@amritk/nish-aarch64-linux 0.13.0 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/nish +0 -0
- package/package.json +1 -1
- package/runtime/nish.d.ts +156 -0
- package/runtime/nish.h +89 -0
- package/runtime/nish.mjs +58 -0
- package/runtime/runtime-host.c +178 -0
- package/runtime/runtime-net.c +528 -0
- package/runtime/runtime-os.c +15 -0
- package/runtime/shim.mjs +137 -0
- package/scripts/build.sh +9 -7
- package/std/README.md +80 -0
- package/std/crypto/LICENSE-bearssl +21 -0
- package/std/crypto/LICENSE-fiat-crypto +21 -0
- package/std/crypto/aes.ts +899 -0
- package/std/crypto/base64url.ts +145 -0
- package/std/crypto/chacha20poly1305.ts +698 -0
- package/std/crypto/ct.ts +64 -0
- package/std/crypto/hkdf.ts +118 -0
- package/std/crypto/hmac.ts +155 -0
- package/std/crypto/p256.ts +4337 -0
- package/std/crypto/sha256.ts +444 -0
- package/std/crypto/sha512.ts +510 -0
- package/std/crypto/x25519.ts +509 -0
- package/std/crypto/x509.ts +1214 -0
|
@@ -0,0 +1,4337 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `nish/crypto/p256` — ECDSA over NIST P-256 (secp256r1), with the
|
|
3
|
+
* deterministic nonces of RFC 6979.
|
|
4
|
+
*
|
|
5
|
+
* import { p256PublicKey, p256SignSha256, p256VerifySha256 } from "nish/crypto/p256";
|
|
6
|
+
*
|
|
7
|
+
* const pub: u8[] | null = p256PublicKey(priv); // 65 bytes, 0x04 || X || Y
|
|
8
|
+
* const sig: u8[] | null = p256SignSha256(priv, message); // 64 bytes, r || s
|
|
9
|
+
* const ok: boolean = p256VerifySha256(pub, message, sig);
|
|
10
|
+
*
|
|
11
|
+
* A private key is 32 big-endian bytes holding a scalar in [1, n); a public
|
|
12
|
+
* key is the uncompressed SEC1 encoding of SEC 1 §2.3.3; a signature is `r`
|
|
13
|
+
* and `s` as 32 big-endian bytes each. DER, which X.509 and TLS wrap a
|
|
14
|
+
* signature in, is not this module's business. Anything of the wrong length,
|
|
15
|
+
* a private key of 0 or n or more, a public key that is not on the curve, and
|
|
16
|
+
* an `r` or `s` of 0 or n or more answer `null` from the signing side and
|
|
17
|
+
* `false` from the verifying side, never a panic.
|
|
18
|
+
*
|
|
19
|
+
* Ported from fiat-crypto (https://github.com/mit-plv/fiat-crypto), fiat-c/src/p256_32.c and fiat-c/src/p256_scalar_32.c. Copyright (c) 2015-2020 the fiat-crypto authors (see the AUTHORS file). Used under the MIT licence; see std/crypto/LICENSE-fiat-crypto.
|
|
20
|
+
*
|
|
21
|
+
* **What is ported and what is not.** The `p256Fiat*` functions are
|
|
22
|
+
* fiat-crypto's generated, formally verified Montgomery arithmetic on eight
|
|
23
|
+
* `u32` limbs with `u64` products — `mul`, `square`, `add`, `sub`,
|
|
24
|
+
* `selectznz`, `nonzero` and `set_one` mod p, and `mul`, `add` and `set_one`
|
|
25
|
+
* mod n — statement for statement, with fiat's variable names. Three things
|
|
26
|
+
* change in the translation and nothing else does. C's out-pointers become a
|
|
27
|
+
* `u64` answer: each of fiat's `addcarryx`, `subborrowx` and `mulx` helpers
|
|
28
|
+
* here answers its two outputs packed, the first in the low 32 bits and the
|
|
29
|
+
* second above them, and the caller splits them, declaring only the halves
|
|
30
|
+
* fiat goes on to read. And each function opens with
|
|
31
|
+
* a length guard, so that the literal indices after it compile with no bounds
|
|
32
|
+
* check. And `square` reads its input's eight limbs into locals first, which
|
|
33
|
+
* changes no arithmetic; it kept the input's pointer from being spilled in a
|
|
34
|
+
* way the aarch64 disassembly check once misread (#334). The
|
|
35
|
+
* scalar functions use the field's four helpers, which fiat generates
|
|
36
|
+
* identically for both. Everything else in this file — the curve, the encodings, the
|
|
37
|
+
* inversions and ECDSA — is written for this module from the documents it
|
|
38
|
+
* names.
|
|
39
|
+
*
|
|
40
|
+
* **The curve** is `y^2 = x^3 - 3x + b` over GF(p), p = 2^256 - 2^224 + 2^192
|
|
41
|
+
* + 2^96 - 1, with the base point G and its order n from SEC 2 §2.4.2 (FIPS
|
|
42
|
+
* 186-4 §D.1.2.3). Points are projective (X : Y : Z), Z = 0 the identity, and
|
|
43
|
+
* are added and doubled with the complete formulas of J. Renes, C. Costello and
|
|
44
|
+
* L. Batina, "Complete addition formulas for prime order elliptic curves"
|
|
45
|
+
* (EUROCRYPT 2016), Algorithms 4 and 6 for a = -3. Complete means no input is
|
|
46
|
+
* exceptional: P + P, P + (-P) and P + O all come out of the same straight line
|
|
47
|
+
* of field operations, so there is no case to branch on.
|
|
48
|
+
*
|
|
49
|
+
* **Constant time where a secret is involved.** A private key and a nonce are
|
|
50
|
+
* only ever multiplied by `p256ScalarMult`, a fixed 4-bit window: sixteen
|
|
51
|
+
* multiples of the point in a table, then 64 windows of four doublings, a
|
|
52
|
+
* table read and an addition, whatever the scalar. The read loads all sixteen
|
|
53
|
+
* entries and keeps one with fiat's conditional move, steered by `ctEq` on the
|
|
54
|
+
* window's digit, so neither a branch nor an address depends on the scalar.
|
|
55
|
+
* The inversions raise to the public exponents p - 2 and n - 2, so their
|
|
56
|
+
* branches follow a constant. The branches that remain are on public facts: a
|
|
57
|
+
* length, a limb or bit position, whether a received key or signature is in
|
|
58
|
+
* range, and — once in about 2^32 signatures — RFC 6979's retry when a
|
|
59
|
+
* candidate nonce is not below n.
|
|
60
|
+
*
|
|
61
|
+
* **What is verified by disassembly and what is discipline.**
|
|
62
|
+
* `tests/cases/ct_asm_p256` holds copies of fiat's field multiply, square, add
|
|
63
|
+
* and subtract, its scalar multiply and its conditional move, the table read
|
|
64
|
+
* by a secret digit, the complete doubling and addition, and one window step
|
|
65
|
+
* of `p256ScalarMult` to the check of `tests/ct-asm.js`, which refuses any
|
|
66
|
+
* branch, call it cannot follow or secret-indexed access in them on x86-64 and
|
|
67
|
+
* aarch64, following each call into the field functions. The copies of the
|
|
68
|
+
* point functions take coordinate arrays rather than points, and the table
|
|
69
|
+
* read's loop is written out there, as that fixture's header says; its `main`
|
|
70
|
+
* runs RFC 6979 A.2.5 through them. The 64-window loop, the table build, the
|
|
71
|
+
* inversions, the encodings and the nonce derivation are constant time by
|
|
72
|
+
* construction rather than by that proof.
|
|
73
|
+
*
|
|
74
|
+
* Verification multiplies only public values, and uses the same routine.
|
|
75
|
+
*
|
|
76
|
+
* Private names carry the `p256` prefix because a `std/` module's private
|
|
77
|
+
* functions share the importing program's flat symbol namespace
|
|
78
|
+
* (`docs/wp26-stdlib.md` §3e).
|
|
79
|
+
*/
|
|
80
|
+
import { HmacSha256, hmacSha256 } from "nish/crypto/hmac"
|
|
81
|
+
import { sha256 } from "nish/crypto/sha256"
|
|
82
|
+
import { timingSafeEqual } from "nish/crypto/ct"
|
|
83
|
+
|
|
84
|
+
/** The length in bytes of a private key: one scalar, big-endian. */
|
|
85
|
+
export const P256_SCALAR_SIZE: i32 = 32
|
|
86
|
+
|
|
87
|
+
/** The length in bytes of a public key: 0x04, then X and Y big-endian (SEC 1 §2.3.3). */
|
|
88
|
+
export const P256_POINT_SIZE: i32 = 65
|
|
89
|
+
|
|
90
|
+
/** The length in bytes of a signature: `r` then `s`, 32 big-endian bytes each. */
|
|
91
|
+
export const P256_SIGNATURE_SIZE: i32 = 64
|
|
92
|
+
|
|
93
|
+
/** A typed zero for the offsets below: a bare literal is an `f64` under `--number-mode f64`. */
|
|
94
|
+
const P256_FROM: i32 = 0
|
|
95
|
+
|
|
96
|
+
/**
|
|
97
|
+
* fiat's `addcarryx_u32`: `arg1 + arg2 + arg3` with `arg1` a carry of 0 or 1.
|
|
98
|
+
* The sum is below 2^33, so its low 32 bits are fiat's `out1` and bit 32 its
|
|
99
|
+
* `out2`.
|
|
100
|
+
*/
|
|
101
|
+
const p256FiatAddcarryxU32 = (arg1: u32, arg2: u32, arg3: u32): u64 => toU64(arg1) + toU64(arg2) + toU64(arg3)
|
|
102
|
+
|
|
103
|
+
/**
|
|
104
|
+
* fiat's `subborrowx_u32`: `arg2 - arg1 - arg3` with `arg1` a borrow of 0 or 1.
|
|
105
|
+
* The difference wraps modulo 2^64, so a negative one has every bit from 32 up
|
|
106
|
+
* set; bit 32 alone is kept, which puts fiat's `out2` (1 on a borrow) where
|
|
107
|
+
* `p256FiatAddcarryxU32` puts its carry.
|
|
108
|
+
*/
|
|
109
|
+
const p256FiatSubborrowxU32 = (arg1: u32, arg2: u32, arg3: u32): u64 =>
|
|
110
|
+
(toU64(arg2) - toU64(arg1) - toU64(arg3)) & 0x1ffffffff
|
|
111
|
+
|
|
112
|
+
/** fiat's `mulx_u32`: the full 64-bit product, `out1` the low half and `out2` the high. */
|
|
113
|
+
const p256FiatMulxU32 = (arg1: u32, arg2: u32): u64 => toU64(arg1) * toU64(arg2)
|
|
114
|
+
|
|
115
|
+
/**
|
|
116
|
+
* fiat's `cmovznz_u32`: `arg2` when `arg1` is zero and `arg3` otherwise. fiat
|
|
117
|
+
* builds the mask from `!!arg1` behind a value barrier; `ctEq` builds it behind
|
|
118
|
+
* the same kind of barrier, and `ctSelect` blends with it.
|
|
119
|
+
*/
|
|
120
|
+
const p256FiatCmovznzU32 = (arg1: u32, arg2: u32, arg3: u32): u32 => ctSelect(ctEq(arg1, 0), arg2, arg3)
|
|
121
|
+
|
|
122
|
+
/** fiat's `fiat_p256_mul`: multiplies two field elements in the Montgomery domain. */
|
|
123
|
+
const p256FiatMul = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
|
|
124
|
+
if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
|
|
125
|
+
return
|
|
126
|
+
}
|
|
127
|
+
const x1: u32 = arg1[1]
|
|
128
|
+
const x2: u32 = arg1[2]
|
|
129
|
+
const x3: u32 = arg1[3]
|
|
130
|
+
const x4: u32 = arg1[4]
|
|
131
|
+
const x5: u32 = arg1[5]
|
|
132
|
+
const x6: u32 = arg1[6]
|
|
133
|
+
const x7: u32 = arg1[7]
|
|
134
|
+
const x8: u32 = arg1[0]
|
|
135
|
+
const w9: u64 = p256FiatMulxU32(x8, arg2[7])
|
|
136
|
+
const x9: u32 = toU32(w9)
|
|
137
|
+
const x10: u32 = toU32(w9 >> 32)
|
|
138
|
+
const w11: u64 = p256FiatMulxU32(x8, arg2[6])
|
|
139
|
+
const x11: u32 = toU32(w11)
|
|
140
|
+
const x12: u32 = toU32(w11 >> 32)
|
|
141
|
+
const w13: u64 = p256FiatMulxU32(x8, arg2[5])
|
|
142
|
+
const x13: u32 = toU32(w13)
|
|
143
|
+
const x14: u32 = toU32(w13 >> 32)
|
|
144
|
+
const w15: u64 = p256FiatMulxU32(x8, arg2[4])
|
|
145
|
+
const x15: u32 = toU32(w15)
|
|
146
|
+
const x16: u32 = toU32(w15 >> 32)
|
|
147
|
+
const w17: u64 = p256FiatMulxU32(x8, arg2[3])
|
|
148
|
+
const x17: u32 = toU32(w17)
|
|
149
|
+
const x18: u32 = toU32(w17 >> 32)
|
|
150
|
+
const w19: u64 = p256FiatMulxU32(x8, arg2[2])
|
|
151
|
+
const x19: u32 = toU32(w19)
|
|
152
|
+
const x20: u32 = toU32(w19 >> 32)
|
|
153
|
+
const w21: u64 = p256FiatMulxU32(x8, arg2[1])
|
|
154
|
+
const x21: u32 = toU32(w21)
|
|
155
|
+
const x22: u32 = toU32(w21 >> 32)
|
|
156
|
+
const w23: u64 = p256FiatMulxU32(x8, arg2[0])
|
|
157
|
+
const x23: u32 = toU32(w23)
|
|
158
|
+
const x24: u32 = toU32(w23 >> 32)
|
|
159
|
+
const w25: u64 = p256FiatAddcarryxU32(0x0, x24, x21)
|
|
160
|
+
const x25: u32 = toU32(w25)
|
|
161
|
+
const x26: u32 = toU32(w25 >> 32)
|
|
162
|
+
const w27: u64 = p256FiatAddcarryxU32(x26, x22, x19)
|
|
163
|
+
const x27: u32 = toU32(w27)
|
|
164
|
+
const x28: u32 = toU32(w27 >> 32)
|
|
165
|
+
const w29: u64 = p256FiatAddcarryxU32(x28, x20, x17)
|
|
166
|
+
const x29: u32 = toU32(w29)
|
|
167
|
+
const x30: u32 = toU32(w29 >> 32)
|
|
168
|
+
const w31: u64 = p256FiatAddcarryxU32(x30, x18, x15)
|
|
169
|
+
const x31: u32 = toU32(w31)
|
|
170
|
+
const x32: u32 = toU32(w31 >> 32)
|
|
171
|
+
const w33: u64 = p256FiatAddcarryxU32(x32, x16, x13)
|
|
172
|
+
const x33: u32 = toU32(w33)
|
|
173
|
+
const x34: u32 = toU32(w33 >> 32)
|
|
174
|
+
const w35: u64 = p256FiatAddcarryxU32(x34, x14, x11)
|
|
175
|
+
const x35: u32 = toU32(w35)
|
|
176
|
+
const x36: u32 = toU32(w35 >> 32)
|
|
177
|
+
const w37: u64 = p256FiatAddcarryxU32(x36, x12, x9)
|
|
178
|
+
const x37: u32 = toU32(w37)
|
|
179
|
+
const x38: u32 = toU32(w37 >> 32)
|
|
180
|
+
const x39: u32 = x38 + x10
|
|
181
|
+
const w40: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
182
|
+
const x40: u32 = toU32(w40)
|
|
183
|
+
const x41: u32 = toU32(w40 >> 32)
|
|
184
|
+
const w42: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
185
|
+
const x42: u32 = toU32(w42)
|
|
186
|
+
const x43: u32 = toU32(w42 >> 32)
|
|
187
|
+
const w44: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
188
|
+
const x44: u32 = toU32(w44)
|
|
189
|
+
const x45: u32 = toU32(w44 >> 32)
|
|
190
|
+
const w46: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
191
|
+
const x46: u32 = toU32(w46)
|
|
192
|
+
const x47: u32 = toU32(w46 >> 32)
|
|
193
|
+
const w48: u64 = p256FiatAddcarryxU32(0x0, x47, x44)
|
|
194
|
+
const x48: u32 = toU32(w48)
|
|
195
|
+
const x49: u32 = toU32(w48 >> 32)
|
|
196
|
+
const w50: u64 = p256FiatAddcarryxU32(x49, x45, x42)
|
|
197
|
+
const x50: u32 = toU32(w50)
|
|
198
|
+
const x51: u32 = toU32(w50 >> 32)
|
|
199
|
+
const x52: u32 = x51 + x43
|
|
200
|
+
const w53: u64 = p256FiatAddcarryxU32(0x0, x23, x46)
|
|
201
|
+
const x54: u32 = toU32(w53 >> 32)
|
|
202
|
+
const w55: u64 = p256FiatAddcarryxU32(x54, x25, x48)
|
|
203
|
+
const x55: u32 = toU32(w55)
|
|
204
|
+
const x56: u32 = toU32(w55 >> 32)
|
|
205
|
+
const w57: u64 = p256FiatAddcarryxU32(x56, x27, x50)
|
|
206
|
+
const x57: u32 = toU32(w57)
|
|
207
|
+
const x58: u32 = toU32(w57 >> 32)
|
|
208
|
+
const w59: u64 = p256FiatAddcarryxU32(x58, x29, x52)
|
|
209
|
+
const x59: u32 = toU32(w59)
|
|
210
|
+
const x60: u32 = toU32(w59 >> 32)
|
|
211
|
+
const w61: u64 = p256FiatAddcarryxU32(x60, x31, 0x0)
|
|
212
|
+
const x61: u32 = toU32(w61)
|
|
213
|
+
const x62: u32 = toU32(w61 >> 32)
|
|
214
|
+
const w63: u64 = p256FiatAddcarryxU32(x62, x33, 0x0)
|
|
215
|
+
const x63: u32 = toU32(w63)
|
|
216
|
+
const x64: u32 = toU32(w63 >> 32)
|
|
217
|
+
const w65: u64 = p256FiatAddcarryxU32(x64, x35, x23)
|
|
218
|
+
const x65: u32 = toU32(w65)
|
|
219
|
+
const x66: u32 = toU32(w65 >> 32)
|
|
220
|
+
const w67: u64 = p256FiatAddcarryxU32(x66, x37, x40)
|
|
221
|
+
const x67: u32 = toU32(w67)
|
|
222
|
+
const x68: u32 = toU32(w67 >> 32)
|
|
223
|
+
const w69: u64 = p256FiatAddcarryxU32(x68, x39, x41)
|
|
224
|
+
const x69: u32 = toU32(w69)
|
|
225
|
+
const x70: u32 = toU32(w69 >> 32)
|
|
226
|
+
const w71: u64 = p256FiatMulxU32(x1, arg2[7])
|
|
227
|
+
const x71: u32 = toU32(w71)
|
|
228
|
+
const x72: u32 = toU32(w71 >> 32)
|
|
229
|
+
const w73: u64 = p256FiatMulxU32(x1, arg2[6])
|
|
230
|
+
const x73: u32 = toU32(w73)
|
|
231
|
+
const x74: u32 = toU32(w73 >> 32)
|
|
232
|
+
const w75: u64 = p256FiatMulxU32(x1, arg2[5])
|
|
233
|
+
const x75: u32 = toU32(w75)
|
|
234
|
+
const x76: u32 = toU32(w75 >> 32)
|
|
235
|
+
const w77: u64 = p256FiatMulxU32(x1, arg2[4])
|
|
236
|
+
const x77: u32 = toU32(w77)
|
|
237
|
+
const x78: u32 = toU32(w77 >> 32)
|
|
238
|
+
const w79: u64 = p256FiatMulxU32(x1, arg2[3])
|
|
239
|
+
const x79: u32 = toU32(w79)
|
|
240
|
+
const x80: u32 = toU32(w79 >> 32)
|
|
241
|
+
const w81: u64 = p256FiatMulxU32(x1, arg2[2])
|
|
242
|
+
const x81: u32 = toU32(w81)
|
|
243
|
+
const x82: u32 = toU32(w81 >> 32)
|
|
244
|
+
const w83: u64 = p256FiatMulxU32(x1, arg2[1])
|
|
245
|
+
const x83: u32 = toU32(w83)
|
|
246
|
+
const x84: u32 = toU32(w83 >> 32)
|
|
247
|
+
const w85: u64 = p256FiatMulxU32(x1, arg2[0])
|
|
248
|
+
const x85: u32 = toU32(w85)
|
|
249
|
+
const x86: u32 = toU32(w85 >> 32)
|
|
250
|
+
const w87: u64 = p256FiatAddcarryxU32(0x0, x86, x83)
|
|
251
|
+
const x87: u32 = toU32(w87)
|
|
252
|
+
const x88: u32 = toU32(w87 >> 32)
|
|
253
|
+
const w89: u64 = p256FiatAddcarryxU32(x88, x84, x81)
|
|
254
|
+
const x89: u32 = toU32(w89)
|
|
255
|
+
const x90: u32 = toU32(w89 >> 32)
|
|
256
|
+
const w91: u64 = p256FiatAddcarryxU32(x90, x82, x79)
|
|
257
|
+
const x91: u32 = toU32(w91)
|
|
258
|
+
const x92: u32 = toU32(w91 >> 32)
|
|
259
|
+
const w93: u64 = p256FiatAddcarryxU32(x92, x80, x77)
|
|
260
|
+
const x93: u32 = toU32(w93)
|
|
261
|
+
const x94: u32 = toU32(w93 >> 32)
|
|
262
|
+
const w95: u64 = p256FiatAddcarryxU32(x94, x78, x75)
|
|
263
|
+
const x95: u32 = toU32(w95)
|
|
264
|
+
const x96: u32 = toU32(w95 >> 32)
|
|
265
|
+
const w97: u64 = p256FiatAddcarryxU32(x96, x76, x73)
|
|
266
|
+
const x97: u32 = toU32(w97)
|
|
267
|
+
const x98: u32 = toU32(w97 >> 32)
|
|
268
|
+
const w99: u64 = p256FiatAddcarryxU32(x98, x74, x71)
|
|
269
|
+
const x99: u32 = toU32(w99)
|
|
270
|
+
const x100: u32 = toU32(w99 >> 32)
|
|
271
|
+
const x101: u32 = x100 + x72
|
|
272
|
+
const w102: u64 = p256FiatAddcarryxU32(0x0, x55, x85)
|
|
273
|
+
const x102: u32 = toU32(w102)
|
|
274
|
+
const x103: u32 = toU32(w102 >> 32)
|
|
275
|
+
const w104: u64 = p256FiatAddcarryxU32(x103, x57, x87)
|
|
276
|
+
const x104: u32 = toU32(w104)
|
|
277
|
+
const x105: u32 = toU32(w104 >> 32)
|
|
278
|
+
const w106: u64 = p256FiatAddcarryxU32(x105, x59, x89)
|
|
279
|
+
const x106: u32 = toU32(w106)
|
|
280
|
+
const x107: u32 = toU32(w106 >> 32)
|
|
281
|
+
const w108: u64 = p256FiatAddcarryxU32(x107, x61, x91)
|
|
282
|
+
const x108: u32 = toU32(w108)
|
|
283
|
+
const x109: u32 = toU32(w108 >> 32)
|
|
284
|
+
const w110: u64 = p256FiatAddcarryxU32(x109, x63, x93)
|
|
285
|
+
const x110: u32 = toU32(w110)
|
|
286
|
+
const x111: u32 = toU32(w110 >> 32)
|
|
287
|
+
const w112: u64 = p256FiatAddcarryxU32(x111, x65, x95)
|
|
288
|
+
const x112: u32 = toU32(w112)
|
|
289
|
+
const x113: u32 = toU32(w112 >> 32)
|
|
290
|
+
const w114: u64 = p256FiatAddcarryxU32(x113, x67, x97)
|
|
291
|
+
const x114: u32 = toU32(w114)
|
|
292
|
+
const x115: u32 = toU32(w114 >> 32)
|
|
293
|
+
const w116: u64 = p256FiatAddcarryxU32(x115, x69, x99)
|
|
294
|
+
const x116: u32 = toU32(w116)
|
|
295
|
+
const x117: u32 = toU32(w116 >> 32)
|
|
296
|
+
const w118: u64 = p256FiatAddcarryxU32(x117, x70, x101)
|
|
297
|
+
const x118: u32 = toU32(w118)
|
|
298
|
+
const x119: u32 = toU32(w118 >> 32)
|
|
299
|
+
const w120: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
300
|
+
const x120: u32 = toU32(w120)
|
|
301
|
+
const x121: u32 = toU32(w120 >> 32)
|
|
302
|
+
const w122: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
303
|
+
const x122: u32 = toU32(w122)
|
|
304
|
+
const x123: u32 = toU32(w122 >> 32)
|
|
305
|
+
const w124: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
306
|
+
const x124: u32 = toU32(w124)
|
|
307
|
+
const x125: u32 = toU32(w124 >> 32)
|
|
308
|
+
const w126: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
309
|
+
const x126: u32 = toU32(w126)
|
|
310
|
+
const x127: u32 = toU32(w126 >> 32)
|
|
311
|
+
const w128: u64 = p256FiatAddcarryxU32(0x0, x127, x124)
|
|
312
|
+
const x128: u32 = toU32(w128)
|
|
313
|
+
const x129: u32 = toU32(w128 >> 32)
|
|
314
|
+
const w130: u64 = p256FiatAddcarryxU32(x129, x125, x122)
|
|
315
|
+
const x130: u32 = toU32(w130)
|
|
316
|
+
const x131: u32 = toU32(w130 >> 32)
|
|
317
|
+
const x132: u32 = x131 + x123
|
|
318
|
+
const w133: u64 = p256FiatAddcarryxU32(0x0, x102, x126)
|
|
319
|
+
const x134: u32 = toU32(w133 >> 32)
|
|
320
|
+
const w135: u64 = p256FiatAddcarryxU32(x134, x104, x128)
|
|
321
|
+
const x135: u32 = toU32(w135)
|
|
322
|
+
const x136: u32 = toU32(w135 >> 32)
|
|
323
|
+
const w137: u64 = p256FiatAddcarryxU32(x136, x106, x130)
|
|
324
|
+
const x137: u32 = toU32(w137)
|
|
325
|
+
const x138: u32 = toU32(w137 >> 32)
|
|
326
|
+
const w139: u64 = p256FiatAddcarryxU32(x138, x108, x132)
|
|
327
|
+
const x139: u32 = toU32(w139)
|
|
328
|
+
const x140: u32 = toU32(w139 >> 32)
|
|
329
|
+
const w141: u64 = p256FiatAddcarryxU32(x140, x110, 0x0)
|
|
330
|
+
const x141: u32 = toU32(w141)
|
|
331
|
+
const x142: u32 = toU32(w141 >> 32)
|
|
332
|
+
const w143: u64 = p256FiatAddcarryxU32(x142, x112, 0x0)
|
|
333
|
+
const x143: u32 = toU32(w143)
|
|
334
|
+
const x144: u32 = toU32(w143 >> 32)
|
|
335
|
+
const w145: u64 = p256FiatAddcarryxU32(x144, x114, x102)
|
|
336
|
+
const x145: u32 = toU32(w145)
|
|
337
|
+
const x146: u32 = toU32(w145 >> 32)
|
|
338
|
+
const w147: u64 = p256FiatAddcarryxU32(x146, x116, x120)
|
|
339
|
+
const x147: u32 = toU32(w147)
|
|
340
|
+
const x148: u32 = toU32(w147 >> 32)
|
|
341
|
+
const w149: u64 = p256FiatAddcarryxU32(x148, x118, x121)
|
|
342
|
+
const x149: u32 = toU32(w149)
|
|
343
|
+
const x150: u32 = toU32(w149 >> 32)
|
|
344
|
+
const x151: u32 = x150 + x119
|
|
345
|
+
const w152: u64 = p256FiatMulxU32(x2, arg2[7])
|
|
346
|
+
const x152: u32 = toU32(w152)
|
|
347
|
+
const x153: u32 = toU32(w152 >> 32)
|
|
348
|
+
const w154: u64 = p256FiatMulxU32(x2, arg2[6])
|
|
349
|
+
const x154: u32 = toU32(w154)
|
|
350
|
+
const x155: u32 = toU32(w154 >> 32)
|
|
351
|
+
const w156: u64 = p256FiatMulxU32(x2, arg2[5])
|
|
352
|
+
const x156: u32 = toU32(w156)
|
|
353
|
+
const x157: u32 = toU32(w156 >> 32)
|
|
354
|
+
const w158: u64 = p256FiatMulxU32(x2, arg2[4])
|
|
355
|
+
const x158: u32 = toU32(w158)
|
|
356
|
+
const x159: u32 = toU32(w158 >> 32)
|
|
357
|
+
const w160: u64 = p256FiatMulxU32(x2, arg2[3])
|
|
358
|
+
const x160: u32 = toU32(w160)
|
|
359
|
+
const x161: u32 = toU32(w160 >> 32)
|
|
360
|
+
const w162: u64 = p256FiatMulxU32(x2, arg2[2])
|
|
361
|
+
const x162: u32 = toU32(w162)
|
|
362
|
+
const x163: u32 = toU32(w162 >> 32)
|
|
363
|
+
const w164: u64 = p256FiatMulxU32(x2, arg2[1])
|
|
364
|
+
const x164: u32 = toU32(w164)
|
|
365
|
+
const x165: u32 = toU32(w164 >> 32)
|
|
366
|
+
const w166: u64 = p256FiatMulxU32(x2, arg2[0])
|
|
367
|
+
const x166: u32 = toU32(w166)
|
|
368
|
+
const x167: u32 = toU32(w166 >> 32)
|
|
369
|
+
const w168: u64 = p256FiatAddcarryxU32(0x0, x167, x164)
|
|
370
|
+
const x168: u32 = toU32(w168)
|
|
371
|
+
const x169: u32 = toU32(w168 >> 32)
|
|
372
|
+
const w170: u64 = p256FiatAddcarryxU32(x169, x165, x162)
|
|
373
|
+
const x170: u32 = toU32(w170)
|
|
374
|
+
const x171: u32 = toU32(w170 >> 32)
|
|
375
|
+
const w172: u64 = p256FiatAddcarryxU32(x171, x163, x160)
|
|
376
|
+
const x172: u32 = toU32(w172)
|
|
377
|
+
const x173: u32 = toU32(w172 >> 32)
|
|
378
|
+
const w174: u64 = p256FiatAddcarryxU32(x173, x161, x158)
|
|
379
|
+
const x174: u32 = toU32(w174)
|
|
380
|
+
const x175: u32 = toU32(w174 >> 32)
|
|
381
|
+
const w176: u64 = p256FiatAddcarryxU32(x175, x159, x156)
|
|
382
|
+
const x176: u32 = toU32(w176)
|
|
383
|
+
const x177: u32 = toU32(w176 >> 32)
|
|
384
|
+
const w178: u64 = p256FiatAddcarryxU32(x177, x157, x154)
|
|
385
|
+
const x178: u32 = toU32(w178)
|
|
386
|
+
const x179: u32 = toU32(w178 >> 32)
|
|
387
|
+
const w180: u64 = p256FiatAddcarryxU32(x179, x155, x152)
|
|
388
|
+
const x180: u32 = toU32(w180)
|
|
389
|
+
const x181: u32 = toU32(w180 >> 32)
|
|
390
|
+
const x182: u32 = x181 + x153
|
|
391
|
+
const w183: u64 = p256FiatAddcarryxU32(0x0, x135, x166)
|
|
392
|
+
const x183: u32 = toU32(w183)
|
|
393
|
+
const x184: u32 = toU32(w183 >> 32)
|
|
394
|
+
const w185: u64 = p256FiatAddcarryxU32(x184, x137, x168)
|
|
395
|
+
const x185: u32 = toU32(w185)
|
|
396
|
+
const x186: u32 = toU32(w185 >> 32)
|
|
397
|
+
const w187: u64 = p256FiatAddcarryxU32(x186, x139, x170)
|
|
398
|
+
const x187: u32 = toU32(w187)
|
|
399
|
+
const x188: u32 = toU32(w187 >> 32)
|
|
400
|
+
const w189: u64 = p256FiatAddcarryxU32(x188, x141, x172)
|
|
401
|
+
const x189: u32 = toU32(w189)
|
|
402
|
+
const x190: u32 = toU32(w189 >> 32)
|
|
403
|
+
const w191: u64 = p256FiatAddcarryxU32(x190, x143, x174)
|
|
404
|
+
const x191: u32 = toU32(w191)
|
|
405
|
+
const x192: u32 = toU32(w191 >> 32)
|
|
406
|
+
const w193: u64 = p256FiatAddcarryxU32(x192, x145, x176)
|
|
407
|
+
const x193: u32 = toU32(w193)
|
|
408
|
+
const x194: u32 = toU32(w193 >> 32)
|
|
409
|
+
const w195: u64 = p256FiatAddcarryxU32(x194, x147, x178)
|
|
410
|
+
const x195: u32 = toU32(w195)
|
|
411
|
+
const x196: u32 = toU32(w195 >> 32)
|
|
412
|
+
const w197: u64 = p256FiatAddcarryxU32(x196, x149, x180)
|
|
413
|
+
const x197: u32 = toU32(w197)
|
|
414
|
+
const x198: u32 = toU32(w197 >> 32)
|
|
415
|
+
const w199: u64 = p256FiatAddcarryxU32(x198, x151, x182)
|
|
416
|
+
const x199: u32 = toU32(w199)
|
|
417
|
+
const x200: u32 = toU32(w199 >> 32)
|
|
418
|
+
const w201: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
419
|
+
const x201: u32 = toU32(w201)
|
|
420
|
+
const x202: u32 = toU32(w201 >> 32)
|
|
421
|
+
const w203: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
422
|
+
const x203: u32 = toU32(w203)
|
|
423
|
+
const x204: u32 = toU32(w203 >> 32)
|
|
424
|
+
const w205: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
425
|
+
const x205: u32 = toU32(w205)
|
|
426
|
+
const x206: u32 = toU32(w205 >> 32)
|
|
427
|
+
const w207: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
428
|
+
const x207: u32 = toU32(w207)
|
|
429
|
+
const x208: u32 = toU32(w207 >> 32)
|
|
430
|
+
const w209: u64 = p256FiatAddcarryxU32(0x0, x208, x205)
|
|
431
|
+
const x209: u32 = toU32(w209)
|
|
432
|
+
const x210: u32 = toU32(w209 >> 32)
|
|
433
|
+
const w211: u64 = p256FiatAddcarryxU32(x210, x206, x203)
|
|
434
|
+
const x211: u32 = toU32(w211)
|
|
435
|
+
const x212: u32 = toU32(w211 >> 32)
|
|
436
|
+
const x213: u32 = x212 + x204
|
|
437
|
+
const w214: u64 = p256FiatAddcarryxU32(0x0, x183, x207)
|
|
438
|
+
const x215: u32 = toU32(w214 >> 32)
|
|
439
|
+
const w216: u64 = p256FiatAddcarryxU32(x215, x185, x209)
|
|
440
|
+
const x216: u32 = toU32(w216)
|
|
441
|
+
const x217: u32 = toU32(w216 >> 32)
|
|
442
|
+
const w218: u64 = p256FiatAddcarryxU32(x217, x187, x211)
|
|
443
|
+
const x218: u32 = toU32(w218)
|
|
444
|
+
const x219: u32 = toU32(w218 >> 32)
|
|
445
|
+
const w220: u64 = p256FiatAddcarryxU32(x219, x189, x213)
|
|
446
|
+
const x220: u32 = toU32(w220)
|
|
447
|
+
const x221: u32 = toU32(w220 >> 32)
|
|
448
|
+
const w222: u64 = p256FiatAddcarryxU32(x221, x191, 0x0)
|
|
449
|
+
const x222: u32 = toU32(w222)
|
|
450
|
+
const x223: u32 = toU32(w222 >> 32)
|
|
451
|
+
const w224: u64 = p256FiatAddcarryxU32(x223, x193, 0x0)
|
|
452
|
+
const x224: u32 = toU32(w224)
|
|
453
|
+
const x225: u32 = toU32(w224 >> 32)
|
|
454
|
+
const w226: u64 = p256FiatAddcarryxU32(x225, x195, x183)
|
|
455
|
+
const x226: u32 = toU32(w226)
|
|
456
|
+
const x227: u32 = toU32(w226 >> 32)
|
|
457
|
+
const w228: u64 = p256FiatAddcarryxU32(x227, x197, x201)
|
|
458
|
+
const x228: u32 = toU32(w228)
|
|
459
|
+
const x229: u32 = toU32(w228 >> 32)
|
|
460
|
+
const w230: u64 = p256FiatAddcarryxU32(x229, x199, x202)
|
|
461
|
+
const x230: u32 = toU32(w230)
|
|
462
|
+
const x231: u32 = toU32(w230 >> 32)
|
|
463
|
+
const x232: u32 = x231 + x200
|
|
464
|
+
const w233: u64 = p256FiatMulxU32(x3, arg2[7])
|
|
465
|
+
const x233: u32 = toU32(w233)
|
|
466
|
+
const x234: u32 = toU32(w233 >> 32)
|
|
467
|
+
const w235: u64 = p256FiatMulxU32(x3, arg2[6])
|
|
468
|
+
const x235: u32 = toU32(w235)
|
|
469
|
+
const x236: u32 = toU32(w235 >> 32)
|
|
470
|
+
const w237: u64 = p256FiatMulxU32(x3, arg2[5])
|
|
471
|
+
const x237: u32 = toU32(w237)
|
|
472
|
+
const x238: u32 = toU32(w237 >> 32)
|
|
473
|
+
const w239: u64 = p256FiatMulxU32(x3, arg2[4])
|
|
474
|
+
const x239: u32 = toU32(w239)
|
|
475
|
+
const x240: u32 = toU32(w239 >> 32)
|
|
476
|
+
const w241: u64 = p256FiatMulxU32(x3, arg2[3])
|
|
477
|
+
const x241: u32 = toU32(w241)
|
|
478
|
+
const x242: u32 = toU32(w241 >> 32)
|
|
479
|
+
const w243: u64 = p256FiatMulxU32(x3, arg2[2])
|
|
480
|
+
const x243: u32 = toU32(w243)
|
|
481
|
+
const x244: u32 = toU32(w243 >> 32)
|
|
482
|
+
const w245: u64 = p256FiatMulxU32(x3, arg2[1])
|
|
483
|
+
const x245: u32 = toU32(w245)
