From: Luis Rivera Zamarripa Date: Thu, 20 Aug 2020 09:56:31 +0000 (+0300) Subject: [ecp] validation with coverity X-Git-Tag: v3.0.0~73 X-Git-Url: http://wagner.pp.ru/gitweb/?a=commitdiff_plain;h=35d2c614ff6e0c58ac6e052f166bea18aa4b7782;p=openssl-gost%2Fengine.git [ecp] validation with coverity --- diff --git a/ecp_id_GostR3410_2001_CryptoPro_A_ParamSet.c b/ecp_id_GostR3410_2001_CryptoPro_A_ParamSet.c index b309808..19b9f3f 100644 --- a/ecp_id_GostR3410_2001_CryptoPro_A_ParamSet.c +++ b/ecp_id_GostR3410_2001_CryptoPro_A_ParamSet.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_CRYPTOPRO_A_PARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -80,18 +84,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_GostR3410_2001_CryptoPro_A_ParamSet 64 5 '2^256 - 617' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_GostR3410_2001_CryptoPro_A_ParamSet 64 5 '2^256 - 617' */ /* curve description: id_GostR3410_2001_CryptoPro_A_ParamSet */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ /* n = 5 (from "5") */ /* s-c = 2^256 - [(1, 617)] (from "2^256 - 617") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 0, 1] */ /* eval z = z[0] + (z[1] << 52) + (z[2] << 103) + (z[3] << 154) + (z[4] << 205) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */ +/* balance = [0x1ffffffffffb2e, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe] */ #include typedef unsigned char fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1; @@ -103,6 +108,17 @@ typedef unsigned __int128 fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_CRYPTOPRO_A_PARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_addcarryx_u52 is an addition with carry. * Postconditions: @@ -236,7 +252,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u64(x2) & + arg3) | + (fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u64((~x2)) & + arg2)); *out1 = x3; } @@ -246,10 +266,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_cmovznz_u64( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] - * arg2: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] + * arg2: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_mul( uint64_t out1[5], const uint64_t arg1[5], const uint64_t arg2[5]) { @@ -411,9 +431,9 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_square( uint64_t out1[5], const uint64_t arg1[5]) { @@ -539,9 +559,9 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry( uint64_t out1[5], const uint64_t arg1[5]) { @@ -584,10 +604,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_add( uint64_t out1[5], const uint64_t arg1[5], const uint64_t arg2[5]) { @@ -614,10 +634,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_sub( uint64_t out1[5], const uint64_t arg1[5], const uint64_t arg2[5]) { @@ -644,9 +664,9 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_opp( uint64_t out1[5], const uint64_t arg1[5]) { @@ -710,7 +730,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -741,70 +761,70 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes( uint64_t x23; uint64_t x24; uint64_t x25; - uint64_t x26; - uint8_t x27; - uint64_t x28; - uint8_t x29; - uint64_t x30; - uint8_t x31; - uint64_t x32; - uint8_t x33; - uint64_t x34; - uint8_t x35; + uint8_t x26; + uint64_t x27; + uint8_t x28; + uint64_t x29; + uint8_t x30; + uint64_t x31; + uint8_t x32; + uint64_t x33; + uint8_t x34; + uint64_t x35; uint8_t x36; uint8_t x37; uint64_t x38; - uint64_t x39; - uint8_t x40; - uint64_t x41; - uint8_t x42; - uint64_t x43; - uint8_t x44; - uint64_t x45; - uint8_t x46; - uint64_t x47; - uint8_t x48; + uint8_t x39; + uint64_t x40; + uint8_t x41; + uint64_t x42; + uint8_t x43; + uint64_t x44; + uint8_t x45; + uint64_t x46; + uint8_t x47; + uint64_t x48; uint8_t x49; uint8_t x50; uint64_t x51; - uint64_t x52; - uint8_t x53; - uint64_t x54; - uint8_t x55; - uint64_t x56; - uint8_t x57; - uint64_t x58; - uint8_t x59; - uint64_t x60; - uint8_t x61; - uint64_t x62; - uint8_t x63; + uint8_t x52; + uint64_t x53; + uint8_t x54; + uint64_t x55; + uint8_t x56; + uint64_t x57; + uint8_t x58; + uint64_t x59; + uint8_t x60; + uint64_t x61; + uint8_t x62; + uint64_t x63; uint8_t x64; uint8_t x65; uint64_t x66; - uint64_t x67; - uint8_t x68; - uint64_t x69; - uint8_t x70; - uint64_t x71; - uint8_t x72; - uint64_t x73; - uint8_t x74; - uint64_t x75; - uint8_t x76; + uint8_t x67; + uint64_t x68; + uint8_t x69; + uint64_t x70; + uint8_t x71; + uint64_t x72; + uint8_t x73; + uint64_t x74; + uint8_t x75; + uint64_t x76; uint8_t x77; uint8_t x78; uint64_t x79; - uint64_t x80; - uint8_t x81; - uint64_t x82; - uint8_t x83; - uint64_t x84; - uint8_t x85; - uint64_t x86; - uint8_t x87; - uint64_t x88; - uint8_t x89; + uint8_t x80; + uint64_t x81; + uint8_t x82; + uint64_t x83; + uint8_t x84; + uint64_t x85; + uint8_t x86; + uint64_t x87; + uint8_t x88; + uint64_t x89; uint8_t x90; uint8_t x91; fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_subborrowx_u52( @@ -833,104 +853,104 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes( x23 = (x18 << 2); x24 = (x16 << 7); x25 = (x14 << 4); - x26 = (x12 >> 8); - x27 = (uint8_t)(x12 & UINT8_C(0xff)); - x28 = (x26 >> 8); - x29 = (uint8_t)(x26 & UINT8_C(0xff)); - x30 = (x28 >> 8); - x31 = (uint8_t)(x28 & UINT8_C(0xff)); - x32 = (x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (x32 >> 8); - x35 = (uint8_t)(x32 & UINT8_C(0xff)); - x36 = (uint8_t)(x34 >> 8); - x37 = (uint8_t)(x34 & UINT8_C(0xff)); - x38 = (x36 + x25); - x39 = (x38 >> 8); - x40 = (uint8_t)(x38 & UINT8_C(0xff)); - x41 = (x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (x41 >> 8); - x44 = (uint8_t)(x41 & UINT8_C(0xff)); - x45 = (x43 >> 8); - x46 = (uint8_t)(x43 & UINT8_C(0xff)); - x47 = (x45 >> 8); - x48 = (uint8_t)(x45 & UINT8_C(0xff)); - x49 = (uint8_t)(x47 >> 8); - x50 = (uint8_t)(x47 & UINT8_C(0xff)); - x51 = (x49 + x24); - x52 = (x51 >> 8); - x53 = (uint8_t)(x51 & UINT8_C(0xff)); - x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); - x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); - x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - x64 = (uint8_t)(x62 >> 8); - x65 = (uint8_t)(x62 & UINT8_C(0xff)); - x66 = (x64 + x23); - x67 = (x66 >> 8); - x68 = (uint8_t)(x66 & UINT8_C(0xff)); - x69 = (x67 >> 8); - x70 = (uint8_t)(x67 & UINT8_C(0xff)); - x71 = (x69 >> 8); - x72 = (uint8_t)(x69 & UINT8_C(0xff)); - x73 = (x71 >> 8); - x74 = (uint8_t)(x71 & UINT8_C(0xff)); - x75 = (x73 >> 8); - x76 = (uint8_t)(x73 & UINT8_C(0xff)); - x77 = (uint8_t)(x75 >> 8); - x78 = (uint8_t)(x75 & UINT8_C(0xff)); - x79 = (x77 + x22); - x80 = (x79 >> 8); - x81 = (uint8_t)(x79 & UINT8_C(0xff)); - x82 = (x80 >> 8); - x83 = (uint8_t)(x80 & UINT8_C(0xff)); - x84 = (x82 >> 8); - x85 = (uint8_t)(x82 & UINT8_C(0xff)); - x86 = (x84 >> 8); - x87 = (uint8_t)(x84 & UINT8_C(0xff)); - x88 = (x86 >> 8); - x89 = (uint8_t)(x86 & UINT8_C(0xff)); - x90 = (uint8_t)(x88 >> 8); - x91 = (uint8_t)(x88 & UINT8_C(0xff)); - out1[0] = x27; - out1[1] = x29; - out1[2] = x31; - out1[3] = x33; - out1[4] = x35; - out1[5] = x37; - out1[6] = x40; - out1[7] = x42; - out1[8] = x44; - out1[9] = x46; - out1[10] = x48; - out1[11] = x50; - out1[12] = x53; - out1[13] = x55; - out1[14] = x57; - out1[15] = x59; - out1[16] = x61; - out1[17] = x63; - out1[18] = x65; - out1[19] = x68; - out1[20] = x70; - out1[21] = x72; - out1[22] = x74; - out1[23] = x76; - out1[24] = x78; - out1[25] = x81; - out1[26] = x83; - out1[27] = x85; - out1[28] = x87; - out1[29] = x89; - out1[30] = x91; - out1[31] = x90; + x26 = (uint8_t)(x12 & UINT8_C(0xff)); + x27 = (x12 >> 8); + x28 = (uint8_t)(x27 & UINT8_C(0xff)); + x29 = (x27 >> 8); + x30 = (uint8_t)(x29 & UINT8_C(0xff)); + x31 = (x29 >> 8); + x32 = (uint8_t)(x31 & UINT8_C(0xff)); + x33 = (x31 >> 8); + x34 = (uint8_t)(x33 & UINT8_C(0xff)); + x35 = (x33 >> 8); + x36 = (uint8_t)(x35 & UINT8_C(0xff)); + x37 = (uint8_t)(x35 >> 8); + x38 = (x25 + (uint64_t)x37); + x39 = (uint8_t)(x38 & UINT8_C(0xff)); + x40 = (x38 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (x42 >> 8); + x45 = (uint8_t)(x44 & UINT8_C(0xff)); + x46 = (x44 >> 8); + x47 = (uint8_t)(x46 & UINT8_C(0xff)); + x48 = (x46 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (uint8_t)(x48 >> 8); + x51 = (x24 + (uint64_t)x50); + x52 = (uint8_t)(x51 & UINT8_C(0xff)); + x53 = (x51 >> 8); + x54 = (uint8_t)(x53 & UINT8_C(0xff)); + x55 = (x53 >> 8); + x56 = (uint8_t)(x55 & UINT8_C(0xff)); + x57 = (x55 >> 8); + x58 = (uint8_t)(x57 & UINT8_C(0xff)); + x59 = (x57 >> 8); + x60 = (uint8_t)(x59 & UINT8_C(0xff)); + x61 = (x59 >> 8); + x62 = (uint8_t)(x61 & UINT8_C(0xff)); + x63 = (x61 >> 8); + x64 = (uint8_t)(x63 & UINT8_C(0xff)); + x65 = (uint8_t)(x63 >> 8); + x66 = (x23 + (uint64_t)x65); + x67 = (uint8_t)(x66 & UINT8_C(0xff)); + x68 = (x66 >> 8); + x69 = (uint8_t)(x68 & UINT8_C(0xff)); + x70 = (x68 >> 8); + x71 = (uint8_t)(x70 & UINT8_C(0xff)); + x72 = (x70 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); + x74 = (x72 >> 8); + x75 = (uint8_t)(x74 & UINT8_C(0xff)); + x76 = (x74 >> 8); + x77 = (uint8_t)(x76 & UINT8_C(0xff)); + x78 = (uint8_t)(x76 >> 8); + x79 = (x22 + (uint64_t)x78); + x80 = (uint8_t)(x79 & UINT8_C(0xff)); + x81 = (x79 >> 8); + x82 = (uint8_t)(x81 & UINT8_C(0xff)); + x83 = (x81 >> 8); + x84 = (uint8_t)(x83 & UINT8_C(0xff)); + x85 = (x83 >> 8); + x86 = (uint8_t)(x85 & UINT8_C(0xff)); + x87 = (x85 >> 8); + x88 = (uint8_t)(x87 & UINT8_C(0xff)); + x89 = (x87 >> 8); + x90 = (uint8_t)(x89 & UINT8_C(0xff)); + x91 = (uint8_t)(x89 >> 8); + out1[0] = x26; + out1[1] = x28; + out1[2] = x30; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x39; + out1[7] = x41; + out1[8] = x43; + out1[9] = x45; + out1[10] = x47; + out1[11] = x49; + out1[12] = x52; + out1[13] = x54; + out1[14] = x56; + out1[15] = x58; + out1[16] = x60; + out1[17] = x62; + out1[18] = x64; + out1[19] = x67; + out1[20] = x69; + out1[21] = x71; + out1[22] = x73; + out1[23] = x75; + out1[24] = x77; + out1[25] = x80; + out1[26] = x82; + out1[27] = x84; + out1[28] = x86; + out1[29] = x88; + out1[30] = x90; + out1[31] = x91; } /* @@ -941,7 +961,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_from_bytes( uint64_t out1[5], const uint8_t arg1[32]) { @@ -978,22 +998,44 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_from_bytes( uint64_t x31; uint8_t x32; uint64_t x33; - uint8_t x34; + uint64_t x34; uint64_t x35; uint64_t x36; uint64_t x37; uint64_t x38; uint64_t x39; - uint64_t x40; - fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1 x41; + uint8_t x40; + uint64_t x41; uint64_t x42; uint64_t x43; - uint8_t x44; + uint64_t x44; uint64_t x45; uint64_t x46; - uint8_t x47; - uint64_t x48; + uint64_t x47; + fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1 x48; uint64_t x49; + uint64_t x50; + uint64_t x51; + uint64_t x52; + uint64_t x53; + uint64_t x54; + uint64_t x55; + uint64_t x56; + uint8_t x57; + uint64_t x58; + uint64_t x59; + uint64_t x60; + uint64_t x61; + uint64_t x62; + uint64_t x63; + uint64_t x64; + uint8_t x65; + uint64_t x66; + uint64_t x67; + uint64_t x68; + uint64_t x69; + uint64_t x70; + uint64_t x71; x1 = ((uint64_t)(arg1[31]) << 43); x2 = ((uint64_t)(arg1[30]) << 35); x3 = ((uint64_t)(arg1[29]) << 27); @@ -1026,28 +1068,50 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_from_bytes( x30 = ((uint64_t)(arg1[2]) << 16); x31 = ((uint64_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + x26)))))); - x34 = (uint8_t)(x33 >> 52); - x35 = (x33 & UINT64_C(0xfffffffffffff)); - x36 = (x6 + (x5 + (x4 + (x3 + (x2 + x1))))); - x37 = (x12 + (x11 + (x10 + (x9 + (x8 + x7))))); - x38 = (x19 + (x18 + (x17 + (x16 + (x15 + (x14 + x13)))))); - x39 = (x25 + (x24 + (x23 + (x22 + (x21 + x20))))); - x40 = (x34 + x39); - x41 = (fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1)(x40 >> 51); - x42 = (x40 & UINT64_C(0x7ffffffffffff)); - x43 = (x41 + x38); - x44 = (uint8_t)(x43 >> 51); - x45 = (x43 & UINT64_C(0x7ffffffffffff)); - x46 = (x44 + x37); - x47 = (uint8_t)(x46 >> 51); - x48 = (x46 & UINT64_C(0x7ffffffffffff)); - x49 = (x47 + x36); - out1[0] = x35; - out1[1] = x42; - out1[2] = x45; - out1[3] = x48; - out1[4] = x49; + x33 = (x31 + (uint64_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x28 + x35); + x37 = (x27 + x36); + x38 = (x26 + x37); + x39 = (x38 & UINT64_C(0xfffffffffffff)); + x40 = (uint8_t)(x38 >> 52); + x41 = (x25 + (uint64_t)x40); + x42 = (x24 + x41); + x43 = (x23 + x42); + x44 = (x22 + x43); + x45 = (x21 + x44); + x46 = (x20 + x45); + x47 = (x46 & UINT64_C(0x7ffffffffffff)); + x48 = (fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1)(x46 >> 51); + x49 = (x19 + (uint64_t)x48); + x50 = (x18 + x49); + x51 = (x17 + x50); + x52 = (x16 + x51); + x53 = (x15 + x52); + x54 = (x14 + x53); + x55 = (x13 + x54); + x56 = (x55 & UINT64_C(0x7ffffffffffff)); + x57 = (uint8_t)(x55 >> 51); + x58 = (x12 + (uint64_t)x57); + x59 = (x11 + x58); + x60 = (x10 + x59); + x61 = (x9 + x60); + x62 = (x8 + x61); + x63 = (x7 + x62); + x64 = (x63 & UINT64_C(0x7ffffffffffff)); + x65 = (uint8_t)(x63 >> 51); + x66 = (x6 + (uint64_t)x65); + x67 = (x5 + x66); + x68 = (x4 + x67); + x69 = (x3 + x68); + x70 = (x2 + x69); + x71 = (x1 + x70); + out1[0] = x39; + out1[1] = x47; + out1[2] = x56; + out1[3] = x64; + out1[4] = x71; } /* END verbatim fiat code */ @@ -3287,7 +3351,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -3295,7 +3359,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -3361,7 +3425,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -3437,8 +3501,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -3499,6 +3563,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -3514,6 +3584,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -3524,6 +3599,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -3541,8 +3622,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_CryptoPro_A_ParamSet( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -3581,6 +3667,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_CryptoPro_A_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -3620,6 +3710,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_CryptoPro_A_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -3666,6 +3760,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_CRYPTOPRO_A_PARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -3714,18 +3812,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_GostR3410_2001_CryptoPro_A_ParamSet 32 '(auto)' '2^256 - 617' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_GostR3410_2001_CryptoPro_A_ParamSet 32 '(auto)' '2^256 - 617' */ /* curve description: id_GostR3410_2001_CryptoPro_A_ParamSet */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ /* n = 11 (from "(auto)") */ /* s-c = 2^256 - [(1, 617)] (from "2^256 - 617") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 0, 1] */ /* eval z = z[0] + (z[1] << 24) + (z[2] << 47) + (z[3] << 70) + (z[4] << 94) + (z[5] << 117) + (z[6] << 140) + (z[7] << 163) + (z[8] << 187) + (z[9] << 210) + (z[10] << 233) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */ +/* balance = [0x1fffb2e, 0xfffffe, 0xfffffe, 0x1fffffe, 0xfffffe, 0xfffffe, 0xfffffe, 0x1fffffe, 0xfffffe, 0xfffffe, 0xfffffe] */ #include typedef unsigned char fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1; @@ -3735,6 +3834,17 @@ typedef signed char fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_CRYPTOPRO_A_PARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_addcarryx_u24 is an addition with carry. * Postconditions: @@ -3868,7 +3978,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u32(x2) & + arg3) | + (fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_value_barrier_u32((~x2)) & + arg2)); *out1 = x3; } @@ -3878,10 +3992,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_cmovznz_u32( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] - * arg2: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * arg1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] + * arg2: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_mul( uint32_t out1[11], const uint32_t arg1[11], const uint32_t arg2[11]) { @@ -4281,9 +4395,9 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * arg1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_square( uint32_t out1[11], const uint32_t arg1[11]) { @@ -4580,9 +4694,9 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * arg1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry( uint32_t out1[11], const uint32_t arg1[11]) { @@ -4655,10 +4769,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] - * arg2: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] + * arg2: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: - * out1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * out1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_add( uint32_t out1[11], const uint32_t arg1[11], const uint32_t arg2[11]) { @@ -4703,10 +4817,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] - * arg2: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] + * arg2: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: - * out1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * out1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_sub( uint32_t out1[11], const uint32_t arg1[11], const uint32_t arg2[11]) { @@ -4751,9 +4865,9 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: - * out1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * out1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_opp( uint32_t out1[11], const uint32_t arg1[11]) { @@ -4859,7 +4973,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -4919,76 +5033,75 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes( uint32_t x52; uint32_t x53; uint32_t x54; - uint32_t x55; - uint8_t x56; + uint8_t x55; + uint32_t x56; uint8_t x57; uint8_t x58; uint8_t x59; uint32_t x60; uint8_t x61; uint8_t x62; - uint8_t x63; - uint32_t x64; + uint32_t x63; + uint8_t x64; uint32_t x65; uint8_t x66; uint32_t x67; uint8_t x68; uint8_t x69; - uint8_t x70; - uint32_t x71; + uint32_t x70; + uint8_t x71; uint32_t x72; uint8_t x73; uint32_t x74; uint8_t x75; uint8_t x76; - uint8_t x77; - uint32_t x78; + uint32_t x77; + uint8_t x78; uint32_t x79; uint8_t x80; uint32_t x81; uint8_t x82; uint8_t x83; - uint8_t x84; - uint32_t x85; + uint32_t x84; + uint8_t x85; uint32_t x86; uint8_t x87; uint32_t x88; uint8_t x89; uint8_t x90; - uint8_t x91; - uint32_t x92; + uint32_t x91; + uint8_t x92; uint32_t x93; uint8_t x94; uint32_t x95; uint8_t x96; uint8_t x97; - uint8_t x98; - uint32_t x99; + uint32_t x98; + uint8_t x99; uint32_t x100; uint8_t x101; uint32_t x102; uint8_t x103; uint8_t x104; - uint8_t x105; - uint32_t x106; + uint32_t x105; + uint8_t x106; uint32_t x107; uint8_t x108; uint32_t x109; uint8_t x110; uint8_t x111; - uint8_t x112; - uint32_t x113; + uint32_t x112; + uint8_t x113; uint32_t x114; uint8_t x115; uint32_t x116; uint8_t x117; fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1 x118; - uint8_t x119; - uint32_t x120; + uint32_t x119; + uint8_t x120; uint32_t x121; uint8_t x122; uint8_t x123; - uint8_t x124; fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_subborrowx_u24( &x1, &x2, 0x0, (arg1[0]), UINT32_C(0xfffd97)); fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_subborrowx_u23( @@ -5044,107 +5157,106 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes( x52 = (x32 << 6); x53 = (x30 << 6); x54 = (x28 << 7); - x55 = (x24 >> 8); - x56 = (uint8_t)(x24 & UINT8_C(0xff)); - x57 = (uint8_t)(x55 >> 8); - x58 = (uint8_t)(x55 & UINT8_C(0xff)); - x59 = (uint8_t)(x57 & UINT8_C(0xff)); + x55 = (uint8_t)(x24 & UINT8_C(0xff)); + x56 = (x24 >> 8); + x57 = (uint8_t)(x56 & UINT8_C(0xff)); + x58 = (uint8_t)(x56 >> 8); + x59 = (uint8_t)(x26 & UINT8_C(0xff)); x60 = (x26 >> 8); - x61 = (uint8_t)(x26 & UINT8_C(0xff)); + x61 = (uint8_t)(x60 & UINT8_C(0xff)); x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - x64 = (x62 + x54); - x65 = (x64 >> 8); - x66 = (uint8_t)(x64 & UINT8_C(0xff)); + x63 = (x54 + (uint32_t)x62); + x64 = (uint8_t)(x63 & UINT8_C(0xff)); + x65 = (x63 >> 8); + x66 = (uint8_t)(x65 & UINT8_C(0xff)); x67 = (x65 >> 8); - x68 = (uint8_t)(x65 & UINT8_C(0xff)); + x68 = (uint8_t)(x67 & UINT8_C(0xff)); x69 = (uint8_t)(x67 >> 8); - x70 = (uint8_t)(x67 & UINT8_C(0xff)); - x71 = (x69 + x53); - x72 = (x71 >> 8); - x73 = (uint8_t)(x71 & UINT8_C(0xff)); + x70 = (x53 + (uint32_t)x69); + x71 = (uint8_t)(x70 & UINT8_C(0xff)); + x72 = (x70 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); x74 = (x72 >> 8); - x75 = (uint8_t)(x72 & UINT8_C(0xff)); + x75 = (uint8_t)(x74 & UINT8_C(0xff)); x76 = (uint8_t)(x74 >> 8); - x77 = (uint8_t)(x74 & UINT8_C(0xff)); - x78 = (x76 + x52); - x79 = (x78 >> 8); - x80 = (uint8_t)(x78 & UINT8_C(0xff)); + x77 = (x52 + (uint32_t)x76); + x78 = (uint8_t)(x77 & UINT8_C(0xff)); + x79 = (x77 >> 8); + x80 = (uint8_t)(x79 & UINT8_C(0xff)); x81 = (x79 >> 8); - x82 = (uint8_t)(x79 & UINT8_C(0xff)); + x82 = (uint8_t)(x81 & UINT8_C(0xff)); x83 = (uint8_t)(x81 >> 8); - x84 = (uint8_t)(x81 & UINT8_C(0xff)); - x85 = (x83 + x51); - x86 = (x85 >> 8); - x87 = (uint8_t)(x85 & UINT8_C(0xff)); + x84 = (x51 + (uint32_t)x83); + x85 = (uint8_t)(x84 & UINT8_C(0xff)); + x86 = (x84 >> 8); + x87 = (uint8_t)(x86 & UINT8_C(0xff)); x88 = (x86 >> 8); - x89 = (uint8_t)(x86 & UINT8_C(0xff)); + x89 = (uint8_t)(x88 & UINT8_C(0xff)); x90 = (uint8_t)(x88 >> 8); - x91 = (uint8_t)(x88 & UINT8_C(0xff)); - x92 = (x90 + x50); - x93 = (x92 >> 8); - x94 = (uint8_t)(x92 & UINT8_C(0xff)); + x91 = (x50 + (uint32_t)x90); + x92 = (uint8_t)(x91 & UINT8_C(0xff)); + x93 = (x91 >> 8); + x94 = (uint8_t)(x93 & UINT8_C(0xff)); x95 = (x93 >> 8); - x96 = (uint8_t)(x93 & UINT8_C(0xff)); + x96 = (uint8_t)(x95 & UINT8_C(0xff)); x97 = (uint8_t)(x95 >> 8); - x98 = (uint8_t)(x95 & UINT8_C(0xff)); - x99 = (x97 + x49); - x100 = (x99 >> 8); - x101 = (uint8_t)(x99 & UINT8_C(0xff)); + x98 = (x49 + (uint32_t)x97); + x99 = (uint8_t)(x98 & UINT8_C(0xff)); + x100 = (x98 >> 8); + x101 = (uint8_t)(x100 & UINT8_C(0xff)); x102 = (x100 >> 8); - x103 = (uint8_t)(x100 & UINT8_C(0xff)); + x103 = (uint8_t)(x102 & UINT8_C(0xff)); x104 = (uint8_t)(x102 >> 8); - x105 = (uint8_t)(x102 & UINT8_C(0xff)); - x106 = (x104 + x48); - x107 = (x106 >> 8); - x108 = (uint8_t)(x106 & UINT8_C(0xff)); + x105 = (x48 + (uint32_t)x104); + x106 = (uint8_t)(x105 & UINT8_C(0xff)); + x107 = (x105 >> 8); + x108 = (uint8_t)(x107 & UINT8_C(0xff)); x109 = (x107 >> 8); - x110 = (uint8_t)(x107 & UINT8_C(0xff)); + x110 = (uint8_t)(x109 & UINT8_C(0xff)); x111 = (uint8_t)(x109 >> 8); - x112 = (uint8_t)(x109 & UINT8_C(0xff)); - x113 = (x111 + x47); - x114 = (x113 >> 8); - x115 = (uint8_t)(x113 & UINT8_C(0xff)); + x112 = (x47 + (uint32_t)x111); + x113 = (uint8_t)(x112 & UINT8_C(0xff)); + x114 = (x112 >> 8); + x115 = (uint8_t)(x114 & UINT8_C(0xff)); x116 = (x114 >> 8); - x117 = (uint8_t)(x114 & UINT8_C(0xff)); + x117 = (uint8_t)(x116 & UINT8_C(0xff)); x118 = (fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1)(x116 >> 8); - x119 = (uint8_t)(x116 & UINT8_C(0xff)); - x120 = (x118 + x46); - x121 = (x120 >> 8); - x122 = (uint8_t)(x120 & UINT8_C(0xff)); + x119 = (x46 + (uint32_t)x118); + x120 = (uint8_t)(x119 & UINT8_C(0xff)); + x121 = (x119 >> 8); + x122 = (uint8_t)(x121 & UINT8_C(0xff)); x123 = (uint8_t)(x121 >> 8); - x124 = (uint8_t)(x121 & UINT8_C(0xff)); - out1[0] = x56; - out1[1] = x58; - out1[2] = x59; - out1[3] = x61; - out1[4] = x63; - out1[5] = x66; - out1[6] = x68; - out1[7] = x70; - out1[8] = x73; - out1[9] = x75; - out1[10] = x77; - out1[11] = x80; - out1[12] = x82; - out1[13] = x84; - out1[14] = x87; - out1[15] = x89; - out1[16] = x91; - out1[17] = x94; - out1[18] = x96; - out1[19] = x98; - out1[20] = x101; - out1[21] = x103; - out1[22] = x105; - out1[23] = x108; - out1[24] = x110; - out1[25] = x112; - out1[26] = x115; - out1[27] = x117; - out1[28] = x119; - out1[29] = x122; - out1[30] = x124; + out1[0] = x55; + out1[1] = x57; + out1[2] = x58; + out1[3] = x59; + out1[4] = x61; + out1[5] = x64; + out1[6] = x66; + out1[7] = x68; + out1[8] = x71; + out1[9] = x73; + out1[10] = x75; + out1[11] = x78; + out1[12] = x80; + out1[13] = x82; + out1[14] = x85; + out1[15] = x87; + out1[16] = x89; + out1[17] = x92; + out1[18] = x94; + out1[19] = x96; + out1[20] = x99; + out1[21] = x101; + out1[22] = x103; + out1[23] = x106; + out1[24] = x108; + out1[25] = x110; + out1[26] = x113; + out1[27] = x115; + out1[28] = x117; + out1[29] = x120; + out1[30] = x122; out1[31] = x123; } @@ -5156,7 +5268,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_from_bytes( uint32_t out1[11], const uint8_t arg1[32]) { @@ -5197,40 +5309,49 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_from_bytes( uint32_t x35; uint32_t x36; uint32_t x37; - uint32_t x38; + fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1 x38; uint32_t x39; uint32_t x40; uint32_t x41; uint32_t x42; - uint32_t x43; + uint8_t x43; uint32_t x44; - fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1 x45; + uint32_t x45; uint32_t x46; uint32_t x47; uint8_t x48; uint32_t x49; uint32_t x50; - uint8_t x51; + uint32_t x51; uint32_t x52; - uint32_t x53; - uint8_t x54; + uint8_t x53; + uint32_t x54; uint32_t x55; uint32_t x56; - uint8_t x57; - uint32_t x58; + uint32_t x57; + uint8_t x58; uint32_t x59; - uint8_t x60; + uint32_t x60; uint32_t x61; uint32_t x62; uint8_t x63; uint32_t x64; uint32_t x65; - uint8_t x66; + uint32_t x66; uint32_t x67; - uint32_t x68; - uint8_t x69; + uint8_t x68; + uint32_t x69; uint32_t x70; uint32_t x71; + uint32_t x72; + uint8_t x73; + uint32_t x74; + uint32_t x75; + uint32_t x76; + uint32_t x77; + uint8_t x78; + uint32_t x79; + uint32_t x80; x1 = ((uint32_t)(arg1[31]) << 15); x2 = ((uint32_t)(arg1[30]) << 7); x3 = ((uint32_t)(arg1[29]) << 22); @@ -5263,56 +5384,65 @@ static void fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_from_bytes( x30 = ((uint32_t)(arg1[2]) << 16); x31 = ((uint32_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + x30)); - x34 = (x33 & UINT32_C(0xffffff)); - x35 = (x2 + x1); - x36 = (x5 + (x4 + x3)); - x37 = (x8 + (x7 + x6)); - x38 = (x11 + (x10 + x9)); - x39 = (x14 + (x13 + x12)); - x40 = (x17 + (x16 + x15)); - x41 = (x20 + (x19 + x18)); - x42 = (x23 + (x22 + x21)); - x43 = (x26 + (x25 + x24)); - x44 = (x29 + (x28 + x27)); - x45 = (fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1)(x44 >> 23); - x46 = (x44 & UINT32_C(0x7fffff)); - x47 = (x45 + x43); - x48 = (uint8_t)(x47 >> 23); - x49 = (x47 & UINT32_C(0x7fffff)); - x50 = (x48 + x42); - x51 = (uint8_t)(x50 >> 24); - x52 = (x50 & UINT32_C(0xffffff)); - x53 = (x51 + x41); - x54 = (uint8_t)(x53 >> 23); - x55 = (x53 & UINT32_C(0x7fffff)); - x56 = (x54 + x40); - x57 = (uint8_t)(x56 >> 23); - x58 = (x56 & UINT32_C(0x7fffff)); - x59 = (x57 + x39); - x60 = (uint8_t)(x59 >> 23); - x61 = (x59 & UINT32_C(0x7fffff)); - x62 = (x60 + x38); - x63 = (uint8_t)(x62 >> 24); - x64 = (x62 & UINT32_C(0xffffff)); - x65 = (x63 + x37); - x66 = (uint8_t)(x65 >> 23); - x67 = (x65 & UINT32_C(0x7fffff)); - x68 = (x66 + x36); - x69 = (uint8_t)(x68 >> 23); - x70 = (x68 & UINT32_C(0x7fffff)); - x71 = (x69 + x35); + x33 = (x31 + (uint32_t)x32); + x34 = (x30 + x33); + x35 = (x28 + (uint32_t)x29); + x36 = (x27 + x35); + x37 = (x36 & UINT32_C(0x7fffff)); + x38 = (fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_uint1)(x36 >> 23); + x39 = (x26 + (uint32_t)x38); + x40 = (x25 + x39); + x41 = (x24 + x40); + x42 = (x41 & UINT32_C(0x7fffff)); + x43 = (uint8_t)(x41 >> 23); + x44 = (x23 + (uint32_t)x43); + x45 = (x22 + x44); + x46 = (x21 + x45); + x47 = (x46 & UINT32_C(0xffffff)); + x48 = (uint8_t)(x46 >> 24); + x49 = (x20 + (uint32_t)x48); + x50 = (x19 + x49); + x51 = (x18 + x50); + x52 = (x51 & UINT32_C(0x7fffff)); + x53 = (uint8_t)(x51 >> 23); + x54 = (x17 + (uint32_t)x53); + x55 = (x16 + x54); + x56 = (x15 + x55); + x57 = (x56 & UINT32_C(0x7fffff)); + x58 = (uint8_t)(x56 >> 23); + x59 = (x14 + (uint32_t)x58); + x60 = (x13 + x59); + x61 = (x12 + x60); + x62 = (x61 & UINT32_C(0x7fffff)); + x63 = (uint8_t)(x61 >> 23); + x64 = (x11 + (uint32_t)x63); + x65 = (x10 + x64); + x66 = (x9 + x65); + x67 = (x66 & UINT32_C(0xffffff)); + x68 = (uint8_t)(x66 >> 24); + x69 = (x8 + (uint32_t)x68); + x70 = (x7 + x69); + x71 = (x6 + x70); + x72 = (x71 & UINT32_C(0x7fffff)); + x73 = (uint8_t)(x71 >> 23); + x74 = (x5 + (uint32_t)x73); + x75 = (x4 + x74); + x76 = (x3 + x75); + x77 = (x76 & UINT32_C(0x7fffff)); + x78 = (uint8_t)(x76 >> 23); + x79 = (x2 + (uint32_t)x78); + x80 = (x1 + x79); out1[0] = x34; - out1[1] = x46; - out1[2] = x49; - out1[3] = x52; - out1[4] = x55; - out1[5] = x58; - out1[6] = x61; - out1[7] = x64; - out1[8] = x67; - out1[9] = x70; - out1[10] = x71; + out1[1] = x37; + out1[2] = x42; + out1[3] = x47; + out1[4] = x52; + out1[5] = x57; + out1[6] = x62; + out1[7] = x67; + out1[8] = x72; + out1[9] = x77; + out1[10] = x80; } /* END verbatim fiat code */ @@ -8162,7 +8292,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -8170,7 +8300,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -8236,7 +8366,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -8312,8 +8442,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -8374,6 +8504,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -8389,6 +8525,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -8399,6 +8540,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_A_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -8416,8 +8563,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_CryptoPro_A_ParamSet( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -8456,6 +8608,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_CryptoPro_A_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -8495,6 +8651,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_CryptoPro_A_ParamSet(const EC_GROUP *group, EC_POINT *r, diff --git a/ecp_id_GostR3410_2001_CryptoPro_B_ParamSet.c b/ecp_id_GostR3410_2001_CryptoPro_B_ParamSet.c index 87264e5..05e521e 100644 --- a/ecp_id_GostR3410_2001_CryptoPro_B_ParamSet.c +++ b/ecp_id_GostR3410_2001_CryptoPro_B_ParamSet.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_CRYPTOPRO_B_PARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -73,7 +77,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_GostR3410_2001_CryptoPro_B_ParamSet 64 '2^255 + 3225' */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_GostR3410_2001_CryptoPro_B_ParamSet 64 '2^255 + 3225' */ /* curve description: id_GostR3410_2001_CryptoPro_B_ParamSet */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ @@ -100,6 +104,17 @@ typedef unsigned __int128 fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_CRYPTOPRO_B_PARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_addcarryx_u64 is an addition with carry. * Postconditions: @@ -204,7 +219,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u64(x2) & + arg3) | + (fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u64((~x2)) & + arg2)); *out1 = x3; } @@ -1524,7 +1543,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_montgomery( static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_nonzero( uint64_t *out1, const uint64_t arg1[4]) { uint64_t x1; - x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | (uint64_t)0x0)))); + x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); *out1 = x1; } @@ -1562,7 +1581,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_selectznz( } /* - * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -1579,18 +1598,18 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes( uint64_t x2; uint64_t x3; uint64_t x4; - uint64_t x5; - uint8_t x6; - uint64_t x7; - uint8_t x8; - uint64_t x9; - uint8_t x10; - uint64_t x11; - uint8_t x12; - uint64_t x13; - uint8_t x14; - uint64_t x15; - uint8_t x16; + uint8_t x5; + uint64_t x6; + uint8_t x7; + uint64_t x8; + uint8_t x9; + uint64_t x10; + uint8_t x11; + uint64_t x12; + uint8_t x13; + uint64_t x14; + uint8_t x15; + uint64_t x16; uint8_t x17; uint8_t x18; uint8_t x19; @@ -1608,21 +1627,21 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes( uint8_t x31; uint8_t x32; uint8_t x33; - uint8_t x34; - uint64_t x35; - uint8_t x36; - uint64_t x37; - uint8_t x38; - uint64_t x39; - uint8_t x40; - uint64_t x41; - uint8_t x42; - uint64_t x43; - uint8_t x44; - uint64_t x45; + uint64_t x34; + uint8_t x35; + uint64_t x36; + uint8_t x37; + uint64_t x38; + uint8_t x39; + uint64_t x40; + uint8_t x41; + uint64_t x42; + uint8_t x43; + uint64_t x44; + uint8_t x45; uint8_t x46; uint8_t x47; - uint8_t x48; + uint64_t x48; uint8_t x49; uint64_t x50; uint8_t x51; @@ -1634,109 +1653,103 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes( uint8_t x57; uint64_t x58; uint8_t x59; - uint64_t x60; - uint8_t x61; - uint8_t x62; - uint8_t x63; + uint8_t x60; x1 = (arg1[3]); x2 = (arg1[2]); x3 = (arg1[1]); x4 = (arg1[0]); - x5 = (x4 >> 8); - x6 = (uint8_t)(x4 & UINT8_C(0xff)); - x7 = (x5 >> 8); - x8 = (uint8_t)(x5 & UINT8_C(0xff)); - x9 = (x7 >> 8); - x10 = (uint8_t)(x7 & UINT8_C(0xff)); - x11 = (x9 >> 8); - x12 = (uint8_t)(x9 & UINT8_C(0xff)); - x13 = (x11 >> 8); - x14 = (uint8_t)(x11 & UINT8_C(0xff)); - x15 = (x13 >> 8); - x16 = (uint8_t)(x13 & UINT8_C(0xff)); - x17 = (uint8_t)(x15 >> 8); - x18 = (uint8_t)(x15 & UINT8_C(0xff)); - x19 = (uint8_t)(x17 & UINT8_C(0xff)); + x5 = (uint8_t)(x4 & UINT8_C(0xff)); + x6 = (x4 >> 8); + x7 = (uint8_t)(x6 & UINT8_C(0xff)); + x8 = (x6 >> 8); + x9 = (uint8_t)(x8 & UINT8_C(0xff)); + x10 = (x8 >> 8); + x11 = (uint8_t)(x10 & UINT8_C(0xff)); + x12 = (x10 >> 8); + x13 = (uint8_t)(x12 & UINT8_C(0xff)); + x14 = (x12 >> 8); + x15 = (uint8_t)(x14 & UINT8_C(0xff)); + x16 = (x14 >> 8); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); + x18 = (uint8_t)(x16 >> 8); + x19 = (uint8_t)(x3 & UINT8_C(0xff)); x20 = (x3 >> 8); - x21 = (uint8_t)(x3 & UINT8_C(0xff)); + x21 = (uint8_t)(x20 & UINT8_C(0xff)); x22 = (x20 >> 8); - x23 = (uint8_t)(x20 & UINT8_C(0xff)); + x23 = (uint8_t)(x22 & UINT8_C(0xff)); x24 = (x22 >> 8); - x25 = (uint8_t)(x22 & UINT8_C(0xff)); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); x26 = (x24 >> 8); - x27 = (uint8_t)(x24 & UINT8_C(0xff)); + x27 = (uint8_t)(x26 & UINT8_C(0xff)); x28 = (x26 >> 8); - x29 = (uint8_t)(x26 & UINT8_C(0xff)); + x29 = (uint8_t)(x28 & UINT8_C(0xff)); x30 = (x28 >> 8); - x31 = (uint8_t)(x28 & UINT8_C(0xff)); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); x32 = (uint8_t)(x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (uint8_t)(x32 & UINT8_C(0xff)); - x35 = (x2 >> 8); - x36 = (uint8_t)(x2 & UINT8_C(0xff)); - x37 = (x35 >> 8); - x38 = (uint8_t)(x35 & UINT8_C(0xff)); - x39 = (x37 >> 8); - x40 = (uint8_t)(x37 & UINT8_C(0xff)); - x41 = (x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (x41 >> 8); - x44 = (uint8_t)(x41 & UINT8_C(0xff)); - x45 = (x43 >> 8); - x46 = (uint8_t)(x43 & UINT8_C(0xff)); - x47 = (uint8_t)(x45 >> 8); - x48 = (uint8_t)(x45 & UINT8_C(0xff)); - x49 = (uint8_t)(x47 & UINT8_C(0xff)); - x50 = (x1 >> 8); - x51 = (uint8_t)(x1 & UINT8_C(0xff)); + x33 = (uint8_t)(x2 & UINT8_C(0xff)); + x34 = (x2 >> 8); + x35 = (uint8_t)(x34 & UINT8_C(0xff)); + x36 = (x34 >> 8); + x37 = (uint8_t)(x36 & UINT8_C(0xff)); + x38 = (x36 >> 8); + x39 = (uint8_t)(x38 & UINT8_C(0xff)); + x40 = (x38 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (x42 >> 8); + x45 = (uint8_t)(x44 & UINT8_C(0xff)); + x46 = (uint8_t)(x44 >> 8); + x47 = (uint8_t)(x1 & UINT8_C(0xff)); + x48 = (x1 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (x48 >> 8); + x51 = (uint8_t)(x50 & UINT8_C(0xff)); x52 = (x50 >> 8); - x53 = (uint8_t)(x50 & UINT8_C(0xff)); + x53 = (uint8_t)(x52 & UINT8_C(0xff)); x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); + x57 = (uint8_t)(x56 & UINT8_C(0xff)); x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - out1[0] = x6; - out1[1] = x8; - out1[2] = x10; - out1[3] = x12; - out1[4] = x14; - out1[5] = x16; - out1[6] = x18; - out1[7] = x19; - out1[8] = x21; - out1[9] = x23; - out1[10] = x25; - out1[11] = x27; - out1[12] = x29; - out1[13] = x31; - out1[14] = x33; - out1[15] = x34; - out1[16] = x36; - out1[17] = x38; - out1[18] = x40; - out1[19] = x42; - out1[20] = x44; - out1[21] = x46; - out1[22] = x48; - out1[23] = x49; - out1[24] = x51; - out1[25] = x53; - out1[26] = x55; - out1[27] = x57; - out1[28] = x59; - out1[29] = x61; - out1[30] = x63; - out1[31] = x62; + x59 = (uint8_t)(x58 & UINT8_C(0xff)); + x60 = (uint8_t)(x58 >> 