Hacl_Curve25519.c (22405B)
1 /* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. 2 Licensed under the Apache 2.0 License. */ 3 4 /* This file was generated by KreMLin <https://github.com/FStarLang/kremlin> 5 * KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fbuiltin-uint128 -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c 6 * F* version: 059db0c8 7 * KreMLin version: 916c37ac 8 */ 9 10 11 #include "Hacl_Curve25519.h" 12 13 extern uint64_t FStar_UInt64_eq_mask(uint64_t x0, uint64_t x1); 14 15 extern uint64_t FStar_UInt64_gte_mask(uint64_t x0, uint64_t x1); 16 17 extern uint128_t FStar_UInt128_add(uint128_t x0, uint128_t x1); 18 19 extern uint128_t FStar_UInt128_add_mod(uint128_t x0, uint128_t x1); 20 21 extern uint128_t FStar_UInt128_logand(uint128_t x0, uint128_t x1); 22 23 extern uint128_t FStar_UInt128_shift_right(uint128_t x0, uint32_t x1); 24 25 extern uint128_t FStar_UInt128_uint64_to_uint128(uint64_t x0); 26 27 extern uint64_t FStar_UInt128_uint128_to_uint64(uint128_t x0); 28 29 extern uint128_t FStar_UInt128_mul_wide(uint64_t x0, uint64_t x1); 30 31 static void Hacl_Bignum_Modulo_carry_top(uint64_t *b) 32 { 33 uint64_t b4 = b[4U]; 34 uint64_t b0 = b[0U]; 35 uint64_t b4_ = b4 & (uint64_t)0x7ffffffffffffU; 36 uint64_t b0_ = b0 + (uint64_t)19U * (b4 >> (uint32_t)51U); 37 b[4U] = b4_; 38 b[0U] = b0_; 39 } 40 41 inline static void Hacl_Bignum_Fproduct_copy_from_wide_(uint64_t *output, uint128_t *input) 42 { 43 uint32_t i; 44 for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) 45 { 46 uint128_t xi = input[i]; 47 output[i] = (uint64_t)xi; 48 } 49 } 50 51 inline static void 52 Hacl_Bignum_Fproduct_sum_scalar_multiplication_(uint128_t *output, uint64_t *input, uint64_t s) 53 { 54 uint32_t i; 55 for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) 56 { 57 uint128_t xi = output[i]; 58 uint64_t yi = input[i]; 59 output[i] = xi + (uint128_t)yi * s; 60 } 61 } 62 63 inline static void Hacl_Bignum_Fproduct_carry_wide_(uint128_t *tmp) 64 { 65 uint32_t i; 66 for (i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U) 67 { 68 uint32_t ctr = i; 69 uint128_t tctr = tmp[ctr]; 70 uint128_t tctrp1 = tmp[ctr + (uint32_t)1U]; 71 uint64_t r0 = (uint64_t)tctr & (uint64_t)0x7ffffffffffffU; 72 uint128_t c = tctr >> (uint32_t)51U; 73 tmp[ctr] = (uint128_t)r0; 74 tmp[ctr + (uint32_t)1U] = tctrp1 + c; 75 } 76 } 77 78 inline static void Hacl_Bignum_Fmul_shift_reduce(uint64_t *output) 79 { 80 uint64_t tmp = output[4U]; 81 uint64_t b0; 82 { 83 uint32_t i; 84 for (i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U) 85 { 86 uint32_t ctr = (uint32_t)5U - i - (uint32_t)1U; 87 uint64_t z = output[ctr - (uint32_t)1U]; 88 output[ctr] = z; 89 } 90 } 91 output[0U] = tmp; 92 b0 = output[0U]; 93 output[0U] = (uint64_t)19U * b0; 94 } 95 96 static void 97 Hacl_Bignum_Fmul_mul_shift_reduce_(uint128_t *output, uint64_t *input, uint64_t *input2) 98 { 99 uint32_t i; 