ed25519 1.2.4-java

Sign up to get free protection for your applications and to get access to all the features.
Files changed (79) hide show
  1. checksums.yaml +7 -0
  2. data/.gitignore +15 -0
  3. data/.rspec +5 -0
  4. data/.rubocop.yml +35 -0
  5. data/.travis.yml +26 -0
  6. data/CHANGES.md +70 -0
  7. data/CODE_OF_CONDUCT.md +74 -0
  8. data/Gemfile +12 -0
  9. data/LICENSE +22 -0
  10. data/README.md +170 -0
  11. data/Rakefile +27 -0
  12. data/appveyor.yml +21 -0
  13. data/ed25519.gemspec +32 -0
  14. data/ed25519.png +0 -0
  15. data/ext/ed25519_jruby/LICENSE.txt +123 -0
  16. data/ext/ed25519_jruby/README.md +77 -0
  17. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAEngine.java +491 -0
  18. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAKey.java +31 -0
  19. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAPrivateKey.java +338 -0
  20. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSAPublicKey.java +275 -0
  21. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/EdDSASecurityProvider.java +59 -0
  22. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/KeyFactory.java +75 -0
  23. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/KeyPairGenerator.java +97 -0
  24. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/Utils.java +103 -0
  25. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Constants.java +23 -0
  26. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Curve.java +100 -0
  27. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Encoding.java +54 -0
  28. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/Field.java +99 -0
  29. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/FieldElement.java +76 -0
  30. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/GroupElement.java +1034 -0
  31. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ScalarOps.java +34 -0
  32. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElement.java +131 -0
  33. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/BigIntegerLittleEndianEncoding.java +102 -0
  34. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOps.java +37 -0
  35. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/bigint/package.html +6 -0
  36. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElement.java +988 -0
  37. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncoding.java +256 -0
  38. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOps.java +693 -0
  39. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAGenParameterSpec.java +32 -0
  40. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSANamedCurveSpec.java +35 -0
  41. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSANamedCurveTable.java +71 -0
  42. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAParameterSpec.java +97 -0
  43. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpec.java +133 -0
  44. data/ext/ed25519_jruby/net/i2p/crypto/eddsa/spec/EdDSAPublicKeySpec.java +61 -0
  45. data/ext/ed25519_jruby/org/cryptorb/Ed25519Provider.java +95 -0
  46. data/ext/ed25519_ref10/api.h +4 -0
  47. data/ext/ed25519_ref10/base.h +1344 -0
  48. data/ext/ed25519_ref10/base2.h +40 -0
  49. data/ext/ed25519_ref10/d.h +1 -0
  50. data/ext/ed25519_ref10/d2.h +1 -0
  51. data/ext/ed25519_ref10/ed25519_ref10.c +99 -0
  52. data/ext/ed25519_ref10/ed25519_ref10.h +33 -0
  53. data/ext/ed25519_ref10/extconf.rb +9 -0
  54. data/ext/ed25519_ref10/fe.c +1085 -0
  55. data/ext/ed25519_ref10/fe.h +56 -0
  56. data/ext/ed25519_ref10/ge.c +407 -0
  57. data/ext/ed25519_ref10/ge.h +95 -0
  58. data/ext/ed25519_ref10/ge_add.h +97 -0
  59. data/ext/ed25519_ref10/ge_madd.h +88 -0
  60. data/ext/ed25519_ref10/ge_msub.h +88 -0
  61. data/ext/ed25519_ref10/ge_p2_dbl.h +73 -0
  62. data/ext/ed25519_ref10/ge_sub.h +97 -0
  63. data/ext/ed25519_ref10/keypair.c +22 -0
  64. data/ext/ed25519_ref10/open.c +47 -0
