ed25519 1.2.4-java
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +15 -0
- data/.rspec +5 -0
- data/.rubocop.yml +35 -0
- data/.travis.yml +26 -0
- data/CHANGES.md +70 -0
- data/CODE_OF_CONDUCT.md +74 -0
- data/Gemfile +12 -0
- data/LICENSE +22 -0
- data/README.md +170 -0
- data/Rakefile +27 -0
- data/appveyor.yml +21 -0
- data/ed25519.gemspec +32 -0
- data/ed25519.png +0 -0
- data/ext/ed25519_jruby/LICENSE.txt +123 -0
- data/ext/ed25519_jruby/README.md +77 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAEngine.java +491 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAKey.java +31 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAPrivateKey.java +338 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAPublicKey.java +275 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSASecurityProvider.java +59 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/KeyFactory.java +75 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/KeyPairGenerator.java +97 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/Utils.java +103 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Constants.java +23 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Curve.java +100 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Encoding.java +54 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Field.java +99 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/FieldElement.java +76 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/GroupElement.java +1034 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ScalarOps.java +34 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElement.java +131 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/BigIntegerLittleEndianEncoding.java +102 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOps.java +37 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/package.html +6 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElement.java +988 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncoding.java +256 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOps.java +693 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAGenParameterSpec.java +32 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSANamedCurveSpec.java +35 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSANamedCurveTable.java +71 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAParameterSpec.java +97 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpec.java +133 -0
- data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAPublicKeySpec.java +61 -0
- data/ext/ed25519_jruby/org/cryptorb/Ed25519Provider.java +95 -0
- data/ext/ed25519_ref10/api.h +4 -0
- data/ext/ed25519_ref10/base.h +1344 -0
- data/ext/ed25519_ref10/base2.h +40 -0
- data/ext/ed25519_ref10/d.h +1 -0
- data/ext/ed25519_ref10/d2.h +1 -0
- data/ext/ed25519_ref10/ed25519_ref10.c +99 -0
- data/ext/ed25519_ref10/ed25519_ref10.h +33 -0
- data/ext/ed25519_ref10/extconf.rb +9 -0
- data/ext/ed25519_ref10/fe.c +1085 -0
- data/ext/ed25519_ref10/fe.h +56 -0
- data/ext/ed25519_ref10/ge.c +407 -0
- data/ext/ed25519_ref10/ge.h +95 -0
- data/ext/ed25519_ref10/ge_add.h +97 -0
- data/ext/ed25519_ref10/ge_madd.h +88 -0
- data/ext/ed25519_ref10/ge_msub.h +88 -0
- data/ext/ed25519_ref10/ge_p2_dbl.h +73 -0
- data/ext/ed25519_ref10/ge_sub.h +97 -0
- data/ext/ed25519_ref10/keypair.c +22 -0
- data/ext/ed25519_ref10/open.c +47 -0
- data/ext/ed25519_ref10/pow22523.h +160 -0
- data/ext/ed25519_ref10/pow225521.h +160 -0
- data/ext/ed25519_ref10/sc.h +17 -0
- data/ext/ed25519_ref10/sc_muladd.c +366 -0
- data/ext/ed25519_ref10/sc_reduce.c +272 -0
- data/ext/ed25519_ref10/sha512.c +304 -0
- data/ext/ed25519_ref10/sha512.h +8 -0
- data/ext/ed25519_ref10/sign.c +41 -0
- data/ext/ed25519_ref10/sqrtm1.h +1 -0
- data/ext/ed25519_ref10/verify.c +40 -0
- data/lib/ed25519.rb +72 -0
- data/lib/ed25519/signing_key.rb +60 -0
- data/lib/ed25519/verify_key.rb +44 -0
- data/lib/ed25519/version.rb +5 -0
- metadata +137 -0
@@ -0,0 +1,22 @@
|
|
1
|
+
#include <string.h>
|
2
|
+
#include "ed25519_ref10.h"
|
3
|
+
#include "sha512.h"
|
4
|
+
#include "ge.h"
|
5
|
+
|
6
|
+
int crypto_sign_ed25519_ref10_seed_keypair(uint8_t *pk, uint8_t *sk, const uint8_t *seed)
|
7
|
+
{
|
8
|
+
ge_p3 A;
|
9
|
+
|
10
|
+
crypto_hash_sha512(sk, seed, 32);
|
11
|
+
sk[0] &= 248;
