| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 #include "ecp.h" | |
| 6 #include "mplogic.h" | |
| 7 #include <stdlib.h> | |
| 8 #ifdef ECL_DEBUG | |
| 9 #include <assert.h> | |
| 10 #endif | |
| 11 | |
| 12 /* Converts a point P(px, py) from affine coordinates to Jacobian | |
| 13 * projective coordinates R(rx, ry, rz). Assumes input is already | |
| 14 * field-encoded using field_enc, and returns output that is still | |
| 15 * field-encoded. */ | |
| 16 mp_err | |
| 17 ec_GFp_pt_aff2jac(const mp_int *px, const mp_int *py, mp_int *rx, | |
| 18 mp_int *ry, mp_int *rz, const ECGroup *group) | |
| 19 { | |
| 20 mp_err res = MP_OKAY; | |
| 21 | |
| 22 if (ec_GFp_pt_is_inf_aff(px, py) == MP_YES) { | |
| 23 MP_CHECKOK(ec_GFp_pt_set_inf_jac(rx, ry, rz)); | |
| 24 } else { | |
| 25 MP_CHECKOK(mp_copy(px, rx)); | |
| 26 MP_CHECKOK(mp_copy(py, ry)); | |
| 27 MP_CHECKOK(mp_set_int(rz, 1)); | |
| 28 if (group->meth->field_enc) { | |
| 29 MP_CHECKOK(group->meth->field_enc(rz, rz, group->meth)); | |
| 30 } | |
| 31 } | |
| 32 CLEANUP: | |
| 33 return res; | |
| 34 } | |
| 35 | |
| 36 /* Converts a point P(px, py, pz) from Jacobian projective coordinates to | |
| 37 * affine coordinates R(rx, ry). P and R can share x and y coordinates. | |
| 38 * Assumes input is already field-encoded using field_enc, and returns | |
| 39 * output that is still field-encoded. */ | |
| 40 mp_err | |
| 41 ec_GFp_pt_jac2aff(const mp_int *px, const mp_int *py, const mp_int *pz, | |
| 42 mp_int *rx, mp_int *ry, const ECGroup *group) | |
| 43 { | |
| 44 mp_err res = MP_OKAY; | |
| 45 mp_int z1, z2, z3; | |
| 46 | |
| 47 MP_DIGITS(&z1) = 0; | |
| 48 MP_DIGITS(&z2) = 0; | |
| 49 MP_DIGITS(&z3) = 0; | |
| 50 MP_CHECKOK(mp_init(&z1)); | |
| 51 MP_CHECKOK(mp_init(&z2)); | |
| 52 MP_CHECKOK(mp_init(&z3)); | |
| 53 | |
| 54 /* if point at infinity, then set point at infinity and exit */ | |
| 55 if (ec_GFp_pt_is_inf_jac(px, py, pz) == MP_YES) { | |
| 56 MP_CHECKOK(ec_GFp_pt_set_inf_aff(rx, ry)); | |
| 57 goto CLEANUP; | |
| 58 } | |
| 59 | |
| 60 /* transform (px, py, pz) into (px / pz^2, py / pz^3) */ | |
| 61 if (mp_cmp_d(pz, 1) == 0) { | |
| 62 MP_CHECKOK(mp_copy(px, rx)); | |
| 63 MP_CHECKOK(mp_copy(py, ry)); | |
| 64 } else { | |
| 65 MP_CHECKOK(group->meth->field_div(NULL, pz, &z1, group->meth)); | |
| 66 MP_CHECKOK(group->meth->field_sqr(&z1, &z2, group->meth)); | |
| 67 MP_CHECKOK(group->meth->field_mul(&z1, &z2, &z3, group->meth)); | |
| 68 MP_CHECKOK(group->meth->field_mul(px, &z2, rx, group->meth)); | |
| 69 MP_CHECKOK(group->meth->field_mul(py, &z3, ry, group->meth)); | |
