loses m >> 32 plus the borrow 213| | * 214| | * The total is non-negative and below 2^256, so the final borrow is zero 215| | */ 216| 117k| W borrow = 0; 217| | 218| | // This variable is intentionally non-const to work around 219| | // GCC 14 at -O1 inserting a undesirable conditional jump 220| 117k| W zero = CT::value_barrier(0); // NOLINT(*-const-correctness) 221| | 222| 117k| const W q0 = word_sub(m, m_lo, &borrow); 223| 117k| const W q1 = word_sub(zero, m_hi, &borrow); 224| 117k| const W q2 = word_sub(zero, m_lo, &borrow); 225| 117k| const W q3 = word_sub(m, m_hi, &borrow); 226| | 227| 117k| return {q0, q1, q2, q3}; 228| 117k| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE9final_subEmRKNSt3__15arrayImLm4EEE: 233| 29.3k| constexpr static BOTAN_FORCE_INLINE std::array final_sub(W top, const std::array& t) { 234| 29.3k| W borrow = 0; 235| 29.3k| const W r0 = word_sub(t[0], P[0], &borrow); 236| 29.3k| const W r1 = word_sub(t[1], P[1], &borrow); 237| 29.3k| const W r2 = word_sub(t[2], P[2], &borrow); 238| 29.3k| const W r3 = word_sub(t[3], P[3], &borrow); 239| | 240| | // t is only < p if the subtraction underflowed and top (the 257th bit) is zero 241| 29.3k| const W t_lt_p = CT::value_barrier(static_cast(0) - (borrow & (top ^ 1))); 242| | 243| 29.3k| return { 244| 29.3k| Botan::choose(t_lt_p, t[0], r0), 245| 29.3k| Botan::choose(t_lt_p, t[1], r1), 246| 29.3k| Botan::choose(t_lt_p, t[2], r2), 247| 29.3k| Botan::choose(t_lt_p, t[3], r3), 248| 29.3k| }; 249| 29.3k| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE: 172| 1| constexpr static std::array from_rep(const std::array& z) { 173| 1| std::array ze = {}; 174| 1| copy_mem(std::span{ze}.template first(), z); 175| 1| return redc(ze); 176| 1| } pcurves_sm2p256v1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19sm2p256v122Sm2p256v1MontgomeryRepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE: 159| 1| constexpr static std::array to_rep(const std::array& x) { 160| 1| std::array z; // NOLINT(*-member-init) 161| 1| comba_mul(z.data(), x.data(), R2.data()); 162| 1| return redc(z); 163| 1| } _ZN5Botan8EC_Group13ec_group_dataEv: 240| 12|EC_Group_Data_Map& EC_Group::ec_group_data() { 241| | /* 242| | * This exists purely to ensure the allocator is constructed before g_ec_data, 243| | * which ensures that its destructor runs after ~g_ec_data is complete. 244| | */ 245| | 246| 12| static const Allocator_Initializer g_init_allocator; 247| 12| static EC_Group_Data_Map g_ec_data; 248| 12| return g_ec_data; 249| 12|} _ZN5Botan8EC_Group18load_EC_group_infoEPKcS2_S2_S2_S2_S2_RKNS_3OIDE: 263| 12| const OID& oid) { 264| 12| BOTAN_ARG_CHECK(oid.has_value(), "EC_Group::load_EC_group_info OID must be set"); ------------------ | | 35| 12| do { \ | | 36| 12| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 12| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 12] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 12| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 12] | | ------------------ ------------------ 265| | 266| 12| const BigInt p(p_str); 267| 12| const BigInt a(a_str); 268| 12| const BigInt b(b_str); 269| 12| const BigInt g_x(g_x_str); 270| 12| const BigInt g_y(g_y_str); 271| 12| const BigInt order(order_str); 272| 12| const BigInt cofactor(1); // implicit 273| | 274| 12| return EC_Group_Data::create(p, a, b, g_x, g_y, order, cofactor, oid, EC_Group_Source::Builtin); 275| 12|} _ZN5Botan8EC_GroupD2Ev: 442| 12|EC_Group::~EC_Group() = default; _ZN5Botan8EC_GroupC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEE: 449| 12|EC_Group::EC_Group(std::shared_ptr data) : m_data(std::move(data)) {} _ZN5Botan8EC_Group9from_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE: 529| 12|EC_Group EC_Group::from_name(std::string_view name) { 530| 12| std::shared_ptr data; 531| | 532| 12| if(auto oid = OID::from_name(name)) { ------------------ | Branch (532:12): [True: 12, False: 0] ------------------ 533| 12| data = ec_group_data().lookup(oid.value()); 534| 12| } 535| | 536| 12| if(!data) { ------------------ | Branch (536:7): [True: 0, False: 12] ------------------ 537| 0| throw Invalid_Argument(fmt("Unknown EC_Group '{}'", name)); 538| 0| } 539| | 540| 12| return EC_Group(std::move(data)); 541| 12|} _ZNK5Botan8EC_Group4dataEv: 714| 2.16k|const EC_Group_Data& EC_Group::data() const { 715| 2.16k| if(m_data == nullptr) { ------------------ | Branch (715:7): [True: 0, False: 2.16k] ------------------ 716| 0| throw Invalid_State("EC_Group uninitialized"); 717| 0| } 718| 2.16k| return *m_data; 719| 2.16k|} _ZNK5Botan8EC_Group15get_order_bytesEv: 733| 2.16k|size_t EC_Group::get_order_bytes() const { 734| 2.16k| return data().order_bytes(); 735| 2.16k|} _ZN5Botan17EC_Group_Data_Map6lookupERKNS_3OIDE: 54| 12| std::shared_ptr lookup(const OID& oid) { 55| 12| const lock_guard_type lock(m_mutex); 56| | 57| 66| for(auto i : m_registered_curves) { ------------------ | Branch (57:21): [True: 66, False: 12] ------------------ 58| 66| if(i->oid() == oid) { ------------------ | Branch (58:16): [True: 0, False: 66] ------------------ 59| 0| return i; 60| 0| } 61| 66| } 62| | 63| | // Not found, check hardcoded data 64| 12| std::shared_ptr data = EC_Group::EC_group_info(oid); 65| | 66| 12| if(data) { ------------------ | Branch (66:13): [True: 12, False: 0] ------------------ 67| | // The requested OID may be an alias for a curve whose canonical OID differs 68| | // TODO(Botan4) remove this once we require exactly one canonical OID per curve 69| 12| if(data->oid() != oid) { ------------------ | Branch (69:16): [True: 0, False: 12] ------------------ 70| 0| for(const auto& i : m_registered_curves) { ------------------ | Branch (70:34): [True: 0, False: 0] ------------------ 71| 0| if(i->oid() == data->oid()) { ------------------ | Branch (71:22): [True: 0, False: 0] ------------------ 72| 0| return i; 73| 0| } 74| 0| } 75| 0| } 76| | 77| 12| m_registered_curves.push_back(data); 78| 12| return data; 79| 12| } 80| | 81| | // Nope, unknown curve 82| 0| return std::shared_ptr(); 83| 12| } _ZN5Botan13EC_Group_DataD2Ev: 28| 12|EC_Group_Data::~EC_Group_Data() = default; _ZN5Botan13EC_Group_DataC2ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE: 40| 12| m_p(p), 41| 12| m_a(a), 42| 12| m_b(b), 43| 12| m_g_x(g_x), 44| 12| m_g_y(g_y), 45| 12| m_order(order), 46| 12| m_cofactor(cofactor), 47| |#if defined(BOTAN_HAS_LEGACY_EC_POINT) 48| 12| m_mod_field(Barrett_Reduction::for_public_modulus(p)), 49| 12| m_mod_order(Barrett_Reduction::for_public_modulus(order)), 50| 12| m_monty(m_p, m_mod_field), 51| |#endif 52| 12| m_oid(oid), 53| 12| m_p_words(p.sig_words()), 54| 12| m_p_bits(p.bits()), 55| 12| m_order_bits(order.bits()), 56| 12| m_order_bytes((m_order_bits + 7) / 8), 57| 12| m_a_is_minus_3(a == p - 3), 58| 12| m_a_is_zero(a.is_zero()), 59| 12| m_has_cofactor(m_cofactor != 1), 60| 12| m_order_is_less_than_p(m_order < p), 61| 12| m_source(source) { 62| | // Verify the generator (x, y) satisfies y^2 = x^3 + a*x + b (mod p) 63| 12| const auto mod_p = Barrett_Reduction::for_public_modulus(p); 64| 12| const BigInt y2 = mod_p.square(g_y); 65| 12| const BigInt x3_ax_b = mod_p.reduce(mod_p.cube(g_x) + mod_p.multiply(a, g_x) + b); 66| 12| if(y2 != x3_ax_b) { ------------------ | Branch (66:7): [True: 0, False: 12] ------------------ 67| 0| throw Invalid_Argument("EC_Group