100 uint64_t input2i; 101 { 102 uint32_t i0; 103 for (i0 = (uint32_t)0U; i0 < (uint32_t)4U; i0 = i0 + (uint32_t)1U) 104 { 105 uint64_t input2i0 = input2[i0]; 106 Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i0); 107 Hacl_Bignum_Fmul_shift_reduce(input); 108 } 109 } 110 i = (uint32_t)4U; 111 input2i = input2[i]; 112 Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i); 113 } 114 115 inline static void Hacl_Bignum_Fmul_fmul(uint64_t *output, uint64_t *input, uint64_t *input2) 116 { 117 uint64_t tmp[5U] = { 0U }; 118 memcpy(tmp, input, (uint32_t)5U * sizeof input[0U]); 119 KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); 120 { 121 uint128_t t[5U]; 122 { 123 uint32_t _i; 124 for (_i = 0U; _i < (uint32_t)5U; ++_i) 125 t[_i] = (uint128_t)(uint64_t)0U; 126 } 127 { 128 uint128_t b4; 129 uint128_t b0; 130 uint128_t b4_; 131 uint128_t b0_; 132 uint64_t i0; 133 uint64_t i1; 134 uint64_t i0_; 135 uint64_t i1_; 136 Hacl_Bignum_Fmul_mul_shift_reduce_(t, tmp, input2); 137 Hacl_Bignum_Fproduct_carry_wide_(t); 138 b4 = t[4U]; 139 b0 = t[0U]; 140 b4_ = b4 & (uint128_t)(uint64_t)0x7ffffffffffffU; 141 b0_ = b0 + (uint128_t)(uint64_t)19U * (uint64_t)(b4 >> (uint32_t)51U); 142 t[4U] = b4_; 143 t[0U] = b0_; 144 Hacl_Bignum_Fproduct_copy_from_wide_(output, t); 145 i0 = output[0U]; 146 i1 = output[1U]; 147 i0_ = i0 & (uint64_t)0x7ffffffffffffU; 148 i1_ = i1 + (i0 >> (uint32_t)51U); 149 output[0U] = i0_; 150 output[1U] = i1_; 151 } 152 } 153 } 154 155 inline static void Hacl_Bignum_Fsquare_fsquare__(uint128_t *tmp, uint64_t *output) 156 { 157 uint64_t r0 = output[0U]; 158 uint64_t r1 = output[1U]; 159 uint64_t r2 = output[2U]; 160 uint64_t r3 = output[3U]; 161 uint64_t r4 = output[4U]; 162 uint64_t d0 = r0 * (uint64_t)2U; 163 uint64_t d1 = r1 * (uint64_t)2U; 164 uint64_t d2 = r2 * (uint64_t)2U * (uint64_t)19U; 165 uint64_t d419 = r4 * (uint64_t)19U; 166 uint64_t d4 = d419 * (uint64_t)2U; 167 uint128_t s0 = (uint128_t)r0 * r0 + (uint128_t)d4 * r1 + (uint128_t)d2 * r3; 168 uint128_t s1 = (uint128_t)d0 * r1 + (uint128_t)d4 * r2 + (uint128_t)(r3 * (uint64_t)19U) * r3; 169 uint128_t s2 = (uint128_t)d0 * r2 + (uint128_t)r1 * r1 + (uint128_t)d4 * r3; 170 uint128_t s3 = (uint128_t)d0 * r3 + (uint128_t)d1 * r2 + (uint128_t)r4 * d419; 171 uint128_t s4 = (uint128_t)d0 * r4 + (uint128_t)d1 * r3 + (uint128_t)r2 * r2; 172 tmp[0U] = s0; 173 tmp[1U] = s1; 174 tmp[2U] = s2; 175 tmp[3U] = s3; 176 tmp[4U] = s4; 177 } 178 179 inline static void Hacl_Bignum_Fsquare_fsquare_(uint128_t *tmp, uint64_t *output) 180 { 181 uint128_t b4; 182 uint128_t b0; 183 uint128_t b4_; 184 uint128_t b0_; 185 uint64_t i0; 186 uint64_t i1; 187 uint64_t i0_; 188 uint64_t i1_; 189 Hacl_Bignum_Fsquare_fsquare__(tmp, output); 190 Hacl_Bignum_Fproduct_carry_wide_(tmp); 191 b4 = tmp[4U]; 192 b0 = tmp[0U]; 193 b4_ = b4 & (uint128_t)(uint64_t)0x7ffffffffffffU; 194 b0_ = b0 + (uint128_t)(uint64_t)19U * (uint64_t)(b4 >> (uint32_t)51U); 195 tmp[4U] = b4_; 196 tmp[0U] = b0_; 197 Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp); 198 i0 = output[0U]; 199 i1 = output[1U]; 200 i0_ = i0 & (uint64_t)0x7ffffffffffffU; 201 i1_ = i1 + (i0 >> (uint32_t)51U); 202 output[0U] = i0_; 203 output[1U] = i1_; 204 } 205 206 static void 207 Hacl_Bignum_Fsquare_fsquare_times_(uint64_t *input, uint128_t *tmp, uint32_t count1) 208 { 209 uint32_t i; 210 Hacl_Bignum_Fsquare_fsquare_(tmp, input); 211 for (i = (uint32_t)1U; i < count1; i = i + (uint32_t)1U) 212 Hacl_Bignum_Fsquare_fsquare_(tmp, input); 213 } 214 215 inline static void 216 Hacl_Bignum_Fsquare_fsquare_times(uint64_t *output, uint64_t *input, uint32_t count1) 217 { 218 KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); 219 { 220 uint128_t t[5U]; 221 { 222 uint32_t _i; 223 for (_i = 0U; _i < (uint32_t)5U; ++_i) 224 t[_i] = (uint128_t)(uint64_t)0U; 225 } 226 memcpy(output, input, (uint32_t)5U * sizeof input[0U]); 227 Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1); 228 } 229 } 230 231 inline static void Hacl_Bignum_Fsquare_fsquare_times_inplace(uint64_t *output, uint32_t count1) 232 { 233 KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); 234 { 235 uint128_t t[5U]; 236 { 237 uint32_t _i; 238 for (_i = 0U; _i < (uint32_t)5U; ++_i) 239 t[_i] = (uint128_t)(uint64_t)0U; 240 } 241 Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1); 242 } 243 } 244 245 inline static void Hacl_Bignum_Crecip_crecip(uint64_t *out, uint64_t *z) 246 { 247 uint64_t buf[20U] = { 0U }; 248 uint64_t *a0 = buf; 249 uint64_t *t00 = buf + (uint32_t)5U; 250 uint64_t *b0 = buf + (uint32_t)10U; 251 uint64_t *t01; 252 uint64_t *b1; 253 uint64_t *c0; 254 uint64_t *a; 255 uint64_t *t0; 256 uint64_t *b; 257 uint64_t *c; 258 Hacl_Bignum_Fsquare_fsquare_times(a0, z, (uint32_t)1U); 259 Hacl_Bignum_Fsquare_fsquare_times(t00, a0, (uint32_t)2U); 260 Hacl_Bignum_Fmul_fmul(b0, t00, z); 261 Hacl_Bignum_Fmul_fmul(a0, b0, a0); 262 Hacl_Bignum_Fsquare_fsquare_times(t00, a0, (uint32_t)1U); 263 Hacl_Bignum_Fmul_fmul(b0, t00, b0); 264 Hacl_Bignum_Fsquare_fsquare_times(t00, b0, (uint32_t)5U); 265 t01 = buf + (uint32_t)5U; 266 b1 = buf + (uint32_t)10U; 267 c0 = buf + (uint32_t)15U; 268 Hacl_Bignum_Fmul_fmul(b1, t01, b1); 269 Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)10U); 270 Hacl_Bignum_Fmul_fmul(c0, t01, b1); 271 Hacl_Bignum_Fsquare_fsquare_times(t01, c0, (uint32_t)20U); 272 Hacl_Bignum_Fmul_fmul(t01, t01, c0); 273 Hacl_Bignum_Fsquare_fsquare_times_inplace(t01, (uint32_t)10U); 274 Hacl_Bignum_Fmul_fmul(b1, t01, b1); 275 Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)50U); 276 a = buf; 277 t0 = buf + (uint32_t)5U; 278 b = buf + (uint32_t)10U; 279 c = buf + (uint32_t)15U; 280 Hacl_Bignum_Fmul_fmul(c, t0, b); 281 Hacl_Bignum_Fsquare_fsquare_times(t0, c, (uint32_t)100U); 282 Hacl_Bignum_Fmul_fmul(t0, t0, c); 283 Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)50U); 