|
12
|
+
sk[31] &= 127;
|
13
|
+
sk[31] |= 64;
|
14
|
+
|
15
|
+
ge_scalarmult_base(&A, sk);
|
16
|
+
ge_p3_tobytes(pk, &A);
|
17
|
+
|
18
|
+
memmove(sk, seed, 32);
|
19
|
+
memmove(sk + 32, pk, 32);
|
20
|
+
|
21
|
+
return 0;
|
22
|
+
}
|
@@ -0,0 +1,47 @@
|
|
1
|
+
#include <string.h>
|
2
|
+
#include "sha512.h"
|
3
|
+
#include "ed25519_ref10.h"
|
4
|
+
#include "ge.h"
|
5
|
+
#include "sc.h"
|
6
|
+
|
7
|
+
int crypto_sign_open_ed25519_ref10(
|
8
|
+
uint8_t *m, uint64_t *mlen,
|
9
|
+
const uint8_t *sm, uint64_t smlen,
|
10
|
+
const uint8_t *pk
|
11
|
+
)
|
12
|
+
{
|
13
|
+
unsigned char pkcopy[32];
|
14
|
+
unsigned char rcopy[32];
|
15
|
+
unsigned char scopy[32];
|
16
|
+
unsigned char h[64];
|
17
|
+
unsigned char rcheck[32];
|
18
|
+
ge_p3 A;
|
19
|
+
ge_p2 R;
|
20
|
+
|
21
|
+
if (smlen < 64) goto badsig;
|
22
|
+
if (sm[63] & 224) goto badsig;
|
23
|
+
if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
|
24
|
+
|
25
|
+
memmove(pkcopy,pk,32);
|
26
|
+
memmove(rcopy,sm,32);
|
27
|
+
memmove(scopy,sm + 32,32);
|
28
|
+
|
29
|
+
memmove(m,sm,smlen);
|
30
|
+
memmove(m + 32,pkcopy,32);
|
31
|
+
crypto_hash_sha512(h,m,smlen);
|
32
|
+
sc_reduce(h);
|
33
|
+
|
34
|
+
ge_double_scalarmult_vartime(&R,h,&A,scopy);
|
35
|
+
ge_tobytes(rcheck,&R);
|
36
|
+
if (crypto_verify_32(rcheck,rcopy) == 0) {
|
37
|
+
memmove(m,m + 64,smlen - 64);
|
38
|
+
memset(m + smlen - 64,0,64);
|
39
|
+
*mlen = smlen - 64;
|
40
|
+
return 0;
|
41
|
+
}
|
42
|
+
|
43
|
+
badsig:
|
44
|
+
*mlen = -1;
|
45
|
+
memset(m,0,smlen);
|
46
|
+
return -1;
|
47
|
+
}
|
@@ -0,0 +1,160 @@
|
|
1
|
+
|
2
|
+
/* qhasm: fe z1 */
|
3
|
+
|
4
|
+
/* qhasm: fe z2 */
|
5
|
+
|
6
|
+
/* qhasm: fe z8 */
|
7
|
+
|
8
|
+
/* qhasm: fe z9 */
|
9
|
+
|
10
|
+
/* qhasm: fe z11 */
|
11
|
+
|
12
|
+
/* qhasm: fe z22 */
|
13
|
+
|
14
|
+
/* qhasm: fe z_5_0 */
|
15
|
+
|
16
|
+
/* qhasm: fe z_10_5 */
|
17
|
+
|
18
|
+
/* qhasm: fe z_10_0 */
|
19
|
+
|
20
|
+
/* qhasm: fe z_20_10 */
|
21
|
+
|
22
|
+
/* qhasm: fe z_20_0 */
|
23
|
+
|
24
|
+
/* qhasm: fe z_40_20 */
|
25
|
+
|
26
|
+
/* qhasm: fe z_40_0 */
|
27
|
+
|
28
|
+
/* qhasm: fe z_50_10 */
|
29
|
+
|
30
|
+
/* qhasm: fe z_50_0 */
|
31
|
+
|
32
|
+
/* qhasm: fe z_100_50 */
|
33
|
+
|
34
|
+
/* qhasm: fe z_100_0 */
|
35
|
+
|
36
|
+
/* qhasm: fe z_200_100 */
|
37
|
+
|
38
|
+
/* qhasm: fe z_200_0 */
|
39
|
+
|
40
|
+
/* qhasm: fe z_250_50 */
|
41
|
+
|
42
|
+
/* qhasm: fe z_250_0 */
|
43
|
+
|
44
|
+
/* qhasm: fe z_252_2 */
|
45
|
+
|
46
|
+
/* qhasm: fe z_252_3 */
|
47
|
+
|
48
|
+
/* qhasm: enter pow22523 */
|
49
|
+
|
50
|
+
/* qhasm: z2 = z1^2^1 */
|
51
|
+
/* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
|
52
|
+
/* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
|
53
|
+
fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
54
|
+
|
55
|
+
/* qhasm: z8 = z2^2^2 */
|
56
|
+
/* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
|
57
|
+
/* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
|
58
|
+
fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
|
59
|
+
|
60
|
+
/* qhasm: z9 = z1*z8 */
|
61
|
+
/* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
|
62
|
+
/* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
|
63
|
+
fe_mul(t1,z,t1);
|
64
|
+
|
65
|
+
/* qhasm: z11 = z2*z9 */
|
66
|
+
/* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
|
67
|
+
/* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
|
68
|
+
fe_mul(t0,t0,t1);
|
69
|
+
|
70
|
+
/* qhasm: z22 = z11^2^1 */
|
71
|
+
/* asm 1: fe_sq(>z22=fe#1,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#1,>z22=fe#1); */
|
72
|
+
/* asm 2: fe_sq(>z22=t0,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t0,>z22=t0); */
|
73
|
+
fe_sq(t0,t0); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
74
|
+
|
75
|
+
/* qhasm: z_5_0 = z9*z22 */
|
76
|
+
/* asm 1: fe_mul(>z_5_0=fe#1,<z9=fe#2,<z22=fe#1); */
|
77
|
+
/* asm 2: fe_mul(>z_5_0=t0,<z9=t1,<z22=t0); */
|
78
|
+
fe_mul(t0,t1,t0);
|
79
|
+
|
80
|
+
/* qhasm: z_10_5 = z_5_0^2^5 */
|
81
|
+
/* asm 1: fe_sq(>z_10_5=fe#2,<z_5_0=fe#1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#2,>z_10_5=fe#2); */
|
82
|
+
/* asm 2: fe_sq(>z_10_5=t1,<z_5_0=t0); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t1,>z_10_5=t1); */
|
83
|
+
fe_sq(t1,t0); for (i = 1;i < 5;++i) fe_sq(t1,t1);
|
