mirror of
https://github.com/taigrr/arduinolibs
synced 2025-01-18 04:33:12 -08:00
1467 lines
210 KiB
HTML
1467 lines
210 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=9"/>
|
|
<meta name="generator" content="Doxygen 1.8.6"/>
|
|
<title>Arduino Cryptography Library: Curve25519.cpp Source File</title>
|
|
<link href="tabs.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="jquery.js"></script>
|
|
<script type="text/javascript" src="dynsections.js"></script>
|
|
<link href="search/search.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="search/search.js"></script>
|
|
<script type="text/javascript">
|
|
$(document).ready(function() { searchBox.OnSelectItem(0); });
|
|
</script>
|
|
<link href="doxygen.css" rel="stylesheet" type="text/css" />
|
|
</head>
|
|
<body>
|
|
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
|
|
<div id="titlearea">
|
|
<table cellspacing="0" cellpadding="0">
|
|
<tbody>
|
|
<tr style="height: 56px;">
|
|
<td style="padding-left: 0.5em;">
|
|
<div id="projectname">Arduino Cryptography Library
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<!-- end header part -->
|
|
<!-- Generated by Doxygen 1.8.6 -->
|
|
<script type="text/javascript">
|
|
var searchBox = new SearchBox("searchBox", "search",false,'Search');
|
|
</script>
|
|
<div id="navrow1" class="tabs">
|
|
<ul class="tablist">
|
|
<li><a href="index.html"><span>Main Page</span></a></li>
|
|
<li><a href="pages.html"><span>Related Pages</span></a></li>
|
|
<li><a href="annotated.html"><span>Classes</span></a></li>
|
|
<li class="current"><a href="files.html"><span>Files</span></a></li>
|
|
<li>
|
|
<div id="MSearchBox" class="MSearchBoxInactive">
|
|
<span class="left">
|
|
<img id="MSearchSelect" src="search/mag_sel.png"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
alt=""/>
|
|
<input type="text" id="MSearchField" value="Search" accesskey="S"
|
|
onfocus="searchBox.OnSearchFieldFocus(true)"
|
|
onblur="searchBox.OnSearchFieldFocus(false)"
|
|
onkeyup="searchBox.OnSearchFieldChange(event)"/>
|
|
</span><span class="right">
|
|
<a id="MSearchClose" href="javascript:searchBox.CloseResultsWindow()"><img id="MSearchCloseImg" border="0" src="search/close.png" alt=""/></a>
|
|
</span>
|
|
</div>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div id="navrow2" class="tabs2">
|
|
<ul class="tablist">
|
|
<li><a href="files.html"><span>File List</span></a></li>
|
|
</ul>
|
|
</div>
|
|
<!-- window showing the filter options -->
|
|
<div id="MSearchSelectWindow"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
onkeydown="return searchBox.OnSearchSelectKey(event)">
|
|
<a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(0)"><span class="SelectionMark"> </span>All</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(1)"><span class="SelectionMark"> </span>Classes</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(2)"><span class="SelectionMark"> </span>Files</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(3)"><span class="SelectionMark"> </span>Functions</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(4)"><span class="SelectionMark"> </span>Variables</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(5)"><span class="SelectionMark"> </span>Enumerations</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(6)"><span class="SelectionMark"> </span>Enumerator</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(7)"><span class="SelectionMark"> </span>Pages</a></div>
|
|
|
|
<!-- iframe showing the search results (closed by default) -->
|
|
<div id="MSearchResultsWindow">
|
|
<iframe src="javascript:void(0)" frameborder="0"
|
|
name="MSearchResults" id="MSearchResults">
|
|
</iframe>
|
|
</div>
|
|
|
|
<div id="nav-path" class="navpath">
|
|
<ul>
|
|
<li class="navelem"><a class="el" href="dir_bc0718b08fb2015b8e59c47b2805f60c.html">libraries</a></li><li class="navelem"><a class="el" href="dir_e2ce51835550ba18edf07a8311722290.html">Crypto</a></li> </ul>
|
|
</div>
|
|
</div><!-- top -->
|
|
<div class="header">
|
|
<div class="headertitle">
|
|
<div class="title">Curve25519.cpp</div> </div>
|
|
</div><!--header-->
|
|
<div class="contents">
|
|
<div class="fragment"><div class="line"><a name="l00001"></a><span class="lineno"> 1</span> <span class="comment">/*</span></div>
|
|
<div class="line"><a name="l00002"></a><span class="lineno"> 2</span> <span class="comment"> * Copyright (C) 2015 Southern Storm Software, Pty Ltd.</span></div>
|
|
<div class="line"><a name="l00003"></a><span class="lineno"> 3</span> <span class="comment"> *</span></div>
|
|
<div class="line"><a name="l00004"></a><span class="lineno"> 4</span> <span class="comment"> * Permission is hereby granted, free of charge, to any person obtaining a</span></div>
|
|
<div class="line"><a name="l00005"></a><span class="lineno"> 5</span> <span class="comment"> * copy of this software and associated documentation files (the "Software"),</span></div>
|
|
<div class="line"><a name="l00006"></a><span class="lineno"> 6</span> <span class="comment"> * to deal in the Software without restriction, including without limitation</span></div>
|
|
<div class="line"><a name="l00007"></a><span class="lineno"> 7</span> <span class="comment"> * the rights to use, copy, modify, merge, publish, distribute, sublicense,</span></div>
|
|
<div class="line"><a name="l00008"></a><span class="lineno"> 8</span> <span class="comment"> * and/or sell copies of the Software, and to permit persons to whom the</span></div>
|
|
<div class="line"><a name="l00009"></a><span class="lineno"> 9</span> <span class="comment"> * Software is furnished to do so, subject to the following conditions:</span></div>
|
|
<div class="line"><a name="l00010"></a><span class="lineno"> 10</span> <span class="comment"> *</span></div>
|
|
<div class="line"><a name="l00011"></a><span class="lineno"> 11</span> <span class="comment"> * The above copyright notice and this permission notice shall be included</span></div>
|
|
<div class="line"><a name="l00012"></a><span class="lineno"> 12</span> <span class="comment"> * in all copies or substantial portions of the Software.</span></div>
|
|
<div class="line"><a name="l00013"></a><span class="lineno"> 13</span> <span class="comment"> *</span></div>
|
|
<div class="line"><a name="l00014"></a><span class="lineno"> 14</span> <span class="comment"> * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS</span></div>
|
|
<div class="line"><a name="l00015"></a><span class="lineno"> 15</span> <span class="comment"> * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,</span></div>
|
|
<div class="line"><a name="l00016"></a><span class="lineno"> 16</span> <span class="comment"> * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE</span></div>
|
|
<div class="line"><a name="l00017"></a><span class="lineno"> 17</span> <span class="comment"> * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER</span></div>
|
|
<div class="line"><a name="l00018"></a><span class="lineno"> 18</span> <span class="comment"> * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING</span></div>
|
|
<div class="line"><a name="l00019"></a><span class="lineno"> 19</span> <span class="comment"> * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER</span></div>
|
|
<div class="line"><a name="l00020"></a><span class="lineno"> 20</span> <span class="comment"> * DEALINGS IN THE SOFTWARE.</span></div>
|
|
<div class="line"><a name="l00021"></a><span class="lineno"> 21</span> <span class="comment"> */</span></div>
|
|
<div class="line"><a name="l00022"></a><span class="lineno"> 22</span> </div>
|
|
<div class="line"><a name="l00023"></a><span class="lineno"> 23</span> <span class="preprocessor">#include "Curve25519.h"</span></div>
|
|
<div class="line"><a name="l00024"></a><span class="lineno"> 24</span> <span class="preprocessor">#include "Crypto.h"</span></div>
|
|
<div class="line"><a name="l00025"></a><span class="lineno"> 25</span> <span class="preprocessor">#include "RNG.h"</span></div>
|
|
<div class="line"><a name="l00026"></a><span class="lineno"> 26</span> <span class="preprocessor">#include "utility/LimbUtil.h"</span></div>
|
|
<div class="line"><a name="l00027"></a><span class="lineno"> 27</span> <span class="preprocessor">#include <string.h></span></div>
|
|
<div class="line"><a name="l00028"></a><span class="lineno"> 28</span> </div>
|
|
<div class="line"><a name="l00044"></a><span class="lineno"> 44</span> <span class="comment">// Global switch to enable/disable AVR inline assembly optimizations.</span></div>
|
|
<div class="line"><a name="l00045"></a><span class="lineno"> 45</span> <span class="preprocessor">#if defined(__AVR__)</span></div>
|
|
<div class="line"><a name="l00046"></a><span class="lineno"> 46</span> <span class="preprocessor"></span><span class="comment">// Disabled for now - there are issues with newer Arduino compilers. FIXME</span></div>
|
|
<div class="line"><a name="l00047"></a><span class="lineno"> 47</span> <span class="comment">//#define CURVE25519_ASM_AVR 1</span></div>
|
|
<div class="line"><a name="l00048"></a><span class="lineno"> 48</span> <span class="preprocessor">#endif</span></div>
|
|
<div class="line"><a name="l00049"></a><span class="lineno"> 49</span> <span class="preprocessor"></span></div>
|
|
<div class="line"><a name="l00050"></a><span class="lineno"> 50</span> <span class="comment">// The overhead of clean() calls in mul(), reduceQuick(), etc can</span></div>
|
|
<div class="line"><a name="l00051"></a><span class="lineno"> 51</span> <span class="comment">// add up to a lot of processing time during eval(). Only do such</span></div>
|
|
<div class="line"><a name="l00052"></a><span class="lineno"> 52</span> <span class="comment">// cleanups if strict mode has been enabled. Other implementations</span></div>
|
|
<div class="line"><a name="l00053"></a><span class="lineno"> 53</span> <span class="comment">// like curve25519-donna don't do any cleaning at all so the value</span></div>
|
|
<div class="line"><a name="l00054"></a><span class="lineno"> 54</span> <span class="comment">// of cleaning up the stack is dubious at best anyway.</span></div>
|
|
<div class="line"><a name="l00055"></a><span class="lineno"> 55</span> <span class="preprocessor">#if defined(CURVE25519_STRICT_CLEAN)</span></div>
|
|
<div class="line"><a name="l00056"></a><span class="lineno"> 56</span> <span class="preprocessor"></span><span class="preprocessor">#define strict_clean(x) clean(x)</span></div>
|
|
<div class="line"><a name="l00057"></a><span class="lineno"> 57</span> <span class="preprocessor"></span><span class="preprocessor">#else</span></div>
|
|
<div class="line"><a name="l00058"></a><span class="lineno"> 58</span> <span class="preprocessor"></span><span class="preprocessor">#define strict_clean(x) do { ; } while (0)</span></div>
|
|
<div class="line"><a name="l00059"></a><span class="lineno"> 59</span> <span class="preprocessor"></span><span class="preprocessor">#endif</span></div>
|
|
<div class="line"><a name="l00060"></a><span class="lineno"> 60</span> <span class="preprocessor"></span></div>
|
|
<div class="line"><a name="l00080"></a><span class="lineno"><a class="line" href="classCurve25519.html#a2e4b7dd83a019b32c76584c99bfda21a"> 80</a></span> <span class="keywordtype">bool</span> <a class="code" href="classCurve25519.html#a2e4b7dd83a019b32c76584c99bfda21a">Curve25519::eval</a>(uint8_t result[32], <span class="keyword">const</span> uint8_t s[32], <span class="keyword">const</span> uint8_t x[32])</div>
|
|
<div class="line"><a name="l00081"></a><span class="lineno"> 81</span> {</div>
|
|
<div class="line"><a name="l00082"></a><span class="lineno"> 82</span>  limb_t x_1[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00083"></a><span class="lineno"> 83</span>  limb_t x_2[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00084"></a><span class="lineno"> 84</span>  limb_t x_3[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00085"></a><span class="lineno"> 85</span>  limb_t z_2[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00086"></a><span class="lineno"> 86</span>  limb_t z_3[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00087"></a><span class="lineno"> 87</span>  limb_t A[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00088"></a><span class="lineno"> 88</span>  limb_t B[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00089"></a><span class="lineno"> 89</span>  limb_t C[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00090"></a><span class="lineno"> 90</span>  limb_t D[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00091"></a><span class="lineno"> 91</span>  limb_t E[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00092"></a><span class="lineno"> 92</span>  limb_t AA[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00093"></a><span class="lineno"> 93</span>  limb_t BB[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00094"></a><span class="lineno"> 94</span>  limb_t DA[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00095"></a><span class="lineno"> 95</span>  limb_t CB[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00096"></a><span class="lineno"> 96</span>  uint8_t mask;</div>
|
|
<div class="line"><a name="l00097"></a><span class="lineno"> 97</span>  uint8_t sposn;</div>
|
|
<div class="line"><a name="l00098"></a><span class="lineno"> 98</span>  uint8_t select;</div>
|
|
<div class="line"><a name="l00099"></a><span class="lineno"> 99</span>  uint8_t swap;</div>
|
|
<div class="line"><a name="l00100"></a><span class="lineno"> 100</span>  <span class="keywordtype">bool</span> retval;</div>
|
|
<div class="line"><a name="l00101"></a><span class="lineno"> 101</span> </div>
|
|
<div class="line"><a name="l00102"></a><span class="lineno"> 102</span>  <span class="comment">// Unpack the "x" argument into the limb representation</span></div>
|
|
<div class="line"><a name="l00103"></a><span class="lineno"> 103</span>  <span class="comment">// which also masks off the high bit. NULL means 9.</span></div>
|
|
<div class="line"><a name="l00104"></a><span class="lineno"> 104</span>  <span class="keywordflow">if</span> (x) {</div>
|
|
<div class="line"><a name="l00105"></a><span class="lineno"> 105</span>  <span class="comment">// x1 = x</span></div>
|
|
<div class="line"><a name="l00106"></a><span class="lineno"> 106</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(x_1, NUM_LIMBS_256BIT, x, 32);</div>
|
|
<div class="line"><a name="l00107"></a><span class="lineno"> 107</span>  x_1[NUM_LIMBS_256BIT - 1] &= ((((limb_t)1) << (LIMB_BITS - 1)) - 1);</div>
|
|
<div class="line"><a name="l00108"></a><span class="lineno"> 108</span>  } <span class="keywordflow">else</span> {</div>
|
|
<div class="line"><a name="l00109"></a><span class="lineno"> 109</span>  memset(x_1, 0, <span class="keyword">sizeof</span>(x_1)); <span class="comment">// x_1 = 9</span></div>
|
|
<div class="line"><a name="l00110"></a><span class="lineno"> 110</span>  x_1[0] = 9;</div>
|
|
<div class="line"><a name="l00111"></a><span class="lineno"> 111</span>  }</div>
|
|
<div class="line"><a name="l00112"></a><span class="lineno"> 112</span> </div>
|
|
<div class="line"><a name="l00113"></a><span class="lineno"> 113</span>  <span class="comment">// Check that "x" is within the range of the modulo field.</span></div>
|
|
<div class="line"><a name="l00114"></a><span class="lineno"> 114</span>  <span class="comment">// We can do this with a reduction - if there was no borrow</span></div>
|
|
<div class="line"><a name="l00115"></a><span class="lineno"> 115</span>  <span class="comment">// then the value of "x" was out of range. Timing is sensitive</span></div>
|
|
<div class="line"><a name="l00116"></a><span class="lineno"> 116</span>  <span class="comment">// here so that we don't reveal anything about the value of "x".</span></div>
|
|
<div class="line"><a name="l00117"></a><span class="lineno"> 117</span>  <span class="comment">// If there was a reduction, then continue executing the rest</span></div>
|
|
<div class="line"><a name="l00118"></a><span class="lineno"> 118</span>  <span class="comment">// of this function with the (now) in-range "x" value and</span></div>
|
|
<div class="line"><a name="l00119"></a><span class="lineno"> 119</span>  <span class="comment">// report the failure at the end.</span></div>
|
|
<div class="line"><a name="l00120"></a><span class="lineno"> 120</span>  retval = (bool)(reduceQuick(x_1) & 0x01);</div>
|
|
<div class="line"><a name="l00121"></a><span class="lineno"> 121</span> </div>
|
|
<div class="line"><a name="l00122"></a><span class="lineno"> 122</span>  <span class="comment">// Initialize the other temporary variables.</span></div>
|
|
<div class="line"><a name="l00123"></a><span class="lineno"> 123</span>  memset(x_2, 0, <span class="keyword">sizeof</span>(x_2)); <span class="comment">// x_2 = 1</span></div>
|
|
<div class="line"><a name="l00124"></a><span class="lineno"> 124</span>  x_2[0] = 1;</div>
|
|
<div class="line"><a name="l00125"></a><span class="lineno"> 125</span>  memset(z_2, 0, <span class="keyword">sizeof</span>(z_2)); <span class="comment">// z_2 = 0</span></div>
|
|
<div class="line"><a name="l00126"></a><span class="lineno"> 126</span>  memcpy(x_3, x_1, <span class="keyword">sizeof</span>(x_1)); <span class="comment">// x_3 = x</span></div>
|
|
<div class="line"><a name="l00127"></a><span class="lineno"> 127</span>  memcpy(z_3, x_2, <span class="keyword">sizeof</span>(x_2)); <span class="comment">// z_3 = 1</span></div>
|
|
<div class="line"><a name="l00128"></a><span class="lineno"> 128</span> </div>
|
|
<div class="line"><a name="l00129"></a><span class="lineno"> 129</span>  <span class="comment">// Iterate over all 255 bits of "s" from the highest to the lowest.</span></div>
|
|
<div class="line"><a name="l00130"></a><span class="lineno"> 130</span>  <span class="comment">// We ignore the high bit of the 256-bit representation of "s".</span></div>
|
|
<div class="line"><a name="l00131"></a><span class="lineno"> 131</span>  mask = 0x40;</div>
|
|
<div class="line"><a name="l00132"></a><span class="lineno"> 132</span>  sposn = 31;</div>
|
|
<div class="line"><a name="l00133"></a><span class="lineno"> 133</span>  swap = 0;</div>
|
|
<div class="line"><a name="l00134"></a><span class="lineno"> 134</span>  <span class="keywordflow">for</span> (uint8_t t = 255; t > 0; --t) {</div>
|
|
<div class="line"><a name="l00135"></a><span class="lineno"> 135</span>  <span class="comment">// Conditional swaps on entry to this bit but only if we</span></div>
|
|
<div class="line"><a name="l00136"></a><span class="lineno"> 136</span>  <span class="comment">// didn't swap on the previous bit.</span></div>
|
|
<div class="line"><a name="l00137"></a><span class="lineno"> 137</span>  select = s[sposn] & mask;</div>
|
|
<div class="line"><a name="l00138"></a><span class="lineno"> 138</span>  swap ^= select;</div>
|
|
<div class="line"><a name="l00139"></a><span class="lineno"> 139</span>  cswap(swap, x_2, x_3);</div>
|
|
<div class="line"><a name="l00140"></a><span class="lineno"> 140</span>  cswap(swap, z_2, z_3);</div>
|
|
<div class="line"><a name="l00141"></a><span class="lineno"> 141</span> </div>
|
|
<div class="line"><a name="l00142"></a><span class="lineno"> 142</span>  <span class="comment">// Evaluate the curve.</span></div>
|
|
<div class="line"><a name="l00143"></a><span class="lineno"> 143</span>  add(A, x_2, z_2); <span class="comment">// A = x_2 + z_2</span></div>
|
|
<div class="line"><a name="l00144"></a><span class="lineno"> 144</span>  square(AA, A); <span class="comment">// AA = A^2</span></div>
|
|
<div class="line"><a name="l00145"></a><span class="lineno"> 145</span>  sub(B, x_2, z_2); <span class="comment">// B = x_2 - z_2</span></div>
|
|
<div class="line"><a name="l00146"></a><span class="lineno"> 146</span>  square(BB, B); <span class="comment">// BB = B^2</span></div>
|
|
<div class="line"><a name="l00147"></a><span class="lineno"> 147</span>  sub(E, AA, BB); <span class="comment">// E = AA - BB</span></div>
|
|
<div class="line"><a name="l00148"></a><span class="lineno"> 148</span>  add(C, x_3, z_3); <span class="comment">// C = x_3 + z_3</span></div>
|
|
<div class="line"><a name="l00149"></a><span class="lineno"> 149</span>  sub(D, x_3, z_3); <span class="comment">// D = x_3 - z_3</span></div>
|
|
<div class="line"><a name="l00150"></a><span class="lineno"> 150</span>  mul(DA, D, A); <span class="comment">// DA = D * A</span></div>
|
|
<div class="line"><a name="l00151"></a><span class="lineno"> 151</span>  mul(CB, C, B); <span class="comment">// CB = C * B</span></div>
|
|
<div class="line"><a name="l00152"></a><span class="lineno"> 152</span>  add(x_3, DA, CB); <span class="comment">// x_3 = (DA + CB)^2</span></div>
|
|
<div class="line"><a name="l00153"></a><span class="lineno"> 153</span>  square(x_3, x_3);</div>
|
|
<div class="line"><a name="l00154"></a><span class="lineno"> 154</span>  sub(z_3, DA, CB); <span class="comment">// z_3 = x_1 * (DA - CB)^2</span></div>
|
|
<div class="line"><a name="l00155"></a><span class="lineno"> 155</span>  square(z_3, z_3);</div>
|
|
<div class="line"><a name="l00156"></a><span class="lineno"> 156</span>  mul(z_3, z_3, x_1);</div>
|
|
<div class="line"><a name="l00157"></a><span class="lineno"> 157</span>  mul(x_2, AA, BB); <span class="comment">// x_2 = AA * BB</span></div>
|
|
<div class="line"><a name="l00158"></a><span class="lineno"> 158</span>  mulA24(z_2, E); <span class="comment">// z_2 = E * (AA + a24 * E)</span></div>
|
|
<div class="line"><a name="l00159"></a><span class="lineno"> 159</span>  add(z_2, z_2, AA);</div>
|
|
<div class="line"><a name="l00160"></a><span class="lineno"> 160</span>  mul(z_2, z_2, E);</div>
|
|
<div class="line"><a name="l00161"></a><span class="lineno"> 161</span> </div>
|
|
<div class="line"><a name="l00162"></a><span class="lineno"> 162</span>  <span class="comment">// Move onto the next lower bit of "s".</span></div>
|
|
<div class="line"><a name="l00163"></a><span class="lineno"> 163</span>  mask >>= 1;</div>
|
|
<div class="line"><a name="l00164"></a><span class="lineno"> 164</span>  <span class="keywordflow">if</span> (!mask) {</div>
|
|
<div class="line"><a name="l00165"></a><span class="lineno"> 165</span>  --sposn;</div>
|
|
<div class="line"><a name="l00166"></a><span class="lineno"> 166</span>  mask = 0x80;</div>
|
|
<div class="line"><a name="l00167"></a><span class="lineno"> 167</span>  swap = select << 7;</div>
|
|
<div class="line"><a name="l00168"></a><span class="lineno"> 168</span>  } <span class="keywordflow">else</span> {</div>
|
|
<div class="line"><a name="l00169"></a><span class="lineno"> 169</span>  swap = select >> 1;</div>
|
|
<div class="line"><a name="l00170"></a><span class="lineno"> 170</span>  }</div>
|
|
<div class="line"><a name="l00171"></a><span class="lineno"> 171</span>  }</div>
|
|
<div class="line"><a name="l00172"></a><span class="lineno"> 172</span> </div>
|
|
<div class="line"><a name="l00173"></a><span class="lineno"> 173</span>  <span class="comment">// Final conditional swaps.</span></div>
|
|
<div class="line"><a name="l00174"></a><span class="lineno"> 174</span>  cswap(swap, x_2, x_3);</div>
|
|
<div class="line"><a name="l00175"></a><span class="lineno"> 175</span>  cswap(swap, z_2, z_3);</div>
|
|
<div class="line"><a name="l00176"></a><span class="lineno"> 176</span> </div>
|
|
<div class="line"><a name="l00177"></a><span class="lineno"> 177</span>  <span class="comment">// Compute x_2 * (z_2 ^ (p - 2)) where p = 2^255 - 19.</span></div>
|
|
<div class="line"><a name="l00178"></a><span class="lineno"> 178</span>  recip(z_3, z_2);</div>
|
|
<div class="line"><a name="l00179"></a><span class="lineno"> 179</span>  mul(x_2, x_2, z_3);</div>
|
|
<div class="line"><a name="l00180"></a><span class="lineno"> 180</span> </div>
|
|
<div class="line"><a name="l00181"></a><span class="lineno"> 181</span>  <span class="comment">// Pack the result into the return array.</span></div>
|
|
