/htdocs/wp-includes/sodium_compat/src/Core/Curve25519.php

https://gitlab.com/VTTE/sitios-vtte · PHP · 1469 lines · 950 code · 83 blank · 436 comment · 37 complexity · 89d6bbc2c88f13bee1d52da8597985c2 MD5 · raw file 

    

  1. <?php
    2. 

  2. 

  3. if (class_exists('ParagonIE_Sodium_Core_Curve25519', false)) {
    4. 

  4.     return;
    5. 

  5. }
    6. 

  6. 

  7. /**
    8. 

  8.  * Class ParagonIE_Sodium_Core_Curve25519
    9. 

  9.  *
    10. 

  10.  * Implements Curve25519 core functions
    11. 

  11.  *
    12. 

  12.  * Based on the ref10 curve25519 code provided by libsodium
    13. 

  13.  *
    14. 

  14.  * @ref https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c
    15. 

  15.  */
    16. 

  16. abstract class ParagonIE_Sodium_Core_Curve25519 extends ParagonIE_Sodium_Core_Curve25519_H
    17. 

  17. {
    18. 

  18.     /**
    19. 

  19.      * Get a field element of size 10 with a value of 0
    20. 

  20.      *
    21. 

  21.      * @internal You should not use this directly from another application
    22. 

  22.      *
    23. 

  23.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    24. 

  24.      */
    25. 

  25.     public static function fe_0()
    26. 

  26.     {
    27. 

  27.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
    28. 

  28.             array(0, 0, 0, 0, 0, 0, 0, 0, 0, 0)
    29. 

  29.         );
    30. 

  30.     }
    31. 

  31. 

  32.     /**
    33. 

  33.      * Get a field element of size 10 with a value of 1
    34. 

  34.      *
    35. 

  35.      * @internal You should not use this directly from another application
    36. 

  36.      *
    37. 

  37.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    38. 

  38.      */
    39. 

  39.     public static function fe_1()
    40. 

  40.     {
    41. 

  41.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
    42. 

  42.             array(1, 0, 0, 0, 0, 0, 0, 0, 0, 0)
    43. 

  43.         );
    44. 

  44.     }
    45. 

  45. 

  46.     /**
    47. 

  47.      * Add two field elements.
    48. 

  48.      *
    49. 

  49.      * @internal You should not use this directly from another application
    50. 

  50.      *
    51. 

  51.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    52. 

  52.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $g
    53. 

  53.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    54. 

  54.      * @psalm-suppress MixedAssignment
    55. 

  55.      * @psalm-suppress MixedOperand
    56. 

  56.      */
    57. 

  57.     public static function fe_add(
    58. 

  58.         ParagonIE_Sodium_Core_Curve25519_Fe $f,
    59. 

  59.         ParagonIE_Sodium_Core_Curve25519_Fe $g
    60. 

  60.     ) {
    61. 

  61.         /** @var array<int, int> $arr */
    62. 

  62.         $arr = array();
    63. 

  63.         for ($i = 0; $i < 10; ++$i) {
    64. 

  64.             $arr[$i] = (int) ($f[$i] + $g[$i]);
    65. 

  65.         }
    66. 

  66.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($arr);
    67. 

  67.     }
    68. 

  68. 

  69.     /**
    70. 

  70.      * Constant-time conditional move.
    71. 

  71.      *
    72. 

  72.      * @internal You should not use this directly from another application
    73. 

  73.      *
    74. 

  74.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    75. 

  75.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $g
    76. 

  76.      * @param int $b
    77. 

  77.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    78. 

  78.      * @psalm-suppress MixedAssignment
    79. 

  79.      */
    80. 

  80.     public static function fe_cmov(
    81. 

  81.         ParagonIE_Sodium_Core_Curve25519_Fe $f,
    82. 

  82.         ParagonIE_Sodium_Core_Curve25519_Fe $g,
    83. 

  83.         $b = 0
    84. 

  84.     ) {
    85. 

  85.         /** @var array<int, int> $h */
    86. 

  86.         $h = array();
    87. 

  87.         $b *= -1;
    88. 

  88.         for ($i = 0; $i < 10; ++$i) {
    89. 

  89.             /** @var int $x */
    90. 

  90.             $x = (($f[$i] ^ $g[$i]) & $b);
    91. 

  91.             $h[$i] = (int) ((int) ($f[$i]) ^ $x);
    92. 

  92.         }
    93. 

  93.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($h);
    94. 

  94.     }
    95. 

  95. 

  96.     /**
    97. 

  97.      * Create a copy of a field element.
    98. 

  98.      *
    99. 

  99.      * @internal You should not use this directly from another application
    100. 

  100.      *
    101. 

  101.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    102. 

  102.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    103. 

  103.      */
    104. 

  104.     public static function fe_copy(ParagonIE_Sodium_Core_Curve25519_Fe $f)
    105. 

  105.     {
    106. 

  106.         $h = clone $f;
    107. 

  107.         return $h;
    108. 

  108.     }
    109. 

  109. 

  110.     /**
    111. 

  111.      * Give: 32-byte string.
    112. 

  112.      * Receive: A field element object to use for internal calculations.
    113. 

  113.      *
    114. 

  114.      * @internal You should not use this directly from another application
    115. 

  115.      *
    116. 

  116.      * @param string $s
    117. 

  117.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    118. 

  118.      * @throws RangeException
    119. 

  119.      * @throws TypeError
    120. 

  120.      */
    121. 

  121.     public static function fe_frombytes($s)
    122. 

  122.     {
    123. 

  123.         if (self::strlen($s) !== 32) {
    124. 

  124.             throw new RangeException('Expected a 32-byte string.');
    125. 

  125.         }
    126. 

  126.         /** @var int $h0 */
    127. 

  127.         $h0 = self::load_4($s);
    128. 

  128.         /** @var int $h1 */
    129. 

  129.         $h1 = self::load_3(self::substr($s, 4, 3)) << 6;
    130. 

  130.         /** @var int $h2 */
    131. 

  131.         $h2 = self::load_3(self::substr($s, 7, 3)) << 5;
    132. 

  132.         /** @var int $h3 */
    133. 

  133.         $h3 = self::load_3(self::substr($s, 10, 3)) << 3;
    134. 

  134.         /** @var int $h4 */
    135. 

  135.         $h4 = self::load_3(self::substr($s, 13, 3)) << 2;
    136. 

  136.         /** @var int $h5 */
    137. 

  137.         $h5 = self::load_4(self::substr($s, 16, 4));
    138. 

  138.         /** @var int $h6 */
    139. 

  139.         $h6 = self::load_3(self::substr($s, 20, 3)) << 7;
    140. 

  140.         /** @var int $h7 */
    141. 

  141.         $h7 = self::load_3(self::substr($s, 23, 3)) << 5;
    142. 

  142.         /** @var int $h8 */
    143. 

  143.         $h8 = self::load_3(self::substr($s, 26, 3)) << 4;
    144. 

  144.         /** @var int $h9 */
    145. 

  145.         $h9 = (self::load_3(self::substr($s, 29, 3)) & 8388607) << 2;
    146. 

  146. 

  147.         /** @var int $carry9 */
    148. 

  148.         $carry9 = ($h9 + (1 << 24)) >> 25;
    149. 

  149.         $h0 += self::mul($carry9, 19, 5);
    150. 

  150.         $h9 -= $carry9 << 25;
    151. 

  151.         /** @var int $carry1 */
    152. 

  152.         $carry1 = ($h1 + (1 << 24)) >> 25;
    153. 

  153.         $h2 += $carry1;
    154. 

  154.         $h1 -= $carry1 << 25;
    155. 

  155.         /** @var int $carry3 */
    156. 

  156.         $carry3 = ($h3 + (1 << 24)) >> 25;
    157. 

  157.         $h4 += $carry3;
    158. 

  158.         $h3 -= $carry3 << 25;
    159. 

  159.         /** @var int $carry5 */
    160. 

  160.         $carry5 = ($h5 + (1 << 24)) >> 25;
    161. 

  161.         $h6 += $carry5;
    162. 

  162.         $h5 -= $carry5 << 25;
    163. 

  163.         /** @var int $carry7 */
    164. 

  164.         $carry7 = ($h7 + (1 << 24)) >> 25;
    165. 

  165.         $h8 += $carry7;
    166. 

  166.         $h7 -= $carry7 << 25;
    167. 

  167. 

  168.         /** @var int $carry0 */
    169. 

  169.         $carry0 = ($h0 + (1 << 25)) >> 26;
    170. 

  170.         $h1 += $carry0;
    171. 

  171.         $h0 -= $carry0 << 26;
    172. 

  172.         /** @var int $carry2 */
    173. 

  173.         $carry2 = ($h2 + (1 << 25)) >> 26;
    174. 

  174.         $h3 += $carry2;
    175. 

  175.         $h2 -= $carry2 << 26;
    176. 

  176.         /** @var int $carry4 */
    177. 

  177.         $carry4 = ($h4 + (1 << 25)) >> 26;
    178. 

  178.         $h5 += $carry4;
    179. 

  179.         $h4 -= $carry4 << 26;
    180. 

  180.         /** @var int $carry6 */
    181. 

  181.         $carry6 = ($h6 + (1 << 25)) >> 26;
    182. 

  182.         $h7 += $carry6;
    183. 

  183.         $h6 -= $carry6 << 26;
    184. 

  184.         /** @var int $carry8 */
    185. 

  185.         $carry8 = ($h8 + (1 << 25)) >> 26;
    186. 

  186.         $h9 += $carry8;
    187. 

  187.         $h8 -= $carry8 << 26;
    188. 

  188. 

  189.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
    190. 

  190.             array(
    191. 

  191.                 (int) $h0,
    192. 

  192.                 (int) $h1,
    193. 

  193.                 (int) $h2,
    194. 

  194.                 (int) $h3,
    195. 

  195.                 (int) $h4,
    196. 

  196.                 (int) $h5,
    197. 

  197.                 (int) $h6,
    198. 

  198.                 (int) $h7,
    199. 

  199.                 (int) $h8,
    200. 

  200.                 (int) $h9
    201. 

  201.             )
    202. 

  202.         );
    203. 

  203.     }
    204. 

  204. 

  205.     /**
    206. 

  206.      * Convert a field element to a byte string.
    207. 

  207.      *
    208. 

  208.      * @internal You should not use this directly from another application
    209. 

  209.      *
    210. 

  210.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $h
    211. 

  211.      * @return string
    212. 

  212.      */
    213. 

  213.     public static function fe_tobytes(ParagonIE_Sodium_Core_Curve25519_Fe $h)
    214. 

  214.     {
    215. 

  215.         /** @var int $h0 */
    216. 

  216.         $h0 = (int) $h[0];
    217. 

  217.         /** @var int $h1 */
    218. 

  218.         $h1 = (int) $h[1];
    219. 

  219.         /** @var int $h2 */
    220. 

  220.         $h2 = (int) $h[2];
    221. 

  221.         /** @var int $h3 */
    222. 

  222.         $h3 = (int) $h[3];
    223. 

  223.         /** @var int $h4 */
    224. 

  224.         $h4 = (int) $h[4];
    225. 

  225.         /** @var int $h5 */
    226. 

  226.         $h5 = (int) $h[5];
    227. 

  227.         /** @var int $h6 */
    228. 

  228.         $h6 = (int) $h[6];
    229. 

  229.         /** @var int $h7 */
    230. 