84
|
+
|
85
|
+
/* qhasm: z_10_0 = z_10_5*z_5_0 */
|
86
|
+
/* asm 1: fe_mul(>z_10_0=fe#1,<z_10_5=fe#2,<z_5_0=fe#1); */
|
87
|
+
/* asm 2: fe_mul(>z_10_0=t0,<z_10_5=t1,<z_5_0=t0); */
|
88
|
+
fe_mul(t0,t1,t0);
|
89
|
+
|
90
|
+
/* qhasm: z_20_10 = z_10_0^2^10 */
|
91
|
+
/* asm 1: fe_sq(>z_20_10=fe#2,<z_10_0=fe#1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#2,>z_20_10=fe#2); */
|
92
|
+
/* asm 2: fe_sq(>z_20_10=t1,<z_10_0=t0); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t1,>z_20_10=t1); */
|
93
|
+
fe_sq(t1,t0); for (i = 1;i < 10;++i) fe_sq(t1,t1);
|
94
|
+
|
95
|
+
/* qhasm: z_20_0 = z_20_10*z_10_0 */
|
96
|
+
/* asm 1: fe_mul(>z_20_0=fe#2,<z_20_10=fe#2,<z_10_0=fe#1); */
|
97
|
+
/* asm 2: fe_mul(>z_20_0=t1,<z_20_10=t1,<z_10_0=t0); */
|
98
|
+
fe_mul(t1,t1,t0);
|
99
|
+
|
100
|
+
/* qhasm: z_40_20 = z_20_0^2^20 */
|
101
|
+
/* asm 1: fe_sq(>z_40_20=fe#3,<z_20_0=fe#2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#3,>z_40_20=fe#3); */
|
102
|
+
/* asm 2: fe_sq(>z_40_20=t2,<z_20_0=t1); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t2,>z_40_20=t2); */
|
103
|
+
fe_sq(t2,t1); for (i = 1;i < 20;++i) fe_sq(t2,t2);
|
104
|
+
|
105
|
+
/* qhasm: z_40_0 = z_40_20*z_20_0 */
|
106
|
+
/* asm 1: fe_mul(>z_40_0=fe#2,<z_40_20=fe#3,<z_20_0=fe#2); */
|
107
|
+
/* asm 2: fe_mul(>z_40_0=t1,<z_40_20=t2,<z_20_0=t1); */
|
108
|
+
fe_mul(t1,t2,t1);
|
109
|
+
|
110
|
+
/* qhasm: z_50_10 = z_40_0^2^10 */
|
111
|
+
/* asm 1: fe_sq(>z_50_10=fe#2,<z_40_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#2,>z_50_10=fe#2); */
|
112
|
+
/* asm 2: fe_sq(>z_50_10=t1,<z_40_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t1,>z_50_10=t1); */
|
113
|
+
fe_sq(t1,t1); for (i = 1;i < 10;++i) fe_sq(t1,t1);
|
114
|
+
|
115
|
+
/* qhasm: z_50_0 = z_50_10*z_10_0 */
|
116
|
+
/* asm 1: fe_mul(>z_50_0=fe#1,<z_50_10=fe#2,<z_10_0=fe#1); */
|
117
|
+
/* asm 2: fe_mul(>z_50_0=t0,<z_50_10=t1,<z_10_0=t0); */
|
118
|
+
fe_mul(t0,t1,t0);
|
119
|
+
|
120
|
+
/* qhasm: z_100_50 = z_50_0^2^50 */
|
121
|
+
/* asm 1: fe_sq(>z_100_50=fe#2,<z_50_0=fe#1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#2,>z_100_50=fe#2); */
|
122
|
+
/* asm 2: fe_sq(>z_100_50=t1,<z_50_0=t0); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t1,>z_100_50=t1); */
|
123
|
+
fe_sq(t1,t0); for (i = 1;i < 50;++i) fe_sq(t1,t1);
|
124
|
+
|
125
|
+
/* qhasm: z_100_0 = z_100_50*z_50_0 */
|
126
|
+
/* asm 1: fe_mul(>z_100_0=fe#2,<z_100_50=fe#2,<z_50_0=fe#1); */
|
127
|
+
/* asm 2: fe_mul(>z_100_0=t1,<z_100_50=t1,<z_50_0=t0); */
|
128
|
+
fe_mul(t1,t1,t0);
|
129
|
+
|
130
|
+
/* qhasm: z_200_100 = z_100_0^2^100 */
|
131
|
+
/* asm 1: fe_sq(>z_200_100=fe#3,<z_100_0=fe#2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#3,>z_200_100=fe#3); */
|
132
|
+
/* asm 2: fe_sq(>z_200_100=t2,<z_100_0=t1); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t2,>z_200_100=t2); */
|
133
|
+
fe_sq(t2,t1); for (i = 1;i < 100;++i) fe_sq(t2,t2);
|
134
|
+
|
135
|
+
/* qhasm: z_200_0 = z_200_100*z_100_0 */
|
136
|
+
/* asm 1: fe_mul(>z_200_0=fe#2,<z_200_100=fe#3,<z_100_0=fe#2); */
|
137
|
+
/* asm 2: fe_mul(>z_200_0=t1,<z_200_100=t2,<z_100_0=t1); */
|
138
|
+
fe_mul(t1,t2,t1);
|
139
|
+
|
140
|
+
/* qhasm: z_250_50 = z_200_0^2^50 */
|
141
|
+
/* asm 1: fe_sq(>z_250_50=fe#2,<z_200_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#2,>z_250_50=fe#2); */
|
142
|
+
/* asm 2: fe_sq(>z_250_50=t1,<z_200_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t1,>z_250_50=t1); */
|
143
|
+
fe_sq(t1,t1); for (i = 1;i < 50;++i) fe_sq(t1,t1);
|
144
|
+
|
145
|
+
/* qhasm: z_250_0 = z_250_50*z_50_0 */
|
146
|
+
/* asm 1: fe_mul(>z_250_0=fe#1,<z_250_50=fe#2,<z_50_0=fe#1); */
|
147
|
+
/* asm 2: fe_mul(>z_250_0=t0,<z_250_50=t1,<z_50_0=t0); */
|
148
|
+
fe_mul(t0,t1,t0);
|
149
|
+
|
150
|
+
/* qhasm: z_252_2 = z_250_0^2^2 */
|
151
|
+
/* asm 1: fe_sq(>z_252_2=fe#1,<z_250_0=fe#1); for (i = 1;i < 2;++i) fe_sq(>z_252_2=fe#1,>z_252_2=fe#1); */
|
152
|
+
/* asm 2: fe_sq(>z_252_2=t0,<z_250_0=t0); for (i = 1;i < 2;++i) fe_sq(>z_252_2=t0,>z_252_2=t0); */
|
153
|
+
fe_sq(t0,t0); for (i = 1;i < 2;++i) fe_sq(t0,t0);
|
154
|
+
|
155
|
+
/* qhasm: z_252_3 = z_252_2*z1 */
|
156
|
+
/* asm 1: fe_mul(>z_252_3=fe#12,<z_252_2=fe#1,<z1=fe#11); */
|
157
|
+
/* asm 2: fe_mul(>z_252_3=out,<z_252_2=t0,<z1=z); */
|
158
|
+