8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; } /* - * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -1789,6 +1802,27 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes( uint64_t x37; uint64_t x38; uint64_t x39; + uint64_t x40; + uint64_t x41; + uint64_t x42; + uint64_t x43; + uint64_t x44; + uint64_t x45; + uint64_t x46; + uint64_t x47; + uint64_t x48; + uint64_t x49; + uint64_t x50; + uint64_t x51; + uint64_t x52; + uint64_t x53; + uint64_t x54; + uint64_t x55; + uint64_t x56; + uint64_t x57; + uint64_t x58; + uint64_t x59; + uint64_t x60; x1 = ((uint64_t)(arg1[31]) << 56); x2 = ((uint64_t)(arg1[30]) << 48); x3 = ((uint64_t)(arg1[29]) << 40); @@ -1821,17 +1855,38 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes( x30 = ((uint64_t)(arg1[2]) << 16); x31 = ((uint64_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + (x26 + x25))))))); - x34 = (x33 & UINT64_C(0xffffffffffffffff)); - x35 = (x8 + (x7 + (x6 + (x5 + (x4 + (x3 + (x2 + x1))))))); - x36 = (x16 + (x15 + (x14 + (x13 + (x12 + (x11 + (x10 + x9))))))); - x37 = (x24 + (x23 + (x22 + (x21 + (x20 + (x19 + (x18 + x17))))))); - x38 = (x37 & UINT64_C(0xffffffffffffffff)); - x39 = (x36 & UINT64_C(0xffffffffffffffff)); - out1[0] = x34; - out1[1] = x38; - out1[2] = x39; - out1[3] = x35; + x33 = (x31 + (uint64_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x28 + x35); + x37 = (x27 + x36); + x38 = (x26 + x37); + x39 = (x25 + x38); + x40 = (x23 + (uint64_t)x24); + x41 = (x22 + x40); + x42 = (x21 + x41); + x43 = (x20 + x42); + x44 = (x19 + x43); + x45 = (x18 + x44); + x46 = (x17 + x45); + x47 = (x15 + (uint64_t)x16); + x48 = (x14 + x47); + x49 = (x13 + x48); + x50 = (x12 + x49); + x51 = (x11 + x50); + x52 = (x10 + x51); + x53 = (x9 + x52); + x54 = (x7 + (uint64_t)x8); + x55 = (x6 + x54); + x56 = (x5 + x55); + x57 = (x4 + x56); + x58 = (x3 + x57); + x59 = (x2 + x58); + x60 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; } /* END verbatim fiat code */ @@ -3939,7 +3994,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -3947,7 +4002,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4013,7 +4068,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4089,8 +4144,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -4151,6 +4206,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -4170,6 +4231,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -4182,6 +4248,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -4203,8 +4275,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_CryptoPro_B_ParamSet( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -4243,6 +4320,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_CryptoPro_B_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -4282,6 +4363,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_CryptoPro_B_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -4328,6 +4413,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_CRYPTOPRO_B_PARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -4369,7 +4458,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_GostR3410_2001_CryptoPro_B_ParamSet 32 '2^255 + 3225' */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_GostR3410_2001_CryptoPro_B_ParamSet 32 '2^255 + 3225' */ /* curve description: id_GostR3410_2001_CryptoPro_B_ParamSet */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ @@ -4394,6 +4483,17 @@ typedef signed char fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_CRYPTOPRO_B_PARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_addcarryx_u32 is an addition with carry. * Postconditions: @@ -4496,7 +4596,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u32(x2) & + arg3) | + (fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_value_barrier_u32((~x2)) & + arg2)); *out1 = x3; } @@ -8079,12 +8183,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_montgomery( static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_nonzero( uint32_t *out1, const uint32_t arg1[8]) { uint32_t x1; - x1 = ((arg1[0]) | - ((arg1[1]) | - ((arg1[2]) | - ((arg1[3]) | - ((arg1[4]) | - ((arg1[5]) | ((arg1[6]) | ((arg1[7]) | (uint32_t)0x0)))))))); + x1 = + ((arg1[0]) | + ((arg1[1]) | + ((arg1[2]) | + ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); *out1 = x1; } @@ -8138,7 +8241,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_selectznz( } /* - * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -8159,10 +8262,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes( uint32_t x6; uint32_t x7; uint32_t x8; - uint32_t x9; - uint8_t x10; - uint32_t x11; - uint8_t x12; + uint8_t x9; + uint32_t x10; + uint8_t x11; + uint32_t x12; uint8_t x13; uint8_t x14; uint8_t x15; @@ -8172,48 +8275,41 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes( uint8_t x19; uint8_t x20; uint8_t x21; - uint8_t x22; - uint32_t x23; - uint8_t x24; - uint32_t x25; + uint32_t x22; + uint8_t x23; + uint32_t x24; + uint8_t x25; uint8_t x26; uint8_t x27; - uint8_t x28; + uint32_t x28; uint8_t x29; uint32_t x30; uint8_t x31; - uint32_t x32; + uint8_t x32; uint8_t x33; - uint8_t x34; + uint32_t x34; uint8_t x35; - uint8_t x36; - uint32_t x37; + uint32_t x36; + uint8_t x37; uint8_t x38; - uint32_t x39; - uint8_t x40; + uint8_t x39; + uint32_t x40; uint8_t x41; - uint8_t x42; + uint32_t x42; uint8_t x43; - uint32_t x44; + uint8_t x44; uint8_t x45; uint32_t x46; uint8_t x47; - uint8_t x48; + uint32_t x48; uint8_t x49; uint8_t x50; - uint32_t x51; - uint8_t x52; - uint32_t x53; - uint8_t x54; + uint8_t x51; + uint32_t x52; + uint8_t x53; + uint32_t x54; uint8_t x55; uint8_t x56; - uint8_t x57; - uint32_t x58; - uint8_t x59; - uint32_t x60; - uint8_t x61; - uint8_t x62; - uint8_t x63; x1 = (arg1[7]); x2 = (arg1[6]); x3 = (arg1[5]); @@ -8222,97 +8318,90 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes( x6 = (arg1[2]); x7 = (arg1[1]); x8 = (arg1[0]); - x9 = (x8 >> 8); - x10 = (uint8_t)(x8 & UINT8_C(0xff)); - x11 = (x9 >> 8); - x12 = (uint8_t)(x9 & UINT8_C(0xff)); - x13 = (uint8_t)(x11 >> 8); - x14 = (uint8_t)(x11 & UINT8_C(0xff)); - x15 = (uint8_t)(x13 & UINT8_C(0xff)); + x9 = (uint8_t)(x8 & UINT8_C(0xff)); + x10 = (x8 >> 8); + x11 = (uint8_t)(x10 & UINT8_C(0xff)); + x12 = (x10 >> 8); + x13 = (uint8_t)(x12 & UINT8_C(0xff)); + x14 = (uint8_t)(x12 >> 8); + x15 = (uint8_t)(x7 & UINT8_C(0xff)); x16 = (x7 >> 8); - x17 = (uint8_t)(x7 & UINT8_C(0xff)); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); x18 = (x16 >> 8); - x19 = (uint8_t)(x16 & UINT8_C(0xff)); + x19 = (uint8_t)(x18 & UINT8_C(0xff)); x20 = (uint8_t)(x18 >> 8); - x21 = (uint8_t)(x18 & UINT8_C(0xff)); - x22 = (uint8_t)(x20 & UINT8_C(0xff)); - x23 = (x6 >> 8); - x24 = (uint8_t)(x6 & UINT8_C(0xff)); - x25 = (x23 >> 8); - x26 = (uint8_t)(x23 & UINT8_C(0xff)); - x27 = (uint8_t)(x25 >> 8); - x28 = (uint8_t)(x25 & UINT8_C(0xff)); - x29 = (uint8_t)(x27 & UINT8_C(0xff)); - x30 = (x5 >> 8); - x31 = (uint8_t)(x5 & UINT8_C(0xff)); - x32 = (x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (uint8_t)(x32 >> 8); - x35 = (uint8_t)(x32 & UINT8_C(0xff)); - x36 = (uint8_t)(x34 & UINT8_C(0xff)); - x37 = (x4 >> 8); - x38 = (uint8_t)(x4 & UINT8_C(0xff)); - x39 = (x37 >> 8); - x40 = (uint8_t)(x37 & UINT8_C(0xff)); - x41 = (uint8_t)(x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (uint8_t)(x41 & UINT8_C(0xff)); - x44 = (x3 >> 8); - x45 = (uint8_t)(x3 & UINT8_C(0xff)); - x46 = (x44 >> 8); - x47 = (uint8_t)(x44 & UINT8_C(0xff)); - x48 = (uint8_t)(x46 >> 8); - x49 = (uint8_t)(x46 & UINT8_C(0xff)); - x50 = (uint8_t)(x48 & UINT8_C(0xff)); - x51 = (x2 >> 8); - x52 = (uint8_t)(x2 & UINT8_C(0xff)); - x53 = (x51 >> 8); - x54 = (uint8_t)(x51 & UINT8_C(0xff)); - x55 = (uint8_t)(x53 >> 8); - x56 = (uint8_t)(x53 & UINT8_C(0xff)); - x57 = (uint8_t)(x55 & UINT8_C(0xff)); - x58 = (x1 >> 8); - x59 = (uint8_t)(x1 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - out1[0] = x10; - out1[1] = x12; - out1[2] = x14; - out1[3] = x15; - out1[4] = x17; - out1[5] = x19; - out1[6] = x21; - out1[7] = x22; - out1[8] = x24; - out1[9] = x26; - out1[10] = x28; - out1[11] = x29; - out1[12] = x31; - out1[13] = x33; - out1[14] = x35; - out1[15] = x36; - out1[16] = x38; - out1[17] = x40; - out1[18] = x42; - out1[19] = x43; - out1[20] = x45; - out1[21] = x47; - out1[22] = x49; - out1[23] = x50; - out1[24] = x52; - out1[25] = x54; - out1[26] = x56; - out1[27] = x57; - out1[28] = x59; - out1[29] = x61; - out1[30] = x63; - out1[31] = x62; + x21 = (uint8_t)(x6 & UINT8_C(0xff)); + x22 = (x6 >> 8); + x23 = (uint8_t)(x22 & UINT8_C(0xff)); + x24 = (x22 >> 8); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); + x26 = (uint8_t)(x24 >> 8); + x27 = (uint8_t)(x5 & UINT8_C(0xff)); + x28 = (x5 >> 8); + x29 = (uint8_t)(x28 & UINT8_C(0xff)); + x30 = (x28 >> 8); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); + x32 = (uint8_t)(x30 >> 8); + x33 = (uint8_t)(x4 & UINT8_C(0xff)); + x34 = (x4 >> 8); + x35 = (uint8_t)(x34 & UINT8_C(0xff)); + x36 = (x34 >> 8); + x37 = (uint8_t)(x36 & UINT8_C(0xff)); + x38 = (uint8_t)(x36 >> 8); + x39 = (uint8_t)(x3 & UINT8_C(0xff)); + x40 = (x3 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (uint8_t)(x42 >> 8); + x45 = (uint8_t)(x2 & UINT8_C(0xff)); + x46 = (x2 >> 8); + x47 = (uint8_t)(x46 & UINT8_C(0xff)); + x48 = (x46 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (uint8_t)(x48 >> 8); + x51 = (uint8_t)(x1 & UINT8_C(0xff)); + x52 = (x1 >> 8); + x53 = (uint8_t)(x52 & UINT8_C(0xff)); + x54 = (x52 >> 8); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); + x56 = (uint8_t)(x54 >> 8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; } /* - * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -8373,6 +8462,15 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes( uint32_t x45; uint32_t x46; uint32_t x47; + uint32_t x48; + uint32_t x49; + uint32_t x50; + uint32_t x51; + uint32_t x52; + uint32_t x53; + uint32_t x54; + uint32_t x55; + uint32_t x56; x1 = ((uint32_t)(arg1[31]) << 24); x2 = ((uint32_t)(arg1[30]) << 16); x3 = ((uint32_t)(arg1[29]) << 8); @@ -8405,29 +8503,38 @@ static void fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_from_bytes( x30 = ((uint32_t)(arg1[2]) << 16); x31 = ((uint32_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + x29))); - x34 = (x33 & UINT32_C(0xffffffff)); - x35 = (x4 + (x3 + (x2 + x1))); - x36 = (x8 + (x7 + (x6 + x5))); - x37 = (x12 + (x11 + (x10 + x9))); - x38 = (x16 + (x15 + (x14 + x13))); - x39 = (x20 + (x19 + (x18 + x17))); - x40 = (x24 + (x23 + (x22 + x21))); - x41 = (x28 + (x27 + (x26 + x25))); - x42 = (x41 & UINT32_C(0xffffffff)); - x43 = (x40 & UINT32_C(0xffffffff)); - x44 = (x39 & UINT32_C(0xffffffff)); - x45 = (x38 & UINT32_C(0xffffffff)); - x46 = (x37 & UINT32_C(0xffffffff)); - x47 = (x36 & UINT32_C(0xffffffff)); - out1[0] = x34; - out1[1] = x42; - out1[2] = x43; + x33 = (x31 + (uint32_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x27 + (uint32_t)x28); + x37 = (x26 + x36); + x38 = (x25 + x37); + x39 = (x23 + (uint32_t)x24); + x40 = (x22 + x39); + x41 = (x21 + x40); + x42 = (x19 + (uint32_t)x20); + x43 = (x18 + x42); + x44 = (x17 + x43); + x45 = (x15 + (uint32_t)x16); + x46 = (x14 + x45); + x47 = (x13 + x46); + x48 = (x11 + (uint32_t)x12); + x49 = (x10 + x48); + x50 = (x9 + x49); + x51 = (x7 + (uint32_t)x8); + x52 = (x6 + x51); + x53 = (x5 + x52); + x54 = (x3 + (uint32_t)x4); + x55 = (x2 + x54); + x56 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; out1[3] = x44; - out1[4] = x45; - out1[5] = x46; - out1[6] = x47; - out1[7] = x35; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; } /* END verbatim fiat code */ @@ -11401,7 +11508,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -11409,7 +11516,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -11475,7 +11582,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -11551,8 +11658,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -11613,6 +11720,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -11632,6 +11745,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -11644,6 +11762,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_B_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -11665,8 +11789,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_CryptoPro_B_ParamSet( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -11705,6 +11834,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_CryptoPro_B_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -11744,6 +11877,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_CryptoPro_B_ParamSet(const EC_GROUP *group, EC_POINT *r, diff --git a/ecp_id_GostR3410_2001_CryptoPro_C_ParamSet.c b/ecp_id_GostR3410_2001_CryptoPro_C_ParamSet.c index c2ada7c..57257a2 100644 --- a/ecp_id_GostR3410_2001_CryptoPro_C_ParamSet.c +++ b/ecp_id_GostR3410_2001_CryptoPro_C_ParamSet.