_ "embed"
"errors"
"math/bits"
+ "unsafe"
)
-//go:embed p256_asm_table.bin
-var p256Precomputed string
+// p256Element is a P-256 base field element in [0, P-1] in the Montgomery
+// domain (with R 2²⁵⁶) as four limbs in little-endian order value.
+type p256Element [4]uint64
+
+// p256One is one in the Montgomery domain.
+var p256One = p256Element{0x0000000000000001, 0xffffffff00000000,
+ 0xffffffffffffffff, 0x00000000fffffffe}
+
+var p256Zero = p256Element{}
-// P256Point is a P-256 point. The zero value is NOT valid.
+// p256P is 2²⁵⁶ - 2²²⁴ + 2¹⁹² + 2⁹⁶ - 1 in the Montgomery domain.
+var p256P = p256Element{0xffffffffffffffff, 0x00000000ffffffff,
+ 0x0000000000000000, 0xffffffff00000001}
+
+// P256Point is a P-256 point. The zero value should not be assumed to be valid
+// (although it is in this implementation).
type P256Point struct {
- xyz [12]uint64
+ // (X:Y:Z) are Jacobian coordinates where x = X/Z² and y = Y/Z³. The point
+ // at infinity can be represented by any set of coordinates with Z = 0.
+ x, y, z p256Element
}
-// NewP256Point returns a new P256Point representing the point at infinity point.
+// NewP256Point returns a new P256Point representing the point at infinity.
func NewP256Point() *P256Point {
- return &P256Point{[12]uint64{
- 0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
- 0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
- 0, 0, 0, 0,
- }}
+ return &P256Point{
+ x: p256One, y: p256One, z: p256Zero,
+ }
}
// NewP256Generator returns a new P256Point set to the canonical generator.
func NewP256Generator() *P256Point {
- return &P256Point{[12]uint64{
- 0x79e730d418a9143c, 0x75ba95fc5fedb601, 0x79fb732b77622510, 0x18905f76a53755c6,
- 0xddf25357ce95560a, 0x8b4ab8e4ba19e45c, 0xd2e88688dd21f325, 0x8571ff1825885d85,
- 0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe,
- }}
+ return &P256Point{
+ x: p256Element{0x79e730d418a9143c, 0x75ba95fc5fedb601,
+ 0x79fb732b77622510, 0x18905f76a53755c6},
+ y: p256Element{0xddf25357ce95560a, 0x8b4ab8e4ba19e45c,
+ 0xd2e88688dd21f325, 0x8571ff1825885d85},
+ z: p256One,
+ }
}
// Set sets p = q and returns p.
func (p *P256Point) Set(q *P256Point) *P256Point {
- p.xyz = q.xyz
+ p.x, p.y, p.z = q.x, q.y, q.z
return p
}
// Uncompressed form.
case len(b) == p256UncompressedLength && b[0] == 4:
var r P256Point
- p256BigToLittle(r.xyz[0:4], b[1:33])
- p256BigToLittle(r.xyz[4:8], b[33:65])
- if p256LessThanP(r.xyz[0:4]) == 0 || p256LessThanP(r.xyz[4:8]) == 0 {
+ p256BigToLittle(&r.x, (*[32]byte)(b[1:33]))
+ p256BigToLittle(&r.y, (*[32]byte)(b[33:65]))
+ if p256LessThanP(&r.x) == 0 || p256LessThanP(&r.y) == 0 {
return nil, errors.New("invalid P256 element encoding")
}
- p256Mul(r.xyz[0:4], r.xyz[0:4], rr[:])
- p256Mul(r.xyz[4:8], r.xyz[4:8], rr[:])
- if err := p256CheckOnCurve(r.xyz[0:4], r.xyz[4:8]); err != nil {
+ // p256Mul operates in the Montgomery domain with R = 2²⁵⁶ mod p. Thus rr
+ // here is R in the Montgomery domain, or R×R mod p. See comment in
+ // P256OrdInverse about how this is used.
+ rr := p256Element{0x0000000000000003, 0xfffffffbffffffff,
+ 0xfffffffffffffffe, 0x00000004fffffffd}
+ p256Mul(&r.x, &r.x, &rr)
+ p256Mul(&r.y, &r.y, &rr)
+ if err := p256CheckOnCurve(&r.x, &r.y); err != nil {
return nil, err
}
- // This sets r's Z value to 1, in the Montgomery domain.
- r.xyz[8] = 0x0000000000000001
- r.xyz[9] = 0xffffffff00000000
- r.xyz[10] = 0xffffffffffffffff
- r.xyz[11] = 0x00000000fffffffe
+ r.z = p256One
return p.Set(&r), nil
// Compressed form.
