ed25519 1.0.0-jruby

Sign up to get free protection for your applications and to get access to all the features.
Files changed (82) hide show
  1. checksums.yaml +7 -0
  2. data/.gitignore +15 -0
  3. data/.rspec +5 -0
  4. data/.rubocop.yml +35 -0
  5. data/.travis.yml +13 -0
  6. data/CHANGES.md +16 -0
  7. data/CODE_OF_CONDUCT.md +74 -0
  8. data/Gemfile +12 -0
  9. data/LICENSE +22 -0
  10. data/README.md +159 -0
  11. data/Rakefile +27 -0
  12. data/ed25519.gemspec +32 -0
  13. data/ed25519.png +0 -0
  14. data/ext/ed25519_java/org/cryptosphere/ed25519.java +228 -0
  15. data/ext/ed25519_ref10/api.h +4 -0
  16. data/ext/ed25519_ref10/base.h +1344 -0
  17. data/ext/ed25519_ref10/base2.h +40 -0
  18. data/ext/ed25519_ref10/d.h +1 -0
  19. data/ext/ed25519_ref10/d2.h +1 -0
  20. data/ext/ed25519_ref10/ed25519_ref10.c +99 -0
  21. data/ext/ed25519_ref10/ed25519_ref10.h +33 -0
  22. data/ext/ed25519_ref10/extconf.rb +9 -0
  23. data/ext/ed25519_ref10/fe.h +56 -0
  24. data/ext/ed25519_ref10/fe_0.c +19 -0
  25. data/ext/ed25519_ref10/fe_1.c +19 -0
  26. data/ext/ed25519_ref10/fe_add.c +57 -0
  27. data/ext/ed25519_ref10/fe_cmov.c +63 -0
  28. data/ext/ed25519_ref10/fe_copy.c +29 -0
  29. data/ext/ed25519_ref10/fe_frombytes.c +71 -0
  30. data/ext/ed25519_ref10/fe_invert.c +14 -0
  31. data/ext/ed25519_ref10/fe_isnegative.c +16 -0
  32. data/ext/ed25519_ref10/fe_isnonzero.c +19 -0
  33. data/ext/ed25519_ref10/fe_mul.c +252 -0
  34. data/ext/ed25519_ref10/fe_neg.c +45 -0
  35. data/ext/ed25519_ref10/fe_pow22523.c +13 -0
  36. data/ext/ed25519_ref10/fe_sq.c +148 -0
  37. data/ext/ed25519_ref10/fe_sq2.c +159 -0
  38. data/ext/ed25519_ref10/fe_sub.c +57 -0
  39. data/ext/ed25519_ref10/fe_tobytes.c +119 -0
  40. data/ext/ed25519_ref10/ge.h +95 -0
  41. data/ext/ed25519_ref10/ge_add.c +11 -0
  42. data/ext/ed25519_ref10/ge_add.h +97 -0
  43. data/ext/ed25519_ref10/ge_double_scalarmult.c +96 -0
  44. data/ext/ed25519_ref10/ge_frombytes.c +50 -0
  45. data/ext/ed25519_ref10/ge_madd.c +11 -0
  46. data/ext/ed25519_ref10/ge_madd.h +88 -0
  47. data/ext/ed25519_ref10/ge_msub.c +11 -0
  48. data/ext/ed25519_ref10/ge_msub.h +88 -0
  49. data/ext/ed25519_ref10/ge_p1p1_to_p2.c +12 -0
  50. data/ext/ed25519_ref10/ge_p1p1_to_p3.c +13 -0
  51. data/ext/ed25519_ref10/ge_p2_0.c +8 -0
  52. data/ext/ed25519_ref10/ge_p2_dbl.c +11 -0
  53. data/ext/ed25519_ref10/ge_p2_dbl.h +73 -0
  54. data/ext/ed25519_ref10/ge_p3_0.c +9 -0
  55. data/ext/ed25519_ref10/ge_p3_dbl.c +12 -0
  56. data/ext/ed25519_ref10/ge_p3_to_cached.c +17 -0
  57. data/ext/ed25519_ref10/ge_p3_to_p2.c +12 -0
  58. data/ext/ed25519_ref10/ge_p3_tobytes.c +14 -0
  59. data/ext/ed25519_ref10/ge_precomp_0.c +8 -0