|
|
484
|
+
const x246: u32 = toU32(w245 >> 32)
|
|
485
|
+
const w247: u64 = p256FiatMulxU32(x3, arg2[0])
|
|
486
|
+
const x247: u32 = toU32(w247)
|
|
487
|
+
const x248: u32 = toU32(w247 >> 32)
|
|
488
|
+
const w249: u64 = p256FiatAddcarryxU32(0x0, x248, x245)
|
|
489
|
+
const x249: u32 = toU32(w249)
|
|
490
|
+
const x250: u32 = toU32(w249 >> 32)
|
|
491
|
+
const w251: u64 = p256FiatAddcarryxU32(x250, x246, x243)
|
|
492
|
+
const x251: u32 = toU32(w251)
|
|
493
|
+
const x252: u32 = toU32(w251 >> 32)
|
|
494
|
+
const w253: u64 = p256FiatAddcarryxU32(x252, x244, x241)
|
|
495
|
+
const x253: u32 = toU32(w253)
|
|
496
|
+
const x254: u32 = toU32(w253 >> 32)
|
|
497
|
+
const w255: u64 = p256FiatAddcarryxU32(x254, x242, x239)
|
|
498
|
+
const x255: u32 = toU32(w255)
|
|
499
|
+
const x256: u32 = toU32(w255 >> 32)
|
|
500
|
+
const w257: u64 = p256FiatAddcarryxU32(x256, x240, x237)
|
|
501
|
+
const x257: u32 = toU32(w257)
|
|
502
|
+
const x258: u32 = toU32(w257 >> 32)
|
|
503
|
+
const w259: u64 = p256FiatAddcarryxU32(x258, x238, x235)
|
|
504
|
+
const x259: u32 = toU32(w259)
|
|
505
|
+
const x260: u32 = toU32(w259 >> 32)
|
|
506
|
+
const w261: u64 = p256FiatAddcarryxU32(x260, x236, x233)
|
|
507
|
+
const x261: u32 = toU32(w261)
|
|
508
|
+
const x262: u32 = toU32(w261 >> 32)
|
|
509
|
+
const x263: u32 = x262 + x234
|
|
510
|
+
const w264: u64 = p256FiatAddcarryxU32(0x0, x216, x247)
|
|
511
|
+
const x264: u32 = toU32(w264)
|
|
512
|
+
const x265: u32 = toU32(w264 >> 32)
|
|
513
|
+
const w266: u64 = p256FiatAddcarryxU32(x265, x218, x249)
|
|
514
|
+
const x266: u32 = toU32(w266)
|
|
515
|
+
const x267: u32 = toU32(w266 >> 32)
|
|
516
|
+
const w268: u64 = p256FiatAddcarryxU32(x267, x220, x251)
|
|
517
|
+
const x268: u32 = toU32(w268)
|
|
518
|
+
const x269: u32 = toU32(w268 >> 32)
|
|
519
|
+
const w270: u64 = p256FiatAddcarryxU32(x269, x222, x253)
|
|
520
|
+
const x270: u32 = toU32(w270)
|
|
521
|
+
const x271: u32 = toU32(w270 >> 32)
|
|
522
|
+
const w272: u64 = p256FiatAddcarryxU32(x271, x224, x255)
|
|
523
|
+
const x272: u32 = toU32(w272)
|
|
524
|
+
const x273: u32 = toU32(w272 >> 32)
|
|
525
|
+
const w274: u64 = p256FiatAddcarryxU32(x273, x226, x257)
|
|
526
|
+
const x274: u32 = toU32(w274)
|
|
527
|
+
const x275: u32 = toU32(w274 >> 32)
|
|
528
|
+
const w276: u64 = p256FiatAddcarryxU32(x275, x228, x259)
|
|
529
|
+
const x276: u32 = toU32(w276)
|
|
530
|
+
const x277: u32 = toU32(w276 >> 32)
|
|
531
|
+
const w278: u64 = p256FiatAddcarryxU32(x277, x230, x261)
|
|
532
|
+
const x278: u32 = toU32(w278)
|
|
533
|
+
const x279: u32 = toU32(w278 >> 32)
|
|
534
|
+
const w280: u64 = p256FiatAddcarryxU32(x279, x232, x263)
|
|
535
|
+
const x280: u32 = toU32(w280)
|
|
536
|
+
const x281: u32 = toU32(w280 >> 32)
|
|
537
|
+
const w282: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
538
|
+
const x282: u32 = toU32(w282)
|
|
539
|
+
const x283: u32 = toU32(w282 >> 32)
|
|
540
|
+
const w284: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
541
|
+
const x284: u32 = toU32(w284)
|
|
542
|
+
const x285: u32 = toU32(w284 >> 32)
|
|
543
|
+
const w286: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
544
|
+
const x286: u32 = toU32(w286)
|
|
545
|
+
const x287: u32 = toU32(w286 >> 32)
|
|
546
|
+
const w288: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
547
|
+
const x288: u32 = toU32(w288)
|
|
548
|
+
const x289: u32 = toU32(w288 >> 32)
|
|
549
|
+
const w290: u64 = p256FiatAddcarryxU32(0x0, x289, x286)
|
|
550
|
+
const x290: u32 = toU32(w290)
|
|
551
|
+
const x291: u32 = toU32(w290 >> 32)
|
|
552
|
+
const w292: u64 = p256FiatAddcarryxU32(x291, x287, x284)
|
|
553
|
+
const x292: u32 = toU32(w292)
|
|
554
|
+
const x293: u32 = toU32(w292 >> 32)
|
|
555
|
+
const x294: u32 = x293 + x285
|
|
556
|
+
const w295: u64 = p256FiatAddcarryxU32(0x0, x264, x288)
|
|
557
|
+
const x296: u32 = toU32(w295 >> 32)
|
|
558
|
+
const w297: u64 = p256FiatAddcarryxU32(x296, x266, x290)
|
|
559
|
+
const x297: u32 = toU32(w297)
|
|
560
|
+
const x298: u32 = toU32(w297 >> 32)
|
|
561
|
+
const w299: u64 = p256FiatAddcarryxU32(x298, x268, x292)
|
|
562
|
+
const x299: u32 = toU32(w299)
|
|
563
|
+
const x300: u32 = toU32(w299 >> 32)
|
|
564
|
+
const w301: u64 = p256FiatAddcarryxU32(x300, x270, x294)
|
|
565
|
+
const x301: u32 = toU32(w301)
|
|
566
|
+
const x302: u32 = toU32(w301 >> 32)
|
|
567
|
+
const w303: u64 = p256FiatAddcarryxU32(x302, x272, 0x0)
|
|
568
|
+
const x303: u32 = toU32(w303)
|
|
569
|
+
const x304: u32 = toU32(w303 >> 32)
|
|
570
|
+
const w305: u64 = p256FiatAddcarryxU32(x304, x274, 0x0)
|
|
571
|
+
const x305: u32 = toU32(w305)
|
|
572
|
+
const x306: u32 = toU32(w305 >> 32)
|
|
573
|
+
const w307: u64 = p256FiatAddcarryxU32(x306, x276, x264)
|
|
574
|
+
const x307: u32 = toU32(w307)
|
|
575
|
+
const x308: u32 = toU32(w307 >> 32)
|
|
576
|
+
const w309: u64 = p256FiatAddcarryxU32(x308, x278, x282)
|
|
577
|
+
const x309: u32 = toU32(w309)
|
|
578
|
+
const x310: u32 = toU32(w309 >> 32)
|
|
579
|
+
const w311: u64 = p256FiatAddcarryxU32(x310, x280, x283)
|
|
580
|
+
const x311: u32 = toU32(w311)
|
|
581
|
+
const x312: u32 = toU32(w311 >> 32)
|
|
582
|
+
const x313: u32 = x312 + x281
|
|
583
|
+
const w314: u64 = p256FiatMulxU32(x4, arg2[7])
|
|
584
|
+
const x314: u32 = toU32(w314)
|
|
585
|
+
const x315: u32 = toU32(w314 >> 32)
|
|
586
|
+
const w316: u64 = p256FiatMulxU32(x4, arg2[6])
|
|
587
|
+
const x316: u32 = toU32(w316)
|
|
588
|
+
const x317: u32 = toU32(w316 >> 32)
|
|
589
|
+
const w318: u64 = p256FiatMulxU32(x4, arg2[5])
|
|
590
|
+
const x318: u32 = toU32(w318)
|
|
591
|
+
const x319: u32 = toU32(w318 >> 32)
|
|
592
|
+
const w320: u64 = p256FiatMulxU32(x4, arg2[4])
|
|
593
|
+
const x320: u32 = toU32(w320)
|
|
594
|
+
const x321: u32 = toU32(w320 >> 32)
|
|
595
|
+
const w322: u64 = p256FiatMulxU32(x4, arg2[3])
|
|
596
|
+
const x322: u32 = toU32(w322)
|
|
597
|
+
const x323: u32 = toU32(w322 >> 32)
|
|
598
|
+
const w324: u64 = p256FiatMulxU32(x4, arg2[2])
|
|
599
|
+
const x324: u32 = toU32(w324)
|
|
600
|
+
const x325: u32 = toU32(w324 >> 32)
|
|
601
|
+
const w326: u64 = p256FiatMulxU32(x4, arg2[1])
|
|
602
|
+
const x326: u32 = toU32(w326)
|
|
603
|
+
const x327: u32 = toU32(w326 >> 32)
|
|
604
|
+
const w328: u64 = p256FiatMulxU32(x4, arg2[0])
|
|
605
|
+
const x328: u32 = toU32(w328)
|
|
606
|
+
const x329: u32 = toU32(w328 >> 32)
|
|
607
|
+
const w330: u64 = p256FiatAddcarryxU32(0x0, x329, x326)
|
|
608
|
+
const x330: u32 = toU32(w330)
|
|
609
|
+
const x331: u32 = toU32(w330 >> 32)
|
|
610
|
+
const w332: u64 = p256FiatAddcarryxU32(x331, x327, x324)
|
|
611
|
+
const x332: u32 = toU32(w332)
|
|
612
|
+
const x333: u32 = toU32(w332 >> 32)
|
|
613
|
+
const w334: u64 = p256FiatAddcarryxU32(x333, x325, x322)
|
|
614
|
+
const x334: u32 = toU32(w334)
|
|
615
|
+
const x335: u32 = toU32(w334 >> 32)
|
|
616
|
+
const w336: u64 = p256FiatAddcarryxU32(x335, x323, x320)
|
|
617
|
+
const x336: u32 = toU32(w336)
|
|
618
|
+
const x337: u32 = toU32(w336 >> 32)
|
|
619
|
+
const w338: u64 = p256FiatAddcarryxU32(x337, x321, x318)
|
|
620
|
+
const x338: u32 = toU32(w338)
|
|
621
|
+
const x339: u32 = toU32(w338 >> 32)
|
|
622
|
+
const w340: u64 = p256FiatAddcarryxU32(x339, x319, x316)
|
|
623
|
+
const x340: u32 = toU32(w340)
|
|
624
|
+
const x341: u32 = toU32(w340 >> 32)
|
|
625
|
+
const w342: u64 = p256FiatAddcarryxU32(x341, x317, x314)
|
|
626
|
+
const x342: u32 = toU32(w342)
|
|
627
|
+
const x343: u32 = toU32(w342 >> 32)
|
|
628
|
+
const x344: u32 = x343 + x315
|
|
629
|
+
const w345: u64 = p256FiatAddcarryxU32(0x0, x297, x328)
|
|
630
|
+
const x345: u32 = toU32(w345)
|
|
631
|
+
const x346: u32 = toU32(w345 >> 32)
|
|
632
|
+
const w347: u64 = p256FiatAddcarryxU32(x346, x299, x330)
|
|
633
|
+
const x347: u32 = toU32(w347)
|
|
634
|
+
const x348: u32 = toU32(w347 >> 32)
|
|
635
|
+
const w349: u64 = p256FiatAddcarryxU32(x348, x301, x332)
|
|
636
|
+
const x349: u32 = toU32(w349)
|
|
637
|
+
const x350: u32 = toU32(w349 >> 32)
|
|
638
|
+
const w351: u64 = p256FiatAddcarryxU32(x350, x303, x334)
|
|
639
|
+
const x351: u32 = toU32(w351)
|
|
640
|
+
const x352: u32 = toU32(w351 >> 32)
|
|
641
|
+
const w353: u64 = p256FiatAddcarryxU32(x352, x305, x336)
|
|
642
|
+
const x353: u32 = toU32(w353)
|
|
643
|
+
const x354: u32 = toU32(w353 >> 32)
|
|
644
|
+
const w355: u64 = p256FiatAddcarryxU32(x354, x307, x338)
|
|
645
|
+
const x355: u32 = toU32(w355)
|
|
646
|
+
const x356: u32 = toU32(w355 >> 32)
|
|
647
|
+
const w357: u64 = p256FiatAddcarryxU32(x356, x309, x340)
|
|
648
|
+
const x357: u32 = toU32(w357)
|
|
649
|
+
const x358: u32 = toU32(w357 >> 32)
|
|
650
|
+
const w359: u64 = p256FiatAddcarryxU32(x358, x311, x342)
|
|
651
|
+
const x359: u32 = toU32(w359)
|
|
652
|
+
const x360: u32 = toU32(w359 >> 32)
|
|
653
|
+
const w361: u64 = p256FiatAddcarryxU32(x360, x313, x344)
|
|
654
|
+
const x361: u32 = toU32(w361)
|
|
655
|
+
const x362: u32 = toU32(w361 >> 32)
|
|
656
|
+
const w363: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
657
|
+
const x363: u32 = toU32(w363)
|
|
658
|
+
const x364: u32 = toU32(w363 >> 32)
|
|
659
|
+
const w365: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
660
|
+
const x365: u32 = toU32(w365)
|
|
661
|
+
const x366: u32 = toU32(w365 >> 32)
|
|
662
|
+
const w367: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
663
|
+
const x367: u32 = toU32(w367)
|
|
664
|
+
const x368: u32 = toU32(w367 >> 32)
|
|
665
|
+
const w369: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
666
|
+
const x369: u32 = toU32(w369)
|
|
667
|
+
const x370: u32 = toU32(w369 >> 32)
|
|
668
|
+
const w371: u64 = p256FiatAddcarryxU32(0x0, x370, x367)
|
|
669
|
+
const x371: u32 = toU32(w371)
|
|
670
|
+
const x372: u32 = toU32(w371 >> 32)
|
|
671
|
+
const w373: u64 = p256FiatAddcarryxU32(x372, x368, x365)
|
|
672
|
+
const x373: u32 = toU32(w373)
|
|
673
|
+
const x374: u32 = toU32(w373 >> 32)
|
|
674
|
+
const x375: u32 = x374 + x366
|
|
675
|
+
const w376: u64 = p256FiatAddcarryxU32(0x0, x345, x369)
|
|
676
|
+
const x377: u32 = toU32(w376 >> 32)
|
|
677
|
+
const w378: u64 = p256FiatAddcarryxU32(x377, x347, x371)
|
|
678
|
+
const x378: u32 = toU32(w378)
|
|
679
|
+
const x379: u32 = toU32(w378 >> 32)
|
|
680
|
+
const w380: u64 = p256FiatAddcarryxU32(x379, x349, x373)
|
|
681
|
+
const x380: u32 = toU32(w380)
|
|
682
|
+
const x381: u32 = toU32(w380 >> 32)
|
|
683
|
+
const w382: u64 = p256FiatAddcarryxU32(x381, x351, x375)
|
|
684
|
+
const x382: u32 = toU32(w382)
|
|
685
|
+
const x383: u32 = toU32(w382 >> 32)
|
|
686
|
+
const w384: u64 = p256FiatAddcarryxU32(x383, x353, 0x0)
|
|
687
|
+
const x384: u32 = toU32(w384)
|
|
688
|
+
const x385: u32 = toU32(w384 >> 32)
|
|
689
|
+
const w386: u64 = p256FiatAddcarryxU32(x385, x355, 0x0)
|
|
690
|
+
const x386: u32 = toU32(w386)
|
|
691
|
+
const x387: u32 = toU32(w386 >> 32)
|
|
692
|
+
const w388: u64 = p256FiatAddcarryxU32(x387, x357, x345)
|
|
693
|
+
const x388: u32 = toU32(w388)
|
|
694
|
+
const x389: u32 = toU32(w388 >> 32)
|
|
695
|
+
const w390: u64 = p256FiatAddcarryxU32(x389, x359, x363)
|
|
696
|
+
const x390: u32 = toU32(w390)
|
|
697
|
+
const x391: u32 = toU32(w390 >> 32)
|
|
698
|
+
const w392: u64 = p256FiatAddcarryxU32(x391, x361, x364)
|
|
699
|
+
const x392: u32 = toU32(w392)
|
|
700
|
+
const x393: u32 = toU32(w392 >> 32)
|
|
701
|
+
const x394: u32 = x393 + x362
|
|
702
|
+
const w395: u64 = p256FiatMulxU32(x5, arg2[7])
|
|
703
|
+
const x395: u32 = toU32(w395)
|
|
704
|
+
const x396: u32 = toU32(w395 >> 32)
|
|
705
|
+
const w397: u64 = p256FiatMulxU32(x5, arg2[6])
|
|
706
|
+
const x397: u32 = toU32(w397)
|
|
707
|
+
const x398: u32 = toU32(w397 >> 32)
|
|
708
|
+
const w399: u64 = p256FiatMulxU32(x5, arg2[5])
|
|
709
|
+
const x399: u32 = toU32(w399)
|
|
710
|
+
const x400: u32 = toU32(w399 >> 32)
|
|
711
|
+
const w401: u64 = p256FiatMulxU32(x5, arg2[4])
|
|
712
|
+
const x401: u32 = toU32(w401)
|
|
713
|
+
const x402: u32 = toU32(w401 >> 32)
|
|
714
|
+
const w403: u64 = p256FiatMulxU32(x5, arg2[3])
|
|
715
|
+
const x403: u32 = toU32(w403)
|
|
716
|
+
const x404: u32 = toU32(w403 >> 32)
|
|
717
|
+
const w405: u64 = p256FiatMulxU32(x5, arg2[2])
|
|
718
|
+
const x405: u32 = toU32(w405)
|
|
719
|
+
const x406: u32 = toU32(w405 >> 32)
|
|
720
|
+
const w407: u64 = p256FiatMulxU32(x5, arg2[1])
|
|
721
|
+
const x407: u32 = toU32(w407)
|
|
722
|
+
const x408: u32 = toU32(w407 >> 32)
|
|
723
|
+
const w409: u64 = p256FiatMulxU32(x5, arg2[0])
|
|
724
|
+
const x409: u32 = toU32(w409)
|
|
725
|
+
const x410: u32 = toU32(w409 >> 32)
|
|
726
|
+
const w411: u64 = p256FiatAddcarryxU32(0x0, x410, x407)
|
|
727
|
+
const x411: u32 = toU32(w411)
|
|
728
|
+
const x412: u32 = toU32(w411 >> 32)
|
|
729
|
+
const w413: u64 = p256FiatAddcarryxU32(x412, x408, x405)
|
|
730
|
+
const x413: u32 = toU32(w413)
|
|
731
|
+
const x414: u32 = toU32(w413 >> 32)
|
|
732
|
+
const w415: u64 = p256FiatAddcarryxU32(x414, x406, x403)
|
|
733
|
+
const x415: u32 = toU32(w415)
|
|
734
|
+
const x416: u32 = toU32(w415 >> 32)
|
|
735
|
+
const w417: u64 = p256FiatAddcarryxU32(x416, x404, x401)
|
|
736
|
+
const x417: u32 = toU32(w417)
|
|
737
|
+
const x418: u32 = toU32(w417 >> 32)
|
|
738
|
+
const w419: u64 = p256FiatAddcarryxU32(x418, x402, x399)
|
|
739
|
+
const x419: u32 = toU32(w419)
|
|
740
|
+
const x420: u32 = toU32(w419 >> 32)
|
|
741
|
+
const w421: u64 = p256FiatAddcarryxU32(x420, x400, x397)
|
|
742
|
+
const x421: u32 = toU32(w421)
|
|
743
|
+
const x422: u32 = toU32(w421 >> 32)
|
|
744
|
+
const w423: u64 = p256FiatAddcarryxU32(x422, x398, x395)
|
|
745
|
+
const x423: u32 = toU32(w423)
|
|
746
|
+
const x424: u32 = toU32(w423 >> 32)
|
|
747
|
+
const x425: u32 = x424 + x396
|
|
748
|
+
const w426: u64 = p256FiatAddcarryxU32(0x0, x378, x409)
|
|
749
|
+
const x426: u32 = toU32(w426)
|
|
750
|
+
const x427: u32 = toU32(w426 >> 32)
|
|
751
|
+
const w428: u64 = p256FiatAddcarryxU32(x427, x380, x411)
|
|
752
|
+
const x428: u32 = toU32(w428)
|
|
753
|
+
const x429: u32 = toU32(w428 >> 32)
|
|
754
|
+
const w430: u64 = p256FiatAddcarryxU32(x429, x382, x413)
|
|
755
|
+
const x430: u32 = toU32(w430)
|
|
756
|
+
const x431: u32 = toU32(w430 >> 32)
|
|
757
|
+
const w432: u64 = p256FiatAddcarryxU32(x431, x384, x415)
|
|
758
|
+
const x432: u32 = toU32(w432)
|
|
759
|
+
const x433: u32 = toU32(w432 >> 32)
|
|
760
|
+
const w434: u64 = p256FiatAddcarryxU32(x433, x386, x417)
|
|
761
|
+
const x434: u32 = toU32(w434)
|
|
762
|
+
const x435: u32 = toU32(w434 >> 32)
|
|
763
|
+
const w436: u64 = p256FiatAddcarryxU32(x435, x388, x419)
|
|
764
|
+
const x436: u32 = toU32(w436)
|
|
765
|
+
const x437: u32 = toU32(w436 >> 32)
|
|
766
|
+
const w438: u64 = p256FiatAddcarryxU32(x437, x390, x421)
|
|
767
|
+
const x438: u32 = toU32(w438)
|
|
768
|
+
const x439: u32 = toU32(w438 >> 32)
|
|
769
|
+
const w440: u64 = p256FiatAddcarryxU32(x439, x392, x423)
|
|
770
|
+
const x440: u32 = toU32(w440)
|
|
771
|
+
const x441: u32 = toU32(w440 >> 32)
|
|
772
|
+
const w442: u64 = p256FiatAddcarryxU32(x441, x394, x425)
|
|
773
|
+
const x442: u32 = toU32(w442)
|
|
774
|
+
const x443: u32 = toU32(w442 >> 32)
|
|
775
|
+
const w444: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
776
|
+
const x444: u32 = toU32(w444)
|
|
777
|
+
const x445: u32 = toU32(w444 >> 32)
|
|
778
|
+
const w446: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
779
|
+
const x446: u32 = toU32(w446)
|
|
780
|
+
const x447: u32 = toU32(w446 >> 32)
|
|
781
|
+
const w448: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
782
|
+
const x448: u32 = toU32(w448)
|
|
783
|
+
const x449: u32 = toU32(w448 >> 32)
|
|
784
|
+
const w450: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
785
|
+
const x450: u32 = toU32(w450)
|
|
786
|
+
const x451: u32 = toU32(w450 >> 32)
|
|
787
|
+
const w452: u64 = p256FiatAddcarryxU32(0x0, x451, x448)
|
|
788
|
+
const x452: u32 = toU32(w452)
|
|
789
|
+
const x453: u32 = toU32(w452 >> 32)
|
|
790
|
+
const w454: u64 = p256FiatAddcarryxU32(x453, x449, x446)
|
|
791
|
+
const x454: u32 = toU32(w454)
|
|
792
|
+
const x455: u32 = toU32(w454 >> 32)
|
|
793
|
+
const x456: u32 = x455 + x447
|
|
794
|
+
const w457: u64 = p256FiatAddcarryxU32(0x0, x426, x450)
|
|
795
|
+
const x458: u32 = toU32(w457 >> 32)
|
|
796
|
+
const w459: u64 = p256FiatAddcarryxU32(x458, x428, x452)
|
|
797
|
+
const x459: u32 = toU32(w459)
|
|
798
|
+
const x460: u32 = toU32(w459 >> 32)
|
|
799
|
+
const w461: u64 = p256FiatAddcarryxU32(x460, x430, x454)
|
|
800
|
+
const x461: u32 = toU32(w461)
|
|
801
|
+
const x462: u32 = toU32(w461 >> 32)
|
|
802
|
+
const w463: u64 = p256FiatAddcarryxU32(x462, x432, x456)
|
|
803
|
+
const x463: u32 = toU32(w463)
|
|
804
|
+
const x464: u32 = toU32(w463 >> 32)
|
|
805
|
+
const w465: u64 = p256FiatAddcarryxU32(x464, x434, 0x0)
|
|
806
|
+
const x465: u32 = toU32(w465)
|
|
807
|
+
const x466: u32 = toU32(w465 >> 32)
|
|
808
|
+
const w467: u64 = p256FiatAddcarryxU32(x466, x436, 0x0)
|
|
809
|
+
const x467: u32 = toU32(w467)
|
|
810
|
+
const x468: u32 = toU32(w467 >> 32)
|
|
811
|
+
const w469: u64 = p256FiatAddcarryxU32(x468, x438, x426)
|
|
812
|
+
const x469: u32 = toU32(w469)
|
|
813
|
+
const x470: u32 = toU32(w469 >> 32)
|
|
814
|
+
const w471: u64 = p256FiatAddcarryxU32(x470, x440, x444)
|
|
815
|
+
const x471: u32 = toU32(w471)
|
|
816
|
+
const x472: u32 = toU32(w471 >> 32)
|
|
817
|
+
const w473: u64 = p256FiatAddcarryxU32(x472, x442, x445)
|
|
818
|
+
const x473: u32 = toU32(w473)
|
|
819
|
+
const x474: u32 = toU32(w473 >> 32)
|
|
820
|
+
const x475: u32 = x474 + x443
|
|
821
|
+
const w476: u64 = p256FiatMulxU32(x6, arg2[7])
|
|
822
|
+
const x476: u32 = toU32(w476)
|
|
823
|
+
const x477: u32 = toU32(w476 >> 32)
|
|
824
|
+
const w478: u64 = p256FiatMulxU32(x6, arg2[6])
|
|
825
|
+
const x478: u32 = toU32(w478)
|
|
826
|
+
const x479: u32 = toU32(w478 >> 32)
|
|
827
|
+
const w480: u64 = p256FiatMulxU32(x6, arg2[5])
|
|
828
|
+
const x480: u32 = toU32(w480)
|
|
829
|
+
const x481: u32 = toU32(w480 >> 32)
|
|
830
|
+
const w482: u64 = p256FiatMulxU32(x6, arg2[4])
|
|
831
|
+
const x482: u32 = toU32(w482)
|
|
832
|
+
const x483: u32 = toU32(w482 >> 32)
|
|
833
|
+
const w484: u64 = p256FiatMulxU32(x6, arg2[3])
|
|
834
|
+
const x484: u32 = toU32(w484)
|
|
835
|
+
const x485: u32 = toU32(w484 >> 32)
|
|
836
|
+
const w486: u64 = p256FiatMulxU32(x6, arg2[2])
|
|
837
|
+
const x486: u32 = toU32(w486)
|
|
838
|
+
const x487: u32 = toU32(w486 >> 32)
|
|
839
|
+
const w488: u64 = p256FiatMulxU32(x6, arg2[1])
|
|
840
|
+
const x488: u32 = toU32(w488)
|
|
841
|
+
const x489: u32 = toU32(w488 >> 32)
|
|
842
|
+
const w490: u64 = p256FiatMulxU32(x6, arg2[0])
|
|
843
|
+
const x490: u32 = toU32(w490)
|
|
844
|
+
const x491: u32 = toU32(w490 >> 32)
|
|
845
|
+
const w492: u64 = p256FiatAddcarryxU32(0x0, x491, x488)
|
|
846
|
+
const x492: u32 = toU32(w492)
|
|
847
|
+
const x493: u32 = toU32(w492 >> 32)
|
|
848
|
+
const w494: u64 = p256FiatAddcarryxU32(x493, x489, x486)
|
|
849
|
+
const x494: u32 = toU32(w494)
|
|
850
|
+
const x495: u32 = toU32(w494 >> 32)
|
|
851
|
+
const w496: u64 = p256FiatAddcarryxU32(x495, x487, x484)
|
|
852
|
+
const x496: u32 = toU32(w496)
|
|
853
|
+
const x497: u32 = toU32(w496 >> 32)
|
|
854
|
+
const w498: u64 = p256FiatAddcarryxU32(x497, x485, x482)
|
|
855
|
+
const x498: u32 = toU32(w498)
|
|
856
|
+
const x499: u32 = toU32(w498 >> 32)
|
|
857
|
+
const w500: u64 = p256FiatAddcarryxU32(x499, x483, x480)
|
|
858
|
+
const x500: u32 = toU32(w500)
|
|
859
|
+
const x501: u32 = toU32(w500 >> 32)
|
|
860
|
+
const w502: u64 = p256FiatAddcarryxU32(x501, x481, x478)
|
|
861
|
+
const x502: u32 = toU32(w502)
|
|
862
|
+
const x503: u32 = toU32(w502 >> 32)
|
|
863
|
+
const w504: u64 = p256FiatAddcarryxU32(x503, x479, x476)
|
|
864
|
+
const x504: u32 = toU32(w504)
|
|
865
|
+
const x505: u32 = toU32(w504 >> 32)
|
|
866
|
+
const x506: u32 = x505 + x477
|
|
867
|
+
const w507: u64 = p256FiatAddcarryxU32(0x0, x459, x490)
|
|
868
|
+
const x507: u32 = toU32(w507)
|
|
869
|
+
const x508: u32 = toU32(w507 >> 32)
|
|
870
|
+
const w509: u64 = p256FiatAddcarryxU32(x508, x461, x492)
|
|
871
|
+
const x509: u32 = toU32(w509)
|
|
872
|
+
const x510: u32 = toU32(w509 >> 32)
|
|
873
|
+
const w511: u64 = p256FiatAddcarryxU32(x510, x463, x494)
|
|
874
|
+
const x511: u32 = toU32(w511)
|
|
875
|
+
const x512: u32 = toU32(w511 >> 32)
|
|
876
|
+
const w513: u64 = p256FiatAddcarryxU32(x512, x465, x496)
|
|
877
|
+
const x513: u32 = toU32(w513)
|
|
878
|
+
const x514: u32 = toU32(w513 >> 32)
|
|
879
|
+
const w515: u64 = p256FiatAddcarryxU32(x514, x467, x498)
|
|
880
|
+
const x515: u32 = toU32(w515)
|
|
881
|
+
const x516: u32 = toU32(w515 >> 32)
|
|
882
|
+
const w517: u64 = p256FiatAddcarryxU32(x516, x469, x500)
|
|
883
|
+
const x517: u32 = toU32(w517)
|
|
884
|
+
const x518: u32 = toU32(w517 >> 32)
|
|
885
|
+
const w519: u64 = p256FiatAddcarryxU32(x518, x471, x502)
|
|
886
|
+
const x519: u32 = toU32(w519)
|
|
887
|
+
const x520: u32 = toU32(w519 >> 32)
|
|
888
|
+
const w521: u64 = p256FiatAddcarryxU32(x520, x473, x504)
|
|
889
|
+
const x521: u32 = toU32(w521)
|
|
890
|
+
const x522: u32 = toU32(w521 >> 32)
|
|
891
|
+
const w523: u64 = p256FiatAddcarryxU32(x522, x475, x506)
|
|
892
|
+
const x523: u32 = toU32(w523)
|
|
893
|
+
const x524: u32 = toU32(w523 >> 32)
|
|
894
|
+
const w525: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
895
|
+
const x525: u32 = toU32(w525)
|
|
896
|
+
const x526: u32 = toU32(w525 >> 32)
|
|
897
|
+
const w527: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
898
|
+
const x527: u32 = toU32(w527)
|
|
899
|
+
const x528: u32 = toU32(w527 >> 32)
|
|
900
|
+
const w529: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
901
|
+
const x529: u32 = toU32(w529)
|
|
902
|
+
const x530: u32 = toU32(w529 >> 32)
|
|
903
|
+
const w531: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
904
|
+
const x531: u32 = toU32(w531)
|
|
905
|
+
const x532: u32 = toU32(w531 >> 32)
|
|
906
|
+
const w533: u64 = p256FiatAddcarryxU32(0x0, x532, x529)
|
|
907
|
+
const x533: u32 = toU32(w533)
|
|
908
|
+
const x534: u32 = toU32(w533 >> 32)
|
|
909
|
+
const w535: u64 = p256FiatAddcarryxU32(x534, x530, x527)
|
|
910
|
+
const x535: u32 = toU32(w535)
|
|
911
|
+
const x536: u32 = toU32(w535 >> 32)
|
|
912
|
+
const x537: u32 = x536 + x528
|
|
913
|
+
const w538: u64 = p256FiatAddcarryxU32(0x0, x507, x531)
|
|
914
|
+
const x539: u32 = toU32(w538 >> 32)
|
|
915
|
+
const w540: u64 = p256FiatAddcarryxU32(x539, x509, x533)
|
|
916
|
+
const x540: u32 = toU32(w540)
|
|
917
|
+
const x541: u32 = toU32(w540 >> 32)
|
|
918
|
+
const w542: u64 = p256FiatAddcarryxU32(x541, x511, x535)
|
|
919
|
+
const x542: u32 = toU32(w542)
|
|
920
|
+
const x543: u32 = toU32(w542 >> 32)
|
|
921
|
+
const w544: u64 = p256FiatAddcarryxU32(x543, x513, x537)
|
|
922
|
+
const x544: u32 = toU32(w544)
|
|
923
|
+
const x545: u32 = toU32(w544 >> 32)
|
|
924
|
+
const w546: u64 = p256FiatAddcarryxU32(x545, x515, 0x0)
|
|
925
|
+
const x546: u32 = toU32(w546)
|
|
926
|
+
const x547: u32 = toU32(w546 >> 32)
|
|
927
|
+
const w548: u64 = p256FiatAddcarryxU32(x547, x517, 0x0)
|
|
928
|
+
const x548: u32 = toU32(w548)
|
|
929
|
+
const x549: u32 = toU32(w548 >> 32)
|
|
930
|
+
const w550: u64 = p256FiatAddcarryxU32(x549, x519, x507)
|
|
931
|
+
const x550: u32 = toU32(w550)
|
|
932
|
+
const x551: u32 = toU32(w550 >> 32)
|
|
933
|
+
const w552: u64 = p256FiatAddcarryxU32(x551, x521, x525)
|
|
934
|
+
const x552: u32 = toU32(w552)
|
|
935
|
+
const x553: u32 = toU32(w552 >> 32)
|
|
936
|
+
const w554: u64 = p256FiatAddcarryxU32(x553, x523, x526)
|
|
937
|
+
const x554: u32 = toU32(w554)
|
|
938
|
+
const x555: u32 = toU32(w554 >> 32)
|
|
939
|
+
const x556: u32 = x555 + x524
|
|
940
|
+
const w557: u64 = p256FiatMulxU32(x7, arg2[7])
|
|
941
|
+
const x557: u32 = toU32(w557)
|
|
942
|
+
const x558: u32 = toU32(w557 >> 32)
|
|
943
|
+
const w559: u64 = p256FiatMulxU32(x7, arg2[6])
|
|
944
|
+
const x559: u32 = toU32(w559)
|
|
945
|
+
const x560: u32 = toU32(w559 >> 32)
|
|
946
|
+
const w561: u64 = p256FiatMulxU32(x7, arg2[5])
|
|
947
|
+
const x561: u32 = toU32(w561)
|
|
948
|
+
const x562: u32 = toU32(w561 >> 32)
|
|
949
|
+
const w563: u64 = p256FiatMulxU32(x7, arg2[4])
|
|
950
|
+
const x563: u32 = toU32(w563)
|
|
951
|
+
const x564: u32 = toU32(w563 >> 32)
|
|
952
|
+
const w565: u64 = p256FiatMulxU32(x7, arg2[3])
|
|
953
|
+
const x565: u32 = toU32(w565)
|
|
954
|
+
const x566: u32 = toU32(w565 >> 32)
|
|
955
|
+
const w567: u64 = p256FiatMulxU32(x7, arg2[2])
|
|
956
|
+
const x567: u32 = toU32(w567)
|
|
957
|
+
const x568: u32 = toU32(w567 >> 32)
|
|
958
|
+
const w569: u64 = p256FiatMulxU32(x7, arg2[1])
|
|
959
|
+
const x569: u32 = toU32(w569)
|
|
960
|
+
const x570: u32 = toU32(w569 >> 32)
|
|
961
|
+
const w571: u64 = p256FiatMulxU32(x7, arg2[0])
|
|
962
|
+
const x571: u32 = toU32(w571)
|
|
963
|
+
const x572: u32 = toU32(w571 >> 32)
|
|
964
|
+
const w573: u64 = p256FiatAddcarryxU32(0x0, x572, x569)
|
|
965
|
+
const x573: u32 = toU32(w573)
|
|
966
|
+
const x574: u32 = toU32(w573 >> 32)
|
|
967
|
+
const w575: u64 = p256FiatAddcarryxU32(x574, x570, x567)
|
|
968
|
+
const x575: u32 = toU32(w575)
|
|
969
|
+
const x576: u32 = toU32(w575 >> 32)
|
|
970
|
+
const w577: u64 = p256FiatAddcarryxU32(x576, x568, x565)
|
|
971
|
+
const x577: u32 = toU32(w577)
|
|
972
|
+
const x578: u32 = toU32(w577 >> 32)
|
|
973
|
+
const w579: u64 = p256FiatAddcarryxU32(x578, x566, x563)
|
|
974
|
+
const x579: u32 = toU32(w579)
|
|
975
|
+
const x580: u32 = toU32(w579 >> 32)
|
|
976
|
+
const w581: u64 = p256FiatAddcarryxU32(x580, x564, x561)
|
|
977
|
+
const x581: u32 = toU32(w581)
|
|
978
|
+
const x582: u32 = toU32(w581 >> 32)
|
|
979
|
+
const w583: u64 = p256FiatAddcarryxU32(x582, x562, x559)
|
|
980
|
+
const x583: u32 = toU32(w583)
|
|
981
|
+
const x584: u32 = toU32(w583 >> 32)
|
|
982
|
+
const w585: u64 = p256FiatAddcarryxU32(x584, x560, x557)
|
|
983
|
+
const x585: u32 = toU32(w585)
|
|
984
|
+
const x586: u32 = toU32(w585 >> 32)
|
|
985
|
+
const x587: u32 = x586 + x558
|
|
986
|
+
const w588: u64 = p256FiatAddcarryxU32(0x0, x540, x571)
|
|
987
|
+
const x588: u32 = toU32(w588)
|
|
988
|
+
const x589: u32 = toU32(w588 >> 32)
|
|
989
|
+
const w590: u64 = p256FiatAddcarryxU32(x589, x542, x573)
|
|
990
|
+
const x590: u32 = toU32(w590)
|
|
991
|
+
const x591: u32 = toU32(w590 >> 32)
|
|
992
|
+
const w592: u64 = p256FiatAddcarryxU32(x591, x544, x575)
|
|
993
|
+
const x592: u32 = toU32(w592)
|
|
994
|
+
const x593: u32 = toU32(w592 >> 32)
|
|
995
|
+
const w594: u64 = p256FiatAddcarryxU32(x593, x546, x577)
|
|
996
|
+
const x594: u32 = toU32(w594)
|
|
997
|
+
const x595: u32 = toU32(w594 >> 32)
|
|
998
|
+
const w596: u64 = p256FiatAddcarryxU32(x595, x548, x579)
|
|
999
|
+
const x596: u32 = toU32(w596)
|
|
1000
|
+
const x597: u32 = toU32(w596 >> 32)
|
|
1001
|
+
const w598: u64 = p256FiatAddcarryxU32(x597, x550, x581)
|
|
1002
|
+
const x598: u32 = toU32(w598)
|
|
1003
|
+
const x599: u32 = toU32(w598 >> 32)
|
|
1004
|
+
const w600: u64 = p256FiatAddcarryxU32(x599, x552, x583)
|
|
1005
|
+
const x600: u32 = toU32(w600)
|
|
1006
|
+
const x601: u32 = toU32(w600 >> 32)
|
|
1007
|
+
const w602: u64 = p256FiatAddcarryxU32(x601, x554, x585)
|
|
1008
|
+
const x602: u32 = toU32(w602)
|
|
1009
|
+
const x603: u32 = toU32(w602 >> 32)
|
|
1010
|
+
const w604: u64 = p256FiatAddcarryxU32(x603, x556, x587)
