void gmersennemod( int n, giant g ) /* g := g (mod 2^n - 1) */ { int the_sign; giant scratch3 = borrowGiant(g->capacity); giant scratch4 = borrowGiant(1); if ((the_sign = gsign(g)) < 0) absg(g); while (bitlen(g) > n) { gtog(g,scratch3); gshiftright(n,scratch3); addg(scratch3,g); gshiftleft(n,scratch3); subg(scratch3,g); } if(isZero(g)) goto out; int_to_giant(1,scratch3); gshiftleft(n,scratch3); int_to_giant(1,scratch4); subg(scratch4,scratch3); if(gcompg(g,scratch3) >= 0) subg(scratch3,g); if (the_sign < 0) { g->sign = -g->sign; addg(scratch3,g); } out: returnGiant(scratch3); returnGiant(scratch4); }
int binvaux(giant p, giant x) /* Binary inverse method. Returns zero if no inverse exists, in which case x becomes GCD(x,p). */ { giant scratch7; giant u0; giant u1; giant v0; giant v1; int result = 1; int giantSize; PROF_START; if(isone(x)) return(result); giantSize = 4 * abs(p->sign); scratch7 = borrowGiant(giantSize); u0 = borrowGiant(giantSize); u1 = borrowGiant(giantSize); v0 = borrowGiant(giantSize); v1 = borrowGiant(giantSize); int_to_giant(1, v0); gtog(x, v1); int_to_giant(0,x); gtog(p, u1); while(!isZero(v1)) { gtog(u1, u0); bdivg(v1, u0); gtog(x, scratch7); gtog(v0, x); mulg(u0, v0); subg(v0,scratch7); gtog(scratch7, v0); gtog(u1, scratch7); gtog(v1, u1); mulg(u0, v1); subg(v1,scratch7); gtog(scratch7, v1); } if (!isone(u1)) { gtog(u1,x); if(x->sign<0) addg(p, x); result = 0; goto done; } if (x->sign<0) addg(p, x); done: returnGiant(scratch7); returnGiant(u0); returnGiant(u1); returnGiant(v0); returnGiant(v1); PROF_END(binvauxTime); return(result); }
static void numer_times(giant x1, giant z1, giant x2, giant z2, giant res, curveParams *par) /* Numerator algebra. res := (x1 x2 - a z1 z2)^2 - 4 b(x1 z2 + x2 z1 + c z1 z2) z1 z2 */ { giant t1; giant t2; giant t3; giant t4; PROF_START; t1 = borrowGiant(par->maxDigits); t2 = borrowGiant(par->maxDigits); t3 = borrowGiant(par->maxDigits); t4 = borrowGiant(par->maxDigits); gtog(x1, t1); mulg(x2, t1); feemod(par, t1); gtog(z1, t2); mulg(z2, t2); feemod(par, t2); gtog(t1, res); if(!isZero(par->a)) { gtog(par->a, t3); mulg(t2, t3); feemod(par, t3); subg(t3, res); } gsquare(res); feemod(par, res); if(isZero(par->b)) goto done; if(par->curveType != FCT_Weierstrass) { // i.e., !isZero(par->c) gtog(par->c, t3); mulg(t2, t3); feemod(par, t3); } else int_to_giant(0, t3); gtog(z1, t4); mulg(x2, t4); feemod(par, t4); addg(t4, t3); gtog(x1, t4); mulg(z2, t4); feemod(par, t4); addg(t4, t3); mulg(par->b, t3); feemod(par, t3); mulg(t2, t3); gshiftleft(2, t3); feemod(par, t3); subg(t3, res); feemod(par, res); done: returnGiant(t1); returnGiant(t2); returnGiant(t3); returnGiant(t4); PROF_END(numerTimesTime); }
