void fp_invn_low(dig_t *c, const dig_t *a) {
mp_size_t cn;
align dig_t s[FP_DIGS], t[2 * FP_DIGS], u[FP_DIGS + 1];
#if FP_RDC == MONTY
dv_zero(t + FP_DIGS, FP_DIGS);
dv_copy(t, a, FP_DIGS);
fp_rdcn_low(u, t);
#else
fp_copy(u, a);
#endif
dv_copy(s, fp_prime_get(), FP_DIGS);
mpn_gcdext(t, c, &cn, u, FP_DIGS, s, FP_DIGS);
if (cn < 0) {
dv_zero(c - cn, FP_DIGS + cn);
mpn_sub_n(c, fp_prime_get(), c, FP_DIGS);
} else {
dv_zero(c + cn, FP_DIGS - cn);
}
#if FP_RDC == MONTY
dv_zero(t, FP_DIGS);
dv_copy(t + FP_DIGS, c, FP_DIGS);
mpn_tdiv_qr(u, c, 0, t, 2 * FP_DIGS, fp_prime_get(), FP_DIGS);
#endif
}
/**
* Multiplies two binary field elements using shift-and-add multiplication.
*
* @param c - the result.
* @param a - the first binary field element.
* @param b - the second binary field element.
* @param size - the number of digits to multiply.
*/
static void fb_mul_basic_imp(dig_t *c, const dig_t *a, const dig_t *b, int size) {
int i;
dv_t s;
dv_null(s);
TRY {
/* We need a temporary variable so that c can be a or b. */
dv_new(s);
dv_zero(s, 2 * FB_DIGS);
dv_copy(s, b, size);
dv_zero(c, 2 * size);
if (a[0] & 1) {
dv_copy(c, b, size);
}
for (i = 1; i <= (FB_DIGIT * size) - 1; i++) {
fb_lsh1_low(s, s);
fb_rdc(s, s);
if (fb_get_bit(a, i)) {
fb_add(c, c, s);
}
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
dv_free(s);
}
}
void fp_rdc_basic(fp_t c, dv_t a) {
dv_t t0, t1, t2, t3;
dv_null(t0);
dv_null(t1);
dv_null(t2);
dv_null(t3);
TRY {
dv_new(t0);
dv_new(t1);
dv_new(t2);
dv_new(t3);
dv_copy(t2, a, 2 * FP_DIGS);
dv_copy(t3, fp_prime_get(), FP_DIGS);
bn_divn_low(t0, t1, t2, 2 * FP_DIGS, t3, FP_DIGS);
fp_copy(c, t1);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
dv_free(t0);
dv_free(t1);
dv_free(t2);
dv_free(t3);
}
}
void fp12_mul_lazyr(fp12_t c, fp12_t a, fp12_t b) {
dv6_t u0, u1, u2, u3;
fp6_t t0, t1;
dv6_null(u0);
dv6_null(u1);
dv6_null(u2);
dv6_null(u3);
fp6_null(t0);
fp6_null(t0);
fp6_null(t1);
TRY {
dv6_new(u0);
dv6_new(u1);
dv6_new(u2);
dv6_new(u3);
fp6_new(t0);
fp6_new(t1);
/* Karatsuba algorithm. */
/* u0 = a_0 * b_0. */
fp6_mul_unr(u0, a[0], b[0]);
/* u1 = a_1 * b_1. */
fp6_mul_unr(u1, a[1], b[1]);
/* t1 = a_0 + a_1. */
fp6_add(t0, a[0], a[1]);
/* t0 = b_0 + b_1. */
fp6_add(t1, b[0], b[1]);
/* u2 = (a_0 + a_1) * (b_0 + b_1) */
fp6_mul_unr(u2, t0, t1);
/* c_1 = u2 - a_0b_0 - a_1b_1. */
for (int i = 0; i < 3; i++) {
fp2_addc_low(u3[i], u0[i], u1[i]);
fp2_subc_low(u2[i], u2[i], u3[i]);
fp2_rdcn_low(c[1][i], u2[i]);
}