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_CRYPTOPRO_C_PARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -73,7 +77,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_GostR3410_2001_CryptoPro_C_ParamSet 64 0x9B9F605F5A858107AB1EC85E6B41C8AACF846E86789051D37998F7B9022D759B */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_GostR3410_2001_CryptoPro_C_ParamSet 64 0x9B9F605F5A858107AB1EC85E6B41C8AACF846E86789051D37998F7B9022D759B */ /* curve description: id_GostR3410_2001_CryptoPro_C_ParamSet */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ @@ -100,6 +104,17 @@ typedef unsigned __int128 fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_CRYPTOPRO_C_PARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_addcarryx_u64 is an addition with carry. * Postconditions: @@ -204,7 +219,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u64(x2) & + arg3) | + (fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u64((~x2)) & + arg2)); *out1 = x3; } @@ -2048,7 +2067,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_montgomery( static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_nonzero( uint64_t *out1, const uint64_t arg1[4]) { uint64_t x1; - x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | (uint64_t)0x0)))); + x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); *out1 = x1; } @@ -2086,7 +2105,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_selectznz( } /* - * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -2103,18 +2122,18 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes( uint64_t x2; uint64_t x3; uint64_t x4; - uint64_t x5; - uint8_t x6; - uint64_t x7; - uint8_t x8; - uint64_t x9; - uint8_t x10; - uint64_t x11; - uint8_t x12; - uint64_t x13; - uint8_t x14; - uint64_t x15; - uint8_t x16; + uint8_t x5; + uint64_t x6; + uint8_t x7; + uint64_t x8; + uint8_t x9; + uint64_t x10; + uint8_t x11; + uint64_t x12; + uint8_t x13; + uint64_t x14; + uint8_t x15; + uint64_t x16; uint8_t x17; uint8_t x18; uint8_t x19; @@ -2132,21 +2151,21 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes( uint8_t x31; uint8_t x32; uint8_t x33; - uint8_t x34; - uint64_t x35; - uint8_t x36; - uint64_t x37; - uint8_t x38; - uint64_t x39; - uint8_t x40; - uint64_t x41; - uint8_t x42; - uint64_t x43; - uint8_t x44; - uint64_t x45; + uint64_t x34; + uint8_t x35; + uint64_t x36; + uint8_t x37; + uint64_t x38; + uint8_t x39; + uint64_t x40; + uint8_t x41; + uint64_t x42; + uint8_t x43; + uint64_t x44; + uint8_t x45; uint8_t x46; uint8_t x47; - uint8_t x48; + uint64_t x48; uint8_t x49; uint64_t x50; uint8_t x51; @@ -2158,109 +2177,103 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes( uint8_t x57; uint64_t x58; uint8_t x59; - uint64_t x60; - uint8_t x61; - uint8_t x62; - uint8_t x63; + uint8_t x60; x1 = (arg1[3]); x2 = (arg1[2]); x3 = (arg1[1]); x4 = (arg1[0]); - x5 = (x4 >> 8); - x6 = (uint8_t)(x4 & UINT8_C(0xff)); - x7 = (x5 >> 8); - x8 = (uint8_t)(x5 & UINT8_C(0xff)); - x9 = (x7 >> 8); - x10 = (uint8_t)(x7 & UINT8_C(0xff)); - x11 = (x9 >> 8); - x12 = (uint8_t)(x9 & UINT8_C(0xff)); - x13 = (x11 >> 8); - x14 = (uint8_t)(x11 & UINT8_C(0xff)); - x15 = (x13 >> 8); - x16 = (uint8_t)(x13 & UINT8_C(0xff)); - x17 = (uint8_t)(x15 >> 8); - x18 = (uint8_t)(x15 & UINT8_C(0xff)); - x19 = (uint8_t)(x17 & UINT8_C(0xff)); + x5 = (uint8_t)(x4 & UINT8_C(0xff)); + x6 = (x4 >> 8); + x7 = (uint8_t)(x6 & UINT8_C(0xff)); + x8 = (x6 >> 8); + x9 = (uint8_t)(x8 & UINT8_C(0xff)); + x10 = (x8 >> 8); + x11 = (uint8_t)(x10 & UINT8_C(0xff)); + x12 = (x10 >> 8); + x13 = (uint8_t)(x12 & UINT8_C(0xff)); + x14 = (x12 >> 8); + x15 = (uint8_t)(x14 & UINT8_C(0xff)); + x16 = (x14 >> 8); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); + x18 = (uint8_t)(x16 >> 8); + x19 = (uint8_t)(x3 & UINT8_C(0xff)); x20 = (x3 >> 8); - x21 = (uint8_t)(x3 & UINT8_C(0xff)); + x21 = (uint8_t)(x20 & UINT8_C(0xff)); x22 = (x20 >> 8); - x23 = (uint8_t)(x20 & UINT8_C(0xff)); + x23 = (uint8_t)(x22 & UINT8_C(0xff)); x24 = (x22 >> 8); - x25 = (uint8_t)(x22 & UINT8_C(0xff)); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); x26 = (x24 >> 8); - x27 = (uint8_t)(x24 & UINT8_C(0xff)); + x27 = (uint8_t)(x26 & UINT8_C(0xff)); x28 = (x26 >> 8); - x29 = (uint8_t)(x26 & UINT8_C(0xff)); + x29 = (uint8_t)(x28 & UINT8_C(0xff)); x30 = (x28 >> 8); - x31 = (uint8_t)(x28 & UINT8_C(0xff)); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); x32 = (uint8_t)(x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (uint8_t)(x32 & UINT8_C(0xff)); - x35 = (x2 >> 8); - x36 = (uint8_t)(x2 & UINT8_C(0xff)); - x37 = (x35 >> 8); - x38 = (uint8_t)(x35 & UINT8_C(0xff)); - x39 = (x37 >> 8); - x40 = (uint8_t)(x37 & UINT8_C(0xff)); - x41 = (x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (x41 >> 8); - x44 = (uint8_t)(x41 & UINT8_C(0xff)); - x45 = (x43 >> 8); - x46 = (uint8_t)(x43 & UINT8_C(0xff)); - x47 = (uint8_t)(x45 >> 8); - x48 = (uint8_t)(x45 & UINT8_C(0xff)); - x49 = (uint8_t)(x47 & UINT8_C(0xff)); - x50 = (x1 >> 8); - x51 = (uint8_t)(x1 & UINT8_C(0xff)); + x33 = (uint8_t)(x2 & UINT8_C(0xff)); + x34 = (x2 >> 8); + x35 = (uint8_t)(x34 & UINT8_C(0xff)); + x36 = (x34 >> 8); + x37 = (uint8_t)(x36 & UINT8_C(0xff)); + x38 = (x36 >> 8); + x39 = (uint8_t)(x38 & UINT8_C(0xff)); + x40 = (x38 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (x42 >> 8); + x45 = (uint8_t)(x44 & UINT8_C(0xff)); + x46 = (uint8_t)(x44 >> 8); + x47 = (uint8_t)(x1 & UINT8_C(0xff)); + x48 = (x1 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (x48 >> 8); + x51 = (uint8_t)(x50 & UINT8_C(0xff)); x52 = (x50 >> 8); - x53 = (uint8_t)(x50 & UINT8_C(0xff)); + x53 = (uint8_t)(x52 & UINT8_C(0xff)); x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); + x57 = (uint8_t)(x56 & UINT8_C(0xff)); x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - out1[0] = x6; - out1[1] = x8; - out1[2] = x10; - out1[3] = x12; - out1[4] = x14; - out1[5] = x16; - out1[6] = x18; - out1[7] = x19; - out1[8] = x21; - out1[9] = x23; - out1[10] = x25; - out1[11] = x27; - out1[12] = x29; - out1[13] = x31; - out1[14] = x33; - out1[15] = x34; - out1[16] = x36; - out1[17] = x38; - out1[18] = x40; - out1[19] = x42; - out1[20] = x44; - out1[21] = x46; - out1[22] = x48; - out1[23] = x49; - out1[24] = x51; - out1[25] = x53; - out1[26] = x55; - out1[27] = x57; - out1[28] = x59; - out1[29] = x61; - out1[30] = x63; - out1[31] = x62; + x59 = (uint8_t)(x58 & UINT8_C(0xff)); + x60 = (uint8_t)(x58 >> 8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; } /* - * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -2313,6 +2326,27 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes( uint64_t x37; uint64_t x38; uint64_t x39; + uint64_t x40; + uint64_t x41; + uint64_t x42; + uint64_t x43; + uint64_t x44; + uint64_t x45; + uint64_t x46; + uint64_t x47; + uint64_t x48; + uint64_t x49; + uint64_t x50; + uint64_t x51; + uint64_t x52; + uint64_t x53; + uint64_t x54; + uint64_t x55; + uint64_t x56; + uint64_t x57; + uint64_t x58; + uint64_t x59; + uint64_t x60; x1 = ((uint64_t)(arg1[31]) << 56); x2 = ((uint64_t)(arg1[30]) << 48); x3 = ((uint64_t)(arg1[29]) << 40); @@ -2345,17 +2379,38 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes( x30 = ((uint64_t)(arg1[2]) << 16); x31 = ((uint64_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + (x26 + x25))))))); - x34 = (x33 & UINT64_C(0xffffffffffffffff)); - x35 = (x8 + (x7 + (x6 + (x5 + (x4 + (x3 + (x2 + x1))))))); - x36 = (x16 + (x15 + (x14 + (x13 + (x12 + (x11 + (x10 + x9))))))); - x37 = (x24 + (x23 + (x22 + (x21 + (x20 + (x19 + (x18 + x17))))))); - x38 = (x37 & UINT64_C(0xffffffffffffffff)); - x39 = (x36 & UINT64_C(0xffffffffffffffff)); - out1[0] = x34; - out1[1] = x38; - out1[2] = x39; - out1[3] = x35; + x33 = (x31 + (uint64_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x28 + x35); + x37 = (x27 + x36); + x38 = (x26 + x37); + x39 = (x25 + x38); + x40 = (x23 + (uint64_t)x24); + x41 = (x22 + x40); + x42 = (x21 + x41); + x43 = (x20 + x42); + x44 = (x19 + x43); + x45 = (x18 + x44); + x46 = (x17 + x45); + x47 = (x15 + (uint64_t)x16); + x48 = (x14 + x47); + x49 = (x13 + x48); + x50 = (x12 + x49); + x51 = (x11 + x50); + x52 = (x10 + x51); + x53 = (x9 + x52); + x54 = (x7 + (uint64_t)x8); + x55 = (x6 + x54); + x56 = (x5 + x55); + x57 = (x4 + x56); + x58 = (x3 + x57); + x59 = (x2 + x58); + x60 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; } /* END verbatim fiat code */ @@ -4597,7 +4652,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -4605,7 +4660,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4671,7 +4726,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4747,8 +4802,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -4809,6 +4864,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -4828,6 +4889,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -4840,6 +4906,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -4861,8 +4933,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_CryptoPro_C_ParamSet( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -4901,6 +4978,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_CryptoPro_C_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -4940,6 +5021,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_CryptoPro_C_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -4986,6 +5071,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_CRYPTOPRO_C_PARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -5027,7 +5116,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_GostR3410_2001_CryptoPro_C_ParamSet 32 0x9B9F605F5A858107AB1EC85E6B41C8AACF846E86789051D37998F7B9022D759B */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_GostR3410_2001_CryptoPro_C_ParamSet 32 0x9B9F605F5A858107AB1EC85E6B41C8AACF846E86789051D37998F7B9022D759B */ /* curve description: id_GostR3410_2001_CryptoPro_C_ParamSet */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ @@ -5052,6 +5141,17 @@ typedef signed char fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_CRYPTOPRO_C_PARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_addcarryx_u32 is an addition with carry. * Postconditions: @@ -5154,7 +5254,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u32(x2) & + arg3) | + (fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_value_barrier_u32((~x2)) & + arg2)); *out1 = x3; } @@ -11498,12 +11602,11 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_montgomery( static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_nonzero( uint32_t *out1, const uint32_t arg1[8]) { uint32_t x1; - x1 = ((arg1[0]) | - ((arg1[1]) | - ((arg1[2]) | - ((arg1[3]) | - ((arg1[4]) | - ((arg1[5]) | ((arg1[6]) | ((arg1[7]) | (uint32_t)0x0)))))))); + x1 = + ((arg1[0]) | + ((arg1[1]) | + ((arg1[2]) | + ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); *out1 = x1; } @@ -11557,7 +11660,7 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_selectznz( } /* - * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -11578,10 +11681,10 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes( uint32_t x6; uint32_t x7; uint32_t x8; - uint32_t x9; - uint8_t x10; - uint32_t x11; - uint8_t x12; + uint8_t x9; + uint32_t x10; + uint8_t x11; + uint32_t x12; uint8_t x13; uint8_t x14; uint8_t x15; @@ -11591,48 +11694,41 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes( uint8_t x19; uint8_t x20; uint8_t x21; - uint8_t x22; - uint32_t x23; - uint8_t x24; - uint32_t x25; + uint32_t x22; + uint8_t x23; + uint32_t x24; + uint8_t x25; uint8_t x26; uint8_t x27; - uint8_t x28; + uint32_t x28; uint8_t x29; uint32_t