int signature_compare(giant p0x, giant p1x, giant p2x, curveParams *par) /* Returns non-zero iff p0x cannot be the x-coordinate of the sum of two points whose respective x-coordinates are p1x, p2x. */ { int ret = 0; giant t1; giant t2; giant t3; giant t4; giant t5; PROF_START; t1 = borrowGiant(par->maxDigits); t2 = borrowGiant(par->maxDigits); t3 = borrowGiant(par->maxDigits); t4 = borrowGiant(par->maxDigits); t5 = borrowGiant(par->maxDigits); if(gcompg(p1x, p2x) == 0) { int_to_giant(1, t1); numer_double(p1x, t1, t2, par); denom_double(p1x, t1, t3, par); mulg(p0x, t3); subg(t3, t2); feemod(par, t2); } else { numer_plus(p1x, p2x, t1, par); gshiftleft(1, t1); feemod(par, t1); int_to_giant(1, t3); numer_times(p1x, t3, p2x, t3, t2, par); int_to_giant(1, t4); int_to_giant(1, t5); denom_times(p1x, t4 , p2x, t5, t3, par); /* Now we require t3 x0^2 - t1 x0 + t2 == 0. */ mulg(p0x, t3); feemod(par, t3); subg(t1, t3); mulg(p0x, t3); feemod(par, t3); addg(t3, t2); feemod(par, t2); } if(!isZero(t2)) ret = SIGNATURE_INVALID; returnGiant(t1); returnGiant(t2); returnGiant(t3); returnGiant(t4); returnGiant(t5); PROF_END(sigCompTime); return(ret); }
main(int argc, char **argv) { giant p = newgiant(CM_SHORTS); giant u = newgiant(CM_SHORTS); giant v = newgiant(CM_SHORTS); giant g[6]; giant plus_order = newgiant(CM_SHORTS); giant minus_order = newgiant(CM_SHORTS); giant a = newgiant(CM_SHORTS); giant b = newgiant(CM_SHORTS); int d, dc, olen, k; init_tools(CM_SHORTS); /* Basic algorithms. */ printf("Give base prime p:\n"); fflush(stdout); gin(p); for(dc=0; dc < 6; dc++) g[dc] = newgiant(CM_SHORTS); for(dc = 0; dc < DCOUNT; dc++) { d = disc12[dc]; /* Next, seek representation 4N = u^2 + |d| v^2. */ if(cornacchia4(p, d, u, v) == 0) continue; /* Here, (u,v) give the quadratic representation of 4p. */ printf("D: %d\n", d); fflush(stdout); gtog(u, g[0]); switch(d) { case -3: olen = 3; /* Six orders: p + 1 +- g[0,1,2]. */ gtog(u, g[1]); gtog(v, g[2]); addg(g[2], g[2]); addg(v, g[2]); /* g[2] := 3v. */ addg(g[2], g[1]); gshiftright(1, g[1]); /* g[1] = (u + 3v)/2. */ subg(u, g[2]); gshiftright(1, g[2]); absg(g[2]); /* g[2] = |u-3v|/2. */ break; case -4: olen = 2; /* Four orders: p + 1 +- g[0,1]. */ gtog(v, g[1]); addg(g[1], g[1]); /* g[1] = 2v. */ break; default: olen = 1; /* Two orders: p + 1 +- g[0]. */ } for(k=0; k < olen; k++) { gtog(p, plus_order); iaddg(1, plus_order); gtog(p, minus_order); iaddg(1, minus_order); addg(g[k], plus_order); subg(g[k], minus_order); printf("curve orders: \n"); printf("(%d) ", prime_probable(plus_order)); gout(plus_order); printf("(%d) ", prime_probable(minus_order)); gout(minus_order); } } }