  60. data/ext/ed25519_ref10/ge_scalarmult_base.c +104 -0
  61. data/ext/ed25519_ref10/ge_sub.c +11 -0
  62. data/ext/ed25519_ref10/ge_sub.h +97 -0
  63. data/ext/ed25519_ref10/ge_tobytes.c +14 -0
  64. data/ext/ed25519_ref10/keypair.c +22 -0
  65. data/ext/ed25519_ref10/open.c +47 -0
  66. data/ext/ed25519_ref10/pow22523.h +160 -0
  67. data/ext/ed25519_ref10/pow225521.h +160 -0
  68. data/ext/ed25519_ref10/sc.h +17 -0
  69. data/ext/ed25519_ref10/sc_muladd.c +366 -0
  70. data/ext/ed25519_ref10/sc_reduce.c +272 -0
  71. data/ext/ed25519_ref10/sha512.c +304 -0
  72. data/ext/ed25519_ref10/sha512.h +8 -0
  73. data/ext/ed25519_ref10/sign.c +41 -0
  74. data/ext/ed25519_ref10/sqrtm1.h +1 -0
  75. data/ext/ed25519_ref10/verify.c +40 -0
  76. data/lib/ed25519.rb +65 -0
  77. data/lib/ed25519/provider/jruby.rb +39 -0
  78. data/lib/ed25519/signing_key.rb +39 -0
  79. data/lib/ed25519/verify_key.rb +44 -0
  80. data/lib/ed25519/version.rb +5 -0
  81. data/lib/ed25519_java.jar +0 -0
  82. metadata +138 -0
@@ -0,0 +1,9 @@
1
+ #include "ge.h"
2
+
3
+ void ge_p3_0(ge_p3 *h)
4
+ {
5
+ fe_0(h->X);
6
+ fe_1(h->Y);
7
+ fe_1(h->Z);
8
+ fe_0(h->T);
9
+ }
@@ -0,0 +1,12 @@
1
+ #include "ge.h"
2
+
3
+ /*
4
+ r = 2 * p
5
+ */
6
+
7
+ void ge_p3_dbl(ge_p1p1 *r,const ge_p3 *p)
8
+ {
9
+ ge_p2 q;
10
+ ge_p3_to_p2(&q,p);
11
+ ge_p2_dbl(r,&q);
12
+ }
@@ -0,0 +1,17 @@
1
+ #include "ge.h"
2
+
3
+ /*
4
+ r = p
5
+ */
6
+
7
+ static const fe d2 = {
8
+ #include "d2.h"
9
+ } ;
10
+
11
+ extern void ge_p3_to_cached(ge_cached *r,const ge_p3 *p)
12
+ {
13
+ fe_add(r->YplusX,p->Y,p->X);
14
+ fe_sub(r->YminusX,p->Y,p->X);
15
+ fe_copy(r->Z,p->Z);
16
+ fe_mul(r->T2d,p->T,d2);
17
+ }
@@ -0,0 +1,12 @@
1
+ #include "ge.h"
2
+
3
+ /*
4
+ r = p
5
+ */
6
+
7
+ extern void ge_p3_to_p2(ge_p2 *r,const ge_p3 *p)
8
+ {
9
+ fe_copy(r->X,p->X);
10
+ fe_copy(r->Y,p->Y);
11
+ fe_copy(r->Z,p->Z);
12
+ }
@@ -0,0 +1,14 @@
1
+ #include "ge.h"
2
+
3
+ void ge_p3_tobytes(unsigned char *s,const ge_p3 *h)
4
+ {
5
+ fe recip;
6
+ fe x;
7
+ fe y;
8
+
9
+ fe_invert(recip,h->Z);
10
+ fe_mul(x,h->X,recip);
11
+ fe_mul(y,h->Y,recip);
12
+ fe_tobytes(s,y);
13
+ s[31] ^= fe_isnegative(x) << 7;
14
+ }
@@ -0,0 +1,8 @@
1
+ #include "ge.h"
2
+
3
+ void ge_precomp_0(ge_precomp *h)
4
+ {
5
+ fe_1(h->yplusx);
6
+ fe_1(h->yminusx);
7
+ fe_0(h->xy2d);
8
+ }
@@ -0,0 +1,104 @@
1
+ #include "ge.h"
2
+
3
+ static uint8_t equal(int8_t b,int8_t c)
4
+ {
5
+ uint8_t ub = b;
6
+ uint8_t uc = c;
7
+ uint8_t x = ub ^ uc; /* 0: yes; 1..255: no */
8
+ uint32_t y = x; /* 0: yes; 1..255: no */
9
+ y -= 1; /* 4294967295: yes; 0..254: no */
10
+ y >>= 31; /* 1: yes; 0: no */
11
+ return y;
12
+ }
13
+
14
+ static uint8_t negative(int8_t b)
15
+ {
16