| 70 } | |
| 71 | |
| 72 CLEANUP: | |
| 73 mp_clear(&z1); | |
| 74 mp_clear(&z2); | |
| 75 mp_clear(&z3); | |
| 76 return res; | |
| 77 } | |
| 78 | |
| 79 /* Checks if point P(px, py, pz) is at infinity. Uses Jacobian | |
| 80 * coordinates. */ | |
| 81 mp_err | |
| 82 ec_GFp_pt_is_inf_jac(const mp_int *px, const mp_int *py, const mp_int *pz) | |
| 83 { | |
| 84 return mp_cmp_z(pz); | |
| 85 } | |
| 86 | |
| 87 /* Sets P(px, py, pz) to be the point at infinity. Uses Jacobian | |
| 88 * coordinates. */ | |
| 89 mp_err | |
| 90 ec_GFp_pt_set_inf_jac(mp_int *px, mp_int *py, mp_int *pz) | |
| 91 { | |
| 92 mp_zero(pz); | |
| 93 return MP_OKAY; | |
| 94 } | |
| 95 | |
| 96 /* Computes R = P + Q where R is (rx, ry, rz), P is (px, py, pz) and Q is | |
| 97 * (qx, qy, 1). Elliptic curve points P, Q, and R can all be identical. | |
| 98 * Uses mixed Jacobian-affine coordinates. Assumes input is already | |
| 99 * field-encoded using field_enc, and returns output that is still | |
| 100 * field-encoded. Uses equation (2) from Brown, Hankerson, Lopez, and | |
| 101 * Menezes. Software Implementation of the NIST Elliptic Curves Over Prime | |
| 102 * Fields. */ | |
| 103 mp_err | |
| 104 ec_GFp_pt_add_jac_aff(const mp_int *px, const mp_int *py, const mp_int *pz, | |
| 105 const mp_int *qx, const mp_int *qy, mp
_int *rx, | |
| 106 mp_int *ry, mp_int *rz, const ECGroup
*group) | |
| 107 { | |
| 108 mp_err res = MP_OKAY; | |
| 109 mp_int A, B, C, D, C2, C3; | |
| 110 | |
| 111 MP_DIGITS(&A) = 0; | |
| 112 MP_DIGITS(&B) = 0; | |
| 113 MP_DIGITS(&C) = 0; | |
| 114 MP_DIGITS(&D) = 0; | |
| 115 MP_DIGITS(&C2) = 0; | |
| 116 MP_DIGITS(&C3) = 0; | |
| 117 MP_CHECKOK(mp_init(&A)); | |
| 118 MP_CHECKOK(mp_init(&B)); | |
| 119 MP_CHECKOK(mp_init(&C)); | |
| 120 MP_CHECKOK(mp_init(&D)); | |
| 121 MP_CHECKOK(mp_init(&C2)); | |
| 122 MP_CHECKOK(mp_init(&C3)); | |
| 123 | |
| 124 /* If either P or Q is the point at infinity, then return the other | |
| 125 * point */ | |
| 126 if (ec_GFp_pt_is_inf_jac(px, py, pz) == MP_YES) { | |
| 127 MP_CHECKOK(ec_GFp_pt_aff2jac(qx, qy, rx, ry, rz, group)); | |
| 128 goto CLEANUP; | |
| 129 } | |
| 130 if (ec_GFp_pt_is_inf_aff(qx, qy) == MP_YES) { | |
| 131 MP_CHECKOK(mp_copy(px, rx)); | |
| 132 MP_CHECKOK(mp_copy(py, ry)); | |
| 133 MP_CHECKOK(mp_copy(pz, rz)); | |
| 134 goto CLEANUP; | |
| 135 } | |
| 136 | |
| 137 /* A = qx * pz^2, B = qy * pz^3 */ | |
| 138 MP_CHECKOK(group->meth->field_sqr(pz, &A, group->meth)); | |
| 139 MP_CHECKOK(group->meth->field_mul(&A, pz, &B, group->meth)); | |