void make_recip(giant d, giant r) /* r becomes the steady-state reciprocal * 2^(2b)/d, where b = bit-length of d-1. */ { int b; giant tmp, tmp2; if (isZero(d) || (d->sign < 0)) { exit(SIGN); } tmp = popg(); tmp2 = popg(); itog(1, r); subg(r, d); b = bitlen(d); addg(r, d); gshiftleft(b, r); gtog(r, tmp2); while (1) { gtog(r, tmp); squareg(tmp); gshiftright(b, tmp); mulg(d, tmp); gshiftright(b, tmp); addg(r, r); subg(tmp, r); if (gcompg(r, tmp2) <= 0) break; gtog(r, tmp2); } itog(1, tmp); gshiftleft(2 * b, tmp); gtog(r, tmp2); mulg(d, tmp2); subg(tmp2, tmp); itog(1, tmp2); while (tmp->sign < 0) { subg(tmp2, r); addg(d, tmp); } pushg(2); }
void ellDoubleProj(pointProj pt, curveParams *cp) /* pt := 2 pt on the curve. */ { giant x = pt->x, y = pt->y, z = pt->z; giant t1; giant t2; giant t3; if(isZero(y) || isZero(z)) { int_to_giant(1,x); int_to_giant(1,y); int_to_giant(0,z); return; } t1 = borrowGiant(cp->maxDigits); t2 = borrowGiant(cp->maxDigits); t3 = borrowGiant(cp->maxDigits); if((cp->a->sign >= 0) || (cp->a->n[0] != 3)) { /* Path prior to Apr2001. */ gtog(z,t1); gsquare(t1); feemod(cp, t1); gsquare(t1); feemod(cp, t1); mulg(cp->a, t1); feemod(cp, t1); /* t1 := a z^4. */ gtog(x, t2); gsquare(t2); feemod(cp, t2); smulg(3, t2); /* t2 := 3x^2. */ addg(t2, t1); feemod(cp, t1); /* t1 := slope m. */ } else { /* New optimization for a = -3 (post Apr 2001). */ gtog(z, t1); gsquare(t1); feemod(cp, t1); /* t1 := z^2. */ gtog(x, t2); subg(t1, t2); /* t2 := x-z^2. */ addg(x, t1); smulg(3, t1); /* t1 := 3(x+z^2). */ mulg(t2, t1); feemod(cp, t1); /* t1 := slope m. */ } mulg(y, z); addg(z,z); feemod(cp, z); /* z := 2 y z. */ gtog(y, t2); gsquare(t2); feemod(cp, t2); /* t2 := y^2. */ gtog(t2, t3); gsquare(t3); feemod(cp, t3); /* t3 := y^4. */ gshiftleft(3, t3); /* t3 := 8 y^4. */ mulg(x, t2); gshiftleft(2, t2); feemod(cp, t2); /* t2 := 4xy^2. */ gtog(t1, x); gsquare(x); feemod(cp, x); subg(t2, x); subg(t2, x); feemod(cp, x); /* x done. */ gtog(t1, y); subg(x, t2); mulg(t2, y); subg(t3, y); feemod(cp, y); returnGiant(t1); returnGiant(t2); returnGiant(t3); }
void make_base_prim(curveParams *cp) /* Jams cp->basePrime with 2^q-k. Assumes valid maxDigits, q, k. */ { giant tmp = borrowGiant(cp->maxDigits); CKASSERT(cp->primeType != FPT_General); int_to_giant(1, cp->basePrime); gshiftleft((int)cp->q, cp->basePrime); int_to_giant(cp->k, tmp); subg(tmp, cp->basePrime); returnGiant(tmp); }
void modg_via_recip(giant d, giant r, giant n) /* This is the fastest mod of the present collection. * n := n % d, where r is the precalculated * steady-state reciprocal of d. */ { int s = (bitlen(r) - 1), sign = n->sign; giant tmp, tmp2; if (isZero(d) || (d->sign < 0)) { exit(SIGN); } tmp = popg(); tmp2 = popg(); n->sign = abs(n->sign); while (1) { gtog(n, tmp); gshiftright(s - 1, tmp); mulg(r, tmp); gshiftright(s + 1, tmp); mulg(d, tmp); subg(tmp, n); if (gcompg(n, d) >= 0) subg(d, n); if (gcompg(n, d) < 0) break; } if (sign >= 0) goto done; if (isZero(n)) goto done; negg(n); addg(d, n); done: pushg(2); return; }