  230.         $h7 = (int) $h[7];
    231. 

  231.         /** @var int $h8 */
    232. 

  232.         $h8 = (int) $h[8];
    233. 

  233.         /** @var int $h9 */
    234. 

  234.         $h9 = (int) $h[9];
    235. 

  235. 

  236.         /** @var int $q */
    237. 

  237.         $q = (self::mul($h9, 19, 5) + (1 << 24)) >> 25;
    238. 

  238.         /** @var int $q */
    239. 

  239.         $q = ($h0 + $q) >> 26;
    240. 

  240.         /** @var int $q */
    241. 

  241.         $q = ($h1 + $q) >> 25;
    242. 

  242.         /** @var int $q */
    243. 

  243.         $q = ($h2 + $q) >> 26;
    244. 

  244.         /** @var int $q */
    245. 

  245.         $q = ($h3 + $q) >> 25;
    246. 

  246.         /** @var int $q */
    247. 

  247.         $q = ($h4 + $q) >> 26;
    248. 

  248.         /** @var int $q */
    249. 

  249.         $q = ($h5 + $q) >> 25;
    250. 

  250.         /** @var int $q */
    251. 

  251.         $q = ($h6 + $q) >> 26;
    252. 

  252.         /** @var int $q */
    253. 

  253.         $q = ($h7 + $q) >> 25;
    254. 

  254.         /** @var int $q */
    255. 

  255.         $q = ($h8 + $q) >> 26;
    256. 

  256.         /** @var int $q */
    257. 

  257.         $q = ($h9 + $q) >> 25;
    258. 

  258. 

  259.         $h0 += self::mul($q, 19, 5);
    260. 

  260. 

  261.         /** @var int $carry0 */
    262. 

  262.         $carry0 = $h0 >> 26;
    263. 

  263.         $h1 += $carry0;
    264. 

  264.         $h0 -= $carry0 << 26;
    265. 

  265.         /** @var int $carry1 */
    266. 

  266.         $carry1 = $h1 >> 25;
    267. 

  267.         $h2 += $carry1;
    268. 

  268.         $h1 -= $carry1 << 25;
    269. 

  269.         /** @var int $carry2 */
    270. 

  270.         $carry2 = $h2 >> 26;
    271. 

  271.         $h3 += $carry2;
    272. 

  272.         $h2 -= $carry2 << 26;
    273. 

  273.         /** @var int $carry3 */
    274. 

  274.         $carry3 = $h3 >> 25;
    275. 

  275.         $h4 += $carry3;
    276. 

  276.         $h3 -= $carry3 << 25;
    277. 

  277.         /** @var int $carry4 */
    278. 

  278.         $carry4 = $h4 >> 26;
    279. 

  279.         $h5 += $carry4;
    280. 

  280.         $h4 -= $carry4 << 26;
    281. 

  281.         /** @var int $carry5 */
    282. 

  282.         $carry5 = $h5 >> 25;
    283. 

  283.         $h6 += $carry5;
    284. 

  284.         $h5 -= $carry5 << 25;
    285. 

  285.         /** @var int $carry6 */
    286. 

  286.         $carry6 = $h6 >> 26;
    287. 

  287.         $h7 += $carry6;
    288. 

  288.         $h6 -= $carry6 << 26;
    289. 

  289.         /** @var int $carry7 */
    290. 

  290.         $carry7 = $h7 >> 25;
    291. 

  291.         $h8 += $carry7;
    292. 

  292.         $h7 -= $carry7 << 25;
    293. 

  293.         /** @var int $carry8 */
    294. 

  294.         $carry8 = $h8 >> 26;
    295. 

  295.         $h9 += $carry8;
    296. 

  296.         $h8 -= $carry8 << 26;
    297. 

  297.         /** @var int $carry9 */
    298. 

  298.         $carry9 = $h9 >> 25;
    299. 

  299.         $h9 -= $carry9 << 25;
    300. 

  300. 

  301.         /**
    302. 

  302.          * @var array<int, int>
    303. 

  303.          */
    304. 

  304.         $s = array(
    305. 

  305.             (int) (($h0 >> 0) & 0xff),
    306. 

  306.             (int) (($h0 >> 8) & 0xff),
    307. 

  307.             (int) (($h0 >> 16) & 0xff),
    308. 

  308.             (int) ((($h0 >> 24) | ($h1 << 2)) & 0xff),
    309. 

  309.             (int) (($h1 >> 6) & 0xff),
    310. 

  310.             (int) (($h1 >> 14) & 0xff),
    311. 

  311.             (int) ((($h1 >> 22) | ($h2 << 3)) & 0xff),
    312. 

  312.             (int) (($h2 >> 5) & 0xff),
    313. 

  313.             (int) (($h2 >> 13) & 0xff),
    314. 

  314.             (int) ((($h2 >> 21) | ($h3 << 5)) & 0xff),
    315. 

  315.             (int) (($h3 >> 3) & 0xff),
    316. 

  316.             (int) (($h3 >> 11) & 0xff),
    317. 

  317.             (int) ((($h3 >> 19) | ($h4 << 6)) & 0xff),
    318. 

  318.             (int) (($h4 >> 2) & 0xff),
    319. 

  319.             (int) (($h4 >> 10) & 0xff),
    320. 

  320.             (int) (($h4 >> 18) & 0xff),
    321. 

  321.             (int) (($h5 >> 0) & 0xff),
    322. 

  322.             (int) (($h5 >> 8) & 0xff),
    323. 

  323.             (int) (($h5 >> 16) & 0xff),
    324. 

  324.             (int) ((($h5 >> 24) | ($h6 << 1)) & 0xff),
    325. 

  325.             (int) (($h6 >> 7) & 0xff),
    326. 

  326.             (int) (($h6 >> 15) & 0xff),
    327. 

  327.             (int) ((($h6 >> 23) | ($h7 << 3)) & 0xff),
    328. 

  328.             (int) (($h7 >> 5) & 0xff),
    329. 

  329.             (int) (($h7 >> 13) & 0xff),
    330. 

  330.             (int) ((($h7 >> 21) | ($h8 << 4)) & 0xff),
    331. 

  331.             (int) (($h8 >> 4) & 0xff),
    332. 

  332.             (int) (($h8 >> 12) & 0xff),
    333. 

  333.             (int) ((($h8 >> 20) | ($h9 << 6)) & 0xff),
    334. 

  334.             (int) (($h9 >> 2) & 0xff),
    335. 

  335.             (int) (($h9 >> 10) & 0xff),
    336. 

  336.             (int) (($h9 >> 18) & 0xff)
    337. 

  337.         );
    338. 

  338.         return self::intArrayToString($s);
    339. 

  339.     }
    340. 

  340. 

  341.     /**
    342. 

  342.      * Is a field element negative? (1 = yes, 0 = no. Used in calculations.)
    343. 

  343.      *
    344. 

  344.      * @internal You should not use this directly from another application
    345. 

  345.      *
    346. 

  346.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    347. 

  347.      * @return int
    348. 

  348.      * @throws SodiumException
    349. 

  349.      * @throws TypeError
    350. 

  350.      */
    351. 

  351.     public static function fe_isnegative(ParagonIE_Sodium_Core_Curve25519_Fe $f)
    352. 

  352.     {
    353. 

  353.         $str = self::fe_tobytes($f);
    354. 

  354.         return (int) (self::chrToInt($str[0]) & 1);
    355. 

  355.     }
    356. 

  356. 

  357.     /**
    358. 

  358.      * Returns 0 if this field element results in all NUL bytes.
    359. 

  359.      *
    360. 

  360.      * @internal You should not use this directly from another application
    361. 

  361.      *
    362. 

  362.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    363. 

  363.      * @return bool
    364. 

  364.      * @throws SodiumException
    365. 

  365.      * @throws TypeError
    366. 

  366.      */
    367. 

  367.     public static function fe_isnonzero(ParagonIE_Sodium_Core_Curve25519_Fe $f)
    368. 

  368.     {
    369. 

  369.         static $zero;
    370. 

  370.         if ($zero === null) {
    371. 

  371.             $zero = str_repeat("\x00", 32);
    372. 

  372.         }
    373. 

  373.         /** @var string $zero */
    374. 

  374.         /** @var string $str */
    375. 

  375.         $str = self::fe_tobytes($f);
    376. 

  376.         return !self::verify_32($str, (string) $zero);
    377. 

  377.     }
    378. 

  378. 

  379.     /**
    380. 

  380.      * Multiply two field elements
    381. 

  381.      *
    382. 

  382.      * h = f * g
    383. 

  383.      *
    384. 

  384.      * @internal You should not use this directly from another application
    385. 

  385.      *
    386. 

  386.      * @security Is multiplication a source of timing leaks? If so, can we do
    387. 

  387.      *           anything to prevent that from happening?
    388. 

  388.      *
    389. 

  389.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    390. 

  390.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $g
    391. 

  391.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    392. 

  392.      */
    393. 

  393.     public static function fe_mul(
    394. 

  394.         ParagonIE_Sodium_Core_Curve25519_Fe $f,
    395. 

  395.         ParagonIE_Sodium_Core_Curve25519_Fe $g
    396. 

  396.     ) {
    397. 

  397.         /** @var int $f0 */
    398. 

  398.         $f0 = $f[0];
    399. 

  399.         /** @var int $f1 */
    400. 

  400.         $f1 = $f[1];
    401. 

  401.         /** @var int $f2 */
    402. 

  402.         $f2 = $f[2];
    403. 

  403.         /** @var int $f3 */
    404. 

  404.         $f3 = $f[3];
    405. 

  405.         /** @var int $f4 */
    406. 

  406.         $f4 = $f[4];
    407. 

  407.         /** @var int $f5 */
    408. 

  408.         $f5 = $f[5];
    409. 

  409.         /** @var int $f6 */
    410. 

  410.         $f6 = $f[6];
    411. 

  411.         /** @var int $f7 */
    412. 

  412.         $f7 = $f[7];
    413. 

  413.         /** @var int $f8 */
    414. 

  414.         $f8 = $f[8];
    415. 

  415.         /** @var int $f9 */
    416. 

  416.         $f9 = $f[9];
    417. 

  417.         /** @var int $g0 */
    418. 

  418.         $g0 = $g[0];
    419. 

  419.         /** @var int $g1 */
    420. 

  420.         $g1 = $g[1];
    421. 

  421.         /** @var int $g2 */
    422. 

  422.         $g2 = $g[2];
    423. 

  423.         /** @var int $g3 */
    424. 

  424.         $g3 = $g[3];
    425. 

  425.         /** @var int $g4 */
    426. 

  426.         $g4 = $g[4];
    427. 

  427.         /** @var int $g5 */
    428. 

  428.         $g5 = $g[5];
    429. 

  429.         /** @var int $g6 */
    430. 

  430.         $g6 = $g[6];
    431. 

  431.         /** @var int $g7 */
    432. 

  432.         $g7 = $g[7];
    433. 

  433.         /** @var int $g8 */
    434. 

  434.         $g8 = $g[8];
    435. 

  435.         /** @var int $g9 */
    436. 

  436.         $g9 = $g[9];
    437. 

  437.         $g1_19 = self::mul($g1, 19, 5);
    438. 

  438.         $g2_19 = self::mul($g2, 19, 5);
    439. 

  439.         $g3_19 = self::mul($g3, 19, 5);
    440. 

  440.         $g4_19 = self::mul($g4, 19, 5);
    441. 

