2025-11-11 02:07:51 +01:00 · 2025-11-11 02:07:51 +01:00 · 2f3113f55d
commit 2f3113f55d
parent aa2ff7b2f0
11742 changed files with 1223940 additions and 0 deletions
--- a/unikernel/duniverse/mirage-crypto/ec/dune
+++ b/unikernel/duniverse/mirage-crypto/ec/dune
@ -0,0 +1,23 @@
+(library
+ (name mirage_crypto_ec)
+ (public_name mirage-crypto-ec)
+ (libraries eqaf mirage-crypto-rng digestif)
+ (foreign_stubs
+  (language c)
+  (names p256_stubs np256_stubs p384_stubs np384_stubs p521_stubs np521_stubs
+    curve25519_stubs)
+  (include_dirs ../src/native)
+  (flags
+   (:standard -DNDEBUG)
+   (:include cflags_optimized.sexp))))
+
+(env
+ (dev
+  (c_flags (:include cflags_warn.sexp))))
+
+(include_subdirs unqualified)
+
+(rule
+ (targets cflags_optimized.sexp cflags_warn.sexp)
+ (action
+  (run ../config/cfg.exe)))
--- a/unikernel/duniverse/mirage-crypto/ec/gen_tables/dune
+++ b/unikernel/duniverse/mirage-crypto/ec/gen_tables/dune
@ -0,0 +1,4 @@
+(include_subdirs no)
+(executable
+  (name gen_tables)
+  (libraries mirage_crypto_ec))
--- a/unikernel/duniverse/mirage-crypto/ec/gen_tables/gen_tables.ml
+++ b/unikernel/duniverse/mirage-crypto/ec/gen_tables/gen_tables.ml
@ -0,0 +1,112 @@
+open Format
+
+let print_header name =
+  printf
+    {|
+/*
+      Pre-computed %d-bit multiples of the generator point G for the curve %s,
+      used for speeding up its scalar multiplication in point_operations.h.
+
+      Generated by %s
+*/|}
+    Sys.word_size name Sys.argv.(0)
+
+let pp_array elem_fmt fmt arr =
+  let fout = fprintf fmt in
+  let len = Array.length arr in
+  fout "@[<2>{@\n";
+  for i = 0 to len - 1 do
+    elem_fmt fmt arr.(i);
+    if i < len - 1 then printf ",@ " else printf ""
+  done;
+  fout "@]@,}"
+
+let div_round_up a b = (a / b) + if a mod b = 0 then 0 else 1
+
+let pp_string_words ~wordsize fmt str =
+  assert (String.length str * 8 mod wordsize = 0);
+  let limbs = String.length str * 8 / wordsize in
+  (* Truncate at the beginning (little-endian) *)
+  let bytes = Bytes.unsafe_of_string str in
+  (* let bytes = rev_str_bytes str in *)
+  fprintf fmt "@[<2>{@\n";
+  for i = 0 to limbs - 1 do
+    let index = i * (wordsize / 8) in
+    (if wordsize = 64 then
+       let w = Bytes.get_int64_le bytes index in
+       fprintf fmt "%#016Lx" w
+     else
+       let w = Bytes.get_int32_le bytes index in
+       fprintf fmt "%#08lx" w);
+    if i < limbs - 1 then printf ",@ " else printf ""
+  done;
+  fprintf fmt "@]@,}"
+
+let check_shape tables =
+  let fe_len = String.length tables.(0).(0).(0) in
+  let table_len = fe_len * 2 in
+  assert (Array.length tables = table_len);
+  Array.iter
+    (fun x ->
+      assert (Array.length x = 15);
+      Array.iter
+        (fun x ->
+          assert (Array.length x = 3);
+          Array.iter (fun x -> assert (String.length x = fe_len)) x)
+        x)
+    tables
+
+let print_tables tables ~wordsize =
+  let fe_len = String.length tables.(0).(0).(0) in
+  printf "@[<2>static WORD generator_table[%d][15][3][LIMBS] = @," (fe_len * 2);
+  pp_array
+    (pp_array (pp_array (pp_string_words ~wordsize)))
+    std_formatter tables;
+  printf "@];@,"
+
+let print_toplevel name wordsize (module P : Mirage_crypto_ec.Dh_dsa) =
+  let tables = P.Dsa.Precompute.generator_tables () in
+  assert (wordsize = Sys.word_size);
+  check_shape tables;
+  print_header name;
+  if wordsize = 64 then
+    printf
+      "@[<v>#ifndef ARCH_64BIT@,\
+       #error \"Cannot use 64-bit tables on a 32-bit architecture\"@,\
+       #endif@,\
+       @]"
+  else
+    printf
+      "@[<v>#ifdef ARCH_64BIT@,\
+       #error \"Cannot use 32-bit tables on a 64-bit architecture\"@,\
+       #endif@,\
+       @]";
+  print_tables ~wordsize tables
+
+let curves =
+  Mirage_crypto_ec.
+    [
+      ("p256", (module P256 : Dh_dsa));
+      ("p384", (module P384));
+      ("p521", (module P521));
+    ]
+
+let usage () =
+  printf "Usage: gen_tables [%a] [64 | 32]@."
+    (pp_print_list
+       ~pp_sep:(fun fmt () -> pp_print_string fmt " | ")
+       pp_print_string)
+    (List.map fst curves)
+
+let go =
+  let name, curve, wordsize =
+    try
+      let name, curve =
+        List.find (fun (name, _) -> name = Sys.argv.(1)) curves
+      in
+      (name, curve, int_of_string Sys.argv.(2))
+    with _ ->
+      usage ();
+      exit 1
+  in
+  print_toplevel name wordsize curve
--- a/unikernel/duniverse/mirage-crypto/ec/implementation.mld
+++ b/unikernel/duniverse/mirage-crypto/ec/implementation.mld
@ -0,0 +1,82 @@
+{1 Implementation }
+
+The goal of this document is to describe how the library is implemented.
+
+{2 Field operations}
+
+These are implemented in [Field_element], which is a binding over
+[p256_{32,64}.h]. These are files extracted from Coq code in
+{{:https://github.com/mit-plv/fiat-crypto}this repository}.
+
+This module uses
+{{:https://en.wikipedia.org/wiki/Montgomery_modular_multiplication} Montgomery
+Modular Multiplication}. Instead of storing a number [a], operations are done
+on [aR] where R = 2{^256}.
+
+It is possible to check that these files correspond to the extracted ones in
+the upstream repository by running [dune build @check_vendors].
+
+These files are part of the trusted computing base. That is, using this package
+relies on the fact that they implemented the correct algorithms. To go further,
+one can re-run the extraction process from Coq sources, see
+{{:https://github.com/mirage/fiat/issues/41}#41}.
+
+{2 Point operations}
+
+Points (see the [Point] module) are stored using projective coordinates (X : Y
+: Z):
+
+- Z=0 corresponds to the point at infinity
+- for Z≠0, this corresponds to a point with affine coordinates (X/Z{^2},
+  Y/Z{^3})
+
+Doubling and addition are implemented as C stubs in [p256_stubs.c] using code
+that comes from BoringSSL, Google's fork of OpenSSL. Fiat code has been design
+in part to be included in BoringSSL, so this does not require any particular
+glue code.
+
+Some operations are implemented manually, in particular:
+
+- conversion to affine coordinates, as described above. This relies on a field
+  inversion primitive from BoringSSL, that is exposed in [Field_element].
+- point verification (bound checking and making sure that the equation is
+  satisfied).
+
+There is no automated way to check that the BoringSSL part is identical to that
+in the upstream repository (nor to update it).
+
+{2 Scalar multiplication}
+
+Implemented by hand using the
+{{:https://cr.yp.to/bib/2003/joye-ladder.pdf}Montgomery Powering Ladder}.
+
+Instead of branching based on key bits, constant-time selection (as defined in
+fiat code) is used.
+
+The following references discuss this algorithm:
+
+- {{:https://cryptojedi.org/peter/data/eccss-20130911b.pdf}Scalar-multiplication algorithms, Peter Schwabe, ECC 2013 Summer School}
+- {{:https://eprint.iacr.org/2017/293.pdf}Montgomery curves and the Montgomery
+ladder, Daniel J. Bernstein and Tanja Lange}
+
+For the special case of base scalar multiplication (where the generator point of
+the curve specifically is multiplied by a scalar), instead an algorithm
+(implemented by hand in C) using pre-computed tables of point doubling is used
+(tables are in `native/p*_tables_32|64.c`).
+
+The key for this algorithm being constant-time is the function selecting values
+from the tables, which conceals what value it selects by exploring the whole
+table in the same order no matter the input, using const-time selection (as
+defined in fiat code). See `native/point_operations.h`.
+
+{2 Key exchange}
+
+Key exchange consists in
+
+- validating the public key as described in
+  {{:https://tools.ietf.org/html/rfc8446#section-4.2.8.2}RFC 8446 §4.2.8.2};
+- computing scalar multiplication;
+- returning the encoded x coordinate of the result.
+
+This is implemented by hand and checked against common errors using test
+vectors from {{:https://github.com/google/wycheproof}project Wycheproof}.
--- a/unikernel/duniverse/mirage-crypto/ec/mirage_crypto_ec.ml
+++ b/unikernel/duniverse/mirage-crypto/ec/mirage_crypto_ec.ml
--- a/unikernel/duniverse/mirage-crypto/ec/mirage_crypto_ec.mli
+++ b/unikernel/duniverse/mirage-crypto/ec/mirage_crypto_ec.mli
@ -0,0 +1,224 @@
+(** {1 Elliptic curve cryptography} *)
+
+(** Mirage-crypto-ec implements public key cryptography with named elliptic
+    curves. Ephemeral key exchanges with {{!Dh}Diffie-Hellman} and
+    {{!Dsa}digital signatures (ECDSA)} are implemented.
+
+    The arithmetic operations uses code generated by
+    {{:https://github.com/mit-plv/fiat-crypto}fiat-crypto} which is proven to
+    consume a constant amount of time, independent of the input values.
+*)
+
+type error = [
+  | `Invalid_range
+  | `Invalid_format
+  | `Invalid_length
+  | `Not_on_curve
+  | `At_infinity
+  | `Low_order
+]
+(** The type for errors. *)
+
+val pp_error : Format.formatter -> error -> unit
+(** Pretty printer for errors *)
+
+exception Message_too_long
+(** Raised if the provided message is too long for the curve. *)
+
+(** Diffie-Hellman key exchange. *)
+module type Dh = sig
+
+  type secret
+  (** Type for private keys. *)
+
+  val secret_of_octets : ?compress:bool -> string ->
+    (secret * string, error) result
+  (** [secret_of_octets ~compress secret] decodes the provided buffer as
+      {!secret}.  If [compress] is provided and [true] (defaults to [false]),
+      the shared part will be compressed. May result in an error if the buffer
+      had an invalid length or was not in bounds. *)
+
+  val secret_to_octets : secret -> string
+  (** [secret_to_octets secret] encodes the provided secret into a freshly
+      allocated buffer. *)
+
+  val gen_key : ?compress:bool -> ?g:Mirage_crypto_rng.g -> unit ->
+    secret * string
+  (** [gen_key ~compress ~g ()] generates a private and a public key for
+      Ephemeral Diffie-Hellman. If [compress] is provided and [true] (defaults
+      to [false]), the shared part will be compressed. The returned key pair
+      MUST only be used for a single key exchange.
+
+      The generated private key is checked to be greater than zero and lower
+      than the group order meaning the public key cannot be the point at
+      inifinity. *)
+
+  val key_exchange : secret -> string -> (string, error) result
+  (** [key_exchange secret received_public_key] performs Diffie-Hellman key
+      exchange using your secret and the data received from the other party.
+      Returns the shared secret or an error if the received data is wrongly
+      encoded, doesn't represent a point on the curve or represent the point
+      at infinity.
+
+      The shared secret is returned as is i.e. not stripped from leading 0x00
+      bytes.
+
+      The public key encoding is described
+      {{:http://www.secg.org/sec1-v2.pdf}in SEC 1} from SECG. *)
+end
+
+(** Digital signature algorithm. *)
+module type Dsa = sig
+
+  type priv
+  (** The type for private keys. *)
+
+  type pub
+  (** The type for public keys. *)
+
+  val byte_length : int
+  (** [byte_length] is the size of a ECDSA signature in bytes. *)
+
+  val bit_length : int
+  (** [bit_length] is the number of significant bits in a ECDSA signature *)
+
+  (** {2 Serialisation} *)
+
+  val priv_of_octets : string -> (priv, error) result
+  (** [priv_of_octets buf] decodes a private key from the buffer [buf]. If the
+      provided data is invalid, an error is returned. *)
+
+  val priv_to_octets : priv -> string
+  (** [priv_to_octets p] encode the private key [p] to a buffer. *)
+
+  val pub_of_octets : string -> (pub, error) result
+  (** [pub_of_octets buf] decodes a public key from the buffer [buf]. If the
+      provided data is invalid, an error is returned. *)
+
+  val pub_to_octets : ?compress:bool -> pub -> string
+  (** [pub_to_octets ~compress p] encodes the public key [p] into a buffer.
+      If [compress] is provided and [true] (default [false]), the compressed
+      representation is returned. *)
+
+  (** {2 Deriving the public key} *)
+
+  val pub_of_priv : priv -> pub
+  (** [pub_of_priv p] extracts the public key from the private key [p]. *)
+
+  (** {2 Key generation} *)
+
+  val generate : ?g:Mirage_crypto_rng.g -> unit -> priv * pub
+  (** [generate ~g ()] generates a key pair. *)
+
+  (** {2 Cryptographic operations} *)
+
+  val sign : key:priv -> ?k:string -> string -> string * string
+  (** [sign ~key ~k digest] signs the message [digest] using the private
+      [key]. The [digest] is not processed further - it should be the hash of
+      the message to sign. If [k] is not provided, it is computed using the
+      deterministic construction from RFC 6979. The result is a pair of [r]
+      and [s].
+
+      Warning: there {{:https://www.hertzbleed.com/2h2b.pdf}are}
+      {{:https://www.hertzbleed.com/hertzbleed.pdf}attacks} that recover the
+      private key from a power and timing analysis of the RFC 6979 computation
+      of [k] - thus it is advised to provide a good nonce ([k]) explicitly,
+      which is independent of key and digest.
+
+      @raise Invalid_argument if [k] is not suitable or not in range.
