void fp2_norm_low(fp2_t c, fp2_t a) { fp2_t t; bn_t b; fp2_null(t); bn_null(b); TRY { fp2_new(t); bn_new(b); #if FP_PRIME == 158 fp_dbl(t[0], a[0]); fp_dbl(t[0], t[0]); fp_sub(t[0], t[0], a[1]); fp_dbl(t[1], a[1]); fp_dbl(t[1], t[1]); fp_add(c[1], a[0], t[1]); fp_copy(c[0], t[0]); #elif defined(FP_QNRES) /* If p = 3 mod 8, (1 + i) is a QNR/CNR. */ fp_neg(t[0], a[1]); fp_add(c[1], a[0], a[1]); fp_add(c[0], t[0], a[0]); #else switch (fp_prime_get_mod8()) { case 3: /* If p = 3 mod 8, (1 + u) is a QNR/CNR. */ fp_neg(t[0], a[1]); fp_add(c[1], a[0], a[1]); fp_add(c[0], t[0], a[0]); break; case 5: /* If p = 5 mod 8, (u) is a QNR/CNR. */ fp2_mul_art(c, a); break; case 7: /* If p = 7 mod 8, we choose (2^(lg_4(b-1)) + u) as QNR/CNR. */ fp2_mul_art(t, a); fp2_dbl(c, a); fp_prime_back(b, ep_curve_get_b()); for (int i = 1; i < bn_bits(b) / 2; i++) { fp2_dbl(c, c); } fp2_add(c, c, t); break; default: THROW(ERR_NO_VALID); break; } #endif } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp2_free(t); bn_free(b); } }
void fp2_sqr_basic(fp2_t c, fp2_t a) { fp_t t0, t1, t2; fp_null(t0); fp_null(t1); fp_null(t2); TRY { fp_new(t0); fp_new(t1); fp_new(t2); /* t0 = (a_0 + a_1). */ fp_add(t0, a[0], a[1]); /* t1 = (a_0 - a_1). */ fp_sub(t1, a[0], a[1]); /* t1 = a_0 + u^2 * a_1. */ for (int i = -1; i > fp_prime_get_qnr(); i--) { fp_sub(t1, t1, a[1]); } for (int i = 0; i <= fp_prime_get_qnr(); i++) { fp_add(t1, t1, a[1]); } if (fp_prime_get_qnr() == -1) { /* t2 = 2 * a_0. */ fp_dbl(t2, a[0]); /* c_1 = 2 * a_0 * a_1. */ fp_mul(c[1], t2, a[1]); /* c_0 = a_0^2 + a_1^2 * u^2. */ fp_mul(c[0], t0, t1); } else { /* c_1 = a_0 * a_1. */ fp_mul(c[1], a[0], a[1]); /* c_0 = a_0^2 + a_1^2 * u^2. */ fp_mul(c[0], t0, t1); for (int i = -1; i > fp_prime_get_qnr(); i--) { fp_add(c[0], c[0], c[1]); } for (int i = 0; i <= fp_prime_get_qnr(); i++) { fp_sub(c[0], c[0], c[1]); } /* c_1 = 2 * a_0 * a_1. */ fp_dbl(c[1], c[1]); } /* c = c_0 + c_1 * u. */ } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); fp_free(t2); } }
int fp2_srt(fp2_t c, fp2_t a) { int r = 0; fp_t t1; fp_t t2; fp_t t3; fp_null(t1); fp_null(t2); fp_null(t3); TRY { fp_new(t1); fp_new(t2); fp_new(t3); /* t1 = a[0]^2 - u^2 * a[1]^2 */ fp_sqr(t1, a[0]); fp_sqr(t2, a[1]); for (int i = -1; i > fp_prime_get_qnr(); i--) { fp_add(t1, t1, t2); } for (int i = 0; i <= fp_prime_get_qnr(); i++) { fp_sub(t1, t1, t2); } fp_add(t1, t1, t2); if (fp_srt(t2, t1)) { /* t1 = (a_0 + sqrt(t1)) / 2 */ fp_add(t1, a[0], t2); fp_set_dig(t3, 2); fp_inv(t3, t3); fp_mul(t1, t1, t3); if (!fp_srt(t3, t1)) { /* t1 = (a_0 - sqrt(t1)) / 2 */ fp_sub(t1, a[0], t2); fp_set_dig(t3, 2); fp_inv(t3, t3); fp_mul(t1, t1, t3); fp_srt(t3, t1); } /* c_0 = sqrt(t1) */ fp_copy(c[0], t3); /* c_1 = a_1 / (2 * sqrt(t1)) */ fp_dbl(t3, t3); fp_inv(t3, t3); fp_mul(c[1], a[1], t3); r = 1; } } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t1); fp_free(t2); fp_free(t3); } return r; }