/* c_0 = a_0b_0 + v * a_1b_1. */
fp2_nord_low(u2[0], u1[2]);
dv_copy(u2[1][0], u1[0][0], 2 * RLC_FP_DIGS);
dv_copy(u2[1][1], u1[0][1], 2 * RLC_FP_DIGS);
dv_copy(u2[2][0], u1[1][0], 2 * RLC_FP_DIGS);
dv_copy(u2[2][1], u1[1][1], 2 * RLC_FP_DIGS);
for (int i = 0; i < 3; i++) {
fp2_addc_low(u2[i], u0[i], u2[i]);
fp2_rdcn_low(c[0][i], u2[i]);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
dv6_free(u0);
dv6_free(u1);
dv6_free(u2);
dv6_free(u3);
fp6_free(t0);
fp6_free(t1);
}
}
void fp2_nord_low(dv2_t c, dv2_t a) {
dv2_t t;
bn_t b;
dv2_null(t);
bn_null(b);
TRY {
dv2_new(t);
bn_new(b);
#ifdef FP_QNRES
/* If p = 3 mod 8, (1 + i) is a QNR/CNR. */
/* (a_0 + a_1 * i) * (1 + i) = (a_0 - a_1) + (a_0 + a_1) * u. */
dv_copy(t[0], a[1], 2 * FP_DIGS);
fp_addc_low(c[1], a[0], a[1]);
fp_subc_low(c[0], a[0], t[0]);
#else
switch (fp_prime_get_mod8()) {
case 3:
/* If p = 3 mod 8, (1 + u) is a QNR, u^2 = -1. */
/* (a_0 + a_1 * u) * (1 + u) = (a_0 - a_1) + (a_0 + a_1) * u. */
dv_copy(t[0], a[1], 2 * FP_DIGS);
fp_addc_low(c[1], a[0], a[1]);
fp_subc_low(c[0], a[0], t[0]);
break;
case 1:
case 5:
/* If p = 1,5 mod 8, (u) is a QNR. */
dv_copy(t[0], a[0], 2 * FP_DIGS);
dv_zero(t[1], FP_DIGS);
dv_copy(t[1] + FP_DIGS, fp_prime_get(), FP_DIGS);
fp_subc_low(c[0], t[1], a[1]);
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_subc_low(c[0], c[0], a[1]);
}
dv_copy(c[1], t[0], 2 * FP_DIGS);
break;
case 7:
/* If p = 7 mod 8, (2 + u) is a QNR/CNR. */
fp2_addc_low(t, a, a);
fp_subc_low(c[0], t[0], a[1]);
fp_addc_low(c[1], t[1], a[0]);
break;
default:
THROW(ERR_NO_VALID);
break;
}
#endif
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
dv2_free(t);
bn_free(b);
}
}
void fp8_sqr_lazyr(fp8_t c, fp8_t a) {
fp4_t t;
dv4_t u0, u1, u2;
fp4_null(t);
dv4_null(u0);
dv4_null(u1);
dv4_null(u2);
TRY {
fp4_new(t);
dv4_new(u0);
dv4_new(u1);
dv4_new(u2);
/* t0 = a^2. */
fp4_sqr_unr(u0, a[0]);
/* t1 = b^2. */
fp4_sqr_unr(u1, a[1]);
fp4_add(t, a[0], a[1]);
/* c = a^2 + b^2 * E. */
dv_copy(u2[1][0], u1[0][0], 2 * RLC_FP_DIGS);
dv_copy(u2[1][1], u1[0][1], 2 * RLC_FP_DIGS);
fp2_nord_low(u2[0], u1[1]);
fp2_addc_low(u2[0], u2[0], u0[0]);
fp2_addc_low(u2[1], u2[1], u0[1]);
/* d = (a + b)^2 - a^2 - b^2 = 2 * a * b. */
fp2_addc_low(u1[0], u1[0], u0[0]);
fp2_addc_low(u1[1], u1[1], u0[1]);
fp4_sqr_unr(u0, t);
fp2_subc_low(u0[0], u0[0], u1[0]);
fp2_subc_low(u0[1], u0[1], u1[1]);
fp2_rdcn_low(c[0][0], u2[0]);
fp2_rdcn_low(c[0][1], u2[1]);
fp2_rdcn_low(c[1][0], u0[0]);