+      @raise Message_too_long if the bit size of [msg] exceeds the curve. *)
+
+  val verify : key:pub -> string * string -> string -> bool
+  (** [verify ~key (r, s) digest] verifies the signature [r, s] on the message
+      [digest] with the public [key]. The return value is [true] if verification
+      was successful, [false] otherwise. If the message has more bits than the
+      group order, the result is false. *)
+
+  (** [K_gen] can be instantiated over a hashing module to obtain an RFC6979
+      compliant [k]-generator for that hash. *)
+  module K_gen (H : Digestif.S) : sig
+
+    val generate : key:priv -> string -> string
+    (** [generate ~key digest] deterministically takes the given private key
+        and message digest to a [k] suitable for seeding the signing process. *)
+  end
+
+  (** {2 Misc} *)
+
+  (** Operations to precompute useful data meant to be hardcoded in
+      [mirage-crypto-ec] before compilation *)
+  module Precompute : sig
+    val generator_tables : unit -> string array array array
+    (** Return an array of shape (Fe_length * 2, 15, 3) containing multiples of
+        the generator point for the curve. Useful only to bootstrap tables
+        necessary for scalar multiplication. *)
+  end
+end
+
+(** Elliptic curve with Diffie-Hellman and DSA. *)
+module type Dh_dsa = sig
+
+  (** Diffie-Hellman key exchange. *)
+  module Dh : Dh
+
+  (** Digital signature algorithm. *)
+  module Dsa : Dsa
+end
+
+(** The NIST P-256 curve, also known as SECP256R1. *)
+module P256 : Dh_dsa
+
+(** The NIST P-384 curve, also known as SECP384R1. *)
+module P384 : Dh_dsa
+
+(** The NIST P-521 curve, also known as SECP521R1. *)
+module P521 : Dh_dsa
+
+(** Curve 25519 Diffie-Hellman, also known as X25519. *)
+module X25519 : Dh
+
+(** Curve 25519 DSA, also known as Ed25519. *)
+module Ed25519 : sig
+  type priv
+  (** The type for private keys. *)
+
+  type pub
+  (** The type for public keys. *)
+
+  (** {2 Serialisation} *)
+
+  val priv_of_octets : string -> (priv, error) result
+  (** [priv_of_octets buf] decodes a private key from the buffer [buf]. If the
+      provided data is invalid, an error is returned. *)
+
+  val priv_to_octets : priv -> string
+  (** [priv_to_octets p] encode the private key [p] to a buffer. *)
+
+  val pub_of_octets : string -> (pub, error) result
+  (** [pub_of_octets buf] decodes a public key from the buffer [buf]. If the
+      provided data is invalid, an error is returned. *)
+
+  val pub_to_octets : pub -> string
+  (** [pub_to_octets p] encodes the public key [p] into a buffer. *)
+
+  (** {2 Deriving the public key} *)
+
+  val pub_of_priv : priv -> pub
+  (** [pub_of_priv p] extracts the public key from the private key [p]. *)
+
+  (** {2 Key generation} *)
+
+  val generate : ?g:Mirage_crypto_rng.g -> unit -> priv * pub
+  (** [generate ~g ()] generates a key pair. *)
+
+  (** {2 Cryptographic operations} *)
+
+  val sign : key:priv -> string -> string
+  (** [sign ~key msg] signs the message [msg] using the private [key]. The
+      result is the concatenation of [r] and [s], as specified in RFC 8032. *)
+
+  val verify : key:pub -> string -> msg:string -> bool
+  (** [verify ~key signature msg] verifies the [signature] on the message
+      [msg] with the public [key]. The return value is [true] if verification
+      was successful, [false] otherwise. *)
+end
--- a/unikernel/duniverse/mirage-crypto/ec/native/GNUmakefile
+++ b/unikernel/duniverse/mirage-crypto/ec/native/GNUmakefile
@ -0,0 +1,152 @@
+# This file is part of mirage-crypto-ec, and used to generate C files
+# As a prerequisite, fiat-crypto (https://github.com/mit-plv/fiat-crypto)
+# needs to be cloned and "make standalone-ocaml" invoked
+# The lowest bound of fiat-crypto is git commit
+# dabaf4b3132e8bb4a3f5fcd8366eec6ac9bb4232 (July 16th 2021)
+# Generated on FreeBSD 12.2p2 with coq 8.13.1 (OCaml 4.12.0)
+# with fiat-crypto 2a07751f37af74edeac47b19bd51810bc99b91a1 (May 29th 2022)
+
+WBW_MONT ?= ../../../fiat-crypto/src/ExtractionOCaml/word_by_word_montgomery --static --use-value-barrier --inline-internal
+UNSAT_SOLINAS ?= ../../../fiat-crypto/src/ExtractionOCaml/unsaturated_solinas --static --use-value-barrier --inline-internal
+N_FUNCS=mul add opp from_montgomery to_montgomery one msat divstep_precomp divstep to_bytes from_bytes selectznz
+
+GEN_TABLE=../../_build/default/ec/gen_tables/gen_tables.exe
+
+# The NIST curve P-256 (AKA SECP256R1)
+P256="2^256 - 2^224 + 2^192 + 2^96 - 1"
+
+.PHONY: p256_64.h
+p256_64.h:
+	$(WBW_MONT) p256 64 $(P256) > $@
+
+.PHONY: p256_32.h
+p256_32.h:
+	$(WBW_MONT) p256 32 $(P256) > $@
+
+# The group order N of P-256
+P256N="0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"
+
+.PHONY: np256_64.h
+np256_64.h:
+	$(WBW_MONT) np256 64 $(P256N) $(N_FUNCS) > $@
+
+.PHONY: np256_32.h
+np256_32.h:
+	$(WBW_MONT) np256 32 $(P256N) $(N_FUNCS) > $@
+
+.PHONY: p256_tables_64.h
+p256_tables_64.h:
+	$(GEN_TABLE) p256 64 > $@
+
+.PHONY: p256_tables_32.h
+p256_tables_32.h:
+	$(GEN_TABLE) p256 32 > $@
+
+.PHONY: p256
+p256: p256_64.h p256_32.h np256_64.h np256_32.h
+
+p256_tables: p256_tables_64.h p256_tables_32.h
+
+# The NIST curve P-384 (AKA SECP384R1)
+P384="2^384 - 2^128 - 2^96 + 2^32 - 1"
+
+.PHONY: p384_64.h
+p384_64.h:
+	$(WBW_MONT) p384 64 $(P384) > $@
+
+.PHONY: p384_32.h
+p384_32.h:
+	$(WBW_MONT) p384 32 $(P384) > $@
+
+# The group order N of P-384
+P384N="0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973"
+
+.PHONY: np384_64.h
+np384_64.h:
+	$(WBW_MONT) np384 64 $(P384N) $(N_FUNCS) > $@
+
+.PHONY: np384_32.h
+np384_32.h:
+	$(WBW_MONT) np384 32 $(P384N) $(N_FUNCS) > $@
+
+.PHONY: p384_tables_64.h
+p384_tables_64.h:
+	$(GEN_TABLE) p384 64 > $@
+
+.PHONY: p384_tables_32.h
+p384_tables_32.h:
+	$(GEN_TABLE) p384 32 > $@
+
+.PHONY: p384
+p384: p384_64.h p384_32.h np384_64.h np384_32.h
+
+p384_tables: p384_tables_64.h p384_tables_32.h
+
+# The NIST curve P-521 (AKA SECP521R1)
+P521="2^521 - 1"
+
+.PHONY: p521_64.h
+p521_64.h:
+	$(WBW_MONT) p521 64 $(P521) > $@
+
+.PHONY: p521_32.h
+p521_32.h:
+	$(WBW_MONT) p521 32 $(P521) > $@
+
+# The group order N of P-521
+P521N="0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"
+
+.PHONY: np521_64.h
+np521_64.h:
+	$(WBW_MONT) np521 64 $(P521N) $(N_FUNCS) > $@
+
+.PHONY: np521_32.h
+np521_32.h:
+	$(WBW_MONT) np521 32 $(P521N) $(N_FUNCS) > $@
+
+.PHONY: p521_tables_64.h
+p521_tables_64.h:
+	$(GEN_TABLE) p521 64 > $@
+
+.PHONY: p521_tables_32.h
+p521_tables_32.h:
+	$(GEN_TABLE) p521 32 > $@
+
+.PHONY: p521
+p521: p521_64.h p521_32.h np521_64.h np521_32.h
+
+p521_tables: p521_tables_64.h p521_tables_32.h
+
+# 25519
+25519="2^255 - 19"
+25519_FUNS=carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes carry_scmul121666
+
+.PHONY: curve25519_64.h
+curve25519_64.h:
+	$(UNSAT_SOLINAS) 25519 64 '(auto)' $(25519) $(25519_FUNS) > $@
+
+.PHONY: curve25519_32.h
+curve25519_32.h:
+	$(UNSAT_SOLINAS) 25519 32 '(auto)' $(25519) $(25519_FUNS) > $@
+
+.PHONY: curve25519
+curve25519: curve25519_64.h curve25519_32.h
+
+.PHONY: tables
+tables: p256_tables p384_tables p521_tables
+
+.PHONY: clean
+clean:
+	$(RM) p256_32.h p256_64.h np256_32.h np256_64.h
+	$(RM) p384_32.h p384_64.h np384_32.h np384_64.h
+	$(RM) p521_32.h p521_64.h np521_32.h np521_64.h
+	$(RM) curve25519_32.h curve25519_64.h
+
+.PHONY: clean_tables
+clean_tables:
+	$(RM) p256_tables_32.h p256_tables_64.h
+	$(RM) p384_tables_32.h p384_tables_64.h
+	$(RM) p521_tables_32.h p521_tables_64.h
+
+.PHONY: all
+all: p256 p384 p521 curve25519
--- a/unikernel/duniverse/mirage-crypto/ec/native/README.md
+++ b/unikernel/duniverse/mirage-crypto/ec/native/README.md
@ -0,0 +1,23 @@
+# Generated code from fiat
+
+This directory includes several files ("p*.h") that are generated by
+[fiat](https://github.com/mit-plv/fiat-crypto). The GNUmakefile provides
+targets to generate these files.
+
+The file "inversion_template.h" is copied from the fiat-crypto repository
+at e31a36d5f1b20134e67ccc5339d88f0ff3cb0f86 (inversion-c/inversion_template.c),
+and has some modifications: the "inversion" function is declared "static",
+and the convenience function "inversion" is provided.
+
+The "*_stubs.c" files are handcrafted.
+
+The "p*_tables_32/64.c" are generated from `../gen_tables` (see each file's
+header) and contain pre-computed data to speed up scalar multiplication for
+ECDSA. The 64- and 32-bit tables must be respectively generated from a 64-bit or
+32-bit build of `gen_tables`.
+
+# Code from BoringSSL
+
+The code in "curve25519_tables.h", and large parts of
+"curve25519_stubs.c" and "point_operations.h" (excluding scalar multiplication)
+originate from BoringSSL. Minor adjustments have been done manually.
--- a/unikernel/duniverse/mirage-crypto/ec/native/curve25519_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/curve25519_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/curve25519_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/curve25519_64.h
@ -0,0 +1,947 @@
+/* Autogenerated: '../fiat-crypto/src/ExtractionOCaml/unsaturated_solinas' --static --use-value-barrier --inline-internal 25519 64 '(auto)' '2^255 - 19' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes carry_scmul121666 */
+/* curve description: 25519 */
+/* machine_wordsize = 64 (from "64") */
+/* requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, carry_scmul121666 */
+/* n = 5 (from "(auto)") */
+/* s-c = 2^255 - [(1, 19)] (from "2^255 - 19") */
+/* tight_bounds_multiplier = 1 (from "") */
+/*  */
+/* Computed values: */
+/*   carry_chain = [0, 1, 2, 3, 4, 0, 1] */
+/*   eval z = z[0] + (z[1] << 51) + (z[2] << 102) + (z[3] << 153) + (z[4] << 204) */
+/*   bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */
+/*   balance = [0xfffffffffffda, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe] */
+
+#include <stdint.h>
+typedef unsigned char fiat_25519_uint1;
+typedef signed char fiat_25519_int1;
+#if defined(__GNUC__) || defined(__clang__)
+#  define FIAT_25519_FIAT_EXTENSION __extension__
+#  define FIAT_25519_FIAT_INLINE __inline__
+#else
+#  define FIAT_25519_FIAT_EXTENSION
+#  define FIAT_25519_FIAT_INLINE
+#endif
+
+FIAT_25519_FIAT_EXTENSION typedef signed __int128 fiat_25519_int128;
+FIAT_25519_FIAT_EXTENSION typedef unsigned __int128 fiat_25519_uint128;
+
+/* The type fiat_25519_loose_field_element is a field element with loose bounds. */
+/* Bounds: [[0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */
+typedef uint64_t fiat_25519_loose_field_element[5];
+
+/* The type fiat_25519_tight_field_element is a field element with tight bounds. */
+/* Bounds: [[0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */
+typedef uint64_t fiat_25519_tight_field_element[5];
+
+#if (-1 & 3) != 3
+#error "This code only works on a two's complement system"
+#endif
+
+#if !defined(FIAT_25519_NO_ASM) && (defined(__GNUC__) || defined(__clang__))
+static __inline__ uint64_t fiat_25519_value_barrier_u64(uint64_t a) {
+  __asm__("" : "+r"(a) : /* no inputs */);
+  return a;
+}
+#else
+#  define fiat_25519_value_barrier_u64(x) (x)
+#endif
+
+
+/*
+ * The function fiat_25519_addcarryx_u51 is an addition with carry.
+ *
+ * Postconditions:
+ *   out1 = (arg1 + arg2 + arg3) mod 2^51
+ *   out2 = ⌊(arg1 + arg2 + arg3) / 2^51⌋
+ *
+ * Input Bounds:
+ *   arg1: [0x0 ~> 0x1]
+ *   arg2: [0x0 ~> 0x7ffffffffffff]
+ *   arg3: [0x0 ~> 0x7ffffffffffff]
+ * Output Bounds:
+ *   out1: [0x0 ~> 0x7ffffffffffff]
+ *   out2: [0x0 ~> 0x1]
+ */
+static FIAT_25519_FIAT_INLINE void fiat_25519_addcarryx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
+  uint64_t x1;
+  uint64_t x2;
+  fiat_25519_uint1 x3;
+  x1 = ((arg1 + arg2) + arg3);
+  x2 = (x1 & UINT64_C(0x7ffffffffffff));
+  x3 = (fiat_25519_uint1)(x1 >> 51);
+  *out1 = x2;
+  *out2 = x3;
+}
+
+/*
+ * The function fiat_25519_subborrowx_u51 is a subtraction with borrow.
