/* Galbraith & Scott Method */
static void gs(BIG u[4],BIG e)
{
int i,j;
BIG v[4],t,q;
DBIG d;
BIG_rcopy(q,CURVE_Order);
for (i=0;i<4;i++)
{
BIG_rcopy(t,CURVE_WB[i]);
BIG_mul(d,t,e);
BIG_ddiv(v[i],d,q);
BIG_zero(u[i]);
}
BIG_copy(u[0],e);
for (i=0;i<4;i++)
for (j=0;j<4;j++)
{
BIG_rcopy(t,CURVE_BB[j][i]);
BIG_modmul(t,v[j],t,q);
BIG_add(u[i],u[i],q);
BIG_sub(u[i],u[i],t);
BIG_mod(u[i],q);
}
return;
}
/* Galbraith & Scott Method */
static void gs(BIG u[4],BIG e)
{
int i;
#if CHOICE<BLS_CURVES
int j;
BIG v[4],t,q;
DBIG d;
BIG_rcopy(q,CURVE_Order);
for (i=0; i<4; i++)
{
BIG_rcopy(t,CURVE_WB[i]);
//BIG_norm(t); BIG_norm(e);
BIG_mul(d,t,e);
BIG_ddiv(v[i],d,q);
BIG_zero(u[i]);
}
BIG_copy(u[0],e);
for (i=0; i<4; i++)
for (j=0; j<4; j++)
{
BIG_rcopy(t,CURVE_BB[j][i]);
BIG_modmul(t,v[j],t,q);
BIG_add(u[i],u[i],q);
BIG_sub(u[i],u[i],t);
BIG_mod(u[i],q);
}
#else
BIG x,w;
BIG_rcopy(x,CURVE_Bnx);
BIG_copy(w,e);
for (i=0; i<4; i++)
{
BIG_copy(u[i],w);
BIG_mod(u[i],x);
BIG_sdiv(w,x);
}
#endif
return;
}
/* GLV method */
static void glv(BIG u[2],BIG e)
{
#if CHOICE<BLS_CURVES
int i,j;
BIG v[2],t,q;
DBIG d;
BIG_rcopy(q,CURVE_Order);
for (i=0; i<2; i++)
{
BIG_rcopy(t,CURVE_W[i]);
//BIG_norm(t); BIG_norm(e);
BIG_mul(d,t,e);
BIG_ddiv(v[i],d,q);
BIG_zero(u[i]);
}
BIG_copy(u[0],e);
for (i=0; i<2; i++)
for (j=0; j<2; j++)
{
BIG_rcopy(t,CURVE_SB[j][i]);
BIG_modmul(t,v[j],t,q);
BIG_add(u[i],u[i],q);
BIG_sub(u[i],u[i],t);
BIG_mod(u[i],q);
}
#else
// -(x^2).P = (Beta.x,y)
BIG x,x2,q;
BIG_rcopy(x,CURVE_Bnx);
BIG_smul(x2,x,x);
BIG_copy(u[0],e);
BIG_mod(u[0],x2);
BIG_copy(u[1],e);
BIG_sdiv(u[1],x2);
BIG_rcopy(q,CURVE_Order);
BIG_sub(u[1],q,u[1]);
#endif
return;
}
/* Multiply P by e in group G1 */
void PAIR_G1mul(ECP *P,BIG e)
{
#ifdef USE_GLV /* Note this method is patented */
int i,np,nn;
ECP Q;
BIG cru,t,q;
BIG u[2];
BIG_rcopy(q,CURVE_Order);
glv(u,e);
ECP_affine(P);
ECP_copy(&Q,P);
BIG_rcopy(cru,CURVE_Cru);
FP_nres(cru);
FP_mul(Q.x,Q.x,cru);
/* note that -a.B = a.(-B). Use a or -a depending on which is smaller */
np=BIG_nbits(u[0]);