|
|
1011
|
+
const x604: u32 = toU32(w604)
|
|
1012
|
+
const x605: u32 = toU32(w604 >> 32)
|
|
1013
|
+
const w606: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
1014
|
+
const x606: u32 = toU32(w606)
|
|
1015
|
+
const x607: u32 = toU32(w606 >> 32)
|
|
1016
|
+
const w608: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
1017
|
+
const x608: u32 = toU32(w608)
|
|
1018
|
+
const x609: u32 = toU32(w608 >> 32)
|
|
1019
|
+
const w610: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
1020
|
+
const x610: u32 = toU32(w610)
|
|
1021
|
+
const x611: u32 = toU32(w610 >> 32)
|
|
1022
|
+
const w612: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
1023
|
+
const x612: u32 = toU32(w612)
|
|
1024
|
+
const x613: u32 = toU32(w612 >> 32)
|
|
1025
|
+
const w614: u64 = p256FiatAddcarryxU32(0x0, x613, x610)
|
|
1026
|
+
const x614: u32 = toU32(w614)
|
|
1027
|
+
const x615: u32 = toU32(w614 >> 32)
|
|
1028
|
+
const w616: u64 = p256FiatAddcarryxU32(x615, x611, x608)
|
|
1029
|
+
const x616: u32 = toU32(w616)
|
|
1030
|
+
const x617: u32 = toU32(w616 >> 32)
|
|
1031
|
+
const x618: u32 = x617 + x609
|
|
1032
|
+
const w619: u64 = p256FiatAddcarryxU32(0x0, x588, x612)
|
|
1033
|
+
const x620: u32 = toU32(w619 >> 32)
|
|
1034
|
+
const w621: u64 = p256FiatAddcarryxU32(x620, x590, x614)
|
|
1035
|
+
const x621: u32 = toU32(w621)
|
|
1036
|
+
const x622: u32 = toU32(w621 >> 32)
|
|
1037
|
+
const w623: u64 = p256FiatAddcarryxU32(x622, x592, x616)
|
|
1038
|
+
const x623: u32 = toU32(w623)
|
|
1039
|
+
const x624: u32 = toU32(w623 >> 32)
|
|
1040
|
+
const w625: u64 = p256FiatAddcarryxU32(x624, x594, x618)
|
|
1041
|
+
const x625: u32 = toU32(w625)
|
|
1042
|
+
const x626: u32 = toU32(w625 >> 32)
|
|
1043
|
+
const w627: u64 = p256FiatAddcarryxU32(x626, x596, 0x0)
|
|
1044
|
+
const x627: u32 = toU32(w627)
|
|
1045
|
+
const x628: u32 = toU32(w627 >> 32)
|
|
1046
|
+
const w629: u64 = p256FiatAddcarryxU32(x628, x598, 0x0)
|
|
1047
|
+
const x629: u32 = toU32(w629)
|
|
1048
|
+
const x630: u32 = toU32(w629 >> 32)
|
|
1049
|
+
const w631: u64 = p256FiatAddcarryxU32(x630, x600, x588)
|
|
1050
|
+
const x631: u32 = toU32(w631)
|
|
1051
|
+
const x632: u32 = toU32(w631 >> 32)
|
|
1052
|
+
const w633: u64 = p256FiatAddcarryxU32(x632, x602, x606)
|
|
1053
|
+
const x633: u32 = toU32(w633)
|
|
1054
|
+
const x634: u32 = toU32(w633 >> 32)
|
|
1055
|
+
const w635: u64 = p256FiatAddcarryxU32(x634, x604, x607)
|
|
1056
|
+
const x635: u32 = toU32(w635)
|
|
1057
|
+
const x636: u32 = toU32(w635 >> 32)
|
|
1058
|
+
const x637: u32 = x636 + x605
|
|
1059
|
+
const w638: u64 = p256FiatSubborrowxU32(0x0, x621, 0xffffffff)
|
|
1060
|
+
const x638: u32 = toU32(w638)
|
|
1061
|
+
const x639: u32 = toU32(w638 >> 32)
|
|
1062
|
+
const w640: u64 = p256FiatSubborrowxU32(x639, x623, 0xffffffff)
|
|
1063
|
+
const x640: u32 = toU32(w640)
|
|
1064
|
+
const x641: u32 = toU32(w640 >> 32)
|
|
1065
|
+
const w642: u64 = p256FiatSubborrowxU32(x641, x625, 0xffffffff)
|
|
1066
|
+
const x642: u32 = toU32(w642)
|
|
1067
|
+
const x643: u32 = toU32(w642 >> 32)
|
|
1068
|
+
const w644: u64 = p256FiatSubborrowxU32(x643, x627, 0x0)
|
|
1069
|
+
const x644: u32 = toU32(w644)
|
|
1070
|
+
const x645: u32 = toU32(w644 >> 32)
|
|
1071
|
+
const w646: u64 = p256FiatSubborrowxU32(x645, x629, 0x0)
|
|
1072
|
+
const x646: u32 = toU32(w646)
|
|
1073
|
+
const x647: u32 = toU32(w646 >> 32)
|
|
1074
|
+
const w648: u64 = p256FiatSubborrowxU32(x647, x631, 0x0)
|
|
1075
|
+
const x648: u32 = toU32(w648)
|
|
1076
|
+
const x649: u32 = toU32(w648 >> 32)
|
|
1077
|
+
const w650: u64 = p256FiatSubborrowxU32(x649, x633, 0x1)
|
|
1078
|
+
const x650: u32 = toU32(w650)
|
|
1079
|
+
const x651: u32 = toU32(w650 >> 32)
|
|
1080
|
+
const w652: u64 = p256FiatSubborrowxU32(x651, x635, 0xffffffff)
|
|
1081
|
+
const x652: u32 = toU32(w652)
|
|
1082
|
+
const x653: u32 = toU32(w652 >> 32)
|
|
1083
|
+
const w654: u64 = p256FiatSubborrowxU32(x653, x637, 0x0)
|
|
1084
|
+
const x655: u32 = toU32(w654 >> 32)
|
|
1085
|
+
const x656: u32 = p256FiatCmovznzU32(x655, x638, x621)
|
|
1086
|
+
const x657: u32 = p256FiatCmovznzU32(x655, x640, x623)
|
|
1087
|
+
const x658: u32 = p256FiatCmovznzU32(x655, x642, x625)
|
|
1088
|
+
const x659: u32 = p256FiatCmovznzU32(x655, x644, x627)
|
|
1089
|
+
const x660: u32 = p256FiatCmovznzU32(x655, x646, x629)
|
|
1090
|
+
const x661: u32 = p256FiatCmovznzU32(x655, x648, x631)
|
|
1091
|
+
const x662: u32 = p256FiatCmovznzU32(x655, x650, x633)
|
|
1092
|
+
const x663: u32 = p256FiatCmovznzU32(x655, x652, x635)
|
|
1093
|
+
out1[0] = x656
|
|
1094
|
+
out1[1] = x657
|
|
1095
|
+
out1[2] = x658
|
|
1096
|
+
out1[3] = x659
|
|
1097
|
+
out1[4] = x660
|
|
1098
|
+
out1[5] = x661
|
|
1099
|
+
out1[6] = x662
|
|
1100
|
+
out1[7] = x663
|
|
1101
|
+
}
|
|
1102
|
+
|
|
1103
|
+
/** fiat's `fiat_p256_square`: squares a field element in the Montgomery domain. */
|
|
1104
|
+
const p256FiatSquare = (out1: u32[], arg1: u32[]): void => {
|
|
1105
|
+
if (toI32(out1.length) < 8 || toI32(arg1.length) < 8) {
|
|
1106
|
+
return
|
|
1107
|
+
}
|
|
1108
|
+
const arg1Limb0: u32 = arg1[0]
|
|
1109
|
+
const arg1Limb1: u32 = arg1[1]
|
|
1110
|
+
const arg1Limb2: u32 = arg1[2]
|
|
1111
|
+
const arg1Limb3: u32 = arg1[3]
|
|
1112
|
+
const arg1Limb4: u32 = arg1[4]
|
|
1113
|
+
const arg1Limb5: u32 = arg1[5]
|
|
1114
|
+
const arg1Limb6: u32 = arg1[6]
|
|
1115
|
+
const arg1Limb7: u32 = arg1[7]
|
|
1116
|
+
const x1: u32 = arg1Limb1
|
|
1117
|
+
const x2: u32 = arg1Limb2
|
|
1118
|
+
const x3: u32 = arg1Limb3
|
|
1119
|
+
const x4: u32 = arg1Limb4
|
|
1120
|
+
const x5: u32 = arg1Limb5
|
|
1121
|
+
const x6: u32 = arg1Limb6
|
|
1122
|
+
const x7: u32 = arg1Limb7
|
|
1123
|
+
const x8: u32 = arg1Limb0
|
|
1124
|
+
const w9: u64 = p256FiatMulxU32(x8, arg1Limb7)
|
|
1125
|
+
const x9: u32 = toU32(w9)
|
|
1126
|
+
const x10: u32 = toU32(w9 >> 32)
|
|
1127
|
+
const w11: u64 = p256FiatMulxU32(x8, arg1Limb6)
|
|
1128
|
+
const x11: u32 = toU32(w11)
|
|
1129
|
+
const x12: u32 = toU32(w11 >> 32)
|
|
1130
|
+
const w13: u64 = p256FiatMulxU32(x8, arg1Limb5)
|
|
1131
|
+
const x13: u32 = toU32(w13)
|
|
1132
|
+
const x14: u32 = toU32(w13 >> 32)
|
|
1133
|
+
const w15: u64 = p256FiatMulxU32(x8, arg1Limb4)
|
|
1134
|
+
const x15: u32 = toU32(w15)
|
|
1135
|
+
const x16: u32 = toU32(w15 >> 32)
|
|
1136
|
+
const w17: u64 = p256FiatMulxU32(x8, arg1Limb3)
|
|
1137
|
+
const x17: u32 = toU32(w17)
|
|
1138
|
+
const x18: u32 = toU32(w17 >> 32)
|
|
1139
|
+
const w19: u64 = p256FiatMulxU32(x8, arg1Limb2)
|
|
1140
|
+
const x19: u32 = toU32(w19)
|
|
1141
|
+
const x20: u32 = toU32(w19 >> 32)
|
|
1142
|
+
const w21: u64 = p256FiatMulxU32(x8, arg1Limb1)
|
|
1143
|
+
const x21: u32 = toU32(w21)
|
|
1144
|
+
const x22: u32 = toU32(w21 >> 32)
|
|
1145
|
+
const w23: u64 = p256FiatMulxU32(x8, arg1Limb0)
|
|
1146
|
+
const x23: u32 = toU32(w23)
|
|
1147
|
+
const x24: u32 = toU32(w23 >> 32)
|
|
1148
|
+
const w25: u64 = p256FiatAddcarryxU32(0x0, x24, x21)
|
|
1149
|
+
const x25: u32 = toU32(w25)
|
|
1150
|
+
const x26: u32 = toU32(w25 >> 32)
|
|
1151
|
+
const w27: u64 = p256FiatAddcarryxU32(x26, x22, x19)
|
|
1152
|
+
const x27: u32 = toU32(w27)
|
|
1153
|
+
const x28: u32 = toU32(w27 >> 32)
|
|
1154
|
+
const w29: u64 = p256FiatAddcarryxU32(x28, x20, x17)
|
|
1155
|
+
const x29: u32 = toU32(w29)
|
|
1156
|
+
const x30: u32 = toU32(w29 >> 32)
|
|
1157
|
+
const w31: u64 = p256FiatAddcarryxU32(x30, x18, x15)
|
|
1158
|
+
const x31: u32 = toU32(w31)
|
|
1159
|
+
const x32: u32 = toU32(w31 >> 32)
|
|
1160
|
+
const w33: u64 = p256FiatAddcarryxU32(x32, x16, x13)
|
|
1161
|
+
const x33: u32 = toU32(w33)
|
|
1162
|
+
const x34: u32 = toU32(w33 >> 32)
|
|
1163
|
+
const w35: u64 = p256FiatAddcarryxU32(x34, x14, x11)
|
|
1164
|
+
const x35: u32 = toU32(w35)
|
|
1165
|
+
const x36: u32 = toU32(w35 >> 32)
|
|
1166
|
+
const w37: u64 = p256FiatAddcarryxU32(x36, x12, x9)
|
|
1167
|
+
const x37: u32 = toU32(w37)
|
|
1168
|
+
const x38: u32 = toU32(w37 >> 32)
|
|
1169
|
+
const x39: u32 = x38 + x10
|
|
1170
|
+
const w40: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
1171
|
+
const x40: u32 = toU32(w40)
|
|
1172
|
+
const x41: u32 = toU32(w40 >> 32)
|
|
1173
|
+
const w42: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
1174
|
+
const x42: u32 = toU32(w42)
|
|
1175
|
+
const x43: u32 = toU32(w42 >> 32)
|
|
1176
|
+
const w44: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
1177
|
+
const x44: u32 = toU32(w44)
|
|
1178
|
+
const x45: u32 = toU32(w44 >> 32)
|
|
1179
|
+
const w46: u64 = p256FiatMulxU32(x23, 0xffffffff)
|
|
1180
|
+
const x46: u32 = toU32(w46)
|
|
1181
|
+
const x47: u32 = toU32(w46 >> 32)
|
|
1182
|
+
const w48: u64 = p256FiatAddcarryxU32(0x0, x47, x44)
|
|
1183
|
+
const x48: u32 = toU32(w48)
|
|
1184
|
+
const x49: u32 = toU32(w48 >> 32)
|
|
1185
|
+
const w50: u64 = p256FiatAddcarryxU32(x49, x45, x42)
|
|
1186
|
+
const x50: u32 = toU32(w50)
|
|
1187
|
+
const x51: u32 = toU32(w50 >> 32)
|
|
1188
|
+
const x52: u32 = x51 + x43
|
|
1189
|
+
const w53: u64 = p256FiatAddcarryxU32(0x0, x23, x46)
|
|
1190
|
+
const x54: u32 = toU32(w53 >> 32)
|
|
1191
|
+
const w55: u64 = p256FiatAddcarryxU32(x54, x25, x48)
|
|
1192
|
+
const x55: u32 = toU32(w55)
|
|
1193
|
+
const x56: u32 = toU32(w55 >> 32)
|
|
1194
|
+
const w57: u64 = p256FiatAddcarryxU32(x56, x27, x50)
|
|
1195
|
+
const x57: u32 = toU32(w57)
|
|
1196
|
+
const x58: u32 = toU32(w57 >> 32)
|
|
1197
|
+
const w59: u64 = p256FiatAddcarryxU32(x58, x29, x52)
|
|
1198
|
+
const x59: u32 = toU32(w59)
|
|
1199
|
+
const x60: u32 = toU32(w59 >> 32)
|
|
1200
|
+
const w61: u64 = p256FiatAddcarryxU32(x60, x31, 0x0)
|
|
1201
|
+
const x61: u32 = toU32(w61)
|
|
1202
|
+
const x62: u32 = toU32(w61 >> 32)
|
|
1203
|
+
const w63: u64 = p256FiatAddcarryxU32(x62, x33, 0x0)
|
|
1204
|
+
const x63: u32 = toU32(w63)
|
|
1205
|
+
const x64: u32 = toU32(w63 >> 32)
|
|
1206
|
+
const w65: u64 = p256FiatAddcarryxU32(x64, x35, x23)
|
|
1207
|
+
const x65: u32 = toU32(w65)
|
|
1208
|
+
const x66: u32 = toU32(w65 >> 32)
|
|
1209
|
+
const w67: u64 = p256FiatAddcarryxU32(x66, x37, x40)
|
|
1210
|
+
const x67: u32 = toU32(w67)
|
|
1211
|
+
const x68: u32 = toU32(w67 >> 32)
|
|
1212
|
+
const w69: u64 = p256FiatAddcarryxU32(x68, x39, x41)
|
|
1213
|
+
const x69: u32 = toU32(w69)
|
|
1214
|
+
const x70: u32 = toU32(w69 >> 32)
|
|
1215
|
+
const w71: u64 = p256FiatMulxU32(x1, arg1Limb7)
|
|
1216
|
+
const x71: u32 = toU32(w71)
|
|
1217
|
+
const x72: u32 = toU32(w71 >> 32)
|
|
1218
|
+
const w73: u64 = p256FiatMulxU32(x1, arg1Limb6)
|
|
1219
|
+
const x73: u32 = toU32(w73)
|
|
1220
|
+
const x74: u32 = toU32(w73 >> 32)
|
|
1221
|
+
const w75: u64 = p256FiatMulxU32(x1, arg1Limb5)
|
|
1222
|
+
const x75: u32 = toU32(w75)
|
|
1223
|
+
const x76: u32 = toU32(w75 >> 32)
|
|
1224
|
+
const w77: u64 = p256FiatMulxU32(x1, arg1Limb4)
|
|
1225
|
+
const x77: u32 = toU32(w77)
|
|
1226
|
+
const x78: u32 = toU32(w77 >> 32)
|
|
1227
|
+
const w79: u64 = p256FiatMulxU32(x1, arg1Limb3)
|
|
1228
|
+
const x79: u32 = toU32(w79)
|
|
1229
|
+
const x80: u32 = toU32(w79 >> 32)
|
|
1230
|
+
const w81: u64 = p256FiatMulxU32(x1, arg1Limb2)
|
|
1231
|
+
const x81: u32 = toU32(w81)
|
|
1232
|
+
const x82: u32 = toU32(w81 >> 32)
|
|
1233
|
+
const w83: u64 = p256FiatMulxU32(x1, arg1Limb1)
|
|
1234
|
+
const x83: u32 = toU32(w83)
|
|
1235
|
+
const x84: u32 = toU32(w83 >> 32)
|
|
1236
|
+
const w85: u64 = p256FiatMulxU32(x1, arg1Limb0)
|
|
1237
|
+
const x85: u32 = toU32(w85)
|
|
1238
|
+
const x86: u32 = toU32(w85 >> 32)
|
|
1239
|
+
const w87: u64 = p256FiatAddcarryxU32(0x0, x86, x83)
|
|
1240
|
+
const x87: u32 = toU32(w87)
|
|
1241
|
+
const x88: u32 = toU32(w87 >> 32)
|
|
1242
|
+
const w89: u64 = p256FiatAddcarryxU32(x88, x84, x81)
|
|
1243
|
+
const x89: u32 = toU32(w89)
|
|
1244
|
+
const x90: u32 = toU32(w89 >> 32)
|
|
1245
|
+
const w91: u64 = p256FiatAddcarryxU32(x90, x82, x79)
|
|
1246
|
+
const x91: u32 = toU32(w91)
|
|
1247
|
+
const x92: u32 = toU32(w91 >> 32)
|
|
1248
|
+
const w93: u64 = p256FiatAddcarryxU32(x92, x80, x77)
|
|
1249
|
+
const x93: u32 = toU32(w93)
|
|
1250
|
+
const x94: u32 = toU32(w93 >> 32)
|
|
1251
|
+
const w95: u64 = p256FiatAddcarryxU32(x94, x78, x75)
|
|
1252
|
+
const x95: u32 = toU32(w95)
|
|
1253
|
+
const x96: u32 = toU32(w95 >> 32)
|
|
1254
|
+
const w97: u64 = p256FiatAddcarryxU32(x96, x76, x73)
|
|
1255
|
+
const x97: u32 = toU32(w97)
|
|
1256
|
+
const x98: u32 = toU32(w97 >> 32)
|
|
1257
|
+
const w99: u64 = p256FiatAddcarryxU32(x98, x74, x71)
|
|
1258
|
+
const x99: u32 = toU32(w99)
|
|
1259
|
+
const x100: u32 = toU32(w99 >> 32)
|
|
1260
|
+
const x101: u32 = x100 + x72
|
|
1261
|
+
const w102: u64 = p256FiatAddcarryxU32(0x0, x55, x85)
|
|
1262
|
+
const x102: u32 = toU32(w102)
|
|
1263
|
+
const x103: u32 = toU32(w102 >> 32)
|
|
1264
|
+
const w104: u64 = p256FiatAddcarryxU32(x103, x57, x87)
|
|
1265
|
+
const x104: u32 = toU32(w104)
|
|
1266
|
+
const x105: u32 = toU32(w104 >> 32)
|
|
1267
|
+
const w106: u64 = p256FiatAddcarryxU32(x105, x59, x89)
|
|
1268
|
+
const x106: u32 = toU32(w106)
|
|
1269
|
+
const x107: u32 = toU32(w106 >> 32)
|
|
1270
|
+
const w108: u64 = p256FiatAddcarryxU32(x107, x61, x91)
|
|
1271
|
+
const x108: u32 = toU32(w108)
|
|
1272
|
+
const x109: u32 = toU32(w108 >> 32)
|
|
1273
|
+
const w110: u64 = p256FiatAddcarryxU32(x109, x63, x93)
|
|
1274
|
+
const x110: u32 = toU32(w110)
|
|
1275
|
+
const x111: u32 = toU32(w110 >> 32)
|
|
1276
|
+
const w112: u64 = p256FiatAddcarryxU32(x111, x65, x95)
|
|
1277
|
+
const x112: u32 = toU32(w112)
|
|
1278
|
+
const x113: u32 = toU32(w112 >> 32)
|
|
1279
|
+
const w114: u64 = p256FiatAddcarryxU32(x113, x67, x97)
|
|
1280
|
+
const x114: u32 = toU32(w114)
|
|
1281
|
+
const x115: u32 = toU32(w114 >> 32)
|
|
1282
|
+
const w116: u64 = p256FiatAddcarryxU32(x115, x69, x99)
|
|
1283
|
+
const x116: u32 = toU32(w116)
|
|
1284
|
+
const x117: u32 = toU32(w116 >> 32)
|
|
1285
|
+
const w118: u64 = p256FiatAddcarryxU32(x117, x70, x101)
|
|
1286
|
+
const x118: u32 = toU32(w118)
|
|
1287
|
+
const x119: u32 = toU32(w118 >> 32)
|
|
1288
|
+
const w120: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
1289
|
+
const x120: u32 = toU32(w120)
|
|
1290
|
+
const x121: u32 = toU32(w120 >> 32)
|
|
1291
|
+
const w122: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
1292
|
+
const x122: u32 = toU32(w122)
|
|
1293
|
+
const x123: u32 = toU32(w122 >> 32)
|
|
1294
|
+
const w124: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
1295
|
+
const x124: u32 = toU32(w124)
|
|
1296
|
+
const x125: u32 = toU32(w124 >> 32)
|
|
1297
|
+
const w126: u64 = p256FiatMulxU32(x102, 0xffffffff)
|
|
1298
|
+
const x126: u32 = toU32(w126)
|
|
1299
|
+
const x127: u32 = toU32(w126 >> 32)
|
|
1300
|
+
const w128: u64 = p256FiatAddcarryxU32(0x0, x127, x124)
|
|
1301
|
+
const x128: u32 = toU32(w128)
|
|
1302
|
+
const x129: u32 = toU32(w128 >> 32)
|
|
1303
|
+
const w130: u64 = p256FiatAddcarryxU32(x129, x125, x122)
|
|
1304
|
+
const x130: u32 = toU32(w130)
|
|
1305
|
+
const x131: u32 = toU32(w130 >> 32)
|
|
1306
|
+
const x132: u32 = x131 + x123
|
|
1307
|
+
const w133: u64 = p256FiatAddcarryxU32(0x0, x102, x126)
|
|
1308
|
+
const x134: u32 = toU32(w133 >> 32)
|
|
1309
|
+
const w135: u64 = p256FiatAddcarryxU32(x134, x104, x128)
|
|
1310
|
+
const x135: u32 = toU32(w135)
|
|
1311
|
+
const x136: u32 = toU32(w135 >> 32)
|
|
1312
|
+
const w137: u64 = p256FiatAddcarryxU32(x136, x106, x130)
|
|
1313
|
+
const x137: u32 = toU32(w137)
|
|
1314
|
+
const x138: u32 = toU32(w137 >> 32)
|
|
1315
|
+
const w139: u64 = p256FiatAddcarryxU32(x138, x108, x132)
|
|
1316
|
+
const x139: u32 = toU32(w139)
|
|
1317
|
+
const x140: u32 = toU32(w139 >> 32)
|
|
1318
|
+
const w141: u64 = p256FiatAddcarryxU32(x140, x110, 0x0)
|
|
1319
|
+
const x141: u32 = toU32(w141)
|
|
1320
|
+
const x142: u32 = toU32(w141 >> 32)
|
|
1321
|
+
const w143: u64 = p256FiatAddcarryxU32(x142, x112, 0x0)
|
|
1322
|
+
const x143: u32 = toU32(w143)
|
|
1323
|
+
const x144: u32 = toU32(w143 >> 32)
|
|
1324
|
+
const w145: u64 = p256FiatAddcarryxU32(x144, x114, x102)
|
|
1325
|
+
const x145: u32 = toU32(w145)
|
|
1326
|
+
const x146: u32 = toU32(w145 >> 32)
|
|
1327
|
+
const w147: u64 = p256FiatAddcarryxU32(x146, x116, x120)
|
|
1328
|
+
const x147: u32 = toU32(w147)
|
|
1329
|
+
const x148: u32 = toU32(w147 >> 32)
|
|
1330
|
+
const w149: u64 = p256FiatAddcarryxU32(x148, x118, x121)
|
|
1331
|
+
const x149: u32 = toU32(w149)
|
|
1332
|
+
const x150: u32 = toU32(w149 >> 32)
|
|
1333
|
+
const x151: u32 = x150 + x119
|
|
1334
|
+
const w152: u64 = p256FiatMulxU32(x2, arg1Limb7)
|
|
1335
|
+
const x152: u32 = toU32(w152)
|
|
1336
|
+
const x153: u32 = toU32(w152 >> 32)
|
|
1337
|
+
const w154: u64 = p256FiatMulxU32(x2, arg1Limb6)
|
|
1338
|
+
const x154: u32 = toU32(w154)
|
|
1339
|
+
const x155: u32 = toU32(w154 >> 32)
|
|
1340
|
+
const w156: u64 = p256FiatMulxU32(x2, arg1Limb5)
|
|
1341
|
+
const x156: u32 = toU32(w156)
|
|
1342
|
+
const x157: u32 = toU32(w156 >> 32)
|
|
1343
|
+
const w158: u64 = p256FiatMulxU32(x2, arg1Limb4)
|
|
1344
|
+
const x158: u32 = toU32(w158)
|
|
1345
|
+
const x159: u32 = toU32(w158 >> 32)
|
|
1346
|
+
const w160: u64 = p256FiatMulxU32(x2, arg1Limb3)
|
|
1347
|
+
const x160: u32 = toU32(w160)
|
|
1348
|
+
const x161: u32 = toU32(w160 >> 32)
|
|
1349
|
+
const w162: u64 = p256FiatMulxU32(x2, arg1Limb2)
|
|
1350
|
+
const x162: u32 = toU32(w162)
|
|
1351
|
+
const x163: u32 = toU32(w162 >> 32)
|
|
1352
|
+
const w164: u64 = p256FiatMulxU32(x2, arg1Limb1)
|
|
1353
|
+
const x164: u32 = toU32(w164)
|
|
1354
|
+
const x165: u32 = toU32(w164 >> 32)
|
|
1355
|
+
const w166: u64 = p256FiatMulxU32(x2, arg1Limb0)
|
|
1356
|
+
const x166: u32 = toU32(w166)
|
|
1357
|
+
const x167: u32 = toU32(w166 >> 32)
|
|
1358
|
+
const w168: u64 = p256FiatAddcarryxU32(0x0, x167, x164)
|
|
1359
|
+
const x168: u32 = toU32(w168)
|
|
1360
|
+
const x169: u32 = toU32(w168 >> 32)
|
|
1361
|
+
const w170: u64 = p256FiatAddcarryxU32(x169, x165, x162)
|
|
1362
|
+
const x170: u32 = toU32(w170)
|
|
1363
|
+
const x171: u32 = toU32(w170 >> 32)
|
|
1364
|
+
const w172: u64 = p256FiatAddcarryxU32(x171, x163, x160)
|
|
1365
|
+
const x172: u32 = toU32(w172)
|
|
1366
|
+
const x173: u32 = toU32(w172 >> 32)
|
|
1367
|
+
const w174: u64 = p256FiatAddcarryxU32(x173, x161, x158)
|
|
1368
|
+
const x174: u32 = toU32(w174)
|
|
1369
|
+
const x175: u32 = toU32(w174 >> 32)
|
|
1370
|
+
const w176: u64 = p256FiatAddcarryxU32(x175, x159, x156)
|
|
1371
|
+
const x176: u32 = toU32(w176)
|
|
1372
|
+
const x177: u32 = toU32(w176 >> 32)
|
|
1373
|
+
const w178: u64 = p256FiatAddcarryxU32(x177, x157, x154)
|
|
1374
|
+
const x178: u32 = toU32(w178)
|
|
1375
|
+
const x179: u32 = toU32(w178 >> 32)
|
|
1376
|
+
const w180: u64 = p256FiatAddcarryxU32(x179, x155, x152)
|
|
1377
|
+
const x180: u32 = toU32(w180)
|
|
1378
|
+
const x181: u32 = toU32(w180 >> 32)
|
|
1379
|
+
const x182: u32 = x181 + x153
|
|
1380
|
+
const w183: u64 = p256FiatAddcarryxU32(0x0, x135, x166)
|
|
1381
|
+
const x183: u32 = toU32(w183)
|
|
1382
|
+
const x184: u32 = toU32(w183 >> 32)
|
|
1383
|
+
const w185: u64 = p256FiatAddcarryxU32(x184, x137, x168)
|
|
1384
|
+
const x185: u32 = toU32(w185)
|
|
1385
|
+
const x186: u32 = toU32(w185 >> 32)
|
|
1386
|
+
const w187: u64 = p256FiatAddcarryxU32(x186, x139, x170)
|
|
1387
|
+
const x187: u32 = toU32(w187)
|
|
1388
|
+
const x188: u32 = toU32(w187 >> 32)
|
|
1389
|
+
const w189: u64 = p256FiatAddcarryxU32(x188, x141, x172)
|
|
1390
|
+
const x189: u32 = toU32(w189)
|
|
1391
|
+
const x190: u32 = toU32(w189 >> 32)
|
|
1392
|
+
const w191: u64 = p256FiatAddcarryxU32(x190, x143, x174)
|
|
1393
|
+
const x191: u32 = toU32(w191)
|
|
1394
|
+
const x192: u32 = toU32(w191 >> 32)
|
|
1395
|
+
const w193: u64 = p256FiatAddcarryxU32(x192, x145, x176)
|
|
1396
|
+
const x193: u32 = toU32(w193)
|
|
1397
|
+
const x194: u32 = toU32(w193 >> 32)
|
|
1398
|
+
const w195: u64 = p256FiatAddcarryxU32(x194, x147, x178)
|
|
1399
|
+
const x195: u32 = toU32(w195)
|
|
1400
|
+
const x196: u32 = toU32(w195 >> 32)
|
|
1401
|
+
const w197: u64 = p256FiatAddcarryxU32(x196, x149, x180)
|
|
1402
|
+
const x197: u32 = toU32(w197)
|
|
1403
|
+
const x198: u32 = toU32(w197 >> 32)
|
|
1404
|
+
const w199: u64 = p256FiatAddcarryxU32(x198, x151, x182)
|
|
1405
|
+
const x199: u32 = toU32(w199)
|
|
1406
|
+
const x200: u32 = toU32(w199 >> 32)
|
|
1407
|
+
const w201: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
1408
|
+
const x201: u32 = toU32(w201)
|
|
1409
|
+
const x202: u32 = toU32(w201 >> 32)
|
|
1410
|
+
const w203: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
1411
|
+
const x203: u32 = toU32(w203)
|
|
1412
|
+
const x204: u32 = toU32(w203 >> 32)
|
|
1413
|
+
const w205: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
1414
|
+
const x205: u32 = toU32(w205)
|
|
1415
|
+
const x206: u32 = toU32(w205 >> 32)
|
|
1416
|
+
const w207: u64 = p256FiatMulxU32(x183, 0xffffffff)
|
|
1417
|
+
const x207: u32 = toU32(w207)
|
|
1418
|
+
const x208: u32 = toU32(w207 >> 32)
|
|
1419
|
+
const w209: u64 = p256FiatAddcarryxU32(0x0, x208, x205)
|
|
1420
|
+
const x209: u32 = toU32(w209)
|
|
1421
|
+
const x210: u32 = toU32(w209 >> 32)
|
|
1422
|
+
const w211: u64 = p256FiatAddcarryxU32(x210, x206, x203)
|
|
1423
|
+
const x211: u32 = toU32(w211)
|
|
1424
|
+
const x212: u32 = toU32(w211 >> 32)
|
|
1425
|
+
const x213: u32 = x212 + x204
|
|
1426
|
+
const w214: u64 = p256FiatAddcarryxU32(0x0, x183, x207)
|
|
1427
|
+
const x215: u32 = toU32(w214 >> 32)
|
|
1428
|
+
const w216: u64 = p256FiatAddcarryxU32(x215, x185, x209)
|
|
1429
|
+
const x216: u32 = toU32(w216)
|
|
1430
|
+
const x217: u32 = toU32(w216 >> 32)
|
|
1431
|
+
const w218: u64 = p256FiatAddcarryxU32(x217, x187, x211)
|
|
1432
|
+
const x218: u32 = toU32(w218)
|
|
1433
|
+
const x219: u32 = toU32(w218 >> 32)
|
|
1434
|
+
const w220: u64 = p256FiatAddcarryxU32(x219, x189, x213)
|
|
1435
|
+
const x220: u32 = toU32(w220)
|
|
1436
|
+
const x221: u32 = toU32(w220 >> 32)
|
|
1437
|
+
const w222: u64 = p256FiatAddcarryxU32(x221, x191, 0x0)
|
|
1438
|
+
const x222: u32 = toU32(w222)
|
|
1439
|
+
const x223: u32 = toU32(w222 >> 32)
|
|
1440
|
+
const w224: u64 = p256FiatAddcarryxU32(x223, x193, 0x0)
|
|
1441
|
+
const x224: u32 = toU32(w224)
|
|
1442
|
+
const x225: u32 = toU32(w224 >> 32)
|
|
1443
|
+
const w226: u64 = p256FiatAddcarryxU32(x225, x195, x183)
|
|
1444
|
+
const x226: u32 = toU32(w226)
|
|
1445
|
+
const x227: u32 = toU32(w226 >> 32)
|
|
1446
|
+
const w228: u64 = p256FiatAddcarryxU32(x227, x197, x201)
|
|
1447
|
+
const x228: u32 = toU32(w228)
|
|
1448
|
+
const x229: u32 = toU32(w228 >> 32)
|
|
1449
|
+
const w230: u64 = p256FiatAddcarryxU32(x229, x199, x202)
|
|
1450
|
+
const x230: u32 = toU32(w230)
|
|
1451
|
+
const x231: u32 = toU32(w230 >> 32)
|
|
1452
|
+
const x232: u32 = x231 + x200
|
|
1453
|
+
const w233: u64 = p256FiatMulxU32(x3, arg1Limb7)
|
|
1454
|
+
const x233: u32 = toU32(w233)
|
|
1455
|
+
const x234: u32 = toU32(w233 >> 32)
|
|
1456
|
+
const w235: u64 = p256FiatMulxU32(x3, arg1Limb6)
|
|
1457
|
+
const x235: u32 = toU32(w235)
|
|
1458
|
+
const x236: u32 = toU32(w235 >> 32)
|
|
1459
|
+
const w237: u64 = p256FiatMulxU32(x3, arg1Limb5)
|
|
1460
|
+
const x237: u32 = toU32(w237)
|
|
1461
|
+
const x238: u32 = toU32(w237 >> 32)
|
|
1462
|
+
const w239: u64 = p256FiatMulxU32(x3, arg1Limb4)
|
|
1463
|
+
const x239: u32 = toU32(w239)
|
|
1464
|
+
const x240: u32 = toU32(w239 >> 32)
|
|
1465
|
+
const w241: u64 = p256FiatMulxU32(x3, arg1Limb3)
|
|
1466
|
+
const x241: u32 = toU32(w241)
|
|
1467
|
+
const x242: u32 = toU32(w241 >> 32)
|
|
1468
|
+
const w243: u64 = p256FiatMulxU32(x3, arg1Limb2)
|
|
1469
|
+
const x243: u32 = toU32(w243)
|
|
1470
|
+
const x244: u32 = toU32(w243 >> 32)
|
|
1471
|
+
const w245: u64 = p256FiatMulxU32(x3, arg1Limb1)
|
|
1472
|
+
const x245: u32 = toU32(w245)
|
|
1473
|
+
const x246: u32 = toU32(w245 >> 32)
|
|
1474
|
+
const w247: u64 = p256FiatMulxU32(x3, arg1Limb0)
|
|
1475
|
+
const x247: u32 = toU32(w247)
|
|
1476
|
+
const x248: u32 = toU32(w247 >> 32)
|
|
1477
|
+
const w249: u64 = p256FiatAddcarryxU32(0x0, x248, x245)
|
|
1478
|
+
const x249: u32 = toU32(w249)
|
|
1479
|
+
const x250: u32 = toU32(w249 >> 32)
|
|
1480
|
+
const w251: u64 = p256FiatAddcarryxU32(x250, x246, x243)
|
|
1481
|
+
const x251: u32 = toU32(w251)
|
|
1482
|
+
const x252: u32 = toU32(w251 >> 32)
|
|
1483
|
+
const w253: u64 = p256FiatAddcarryxU32(x252, x244, x241)
|
|
1484
|
+
const x253: u32 = toU32(w253)
|
|
1485
|
+
const x254: u32 = toU32(w253 >> 32)
|
|
1486
|
+
const w255: u64 = p256FiatAddcarryxU32(x254, x242, x239)
|
|
1487
|
+
const x255: u32 = toU32(w255)
|
|
1488
|
+
const x256: u32 = toU32(w255 >> 32)
|
|
1489
|
+
const w257: u64 = p256FiatAddcarryxU32(x256, x240, x237)
|
|
1490
|
+
const x257: u32 = toU32(w257)
|
|
1491
|
+
const x258: u32 = toU32(w257 >> 32)
|
|
1492
|
+
const w259: u64 = p256FiatAddcarryxU32(x258, x238, x235)
|
|
1493
|
+
const x259: u32 = toU32(w259)
|
|
1494
|
+
const x260: u32 = toU32(w259 >> 32)
|
|
1495
|
+
const w261: u64 = p256FiatAddcarryxU32(x260, x236, x233)
|
|
1496
|
+
const x261: u32 = toU32(w261)
|
|
1497
|
+
const x262: u32 = toU32(w261 >> 32)
|
|
1498
|
+
const x263: u32 = x262 + x234
|
|
1499
|
+
const w264: u64 = p256FiatAddcarryxU32(0x0, x216, x247)
|
|
1500
|
+
const x264: u32 = toU32(w264)
|
|
1501
|
+
const x265: u32 = toU32(w264 >> 32)
|
|
1502
|
+
const w266: u64 = p256FiatAddcarryxU32(x265, x218, x249)
|
|
1503
|
+
const x266: u32 = toU32(w266)
|
|
1504
|
+
const x267: u32 = toU32(w266 >> 32)
|
|
1505
|
+
const w268: u64 = p256FiatAddcarryxU32(x267, x220, x251)
|
|
1506
|
+
const x268: u32 = toU32(w268)
|
|
1507
|
+
const x269: u32 = toU32(w268 >> 32)
|
|
1508
|
+
const w270: u64 = p256FiatAddcarryxU32(x269, x222, x253)
|
|
1509
|
+
const x270: u32 = toU32(w270)
|
|
1510
|
+
const x271: u32 = toU32(w270 >> 32)
|
|
1511
|
+
const w272: u64 = p256FiatAddcarryxU32(x271, x224, x255)
|
|
1512
|
+
const x272: u32 = toU32(w272)
|
|
1513
|
+
const x273: u32 = toU32(w272 >> 32)
|
|
1514
|
+
const w274: u64 = p256FiatAddcarryxU32(x273, x226, x257)
|
|
1515
|
+
const x274: u32 = toU32(w274)
|
|
1516
|
+
const x275: u32 = toU32(w274 >> 32)
|
|
1517
|
+
const w276: u64 = p256FiatAddcarryxU32(x275, x228, x259)
|
|
1518
|
+
const x276: u32 = toU32(w276)
|
|
1519
|
+
const x277: u32 = toU32(w276 >> 32)
|
|
1520
|
+
const w278: u64 = p256FiatAddcarryxU32(x277, x230, x261)
|
|
1521
|
+
const x278: u32 = toU32(w278)
|
|
1522
|
+
const x279: u32 = toU32(w278 >> 32)
|
|
1523
|
+
const w280: u64 = p256FiatAddcarryxU32(x279, x232, x263)
|
|
1524
|
+
const x280: u32 = toU32(w280)
|
|
1525
|
+
const x281: u32 = toU32(w280 >> 32)
|
|
1526
|
+
const w282: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
1527
|
+
const x282: u32 = toU32(w282)
|
|
1528
|
+
const x283: u32 = toU32(w282 >> 32)
|
|
1529
|
+
const w284: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
1530
|
+
const x284: u32 = toU32(w284)
|
|
1531
|
+
const x285: u32 = toU32(w284 >> 32)
|
|
1532
|
+
const w286: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
1533
|
+
const x286: u32 = toU32(w286)
|
|
1534
|
+
const x287: u32 = toU32(w286 >> 32)
|
|
1535
|
+
const w288: u64 = p256FiatMulxU32(x264, 0xffffffff)
|
|
1536
|
+
const x288: u32 = toU32(w288)
|
|
1537
|
+
const x289: u32 = toU32(w288 >> 32)
|
|
1538
|
+
const w290: u64 = p256FiatAddcarryxU32(0x0, x289, x286)