+ *
+ * Postconditions:
+ *   out1 = (-arg1 + arg2 + -arg3) mod 2^51
+ *   out2 = -⌊(-arg1 + arg2 + -arg3) / 2^51⌋
+ *
+ * Input Bounds:
+ *   arg1: [0x0 ~> 0x1]
+ *   arg2: [0x0 ~> 0x7ffffffffffff]
+ *   arg3: [0x0 ~> 0x7ffffffffffff]
+ * Output Bounds:
+ *   out1: [0x0 ~> 0x7ffffffffffff]
+ *   out2: [0x0 ~> 0x1]
+ */
+static FIAT_25519_FIAT_INLINE void fiat_25519_subborrowx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
+  int64_t x1;
+  fiat_25519_int1 x2;
+  uint64_t x3;
+  x1 = ((int64_t)(arg2 - (int64_t)arg1) - (int64_t)arg3);
+  x2 = (fiat_25519_int1)(x1 >> 51);
+  x3 = (x1 & UINT64_C(0x7ffffffffffff));
+  *out1 = x3;
+  *out2 = (fiat_25519_uint1)(0x0 - x2);
+}
+
+/*
+ * The function fiat_25519_cmovznz_u64 is a single-word conditional move.
+ *
+ * Postconditions:
+ *   out1 = (if arg1 = 0 then arg2 else arg3)
+ *
+ * Input Bounds:
+ *   arg1: [0x0 ~> 0x1]
+ *   arg2: [0x0 ~> 0xffffffffffffffff]
+ *   arg3: [0x0 ~> 0xffffffffffffffff]
+ * Output Bounds:
+ *   out1: [0x0 ~> 0xffffffffffffffff]
+ */
+static FIAT_25519_FIAT_INLINE void fiat_25519_cmovznz_u64(uint64_t* out1, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
+  fiat_25519_uint1 x1;
+  uint64_t x2;
+  uint64_t x3;
+  x1 = (!(!arg1));
+  x2 = ((fiat_25519_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff));
+  x3 = ((fiat_25519_value_barrier_u64(x2) & arg3) | (fiat_25519_value_barrier_u64((~x2)) & arg2));
+  *out1 = x3;
+}
+
+/*
+ * The function fiat_25519_carry_mul multiplies two field elements and reduces the result.
+ *
+ * Postconditions:
+ *   eval out1 mod m = (eval arg1 * eval arg2) mod m
+ *
+ */
+static void fiat_25519_carry_mul(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1, const fiat_25519_loose_field_element arg2) {
+  fiat_25519_uint128 x1;
+  fiat_25519_uint128 x2;
+  fiat_25519_uint128 x3;
+  fiat_25519_uint128 x4;
+  fiat_25519_uint128 x5;
+  fiat_25519_uint128 x6;
+  fiat_25519_uint128 x7;
+  fiat_25519_uint128 x8;
+  fiat_25519_uint128 x9;
+  fiat_25519_uint128 x10;
+  fiat_25519_uint128 x11;
+  fiat_25519_uint128 x12;
+  fiat_25519_uint128 x13;
+  fiat_25519_uint128 x14;
+  fiat_25519_uint128 x15;
+  fiat_25519_uint128 x16;
+  fiat_25519_uint128 x17;
+  fiat_25519_uint128 x18;
+  fiat_25519_uint128 x19;
+  fiat_25519_uint128 x20;
+  fiat_25519_uint128 x21;
+  fiat_25519_uint128 x22;
+  fiat_25519_uint128 x23;
+  fiat_25519_uint128 x24;
+  fiat_25519_uint128 x25;
+  fiat_25519_uint128 x26;
+  uint64_t x27;
+  uint64_t x28;
+  fiat_25519_uint128 x29;
+  fiat_25519_uint128 x30;
+  fiat_25519_uint128 x31;
+  fiat_25519_uint128 x32;
+  fiat_25519_uint128 x33;
+  uint64_t x34;
+  uint64_t x35;
+  fiat_25519_uint128 x36;
+  uint64_t x37;
+  uint64_t x38;
+  fiat_25519_uint128 x39;
+  uint64_t x40;
+  uint64_t x41;
+  fiat_25519_uint128 x42;
+  uint64_t x43;
+  uint64_t x44;
+  uint64_t x45;
+  uint64_t x46;
+  uint64_t x47;
+  uint64_t x48;
+  uint64_t x49;
+  fiat_25519_uint1 x50;
+  uint64_t x51;
+  uint64_t x52;
+  x1 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[4]) * UINT8_C(0x13)));
+  x2 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[3]) * UINT8_C(0x13)));
+  x3 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[2]) * UINT8_C(0x13)));
+  x4 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[1]) * UINT8_C(0x13)));
+  x5 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[4]) * UINT8_C(0x13)));
+  x6 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[3]) * UINT8_C(0x13)));
+  x7 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[2]) * UINT8_C(0x13)));
+  x8 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[4]) * UINT8_C(0x13)));
+  x9 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[3]) * UINT8_C(0x13)));
+  x10 = ((fiat_25519_uint128)(arg1[1]) * ((arg2[4]) * UINT8_C(0x13)));
+  x11 = ((fiat_25519_uint128)(arg1[4]) * (arg2[0]));
+  x12 = ((fiat_25519_uint128)(arg1[3]) * (arg2[1]));
+  x13 = ((fiat_25519_uint128)(arg1[3]) * (arg2[0]));
+  x14 = ((fiat_25519_uint128)(arg1[2]) * (arg2[2]));
+  x15 = ((fiat_25519_uint128)(arg1[2]) * (arg2[1]));
+  x16 = ((fiat_25519_uint128)(arg1[2]) * (arg2[0]));
+  x17 = ((fiat_25519_uint128)(arg1[1]) * (arg2[3]));
+  x18 = ((fiat_25519_uint128)(arg1[1]) * (arg2[2]));
+  x19 = ((fiat_25519_uint128)(arg1[1]) * (arg2[1]));
+  x20 = ((fiat_25519_uint128)(arg1[1]) * (arg2[0]));
+  x21 = ((fiat_25519_uint128)(arg1[0]) * (arg2[4]));
+  x22 = ((fiat_25519_uint128)(arg1[0]) * (arg2[3]));
+  x23 = ((fiat_25519_uint128)(arg1[0]) * (arg2[2]));
+  x24 = ((fiat_25519_uint128)(arg1[0]) * (arg2[1]));
+  x25 = ((fiat_25519_uint128)(arg1[0]) * (arg2[0]));
+  x26 = (x25 + (x10 + (x9 + (x7 + x4))));
+  x27 = (uint64_t)(x26 >> 51);
+  x28 = (uint64_t)(x26 & UINT64_C(0x7ffffffffffff));
+  x29 = (x21 + (x17 + (x14 + (x12 + x11))));
+  x30 = (x22 + (x18 + (x15 + (x13 + x1))));
+  x31 = (x23 + (x19 + (x16 + (x5 + x2))));
+  x32 = (x24 + (x20 + (x8 + (x6 + x3))));
+  x33 = (x27 + x32);
+  x34 = (uint64_t)(x33 >> 51);
+  x35 = (uint64_t)(x33 & UINT64_C(0x7ffffffffffff));
+  x36 = (x34 + x31);
+  x37 = (uint64_t)(x36 >> 51);
+  x38 = (uint64_t)(x36 & UINT64_C(0x7ffffffffffff));
+  x39 = (x37 + x30);
+  x40 = (uint64_t)(x39 >> 51);
+  x41 = (uint64_t)(x39 & UINT64_C(0x7ffffffffffff));
+  x42 = (x40 + x29);
+  x43 = (uint64_t)(x42 >> 51);
+  x44 = (uint64_t)(x42 & UINT64_C(0x7ffffffffffff));
+  x45 = (x43 * UINT8_C(0x13));
+  x46 = (x28 + x45);
+  x47 = (x46 >> 51);
+  x48 = (x46 & UINT64_C(0x7ffffffffffff));
+  x49 = (x47 + x35);
+  x50 = (fiat_25519_uint1)(x49 >> 51);
+  x51 = (x49 & UINT64_C(0x7ffffffffffff));
+  x52 = (x50 + x38);
+  out1[0] = x48;
+  out1[1] = x51;
+  out1[2] = x52;
+  out1[3] = x41;
+  out1[4] = x44;
+}
+
+/*
+ * The function fiat_25519_carry_square squares a field element and reduces the result.
+ *
+ * Postconditions:
+ *   eval out1 mod m = (eval arg1 * eval arg1) mod m
+ *
+ */
+static void fiat_25519_carry_square(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) {
+  uint64_t x1;
+  uint64_t x2;
+  uint64_t x3;
+  uint64_t x4;
+  uint64_t x5;
+  uint64_t x6;
+  uint64_t x7;
+  uint64_t x8;
+  fiat_25519_uint128 x9;
+  fiat_25519_uint128 x10;
+  fiat_25519_uint128 x11;
+  fiat_25519_uint128 x12;
+  fiat_25519_uint128 x13;
+  fiat_25519_uint128 x14;
+  fiat_25519_uint128 x15;
+  fiat_25519_uint128 x16;
+  fiat_25519_uint128 x17;
+  fiat_25519_uint128 x18;
+  fiat_25519_uint128 x19;
+  fiat_25519_uint128 x20;
+  fiat_25519_uint128 x21;
+  fiat_25519_uint128 x22;
+  fiat_25519_uint128 x23;
+  fiat_25519_uint128 x24;
+  uint64_t x25;
+  uint64_t x26;
+  fiat_25519_uint128 x27;
+  fiat_25519_uint128 x28;
+  fiat_25519_uint128 x29;
+  fiat_25519_uint128 x30;
+  fiat_25519_uint128 x31;
+  uint64_t x32;
+  uint64_t x33;
+  fiat_25519_uint128 x34;
+  uint64_t x35;
+  uint64_t x36;
+  fiat_25519_uint128 x37;
+  uint64_t x38;
+  uint64_t x39;
+  fiat_25519_uint128 x40;
+  uint64_t x41;
+  uint64_t x42;
+  uint64_t x43;
+  uint64_t x44;
+  uint64_t x45;
+  uint64_t x46;
+  uint64_t x47;
+  fiat_25519_uint1 x48;
+  uint64_t x49;
+  uint64_t x50;
+  x1 = ((arg1[4]) * UINT8_C(0x13));
+  x2 = (x1 * 0x2);
+  x3 = ((arg1[4]) * 0x2);
+  x4 = ((arg1[3]) * UINT8_C(0x13));
+  x5 = (x4 * 0x2);
+  x6 = ((arg1[3]) * 0x2);
+  x7 = ((arg1[2]) * 0x2);
+  x8 = ((arg1[1]) * 0x2);
+  x9 = ((fiat_25519_uint128)(arg1[4]) * x1);
+  x10 = ((fiat_25519_uint128)(arg1[3]) * x2);
+  x11 = ((fiat_25519_uint128)(arg1[3]) * x4);
+  x12 = ((fiat_25519_uint128)(arg1[2]) * x2);
+  x13 = ((fiat_25519_uint128)(arg1[2]) * x5);
+  x14 = ((fiat_25519_uint128)(arg1[2]) * (arg1[2]));
+  x15 = ((fiat_25519_uint128)(arg1[1]) * x2);
+  x16 = ((fiat_25519_uint128)(arg1[1]) * x6);
+  x17 = ((fiat_25519_uint128)(arg1[1]) * x7);
+  x18 = ((fiat_25519_uint128)(arg1[1]) * (arg1[1]));
+  x19 = ((fiat_25519_uint128)(arg1[0]) * x3);
+  x20 = ((fiat_25519_uint128)(arg1[0]) * x6);
+  x21 = ((fiat_25519_uint128)(arg1[0]) * x7);
+  x22 = ((fiat_25519_uint128)(arg1[0]) * x8);
+  x23 = ((fiat_25519_uint128)(arg1[0]) * (arg1[0]));
+  x24 = (x23 + (x15 + x13));
+  x25 = (uint64_t)(x24 >> 51);
+  x26 = (uint64_t)(x24 & UINT64_C(0x7ffffffffffff));
+  x27 = (x19 + (x16 + x14));
+  x28 = (x20 + (x17 + x9));
+  x29 = (x21 + (x18 + x10));
+  x30 = (x22 + (x12 + x11));
+  x31 = (x25 + x30);
+  x32 = (uint64_t)(x31 >> 51);
+  x33 = (uint64_t)(x31 & UINT64_C(0x7ffffffffffff));
+  x34 = (x32 + x29);
+  x35 = (uint64_t)(x34 >> 51);
+  x36 = (uint64_t)(x34 & UINT64_C(0x7ffffffffffff));
+  x37 = (x35 + x28);
+  x38 = (uint64_t)(x37 >> 51);
+  x39 = (uint64_t)(x37 & UINT64_C(0x7ffffffffffff));
+  x40 = (x38 + x27);
+  x41 = (uint64_t)(x40 >> 51);
+  x42 = (uint64_t)(x40 & UINT64_C(0x7ffffffffffff));
+  x43 = (x41 * UINT8_C(0x13));
+  x44 = (x26 + x43);
+  x45 = (x44 >> 51);
+  x46 = (x44 & UINT64_C(0x7ffffffffffff));
+  x47 = (x45 + x33);
+  x48 = (fiat_25519_uint1)(x47 >> 51);
+  x49 = (x47 & UINT64_C(0x7ffffffffffff));
+  x50 = (x48 + x36);
+  out1[0] = x46;
+  out1[1] = x49;
+  out1[2] = x50;
+  out1[3] = x39;
+  out1[4] = x42;
+}
+
+/*
+ * The function fiat_25519_carry reduces a field element.
+ *
+ * Postconditions:
+ *   eval out1 mod m = eval arg1 mod m
+ *
+ */
+static void fiat_25519_carry(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) {
+  uint64_t x1;
+  uint64_t x2;
+  uint64_t x3;
+  uint64_t x4;
+  uint64_t x5;
+  uint64_t x6;
+  uint64_t x7;
+  uint64_t x8;
+  uint64_t x9;
+  uint64_t x10;
+  uint64_t x11;
+  uint64_t x12;
+  x1 = (arg1[0]);
+  x2 = ((x1 >> 51) + (arg1[1]));
+  x3 = ((x2 >> 51) + (arg1[2]));
+  x4 = ((x3 >> 51) + (arg1[3]));
+  x5 = ((x4 >> 51) + (arg1[4]));
+  x6 = ((x1 & UINT64_C(0x7ffffffffffff)) + ((x5 >> 51) * UINT8_C(0x13)));
+  x7 = ((fiat_25519_uint1)(x6 >> 51) + (x2 & UINT64_C(0x7ffffffffffff)));
+  x8 = (x6 & UINT64_C(0x7ffffffffffff));
+  x9 = (x7 & UINT64_C(0x7ffffffffffff));
+  x10 = ((fiat_25519_uint1)(x7 >> 51) + (x3 & UINT64_C(0x7ffffffffffff)));
+  x11 = (x4 & UINT64_C(0x7ffffffffffff));
+  x12 = (x5 & UINT64_C(0x7ffffffffffff));
+  out1[0] = x8;
+  out1[1] = x9;
+  out1[2] = x10;
+  out1[3] = x11;
+  out1[4] = x12;
+}
+
+/*
+ * The function fiat_25519_add adds two field elements.