<div class="line"><a name="l00182"></a><span class="lineno"> 182</span>  <a class="code" href="classBigNumberUtil.html#a989cd5f389ac5adc798d8767383e2810">BigNumberUtil::packLE</a>(result, 32, x_2, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00183"></a><span class="lineno"> 183</span> </div>
|
|
<div class="line"><a name="l00184"></a><span class="lineno"> 184</span>  <span class="comment">// Clean up and exit.</span></div>
|
|
<div class="line"><a name="l00185"></a><span class="lineno"> 185</span>  clean(x_1);</div>
|
|
<div class="line"><a name="l00186"></a><span class="lineno"> 186</span>  clean(x_2);</div>
|
|
<div class="line"><a name="l00187"></a><span class="lineno"> 187</span>  clean(x_3);</div>
|
|
<div class="line"><a name="l00188"></a><span class="lineno"> 188</span>  clean(z_2);</div>
|
|
<div class="line"><a name="l00189"></a><span class="lineno"> 189</span>  clean(z_3);</div>
|
|
<div class="line"><a name="l00190"></a><span class="lineno"> 190</span>  clean(A);</div>
|
|
<div class="line"><a name="l00191"></a><span class="lineno"> 191</span>  clean(B);</div>
|
|
<div class="line"><a name="l00192"></a><span class="lineno"> 192</span>  clean(C);</div>
|
|
<div class="line"><a name="l00193"></a><span class="lineno"> 193</span>  clean(D);</div>
|
|
<div class="line"><a name="l00194"></a><span class="lineno"> 194</span>  clean(E);</div>
|
|
<div class="line"><a name="l00195"></a><span class="lineno"> 195</span>  clean(AA);</div>
|
|
<div class="line"><a name="l00196"></a><span class="lineno"> 196</span>  clean(BB);</div>
|
|
<div class="line"><a name="l00197"></a><span class="lineno"> 197</span>  clean(DA);</div>
|
|
<div class="line"><a name="l00198"></a><span class="lineno"> 198</span>  clean(CB);</div>
|
|
<div class="line"><a name="l00199"></a><span class="lineno"> 199</span>  <span class="keywordflow">return</span> retval;</div>
|
|
<div class="line"><a name="l00200"></a><span class="lineno"> 200</span> }</div>
|
|
<div class="line"><a name="l00201"></a><span class="lineno"> 201</span> </div>
|
|
<div class="line"><a name="l00245"></a><span class="lineno"><a class="line" href="classCurve25519.html#a2b6911583d17ea9a36bbbb40d58b3d89"> 245</a></span> <span class="keywordtype">void</span> <a class="code" href="classCurve25519.html#a2b6911583d17ea9a36bbbb40d58b3d89">Curve25519::dh1</a>(uint8_t k[32], uint8_t f[32])</div>
|
|
<div class="line"><a name="l00246"></a><span class="lineno"> 246</span> {</div>
|
|
<div class="line"><a name="l00247"></a><span class="lineno"> 247</span>  <span class="keywordflow">do</span> {</div>
|
|
<div class="line"><a name="l00248"></a><span class="lineno"> 248</span>  <span class="comment">// Generate a random "f" value and then adjust the value to make</span></div>
|
|
<div class="line"><a name="l00249"></a><span class="lineno"> 249</span>  <span class="comment">// it valid as an "s" value for eval(). According to the specification</span></div>
|
|
<div class="line"><a name="l00250"></a><span class="lineno"> 250</span>  <span class="comment">// we need to mask off the 3 right-most bits of f[0], mask off the</span></div>
|
|
<div class="line"><a name="l00251"></a><span class="lineno"> 251</span>  <span class="comment">// left-most bit of f[31], and set the second to left-most bit of f[31].</span></div>
|
|
<div class="line"><a name="l00252"></a><span class="lineno"> 252</span>  RNG.<a class="code" href="classRNGClass.html#a418a833cf18198fd7e5d6dbd78c99c29">rand</a>(f, 32);</div>
|
|
<div class="line"><a name="l00253"></a><span class="lineno"> 253</span>  f[0] &= 0xF8;</div>
|
|
<div class="line"><a name="l00254"></a><span class="lineno"> 254</span>  f[31] = (f[31] & 0x7F) | 0x40;</div>
|
|
<div class="line"><a name="l00255"></a><span class="lineno"> 255</span> </div>
|
|
<div class="line"><a name="l00256"></a><span class="lineno"> 256</span>  <span class="comment">// Evaluate the curve function: k = Curve25519::eval(f, 9).</span></div>
|
|
<div class="line"><a name="l00257"></a><span class="lineno"> 257</span>  <span class="comment">// We pass NULL to eval() to indicate the value 9. There is no</span></div>
|
|
<div class="line"><a name="l00258"></a><span class="lineno"> 258</span>  <span class="comment">// need to check the return value from eval() because we know</span></div>
|
|
<div class="line"><a name="l00259"></a><span class="lineno"> 259</span>  <span class="comment">// that 9 is a valid field element.</span></div>
|
|
<div class="line"><a name="l00260"></a><span class="lineno"> 260</span>  <a class="code" href="classCurve25519.html#a2e4b7dd83a019b32c76584c99bfda21a">eval</a>(k, f, 0);</div>
|
|
<div class="line"><a name="l00261"></a><span class="lineno"> 261</span> </div>
|
|
<div class="line"><a name="l00262"></a><span class="lineno"> 262</span>  <span class="comment">// If "k" is weak for contributory behaviour then reject it,</span></div>
|
|
<div class="line"><a name="l00263"></a><span class="lineno"> 263</span>  <span class="comment">// generate another "f" value, and try again. This case is</span></div>
|
|
<div class="line"><a name="l00264"></a><span class="lineno"> 264</span>  <span class="comment">// highly unlikely but we still perform the check just in case.</span></div>
|
|
<div class="line"><a name="l00265"></a><span class="lineno"> 265</span>  } <span class="keywordflow">while</span> (isWeakPoint(k));</div>
|
|
<div class="line"><a name="l00266"></a><span class="lineno"> 266</span> }</div>
|
|
<div class="line"><a name="l00267"></a><span class="lineno"> 267</span> </div>
|
|
<div class="line"><a name="l00283"></a><span class="lineno"><a class="line" href="classCurve25519.html#a14022d6ac68ec691ffb0247275078ab9"> 283</a></span> <span class="keywordtype">bool</span> <a class="code" href="classCurve25519.html#a14022d6ac68ec691ffb0247275078ab9">Curve25519::dh2</a>(uint8_t k[32], uint8_t f[32])</div>
|
|
<div class="line"><a name="l00284"></a><span class="lineno"> 284</span> {</div>
|
|
<div class="line"><a name="l00285"></a><span class="lineno"> 285</span>  uint8_t weak;</div>
|
|
<div class="line"><a name="l00286"></a><span class="lineno"> 286</span> </div>
|
|
<div class="line"><a name="l00287"></a><span class="lineno"> 287</span>  <span class="comment">// Evaluate the curve function: k = Curve25519::eval(f, k).</span></div>
|
|
<div class="line"><a name="l00288"></a><span class="lineno"> 288</span>  <span class="comment">// If "k" is weak for contributory behaviour before or after</span></div>
|
|
<div class="line"><a name="l00289"></a><span class="lineno"> 289</span>  <span class="comment">// the curve evaluation, then fail the exchange. For safety</span></div>
|
|
<div class="line"><a name="l00290"></a><span class="lineno"> 290</span>  <span class="comment">// we perform every phase of the weak checks even if we could</span></div>
|
|
<div class="line"><a name="l00291"></a><span class="lineno"> 291</span>  <span class="comment">// bail out earlier so that the execution takes the same</span></div>
|
|
<div class="line"><a name="l00292"></a><span class="lineno"> 292</span>  <span class="comment">// amount of time for weak and non-weak "k" values.</span></div>
|
|
<div class="line"><a name="l00293"></a><span class="lineno"> 293</span>  weak = isWeakPoint(k); <span class="comment">// Is "k" weak before?</span></div>
|
|
<div class="line"><a name="l00294"></a><span class="lineno"> 294</span>  weak |= ((<a class="code" href="classCurve25519.html#a2e4b7dd83a019b32c76584c99bfda21a">eval</a>(k, f, k) ^ 0x01) & 0x01); <span class="comment">// Is "k" weak during?</span></div>
|
|
<div class="line"><a name="l00295"></a><span class="lineno"> 295</span>  weak |= isWeakPoint(k); <span class="comment">// Is "k" weak after?</span></div>
|
|
<div class="line"><a name="l00296"></a><span class="lineno"> 296</span>  clean(f, 32);</div>
|
|
<div class="line"><a name="l00297"></a><span class="lineno"> 297</span>  <span class="keywordflow">return</span> (<span class="keywordtype">bool</span>)((weak ^ 0x01) & 0x01);</div>
|
|
<div class="line"><a name="l00298"></a><span class="lineno"> 298</span> }</div>
|
|
<div class="line"><a name="l00299"></a><span class="lineno"> 299</span> </div>
|
|
<div class="line"><a name="l00307"></a><span class="lineno"> 307</span> uint8_t Curve25519::isWeakPoint(<span class="keyword">const</span> uint8_t k[32])</div>
|
|
<div class="line"><a name="l00308"></a><span class="lineno"> 308</span> {</div>
|
|
<div class="line"><a name="l00309"></a><span class="lineno"> 309</span>  <span class="comment">// List of weak points from http://cr.yp.to/ecdh.html</span></div>
|
|
<div class="line"><a name="l00310"></a><span class="lineno"> 310</span>  <span class="comment">// That page lists some others but they are variants on these</span></div>
|
|
<div class="line"><a name="l00311"></a><span class="lineno"> 311</span>  <span class="comment">// of the form "point + i * (2^255 - 19)" for i = 0, 1, 2.</span></div>
|
|
<div class="line"><a name="l00312"></a><span class="lineno"> 312</span>  <span class="comment">// Here we mask off the high bit and eval() catches the rest.</span></div>
|
|
<div class="line"><a name="l00313"></a><span class="lineno"> 313</span>  <span class="keyword">static</span> <span class="keyword">const</span> uint8_t points[5][32] PROGMEM = {</div>
|
|
<div class="line"><a name="l00314"></a><span class="lineno"> 314</span>  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,</div>
|
|
<div class="line"><a name="l00315"></a><span class="lineno"> 315</span>  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,</div>
|
|
<div class="line"><a name="l00316"></a><span class="lineno"> 316</span>  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,</div>
|
|
<div class="line"><a name="l00317"></a><span class="lineno"> 317</span>  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},</div>
|
|
<div class="line"><a name="l00318"></a><span class="lineno"> 318</span>  {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,</div>
|
|
<div class="line"><a name="l00319"></a><span class="lineno"> 319</span>  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,</div>
|
|
<div class="line"><a name="l00320"></a><span class="lineno"> 320</span>  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,</div>
|
|
<div class="line"><a name="l00321"></a><span class="lineno"> 321</span>  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},</div>
|
|
<div class="line"><a name="l00322"></a><span class="lineno"> 322</span>  {0xE0, 0xEB, 0x7A, 0x7C, 0x3B, 0x41, 0xB8, 0xAE,</div>
|
|
<div class="line"><a name="l00323"></a><span class="lineno"> 323</span>  0x16, 0x56, 0xE3, 0xFA, 0xF1, 0x9F, 0xC4, 0x6A,</div>
|
|
<div class="line"><a name="l00324"></a><span class="lineno"> 324</span>  0xDA, 0x09, 0x8D, 0xEB, 0x9C, 0x32, 0xB1, 0xFD,</div>
|
|
<div class="line"><a name="l00325"></a><span class="lineno"> 325</span>  0x86, 0x62, 0x05, 0x16, 0x5F, 0x49, 0xB8, 0x00},</div>
|
|
<div class="line"><a name="l00326"></a><span class="lineno"> 326</span>  {0x5F, 0x9C, 0x95, 0xBC, 0xA3, 0x50, 0x8C, 0x24,</div>
|
|
<div class="line"><a name="l00327"></a><span class="lineno"> 327</span>  0xB1, 0xD0, 0xB1, 0x55, 0x9C, 0x83, 0xEF, 0x5B,</div>
|
|
<div class="line"><a name="l00328"></a><span class="lineno"> 328</span>  0x04, 0x44, 0x5C, 0xC4, 0x58, 0x1C, 0x8E, 0x86,</div>
|
|
<div class="line"><a name="l00329"></a><span class="lineno"> 329</span>  0xD8, 0x22, 0x4E, 0xDD, 0xD0, 0x9F, 0x11, 0x57},</div>
|
|
<div class="line"><a name="l00330"></a><span class="lineno"> 330</span>  {0xEC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,</div>
|
|
<div class="line"><a name="l00331"></a><span class="lineno"> 331</span>  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,</div>
|
|
<div class="line"><a name="l00332"></a><span class="lineno"> 332</span>  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,</div>
|
|
<div class="line"><a name="l00333"></a><span class="lineno"> 333</span>  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F}</div>
|
|
<div class="line"><a name="l00334"></a><span class="lineno"> 334</span>  };</div>
|
|
<div class="line"><a name="l00335"></a><span class="lineno"> 335</span> </div>
|
|
<div class="line"><a name="l00336"></a><span class="lineno"> 336</span>  <span class="comment">// Check each of the weak points in turn. We perform the</span></div>
|
|
<div class="line"><a name="l00337"></a><span class="lineno"> 337</span>  <span class="comment">// comparisons carefully so as not to reveal the value of "k"</span></div>
|
|
<div class="line"><a name="l00338"></a><span class="lineno"> 338</span>  <span class="comment">// in the instruction timing. If "k" is indeed weak then</span></div>
|
|
<div class="line"><a name="l00339"></a><span class="lineno"> 339</span>  <span class="comment">// we still check everything so as not to reveal which</span></div>
|
|
<div class="line"><a name="l00340"></a><span class="lineno"> 340</span>  <span class="comment">// weak point it is.</span></div>
|
|
<div class="line"><a name="l00341"></a><span class="lineno"> 341</span>  uint8_t result = 0;</div>
|
|
<div class="line"><a name="l00342"></a><span class="lineno"> 342</span>  <span class="keywordflow">for</span> (uint8_t posn = 0; posn < 5; ++posn) {</div>
|
|
<div class="line"><a name="l00343"></a><span class="lineno"> 343</span>  <span class="keyword">const</span> uint8_t *point = points[posn];</div>
|
|
<div class="line"><a name="l00344"></a><span class="lineno"> 344</span>  uint8_t check = (pgm_read_byte(&(point[31])) ^ k[31]) & 0x7F;</div>
|
|
<div class="line"><a name="l00345"></a><span class="lineno"> 345</span>  <span class="keywordflow">for</span> (uint8_t index = 31; index > 0; --index)</div>
|
|
<div class="line"><a name="l00346"></a><span class="lineno"> 346</span>  check |= (pgm_read_byte(&(point[index - 1])) ^ k[index - 1]);</div>
|
|
<div class="line"><a name="l00347"></a><span class="lineno"> 347</span>  result |= (uint8_t)((((uint16_t)0x0100) - check) >> 8);</div>
|
|
<div class="line"><a name="l00348"></a><span class="lineno"> 348</span>  }</div>
|
|
<div class="line"><a name="l00349"></a><span class="lineno"> 349</span> </div>
|
|
<div class="line"><a name="l00350"></a><span class="lineno"> 350</span>  <span class="comment">// The "result" variable will be non-zero if there was a match.</span></div>
|
|
<div class="line"><a name="l00351"></a><span class="lineno"> 351</span>  <span class="keywordflow">return</span> result;</div>
|
|
<div class="line"><a name="l00352"></a><span class="lineno"> 352</span> }</div>
|
|
<div class="line"><a name="l00353"></a><span class="lineno"> 353</span> </div>
|
|
<div class="line"><a name="l00366"></a><span class="lineno"> 366</span> <span class="keywordtype">void</span> Curve25519::reduce(limb_t *result, limb_t *x, uint8_t size)</div>
|
|
<div class="line"><a name="l00367"></a><span class="lineno"> 367</span> {</div>
|
|
<div class="line"><a name="l00368"></a><span class="lineno"> 368</span>  <span class="comment">/*</span></div>
|
|
<div class="line"><a name="l00369"></a><span class="lineno"> 369</span> <span class="comment"> Note: This explaination is best viewed with a UTF-8 text viewer.</span></div>
|
|
<div class="line"><a name="l00370"></a><span class="lineno"> 370</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00371"></a><span class="lineno"> 371</span> <span class="comment"> To help explain what this function is doing, the following describes</span></div>
|
|
<div class="line"><a name="l00372"></a><span class="lineno"> 372</span> <span class="comment"> how to efficiently compute reductions modulo a base of the form (2ⁿ - b)</span></div>
|
|
<div class="line"><a name="l00373"></a><span class="lineno"> 373</span> <span class="comment"> where b is greater than zero and (b + 1)² <= 2ⁿ.</span></div>
|
|
<div class="line"><a name="l00374"></a><span class="lineno"> 374</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00375"></a><span class="lineno"> 375</span> <span class="comment"> Here we are interested in reducing the result of multiplying two</span></div>
|
|
<div class="line"><a name="l00376"></a><span class="lineno"> 376</span> <span class="comment"> numbers that are less than or equal to (2ⁿ - b - 1). That is,</span></div>
|
|
<div class="line"><a name="l00377"></a><span class="lineno"> 377</span> <span class="comment"> multiplying numbers that have already been reduced.</span></div>
|
|
<div class="line"><a name="l00378"></a><span class="lineno"> 378</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00379"></a><span class="lineno"> 379</span> <span class="comment"> Given some x less than or equal to (2ⁿ - b - 1)², we want to find a</span></div>
|
|
<div class="line"><a name="l00380"></a><span class="lineno"> 380</span> <span class="comment"> y less than (2ⁿ - b) such that:</span></div>
|
|
<div class="line"><a name="l00381"></a><span class="lineno"> 381</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00382"></a><span class="lineno"> 382</span> <span class="comment"> y ≡ x mod (2ⁿ - b)</span></div>
|
|
<div class="line"><a name="l00383"></a><span class="lineno"> 383</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00384"></a><span class="lineno"> 384</span> <span class="comment"> We know that for all integer values of k >= 0:</span></div>
|
|
<div class="line"><a name="l00385"></a><span class="lineno"> 385</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00386"></a><span class="lineno"> 386</span> <span class="comment"> y ≡ x - k * (2ⁿ - b)</span></div>
|
|
<div class="line"><a name="l00387"></a><span class="lineno"> 387</span> <span class="comment"> ≡ x - k * 2ⁿ + k * b</span></div>
|
|
<div class="line"><a name="l00388"></a><span class="lineno"> 388</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00389"></a><span class="lineno"> 389</span> <span class="comment"> In our case we choose k = ⌊x / 2ⁿ⌋ and then let:</span></div>
|
|
<div class="line"><a name="l00390"></a><span class="lineno"> 390</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00391"></a><span class="lineno"> 391</span> <span class="comment"> w = (x mod 2ⁿ) + ⌊x / 2ⁿ⌋ * b</span></div>
|
|
<div class="line"><a name="l00392"></a><span class="lineno"> 392</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00393"></a><span class="lineno"> 393</span> <span class="comment"> The value w will either be the answer y or y can be obtained by</span></div>
|
|
<div class="line"><a name="l00394"></a><span class="lineno"> 394</span> <span class="comment"> repeatedly subtracting (2ⁿ - b) from w until it is less than (2ⁿ - b).</span></div>
|
|
<div class="line"><a name="l00395"></a><span class="lineno"> 395</span> <span class="comment"> At most b subtractions will be required.</span></div>
|
|
<div class="line"><a name="l00396"></a><span class="lineno"> 396</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00397"></a><span class="lineno"> 397</span> <span class="comment"> In our case b is 19 which is more subtractions than we would like to do,</span></div>
|
|
<div class="line"><a name="l00398"></a><span class="lineno"> 398</span> <span class="comment"> but we can handle that by performing the above reduction twice and then</span></div>
|
|
<div class="line"><a name="l00399"></a><span class="lineno"> 399</span> <span class="comment"> performing a single trial subtraction:</span></div>
|
|
<div class="line"><a name="l00400"></a><span class="lineno"> 400</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00401"></a><span class="lineno"> 401</span> <span class="comment"> w = (x mod 2ⁿ) + ⌊x / 2ⁿ⌋ * b</span></div>
|
|
<div class="line"><a name="l00402"></a><span class="lineno"> 402</span> <span class="comment"> y = (w mod 2ⁿ) + ⌊w / 2ⁿ⌋ * b</span></div>
|
|
<div class="line"><a name="l00403"></a><span class="lineno"> 403</span> <span class="comment"> if y >= (2ⁿ - b)</span></div>
|
|
<div class="line"><a name="l00404"></a><span class="lineno"> 404</span> <span class="comment"> y -= (2ⁿ - b)</span></div>
|
|
<div class="line"><a name="l00405"></a><span class="lineno"> 405</span> <span class="comment"></span></div>
|
|
<div class="line"><a name="l00406"></a><span class="lineno"> 406</span> <span class="comment"> The value y is the answer we want for reducing x modulo (2ⁿ - b).</span></div>
|
|
<div class="line"><a name="l00407"></a><span class="lineno"> 407</span> <span class="comment"> */</span></div>
|
|
<div class="line"><a name="l00408"></a><span class="lineno"> 408</span> </div>
|
|
<div class="line"><a name="l00409"></a><span class="lineno"> 409</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l00410"></a><span class="lineno"> 410</span> <span class="preprocessor"></span> dlimb_t carry;</div>
|
|
<div class="line"><a name="l00411"></a><span class="lineno"> 411</span>  uint8_t posn;</div>
|
|
<div class="line"><a name="l00412"></a><span class="lineno"> 412</span> </div>
|
|
<div class="line"><a name="l00413"></a><span class="lineno"> 413</span>  <span class="comment">// Calculate (x mod 2^255) + ((x / 2^255) * 19) which will</span></div>
|
|
<div class="line"><a name="l00414"></a><span class="lineno"> 414</span>  <span class="comment">// either produce the answer we want or it will produce a</span></div>
|
|
<div class="line"><a name="l00415"></a><span class="lineno"> 415</span>  <span class="comment">// value of the form "answer + j * (2^255 - 19)".</span></div>
|
|
<div class="line"><a name="l00416"></a><span class="lineno"> 416</span>  carry = ((dlimb_t)(x[NUM_LIMBS_256BIT - 1] >> (LIMB_BITS - 1))) * 19U;</div>
|
|
<div class="line"><a name="l00417"></a><span class="lineno"> 417</span>  x[NUM_LIMBS_256BIT - 1] &= ((((limb_t)1) << (LIMB_BITS - 1)) - 1);</div>
|
|
<div class="line"><a name="l00418"></a><span class="lineno"> 418</span>  <span class="keywordflow">for</span> (posn = 0; posn < size; ++posn) {</div>
|
|
<div class="line"><a name="l00419"></a><span class="lineno"> 419</span>  carry += ((dlimb_t)(x[posn + NUM_LIMBS_256BIT])) * 38U;</div>
|
|
<div class="line"><a name="l00420"></a><span class="lineno"> 420</span>  carry += x[posn];</div>
|
|
<div class="line"><a name="l00421"></a><span class="lineno"> 421</span>  x[posn] = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00422"></a><span class="lineno"> 422</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00423"></a><span class="lineno"> 423</span>  }</div>
|
|
<div class="line"><a name="l00424"></a><span class="lineno"> 424</span>  <span class="keywordflow">if</span> (size < NUM_LIMBS_256BIT) {</div>
|
|
<div class="line"><a name="l00425"></a><span class="lineno"> 425</span>  <span class="comment">// The high order half of the number is short; e.g. for mulA24().</span></div>
|
|
<div class="line"><a name="l00426"></a><span class="lineno"> 426</span>  <span class="comment">// Propagate the carry through the rest of the low order part.</span></div>
|
|
<div class="line"><a name="l00427"></a><span class="lineno"> 427</span>  <span class="keywordflow">for</span> (posn = size; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l00428"></a><span class="lineno"> 428</span>  carry += x[posn];</div>
|
|
<div class="line"><a name="l00429"></a><span class="lineno"> 429</span>  x[posn] = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00430"></a><span class="lineno"> 430</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00431"></a><span class="lineno"> 431</span>  }</div>
|
|
<div class="line"><a name="l00432"></a><span class="lineno"> 432</span>  }</div>
|
|
<div class="line"><a name="l00433"></a><span class="lineno"> 433</span> </div>
|
|
<div class="line"><a name="l00434"></a><span class="lineno"> 434</span>  <span class="comment">// The "j" value may still be too large due to the final carry-out.</span></div>
|
|
<div class="line"><a name="l00435"></a><span class="lineno"> 435</span>  <span class="comment">// We must repeat the reduction. If we already have the answer,</span></div>
|
|
<div class="line"><a name="l00436"></a><span class="lineno"> 436</span>  <span class="comment">// then this won't do any harm but we must still do the calculation</span></div>