fp2_rdcn_low(c[1][1], u0[1]);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp4_free(t);
dv4_free(u0);
dv4_free(u1);
dv4_free(u2);
}
}
void fp_prime_back(bn_t c, const fp_t a) {
dv_t t;
int i;
dv_null(t);
TRY {
dv_new(t);
bn_grow(c, FP_DIGS);
for (i = 0; i < FP_DIGS; i++) {
c->dp[i] = a[i];
}
#if FP_RDC == MONTY
dv_zero(t, 2 * FP_DIGS + 1);
dv_copy(t, a, FP_DIGS);
fp_rdc(c->dp, t);
#endif
c->used = FP_DIGS;
c->sign = BN_POS;
bn_trim(c);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
dv_free(t);
}
}
int fp3_srt(fp3_t c, fp3_t a) {
int r = 0;
fp3_t t0, t1, t2, t3;
bn_t e;
fp3_null(t0);
fp3_null(t1);
fp3_null(t2);
fp3_null(t3);
bn_null(e);
TRY {
fp3_new(t0);
fp3_new(t1);
fp3_new(t2);
fp3_new(t3);
bn_new(e);
fp3_dbl(t3, a);
fp3_frb(t0, t3, 1);
fp3_sqr(t1, t0);
fp3_mul(t2, t1, t0);
fp3_mul(t1, t1, t2);
fp3_frb(t0, t0, 1);
fp3_mul(t3, t3, t1);
fp3_mul(t0, t0, t3);
e->used = FP_DIGS;
dv_copy(e->dp, fp_prime_get(), FP_DIGS);
bn_sub_dig(e, e, 5);
bn_div_dig(e, e, 8);
fp3_exp(t0, t0, e);
fp3_mul(t0, t0, t2);
fp3_sqr(t1, t0);
fp3_mul(t1, t1, a);
fp3_dbl(t1, t1);
fp3_mul(t0, t0, a);
fp_sub_dig(t1[0], t1[0], 1);
fp3_mul(c, t0, t1);
fp3_sqr(t0, c);
if (fp3_cmp(t0, a) == CMP_EQ) {
r = 1;
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp3_free(t0);
fp3_free(t1);
fp3_free(t2);
fp3_free(t3);
bn_free(e);
}
return r;
}
void pp_exp_k2(fp2_t c, fp2_t a) {
bn_t e, n;
bn_null(n);
bn_null(e);
TRY {
bn_new(n);
bn_new(e);
ep_curve_get_ord(n);
fp2_conv_uni(c, a);
dv_copy(e->dp, fp_prime_get(), FP_DIGS);
e->used = FP_DIGS;
e->sign = BN_POS;
bn_add_dig(e, e, 1);
bn_div(e, e, n);
fp2_exp_uni(c, c, e);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
bn_free(n);
bn_free(e);
}
}
void fp_prime_conv_dig(fp_t c, dig_t a) {
dv_t t;
ctx_t *ctx = core_get();
bn_null(t);
TRY {
dv_new(t);
#if FP_RDC == MONTY
if (a != 1) {
dv_zero(t, 2 * FP_DIGS + 1);
t[FP_DIGS] = fp_mul1_low(t, ctx->conv.dp, a);
fp_rdc(c, t);
} else {
dv_copy(c, ctx->one.dp, FP_DIGS);
}
#else
(void)ctx;
fp_zero(c);
c[0] = a;
#endif
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
dv_free(t);
}
}
void fp_hlvm_low(dig_t *c, const dig_t *a) {
dig_t carry = 0;
if (a[0] & 1) {
carry = fp_addn_low(c, a, fp_prime_get());
} else {
dv_copy(c, a, FP_DIGS);
}
fp_rsh1_low(c, c);
if (carry) {
c[FP_DIGS - 1] ^= ((dig_t)1 << (FP_DIGIT - 1));
}
}
void fp_invn_low(dig_t *c, const dig_t *a) {
bn_st e;
bn_init(&e, RLC_FP_DIGS);
e.used = RLC_FP_DIGS;
dv_copy(e.dp, fp_prime_get(), RLC_FP_DIGS);
bn_sub1_low(e.dp, e.dp, 2, RLC_FP_DIGS);
