Line data Source code
1 : #ifndef HEADER_fd_src_ballet_ed25519_fd_curve25519_h
2 : #error "Do not include this directly; use fd_curve25519.h"
3 : #endif
4 :
5 : /* fd_curve25519.h provides the public Curve25519 API.
6 :
7 : Most operations in this API should be assumed to take a variable
8 : amount of time depending on inputs. (And thus should not be exposed
9 : to secret data).
10 :
11 : Const time operations are made explicit, see fd_curve25519_secure.c */
12 :
13 : #include "../../fd_ballet_base.h"
14 : #include "../fd_f25519.h"
15 : #include "../fd_curve25519_scalar.h"
16 : #include "./fd_r43x6_ge.h"
17 :
18 : /* struct fd_curve25519_edwards (aka fd_curve25519_edwards_t) represents
19 : a point in Extended Twisted Edwards Coordinates.
20 : https://eprint.iacr.org/2008/522 */
21 : struct fd_curve25519_edwards {
22 : FD_R43X6_QUAD_DECL( P ) __attribute__((aligned(FD_F25519_ALIGN)));
23 : };
24 : typedef struct fd_curve25519_edwards fd_curve25519_edwards_t;
25 :
26 : typedef fd_curve25519_edwards_t fd_ed25519_point_t;
27 : typedef fd_curve25519_edwards_t fd_ristretto255_point_t;
28 :
29 : /* A decode in progress, see fd_ed25519_point_decode_init */
30 :
31 : typedef fd_r43x6_ge_decode_t fd_ed25519_point_decode_t;
32 :
33 : #include "../table/fd_curve25519_table_avx512.c"
34 :
35 : FD_PROTOTYPES_BEGIN
36 :
37 : /* fd_ed25519_point_set sets r = 0 (point at infinity). */
38 : FD_25519_INLINE fd_ed25519_point_t *
39 236448 : fd_ed25519_point_set_zero( fd_ed25519_point_t * r ) {
40 236448 : FD_R43X6_GE_ZERO( r->P );
41 236448 : return r;
42 236448 : }
43 :
44 : /* fd_ed25519_point_set_zero_precomputed sets r = 0 (point at infinity). */
45 : FD_25519_INLINE fd_ed25519_point_t *
46 5854785 : fd_ed25519_point_set_zero_precomputed( fd_ed25519_point_t * r ) {
47 5854785 : r->P03 = wwl( 1L,1L,1L,0L, 0L,0L,0L,0L ); r->P14 = wwl_zero(); r->P25 = wwl_zero();
48 5854785 : return r;
49 5854785 : }
50 :
51 : /* fd_ed25519_point_set sets r = a. */
52 : FD_25519_INLINE fd_ed25519_point_t * FD_FN_NO_ASAN
53 : fd_ed25519_point_set( fd_ed25519_point_t * r,
54 35876677 : fd_ed25519_point_t const * a ) {
55 35876677 : r->P03 = a->P03;
56 35876677 : r->P14 = a->P14;
57 35876677 : r->P25 = a->P25;
58 35876677 : return r;
59 35876677 : }
60 :
61 : /* fd_ed25519_point_from sets r = (x : y : z : t). */
62 : FD_25519_INLINE fd_ed25519_point_t *
63 : fd_ed25519_point_from( fd_ed25519_point_t * r,
64 : fd_f25519_t const * x,
65 : fd_f25519_t const * y,
66 : fd_f25519_t const * z,
67 241627 : fd_f25519_t const * t ) {
68 241627 : FD_R43X6_QUAD_PACK( r->P, x->el, y->el, z->el, t->el );
69 241627 : return r;
70 241627 : }
71 :
72 : /* fd_ed25519_point_from sets (x : y : z : t) = a. */
73 : FD_25519_INLINE void
74 : fd_ed25519_point_to( fd_f25519_t * x,
75 : fd_f25519_t * y,
76 : fd_f25519_t * z,
77 : fd_f25519_t * t,
78 431613 : fd_ed25519_point_t const * a ) {
79 431613 : FD_R43X6_QUAD_UNPACK( x->el, y->el, z->el, t->el, a->P );
80 431613 : }
81 :
82 : /* fd_ed25519_point_dbln computes r = 2^n a, and returns r.