|
|
1539
|
+
const x290: u32 = toU32(w290)
|
|
1540
|
+
const x291: u32 = toU32(w290 >> 32)
|
|
1541
|
+
const w292: u64 = p256FiatAddcarryxU32(x291, x287, x284)
|
|
1542
|
+
const x292: u32 = toU32(w292)
|
|
1543
|
+
const x293: u32 = toU32(w292 >> 32)
|
|
1544
|
+
const x294: u32 = x293 + x285
|
|
1545
|
+
const w295: u64 = p256FiatAddcarryxU32(0x0, x264, x288)
|
|
1546
|
+
const x296: u32 = toU32(w295 >> 32)
|
|
1547
|
+
const w297: u64 = p256FiatAddcarryxU32(x296, x266, x290)
|
|
1548
|
+
const x297: u32 = toU32(w297)
|
|
1549
|
+
const x298: u32 = toU32(w297 >> 32)
|
|
1550
|
+
const w299: u64 = p256FiatAddcarryxU32(x298, x268, x292)
|
|
1551
|
+
const x299: u32 = toU32(w299)
|
|
1552
|
+
const x300: u32 = toU32(w299 >> 32)
|
|
1553
|
+
const w301: u64 = p256FiatAddcarryxU32(x300, x270, x294)
|
|
1554
|
+
const x301: u32 = toU32(w301)
|
|
1555
|
+
const x302: u32 = toU32(w301 >> 32)
|
|
1556
|
+
const w303: u64 = p256FiatAddcarryxU32(x302, x272, 0x0)
|
|
1557
|
+
const x303: u32 = toU32(w303)
|
|
1558
|
+
const x304: u32 = toU32(w303 >> 32)
|
|
1559
|
+
const w305: u64 = p256FiatAddcarryxU32(x304, x274, 0x0)
|
|
1560
|
+
const x305: u32 = toU32(w305)
|
|
1561
|
+
const x306: u32 = toU32(w305 >> 32)
|
|
1562
|
+
const w307: u64 = p256FiatAddcarryxU32(x306, x276, x264)
|
|
1563
|
+
const x307: u32 = toU32(w307)
|
|
1564
|
+
const x308: u32 = toU32(w307 >> 32)
|
|
1565
|
+
const w309: u64 = p256FiatAddcarryxU32(x308, x278, x282)
|
|
1566
|
+
const x309: u32 = toU32(w309)
|
|
1567
|
+
const x310: u32 = toU32(w309 >> 32)
|
|
1568
|
+
const w311: u64 = p256FiatAddcarryxU32(x310, x280, x283)
|
|
1569
|
+
const x311: u32 = toU32(w311)
|
|
1570
|
+
const x312: u32 = toU32(w311 >> 32)
|
|
1571
|
+
const x313: u32 = x312 + x281
|
|
1572
|
+
const w314: u64 = p256FiatMulxU32(x4, arg1Limb7)
|
|
1573
|
+
const x314: u32 = toU32(w314)
|
|
1574
|
+
const x315: u32 = toU32(w314 >> 32)
|
|
1575
|
+
const w316: u64 = p256FiatMulxU32(x4, arg1Limb6)
|
|
1576
|
+
const x316: u32 = toU32(w316)
|
|
1577
|
+
const x317: u32 = toU32(w316 >> 32)
|
|
1578
|
+
const w318: u64 = p256FiatMulxU32(x4, arg1Limb5)
|
|
1579
|
+
const x318: u32 = toU32(w318)
|
|
1580
|
+
const x319: u32 = toU32(w318 >> 32)
|
|
1581
|
+
const w320: u64 = p256FiatMulxU32(x4, arg1Limb4)
|
|
1582
|
+
const x320: u32 = toU32(w320)
|
|
1583
|
+
const x321: u32 = toU32(w320 >> 32)
|
|
1584
|
+
const w322: u64 = p256FiatMulxU32(x4, arg1Limb3)
|
|
1585
|
+
const x322: u32 = toU32(w322)
|
|
1586
|
+
const x323: u32 = toU32(w322 >> 32)
|
|
1587
|
+
const w324: u64 = p256FiatMulxU32(x4, arg1Limb2)
|
|
1588
|
+
const x324: u32 = toU32(w324)
|
|
1589
|
+
const x325: u32 = toU32(w324 >> 32)
|
|
1590
|
+
const w326: u64 = p256FiatMulxU32(x4, arg1Limb1)
|
|
1591
|
+
const x326: u32 = toU32(w326)
|
|
1592
|
+
const x327: u32 = toU32(w326 >> 32)
|
|
1593
|
+
const w328: u64 = p256FiatMulxU32(x4, arg1Limb0)
|
|
1594
|
+
const x328: u32 = toU32(w328)
|
|
1595
|
+
const x329: u32 = toU32(w328 >> 32)
|
|
1596
|
+
const w330: u64 = p256FiatAddcarryxU32(0x0, x329, x326)
|
|
1597
|
+
const x330: u32 = toU32(w330)
|
|
1598
|
+
const x331: u32 = toU32(w330 >> 32)
|
|
1599
|
+
const w332: u64 = p256FiatAddcarryxU32(x331, x327, x324)
|
|
1600
|
+
const x332: u32 = toU32(w332)
|
|
1601
|
+
const x333: u32 = toU32(w332 >> 32)
|
|
1602
|
+
const w334: u64 = p256FiatAddcarryxU32(x333, x325, x322)
|
|
1603
|
+
const x334: u32 = toU32(w334)
|
|
1604
|
+
const x335: u32 = toU32(w334 >> 32)
|
|
1605
|
+
const w336: u64 = p256FiatAddcarryxU32(x335, x323, x320)
|
|
1606
|
+
const x336: u32 = toU32(w336)
|
|
1607
|
+
const x337: u32 = toU32(w336 >> 32)
|
|
1608
|
+
const w338: u64 = p256FiatAddcarryxU32(x337, x321, x318)
|
|
1609
|
+
const x338: u32 = toU32(w338)
|
|
1610
|
+
const x339: u32 = toU32(w338 >> 32)
|
|
1611
|
+
const w340: u64 = p256FiatAddcarryxU32(x339, x319, x316)
|
|
1612
|
+
const x340: u32 = toU32(w340)
|
|
1613
|
+
const x341: u32 = toU32(w340 >> 32)
|
|
1614
|
+
const w342: u64 = p256FiatAddcarryxU32(x341, x317, x314)
|
|
1615
|
+
const x342: u32 = toU32(w342)
|
|
1616
|
+
const x343: u32 = toU32(w342 >> 32)
|
|
1617
|
+
const x344: u32 = x343 + x315
|
|
1618
|
+
const w345: u64 = p256FiatAddcarryxU32(0x0, x297, x328)
|
|
1619
|
+
const x345: u32 = toU32(w345)
|
|
1620
|
+
const x346: u32 = toU32(w345 >> 32)
|
|
1621
|
+
const w347: u64 = p256FiatAddcarryxU32(x346, x299, x330)
|
|
1622
|
+
const x347: u32 = toU32(w347)
|
|
1623
|
+
const x348: u32 = toU32(w347 >> 32)
|
|
1624
|
+
const w349: u64 = p256FiatAddcarryxU32(x348, x301, x332)
|
|
1625
|
+
const x349: u32 = toU32(w349)
|
|
1626
|
+
const x350: u32 = toU32(w349 >> 32)
|
|
1627
|
+
const w351: u64 = p256FiatAddcarryxU32(x350, x303, x334)
|
|
1628
|
+
const x351: u32 = toU32(w351)
|
|
1629
|
+
const x352: u32 = toU32(w351 >> 32)
|
|
1630
|
+
const w353: u64 = p256FiatAddcarryxU32(x352, x305, x336)
|
|
1631
|
+
const x353: u32 = toU32(w353)
|
|
1632
|
+
const x354: u32 = toU32(w353 >> 32)
|
|
1633
|
+
const w355: u64 = p256FiatAddcarryxU32(x354, x307, x338)
|
|
1634
|
+
const x355: u32 = toU32(w355)
|
|
1635
|
+
const x356: u32 = toU32(w355 >> 32)
|
|
1636
|
+
const w357: u64 = p256FiatAddcarryxU32(x356, x309, x340)
|
|
1637
|
+
const x357: u32 = toU32(w357)
|
|
1638
|
+
const x358: u32 = toU32(w357 >> 32)
|
|
1639
|
+
const w359: u64 = p256FiatAddcarryxU32(x358, x311, x342)
|
|
1640
|
+
const x359: u32 = toU32(w359)
|
|
1641
|
+
const x360: u32 = toU32(w359 >> 32)
|
|
1642
|
+
const w361: u64 = p256FiatAddcarryxU32(x360, x313, x344)
|
|
1643
|
+
const x361: u32 = toU32(w361)
|
|
1644
|
+
const x362: u32 = toU32(w361 >> 32)
|
|
1645
|
+
const w363: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
1646
|
+
const x363: u32 = toU32(w363)
|
|
1647
|
+
const x364: u32 = toU32(w363 >> 32)
|
|
1648
|
+
const w365: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
1649
|
+
const x365: u32 = toU32(w365)
|
|
1650
|
+
const x366: u32 = toU32(w365 >> 32)
|
|
1651
|
+
const w367: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
1652
|
+
const x367: u32 = toU32(w367)
|
|
1653
|
+
const x368: u32 = toU32(w367 >> 32)
|
|
1654
|
+
const w369: u64 = p256FiatMulxU32(x345, 0xffffffff)
|
|
1655
|
+
const x369: u32 = toU32(w369)
|
|
1656
|
+
const x370: u32 = toU32(w369 >> 32)
|
|
1657
|
+
const w371: u64 = p256FiatAddcarryxU32(0x0, x370, x367)
|
|
1658
|
+
const x371: u32 = toU32(w371)
|
|
1659
|
+
const x372: u32 = toU32(w371 >> 32)
|
|
1660
|
+
const w373: u64 = p256FiatAddcarryxU32(x372, x368, x365)
|
|
1661
|
+
const x373: u32 = toU32(w373)
|
|
1662
|
+
const x374: u32 = toU32(w373 >> 32)
|
|
1663
|
+
const x375: u32 = x374 + x366
|
|
1664
|
+
const w376: u64 = p256FiatAddcarryxU32(0x0, x345, x369)
|
|
1665
|
+
const x377: u32 = toU32(w376 >> 32)
|
|
1666
|
+
const w378: u64 = p256FiatAddcarryxU32(x377, x347, x371)
|
|
1667
|
+
const x378: u32 = toU32(w378)
|
|
1668
|
+
const x379: u32 = toU32(w378 >> 32)
|
|
1669
|
+
const w380: u64 = p256FiatAddcarryxU32(x379, x349, x373)
|
|
1670
|
+
const x380: u32 = toU32(w380)
|
|
1671
|
+
const x381: u32 = toU32(w380 >> 32)
|
|
1672
|
+
const w382: u64 = p256FiatAddcarryxU32(x381, x351, x375)
|
|
1673
|
+
const x382: u32 = toU32(w382)
|
|
1674
|
+
const x383: u32 = toU32(w382 >> 32)
|
|
1675
|
+
const w384: u64 = p256FiatAddcarryxU32(x383, x353, 0x0)
|
|
1676
|
+
const x384: u32 = toU32(w384)
|
|
1677
|
+
const x385: u32 = toU32(w384 >> 32)
|
|
1678
|
+
const w386: u64 = p256FiatAddcarryxU32(x385, x355, 0x0)
|
|
1679
|
+
const x386: u32 = toU32(w386)
|
|
1680
|
+
const x387: u32 = toU32(w386 >> 32)
|
|
1681
|
+
const w388: u64 = p256FiatAddcarryxU32(x387, x357, x345)
|
|
1682
|
+
const x388: u32 = toU32(w388)
|
|
1683
|
+
const x389: u32 = toU32(w388 >> 32)
|
|
1684
|
+
const w390: u64 = p256FiatAddcarryxU32(x389, x359, x363)
|
|
1685
|
+
const x390: u32 = toU32(w390)
|
|
1686
|
+
const x391: u32 = toU32(w390 >> 32)
|
|
1687
|
+
const w392: u64 = p256FiatAddcarryxU32(x391, x361, x364)
|
|
1688
|
+
const x392: u32 = toU32(w392)
|
|
1689
|
+
const x393: u32 = toU32(w392 >> 32)
|
|
1690
|
+
const x394: u32 = x393 + x362
|
|
1691
|
+
const w395: u64 = p256FiatMulxU32(x5, arg1Limb7)
|
|
1692
|
+
const x395: u32 = toU32(w395)
|
|
1693
|
+
const x396: u32 = toU32(w395 >> 32)
|
|
1694
|
+
const w397: u64 = p256FiatMulxU32(x5, arg1Limb6)
|
|
1695
|
+
const x397: u32 = toU32(w397)
|
|
1696
|
+
const x398: u32 = toU32(w397 >> 32)
|
|
1697
|
+
const w399: u64 = p256FiatMulxU32(x5, arg1Limb5)
|
|
1698
|
+
const x399: u32 = toU32(w399)
|
|
1699
|
+
const x400: u32 = toU32(w399 >> 32)
|
|
1700
|
+
const w401: u64 = p256FiatMulxU32(x5, arg1Limb4)
|
|
1701
|
+
const x401: u32 = toU32(w401)
|
|
1702
|
+
const x402: u32 = toU32(w401 >> 32)
|
|
1703
|
+
const w403: u64 = p256FiatMulxU32(x5, arg1Limb3)
|
|
1704
|
+
const x403: u32 = toU32(w403)
|
|
1705
|
+
const x404: u32 = toU32(w403 >> 32)
|
|
1706
|
+
const w405: u64 = p256FiatMulxU32(x5, arg1Limb2)
|
|
1707
|
+
const x405: u32 = toU32(w405)
|
|
1708
|
+
const x406: u32 = toU32(w405 >> 32)
|
|
1709
|
+
const w407: u64 = p256FiatMulxU32(x5, arg1Limb1)
|
|
1710
|
+
const x407: u32 = toU32(w407)
|
|
1711
|
+
const x408: u32 = toU32(w407 >> 32)
|
|
1712
|
+
const w409: u64 = p256FiatMulxU32(x5, arg1Limb0)
|
|
1713
|
+
const x409: u32 = toU32(w409)
|
|
1714
|
+
const x410: u32 = toU32(w409 >> 32)
|
|
1715
|
+
const w411: u64 = p256FiatAddcarryxU32(0x0, x410, x407)
|
|
1716
|
+
const x411: u32 = toU32(w411)
|
|
1717
|
+
const x412: u32 = toU32(w411 >> 32)
|
|
1718
|
+
const w413: u64 = p256FiatAddcarryxU32(x412, x408, x405)
|
|
1719
|
+
const x413: u32 = toU32(w413)
|
|
1720
|
+
const x414: u32 = toU32(w413 >> 32)
|
|
1721
|
+
const w415: u64 = p256FiatAddcarryxU32(x414, x406, x403)
|
|
1722
|
+
const x415: u32 = toU32(w415)
|
|
1723
|
+
const x416: u32 = toU32(w415 >> 32)
|
|
1724
|
+
const w417: u64 = p256FiatAddcarryxU32(x416, x404, x401)
|
|
1725
|
+
const x417: u32 = toU32(w417)
|
|
1726
|
+
const x418: u32 = toU32(w417 >> 32)
|
|
1727
|
+
const w419: u64 = p256FiatAddcarryxU32(x418, x402, x399)
|
|
1728
|
+
const x419: u32 = toU32(w419)
|
|
1729
|
+
const x420: u32 = toU32(w419 >> 32)
|
|
1730
|
+
const w421: u64 = p256FiatAddcarryxU32(x420, x400, x397)
|
|
1731
|
+
const x421: u32 = toU32(w421)
|
|
1732
|
+
const x422: u32 = toU32(w421 >> 32)
|
|
1733
|
+
const w423: u64 = p256FiatAddcarryxU32(x422, x398, x395)
|
|
1734
|
+
const x423: u32 = toU32(w423)
|
|
1735
|
+
const x424: u32 = toU32(w423 >> 32)
|
|
1736
|
+
const x425: u32 = x424 + x396
|
|
1737
|
+
const w426: u64 = p256FiatAddcarryxU32(0x0, x378, x409)
|
|
1738
|
+
const x426: u32 = toU32(w426)
|
|
1739
|
+
const x427: u32 = toU32(w426 >> 32)
|
|
1740
|
+
const w428: u64 = p256FiatAddcarryxU32(x427, x380, x411)
|
|
1741
|
+
const x428: u32 = toU32(w428)
|
|
1742
|
+
const x429: u32 = toU32(w428 >> 32)
|
|
1743
|
+
const w430: u64 = p256FiatAddcarryxU32(x429, x382, x413)
|
|
1744
|
+
const x430: u32 = toU32(w430)
|
|
1745
|
+
const x431: u32 = toU32(w430 >> 32)
|
|
1746
|
+
const w432: u64 = p256FiatAddcarryxU32(x431, x384, x415)
|
|
1747
|
+
const x432: u32 = toU32(w432)
|
|
1748
|
+
const x433: u32 = toU32(w432 >> 32)
|
|
1749
|
+
const w434: u64 = p256FiatAddcarryxU32(x433, x386, x417)
|
|
1750
|
+
const x434: u32 = toU32(w434)
|
|
1751
|
+
const x435: u32 = toU32(w434 >> 32)
|
|
1752
|
+
const w436: u64 = p256FiatAddcarryxU32(x435, x388, x419)
|
|
1753
|
+
const x436: u32 = toU32(w436)
|
|
1754
|
+
const x437: u32 = toU32(w436 >> 32)
|
|
1755
|
+
const w438: u64 = p256FiatAddcarryxU32(x437, x390, x421)
|
|
1756
|
+
const x438: u32 = toU32(w438)
|
|
1757
|
+
const x439: u32 = toU32(w438 >> 32)
|
|
1758
|
+
const w440: u64 = p256FiatAddcarryxU32(x439, x392, x423)
|
|
1759
|
+
const x440: u32 = toU32(w440)
|
|
1760
|
+
const x441: u32 = toU32(w440 >> 32)
|
|
1761
|
+
const w442: u64 = p256FiatAddcarryxU32(x441, x394, x425)
|
|
1762
|
+
const x442: u32 = toU32(w442)
|
|
1763
|
+
const x443: u32 = toU32(w442 >> 32)
|
|
1764
|
+
const w444: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
1765
|
+
const x444: u32 = toU32(w444)
|
|
1766
|
+
const x445: u32 = toU32(w444 >> 32)
|
|
1767
|
+
const w446: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
1768
|
+
const x446: u32 = toU32(w446)
|
|
1769
|
+
const x447: u32 = toU32(w446 >> 32)
|
|
1770
|
+
const w448: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
1771
|
+
const x448: u32 = toU32(w448)
|
|
1772
|
+
const x449: u32 = toU32(w448 >> 32)
|
|
1773
|
+
const w450: u64 = p256FiatMulxU32(x426, 0xffffffff)
|
|
1774
|
+
const x450: u32 = toU32(w450)
|
|
1775
|
+
const x451: u32 = toU32(w450 >> 32)
|
|
1776
|
+
const w452: u64 = p256FiatAddcarryxU32(0x0, x451, x448)
|
|
1777
|
+
const x452: u32 = toU32(w452)
|
|
1778
|
+
const x453: u32 = toU32(w452 >> 32)
|
|
1779
|
+
const w454: u64 = p256FiatAddcarryxU32(x453, x449, x446)
|
|
1780
|
+
const x454: u32 = toU32(w454)
|
|
1781
|
+
const x455: u32 = toU32(w454 >> 32)
|
|
1782
|
+
const x456: u32 = x455 + x447
|
|
1783
|
+
const w457: u64 = p256FiatAddcarryxU32(0x0, x426, x450)
|
|
1784
|
+
const x458: u32 = toU32(w457 >> 32)
|
|
1785
|
+
const w459: u64 = p256FiatAddcarryxU32(x458, x428, x452)
|
|
1786
|
+
const x459: u32 = toU32(w459)
|
|
1787
|
+
const x460: u32 = toU32(w459 >> 32)
|
|
1788
|
+
const w461: u64 = p256FiatAddcarryxU32(x460, x430, x454)
|
|
1789
|
+
const x461: u32 = toU32(w461)
|
|
1790
|
+
const x462: u32 = toU32(w461 >> 32)
|
|
1791
|
+
const w463: u64 = p256FiatAddcarryxU32(x462, x432, x456)
|
|
1792
|
+
const x463: u32 = toU32(w463)
|
|
1793
|
+
const x464: u32 = toU32(w463 >> 32)
|
|
1794
|
+
const w465: u64 = p256FiatAddcarryxU32(x464, x434, 0x0)
|
|
1795
|
+
const x465: u32 = toU32(w465)
|
|
1796
|
+
const x466: u32 = toU32(w465 >> 32)
|
|
1797
|
+
const w467: u64 = p256FiatAddcarryxU32(x466, x436, 0x0)
|
|
1798
|
+
const x467: u32 = toU32(w467)
|
|
1799
|
+
const x468: u32 = toU32(w467 >> 32)
|
|
1800
|
+
const w469: u64 = p256FiatAddcarryxU32(x468, x438, x426)
|
|
1801
|
+
const x469: u32 = toU32(w469)
|
|
1802
|
+
const x470: u32 = toU32(w469 >> 32)
|
|
1803
|
+
const w471: u64 = p256FiatAddcarryxU32(x470, x440, x444)
|
|
1804
|
+
const x471: u32 = toU32(w471)
|
|
1805
|
+
const x472: u32 = toU32(w471 >> 32)
|
|
1806
|
+
const w473: u64 = p256FiatAddcarryxU32(x472, x442, x445)
|
|
1807
|
+
const x473: u32 = toU32(w473)
|
|
1808
|
+
const x474: u32 = toU32(w473 >> 32)
|
|
1809
|
+
const x475: u32 = x474 + x443
|
|
1810
|
+
const w476: u64 = p256FiatMulxU32(x6, arg1Limb7)
|
|
1811
|
+
const x476: u32 = toU32(w476)
|
|
1812
|
+
const x477: u32 = toU32(w476 >> 32)
|
|
1813
|
+
const w478: u64 = p256FiatMulxU32(x6, arg1Limb6)
|
|
1814
|
+
const x478: u32 = toU32(w478)
|
|
1815
|
+
const x479: u32 = toU32(w478 >> 32)
|
|
1816
|
+
const w480: u64 = p256FiatMulxU32(x6, arg1Limb5)
|
|
1817
|
+
const x480: u32 = toU32(w480)
|
|
1818
|
+
const x481: u32 = toU32(w480 >> 32)
|
|
1819
|
+
const w482: u64 = p256FiatMulxU32(x6, arg1Limb4)
|
|
1820
|
+
const x482: u32 = toU32(w482)
|
|
1821
|
+
const x483: u32 = toU32(w482 >> 32)
|
|
1822
|
+
const w484: u64 = p256FiatMulxU32(x6, arg1Limb3)
|
|
1823
|
+
const x484: u32 = toU32(w484)
|
|
1824
|
+
const x485: u32 = toU32(w484 >> 32)
|
|
1825
|
+
const w486: u64 = p256FiatMulxU32(x6, arg1Limb2)
|
|
1826
|
+
const x486: u32 = toU32(w486)
|
|
1827
|
+
const x487: u32 = toU32(w486 >> 32)
|
|
1828
|
+
const w488: u64 = p256FiatMulxU32(x6, arg1Limb1)
|
|
1829
|
+
const x488: u32 = toU32(w488)
|
|
1830
|
+
const x489: u32 = toU32(w488 >> 32)
|
|
1831
|
+
const w490: u64 = p256FiatMulxU32(x6, arg1Limb0)
|
|
1832
|
+
const x490: u32 = toU32(w490)
|
|
1833
|
+
const x491: u32 = toU32(w490 >> 32)
|
|
1834
|
+
const w492: u64 = p256FiatAddcarryxU32(0x0, x491, x488)
|
|
1835
|
+
const x492: u32 = toU32(w492)
|
|
1836
|
+
const x493: u32 = toU32(w492 >> 32)
|
|
1837
|
+
const w494: u64 = p256FiatAddcarryxU32(x493, x489, x486)
|
|
1838
|
+
const x494: u32 = toU32(w494)
|
|
1839
|
+
const x495: u32 = toU32(w494 >> 32)
|
|
1840
|
+
const w496: u64 = p256FiatAddcarryxU32(x495, x487, x484)
|
|
1841
|
+
const x496: u32 = toU32(w496)
|
|
1842
|
+
const x497: u32 = toU32(w496 >> 32)
|
|
1843
|
+
const w498: u64 = p256FiatAddcarryxU32(x497, x485, x482)
|
|
1844
|
+
const x498: u32 = toU32(w498)
|
|
1845
|
+
const x499: u32 = toU32(w498 >> 32)
|
|
1846
|
+
const w500: u64 = p256FiatAddcarryxU32(x499, x483, x480)
|
|
1847
|
+
const x500: u32 = toU32(w500)
|
|
1848
|
+
const x501: u32 = toU32(w500 >> 32)
|
|
1849
|
+
const w502: u64 = p256FiatAddcarryxU32(x501, x481, x478)
|
|
1850
|
+
const x502: u32 = toU32(w502)
|
|
1851
|
+
const x503: u32 = toU32(w502 >> 32)
|
|
1852
|
+
const w504: u64 = p256FiatAddcarryxU32(x503, x479, x476)
|
|
1853
|
+
const x504: u32 = toU32(w504)
|
|
1854
|
+
const x505: u32 = toU32(w504 >> 32)
|
|
1855
|
+
const x506: u32 = x505 + x477
|
|
1856
|
+
const w507: u64 = p256FiatAddcarryxU32(0x0, x459, x490)
|
|
1857
|
+
const x507: u32 = toU32(w507)
|
|
1858
|
+
const x508: u32 = toU32(w507 >> 32)
|
|
1859
|
+
const w509: u64 = p256FiatAddcarryxU32(x508, x461, x492)
|
|
1860
|
+
const x509: u32 = toU32(w509)
|
|
1861
|
+
const x510: u32 = toU32(w509 >> 32)
|
|
1862
|
+
const w511: u64 = p256FiatAddcarryxU32(x510, x463, x494)
|
|
1863
|
+
const x511: u32 = toU32(w511)
|
|
1864
|
+
const x512: u32 = toU32(w511 >> 32)
|
|
1865
|
+
const w513: u64 = p256FiatAddcarryxU32(x512, x465, x496)
|
|
1866
|
+
const x513: u32 = toU32(w513)
|
|
1867
|
+
const x514: u32 = toU32(w513 >> 32)
|
|
1868
|
+
const w515: u64 = p256FiatAddcarryxU32(x514, x467, x498)
|
|
1869
|
+
const x515: u32 = toU32(w515)
|
|
1870
|
+
const x516: u32 = toU32(w515 >> 32)
|
|
1871
|
+
const w517: u64 = p256FiatAddcarryxU32(x516, x469, x500)
|
|
1872
|
+
const x517: u32 = toU32(w517)
|
|
1873
|
+
const x518: u32 = toU32(w517 >> 32)
|
|
1874
|
+
const w519: u64 = p256FiatAddcarryxU32(x518, x471, x502)
|
|
1875
|
+
const x519: u32 = toU32(w519)
|
|
1876
|
+
const x520: u32 = toU32(w519 >> 32)
|
|
1877
|
+
const w521: u64 = p256FiatAddcarryxU32(x520, x473, x504)
|
|
1878
|
+
const x521: u32 = toU32(w521)
|
|
1879
|
+
const x522: u32 = toU32(w521 >> 32)
|
|
1880
|
+
const w523: u64 = p256FiatAddcarryxU32(x522, x475, x506)
|
|
1881
|
+
const x523: u32 = toU32(w523)
|
|
1882
|
+
const x524: u32 = toU32(w523 >> 32)
|
|
1883
|
+
const w525: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
1884
|
+
const x525: u32 = toU32(w525)
|
|
1885
|
+
const x526: u32 = toU32(w525 >> 32)
|
|
1886
|
+
const w527: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
1887
|
+
const x527: u32 = toU32(w527)
|
|
1888
|
+
const x528: u32 = toU32(w527 >> 32)
|
|
1889
|
+
const w529: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
1890
|
+
const x529: u32 = toU32(w529)
|
|
1891
|
+
const x530: u32 = toU32(w529 >> 32)
|
|
1892
|
+
const w531: u64 = p256FiatMulxU32(x507, 0xffffffff)
|
|
1893
|
+
const x531: u32 = toU32(w531)
|
|
1894
|
+
const x532: u32 = toU32(w531 >> 32)
|
|
1895
|
+
const w533: u64 = p256FiatAddcarryxU32(0x0, x532, x529)
|
|
1896
|
+
const x533: u32 = toU32(w533)
|
|
1897
|
+
const x534: u32 = toU32(w533 >> 32)
|
|
1898
|
+
const w535: u64 = p256FiatAddcarryxU32(x534, x530, x527)
|
|
1899
|
+
const x535: u32 = toU32(w535)
|
|
1900
|
+
const x536: u32 = toU32(w535 >> 32)
|
|
1901
|
+
const x537: u32 = x536 + x528
|
|
1902
|
+
const w538: u64 = p256FiatAddcarryxU32(0x0, x507, x531)
|
|
1903
|
+
const x539: u32 = toU32(w538 >> 32)
|
|
1904
|
+
const w540: u64 = p256FiatAddcarryxU32(x539, x509, x533)
|
|
1905
|
+
const x540: u32 = toU32(w540)
|
|
1906
|
+
const x541: u32 = toU32(w540 >> 32)
|
|
1907
|
+
const w542: u64 = p256FiatAddcarryxU32(x541, x511, x535)
|
|
1908
|
+
const x542: u32 = toU32(w542)
|
|
1909
|
+
const x543: u32 = toU32(w542 >> 32)
|
|
1910
|
+
const w544: u64 = p256FiatAddcarryxU32(x543, x513, x537)
|
|
1911
|
+
const x544: u32 = toU32(w544)
|
|
1912
|
+
const x545: u32 = toU32(w544 >> 32)
|
|
1913
|
+
const w546: u64 = p256FiatAddcarryxU32(x545, x515, 0x0)
|
|
1914
|
+
const x546: u32 = toU32(w546)
|
|
1915
|
+
const x547: u32 = toU32(w546 >> 32)
|
|
1916
|
+
const w548: u64 = p256FiatAddcarryxU32(x547, x517, 0x0)
|
|
1917
|
+
const x548: u32 = toU32(w548)
|
|
1918
|
+
const x549: u32 = toU32(w548 >> 32)
|
|
1919
|
+
const w550: u64 = p256FiatAddcarryxU32(x549, x519, x507)
|
|
1920
|
+
const x550: u32 = toU32(w550)
|
|
1921
|
+
const x551: u32 = toU32(w550 >> 32)
|
|
1922
|
+
const w552: u64 = p256FiatAddcarryxU32(x551, x521, x525)
|
|
1923
|
+
const x552: u32 = toU32(w552)
|
|
1924
|
+
const x553: u32 = toU32(w552 >> 32)
|
|
1925
|
+
const w554: u64 = p256FiatAddcarryxU32(x553, x523, x526)
|
|
1926
|
+
const x554: u32 = toU32(w554)
|
|
1927
|
+
const x555: u32 = toU32(w554 >> 32)
|
|
1928
|
+
const x556: u32 = x555 + x524
|
|
1929
|
+
const w557: u64 = p256FiatMulxU32(x7, arg1Limb7)
|
|
1930
|
+
const x557: u32 = toU32(w557)
|
|
1931
|
+
const x558: u32 = toU32(w557 >> 32)
|
|
1932
|
+
const w559: u64 = p256FiatMulxU32(x7, arg1Limb6)
|
|
1933
|
+
const x559: u32 = toU32(w559)
|
|
1934
|
+
const x560: u32 = toU32(w559 >> 32)
|
|
1935
|
+
const w561: u64 = p256FiatMulxU32(x7, arg1Limb5)
|
|
1936
|
+
const x561: u32 = toU32(w561)
|
|
1937
|
+
const x562: u32 = toU32(w561 >> 32)
|
|
1938
|
+
const w563: u64 = p256FiatMulxU32(x7, arg1Limb4)
|
|
1939
|
+
const x563: u32 = toU32(w563)
|
|
1940
|
+
const x564: u32 = toU32(w563 >> 32)
|
|
1941
|
+
const w565: u64 = p256FiatMulxU32(x7, arg1Limb3)
|
|
1942
|
+
const x565: u32 = toU32(w565)
|
|
1943
|
+
const x566: u32 = toU32(w565 >> 32)
|
|
1944
|
+
const w567: u64 = p256FiatMulxU32(x7, arg1Limb2)
|
|
1945
|
+
const x567: u32 = toU32(w567)
|
|
1946
|
+
const x568: u32 = toU32(w567 >> 32)
|
|
1947
|
+
const w569: u64 = p256FiatMulxU32(x7, arg1Limb1)
|
|
1948
|
+
const x569: u32 = toU32(w569)
|
|
1949
|
+
const x570: u32 = toU32(w569 >> 32)
|
|
1950
|
+
const w571: u64 = p256FiatMulxU32(x7, arg1Limb0)
|
|
1951
|
+
const x571: u32 = toU32(w571)
|
|
1952
|
+
const x572: u32 = toU32(w571 >> 32)
|
|
1953
|
+
const w573: u64 = p256FiatAddcarryxU32(0x0, x572, x569)
|
|
1954
|
+
const x573: u32 = toU32(w573)
|
|
1955
|
+
const x574: u32 = toU32(w573 >> 32)
|
|
1956
|
+
const w575: u64 = p256FiatAddcarryxU32(x574, x570, x567)
|
|
1957
|
+
const x575: u32 = toU32(w575)
|
|
1958
|
+
const x576: u32 = toU32(w575 >> 32)
|
|
1959
|
+
const w577: u64 = p256FiatAddcarryxU32(x576, x568, x565)
|
|
1960
|
+
const x577: u32 = toU32(w577)
|
|
1961
|
+
const x578: u32 = toU32(w577 >> 32)
|
|
1962
|
+
const w579: u64 = p256FiatAddcarryxU32(x578, x566, x563)
|
|
1963
|
+
const x579: u32 = toU32(w579)
|
|
1964
|
+
const x580: u32 = toU32(w579 >> 32)
|
|
1965
|
+
const w581: u64 = p256FiatAddcarryxU32(x580, x564, x561)
|
|
1966
|
+
const x581: u32 = toU32(w581)
|
|
1967
|
+
const x582: u32 = toU32(w581 >> 32)
|
|
1968
|
+
const w583: u64 = p256FiatAddcarryxU32(x582, x562, x559)
|
|
1969
|
+
const x583: u32 = toU32(w583)
|
|
1970
|
+
const x584: u32 = toU32(w583 >> 32)
|
|
1971
|
+
const w585: u64 = p256FiatAddcarryxU32(x584, x560, x557)
|
|
1972
|
+
const x585: u32 = toU32(w585)
|
|
1973
|
+
const x586: u32 = toU32(w585 >> 32)
|
|
1974
|
+
const x587: u32 = x586 + x558
|
|
1975
|
+
const w588: u64 = p256FiatAddcarryxU32(0x0, x540, x571)
|
|
1976
|
+
const x588: u32 = toU32(w588)
|
|
1977
|
+
const x589: u32 = toU32(w588 >> 32)
|
|
1978
|
+
const w590: u64 = p256FiatAddcarryxU32(x589, x542, x573)
|
|
1979
|
+
const x590: u32 = toU32(w590)
|
|
1980
|
+
const x591: u32 = toU32(w590 >> 32)
|
|
1981
|
+
const w592: u64 = p256FiatAddcarryxU32(x591, x544, x575)
|
|
1982
|
+
const x592: u32 = toU32(w592)
|
|
1983
|
+
const x593: u32 = toU32(w592 >> 32)
|
|
1984
|
+
const w594: u64 = p256FiatAddcarryxU32(x593, x546, x577)
|
|
1985
|
+
const x594: u32 = toU32(w594)
|
|
1986
|
+
const x595: u32 = toU32(w594 >> 32)
|
|
1987
|
+
const w596: u64 = p256FiatAddcarryxU32(x595, x548, x579)
|
|
1988
|
+
const x596: u32 = toU32(w596)
|
|
1989
|
+
const x597: u32 = toU32(w596 >> 32)
|
|
1990
|
+
const w598: u64 = p256FiatAddcarryxU32(x597, x550, x581)
|
|
1991
|
+
const x598: u32 = toU32(w598)
|
|
1992
|
+
const x599: u32 = toU32(w598 >> 32)
|
|
1993
|
+
const w600: u64 = p256FiatAddcarryxU32(x599, x552, x583)
|
|
1994
|
+
const x600: u32 = toU32(w600)
|
|
1995
|
+
const x601: u32 = toU32(w600 >> 32)
|
|
1996
|
+
const w602: u64 = p256FiatAddcarryxU32(x601, x554, x585)
|
|
1997
|
+
const x602: u32 = toU32(w602)
|
|
1998
|
+
const x603: u32 = toU32(w602 >> 32)
|
|
1999
|
+
const w604: u64 = p256FiatAddcarryxU32(x603, x556, x587)
|
|
2000
|
+
const x604: u32 = toU32(w604)
|
|
2001
|
+
const x605: u32 = toU32(w604 >> 32)
|
|
2002
|
+
const w606: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
2003
|
+
const x606: u32 = toU32(w606)
|
|
2004
|
+
const x607: u32 = toU32(w606 >> 32)
|
|
2005
|
+
const w608: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
2006
|
+
const x608: u32 = toU32(w608)
|
|
2007
|
+
const x609: u32 = toU32(w608 >> 32)
|
|
2008
|
+
const w610: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
2009
|
+
const x610: u32 = toU32(w610)
|
|
2010
|
+
const x611: u32 = toU32(w610 >> 32)
|
|
2011
|
+
const w612: u64 = p256FiatMulxU32(x588, 0xffffffff)
|
|
2012
|
+
const x612: u32 = toU32(w612)
|
|
2013
|
+
const x613: u32 = toU32(w612 >> 32)
|
|
2014
|
+
const w614: u64 = p256FiatAddcarryxU32(0x0, x613, x610)
|
|
2015
|
+
const x614: u32 = toU32(w614)
|
|
2016
|
+
const x615: u32 = toU32(w614 >> 32)
|
|
2017
|
+
const w616: u64 = p256FiatAddcarryxU32(x615, x611, x608)
|
|
2018
|
+
const x616: u32 = toU32(w616)
|
|
2019
|
+
const x617: u32 = toU32(w616 >> 32)
|
|
2020
|
+
const x618: u32 = x617 + x609
|
|
2021
|
+
const w619: u64 = p256FiatAddcarryxU32(0x0, x588, x612)
|
|
2022
|
+
const x620: u32 = toU32(w619 >> 32)
|
|
2023
|
+
const w621: u64 = p256FiatAddcarryxU32(x620, x590, x614)
|
|
2024
|
+
const x621: u32 = toU32(w621)
|
|
2025
|
+
const x622: u32 = toU32(w621 >> 32)
|
|
2026
|
+
const w623: u64 = p256FiatAddcarryxU32(x622, x592, x616)
|
|
2027
|
+
const x623: u32 = toU32(w623)
|
|
2028
|
+
const x624: u32 = toU32(w623 >> 32)
|
|
2029
|
+
const w625: u64 = p256FiatAddcarryxU32(x624, x594, x618)
|
|
2030
|
+
const x625: u32 = toU32(w625)
|
|
2031
|
+
const x626: u32 = toU32(w625 >> 32)
|
|
2032
|
+
const w627: u64 = p256FiatAddcarryxU32(x626, x596, 0x0)
|
|
2033
|
+
const x627: u32 = toU32(w627)
|
|
2034
|
+
const x628: u32 = toU32(w627 >> 32)
|
|
2035
|
+
const w629: u64 = p256FiatAddcarryxU32(x628, x598, 0x0)
|
|
2036
|
+
const x629: u32 = toU32(w629)
|
|
2037
|
+
const x630: u32 = toU32(w629 >> 32)
|
|
2038
|
+
const w631: u64 = p256FiatAddcarryxU32(x630, x600, x588)
|
|
2039
|
+
const x631: u32 = toU32(w631)
|
|
2040
|
+
const x632: u32 = toU32(w631 >> 32)
|
|
2041
|
+
const w633: u64 = p256FiatAddcarryxU32(x632, x602, x606)
|
|
2042
|
+
const x633: u32 = toU32(w633)
|
|
2043
|
+
const x634: u32 = toU32(w633 >> 32)
|
|
2044
|
+
const w635: u64 = p256FiatAddcarryxU32(x634, x604, x607)
|
|
2045
|
+
const x635: u32 = toU32(w635)
|
|
2046
|
+
const x636: u32 = toU32(w635 >> 32)
|
|
2047
|
+
const x637: u32 = x636 + x605
|
|
2048
|
+
const w638: u64 = p256FiatSubborrowxU32(0x0, x621, 0xffffffff)
|
|
2049
|
+
const x638: u32 = toU32(w638)
|
|
2050
|
+
const x639: u32 = toU32(w638 >> 32)
|
|
2051
|
+
const w640: u64 = p256FiatSubborrowxU32(x639, x623, 0xffffffff)
|
|
2052
|
+
const x640: u32 = toU32(w640)
|
|
2053
|
+
const x641: u32 = toU32(w640 >> 32)
|
|
2054
|
+
const w642: u64 = p256FiatSubborrowxU32(x641, x625, 0xffffffff)
|