}
}
-func p256CheckOnCurve(x, y []uint64) error {
+func p256CheckOnCurve(x, y *p256Element) error {
// x³ - 3x + b
- x3 := make([]uint64, 4)
+ x3 := new(p256Element)
p256Sqr(x3, x, 1)
p256Mul(x3, x3, x)
- threeX := make([]uint64, 4)
+ threeX := new(p256Element)
p256Add(threeX, x, x)
p256Add(threeX, threeX, x)
p256NegCond(threeX, 1)
- p256B := []uint64{0xd89cdf6229c4bddf, 0xacf005cd78843090,
+ p256B := &p256Element{0xd89cdf6229c4bddf, 0xacf005cd78843090,
0xe5a220abf7212ed6, 0xdc30061d04874834}
p256Add(x3, x3, threeX)
p256Add(x3, x3, p256B)
// y² = x³ - 3x + b
- y2 := make([]uint64, 4)
+ y2 := new(p256Element)
p256Sqr(y2, y, 1)
- diff := (x3[0] ^ y2[0]) | (x3[1] ^ y2[1]) |
- (x3[2] ^ y2[2]) | (x3[3] ^ y2[3])
- if uint64IsZero(diff) != 1 {
+ if p256Equal(y2, x3) != 1 {
return errors.New("P256 point not on curve")
}
return nil
}
-var p256P = []uint64{0xffffffffffffffff, 0x00000000ffffffff,
- 0x0000000000000000, 0xffffffff00000001}
-
-// p256LessThanP returns 1 if x < p, and 0 otherwise.
-func p256LessThanP(x []uint64) int {
+// p256LessThanP returns 1 if x < p, and 0 otherwise. Note that a p256Element is
+// not allowed to be equal to or greater than p, so if this function returns 0
+// then x is invalid.
+func p256LessThanP(x *p256Element) int {
var b uint64
_, b = bits.Sub64(x[0], p256P[0], b)
_, b = bits.Sub64(x[1], p256P[1], b)
return int(b)
}
-func p256Add(res, x, y []uint64) {
+// p256Add sets res = x + y.
+func p256Add(res, x, y *p256Element) {
var c, b uint64
t1 := make([]uint64, 4)
t1[0], c = bits.Add64(x[0], y[0], 0)
res[3] = (t1[3] & ^t2Mask) | (t2[3] & t2Mask)
}
-// Functions implemented in p256_asm_*64.s
-// Montgomery multiplication modulo P256
+// The following assembly functions are implemented in p256_asm_*.s
+
+// Montgomery multiplication. Sets res = in1 * in2 * R⁻¹ mod p.
//
//go:noescape
-func p256Mul(res, in1, in2 []uint64)
+func p256Mul(res, in1, in2 *p256Element)
-// Montgomery square modulo P256, repeated n times (n >= 1)
+// Montgomery square, repeated n times (n >= 1).
//
//go:noescape
-func p256Sqr(res, in []uint64, n int)
+func p256Sqr(res, in *p256Element, n int)
-// Montgomery multiplication by 1
+// Montgomery multiplication by R⁻¹, or 1 outside the domain.
+// Sets res = in * R⁻¹, bringing res out of the Montgomery domain.
//
//go:noescape
-func p256FromMont(res, in []uint64)
+func p256FromMont(res, in *p256Element)
-// iff cond == 1 val <- -val
+// If cond is not 0, sets val = -val mod p.
//
//go:noescape
-func p256NegCond(val []uint64, cond int)
+func p256NegCond(val *p256Element, cond int)
-// if cond == 0 res <- b; else res <- a
+// If cond is 0, sets res = b, otherwise sets res = a.
//
//go:noescape
-func p256MovCond(res, a, b []uint64, cond int)
+func p256MovCond(res, a, b *P256Point, cond int)
+
+//go:noescape
+func p256BigToLittle(res *p256Element, in *[32]byte)
+
+//go:noescape
+func p256LittleToBig(res *[32]byte, in *p256Element)
-// Endianness swap
-//
//go:noescape
-func p256BigToLittle(res []uint64, in []byte)
+func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
//go:noescape
-func p256LittleToBig(res []byte, in []uint64)
+func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
-// Constant time table access
+// p256Table is a table of the first 16 multiples of a point. Points are stored
+// at an index offset of -1 so [8]P is at index 7, P is at 0, and [16]P is at 15.
+// [0]P is the point at infinity and it's not stored.
+type p256Table [16]P256Point
+
+// p256Select sets res to the point at index idx in the table.
+// idx must be in [0, 15]. It executes in constant time.
//
//go:noescape
-func p256Select(point, table []uint64, idx int)
+func p256Select(res *P256Point, table *p256Table, idx int)
+
+// p256AffinePoint is a point in affine coordinates (x, y). x and y are still
+// Montgomery domain elements. The point can't be the point at infinity.
+type p256AffinePoint struct {
+ x, y p256Element
+}
+
+// p256AffineTable is a table of the first 32 multiples of a point. Points are
+// stored at an index offset of -1 like in p256Table, and [0]P is not stored.
+type p256AffineTable [32]p256AffinePoint
+
+// p256Precomputed is a series of precomputed multiples of G, the canonical
+// generator. The first p256AffineTable contains multiples of G. The second one
+// multiples of [2⁶]G, the third one of [2¹²]G, and so on, where each successive
+// table is the previous table doubled six times. Six is the width of the
+// sliding window used in p256ScalarMult, and having each table already
+// pre-doubled lets us avoid the doublings between windows entirely. This table
+// MUST NOT be modified, as it aliases into p256PrecomputedEmbed below.
+var p256Precomputed *[43]p256AffineTable
+
+//go:embed p256_asm_table.bin
+var p256PrecomputedEmbed string
+
+func init() {
+ p256PrecomputedPtr := (*unsafe.Pointer)(unsafe.Pointer(&p256PrecomputedEmbed))
+ p256Precomputed = (*[43]p256AffineTable)(*p256PrecomputedPtr)
+}
+// p256SelectAffine sets res to the point at index idx in the table.
+// idx must be in [0, 31]. It executes in constant time.