| 140 MP_CHECKOK(group->meth->field_mul(&A, qx, &A, group->meth)); | |
| 141 MP_CHECKOK(group->meth->field_mul(&B, qy, &B, group->meth)); | |
| 142 | |
| 143 /* C = A - px, D = B - py */ | |
| 144 MP_CHECKOK(group->meth->field_sub(&A, px, &C, group->meth)); | |
| 145 MP_CHECKOK(group->meth->field_sub(&B, py, &D, group->meth)); | |
| 146 | |
| 147 /* C2 = C^2, C3 = C^3 */ | |
| 148 MP_CHECKOK(group->meth->field_sqr(&C, &C2, group->meth)); | |
| 149 MP_CHECKOK(group->meth->field_mul(&C, &C2, &C3, group->meth)); | |
| 150 | |
| 151 /* rz = pz * C */ | |
| 152 MP_CHECKOK(group->meth->field_mul(pz, &C, rz, group->meth)); | |
| 153 | |
| 154 /* C = px * C^2 */ | |
| 155 MP_CHECKOK(group->meth->field_mul(px, &C2, &C, group->meth)); | |
| 156 /* A = D^2 */ | |
| 157 MP_CHECKOK(group->meth->field_sqr(&D, &A, group->meth)); | |
| 158 | |
| 159 /* rx = D^2 - (C^3 + 2 * (px * C^2)) */ | |
| 160 MP_CHECKOK(group->meth->field_add(&C, &C, rx, group->meth)); | |
| 161 MP_CHECKOK(group->meth->field_add(&C3, rx, rx, group->meth)); | |
| 162 MP_CHECKOK(group->meth->field_sub(&A, rx, rx, group->meth)); | |
| 163 | |
| 164 /* C3 = py * C^3 */ | |
| 165 MP_CHECKOK(group->meth->field_mul(py, &C3, &C3, group->meth)); | |
| 166 | |
| 167 /* ry = D * (px * C^2 - rx) - py * C^3 */ | |
| 168 MP_CHECKOK(group->meth->field_sub(&C, rx, ry, group->meth)); | |
| 169 MP_CHECKOK(group->meth->field_mul(&D, ry, ry, group->meth)); | |
| 170 MP_CHECKOK(group->meth->field_sub(ry, &C3, ry, group->meth)); | |
| 171 | |
| 172 CLEANUP: | |
| 173 mp_clear(&A); | |
| 174 mp_clear(&B); | |
| 175 mp_clear(&C); | |
| 176 mp_clear(&D); | |
| 177 mp_clear(&C2); | |
| 178 mp_clear(&C3); | |
| 179 return res; | |
| 180 } | |
| 181 | |
| 182 /* Computes R = 2P. Elliptic curve points P and R can be identical. Uses | |
| 183 * Jacobian coordinates. | |
| 184 * | |
| 185 * Assumes input is already field-encoded using field_enc, and returns | |
| 186 * output that is still field-encoded. | |
| 187 * | |
| 188 * This routine implements Point Doubling in the Jacobian Projective | |
| 189 * space as described in the paper "Efficient elliptic curve exponentiation | |
| 190 * using mixed coordinates", by H. Cohen, A Miyaji, T. Ono. | |
| 191 */ | |
| 192 mp_err | |
| 193 ec_GFp_pt_dbl_jac(const mp_int *px, const mp_int *py, const mp_int *pz, | |
| 194 mp_int *rx, mp_int *ry, mp_int *rz, const ECGr
oup *group) | |
| 195 { | |
| 196 mp_err res = MP_OKAY; | |
| 197 mp_int t0, t1, M, S; | |
| 198 | |
| 199 MP_DIGITS(&t0) = 0; | |
| 200 MP_DIGITS(&t1) = 0; | |
| 201 MP_DIGITS(&M) = 0; | |
