/security/nss/lib/freebl/ecl/ecp_fp160.c

  1/* 
  2 * ***** BEGIN LICENSE BLOCK *****
  3 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  4 *
  5 * The contents of this file are subject to the Mozilla Public License Version
  6 * 1.1 (the "License"); you may not use this file except in compliance with
  7 * the License. You may obtain a copy of the License at
  8 * http://www.mozilla.org/MPL/
  9 *
 10 * Software distributed under the License is distributed on an "AS IS" basis,
 11 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 12 * for the specific language governing rights and limitations under the
 13 * License.
 14 *
 15 * The Original Code is the elliptic curve math library for prime field curves using floating point operations.
 16 *
 17 * The Initial Developer of the Original Code is
 18 * Sun Microsystems, Inc.
 19 * Portions created by the Initial Developer are Copyright (C) 2003
 20 * the Initial Developer. All Rights Reserved.
 21 *
 22 * Contributor(s):
 23 *   Stephen Fung <fungstep@hotmail.com>, Sun Microsystems Laboratories
 24 *
 25 * Alternatively, the contents of this file may be used under the terms of
 26 * either the GNU General Public License Version 2 or later (the "GPL"), or
 27 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 28 * in which case the provisions of the GPL or the LGPL are applicable instead
 29 * of those above. If you wish to allow use of your version of this file only
 30 * under the terms of either the GPL or the LGPL, and not to allow others to
 31 * use your version of this file under the terms of the MPL, indicate your
 32 * decision by deleting the provisions above and replace them with the notice
 33 * and other provisions required by the GPL or the LGPL. If you do not delete
 34 * the provisions above, a recipient may use your version of this file under
 35 * the terms of any one of the MPL, the GPL or the LGPL.
 36 *
 37 * ***** END LICENSE BLOCK ***** */
 38
 39#include "ecp_fp.h"
 40#include <stdlib.h>
 41
 42#define ECFP_BSIZE 160
 43#define ECFP_NUMDOUBLES 7
 44
 45#include "ecp_fpinc.c"
 46
 47/* Performs a single step of reduction, just on the uppermost float
 48 * (assumes already tidied), and then retidies. Note, this does not
 49 * guarantee that the result will be less than p, but truncates the number 
 50 * of bits. */
 51void
 52ecfp160_singleReduce(double *d, const EC_group_fp * group)
 53{
 54	double q;
 55
 56	ECFP_ASSERT(group->doubleBitSize == 24);
 57	ECFP_ASSERT(group->primeBitSize == 160);
 58	ECFP_ASSERT(ECFP_NUMDOUBLES == 7);
 59
 60	q = d[ECFP_NUMDOUBLES - 1] - ecfp_beta_160;
 61	q += group->bitSize_alpha;
 62	q -= group->bitSize_alpha;
 63
 64	d[ECFP_NUMDOUBLES - 1] -= q;
 65	d[0] += q * ecfp_twom160;
 66	d[1] += q * ecfp_twom129;
 67	ecfp_positiveTidy(d, group);
 68
 69	/* Assertions for the highest order term */
 70	ECFP_ASSERT(d[ECFP_NUMDOUBLES - 1] / ecfp_exp[ECFP_NUMDOUBLES - 1] ==
 71				(unsigned long long) (d[ECFP_NUMDOUBLES - 1] /
 72									  ecfp_exp[ECFP_NUMDOUBLES - 1]));
 73	ECFP_ASSERT(d[ECFP_NUMDOUBLES - 1] >= 0);
 74}
 75
 76/* Performs imperfect reduction.  This might leave some negative terms,
 77 * and one more reduction might be required for the result to be between 0 
 78 * and p-1. x should not already be reduced, i.e. should have
 79 * 2*ECFP_NUMDOUBLES significant terms. x and r can be the same, but then
 80 * the upper parts of r are not zeroed */