BIG_modneg(t,u[0],q);
nn=BIG_nbits(t);
if (nn<np)
{
BIG_copy(u[0],t);
ECP_neg(P);
}
np=BIG_nbits(u[1]);
BIG_modneg(t,u[1],q);
nn=BIG_nbits(t);
if (nn<np)
{
BIG_copy(u[1],t);
ECP_neg(&Q);
}
ECP_mul2(P,&Q,u[0],u[1]);
#else
ECP_mul(P,e);
#endif
}
/* maps a random u to a point on the curve */
static void map(ECP *P,BIG u,int cb)
{
BIG x,q;
BIG_rcopy(q,Modulus);
BIG_copy(x,u);
BIG_mod(x,q);
while (!ECP_setx(P,x,cb))
BIG_inc(x,1);
}
/* SU= 64 */
void BIG_toBytes(char *b,BIG a)
{
int i;
BIG c;
BIG_norm(a);
BIG_copy(c,a);
for (i=MODBYTES-1;i>=0;i--)
{
b[i]=c[0]&0xff;
BIG_fshr(c,8);
}
}
/* SU= 200 */
void FP4_times_i(FP4 *w)
{
BIG z;
FP2 s,t;
#if CHUNK<64
FP4_norm(w);
#endif
FP2_copy(&t,&(w->b));
FP2_copy(&s,&t);
BIG_copy(z,s.a);
FP_neg(s.a,s.b);
BIG_copy(s.b,z);
FP2_add(&t,&t,&s);
#if CHUNK<64
FP2_norm(&t);
#endif
FP2_copy(&(w->b),&(w->a));
FP2_copy(&(w->a),&t);
}
/* output a */
void BIG_output(BIG a)
{
BIG b;
int i,len;
len=BIG_nbits(a);
if (len%4==0) len/=4;
else {len/=4; len++;}
if (len<MODBYTES*2) len=MODBYTES*2;
for (i=len-1;i>=0;i--)
{
BIG_copy(b,a);
BIG_shr(b,i*4);
printf("%01x",(unsigned int)(b[0]&15));
}
}
/* Multiply P by e in group G2 */
void PAIR_G2mul(ECP2 *P,BIG e)
{
#ifdef USE_GS_G2 /* Well I didn't patent it :) */
int i,np,nn;
ECP2 Q[4];
FP2 X;
BIG x,y;
BIG u[4];
BIG_rcopy(x,CURVE_Fra);
BIG_rcopy(y,CURVE_Frb);
FP2_from_BIGs(&X,x,y);
BIG_rcopy(y,CURVE_Order);
gs(u,e);
ECP2_affine(P);
ECP2_copy(&Q[0],P);
for (i=1; i<4; i++)
{
ECP2_copy(&Q[i],&Q[i-1]);
ECP2_frob(&Q[i],&X);
}
for (i=0; i<4; i++)
{
np=BIG_nbits(u[i]);
BIG_modneg(x,u[i],y);
nn=BIG_nbits(x);
if (nn<np)
{
BIG_copy(u[i],x);
ECP2_neg(&Q[i]);
}
}
ECP2_mul4(P,Q,u);
#else
ECP2_mul(P,e);
#endif
}
/* returns u derived from P. Random value in range 1 to return value should then be added to u */
static int unmap(BIG u,int *cb,ECP *P)
{
int s,r=0;
BIG x;
s=ECP_get(x,x,P);
BIG_copy(u,x);
do
{
BIG_dec(u,1);
r++;
}
while (!ECP_setx(P,u,s));
ECP_setx(P,x,s);
*cb=s;
return r;
}
/* r=x^n using XTR method on traces of FP12s */
void FP4_xtr_pow(FP4 *r,FP4 *x,BIG n)