fe_mul(out,t0,z);
|
159
|
+
|
160
|
+
/* qhasm: return */
|
@@ -0,0 +1,160 @@
|
|
1
|
+
|
2
|
+
/* qhasm: fe z1 */
|
3
|
+
|
4
|
+
/* qhasm: fe z2 */
|
5
|
+
|
6
|
+
/* qhasm: fe z8 */
|
7
|
+
|
8
|
+
/* qhasm: fe z9 */
|
9
|
+
|
10
|
+
/* qhasm: fe z11 */
|
11
|
+
|
12
|
+
/* qhasm: fe z22 */
|
13
|
+
|
14
|
+
/* qhasm: fe z_5_0 */
|
15
|
+
|
16
|
+
/* qhasm: fe z_10_5 */
|
17
|
+
|
18
|
+
/* qhasm: fe z_10_0 */
|
19
|
+
|
20
|
+
/* qhasm: fe z_20_10 */
|
21
|
+
|
22
|
+
/* qhasm: fe z_20_0 */
|
23
|
+
|
24
|
+
/* qhasm: fe z_40_20 */
|
25
|
+
|
26
|
+
/* qhasm: fe z_40_0 */
|
27
|
+
|
28
|
+
/* qhasm: fe z_50_10 */
|
29
|
+
|
30
|
+
/* qhasm: fe z_50_0 */
|
31
|
+
|
32
|
+
/* qhasm: fe z_100_50 */
|
33
|
+
|
34
|
+
/* qhasm: fe z_100_0 */
|
35
|
+
|
36
|
+
/* qhasm: fe z_200_100 */
|
37
|
+
|
38
|
+
/* qhasm: fe z_200_0 */
|
39
|
+
|
40
|
+
/* qhasm: fe z_250_50 */
|
41
|
+
|
42
|
+
/* qhasm: fe z_250_0 */
|
43
|
+
|
44
|
+
/* qhasm: fe z_255_5 */
|
45
|
+
|
46
|
+
/* qhasm: fe z_255_21 */
|
47
|
+
|
48
|
+
/* qhasm: enter pow225521 */
|
49
|
+
|
50
|
+
/* qhasm: z2 = z1^2^1 */
|
51
|
+
/* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
|
52
|
+
/* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
|
53
|
+
fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
54
|
+
|
55
|
+
/* qhasm: z8 = z2^2^2 */
|
56
|
+
/* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
|
57
|
+
/* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
|
58
|
+
fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
|
59
|
+
|
60
|
+
/* qhasm: z9 = z1*z8 */
|
61
|
+
/* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
|
62
|
+
/* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
|
63
|
+
fe_mul(t1,z,t1);
|
64
|
+
|
65
|
+
/* qhasm: z11 = z2*z9 */
|
66
|
+
/* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
|
67
|
+
/* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
|
68
|
+
fe_mul(t0,t0,t1);
|
69
|
+
|
70
|
+
/* qhasm: z22 = z11^2^1 */
|
71
|
+
/* asm 1: fe_sq(>z22=fe#3,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#3,>z22=fe#3); */
|
72
|
+
/* asm 2: fe_sq(>z22=t2,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t2,>z22=t2); */
|
73
|
+
fe_sq(t2,t0); for (i = 1;i < 1;++i) fe_sq(t2,t2);
|
74
|
+
|
75
|
+
/* qhasm: z_5_0 = z9*z22 */
|
76
|
+
/* asm 1: fe_mul(>z_5_0=fe#2,<z9=fe#2,<z22=fe#3); */
|
77
|
+
/* asm 2: fe_mul(>z_5_0=t1,<z9=t1,<z22=t2); */
|
78
|
+
fe_mul(t1,t1,t2);
|
79
|
+
|
80
|
+
/* qhasm: z_10_5 = z_5_0^2^5 */
|
81
|
+
/* asm 1: fe_sq(>z_10_5=fe#3,<z_5_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#3,>z_10_5=fe#3); */
|
82
|
+
/* asm 2: fe_sq(>z_10_5=t2,<z_5_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t2,>z_10_5=t2); */
|
83
|
+
fe_sq(t2,t1); for (i = 1;i < 5;++i) fe_sq(t2,t2);
|
84
|
+
|
85
|
+
/* qhasm: z_10_0 = z_10_5*z_5_0 */
|
86
|
+
/* asm 1: fe_mul(>z_10_0=fe#2,<z_10_5=fe#3,<z_5_0=fe#2); */
|
87
|
+
/* asm 2: fe_mul(>z_10_0=t1,<z_10_5=t2,<z_5_0=t1); */
|
88
|
+
fe_mul(t1,t2,t1);
|
89
|
+
|
90
|
+
/* qhasm: z_20_10 = z_10_0^2^10 */
|
91
|
+
/* asm 1: fe_sq(>z_20_10=fe#3,<z_10_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#3,>z_20_10=fe#3); */
|
92
|
+
/* asm 2: fe_sq(>z_20_10=t2,<z_10_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t2,>z_20_10=t2); */
|
93
|
+
fe_sq(t2,t1); for (i = 1;i < 10;++i) fe_sq(t2,t2);
|
94
|
+
|
95
|
+
/* qhasm: z_20_0 = z_20_10*z_10_0 */
|
96
|
+
/* asm 1: fe_mul(>z_20_0=fe#3,<z_20_10=fe#3,<z_10_0=fe#2); */
|
97
|
+
/* asm 2: fe_mul(>z_20_0=t2,<z_20_10=t2,<z_10_0=t1); */
|
98
|
+
fe_mul(t2,t2,t1);
|
99
|
+
|
100
|
+
/* qhasm: z_40_20 = z_20_0^2^20 */
|
101
|
+
/* asm 1: fe_sq(>z_40_20=fe#4,<z_20_0=fe#3); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#4,>z_40_20=fe#4); */
|
102
|
+
/* asm 2: fe_sq(>z_40_20=t3,<z_20_0=t2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t3,>z_40_20=t3); */
|
103
|
+
fe_sq(t3,t2); for (i = 1;i < 20;++i) fe_sq(t3,t3);
|
104
|
+
|
105
|
+
/* qhasm: z_40_0 = z_40_20*z_20_0 */
|
106
|
+
/* asm 1: fe_mul(>z_40_0=fe#3,<z_40_20=fe#4,<z_20_0=fe#3); */
|
107
|
+
/* asm 2: fe_mul(>z_40_0=t2,<z_40_20=t3,<z_20_0=t2); */
|
108
|
+
fe_mul(t2,t3,t2);
|
109
|
+
|
110
|
+
/* qhasm: z_50_10 = z_40_0^2^10 */
|
111
|
+
/* asm 1: fe_sq(>z_50_10=fe#3,<z_40_0=fe#3); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#3,>z_50_10=fe#3); */