284 Hacl_Bignum_Fmul_fmul(t0, t0, b); 285 Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)5U); 286 Hacl_Bignum_Fmul_fmul(out, t0, a); 287 } 288 289 inline static void Hacl_Bignum_fsum(uint64_t *a, uint64_t *b) 290 { 291 uint32_t i; 292 for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) 293 { 294 uint64_t xi = a[i]; 295 uint64_t yi = b[i]; 296 a[i] = xi + yi; 297 } 298 } 299 300 inline static void Hacl_Bignum_fdifference(uint64_t *a, uint64_t *b) 301 { 302 uint64_t tmp[5U] = { 0U }; 303 uint64_t b0; 304 uint64_t b1; 305 uint64_t b2; 306 uint64_t b3; 307 uint64_t b4; 308 memcpy(tmp, b, (uint32_t)5U * sizeof b[0U]); 309 b0 = tmp[0U]; 310 b1 = tmp[1U]; 311 b2 = tmp[2U]; 312 b3 = tmp[3U]; 313 b4 = tmp[4U]; 314 tmp[0U] = b0 + (uint64_t)0x3fffffffffff68U; 315 tmp[1U] = b1 + (uint64_t)0x3ffffffffffff8U; 316 tmp[2U] = b2 + (uint64_t)0x3ffffffffffff8U; 317 tmp[3U] = b3 + (uint64_t)0x3ffffffffffff8U; 318 tmp[4U] = b4 + (uint64_t)0x3ffffffffffff8U; 319 { 320 uint32_t i; 321 for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) 322 { 323 uint64_t xi = a[i]; 324 uint64_t yi = tmp[i]; 325 a[i] = yi - xi; 326 } 327 } 328 } 329 330 inline static void Hacl_Bignum_fscalar(uint64_t *output, uint64_t *b, uint64_t s) 331 { 332 KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); 333 { 334 uint128_t tmp[5U]; 335 { 336 uint32_t _i; 337 for (_i = 0U; _i < (uint32_t)5U; ++_i) 338 tmp[_i] = (uint128_t)(uint64_t)0U; 339 } 340 { 341 uint128_t b4; 342 uint128_t b0; 343 uint128_t b4_; 344 uint128_t b0_; 345 { 346 uint32_t i; 347 for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) 348 { 349 uint64_t xi = b[i]; 350 tmp[i] = (uint128_t)xi * s; 351 } 352 } 353 Hacl_Bignum_Fproduct_carry_wide_(tmp); 354 b4 = tmp[4U]; 355 b0 = tmp[0U]; 356 b4_ = b4 & (uint128_t)(uint64_t)0x7ffffffffffffU; 357 b0_ = b0 + (uint128_t)(uint64_t)19U * (uint64_t)(b4 >> (uint32_t)51U); 358 tmp[4U] = b4_; 359 tmp[0U] = b0_; 360 Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp); 361 } 362 } 363 } 364 365 inline static void Hacl_Bignum_fmul(uint64_t *output, uint64_t *a, uint64_t *b) 366 { 367 Hacl_Bignum_Fmul_fmul(output, a, b); 368 } 369 370 inline static void Hacl_Bignum_crecip(uint64_t *output, uint64_t *input) 371 { 372 Hacl_Bignum_Crecip_crecip(output, input); 373 } 374 375 static void 376 Hacl_EC_Point_swap_conditional_step(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr) 377 { 378 uint32_t i = ctr - (uint32_t)1U; 379 uint64_t ai = a[i]; 380 uint64_t bi = b[i]; 381 uint64_t x = swap1 & (ai ^ bi); 382 uint64_t ai1 = ai ^ x; 383 uint64_t bi1 = bi ^ x; 384 a[i] = ai1; 385 b[i] = bi1; 386 } 387 388 static void 389 Hacl_EC_Point_swap_conditional_(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr) 390 { 391 if (!