edhoc 1.0.0 → 1.0.2

package/external/libedhoc/backends/cbor/src/backend_cbor_plaintext_4_encode.c

@@ -0,0 +1,88 @@
+/*
+ * Generated using zcbor version 0.7.0
+ * https://github.com/NordicSemiconductor/zcbor
+ * Generated with a --default-max-qty of 3
+ */
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <string.h>
+#include "zcbor_encode.h"
+#include "backend_cbor_plaintext_4_encode.h"
+
+#if DEFAULT_MAX_QTY != 3
+#error "The type file was generated with a different default_max_qty than this file"
+#endif
+
+static bool encode_repeated_ead_x(zcbor_state_t *state, const struct ead_x *input);
+static bool encode_ead_x(zcbor_state_t *state, const struct ead_x_ *input);
+static bool encode_plaintext_4_EAD_4(zcbor_state_t *state, const struct plaintext_4_EAD_4 *input);
+
+
+static bool encode_repeated_ead_x(
+		zcbor_state_t *state, const struct ead_x *input)
+{
+	zcbor_print("%s\r\n", __func__);
+
+	bool tmp_result = (((((zcbor_int32_encode(state, (&(*input)._ead_x_ead_label))))
+	&& zcbor_present_encode(&((*input)._ead_x_ead_value_present), (zcbor_encoder_t *)zcbor_bstr_encode, state, (&(*input)._ead_x_ead_value)))));
+
+	if (!tmp_result)
+		zcbor_trace();
+
+	return tmp_result;
+}
+
+static bool encode_ead_x(
+		zcbor_state_t *state, const struct ead_x_ *input)
+{
+	zcbor_print("%s\r\n", __func__);
+
+	bool tmp_result = (zcbor_multi_encode_minmax(1, 3, &(*input)._ead_x_count, (zcbor_encoder_t *)encode_repeated_ead_x, state, (&(*input)._ead_x), sizeof(struct ead_x)));
+
+	if (!tmp_result)
+		zcbor_trace();
+
+	return tmp_result;
+}
+
+static bool encode_plaintext_4_EAD_4(
+		zcbor_state_t *state, const struct plaintext_4_EAD_4 *input)
+{
+	zcbor_print("%s\r\n", __func__);
+
+	bool tmp_result = (zcbor_present_encode(&((*input)._plaintext_4_EAD_4_present), (zcbor_encoder_t *)encode_ead_x, state, (&(*input)._plaintext_4_EAD_4)));
+
+	if (!tmp_result)
+		zcbor_trace();
+
+	return tmp_result;
+}
+
+
+
+int cbor_encode_plaintext_4_EAD_4(
+		uint8_t *payload, size_t payload_len,
+		const struct plaintext_4_EAD_4 *input,
+		size_t *payload_len_out)
+{
+	zcbor_state_t states[2];
+
+	zcbor_new_state(states, sizeof(states) / sizeof(zcbor_state_t), payload, payload_len, 6);
+
+	bool ret = encode_plaintext_4_EAD_4(states, input);
+
+	if (ret && (payload_len_out != NULL)) {
+		*payload_len_out = MIN(payload_len,
+				(size_t)states[0].payload - (size_t)payload);
+	}
+
+	if (!ret) {
+		int err = zcbor_pop_error(states);
+
+		zcbor_print("Return error: %d\r\n", err);
+		return (err == ZCBOR_SUCCESS) ? ZCBOR_ERR_UNKNOWN : err;
+	}
+	return ZCBOR_SUCCESS;
+}

package/external/libedhoc/backends/cbor/src/backend_cbor_sig_structure_decode.c

@@ -0,0 +1,63 @@
+/*
+ * Generated using zcbor version 0.7.0
+ * https://github.com/NordicSemiconductor/zcbor
+ * Generated with a --default-max-qty of 3
+ */
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <string.h>
+#include "zcbor_decode.h"
+#include "backend_cbor_sig_structure_decode.h"
+
+#if DEFAULT_MAX_QTY != 3
+#error "The type file was generated with a different default_max_qty than this file"
+#endif
+
+static bool decode_sig_structure(zcbor_state_t *state, struct sig_structure *result);
+
+
+static bool decode_sig_structure(
+		zcbor_state_t *state, struct sig_structure *result)
+{
+	zcbor_print("%s\r\n", __func__);
+	struct zcbor_string tmp_str;
+