#if AUTO == ALLOC
fp_exp(c, a, &e);
#else
fp_exp(c, (const fp_t)a, &e);
#endif
bn_clean(&e);
}
void fp_prime_conv(fp_t c, const bn_t a) {
bn_t t;
bn_null(t);
TRY {
bn_new(t);
#if FP_RDC == MONTY
bn_mod(t, a, &(core_get()->prime));
bn_lsh(t, t, FP_DIGS * FP_DIGIT);
bn_mod(t, t, &(core_get()->prime));
dv_copy(c, t->dp, FP_DIGS);
#else
if (a->used > FP_DIGS) {
THROW(ERR_NO_PRECI);
}
bn_mod(t, a, &(core_get()->prime));
if (bn_is_zero(t)) {
fp_zero(c);
} else {
int i;
for (i = 0; i < t->used; i++) {
c[i] = t->dp[i];
}
for (; i < FP_DIGS; i++) {
c[i] = 0;
}
}
(void)t;
#endif
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(t);
}
}
void fp_copy(fp_t c, const fp_t a) {
dv_copy(c, a, RLC_FP_DIGS);
}
void fp_rdcs_low(dig_t *c, dig_t *a, dig_t *m) {
align dig_t q[2 * FP_DIGS], _q[2 * FP_DIGS];
align dig_t _r[2 * FP_DIGS], r[2 * FP_DIGS], t[2 * FP_DIGS];
int *sform, len;
int first, i, j, b0, d0, b1, d1;
dig_t carry;
sform = fp_prime_get_sps(&len);
SPLIT(b0, d0, FP_BITS, FP_DIG_LOG);
first = (d0) + (b0 == 0 ? 0 : 1);
/* q = floor(a/b^k) */
dv_zero(q, 2 * FP_DIGS);
bn_rshd_low(q, a, 2 * FP_DIGS, d0);
if (b0 > 0) {
bn_rshb_low(q, q, 2 * FP_DIGS, b0);
}
/* r = a - qb^k. */
dv_copy(r, a, first);
if (b0 > 0) {
r[first - 1] &= MASK(b0);
}
carry = 0;
while (!fp_is_zero(q)) {
dv_zero(_q, 2 * FP_DIGS);
for (i = len - 1; i > 0; i--) {
j = (sform[i] < 0 ? -sform[i] : sform[i]);
SPLIT(b1, d1, j, FP_DIG_LOG);
dv_zero(t, 2 * FP_DIGS);
bn_lshd_low(t, q, FP_DIGS, d1);
if (b1 > 0) {
bn_lshb_low(t, t, 2 * FP_DIGS, b1);
}
if (sform[i] > 0) {
bn_subn_low(_q, _q, t, 2 * FP_DIGS);
} else {
bn_addn_low(_q, _q, t, 2 * FP_DIGS);
}
}
if (sform[0] > 0) {
bn_subn_low(_q, _q, q, 2 * FP_DIGS);
} else {
bn_addn_low(_q, _q, q, 2 * FP_DIGS);
}
bn_rshd_low(q, _q, 2 * FP_DIGS, d0);
if (b0 > 0) {
bn_rshb_low(q, q, 2 * FP_DIGS, b0);
}
dv_copy(_r, _q, first);
if (b0 > 0) {
_r[first - 1] &= MASK(b0);
}
fp_add(r, r, _r);
}
while (fp_cmpn_low(r, m) != CMP_LT) {
fp_subn_low(r, r, m);
}
fp_copy(c, r);
}
int fp_srt(fp_t c, const fp_t a) {
bn_t e;
fp_t t0;
fp_t t1;
int r = 0;
bn_null(e);
fp_null(t0);
fp_null(t1);
TRY {
bn_new(e);
fp_new(t0);
fp_new(t1);
/* Make e = p. */
e->used = FP_DIGS;
dv_copy(e->dp, fp_prime_get(), FP_DIGS);
if (fp_prime_get_mod8() == 3 || fp_prime_get_mod8() == 7) {
/* Easy case, compute a^((p + 1)/4). */
bn_add_dig(e, e, 1);
bn_rsh(e, e, 2);
fp_exp(t0, a, e);
fp_sqr(t1, t0);
r = (fp_cmp(t1, a) == CMP_EQ);
fp_copy(c, t0);
} else {
int f = 0, m = 0;
