int fp2_srt(fp2_t c, fp2_t a) {
int r = 0;
fp_t t1;
fp_t t2;
fp_t t3;
fp_null(t1);
fp_null(t2);
fp_null(t3);
TRY {
fp_new(t1);
fp_new(t2);
fp_new(t3);
/* t1 = a[0]^2 - u^2 * a[1]^2 */
fp_sqr(t1, a[0]);
fp_sqr(t2, a[1]);
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_add(t1, t1, t2);
}
for (int i = 0; i <= fp_prime_get_qnr(); i++) {
fp_sub(t1, t1, t2);
}
fp_add(t1, t1, t2);
if (fp_srt(t2, t1)) {
/* t1 = (a_0 + sqrt(t1)) / 2 */
fp_add(t1, a[0], t2);
fp_set_dig(t3, 2);
fp_inv(t3, t3);
fp_mul(t1, t1, t3);
if (!fp_srt(t3, t1)) {
/* t1 = (a_0 - sqrt(t1)) / 2 */
fp_sub(t1, a[0], t2);
fp_set_dig(t3, 2);
fp_inv(t3, t3);
fp_mul(t1, t1, t3);
fp_srt(t3, t1);
}
/* c_0 = sqrt(t1) */
fp_copy(c[0], t3);
/* c_1 = a_1 / (2 * sqrt(t1)) */
fp_dbl(t3, t3);
fp_inv(t3, t3);
fp_mul(c[1], a[1], t3);
r = 1;
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t1);
fp_free(t2);
fp_free(t3);
}
return r;
}
/**
* Normalizes a point represented in projective coordinates.
*
* @param r - the result.
* @param p - the point to normalize.
*/
static void ep_norm_imp(ep_t r, const ep_t p, int inverted) {
if (!p->norm) {
fp_t t0, t1;
fp_null(t0);
fp_null(t1);
TRY {
fp_new(t0);
fp_new(t1);
if (inverted) {
fp_copy(t1, p->z);
} else {
fp_inv(t1, p->z);
}
fp_sqr(t0, t1);
fp_mul(r->x, p->x, t0);
fp_mul(t0, t0, t1);
fp_mul(r->y, p->y, t0);
fp_set_dig(r->z, 1);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
}
}
/**
* Normalizes a point represented in projective coordinates.
*
* @param r - the result.
* @param p - the point to normalize.
*/
void ed_norm(ed_t r, const ed_t p) {
if (ed_is_infty(p)) {
ed_set_infty(r);
return;
}
if (fp_cmp_dig(p->z, 1) == CMP_EQ) {
/* If the point is represented in affine coordinates, we just copy it. */
ed_copy(r, p);
} else {
fp_t z_inv;
fp_null(z_inv);
fp_new(z_inv);
fp_inv(z_inv, p->z);
fp_mul(r->x, p->x, z_inv);
fp_mul(r->y, p->y, z_inv);
#if ED_ADD == EXTND
fp_mul(r->t, p->t, z_inv);
#endif
fp_set_dig(r->z, 1);
fp_free(z_inv);
}
}
void fp2_inv(fp2_t c, fp2_t a) {
fp_t t0, t1;
fp_null(t0);
fp_null(t1);
TRY {
fp_new(t0);
fp_new(t1);
/* t0 = a_0^2, t1 = a_1^2. */
fp_sqr(t0, a[0]);
fp_sqr(t1, a[1]);
/* t1 = 1/(a_0^2 + a_1^2). */
#ifndef FP_QNRES
if (fp_prime_get_qnr() != -1) {
if (fp_prime_get_qnr() == -2) {
fp_dbl(t1, t1);
fp_add(t0, t0, t1);
} else {
if (fp_prime_get_qnr() < 0) {
fp_mul_dig(t1, t1, -fp_prime_get_qnr());
fp_add(t0, t0, t1);
} else {
fp_mul_dig(t1, t1, fp_prime_get_qnr());
fp_sub(t0, t0, t1);
}
}
} else {
fp_add(t0, t0, t1);
}
#else
fp_add(t0, t0, t1);
#endif
fp_inv(t1, t0);
/* c_0 = a_0/(a_0^2 + a_1^2). */
fp_mul(c[0], a[0], t1);
/* c_1 = - a_1/(a_0^2 + a_1^2). */
fp_mul(c[1], a[1], t1);