{
int i,par,nb;
BIG v;
FP2 w;
FP4 t,a,b,c;
BIG_zero(v); BIG_inc(v,3);
FP2_from_BIG(&w,v);
FP4_from_FP2(&a,&w);
FP4_copy(&b,x);
FP4_xtr_D(&c,x);
BIG_norm(n); par=BIG_parity(n); BIG_copy(v,n); BIG_shr(v,1);
if (par==0) {BIG_dec(v,1); BIG_norm(v);}
nb=BIG_nbits(v);
for (i=nb-1;i>=0;i--)
{
if (!BIG_bit(v,i))
{
FP4_copy(&t,&b);
FP4_conj(x,x);
FP4_conj(&c,&c);
FP4_xtr_A(&b,&a,&b,x,&c);
FP4_conj(x,x);
FP4_xtr_D(&c,&t);
FP4_xtr_D(&a,&a);
}
else
{
FP4_conj(&t,&a);
FP4_xtr_D(&a,&b);
FP4_xtr_A(&b,&c,&b,x,&t);
FP4_xtr_D(&c,&c);
}
}
if (par==0) FP4_copy(r,&c);
else FP4_copy(r,&b);
FP4_reduce(r);
}
/* f=f^e */
void PAIR_GTpow(FP12 *f,BIG e)
{
#ifdef USE_GS_GT /* Note that this option requires a lot of RAM! Maybe better to use compressed XTR method, see fp4.c */
int i,np,nn;
FP12 g[4];
FP2 X;
BIG t,q,x,y;
BIG u[4];
BIG_rcopy(x,CURVE_Fra);
BIG_rcopy(y,CURVE_Frb);
FP2_from_BIGs(&X,x,y);
BIG_rcopy(q,CURVE_Order);
gs(u,e);
FP12_copy(&g[0],f);
for (i=1; i<4; i++)
{
FP12_copy(&g[i],&g[i-1]);
FP12_frob(&g[i],&X);
}
for (i=0; i<4; i++)
{
np=BIG_nbits(u[i]);
BIG_modneg(t,u[i],q);
nn=BIG_nbits(t);
if (nn<np)
{
BIG_copy(u[i],t);
FP12_conj(&g[i],&g[i]);
}
}
FP12_pow4(f,g,u);
#else
FP12_pow(f,f,e);
#endif
}
/* SU= 240 */
void FP4_pow(FP4 *r,FP4* a,BIG b)
{
FP4 w;
BIG z,zilch;
int bt;
BIG_zero(zilch);
BIG_norm(b);
BIG_copy(z,b);
FP4_copy(&w,a);
FP4_one(r);
while(1)
{
bt=BIG_parity(z);
BIG_shr(z,1);
if (bt) FP4_mul(r,r,&w);
if (BIG_comp(z,zilch)==0) break;
FP4_sqr(&w,&w);
}
FP4_reduce(r);
}
/* Convert g to octet string w */
void FP12_toOctet(octet *W,FP12 *g)
{
BIG a;
W->len=12*MODBYTES;
BIG_copy(a,(*g).a.a.a); FP_redc(a); BIG_toBytes(&(W->val[0]),a);
BIG_copy(a,(*g).a.a.b); FP_redc(a); BIG_toBytes(&(W->val[MODBYTES]),a);
BIG_copy(a,(*g).a.b.a); FP_redc(a); BIG_toBytes(&(W->val[2*MODBYTES]),a);
BIG_copy(a,(*g).a.b.b); FP_redc(a); BIG_toBytes(&(W->val[3*MODBYTES]),a);
BIG_copy(a,(*g).b.a.a); FP_redc(a); BIG_toBytes(&(W->val[4*MODBYTES]),a);
BIG_copy(a,(*g).b.a.b); FP_redc(a); BIG_toBytes(&(W->val[5*MODBYTES]),a);