+ *
+ * Postconditions:
+ *   eval out1 mod m = (eval arg1 + eval arg2) mod m
+ *
+ */
+static void fiat_25519_add(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) {
+  uint64_t x1;
+  uint64_t x2;
+  uint64_t x3;
+  uint64_t x4;
+  uint64_t x5;
+  x1 = ((arg1[0]) + (arg2[0]));
+  x2 = ((arg1[1]) + (arg2[1]));
+  x3 = ((arg1[2]) + (arg2[2]));
+  x4 = ((arg1[3]) + (arg2[3]));
+  x5 = ((arg1[4]) + (arg2[4]));
+  out1[0] = x1;
+  out1[1] = x2;
+  out1[2] = x3;
+  out1[3] = x4;
+  out1[4] = x5;
+}
+
+/*
+ * The function fiat_25519_sub subtracts two field elements.
+ *
+ * Postconditions:
+ *   eval out1 mod m = (eval arg1 - eval arg2) mod m
+ *
+ */
+static void fiat_25519_sub(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) {
+  uint64_t x1;
+  uint64_t x2;
+  uint64_t x3;
+  uint64_t x4;
+  uint64_t x5;
+  x1 = ((UINT64_C(0xfffffffffffda) + (arg1[0])) - (arg2[0]));
+  x2 = ((UINT64_C(0xffffffffffffe) + (arg1[1])) - (arg2[1]));
+  x3 = ((UINT64_C(0xffffffffffffe) + (arg1[2])) - (arg2[2]));
+  x4 = ((UINT64_C(0xffffffffffffe) + (arg1[3])) - (arg2[3]));
+  x5 = ((UINT64_C(0xffffffffffffe) + (arg1[4])) - (arg2[4]));
+  out1[0] = x1;
+  out1[1] = x2;
+  out1[2] = x3;
+  out1[3] = x4;
+  out1[4] = x5;
+}
+
+/*
+ * The function fiat_25519_opp negates a field element.
+ *
+ * Postconditions:
+ *   eval out1 mod m = -eval arg1 mod m
+ *
+ */
+static void fiat_25519_opp(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1) {
+  uint64_t x1;
+  uint64_t x2;
+  uint64_t x3;
+  uint64_t x4;
+  uint64_t x5;
+  x1 = (UINT64_C(0xfffffffffffda) - (arg1[0]));
+  x2 = (UINT64_C(0xffffffffffffe) - (arg1[1]));
+  x3 = (UINT64_C(0xffffffffffffe) - (arg1[2]));
+  x4 = (UINT64_C(0xffffffffffffe) - (arg1[3]));
+  x5 = (UINT64_C(0xffffffffffffe) - (arg1[4]));
+  out1[0] = x1;
+  out1[1] = x2;
+  out1[2] = x3;
+  out1[3] = x4;
+  out1[4] = x5;
+}
+
+/*
+ * The function fiat_25519_selectznz is a multi-limb conditional select.
+ *
+ * Postconditions:
+ *   out1 = (if arg1 = 0 then arg2 else arg3)
+ *
+ * Input Bounds:
+ *   arg1: [0x0 ~> 0x1]
+ *   arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
+ *   arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
+ * Output Bounds:
+ *   out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
+ */
+static void fiat_25519_selectznz(uint64_t out1[5], fiat_25519_uint1 arg1, const uint64_t arg2[5], const uint64_t arg3[5]) {
+  uint64_t x1;
+  uint64_t x2;
+  uint64_t x3;
+  uint64_t x4;
+  uint64_t x5;
+  fiat_25519_cmovznz_u64(&x1, arg1, (arg2[0]), (arg3[0]));
+  fiat_25519_cmovznz_u64(&x2, arg1, (arg2[1]), (arg3[1]));
+  fiat_25519_cmovznz_u64(&x3, arg1, (arg2[2]), (arg3[2]));
+  fiat_25519_cmovznz_u64(&x4, arg1, (arg2[3]), (arg3[3]));
+  fiat_25519_cmovznz_u64(&x5, arg1, (arg2[4]), (arg3[4]));
+  out1[0] = x1;
+  out1[1] = x2;
+  out1[2] = x3;
+  out1[3] = x4;
+  out1[4] = x5;
+}
+
+/*
+ * The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order.
+ *
+ * Postconditions:
+ *   out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
+ *
+ * Output Bounds:
+ *   out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]]
+ */
+static void fiat_25519_to_bytes(uint8_t out1[32], const fiat_25519_tight_field_element arg1) {
+  uint64_t x1;
+  fiat_25519_uint1 x2;
+  uint64_t x3;
+  fiat_25519_uint1 x4;
+  uint64_t x5;
+  fiat_25519_uint1 x6;
+  uint64_t x7;
+  fiat_25519_uint1 x8;
+  uint64_t x9;
+  fiat_25519_uint1 x10;
+  uint64_t x11;
+  uint64_t x12;
+  fiat_25519_uint1 x13;
+  uint64_t x14;
+  fiat_25519_uint1 x15;
+  uint64_t x16;
+  fiat_25519_uint1 x17;
+  uint64_t x18;
+  fiat_25519_uint1 x19;
+  uint64_t x20;
+  fiat_25519_uint1 x21;
+  uint64_t x22;
+  uint64_t x23;
+  uint64_t x24;
+  uint64_t x25;
+  uint8_t x26;
+  uint64_t x27;
+  uint8_t x28;
+  uint64_t x29;
+  uint8_t x30;
+  uint64_t x31;
+  uint8_t x32;
+  uint64_t x33;
+  uint8_t x34;
+  uint64_t x35;
+  uint8_t x36;
+  uint8_t x37;
+  uint64_t x38;
+  uint8_t x39;
+  uint64_t x40;
+  uint8_t x41;
+  uint64_t x42;
+  uint8_t x43;
+  uint64_t x44;
+  uint8_t x45;
+  uint64_t x46;
+  uint8_t x47;
+  uint64_t x48;
+  uint8_t x49;
+  uint8_t x50;
+  uint64_t x51;
+  uint8_t x52;
+  uint64_t x53;
+  uint8_t x54;
+  uint64_t x55;
+  uint8_t x56;
+  uint64_t x57;
+  uint8_t x58;
+  uint64_t x59;
+  uint8_t x60;
+  uint64_t x61;
+  uint8_t x62;
+  uint64_t x63;
+  uint8_t x64;
+  fiat_25519_uint1 x65;
+  uint64_t x66;
+  uint8_t x67;
+  uint64_t x68;
+  uint8_t x69;
+  uint64_t x70;
+  uint8_t x71;
+  uint64_t x72;
+  uint8_t x73;
+  uint64_t x74;
+  uint8_t x75;
+  uint64_t x76;
+  uint8_t x77;
+  uint8_t x78;
+  uint64_t x79;
+  uint8_t x80;
+  uint64_t x81;
+  uint8_t x82;
+  uint64_t x83;
+  uint8_t x84;
+  uint64_t x85;
+  uint8_t x86;
+  uint64_t x87;
+  uint8_t x88;
+  uint64_t x89;
+  uint8_t x90;
+  uint8_t x91;
+  fiat_25519_subborrowx_u51(&x1, &x2, 0x0, (arg1[0]), UINT64_C(0x7ffffffffffed));
+  fiat_25519_subborrowx_u51(&x3, &x4, x2, (arg1[1]), UINT64_C(0x7ffffffffffff));
+  fiat_25519_subborrowx_u51(&x5, &x6, x4, (arg1[2]), UINT64_C(0x7ffffffffffff));
+  fiat_25519_subborrowx_u51(&x7, &x8, x6, (arg1[3]), UINT64_C(0x7ffffffffffff));
+  fiat_25519_subborrowx_u51(&x9, &x10, x8, (arg1[4]), UINT64_C(0x7ffffffffffff));
+  fiat_25519_cmovznz_u64(&x11, x10, 0x0, UINT64_C(0xffffffffffffffff));
+  fiat_25519_addcarryx_u51(&x12, &x13, 0x0, x1, (x11 & UINT64_C(0x7ffffffffffed)));
+  fiat_25519_addcarryx_u51(&x14, &x15, x13, x3, (x11 & UINT64_C(0x7ffffffffffff)));
+  fiat_25519_addcarryx_u51(&x16, &x17, x15, x5, (x11 & UINT64_C(0x7ffffffffffff)));
+  fiat_25519_addcarryx_u51(&x18, &x19, x17, x7, (x11 & UINT64_C(0x7ffffffffffff)));
+  fiat_25519_addcarryx_u51(&x20, &x21, x19, x9, (x11 & UINT64_C(0x7ffffffffffff)));
+  x22 = (x20 << 4);
+  x23 = (x18 * (uint64_t)0x2);
+  x24 = (x16 << 6);
+  x25 = (x14 << 3);
+  x26 = (uint8_t)(x12 & UINT8_C(0xff));
+  x27 = (x12 >> 8);
+  x28 = (uint8_t)(x27 & UINT8_C(0xff));
+  x29 = (x27 >> 8);
+  x30 = (uint8_t)(x29 & UINT8_C(0xff));
+  x31 = (x29 >> 8);
+  x32 = (uint8_t)(x31 & UINT8_C(0xff));
+  x33 = (x31 >> 8);
+  x34 = (uint8_t)(x33 & UINT8_C(0xff));
+  x35 = (x33 >> 8);
+  x36 = (uint8_t)(x35 & UINT8_C(0xff));
+  x37 = (uint8_t)(x35 >> 8);
+  x38 = (x25 + (uint64_t)x37);
+  x39 = (uint8_t)(x38 & UINT8_C(0xff));
+  x40 = (x38 >> 8);
+  x41 = (uint8_t)(x40 & UINT8_C(0xff));
+  x42 = (x40 >> 8);
+  x43 = (uint8_t)(x42 & UINT8_C(0xff));
+  x44 = (x42 >> 8);
+  x45 = (uint8_t)(x44 & UINT8_C(0xff));
+  x46 = (x44 >> 8);
+  x47 = (uint8_t)(x46 & UINT8_C(0xff));
+  x48 = (x46 >> 8);
+  x49 = (uint8_t)(x48 & UINT8_C(0xff));
+  x50 = (uint8_t)(x48 >> 8);
+  x51 = (x24 + (uint64_t)x50);
+  x52 = (uint8_t)(x51 & UINT8_C(0xff));
+  x53 = (x51 >> 8);
+  x54 = (uint8_t)(x53 & UINT8_C(0xff));
+  x55 = (x53 >> 8);
+  x56 = (uint8_t)(x55 & UINT8_C(0xff));
+  x57 = (x55 >> 8);
+  x58 = (uint8_t)(x57 & UINT8_C(0xff));
+  x59 = (x57 >> 8);
+  x60 = (uint8_t)(x59 & UINT8_C(0xff));
+  x61 = (x59 >> 8);
+  x62 = (uint8_t)(x61 & UINT8_C(0xff));
+  x63 = (x61 >> 8);
+  x64 = (uint8_t)(x63 & UINT8_C(0xff));
+  x65 = (fiat_25519_uint1)(x63 >> 8);
+  x66 = (x23 + (uint64_t)x65);
+  x67 = (uint8_t)(x66 & UINT8_C(0xff));
+  x68 = (x66 >> 8);
+  x69 = (uint8_t)(x68 & UINT8_C(0xff));
+  x70 = (x68 >> 8);
+  x71 = (uint8_t)(x70 & UINT8_C(0xff));
+  x72 = (x70 >> 8);
+  x73 = (uint8_t)(x72 & UINT8_C(0xff));
+  x74 = (x72 >> 8);
+  x75 = (uint8_t)(x74 & UINT8_C(0xff));
+  x76 = (x74 >> 8);
+  x77 = (uint8_t)(x76 & UINT8_C(0xff));
+  x78 = (uint8_t)(x76 >> 8);
+  x79 = (x22 + (uint64_t)x78);
+  x80 = (uint8_t)(x79 & UINT8_C(0xff));
+  x81 = (x79 >> 8);
+  x82 = (uint8_t)(x81 & UINT8_C(0xff));
+  x83 = (x81 >> 8);
+  x84 = (uint8_t)(x83 & UINT8_C(0xff));
+  x85 = (x83 >> 8);
+  x86 = (uint8_t)(x85 & UINT8_C(0xff));
+  x87 = (x85 >> 8);
+  x88 = (uint8_t)(x87 & UINT8_C(0xff));
+  x89 = (x87 >> 8);
+  x90 = (uint8_t)(x89 & UINT8_C(0xff));
+  x91 = (uint8_t)(x89 >> 8);
+  out1[0] = x26;
+  out1[1] = x28;
+  out1[2] = x30;
+  out1[3] = x32;
+  out1[4] = x34;
+  out1[5] = x36;
+  out1[6] = x39;
+  out1[7] = x41;
+  out1[8] = x43;
+  out1[9] = x45;
+  out1[10] = x47;
+  out1[11] = x49;
+  out1[12] = x52;
+  out1[13] = x54;
+  out1[14] = x56;
+  out1[15] = x58;
+  out1[16] = x60;
+  out1[17] = x62;
+  out1[18] = x64;
+  out1[19] = x67;
+  out1[20] = x69;
+  out1[21] = x71;
+  out1[22] = x73;
+  out1[23] = x75;
+  out1[24] = x77;
+  out1[25] = x80;
+  out1[26] = x82;
+  out1[27] = x84;
+  out1[28] = x86;
+  out1[29] = x88;
+  out1[30] = x90;
+  out1[31] = x91;
+}
+
+/*
+ * The function fiat_25519_from_bytes deserializes a field element from bytes in little-endian order.
