This commit is contained in:
parent
aa2ff7b2f0
commit
2f3113f55d
11742 changed files with 1223940 additions and 0 deletions
152
unikernel/duniverse/mirage-crypto/ec/native/GNUmakefile
Normal file
152
unikernel/duniverse/mirage-crypto/ec/native/GNUmakefile
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
# This file is part of mirage-crypto-ec, and used to generate C files
|
||||
# As a prerequisite, fiat-crypto (https://github.com/mit-plv/fiat-crypto)
|
||||
# needs to be cloned and "make standalone-ocaml" invoked
|
||||
# The lowest bound of fiat-crypto is git commit
|
||||
# dabaf4b3132e8bb4a3f5fcd8366eec6ac9bb4232 (July 16th 2021)
|
||||
# Generated on FreeBSD 12.2p2 with coq 8.13.1 (OCaml 4.12.0)
|
||||
# with fiat-crypto 2a07751f37af74edeac47b19bd51810bc99b91a1 (May 29th 2022)
|
||||
|
||||
WBW_MONT ?= ../../../fiat-crypto/src/ExtractionOCaml/word_by_word_montgomery --static --use-value-barrier --inline-internal
|
||||
UNSAT_SOLINAS ?= ../../../fiat-crypto/src/ExtractionOCaml/unsaturated_solinas --static --use-value-barrier --inline-internal
|
||||
N_FUNCS=mul add opp from_montgomery to_montgomery one msat divstep_precomp divstep to_bytes from_bytes selectznz
|
||||
|
||||
GEN_TABLE=../../_build/default/ec/gen_tables/gen_tables.exe
|
||||
|
||||
# The NIST curve P-256 (AKA SECP256R1)
|
||||
P256="2^256 - 2^224 + 2^192 + 2^96 - 1"
|
||||
|
||||
.PHONY: p256_64.h
|
||||
p256_64.h:
|
||||
$(WBW_MONT) p256 64 $(P256) > $@
|
||||
|
||||
.PHONY: p256_32.h
|
||||
p256_32.h:
|
||||
$(WBW_MONT) p256 32 $(P256) > $@
|
||||
|
||||
# The group order N of P-256
|
||||
P256N="0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"
|
||||
|
||||
.PHONY: np256_64.h
|
||||
np256_64.h:
|
||||
$(WBW_MONT) np256 64 $(P256N) $(N_FUNCS) > $@
|
||||
|
||||
.PHONY: np256_32.h
|
||||
np256_32.h:
|
||||
$(WBW_MONT) np256 32 $(P256N) $(N_FUNCS) > $@
|
||||
|
||||
.PHONY: p256_tables_64.h
|
||||
p256_tables_64.h:
|
||||
$(GEN_TABLE) p256 64 > $@
|
||||
|
||||
.PHONY: p256_tables_32.h
|
||||
p256_tables_32.h:
|
||||
$(GEN_TABLE) p256 32 > $@
|
||||
|
||||
.PHONY: p256
|
||||
p256: p256_64.h p256_32.h np256_64.h np256_32.h
|
||||
|
||||
p256_tables: p256_tables_64.h p256_tables_32.h
|
||||
|
||||
# The NIST curve P-384 (AKA SECP384R1)
|
||||
P384="2^384 - 2^128 - 2^96 + 2^32 - 1"
|
||||
|
||||
.PHONY: p384_64.h
|
||||
p384_64.h:
|
||||
$(WBW_MONT) p384 64 $(P384) > $@
|
||||
|
||||
.PHONY: p384_32.h
|
||||
p384_32.h:
|
||||
$(WBW_MONT) p384 32 $(P384) > $@
|
||||
|
||||
# The group order N of P-384
|
||||
P384N="0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973"
|
||||
|
||||
.PHONY: np384_64.h
|
||||
np384_64.h:
|
||||
$(WBW_MONT) np384 64 $(P384N) $(N_FUNCS) > $@
|
||||
|
||||
.PHONY: np384_32.h
|
||||
np384_32.h:
|
||||
$(WBW_MONT) np384 32 $(P384N) $(N_FUNCS) > $@
|
||||
|
||||
.PHONY: p384_tables_64.h
|
||||
p384_tables_64.h:
|
||||
$(GEN_TABLE) p384 64 > $@
|
||||
|
||||
.PHONY: p384_tables_32.h
|
||||
p384_tables_32.h:
|
||||
$(GEN_TABLE) p384 32 > $@
|
||||
|
||||
.PHONY: p384
|
||||
p384: p384_64.h p384_32.h np384_64.h np384_32.h
|
||||
|
||||
p384_tables: p384_tables_64.h p384_tables_32.h
|
||||
|
||||
# The NIST curve P-521 (AKA SECP521R1)
|
||||
P521="2^521 - 1"
|
||||
|
||||
.PHONY: p521_64.h
|
||||
p521_64.h:
|
||||
$(WBW_MONT) p521 64 $(P521) > $@
|
||||
|
||||
.PHONY: p521_32.h
|
||||
p521_32.h:
|
||||
$(WBW_MONT) p521 32 $(P521) > $@
|
||||
|
||||
# The group order N of P-521
|
||||
P521N="0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"
|
||||
|
||||
.PHONY: np521_64.h
|
||||
np521_64.h:
|
||||
$(WBW_MONT) np521 64 $(P521N) $(N_FUNCS) > $@
|
||||
|
||||
.PHONY: np521_32.h
|
||||
np521_32.h:
|
||||
$(WBW_MONT) np521 32 $(P521N) $(N_FUNCS) > $@
|
||||
|
||||
.PHONY: p521_tables_64.h
|
||||
p521_tables_64.h:
|
||||
$(GEN_TABLE) p521 64 > $@
|
||||
|
||||
.PHONY: p521_tables_32.h
|
||||
p521_tables_32.h:
|
||||
$(GEN_TABLE) p521 32 > $@
|
||||
|
||||
.PHONY: p521
|
||||
p521: p521_64.h p521_32.h np521_64.h np521_32.h
|
||||
|
||||
p521_tables: p521_tables_64.h p521_tables_32.h
|
||||
|
||||
# 25519
|
||||
25519="2^255 - 19"
|
||||
25519_FUNS=carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes carry_scmul121666
|
||||
|
||||
.PHONY: curve25519_64.h
|
||||
curve25519_64.h:
|
||||
$(UNSAT_SOLINAS) 25519 64 '(auto)' $(25519) $(25519_FUNS) > $@
|
||||
|
||||
.PHONY: curve25519_32.h
|
||||
curve25519_32.h:
|
||||
$(UNSAT_SOLINAS) 25519 32 '(auto)' $(25519) $(25519_FUNS) > $@
|
||||
|
||||
.PHONY: curve25519
|
||||
curve25519: curve25519_64.h curve25519_32.h
|
||||
|
||||
.PHONY: tables
|
||||
tables: p256_tables p384_tables p521_tables
|
||||
|
||||
.PHONY: clean
|
||||
clean:
|
||||
$(RM) p256_32.h p256_64.h np256_32.h np256_64.h
|
||||
$(RM) p384_32.h p384_64.h np384_32.h np384_64.h
|
||||
$(RM) p521_32.h p521_64.h np521_32.h np521_64.h
|
||||
$(RM) curve25519_32.h curve25519_64.h
|
||||
|
||||
.PHONY: clean_tables
|
||||
clean_tables:
|
||||
$(RM) p256_tables_32.h p256_tables_64.h
|
||||
$(RM) p384_tables_32.h p384_tables_64.h
|
||||
$(RM) p521_tables_32.h p521_tables_64.h
|
||||
|
||||
.PHONY: all
|
||||
all: p256 p384 p521 curve25519
|
||||
23
unikernel/duniverse/mirage-crypto/ec/native/README.md
Normal file
23
unikernel/duniverse/mirage-crypto/ec/native/README.md
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Generated code from fiat
|
||||
|
||||
This directory includes several files ("p*.h") that are generated by
|
||||
[fiat](https://github.com/mit-plv/fiat-crypto). The GNUmakefile provides
|
||||
targets to generate these files.
|
||||
|
||||
The file "inversion_template.h" is copied from the fiat-crypto repository
|
||||
at e31a36d5f1b20134e67ccc5339d88f0ff3cb0f86 (inversion-c/inversion_template.c),
|
||||
and has some modifications: the "inversion" function is declared "static",
|
||||
and the convenience function "inversion" is provided.
|
||||
|
||||
The "*_stubs.c" files are handcrafted.
|
||||
|
||||
The "p*_tables_32/64.c" are generated from `../gen_tables` (see each file's
|
||||
header) and contain pre-computed data to speed up scalar multiplication for
|
||||
ECDSA. The 64- and 32-bit tables must be respectively generated from a 64-bit or
|
||||
32-bit build of `gen_tables`.
|
||||
|
||||
# Code from BoringSSL
|
||||
|
||||
The code in "curve25519_tables.h", and large parts of
|
||||
"curve25519_stubs.c" and "point_operations.h" (excluding scalar multiplication)
|
||||
originate from BoringSSL. Minor adjustments have been done manually.
|
||||
1525
unikernel/duniverse/mirage-crypto/ec/native/curve25519_32.h
Normal file
1525
unikernel/duniverse/mirage-crypto/ec/native/curve25519_32.h
Normal file
File diff suppressed because it is too large
Load diff
947
unikernel/duniverse/mirage-crypto/ec/native/curve25519_64.h
Normal file
947
unikernel/duniverse/mirage-crypto/ec/native/curve25519_64.h
Normal file
|
|
@ -0,0 +1,947 @@
|
|||
/* Autogenerated: '../fiat-crypto/src/ExtractionOCaml/unsaturated_solinas' --static --use-value-barrier --inline-internal 25519 64 '(auto)' '2^255 - 19' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes carry_scmul121666 */
|
||||
/* curve description: 25519 */
|
||||
/* machine_wordsize = 64 (from "64") */
|
||||
/* requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, carry_scmul121666 */
|
||||
/* n = 5 (from "(auto)") */
|
||||
/* s-c = 2^255 - [(1, 19)] (from "2^255 - 19") */
|
||||
/* tight_bounds_multiplier = 1 (from "") */
|
||||
/* */
|
||||
/* Computed values: */
|
||||
/* carry_chain = [0, 1, 2, 3, 4, 0, 1] */
|
||||
/* eval z = z[0] + (z[1] << 51) + (z[2] << 102) + (z[3] << 153) + (z[4] << 204) */
|
||||
/* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */
|
||||
/* balance = [0xfffffffffffda, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe] */
|
||||
|
||||
#include <stdint.h>
|
||||
typedef unsigned char fiat_25519_uint1;
|
||||
typedef signed char fiat_25519_int1;
|
||||
#if defined(__GNUC__) || defined(__clang__)
|
||||
# define FIAT_25519_FIAT_EXTENSION __extension__
|
||||
# define FIAT_25519_FIAT_INLINE __inline__
|
||||
#else
|
||||
# define FIAT_25519_FIAT_EXTENSION
|
||||
# define FIAT_25519_FIAT_INLINE
|
||||
#endif
|
||||
|
||||
FIAT_25519_FIAT_EXTENSION typedef signed __int128 fiat_25519_int128;
|
||||
FIAT_25519_FIAT_EXTENSION typedef unsigned __int128 fiat_25519_uint128;
|
||||
|
||||
/* The type fiat_25519_loose_field_element is a field element with loose bounds. */
|
||||
/* Bounds: [[0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */
|
||||
typedef uint64_t fiat_25519_loose_field_element[5];
|
||||
|
||||
/* The type fiat_25519_tight_field_element is a field element with tight bounds. */
|
||||
/* Bounds: [[0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */
|
||||
typedef uint64_t fiat_25519_tight_field_element[5];
|
||||
|
||||
#if (-1 & 3) != 3
|
||||
#error "This code only works on a two's complement system"
|
||||
#endif
|
||||
|
||||
#if !defined(FIAT_25519_NO_ASM) && (defined(__GNUC__) || defined(__clang__))
|
||||
static __inline__ uint64_t fiat_25519_value_barrier_u64(uint64_t a) {
|
||||
__asm__("" : "+r"(a) : /* no inputs */);
|
||||
return a;
|
||||
}
|
||||
#else
|
||||
# define fiat_25519_value_barrier_u64(x) (x)
|
||||
#endif
|
||||
|
||||
|
||||
/*
|
||||
* The function fiat_25519_addcarryx_u51 is an addition with carry.
|
||||
*
|
||||
* Postconditions:
|
||||
* out1 = (arg1 + arg2 + arg3) mod 2^51
|
||||
* out2 = ⌊(arg1 + arg2 + arg3) / 2^51⌋
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [0x0 ~> 0x7ffffffffffff]
|
||||
* arg3: [0x0 ~> 0x7ffffffffffff]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0x7ffffffffffff]
|
||||
* out2: [0x0 ~> 0x1]
|
||||
*/
|
||||
static FIAT_25519_FIAT_INLINE void fiat_25519_addcarryx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
fiat_25519_uint1 x3;
|
||||
x1 = ((arg1 + arg2) + arg3);
|
||||
x2 = (x1 & UINT64_C(0x7ffffffffffff));
|
||||
x3 = (fiat_25519_uint1)(x1 >> 51);
|
||||
*out1 = x2;
|
||||
*out2 = x3;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_subborrowx_u51 is a subtraction with borrow.
|
||||
*
|
||||
* Postconditions:
|
||||
* out1 = (-arg1 + arg2 + -arg3) mod 2^51
|
||||
* out2 = -⌊(-arg1 + arg2 + -arg3) / 2^51⌋
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [0x0 ~> 0x7ffffffffffff]
|
||||
* arg3: [0x0 ~> 0x7ffffffffffff]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0x7ffffffffffff]
|
||||
* out2: [0x0 ~> 0x1]
|
||||
*/
|
||||
static FIAT_25519_FIAT_INLINE void fiat_25519_subborrowx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
|
||||
int64_t x1;
|
||||
fiat_25519_int1 x2;
|
||||
uint64_t x3;
|
||||
x1 = ((int64_t)(arg2 - (int64_t)arg1) - (int64_t)arg3);
|
||||
x2 = (fiat_25519_int1)(x1 >> 51);
|
||||
x3 = (x1 & UINT64_C(0x7ffffffffffff));
|
||||
*out1 = x3;
|
||||
*out2 = (fiat_25519_uint1)(0x0 - x2);
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_cmovznz_u64 is a single-word conditional move.