generator is not on the curve"); 68| 0| } 69| | 70| | // TODO(Botan4) we can assume/assert the OID is set 71| 12| if(!m_oid.empty()) { ------------------ | Branch (71:7): [True: 12, False: 0] ------------------ 72| 12| DER_Encoder der(m_der_named_curve); 73| 12| der.encode(m_oid); 74| | 75| 12| if(const auto name = m_oid.registered_name()) { ------------------ | Branch (75:21): [True: 12, False: 0] ------------------ 76| 12| if(auto pcurve = PCurve::PrimeOrderCurve::for_named_curve(*name)) { ------------------ | Branch (76:18): [True: 12, False: 0] ------------------ 77| 12| const bool same_params = [&]() { 78| 12| if(m_source == EC_Group_Source::Builtin) { 79| 12| return true; 80| 12| } 81| | 82| 12| if(const auto group_oid = OID::from_name(*name)) { 83| 12| if(const auto group_info = EC_Group::EC_group_info(*group_oid)) { 84| 12| return group_info->params_match(p, a, b, g_x, g_y, order, cofactor); 85| 12| } 86| 12| } 87| | 88| 12| return false; 89| 12| }(); 90| | 91| 12| if(same_params) { ------------------ | Branch (91:16): [True: 12, False: 0] ------------------ 92| 12| m_pcurve = std::move(pcurve); 93| 12| } 94| 12| } 95| 12| } 96| 12| if(m_pcurve) { ------------------ | Branch (96:10): [True: 12, False: 0] ------------------ 97| 12| m_engine = EC_Group_Engine::Optimized; 98| 12| } 99| 12| } 100| | 101| | // Try a generic pcurves instance 102| 12| if(!m_pcurve && !m_has_cofactor) { ------------------ | Branch (102:7): [True: 0, False: 12] | Branch (102:20): [True: 0, False: 0] ------------------ 103| 0| m_pcurve = PCurve::PrimeOrderCurve::from_params(p, a, b, g_x, g_y, order); 104| 0| if(m_pcurve) { ------------------ | Branch (104:10): [True: 0, False: 0] ------------------ 105| 0| m_engine = EC_Group_Engine::Generic; 106| 0| } 107| | // possibly still null here, if parameters unsuitable or if the 108| | // pcurves_generic module wasn't included in the build 109| 0| } 110| | 111| 12|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 112| 12| secure_vector ws; 113| 12| m_a_r = m_monty.mul(a, m_monty.R2(), ws); 114| 12| m_b_r = m_monty.mul(b, m_monty.R2(), ws); 115| 12| if(!m_pcurve) { ------------------ | Branch (115:7): [True: 0, False: 12] ------------------ 116| 0| m_engine = EC_Group_Engine::Legacy; 117| 0| } 118| |#else 119| | if(!m_pcurve) { 120| | if(m_oid.empty()) { 121| | throw Not_Implemented("EC_Group this group is not supported in this build configuration"); 122| | } else { 123| | throw Not_Implemented( 124| | fmt("EC_Group the group {} is not supported in this build configuration", oid.to_string())); 125| | } 126| | } 127| |#endif 128| 12|} _ZN5Botan13EC_Group_Data6createERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE: 138| 12| EC_Group_Source source) { 139| 12| auto group = std::make_shared(p, a, b, g_x, g_y, order, cofactor, oid, source); 140| | 141| 12|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 142| 12| group->m_curve = CurveGFp(group.get()); 143| 12| group->m_base_point = EC_Point(group->m_curve, g_x, g_y); 144| 12| if(!group->m_pcurve) { ------------------ | Branch (144:7): [True: 0, False: 12] ------------------ 145| 0| group->m_base_mult = std::make_unique(group->m_base_point, group->m_mod_order); 146| 0| } 147| 12|#endif 148| | 149| 12| return group; 150| 12|} _ZNK5Botan13EC_Group_Data27scalar_from_bytes_mod_orderENSt3__14spanIKhLm18446744073709551615EEE: 290| 4.23k|std::unique_ptr EC_Group_Data::scalar_from_bytes_mod_order(std::span bytes) const { 291| 4.23k| if(bytes.size() > 2 * order_bytes()) { ------------------ | Branch (291:7): [True: 0, False: 4.23k] ------------------ 292| 0| return {}; 293| 0| } 294| | 295| 4.23k| if(m_pcurve) { ------------------ | Branch (295:7): [True: 4.23k, False: 0] ------------------ 296| 4.23k| if(auto s = m_pcurve->scalar_from_wide_bytes(bytes)) { ------------------ | Branch (296:15): [True: 4.23k, False: 0] ------------------ 297| 4.23k| return std::make_unique(shared_from_this(), std::move(*s)); 298| 4.23k| } else { 299| 0| return {}; 300| 0| } 301| 4.23k| } else { 302| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 303| 0| return std::make_unique(shared_from_this(), m_mod_order.reduce(BigInt(bytes))); 304| |#else 305| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 306| |#endif 307| 0| } 308| 4.23k|} _ZNK5Botan13EC_Group_Data10scalar_oneEv: 323| 2.11k|std::unique_ptr EC_Group_Data::scalar_one() const { 324| 2.11k| if(m_pcurve) { ------------------ | Branch (324:7): [True: 2.11k, False: 0] ------------------ 325| 2.11k| return std::make_unique(shared_from_this(), m_pcurve->scalar_one()); 326| 2.11k| } else { 327| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 328| 0| return std::make_unique(shared_from_this(), BigInt::one()); 329| |#else 330| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 331| |#endif 332| 0| } 333| 2.11k|} _ZNK5Botan13EC_Group_Data18scalar_deserializeENSt3__14spanIKhLm18446744073709551615EEE: 375| 4.10k|std::unique_ptr EC_Group_Data::scalar_deserialize(std::span bytes) const { 376| 4.10k| if(bytes.size() != m_order_bytes) { ------------------ | Branch (376:7): [True: 0, False: 4.10k] ------------------ 377| 0| return nullptr; 378| 0| } 379| | 380| 4.10k| if(m_pcurve) { ------------------ | Branch (380:7): [True: 4.10k, False: 0] ------------------ 381| 4.10k| if(auto s = m_pcurve->deserialize_scalar(bytes)) { ------------------ | Branch (381:15): [True: 4.10k, False: 0] ------------------ 382| 4.10k| return std::make_unique(shared_from_this(), *s); 383| 4.10k| } else { 384| 0| return nullptr; 385| 0| } 386| 4.10k| } else { 387| 0|#if defined(BOTAN_HAS_LEGACY_EC_POINT) 388| 0| BigInt r(bytes); 389| | 390| 0| if(r.is_zero() || r >= m_order) { ------------------ | Branch (390:10): [True: 0, False: 0] | Branch (390:25): [True: 0, False: 0] ------------------ 391| 0| return nullptr; 392| 0| } 393| | 394| 0| return std::make_unique(shared_from_this(), std::move(r)); 395| |#else 396| | throw Not_Implemented("Legacy EC interfaces disabled in this build configuration"); 397| |#endif 398| 0| } 399| 4.10k|} ec_inner_data.cpp:_ZZN5Botan13EC_Group_DataC1ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceEENK3$_0clEv: 77| 12| const bool same_params = [&]() { 78| 12| if(m_source == EC_Group_Source::Builtin) { ------------------ | Branch (78:19): [True: 12, False: 0] ------------------ 79| 12| return true; 80| 12| } 81| | 82| 0| if(const auto group_oid = OID::from_name(*name)) { ------------------ | Branch (82:30): [True: 0, False: 0] ------------------ 83| 0| if(const auto group_info = EC_Group::EC_group_info(*group_oid)) { ------------------ | Branch (83:33): [True: 0, False: 0] ------------------ 84| 0| return group_info->params_match(p, a, b, g_x, g_y, order, cofactor); 85| 0| } 86| 0| } 87| | 88| 0| return false; 89| 0| }(); _ZN5Botan17EC_Scalar_Data_PC11checked_refERKNS_14EC_Scalar_DataE: 14| 56.6k|const EC_Scalar_Data_PC& EC_Scalar_Data_PC::checked_ref(const EC_Scalar_Data& data) { 15| 56.6k| const auto* p = dynamic_cast(&data); 16| 56.6k| if(p == nullptr) { ------------------ | Branch (16:7): [True: 0, False: 56.6k] ------------------ 17| 0| throw Invalid_State("Failed conversion to EC_Scalar_Data_PC"); 18| 0| } 19| 56.6k| return *p; 20| 56.6k|} _ZNK5Botan17EC_Scalar_Data_PC5groupEv: 22| 184k|const std::shared_ptr& EC_Scalar_Data_PC::group() const { 23| 184k| return m_group; 24| 