void fp2_inv(fp2_t c, fp2_t a) { fp_t t0, t1; fp_null(t0); fp_null(t1); TRY { fp_new(t0); fp_new(t1); /* t0 = a_0^2, t1 = a_1^2. */ fp_sqr(t0, a[0]); fp_sqr(t1, a[1]); /* t1 = 1/(a_0^2 + a_1^2). */ #ifndef FP_QNRES if (fp_prime_get_qnr() != -1) { if (fp_prime_get_qnr() == -2) { fp_dbl(t1, t1); fp_add(t0, t0, t1); } else { if (fp_prime_get_qnr() < 0) { fp_mul_dig(t1, t1, -fp_prime_get_qnr()); fp_add(t0, t0, t1); } else { fp_mul_dig(t1, t1, fp_prime_get_qnr()); fp_sub(t0, t0, t1); } } } else { fp_add(t0, t0, t1); } #else fp_add(t0, t0, t1); #endif fp_inv(t1, t0); /* c_0 = a_0/(a_0^2 + a_1^2). */ fp_mul(c[0], a[0], t1); /* c_1 = - a_1/(a_0^2 + a_1^2). */ fp_mul(c[1], a[1], t1); fp_neg(c[1], c[1]); } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); } }
void fp3_mul_art(fp3_t c, fp3_t a) { fp_t t; fp_null(t); TRY { fp_new(t); /* (a_0 + a_1 * u + a_1 * u^2) * u = a_0 * u + a_1 * u^2 + a_1 * u^3. */ fp_copy(t, a[0]); fp_dbl(c[0], a[2]); fp_neg(c[0], c[0]); fp_copy(c[2], a[1]); fp_copy(c[1], t); } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t); } }
void fp2_dblm_low(fp2_t c, fp2_t a) { /* 2 * (a0 + a1 * u) = 2 * a0 + 2 * a1 * u. */ fp_dbl(c[0], a[0]); fp_dbl(c[1], a[1]); }
void fp3_sqr_basic(fp3_t c, fp3_t a) { dv_t t0, t1, t2, t3, t4, t5; dv_null(t0); dv_null(t1); dv_null(t2); dv_null(t3); dv_null(t4); dv_null(t5); TRY { dv_new(t0); dv_new(t1); dv_new(t2); dv_new(t3); dv_new(t4); dv_new(t5); /* t0 = a_0^2. */ fp_sqrn_low(t0, a[0]); /* t1 = 2 * a_1 * a_2. */ fp_dbl(t2, a[1]); fp_muln_low(t1, t2, a[2]); /* t2 = a_2^2. */ fp_sqrn_low(t2, a[2]); /* t3 = (a_0 + a_2 + a_1)^2, t4 = (a_0 + a_2 - a_1)^2. */ fp_add(t3, a[0], a[2]); fp_add(t4, t3, a[1]); fp_sub(t5, t3, a[1]); fp_sqrn_low(t3, t4); fp_sqrn_low(t4, t5); /* t4 = (t4 + t3)/2. */ fp_addd_low(t4, t4, t3); fp_hlvd_low(t4, t4); /* t3 = t3 - t4 - t1. */ fp_addc_low(t5, t1, t4); fp_subc_low(t3, t3, t5); /* c_2 = t4 - t0 - t2. */ fp_addc_low(t5, t0, t2); fp_subc_low(t4, t4, t5); fp_rdc(c[2], t4); /* c_0 = t0 + t1 * B. */ fp_subc_low(t0, t0, t1); for (int i = -1; i > fp_prime_get_cnr(); i--) { fp_subc_low(t0, t0, t1); } fp_rdc(c[0], t0); /* c_1 = t3 + t2 * B. */ fp_subc_low(t3, t3, t2); for (int i = -1; i > fp_prime_get_cnr(); i--) { fp_subc_low(t3, t3, t2); } fp_rdc(c[1], t3); } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { dv_free(t0); dv_free(t1); dv_free(t2); dv_free(t3); dv_free(t4); dv_free(t5); } }
void fp3_dbl_basic(fp2_t c, fp2_t a) { /* 2 * (a_0 + a_1 * u) = 2 * a_0 + 2 * a_1 * u. */ fp_dbl(c[0], a[0]); fp_dbl(c[1], a[1]); fp_dbl(c[2], a[2]); }