+//
//go:noescape
-func p256SelectBase(point *[12]uint64, table string, idx int)
+func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
-// Montgomery multiplication modulo Ord(G)
+// Point addition with an affine point and constant time conditions.
+// If zero is 0, sets res = in2. If sel is 0, sets res = in1.
+// If sign is not 0, sets res = in1 + -in2. Otherwise, sets res = in1 + in2
//
//go:noescape
-func p256OrdMul(res, in1, in2 []uint64)
+func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
-// Montgomery square modulo Ord(G), repeated n times
+// Point addition. Sets res = in1 + in2. Returns one if the two input points
+// were equal and zero otherwise. If in1 or in2 are the point at infinity, res
+// and the return value are undefined.
//
//go:noescape
-func p256OrdSqr(res, in []uint64, n int)
+func p256PointAddAsm(res, in1, in2 *P256Point) int
-// Point add with in2 being affine point
-// If sign == 1 -> in2 = -in2
-// If sel == 0 -> res = in1
-// if zero == 0 -> res = in2
+// Point doubling. Sets res = in + in. in can be the point at infinity.
//
//go:noescape
-func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
+func p256PointDoubleAsm(res, in *P256Point)
+
+// p256OrdElement is a P-256 scalar field element in [0, ord(G)-1] in the
+// Montgomery domain (with R 2²⁵⁶) as four uint64 limbs in little-endian order.
+type p256OrdElement [4]uint64
-// Point add. Returns one if the two input points were equal and zero
-// otherwise. (Note that, due to the way that the equations work out, some
-// representations of ∞ are considered equal to everything by this function.)
+// Montgomery multiplication modulo org(G). Sets res = in1 * in2 * R⁻¹.
//
//go:noescape
-func p256PointAddAsm(res, in1, in2 []uint64) int
+func p256OrdMul(res, in1, in2 *p256OrdElement)
-// Point double
+// Montgomery square modulo org(G), repeated n times (n >= 1).
//
//go:noescape
-func p256PointDoubleAsm(res, in []uint64)
+func p256OrdSqr(res, in *p256OrdElement, n int)
func P256OrdInverse(k []byte) ([]byte, error) {
- // TODO: test for values p <= x < 2^256.
if len(k) != 32 {
return nil, errors.New("invalid scalar length")
}
- // table will store precomputed powers of x.
- var table [4 * 9]uint64
- var (
- _1 = table[4*0 : 4*1]
- _11 = table[4*1 : 4*2]
- _101 = table[4*2 : 4*3]
- _111 = table[4*3 : 4*4]
- _1111 = table[4*4 : 4*5]
- _10101 = table[4*5 : 4*6]
- _101111 = table[4*6 : 4*7]
- x = table[4*7 : 4*8]
- t = table[4*8 : 4*9]
- )
-
- p256BigToLittle(x, k)
- // This code operates in the Montgomery domain where R = 2^256 mod n
- // and n is the order of the scalar field. (See initP256 for the
- // value.) Elements in the Montgomery domain take the form a×R and
- // multiplication of x and y in the calculates (x × y × R^-1) mod n. RR
- // is R×R mod n thus the Montgomery multiplication x and RR gives x×R,
- // i.e. converts x into the Montgomery domain.
- // Window values borrowed from https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion
- RR := []uint64{0x83244c95be79eea2, 0x4699799c49bd6fa6, 0x2845b2392b6bec59, 0x66e12d94f3d95620}
+ x := new(p256OrdElement)
+ p256OrdBigToLittle(x, (*[32]byte)(k))
+
+ // Inversion is implemented as exponentiation by n - 2, per Fermat's little theorem.
+ //
+ // The sequence of 38 multiplications and 254 squarings is derived from
+ // https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion
+ _1 := new(p256OrdElement)
+ _11 := new(p256OrdElement)
+ _101 := new(p256OrdElement)
+ _111 := new(p256OrdElement)
+ _1111 := new(p256OrdElement)
+ _10101 := new(p256OrdElement)
+ _101111 := new(p256OrdElement)
+ t := new(p256OrdElement)
+
+ // This code operates in the Montgomery domain where R = 2²⁵⁶ mod n and n is
+ // the order of the scalar field. Elements in the Montgomery domain take the
+ // form a×R and p256OrdMul calculates (a × b × R⁻¹) mod n. RR is R in the
+ // domain, or R×R mod n, thus p256OrdMul(x, RR) gives x×R, i.e. converts x
+ // into the Montgomery domain.
+ RR := &p256OrdElement{0x83244c95be79eea2, 0x4699799c49bd6fa6,
+ 0x2845b2392b6bec59, 0x66e12d94f3d95620}
+
p256OrdMul(_1, x, RR) // _1
p256OrdSqr(x, _1, 1) // _10
p256OrdMul(_11, x, _1) // _11
p256OrdSqr(x, x, 32)
p256OrdMul(x, x, t)
- sqrs := []uint8{
+ sqrs := []int{
6, 5, 4, 5, 5,
4, 3, 3, 5, 9,
6, 2, 5, 6, 5,
4, 5, 5, 3, 10,
2, 5, 5, 3, 7, 6}
- muls := [][]uint64{
+ muls := []*p256OrdElement{
_101111, _111, _11, _1111, _10101,
_101, _101, _101, _111, _101111,
_1111, _1, _1, _1111, _111,
_11, _11, _11, _1, _10101, _1111}
for i, s := range sqrs {
- p256OrdSqr(x, x, int(s))
+ p256OrdSqr(x, x, s)
p256OrdMul(x, x, muls[i])
}
- // Multiplying by one in the Montgomery domain converts a Montgomery
- // value out of the domain.
