void fp3_sqrn_low(dv3_t c, fp3_t a) {
align dig_t t0[2 * FP_DIGS], t1[2 * FP_DIGS], t2[2 * FP_DIGS];
align dig_t t3[2 * FP_DIGS], t4[2 * FP_DIGS], t5[2 * FP_DIGS];
/* t0 = a_0^2. */
fp_sqrn_low(t0, a[0]);
/* t1 = 2 * a_1 * a_2. */
#ifdef FP_SPACE
fp_dbln_low(t2, a[1]);
#else
fp_dblm_low(t2, a[1]);
#endif
fp_muln_low(t1, t2, a[2]);
/* t2 = a_2^2. */
fp_sqrn_low(t2, a[2]);
/* t3 = (a_0 + a_2 + a_1)^2, t4 = (a_0 + a_2 - a_1)^2. */
#ifdef FP_SPACE
fp_addn_low(t3, a[0], a[2]);
fp_addn_low(t4, t3, a[1]);
#else
fp_addm_low(t3, a[0], a[2]);
fp_addm_low(t4, t3, a[1]);
#endif
fp_subm_low(t5, t3, a[1]);
fp_sqrn_low(t3, t4);
fp_sqrn_low(t4, t5);
/* t4 = (t4 + t3)/2. */
fp_addd_low(t4, t4, t3);
fp_hlvd_low(t4, t4);
/* t3 = t3 - t4 - t1. */
fp_addc_low(t5, t1, t4);
fp_subc_low(t3, t3, t5);
/* c_2 = t4 - t0 - t2. */
fp_addc_low(t5, t0, t2);
fp_subc_low(c[2], t4, t5);
/* c_0 = t0 + t1 * B. */
fp_subc_low(c[0], t0, t1);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_subc_low(c[0], c[0], t1);
}
/* c_1 = t3 + t2 * B. */
fp_subc_low(c[1], t3, t2);
for (int i = -1; i > fp_prime_get_cnr(); i--) {
fp_subc_low(c[1], c[1], t2);
}
}
void fp2_sqrn_low(dv2_t c, fp2_t a) {
align dig_t t0[2 * FP_DIGS], t1[2 * FP_DIGS], t2[2 * FP_DIGS];
/* t0 = (a0 + a1). */
#ifdef FP_SPACE
/* if we have room for carries, we can avoid reductions here. */
fp_addn_low(t0, a[0], a[1]);
#else
fp_addm_low(t0, a[0], a[1]);
#endif
/* t1 = (a0 - a1). */
fp_subm_low(t1, a[0], a[1]);
#ifdef FP_QNRES
#ifdef FP_SPACE
fp_dbln_low(t2, a[0]);
#else
fp_dblm_low(t2, a[0]);
#endif
/* c1 = 2 * a0 * a1. */
fp_muln_low(c[1], t2, a[1]);
/* c_0 = a_0^2 + a_1^2 * u^2. */
fp_muln_low(c[0], t0, t1);
#else /* !FP_QNRES */
/* t1 = u^2 * (a1 * b1). */
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_subm_low(t1, t1, a[1]);
}
if (fp_prime_get_qnr() == -1) {
/* t2 = 2 * a0. */
fp_dbl(t2, a[0]);
/* c1 = 2 * a0 * a1. */
fp_muln_low(c[1], t2, a[1]);
/* c0 = a0^2 + b_0^2 * u^2. */
fp_muln_low(c[0], t0, t1);
} else {
/* c1 = a0 * a1. */
fp_muln_low(c[1], a[0], a[1]);
/* c0 = a0^2 + b_0^2 * u^2. */
fp_muln_low(c[0], t0, t1);
#ifdef FP_SPACE
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_addd_low(c[0], c[0], c[1]);
}
/* c1 = 2 * a0 * a1. */
fp_addd_low(c[1], c[1], c[1]);
#else
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_addc_low(c[0], c[0], c[1]);
}
/* c1 = 2 * a0 * a1. */
fp_addc_low(c[1], c[1], c[1]);
#endif
}
#endif
/* c = c0 + c1 * u. */
}
void fp2_subm_low(fp2_t c, fp2_t a, fp2_t b) {
fp_subm_low(c[0], a[0], b[0]);
fp_subm_low(c[1], a[1], b[1]);
}
void pp_dbl_k2_projc_lazyr(fp2_t l, ep_t r, ep_t p, ep_t q) {
fp_t t0, t1, t2, t3, t4, t5;
dv_t u0, u1;
fp_null(t0);
fp_null(t1);
fp_null(t2);
fp_null(t3);
fp_null(t4);
fp_null(t5);
dv_null(u0);
dv_null(u1);
TRY {
fp_new(t0);
fp_new(t1);
fp_new(t2);
fp_new(t3);
fp_new(t4);
fp_new(t5);
dv_new(u0);
dv_new(u1);
/* For these curves, we always can choose a = -3. */
/* dbl-2001-b formulas: 3M + 5S + 8add + 1*4 + 2*8 + 1*3 */
/* http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b */
/* t0 = delta = z1^2. */
fp_sqr(t0, p->z);
/* t1 = gamma = y1^2. */
fp_sqr(t1, p->y);
/* t2 = beta = x1 * y1^2. */
fp_mul(t2, p->x, t1);
/* t3 = alpha = 3 * (x1 - z1^2) * (x1 + z1^2). */
fp_sub(t3, p->x, t0);
fp_add(t4, p->x, t0);
fp_mul(t4, t3, t4);
fp_dbl(t3, t4);
fp_add(t3, t3, t4);
/* t2 = 4 * beta. */
fp_dbl(t2, t2);
fp_dbl(t2, t2);
/* z3 = (y1 + z1)^2 - gamma - delta. */
fp_add(r->z, p->y, p->z);
fp_sqr(r->z, r->z);
fp_sub(r->z, r->z, t1);
fp_sub(r->z, r->z, t0);
/* l0 = 2 * gamma - alpha * (delta * xq + x1). */
fp_dbl(t1, t1);
fp_mul(t5, t0, q->x);
fp_add(t5, t5, p->x);
fp_mul(t5, t5, t3);
fp_sub(l[0], t1, t5);
/* x3 = alpha^2 - 8 * beta. */
fp_dbl(t5, t2);
fp_sqr(r->x, t3);
fp_sub(r->x, r->x, t5);
/* y3 = alpha * (4 * beta - x3) - 8 * gamma^2. */
fp_sqrn_low(u0, t1);
fp_addc_low(u0, u0, u0);
fp_subm_low(r->y, t2, r->x);
fp_muln_low(u1, r->y, t3);
fp_subc_low(u1, u1, u0);
fp_rdcn_low(r->y, u1);
/* l1 = - z3 * delta * yq. */
fp_mul(l[1], r->z, t0);
fp_mul(l[1], l[1], q->y);
r->norm = 0;
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
fp_free(t2);
fp_free(t3);
fp_free(t4);
fp_free(t5);
dv_free(u0);
dv_free(u1);
}
}
void fp3_subm_low(fp3_t c, fp3_t a, fp3_t b) {
fp_subm_low(c[0], a[0], b[0]);
fp_subm_low(c[1], a[1], b[1]);
fp_subm_low(c[2], a[2], b[2]);
}
