mirror of
https://github.com/golang/go
synced 2024-11-17 07:45:09 -07:00
crypto/elliptic: clean up and document P-256 assembly interface
For #52182 Change-Id: I8a68fda3e54bdea48b0dfe528fe293d47bdcd145 Reviewed-on: https://go-review.googlesource.com/c/go/+/396255 Reviewed-by: Fernando Lobato Meeser <felobato@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
This commit is contained in:
Filippo Valsorda
parent
10d1189464
commit
0b4f2416a2
@ -6,7 +6,9 @@ package nistec_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/elliptic"
|
||||
"crypto/elliptic/internal/nistec"
|
||||
"math/big"
|
||||
"math/rand"
|
||||
"os"
|
||||
"strings"
|
||||
@ -90,27 +92,27 @@ type nistPoint[T any] interface {
|
||||
|
||||
func TestEquivalents(t *testing.T) {
|
||||
t.Run("P224", func(t *testing.T) {
|
||||
testEquivalents(t, nistec.NewP224Point, nistec.NewP224Generator)
|
||||
testEquivalents(t, nistec.NewP224Point, nistec.NewP224Generator, elliptic.P224())
|
||||
})
|
||||
t.Run("P256", func(t *testing.T) {
|
||||
testEquivalents(t, nistec.NewP256Point, nistec.NewP256Generator)
|
||||
testEquivalents(t, nistec.NewP256Point, nistec.NewP256Generator, elliptic.P256())
|
||||
})
|
||||
t.Run("P384", func(t *testing.T) {
|
||||
testEquivalents(t, nistec.NewP384Point, nistec.NewP384Generator)
|
||||
testEquivalents(t, nistec.NewP384Point, nistec.NewP384Generator, elliptic.P384())
|
||||
})
|
||||
t.Run("P521", func(t *testing.T) {
|
||||
testEquivalents(t, nistec.NewP521Point, nistec.NewP521Generator)
|
||||
testEquivalents(t, nistec.NewP521Point, nistec.NewP521Generator, elliptic.P521())
|
||||
})
|
||||
}
|
||||
|
||||
func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func() P) {
|
||||
func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func() P, c elliptic.Curve) {
|
||||
p := newGenerator()
|
||||
|
||||
// This assumes the base and scalar fields have the same byte size, which
|
||||
// they do for these curves.
|
||||
elementSize := len(p.Bytes()) / 2
|
||||
elementSize := (c.Params().BitSize + 7) / 8
|
||||
two := make([]byte, elementSize)
|
||||
two[len(two)-1] = 2
|
||||
nPlusTwo := make([]byte, elementSize)
|
||||
new(big.Int).Add(c.Params().N, big.NewInt(2)).FillBytes(nPlusTwo)
|
||||
|
||||
p1 := newPoint().Double(p)
|
||||
p2 := newPoint().Add(p, p)
|
||||
@ -122,6 +124,14 @@ func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
p5, err := newPoint().ScalarMult(p, nPlusTwo)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
p6, err := newPoint().ScalarBaseMult(nPlusTwo)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if !bytes.Equal(p1.Bytes(), p2.Bytes()) {
|
||||
t.Error("P+P != 2*P")
|
||||
@ -132,6 +142,12 @@ func testEquivalents[P nistPoint[P]](t *testing.T, newPoint, newGenerator func()
|
||||
if !bytes.Equal(p1.Bytes(), p4.Bytes()) {
|
||||
t.Error("G+G != [2]G")
|
||||
}
|
||||
if !bytes.Equal(p1.Bytes(), p5.Bytes()) {
|
||||
t.Error("P+P != [N+2]P")
|
||||
}
|
||||
if !bytes.Equal(p1.Bytes(), p6.Bytes()) {
|
||||
t.Error("G+G != [N+2]G")
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkScalarMult(b *testing.B) {
|
||||
|
||||
@ -18,37 +18,52 @@ import (
|
||||
_ "embed"
|
||||
"errors"
|
||||
"math/bits"
|
||||
"unsafe"
|
||||
)
|
||||
|
||||
//go:embed p256_asm_table.bin
|
||||
var p256Precomputed string
|
||||
// p256Element is a P-256 base field element in [0, P-1] in the Montgomery
|
||||
// domain (with R 2²⁵⁶) as four limbs in little-endian order value.
|
||||
type p256Element [4]uint64
|
||||
|
||||
// P256Point is a P-256 point. The zero value is NOT valid.
|
||||
// p256One is one in the Montgomery domain.
|
||||
var p256One = p256Element{0x0000000000000001, 0xffffffff00000000,
|
||||
0xffffffffffffffff, 0x00000000fffffffe}
|
||||
|
||||
var p256Zero = p256Element{}
|
||||
|
||||
// p256P is 2²⁵⁶ - 2²²⁴ + 2¹⁹² + 2⁹⁶ - 1 in the Montgomery domain.
|
||||
var p256P = p256Element{0xffffffffffffffff, 0x00000000ffffffff,
|
||||
0x0000000000000000, 0xffffffff00000001}
|
||||
|
||||
// P256Point is a P-256 point. The zero value should not be assumed to be valid
|
||||
// (although it is in this implementation).
|
||||
type P256Point struct {
|
||||
xyz [12]uint64
|
||||
// (X:Y:Z) are Jacobian coordinates where x = X/Z² and y = Y/Z³. The point
|
||||
// at infinity can be represented by any set of coordinates with Z = 0.
|
||||
x, y, z p256Element
|
||||
}
|
||||
|
||||
// NewP256Point returns a new P256Point representing the point at infinity point.
|
||||
// NewP256Point returns a new P256Point representing the point at infinity.
|
||||
func NewP256Point() *P256Point {
|
||||
return &P256Point{[12]uint64{
|
||||
0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
|
||||
0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
|
||||
0, 0, 0, 0,
|
||||
}}
|
||||
return &P256Point{
|
||||
x: p256One, y: p256One, z: p256Zero,
|
||||
}
|
||||
}
|
||||
|
||||
// NewP256Generator returns a new P256Point set to the canonical generator.
|
||||
func NewP256Generator() *P256Point {
|
||||
return &P256Point{[12]uint64{
|
||||
0x79e730d418a9143c, 0x75ba95fc5fedb601, 0x79fb732b77622510, 0x18905f76a53755c6,
|
||||
0xddf25357ce95560a, 0x8b4ab8e4ba19e45c, 0xd2e88688dd21f325, 0x8571ff1825885d85,
|
||||
0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
|
||||
}}
|
||||
return &P256Point{
|
||||
x: p256Element{0x79e730d418a9143c, 0x75ba95fc5fedb601,
|
||||
0x79fb732b77622510, 0x18905f76a53755c6},
|
||||
y: p256Element{0xddf25357ce95560a, 0x8b4ab8e4ba19e45c,
|
||||
0xd2e88688dd21f325, 0x8571ff1825885d85},
|
||||
z: p256One,
|
||||
}
|
||||
}
|
||||
|
||||
// Set sets p = q and returns p.
|
||||
func (p *P256Point) Set(q *P256Point) *P256Point {
|
||||
p.xyz = q.xyz
|
||||
p.x, p.y, p.z = q.x, q.y, q.z
|
||||
return p
|
||||
}
|
||||
|
||||
@ -69,21 +84,22 @@ func (p *P256Point) SetBytes(b []byte) (*P256Point, error) {
|
||||
// Uncompressed form.
|
||||
case len(b) == p256UncompressedLength && b[0] == 4:
|
||||
var r P256Point
|
||||
p256BigToLittle(r.xyz[0:4], b[1:33])
|
||||
p256BigToLittle(r.xyz[4:8], b[33:65])
|
||||
if p256LessThanP(r.xyz[0:4]) == 0 || p256LessThanP(r.xyz[4:8]) == 0 {
|
||||
p256BigToLittle(&r.x, (*[32]byte)(b[1:33]))
|
||||
p256BigToLittle(&r.y, (*[32]byte)(b[33:65]))
|
||||
if p256LessThanP(&r.x) == 0 || p256LessThanP(&r.y) == 0 {
|
||||
return nil, errors.New("invalid P256 element encoding")
|
||||
}
|
||||
p256Mul(r.xyz[0:4], r.xyz[0:4], rr[:])
|
||||
p256Mul(r.xyz[4:8], r.xyz[4:8], rr[:])
|
||||
if err := p256CheckOnCurve(r.xyz[0:4], r.xyz[4:8]); err != nil {
|
||||
// p256Mul operates in the Montgomery domain with R = 2²⁵⁶ mod p. Thus rr
|
||||
// here is R in the Montgomery domain, or R×R mod p. See comment in
|
||||
// P256OrdInverse about how this is used.
|
||||
rr := p256Element{0x0000000000000003, 0xfffffffbffffffff,
|
||||
0xfffffffffffffffe, 0x00000004fffffffd}
|
||||
p256Mul(&r.x, &r.x, &rr)
|
||||
p256Mul(&r.y, &r.y, &rr)
|
||||
if err := p256CheckOnCurve(&r.x, &r.y); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// This sets r's Z value to 1, in the Montgomery domain.
|
||||
r.xyz[8] = 0x0000000000000001
|
||||
r.xyz[9] = 0xffffffff00000000
|
||||
r.xyz[10] = 0xffffffffffffffff
|
||||
r.xyz[11] = 0x00000000fffffffe
|
||||
r.z = p256One
|
||||
return p.Set(&r), nil
|
||||
|
||||
// Compressed form.