|
2055
|
+
const x642: u32 = toU32(w642)
|
|
2056
|
+
const x643: u32 = toU32(w642 >> 32)
|
|
2057
|
+
const w644: u64 = p256FiatSubborrowxU32(x643, x627, 0x0)
|
|
2058
|
+
const x644: u32 = toU32(w644)
|
|
2059
|
+
const x645: u32 = toU32(w644 >> 32)
|
|
2060
|
+
const w646: u64 = p256FiatSubborrowxU32(x645, x629, 0x0)
|
|
2061
|
+
const x646: u32 = toU32(w646)
|
|
2062
|
+
const x647: u32 = toU32(w646 >> 32)
|
|
2063
|
+
const w648: u64 = p256FiatSubborrowxU32(x647, x631, 0x0)
|
|
2064
|
+
const x648: u32 = toU32(w648)
|
|
2065
|
+
const x649: u32 = toU32(w648 >> 32)
|
|
2066
|
+
const w650: u64 = p256FiatSubborrowxU32(x649, x633, 0x1)
|
|
2067
|
+
const x650: u32 = toU32(w650)
|
|
2068
|
+
const x651: u32 = toU32(w650 >> 32)
|
|
2069
|
+
const w652: u64 = p256FiatSubborrowxU32(x651, x635, 0xffffffff)
|
|
2070
|
+
const x652: u32 = toU32(w652)
|
|
2071
|
+
const x653: u32 = toU32(w652 >> 32)
|
|
2072
|
+
const w654: u64 = p256FiatSubborrowxU32(x653, x637, 0x0)
|
|
2073
|
+
const x655: u32 = toU32(w654 >> 32)
|
|
2074
|
+
const x656: u32 = p256FiatCmovznzU32(x655, x638, x621)
|
|
2075
|
+
const x657: u32 = p256FiatCmovznzU32(x655, x640, x623)
|
|
2076
|
+
const x658: u32 = p256FiatCmovznzU32(x655, x642, x625)
|
|
2077
|
+
const x659: u32 = p256FiatCmovznzU32(x655, x644, x627)
|
|
2078
|
+
const x660: u32 = p256FiatCmovznzU32(x655, x646, x629)
|
|
2079
|
+
const x661: u32 = p256FiatCmovznzU32(x655, x648, x631)
|
|
2080
|
+
const x662: u32 = p256FiatCmovznzU32(x655, x650, x633)
|
|
2081
|
+
const x663: u32 = p256FiatCmovznzU32(x655, x652, x635)
|
|
2082
|
+
out1[0] = x656
|
|
2083
|
+
out1[1] = x657
|
|
2084
|
+
out1[2] = x658
|
|
2085
|
+
out1[3] = x659
|
|
2086
|
+
out1[4] = x660
|
|
2087
|
+
out1[5] = x661
|
|
2088
|
+
out1[6] = x662
|
|
2089
|
+
out1[7] = x663
|
|
2090
|
+
}
|
|
2091
|
+
|
|
2092
|
+
/** fiat's `fiat_p256_add`: adds two field elements in the Montgomery domain. */
|
|
2093
|
+
const p256FiatAdd = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
|
|
2094
|
+
if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
|
|
2095
|
+
return
|
|
2096
|
+
}
|
|
2097
|
+
const w1: u64 = p256FiatAddcarryxU32(0x0, arg1[0], arg2[0])
|
|
2098
|
+
const x1: u32 = toU32(w1)
|
|
2099
|
+
const x2: u32 = toU32(w1 >> 32)
|
|
2100
|
+
const w3: u64 = p256FiatAddcarryxU32(x2, arg1[1], arg2[1])
|
|
2101
|
+
const x3: u32 = toU32(w3)
|
|
2102
|
+
const x4: u32 = toU32(w3 >> 32)
|
|
2103
|
+
const w5: u64 = p256FiatAddcarryxU32(x4, arg1[2], arg2[2])
|
|
2104
|
+
const x5: u32 = toU32(w5)
|
|
2105
|
+
const x6: u32 = toU32(w5 >> 32)
|
|
2106
|
+
const w7: u64 = p256FiatAddcarryxU32(x6, arg1[3], arg2[3])
|
|
2107
|
+
const x7: u32 = toU32(w7)
|
|
2108
|
+
const x8: u32 = toU32(w7 >> 32)
|
|
2109
|
+
const w9: u64 = p256FiatAddcarryxU32(x8, arg1[4], arg2[4])
|
|
2110
|
+
const x9: u32 = toU32(w9)
|
|
2111
|
+
const x10: u32 = toU32(w9 >> 32)
|
|
2112
|
+
const w11: u64 = p256FiatAddcarryxU32(x10, arg1[5], arg2[5])
|
|
2113
|
+
const x11: u32 = toU32(w11)
|
|
2114
|
+
const x12: u32 = toU32(w11 >> 32)
|
|
2115
|
+
const w13: u64 = p256FiatAddcarryxU32(x12, arg1[6], arg2[6])
|
|
2116
|
+
const x13: u32 = toU32(w13)
|
|
2117
|
+
const x14: u32 = toU32(w13 >> 32)
|
|
2118
|
+
const w15: u64 = p256FiatAddcarryxU32(x14, arg1[7], arg2[7])
|
|
2119
|
+
const x15: u32 = toU32(w15)
|
|
2120
|
+
const x16: u32 = toU32(w15 >> 32)
|
|
2121
|
+
const w17: u64 = p256FiatSubborrowxU32(0x0, x1, 0xffffffff)
|
|
2122
|
+
const x17: u32 = toU32(w17)
|
|
2123
|
+
const x18: u32 = toU32(w17 >> 32)
|
|
2124
|
+
const w19: u64 = p256FiatSubborrowxU32(x18, x3, 0xffffffff)
|
|
2125
|
+
const x19: u32 = toU32(w19)
|
|
2126
|
+
const x20: u32 = toU32(w19 >> 32)
|
|
2127
|
+
const w21: u64 = p256FiatSubborrowxU32(x20, x5, 0xffffffff)
|
|
2128
|
+
const x21: u32 = toU32(w21)
|
|
2129
|
+
const x22: u32 = toU32(w21 >> 32)
|
|
2130
|
+
const w23: u64 = p256FiatSubborrowxU32(x22, x7, 0x0)
|
|
2131
|
+
const x23: u32 = toU32(w23)
|
|
2132
|
+
const x24: u32 = toU32(w23 >> 32)
|
|
2133
|
+
const w25: u64 = p256FiatSubborrowxU32(x24, x9, 0x0)
|
|
2134
|
+
const x25: u32 = toU32(w25)
|
|
2135
|
+
const x26: u32 = toU32(w25 >> 32)
|
|
2136
|
+
const w27: u64 = p256FiatSubborrowxU32(x26, x11, 0x0)
|
|
2137
|
+
const x27: u32 = toU32(w27)
|
|
2138
|
+
const x28: u32 = toU32(w27 >> 32)
|
|
2139
|
+
const w29: u64 = p256FiatSubborrowxU32(x28, x13, 0x1)
|
|
2140
|
+
const x29: u32 = toU32(w29)
|
|
2141
|
+
const x30: u32 = toU32(w29 >> 32)
|
|
2142
|
+
const w31: u64 = p256FiatSubborrowxU32(x30, x15, 0xffffffff)
|
|
2143
|
+
const x31: u32 = toU32(w31)
|
|
2144
|
+
const x32: u32 = toU32(w31 >> 32)
|
|
2145
|
+
const w33: u64 = p256FiatSubborrowxU32(x32, x16, 0x0)
|
|
2146
|
+
const x34: u32 = toU32(w33 >> 32)
|
|
2147
|
+
const x35: u32 = p256FiatCmovznzU32(x34, x17, x1)
|
|
2148
|
+
const x36: u32 = p256FiatCmovznzU32(x34, x19, x3)
|
|
2149
|
+
const x37: u32 = p256FiatCmovznzU32(x34, x21, x5)
|
|
2150
|
+
const x38: u32 = p256FiatCmovznzU32(x34, x23, x7)
|
|
2151
|
+
const x39: u32 = p256FiatCmovznzU32(x34, x25, x9)
|
|
2152
|
+
const x40: u32 = p256FiatCmovznzU32(x34, x27, x11)
|
|
2153
|
+
const x41: u32 = p256FiatCmovznzU32(x34, x29, x13)
|
|
2154
|
+
const x42: u32 = p256FiatCmovznzU32(x34, x31, x15)
|
|
2155
|
+
out1[0] = x35
|
|
2156
|
+
out1[1] = x36
|
|
2157
|
+
out1[2] = x37
|
|
2158
|
+
out1[3] = x38
|
|
2159
|
+
out1[4] = x39
|
|
2160
|
+
out1[5] = x40
|
|
2161
|
+
out1[6] = x41
|
|
2162
|
+
out1[7] = x42
|
|
2163
|
+
}
|
|
2164
|
+
|
|
2165
|
+
/** fiat's `fiat_p256_sub`: subtracts two field elements in the Montgomery domain. */
|
|
2166
|
+
const p256FiatSub = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
|
|
2167
|
+
if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
|
|
2168
|
+
return
|
|
2169
|
+
}
|
|
2170
|
+
const w1: u64 = p256FiatSubborrowxU32(0x0, arg1[0], arg2[0])
|
|
2171
|
+
const x1: u32 = toU32(w1)
|
|
2172
|
+
const x2: u32 = toU32(w1 >> 32)
|
|
2173
|
+
const w3: u64 = p256FiatSubborrowxU32(x2, arg1[1], arg2[1])
|
|
2174
|
+
const x3: u32 = toU32(w3)
|
|
2175
|
+
const x4: u32 = toU32(w3 >> 32)
|
|
2176
|
+
const w5: u64 = p256FiatSubborrowxU32(x4, arg1[2], arg2[2])
|
|
2177
|
+
const x5: u32 = toU32(w5)
|
|
2178
|
+
const x6: u32 = toU32(w5 >> 32)
|
|
2179
|
+
const w7: u64 = p256FiatSubborrowxU32(x6, arg1[3], arg2[3])
|
|
2180
|
+
const x7: u32 = toU32(w7)
|
|
2181
|
+
const x8: u32 = toU32(w7 >> 32)
|
|
2182
|
+
const w9: u64 = p256FiatSubborrowxU32(x8, arg1[4], arg2[4])
|
|
2183
|
+
const x9: u32 = toU32(w9)
|
|
2184
|
+
const x10: u32 = toU32(w9 >> 32)
|
|
2185
|
+
const w11: u64 = p256FiatSubborrowxU32(x10, arg1[5], arg2[5])
|
|
2186
|
+
const x11: u32 = toU32(w11)
|
|
2187
|
+
const x12: u32 = toU32(w11 >> 32)
|
|
2188
|
+
const w13: u64 = p256FiatSubborrowxU32(x12, arg1[6], arg2[6])
|
|
2189
|
+
const x13: u32 = toU32(w13)
|
|
2190
|
+
const x14: u32 = toU32(w13 >> 32)
|
|
2191
|
+
const w15: u64 = p256FiatSubborrowxU32(x14, arg1[7], arg2[7])
|
|
2192
|
+
const x15: u32 = toU32(w15)
|
|
2193
|
+
const x16: u32 = toU32(w15 >> 32)
|
|
2194
|
+
const x17: u32 = p256FiatCmovznzU32(x16, 0x0, 0xffffffff)
|
|
2195
|
+
const w18: u64 = p256FiatAddcarryxU32(0x0, x1, x17)
|
|
2196
|
+
const x18: u32 = toU32(w18)
|
|
2197
|
+
const x19: u32 = toU32(w18 >> 32)
|
|
2198
|
+
const w20: u64 = p256FiatAddcarryxU32(x19, x3, x17)
|
|
2199
|
+
const x20: u32 = toU32(w20)
|
|
2200
|
+
const x21: u32 = toU32(w20 >> 32)
|
|
2201
|
+
const w22: u64 = p256FiatAddcarryxU32(x21, x5, x17)
|
|
2202
|
+
const x22: u32 = toU32(w22)
|
|
2203
|
+
const x23: u32 = toU32(w22 >> 32)
|
|
2204
|
+
const w24: u64 = p256FiatAddcarryxU32(x23, x7, 0x0)
|
|
2205
|
+
const x24: u32 = toU32(w24)
|
|
2206
|
+
const x25: u32 = toU32(w24 >> 32)
|
|
2207
|
+
const w26: u64 = p256FiatAddcarryxU32(x25, x9, 0x0)
|
|
2208
|
+
const x26: u32 = toU32(w26)
|
|
2209
|
+
const x27: u32 = toU32(w26 >> 32)
|
|
2210
|
+
const w28: u64 = p256FiatAddcarryxU32(x27, x11, 0x0)
|
|
2211
|
+
const x28: u32 = toU32(w28)
|
|
2212
|
+
const x29: u32 = toU32(w28 >> 32)
|
|
2213
|
+
const w30: u64 = p256FiatAddcarryxU32(x29, x13, x17 & 0x1)
|
|
2214
|
+
const x30: u32 = toU32(w30)
|
|
2215
|
+
const x31: u32 = toU32(w30 >> 32)
|
|
2216
|
+
const w32: u64 = p256FiatAddcarryxU32(x31, x15, x17)
|
|
2217
|
+
const x32: u32 = toU32(w32)
|
|
2218
|
+
out1[0] = x18
|
|
2219
|
+
out1[1] = x20
|
|
2220
|
+
out1[2] = x22
|
|
2221
|
+
out1[3] = x24
|
|
2222
|
+
out1[4] = x26
|
|
2223
|
+
out1[5] = x28
|
|
2224
|
+
out1[6] = x30
|
|
2225
|
+
out1[7] = x32
|
|
2226
|
+
}
|
|
2227
|
+
|
|
2228
|
+
/** fiat's `fiat_p256_nonzero`: outputs a single non-zero word if the input is non-zero and zero otherwise. */
|
|
2229
|
+
const p256FiatNonzero = (arg1: u32[]): u32 => {
|
|
2230
|
+
if (toI32(arg1.length) < 8) {
|
|
2231
|
+
return 0
|
|
2232
|
+
}
|
|
2233
|
+
const x1: u32 = arg1[0] | (arg1[1] | (arg1[2] | (arg1[3] | (arg1[4] | (arg1[5] | (arg1[6] | arg1[7]))))))
|
|
2234
|
+
return x1
|
|
2235
|
+
}
|
|
2236
|
+
|
|
2237
|
+
/** fiat's `fiat_p256_selectznz`: is a multi-limb conditional select. */
|
|
2238
|
+
const p256FiatSelectznz = (out1: u32[], arg1: u32, arg2: u32[], arg3: u32[]): void => {
|
|
2239
|
+
if (toI32(out1.length) < 8 || toI32(arg2.length) < 8 || toI32(arg3.length) < 8) {
|
|
2240
|
+
return
|
|
2241
|
+
}
|
|
2242
|
+
const x1: u32 = p256FiatCmovznzU32(arg1, arg2[0], arg3[0])
|
|
2243
|
+
const x2: u32 = p256FiatCmovznzU32(arg1, arg2[1], arg3[1])
|
|
2244
|
+
const x3: u32 = p256FiatCmovznzU32(arg1, arg2[2], arg3[2])
|
|
2245
|
+
const x4: u32 = p256FiatCmovznzU32(arg1, arg2[3], arg3[3])
|
|
2246
|
+
const x5: u32 = p256FiatCmovznzU32(arg1, arg2[4], arg3[4])
|
|
2247
|
+
const x6: u32 = p256FiatCmovznzU32(arg1, arg2[5], arg3[5])
|
|
2248
|
+
const x7: u32 = p256FiatCmovznzU32(arg1, arg2[6], arg3[6])
|
|
2249
|
+
const x8: u32 = p256FiatCmovznzU32(arg1, arg2[7], arg3[7])
|
|
2250
|
+
out1[0] = x1
|
|
2251
|
+
out1[1] = x2
|
|
2252
|
+
out1[2] = x3
|
|
2253
|
+
out1[3] = x4
|
|
2254
|
+
out1[4] = x5
|
|
2255
|
+
out1[5] = x6
|
|
2256
|
+
out1[6] = x7
|
|
2257
|
+
out1[7] = x8
|
|
2258
|
+
}
|
|
2259
|
+
|
|
2260
|
+
/** fiat's `fiat_p256_set_one`: returns the field element one in the Montgomery domain. */
|
|
2261
|
+
const p256FiatSetOne = (out1: u32[]): void => {
|
|
2262
|
+
if (toI32(out1.length) < 8) {
|
|
2263
|
+
return
|
|
2264
|
+
}
|
|
2265
|
+
out1[0] = 0x1
|
|
2266
|
+
out1[1] = 0x0
|
|
2267
|
+
out1[2] = 0x0
|
|
2268
|
+
out1[3] = 0xffffffff
|
|
2269
|
+
out1[4] = 0xffffffff
|
|
2270
|
+
out1[5] = 0xffffffff
|
|
2271
|
+
out1[6] = 0xfffffffe
|
|
2272
|
+
out1[7] = 0x0
|
|
2273
|
+
}
|
|
2274
|
+
/** fiat's `fiat_p256_scalar_mul`: multiplies two field elements in the Montgomery domain. */
|
|
2275
|
+
const p256FiatScalarMul = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
|
|
2276
|
+
if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
|
|
2277
|
+
return
|
|
2278
|
+
}
|
|
2279
|
+
const x1: u32 = arg1[1]
|
|
2280
|
+
const x2: u32 = arg1[2]
|
|
2281
|
+
const x3: u32 = arg1[3]
|
|
2282
|
+
const x4: u32 = arg1[4]
|
|
2283
|
+
const x5: u32 = arg1[5]
|
|
2284
|
+
const x6: u32 = arg1[6]
|
|
2285
|
+
const x7: u32 = arg1[7]
|
|
2286
|
+
const x8: u32 = arg1[0]
|
|
2287
|
+
const w9: u64 = p256FiatMulxU32(x8, arg2[7])
|
|
2288
|
+
const x9: u32 = toU32(w9)
|
|
2289
|
+
const x10: u32 = toU32(w9 >> 32)
|
|
2290
|
+
const w11: u64 = p256FiatMulxU32(x8, arg2[6])
|
|
2291
|
+
const x11: u32 = toU32(w11)
|
|
2292
|
+
const x12: u32 = toU32(w11 >> 32)
|
|
2293
|
+
const w13: u64 = p256FiatMulxU32(x8, arg2[5])
|
|
2294
|
+
const x13: u32 = toU32(w13)
|
|
2295
|
+
const x14: u32 = toU32(w13 >> 32)
|
|
2296
|
+
const w15: u64 = p256FiatMulxU32(x8, arg2[4])
|
|
2297
|
+
const x15: u32 = toU32(w15)
|
|
2298
|
+
const x16: u32 = toU32(w15 >> 32)
|
|
2299
|
+
const w17: u64 = p256FiatMulxU32(x8, arg2[3])
|
|
2300
|
+
const x17: u32 = toU32(w17)
|
|
2301
|
+
const x18: u32 = toU32(w17 >> 32)
|
|
2302
|
+
const w19: u64 = p256FiatMulxU32(x8, arg2[2])
|
|
2303
|
+
const x19: u32 = toU32(w19)
|
|
2304
|
+
const x20: u32 = toU32(w19 >> 32)
|
|
2305
|
+
const w21: u64 = p256FiatMulxU32(x8, arg2[1])
|
|
2306
|
+
const x21: u32 = toU32(w21)
|
|
2307
|
+
const x22: u32 = toU32(w21 >> 32)
|
|
2308
|
+
const w23: u64 = p256FiatMulxU32(x8, arg2[0])
|
|
2309
|
+
const x23: u32 = toU32(w23)
|
|
2310
|
+
const x24: u32 = toU32(w23 >> 32)
|
|
2311
|
+
const w25: u64 = p256FiatAddcarryxU32(0x0, x24, x21)
|
|
2312
|
+
const x25: u32 = toU32(w25)
|
|
2313
|
+
const x26: u32 = toU32(w25 >> 32)
|
|
2314
|
+
const w27: u64 = p256FiatAddcarryxU32(x26, x22, x19)
|
|
2315
|
+
const x27: u32 = toU32(w27)
|
|
2316
|
+
const x28: u32 = toU32(w27 >> 32)
|
|
2317
|
+
const w29: u64 = p256FiatAddcarryxU32(x28, x20, x17)
|
|
2318
|
+
const x29: u32 = toU32(w29)
|
|
2319
|
+
const x30: u32 = toU32(w29 >> 32)
|
|
2320
|
+
const w31: u64 = p256FiatAddcarryxU32(x30, x18, x15)
|
|
2321
|
+
const x31: u32 = toU32(w31)
|
|
2322
|
+
const x32: u32 = toU32(w31 >> 32)
|
|
2323
|
+
const w33: u64 = p256FiatAddcarryxU32(x32, x16, x13)
|
|
2324
|
+
const x33: u32 = toU32(w33)
|
|
2325
|
+
const x34: u32 = toU32(w33 >> 32)
|
|
2326
|
+
const w35: u64 = p256FiatAddcarryxU32(x34, x14, x11)
|
|
2327
|
+
const x35: u32 = toU32(w35)
|
|
2328
|
+
const x36: u32 = toU32(w35 >> 32)
|
|
2329
|
+
const w37: u64 = p256FiatAddcarryxU32(x36, x12, x9)
|
|
2330
|
+
const x37: u32 = toU32(w37)
|
|
2331
|
+
const x38: u32 = toU32(w37 >> 32)
|
|
2332
|
+
const x39: u32 = x38 + x10
|
|
2333
|
+
const w40: u64 = p256FiatMulxU32(x23, 0xee00bc4f)
|
|
2334
|
+
const x40: u32 = toU32(w40)
|
|
2335
|
+
const w42: u64 = p256FiatMulxU32(x40, 0xffffffff)
|
|
2336
|
+
const x42: u32 = toU32(w42)
|
|
2337
|
+
const x43: u32 = toU32(w42 >> 32)
|
|
2338
|
+
const w44: u64 = p256FiatMulxU32(x40, 0xffffffff)
|
|
2339
|
+
const x44: u32 = toU32(w44)
|
|
2340
|
+
const x45: u32 = toU32(w44 >> 32)
|
|
2341
|
+
const w46: u64 = p256FiatMulxU32(x40, 0xffffffff)
|
|
2342
|
+
const x46: u32 = toU32(w46)
|
|
2343
|
+
const x47: u32 = toU32(w46 >> 32)
|
|
2344
|
+
const w48: u64 = p256FiatMulxU32(x40, 0xbce6faad)
|
|
2345
|
+
const x48: u32 = toU32(w48)
|
|
2346
|
+
const x49: u32 = toU32(w48 >> 32)
|
|
2347
|
+
const w50: u64 = p256FiatMulxU32(x40, 0xa7179e84)
|
|
2348
|
+
const x50: u32 = toU32(w50)
|
|
2349
|
+
const x51: u32 = toU32(w50 >> 32)
|
|
2350
|
+
const w52: u64 = p256FiatMulxU32(x40, 0xf3b9cac2)
|
|
2351
|
+
const x52: u32 = toU32(w52)
|
|
2352
|
+
const x53: u32 = toU32(w52 >> 32)
|
|
2353
|
+
const w54: u64 = p256FiatMulxU32(x40, 0xfc632551)
|
|
2354
|
+
const x54: u32 = toU32(w54)
|
|
2355
|
+
const x55: u32 = toU32(w54 >> 32)
|
|
2356
|
+
const w56: u64 = p256FiatAddcarryxU32(0x0, x55, x52)
|
|
2357
|
+
const x56: u32 = toU32(w56)
|
|
2358
|
+
const x57: u32 = toU32(w56 >> 32)
|
|
2359
|
+
const w58: u64 = p256FiatAddcarryxU32(x57, x53, x50)
|
|
2360
|
+
const x58: u32 = toU32(w58)
|
|
2361
|
+
const x59: u32 = toU32(w58 >> 32)
|
|
2362
|
+
const w60: u64 = p256FiatAddcarryxU32(x59, x51, x48)
|
|
2363
|
+
const x60: u32 = toU32(w60)
|
|
2364
|
+
const x61: u32 = toU32(w60 >> 32)
|
|
2365
|
+
const w62: u64 = p256FiatAddcarryxU32(x61, x49, x46)
|
|
2366
|
+
const x62: u32 = toU32(w62)
|
|
2367
|
+
const x63: u32 = toU32(w62 >> 32)
|
|
2368
|
+
const w64: u64 = p256FiatAddcarryxU32(x63, x47, x44)
|
|
2369
|
+
const x64: u32 = toU32(w64)
|
|
2370
|
+
const x65: u32 = toU32(w64 >> 32)
|
|
2371
|
+
const x66: u32 = x65 + x45
|
|
2372
|
+
const w67: u64 = p256FiatAddcarryxU32(0x0, x23, x54)
|
|
2373
|
+
const x68: u32 = toU32(w67 >> 32)
|
|
2374
|
+
const w69: u64 = p256FiatAddcarryxU32(x68, x25, x56)
|
|
2375
|
+
const x69: u32 = toU32(w69)
|
|
2376
|
+
const x70: u32 = toU32(w69 >> 32)
|
|
2377
|
+
const w71: u64 = p256FiatAddcarryxU32(x70, x27, x58)
|
|
2378
|
+
const x71: u32 = toU32(w71)
|
|
2379
|
+
const x72: u32 = toU32(w71 >> 32)
|
|
2380
|
+
const w73: u64 = p256FiatAddcarryxU32(x72, x29, x60)
|
|
2381
|
+
const x73: u32 = toU32(w73)
|
|
2382
|
+
const x74: u32 = toU32(w73 >> 32)
|
|
2383
|
+
const w75: u64 = p256FiatAddcarryxU32(x74, x31, x62)
|
|
2384
|
+
const x75: u32 = toU32(w75)
|
|
2385
|
+
const x76: u32 = toU32(w75 >> 32)
|
|
2386
|
+
const w77: u64 = p256FiatAddcarryxU32(x76, x33, x64)
|
|
2387
|
+
const x77: u32 = toU32(w77)
|
|
2388
|
+
const x78: u32 = toU32(w77 >> 32)
|
|
2389
|
+
const w79: u64 = p256FiatAddcarryxU32(x78, x35, x66)
|
|
2390
|
+
const x79: u32 = toU32(w79)
|
|
2391
|
+
const x80: u32 = toU32(w79 >> 32)
|
|
2392
|
+
const w81: u64 = p256FiatAddcarryxU32(x80, x37, x42)
|
|
2393
|
+
const x81: u32 = toU32(w81)
|
|
2394
|
+
const x82: u32 = toU32(w81 >> 32)
|
|
2395
|
+
const w83: u64 = p256FiatAddcarryxU32(x82, x39, x43)
|
|
2396
|
+
const x83: u32 = toU32(w83)
|
|
2397
|
+
const x84: u32 = toU32(w83 >> 32)
|
|
2398
|
+
const w85: u64 = p256FiatMulxU32(x1, arg2[7])
|
|
2399
|
+
const x85: u32 = toU32(w85)
|
|
2400
|
+
const x86: u32 = toU32(w85 >> 32)
|
|
2401
|
+
const w87: u64 = p256FiatMulxU32(x1, arg2[6])
|
|
2402
|
+
const x87: u32 = toU32(w87)
|
|
2403
|
+
const x88: u32 = toU32(w87 >> 32)
|
|
2404
|
+
const w89: u64 = p256FiatMulxU32(x1, arg2[5])
|
|
2405
|
+
const x89: u32 = toU32(w89)
|
|
2406
|
+
const x90: u32 = toU32(w89 >> 32)
|
|
2407
|
+
const w91: u64 = p256FiatMulxU32(x1, arg2[4])
|
|
2408
|
+
const x91: u32 = toU32(w91)
|
|
2409
|
+
const x92: u32 = toU32(w91 >> 32)
|
|
2410
|
+
const w93: u64 = p256FiatMulxU32(x1, arg2[3])
|
|
2411
|
+
const x93: u32 = toU32(w93)
|
|
2412
|
+
const x94: u32 = toU32(w93 >> 32)
|
|
2413
|
+
const w95: u64 = p256FiatMulxU32(x1, arg2[2])
|
|
2414
|
+
const x95: u32 = toU32(w95)
|
|
2415
|
+
const x96: u32 = toU32(w95 >> 32)
|
|
2416
|
+
const w97: u64 = p256FiatMulxU32(x1, arg2[1])
|
|
2417
|
+
const x97: u32 = toU32(w97)
|
|
2418
|
+
const x98: u32 = toU32(w97 >> 32)
|
|
2419
|
+
const w99: u64 = p256FiatMulxU32(x1, arg2[0])
|
|
2420
|
+
const x99: u32 = toU32(w99)
|
|
2421
|
+
const x100: u32 = toU32(w99 >> 32)
|
|
2422
|
+
const w101: u64 = p256FiatAddcarryxU32(0x0, x100, x97)
|
|
2423
|
+
const x101: u32 = toU32(w101)
|
|
2424
|
+
const x102: u32 = toU32(w101 >> 32)
|
|
2425
|
+
const w103: u64 = p256FiatAddcarryxU32(x102, x98, x95)
|
|
2426
|
+
const x103: u32 = toU32(w103)
|
|
2427
|
+
const x104: u32 = toU32(w103 >> 32)
|
|
2428
|
+
const w105: u64 = p256FiatAddcarryxU32(x104, x96, x93)
|
|
2429
|
+
const x105: u32 = toU32(w105)
|
|
2430
|
+
const x106: u32 = toU32(w105 >> 32)
|
|
2431
|
+
const w107: u64 = p256FiatAddcarryxU32(x106, x94, x91)
|
|
2432
|
+
const x107: u32 = toU32(w107)
|
|
2433
|
+
const x108: u32 = toU32(w107 >> 32)
|
|
2434
|
+
const w109: u64 = p256FiatAddcarryxU32(x108, x92, x89)
|
|
2435
|
+
const x109: u32 = toU32(w109)
|
|
2436
|
+
const x110: u32 = toU32(w109 >> 32)
|
|
2437
|
+
const w111: u64 = p256FiatAddcarryxU32(x110, x90, x87)
|
|
2438
|
+
const x111: u32 = toU32(w111)
|
|
2439
|
+
const x112: u32 = toU32(w111 >> 32)
|
|
2440
|
+
const w113: u64 = p256FiatAddcarryxU32(x112, x88, x85)
|
|
2441
|
+
const x113: u32 = toU32(w113)
|
|
2442
|
+
const x114: u32 = toU32(w113 >> 32)
|
|
2443
|
+
const x115: u32 = x114 + x86
|
|
2444
|
+
const w116: u64 = p256FiatAddcarryxU32(0x0, x69, x99)
|
|
2445
|
+
const x116: u32 = toU32(w116)
|
|
2446
|
+
const x117: u32 = toU32(w116 >> 32)
|
|
2447
|
+
const w118: u64 = p256FiatAddcarryxU32(x117, x71, x101)
|
|
2448
|
+
const x118: u32 = toU32(w118)
|
|
2449
|
+
const x119: u32 = toU32(w118 >> 32)
|
|
2450
|
+
const w120: u64 = p256FiatAddcarryxU32(x119, x73, x103)
|
|
2451
|
+
const x120: u32 = toU32(w120)
|
|
2452
|
+
const x121: u32 = toU32(w120 >> 32)
|
|
2453
|
+
const w122: u64 = p256FiatAddcarryxU32(x121, x75, x105)
|
|
2454
|
+
const x122: u32 = toU32(w122)
|
|
2455
|
+
const x123: u32 = toU32(w122 >> 32)
|
|
2456
|
+
const w124: u64 = p256FiatAddcarryxU32(x123, x77, x107)
|
|
2457
|
+
const x124: u32 = toU32(w124)
|
|
2458
|
+
const x125: u32 = toU32(w124 >> 32)
|
|
2459
|
+
const w126: u64 = p256FiatAddcarryxU32(x125, x79, x109)
|
|
2460
|
+
const x126: u32 = toU32(w126)
|
|
2461
|
+
const x127: u32 = toU32(w126 >> 32)
|
|
2462
|
+
const w128: u64 = p256FiatAddcarryxU32(x127, x81, x111)
|
|
2463
|
+
const x128: u32 = toU32(w128)
|
|
2464
|
+
const x129: u32 = toU32(w128 >> 32)
|
|
2465
|
+
const w130: u64 = p256FiatAddcarryxU32(x129, x83, x113)
|
|
2466
|
+
const x130: u32 = toU32(w130)
|
|
2467
|
+
const x131: u32 = toU32(w130 >> 32)
|
|
2468
|
+
const w132: u64 = p256FiatAddcarryxU32(x131, x84, x115)
|
|
2469
|
+
const x132: u32 = toU32(w132)
|
|
2470
|
+
const x133: u32 = toU32(w132 >> 32)
|
|
2471
|
+
const w134: u64 = p256FiatMulxU32(x116, 0xee00bc4f)
|
|
2472
|
+
const x134: u32 = toU32(w134)
|
|
2473
|
+
const w136: u64 = p256FiatMulxU32(x134, 0xffffffff)
|
|
2474
|
+
const x136: u32 = toU32(w136)
|
|
2475
|
+
const x137: u32 = toU32(w136 >> 32)
|
|
2476
|
+
const w138: u64 = p256FiatMulxU32(x134, 0xffffffff)
|
|
2477
|
+
const x138: u32 = toU32(w138)
|
|
2478
|
+
const x139: u32 = toU32(w138 >> 32)
|
|
2479
|
+
const w140: u64 = p256FiatMulxU32(x134, 0xffffffff)
|
|
2480
|
+
const x140: u32 = toU32(w140)
|
|
2481
|
+
const x141: u32 = toU32(w140 >> 32)
|
|
2482
|
+
const w142: u64 = p256FiatMulxU32(x134, 0xbce6faad)
|
|
2483
|
+
const x142: u32 = toU32(w142)
|
|
2484
|
+
const x143: u32 = toU32(w142 >> 32)
|
|
2485
|
+
const w144: u64 = p256FiatMulxU32(x134, 0xa7179e84)
|
|
2486
|
+
const x144: u32 = toU32(w144)
|
|
2487
|
+
const x145: u32 = toU32(w144 >> 32)
|
|
2488
|
+
const w146: u64 = p256FiatMulxU32(x134, 0xf3b9cac2)
|
|
2489
|
+
const x146: u32 = toU32(w146)
|
|
2490
|
+
const x147: u32 = toU32(w146 >> 32)
|
|
2491
|
+
const w148: u64 = p256FiatMulxU32(x134, 0xfc632551)
|
|
2492
|
+
const x148: u32 = toU32(w148)
|
|
2493
|
+
const x149: u32 = toU32(w148 >> 32)
|
|
2494
|
+
const w150: u64 = p256FiatAddcarryxU32(0x0, x149, x146)
|
|
2495
|
+
const x150: u32 = toU32(w150)
|
|
2496
|
+
const x151: u32 = toU32(w150 >> 32)
|
|
2497
|
+
const w152: u64 = p256FiatAddcarryxU32(x151, x147, x144)
|
|
2498
|
+
const x152: u32 = toU32(w152)
|
|
2499
|
+
const x153: u32 = toU32(w152 >> 32)
|
|
2500
|
+
const w154: u64 = p256FiatAddcarryxU32(x153, x145, x142)
|
|
2501
|
+
const x154: u32 = toU32(w154)
|
|
2502
|
+
const x155: u32 = toU32(w154 >> 32)
|
|
2503
|
+
const w156: u64 = p256FiatAddcarryxU32(x155, x143, x140)
|
|
2504
|
+
const x156: u32 = toU32(w156)
|
|
2505
|
+
const x157: u32 = toU32(w156 >> 32)
|
|
2506
|
+
const w158: u64 = p256FiatAddcarryxU32(x157, x141, x138)
|
|
2507
|
+
const x158: u32 = toU32(w158)
|
|
2508
|
+
const x159: u32 = toU32(w158 >> 32)
|
|
2509
|
+
const x160: u32 = x159 + x139
|
|
2510
|
+
const w161: u64 = p256FiatAddcarryxU32(0x0, x116, x148)
|
|
2511
|
+
const x162: u32 = toU32(w161 >> 32)
|
|
2512
|
+
const w163: u64 = p256FiatAddcarryxU32(x162, x118, x150)
|
|
2513
|
+
const x163: u32 = toU32(w163)
|
|
2514
|
+
const x164: u32 = toU32(w163 >> 32)
|
|
2515
|
+
const w165: u64 = p256FiatAddcarryxU32(x164, x120, x152)
|
|
2516
|
+
const x165: u32 = toU32(w165)
|
|
2517
|
+
const x166: u32 = toU32(w165 >> 32)
|
|
2518
|
+
const w167: u64 = p256FiatAddcarryxU32(x166, x122, x154)
|
|
2519
|
+
const x167: u32 = toU32(w167)
|
|
2520
|
+
const x168: u32 = toU32(w167 >> 32)
|
|
2521
|
+
const w169: u64 = p256FiatAddcarryxU32(x168, x124, x156)
|
|
2522
|
+
const x169: u32 = toU32(w169)
|
|
2523
|
+
const x170: u32 = toU32(w169 >> 32)
|
|
2524
|
+
const w171: u64 = p256FiatAddcarryxU32(x170, x126, x158)
|
|
2525
|
+
const x171: u32 = toU32(w171)
|
|
2526
|
+
const x172: u32 = toU32(w171 >> 32)
|
|
2527
|
+
const w173: u64 = p256FiatAddcarryxU32(x172, x128, x160)
|
|
2528
|
+
const x173: u32 = toU32(w173)
|
|
2529
|
+
const x174: u32 = toU32(w173 >> 32)
|
|
2530
|
+
const w175: u64 = p256FiatAddcarryxU32(x174, x130, x136)
|
|
2531
|
+
const x175: u32 = toU32(w175)
|
|
2532
|
+
const x176: u32 = toU32(w175 >> 32)
|
|
2533
|
+
const w177: u64 = p256FiatAddcarryxU32(x176, x132, x137)
|
|
2534
|
+
const x177: u32 = toU32(w177)
|
|
2535
|
+
const x178: u32 = toU32(w177 >> 32)
|
|
2536
|
+
const x179: u32 = x178 + x133
|
|
2537
|
+
const w180: u64 = p256FiatMulxU32(x2, arg2[7])
|
|
2538
|
+
const x180: u32 = toU32(w180)
|
|
2539
|
+
const x181: u32 = toU32(w180 >> 32)
|
|
2540
|
+
const w182: u64 = p256FiatMulxU32(x2, arg2[6])
|
|
2541
|
+
const x182: u32 = toU32(w182)
|
|
2542
|
+
const x183: u32 = toU32(w182 >> 32)
|
|
2543
|
+
const w184: u64 = p256FiatMulxU32(x2, arg2[5])
|
|
2544
|
+
const x184: u32 = toU32(w184)
|
|
2545
|
+
const x185: u32 = toU32(w184 >> 32)
|
|
2546
|
+
const w186: u64 = p256FiatMulxU32(x2, arg2[4])
|
|
2547
|
+
const x186: u32 = toU32(w186)
|
|
2548
|
+
const x187: u32 = toU32(w186 >> 32)
|
|
2549
|
+
const w188: u64 = p256FiatMulxU32(x2, arg2[3])
|
|
2550
|
+
const x188: u32 = toU32(w188)
|
|
2551
|
+
const x189: u32 = toU32(w188 >> 32)
|
|
2552
|
+
const w190: u64 = p256FiatMulxU32(x2, arg2[2])
|
|
2553
|
+
const x190: u32 = toU32(w190)
|
|
2554
|
+
const x191: u32 = toU32(w190 >> 32)
|
|
2555
|
+
const w192: u64 = p256FiatMulxU32(x2, arg2[1])
|
|
2556
|
+
const x192: u32 = toU32(w192)
|
|
2557
|
+
const x193: u32 = toU32(w192 >> 32)
|
|
2558
|
+
const w194: u64 = p256FiatMulxU32(x2, arg2[0])
|
|
2559
|
+
const x194: u32 = toU32(w194)
|
|
2560
|
+
const x195: u32 = toU32(w194 >> 32)
|
|
2561
|
+
const w196: u64 = p256FiatAddcarryxU32(0x0, x195, x192)
|
|
2562
|
+
const x196: u32 = toU32(w196)
|
|
2563
|
+
const x197: u32 = toU32(w196 >> 32)
|
|
2564
|
+
const w198: u64 = p256FiatAddcarryxU32(x197, x193, x190)
|
|
2565
|
+
const x198: u32 = toU32(w198)
|
|
2566
|
+
const x199: u32 = toU32(w198 >> 32)
|
|
2567
|
+
const w200: u64 = p256FiatAddcarryxU32(x199, x191, x188)
|
|
2568
|
+
const x200: u32 = toU32(w200)
|
|
2569
|
+
const x201: u32 = toU32(w200 >> 32)
|
|
2570
|
+
const w202: u64 = p256FiatAddcarryxU32(x201, x189, x186)
|
|
2571
|
+
const x202: u32 = toU32(w202)
|
|
2572
|
+
const x203: u32 = toU32(w202 >> 32)
|
|
2573
|
+
const w204: u64 = p256FiatAddcarryxU32(x203, x187, x184)
|
|
2574
|
+
const x204: u32 = toU32(w204)
|
|
2575
|
+
const x205: u32 = toU32(w204 >> 32)
|
|
2576
|
+
const w206: u64 = p256FiatAddcarryxU32(x205, x185, x182)
|
|
2577
|
+
const x206: u32 = toU32(w206)
|
|
2578
|
+
const x207: u32 = toU32(w206 >> 32)
|
|
2579
|
+
const w208: u64 = p256FiatAddcarryxU32(x207, x183, x180)
|
|
2580
|
+
const x208: u32 = toU32(w208)
|
|
2581
|
+
const x209: u32 = toU32(w208 >> 32)
|
|
2582
|
+
const x210: u32 = x209 + x181
|
|
2583
|
+
const w211: u64 = p256FiatAddcarryxU32(0x0, x163, x194)
|
|
2584
|
+
const x211: u32 = toU32(w211)
|
|
2585
|
+
const x212: u32 = toU32(w211 >> 32)
|
|
2586
|
+
const w213: u64 = p256FiatAddcarryxU32(x212, x165, x196)
|
|
2587
|
+
const x213: u32 = toU32(w213)
|
|
2588
|
+
const x214: u32 = toU32(w213 >> 32)
|
|
2589
|
+
const w215: u64 = p256FiatAddcarryxU32(x214, x167, x198)
|
|
2590
|
+
const x215: u32 = toU32(w215)
|
|
2591
|
+
const x216: u32 = toU32(w215 >> 32)
|
|
2592
|
+
const w217: u64 = p256FiatAddcarryxU32(x216, x169, x200)
|
|
2593
|
+
const x217: u32 = toU32(w217)
|
|
2594
|
+
const x218: u32 = toU32(w217 >> 32)
|
|
2595
|
+
const w219: u64 = p256FiatAddcarryxU32(x218, x171, x202)
|
|
2596
|
+
const x219: u32 = toU32(w219)
|
|
2597
|
+
const x220: u32 = toU32(w219 >> 32)
|
|
2598
|
+
const w221: u64 = p256FiatAddcarryxU32(x220, x173, x204)
|
|
2599
|
+
const x221: u32 = toU32(w221)
|
|
2600
|
+
const x222: u32 = toU32(w221 >> 32)
|
|
2601
|
+
const w223: u64 = p256FiatAddcarryxU32(x222, x175, x206)