+ unsigned long long x = b; /* 18446744073709551361..18446744073709551615: yes; 0..255: no */
17
+ x >>= 63; /* 1: yes; 0: no */
18
+ return x;
19
+ }
20
+
21
+ static void cmov(ge_precomp *t,ge_precomp *u,int8_t b)
22
+ {
23
+ fe_cmov(t->yplusx,u->yplusx,b);
24
+ fe_cmov(t->yminusx,u->yminusx,b);
25
+ fe_cmov(t->xy2d,u->xy2d,b);
26
+ }
27
+
28
+ /* base[i][j] = (j+1)*256^i*B */
29
+ static ge_precomp base[32][8] = {
30
+ #include "base.h"
31
+ } ;
32
+
33
+ static void select(ge_precomp *t,int pos,int8_t b)
34
+ {
35
+ ge_precomp minust;
36
+ uint8_t bnegative = negative(b);
37
+ uint8_t babs = b - (((-bnegative) & b) << 1);
38
+
39
+ ge_precomp_0(t);
40
+ cmov(t,&base[pos][0],equal(babs,1));
41
+ cmov(t,&base[pos][1],equal(babs,2));
42
+ cmov(t,&base[pos][2],equal(babs,3));
43
+ cmov(t,&base[pos][3],equal(babs,4));
44
+ cmov(t,&base[pos][4],equal(babs,5));
45
+ cmov(t,&base[pos][5],equal(babs,6));
46
+ cmov(t,&base[pos][6],equal(babs,7));
47
+ cmov(t,&base[pos][7],equal(babs,8));
48
+ fe_copy(minust.yplusx,t->yminusx);
49
+ fe_copy(minust.yminusx,t->yplusx);
50
+ fe_neg(minust.xy2d,t->xy2d);
51
+ cmov(t,&minust,bnegative);
52
+ }
53
+
54
+ /*
55
+ h = a * B
56
+ where a = a[0]+256*a[1]+...+256^31 a[31]
57
+ B is the Ed25519 base point (x,4/5) with x positive.
58
+
59
+ Preconditions:
60
+ a[31] <= 127
61
+ */
62
+
63
+ void ge_scalarmult_base(ge_p3 *h,const uint8_t *a)
64
+ {
65
+ int8_t e[64];
66
+ int8_t carry;
67
+ ge_p1p1 r;
68
+ ge_p2 s;
69
+ ge_precomp t;
70
+ int i;
71
+
72
+ for (i = 0;i < 32;++i) {
73
+ e[2 * i + 0] = (a[i] >> 0) & 15;
74
+ e[2 * i + 1] = (a[i] >> 4) & 15;
75
+ }
76
+ /* each e[i] is between 0 and 15 */
77
+ /* e[63] is between 0 and 7 */
78
+
79
+ carry = 0;
80
+ for (i = 0;i < 63;++i) {
81
+ e[i] += carry;
82
+ carry = e[i] + 8;
83
+ carry >>= 4;
84
+ e[i] -= carry << 4;
85
+ }
86
+ e[63] += carry;
87
+ /* each e[i] is between -8 and 8 */
88
+
89
+ ge_p3_0(h);
90
+ for (i = 1;i < 64;i += 2) {
91
+ select(&t,i / 2,e[i]);
92
+ ge_madd(&r,h,&t); ge_p1p1_to_p3(h,&r);
93
+ }
94
+
95
+ ge_p3_dbl(&r,h); ge_p1p1_to_p2(&s,&r);
96
+ ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
97
+ ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
98
+ ge_p2_dbl(&r,&s); ge_p1p1_to_p3(h,&r);
99
+
100
+ for (i = 0;i < 64;i += 2) {
101
+ select(&t,i / 2,e[i]);
102
+ ge_madd(&r,h,&t); ge_p1p1_to_p3(h,&r);
103
+ }
104
+ }
@@ -0,0 +1,11 @@
1
+ #include "ge.h"
2
+
3
+ /*
4
+ r = p - q
5
+ */
6
+
7
+ void ge_sub(ge_p1p1 *r,const ge_p3 *p,const ge_cached *q)
8
+ {
9
+ fe t0;
10
+ #include "ge_sub.h"
11
+ }
@@ -0,0 +1,97 @@
1
+
2
+ /* qhasm: enter ge_sub */
3
+
4
+ /* qhasm: fe X1 */
5
+
6
+ /* qhasm: fe Y1 */
7
+
8
+ /* qhasm: fe Z1 */
9
+
10
+ /* qhasm: fe Z2 */
11
+
12