(ctr == (uint32_t)0U)) 392 { 393 uint32_t i; 394 Hacl_EC_Point_swap_conditional_step(a, b, swap1, ctr); 395 i = ctr - (uint32_t)1U; 396 Hacl_EC_Point_swap_conditional_(a, b, swap1, i); 397 } 398 } 399 400 static void Hacl_EC_Point_swap_conditional(uint64_t *a, uint64_t *b, uint64_t iswap) 401 { 402 uint64_t swap1 = (uint64_t)0U - iswap; 403 Hacl_EC_Point_swap_conditional_(a, b, swap1, (uint32_t)5U); 404 Hacl_EC_Point_swap_conditional_(a + (uint32_t)5U, b + (uint32_t)5U, swap1, (uint32_t)5U); 405 } 406 407 static void Hacl_EC_Point_copy(uint64_t *output, uint64_t *input) 408 { 409 memcpy(output, input, (uint32_t)5U * sizeof input[0U]); 410 memcpy(output + (uint32_t)5U, 411 input + (uint32_t)5U, 412 (uint32_t)5U * sizeof (input + (uint32_t)5U)[0U]); 413 } 414 415 static void Hacl_EC_Format_fexpand(uint64_t *output, uint8_t *input) 416 { 417 uint64_t i0 = load64_le(input); 418 uint8_t *x00 = input + (uint32_t)6U; 419 uint64_t i1 = load64_le(x00); 420 uint8_t *x01 = input + (uint32_t)12U; 421 uint64_t i2 = load64_le(x01); 422 uint8_t *x02 = input + (uint32_t)19U; 423 uint64_t i3 = load64_le(x02); 424 uint8_t *x0 = input + (uint32_t)24U; 425 uint64_t i4 = load64_le(x0); 426 uint64_t output0 = i0 & (uint64_t)0x7ffffffffffffU; 427 uint64_t output1 = i1 >> (uint32_t)3U & (uint64_t)0x7ffffffffffffU; 428 uint64_t output2 = i2 >> (uint32_t)6U & (uint64_t)0x7ffffffffffffU; 429 uint64_t output3 = i3 >> (uint32_t)1U & (uint64_t)0x7ffffffffffffU; 430 uint64_t output4 = i4 >> (uint32_t)12U & (uint64_t)0x7ffffffffffffU; 431 output[0U] = output0; 432 output[1U] = output1; 433 output[2U] = output2; 434 output[3U] = output3; 435 output[4U] = output4; 436 } 437 438 static void Hacl_EC_Format_fcontract_first_carry_pass(uint64_t *input) 439 { 440 uint64_t t0 = input[0U]; 441 uint64_t t1 = input[1U]; 442 uint64_t t2 = input[2U]; 443 uint64_t t3 = input[3U]; 444 uint64_t t4 = input[4U]; 445 uint64_t t1_ = t1 + (t0 >> (uint32_t)51U); 446 uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU; 447 uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U); 448 uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU; 449 uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U); 450 uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU; 451 uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U); 452 uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU; 453 input[0U] = t0_; 454 input[1U] = t1__; 455 input[2U] = t2__; 456 input[3U] = t3__; 457 input[4U] = t4_; 458 } 459 460 static void Hacl_EC_Format_fcontract_first_carry_full(uint64_t *input) 461 { 462 Hacl_EC_Format_fcontract_first_carry_pass(input); 463 Hacl_Bignum_Modulo_carry_top(input); 464 } 465 466 static void Hacl_EC_Format_fcontract_second_carry_pass(uint64_t *input) 467 { 468 uint64_t t0 = input[0U]; 469 uint64_t t1 = input[1U]; 470 uint64_t t2 = input[2U]; 471 uint64_t t3 = input[3U]; 472 uint64_t t4 = input[4U]; 473 uint64_t t1_ = t1 + (t0 >> (uint32_t)51U); 474 uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU; 475 uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U); 