  65. data/ext/ed25519_ref10/pow22523.h +160 -0
  66. data/ext/ed25519_ref10/pow225521.h +160 -0
  67. data/ext/ed25519_ref10/sc.h +17 -0
  68. data/ext/ed25519_ref10/sc_muladd.c +366 -0
  69. data/ext/ed25519_ref10/sc_reduce.c +272 -0
  70. data/ext/ed25519_ref10/sha512.c +304 -0
  71. data/ext/ed25519_ref10/sha512.h +8 -0
  72. data/ext/ed25519_ref10/sign.c +41 -0
  73. data/ext/ed25519_ref10/sqrtm1.h +1 -0
  74. data/ext/ed25519_ref10/verify.c +40 -0
  75. data/lib/ed25519.rb +72 -0
  76. data/lib/ed25519/signing_key.rb +60 -0
  77. data/lib/ed25519/verify_key.rb +44 -0
  78. data/lib/ed25519/version.rb +5 -0
  79. metadata +137 -0
@@ -0,0 +1,22 @@
1
+ #include <string.h>
2
+ #include "ed25519_ref10.h"
3
+ #include "sha512.h"
4
+ #include "ge.h"
5
+
6
+ int crypto_sign_ed25519_ref10_seed_keypair(uint8_t *pk, uint8_t *sk, const uint8_t *seed)
7
+ {
8
+ ge_p3 A;
9
+
10
+ crypto_hash_sha512(sk, seed, 32);
11
+ sk[0] &= 248;
12
+ sk[31] &= 127;
13
+ sk[31] |= 64;
14
+
15
+ ge_scalarmult_base(&A, sk);
16
+ ge_p3_tobytes(pk, &A);
17
+
18
+ memmove(sk, seed, 32);
19
+ memmove(sk + 32, pk, 32);
20
+
21
+ return 0;
22
+ }
@@ -0,0 +1,47 @@
1
+ #include <string.h>
2
+ #include "sha512.h"
3
+ #include "ed25519_ref10.h"
4
+ #include "ge.h"
5
+ #include "sc.h"
6
+
7
+ int crypto_sign_open_ed25519_ref10(
8
+ uint8_t *m, uint64_t *mlen,
9
+ const uint8_t *sm, uint64_t smlen,
10
+ const uint8_t *pk
11
+ )
12
+ {
13
+ unsigned char pkcopy[32];
14
+ unsigned char rcopy[32];
15
+ unsigned char scopy[32];
16
+ unsigned char h[64];
17
+ unsigned char rcheck[32];
18
+ ge_p3 A;
19
+ ge_p2 R;
20
+
21
+ if (smlen < 64) goto badsig;
22
+ if (sm[63] & 224) goto badsig;
23
+ if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
24
+
25
+ memmove(pkcopy,pk,32);
26
+ memmove(rcopy,sm,32);
27
+ memmove(scopy,sm + 32,32);
28
+
29
+ memmove(m,sm,smlen);
30
+ memmove(m + 32,pkcopy,32);
31
+ crypto_hash_sha512(h,m,smlen);
32
+ sc_reduce(h);
33
+
34
+ ge_double_scalarmult_vartime(&R,h,&A,scopy);
35
+ ge_tobytes(rcheck,&R);
36
+ if (crypto_verify_32(rcheck,rcopy) == 0) {
37
+ memmove(m,m + 64,smlen - 64);
38
+ memset(m + smlen - 64,0,64);
39
+ *mlen = smlen - 64;
40
+ return 0;
41
+ }
42
+
43
+ badsig:
44
+ *mlen = -1;
45
+ memset(m,0,smlen);
46
+ return -1;
47
+ }
@@ -0,0 +1,160 @@
1
+
2
+ /* qhasm: fe z1 */
3
+
4
+ /* qhasm: fe z2 */
5
+
6
+ /* qhasm: fe z8 */
7
+
8
+ /* qhasm: fe z9 */
9
+
10
+ /* qhasm: fe z11 */
11
+
12
+ /* qhasm: fe z22 */
13
+
14
+ /* qhasm: fe z_5_0 */
15
+
16
+ /* qhasm: fe z_10_5 */
17
+
18
+ /* qhasm: fe z_10_0 */
19
+
20
+ /* qhasm: fe z_20_10 */
21
+
22
+ /* qhasm: fe z_20_0 */
23
+
24
+ /* qhasm: fe z_40_20 */
25
+
26
+ /* qhasm: fe z_40_0 */
27
+
28
+ /* qhasm: fe z_50_10 */
29
+
30
+ /* qhasm: fe z_50_0 */
31
+
32
+ /* qhasm: fe z_100_50 */
33
+
34
+ /* qhasm: fe z_100_0 */
35
+
36
+ /* qhasm: fe z_200_100 */
37
+
38
+ /* qhasm: fe z_200_0 */
39
+
40
+ /* qhasm: fe z_250_50 */
41
+
42
+ /* qhasm: fe z_250_0 */
43
+
44
+ /* qhasm: fe z_252_2 */
45
+
46
+ /* qhasm: fe z_252_3 */
47
+
48
+ /* qhasm: enter pow22523 */
49
+
50
+ /* qhasm: z2 = z1^2^1 */
51
+ /* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
52
+ /* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
53
+ fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
54
+
55
+ /* qhasm: z8 = z2^2^2 */
56
+ /* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
57
+ /* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
58
+ fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
59
+
60
+ /* qhasm: z9 = z1*z8 */
61
+ /* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
62
+ /* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
63
+ fe_mul(t1,z,t1);
64
+
65
+ /* qhasm: z11 = z2*z9 */
66
+ /* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
67
+ /* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