|
||||
*
|
||||
* Postconditions:
|
||||
* out1 = (if arg1 = 0 then arg2 else arg3)
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [0x0 ~> 0xffffffffffffffff]
|
||||
* arg3: [0x0 ~> 0xffffffffffffffff]
|
||||
* Output Bounds:
|
||||
* out1: [0x0 ~> 0xffffffffffffffff]
|
||||
*/
|
||||
static FIAT_25519_FIAT_INLINE void fiat_25519_cmovznz_u64(uint64_t* out1, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
|
||||
fiat_25519_uint1 x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
x1 = (!(!arg1));
|
||||
x2 = ((fiat_25519_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff));
|
||||
x3 = ((fiat_25519_value_barrier_u64(x2) & arg3) | (fiat_25519_value_barrier_u64((~x2)) & arg2));
|
||||
*out1 = x3;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_carry_mul multiplies two field elements and reduces the result.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = (eval arg1 * eval arg2) mod m
|
||||
*
|
||||
*/
|
||||
static void fiat_25519_carry_mul(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1, const fiat_25519_loose_field_element arg2) {
|
||||
fiat_25519_uint128 x1;
|
||||
fiat_25519_uint128 x2;
|
||||
fiat_25519_uint128 x3;
|
||||
fiat_25519_uint128 x4;
|
||||
fiat_25519_uint128 x5;
|
||||
fiat_25519_uint128 x6;
|
||||
fiat_25519_uint128 x7;
|
||||
fiat_25519_uint128 x8;
|
||||
fiat_25519_uint128 x9;
|
||||
fiat_25519_uint128 x10;
|
||||
fiat_25519_uint128 x11;
|
||||
fiat_25519_uint128 x12;
|
||||
fiat_25519_uint128 x13;
|
||||
fiat_25519_uint128 x14;
|
||||
fiat_25519_uint128 x15;
|
||||
fiat_25519_uint128 x16;
|
||||
fiat_25519_uint128 x17;
|
||||
fiat_25519_uint128 x18;
|
||||
fiat_25519_uint128 x19;
|
||||
fiat_25519_uint128 x20;
|
||||
fiat_25519_uint128 x21;
|
||||
fiat_25519_uint128 x22;
|
||||
fiat_25519_uint128 x23;
|
||||
fiat_25519_uint128 x24;
|
||||
fiat_25519_uint128 x25;
|
||||
fiat_25519_uint128 x26;
|
||||
uint64_t x27;
|
||||
uint64_t x28;
|
||||
fiat_25519_uint128 x29;
|
||||
fiat_25519_uint128 x30;
|
||||
fiat_25519_uint128 x31;
|
||||
fiat_25519_uint128 x32;
|
||||
fiat_25519_uint128 x33;
|
||||
uint64_t x34;
|
||||
uint64_t x35;
|
||||
fiat_25519_uint128 x36;
|
||||
uint64_t x37;
|
||||
uint64_t x38;
|
||||
fiat_25519_uint128 x39;
|
||||
uint64_t x40;
|
||||
uint64_t x41;
|
||||
fiat_25519_uint128 x42;
|
||||
uint64_t x43;
|
||||
uint64_t x44;
|
||||
uint64_t x45;
|
||||
uint64_t x46;
|
||||
uint64_t x47;
|
||||
uint64_t x48;
|
||||
uint64_t x49;
|
||||
fiat_25519_uint1 x50;
|
||||
uint64_t x51;
|
||||
uint64_t x52;
|
||||
x1 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[4]) * UINT8_C(0x13)));
|
||||
x2 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[3]) * UINT8_C(0x13)));
|
||||
x3 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[2]) * UINT8_C(0x13)));
|
||||
x4 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[1]) * UINT8_C(0x13)));
|
||||
x5 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[4]) * UINT8_C(0x13)));
|
||||
x6 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[3]) * UINT8_C(0x13)));
|
||||
x7 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[2]) * UINT8_C(0x13)));
|
||||
x8 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[4]) * UINT8_C(0x13)));
|
||||
x9 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[3]) * UINT8_C(0x13)));
|
||||
x10 = ((fiat_25519_uint128)(arg1[1]) * ((arg2[4]) * UINT8_C(0x13)));
|
||||
x11 = ((fiat_25519_uint128)(arg1[4]) * (arg2[0]));
|
||||
x12 = ((fiat_25519_uint128)(arg1[3]) * (arg2[1]));
|
||||
x13 = ((fiat_25519_uint128)(arg1[3]) * (arg2[0]));
|
||||
x14 = ((fiat_25519_uint128)(arg1[2]) * (arg2[2]));
|
||||
x15 = ((fiat_25519_uint128)(arg1[2]) * (arg2[1]));
|
||||
x16 = ((fiat_25519_uint128)(arg1[2]) * (arg2[0]));
|
||||
x17 = ((fiat_25519_uint128)(arg1[1]) * (arg2[3]));
|
||||
x18 = ((fiat_25519_uint128)(arg1[1]) * (arg2[2]));
|
||||
x19 = ((fiat_25519_uint128)(arg1[1]) * (arg2[1]));
|
||||
x20 = ((fiat_25519_uint128)(arg1[1]) * (arg2[0]));
|
||||
x21 = ((fiat_25519_uint128)(arg1[0]) * (arg2[4]));
|
||||
x22 = ((fiat_25519_uint128)(arg1[0]) * (arg2[3]));
|
||||
x23 = ((fiat_25519_uint128)(arg1[0]) * (arg2[2]));
|
||||
x24 = ((fiat_25519_uint128)(arg1[0]) * (arg2[1]));
|
||||
x25 = ((fiat_25519_uint128)(arg1[0]) * (arg2[0]));
|
||||
x26 = (x25 + (x10 + (x9 + (x7 + x4))));
|
||||
x27 = (uint64_t)(x26 >> 51);
|
||||
x28 = (uint64_t)(x26 & UINT64_C(0x7ffffffffffff));
|
||||
x29 = (x21 + (x17 + (x14 + (x12 + x11))));
|
||||
x30 = (x22 + (x18 + (x15 + (x13 + x1))));
|
||||
x31 = (x23 + (x19 + (x16 + (x5 + x2))));
|
||||
x32 = (x24 + (x20 + (x8 + (x6 + x3))));
|
||||
x33 = (x27 + x32);
|
||||
x34 = (uint64_t)(x33 >> 51);
|
||||
x35 = (uint64_t)(x33 & UINT64_C(0x7ffffffffffff));
|
||||
x36 = (x34 + x31);
|
||||
x37 = (uint64_t)(x36 >> 51);
|
||||
x38 = (uint64_t)(x36 & UINT64_C(0x7ffffffffffff));
|
||||
x39 = (x37 + x30);
|
||||
x40 = (uint64_t)(x39 >> 51);
|
||||
x41 = (uint64_t)(x39 & UINT64_C(0x7ffffffffffff));
|
||||
x42 = (x40 + x29);
|
||||
x43 = (uint64_t)(x42 >> 51);
|
||||
x44 = (uint64_t)(x42 & UINT64_C(0x7ffffffffffff));
|
||||
x45 = (x43 * UINT8_C(0x13));
|
||||
x46 = (x28 + x45);
|
||||
x47 = (x46 >> 51);
|
||||
x48 = (x46 & UINT64_C(0x7ffffffffffff));
|
||||
x49 = (x47 + x35);
|
||||
x50 = (fiat_25519_uint1)(x49 >> 51);
|
||||
x51 = (x49 & UINT64_C(0x7ffffffffffff));
|
||||
x52 = (x50 + x38);
|
||||
out1[0] = x48;
|
||||
out1[1] = x51;
|
||||
out1[2] = x52;
|
||||
out1[3] = x41;
|
||||
out1[4] = x44;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_carry_square squares a field element and reduces the result.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = (eval arg1 * eval arg1) mod m
|
||||
*
|
||||
*/
|
||||
static void fiat_25519_carry_square(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
uint64_t x4;
|
||||
uint64_t x5;
|
||||
uint64_t x6;
|
||||
uint64_t x7;
|
||||
uint64_t x8;
|
||||
fiat_25519_uint128 x9;
|
||||
fiat_25519_uint128 x10;
|
||||
fiat_25519_uint128 x11;
|
||||
fiat_25519_uint128 x12;
|
||||
fiat_25519_uint128 x13;
|
||||
fiat_25519_uint128 x14;
|
||||
fiat_25519_uint128 x15;
|
||||
fiat_25519_uint128 x16;
|
||||
fiat_25519_uint128 x17;
|
||||
fiat_25519_uint128 x18;
|
||||
fiat_25519_uint128 x19;
|
||||
fiat_25519_uint128 x20;
|
||||
fiat_25519_uint128 x21;
|
||||
fiat_25519_uint128 x22;
|
||||
fiat_25519_uint128 x23;
|
||||
fiat_25519_uint128 x24;
|
||||
uint64_t x25;
|
||||
uint64_t x26;
|
||||
fiat_25519_uint128 x27;
|
||||
fiat_25519_uint128 x28;
|
||||
fiat_25519_uint128 x29;
|
||||
fiat_25519_uint128 x30;
|
||||
fiat_25519_uint128 x31;
|
||||
uint64_t x32;
|
||||
uint64_t x33;
|
||||
fiat_25519_uint128 x34;
|
||||
uint64_t x35;
|
||||
uint64_t x36;
|
||||
fiat_25519_uint128 x37;
|
||||
uint64_t x38;
|
||||
uint64_t x39;
|
||||
fiat_25519_uint128 x40;
|
||||
uint64_t x41;
|
||||
uint64_t x42;
|
||||
uint64_t x43;
|
||||
uint64_t x44;
|
||||
uint64_t x45;
|
||||
uint64_t x46;
|
||||
uint64_t x47;
|
||||
fiat_25519_uint1 x48;
|
||||
uint64_t x49;
|
||||
uint64_t x50;
|
||||
x1 = ((arg1[4]) * UINT8_C(0x13));
|
||||
x2 = (x1 * 0x2);
|
||||
x3 = ((arg1[4]) * 0x2);
|
||||
x4 = ((arg1[3]) * UINT8_C(0x13));
|
||||
x5 = (x4 * 0x2);
|
||||
x6 = ((arg1[3]) * 0x2);
|
||||
x7 = ((arg1[2]) * 0x2);
|
||||
x8 = ((arg1[1]) * 0x2);
|
||||
x9 = ((fiat_25519_uint128)(arg1[4]) * x1);
|
||||
x10 = ((fiat_25519_uint128)(arg1[3]) * x2);
|
||||
x11 = ((fiat_25519_uint128)(arg1[3]) * x4);
|
||||
x12 = ((fiat_25519_uint128)(arg1[2]) * x2);
|
||||
x13 = ((fiat_25519_uint128)(arg1[2]) * x5);
|
||||
x14 = ((fiat_25519_uint128)(arg1[2]) * (arg1[2]));
|
||||
x15 = ((fiat_25519_uint128)(arg1[1]) * x2);
|
||||
x16 = ((fiat_25519_uint128)(arg1[1]) * x6);
|
||||
x17 = ((fiat_25519_uint128)(arg1[1]) * x7);
|
||||
x18 = ((fiat_25519_uint128)(arg1[1]) * (arg1[1]));
|
||||
x19 = ((fiat_25519_uint128)(arg1[0]) * x3);
|
||||
x20 = ((fiat_25519_uint128)(arg1[0]) * x6);
|
||||
x21 = ((fiat_25519_uint128)(arg1[0]) * x7);
|
||||
x22 = ((fiat_25519_uint128)(arg1[0]) * x8);
|
||||
x23 = ((fiat_25519_uint128)(arg1[0]) * (arg1[0]));
|
||||
x24 = (x23 + (x15 + x13));
|
||||
x25 = (uint64_t)(x24 >> 51);
|
||||
x26 = (uint64_t)(x24 & UINT64_C(0x7ffffffffffff));
|
||||
x27 = (x19 + (x16 + x14));
|
||||
x28 = (x20 + (x17 + x9));
|
||||
x29 = (x21 + (x18 + x10));
|
||||
x30 = (x22 + (x12 + x11));
|
||||
x31 = (x25 + x30);
|
||||
x32 = (uint64_t)(x31 >> 51);
|
||||
x33 = (uint64_t)(x31 & UINT64_C(0x7ffffffffffff));
|
||||
x34 = (x32 + x29);
|
||||
x35 = (uint64_t)(x34 >> 51);
|
||||
x36 = (uint64_t)(x34 & UINT64_C(0x7ffffffffffff));
|
||||
x37 = (x35 + x28);
|
||||
x38 = (uint64_t)(x37 >> 51);
|
||||
x39 = (uint64_t)(x37 & UINT64_C(0x7ffffffffffff));
|
||||
x40 = (x38 + x27);
|
||||
x41 = (uint64_t)(x40 >> 51);
|
||||
x42 = (uint64_t)(x40 & UINT64_C(0x7ffffffffffff));
|
||||
x43 = (x41 * UINT8_C(0x13));
|
||||
x44 = (x26 + x43);
|
||||
x45 = (x44 >> 51);
|
||||
x46 = (x44 & UINT64_C(0x7ffffffffffff));
|
||||
x47 = (x45 + x33);
|
||||
x48 = (fiat_25519_uint1)(x47 >> 51);
|
||||
x49 = (x47 & UINT64_C(0x7ffffffffffff));
|
||||
x50 = (x48 + x36);
|
||||
out1[0] = x46;
|
||||
out1[1] = x49;
|
||||
out1[2] = x50;
|
||||
out1[3] = x39;
|
||||
out1[4] = x42;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_carry reduces a field element.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = eval arg1 mod m
|
||||
*
|
||||
*/
|
||||
static void fiat_25519_carry(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
uint64_t x4;
|
||||
uint64_t x5;
|
||||
uint64_t x6;
|
||||
uint64_t x7;
|
||||
uint64_t x8;
|
||||
uint64_t x9;
|
||||
uint64_t x10;
|
||||
uint64_t x11;
|
||||
uint64_t x12;
|
||||
x1 = (arg1[0]);
|
||||
x2 = ((x1 >> 51) + (arg1[1]));
|
||||
x3 = ((x2 >> 51) + (arg1[2]));
|
||||
x4 = ((x3 >> 51) + (arg1[3]));
|
||||
x5 = ((x4 >> 51) + (arg1[4]));
|
||||
x6 = ((x1 & UINT64_C(0x7ffffffffffff)) + ((x5 >> 51) * UINT8_C(0x13)));
|
||||
x7 = ((fiat_25519_uint1)(x6 >> 51) + (x2 & UINT64_C(0x7ffffffffffff)));
|
||||
x8 = (x6 & UINT64_C(0x7ffffffffffff));
|
||||
x9 = (x7 & UINT64_C(0x7ffffffffffff));
|
||||
x10 = ((fiat_25519_uint1)(x7 >> 51) + (x3 & UINT64_C(0x7ffffffffffff)));
|
||||
x11 = (x4 & UINT64_C(0x7ffffffffffff));
|
||||
x12 = (x5 & UINT64_C(0x7ffffffffffff));
|
||||
out1[0] = x8;
|
||||
out1[1] = x9;
|
||||
out1[2] = x10;
|
||||
out1[3] = x11;
|
||||
out1[4] = x12;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_add adds two field elements.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = (eval arg1 + eval arg2) mod m
|
||||
*
|
||||
*/
|
||||
static void fiat_25519_add(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
uint64_t x4;
|
||||
uint64_t x5;
|
||||
x1 = ((arg1[0]) + (arg2[0]));
|
||||
x2 = ((arg1[1]) + (arg2[1]));
|
||||
x3 = ((arg1[2]) + (arg2[2]));
|
||||
x4 = ((arg1[3]) + (arg2[3]));
|
||||
x5 = ((arg1[4]) + (arg2[4]));
|
||||
out1[0] = x1;
|
||||
out1[1] = x2;
|
||||
out1[2] = x3;
|
||||
out1[3] = x4;
|
||||
out1[4] = x5;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_sub subtracts two field elements.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = (eval arg1 - eval arg2) mod m
|
||||
*
|
||||
*/
|
||||
static void fiat_25519_sub(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
uint64_t x4;
|
||||
uint64_t x5;
|
||||
x1 = ((UINT64_C(0xfffffffffffda) + (arg1[0])) - (arg2[0]));
|
||||
x2 = ((UINT64_C(0xffffffffffffe) + (arg1[1])) - (arg2[1]));
|
||||
x3 = ((UINT64_C(0xffffffffffffe) + (arg1[2])) - (arg2[2]));
|
||||
x4 = ((UINT64_C(0xffffffffffffe) + (arg1[3])) - (arg2[3]));
|
||||
x5 = ((UINT64_C(0xffffffffffffe) + (arg1[4])) - (arg2[4]));
|
||||
out1[0] = x1;
|
||||
out1[1] = x2;
|
||||
out1[2] = x3;
|
||||
out1[3] = x4;
|
||||
out1[4] = x5;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_opp negates a field element.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = -eval arg1 mod m
|
||||
*
|
||||
*/
|
||||
static void fiat_25519_opp(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
uint64_t x4;
|
||||
uint64_t x5;
|
||||
x1 = (UINT64_C(0xfffffffffffda) - (arg1[0]));
|
||||
x2 = (UINT64_C(0xffffffffffffe) - (arg1[1]));
|
||||
x3 = (UINT64_C(0xffffffffffffe) - (arg1[2]));
|
||||
x4 = (UINT64_C(0xffffffffffffe) - (arg1[3]));
|
||||
x5 = (UINT64_C(0xffffffffffffe) - (arg1[4]));
|
||||
out1[0] = x1;
|
||||
out1[1] = x2;
|
||||
out1[2] = x3;
|
||||
out1[3] = x4;
|
||||
out1[4] = x5;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_selectznz is a multi-limb conditional select.