BIG_copy(a,(*g).b.b.a); FP_redc(a); BIG_toBytes(&(W->val[6*MODBYTES]),a);
BIG_copy(a,(*g).b.b.b); FP_redc(a); BIG_toBytes(&(W->val[7*MODBYTES]),a);
BIG_copy(a,(*g).c.a.a); FP_redc(a); BIG_toBytes(&(W->val[8*MODBYTES]),a);
BIG_copy(a,(*g).c.a.b); FP_redc(a); BIG_toBytes(&(W->val[9*MODBYTES]),a);
BIG_copy(a,(*g).c.b.a); FP_redc(a); BIG_toBytes(&(W->val[10*MODBYTES]),a);
BIG_copy(a,(*g).c.b.b); FP_redc(a); BIG_toBytes(&(W->val[11*MODBYTES]),a);
}
/* r=ck^a.cl^n using XTR double exponentiation method on traces of FP12s. See Stam thesis. */
void FP4_xtr_pow2(FP4 *r,FP4 *ck,FP4 *cl,FP4 *ckml,FP4 *ckm2l,BIG a,BIG b)
{
int i,f2,nb;
BIG d,e,w;
FP4 t,cu,cv,cumv,cum2v;
BIG_norm(a);
BIG_norm(b);
BIG_copy(e,a);
BIG_copy(d,b);
FP4_copy(&cu,ck);
FP4_copy(&cv,cl);
FP4_copy(&cumv,ckml);
FP4_copy(&cum2v,ckm2l);
f2=0;
while (BIG_parity(d)==0 && BIG_parity(e)==0)
{
BIG_shr(d,1);
BIG_shr(e,1);
f2++;
}
while (BIG_comp(d,e)!=0)
{
if (BIG_comp(d,e)>0)
{
BIG_imul(w,e,4); BIG_norm(w);
if (BIG_comp(d,w)<=0)
{
BIG_copy(w,d);
BIG_copy(d,e);
BIG_sub(e,w,e); BIG_norm(e);
FP4_xtr_A(&t,&cu,&cv,&cumv,&cum2v);
FP4_conj(&cum2v,&cumv);
FP4_copy(&cumv,&cv);
FP4_copy(&cv,&cu);
FP4_copy(&cu,&t);
}
else if (BIG_parity(d)==0)
{
BIG_shr(d,1);
FP4_conj(r,&cum2v);
FP4_xtr_A(&t,&cu,&cumv,&cv,r);
FP4_xtr_D(&cum2v,&cumv);
FP4_copy(&cumv,&t);
FP4_xtr_D(&cu,&cu);
}
else if (BIG_parity(e)==1)
{
BIG_sub(d,d,e); BIG_norm(d);
BIG_shr(d,1);
FP4_xtr_A(&t,&cu,&cv,&cumv,&cum2v);
FP4_xtr_D(&cu,&cu);
FP4_xtr_D(&cum2v,&cv);
FP4_conj(&cum2v,&cum2v);
FP4_copy(&cv,&t);
}
else
{
BIG_copy(w,d);
BIG_copy(d,e); BIG_shr(d,1);
BIG_copy(e,w);
FP4_xtr_D(&t,&cumv);
FP4_conj(&cumv,&cum2v);
FP4_conj(&cum2v,&t);
FP4_xtr_D(&t,&cv);
FP4_copy(&cv,&cu);
FP4_copy(&cu,&t);
}
}
if (BIG_comp(d,e)<0)
{
BIG_imul(w,d,4); BIG_norm(w);
if (BIG_comp(e,w)<=0)
{
BIG_sub(e,e,d); BIG_norm(e);
FP4_xtr_A(&t,&cu,&cv,&cumv,&cum2v);
FP4_copy(&cum2v,&cumv);
FP4_copy(&cumv,&cu);
FP4_copy(&cu,&t);
}
else if (BIG_parity(e)==0)
{
BIG_copy(w,d);
BIG_copy(d,e); BIG_shr(d,1);
BIG_copy(e,w);
FP4_xtr_D(&t,&cumv);
FP4_conj(&cumv,&cum2v);