68
+ fe_mul(t0,t0,t1);
69
+
70
+ /* qhasm: z22 = z11^2^1 */
71
+ /* asm 1: fe_sq(>z22=fe#1,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#1,>z22=fe#1); */
72
+ /* asm 2: fe_sq(>z22=t0,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t0,>z22=t0); */
73
+ fe_sq(t0,t0); for (i = 1;i < 1;++i) fe_sq(t0,t0);
74
+
75
+ /* qhasm: z_5_0 = z9*z22 */
76
+ /* asm 1: fe_mul(>z_5_0=fe#1,<z9=fe#2,<z22=fe#1); */
77
+ /* asm 2: fe_mul(>z_5_0=t0,<z9=t1,<z22=t0); */
78
+ fe_mul(t0,t1,t0);
79
+
80
+ /* qhasm: z_10_5 = z_5_0^2^5 */
81
+ /* asm 1: fe_sq(>z_10_5=fe#2,<z_5_0=fe#1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#2,>z_10_5=fe#2); */
82
+ /* asm 2: fe_sq(>z_10_5=t1,<z_5_0=t0); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t1,>z_10_5=t1); */
83
+ fe_sq(t1,t0); for (i = 1;i < 5;++i) fe_sq(t1,t1);
84
+
85
+ /* qhasm: z_10_0 = z_10_5*z_5_0 */
86
+ /* asm 1: fe_mul(>z_10_0=fe#1,<z_10_5=fe#2,<z_5_0=fe#1); */
87
+ /* asm 2: fe_mul(>z_10_0=t0,<z_10_5=t1,<z_5_0=t0); */
88
+ fe_mul(t0,t1,t0);
89
+
90
+ /* qhasm: z_20_10 = z_10_0^2^10 */
91
+ /* asm 1: fe_sq(>z_20_10=fe#2,<z_10_0=fe#1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#2,>z_20_10=fe#2); */
92
+ /* asm 2: fe_sq(>z_20_10=t1,<z_10_0=t0); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t1,>z_20_10=t1); */
93
+ fe_sq(t1,t0); for (i = 1;i < 10;++i) fe_sq(t1,t1);
94
+
95
+ /* qhasm: z_20_0 = z_20_10*z_10_0 */
96
+ /* asm 1: fe_mul(>z_20_0=fe#2,<z_20_10=fe#2,<z_10_0=fe#1); */
97
+ /* asm 2: fe_mul(>z_20_0=t1,<z_20_10=t1,<z_10_0=t0); */
98
+ fe_mul(t1,t1,t0);
99
+
100
+ /* qhasm: z_40_20 = z_20_0^2^20 */
101
+ /* asm 1: fe_sq(>z_40_20=fe#3,<z_20_0=fe#2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#3,>z_40_20=fe#3); */
102
+ /* asm 2: fe_sq(>z_40_20=t2,<z_20_0=t1); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t2,>z_40_20=t2); */
103
+ fe_sq(t2,t1); for (i = 1;i < 20;++i) fe_sq(t2,t2);
104
+
105
+ /* qhasm: z_40_0 = z_40_20*z_20_0 */
106
+ /* asm 1: fe_mul(>z_40_0=fe#2,<z_40_20=fe#3,<z_20_0=fe#2); */
107
+ /* asm 2: fe_mul(>z_40_0=t1,<z_40_20=t2,<z_20_0=t1); */
108
+ fe_mul(t1,t2,t1);
109
+
110
+ /* qhasm: z_50_10 = z_40_0^2^10 */
111
+ /* asm 1: fe_sq(>z_50_10=fe#2,<z_40_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#2,>z_50_10=fe#2); */
112
+ /* asm 2: fe_sq(>z_50_10=t1,<z_40_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t1,>z_50_10=t1); */
113
+ fe_sq(t1,t1); for (i = 1;i < 10;++i) fe_sq(t1,t1);
114
+
115
+ /* qhasm: z_50_0 = z_50_10*z_10_0 */
116
+ /* asm 1: fe_mul(>z_50_0=fe#1,<z_50_10=fe#2,<z_10_0=fe#1); */
117
+ /* asm 2: fe_mul(>z_50_0=t0,<z_50_10=t1,<z_10_0=t0); */
118
+ fe_mul(t0,t1,t0);
119
+
120
+ /* qhasm: z_100_50 = z_50_0^2^50 */
121
+ /* asm 1: fe_sq(>z_100_50=fe#2,<z_50_0=fe#1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#2,>z_100_50=fe#2); */
122
+ /* asm 2: fe_sq(>z_100_50=t1,<z_50_0=t0); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t1,>z_100_50=t1); */
123
+ fe_sq(t1,t0); for (i = 1;i < 50;++i) fe_sq(t1,t1);
124
+
125
+ /* qhasm: z_100_0 = z_100_50*z_50_0 */
126
+ /* asm 1: fe_mul(>z_100_0=fe#2,<z_100_50=fe#2,<z_50_0=fe#1); */
127
+ /* asm 2: fe_mul(>z_100_0=t1,<z_100_50=t1,<z_50_0=t0); */
128
+ fe_mul(t1,t1,t0);
129
+
130
+ /* qhasm: z_200_100 = z_100_0^2^100 */
131
+ /* asm 1: fe_sq(>z_200_100=fe#3,<z_100_0=fe#2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#3,>z_200_100=fe#3); */
132
+ /* asm 2: fe_sq(>z_200_100=t2,<z_100_0=t1); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t2,>z_200_100=t2); */
133
+ fe_sq(t2,t1); for (i = 1;i < 100;++i) fe_sq(t2,t2);
134
+
135
+ /* qhasm: z_200_0 = z_200_100*z_100_0 */
136
+ /* asm 1: fe_mul(>z_200_0=fe#2,<z_200_100=fe#3,<z_100_0=fe#2); */
137
+ /* asm 2: fe_mul(>z_200_0=t1,<z_200_100=t2,<z_100_0=t1); */
138
+ fe_mul(t1,t2,t1);
139
+
140
+ /* qhasm: z_250_50 = z_200_0^2^50 */
141