/* First, check if there is a root. Compute t1 = a^((p - 1)/2). */
bn_rsh(e, e, 1);
fp_exp(t0, a, e);
if (fp_cmp_dig(t0, 1) != CMP_EQ) {
/* Nope, there is no square root. */
r = 0;
} else {
r = 1;
/* Find a quadratic non-residue modulo p, that is a number t2
* such that (t2 | p) = t2^((p - 1)/2)!= 1. */
do {
fp_rand(t1);
fp_exp(t0, t1, e);
} while (fp_cmp_dig(t0, 1) == CMP_EQ);
/* Write p - 1 as (e * 2^f), odd e. */
bn_lsh(e, e, 1);
while (bn_is_even(e)) {
bn_rsh(e, e, 1);
f++;
}
/* Compute t2 = t2^e. */
fp_exp(t1, t1, e);
/* Compute t1 = a^e, c = a^((e + 1)/2) = a^(e/2 + 1), odd e. */
bn_rsh(e, e, 1);
fp_exp(t0, a, e);
fp_mul(e->dp, t0, a);
fp_sqr(t0, t0);
fp_mul(t0, t0, a);
fp_copy(c, e->dp);
while (1) {
if (fp_cmp_dig(t0, 1) == CMP_EQ) {
break;
}
fp_copy(e->dp, t0);
for (m = 0; (m < f) && (fp_cmp_dig(t0, 1) != CMP_EQ); m++) {
fp_sqr(t0, t0);
}
fp_copy(t0, e->dp);
for (int i = 0; i < f - m - 1; i++) {
fp_sqr(t1, t1);
}
fp_mul(c, c, t1);
fp_sqr(t1, t1);
fp_mul(t0, t0, t1);
f = m;
}
}
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(e);
fp_free(t0);
fp_free(t1);
}
return r;
}
void fp2_nord_low(dv2_t c, dv2_t a) {
dv2_t t;
bn_t b;
dv2_null(t);
bn_null(b);
TRY {
dv2_new(t);
bn_new(b);
#if FP_PRIME == 158
fp_addc_low(t[0], a[0], a[0]);
fp_addc_low(t[0], t[0], t[0]);
fp_subc_low(t[0], t[0], a[1]);
fp_addc_low(t[1], a[1], a[1]);
fp_addc_low(t[1], t[1], t[1]);
fp_addc_low(c[1], a[0], t[1]);
dv_copy(c[0], t[0], 2 * FP_DIGS);
#elif defined(FP_QNRES)
/* If p = 3 mod 8, (1 + i) is a QNR/CNR. */
/* (a_0 + a_1 * i) * (1 + i) = (a_0 - a_1) + (a_0 + a_1) * u. */
dv_copy(t[0], a[1], 2 * FP_DIGS);
fp_addc_low(c[1], a[0], a[1]);
fp_subc_low(c[0], a[0], t[0]);
#else
switch (fp_prime_get_mod8()) {
case 3:
/* If p = 3 mod 8, (1 + u) is a QNR, u^2 = -1. */
/* (a_0 + a_1 * u) * (1 + u) = (a_0 - a_1) + (a_0 + a_1) * u. */
dv_copy(t[0], a[1], 2 * FP_DIGS);
fp_addc_low(c[1], a[0], a[1]);
fp_subc_low(c[0], a[0], t[0]);
break;
case 5:
/* If p = 5 mod 8, (u) is a QNR. */
dv_copy(t[0], a[0], 2 * FP_DIGS);
dv_zero(t[1], FP_DIGS);
dv_copy(t[1] + FP_DIGS, fp_prime_get(), FP_DIGS);
fp_subc_low(c[0], t[1], a[1]);
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_subc_low(c[0], c[0], a[1]);
}
dv_copy(c[1], t[0], 2 * FP_DIGS);
break;
case 7:
/* If p = 7 mod 8, (2^lg_4(b-1) + u) is a QNR/CNR. */
/* (a_0 + a_1 * u)(2^lg_4(b-1) + u) =
* (2^lg_4(b-1)a_0 - a_1) + (a_0 + 2^lg_4(b-1)a_1 * u. */
fp2_addc_low(t, a, a);
fp_prime_back(b, ep_curve_get_b());