|
|
<div class="line"><a name="l00437"></a><span class="lineno"> 437</span>  <span class="comment">// to preserve the overall timing.</span></div>
|
|
<div class="line"><a name="l00438"></a><span class="lineno"> 438</span>  carry *= 38U;</div>
|
|
<div class="line"><a name="l00439"></a><span class="lineno"> 439</span>  carry += ((dlimb_t)(x[NUM_LIMBS_256BIT - 1] >> (LIMB_BITS - 1))) * 19U;</div>
|
|
<div class="line"><a name="l00440"></a><span class="lineno"> 440</span>  x[NUM_LIMBS_256BIT - 1] &= ((((limb_t)1) << (LIMB_BITS - 1)) - 1);</div>
|
|
<div class="line"><a name="l00441"></a><span class="lineno"> 441</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l00442"></a><span class="lineno"> 442</span>  carry += x[posn];</div>
|
|
<div class="line"><a name="l00443"></a><span class="lineno"> 443</span>  x[posn] = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00444"></a><span class="lineno"> 444</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00445"></a><span class="lineno"> 445</span>  }</div>
|
|
<div class="line"><a name="l00446"></a><span class="lineno"> 446</span> </div>
|
|
<div class="line"><a name="l00447"></a><span class="lineno"> 447</span>  <span class="comment">// At this point "x" will either be the answer or it will be the</span></div>
|
|
<div class="line"><a name="l00448"></a><span class="lineno"> 448</span>  <span class="comment">// answer plus (2^255 - 19). Perform a trial subtraction which</span></div>
|
|
<div class="line"><a name="l00449"></a><span class="lineno"> 449</span>  <span class="comment">// is equivalent to adding 19 and subtracting 2^255. We put the</span></div>
|
|
<div class="line"><a name="l00450"></a><span class="lineno"> 450</span>  <span class="comment">// trial answer into the top-most limbs of the original "x" array.</span></div>
|
|
<div class="line"><a name="l00451"></a><span class="lineno"> 451</span>  <span class="comment">// We add 19 here; the subtraction of 2^255 occurs in the next step.</span></div>
|
|
<div class="line"><a name="l00452"></a><span class="lineno"> 452</span>  carry = 19U;</div>
|
|
<div class="line"><a name="l00453"></a><span class="lineno"> 453</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l00454"></a><span class="lineno"> 454</span>  carry += x[posn];</div>
|
|
<div class="line"><a name="l00455"></a><span class="lineno"> 455</span>  x[posn + NUM_LIMBS_256BIT] = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00456"></a><span class="lineno"> 456</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00457"></a><span class="lineno"> 457</span>  }</div>
|
|
<div class="line"><a name="l00458"></a><span class="lineno"> 458</span> </div>
|
|
<div class="line"><a name="l00459"></a><span class="lineno"> 459</span>  <span class="comment">// If there was a borrow, then the bottom-most limbs of "x" are the</span></div>
|
|
<div class="line"><a name="l00460"></a><span class="lineno"> 460</span>  <span class="comment">// correct answer. If there was no borrow, then the top-most limbs</span></div>
|
|
<div class="line"><a name="l00461"></a><span class="lineno"> 461</span>  <span class="comment">// of "x" are the correct answer. Select the correct answer but do</span></div>
|
|
<div class="line"><a name="l00462"></a><span class="lineno"> 462</span>  <span class="comment">// it in a way that instruction timing will not reveal which value</span></div>
|
|
<div class="line"><a name="l00463"></a><span class="lineno"> 463</span>  <span class="comment">// was selected. Borrow will occur if the high bit of the previous</span></div>
|
|
<div class="line"><a name="l00464"></a><span class="lineno"> 464</span>  <span class="comment">// result is 0: turn the high bit into a selection mask.</span></div>
|
|
<div class="line"><a name="l00465"></a><span class="lineno"> 465</span>  limb_t mask = (limb_t)(((slimb_t)(x[NUM_LIMBS_512BIT - 1])) >> (LIMB_BITS - 1));</div>
|
|
<div class="line"><a name="l00466"></a><span class="lineno"> 466</span>  limb_t nmask = ~mask;</div>
|
|
<div class="line"><a name="l00467"></a><span class="lineno"> 467</span>  x[NUM_LIMBS_512BIT - 1] &= ((((limb_t)1) << (LIMB_BITS - 1)) - 1);</div>
|
|
<div class="line"><a name="l00468"></a><span class="lineno"> 468</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l00469"></a><span class="lineno"> 469</span>  result[posn] = (x[posn] & nmask) | (x[posn + NUM_LIMBS_256BIT] & mask);</div>
|
|
<div class="line"><a name="l00470"></a><span class="lineno"> 470</span>  }</div>
|
|
<div class="line"><a name="l00471"></a><span class="lineno"> 471</span> <span class="preprocessor">#else</span></div>
|
|
<div class="line"><a name="l00472"></a><span class="lineno"> 472</span> <span class="preprocessor"></span> __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l00473"></a><span class="lineno"> 473</span>  <span class="comment">// Calculate (x mod 2^255) + ((x / 2^255) * 19) which will</span></div>
|
|
<div class="line"><a name="l00474"></a><span class="lineno"> 474</span>  <span class="comment">// either produce the answer we want or it will produce a</span></div>
|
|
<div class="line"><a name="l00475"></a><span class="lineno"> 475</span>  <span class="comment">// value of the form "answer + j * (2^255 - 19)".</span></div>
|
|
<div class="line"><a name="l00476"></a><span class="lineno"> 476</span>  <span class="stringliteral">"ldd r24,Z+31\n"</span> <span class="comment">// Extract the high bit of x[31]</span></div>
|
|
<div class="line"><a name="l00477"></a><span class="lineno"> 477</span>  <span class="stringliteral">"mov r25,r24\n"</span> <span class="comment">// and mask it off</span></div>
|
|
<div class="line"><a name="l00478"></a><span class="lineno"> 478</span>  <span class="stringliteral">"andi r25,0x7F\n"</span></div>
|
|
<div class="line"><a name="l00479"></a><span class="lineno"> 479</span>  <span class="stringliteral">"std Z+31,r25\n"</span></div>
|
|
<div class="line"><a name="l00480"></a><span class="lineno"> 480</span>  <span class="stringliteral">"lsl r24\n"</span> <span class="comment">// carry = high bit * 19</span></div>
|
|
<div class="line"><a name="l00481"></a><span class="lineno"> 481</span>  <span class="stringliteral">"mov r24,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00482"></a><span class="lineno"> 482</span>  <span class="stringliteral">"sbc r24,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00483"></a><span class="lineno"> 483</span>  <span class="stringliteral">"andi r24,19\n"</span></div>
|
|
<div class="line"><a name="l00484"></a><span class="lineno"> 484</span> </div>
|
|
<div class="line"><a name="l00485"></a><span class="lineno"> 485</span>  <span class="stringliteral">"mov r25,%1\n"</span> <span class="comment">// load "size" into r25</span></div>
|
|
<div class="line"><a name="l00486"></a><span class="lineno"> 486</span>  <span class="stringliteral">"ldi r23,38\n"</span> <span class="comment">// r23 = 38</span></div>
|
|
<div class="line"><a name="l00487"></a><span class="lineno"> 487</span>  <span class="stringliteral">"mov r22,__zero_reg__\n"</span> <span class="comment">// r22 = 0 (we're about to destroy r1)</span></div>
|
|
<div class="line"><a name="l00488"></a><span class="lineno"> 488</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l00489"></a><span class="lineno"> 489</span>  <span class="stringliteral">"ld r16,Z\n"</span> <span class="comment">// r16 = x[0]</span></div>
|
|
<div class="line"><a name="l00490"></a><span class="lineno"> 490</span>  <span class="stringliteral">"ldd r17,Z+32\n"</span> <span class="comment">// r17 = x[32]</span></div>
|
|
<div class="line"><a name="l00491"></a><span class="lineno"> 491</span>  <span class="stringliteral">"mul r17,r23\n"</span> <span class="comment">// r0:r1 = r17 * 38</span></div>
|
|
<div class="line"><a name="l00492"></a><span class="lineno"> 492</span>  <span class="stringliteral">"add r0,r24\n"</span> <span class="comment">// r0:r1 += carry</span></div>
|
|
<div class="line"><a name="l00493"></a><span class="lineno"> 493</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00494"></a><span class="lineno"> 494</span>  <span class="stringliteral">"add r0,r16\n"</span> <span class="comment">// r0:r1 += r16</span></div>
|
|
<div class="line"><a name="l00495"></a><span class="lineno"> 495</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00496"></a><span class="lineno"> 496</span>  <span class="stringliteral">"st Z+,r0\n"</span> <span class="comment">// *x++ = r0</span></div>
|
|
<div class="line"><a name="l00497"></a><span class="lineno"> 497</span>  <span class="stringliteral">"mov r24,r1\n"</span> <span class="comment">// carry = r1</span></div>
|
|
<div class="line"><a name="l00498"></a><span class="lineno"> 498</span>  <span class="stringliteral">"dec r25\n"</span> <span class="comment">// if (--r25 != 0) loop</span></div>
|
|
<div class="line"><a name="l00499"></a><span class="lineno"> 499</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l00500"></a><span class="lineno"> 500</span> </div>
|
|
<div class="line"><a name="l00501"></a><span class="lineno"> 501</span>  <span class="comment">// If the size is short, then we need to continue propagating carries.</span></div>
|
|
<div class="line"><a name="l00502"></a><span class="lineno"> 502</span>  <span class="stringliteral">"ldi r25,32\n"</span></div>
|
|
<div class="line"><a name="l00503"></a><span class="lineno"> 503</span>  <span class="stringliteral">"cp %1,r25\n"</span></div>
|
|
<div class="line"><a name="l00504"></a><span class="lineno"> 504</span>  <span class="stringliteral">"breq 3f\n"</span></div>
|
|
<div class="line"><a name="l00505"></a><span class="lineno"> 505</span>  <span class="stringliteral">"sub r25,%1\n"</span></div>
|
|
<div class="line"><a name="l00506"></a><span class="lineno"> 506</span>  <span class="stringliteral">"ld __tmp_reg__,Z\n"</span></div>
|
|
<div class="line"><a name="l00507"></a><span class="lineno"> 507</span>  <span class="stringliteral">"add __tmp_reg__,r24\n"</span></div>
|
|
<div class="line"><a name="l00508"></a><span class="lineno"> 508</span>  <span class="stringliteral">"st Z+,__tmp_reg__\n"</span></div>
|
|
<div class="line"><a name="l00509"></a><span class="lineno"> 509</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l00510"></a><span class="lineno"> 510</span>  <span class="stringliteral">"2:\n"</span></div>
|
|
<div class="line"><a name="l00511"></a><span class="lineno"> 511</span>  <span class="stringliteral">"ld __tmp_reg__,Z\n"</span> <span class="comment">// *x++ += carry</span></div>
|
|
<div class="line"><a name="l00512"></a><span class="lineno"> 512</span>  <span class="stringliteral">"adc __tmp_reg__,r22\n"</span></div>
|
|
<div class="line"><a name="l00513"></a><span class="lineno"> 513</span>  <span class="stringliteral">"st Z+,__tmp_reg__\n"</span></div>
|
|
<div class="line"><a name="l00514"></a><span class="lineno"> 514</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l00515"></a><span class="lineno"> 515</span>  <span class="stringliteral">"brne 2b\n"</span></div>
|
|
<div class="line"><a name="l00516"></a><span class="lineno"> 516</span>  <span class="stringliteral">"mov r24,r22\n"</span> <span class="comment">// put the carry back into r24</span></div>
|
|
<div class="line"><a name="l00517"></a><span class="lineno"> 517</span>  <span class="stringliteral">"adc r24,r22\n"</span></div>
|
|
<div class="line"><a name="l00518"></a><span class="lineno"> 518</span>  <span class="stringliteral">"3:\n"</span></div>
|
|
<div class="line"><a name="l00519"></a><span class="lineno"> 519</span>  <span class="stringliteral">"sbiw r30,32\n"</span> <span class="comment">// Point Z back to the start of "x"</span></div>
|
|
<div class="line"><a name="l00520"></a><span class="lineno"> 520</span> </div>
|
|
<div class="line"><a name="l00521"></a><span class="lineno"> 521</span>  <span class="comment">// The "j" value may still be too large due to the final carry-out.</span></div>
|
|
<div class="line"><a name="l00522"></a><span class="lineno"> 522</span>  <span class="comment">// We must repeat the reduction. If we already have the answer,</span></div>
|
|
<div class="line"><a name="l00523"></a><span class="lineno"> 523</span>  <span class="comment">// then this won't do any harm but we must still do the calculation</span></div>
|
|
<div class="line"><a name="l00524"></a><span class="lineno"> 524</span>  <span class="comment">// to preserve the overall timing.</span></div>
|
|
<div class="line"><a name="l00525"></a><span class="lineno"> 525</span>  <span class="stringliteral">"mul r24,r23\n"</span> <span class="comment">// carry *= 38</span></div>
|
|
<div class="line"><a name="l00526"></a><span class="lineno"> 526</span>  <span class="stringliteral">"ldd r24,Z+31\n"</span> <span class="comment">// Extract the high bit of x[31]</span></div>
|
|
<div class="line"><a name="l00527"></a><span class="lineno"> 527</span>  <span class="stringliteral">"mov r25,r24\n"</span> <span class="comment">// and mask it off</span></div>
|
|
<div class="line"><a name="l00528"></a><span class="lineno"> 528</span>  <span class="stringliteral">"andi r25,0x7F\n"</span></div>
|
|
<div class="line"><a name="l00529"></a><span class="lineno"> 529</span>  <span class="stringliteral">"std Z+31,r25\n"</span></div>
|
|
<div class="line"><a name="l00530"></a><span class="lineno"> 530</span>  <span class="stringliteral">"lsl r24\n"</span> <span class="comment">// carry += high bit * 19</span></div>
|
|
<div class="line"><a name="l00531"></a><span class="lineno"> 531</span>  <span class="stringliteral">"mov r24,r22\n"</span></div>
|
|
<div class="line"><a name="l00532"></a><span class="lineno"> 532</span>  <span class="stringliteral">"sbc r24,r22\n"</span></div>
|
|
<div class="line"><a name="l00533"></a><span class="lineno"> 533</span>  <span class="stringliteral">"andi r24,19\n"</span></div>
|
|
<div class="line"><a name="l00534"></a><span class="lineno"> 534</span>  <span class="stringliteral">"add r0,r24\n"</span></div>
|
|
<div class="line"><a name="l00535"></a><span class="lineno"> 535</span>  <span class="stringliteral">"adc r1,r22\n"</span> <span class="comment">// 9-bit carry is now in r0:r1</span></div>
|
|
<div class="line"><a name="l00536"></a><span class="lineno"> 536</span> </div>
|
|
<div class="line"><a name="l00537"></a><span class="lineno"> 537</span>  <span class="comment">// Propagate the carry through the rest of x.</span></div>
|
|
<div class="line"><a name="l00538"></a><span class="lineno"> 538</span>  <span class="stringliteral">"ld r24,Z\n"</span> <span class="comment">// x[0]</span></div>
|
|
<div class="line"><a name="l00539"></a><span class="lineno"> 539</span>  <span class="stringliteral">"add r0,r24\n"</span></div>
|
|
<div class="line"><a name="l00540"></a><span class="lineno"> 540</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00541"></a><span class="lineno"> 541</span>  <span class="stringliteral">"st Z+,r0\n"</span></div>
|
|
<div class="line"><a name="l00542"></a><span class="lineno"> 542</span>  <span class="stringliteral">"ld r24,Z\n"</span> <span class="comment">// x[1]</span></div>
|
|
<div class="line"><a name="l00543"></a><span class="lineno"> 543</span>  <span class="stringliteral">"add r1,r24\n"</span></div>
|
|
<div class="line"><a name="l00544"></a><span class="lineno"> 544</span>  <span class="stringliteral">"st Z+,r1\n"</span></div>
|
|
<div class="line"><a name="l00545"></a><span class="lineno"> 545</span>  <span class="stringliteral">"ldi r25,30\n"</span> <span class="comment">// x[2..31]</span></div>
|
|
<div class="line"><a name="l00546"></a><span class="lineno"> 546</span>  <span class="stringliteral">"4:\n"</span></div>
|
|
<div class="line"><a name="l00547"></a><span class="lineno"> 547</span>  <span class="stringliteral">"ld r24,Z\n"</span></div>
|
|
<div class="line"><a name="l00548"></a><span class="lineno"> 548</span>  <span class="stringliteral">"adc r24,r22\n"</span></div>
|
|
<div class="line"><a name="l00549"></a><span class="lineno"> 549</span>  <span class="stringliteral">"st Z+,r24\n"</span></div>
|
|
<div class="line"><a name="l00550"></a><span class="lineno"> 550</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l00551"></a><span class="lineno"> 551</span>  <span class="stringliteral">"brne 4b\n"</span></div>
|
|
<div class="line"><a name="l00552"></a><span class="lineno"> 552</span>  <span class="stringliteral">"sbiw r30,32\n"</span> <span class="comment">// Point Z back to the start of "x"</span></div>
|
|
<div class="line"><a name="l00553"></a><span class="lineno"> 553</span> </div>
|
|
<div class="line"><a name="l00554"></a><span class="lineno"> 554</span>  <span class="comment">// We destroyed __zero_reg__ (r1) above, so restore its zero value.</span></div>
|
|
<div class="line"><a name="l00555"></a><span class="lineno"> 555</span>  <span class="stringliteral">"mov __zero_reg__,r22\n"</span></div>
|
|
<div class="line"><a name="l00556"></a><span class="lineno"> 556</span> </div>
|
|
<div class="line"><a name="l00557"></a><span class="lineno"> 557</span>  <span class="comment">// At this point "x" will either be the answer or it will be the</span></div>
|
|
<div class="line"><a name="l00558"></a><span class="lineno"> 558</span>  <span class="comment">// answer plus (2^255 - 19). Perform a trial subtraction which</span></div>
|
|
<div class="line"><a name="l00559"></a><span class="lineno"> 559</span>  <span class="comment">// is equivalent to adding 19 and subtracting 2^255. We put the</span></div>
|
|
<div class="line"><a name="l00560"></a><span class="lineno"> 560</span>  <span class="comment">// trial answer into the top-most limbs of the original "x" array.</span></div>
|
|
<div class="line"><a name="l00561"></a><span class="lineno"> 561</span>  <span class="comment">// We add 19 here; the subtraction of 2^255 occurs in the next step.</span></div>
|
|
<div class="line"><a name="l00562"></a><span class="lineno"> 562</span>  <span class="stringliteral">"ldi r24,8\n"</span> <span class="comment">// Loop counter.</span></div>
|
|
<div class="line"><a name="l00563"></a><span class="lineno"> 563</span>  <span class="stringliteral">"ldi r25,19\n"</span> <span class="comment">// carry = 19</span></div>
|
|
<div class="line"><a name="l00564"></a><span class="lineno"> 564</span>  <span class="stringliteral">"5:\n"</span></div>
|
|
<div class="line"><a name="l00565"></a><span class="lineno"> 565</span>  <span class="stringliteral">"ld r16,Z+\n"</span> <span class="comment">// r16:r19:carry = *xx++ + carry</span></div>
|
|
<div class="line"><a name="l00566"></a><span class="lineno"> 566</span>  <span class="stringliteral">"ld r17,Z+\n"</span></div>
|
|
<div class="line"><a name="l00567"></a><span class="lineno"> 567</span>  <span class="stringliteral">"ld r18,Z+\n"</span></div>
|
|
<div class="line"><a name="l00568"></a><span class="lineno"> 568</span>  <span class="stringliteral">"ld r19,Z+\n"</span></div>
|
|
<div class="line"><a name="l00569"></a><span class="lineno"> 569</span>  <span class="stringliteral">"add r16,r25\n"</span> <span class="comment">// r16:r19:carry += carry</span></div>
|
|
<div class="line"><a name="l00570"></a><span class="lineno"> 570</span>  <span class="stringliteral">"adc r17,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00571"></a><span class="lineno"> 571</span>  <span class="stringliteral">"adc r18,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00572"></a><span class="lineno"> 572</span>  <span class="stringliteral">"adc r19,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00573"></a><span class="lineno"> 573</span>  <span class="stringliteral">"mov r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00574"></a><span class="lineno"> 574</span>  <span class="stringliteral">"adc r25,r25\n"</span></div>
|
|
<div class="line"><a name="l00575"></a><span class="lineno"> 575</span>  <span class="stringliteral">"std Z+28,r16\n"</span> <span class="comment">// *tt++ = r16:r19</span></div>
|
|
<div class="line"><a name="l00576"></a><span class="lineno"> 576</span>  <span class="stringliteral">"std Z+29,r17\n"</span></div>
|
|
<div class="line"><a name="l00577"></a><span class="lineno"> 577</span>  <span class="stringliteral">"std Z+30,r18\n"</span></div>
|
|
<div class="line"><a name="l00578"></a><span class="lineno"> 578</span>  <span class="stringliteral">"std Z+31,r19\n"</span></div>
|
|
<div class="line"><a name="l00579"></a><span class="lineno"> 579</span>  <span class="stringliteral">"dec r24\n"</span></div>
|
|
<div class="line"><a name="l00580"></a><span class="lineno"> 580</span>  <span class="stringliteral">"brne 5b\n"</span></div>
|
|
<div class="line"><a name="l00581"></a><span class="lineno"> 581</span> </div>
|
|
<div class="line"><a name="l00582"></a><span class="lineno"> 582</span>  <span class="comment">// Subtract 2^255 from x[32..63] which is equivalent to extracting</span></div>
|
|
<div class="line"><a name="l00583"></a><span class="lineno"> 583</span>  <span class="comment">// the top bit and then masking it off. If the top bit is zero</span></div>
|
|
<div class="line"><a name="l00584"></a><span class="lineno"> 584</span>  <span class="comment">// then a borrow has occurred and this isn't the answer we want.</span></div>
|
|
<div class="line"><a name="l00585"></a><span class="lineno"> 585</span>  <span class="stringliteral">"mov r25,r19\n"</span></div>
|
|
<div class="line"><a name="l00586"></a><span class="lineno"> 586</span>  <span class="stringliteral">"andi r19,0x7F\n"</span></div>
|
|
<div class="line"><a name="l00587"></a><span class="lineno"> 587</span>  <span class="stringliteral">"std Z+31,r19\n"</span></div>
|
|
<div class="line"><a name="l00588"></a><span class="lineno"> 588</span>  <span class="stringliteral">"lsl r25\n"</span></div>
|
|
<div class="line"><a name="l00589"></a><span class="lineno"> 589</span>  <span class="stringliteral">"mov r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00590"></a><span class="lineno"> 590</span>  <span class="stringliteral">"sbc r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00591"></a><span class="lineno"> 591</span> </div>
|
|
<div class="line"><a name="l00592"></a><span class="lineno"> 592</span>  <span class="comment">// At this point, r25 is 0 if the original x[0..31] is the answer</span></div>
|
|
<div class="line"><a name="l00593"></a><span class="lineno"> 593</span>  <span class="comment">// we want, or 0xFF if x[32..63] is the answer we want. Essentially</span></div>
|
|
<div class="line"><a name="l00594"></a><span class="lineno"> 594</span>  <span class="comment">// we need to do a conditional move of either x[0..31] or x[32..63]</span></div>
|
|
<div class="line"><a name="l00595"></a><span class="lineno"> 595</span>  <span class="comment">// into "result".</span></div>
|
|
<div class="line"><a name="l00596"></a><span class="lineno"> 596</span>  <span class="stringliteral">"sbiw r30,32\n"</span> <span class="comment">// Point Z back to x[0].</span></div>
|
|
<div class="line"><a name="l00597"></a><span class="lineno"> 597</span>  <span class="stringliteral">"ldi r24,8\n"</span></div>
|
|
<div class="line"><a name="l00598"></a><span class="lineno"> 598</span>  <span class="stringliteral">"6:\n"</span></div>
|
|
<div class="line"><a name="l00599"></a><span class="lineno"> 599</span>  <span class="stringliteral">"ldd r16,Z+32\n"</span></div>
|
|
<div class="line"><a name="l00600"></a><span class="lineno"> 600</span>  <span class="stringliteral">"ldd r17,Z+33\n"</span></div>
|
|
<div class="line"><a name="l00601"></a><span class="lineno"> 601</span>  <span class="stringliteral">"ldd r18,Z+34\n"</span></div>
|
|
<div class="line"><a name="l00602"></a><span class="lineno"> 602</span>  <span class="stringliteral">"ldd r19,Z+35\n"</span></div>
|
|
<div class="line"><a name="l00603"></a><span class="lineno"> 603</span>  <span class="stringliteral">"ld r20,Z+\n"</span></div>
|
|
<div class="line"><a name="l00604"></a><span class="lineno"> 604</span>  <span class="stringliteral">"ld r21,Z+\n"</span></div>