  441.         $g5_19 = self::mul($g5, 19, 5);
    442. 

  442.         $g6_19 = self::mul($g6, 19, 5);
    443. 

  443.         $g7_19 = self::mul($g7, 19, 5);
    444. 

  444.         $g8_19 = self::mul($g8, 19, 5);
    445. 

  445.         $g9_19 = self::mul($g9, 19, 5);
    446. 

  446.         /** @var int $f1_2 */
    447. 

  447.         $f1_2 = $f1 << 1;
    448. 

  448.         /** @var int $f3_2 */
    449. 

  449.         $f3_2 = $f3 << 1;
    450. 

  450.         /** @var int $f5_2 */
    451. 

  451.         $f5_2 = $f5 << 1;
    452. 

  452.         /** @var int $f7_2 */
    453. 

  453.         $f7_2 = $f7 << 1;
    454. 

  454.         /** @var int $f9_2 */
    455. 

  455.         $f9_2 = $f9 << 1;
    456. 

  456.         $f0g0    = self::mul($f0,    $g0, 26);
    457. 

  457.         $f0g1    = self::mul($f0,    $g1, 25);
    458. 

  458.         $f0g2    = self::mul($f0,    $g2, 26);
    459. 

  459.         $f0g3    = self::mul($f0,    $g3, 25);
    460. 

  460.         $f0g4    = self::mul($f0,    $g4, 26);
    461. 

  461.         $f0g5    = self::mul($f0,    $g5, 25);
    462. 

  462.         $f0g6    = self::mul($f0,    $g6, 26);
    463. 

  463.         $f0g7    = self::mul($f0,    $g7, 25);
    464. 

  464.         $f0g8    = self::mul($f0,    $g8, 26);
    465. 

  465.         $f0g9    = self::mul($f0,    $g9, 26);
    466. 

  466.         $f1g0    = self::mul($f1,    $g0, 26);
    467. 

  467.         $f1g1_2  = self::mul($f1_2,  $g1, 25);
    468. 

  468.         $f1g2    = self::mul($f1,    $g2, 26);
    469. 

  469.         $f1g3_2  = self::mul($f1_2,  $g3, 25);
    470. 

  470.         $f1g4    = self::mul($f1,    $g4, 26);
    471. 

  471.         $f1g5_2  = self::mul($f1_2,  $g5, 25);
    472. 

  472.         $f1g6    = self::mul($f1,    $g6, 26);
    473. 

  473.         $f1g7_2  = self::mul($f1_2,  $g7, 25);
    474. 

  474.         $f1g8    = self::mul($f1,    $g8, 26);
    475. 

  475.         $f1g9_38 = self::mul($g9_19, $f1_2, 26);
    476. 

  476.         $f2g0    = self::mul($f2,    $g0, 26);
    477. 

  477.         $f2g1    = self::mul($f2,    $g1, 25);
    478. 

  478.         $f2g2    = self::mul($f2,    $g2, 26);
    479. 

  479.         $f2g3    = self::mul($f2,    $g3, 25);
    480. 

  480.         $f2g4    = self::mul($f2,    $g4, 26);
    481. 

  481.         $f2g5    = self::mul($f2,    $g5, 25);
    482. 

  482.         $f2g6    = self::mul($f2,    $g6, 26);
    483. 

  483.         $f2g7    = self::mul($f2,    $g7, 25);
    484. 

  484.         $f2g8_19 = self::mul($g8_19, $f2, 26);
    485. 

  485.         $f2g9_19 = self::mul($g9_19, $f2, 26);
    486. 

  486.         $f3g0    = self::mul($f3,    $g0, 26);
    487. 

  487.         $f3g1_2  = self::mul($f3_2,  $g1, 25);
    488. 

  488.         $f3g2    = self::mul($f3,    $g2, 26);
    489. 

  489.         $f3g3_2  = self::mul($f3_2,  $g3, 25);
    490. 

  490.         $f3g4    = self::mul($f3,    $g4, 26);
    491. 

  491.         $f3g5_2  = self::mul($f3_2,  $g5, 25);
    492. 

  492.         $f3g6    = self::mul($f3,    $g6, 26);
    493. 

  493.         $f3g7_38 = self::mul($g7_19, $f3_2, 26);
    494. 

  494.         $f3g8_19 = self::mul($g8_19, $f3, 25);
    495. 

  495.         $f3g9_38 = self::mul($g9_19, $f3_2, 26);
    496. 

  496.         $f4g0    = self::mul($f4,    $g0, 26);
    497. 

  497.         $f4g1    = self::mul($f4,    $g1, 25);
    498. 

  498.         $f4g2    = self::mul($f4,    $g2, 26);
    499. 

  499.         $f4g3    = self::mul($f4,    $g3, 25);
    500. 

  500.         $f4g4    = self::mul($f4,    $g4, 26);
    501. 

  501.         $f4g5    = self::mul($f4,    $g5, 25);
    502. 

  502.         $f4g6_19 = self::mul($g6_19, $f4, 26);
    503. 

  503.         $f4g7_19 = self::mul($g7_19, $f4, 26);
    504. 

  504.         $f4g8_19 = self::mul($g8_19, $f4, 26);
    505. 

  505.         $f4g9_19 = self::mul($g9_19, $f4, 26);
    506. 

  506.         $f5g0    = self::mul($f5,    $g0, 26);
    507. 

  507.         $f5g1_2  = self::mul($f5_2,  $g1, 25);
    508. 

  508.         $f5g2    = self::mul($f5,    $g2, 26);
    509. 

  509.         $f5g3_2  = self::mul($f5_2,  $g3, 25);
    510. 

  510.         $f5g4    = self::mul($f5,    $g4, 26);
    511. 

  511.         $f5g5_38 = self::mul($g5_19, $f5_2, 26);
    512. 

  512.         $f5g6_19 = self::mul($g6_19, $f5, 25);
    513. 

  513.         $f5g7_38 = self::mul($g7_19, $f5_2, 26);
    514. 

  514.         $f5g8_19 = self::mul($g8_19, $f5, 25);
    515. 

  515.         $f5g9_38 = self::mul($g9_19, $f5_2, 26);
    516. 

  516.         $f6g0    = self::mul($f6,    $g0, 26);
    517. 

  517.         $f6g1    = self::mul($f6,    $g1, 25);
    518. 

  518.         $f6g2    = self::mul($f6,    $g2, 26);
    519. 

  519.         $f6g3    = self::mul($f6,    $g3, 25);
    520. 

  520.         $f6g4_19 = self::mul($g4_19, $f6, 26);
    521. 

  521.         $f6g5_19 = self::mul($g5_19, $f6, 26);
    522. 

  522.         $f6g6_19 = self::mul($g6_19, $f6, 26);
    523. 

  523.         $f6g7_19 = self::mul($g7_19, $f6, 26);
    524. 

  524.         $f6g8_19 = self::mul($g8_19, $f6, 26);
    525. 

  525.         $f6g9_19 = self::mul($g9_19, $f6, 26);
    526. 

  526.         $f7g0    = self::mul($f7,    $g0, 26);
    527. 

  527.         $f7g1_2  = self::mul($f7_2,  $g1, 25);
    528. 

  528.         $f7g2    = self::mul($f7,    $g2, 26);
    529. 

  529.         $f7g3_38 = self::mul($g3_19, $f7_2, 26);
    530. 

  530.         $f7g4_19 = self::mul($g4_19, $f7, 26);
    531. 

  531.         $f7g5_38 = self::mul($g5_19, $f7_2, 26);
    532. 

  532.         $f7g6_19 = self::mul($g6_19, $f7, 25);
    533. 

  533.         $f7g7_38 = self::mul($g7_19, $f7_2, 26);
    534. 

  534.         $f7g8_19 = self::mul($g8_19, $f7, 25);
    535. 

  535.         $f7g9_38 = self::mul($g9_19,$f7_2, 26);
    536. 

  536.         $f8g0    = self::mul($f8,    $g0, 26);
    537. 

  537.         $f8g1    = self::mul($f8,    $g1, 25);
    538. 

  538.         $f8g2_19 = self::mul($g2_19, $f8, 26);
    539. 

  539.         $f8g3_19 = self::mul($g3_19, $f8, 26);
    540. 

  540.         $f8g4_19 = self::mul($g4_19, $f8, 26);
    541. 

  541.         $f8g5_19 = self::mul($g5_19, $f8, 26);
    542. 

  542.         $f8g6_19 = self::mul($g6_19, $f8, 26);
    543. 

  543.         $f8g7_19 = self::mul($g7_19, $f8, 26);
    544. 

  544.         $f8g8_19 = self::mul($g8_19, $f8, 26);
    545. 

  545.         $f8g9_19 = self::mul($g9_19, $f8, 26);
    546. 

  546.         $f9g0    = self::mul($f9,    $g0, 26);
    547. 

  547.         $f9g1_38 = self::mul($g1_19, $f9_2, 26);
    548. 

  548.         $f9g2_19 = self::mul($g2_19, $f9, 25);
    549. 

  549.         $f9g3_38 = self::mul($g3_19, $f9_2, 26);
    550. 

  550.         $f9g4_19 = self::mul($g4_19, $f9, 25);
    551. 

  551.         $f9g5_38 = self::mul($g5_19, $f9_2, 26);
    552. 

  552.         $f9g6_19 = self::mul($g6_19, $f9, 25);
    553. 

  553.         $f9g7_38 = self::mul($g7_19, $f9_2, 26);
    554. 

  554.         $f9g8_19 = self::mul($g8_19, $f9, 25);
    555. 

  555.         $f9g9_38 = self::mul($g9_19, $f9_2, 26);
    556. 

  556.         $h0 = $f0g0 + $f1g9_38 + $f2g8_19 + $f3g7_38 + $f4g6_19 + $f5g5_38 + $f6g4_19 + $f7g3_38 + $f8g2_19 + $f9g1_38;
    557. 

  557.         $h1 = $f0g1 + $f1g0    + $f2g9_19 + $f3g8_19 + $f4g7_19 + $f5g6_19 + $f6g5_19 + $f7g4_19 + $f8g3_19 + $f9g2_19;
    558. 

  558.         $h2 = $f0g2 + $f1g1_2  + $f2g0    + $f3g9_38 + $f4g8_19 + $f5g7_38 + $f6g6_19 + $f7g5_38 + $f8g4_19 + $f9g3_38;
    559. 

  559.         $h3 = $f0g3 + $f1g2    + $f2g1    + $f3g0    + $f4g9_19 + $f5g8_19 + $f6g7_19 + $f7g6_19 + $f8g5_19 + $f9g4_19;
    560. 

  560.         $h4 = $f0g4 + $f1g3_2  + $f2g2    + $f3g1_2  + $f4g0    + $f5g9_38 + $f6g8_19 + $f7g7_38 + $f8g6_19 + $f9g5_38;
    561. 

  561.         $h5 = $f0g5 + $f1g4    + $f2g3    + $f3g2    + $f4g1    + $f5g0    + $f6g9_19 + $f7g8_19 + $f8g7_19 + $f9g6_19;
    562. 

  562.         $h6 = $f0g6 + $f1g5_2  + $f2g4    + $f3g3_2  + $f4g2    + $f5g1_2  + $f6g0    + $f7g9_38 + $f8g8_19 + $f9g7_38;
    563. 