| 202 MP_DIGITS(&S) = 0; | |
| 203 MP_CHECKOK(mp_init(&t0)); | |
| 204 MP_CHECKOK(mp_init(&t1)); | |
| 205 MP_CHECKOK(mp_init(&M)); | |
| 206 MP_CHECKOK(mp_init(&S)); | |
| 207 | |
| 208 if (ec_GFp_pt_is_inf_jac(px, py, pz) == MP_YES) { | |
| 209 MP_CHECKOK(ec_GFp_pt_set_inf_jac(rx, ry, rz)); | |
| 210 goto CLEANUP; | |
| 211 } | |
| 212 | |
| 213 if (mp_cmp_d(pz, 1) == 0) { | |
| 214 /* M = 3 * px^2 + a */ | |
| 215 MP_CHECKOK(group->meth->field_sqr(px, &t0, group->meth)); | |
| 216 MP_CHECKOK(group->meth->field_add(&t0, &t0, &M, group->meth)); | |
| 217 MP_CHECKOK(group->meth->field_add(&t0, &M, &t0, group->meth)); | |
| 218 MP_CHECKOK(group->meth-> | |
| 219 field_add(&t0, &group->curvea, &M, group->met
h)); | |
| 220 } else if (mp_cmp_int(&group->curvea, -3) == 0) { | |
| 221 /* M = 3 * (px + pz^2) * (px - pz^2) */ | |
| 222 MP_CHECKOK(group->meth->field_sqr(pz, &M, group->meth)); | |
| 223 MP_CHECKOK(group->meth->field_add(px, &M, &t0, group->meth)); | |
| 224 MP_CHECKOK(group->meth->field_sub(px, &M, &t1, group->meth)); | |
| 225 MP_CHECKOK(group->meth->field_mul(&t0, &t1, &M, group->meth)); | |
| 226 MP_CHECKOK(group->meth->field_add(&M, &M, &t0, group->meth)); | |
| 227 MP_CHECKOK(group->meth->field_add(&t0, &M, &M, group->meth)); | |
| 228 } else { | |
| 229 /* M = 3 * (px^2) + a * (pz^4) */ | |
| 230 MP_CHECKOK(group->meth->field_sqr(px, &t0, group->meth)); | |
| 231 MP_CHECKOK(group->meth->field_add(&t0, &t0, &M, group->meth)); | |
| 232 MP_CHECKOK(group->meth->field_add(&t0, &M, &t0, group->meth)); | |
| 233 MP_CHECKOK(group->meth->field_sqr(pz, &M, group->meth)); | |
| 234 MP_CHECKOK(group->meth->field_sqr(&M, &M, group->meth)); | |
| 235 MP_CHECKOK(group->meth-> | |
| 236 field_mul(&M, &group->curvea, &M, group->meth
)); | |
| 237 MP_CHECKOK(group->meth->field_add(&M, &t0, &M, group->meth)); | |
| 238 } | |
| 239 | |
| 240 /* rz = 2 * py * pz */ | |
| 241 /* t0 = 4 * py^2 */ | |
| 242 if (mp_cmp_d(pz, 1) == 0) { | |
| 243 MP_CHECKOK(group->meth->field_add(py, py, rz, group->meth)); | |
| 244 MP_CHECKOK(group->meth->field_sqr(rz, &t0, group->meth)); | |
| 245 } else { | |
| 246 MP_CHECKOK(group->meth->field_add(py, py, &t0, group->meth)); | |
| 247 MP_CHECKOK(group->meth->field_mul(&t0, pz, rz, group->meth)); | |
| 248 MP_CHECKOK(group->meth->field_sqr(&t0, &t0, group->meth)); | |
| 249 } | |
| 250 | |
| 251 /* S = 4 * px * py^2 = px * (2 * py)^2 */ | |
| 252 MP_CHECKOK(group->meth->field_mul(px, &t0, &S, group->meth)); | |
| 253 | |
| 254 /* rx = M^2 - 2 * S */ | |
| 255 MP_CHECKOK(group->meth->field_add(&S, &S, &t1, group->meth)); | |