FP4_conj(&cum2v,&t);
FP4_xtr_D(&t,&cv);
FP4_copy(&cv,&cu);
FP4_copy(&cu,&t);
}
else if (BIG_parity(d)==1)
{
BIG_copy(w,e);
BIG_copy(e,d);
BIG_sub(w,w,d); BIG_norm(w);
BIG_copy(d,w); BIG_shr(d,1);
FP4_xtr_A(&t,&cu,&cv,&cumv,&cum2v);
FP4_conj(&cumv,&cumv);
FP4_xtr_D(&cum2v,&cu);
FP4_conj(&cum2v,&cum2v);
FP4_xtr_D(&cu,&cv);
FP4_copy(&cv,&t);
}
else
{
BIG_shr(d,1);
FP4_conj(r,&cum2v);
FP4_xtr_A(&t,&cu,&cumv,&cv,r);
FP4_xtr_D(&cum2v,&cumv);
FP4_copy(&cumv,&t);
FP4_xtr_D(&cu,&cu);
}
}
}
FP4_xtr_A(r,&cu,&cv,&cumv,&cum2v);
for (i=0;i<f2;i++) FP4_xtr_D(r,r);
FP4_xtr_pow(r,r,d);
}
/* Optimal R-ate pairing r=e(P,Q) */
void PAIR_ate(FP12 *r,ECP2 *P,ECP *Q)
{
FP2 X;
BIG x,n,Qx,Qy;
int i,nb;
ECP2 A,KA;
FP12 lv;
BIG_rcopy(Qx,CURVE_Fra);
BIG_rcopy(Qy,CURVE_Frb);
FP2_from_BIGs(&X,Qx,Qy);
BIG_rcopy(x,CURVE_Bnx);
BIG_pmul(n,x,6);
BIG_dec(n,2);
BIG_norm(n);
ECP2_affine(P);
ECP_affine(Q);
BIG_copy(Qx,Q->x);
BIG_copy(Qy,Q->y);
ECP2_copy(&A,P);
FP12_one(r);
nb=BIG_nbits(n);
/* Main Miller Loop */
for (i=nb-2;i>=1;i--)
{
PAIR_line(&lv,&A,&A,Qx,Qy);
FP12_smul(r,&lv);
if (BIG_bit(n,i))
{
PAIR_line(&lv,&A,P,Qx,Qy);
FP12_smul(r,&lv);
}
FP12_sqr(r,r);
}
PAIR_line(&lv,&A,&A,Qx,Qy);
FP12_smul(r,&lv);
/* R-ate fixup */
ECP2_copy(&KA,P);
ECP2_frob(&KA,&X);
ECP2_neg(&A);
FP12_conj(r,r);
PAIR_line(&lv,&A,&KA,Qx,Qy);
FP12_smul(r,&lv);
ECP2_frob(&KA,&X);
ECP2_neg(&KA);
PAIR_line(&lv,&A,&KA,Qx,Qy);
FP12_smul(r,&lv);
}
/* Optimal R-ate pairing r=e(P,Q) */
void PAIR_ate(FP12 *r,ECP2 *P,ECP *Q)
{
FP2 X;
BIG x,n,Qx,Qy;
int i,nb;
ECP2 A;
FP12 lv;
#if CHOICE<BLS_CURVES
ECP2 KA;
#endif
BIG_rcopy(Qx,CURVE_Fra);
BIG_rcopy(Qy,CURVE_Frb);
FP2_from_BIGs(&X,Qx,Qy);
BIG_rcopy(x,CURVE_Bnx);
#if CHOICE<BLS_CURVES
BIG_pmul(n,x,6);
BIG_dec(n,2);
#else
BIG_copy(n,x);
#endif
BIG_norm(n);
ECP2_affine(P);
ECP_affine(Q);
BIG_copy(Qx,Q->x);
BIG_copy(Qy,Q->y);
ECP2_copy(&A,P);
FP12_one(r);
nb=BIG_nbits(n);
/* Main Miller Loop */
for (i=nb-2; i>=1; i--)
{
PAIR_line(&lv,&A,&A,Qx,Qy);
FP12_smul(r,&lv);
if (BIG_bit(n,i))
{
PAIR_line(&lv,&A,P,Qx,Qy);
FP12_smul(r,&lv);
