/*************************************************
* Two Operand Subtraction *
*************************************************/
void bigint_sub2(word x[], u32bit x_size, const word y[], u32bit y_size)
{
word carry = 0;
const u32bit blocks = y_size - (y_size % 8);
for(u32bit j = 0; j != blocks; j += 8)
carry = word8_sub2(x + j, y + j, carry);
for(u32bit j = blocks; j != y_size; ++j)
x[j] = word_sub(x[j], y[j], &carry);
if(!carry) return;
for(u32bit j = y_size; j != x_size; ++j)
{
--x[j];
if(x[j] != MP_WORD_MAX) return;
}
}
/*************************************************
* Three Operand Subtraction *
*************************************************/
void bigint_sub3(word z[], const word x[], u32bit x_size,
const word y[], u32bit y_size)
{
word carry = 0;
const u32bit blocks = y_size - (y_size % 8);
for(u32bit j = 0; j != blocks; j += 8)
carry = word8_sub3(z + j, x + j, y + j, carry);
for(u32bit j = blocks; j != y_size; ++j)
z[j] = word_sub(x[j], y[j], &carry);
for(u32bit j = y_size; j != x_size; ++j)
{
word x_j = x[j] - carry;
if(carry && x_j != MP_WORD_MAX)
carry = 0;
z[j] = x_j;
}
}
/*
* Montgomery Reduction Algorithm
*/
void bigint_monty_redc(word z[],
const word p[], size_t p_size,
word p_dash, word ws[])
{
const size_t z_size = 2*(p_size+1);
const size_t blocks_of_8 = p_size - (p_size % 8);
for(size_t i = 0; i != p_size; ++i)
{
word* z_i = z + i;
const word y = z_i[0] * p_dash;
/*
bigint_linmul3(ws, p, p_size, y);
bigint_add2(z_i, z_size - i, ws, p_size+1);
*/
word carry = 0;
for(size_t j = 0; j != blocks_of_8; j += 8)
carry = word8_madd3(z_i + j, p + j, y, carry);
for(size_t j = blocks_of_8; j != p_size; ++j)
z_i[j] = word_madd3(p[j], y, z_i[j], &carry);
word z_sum = z_i[p_size] + carry;
carry = (z_sum < z_i[p_size]);
z_i[p_size] = z_sum;
for(size_t j = p_size + 1; carry && j != z_size - i; ++j)
{
++z_i[j];
carry = !z_i[j];
}
}
/*
* The result might need to be reduced mod p. To avoid a timing
* channel, always perform the subtraction. If in the compution
* of x - p a borrow is required then x was already < p.
*
* x - p starts at ws[0] and is p_size+1 bytes long
* x starts at ws[p_size+1] and is also p_size+1 bytes log
* (that's the copy_mem)
*
* Select which address to copy from indexing off of the final
* borrow.
*/
word borrow = 0;
for(size_t i = 0; i != p_size; ++i)
ws[i] = word_sub(z[p_size + i], p[i], &borrow);
ws[p_size] = word_sub(z[p_size+p_size], 0, &borrow);
BOTAN_ASSERT(borrow == 0 || borrow == 1, "Expected borrow");
copy_mem(ws + p_size + 1, z + p_size, p_size + 1);
copy_mem(z, ws + borrow*(p_size+1), p_size + 1);
clear_mem(z + p_size + 1, z_size - p_size - 1);
}
static Const fold_op(Node node) /*;fold_op*/
{
Node opn, arg1, arg2, oplist;
Const result, op1, op2, tryc;
Symbol sym, op_name;
int *uint;
int rm;
Tuple tup;
int res, overflow;
opn = N_AST1(node);
oplist = N_AST2(node);
tup = N_LIST(oplist);
arg1 = (Node) tup[1];
arg2 = (Node) tup[2];
op1 = const_fold(arg1);
op2 = const_fold(arg2);
op_name = N_UNQ(opn);
/* If either operand raises and exception, so does the operation */
if (N_KIND(arg1) == as_raise) {
copy_attributes(arg1, node);
return const_new(CONST_OM);
}
if (N_KIND(arg2) == as_raise
&& op_name != symbol_andthen && op_name != symbol_orelse) {
copy_attributes(arg2, node);
return const_new(CONST_OM);
}
if (is_const_om(op1) || (is_const_om(op2)
&& (op_name != symbol_in || op_name != symbol_notin))) {
return const_new(CONST_OM);
}
sym = op_name;
if ( sym == symbol_addi || sym == symbol_addfl) {
if (sym == symbol_addi) {
res = word_add(INTV(op1), INTV(op2), &overflow);
if (overflow) {
create_raise(node, symbol_constraint_error);
result = const_new(CONST_OM);
}
else result = int_const(res);
}
else
result = real_const(REALV(op1) + REALV(op2));
}
else if ( sym == symbol_addfx) {
const_check(op1, CONST_RAT);
const_check(op2, CONST_RAT);
result= rat_const(rat_add(RATV(op1), RATV(op2)));
}
else if ( sym == symbol_subi) {
if (is_const_int(op1)) {
if (is_const_int(op2)) {
res = word_sub(INTV(op1), INTV(op2), &overflow);
if (overflow) {
create_raise(node, symbol_constraint_error);
result = const_new(CONST_OM);
}
else result = int_const(res);
}
else {
chaos("fold_op: subi operand types");
}
}
}
else if (sym == symbol_subfl) {
result = real_const(REALV(op1) - REALV(op2));
}
else if ( sym == symbol_subfx) {
const_check(op1, CONST_RAT);
const_check(op2, CONST_RAT);
result= rat_const(rat_sub(RATV(op1), RATV(op2)));
}
else if ( sym == symbol_muli) {
#ifdef TBSL
-- need to check for overflow and convert result back to int if not
-- note that low-level setl is missing calls to check_overflow that
-- are present in high-level and should be in low-level as well
result = int_mul(int_fri(op1), int_fri(op2));
#endif
/* until overflow check in */
const_check(op1, CONST_INT);
const_check(op2, CONST_INT);
res = word_mul(INTV(op1), INTV(op2), &overflow);
if (overflow) {
create_raise(node, symbol_constraint_error);
result = const_new(CONST_OM);
}
else result = int_const(res);
}