| 256 MP_CHECKOK(group->meth->field_sqr(&M, rx, group->meth)); | |
| 257 MP_CHECKOK(group->meth->field_sub(rx, &t1, rx, group->meth)); | |
| 258 | |
| 259 /* ry = M * (S - rx) - 8 * py^4 */ | |
| 260 MP_CHECKOK(group->meth->field_sqr(&t0, &t1, group->meth)); | |
| 261 if (mp_isodd(&t1)) { | |
| 262 MP_CHECKOK(mp_add(&t1, &group->meth->irr, &t1)); | |
| 263 } | |
| 264 MP_CHECKOK(mp_div_2(&t1, &t1)); | |
| 265 MP_CHECKOK(group->meth->field_sub(&S, rx, &S, group->meth)); | |
| 266 MP_CHECKOK(group->meth->field_mul(&M, &S, &M, group->meth)); | |
| 267 MP_CHECKOK(group->meth->field_sub(&M, &t1, ry, group->meth)); | |
| 268 | |
| 269 CLEANUP: | |
| 270 mp_clear(&t0); | |
| 271 mp_clear(&t1); | |
| 272 mp_clear(&M); | |
| 273 mp_clear(&S); | |
| 274 return res; | |
| 275 } | |
| 276 | |
| 277 /* by default, this routine is unused and thus doesn't need to be compiled */ | |
| 278 #ifdef ECL_ENABLE_GFP_PT_MUL_JAC | |
| 279 /* Computes R = nP where R is (rx, ry) and P is (px, py). The parameters | |
| 280 * a, b and p are the elliptic curve coefficients and the prime that | |
| 281 * determines the field GFp. Elliptic curve points P and R can be | |
| 282 * identical. Uses mixed Jacobian-affine coordinates. Assumes input is | |
| 283 * already field-encoded using field_enc, and returns output that is still | |
| 284 * field-encoded. Uses 4-bit window method. */ | |
| 285 mp_err | |
| 286 ec_GFp_pt_mul_jac(const mp_int *n, const mp_int *px, const mp_int *py, | |
| 287 mp_int *rx, mp_int *ry, const ECGroup *group) | |
| 288 { | |
| 289 mp_err res = MP_OKAY; | |
| 290 mp_int precomp[16][2], rz; | |
| 291 int i, ni, d; | |
| 292 | |
| 293 MP_DIGITS(&rz) = 0; | |
| 294 for (i = 0; i < 16; i++) { | |
| 295 MP_DIGITS(&precomp[i][0]) = 0; | |
| 296 MP_DIGITS(&precomp[i][1]) = 0; | |
| 297 } | |
| 298 | |
| 299 ARGCHK(group != NULL, MP_BADARG); | |
| 300 ARGCHK((n != NULL) && (px != NULL) && (py != NULL), MP_BADARG); | |
| 301 | |
| 302 /* initialize precomputation table */ | |
| 303 for (i = 0; i < 16; i++) { | |
| 304 MP_CHECKOK(mp_init(&precomp[i][0])); | |
| 305 MP_CHECKOK(mp_init(&precomp[i][1])); | |
| 306 } | |
| 307 | |
| 308 /* fill precomputation table */ | |
| 309 mp_zero(&precomp[0][0]); | |
| 310 mp_zero(&precomp[0][1]); | |
| 311 MP_CHECKOK(mp_copy(px, &precomp[1][0])); | |
| 312 MP_CHECKOK(mp_copy(py, &precomp[1][1])); | |
| 313 for (i = 2; i < 16; i++) { | |
| 314 MP_CHECKOK(group-> | |
| 315 point_add(&precomp[1][0], &precomp[1][1], | |
| 316 &precomp[i - 1][0], &pr
ecomp[i - 1][1], | |
| 317 &precomp[i][0], &precom