|
|
<div class="line"><a name="l00605"></a><span class="lineno"> 605</span>  <span class="stringliteral">"ld r22,Z+\n"</span></div>
|
|
<div class="line"><a name="l00606"></a><span class="lineno"> 606</span>  <span class="stringliteral">"ld r23,Z+\n"</span></div>
|
|
<div class="line"><a name="l00607"></a><span class="lineno"> 607</span>  <span class="stringliteral">"eor r16,r20\n"</span></div>
|
|
<div class="line"><a name="l00608"></a><span class="lineno"> 608</span>  <span class="stringliteral">"eor r17,r21\n"</span></div>
|
|
<div class="line"><a name="l00609"></a><span class="lineno"> 609</span>  <span class="stringliteral">"eor r18,r22\n"</span></div>
|
|
<div class="line"><a name="l00610"></a><span class="lineno"> 610</span>  <span class="stringliteral">"eor r19,r23\n"</span></div>
|
|
<div class="line"><a name="l00611"></a><span class="lineno"> 611</span>  <span class="stringliteral">"and r16,r25\n"</span></div>
|
|
<div class="line"><a name="l00612"></a><span class="lineno"> 612</span>  <span class="stringliteral">"and r17,r25\n"</span></div>
|
|
<div class="line"><a name="l00613"></a><span class="lineno"> 613</span>  <span class="stringliteral">"and r18,r25\n"</span></div>
|
|
<div class="line"><a name="l00614"></a><span class="lineno"> 614</span>  <span class="stringliteral">"and r19,r25\n"</span></div>
|
|
<div class="line"><a name="l00615"></a><span class="lineno"> 615</span>  <span class="stringliteral">"eor r20,r16\n"</span></div>
|
|
<div class="line"><a name="l00616"></a><span class="lineno"> 616</span>  <span class="stringliteral">"eor r21,r17\n"</span></div>
|
|
<div class="line"><a name="l00617"></a><span class="lineno"> 617</span>  <span class="stringliteral">"eor r22,r18\n"</span></div>
|
|
<div class="line"><a name="l00618"></a><span class="lineno"> 618</span>  <span class="stringliteral">"eor r23,r19\n"</span></div>
|
|
<div class="line"><a name="l00619"></a><span class="lineno"> 619</span>  <span class="stringliteral">"st X+,r20\n"</span></div>
|
|
<div class="line"><a name="l00620"></a><span class="lineno"> 620</span>  <span class="stringliteral">"st X+,r21\n"</span></div>
|
|
<div class="line"><a name="l00621"></a><span class="lineno"> 621</span>  <span class="stringliteral">"st X+,r22\n"</span></div>
|
|
<div class="line"><a name="l00622"></a><span class="lineno"> 622</span>  <span class="stringliteral">"st X+,r23\n"</span></div>
|
|
<div class="line"><a name="l00623"></a><span class="lineno"> 623</span>  <span class="stringliteral">"dec r24\n"</span></div>
|
|
<div class="line"><a name="l00624"></a><span class="lineno"> 624</span>  <span class="stringliteral">"brne 6b\n"</span></div>
|
|
<div class="line"><a name="l00625"></a><span class="lineno"> 625</span> </div>
|
|
<div class="line"><a name="l00626"></a><span class="lineno"> 626</span>  : : <span class="stringliteral">"z"</span>(x), <span class="stringliteral">"r"</span>((uint8_t)(size * <span class="keyword">sizeof</span>(limb_t))), <span class="stringliteral">"x"</span>(result)</div>
|
|
<div class="line"><a name="l00627"></a><span class="lineno"> 627</span>  : <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r17"</span>, <span class="stringliteral">"r18"</span>, <span class="stringliteral">"r19"</span>, <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>, <span class="stringliteral">"r23"</span>,</div>
|
|
<div class="line"><a name="l00628"></a><span class="lineno"> 628</span>  <span class="stringliteral">"r24"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l00629"></a><span class="lineno"> 629</span>  );</div>
|
|
<div class="line"><a name="l00630"></a><span class="lineno"> 630</span> <span class="preprocessor">#endif</span></div>
|
|
<div class="line"><a name="l00631"></a><span class="lineno"> 631</span> <span class="preprocessor"></span>}</div>
|
|
<div class="line"><a name="l00632"></a><span class="lineno"> 632</span> </div>
|
|
<div class="line"><a name="l00646"></a><span class="lineno"> 646</span> limb_t Curve25519::reduceQuick(limb_t *x)</div>
|
|
<div class="line"><a name="l00647"></a><span class="lineno"> 647</span> {</div>
|
|
<div class="line"><a name="l00648"></a><span class="lineno"> 648</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l00649"></a><span class="lineno"> 649</span> <span class="preprocessor"></span> limb_t temp[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00650"></a><span class="lineno"> 650</span>  dlimb_t carry;</div>
|
|
<div class="line"><a name="l00651"></a><span class="lineno"> 651</span>  uint8_t posn;</div>
|
|
<div class="line"><a name="l00652"></a><span class="lineno"> 652</span>  limb_t *xx;</div>
|
|
<div class="line"><a name="l00653"></a><span class="lineno"> 653</span>  limb_t *tt;</div>
|
|
<div class="line"><a name="l00654"></a><span class="lineno"> 654</span>  </div>
|
|
<div class="line"><a name="l00655"></a><span class="lineno"> 655</span>  <span class="comment">// Perform a trial subtraction of (2^255 - 19) from "x" which is</span></div>
|
|
<div class="line"><a name="l00656"></a><span class="lineno"> 656</span>  <span class="comment">// equivalent to adding 19 and subtracting 2^255. We add 19 here;</span></div>
|
|
<div class="line"><a name="l00657"></a><span class="lineno"> 657</span>  <span class="comment">// the subtraction of 2^255 occurs in the next step.</span></div>
|
|
<div class="line"><a name="l00658"></a><span class="lineno"> 658</span>  carry = 19U;</div>
|
|
<div class="line"><a name="l00659"></a><span class="lineno"> 659</span>  xx = x;</div>
|
|
<div class="line"><a name="l00660"></a><span class="lineno"> 660</span>  tt = temp;</div>
|
|
<div class="line"><a name="l00661"></a><span class="lineno"> 661</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l00662"></a><span class="lineno"> 662</span>  carry += *xx++;</div>
|
|
<div class="line"><a name="l00663"></a><span class="lineno"> 663</span>  *tt++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00664"></a><span class="lineno"> 664</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00665"></a><span class="lineno"> 665</span>  }</div>
|
|
<div class="line"><a name="l00666"></a><span class="lineno"> 666</span> </div>
|
|
<div class="line"><a name="l00667"></a><span class="lineno"> 667</span>  <span class="comment">// If there was a borrow, then the original "x" is the correct answer.</span></div>
|
|
<div class="line"><a name="l00668"></a><span class="lineno"> 668</span>  <span class="comment">// If there was no borrow, then "temp" is the correct answer. Select the</span></div>
|
|
<div class="line"><a name="l00669"></a><span class="lineno"> 669</span>  <span class="comment">// correct answer but do it in a way that instruction timing will not</span></div>
|
|
<div class="line"><a name="l00670"></a><span class="lineno"> 670</span>  <span class="comment">// reveal which value was selected. Borrow will occur if the high bit</span></div>
|
|
<div class="line"><a name="l00671"></a><span class="lineno"> 671</span>  <span class="comment">// of "temp" is 0: turn the high bit into a selection mask.</span></div>
|
|
<div class="line"><a name="l00672"></a><span class="lineno"> 672</span>  limb_t mask = (limb_t)(((slimb_t)(temp[NUM_LIMBS_256BIT - 1])) >> (LIMB_BITS - 1));</div>
|
|
<div class="line"><a name="l00673"></a><span class="lineno"> 673</span>  limb_t nmask = ~mask;</div>
|
|
<div class="line"><a name="l00674"></a><span class="lineno"> 674</span>  temp[NUM_LIMBS_256BIT - 1] &= ((((limb_t)1) << (LIMB_BITS - 1)) - 1);</div>
|
|
<div class="line"><a name="l00675"></a><span class="lineno"> 675</span>  xx = x;</div>
|
|
<div class="line"><a name="l00676"></a><span class="lineno"> 676</span>  tt = temp;</div>
|
|
<div class="line"><a name="l00677"></a><span class="lineno"> 677</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l00678"></a><span class="lineno"> 678</span>  *xx = ((*xx) & nmask) | ((*tt++) & mask);</div>
|
|
<div class="line"><a name="l00679"></a><span class="lineno"> 679</span>  ++xx;</div>
|
|
<div class="line"><a name="l00680"></a><span class="lineno"> 680</span>  }</div>
|
|
<div class="line"><a name="l00681"></a><span class="lineno"> 681</span> </div>
|
|
<div class="line"><a name="l00682"></a><span class="lineno"> 682</span>  <span class="comment">// Clean up "temp".</span></div>
|
|
<div class="line"><a name="l00683"></a><span class="lineno"> 683</span>  strict_clean(temp);</div>
|
|
<div class="line"><a name="l00684"></a><span class="lineno"> 684</span> </div>
|
|
<div class="line"><a name="l00685"></a><span class="lineno"> 685</span>  <span class="comment">// Return a zero value if we actually subtracted (2^255 - 19) from "x".</span></div>
|
|
<div class="line"><a name="l00686"></a><span class="lineno"> 686</span>  <span class="keywordflow">return</span> nmask;</div>
|
|
<div class="line"><a name="l00687"></a><span class="lineno"> 687</span> <span class="preprocessor">#else // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l00688"></a><span class="lineno"> 688</span> <span class="preprocessor"></span> limb_t temp[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00689"></a><span class="lineno"> 689</span>  uint8_t result;</div>
|
|
<div class="line"><a name="l00690"></a><span class="lineno"> 690</span>  __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l00691"></a><span class="lineno"> 691</span>  <span class="comment">// Subtract (2^255 - 19) from "x", which is the same as adding 19</span></div>
|
|
<div class="line"><a name="l00692"></a><span class="lineno"> 692</span>  <span class="comment">// and then subtracting 2^255.</span></div>
|
|
<div class="line"><a name="l00693"></a><span class="lineno"> 693</span>  <span class="stringliteral">"ldi r24,8\n"</span> <span class="comment">// Loop counter.</span></div>
|
|
<div class="line"><a name="l00694"></a><span class="lineno"> 694</span>  <span class="stringliteral">"ldi r25,19\n"</span> <span class="comment">// carry = 19</span></div>
|
|
<div class="line"><a name="l00695"></a><span class="lineno"> 695</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l00696"></a><span class="lineno"> 696</span>  <span class="stringliteral">"ld r16,Z+\n"</span> <span class="comment">// r16:r19:carry = *xx++ + carry</span></div>
|
|
<div class="line"><a name="l00697"></a><span class="lineno"> 697</span>  <span class="stringliteral">"ld r17,Z+\n"</span></div>
|
|
<div class="line"><a name="l00698"></a><span class="lineno"> 698</span>  <span class="stringliteral">"ld r18,Z+\n"</span></div>
|
|
<div class="line"><a name="l00699"></a><span class="lineno"> 699</span>  <span class="stringliteral">"ld r19,Z+\n"</span></div>
|
|
<div class="line"><a name="l00700"></a><span class="lineno"> 700</span>  <span class="stringliteral">"add r16,r25\n"</span> <span class="comment">// r16:r19:carry += carry</span></div>
|
|
<div class="line"><a name="l00701"></a><span class="lineno"> 701</span>  <span class="stringliteral">"adc r17,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00702"></a><span class="lineno"> 702</span>  <span class="stringliteral">"adc r18,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00703"></a><span class="lineno"> 703</span>  <span class="stringliteral">"adc r19,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00704"></a><span class="lineno"> 704</span>  <span class="stringliteral">"mov r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00705"></a><span class="lineno"> 705</span>  <span class="stringliteral">"adc r25,r25\n"</span></div>
|
|
<div class="line"><a name="l00706"></a><span class="lineno"> 706</span>  <span class="stringliteral">"st X+,r16\n"</span> <span class="comment">// *tt++ = r16:r19</span></div>
|
|
<div class="line"><a name="l00707"></a><span class="lineno"> 707</span>  <span class="stringliteral">"st X+,r17\n"</span></div>
|
|
<div class="line"><a name="l00708"></a><span class="lineno"> 708</span>  <span class="stringliteral">"st X+,r18\n"</span></div>
|
|
<div class="line"><a name="l00709"></a><span class="lineno"> 709</span>  <span class="stringliteral">"st X+,r19\n"</span></div>
|
|
<div class="line"><a name="l00710"></a><span class="lineno"> 710</span>  <span class="stringliteral">"dec r24\n"</span></div>
|
|
<div class="line"><a name="l00711"></a><span class="lineno"> 711</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l00712"></a><span class="lineno"> 712</span> </div>
|
|
<div class="line"><a name="l00713"></a><span class="lineno"> 713</span>  <span class="comment">// Subtract 2^255 from "temp" which is equivalent to extracting</span></div>
|
|
<div class="line"><a name="l00714"></a><span class="lineno"> 714</span>  <span class="comment">// the top bit and then masking it off. If the top bit is zero</span></div>
|
|
<div class="line"><a name="l00715"></a><span class="lineno"> 715</span>  <span class="comment">// then a borrow has occurred and this isn't the answer we want.</span></div>
|
|
<div class="line"><a name="l00716"></a><span class="lineno"> 716</span>  <span class="stringliteral">"mov r25,r19\n"</span></div>
|
|
<div class="line"><a name="l00717"></a><span class="lineno"> 717</span>  <span class="stringliteral">"andi r19,0x7F\n"</span></div>
|
|
<div class="line"><a name="l00718"></a><span class="lineno"> 718</span>  <span class="stringliteral">"st -X,r19\n"</span></div>
|
|
<div class="line"><a name="l00719"></a><span class="lineno"> 719</span>  <span class="stringliteral">"lsl r25\n"</span></div>
|
|
<div class="line"><a name="l00720"></a><span class="lineno"> 720</span>  <span class="stringliteral">"mov r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00721"></a><span class="lineno"> 721</span>  <span class="stringliteral">"sbc r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00722"></a><span class="lineno"> 722</span> </div>
|
|
<div class="line"><a name="l00723"></a><span class="lineno"> 723</span>  <span class="comment">// At this point, r25 is 0 if the original "x" is the answer</span></div>
|
|
<div class="line"><a name="l00724"></a><span class="lineno"> 724</span>  <span class="comment">// we want, or 0xFF if "temp" is the answer we want. Essentially</span></div>
|
|
<div class="line"><a name="l00725"></a><span class="lineno"> 725</span>  <span class="comment">// we need to do a conditional move of "temp" into "x".</span></div>
|
|
<div class="line"><a name="l00726"></a><span class="lineno"> 726</span>  <span class="stringliteral">"sbiw r26,31\n"</span> <span class="comment">// Point X back to the start of "temp".</span></div>
|
|
<div class="line"><a name="l00727"></a><span class="lineno"> 727</span>  <span class="stringliteral">"sbiw r30,32\n"</span> <span class="comment">// Point Z back to the start of "x".</span></div>
|
|
<div class="line"><a name="l00728"></a><span class="lineno"> 728</span>  <span class="stringliteral">"ldi r24,8\n"</span></div>
|
|
<div class="line"><a name="l00729"></a><span class="lineno"> 729</span>  <span class="stringliteral">"2:\n"</span></div>
|
|
<div class="line"><a name="l00730"></a><span class="lineno"> 730</span>  <span class="stringliteral">"ld r16,X+\n"</span></div>
|
|
<div class="line"><a name="l00731"></a><span class="lineno"> 731</span>  <span class="stringliteral">"ld r17,X+\n"</span></div>
|
|
<div class="line"><a name="l00732"></a><span class="lineno"> 732</span>  <span class="stringliteral">"ld r18,X+\n"</span></div>
|
|
<div class="line"><a name="l00733"></a><span class="lineno"> 733</span>  <span class="stringliteral">"ld r19,X+\n"</span></div>
|
|
<div class="line"><a name="l00734"></a><span class="lineno"> 734</span>  <span class="stringliteral">"ld r20,Z\n"</span></div>
|
|
<div class="line"><a name="l00735"></a><span class="lineno"> 735</span>  <span class="stringliteral">"ldd r21,Z+1\n"</span></div>
|
|
<div class="line"><a name="l00736"></a><span class="lineno"> 736</span>  <span class="stringliteral">"ldd r22,Z+2\n"</span></div>
|
|
<div class="line"><a name="l00737"></a><span class="lineno"> 737</span>  <span class="stringliteral">"ldd r23,Z+3\n"</span></div>
|
|
<div class="line"><a name="l00738"></a><span class="lineno"> 738</span>  <span class="stringliteral">"eor r16,r20\n"</span></div>
|
|
<div class="line"><a name="l00739"></a><span class="lineno"> 739</span>  <span class="stringliteral">"eor r17,r21\n"</span></div>
|
|
<div class="line"><a name="l00740"></a><span class="lineno"> 740</span>  <span class="stringliteral">"eor r18,r22\n"</span></div>
|
|
<div class="line"><a name="l00741"></a><span class="lineno"> 741</span>  <span class="stringliteral">"eor r19,r23\n"</span></div>
|
|
<div class="line"><a name="l00742"></a><span class="lineno"> 742</span>  <span class="stringliteral">"and r16,r25\n"</span></div>
|
|
<div class="line"><a name="l00743"></a><span class="lineno"> 743</span>  <span class="stringliteral">"and r17,r25\n"</span></div>
|
|
<div class="line"><a name="l00744"></a><span class="lineno"> 744</span>  <span class="stringliteral">"and r18,r25\n"</span></div>
|
|
<div class="line"><a name="l00745"></a><span class="lineno"> 745</span>  <span class="stringliteral">"and r19,r25\n"</span></div>
|
|
<div class="line"><a name="l00746"></a><span class="lineno"> 746</span>  <span class="stringliteral">"eor r20,r16\n"</span></div>
|
|
<div class="line"><a name="l00747"></a><span class="lineno"> 747</span>  <span class="stringliteral">"eor r21,r17\n"</span></div>
|
|
<div class="line"><a name="l00748"></a><span class="lineno"> 748</span>  <span class="stringliteral">"eor r22,r18\n"</span></div>
|
|
<div class="line"><a name="l00749"></a><span class="lineno"> 749</span>  <span class="stringliteral">"eor r23,r19\n"</span></div>
|
|
<div class="line"><a name="l00750"></a><span class="lineno"> 750</span>  <span class="stringliteral">"st Z+,r20\n"</span></div>
|
|
<div class="line"><a name="l00751"></a><span class="lineno"> 751</span>  <span class="stringliteral">"st Z+,r21\n"</span></div>
|
|
<div class="line"><a name="l00752"></a><span class="lineno"> 752</span>  <span class="stringliteral">"st Z+,r22\n"</span></div>
|
|
<div class="line"><a name="l00753"></a><span class="lineno"> 753</span>  <span class="stringliteral">"st Z+,r23\n"</span></div>
|
|
<div class="line"><a name="l00754"></a><span class="lineno"> 754</span>  <span class="stringliteral">"dec r24\n"</span></div>
|
|
<div class="line"><a name="l00755"></a><span class="lineno"> 755</span>  <span class="stringliteral">"brne 2b\n"</span></div>
|
|
<div class="line"><a name="l00756"></a><span class="lineno"> 756</span>  <span class="stringliteral">"mov %0,r25\n"</span></div>
|
|
<div class="line"><a name="l00757"></a><span class="lineno"> 757</span>  : <span class="stringliteral">"=r"</span>(result)</div>
|
|
<div class="line"><a name="l00758"></a><span class="lineno"> 758</span>  : <span class="stringliteral">"x"</span>(temp), <span class="stringliteral">"z"</span>(x)</div>
|
|
<div class="line"><a name="l00759"></a><span class="lineno"> 759</span>  : <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r17"</span>, <span class="stringliteral">"r18"</span>, <span class="stringliteral">"r19"</span>, <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>, <span class="stringliteral">"r23"</span>,</div>
|
|
<div class="line"><a name="l00760"></a><span class="lineno"> 760</span>  <span class="stringliteral">"r24"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l00761"></a><span class="lineno"> 761</span>  );</div>
|
|
<div class="line"><a name="l00762"></a><span class="lineno"> 762</span>  strict_clean(temp);</div>
|
|
<div class="line"><a name="l00763"></a><span class="lineno"> 763</span>  <span class="keywordflow">return</span> result;</div>
|
|
<div class="line"><a name="l00764"></a><span class="lineno"> 764</span> <span class="preprocessor">#endif // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l00765"></a><span class="lineno"> 765</span> <span class="preprocessor"></span>}</div>
|
|
<div class="line"><a name="l00766"></a><span class="lineno"> 766</span> </div>
|
|
<div class="line"><a name="l00779"></a><span class="lineno"> 779</span> <span class="keywordtype">void</span> Curve25519::mulNoReduce(limb_t *result, <span class="keyword">const</span> limb_t *x, <span class="keyword">const</span> limb_t *y)</div>
|
|
<div class="line"><a name="l00780"></a><span class="lineno"> 780</span> {</div>
|
|
<div class="line"><a name="l00781"></a><span class="lineno"> 781</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l00782"></a><span class="lineno"> 782</span> <span class="preprocessor"></span> uint8_t i, j;</div>
|
|
<div class="line"><a name="l00783"></a><span class="lineno"> 783</span>  dlimb_t carry;</div>
|
|
<div class="line"><a name="l00784"></a><span class="lineno"> 784</span>  limb_t word;</div>
|
|
<div class="line"><a name="l00785"></a><span class="lineno"> 785</span>  <span class="keyword">const</span> limb_t *yy;</div>
|
|
<div class="line"><a name="l00786"></a><span class="lineno"> 786</span>  limb_t *rr;</div>
|
|
<div class="line"><a name="l00787"></a><span class="lineno"> 787</span> </div>
|
|
<div class="line"><a name="l00788"></a><span class="lineno"> 788</span>  <span class="comment">// Multiply the lowest word of x by y.</span></div>
|
|
<div class="line"><a name="l00789"></a><span class="lineno"> 789</span>  carry = 0;</div>
|
|
<div class="line"><a name="l00790"></a><span class="lineno"> 790</span>  word = x[0];</div>
|
|
<div class="line"><a name="l00791"></a><span class="lineno"> 791</span>  yy = y;</div>
|
|
<div class="line"><a name="l00792"></a><span class="lineno"> 792</span>  rr = result;</div>
|
|
<div class="line"><a name="l00793"></a><span class="lineno"> 793</span>  <span class="keywordflow">for</span> (i = 0; i < NUM_LIMBS_256BIT; ++i) {</div>
|
|
<div class="line"><a name="l00794"></a><span class="lineno"> 794</span>  carry += ((dlimb_t)(*yy++)) * word;</div>
|
|
<div class="line"><a name="l00795"></a><span class="lineno"> 795</span>  *rr++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00796"></a><span class="lineno"> 796</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00797"></a><span class="lineno"> 797</span>  }</div>
|
|
<div class="line"><a name="l00798"></a><span class="lineno"> 798</span>  *rr = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00799"></a><span class="lineno"> 799</span> </div>
|
|
<div class="line"><a name="l00800"></a><span class="lineno"> 800</span>  <span class="comment">// Multiply and add the remaining words of x by y.</span></div>
|
|
<div class="line"><a name="l00801"></a><span class="lineno"> 801</span>  <span class="keywordflow">for</span> (i = 1; i < NUM_LIMBS_256BIT; ++i) {</div>
|
|
<div class="line"><a name="l00802"></a><span class="lineno"> 802</span>  word = x[i];</div>
|
|
<div class="line"><a name="l00803"></a><span class="lineno"> 803</span>  carry = 0;</div>
|
|
<div class="line"><a name="l00804"></a><span class="lineno"> 804</span>  yy = y;</div>
|
|
<div class="line"><a name="l00805"></a><span class="lineno"> 805</span>  rr = result + i;</div>
|
|
<div class="line"><a name="l00806"></a><span class="lineno"> 806</span>  <span class="keywordflow">for</span> (j = 0; j < NUM_LIMBS_256BIT; ++j) {</div>
|
|
<div class="line"><a name="l00807"></a><span class="lineno"> 807</span>  carry += ((dlimb_t)(*yy++)) * word;</div>
|
|
<div class="line"><a name="l00808"></a><span class="lineno"> 808</span>  carry += *rr;</div>
|
|
<div class="line"><a name="l00809"></a><span class="lineno"> 809</span>  *rr++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00810"></a><span class="lineno"> 810</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00811"></a><span class="lineno"> 811</span>  }</div>
|
|
<div class="line"><a name="l00812"></a><span class="lineno"> 812</span>  *rr = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00813"></a><span class="lineno"> 813</span>  }</div>
|
|
<div class="line"><a name="l00814"></a><span class="lineno"> 814</span> <span class="preprocessor">#else</span></div>
|
|