476 uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU; 477 uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U); 478 uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU; 479 uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U); 480 uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU; 481 input[0U] = t0_; 482 input[1U] = t1__; 483 input[2U] = t2__; 484 input[3U] = t3__; 485 input[4U] = t4_; 486 } 487 488 static void Hacl_EC_Format_fcontract_second_carry_full(uint64_t *input) 489 { 490 uint64_t i0; 491 uint64_t i1; 492 uint64_t i0_; 493 uint64_t i1_; 494 Hacl_EC_Format_fcontract_second_carry_pass(input); 495 Hacl_Bignum_Modulo_carry_top(input); 496 i0 = input[0U]; 497 i1 = input[1U]; 498 i0_ = i0 & (uint64_t)0x7ffffffffffffU; 499 i1_ = i1 + (i0 >> (uint32_t)51U); 500 input[0U] = i0_; 501 input[1U] = i1_; 502 } 503 504 static void Hacl_EC_Format_fcontract_trim(uint64_t *input) 505 { 506 uint64_t a0 = input[0U]; 507 uint64_t a1 = input[1U]; 508 uint64_t a2 = input[2U]; 509 uint64_t a3 = input[3U]; 510 uint64_t a4 = input[4U]; 511 uint64_t mask0 = FStar_UInt64_gte_mask(a0, (uint64_t)0x7ffffffffffedU); 512 uint64_t mask1 = FStar_UInt64_eq_mask(a1, (uint64_t)0x7ffffffffffffU); 513 uint64_t mask2 = FStar_UInt64_eq_mask(a2, (uint64_t)0x7ffffffffffffU); 514 uint64_t mask3 = FStar_UInt64_eq_mask(a3, (uint64_t)0x7ffffffffffffU); 515 uint64_t mask4 = FStar_UInt64_eq_mask(a4, (uint64_t)0x7ffffffffffffU); 516 uint64_t mask = (((mask0 & mask1) & mask2) & mask3) & mask4; 517 uint64_t a0_ = a0 - ((uint64_t)0x7ffffffffffedU & mask); 518 uint64_t a1_ = a1 - ((uint64_t)0x7ffffffffffffU & mask); 519 uint64_t a2_ = a2 - ((uint64_t)0x7ffffffffffffU & mask); 520 uint64_t a3_ = a3 - ((uint64_t)0x7ffffffffffffU & mask); 521 uint64_t a4_ = a4 - ((uint64_t)0x7ffffffffffffU & mask); 522 input[0U] = a0_; 523 input[1U] = a1_; 524 input[2U] = a2_; 525 input[3U] = a3_; 526 input[4U] = a4_; 527 } 528 529 static void Hacl_EC_Format_fcontract_store(uint8_t *output, uint64_t *input) 530 { 531 uint64_t t0 = input[0U]; 532 uint64_t t1 = input[1U]; 533 uint64_t t2 = input[2U]; 534 uint64_t t3 = input[3U]; 535 uint64_t t4 = input[4U]; 536 uint64_t o0 = t1 << (uint32_t)51U | t0; 537 uint64_t o1 = t2 << (uint32_t)38U | t1 >> (uint32_t)13U; 538 uint64_t o2 = t3 << (uint32_t)25U | t2 >> (uint32_t)26U; 539 uint64_t o3 = t4 << (uint32_t)12U | t3 >> (uint32_t)39U; 540 uint8_t *b0 = output; 541 uint8_t *b1 = output + (uint32_t)8U; 542 uint8_t *b2 = output + (uint32_t)16U; 543 uint8_t *b3 = output + (uint32_t)24U; 544 store64_le(b0, o0); 545 store64_le(b1, o1); 546 store64_le(b2, o2); 547 store64_le(b3, o3); 548 } 549 550 static void Hacl_EC_Format_fcontract(uint8_t *output, uint64_t *input) 551 { 552 Hacl_EC_Format_fcontract_first_carry_full(input); 553 Hacl_EC_Format_fcontract_second_carry_full(input); 554 Hacl_EC_Format_fcontract_trim(input); 555 