+ /* asm 1: fe_sq(>z_250_50=fe#2,<z_200_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#2,>z_250_50=fe#2); */
142
+ /* asm 2: fe_sq(>z_250_50=t1,<z_200_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t1,>z_250_50=t1); */
143
+ fe_sq(t1,t1); for (i = 1;i < 50;++i) fe_sq(t1,t1);
144
+
145
+ /* qhasm: z_250_0 = z_250_50*z_50_0 */
146
+ /* asm 1: fe_mul(>z_250_0=fe#1,<z_250_50=fe#2,<z_50_0=fe#1); */
147
+ /* asm 2: fe_mul(>z_250_0=t0,<z_250_50=t1,<z_50_0=t0); */
148
+ fe_mul(t0,t1,t0);
149
+
150
+ /* qhasm: z_252_2 = z_250_0^2^2 */
151
+ /* asm 1: fe_sq(>z_252_2=fe#1,<z_250_0=fe#1); for (i = 1;i < 2;++i) fe_sq(>z_252_2=fe#1,>z_252_2=fe#1); */
152
+ /* asm 2: fe_sq(>z_252_2=t0,<z_250_0=t0); for (i = 1;i < 2;++i) fe_sq(>z_252_2=t0,>z_252_2=t0); */
153
+ fe_sq(t0,t0); for (i = 1;i < 2;++i) fe_sq(t0,t0);
154
+
155
+ /* qhasm: z_252_3 = z_252_2*z1 */
156
+ /* asm 1: fe_mul(>z_252_3=fe#12,<z_252_2=fe#1,<z1=fe#11); */
157
+ /* asm 2: fe_mul(>z_252_3=out,<z_252_2=t0,<z1=z); */
158
+ fe_mul(out,t0,z);
159
+
160
+ /* qhasm: return */
@@ -0,0 +1,160 @@
1
+
2
+ /* qhasm: fe z1 */
3
+
4
+ /* qhasm: fe z2 */
5
+
6
+ /* qhasm: fe z8 */
7
+
8
+ /* qhasm: fe z9 */
9
+
10
+ /* qhasm: fe z11 */
11
+
12
+ /* qhasm: fe z22 */
13
+
14
+ /* qhasm: fe z_5_0 */
15
+
16
+ /* qhasm: fe z_10_5 */
17
+
18
+ /* qhasm: fe z_10_0 */
19
+
20
+ /* qhasm: fe z_20_10 */
21
+
22
+ /* qhasm: fe z_20_0 */
23
+
24
+ /* qhasm: fe z_40_20 */
25
+
26
+ /* qhasm: fe z_40_0 */
27
+
28
+ /* qhasm: fe z_50_10 */
29
+
30
+ /* qhasm: fe z_50_0 */
31
+
32
+ /* qhasm: fe z_100_50 */
33
+
34
+ /* qhasm: fe z_100_0 */
35
+
36
+ /* qhasm: fe z_200_100 */
37
+
38
+ /* qhasm: fe z_200_0 */
39
+
40
+ /* qhasm: fe z_250_50 */
41
+
42
+ /* qhasm: fe z_250_0 */
43
+
44
+ /* qhasm: fe z_255_5 */
45
+
46
+ /* qhasm: fe z_255_21 */
47
+
48
+ /* qhasm: enter pow225521 */
49
+
50
+ /* qhasm: z2 = z1^2^1 */
51
+ /* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
52
+ /* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
53
+ fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
54
+
55
+ /* qhasm: z8 = z2^2^2 */
56
+ /* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
57
+ /* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
58
+ fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
59
+
60
+ /* qhasm: z9 = z1*z8 */
61
+ /* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
62
+ /* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
63
+ fe_mul(t1,z,t1);
64
+
65
+ /* qhasm: z11 = z2*z9 */
66
+ /* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
67
+ /* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
68
+ fe_mul(t0,t0,t1);
69
+
70
+ /* qhasm: z22 = z11^2^1 */
71
+ /* asm 1: fe_sq(>z22=fe#3,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#3,>z22=fe#3); */
72
+ /* asm 2: fe_sq(>z22=t2,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t2,>z22=t2); */
73
+ fe_sq(t2,t0); for (i = 1;i < 1;++i) fe_sq(t2,t2);
74
+
75
+ /* qhasm: z_5_0 = z9*z22 */
76
+ /* asm 1: fe_mul(>z_5_0=fe#2,<z9=fe#2,<z22=fe#3); */
77
+ /* asm 2: fe_mul(>z_5_0=t1,<z9=t1,<z22=t2); */
78
+ fe_mul(t1,t1,t2);
79
+
80
+ /* qhasm: z_10_5 = z_5_0^2^5 */
81
+ /* asm 1: fe_sq(>z_10_5=fe#3,<z_5_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#3,>z_10_5=fe#3); */
82
+ /* asm 2: fe_sq(>z_10_5=t2,<z_5_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t2,>z_10_5=t2); */
83
+ fe_sq(t2,t1); for (i = 1;i < 5;++i) fe_sq(t2,t2);
84
+
85
+ /* qhasm: z_10_0 = z_10_5*z_5_0 */
86
+ /* asm 1: fe_mul(>z_10_0=fe#2,<z_10_5=fe#3,<z_5_0=fe#2); */
87
+ /* asm 2: fe_mul(>z_10_0=t1,<z_10_5=t2,<z_5_0=t1); */
88
+ fe_mul(t1,t2,t1);
89
+
90
+ /* qhasm: z_20_10 = z_10_0^2^10 */
91
+ /* asm 1: fe_sq(>z_20_10=fe#3,<z_10_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#3,>z_20_10=fe#3); */
92
+ /* asm 2: fe_sq(>z_20_10=t2,<z_10_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t2,>z_20_10=t2); */