p[i][1], group)); | |
| 318 } | |
| 319 | |
| 320 d = (mpl_significant_bits(n) + 3) / 4; | |
| 321 | |
| 322 /* R = inf */ | |
| 323 MP_CHECKOK(mp_init(&rz)); | |
| 324 MP_CHECKOK(ec_GFp_pt_set_inf_jac(rx, ry, &rz)); | |
| 325 | |
| 326 for (i = d - 1; i >= 0; i--) { | |
| 327 /* compute window ni */ | |
| 328 ni = MP_GET_BIT(n, 4 * i + 3); | |
| 329 ni <<= 1; | |
| 330 ni |= MP_GET_BIT(n, 4 * i + 2); | |
| 331 ni <<= 1; | |
| 332 ni |= MP_GET_BIT(n, 4 * i + 1); | |
| 333 ni <<= 1; | |
| 334 ni |= MP_GET_BIT(n, 4 * i); | |
| 335 /* R = 2^4 * R */ | |
| 336 MP_CHECKOK(ec_GFp_pt_dbl_jac(rx, ry, &rz, rx, ry, &rz, group)); | |
| 337 MP_CHECKOK(ec_GFp_pt_dbl_jac(rx, ry, &rz, rx, ry, &rz, group)); | |
| 338 MP_CHECKOK(ec_GFp_pt_dbl_jac(rx, ry, &rz, rx, ry, &rz, group)); | |
| 339 MP_CHECKOK(ec_GFp_pt_dbl_jac(rx, ry, &rz, rx, ry, &rz, group)); | |
| 340 /* R = R + (ni * P) */ | |
| 341 MP_CHECKOK(ec_GFp_pt_add_jac_aff | |
| 342 (rx, ry, &rz, &precomp[ni][0], &precomp[ni][1
], rx, ry, | |
| 343 &rz, group)); | |
| 344 } | |
| 345 | |
| 346 /* convert result S to affine coordinates */ | |
| 347 MP_CHECKOK(ec_GFp_pt_jac2aff(rx, ry, &rz, rx, ry, group)); | |
| 348 | |
| 349 CLEANUP: | |
| 350 mp_clear(&rz); | |
| 351 for (i = 0; i < 16; i++) { | |
| 352 mp_clear(&precomp[i][0]); | |
| 353 mp_clear(&precomp[i][1]); | |
| 354 } | |
| 355 return res; | |
| 356 } | |
| 357 #endif | |
| 358 | |
| 359 /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k1 * G + | |
| 360 * k2 * P(x, y), where G is the generator (base point) of the group of | |
| 361 * points on the elliptic curve. Allows k1 = NULL or { k2, P } = NULL. | |
| 362 * Uses mixed Jacobian-affine coordinates. Input and output values are | |
| 363 * assumed to be NOT field-encoded. Uses algorithm 15 (simultaneous | |
| 364 * multiple point multiplication) from Brown, Hankerson, Lopez, Menezes. | |
| 365 * Software Implementation of the NIST Elliptic Curves over Prime Fields. */ | |
| 366 mp_err | |
| 367 ec_GFp_pts_mul_jac(const mp_int *k1, const mp_int *k2, const mp_int *px, | |
| 368 const mp_int *py, mp_int *rx, mp_int *ry, | |
| 369 const ECGroup *group) | |
| 370 { | |
| 371 mp_err res = MP_OKAY; | |
| 372 mp_int precomp[4][4][2]; | |
| 373 mp_int rz; | |
| 374 const mp_int *a, *b; | |
| 375 int i, j; | |
| 376 int ai, bi, d; | |
| 377 | |
| 378 for (i = 0; i < 4; i++) { | |
| 379 for (j = 0; j < 4; j++) { | |
| 380 MP_DIGITS(&precomp[i][j][0]) = 0; | |
| 381 MP_DIGITS(&precomp[i][j][1]) = 0; | |
| 382 } | |
| 383 } | |
| 384 MP_DIGITS(&rz) = 0; | |
| 385 | |
