Go to the documentation of this file.
32 #define TRACE_LEVEL CRYPTO_TRACE_LEVEL
41 #if (X25519_SUPPORT == ENABLED || ED25519_SUPPORT == ENABLED)
44 static const int32_t CURVE25519_SQRT_MINUS_1[9] =
46 0x0A0EA0B0, 0x0770D93A, 0x0BF91E31, 0x06300D5A, 0x1D7A72F4,
47 0x004C9EFD, 0x1C2CAD34, 0x1009F83B, 0x002B8324
65 for(i = 1; i < 9; i++)
81 #if (CURVE25519_SPEED_OPTIMIZATION_LEVEL <= 1)
86 for(temp = 0, i = 0; i < 8; i++)
89 r[i] = temp & 0x1FFFFFFF;
94 r[8] = temp & 0x007FFFFF;
104 r[0] = temp & 0x1FFFFFFF;
107 r[1] = temp & 0x1FFFFFFF;
110 r[2] = temp & 0x1FFFFFFF;
113 r[3] = temp & 0x1FFFFFFF;
116 r[4] = temp & 0x1FFFFFFF;
119 r[5] = temp & 0x1FFFFFFF;
122 r[6] = temp & 0x1FFFFFFF;
125 r[7] = temp & 0x1FFFFFFF;
128 r[8] = temp & 0x007FFFFF;
150 for(temp =
b, i = 0; i < 8; i++)
153 r[i] = temp & 0x1FFFFFFF;
158 r[8] = temp & 0x007FFFFF;
175 #if (CURVE25519_SPEED_OPTIMIZATION_LEVEL <= 1)
180 for(temp = 0, i = 0; i < 8; i++)
183 r[i] = temp & 0x1FFFFFFF;
188 r[8] = temp & 0x007FFFFF;
198 r[0] = temp & 0x1FFFFFFF;
201 r[1] = temp & 0x1FFFFFFF;
204 r[2] = temp & 0x1FFFFFFF;
207 r[3] = temp & 0x1FFFFFFF;
210 r[4] = temp & 0x1FFFFFFF;
213 r[5] = temp & 0x1FFFFFFF;
216 r[6] = temp & 0x1FFFFFFF;
219 r[7] = temp & 0x1FFFFFFF;
222 r[8] = temp & 0x007FFFFF;
244 for(temp = -
b, i = 0; i < 8; i++)
247 r[i] = temp & 0x1FFFFFFF;
252 r[8] = temp & 0x007FFFFF;
269 #if (CURVE25519_SPEED_OPTIMIZATION_LEVEL == 0)
276 for(temp = 0, i = 0; i < 18; i++)
282 for(j = 0; j <= i; j++)
284 temp += (int64_t)
a[j] *
b[i - j];
290 for(j = i - 8; j < 9; j++)
292 temp += (int64_t)
a[j] *
b[i - j];
297 u[i] = temp & 0x1FFFFFFF;
303 for(temp = 0, i = 0; i < 8; i++)
306 temp += (int64_t)
u[i + 9] * 1216;
307 r[i] = temp & 0x1FFFFFFF;
312 temp += (int64_t)
u[17] * 1216;
313 r[8] = temp & 0x007FFFFF;
319 r[0] = temp & 0x1FFFFFFF;
321 r[1] += temp & 0xFFFFFFFF;
327 temp = (int64_t)
a[0] *
b[0];
328 u[0] = temp & 0x1FFFFFFF;
330 temp += (int64_t)
a[0] *
b[1];
331 temp += (int64_t)
a[1] *
b[0];
332 u[1] = temp & 0x1FFFFFFF;
334 temp += (int64_t)
a[0] *
b[2];
335 temp += (int64_t)
a[1] *
b[1];
336 temp += (int64_t)
a[2] *
b[0];
337 u[2] = temp & 0x1FFFFFFF;
339 temp += (int64_t)
a[0] *
b[3];
340 temp += (int64_t)
a[1] *
b[2];
341 temp += (int64_t)
a[2] *
b[1];
342 temp += (int64_t)
a[3] *
b[0];
343 u[3] = temp & 0x1FFFFFFF;
345 temp += (int64_t)
a[0] *
b[4];
346 temp += (int64_t)
a[1] *
b[3];
347 temp += (int64_t)
a[2] *
b[2];
348 temp += (int64_t)
a[3] *
b[1];
349 temp += (int64_t)
a[4] *
b[0];
350 u[4] = temp & 0x1FFFFFFF;
352 temp += (int64_t)
a[0] *
b[5];
353 temp += (int64_t)
a[1] *
b[4];
354 temp += (int64_t)
a[2] *
b[3];
355 temp += (int64_t)
a[3] *
b[2];
356 temp += (int64_t)
a[4] *
b[1];
357 temp += (int64_t)
a[5] *
b[0];
358 u[5] = temp & 0x1FFFFFFF;
360 temp += (int64_t)
a[0] *
b[6];
361 temp += (int64_t)
a[1] *
b[5];
362 temp += (int64_t)
a[2] *
b[4];
363 temp += (int64_t)
a[3] *
b[3];
364 temp += (int64_t)
a[4] *
b[2];
365 temp += (int64_t)
a[5] *
b[1];
366 temp += (int64_t)
a[6] *
b[0];
367 u[6] = temp & 0x1FFFFFFF;
