]>
git.ipfire.org Git - thirdparty/openssl.git/blob - crypto/ec/curve448/field.h
e1c633378950db1ea5064c00b4cd34f917fcdd80
2 * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright 2014 Cryptography Research, Inc.
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
10 * Originally written by Mike Hamburg
13 #ifndef OSSL_CRYPTO_EC_CURVE448_FIELD_H
14 # define OSSL_CRYPTO_EC_CURVE448_FIELD_H
16 # include "internal/constant_time.h"
21 # define NLIMBS (64/sizeof(word_t))
22 # define X_SER_BYTES 56
25 # if defined(__GNUC__) || defined(__clang__)
26 # define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__))
27 # define RESTRICT __restrict__
28 # define ALIGNED __attribute__((__aligned__(16)))
30 # define INLINE_UNUSED ossl_inline
37 } ALIGNED gf_s
, gf
[1];
39 /* RFC 7748 support */
40 # define X_PUBLIC_BYTES X_SER_BYTES
41 # define X_PRIVATE_BYTES X_PUBLIC_BYTES
42 # define X_PRIVATE_BITS 448
44 static INLINE_UNUSED
void gf_copy(gf out
, const gf a
)
49 static INLINE_UNUSED
void gf_add_RAW(gf out
, const gf a
, const gf b
);
50 static INLINE_UNUSED
void gf_sub_RAW(gf out
, const gf a
, const gf b
);
51 static INLINE_UNUSED
void gf_bias(gf inout
, int amount
);
52 static INLINE_UNUSED
void gf_weak_reduce(gf inout
);
54 void gf_strong_reduce(gf inout
);
55 void gf_add(gf out
, const gf a
, const gf b
);
56 void gf_sub(gf out
, const gf a
, const gf b
);
57 void gf_mul(gf_s
* RESTRICT out
, const gf a
, const gf b
);
58 void gf_mulw_unsigned(gf_s
* RESTRICT out
, const gf a
, uint32_t b
);
59 void gf_sqr(gf_s
* RESTRICT out
, const gf a
);
60 mask_t
gf_isr(gf a
, const gf x
); /** a^2 x = 1, QNR, or 0 if x=0. Return true if successful */
61 mask_t
gf_eq(const gf x
, const gf y
);
62 mask_t
gf_lobit(const gf x
);
63 mask_t
gf_hibit(const gf x
);
65 void gf_serialize(uint8_t *serial
, const gf x
, int with_highbit
);
66 mask_t
gf_deserialize(gf x
, const uint8_t serial
[SER_BYTES
], int with_hibit
,
70 # define LIMBPERM(i) (i)
71 # if (ARCH_WORD_BITS == 32)
72 # include "arch_32/f_impl.h" /* Bring in the inline implementations */
73 # define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1)
74 # elif (ARCH_WORD_BITS == 64)
75 # include "arch_64/f_impl.h" /* Bring in the inline implementations */
76 # define LIMB_MASK(i) (((1ULL)<<LIMB_PLACE_VALUE(i))-1)
79 static const gf ZERO
= {{{0}}}, ONE
= {{{1}}};
81 /* Square x, n times. */
82 static ossl_inline
void gf_sqrn(gf_s
* RESTRICT y
, const gf x
, int n
)
101 # define gf_add_nr gf_add_RAW
103 /* Subtract mod p. Bias by 2 and don't reduce */
104 static ossl_inline
void gf_sub_nr(gf c
, const gf a
, const gf b
)
112 /* Subtract mod p. Bias by amt but don't reduce. */
113 static ossl_inline
void gf_subx_nr(gf c
, const gf a
, const gf b
, int amt
)
117 if (GF_HEADROOM
< amt
+ 1)
121 /* Mul by signed int. Not constant-time WRT the sign of that int. */
122 static ossl_inline
void gf_mulw(gf c
, const gf a
, int32_t w
)
125 gf_mulw_unsigned(c
, a
, w
);
127 gf_mulw_unsigned(c
, a
, -w
);
132 /* Constant time, x = is_z ? z : y */
133 static ossl_inline
void gf_cond_sel(gf x
, const gf y
, const gf z
, mask_t is_z
)
137 for (i
= 0; i
< NLIMBS
; i
++) {
138 #if ARCH_WORD_BITS == 32
139 x
[0].limb
[i
] = constant_time_select_32(is_z
, z
[0].limb
[i
],
143 x
[0].limb
[i
] = constant_time_select_64(is_z
, z
[0].limb
[i
],
149 /* Constant time, if (neg) x=-x; */
150 static ossl_inline
void gf_cond_neg(gf x
, mask_t neg
)
155 gf_cond_sel(x
, x
, y
, neg
);
158 /* Constant time, if (swap) (x,y) = (y,x); */
159 static ossl_inline
void gf_cond_swap(gf x
, gf_s
* RESTRICT y
, mask_t swap
)
163 for (i
= 0; i
< NLIMBS
; i
++) {
164 #if ARCH_WORD_BITS == 32
165 constant_time_cond_swap_32(swap
, &(x
[0].limb
[i
]), &(y
->limb
[i
]));
168 constant_time_cond_swap_64(swap
, &(x
[0].limb
[i
]), &(y
->limb
[i
]));
173 #endif /* OSSL_CRYPTO_EC_CURVE448_FIELD_H */