<div class="line"><a name="l00815"></a><span class="lineno"> 815</span> <span class="preprocessor"></span> __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l00816"></a><span class="lineno"> 816</span>  <span class="comment">// Save Y and copy the "result" pointer into it.</span></div>
|
|
<div class="line"><a name="l00817"></a><span class="lineno"> 817</span>  <span class="stringliteral">"push r28\n"</span></div>
|
|
<div class="line"><a name="l00818"></a><span class="lineno"> 818</span>  <span class="stringliteral">"push r29\n"</span></div>
|
|
<div class="line"><a name="l00819"></a><span class="lineno"> 819</span>  <span class="stringliteral">"mov r28,%A2\n"</span></div>
|
|
<div class="line"><a name="l00820"></a><span class="lineno"> 820</span>  <span class="stringliteral">"mov r29,%B2\n"</span></div>
|
|
<div class="line"><a name="l00821"></a><span class="lineno"> 821</span> </div>
|
|
<div class="line"><a name="l00822"></a><span class="lineno"> 822</span>  <span class="comment">// Multiply the first byte of "x" by y[0..31].</span></div>
|
|
<div class="line"><a name="l00823"></a><span class="lineno"> 823</span>  <span class="stringliteral">"ldi r25,8\n"</span> <span class="comment">// loop 8 times: 4 bytes of y each time</span></div>
|
|
<div class="line"><a name="l00824"></a><span class="lineno"> 824</span>  <span class="stringliteral">"clr r24\n"</span> <span class="comment">// carry = 0</span></div>
|
|
<div class="line"><a name="l00825"></a><span class="lineno"> 825</span>  <span class="stringliteral">"clr r22\n"</span> <span class="comment">// r22 = 0 to replace __zero_reg__</span></div>
|
|
<div class="line"><a name="l00826"></a><span class="lineno"> 826</span>  <span class="stringliteral">"ld r23,X+\n"</span> <span class="comment">// r23 = *x++</span></div>
|
|
<div class="line"><a name="l00827"></a><span class="lineno"> 827</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l00828"></a><span class="lineno"> 828</span>  <span class="stringliteral">"ld r16,Z\n"</span> <span class="comment">// r16 = y[0]</span></div>
|
|
<div class="line"><a name="l00829"></a><span class="lineno"> 829</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r8:r9 = y[0] * r23</span></div>
|
|
<div class="line"><a name="l00830"></a><span class="lineno"> 830</span>  <span class="stringliteral">"movw r8,r0\n"</span></div>
|
|
<div class="line"><a name="l00831"></a><span class="lineno"> 831</span>  <span class="stringliteral">"ldd r16,Z+2\n"</span> <span class="comment">// r16 = y[2]</span></div>
|
|
<div class="line"><a name="l00832"></a><span class="lineno"> 832</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r10:r11 = y[2] * r23</span></div>
|
|
<div class="line"><a name="l00833"></a><span class="lineno"> 833</span>  <span class="stringliteral">"movw r10,r0\n"</span></div>
|
|
<div class="line"><a name="l00834"></a><span class="lineno"> 834</span>  <span class="stringliteral">"ldd r16,Z+1\n"</span> <span class="comment">// r16 = y[1]</span></div>
|
|
<div class="line"><a name="l00835"></a><span class="lineno"> 835</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r9:r10:r11 += y[1] * r23</span></div>
|
|
<div class="line"><a name="l00836"></a><span class="lineno"> 836</span>  <span class="stringliteral">"add r9,r0\n"</span></div>
|
|
<div class="line"><a name="l00837"></a><span class="lineno"> 837</span>  <span class="stringliteral">"adc r10,r1\n"</span></div>
|
|
<div class="line"><a name="l00838"></a><span class="lineno"> 838</span>  <span class="stringliteral">"adc r11,r22\n"</span></div>
|
|
<div class="line"><a name="l00839"></a><span class="lineno"> 839</span>  <span class="stringliteral">"ldd r16,Z+3\n"</span> <span class="comment">// r16 = y[3]</span></div>
|
|
<div class="line"><a name="l00840"></a><span class="lineno"> 840</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r11:r1 += y[3] * r23</span></div>
|
|
<div class="line"><a name="l00841"></a><span class="lineno"> 841</span>  <span class="stringliteral">"add r11,r0\n"</span></div>
|
|
<div class="line"><a name="l00842"></a><span class="lineno"> 842</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00843"></a><span class="lineno"> 843</span>  <span class="stringliteral">"add r8,r24\n"</span> <span class="comment">// r8:r9:r10:r11:r1 += carry</span></div>
|
|
<div class="line"><a name="l00844"></a><span class="lineno"> 844</span>  <span class="stringliteral">"adc r9,r22\n"</span></div>
|
|
<div class="line"><a name="l00845"></a><span class="lineno"> 845</span>  <span class="stringliteral">"adc r10,r22\n"</span></div>
|
|
<div class="line"><a name="l00846"></a><span class="lineno"> 846</span>  <span class="stringliteral">"adc r11,r22\n"</span></div>
|
|
<div class="line"><a name="l00847"></a><span class="lineno"> 847</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00848"></a><span class="lineno"> 848</span>  <span class="stringliteral">"mov r24,r1\n"</span> <span class="comment">// carry = r1</span></div>
|
|
<div class="line"><a name="l00849"></a><span class="lineno"> 849</span>  <span class="stringliteral">"st Y+,r8\n"</span> <span class="comment">// *rr++ = r8:r9:r10:r11</span></div>
|
|
<div class="line"><a name="l00850"></a><span class="lineno"> 850</span>  <span class="stringliteral">"st Y+,r9\n"</span></div>
|
|
<div class="line"><a name="l00851"></a><span class="lineno"> 851</span>  <span class="stringliteral">"st Y+,r10\n"</span></div>
|
|
<div class="line"><a name="l00852"></a><span class="lineno"> 852</span>  <span class="stringliteral">"st Y+,r11\n"</span></div>
|
|
<div class="line"><a name="l00853"></a><span class="lineno"> 853</span>  <span class="stringliteral">"adiw r30,4\n"</span></div>
|
|
<div class="line"><a name="l00854"></a><span class="lineno"> 854</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l00855"></a><span class="lineno"> 855</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l00856"></a><span class="lineno"> 856</span>  <span class="stringliteral">"st Y+,r24\n"</span> <span class="comment">// *rr++ = carry</span></div>
|
|
<div class="line"><a name="l00857"></a><span class="lineno"> 857</span>  <span class="stringliteral">"sbiw r28,32\n"</span> <span class="comment">// rr -= 32</span></div>
|
|
<div class="line"><a name="l00858"></a><span class="lineno"> 858</span>  <span class="stringliteral">"sbiw r30,32\n"</span> <span class="comment">// Point Z back to the start of y</span></div>
|
|
<div class="line"><a name="l00859"></a><span class="lineno"> 859</span> </div>
|
|
<div class="line"><a name="l00860"></a><span class="lineno"> 860</span>  <span class="comment">// Multiply and add the remaining bytes of "x" by y[0..31].</span></div>
|
|
<div class="line"><a name="l00861"></a><span class="lineno"> 861</span>  <span class="stringliteral">"ldi r21,31\n"</span> <span class="comment">// 31 more bytes of x to go.</span></div>
|
|
<div class="line"><a name="l00862"></a><span class="lineno"> 862</span>  <span class="stringliteral">"2:\n"</span></div>
|
|
<div class="line"><a name="l00863"></a><span class="lineno"> 863</span>  <span class="stringliteral">"ldi r25,8\n"</span> <span class="comment">// loop 8 times: 4 bytes of y each time</span></div>
|
|
<div class="line"><a name="l00864"></a><span class="lineno"> 864</span>  <span class="stringliteral">"clr r24\n"</span> <span class="comment">// carry = 0</span></div>
|
|
<div class="line"><a name="l00865"></a><span class="lineno"> 865</span>  <span class="stringliteral">"ld r23,X+\n"</span> <span class="comment">// r23 = *x++</span></div>
|
|
<div class="line"><a name="l00866"></a><span class="lineno"> 866</span>  <span class="stringliteral">"3:\n"</span></div>
|
|
<div class="line"><a name="l00867"></a><span class="lineno"> 867</span>  <span class="stringliteral">"ld r16,Z\n"</span> <span class="comment">// r16 = y[0]</span></div>
|
|
<div class="line"><a name="l00868"></a><span class="lineno"> 868</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r8:r9 = y[0] * r23</span></div>
|
|
<div class="line"><a name="l00869"></a><span class="lineno"> 869</span>  <span class="stringliteral">"movw r8,r0\n"</span></div>
|
|
<div class="line"><a name="l00870"></a><span class="lineno"> 870</span>  <span class="stringliteral">"ldd r16,Z+2\n"</span> <span class="comment">// r16 = y[2]</span></div>
|
|
<div class="line"><a name="l00871"></a><span class="lineno"> 871</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r10:r11 = y[2] * r23</span></div>
|
|
<div class="line"><a name="l00872"></a><span class="lineno"> 872</span>  <span class="stringliteral">"movw r10,r0\n"</span></div>
|
|
<div class="line"><a name="l00873"></a><span class="lineno"> 873</span>  <span class="stringliteral">"ldd r16,Z+1\n"</span> <span class="comment">// r16 = y[1]</span></div>
|
|
<div class="line"><a name="l00874"></a><span class="lineno"> 874</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r9:r10:r11 += y[1] * r23</span></div>
|
|
<div class="line"><a name="l00875"></a><span class="lineno"> 875</span>  <span class="stringliteral">"add r9,r0\n"</span></div>
|
|
<div class="line"><a name="l00876"></a><span class="lineno"> 876</span>  <span class="stringliteral">"adc r10,r1\n"</span></div>
|
|
<div class="line"><a name="l00877"></a><span class="lineno"> 877</span>  <span class="stringliteral">"adc r11,r22\n"</span></div>
|
|
<div class="line"><a name="l00878"></a><span class="lineno"> 878</span>  <span class="stringliteral">"ldd r16,Z+3\n"</span> <span class="comment">// r16 = y[3]</span></div>
|
|
<div class="line"><a name="l00879"></a><span class="lineno"> 879</span>  <span class="stringliteral">"mul r16,r23\n"</span> <span class="comment">// r11:r1 += y[3] * r23</span></div>
|
|
<div class="line"><a name="l00880"></a><span class="lineno"> 880</span>  <span class="stringliteral">"add r11,r0\n"</span></div>
|
|
<div class="line"><a name="l00881"></a><span class="lineno"> 881</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00882"></a><span class="lineno"> 882</span>  <span class="stringliteral">"add r8,r24\n"</span> <span class="comment">// r8:r9:r10:r11:r1 += carry</span></div>
|
|
<div class="line"><a name="l00883"></a><span class="lineno"> 883</span>  <span class="stringliteral">"adc r9,r22\n"</span></div>
|
|
<div class="line"><a name="l00884"></a><span class="lineno"> 884</span>  <span class="stringliteral">"adc r10,r22\n"</span></div>
|
|
<div class="line"><a name="l00885"></a><span class="lineno"> 885</span>  <span class="stringliteral">"adc r11,r22\n"</span></div>
|
|
<div class="line"><a name="l00886"></a><span class="lineno"> 886</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00887"></a><span class="lineno"> 887</span>  <span class="stringliteral">"ld r16,Y\n"</span> <span class="comment">// r8:r9:r10:r11:r1 += rr[0..3]</span></div>
|
|
<div class="line"><a name="l00888"></a><span class="lineno"> 888</span>  <span class="stringliteral">"add r8,r16\n"</span></div>
|
|
<div class="line"><a name="l00889"></a><span class="lineno"> 889</span>  <span class="stringliteral">"ldd r16,Y+1\n"</span></div>
|
|
<div class="line"><a name="l00890"></a><span class="lineno"> 890</span>  <span class="stringliteral">"adc r9,r16\n"</span></div>
|
|
<div class="line"><a name="l00891"></a><span class="lineno"> 891</span>  <span class="stringliteral">"ldd r16,Y+2\n"</span></div>
|
|
<div class="line"><a name="l00892"></a><span class="lineno"> 892</span>  <span class="stringliteral">"adc r10,r16\n"</span></div>
|
|
<div class="line"><a name="l00893"></a><span class="lineno"> 893</span>  <span class="stringliteral">"ldd r16,Y+3\n"</span></div>
|
|
<div class="line"><a name="l00894"></a><span class="lineno"> 894</span>  <span class="stringliteral">"adc r11,r16\n"</span></div>
|
|
<div class="line"><a name="l00895"></a><span class="lineno"> 895</span>  <span class="stringliteral">"adc r1,r22\n"</span></div>
|
|
<div class="line"><a name="l00896"></a><span class="lineno"> 896</span>  <span class="stringliteral">"mov r24,r1\n"</span> <span class="comment">// carry = r1</span></div>
|
|
<div class="line"><a name="l00897"></a><span class="lineno"> 897</span>  <span class="stringliteral">"st Y+,r8\n"</span> <span class="comment">// *rr++ = r8:r9:r10:r11</span></div>
|
|
<div class="line"><a name="l00898"></a><span class="lineno"> 898</span>  <span class="stringliteral">"st Y+,r9\n"</span></div>
|
|
<div class="line"><a name="l00899"></a><span class="lineno"> 899</span>  <span class="stringliteral">"st Y+,r10\n"</span></div>
|
|
<div class="line"><a name="l00900"></a><span class="lineno"> 900</span>  <span class="stringliteral">"st Y+,r11\n"</span></div>
|
|
<div class="line"><a name="l00901"></a><span class="lineno"> 901</span>  <span class="stringliteral">"adiw r30,4\n"</span></div>
|
|
<div class="line"><a name="l00902"></a><span class="lineno"> 902</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l00903"></a><span class="lineno"> 903</span>  <span class="stringliteral">"brne 3b\n"</span></div>
|
|
<div class="line"><a name="l00904"></a><span class="lineno"> 904</span>  <span class="stringliteral">"st Y+,r24\n"</span> <span class="comment">// *r++ = carry</span></div>
|
|
<div class="line"><a name="l00905"></a><span class="lineno"> 905</span>  <span class="stringliteral">"sbiw r28,32\n"</span> <span class="comment">// rr -= 32</span></div>
|
|
<div class="line"><a name="l00906"></a><span class="lineno"> 906</span>  <span class="stringliteral">"sbiw r30,32\n"</span> <span class="comment">// Point Z back to the start of y</span></div>
|
|
<div class="line"><a name="l00907"></a><span class="lineno"> 907</span>  <span class="stringliteral">"dec r21\n"</span></div>
|
|
<div class="line"><a name="l00908"></a><span class="lineno"> 908</span>  <span class="stringliteral">"brne 2b\n"</span></div>
|
|
<div class="line"><a name="l00909"></a><span class="lineno"> 909</span> </div>
|
|
<div class="line"><a name="l00910"></a><span class="lineno"> 910</span>  <span class="comment">// Restore Y and __zero_reg__.</span></div>
|
|
<div class="line"><a name="l00911"></a><span class="lineno"> 911</span>  <span class="stringliteral">"pop r29\n"</span></div>
|
|
<div class="line"><a name="l00912"></a><span class="lineno"> 912</span>  <span class="stringliteral">"pop r28\n"</span></div>
|
|
<div class="line"><a name="l00913"></a><span class="lineno"> 913</span>  <span class="stringliteral">"clr __zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l00914"></a><span class="lineno"> 914</span>  : : <span class="stringliteral">"x"</span>(x), <span class="stringliteral">"z"</span>(y), <span class="stringliteral">"r"</span>(result)</div>
|
|
<div class="line"><a name="l00915"></a><span class="lineno"> 915</span>  : <span class="stringliteral">"r8"</span>, <span class="stringliteral">"r9"</span>, <span class="stringliteral">"r10"</span>, <span class="stringliteral">"r11"</span>, <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>,</div>
|
|
<div class="line"><a name="l00916"></a><span class="lineno"> 916</span>  <span class="stringliteral">"r23"</span>, <span class="stringliteral">"r24"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l00917"></a><span class="lineno"> 917</span>  );</div>
|
|
<div class="line"><a name="l00918"></a><span class="lineno"> 918</span> <span class="preprocessor">#endif</span></div>
|
|
<div class="line"><a name="l00919"></a><span class="lineno"> 919</span> <span class="preprocessor"></span>}</div>
|
|
<div class="line"><a name="l00920"></a><span class="lineno"> 920</span> </div>
|
|
<div class="line"><a name="l00931"></a><span class="lineno"> 931</span> <span class="keywordtype">void</span> Curve25519::mul(limb_t *result, <span class="keyword">const</span> limb_t *x, <span class="keyword">const</span> limb_t *y)</div>
|
|
<div class="line"><a name="l00932"></a><span class="lineno"> 932</span> {</div>
|
|
<div class="line"><a name="l00933"></a><span class="lineno"> 933</span>  limb_t temp[NUM_LIMBS_512BIT];</div>
|
|
<div class="line"><a name="l00934"></a><span class="lineno"> 934</span>  mulNoReduce(temp, x, y);</div>
|
|
<div class="line"><a name="l00935"></a><span class="lineno"> 935</span>  reduce(result, temp, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00936"></a><span class="lineno"> 936</span>  strict_clean(temp);</div>
|
|
<div class="line"><a name="l00937"></a><span class="lineno"> 937</span>  crypto_feed_watchdog();</div>
|
|
<div class="line"><a name="l00938"></a><span class="lineno"> 938</span> }</div>
|
|
<div class="line"><a name="l00939"></a><span class="lineno"> 939</span> </div>
|
|
<div class="line"><a name="l00959"></a><span class="lineno"> 959</span> <span class="keywordtype">void</span> Curve25519::mulA24(limb_t *result, <span class="keyword">const</span> limb_t *x)</div>
|
|
<div class="line"><a name="l00960"></a><span class="lineno"> 960</span> {</div>
|
|
<div class="line"><a name="l00961"></a><span class="lineno"> 961</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l00962"></a><span class="lineno"> 962</span> <span class="preprocessor"></span> <span class="comment">// The constant a24 = 121665 (0x1DB41) as a limb array.</span></div>
|
|
<div class="line"><a name="l00963"></a><span class="lineno"> 963</span> <span class="preprocessor">#if BIGNUMBER_LIMB_8BIT</span></div>
|
|
<div class="line"><a name="l00964"></a><span class="lineno"> 964</span> <span class="preprocessor"></span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> a24[3] PROGMEM = {0x41, 0xDB, 0x01};</div>
|
|
<div class="line"><a name="l00965"></a><span class="lineno"> 965</span> <span class="preprocessor">#elif BIGNUMBER_LIMB_16BIT</span></div>
|
|
<div class="line"><a name="l00966"></a><span class="lineno"> 966</span> <span class="preprocessor"></span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> a24[2] PROGMEM = {0xDB41, 0x0001};</div>
|
|
<div class="line"><a name="l00967"></a><span class="lineno"> 967</span> <span class="preprocessor">#elif BIGNUMBER_LIMB_32BIT || BIGNUMBER_LIMB_64BIT</span></div>
|
|
<div class="line"><a name="l00968"></a><span class="lineno"> 968</span> <span class="preprocessor"></span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> a24[1] PROGMEM = {0x0001DB41};</div>
|
|
<div class="line"><a name="l00969"></a><span class="lineno"> 969</span> <span class="preprocessor">#else</span></div>
|
|
<div class="line"><a name="l00970"></a><span class="lineno"> 970</span> <span class="preprocessor"></span><span class="preprocessor"> #error "limb_t must be 8, 16, 32, or 64 bits in size"</span></div>
|
|
<div class="line"><a name="l00971"></a><span class="lineno"> 971</span> <span class="preprocessor"></span><span class="preprocessor">#endif</span></div>
|
|
<div class="line"><a name="l00972"></a><span class="lineno"> 972</span> <span class="preprocessor"></span><span class="preprocessor"> #define NUM_A24_LIMBS (sizeof(a24) / sizeof(limb_t))</span></div>
|
|
<div class="line"><a name="l00973"></a><span class="lineno"> 973</span> <span class="preprocessor"></span></div>
|
|
<div class="line"><a name="l00974"></a><span class="lineno"> 974</span>  <span class="comment">// Multiply the lowest limb of a24 by x and zero-extend into the result.</span></div>
|
|
<div class="line"><a name="l00975"></a><span class="lineno"> 975</span>  limb_t temp[NUM_LIMBS_512BIT];</div>
|
|
<div class="line"><a name="l00976"></a><span class="lineno"> 976</span>  uint8_t i, j;</div>
|
|
<div class="line"><a name="l00977"></a><span class="lineno"> 977</span>  dlimb_t carry = 0;</div>
|
|
<div class="line"><a name="l00978"></a><span class="lineno"> 978</span>  limb_t word = pgm_read_limb(&(a24[0]));</div>
|
|
<div class="line"><a name="l00979"></a><span class="lineno"> 979</span>  <span class="keyword">const</span> limb_t *xx = x;</div>
|
|
<div class="line"><a name="l00980"></a><span class="lineno"> 980</span>  limb_t *tt = temp;</div>
|
|
<div class="line"><a name="l00981"></a><span class="lineno"> 981</span>  <span class="keywordflow">for</span> (i = 0; i < NUM_LIMBS_256BIT; ++i) {</div>
|
|
<div class="line"><a name="l00982"></a><span class="lineno"> 982</span>  carry += ((dlimb_t)(*xx++)) * word;</div>
|
|
<div class="line"><a name="l00983"></a><span class="lineno"> 983</span>  *tt++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00984"></a><span class="lineno"> 984</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00985"></a><span class="lineno"> 985</span>  }</div>
|
|
<div class="line"><a name="l00986"></a><span class="lineno"> 986</span>  *tt = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00987"></a><span class="lineno"> 987</span> </div>
|
|
<div class="line"><a name="l00988"></a><span class="lineno"> 988</span>  <span class="comment">// Multiply and add the remaining limbs of a24.</span></div>
|
|
<div class="line"><a name="l00989"></a><span class="lineno"> 989</span>  <span class="keywordflow">for</span> (i = 1; i < NUM_A24_LIMBS; ++i) {</div>
|
|
<div class="line"><a name="l00990"></a><span class="lineno"> 990</span>  word = pgm_read_limb(&(a24[i]));</div>
|
|
<div class="line"><a name="l00991"></a><span class="lineno"> 991</span>  carry = 0;</div>
|
|
<div class="line"><a name="l00992"></a><span class="lineno"> 992</span>  xx = x;</div>
|
|
<div class="line"><a name="l00993"></a><span class="lineno"> 993</span>  tt = temp + i;</div>
|
|
<div class="line"><a name="l00994"></a><span class="lineno"> 994</span>  <span class="keywordflow">for</span> (j = 0; j < NUM_LIMBS_256BIT; ++j) {</div>
|
|
<div class="line"><a name="l00995"></a><span class="lineno"> 995</span>  carry += ((dlimb_t)(*xx++)) * word;</div>
|
|
<div class="line"><a name="l00996"></a><span class="lineno"> 996</span>  carry += *tt;</div>
|
|
<div class="line"><a name="l00997"></a><span class="lineno"> 997</span>  *tt++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l00998"></a><span class="lineno"> 998</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l00999"></a><span class="lineno"> 999</span>  }</div>
|
|
<div class="line"><a name="l01000"></a><span class="lineno"> 1000</span>  *tt = (limb_t)carry;</div>
|
|
<div class="line"><a name="l01001"></a><span class="lineno"> 1001</span>  }</div>
|
|
<div class="line"><a name="l01002"></a><span class="lineno"> 1002</span> <span class="preprocessor">#else</span></div>
|
|
<div class="line"><a name="l01003"></a><span class="lineno"> 1003</span> <span class="preprocessor"></span> limb_t temp[NUM_LIMBS_512BIT];</div>
|
|
<div class="line"><a name="l01004"></a><span class="lineno"> 1004</span> <span class="preprocessor"> #define NUM_A24_LIMBS ((3 + sizeof(limb_t) - 1) / sizeof(limb_t))</span></div>
|
|
<div class="line"><a name="l01005"></a><span class="lineno"> 1005</span> <span class="preprocessor"></span> __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l01006"></a><span class="lineno"> 1006</span>  <span class="comment">// Load the two low bytes of a24 into r16 and r17.</span></div>
|
|
<div class="line"><a name="l01007"></a><span class="lineno"> 1007</span>  <span class="comment">// The third byte is 0x01 which we can deal with implicitly.</span></div>
|
|
<div class="line"><a name="l01008"></a><span class="lineno"> 1008</span>  <span class="stringliteral">"ldi r16,0x41\n"</span></div>
|
|
<div class="line"><a name="l01009"></a><span class="lineno"> 1009</span>  <span class="stringliteral">"ldi r17,0xDB\n"</span></div>
|
|
<div class="line"><a name="l01010"></a><span class="lineno"> 1010</span> </div>
|
|
<div class="line"><a name="l01011"></a><span class="lineno"> 1011</span>  <span class="comment">// Iterate over the bytes of "x" and multiply each with a24.</span></div>
|
|
<div class="line"><a name="l01012"></a><span class="lineno"> 1012</span>  <span class="stringliteral">"ldi r25,32\n"</span> <span class="comment">// 32 bytes in "x"</span></div>
|
|
<div class="line"><a name="l01013"></a><span class="lineno"> 1013</span>  <span class="stringliteral">"clr r22\n"</span> <span class="comment">// r22 = 0</span></div>
|
|
<div class="line"><a name="l01014"></a><span class="lineno"> 1014</span>  <span class="stringliteral">"clr r18\n"</span> <span class="comment">// r18:r19:r11 = 0 (carry)</span></div>