|
||||
@ -95,40 +111,37 @@ func (p *P256Point) SetBytes(b []byte) (*P256Point, error) {
|
||||
}
|
||||
}
|
||||
|
||||
func p256CheckOnCurve(x, y []uint64) error {
|
||||
func p256CheckOnCurve(x, y *p256Element) error {
|
||||
// x³ - 3x + b
|
||||
x3 := make([]uint64, 4)
|
||||
x3 := new(p256Element)
|
||||
p256Sqr(x3, x, 1)
|
||||
p256Mul(x3, x3, x)
|
||||
|
||||
threeX := make([]uint64, 4)
|
||||
threeX := new(p256Element)
|
||||
p256Add(threeX, x, x)
|
||||
p256Add(threeX, threeX, x)
|
||||
p256NegCond(threeX, 1)
|
||||
|
||||
p256B := []uint64{0xd89cdf6229c4bddf, 0xacf005cd78843090,
|
||||
p256B := &p256Element{0xd89cdf6229c4bddf, 0xacf005cd78843090,
|
||||
0xe5a220abf7212ed6, 0xdc30061d04874834}
|
||||
|
||||
p256Add(x3, x3, threeX)
|
||||
p256Add(x3, x3, p256B)
|
||||
|
||||
// y² = x³ - 3x + b
|
||||
y2 := make([]uint64, 4)
|
||||
y2 := new(p256Element)
|
||||
p256Sqr(y2, y, 1)
|
||||
|
||||
diff := (x3[0] ^ y2[0]) | (x3[1] ^ y2[1]) |
|
||||
(x3[2] ^ y2[2]) | (x3[3] ^ y2[3])
|
||||
if uint64IsZero(diff) != 1 {
|
||||
if p256Equal(y2, x3) != 1 {
|
||||
return errors.New("P256 point not on curve")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
var p256P = []uint64{0xffffffffffffffff, 0x00000000ffffffff,
|
||||
0x0000000000000000, 0xffffffff00000001}
|
||||
|
||||
// p256LessThanP returns 1 if x < p, and 0 otherwise.
|
||||
func p256LessThanP(x []uint64) int {
|
||||
// p256LessThanP returns 1 if x < p, and 0 otherwise. Note that a p256Element is
|
||||
// not allowed to be equal to or greater than p, so if this function returns 0
|
||||
// then x is invalid.
|
||||
func p256LessThanP(x *p256Element) int {
|
||||
var b uint64
|
||||
_, b = bits.Sub64(x[0], p256P[0], b)
|
||||
_, b = bits.Sub64(x[1], p256P[1], b)
|
||||
@ -137,7 +150,8 @@ func p256LessThanP(x []uint64) int {
|
||||
return int(b)
|
||||
}
|
||||
|
||||
func p256Add(res, x, y []uint64) {
|
||||
// p256Add sets res = x + y.
|
||||
func p256Add(res, x, y *p256Element) {
|
||||
var c, b uint64
|
||||
t1 := make([]uint64, 4)
|
||||
t1[0], c = bits.Add64(x[0], y[0], 0)
|
||||
@ -163,107 +177,152 @@ func p256Add(res, x, y []uint64) {
|
||||
res[3] = (t1[3] & ^t2Mask) | (t2[3] & t2Mask)
|
||||
}
|
||||
|
||||
// Functions implemented in p256_asm_*64.s
|
||||
// Montgomery multiplication modulo P256
|
||||
// The following assembly functions are implemented in p256_asm_*.s
|
||||
|
||||
// Montgomery multiplication. Sets res = in1 * in2 * R⁻¹ mod p.
|
||||
//
|
||||
//go:noescape
|
||||
func p256Mul(res, in1, in2 []uint64)
|
||||
func p256Mul(res, in1, in2 *p256Element)
|
||||
|
||||
// Montgomery square modulo P256, repeated n times (n >= 1)
|
||||
// Montgomery square, repeated n times (n >= 1).
|
||||
//
|
||||
//go:noescape
|
||||
func p256Sqr(res, in []uint64, n int)
|
||||
func p256Sqr(res, in *p256Element, n int)
|
||||
|
||||
// Montgomery multiplication by 1
|
||||
// Montgomery multiplication by R⁻¹, or 1 outside the domain.
|
||||
// Sets res = in * R⁻¹, bringing res out of the Montgomery domain.
|
||||
//
|
||||
//go:noescape
|
||||
func p256FromMont(res, in []uint64)
|
||||
func p256FromMont(res, in *p256Element)
|
||||
|
||||
// iff cond == 1 val <- -val
|
||||
// If cond is not 0, sets val = -val mod p.
|
||||
//
|
||||
//go:noescape
|
||||
func p256NegCond(val []uint64, cond int)
|
||||
func p256NegCond(val *p256Element, cond int)
|
||||
|
||||
// if cond == 0 res <- b; else res <- a
|
||||
// If cond is 0, sets res = b, otherwise sets res = a.
|
||||
//
|
||||
//go:noescape
|
||||
func p256MovCond(res, a, b []uint64, cond int)
|
||||
func p256MovCond(res, a, b *P256Point, cond int)
|
||||
|
||||
// Endianness swap
|
||||
//go:noescape
|
||||
func p256BigToLittle(res *p256Element, in *[32]byte)
|
||||
|
||||
//go:noescape
|
||||
func p256LittleToBig(res *[32]byte, in *p256Element)
|
||||
|
||||
//go:noescape
|
||||
func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
|
||||
|
||||
//go:noescape
|
||||
func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
|
||||
|
||||
// p256Table is a table of the first 16 multiples of a point. Points are stored
|
||||
// at an index offset of -1 so [8]P is at index 7, P is at 0, and [16]P is at 15.
|
||||
// [0]P is the point at infinity and it's not stored.
|
||||
type p256Table [16]P256Point
|
||||
|
||||
// p256Select sets res to the point at index idx in the table.
|
||||
// idx must be in [0, 15]. It executes in constant time.
|
||||
//
|
||||
//go:noescape
|
||||
func p256BigToLittle(res []uint64, in []byte)
|
||||
func p256Select(res *P256Point, table *p256Table, idx int)
|
||||
|
||||
//go:noescape
|
||||
func p256LittleToBig(res []byte, in []uint64)
|
||||
// p256AffinePoint is a point in affine coordinates (x, y). x and y are still
|
||||
// Montgomery domain elements. The point can't be the point at infinity.
|
||||
type p256AffinePoint struct {
|
||||
x, y p256Element
|
||||
}
|
||||
|
||||
// Constant time table access
|
||||
// p256AffineTable is a table of the first 32 multiples of a point. Points are
|
||||
// stored at an index offset of -1 like in p256Table, and [0]P is not stored.
|
||||
type p256AffineTable [32]p256AffinePoint
|
||||
|
||||
// p256Precomputed is a series of precomputed multiples of G, the canonical
|
||||
// generator. The first p256AffineTable contains multiples of G. The second one
|
||||
// multiples of [2⁶]G, the third one of [2¹²]G, and so on, where each successive
|
||||
// table is the previous table doubled six times. Six is the width of the
|
||||
// sliding window used in p256ScalarMult, and having each table already
|
||||
// pre-doubled lets us avoid the doublings between windows entirely. This table
|
||||
// MUST NOT be modified, as it aliases into p256PrecomputedEmbed below.
|
||||
var p256Precomputed *[43]p256AffineTable
|
||||
|
||||
//go:embed p256_asm_table.bin
|
||||
var p256PrecomputedEmbed string
|
||||
|
||||
func init() {
|
||||
p256PrecomputedPtr := (*unsafe.Pointer)(unsafe.Pointer(&p256PrecomputedEmbed))
|
||||
p256Precomputed = (*[43]p256AffineTable)(*p256PrecomputedPtr)
|
||||
}
|
||||
|
||||
// p256SelectAffine sets res to the point at index idx in the table.
|
||||
// idx must be in [0, 31]. It executes in constant time.
|
||||
//
|
||||
//go:noescape
|
||||
func p256Select(point, table []uint64, idx int)
|
||||
func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
|
||||
|
||||
//go:noescape
|
||||
func p256SelectBase(point *[12]uint64, table string, idx int)
|
||||
|
||||
// Montgomery multiplication modulo Ord(G)
|
||||
// Point addition with an affine point and constant time conditions.
|
||||
// If zero is 0, sets res = in2. If sel is 0, sets res = in1.
|
||||
// If sign is not 0, sets res = in1 + -in2. Otherwise, sets res = in1 + in2
|
||||
//
|
||||
//go:noescape
|
||||
func p256OrdMul(res, in1, in2 []uint64)
|
||||
func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
|
||||
|
||||
// Montgomery square modulo Ord(G), repeated n times
|
||||
// Point addition. Sets res = in1 + in2. Returns one if the two input points
|
||||
// were equal and zero otherwise. If in1 or in2 are the point at infinity, res
|
||||
// and the return value are undefined.
|
||||
//
|
||||
//go:noescape
|
||||
func p256OrdSqr(res, in []uint64, n int)
|
||||
func p256PointAddAsm(res, in1, in2 *P256Point) int
|
||||
|
||||
// Point add with in2 being affine point
|
||||
// If sign == 1 -> in2 = -in2
|
||||
// If sel == 0 -> res = in1
|
||||
// if zero == 0 -> res = in2
|
||||
// Point doubling. Sets res = in + in. in can be the point at infinity.
|
||||
//
|
||||
//go:noescape
|
||||
func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
|
||||
func p256PointDoubleAsm(res, in *P256Point)
|
||||
|
||||
// Point add. Returns one if the two input points were equal and zero
|
||||
// otherwise. (Note that, due to the way that the equations work out, some
|
||||
// representations of ∞ are considered equal to everything by this function.)