fp_neg(c[1], c[1]);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
}
}
int ed_is_infty(const ed_t p) {
assert(!fp_is_zero(p->z));
int ret = 0;
fp_t norm_y;
fp_null(norm_y);
fp_new(norm_y);
fp_inv(norm_y, p->z);
fp_mul(norm_y, p->y, norm_y);
if (fp_cmp_dig(norm_y, 1) == CMP_EQ && fp_is_zero(p->x)) {
ret = 1;
}
fp_free(norm_y);
return ret;
}
void fp_exp_monty(fp_t c, const fp_t a, const bn_t b) {
fp_t t[2];
fp_null(t[0]);
fp_null(t[1]);
if (bn_is_zero(b)) {
fp_set_dig(c, 1);
return;
}
TRY {
fp_new(t[0]);
fp_new(t[1]);
fp_set_dig(t[0], 1);
fp_copy(t[1], a);
for (int i = bn_bits(b) - 1; i >= 0; i--) {
int j = bn_get_bit(b, i);
dv_swap_cond(t[0], t[1], FP_DIGS, j ^ 1);
fp_mul(t[0], t[0], t[1]);
fp_sqr(t[1], t[1]);
dv_swap_cond(t[0], t[1], FP_DIGS, j ^ 1);
}
if (bn_sign(b) == BN_NEG) {
fp_inv(c, t[0]);
} else {
fp_copy(c, t[0]);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t[1]);
fp_free(t[0]);
}
}
void fp_exp_basic(fp_t c, const fp_t a, const bn_t b) {
int i, l;
fp_t r;
fp_null(r);
if (bn_is_zero(b)) {
fp_set_dig(c, 1);
return;
}
TRY {
fp_new(r);
l = bn_bits(b);
fp_copy(r, a);
for (i = l - 2; i >= 0; i--) {
fp_sqr(r, r);
if (bn_get_bit(b, i)) {
fp_mul(r, r, a);
}
}
if (bn_sign(b) == BN_NEG) {
fp_inv(c, r);
} else {
fp_copy(c, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(r);
}
}
/**
* Doubles a point represented in affine coordinates on an ordinary prime
* elliptic curve.
*
* @param[out] r - the result.
* @param[out] s - the slope.
* @param[in] p - the point to double.
*/
static void ep_dbl_basic_imp(ep_t r, fp_t s, const ep_t p) {
fp_t t0, t1, t2;
fp_null(t0);
fp_null(t1);
fp_null(t2);
TRY {
fp_new(t0);
fp_new(t1);
fp_new(t2);
/* t0 = 1/2 * y1. */
fp_dbl(t0, p->y);
fp_inv(t0, t0);
/* t1 = 3 * x1^2 + a. */
fp_sqr(t1, p->x);
fp_copy(t2, t1);
fp_dbl(t1, t1);
fp_add(t1, t1, t2);
switch (ep_curve_opt_a()) {
case OPT_ZERO:
break;
case OPT_ONE:
fp_add_dig(t1, t1, (dig_t)1);
break;
#if FP_RDC != MONTY
case OPT_DIGIT:
fp_add_dig(t1, t1, ep_curve_get_a()[0]);
break;
#endif
default:
fp_add(t1, t1, ep_curve_get_a());
break;
}
/* t1 = (3 * x1^2 + a)/(2 * y1). */
fp_mul(t1, t1, t0);
if (s != NULL) {
fp_copy(s, t1);
}
/* t2 = t1^2. */
fp_sqr(t2, t1);
/* x3 = t1^2 - 2 * x1. */
fp_dbl(t0, p->x);
fp_sub(t0, t2, t0);
/* y3 = t1 * (x1 - x3) - y1. */
fp_sub(t2, p->x, t0);
fp_mul(t1, t1, t2);
fp_sub(r->y, t1, p->y);
fp_copy(r->x, t0);
fp_copy(r->z, p->z);
r->norm = 1;
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
fp_free(t2);
}
}
/**
* Adds two points represented in affine coordinates on an ordinary prime
* elliptic curve.
*
* @param[out] r - the result.
* @param[out] s - the slope.
* @param[in] p - the first point to add.
* @param[in] q - the second point to add.