+ *
+ * Postconditions:
+ *   eval out1 mod m = bytes_eval arg1 mod m
+ *
+ * Input Bounds:
+ *   arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]]
+ */
+static void fiat_25519_from_bytes(fiat_25519_tight_field_element out1, const uint8_t arg1[32]) {
+  uint64_t x1;
+  uint64_t x2;
+  uint64_t x3;
+  uint64_t x4;
+  uint64_t x5;
+  uint64_t x6;
+  uint64_t x7;
+  uint64_t x8;
+  uint64_t x9;
+  uint64_t x10;
+  uint64_t x11;
+  uint64_t x12;
+  uint64_t x13;
+  uint64_t x14;
+  uint64_t x15;
+  uint64_t x16;
+  uint64_t x17;
+  uint64_t x18;
+  uint64_t x19;
+  uint64_t x20;
+  uint64_t x21;
+  uint64_t x22;
+  uint64_t x23;
+  uint64_t x24;
+  uint64_t x25;
+  uint64_t x26;
+  uint64_t x27;
+  uint64_t x28;
+  uint64_t x29;
+  uint64_t x30;
+  uint64_t x31;
+  uint8_t x32;
+  uint64_t x33;
+  uint64_t x34;
+  uint64_t x35;
+  uint64_t x36;
+  uint64_t x37;
+  uint64_t x38;
+  uint64_t x39;
+  uint8_t x40;
+  uint64_t x41;
+  uint64_t x42;
+  uint64_t x43;
+  uint64_t x44;
+  uint64_t x45;
+  uint64_t x46;
+  uint64_t x47;
+  uint8_t x48;
+  uint64_t x49;
+  uint64_t x50;
+  uint64_t x51;
+  uint64_t x52;
+  uint64_t x53;
+  uint64_t x54;
+  uint64_t x55;
+  uint64_t x56;
+  uint8_t x57;
+  uint64_t x58;
+  uint64_t x59;
+  uint64_t x60;
+  uint64_t x61;
+  uint64_t x62;
+  uint64_t x63;
+  uint64_t x64;
+  uint8_t x65;
+  uint64_t x66;
+  uint64_t x67;
+  uint64_t x68;
+  uint64_t x69;
+  uint64_t x70;
+  uint64_t x71;
+  x1 = ((uint64_t)(arg1[31]) << 44);
+  x2 = ((uint64_t)(arg1[30]) << 36);
+  x3 = ((uint64_t)(arg1[29]) << 28);
+  x4 = ((uint64_t)(arg1[28]) << 20);
+  x5 = ((uint64_t)(arg1[27]) << 12);
+  x6 = ((uint64_t)(arg1[26]) << 4);
+  x7 = ((uint64_t)(arg1[25]) << 47);
+  x8 = ((uint64_t)(arg1[24]) << 39);
+  x9 = ((uint64_t)(arg1[23]) << 31);
+  x10 = ((uint64_t)(arg1[22]) << 23);
+  x11 = ((uint64_t)(arg1[21]) << 15);
+  x12 = ((uint64_t)(arg1[20]) << 7);
+  x13 = ((uint64_t)(arg1[19]) << 50);
+  x14 = ((uint64_t)(arg1[18]) << 42);
+  x15 = ((uint64_t)(arg1[17]) << 34);
+  x16 = ((uint64_t)(arg1[16]) << 26);
+  x17 = ((uint64_t)(arg1[15]) << 18);
+  x18 = ((uint64_t)(arg1[14]) << 10);
+  x19 = ((uint64_t)(arg1[13]) << 2);
+  x20 = ((uint64_t)(arg1[12]) << 45);
+  x21 = ((uint64_t)(arg1[11]) << 37);
+  x22 = ((uint64_t)(arg1[10]) << 29);
+  x23 = ((uint64_t)(arg1[9]) << 21);
+  x24 = ((uint64_t)(arg1[8]) << 13);
+  x25 = ((uint64_t)(arg1[7]) << 5);
+  x26 = ((uint64_t)(arg1[6]) << 48);
+  x27 = ((uint64_t)(arg1[5]) << 40);
+  x28 = ((uint64_t)(arg1[4]) << 32);
+  x29 = ((uint64_t)(arg1[3]) << 24);
+  x30 = ((uint64_t)(arg1[2]) << 16);
+  x31 = ((uint64_t)(arg1[1]) << 8);
+  x32 = (arg1[0]);
+  x33 = (x31 + (uint64_t)x32);
+  x34 = (x30 + x33);
+  x35 = (x29 + x34);
+  x36 = (x28 + x35);
+  x37 = (x27 + x36);
+  x38 = (x26 + x37);
+  x39 = (x38 & UINT64_C(0x7ffffffffffff));
+  x40 = (uint8_t)(x38 >> 51);
+  x41 = (x25 + (uint64_t)x40);
+  x42 = (x24 + x41);
+  x43 = (x23 + x42);
+  x44 = (x22 + x43);
+  x45 = (x21 + x44);
+  x46 = (x20 + x45);
+  x47 = (x46 & UINT64_C(0x7ffffffffffff));
+  x48 = (uint8_t)(x46 >> 51);
+  x49 = (x19 + (uint64_t)x48);
+  x50 = (x18 + x49);
+  x51 = (x17 + x50);
+  x52 = (x16 + x51);
+  x53 = (x15 + x52);
+  x54 = (x14 + x53);
+  x55 = (x13 + x54);
+  x56 = (x55 & UINT64_C(0x7ffffffffffff));
+  x57 = (uint8_t)(x55 >> 51);
+  x58 = (x12 + (uint64_t)x57);
+  x59 = (x11 + x58);
+  x60 = (x10 + x59);
+  x61 = (x9 + x60);
+  x62 = (x8 + x61);
+  x63 = (x7 + x62);
+  x64 = (x63 & UINT64_C(0x7ffffffffffff));
+  x65 = (uint8_t)(x63 >> 51);
+  x66 = (x6 + (uint64_t)x65);
+  x67 = (x5 + x66);
+  x68 = (x4 + x67);
+  x69 = (x3 + x68);
+  x70 = (x2 + x69);
+  x71 = (x1 + x70);
+  out1[0] = x39;
+  out1[1] = x47;
+  out1[2] = x56;
+  out1[3] = x64;
+  out1[4] = x71;
+}
+
+/*
+ * The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result.
+ *
+ * Postconditions:
+ *   eval out1 mod m = (121666 * eval arg1) mod m
+ *
+ */
+static void fiat_25519_carry_scmul_121666(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) {
+  fiat_25519_uint128 x1;
+  fiat_25519_uint128 x2;
+  fiat_25519_uint128 x3;
+  fiat_25519_uint128 x4;
+  fiat_25519_uint128 x5;
+  uint64_t x6;
+  uint64_t x7;
+  fiat_25519_uint128 x8;
+  uint64_t x9;
+  uint64_t x10;
+  fiat_25519_uint128 x11;
+  uint64_t x12;
+  uint64_t x13;
+  fiat_25519_uint128 x14;
+  uint64_t x15;
+  uint64_t x16;
+  fiat_25519_uint128 x17;
+  uint64_t x18;
+  uint64_t x19;
+  uint64_t x20;
+  uint64_t x21;
+  fiat_25519_uint1 x22;
+  uint64_t x23;
+  uint64_t x24;
+  fiat_25519_uint1 x25;
+  uint64_t x26;
+  uint64_t x27;
+  x1 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[4]));
+  x2 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[3]));
+  x3 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[2]));
+  x4 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[1]));
+  x5 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[0]));
+  x6 = (uint64_t)(x5 >> 51);
+  x7 = (uint64_t)(x5 & UINT64_C(0x7ffffffffffff));
+  x8 = (x6 + x4);
+  x9 = (uint64_t)(x8 >> 51);
+  x10 = (uint64_t)(x8 & UINT64_C(0x7ffffffffffff));
+  x11 = (x9 + x3);
+  x12 = (uint64_t)(x11 >> 51);
+  x13 = (uint64_t)(x11 & UINT64_C(0x7ffffffffffff));
+  x14 = (x12 + x2);
+  x15 = (uint64_t)(x14 >> 51);
+  x16 = (uint64_t)(x14 & UINT64_C(0x7ffffffffffff));
+  x17 = (x15 + x1);
+  x18 = (uint64_t)(x17 >> 51);
+  x19 = (uint64_t)(x17 & UINT64_C(0x7ffffffffffff));
+  x20 = (x18 * UINT8_C(0x13));
+  x21 = (x7 + x20);
+  x22 = (fiat_25519_uint1)(x21 >> 51);
+  x23 = (x21 & UINT64_C(0x7ffffffffffff));
+  x24 = (x22 + x10);
+  x25 = (fiat_25519_uint1)(x24 >> 51);
+  x26 = (x24 & UINT64_C(0x7ffffffffffff));
+  x27 = (x25 + x13);
+  out1[0] = x23;
+  out1[1] = x26;
+  out1[2] = x27;
+  out1[3] = x16;
+  out1[4] = x19;
+}
--- a/unikernel/duniverse/mirage-crypto/ec/native/curve25519_stubs.c
+++ b/unikernel/duniverse/mirage-crypto/ec/native/curve25519_stubs.c
--- a/unikernel/duniverse/mirage-crypto/ec/native/curve25519_tables.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/curve25519_tables.h
@ -0,0 +1,375 @@
+/* following code is from c47bfce06 of boringssl: crypto/curve25519 */
+
+/* Copyright (c) 2020, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+// This file is generated from
+//    ./make_curve25519_tables.py > curve25519_tables.h
+
+static const fe d = {{
+#if defined(ARCH_64BIT)
+    929955233495203, 466365720129213, 1662059464998953, 2033849074728123,
+    1442794654840575
+#else
+    56195235, 13857412, 51736253, 6949390, 114729, 24766616, 60832955, 30306712,
+    48412415, 21499315
+#endif
+}};
+
+static const fe sqrtm1 = {{
+#if defined(ARCH_64BIT)
+    1718705420411056, 234908883556509, 2233514472574048, 2117202627021982,
+    765476049583133
+#else
+    34513072, 25610706, 9377949, 3500415, 12389472, 33281959, 41962654,
+    31548777, 326685, 11406482
+#endif
+}};
+
+static const fe d2 = {{
+#if defined(ARCH_64BIT)
+    1859910466990425, 932731440258426, 1072319116312658, 1815898335770999,
+    633789495995903
+#else
+    45281625, 27714825, 36363642, 13898781, 229458, 15978800, 54557047,
+    27058993, 29715967, 9444199
+#endif
+}};
+
+// This block of code replaces the standard base-point table with a much smaller
+// one. The standard table is 30,720 bytes while this one is just 960.
+//
+// This table contains 15 pairs of group elements, (x, y), where each field
+// element is serialised with |fe_tobytes|. If |i| is the index of the group
+// element then consider i+1 as a four-bit number: (i₀, i₁, i₂, i₃) (where i₀
+// is the most significant bit). The value of the group element is then:
+// (i₀×2^192 + i₁×2^128 + i₂×2^64 + i₃)G, where G is the generator.
+static const uint8_t k25519SmallPrecomp[15 * 2 * 32] = {
+    0x1a, 0xd5, 0x25, 0x8f, 0x60, 0x2d, 0x56, 0xc9, 0xb2, 0xa7, 0x25, 0x95,
+    0x60, 0xc7, 0x2c, 0x69, 0x5c, 0xdc, 0xd6, 0xfd, 0x31, 0xe2, 0xa4, 0xc0,
+    0xfe, 0x53, 0x6e, 0xcd, 0xd3, 0x36, 0x69, 0x21, 0x58, 0x66, 0x66, 0x66,
+    0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
+    0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
+    0x66, 0x66, 0x66, 0x66, 0x02, 0xa2, 0xed, 0xf4, 0x8f, 0x6b, 0x0b, 0x3e,
+    0xeb, 0x35, 0x1a, 0xd5, 0x7e, 0xdb, 0x78, 0x00, 0x96, 0x8a, 0xa0, 0xb4,
+    0xcf, 0x60, 0x4b, 0xd4, 0xd5, 0xf9, 0x2d, 0xbf, 0x88, 0xbd, 0x22, 0x62,
+    0x13, 0x53, 0xe4, 0x82, 0x57, 0xfa, 0x1e, 0x8f, 0x06, 0x2b, 0x90, 0xba,
+    0x08, 0xb6, 0x10, 0x54, 0x4f, 0x7c, 0x1b, 0x26, 0xed, 0xda, 0x6b, 0xdd,
+    0x25, 0xd0, 0x4e, 0xea, 0x42, 0xbb, 0x25, 0x03, 0xa2, 0xfb, 0xcc, 0x61,
+    0x67, 0x06, 0x70, 0x1a, 0xc4, 0x78, 0x3a, 0xff, 0x32, 0x62, 0xdd, 0x2c,
+    0xab, 0x50, 0x19, 0x3b, 0xf2, 0x9b, 0x7d, 0xb8, 0xfd, 0x4f, 0x29, 0x9c,
+    0xa7, 0x91, 0xba, 0x0e, 0x46, 0x5e, 0x51, 0xfe, 0x1d, 0xbf, 0xe5, 0xe5,
+    0x9b, 0x95, 0x0d, 0x67, 0xf8, 0xd1, 0xb5, 0x5a, 0xa1, 0x93, 0x2c, 0xc3,
+    0xde, 0x0e, 0x97, 0x85, 0x2d, 0x7f, 0xea, 0xab, 0x3e, 0x47, 0x30, 0x18,
+    0x24, 0xe8, 0xb7, 0x60, 0xae, 0x47, 0x80, 0xfc, 0xe5, 0x23, 0xe7, 0xc2,
+    0xc9, 0x85, 0xe6, 0x98, 0xa0, 0x29, 0x4e, 0xe1, 0x84, 0x39, 0x2d, 0x95,
+    0x2c, 0xf3, 0x45, 0x3c, 0xff, 0xaf, 0x27, 0x4c, 0x6b, 0xa6, 0xf5, 0x4b,
+    0x11, 0xbd, 0xba, 0x5b, 0x9e, 0xc4, 0xa4, 0x51, 0x1e, 0xbe, 0xd0, 0x90,
+    0x3a, 0x9c, 0xc2, 0x26, 0xb6, 0x1e, 0xf1, 0x95, 0x7d, 0xc8, 0x6d, 0x52,
+    0xe6, 0x99, 0x2c, 0x5f, 0x9a, 0x96, 0x0c, 0x68, 0x29, 0xfd, 0xe2, 0xfb,
+    0xe6, 0xbc, 0xec, 0x31, 0x08, 0xec, 0xe6, 0xb0, 0x53, 0x60, 0xc3, 0x8c,
+    0xbe, 0xc1, 0xb3, 0x8a, 0x8f, 0xe4, 0x88, 0x2b, 0x55, 0xe5, 0x64, 0x6e,
+    0x9b, 0xd0, 0xaf, 0x7b, 0x64, 0x2a, 0x35, 0x25, 0x10, 0x52, 0xc5, 0x9e,
+    0x58, 0x11, 0x39, 0x36, 0x45, 0x51, 0xb8, 0x39, 0x93, 0xfc, 0x9d, 0x6a,
+    0xbe, 0x58, 0xcb, 0xa4, 0x0f, 0x51, 0x3c, 0x38, 0x05, 0xca, 0xab, 0x43,
+    0x63, 0x0e, 0xf3, 0x8b, 0x41, 0xa6, 0xf8, 0x9b, 0x53, 0x70, 0x80, 0x53,
+    0x86, 0x5e, 0x8f, 0xe3, 0xc3, 0x0d, 0x18, 0xc8, 0x4b, 0x34, 0x1f, 0xd8,
+    0x1d, 0xbc, 0xf2, 0x6d, 0x34, 0x3a, 0xbe, 0xdf, 0xd9, 0xf6, 0xf3, 0x89,
+    0xa1, 0xe1, 0x94, 0x9f, 0x5d, 0x4c, 0x5d, 0xe9, 0xa1, 0x49, 0x92, 0xef,
+    0x0e, 0x53, 0x81, 0x89, 0x58, 0x87, 0xa6, 0x37, 0xf1, 0xdd, 0x62, 0x60,
+    0x63, 0x5a, 0x9d, 0x1b, 0x8c, 0xc6, 0x7d, 0x52, 0xea, 0x70, 0x09, 0x6a,
+    0xe1, 0x32, 0xf3, 0x73, 0x21, 0x1f, 0x07, 0x7b, 0x7c, 0x9b, 0x49, 0xd8,
+    0xc0, 0xf3, 0x25, 0x72, 0x6f, 0x9d, 0xed, 0x31, 0x67, 0x36, 0x36, 0x54,
+    0x40, 0x92, 0x71, 0xe6, 0x11, 0x28, 0x11, 0xad, 0x93, 0x32, 0x85, 0x7b,
+    0x3e, 0xb7, 0x3b, 0x49, 0x13, 0x1c, 0x07, 0xb0, 0x2e, 0x93, 0xaa, 0xfd,
+    0xfd, 0x28, 0x47, 0x3d, 0x8d, 0xd2, 0xda, 0xc7, 0x44, 0xd6, 0x7a, 0xdb,
+    0x26, 0x7d, 0x1d, 0xb8, 0xe1, 0xde, 0x9d, 0x7a, 0x7d, 0x17, 0x7e, 0x1c,
+    0x37, 0x04, 0x8d, 0x2d, 0x7c, 0x5e, 0x18, 0x38, 0x1e, 0xaf, 0xc7, 0x1b,
+    0x33, 0x48, 0x31, 0x00, 0x59, 0xf6, 0xf2, 0xca, 0x0f, 0x27, 0x1b, 0x63,
+    0x12, 0x7e, 0x02, 0x1d, 0x49, 0xc0, 0x5d, 0x79, 0x87, 0xef, 0x5e, 0x7a,
+    0x2f, 0x1f, 0x66, 0x55, 0xd8, 0x09, 0xd9, 0x61, 0x38, 0x68, 0xb0, 0x07,
+    0xa3, 0xfc, 0xcc, 0x85, 0x10, 0x7f, 0x4c, 0x65, 0x65, 0xb3, 0xfa, 0xfa,
+    0xa5, 0x53, 0x6f, 0xdb, 0x74, 0x4c, 0x56, 0x46, 0x03, 0xe2, 0xd5, 0x7a,
+    0x29, 0x1c, 0xc6, 0x02, 0xbc, 0x59, 0xf2, 0x04, 0x75, 0x63, 0xc0, 0x84,
+    0x2f, 0x60, 0x1c, 0x67, 0x76, 0xfd, 0x63, 0x86, 0xf3, 0xfa, 0xbf, 0xdc,
+    0xd2, 0x2d, 0x90, 0x91, 0xbd, 0x33, 0xa9, 0xe5, 0x66, 0x0c, 0xda, 0x42,
+    0x27, 0xca, 0xf4, 0x66, 0xc2, 0xec, 0x92, 0x14, 0x57, 0x06, 0x63, 0xd0,
+    0x4d, 0x15, 0x06, 0xeb, 0x69, 0x58, 0x4f, 0x77, 0xc5, 0x8b, 0xc7, 0xf0,
+    0x8e, 0xed, 0x64, 0xa0, 0xb3, 0x3c, 0x66, 0x71, 0xc6, 0x2d, 0xda, 0x0a,
+    0x0d, 0xfe, 0x70, 0x27, 0x64, 0xf8, 0x27, 0xfa, 0xf6, 0x5f, 0x30, 0xa5,
+    0x0d, 0x6c, 0xda, 0xf2, 0x62, 0x5e, 0x78, 0x47, 0xd3, 0x66, 0x00, 0x1c,