184k|} _ZNK5Botan17EC_Scalar_Data_PC5cloneEv: 30| 2.11k|std::unique_ptr EC_Scalar_Data_PC::clone() const { 31| 2.11k| return std::make_unique(this->group(), this->value()); 32| 2.11k|} _ZNK5Botan17EC_Scalar_Data_PC7is_zeroEv: 34| 12.7k|bool EC_Scalar_Data_PC::is_zero() const { 35| 12.7k| const auto& pcurve = this->group()->pcurve(); 36| 12.7k| return pcurve.scalar_is_zero(m_v); 37| 12.7k|} _ZNK5Botan17EC_Scalar_Data_PC5is_eqERKNS_14EC_Scalar_DataE: 39| 24.9k|bool EC_Scalar_Data_PC::is_eq(const EC_Scalar_Data& other) const { 40| 24.9k| const auto& pcurve = group()->pcurve(); 41| 24.9k| return pcurve.scalar_equal(m_v, checked_ref(other).m_v); 42| 24.9k|} _ZN5Botan17EC_Scalar_Data_PC11square_selfEv: 53| 2.11k|void EC_Scalar_Data_PC::square_self() { 54| | // TODO square in place 55| 2.11k| m_v = m_group->pcurve().scalar_square(m_v); 56| 2.11k|} _ZNK5Botan17EC_Scalar_Data_PC6negateEv: 58| 2.11k|std::unique_ptr EC_Scalar_Data_PC::negate() const { 59| 2.11k| return std::make_unique(m_group, m_group->pcurve().scalar_negate(m_v)); 60| 2.11k|} _ZNK5Botan17EC_Scalar_Data_PC6invertEv: 62| 6.15k|std::unique_ptr EC_Scalar_Data_PC::invert() const { 63| 6.15k| return std::make_unique(m_group, m_group->pcurve().scalar_invert(m_v)); 64| 6.15k|} _ZNK5Botan17EC_Scalar_Data_PC14invert_vartimeEv: 66| 4.10k|std::unique_ptr EC_Scalar_Data_PC::invert_vartime() const { 67| 4.10k| return std::make_unique(m_group, m_group->pcurve().scalar_invert_vartime(m_v)); 68| 4.10k|} _ZNK5Botan17EC_Scalar_Data_PC3addERKNS_14EC_Scalar_DataE: 70| 10.5k|std::unique_ptr EC_Scalar_Data_PC::add(const EC_Scalar_Data& other) const { 71| 10.5k| return std::make_unique(m_group, group()->pcurve().scalar_add(m_v, checked_ref(other).m_v)); 72| 10.5k|} _ZNK5Botan17EC_Scalar_Data_PC3subERKNS_14EC_Scalar_DataE: 74| 2.11k|std::unique_ptr EC_Scalar_Data_PC::sub(const EC_Scalar_Data& other) const { 75| 2.11k| return std::make_unique(m_group, group()->pcurve().scalar_sub(m_v, checked_ref(other).m_v)); 76| 2.11k|} _ZNK5Botan17EC_Scalar_Data_PC3mulERKNS_14EC_Scalar_DataE: 78| 18.9k|std::unique_ptr EC_Scalar_Data_PC::mul(const EC_Scalar_Data& other) const { 79| 18.9k| return std::make_unique(m_group, group()->pcurve().scalar_mul(m_v, checked_ref(other).m_v)); 80| 18.9k|} _ZNK5Botan17EC_Scalar_Data_PC12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 82| 4.10k|void EC_Scalar_Data_PC::serialize_to(std::span bytes) const { 83| 4.10k| BOTAN_ARG_CHECK(bytes.size() == m_group->order_bytes(), "Invalid output length"); ------------------ | | 35| 4.10k| do { \ | | 36| 4.10k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 4.10k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 4.10k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 4.10k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 4.10k] | | ------------------ ------------------ 84| 4.10k| m_group->pcurve().serialize_scalar(bytes, m_v); 85| 4.10k|} _ZN5Botan8EC_Group13EC_group_infoERKNS_3OIDE: 16| 12|std::shared_ptr EC_Group::EC_group_info(const OID& oid) { 17| | // secp256r1 18| 12| if(oid == OID{1, 2, 840, 10045, 3, 1, 7}) { ------------------ | Branch (18:7): [True: 1, False: 11] ------------------ 19| 1| return load_EC_group_info( 20| 1| "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", 21| 1| "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", 22| 1| "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", 23| 1| "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296", 24| 1| "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", 25| 1| "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551", 26| 1| oid); 27| 1| } 28| | 29| | // secp384r1 30| 11| if(oid == OID{1, 3, 132, 0, 34}) { ------------------ | Branch (30:7): [True: 1, False: 10] ------------------ 31| 1| return load_EC_group_info( 32| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF", 33| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC", 34| 1| "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF", 35| 1| "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7", 36| 1| "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F", 37| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973", 38| 1| oid); 39| 1| } 40| | 41| | // secp521r1 42| 10| if(oid == OID{1, 3, 132, 0, 35}) { ------------------ | Branch (42:7): [True: 1, False: 9] ------------------ 43| 1| return load_EC_group_info( 44| 1| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", 45| 1| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC", 46| 1| "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00", 47| 1| "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66", 48| 1| "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650", 49| 1| "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409", 50| 1| oid); 51| 1| } 52| | 53| | // brainpool160r1 54| 9| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1}) { ------------------ | Branch (54:7): [True: 0, False: 9] ------------------ 55| 0| return load_EC_group_info( 56| 0| "0xE95E4A5F737059DC60DFC7AD95B3D8139515620F", 57| 0| "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300", 58| 0| "0x1E589A8595423412134FAA2DBDEC95C8D8675E58", 59| 0| "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3", 60| 0| "0x1667CB477A1A8EC338F94741669C976316DA6321", 61| 0| "0xE95E4A5F737059DC60DF5991D45029409E60FC09", 62| 0| oid); 63| 0| } 64| | 65| | // brainpool192r1 66| 9| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3}) { ------------------ | Branch (66:7): [True: 0, False: 9] ------------------ 67| 0| return load_EC_group_info( 68| 0| "0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297", 69| 0| "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF", 70| 0| "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9", 71| 0| "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6", 72| 0| "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F", 73| 0| "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1", 74| 0| oid); 75| 0| } 76| | 77| | // brainpool224r1 78| 9| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5}) { ------------------ | Branch (78:7): [True: 0, False: 9] ------------------ 79| 0| return load_EC_group_info( 80| 0| "0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF", 81| 0| "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43", 82| 0| "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B", 83| 0| "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D", 84| 0| "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD", 85| 0| "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F", 86| 0| oid); 87| 0| } 88| | 89| | // brainpool256r1 90| 9| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7}) { ------------------ | Branch (90:7): [True: 1, False: 8] ------------------ 91| 1| return load_EC_group_info( 92| 1| "0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", 93| 1| "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", 94| 1| "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", 95| 1| "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262", 96| 1| "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", 97| 1| "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7", 98| 1| oid); 99| 1| } 100| | 101| | // brainpool320r1 102| 8| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9}) { ------------------ | Branch (102:7): [True: 0, False: 