- one := []uint64{1, 0, 0, 0}
+ // Montgomery multiplication by R⁻¹, or 1 outside the domain as R⁻¹×R = 1,
+ // converts a Montgomery value out of the domain.
+ one := &p256OrdElement{1}
p256OrdMul(x, x, one)
- xOut := make([]byte, 32)
- p256LittleToBig(xOut, x)
- return xOut, nil
+ var xOut [32]byte
+ p256OrdLittleToBig(&xOut, x)
+ return xOut[:], nil
}
-// p256Mul operates in a Montgomery domain with R = 2^256 mod p, where p is the
-// underlying field of the curve. (See initP256 for the value.) Thus rr here is
-// R×R mod p. See comment in Inverse about how this is used.
-var rr = []uint64{0x0000000000000003, 0xfffffffbffffffff, 0xfffffffffffffffe, 0x00000004fffffffd}
-
// Add sets q = p1 + p2, and returns q. The points may overlap.
func (q *P256Point) Add(r1, r2 *P256Point) *P256Point {
var sum, double P256Point
r1IsInfinity := r1.isInfinity()
r2IsInfinity := r2.isInfinity()
- pointsEqual := p256PointAddAsm(sum.xyz[:], r1.xyz[:], r2.xyz[:])
- p256PointDoubleAsm(double.xyz[:], r1.xyz[:])
- sum.Select(&double, &sum, pointsEqual)
- sum.Select(r1, &sum, r2IsInfinity)
- sum.Select(r2, &sum, r1IsInfinity)
+ pointsEqual := p256PointAddAsm(&sum, r1, r2)
+ p256PointDoubleAsm(&double, r1)
+ p256MovCond(&sum, &double, &sum, pointsEqual)
+ p256MovCond(&sum, r1, &sum, r2IsInfinity)
+ p256MovCond(&sum, r2, &sum, r1IsInfinity)
return q.Set(&sum)
}
// Double sets q = p + p, and returns q. The points may overlap.
func (q *P256Point) Double(p *P256Point) *P256Point {
var double P256Point
- p256PointDoubleAsm(double.xyz[:], p.xyz[:])
+ p256PointDoubleAsm(&double, p)
return q.Set(&double)
}
// endian value, and returns r. If scalar is not 32 bytes long, ScalarBaseMult
// returns an error and the receiver is unchanged.
func (r *P256Point) ScalarBaseMult(scalar []byte) (*P256Point, error) {
- // TODO: test for values p <= x < 2^256.
if len(scalar) != 32 {
return nil, errors.New("invalid scalar length")
}
- scalarReversed := make([]uint64, 4)
- p256BigToLittle(scalarReversed, scalar)
+ scalarReversed := new(p256OrdElement)
+ p256OrdBigToLittle(scalarReversed, (*[32]byte)(scalar))
r.p256BaseMult(scalarReversed)
return r, nil
// and returns r. If scalar is not 32 bytes long, ScalarBaseMult returns an
// error and the receiver is unchanged.
func (r *P256Point) ScalarMult(q *P256Point, scalar []byte) (*P256Point, error) {
- // TODO: test for values p <= x < 2^256.
if len(scalar) != 32 {
return nil, errors.New("invalid scalar length")
}
- scalarReversed := make([]uint64, 4)
- p256BigToLittle(scalarReversed, scalar)
+ scalarReversed := new(p256OrdElement)
+ p256OrdBigToLittle(scalarReversed, (*[32]byte)(scalar))
r.Set(q).p256ScalarMult(scalarReversed)
return r, nil
return int(x & 1)
}
+// p256Equal returns 1 if a and b are equal and 0 otherwise.
+func p256Equal(a, b *p256Element) int {
+ var acc uint64
+ for i := range a {
+ acc |= a[i] ^ b[i]
+ }
+ return uint64IsZero(acc)
+}
+
// isInfinity returns 1 if p is the point at infinity and 0 otherwise.
func (p *P256Point) isInfinity() int {
- return uint64IsZero(p.xyz[8] | p.xyz[9] | p.xyz[10] | p.xyz[11])
+ return p256Equal(&p.z, &p256Zero)
}
// Bytes returns the uncompressed or infinity encoding of p, as specified in
return out[:1]
}
- zInv := make([]uint64, 4)
- zInvSq := make([]uint64, 4)
- p256Inverse(zInv, p.xyz[8:12])
+ zInv := new(p256Element)
+ zInvSq := new(p256Element)
+ p256Inverse(zInv, &p.z)
p256Sqr(zInvSq, zInv, 1)
p256Mul(zInv, zInv, zInvSq)
- p256Mul(zInvSq, p.xyz[0:4], zInvSq)
- p256Mul(zInv, p.xyz[4:8], zInv)
+ p256Mul(zInvSq, &p.x, zInvSq)
+ p256Mul(zInv, &p.y, zInv)
p256FromMont(zInvSq, zInvSq)
p256FromMont(zInv, zInv)
out[0] = 4 // Uncompressed form.
