Botan 3.0.0-alpha0
Crypto and TLS for C&
ed25519_internal.h
Go to the documentation of this file.
1/*
2* Ed25519
3* (C) 2017 Ribose Inc
4*
5* Based on the public domain code from SUPERCOP ref10 by
6* Peter Schwabe, Daniel J. Bernstein, Niels Duif, Tanja Lange, Bo-Yin Yang
7*
8* Botan is released under the Simplified BSD License (see license.txt)
9*/
10
11#ifndef BOTAN_ED25519_INT_H_
12#define BOTAN_ED25519_INT_H_
13
14#include <botan/internal/ed25519_fe.h>
15#include <botan/internal/loadstor.h>
16
17namespace Botan {
18
19inline uint64_t load_3(const uint8_t in[3])
20 {
21 return static_cast<uint64_t>(in[0]) |
22 (static_cast<uint64_t>(in[1]) << 8) |
23 (static_cast<uint64_t>(in[2]) << 16);
24 }
25
26inline uint64_t load_4(const uint8_t* in)
27 {
28 return load_le<uint32_t>(in, 0);
29 }
30
31template<size_t S, int64_t MUL=1>
32inline void carry(int64_t& h0, int64_t& h1)
33 {
34 static_assert(S > 0 && S < 64, "Shift in range");
35
36 const int64_t X1 = (static_cast<int64_t>(1) << S);
37 const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));
38 int64_t c = (h0 + X2) >> S;
39 h1 += c * MUL;
40 h0 -= c * X1;
41 }
42
43template<size_t S>
44inline void carry0(int64_t& h0, int64_t& h1)
45 {
46 static_assert(S > 0 && S < 64, "Shift in range");
47
48 const int64_t X1 = (static_cast<int64_t>(1) << S);
49 int64_t c = h0 >> S;
50 h1 += c;
51 h0 -= c * X1;
52 }
53
54template<size_t S>
55inline void carry0(int32_t& h0, int32_t& h1)
56 {
57 static_assert(S > 0 && S < 32, "Shift in range");
58
59 const int32_t X1 = (static_cast<int64_t>(1) << S);
60 int32_t c = h0 >> S;
61 h1 += c;
62 h0 -= c * X1;
63 }
64
65inline void redc_mul(int64_t& s1,
66 int64_t& s2,
67 int64_t& s3,
68 int64_t& s4,
69 int64_t& s5,
70 int64_t& s6,
71 int64_t& X)
72 {
73 s1 += X * 666643;
74 s2 += X * 470296;
75 s3 += X * 654183;
76 s4 -= X * 997805;
77 s5 += X * 136657;
78 s6 -= X * 683901;
79 X = 0;
80 }
81
82/*
83ge means group element.
84
85Here the group is the set of pairs (x,y) of field elements (see fe.h)
86satisfying -x^2 + y^2 = 1 + d x^2y^2
87where d = -121665/121666.
88
89Representations:
90 ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT
91*/
92
93struct ge_p3
94 {
99 };
100
101int ge_frombytes_negate_vartime(ge_p3* v, const uint8_t*);
102void ge_scalarmult_base(uint8_t out[32], const uint8_t in[32]);
103
104void ge_double_scalarmult_vartime(uint8_t out[32],
105 const uint8_t a[],
106 const ge_p3* A,
107 const uint8_t b[]);
108
109/*
110The set of scalars is \Z/l
111where l = 2^252 + 27742317777372353535851937790883648493.
112*/
113
114void sc_reduce(uint8_t*);
115void sc_muladd(uint8_t*, const uint8_t*, const uint8_t*, const uint8_t*);
116
117}
118
119#endif
fe X
Definition: ge.cpp:26
Polynomial v
Definition: kyber.cpp:822
PolynomialVector b
Definition: kyber.cpp:821
Definition: alg_id.cpp:13
constexpr uint32_t load_le< uint32_t >(const uint8_t in[], size_t off)
Definition: loadstor.h:209
void redc_mul(int64_t &s1, int64_t &s2, int64_t &s3, int64_t &s4, int64_t &s5, int64_t &s6, int64_t &X)
uint64_t load_4(const uint8_t *in)
void carry0(int64_t &h0, int64_t &h1)
int ge_frombytes_negate_vartime(ge_p3 *v, const uint8_t *)
Definition: ge.cpp:457
void carry(int64_t &h0, int64_t &h1)
void ge_scalarmult_base(uint8_t out[32], const uint8_t in[32])
Definition: ge.cpp:2117
void sc_reduce(uint8_t *)
Definition: sc_reduce.cpp:25
uint64_t load_3(const uint8_t in[3])
void ge_double_scalarmult_vartime(uint8_t out[32], const uint8_t a[], const ge_p3 *A, const uint8_t b[])
void sc_muladd(uint8_t *, const uint8_t *, const uint8_t *, const uint8_t *)
Definition: sc_muladd.cpp:26