for (int i = 1; i < bn_bits(b) / 2; i++) {
fp2_addc_low(t, t, t);
}
fp_subc_low(c[0], t[0], a[1]);
fp_addc_low(c[1], t[1], a[0]);
break;
default:
THROW(ERR_NO_VALID);
break;
}
#endif
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
dv2_free(t);
bn_free(b);
}
}
void fb_invn_low(dig_t *c, const dig_t *a) {
int j, d, lu, lv, lt, l1, l2, bu, bv;
align dig_t _u[2 * FB_DIGS], _v[2 * FB_DIGS];
align dig_t _g1[2 * FB_DIGS], _g2[2 * FB_DIGS];
dig_t *t = NULL, *u = NULL, *v = NULL, *g1 = NULL, *g2 = NULL, carry;
dv_zero(_g1, FB_DIGS + 1);
dv_zero(_g2, FB_DIGS + 1);
u = _u;
v = _v;
g1 = _g1;
g2 = _g2;
/* u = a, v = f, g1 = 1, g2 = 0. */
dv_copy(u, a, FB_DIGS);
dv_copy(v, fb_poly_get(), FB_DIGS);
g1[0] = 1;
lu = lv = FB_DIGS;
l1 = l2 = 1;
bu = fb_bits(u);
bv = FB_BITS + 1;
j = bu - bv;
/* While (u != 1). */
while (1) {
/* If j < 0 then swap(u, v), swap(g1, g2), j = -j. */
if (j < 0) {
t = u;
u = v;
v = t;
lt = lu;
lu = lv;
lv = lt;
t = g1;
g1 = g2;
g2 = t;
lt = l1;
l1 = l2;
l2 = lt;
j = -j;
}
SPLIT(j, d, j, FB_DIG_LOG);
/* u = u + v * z^j. */
if (j > 0) {
carry = fb_lsha_low(u + d, v, j, lv);
u[d + lv] ^= carry;
} else {
fb_addd_low(u + d, u + d, v, lv);
}
/* g1 = g1 + g2 * z^j. */
if (j > 0) {
carry = fb_lsha_low(g1 + d, g2, j, l2);
l1 = (l2 + d >= l1 ? l2 + d : l1);
if (carry) {
g1[d + l2] ^= carry;
l1 = (l2 + d >= l1 ? l1 + 1 : l1);
}
} else {
fb_addd_low(g1 + d, g1 + d, g2, l2);
l1 = (l2 + d > l1 ? l2 + d : l1);
}
while (u[lu - 1] == 0)
lu--;
while (v[lv - 1] == 0)
lv--;
if (lu == 1 && u[0] == 1)
break;
/* j = deg(u) - deg(v). */
lt = util_bits_dig(u[lu - 1]) - util_bits_dig(v[lv - 1]);
j = ((lu - lv) << FB_DIG_LOG) + lt;
}
/* Return g1. */
fb_copy(c, g1);
}
/**
* Computes the constantes required for evaluating Frobenius maps.
*/
static void fp2_calc() {
bn_t e;
fp2_t t0;
fp2_t t1;
ctx_t *ctx = core_get();
bn_null(e);
fp2_null(t0);
fp2_null(t1);
TRY {
bn_new(e);
fp2_new(t0);
fp2_new(t1);
fp2_zero(t0);
fp_set_dig(t0[0], 1);
fp2_mul_nor(t0, t0);
e->used = FP_DIGS;
dv_copy(e->dp, fp_prime_get(), FP_DIGS);
bn_sub_dig(e, e, 1);
bn_div_dig(e, e, 6);
fp2_exp(t0, t0, e);
#if ALLOC == AUTO
fp2_copy(ctx->fp2_p[0], t0);
fp2_sqr(ctx->fp2_p[1], ctx->fp2_p[0]);
fp2_mul(ctx->fp2_p[2], ctx->fp2_p[1], ctx->fp2_p[0]);
fp2_sqr(ctx->fp2_p[3], ctx->fp2_p[1]);
fp2_mul(ctx->fp2_p[4], ctx->fp2_p[3], ctx->fp2_p[0]);
#else
fp_copy(ctx->fp2_p[0][0], t0[0]);
fp_copy(ctx->fp2_p[0][1], t0[1]);
fp2_sqr(t1, t0);
fp_copy(ctx->fp2_p[1][0], t1[0]);
fp_copy(ctx->fp2_p[1][1], t1[1]);