369 temp += (int64_t)
a[0] *
b[7];
370 temp += (int64_t)
a[1] *
b[6];
371 temp += (int64_t)
a[2] *
b[5];
372 temp += (int64_t)
a[3] *
b[4];
373 temp += (int64_t)
a[4] *
b[3];
374 temp += (int64_t)
a[5] *
b[2];
375 temp += (int64_t)
a[6] *
b[1];
376 temp += (int64_t)
a[7] *
b[0];
377 u[7] = temp & 0x1FFFFFFF;
379 temp += (int64_t)
a[0] *
b[8];
380 temp += (int64_t)
a[1] *
b[7];
381 temp += (int64_t)
a[2] *
b[6];
382 temp += (int64_t)
a[3] *
b[5];
383 temp += (int64_t)
a[4] *
b[4];
384 temp += (int64_t)
a[5] *
b[3];
385 temp += (int64_t)
a[6] *
b[2];
386 temp += (int64_t)
a[7] *
b[1];
387 temp += (int64_t)
a[8] *
b[0];
388 u[8] = temp & 0x1FFFFFFF;
390 temp += (int64_t)
a[1] *
b[8];
391 temp += (int64_t)
a[2] *
b[7];
392 temp += (int64_t)
a[3] *
b[6];
393 temp += (int64_t)
a[4] *
b[5];
394 temp += (int64_t)
a[5] *
b[4];
395 temp += (int64_t)
a[6] *
b[3];
396 temp += (int64_t)
a[7] *
b[2];
397 temp += (int64_t)
a[8] *
b[1];
398 u[9] = temp & 0x1FFFFFFF;
400 temp += (int64_t)
a[2] *
b[8];
401 temp += (int64_t)
a[3] *
b[7];
402 temp += (int64_t)
a[4] *
b[6];
403 temp += (int64_t)
a[5] *
b[5];
404 temp += (int64_t)
a[6] *
b[4];
405 temp += (int64_t)
a[7] *
b[3];
406 temp += (int64_t)
a[8] *
b[2];
407 u[10] = temp & 0x1FFFFFFF;
409 temp += (int64_t)
a[3] *
b[8];
410 temp += (int64_t)
a[4] *
b[7];
411 temp += (int64_t)
a[5] *
b[6];
412 temp += (int64_t)
a[6] *
b[5];
413 temp += (int64_t)
a[7] *
b[4];
414 temp += (int64_t)
a[8] *
b[3];
415 u[11] = temp & 0x1FFFFFFF;
417 temp += (int64_t)
a[4] *
b[8];
418 temp += (int64_t)
a[5] *
b[7];
419 temp += (int64_t)
a[6] *
b[6];
420 temp += (int64_t)
a[7] *
b[5];
421 temp += (int64_t)
a[8] *
b[4];
422 u[12] = temp & 0x1FFFFFFF;
424 temp += (int64_t)
a[5] *
b[8];
425 temp += (int64_t)
a[6] *
b[7];
426 temp += (int64_t)
a[7] *
b[6];
427 temp += (int64_t)
a[8] *
b[5];
428 u[13] = temp & 0x1FFFFFFF;
430 temp += (int64_t)
a[6] *
b[8];
431 temp += (int64_t)
a[7] *
b[7];
432 temp += (int64_t)
a[8] *
b[6];
433 u[14] = temp & 0x1FFFFFFF;
435 temp += (int64_t)
a[7] *
b[8];
436 temp += (int64_t)
a[8] *
b[7];
437 u[15] = temp & 0x1FFFFFFF;
439 temp += (int64_t)
a[8] *
b[8];
440 u[16] = temp & 0x1FFFFFFF;
442 u[17] = temp & 0xFFFFFFFF;
446 temp += (int64_t)
u[9] * 1216;
447 r[0] = temp & 0x1FFFFFFF;
450 temp += (int64_t)
u[10] * 1216;
451 r[1] = temp & 0x1FFFFFFF;
454 temp += (int64_t)
u[11] * 1216;
455 r[2] = temp & 0x1FFFFFFF;
458 temp += (int64_t)
u[12] * 1216;
459 r[3] = temp & 0x1FFFFFFF;
462 temp += (int64_t)
u[13] * 1216;
463 r[4] = temp & 0x1FFFFFFF;
466 temp += (int64_t)
u[14] * 1216;
467 r[5] = temp & 0x1FFFFFFF;
470 temp += (int64_t)
u[15] * 1216;
471 r[6] = temp & 0x1FFFFFFF;
474 temp += (int64_t)
u[16] * 1216;
475 r[7] = temp & 0x1FFFFFFF;
478 temp += (int64_t)
u[17] * 1216;
479 r[8] = temp & 0x007FFFFF;
485 r[0] = temp & 0x1FFFFFFF;
487 r[1] += temp & 0xFFFFFFFF;
501 #if (CURVE25519_SPEED_OPTIMIZATION_LEVEL == 0)
506 for(temp = 0, i = 0; i < 8; i++)
508 temp += (int64_t)
a[i] *
b;
509 r[i] = temp & 0x1FFFFFFF;
513 temp += (int64_t)
a[8] *