93
+ fe_sq(t2,t1); for (i = 1;i < 10;++i) fe_sq(t2,t2);
94
+
95
+ /* qhasm: z_20_0 = z_20_10*z_10_0 */
96
+ /* asm 1: fe_mul(>z_20_0=fe#3,<z_20_10=fe#3,<z_10_0=fe#2); */
97
+ /* asm 2: fe_mul(>z_20_0=t2,<z_20_10=t2,<z_10_0=t1); */
98
+ fe_mul(t2,t2,t1);
99
+
100
+ /* qhasm: z_40_20 = z_20_0^2^20 */
101
+ /* asm 1: fe_sq(>z_40_20=fe#4,<z_20_0=fe#3); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#4,>z_40_20=fe#4); */
102
+ /* asm 2: fe_sq(>z_40_20=t3,<z_20_0=t2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t3,>z_40_20=t3); */
103
+ fe_sq(t3,t2); for (i = 1;i < 20;++i) fe_sq(t3,t3);
104
+
105
+ /* qhasm: z_40_0 = z_40_20*z_20_0 */
106
+ /* asm 1: fe_mul(>z_40_0=fe#3,<z_40_20=fe#4,<z_20_0=fe#3); */
107
+ /* asm 2: fe_mul(>z_40_0=t2,<z_40_20=t3,<z_20_0=t2); */
108
+ fe_mul(t2,t3,t2);
109
+
110
+ /* qhasm: z_50_10 = z_40_0^2^10 */
111
+ /* asm 1: fe_sq(>z_50_10=fe#3,<z_40_0=fe#3); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#3,>z_50_10=fe#3); */
112
+ /* asm 2: fe_sq(>z_50_10=t2,<z_40_0=t2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t2,>z_50_10=t2); */
113
+ fe_sq(t2,t2); for (i = 1;i < 10;++i) fe_sq(t2,t2);
114
+
115
+ /* qhasm: z_50_0 = z_50_10*z_10_0 */
116
+ /* asm 1: fe_mul(>z_50_0=fe#2,<z_50_10=fe#3,<z_10_0=fe#2); */
117
+ /* asm 2: fe_mul(>z_50_0=t1,<z_50_10=t2,<z_10_0=t1); */
118
+ fe_mul(t1,t2,t1);
119
+
120
+ /* qhasm: z_100_50 = z_50_0^2^50 */
121
+ /* asm 1: fe_sq(>z_100_50=fe#3,<z_50_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#3,>z_100_50=fe#3); */
122
+ /* asm 2: fe_sq(>z_100_50=t2,<z_50_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t2,>z_100_50=t2); */
123
+ fe_sq(t2,t1); for (i = 1;i < 50;++i) fe_sq(t2,t2);
124
+
125
+ /* qhasm: z_100_0 = z_100_50*z_50_0 */
126
+ /* asm 1: fe_mul(>z_100_0=fe#3,<z_100_50=fe#3,<z_50_0=fe#2); */
127
+ /* asm 2: fe_mul(>z_100_0=t2,<z_100_50=t2,<z_50_0=t1); */
128
+ fe_mul(t2,t2,t1);
129
+
130
+ /* qhasm: z_200_100 = z_100_0^2^100 */
131
+ /* asm 1: fe_sq(>z_200_100=fe#4,<z_100_0=fe#3); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#4,>z_200_100=fe#4); */
132
+ /* asm 2: fe_sq(>z_200_100=t3,<z_100_0=t2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t3,>z_200_100=t3); */
133
+ fe_sq(t3,t2); for (i = 1;i < 100;++i) fe_sq(t3,t3);
134
+
135
+ /* qhasm: z_200_0 = z_200_100*z_100_0 */
136
+ /* asm 1: fe_mul(>z_200_0=fe#3,<z_200_100=fe#4,<z_100_0=fe#3); */
137
+ /* asm 2: fe_mul(>z_200_0=t2,<z_200_100=t3,<z_100_0=t2); */
138
+ fe_mul(t2,t3,t2);
139
+
140
+ /* qhasm: z_250_50 = z_200_0^2^50 */
141
+ /* asm 1: fe_sq(>z_250_50=fe#3,<z_200_0=fe#3); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#3,>z_250_50=fe#3); */
142
+ /* asm 2: fe_sq(>z_250_50=t2,<z_200_0=t2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t2,>z_250_50=t2); */
143
+ fe_sq(t2,t2); for (i = 1;i < 50;++i) fe_sq(t2,t2);
144
+
145
+ /* qhasm: z_250_0 = z_250_50*z_50_0 */
146
+ /* asm 1: fe_mul(>z_250_0=fe#2,<z_250_50=fe#3,<z_50_0=fe#2); */
147
+ /* asm 2: fe_mul(>z_250_0=t1,<z_250_50=t2,<z_50_0=t1); */
148
+ fe_mul(t1,t2,t1);
149
+
150
+ /* qhasm: z_255_5 = z_250_0^2^5 */
151
+ /* asm 1: fe_sq(>z_255_5=fe#2,<z_250_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_255_5=fe#2,>z_255_5=fe#2); */
152
+ /* asm 2: fe_sq(>z_255_5=t1,<z_250_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_255_5=t1,>z_255_5=t1); */
153
+ fe_sq(t1,t1); for (i = 1;i < 5;++i) fe_sq(t1,t1);
154
+
155
+ /* qhasm: z_255_21 = z_255_5*z11 */
156
+ /* asm 1: fe_mul(>z_255_21=fe#12,<z_255_5=fe#2,<z11=fe#1); */
157
+ /* asm 2: fe_mul(>z_255_21=out,<z_255_5=t1,<z11=t0); */
158
+ fe_mul(out,t1,t0);
159
+
160
+ /* qhasm: return */
@@ -0,0 +1,17 @@
1
+ #ifndef SC_H
2
+ #define SC_H
3
+
4
+ #include <stdint.h>
5
+
6
+ /*
7
+ The set of scalars is \Z/l
8
+ where l = 2^252 + 27742317777372353535851937790883648493.