Hacl_EC_Format_fcontract_store(output, input); 556 } 557 558 static void Hacl_EC_Format_scalar_of_point(uint8_t *scalar, uint64_t *point) 559 { 560 uint64_t *x = point; 561 uint64_t *z = point + (uint32_t)5U; 562 uint64_t buf[10U] = { 0U }; 563 uint64_t *zmone = buf; 564 uint64_t *sc = buf + (uint32_t)5U; 565 Hacl_Bignum_crecip(zmone, z); 566 Hacl_Bignum_fmul(sc, x, zmone); 567 Hacl_EC_Format_fcontract(scalar, sc); 568 } 569 570 static void 571 Hacl_EC_AddAndDouble_fmonty( 572 uint64_t *pp, 573 uint64_t *ppq, 574 uint64_t *p, 575 uint64_t *pq, 576 uint64_t *qmqp 577 ) 578 { 579 uint64_t *qx = qmqp; 580 uint64_t *x2 = pp; 581 uint64_t *z2 = pp + (uint32_t)5U; 582 uint64_t *x3 = ppq; 583 uint64_t *z3 = ppq + (uint32_t)5U; 584 uint64_t *x = p; 585 uint64_t *z = p + (uint32_t)5U; 586 uint64_t *xprime = pq; 587 uint64_t *zprime = pq + (uint32_t)5U; 588 uint64_t buf[40U] = { 0U }; 589 uint64_t *origx = buf; 590 uint64_t *origxprime0 = buf + (uint32_t)5U; 591 uint64_t *xxprime0 = buf + (uint32_t)25U; 592 uint64_t *zzprime0 = buf + (uint32_t)30U; 593 uint64_t *origxprime; 594 uint64_t *xx0; 595 uint64_t *zz0; 596 uint64_t *xxprime; 597 uint64_t *zzprime; 598 uint64_t *zzzprime; 599 uint64_t *zzz; 600 uint64_t *xx; 601 uint64_t *zz; 602 uint64_t scalar; 603 memcpy(origx, x, (uint32_t)5U * sizeof x[0U]); 604 Hacl_Bignum_fsum(x, z); 605 Hacl_Bignum_fdifference(z, origx); 606 memcpy(origxprime0, xprime, (uint32_t)5U * sizeof xprime[0U]); 607 Hacl_Bignum_fsum(xprime, zprime); 608 Hacl_Bignum_fdifference(zprime, origxprime0); 609 Hacl_Bignum_fmul(xxprime0, xprime, z); 610 Hacl_Bignum_fmul(zzprime0, x, zprime); 611 origxprime = buf + (uint32_t)5U; 612 xx0 = buf + (uint32_t)15U; 613 zz0 = buf + (uint32_t)20U; 614 xxprime = buf + (uint32_t)25U; 615 zzprime = buf + (uint32_t)30U; 616 zzzprime = buf + (uint32_t)35U; 617 memcpy(origxprime, xxprime, (uint32_t)5U * sizeof xxprime[0U]); 618 Hacl_Bignum_fsum(xxprime, zzprime); 619 Hacl_Bignum_fdifference(zzprime, origxprime); 620 Hacl_Bignum_Fsquare_fsquare_times(x3, xxprime, (uint32_t)1U); 621 Hacl_Bignum_Fsquare_fsquare_times(zzzprime, zzprime, (uint32_t)1U); 622 Hacl_Bignum_fmul(z3, zzzprime, qx); 623 Hacl_Bignum_Fsquare_fsquare_times(xx0, x, (uint32_t)1U); 624 Hacl_Bignum_Fsquare_fsquare_times(zz0, z, (uint32_t)1U); 625 zzz = buf + (uint32_t)10U; 626 xx = buf + (uint32_t)15U; 627 zz = buf + (uint32_t)20U; 628 Hacl_Bignum_fmul(x2, xx, zz); 629 Hacl_Bignum_fdifference(zz, xx); 630 scalar = (uint64_t)121665U; 631 Hacl_Bignum_fscalar(zzz, zz, scalar); 632 Hacl_Bignum_fsum(zzz, xx); 633 Hacl_Bignum_fmul(z2, zzz, zz); 634 } 635 636 static void 637 Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step( 638 uint64_t *nq, 639 uint64_t *nqpq, 640 uint64_t *nq2, 641 uint64_t *nqpq2, 642 uint64_t *q, 643 uint8_t byt 644 ) 645 { 646 uint64_t bit0 = (uint64_t)(byt >> (uint32_t)7U); 647 uint64_t bit; 648 Hacl_EC_Point_swap_conditional(nq, nqpq, bit0); 