83 : More efficient than n fd_ed25519_point_add. */
84 : FD_25519_INLINE fd_ed25519_point_t * FD_FN_NO_ASAN
85 : fd_ed25519_point_dbln( fd_ed25519_point_t * r,
86 : fd_ed25519_point_t const * a,
87 238258 : int n ) {
88 238258 : FD_R43X6_GE_DBL( r->P, a->P );
89 1676317 : for( uchar i=1; i<n; i++ ) {
90 1438059 : FD_R43X6_GE_DBL( r->P, r->P );
91 1438059 : }
92 238258 : return r;
93 238258 : }
94 :
95 : /* fd_ed25519_point_sub sets r = -a. */
96 : FD_25519_INLINE fd_ed25519_point_t *
97 : fd_ed25519_point_neg( fd_ed25519_point_t * r,
98 1067951 : fd_ed25519_point_t const * a ) {
99 : /* use p instead of zero to avoid mod reduction */
100 1067951 : FD_R43X6_QUAD_DECL( _p );
101 1067951 : _p03 = wwl( 8796093022189L, 8796093022189L, 8796093022189L, 8796093022189L, 8796093022207L, 8796093022207L, 8796093022207L, 8796093022207L );
102 1067951 : _p14 = wwl( 8796093022207L, 8796093022207L, 8796093022207L, 8796093022207L, 8796093022207L, 8796093022207L, 8796093022207L, 8796093022207L );
103 1067951 : _p25 = wwl( 8796093022207L, 8796093022207L, 8796093022207L, 8796093022207L, 1099511627775L, 1099511627775L, 1099511627775L, 1099511627775L );
104 1067951 : FD_R43X6_QUAD_LANE_SUB_FAST( r->P, a->P, 1,0,0,1, _p, a->P );
105 1067951 : FD_R43X6_QUAD_FOLD_UNSIGNED( r->P, r->P );
106 1067951 : return r;
107 1067951 : }
108 :
109 : /* fd_ed25519_point_is_zero returns 1 if a == 0 (point at infinity), 0 otherwise. */
110 : FD_25519_INLINE int
111 0 : fd_ed25519_point_is_zero( fd_ed25519_point_t const * a ) {
112 0 : fd_ed25519_point_t zero[1];
113 0 : fd_ed25519_point_set_zero( zero );
114 0 : return FD_R43X6_GE_IS_EQ( a->P, zero->P );
115 0 : }
116 :
117 : /* fd_ed25519_point_eq returns 1 if a == b, 0 otherwise. */
118 : FD_25519_INLINE int
119 : fd_ed25519_point_eq( fd_ed25519_point_t const * a,
120 122021 : fd_ed25519_point_t const * b ) {
121 122021 : return FD_R43X6_GE_IS_EQ( a->P, b->P );
122 122021 : }
123 :
124 : /* fd_ed25519_point_eq returns 1 if a == b, 0 otherwise.
125 : b is a point with Z==1, e.g. a decompressed point. */
126 : FD_25519_INLINE int
127 : fd_ed25519_point_eq_z1( fd_ed25519_point_t const * a,
128 120020 : fd_ed25519_point_t const * b ) { /* b.Z == 1, e.g. a decompressed point */
129 120020 : return fd_ed25519_point_eq( a, b );
130 120020 : }
131 :
132 : FD_25519_INLINE void
133 1355153 : fd_curve25519_into_precomputed( fd_ed25519_point_t * r ) {
134 1355153 : FD_R43X6_QUAD_DECL ( _ta );
135 1355153 : FD_R43X6_QUAD_PERMUTE ( _ta, 1,0,2,3, r->P ); /* _ta = (Y1, X1, Z1, T1 ), s61|s61|s61|s61 */
136 1355153 : FD_R43X6_QUAD_LANE_SUB_FAST( _ta, _ta, 1,0,0,0, _ta, r->P ); /* _ta = (Y1-X1,X1, Z1, T1 ), s62|s61|s61|s61 */
137 1355153 : FD_R43X6_QUAD_LANE_ADD_FAST( _ta, _ta, 0,1,0,0, _ta, r->P ); /* _ta = (Y1-X1,Y1+X1,Z1, T1 ), s62|s62|s61|s61 */
138 1355153 : FD_R43X6_QUAD_FOLD_SIGNED ( r->P, _ta ); /* r = (Y1-X1,Y1+X1,Z1, T1 ), u44|u44|u44|u44 */
139 :
140 1355153 : FD_R43X6_QUAD_DECL ( _1112d );
141 1355153 : FD_R43X6_QUAD_1112d ( _1112d );
142 1355153 : FD_R43X6_QUAD_MUL_FAST ( r->P, r->P, _1112d );
143 : FD_R43X6_QUAD_FOLD_UNSIGNED( r->P, r->P );
144 1355153 : }
145 :
146 : FD_PROTOTYPES_END
|
