Add GCM, CTR, and CTS modes to AES.

nss/mozilla/security/nss/lib/freebl/mpi/mp_gf2m.c

 /*
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
@@ skipping 341 matching lines @@
 
     /* The algorithm does the reduction in place in r, 
      * if a != r, copy a into r first so reduction can be done in r
      */
     if (a != r) {
         MP_CHECKOK( mp_copy(a, r) );
     }
     z = MP_DIGITS(r);
 
     /* start reduction */
-    dN = p[0] / MP_DIGIT_BITS;
+    /*dN = p[0] / MP_DIGIT_BITS; */
+    dN = p[0] >> MP_DIGIT_BITS_LOG_2;
     used = MP_USED(r);
 
     for (j = used - 1; j > dN;) {
 
         zz = z[j];
         if (zz == 0) {
             j--; continue;
         }
         z[j] = 0;
 
         for (k = 1; p[k] > 0; k++) {
             /* reducing component t^p[k] */
             n = p[0] - p[k];
-            d0 = n % MP_DIGIT_BITS;  
+            /*d0 = n % MP_DIGIT_BITS;   */
+            d0 = n & MP_DIGIT_BITS_MASK;
             d1 = MP_DIGIT_BITS - d0;
-            n /= MP_DIGIT_BITS;
+            /*n /= MP_DIGIT_BITS; */
+            n >>= MP_DIGIT_BITS_LOG_2;
             z[j-n] ^= (zz>>d0);
             if (d0) 
                 z[j-n-1] ^= (zz<<d1);
         }
 
         /* reducing component t^0 */
         n = dN;  
-        d0 = p[0] % MP_DIGIT_BITS;
+        /*d0 = p[0] % MP_DIGIT_BITS;*/
+        d0 = p[0] & MP_DIGIT_BITS_MASK;
         d1 = MP_DIGIT_BITS - d0;
         z[j-n] ^= (zz >> d0);
         if (d0) 
             z[j-n-1] ^= (zz << d1);
 
     }
 
     /* final round of reduction */
     while (j == dN) {
 
-        d0 = p[0] % MP_DIGIT_BITS;
+        /* d0 = p[0] % MP_DIGIT_BITS; */
+        d0 = p[0] & MP_DIGIT_BITS_MASK;
         zz = z[dN] >> d0;  
         if (zz == 0) break;
         d1 = MP_DIGIT_BITS - d0;
 
         /* clear up the top d1 bits */
-        if (d0) z[dN] = (z[dN] << d1) >> d1; 
+        if (d0) {
+            z[dN] = (z[dN] << d1) >> d1; 
+        } else {
+            z[dN] = 0;
+        }
         *z ^= zz; /* reduction t^0 component */
 
         for (k = 1; p[k] > 0; k++) {
             /* reducing component t^p[k]*/
-            n = p[k] / MP_DIGIT_BITS;
-            d0 = p[k] % MP_DIGIT_BITS;
+            /* n = p[k] / MP_DIGIT_BITS; */
+            n = p[k] >> MP_DIGIT_BITS_LOG_2;
+            /* d0 = p[k] % MP_DIGIT_BITS; */
+            d0 = p[k] & MP_DIGIT_BITS_MASK;
             d1 = MP_DIGIT_BITS - d0;
             z[n] ^= (zz << d0);
             tmp = zz >> d1;
             if (d0 && tmp)
                 z[n+1] ^= tmp;
         }
     }
 
     s_mp_clamp(r);
 CLEANUP:
@@ skipping 174 matching lines @@
 
     mp_zero(a);
     for (i = 0; p[i] > 0; i++) {
         MP_CHECKOK( mpl_set_bit(a, p[i], 1) );
     }
     MP_CHECKOK( mpl_set_bit(a, 0, 1) );
         
 CLEANUP:
     return res;
 }