static void numer_double(giant x, giant z, giant res, curveParams *par) /* Numerator algebra. res := (x^2 - a z^2)^2 - 4 b (2 x + c z) z^3. */ { giant t1; giant t2; PROF_START; t1 = borrowGiant(par->maxDigits); t2 = borrowGiant(par->maxDigits); gtog(x, t1); gsquare(t1); feemod(par, t1); gtog(z, res); gsquare(res); feemod(par, res); gtog(res, t2); if(!isZero(par->a) ) { if(!isone(par->a)) { /* Speedup - REC 17 Jan 1997. */ mulg(par->a, res); feemod(par, res); } subg(res, t1); feemod(par, t1); } gsquare(t1); feemod(par, t1); /* t1 := (x^2 - a z^2)^2. */ if(isZero(par->b)) { /* Speedup - REC 17 Jan 1997. */ gtog(t1, res); goto done; } if(par->curveType != FCT_Weierstrass) { // i.e., !isZero(par->c) // Speedup - REC 17 Jan 1997. gtog(z, res); mulg(par->c, res); feemod(par, res); } else { int_to_giant(0, res); } addg(x, res); addg(x, res); mulg(par->b, res); feemod(par, res); gshiftleft(2, res); mulg(z, res); feemod(par, res); mulg(t2, res); feemod(par, res); negg(res); addg(t1, res); feemod(par, res); done: returnGiant(t1); returnGiant(t2); PROF_END(numerDoubleTime); }
static void denom_times(giant x1, giant z1, giant x2, giant z2, giant res, curveParams *par) /* Denominator algebra. res := (x1 z2 - x2 z1)^2 */ { giant t1; PROF_START; t1 = borrowGiant(par->maxDigits); gtog(x1, res); mulg(z2, res); feemod(par, res); gtog(z1, t1); mulg(x2, t1); feemod(par, t1); subg(t1, res); gsquare(res); feemod(par, res); returnGiant(t1); PROF_END(denomTimesTime); }
/* * New optimzation of curveOrderJustify using known reciprocal, 11 June 1997. * g is set to be within [2, curveOrder-2]. */ static void curveOrderJustifyWithRecip(giant g, giant curveOrder, giant recip) { giant tmp; CKASSERT(!isZero(curveOrder)); modg_via_recip(curveOrder, recip, g); // g now in [0, curveOrder-1] if(isZero(g)) { /* * First degenerate case - (g == 0) : set g := 2 */ dbgLog(("curveOrderJustify: case 1\n")); int_to_giant(2, g); return; } if(isone(g)) { /* * Second case - (g == 1) : set g := 2 */ dbgLog(("curveOrderJustify: case 2\n")); int_to_giant(2, g); return; } tmp = borrowGiant(g->capacity); gtog(g, tmp); iaddg(1, tmp); if(gcompg(tmp, curveOrder) == 0) { /* * Third degenerate case - (g == (curveOrder-1)) : set g -= 1 */ dbgLog(("curveOrderJustify: case 3\n")); int_to_giant(1, tmp); subg(tmp, g); } returnGiant(tmp); return; }
void main( void ) { giant x = newgiant(INFINITY), y = newgiant(INFINITY), p = newgiant(INFINITY), r = newgiant(100); int j; printf("Give two integers x, y on separate lines:\n"); gin(x); gin(y); gtog(y, p); /* p := y */ mulg(x, p); printf("y * x = "); gout(p); gtog(y, p); subg(x, p); printf("y - x = "); gout(p); gtog(y, p); addg(x, p); printf("y + x = "); gout(p); gtog(y, p); divg(x, p); printf("y div x = "); gout(p); gtog(y, p); modg(x, p); printf("y mod x = "); gout(p); gtog(y, p); gcdg(x, p); printf("GCD(x, y) = "); gout(p); /* Next, test