9
+ */
10
+
11
+ #define sc_reduce crypto_sign_ed25519_ref10_sc_reduce
12
+ #define sc_muladd crypto_sign_ed25519_ref10_sc_muladd
13
+
14
+ extern void sc_reduce(uint8_t *);
15
+ extern void sc_muladd(uint8_t *,const uint8_t *,const uint8_t *,const uint8_t *);
16
+
17
+ #endif
@@ -0,0 +1,366 @@
1
+ #include "sc.h"
2
+
3
+ static uint64_t load_3(const uint8_t *in)
4
+ {
5
+ uint64_t result;
6
+ result = (uint64_t) in[0];
7
+ result |= ((uint64_t) in[1]) << 8;
8
+ result |= ((uint64_t) in[2]) << 16;
9
+ return result;
10
+ }
11
+
12
+ static uint64_t load_4(const uint8_t *in)
13
+ {
14
+ uint64_t result;
15
+ result = (uint64_t) in[0];
16
+ result |= ((uint64_t) in[1]) << 8;
17
+ result |= ((uint64_t) in[2]) << 16;
18
+ result |= ((uint64_t) in[3]) << 24;
19
+ return result;
20
+ }
21
+
22
+ /*
23
+ Input:
24
+ a[0]+256*a[1]+...+256^31*a[31] = a
25
+ b[0]+256*b[1]+...+256^31*b[31] = b
26
+ c[0]+256*c[1]+...+256^31*c[31] = c
27
+
28
+ Output:
29
+ s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
30
+ where l = 2^252 + 27742317777372353535851937790883648493.
31
+ */
32
+
33
+ void sc_muladd(uint8_t *s,const uint8_t *a,const uint8_t *b,const uint8_t *c)
34
+ {
35
+ int64_t a0 = 2097151 & load_3(a);
36
+ int64_t a1 = 2097151 & (load_4(a + 2) >> 5);
37
+ int64_t a2 = 2097151 & (load_3(a + 5) >> 2);
38
+ int64_t a3 = 2097151 & (load_4(a + 7) >> 7);
39
+ int64_t a4 = 2097151 & (load_4(a + 10) >> 4);
40
+ int64_t a5 = 2097151 & (load_3(a + 13) >> 1);
41
+ int64_t a6 = 2097151 & (load_4(a + 15) >> 6);
42
+ int64_t a7 = 2097151 & (load_3(a + 18) >> 3);
43
+ int64_t a8 = 2097151 & load_3(a + 21);
44
+ int64_t a9 = 2097151 & (load_4(a + 23) >> 5);
45
+ int64_t a10 = 2097151 & (load_3(a + 26) >> 2);
46
+ int64_t a11 = (load_4(a + 28) >> 7);
47
+ int64_t b0 = 2097151 & load_3(b);
48
+ int64_t b1 = 2097151 & (load_4(b + 2) >> 5);
49
+ int64_t b2 = 2097151 & (load_3(b + 5) >> 2);
50
+ int64_t b3 = 2097151 & (load_4(b + 7) >> 7);
51
+ int64_t b4 = 2097151 & (load_4(b + 10) >> 4);
52
+ int64_t b5 = 2097151 & (load_3(b + 13) >> 1);
53
+ int64_t b6 = 2097151 & (load_4(b + 15) >> 6);
54
+ int64_t b7 = 2097151 & (load_3(b + 18) >> 3);
55
+ int64_t b8 = 2097151 & load_3(b + 21);
56
+ int64_t b9 = 2097151 & (load_4(b + 23) >> 5);
57
+ int64_t b10 = 2097151 & (load_3(b + 26) >> 2);
58
+ int64_t b11 = (load_4(b + 28) >> 7);
59
+ int64_t c0 = 2097151 & load_3(c);
60
+ int64_t c1 = 2097151 & (load_4(c + 2) >> 5);
61
+ int64_t c2 = 2097151 & (load_3(c + 5) >> 2);
62
+ int64_t c3 = 2097151 & (load_4(c + 7) >> 7);
63
+ int64_t c4 = 2097151 & (load_4(c + 10) >> 4);
64
+ int64_t c5 = 2097151 & (load_3(c + 13) >> 1);
65
+ int64_t c6 = 2097151 & (load_4(c + 15) >> 6);
66
+ int64_t c7 = 2097151 & (load_3(c + 18) >> 3);
67
+ int64_t c8 = 2097151 & load_3(c + 21);
68
+ int64_t c9 = 2097151 & (load_4(c + 23) >> 5);
69
+ int64_t c10 = 2097151 & (load_3(c + 26) >> 2);
70
+ int64_t c11 = (load_4(c + 28) >> 7);
71
+ int64_t s0;
72
+ int64_t s1;
73
+ int64_t s2;
74
+ int64_t s3;
75
+ int64_t s4;
76
+ int64_t s5;
77
+ int64_t s6;
78
+ int64_t s7;
79
+ int64_t s8;
80
+ int64_t s9;
81
+ int64_t s10;
82
+ int64_t s11;
83
+ int64_t s12;
84
+ int64_t s13;
85
+ int64_t s14;
86
+ int64_t s15;
87
+ int64_t s16;
88
+ int64_t s17;
89
+ int64_t s18;
90
+ int64_t s19;
91
+ int64_t s20;
92
+ int64_t s21;
93
+ int64_t s22;
94
+ int64_t s23;
95
+ int64_t carry0;
96
+ int64_t carry1;
97
+ int64_t carry2;
98
+ int64_t carry3;
99
+ int64_t carry4;
100
+ int64_t carry5;
101
+ int64_t carry6;
102
+ int64_t carry7;
103
+ int64_t carry8;
104
+ int64_t carry9;
105
+ int64_t carry10;
106
+ int64_t carry11;
107
+ int64_t carry12;
108
+ int64_t carry13;
109
+ int64_t carry14;
110
+ int64_t carry15;
111
+ int64_t carry16;
112
+ int64_t carry17;
113
+ int64_t carry18;
114
+ int64_t carry19;
115
+ int64_t carry20;
116
+ int64_t carry21;
117
+ int64_t carry22;
118
+
119
+ /* Merry Christmas! */
120
+ s0 = c0 + a0*b0;
121
+ s1 = c1 + a0*b1 + a1*b0;
122
+ s2 = c2 + a0*b2 + a1*b1 + a2*b0;
123
+ s3 = c3 + a0*b3 + a1*b2 + a2*b1 + a3*b0;
124
+ s4 = c4 + a0*b4 + a1*b3 + a2*b2 + a3*b1 + a4*b0;
125
+ s5 = c5 + a0*b5 + a1*b4 + a2*b3 + a3*b2 + a4*b1 + a5*b0;
126
+ s6 = c6 + a0*b6 + a1*b5 + a2*b4 + a3*b3 + a4*b2 + a5*b1 + a6*b0;
127
+ s7 = c7 + a0*b7 + a1*b6 + a2*b5 + a3*b4 + a4*b3 + a5*b2 + a6*b1 + a7*b0;
128
+ s8 = c8 + a0*b8 + a1*b7 + a2*b6 + a3*b5 + a4*b4 + a5*b3 + a6*b2 + a7*b1 + a8*b0;
129