|
112
|
+
/* asm 2: fe_sq(>z_50_10=t2,<z_40_0=t2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t2,>z_50_10=t2); */
|
113
|
+
fe_sq(t2,t2); for (i = 1;i < 10;++i) fe_sq(t2,t2);
|
114
|
+
|
115
|
+
/* qhasm: z_50_0 = z_50_10*z_10_0 */
|
116
|
+
/* asm 1: fe_mul(>z_50_0=fe#2,<z_50_10=fe#3,<z_10_0=fe#2); */
|
117
|
+
/* asm 2: fe_mul(>z_50_0=t1,<z_50_10=t2,<z_10_0=t1); */
|
118
|
+
fe_mul(t1,t2,t1);
|
119
|
+
|
120
|
+
/* qhasm: z_100_50 = z_50_0^2^50 */
|
121
|
+
/* asm 1: fe_sq(>z_100_50=fe#3,<z_50_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#3,>z_100_50=fe#3); */
|
122
|
+
/* asm 2: fe_sq(>z_100_50=t2,<z_50_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t2,>z_100_50=t2); */
|
123
|
+
fe_sq(t2,t1); for (i = 1;i < 50;++i) fe_sq(t2,t2);
|
124
|
+
|
125
|
+
/* qhasm: z_100_0 = z_100_50*z_50_0 */
|
126
|
+
/* asm 1: fe_mul(>z_100_0=fe#3,<z_100_50=fe#3,<z_50_0=fe#2); */
|
127
|
+
/* asm 2: fe_mul(>z_100_0=t2,<z_100_50=t2,<z_50_0=t1); */
|
128
|
+
fe_mul(t2,t2,t1);
|
129
|
+
|
130
|
+
/* qhasm: z_200_100 = z_100_0^2^100 */
|
131
|
+
/* asm 1: fe_sq(>z_200_100=fe#4,<z_100_0=fe#3); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#4,>z_200_100=fe#4); */
|
132
|
+
/* asm 2: fe_sq(>z_200_100=t3,<z_100_0=t2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t3,>z_200_100=t3); */
|
133
|
+
fe_sq(t3,t2); for (i = 1;i < 100;++i) fe_sq(t3,t3);
|
134
|
+
|
135
|
+
/* qhasm: z_200_0 = z_200_100*z_100_0 */
|
136
|
+
/* asm 1: fe_mul(>z_200_0=fe#3,<z_200_100=fe#4,<z_100_0=fe#3); */
|
137
|
+
/* asm 2: fe_mul(>z_200_0=t2,<z_200_100=t3,<z_100_0=t2); */
|
138
|
+
fe_mul(t2,t3,t2);
|
139
|
+
|
140
|
+
/* qhasm: z_250_50 = z_200_0^2^50 */
|
141
|
+
/* asm 1: fe_sq(>z_250_50=fe#3,<z_200_0=fe#3); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#3,>z_250_50=fe#3); */
|
142
|
+
/* asm 2: fe_sq(>z_250_50=t2,<z_200_0=t2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t2,>z_250_50=t2); */
|
143
|
+
fe_sq(t2,t2); for (i = 1;i < 50;++i) fe_sq(t2,t2);
|
144
|
+
|
145
|
+
/* qhasm: z_250_0 = z_250_50*z_50_0 */
|
146
|
+
/* asm 1: fe_mul(>z_250_0=fe#2,<z_250_50=fe#3,<z_50_0=fe#2); */
|
147
|
+
/* asm 2: fe_mul(>z_250_0=t1,<z_250_50=t2,<z_50_0=t1); */
|
148
|
+
fe_mul(t1,t2,t1);
|
149
|
+
|
150
|
+
/* qhasm: z_255_5 = z_250_0^2^5 */
|
151
|
+
/* asm 1: fe_sq(>z_255_5=fe#2,<z_250_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_255_5=fe#2,>z_255_5=fe#2); */
|
152
|
+
/* asm 2: fe_sq(>z_255_5=t1,<z_250_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_255_5=t1,>z_255_5=t1); */
|
153
|
+
fe_sq(t1,t1); for (i = 1;i < 5;++i) fe_sq(t1,t1);
|
154
|
+
|
155
|
+
/* qhasm: z_255_21 = z_255_5*z11 */
|
156
|
+
/* asm 1: fe_mul(>z_255_21=fe#12,<z_255_5=fe#2,<z11=fe#1); */
|
157
|
+
/* asm 2: fe_mul(>z_255_21=out,<z_255_5=t1,<z11=t0); */
|
158
|
+
fe_mul(out,t1,t0);
|
159
|
+
|
160
|
+
/* qhasm: return */
|
@@ -0,0 +1,17 @@
|
|
1
|
+
#ifndef SC_H
|
2
|
+
#define SC_H
|
3
|
+
|
4
|
+
#include <stdint.h>
|
5
|
+
|
6
|
+
/*
|
7
|
+
The set of scalars is \Z/l
|
8
|
+
where l = 2^252 + 27742317777372353535851937790883648493.
|
9
|
+
*/
|
10
|
+
|
11
|
+
#define sc_reduce crypto_sign_ed25519_ref10_sc_reduce
|
12
|
+
#define sc_muladd crypto_sign_ed25519_ref10_sc_muladd
|
13
|
+
|
14
|
+
extern void sc_reduce(uint8_t *);
|
15
|
+
extern void sc_muladd(uint8_t *,const uint8_t *,const uint8_t *,const uint8_t *);
|
16
|
+
|
17
|
+
#endif
|
@@ -0,0 +1,366 @@
|
|
1
|
+
#include "sc.h"
|
2
|
+
|
3
|
+
static uint64_t load_3(const uint8_t *in)
|
4
|
+
{
|
5
|
+
uint64_t result;
|
6
|
+
result = (uint64_t) in[0];
|
7
|
+
result |= ((uint64_t) in[1]) << 8;
|
8
|
+
result |= ((uint64_t) in[2]) << 16;
|
9
|
+
return result;
|
10
|
+
}
|
11
|
+
|
12
|
+
static uint64_t load_4(const uint8_t *in)
|
13
|
+
{
|
14
|
+
uint64_t result;
|
15
|
+
result = (uint64_t) in[0];
|
16
|
+
result |= ((uint64_t) in[1]) << 8;
|
17
|
+
result |= ((uint64_t) in[2]) << 16;
|
18
|
+
result |= ((uint64_t) in[3]) << 24;
|
19
|
+
return result;
|
20
|
+
}
|
21
|
+
|
22
|
+
/*
|
23
|
+
Input:
|
24
|
+
a[0]+256*a[1]+...+256^31*a[31] = a
|
25
|
+
b[0]+256*b[1]+...+256^31*b[31] = b
|
26
|
+
c[0]+256*c[1]+...+256^31*c[31] = c
|
27
|
+
|
28
|
+
Output:
|
29
|
+
s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
|
30
|
+
where l = 2^252 + 27742317777372353535851937790883648493.