|
||||
// p256OrdElement is a P-256 scalar field element in [0, ord(G)-1] in the
|
||||
// Montgomery domain (with R 2²⁵⁶) as four uint64 limbs in little-endian order.
|
||||
type p256OrdElement [4]uint64
|
||||
|
||||
// Montgomery multiplication modulo org(G). Sets res = in1 * in2 * R⁻¹.
|
||||
//
|
||||
//go:noescape
|
||||
func p256PointAddAsm(res, in1, in2 []uint64) int
|
||||
func p256OrdMul(res, in1, in2 *p256OrdElement)
|
||||
|
||||
// Point double
|
||||
// Montgomery square modulo org(G), repeated n times (n >= 1).
|
||||
//
|
||||
//go:noescape
|
||||
func p256PointDoubleAsm(res, in []uint64)
|
||||
func p256OrdSqr(res, in *p256OrdElement, n int)
|
||||
|
||||
func P256OrdInverse(k []byte) ([]byte, error) {
|
||||
// TODO: test for values p <= x < 2^256.
|
||||
if len(k) != 32 {
|
||||
return nil, errors.New("invalid scalar length")
|
||||
}
|
||||
|
||||
// table will store precomputed powers of x.
|
||||
var table [4 * 9]uint64
|
||||
var (
|
||||
_1 = table[4*0 : 4*1]
|
||||
_11 = table[4*1 : 4*2]
|
||||
_101 = table[4*2 : 4*3]
|
||||
_111 = table[4*3 : 4*4]
|
||||
_1111 = table[4*4 : 4*5]
|
||||
_10101 = table[4*5 : 4*6]
|
||||
_101111 = table[4*6 : 4*7]
|
||||
x = table[4*7 : 4*8]
|
||||
t = table[4*8 : 4*9]
|
||||
)
|
||||
x := new(p256OrdElement)
|
||||
p256OrdBigToLittle(x, (*[32]byte)(k))
|
||||
|
||||
// Inversion is implemented as exponentiation by n - 2, per Fermat's little theorem.
|
||||
//
|
||||
// The sequence of 38 multiplications and 254 squarings is derived from
|
||||
// https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion
|
||||
_1 := new(p256OrdElement)
|
||||
_11 := new(p256OrdElement)
|
||||
_101 := new(p256OrdElement)
|
||||
_111 := new(p256OrdElement)
|
||||
_1111 := new(p256OrdElement)
|
||||
_10101 := new(p256OrdElement)
|
||||
_101111 := new(p256OrdElement)
|
||||
t := new(p256OrdElement)
|
||||
|
||||
// This code operates in the Montgomery domain where R = 2²⁵⁶ mod n and n is
|
||||
// the order of the scalar field. Elements in the Montgomery domain take the
|
||||
// form a×R and p256OrdMul calculates (a × b × R⁻¹) mod n. RR is R in the
|
||||
// domain, or R×R mod n, thus p256OrdMul(x, RR) gives x×R, i.e. converts x
|
||||
// into the Montgomery domain.
|
||||
RR := &p256OrdElement{0x83244c95be79eea2, 0x4699799c49bd6fa6,
|
||||
0x2845b2392b6bec59, 0x66e12d94f3d95620}
|
||||
|
||||
p256BigToLittle(x, k)
|
||||
// This code operates in the Montgomery domain where R = 2^256 mod n
|
||||
// and n is the order of the scalar field. (See initP256 for the
|
||||
// value.) Elements in the Montgomery domain take the form a×R and
|
||||
// multiplication of x and y in the calculates (x × y × R^-1) mod n. RR
|
||||
// is R×R mod n thus the Montgomery multiplication x and RR gives x×R,
|
||||
// i.e. converts x into the Montgomery domain.
|
||||
// Window values borrowed from https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion
|
||||
RR := []uint64{0x83244c95be79eea2, 0x4699799c49bd6fa6, 0x2845b2392b6bec59, 0x66e12d94f3d95620}
|
||||
p256OrdMul(_1, x, RR) // _1
|
||||
p256OrdSqr(x, _1, 1) // _10
|
||||
p256OrdMul(_11, x, _1) // _11
|
||||
@ -289,13 +348,13 @@ func P256OrdInverse(k []byte) ([]byte, error) {
|
||||
p256OrdSqr(x, x, 32)
|
||||
p256OrdMul(x, x, t)
|
||||
|
||||
sqrs := []uint8{
|
||||
sqrs := []int{
|
||||
6, 5, 4, 5, 5,
|
||||
4, 3, 3, 5, 9,
|
||||
6, 2, 5, 6, 5,
|
||||
4, 5, 5, 3, 10,
|
||||
2, 5, 5, 3, 7, 6}
|
||||
muls := [][]uint64{
|
||||
muls := []*p256OrdElement{
|
||||
_101111, _111, _11, _1111, _10101,
|
||||
_101, _101, _101, _111, _101111,
|
||||
_1111, _1, _1, _1111, _111,
|
||||
@ -303,42 +362,37 @@ func P256OrdInverse(k []byte) ([]byte, error) {
|
||||
_11, _11, _11, _1, _10101, _1111}
|
||||
|
||||
for i, s := range sqrs {
|
||||
p256OrdSqr(x, x, int(s))
|
||||
p256OrdSqr(x, x, s)
|
||||
p256OrdMul(x, x, muls[i])
|
||||
}
|
||||
|
||||
// Multiplying by one in the Montgomery domain converts a Montgomery
|
||||
// value out of the domain.
|
||||
one := []uint64{1, 0, 0, 0}
|
||||
// Montgomery multiplication by R⁻¹, or 1 outside the domain as R⁻¹×R = 1,
|
||||
// converts a Montgomery value out of the domain.
|
||||
one := &p256OrdElement{1}
|
||||
p256OrdMul(x, x, one)
|
||||
|
||||
xOut := make([]byte, 32)
|
||||
p256LittleToBig(xOut, x)
|
||||
return xOut, nil
|
||||
var xOut [32]byte
|
||||
p256OrdLittleToBig(&xOut, x)
|
||||
return xOut[:], nil
|
||||
}
|
||||
|
||||
// p256Mul operates in a Montgomery domain with R = 2^256 mod p, where p is the
|
||||
// underlying field of the curve. (See initP256 for the value.) Thus rr here is
|
||||
// R×R mod p. See comment in Inverse about how this is used.
|
||||
var rr = []uint64{0x0000000000000003, 0xfffffffbffffffff, 0xfffffffffffffffe, 0x00000004fffffffd}
|
||||
|
||||
// Add sets q = p1 + p2, and returns q. The points may overlap.
|
||||
func (q *P256Point) Add(r1, r2 *P256Point) *P256Point {
|
||||
var sum, double P256Point
|
||||
r1IsInfinity := r1.isInfinity()
|
||||
r2IsInfinity := r2.isInfinity()
|
||||
pointsEqual := p256PointAddAsm(sum.xyz[:], r1.xyz[:], r2.xyz[:])
|
||||
p256PointDoubleAsm(double.xyz[:], r1.xyz[:])
|
||||
sum.Select(&double, &sum, pointsEqual)
|
||||
sum.Select(r1, &sum, r2IsInfinity)
|
||||
sum.Select(r2, &sum, r1IsInfinity)
|
||||
pointsEqual := p256PointAddAsm(&sum, r1, r2)
|
||||
p256PointDoubleAsm(&double, r1)
|
||||
p256MovCond(&sum, &double, &sum, pointsEqual)
|
||||
p256MovCond(&sum, r1, &sum, r2IsInfinity)
|
||||
p256MovCond(&sum, r2, &sum, r1IsInfinity)
|
||||
return q.Set(&sum)
|
||||
}
|
||||
|
||||
// Double sets q = p + p, and returns q. The points may overlap.
|
||||
func (q *P256Point) Double(p *P256Point) *P256Point {
|
||||
var double P256Point
|
||||
p256PointDoubleAsm(double.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(&double, p)
|
||||
return q.Set(&double)
|
||||
}
|
||||
|
||||
@ -346,12 +400,11 @@ func (q *P256Point) Double(p *P256Point) *P256Point {
|
||||
// endian value, and returns r. If scalar is not 32 bytes long, ScalarBaseMult
|
||||
// returns an error and the receiver is unchanged.
|
||||
func (r *P256Point) ScalarBaseMult(scalar []byte) (*P256Point, error) {
|
||||
// TODO: test for values p <= x < 2^256.
|
||||
if len(scalar) != 32 {
|
||||
return nil, errors.New("invalid scalar length")
|
||||
}
|
||||
scalarReversed := make([]uint64, 4)
|
||||
p256BigToLittle(scalarReversed, scalar)
|
||||
scalarReversed := new(p256OrdElement)
|
||||
p256OrdBigToLittle(scalarReversed, (*[32]byte)(scalar))
|
||||
|
||||
r.p256BaseMult(scalarReversed)
|
||||
return r, nil
|
||||
@ -361,12 +414,11 @@ func (r *P256Point) ScalarBaseMult(scalar []byte) (*P256Point, error) {
|
||||
// and returns r. If scalar is not 32 bytes long, ScalarBaseMult returns an
|
||||
// error and the receiver is unchanged.
|
||||
func (r *P256Point) ScalarMult(q *P256Point, scalar []byte) (*P256Point, error) {
|
||||
// TODO: test for values p <= x < 2^256.