+ /* qhasm: fe T1 */
13
+
14
+ /* qhasm: fe ZZ */
15
+
16
+ /* qhasm: fe YpX2 */
17
+
18
+ /* qhasm: fe YmX2 */
19
+
20
+ /* qhasm: fe T2d2 */
21
+
22
+ /* qhasm: fe X3 */
23
+
24
+ /* qhasm: fe Y3 */
25
+
26
+ /* qhasm: fe Z3 */
27
+
28
+ /* qhasm: fe T3 */
29
+
30
+ /* qhasm: fe YpX1 */
31
+
32
+ /* qhasm: fe YmX1 */
33
+
34
+ /* qhasm: fe A */
35
+
36
+ /* qhasm: fe B */
37
+
38
+ /* qhasm: fe C */
39
+
40
+ /* qhasm: fe D */
41
+
42
+ /* qhasm: YpX1 = Y1+X1 */
43
+ /* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
44
+ /* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
45
+ fe_add(r->X,p->Y,p->X);
46
+
47
+ /* qhasm: YmX1 = Y1-X1 */
48
+ /* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
49
+ /* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
50
+ fe_sub(r->Y,p->Y,p->X);
51
+
52
+ /* qhasm: A = YpX1*YmX2 */
53
+ /* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<YmX2=fe#16); */
54
+ /* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<YmX2=q->YminusX); */
55
+ fe_mul(r->Z,r->X,q->YminusX);
56
+
57
+ /* qhasm: B = YmX1*YpX2 */
58
+ /* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<YpX2=fe#15); */
59
+ /* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<YpX2=q->YplusX); */
60
+ fe_mul(r->Y,r->Y,q->YplusX);
61
+
62
+ /* qhasm: C = T2d2*T1 */
63
+ /* asm 1: fe_mul(>C=fe#4,<T2d2=fe#18,<T1=fe#14); */
64
+ /* asm 2: fe_mul(>C=r->T,<T2d2=q->T2d,<T1=p->T); */
65
+ fe_mul(r->T,q->T2d,p->T);
66
+
67
+ /* qhasm: ZZ = Z1*Z2 */
68
+ /* asm 1: fe_mul(>ZZ=fe#1,<Z1=fe#13,<Z2=fe#17); */
69
+ /* asm 2: fe_mul(>ZZ=r->X,<Z1=p->Z,<Z2=q->Z); */
70
+ fe_mul(r->X,p->Z,q->Z);
71
+
72
+ /* qhasm: D = 2*ZZ */
73
+ /* asm 1: fe_add(>D=fe#5,<ZZ=fe#1,<ZZ=fe#1); */
74
+ /* asm 2: fe_add(>D=t0,<ZZ=r->X,<ZZ=r->X); */
75
+ fe_add(t0,r->X,r->X);
76
+
77
+ /* qhasm: X3 = A-B */
78
+ /* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
79
+ /* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
80
+ fe_sub(r->X,r->Z,r->Y);
81
+
82
+ /* qhasm: Y3 = A+B */
83
+ /* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
84
+ /* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
85
+ fe_add(r->Y,r->Z,r->Y);
86
+
87
+ /* qhasm: Z3 = D-C */
88
+ /* asm 1: fe_sub(>Z3=fe#3,<D=fe#5,<C=fe#4); */
89
+ /* asm 2: fe_sub(>Z3=r->Z,<D=t0,<C=r->T); */
90
+ fe_sub(r->Z,t0,r->T);
91
+
92
+ /* qhasm: T3 = D+C */
93
+ /* asm 1: fe_add(>T3=fe#4,<D=fe#5,<C=fe#4); */
94
+ /* asm 2: fe_add(>T3=r->T,<D=t0,<C=r->T); */
95
+ fe_add(r->T,t0,r->T);
96
+
97
+ /* qhasm: return */
@@ -0,0 +1,14 @@
1
+ #include "ge.h"
2
+
3
+ void ge_tobytes(unsigned char *s,const ge_p2 *h)
4
+ {
5
+ fe recip;
6
+ fe x;
7
+ fe y;
8
+
9
+ fe_invert(recip,h->Z);
10
+ fe_mul(x,h->X,recip);
11
+ fe_mul(y,h->Y,recip);