|
31
|
+
*/
|
32
|
+
|
33
|
+
void sc_muladd(uint8_t *s,const uint8_t *a,const uint8_t *b,const uint8_t *c)
|
34
|
+
{
|
35
|
+
int64_t a0 = 2097151 & load_3(a);
|
36
|
+
int64_t a1 = 2097151 & (load_4(a + 2) >> 5);
|
37
|
+
int64_t a2 = 2097151 & (load_3(a + 5) >> 2);
|
38
|
+
int64_t a3 = 2097151 & (load_4(a + 7) >> 7);
|
39
|
+
int64_t a4 = 2097151 & (load_4(a + 10) >> 4);
|
40
|
+
int64_t a5 = 2097151 & (load_3(a + 13) >> 1);
|
41
|
+
int64_t a6 = 2097151 & (load_4(a + 15) >> 6);
|
42
|
+
int64_t a7 = 2097151 & (load_3(a + 18) >> 3);
|
43
|
+
int64_t a8 = 2097151 & load_3(a + 21);
|
44
|
+
int64_t a9 = 2097151 & (load_4(a + 23) >> 5);
|
45
|
+
int64_t a10 = 2097151 & (load_3(a + 26) >> 2);
|
46
|
+
int64_t a11 = (load_4(a + 28) >> 7);
|
47
|
+
int64_t b0 = 2097151 & load_3(b);
|
48
|
+
int64_t b1 = 2097151 & (load_4(b + 2) >> 5);
|
49
|
+
int64_t b2 = 2097151 & (load_3(b + 5) >> 2);
|
50
|
+
int64_t b3 = 2097151 & (load_4(b + 7) >> 7);
|
51
|
+
int64_t b4 = 2097151 & (load_4(b + 10) >> 4);
|
52
|
+
int64_t b5 = 2097151 & (load_3(b + 13) >> 1);
|
53
|
+
int64_t b6 = 2097151 & (load_4(b + 15) >> 6);
|
54
|
+
int64_t b7 = 2097151 & (load_3(b + 18) >> 3);
|
55
|
+
int64_t b8 = 2097151 & load_3(b + 21);
|
56
|
+
int64_t b9 = 2097151 & (load_4(b + 23) >> 5);
|
57
|
+
int64_t b10 = 2097151 & (load_3(b + 26) >> 2);
|
58
|
+
int64_t b11 = (load_4(b + 28) >> 7);
|
59
|
+
int64_t c0 = 2097151 & load_3(c);
|
60
|
+
int64_t c1 = 2097151 & (load_4(c + 2) >> 5);
|
61
|
+
int64_t c2 = 2097151 & (load_3(c + 5) >> 2);
|
62
|
+
int64_t c3 = 2097151 & (load_4(c + 7) >> 7);
|
63
|
+
int64_t c4 = 2097151 & (load_4(c + 10) >> 4);
|
64
|
+
int64_t c5 = 2097151 & (load_3(c + 13) >> 1);
|
65
|
+
int64_t c6 = 2097151 & (load_4(c + 15) >> 6);
|
66
|
+
int64_t c7 = 2097151 & (load_3(c + 18) >> 3);
|
67
|
+
int64_t c8 = 2097151 & load_3(c + 21);
|
68
|
+
int64_t c9 = 2097151 & (load_4(c + 23) >> 5);
|
69
|
+
int64_t c10 = 2097151 & (load_3(c + 26) >> 2);
|
70
|
+
int64_t c11 = (load_4(c + 28) >> 7);
|
71
|
+
int64_t s0;
|
72
|
+
int64_t s1;
|
73
|
+
int64_t s2;
|
74
|
+
int64_t s3;
|
75
|
+
int64_t s4;
|
76
|
+
int64_t s5;
|
77
|
+
int64_t s6;
|
78
|
+
int64_t s7;
|
79
|
+
int64_t s8;
|
80
|
+
int64_t s9;
|
81
|
+
int64_t s10;
|
82
|
+
int64_t s11;
|
83
|
+
int64_t s12;
|
84
|
+
int64_t s13;
|
85
|
+
int64_t s14;
|
86
|
+
int64_t s15;
|
87
|
+
int64_t s16;
|
88
|
+
int64_t s17;
|
89
|
+
int64_t s18;
|
90
|
+
int64_t s19;
|
91
|
+
int64_t s20;
|
92
|
+
int64_t s21;
|
93
|
+
int64_t s22;
|
94
|
+
int64_t s23;
|
95
|
+
int64_t carry0;
|
96
|
+
int64_t carry1;
|
97
|
+
int64_t carry2;
|
98
|
+
int64_t carry3;
|
99
|
+
int64_t carry4;
|
100
|
+
int64_t carry5;
|
101
|
+
int64_t carry6;
|
102
|
+
int64_t carry7;
|
103
|
+
int64_t carry8;
|
104
|
+
int64_t carry9;
|
105
|
+
int64_t carry10;
|
106
|
+
int64_t carry11;
|
107
|
+
int64_t carry12;
|
108
|
+
int64_t carry13;
|
109
|
+
int64_t carry14;
|
110
|
+
int64_t carry15;
|
111
|
+
int64_t carry16;
|
112
|
+
int64_t carry17;
|
113
|
+
int64_t carry18;
|
114
|
+
int64_t carry19;
|
115
|
+
int64_t carry20;
|
116
|
+
int64_t carry21;
|
117
|
+
int64_t carry22;
|
118
|
+
|
119
|
+
/* Merry Christmas! */
|
120
|
+
s0 = c0 + a0*b0;
|
121
|
+
s1 = c1 + a0*b1 + a1*b0;
|
122
|
+
s2 = c2 + a0*b2 + a1*b1 + a2*b0;
|
123
|
+
s3 = c3 + a0*b3 + a1*b2 + a2*b1 + a3*b0;
|
124
|
+
s4 = c4 + a0*b4 + a1*b3 + a2*b2 + a3*b1 + a4*b0;
|
125
|
+
s5 = c5 + a0*b5 + a1*b4 + a2*b3 + a3*b2 + a4*b1 + a5*b0;
|
126
|
+
s6 = c6 + a0*b6 + a1*b5 + a2*b4 + a3*b3 + a4*b2 + a5*b1 + a6*b0;
|
127
|
+
s7 = c7 + a0*b7 + a1*b6 + a2*b5 + a3*b4 + a4*b3 + a5*b2 + a6*b1 + a7*b0;
|
128
|
+
s8 = c8 + a0*b8 + a1*b7 + a2*b6 + a3*b5 + a4*b4 + a5*b3 + a6*b2 + a7*b1 + a8*b0;
|
129
|
+
s9 = c9 + a0*b9 + a1*b8 + a2*b7 + a3*b6 + a4*b5 + a5*b4 + a6*b3 + a7*b2 + a8*b1 + a9*b0;
|
130
|
+
s10 = c10 + a0*b10 + a1*b9 + a2*b8 + a3*b7 + a4*b6 + a5*b5 + a6*b4 + a7*b3 + a8*b2 + a9*b1 + a10*b0;
|
131
|
+
s11 = c11 + a0*b11 + a1*b10 + a2*b9 + a3*b8 + a4*b7 + a5*b6 + a6*b5 + a7*b4 + a8*b3 + a9*b2 + a10*b1 + a11*b0;
|
132
|
+
s12 = a1*b11 + a2*b10 + a3*b9 + a4*b8 + a5*b7 + a6*b6 + a7*b5 + a8*b4 + a9*b3 + a10*b2 + a11*b1;
|
133
|
+
s13 = a2*b11 + a3*b10 + a4*b9 + a5*b8 + a6*b7 + a7*b6 + a8*b5 + a9*b4 + a10*b3 + a11*b2;
|
134
|
+
s14 = a3*b11 + a4*b10 + a5*b9 + a6*b8 + a7*b7 + a8*b6 + a9*b5 + a10*b4 + a11*b3;
|
135
|
+
s15 = a4*b11 + a5*b10 + a6*b9 + a7*b8 + a8*b7 + a9*b6 + a10*b5 + a11*b4;
|
136