|
||||
if len(scalar) != 32 {
|
||||
return nil, errors.New("invalid scalar length")
|
||||
}
|
||||
scalarReversed := make([]uint64, 4)
|
||||
p256BigToLittle(scalarReversed, scalar)
|
||||
scalarReversed := new(p256OrdElement)
|
||||
p256OrdBigToLittle(scalarReversed, (*[32]byte)(scalar))
|
||||
|
||||
r.Set(q).p256ScalarMult(scalarReversed)
|
||||
return r, nil
|
||||
@ -384,9 +436,18 @@ func uint64IsZero(x uint64) int {
|
||||
return int(x & 1)
|
||||
}
|
||||
|
||||
// p256Equal returns 1 if a and b are equal and 0 otherwise.
|
||||
func p256Equal(a, b *p256Element) int {
|
||||
var acc uint64
|
||||
for i := range a {
|
||||
acc |= a[i] ^ b[i]
|
||||
}
|
||||
return uint64IsZero(acc)
|
||||
}
|
||||
|
||||
// isInfinity returns 1 if p is the point at infinity and 0 otherwise.
|
||||
func (p *P256Point) isInfinity() int {
|
||||
return uint64IsZero(p.xyz[8] | p.xyz[9] | p.xyz[10] | p.xyz[11])
|
||||
return p256Equal(&p.z, &p256Zero)
|
||||
}
|
||||
|
||||
// Bytes returns the uncompressed or infinity encoding of p, as specified in
|
||||
@ -405,82 +466,83 @@ func (p *P256Point) bytes(out *[p256UncompressedLength]byte) []byte {
|
||||
return out[:1]
|
||||
}
|
||||
|
||||
zInv := make([]uint64, 4)
|
||||
zInvSq := make([]uint64, 4)
|
||||
p256Inverse(zInv, p.xyz[8:12])
|
||||
zInv := new(p256Element)
|
||||
zInvSq := new(p256Element)
|
||||
p256Inverse(zInv, &p.z)
|
||||
p256Sqr(zInvSq, zInv, 1)
|
||||
p256Mul(zInv, zInv, zInvSq)
|
||||
|
||||
p256Mul(zInvSq, p.xyz[0:4], zInvSq)
|
||||
p256Mul(zInv, p.xyz[4:8], zInv)
|
||||
p256Mul(zInvSq, &p.x, zInvSq)
|
||||
p256Mul(zInv, &p.y, zInv)
|
||||
|
||||
p256FromMont(zInvSq, zInvSq)
|
||||
p256FromMont(zInv, zInv)
|
||||
|
||||
out[0] = 4 // Uncompressed form.
|
||||
p256LittleToBig(out[1:33], zInvSq)
|
||||
p256LittleToBig(out[33:65], zInv)
|
||||
p256LittleToBig((*[32]byte)(out[1:33]), zInvSq)
|
||||
p256LittleToBig((*[32]byte)(out[33:65]), zInv)
|
||||
|
||||
return out[:]
|
||||
}
|
||||
|
||||
// Select sets q to p1 if cond == 1, and to p2 if cond == 0.
|
||||
func (q *P256Point) Select(p1, p2 *P256Point, cond int) *P256Point {
|
||||
p256MovCond(q.xyz[:], p1.xyz[:], p2.xyz[:], cond)
|
||||
p256MovCond(q, p1, p2, cond)
|
||||
return q
|
||||
}
|
||||
|
||||
// p256Inverse sets out to in^-1 mod p.
|
||||
func p256Inverse(out, in []uint64) {
|
||||
var stack [6 * 4]uint64
|
||||
p2 := stack[4*0 : 4*0+4]
|
||||
p4 := stack[4*1 : 4*1+4]
|
||||
p8 := stack[4*2 : 4*2+4]
|
||||
p16 := stack[4*3 : 4*3+4]
|
||||
p32 := stack[4*4 : 4*4+4]
|
||||
// p256Inverse sets out to in⁻¹ mod p. If in is zero, out will be zero.
|
||||
func p256Inverse(out, in *p256Element) {
|
||||
// Inversion is calculated through exponentiation by p - 2, per Fermat's
|
||||
// little theorem.
|
||||
//
|
||||
// The sequence of 12 multiplications and 255 squarings is derived from the
|
||||
// following addition chain generated with github.com/mmcloughlin/addchain
|
||||
// v0.4.0.
|
||||
//
|
||||
// _10 = 2*1
|
||||
// _11 = 1 + _10
|
||||
// _110 = 2*_11
|
||||
// _111 = 1 + _110
|
||||
// _111000 = _111 << 3
|
||||
// _111111 = _111 + _111000
|
||||
// x12 = _111111 << 6 + _111111
|
||||
// x15 = x12 << 3 + _111
|
||||
// x16 = 2*x15 + 1
|
||||
// x32 = x16 << 16 + x16
|
||||
// i53 = x32 << 15
|
||||
// x47 = x15 + i53
|
||||
// i263 = ((i53 << 17 + 1) << 143 + x47) << 47
|
||||
// return (x47 + i263) << 2 + 1
|
||||
//
|
||||
var z = new(p256Element)
|
||||
var t0 = new(p256Element)
|
||||
var t1 = new(p256Element)
|
||||
|
||||
p256Sqr(out, in, 1)
|
||||
p256Mul(p2, out, in) // 3*p
|
||||
|
||||
p256Sqr(out, p2, 2)
|
||||
p256Mul(p4, out, p2) // f*p
|
||||
|
||||
p256Sqr(out, p4, 4)
|
||||
p256Mul(p8, out, p4) // ff*p
|
||||
|
||||
p256Sqr(out, p8, 8)
|
||||
p256Mul(p16, out, p8) // ffff*p
|
||||
|
||||
p256Sqr(out, p16, 16)
|
||||
p256Mul(p32, out, p16) // ffffffff*p
|
||||
|
||||
p256Sqr(out, p32, 32)
|
||||
p256Mul(out, out, in)
|
||||
|
||||
p256Sqr(out, out, 128)
|
||||
p256Mul(out, out, p32)
|
||||
|
||||
p256Sqr(out, out, 32)
|
||||
p256Mul(out, out, p32)
|
||||
|
||||
p256Sqr(out, out, 16)
|
||||
p256Mul(out, out, p16)
|
||||
|
||||
p256Sqr(out, out, 8)
|
||||
p256Mul(out, out, p8)
|
||||
|
||||
p256Sqr(out, out, 4)
|
||||
p256Mul(out, out, p4)
|
||||
|
||||
p256Sqr(out, out, 2)
|
||||
p256Mul(out, out, p2)
|
||||
|
||||
p256Sqr(out, out, 2)
|
||||
p256Mul(out, out, in)
|
||||
}
|
||||
|
||||
func (p *P256Point) p256StorePoint(r *[16 * 4 * 3]uint64, index int) {
|
||||
copy(r[index*12:], p.xyz[:])
|
||||
p256Sqr(z, in, 1)
|
||||
p256Mul(z, in, z)
|
||||
p256Sqr(z, z, 1)
|
||||
p256Mul(z, in, z)
|
||||
p256Sqr(t0, z, 3)
|
||||
p256Mul(t0, z, t0)
|
||||
p256Sqr(t1, t0, 6)
|
||||
p256Mul(t0, t0, t1)
|
||||
p256Sqr(t0, t0, 3)
|
||||
p256Mul(z, z, t0)
|
||||
p256Sqr(t0, z, 1)
|
||||
p256Mul(t0, in, t0)
|
||||
p256Sqr(t1, t0, 16)
|
||||
p256Mul(t0, t0, t1)
|
||||
p256Sqr(t0, t0, 15)
|
||||
p256Mul(z, z, t0)
|
||||
p256Sqr(t0, t0, 17)
|
||||
p256Mul(t0, in, t0)
|
||||
p256Sqr(t0, t0, 143)
|
||||
p256Mul(t0, z, t0)
|
||||
p256Sqr(t0, t0, 47)
|
||||
p256Mul(z, z, t0)
|
||||
p256Sqr(z, z, 2)
|
||||
p256Mul(out, in, z)
|
||||
}
|
||||
|
||||
func boothW5(in uint) (int, int) {
|
||||
@ -499,24 +561,14 @@ func boothW6(in uint) (int, int) {
|
||||
return int(d), int(s & 1)
|
||||
}
|
||||
|
||||
func (p *P256Point) p256BaseMult(scalar []uint64) {
|
||||
func (p *P256Point) p256BaseMult(scalar *p256OrdElement) {
|
||||
var t0 p256AffinePoint
|
||||
|
||||
wvalue := (scalar[0] << 1) & 0x7f
|
||||
sel, sign := boothW6(uint(wvalue))
|
||||
p256SelectBase(&p.xyz, p256Precomputed, sel)
|
||||
p256NegCond(p.xyz[4:8], sign)
|
||||
|
||||
// (This is one, in the Montgomery domain.)
|
||||
p.xyz[8] = 0x0000000000000001
|
||||
p.xyz[9] = 0xffffffff00000000
|
||||
p.xyz[10] = 0xffffffffffffffff
|
||||
p.xyz[11] = 0x00000000fffffffe
|
||||
|
||||
var t0 P256Point
|
||||
// (This is one, in the Montgomery domain.)