- p256LittleToBig(out[1:33], zInvSq)
- p256LittleToBig(out[33:65], zInv)
+ p256LittleToBig((*[32]byte)(out[1:33]), zInvSq)
+ p256LittleToBig((*[32]byte)(out[33:65]), zInv)
return out[:]
}
// Select sets q to p1 if cond == 1, and to p2 if cond == 0.
func (q *P256Point) Select(p1, p2 *P256Point, cond int) *P256Point {
- p256MovCond(q.xyz[:], p1.xyz[:], p2.xyz[:], cond)
+ p256MovCond(q, p1, p2, cond)
return q
}
-// p256Inverse sets out to in^-1 mod p.
-func p256Inverse(out, in []uint64) {
- var stack [6 * 4]uint64
- p2 := stack[4*0 : 4*0+4]
- p4 := stack[4*1 : 4*1+4]
- p8 := stack[4*2 : 4*2+4]
- p16 := stack[4*3 : 4*3+4]
- p32 := stack[4*4 : 4*4+4]
-
- p256Sqr(out, in, 1)
- p256Mul(p2, out, in) // 3*p
-
- p256Sqr(out, p2, 2)
- p256Mul(p4, out, p2) // f*p
-
- p256Sqr(out, p4, 4)
- p256Mul(p8, out, p4) // ff*p
-
- p256Sqr(out, p8, 8)
- p256Mul(p16, out, p8) // ffff*p
-
- p256Sqr(out, p16, 16)
- p256Mul(p32, out, p16) // ffffffff*p
-
- p256Sqr(out, p32, 32)
- p256Mul(out, out, in)
-
- p256Sqr(out, out, 128)
- p256Mul(out, out, p32)
-
- p256Sqr(out, out, 32)
- p256Mul(out, out, p32)
-
- p256Sqr(out, out, 16)
- p256Mul(out, out, p16)
-
- p256Sqr(out, out, 8)
- p256Mul(out, out, p8)
-
- p256Sqr(out, out, 4)
- p256Mul(out, out, p4)
-
- p256Sqr(out, out, 2)
- p256Mul(out, out, p2)
-
- p256Sqr(out, out, 2)
- p256Mul(out, out, in)
-}
-
-func (p *P256Point) p256StorePoint(r *[16 * 4 * 3]uint64, index int) {
- copy(r[index*12:], p.xyz[:])
+// p256Inverse sets out to in⁻¹ mod p. If in is zero, out will be zero.
+func p256Inverse(out, in *p256Element) {
+ // Inversion is calculated through exponentiation by p - 2, per Fermat's
+ // little theorem.
+ //
+ // The sequence of 12 multiplications and 255 squarings is derived from the
+ // following addition chain generated with github.com/mmcloughlin/addchain
+ // v0.4.0.
+ //
+ // _10 = 2*1
+ // _11 = 1 + _10
+ // _110 = 2*_11
+ // _111 = 1 + _110
+ // _111000 = _111 << 3
+ // _111111 = _111 + _111000
+ // x12 = _111111 << 6 + _111111
+ // x15 = x12 << 3 + _111
+ // x16 = 2*x15 + 1
+ // x32 = x16 << 16 + x16
+ // i53 = x32 << 15
+ // x47 = x15 + i53
+ // i263 = ((i53 << 17 + 1) << 143 + x47) << 47
+ // return (x47 + i263) << 2 + 1
+ //
+ var z = new(p256Element)
+ var t0 = new(p256Element)
+ var t1 = new(p256Element)
+
+ p256Sqr(z, in, 1)
+ p256Mul(z, in, z)
+ p256Sqr(z, z, 1)
+ p256Mul(z, in, z)
+ p256Sqr(t0, z, 3)
+ p256Mul(t0, z, t0)
+ p256Sqr(t1, t0, 6)
+ p256Mul(t0, t0, t1)
+ p256Sqr(t0, t0, 3)
+ p256Mul(z, z, t0)
+ p256Sqr(t0, z, 1)
+ p256Mul(t0, in, t0)
+ p256Sqr(t1, t0, 16)
+ p256Mul(t0, t0, t1)
+ p256Sqr(t0, t0, 15)
+ p256Mul(z, z, t0)
+ p256Sqr(t0, t0, 17)
+ p256Mul(t0, in, t0)
+ p256Sqr(t0, t0, 143)
+ p256Mul(t0, z, t0)
+ p256Sqr(t0, t0, 47)
+ p256Mul(z, z, t0)
+ p256Sqr(z, z, 2)
+ p256Mul(out, in, z)
}
func boothW5(in uint) (int, int) {
return int(d), int(s & 1)
}
-func (p *P256Point) p256BaseMult(scalar []uint64) {
+func (p *P256Point) p256BaseMult(scalar *p256OrdElement) {
+ var t0 p256AffinePoint
+
wvalue := (scalar[0] << 1) & 0x7f
sel, sign := boothW6(uint(wvalue))
- p256SelectBase(&p.xyz, p256Precomputed, sel)
- p256NegCond(p.xyz[4:8], sign)
-
- // (This is one, in the Montgomery domain.)
- p.xyz[8] = 0x0000000000000001
- p.xyz[9] = 0xffffffff00000000
- p.xyz[10] = 0xffffffffffffffff
- p.xyz[11] = 0x00000000fffffffe
-
- var t0 P256Point
- // (This is one, in the Montgomery domain.)