|
+
s16 = a5*b11 + a6*b10 + a7*b9 + a8*b8 + a9*b7 + a10*b6 + a11*b5;
|
137
|
+
s17 = a6*b11 + a7*b10 + a8*b9 + a9*b8 + a10*b7 + a11*b6;
|
138
|
+
s18 = a7*b11 + a8*b10 + a9*b9 + a10*b8 + a11*b7;
|
139
|
+
s19 = a8*b11 + a9*b10 + a10*b9 + a11*b8;
|
140
|
+
s20 = a9*b11 + a10*b10 + a11*b9;
|
141
|
+
s21 = a10*b11 + a11*b10;
|
142
|
+
s22 = a11*b11;
|
143
|
+
s23 = 0;
|
144
|
+
|
145
|
+
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
146
|
+
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
147
|
+
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
148
|
+
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
149
|
+
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
150
|
+
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
151
|
+
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
152
|
+
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
153
|
+
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
154
|
+
carry18 = (s18 + (1<<20)) >> 21; s19 += carry18; s18 -= carry18 << 21;
|
155
|
+
carry20 = (s20 + (1<<20)) >> 21; s21 += carry20; s20 -= carry20 << 21;
|
156
|
+
carry22 = (s22 + (1<<20)) >> 21; s23 += carry22; s22 -= carry22 << 21;
|
157
|
+
|
158
|
+
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
159
|
+
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
160
|
+
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
161
|
+
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
162
|
+
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
163
|
+
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
164
|
+
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
165
|
+
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
166
|
+
carry17 = (s17 + (1<<20)) >> 21; s18 += carry17; s17 -= carry17 << 21;
|
167
|
+
carry19 = (s19 + (1<<20)) >> 21; s20 += carry19; s19 -= carry19 << 21;
|
168
|
+
carry21 = (s21 + (1<<20)) >> 21; s22 += carry21; s21 -= carry21 << 21;
|
169
|
+
|
170
|
+
s11 += s23 * 666643;
|
171
|
+
s12 += s23 * 470296;
|
172
|
+
s13 += s23 * 654183;
|
173
|
+
s14 -= s23 * 997805;
|
174
|
+
s15 += s23 * 136657;
|
175
|
+
s16 -= s23 * 683901;
|
176
|
+
s23 = 0;
|
177
|
+
|
178
|
+
s10 += s22 * 666643;
|
179
|
+
s11 += s22 * 470296;
|
180
|
+
s12 += s22 * 654183;
|
181
|
+
s13 -= s22 * 997805;
|
182
|
+
s14 += s22 * 136657;
|
183
|
+
s15 -= s22 * 683901;
|
184
|
+
s22 = 0;
|
185
|
+
|
186
|
+
s9 += s21 * 666643;
|
187
|
+
s10 += s21 * 470296;
|
188
|
+
s11 += s21 * 654183;
|
189
|
+
s12 -= s21 * 997805;
|
190
|
+
s13 += s21 * 136657;
|
191
|
+
s14 -= s21 * 683901;
|
192
|
+
s21 = 0;
|
193
|
+
|
194
|
+
s8 += s20 * 666643;
|
195
|
+
s9 += s20 * 470296;
|
196
|
+
s10 += s20 * 654183;
|
197
|
+
s11 -= s20 * 997805;
|
198
|
+
s12 += s20 * 136657;
|
199
|
+
s13 -= s20 * 683901;
|
200
|
+
s20 = 0;
|
201
|
+
|
202
|
+
s7 += s19 * 666643;
|
203
|
+
s8 += s19 * 470296;
|
204
|
+
s9 += s19 * 654183;
|
205
|
+
s10 -= s19 * 997805;
|
206
|
+
s11 += s19 * 136657;
|
207
|
+
s12 -= s19 * 683901;
|
208
|
+
s19 = 0;
|
209
|
+
|
210
|
+
s6 += s18 * 666643;
|
211
|
+
s7 += s18 * 470296;
|
212
|
+
s8 += s18 * 654183;
|
213
|
+
s9 -= s18 * 997805;
|
214
|
+
s10 += s18 * 136657;
|
215
|
+
s11 -= s18 * 683901;
|
216
|
+
s18 = 0;
|
217
|
+
|
218
|
+
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
219
|
+
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
220
|
+
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
221
|
+
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
222
|
+
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
223
|
+
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
224
|
+
|
225
|
+
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
226
|
+
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
227
|
+
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
228
|
+
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
229
|
+
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
230
|
+
|
231
|
+
s5 += s17 * 666643;
|
232
|
+
s6 += s17 * 470296;
|
233
|
+
s7 += s17 * 654183;
|
234
|
+
s8 -= s17 * 997805;
|
235
|
+
s9 += s17 * 136657;
|
236
|
+
s10 -= s17 * 683901;
|
237
|
+
s17 = 0;
|
238
|
+
|
239
|
+
s4 += s16 * 666643;
|
240
|
+
s5 += s16 * 470296;
|
241
|
+
s6 += s16 * 654183;
|
242
|
+
s7 -= s16 * 997805;
|
243
|
+
s8 += s16 * 136657;
|
244
|
+
s9 -= s16 * 683901;
|
245
|
+
s16 = 0;
|
246
|
+
|
247
|
+
s3 += s15 * 666643;
|
248
|
+
s4 += s15 * 470296;
|
249
|
+
s5 += s15 * 654183;