which of x, y is greater. */ if (gcompg(x, y) < 0 ) printf("y is greater\n"); else if (gcompg(x,y) == 0) printf("x, y equal\n"); else printf("x is greater\n"); /* Next, we see how a giant struct is comprised. * We make a random, bipolar number of about 100 * digits in base 65536. */ for (j=0; j < 100; j++) { /* Fill 100 digits randomly. */ r->n[j] = (unsigned short)rand(); } r->sign = 100 * (1 - 2*(rand()%2)); /* Next, don't forget to check for leading zero digits, * even though such are unlikely. */ j = abs(r->sign) - 1; while ((r->n[j] == 0) && (j > 0)) { --j; } r->sign = (j+1) * ((r->sign > 0) ? 1: -1); printf("The random number: "); gout(r); /* Next, compare a large-FFT multiply with a standard, * grammar-school multiply. */ itog(1, x); gshiftleft(65536, x); iaddg(1, x); itog(5, y); gshiftleft(30000, y); itog(1, p); subg(p, y); /* Now we multiply (2^65536 + 1)*(5*(2^30000) - 1). */ gtog(y, p); mulg(x, p); /* Actually invokes FFT method because bit lengths of x, y are sufficiently large. */ printf("High digit of (2^65536 + 1)*(5*(2^30000) - 1) via FFT mul: %d\n", (int) p->n[abs(p->sign)-1]); fflush(stdout); gtog(y, p); grammarmulg(x, p); /* Grammar-school method. */ printf("High digit via grammar-school mul: %d\n", (int) p->n[abs(p->sign)-1]); fflush(stdout); /* Next, perform Fermat test for pseudoprimality. */ printf("Give prime candidate p:\n"); gin(p); gtog(p, y); itog(1, x); subg(x, y); itog(2, x); powermodg(x, y, p); if (isone(x)) printf("p is probably prime.\n"); else printf("p is composite.\n"); }
/* * Completely rewritten in CryptKit-18, 13 Jan 1997, for new IEEE-style * curveParameters. */ void elliptic_add(giant x1, giant x2, giant x3, curveParams *par, int s) { /* Addition algorithm for x3 = x1 + x2 on the curve, with sign ambiguity s. From theory, we know that if {x1,1} and {x2,1} are on a curve, then their elliptic sum (x1,1} + {x2,1} = {x3,1} must have x3 as one of two values: x3 = U/2 + s*Sqrt[U^2/4 - V] where sign s = +-1, and U,V are functions of x1,x2. Tho present function is called a maximum of twice, to settle which of +- is s. When a call is made, it is guaranteed already that x1, x2 both lie on the same curve (+- curve); i.e., which curve (+-) is not connected at all with sign s of the x3 relation. */ giant cur_n; giant t1; giant t2; giant t3; giant t4; giant t5; PROF_START; cur_n = borrowGiant(par->maxDigits); t1 = borrowGiant(par->maxDigits); t2 = borrowGiant(par->maxDigits); t3 = borrowGiant(par->maxDigits); t4 = borrowGiant(par->maxDigits); t5 = borrowGiant(par->maxDigits); if(gcompg(x1, x2)==0) { int_to_giant(1, t1); numer_double(x1, t1, x3, par); denom_double(x1, t1, t2, par); binvg_cp(par, t2); mulg(t2, x3); feemod(par, x3); goto