8] ------------------ 103| 0| return load_EC_group_info( 104| 0| "0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27", 105| 0| "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4", 106| 0| "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6", 107| 0| "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611", 108| 0| "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1", 109| 0| "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311", 110| 0| oid); 111| 0| } 112| | 113| | // brainpool384r1 114| 8| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11}) { ------------------ | Branch (114:7): [True: 1, False: 7] ------------------ 115| 1| return load_EC_group_info( 116| 1| "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53", 117| 1| "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826", 118| 1| "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11", 119| 1| "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E", 120| 1| "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315", 121| 1| "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565", 122| 1| oid); 123| 1| } 124| | 125| | // brainpool512r1 126| 7| if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13}) { ------------------ | Branch (126:7): [True: 1, False: 6] ------------------ 127| 1| return load_EC_group_info( 128| 1| "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3", 129| 1| "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA", 130| 1| "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723", 131| 1| "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822", 132| 1| "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892", 133| 1| "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069", 134| 1| oid); 135| 1| } 136| | 137| | // frp256v1 138| 6| if(oid == OID{1, 2, 250, 1, 223, 101, 256, 1}) { ------------------ | Branch (138:7): [True: 1, False: 5] ------------------ 139| 1| return load_EC_group_info( 140| 1| "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03", 141| 1| "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00", 142| 1| "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F", 143| 1| "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF", 144| 1| "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB", 145| 1| "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1", 146| 1| oid); 147| 1| } 148| | 149| | // gost_256A 150| 5| if(oid == OID{1, 2, 643, 7, 1, 2, 1, 1, 1} || oid == OID{1, 2, 643, 2, 2, 35, 1} || oid == OID{1, 2, 643, 2, 2, 36, 0}) { ------------------ | Branch (150:7): [True: 0, False: 5] | Branch (150:7): [True: 0, False: 5] | Branch (150:50): [True: 0, False: 5] | Branch (150:88): [True: 0, False: 5] ------------------ 151| 0| return load_EC_group_info( 152| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97", 153| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94", 154| 0| "0xA6", 155| 0| "0x1", 156| 0| "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14", 157| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893", 158| 0| OID{1, 2, 643, 7, 1, 2, 1, 1, 1}); 159| 0| } 160| | 161| | // gost_512A 162| 5| if(oid == OID{1, 2, 643, 7, 1, 2, 1, 2, 1}) { ------------------ | Branch (162:7): [True: 0, False: 5] ------------------ 163| 0| return load_EC_group_info( 164| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7", 165| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4", 166| 0| "0xE8C2505DEDFC86DDC1BD0B2B6667F1DA34B82574761CB0E879BD081CFD0B6265EE3CB090F30D27614CB4574010DA90DD862EF9D4EBEE4761503190785A71C760", 167| 0| "0x3", 168| 0| "0x7503CFE87A836AE3A61B8816E25450E6CE5E1C93ACF1ABC1778064FDCBEFA921DF1626BE4FD036E93D75E6A50E3A41E98028FE5FC235F5B889A589CB5215F2A4", 169| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275", 170| 0| oid); 171| 0| } 172| | 173| | // secp160k1 174| 5| if(oid == OID{1, 3, 132, 0, 9}) { ------------------ | Branch (174:7): [True: 0, False: 5] ------------------ 175| 0| return load_EC_group_info( 176| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", 177| 0| "0x0", 178| 0| "0x7", 179| 0| "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB", 180| 0| "0x938CF935318FDCED6BC28286531733C3F03C4FEE", 181| 0| "0x100000000000000000001B8FA16DFAB9ACA16B6B3", 182| 0| oid); 183| 0| } 184| | 185| | // secp160r1 186| 5| if(oid == OID{1, 3, 132, 0, 8}) { ------------------ | Branch (186:7): [True: 0, False: 5] ------------------ 187| 0| return load_EC_group_info( 188| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF", 189| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC", 190| 0| "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45", 191| 0| "0x4A96B5688EF573284664698968C38BB913CBFC82", 192| 0| "0x23A628553168947D59DCC912042351377AC5FB32", 193| 0| "0x100000000000000000001F4C8F927AED3CA752257", 194| 0| oid); 195| 0| } 196| | 197| | // secp160r2 198| 5| if(oid == OID{1, 3, 132, 0, 30}) { ------------------ | Branch (198:7): [True: 0, False: 5] ------------------ 199| 0| return load_EC_group_info( 200| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", 201| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70", 202| 0| "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA", 203| 0| "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D", 204| 0| "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E", 205| 0| "0x100000000000000000000351EE786A818F3A1A16B", 206| 0| oid); 207| 0| } 208| | 209| | // secp192k1 210| 5| if(oid == OID{1, 3, 132, 0, 31}) { ------------------ | Branch (210:7): [True: 0, False: 5] ------------------ 211| 0| return load_EC_group_info( 212| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37", 213| 0| "0x0", 214| 0| "0x3", 215| 0| "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D", 216| 0| "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D", 217| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D", 218| 0| oid); 219| 0| } 220| | 221| | // secp192r1 222| 5| if(oid == OID{1, 2, 840, 10045, 3, 1, 1}) { ------------------ | Branch (222:7): [True: 1, False: 4] ------------------ 223| 1| return load_EC_group_info( 224| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 225| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 226| 1| "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1", 227| 1| "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012", 228| 1| "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811", 229| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831", 230| 1| oid); 231| 1| } 232| | 233| | // secp224k1 234| 4| if(oid == OID{1, 3, 132, 0, 32}) { ------------------ | Branch (234:7): [True: 0, False: 4] ------------------ 235| 0| return load_EC_group_info( 236| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D", 237| 0| "0x0", 238| 0| "0x5", 239| 0| "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C", 240| 0| "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5", 241| 0| "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7", 242| 0| oid); 243| 0| } 244| | 245| | // secp224r1 246| 4| if(oid == OID{1, 3, 132, 0, 33}) { ------------------ | Branch (246:7): [True: 1, False: 3] ------------------ 247| 1| return load_EC_group_info( 248| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001", 249| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE", 250| 1| "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4", 