+	bool tmp_result = (((zcbor_list_start_decode(state) && ((((zcbor_tstr_expect(state, ((tmp_str.value = (uint8_t *)"Signature1", tmp_str.len = sizeof("Signature1") - 1, &tmp_str)))))
+	&& ((zcbor_bstr_decode(state, (&(*result)._sig_structure_protected))))
+	&& ((zcbor_bstr_decode(state, (&(*result)._sig_structure_external_aad))))
+	&& ((zcbor_bstr_decode(state, (&(*result)._sig_structure_payload))))) || (zcbor_list_map_end_force_decode(state), false)) && zcbor_list_end_decode(state))));
+
+	if (!tmp_result)
+		zcbor_trace();
+
+	return tmp_result;
+}
+
+
+
+int cbor_decode_sig_structure(
+		const uint8_t *payload, size_t payload_len,
+		struct sig_structure *result,
+		size_t *payload_len_out)
+{
+	zcbor_state_t states[3];
+
+	zcbor_new_state(states, sizeof(states) / sizeof(zcbor_state_t), payload, payload_len, 1);
+
+	bool ret = decode_sig_structure(states, result);
+
+	if (ret && (payload_len_out != NULL)) {
+		*payload_len_out = MIN(payload_len,
+				(size_t)states[0].payload - (size_t)payload);
+	}
+
+	if (!ret) {
+		int err = zcbor_pop_error(states);
+
+		zcbor_print("Return error: %d\r\n", err);
+		return (err == ZCBOR_SUCCESS) ? ZCBOR_ERR_UNKNOWN : err;
+	}
+	return ZCBOR_SUCCESS;
+}

package/external/libedhoc/backends/cbor/src/backend_cbor_sig_structure_encode.c

@@ -0,0 +1,63 @@
+/*
+ * Generated using zcbor version 0.7.0
+ * https://github.com/NordicSemiconductor/zcbor
+ * Generated with a --default-max-qty of 3
+ */
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <string.h>
+#include "zcbor_encode.h"
+#include "backend_cbor_sig_structure_encode.h"
+
+#if DEFAULT_MAX_QTY != 3
+#error "The type file was generated with a different default_max_qty than this file"
+#endif
+
+static bool encode_sig_structure(zcbor_state_t *state, const struct sig_structure *input);
+
+
+static bool encode_sig_structure(
+		zcbor_state_t *state, const struct sig_structure *input)
+{
+	zcbor_print("%s\r\n", __func__);
+	struct zcbor_string tmp_str;
+
+	bool tmp_result = (((zcbor_list_start_encode(state, 4) && ((((zcbor_tstr_encode(state, ((tmp_str.value = (uint8_t *)"Signature1", tmp_str.len = sizeof("Signature1") - 1, &tmp_str)))))
+	&& ((zcbor_bstr_encode(state, (&(*input)._sig_structure_protected))))
+	&& ((zcbor_bstr_encode(state, (&(*input)._sig_structure_external_aad))))
+	&& ((zcbor_bstr_encode(state, (&(*input)._sig_structure_payload))))) || (zcbor_list_map_end_force_encode(state), false)) && zcbor_list_end_encode(state, 4))));
+
+	if (!tmp_result)
+		zcbor_trace();
+
+	return tmp_result;
+}
+
+
+
+int cbor_encode_sig_structure(
+		uint8_t *payload, size_t payload_len,
+		const struct sig_structure *input,
+		size_t *payload_len_out)
+{
+	zcbor_state_t states[3];
+
+	zcbor_new_state(states, sizeof(states) / sizeof(zcbor_state_t), payload, payload_len, 1);
+
+	bool ret = encode_sig_structure(states, input);
+
+	if (ret && (payload_len_out != NULL)) {
+		*payload_len_out = MIN(payload_len,
+				(size_t)states[0].payload - (size_t)payload);
+	}
+
+	if (!ret) {
+		int err = zcbor_pop_error(states);
+
+		zcbor_print("Return error: %d\r\n", err);
+		return (err == ZCBOR_SUCCESS) ? ZCBOR_ERR_UNKNOWN : err;
+	}
+	return ZCBOR_SUCCESS;
+}

package/external/libedhoc/externals/compact25519/src/c25519/c25519.c

@@ -0,0 +1,126 @@
+/* Curve25519 (Montgomery form)
+ * Daniel Beer <dlbeer@gmail.com>, 18 Apr 2014
+ *
+ * This file is in the public domain.