- t0.xyz[8] = 0x0000000000000001
- t0.xyz[9] = 0xffffffff00000000
- t0.xyz[10] = 0xffffffffffffffff
- t0.xyz[11] = 0x00000000fffffffe
+ p256SelectAffine(&t0, &p256Precomputed[0], sel)
+ p.x, p.y, p.z = t0.x, t0.y, p256One
+ p256NegCond(&p.y, sign)
index := uint(5)
zero := sel
}
index += 6
sel, sign = boothW6(uint(wvalue))
- p256SelectBase(&t0.xyz, p256Precomputed[i*32*8*8:], sel)
- p256PointAddAffineAsm(p.xyz[0:12], p.xyz[0:12], t0.xyz[0:8], sign, sel, zero)
+ p256SelectAffine(&t0, &p256Precomputed[i], sel)
+ p256PointAddAffineAsm(p, p, &t0, sign, sel, zero)
zero |= sel
}
// If the whole scalar was zero, set to the point at infinity.
- p256MovCond(p.xyz[:], NewP256Point().xyz[:], p.xyz[:], uint64IsZero(uint64(zero)))
+ p256MovCond(p, p, NewP256Point(), zero)
}
-func (p *P256Point) p256ScalarMult(scalar []uint64) {
+func (p *P256Point) p256ScalarMult(scalar *p256OrdElement) {
// precomp is a table of precomputed points that stores powers of p
// from p^1 to p^16.
- var precomp [16 * 4 * 3]uint64
+ var precomp p256Table
var t0, t1, t2, t3 P256Point
// Prepare the table
- p.p256StorePoint(&precomp, 0) // 1
-
- p256PointDoubleAsm(t0.xyz[:], p.xyz[:])
- p256PointDoubleAsm(t1.xyz[:], t0.xyz[:])
- p256PointDoubleAsm(t2.xyz[:], t1.xyz[:])
- p256PointDoubleAsm(t3.xyz[:], t2.xyz[:])
- t0.p256StorePoint(&precomp, 1) // 2
- t1.p256StorePoint(&precomp, 3) // 4
- t2.p256StorePoint(&precomp, 7) // 8
- t3.p256StorePoint(&precomp, 15) // 16
-
- p256PointAddAsm(t0.xyz[:], t0.xyz[:], p.xyz[:])
- p256PointAddAsm(t1.xyz[:], t1.xyz[:], p.xyz[:])
- p256PointAddAsm(t2.xyz[:], t2.xyz[:], p.xyz[:])
- t0.p256StorePoint(&precomp, 2) // 3
- t1.p256StorePoint(&precomp, 4) // 5
- t2.p256StorePoint(&precomp, 8) // 9
-
- p256PointDoubleAsm(t0.xyz[:], t0.xyz[:])
- p256PointDoubleAsm(t1.xyz[:], t1.xyz[:])
- t0.p256StorePoint(&precomp, 5) // 6
- t1.p256StorePoint(&precomp, 9) // 10
-
- p256PointAddAsm(t2.xyz[:], t0.xyz[:], p.xyz[:])
- p256PointAddAsm(t1.xyz[:], t1.xyz[:], p.xyz[:])
- t2.p256StorePoint(&precomp, 6) // 7
- t1.p256StorePoint(&precomp, 10) // 11
-
- p256PointDoubleAsm(t0.xyz[:], t0.xyz[:])
- p256PointDoubleAsm(t2.xyz[:], t2.xyz[:])
- t0.p256StorePoint(&precomp, 11) // 12
- t2.p256StorePoint(&precomp, 13) // 14
-
- p256PointAddAsm(t0.xyz[:], t0.xyz[:], p.xyz[:])
- p256PointAddAsm(t2.xyz[:], t2.xyz[:], p.xyz[:])
- t0.p256StorePoint(&precomp, 12) // 13
- t2.p256StorePoint(&precomp, 14) // 15
+ precomp[0] = *p // 1
+
+ p256PointDoubleAsm(&t0, p)
+ p256PointDoubleAsm(&t1, &t0)
+ p256PointDoubleAsm(&t2, &t1)
+ p256PointDoubleAsm(&t3, &t2)
+ precomp[1] = t0 // 2
+ precomp[3] = t1 // 4
+ precomp[7] = t2 // 8
+ precomp[15] = t3 // 16
+
+ p256PointAddAsm(&t0, &t0, p)
+ p256PointAddAsm(&t1, &t1, p)
+ p256PointAddAsm(&t2, &t2, p)
+ precomp[2] = t0 // 3
+ precomp[4] = t1 // 5
+ precomp[8] = t2 // 9
+
+ p256PointDoubleAsm(&t0, &t0)
+ p256PointDoubleAsm(&t1, &t1)
+ precomp[5] = t0 // 6
+ precomp[9] = t1 // 10
+
+ p256PointAddAsm(&t2, &t0, p)
+ p256PointAddAsm(&t1, &t1, p)
+ precomp[6] = t2 // 7
+ precomp[10] = t1 // 11
+
+ p256PointDoubleAsm(&t0, &t0)
+ p256PointDoubleAsm(&t2, &t2)
+ precomp[11] = t0 // 12
+ precomp[13] = t2 // 14
+
+ p256PointAddAsm(&t0, &t0, p)
+ p256PointAddAsm(&t2, &t2, p)
+ precomp[12] = t0 // 13
+ precomp[14] = t2 // 15
// Start scanning the window from top bit
index := uint(254)
wvalue := (scalar[index/64] >> (index % 64)) & 0x3f
sel, _ = boothW5(uint(wvalue))
- p256Select(p.xyz[0:12], precomp[0:], sel)
+ p256Select(p, &precomp, sel)
zero := sel
for index > 4 {
index -= 5
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
if index < 192 {
wvalue = ((scalar[index/64] >> (index % 64)) + (scalar[index/64+1] << (64 - (index % 64)))) & 0x3f
sel, sign = boothW5(uint(wvalue))
- p256Select(t0.xyz[0:], precomp[0:], sel)
- p256NegCond(t0.xyz[4:8], sign)