|
|
<div class="line"><a name="l01015"></a><span class="lineno"> 1015</span>  <span class="stringliteral">"clr r19\n"</span></div>
|
|
<div class="line"><a name="l01016"></a><span class="lineno"> 1016</span>  <span class="stringliteral">"clr r11\n"</span></div>
|
|
<div class="line"><a name="l01017"></a><span class="lineno"> 1017</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l01018"></a><span class="lineno"> 1018</span>  <span class="stringliteral">"ld r21,X+\n"</span> <span class="comment">// r21 = *x++</span></div>
|
|
<div class="line"><a name="l01019"></a><span class="lineno"> 1019</span>  <span class="stringliteral">"mul r21,r16\n"</span> <span class="comment">// r8:r9 = r21 * a24[0]</span></div>
|
|
<div class="line"><a name="l01020"></a><span class="lineno"> 1020</span>  <span class="stringliteral">"movw r8,r0\n"</span></div>
|
|
<div class="line"><a name="l01021"></a><span class="lineno"> 1021</span>  <span class="stringliteral">"mul r21,r17\n"</span> <span class="comment">// r9:r1 += r21 * a24[1]</span></div>
|
|
<div class="line"><a name="l01022"></a><span class="lineno"> 1022</span>  <span class="stringliteral">"add r9,r0\n"</span></div>
|
|
<div class="line"><a name="l01023"></a><span class="lineno"> 1023</span>  <span class="stringliteral">"adc r1,r21\n"</span> <span class="comment">// r1:r10 += r21 * a24[2] (implicitly 1)</span></div>
|
|
<div class="line"><a name="l01024"></a><span class="lineno"> 1024</span>  <span class="stringliteral">"mov r10,r22\n"</span></div>
|
|
<div class="line"><a name="l01025"></a><span class="lineno"> 1025</span>  <span class="stringliteral">"adc r10,r22\n"</span></div>
|
|
<div class="line"><a name="l01026"></a><span class="lineno"> 1026</span>  <span class="stringliteral">"add r8,r18\n"</span> <span class="comment">// r8:r9:r1:r10 += carry</span></div>
|
|
<div class="line"><a name="l01027"></a><span class="lineno"> 1027</span>  <span class="stringliteral">"adc r9,r19\n"</span></div>
|
|
<div class="line"><a name="l01028"></a><span class="lineno"> 1028</span>  <span class="stringliteral">"adc r1,r11\n"</span></div>
|
|
<div class="line"><a name="l01029"></a><span class="lineno"> 1029</span>  <span class="stringliteral">"adc r10,r22\n"</span></div>
|
|
<div class="line"><a name="l01030"></a><span class="lineno"> 1030</span>  <span class="stringliteral">"st Z+,r8\n"</span> <span class="comment">// *tt++ = r8</span></div>
|
|
<div class="line"><a name="l01031"></a><span class="lineno"> 1031</span>  <span class="stringliteral">"mov r18,r9\n"</span> <span class="comment">// carry = r9:r1:r10</span></div>
|
|
<div class="line"><a name="l01032"></a><span class="lineno"> 1032</span>  <span class="stringliteral">"mov r19,r1\n"</span></div>
|
|
<div class="line"><a name="l01033"></a><span class="lineno"> 1033</span>  <span class="stringliteral">"mov r11,r10\n"</span></div>
|
|
<div class="line"><a name="l01034"></a><span class="lineno"> 1034</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l01035"></a><span class="lineno"> 1035</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l01036"></a><span class="lineno"> 1036</span>  <span class="stringliteral">"st Z,r18\n"</span> <span class="comment">// *tt = carry</span></div>
|
|
<div class="line"><a name="l01037"></a><span class="lineno"> 1037</span>  <span class="stringliteral">"std Z+1,r19\n"</span></div>
|
|
<div class="line"><a name="l01038"></a><span class="lineno"> 1038</span>  <span class="stringliteral">"std Z+2,r11\n"</span></div>
|
|
<div class="line"><a name="l01039"></a><span class="lineno"> 1039</span> #<span class="keywordflow">if</span> BIGNUMBER_LIMB_16BIT || BIGNUMBER_LIMB_32BIT</div>
|
|
<div class="line"><a name="l01040"></a><span class="lineno"> 1040</span>  <span class="stringliteral">"std Z+3,r22\n"</span> <span class="comment">// Zero pad to a limb boundary</span></div>
|
|
<div class="line"><a name="l01041"></a><span class="lineno"> 1041</span> #endif</div>
|
|
<div class="line"><a name="l01042"></a><span class="lineno"> 1042</span> </div>
|
|
<div class="line"><a name="l01043"></a><span class="lineno"> 1043</span>  <span class="comment">// Restore __zero_reg__</span></div>
|
|
<div class="line"><a name="l01044"></a><span class="lineno"> 1044</span>  <span class="stringliteral">"clr __zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01045"></a><span class="lineno"> 1045</span> </div>
|
|
<div class="line"><a name="l01046"></a><span class="lineno"> 1046</span>  : : <span class="stringliteral">"x"</span>(x), <span class="stringliteral">"z"</span>(temp)</div>
|
|
<div class="line"><a name="l01047"></a><span class="lineno"> 1047</span>  : <span class="stringliteral">"r8"</span>, <span class="stringliteral">"r9"</span>, <span class="stringliteral">"r10"</span>, <span class="stringliteral">"r11"</span>, <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r17"</span>, <span class="stringliteral">"r18"</span>, <span class="stringliteral">"r19"</span>,</div>
|
|
<div class="line"><a name="l01048"></a><span class="lineno"> 1048</span>  <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l01049"></a><span class="lineno"> 1049</span>  );</div>
|
|
<div class="line"><a name="l01050"></a><span class="lineno"> 1050</span> <span class="preprocessor">#endif</span></div>
|
|
<div class="line"><a name="l01051"></a><span class="lineno"> 1051</span> <span class="preprocessor"></span></div>
|
|
<div class="line"><a name="l01052"></a><span class="lineno"> 1052</span>  <span class="comment">// Reduce the intermediate result modulo 2^255 - 19.</span></div>
|
|
<div class="line"><a name="l01053"></a><span class="lineno"> 1053</span>  reduce(result, temp, NUM_A24_LIMBS);</div>
|
|
<div class="line"><a name="l01054"></a><span class="lineno"> 1054</span>  strict_clean(temp);</div>
|
|
<div class="line"><a name="l01055"></a><span class="lineno"> 1055</span> }</div>
|
|
<div class="line"><a name="l01056"></a><span class="lineno"> 1056</span> </div>
|
|
<div class="line"><a name="l01068"></a><span class="lineno"> 1068</span> <span class="keywordtype">void</span> Curve25519::mul_P(limb_t *result, <span class="keyword">const</span> limb_t *x, <span class="keyword">const</span> limb_t *y)</div>
|
|
<div class="line"><a name="l01069"></a><span class="lineno"> 1069</span> {</div>
|
|
<div class="line"><a name="l01070"></a><span class="lineno"> 1070</span>  limb_t temp[NUM_LIMBS_512BIT];</div>
|
|
<div class="line"><a name="l01071"></a><span class="lineno"> 1071</span>  uint8_t i, j;</div>
|
|
<div class="line"><a name="l01072"></a><span class="lineno"> 1072</span>  dlimb_t carry;</div>
|
|
<div class="line"><a name="l01073"></a><span class="lineno"> 1073</span>  limb_t word;</div>
|
|
<div class="line"><a name="l01074"></a><span class="lineno"> 1074</span>  <span class="keyword">const</span> limb_t *xx;</div>
|
|
<div class="line"><a name="l01075"></a><span class="lineno"> 1075</span>  limb_t *tt;</div>
|
|
<div class="line"><a name="l01076"></a><span class="lineno"> 1076</span> </div>
|
|
<div class="line"><a name="l01077"></a><span class="lineno"> 1077</span>  <span class="comment">// Multiply the lowest word of y by x.</span></div>
|
|
<div class="line"><a name="l01078"></a><span class="lineno"> 1078</span>  carry = 0;</div>
|
|
<div class="line"><a name="l01079"></a><span class="lineno"> 1079</span>  word = pgm_read_limb(&(y[0]));</div>
|
|
<div class="line"><a name="l01080"></a><span class="lineno"> 1080</span>  xx = x;</div>
|
|
<div class="line"><a name="l01081"></a><span class="lineno"> 1081</span>  tt = temp;</div>
|
|
<div class="line"><a name="l01082"></a><span class="lineno"> 1082</span>  <span class="keywordflow">for</span> (i = 0; i < NUM_LIMBS_256BIT; ++i) {</div>
|
|
<div class="line"><a name="l01083"></a><span class="lineno"> 1083</span>  carry += ((dlimb_t)(*xx++)) * word;</div>
|
|
<div class="line"><a name="l01084"></a><span class="lineno"> 1084</span>  *tt++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l01085"></a><span class="lineno"> 1085</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l01086"></a><span class="lineno"> 1086</span>  }</div>
|
|
<div class="line"><a name="l01087"></a><span class="lineno"> 1087</span>  *tt = (limb_t)carry;</div>
|
|
<div class="line"><a name="l01088"></a><span class="lineno"> 1088</span> </div>
|
|
<div class="line"><a name="l01089"></a><span class="lineno"> 1089</span>  <span class="comment">// Multiply and add the remaining words of y by x.</span></div>
|
|
<div class="line"><a name="l01090"></a><span class="lineno"> 1090</span>  <span class="keywordflow">for</span> (i = 1; i < NUM_LIMBS_256BIT; ++i) {</div>
|
|
<div class="line"><a name="l01091"></a><span class="lineno"> 1091</span>  word = pgm_read_limb(&(y[i]));</div>
|
|
<div class="line"><a name="l01092"></a><span class="lineno"> 1092</span>  carry = 0;</div>
|
|
<div class="line"><a name="l01093"></a><span class="lineno"> 1093</span>  xx = x;</div>
|
|
<div class="line"><a name="l01094"></a><span class="lineno"> 1094</span>  tt = temp + i;</div>
|
|
<div class="line"><a name="l01095"></a><span class="lineno"> 1095</span>  <span class="keywordflow">for</span> (j = 0; j < NUM_LIMBS_256BIT; ++j) {</div>
|
|
<div class="line"><a name="l01096"></a><span class="lineno"> 1096</span>  carry += ((dlimb_t)(*xx++)) * word;</div>
|
|
<div class="line"><a name="l01097"></a><span class="lineno"> 1097</span>  carry += *tt;</div>
|
|
<div class="line"><a name="l01098"></a><span class="lineno"> 1098</span>  *tt++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l01099"></a><span class="lineno"> 1099</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l01100"></a><span class="lineno"> 1100</span>  }</div>
|
|
<div class="line"><a name="l01101"></a><span class="lineno"> 1101</span>  *tt = (limb_t)carry;</div>
|
|
<div class="line"><a name="l01102"></a><span class="lineno"> 1102</span>  }</div>
|
|
<div class="line"><a name="l01103"></a><span class="lineno"> 1103</span> </div>
|
|
<div class="line"><a name="l01104"></a><span class="lineno"> 1104</span>  <span class="comment">// Reduce the intermediate result modulo 2^255 - 19.</span></div>
|
|
<div class="line"><a name="l01105"></a><span class="lineno"> 1105</span>  reduce(result, temp, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l01106"></a><span class="lineno"> 1106</span>  strict_clean(temp);</div>
|
|
<div class="line"><a name="l01107"></a><span class="lineno"> 1107</span> }</div>
|
|
<div class="line"><a name="l01108"></a><span class="lineno"> 1108</span> </div>
|
|
<div class="line"><a name="l01119"></a><span class="lineno"> 1119</span> <span class="keywordtype">void</span> Curve25519::add(limb_t *result, <span class="keyword">const</span> limb_t *x, <span class="keyword">const</span> limb_t *y)</div>
|
|
<div class="line"><a name="l01120"></a><span class="lineno"> 1120</span> {</div>
|
|
<div class="line"><a name="l01121"></a><span class="lineno"> 1121</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l01122"></a><span class="lineno"> 1122</span> <span class="preprocessor"></span> dlimb_t carry = 0;</div>
|
|
<div class="line"><a name="l01123"></a><span class="lineno"> 1123</span>  uint8_t posn;</div>
|
|
<div class="line"><a name="l01124"></a><span class="lineno"> 1124</span>  limb_t *rr = result;</div>
|
|
<div class="line"><a name="l01125"></a><span class="lineno"> 1125</span> </div>
|
|
<div class="line"><a name="l01126"></a><span class="lineno"> 1126</span>  <span class="comment">// Add the two arrays to obtain the intermediate result.</span></div>
|
|
<div class="line"><a name="l01127"></a><span class="lineno"> 1127</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l01128"></a><span class="lineno"> 1128</span>  carry += *x++;</div>
|
|
<div class="line"><a name="l01129"></a><span class="lineno"> 1129</span>  carry += *y++;</div>
|
|
<div class="line"><a name="l01130"></a><span class="lineno"> 1130</span>  *rr++ = (limb_t)carry;</div>
|
|
<div class="line"><a name="l01131"></a><span class="lineno"> 1131</span>  carry >>= LIMB_BITS;</div>
|
|
<div class="line"><a name="l01132"></a><span class="lineno"> 1132</span>  }</div>
|
|
<div class="line"><a name="l01133"></a><span class="lineno"> 1133</span> <span class="preprocessor">#else // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01134"></a><span class="lineno"> 1134</span> <span class="preprocessor"></span> __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l01135"></a><span class="lineno"> 1135</span>  <span class="comment">// Save Y and copy the "result" pointer into it.</span></div>
|
|
<div class="line"><a name="l01136"></a><span class="lineno"> 1136</span>  <span class="stringliteral">"push r28\n"</span></div>
|
|
<div class="line"><a name="l01137"></a><span class="lineno"> 1137</span>  <span class="stringliteral">"push r29\n"</span></div>
|
|
<div class="line"><a name="l01138"></a><span class="lineno"> 1138</span>  <span class="stringliteral">"mov r28,%A2\n"</span></div>
|
|
<div class="line"><a name="l01139"></a><span class="lineno"> 1139</span>  <span class="stringliteral">"mov r29,%B2\n"</span></div>
|
|
<div class="line"><a name="l01140"></a><span class="lineno"> 1140</span> </div>
|
|
<div class="line"><a name="l01141"></a><span class="lineno"> 1141</span>  <span class="comment">// Unroll the loop to operate on 4 bytes at a time (8 iterations).</span></div>
|
|
<div class="line"><a name="l01142"></a><span class="lineno"> 1142</span>  <span class="stringliteral">"ldi r24,8\n"</span> <span class="comment">// Loop counter.</span></div>
|
|
<div class="line"><a name="l01143"></a><span class="lineno"> 1143</span>  <span class="stringliteral">"clr r25\n"</span> <span class="comment">// carry = 0</span></div>
|
|
<div class="line"><a name="l01144"></a><span class="lineno"> 1144</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l01145"></a><span class="lineno"> 1145</span>  <span class="stringliteral">"ld r16,X+\n"</span> <span class="comment">// r16:r19 = *x++</span></div>
|
|
<div class="line"><a name="l01146"></a><span class="lineno"> 1146</span>  <span class="stringliteral">"ld r17,X+\n"</span></div>
|
|
<div class="line"><a name="l01147"></a><span class="lineno"> 1147</span>  <span class="stringliteral">"ld r18,X+\n"</span></div>
|
|
<div class="line"><a name="l01148"></a><span class="lineno"> 1148</span>  <span class="stringliteral">"ld r19,X+\n"</span></div>
|
|
<div class="line"><a name="l01149"></a><span class="lineno"> 1149</span>  <span class="stringliteral">"ld r20,Z+\n"</span> <span class="comment">// r20:r23 = *y++</span></div>
|
|
<div class="line"><a name="l01150"></a><span class="lineno"> 1150</span>  <span class="stringliteral">"ld r21,Z+\n"</span></div>
|
|
<div class="line"><a name="l01151"></a><span class="lineno"> 1151</span>  <span class="stringliteral">"ld r22,Z+\n"</span></div>
|
|
<div class="line"><a name="l01152"></a><span class="lineno"> 1152</span>  <span class="stringliteral">"ld r23,Z+\n"</span></div>
|
|
<div class="line"><a name="l01153"></a><span class="lineno"> 1153</span>  <span class="stringliteral">"add r16,r25\n"</span> <span class="comment">// r16:r19:carry += carry</span></div>
|
|
<div class="line"><a name="l01154"></a><span class="lineno"> 1154</span>  <span class="stringliteral">"adc r17,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01155"></a><span class="lineno"> 1155</span>  <span class="stringliteral">"adc r18,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01156"></a><span class="lineno"> 1156</span>  <span class="stringliteral">"adc r19,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01157"></a><span class="lineno"> 1157</span>  <span class="stringliteral">"mov r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01158"></a><span class="lineno"> 1158</span>  <span class="stringliteral">"adc r25,r25\n"</span></div>
|
|
<div class="line"><a name="l01159"></a><span class="lineno"> 1159</span>  <span class="stringliteral">"add r16,r20\n"</span> <span class="comment">// r16:r19:carry += r20:r23</span></div>
|
|
<div class="line"><a name="l01160"></a><span class="lineno"> 1160</span>  <span class="stringliteral">"adc r17,r21\n"</span></div>
|
|
<div class="line"><a name="l01161"></a><span class="lineno"> 1161</span>  <span class="stringliteral">"adc r18,r22\n"</span></div>
|
|
<div class="line"><a name="l01162"></a><span class="lineno"> 1162</span>  <span class="stringliteral">"adc r19,r23\n"</span></div>
|
|
<div class="line"><a name="l01163"></a><span class="lineno"> 1163</span>  <span class="stringliteral">"adc r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01164"></a><span class="lineno"> 1164</span>  <span class="stringliteral">"st Y+,r16\n"</span> <span class="comment">// *rr++ = r16:r23</span></div>
|
|
<div class="line"><a name="l01165"></a><span class="lineno"> 1165</span>  <span class="stringliteral">"st Y+,r17\n"</span></div>
|
|
<div class="line"><a name="l01166"></a><span class="lineno"> 1166</span>  <span class="stringliteral">"st Y+,r18\n"</span></div>
|
|
<div class="line"><a name="l01167"></a><span class="lineno"> 1167</span>  <span class="stringliteral">"st Y+,r19\n"</span></div>
|
|
<div class="line"><a name="l01168"></a><span class="lineno"> 1168</span>  <span class="stringliteral">"dec r24\n"</span></div>
|
|
<div class="line"><a name="l01169"></a><span class="lineno"> 1169</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l01170"></a><span class="lineno"> 1170</span> </div>
|
|
<div class="line"><a name="l01171"></a><span class="lineno"> 1171</span>  <span class="comment">// Restore Y.</span></div>
|
|
<div class="line"><a name="l01172"></a><span class="lineno"> 1172</span>  <span class="stringliteral">"pop r29\n"</span></div>
|
|
<div class="line"><a name="l01173"></a><span class="lineno"> 1173</span>  <span class="stringliteral">"pop r28\n"</span></div>
|
|
<div class="line"><a name="l01174"></a><span class="lineno"> 1174</span>  : : <span class="stringliteral">"x"</span>(x), <span class="stringliteral">"z"</span>(y), <span class="stringliteral">"r"</span>(result)</div>
|
|
<div class="line"><a name="l01175"></a><span class="lineno"> 1175</span>  : <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r17"</span>, <span class="stringliteral">"r18"</span>, <span class="stringliteral">"r19"</span>, <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>, <span class="stringliteral">"r23"</span>,</div>
|
|
<div class="line"><a name="l01176"></a><span class="lineno"> 1176</span>  <span class="stringliteral">"r24"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l01177"></a><span class="lineno"> 1177</span>  );</div>
|
|
<div class="line"><a name="l01178"></a><span class="lineno"> 1178</span> <span class="preprocessor">#endif // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01179"></a><span class="lineno"> 1179</span> <span class="preprocessor"></span></div>
|
|
<div class="line"><a name="l01180"></a><span class="lineno"> 1180</span>  <span class="comment">// Reduce the result using the quick trial subtraction method.</span></div>
|
|
<div class="line"><a name="l01181"></a><span class="lineno"> 1181</span>  reduceQuick(result);</div>
|
|
<div class="line"><a name="l01182"></a><span class="lineno"> 1182</span> }</div>
|
|
<div class="line"><a name="l01183"></a><span class="lineno"> 1183</span> </div>
|
|
<div class="line"><a name="l01194"></a><span class="lineno"> 1194</span> <span class="keywordtype">void</span> Curve25519::sub(limb_t *result, <span class="keyword">const</span> limb_t *x, <span class="keyword">const</span> limb_t *y)</div>
|
|
<div class="line"><a name="l01195"></a><span class="lineno"> 1195</span> {</div>
|
|
<div class="line"><a name="l01196"></a><span class="lineno"> 1196</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l01197"></a><span class="lineno"> 1197</span> <span class="preprocessor"></span> dlimb_t borrow;</div>
|
|
<div class="line"><a name="l01198"></a><span class="lineno"> 1198</span>  uint8_t posn;</div>
|
|
<div class="line"><a name="l01199"></a><span class="lineno"> 1199</span>  limb_t *rr = result;</div>
|
|
<div class="line"><a name="l01200"></a><span class="lineno"> 1200</span> </div>
|
|
<div class="line"><a name="l01201"></a><span class="lineno"> 1201</span>  <span class="comment">// Subtract y from x to generate the intermediate result.</span></div>
|
|
<div class="line"><a name="l01202"></a><span class="lineno"> 1202</span>  borrow = 0;</div>
|
|
<div class="line"><a name="l01203"></a><span class="lineno"> 1203</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l01204"></a><span class="lineno"> 1204</span>  borrow = ((dlimb_t)(*x++)) - (*y++) - ((borrow >> LIMB_BITS) & 0x01);</div>
|
|
<div class="line"><a name="l01205"></a><span class="lineno"> 1205</span>  *rr++ = (limb_t)borrow;</div>
|
|
<div class="line"><a name="l01206"></a><span class="lineno"> 1206</span>  }</div>
|
|
<div class="line"><a name="l01207"></a><span class="lineno"> 1207</span> </div>
|
|
<div class="line"><a name="l01208"></a><span class="lineno"> 1208</span>  <span class="comment">// If we had a borrow, then the result has gone negative and we</span></div>
|
|
<div class="line"><a name="l01209"></a><span class="lineno"> 1209</span>  <span class="comment">// have to add 2^255 - 19 to the result to make it positive again.</span></div>
|
|
<div class="line"><a name="l01210"></a><span class="lineno"> 1210</span>  <span class="comment">// The top bits of "borrow" will be all 1's if there is a borrow</span></div>
|
|
<div class="line"><a name="l01211"></a><span class="lineno"> 1211</span>  <span class="comment">// or it will be all 0's if there was no borrow. Easiest is to</span></div>
|
|
<div class="line"><a name="l01212"></a><span class="lineno"> 1212</span>  <span class="comment">// conditionally subtract 19 and then mask off the high bit.</span></div>
|
|
<div class="line"><a name="l01213"></a><span class="lineno"> 1213</span>  rr = result;</div>
|
|
<div class="line"><a name="l01214"></a><span class="lineno"> 1214</span>  borrow = (borrow >> LIMB_BITS) & 19U;</div>
|
|
<div class="line"><a name="l01215"></a><span class="lineno"> 1215</span>  borrow = ((dlimb_t)(*rr)) - borrow;</div>
|
|
<div class="line"><a name="l01216"></a><span class="lineno"> 1216</span>  *rr++ = (limb_t)borrow;</div>
|
|
<div class="line"><a name="l01217"></a><span class="lineno"> 1217</span>  <span class="keywordflow">for</span> (posn = 1; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l01218"></a><span class="lineno"> 1218</span>  borrow = ((dlimb_t)(*rr)) - ((borrow >> LIMB_BITS) & 0x01);</div>
|
|
<div class="line"><a name="l01219"></a><span class="lineno"> 1219</span>  *rr++ = (limb_t)borrow;</div>
|
|
<div class="line"><a name="l01220"></a><span class="lineno"> 1220</span>  }</div>
|
|
<div class="line"><a name="l01221"></a><span class="lineno"> 1221</span>  *(--rr) &= ((((limb_t)1) << (LIMB_BITS - 1)) - 1);</div>
|
|
<div class="line"><a name="l01222"></a><span class="lineno"> 1222</span> <span class="preprocessor">#else // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01223"></a><span class="lineno"> 1223</span> <span class="preprocessor"></span> __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l01224"></a><span class="lineno"> 1224</span>  <span class="comment">// Save Y and copy the "result" pointer into it.</span></div>
|
|
<div class="line"><a name="l01225"></a><span class="lineno"> 1225</span>  <span class="stringliteral">"push r28\n"</span></div>
|
|
<div class="line"><a name="l01226"></a><span class="lineno"> 1226</span>  <span class="stringliteral">"push r29\n"</span></div>
|
|
<div class="line"><a name="l01227"></a><span class="lineno"> 1227</span>  <span class="stringliteral">"mov r28,%A2\n"</span></div>
|
|
<div class="line"><a name="l01228"></a><span class="lineno"> 1228</span>  <span class="stringliteral">"mov r29,%B2\n"</span></div>
|
|
<div class="line"><a name="l01229"></a><span class="lineno"> 1229</span> </div>
|
|
<div class="line"><a name="l01230"></a><span class="lineno"> 1230</span>  <span class="comment">// Unroll the sub loop to operate on 4 bytes at a time (8 iterations).</span></div>