  563.         $h7 = $f0g7 + $f1g6    + $f2g5    + $f3g4    + $f4g3    + $f5g2    + $f6g1    + $f7g0    + $f8g9_19 + $f9g8_19;
    564. 

  564.         $h8 = $f0g8 + $f1g7_2  + $f2g6    + $f3g5_2  + $f4g4    + $f5g3_2  + $f6g2    + $f7g1_2  + $f8g0    + $f9g9_38;
    565. 

  565.         $h9 = $f0g9 + $f1g8    + $f2g7    + $f3g6    + $f4g5    + $f5g4    + $f6g3    + $f7g2    + $f8g1    + $f9g0   ;
    566. 

  566. 

  567.         /** @var int $carry0 */
    568. 

  568.         $carry0 = ($h0 + (1 << 25)) >> 26;
    569. 

  569.         $h1 += $carry0;
    570. 

  570.         $h0 -= $carry0 << 26;
    571. 

  571.         /** @var int $carry4 */
    572. 

  572.         $carry4 = ($h4 + (1 << 25)) >> 26;
    573. 

  573.         $h5 += $carry4;
    574. 

  574.         $h4 -= $carry4 << 26;
    575. 

  575. 

  576.         /** @var int $carry1 */
    577. 

  577.         $carry1 = ($h1 + (1 << 24)) >> 25;
    578. 

  578.         $h2 += $carry1;
    579. 

  579.         $h1 -= $carry1 << 25;
    580. 

  580.         /** @var int $carry5 */
    581. 

  581.         $carry5 = ($h5 + (1 << 24)) >> 25;
    582. 

  582.         $h6 += $carry5;
    583. 

  583.         $h5 -= $carry5 << 25;
    584. 

  584. 

  585.         /** @var int $carry2 */
    586. 

  586.         $carry2 = ($h2 + (1 << 25)) >> 26;
    587. 

  587.         $h3 += $carry2;
    588. 

  588.         $h2 -= $carry2 << 26;
    589. 

  589.         /** @var int $carry6 */
    590. 

  590.         $carry6 = ($h6 + (1 << 25)) >> 26;
    591. 

  591.         $h7 += $carry6;
    592. 

  592.         $h6 -= $carry6 << 26;
    593. 

  593. 

  594.         /** @var int $carry3 */
    595. 

  595.         $carry3 = ($h3 + (1 << 24)) >> 25;
    596. 

  596.         $h4 += $carry3;
    597. 

  597.         $h3 -= $carry3 << 25;
    598. 

  598.         /** @var int $carry7 */
    599. 

  599.         $carry7 = ($h7 + (1 << 24)) >> 25;
    600. 

  600.         $h8 += $carry7;
    601. 

  601.         $h7 -= $carry7 << 25;
    602. 

  602. 

  603.         /** @var int $carry4 */
    604. 

  604.         $carry4 = ($h4 + (1 << 25)) >> 26;
    605. 

  605.         $h5 += $carry4;
    606. 

  606.         $h4 -= $carry4 << 26;
    607. 

  607.         /** @var int $carry8 */
    608. 

  608.         $carry8 = ($h8 + (1 << 25)) >> 26;
    609. 

  609.         $h9 += $carry8;
    610. 

  610.         $h8 -= $carry8 << 26;
    611. 

  611. 

  612.         /** @var int $carry9 */
    613. 

  613.         $carry9 = ($h9 + (1 << 24)) >> 25;
    614. 

  614.         $h0 += self::mul($carry9, 19, 5);
    615. 

  615.         $h9 -= $carry9 << 25;
    616. 

  616. 

  617.         /** @var int $carry0 */
    618. 

  618.         $carry0 = ($h0 + (1 << 25)) >> 26;
    619. 

  619.         $h1 += $carry0;
    620. 

  620.         $h0 -= $carry0 << 26;
    621. 

  621. 

  622.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
    623. 

  623.             array(
    624. 

  624.                 (int) $h0,
    625. 

  625.                 (int) $h1,
    626. 

  626.                 (int) $h2,
    627. 

  627.                 (int) $h3,
    628. 

  628.                 (int) $h4,
    629. 

  629.                 (int) $h5,
    630. 

  630.                 (int) $h6,
    631. 

  631.                 (int) $h7,
    632. 

  632.                 (int) $h8,
    633. 

  633.                 (int) $h9
    634. 

  634.             )
    635. 

  635.         );
    636. 

  636.     }
    637. 

  637. 

  638.     /**
    639. 

  639.      * Get the negative values for each piece of the field element.
    640. 

  640.      *
    641. 

  641.      * h = -f
    642. 

  642.      *
    643. 

  643.      * @internal You should not use this directly from another application
    644. 

  644.      *
    645. 

  645.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    646. 

  646.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    647. 

  647.      * @psalm-suppress MixedAssignment
    648. 

  648.      */
    649. 

  649.     public static function fe_neg(ParagonIE_Sodium_Core_Curve25519_Fe $f)
    650. 

  650.     {
    651. 

  651.         $h = new ParagonIE_Sodium_Core_Curve25519_Fe();
    652. 

  652.         for ($i = 0; $i < 10; ++$i) {
    653. 

  653.             $h[$i] = -$f[$i];
    654. 

  654.         }
    655. 

  655.         return $h;
    656. 

  656.     }
    657. 

  657. 

  658.     /**
    659. 

  659.      * Square a field element
    660. 

  660.      *
    661. 

  661.      * h = f * f
    662. 

  662.      *
    663. 

  663.      * @internal You should not use this directly from another application
    664. 

  664.      *
    665. 

  665.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    666. 

  666.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    667. 

  667.      */
    668. 

  668.     public static function fe_sq(ParagonIE_Sodium_Core_Curve25519_Fe $f)
    669. 

  669.     {
    670. 

  670.         $f0 = (int) $f[0];
    671. 

  671.         $f1 = (int) $f[1];
    672. 

  672.         $f2 = (int) $f[2];
    673. 

  673.         $f3 = (int) $f[3];
    674. 

  674.         $f4 = (int) $f[4];
    675. 

  675.         $f5 = (int) $f[5];
    676. 

  676.         $f6 = (int) $f[6];
    677. 

  677.         $f7 = (int) $f[7];
    678. 

  678.         $f8 = (int) $f[8];
    679. 

  679.         $f9 = (int) $f[9];
    680. 

  680. 

  681.         /** @var int $f0_2 */
    682. 

  682.         $f0_2 = $f0 << 1;
    683. 

  683.         /** @var int $f1_2 */
    684. 

  684.         $f1_2 = $f1 << 1;
    685. 

  685.         /** @var int $f2_2 */
    686. 

  686.         $f2_2 = $f2 << 1;
    687. 

  687.         /** @var int $f3_2 */
    688. 

  688.         $f3_2 = $f3 << 1;
    689. 

  689.         /** @var int $f4_2 */
    690. 

  690.         $f4_2 = $f4 << 1;
    691. 

  691.         /** @var int $f5_2 */
    692. 

  692.         $f5_2 = $f5 << 1;
    693. 

  693.         /** @var int $f6_2 */
    694. 

  694.         $f6_2 = $f6 << 1;
    695. 

  695.         /** @var int $f7_2 */
    696. 

  696.         $f7_2 = $f7 << 1;
    697. 

  697.         $f5_38 = self::mul($f5, 38, 6);
    698. 

  698.         $f6_19 = self::mul($f6, 19, 5);
    699. 

  699.         $f7_38 = self::mul($f7, 38, 6);
    700. 

  700.         $f8_19 = self::mul($f8, 19, 5);
    701. 

  701.         $f9_38 = self::mul($f9, 38, 6);
    702. 

  702.         $f0f0    = self::mul($f0,    $f0,    25);
    703. 

  703.         $f0f1_2  = self::mul($f0_2,  $f1,    24);
    704. 

  704.         $f0f2_2  = self::mul($f0_2,  $f2,    25);
    705. 

  705.         $f0f3_2  = self::mul($f0_2,  $f3,    24);
    706. 

  706.         $f0f4_2  = self::mul($f0_2,  $f4,    25);
    707. 

  707.         $f0f5_2  = self::mul($f0_2,  $f5,    25);
    708. 

  708.         $f0f6_2  = self::mul($f0_2,  $f6,    25);
    709. 

  709.         $f0f7_2  = self::mul($f0_2,  $f7,    24);
    710. 

  710.         $f0f8_2  = self::mul($f0_2,  $f8,    25);
    711. 

  711.         $f0f9_2  = self::mul($f0_2,  $f9,    25);
    712. 

  712.         $f1f1_2  = self::mul($f1_2,  $f1,    24);
    713. 

  713.         $f1f2_2  = self::mul($f1_2,  $f2,    25);
    714. 

  714.         $f1f3_4  = self::mul($f1_2,  $f3_2,  25);
    715. 

  715.         $f1f4_2  = self::mul($f1_2,  $f4,    25);
    716. 

  716.         $f1f5_4  = self::mul($f1_2,  $f5_2,  26);
    717. 

  717.         $f1f6_2  = self::mul($f1_2,  $f6,    25);
    718. 

  718.         $f1f7_4  = self::mul($f1_2,  $f7_2,  25);
    719. 

  719.         $f1f8_2  = self::mul($f1_2,  $f8,    25);
    720. 

  720.         $f1f9_76 = self::mul($f9_38, $f1_2,  25);
    721. 

  721.         $f2f2    = self::mul($f2,    $f2,    25);
    722. 

  722.         $f2f3_2  = self::mul($f2_2,  $f3,    24);
    723. 

  723.         $f2f4_2  = self::mul($f2_2,  $f4,    25);
    724. 

  724.         $f2f5_2  = self::mul($f2_2,  $f5,    25);
    725. 

  725.         $f2f6_2  = self::mul($f2_2,  $f6,    25);
    726. 

  726.         $f2f7_2  = self::mul($f2_2,  $f7,    24);
    727. 

  727.         $f2f8_38 = self::mul($f8_19, $f2_2,  26);
    728. 

  728.         $f2f9_38 = self::mul($f9_38, $f2,    25);
    729. 

  729.         $f3f3_2  = self::mul($f3_2,  $f3,    24);
    730. 

  730.         $f3f4_2  = self::mul($f3_2,  $f4,    25);
    731. 

  731.         $f3f5_4  = self::mul($f3_2,  $f5_2,  26);
    732. 

  732.         $f3f6_2  = self::mul($f3_2,  $f6,    25);
    733. 

  733.         $f3f7_76 = self::mul($f7_38, $f3_2,  25);
    734. 

  734.         $f3f8_38 = self::mul($f8_19, $f3_2,  25);
    735. 

  735.         $f3f9_76 = self::mul($f9_38, $f3_2,  25);
    736. 

  736.         $f4f4    = self::mul($f4,    $f4,    25);
    737. 

  737.         $f4f5_2  = self::mul($f4_2,  $f5,    25);
    738. 

  738.         $f4f6_38 = self::mul($f6_19, $f4_2,  26);
    739. 

  739.         $f4f7_38 = self::mul($f7_38, $f4,    25);
    740. 

  740.         $f4f8_38 = self::mul($f8_19, $f4_2,  26);
    741. 

  741.         $f4f9_38 = self::mul($f9_38, $f4,    25);
    742. 

  742.         $f5f5_38 = self::mul($f5_38, $f5,    25);
    743. 

  743.         $f5f6_38 = self::mul($f6_19, $f5_2,  26);
    744. 

  744.         $f5f7_76 = self::mul($f7_38, $f5_2,  26);
    745. 