out; } numer_plus(x1, x2, t1, par); int_to_giant(1, t3); numer_times(x1, t3, x2, t3, t2, par); int_to_giant(1, t4); int_to_giant(1, t5); denom_times(x1, t4, x2, t5, t3, par); binvg_cp(par, t3); mulg(t3, t1); feemod(par, t1); /* t1 := U/2. */ mulg(t3, t2); feemod(par, t2); /* t2 := V. */ /* Now x3 will be t1 +- Sqrt[t1^2 - t2]. */ gtog(t1, t4); gsquare(t4); feemod(par, t4); subg(t2, t4); make_base(par, cur_n); iaddg(1, cur_n); gshiftright(2, cur_n); /* cur_n := (p+1)/4. */ feepowermodg(par, t4, cur_n); /* t4 := t2^((p+1)/4) (mod p). */ gtog(t1, x3); if(s != SIGN_PLUS) negg(t4); addg(t4, x3); feemod(par, x3); out: returnGiant(cur_n); returnGiant(t1); returnGiant(t2); returnGiant(t3); returnGiant(t4); returnGiant(t5); PROF_END(ellAddTime); }
static void ell_even(giant x1, giant z1, giant x2, giant z2, curveParams *par) { giant t1; giant t2; giant t3; EPROF_START; t1 = borrowGiant(par->maxDigits); t2 = borrowGiant(par->maxDigits); t3 = borrowGiant(par->maxDigits); if(par->curveType == FCT_Montgomery) { /* Begin Montgomery OPT: 10 Jan 98 REC. */ gtog(x1, t1); gsquare(t1); feemod(par, t1); /* t1 := x1^2. */ gtog(z1, t2); gsquare(t2); feemod(par, t2); /* t2 := z1^2. */ gtog(x1, t3); mulg(z1, t3); feemod(par, t3); gtog(t3, z2); mulg(par->c, z2); feemod(par, z2); addg(t1, z2); addg(t2, z2); mulg(t3, z2); gshiftleft(2, z2); feemod(par, z2); /* z2 := 4 x1 z1 (x1^2 + c x1 z1 + z1^2). */ gtog(t1, x2); subg(t2, x2); gsquare(x2); feemod(par, x2); /* x2 := (x1^2 - z1^2)^2. */ /* End OPT: 10 Jan 98 REC. */ } else if((par->curveType == FCT_Weierstrass) && isZero(par->a)) { /* Begin Atkin3 OPT: 9 Jan 98 REC. */ gtog(x1, t1); gsquare(t1); feemod(par, t1); mulg(x1, t1); feemod(par, t1); /* t1 := x^3. */ gtog(z1, t2); gsquare(t2); feemod(par, t2); mulg(z1, t2); feemod(par, t2); /* t2 := z1^3 */ mulg(par->b, t2); feemod(par, t2); /* t2 := b z1^3. */ gtog(t1, t3); addg(t2, t3); /* t3 := x^3 + b z1^3 */ mulg(z1, t3); feemod(par, t3); /* t3 *= z1 * = z1 ( x^3 + b z1^3 ) */ gshiftleft(2, t3); feemod(par, t3); /* t3 = 4 z1 (x1^3 + b z1^3) */ gshiftleft(3, t2); /* t2 = 8 b z1^3 */ subg(t2, t1); /* t1 = x^3 - 8 b z1^3 */ mulg(x1, t1); feemod(par, t1); /* t1 = x1 (x1^3 - 8 b z1^3) */ gtog(t3, z2); gtog(t1, x2); /* End OPT: 9 Jan 98 REC. */ } else { numer_double(x1, z1, t1, par); denom_double(x1, z1, t2, par); gtog(t1, x2); gtog(t2, z2); } returnGiant(t1); returnGiant(t2); returnGiant(t3); EPROF_END(ellEvenTime); EPROF_INCR(numEllEvens); /* printf("ell_even end\n"); printf(" x1 : "); printGiant(x1); printf(" z1 : "); printGiant(z1); printf(" x2 : "); printGiant(x2); printf(" z2 : "); printGiant(z2); */ }