+ */
+
+#include "c25519.h"
+
+#ifndef COMPACT_DISABLE_X25519
+const uint8_t c25519_base_x[F25519_SIZE] = {9};
+
+/* Double an X-coordinate */
+static void xc_double(uint8_t *x3, uint8_t *z3,
+		      const uint8_t *x1, const uint8_t *z1)
+{
+	/* Explicit formulas database: dbl-1987-m
+	 *
+	 * source 1987 Montgomery "Speeding the Pollard and elliptic
+	 *   curve methods of factorization", page 261, fourth display
+	 * compute X3 = (X1^2-Z1^2)^2
+	 * compute Z3 = 4 X1 Z1 (X1^2 + a X1 Z1 + Z1^2)
+	 */
+	uint8_t x1sq[F25519_SIZE];
+	uint8_t z1sq[F25519_SIZE];
+	uint8_t x1z1[F25519_SIZE];
+	uint8_t a[F25519_SIZE];
+
+	f25519_mul__distinct(x1sq, x1, x1);
+	f25519_mul__distinct(z1sq, z1, z1);
+	f25519_mul__distinct(x1z1, x1, z1);
+
+	f25519_sub(a, x1sq, z1sq);
+	f25519_mul__distinct(x3, a, a);
+
+	f25519_mul_c(a, x1z1, 486662);
+	f25519_add(a, x1sq, a);
+	f25519_add(a, z1sq, a);
+	f25519_mul__distinct(x1sq, x1z1, a);
+	f25519_mul_c(z3, x1sq, 4);
+}
+
+/* Differential addition */
+static void xc_diffadd(uint8_t *x5, uint8_t *z5,
+		       const uint8_t *x1, const uint8_t *z1,
+		       const uint8_t *x2, const uint8_t *z2,
+		       const uint8_t *x3, const uint8_t *z3)
+{
+	/* Explicit formulas database: dbl-1987-m3
+	 *
+	 * source 1987 Montgomery "Speeding the Pollard and elliptic curve
+	 *   methods of factorization", page 261, fifth display, plus
+	 *   common-subexpression elimination
+	 * compute A = X2+Z2
+	 * compute B = X2-Z2
+	 * compute C = X3+Z3
+	 * compute D = X3-Z3
+	 * compute DA = D A
+	 * compute CB = C B
+	 * compute X5 = Z1(DA+CB)^2
+	 * compute Z5 = X1(DA-CB)^2
+	 */
+	uint8_t da[F25519_SIZE];
+	uint8_t cb[F25519_SIZE];
+	uint8_t a[F25519_SIZE];
+	uint8_t b[F25519_SIZE];
+
+	f25519_add(a, x2, z2);
+	f25519_sub(b, x3, z3); /* D */
+	f25519_mul__distinct(da, a, b);
+
+	f25519_sub(b, x2, z2);
+	f25519_add(a, x3, z3); /* C */
+	f25519_mul__distinct(cb, a, b);
+
+	f25519_add(a, da, cb);
+	f25519_mul__distinct(b, a, a);
+	f25519_mul__distinct(x5, z1, b);
+
+	f25519_sub(a, da, cb);
+	f25519_mul__distinct(b, a, a);
+	f25519_mul__distinct(z5, x1, b);
+}
+
+void c25519_smult(uint8_t *result, const uint8_t *q, const uint8_t *e)
+{
+	/* Current point: P_m */
+	uint8_t xm[F25519_SIZE];
+	uint8_t zm[F25519_SIZE] = {1};
+
+	/* Predecessor: P_(m-1) */
+	uint8_t xm1[F25519_SIZE] = {1};
+	uint8_t zm1[F25519_SIZE] = {0};
+
+	int i;
+