- p256PointAddAsm(t1.xyz[:], p.xyz[:], t0.xyz[:])
- p256MovCond(t1.xyz[0:12], t1.xyz[0:12], p.xyz[0:12], sel)
- p256MovCond(p.xyz[0:12], t1.xyz[0:12], t0.xyz[0:12], zero)
+ p256Select(&t0, &precomp, sel)
+ p256NegCond(&t0.y, sign)
+ p256PointAddAsm(&t1, p, &t0)
+ p256MovCond(&t1, &t1, p, sel)
+ p256MovCond(p, &t1, &t0, zero)
zero |= sel
}
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
- p256PointDoubleAsm(p.xyz[:], p.xyz[:])
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
+ p256PointDoubleAsm(p, p)
wvalue = (scalar[0] << 1) & 0x3f
sel, sign = boothW5(uint(wvalue))
- p256Select(t0.xyz[0:], precomp[0:], sel)
- p256NegCond(t0.xyz[4:8], sign)
- p256PointAddAsm(t1.xyz[:], p.xyz[:], t0.xyz[:])
- p256MovCond(t1.xyz[0:12], t1.xyz[0:12], p.xyz[0:12], sel)
- p256MovCond(p.xyz[0:12], t1.xyz[0:12], t0.xyz[0:12], zero)
+ p256Select(&t0, &precomp, sel)
+ p256NegCond(&t0.y, sign)
+ p256PointAddAsm(&t1, p, &t0)
+ p256MovCond(&t1, &t1, p, sel)
+ p256MovCond(p, &t1, &t0, zero)
}
GLOBL p256one<>(SB), 8, $32
/* ---------------------------------------*/
-// func p256LittleToBig(res []byte, in []uint64)
+// func p256OrdLittleToBig(res *[32]byte, in *p256OrdElement)
+TEXT ·p256OrdLittleToBig(SB),NOSPLIT,$0
+ JMP ·p256BigToLittle(SB)
+/* ---------------------------------------*/
+// func p256OrdBigToLittle(res *p256OrdElement, in *[32]byte)
+TEXT ·p256OrdBigToLittle(SB),NOSPLIT,$0
+ JMP ·p256BigToLittle(SB)
+/* ---------------------------------------*/
+// func p256LittleToBig(res *[32]byte, in *p256Element)
TEXT ·p256LittleToBig(SB),NOSPLIT,$0
JMP ·p256BigToLittle(SB)
/* ---------------------------------------*/
-// func p256BigToLittle(res []uint64, in []byte)
+// func p256BigToLittle(res *p256Element, in *[32]byte)
TEXT ·p256BigToLittle(SB),NOSPLIT,$0
MOVD res+0(FP), res_ptr
- MOVD in+24(FP), a_ptr
+ MOVD in+8(FP), a_ptr
LDP 0*16(a_ptr), (acc0, acc1)
LDP 1*16(a_ptr), (acc2, acc3)
STP (acc1, acc0), 1*16(res_ptr)
RET
/* ---------------------------------------*/
-// func p256MovCond(res, a, b []uint64, cond int)
+// func p256MovCond(res, a, b *P256Point, cond int)
// If cond == 0 res=b, else res=a
TEXT ·p256MovCond(SB),NOSPLIT,$0
MOVD res+0(FP), res_ptr
- MOVD a+24(FP), a_ptr
- MOVD b+48(FP), b_ptr
- MOVD cond+72(FP), R3
+ MOVD a+8(FP), a_ptr
+ MOVD b+16(FP), b_ptr
+ MOVD cond+24(FP), R3
CMP $0, R3
// Two remarks:
RET
/* ---------------------------------------*/
-// func p256NegCond(val []uint64, cond int)
+// func p256NegCond(val *p256Element, cond int)
TEXT ·p256NegCond(SB),NOSPLIT,$0
MOVD val+0(FP), a_ptr
- MOVD cond+24(FP), hlp0
+ MOVD cond+8(FP), hlp0
MOVD a_ptr, res_ptr
// acc = poly
MOVD $-1, acc0
RET
/* ---------------------------------------*/
-// func p256Sqr(res, in []uint64, n int)
+// func p256Sqr(res, in *p256Element, n int)
TEXT ·p256Sqr(SB),NOSPLIT,$0
MOVD res+0(FP), res_ptr
- MOVD in+24(FP), a_ptr
- MOVD n+48(FP), b_ptr
+ MOVD in+8(FP), a_ptr
+ MOVD n+16(FP), b_ptr
MOVD p256const0<>(SB), const0
MOVD p256const1<>(SB), const1
STP (y2, y3), 1*16(res_ptr)
RET
/* ---------------------------------------*/
-// func p256Mul(res, in1, in2 []uint64)
+// func p256Mul(res, in1, in2 *p256Element)
TEXT ·p256Mul(SB),NOSPLIT,$0
MOVD res+0(FP), res_ptr
- MOVD in1+24(FP), a_ptr
- MOVD in2+48(FP), b_ptr
+ MOVD in1+8(FP), a_ptr
+ MOVD in2+16(FP), b_ptr
MOVD p256const0<>(SB), const0
MOVD p256const1<>(SB), const1
STP (y2, y3), 1*16(res_ptr)
RET
/* ---------------------------------------*/
-// func p256FromMont(res, in []uint64)
+// func p256FromMont(res, in *p256Element)
TEXT ·p256FromMont(SB),NOSPLIT,$0
MOVD res+0(FP), res_ptr
- MOVD in+24(FP), a_ptr
+ MOVD in+8(FP), a_ptr
MOVD p256const0<>(SB), const0
MOVD p256const1<>(SB), const1
RET
/* ---------------------------------------*/
-// Constant time point access to arbitrary point table.