|
||||
t0.xyz[8] = 0x0000000000000001
|
||||
t0.xyz[9] = 0xffffffff00000000
|
||||
t0.xyz[10] = 0xffffffffffffffff
|
||||
t0.xyz[11] = 0x00000000fffffffe
|
||||
p256SelectAffine(&t0, &p256Precomputed[0], sel)
|
||||
p.x, p.y, p.z = t0.x, t0.y, p256One
|
||||
p256NegCond(&p.y, sign)
|
||||
|
||||
index := uint(5)
|
||||
zero := sel
|
||||
@ -529,59 +581,59 @@ func (p *P256Point) p256BaseMult(scalar []uint64) {
|
||||
}
|
||||
index += 6
|
||||
sel, sign = boothW6(uint(wvalue))
|
||||
p256SelectBase(&t0.xyz, p256Precomputed[i*32*8*8:], sel)
|
||||
p256PointAddAffineAsm(p.xyz[0:12], p.xyz[0:12], t0.xyz[0:8], sign, sel, zero)
|
||||
p256SelectAffine(&t0, &p256Precomputed[i], sel)
|
||||
p256PointAddAffineAsm(p, p, &t0, sign, sel, zero)
|
||||
zero |= sel
|
||||
}
|
||||
|
||||
// If the whole scalar was zero, set to the point at infinity.
|
||||
p256MovCond(p.xyz[:], NewP256Point().xyz[:], p.xyz[:], uint64IsZero(uint64(zero)))
|
||||
p256MovCond(p, p, NewP256Point(), zero)
|
||||
}
|
||||
|
||||
func (p *P256Point) p256ScalarMult(scalar []uint64) {
|
||||
func (p *P256Point) p256ScalarMult(scalar *p256OrdElement) {
|
||||
// precomp is a table of precomputed points that stores powers of p
|
||||
// from p^1 to p^16.
|
||||
var precomp [16 * 4 * 3]uint64
|
||||
var precomp p256Table
|
||||
var t0, t1, t2, t3 P256Point
|
||||
|
||||
// Prepare the table
|
||||
p.p256StorePoint(&precomp, 0) // 1
|
||||
precomp[0] = *p // 1
|
||||
|
||||
p256PointDoubleAsm(t0.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(t1.xyz[:], t0.xyz[:])
|
||||
p256PointDoubleAsm(t2.xyz[:], t1.xyz[:])
|
||||
p256PointDoubleAsm(t3.xyz[:], t2.xyz[:])
|
||||
t0.p256StorePoint(&precomp, 1) // 2
|
||||
t1.p256StorePoint(&precomp, 3) // 4
|
||||
t2.p256StorePoint(&precomp, 7) // 8
|
||||
t3.p256StorePoint(&precomp, 15) // 16
|
||||
p256PointDoubleAsm(&t0, p)
|
||||
p256PointDoubleAsm(&t1, &t0)
|
||||
p256PointDoubleAsm(&t2, &t1)
|
||||
p256PointDoubleAsm(&t3, &t2)
|
||||
precomp[1] = t0 // 2
|
||||
precomp[3] = t1 // 4
|
||||
precomp[7] = t2 // 8
|
||||
precomp[15] = t3 // 16
|
||||
|
||||
p256PointAddAsm(t0.xyz[:], t0.xyz[:], p.xyz[:])
|
||||
p256PointAddAsm(t1.xyz[:], t1.xyz[:], p.xyz[:])
|
||||
p256PointAddAsm(t2.xyz[:], t2.xyz[:], p.xyz[:])
|
||||
t0.p256StorePoint(&precomp, 2) // 3
|
||||
t1.p256StorePoint(&precomp, 4) // 5
|
||||
t2.p256StorePoint(&precomp, 8) // 9
|
||||
p256PointAddAsm(&t0, &t0, p)
|
||||
p256PointAddAsm(&t1, &t1, p)
|
||||
p256PointAddAsm(&t2, &t2, p)
|
||||
precomp[2] = t0 // 3
|
||||
precomp[4] = t1 // 5
|
||||
precomp[8] = t2 // 9
|
||||
|
||||
p256PointDoubleAsm(t0.xyz[:], t0.xyz[:])
|
||||
p256PointDoubleAsm(t1.xyz[:], t1.xyz[:])
|
||||
t0.p256StorePoint(&precomp, 5) // 6
|
||||
t1.p256StorePoint(&precomp, 9) // 10
|
||||
p256PointDoubleAsm(&t0, &t0)
|
||||
p256PointDoubleAsm(&t1, &t1)
|
||||
precomp[5] = t0 // 6
|
||||
precomp[9] = t1 // 10
|
||||
|
||||
p256PointAddAsm(t2.xyz[:], t0.xyz[:], p.xyz[:])
|
||||
p256PointAddAsm(t1.xyz[:], t1.xyz[:], p.xyz[:])
|
||||
t2.p256StorePoint(&precomp, 6) // 7
|
||||
t1.p256StorePoint(&precomp, 10) // 11
|
||||
p256PointAddAsm(&t2, &t0, p)
|
||||
p256PointAddAsm(&t1, &t1, p)
|
||||
precomp[6] = t2 // 7
|
||||
precomp[10] = t1 // 11
|
||||
|
||||
p256PointDoubleAsm(t0.xyz[:], t0.xyz[:])
|
||||
p256PointDoubleAsm(t2.xyz[:], t2.xyz[:])
|
||||
t0.p256StorePoint(&precomp, 11) // 12
|
||||
t2.p256StorePoint(&precomp, 13) // 14
|
||||
p256PointDoubleAsm(&t0, &t0)
|
||||
p256PointDoubleAsm(&t2, &t2)
|
||||
precomp[11] = t0 // 12
|
||||
precomp[13] = t2 // 14
|
||||
|
||||
p256PointAddAsm(t0.xyz[:], t0.xyz[:], p.xyz[:])
|
||||
p256PointAddAsm(t2.xyz[:], t2.xyz[:], p.xyz[:])
|
||||
t0.p256StorePoint(&precomp, 12) // 13
|
||||
t2.p256StorePoint(&precomp, 14) // 15
|
||||
p256PointAddAsm(&t0, &t0, p)
|
||||
p256PointAddAsm(&t2, &t2, p)
|
||||
precomp[12] = t0 // 13
|
||||
precomp[14] = t2 // 15
|
||||
|
||||
// Start scanning the window from top bit
|
||||
index := uint(254)
|
||||
@ -590,16 +642,16 @@ func (p *P256Point) p256ScalarMult(scalar []uint64) {
|
||||
wvalue := (scalar[index/64] >> (index % 64)) & 0x3f
|
||||
sel, _ = boothW5(uint(wvalue))
|
||||
|
||||
p256Select(p.xyz[0:12], precomp[0:], sel)
|
||||
p256Select(p, &precomp, sel)
|
||||
zero := sel
|
||||
|
||||
for index > 4 {
|
||||
index -= 5
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
|
||||
if index < 192 {
|
||||
wvalue = ((scalar[index/64] >> (index % 64)) + (scalar[index/64+1] << (64 - (index % 64)))) & 0x3f
|
||||
@ -609,26 +661,26 @@ func (p *P256Point) p256ScalarMult(scalar []uint64) {
|
||||
|
||||
sel, sign = boothW5(uint(wvalue))
|
||||
|
||||
p256Select(t0.xyz[0:], precomp[0:], sel)
|
||||
p256NegCond(t0.xyz[4:8], sign)
|
||||
p256PointAddAsm(t1.xyz[:], p.xyz[:], t0.xyz[:])
|
||||
p256MovCond(t1.xyz[0:12], t1.xyz[0:12], p.xyz[0:12], sel)
|
||||
p256MovCond(p.xyz[0:12], t1.xyz[0:12], t0.xyz[0:12], zero)
|
||||
p256Select(&t0, &precomp, sel)
|
||||
p256NegCond(&t0.y, sign)
|
||||
p256PointAddAsm(&t1, p, &t0)
|
||||
p256MovCond(&t1, &t1, p, sel)
|
||||
p256MovCond(p, &t1, &t0, zero)
|
||||
zero |= sel
|
||||
}
|
||||
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p.xyz[:], p.xyz[:])
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
p256PointDoubleAsm(p, p)
|
||||
|
||||
wvalue = (scalar[0] << 1) & 0x3f
|
||||
sel, sign = boothW5(uint(wvalue))
|
||||
|
||||
p256Select(t0.xyz[0:], precomp[0:], sel)
|
||||
p256NegCond(t0.xyz[4:8], sign)
|
||||
p256PointAddAsm(t1.xyz[:], p.xyz[:], t0.xyz[:])
|
||||
p256MovCond(t1.xyz[0:12], t1.xyz[0:12], p.xyz[0:12], sel)
|
||||
p256MovCond(p.xyz[0:12], t1.xyz[0:12], t0.xyz[0:12], zero)
|
||||
p256Select(&t0, &precomp, sel)
|
||||
p256NegCond(&t0.y, sign)
|
||||
p256PointAddAsm(&t1, p, &t0)
|
||||
p256MovCond(&t1, &t1, p, sel)
|
||||
p256MovCond(p, &t1, &t0, zero)
|
||||
}
|
||||
|
||||
@ -42,14 +42,22 @@ GLOBL p256ord<>(SB), 8, $32
|
||||