|
|
2602
|
+
const x223: u32 = toU32(w223)
|
|
2603
|
+
const x224: u32 = toU32(w223 >> 32)
|
|
2604
|
+
const w225: u64 = p256FiatAddcarryxU32(x224, x177, x208)
|
|
2605
|
+
const x225: u32 = toU32(w225)
|
|
2606
|
+
const x226: u32 = toU32(w225 >> 32)
|
|
2607
|
+
const w227: u64 = p256FiatAddcarryxU32(x226, x179, x210)
|
|
2608
|
+
const x227: u32 = toU32(w227)
|
|
2609
|
+
const x228: u32 = toU32(w227 >> 32)
|
|
2610
|
+
const w229: u64 = p256FiatMulxU32(x211, 0xee00bc4f)
|
|
2611
|
+
const x229: u32 = toU32(w229)
|
|
2612
|
+
const w231: u64 = p256FiatMulxU32(x229, 0xffffffff)
|
|
2613
|
+
const x231: u32 = toU32(w231)
|
|
2614
|
+
const x232: u32 = toU32(w231 >> 32)
|
|
2615
|
+
const w233: u64 = p256FiatMulxU32(x229, 0xffffffff)
|
|
2616
|
+
const x233: u32 = toU32(w233)
|
|
2617
|
+
const x234: u32 = toU32(w233 >> 32)
|
|
2618
|
+
const w235: u64 = p256FiatMulxU32(x229, 0xffffffff)
|
|
2619
|
+
const x235: u32 = toU32(w235)
|
|
2620
|
+
const x236: u32 = toU32(w235 >> 32)
|
|
2621
|
+
const w237: u64 = p256FiatMulxU32(x229, 0xbce6faad)
|
|
2622
|
+
const x237: u32 = toU32(w237)
|
|
2623
|
+
const x238: u32 = toU32(w237 >> 32)
|
|
2624
|
+
const w239: u64 = p256FiatMulxU32(x229, 0xa7179e84)
|
|
2625
|
+
const x239: u32 = toU32(w239)
|
|
2626
|
+
const x240: u32 = toU32(w239 >> 32)
|
|
2627
|
+
const w241: u64 = p256FiatMulxU32(x229, 0xf3b9cac2)
|
|
2628
|
+
const x241: u32 = toU32(w241)
|
|
2629
|
+
const x242: u32 = toU32(w241 >> 32)
|
|
2630
|
+
const w243: u64 = p256FiatMulxU32(x229, 0xfc632551)
|
|
2631
|
+
const x243: u32 = toU32(w243)
|
|
2632
|
+
const x244: u32 = toU32(w243 >> 32)
|
|
2633
|
+
const w245: u64 = p256FiatAddcarryxU32(0x0, x244, x241)
|
|
2634
|
+
const x245: u32 = toU32(w245)
|
|
2635
|
+
const x246: u32 = toU32(w245 >> 32)
|
|
2636
|
+
const w247: u64 = p256FiatAddcarryxU32(x246, x242, x239)
|
|
2637
|
+
const x247: u32 = toU32(w247)
|
|
2638
|
+
const x248: u32 = toU32(w247 >> 32)
|
|
2639
|
+
const w249: u64 = p256FiatAddcarryxU32(x248, x240, x237)
|
|
2640
|
+
const x249: u32 = toU32(w249)
|
|
2641
|
+
const x250: u32 = toU32(w249 >> 32)
|
|
2642
|
+
const w251: u64 = p256FiatAddcarryxU32(x250, x238, x235)
|
|
2643
|
+
const x251: u32 = toU32(w251)
|
|
2644
|
+
const x252: u32 = toU32(w251 >> 32)
|
|
2645
|
+
const w253: u64 = p256FiatAddcarryxU32(x252, x236, x233)
|
|
2646
|
+
const x253: u32 = toU32(w253)
|
|
2647
|
+
const x254: u32 = toU32(w253 >> 32)
|
|
2648
|
+
const x255: u32 = x254 + x234
|
|
2649
|
+
const w256: u64 = p256FiatAddcarryxU32(0x0, x211, x243)
|
|
2650
|
+
const x257: u32 = toU32(w256 >> 32)
|
|
2651
|
+
const w258: u64 = p256FiatAddcarryxU32(x257, x213, x245)
|
|
2652
|
+
const x258: u32 = toU32(w258)
|
|
2653
|
+
const x259: u32 = toU32(w258 >> 32)
|
|
2654
|
+
const w260: u64 = p256FiatAddcarryxU32(x259, x215, x247)
|
|
2655
|
+
const x260: u32 = toU32(w260)
|
|
2656
|
+
const x261: u32 = toU32(w260 >> 32)
|
|
2657
|
+
const w262: u64 = p256FiatAddcarryxU32(x261, x217, x249)
|
|
2658
|
+
const x262: u32 = toU32(w262)
|
|
2659
|
+
const x263: u32 = toU32(w262 >> 32)
|
|
2660
|
+
const w264: u64 = p256FiatAddcarryxU32(x263, x219, x251)
|
|
2661
|
+
const x264: u32 = toU32(w264)
|
|
2662
|
+
const x265: u32 = toU32(w264 >> 32)
|
|
2663
|
+
const w266: u64 = p256FiatAddcarryxU32(x265, x221, x253)
|
|
2664
|
+
const x266: u32 = toU32(w266)
|
|
2665
|
+
const x267: u32 = toU32(w266 >> 32)
|
|
2666
|
+
const w268: u64 = p256FiatAddcarryxU32(x267, x223, x255)
|
|
2667
|
+
const x268: u32 = toU32(w268)
|
|
2668
|
+
const x269: u32 = toU32(w268 >> 32)
|
|
2669
|
+
const w270: u64 = p256FiatAddcarryxU32(x269, x225, x231)
|
|
2670
|
+
const x270: u32 = toU32(w270)
|
|
2671
|
+
const x271: u32 = toU32(w270 >> 32)
|
|
2672
|
+
const w272: u64 = p256FiatAddcarryxU32(x271, x227, x232)
|
|
2673
|
+
const x272: u32 = toU32(w272)
|
|
2674
|
+
const x273: u32 = toU32(w272 >> 32)
|
|
2675
|
+
const x274: u32 = x273 + x228
|
|
2676
|
+
const w275: u64 = p256FiatMulxU32(x3, arg2[7])
|
|
2677
|
+
const x275: u32 = toU32(w275)
|
|
2678
|
+
const x276: u32 = toU32(w275 >> 32)
|
|
2679
|
+
const w277: u64 = p256FiatMulxU32(x3, arg2[6])
|
|
2680
|
+
const x277: u32 = toU32(w277)
|
|
2681
|
+
const x278: u32 = toU32(w277 >> 32)
|
|
2682
|
+
const w279: u64 = p256FiatMulxU32(x3, arg2[5])
|
|
2683
|
+
const x279: u32 = toU32(w279)
|
|
2684
|
+
const x280: u32 = toU32(w279 >> 32)
|
|
2685
|
+
const w281: u64 = p256FiatMulxU32(x3, arg2[4])
|
|
2686
|
+
const x281: u32 = toU32(w281)
|
|
2687
|
+
const x282: u32 = toU32(w281 >> 32)
|
|
2688
|
+
const w283: u64 = p256FiatMulxU32(x3, arg2[3])
|
|
2689
|
+
const x283: u32 = toU32(w283)
|
|
2690
|
+
const x284: u32 = toU32(w283 >> 32)
|
|
2691
|
+
const w285: u64 = p256FiatMulxU32(x3, arg2[2])
|
|
2692
|
+
const x285: u32 = toU32(w285)
|
|
2693
|
+
const x286: u32 = toU32(w285 >> 32)
|
|
2694
|
+
const w287: u64 = p256FiatMulxU32(x3, arg2[1])
|
|
2695
|
+
const x287: u32 = toU32(w287)
|
|
2696
|
+
const x288: u32 = toU32(w287 >> 32)
|
|
2697
|
+
const w289: u64 = p256FiatMulxU32(x3, arg2[0])
|
|
2698
|
+
const x289: u32 = toU32(w289)
|
|
2699
|
+
const x290: u32 = toU32(w289 >> 32)
|
|
2700
|
+
const w291: u64 = p256FiatAddcarryxU32(0x0, x290, x287)
|
|
2701
|
+
const x291: u32 = toU32(w291)
|
|
2702
|
+
const x292: u32 = toU32(w291 >> 32)
|
|
2703
|
+
const w293: u64 = p256FiatAddcarryxU32(x292, x288, x285)
|
|
2704
|
+
const x293: u32 = toU32(w293)
|
|
2705
|
+
const x294: u32 = toU32(w293 >> 32)
|
|
2706
|
+
const w295: u64 = p256FiatAddcarryxU32(x294, x286, x283)
|
|
2707
|
+
const x295: u32 = toU32(w295)
|
|
2708
|
+
const x296: u32 = toU32(w295 >> 32)
|
|
2709
|
+
const w297: u64 = p256FiatAddcarryxU32(x296, x284, x281)
|
|
2710
|
+
const x297: u32 = toU32(w297)
|
|
2711
|
+
const x298: u32 = toU32(w297 >> 32)
|
|
2712
|
+
const w299: u64 = p256FiatAddcarryxU32(x298, x282, x279)
|
|
2713
|
+
const x299: u32 = toU32(w299)
|
|
2714
|
+
const x300: u32 = toU32(w299 >> 32)
|
|
2715
|
+
const w301: u64 = p256FiatAddcarryxU32(x300, x280, x277)
|
|
2716
|
+
const x301: u32 = toU32(w301)
|
|
2717
|
+
const x302: u32 = toU32(w301 >> 32)
|
|
2718
|
+
const w303: u64 = p256FiatAddcarryxU32(x302, x278, x275)
|
|
2719
|
+
const x303: u32 = toU32(w303)
|
|
2720
|
+
const x304: u32 = toU32(w303 >> 32)
|
|
2721
|
+
const x305: u32 = x304 + x276
|
|
2722
|
+
const w306: u64 = p256FiatAddcarryxU32(0x0, x258, x289)
|
|
2723
|
+
const x306: u32 = toU32(w306)
|
|
2724
|
+
const x307: u32 = toU32(w306 >> 32)
|
|
2725
|
+
const w308: u64 = p256FiatAddcarryxU32(x307, x260, x291)
|
|
2726
|
+
const x308: u32 = toU32(w308)
|
|
2727
|
+
const x309: u32 = toU32(w308 >> 32)
|
|
2728
|
+
const w310: u64 = p256FiatAddcarryxU32(x309, x262, x293)
|
|
2729
|
+
const x310: u32 = toU32(w310)
|
|
2730
|
+
const x311: u32 = toU32(w310 >> 32)
|
|
2731
|
+
const w312: u64 = p256FiatAddcarryxU32(x311, x264, x295)
|
|
2732
|
+
const x312: u32 = toU32(w312)
|
|
2733
|
+
const x313: u32 = toU32(w312 >> 32)
|
|
2734
|
+
const w314: u64 = p256FiatAddcarryxU32(x313, x266, x297)
|
|
2735
|
+
const x314: u32 = toU32(w314)
|
|
2736
|
+
const x315: u32 = toU32(w314 >> 32)
|
|
2737
|
+
const w316: u64 = p256FiatAddcarryxU32(x315, x268, x299)
|
|
2738
|
+
const x316: u32 = toU32(w316)
|
|
2739
|
+
const x317: u32 = toU32(w316 >> 32)
|
|
2740
|
+
const w318: u64 = p256FiatAddcarryxU32(x317, x270, x301)
|
|
2741
|
+
const x318: u32 = toU32(w318)
|
|
2742
|
+
const x319: u32 = toU32(w318 >> 32)
|
|
2743
|
+
const w320: u64 = p256FiatAddcarryxU32(x319, x272, x303)
|
|
2744
|
+
const x320: u32 = toU32(w320)
|
|
2745
|
+
const x321: u32 = toU32(w320 >> 32)
|
|
2746
|
+
const w322: u64 = p256FiatAddcarryxU32(x321, x274, x305)
|
|
2747
|
+
const x322: u32 = toU32(w322)
|
|
2748
|
+
const x323: u32 = toU32(w322 >> 32)
|
|
2749
|
+
const w324: u64 = p256FiatMulxU32(x306, 0xee00bc4f)
|
|
2750
|
+
const x324: u32 = toU32(w324)
|
|
2751
|
+
const w326: u64 = p256FiatMulxU32(x324, 0xffffffff)
|
|
2752
|
+
const x326: u32 = toU32(w326)
|
|
2753
|
+
const x327: u32 = toU32(w326 >> 32)
|
|
2754
|
+
const w328: u64 = p256FiatMulxU32(x324, 0xffffffff)
|
|
2755
|
+
const x328: u32 = toU32(w328)
|
|
2756
|
+
const x329: u32 = toU32(w328 >> 32)
|
|
2757
|
+
const w330: u64 = p256FiatMulxU32(x324, 0xffffffff)
|
|
2758
|
+
const x330: u32 = toU32(w330)
|
|
2759
|
+
const x331: u32 = toU32(w330 >> 32)
|
|
2760
|
+
const w332: u64 = p256FiatMulxU32(x324, 0xbce6faad)
|
|
2761
|
+
const x332: u32 = toU32(w332)
|
|
2762
|
+
const x333: u32 = toU32(w332 >> 32)
|
|
2763
|
+
const w334: u64 = p256FiatMulxU32(x324, 0xa7179e84)
|
|
2764
|
+
const x334: u32 = toU32(w334)
|
|
2765
|
+
const x335: u32 = toU32(w334 >> 32)
|
|
2766
|
+
const w336: u64 = p256FiatMulxU32(x324, 0xf3b9cac2)
|
|
2767
|
+
const x336: u32 = toU32(w336)
|
|
2768
|
+
const x337: u32 = toU32(w336 >> 32)
|
|
2769
|
+
const w338: u64 = p256FiatMulxU32(x324, 0xfc632551)
|
|
2770
|
+
const x338: u32 = toU32(w338)
|
|
2771
|
+
const x339: u32 = toU32(w338 >> 32)
|
|
2772
|
+
const w340: u64 = p256FiatAddcarryxU32(0x0, x339, x336)
|
|
2773
|
+
const x340: u32 = toU32(w340)
|
|
2774
|
+
const x341: u32 = toU32(w340 >> 32)
|
|
2775
|
+
const w342: u64 = p256FiatAddcarryxU32(x341, x337, x334)
|
|
2776
|
+
const x342: u32 = toU32(w342)
|
|
2777
|
+
const x343: u32 = toU32(w342 >> 32)
|
|
2778
|
+
const w344: u64 = p256FiatAddcarryxU32(x343, x335, x332)
|
|
2779
|
+
const x344: u32 = toU32(w344)
|
|
2780
|
+
const x345: u32 = toU32(w344 >> 32)
|
|
2781
|
+
const w346: u64 = p256FiatAddcarryxU32(x345, x333, x330)
|
|
2782
|
+
const x346: u32 = toU32(w346)
|
|
2783
|
+
const x347: u32 = toU32(w346 >> 32)
|
|
2784
|
+
const w348: u64 = p256FiatAddcarryxU32(x347, x331, x328)
|
|
2785
|
+
const x348: u32 = toU32(w348)
|
|
2786
|
+
const x349: u32 = toU32(w348 >> 32)
|
|
2787
|
+
const x350: u32 = x349 + x329
|
|
2788
|
+
const w351: u64 = p256FiatAddcarryxU32(0x0, x306, x338)
|
|
2789
|
+
const x352: u32 = toU32(w351 >> 32)
|
|
2790
|
+
const w353: u64 = p256FiatAddcarryxU32(x352, x308, x340)
|
|
2791
|
+
const x353: u32 = toU32(w353)
|
|
2792
|
+
const x354: u32 = toU32(w353 >> 32)
|
|
2793
|
+
const w355: u64 = p256FiatAddcarryxU32(x354, x310, x342)
|
|
2794
|
+
const x355: u32 = toU32(w355)
|
|
2795
|
+
const x356: u32 = toU32(w355 >> 32)
|
|
2796
|
+
const w357: u64 = p256FiatAddcarryxU32(x356, x312, x344)
|
|
2797
|
+
const x357: u32 = toU32(w357)
|
|
2798
|
+
const x358: u32 = toU32(w357 >> 32)
|
|
2799
|
+
const w359: u64 = p256FiatAddcarryxU32(x358, x314, x346)
|
|
2800
|
+
const x359: u32 = toU32(w359)
|
|
2801
|
+
const x360: u32 = toU32(w359 >> 32)
|
|
2802
|
+
const w361: u64 = p256FiatAddcarryxU32(x360, x316, x348)
|
|
2803
|
+
const x361: u32 = toU32(w361)
|
|
2804
|
+
const x362: u32 = toU32(w361 >> 32)
|
|
2805
|
+
const w363: u64 = p256FiatAddcarryxU32(x362, x318, x350)
|
|
2806
|
+
const x363: u32 = toU32(w363)
|
|
2807
|
+
const x364: u32 = toU32(w363 >> 32)
|
|
2808
|
+
const w365: u64 = p256FiatAddcarryxU32(x364, x320, x326)
|
|
2809
|
+
const x365: u32 = toU32(w365)
|
|
2810
|
+
const x366: u32 = toU32(w365 >> 32)
|
|
2811
|
+
const w367: u64 = p256FiatAddcarryxU32(x366, x322, x327)
|
|
2812
|
+
const x367: u32 = toU32(w367)
|
|
2813
|
+
const x368: u32 = toU32(w367 >> 32)
|
|
2814
|
+
const x369: u32 = x368 + x323
|
|
2815
|
+
const w370: u64 = p256FiatMulxU32(x4, arg2[7])
|
|
2816
|
+
const x370: u32 = toU32(w370)
|
|
2817
|
+
const x371: u32 = toU32(w370 >> 32)
|
|
2818
|
+
const w372: u64 = p256FiatMulxU32(x4, arg2[6])
|
|
2819
|
+
const x372: u32 = toU32(w372)
|
|
2820
|
+
const x373: u32 = toU32(w372 >> 32)
|
|
2821
|
+
const w374: u64 = p256FiatMulxU32(x4, arg2[5])
|
|
2822
|
+
const x374: u32 = toU32(w374)
|
|
2823
|
+
const x375: u32 = toU32(w374 >> 32)
|
|
2824
|
+
const w376: u64 = p256FiatMulxU32(x4, arg2[4])
|
|
2825
|
+
const x376: u32 = toU32(w376)
|
|
2826
|
+
const x377: u32 = toU32(w376 >> 32)
|
|
2827
|
+
const w378: u64 = p256FiatMulxU32(x4, arg2[3])
|
|
2828
|
+
const x378: u32 = toU32(w378)
|
|
2829
|
+
const x379: u32 = toU32(w378 >> 32)
|
|
2830
|
+
const w380: u64 = p256FiatMulxU32(x4, arg2[2])
|
|
2831
|
+
const x380: u32 = toU32(w380)
|
|
2832
|
+
const x381: u32 = toU32(w380 >> 32)
|
|
2833
|
+
const w382: u64 = p256FiatMulxU32(x4, arg2[1])
|
|
2834
|
+
const x382: u32 = toU32(w382)
|
|
2835
|
+
const x383: u32 = toU32(w382 >> 32)
|
|
2836
|
+
const w384: u64 = p256FiatMulxU32(x4, arg2[0])
|
|
2837
|
+
const x384: u32 = toU32(w384)
|
|
2838
|
+
const x385: u32 = toU32(w384 >> 32)
|
|
2839
|
+
const w386: u64 = p256FiatAddcarryxU32(0x0, x385, x382)
|
|
2840
|
+
const x386: u32 = toU32(w386)
|
|
2841
|
+
const x387: u32 = toU32(w386 >> 32)
|
|
2842
|
+
const w388: u64 = p256FiatAddcarryxU32(x387, x383, x380)
|
|
2843
|
+
const x388: u32 = toU32(w388)
|
|
2844
|
+
const x389: u32 = toU32(w388 >> 32)
|
|
2845
|
+
const w390: u64 = p256FiatAddcarryxU32(x389, x381, x378)
|
|
2846
|
+
const x390: u32 = toU32(w390)
|
|
2847
|
+
const x391: u32 = toU32(w390 >> 32)
|
|
2848
|
+
const w392: u64 = p256FiatAddcarryxU32(x391, x379, x376)
|
|
2849
|
+
const x392: u32 = toU32(w392)
|
|
2850
|
+
const x393: u32 = toU32(w392 >> 32)
|
|
2851
|
+
const w394: u64 = p256FiatAddcarryxU32(x393, x377, x374)
|
|
2852
|
+
const x394: u32 = toU32(w394)
|
|
2853
|
+
const x395: u32 = toU32(w394 >> 32)
|
|
2854
|
+
const w396: u64 = p256FiatAddcarryxU32(x395, x375, x372)
|
|
2855
|
+
const x396: u32 = toU32(w396)
|
|
2856
|
+
const x397: u32 = toU32(w396 >> 32)
|
|
2857
|
+
const w398: u64 = p256FiatAddcarryxU32(x397, x373, x370)
|
|
2858
|
+
const x398: u32 = toU32(w398)
|
|
2859
|
+
const x399: u32 = toU32(w398 >> 32)
|
|
2860
|
+
const x400: u32 = x399 + x371
|
|
2861
|
+
const w401: u64 = p256FiatAddcarryxU32(0x0, x353, x384)
|
|
2862
|
+
const x401: u32 = toU32(w401)
|
|
2863
|
+
const x402: u32 = toU32(w401 >> 32)
|
|
2864
|
+
const w403: u64 = p256FiatAddcarryxU32(x402, x355, x386)
|
|
2865
|
+
const x403: u32 = toU32(w403)
|
|
2866
|
+
const x404: u32 = toU32(w403 >> 32)
|
|
2867
|
+
const w405: u64 = p256FiatAddcarryxU32(x404, x357, x388)
|
|
2868
|
+
const x405: u32 = toU32(w405)
|
|
2869
|
+
const x406: u32 = toU32(w405 >> 32)
|
|
2870
|
+
const w407: u64 = p256FiatAddcarryxU32(x406, x359, x390)
|
|
2871
|
+
const x407: u32 = toU32(w407)
|
|
2872
|
+
const x408: u32 = toU32(w407 >> 32)
|
|
2873
|
+
const w409: u64 = p256FiatAddcarryxU32(x408, x361, x392)
|
|
2874
|
+
const x409: u32 = toU32(w409)
|
|
2875
|
+
const x410: u32 = toU32(w409 >> 32)
|
|
2876
|
+
const w411: u64 = p256FiatAddcarryxU32(x410, x363, x394)
|
|
2877
|
+
const x411: u32 = toU32(w411)
|
|
2878
|
+
const x412: u32 = toU32(w411 >> 32)
|
|
2879
|
+
const w413: u64 = p256FiatAddcarryxU32(x412, x365, x396)
|
|
2880
|
+
const x413: u32 = toU32(w413)
|
|
2881
|
+
const x414: u32 = toU32(w413 >> 32)
|
|
2882
|
+
const w415: u64 = p256FiatAddcarryxU32(x414, x367, x398)
|
|
2883
|
+
const x415: u32 = toU32(w415)
|
|
2884
|
+
const x416: u32 = toU32(w415 >> 32)
|
|
2885
|
+
const w417: u64 = p256FiatAddcarryxU32(x416, x369, x400)
|
|
2886
|
+
const x417: u32 = toU32(w417)
|
|
2887
|
+
const x418: u32 = toU32(w417 >> 32)
|
|
2888
|
+
const w419: u64 = p256FiatMulxU32(x401, 0xee00bc4f)
|
|
2889
|
+
const x419: u32 = toU32(w419)
|
|
2890
|
+
const w421: u64 = p256FiatMulxU32(x419, 0xffffffff)
|
|
2891
|
+
const x421: u32 = toU32(w421)
|
|
2892
|
+
const x422: u32 = toU32(w421 >> 32)
|
|
2893
|
+
const w423: u64 = p256FiatMulxU32(x419, 0xffffffff)
|
|
2894
|
+
const x423: u32 = toU32(w423)
|
|
2895
|
+
const x424: u32 = toU32(w423 >> 32)
|
|
2896
|
+
const w425: u64 = p256FiatMulxU32(x419, 0xffffffff)
|
|
2897
|
+
const x425: u32 = toU32(w425)
|
|
2898
|
+
const x426: u32 = toU32(w425 >> 32)
|
|
2899
|
+
const w427: u64 = p256FiatMulxU32(x419, 0xbce6faad)
|
|
2900
|
+
const x427: u32 = toU32(w427)
|
|
2901
|
+
const x428: u32 = toU32(w427 >> 32)
|
|
2902
|
+
const w429: u64 = p256FiatMulxU32(x419, 0xa7179e84)
|
|
2903
|
+
const x429: u32 = toU32(w429)
|
|
2904
|
+
const x430: u32 = toU32(w429 >> 32)
|
|
2905
|
+
const w431: u64 = p256FiatMulxU32(x419, 0xf3b9cac2)
|
|
2906
|
+
const x431: u32 = toU32(w431)
|
|
2907
|
+
const x432: u32 = toU32(w431 >> 32)
|
|
2908
|
+
const w433: u64 = p256FiatMulxU32(x419, 0xfc632551)
|
|
2909
|
+
const x433: u32 = toU32(w433)
|
|
2910
|
+
const x434: u32 = toU32(w433 >> 32)
|
|
2911
|
+
const w435: u64 = p256FiatAddcarryxU32(0x0, x434, x431)
|
|
2912
|
+
const x435: u32 = toU32(w435)
|
|
2913
|
+
const x436: u32 = toU32(w435 >> 32)
|
|
2914
|
+
const w437: u64 = p256FiatAddcarryxU32(x436, x432, x429)
|
|
2915
|
+
const x437: u32 = toU32(w437)
|
|
2916
|
+
const x438: u32 = toU32(w437 >> 32)
|
|
2917
|
+
const w439: u64 = p256FiatAddcarryxU32(x438, x430, x427)
|
|
2918
|
+
const x439: u32 = toU32(w439)
|
|
2919
|
+
const x440: u32 = toU32(w439 >> 32)
|
|
2920
|
+
const w441: u64 = p256FiatAddcarryxU32(x440, x428, x425)
|
|
2921
|
+
const x441: u32 = toU32(w441)
|
|
2922
|
+
const x442: u32 = toU32(w441 >> 32)
|
|
2923
|
+
const w443: u64 = p256FiatAddcarryxU32(x442, x426, x423)
|
|
2924
|
+
const x443: u32 = toU32(w443)
|
|
2925
|
+
const x444: u32 = toU32(w443 >> 32)
|
|
2926
|
+
const x445: u32 = x444 + x424
|
|
2927
|
+
const w446: u64 = p256FiatAddcarryxU32(0x0, x401, x433)
|
|
2928
|
+
const x447: u32 = toU32(w446 >> 32)
|
|
2929
|
+
const w448: u64 = p256FiatAddcarryxU32(x447, x403, x435)
|
|
2930
|
+
const x448: u32 = toU32(w448)
|
|
2931
|
+
const x449: u32 = toU32(w448 >> 32)
|
|
2932
|
+
const w450: u64 = p256FiatAddcarryxU32(x449, x405, x437)
|
|
2933
|
+
const x450: u32 = toU32(w450)
|
|
2934
|
+
const x451: u32 = toU32(w450 >> 32)
|
|
2935
|
+
const w452: u64 = p256FiatAddcarryxU32(x451, x407, x439)
|
|
2936
|
+
const x452: u32 = toU32(w452)
|
|
2937
|
+
const x453: u32 = toU32(w452 >> 32)
|
|
2938
|
+
const w454: u64 = p256FiatAddcarryxU32(x453, x409, x441)
|
|
2939
|
+
const x454: u32 = toU32(w454)
|
|
2940
|
+
const x455: u32 = toU32(w454 >> 32)
|
|
2941
|
+
const w456: u64 = p256FiatAddcarryxU32(x455, x411, x443)
|
|
2942
|
+
const x456: u32 = toU32(w456)
|
|
2943
|
+
const x457: u32 = toU32(w456 >> 32)
|
|
2944
|
+
const w458: u64 = p256FiatAddcarryxU32(x457, x413, x445)
|
|
2945
|
+
const x458: u32 = toU32(w458)
|
|
2946
|
+
const x459: u32 = toU32(w458 >> 32)
|
|
2947
|
+
const w460: u64 = p256FiatAddcarryxU32(x459, x415, x421)
|
|
2948
|
+
const x460: u32 = toU32(w460)
|
|
2949
|
+
const x461: u32 = toU32(w460 >> 32)
|
|
2950
|
+
const w462: u64 = p256FiatAddcarryxU32(x461, x417, x422)
|
|
2951
|
+
const x462: u32 = toU32(w462)
|
|
2952
|
+
const x463: u32 = toU32(w462 >> 32)
|
|
2953
|
+
const x464: u32 = x463 + x418
|
|
2954
|
+
const w465: u64 = p256FiatMulxU32(x5, arg2[7])
|
|
2955
|
+
const x465: u32 = toU32(w465)
|
|
2956
|
+
const x466: u32 = toU32(w465 >> 32)
|
|
2957
|
+
const w467: u64 = p256FiatMulxU32(x5, arg2[6])
|
|
2958
|
+
const x467: u32 = toU32(w467)
|
|
2959
|
+
const x468: u32 = toU32(w467 >> 32)
|
|
2960
|
+
const w469: u64 = p256FiatMulxU32(x5, arg2[5])
|
|
2961
|
+
const x469: u32 = toU32(w469)
|
|
2962
|
+
const x470: u32 = toU32(w469 >> 32)
|
|
2963
|
+
const w471: u64 = p256FiatMulxU32(x5, arg2[4])
|
|
2964
|
+
const x471: u32 = toU32(w471)
|
|
2965
|
+
const x472: u32 = toU32(w471 >> 32)
|
|
2966
|
+
const w473: u64 = p256FiatMulxU32(x5, arg2[3])
|
|
2967
|
+
const x473: u32 = toU32(w473)
|
|
2968
|
+
const x474: u32 = toU32(w473 >> 32)
|
|
2969
|
+
const w475: u64 = p256FiatMulxU32(x5, arg2[2])
|
|
2970
|
+
const x475: u32 = toU32(w475)
|
|
2971
|
+
const x476: u32 = toU32(w475 >> 32)
|
|
2972
|
+
const w477: u64 = p256FiatMulxU32(x5, arg2[1])
|
|
2973
|
+
const x477: u32 = toU32(w477)
|
|
2974
|
+
const x478: u32 = toU32(w477 >> 32)
|
|
2975
|
+
const w479: u64 = p256FiatMulxU32(x5, arg2[0])
|
|
2976
|
+
const x479: u32 = toU32(w479)
|
|
2977
|
+
const x480: u32 = toU32(w479 >> 32)
|
|
2978
|
+
const w481: u64 = p256FiatAddcarryxU32(0x0, x480, x477)
|
|
2979
|
+
const x481: u32 = toU32(w481)
|
|
2980
|
+
const x482: u32 = toU32(w481 >> 32)
|
|
2981
|
+
const w483: u64 = p256FiatAddcarryxU32(x482, x478, x475)
|
|
2982
|
+
const x483: u32 = toU32(w483)
|
|
2983
|
+
const x484: u32 = toU32(w483 >> 32)
|
|
2984
|
+
const w485: u64 = p256FiatAddcarryxU32(x484, x476, x473)
|
|
2985
|
+
const x485: u32 = toU32(w485)
|
|
2986
|
+
const x486: u32 = toU32(w485 >> 32)
|
|
2987
|
+
const w487: u64 = p256FiatAddcarryxU32(x486, x474, x471)
|
|
2988
|
+
const x487: u32 = toU32(w487)
|
|
2989
|
+
const x488: u32 = toU32(w487 >> 32)
|
|
2990
|
+
const w489: u64 = p256FiatAddcarryxU32(x488, x472, x469)
|
|
2991
|
+
const x489: u32 = toU32(w489)
|
|
2992
|
+
const x490: u32 = toU32(w489 >> 32)
|
|
2993
|
+
const w491: u64 = p256FiatAddcarryxU32(x490, x470, x467)
|
|
2994
|
+
const x491: u32 = toU32(w491)
|
|
2995
|
+
const x492: u32 = toU32(w491 >> 32)
|
|
2996
|
+
const w493: u64 = p256FiatAddcarryxU32(x492, x468, x465)
|
|
2997
|
+
const x493: u32 = toU32(w493)
|
|
2998
|
+
const x494: u32 = toU32(w493 >> 32)
|
|
2999
|
+
const x495: u32 = x494 + x466
|
|
3000
|
+
const w496: u64 = p256FiatAddcarryxU32(0x0, x448, x479)
|
|
3001
|
+
const x496: u32 = toU32(w496)
|
|
3002
|
+
const x497: u32 = toU32(w496 >> 32)
|
|
3003
|
+
const w498: u64 = p256FiatAddcarryxU32(x497, x450, x481)
|
|
3004
|
+
const x498: u32 = toU32(w498)
|
|
3005
|
+
const x499: u32 = toU32(w498 >> 32)
|
|
3006
|
+
const w500: u64 = p256FiatAddcarryxU32(x499, x452, x483)
|
|
3007
|
+
const x500: u32 = toU32(w500)
|
|
3008
|
+
const x501: u32 = toU32(w500 >> 32)
|
|
3009
|
+
const w502: u64 = p256FiatAddcarryxU32(x501, x454, x485)
|
|
3010
|
+
const x502: u32 = toU32(w502)
|
|
3011
|
+
const x503: u32 = toU32(w502 >> 32)
|
|
3012
|
+
const w504: u64 = p256FiatAddcarryxU32(x503, x456, x487)
|
|
3013
|
+
const x504: u32 = toU32(w504)
|
|
3014
|
+
const x505: u32 = toU32(w504 >> 32)
|
|
3015
|
+
const w506: u64 = p256FiatAddcarryxU32(x505, x458, x489)
|
|
3016
|
+
const x506: u32 = toU32(w506)
|
|
3017
|
+
const x507: u32 = toU32(w506 >> 32)
|
|
3018
|
+
const w508: u64 = p256FiatAddcarryxU32(x507, x460, x491)
|
|
3019
|
+
const x508: u32 = toU32(w508)
|
|
3020
|
+
const x509: u32 = toU32(w508 >> 32)
|
|
3021
|
+
const w510: u64 = p256FiatAddcarryxU32(x509, x462, x493)
|
|
3022
|
+
const x510: u32 = toU32(w510)
|
|
3023
|
+
const x511: u32 = toU32(w510 >> 32)
|
|
3024
|
+
const w512: u64 = p256FiatAddcarryxU32(x511, x464, x495)
|
|
3025
|
+
const x512: u32 = toU32(w512)
|
|
3026
|
+
const x513: u32 = toU32(w512 >> 32)
|
|
3027
|
+
const w514: u64 = p256FiatMulxU32(x496, 0xee00bc4f)
|
|
3028
|
+
const x514: u32 = toU32(w514)
|
|
3029
|
+
const w516: u64 = p256FiatMulxU32(x514, 0xffffffff)
|
|
3030
|
+
const x516: u32 = toU32(w516)
|
|
3031
|
+
const x517: u32 = toU32(w516 >> 32)
|
|
3032
|
+
const w518: u64 = p256FiatMulxU32(x514, 0xffffffff)
|
|
3033
|
+
const x518: u32 = toU32(w518)
|
|
3034
|
+
const x519: u32 = toU32(w518 >> 32)
|
|
3035
|
+
const w520: u64 = p256FiatMulxU32(x514, 0xffffffff)
|
|
3036
|
+
const x520: u32 = toU32(w520)
|
|
3037
|
+
const x521: u32 = toU32(w520 >> 32)
|
|
3038
|
+
const w522: u64 = p256FiatMulxU32(x514, 0xbce6faad)
|
|
3039
|
+
const x522: u32 = toU32(w522)
|
|
3040
|
+
const x523: u32 = toU32(w522 >> 32)
|
|
3041
|
+
const w524: u64 = p256FiatMulxU32(x514, 0xa7179e84)
|
|
3042
|
+
const x524: u32 = toU32(w524)
|
|
3043
|
+
const x525: u32 = toU32(w524 >> 32)
|
|
3044
|
+
const w526: u64 = p256FiatMulxU32(x514, 0xf3b9cac2)
|
|
3045
|
+
const x526: u32 = toU32(w526)
|
|
3046
|
+
const x527: u32 = toU32(w526 >> 32)
|
|
3047
|
+
const w528: u64 = p256FiatMulxU32(x514, 0xfc632551)
|
|
3048
|
+
const x528: u32 = toU32(w528)
|
|
3049
|
+
const x529: u32 = toU32(w528 >> 32)
|
|
3050
|
+
const w530: u64 = p256FiatAddcarryxU32(0x0, x529, x526)
|
|
3051
|
+
const x530: u32 = toU32(w530)
|
|
3052
|
+
const x531: u32 = toU32(w530 >> 32)
|
|
3053
|
+
const w532: u64 = p256FiatAddcarryxU32(x531, x527, x524)
|
|
3054
|
+
const x532: u32 = toU32(w532)
|
|
3055
|
+
const x533: u32 = toU32(w532 >> 32)
|
|
3056
|
+
const w534: u64 = p256FiatAddcarryxU32(x533, x525, x522)
|
|
3057
|
+
const x534: u32 = toU32(w534)
|
|
3058
|
+
const x535: u32 = toU32(w534 >> 32)
|
|
3059
|
+
const w536: u64 = p256FiatAddcarryxU32(x535, x523, x520)
|
|
3060
|
+
const x536: u32 = toU32(w536)
|
|
3061
|
+
const x537: u32 = toU32(w536 >> 32)
|
|
3062
|
+
const w538: u64 = p256FiatAddcarryxU32(x537, x521, x518)
|
|
3063
|
+
const x538: u32 = toU32(w538)
|
|
3064
|
+
const x539: u32 = toU32(w538 >> 32)
|
|
3065
|
+
const x540: u32 = x539 + x519
|
|
3066
|
+
const w541: u64 = p256FiatAddcarryxU32(0x0, x496, x528)
|
|
3067
|
+
const x542: u32 = toU32(w541 >> 32)
|
|
3068
|
+
const w543: u64 = p256FiatAddcarryxU32(x542, x498, x530)
|
|
3069
|
+
const x543: u32 = toU32(w543)
|
|
3070
|
+
const x544: u32 = toU32(w543 >> 32)
|
|
3071
|
+
const w545: u64 = p256FiatAddcarryxU32(x544, x500, x532)
|
|
3072
|
+
const x545: u32 = toU32(w545)
|
|
3073
|
+
const x546: u32 = toU32(w545 >> 32)
|
|
3074
|
+
const w547: u64 = p256FiatAddcarryxU32(x546, x502, x534)
|
|
3075
|
+
const x547: u32 = toU32(w547)
|
|
3076
|
+
const x548: u32 = toU32(w547 >> 32)
|
|
3077
|
+
const w549: u64 = p256FiatAddcarryxU32(x548, x504, x536)
|
|
3078
|
+
const x549: u32 = toU32(w549)
|
|
3079
|
+
const x550: u32 = toU32(w549 >> 32)
|
|
3080
|
+
const w551: u64 = p256FiatAddcarryxU32(x550, x506, x538)
|
|
3081
|
+
const x551: u32 = toU32(w551)
|
|
3082
|
+
const x552: u32 = toU32(w551 >> 32)
|
|
3083
|
+
const w553: u64 = p256FiatAddcarryxU32(x552, x508, x540)
|
|
3084
|
+
const x553: u32 = toU32(w553)
|
|
3085
|
+
const x554: u32 = toU32(w553 >> 32)
|
|
3086
|
+
const w555: u64 = p256FiatAddcarryxU32(x554, x510, x516)
|
|
3087
|
+
const x555: u32 = toU32(w555)
|
|
3088
|
+
const x556: u32 = toU32(w555 >> 32)
|
|
3089
|
+
const w557: u64 = p256FiatAddcarryxU32(x556, x512, x517)
|
|
3090
|
+
const x557: u32 = toU32(w557)
|
|
3091
|
+
const x558: u32 = toU32(w557 >> 32)
|
|
3092
|
+
const x559: u32 = x558 + x513
|
|
3093
|
+
const w560: u64 = p256FiatMulxU32(x6, arg2[7])
|
|
3094
|
+
const x560: u32 = toU32(w560)
|
|
3095
|
+
const x561: u32 = toU32(w560 >> 32)
|
|
3096
|
+
const w562: u64 = p256FiatMulxU32(x6, arg2[6])
|
|
3097
|
+
const x562: u32 = toU32(w562)
|
|
3098
|
+
const x563: u32 = toU32(w562 >> 32)
|
|
3099
|
+
const w564: u64 = p256FiatMulxU32(x6, arg2[5])
|
|
3100
|
+
const x564: u32 = toU32(w564)
|
|
3101
|
+
const x565: u32 = toU32(w564 >> 32)
|
|
3102
|
+
const w566: u64 = p256FiatMulxU32(x6, arg2[4])
|
|
3103
|
+
const x566: u32 = toU32(w566)
|
|
3104
|
+
const x567: u32 = toU32(w566 >> 32)
|
|
3105
|
+
const w568: u64 = p256FiatMulxU32(x6, arg2[3])
|
|
3106
|
+
const x568: u32 = toU32(w568)
|
|
3107
|
+
const x569: u32 = toU32(w568 >> 32)
|
|
3108
|
+
const w570: u64 = p256FiatMulxU32(x6, arg2[2])
|
|
3109
|
+
const x570: u32 = toU32(w570)
|
|
3110
|
+
const x571: u32 = toU32(w570 >> 32)
|
|
3111
|
+
const w572: u64 = p256FiatMulxU32(x6, arg2[1])
|
|
3112
|
+
const x572: u32 = toU32(w572)
|
|
3113
|
+
const x573: u32 = toU32(w572 >> 32)
|
|
3114
|
+
const w574: u64 = p256FiatMulxU32(x6, arg2[0])
|
|
3115
|
+
const x574: u32 = toU32(w574)
|
|
3116
|
+
const x575: u32 = toU32(w574 >> 32)
|
|
3117
|
+
const w576: u64 = p256FiatAddcarryxU32(0x0, x575, x572)
|
|
3118
|
+
const x576: u32 = toU32(w576)
|
|
3119
|
+
const x577: u32 = toU32(w576 >> 32)
|
|
3120
|
+
const w578: u64 = p256FiatAddcarryxU32(x577, x573, x570)
|
|
3121
|
+
const x578: u32 = toU32(w578)
|
|