12
+ fe_tobytes(s,y);
13
+ s[31] ^= fe_isnegative(x) << 7;
14
+ }
@@ -0,0 +1,22 @@
1
+ #include <string.h>
2
+ #include "ed25519_ref10.h"
3
+ #include "sha512.h"
4
+ #include "ge.h"
5
+
6
+ int crypto_sign_ed25519_ref10_seed_keypair(uint8_t *pk, uint8_t *sk, const uint8_t *seed)
7
+ {
8
+ ge_p3 A;
9
+
10
+ crypto_hash_sha512(sk, seed, 32);
11
+ sk[0] &= 248;
12
+ sk[31] &= 127;
13
+ sk[31] |= 64;
14
+
15
+ ge_scalarmult_base(&A, sk);
16
+ ge_p3_tobytes(pk, &A);
17
+
18
+ memmove(sk, seed, 32);
19
+ memmove(sk + 32, pk, 32);
20
+
21
+ return 0;
22
+ }
@@ -0,0 +1,47 @@
1
+ #include <string.h>
2
+ #include "sha512.h"
3
+ #include "ed25519_ref10.h"
4
+ #include "ge.h"
5
+ #include "sc.h"
6
+
7
+ int crypto_sign_open_ed25519_ref10(
8
+ uint8_t *m, uint64_t *mlen,
9
+ const uint8_t *sm, uint64_t smlen,
10
+ const uint8_t *pk
11
+ )
12
+ {
13
+ unsigned char pkcopy[32];
14
+ unsigned char rcopy[32];
15
+ unsigned char scopy[32];
16
+ unsigned char h[64];
17
+ unsigned char rcheck[32];
18
+ ge_p3 A;
19
+ ge_p2 R;
20
+
21
+ if (smlen < 64) goto badsig;
22
+ if (sm[63] & 224) goto badsig;
23
+ if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
24
+
25
+ memmove(pkcopy,pk,32);
26
+ memmove(rcopy,sm,32);
27
+ memmove(scopy,sm + 32,32);
28
+
29
+ memmove(m,sm,smlen);
30
+ memmove(m + 32,pkcopy,32);
31
+ crypto_hash_sha512(h,m,smlen);
32
+ sc_reduce(h);
33
+
34
+ ge_double_scalarmult_vartime(&R,h,&A,scopy);
35
+ ge_tobytes(rcheck,&R);
36
+ if (crypto_verify_32(rcheck,rcopy) == 0) {
37
+ memmove(m,m + 64,smlen - 64);
38
+ memset(m + smlen - 64,0,64);
39
+ *mlen = smlen - 64;
40
+ return 0;
41
+ }
42
+
43
+ badsig:
44
+ *mlen = -1;
45
+ memset(m,0,smlen);
46
+ return -1;
47
+ }
@@ -0,0 +1,160 @@
1
+
2
+ /* qhasm: fe z1 */
3
+
4
+ /* qhasm: fe z2 */
5
+
6
+ /* qhasm: fe z8 */
7
+
8
+ /* qhasm: fe z9 */
9
+
10
+ /* qhasm: fe z11 */
11
+
12
+ /* qhasm: fe z22 */
13
+
14
+ /* qhasm: fe z_5_0 */
15
+
16
+ /* qhasm: fe z_10_5 */
17
+
18
+ /* qhasm: fe z_10_0 */
19
+
20
+ /* qhasm: fe z_20_10 */
21
+
22
+ /* qhasm: fe z_20_0 */
23
+
24
+ /* qhasm: fe z_40_20 */
25
+
26
+ /* qhasm: fe z_40_0 */
27
+
28
+ /* qhasm: fe z_50_10 */
29
+
30
+ /* qhasm: fe z_50_0 */
31
+
32
+ /* qhasm: fe z_100_50 */
33
+
34
+ /* qhasm: fe z_100_0 */
35
+
36
+ /* qhasm: fe z_200_100 */
37
+
38
+ /* qhasm: fe z_200_0 */
39
+
40
+ /* qhasm: fe z_250_50 */
41
+
42
+ /* qhasm: fe z_250_0 */
43
+
44
+ /* qhasm: fe z_252_2 */
45
+
46
+ /* qhasm: fe z_252_3 */
47
+
48
+ /* qhasm: enter pow22523 */
49
+
50
+ /* qhasm: z2 = z1^2^1 */
51
+ /* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
52
+ /* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
53
+ fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