GLOBL p256one<>(SB), 8, $32
|
||||
|
||||
/* ---------------------------------------*/
|
||||
// func p256LittleToBig(res []byte, in []uint64)
|
||||
// func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
|
||||
TEXT ·p256OrdLittleToBig(SB),NOSPLIT,$0
|
||||
JMP ·p256BigToLittle(SB)
|
||||
/* ---------------------------------------*/
|
||||
// func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
|
||||
TEXT ·p256OrdBigToLittle(SB),NOSPLIT,$0
|
||||
JMP ·p256BigToLittle(SB)
|
||||
/* ---------------------------------------*/
|
||||
// func p256LittleToBig(res *[32]byte, in *p256Element)
|
||||
TEXT ·p256LittleToBig(SB),NOSPLIT,$0
|
||||
JMP ·p256BigToLittle(SB)
|
||||
/* ---------------------------------------*/
|
||||
// func p256BigToLittle(res []uint64, in []byte)
|
||||
// func p256BigToLittle(res *p256Element, in *[32]byte)
|
||||
TEXT ·p256BigToLittle(SB),NOSPLIT,$0
|
||||
MOVQ res+0(FP), res_ptr
|
||||
MOVQ in+24(FP), x_ptr
|
||||
MOVQ in+8(FP), x_ptr
|
||||
|
||||
MOVQ (8*0)(x_ptr), acc0
|
||||
MOVQ (8*1)(x_ptr), acc1
|
||||
@ -68,13 +76,12 @@ TEXT ·p256BigToLittle(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256MovCond(res, a, b []uint64, cond int)
|
||||
// If cond == 0 res=b, else res=a
|
||||
// func p256MovCond(res, a, b *P256Point, cond int)
|
||||
TEXT ·p256MovCond(SB),NOSPLIT,$0
|
||||
MOVQ res+0(FP), res_ptr
|
||||
MOVQ a+24(FP), x_ptr
|
||||
MOVQ b+48(FP), y_ptr
|
||||
MOVQ cond+72(FP), X12
|
||||
MOVQ a+8(FP), x_ptr
|
||||
MOVQ b+16(FP), y_ptr
|
||||
MOVQ cond+24(FP), X12
|
||||
|
||||
PXOR X13, X13
|
||||
PSHUFD $0, X12, X12
|
||||
@ -129,10 +136,10 @@ TEXT ·p256MovCond(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256NegCond(val []uint64, cond int)
|
||||
// func p256NegCond(val *p256Element, cond int)
|
||||
TEXT ·p256NegCond(SB),NOSPLIT,$0
|
||||
MOVQ val+0(FP), res_ptr
|
||||
MOVQ cond+24(FP), t0
|
||||
MOVQ cond+8(FP), t0
|
||||
// acc = poly
|
||||
MOVQ $-1, acc0
|
||||
MOVQ p256const0<>(SB), acc1
|
||||
@ -162,11 +169,11 @@ TEXT ·p256NegCond(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256Sqr(res, in []uint64, n int)
|
||||
// func p256Sqr(res, in *p256Element, n int)
|
||||
TEXT ·p256Sqr(SB),NOSPLIT,$0
|
||||
MOVQ res+0(FP), res_ptr
|
||||
MOVQ in+24(FP), x_ptr
|
||||
MOVQ n+48(FP), BX
|
||||
MOVQ in+8(FP), x_ptr
|
||||
MOVQ n+16(FP), BX
|
||||
|
||||
sqrLoop:
|
||||
|
||||
@ -326,11 +333,11 @@ sqrLoop:
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256Mul(res, in1, in2 []uint64)
|
||||
// func p256Mul(res, in1, in2 *p256Element)
|
||||
TEXT ·p256Mul(SB),NOSPLIT,$0
|
||||
MOVQ res+0(FP), res_ptr
|
||||
MOVQ in1+24(FP), x_ptr
|
||||
MOVQ in2+48(FP), y_ptr
|
||||
MOVQ in1+8(FP), x_ptr
|
||||
MOVQ in2+16(FP), y_ptr
|
||||
// x * y[0]
|
||||
MOVQ (8*0)(y_ptr), t0
|
||||
|
||||
@ -524,10 +531,10 @@ TEXT ·p256Mul(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256FromMont(res, in []uint64)
|
||||
// func p256FromMont(res, in *p256Element)
|
||||
TEXT ·p256FromMont(SB),NOSPLIT,$0
|
||||
MOVQ res+0(FP), res_ptr
|
||||
MOVQ in+24(FP), x_ptr
|
||||
MOVQ in+8(FP), x_ptr
|
||||
|
||||
MOVQ (8*0)(x_ptr), acc0
|
||||
MOVQ (8*1)(x_ptr), acc1
|
||||
@ -602,14 +609,11 @@ TEXT ·p256FromMont(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// Constant time point access to arbitrary point table.
|
||||
// Indexed from 1 to 15, with -1 offset
|
||||
// (index 0 is implicitly point at infinity)
|
||||
// func p256Select(point, table []uint64, idx int)
|
||||
// func p256Select(res *P256Point, table *p256Table, idx int)
|
||||
TEXT ·p256Select(SB),NOSPLIT,$0
|
||||
MOVQ idx+48(FP),AX
|
||||
MOVQ table+24(FP),DI
|
||||
MOVQ point+0(FP),DX
|
||||
MOVQ idx+16(FP),AX
|
||||
MOVQ table+8(FP),DI
|
||||
MOVQ res+0(FP),DX
|
||||
|
||||
PXOR X15, X15 // X15 = 0
|
||||
PCMPEQL X14, X14 // X14 = -1
|
||||
@ -667,12 +671,11 @@ loop_select:
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// Constant time point access to base point table.
|
||||
// func p256SelectBase(point *[12]uint64, table string, idx int)
|
||||
TEXT ·p256SelectBase(SB),NOSPLIT,$0
|
||||
MOVQ idx+24(FP),AX
|
||||
// func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
|
||||
TEXT ·p256SelectAffine(SB),NOSPLIT,$0
|
||||
MOVQ idx+16(FP),AX
|
||||
MOVQ table+8(FP),DI
|
||||
MOVQ point+0(FP),DX
|
||||
MOVQ res+0(FP),DX
|
||||
|
||||
PXOR X15, X15 // X15 = 0
|
||||
PCMPEQL X14, X14 // X14 = -1
|
||||
@ -740,11 +743,11 @@ loop_select_base:
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256OrdMul(res, in1, in2 []uint64)
|
||||
// func p256OrdMul(res, in1, in2 *p256OrdElement)
|
||||
TEXT ·p256OrdMul(SB),NOSPLIT,$0
|
||||
MOVQ res+0(FP), res_ptr
|
||||
MOVQ in1+24(FP), x_ptr
|
||||
MOVQ in2+48(FP), y_ptr
|
||||
MOVQ in1+8(FP), x_ptr
|
||||
MOVQ in2+16(FP), y_ptr
|
||||
// x * y[0]
|
||||
MOVQ (8*0)(y_ptr), t0
|
||||
|
||||
@ -1027,11 +1030,11 @@ TEXT ·p256OrdMul(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256OrdSqr(res, in []uint64, n int)
|
||||
// func p256OrdSqr(res, in *p256OrdElement, n int)
|
||||
TEXT ·p256OrdSqr(SB),NOSPLIT,$0
|
||||
MOVQ res+0(FP), res_ptr
|
||||
MOVQ in+24(FP), x_ptr
|
||||
MOVQ n+48(FP), BX
|
||||
MOVQ in+8(FP), x_ptr
|
||||
MOVQ n+16(FP), BX
|
||||
|
||||
ordSqrLoop:
|
||||
|
||||
@ -1729,15 +1732,15 @@ TEXT p256SqrInternal(SB),NOSPLIT,$8
|
||||
#define sel_save (32*15 + 8)(SP)
|
||||
#define zero_save (32*15 + 8 + 4)(SP)
|
||||
|
||||
// func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
|
||||
TEXT ·p256PointAddAffineAsm(SB),0,$512-96
|
||||
// func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
|
||||
TEXT ·p256PointAddAffineAsm(SB),0,$512-48
|
||||
// Move input to stack in order to free registers
|
||||
MOVQ res+0(FP), AX
|
||||
MOVQ in1+24(FP), BX
|
||||
MOVQ in2+48(FP), CX
|
||||
MOVQ sign+72(FP), DX
|
||||
MOVQ sel+80(FP), t1
|
||||
MOVQ zero+88(FP), t2
|
||||
MOVQ in1+8(FP), BX
|
||||
MOVQ in2+16(FP), CX
|
||||