+ s9 = c9 + a0*b9 + a1*b8 + a2*b7 + a3*b6 + a4*b5 + a5*b4 + a6*b3 + a7*b2 + a8*b1 + a9*b0;
130
+ s10 = c10 + a0*b10 + a1*b9 + a2*b8 + a3*b7 + a4*b6 + a5*b5 + a6*b4 + a7*b3 + a8*b2 + a9*b1 + a10*b0;
131
+ s11 = c11 + a0*b11 + a1*b10 + a2*b9 + a3*b8 + a4*b7 + a5*b6 + a6*b5 + a7*b4 + a8*b3 + a9*b2 + a10*b1 + a11*b0;
132
+ s12 = a1*b11 + a2*b10 + a3*b9 + a4*b8 + a5*b7 + a6*b6 + a7*b5 + a8*b4 + a9*b3 + a10*b2 + a11*b1;
133
+ s13 = a2*b11 + a3*b10 + a4*b9 + a5*b8 + a6*b7 + a7*b6 + a8*b5 + a9*b4 + a10*b3 + a11*b2;
134
+ s14 = a3*b11 + a4*b10 + a5*b9 + a6*b8 + a7*b7 + a8*b6 + a9*b5 + a10*b4 + a11*b3;
135
+ s15 = a4*b11 + a5*b10 + a6*b9 + a7*b8 + a8*b7 + a9*b6 + a10*b5 + a11*b4;
136
+ s16 = a5*b11 + a6*b10 + a7*b9 + a8*b8 + a9*b7 + a10*b6 + a11*b5;
137
+ s17 = a6*b11 + a7*b10 + a8*b9 + a9*b8 + a10*b7 + a11*b6;
138
+ s18 = a7*b11 + a8*b10 + a9*b9 + a10*b8 + a11*b7;
139
+ s19 = a8*b11 + a9*b10 + a10*b9 + a11*b8;
140
+ s20 = a9*b11 + a10*b10 + a11*b9;
141
+ s21 = a10*b11 + a11*b10;
142
+ s22 = a11*b11;
143
+ s23 = 0;
144
+
145
+ carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
146
+ carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
147
+ carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
148
+ carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
149
+ carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
150
+ carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
151
+ carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
152
+ carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
153
+ carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
154
+ carry18 = (s18 + (1<<20)) >> 21; s19 += carry18; s18 -= carry18 << 21;
155
+ carry20 = (s20 + (1<<20)) >> 21; s21 += carry20; s20 -= carry20 << 21;
156
+ carry22 = (s22 + (1<<20)) >> 21; s23 += carry22; s22 -= carry22 << 21;
157
+
158
+ carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
159
+ carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
160
+ carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
161
+ carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
162
+ carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
163
+ carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
164
+ carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
165
+ carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
166
+ carry17 = (s17 + (1<<20)) >> 21; s18 += carry17; s17 -= carry17 << 21;
167
+ carry19 = (s19 + (1<<20)) >> 21; s20 += carry19; s19 -= carry19 << 21;
168
+ carry21 = (s21 + (1<<20)) >> 21; s22 += carry21; s21 -= carry21 << 21;
169
+
170
+ s11 += s23 * 666643;
171
+ s12 += s23 * 470296;
172
+ s13 += s23 * 654183;
173
+ s14 -= s23 * 997805;
174
+ s15 += s23 * 136657;
175
+ s16 -= s23 * 683901;
176
+ s23 = 0;
177
+
178
+ s10 += s22 * 666643;
179
+ s11 += s22 * 470296;
180
+ s12 += s22 * 654183;
181
+ s13 -= s22 * 997805;
182
+ s14 += s22 * 136657;
183
+ s15 -= s22 * 683901;
184
+ s22 = 0;
185
+
186
+ s9 += s21 * 666643;
187
+ s10 += s21 * 470296;
188
+ s11 += s21 * 654183;
189
+ s12 -= s21 * 997805;
190
+ s13 += s21 * 136657;
191
+ s14 -= s21 * 683901;
192
+ s21 = 0;
193
+
194
+ s8 += s20 * 666643;
195
+ s9 += s20 * 470296;
196
+ s10 += s20 * 654183;
197
+ s11 -= s20 * 997805;
198
+ s12 += s20 * 136657;
199
+ s13 -= s20 * 683901;
200
+ s20 = 0;
201
+
202
+ s7 += s19 * 666643;
203
+ s8 += s19 * 470296;
204
+ s9 += s19 * 654183;
205
+ s10 -= s19 * 997805;
206
+ s11 += s19 * 136657;
207
+ s12 -= s19 * 683901;
208
+ s19 = 0;
209
+
210
+ s6 += s18 * 666643;
211
+ s7 += s18 * 470296;
212
+ s8 += s18 * 654183;
213
+ s9 -= s18 * 997805;
214
+ s10 += s18 * 136657;
215
+ s11 -= s18 * 683901;
216
+ s18 = 0;
217
+
218
+ carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
219
+ carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
220
+ carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
221
+ carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
222
+ carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
223
+ carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
224
+
225
+ carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
226
+ carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
227
+ carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
228
+ carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
229
+ carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
230
+
231
+ s5 += s17 * 666643;
232
+ s6 += s17 * 470296;
233
+ s7 += s17 * 654183;
234
+ s8 -= s17 * 997805;
235