251| 1| "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21", 252| 1| "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34", 253| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D", 254| 1| oid); 255| 1| } 256| | 257| | // secp256k1 258| 3| if(oid == OID{1, 3, 132, 0, 10}) { ------------------ | Branch (258:7): [True: 1, False: 2] ------------------ 259| 1| return load_EC_group_info( 260| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", 261| 1| "0x0", 262| 1| "0x7", 263| 1| "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 264| 1| "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", 265| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 266| 1| oid); 267| 1| } 268| | 269| | // sm2p256v1 270| 2| if(oid == OID{1, 2, 156, 10197, 1, 301}) { ------------------ | Branch (270:7): [True: 1, False: 1] ------------------ 271| 1| return load_EC_group_info( 272| 1| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF", 273| 1| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC", 274| 1| "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93", 275| 1| "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7", 276| 1| "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0", 277| 1| "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123", 278| 1| oid); 279| 1| } 280| | 281| | // x962_p192v2 282| 1| if(oid == OID{1, 2, 840, 10045, 3, 1, 2}) { ------------------ | Branch (282:7): [True: 0, False: 1] ------------------ 283| 0| return load_EC_group_info( 284| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 285| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 286| 0| "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953", 287| 0| "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A", 288| 0| "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15", 289| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31", 290| 0| oid); 291| 0| } 292| | 293| | // x962_p192v3 294| 1| if(oid == OID{1, 2, 840, 10045, 3, 1, 3}) { ------------------ | Branch (294:7): [True: 0, False: 1] ------------------ 295| 0| return load_EC_group_info( 296| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", 297| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", 298| 0| "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916", 299| 0| "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896", 300| 0| "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0", 301| 0| "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13", 302| 0| oid); 303| 0| } 304| | 305| | // x962_p239v1 306| 1| if(oid == OID{1, 2, 840, 10045, 3, 1, 4}) { ------------------ | Branch (306:7): [True: 0, False: 1] ------------------ 307| 0| return load_EC_group_info( 308| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 309| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 310| 0| "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A", 311| 0| "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF", 312| 0| "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE", 313| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B", 314| 0| oid); 315| 0| } 316| | 317| | // x962_p239v2 318| 1| if(oid == OID{1, 2, 840, 10045, 3, 1, 5}) { ------------------ | Branch (318:7): [True: 0, False: 1] ------------------ 319| 0| return load_EC_group_info( 320| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 321| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 322| 0| "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C", 323| 0| "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7", 324| 0| "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA", 325| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063", 326| 0| oid); 327| 0| } 328| | 329| | // x962_p239v3 330| 1| if(oid == OID{1, 2, 840, 10045, 3, 1, 6}) { ------------------ | Branch (330:7): [True: 0, False: 1] ------------------ 331| 0| return load_EC_group_info( 332| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", 333| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", 334| 0| "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E", 335| 0| "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A", 336| 0| "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3", 337| 0| "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551", 338| 0| oid); 339| 0| } 340| | 341| | // numsp512d1 342| 1| if(oid == OID{1, 3, 6, 1, 4, 1, 25258, 4, 3}) { ------------------ | Branch (342:7): [True: 1, False: 0] ------------------ 343| 1| return load_EC_group_info( 344| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7", 345| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4", 346| 1| "0x1D99B", 347| 1| "0x2", 348| 1| "0x1C282EB23327F9711952C250EA61AD53FCC13031CF6DD336E0B9328433AFBDD8CC5A1C1F0C716FDC724DDE537C2B0ADB00BB3D08DC83755B205CC30D7F83CF28", 349| 1| "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5B3CA4FB94E7831B4FC258ED97D0BDC63B568B36607CD243CE153F390433555D", 350| 1| oid); 351| 1| } 352| | 353| 0| return std::shared_ptr(); 354| 1|} _ZN5Botan9EC_ScalarC2ENSt3__110unique_ptrINS_14EC_Scalar_DataENS1_14default_deleteIS3_EEEE: 19| 54.4k|EC_Scalar::EC_Scalar(std::unique_ptr scalar) : m_scalar(std::move(scalar)) { 20| 54.4k| BOTAN_ASSERT_NONNULL(m_scalar); ------------------ | | 123| 54.4k| do { \ | | 124| 54.4k| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 54.4k] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 54.4k| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 54.4k] | | ------------------ ------------------ 21| 54.4k|} _ZN5Botan9EC_ScalarC2ERKS0_: 23| 2.11k|EC_Scalar::EC_Scalar(const EC_Scalar& other) : m_scalar(other.inner().clone()) {} _ZN5Botan9EC_ScalarC2EOS0_: 25| 4.10k|EC_Scalar::EC_Scalar(EC_Scalar&& other) noexcept : m_scalar(std::move(other.m_scalar)) {} _ZN5Botan9EC_ScalarD2Ev: 46| 60.7k|EC_Scalar::~EC_Scalar() = default; _ZN5Botan9EC_Scalar20from_bytes_mod_orderERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 60| 4.23k|EC_Scalar EC_Scalar::from_bytes_mod_order(const EC_Group& group, std::span bytes) { 61| 4.23k| if(auto s = group._data()->scalar_from_bytes_mod_order(bytes)) { ------------------ | Branch (61:12): [True: 4.23k, False: 0] ------------------ 62| 4.23k| return EC_Scalar(std::move(s)); 63| 4.23k| } else { 64| 0| throw Decoding_Error("EC_Scalar::from_bytes_mod_order input invalid"); 65| 0| } 66| 4.23k|} _ZN5Botan9EC_Scalar3oneERKNS_8EC_GroupE: 72| 2.11k|EC_Scalar EC_Scalar::one(const EC_Group& group) { 73| 2.11k| return EC_Scalar(group._data()->scalar_one()); 74| 2.11k|} _ZNK5Botan9EC_Scalar12serialize_toENSt3__14spanIhLm18446744073709551615EEE: 96| 4.10k|void EC_Scalar::serialize_to(std::span bytes) const { 97| 4.10k| inner().serialize_to(bytes); 98| 4.10k|} _ZN5Botan9EC_Scalar11deserializeERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE: 126| 4.10k|std::optional EC_Scalar::deserialize(const EC_Group& group, std::span bytes) { 127| 4.10k| if(auto v = group._data()->scalar_deserialize(bytes)) { ------------------ | Branch (127:12): [True: 4.10k, False: 0] ------------------ 128| 4.10k| return EC_Scalar(std::move(v)); 129| 4.10k| } else { 130| 0| return {}; 131| 0| } 132| 4.10k|} _ZNK5Botan9EC_Scalar7is_zeroEv: 141| 12.7k|bool EC_Scalar::is_zero() const { 142| 12.7k| return inner().is_zero(); 143| 12.7k|} _ZNK5Botan9EC_Scalar6invertEv: 145| 6.15k|EC_Scalar EC_Scalar::invert() const { 146| 6.15k| return EC_Scalar(inner().invert()); 147| 6.15k|} _ZNK5Botan9EC_Scalar14invert_vartimeEv: 149| 4.10k|EC_Scalar EC_Scalar::invert_vartime() const { 150| 4.10k| return EC_Scalar(inner().invert_vartime()); 151| 4.10k|} _ZNK5Botan9EC_Scalar6negateEv: 153| 2.11k|EC_Scalar EC_Scalar::negate() const { 154| 2.11k| return EC_Scalar(inner().negate()); 155| 2.11k|} _ZN5Botan9EC_Scalar11square_selfEv: 157| 2.11k|void EC_Scalar::square_self() { 158| 2.11k| m_scalar->square_self(); 159| 2.11k|} _ZNK5Botan9EC_Scalar3addERKS0_: 161| 10.5k|EC_Scalar EC_Scalar::add(const EC_Scalar& x) const { 162| 10.5k| BOTAN_ARG_CHECK(inner().group() == x.inner().group(), "Curve mismatch"); ------------------ | | 35| 10.5k| do { \ | | 36| 10.5k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 10.5k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 10.5k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 10.5k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 10.5k] | | ------------------ ------------------ 163| 10.5k| return EC_Scalar(inner().add(x.inner())); 164| 10.5k|} _ZNK5Botan9EC_Scalar3subERKS0_: 166| 2.11k|EC_Scalar EC_Scalar::sub(const EC_Scalar& x) const { 167| 2.11k| BOTAN_ARG_CHECK(inner().group() == x.inner().group(), "Curve mismatch"); ------------------ | | 35| 2.11k| do { \ | | 36| 2.11k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 2.11k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 2.11k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 2.11k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 2.11k] | | ------------------ ------------------ 168| 2.11k| return EC_Scalar(inner().sub(x.inner())); 169| 2.11k|} _ZNK5Botan9EC_Scalar3mulERKS0_: 171| 18.9k|EC_Scalar EC_Scalar::mul(const EC_Scalar& x) const { 172| 18.9k| BOTAN_ARG_CHECK(inner().group() == x.inner().group(), "Curve mismatch"); ------------------ | | 35| 18.9k| do { \ | | 36| 18.9k| /* NOLINTNEXTLINE(*-simplify-boolean-expr) */ \ | | 37| 18.9k| if(!(expr)) { \ | | ------------------ | | | Branch (37:10): [True: 0, False: 18.9k] | | ------------------ | | 38| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 39| 0| Botan::throw_invalid_argument(msg, __func__, __FILE__); \ | | 40| 0| } \ | | 41| 18.9k| } while(0) | | ------------------ | | | Branch (41:12): [Folded, False: 18.9k] | | ------------------ ------------------ 173| 18.9k| return EC_Scalar(inner().mul(x.inner())); 174| 18.9k|} _ZNK5Botan9EC_Scalar5is_eqERKS0_: 190| 24.9k|bool EC_Scalar::is_eq(const EC_Scalar& x) const { 191| 24.9k| if(inner().group() != x.inner().group()) { ------------------ | Branch (191:7): [True: 0, False: 24.9k] ------------------ 192| 0| return false; 193| 0| } 194| | 195| 24.9k| return inner().is_eq(x.inner()); 196| 24.9k|} _ZN5Botan8CurveGFpC2EPKNS_13EC_Group_DataE: 28| 12|CurveGFp::CurveGFp(const EC_Group_Data* group) : m_group(group) { 29| 12| BOTAN_ASSERT_NONNULL(m_group); ------------------ | | 123| 12| do { \ | | 124| 12| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 12] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 12| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 12] | | ------------------ ------------------ 30| 12|} _ZNK5Botan8CurveGFp5groupEv: 32| 24|const EC_Group_Data& CurveGFp::group() const { 33| 24| BOTAN_ASSERT_NONNULL(m_group); ------------------ | | 123| 24| do { \ | | 124| 24| if((ptr) == nullptr) { \ | | ------------------ | | | Branch (124:10): [True: 0, False: 24] | | ------------------ | | 125| 0| /* NOLINTNEXTLINE(bugprone-lambda-function-name) */ \ | | 126| 0| Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \ | | 127| 0| } \ | | 128| 24| } while(0) | | ------------------ | | | Branch (128:12): [Folded, False: 24] | | ------------------ ------------------ 34| 24| return *m_group; 35| 24|} _ZN5Botan8EC_PointC2ERKNS_8CurveGFpENS_6BigIntES4_: 115| 12| m_curve(curve), m_x(std::move(x)), m_y(std::move(y)), m_z(m_curve.group().monty().R1()) { 116| 12| const auto& group = m_curve.group(); 117| | 118| 12| if(m_x < 0 || m_x >= group.p()) { ------------------ | Branch (118:7): [True: 0, False: 12] | Branch (118:18): [True: 0, False: 12] ------------------ 119| 0| throw Invalid_Argument("Invalid EC_Point affine x"); 120| 0| } 121| 12| if(m_y < 0 || m_y >= group.p()) { ------------------ | Branch (121:7): [True: 0, False: 12] | Branch (121:18): [True: 0, False: 12] ------------------ 122| 0| throw Invalid_Argument("Invalid EC_Point affine y"); 123| 0| } 124| | 125| 12| secure_vector monty_ws(monty_ws_size(group)); 126| | 127| 12| to_rep(group, m_x, monty_ws); 128| 12| to_rep(group, m_y, monty_ws); 129| 12|} _ZN5Botan8EC_Point4swapERS0_: 792| 12|void EC_Point::swap(EC_Point& other) noexcept { 793| 12| m_curve.swap(other.m_curve); 794| 12| m_x.swap(other.m_x); 795| 12| m_y.swap(other.m_y); 796| 12| m_z.swap(other.m_z); 797| 12|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_113monty_ws_sizeERKNS_13EC_Group_DataE: 102| 12|size_t monty_ws_size(const EC_Group_Data& group) { 103| 12| return 2 * group.p_words(); 104| 12|} ec_point.cpp:_ZN5Botan12_GLOBAL__N_16to_repERKNS_13EC_Group_DataERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE: 55| 24|void to_rep(const EC_Group_Data& group, BigInt& x, secure_vector& ws) { 56| 24| group.monty().mul_by(x, group.monty().R2(), ws); 57| 24|} _ZN5Botan15allocate_memoryEmm: 21| 1.03k|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) { 22| 1.03k| if(elems == 0 || elem_size == 0) { ------------------ | Branch (22:7): [True: 0, False: 1.03k] | Branch (22:21): [True: 0, False: 1.03k] ------------------ 23| 0| return nullptr; 24| 0| } 25| | 26| | // Some calloc implementations do not check for overflow (?!?) 27| 1.03k| if(!checked_mul(elems, elem_size).has_value()) { ------------------ | Branch (27:7): [True: 0, False: 1.03k] ------------------ 28| 0| throw std::bad_alloc(); 29| 0| } 30| | 31| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 32| | // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy 33| | if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) { 34| | return p; 35| | } 36| |#endif 37| | 38| |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL) 39| | void* ptr = ::calloc_conceal(elems, elem_size); 40| |#else 41| | // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy 42| 1.03k| void* ptr = std::calloc(elems, elem_size); // NOLINT(*-no-malloc,*-owning-memory) 43| 1.03k|#endif 44| 1.03k| if(ptr == nullptr) { ------------------ | Branch (44:7): [True: 0, False: 1.03k] ------------------ 45| 0| [[unlikely]] throw std::bad_alloc(); 46| 0| } 47| 1.03k| return ptr; 48| 1.03k|} _ZN5Botan17deallocate_memoryEPvmm: 50| 1.03k|void deallocate_memory(void* p, size_t elems, size_t elem_size) { 51| 1.03k| if(p == nullptr) { ------------------ | Branch (51:7): [True: 0, False: 1.03k] ------------------ 52| 0| [[unlikely]] return; 53| 0| } 54| | 55| 1.03k| secure_scrub_memory(p, elems * elem_size); 56| | 57| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 58| | if(mlock_allocator::instance().deallocate(p, elems, elem_size)) { 59| | return; 60| | } 61| |#endif 62| | 63| 1.03k| std::free(p); // NOLINT(*-no-malloc,*-owning-memory) 64| 1.03k|} _ZN5Botan20initialize_allocatorEv: 66| 1|void initialize_allocator() { 67| |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR) 68| | mlock_allocator::instance(); 69| |#endif 70| 