| 386 ARGCHK(group != NULL, MP_BADARG); | |
| 387 ARGCHK(!((k1 == NULL) | |
| 388 && ((k2 == NULL) || (px == NULL) | |
| 389 || (py == NULL))), MP_BADARG); | |
| 390 | |
| 391 /* if some arguments are not defined used ECPoint_mul */ | |
| 392 if (k1 == NULL) { | |
| 393 return ECPoint_mul(group, k2, px, py, rx, ry); | |
| 394 } else if ((k2 == NULL) || (px == NULL) || (py == NULL)) { | |
| 395 return ECPoint_mul(group, k1, NULL, NULL, rx, ry); | |
| 396 } | |
| 397 | |
| 398 /* initialize precomputation table */ | |
| 399 for (i = 0; i < 4; i++) { | |
| 400 for (j = 0; j < 4; j++) { | |
| 401 MP_CHECKOK(mp_init(&precomp[i][j][0])); | |
| 402 MP_CHECKOK(mp_init(&precomp[i][j][1])); | |
| 403 } | |
| 404 } | |
| 405 | |
| 406 /* fill precomputation table */ | |
| 407 /* assign {k1, k2} = {a, b} such that len(a) >= len(b) */ | |
| 408 if (mpl_significant_bits(k1) < mpl_significant_bits(k2)) { | |
| 409 a = k2; | |
| 410 b = k1; | |
| 411 if (group->meth->field_enc) { | |
| 412 MP_CHECKOK(group->meth-> | |
| 413 field_enc(px, &precomp[1][0][0], grou
p->meth)); | |
| 414 MP_CHECKOK(group->meth-> | |
| 415 field_enc(py, &precomp[1][0][1], grou
p->meth)); | |
| 416 } else { | |
| 417 MP_CHECKOK(mp_copy(px, &precomp[1][0][0])); | |
| 418 MP_CHECKOK(mp_copy(py, &precomp[1][0][1])); | |
| 419 } | |
| 420 MP_CHECKOK(mp_copy(&group->genx, &precomp[0][1][0])); | |
| 421 MP_CHECKOK(mp_copy(&group->geny, &precomp[0][1][1])); | |
| 422 } else { | |
| 423 a = k1; | |
| 424 b = k2; | |
| 425 MP_CHECKOK(mp_copy(&group->genx, &precomp[1][0][0])); | |
| 426 MP_CHECKOK(mp_copy(&group->geny, &precomp[1][0][1])); | |
| 427 if (group->meth->field_enc) { | |
| 428 MP_CHECKOK(group->meth-> | |
| 429 field_enc(px, &precomp[0][1][0], grou
p->meth)); | |
| 430 MP_CHECKOK(group->meth-> | |
| 431 field_enc(py, &precomp[0][1][1], grou
p->meth)); | |
| 432 } else { | |
| 433 MP_CHECKOK(mp_copy(px, &precomp[0][1][0])); | |
| 434 MP_CHECKOK(mp_copy(py, &precomp[0][1][1])); | |
| 435 } | |
| 436 } | |
| 437 /* precompute [*][0][*] */ | |
| 438 mp_zero(&precomp[0][0][0]); | |
| 439 mp_zero(&precomp[0][0][1]); | |
| 440 MP_CHECKOK(group-> | |
| 441 point_dbl(&precomp[1][0][0], &precomp[1][0][1], | |
| 442 &precomp[2][0][0], &precomp[2][
0][1], group)); | |
| 443 MP_CHECKOK(group-> | |
| 444 point_add(&precomp[1][0][0], &precomp[1][0][1], | |
| 445 &precomp[2][0][0], &precomp[2][
0][1], | |
| 446 &precomp[3][0][0], &precomp[3][
0][1], group)); | |
| 447 /* precompute [*][1][*] */ | |
| 448 for (i = 1; i < 4; i++) { | |
| 449 MP_CHECKOK(group-> | |
| 450 point_add(&precomp[0][1][0], &precomp[0][1][1