+ s9 += s17 * 136657;
236
+ s10 -= s17 * 683901;
237
+ s17 = 0;
238
+
239
+ s4 += s16 * 666643;
240
+ s5 += s16 * 470296;
241
+ s6 += s16 * 654183;
242
+ s7 -= s16 * 997805;
243
+ s8 += s16 * 136657;
244
+ s9 -= s16 * 683901;
245
+ s16 = 0;
246
+
247
+ s3 += s15 * 666643;
248
+ s4 += s15 * 470296;
249
+ s5 += s15 * 654183;
250
+ s6 -= s15 * 997805;
251
+ s7 += s15 * 136657;
252
+ s8 -= s15 * 683901;
253
+ s15 = 0;
254
+
255
+ s2 += s14 * 666643;
256
+ s3 += s14 * 470296;
257
+ s4 += s14 * 654183;
258
+ s5 -= s14 * 997805;
259
+ s6 += s14 * 136657;
260
+ s7 -= s14 * 683901;
261
+ s14 = 0;
262
+
263
+ s1 += s13 * 666643;
264
+ s2 += s13 * 470296;
265
+ s3 += s13 * 654183;
266
+ s4 -= s13 * 997805;
267
+ s5 += s13 * 136657;
268
+ s6 -= s13 * 683901;
269
+ s13 = 0;
270
+
271
+ s0 += s12 * 666643;
272
+ s1 += s12 * 470296;
273
+ s2 += s12 * 654183;
274
+ s3 -= s12 * 997805;
275
+ s4 += s12 * 136657;
276
+ s5 -= s12 * 683901;
277
+ s12 = 0;
278
+
279
+ carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
280
+ carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
281
+ carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
282
+ carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
283
+ carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
284
+ carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
285
+
286
+ carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
287
+ carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
288
+ carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
289
+ carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
290
+ carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
291
+ carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
292
+
293
+ s0 += s12 * 666643;
294
+ s1 += s12 * 470296;
295
+ s2 += s12 * 654183;
296
+ s3 -= s12 * 997805;
297
+ s4 += s12 * 136657;
298
+ s5 -= s12 * 683901;
299
+ s12 = 0;
300
+
301
+ carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
302
+ carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
303
+ carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
304
+ carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
305
+ carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
306
+ carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
307
+ carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
308
+ carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
309
+ carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
310
+ carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
311
+ carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
312
+ carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 << 21;
313
+
314
+ s0 += s12 * 666643;
315
+ s1 += s12 * 470296;
316
+ s2 += s12 * 654183;
317
+ s3 -= s12 * 997805;
318
+ s4 += s12 * 136657;
319
+ s5 -= s12 * 683901;
320
+ s12 = 0;
321
+
322
+ carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
323
+ carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
324
+ carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
325
+ carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
326
+ carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
327
+ carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
328
+ carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
329
+ carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
330
+ carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
331
+ carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
332
+ carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
333
+
334
+ s[0] = s0 >> 0;
335
+ s[1] = s0 >> 8;
336
+ s[2] = (s0 >> 16) | (s1 << 5);
337
+ s[3] = s1 >> 3;
338
+ s[4] = s1 >> 11;
339
+ s[5] = (s1 >> 19) | (s2 << 2);
340
+ s[6] = s2 >> 6;
341
+ s[7] = (s2 >> 14) | (s3 << 7);
342
+ s[8] = s3 >> 1;
343
+ s[9] = s3 >> 9;
344
+ s[10] = (s3 >> 17) | (s4 << 4);
345
+ s[11] = s4 >> 4;
346
+ s[12] = s4 >> 12;
347
+ s[13] = (s4 >> 20) | (s5 << 1);
348
+ s[14] = s5 >> 7;
349
+ s[15] = (s5 >> 15) | (s6 << 6);
350
+ s[16] = s6 >> 2;
351
+ s[17] = s6 >> 10;
352
+ s[18] = (s6 >> 18) | (s7 << 3);
353
+ s[19] = s7 >> 5;
354
+ s[20] = s7 >> 13;
355
+ s[21] = s8 >> 0;
356
+ s[22] = s8 >> 8;
357
+ s[23] = (s8 >> 16) | (s9 << 5);
358
+ s[24] = s9 >> 3;
359
+ s[25] = s9 >> 11;
360
+ s[26] = (s9 >> 19) | (s10 << 2);
361
+ s[27] = s10 >> 6;
362
+ s[28] = (s10 >> 14) | (s11 << 7);
363
+ s[29] = s11 >> 1;
364
+ s[30] = s11 >> 9;
365
+ s[31] = s11 >> 17;
366
+ }