+    0xfd, 0x56, 0x1f, 0x5d, 0x3f, 0x6f, 0xf4, 0x4c, 0xd8, 0xfd, 0x0e, 0x27,
+    0xc9, 0x5c, 0x2b, 0xbc, 0xc0, 0xa4, 0xe7, 0x23, 0x29, 0x02, 0x9f, 0x31,
+    0xd6, 0xe9, 0xd7, 0x96, 0xf4, 0xe0, 0x5e, 0x0b, 0x0e, 0x13, 0xee, 0x3c,
+    0x09, 0xed, 0xf2, 0x3d, 0x76, 0x91, 0xc3, 0xa4, 0x97, 0xae, 0xd4, 0x87,
+    0xd0, 0x5d, 0xf6, 0x18, 0x47, 0x1f, 0x1d, 0x67, 0xf2, 0xcf, 0x63, 0xa0,
+    0x91, 0x27, 0xf8, 0x93, 0x45, 0x75, 0x23, 0x3f, 0xd1, 0xf1, 0xad, 0x23,
+    0xdd, 0x64, 0x93, 0x96, 0x41, 0x70, 0x7f, 0xf7, 0xf5, 0xa9, 0x89, 0xa2,
+    0x34, 0xb0, 0x8d, 0x1b, 0xae, 0x19, 0x15, 0x49, 0x58, 0x23, 0x6d, 0x87,
+    0x15, 0x4f, 0x81, 0x76, 0xfb, 0x23, 0xb5, 0xea, 0xcf, 0xac, 0x54, 0x8d,
+    0x4e, 0x42, 0x2f, 0xeb, 0x0f, 0x63, 0xdb, 0x68, 0x37, 0xa8, 0xcf, 0x8b,
+    0xab, 0xf5, 0xa4, 0x6e, 0x96, 0x2a, 0xb2, 0xd6, 0xbe, 0x9e, 0xbd, 0x0d,
+    0xb4, 0x42, 0xa9, 0xcf, 0x01, 0x83, 0x8a, 0x17, 0x47, 0x76, 0xc4, 0xc6,
+    0x83, 0x04, 0x95, 0x0b, 0xfc, 0x11, 0xc9, 0x62, 0xb8, 0x0c, 0x76, 0x84,
+    0xd9, 0xb9, 0x37, 0xfa, 0xfc, 0x7c, 0xc2, 0x6d, 0x58, 0x3e, 0xb3, 0x04,
+    0xbb, 0x8c, 0x8f, 0x48, 0xbc, 0x91, 0x27, 0xcc, 0xf9, 0xb7, 0x22, 0x19,
+    0x83, 0x2e, 0x09, 0xb5, 0x72, 0xd9, 0x54, 0x1c, 0x4d, 0xa1, 0xea, 0x0b,
+    0xf1, 0xc6, 0x08, 0x72, 0x46, 0x87, 0x7a, 0x6e, 0x80, 0x56, 0x0a, 0x8a,
+    0xc0, 0xdd, 0x11, 0x6b, 0xd6, 0xdd, 0x47, 0xdf, 0x10, 0xd9, 0xd8, 0xea,
+    0x7c, 0xb0, 0x8f, 0x03, 0x00, 0x2e, 0xc1, 0x8f, 0x44, 0xa8, 0xd3, 0x30,
+    0x06, 0x89, 0xa2, 0xf9, 0x34, 0xad, 0xdc, 0x03, 0x85, 0xed, 0x51, 0xa7,
+    0x82, 0x9c, 0xe7, 0x5d, 0x52, 0x93, 0x0c, 0x32, 0x9a, 0x5b, 0xe1, 0xaa,
+    0xca, 0xb8, 0x02, 0x6d, 0x3a, 0xd4, 0xb1, 0x3a, 0xf0, 0x5f, 0xbe, 0xb5,
+    0x0d, 0x10, 0x6b, 0x38, 0x32, 0xac, 0x76, 0x80, 0xbd, 0xca, 0x94, 0x71,
+    0x7a, 0xf2, 0xc9, 0x35, 0x2a, 0xde, 0x9f, 0x42, 0x49, 0x18, 0x01, 0xab,
+    0xbc, 0xef, 0x7c, 0x64, 0x3f, 0x58, 0x3d, 0x92, 0x59, 0xdb, 0x13, 0xdb,
+    0x58, 0x6e, 0x0a, 0xe0, 0xb7, 0x91, 0x4a, 0x08, 0x20, 0xd6, 0x2e, 0x3c,
+    0x45, 0xc9, 0x8b, 0x17, 0x79, 0xe7, 0xc7, 0x90, 0x99, 0x3a, 0x18, 0x25,
+};
+
+// Bi[i] = (2*i+1)*B
+static const ge_precomp Bi[8] = {
+    {
+        {{
+#if defined(ARCH_64BIT)
+            1288382639258501, 245678601348599, 269427782077623,
+            1462984067271730, 137412439391563
+#else
+            25967493, 19198397, 29566455, 3660896, 54414519, 4014786, 27544626,
+            21800161, 61029707, 2047604
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            62697248952638, 204681361388450, 631292143396476, 338455783676468,
+            1213667448819585
+#else
+            54563134, 934261, 64385954, 3049989, 66381436, 9406985, 12720692,
+            5043384, 19500929, 18085054
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            301289933810280, 1259582250014073, 1422107436869536,
+            796239922652654, 1953934009299142
+#else
+            58370664, 4489569, 9688441, 18769238, 10184608, 21191052, 29287918,
+            11864899, 42594502, 29115885
+#endif
+        }},
+    },
+    {
+        {{
+#if defined(ARCH_64BIT)
+            1601611775252272, 1720807796594148, 1132070835939856,
+            1260455018889551, 2147779492816911
+#else
+            15636272, 23865875, 24204772, 25642034, 616976, 16869170, 27787599,
+            18782243, 28944399, 32004408
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            316559037616741, 2177824224946892, 1459442586438991,
+            1461528397712656, 751590696113597
+#else
+            16568933, 4717097, 55552716, 32452109, 15682895, 21747389, 16354576,
+            21778470, 7689661, 11199574
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            1850748884277385, 1200145853858453, 1068094770532492,
+            672251375690438, 1586055907191707
+#else
+            30464137, 27578307, 55329429, 17883566, 23220364, 15915852, 7512774,
+            10017326, 49359771, 23634074
+#endif
+        }},
+    },
+    {
+        {{
+#if defined(ARCH_64BIT)
+            769950342298419, 132954430919746, 844085933195555, 974092374476333,
+            726076285546016
+#else
+            10861363, 11473154, 27284546, 1981175, 37044515, 12577860, 32867885,
+            14515107, 51670560, 10819379
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            425251763115706, 608463272472562, 442562545713235, 837766094556764,
+            374555092627893
+#else
+            4708026, 6336745, 20377586, 9066809, 55836755, 6594695, 41455196,
+            12483687, 54440373, 5581305
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            1086255230780037, 274979815921559, 1960002765731872,
+            929474102396301, 1190409889297339
+#else
+            19563141, 16186464, 37722007, 4097518, 10237984, 29206317, 28542349,
+            13850243, 43430843, 17738489
+#endif
+        }},
+    },
+    {
+        {{
+#if defined(ARCH_64BIT)
+            665000864555967, 2065379846933859, 370231110385876, 350988370788628,
+            1233371373142985
+#else
+            5153727, 9909285, 1723747, 30776558, 30523604, 5516873, 19480852,
+            5230134, 43156425, 18378665
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            2019367628972465, 676711900706637, 110710997811333,
+            1108646842542025, 517791959672113
+#else
+            36839857, 30090922, 7665485, 10083793, 28475525, 1649722, 20654025,
+            16520125, 30598449, 7715701
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            965130719900578, 247011430587952, 526356006571389, 91986625355052,
+            2157223321444601
+#else
+            28881826, 14381568, 9657904, 3680757, 46927229, 7843315, 35708204,
+            1370707, 29794553, 32145132
+#endif
+        }},
+    },
+    {
+        {{
+#if defined(ARCH_64BIT)
+            1802695059465007, 1664899123557221, 593559490740857,
+            2160434469266659, 927570450755031
+#else
+            44589871, 26862249, 14201701, 24808930, 43598457, 8844725, 18474211,
+            32192982, 54046167, 13821876
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            1725674970513508, 1933645953859181, 1542344539275782,
+            1767788773573747, 1297447965928905
+#else
+            60653668, 25714560, 3374701, 28813570, 40010246, 22982724, 31655027,
+            26342105, 18853321, 19333481
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            1381809363726107, 1430341051343062, 2061843536018959,
+            1551778050872521, 2036394857967624
+#else
+            4566811, 20590564, 38133974, 21313742, 59506191, 30723862, 58594505,
+            23123294, 2207752, 30344648
+#endif
+        }},
+    },
+    {
+        {{
+#if defined(ARCH_64BIT)
+            1970894096313054, 528066325833207, 1619374932191227,
+            2207306624415883, 1169170329061080
+#else
+            41954014, 29368610, 29681143, 7868801, 60254203, 24130566, 54671499,
+            32891431, 35997400, 17421995
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            2070390218572616, 1458919061857835, 624171843017421,
+            1055332792707765, 433987520732508
+#else
+            25576264, 30851218, 7349803, 21739588, 16472781, 9300885, 3844789,
+            15725684, 171356, 6466918
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            893653801273833, 1168026499324677, 1242553501121234,
+            1306366254304474, 1086752658510815
+#else
+            23103977, 13316479, 9739013, 17404951, 817874, 18515490, 8965338,
+            19466374, 36393951, 16193876
+#endif
+        }},
+    },
+    {
+        {{
+#if defined(ARCH_64BIT)
+            213454002618221, 939771523987438, 1159882208056014, 317388369627517,
+            621213314200687
+#else
+            33587053, 3180712, 64714734, 14003686, 50205390, 17283591, 17238397,
+            4729455, 49034351, 9256799
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            1971678598905747, 338026507889165, 762398079972271, 655096486107477,
+            42299032696322
+#else
+            41926547, 29380300, 32336397, 5036987, 45872047, 11360616, 22616405,
+            9761698, 47281666, 630304
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            177130678690680, 1754759263300204, 1864311296286618,
+            1180675631479880, 1292726903152791
+#else
+            53388152, 2639452, 42871404, 26147950, 9494426, 27780403, 60554312,
+            17593437, 64659607, 19263131
+#endif
+        }},
+    },
+    {
+        {{
+#if defined(ARCH_64BIT)
+            1913163449625248, 460779200291993, 2193883288642314,
+            1008900146920800, 1721983679009502
+#else
+            63957664, 28508356, 9282713, 6866145, 35201802, 32691408, 48168288,
+            15033783, 25105118, 25659556
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            1070401523076875, 1272492007800961, 1910153608563310,
+            2075579521696771, 1191169788841221
+#else
+            42782475, 15950225, 35307649, 18961608, 55446126, 28463506, 1573891,
+            30928545, 2198789, 17749813
+#endif
+        }},
+        {{
+#if defined(ARCH_64BIT)
+            692896803108118, 500174642072499, 2068223309439677,
+            1162190621851337, 1426986007309901
+#else
+            64009494, 10324966, 64867251, 7453182, 61661885, 30818928, 53296841,
+            17317989, 34647629, 21263748
+#endif
+        }},
+    },
+};
--- a/unikernel/duniverse/mirage-crypto/ec/native/inversion_template.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/inversion_template.h
@ -0,0 +1,61 @@
+#define MAKE_FN_NAME1(x,y) x ## y
+#define MAKE_FN_NAME(x,y) MAKE_FN_NAME1(x,y)
+
+#define PRECOMP MAKE_FN_NAME(CURVE_DESCRIPTION,_divstep_precomp)
+#define MSAT MAKE_FN_NAME(CURVE_DESCRIPTION,_msat)
+#define MONE MAKE_FN_NAME(CURVE_DESCRIPTION,_set_one)
+#define DIVSTEP MAKE_FN_NAME(CURVE_DESCRIPTION,_divstep)
+#define OPP MAKE_FN_NAME(CURVE_DESCRIPTION,_opp)
+#define MUL MAKE_FN_NAME(CURVE_DESCRIPTION,_mul)
+#define SZNZ MAKE_FN_NAME(CURVE_DESCRIPTION,_selectznz)
+
+#if LEN_PRIME < 46
+#define ITERATIONS (((49 * LEN_PRIME) + 80) / 17)
+#else
+#define ITERATIONS (((49 * LEN_PRIME) + 57) / 17)
+#endif
+
+#define SAT_LIMBS LIMBS + 1 /* we might need 2 more bits to represent m in twos complement */
+#define BYTES 8 * (((LEN_PRIME - 1) / 64) + 1)
+
+static void inverse(WORD out[LIMBS], WORD g[SAT_LIMBS]) {
+
+  WORD precomp[LIMBS];
+  PRECOMP(precomp);
+
+  WORD d = 1;
+  WORD f[SAT_LIMBS];
+  WORD v[LIMBS];
+  WORD r[LIMBS];
+  WORD out1;
+  WORD out2[SAT_LIMBS], out3[SAT_LIMBS], out4[LIMBS], out5[LIMBS];
+
+  MSAT(f);
+  MONE(r);
+  for (int j = 0; j < LIMBS; j++) v[j] = 0;
+
+  for (int i = 0; i < ITERATIONS - (ITERATIONS % 2); i+=2) {
+    DIVSTEP(&out1,out2,out3,out4,out5,d,f,g,v,r);
+    DIVSTEP(&d,f,g,v,r,out1,out2,out3,out4,out5);
+  }
+  if (ITERATIONS % 2) {
+    DIVSTEP(&out1,out2,out3,out4,out5,d,f,g,v,r);
+    for (int k = 0; k < LIMBS; k++) v[k] = out4[k];
+    for (int k = 0; k < SAT_LIMBS; k++) f[k] = out2[k];
+  }
+
+  WORD h[LIMBS];
+  OPP(h, v);
+  SZNZ(v, f[SAT_LIMBS -1 ] >> (WORDSIZE - 1), v, h);
+  MUL(out, v, precomp);
+
+  return;
+}
+
+static void inversion (WORD out[LIMBS], const WORD in[LIMBS]) {
+  WORD in_[SAT_LIMBS];
+  for (int i = 0; i < LIMBS; i++) in_[i] = in[i];
+  in_[LIMBS] = 0;
+  inverse(out, in_);
+  return;
+}
--- a/unikernel/duniverse/mirage-crypto/ec/native/np256_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np256_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/np256_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np256_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/np256_stubs.c
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np256_stubs.c
@ -0,0 +1,79 @@
+#include "mirage_crypto.h"
+
+/* Microsoft compiler does not support 128-bit integers. Drop down to
+ * 32-bit for MSVC.