], | |
| 451 &precomp[i][0][0], &pre
comp[i][0][1], | |
| 452 &precomp[i][1][0], &pre
comp[i][1][1], group)); | |
| 453 } | |
| 454 /* precompute [*][2][*] */ | |
| 455 MP_CHECKOK(group-> | |
| 456 point_dbl(&precomp[0][1][0], &precomp[0][1][1], | |
| 457 &precomp[0][2][0], &precomp[0][
2][1], group)); | |
| 458 for (i = 1; i < 4; i++) { | |
| 459 MP_CHECKOK(group-> | |
| 460 point_add(&precomp[0][2][0], &precomp[0][2][1
], | |
| 461 &precomp[i][0][0], &pre
comp[i][0][1], | |
| 462 &precomp[i][2][0], &pre
comp[i][2][1], group)); | |
| 463 } | |
| 464 /* precompute [*][3][*] */ | |
| 465 MP_CHECKOK(group-> | |
| 466 point_add(&precomp[0][1][0], &precomp[0][1][1], | |
| 467 &precomp[0][2][0], &precomp[0][
2][1], | |
| 468 &precomp[0][3][0], &precomp[0][
3][1], group)); | |
| 469 for (i = 1; i < 4; i++) { | |
| 470 MP_CHECKOK(group-> | |
| 471 point_add(&precomp[0][3][0], &precomp[0][3][1
], | |
| 472 &precomp[i][0][0], &pre
comp[i][0][1], | |
| 473 &precomp[i][3][0], &pre
comp[i][3][1], group)); | |
| 474 } | |
| 475 | |
| 476 d = (mpl_significant_bits(a) + 1) / 2; | |
| 477 | |
| 478 /* R = inf */ | |
| 479 MP_CHECKOK(mp_init(&rz)); | |
| 480 MP_CHECKOK(ec_GFp_pt_set_inf_jac(rx, ry, &rz)); | |
| 481 | |
| 482 for (i = d - 1; i >= 0; i--) { | |
| 483 ai = MP_GET_BIT(a, 2 * i + 1); | |
| 484 ai <<= 1; | |
| 485 ai |= MP_GET_BIT(a, 2 * i); | |
| 486 bi = MP_GET_BIT(b, 2 * i + 1); | |
| 487 bi <<= 1; | |
| 488 bi |= MP_GET_BIT(b, 2 * i); | |
| 489 /* R = 2^2 * R */ | |
| 490 MP_CHECKOK(ec_GFp_pt_dbl_jac(rx, ry, &rz, rx, ry, &rz, group)); | |
| 491 MP_CHECKOK(ec_GFp_pt_dbl_jac(rx, ry, &rz, rx, ry, &rz, group)); | |
| 492 /* R = R + (ai * A + bi * B) */ | |
| 493 MP_CHECKOK(ec_GFp_pt_add_jac_aff | |
| 494 (rx, ry, &rz, &precomp[ai][bi][0], &precomp[a
i][bi][1], | |
| 495 rx, ry, &rz, group)); | |
| 496 } | |
| 497 | |
| 498 MP_CHECKOK(ec_GFp_pt_jac2aff(rx, ry, &rz, rx, ry, group)); | |
| 499 | |
| 500 if (group->meth->field_dec) { | |
| 501 MP_CHECKOK(group->meth->field_dec(rx, rx, group->meth)); | |
| 502 MP_CHECKOK(group->meth->field_dec(ry, ry, group->meth)); | |
| 503 } | |
| 504 | |
| 505 CLEANUP: | |
| 506 mp_clear(&rz); | |
| 507 for (i = 0; i < 4; i++) { | |
| 508 for (j = 0; j < 4; j++) { | |
| 509 mp_clear(&precomp[i][j][0]); | |
| 510 mp_clear(&precomp[i][j][1]); | |
| 511 } | |
| 512 } | |
| 513 return res; | |
| 514 } | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 14249009:
Change the NSS and NSPR source tree to the new directory structure to be (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/nss/