54
+
55
+ /* qhasm: z8 = z2^2^2 */
56
+ /* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
57
+ /* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
58
+ fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
59
+
60
+ /* qhasm: z9 = z1*z8 */
61
+ /* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
62
+ /* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
63
+ fe_mul(t1,z,t1);
64
+
65
+ /* qhasm: z11 = z2*z9 */
66
+ /* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
67
+ /* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
68
+ fe_mul(t0,t0,t1);
69
+
70
+ /* qhasm: z22 = z11^2^1 */
71
+ /* asm 1: fe_sq(>z22=fe#1,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#1,>z22=fe#1); */
72
+ /* asm 2: fe_sq(>z22=t0,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t0,>z22=t0); */
73
+ fe_sq(t0,t0); for (i = 1;i < 1;++i) fe_sq(t0,t0);
74
+
75
+ /* qhasm: z_5_0 = z9*z22 */
76
+ /* asm 1: fe_mul(>z_5_0=fe#1,<z9=fe#2,<z22=fe#1); */
77
+ /* asm 2: fe_mul(>z_5_0=t0,<z9=t1,<z22=t0); */
78
+ fe_mul(t0,t1,t0);
79
+
80
+ /* qhasm: z_10_5 = z_5_0^2^5 */
81
+ /* asm 1: fe_sq(>z_10_5=fe#2,<z_5_0=fe#1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#2,>z_10_5=fe#2); */
82
+ /* asm 2: fe_sq(>z_10_5=t1,<z_5_0=t0); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t1,>z_10_5=t1); */
83
+ fe_sq(t1,t0); for (i = 1;i < 5;++i) fe_sq(t1,t1);
84
+
85
+ /* qhasm: z_10_0 = z_10_5*z_5_0 */
86
+ /* asm 1: fe_mul(>z_10_0=fe#1,<z_10_5=fe#2,<z_5_0=fe#1); */
87
+ /* asm 2: fe_mul(>z_10_0=t0,<z_10_5=t1,<z_5_0=t0); */
88
+ fe_mul(t0,t1,t0);
89
+
90
+ /* qhasm: z_20_10 = z_10_0^2^10 */
91
+ /* asm 1: fe_sq(>z_20_10=fe#2,<z_10_0=fe#1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#2,>z_20_10=fe#2); */
92
+ /* asm 2: fe_sq(>z_20_10=t1,<z_10_0=t0); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t1,>z_20_10=t1); */
93
+ fe_sq(t1,t0); for (i = 1;i < 10;++i) fe_sq(t1,t1);
94
+
95
+ /* qhasm: z_20_0 = z_20_10*z_10_0 */
96
+ /* asm 1: fe_mul(>z_20_0=fe#2,<z_20_10=fe#2,<z_10_0=fe#1); */
97
+ /* asm 2: fe_mul(>z_20_0=t1,<z_20_10=t1,<z_10_0=t0); */
98
+ fe_mul(t1,t1,t0);
99
+
100
+ /* qhasm: z_40_20 = z_20_0^2^20 */
101
+ /* asm 1: fe_sq(>z_40_20=fe#3,<z_20_0=fe#2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#3,>z_40_20=fe#3); */
102
+ /* asm 2: fe_sq(>z_40_20=t2,<z_20_0=t1); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t2,>z_40_20=t2); */
103
+ fe_sq(t2,t1); for (i = 1;i < 20;++i) fe_sq(t2,t2);
104
+
105
+ /* qhasm: z_40_0 = z_40_20*z_20_0 */
106
+ /* asm 1: fe_mul(>z_40_0=fe#2,<z_40_20=fe#3,<z_20_0=fe#2); */
107
+ /* asm 2: fe_mul(>z_40_0=t1,<z_40_20=t2,<z_20_0=t1); */
108
+ fe_mul(t1,t2,t1);
109
+
110
+ /* qhasm: z_50_10 = z_40_0^2^10 */
111