+ */
+#if defined(ARCH_64BIT) && !defined(_MSC_VER)
+#include "np256_64.h"
+#define LIMBS 4
+#define WORD uint64_t
+#define WORDSIZE 64
+#else
+#include "np256_32.h"
+#define LIMBS 8
+#define WORD uint32_t
+#define WORDSIZE 32
+#endif
+
+#define LEN_PRIME 256
+#define CURVE_DESCRIPTION fiat_np256
+
+#include "inversion_template.h"
+
+#include <caml/memory.h>
+
+CAMLprim value mc_np256_inv(value out, value in)
+{
+	CAMLparam2(out, in);
+	inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np256_mul(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_np256_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np256_add(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_np256_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np256_one(value out)
+{
+	CAMLparam1(out);
+	fiat_np256_set_one((WORD*)Bytes_val(out));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np256_from_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np256_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np256_to_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np256_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np256_from_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np256_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np256_to_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np256_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
--- a/unikernel/duniverse/mirage-crypto/ec/native/np384_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np384_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/np384_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np384_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/np384_stubs.c
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np384_stubs.c
@ -0,0 +1,79 @@
+#include "mirage_crypto.h"
+
+/* Microsoft compiler does not support 128-bit integers. Drop down to
+ * 32-bit for MSVC.
+ */
+#if defined(ARCH_64BIT) && !defined(_MSC_VER)
+#include "np384_64.h"
+#define LIMBS 6
+#define WORD uint64_t
+#define WORDSIZE 64
+#else
+#include "np384_32.h"
+#define LIMBS 12
+#define WORD uint32_t
+#define WORDSIZE 32
+#endif
+
+#define LEN_PRIME 384
+#define CURVE_DESCRIPTION fiat_np384
+
+#include "inversion_template.h"
+
+#include <caml/memory.h>
+
+CAMLprim value mc_np384_inv(value out, value in)
+{
+	CAMLparam2(out, in);
+	inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np384_mul(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_np384_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np384_add(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_np384_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np384_one(value out)
+{
+	CAMLparam1(out);
+	fiat_np384_set_one((WORD*)Bytes_val(out));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np384_from_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np384_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np384_to_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np384_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np384_from_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np384_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np384_to_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np384_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
--- a/unikernel/duniverse/mirage-crypto/ec/native/np521_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np521_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/np521_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np521_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/np521_stubs.c
+++ b/unikernel/duniverse/mirage-crypto/ec/native/np521_stubs.c
@ -0,0 +1,80 @@
+#include "mirage_crypto.h"
+
+/* Microsoft compiler does not support 128-bit integers. Drop down to
+ * 32-bit for MSVC.
+ */
+#if defined(ARCH_64BIT) && !defined(_MSC_VER)
+#include "np521_64.h"
+#define LIMBS 9
+#define WORD uint64_t
+#define WORDSIZE 64
+#else
+#include "np521_32.h"
+#define LIMBS 17
+#define WORD uint32_t
+#define WORDSIZE 32
+#endif
+
+#define LEN_PRIME 521
+#define CURVE_DESCRIPTION fiat_np521
+
+#include "inversion_template.h"
+
+#include <caml/memory.h>
+
+CAMLprim value mc_np521_inv(value out, value in)
+{
+	CAMLparam2(out, in);
+	inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np521_mul(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_np521_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np521_add(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_np521_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np521_one(value out)
+{
+	CAMLparam1(out);
+	fiat_np521_set_one((WORD*)Bytes_val(out));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np521_from_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np521_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np521_to_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np521_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np521_from_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np521_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_np521_to_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_np521_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
--- a/unikernel/duniverse/mirage-crypto/ec/native/p256_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p256_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p256_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p256_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p256_stubs.c
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p256_stubs.c
@ -0,0 +1,160 @@
+#include "mirage_crypto.h"
+
+/* Microsoft compiler does not support 128-bit integers. Drop down to
+ * 32-bit for MSVC.
+ */
+#if defined(ARCH_64BIT) && !defined(_MSC_VER)
+#include "p256_64.h"
+#define LIMBS 4
+#define WORD uint64_t
+#define WORDSIZE 64
+#include "p256_tables_64.h"
+#else
+#include "p256_32.h"
+#define LIMBS 8
+#define WORD uint32_t
+#define WORDSIZE 32
+#include "p256_tables_32.h"
+#endif
+
+#define LEN_PRIME 256
+#define CURVE_DESCRIPTION fiat_p256
+
+#include "inversion_template.h"
+#include "point_operations.h"
+
+#include <caml/memory.h>
+
+CAMLprim value mc_p256_sub(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p256_sub((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_add(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p256_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_mul(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p256_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_from_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p256_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_to_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p256_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_sqr(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p256_square((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_from_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p256_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_to_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p256_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_nz(value x)
+{
+	CAMLparam1(x);
+	CAMLreturn(Val_bool(fe_nz((const WORD*)String_val(x))));
+}
+
+CAMLprim value mc_p256_set_one(value x)
+{
+	CAMLparam1(x);
+        fiat_p256_set_one((WORD*)Bytes_val(x));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_inv(value out, value in)
+{
+	CAMLparam2(out, in);
+	inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_point_double(value out, value in)
+{
+	CAMLparam2(out, in);
+	point_double(
+		(WORD*)Bytes_val(Field(out, 0)),
+		(WORD*)Bytes_val(Field(out, 1)),
+		(WORD*)Bytes_val(Field(out, 2)),
+		(const WORD*)String_val(Field(in, 0)),
+		(const WORD*)String_val(Field(in, 1)),
+		(const WORD*)String_val(Field(in, 2))
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_point_add(value out, value p, value q)
+{
+	CAMLparam3(out, p, q);
+	point_add(
+		(WORD*)Bytes_val(Field(out, 0)),
+		(WORD*)Bytes_val(Field(out, 1)),
+		(WORD*)Bytes_val(Field(out, 2)),
+		(const WORD*)String_val(Field(p, 0)),
+		(const WORD*)String_val(Field(p, 1)),
+		(const WORD*)String_val(Field(p, 2)),
+		0,
+		(const WORD*)String_val(Field(q, 0)),
+		(const WORD*)String_val(Field(q, 1)),
+		(const WORD*)String_val(Field(q, 2))
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p256_select(value out, value bit, value t, value f)
+{
+	CAMLparam4(out, bit, t, f);
+	fe_cmovznz(
+		(WORD*)Bytes_val(out),
+		Bool_val(bit),
+		(const WORD*)String_val(f),
+		(const WORD*)String_val(t)
+	);
+	CAMLreturn(Val_unit);
+}
+
+
+CAMLprim value mc_p256_scalar_mult_base(value out, value s)
+{
+    CAMLparam2(out, s);
+    scalar_mult_base(
+		(WORD *) Bytes_val(Field(out, 0)),
+		(WORD *) Bytes_val(Field(out, 1)),
+		(WORD *) Bytes_val(Field(out, 2)),
+		_st_uint8(s),
+		caml_string_length(s)
+    );
+    CAMLreturn(Val_unit);
+}
--- a/unikernel/duniverse/mirage-crypto/ec/native/p256_tables_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p256_tables_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p256_tables_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p256_tables_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p384_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p384_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p384_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p384_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p384_stubs.c
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p384_stubs.c
@ -0,0 +1,159 @@
+#include "mirage_crypto.h"
+
+/* Microsoft compiler does not support 128-bit integers. Drop down to
+ * 32-bit for MSVC.
+ */
+#if defined(ARCH_64BIT) && !defined(_MSC_VER)
+#include "p384_64.h"
+#define LIMBS 6
+#define WORD uint64_t
+#define WORDSIZE 64
+#include "p384_tables_64.h"
+#else
+#include "p384_32.h"
+#define LIMBS 12
+#define WORD uint32_t
+#define WORDSIZE 32
+#include "p384_tables_32.h"
+#endif
+
+#define LEN_PRIME 384
+#define CURVE_DESCRIPTION fiat_p384
+
+#include "inversion_template.h"
+#include "point_operations.h"
+
+#include <caml/memory.h>
+
+CAMLprim value mc_p384_sub(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p384_sub((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_add(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p384_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_mul(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p384_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_from_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p384_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_to_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p384_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_sqr(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p384_square((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_from_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p384_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_to_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p384_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_nz(value x)
+{
+	CAMLparam1(x);
+	CAMLreturn(Val_bool(fe_nz((const WORD*)String_val(x))));
+}
+
+CAMLprim value mc_p384_set_one(value x)
+{
+	CAMLparam1(x);
+        fiat_p384_set_one((WORD*)Bytes_val(x));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_inv(value out, value in)
+{
+	CAMLparam2(out, in);
+	inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_point_double(value out, value in)
+{
+	CAMLparam2(out, in);
+	point_double(
+		(WORD*)Bytes_val(Field(out, 0)),
+		(WORD*)Bytes_val(Field(out, 1)),
+		(WORD*)Bytes_val(Field(out, 2)),
+		(const WORD*)String_val(Field(in, 0)),
+		(const WORD*)String_val(Field(in, 1)),
+		(const WORD*)String_val(Field(in, 2))
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_point_add(value out, value p, value q)
+{
+	CAMLparam3(out, p, q);
+	point_add(
+		(WORD*)Bytes_val(Field(out, 0)),
+		(WORD*)Bytes_val(Field(out, 1)),
+		(WORD*)Bytes_val(Field(out, 2)),
+		(const WORD*)String_val(Field(p, 0)),
+		(const WORD*)String_val(Field(p, 1)),
+		(const WORD*)String_val(Field(p, 2)),
+		0,
+		(const WORD*)String_val(Field(q, 0)),
+		(const WORD*)String_val(Field(q, 1)),
+		(const WORD*)String_val(Field(q, 2))
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_select(value out, value bit, value t, value f)
+{
+	CAMLparam4(out, bit, t, f);
+	fe_cmovznz(
+		(WORD*)Bytes_val(out),
+		Bool_val(bit),
+		(const WORD*)String_val(f),
+		(const WORD*)String_val(t)
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p384_scalar_mult_base(value out, value s)
+{
+    CAMLparam2(out, s);
+    scalar_mult_base(
+		(WORD *) Bytes_val(Field(out, 0)),
+		(WORD *) Bytes_val(Field(out, 1)),
+		(WORD *) Bytes_val(Field(out, 2)),
+		_st_uint8(s),
+		caml_string_length(s)
+    );
+    CAMLreturn(Val_unit);
+}
--- a/unikernel/duniverse/mirage-crypto/ec/native/p384_tables_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p384_tables_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p384_tables_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p384_tables_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p521_32.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p521_32.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p521_64.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p521_64.h
--- a/unikernel/duniverse/mirage-crypto/ec/native/p521_stubs.c
+++ b/unikernel/duniverse/mirage-crypto/ec/native/p521_stubs.c
@ -0,0 +1,159 @@
+#include "mirage_crypto.h"
+
+/* Microsoft compiler does not support 128-bit integers. Drop down to
+ * 32-bit for MSVC.