}
FP12_sqr(r,r);
}
PAIR_line(&lv,&A,&A,Qx,Qy);
FP12_smul(r,&lv);
if (BIG_parity(n))
{
PAIR_line(&lv,&A,P,Qx,Qy);
FP12_smul(r,&lv);
}
/* R-ate fixup required for BN curves */
#if CHOICE<BLS_CURVES
ECP2_copy(&KA,P);
ECP2_frob(&KA,&X);
ECP2_neg(&A);
FP12_conj(r,r);
PAIR_line(&lv,&A,&KA,Qx,Qy);
FP12_smul(r,&lv);
ECP2_frob(&KA,&X);
ECP2_neg(&KA);
PAIR_line(&lv,&A,&KA,Qx,Qy);
FP12_smul(r,&lv);
#endif
}
void FP12_pow4(FP12 *p,FP12 *q,BIG u[4])
{
int i,j,a[4],nb,m;
FP12 g[8],c,s[2];
BIG t[4],mt;
sign8 w[NLEN*BASEBITS+1];
for (i=0;i<4;i++)
BIG_copy(t[i],u[i]);
FP12_copy(&g[0],&q[0]); FP12_conj(&s[0],&q[1]); FP12_mul(&g[0],&s[0]); /* P/Q */
FP12_copy(&g[1],&g[0]);
FP12_copy(&g[2],&g[0]);
FP12_copy(&g[3],&g[0]);
FP12_copy(&g[4],&q[0]); FP12_mul(&g[4],&q[1]); /* P*Q */
FP12_copy(&g[5],&g[4]);
FP12_copy(&g[6],&g[4]);
FP12_copy(&g[7],&g[4]);
FP12_copy(&s[1],&q[2]); FP12_conj(&s[0],&q[3]); FP12_mul(&s[1],&s[0]); /* R/S */
FP12_conj(&s[0],&s[1]); FP12_mul(&g[1],&s[0]);
FP12_mul(&g[2],&s[1]);
FP12_mul(&g[5],&s[0]);
FP12_mul(&g[6],&s[1]);
FP12_copy(&s[1],&q[2]); FP12_mul(&s[1],&q[3]); /* R*S */
FP12_conj(&s[0],&s[1]); FP12_mul(&g[0],&s[0]);
FP12_mul(&g[3],&s[1]);
FP12_mul(&g[4],&s[0]);
FP12_mul(&g[7],&s[1]);
/* if power is even add 1 to power, and add q to correction */
FP12_one(&c);
BIG_zero(mt);
for (i=0;i<4;i++)
{
if (BIG_parity(t[i])==0)
{
BIG_inc(t[i],1); BIG_norm(t[i]);
FP12_mul(&c,&q[i]);
}
BIG_add(mt,mt,t[i]); BIG_norm(mt);
}
FP12_conj(&c,&c);
nb=1+BIG_nbits(mt);
/* convert exponent to signed 1-bit window */
for (j=0;j<nb;j++)
{
for (i=0;i<4;i++)
{
a[i]=BIG_lastbits(t[i],2)-2;
BIG_dec(t[i],a[i]); BIG_norm(t[i]);
BIG_fshr(t[i],1);
}
w[j]=8*a[0]+4*a[1]+2*a[2]+a[3];
}
w[nb]=8*BIG_lastbits(t[0],2)+4*BIG_lastbits(t[1],2)+2*BIG_lastbits(t[2],2)+BIG_lastbits(t[3],2);
FP12_copy(p,&g[(w[nb]-1)/2]);
for (i=nb-1;i>=0;i--)
{
m=w[i]>>7;
j=(w[i]^m)-m; /* j=abs(w[i]) */
j=(j-1)/2;
FP12_copy(&s[0],&g[j]);
FP12_conj(&s[1],&g[j]);
FP12_usqr(p,p);
FP12_mul(p,&s[m&1]);
}
FP12_mul(p,&c); /* apply correction */
FP12_reduce(p);
}