|
||||
*
|
||||
* Postconditions:
|
||||
* out1 = (if arg1 = 0 then arg2 else arg3)
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [0x0 ~> 0x1]
|
||||
* arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
|
||||
*/
|
||||
static void fiat_25519_selectznz(uint64_t out1[5], fiat_25519_uint1 arg1, const uint64_t arg2[5], const uint64_t arg3[5]) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
uint64_t x4;
|
||||
uint64_t x5;
|
||||
fiat_25519_cmovznz_u64(&x1, arg1, (arg2[0]), (arg3[0]));
|
||||
fiat_25519_cmovznz_u64(&x2, arg1, (arg2[1]), (arg3[1]));
|
||||
fiat_25519_cmovznz_u64(&x3, arg1, (arg2[2]), (arg3[2]));
|
||||
fiat_25519_cmovznz_u64(&x4, arg1, (arg2[3]), (arg3[3]));
|
||||
fiat_25519_cmovznz_u64(&x5, arg1, (arg2[4]), (arg3[4]));
|
||||
out1[0] = x1;
|
||||
out1[1] = x2;
|
||||
out1[2] = x3;
|
||||
out1[3] = x4;
|
||||
out1[4] = x5;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order.
|
||||
*
|
||||
* Postconditions:
|
||||
* out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
|
||||
*
|
||||
* Output Bounds:
|
||||
* out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]]
|
||||
*/
|
||||
static void fiat_25519_to_bytes(uint8_t out1[32], const fiat_25519_tight_field_element arg1) {
|
||||
uint64_t x1;
|
||||
fiat_25519_uint1 x2;
|
||||
uint64_t x3;
|
||||
fiat_25519_uint1 x4;
|
||||
uint64_t x5;
|
||||
fiat_25519_uint1 x6;
|
||||
uint64_t x7;
|
||||
fiat_25519_uint1 x8;
|
||||
uint64_t x9;
|
||||
fiat_25519_uint1 x10;
|
||||
uint64_t x11;
|
||||
uint64_t x12;
|
||||
fiat_25519_uint1 x13;
|
||||
uint64_t x14;
|
||||
fiat_25519_uint1 x15;
|
||||
uint64_t x16;
|
||||
fiat_25519_uint1 x17;
|
||||
uint64_t x18;
|
||||
fiat_25519_uint1 x19;
|
||||
uint64_t x20;
|
||||
fiat_25519_uint1 x21;
|
||||
uint64_t x22;
|
||||
uint64_t x23;
|
||||
uint64_t x24;
|
||||
uint64_t x25;
|
||||
uint8_t x26;
|
||||
uint64_t x27;
|
||||
uint8_t x28;
|
||||
uint64_t x29;
|
||||
uint8_t x30;
|
||||
uint64_t x31;
|
||||
uint8_t x32;
|
||||
uint64_t x33;
|
||||
uint8_t x34;
|
||||
uint64_t x35;
|
||||
uint8_t x36;
|
||||
uint8_t x37;
|
||||
uint64_t x38;
|
||||
uint8_t x39;
|
||||
uint64_t x40;
|
||||
uint8_t x41;
|
||||
uint64_t x42;
|
||||
uint8_t x43;
|
||||
uint64_t x44;
|
||||
uint8_t x45;
|
||||
uint64_t x46;
|
||||
uint8_t x47;
|
||||
uint64_t x48;
|
||||
uint8_t x49;
|
||||
uint8_t x50;
|
||||
uint64_t x51;
|
||||
uint8_t x52;
|
||||
uint64_t x53;
|
||||
uint8_t x54;
|
||||
uint64_t x55;
|
||||
uint8_t x56;
|
||||
uint64_t x57;
|
||||
uint8_t x58;
|
||||
uint64_t x59;
|
||||
uint8_t x60;
|
||||
uint64_t x61;
|
||||
uint8_t x62;
|
||||
uint64_t x63;
|
||||
uint8_t x64;
|
||||
fiat_25519_uint1 x65;
|
||||
uint64_t x66;
|
||||
uint8_t x67;
|
||||
uint64_t x68;
|
||||
uint8_t x69;
|
||||
uint64_t x70;
|
||||
uint8_t x71;
|
||||
uint64_t x72;
|
||||
uint8_t x73;
|
||||
uint64_t x74;
|
||||
uint8_t x75;
|
||||
uint64_t x76;
|
||||
uint8_t x77;
|
||||
uint8_t x78;
|
||||
uint64_t x79;
|
||||
uint8_t x80;
|
||||
uint64_t x81;
|
||||
uint8_t x82;
|
||||
uint64_t x83;
|
||||
uint8_t x84;
|
||||
uint64_t x85;
|
||||
uint8_t x86;
|
||||
uint64_t x87;
|
||||
uint8_t x88;
|
||||
uint64_t x89;
|
||||
uint8_t x90;
|
||||
uint8_t x91;
|
||||
fiat_25519_subborrowx_u51(&x1, &x2, 0x0, (arg1[0]), UINT64_C(0x7ffffffffffed));
|
||||
fiat_25519_subborrowx_u51(&x3, &x4, x2, (arg1[1]), UINT64_C(0x7ffffffffffff));
|
||||
fiat_25519_subborrowx_u51(&x5, &x6, x4, (arg1[2]), UINT64_C(0x7ffffffffffff));
|
||||
fiat_25519_subborrowx_u51(&x7, &x8, x6, (arg1[3]), UINT64_C(0x7ffffffffffff));
|
||||
fiat_25519_subborrowx_u51(&x9, &x10, x8, (arg1[4]), UINT64_C(0x7ffffffffffff));
|
||||
fiat_25519_cmovznz_u64(&x11, x10, 0x0, UINT64_C(0xffffffffffffffff));
|
||||
fiat_25519_addcarryx_u51(&x12, &x13, 0x0, x1, (x11 & UINT64_C(0x7ffffffffffed)));
|
||||
fiat_25519_addcarryx_u51(&x14, &x15, x13, x3, (x11 & UINT64_C(0x7ffffffffffff)));
|
||||
fiat_25519_addcarryx_u51(&x16, &x17, x15, x5, (x11 & UINT64_C(0x7ffffffffffff)));
|
||||
fiat_25519_addcarryx_u51(&x18, &x19, x17, x7, (x11 & UINT64_C(0x7ffffffffffff)));
|
||||
fiat_25519_addcarryx_u51(&x20, &x21, x19, x9, (x11 & UINT64_C(0x7ffffffffffff)));
|
||||
x22 = (x20 << 4);
|
||||
x23 = (x18 * (uint64_t)0x2);
|
||||
x24 = (x16 << 6);
|
||||
x25 = (x14 << 3);
|
||||
x26 = (uint8_t)(x12 & UINT8_C(0xff));
|
||||
x27 = (x12 >> 8);
|
||||
x28 = (uint8_t)(x27 & UINT8_C(0xff));
|
||||
x29 = (x27 >> 8);
|
||||
x30 = (uint8_t)(x29 & UINT8_C(0xff));
|
||||
x31 = (x29 >> 8);
|
||||
x32 = (uint8_t)(x31 & UINT8_C(0xff));
|
||||
x33 = (x31 >> 8);
|
||||
x34 = (uint8_t)(x33 & UINT8_C(0xff));
|
||||
x35 = (x33 >> 8);
|
||||
x36 = (uint8_t)(x35 & UINT8_C(0xff));
|
||||
x37 = (uint8_t)(x35 >> 8);
|
||||
x38 = (x25 + (uint64_t)x37);
|
||||
x39 = (uint8_t)(x38 & UINT8_C(0xff));
|
||||
x40 = (x38 >> 8);
|
||||
x41 = (uint8_t)(x40 & UINT8_C(0xff));
|
||||
x42 = (x40 >> 8);
|
||||
x43 = (uint8_t)(x42 & UINT8_C(0xff));
|
||||
x44 = (x42 >> 8);
|
||||
x45 = (uint8_t)(x44 & UINT8_C(0xff));
|
||||
x46 = (x44 >> 8);
|
||||
x47 = (uint8_t)(x46 & UINT8_C(0xff));
|
||||
x48 = (x46 >> 8);
|
||||
x49 = (uint8_t)(x48 & UINT8_C(0xff));
|
||||
x50 = (uint8_t)(x48 >> 8);
|
||||
x51 = (x24 + (uint64_t)x50);
|
||||
x52 = (uint8_t)(x51 & UINT8_C(0xff));
|
||||
x53 = (x51 >> 8);
|
||||
x54 = (uint8_t)(x53 & UINT8_C(0xff));
|
||||
x55 = (x53 >> 8);
|
||||
x56 = (uint8_t)(x55 & UINT8_C(0xff));
|
||||
x57 = (x55 >> 8);
|
||||
x58 = (uint8_t)(x57 & UINT8_C(0xff));
|
||||
x59 = (x57 >> 8);
|
||||
x60 = (uint8_t)(x59 & UINT8_C(0xff));
|
||||
x61 = (x59 >> 8);
|
||||
x62 = (uint8_t)(x61 & UINT8_C(0xff));
|
||||
x63 = (x61 >> 8);
|
||||
x64 = (uint8_t)(x63 & UINT8_C(0xff));
|
||||
x65 = (fiat_25519_uint1)(x63 >> 8);
|
||||
x66 = (x23 + (uint64_t)x65);
|
||||
x67 = (uint8_t)(x66 & UINT8_C(0xff));
|
||||
x68 = (x66 >> 8);
|
||||
x69 = (uint8_t)(x68 & UINT8_C(0xff));
|
||||
x70 = (x68 >> 8);
|
||||
x71 = (uint8_t)(x70 & UINT8_C(0xff));
|
||||
x72 = (x70 >> 8);
|
||||
x73 = (uint8_t)(x72 & UINT8_C(0xff));
|
||||
x74 = (x72 >> 8);
|
||||
x75 = (uint8_t)(x74 & UINT8_C(0xff));
|
||||
x76 = (x74 >> 8);
|
||||
x77 = (uint8_t)(x76 & UINT8_C(0xff));
|
||||
x78 = (uint8_t)(x76 >> 8);
|
||||
x79 = (x22 + (uint64_t)x78);
|
||||
x80 = (uint8_t)(x79 & UINT8_C(0xff));
|
||||
x81 = (x79 >> 8);
|
||||
x82 = (uint8_t)(x81 & UINT8_C(0xff));
|
||||
x83 = (x81 >> 8);
|
||||
x84 = (uint8_t)(x83 & UINT8_C(0xff));
|
||||
x85 = (x83 >> 8);
|
||||
x86 = (uint8_t)(x85 & UINT8_C(0xff));
|
||||
x87 = (x85 >> 8);
|
||||
x88 = (uint8_t)(x87 & UINT8_C(0xff));
|
||||
x89 = (x87 >> 8);
|
||||
x90 = (uint8_t)(x89 & UINT8_C(0xff));
|
||||
x91 = (uint8_t)(x89 >> 8);
|
||||
out1[0] = x26;
|
||||
out1[1] = x28;
|
||||
out1[2] = x30;
|
||||
out1[3] = x32;
|
||||
out1[4] = x34;
|
||||
out1[5] = x36;
|
||||
out1[6] = x39;
|
||||
out1[7] = x41;
|
||||
out1[8] = x43;
|
||||
out1[9] = x45;
|
||||
out1[10] = x47;
|
||||
out1[11] = x49;
|
||||
out1[12] = x52;
|
||||
out1[13] = x54;
|
||||
out1[14] = x56;
|
||||
out1[15] = x58;
|
||||
out1[16] = x60;
|
||||
out1[17] = x62;
|
||||
out1[18] = x64;
|
||||
out1[19] = x67;
|
||||
out1[20] = x69;
|
||||
out1[21] = x71;
|
||||
out1[22] = x73;
|
||||
out1[23] = x75;
|
||||
out1[24] = x77;
|
||||
out1[25] = x80;
|
||||
out1[26] = x82;
|
||||
out1[27] = x84;
|
||||
out1[28] = x86;
|
||||
out1[29] = x88;
|
||||
out1[30] = x90;
|
||||
out1[31] = x91;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_from_bytes deserializes a field element from bytes in little-endian order.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = bytes_eval arg1 mod m
|
||||
*
|
||||
* Input Bounds:
|
||||
* arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]]
|
||||
*/
|
||||
static void fiat_25519_from_bytes(fiat_25519_tight_field_element out1, const uint8_t arg1[32]) {
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
uint64_t x4;
|
||||
uint64_t x5;
|
||||
uint64_t x6;
|
||||
uint64_t x7;
|
||||
uint64_t x8;
|
||||
uint64_t x9;
|
||||
uint64_t x10;
|
||||
uint64_t x11;
|
||||
uint64_t x12;
|
||||
uint64_t x13;
|
||||
uint64_t x14;
|
||||
uint64_t x15;
|
||||
uint64_t x16;
|
||||
uint64_t x17;
|
||||
uint64_t x18;
|
||||
uint64_t x19;
|
||||
uint64_t x20;
|
||||
uint64_t x21;
|
||||
uint64_t x22;
|
||||
uint64_t x23;
|
||||
uint64_t x24;
|
||||
uint64_t x25;
|
||||
uint64_t x26;
|
||||
uint64_t x27;