/** * Doubles a point represented in affine coordinates on an ordinary prime * elliptic curve. * * @param[out] r - the result. * @param[out] s - the slope. * @param[in] p - the point to double. */ static void ep_dbl_basic_imp(ep_t r, fp_t s, const ep_t p) { fp_t t0, t1, t2; fp_null(t0); fp_null(t1); fp_null(t2); TRY { fp_new(t0); fp_new(t1); fp_new(t2); /* t0 = 1/2 * y1. */ fp_dbl(t0, p->y); fp_inv(t0, t0); /* t1 = 3 * x1^2 + a. */ fp_sqr(t1, p->x); fp_copy(t2, t1); fp_dbl(t1, t1); fp_add(t1, t1, t2); switch (ep_curve_opt_a()) { case OPT_ZERO: break; case OPT_ONE: fp_add_dig(t1, t1, (dig_t)1); break; #if FP_RDC != MONTY case OPT_DIGIT: fp_add_dig(t1, t1, ep_curve_get_a()[0]); break; #endif default: fp_add(t1, t1, ep_curve_get_a()); break; } /* t1 = (3 * x1^2 + a)/(2 * y1). */ fp_mul(t1, t1, t0); if (s != NULL) { fp_copy(s, t1); } /* t2 = t1^2. */ fp_sqr(t2, t1); /* x3 = t1^2 - 2 * x1. */ fp_dbl(t0, p->x); fp_sub(t0, t2, t0); /* y3 = t1 * (x1 - x3) - y1. */ fp_sub(t2, p->x, t0); fp_mul(t1, t1, t2); fp_sub(r->y, t1, p->y); fp_copy(r->x, t0); fp_copy(r->z, p->z); r->norm = 1; } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); fp_free(t2); } }
/** * Doubles a point represented in projective coordinates on an ordinary prime * elliptic curve. * * @param r - the result. * @param p - the point to double. */ static void ep_dbl_projc_imp(ep_t r, const ep_t p) { fp_t t0, t1, t2, t3, t4, t5; fp_null(t1); fp_null(t2); fp_null(t3); fp_null(t4); fp_null(t5); TRY { fp_new(t0); fp_new(t1); fp_new(t2); fp_new(t3); fp_new(t4); fp_new(t5); if (!p->norm && ep_curve_opt_a() == OPT_MINUS3) { /* dbl-2001-b formulas: 3M + 5S + 8add + 1*4 + 2*8 + 1*3 */ /* http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b */ /* t0 = delta = z1^2. */ fp_sqr(t0, p->z); /* t1 = gamma = y1^2. */ fp_sqr(t1, p->y); /* t2 = beta = x1 * y1^2. */ fp_mul(t2, p->x, t1); /* t3 = alpha = 3 * (x1 - z1^2) * (x1 + z1^2). */ fp_sub(t3, p->x, t0); fp_add(t4, p->x, t0); fp_mul(t4, t3, t4); fp_dbl(t3, t4); fp_add(t3, t3, t4); /* x3 = alpha^2 - 8 * beta. */ fp_dbl(t2, t2); fp_dbl(t2, t2); fp_dbl(t5, t2); fp_sqr(r->x, t3); fp_sub(r->x, r->x, t5); /* z3 = (y1 + z1)^2 - gamma - delta. */ fp_add(r->z, p->y, p->z); fp_sqr(r->z, r->z); fp_sub(r->z, r->z, t1); fp_sub(r->z, r->z, t0); /* y3 = alpha * (4 * beta - x3) - 8 * gamma^2. */ fp_dbl(t1, t1); fp_sqr(t1, t1); fp_dbl(t1, t1); fp_sub(r->y, t2, r->x); fp_mul(r->y, r->y, t3); fp_sub(r->y, r->y, t1); } else if (ep_curve_opt_a() == OPT_ZERO) { /* dbl-2009-l formulas: 2M + 5S + 6add + 1*8 + 3*2 + 1*3. */ /* http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l */ /* A = X1^2 */ fp_sqr(t0, p->x); /* B = Y1^2 */ fp_sqr(t1, p->y); /* C = B^2 */ fp_sqr(t2, t1); /* D = 2*((X1+B)^2-A-C) */ fp_add(t1, t1, p->x); fp_sqr(t1, t1); fp_sub(t1, t1, t0); fp_sub(t1, t1, t2); fp_dbl(t1, t1); /* E = 3*A */ fp_dbl(t3, t0); fp_add(t0, t3, t0); /* F = E^2 */ fp_sqr(t3, t0); /* Z3 = 2*Y1*Z1 */ fp_mul(r->z, p->y, p->z); fp_dbl(r->z, r->z); /* X3 = F-2*D */ fp_sub(r->x, t3, t1); fp_sub(r->x, r->x, t1); /* Y3 = E*(D-X3)-8*C */ fp_sub(r->y, t1, r->x); fp_mul(r->y, r->y, t0); fp_dbl(t2, t2); fp_dbl(t2, t2); fp_dbl(t2, t2); fp_sub(r->y, r->y, t2); } else { /* dbl-2007-bl formulas: 1M + 8S + 1*a + 10add + 1*8 + 2*2 + 1*3 */ /* http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-2007-bl */ /* t0 = x1^2, t1 = y1^2, t2 = y1^4. */ fp_sqr(t0, p->x); fp_sqr(t1, p->y); fp_sqr(t2, t1); if (!p->norm) { /* t3 = z1^2. */ fp_sqr(t3, p->z); if (ep_curve_get_a() == OPT_ZERO) { /* z3 = 2 * y1 * z1. */ fp_mul(r->z, p->y, p->z); fp_dbl(r->z, r->z); } else { /* z3 = (y1 + z1)^2 - y1^2 - z1^2. */ fp_add(r->z, p->y, p->z); fp_sqr(r->z, r->z); fp_sub(r->z, r->z, t1); fp_sub(r->z, r->z, t3); } } else { /* z3 = 2 * y1. */ fp_dbl(r->z, p->y); } /* t4 = S = 2*((x1 + y1^2)^2 - x1^2 - y1^4). */ fp_add(t4, p->x, t1); fp_sqr(t4, t4); fp_sub(t4, t4, t0); fp_sub(t4, t4, t2); fp_dbl(t4, t4); /* t5 = M = 3 * x1^2 + a * z1^4. */ fp_dbl(t5, t0); fp_add(t5, t5, t0); if (!p->norm) { fp_sqr(t3, t3); switch (ep_curve_opt_a()) { case OPT_ZERO: break; case OPT_ONE: fp_add(t5, t5, ep_curve_get_a()); break; case OPT_DIGIT: fp_mul_dig(t1, t3, ep_curve_get_a()[0]); fp_add(t5, t5, t1); break; default: fp_mul(t1, ep_curve_get_a(), t3); fp_add(t5, t5, t1); break; } } else { switch (ep_curve_opt_a()) { case OPT_ZERO: break; case OPT_ONE: fp_add_dig(t5, t5, (dig_t)1); break; case OPT_DIGIT: fp_add_dig(t5, t5, ep_curve_get_a()[0]); break; default: fp_add(t5, t5, ep_curve_get_a()); break; } } /* x3 = T = M^2 - 2 * S. */ fp_sqr(r->x, t5); fp_dbl(t1, t4); fp_sub(r->x, r->x, t1); /* y3 = M * (S - T) - 8 * y1^4. */ fp_dbl(t2, t2); fp_dbl(t2, t2); fp_dbl(t2, t2); fp_sub(t4, t4, r->x); fp_mul(t5, t5, t4); fp_sub(r->y, t5, t2); } r->norm = 0; } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); fp_free(t2); fp_free(t3); fp_free(t4); fp_free(t5); } }
void fp2_sqrn_low(dv2_t c, fp2_t a) { align dig_t t0[2 * FP_DIGS], t1[2 * FP_DIGS], t2[2 * FP_DIGS]; /* t0 = (a0 + a1). */ #ifdef FP_SPACE /* if we have room for carries, we can avoid reductions here. */ fp_addn_low(t0, a[0], a[1]); #else fp_addm_low(t0, a[0], a[1]); #endif /* t1 = (a0 - a1). */ fp_subm_low(t1, a[0], a[1]); #ifdef FP_QNRES #ifdef FP_SPACE fp_dbln_low(t2, a[0]); #else fp_dblm_low(t2, a[0]); #endif /* c1 = 2 * a0 * a1. */ fp_muln_low(c[1], t2, a[1]); /* c_0 = a_0^2 + a_1^2 * u^2. */ fp_muln_low(c[0], t0, t1); #else /* !FP_QNRES */ /* t1 = u^2 * (a1 * b1). */ for (int i = -1; i > fp_prime_get_qnr(); i--) { fp_subm_low(t1, t1, a[1]); } if (fp_prime_get_qnr() == -1) { /* t2 = 2 * a0. */ fp_dbl(t2, a[0]); /* c1 = 2 * a0 * a1. */ fp_muln_low(c[1], t2, a[1]); /* c0 = a0^2 + b_0^2 * u^2. */ fp_muln_low(c[0], t0, t1); } else { /* c1 = a0 * a1. */ fp_muln_low(c[1], a[0], a[1]); /* c0 = a0^2 + b_0^2 * u^2. */ fp_muln_low(c[0], t0, t1); #ifdef FP_SPACE for (int i = -1; i > fp_prime_get_qnr(); i--) { fp_addd_low(c[0], c[0], c[1]); } /* c1 = 2 * a0 * a1. */ fp_addd_low(c[1], c[1], c[1]); #else for (int i = -1; i > fp_prime_get_qnr(); i--) { fp_addc_low(c[0], c[0], c[1]); } /* c1 = 2 * a0 * a1. */ fp_addc_low(c[1], c[1], c[1]); #endif } #endif /* c = c0 + c1 * u. */ }
void pp_dbl_lit_k12(fp12_t l, ep_t r, ep_t p, ep2_t q) { fp_t t0, t1, t2, t3, t4, t5, t6; int one = 1, zero = 0; fp_null(t0); fp_null(t1); fp_null(t2); fp_null(t3); fp_null(t4); fp_null(t5); fp_null(t6); TRY { fp_new(t0); fp_new(t1); fp_new(t2); fp_new(t3); fp_new(t4); fp_new(t5); fp_new(t6); fp_sqr(t0, p->x); fp_sqr(t1, p->y); fp_sqr(t2, p->z); fp_mul(t4, ep_curve_get_b(), t2); fp_dbl(t3, t4); fp_add(t3, t3, t4); fp_add(t4, p->x, p->y); fp_sqr(t4, t4); fp_sub(t4, t4, t0); fp_sub(t4, t4, t1); fp_add(t5, p->y, p->z); fp_sqr(t5, t5); fp_sub(t5, t5, t1); fp_sub(t5, t5, t2); fp_dbl(t6, t3); fp_add(t6, t6, t3); fp_sub(r->x, t1, t6); fp_mul(r->x, r->x, t4); fp_add(r->y, t1, t6); fp_sqr(r->y, r->y); fp_sqr(t4, t3); fp_dbl(t6, t4); fp_add(t6, t6, t4); fp_dbl(t6, t6); fp_dbl(t6, t6); fp_sub(r->y, r->y, t6); fp_mul(r->z, t1, t5); fp_dbl(r->z, r->z); fp_dbl(r->z, r->z); r->norm = 0; if (ep2_curve_is_twist() == EP_MTYPE) { one ^= 1; zero ^= 1; } fp2_dbl(l[zero][one], q->x); fp2_add(l[zero][one], l[zero][one], q->x); fp_mul(l[zero][one][0], l[zero][one][0], t0); fp_mul(l[zero][one][1], l[zero][one][1], t0); fp_sub(l[zero][zero][0], t3, t1); fp_zero(l[zero][zero][1]); fp_mul(l[one][one][0], q->y[0], t5); fp_mul(l[one][one][1], q->y[1], t5); } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); fp_free(t2); fp_free(t3); fp_free(t4); fp_free(t5); fp_free(t6); } }
void pp_dbl_k2_projc_lazyr(fp2_t l, ep_t r, ep_t p, ep_t q) { fp_t t0, t1, t2, t3, t4, t5; dv_t u0, u1; fp_null(t0); fp_null(t1); fp_null(t2); fp_null(t3); fp_null(t4); fp_null(t5); dv_null(u0); dv_null(u1); TRY { fp_new(t0); fp_new(t1); fp_new(t2); fp_new(t3); fp_new(t4); fp_new(t5); dv_new(u0); dv_new(u1); /* For these curves, we always can choose a = -3. */ /* dbl-2001-b formulas: 3M + 5S + 8add + 1*4 + 2*8 + 1*3 */ /* http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b */ /* t0 = delta = z1^2. */ fp_sqr(t0, p->z); /* t1 = gamma = y1^2. */ fp_sqr(t1, p->y); /* t2 = beta = x1 * y1^2. */ fp_mul(t2, p->x, t1); /* t3 = alpha = 3 * (x1 - z1^2) * (x1 + z1^2). */ fp_sub(t3, p->x, t0); fp_add(t4, p->x, t0); fp_mul(t4, t3, t4); fp_dbl(t3, t4); fp_add(t3, t3, t4); /* t2 = 4 * beta. */ fp_dbl(t2, t2); fp_dbl(t2, t2); /* z3 = (y1 + z1)^2 - gamma - delta. */ fp_add(r->z, p->y, p->z); fp_sqr(r->z, r->z); fp_sub(r->z, r->z, t1); fp_sub(r->z, r->z, t0); /* l0 = 2 * gamma - alpha * (delta * xq + x1). */ fp_dbl(t1, t1); fp_mul(t5, t0, q->x); fp_add(t5, t5, p->x); fp_mul(t5, t5, t3); fp_sub(l[0], t1, t5); /* x3 = alpha^2 - 8 * beta. */ fp_dbl(t5, t2); fp_sqr(r->x, t3); fp_sub(r->x, r->x, t5); /* y3 = alpha * (4 * beta - x3) - 8 * gamma^2. */ fp_sqrn_low(u0, t1); fp_addc_low(u0, u0, u0); fp_subm_low(r->y, t2, r->x); fp_muln_low(u1, r->y, t3); fp_subc_low(u1, u1, u0); fp_rdcn_low(r->y, u1); /* l1 = - z3 * delta * yq. */ fp_mul(l[1], r->z, t0); fp_mul(l[1], l[1], q->y); r->norm = 0; } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); fp_free(t2); fp_free(t3); fp_free(t4); fp_free(t5); dv_free(u0); dv_free(u1); } }
void fp3_mul_nor(fp3_t c, fp3_t a) { fp_copy(c[1], a[0]); fp_dbl(c[0], a[2]); fp_neg(c[0], c[0]); fp_copy(c[2], a[1]); }
/** * Adds two points represented in projective coordinates on an ordinary prime * elliptic curve. * * @param[out] r - the result. * @param[in] p - the first point to add. * @param[in] q - the second point to add. */ static void ep_add_projc_imp(ep_t r, const ep_t p, const ep_t q) { #if defined(EP_MIXED) && defined(STRIP) /* If code size is a problem, leave only the mixed version. */ ep_add_projc_mix(r, p, q); #else /* General addition. */ #if defined(EP_MIXED) || !defined(STRIP) /* Test if z2 = 1 only if mixed coordinates are turned on. */ if (q->norm) { ep_add_projc_mix(r, p, q); return; } #endif fp_t t0, t1, t2, t3, t4, t5, t6; fp_null(t0); fp_null(t1); fp_null(t2); fp_null(t3); fp_null(t4); fp_null(t5); fp_null(t6); TRY { fp_new(t0); fp_new(t1); fp_new(t2); fp_new(t3); fp_new(t4); fp_new(t5); fp_new(t6); /* add-2007-bl formulas: 11M + 5S + 9add + 4*2 */ /* http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl */ /* t0 = z1^2. */ fp_sqr(t0, p->z); /* t1 = z2^2. */ fp_sqr(t1, q->z); /* t2 = U1 = x1 * z2^2. */ fp_mul(t2, p->x, t1); /* t3 = U2 = x2 * z1^2. */ fp_mul(t3, q->x, t0); /* t6 = z1^2 + z2^2. */ fp_add(t6, t0, t1); /* t0 = S2 = y2 * z1^3. */ fp_mul(t0, t0, p->z); fp_mul(t0, t0, q->y); /* t1 = S1 = y1 * z2^3. */ fp_mul(t1, t1, q->z); fp_mul(t1, t1, p->y); /* t3 = H = U2 - U1. */ fp_sub(t3, t3, t2); /* t0 = R = 2 * (S2 - S1). */ fp_sub(t0, t0, t1); fp_dbl(t0, t0); /* If E is zero. */ if (fp_is_zero(t3)) { if (fp_is_zero(t0)) { /* If I is zero, p = q, should have doubled. */ ep_dbl_projc(r, p); } else { /* If I is not zero, q = -p, r = infinity. */ ep_set_infty(r); } } else { /* t4 = I = (2*H)^2. */ fp_dbl(t4, t3); fp_sqr(t4, t4); /* t5 = J = H * I. */ fp_mul(t5, t3, t4); /* t4 = V = U1 * I. */ fp_mul(t4, t2, t4); /* x3 = R^2 - J - 2 * V. */ fp_sqr(r->x, t0); fp_sub(r->x, r->x, t5); fp_dbl(t2, t4); fp_sub(r->x, r->x, t2); /* y3 = R * (V - x3) - 2 * S1 * J. */ fp_sub(t4, t4, r->x); fp_mul(t4, t4, t0); fp_mul(t1, t1, t5); fp_dbl(t1, t1); fp_sub(r->y, t4, t1); /* z3 = ((z1 + z2)^2 - z1^2 - z2^2) * H. */ fp_add(r->z, p->z, q->z); fp_sqr(r->z, r->z); fp_sub(r->z, r->z, t6); fp_mul(r->z, r->z, t3); } r->norm = 0; } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); fp_free(t2); fp_free(t3); fp_free(t4); fp_free(t5); fp_free(t6); } #endif }
/** * Adds a point represented in affine coordinates to a point represented in * projective coordinates. * * @param[out] r - the result. * @param[in] p - the projective point. * @param[in] q - the affine point. */ static void ep_add_projc_mix(ep_t r, const ep_t p, const ep_t q) { fp_t t0, t1, t2, t3, t4, t5, t6; fp_null(t0); fp_null(t1); fp_null(t2); fp_null(t3); fp_null(t4); fp_null(t5); fp_null(t6); TRY { fp_new(t0); fp_new(t1); fp_new(t2); fp_new(t3); fp_new(t4); fp_new(t5); fp_new(t6); /* madd-2007-bl formulas: 7M + 4S + 9add + 1*4 + 3*2. */ /* http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-madd-2007-bl */ if (!p->norm) { /* t0 = z1^2. */ fp_sqr(t0, p->z); /* t3 = U2 = x2 * z1^2. */ fp_mul(t3, q->x, t0); /* t1 = S2 = y2 * z1^3. */ fp_mul(t1, t0, p->z); fp_mul(t1, t1, q->y); /* t3 = H = U2 - x1. */ fp_sub(t3, t3, p->x); /* t1 = R = 2 * (S2 - y1). */ fp_sub(t1, t1, p->y); fp_dbl(t1, t1); } else { /* H = x2 - x1. */ fp_sub(t3, q->x, p->x); /* t1 = R = 2 * (y2 - y1). */ fp_sub(t1, q->y, p->y); fp_dbl(t1, t1); } /* t2 = HH = H^2. */ fp_sqr(t2, t3); /* If E is zero. */ if (fp_is_zero(t3)) { if (fp_is_zero(t1)) { /* If I is zero, p = q, should have doubled. */ ep_dbl_projc(r, p); } else { /* If I is not zero, q = -p, r = infinity. */ ep_set_infty(r); } } else { /* t4 = I = 4*HH. */ fp_dbl(t4, t2); fp_dbl(t4, t4); /* t5 = J = H * I. */ fp_mul(t5, t3, t4); /* t4 = V = x1 * I. */ fp_mul(t4, p->x, t4); /* x3 = R^2 - J - 2 * V. */ fp_sqr(r->x, t1); fp_sub(r->x, r->x, t5); fp_dbl(t6, t4); fp_sub(r->x, r->x, t6); /* y3 = R * (V - x3) - 2 * Y1 * J. */ fp_sub(t4, t4, r->x); fp_mul(t4, t4, t1); fp_mul(t1, p->y, t5); fp_dbl(t1, t1); fp_sub(r->y, t4, t1); if (!p->norm) { /* z3 = (z1 + H)^2 - z1^2 - HH. */ fp_add(r->z, p->z, t3); fp_sqr(r->z, r->z); fp_sub(r->z, r->z, t0); fp_sub(r->z, r->z, t2); } else { /* z3 = 2 * H. */ fp_dbl(r->z, t3); } } r->norm = 0; } CATCH_ANY { THROW(ERR_CAUGHT); } FINALLY { fp_free(t0); fp_free(t1); fp_free(t2); fp_free(t3); fp_free(t4); fp_free(t5); fp_free(t6); } }