  745.         $f5f8_38 = self::mul($f8_19, $f5_2,  26);
    746. 

  746.         $f5f9_76 = self::mul($f9_38, $f5_2,  26);
    747. 

  747.         $f6f6_19 = self::mul($f6_19, $f6,    25);
    748. 

  748.         $f6f7_38 = self::mul($f7_38, $f6,    25);
    749. 

  749.         $f6f8_38 = self::mul($f8_19, $f6_2,  26);
    750. 

  750.         $f6f9_38 = self::mul($f9_38, $f6,    25);
    751. 

  751.         $f7f7_38 = self::mul($f7_38, $f7,    24);
    752. 

  752.         $f7f8_38 = self::mul($f8_19, $f7_2,  25);
    753. 

  753.         $f7f9_76 = self::mul($f9_38, $f7_2,  25);
    754. 

  754.         $f8f8_19 = self::mul($f8_19, $f8,    25);
    755. 

  755.         $f8f9_38 = self::mul($f9_38, $f8,    25);
    756. 

  756.         $f9f9_38 = self::mul($f9_38, $f9,    25);
    757. 

  757.         $h0 = $f0f0   + $f1f9_76 + $f2f8_38 + $f3f7_76 + $f4f6_38 + $f5f5_38;
    758. 

  758.         $h1 = $f0f1_2 + $f2f9_38 + $f3f8_38 + $f4f7_38 + $f5f6_38;
    759. 

  759.         $h2 = $f0f2_2 + $f1f1_2  + $f3f9_76 + $f4f8_38 + $f5f7_76 + $f6f6_19;
    760. 

  760.         $h3 = $f0f3_2 + $f1f2_2  + $f4f9_38 + $f5f8_38 + $f6f7_38;
    761. 

  761.         $h4 = $f0f4_2 + $f1f3_4  + $f2f2    + $f5f9_76 + $f6f8_38 + $f7f7_38;
    762. 

  762.         $h5 = $f0f5_2 + $f1f4_2  + $f2f3_2  + $f6f9_38 + $f7f8_38;
    763. 

  763.         $h6 = $f0f6_2 + $f1f5_4  + $f2f4_2  + $f3f3_2  + $f7f9_76 + $f8f8_19;
    764. 

  764.         $h7 = $f0f7_2 + $f1f6_2  + $f2f5_2  + $f3f4_2  + $f8f9_38;
    765. 

  765.         $h8 = $f0f8_2 + $f1f7_4  + $f2f6_2  + $f3f5_4  + $f4f4    + $f9f9_38;
    766. 

  766.         $h9 = $f0f9_2 + $f1f8_2  + $f2f7_2  + $f3f6_2  + $f4f5_2;
    767. 

  767. 

  768.         /** @var int $carry0 */
    769. 

  769.         $carry0 = ($h0 + (1 << 25)) >> 26;
    770. 

  770.         $h1 += $carry0;
    771. 

  771.         $h0 -= $carry0 << 26;
    772. 

  772.         /** @var int $carry4 */
    773. 

  773.         $carry4 = ($h4 + (1 << 25)) >> 26;
    774. 

  774.         $h5 += $carry4;
    775. 

  775.         $h4 -= $carry4 << 26;
    776. 

  776. 

  777.         /** @var int $carry1 */
    778. 

  778.         $carry1 = ($h1 + (1 << 24)) >> 25;
    779. 

  779.         $h2 += $carry1;
    780. 

  780.         $h1 -= $carry1 << 25;
    781. 

  781.         /** @var int $carry5 */
    782. 

  782.         $carry5 = ($h5 + (1 << 24)) >> 25;
    783. 

  783.         $h6 += $carry5;
    784. 

  784.         $h5 -= $carry5 << 25;
    785. 

  785. 

  786.         /** @var int $carry2 */
    787. 

  787.         $carry2 = ($h2 + (1 << 25)) >> 26;
    788. 

  788.         $h3 += $carry2;
    789. 

  789.         $h2 -= $carry2 << 26;
    790. 

  790.         /** @var int $carry6 */
    791. 

  791.         $carry6 = ($h6 + (1 << 25)) >> 26;
    792. 

  792.         $h7 += $carry6;
    793. 

  793.         $h6 -= $carry6 << 26;
    794. 

  794. 

  795.         /** @var int $carry3 */
    796. 

  796.         $carry3 = ($h3 + (1 << 24)) >> 25;
    797. 

  797.         $h4 += $carry3;
    798. 

  798.         $h3 -= $carry3 << 25;
    799. 

  799.         /** @var int $carry7 */
    800. 

  800.         $carry7 = ($h7 + (1 << 24)) >> 25;
    801. 

  801.         $h8 += $carry7;
    802. 

  802.         $h7 -= $carry7 << 25;
    803. 

  803. 

  804.         /** @var int $carry4 */
    805. 

  805.         $carry4 = ($h4 + (1 << 25)) >> 26;
    806. 

  806.         $h5 += $carry4;
    807. 

  807.         $h4 -= $carry4 << 26;
    808. 

  808.         /** @var int $carry8 */
    809. 

  809.         $carry8 = ($h8 + (1 << 25)) >> 26;
    810. 

  810.         $h9 += $carry8;
    811. 

  811.         $h8 -= $carry8 << 26;
    812. 

  812. 

  813.         /** @var int $carry9 */
    814. 

  814.         $carry9 = ($h9 + (1 << 24)) >> 25;
    815. 

  815.         $h0 += self::mul($carry9, 19, 5);
    816. 

  816.         $h9 -= $carry9 << 25;
    817. 

  817. 

  818.         /** @var int $carry0 */
    819. 

  819.         $carry0 = ($h0 + (1 << 25)) >> 26;
    820. 

  820.         $h1 += $carry0;
    821. 

  821.         $h0 -= $carry0 << 26;
    822. 

  822. 

  823.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
    824. 

  824.             array(
    825. 

  825.                 (int) $h0,
    826. 

  826.                 (int) $h1,
    827. 

  827.                 (int) $h2,
    828. 

  828.                 (int) $h3,
    829. 

  829.                 (int) $h4,
    830. 

  830.                 (int) $h5,
    831. 

  831.                 (int) $h6,
    832. 

  832.                 (int) $h7,
    833. 

  833.                 (int) $h8,
    834. 

  834.                 (int) $h9
    835. 

  835.             )
    836. 

  836.         );
    837. 

  837.     }
    838. 

  838. 

  839. 

  840.     /**
    841. 

  841.      * Square and double a field element
    842. 

  842.      *
    843. 

  843.      * h = 2 * f * f
    844. 

  844.      *
    845. 

  845.      * @internal You should not use this directly from another application
    846. 

  846.      *
    847. 

  847.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    848. 

  848.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    849. 

  849.      */
    850. 

  850.     public static function fe_sq2(ParagonIE_Sodium_Core_Curve25519_Fe $f)
    851. 

  851.     {
    852. 

  852.         $f0 = (int) $f[0];
    853. 

  853.         $f1 = (int) $f[1];
    854. 

  854.         $f2 = (int) $f[2];
    855. 

  855.         $f3 = (int) $f[3];
    856. 

  856.         $f4 = (int) $f[4];
    857. 

  857.         $f5 = (int) $f[5];
    858. 

  858.         $f6 = (int) $f[6];
    859. 

  859.         $f7 = (int) $f[7];
    860. 

  860.         $f8 = (int) $f[8];
    861. 

  861.         $f9 = (int) $f[9];
    862. 

  862. 

  863.         /** @var int $f0_2 */
    864. 

  864.         $f0_2 = $f0 << 1;
    865. 

  865.         /** @var int $f1_2 */
    866. 

  866.         $f1_2 = $f1 << 1;
    867. 

  867.         /** @var int $f2_2 */
    868. 

  868.         $f2_2 = $f2 << 1;
    869. 

  869.         /** @var int $f3_2 */
    870. 

  870.         $f3_2 = $f3 << 1;
    871. 

  871.         /** @var int $f4_2 */
    872. 

  872.         $f4_2 = $f4 << 1;
    873. 

  873.         /** @var int $f5_2 */
    874. 

  874.         $f5_2 = $f5 << 1;
    875. 

  875.         /** @var int $f6_2 */
    876. 

  876.         $f6_2 = $f6 << 1;
    877. 

  877.         /** @var int $f7_2 */
    878. 

  878.         $f7_2 = $f7 << 1;
    879. 

  879.         $f5_38 = self::mul($f5, 38, 6); /* 1.959375*2^30 */
    880. 

  880.         $f6_19 = self::mul($f6, 19, 5); /* 1.959375*2^30 */
    881. 

  881.         $f7_38 = self::mul($f7, 38, 6); /* 1.959375*2^30 */
    882. 

  882.         $f8_19 = self::mul($f8, 19, 5); /* 1.959375*2^30 */
    883. 

  883.         $f9_38 = self::mul($f9, 38, 6); /* 1.959375*2^30 */
    884. 

  884.         $f0f0 = self::mul($f0, $f0, 24);
    885. 

  885.         $f0f1_2 = self::mul($f0_2, $f1, 24);
    886. 

  886.         $f0f2_2 = self::mul($f0_2, $f2, 24);
    887. 

  887.         $f0f3_2 = self::mul($f0_2, $f3, 24);
    888. 

  888.         $f0f4_2 = self::mul($f0_2, $f4, 24);
    889. 

  889.         $f0f5_2 = self::mul($f0_2, $f5, 24);
    890. 

  890.         $f0f6_2 = self::mul($f0_2, $f6, 24);
    891. 

  891.         $f0f7_2 = self::mul($f0_2, $f7, 24);
    892. 

  892.         $f0f8_2 = self::mul($f0_2, $f8, 24);
    893. 

  893.         $f0f9_2 = self::mul($f0_2, $f9, 24);
    894. 

  894.         $f1f1_2 = self::mul($f1_2,  $f1, 24);
    895. 

  895.         $f1f2_2 = self::mul($f1_2,  $f2, 24);
    896. 

  896.         $f1f3_4 = self::mul($f1_2,  $f3_2, 24);
    897. 

  897.         $f1f4_2 = self::mul($f1_2,  $f4, 24);
    898. 

  898.         $f1f5_4 = self::mul($f1_2,  $f5_2, 24);
    899. 

  899.         $f1f6_2 = self::mul($f1_2,  $f6, 24);
    900. 

  900.         $f1f7_4 = self::mul($f1_2,  $f7_2, 24);
    901. 

  901.         $f1f8_2 = self::mul($f1_2,  $f8, 24);
    902. 

  902.         $f1f9_76 = self::mul($f9_38, $f1_2, 24);
    903. 

  903.         $f2f2 = self::mul($f2,  $f2, 24);
    904. 

  904.         $f2f3_2 = self::mul($f2_2,  $f3, 24);
    905. 

  905.         $f2f4_2 = self::mul($f2_2,  $f4, 24);
    906. 

  906.         $f2f5_2 = self::mul($f2_2,  $f5, 24);
    907. 

  907.         $f2f6_2 = self::mul($f2_2,  $f6, 24);
    908. 

  908.         $f2f7_2 = self::mul($f2_2,  $f7, 24);
    909. 

  909.         $f2f8_38 = self::mul($f8_19, $f2_2, 25);
    910. 

  910.         $f2f9_38 = self::mul($f9_38, $f2, 24);
    911. 

  911.         $f3f3_2 = self::mul($f3_2,  $f3, 24);
    912. 

