Botan  2.7.0
Crypto and TLS for C++11
ed25519_internal.h
Go to the documentation of this file.
1 /*
2 * Ed25519
3 * (C) 2017 Ribose Inc
4 *
5 * Based on the public domain code from SUPERCOP ref10 by
6 * Peter Schwabe, Daniel J. Bernstein, Niels Duif, Tanja Lange, Bo-Yin Yang
7 *
8 * Botan is released under the Simplified BSD License (see license.txt)
9 */
10 
11 #ifndef BOTAN_ED25519_INT_H_
12 #define BOTAN_ED25519_INT_H_
13 
14 #include <botan/internal/ed25519_fe.h>
15 #include <botan/loadstor.h>
16 
17 namespace Botan {
18 
19 inline uint64_t load_3(const uint8_t in[3])
20  {
21  return static_cast<uint64_t>(in[0]) |
22  (static_cast<uint64_t>(in[1]) << 8) |
23  (static_cast<uint64_t>(in[2]) << 16);
24  }
25 
26 inline uint64_t load_4(const uint8_t* in)
27  {
28  return load_le<uint32_t>(in, 0);
29  }
30 
31 template<size_t S, int64_t MUL=1>
32 inline void carry(int64_t& h0, int64_t& h1)
33  {
34  static_assert(S > 0 && S < 64, "Shift in range");
35 
36  const int64_t X1 = (static_cast<int64_t>(1) << S);
37  const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));
38  int64_t c = (h0 + X2) >> S;
39  h1 += c * MUL;
40  h0 -= c * X1;
41  }
42 
43 template<size_t S>
44 inline void carry0(int64_t& h0, int64_t& h1)
45  {
46  static_assert(S > 0 && S < 64, "Shift in range");
47 
48  const int64_t X1 = (static_cast<int64_t>(1) << S);
49  int64_t c = h0 >> S;
50  h1 += c;
51  h0 -= c * X1;
52  }
53 
54 template<size_t S>
55 inline void carry0(int32_t& h0, int32_t& h1)
56  {
57  static_assert(S > 0 && S < 32, "Shift in range");
58 
59  const int32_t X1 = (static_cast<int64_t>(1) << S);
60  int32_t c = h0 >> S;
61  h1 += c;
62  h0 -= c * X1;
63  }
64 
65 inline void redc_mul(int64_t& s1,
66  int64_t& s2,
67  int64_t& s3,
68  int64_t& s4,
69  int64_t& s5,
70  int64_t& s6,
71  int64_t& X)
72  {
73  s1 += X * 666643;
74  s2 += X * 470296;
75  s3 += X * 654183;
76  s4 -= X * 997805;
77  s5 += X * 136657;
78  s6 -= X * 683901;
79  X = 0;
80  }
81 
82 /*
83 ge means group element.
84 
85 Here the group is the set of pairs (x,y) of field elements (see fe.h)
86 satisfying -x^2 + y^2 = 1 + d x^2y^2
87 where d = -121665/121666.
88 
89 Representations:
90  ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT
91 */
92 
93 typedef struct
94  {
95  fe X;
96  fe Y;
97  fe Z;
98  fe T;
99  } ge_p3;
100 
101 int ge_frombytes_negate_vartime(ge_p3*, const uint8_t*);
102 void ge_scalarmult_base(uint8_t out[32], const uint8_t in[32]);
103 
104 void ge_double_scalarmult_vartime(uint8_t out[32],
105  const uint8_t a[],
106  const ge_p3* A,
107  const uint8_t b[]);
108 
109 /*
110 The set of scalars is \Z/l
111 where l = 2^252 + 27742317777372353535851937790883648493.
112 */
113 
114 void sc_reduce(uint8_t*);
115 void sc_muladd(uint8_t*, const uint8_t*, const uint8_t*, const uint8_t*);
116 
117 }
118 
119 #endif
fe X
Definition: ge.cpp:27
void sc_muladd(uint8_t *, const uint8_t *, const uint8_t *, const uint8_t *)
Definition: sc_muladd.cpp:26
void carry(int64_t &h0, int64_t &h1)
void sc_reduce(uint8_t *)
Definition: sc_reduce.cpp:25
uint64_t load_4(const uint8_t *in)
uint32_t load_le< uint32_t >(const uint8_t in[], size_t off)
Definition: loadstor.h:196
uint64_t load_3(const uint8_t in[3])
int ge_frombytes_negate_vartime(ge_p3 *, const uint8_t *)
Definition: ge.cpp:458
void ge_double_scalarmult_vartime(uint8_t out[32], const uint8_t a[], const ge_p3 *A, const uint8_t b[])
Definition: alg_id.cpp:13
void redc_mul(int64_t &s1, int64_t &s2, int64_t &s3, int64_t &s4, int64_t &s5, int64_t &s6, int64_t &X)
void ge_scalarmult_base(uint8_t out[32], const uint8_t in[32])
Definition: ge.cpp:2118
void carry0(int64_t &h0, int64_t &h1)