649 Hacl_EC_AddAndDouble_fmonty(nq2, nqpq2, nq, nqpq, q); 650 bit = (uint64_t)(byt >> (uint32_t)7U); 651 Hacl_EC_Point_swap_conditional(nq2, nqpq2, bit); 652 } 653 654 static void 655 Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step( 656 uint64_t *nq, 657 uint64_t *nqpq, 658 uint64_t *nq2, 659 uint64_t *nqpq2, 660 uint64_t *q, 661 uint8_t byt 662 ) 663 { 664 uint8_t byt1; 665 Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq, nqpq, nq2, nqpq2, q, byt); 666 byt1 = byt << (uint32_t)1U; 667 Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq2, nqpq2, nq, nqpq, q, byt1); 668 } 669 670 static void 671 Hacl_EC_Ladder_SmallLoop_cmult_small_loop( 672 uint64_t *nq, 673 uint64_t *nqpq, 674 uint64_t *nq2, 675 uint64_t *nqpq2, 676 uint64_t *q, 677 uint8_t byt, 678 uint32_t i 679 ) 680 { 681 if (!(i == (uint32_t)0U)) 682 { 683 uint32_t i_ = i - (uint32_t)1U; 684 uint8_t byt_; 685 Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step(nq, nqpq, nq2, nqpq2, q, byt); 686 byt_ = byt << (uint32_t)2U; 687 Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byt_, i_); 688 } 689 } 690 691 static void 692 Hacl_EC_Ladder_BigLoop_cmult_big_loop( 693 uint8_t *n1, 694 uint64_t *nq, 695 uint64_t *nqpq, 696 uint64_t *nq2, 697 uint64_t *nqpq2, 698 uint64_t *q, 699 uint32_t i 700 ) 701 { 702 if (!(i == (uint32_t)0U)) 703 { 704 uint32_t i1 = i - (uint32_t)1U; 705 uint8_t byte = n1[i1]; 706 Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byte, (uint32_t)4U); 707 Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, i1); 708 } 709 } 710 711 static void Hacl_EC_Ladder_cmult(uint64_t *result, uint8_t *n1, uint64_t *q) 712 { 713 uint64_t point_buf[40U] = { 0U }; 714 uint64_t *nq = point_buf; 715 uint64_t *nqpq = point_buf + (uint32_t)10U; 716 uint64_t *nq2 = point_buf + (uint32_t)20U; 717 uint64_t *nqpq2 = point_buf + (uint32_t)30U; 718 Hacl_EC_Point_copy(nqpq, q); 719 nq[0U] = (uint64_t)1U; 720 Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, (uint32_t)32U); 721 Hacl_EC_Point_copy(result, nq); 722 } 723 724 void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint) 725 { 726 uint64_t buf0[10U] = { 0U }; 727 uint64_t *x0 = buf0; 728 uint64_t *z = buf0 + (uint32_t)5U; 729 uint64_t *q; 730 Hacl_EC_Format_fexpand(x0, basepoint); 731 z[0U] = (uint64_t)1U; 732 q = buf0; 733 { 734 uint8_t e[32U] = { 0U }; 735 uint8_t e0; 736 uint8_t e31; 737 uint8_t e01; 738 uint8_t e311; 739 uint8_t e312; 740 uint8_t *scalar; 741 memcpy(e, secret, (uint32_t)32U * sizeof secret[0U]); 742 e0 = e[0U]; 743 e31 = e[31U]; 744 e01 = e0 & (uint8_t)248U; 745 e311 = e31 & (uint8_t)127U; 746 e312 = e311 | (uint8_t)64U; 747 e[0U] = e01; 748 e[31U] = e312; 749 scalar = e; 750 { 751 uint64_t buf[15U] = { 0U }; 752 uint64_t *nq = buf; 753 uint64_t *x = nq; 754 x[0U] = (uint64_t)1U; 755 Hacl_EC_Ladder_cmult(nq, scalar, q); 756 Hacl_EC_Format_scalar_of_point(mypublic, nq); 757 } 758 } 759 } 760