+	/* Note: bit 254 is assumed to be 1 */
+	f25519_copy(xm, q);
+
+	for (i = 253; i >= 0; i--) {
+		const int bit = (e[i >> 3] >> (i & 7)) & 1;
+		uint8_t xms[F25519_SIZE];
+		uint8_t zms[F25519_SIZE];
+
+		/* From P_m and P_(m-1), compute P_(2m) and P_(2m-1) */
+		xc_diffadd(xm1, zm1, q, f25519_one, xm, zm, xm1, zm1);
+		xc_double(xm, zm, xm, zm);
+
+		/* Compute P_(2m+1) */
+		xc_diffadd(xms, zms, xm1, zm1, xm, zm, q, f25519_one);
+
+		/* Select:
+		 *   bit = 1 --> (P_(2m+1), P_(2m))
+		 *   bit = 0 --> (P_(2m), P_(2m-1))
+		 */
+		f25519_select(xm1, xm1, xm, bit);
+		f25519_select(zm1, zm1, zm, bit);
+		f25519_select(xm, xm, xms, bit);
+		f25519_select(zm, zm, zms, bit);
+	}
+
+	/* Freeze out of projective coordinates */
+	f25519_inv__distinct(zm1, zm);
+	f25519_mul__distinct(result, zm1, xm);
+	f25519_normalize(result);
+}
+#endif

package/external/libedhoc/externals/compact25519/src/c25519/c25519.h

@@ -0,0 +1,49 @@
+/* Curve25519 (Montgomery form)
+ * Daniel Beer <dlbeer@gmail.com>, 18 Apr 2014
+ *
+ * This file is in the public domain.
+ */
+
+#ifndef C25519_H_
+#define C25519_H_
+
+#ifndef COMPACT_DISABLE_X25519
+#include <stdint.h>
+#include "f25519.h"
+
+/* Curve25519 has the equation over F(p = 2^255-19):
+ *
+ *    y^2 = x^3 + 486662x^2 + x
+ *
+ * 486662 = 4A+2, where A = 121665. This is a Montgomery curve.
+ *
+ * For more information, see:
+ *
+ *    Bernstein, D.J. (2006) "Curve25519: New Diffie-Hellman speed
+ *    records". Document ID: 4230efdfa673480fc079449d90f322c0.
+ */
+
+/* This is the site of a Curve25519 exponent (private key) */
+#define C25519_EXPONENT_SIZE  32
+
+/* Having generated 32 random bytes, you should call this function to
+ * finalize the generated key.
+ */
+static inline void c25519_prepare(uint8_t *key)
+{
+	key[0] &= 0xf8;
+	key[31] &= 0x7f;
+	key[31] |= 0x40;
+}
+
+/* X-coordinate of the base point */
+extern const uint8_t c25519_base_x[F25519_SIZE];
+
+/* X-coordinate scalar multiply: given the X-coordinate of q, return the
+ * X-coordinate of e*q.
+ *
+ * result and q are field elements. e is an exponent.
+ */
+void c25519_smult(uint8_t *result, const uint8_t *q, const uint8_t *e);
+#endif
+#endif

package/external/libedhoc/externals/compact25519/src/c25519/ed25519.c

@@ -0,0 +1,323 @@
+/* Edwards curve operations
+ * Daniel Beer <dlbeer@gmail.com>, 9 Jan 2014
+ *
+ * This file is in the public domain.