-// Indexed from 1 to 15, with -1 offset
-// (index 0 is implicitly point at infinity)
-// func p256Select(point, table []uint64, idx int)
+// func p256Select(res *P256Point, table *p256Table, idx int)
TEXT ·p256Select(SB),NOSPLIT,$0
- MOVD idx+48(FP), const0
- MOVD table+24(FP), b_ptr
- MOVD point+0(FP), res_ptr
+ MOVD idx+16(FP), const0
+ MOVD table+8(FP), b_ptr
+ MOVD res+0(FP), res_ptr
EOR x0, x0, x0
EOR x1, x1, x1
STP (t2, t3), 5*16(res_ptr)
RET
/* ---------------------------------------*/
-// Constant time point access to base point table.
-// func p256SelectBase(point *[12]uint64, table string, idx int)
-TEXT ·p256SelectBase(SB),NOSPLIT,$0
- MOVD idx+24(FP), t0
- MOVD table_base+8(FP), t1
- MOVD point+0(FP), res_ptr
+// func p256SelectAffine(res *p256AffinePoint, table *p256AffineTable, idx int)
+TEXT ·p256SelectAffine(SB),NOSPLIT,$0
+ MOVD idx+16(FP), t0
+ MOVD table+8(FP), t1
+ MOVD res+0(FP), res_ptr
EOR x0, x0, x0
EOR x1, x1, x1
STP (y2, y3), 3*16(res_ptr)
RET
/* ---------------------------------------*/
-// func p256OrdSqr(res, in []uint64, n int)
+// func p256OrdSqr(res, in *p256OrdElement, n int)
TEXT ·p256OrdSqr(SB),NOSPLIT,$0
- MOVD in+24(FP), a_ptr
- MOVD n+48(FP), b_ptr
+ MOVD in+8(FP), a_ptr
+ MOVD n+16(FP), b_ptr
MOVD p256ordK0<>(SB), hlp1
LDP p256ord<>+0x00(SB), (const0, const1)
RET
/* ---------------------------------------*/
-// func p256OrdMul(res, in1, in2 []uint64)
+// func p256OrdMul(res, in1, in2 *p256OrdElement)
TEXT ·p256OrdMul(SB),NOSPLIT,$0
- MOVD in1+24(FP), a_ptr
- MOVD in2+48(FP), b_ptr
+ MOVD in1+8(FP), a_ptr
+ MOVD in2+16(FP), b_ptr
MOVD p256ordK0<>(SB), hlp1
LDP p256ord<>+0x00(SB), (const0, const1)
#define u1(off) (32*10 + 8 + off)(RSP)
#define u2(off) (32*11 + 8 + off)(RSP)
-// func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
-TEXT ·p256PointAddAffineAsm(SB),0,$264-96
- MOVD in1+24(FP), a_ptr
- MOVD in2+48(FP), b_ptr
- MOVD sign+72(FP), hlp0
- MOVD sel+80(FP), hlp1
- MOVD zero+88(FP), t2
+// func p256PointAddAffineAsm(res, in1 *P256Point, in2 *p256AffinePoint, sign, sel, zero int)
+TEXT ·p256PointAddAffineAsm(SB),0,$264-48
+ MOVD in1+8(FP), a_ptr
+ MOVD in2+16(FP), b_ptr
+ MOVD sign+24(FP), hlp0
+ MOVD sel+32(FP), hlp1
+ MOVD zero+40(FP), t2
MOVD $1, t0
CMP $0, t2
#define zsqr(off) (32*2 + 8 + off)(RSP)
#define tmp(off) (32*3 + 8 + off)(RSP)
-//func p256PointDoubleAsm(res, in []uint64)
-TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-48
+//func p256PointDoubleAsm(res, in *P256Point)
+TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$136-16
MOVD res+0(FP), res_ptr
- MOVD in+24(FP), a_ptr
+ MOVD in+8(FP), a_ptr
MOVD p256const0<>(SB), const0
MOVD p256const1<>(SB), const1
#define x3out(off) (off)(b_ptr)
#define y3out(off) (off + 32)(b_ptr)
#define z3out(off) (off + 64)(b_ptr)
-//func p256PointAddAsm(res, in1, in2 []uint64) int
-TEXT ·p256PointAddAsm(SB),0,$392-80
+// func p256PointAddAsm(res, in1, in2 *P256Point) int
+TEXT ·p256PointAddAsm(SB),0,$392-32
// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
// Move input to stack in order to free registers
- MOVD in1+24(FP), a_ptr
- MOVD in2+48(FP), b_ptr
+ MOVD in1+8(FP), a_ptr
+ MOVD in2+16(FP), b_ptr
MOVD p256const0<>(SB), const0
MOVD p256const1<>(SB), const1
STx(y3out)
MOVD hlp1, R0
- MOVD R0, ret+72(FP)
+ MOVD R0, ret+24(FP)
RET