3122
|
+
const x579: u32 = toU32(w578 >> 32)
|
|
3123
|
+
const w580: u64 = p256FiatAddcarryxU32(x579, x571, x568)
|
|
3124
|
+
const x580: u32 = toU32(w580)
|
|
3125
|
+
const x581: u32 = toU32(w580 >> 32)
|
|
3126
|
+
const w582: u64 = p256FiatAddcarryxU32(x581, x569, x566)
|
|
3127
|
+
const x582: u32 = toU32(w582)
|
|
3128
|
+
const x583: u32 = toU32(w582 >> 32)
|
|
3129
|
+
const w584: u64 = p256FiatAddcarryxU32(x583, x567, x564)
|
|
3130
|
+
const x584: u32 = toU32(w584)
|
|
3131
|
+
const x585: u32 = toU32(w584 >> 32)
|
|
3132
|
+
const w586: u64 = p256FiatAddcarryxU32(x585, x565, x562)
|
|
3133
|
+
const x586: u32 = toU32(w586)
|
|
3134
|
+
const x587: u32 = toU32(w586 >> 32)
|
|
3135
|
+
const w588: u64 = p256FiatAddcarryxU32(x587, x563, x560)
|
|
3136
|
+
const x588: u32 = toU32(w588)
|
|
3137
|
+
const x589: u32 = toU32(w588 >> 32)
|
|
3138
|
+
const x590: u32 = x589 + x561
|
|
3139
|
+
const w591: u64 = p256FiatAddcarryxU32(0x0, x543, x574)
|
|
3140
|
+
const x591: u32 = toU32(w591)
|
|
3141
|
+
const x592: u32 = toU32(w591 >> 32)
|
|
3142
|
+
const w593: u64 = p256FiatAddcarryxU32(x592, x545, x576)
|
|
3143
|
+
const x593: u32 = toU32(w593)
|
|
3144
|
+
const x594: u32 = toU32(w593 >> 32)
|
|
3145
|
+
const w595: u64 = p256FiatAddcarryxU32(x594, x547, x578)
|
|
3146
|
+
const x595: u32 = toU32(w595)
|
|
3147
|
+
const x596: u32 = toU32(w595 >> 32)
|
|
3148
|
+
const w597: u64 = p256FiatAddcarryxU32(x596, x549, x580)
|
|
3149
|
+
const x597: u32 = toU32(w597)
|
|
3150
|
+
const x598: u32 = toU32(w597 >> 32)
|
|
3151
|
+
const w599: u64 = p256FiatAddcarryxU32(x598, x551, x582)
|
|
3152
|
+
const x599: u32 = toU32(w599)
|
|
3153
|
+
const x600: u32 = toU32(w599 >> 32)
|
|
3154
|
+
const w601: u64 = p256FiatAddcarryxU32(x600, x553, x584)
|
|
3155
|
+
const x601: u32 = toU32(w601)
|
|
3156
|
+
const x602: u32 = toU32(w601 >> 32)
|
|
3157
|
+
const w603: u64 = p256FiatAddcarryxU32(x602, x555, x586)
|
|
3158
|
+
const x603: u32 = toU32(w603)
|
|
3159
|
+
const x604: u32 = toU32(w603 >> 32)
|
|
3160
|
+
const w605: u64 = p256FiatAddcarryxU32(x604, x557, x588)
|
|
3161
|
+
const x605: u32 = toU32(w605)
|
|
3162
|
+
const x606: u32 = toU32(w605 >> 32)
|
|
3163
|
+
const w607: u64 = p256FiatAddcarryxU32(x606, x559, x590)
|
|
3164
|
+
const x607: u32 = toU32(w607)
|
|
3165
|
+
const x608: u32 = toU32(w607 >> 32)
|
|
3166
|
+
const w609: u64 = p256FiatMulxU32(x591, 0xee00bc4f)
|
|
3167
|
+
const x609: u32 = toU32(w609)
|
|
3168
|
+
const w611: u64 = p256FiatMulxU32(x609, 0xffffffff)
|
|
3169
|
+
const x611: u32 = toU32(w611)
|
|
3170
|
+
const x612: u32 = toU32(w611 >> 32)
|
|
3171
|
+
const w613: u64 = p256FiatMulxU32(x609, 0xffffffff)
|
|
3172
|
+
const x613: u32 = toU32(w613)
|
|
3173
|
+
const x614: u32 = toU32(w613 >> 32)
|
|
3174
|
+
const w615: u64 = p256FiatMulxU32(x609, 0xffffffff)
|
|
3175
|
+
const x615: u32 = toU32(w615)
|
|
3176
|
+
const x616: u32 = toU32(w615 >> 32)
|
|
3177
|
+
const w617: u64 = p256FiatMulxU32(x609, 0xbce6faad)
|
|
3178
|
+
const x617: u32 = toU32(w617)
|
|
3179
|
+
const x618: u32 = toU32(w617 >> 32)
|
|
3180
|
+
const w619: u64 = p256FiatMulxU32(x609, 0xa7179e84)
|
|
3181
|
+
const x619: u32 = toU32(w619)
|
|
3182
|
+
const x620: u32 = toU32(w619 >> 32)
|
|
3183
|
+
const w621: u64 = p256FiatMulxU32(x609, 0xf3b9cac2)
|
|
3184
|
+
const x621: u32 = toU32(w621)
|
|
3185
|
+
const x622: u32 = toU32(w621 >> 32)
|
|
3186
|
+
const w623: u64 = p256FiatMulxU32(x609, 0xfc632551)
|
|
3187
|
+
const x623: u32 = toU32(w623)
|
|
3188
|
+
const x624: u32 = toU32(w623 >> 32)
|
|
3189
|
+
const w625: u64 = p256FiatAddcarryxU32(0x0, x624, x621)
|
|
3190
|
+
const x625: u32 = toU32(w625)
|
|
3191
|
+
const x626: u32 = toU32(w625 >> 32)
|
|
3192
|
+
const w627: u64 = p256FiatAddcarryxU32(x626, x622, x619)
|
|
3193
|
+
const x627: u32 = toU32(w627)
|
|
3194
|
+
const x628: u32 = toU32(w627 >> 32)
|
|
3195
|
+
const w629: u64 = p256FiatAddcarryxU32(x628, x620, x617)
|
|
3196
|
+
const x629: u32 = toU32(w629)
|
|
3197
|
+
const x630: u32 = toU32(w629 >> 32)
|
|
3198
|
+
const w631: u64 = p256FiatAddcarryxU32(x630, x618, x615)
|
|
3199
|
+
const x631: u32 = toU32(w631)
|
|
3200
|
+
const x632: u32 = toU32(w631 >> 32)
|
|
3201
|
+
const w633: u64 = p256FiatAddcarryxU32(x632, x616, x613)
|
|
3202
|
+
const x633: u32 = toU32(w633)
|
|
3203
|
+
const x634: u32 = toU32(w633 >> 32)
|
|
3204
|
+
const x635: u32 = x634 + x614
|
|
3205
|
+
const w636: u64 = p256FiatAddcarryxU32(0x0, x591, x623)
|
|
3206
|
+
const x637: u32 = toU32(w636 >> 32)
|
|
3207
|
+
const w638: u64 = p256FiatAddcarryxU32(x637, x593, x625)
|
|
3208
|
+
const x638: u32 = toU32(w638)
|
|
3209
|
+
const x639: u32 = toU32(w638 >> 32)
|
|
3210
|
+
const w640: u64 = p256FiatAddcarryxU32(x639, x595, x627)
|
|
3211
|
+
const x640: u32 = toU32(w640)
|
|
3212
|
+
const x641: u32 = toU32(w640 >> 32)
|
|
3213
|
+
const w642: u64 = p256FiatAddcarryxU32(x641, x597, x629)
|
|
3214
|
+
const x642: u32 = toU32(w642)
|
|
3215
|
+
const x643: u32 = toU32(w642 >> 32)
|
|
3216
|
+
const w644: u64 = p256FiatAddcarryxU32(x643, x599, x631)
|
|
3217
|
+
const x644: u32 = toU32(w644)
|
|
3218
|
+
const x645: u32 = toU32(w644 >> 32)
|
|
3219
|
+
const w646: u64 = p256FiatAddcarryxU32(x645, x601, x633)
|
|
3220
|
+
const x646: u32 = toU32(w646)
|
|
3221
|
+
const x647: u32 = toU32(w646 >> 32)
|
|
3222
|
+
const w648: u64 = p256FiatAddcarryxU32(x647, x603, x635)
|
|
3223
|
+
const x648: u32 = toU32(w648)
|
|
3224
|
+
const x649: u32 = toU32(w648 >> 32)
|
|
3225
|
+
const w650: u64 = p256FiatAddcarryxU32(x649, x605, x611)
|
|
3226
|
+
const x650: u32 = toU32(w650)
|
|
3227
|
+
const x651: u32 = toU32(w650 >> 32)
|
|
3228
|
+
const w652: u64 = p256FiatAddcarryxU32(x651, x607, x612)
|
|
3229
|
+
const x652: u32 = toU32(w652)
|
|
3230
|
+
const x653: u32 = toU32(w652 >> 32)
|
|
3231
|
+
const x654: u32 = x653 + x608
|
|
3232
|
+
const w655: u64 = p256FiatMulxU32(x7, arg2[7])
|
|
3233
|
+
const x655: u32 = toU32(w655)
|
|
3234
|
+
const x656: u32 = toU32(w655 >> 32)
|
|
3235
|
+
const w657: u64 = p256FiatMulxU32(x7, arg2[6])
|
|
3236
|
+
const x657: u32 = toU32(w657)
|
|
3237
|
+
const x658: u32 = toU32(w657 >> 32)
|
|
3238
|
+
const w659: u64 = p256FiatMulxU32(x7, arg2[5])
|
|
3239
|
+
const x659: u32 = toU32(w659)
|
|
3240
|
+
const x660: u32 = toU32(w659 >> 32)
|
|
3241
|
+
const w661: u64 = p256FiatMulxU32(x7, arg2[4])
|
|
3242
|
+
const x661: u32 = toU32(w661)
|
|
3243
|
+
const x662: u32 = toU32(w661 >> 32)
|
|
3244
|
+
const w663: u64 = p256FiatMulxU32(x7, arg2[3])
|
|
3245
|
+
const x663: u32 = toU32(w663)
|
|
3246
|
+
const x664: u32 = toU32(w663 >> 32)
|
|
3247
|
+
const w665: u64 = p256FiatMulxU32(x7, arg2[2])
|
|
3248
|
+
const x665: u32 = toU32(w665)
|
|
3249
|
+
const x666: u32 = toU32(w665 >> 32)
|
|
3250
|
+
const w667: u64 = p256FiatMulxU32(x7, arg2[1])
|
|
3251
|
+
const x667: u32 = toU32(w667)
|
|
3252
|
+
const x668: u32 = toU32(w667 >> 32)
|
|
3253
|
+
const w669: u64 = p256FiatMulxU32(x7, arg2[0])
|
|
3254
|
+
const x669: u32 = toU32(w669)
|
|
3255
|
+
const x670: u32 = toU32(w669 >> 32)
|
|
3256
|
+
const w671: u64 = p256FiatAddcarryxU32(0x0, x670, x667)
|
|
3257
|
+
const x671: u32 = toU32(w671)
|
|
3258
|
+
const x672: u32 = toU32(w671 >> 32)
|
|
3259
|
+
const w673: u64 = p256FiatAddcarryxU32(x672, x668, x665)
|
|
3260
|
+
const x673: u32 = toU32(w673)
|
|
3261
|
+
const x674: u32 = toU32(w673 >> 32)
|
|
3262
|
+
const w675: u64 = p256FiatAddcarryxU32(x674, x666, x663)
|
|
3263
|
+
const x675: u32 = toU32(w675)
|
|
3264
|
+
const x676: u32 = toU32(w675 >> 32)
|
|
3265
|
+
const w677: u64 = p256FiatAddcarryxU32(x676, x664, x661)
|
|
3266
|
+
const x677: u32 = toU32(w677)
|
|
3267
|
+
const x678: u32 = toU32(w677 >> 32)
|
|
3268
|
+
const w679: u64 = p256FiatAddcarryxU32(x678, x662, x659)
|
|
3269
|
+
const x679: u32 = toU32(w679)
|
|
3270
|
+
const x680: u32 = toU32(w679 >> 32)
|
|
3271
|
+
const w681: u64 = p256FiatAddcarryxU32(x680, x660, x657)
|
|
3272
|
+
const x681: u32 = toU32(w681)
|
|
3273
|
+
const x682: u32 = toU32(w681 >> 32)
|
|
3274
|
+
const w683: u64 = p256FiatAddcarryxU32(x682, x658, x655)
|
|
3275
|
+
const x683: u32 = toU32(w683)
|
|
3276
|
+
const x684: u32 = toU32(w683 >> 32)
|
|
3277
|
+
const x685: u32 = x684 + x656
|
|
3278
|
+
const w686: u64 = p256FiatAddcarryxU32(0x0, x638, x669)
|
|
3279
|
+
const x686: u32 = toU32(w686)
|
|
3280
|
+
const x687: u32 = toU32(w686 >> 32)
|
|
3281
|
+
const w688: u64 = p256FiatAddcarryxU32(x687, x640, x671)
|
|
3282
|
+
const x688: u32 = toU32(w688)
|
|
3283
|
+
const x689: u32 = toU32(w688 >> 32)
|
|
3284
|
+
const w690: u64 = p256FiatAddcarryxU32(x689, x642, x673)
|
|
3285
|
+
const x690: u32 = toU32(w690)
|
|
3286
|
+
const x691: u32 = toU32(w690 >> 32)
|
|
3287
|
+
const w692: u64 = p256FiatAddcarryxU32(x691, x644, x675)
|
|
3288
|
+
const x692: u32 = toU32(w692)
|
|
3289
|
+
const x693: u32 = toU32(w692 >> 32)
|
|
3290
|
+
const w694: u64 = p256FiatAddcarryxU32(x693, x646, x677)
|
|
3291
|
+
const x694: u32 = toU32(w694)
|
|
3292
|
+
const x695: u32 = toU32(w694 >> 32)
|
|
3293
|
+
const w696: u64 = p256FiatAddcarryxU32(x695, x648, x679)
|
|
3294
|
+
const x696: u32 = toU32(w696)
|
|
3295
|
+
const x697: u32 = toU32(w696 >> 32)
|
|
3296
|
+
const w698: u64 = p256FiatAddcarryxU32(x697, x650, x681)
|
|
3297
|
+
const x698: u32 = toU32(w698)
|
|
3298
|
+
const x699: u32 = toU32(w698 >> 32)
|
|
3299
|
+
const w700: u64 = p256FiatAddcarryxU32(x699, x652, x683)
|
|
3300
|
+
const x700: u32 = toU32(w700)
|
|
3301
|
+
const x701: u32 = toU32(w700 >> 32)
|
|
3302
|
+
const w702: u64 = p256FiatAddcarryxU32(x701, x654, x685)
|
|
3303
|
+
const x702: u32 = toU32(w702)
|
|
3304
|
+
const x703: u32 = toU32(w702 >> 32)
|
|
3305
|
+
const w704: u64 = p256FiatMulxU32(x686, 0xee00bc4f)
|
|
3306
|
+
const x704: u32 = toU32(w704)
|
|
3307
|
+
const w706: u64 = p256FiatMulxU32(x704, 0xffffffff)
|
|
3308
|
+
const x706: u32 = toU32(w706)
|
|
3309
|
+
const x707: u32 = toU32(w706 >> 32)
|
|
3310
|
+
const w708: u64 = p256FiatMulxU32(x704, 0xffffffff)
|
|
3311
|
+
const x708: u32 = toU32(w708)
|
|
3312
|
+
const x709: u32 = toU32(w708 >> 32)
|
|
3313
|
+
const w710: u64 = p256FiatMulxU32(x704, 0xffffffff)
|
|
3314
|
+
const x710: u32 = toU32(w710)
|
|
3315
|
+
const x711: u32 = toU32(w710 >> 32)
|
|
3316
|
+
const w712: u64 = p256FiatMulxU32(x704, 0xbce6faad)
|
|
3317
|
+
const x712: u32 = toU32(w712)
|
|
3318
|
+
const x713: u32 = toU32(w712 >> 32)
|
|
3319
|
+
const w714: u64 = p256FiatMulxU32(x704, 0xa7179e84)
|
|
3320
|
+
const x714: u32 = toU32(w714)
|
|
3321
|
+
const x715: u32 = toU32(w714 >> 32)
|
|
3322
|
+
const w716: u64 = p256FiatMulxU32(x704, 0xf3b9cac2)
|
|
3323
|
+
const x716: u32 = toU32(w716)
|
|
3324
|
+
const x717: u32 = toU32(w716 >> 32)
|
|
3325
|
+
const w718: u64 = p256FiatMulxU32(x704, 0xfc632551)
|
|
3326
|
+
const x718: u32 = toU32(w718)
|
|
3327
|
+
const x719: u32 = toU32(w718 >> 32)
|
|
3328
|
+
const w720: u64 = p256FiatAddcarryxU32(0x0, x719, x716)
|
|
3329
|
+
const x720: u32 = toU32(w720)
|
|
3330
|
+
const x721: u32 = toU32(w720 >> 32)
|
|
3331
|
+
const w722: u64 = p256FiatAddcarryxU32(x721, x717, x714)
|
|
3332
|
+
const x722: u32 = toU32(w722)
|
|
3333
|
+
const x723: u32 = toU32(w722 >> 32)
|
|
3334
|
+
const w724: u64 = p256FiatAddcarryxU32(x723, x715, x712)
|
|
3335
|
+
const x724: u32 = toU32(w724)
|
|
3336
|
+
const x725: u32 = toU32(w724 >> 32)
|
|
3337
|
+
const w726: u64 = p256FiatAddcarryxU32(x725, x713, x710)
|
|
3338
|
+
const x726: u32 = toU32(w726)
|
|
3339
|
+
const x727: u32 = toU32(w726 >> 32)
|
|
3340
|
+
const w728: u64 = p256FiatAddcarryxU32(x727, x711, x708)
|
|
3341
|
+
const x728: u32 = toU32(w728)
|
|
3342
|
+
const x729: u32 = toU32(w728 >> 32)
|
|
3343
|
+
const x730: u32 = x729 + x709
|
|
3344
|
+
const w731: u64 = p256FiatAddcarryxU32(0x0, x686, x718)
|
|
3345
|
+
const x732: u32 = toU32(w731 >> 32)
|
|
3346
|
+
const w733: u64 = p256FiatAddcarryxU32(x732, x688, x720)
|
|
3347
|
+
const x733: u32 = toU32(w733)
|
|
3348
|
+
const x734: u32 = toU32(w733 >> 32)
|
|
3349
|
+
const w735: u64 = p256FiatAddcarryxU32(x734, x690, x722)
|
|
3350
|
+
const x735: u32 = toU32(w735)
|
|
3351
|
+
const x736: u32 = toU32(w735 >> 32)
|
|
3352
|
+
const w737: u64 = p256FiatAddcarryxU32(x736, x692, x724)
|
|
3353
|
+
const x737: u32 = toU32(w737)
|
|
3354
|
+
const x738: u32 = toU32(w737 >> 32)
|
|
3355
|
+
const w739: u64 = p256FiatAddcarryxU32(x738, x694, x726)
|
|
3356
|
+
const x739: u32 = toU32(w739)
|
|
3357
|
+
const x740: u32 = toU32(w739 >> 32)
|
|
3358
|
+
const w741: u64 = p256FiatAddcarryxU32(x740, x696, x728)
|
|
3359
|
+
const x741: u32 = toU32(w741)
|
|
3360
|
+
const x742: u32 = toU32(w741 >> 32)
|
|
3361
|
+
const w743: u64 = p256FiatAddcarryxU32(x742, x698, x730)
|
|
3362
|
+
const x743: u32 = toU32(w743)
|
|
3363
|
+
const x744: u32 = toU32(w743 >> 32)
|
|
3364
|
+
const w745: u64 = p256FiatAddcarryxU32(x744, x700, x706)
|
|
3365
|
+
const x745: u32 = toU32(w745)
|
|
3366
|
+
const x746: u32 = toU32(w745 >> 32)
|
|
3367
|
+
const w747: u64 = p256FiatAddcarryxU32(x746, x702, x707)
|
|
3368
|
+
const x747: u32 = toU32(w747)
|
|
3369
|
+
const x748: u32 = toU32(w747 >> 32)
|
|
3370
|
+
const x749: u32 = x748 + x703
|
|
3371
|
+
const w750: u64 = p256FiatSubborrowxU32(0x0, x733, 0xfc632551)
|
|
3372
|
+
const x750: u32 = toU32(w750)
|
|
3373
|
+
const x751: u32 = toU32(w750 >> 32)
|
|
3374
|
+
const w752: u64 = p256FiatSubborrowxU32(x751, x735, 0xf3b9cac2)
|
|
3375
|
+
const x752: u32 = toU32(w752)
|
|
3376
|
+
const x753: u32 = toU32(w752 >> 32)
|
|
3377
|
+
const w754: u64 = p256FiatSubborrowxU32(x753, x737, 0xa7179e84)
|
|
3378
|
+
const x754: u32 = toU32(w754)
|
|
3379
|
+
const x755: u32 = toU32(w754 >> 32)
|
|
3380
|
+
const w756: u64 = p256FiatSubborrowxU32(x755, x739, 0xbce6faad)
|
|
3381
|
+
const x756: u32 = toU32(w756)
|
|
3382
|
+
const x757: u32 = toU32(w756 >> 32)
|
|
3383
|
+
const w758: u64 = p256FiatSubborrowxU32(x757, x741, 0xffffffff)
|
|
3384
|
+
const x758: u32 = toU32(w758)
|
|
3385
|
+
const x759: u32 = toU32(w758 >> 32)
|
|
3386
|
+
const w760: u64 = p256FiatSubborrowxU32(x759, x743, 0xffffffff)
|
|
3387
|
+
const x760: u32 = toU32(w760)
|
|
3388
|
+
const x761: u32 = toU32(w760 >> 32)
|
|
3389
|
+
const w762: u64 = p256FiatSubborrowxU32(x761, x745, 0x0)
|
|
3390
|
+
const x762: u32 = toU32(w762)
|
|
3391
|
+
const x763: u32 = toU32(w762 >> 32)
|
|
3392
|
+
const w764: u64 = p256FiatSubborrowxU32(x763, x747, 0xffffffff)
|
|
3393
|
+
const x764: u32 = toU32(w764)
|
|
3394
|
+
const x765: u32 = toU32(w764 >> 32)
|
|
3395
|
+
const w766: u64 = p256FiatSubborrowxU32(x765, x749, 0x0)
|
|
3396
|
+
const x767: u32 = toU32(w766 >> 32)
|
|
3397
|
+
const x768: u32 = p256FiatCmovznzU32(x767, x750, x733)
|
|
3398
|
+
const x769: u32 = p256FiatCmovznzU32(x767, x752, x735)
|
|
3399
|
+
const x770: u32 = p256FiatCmovznzU32(x767, x754, x737)
|
|
3400
|
+
const x771: u32 = p256FiatCmovznzU32(x767, x756, x739)
|
|
3401
|
+
const x772: u32 = p256FiatCmovznzU32(x767, x758, x741)
|
|
3402
|
+
const x773: u32 = p256FiatCmovznzU32(x767, x760, x743)
|
|
3403
|
+
const x774: u32 = p256FiatCmovznzU32(x767, x762, x745)
|
|
3404
|
+
const x775: u32 = p256FiatCmovznzU32(x767, x764, x747)
|
|
3405
|
+
out1[0] = x768
|
|
3406
|
+
out1[1] = x769
|
|
3407
|
+
out1[2] = x770
|
|
3408
|
+
out1[3] = x771
|
|
3409
|
+
out1[4] = x772
|
|
3410
|
+
out1[5] = x773
|
|
3411
|
+
out1[6] = x774
|
|
3412
|
+
out1[7] = x775
|
|
3413
|
+
}
|
|
3414
|
+
|
|
3415
|
+
/** fiat's `fiat_p256_scalar_add`: adds two field elements in the Montgomery domain. */
|
|
3416
|
+
const p256FiatScalarAdd = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
|
|
3417
|
+
if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
|
|
3418
|
+
return
|
|
3419
|
+
}
|
|
3420
|
+
const w1: u64 = p256FiatAddcarryxU32(0x0, arg1[0], arg2[0])
|
|
3421
|
+
const x1: u32 = toU32(w1)
|
|
3422
|
+
const x2: u32 = toU32(w1 >> 32)
|
|
3423
|
+
const w3: u64 = p256FiatAddcarryxU32(x2, arg1[1], arg2[1])
|
|
3424
|
+
const x3: u32 = toU32(w3)
|
|
3425
|
+
const x4: u32 = toU32(w3 >> 32)
|
|
3426
|
+
const w5: u64 = p256FiatAddcarryxU32(x4, arg1[2], arg2[2])
|
|
3427
|
+
const x5: u32 = toU32(w5)
|
|
3428
|
+
const x6: u32 = toU32(w5 >> 32)
|
|
3429
|
+
const w7: u64 = p256FiatAddcarryxU32(x6, arg1[3], arg2[3])
|
|
3430
|
+
const x7: u32 = toU32(w7)
|
|
3431
|
+
const x8: u32 = toU32(w7 >> 32)
|
|
3432
|
+
const w9: u64 = p256FiatAddcarryxU32(x8, arg1[4], arg2[4])
|
|
3433
|
+
const x9: u32 = toU32(w9)
|
|
3434
|
+
const x10: u32 = toU32(w9 >> 32)
|
|
3435
|
+
const w11: u64 = p256FiatAddcarryxU32(x10, arg1[5], arg2[5])
|
|
3436
|
+
const x11: u32 = toU32(w11)
|
|
3437
|
+
const x12: u32 = toU32(w11 >> 32)
|
|
3438
|
+
const w13: u64 = p256FiatAddcarryxU32(x12, arg1[6], arg2[6])
|
|
3439
|
+
const x13: u32 = toU32(w13)
|
|
3440
|
+
const x14: u32 = toU32(w13 >> 32)
|
|
3441
|
+
const w15: u64 = p256FiatAddcarryxU32(x14, arg1[7], arg2[7])
|
|
3442
|
+
const x15: u32 = toU32(w15)
|
|
3443
|
+
const x16: u32 = toU32(w15 >> 32)
|
|
3444
|
+
const w17: u64 = p256FiatSubborrowxU32(0x0, x1, 0xfc632551)
|
|
3445
|
+
const x17: u32 = toU32(w17)
|
|
3446
|
+
const x18: u32 = toU32(w17 >> 32)
|
|
3447
|
+
const w19: u64 = p256FiatSubborrowxU32(x18, x3, 0xf3b9cac2)
|
|
3448
|
+
const x19: u32 = toU32(w19)
|
|
3449
|
+
const x20: u32 = toU32(w19 >> 32)
|
|
3450
|
+
const w21: u64 = p256FiatSubborrowxU32(x20, x5, 0xa7179e84)
|
|
3451
|
+
const x21: u32 = toU32(w21)
|
|
3452
|
+
const x22: u32 = toU32(w21 >> 32)
|
|
3453
|
+
const w23: u64 = p256FiatSubborrowxU32(x22, x7, 0xbce6faad)
|
|
3454
|
+
const x23: u32 = toU32(w23)
|
|
3455
|
+
const x24: u32 = toU32(w23 >> 32)
|
|
3456
|
+
const w25: u64 = p256FiatSubborrowxU32(x24, x9, 0xffffffff)
|
|
3457
|
+
const x25: u32 = toU32(w25)
|
|
3458
|
+
const x26: u32 = toU32(w25 >> 32)
|
|
3459
|
+
const w27: u64 = p256FiatSubborrowxU32(x26, x11, 0xffffffff)
|
|
3460
|
+
const x27: u32 = toU32(w27)
|
|
3461
|
+
const x28: u32 = toU32(w27 >> 32)
|
|
3462
|
+
const w29: u64 = p256FiatSubborrowxU32(x28, x13, 0x0)
|
|
3463
|
+
const x29: u32 = toU32(w29)
|
|
3464
|
+
const x30: u32 = toU32(w29 >> 32)
|
|
3465
|
+
const w31: u64 = p256FiatSubborrowxU32(x30, x15, 0xffffffff)
|
|
3466
|
+
const x31: u32 = toU32(w31)
|
|
3467
|
+
const x32: u32 = toU32(w31 >> 32)
|
|
3468
|
+
const w33: u64 = p256FiatSubborrowxU32(x32, x16, 0x0)
|
|
3469
|
+
const x34: u32 = toU32(w33 >> 32)
|
|
3470
|
+
const x35: u32 = p256FiatCmovznzU32(x34, x17, x1)
|
|
3471
|
+
const x36: u32 = p256FiatCmovznzU32(x34, x19, x3)
|
|
3472
|
+
const x37: u32 = p256FiatCmovznzU32(x34, x21, x5)
|
|
3473
|
+
const x38: u32 = p256FiatCmovznzU32(x34, x23, x7)
|
|
3474
|
+
const x39: u32 = p256FiatCmovznzU32(x34, x25, x9)
|
|
3475
|
+
const x40: u32 = p256FiatCmovznzU32(x34, x27, x11)
|
|
3476
|
+
const x41: u32 = p256FiatCmovznzU32(x34, x29, x13)
|
|
3477
|
+
const x42: u32 = p256FiatCmovznzU32(x34, x31, x15)
|
|
3478
|
+
out1[0] = x35
|
|
3479
|
+
out1[1] = x36
|
|
3480
|
+
out1[2] = x37
|
|
3481
|
+
out1[3] = x38
|
|
3482
|
+
out1[4] = x39
|
|
3483
|
+
out1[5] = x40
|
|
3484
|
+
out1[6] = x41
|
|
3485
|
+
out1[7] = x42
|
|
3486
|
+
}
|
|
3487
|
+
|
|
3488
|
+
/** fiat's `fiat_p256_scalar_set_one`: returns the field element one in the Montgomery domain. */
|
|
3489
|
+
const p256FiatScalarSetOne = (out1: u32[]): void => {
|
|
3490
|
+
if (toI32(out1.length) < 8) {
|
|
3491
|
+
return
|
|
3492
|
+
}
|
|
3493
|
+
out1[0] = 0x39cdaaf
|
|
3494
|
+
out1[1] = 0xc46353d
|
|
3495
|
+
out1[2] = 0x58e8617b
|
|
3496
|
+
out1[3] = 0x43190552
|
|
3497
|
+
out1[4] = 0x0
|
|
3498
|
+
out1[5] = 0x0
|
|
3499
|
+
out1[6] = 0xffffffff
|
|
3500
|
+
out1[7] = 0x0
|
|
3501
|
+
}
|
|
3502
|
+
|
|
3503
|
+
/** The eight limbs `l0` (least significant) to `l7` written into `out`. */
|
|
3504
|
+
const p256SetLimbs = (
|
|
3505
|
+
out: u32[],
|
|
3506
|
+
l0: u32,
|
|
3507
|
+
l1: u32,
|
|
3508
|
+
l2: u32,
|
|
3509
|
+
l3: u32,
|
|
3510
|
+
l4: u32,
|
|
3511
|
+
l5: u32,
|
|
3512
|
+
l6: u32,
|
|
3513
|
+
l7: u32
|
|
3514
|
+
): void => {
|
|
3515
|
+
if (toI32(out.length) < 8) {
|
|
3516
|
+
return
|
|
3517
|
+
}
|
|
3518
|
+
out[0] = l0
|
|
3519
|
+
out[1] = l1
|
|
3520
|
+
out[2] = l2
|
|
3521
|
+
out[3] = l3
|
|
3522
|
+
out[4] = l4
|
|
3523
|
+
out[5] = l5
|
|
3524
|
+
out[6] = l6
|
|
3525
|
+
out[7] = l7
|
|
3526
|
+
}
|
|
3527
|
+
|
|
3528
|
+
/** `out = 0`, limb by limb. */
|
|
3529
|
+
const p256SetZero = (out: u32[]): void => {
|
|
3530
|
+
if (toI32(out.length) < 8) {
|
|
3531
|
+
return
|
|
3532
|
+
}
|
|
3533
|
+
for (let i: i32 = 0; i < 8; i++) {
|
|
3534
|
+
out[i] = 0
|
|
3535
|
+
}
|
|
3536
|
+
}
|
|
3537
|
+
|
|
3538
|
+
/** A fresh eight-limb array, zero. */
|
|
3539
|
+
const p256Limbs = (): u32[] => new Array<u32>(8)
|
|
3540
|
+
|
|
3541
|
+
/** The field prime p = 2^256 - 2^224 + 2^192 + 2^96 - 1, as plain limbs. */
|
|
3542
|
+
const p256Prime = (): u32[] => {
|
|
3543
|
+
const out: u32[] = p256Limbs()
|
|
3544
|
+
p256SetLimbs(out, 0xffffffff, 0xffffffff, 0xffffffff, 0, 0, 0, 1, 0xffffffff)
|
|
3545
|
+
return out
|
|
3546
|
+
}
|
|
3547
|
+
|
|
3548
|
+
/** The group order n (SEC 2 §2.4.2), as plain limbs. */
|
|
3549
|
+
const p256Order = (): u32[] => {
|
|
3550
|
+
const out: u32[] = p256Limbs()
|
|
3551
|
+
p256SetLimbs(out, 0xfc632551, 0xf3b9cac2, 0xa7179e84, 0xbce6faad, 0xffffffff, 0xffffffff, 0, 0xffffffff)
|
|
3552
|
+
return out
|
|
3553
|
+
}
|
|
3554
|
+
|
|
3555
|
+
/**
|
|
3556
|
+
* R^2 mod p for R = 2^256: a Montgomery multiply by it takes a plain element
|
|
3557
|
+
* into the Montgomery domain, which is all fiat's `to_montgomery` does.
|
|
3558
|
+
*/
|
|
3559
|
+
const p256FieldR2 = (): u32[] => {
|
|
3560
|
+
const out: u32[] = p256Limbs()
|
|
3561
|
+
p256SetLimbs(out, 3, 0, 0xffffffff, 0xfffffffb, 0xfffffffe, 0xffffffff, 0xfffffffd, 4)
|
|
3562
|
+
return out
|
|
3563
|
+
}
|
|
3564
|
+
|
|
3565
|
+
/** R^2 mod n, which does for the scalars what `p256FieldR2` does for the field. */
|
|
3566
|
+
const p256ScalarR2 = (): u32[] => {
|
|
3567
|
+
const out: u32[] = p256Limbs()
|
|
3568
|
+
p256SetLimbs(
|
|
3569
|
+
out,
|
|
3570
|
+
0xbe79eea2,
|
|
3571
|
+
0x83244c95,
|
|
3572
|
+
0x49bd6fa6,
|
|
3573
|
+
0x4699799c,
|
|
3574
|
+
0x2b6bec59,
|
|
3575
|
+
0x2845b239,
|
|
3576
|
+
0xf3d95620,
|
|
3577
|
+
0x66e12d94
|
|
3578
|
+
)
|
|
3579
|
+
return out
|
|
3580
|
+
}
|
|
3581
|
+
|
|
3582
|
+
/** The curve's `b` (SEC 2 §2.4.2) times R mod p: `b` in the Montgomery domain. */
|
|
3583
|
+
const p256CurveB = (): u32[] => {
|
|
3584
|
+
const out: u32[] = p256Limbs()
|
|
3585
|
+
p256SetLimbs(
|
|
3586
|
+
out,
|
|
3587
|
+
0x29c4bddf,
|
|
3588
|
+
0xd89cdf62,
|
|
3589
|
+
0x78843090,
|
|
3590
|
+
0xacf005cd,
|
|
3591
|
+
0xf7212ed6,
|
|
3592
|
+
0xe5a220ab,
|
|
3593
|
+
0x04874834,
|
|
3594
|
+
0xdc30061d
|
|
3595
|
+
)
|
|
3596
|
+
return out
|
|
3597
|
+
}
|
|
3598
|
+
|
|
3599
|
+
/**
|
|
3600
|
+
* The plain 1, `[1, 0, …, 0]`. A Montgomery multiply by it divides by R, which
|
|
3601
|
+
* takes an element out of the Montgomery domain: fiat's `from_montgomery`.
|
|
3602
|
+
*/
|
|
3603
|
+
const p256PlainOne = (): u32[] => {
|
|
3604
|
+
const out: u32[] = p256Limbs()
|
|
3605
|
+
out[0] = 1
|
|
3606
|
+
return out
|
|
3607
|
+
}
|
|
3608
|
+
|
|
3609
|
+
/** `out = a`, limb by limb. */
|
|
3610
|
+
const p256Copy = (out: u32[], a: u32[]): void => {
|
|
3611
|
+
if (toI32(out.length) < 8 || toI32(a.length) < 8) {
|
|
3612
|
+
return
|
|
3613
|
+
}
|
|
3614
|
+
for (let i: i32 = 0; i < 8; i++) {
|
|
3615
|
+
out[i] = a[i]
|
|
3616
|
+
}
|
|
3617
|
+
}
|
|
3618
|
+
|
|
3619
|
+
/**
|
|
3620
|
+
* The plain limbs of the 32 big-endian bytes `bytes[at .. at + 32)`, limb 0
|
|
3621
|
+
* the least significant. A window outside `bytes` leaves `out` as it was;
|
|
3622
|
+
* every caller has checked the length first.
|
|
3623
|
+
*/
|
|
3624
|
+
const p256LimbsFromBytes = (out: u32[], bytes: u8[], at: i32): void => {
|
|
3625
|
+
const length: i32 = toI32(bytes.length)
|
|
3626
|
+
if (toI32(out.length) < 8 || at < 0 || at > length - 32) {
|
|
3627
|
+
return
|
|
3628
|
+
}
|
|
3629
|
+
for (let i: i32 = 0; i < 8; i++) {
|
|
3630
|
+
let limb: u32 = 0
|
|
3631
|
+
for (let b: i32 = 0; b < 4; b++) {
|
|
3632
|
+
const j: i32 = at + 28 - 4 * i + b
|
|
3633
|
+
if (j >= 0 && j < length) {
|
|
3634
|
+
limb = (limb << 8) | toU32(bytes[j])
|
|
3635
|
+
}
|
|
3636
|
+
}
|
|
3637
|
+
out[i] = limb
|
|
3638
|
+
}
|
|
3639
|
+
}
|
|
3640
|
+
|
|
3641
|
+
/** The plain limbs `a` as 32 big-endian bytes at `out[at .. at + 32)`. */
|
|
3642
|
+
const p256LimbsToBytes = (out: u8[], at: i32, a: u32[]): void => {
|
|
3643
|
+
const length: i32 = toI32(out.length)
|
|
3644
|
+
if (toI32(a.length) < 8 || at < 0 || at > length - 32) {
|
|
3645
|
+
return
|
|
3646
|
+
}
|
|
3647
|
+
for (let i: i32 = 0; i < 8; i++) {
|
|
3648
|
+
const limb: u32 = a[i]
|
|
3649
|
+
for (let b: i32 = 0; b < 4; b++) {
|
|
3650
|
+
const j: i32 = at + 31 - 4 * i - b
|
|
3651
|
+
if (j >= 0 && j < length) {
|
|
3652
|
+
out[j] = toU8(limb >> toU32(8 * b))
|
|
3653
|
+
}
|
|
3654
|
+
}
|
|
3655
|
+
}
|
|
3656
|
+
}
|
|
3657
|
+
|
|
3658
|
+
/**
|
|
3659
|
+
* `d = a - m` modulo 2^256 for plain limbs, answering the borrow out of the
|
|
3660
|
+
* top limb: 1 when `a` is below `m` and 0 otherwise. Every limb is subtracted
|
|
3661
|
+
* whatever the values, so the answer takes no comparison a secret could steer.
|
|
3662
|
+
*/
|
|
3663
|
+
const p256SubBorrow = (d: u32[], a: u32[], m: u32[]): u32 => {
|
|
3664
|
+
if (toI32(d.length) < 8 || toI32(a.length) < 8 || toI32(m.length) < 8) {
|
|
3665
|
+
return 0
|
|
3666
|
+
}
|
|
3667
|
+
let borrow: u32 = 0
|
|
3668
|
+
for (let i: i32 = 0; i < 8; i++) {
|
|
3669
|
+
const w: u64 = p256FiatSubborrowxU32(borrow, a[i], m[i])
|
|
3670
|
+
d[i] = toU32(w)
|
|
3671
|
+
borrow = toU32(w >> 32)
|
|
3672
|
+
}
|
|
3673
|
+
return borrow
|
|
3674
|
+
}
|
|
3675
|
+
|
|
3676
|
+
/**
|
|
3677
|
+
* 1 when the plain value `a` is below `m` and 0 otherwise: the borrow out of
|
|
3678
|
+
* `a - m`, carried through every limb, so the answer takes no comparison a
|
|
3679
|
+
* secret could steer.
|
|
3680
|
+
*/
|
|
3681
|
+
const p256Below = (a: u32[], m: u32[]): u32 => p256SubBorrow(new Array<u32>(8), a, m)
|
|
3682
|
+
|
|
3683
|
+
/**
|
|
3684
|
+
* `out = a mod m` for a plain `a` below 2m: `a - m` is computed whatever `a`
|
|
3685
|
+
* is, and fiat's conditional move keeps it when there was no borrow. That is
|
|
3686
|
+
* how an x-coordinate (below p < 2n) and a 256-bit digest are taken mod n.
|
|
3687
|
+
*/
|
|
3688
|
+
const p256ReduceOnce = (out: u32[], a: u32[], m: u32[]): void => {
|
|
3689
|
+
const d: u32[] = new Array<u32>(8)
|
|
3690
|
+
p256FiatSelectznz(out, p256SubBorrow(d, a, m), d, a)
|
|
3691
|
+
}
|
|
3692
|
+
|
|
3693
|
+
/**
|
|
3694
|
+
* Whether bit `i` (0 the least significant) of the plain limbs `e` is set.
|
|
3695
|
+
* Only ever asked of a public exponent.
|
|
3696
|
+
*/
|
|
3697
|
+
const p256Bit = (e: u32[], i: i32): boolean => {
|
|
3698
|
+
const limb: i32 = i >> 5
|
|
3699
|
+
if (limb < 0 || limb >= 8 || toI32(e.length) < 8) {
|
|
3700
|
+
return false
|
|
3701
|
+
}
|
|
3702
|
+
return ((e[limb] >> toU32(i & 31)) & 1) === 1
|
|
3703
|
+
}
|
|
3704
|
+
|
|
3705
|
+
/**
|
|
3706
|
+
* `out = 1 / a` in the field, as `a^(p - 2)` (Fermat); zero for a zero `a`.
|
|
3707
|
+
* Square-and-multiply from the top bit: the branch is on the exponent's bits,
|
|
3708
|
+
* which are a constant.