b;
514 r[8] = temp & 0x007FFFFF;
520 r[0] = temp & 0x1FFFFFFF;
522 r[1] += temp & 0xFFFFFFFF;
527 temp = (int64_t)
a[0] *
b;
528 r[0] = temp & 0x1FFFFFFF;
530 temp += (int64_t)
a[1] *
b;
531 r[1] = temp & 0x1FFFFFFF;
533 temp += (int64_t)
a[2] *
b;
534 r[2] = temp & 0x1FFFFFFF;
536 temp += (int64_t)
a[3] *
b;
537 r[3] = temp & 0x1FFFFFFF;
539 temp += (int64_t)
a[4] *
b;
540 r[4] = temp & 0x1FFFFFFF;
542 temp += (int64_t)
a[5] *
b;
543 r[5] = temp & 0x1FFFFFFF;
545 temp += (int64_t)
a[6] *
b;
546 r[6] = temp & 0x1FFFFFFF;
548 temp += (int64_t)
a[7] *
b;
549 r[7] = temp & 0x1FFFFFFF;
551 temp += (int64_t)
a[8] *
b;
552 r[8] = temp & 0x007FFFFF;
558 r[0] = temp & 0x1FFFFFFF;
560 r[1] += temp & 0xFFFFFFFF;
593 for(i = 1; i <
n; i++)
756 for(temp = 0, i = 0; i < 8; i++)
759 r[i] = temp & 0x1FFFFFFF;
764 r[8] = temp & 0x007FFFFF;
768 for(temp *= 19, i = 0; i < 9; i++)
771 r[i] = temp & 0x1FFFFFFF;
776 for(temp = 19, i = 0; i < 9; i++)
779 b[i] = temp & 0x1FFFFFFF;
803 for(i = 0; i < 9; i++)
827 for(i = 0; i < 9; i++)
830 dummy =
mask & (
a[i] ^
b[i]);
855 for(i = 0; i < 9; i++)
879 for(i = 0; i < 9; i++)
886 return ((uint32_t) (
mask | (~
mask + 1))) >> 31;
902 for(
a[0] = 0, i = 0; i < 8; i++)
905 a[i] |= (temp << (i * 3)) & 0x1FFFFFFF;
906 a[i + 1] = temp >> (29 - i * 3);
923 for(i = 0; i < 8; i++)
925 temp = (
a[i + 1] << (29 - i * 3)) | (
a[i] >> (i * 3));
void curve25519Add(int32_t *r, const int32_t *a, const int32_t *b)
Modular addition.
void curve25519Canonicalize(int32_t *r, const int32_t *a)
Reduce non-canonical value.
void curve25519Export(int32_t *a, uint8_t *data)
Export an octet string.
void curve25519Select(int32_t *r, const int32_t *a, const int32_t *b, uint32_t c)
Select an integer.
uint32_t curve25519Sqrt(int32_t *r, const int32_t *a, const int32_t *b)
Compute the square root of (A / B) modulo p.
uint32_t curve25519Comp(const int32_t *a, const int32_t *b)
Compare integers.
General definitions for cryptographic algorithms.
__weak_func void curve25519Sqr(int32_t *r, const int32_t *a)
Modular squaring.
void curve25519Copy(int32_t *a, const int32_t *b)
Copy an integer.
void curve25519Swap(int32_t *a, int32_t *b, uint32_t c)
Conditional swap.
void curve25519SetInt(int32_t *a, int32_t b)
Set integer value.
void curve25519Inv(int32_t *r, const int32_t *a)
Modular multiplicative inverse.
void curve25519Sub(int32_t *r, const int32_t *a, const int32_t *b)
Modular subtraction.
Curve25519 elliptic curve (constant-time implementation)
void curve25519MulInt(int32_t *r, const int32_t *a, int32_t b)
Modular multiplication.
void curve25519AddInt(int32_t *r, const int32_t *a, int32_t b)
Modular addition.
void curve25519Import(int32_t *a, const uint8_t *data)
Import an octet string.
void curve25519Pwr2(int32_t *r, const int32_t *a, uint_t n)
Raise an integer to power 2^n.
__weak_func void curve25519Mul(int32_t *r, const int32_t *a, const int32_t *b)
Modular multiplication.
ECC (Elliptic Curve Cryptography)
void curve25519SubInt(int32_t *r, const int32_t *a, int32_t b)
Modular subtraction.