fp2_mul(t1, t1, t0);
fp_copy(ctx->fp2_p[2][0], t1[0]);
fp_copy(ctx->fp2_p[2][1], t1[1]);
fp2_sqr(t1, t0);
fp2_sqr(t1, t1);
fp_copy(ctx->fp2_p[3][0], t1[0]);
fp_copy(ctx->fp2_p[3][1], t1[1]);
fp2_mul(t1, t1, t0);
fp_copy(ctx->fp2_p[4][0], t1[0]);
fp_copy(ctx->fp2_p[4][1], t1[1]);
#endif
fp2_frb(t1, t0, 1);
fp2_mul(t0, t1, t0);
fp_copy(ctx->fp2_p2[0], t0[0]);
fp_sqr(ctx->fp2_p2[1], ctx->fp2_p2[0]);
fp_mul(ctx->fp2_p2[2], ctx->fp2_p2[1], ctx->fp2_p2[0]);
fp_sqr(ctx->fp2_p2[3], ctx->fp2_p2[1]);
for (int i = 0; i < 5; i++) {
fp_mul(ctx->fp2_p3[i][0], ctx->fp2_p2[i % 3], ctx->fp2_p[i][0]);
fp_mul(ctx->fp2_p3[i][1], ctx->fp2_p2[i % 3], ctx->fp2_p[i][1]);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
bn_free(e);
fp2_free(t0);
fp2_free(t1);
}
}
/**
* Computes the constants required for evaluating Frobenius maps.
*/
static void fp3_calc() {
bn_t e;
fp3_t t0, t1, t2;
ctx_t *ctx = core_get();
bn_null(e);
fp3_null(t0);
fp3_null(t1);
fp3_null(t2);
TRY {
bn_new(e);
fp3_new(t0);
fp3_new(t1);
fp3_new(t2);
fp_set_dig(ctx->fp3_base[0], -fp_prime_get_cnr());
fp_neg(ctx->fp3_base[0], ctx->fp3_base[0]);
e->used = FP_DIGS;
dv_copy(e->dp, fp_prime_get(), FP_DIGS);
bn_sub_dig(e, e, 1);
bn_div_dig(e, e, 3);
fp_exp(ctx->fp3_base[0], ctx->fp3_base[0], e);
fp_sqr(ctx->fp3_base[1], ctx->fp3_base[0]);
fp3_zero(t0);
fp_set_dig(t0[1], 1);
dv_copy(e->dp, fp_prime_get(), FP_DIGS);
bn_sub_dig(e, e, 1);
bn_div_dig(e, e, 6);
/* t0 = u^((p-1)/6). */
fp3_exp(t0, t0, e);
fp_copy(ctx->fp3_p[0], t0[2]);
fp3_sqr(t1, t0);
fp_copy(ctx->fp3_p[1], t1[1]);
fp3_mul(t2, t1, t0);
fp_copy(ctx->fp3_p[2], t2[0]);
fp3_sqr(t2, t1);
fp_copy(ctx->fp3_p[3], t2[2]);
fp3_mul(t2, t2, t0);
fp_copy(ctx->fp3_p[4], t2[1]);
fp_mul(ctx->fp3_p2[0], ctx->fp3_p[0], ctx->fp3_base[1]);
fp_mul(t0[0], ctx->fp3_p2[0], ctx->fp3_p[0]);
fp_neg(ctx->fp3_p2[0], t0[0]);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(ctx->fp3_p2[0], ctx->fp3_p2[0], t0[0]);
}
fp_mul(ctx->fp3_p2[1], ctx->fp3_p[1], ctx->fp3_base[0]);
fp_mul(ctx->fp3_p2[1], ctx->fp3_p2[1], ctx->fp3_p[1]);
fp_sqr(ctx->fp3_p2[2], ctx->fp3_p[2]);
fp_mul(ctx->fp3_p2[3], ctx->fp3_p[3], ctx->fp3_base[1]);
fp_mul(t0[0], ctx->fp3_p2[3], ctx->fp3_p[3]);
fp_neg(ctx->fp3_p2[3], t0[0]);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(ctx->fp3_p2[3], ctx->fp3_p2[3], t0[0]);
}
fp_mul(ctx->fp3_p2[4], ctx->fp3_p[4], ctx->fp3_base[0]);
fp_mul(ctx->fp3_p2[4], ctx->fp3_p2[4], ctx->fp3_p[4]);
fp_mul(ctx->fp3_p3[0], ctx->fp3_p[0], ctx->fp3_base[0]);