|
|
<div class="line"><a name="l01231"></a><span class="lineno"> 1231</span>  <span class="stringliteral">"ldi r24,8\n"</span> <span class="comment">// Loop counter.</span></div>
|
|
<div class="line"><a name="l01232"></a><span class="lineno"> 1232</span>  <span class="stringliteral">"clr r25\n"</span> <span class="comment">// borrow = 0</span></div>
|
|
<div class="line"><a name="l01233"></a><span class="lineno"> 1233</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l01234"></a><span class="lineno"> 1234</span>  <span class="stringliteral">"ld r16,X+\n"</span> <span class="comment">// r16:r19 = *x++</span></div>
|
|
<div class="line"><a name="l01235"></a><span class="lineno"> 1235</span>  <span class="stringliteral">"ld r17,X+\n"</span></div>
|
|
<div class="line"><a name="l01236"></a><span class="lineno"> 1236</span>  <span class="stringliteral">"ld r18,X+\n"</span></div>
|
|
<div class="line"><a name="l01237"></a><span class="lineno"> 1237</span>  <span class="stringliteral">"ld r19,X+\n"</span></div>
|
|
<div class="line"><a name="l01238"></a><span class="lineno"> 1238</span>  <span class="stringliteral">"ld r20,Z+\n"</span> <span class="comment">// r20:r23 = *y++</span></div>
|
|
<div class="line"><a name="l01239"></a><span class="lineno"> 1239</span>  <span class="stringliteral">"ld r21,Z+\n"</span></div>
|
|
<div class="line"><a name="l01240"></a><span class="lineno"> 1240</span>  <span class="stringliteral">"ld r22,Z+\n"</span></div>
|
|
<div class="line"><a name="l01241"></a><span class="lineno"> 1241</span>  <span class="stringliteral">"ld r23,Z+\n"</span></div>
|
|
<div class="line"><a name="l01242"></a><span class="lineno"> 1242</span>  <span class="stringliteral">"sub r16,r25\n"</span> <span class="comment">// r16:r19:borrow -= borrow</span></div>
|
|
<div class="line"><a name="l01243"></a><span class="lineno"> 1243</span>  <span class="stringliteral">"sbc r17,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01244"></a><span class="lineno"> 1244</span>  <span class="stringliteral">"sbc r18,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01245"></a><span class="lineno"> 1245</span>  <span class="stringliteral">"sbc r19,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01246"></a><span class="lineno"> 1246</span>  <span class="stringliteral">"mov r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01247"></a><span class="lineno"> 1247</span>  <span class="stringliteral">"sbc r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01248"></a><span class="lineno"> 1248</span>  <span class="stringliteral">"sub r16,r20\n"</span> <span class="comment">// r16:r19:borrow -= r20:r23</span></div>
|
|
<div class="line"><a name="l01249"></a><span class="lineno"> 1249</span>  <span class="stringliteral">"sbc r17,r21\n"</span></div>
|
|
<div class="line"><a name="l01250"></a><span class="lineno"> 1250</span>  <span class="stringliteral">"sbc r18,r22\n"</span></div>
|
|
<div class="line"><a name="l01251"></a><span class="lineno"> 1251</span>  <span class="stringliteral">"sbc r19,r23\n"</span></div>
|
|
<div class="line"><a name="l01252"></a><span class="lineno"> 1252</span>  <span class="stringliteral">"sbc r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01253"></a><span class="lineno"> 1253</span>  <span class="stringliteral">"st Y+,r16\n"</span> <span class="comment">// *rr++ = r16:r23</span></div>
|
|
<div class="line"><a name="l01254"></a><span class="lineno"> 1254</span>  <span class="stringliteral">"st Y+,r17\n"</span></div>
|
|
<div class="line"><a name="l01255"></a><span class="lineno"> 1255</span>  <span class="stringliteral">"st Y+,r18\n"</span></div>
|
|
<div class="line"><a name="l01256"></a><span class="lineno"> 1256</span>  <span class="stringliteral">"st Y+,r19\n"</span></div>
|
|
<div class="line"><a name="l01257"></a><span class="lineno"> 1257</span>  <span class="stringliteral">"andi r25,1\n"</span> <span class="comment">// Only need the bottom bit of the borrow</span></div>
|
|
<div class="line"><a name="l01258"></a><span class="lineno"> 1258</span>  <span class="stringliteral">"dec r24\n"</span></div>
|
|
<div class="line"><a name="l01259"></a><span class="lineno"> 1259</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l01260"></a><span class="lineno"> 1260</span> </div>
|
|
<div class="line"><a name="l01261"></a><span class="lineno"> 1261</span>  <span class="comment">// If there was a borrow, then we need to add 2^255 - 19 back.</span></div>
|
|
<div class="line"><a name="l01262"></a><span class="lineno"> 1262</span>  <span class="comment">// We conditionally subtract 19 and then mask off the high bit.</span></div>
|
|
<div class="line"><a name="l01263"></a><span class="lineno"> 1263</span>  <span class="stringliteral">"neg r25\n"</span> <span class="comment">// borrow = mask(borrow) & 19</span></div>
|
|
<div class="line"><a name="l01264"></a><span class="lineno"> 1264</span>  <span class="stringliteral">"andi r25,19\n"</span></div>
|
|
<div class="line"><a name="l01265"></a><span class="lineno"> 1265</span>  <span class="stringliteral">"sbiw r28,32\n"</span> <span class="comment">// Point Y back to the start of "result"</span></div>
|
|
<div class="line"><a name="l01266"></a><span class="lineno"> 1266</span>  <span class="stringliteral">"ldi r24,8\n"</span></div>
|
|
<div class="line"><a name="l01267"></a><span class="lineno"> 1267</span>  <span class="stringliteral">"2:\n"</span></div>
|
|
<div class="line"><a name="l01268"></a><span class="lineno"> 1268</span>  <span class="stringliteral">"ld r16,Y\n"</span> <span class="comment">// r16:r19 = *rr</span></div>
|
|
<div class="line"><a name="l01269"></a><span class="lineno"> 1269</span>  <span class="stringliteral">"ldd r17,Y+1\n"</span></div>
|
|
<div class="line"><a name="l01270"></a><span class="lineno"> 1270</span>  <span class="stringliteral">"ldd r18,Y+2\n"</span></div>
|
|
<div class="line"><a name="l01271"></a><span class="lineno"> 1271</span>  <span class="stringliteral">"ldd r19,Y+3\n"</span></div>
|
|
<div class="line"><a name="l01272"></a><span class="lineno"> 1272</span>  <span class="stringliteral">"sub r16,r25\n"</span></div>
|
|
<div class="line"><a name="l01273"></a><span class="lineno"> 1273</span>  <span class="stringliteral">"sbc r17,__zero_reg__\n"</span> <span class="comment">// r16:r19:borrow -= borrow</span></div>
|
|
<div class="line"><a name="l01274"></a><span class="lineno"> 1274</span>  <span class="stringliteral">"sbc r18,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01275"></a><span class="lineno"> 1275</span>  <span class="stringliteral">"sbc r19,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01276"></a><span class="lineno"> 1276</span>  <span class="stringliteral">"mov r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01277"></a><span class="lineno"> 1277</span>  <span class="stringliteral">"sbc r25,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01278"></a><span class="lineno"> 1278</span>  <span class="stringliteral">"andi r25,1\n"</span></div>
|
|
<div class="line"><a name="l01279"></a><span class="lineno"> 1279</span>  <span class="stringliteral">"st Y+,r16\n"</span> <span class="comment">// *r++ = r16:r19</span></div>
|
|
<div class="line"><a name="l01280"></a><span class="lineno"> 1280</span>  <span class="stringliteral">"st Y+,r17\n"</span></div>
|
|
<div class="line"><a name="l01281"></a><span class="lineno"> 1281</span>  <span class="stringliteral">"st Y+,r18\n"</span></div>
|
|
<div class="line"><a name="l01282"></a><span class="lineno"> 1282</span>  <span class="stringliteral">"st Y+,r19\n"</span></div>
|
|
<div class="line"><a name="l01283"></a><span class="lineno"> 1283</span>  <span class="stringliteral">"dec r24\n"</span></div>
|
|
<div class="line"><a name="l01284"></a><span class="lineno"> 1284</span>  <span class="stringliteral">"brne 2b\n"</span></div>
|
|
<div class="line"><a name="l01285"></a><span class="lineno"> 1285</span>  <span class="stringliteral">"andi r19,0x7F\n"</span> <span class="comment">// Mask off the high bit in the last byte</span></div>
|
|
<div class="line"><a name="l01286"></a><span class="lineno"> 1286</span>  <span class="stringliteral">"sbiw r28,1\n"</span></div>
|
|
<div class="line"><a name="l01287"></a><span class="lineno"> 1287</span>  <span class="stringliteral">"st Y,r19\n"</span></div>
|
|
<div class="line"><a name="l01288"></a><span class="lineno"> 1288</span> </div>
|
|
<div class="line"><a name="l01289"></a><span class="lineno"> 1289</span>  <span class="comment">// Restore Y.</span></div>
|
|
<div class="line"><a name="l01290"></a><span class="lineno"> 1290</span>  <span class="stringliteral">"pop r29\n"</span></div>
|
|
<div class="line"><a name="l01291"></a><span class="lineno"> 1291</span>  <span class="stringliteral">"pop r28\n"</span></div>
|
|
<div class="line"><a name="l01292"></a><span class="lineno"> 1292</span>  : : <span class="stringliteral">"x"</span>(x), <span class="stringliteral">"z"</span>(y), <span class="stringliteral">"r"</span>(result)</div>
|
|
<div class="line"><a name="l01293"></a><span class="lineno"> 1293</span>  : <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r17"</span>, <span class="stringliteral">"r18"</span>, <span class="stringliteral">"r19"</span>, <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>, <span class="stringliteral">"r23"</span>,</div>
|
|
<div class="line"><a name="l01294"></a><span class="lineno"> 1294</span>  <span class="stringliteral">"r24"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l01295"></a><span class="lineno"> 1295</span>  );</div>
|
|
<div class="line"><a name="l01296"></a><span class="lineno"> 1296</span> <span class="preprocessor">#endif // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01297"></a><span class="lineno"> 1297</span> <span class="preprocessor"></span>}</div>
|
|
<div class="line"><a name="l01298"></a><span class="lineno"> 1298</span> </div>
|
|
<div class="line"><a name="l01311"></a><span class="lineno"> 1311</span> <span class="keywordtype">void</span> Curve25519::cswap(limb_t select, limb_t *x, limb_t *y)</div>
|
|
<div class="line"><a name="l01312"></a><span class="lineno"> 1312</span> {</div>
|
|
<div class="line"><a name="l01313"></a><span class="lineno"> 1313</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l01314"></a><span class="lineno"> 1314</span> <span class="preprocessor"></span> uint8_t posn;</div>
|
|
<div class="line"><a name="l01315"></a><span class="lineno"> 1315</span>  limb_t dummy;</div>
|
|
<div class="line"><a name="l01316"></a><span class="lineno"> 1316</span>  limb_t sel;</div>
|
|
<div class="line"><a name="l01317"></a><span class="lineno"> 1317</span> </div>
|
|
<div class="line"><a name="l01318"></a><span class="lineno"> 1318</span>  <span class="comment">// Turn "select" into an all-zeroes or all-ones mask. We don't care</span></div>
|
|
<div class="line"><a name="l01319"></a><span class="lineno"> 1319</span>  <span class="comment">// which bit or bits is set in the original "select" value.</span></div>
|
|
<div class="line"><a name="l01320"></a><span class="lineno"> 1320</span>  sel = (limb_t)(((((dlimb_t)1) << LIMB_BITS) - select) >> LIMB_BITS);</div>
|
|
<div class="line"><a name="l01321"></a><span class="lineno"> 1321</span>  --sel;</div>
|
|
<div class="line"><a name="l01322"></a><span class="lineno"> 1322</span> </div>
|
|
<div class="line"><a name="l01323"></a><span class="lineno"> 1323</span>  <span class="comment">// Swap the two values based on "select". Algorithm from:</span></div>
|
|
<div class="line"><a name="l01324"></a><span class="lineno"> 1324</span>  <span class="comment">// http://tools.ietf.org/html/rfc7748</span></div>
|
|
<div class="line"><a name="l01325"></a><span class="lineno"> 1325</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l01326"></a><span class="lineno"> 1326</span>  dummy = sel & (x[posn] ^ y[posn]);</div>
|
|
<div class="line"><a name="l01327"></a><span class="lineno"> 1327</span>  x[posn] ^= dummy;</div>
|
|
<div class="line"><a name="l01328"></a><span class="lineno"> 1328</span>  y[posn] ^= dummy;</div>
|
|
<div class="line"><a name="l01329"></a><span class="lineno"> 1329</span>  }</div>
|
|
<div class="line"><a name="l01330"></a><span class="lineno"> 1330</span> <span class="preprocessor">#else // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01331"></a><span class="lineno"> 1331</span> <span class="preprocessor"></span> __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l01332"></a><span class="lineno"> 1332</span>  <span class="comment">// Combine all bytes from "select" into one and then turn</span></div>
|
|
<div class="line"><a name="l01333"></a><span class="lineno"> 1333</span>  <span class="comment">// that byte into the "sel" mask in r24.</span></div>
|
|
<div class="line"><a name="l01334"></a><span class="lineno"> 1334</span>  <span class="stringliteral">"clr r24\n"</span></div>
|
|
<div class="line"><a name="l01335"></a><span class="lineno"> 1335</span> #<span class="keywordflow">if</span> BIGNUMBER_LIMB_8BIT</div>
|
|
<div class="line"><a name="l01336"></a><span class="lineno"> 1336</span>  <span class="stringliteral">"sub r24,%2\n"</span></div>
|
|
<div class="line"><a name="l01337"></a><span class="lineno"> 1337</span> #elif BIGNUMBER_LIMB_16BIT</div>
|
|
<div class="line"><a name="l01338"></a><span class="lineno"> 1338</span>  <span class="stringliteral">"or %A2,%B2\n"</span></div>
|
|
<div class="line"><a name="l01339"></a><span class="lineno"> 1339</span>  <span class="stringliteral">"sub r24,%A2\n"</span></div>
|
|
<div class="line"><a name="l01340"></a><span class="lineno"> 1340</span> #elif BIGNUMBER_LIMB_32BIT</div>
|
|
<div class="line"><a name="l01341"></a><span class="lineno"> 1341</span>  <span class="stringliteral">"or %A2,%B2\n"</span></div>
|
|
<div class="line"><a name="l01342"></a><span class="lineno"> 1342</span>  <span class="stringliteral">"or %A2,%C2\n"</span></div>
|
|
<div class="line"><a name="l01343"></a><span class="lineno"> 1343</span>  <span class="stringliteral">"or %A2,%D2\n"</span></div>
|
|
<div class="line"><a name="l01344"></a><span class="lineno"> 1344</span>  <span class="stringliteral">"sub r24,%A2\n"</span></div>
|
|
<div class="line"><a name="l01345"></a><span class="lineno"> 1345</span> #endif</div>
|
|
<div class="line"><a name="l01346"></a><span class="lineno"> 1346</span>  <span class="stringliteral">"mov r24,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01347"></a><span class="lineno"> 1347</span>  <span class="stringliteral">"sbc r24,r24\n"</span></div>
|
|
<div class="line"><a name="l01348"></a><span class="lineno"> 1348</span> </div>
|
|
<div class="line"><a name="l01349"></a><span class="lineno"> 1349</span>  <span class="comment">// Perform the conditional swap 4 bytes at a time.</span></div>
|
|
<div class="line"><a name="l01350"></a><span class="lineno"> 1350</span>  <span class="stringliteral">"ldi r25,8\n"</span></div>
|
|
<div class="line"><a name="l01351"></a><span class="lineno"> 1351</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l01352"></a><span class="lineno"> 1352</span>  <span class="stringliteral">"ld r16,X+\n"</span> <span class="comment">// r16:r19 = *x</span></div>
|
|
<div class="line"><a name="l01353"></a><span class="lineno"> 1353</span>  <span class="stringliteral">"ld r17,X+\n"</span></div>
|
|
<div class="line"><a name="l01354"></a><span class="lineno"> 1354</span>  <span class="stringliteral">"ld r18,X+\n"</span></div>
|
|
<div class="line"><a name="l01355"></a><span class="lineno"> 1355</span>  <span class="stringliteral">"ld r19,X\n"</span></div>
|
|
<div class="line"><a name="l01356"></a><span class="lineno"> 1356</span>  <span class="stringliteral">"ld r20,Z\n"</span> <span class="comment">// r20:r23 = *y</span></div>
|
|
<div class="line"><a name="l01357"></a><span class="lineno"> 1357</span>  <span class="stringliteral">"ldd r21,Z+1\n"</span></div>
|
|
<div class="line"><a name="l01358"></a><span class="lineno"> 1358</span>  <span class="stringliteral">"ldd r22,Z+2\n"</span></div>
|
|
<div class="line"><a name="l01359"></a><span class="lineno"> 1359</span>  <span class="stringliteral">"ldd r23,Z+3\n"</span></div>
|
|
<div class="line"><a name="l01360"></a><span class="lineno"> 1360</span>  <span class="stringliteral">"mov r12,r16\n"</span> <span class="comment">// r12:r15 = (r16:r19 ^ r20:r23) & sel</span></div>
|
|
<div class="line"><a name="l01361"></a><span class="lineno"> 1361</span>  <span class="stringliteral">"mov r13,r17\n"</span></div>
|
|
<div class="line"><a name="l01362"></a><span class="lineno"> 1362</span>  <span class="stringliteral">"mov r14,r18\n"</span></div>
|
|
<div class="line"><a name="l01363"></a><span class="lineno"> 1363</span>  <span class="stringliteral">"mov r15,r19\n"</span></div>
|
|
<div class="line"><a name="l01364"></a><span class="lineno"> 1364</span>  <span class="stringliteral">"eor r12,r20\n"</span></div>
|
|
<div class="line"><a name="l01365"></a><span class="lineno"> 1365</span>  <span class="stringliteral">"eor r13,r21\n"</span></div>
|
|
<div class="line"><a name="l01366"></a><span class="lineno"> 1366</span>  <span class="stringliteral">"eor r14,r22\n"</span></div>
|
|
<div class="line"><a name="l01367"></a><span class="lineno"> 1367</span>  <span class="stringliteral">"eor r15,r23\n"</span></div>
|
|
<div class="line"><a name="l01368"></a><span class="lineno"> 1368</span>  <span class="stringliteral">"and r12,r24\n"</span></div>
|
|
<div class="line"><a name="l01369"></a><span class="lineno"> 1369</span>  <span class="stringliteral">"and r13,r24\n"</span></div>
|
|
<div class="line"><a name="l01370"></a><span class="lineno"> 1370</span>  <span class="stringliteral">"and r14,r24\n"</span></div>
|
|
<div class="line"><a name="l01371"></a><span class="lineno"> 1371</span>  <span class="stringliteral">"and r15,r24\n"</span></div>
|
|
<div class="line"><a name="l01372"></a><span class="lineno"> 1372</span>  <span class="stringliteral">"eor r16,r12\n"</span> <span class="comment">// r16:r19 ^= r12:r15</span></div>
|
|
<div class="line"><a name="l01373"></a><span class="lineno"> 1373</span>  <span class="stringliteral">"eor r17,r13\n"</span></div>
|
|
<div class="line"><a name="l01374"></a><span class="lineno"> 1374</span>  <span class="stringliteral">"eor r18,r14\n"</span></div>
|
|
<div class="line"><a name="l01375"></a><span class="lineno"> 1375</span>  <span class="stringliteral">"eor r19,r15\n"</span></div>
|
|
<div class="line"><a name="l01376"></a><span class="lineno"> 1376</span>  <span class="stringliteral">"eor r20,r12\n"</span> <span class="comment">// r20:r23 ^= r12:r15</span></div>
|
|
<div class="line"><a name="l01377"></a><span class="lineno"> 1377</span>  <span class="stringliteral">"eor r21,r13\n"</span></div>
|
|
<div class="line"><a name="l01378"></a><span class="lineno"> 1378</span>  <span class="stringliteral">"eor r22,r14\n"</span></div>
|
|
<div class="line"><a name="l01379"></a><span class="lineno"> 1379</span>  <span class="stringliteral">"eor r23,r15\n"</span></div>
|
|
<div class="line"><a name="l01380"></a><span class="lineno"> 1380</span>  <span class="stringliteral">"st X,r19\n"</span> <span class="comment">// *x++ = r16:r19</span></div>
|
|
<div class="line"><a name="l01381"></a><span class="lineno"> 1381</span>  <span class="stringliteral">"st -X,r18\n"</span></div>
|
|
<div class="line"><a name="l01382"></a><span class="lineno"> 1382</span>  <span class="stringliteral">"st -X,r17\n"</span></div>
|
|
<div class="line"><a name="l01383"></a><span class="lineno"> 1383</span>  <span class="stringliteral">"st -X,r16\n"</span></div>
|
|
<div class="line"><a name="l01384"></a><span class="lineno"> 1384</span>  <span class="stringliteral">"adiw r26,4\n"</span></div>
|
|
<div class="line"><a name="l01385"></a><span class="lineno"> 1385</span>  <span class="stringliteral">"st Z+,r20\n"</span> <span class="comment">// *y++ = r20:r23</span></div>
|
|
<div class="line"><a name="l01386"></a><span class="lineno"> 1386</span>  <span class="stringliteral">"st Z+,r21\n"</span></div>
|
|
<div class="line"><a name="l01387"></a><span class="lineno"> 1387</span>  <span class="stringliteral">"st Z+,r22\n"</span></div>
|
|
<div class="line"><a name="l01388"></a><span class="lineno"> 1388</span>  <span class="stringliteral">"st Z+,r23\n"</span></div>
|
|
<div class="line"><a name="l01389"></a><span class="lineno"> 1389</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l01390"></a><span class="lineno"> 1390</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l01391"></a><span class="lineno"> 1391</span> </div>
|
|
<div class="line"><a name="l01392"></a><span class="lineno"> 1392</span>  : : <span class="stringliteral">"x"</span>(x), <span class="stringliteral">"z"</span>(y), <span class="stringliteral">"r"</span>(select)</div>
|
|
<div class="line"><a name="l01393"></a><span class="lineno"> 1393</span>  : <span class="stringliteral">"r12"</span>, <span class="stringliteral">"r13"</span>, <span class="stringliteral">"r14"</span>, <span class="stringliteral">"r15"</span>, <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r17"</span>, <span class="stringliteral">"r18"</span>, <span class="stringliteral">"r19"</span>,</div>
|
|
<div class="line"><a name="l01394"></a><span class="lineno"> 1394</span>  <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>, <span class="stringliteral">"r23"</span>, <span class="stringliteral">"r24"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l01395"></a><span class="lineno"> 1395</span>  );</div>
|
|
<div class="line"><a name="l01396"></a><span class="lineno"> 1396</span> <span class="preprocessor">#endif // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01397"></a><span class="lineno"> 1397</span> <span class="preprocessor"></span>}</div>
|
|
<div class="line"><a name="l01398"></a><span class="lineno"> 1398</span> </div>
|
|
<div class="line"><a name="l01411"></a><span class="lineno"> 1411</span> <span class="keywordtype">void</span> Curve25519::cmove(limb_t select, limb_t *x, <span class="keyword">const</span> limb_t *y)</div>
|
|
<div class="line"><a name="l01412"></a><span class="lineno"> 1412</span> {</div>
|
|
<div class="line"><a name="l01413"></a><span class="lineno"> 1413</span> <span class="preprocessor">#if !defined(CURVE25519_ASM_AVR)</span></div>
|
|
<div class="line"><a name="l01414"></a><span class="lineno"> 1414</span> <span class="preprocessor"></span> uint8_t posn;</div>
|
|
<div class="line"><a name="l01415"></a><span class="lineno"> 1415</span>  limb_t dummy;</div>
|
|
<div class="line"><a name="l01416"></a><span class="lineno"> 1416</span>  limb_t sel;</div>
|
|
<div class="line"><a name="l01417"></a><span class="lineno"> 1417</span> </div>
|
|
<div class="line"><a name="l01418"></a><span class="lineno"> 1418</span>  <span class="comment">// Turn "select" into an all-zeroes or all-ones mask. We don't care</span></div>
|
|
<div class="line"><a name="l01419"></a><span class="lineno"> 1419</span>  <span class="comment">// which bit or bits is set in the original "select" value.</span></div>
|
|
<div class="line"><a name="l01420"></a><span class="lineno"> 1420</span>  sel = (limb_t)(((((dlimb_t)1) << LIMB_BITS) - select) >> LIMB_BITS);</div>
|
|
<div class="line"><a name="l01421"></a><span class="lineno"> 1421</span>  --sel;</div>
|
|
<div class="line"><a name="l01422"></a><span class="lineno"> 1422</span> </div>
|
|
<div class="line"><a name="l01423"></a><span class="lineno"> 1423</span>  <span class="comment">// Move y into x based on "select". Similar to conditional swap above.</span></div>
|
|
<div class="line"><a name="l01424"></a><span class="lineno"> 1424</span>  <span class="keywordflow">for</span> (posn = 0; posn < NUM_LIMBS_256BIT; ++posn) {</div>
|
|
<div class="line"><a name="l01425"></a><span class="lineno"> 1425</span>  dummy = sel & (x[posn] ^ y[posn]);</div>
|
|
<div class="line"><a name="l01426"></a><span class="lineno"> 1426</span>  x[posn] ^= dummy;</div>