1|} _ZN5Botan5CPUID10CPUID_DataC2Ev: 80| 1|CPUID::CPUID_Data::CPUID_Data() { 81| | // NOLINTBEGIN(*-prefer-member-initializer) 82| 1|#if defined(BOTAN_HAS_CPUID_DETECTION) 83| 1| m_processor_features = detect_cpu_features(~cleared_cpuid_bits()); 84| |#else 85| | m_processor_features = 0; 86| |#endif 87| | // NOLINTEND(*-prefer-member-initializer) 88| 1|} cpuid.cpp:_ZN5Botan12_GLOBAL__N_118cleared_cpuid_bitsEv: 59| 1|uint32_t cleared_cpuid_bits() { 60| 1| uint32_t cleared = 0; 61| | 62| 1| #if defined(BOTAN_HAS_OS_UTILS) 63| 1| std::string clear_cpuid_env; 64| 1| if(OS::read_env_variable(clear_cpuid_env, "BOTAN_CLEAR_CPUID")) { ------------------ | Branch (64:7): [True: 0, False: 1] ------------------ 65| 0| for(const auto& cpuid : split_on(clear_cpuid_env, ',')) { ------------------ | Branch (65:29): [True: 0, False: 0] ------------------ 66| 0| if(auto bit = CPUID::bit_from_string(cpuid)) { ------------------ | Branch (66:18): [True: 0, False: 0] ------------------ 67| 0| cleared |= bit->as_u32(); 68| 0| } 69| 0| } 70| 0| } 71| 1| #endif 72| | 73| 1| return cleared; 74| 1|} _ZN5Botan5CPUID10CPUID_Data19detect_cpu_featuresEj: 62| 1|uint32_t CPUID::CPUID_Data::detect_cpu_features(uint32_t allowed) { 63| 1| enum class x86_CPUID_1_bits : uint64_t { 64| 1| RDTSC = (1ULL << 4), 65| 1| SSE2 = (1ULL << 26), 66| 1| CLMUL = (1ULL << 33), 67| 1| SSSE3 = (1ULL << 41), 68| 1| SSE41 = (1ULL << 51), 69| 1| POPCNT = (1ULL << 55), 70| 1| AESNI = (1ULL << 57), 71| | // AVX + OSXSAVE 72| 1| OSXSAVE = (1ULL << 59) | (1ULL << 60), 73| 1| RDRAND = (1ULL << 62) 74| 1| }; 75| | 76| 1| enum class x86_CPUID_7_bits : uint64_t { 77| 1| BMI1 = (1ULL << 3), 78| 1| AVX2 = (1ULL << 5), 79| 1| BMI2 = (1ULL << 8), 80| 1| BMI_1_AND_2 = BMI1 | BMI2, 81| 1| AVX512_F = (1ULL << 16), 82| 1| AVX512_DQ = (1ULL << 17), 83| 1| RDSEED = (1ULL << 18), 84| 1| ADX = (1ULL << 19), 85| 1| AVX512_IFMA = (1ULL << 21), 86| 1| SHA = (1ULL << 29), 87| 1| AVX512_BW = (1ULL << 30), 88| 1| AVX512_VL = (1ULL << 31), 89| 1| AVX512_VBMI = (1ULL << 33), 90| 1| AVX512_VBMI2 = (1ULL << 38), 91| 1| GFNI = (1ULL << 40), 92| 1| AVX512_VAES = (1ULL << 41), 93| 1| AVX512_VCLMUL = (1ULL << 42), 94| 1| AVX512_VBITALG = (1ULL << 44), 95| | 96| | /* 97| | We only enable AVX512 support if all of the below flags are available 98| | 99| | This is more than we strictly need for most uses, however it also has 100| | the effect of preventing execution of AVX512 codepaths on cores that 101| | have serious downclocking problems when AVX512 code executes, 102| | especially Intel Skylake. 103| | 104| | VBMI2/VBITALG are the key flags here as they restrict us to Intel Ice 105| | Lake/Rocket Lake, or AMD Zen4, all of which do not have penalties for 106| | executing AVX512. 107| | 108| | There is nothing stopping some future processor from supporting the 109| | above flags and having AVX512 penalties, but maybe you should not have 110| | bought such a processor. 111| | */ 112| 1| AVX512_PROFILE = 113| 1| AVX512_F | AVX512_DQ | AVX512_IFMA | AVX512_BW | AVX512_VL | AVX512_VBMI | AVX512_VBMI2 | AVX512_VBITALG, 114| 1| }; 115| | 116| | // NOLINTNEXTLINE(performance-enum-size) 117| 1| enum class x86_CPUID_7_1_bits : uint64_t { 118| 1| SHA512 = (1 << 0), 119| 1| SM3 = (1 << 1), 120| 1| SM4 = (1 << 2), 121| 1| }; 122| | 123| 1| uint32_t feat = 0; 124| 1| uint32_t cpuid[4] = {0}; 125| 1| bool has_sse41 = false; 126| 1| bool has_os_ymm_support = false; 127| 1| bool has_os_zmm_support = false; 128| | 129| | // CPUID 0: vendor identification, max sublevel 130| 1| invoke_cpuid(0, cpuid); 131| | 132| 1| const uint32_t max_supported_sublevel = cpuid[0]; 133| | 134| 1| if(max_supported_sublevel >= 1) { ------------------ | Branch (134:7): [True: 1, False: 0] ------------------ 135| | // CPUID 1: feature bits 136| 1| invoke_cpuid(1, cpuid); 137| 1| const uint64_t flags0 = (static_cast(cpuid[2]) << 32) | cpuid[3]; 138| | 139| 1| feat |= if_set(flags0, x86_CPUID_1_bits::RDTSC, CPUFeature::Bit::RDTSC, allowed); 140| | 141| 1| feat |= if_set(flags0, x86_CPUID_1_bits::RDRAND, CPUFeature::Bit::RDRAND, allowed); 142| | 143| 1| feat |= if_set(flags0, x86_CPUID_1_bits::POPCNT, CPUFeature::Bit::POPCNT, allowed); 144| | 145| 1| feat |= if_set(flags0, x86_CPUID_1_bits::SSE2, CPUFeature::Bit::SSE2, allowed); 146| | 147| 1| if(is_set(feat, CPUFeature::Bit::SSE2)) { ------------------ | Branch (147:10): [True: 1, False: 0] ------------------ 148| 1| feat |= if_set(flags0, x86_CPUID_1_bits::SSSE3, CPUFeature::Bit::SSSE3, allowed); 149| | 150| 1| if(is_set(feat, CPUFeature::Bit::SSSE3)) { ------------------ | Branch (150:13): [True: 1, False: 0] ------------------ 151| 1| feat |= if_set(flags0, x86_CPUID_1_bits::CLMUL, CPUFeature::Bit::CLMUL, allowed); 152| 1| feat |= if_set(flags0, x86_CPUID_1_bits::AESNI, CPUFeature::Bit::AESNI, allowed); 153| | 154| | // SSE4.1 is not tracked as a feature, but is required by the SHA-NI code 155| 1| const uint64_t sse41 = static_cast(x86_CPUID_1_bits::SSE41); 156| 1| has_sse41 = (flags0 & sse41) == sse41; 157| 1| } 158| | 159| 1| const uint64_t osxsave64 = static_cast(x86_CPUID_1_bits::OSXSAVE); 160| 1| if((flags0 & osxsave64) == osxsave64) { ------------------ | Branch (160:13): [True: 1, False: 0] ------------------ 161| 1| const uint64_t xcr_flags = xgetbv(); 162| 1| if((xcr_flags & 0x6) == 0x6) { ------------------ | Branch (162:16): [True: 1, False: 0] ------------------ 163| 1| has_os_ymm_support = true; 164| 1| has_os_zmm_support = (xcr_flags & 0xE0) == 0xE0; 165| 1| } 166| 1| } 167| 1| } 168| 1| } 169| | 170| 1| if(max_supported_sublevel >= 7) { ------------------ | Branch (170:7): [True: 1, False: 0] ------------------ 171| 1| clear_mem(cpuid, 4); 172| 1| invoke_cpuid_sublevel(7, 0, cpuid); 173| | 174| 1| const uint64_t flags7 = (static_cast(cpuid[2]) << 32) | cpuid[1]; 175| | 176| 1| clear_mem(cpuid, 4); 177| 1| invoke_cpuid_sublevel(7, 1, cpuid); 178| 1| const uint32_t flags7_1 = cpuid[0]; 179| | 180| 1| feat |= if_set(flags7, x86_CPUID_7_bits::RDSEED, CPUFeature::Bit::RDSEED, allowed); 181| 1| feat |= if_set(flags7, x86_CPUID_7_bits::ADX, CPUFeature::Bit::ADX, allowed); 182| | 183| | /* 184| | We only set the BMI bit if both BMI1 and BMI2 are supported, since 185| | typically we want to use both extensions in the same code. 186| | */ 187| 1| feat |= if_set(flags7, x86_CPUID_7_bits::BMI_1_AND_2, CPUFeature::Bit::BMI, allowed); 188| | 189| 1| if(is_set(feat, CPUFeature::Bit::SSSE3)) { ------------------ | Branch (189:10): [True: 1, False: 0] ------------------ 190| | // The SHA-NI code uses SSE4.1 instructions in addition to SSSE3 191| 1| if(has_sse41) { ------------------ | Branch (191:13): [True: 1, False: 0] ------------------ 192| 1| feat |= if_set(flags7, x86_CPUID_7_bits::SHA, CPUFeature::Bit::SHA, allowed); 193| 1| } 194| | 195| | // We only consider AVX2 if SSSE3 is supported 196| 1| if(has_os_ymm_support) { ------------------ | Branch (196:13): [True: 1, False: 0] ------------------ 197| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX2, CPUFeature::Bit::AVX2, allowed); 198| | 199| 1| if(is_set(feat, CPUFeature::Bit::AVX2)) { ------------------ | Branch (199:16): [True: 1, False: 0] ------------------ 200| 1| feat |= if_set(flags7, x86_CPUID_7_bits::GFNI, CPUFeature::Bit::GFNI, allowed); 201| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX2_AES, allowed); 202| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SHA512, CPUFeature::Bit::SHA512, allowed); 203| | // The SM3/SM4 instructions are VEX encoded and the code using them also uses AVX2 204| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM3, CPUFeature::Bit::SM3, allowed); 205| 1| feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM4, CPUFeature::Bit::SM4, allowed); 206| | 207| | // The VPCLMULQDQ code also uses the legacy 128-bit PCLMULQDQ instruction 208| 1| if(is_set(feat, CPUFeature::Bit::CLMUL)) { ------------------ | Branch (208:19): [True: 1, False: 0] ------------------ 209| 1| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX2_CLMUL, allowed); 210| 1| } 211| | 212| | // Likewise we only consider AVX-512 if AVX2 is supported 213| 1| if(has_os_zmm_support) { ------------------ | Branch (213:19): [True: 0, False: 1] ------------------ 214| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_PROFILE, CPUFeature::Bit::AVX512, allowed); 215| | 216| 0| if(is_set(feat, CPUFeature::Bit::AVX512)) { ------------------ | Branch (216:22): [True: 0, False: 0] ------------------ 217| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX512_AES, allowed); 218| 0| if(is_set(feat, CPUFeature::Bit::CLMUL)) { ------------------ | Branch (218:25): [True: 0, False: 0] ------------------ 219| 0| feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX512_CLMUL, allowed); 220| 0| } 221| 0| } 222| 0| } 223| 1| } 224| 1| } 225| 1| } 226| 1| } 227| | 228| |/* 229| | * If we don't have access to CPUID, we can still safely assume that 230| | * any x86-64 processor has SSE2 and RDTSC 231| | */ 232| 1|#if defined(BOTAN_TARGET_ARCH_IS_X86_64) 233| 1| if(feat == 0) { ------------------ | Branch (233:7): [True: 0, False: 1] ------------------ 234| 0| feat |= CPUFeature::Bit::SSE2 & allowed; 235| 0| feat |= CPUFeature::Bit::RDTSC & allowed; 236| 0| } 237| 1|#endif 238| | 239| 1| return feat; 240| 1|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_112invoke_cpuidEjPj: 24| 2|void invoke_cpuid(uint32_t type, uint32_t out[4]) { 25| 2| clear_mem(out, 4); 26| | 27| 2|#if defined(BOTAN_USE_GCC_INLINE_ASM) 28| | // NOLINTNEXTLINE(*-no-assembler) 29| 2| asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type)); 30| | 31| |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) 32| | __cpuid((int*)out, type); 33| | 34| |#else 35| | BOTAN_UNUSED(type); 36| | #warning "No way of calling x86 cpuid instruction for this compiler" 37| |#endif 38| 2|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_16xgetbvEv: 56| 1|BOTAN_FUNC_ISA("xsave") uint64_t xgetbv() { 57| | return _xgetbv(0); 58| 1|} cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_121invoke_cpuid_sublevelEjjPj: 40| 2|void invoke_cpuid_sublevel(uint32_t type, uint32_t level, uint32_t out[4]) { 41| 2| clear_mem(out, 4); 42| | 43| 2|#if defined(BOTAN_USE_GCC_INLINE_ASM) 44| | // NOLINTNEXTLINE(*-no-assembler) 45| 2| asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type), "2"(level)); 46| | 47| |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) 48| | __cpuidex((int*)out, type, level); 49| | 50| |#else 51| | BOTAN_UNUSED(type, level); 52| | #warning "No way of calling x86 cpuid instruction for this compiler" 53| |#endif 54| 2|} _ZN5Botan19secure_scrub_memoryEPvm: 24| 1.03k|void secure_scrub_memory(void* ptr, size_t n) { 25| 1.03k| return secure_zeroize_buffer(ptr, n); 26| 1.03k|} _ZN5Botan21secure_zeroize_bufferEPvm: 28| 179k|void secure_zeroize_buffer(void* ptr, size_t n) { 29| 179k| if(n == 0) { ------------------ | Branch (29:7): [True: 0, False: 179k] ------------------ 30| 0| return; 31| 0| } 32| | 33| |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY) 34| | ::RtlSecureZeroMemory(ptr, n); 35| | 36| |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO) 37| 179k| ::explicit_bzero(ptr, n); 38| | 39| |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET) 40| | (void)::explicit_memset(ptr, 0, n); 41| | 42| |#else 43| | /* 44| | * Call memset through a static volatile pointer, which the compiler should 45| | * not elide. This construct should be safe in conforming compilers, but who 46| | * knows. This has been checked to generate the expected code, which saves the 47| | * memset address in the data segment and unconditionally loads and jumps to 48| | * that address, with the following targets: 49| | * 50| | * x86-64: Clang 19, GCC 6, 11, 13, 14 51| | * riscv64: GCC 14 52| | * aarch64: GCC 14 53| | * armv7: GCC 14 54| | * 55| | * Actually all of them generated the expected jump even without marking the 56| | * function pointer as volatile. However this seems worth including as an 57| | * additional precaution. 58| | */ 59| | static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset; 60| | (memset_ptr)(ptr, 0, n); 61| |#endif 62| 179k|} _ZN5Botan2OS17read_env_variableERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE: 471| 1|bool OS::read_env_variable(std::string& value_out, std::string_view name_view) { 472| 1| value_out = ""; 473| | 474| 1| if(running_in_privileged_state()) { ------------------ | Branch (474:7): [True: 0, False: 1] ------------------ 475| 0| return false; 476| 0| } 477| | 478| |#if defined(BOTAN_TARGET_OS_HAS_WIN32) && \ 479| | (defined(BOTAN_BUILD_COMPILER_IS_MSVC) || defined(BOTAN_BUILD_COMPILER_IS_CLANGCL)) 480| | const std::string name(name_view); 481| | 482| | // First query the required buffer size; req_size is 0 if the variable is not set 483| | size_t req_size = 0; 484| | if(getenv_s(&req_size, nullptr, 0, name.c_str()) != 0 || req_size == 0) { 485| | return false; 486| | } 487| | 488| | // The reported size includes the terminating \0 489| | std::string val(req_size, '\0'); 490| | if(getenv_s(&req_size, val.data(), val.size(), name.c_str()) != 0) { 491| | return false; 492| | } 493| | 494| | value_out = std::string(val.c_str()); 495| | return true; 496| |#else 497| 1| const std::string name(name_view); 498| 1| if(const char* val = std::getenv(name.c_str())) { ------------------ | Branch (498:19): [True: 0, False: 1] ------------------ 499| 0| value_out = val; 500| 0| return true; 501| 0| } 502| 1|#endif 503| | 504| 1| return false; 505| 1|} os_utils.cpp:_ZN5Botan12_GLOBAL__N_110get_auxvalENSt3__18optionalImEE: 120| 1|std::optional get_auxval(std::optional id) { 121| 1| if(id) { ------------------ | Branch (121:7): [True: 1, False: 0] ------------------ 122| 1|#if defined(BOTAN_TARGET_OS_HAS_GETAUXVAL) 123| 1| return ::getauxval(*id); 124| |#elif defined(BOTAN_TARGET_OS_HAS_ELF_AUX_INFO) 125| | unsigned long auxinfo = 0; 126| | if(::elf_aux_info(static_cast(*id), &auxinfo, sizeof(auxinfo)) == 0) { 127| | return auxinfo; 128| | } 129| |#endif 130| 1| } 131| | 132| 0| return {}; 133| 1|} os_utils.cpp:_ZN5Botan12_GLOBAL__N_127running_in_privileged_stateEv: 154| 1|bool running_in_privileged_state() { 155| 1|#if defined(AT_SECURE) 156| 1| if(const auto at_secure = get_auxval(AT_SECURE)) { ------------------ | Branch (156:18): [True: 1, False: 0] ------------------ 157| 1| return at_secure != 0; 158| 1| } 159| 0|#endif 160| | 161| 0|#if defined(BOTAN_TARGET_OS_HAS_POSIX1) 162| 0| return (::getuid() != ::geteuid()) || (::getgid() != ::getegid()); ------------------ | Branch (162:11): [True: 0, False: 0] | Branch (162:42): [True: 0, False: 0] ------------------ 163| |#else 164| | return false; 165| |#endif 166| 1|}