fp_mul(t0[0], ctx->fp3_p3[0], ctx->fp3_p2[0]);
fp_neg(ctx->fp3_p3[0], t0[0]);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(ctx->fp3_p3[0], ctx->fp3_p3[0], t0[0]);
}
fp_mul(ctx->fp3_p3[1], ctx->fp3_p[1], ctx->fp3_base[1]);
fp_mul(t0[0], ctx->fp3_p3[1], ctx->fp3_p2[1]);
fp_neg(ctx->fp3_p3[1], t0[0]);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(ctx->fp3_p3[1], ctx->fp3_p3[1], t0[0]);
}
fp_mul(ctx->fp3_p3[2], ctx->fp3_p[2], ctx->fp3_p2[2]);
fp_mul(ctx->fp3_p3[3], ctx->fp3_p[3], ctx->fp3_base[0]);
fp_mul(t0[0], ctx->fp3_p3[3], ctx->fp3_p2[3]);
fp_neg(ctx->fp3_p3[3], t0[0]);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(ctx->fp3_p3[3], ctx->fp3_p3[3], t0[0]);
}
fp_mul(ctx->fp3_p3[4], ctx->fp3_p[4], ctx->fp3_base[1]);
fp_mul(t0[0], ctx->fp3_p3[4], ctx->fp3_p2[4]);
fp_neg(ctx->fp3_p3[4], t0[0]);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_sub(ctx->fp3_p3[4], ctx->fp3_p3[4], t0[0]);
}
for (int i = 0; i < 5; i++) {
fp_mul(ctx->fp3_p4[i], ctx->fp3_p[i], ctx->fp3_p3[i]);
fp_mul(ctx->fp3_p5[i], ctx->fp3_p2[i], ctx->fp3_p3[i]);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
bn_free(e);
fp3_free(t0);
fp3_free(t1);
fp3_free(t2);
}
}
/**
* Assigns the prime field modulus.
*
* @param[in] p - the new prime field modulus.
*/
static void fp_prime_set(const bn_t p) {
dv_t s, q;
bn_t t;
ctx_t *ctx = core_get();
if (p->used != FP_DIGS) {
THROW(ERR_NO_VALID);
}
dv_null(s);
bn_null(t);
dv_null(q);
TRY {
dv_new(s);
bn_new(t);
dv_new(q);
bn_copy(&(ctx->prime), p);
bn_mod_dig(&(ctx->mod8), &(ctx->prime), 8);
switch (ctx->mod8) {
case 3:
case 7:
ctx->qnr = -1;
/* The current code for extensions of Fp^3 relies on qnr being
* also a cubic non-residue. */
ctx->cnr = 0;
break;
case 1:
case 5:
ctx->qnr = ctx->cnr = -2;
break;
default:
ctx->qnr = ctx->cnr = 0;
THROW(ERR_NO_VALID);
break;
}
#ifdef FP_QNRES
if (ctx->mod8 != 3) {
THROW(ERR_NO_VALID);
}
#endif
#if FP_RDC == MONTY || !defined(STRIP)
bn_mod_pre_monty(t, &(ctx->prime));
ctx->u = t->dp[0];
dv_zero(s, 2 * FP_DIGS);
s[2 * FP_DIGS] = 1;
dv_zero(q, 2 * FP_DIGS + 1);
dv_copy(q, ctx->prime.dp, FP_DIGS);
bn_divn_low(t->dp, ctx->conv.dp, s, 2 * FP_DIGS + 1, q, FP_DIGS);
ctx->conv.used = FP_DIGS;
bn_trim(&(ctx->conv));
bn_set_dig(&(ctx->one), 1);
bn_lsh(&(ctx->one), &(ctx->one), ctx->prime.used * BN_DIGIT);
bn_mod(&(ctx->one), &(ctx->one), &(ctx->prime));
#endif
fp_prime_calc();
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(t);
dv_free(s);
dv_free(q);
}
}