|
|
<div class="line"><a name="l01427"></a><span class="lineno"> 1427</span>  }</div>
|
|
<div class="line"><a name="l01428"></a><span class="lineno"> 1428</span> <span class="preprocessor">#else // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01429"></a><span class="lineno"> 1429</span> <span class="preprocessor"></span> __asm__ __volatile__ (</div>
|
|
<div class="line"><a name="l01430"></a><span class="lineno"> 1430</span>  <span class="comment">// Combine all bytes from "select" into one and then turn</span></div>
|
|
<div class="line"><a name="l01431"></a><span class="lineno"> 1431</span>  <span class="comment">// that byte into the "sel" mask in r24.</span></div>
|
|
<div class="line"><a name="l01432"></a><span class="lineno"> 1432</span>  <span class="stringliteral">"clr r24\n"</span></div>
|
|
<div class="line"><a name="l01433"></a><span class="lineno"> 1433</span> #<span class="keywordflow">if</span> BIGNUMBER_LIMB_8BIT</div>
|
|
<div class="line"><a name="l01434"></a><span class="lineno"> 1434</span>  <span class="stringliteral">"sub r24,%2\n"</span></div>
|
|
<div class="line"><a name="l01435"></a><span class="lineno"> 1435</span> #elif BIGNUMBER_LIMB_16BIT</div>
|
|
<div class="line"><a name="l01436"></a><span class="lineno"> 1436</span>  <span class="stringliteral">"or %A2,%B2\n"</span></div>
|
|
<div class="line"><a name="l01437"></a><span class="lineno"> 1437</span>  <span class="stringliteral">"sub r24,%A2\n"</span></div>
|
|
<div class="line"><a name="l01438"></a><span class="lineno"> 1438</span> #elif BIGNUMBER_LIMB_32BIT</div>
|
|
<div class="line"><a name="l01439"></a><span class="lineno"> 1439</span>  <span class="stringliteral">"or %A2,%B2\n"</span></div>
|
|
<div class="line"><a name="l01440"></a><span class="lineno"> 1440</span>  <span class="stringliteral">"or %A2,%C2\n"</span></div>
|
|
<div class="line"><a name="l01441"></a><span class="lineno"> 1441</span>  <span class="stringliteral">"or %A2,%D2\n"</span></div>
|
|
<div class="line"><a name="l01442"></a><span class="lineno"> 1442</span>  <span class="stringliteral">"sub r24,%A2\n"</span></div>
|
|
<div class="line"><a name="l01443"></a><span class="lineno"> 1443</span> #endif</div>
|
|
<div class="line"><a name="l01444"></a><span class="lineno"> 1444</span>  <span class="stringliteral">"mov r24,__zero_reg__\n"</span></div>
|
|
<div class="line"><a name="l01445"></a><span class="lineno"> 1445</span>  <span class="stringliteral">"sbc r24,r24\n"</span></div>
|
|
<div class="line"><a name="l01446"></a><span class="lineno"> 1446</span> </div>
|
|
<div class="line"><a name="l01447"></a><span class="lineno"> 1447</span>  <span class="comment">// Perform the conditional move 4 bytes at a time.</span></div>
|
|
<div class="line"><a name="l01448"></a><span class="lineno"> 1448</span>  <span class="stringliteral">"ldi r25,8\n"</span></div>
|
|
<div class="line"><a name="l01449"></a><span class="lineno"> 1449</span>  <span class="stringliteral">"1:\n"</span></div>
|
|
<div class="line"><a name="l01450"></a><span class="lineno"> 1450</span>  <span class="stringliteral">"ld r16,X+\n"</span> <span class="comment">// r16:r19 = *x</span></div>
|
|
<div class="line"><a name="l01451"></a><span class="lineno"> 1451</span>  <span class="stringliteral">"ld r17,X+\n"</span></div>
|
|
<div class="line"><a name="l01452"></a><span class="lineno"> 1452</span>  <span class="stringliteral">"ld r18,X+\n"</span></div>
|
|
<div class="line"><a name="l01453"></a><span class="lineno"> 1453</span>  <span class="stringliteral">"ld r19,X\n"</span></div>
|
|
<div class="line"><a name="l01454"></a><span class="lineno"> 1454</span>  <span class="stringliteral">"ld r20,Z+\n"</span> <span class="comment">// r20:r23 = *y++</span></div>
|
|
<div class="line"><a name="l01455"></a><span class="lineno"> 1455</span>  <span class="stringliteral">"ld r21,Z+\n"</span></div>
|
|
<div class="line"><a name="l01456"></a><span class="lineno"> 1456</span>  <span class="stringliteral">"ld r22,Z+\n"</span></div>
|
|
<div class="line"><a name="l01457"></a><span class="lineno"> 1457</span>  <span class="stringliteral">"ld r23,Z+\n"</span></div>
|
|
<div class="line"><a name="l01458"></a><span class="lineno"> 1458</span>  <span class="stringliteral">"eor r20,r16\n"</span> <span class="comment">// r20:r23 = (r16:r19 ^ r20:r23) & sel</span></div>
|
|
<div class="line"><a name="l01459"></a><span class="lineno"> 1459</span>  <span class="stringliteral">"eor r21,r17\n"</span></div>
|
|
<div class="line"><a name="l01460"></a><span class="lineno"> 1460</span>  <span class="stringliteral">"eor r22,r18\n"</span></div>
|
|
<div class="line"><a name="l01461"></a><span class="lineno"> 1461</span>  <span class="stringliteral">"eor r23,r19\n"</span></div>
|
|
<div class="line"><a name="l01462"></a><span class="lineno"> 1462</span>  <span class="stringliteral">"and r20,r24\n"</span></div>
|
|
<div class="line"><a name="l01463"></a><span class="lineno"> 1463</span>  <span class="stringliteral">"and r21,r24\n"</span></div>
|
|
<div class="line"><a name="l01464"></a><span class="lineno"> 1464</span>  <span class="stringliteral">"and r22,r24\n"</span></div>
|
|
<div class="line"><a name="l01465"></a><span class="lineno"> 1465</span>  <span class="stringliteral">"and r23,r24\n"</span></div>
|
|
<div class="line"><a name="l01466"></a><span class="lineno"> 1466</span>  <span class="stringliteral">"eor r16,r20\n"</span> <span class="comment">// r16:r19 ^= r20:r23</span></div>
|
|
<div class="line"><a name="l01467"></a><span class="lineno"> 1467</span>  <span class="stringliteral">"eor r17,r21\n"</span></div>
|
|
<div class="line"><a name="l01468"></a><span class="lineno"> 1468</span>  <span class="stringliteral">"eor r18,r22\n"</span></div>
|
|
<div class="line"><a name="l01469"></a><span class="lineno"> 1469</span>  <span class="stringliteral">"eor r19,r23\n"</span></div>
|
|
<div class="line"><a name="l01470"></a><span class="lineno"> 1470</span>  <span class="stringliteral">"st X,r19\n"</span> <span class="comment">// *x++ = r16:r19</span></div>
|
|
<div class="line"><a name="l01471"></a><span class="lineno"> 1471</span>  <span class="stringliteral">"st -X,r18\n"</span></div>
|
|
<div class="line"><a name="l01472"></a><span class="lineno"> 1472</span>  <span class="stringliteral">"st -X,r17\n"</span></div>
|
|
<div class="line"><a name="l01473"></a><span class="lineno"> 1473</span>  <span class="stringliteral">"st -X,r16\n"</span></div>
|
|
<div class="line"><a name="l01474"></a><span class="lineno"> 1474</span>  <span class="stringliteral">"adiw r26,4\n"</span></div>
|
|
<div class="line"><a name="l01475"></a><span class="lineno"> 1475</span>  <span class="stringliteral">"dec r25\n"</span></div>
|
|
<div class="line"><a name="l01476"></a><span class="lineno"> 1476</span>  <span class="stringliteral">"brne 1b\n"</span></div>
|
|
<div class="line"><a name="l01477"></a><span class="lineno"> 1477</span> </div>
|
|
<div class="line"><a name="l01478"></a><span class="lineno"> 1478</span>  : : <span class="stringliteral">"x"</span>(x), <span class="stringliteral">"z"</span>(y), <span class="stringliteral">"r"</span>(select)</div>
|
|
<div class="line"><a name="l01479"></a><span class="lineno"> 1479</span>  : <span class="stringliteral">"r16"</span>, <span class="stringliteral">"r17"</span>, <span class="stringliteral">"r18"</span>, <span class="stringliteral">"r19"</span>, <span class="stringliteral">"r20"</span>, <span class="stringliteral">"r21"</span>, <span class="stringliteral">"r22"</span>, <span class="stringliteral">"r23"</span>,</div>
|
|
<div class="line"><a name="l01480"></a><span class="lineno"> 1480</span>  <span class="stringliteral">"r24"</span>, <span class="stringliteral">"r25"</span></div>
|
|
<div class="line"><a name="l01481"></a><span class="lineno"> 1481</span>  );</div>
|
|
<div class="line"><a name="l01482"></a><span class="lineno"> 1482</span> <span class="preprocessor">#endif // CURVE25519_ASM_AVR</span></div>
|
|
<div class="line"><a name="l01483"></a><span class="lineno"> 1483</span> <span class="preprocessor"></span>}</div>
|
|
<div class="line"><a name="l01484"></a><span class="lineno"> 1484</span> </div>
|
|
<div class="line"><a name="l01491"></a><span class="lineno"> 1491</span> <span class="keywordtype">void</span> Curve25519::pow250(limb_t *result, <span class="keyword">const</span> limb_t *x)</div>
|
|
<div class="line"><a name="l01492"></a><span class="lineno"> 1492</span> {</div>
|
|
<div class="line"><a name="l01493"></a><span class="lineno"> 1493</span>  limb_t t1[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l01494"></a><span class="lineno"> 1494</span>  uint8_t i, j;</div>
|
|
<div class="line"><a name="l01495"></a><span class="lineno"> 1495</span> </div>
|
|
<div class="line"><a name="l01496"></a><span class="lineno"> 1496</span>  <span class="comment">// The big-endian hexadecimal expansion of (2^250 - 1) is:</span></div>
|
|
<div class="line"><a name="l01497"></a><span class="lineno"> 1497</span>  <span class="comment">// 03FFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF</span></div>
|
|
<div class="line"><a name="l01498"></a><span class="lineno"> 1498</span>  <span class="comment">//</span></div>
|
|
<div class="line"><a name="l01499"></a><span class="lineno"> 1499</span>  <span class="comment">// The naive implementation needs to do 2 multiplications per 1 bit and</span></div>
|
|
<div class="line"><a name="l01500"></a><span class="lineno"> 1500</span>  <span class="comment">// 1 multiplication per 0 bit. We can improve upon this by creating a</span></div>
|
|
<div class="line"><a name="l01501"></a><span class="lineno"> 1501</span>  <span class="comment">// pattern 0000000001 ... 0000000001. If we square and multiply the</span></div>
|
|
<div class="line"><a name="l01502"></a><span class="lineno"> 1502</span>  <span class="comment">// pattern by itself we can turn the pattern into the partial results</span></div>
|
|
<div class="line"><a name="l01503"></a><span class="lineno"> 1503</span>  <span class="comment">// 0000000011 ... 0000000011, 0000000111 ... 0000000111, etc.</span></div>
|
|
<div class="line"><a name="l01504"></a><span class="lineno"> 1504</span>  <span class="comment">// This averages out to about 1.1 multiplications per 1 bit instead of 2.</span></div>
|
|
<div class="line"><a name="l01505"></a><span class="lineno"> 1505</span> </div>
|
|
<div class="line"><a name="l01506"></a><span class="lineno"> 1506</span>  <span class="comment">// Build a pattern of 250 bits in length of repeated copies of 0000000001.</span></div>
|
|
<div class="line"><a name="l01507"></a><span class="lineno"> 1507</span> <span class="preprocessor"> #define RECIP_GROUP_SIZE 10</span></div>
|
|
<div class="line"><a name="l01508"></a><span class="lineno"> 1508</span> <span class="preprocessor"></span><span class="preprocessor"> #define RECIP_GROUP_BITS 250 // Must be a multiple of RECIP_GROUP_SIZE.</span></div>
|
|
<div class="line"><a name="l01509"></a><span class="lineno"> 1509</span> <span class="preprocessor"></span> square(t1, x);</div>
|
|
<div class="line"><a name="l01510"></a><span class="lineno"> 1510</span>  <span class="keywordflow">for</span> (j = 0; j < (RECIP_GROUP_SIZE - 1); ++j)</div>
|
|
<div class="line"><a name="l01511"></a><span class="lineno"> 1511</span>  square(t1, t1);</div>
|
|
<div class="line"><a name="l01512"></a><span class="lineno"> 1512</span>  mul(result, t1, x);</div>
|
|
<div class="line"><a name="l01513"></a><span class="lineno"> 1513</span>  <span class="keywordflow">for</span> (i = 0; i < ((RECIP_GROUP_BITS / RECIP_GROUP_SIZE) - 2); ++i) {</div>
|
|
<div class="line"><a name="l01514"></a><span class="lineno"> 1514</span>  <span class="keywordflow">for</span> (j = 0; j < RECIP_GROUP_SIZE; ++j)</div>
|
|
<div class="line"><a name="l01515"></a><span class="lineno"> 1515</span>  square(t1, t1);</div>
|
|
<div class="line"><a name="l01516"></a><span class="lineno"> 1516</span>  mul(result, result, t1);</div>
|
|
<div class="line"><a name="l01517"></a><span class="lineno"> 1517</span>  }</div>
|
|
<div class="line"><a name="l01518"></a><span class="lineno"> 1518</span> </div>
|
|
<div class="line"><a name="l01519"></a><span class="lineno"> 1519</span>  <span class="comment">// Multiply bit-shifted versions of the 0000000001 pattern into</span></div>
|
|
<div class="line"><a name="l01520"></a><span class="lineno"> 1520</span>  <span class="comment">// the result to "fill in" the gaps in the pattern.</span></div>
|
|
<div class="line"><a name="l01521"></a><span class="lineno"> 1521</span>  square(t1, result);</div>
|
|
<div class="line"><a name="l01522"></a><span class="lineno"> 1522</span>  mul(result, result, t1);</div>
|
|
<div class="line"><a name="l01523"></a><span class="lineno"> 1523</span>  <span class="keywordflow">for</span> (j = 0; j < (RECIP_GROUP_SIZE - 2); ++j) {</div>
|
|
<div class="line"><a name="l01524"></a><span class="lineno"> 1524</span>  square(t1, t1);</div>
|
|
<div class="line"><a name="l01525"></a><span class="lineno"> 1525</span>  mul(result, result, t1);</div>
|
|
<div class="line"><a name="l01526"></a><span class="lineno"> 1526</span>  }</div>
|
|
<div class="line"><a name="l01527"></a><span class="lineno"> 1527</span> </div>
|
|
<div class="line"><a name="l01528"></a><span class="lineno"> 1528</span>  <span class="comment">// Clean up and exit.</span></div>
|
|
<div class="line"><a name="l01529"></a><span class="lineno"> 1529</span>  clean(t1);</div>
|
|
<div class="line"><a name="l01530"></a><span class="lineno"> 1530</span> }</div>
|
|
<div class="line"><a name="l01531"></a><span class="lineno"> 1531</span> </div>
|
|
<div class="line"><a name="l01539"></a><span class="lineno"> 1539</span> <span class="keywordtype">void</span> Curve25519::recip(limb_t *result, <span class="keyword">const</span> limb_t *x)</div>
|
|
<div class="line"><a name="l01540"></a><span class="lineno"> 1540</span> {</div>
|
|
<div class="line"><a name="l01541"></a><span class="lineno"> 1541</span>  <span class="comment">// The reciprocal is the same as x ^ (p - 2) where p = 2^255 - 19.</span></div>
|
|
<div class="line"><a name="l01542"></a><span class="lineno"> 1542</span>  <span class="comment">// The big-endian hexadecimal expansion of (p - 2) is:</span></div>
|
|
<div class="line"><a name="l01543"></a><span class="lineno"> 1543</span>  <span class="comment">// 7FFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFEB</span></div>
|
|
<div class="line"><a name="l01544"></a><span class="lineno"> 1544</span>  <span class="comment">// Start with the 250 upper bits of the expansion of (p - 2).</span></div>
|
|
<div class="line"><a name="l01545"></a><span class="lineno"> 1545</span>  pow250(result, x);</div>
|
|
<div class="line"><a name="l01546"></a><span class="lineno"> 1546</span> </div>
|
|
<div class="line"><a name="l01547"></a><span class="lineno"> 1547</span>  <span class="comment">// Deal with the 5 lowest bits of (p - 2), 01011, from highest to lowest.</span></div>
|
|
<div class="line"><a name="l01548"></a><span class="lineno"> 1548</span>  square(result, result);</div>
|
|
<div class="line"><a name="l01549"></a><span class="lineno"> 1549</span>  square(result, result);</div>
|
|
<div class="line"><a name="l01550"></a><span class="lineno"> 1550</span>  mul(result, result, x);</div>
|
|
<div class="line"><a name="l01551"></a><span class="lineno"> 1551</span>  square(result, result);</div>
|
|
<div class="line"><a name="l01552"></a><span class="lineno"> 1552</span>  square(result, result);</div>
|
|
<div class="line"><a name="l01553"></a><span class="lineno"> 1553</span>  mul(result, result, x);</div>
|
|
<div class="line"><a name="l01554"></a><span class="lineno"> 1554</span>  square(result, result);</div>
|
|
<div class="line"><a name="l01555"></a><span class="lineno"> 1555</span>  mul(result, result, x);</div>
|
|
<div class="line"><a name="l01556"></a><span class="lineno"> 1556</span> }</div>
|
|
<div class="line"><a name="l01557"></a><span class="lineno"> 1557</span> </div>
|
|
<div class="line"><a name="l01573"></a><span class="lineno"> 1573</span> <span class="keywordtype">bool</span> Curve25519::sqrt(limb_t *result, <span class="keyword">const</span> limb_t *x)</div>
|
|
<div class="line"><a name="l01574"></a><span class="lineno"> 1574</span> {</div>
|
|
<div class="line"><a name="l01575"></a><span class="lineno"> 1575</span>  <span class="comment">// sqrt(-1) mod (2^255 - 19).</span></div>
|
|
<div class="line"><a name="l01576"></a><span class="lineno"> 1576</span>  <span class="keyword">static</span> limb_t <span class="keyword">const</span> numSqrtM1[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l01577"></a><span class="lineno"> 1577</span>  LIMB_PAIR(0x4A0EA0B0, 0xC4EE1B27), LIMB_PAIR(0xAD2FE478, 0x2F431806),</div>
|
|
<div class="line"><a name="l01578"></a><span class="lineno"> 1578</span>  LIMB_PAIR(0x3DFBD7A7, 0x2B4D0099), LIMB_PAIR(0x4FC1DF0B, 0x2B832480)</div>
|
|
<div class="line"><a name="l01579"></a><span class="lineno"> 1579</span>  };</div>
|
|
<div class="line"><a name="l01580"></a><span class="lineno"> 1580</span>  limb_t y[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l01581"></a><span class="lineno"> 1581</span> </div>
|
|
<div class="line"><a name="l01582"></a><span class="lineno"> 1582</span>  <span class="comment">// Algorithm from: http://tools.ietf.org/html/rfc7748</span></div>
|
|
<div class="line"><a name="l01583"></a><span class="lineno"> 1583</span> </div>
|
|
<div class="line"><a name="l01584"></a><span class="lineno"> 1584</span>  <span class="comment">// Compute a candidate root: result = x^((p + 3) / 8) mod p.</span></div>
|
|
<div class="line"><a name="l01585"></a><span class="lineno"> 1585</span>  <span class="comment">// (p + 3) / 8 = (2^252 - 2) which is 251 one bits followed by a zero:</span></div>
|
|
<div class="line"><a name="l01586"></a><span class="lineno"> 1586</span>  <span class="comment">// 0FFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE</span></div>
|
|
<div class="line"><a name="l01587"></a><span class="lineno"> 1587</span>  pow250(result, x);</div>
|
|
<div class="line"><a name="l01588"></a><span class="lineno"> 1588</span>  square(result, result);</div>
|
|
<div class="line"><a name="l01589"></a><span class="lineno"> 1589</span>  mul(result, result, x);</div>
|
|
<div class="line"><a name="l01590"></a><span class="lineno"> 1590</span>  square(result, result);</div>
|
|
<div class="line"><a name="l01591"></a><span class="lineno"> 1591</span> </div>
|
|
<div class="line"><a name="l01592"></a><span class="lineno"> 1592</span>  <span class="comment">// Did we get the square root immediately?</span></div>
|
|
<div class="line"><a name="l01593"></a><span class="lineno"> 1593</span>  square(y, result);</div>
|
|
<div class="line"><a name="l01594"></a><span class="lineno"> 1594</span>  <span class="keywordflow">if</span> (memcmp(x, y, <span class="keyword">sizeof</span>(y)) == 0) {</div>
|
|
<div class="line"><a name="l01595"></a><span class="lineno"> 1595</span>  clean(y);</div>
|
|
<div class="line"><a name="l01596"></a><span class="lineno"> 1596</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
<div class="line"><a name="l01597"></a><span class="lineno"> 1597</span>  }</div>
|
|
<div class="line"><a name="l01598"></a><span class="lineno"> 1598</span> </div>
|
|
<div class="line"><a name="l01599"></a><span class="lineno"> 1599</span>  <span class="comment">// Multiply the result by sqrt(-1) and check again.</span></div>
|
|
<div class="line"><a name="l01600"></a><span class="lineno"> 1600</span>  mul_P(result, result, numSqrtM1);</div>
|
|
<div class="line"><a name="l01601"></a><span class="lineno"> 1601</span>  square(y, result);</div>
|
|
<div class="line"><a name="l01602"></a><span class="lineno"> 1602</span>  <span class="keywordflow">if</span> (memcmp(x, y, <span class="keyword">sizeof</span>(y)) == 0) {</div>
|
|
<div class="line"><a name="l01603"></a><span class="lineno"> 1603</span>  clean(y);</div>
|
|
<div class="line"><a name="l01604"></a><span class="lineno"> 1604</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
<div class="line"><a name="l01605"></a><span class="lineno"> 1605</span>  }</div>
|
|
<div class="line"><a name="l01606"></a><span class="lineno"> 1606</span> </div>
|
|
<div class="line"><a name="l01607"></a><span class="lineno"> 1607</span>  <span class="comment">// The number does not have a square root.</span></div>
|
|
<div class="line"><a name="l01608"></a><span class="lineno"> 1608</span>  clean(y);</div>
|
|
<div class="line"><a name="l01609"></a><span class="lineno"> 1609</span>  <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
<div class="line"><a name="l01610"></a><span class="lineno"> 1610</span> }</div>
|
|
<div class="ttc" id="classRNGClass_html_a418a833cf18198fd7e5d6dbd78c99c29"><div class="ttname"><a href="classRNGClass.html#a418a833cf18198fd7e5d6dbd78c99c29">RNGClass::rand</a></div><div class="ttdeci">void rand(uint8_t *data, size_t len)</div><div class="ttdoc">Generates random bytes into a caller-supplied buffer. </div><div class="ttdef"><b>Definition:</b> <a href="RNG_8cpp_source.html#l00566">RNG.cpp:566</a></div></div>
|
|
<div class="ttc" id="classCurve25519_html_a2e4b7dd83a019b32c76584c99bfda21a"><div class="ttname"><a href="classCurve25519.html#a2e4b7dd83a019b32c76584c99bfda21a">Curve25519::eval</a></div><div class="ttdeci">static bool eval(uint8_t result[32], const uint8_t s[32], const uint8_t x[32])</div><div class="ttdoc">Evaluates the raw Curve25519 function. </div><div class="ttdef"><b>Definition:</b> <a href="Curve25519_8cpp_source.html#l00080">Curve25519.cpp:80</a></div></div>
|
|
<div class="ttc" id="classBigNumberUtil_html_a25041f898c417c8dd63f30536287ed79"><div class="ttname"><a href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a></div><div class="ttdeci">static void unpackLE(limb_t *limbs, size_t count, const uint8_t *bytes, size_t len)</div><div class="ttdoc">Unpacks the little-endian byte representation of a big number into a limb array. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00055">BigNumberUtil.cpp:55</a></div></div>
|
|
<div class="ttc" id="classBigNumberUtil_html_a989cd5f389ac5adc798d8767383e2810"><div class="ttname"><a href="classBigNumberUtil.html#a989cd5f389ac5adc798d8767383e2810">BigNumberUtil::packLE</a></div><div class="ttdeci">static void packLE(uint8_t *bytes, size_t len, const limb_t *limbs, size_t count)</div><div class="ttdoc">Packs the little-endian byte representation of a big number into a byte array. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00264">BigNumberUtil.cpp:264</a></div></div>
|
|
<div class="ttc" id="classCurve25519_html_a2b6911583d17ea9a36bbbb40d58b3d89"><div class="ttname"><a href="classCurve25519.html#a2b6911583d17ea9a36bbbb40d58b3d89">Curve25519::dh1</a></div><div class="ttdeci">static void dh1(uint8_t k[32], uint8_t f[32])</div><div class="ttdoc">Performs phase 1 of a Diffie-Hellman key exchange using Curve25519. </div><div class="ttdef"><b>Definition:</b> <a href="Curve25519_8cpp_source.html#l00245">Curve25519.cpp:245</a></div></div>
|
|
<div class="ttc" id="classCurve25519_html_a14022d6ac68ec691ffb0247275078ab9"><div class="ttname"><a href="classCurve25519.html#a14022d6ac68ec691ffb0247275078ab9">Curve25519::dh2</a></div><div class="ttdeci">static bool dh2(uint8_t k[32], uint8_t f[32])</div><div class="ttdoc">Performs phase 2 of a Diffie-Hellman key exchange using Curve25519. </div><div class="ttdef"><b>Definition:</b> <a href="Curve25519_8cpp_source.html#l00283">Curve25519.cpp:283</a></div></div>
|
|
</div><!-- fragment --></div><!-- contents -->
|
|
<!-- start footer part -->
|
|
<hr class="footer"/><address class="footer"><small>
|
|
Generated on Fri Apr 27 2018 12:01:32 for Arduino Cryptography Library by  <a href="http://www.doxygen.org/index.html">
|
|
<img class="footer" src="doxygen.png" alt="doxygen"/>
|
|
</a> 1.8.6
|
|
</small></address>
|
|
</body>
|
|
</html>
|