|
||||
uint64_t x28;
|
||||
uint64_t x29;
|
||||
uint64_t x30;
|
||||
uint64_t x31;
|
||||
uint8_t x32;
|
||||
uint64_t x33;
|
||||
uint64_t x34;
|
||||
uint64_t x35;
|
||||
uint64_t x36;
|
||||
uint64_t x37;
|
||||
uint64_t x38;
|
||||
uint64_t x39;
|
||||
uint8_t x40;
|
||||
uint64_t x41;
|
||||
uint64_t x42;
|
||||
uint64_t x43;
|
||||
uint64_t x44;
|
||||
uint64_t x45;
|
||||
uint64_t x46;
|
||||
uint64_t x47;
|
||||
uint8_t x48;
|
||||
uint64_t x49;
|
||||
uint64_t x50;
|
||||
uint64_t x51;
|
||||
uint64_t x52;
|
||||
uint64_t x53;
|
||||
uint64_t x54;
|
||||
uint64_t x55;
|
||||
uint64_t x56;
|
||||
uint8_t x57;
|
||||
uint64_t x58;
|
||||
uint64_t x59;
|
||||
uint64_t x60;
|
||||
uint64_t x61;
|
||||
uint64_t x62;
|
||||
uint64_t x63;
|
||||
uint64_t x64;
|
||||
uint8_t x65;
|
||||
uint64_t x66;
|
||||
uint64_t x67;
|
||||
uint64_t x68;
|
||||
uint64_t x69;
|
||||
uint64_t x70;
|
||||
uint64_t x71;
|
||||
x1 = ((uint64_t)(arg1[31]) << 44);
|
||||
x2 = ((uint64_t)(arg1[30]) << 36);
|
||||
x3 = ((uint64_t)(arg1[29]) << 28);
|
||||
x4 = ((uint64_t)(arg1[28]) << 20);
|
||||
x5 = ((uint64_t)(arg1[27]) << 12);
|
||||
x6 = ((uint64_t)(arg1[26]) << 4);
|
||||
x7 = ((uint64_t)(arg1[25]) << 47);
|
||||
x8 = ((uint64_t)(arg1[24]) << 39);
|
||||
x9 = ((uint64_t)(arg1[23]) << 31);
|
||||
x10 = ((uint64_t)(arg1[22]) << 23);
|
||||
x11 = ((uint64_t)(arg1[21]) << 15);
|
||||
x12 = ((uint64_t)(arg1[20]) << 7);
|
||||
x13 = ((uint64_t)(arg1[19]) << 50);
|
||||
x14 = ((uint64_t)(arg1[18]) << 42);
|
||||
x15 = ((uint64_t)(arg1[17]) << 34);
|
||||
x16 = ((uint64_t)(arg1[16]) << 26);
|
||||
x17 = ((uint64_t)(arg1[15]) << 18);
|
||||
x18 = ((uint64_t)(arg1[14]) << 10);
|
||||
x19 = ((uint64_t)(arg1[13]) << 2);
|
||||
x20 = ((uint64_t)(arg1[12]) << 45);
|
||||
x21 = ((uint64_t)(arg1[11]) << 37);
|
||||
x22 = ((uint64_t)(arg1[10]) << 29);
|
||||
x23 = ((uint64_t)(arg1[9]) << 21);
|
||||
x24 = ((uint64_t)(arg1[8]) << 13);
|
||||
x25 = ((uint64_t)(arg1[7]) << 5);
|
||||
x26 = ((uint64_t)(arg1[6]) << 48);
|
||||
x27 = ((uint64_t)(arg1[5]) << 40);
|
||||
x28 = ((uint64_t)(arg1[4]) << 32);
|
||||
x29 = ((uint64_t)(arg1[3]) << 24);
|
||||
x30 = ((uint64_t)(arg1[2]) << 16);
|
||||
x31 = ((uint64_t)(arg1[1]) << 8);
|
||||
x32 = (arg1[0]);
|
||||
x33 = (x31 + (uint64_t)x32);
|
||||
x34 = (x30 + x33);
|
||||
x35 = (x29 + x34);
|
||||
x36 = (x28 + x35);
|
||||
x37 = (x27 + x36);
|
||||
x38 = (x26 + x37);
|
||||
x39 = (x38 & UINT64_C(0x7ffffffffffff));
|
||||
x40 = (uint8_t)(x38 >> 51);
|
||||
x41 = (x25 + (uint64_t)x40);
|
||||
x42 = (x24 + x41);
|
||||
x43 = (x23 + x42);
|
||||
x44 = (x22 + x43);
|
||||
x45 = (x21 + x44);
|
||||
x46 = (x20 + x45);
|
||||
x47 = (x46 & UINT64_C(0x7ffffffffffff));
|
||||
x48 = (uint8_t)(x46 >> 51);
|
||||
x49 = (x19 + (uint64_t)x48);
|
||||
x50 = (x18 + x49);
|
||||
x51 = (x17 + x50);
|
||||
x52 = (x16 + x51);
|
||||
x53 = (x15 + x52);
|
||||
x54 = (x14 + x53);
|
||||
x55 = (x13 + x54);
|
||||
x56 = (x55 & UINT64_C(0x7ffffffffffff));
|
||||
x57 = (uint8_t)(x55 >> 51);
|
||||
x58 = (x12 + (uint64_t)x57);
|
||||
x59 = (x11 + x58);
|
||||
x60 = (x10 + x59);
|
||||
x61 = (x9 + x60);
|
||||
x62 = (x8 + x61);
|
||||
x63 = (x7 + x62);
|
||||
x64 = (x63 & UINT64_C(0x7ffffffffffff));
|
||||
x65 = (uint8_t)(x63 >> 51);
|
||||
x66 = (x6 + (uint64_t)x65);
|
||||
x67 = (x5 + x66);
|
||||
x68 = (x4 + x67);
|
||||
x69 = (x3 + x68);
|
||||
x70 = (x2 + x69);
|
||||
x71 = (x1 + x70);
|
||||
out1[0] = x39;
|
||||
out1[1] = x47;
|
||||
out1[2] = x56;
|
||||
out1[3] = x64;
|
||||
out1[4] = x71;
|
||||
}
|
||||
|
||||
/*
|
||||
* The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result.
|
||||
*
|
||||
* Postconditions:
|
||||
* eval out1 mod m = (121666 * eval arg1) mod m
|
||||
*
|
||||
*/
|
||||
static void fiat_25519_carry_scmul_121666(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) {
|
||||
fiat_25519_uint128 x1;
|
||||
fiat_25519_uint128 x2;
|
||||
fiat_25519_uint128 x3;
|
||||
fiat_25519_uint128 x4;
|
||||
fiat_25519_uint128 x5;
|
||||
uint64_t x6;
|
||||
uint64_t x7;
|
||||
fiat_25519_uint128 x8;
|
||||
uint64_t x9;
|
||||
uint64_t x10;
|
||||
fiat_25519_uint128 x11;
|
||||
uint64_t x12;
|
||||
uint64_t x13;
|
||||
fiat_25519_uint128 x14;
|
||||
uint64_t x15;
|
||||
uint64_t x16;
|
||||
fiat_25519_uint128 x17;
|
||||
uint64_t x18;
|
||||
uint64_t x19;
|
||||
uint64_t x20;
|
||||
uint64_t x21;
|
||||
fiat_25519_uint1 x22;
|
||||
uint64_t x23;
|
||||
uint64_t x24;
|
||||
fiat_25519_uint1 x25;
|
||||
uint64_t x26;
|
||||
uint64_t x27;
|
||||
x1 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[4]));
|
||||
x2 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[3]));
|
||||
x3 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[2]));
|
||||
x4 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[1]));
|
||||
x5 = ((fiat_25519_uint128)UINT32_C(0x1db42) * (arg1[0]));
|
||||
x6 = (uint64_t)(x5 >> 51);
|
||||
x7 = (uint64_t)(x5 & UINT64_C(0x7ffffffffffff));
|
||||
x8 = (x6 + x4);
|
||||
x9 = (uint64_t)(x8 >> 51);
|
||||
x10 = (uint64_t)(x8 & UINT64_C(0x7ffffffffffff));
|
||||
x11 = (x9 + x3);
|
||||
x12 = (uint64_t)(x11 >> 51);
|
||||
x13 = (uint64_t)(x11 & UINT64_C(0x7ffffffffffff));
|
||||
x14 = (x12 + x2);
|
||||
x15 = (uint64_t)(x14 >> 51);
|
||||
x16 = (uint64_t)(x14 & UINT64_C(0x7ffffffffffff));
|
||||
x17 = (x15 + x1);
|
||||
x18 = (uint64_t)(x17 >> 51);
|
||||
x19 = (uint64_t)(x17 & UINT64_C(0x7ffffffffffff));
|
||||
x20 = (x18 * UINT8_C(0x13));
|
||||
x21 = (x7 + x20);
|
||||
x22 = (fiat_25519_uint1)(x21 >> 51);
|
||||
x23 = (x21 & UINT64_C(0x7ffffffffffff));
|
||||
x24 = (x22 + x10);
|
||||
x25 = (fiat_25519_uint1)(x24 >> 51);
|
||||
x26 = (x24 & UINT64_C(0x7ffffffffffff));
|
||||
x27 = (x25 + x13);
|
||||
out1[0] = x23;
|
||||
out1[1] = x26;
|
||||
out1[2] = x27;
|
||||
out1[3] = x16;
|
||||
out1[4] = x19;
|
||||
}
|
||||
1859
unikernel/duniverse/mirage-crypto/ec/native/curve25519_stubs.c
Normal file
1859
unikernel/duniverse/mirage-crypto/ec/native/curve25519_stubs.c
Normal file
File diff suppressed because it is too large
Load diff
375
unikernel/duniverse/mirage-crypto/ec/native/curve25519_tables.h
Normal file
375
unikernel/duniverse/mirage-crypto/ec/native/curve25519_tables.h
Normal file
|
|
@ -0,0 +1,375 @@
|
|||
/* following code is from c47bfce06 of boringssl: crypto/curve25519 */
|
||||
|
||||
/* Copyright (c) 2020, Google Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and/or distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
|
||||
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
|
||||
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
|
||||
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
|
||||
|
||||
// This file is generated from
|
||||
// ./make_curve25519_tables.py > curve25519_tables.h
|
||||
|
||||
static const fe d = {{
|
||||
#if defined(ARCH_64BIT)
|
||||
929955233495203, 466365720129213, 1662059464998953, 2033849074728123,
|
||||
1442794654840575
|
||||
#else
|
||||
56195235, 13857412, 51736253, 6949390, 114729, 24766616, 60832955, 30306712,
|
||||
48412415, 21499315
|
||||
#endif
|
||||
}};
|
||||
|
||||
static const fe sqrtm1 = {{
|
||||
#if defined(ARCH_64BIT)
|
||||
1718705420411056, 234908883556509, 2233514472574048, 2117202627021982,
|
||||
765476049583133
|
||||
#else
|
||||
34513072, 25610706, 9377949, 3500415, 12389472, 33281959, 41962654,
|
||||
31548777, 326685, 11406482
|
||||
#endif
|
||||
}};
|
||||
|
||||
static const fe d2 = {{
|
||||
#if defined(ARCH_64BIT)
|
||||
1859910466990425, 932731440258426, 1072319116312658, 1815898335770999,
|
||||
633789495995903
|
||||
#else
|
||||
45281625, 27714825, 36363642, 13898781, 229458, 15978800, 54557047,
|
||||
27058993, 29715967, 9444199
|
||||
#endif
|
||||
}};
|
||||
|
||||
// This block of code replaces the standard base-point table with a much smaller
|
||||
// one. The standard table is 30,720 bytes while this one is just 960.
|
||||
//
|
||||
// This table contains 15 pairs of group elements, (x, y), where each field
|
||||
// element is serialised with |fe_tobytes|. If |i| is the index of the group
|
||||
// element then consider i+1 as a four-bit number: (i₀, i₁, i₂, i₃) (where i₀
|
||||
// is the most significant bit). The value of the group element is then:
|
||||
// (i₀×2^192 + i₁×2^128 + i₂×2^64 + i₃)G, where G is the generator.