*/
static void ep_add_basic_imp(ep_t r, fp_t s, const ep_t p, const ep_t q) {
fp_t t0, t1, t2;
fp_null(t0);
fp_null(t1);
fp_null(t2);
TRY {
fp_new(t0);
fp_new(t1);
fp_new(t2);
/* t0 = x2 - x1. */
fp_sub(t0, q->x, p->x);
/* t1 = y2 - y1. */
fp_sub(t1, q->y, p->y);
/* If t0 is zero. */
if (fp_is_zero(t0)) {
if (fp_is_zero(t1)) {
/* If t1 is zero, q = p, should have doubled. */
ep_dbl_basic(r, p);
} else {
/* If t1 is not zero and t0 is zero, q = -p and r = infinity. */
ep_set_infty(r);
}
} else {
/* t2 = 1/(x2 - x1). */
fp_inv(t2, t0);
/* t2 = lambda = (y2 - y1)/(x2 - x1). */
fp_mul(t2, t1, t2);
/* x3 = lambda^2 - x2 - x1. */
fp_sqr(t1, t2);
fp_sub(t0, t1, p->x);
fp_sub(t0, t0, q->x);
/* y3 = lambda * (x1 - x3) - y1. */
fp_sub(t1, p->x, t0);
fp_mul(t1, t2, t1);
fp_sub(r->y, t1, p->y);
fp_copy(r->x, t0);
fp_copy(r->z, p->z);
if (s != NULL) {
fp_copy(s, t2);
}
r->norm = 1;
}
fp_free(t0);
fp_free(t1);
fp_free(t2);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
fp_free(t2);
}
}
void fp_exp_slide(fp_t c, const fp_t a, const bn_t b) {
fp_t t[1 << (FP_WIDTH - 1)], r;
int i, j, l;
uint8_t win[FP_BITS + 1];
fp_null(r);
if (bn_is_zero(b)) {
fp_set_dig(c, 1);
return;
}
/* Initialize table. */
for (i = 0; i < (1 << (FP_WIDTH - 1)); i++) {
fp_null(t[i]);
}
TRY {
for (i = 0; i < (1 << (FP_WIDTH - 1)); i ++) {
fp_new(t[i]);
}
fp_new(r);
fp_copy(t[0], a);
fp_sqr(r, a);
/* Create table. */
for (i = 1; i < 1 << (FP_WIDTH - 1); i++) {
fp_mul(t[i], t[i - 1], r);
}
fp_set_dig(r, 1);
l = FP_BITS + 1;
bn_rec_slw(win, &l, b, FP_WIDTH);
for (i = 0; i < l; i++) {
if (win[i] == 0) {
fp_sqr(r, r);
} else {
for (j = 0; j < util_bits_dig(win[i]); j++) {
fp_sqr(r, r);
}
fp_mul(r, r, t[win[i] >> 1]);
}
}
if (bn_sign(b) == BN_NEG) {
fp_inv(c, r);
} else {
fp_copy(c, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
for (i = 0; i < (1 << (FP_WIDTH - 1)); i++) {
fp_free(t[i]);
}
fp_free(r);
}
}
void fp3_inv(fp3_t c, fp3_t a) {
fp_t v0;
fp_t v1;
fp_t v2;
fp_t t0;
fp_null(v0);
fp_null(v1);
fp_null(v2);
fp_null(t0);
TRY {
fp_new(v0);
fp_new(v1);
fp_new(v2);
fp_new(t0);
/* v0 = a_0^2 - B * a_1 * a_2. */
fp_sqr(t0, a[0]);
fp_mul(v0, a[1], a[2]);
fp_neg(v2, v0);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(v2, v2, v0);
}
fp_sub(v0, t0, v2);
/* v1 = B * a_2^2 - a_0 * a_1. */
fp_sqr(t0, a[2]);
fp_neg(v2, t0);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(v2, v2, t0);
}
fp_mul(v1, a[0], a[1]);
fp_sub(v1, v2, v1);
/* v2 = a_1^2 - a_0 * a_2. */
fp_sqr(t0, a[1]);
fp_mul(v2, a[0], a[2]);
fp_sub(v2, t0, v2);
fp_mul(t0, a[1], v2);
fp_neg(c[1], t0);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(c[1], c[1], t0);
}
fp_mul(c[0], a[0], v0);
fp_mul(t0, a[2], v1);
fp_neg(c[2], t0);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(c[2], c[2], t0);
}
fp_add(t0, c[0], c[1]);
fp_add(t0, t0, c[2]);
fp_inv(t0, t0);
fp_mul(c[0], v0, t0);
fp_mul(c[1], v1, t0);
fp_mul(c[2], v2, t0);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp_free(v0);
fp_free(v1);
fp_free(v2);
fp_free(t0);
}
}