static void ell_odd(giant x1, giant z1, giant x2, giant z2, giant xxor, giant zor, curveParams *par) { giant t1; giant t2; EPROF_START; t1 = borrowGiant(par->maxDigits); t2 = borrowGiant(par->maxDigits); if(par->curveType == FCT_Montgomery) { /* Begin Montgomery OPT: 10 Jan 98 REC. */ giant t3 = borrowGiant(par->maxDigits); giant t4 = borrowGiant(par->maxDigits); gtog(x1, t1); addg(z1, t1); /* t1 := x1 + z1. */ gtog(x2, t2); subg(z2, t2); /* t2 := x2 - z2. */ gtog(x1, t3); subg(z1, t3); /* t3 := x1 - z1. */ gtog(x2, t4); addg(z2, t4); /* t4 := x2 + z2. */ mulg(t2, t1); feemod(par, t1); /* t1 := (x1 + z1)(x2 - z2) */ mulg(t4, t3); feemod(par, t3); /* t4 := (x2 + z2)(x1 - z1) */ gtog(t1, z2); subg(t3, z2); /*???gshiftright(1, z2);*/ /* z2 := ((x1 + z1)(x2 - z2) - x2)/2 */ gsquare(z2); feemod(par, z2); mulg(xxor, z2); feemod(par, z2); gtog(t1, x2); addg(t3, x2); /*????gshiftright(1, x2);*/ gsquare(x2); feemod(par, x2); mulg(zor, x2); feemod(par, x2); returnGiant(t3); returnGiant(t4); } else if((par->curveType == FCT_Weierstrass) && isZero(par->a)) { /* Begin Atkin3 OPT: 9 Jan 98 REC. */ giant t3 = borrowGiant(par->maxDigits); giant t4 = borrowGiant(par->maxDigits); gtog(x1, t1); mulg(x2, t1); feemod(par, t1); /* t1 := x1 x2. */ gtog(z1, t2); mulg(z2, t2); feemod(par, t2); /* t2 := z1 z2. */ gtog(x1, t3); mulg(z2, t3); feemod(par, t3); /* t3 := x1 z2. */ gtog(z1, t4); mulg(x2, t4); feemod(par, t4); /* t4 := x2 z1. */ gtog(t3, z2); subg(t4, z2); gsquare(z2); feemod(par, z2); mulg(xxor, z2); feemod(par, z2); gtog(t1, x2); gsquare(x2); feemod(par, x2); addg(t4, t3); mulg(t2, t3); feemod(par, t3); mulg(par->b, t3); feemod(par, t3); addg(t3, t3); addg(t3, t3); subg(t3, x2); mulg(zor, x2); feemod(par, x2); returnGiant(t3); returnGiant(t4); /* End OPT: 9 Jan 98 REC. */ } else { numer_times(x1, z1, x2, z2, t1, par); mulg(zor, t1); feemod(par, t1); denom_times(x1, z1, x2, z2, t2, par); mulg(xxor, t2); feemod(par, t2); gtog(t1, x2); gtog(t2, z2); } returnGiant(t1); returnGiant(t2); EPROF_END(ellOddTime); EPROF_INCR(numEllOdds); /* printf("ell_odd end\n"); printf(" x2 : "); printGiant(x2); printf(" z2 : "); printGiant(z2); */ }
void ellAddProj(pointProj pt0, pointProj pt1, curveParams *cp) /* pt0 := pt0 + pt1 on the curve. */ { giant x0 = pt0->x, y0 = pt0->y, z0 = pt0->z, x1 = pt1->x, y1 = pt1->y, z1 = pt1->z; giant t1; giant t2; giant t3; giant t4; giant t5; giant t6; giant t7; if(isZero(z0)) { gtog(x1,x0); gtog(y1,y0); gtog(z1,z0); return; } if(isZero(z1)) return; t1 = borrowGiant(cp->maxDigits); t2 = borrowGiant(cp->maxDigits); t3 = borrowGiant(cp->maxDigits); t4 = borrowGiant(cp->maxDigits); t5 = borrowGiant(cp->maxDigits); t6 = borrowGiant(cp->maxDigits); t7 = borrowGiant(cp->maxDigits); gtog(x0, t1); gtog(y0,t2); gtog(z0, t3); gtog(x1, t4); gtog(y1, t5); if(!isone(z1)) { gtog(z1, t6); gtog(t6, t7); gsquare(t7); feemod(cp, t7); mulg(t7, t1); feemod(cp, t1); mulg(t6, t7); feemod(cp, t7); mulg(t7, t2); feemod(cp, t2); } gtog(t3, t7); gsquare(t7); feemod(cp, t7); mulg(t7, t4); feemod(cp, t4); mulg(t3, t7); feemod(cp, t7); mulg(t7, t5); feemod(cp, t5); negg(t4); addg(t1, t4); feemod(cp, t4); negg(t5); addg(t2, t5); feemod(cp, t5); if(isZero(t4)) { if(isZero(t5)) { ellDoubleProj(pt0, cp); } else { int_to_giant(1, x0); int_to_giant(1, y0); int_to_giant(0, z0); } goto out; } addg(t1, t1); subg(t4, t1); feemod(cp, t1); addg(t2, t2); subg(t5, t2); feemod(cp, t2); if(!isone(z1)) { mulg(t6, t3); feemod(cp, t3); } mulg(t4, t3); feemod(cp, t3); gtog(t4, t7); gsquare(t7); feemod(cp, t7); mulg(t7, t4); feemod(cp, t4); mulg(t1, t7); feemod(cp, t7); gtog(t5, t1); gsquare(t1); feemod(cp, t1); subg(t7, t1); feemod(cp, t1); subg(t1, t7); subg(t1, t7); feemod(cp, t7); mulg(t7, t5); feemod(cp, t5); mulg(t2, t4); feemod(cp, t4); gtog(t5, t2); subg(t4,t2); feemod(cp, t2); if(t2->n[0] & 1) { /* Test if t2 is odd. */ addg(cp->basePrime, t2); } gshiftright(1, t2); gtog(t1, x0); gtog(t2, y0); gtog(t3, z0); out: returnGiant(t1); returnGiant(t2); returnGiant(t3); returnGiant(t4); returnGiant(t5); returnGiant(t6); returnGiant(t7); }
static int sqrtmod(giant x, curveParams *cp) /* If Sqrt[x] (mod p) exists, function returns 1, else 0. In either case x is modified, but if 1 is returned, x:= Sqrt[x] (mod p). */ { int rtn; giant t0 = borrowGiant(cp->maxDigits); giant t1 = borrowGiant(cp->maxDigits); giant t2 = borrowGiant(cp->maxDigits); giant t3 = borrowGiant(cp->maxDigits); giant t4 = borrowGiant(cp->maxDigits); giant p = cp->basePrime; feemod(cp, x); /* Justify the argument. */ gtog(x, t0); /* Store x for eventual validity check on square root. */ if((p->n[0] & 3) == 3) { /* The case p = 3 (mod 4). */ gtog(p, t1); iaddg(1, t1); gshiftright(2, t1); powermodg(x, t1, cp); goto resolve; } /* Next, handle case p = 5 (mod 8). */ if((p->n[0] & 7) == 5) { gtog(p, t1); int_to_giant(1, t2); subg(t2, t1); gshiftright(2, t1); gtog(x, t2); powermodg(t2, t1, cp); /* t2 := x^((p-1)/4) % p. */ iaddg(1, t1); gshiftright(1, t1); /* t1 := (p+3)/8. */ if(isone(t2)) { powermodg(x, t1, cp); /* x^((p+3)/8) is root. */ goto resolve; } else { int_to_giant(1, t2); subg(t2, t1); /* t1 := (p-5)/8. */ gshiftleft(2,x); powermodg(x, t1, cp); mulg(t0, x); addg(x, x); feemod(cp, x); /* 2x (4x)^((p-5)/8. */ goto resolve; } } /* Next, handle tougher case: p = 1 (mod 8). */ int_to_giant(2, t1); while(1) { /* Find appropriate nonresidue. */ gtog(t1, t2); gsquare(t2); subg(x, t2); feemod(cp, t2); if(jacobi_symbol(t2, cp) == -1) break; iaddg(1, t1); } /* t2 is now w^2 in F_p^2. */ int_to_giant(1, t3); gtog(p, t4); iaddg(1, t4); gshiftright(1, t4); powFp2(t1, t3, t2, t4, cp); gtog(t1, x); resolve: gtog(x,t1); gsquare(t1); feemod(cp, t1); if(gcompg(t0, t1) == 0) { rtn = 1; /* Success. */ } else { rtn = 0; /* no square root */ } returnGiant(t0); returnGiant(t1); returnGiant(t2); returnGiant(t3); returnGiant(t4); return rtn; }