|
||||
static const uint8_t k25519SmallPrecomp[15 * 2 * 32] = {
|
||||
0x1a, 0xd5, 0x25, 0x8f, 0x60, 0x2d, 0x56, 0xc9, 0xb2, 0xa7, 0x25, 0x95,
|
||||
0x60, 0xc7, 0x2c, 0x69, 0x5c, 0xdc, 0xd6, 0xfd, 0x31, 0xe2, 0xa4, 0xc0,
|
||||
0xfe, 0x53, 0x6e, 0xcd, 0xd3, 0x36, 0x69, 0x21, 0x58, 0x66, 0x66, 0x66,
|
||||
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
|
||||
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
|
||||
0x66, 0x66, 0x66, 0x66, 0x02, 0xa2, 0xed, 0xf4, 0x8f, 0x6b, 0x0b, 0x3e,
|
||||
0xeb, 0x35, 0x1a, 0xd5, 0x7e, 0xdb, 0x78, 0x00, 0x96, 0x8a, 0xa0, 0xb4,
|
||||
0xcf, 0x60, 0x4b, 0xd4, 0xd5, 0xf9, 0x2d, 0xbf, 0x88, 0xbd, 0x22, 0x62,
|
||||
0x13, 0x53, 0xe4, 0x82, 0x57, 0xfa, 0x1e, 0x8f, 0x06, 0x2b, 0x90, 0xba,
|
||||
0x08, 0xb6, 0x10, 0x54, 0x4f, 0x7c, 0x1b, 0x26, 0xed, 0xda, 0x6b, 0xdd,
|
||||
0x25, 0xd0, 0x4e, 0xea, 0x42, 0xbb, 0x25, 0x03, 0xa2, 0xfb, 0xcc, 0x61,
|
||||
0x67, 0x06, 0x70, 0x1a, 0xc4, 0x78, 0x3a, 0xff, 0x32, 0x62, 0xdd, 0x2c,
|
||||
0xab, 0x50, 0x19, 0x3b, 0xf2, 0x9b, 0x7d, 0xb8, 0xfd, 0x4f, 0x29, 0x9c,
|
||||
0xa7, 0x91, 0xba, 0x0e, 0x46, 0x5e, 0x51, 0xfe, 0x1d, 0xbf, 0xe5, 0xe5,
|
||||
0x9b, 0x95, 0x0d, 0x67, 0xf8, 0xd1, 0xb5, 0x5a, 0xa1, 0x93, 0x2c, 0xc3,
|
||||
0xde, 0x0e, 0x97, 0x85, 0x2d, 0x7f, 0xea, 0xab, 0x3e, 0x47, 0x30, 0x18,
|
||||
0x24, 0xe8, 0xb7, 0x60, 0xae, 0x47, 0x80, 0xfc, 0xe5, 0x23, 0xe7, 0xc2,
|
||||
0xc9, 0x85, 0xe6, 0x98, 0xa0, 0x29, 0x4e, 0xe1, 0x84, 0x39, 0x2d, 0x95,
|
||||
0x2c, 0xf3, 0x45, 0x3c, 0xff, 0xaf, 0x27, 0x4c, 0x6b, 0xa6, 0xf5, 0x4b,
|
||||
0x11, 0xbd, 0xba, 0x5b, 0x9e, 0xc4, 0xa4, 0x51, 0x1e, 0xbe, 0xd0, 0x90,
|
||||
0x3a, 0x9c, 0xc2, 0x26, 0xb6, 0x1e, 0xf1, 0x95, 0x7d, 0xc8, 0x6d, 0x52,
|
||||
0xe6, 0x99, 0x2c, 0x5f, 0x9a, 0x96, 0x0c, 0x68, 0x29, 0xfd, 0xe2, 0xfb,
|
||||
0xe6, 0xbc, 0xec, 0x31, 0x08, 0xec, 0xe6, 0xb0, 0x53, 0x60, 0xc3, 0x8c,
|
||||
0xbe, 0xc1, 0xb3, 0x8a, 0x8f, 0xe4, 0x88, 0x2b, 0x55, 0xe5, 0x64, 0x6e,
|
||||
0x9b, 0xd0, 0xaf, 0x7b, 0x64, 0x2a, 0x35, 0x25, 0x10, 0x52, 0xc5, 0x9e,
|
||||
0x58, 0x11, 0x39, 0x36, 0x45, 0x51, 0xb8, 0x39, 0x93, 0xfc, 0x9d, 0x6a,
|
||||
0xbe, 0x58, 0xcb, 0xa4, 0x0f, 0x51, 0x3c, 0x38, 0x05, 0xca, 0xab, 0x43,
|
||||
0x63, 0x0e, 0xf3, 0x8b, 0x41, 0xa6, 0xf8, 0x9b, 0x53, 0x70, 0x80, 0x53,
|
||||
0x86, 0x5e, 0x8f, 0xe3, 0xc3, 0x0d, 0x18, 0xc8, 0x4b, 0x34, 0x1f, 0xd8,
|
||||
0x1d, 0xbc, 0xf2, 0x6d, 0x34, 0x3a, 0xbe, 0xdf, 0xd9, 0xf6, 0xf3, 0x89,
|
||||
0xa1, 0xe1, 0x94, 0x9f, 0x5d, 0x4c, 0x5d, 0xe9, 0xa1, 0x49, 0x92, 0xef,
|
||||
0x0e, 0x53, 0x81, 0x89, 0x58, 0x87, 0xa6, 0x37, 0xf1, 0xdd, 0x62, 0x60,
|
||||
0x63, 0x5a, 0x9d, 0x1b, 0x8c, 0xc6, 0x7d, 0x52, 0xea, 0x70, 0x09, 0x6a,
|
||||
0xe1, 0x32, 0xf3, 0x73, 0x21, 0x1f, 0x07, 0x7b, 0x7c, 0x9b, 0x49, 0xd8,
|
||||
0xc0, 0xf3, 0x25, 0x72, 0x6f, 0x9d, 0xed, 0x31, 0x67, 0x36, 0x36, 0x54,
|
||||
0x40, 0x92, 0x71, 0xe6, 0x11, 0x28, 0x11, 0xad, 0x93, 0x32, 0x85, 0x7b,
|
||||
0x3e, 0xb7, 0x3b, 0x49, 0x13, 0x1c, 0x07, 0xb0, 0x2e, 0x93, 0xaa, 0xfd,
|
||||
0xfd, 0x28, 0x47, 0x3d, 0x8d, 0xd2, 0xda, 0xc7, 0x44, 0xd6, 0x7a, 0xdb,
|
||||
0x26, 0x7d, 0x1d, 0xb8, 0xe1, 0xde, 0x9d, 0x7a, 0x7d, 0x17, 0x7e, 0x1c,
|
||||
0x37, 0x04, 0x8d, 0x2d, 0x7c, 0x5e, 0x18, 0x38, 0x1e, 0xaf, 0xc7, 0x1b,
|
||||
0x33, 0x48, 0x31, 0x00, 0x59, 0xf6, 0xf2, 0xca, 0x0f, 0x27, 0x1b, 0x63,
|
||||
0x12, 0x7e, 0x02, 0x1d, 0x49, 0xc0, 0x5d, 0x79, 0x87, 0xef, 0x5e, 0x7a,
|
||||
0x2f, 0x1f, 0x66, 0x55, 0xd8, 0x09, 0xd9, 0x61, 0x38, 0x68, 0xb0, 0x07,
|
||||
0xa3, 0xfc, 0xcc, 0x85, 0x10, 0x7f, 0x4c, 0x65, 0x65, 0xb3, 0xfa, 0xfa,
|
||||
0xa5, 0x53, 0x6f, 0xdb, 0x74, 0x4c, 0x56, 0x46, 0x03, 0xe2, 0xd5, 0x7a,
|
||||
0x29, 0x1c, 0xc6, 0x02, 0xbc, 0x59, 0xf2, 0x04, 0x75, 0x63, 0xc0, 0x84,
|
||||
0x2f, 0x60, 0x1c, 0x67, 0x76, 0xfd, 0x63, 0x86, 0xf3, 0xfa, 0xbf, 0xdc,
|
||||
0xd2, 0x2d, 0x90, 0x91, 0xbd, 0x33, 0xa9, 0xe5, 0x66, 0x0c, 0xda, 0x42,
|
||||
0x27, 0xca, 0xf4, 0x66, 0xc2, 0xec, 0x92, 0x14, 0x57, 0x06, 0x63, 0xd0,
|
||||
0x4d, 0x15, 0x06, 0xeb, 0x69, 0x58, 0x4f, 0x77, 0xc5, 0x8b, 0xc7, 0xf0,
|
||||
0x8e, 0xed, 0x64, 0xa0, 0xb3, 0x3c, 0x66, 0x71, 0xc6, 0x2d, 0xda, 0x0a,
|
||||
0x0d, 0xfe, 0x70, 0x27, 0x64, 0xf8, 0x27, 0xfa, 0xf6, 0x5f, 0x30, 0xa5,
|
||||
0x0d, 0x6c, 0xda, 0xf2, 0x62, 0x5e, 0x78, 0x47, 0xd3, 0x66, 0x00, 0x1c,
|
||||
0xfd, 0x56, 0x1f, 0x5d, 0x3f, 0x6f, 0xf4, 0x4c, 0xd8, 0xfd, 0x0e, 0x27,
|
||||
0xc9, 0x5c, 0x2b, 0xbc, 0xc0, 0xa4, 0xe7, 0x23, 0x29, 0x02, 0x9f, 0x31,
|
||||
0xd6, 0xe9, 0xd7, 0x96, 0xf4, 0xe0, 0x5e, 0x0b, 0x0e, 0x13, 0xee, 0x3c,
|
||||
0x09, 0xed, 0xf2, 0x3d, 0x76, 0x91, 0xc3, 0xa4, 0x97, 0xae, 0xd4, 0x87,
|
||||
0xd0, 0x5d, 0xf6, 0x18, 0x47, 0x1f, 0x1d, 0x67, 0xf2, 0xcf, 0x63, 0xa0,
|
||||
0x91, 0x27, 0xf8, 0x93, 0x45, 0x75, 0x23, 0x3f, 0xd1, 0xf1, 0xad, 0x23,
|
||||
0xdd, 0x64, 0x93, 0x96, 0x41, 0x70, 0x7f, 0xf7, 0xf5, 0xa9, 0x89, 0xa2,
|
||||
0x34, 0xb0, 0x8d, 0x1b, 0xae, 0x19, 0x15, 0x49, 0x58, 0x23, 0x6d, 0x87,
|
||||
0x15, 0x4f, 0x81, 0x76, 0xfb, 0x23, 0xb5, 0xea, 0xcf, 0xac, 0x54, 0x8d,
|
||||
0x4e, 0x42, 0x2f, 0xeb, 0x0f, 0x63, 0xdb, 0x68, 0x37, 0xa8, 0xcf, 0x8b,
|
||||
0xab, 0xf5, 0xa4, 0x6e, 0x96, 0x2a, 0xb2, 0xd6, 0xbe, 0x9e, 0xbd, 0x0d,
|
||||
0xb4, 0x42, 0xa9, 0xcf, 0x01, 0x83, 0x8a, 0x17, 0x47, 0x76, 0xc4, 0xc6,
|
||||
0x83, 0x04, 0x95, 0x0b, 0xfc, 0x11, 0xc9, 0x62, 0xb8, 0x0c, 0x76, 0x84,
|
||||
0xd9, 0xb9, 0x37, 0xfa, 0xfc, 0x7c, 0xc2, 0x6d, 0x58, 0x3e, 0xb3, 0x04,
|
||||
0xbb, 0x8c, 0x8f, 0x48, 0xbc, 0x91, 0x27, 0xcc, 0xf9, 0xb7, 0x22, 0x19,
|
||||
0x83, 0x2e, 0x09, 0xb5, 0x72, 0xd9, 0x54, 0x1c, 0x4d, 0xa1, 0xea, 0x0b,
|
||||
0xf1, 0xc6, 0x08, 0x72, 0x46, 0x87, 0x7a, 0x6e, 0x80, 0x56, 0x0a, 0x8a,
|
||||
0xc0, 0xdd, 0x11, 0x6b, 0xd6, 0xdd, 0x47, 0xdf, 0x10, 0xd9, 0xd8, 0xea,
|
||||
0x7c, 0xb0, 0x8f, 0x03, 0x00, 0x2e, 0xc1, 0x8f, 0x44, 0xa8, 0xd3, 0x30,
|
||||
0x06, 0x89, 0xa2, 0xf9, 0x34, 0xad, 0xdc, 0x03, 0x85, 0xed, 0x51, 0xa7,
|
||||
0x82, 0x9c, 0xe7, 0x5d, 0x52, 0x93, 0x0c, 0x32, 0x9a, 0x5b, 0xe1, 0xaa,
|
||||
0xca, 0xb8, 0x02, 0x6d, 0x3a, 0xd4, 0xb1, 0x3a, 0xf0, 0x5f, 0xbe, 0xb5,
|
||||
0x0d, 0x10, 0x6b, 0x38, 0x32, 0xac, 0x76, 0x80, 0xbd, 0xca, 0x94, 0x71,
|
||||
0x7a, 0xf2, 0xc9, 0x35, 0x2a, 0xde, 0x9f, 0x42, 0x49, 0x18, 0x01, 0xab,
|
||||
0xbc, 0xef, 0x7c, 0x64, 0x3f, 0x58, 0x3d, 0x92, 0x59, 0xdb, 0x13, 0xdb,
|
||||
0x58, 0x6e, 0x0a, 0xe0, 0xb7, 0x91, 0x4a, 0x08, 0x20, 0xd6, 0x2e, 0x3c,
|
||||
0x45, 0xc9, 0x8b, 0x17, 0x79, 0xe7, 0xc7, 0x90, 0x99, 0x3a, 0x18, 0x25,
|
||||
};
|
||||
|
||||
// Bi[i] = (2*i+1)*B
|
||||
static const ge_precomp Bi[8] = {
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1288382639258501, 245678601348599, 269427782077623,
|
||||
1462984067271730, 137412439391563
|
||||
#else
|
||||
25967493, 19198397, 29566455, 3660896, 54414519, 4014786, 27544626,
|
||||
21800161, 61029707, 2047604
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
62697248952638, 204681361388450, 631292143396476, 338455783676468,
|
||||
1213667448819585
|
||||
#else
|
||||
54563134, 934261, 64385954, 3049989, 66381436, 9406985, 12720692,
|
||||
5043384, 19500929, 18085054
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
301289933810280, 1259582250014073, 1422107436869536,
|
||||
796239922652654, 1953934009299142
|
||||
#else
|
||||
58370664, 4489569, 9688441, 18769238, 10184608, 21191052, 29287918,
|
||||
11864899, 42594502, 29115885
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1601611775252272, 1720807796594148, 1132070835939856,
|
||||
1260455018889551, 2147779492816911
|
||||
#else
|
||||
15636272, 23865875, 24204772, 25642034, 616976, 16869170, 27787599,
|
||||
18782243, 28944399, 32004408
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
316559037616741, 2177824224946892, 1459442586438991,
|
||||
1461528397712656, 751590696113597
|
||||
#else
|
||||
16568933, 4717097, 55552716, 32452109, 15682895, 21747389, 16354576,
|
||||
21778470, 7689661, 11199574
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1850748884277385, 1200145853858453, 1068094770532492,
|
||||
672251375690438, 1586055907191707
|
||||
#else
|
||||
30464137, 27578307, 55329429, 17883566, 23220364, 15915852, 7512774,
|
||||
10017326, 49359771, 23634074
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
769950342298419, 132954430919746, 844085933195555, 974092374476333,
|
||||
726076285546016
|
||||
#else
|
||||
10861363, 11473154, 27284546, 1981175, 37044515, 12577860, 32867885,
|
||||
14515107, 51670560, 10819379
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
425251763115706, 608463272472562, 442562545713235, 837766094556764,
|
||||
374555092627893
|
||||
#else
|
||||
4708026, 6336745, 20377586, 9066809, 55836755, 6594695, 41455196,
|
||||
12483687, 54440373, 5581305
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1086255230780037, 274979815921559, 1960002765731872,
|
||||
929474102396301, 1190409889297339
|
||||
#else
|
||||
19563141, 16186464, 37722007, 4097518, 10237984, 29206317, 28542349,
|
||||
13850243, 43430843, 17738489
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
665000864555967, 2065379846933859, 370231110385876, 350988370788628,
|
||||
1233371373142985
|
||||
#else
|
||||
5153727, 9909285, 1723747, 30776558, 30523604, 5516873, 19480852,
|
||||
5230134, 43156425, 18378665
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
2019367628972465, 676711900706637, 110710997811333,
|
||||
1108646842542025, 517791959672113
|
||||
#else
|
||||
36839857, 30090922, 7665485, 10083793, 28475525, 1649722, 20654025,
|
||||
16520125, 30598449, 7715701
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
965130719900578, 247011430587952, 526356006571389, 91986625355052,
|
||||
2157223321444601
|
||||
#else
|
||||
28881826, 14381568, 9657904, 3680757, 46927229, 7843315, 35708204,
|
||||
1370707, 29794553, 32145132
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1802695059465007, 1664899123557221, 593559490740857,
|
||||
2160434469266659, 927570450755031
|
||||
#else
|
||||
44589871, 26862249, 14201701, 24808930, 43598457, 8844725, 18474211,
|
||||
32192982, 54046167, 13821876
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1725674970513508, 1933645953859181, 1542344539275782,
|
||||
1767788773573747, 1297447965928905
|
||||
#else
|
||||