|
250
|
+
s6 -= s15 * 997805;
|
251
|
+
s7 += s15 * 136657;
|
252
|
+
s8 -= s15 * 683901;
|
253
|
+
s15 = 0;
|
254
|
+
|
255
|
+
s2 += s14 * 666643;
|
256
|
+
s3 += s14 * 470296;
|
257
|
+
s4 += s14 * 654183;
|
258
|
+
s5 -= s14 * 997805;
|
259
|
+
s6 += s14 * 136657;
|
260
|
+
s7 -= s14 * 683901;
|
261
|
+
s14 = 0;
|
262
|
+
|
263
|
+
s1 += s13 * 666643;
|
264
|
+
s2 += s13 * 470296;
|
265
|
+
s3 += s13 * 654183;
|
266
|
+
s4 -= s13 * 997805;
|
267
|
+
s5 += s13 * 136657;
|
268
|
+
s6 -= s13 * 683901;
|
269
|
+
s13 = 0;
|
270
|
+
|
271
|
+
s0 += s12 * 666643;
|
272
|
+
s1 += s12 * 470296;
|
273
|
+
s2 += s12 * 654183;
|
274
|
+
s3 -= s12 * 997805;
|
275
|
+
s4 += s12 * 136657;
|
276
|
+
s5 -= s12 * 683901;
|
277
|
+
s12 = 0;
|
278
|
+
|
279
|
+
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
280
|
+
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
281
|
+
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
282
|
+
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
283
|
+
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
284
|
+
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
285
|
+
|
286
|
+
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
287
|
+
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
288
|
+
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
289
|
+
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
290
|
+
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
291
|
+
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
292
|
+
|
293
|
+
s0 += s12 * 666643;
|
294
|
+
s1 += s12 * 470296;
|
295
|
+
s2 += s12 * 654183;
|
296
|
+
s3 -= s12 * 997805;
|
297
|
+
s4 += s12 * 136657;
|
298
|
+
s5 -= s12 * 683901;
|
299
|
+
s12 = 0;
|
300
|
+
|
301
|
+
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
302
|
+
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
303
|
+
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
304
|
+
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
305
|
+
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
306
|
+
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
307
|
+
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
308
|
+
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
309
|
+
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
310
|
+
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
311
|
+
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
312
|
+
carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 << 21;
|
313
|
+
|
314
|
+
s0 += s12 * 666643;
|
315
|
+
s1 += s12 * 470296;
|
316
|
+
s2 += s12 * 654183;
|
317
|
+
s3 -= s12 * 997805;
|
318
|
+
s4 += s12 * 136657;
|
319
|
+
s5 -= s12 * 683901;
|
320
|
+
s12 = 0;
|
321
|
+
|
322
|
+
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
323
|
+
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
324
|
+
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
325
|
+
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
326
|
+
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
327
|
+
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
328
|
+
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
329
|
+
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
330
|
+
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
331
|
+
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
332
|
+
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
333
|
+
|
334
|
+
s[0] = s0 >> 0;
|
335
|
+
s[1] = s0 >> 8;
|
336
|
+
s[2] = (s0 >> 16) | (s1 << 5);
|
337
|
+
s[3] = s1 >> 3;
|
338
|
+
s[4] = s1 >> 11;
|
339
|
+
s[5] = (s1 >> 19) | (s2 << 2);
|
340
|
+
s[6] = s2 >> 6;
|
341
|
+
s[7] = (s2 >> 14) | (s3 << 7);
|
342
|
+
s[8] = s3 >> 1;
|
343
|
+
s[9] = s3 >> 9;
|
344
|
+
s[10] = (s3 >> 17) | (s4 << 4);
|
345
|
+
s[11] = s4 >> 4;
|
346
|
+
s[12] = s4 >> 12;
|
347
|
+
s[13] = (s4 >> 20) | (s5 << 1);
|
348
|
+
s[14] = s5 >> 7;
|
349
|
+
s[15] = (s5 >> 15) | (s6 << 6);
|
350
|
+
s[16] = s6 >> 2;
|
351
|
+
s[17] = s6 >> 10;
|
352
|
+
s[18] = (s6 >> 18) | (s7 << 3);
|
353
|
+
s[19] = s7 >> 5;
|
354
|
+
s[20] = s7 >> 13;
|
355
|
+
s[21] = s8 >> 0;
|
356
|
+
s[22] = s8 >> 8;
|
357
|
+
s[23] = (s8 >> 16) | (s9 << 5);
|
358
|
+
s[24] = s9 >> 3;
|
359
|
+
s[25] = s9 >> 11;
|
360
|
+
s[26] = (s9 >> 19) | (s10 << 2);
|
361
|
+
s[27] = s10 >> 6;
|
362
|
+
s[28] = (s10 >> 14) | (s11 << 7);
|
363
|
+
s[29] = s11 >> 1;
|
364
|
+
s[30] = s11 >> 9;
|
365
|
+
s[31] = s11 >> 17;
|
366
|
+
}
|