  912.         $f3f4_2 = self::mul($f3_2,  $f4, 24);
    913. 

  913.         $f3f5_4 = self::mul($f3_2,  $f5_2, 24);
    914. 

  914.         $f3f6_2 = self::mul($f3_2,  $f6, 24);
    915. 

  915.         $f3f7_76 = self::mul($f7_38, $f3_2, 24);
    916. 

  916.         $f3f8_38 = self::mul($f8_19, $f3_2, 24);
    917. 

  917.         $f3f9_76 = self::mul($f9_38, $f3_2, 24);
    918. 

  918.         $f4f4 = self::mul($f4,  $f4, 24);
    919. 

  919.         $f4f5_2 = self::mul($f4_2,  $f5, 24);
    920. 

  920.         $f4f6_38 = self::mul($f6_19, $f4_2, 25);
    921. 

  921.         $f4f7_38 = self::mul($f7_38, $f4, 24);
    922. 

  922.         $f4f8_38 = self::mul($f8_19, $f4_2, 25);
    923. 

  923.         $f4f9_38 = self::mul($f9_38, $f4, 24);
    924. 

  924.         $f5f5_38 = self::mul($f5_38, $f5, 24);
    925. 

  925.         $f5f6_38 = self::mul($f6_19, $f5_2, 24);
    926. 

  926.         $f5f7_76 = self::mul($f7_38, $f5_2, 24);
    927. 

  927.         $f5f8_38 = self::mul($f8_19, $f5_2, 24);
    928. 

  928.         $f5f9_76 = self::mul($f9_38, $f5_2, 24);
    929. 

  929.         $f6f6_19 = self::mul($f6_19, $f6, 24);
    930. 

  930.         $f6f7_38 = self::mul($f7_38, $f6, 24);
    931. 

  931.         $f6f8_38 = self::mul($f8_19, $f6_2, 25);
    932. 

  932.         $f6f9_38 = self::mul($f9_38, $f6, 24);
    933. 

  933.         $f7f7_38 = self::mul($f7_38, $f7, 24);
    934. 

  934.         $f7f8_38 = self::mul($f8_19, $f7_2, 24);
    935. 

  935.         $f7f9_76 = self::mul($f9_38, $f7_2, 24);
    936. 

  936.         $f8f8_19 = self::mul($f8_19, $f8, 24);
    937. 

  937.         $f8f9_38 = self::mul($f9_38, $f8, 24);
    938. 

  938.         $f9f9_38 = self::mul($f9_38, $f9, 24);
    939. 

  939. 

  940.         /** @var int $h0 */
    941. 

  941.         $h0 = (int) ($f0f0 + $f1f9_76 + $f2f8_38 + $f3f7_76 + $f4f6_38 + $f5f5_38) << 1;
    942. 

  942.         /** @var int $h1 */
    943. 

  943.         $h1 = (int) ($f0f1_2 + $f2f9_38 + $f3f8_38 + $f4f7_38 + $f5f6_38) << 1;
    944. 

  944.         /** @var int $h2 */
    945. 

  945.         $h2 = (int) ($f0f2_2 + $f1f1_2  + $f3f9_76 + $f4f8_38 + $f5f7_76 + $f6f6_19) << 1;
    946. 

  946.         /** @var int $h3 */
    947. 

  947.         $h3 = (int) ($f0f3_2 + $f1f2_2  + $f4f9_38 + $f5f8_38 + $f6f7_38) << 1;
    948. 

  948.         /** @var int $h4 */
    949. 

  949.         $h4 = (int) ($f0f4_2 + $f1f3_4  + $f2f2    + $f5f9_76 + $f6f8_38 + $f7f7_38) << 1;
    950. 

  950.         /** @var int $h5 */
    951. 

  951.         $h5 = (int) ($f0f5_2 + $f1f4_2  + $f2f3_2  + $f6f9_38 + $f7f8_38) << 1;
    952. 

  952.         /** @var int $h6 */
    953. 

  953.         $h6 = (int) ($f0f6_2 + $f1f5_4  + $f2f4_2  + $f3f3_2  + $f7f9_76 + $f8f8_19) << 1;
    954. 

  954.         /** @var int $h7 */
    955. 

  955.         $h7 = (int) ($f0f7_2 + $f1f6_2  + $f2f5_2  + $f3f4_2  + $f8f9_38) << 1;
    956. 

  956.         /** @var int $h8 */
    957. 

  957.         $h8 = (int) ($f0f8_2 + $f1f7_4  + $f2f6_2  + $f3f5_4  + $f4f4    + $f9f9_38) << 1;
    958. 

  958.         /** @var int $h9 */
    959. 

  959.         $h9 = (int) ($f0f9_2 + $f1f8_2  + $f2f7_2  + $f3f6_2  + $f4f5_2) << 1;
    960. 

  960. 

  961.         /** @var int $carry0 */
    962. 

  962.         $carry0 = ($h0 + (1 << 25)) >> 26;
    963. 

  963.         $h1 += $carry0;
    964. 

  964.         $h0 -= $carry0 << 26;
    965. 

  965.         /** @var int $carry4 */
    966. 

  966.         $carry4 = ($h4 + (1 << 25)) >> 26;
    967. 

  967.         $h5 += $carry4;
    968. 

  968.         $h4 -= $carry4 << 26;
    969. 

  969. 

  970.         /** @var int $carry1 */
    971. 

  971.         $carry1 = ($h1 + (1 << 24)) >> 25;
    972. 

  972.         $h2 += $carry1;
    973. 

  973.         $h1 -= $carry1 << 25;
    974. 

  974.         /** @var int $carry5 */
    975. 

  975.         $carry5 = ($h5 + (1 << 24)) >> 25;
    976. 

  976.         $h6 += $carry5;
    977. 

  977.         $h5 -= $carry5 << 25;
    978. 

  978. 

  979.         /** @var int $carry2 */
    980. 

  980.         $carry2 = ($h2 + (1 << 25)) >> 26;
    981. 

  981.         $h3 += $carry2;
    982. 

  982.         $h2 -= $carry2 << 26;
    983. 

  983.         /** @var int $carry6 */
    984. 

  984.         $carry6 = ($h6 + (1 << 25)) >> 26;
    985. 

  985.         $h7 += $carry6;
    986. 

  986.         $h6 -= $carry6 << 26;
    987. 

  987. 

  988.         /** @var int $carry3 */
    989. 

  989.         $carry3 = ($h3 + (1 << 24)) >> 25;
    990. 

  990.         $h4 += $carry3;
    991. 

  991.         $h3 -= $carry3 << 25;
    992. 

  992.         /** @var int $carry7 */
    993. 

  993.         $carry7 = ($h7 + (1 << 24)) >> 25;
    994. 

  994.         $h8 += $carry7;
    995. 

  995.         $h7 -= $carry7 << 25;
    996. 

  996. 

  997.         /** @var int $carry4 */
    998. 

  998.         $carry4 = ($h4 + (1 << 25)) >> 26;
    999. 

  999.         $h5 += $carry4;
    1000. 

  1000.         $h4 -= $carry4 << 26;
    1001. 

  1001.         /** @var int $carry8 */
    1002. 

  1002.         $carry8 = ($h8 + (1 << 25)) >> 26;
    1003. 

  1003.         $h9 += $carry8;
    1004. 

  1004.         $h8 -= $carry8 << 26;
    1005. 

  1005. 

  1006.         /** @var int $carry9 */
    1007. 

  1007.         $carry9 = ($h9 + (1 << 24)) >> 25;
    1008. 

  1008.         $h0 += self::mul($carry9, 19, 5);
    1009. 

  1009.         $h9 -= $carry9 << 25;
    1010. 

  1010. 

  1011.         /** @var int $carry0 */
    1012. 

  1012.         $carry0 = ($h0 + (1 << 25)) >> 26;
    1013. 

  1013.         $h1 += $carry0;
    1014. 

  1014.         $h0 -= $carry0 << 26;
    1015. 

  1015. 

  1016.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
    1017. 

  1017.             array(
    1018. 

  1018.                 (int) $h0,
    1019. 

  1019.                 (int) $h1,
    1020. 

  1020.                 (int) $h2,
    1021. 

  1021.                 (int) $h3,
    1022. 

  1022.                 (int) $h4,
    1023. 

  1023.                 (int) $h5,
    1024. 

  1024.                 (int) $h6,
    1025. 

  1025.                 (int) $h7,
    1026. 

  1026.                 (int) $h8,
    1027. 

  1027.                 (int) $h9
    1028. 

  1028.             )
    1029. 

  1029.         );
    1030. 

  1030.     }
    1031. 

  1031. 

  1032.     /**
    1033. 

  1033.      * @internal You should not use this directly from another application
    1034. 

  1034.      *
    1035. 

  1035.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $Z
    1036. 

  1036.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    1037. 

  1037.      */
    1038. 

  1038.     public static function fe_invert(ParagonIE_Sodium_Core_Curve25519_Fe $Z)
    1039. 

  1039.     {
    1040. 

  1040.         $z = clone $Z;
    1041. 

  1041.         $t0 = self::fe_sq($z);
    1042. 

  1042.         $t1 = self::fe_sq($t0);
    1043. 

  1043.         $t1 = self::fe_sq($t1);
    1044. 

  1044.         $t1 = self::fe_mul($z, $t1);
    1045. 

  1045.         $t0 = self::fe_mul($t0, $t1);
    1046. 

  1046.         $t2 = self::fe_sq($t0);
    1047. 

  1047.         $t1 = self::fe_mul($t1, $t2);
    1048. 

  1048.         $t2 = self::fe_sq($t1);
    1049. 

  1049.         for ($i = 1; $i < 5; ++$i) {
    1050. 

  1050.             $t2 = self::fe_sq($t2);
    1051. 

  1051.         }
    1052. 

  1052.         $t1 = self::fe_mul($t2, $t1);
    1053. 

  1053.         $t2 = self::fe_sq($t1);
    1054. 

  1054.         for ($i = 1; $i < 10; ++$i) {
    1055. 

  1055.             $t2 = self::fe_sq($t2);
    1056. 

  1056.         }
    1057. 

  1057.         $t2 = self::fe_mul($t2, $t1);
    1058. 

  1058.         $t3 = self::fe_sq($t2);
    1059. 

  1059.         for ($i = 1; $i < 20; ++$i) {
    1060. 

  1060.             $t3 = self::fe_sq($t3);
    1061. 

  1061.         }
    1062. 

  1062.         $t2 = self::fe_mul($t3, $t2);
    1063. 

  1063.         $t2 = self::fe_sq($t2);
    1064. 

  1064.         for ($i = 1; $i < 10; ++$i) {
    1065. 

  1065.             $t2 = self::fe_sq($t2);
    1066. 

  1066.         }
    1067. 

  1067.         $t1 = self::fe_mul($t2, $t1);
    1068. 

  1068.         $t2 = self::fe_sq($t1);
    1069. 

  1069.         for ($i = 1; $i < 50; ++$i) {
    1070. 

  1070.             $t2 = self::fe_sq($t2);
    1071. 

  1071.         }
    1072. 

  1072.         $t2 = self::fe_mul($t2, $t1);
    1073. 

  1073.         $t3 = self::fe_sq($t2);
    1074. 

  1074.         for ($i = 1; $i < 100; ++$i) {
    1075. 

  1075.             $t3 = self::fe_sq($t3);
    1076. 