60653668, 25714560, 3374701, 28813570, 40010246, 22982724, 31655027,
|
||||
26342105, 18853321, 19333481
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1381809363726107, 1430341051343062, 2061843536018959,
|
||||
1551778050872521, 2036394857967624
|
||||
#else
|
||||
4566811, 20590564, 38133974, 21313742, 59506191, 30723862, 58594505,
|
||||
23123294, 2207752, 30344648
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1970894096313054, 528066325833207, 1619374932191227,
|
||||
2207306624415883, 1169170329061080
|
||||
#else
|
||||
41954014, 29368610, 29681143, 7868801, 60254203, 24130566, 54671499,
|
||||
32891431, 35997400, 17421995
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
2070390218572616, 1458919061857835, 624171843017421,
|
||||
1055332792707765, 433987520732508
|
||||
#else
|
||||
25576264, 30851218, 7349803, 21739588, 16472781, 9300885, 3844789,
|
||||
15725684, 171356, 6466918
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
893653801273833, 1168026499324677, 1242553501121234,
|
||||
1306366254304474, 1086752658510815
|
||||
#else
|
||||
23103977, 13316479, 9739013, 17404951, 817874, 18515490, 8965338,
|
||||
19466374, 36393951, 16193876
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
213454002618221, 939771523987438, 1159882208056014, 317388369627517,
|
||||
621213314200687
|
||||
#else
|
||||
33587053, 3180712, 64714734, 14003686, 50205390, 17283591, 17238397,
|
||||
4729455, 49034351, 9256799
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1971678598905747, 338026507889165, 762398079972271, 655096486107477,
|
||||
42299032696322
|
||||
#else
|
||||
41926547, 29380300, 32336397, 5036987, 45872047, 11360616, 22616405,
|
||||
9761698, 47281666, 630304
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
177130678690680, 1754759263300204, 1864311296286618,
|
||||
1180675631479880, 1292726903152791
|
||||
#else
|
||||
53388152, 2639452, 42871404, 26147950, 9494426, 27780403, 60554312,
|
||||
17593437, 64659607, 19263131
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
{
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1913163449625248, 460779200291993, 2193883288642314,
|
||||
1008900146920800, 1721983679009502
|
||||
#else
|
||||
63957664, 28508356, 9282713, 6866145, 35201802, 32691408, 48168288,
|
||||
15033783, 25105118, 25659556
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
1070401523076875, 1272492007800961, 1910153608563310,
|
||||
2075579521696771, 1191169788841221
|
||||
#else
|
||||
42782475, 15950225, 35307649, 18961608, 55446126, 28463506, 1573891,
|
||||
30928545, 2198789, 17749813
|
||||
#endif
|
||||
}},
|
||||
{{
|
||||
#if defined(ARCH_64BIT)
|
||||
692896803108118, 500174642072499, 2068223309439677,
|
||||
1162190621851337, 1426986007309901
|
||||
#else
|
||||
64009494, 10324966, 64867251, 7453182, 61661885, 30818928, 53296841,
|
||||
17317989, 34647629, 21263748
|
||||
#endif
|
||||
}},
|
||||
},
|
||||
};
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
#define MAKE_FN_NAME1(x,y) x ## y
|
||||
#define MAKE_FN_NAME(x,y) MAKE_FN_NAME1(x,y)
|
||||
|
||||
#define PRECOMP MAKE_FN_NAME(CURVE_DESCRIPTION,_divstep_precomp)
|
||||
#define MSAT MAKE_FN_NAME(CURVE_DESCRIPTION,_msat)
|
||||
#define MONE MAKE_FN_NAME(CURVE_DESCRIPTION,_set_one)
|
||||
#define DIVSTEP MAKE_FN_NAME(CURVE_DESCRIPTION,_divstep)
|
||||
#define OPP MAKE_FN_NAME(CURVE_DESCRIPTION,_opp)
|
||||
#define MUL MAKE_FN_NAME(CURVE_DESCRIPTION,_mul)
|
||||
#define SZNZ MAKE_FN_NAME(CURVE_DESCRIPTION,_selectznz)
|
||||
|
||||
#if LEN_PRIME < 46
|
||||
#define ITERATIONS (((49 * LEN_PRIME) + 80) / 17)
|
||||
#else
|
||||
#define ITERATIONS (((49 * LEN_PRIME) + 57) / 17)
|
||||
#endif
|
||||
|
||||
#define SAT_LIMBS LIMBS + 1 /* we might need 2 more bits to represent m in twos complement */
|
||||
#define BYTES 8 * (((LEN_PRIME - 1) / 64) + 1)
|
||||
|
||||
static void inverse(WORD out[LIMBS], WORD g[SAT_LIMBS]) {
|
||||
|
||||
WORD precomp[LIMBS];
|
||||
PRECOMP(precomp);
|
||||
|
||||
WORD d = 1;
|
||||
WORD f[SAT_LIMBS];
|
||||
WORD v[LIMBS];
|
||||
WORD r[LIMBS];
|
||||
WORD out1;
|
||||
WORD out2[SAT_LIMBS], out3[SAT_LIMBS], out4[LIMBS], out5[LIMBS];
|
||||
|
||||
MSAT(f);
|
||||
MONE(r);
|
||||
for (int j = 0; j < LIMBS; j++) v[j] = 0;
|
||||
|
||||
for (int i = 0; i < ITERATIONS - (ITERATIONS % 2); i+=2) {
|
||||
DIVSTEP(&out1,out2,out3,out4,out5,d,f,g,v,r);
|
||||
DIVSTEP(&d,f,g,v,r,out1,out2,out3,out4,out5);
|
||||
}
|
||||
if (ITERATIONS % 2) {
|
||||
DIVSTEP(&out1,out2,out3,out4,out5,d,f,g,v,r);
|
||||
for (int k = 0; k < LIMBS; k++) v[k] = out4[k];
|
||||
for (int k = 0; k < SAT_LIMBS; k++) f[k] = out2[k];
|
||||
}
|
||||
|
||||
WORD h[LIMBS];
|
||||
OPP(h, v);
|
||||
SZNZ(v, f[SAT_LIMBS -1 ] >> (WORDSIZE - 1), v, h);
|
||||
MUL(out, v, precomp);
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
static void inversion (WORD out[LIMBS], const WORD in[LIMBS]) {
|
||||
WORD in_[SAT_LIMBS];
|
||||
for (int i = 0; i < LIMBS; i++) in_[i] = in[i];
|
||||
in_[LIMBS] = 0;
|
||||
inverse(out, in_);
|
||||
return;
|
||||
}
|
||||
4264
unikernel/duniverse/mirage-crypto/ec/native/np256_32.h
Normal file
4264
unikernel/duniverse/mirage-crypto/ec/native/np256_32.h
Normal file
File diff suppressed because it is too large
Load diff
1797
unikernel/duniverse/mirage-crypto/ec/native/np256_64.h
Normal file
1797
unikernel/duniverse/mirage-crypto/ec/native/np256_64.h
Normal file
File diff suppressed because it is too large
Load diff
79
unikernel/duniverse/mirage-crypto/ec/native/np256_stubs.c
Normal file
79
unikernel/duniverse/mirage-crypto/ec/native/np256_stubs.c
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
#include "mirage_crypto.h"
|
||||
|
||||
/* Microsoft compiler does not support 128-bit integers. Drop down to
|
||||
* 32-bit for MSVC.
|
||||
*/
|
||||
#if defined(ARCH_64BIT) && !defined(_MSC_VER)
|
||||
#include "np256_64.h"
|
||||
#define LIMBS 4
|
||||
#define WORD uint64_t
|
||||
#define WORDSIZE 64
|
||||
#else
|
||||
#include "np256_32.h"
|
||||
#define LIMBS 8
|
||||
#define WORD uint32_t
|
||||
#define WORDSIZE 32
|
||||
#endif
|
||||
|
||||
#define LEN_PRIME 256
|
||||
#define CURVE_DESCRIPTION fiat_np256
|
||||
|
||||
#include "inversion_template.h"
|
||||
|
||||
#include <caml/memory.h>
|
||||
|
||||
CAMLprim value mc_np256_inv(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np256_mul(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_np256_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np256_add(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_np256_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np256_one(value out)
|
||||
{
|
||||
CAMLparam1(out);
|
||||
fiat_np256_set_one((WORD*)Bytes_val(out));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np256_from_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np256_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np256_to_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np256_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np256_from_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np256_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np256_to_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np256_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
8835
unikernel/duniverse/mirage-crypto/ec/native/np384_32.h
Normal file
8835
unikernel/duniverse/mirage-crypto/ec/native/np384_32.h
Normal file
File diff suppressed because it is too large
Load diff
3104
unikernel/duniverse/mirage-crypto/ec/native/np384_64.h
Normal file
3104
unikernel/duniverse/mirage-crypto/ec/native/np384_64.h
Normal file
File diff suppressed because it is too large
Load diff
79
unikernel/duniverse/mirage-crypto/ec/native/np384_stubs.c
Normal file
79
unikernel/duniverse/mirage-crypto/ec/native/np384_stubs.c
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
#include "mirage_crypto.h"
|
||||
|
||||
/* Microsoft compiler does not support 128-bit integers. Drop down to
|
||||
* 32-bit for MSVC.
|
||||
*/
|
||||
#if defined(ARCH_64BIT) && !defined(_MSC_VER)
|
||||
#include "np384_64.h"
|
||||
#define LIMBS 6
|
||||
#define WORD uint64_t
|
||||
#define WORDSIZE 64
|
||||
#else
|
||||
#include "np384_32.h"
|
||||
#define LIMBS 12
|
||||
#define WORD uint32_t
|
||||
#define WORDSIZE 32
|
||||
#endif
|
||||
|
||||
#define LEN_PRIME 384
|
||||
#define CURVE_DESCRIPTION fiat_np384
|
||||
|
||||
#include "inversion_template.h"
|
||||
|
||||
#include <caml/memory.h>
|
||||
|
||||
CAMLprim value mc_np384_inv(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np384_mul(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_np384_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np384_add(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_np384_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np384_one(value out)
|
||||
{
|
||||
CAMLparam1(out);
|
||||
fiat_np384_set_one((WORD*)Bytes_val(out));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np384_from_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np384_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np384_to_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np384_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np384_from_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np384_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np384_to_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np384_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
16271
unikernel/duniverse/mirage-crypto/ec/native/np521_32.h
Normal file
16271
unikernel/duniverse/mirage-crypto/ec/native/np521_32.h
Normal file
File diff suppressed because it is too large
Load diff
5628
unikernel/duniverse/mirage-crypto/ec/native/np521_64.h
Normal file
5628
unikernel/duniverse/mirage-crypto/ec/native/np521_64.h
Normal file
File diff suppressed because it is too large
Load diff
80
unikernel/duniverse/mirage-crypto/ec/native/np521_stubs.c
Normal file
80
unikernel/duniverse/mirage-crypto/ec/native/np521_stubs.c
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
#include "mirage_crypto.h"
|
||||
|
||||
/* Microsoft compiler does not support 128-bit integers. Drop down to
|
||||
* 32-bit for MSVC.