 81void
 82ecfp160_reduce(double *r, double *x, const EC_group_fp * group)
 83{
 84
 85	double x7, x8, q;
 86
 87	ECFP_ASSERT(group->doubleBitSize == 24);
 88	ECFP_ASSERT(group->primeBitSize == 160);
 89	ECFP_ASSERT(ECFP_NUMDOUBLES == 7);
 90
 91	/* Tidy just the upper bits, the lower bits can wait. */
 92	ecfp_tidyUpper(x, group);
 93
 94	/* Assume that this is already tidied so that we have enough extra
 95	 * bits */
 96	x7 = x[7] + x[13] * ecfp_twom129;	/* adds bits 15-39 */
 97
 98	/* Tidy x7, or we won't have enough bits later to add it in */
 99	q = x7 + group->alpha[8];
100	q -= group->alpha[8];
101	x7 -= q;					/* holds bits 0-24 */
102	x8 = x[8] + q;				/* holds bits 0-25 */
103
104	r[6] = x[6] + x[13] * ecfp_twom160 + x[12] * ecfp_twom129;	/* adds
105																 * bits
106																 * 8-39 */
107	r[5] = x[5] + x[12] * ecfp_twom160 + x[11] * ecfp_twom129;
108	r[4] = x[4] + x[11] * ecfp_twom160 + x[10] * ecfp_twom129;
109	r[3] = x[3] + x[10] * ecfp_twom160 + x[9] * ecfp_twom129;
110	r[2] = x[2] + x[9] * ecfp_twom160 + x8 * ecfp_twom129;	/* adds bits
111															 * 8-40 */
112	r[1] = x[1] + x8 * ecfp_twom160 + x7 * ecfp_twom129;	/* adds bits
113															 * 8-39 */
114	r[0] = x[0] + x7 * ecfp_twom160;
115
116	/* Tidy up just r[ECFP_NUMDOUBLES-2] so that the number of reductions
117	 * is accurate plus or minus one.  (Rather than tidy all to make it
118	 * totally accurate, which is more costly.) */
119	q = r[ECFP_NUMDOUBLES - 2] + group->alpha[ECFP_NUMDOUBLES - 1];
120	q -= group->alpha[ECFP_NUMDOUBLES - 1];
121	r[ECFP_NUMDOUBLES - 2] -= q;
122	r[ECFP_NUMDOUBLES - 1] += q;
123
124	/* Tidy up the excess bits on r[ECFP_NUMDOUBLES-1] using reduction */
125	/* Use ecfp_beta so we get a positive result */
126	q = r[ECFP_NUMDOUBLES - 1] - ecfp_beta_160;
127	q += group->bitSize_alpha;
128	q -= group->bitSize_alpha;
129
130	r[ECFP_NUMDOUBLES - 1] -= q;
131	r[0] += q * ecfp_twom160;
132	r[1] += q * ecfp_twom129;
133
134	/* Tidy the result */
135	ecfp_tidyShort(r, group);
136}
137
138/* Sets group to use optimized calculations in this file */
139mp_err
140ec_group_set_secp160r1_fp(ECGroup *group)
141{
142
143	EC_group_fp *fpg = NULL;
144
145	/* Allocate memory for floating point group data */
146	fpg = (EC_group_fp *) malloc(sizeof(EC_group_fp));
147	if (fpg == NULL) {
148		return MP_MEM;
149	}
150
151	fpg->numDoubles = ECFP_NUMDOUBLES;
152	fpg->primeBitSize = ECFP_BSIZE;
153	fpg->orderBitSize = 161;
154	fpg->doubleBitSize = 24;
155	fpg->numInts = (ECFP_BSIZE + ECL_BITS - 1) / ECL_BITS;
156	fpg->aIsM3 = 1;
157	fpg->ecfp_singleReduce = &ecfp160_singleReduce;
158	fpg->ecfp_reduce = &ecfp160_reduce;
159	fpg->ecfp_tidy = &ecfp_tidy;
160
161	fpg->pt_add_jac_aff = &ecfp160_pt_add_jac_aff;
162	fpg->pt_add_jac = &ecfp160_pt_add_jac;
163	fpg->pt_add_jm_chud = &ecfp160_pt_add_jm_chud;
164	fpg->pt_add_chud = &ecfp160_pt_add_chud;
165	fpg->pt_dbl_jac = &ecfp160_pt_dbl_jac;
166	fpg->pt_dbl_jm = &ecfp160_pt_dbl_jm;
167	fpg->pt_dbl_aff2chud = &ecfp160_pt_dbl_aff2chud;
168	fpg->precompute_chud = &ecfp160_precompute_chud;
169	fpg->precompute_jac = &ecfp160_precompute_jac;
170
171	group->point_mul = &ec_GFp_point_mul_wNAF_fp;
172	group->points_mul = &ec_pts_mul_basic;
173	group->extra1 = fpg;
174	group->extra_free = &ec_GFp_extra_free_fp;
175
176	ec_set_fp_precision(fpg);
177	fpg->bitSize_alpha = ECFP_TWO160 * fpg->alpha[0];
178	return MP_OKAY;
179}