+ */
+
+#include "ed25519.h"
+
+#ifndef COMPACT_DISABLE_ED25519
+
+/* Base point is (numbers wrapped):
+ *
+ *     x = 151122213495354007725011514095885315114
+ *         54012693041857206046113283949847762202
+ *     y = 463168356949264781694283940034751631413
+ *         07993866256225615783033603165251855960
+ *
+ * y is derived by transforming the original Montgomery base (u=9). x
+ * is the corresponding positive coordinate for the new curve equation.
+ * t is x*y.
+ */
+const struct ed25519_pt ed25519_base = {
+	.x = {
+		0x1a, 0xd5, 0x25, 0x8f, 0x60, 0x2d, 0x56, 0xc9,
+		0xb2, 0xa7, 0x25, 0x95, 0x60, 0xc7, 0x2c, 0x69,
+		0x5c, 0xdc, 0xd6, 0xfd, 0x31, 0xe2, 0xa4, 0xc0,
+		0xfe, 0x53, 0x6e, 0xcd, 0xd3, 0x36, 0x69, 0x21
+	},
+	.y = {
+		0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
+		0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
+		0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
+		0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66
+	},
+	.t = {
+		0xa3, 0xdd, 0xb7, 0xa5, 0xb3, 0x8a, 0xde, 0x6d,
+		0xf5, 0x52, 0x51, 0x77, 0x80, 0x9f, 0xf0, 0x20,
+		0x7d, 0xe3, 0xab, 0x64, 0x8e, 0x4e, 0xea, 0x66,
+		0x65, 0x76, 0x8b, 0xd7, 0x0f, 0x5f, 0x87, 0x67
+	},
+	.z = {1, 0}
+};
+
+const struct ed25519_pt ed25519_neutral = {
+	.x = {0},
+	.y = {1, 0},
+	.t = {0},
+	.z = {1, 0}
+};
+
+/* Conversion to and from projective coordinates */
+void ed25519_project(struct ed25519_pt *p,
+		     const uint8_t *x, const uint8_t *y)
+{
+	f25519_copy(p->x, x);
+	f25519_copy(p->y, y);
+	f25519_load(p->z, 1);
+	f25519_mul__distinct(p->t, x, y);
+}
+
+void ed25519_unproject(uint8_t *x, uint8_t *y,
+		       const struct ed25519_pt *p)
+{
+	uint8_t z1[F25519_SIZE];
+
+	f25519_inv__distinct(z1, p->z);
+	f25519_mul__distinct(x, p->x, z1);
+	f25519_mul__distinct(y, p->y, z1);
+
+	f25519_normalize(x);
+	f25519_normalize(y);
+}
+
+/* Compress/uncompress points. We compress points by storing the x
+ * coordinate and the parity of the y coordinate.