|
||||
*/
|
||||
#if defined(ARCH_64BIT) && !defined(_MSC_VER)
|
||||
#include "np521_64.h"
|
||||
#define LIMBS 9
|
||||
#define WORD uint64_t
|
||||
#define WORDSIZE 64
|
||||
#else
|
||||
#include "np521_32.h"
|
||||
#define LIMBS 17
|
||||
#define WORD uint32_t
|
||||
#define WORDSIZE 32
|
||||
#endif
|
||||
|
||||
#define LEN_PRIME 521
|
||||
#define CURVE_DESCRIPTION fiat_np521
|
||||
|
||||
#include "inversion_template.h"
|
||||
|
||||
#include <caml/memory.h>
|
||||
|
||||
CAMLprim value mc_np521_inv(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np521_mul(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_np521_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np521_add(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_np521_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np521_one(value out)
|
||||
{
|
||||
CAMLparam1(out);
|
||||
fiat_np521_set_one((WORD*)Bytes_val(out));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np521_from_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np521_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np521_to_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np521_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np521_from_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np521_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_np521_to_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_np521_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
4760
unikernel/duniverse/mirage-crypto/ec/native/p256_32.h
Normal file
4760
unikernel/duniverse/mirage-crypto/ec/native/p256_32.h
Normal file
File diff suppressed because it is too large
Load diff
2011
unikernel/duniverse/mirage-crypto/ec/native/p256_64.h
Normal file
2011
unikernel/duniverse/mirage-crypto/ec/native/p256_64.h
Normal file
File diff suppressed because it is too large
Load diff
160
unikernel/duniverse/mirage-crypto/ec/native/p256_stubs.c
Normal file
160
unikernel/duniverse/mirage-crypto/ec/native/p256_stubs.c
Normal file
|
|
@ -0,0 +1,160 @@
|
|||
#include "mirage_crypto.h"
|
||||
|
||||
/* Microsoft compiler does not support 128-bit integers. Drop down to
|
||||
* 32-bit for MSVC.
|
||||
*/
|
||||
#if defined(ARCH_64BIT) && !defined(_MSC_VER)
|
||||
#include "p256_64.h"
|
||||
#define LIMBS 4
|
||||
#define WORD uint64_t
|
||||
#define WORDSIZE 64
|
||||
#include "p256_tables_64.h"
|
||||
#else
|
||||
#include "p256_32.h"
|
||||
#define LIMBS 8
|
||||
#define WORD uint32_t
|
||||
#define WORDSIZE 32
|
||||
#include "p256_tables_32.h"
|
||||
#endif
|
||||
|
||||
#define LEN_PRIME 256
|
||||
#define CURVE_DESCRIPTION fiat_p256
|
||||
|
||||
#include "inversion_template.h"
|
||||
#include "point_operations.h"
|
||||
|
||||
#include <caml/memory.h>
|
||||
|
||||
CAMLprim value mc_p256_sub(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p256_sub((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_add(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p256_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_mul(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p256_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_from_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p256_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_to_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p256_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_sqr(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p256_square((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_from_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p256_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_to_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p256_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_nz(value x)
|
||||
{
|
||||
CAMLparam1(x);
|
||||
CAMLreturn(Val_bool(fe_nz((const WORD*)String_val(x))));
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_set_one(value x)
|
||||
{
|
||||
CAMLparam1(x);
|
||||
fiat_p256_set_one((WORD*)Bytes_val(x));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_inv(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_point_double(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
point_double(
|
||||
(WORD*)Bytes_val(Field(out, 0)),
|
||||
(WORD*)Bytes_val(Field(out, 1)),
|
||||
(WORD*)Bytes_val(Field(out, 2)),
|
||||
(const WORD*)String_val(Field(in, 0)),
|
||||
(const WORD*)String_val(Field(in, 1)),
|
||||
(const WORD*)String_val(Field(in, 2))
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_point_add(value out, value p, value q)
|
||||
{
|
||||
CAMLparam3(out, p, q);
|
||||
point_add(
|
||||
(WORD*)Bytes_val(Field(out, 0)),
|
||||
(WORD*)Bytes_val(Field(out, 1)),
|
||||
(WORD*)Bytes_val(Field(out, 2)),
|
||||
(const WORD*)String_val(Field(p, 0)),
|
||||
(const WORD*)String_val(Field(p, 1)),
|
||||
(const WORD*)String_val(Field(p, 2)),
|
||||
0,
|
||||
(const WORD*)String_val(Field(q, 0)),
|
||||
(const WORD*)String_val(Field(q, 1)),
|
||||
(const WORD*)String_val(Field(q, 2))
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p256_select(value out, value bit, value t, value f)
|
||||
{
|
||||
CAMLparam4(out, bit, t, f);
|
||||
fe_cmovznz(
|
||||
(WORD*)Bytes_val(out),
|
||||
Bool_val(bit),
|
||||
(const WORD*)String_val(f),
|
||||
(const WORD*)String_val(t)
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
|
||||
CAMLprim value mc_p256_scalar_mult_base(value out, value s)
|
||||
{
|
||||
CAMLparam2(out, s);
|
||||
scalar_mult_base(
|
||||
(WORD *) Bytes_val(Field(out, 0)),
|
||||
(WORD *) Bytes_val(Field(out, 1)),
|
||||
(WORD *) Bytes_val(Field(out, 2)),
|
||||
_st_uint8(s),
|
||||
caml_string_length(s)
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
13581
unikernel/duniverse/mirage-crypto/ec/native/p256_tables_32.h
Normal file
13581
unikernel/duniverse/mirage-crypto/ec/native/p256_tables_32.h
Normal file
File diff suppressed because it is too large
Load diff
13581
unikernel/duniverse/mirage-crypto/ec/native/p256_tables_64.h
Normal file
13581
unikernel/duniverse/mirage-crypto/ec/native/p256_tables_64.h
Normal file
File diff suppressed because it is too large
Load diff
10141
unikernel/duniverse/mirage-crypto/ec/native/p384_32.h
Normal file
10141
unikernel/duniverse/mirage-crypto/ec/native/p384_32.h
Normal file
File diff suppressed because it is too large
Load diff
3870
unikernel/duniverse/mirage-crypto/ec/native/p384_64.h
Normal file
3870
unikernel/duniverse/mirage-crypto/ec/native/p384_64.h
Normal file
File diff suppressed because it is too large
Load diff
159
unikernel/duniverse/mirage-crypto/ec/native/p384_stubs.c
Normal file
159
unikernel/duniverse/mirage-crypto/ec/native/p384_stubs.c
Normal file
|
|
@ -0,0 +1,159 @@
|
|||
#include "mirage_crypto.h"
|
||||
|
||||
/* Microsoft compiler does not support 128-bit integers. Drop down to
|
||||
* 32-bit for MSVC.
|
||||
*/
|
||||
#if defined(ARCH_64BIT) && !defined(_MSC_VER)
|
||||
#include "p384_64.h"
|
||||
#define LIMBS 6
|
||||
#define WORD uint64_t
|
||||
#define WORDSIZE 64
|
||||
#include "p384_tables_64.h"
|
||||
#else
|
||||
#include "p384_32.h"
|
||||
#define LIMBS 12
|
||||
#define WORD uint32_t
|
||||
#define WORDSIZE 32
|
||||
#include "p384_tables_32.h"
|
||||
#endif
|
||||
|
||||
#define LEN_PRIME 384
|
||||
#define CURVE_DESCRIPTION fiat_p384
|
||||
|
||||
#include "inversion_template.h"
|
||||
#include "point_operations.h"
|
||||
|
||||
#include <caml/memory.h>
|
||||
|
||||
CAMLprim value mc_p384_sub(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p384_sub((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_add(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p384_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_mul(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p384_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_from_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p384_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_to_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p384_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_sqr(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p384_square((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_from_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p384_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_to_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p384_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_nz(value x)
|
||||
{
|
||||
CAMLparam1(x);
|
||||
CAMLreturn(Val_bool(fe_nz((const WORD*)String_val(x))));
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_set_one(value x)
|
||||
{
|
||||
CAMLparam1(x);
|
||||
fiat_p384_set_one((WORD*)Bytes_val(x));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_inv(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_point_double(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
point_double(
|
||||
(WORD*)Bytes_val(Field(out, 0)),
|
||||
(WORD*)Bytes_val(Field(out, 1)),
|
||||
(WORD*)Bytes_val(Field(out, 2)),
|
||||
(const WORD*)String_val(Field(in, 0)),
|
||||
(const WORD*)String_val(Field(in, 1)),
|
||||
(const WORD*)String_val(Field(in, 2))
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_point_add(value out, value p, value q)
|
||||
{
|
||||
CAMLparam3(out, p, q);
|
||||
point_add(
|
||||
(WORD*)Bytes_val(Field(out, 0)),
|
||||
(WORD*)Bytes_val(Field(out, 1)),
|
||||
(WORD*)Bytes_val(Field(out, 2)),
|
||||
(const WORD*)String_val(Field(p, 0)),
|
||||
(const WORD*)String_val(Field(p, 1)),
|
||||
(const WORD*)String_val(Field(p, 2)),
|
||||
0,
|
||||
(const WORD*)String_val(Field(q, 0)),
|
||||
(const WORD*)String_val(Field(q, 1)),
|
||||
(const WORD*)String_val(Field(q, 2))
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_select(value out, value bit, value t, value f)
|
||||
{
|
||||
CAMLparam4(out, bit, t, f);
|
||||
fe_cmovznz(
|
||||
(WORD*)Bytes_val(out),
|
||||
Bool_val(bit),
|
||||
(const WORD*)String_val(f),
|
||||
(const WORD*)String_val(t)
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p384_scalar_mult_base(value out, value s)
|
||||
{
|
||||
CAMLparam2(out, s);
|
||||
scalar_mult_base(
|
||||
(WORD *) Bytes_val(Field(out, 0)),
|
||||
(WORD *) Bytes_val(Field(out, 1)),
|
||||
(WORD *) Bytes_val(Field(out, 2)),
|
||||
_st_uint8(s),
|
||||
caml_string_length(s)
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
24684
unikernel/duniverse/mirage-crypto/ec/native/p384_tables_32.h
Normal file
24684
unikernel/duniverse/mirage-crypto/ec/native/p384_tables_32.h
Normal file
File diff suppressed because it is too large
Load diff
20365
unikernel/duniverse/mirage-crypto/ec/native/p384_tables_64.h
Normal file
20365
unikernel/duniverse/mirage-crypto/ec/native/p384_tables_64.h
Normal file
File diff suppressed because it is too large
Load diff
19718
unikernel/duniverse/mirage-crypto/ec/native/p521_32.h
Normal file
19718
unikernel/duniverse/mirage-crypto/ec/native/p521_32.h
Normal file
File diff suppressed because it is too large
Load diff
6619
unikernel/duniverse/mirage-crypto/ec/native/p521_64.h
Normal file
6619
unikernel/duniverse/mirage-crypto/ec/native/p521_64.h
Normal file
File diff suppressed because it is too large
Load diff
159
unikernel/duniverse/mirage-crypto/ec/native/p521_stubs.c
Normal file
159
unikernel/duniverse/mirage-crypto/ec/native/p521_stubs.c
Normal file
|
|
@ -0,0 +1,159 @@
|
|||
#include "mirage_crypto.h"
|
||||
|
||||
/* Microsoft compiler does not support 128-bit integers. Drop down to
|
||||
* 32-bit for MSVC.