  1076.         }
    1077. 

  1077.         $t2 = self::fe_mul($t3, $t2);
    1078. 

  1078.         $t2 = self::fe_sq($t2);
    1079. 

  1079.         for ($i = 1; $i < 50; ++$i) {
    1080. 

  1080.             $t2 = self::fe_sq($t2);
    1081. 

  1081.         }
    1082. 

  1082.         $t1 = self::fe_mul($t2, $t1);
    1083. 

  1083.         $t1 = self::fe_sq($t1);
    1084. 

  1084.         for ($i = 1; $i < 5; ++$i) {
    1085. 

  1085.             $t1 = self::fe_sq($t1);
    1086. 

  1086.         }
    1087. 

  1087.         return self::fe_mul($t1, $t0);
    1088. 

  1088.     }
    1089. 

  1089. 

  1090.     /**
    1091. 

  1091.      * @internal You should not use this directly from another application
    1092. 

  1092.      *
    1093. 

  1093.      * @ref https://github.com/jedisct1/libsodium/blob/68564326e1e9dc57ef03746f85734232d20ca6fb/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c#L1054-L1106
    1094. 

  1094.      *
    1095. 

  1095.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $z
    1096. 

  1096.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    1097. 

  1097.      */
    1098. 

  1098.     public static function fe_pow22523(ParagonIE_Sodium_Core_Curve25519_Fe $z)
    1099. 

  1099.     {
    1100. 

  1100.         # fe_sq(t0, z);
    1101. 

  1101.         # fe_sq(t1, t0);
    1102. 

  1102.         # fe_sq(t1, t1);
    1103. 

  1103.         # fe_mul(t1, z, t1);
    1104. 

  1104.         # fe_mul(t0, t0, t1);
    1105. 

  1105.         # fe_sq(t0, t0);
    1106. 

  1106.         # fe_mul(t0, t1, t0);
    1107. 

  1107.         # fe_sq(t1, t0);
    1108. 

  1108.         $t0 = self::fe_sq($z);
    1109. 

  1109.         $t1 = self::fe_sq($t0);
    1110. 

  1110.         $t1 = self::fe_sq($t1);
    1111. 

  1111.         $t1 = self::fe_mul($z, $t1);
    1112. 

  1112.         $t0 = self::fe_mul($t0, $t1);
    1113. 

  1113.         $t0 = self::fe_sq($t0);
    1114. 

  1114.         $t0 = self::fe_mul($t1, $t0);
    1115. 

  1115.         $t1 = self::fe_sq($t0);
    1116. 

  1116. 

  1117.         # for (i = 1; i < 5; ++i) {
    1118. 

  1118.         #     fe_sq(t1, t1);
    1119. 

  1119.         # }
    1120. 

  1120.         for ($i = 1; $i < 5; ++$i) {
    1121. 

  1121.             $t1 = self::fe_sq($t1);
    1122. 

  1122.         }
    1123. 

  1123. 

  1124.         # fe_mul(t0, t1, t0);
    1125. 

  1125.         # fe_sq(t1, t0);
    1126. 

  1126.         $t0 = self::fe_mul($t1, $t0);
    1127. 

  1127.         $t1 = self::fe_sq($t0);
    1128. 

  1128. 

  1129.         # for (i = 1; i < 10; ++i) {
    1130. 

  1130.         #     fe_sq(t1, t1);
    1131. 

  1131.         # }
    1132. 

  1132.         for ($i = 1; $i < 10; ++$i) {
    1133. 

  1133.             $t1 = self::fe_sq($t1);
    1134. 

  1134.         }
    1135. 

  1135. 

  1136.         # fe_mul(t1, t1, t0);
    1137. 

  1137.         # fe_sq(t2, t1);
    1138. 

  1138.         $t1 = self::fe_mul($t1, $t0);
    1139. 

  1139.         $t2 = self::fe_sq($t1);
    1140. 

  1140. 

  1141.         # for (i = 1; i < 20; ++i) {
    1142. 

  1142.         #     fe_sq(t2, t2);
    1143. 

  1143.         # }
    1144. 

  1144.         for ($i = 1; $i < 20; ++$i) {
    1145. 

  1145.             $t2 = self::fe_sq($t2);
    1146. 

  1146.         }
    1147. 

  1147. 

  1148.         # fe_mul(t1, t2, t1);
    1149. 

  1149.         # fe_sq(t1, t1);
    1150. 

  1150.         $t1 = self::fe_mul($t2, $t1);
    1151. 

  1151.         $t1 = self::fe_sq($t1);
    1152. 

  1152. 

  1153.         # for (i = 1; i < 10; ++i) {
    1154. 

  1154.         #     fe_sq(t1, t1);
    1155. 

  1155.         # }
    1156. 

  1156.         for ($i = 1; $i < 10; ++$i) {
    1157. 

  1157.             $t1 = self::fe_sq($t1);
    1158. 

  1158.         }
    1159. 

  1159. 

  1160.         # fe_mul(t0, t1, t0);
    1161. 

  1161.         # fe_sq(t1, t0);
    1162. 

  1162.         $t0 = self::fe_mul($t1, $t0);
    1163. 

  1163.         $t1 = self::fe_sq($t0);
    1164. 

  1164. 

  1165.         # for (i = 1; i < 50; ++i) {
    1166. 

  1166.         #     fe_sq(t1, t1);
    1167. 

  1167.         # }
    1168. 

  1168.         for ($i = 1; $i < 50; ++$i) {
    1169. 

  1169.             $t1 = self::fe_sq($t1);
    1170. 

  1170.         }
    1171. 

  1171. 

  1172.         # fe_mul(t1, t1, t0);
    1173. 

  1173.         # fe_sq(t2, t1);
    1174. 

  1174.         $t1 = self::fe_mul($t1, $t0);
    1175. 

  1175.         $t2 = self::fe_sq($t1);
    1176. 

  1176. 

  1177.         # for (i = 1; i < 100; ++i) {
    1178. 

  1178.         #     fe_sq(t2, t2);
    1179. 

  1179.         # }
    1180. 

  1180.         for ($i = 1; $i < 100; ++$i) {
    1181. 

  1181.             $t2 = self::fe_sq($t2);
    1182. 

  1182.         }
    1183. 

  1183. 

  1184.         # fe_mul(t1, t2, t1);
    1185. 

  1185.         # fe_sq(t1, t1);
    1186. 

  1186.         $t1 = self::fe_mul($t2, $t1);
    1187. 

  1187.         $t1 = self::fe_sq($t1);
    1188. 

  1188. 

  1189.         # for (i = 1; i < 50; ++i) {
    1190. 

  1190.         #     fe_sq(t1, t1);
    1191. 

  1191.         # }
    1192. 

  1192.         for ($i = 1; $i < 50; ++$i) {
    1193. 

  1193.             $t1 = self::fe_sq($t1);
    1194. 

  1194.         }
    1195. 

  1195. 

  1196.         # fe_mul(t0, t1, t0);
    1197. 

  1197.         # fe_sq(t0, t0);
    1198. 

  1198.         # fe_sq(t0, t0);
    1199. 

  1199.         # fe_mul(out, t0, z);
    1200. 

  1200.         $t0 = self::fe_mul($t1, $t0);
    1201. 

  1201.         $t0 = self::fe_sq($t0);
    1202. 

  1202.         $t0 = self::fe_sq($t0);
    1203. 

  1203.         return self::fe_mul($t0, $z);
    1204. 

  1204.     }
    1205. 

  1205. 

  1206.     /**
    1207. 

  1207.      * Subtract two field elements.
    1208. 

  1208.      *
    1209. 

  1209.      * h = f - g
    1210. 

  1210.      *
    1211. 

  1211.      * Preconditions:
    1212. 

  1212.      * |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
    1213. 

  1213.      * |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
    1214. 

  1214.      *
    1215. 

  1215.      * Postconditions:
    1216. 

  1216.      * |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
    1217. 

  1217.      *
    1218. 

  1218.      * @internal You should not use this directly from another application
    1219. 

  1219.      *
    1220. 

  1220.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $f
    1221. 

  1221.      * @param ParagonIE_Sodium_Core_Curve25519_Fe $g
    1222. 

  1222.      * @return ParagonIE_Sodium_Core_Curve25519_Fe
    1223. 

  1223.      * @psalm-suppress MixedOperand
    1224. 

  1224.      */
    1225. 

  1225.     public static function fe_sub(ParagonIE_Sodium_Core_Curve25519_Fe $f, ParagonIE_Sodium_Core_Curve25519_Fe $g)
    1226. 

  1226.     {
    1227. 

  1227.         return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
    1228. 

  1228.             array(
    1229. 

  1229.                 (int) ($f[0] - $g[0]),
    1230. 

  1230.                 (int) ($f[1] - $g[1]),
    1231. 

  1231.                 (int) ($f[2] - $g[2]),
    1232. 

  1232.                 (int) ($f[3] - $g[3]),
    1233. 

  1233.                 (int) ($f[4] - $g[4]),
    1234. 

  1234.                 (int) ($f[5] - $g[5]),
    1235. 

  1235.                 (int) ($f[6] - $g[6]),
    1236. 

  1236.                 (int) ($f[7] - $g[7]),
    1237. 

  1237.                 (int) ($f[8] - $g[8]),
    1238. 

  1238.                 (int) ($f[9] - $g[9])
    1239. 

  1239.             )
    1240. 

  1240.         );
    1241. 

  1241.     }
    1242. 

  1242. 

  1243.     /**
    1244. 

  1244.      * Add two group elements.
    1245. 

  1245.      *
    1246. 

  1246.      * r = p + q
    1247. 

  1247.      *
    1248. 

  1248.      * @internal You should not use this directly from another application
    1249. 

  1249.      *
    1250. 

  1250.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
    1251. 

  1251.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_Cached $q
    1252. 

  1252.      * @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
    1253. 

  1253.      */
    1254. 

  1254.     public static function ge_add(
    1255. 

  1255.         ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p,
    1256. 

  1256.         ParagonIE_Sodium_Core_Curve25519_Ge_Cached $q
    1257. 

  1257.     ) {
    1258. 

  1258.         $r = new ParagonIE_Sodium_Core_Curve25519_Ge_P1p1();
    1259. 

  1259.         $r->X = self::fe_add($p->Y, $p->X);
    1260. 

  1260.         $r->Y = self::fe_sub($p->Y, $p->X);
    1261. 

  1261.         $r->Z = self::fe_mul($r->X, $q->YplusX);
    1262. 

  1262.         $r->Y = self::fe_mul($r->Y, $q->YminusX);
    1263. 

  1263.         $r->T = self::fe_mul($q->T2d, $p->T);
    1264. 

  1264.         $r->X = self::fe_mul($p->Z, $q->Z);
    1265. 

  1265.         $t0   = self::fe_add($r->X, $r->X);
    1266. 

  1266.         $r->X = self::fe_sub($r->Z, $r->Y);
    1267. 

  1267.         $r->Y = self::fe_add($r->Z, $r->Y);
    1268. 

  1268.         $r->Z = self::fe_add($t0, $r->T);
    1269. 

  1269.         $r->T = self::fe_sub($t0, $r->T);
    1270. 

  1270.         return $r;
    1271. 

  1271.     }
    1272. 

  1272. 

  1273.     /**
    1274. 

  1274.      * @internal You should not use this directly from another application
    1275. 

  1275.      *
    1276. 

  1276.      * @ref https://github.com/jedisct1/libsodium/blob/157c4a80c13b117608aeae12178b2d38825f9f8f/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c#L1185-L1215
    1277. 

  1277.      * @param string $a
    1278. 

  1278.      * @return array<int, mixed>
    1279. 

  1279.      * @throws SodiumException
    1280. 

  1280.      * @throws TypeError
    1281. 

  1281.      */
    1282. 

  1282.     public static function slide($a)
    1283. 

  1283.     {
    1284. 

  1284.         if (self::strlen($a) < 256) {
    1285. 

  1285.             if (self::strlen($a) < 16) {
    1286. 

  1286.                 $a = str_pad($a, 256, '0', STR_PAD_RIGHT);
    1287. 

  1287.             }
    1288. 

  1288.         }
    1289. 

  1289.         /** @var array<int, int> $r */
    1290. 

  1290.         $r = array();
    1291. 

  1291. 

  1292.         /** @var int $i */
    1293. 

  1293.         for ($i = 0; $i < 256; ++$i) {
    1294. 

  1294.             $r[$i] = (int) (
    1295. 

  1295.                 1 & (
    1296. 

  1296.                     self::chrToInt($a[(int) ($i >> 3)])
    1297. 

  1297.                         >>
    1298. 

  1298.                     ($i & 7)
    1299. 

  1299.                 )
    1300. 

  1300.             );
    1301. 

  1301.         }
    1302. 

  1302. 

  1303.         for ($i = 0;$i < 256;++$i) {
    1304. 

  1304.             if ($r[$i]) {
    1305. 

  1305.                 for ($b = 1;$b <= 6 && $i + $b < 256;++$b) {
    1306. 

  1306.                     if ($r[$i + $b]) {
    1307. 

  1307.                         if ($r[$i] + ($r[$i + $b] << $b) <= 15) {
    1308. 

  1308.                             $r[$i] += $r[$i + $b] << $b;
    1309. 

  1309.                             $r[$i + $b] = 0;
    1310. 

  1310.                         } elseif ($r[$i] - ($r[$i + $b] << $b) >= -15) {
    1311. 

  1311.                             $r[$i] -= $r[$i + $b] << $b;
    1312. 

  1312.                             for ($k = $i + $b; $k < 256; ++$k) {
    1313. 

  1313.                                 if (!$r[$k]) {
    1314. 

  1314.                                     $r[$k] = 1;
    1315. 

  1315.                                     break;
    1316. 

  1316.                                 }
    1317. 

  1317.                                 $r[$k] = 0;
    1318. 

  1318.                             }
    1319. 

  1319.                         } else {
    1320. 

  1320.                             break;
    1321. 

  1321.                         }
    1322. 

  1322.                     }
    1323. 

  1323.                 }
    1324. 

  1324.             }
    1325. 

  1325.         }
    1326. 

  1326.         return $r;
    1327. 

  1327.     }
    1328. 

  1328. 

  1329.     /**
    1330. 

  1330.      * @internal You should not use this directly from another application
    1331. 

  1331.      *
    1332. 

  1332.      * @param string $s
    1333. 

  1333.      * @return ParagonIE_Sodium_Core_Curve25519_Ge_P3
    1334. 

  1334.      * @throws SodiumException
    1335. 

  1335.      * @throws TypeError
    1336. 

  1336.      */
    1337. 

  1337.     public static function ge_frombytes_negate_vartime($s)
    1338. 

  1338.     {
    1339. 

  1339.         static $d = null;
    1340. 

  1340.         if (!$d) {
    1341. 

  1341.             $d = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$d);
    1342. 

  1342.         }
    1343. 

  1343. 

  1344.         # fe_frombytes(h->Y,s);
    1345. 

  1345.         # fe_1(h->Z);
    1346. 

  1346.         $h = new ParagonIE_Sodium_Core_Curve25519_Ge_P3(
    1347. 

  1347.             self::fe_0(),
    1348. 

  1348.             self::fe_frombytes($s),
    1349. 

  1349.             self::fe_1()
    1350. 

  1350.         );
    1351. 

  1351. 

  1352.         # fe_sq(u,h->Y);
    1353. 

  1353.         # fe_mul(v,u,d);
    1354. 

  1354.         # fe_sub(u,u,h->Z);       /* u = y^2-1 */
    1355. 

  1355.         # fe_add(v,v,h->Z);       /* v = dy^2+1 */
    1356. 

  1356.         $u = self::fe_sq($h->Y);
    1357. 

  1357.         /** @var ParagonIE_Sodium_Core_Curve25519_Fe $d */
    1358. 

  1358.         $v = self::fe_mul($u, $d);
    1359. 

  1359.         $u = self::fe_sub($u, $h->Z); /* u =  y^2 - 1 */
    1360. 

  1360.         $v = self::fe_add($v, $h->Z); /* v = dy^2 + 1 */
    1361. 

  1361. 

  1362.         # fe_sq(v3,v);
    1363. 

  1363.         # fe_mul(v3,v3,v);        /* v3 = v^3 */
    1364. 

  1364.         # fe_sq(h->X,v3);
    1365. 

  1365.         # fe_mul(h->X,h->X,v);
    1366. 

  1366.         # fe_mul(h->X,h->X,u);    /* x = uv^7 */
    1367. 

  1367.         $v3 = self::fe_sq($v);
    1368. 

  1368.         $v3 = self::fe_mul($v3, $v); /* v3 = v^3 */
    1369. 

  1369.         $h->X = self::fe_sq($v3);
    1370. 

  1370.         $h->X = self::fe_mul($h->X, $v);
    1371. 

  1371.         $h->X = self::fe_mul($h->X, $u); /* x = uv^7 */
    1372. 

  1372. 

  1373.         # fe_pow22523(h->X,h->X); /* x = (uv^7)^((q-5)/8) */
    1374. 

  1374.         # fe_mul(h->X,h->X,v3);
    1375. 

  1375.         # fe_mul(h->X,h->X,u);    /* x = uv^3(uv^7)^((q-5)/8) */
    1376. 

  1376.         $h->X = self::fe_pow22523($h->X); /* x = (uv^7)^((q-5)/8) */
    1377. 

  1377.         $h->X = self::fe_mul($h->X, $v3);
    1378. 

  1378.         $h->X = self::fe_mul($h->X, $u); /* x = uv^3(uv^7)^((q-5)/8) */
    1379. 

  1379. 

  1380.         # fe_sq(vxx,h->X);
    1381. 

  1381.         # fe_mul(vxx,vxx,v);
    1382. 

  1382.         # fe_sub(check,vxx,u);    /* vx^2-u */
    1383. 

  1383.         $vxx = self::fe_sq($h->X);
    1384. 

  1384.         $vxx = self::fe_mul($vxx, $v);
    1385. 

  1385.         $check = self::fe_sub($vxx, $u); /* vx^2 - u */
    1386. 

  1386. 

  1387.         # if (fe_isnonzero(check)) {
    1388. 

  1388.         #     fe_add(check,vxx,u);  /* vx^2+u */
    1389. 

  1389.         #     if (fe_isnonzero(check)) {
    1390. 

  1390.         #         return -1;
    1391. 

  1391.         #     }
    1392. 

  1392.         #     fe_mul(h->X,h->X,sqrtm1);
    1393. 

  1393.         # }
    1394. 

  1394.         if (self::fe_isnonzero($check)) {
    1395. 

  1395.             $check = self::fe_add($vxx, $u); /* vx^2 + u */
    1396. 

  1396.             if (self::fe_isnonzero($check)) {
    1397. 

  1397.                 throw new RangeException('Internal check failed.');
    1398. 

  1398.             }
    1399. 

  1399.             $h->X = self::fe_mul(
    1400. 

  1400.                 $h->X,
    1401. 

  1401.                 ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$sqrtm1)
    1402. 

  1402.             );
    1403. 

  1403.         }
    1404. 

  1404. 

  1405.         # if (fe_isnegative(h->X) == (s[31] >> 7)) {
    1406. 

  1406.         #     fe_neg(h->X,h->X);
    1407. 

  1407.         # }
    1408. 

  1408.         $i = self::chrToInt($s[31]);
    1409. 

  1409.         if (self::fe_isnegative($h->X) === ($i >> 7)) {
    1410. 

  1410.             $h->X = self::fe_neg($h->X);
    1411. 

  1411.         }
    1412. 

  1412. 

  1413.         # fe_mul(h->T,h->X,h->Y);
    1414. 

  1414.         $h->T = self::fe_mul($h->X, $h->Y);
    1415. 

  1415.         return $h;
    1416. 

  1416.     }
    1417. 

  1417. 

  1418.     /**
    1419. 

  1419.      * @internal You should not use this directly from another application
    1420. 

  1420.      *
    1421. 

  1421.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R
    1422. 

  1422.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
    1423. 

  1423.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
    1424. 

  1424.      * @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
    1425. 

  1425.      */
    1426. 

  1426.     public static function ge_madd(
    1427. 

  1427.         ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R,
    1428. 

  1428.         ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p,
    1429. 

  1429.         ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
    1430. 

  1430.     ) {
    1431. 

  1431.         $r = clone $R;
    1432. 

  1432.         $r->X = self::fe_add($p->Y, $p->X);
    1433. 

  1433.         $r->Y = self::fe_sub($p->Y, $p->X);
    1434. 

  1434.         $r->Z = self::fe_mul($r->X, $q->yplusx);
    1435. 

  1435.         $r->Y = self::fe_mul($r->Y, $q->yminusx);
    1436. 

  1436.         $r->T = self::fe_mul($q->xy2d, $p->T);
    1437. 

  1437.         $t0 = self::fe_add(clone $p->Z, clone $p->Z);
    1438. 

  1438.         $r->X = self::fe_sub($r->Z, $r->Y);
    1439. 

  1439.         $r->Y = self::fe_add($r->Z, $r->Y);
    1440. 

  1440.         $r->Z = self::fe_add($t0, $r->T);
    1441. 

  1441.         $r->T = self::fe_sub($t0, $r->T);
    1442. 

  1442. 

  1443.         return $r;
    1444. 

  1444.     }
    1445. 

  1445. 

  1446.     /**
    1447. 

  1447.      * @internal You should not use this directly from another application
    1448. 

  1448.      *
    1449. 

  1449.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R
    1450. 

  1450.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
    1451. 

  1451.      * @param ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
    1452. 

  1452.      * @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
    1453. 

  1453.      */
    1454. 

  1454.     public static function ge_msub(
    1455. 

  1455.         ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R,
    1456. 

  1456.         ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p,
    1457. 

  1457.         ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
    1458. 

  1458.     ) {
    1459. 

  1459.         $r = clone $R;
    1460. 

  1460. 

  1461.         $r->X = self::fe_add($p->Y, $p->X);
    1462. 

  1462.         $r->Y = self::fe_sub($p->Y, $p->X);
    1463. 

  1463.         $r->Z = self::fe_mul($r->X, $q->yminusx);
    1464. 

  1464.         $r->Y = self::fe_mul($r->Y, $q->yplusx);
    1465. 

  1465.         $r->T = self::fe_mul($q->xy2d, $p->T);
    1466. 

  1466.         $t0 = self::fe_add($p->Z, $p->Z);
    1467. 

  1467.         $r->X = self::fe_sub($r->Z, $r->Y);
    1468. 

  1468.         $r->Y = self::fe_add($r->Z, $r->Y);
    1469. 

  1469.         $r->Z = self
    1470.