+ /* asm 1: fe_sq(>z_50_10=fe#2,<z_40_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#2,>z_50_10=fe#2); */
112
+ /* asm 2: fe_sq(>z_50_10=t1,<z_40_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t1,>z_50_10=t1); */
113
+ fe_sq(t1,t1); for (i = 1;i < 10;++i) fe_sq(t1,t1);
114
+
115
+ /* qhasm: z_50_0 = z_50_10*z_10_0 */
116
+ /* asm 1: fe_mul(>z_50_0=fe#1,<z_50_10=fe#2,<z_10_0=fe#1); */
117
+ /* asm 2: fe_mul(>z_50_0=t0,<z_50_10=t1,<z_10_0=t0); */
118
+ fe_mul(t0,t1,t0);
119
+
120
+ /* qhasm: z_100_50 = z_50_0^2^50 */
121
+ /* asm 1: fe_sq(>z_100_50=fe#2,<z_50_0=fe#1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#2,>z_100_50=fe#2); */
122
+ /* asm 2: fe_sq(>z_100_50=t1,<z_50_0=t0); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t1,>z_100_50=t1); */
123
+ fe_sq(t1,t0); for (i = 1;i < 50;++i) fe_sq(t1,t1);
124
+
125
+ /* qhasm: z_100_0 = z_100_50*z_50_0 */
126
+ /* asm 1: fe_mul(>z_100_0=fe#2,<z_100_50=fe#2,<z_50_0=fe#1); */
127
+ /* asm 2: fe_mul(>z_100_0=t1,<z_100_50=t1,<z_50_0=t0); */
128
+ fe_mul(t1,t1,t0);
129
+
130
+ /* qhasm: z_200_100 = z_100_0^2^100 */
131
+ /* asm 1: fe_sq(>z_200_100=fe#3,<z_100_0=fe#2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#3,>z_200_100=fe#3); */
132
+ /* asm 2: fe_sq(>z_200_100=t2,<z_100_0=t1); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t2,>z_200_100=t2); */
133
+ fe_sq(t2,t1); for (i = 1;i < 100;++i) fe_sq(t2,t2);
134
+
135
+ /* qhasm: z_200_0 = z_200_100*z_100_0 */
136
+ /* asm 1: fe_mul(>z_200_0=fe#2,<z_200_100=fe#3,<z_100_0=fe#2); */
137
+ /* asm 2: fe_mul(>z_200_0=t1,<z_200_100=t2,<z_100_0=t1); */
138
+ fe_mul(t1,t2,t1);
139
+
140
+ /* qhasm: z_250_50 = z_200_0^2^50 */
141
+ /* asm 1: fe_sq(>z_250_50=fe#2,<z_200_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#2,>z_250_50=fe#2); */
142
+ /* asm 2: fe_sq(>z_250_50=t1,<z_200_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t1,>z_250_50=t1); */
143
+ fe_sq(t1,t1); for (i = 1;i < 50;++i) fe_sq(t1,t1);
144
+
145
+ /* qhasm: z_250_0 = z_250_50*z_50_0 */
146
+ /* asm 1: fe_mul(>z_250_0=fe#1,<z_250_50=fe#2,<z_50_0=fe#1); */
147
+ /* asm 2: fe_mul(>z_250_0=t0,<z_250_50=t1,<z_50_0=t0); */
148
+ fe_mul(t0,t1,t0);
149
+
150
+ /* qhasm: z_252_2 = z_250_0^2^2 */
151
+ /* asm 1: fe_sq(>z_252_2=fe#1,<z_250_0=fe#1); for (i = 1;i < 2;++i) fe_sq(>z_252_2=fe#1,>z_252_2=fe#1); */
152
+ /* asm 2: fe_sq(>z_252_2=t0,<z_250_0=t0); for (i = 1;i < 2;++i) fe_sq(>z_252_2=t0,>z_252_2=t0); */
153
+ fe_sq(t0,t0); for (i = 1;i < 2;++i) fe_sq(t0,t0);
154
+
155
+ /* qhasm: z_252_3 = z_252_2*z1 */
156
+ /* asm 1: fe_mul(>z_252_3=fe#12,<z_252_2=fe#1,<z1=fe#11); */
157
+ /* asm 2: fe_mul(>z_252_3=out,<z_252_2=t0,<z1=z); */
158
+ fe_mul(out,t0,z);
159
+
160
+ /* qhasm: return */