|
||||
*/
|
||||
#if defined(ARCH_64BIT) && !defined(_MSC_VER)
|
||||
#include "p521_64.h"
|
||||
#define LIMBS 9
|
||||
#define WORD uint64_t
|
||||
#define WORDSIZE 64
|
||||
#include "p521_tables_64.h"
|
||||
#else
|
||||
#include "p521_32.h"
|
||||
#define LIMBS 17
|
||||
#define WORD uint32_t
|
||||
#define WORDSIZE 32
|
||||
#include "p521_tables_32.h"
|
||||
#endif
|
||||
|
||||
#define LEN_PRIME 521
|
||||
#define CURVE_DESCRIPTION fiat_p521
|
||||
|
||||
#include "inversion_template.h"
|
||||
#include "point_operations.h"
|
||||
|
||||
#include <caml/memory.h>
|
||||
|
||||
CAMLprim value mc_p521_sub(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p521_sub((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_add(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p521_add((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_mul(value out, value a, value b)
|
||||
{
|
||||
CAMLparam3(out, a, b);
|
||||
fiat_p521_mul((WORD*)Bytes_val(out), (const WORD*)String_val(a), (const WORD*)String_val(b));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_from_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p521_from_bytes((WORD*)Bytes_val(out), _st_uint8(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_to_bytes(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p521_to_bytes(Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_sqr(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p521_square((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_from_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p521_from_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_to_montgomery(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
fiat_p521_to_montgomery((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_nz(value x)
|
||||
{
|
||||
CAMLparam1(x);
|
||||
CAMLreturn(Val_bool(fe_nz((const WORD*)String_val(x))));
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_set_one(value x)
|
||||
{
|
||||
CAMLparam1(x);
|
||||
fiat_p521_set_one((WORD*)Bytes_val(x));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_inv(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
inversion((WORD*)Bytes_val(out), (const WORD*)String_val(in));
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_point_double(value out, value in)
|
||||
{
|
||||
CAMLparam2(out, in);
|
||||
point_double(
|
||||
(WORD*)Bytes_val(Field(out, 0)),
|
||||
(WORD*)Bytes_val(Field(out, 1)),
|
||||
(WORD*)Bytes_val(Field(out, 2)),
|
||||
(const WORD*)String_val(Field(in, 0)),
|
||||
(const WORD*)String_val(Field(in, 1)),
|
||||
(const WORD*)String_val(Field(in, 2))
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_point_add(value out, value p, value q)
|
||||
{
|
||||
CAMLparam3(out, p, q);
|
||||
point_add(
|
||||
(WORD*)Bytes_val(Field(out, 0)),
|
||||
(WORD*)Bytes_val(Field(out, 1)),
|
||||
(WORD*)Bytes_val(Field(out, 2)),
|
||||
(const WORD*)String_val(Field(p, 0)),
|
||||
(const WORD*)String_val(Field(p, 1)),
|
||||
(const WORD*)String_val(Field(p, 2)),
|
||||
0,
|
||||
(const WORD*)String_val(Field(q, 0)),
|
||||
(const WORD*)String_val(Field(q, 1)),
|
||||
(const WORD*)String_val(Field(q, 2))
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_select(value out, value bit, value t, value f)
|
||||
{
|
||||
CAMLparam4(out, bit, t, f);
|
||||
fe_cmovznz(
|
||||
(WORD*)Bytes_val(out),
|
||||
Bool_val(bit),
|
||||
(const WORD*)String_val(f),
|
||||
(const WORD*)String_val(t)
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
|
||||
CAMLprim value mc_p521_scalar_mult_base(value out, value s)
|
||||
{
|
||||
CAMLparam2(out, s);
|
||||
scalar_mult_base(
|
||||
(WORD *) Bytes_val(Field(out, 0)),
|
||||
(WORD *) Bytes_val(Field(out, 1)),
|
||||
(WORD *) Bytes_val(Field(out, 2)),
|
||||
_st_uint8(s),
|
||||
caml_string_length(s)
|
||||
);
|
||||
CAMLreturn(Val_unit);
|
||||
}
|
||||
263
unikernel/duniverse/mirage-crypto/ec/native/point_operations.h
Normal file
263
unikernel/duniverse/mirage-crypto/ec/native/point_operations.h
Normal file
|
|
@ -0,0 +1,263 @@
|
|||
#define MAKE_FN_NAME1(x,y) x ## y
|
||||
#define MAKE_FN_NAME(x,y) MAKE_FN_NAME1(x,y)
|
||||
|
||||
#define fe_one MAKE_FN_NAME(CURVE_DESCRIPTION,_set_one)
|
||||
|
||||
#define fe_add MAKE_FN_NAME(CURVE_DESCRIPTION,_add)
|
||||
#define fe_sub MAKE_FN_NAME(CURVE_DESCRIPTION,_sub)
|
||||
|
||||
#define fe_mul MAKE_FN_NAME(CURVE_DESCRIPTION,_mul)
|
||||
#define fe_sqr MAKE_FN_NAME(CURVE_DESCRIPTION,_square)
|
||||
|
||||
#define fe_nonzero MAKE_FN_NAME(CURVE_DESCRIPTION,_nonzero)
|
||||
#define fe_selectznz MAKE_FN_NAME(CURVE_DESCRIPTION,_selectznz)
|
||||
|
||||
#define fe_from_bytes MAKE_FN_NAME(CURVE_DESCRIPTION,_from_bytes)
|
||||
#define fe_to_mont MAKE_FN_NAME(CURVE_DESCRIPTION,_to_montgomery)
|
||||
|
||||
typedef WORD fe[LIMBS];
|
||||
|
||||
static WORD fe_nz(const WORD in1[LIMBS]) {
|
||||
WORD ret;
|
||||
fe_nonzero(&ret, in1);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void fe_copy(WORD out[LIMBS], const WORD in1[LIMBS]) {
|
||||
for (int i = 0; i < LIMBS; i++) {
|
||||
out[i] = in1[i];
|
||||
}
|
||||
}
|
||||
|
||||
static void fe_cmovznz(WORD out[LIMBS], WORD t, const WORD z[LIMBS],
|
||||
const WORD nz[LIMBS]) {
|
||||
fe_selectznz(out, !!t, z, nz);
|
||||
}
|
||||
|
||||
// Group operations
|
||||
// ----------------
|
||||
//
|
||||
// Building on top of the field operations we have the operations on the
|
||||
// elliptic curve group itself. Points on the curve are represented in Jacobian
|
||||
// coordinates.
|
||||
//
|
||||
// Both operations were transcribed to Coq and proven to correspond to naive
|
||||
// implementations using Affine coordinates, for all suitable fields. In the
|
||||
// Coq proofs, issues of constant-time execution and memory layout (aliasing)
|
||||
// conventions were not considered. Specification of affine coordinates:
|
||||
// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Spec/WeierstrassCurve.v#L28>
|
||||
// As a sanity check, a proof that these points form a commutative group:
|
||||
// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/AffineProofs.v#L33>
|
||||
|
||||
// point_double calculates 2*(x_in, y_in, z_in)
|
||||
//
|
||||
// The method is taken from:
|
||||
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
|
||||
//
|
||||
// Coq transcription and correctness proof:
|
||||
// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L93>
|
||||
// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L201>
|
||||
//
|
||||
// Outputs can equal corresponding inputs, i.e., x_out == x_in is allowed.
|
||||
// while x_out == y_in is not (maybe this works, but it's not tested).
|
||||
static void point_double(fe x_out, fe y_out, fe z_out,
|
||||
const fe x_in, const fe y_in, const fe z_in) {
|
||||
fe delta, gamma, beta, ftmp, ftmp2, tmptmp, alpha, fourbeta;
|
||||
// delta = z^2
|
||||
fe_sqr(delta, z_in);
|
||||
// gamma = y^2
|
||||
fe_sqr(gamma, y_in);
|
||||
// beta = x*gamma
|
||||
fe_mul(beta, x_in, gamma);
|
||||
|
||||
// alpha = 3*(x-delta)*(x+delta)
|
||||
fe_sub(ftmp, x_in, delta);
|
||||
fe_add(ftmp2, x_in, delta);
|
||||
|
||||
fe_add(tmptmp, ftmp2, ftmp2);
|
||||
fe_add(ftmp2, ftmp2, tmptmp);
|
||||
fe_mul(alpha, ftmp, ftmp2);
|
||||
|
||||
// x' = alpha^2 - 8*beta
|
||||
fe_sqr(x_out, alpha);
|
||||
fe_add(fourbeta, beta, beta);
|
||||
fe_add(fourbeta, fourbeta, fourbeta);
|
||||
fe_add(tmptmp, fourbeta, fourbeta);
|
||||
fe_sub(x_out, x_out, tmptmp);
|
||||
|
||||
// z' = (y + z)^2 - gamma - delta
|
||||
fe_add(delta, gamma, delta);
|
||||
fe_add(ftmp, y_in, z_in);
|
||||
fe_sqr(z_out, ftmp);
|
||||
fe_sub(z_out, z_out, delta);
|
||||
|
||||
// y' = alpha*(4*beta - x') - 8*gamma^2
|
||||
fe_sub(y_out, fourbeta, x_out);
|
||||
fe_add(gamma, gamma, gamma);
|
||||
fe_sqr(gamma, gamma);
|
||||
fe_mul(y_out, alpha, y_out);
|
||||
fe_add(gamma, gamma, gamma);
|
||||
fe_sub(y_out, y_out, gamma);
|
||||
}
|
||||
|
||||
// point_add calculates (x1, y1, z1) + (x2, y2, z2)
|
||||
//
|
||||
// The method is taken from:
|
||||
// http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl,
|
||||
// adapted for mixed addition (z2 = 1, or z2 = 0 for the point at infinity).
|
||||
//
|
||||
// Coq transcription and correctness proof:
|
||||
// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L135>
|
||||
// <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L205>
|
||||
//
|
||||
// This function includes a branch for checking whether the two input points
|
||||
// are equal, (while not equal to the point at infinity). This case never
|
||||
// happens during single point multiplication, so there is no timing leak for
|
||||
// ECDH or ECDSA signing.
|
||||
static void point_add(fe x3, fe y3, fe z3, const fe x1,
|
||||
const fe y1, const fe z1, const int mixed,
|
||||
const fe x2, const fe y2, const fe z2) {
|
||||
fe x_out, y_out, z_out;
|
||||
WORD z1nz = fe_nz(z1);
|
||||
WORD z2nz = fe_nz(z2);
|
||||
|
||||
// z1z1 = z1z1 = z1**2
|
||||
fe z1z1; fe_sqr(z1z1, z1);
|
||||
|
||||
fe u1, s1, two_z1z2;
|
||||
if (!mixed) {
|
||||
// z2z2 = z2**2
|
||||
fe z2z2; fe_sqr(z2z2, z2);
|
||||
|
||||
// u1 = x1*z2z2
|
||||
fe_mul(u1, x1, z2z2);
|
||||
|
||||
// two_z1z2 = (z1 + z2)**2 - (z1z1 + z2z2) = 2z1z2
|
||||
fe_add(two_z1z2, z1, z2);
|
||||
fe_sqr(two_z1z2, two_z1z2);
|
||||
fe_sub(two_z1z2, two_z1z2, z1z1);
|
||||
fe_sub(two_z1z2, two_z1z2, z2z2);
|
||||
|
||||
// s1 = y1 * z2**3
|
||||
fe_mul(s1, z2, z2z2);
|
||||
fe_mul(s1, s1, y1);
|
||||
} else {
|
||||
// We'll assume z2 = 1 (special case z2 = 0 is handled later).
|
||||
|
||||
// u1 = x1*z2z2
|
||||
fe_copy(u1, x1);
|
||||
// two_z1z2 = 2z1z2
|
||||
fe_add(two_z1z2, z1, z1);
|
||||
// s1 = y1 * z2**3
|
||||
fe_copy(s1, y1);
|
||||
}
|
||||
|
||||
// u2 = x2*z1z1
|
||||
fe u2; fe_mul(u2, x2, z1z1);
|
||||
|
||||
// h = u2 - u1
|
||||
fe h; fe_sub(h, u2, u1);
|
||||
|
||||
WORD xneq = fe_nz(h);
|
||||
|
||||
// z_out = two_z1z2 * h
|
||||
fe_mul(z_out, h, two_z1z2);
|
||||
|
||||
// z1z1z1 = z1 * z1z1
|
||||
fe z1z1z1; fe_mul(z1z1z1, z1, z1z1);
|
||||
|
||||
// s2 = y2 * z1**3
|
||||
fe s2; fe_mul(s2, y2, z1z1z1);
|
||||
|
||||
// r = (s2 - s1)*2
|
||||
fe r;
|
||||
fe_sub(r, s2, s1);
|
||||
fe_add(r, r, r);
|
||||
|
||||
WORD yneq = fe_nz(r);
|
||||
|
||||
if (!xneq && !yneq && z1nz && z2nz) {
|
||||
point_double(x3, y3, z3, x1, y1, z1);
|
||||
return;
|
||||
}
|
||||
|
||||
// I = (2h)**2
|
||||
fe i;
|
||||
fe_add(i, h, h);
|
||||
fe_sqr(i, i);
|
||||
|
||||
// J = h * I
|
||||
fe j; fe_mul(j, h, i);
|
||||
|
||||
// V = U1 * I
|
||||
fe v; fe_mul(v, u1, i);
|
||||
|
||||
// x_out = r**2 - J - 2V
|
||||
fe_sqr(x_out, r);
|
||||
fe_sub(x_out, x_out, j);
|
||||
fe_sub(x_out, x_out, v);
|
||||
fe_sub(x_out, x_out, v);
|
||||
|
||||
// y_out = r(V-x_out) - 2 * s1 * J
|
||||
fe_sub(y_out, v, x_out);
|
||||
fe_mul(y_out, y_out, r);
|
||||
fe s1j;
|
||||
fe_mul(s1j, s1, j);
|
||||
fe_sub(y_out, y_out, s1j);
|
||||
fe_sub(y_out, y_out, s1j);
|
||||
|
||||
fe_cmovznz(x_out, z1nz, x2, x_out);
|
||||
fe_cmovznz(x3, z2nz, x1, x_out);
|
||||
fe_cmovznz(y_out, z1nz, y2, y_out);
|
||||
fe_cmovznz(y3, z2nz, y1, y_out);
|
||||
fe_cmovznz(z_out, z1nz, z2, z_out);
|
||||
fe_cmovznz(z3, z2nz, z1, z_out);
|
||||
}
|
||||
|
||||
/* Use a sliding window optimization method for scalar multiplication
|
||||
Hard-coded window size = 4
|
||||
Implementation inspired from Go's crypto library
|
||||
https://github.com/golang/go/blob/a5cd894318677359f6d07ee74f9004d28b4d164c/src/crypto/internal/nistec/p256.go#L317
|
||||
*/
|
||||
|
||||
/* Select the n-th element of the table
|
||||
without leaking information about [n] */
|
||||
static void table_select(fe out_x, fe out_y, fe out_z, size_t index, uint8_t n) {
|
||||
fe x, y, z = {0};
|
||||
fe_one(x); fe_one(y);
|
||||
for(uint8_t i = 1 ; i < 16 ; ++i) {
|
||||
WORD cond = i ^ n;
|
||||
fe_cmovznz(x, cond, generator_table[index][n - 1][0], x);
|
||||
fe_cmovznz(y, cond, generator_table[index][n - 1][1], y);
|
||||
fe_cmovznz(z, cond, generator_table[index][n - 1][2], z);
|
||||
}
|
||||
fe_copy(out_x, x);
|
||||
fe_copy(out_y, y);
|
||||
fe_copy(out_z, z);
|
||||
}
|
||||
|
||||
/* Returns [kG] by decomposing [k] in binary form, and adding
|
||||
[2^0G * k_0 + 2^1G * k_1 + ...] in constant time using
|
||||
pre-computed values of 2^iG */
|
||||
static void scalar_mult_base(fe x2, fe y2, fe z2,
|
||||
const uint8_t* scalar, size_t len) {
|
||||
// P = 0
|
||||
fe p_x, p_y, p_z = {0};
|
||||
fe_one(p_x);
|
||||
fe_one(p_y);
|
||||
size_t index = 0;
|
||||
for(size_t i = 0 ; i < len ; ++i) {
|
||||
fe s_x, s_y, s_z;
|
||||
uint8_t window = scalar[i] & 0xf;
|
||||
table_select(s_x, s_y, s_z, index, window);
|
||||
point_add(p_x, p_y, p_z, p_x, p_y, p_z, 0, s_x, s_y, s_z);
|
||||
index++;
|
||||
window = scalar[i] >> 4;
|
||||
table_select(s_x, s_y, s_z, index, window);
|
||||
point_add(p_x, p_y, p_z, p_x, p_y, p_z, 0, s_x, s_y, s_z);
|
||||
index++;
|
||||
}
|
||||
fe_copy(x2, p_x);
|
||||
fe_copy(y2, p_y);
|
||||
fe_copy(z2, p_z);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue