void ed_mul_monty(ed_t r, const ed_t p, const bn_t k) {
ed_t t[2];
ed_null(t[0]);
ed_null(t[1]);
if (bn_is_zero(k) || ed_is_infty(p)) {
ed_set_infty(r);
return;
}
TRY {
ed_new(t[0]);
ed_new(t[1]);
ed_set_infty(t[0]);
ed_copy(t[1], p);
for (int i = bn_bits(k) - 1; i >= 0; i--) {
int j = bn_get_bit(k, i);
dv_swap_cond(t[0]->x, t[1]->x, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->y, t[1]->y, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->z, t[1]->z, RLC_FP_DIGS, j ^ 1);
#if ED_ADD == EXTND
dv_swap_cond(t[0]->t, t[1]->t, RLC_FP_DIGS, j ^ 1);
#endif
ed_add(t[0], t[0], t[1]);
ed_dbl(t[1], t[1]);
dv_swap_cond(t[0]->x, t[1]->x, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->y, t[1]->y, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->z, t[1]->z, RLC_FP_DIGS, j ^ 1);
#if ED_ADD == EXTND
dv_swap_cond(t[0]->t, t[1]->t, RLC_FP_DIGS, j ^ 1);
#endif
}
ed_norm(r, t[0]);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(t[1]);
ed_free(t[0]);
}
}
void ed_mul_fix_yaowi(ed_t r, const ed_t *t, const bn_t k) {
int i, j, l;
ed_t a;
uint8_t win[CEIL(FP_BITS, ED_DEPTH)];
ed_null(a);
TRY {
ed_new(a);
ed_set_infty(r);
ed_set_infty(a);
l = CEIL(FP_BITS, ED_DEPTH);
bn_rec_win(win, &l, k, ED_DEPTH);
for (j = (1 << ED_DEPTH) - 1; j >= 1; j--) {
for (i = 0; i < l; i++) {
if (win[i] == j) {
ed_add(a, a, t[i]);
}
}
ed_add(r, r, a);
}
ed_norm(r, r);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(a);
}
}
void ed_mul_dig(ed_t r, const ed_t p, dig_t k) {
int i, l;
ed_t t;
ed_null(t);
if (k == 0) {
ed_set_infty(r);
return;
}
TRY {
ed_new(t);
l = util_bits_dig(k);
ed_copy(t, p);
for (i = l - 2; i >= 0; i--) {
ed_dbl(t, t);
if (k & ((dig_t)1 << i)) {
ed_add(t, t, p);
}
}
ed_norm(r, t);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(t);
}
}
void ed_mul_gen(ed_t r, const bn_t k) {
if (bn_is_zero(k)) {
ed_set_infty(r);
return;
}
#ifdef ED_PRECO
ed_mul_fix(r, ed_curve_get_tab(), k);
#else
ed_t g;
ed_null(g);
TRY {
ed_new(g);
ed_curve_get_gen(g);
ed_mul(r, g, k);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(g);
}
#endif
}
void ed_mul_basic(ed_t r, const ed_t p, const bn_t k) {
ed_t t;
ed_null(t);
if (bn_is_zero(k) || ed_is_infty(p)) {
ed_set_infty(r);
return;
}
TRY {
ed_new(t);
ed_copy(t, p);
for (int i = bn_bits(k) - 2; i >= 0; i--) {
ed_dbl(t, t);
if (bn_get_bit(k, i)) {
ed_add(t, t, p);
}
}
ed_norm(r, t);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(t);
}
}
void ed_mul_fix_nafwi(ed_t r, const ed_t *t, const bn_t k) {
int i, j, l, d, m;
ed_t a;
int8_t naf[FP_BITS + 1];
char w;
ed_null(a);
TRY {
ed_new(a);
ed_set_infty(r);
ed_set_infty(a);
l = FP_BITS + 1;
bn_rec_naf(naf, &l, k, 2);
d = ((l % ED_DEPTH) == 0 ? (l / ED_DEPTH) : (l / ED_DEPTH) + 1);
for (i = 0; i < d; i++) {
w = 0;
for (j = ED_DEPTH - 1; j >= 0; j--) {
if (i * ED_DEPTH + j < l) {
w = (char)(w << 1);
w = (char)(w + naf[i * ED_DEPTH + j]);
}
}
naf[i] = w;
}
if (ED_DEPTH % 2 == 0) {
m = ((1 << (ED_DEPTH + 1)) - 2) / 3;
} else {
m = ((1 << (ED_DEPTH + 1)) - 1) / 3;
}
for (j = m; j >= 1; j--) {
for (i = 0; i < d; i++) {
if (naf[i] == j) {
ed_add(a, a, t[i]);
}
if (naf[i] == -j) {
ed_sub(a, a, t[i]);
}
}
ed_add(r, r, a);
}
ed_norm(r, r);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(a);
}
}
static void ed_mul_reg_imp(ed_t r, const ed_t p, const bn_t k) {
int l, i, j, n;
int8_t reg[RLC_CEIL(RLC_FP_BITS + 1, ED_WIDTH - 1)], *_k;
ed_t t[1 << (ED_WIDTH - 2)];
TRY {
/* Prepare the precomputation table. */
for (i = 0; i < (1 << (ED_WIDTH - 2)); i++) {
ed_null(t[i]);
ed_new(t[i]);
}
/* Compute the precomputation table. */
ed_tab(t, p, ED_WIDTH);
/* Compute the w-NAF representation of k. */
l = RLC_CEIL(RLC_FP_BITS + 1, ED_WIDTH - 1);
bn_rec_reg(reg, &l, k, RLC_FP_BITS, ED_WIDTH);
_k = reg + l - 1;
ed_set_infty(r);
for (i = l - 1; i >= 0; i--, _k--) {
for (j = 0; j < ED_WIDTH - 1; j++) {
r->norm = 2;
ed_dbl(r, r);
}
n = *_k;
if (n > 0) {
ed_add(r, r, t[n / 2]);
}
if (n < 0) {
ed_sub(r, r, t[-n / 2]);
}
}
/* Convert r to affine coordinates. */
ed_norm(r, r);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
/* Free the precomputation table. */
for (i = 0; i < (1 << (ED_WIDTH - 2)); i++) {
ed_free(t[i]);
}
}
}
int ed_is_valid(const ed_t p) {
ed_t t;
#if ED_ADD == EXTND
fp_t x_times_y;
#endif
int r = 0;
ed_null(t);
#if ED_ADD == EXTND
fp_null(x_times_y);
#endif
if (fp_is_zero(p->z)) {
r = 0;
} else {
TRY {
#if ED_ADD == EXTND
fp_new(x_times_y);
#endif
ed_new(t);
ed_norm(t, p);
// check t coordinate
#if ED_ADD == PROJC
r = ed_affine_is_valid(t->x, t->y);
#elif ED_ADD == EXTND
fp_mul(x_times_y, t->x, t->y);
if (fp_cmp(x_times_y, t->t) != CMP_EQ) {
r = 0;
} else {
r = ed_affine_is_valid(t->x, t->y);
}
#endif
// if (r == 0) {
// util_printf("\n\n(X, Y, T, Z) = \n");
// ed_print(p);
// }
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
#if ED_ADD == EXTND
fp_free(x_times_y);
#endif
ed_free(t);
}
}
return r;
}
void ed_write_bin(uint8_t *bin, int len, const ed_t a, int pack) {
ed_t t;
ed_null(t);
if (ed_is_infty(a)) {
if (len != 1) {
THROW(ERR_NO_BUFFER);
} else {
bin[0] = 0;
return;
}
}
TRY {
ed_new(t);
ed_norm(t, a);
if (pack) {
if (len != FP_BYTES + 1) {
THROW(ERR_NO_BUFFER);
} else {
ed_pck(t, t);
bin[0] = 2 | fp_get_bit(t->x, 0);
fp_write_bin(bin + 1, FP_BYTES, t->y);
}
} else {
if (len != 2 * FP_BYTES + 1) {
THROW(ERR_NO_BUFFER);
} else {
bin[0] = 4;
fp_write_bin(bin + 1, FP_BYTES, t->y);
fp_write_bin(bin + FP_BYTES + 1, FP_BYTES, t->x);
}
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(t);
}
}
void ed_mul_fixed(ed_t r, const ed_t b, const bn_t k) {
ed_t pre[4];
int h, l;
if (bn_is_zero(k)) {
ed_set_infty(r);
return;
}
for (int n = 0; n < 4; n++) {
ed_null(pre[n]);
ed_new(pre[n]);
}
// precomputation
ed_set_infty(pre[0]);
ed_copy(pre[1], b);
ed_dbl(pre[2], b);
ed_add(pre[3], pre[2], pre[1]);
l = bn_bits(k);
h = bn_get_bit(k, l - 1 + (l % 2)) * 2 + bn_get_bit(k, l - 2 + (l % 2));
ed_copy(r, pre[h]);
for (int i = ((l - 1) / 2) * 2; i > 1; i -= 2) {
int index = (i - 2) / (sizeof(dig_t) * 8);
int shift = (i - 2) % (sizeof(dig_t) * 8);
int bits = (k->dp[index] >> shift) & 3;
r->norm = 2;
ed_dbl(r, r);
ed_dbl(r, r);
ed_add(r, r, pre[bits]);
}
ed_norm(r, r);
for (int n = 0; n < 4; n++) {
ed_free(pre[n]);
}
}
/**
* Multiplies a prime elliptic curve point by an integer using the COMBS
* method.
*
* @param[out] r - the result.
* @param[in] t - the precomputed table.
* @param[in] k - the integer.
*/
static void ed_mul_combs_endom(ed_t r, const ed_t *t, const bn_t k) {
int i, j, l, w0, w1, n0, n1, p0, p1, s0, s1;
bn_t n, k0, k1, v1[3], v2[3];
ed_t u;
bn_null(n);
bn_null(k0);
bn_null(k1);
ed_null(u);
TRY {
bn_new(n);
bn_new(k0);
bn_new(k1);
ed_new(u);
for (i = 0; i < 3; i++) {
bn_null(v1[i]);
bn_null(v2[i]);
bn_new(v1[i]);
bn_new(v2[i]);
}
ed_curve_get_ord(n);
ed_curve_get_v1(v1);
ed_curve_get_v2(v2);
l = bn_bits(n);
l = ((l % (2 * ED_DEPTH)) ==
0 ? (l / (2 * ED_DEPTH)) : (l / (2 * ED_DEPTH)) + 1);
bn_rec_glv(k0, k1, k, n, (const bn_t *)v1, (const bn_t *)v2);
s0 = bn_sign(k0);
s1 = bn_sign(k1);
bn_abs(k0, k0);
bn_abs(k1, k1);
n0 = bn_bits(k0);
n1 = bn_bits(k1);
p0 = (ED_DEPTH) * l - 1;
ed_set_infty(r);
for (i = l - 1; i >= 0; i--) {
ed_dbl(r, r);
w0 = 0;
w1 = 0;
p1 = p0--;
for (j = ED_DEPTH - 1; j >= 0; j--, p1 -= l) {
w0 = w0 << 1;
w1 = w1 << 1;
if (p1 < n0 && bn_get_bit(k0, p1)) {
w0 = w0 | 1;
}
if (p1 < n1 && bn_get_bit(k1, p1)) {
w1 = w1 | 1;
}
}
if (w0 > 0) {
if (s0 == BN_POS) {
ed_add(r, r, t[w0]);
} else {
ed_sub(r, r, t[w0]);
}
}
if (w1 > 0) {
ed_copy(u, t[w1]);
fp_mul(u->x, u->x, ed_curve_get_beta());
if (s1 == BN_NEG) {
ed_neg(u, u);
}
ed_add(r, r, u);
}
}
ed_norm(r, r);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(n);
bn_free(k0);
bn_free(k1);
ed_free(u);
for (i = 0; i < 3; i++) {
bn_free(v1[i]);
bn_free(v2[i]);
}
}
}
static void ed_mul_naf_imp(ed_t r, const ed_t p, const bn_t k) {
int l, i, n;
int8_t naf[RLC_FP_BITS + 1];
ed_t t[1 << (ED_WIDTH - 2)];
if (bn_is_zero(k)) {
ed_set_infty(r);
return;
}
TRY {
/* Prepare the precomputation table. */
for (i = 0; i < (1 << (ED_WIDTH - 2)); i++) {
ed_null(t[i]);
ed_new(t[i]);
}
/* Compute the precomputation table. */
ed_tab(t, p, ED_WIDTH);
/* Compute the w-NAF representation of k. */
l = sizeof(naf);
bn_rec_naf(naf, &l, k, EP_WIDTH);
ed_set_infty(r);
for (i = l - 1; i > 0; i--) {
n = naf[i];
if (n == 0) {
/* This point will be doubled in the previous iteration. */
r->norm = 2;
ed_dbl(r, r);
} else {
ed_dbl(r, r);
if (n > 0) {
ed_add(r, r, t[n / 2]);
} else if (n < 0) {
ed_sub(r, r, t[-n / 2]);
}
}
}
/* Last iteration. */
n = naf[0];
ed_dbl(r, r);
if (n > 0) {
ed_add(r, r, t[n / 2]);
} else if (n < 0) {
ed_sub(r, r, t[-n / 2]);
}
/* Convert r to affine coordinates. */
ed_norm(r, r);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
/* Free the precomputation table. */
for (i = 0; i < (1 << (ED_WIDTH - 2)); i++) {
ed_free(t[i]);
}
}
}
void ed_mul_slide(ed_t r, const ed_t p, const bn_t k) {
ed_t t[1 << (EP_WIDTH - 1)], q;
int i, j, l;
uint8_t win[RLC_FP_BITS + 1];
ed_null(q);
if (bn_is_zero(k) || ed_is_infty(p)) {
ed_set_infty(r);
return;
}
TRY {
for (i = 0; i < (1 << (EP_WIDTH - 1)); i ++) {
ed_null(t[i]);
ed_new(t[i]);
}
ed_new(q);
ed_copy(t[0], p);
ed_dbl(q, p);
#if defined(EP_MIXED)
ed_norm(q, q);
#endif
/* Create table. */
for (i = 1; i < (1 << (EP_WIDTH - 1)); i++) {
ed_add(t[i], t[i - 1], q);
}
#if defined(EP_MIXED)
ed_norm_sim(t + 1, (const ed_t *)t + 1, (1 << (EP_WIDTH - 1)) - 1);
#endif
ed_set_infty(q);
l = RLC_FP_BITS + 1;
bn_rec_slw(win, &l, k, EP_WIDTH);
for (i = 0; i < l; i++) {
if (win[i] == 0) {
ed_dbl(q, q);
} else {
for (j = 0; j < util_bits_dig(win[i]); j++) {
ed_dbl(q, q);
}
ed_add(q, q, t[win[i] >> 1]);
}
}
ed_norm(r, q);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
for (i = 0; i < (1 << (EP_WIDTH - 1)); i++) {
ed_free(t[i]);
}
ed_free(q);
}
}