|
|
3709
|
+
*/
|
|
3710
|
+
const p256FieldInvert = (out: u32[], a: u32[]): void => {
|
|
3711
|
+
const e: u32[] = p256Prime()
|
|
3712
|
+
e[0] = 0xfffffffd
|
|
3713
|
+
const acc: u32[] = p256Limbs()
|
|
3714
|
+
p256FiatSetOne(acc)
|
|
3715
|
+
for (let i: i32 = 255; i >= 0; i--) {
|
|
3716
|
+
p256FiatSquare(acc, acc)
|
|
3717
|
+
if (p256Bit(e, i)) {
|
|
3718
|
+
p256FiatMul(acc, acc, a)
|
|
3719
|
+
}
|
|
3720
|
+
}
|
|
3721
|
+
p256Copy(out, acc)
|
|
3722
|
+
}
|
|
3723
|
+
|
|
3724
|
+
/**
|
|
3725
|
+
* `out = 1 / a` mod n, as `a^(n - 2)` with the scalar Montgomery multiply;
|
|
3726
|
+
* the exponent is public, so the square-and-multiply branches only on a
|
|
3727
|
+
* constant.
|
|
3728
|
+
*/
|
|
3729
|
+
const p256ScalarInvert = (out: u32[], a: u32[]): void => {
|
|
3730
|
+
const e: u32[] = p256Order()
|
|
3731
|
+
e[0] = 0xfc63254f
|
|
3732
|
+
const acc: u32[] = p256Limbs()
|
|
3733
|
+
p256FiatScalarSetOne(acc)
|
|
3734
|
+
for (let i: i32 = 255; i >= 0; i--) {
|
|
3735
|
+
p256FiatScalarMul(acc, acc, acc)
|
|
3736
|
+
if (p256Bit(e, i)) {
|
|
3737
|
+
p256FiatScalarMul(acc, acc, a)
|
|
3738
|
+
}
|
|
3739
|
+
}
|
|
3740
|
+
p256Copy(out, acc)
|
|
3741
|
+
}
|
|
3742
|
+
|
|
3743
|
+
/**
|
|
3744
|
+
* A point in projective coordinates (X : Y : Z), each coordinate a field
|
|
3745
|
+
* element in the Montgomery domain. It stands for the affine (X/Z, Y/Z), and
|
|
3746
|
+
* Z = 0 is the identity, which the complete formulas take like any other point.
|
|
3747
|
+
*/
|
|
3748
|
+
class P256ProjectivePoint {
|
|
3749
|
+
x: u32[]
|
|
3750
|
+
y: u32[]
|
|
3751
|
+
z: u32[]
|
|
3752
|
+
|
|
3753
|
+
/** The identity, (0 : 1 : 0). */
|
|
3754
|
+
constructor() {
|
|
3755
|
+
this.x = p256Limbs()
|
|
3756
|
+
this.y = p256Limbs()
|
|
3757
|
+
this.z = p256Limbs()
|
|
3758
|
+
p256FiatSetOne(this.y)
|
|
3759
|
+
}
|
|
3760
|
+
}
|
|
3761
|
+
|
|
3762
|
+
/**
|
|
3763
|
+
* The temporaries of one addition or doubling, allocated once per scalar
|
|
3764
|
+
* multiplication rather than once per step, and the curve's `b`, which the
|
|
3765
|
+
* formulas multiply by.
|
|
3766
|
+
*/
|
|
3767
|
+
class P256PointScratch {
|
|
3768
|
+
t0: u32[]
|
|
3769
|
+
t1: u32[]
|
|
3770
|
+
t2: u32[]
|
|
3771
|
+
t3: u32[]
|
|
3772
|
+
t4: u32[]
|
|
3773
|
+
sum: P256ProjectivePoint
|
|
3774
|
+
b: u32[]
|
|
3775
|
+
|
|
3776
|
+
constructor() {
|
|
3777
|
+
this.t0 = p256Limbs()
|
|
3778
|
+
this.t1 = p256Limbs()
|
|
3779
|
+
this.t2 = p256Limbs()
|
|
3780
|
+
this.t3 = p256Limbs()
|
|
3781
|
+
this.t4 = p256Limbs()
|
|
3782
|
+
this.sum = new P256ProjectivePoint()
|
|
3783
|
+
this.b = p256CurveB()
|
|
3784
|
+
}
|
|
3785
|
+
}
|
|
3786
|
+
|
|
3787
|
+
/** `out = p`, coordinate by coordinate. */
|
|
3788
|
+
const p256PointCopy = (out: P256ProjectivePoint, p: P256ProjectivePoint): void => {
|
|
3789
|
+
p256Copy(out.x, p.x)
|
|
3790
|
+
p256Copy(out.y, p.y)
|
|
3791
|
+
p256Copy(out.z, p.z)
|
|
3792
|
+
}
|
|
3793
|
+
|
|
3794
|
+
/**
|
|
3795
|
+
* `out = p + q`, by Renes, Costello and Batina's Algorithm 4 (complete
|
|
3796
|
+
* addition for a = -3), step for step in the paper's order and with its names.
|
|
3797
|
+
* `out` may be `p` or `q`: the sum is built in the scratch and copied out.
|
|
3798
|
+
*/
|
|
3799
|
+
const p256PointAdd = (
|
|
3800
|
+
out: P256ProjectivePoint,
|
|
3801
|
+
p: P256ProjectivePoint,
|
|
3802
|
+
q: P256ProjectivePoint,
|
|
3803
|
+
s: P256PointScratch
|
|
3804
|
+
): void => {
|
|
3805
|
+
const t0: u32[] = s.t0
|
|
3806
|
+
const t1: u32[] = s.t1
|
|
3807
|
+
const t2: u32[] = s.t2
|
|
3808
|
+
const t3: u32[] = s.t3
|
|
3809
|
+
const t4: u32[] = s.t4
|
|
3810
|
+
const x3: u32[] = s.sum.x
|
|
3811
|
+
const y3: u32[] = s.sum.y
|
|
3812
|
+
const z3: u32[] = s.sum.z
|
|
3813
|
+
p256FiatMul(t0, p.x, q.x) // 1
|
|
3814
|
+
p256FiatMul(t1, p.y, q.y)
|
|
3815
|
+
p256FiatMul(t2, p.z, q.z)
|
|
3816
|
+
p256FiatAdd(t3, p.x, p.y)
|
|
3817
|
+
p256FiatAdd(t4, q.x, q.y) // 5
|
|
3818
|
+
p256FiatMul(t3, t3, t4)
|
|
3819
|
+
p256FiatAdd(t4, t0, t1)
|
|
3820
|
+
p256FiatSub(t3, t3, t4)
|
|
3821
|
+
p256FiatAdd(t4, p.y, p.z)
|
|
3822
|
+
p256FiatAdd(x3, q.y, q.z) // 10
|
|
3823
|
+
p256FiatMul(t4, t4, x3)
|
|
3824
|
+
p256FiatAdd(x3, t1, t2)
|
|
3825
|
+
p256FiatSub(t4, t4, x3)
|
|
3826
|
+
p256FiatAdd(x3, p.x, p.z)
|
|
3827
|
+
p256FiatAdd(y3, q.x, q.z) // 15
|
|
3828
|
+
p256FiatMul(x3, x3, y3)
|
|
3829
|
+
p256FiatAdd(y3, t0, t2)
|
|
3830
|
+
p256FiatSub(y3, x3, y3)
|
|
3831
|
+
p256FiatMul(z3, s.b, t2)
|
|
3832
|
+
p256FiatSub(x3, y3, z3) // 20
|
|
3833
|
+
p256FiatAdd(z3, x3, x3)
|
|
3834
|
+
p256FiatAdd(x3, x3, z3)
|
|
3835
|
+
p256FiatSub(z3, t1, x3)
|
|
3836
|
+
p256FiatAdd(x3, t1, x3)
|
|
3837
|
+
p256FiatMul(y3, s.b, y3) // 25
|
|
3838
|
+
p256FiatAdd(t1, t2, t2)
|
|
3839
|
+
p256FiatAdd(t2, t1, t2)
|
|
3840
|
+
p256FiatSub(y3, y3, t2)
|
|
3841
|
+
p256FiatSub(y3, y3, t0)
|
|
3842
|
+
p256FiatAdd(t1, y3, y3) // 30
|
|
3843
|
+
p256FiatAdd(y3, t1, y3)
|
|
3844
|
+
p256FiatAdd(t1, t0, t0)
|
|
3845
|
+
p256FiatAdd(t0, t1, t0)
|
|
3846
|
+
p256FiatSub(t0, t0, t2)
|
|
3847
|
+
p256FiatMul(t1, t4, y3) // 35
|
|
3848
|
+
p256FiatMul(t2, t0, y3)
|
|
3849
|
+
p256FiatMul(y3, x3, z3)
|
|
3850
|
+
p256FiatAdd(y3, y3, t2)
|
|
3851
|
+
p256FiatMul(x3, t3, x3)
|
|
3852
|
+
p256FiatSub(x3, x3, t1) // 40
|
|
3853
|
+
p256FiatMul(z3, t4, z3)
|
|
3854
|
+
p256FiatMul(t1, t3, t0)
|
|
3855
|
+
p256FiatAdd(z3, z3, t1)
|
|
3856
|
+
p256PointCopy(out, s.sum)
|
|
3857
|
+
}
|
|
3858
|
+
|
|
3859
|
+
/**
|
|
3860
|
+
* `out = 2p`, by Renes, Costello and Batina's Algorithm 6 (exception-free
|
|
3861
|
+
* doubling for a = -3), step for step. `out` may be `p`.
|
|
3862
|
+
*/
|
|
3863
|
+
const p256PointDouble = (out: P256ProjectivePoint, p: P256ProjectivePoint, s: P256PointScratch): void => {
|
|
3864
|
+
const t0: u32[] = s.t0
|
|
3865
|
+
const t1: u32[] = s.t1
|
|
3866
|
+
const t2: u32[] = s.t2
|
|
3867
|
+
const t3: u32[] = s.t3
|
|
3868
|
+
const x3: u32[] = s.sum.x
|
|
3869
|
+
const y3: u32[] = s.sum.y
|
|
3870
|
+
const z3: u32[] = s.sum.z
|
|
3871
|
+
p256FiatSquare(t0, p.x) // 1
|
|
3872
|
+
p256FiatSquare(t1, p.y)
|
|
3873
|
+
p256FiatSquare(t2, p.z)
|
|
3874
|
+
p256FiatMul(t3, p.x, p.y)
|
|
3875
|
+
p256FiatAdd(t3, t3, t3) // 5
|
|
3876
|
+
p256FiatMul(z3, p.x, p.z)
|
|
3877
|
+
p256FiatAdd(z3, z3, z3)
|
|
3878
|
+
p256FiatMul(y3, s.b, t2)
|
|
3879
|
+
p256FiatSub(y3, y3, z3)
|
|
3880
|
+
p256FiatAdd(x3, y3, y3) // 10
|
|
3881
|
+
p256FiatAdd(y3, x3, y3)
|
|
3882
|
+
p256FiatSub(x3, t1, y3)
|
|
3883
|
+
p256FiatAdd(y3, t1, y3)
|
|
3884
|
+
p256FiatMul(y3, x3, y3)
|
|
3885
|
+
p256FiatMul(x3, x3, t3) // 15
|
|
3886
|
+
p256FiatAdd(t3, t2, t2)
|
|
3887
|
+
p256FiatAdd(t2, t2, t3)
|
|
3888
|
+
p256FiatMul(z3, s.b, z3)
|
|
3889
|
+
p256FiatSub(z3, z3, t2)
|
|
3890
|
+
p256FiatSub(z3, z3, t0) // 20
|
|
3891
|
+
p256FiatAdd(t3, z3, z3)
|
|
3892
|
+
p256FiatAdd(z3, z3, t3)
|
|
3893
|
+
p256FiatAdd(t3, t0, t0)
|
|
3894
|
+
p256FiatAdd(t0, t3, t0)
|
|
3895
|
+
p256FiatSub(t0, t0, t2) // 25
|
|
3896
|
+
p256FiatMul(t0, t0, z3)
|
|
3897
|
+
p256FiatAdd(y3, y3, t0)
|
|
3898
|
+
p256FiatMul(t0, p.y, p.z)
|
|
3899
|
+
p256FiatAdd(t0, t0, t0)
|
|
3900
|
+
p256FiatMul(z3, t0, z3) // 30
|
|
3901
|
+
p256FiatSub(x3, x3, z3)
|
|
3902
|
+
p256FiatMul(z3, t0, t1)
|
|
3903
|
+
p256FiatAdd(z3, z3, z3)
|
|
3904
|
+
p256FiatAdd(z3, z3, z3)
|
|
3905
|
+
p256PointCopy(out, s.sum)
|
|
3906
|
+
}
|
|
3907
|
+
|
|
3908
|
+
/** The limbs one table entry takes: X, Y and Z, eight each. */
|
|
3909
|
+
const P256_ENTRY: i32 = 24
|
|
3910
|
+
|
|
3911
|
+
/** `table[at .. at + 8) = a`. */
|
|
3912
|
+
const p256TableStore = (table: u32[], at: i32, a: u32[]): void => {
|
|
3913
|
+
if (toI32(a.length) < 8 || at < 0 || at > toI32(table.length) - 8) {
|
|
3914
|
+
return
|
|
3915
|
+
}
|
|
3916
|
+
for (let i: i32 = 0; i < 8; i++) {
|
|
3917
|
+
table[at + i] = a[i]
|
|
3918
|
+
}
|
|
3919
|
+
}
|
|
3920
|
+
|
|
3921
|
+
/** Table entry `i` (limbs `24i` to `24i + 23`, X then Y then Z) = `p`. */
|
|
3922
|
+
const p256TableStorePoint = (table: u32[], i: i32, p: P256ProjectivePoint): void => {
|
|
3923
|
+
p256TableStore(table, i * P256_ENTRY, p.x)
|
|
3924
|
+
p256TableStore(table, i * P256_ENTRY + 8, p.y)
|
|
3925
|
+
p256TableStore(table, i * P256_ENTRY + 16, p.z)
|
|
3926
|
+
}
|
|
3927
|
+
|
|
3928
|
+
/**
|
|
3929
|
+
* The window table: entry `i` is `i * p`, for `i` from 0 to 15. Built from
|
|
3930
|
+
* `p`, which is public here (G or a received key) and a secret only in that
|
|
3931
|
+
* it is about to be multiplied. Entry 0 is the identity and entry 1 is `p`;
|
|
3932
|
+
* each later one adds `p` to the one before.
|
|
3933
|
+
*/
|
|
3934
|
+
const p256TableBuild = (table: u32[], p: P256ProjectivePoint, s: P256PointScratch): void => {
|
|
3935
|
+
const acc = new P256ProjectivePoint()
|
|
3936
|
+
p256TableStorePoint(table, 0, acc)
|
|
3937
|
+
p256PointCopy(acc, p)
|
|
3938
|
+
p256TableStorePoint(table, 1, acc)
|
|
3939
|
+
for (let i: i32 = 2; i < 16; i++) {
|
|
3940
|
+
p256PointAdd(acc, acc, p, s)
|
|
3941
|
+
p256TableStorePoint(table, i, acc)
|
|
3942
|
+
}
|
|
3943
|
+
}
|
|
3944
|
+
|
|
3945
|
+
/**
|
|
3946
|
+
* `out = table[at .. at + 8)` when `hit` is 1, and `out` unchanged when it is
|
|
3947
|
+
* 0, by fiat's conditional move on every limb: the eight loads happen either
|
|
3948
|
+
* way, at an offset that is the caller's loop position, never the secret.
|
|
3949
|
+
*/
|
|
3950
|
+
const p256TableMove = (out: u32[], table: u32[], at: i32, hit: u32): void => {
|
|
3951
|
+
if (toI32(out.length) < 8 || at < 0 || at > toI32(table.length) - 8) {
|
|
3952
|
+
return
|
|
3953
|
+
}
|
|
3954
|
+
out[0] = p256FiatCmovznzU32(hit, out[0], table[at])
|
|
3955
|
+
out[1] = p256FiatCmovznzU32(hit, out[1], table[at + 1])
|
|
3956
|
+
out[2] = p256FiatCmovznzU32(hit, out[2], table[at + 2])
|
|
3957
|
+
out[3] = p256FiatCmovznzU32(hit, out[3], table[at + 3])
|
|
3958
|
+
out[4] = p256FiatCmovznzU32(hit, out[4], table[at + 4])
|
|
3959
|
+
out[5] = p256FiatCmovznzU32(hit, out[5], table[at + 5])
|
|
3960
|
+
out[6] = p256FiatCmovznzU32(hit, out[6], table[at + 6])
|
|
3961
|
+
out[7] = p256FiatCmovznzU32(hit, out[7], table[at + 7])
|
|
3962
|
+
}
|
|
3963
|
+
|
|
3964
|
+
/**
|
|
3965
|
+
* The table entry `digit` into `out`, without indexing by `digit`: all
|
|
3966
|
+
* sixteen entries are read, and `p256TableMove` keeps entry `i` when `ctEq`
|
|
3967
|
+
* says `i` is the digit. The loop runs over public positions; the digit only
|
|
3968
|
+
* ever reaches the mask.
|
|
3969
|
+
*/
|
|
3970
|
+
const p256TableSelect = (out: P256ProjectivePoint, table: u32[], digit: u32): void => {
|
|
3971
|
+
p256SetZero(out.x)
|
|
3972
|
+
p256SetZero(out.y)
|
|
3973
|
+
p256SetZero(out.z)
|
|
3974
|
+
for (let i: i32 = 0; i < 16; i++) {
|
|
3975
|
+
const hit: u32 = ctEq(toU32(i), digit) & 1
|
|
3976
|
+
p256TableMove(out.x, table, i * P256_ENTRY, hit)
|
|
3977
|
+
p256TableMove(out.y, table, i * P256_ENTRY + 8, hit)
|
|
3978
|
+
p256TableMove(out.z, table, i * P256_ENTRY + 16, hit)
|
|
3979
|
+
}
|
|
3980
|
+
}
|
|
3981
|
+
|
|
3982
|
+
/**
|
|
3983
|
+
* `out = k * p` for 32 big-endian bytes `k`, in constant time: the fixed
|
|
3984
|
+
* 4-bit window described in the module's header. The 64 digits are read from
|
|
3985
|
+
* the top nibble down; their positions are public, their values reach only
|
|
3986
|
+
* `p256TableSelect`. Every window does four doublings, one table read and one
|
|
3987
|
+
* complete addition, so a zero digit or a leading run of zeros costs what any
|
|
3988
|
+
* other digit does.
|
|
3989
|
+
*/
|
|
3990
|
+
const p256ScalarMult = (
|
|
3991
|
+
out: P256ProjectivePoint,
|
|
3992
|
+
k: u8[],
|
|
3993
|
+
p: P256ProjectivePoint,
|
|
3994
|
+
s: P256PointScratch
|
|
3995
|
+
): void => {
|
|
3996
|
+
const kLength: i32 = toI32(k.length)
|
|
3997
|
+
if (kLength < 32) {
|
|
3998
|
+
return
|
|
3999
|
+
}
|
|
4000
|
+
const table: u32[] = new Array<u32>(384)
|
|
4001
|
+
p256TableBuild(table, p, s)
|
|
4002
|
+
const acc = new P256ProjectivePoint()
|
|
4003
|
+
const entry = new P256ProjectivePoint()
|
|
4004
|
+
for (let i: i32 = 0; i < 64; i++) {
|
|
4005
|
+
// Digit i is the high nibble of byte i / 2 when i is even, the low when odd.
|
|
4006
|
+
const at: i32 = i >> 1
|
|
4007
|
+
const byte: u32 = at >= 0 && at < kLength ? toU32(k[at]) : 0
|
|
4008
|
+
const digit: u32 = (byte >> ((1 - toU32(i & 1)) << 2)) & 15
|
|
4009
|
+
p256PointDouble(acc, acc, s)
|
|
4010
|
+
p256PointDouble(acc, acc, s)
|
|
4011
|
+
p256PointDouble(acc, acc, s)
|
|
4012
|
+
p256PointDouble(acc, acc, s)
|
|
4013
|
+
p256TableSelect(entry, table, digit)
|
|
4014
|
+
p256PointAdd(acc, acc, entry, s)
|
|
4015
|
+
}
|
|
4016
|
+
p256PointCopy(out, acc)
|
|
4017
|
+
}
|
|
4018
|
+
|
|
4019
|
+
/** The base point G (SEC 2 §2.4.2), in the Montgomery domain with Z = 1. */
|
|
4020
|
+
const p256Generator = (): P256ProjectivePoint => {
|
|
4021
|
+
const g = new P256ProjectivePoint()
|
|
4022
|
+
const r2: u32[] = p256FieldR2()
|
|
4023
|
+
p256SetLimbs(
|
|
4024
|
+
g.x,
|
|
4025
|
+
0xd898c296,
|
|
4026
|
+
0xf4a13945,
|
|
4027
|
+
0x2deb33a0,
|
|
4028
|
+
0x77037d81,
|
|
4029
|
+
0x63a440f2,
|
|
4030
|
+
0xf8bce6e5,
|
|
4031
|
+
0xe12c4247,
|
|
4032
|
+
0x6b17d1f2
|
|
4033
|
+
)
|
|
4034
|
+
p256SetLimbs(
|
|
4035
|
+
g.y,
|
|
4036
|
+
0x37bf51f5,
|
|
4037
|
+
0xcbb64068,
|
|
4038
|
+
0x6b315ece,
|
|
4039
|
+
0x2bce3357,
|
|
4040
|
+
0x7c0f9e16,
|
|
4041
|
+
0x8ee7eb4a,
|
|
4042
|
+
0xfe1a7f9b,
|
|
4043
|
+
0x4fe342e2
|
|
4044
|
+
)
|
|
4045
|
+
p256FiatMul(g.x, g.x, r2)
|
|
4046
|
+
p256FiatMul(g.y, g.y, r2)
|
|
4047
|
+
p256FiatSetOne(g.z)
|
|
4048
|
+
return g
|
|
4049
|
+
}
|
|
4050
|
+
|
|
4051
|
+
/**
|
|
4052
|
+
* The affine x of `p` as plain limbs, `X / Z` out of the Montgomery domain,
|
|
4053
|
+
* which is all ECDSA reads of a point. The identity has no affine form; its Z
|
|
4054
|
+
* inverts to zero and so does the answer, which callers rule out first.
|
|
4055
|
+
*/
|
|
4056
|
+
const p256AffineX = (x: u32[], p: P256ProjectivePoint): void => {
|
|
4057
|
+
const zInverse: u32[] = p256Limbs()
|
|
4058
|
+
p256FieldInvert(zInverse, p.z)
|
|
4059
|
+
p256FiatMul(x, p.x, zInverse)
|
|
4060
|
+
p256FiatMul(x, x, p256PlainOne())
|
|
4061
|
+
}
|
|
4062
|
+
|
|
4063
|
+
/**
|
|
4064
|
+
* The point a SEC 1 §2.3.4 uncompressed encoding names, or `null` when it
|
|
4065
|
+
* names none: a length other than 65, a first byte other than 0x04, a
|
|
4066
|
+
* coordinate of p or more, or a pair that is not on the curve. The identity
|
|
4067
|
+
* has no 65-byte encoding (SEC 1 writes it as the single byte 0x00), so it is
|
|
4068
|
+
* refused by the length, and its would-be spelling as (0, 0) is not on the
|
|
4069
|
+
* curve. Everything here is public — it is a key someone sent — so it may
|
|
4070
|
+
* branch.
|
|
4071
|
+
*/
|
|
4072
|
+
const p256DecodePoint = (bytes: u8[]): P256ProjectivePoint | null => {
|
|
4073
|
+
if (toI32(bytes.length) !== 65 || toI32(bytes[0]) !== 4) {
|
|
4074
|
+
return null
|
|
4075
|
+
}
|
|
4076
|
+
const prime: u32[] = p256Prime()
|
|
4077
|
+
const r2: u32[] = p256FieldR2()
|
|
4078
|
+
const p = new P256ProjectivePoint()
|
|
4079
|
+
p256LimbsFromBytes(p.x, bytes, 1)
|
|
4080
|
+
p256LimbsFromBytes(p.y, bytes, 33)
|
|
4081
|
+
if (p256Below(p.x, prime) === 0 || p256Below(p.y, prime) === 0) {
|
|
4082
|
+
return null
|
|
4083
|
+
}
|
|
4084
|
+
p256FiatMul(p.x, p.x, r2)
|
|
4085
|
+
p256FiatMul(p.y, p.y, r2)
|
|
4086
|
+
p256FiatSetOne(p.z)
|
|
4087
|
+
// y^2 = x^3 - 3x + b, both sides in the Montgomery domain.
|
|
4088
|
+
const lhs: u32[] = p256Limbs()
|
|
4089
|
+
const rhs: u32[] = p256Limbs()
|
|
4090
|
+
const t: u32[] = p256Limbs()
|
|
4091
|
+
p256FiatSquare(lhs, p.y)
|
|
4092
|
+
p256FiatSquare(rhs, p.x)
|
|
4093
|
+
p256FiatMul(rhs, rhs, p.x)
|
|
4094
|
+
p256FiatAdd(t, p.x, p.x)
|
|
4095
|
+
p256FiatAdd(t, t, p.x)
|
|
4096
|
+
p256FiatSub(rhs, rhs, t)
|
|
4097
|
+
p256FiatAdd(rhs, rhs, p256CurveB())
|
|
4098
|
+
p256FiatSub(t, lhs, rhs)
|
|
4099
|
+
if (p256FiatNonzero(t) !== 0) {
|
|
4100
|
+
return null
|
|
4101
|
+
}
|
|
4102
|
+
return p
|
|
4103
|
+
}
|
|
4104
|
+
|
|
4105
|
+
/** `p` as its 65-byte uncompressed SEC 1 encoding; `p` is never the identity here. */
|
|
4106
|
+
const p256EncodePoint = (p: P256ProjectivePoint): u8[] => {
|
|
4107
|
+
const zInverse: u32[] = p256Limbs()
|
|
4108
|
+
const one: u32[] = p256PlainOne()
|
|
4109
|
+
const x: u32[] = p256Limbs()
|
|
4110
|
+
const y: u32[] = p256Limbs()
|
|
4111
|
+
p256FieldInvert(zInverse, p.z)
|
|
4112
|
+
p256FiatMul(x, p.x, zInverse)
|
|
4113
|
+
p256FiatMul(y, p.y, zInverse)
|
|
4114
|
+
p256FiatMul(x, x, one)
|
|
4115
|
+
p256FiatMul(y, y, one)
|
|
4116
|
+
const out: u8[] = new Array<u8>(65)
|
|
4117
|
+
out[0] = 4
|
|
4118
|
+
p256LimbsToBytes(out, 1, x)
|
|
4119
|
+
p256LimbsToBytes(out, 33, y)
|
|
4120
|
+
return out
|
|
4121
|
+
}
|
|
4122
|
+
|
|
4123
|
+
/**
|
|
4124
|
+
* Whether 32 big-endian bytes hold a scalar in [1, n), the range of a private
|
|
4125
|
+
* key, a nonce and each half of a signature. Constant time in the value; the
|
|
4126
|
+
* caller branches on the answer, which says only that the input was usable.
|
|
4127
|
+
*/
|
|
4128
|
+
const p256ScalarInRange = (bytes: u8[]): boolean => {
|
|
4129
|
+
if (toI32(bytes.length) !== 32) {
|
|
4130
|
+
return false
|
|
4131
|
+
}
|
|
4132
|
+
const a: u32[] = p256Limbs()
|
|
4133
|
+
p256LimbsFromBytes(a, bytes, 0)
|
|
4134
|
+
const below: u32 = p256Below(a, p256Order())
|
|
4135
|
+
const zero: u32 = ctEq(p256FiatNonzero(a), 0) & 1
|
|
4136
|
+
return (below & (zero ^ 1)) === 1
|
|
4137
|
+
}
|
|
4138
|
+
|
|
4139
|
+
/**
|
|
4140
|
+
* bits2int of RFC 6979 §2.3.2 for qlen = 256, then reduced mod n: the leftmost
|
|
4141
|
+
* 256 bits of `digest` as an integer, as FIPS 186-4 §6.4 takes a hash, and
|
|
4142
|
+
* then n subtracted once if it is at least n. A digest shorter than 32 bytes
|
|
4143
|
+
* is its own value, zero-extended on the left. Answers plain limbs.
|
|
4144
|
+
*/
|
|
4145
|
+
const p256DigestScalar = (out: u32[], digest: u8[]): void => {
|
|
4146
|
+
const length: i32 = toI32(digest.length)
|
|
4147
|
+
const bytes: u8[] = new Array<u8>(32)
|
|
4148
|
+
const take: i32 = length < 32 ? length : 32
|
|
4149
|
+
const skip: i32 = 32 - take
|
|
4150
|
+
for (let i: i32 = 0; i < take && i < length && skip + i < 32; i++) {
|
|
4151
|
+
bytes[skip + i] = digest[i]
|
|
4152
|
+
}
|
|
4153
|
+
const a: u32[] = p256Limbs()
|
|
4154
|
+
p256LimbsFromBytes(a, bytes, 0)
|
|
4155
|
+
p256ReduceOnce(out, a, p256Order())
|
|
4156
|
+
}
|
|
4157
|
+
|
|
4158
|
+
/**
|
|
4159
|
+
* HMAC_K(V || sep || x || h), the key update of RFC 6979 §3.2 steps d and f
|
|
4160
|
+
* (with `sep` 0 and then 1) and, with `x` and `h` empty, step h.3.
|
|
4161
|
+
*/
|
|
4162
|
+
const p256NonceKey = (k: u8[], v: u8[], sep: u8, x: u8[], h: u8[]): u8[] => {
|
|
4163
|
+
const mac = new HmacSha256(k)
|
|
4164
|
+
const separator: u8[] = new Array<u8>(1)
|
|
4165
|
+
separator[0] = sep
|
|
4166
|
+
mac.update(v, P256_FROM, toI32(v.length))
|
|
4167
|
+
mac.update(separator, P256_FROM, toI32(separator.length))
|
|
4168
|
+
mac.update(x, P256_FROM, toI32(x.length))
|
|
4169
|
+
mac.update(h, P256_FROM, toI32(h.length))
|
|
4170
|
+
return mac.digest()
|
|
4171
|
+
}
|
|
4172
|
+
|
|
4173
|
+
/**
|
|
4174
|
+
* The signature of the plain scalar `z` (a digest mod n) under the private key
|
|
4175
|
+
* `priv`, already checked to be in [1, n), with the nonce of RFC 6979 §3.2 for
|
|
4176
|
+
* HMAC-SHA-256. For P-256 and SHA-256, qlen = hlen = 256, so one HMAC output
|
|
4177
|
+
* is one candidate `k` (step h.2 runs once) and bits2int is the identity.
|
|
4178
|
+
*
|
|
4179
|
+
* A candidate at or above n, and a `k` that gives `r = 0` or `s = 0`, go round
|
|
4180
|
+
* again through step h.3, as the RFC says. Whether a candidate is below n is a
|
|
4181
|
+
* branch on the secret, and the one the RFC prescribes: it is taken once in
|
|
4182
|
+
* about 2^32 signatures and says only that a discarded value was large.
|
|
4183
|
+
*/
|
|
4184
|
+
const p256SignScalar = (priv: u8[], z: u32[]): u8[] => {
|
|
4185
|
+
const n: u32[] = p256Order()
|
|
4186
|
+
const r2: u32[] = p256ScalarR2()
|
|
4187
|
+
const h1: u8[] = new Array<u8>(32)
|
|
4188
|
+
p256LimbsToBytes(h1, 0, z)
|
|
4189
|
+
const empty: u8[] = new Array<u8>(0)
|
|
4190
|
+
let v: u8[] = new Array<u8>(32)
|
|
4191
|
+
let k: u8[] = new Array<u8>(32)
|
|
4192
|
+
for (let i: i32 = 0; i < 32; i++) {
|
|
4193
|
+
v[i] = 1
|
|
4194
|
+
}
|
|
4195
|
+
k = p256NonceKey(k, v, 0, priv, h1) // step d
|
|
4196
|
+
v = hmacSha256(k, v) // step e
|
|
4197
|
+
k = p256NonceKey(k, v, 1, priv, h1) // step f
|
|
4198
|
+
v = hmacSha256(k, v) // step g
|
|
4199
|
+
|
|
4200
|
+
const dM: u32[] = p256Limbs()
|
|
4201
|
+
p256LimbsFromBytes(dM, priv, 0)
|
|
4202
|
+
p256FiatScalarMul(dM, dM, r2)
|
|
4203
|
+
const g: P256ProjectivePoint = p256Generator()
|
|
4204
|
+
const scratch = new P256PointScratch()
|
|
4205
|
+
const point = new P256ProjectivePoint()
|
|
4206
|
+
const x: u32[] = p256Limbs()
|
|
4207
|
+
const r: u32[] = p256Limbs()
|
|
4208
|
+
const kM: u32[] = p256Limbs()
|
|
4209
|
+
const s: u32[] = p256Limbs()
|
|
4210
|
+
while (true) {
|
|
4211
|
+
v = hmacSha256(k, v) // step h.2
|
|
4212
|
+
if (p256ScalarInRange(v)) {
|
|
4213
|
+
p256ScalarMult(point, v, g, scratch)
|
|
4214
|
+
p256AffineX(x, point)
|
|
4215
|
+
p256ReduceOnce(r, x, n)
|
|
4216
|
+
// s = k^-1 (z + r d) mod n. A Montgomery multiply of a plain value by
|
|
4217
|
+
// one in the Montgomery domain answers a plain value, so only d and
|
|
4218
|
+
// k^-1 are converted: r d and then (z + r d) k^-1 come out plain.
|
|
4219
|
+
p256LimbsFromBytes(kM, v, 0)
|
|
4220
|
+
p256FiatScalarMul(kM, kM, r2)
|
|
4221
|
+
p256ScalarInvert(kM, kM)
|
|
4222
|
+
p256FiatScalarMul(s, r, dM)
|
|
4223
|
+
p256FiatScalarAdd(s, s, z)
|
|
4224
|
+
p256FiatScalarMul(s, s, kM)
|
|
4225
|
+
if (p256FiatNonzero(r) !== 0 && p256FiatNonzero(s) !== 0) {
|
|
4226
|
+
const sig: u8[] = new Array<u8>(64)
|
|
4227
|
+
p256LimbsToBytes(sig, 0, r)
|
|
4228
|
+
p256LimbsToBytes(sig, 32, s)
|
|
4229
|
+
return sig
|
|
4230
|
+
}
|
|
4231
|
+
}
|
|
4232
|
+
k = p256NonceKey(k, v, 0, empty, empty) // step h.3
|
|
4233
|
+
v = hmacSha256(k, v)
|
|
4234
|
+
}
|
|
4235
|
+
}
|
|
4236
|
+
|
|
4237
|
+
/**
|
|
4238
|
+
* The public key of `priv`: `priv * G` in the 65-byte uncompressed SEC 1
|
|
4239
|
+
* encoding. Answers `null` unless `priv` is `P256_SCALAR_SIZE` bytes holding a
|
|
4240
|
+
* scalar in [1, n) — 0 and n and everything above are not private keys.
|
|
4241
|
+
*/
|
|
4242
|
+
export const p256PublicKey = (priv: u8[]): u8[] | null => {
|
|
4243
|
+
if (!p256ScalarInRange(priv)) {
|
|
4244
|
+
return null
|
|
4245
|
+
}
|
|
4246
|
+
const point = new P256ProjectivePoint()
|
|
4247
|
+
p256ScalarMult(point, priv, p256Generator(), new P256PointScratch())
|
|
4248
|
+
return p256EncodePoint(point)
|
|
4249
|
+
}
|
|
4250
|
+
|
|
4251
|
+
/**
|
|
4252
|
+
* The ECDSA signature (FIPS 186-4 §6.4) of `digest` under `priv`, as `r || s`,
|
|
4253
|
+
* 64 bytes, with the deterministic nonce of RFC 6979 §3.2 over HMAC-SHA-256.
|
|
4254
|
+
* `digest` is the message's hash, taken as bits2int does: its leftmost 256
|
|
4255
|
+
* bits. The same key and digest always give the same signature, and `s` is
|
|
4256
|
+
* not normalised to the lower half. Answers `null` for a private key
|
|
4257
|
+
* `p256PublicKey` would refuse.
|
|
4258
|
+
*/
|
|
4259
|
+
export const p256Sign = (priv: u8[], digest: u8[]): u8[] | null => {
|
|
4260
|
+
if (!p256ScalarInRange(priv)) {
|
|
4261
|
+
return null
|
|
4262
|
+
}
|
|
4263
|
+
const z: u32[] = p256Limbs()
|
|
4264
|
+
p256DigestScalar(z, digest)
|
|
4265
|
+
return p256SignScalar(priv, z)
|
|
4266
|
+
}
|
|
4267
|
+
|
|
4268
|
+
/**
|
|
4269
|
+
* Whether `sig` (`r || s`) is a valid ECDSA signature of `digest` under the
|
|
4270
|
+
* public key `pub` (FIPS 186-4 §6.4.2): `r` and `s` in [1, n), and the
|
|
4271
|
+
* x-coordinate of `u1 * G + u2 * Q` equal to `r` mod n, with `w = s^-1`,
|
|
4272
|
+
* `u1 = z w` and `u2 = r w`. A key or signature of the wrong length, a key
|
|
4273
|
+
* that is not a point on the curve, and a sum that is the identity all answer
|
|
4274
|
+
* `false`. Every value here is public, so the answer may be reached by
|
|
4275
|
+
* branches; the multiplications are the constant-time ones all the same.
|
|
4276
|
+
*/
|
|
4277
|
+
export const p256Verify = (pub: u8[], digest: u8[], sig: u8[]): boolean => {
|
|
4278
|
+
if (toI32(sig.length) !== 64) {
|
|
4279
|
+
return false
|
|
4280
|
+
}
|
|
4281
|
+
const q: P256ProjectivePoint | null = p256DecodePoint(pub)
|
|
4282
|
+
if (q === null) {
|
|
4283
|
+
return false
|
|
4284
|
+
}
|
|
4285
|
+
const rBytes: u8[] = new Array<u8>(32)
|
|
4286
|
+
const sBytes: u8[] = new Array<u8>(32)
|
|
4287
|
+
for (let i: i32 = 0; i < 32; i++) {
|
|
4288
|
+
rBytes[i] = sig[i]
|
|
4289
|
+
sBytes[i] = sig[i + 32]
|
|
4290
|
+
}
|
|
4291
|
+
if (!p256ScalarInRange(rBytes) || !p256ScalarInRange(sBytes)) {
|
|
4292
|
+
return false
|
|
4293
|
+
}
|
|
4294
|
+
const n: u32[] = p256Order()
|
|
4295
|
+
const r2: u32[] = p256ScalarR2()
|
|
4296
|
+
const r: u32[] = p256Limbs()
|
|
4297
|
+
const w: u32[] = p256Limbs()
|
|
4298
|
+
const z: u32[] = p256Limbs()
|
|
4299
|
+
p256LimbsFromBytes(r, rBytes, 0)
|
|
4300
|
+
p256LimbsFromBytes(w, sBytes, 0)
|
|
4301
|
+
p256DigestScalar(z, digest)
|
|
4302
|
+
// w = s^-1 in the Montgomery domain; u1 = z w and u2 = r w multiply a
|
|
4303
|
+
// plain value by it, so they come out plain.
|
|
4304
|
+
p256FiatScalarMul(w, w, r2)
|
|
4305
|
+
p256ScalarInvert(w, w)
|
|
4306
|
+
const u1: u32[] = p256Limbs()
|
|
4307
|
+
const u2: u32[] = p256Limbs()
|
|
4308
|
+
p256FiatScalarMul(u1, z, w)
|
|
4309
|
+
p256FiatScalarMul(u2, r, w)
|
|
4310
|
+
const u1Bytes: u8[] = new Array<u8>(32)
|
|
4311
|
+
const u2Bytes: u8[] = new Array<u8>(32)
|
|
4312
|
+
p256LimbsToBytes(u1Bytes, 0, u1)
|
|
4313
|
+
p256LimbsToBytes(u2Bytes, 0, u2)
|
|
4314
|
+
|
|
4315
|
+
const scratch = new P256PointScratch()
|
|
4316
|
+
const sum = new P256ProjectivePoint()
|
|
4317
|
+
const other = new P256ProjectivePoint()
|
|
4318
|
+
p256ScalarMult(sum, u1Bytes, p256Generator(), scratch)
|
|
4319
|
+
p256ScalarMult(other, u2Bytes, q, scratch)
|
|
4320
|
+
p256PointAdd(sum, sum, other, scratch)
|
|
4321
|
+
if (p256FiatNonzero(sum.z) === 0) {
|
|
4322
|
+
return false
|
|
4323
|
+
}
|
|
4324
|
+
const x: u32[] = p256Limbs()
|
|
4325
|
+
p256AffineX(x, sum)
|
|
4326
|
+
p256ReduceOnce(x, x, n)
|
|
4327
|
+
const vBytes: u8[] = new Array<u8>(32)
|
|
4328
|
+
p256LimbsToBytes(vBytes, 0, x)
|
|
4329
|
+
return timingSafeEqual(vBytes, rBytes)
|
|
4330
|
+
}
|
|
4331
|
+
|
|
4332
|
+
/** `p256Sign` of the SHA-256 of `msg`: ECDSA with SHA-256 over the whole message. */
|
|
4333
|
+
export const p256SignSha256 = (priv: u8[], msg: u8[]): u8[] | null => p256Sign(priv, sha256(msg))
|
|
4334
|
+
|
|
4335
|
+
/** `p256Verify` of the SHA-256 of `msg`. */
|
|
4336
|
+
export const p256VerifySha256 = (pub: u8[], msg: u8[], sig: u8[]): boolean =>
|
|
4337
|
+
p256Verify(pub, sha256(msg), sig)
|