MOVQ sign+24(FP), DX
|
||||
MOVQ sel+32(FP), t1
|
||||
MOVQ zero+40(FP), t2
|
||||
|
||||
MOVOU (16*0)(BX), X0
|
||||
MOVOU (16*1)(BX), X1
|
||||
@ -2041,13 +2044,13 @@ TEXT p256IsZero(SB),NOSPLIT,$0
|
||||
#define rptr (32*20)(SP)
|
||||
#define points_eq (32*20+8)(SP)
|
||||
|
||||
//func p256PointAddAsm(res, in1, in2 []uint64) int
|
||||
TEXT ·p256PointAddAsm(SB),0,$680-80
|
||||
//func p256PointAddAsm(res, in1, in2 *P256Point) int
|
||||
TEXT ·p256PointAddAsm(SB),0,$680-32
|
||||
// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
|
||||
// Move input to stack in order to free registers
|
||||
MOVQ res+0(FP), AX
|
||||
MOVQ in1+24(FP), BX
|
||||
MOVQ in2+48(FP), CX
|
||||
MOVQ in1+8(FP), BX
|
||||
MOVQ in2+16(FP), CX
|
||||
|
||||
MOVOU (16*0)(BX), X0
|
||||
MOVOU (16*1)(BX), X1
|
||||
@ -2186,7 +2189,7 @@ TEXT ·p256PointAddAsm(SB),0,$680-80
|
||||
MOVOU X5, (16*5)(AX)
|
||||
|
||||
MOVQ points_eq, AX
|
||||
MOVQ AX, ret+72(FP)
|
||||
MOVQ AX, ret+24(FP)
|
||||
|
||||
RET
|
||||
#undef x1in
|
||||
@ -2221,11 +2224,11 @@ TEXT ·p256PointAddAsm(SB),0,$680-80
|
||||
#define tmp(off) (32*6 + off)(SP)
|
||||
#define rptr (32*7)(SP)
|
||||
|
||||
//func p256PointDoubleAsm(res, in []uint64)
|
||||
TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$256-48
|
||||
//func p256PointDoubleAsm(res, in *P256Point)
|
||||
TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$256-16
|
||||
// Move input to stack in order to free registers
|
||||
MOVQ res+0(FP), AX
|
||||
MOVQ in+24(FP), BX
|
||||
MOVQ in+8(FP), BX
|
||||
|
||||
MOVOU (16*0)(BX), X0
|
||||
MOVOU (16*1)(BX), X1
|
||||
|
||||
@ -64,14 +64,22 @@ GLOBL p256ord<>(SB), 8, $32
|
||||
GLOBL p256one<>(SB), 8, $32
|
||||
|
||||
/* ---------------------------------------*/
|
||||
// func p256LittleToBig(res []byte, in []uint64)
|
||||
// func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
|
||||
TEXT ·p256OrdLittleToBig(SB),NOSPLIT,$0
|
||||
JMP ·p256BigToLittle(SB)
|
||||
/* ---------------------------------------*/
|
||||
// func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
|
||||
TEXT ·p256OrdBigToLittle(SB),NOSPLIT,$0
|
||||
JMP ·p256BigToLittle(SB)
|
||||
/* ---------------------------------------*/
|
||||
// func p256LittleToBig(res *[32]byte, in *p256Element)
|
||||
TEXT ·p256LittleToBig(SB),NOSPLIT,$0
|
||||
JMP ·p256BigToLittle(SB)
|
||||
/* ---------------------------------------*/
|
||||
// func p256BigToLittle(res []uint64, in []byte)
|
||||
// func p256BigToLittle(res *p256Element, in *[32]byte)
|
||||
TEXT ·p256BigToLittle(SB),NOSPLIT,$0
|
||||
MOVD res+0(FP), res_ptr
|
||||
MOVD in+24(FP), a_ptr
|
||||
MOVD in+8(FP), a_ptr
|
||||
|
||||
LDP 0*16(a_ptr), (acc0, acc1)
|
||||
LDP 1*16(a_ptr), (acc2, acc3)
|
||||
@ -85,13 +93,13 @@ TEXT ·p256BigToLittle(SB),NOSPLIT,$0
|
||||
STP (acc1, acc0), 1*16(res_ptr)
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256MovCond(res, a, b []uint64, cond int)
|
||||
// func p256MovCond(res, a, b *P256Point, cond int)
|
||||
// If cond == 0 res=b, else res=a
|
||||
TEXT ·p256MovCond(SB),NOSPLIT,$0
|
||||
MOVD res+0(FP), res_ptr
|
||||
MOVD a+24(FP), a_ptr
|
||||
MOVD b+48(FP), b_ptr
|
||||
MOVD cond+72(FP), R3
|
||||
MOVD a+8(FP), a_ptr
|
||||
MOVD b+16(FP), b_ptr
|
||||
MOVD cond+24(FP), R3
|
||||
|
||||
CMP $0, R3
|
||||
// Two remarks:
|
||||
@ -131,10 +139,10 @@ TEXT ·p256MovCond(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256NegCond(val []uint64, cond int)
|
||||
// func p256NegCond(val *p256Element, cond int)
|
||||
TEXT ·p256NegCond(SB),NOSPLIT,$0
|
||||
MOVD val+0(FP), a_ptr
|
||||
MOVD cond+24(FP), hlp0
|
||||
MOVD cond+8(FP), hlp0
|
||||
MOVD a_ptr, res_ptr
|
||||
// acc = poly
|
||||
MOVD $-1, acc0
|
||||
@ -161,11 +169,11 @@ TEXT ·p256NegCond(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256Sqr(res, in []uint64, n int)
|
||||
// func p256Sqr(res, in *p256Element, n int)
|
||||
TEXT ·p256Sqr(SB),NOSPLIT,$0
|
||||
MOVD res+0(FP), res_ptr
|
||||
MOVD in+24(FP), a_ptr
|
||||
MOVD n+48(FP), b_ptr
|
||||
MOVD in+8(FP), a_ptr
|
||||
MOVD n+16(FP), b_ptr
|
||||
|
||||
MOVD p256const0<>(SB), const0
|
||||
MOVD p256const1<>(SB), const1
|
||||
@ -186,11 +194,11 @@ sqrLoop:
|
||||
STP (y2, y3), 1*16(res_ptr)
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256Mul(res, in1, in2 []uint64)
|
||||
// func p256Mul(res, in1, in2 *p256Element)
|
||||
TEXT ·p256Mul(SB),NOSPLIT,$0
|
||||
MOVD res+0(FP), res_ptr
|
||||
MOVD in1+24(FP), a_ptr
|
||||
MOVD in2+48(FP), b_ptr
|
||||
MOVD in1+8(FP), a_ptr
|
||||
MOVD in2+16(FP), b_ptr
|
||||
|
||||
MOVD p256const0<>(SB), const0
|
||||
MOVD p256const1<>(SB), const1
|
||||
@ -207,10 +215,10 @@ TEXT ·p256Mul(SB),NOSPLIT,$0
|
||||
STP (y2, y3), 1*16(res_ptr)
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256FromMont(res, in []uint64)
|
||||
// func p256FromMont(res, in *p256Element)
|
||||
TEXT ·p256FromMont(SB),NOSPLIT,$0
|
||||
MOVD res+0(FP), res_ptr
|
||||
MOVD in+24(FP), a_ptr
|
||||
MOVD in+8(FP), a_ptr
|
||||
|
||||
MOVD p256const0<>(SB), const0
|
||||
MOVD p256const1<>(SB), const1
|
||||
@ -266,14 +274,11 @@ TEXT ·p256FromMont(SB),NOSPLIT,$0
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// Constant time point access to arbitrary point table.
|
||||
// Indexed from 1 to 15, with -1 offset
|
||||
// (index 0 is implicitly point at infinity)
|
||||
// func p256Select(point, table []uint64, idx int)
|
||||
// func p256Select(res *P256Point, table *p256Table, idx int)
|
||||
TEXT ·p256Select(SB),NOSPLIT,$0
|
||||
MOVD idx+48(FP), const0
|
||||
MOVD table+24(FP), b_ptr
|
||||
MOVD point+0(FP), res_ptr
|
||||
MOVD idx+16(FP), const0
|
||||
MOVD table+8(FP), b_ptr
|
||||
MOVD res+0(FP), res_ptr
|
||||
|
||||
EOR x0, x0, x0
|
||||
EOR x1, x1, x1
|
||||
@ -323,12 +328,11 @@ loop_select:
|
||||
STP (t2, t3), 5*16(res_ptr)
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// Constant time point access to base point table.