+ */
+#if defined(ARCH_64BIT) && !defined(_MSC_VER)
+#include "p521_64.h"
+#define LIMBS 9
+#define WORD uint64_t
+#define WORDSIZE 64
+#include "p521_tables_64.h"
+#else
+#include "p521_32.h"
+#define LIMBS 17
+#define WORD uint32_t
+#define WORDSIZE 32
+#include "p521_tables_32.h"
+#endif
+
+#define LEN_PRIME 521
+#define CURVE_DESCRIPTION fiat_p521
+
+#include "inversion_template.h"
+#include "point_operations.h"
+
+#include <caml/memory.h>
+
+CAMLprim value mc_p521_sub(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p521_sub((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_add(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p521_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_mul(value out, value a, value b)
+{
+	CAMLparam3(out, a, b);
+	fiat_p521_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_from_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p521_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_to_bytes(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p521_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_sqr(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p521_square((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_from_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p521_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_to_montgomery(value out, value in)
+{
+	CAMLparam2(out, in);
+	fiat_p521_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_nz(value x)
+{
+	CAMLparam1(x);
+	CAMLreturn(Val_bool(fe_nz((const WORD*)String_val(x))));
+}
+
+CAMLprim value mc_p521_set_one(value x)
+{
+	CAMLparam1(x);
+        fiat_p521_set_one((WORD*)Bytes_val(x));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_inv(value out, value in)
+{
+	CAMLparam2(out, in);
+	inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_point_double(value out, value in)
+{
+	CAMLparam2(out, in);
+	point_double(
+		(WORD*)Bytes_val(Field(out, 0)),
+		(WORD*)Bytes_val(Field(out, 1)),
+		(WORD*)Bytes_val(Field(out, 2)),
+		(const WORD*)String_val(Field(in, 0)),
+		(const WORD*)String_val(Field(in, 1)),
+		(const WORD*)String_val(Field(in, 2))
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_point_add(value out, value p, value q)
+{
+	CAMLparam3(out, p, q);
+	point_add(
+		(WORD*)Bytes_val(Field(out, 0)),
+		(WORD*)Bytes_val(Field(out, 1)),
+		(WORD*)Bytes_val(Field(out, 2)),
+		(const WORD*)String_val(Field(p, 0)),
+		(const WORD*)String_val(Field(p, 1)),
+		(const WORD*)String_val(Field(p, 2)),
+		0,
+		(const WORD*)String_val(Field(q, 0)),
+		(const WORD*)String_val(Field(q, 1)),
+		(const WORD*)String_val(Field(q, 2))
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_select(value out, value bit, value t, value f)
+{
+	CAMLparam4(out, bit, t, f);
+	fe_cmovznz(
+		(WORD*)Bytes_val(out),
+		Bool_val(bit),
+		(const WORD*)String_val(f),
+		(const WORD*)String_val(t)
+	);
+	CAMLreturn(Val_unit);
+}
+
+CAMLprim value mc_p521_scalar_mult_base(value out, value s)
+{
+    CAMLparam2(out, s);
+    scalar_mult_base(
+		(WORD *) Bytes_val(Field(out, 0)),
+		(WORD *) Bytes_val(Field(out, 1)),
+		(WORD *) Bytes_val(Field(out, 2)),
+		_st_uint8(s),
+		caml_string_length(s)
+    );
+    CAMLreturn(Val_unit);
+}
--- a/unikernel/duniverse/mirage-crypto/ec/native/point_operations.h
+++ b/unikernel/duniverse/mirage-crypto/ec/native/point_operations.h
@ -0,0 +1,263 @@
+#define MAKE_FN_NAME1(x,y) x ## y
+#define MAKE_FN_NAME(x,y) MAKE_FN_NAME1(x,y)
+
+#define fe_one MAKE_FN_NAME(CURVE_DESCRIPTION,_set_one)
+
+#define fe_add MAKE_FN_NAME(CURVE_DESCRIPTION,_add)
+#define fe_sub MAKE_FN_NAME(CURVE_DESCRIPTION,_sub)
+
+#define fe_mul MAKE_FN_NAME(CURVE_DESCRIPTION,_mul)
+#define fe_sqr MAKE_FN_NAME(CURVE_DESCRIPTION,_square)
+
+#define fe_nonzero MAKE_FN_NAME(CURVE_DESCRIPTION,_nonzero)
+#define fe_selectznz MAKE_FN_NAME(CURVE_DESCRIPTION,_selectznz)
+
+#define fe_from_bytes MAKE_FN_NAME(CURVE_DESCRIPTION,_from_bytes)
+#define fe_to_mont MAKE_FN_NAME(CURVE_DESCRIPTION,_to_montgomery)
+
+typedef WORD fe[LIMBS];
+
+static WORD fe_nz(const WORD in1[LIMBS]) {
+  WORD ret;
+  fe_nonzero(&ret, in1);
+  return ret;
+}
+
+static void fe_copy(WORD out[LIMBS], const WORD in1[LIMBS]) {
+  for (int i = 0; i < LIMBS; i++) {
+    out[i] = in1[i];
+  }
+}
+
+static void fe_cmovznz(WORD out[LIMBS], WORD t, const WORD z[LIMBS],
+                       const WORD nz[LIMBS]) {
+  fe_selectznz(out, !!t, z, nz);
+}
+
+// Group operations
+// ----------------
+//
+// Building on top of the field operations we have the operations on the
+// elliptic curve group itself. Points on the curve are represented in Jacobian
+// coordinates.
+//
+// Both operations were transcribed to Coq and proven to correspond to naive
+// implementations using Affine coordinates, for all suitable fields.  In the
+// Coq proofs, issues of constant-time execution and memory layout (aliasing)
+// conventions were not considered. Specification of affine coordinates:
+// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Spec/WeierstrassCurve.v#L28>
+// As a sanity check, a proof that these points form a commutative group:
+// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/AffineProofs.v#L33>
+
+// point_double calculates 2*(x_in, y_in, z_in)
+//
+// The method is taken from:
+//   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
+//
+// Coq transcription and correctness proof:
+// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L93>
+// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L201>
+//
+// Outputs can equal corresponding inputs, i.e., x_out == x_in is allowed.
+// while x_out == y_in is not (maybe this works, but it's not tested).
+static void point_double(fe x_out, fe y_out, fe z_out,
+                         const fe x_in, const fe y_in, const fe z_in) {
+  fe delta, gamma, beta, ftmp, ftmp2, tmptmp, alpha, fourbeta;
+  // delta = z^2
+  fe_sqr(delta, z_in);
+  // gamma = y^2
+  fe_sqr(gamma, y_in);
+  // beta = x*gamma
+  fe_mul(beta, x_in, gamma);
+
+  // alpha = 3*(x-delta)*(x+delta)
+  fe_sub(ftmp, x_in, delta);
+  fe_add(ftmp2, x_in, delta);
+
+  fe_add(tmptmp, ftmp2, ftmp2);
+  fe_add(ftmp2, ftmp2, tmptmp);
+  fe_mul(alpha, ftmp, ftmp2);
+
+  // x' = alpha^2 - 8*beta
+  fe_sqr(x_out, alpha);
+  fe_add(fourbeta, beta, beta);
+  fe_add(fourbeta, fourbeta, fourbeta);
+  fe_add(tmptmp, fourbeta, fourbeta);
+  fe_sub(x_out, x_out, tmptmp);
+
+  // z' = (y + z)^2 - gamma - delta
+  fe_add(delta, gamma, delta);
+  fe_add(ftmp, y_in, z_in);
+  fe_sqr(z_out, ftmp);
+  fe_sub(z_out, z_out, delta);
+
+  // y' = alpha*(4*beta - x') - 8*gamma^2
+  fe_sub(y_out, fourbeta, x_out);
+  fe_add(gamma, gamma, gamma);
+  fe_sqr(gamma, gamma);
+  fe_mul(y_out, alpha, y_out);
+  fe_add(gamma, gamma, gamma);
+  fe_sub(y_out, y_out, gamma);
+}
+
+// point_add calculates (x1, y1, z1) + (x2, y2, z2)
+//
+// The method is taken from:
+//   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl,
+// adapted for mixed addition (z2 = 1, or z2 = 0 for the point at infinity).
+//
+// Coq transcription and correctness proof:
+// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L135>
+// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L205>
+//
+// This function includes a branch for checking whether the two input points
+// are equal, (while not equal to the point at infinity). This case never
+// happens during single point multiplication, so there is no timing leak for
+// ECDH or ECDSA signing.
+static void point_add(fe x3, fe y3, fe z3, const fe x1,
+                      const fe y1, const fe z1, const int mixed,
+                      const fe x2, const fe y2, const fe z2) {
+  fe x_out, y_out, z_out;
+  WORD z1nz = fe_nz(z1);
+  WORD z2nz = fe_nz(z2);
+
+  // z1z1 = z1z1 = z1**2
+  fe z1z1; fe_sqr(z1z1, z1);
+
+  fe u1, s1, two_z1z2;
+  if (!mixed) {
+    // z2z2 = z2**2
+    fe z2z2; fe_sqr(z2z2, z2);
+
+    // u1 = x1*z2z2
+    fe_mul(u1, x1, z2z2);
+
+    // two_z1z2 = (z1 + z2)**2 - (z1z1 + z2z2) = 2z1z2
+    fe_add(two_z1z2, z1, z2);
+    fe_sqr(two_z1z2, two_z1z2);
+    fe_sub(two_z1z2, two_z1z2, z1z1);
+    fe_sub(two_z1z2, two_z1z2, z2z2);
+
+    // s1 = y1 * z2**3
+    fe_mul(s1, z2, z2z2);
+    fe_mul(s1, s1, y1);
+  } else {
+    // We'll assume z2 = 1 (special case z2 = 0 is handled later).
+
+    // u1 = x1*z2z2
+    fe_copy(u1, x1);
+    // two_z1z2 = 2z1z2
+    fe_add(two_z1z2, z1, z1);
+    // s1 = y1 * z2**3
+    fe_copy(s1, y1);
+  }
+
+  // u2 = x2*z1z1
+  fe u2; fe_mul(u2, x2, z1z1);
+
+  // h = u2 - u1
+  fe h; fe_sub(h, u2, u1);
+
+  WORD xneq = fe_nz(h);
+
+  // z_out = two_z1z2 * h
+  fe_mul(z_out, h, two_z1z2);
+
+  // z1z1z1 = z1 * z1z1
+  fe z1z1z1; fe_mul(z1z1z1, z1, z1z1);
+
+  // s2 = y2 * z1**3
+  fe s2; fe_mul(s2, y2, z1z1z1);
+
+  // r = (s2 - s1)*2
+  fe r;
+  fe_sub(r, s2, s1);
+  fe_add(r, r, r);
+
+  WORD yneq = fe_nz(r);
+
+  if (!xneq && !yneq && z1nz && z2nz) {
+    point_double(x3, y3, z3, x1, y1, z1);
+    return;
+  }
+
+  // I = (2h)**2
+  fe i;
+  fe_add(i, h, h);
+  fe_sqr(i, i);
+
+  // J = h * I
+  fe j; fe_mul(j, h, i);
+
+  // V = U1 * I
+  fe v; fe_mul(v, u1, i);
+
+  // x_out = r**2 - J - 2V
+  fe_sqr(x_out, r);
+  fe_sub(x_out, x_out, j);
+  fe_sub(x_out, x_out, v);
+  fe_sub(x_out, x_out, v);
+
+  // y_out = r(V-x_out) - 2 * s1 * J
+  fe_sub(y_out, v, x_out);
+  fe_mul(y_out, y_out, r);
+  fe s1j;
+  fe_mul(s1j, s1, j);
+  fe_sub(y_out, y_out, s1j);
+  fe_sub(y_out, y_out, s1j);
+
+  fe_cmovznz(x_out, z1nz, x2, x_out);
+  fe_cmovznz(x3, z2nz, x1, x_out);
+  fe_cmovznz(y_out, z1nz, y2, y_out);
+  fe_cmovznz(y3, z2nz, y1, y_out);
+  fe_cmovznz(z_out, z1nz, z2, z_out);
+  fe_cmovznz(z3, z2nz, z1, z_out);
+}
+
+/* Use a sliding window optimization method for scalar multiplication
+     Hard-coded window size = 4
+     Implementation inspired from Go's crypto library
+     https://github.com/golang/go/blob/a5cd894318677359f6d07ee74f9004d28b4d164c/src/crypto/internal/nistec/p256.go#L317
+  */
+
+/* Select the n-th element of the table
+   without leaking information about [n] */
+static void table_select(fe out_x, fe out_y, fe out_z, size_t index, uint8_t n) {
+    fe x, y, z = {0};
+    fe_one(x); fe_one(y);
+    for(uint8_t i = 1 ; i < 16 ; ++i) {
+        WORD cond = i ^ n;
+        fe_cmovznz(x, cond, generator_table[index][n - 1][0], x);
+        fe_cmovznz(y, cond, generator_table[index][n - 1][1], y);
+        fe_cmovznz(z, cond, generator_table[index][n - 1][2], z);
+    }
+    fe_copy(out_x, x);
+    fe_copy(out_y, y);
+    fe_copy(out_z, z);
+}
+
+/* Returns [kG] by decomposing [k] in binary form, and adding
+   [2^0G * k_0 + 2^1G * k_1 + ...] in constant time using
+   pre-computed values of 2^iG */
+static void scalar_mult_base(fe x2, fe y2, fe z2,
+                             const uint8_t* scalar, size_t len) {
+    // P = 0
+    fe p_x, p_y, p_z = {0};
+    fe_one(p_x);
+    fe_one(p_y);
+    size_t index = 0;
+    for(size_t i = 0 ; i < len ; ++i) {
+        fe s_x, s_y, s_z;
+        uint8_t window = scalar[i] & 0xf;
+        table_select(s_x, s_y, s_z, index, window);
+        point_add(p_x, p_y, p_z, p_x, p_y, p_z, 0, s_x, s_y, s_z);
+        index++;
+        window = scalar[i] >> 4;
+        table_select(s_x, s_y, s_z, index, window);
+        point_add(p_x, p_y, p_z, p_x, p_y, p_z, 0, s_x, s_y, s_z);
+        index++;
+    }
+    fe_copy(x2, p_x);
+    fe_copy(y2, p_y);
+    fe_copy(z2, p_z);
+}