+ *
+ * Rearranging the curve equation, we obtain explicit formulae for the
+ * coordinates:
+ *
+ *     x = sqrt((y^2-1) / (1+dy^2))
+ *     y = sqrt((x^2+1) / (1-dx^2))
+ *
+ * Where d = (-121665/121666), or:
+ *
+ *     d = 370957059346694393431380835087545651895
+ *         42113879843219016388785533085940283555
+ */
+
+static const uint8_t ed25519_d[F25519_SIZE] = {
+	0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75,
+	0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00,
+	0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c,
+	0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52
+};
+
+void ed25519_pack(uint8_t *c, const uint8_t *x, const uint8_t *y)
+{
+	uint8_t tmp[F25519_SIZE];
+	uint8_t parity;
+
+	f25519_copy(tmp, x);
+	f25519_normalize(tmp);
+	parity = (tmp[0] & 1) << 7;
+
+	f25519_copy(c, y);
+	f25519_normalize(c);
+	c[31] |= parity;
+}
+
+uint8_t ed25519_try_unpack(uint8_t *x, uint8_t *y, const uint8_t *comp)
+{
+	const int parity = comp[31] >> 7;
+	uint8_t a[F25519_SIZE];
+	uint8_t b[F25519_SIZE];
+	uint8_t c[F25519_SIZE];
+
+	/* Unpack y */
+	f25519_copy(y, comp);
+	y[31] &= 127;
+
+	/* Compute c = y^2 */
+	f25519_mul__distinct(c, y, y);
+
+	/* Compute b = (1+dy^2)^-1 */
+	f25519_mul__distinct(b, c, ed25519_d);
+	f25519_add(a, b, f25519_one);
+	f25519_inv__distinct(b, a);
+
+	/* Compute a = y^2-1 */
+	f25519_sub(a, c, f25519_one);
+
+	/* Compute c = a*b = (y^2-1)/(1-dy^2) */
+	f25519_mul__distinct(c, a, b);
+
+	/* Compute a, b = +/-sqrt(c), if c is square */
+	f25519_sqrt(a, c);
+	f25519_neg(b, a);
+
+	/* Select one of them, based on the compressed parity bit */
+	f25519_select(x, a, b, (a[0] ^ parity) & 1);
+
+	/* Verify that x^2 = c */
+	f25519_mul__distinct(a, x, x);
+	f25519_normalize(a);
+	f25519_normalize(c);
+
+	return f25519_eq(a, c);
+}
+
+/* k = 2d */
+static const uint8_t ed25519_k[F25519_SIZE] = {
+	0x59, 0xf1, 0xb2, 0x26, 0x94, 0x9b, 0xd6, 0xeb,
+	0x56, 0xb1, 0x83, 0x82, 0x9a, 0x14, 0xe0, 0x00,
+	0x30, 0xd1, 0xf3, 0xee, 0xf2, 0x80, 0x8e, 0x19,
+	0xe7, 0xfc, 0xdf, 0x56, 0xdc, 0xd9, 0x06, 0x24
+};
+
+void ed25519_add(struct ed25519_pt *r,
+		 const struct ed25519_pt *p1, const struct ed25519_pt *p2)
+{
+	/* Explicit formulas database: add-2008-hwcd-3
+	 *
+	 * source 2008 Hisil--Wong--Carter--Dawson,
+	 *     http://eprint.iacr.org/2008/522, Section 3.1
+	 * appliesto extended-1
+	 * parameter k
+	 * assume k = 2 d
+	 * compute A = (Y1-X1)(Y2-X2)
+	 * compute B = (Y1+X1)(Y2+X2)
+	 * compute C = T1 k T2
+	 * compute D = Z1 2 Z2
+	 * compute E = B - A
+	 * compute F = D - C
+	 * compute G = D + C
+	 * compute H = B + A
+	 * compute X3 = E F
+	 * compute Y3 = G H
+	 * compute T3 = E H
+	 * compute Z3 = F G
+	 */
+	uint8_t a[F25519_SIZE];
+	uint8_t b[F25519_SIZE];
+	uint8_t c[F25519_SIZE];
+	uint8_t d[F25519_SIZE];
+	uint8_t e[F25519_SIZE];
+	uint8_t f[F25519_SIZE];
+	uint8_t g[F25519_SIZE];
+	uint8_t h[F25519_SIZE];
+
+	/* A = (Y1-X1)(Y2-X2) */
+	f25519_sub(c, p1->y, p1->x);
+	f25519_sub(d, p2->y, p2->x);
+	f25519_mul__distinct(a, c, d);
+
+	/* B = (Y1+X1)(Y2+X2) */
+	f25519_add(c, p1->y, p1->x);
+	f25519_add(d, p2->y, p2->x);
+	f25519_mul__distinct(b, c, d);
+
+	/* C = T1 k T2 */
+	f25519_mul__distinct(d, p1->t, p2->t);
+	f25519_mul__distinct(c, d, ed25519_k);
+
+	/* D = Z1 2 Z2 */
+	f25519_mul__distinct(d, p1->z, p2->z);
+	f25519_add(d, d, d);
+
+	/* E = B - A */
+	f25519_sub(e, b, a);
+
+	/* F = D - C */
+	f25519_sub(f, d, c);
+
+	/* G = D + C */
+	f25519_add(g, d, c);
+
+	/* H = B + A */
+	f25519_add(h, b, a);
+
+	/* X3 = E F */
+	f25519_mul__distinct(r->x, e, f);
+
+	/* Y3 = G H */
+	f25519_mul__distinct(r->y, g, h);
+
+	/* T3 = E H */
+	f25519_mul__distinct(r->t, e, h);
+
+	/* Z3 = F G */
+	f25519_mul__distinct(r->z, f, g);
+}
+
+void ed25519_double(struct ed25519_pt *r, const struct ed25519_pt *p)
+{
+	/* Explicit formulas database: dbl-2008-hwcd
+	 *
+	 * source 2008 Hisil--Wong--Carter--Dawson,
+	 *     http://eprint.iacr.org/2008/522, Section 3.3
+	 * compute A = X1^2
+	 * compute B = Y1^2
+	 * compute C = 2 Z1^2
+	 * compute D = a A
+	 * compute E = (X1+Y1)^2-A-B
+	 * compute G = D + B
+	 * compute F = G - C
+	 * compute H = D - B
+	 * compute X3 = E F
+	 * compute Y3 = G H
+	 * compute T3 = E H
+	 * compute Z3 = F G
+	 */
+	uint8_t a[F25519_SIZE];
+	uint8_t b[F25519_SIZE];
+	uint8_t c[F25519_SIZE];
+	uint8_t e[F25519_SIZE];
+	uint8_t f[F25519_SIZE];
+	uint8_t g[F25519_SIZE];
+	uint8_t h[F25519_SIZE];
+
+	/* A = X1^2 */
+	f25519_mul__distinct(a, p->x, p->x);
+
+	/* B = Y1^2 */
+	f25519_mul__distinct(b, p->y, p->y);
+
+	/* C = 2 Z1^2 */
+	f25519_mul__distinct(c, p->z, p->z);
+	f25519_add(c, c, c);
+
+	/* D = a A (alter sign) */
+	/* E = (X1+Y1)^2-A-B */
+	f25519_add(f, p->x, p->y);
+	f25519_mul__distinct(e, f, f);
+	f25519_sub(e, e, a);
+	f25519_sub(e, e, b);
+
+	/* G = D + B */
+	f25519_sub(g, b, a);
+
+	/* F = G - C */
+	f25519_sub(f, g, c);
+
+	/* H = D - B */
+	f25519_neg(h, b);
+	f25519_sub(h, h, a);
+
+	/* X3 = E F */
+	f25519_mul__distinct(r->x, e, f);
+
+	/* Y3 = G H */
+	f25519_mul__distinct(r->y, g, h);
+
+	/* T3 = E H */
+	f25519_mul__distinct(r->t, e, h);
+
+	/* Z3 = F G */
+	f25519_mul__distinct(r->z, f, g);
+}
+
+void ed25519_smult(struct ed25519_pt *r_out, const struct ed25519_pt *p,
+		   const uint8_t *e)
+{
+	struct ed25519_pt r;
+	int i;
+
+	ed25519_copy(&r, &ed25519_neutral);
+
+	for (i = 255; i >= 0; i--) {
+		const uint8_t bit = (e[i >> 3] >> (i & 7)) & 1;
+		struct ed25519_pt s;
+
+		ed25519_double(&r, &r);
+		ed25519_add(&s, &r, p);
+
+		f25519_select(r.x, r.x, s.x, bit);
+		f25519_select(r.y, r.y, s.y, bit);
+		f25519_select(r.z, r.z, s.z, bit);
+		f25519_select(r.t, r.t, s.t, bit);
+	}
+
+	ed25519_copy(r_out, &r);
+}
+#endif