|
||||
// func p256SelectBase(point *[12]uint64, table string, idx int)
|
||||
TEXT ·p256SelectBase(SB),NOSPLIT,$0
|
||||
MOVD idx+24(FP), t0
|
||||
MOVD table_base+8(FP), t1
|
||||
MOVD point+0(FP), res_ptr
|
||||
// func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
|
||||
TEXT ·p256SelectAffine(SB),NOSPLIT,$0
|
||||
MOVD idx+16(FP), t0
|
||||
MOVD table+8(FP), t1
|
||||
MOVD res+0(FP), res_ptr
|
||||
|
||||
EOR x0, x0, x0
|
||||
EOR x1, x1, x1
|
||||
@ -366,10 +370,10 @@ loop_select:
|
||||
STP (y2, y3), 3*16(res_ptr)
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256OrdSqr(res, in []uint64, n int)
|
||||
// func p256OrdSqr(res, in *p256OrdElement, n int)
|
||||
TEXT ·p256OrdSqr(SB),NOSPLIT,$0
|
||||
MOVD in+24(FP), a_ptr
|
||||
MOVD n+48(FP), b_ptr
|
||||
MOVD in+8(FP), a_ptr
|
||||
MOVD n+16(FP), b_ptr
|
||||
|
||||
MOVD p256ordK0<>(SB), hlp1
|
||||
LDP p256ord<>+0x00(SB), (const0, const1)
|
||||
@ -565,10 +569,10 @@ ordSqrLoop:
|
||||
|
||||
RET
|
||||
/* ---------------------------------------*/
|
||||
// func p256OrdMul(res, in1, in2 []uint64)
|
||||
// func p256OrdMul(res, in1, in2 *p256OrdElement)
|
||||
TEXT ·p256OrdMul(SB),NOSPLIT,$0
|
||||
MOVD in1+24(FP), a_ptr
|
||||
MOVD in2+48(FP), b_ptr
|
||||
MOVD in1+8(FP), a_ptr
|
||||
MOVD in2+16(FP), b_ptr
|
||||
|
||||
MOVD p256ordK0<>(SB), hlp1
|
||||
LDP p256ord<>+0x00(SB), (const0, const1)
|
||||
@ -1091,13 +1095,13 @@ TEXT p256MulInternal<>(SB),NOSPLIT,$0
|
||||
#define u1(off) (32*10 + 8 + off)(RSP)
|
||||
#define u2(off) (32*11 + 8 + off)(RSP)
|
||||
|
||||
// func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
|
||||
TEXT ·p256PointAddAffineAsm(SB),0,$264-96
|
||||
MOVD in1+24(FP), a_ptr
|
||||
MOVD in2+48(FP), b_ptr
|
||||
MOVD sign+72(FP), hlp0
|
||||
MOVD sel+80(FP), hlp1
|
||||
MOVD zero+88(FP), t2
|
||||
// func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
|
||||
TEXT ·p256PointAddAffineAsm(SB),0,$264-48
|
||||
MOVD in1+8(FP), a_ptr
|
||||
MOVD in2+16(FP), b_ptr
|
||||
MOVD sign+24(FP), hlp0
|
||||
MOVD sel+32(FP), hlp1
|
||||
MOVD zero+40(FP), t2
|
||||
|
||||
MOVD $1, t0
|
||||
CMP $0, t2
|
||||
@ -1288,10 +1292,10 @@ TEXT ·p256PointAddAffineAsm(SB),0,$264-96
|
||||
#define zsqr(off) (32*2 + 8 + off)(RSP)
|
||||
#define tmp(off) (32*3 + 8 + off)(RSP)
|
||||
|
||||
//func p256PointDoubleAsm(res, in []uint64)
|
||||
TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-48
|
||||
//func p256PointDoubleAsm(res, in *P256Point)
|
||||
TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-16
|
||||
MOVD res+0(FP), res_ptr
|
||||
MOVD in+24(FP), a_ptr
|
||||
MOVD in+8(FP), a_ptr
|
||||
|
||||
MOVD p256const0<>(SB), const0
|
||||
MOVD p256const1<>(SB), const1
|
||||
@ -1388,12 +1392,12 @@ TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-48
|
||||
#define x3out(off) (off)(b_ptr)
|
||||
#define y3out(off) (off + 32)(b_ptr)
|
||||
#define z3out(off) (off + 64)(b_ptr)
|
||||
//func p256PointAddAsm(res, in1, in2 []uint64) int
|
||||
TEXT ·p256PointAddAsm(SB),0,$392-80
|
||||
// func p256PointAddAsm(res, in1, in2 *P256Point) int
|
||||
TEXT ·p256PointAddAsm(SB),0,$392-32
|
||||
// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
|
||||
// Move input to stack in order to free registers
|
||||
MOVD in1+24(FP), a_ptr
|
||||
MOVD in2+48(FP), b_ptr
|
||||
MOVD in1+8(FP), a_ptr
|
||||
MOVD in2+16(FP), b_ptr
|
||||
|
||||
MOVD p256const0<>(SB), const0
|
||||
MOVD p256const1<>(SB), const1
|
||||
@ -1524,6 +1528,6 @@ TEXT ·p256PointAddAsm(SB),0,$392-80
|
||||
STx(y3out)
|
||||
|
||||
MOVD hlp1, R0
|
||||
MOVD R0, ret+72(FP)
|
||||
MOVD R0, ret+24(FP)
|
||||
|
||||
RET
|
||||
|
||||
@ -7,58 +7,43 @@
|
||||
package nistec
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"reflect"
|
||||
"fmt"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestP256PrecomputedTable(t *testing.T) {
|
||||
base := NewP256Generator()
|
||||
|
||||
basePoint := []uint64{
|
||||
0x79e730d418a9143c, 0x75ba95fc5fedb601, 0x79fb732b77622510, 0x18905f76a53755c6,
|
||||
0xddf25357ce95560a, 0x8b4ab8e4ba19e45c, 0xd2e88688dd21f325, 0x8571ff1825885d85,
|
||||
0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
|
||||
}
|
||||
t1 := make([]uint64, 12)
|
||||
t2 := make([]uint64, 12)
|
||||
copy(t2, basePoint)
|
||||
for i := 0; i < 43; i++ {
|
||||
t.Run(fmt.Sprintf("table[%d]", i), func(t *testing.T) {
|
||||
testP256AffineTable(t, base, &p256Precomputed[i])
|
||||
})
|
||||
|
||||
zInv := make([]uint64, 4)
|
||||
zInvSq := make([]uint64, 4)
|
||||
for j := 0; j < 32; j++ {
|
||||
copy(t1, t2)
|
||||
for i := 0; i < 43; i++ {
|
||||
// The window size is 6 so we need to double 6 times.
|
||||
if i != 0 {
|
||||
for k := 0; k < 6; k++ {
|
||||
p256PointDoubleAsm(t1, t1)
|
||||
}
|
||||
}
|
||||
// Convert the point to affine form. (Its values are
|
||||
// still in Montgomery form however.)
|
||||
p256Inverse(zInv, t1[8:12])
|
||||
p256Sqr(zInvSq, zInv, 1)
|
||||
p256Mul(zInv, zInv, zInvSq)
|
||||
|
||||
p256Mul(t1[:4], t1[:4], zInvSq)
|
||||
p256Mul(t1[4:8], t1[4:8], zInv)
|
||||
|
||||
copy(t1[8:12], basePoint[8:12])
|
||||
|
||||
buf := make([]byte, 8*8)
|
||||
for i, u := range t1[:8] {
|
||||
binary.LittleEndian.PutUint64(buf[i*8:i*8+8], u)
|
||||
}
|
||||
start := i*32*8*8 + j*8*8
|
||||
if got, want := p256Precomputed[start:start+64], string(buf); !reflect.DeepEqual(got, want) {
|
||||
t.Fatalf("Unexpected table entry at [%d][%d:%d]: got %v, want %v", i, j*8, (j*8)+8, got, want)
|
||||
}
|
||||
}
|
||||
if j == 0 {
|
||||
p256PointDoubleAsm(t2, basePoint)
|
||||
} else {
|
||||
p256PointAddAsm(t2, t2, basePoint)
|
||||
for k := 0; k < 6; k++ {
|
||||
base.Double(base)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func testP256AffineTable(t *testing.T, base *P256Point, table *p256AffineTable) {
|
||||
p := NewP256Point()
|
||||
zInv := new(p256Element)
|
||||
zInvSq := new(p256Element)
|
||||
|
||||
for j := 0; j < 32; j++ {
|
||||
p.Add(p, base)
|
||||
|
||||
// Convert p to affine coordinates.
|
||||
p256Inverse(zInv, &p.z)
|
||||
p256Sqr(zInvSq, zInv, 1)
|
||||
p256Mul(zInv, zInv, zInvSq)
|
||||
|
||||
p256Mul(&p.x, &p.x, zInvSq)
|
||||
p256Mul(&p.y, &p.y, zInv)
|
||||
p.z = p256One
|
||||
|
||||
if p256Equal(&table[j].x, &p.x) != 1 || p256Equal(&table[j].y, &p.y) != 1 {
|
||||
t.Fatalf("incorrect table entry at index %d", j)
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
94
src/crypto/elliptic/internal/nistec/p256_asm_test.go
Normal file
94
src/crypto/elliptic/internal/nistec/p256_asm_test.go
Normal file
@ -0,0 +1,94 @@
|
||||
// Copyright 2022 The Go Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
//go:build amd64 || arm64
|
||||
|
||||
package nistec_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/elliptic"
|
||||
"crypto/elliptic/internal/nistec"
|
||||
"math/big"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestP256OrdInverse(t *testing.T) {
|
||||
N := elliptic.P256().Params().N
|
||||
|
||||
// inv(0) is expected to be 0.
|
||||
zero := make([]byte, 32)
|
||||
out, err := nistec.P256OrdInverse(zero)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(out, zero) {
|
||||
t.Error("unexpected output for inv(0)")
|
||||
}
|
||||
|
||||
// inv(N) is also 0 mod N.
|
||||
input := make([]byte, 32)
|
||||
N.FillBytes(input)
|
||||
out, err = nistec.P256OrdInverse(input)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(out, zero) {
|
||||
t.Error("unexpected output for inv(N)")
|
||||
}
|
||||
if !bytes.Equal(input, N.Bytes()) {
|
||||
t.Error("input was modified")
|
||||
}
|
||||
|
||||
// Check inv(1) and inv(N+1) against math/big
|
||||
exp := new(big.Int).ModInverse(big.NewInt(1), N).FillBytes(make([]byte, 32))
|
||||
big.NewInt(1).FillBytes(input)
|
||||
out, err = nistec.P256OrdInverse(input)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(out, exp) {
|
||||
t.Error("unexpected output for inv(1)")
|
||||
}
|
||||
new(big.Int).Add(N, big.NewInt(1)).FillBytes(input)
|
||||
out, err = nistec.P256OrdInverse(input)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(out, exp) {
|
||||
t.Error("unexpected output for inv(N+1)")
|
||||
}
|
||||
|
||||
// Check inv(20) and inv(N+20) against math/big
|
||||
exp = new(big.Int).ModInverse(big.NewInt(20), N).FillBytes(make([]byte, 32))
|
||||
big.NewInt(20).FillBytes(input)
|
||||
out, err = nistec.P256OrdInverse(input)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(out, exp) {
|
||||
t.Error("unexpected output for inv(20)")
|
||||
}
|
||||
new(big.Int).Add(N, big.NewInt(20)).FillBytes(input)
|
||||
out, err = nistec.P256OrdInverse(input)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(out, exp) {
|
||||
t.Error("unexpected output for inv(N+20)")
|
||||
}
|
||||
|
||||
// Check inv(2^256-1) against math/big
|
||||
bigInput := new(big.Int).Lsh(big.NewInt(1), 256)
|
||||
bigInput.Sub(bigInput, big.NewInt(1))
|
||||
exp = new(big.Int).ModInverse(bigInput, N).FillBytes(make([]byte, 32))
|
||||
bigInput.FillBytes(input)
|
||||
out, err = nistec.P256OrdInverse(input)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(out, exp) {
|
||||
t.Error("unexpected output for inv(2^256-1)")
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user