x30; uint8_t x31; - uint32_t x32; + uint8_t x32; uint8_t x33; - uint8_t x34; + uint32_t x34; uint8_t x35; - uint8_t x36; - uint32_t x37; + uint32_t x36; + uint8_t x37; uint8_t x38; - uint32_t x39; - uint8_t x40; + uint8_t x39; + uint32_t x40; uint8_t x41; - uint8_t x42; + uint32_t x42; uint8_t x43; - uint32_t x44; + uint8_t x44; uint8_t x45; uint32_t x46; uint8_t x47; - uint8_t x48; + uint32_t x48; uint8_t x49; uint8_t x50; - uint32_t x51; - uint8_t x52; - uint32_t x53; - uint8_t x54; + uint8_t x51; + uint32_t x52; + uint8_t x53; + uint32_t x54; uint8_t x55; uint8_t x56; - uint8_t x57; - uint32_t x58; - uint8_t x59; - uint32_t x60; - uint8_t x61; - uint8_t x62; - uint8_t x63; x1 = (arg1[7]); x2 = (arg1[6]); x3 = (arg1[5]); @@ -11641,97 +11737,90 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes( x6 = (arg1[2]); x7 = (arg1[1]); x8 = (arg1[0]); - x9 = (x8 >> 8); - x10 = (uint8_t)(x8 & UINT8_C(0xff)); - x11 = (x9 >> 8); - x12 = (uint8_t)(x9 & UINT8_C(0xff)); - x13 = (uint8_t)(x11 >> 8); - x14 = (uint8_t)(x11 & UINT8_C(0xff)); - x15 = (uint8_t)(x13 & UINT8_C(0xff)); + x9 = (uint8_t)(x8 & UINT8_C(0xff)); + x10 = (x8 >> 8); + x11 = (uint8_t)(x10 & UINT8_C(0xff)); + x12 = (x10 >> 8); + x13 = (uint8_t)(x12 & UINT8_C(0xff)); + x14 = (uint8_t)(x12 >> 8); + x15 = (uint8_t)(x7 & UINT8_C(0xff)); x16 = (x7 >> 8); - x17 = (uint8_t)(x7 & UINT8_C(0xff)); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); x18 = (x16 >> 8); - x19 = (uint8_t)(x16 & UINT8_C(0xff)); + x19 = (uint8_t)(x18 & UINT8_C(0xff)); x20 = (uint8_t)(x18 >> 8); - x21 = (uint8_t)(x18 & UINT8_C(0xff)); - x22 = (uint8_t)(x20 & UINT8_C(0xff)); - x23 = (x6 >> 8); - x24 = (uint8_t)(x6 & UINT8_C(0xff)); - x25 = (x23 >> 8); - x26 = (uint8_t)(x23 & UINT8_C(0xff)); - x27 = (uint8_t)(x25 >> 8); - x28 = (uint8_t)(x25 & UINT8_C(0xff)); - x29 = (uint8_t)(x27 & UINT8_C(0xff)); - x30 = (x5 >> 8); - x31 = (uint8_t)(x5 & UINT8_C(0xff)); - x32 = (x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (uint8_t)(x32 >> 8); - x35 = (uint8_t)(x32 & UINT8_C(0xff)); - x36 = (uint8_t)(x34 & UINT8_C(0xff)); - x37 = (x4 >> 8); - x38 = (uint8_t)(x4 & UINT8_C(0xff)); - x39 = (x37 >> 8); - x40 = (uint8_t)(x37 & UINT8_C(0xff)); - x41 = (uint8_t)(x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (uint8_t)(x41 & UINT8_C(0xff)); - x44 = (x3 >> 8); - x45 = (uint8_t)(x3 & UINT8_C(0xff)); - x46 = (x44 >> 8); - x47 = (uint8_t)(x44 & UINT8_C(0xff)); - x48 = (uint8_t)(x46 >> 8); - x49 = (uint8_t)(x46 & UINT8_C(0xff)); - x50 = (uint8_t)(x48 & UINT8_C(0xff)); - x51 = (x2 >> 8); - x52 = (uint8_t)(x2 & UINT8_C(0xff)); - x53 = (x51 >> 8); - x54 = (uint8_t)(x51 & UINT8_C(0xff)); - x55 = (uint8_t)(x53 >> 8); - x56 = (uint8_t)(x53 & UINT8_C(0xff)); - x57 = (uint8_t)(x55 & UINT8_C(0xff)); - x58 = (x1 >> 8); - x59 = (uint8_t)(x1 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - out1[0] = x10; - out1[1] = x12; - out1[2] = x14; - out1[3] = x15; - out1[4] = x17; - out1[5] = x19; - out1[6] = x21; - out1[7] = x22; - out1[8] = x24; - out1[9] = x26; - out1[10] = x28; - out1[11] = x29; - out1[12] = x31; - out1[13] = x33; - out1[14] = x35; - out1[15] = x36; - out1[16] = x38; - out1[17] = x40; - out1[18] = x42; - out1[19] = x43; - out1[20] = x45; - out1[21] = x47; - out1[22] = x49; - out1[23] = x50; - out1[24] = x52; - out1[25] = x54; - out1[26] = x56; - out1[27] = x57; - out1[28] = x59; - out1[29] = x61; - out1[30] = x63; - out1[31] = x62; + x21 = (uint8_t)(x6 & UINT8_C(0xff)); + x22 = (x6 >> 8); + x23 = (uint8_t)(x22 & UINT8_C(0xff)); + x24 = (x22 >> 8); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); + x26 = (uint8_t)(x24 >> 8); + x27 = (uint8_t)(x5 & UINT8_C(0xff)); + x28 = (x5 >> 8); + x29 = (uint8_t)(x28 & UINT8_C(0xff)); + x30 = (x28 >> 8); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); + x32 = (uint8_t)(x30 >> 8); + x33 = (uint8_t)(x4 & UINT8_C(0xff)); + x34 = (x4 >> 8); + x35 = (uint8_t)(x34 & UINT8_C(0xff)); + x36 = (x34 >> 8); + x37 = (uint8_t)(x36 & UINT8_C(0xff)); + x38 = (uint8_t)(x36 >> 8); + x39 = (uint8_t)(x3 & UINT8_C(0xff)); + x40 = (x3 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (uint8_t)(x42 >> 8); + x45 = (uint8_t)(x2 & UINT8_C(0xff)); + x46 = (x2 >> 8); + x47 = (uint8_t)(x46 & UINT8_C(0xff)); + x48 = (x46 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (uint8_t)(x48 >> 8); + x51 = (uint8_t)(x1 & UINT8_C(0xff)); + x52 = (x1 >> 8); + x53 = (uint8_t)(x52 & UINT8_C(0xff)); + x54 = (x52 >> 8); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); + x56 = (uint8_t)(x54 >> 8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; } /* - * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -11792,6 +11881,15 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes( uint32_t x45; uint32_t x46; uint32_t x47; + uint32_t x48; + uint32_t x49; + uint32_t x50; + uint32_t x51; + uint32_t x52; + uint32_t x53; + uint32_t x54; + uint32_t x55; + uint32_t x56; x1 = ((uint32_t)(arg1[31]) << 24); x2 = ((uint32_t)(arg1[30]) << 16); x3 = ((uint32_t)(arg1[29]) << 8); @@ -11824,29 +11922,38 @@ static void fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_from_bytes( x30 = ((uint32_t)(arg1[2]) << 16); x31 = ((uint32_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + x29))); - x34 = (x33 & UINT32_C(0xffffffff)); - x35 = (x4 + (x3 + (x2 + x1))); - x36 = (x8 + (x7 + (x6 + x5))); - x37 = (x12 + (x11 + (x10 + x9))); - x38 = (x16 + (x15 + (x14 + x13))); - x39 = (x20 + (x19 + (x18 + x17))); - x40 = (x24 + (x23 + (x22 + x21))); - x41 = (x28 + (x27 + (x26 + x25))); - x42 = (x41 & UINT32_C(0xffffffff)); - x43 = (x40 & UINT32_C(0xffffffff)); - x44 = (x39 & UINT32_C(0xffffffff)); - x45 = (x38 & UINT32_C(0xffffffff)); - x46 = (x37 & UINT32_C(0xffffffff)); - x47 = (x36 & UINT32_C(0xffffffff)); - out1[0] = x34; - out1[1] = x42; - out1[2] = x43; + x33 = (x31 + (uint32_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x27 + (uint32_t)x28); + x37 = (x26 + x36); + x38 = (x25 + x37); + x39 = (x23 + (uint32_t)x24); + x40 = (x22 + x39); + x41 = (x21 + x40); + x42 = (x19 + (uint32_t)x20); + x43 = (x18 + x42); + x44 = (x17 + x43); + x45 = (x15 + (uint32_t)x16); + x46 = (x14 + x45); + x47 = (x13 + x46); + x48 = (x11 + (uint32_t)x12); + x49 = (x10 + x48); + x50 = (x9 + x49); + x51 = (x7 + (uint32_t)x8); + x52 = (x6 + x51); + x53 = (x5 + x52); + x54 = (x3 + (uint32_t)x4); + x55 = (x2 + x54); + x56 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; out1[3] = x44; - out1[4] = x45; - out1[5] = x46; - out1[6] = x47; - out1[7] = x35; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; } /* END verbatim fiat code */ @@ -14954,7 +15061,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -14962,7 +15069,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -15028,7 +15135,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -15104,8 +15211,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -15166,6 +15273,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -15185,6 +15298,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -15197,6 +15315,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_CryptoPro_C_ParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -15218,8 +15342,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_CryptoPro_C_ParamSet( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -15258,6 +15387,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_CryptoPro_C_ParamSet(const EC_GROUP *group, EC_POINT *r, @@ -15297,6 +15430,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_CryptoPro_C_ParamSet(const EC_GROUP *group, EC_POINT *r, diff --git a/ecp_id_GostR3410_2001_TestParamSet.c b/ecp_id_GostR3410_2001_TestParamSet.c index 410de5a..3163630 100644 --- a/ecp_id_GostR3410_2001_TestParamSet.c +++ b/ecp_id_GostR3410_2001_TestParamSet.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_TESTPARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -73,7 +77,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_GostR3410_2001_TestParamSet 64 '2^255 + 1073' */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_GostR3410_2001_TestParamSet 64 '2^255 + 1073' */ /* curve description: id_GostR3410_2001_TestParamSet */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ @@ -100,6 +104,17 @@ typedef unsigned __int128 fiat_id_GostR3410_2001_TestParamSet_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_TESTPARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_GostR3410_2001_TestParamSet_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_TestParamSet_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_TestParamSet_addcarryx_u64 is an addition with carry. * Postconditions: @@ -204,7 +219,9 @@ static void fiat_id_GostR3410_2001_TestParamSet_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_TestParamSet_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_TestParamSet_value_barrier_u64(x2) & arg3) | + (fiat_id_GostR3410_2001_TestParamSet_value_barrier_u64((~x2)) & arg2)); *out1 = x3; } @@ -1461,7 +1478,7 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_montgomery( static void fiat_id_GostR3410_2001_TestParamSet_nonzero( uint64_t *out1, const uint64_t arg1[4]) { uint64_t x1; - x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | (uint64_t)0x0)))); + x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); *out1 = x1; } @@ -1499,7 +1516,7 @@ static void fiat_id_GostR3410_2001_TestParamSet_selectznz( } /* - * The function fiat_id_GostR3410_2001_TestParamSet_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_GostR3410_2001_TestParamSet_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -1516,18 +1533,18 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_bytes( uint64_t x2; uint64_t x3; uint64_t x4; - uint64_t x5; - uint8_t x6; - uint64_t x7; - uint8_t x8; - uint64_t x9; - uint8_t x10; - uint64_t x11; - uint8_t x12; - uint64_t x13; - uint8_t x14; - uint64_t x15; - uint8_t x16; + uint8_t x5; + uint64_t x6; + uint8_t x7; + uint64_t x8; + uint8_t x9; + uint64_t x10; + uint8_t x11; + uint64_t x12; + uint8_t x13; + uint64_t x14; + uint8_t x15; + uint64_t x16; uint8_t x17; uint8_t x18; uint8_t x19; @@ -1545,21 +1562,21 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_bytes( uint8_t x31; uint8_t x32; uint8_t x33; - uint8_t x34; - uint64_t x35; - uint8_t x36; - uint64_t x37; - uint8_t x38; - uint64_t x39; - uint8_t x40; - uint64_t x41; - uint8_t x42; - uint64_t x43; - uint8_t x44; - uint64_t x45; + uint64_t x34; + uint8_t x35; + uint64_t x36; + uint8_t x37; + uint64_t x38; + uint8_t x39; + uint64_t x40; + uint8_t x41; + uint64_t x42; + uint8_t x43; + uint64_t x44; + uint8_t x45; uint8_t x46; uint8_t x47; - uint8_t x48; + uint64_t x48; uint8_t x49; uint64_t x50; uint8_t x51; @@ -1571,109 +1588,103 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_bytes( uint8_t x57; uint64_t x58; uint8_t x59; - uint64_t x60; - uint8_t x61; - uint8_t x62; - uint8_t x63; + uint8_t x60; x1 = (arg1[3]); x2 = (arg1[2]); x3 = (arg1[1]); x4 = (arg1[0]); - x5 = (x4 >> 8); - x6 = (uint8_t)(x4 & UINT8_C(0xff)); - x7 = (x5 >> 8); - x8 = (uint8_t)(x5 & UINT8_C(0xff)); - x9 = (x7 >> 8); - x10 = (uint8_t)(x7 & UINT8_C(0xff)); - x11 = (x9 >> 8); - x12 = (uint8_t)(x9 & UINT8_C(0xff)); - x13 = (x11 >> 8); - x14 = (uint8_t)(x11 & UINT8_C(0xff)); - x15 = (x13 >> 8); - x16 = (uint8_t)(x13 & UINT8_C(0xff)); - x17 = (uint8_t)(x15 >> 8); - x18 = (uint8_t)(x15 & UINT8_C(0xff)); - x19 = (uint8_t)(x17 & UINT8_C(0xff)); + x5 = (uint8_t)(x4 & UINT8_C(0xff)); + x6 = (x4 >> 8); + x7 = (uint8_t)(x6 & UINT8_C(0xff)); + x8 = (x6 >> 8); + x9 = (uint8_t)(x8 & UINT8_C(0xff)); + x10 = (x8 >> 8); + x11 = (uint8_t)(x10 & UINT8_C(0xff)); + x12 = (x10 >> 8); + x13 = (uint8_t)(x12 & UINT8_C(0xff)); + x14 = (x12 >> 8); + x15 = (uint8_t)(x14 & UINT8_C(0xff)); + x16 = (x14 >> 8); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); + x18 = (uint8_t)(x16 >> 8); + x19 = (uint8_t)(x3 & UINT8_C(0xff)); x20 = (x3 >> 8); - x21 = (uint8_t)(x3 & UINT8_C(0xff)); + x21 = (uint8_t)(x20 & UINT8_C(0xff)); x22 = (x20 >> 8); - x23 = (uint8_t)(x20 & UINT8_C(0xff)); + x23 = (uint8_t)(x22 & UINT8_C(0xff)); x24 = (x22 >> 8); - x25 = (uint8_t)(x22 & UINT8_C(0xff)); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); x26 = (x24 >> 8); - x27 = (uint8_t)(x24 & UINT8_C(0xff)); + x27 = (uint8_t)(x26 & UINT8_C(0xff)); x28 = (x26 >> 8); - x29 = (uint8_t)(x26 & UINT8_C(0xff)); + x29 = (uint8_t)(x28 & UINT8_C(0xff)); x30 = (x28 >> 8); - x31 = (uint8_t)(x28 & UINT8_C(0xff)); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); x32 = (uint8_t)(x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (uint8_t)(x32 & UINT8_C(0xff)); - x35 = (x2 >> 8); - x36 = (uint8_t)(x2 & UINT8_C(0xff)); - x37 = (x35 >> 8); - x38 = (uint8_t)(x35 & UINT8_C(0xff)); - x39 = (x37 >> 8); - x40 = (uint8_t)(x37 & UINT8_C(0xff)); - x41 = (x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (x41 >> 8); - x44 = (uint8_t)(x41 & UINT8_C(0xff)); - x45 = (x43 >> 8); - x46 = (uint8_t)(x43 & UINT8_C(0xff)); - x47 = (uint8_t)(x45 >> 8); - x48 = (uint8_t)(x45 & UINT8_C(0xff)); - x49 = (uint8_t)(x47 & UINT8_C(0xff)); - x50 = (x1 >> 8); - x51 = (uint8_t)(x1 & UINT8_C(0xff)); + x33 = (uint8_t)(x2 & UINT8_C(0xff)); + x34 = (x2 >> 8); + x35 = (uint8_t)(x34 & UINT8_C(0xff)); + x36 = (x34 >> 8); + x37 = (uint8_t)(x36 & UINT8_C(0xff)); + x38 = (x36 >> 8); + x39 = (uint8_t)(x38 & UINT8_C(0xff)); + x40 = (x38 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (x42 >> 8); + x45 = (uint8_t)(x44 & UINT8_C(0xff)); + x46 = (uint8_t)(x44 >> 8); + x47 = (uint8_t)(x1 & UINT8_C(0xff)); + x48 = (x1 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (x48 >> 8); + x51 = (uint8_t)(x50 & UINT8_C(0xff)); x52 = (x50 >> 8); - x53 = (uint8_t)(x50 & UINT8_C(0xff)); + x53 = (uint8_t)(x52 & UINT8_C(0xff)); x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); + x57 = (uint8_t)(x56 & UINT8_C(0xff)); x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - out1[0] = x6; - out1[1] = x8; - out1[2] = x10; - out1[3] = x12; - out1[4] = x14; - out1[5] = x16; - out1[6] = x18; - out1[7] = x19; - out1[8] = x21; - out1[9] = x23; - out1[10] = x25; - out1[11] = x27; - out1[12] = x29; - out1[13] = x31; - out1[14] = x33; - out1[15] = x34; - out1[16] = x36; - out1[17] = x38; - out1[18] = x40; - out1[19] = x42; - out1[20] = x44; - out1[21] = x46; - out1[22] = x48; - out1[23] = x49; - out1[24] = x51; - out1[25] = x53; - out1[26] = x55; - out1[27] = x57; - out1[28] = x59; - out1[29] = x61; - out1[30] = x63; - out1[31] = x62; + x59 = (uint8_t)(x58 & UINT8_C(0xff)); + x60 = (uint8_t)(x58 >> 8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; } /* - * The function fiat_id_GostR3410_2001_TestParamSet_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_GostR3410_2001_TestParamSet_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -1726,6 +1737,27 @@ static void fiat_id_GostR3410_2001_TestParamSet_from_bytes( uint64_t x37; uint64_t x38; uint64_t x39; + uint64_t x40; + uint64_t x41; + uint64_t x42; + uint64_t x43; + uint64_t x44; + uint64_t x45; + uint64_t x46; + uint64_t x47; + uint64_t x48; + uint64_t x49; + uint64_t x50; + uint64_t x51; + uint64_t x52; + uint64_t x53; + uint64_t x54; + uint64_t x55; + uint64_t x56; + uint64_t x57; + uint64_t x58; + uint64_t x59; + uint64_t x60; x1 = ((uint64_t)(arg1[31]) << 56); x2 = ((uint64_t)(arg1[30]) << 48); x3 = ((uint64_t)(arg1[29]) << 40); @@ -1758,17 +1790,38 @@ static void fiat_id_GostR3410_2001_TestParamSet_from_bytes( x30 = ((uint64_t)(arg1[2]) << 16); x31 = ((uint64_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + (x26 + x25))))))); - x34 = (x33 & UINT64_C(0xffffffffffffffff)); - x35 = (x8 + (x7 + (x6 + (x5 + (x4 + (x3 + (x2 + x1))))))); - x36 = (x16 + (x15 + (x14 + (x13 + (x12 + (x11 + (x10 + x9))))))); - x37 = (x24 + (x23 + (x22 + (x21 + (x20 + (x19 + (x18 + x17))))))); - x38 = (x37 & UINT64_C(0xffffffffffffffff)); - x39 = (x36 & UINT64_C(0xffffffffffffffff)); - out1[0] = x34; - out1[1] = x38; - out1[2] = x39; - out1[3] = x35; + x33 = (x31 + (uint64_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x28 + x35); + x37 = (x27 + x36); + x38 = (x26 + x37); + x39 = (x25 + x38); + x40 = (x23 + (uint64_t)x24); + x41 = (x22 + x40); + x42 = (x21 + x41); + x43 = (x20 + x42); + x44 = (x19 + x43); + x45 = (x18 + x44); + x46 = (x17 + x45); + x47 = (x15 + (uint64_t)x16); + x48 = (x14 + x47); + x49 = (x13 + x48); + x50 = (x12 + x49); + x51 = (x11 + x50); + x52 = (x10 + x51); + x53 = (x9 + x52); + x54 = (x7 + (uint64_t)x8); + x55 = (x6 + x54); + x56 = (x5 + x55); + x57 = (x4 + x56); + x58 = (x3 + x57); + x59 = (x2 + x58); + x60 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; } /* END verbatim fiat code */ @@ -3872,7 +3925,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -3880,7 +3933,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -3946,7 +3999,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4022,8 +4075,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -4081,6 +4134,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_TestParamSet_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -4100,6 +4159,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_TestParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -4112,6 +4176,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_TestParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -4133,8 +4203,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_TestParamSet(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, @@ -4174,6 +4249,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_TestParamSet(const EC_GROUP *group, EC_POINT *r, const EC_POINT *q, const BIGNUM *m, @@ -4211,6 +4290,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_TestParamSet(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, @@ -4256,6 +4339,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_GOSTR3410_2001_TESTPARAMSET_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -4297,7 +4384,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_GostR3410_2001_TestParamSet 32 '2^255 + 1073' */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_GostR3410_2001_TestParamSet 32 '2^255 + 1073' */ /* curve description: id_GostR3410_2001_TestParamSet */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ @@ -4322,6 +4409,17 @@ typedef signed char fiat_id_GostR3410_2001_TestParamSet_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_GOSTR3410_2001_TESTPARAMSET_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_GostR3410_2001_TestParamSet_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_GostR3410_2001_TestParamSet_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_GostR3410_2001_TestParamSet_addcarryx_u32 is an addition with carry. * Postconditions: @@ -4426,7 +4524,9 @@ static void fiat_id_GostR3410_2001_TestParamSet_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_GostR3410_2001_TestParamSet_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = + ((fiat_id_GostR3410_2001_TestParamSet_value_barrier_u32(x2) & arg3) | + (fiat_id_GostR3410_2001_TestParamSet_value_barrier_u32((~x2)) & arg2)); *out1 = x3; } @@ -7831,12 +7931,11 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_montgomery( static void fiat_id_GostR3410_2001_TestParamSet_nonzero( uint32_t *out1, const uint32_t arg1[8]) { uint32_t x1; - x1 = ((arg1[0]) | - ((arg1[1]) | - ((arg1[2]) | - ((arg1[3]) | - ((arg1[4]) | - ((arg1[5]) | ((arg1[6]) | ((arg1[7]) | (uint32_t)0x0)))))))); + x1 = + ((arg1[0]) | + ((arg1[1]) | + ((arg1[2]) | + ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); *out1 = x1; } @@ -7890,7 +7989,7 @@ static void fiat_id_GostR3410_2001_TestParamSet_selectznz( } /* - * The function fiat_id_GostR3410_2001_TestParamSet_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_GostR3410_2001_TestParamSet_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -7911,10 +8010,10 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_bytes( uint32_t x6; uint32_t x7; uint32_t x8; - uint32_t x9; - uint8_t x10; - uint32_t x11; - uint8_t x12; + uint8_t x9; + uint32_t x10; + uint8_t x11; + uint32_t x12; uint8_t x13; uint8_t x14; uint8_t x15; @@ -7924,48 +8023,41 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_bytes( uint8_t x19; uint8_t x20; uint8_t x21; - uint8_t x22; - uint32_t x23; - uint8_t x24; - uint32_t x25; + uint32_t x22; + uint8_t x23; + uint32_t x24; + uint8_t x25; uint8_t x26; uint8_t x27; - uint8_t x28; + uint32_t x28; uint8_t x29; uint32_t x30; uint8_t x31; - uint32_t x32; + uint8_t x32; uint8_t x33; - uint8_t x34; + uint32_t x34; uint8_t x35; - uint8_t x36; - uint32_t x37; + uint32_t x36; + uint8_t x37; uint8_t x38; - uint32_t x39; - uint8_t x40; + uint8_t x39; + uint32_t x40; uint8_t x41; - uint8_t x42; + uint32_t x42; uint8_t x43; - uint32_t x44; + uint8_t x44; uint8_t x45; uint32_t x46; uint8_t x47; - uint8_t x48; + uint32_t x48; uint8_t x49; uint8_t x50; - uint32_t x51; - uint8_t x52; - uint32_t x53; - uint8_t x54; + uint8_t x51; + uint32_t x52; + uint8_t x53; + uint32_t x54; uint8_t x55; uint8_t x56; - uint8_t x57; - uint32_t x58; - uint8_t x59; - uint32_t x60; - uint8_t x61; - uint8_t x62; - uint8_t x63; x1 = (arg1[7]); x2 = (arg1[6]); x3 = (arg1[5]); @@ -7974,97 +8066,90 @@ static void fiat_id_GostR3410_2001_TestParamSet_to_bytes( x6 = (arg1[2]); x7 = (arg1[1]); x8 = (arg1[0]); - x9 = (x8 >> 8); - x10 = (uint8_t)(x8 & UINT8_C(0xff)); - x11 = (x9 >> 8); - x12 = (uint8_t)(x9 & UINT8_C(0xff)); - x13 = (uint8_t)(x11 >> 8); - x14 = (uint8_t)(x11 & UINT8_C(0xff)); - x15 = (uint8_t)(x13 & UINT8_C(0xff)); + x9 = (uint8_t)(x8 & UINT8_C(0xff)); + x10 = (x8 >> 8); + x11 = (uint8_t)(x10 & UINT8_C(0xff)); + x12 = (x10 >> 8); + x13 = (uint8_t)(x12 & UINT8_C(0xff)); + x14 = (uint8_t)(x12 >> 8); + x15 = (uint8_t)(x7 & UINT8_C(0xff)); x16 = (x7 >> 8); - x17 = (uint8_t)(x7 & UINT8_C(0xff)); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); x18 = (x16 >> 8); - x19 = (uint8_t)(x16 & UINT8_C(0xff)); + x19 = (uint8_t)(x18 & UINT8_C(0xff)); x20 = (uint8_t)(x18 >> 8); - x21 = (uint8_t)(x18 & UINT8_C(0xff)); - x22 = (uint8_t)(x20 & UINT8_C(0xff)); - x23 = (x6 >> 8); - x24 = (uint8_t)(x6 & UINT8_C(0xff)); - x25 = (x23 >> 8); - x26 = (uint8_t)(x23 & UINT8_C(0xff)); - x27 = (uint8_t)(x25 >> 8); - x28 = (uint8_t)(x25 & UINT8_C(0xff)); - x29 = (uint8_t)(x27 & UINT8_C(0xff)); - x30 = (x5 >> 8); - x31 = (uint8_t)(x5 & UINT8_C(0xff)); - x32 = (x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (uint8_t)(x32 >> 8); - x35 = (uint8_t)(x32 & UINT8_C(0xff)); - x36 = (uint8_t)(x34 & UINT8_C(0xff)); - x37 = (x4 >> 8); - x38 = (uint8_t)(x4 & UINT8_C(0xff)); - x39 = (x37 >> 8); - x40 = (uint8_t)(x37 & UINT8_C(0xff)); - x41 = (uint8_t)(x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (uint8_t)(x41 & UINT8_C(0xff)); - x44 = (x3 >> 8); - x45 = (uint8_t)(x3 & UINT8_C(0xff)); - x46 = (x44 >> 8); - x47 = (uint8_t)(x44 & UINT8_C(0xff)); - x48 = (uint8_t)(x46 >> 8); - x49 = (uint8_t)(x46 & UINT8_C(0xff)); - x50 = (uint8_t)(x48 & UINT8_C(0xff)); - x51 = (x2 >> 8); - x52 = (uint8_t)(x2 & UINT8_C(0xff)); - x53 = (x51 >> 8); - x54 = (uint8_t)(x51 & UINT8_C(0xff)); - x55 = (uint8_t)(x53 >> 8); - x56 = (uint8_t)(x53 & UINT8_C(0xff)); - x57 = (uint8_t)(x55 & UINT8_C(0xff)); - x58 = (x1 >> 8); - x59 = (uint8_t)(x1 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - out1[0] = x10; - out1[1] = x12; - out1[2] = x14; - out1[3] = x15; - out1[4] = x17; - out1[5] = x19; - out1[6] = x21; - out1[7] = x22; - out1[8] = x24; - out1[9] = x26; - out1[10] = x28; - out1[11] = x29; - out1[12] = x31; - out1[13] = x33; - out1[14] = x35; - out1[15] = x36; - out1[16] = x38; - out1[17] = x40; - out1[18] = x42; - out1[19] = x43; - out1[20] = x45; - out1[21] = x47; - out1[22] = x49; - out1[23] = x50; - out1[24] = x52; - out1[25] = x54; - out1[26] = x56; - out1[27] = x57; - out1[28] = x59; - out1[29] = x61; - out1[30] = x63; - out1[31] = x62; + x21 = (uint8_t)(x6 & UINT8_C(0xff)); + x22 = (x6 >> 8); + x23 = (uint8_t)(x22 & UINT8_C(0xff)); + x24 = (x22 >> 8); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); + x26 = (uint8_t)(x24 >> 8); + x27 = (uint8_t)(x5 & UINT8_C(0xff)); + x28 = (x5 >> 8); + x29 = (uint8_t)(x28 & UINT8_C(0xff)); + x30 = (x28 >> 8); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); + x32 = (uint8_t)(x30 >> 8); + x33 = (uint8_t)(x4 & UINT8_C(0xff)); + x34 = (x4 >> 8); + x35 = (uint8_t)(x34 & UINT8_C(0xff)); + x36 = (x34 >> 8); + x37 = (uint8_t)(x36 & UINT8_C(0xff)); + x38 = (uint8_t)(x36 >> 8); + x39 = (uint8_t)(x3 & UINT8_C(0xff)); + x40 = (x3 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (uint8_t)(x42 >> 8); + x45 = (uint8_t)(x2 & UINT8_C(0xff)); + x46 = (x2 >> 8); + x47 = (uint8_t)(x46 & UINT8_C(0xff)); + x48 = (x46 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (uint8_t)(x48 >> 8); + x51 = (uint8_t)(x1 & UINT8_C(0xff)); + x52 = (x1 >> 8); + x53 = (uint8_t)(x52 & UINT8_C(0xff)); + x54 = (x52 >> 8); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); + x56 = (uint8_t)(x54 >> 8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; } /* - * The function fiat_id_GostR3410_2001_TestParamSet_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_GostR3410_2001_TestParamSet_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -8125,6 +8210,15 @@ static void fiat_id_GostR3410_2001_TestParamSet_from_bytes( uint32_t x45; uint32_t x46; uint32_t x47; + uint32_t x48; + uint32_t x49; + uint32_t x50; + uint32_t x51; + uint32_t x52; + uint32_t x53; + uint32_t x54; + uint32_t x55; + uint32_t x56; x1 = ((uint32_t)(arg1[31]) << 24); x2 = ((uint32_t)(arg1[30]) << 16); x3 = ((uint32_t)(arg1[29]) << 8); @@ -8157,29 +8251,38 @@ static void fiat_id_GostR3410_2001_TestParamSet_from_bytes( x30 = ((uint32_t)(arg1[2]) << 16); x31 = ((uint32_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + x29))); - x34 = (x33 & UINT32_C(0xffffffff)); - x35 = (x4 + (x3 + (x2 + x1))); - x36 = (x8 + (x7 + (x6 + x5))); - x37 = (x12 + (x11 + (x10 + x9))); - x38 = (x16 + (x15 + (x14 + x13))); - x39 = (x20 + (x19 + (x18 + x17))); - x40 = (x24 + (x23 + (x22 + x21))); - x41 = (x28 + (x27 + (x26 + x25))); - x42 = (x41 & UINT32_C(0xffffffff)); - x43 = (x40 & UINT32_C(0xffffffff)); - x44 = (x39 & UINT32_C(0xffffffff)); - x45 = (x38 & UINT32_C(0xffffffff)); - x46 = (x37 & UINT32_C(0xffffffff)); - x47 = (x36 & UINT32_C(0xffffffff)); - out1[0] = x34; - out1[1] = x42; - out1[2] = x43; + x33 = (x31 + (uint32_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x27 + (uint32_t)x28); + x37 = (x26 + x36); + x38 = (x25 + x37); + x39 = (x23 + (uint32_t)x24); + x40 = (x22 + x39); + x41 = (x21 + x40); + x42 = (x19 + (uint32_t)x20); + x43 = (x18 + x42); + x44 = (x17 + x43); + x45 = (x15 + (uint32_t)x16); + x46 = (x14 + x45); + x47 = (x13 + x46); + x48 = (x11 + (uint32_t)x12); + x49 = (x10 + x48); + x50 = (x9 + x49); + x51 = (x7 + (uint32_t)x8); + x52 = (x6 + x51); + x53 = (x5 + x52); + x54 = (x3 + (uint32_t)x4); + x55 = (x2 + x54); + x56 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; out1[3] = x44; - out1[4] = x45; - out1[5] = x46; - out1[6] = x47; - out1[7] = x35; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; } /* END verbatim fiat code */ @@ -11150,7 +11253,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -11158,7 +11261,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -11224,7 +11327,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -11300,8 +11403,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -11359,6 +11462,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_GostR3410_2001_TestParamSet_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -11378,6 +11487,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_TestParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -11390,6 +11504,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_GostR3410_2001_TestParamSet_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -11411,8 +11531,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_GostR3410_2001_TestParamSet(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, @@ -11452,6 +11577,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_GostR3410_2001_TestParamSet(const EC_GROUP *group, EC_POINT *r, const EC_POINT *q, const BIGNUM *m, @@ -11489,6 +11618,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_GostR3410_2001_TestParamSet(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, diff --git a/ecp_id_tc26_gost_3410_2012_256_paramSetA.c b/ecp_id_tc26_gost_3410_2012_256_paramSetA.c index 1528163..9282fb7 100644 --- a/ecp_id_tc26_gost_3410_2012_256_paramSetA.c +++ b/ecp_id_tc26_gost_3410_2012_256_paramSetA.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_256_PARAMSETA_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -82,18 +86,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_tc26_gost_3410_2012_256_paramSetA 64 5 '2^256 - 617' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_tc26_gost_3410_2012_256_paramSetA 64 5 '2^256 - 617' */ /* curve description: id_tc26_gost_3410_2012_256_paramSetA */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ /* n = 5 (from "5") */ /* s-c = 2^256 - [(1, 617)] (from "2^256 - 617") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 0, 1] */ /* eval z = z[0] + (z[1] << 52) + (z[2] << 103) + (z[3] << 154) + (z[4] << 205) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */ +/* balance = [0x1ffffffffffb2e, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe] */ #include typedef unsigned char fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1; @@ -105,6 +110,17 @@ typedef unsigned __int128 fiat_id_tc26_gost_3410_2012_256_paramSetA_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_256_PARAMSETA_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_256_paramSetA_addcarryx_u52 is an addition with carry. * Postconditions: @@ -238,7 +254,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_256_paramSetA_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u64(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u64((~x2)) & + arg2)); *out1 = x3; } @@ -248,10 +267,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_cmovznz_u64( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] - * arg2: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] + * arg2: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_mul( uint64_t out1[5], const uint64_t arg1[5], const uint64_t arg2[5]) { @@ -412,9 +431,9 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_square( uint64_t out1[5], const uint64_t arg1[5]) { @@ -539,9 +558,9 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry( uint64_t out1[5], const uint64_t arg1[5]) { @@ -584,10 +603,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_add( uint64_t out1[5], const uint64_t arg1[5], const uint64_t arg2[5]) { @@ -614,10 +633,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_sub( uint64_t out1[5], const uint64_t arg1[5], const uint64_t arg2[5]) { @@ -644,9 +663,9 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_opp( uint64_t out1[5], const uint64_t arg1[5]) { @@ -710,7 +729,7 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -741,70 +760,70 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes( uint64_t x23; uint64_t x24; uint64_t x25; - uint64_t x26; - uint8_t x27; - uint64_t x28; - uint8_t x29; - uint64_t x30; - uint8_t x31; - uint64_t x32; - uint8_t x33; - uint64_t x34; - uint8_t x35; + uint8_t x26; + uint64_t x27; + uint8_t x28; + uint64_t x29; + uint8_t x30; + uint64_t x31; + uint8_t x32; + uint64_t x33; + uint8_t x34; + uint64_t x35; uint8_t x36; uint8_t x37; uint64_t x38; - uint64_t x39; - uint8_t x40; - uint64_t x41; - uint8_t x42; - uint64_t x43; - uint8_t x44; - uint64_t x45; - uint8_t x46; - uint64_t x47; - uint8_t x48; + uint8_t x39; + uint64_t x40; + uint8_t x41; + uint64_t x42; + uint8_t x43; + uint64_t x44; + uint8_t x45; + uint64_t x46; + uint8_t x47; + uint64_t x48; uint8_t x49; uint8_t x50; uint64_t x51; - uint64_t x52; - uint8_t x53; - uint64_t x54; - uint8_t x55; - uint64_t x56; - uint8_t x57; - uint64_t x58; - uint8_t x59; - uint64_t x60; - uint8_t x61; - uint64_t x62; - uint8_t x63; + uint8_t x52; + uint64_t x53; + uint8_t x54; + uint64_t x55; + uint8_t x56; + uint64_t x57; + uint8_t x58; + uint64_t x59; + uint8_t x60; + uint64_t x61; + uint8_t x62; + uint64_t x63; uint8_t x64; uint8_t x65; uint64_t x66; - uint64_t x67; - uint8_t x68; - uint64_t x69; - uint8_t x70; - uint64_t x71; - uint8_t x72; - uint64_t x73; - uint8_t x74; - uint64_t x75; - uint8_t x76; + uint8_t x67; + uint64_t x68; + uint8_t x69; + uint64_t x70; + uint8_t x71; + uint64_t x72; + uint8_t x73; + uint64_t x74; + uint8_t x75; + uint64_t x76; uint8_t x77; uint8_t x78; uint64_t x79; - uint64_t x80; - uint8_t x81; - uint64_t x82; - uint8_t x83; - uint64_t x84; - uint8_t x85; - uint64_t x86; - uint8_t x87; - uint64_t x88; - uint8_t x89; + uint8_t x80; + uint64_t x81; + uint8_t x82; + uint64_t x83; + uint8_t x84; + uint64_t x85; + uint8_t x86; + uint64_t x87; + uint8_t x88; + uint64_t x89; uint8_t x90; uint8_t x91; fiat_id_tc26_gost_3410_2012_256_paramSetA_subborrowx_u52( @@ -833,104 +852,104 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes( x23 = (x18 << 2); x24 = (x16 << 7); x25 = (x14 << 4); - x26 = (x12 >> 8); - x27 = (uint8_t)(x12 & UINT8_C(0xff)); - x28 = (x26 >> 8); - x29 = (uint8_t)(x26 & UINT8_C(0xff)); - x30 = (x28 >> 8); - x31 = (uint8_t)(x28 & UINT8_C(0xff)); - x32 = (x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); - x34 = (x32 >> 8); - x35 = (uint8_t)(x32 & UINT8_C(0xff)); - x36 = (uint8_t)(x34 >> 8); - x37 = (uint8_t)(x34 & UINT8_C(0xff)); - x38 = (x36 + x25); - x39 = (x38 >> 8); - x40 = (uint8_t)(x38 & UINT8_C(0xff)); - x41 = (x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (x41 >> 8); - x44 = (uint8_t)(x41 & UINT8_C(0xff)); - x45 = (x43 >> 8); - x46 = (uint8_t)(x43 & UINT8_C(0xff)); - x47 = (x45 >> 8); - x48 = (uint8_t)(x45 & UINT8_C(0xff)); - x49 = (uint8_t)(x47 >> 8); - x50 = (uint8_t)(x47 & UINT8_C(0xff)); - x51 = (x49 + x24); - x52 = (x51 >> 8); - x53 = (uint8_t)(x51 & UINT8_C(0xff)); - x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); - x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); - x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); - x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - x64 = (uint8_t)(x62 >> 8); - x65 = (uint8_t)(x62 & UINT8_C(0xff)); - x66 = (x64 + x23); - x67 = (x66 >> 8); - x68 = (uint8_t)(x66 & UINT8_C(0xff)); - x69 = (x67 >> 8); - x70 = (uint8_t)(x67 & UINT8_C(0xff)); - x71 = (x69 >> 8); - x72 = (uint8_t)(x69 & UINT8_C(0xff)); - x73 = (x71 >> 8); - x74 = (uint8_t)(x71 & UINT8_C(0xff)); - x75 = (x73 >> 8); - x76 = (uint8_t)(x73 & UINT8_C(0xff)); - x77 = (uint8_t)(x75 >> 8); - x78 = (uint8_t)(x75 & UINT8_C(0xff)); - x79 = (x77 + x22); - x80 = (x79 >> 8); - x81 = (uint8_t)(x79 & UINT8_C(0xff)); - x82 = (x80 >> 8); - x83 = (uint8_t)(x80 & UINT8_C(0xff)); - x84 = (x82 >> 8); - x85 = (uint8_t)(x82 & UINT8_C(0xff)); - x86 = (x84 >> 8); - x87 = (uint8_t)(x84 & UINT8_C(0xff)); - x88 = (x86 >> 8); - x89 = (uint8_t)(x86 & UINT8_C(0xff)); - x90 = (uint8_t)(x88 >> 8); - x91 = (uint8_t)(x88 & UINT8_C(0xff)); - out1[0] = x27; - out1[1] = x29; - out1[2] = x31; - out1[3] = x33; - out1[4] = x35; - out1[5] = x37; - out1[6] = x40; - out1[7] = x42; - out1[8] = x44; - out1[9] = x46; - out1[10] = x48; - out1[11] = x50; - out1[12] = x53; - out1[13] = x55; - out1[14] = x57; - out1[15] = x59; - out1[16] = x61; - out1[17] = x63; - out1[18] = x65; - out1[19] = x68; - out1[20] = x70; - out1[21] = x72; - out1[22] = x74; - out1[23] = x76; - out1[24] = x78; - out1[25] = x81; - out1[26] = x83; - out1[27] = x85; - out1[28] = x87; - out1[29] = x89; - out1[30] = x91; - out1[31] = x90; + x26 = (uint8_t)(x12 & UINT8_C(0xff)); + x27 = (x12 >> 8); + x28 = (uint8_t)(x27 & UINT8_C(0xff)); + x29 = (x27 >> 8); + x30 = (uint8_t)(x29 & UINT8_C(0xff)); + x31 = (x29 >> 8); + x32 = (uint8_t)(x31 & UINT8_C(0xff)); + x33 = (x31 >> 8); + x34 = (uint8_t)(x33 & UINT8_C(0xff)); + x35 = (x33 >> 8); + x36 = (uint8_t)(x35 & UINT8_C(0xff)); + x37 = (uint8_t)(x35 >> 8); + x38 = (x25 + (uint64_t)x37); + x39 = (uint8_t)(x38 & UINT8_C(0xff)); + x40 = (x38 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (x42 >> 8); + x45 = (uint8_t)(x44 & UINT8_C(0xff)); + x46 = (x44 >> 8); + x47 = (uint8_t)(x46 & UINT8_C(0xff)); + x48 = (x46 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (uint8_t)(x48 >> 8); + x51 = (x24 + (uint64_t)x50); + x52 = (uint8_t)(x51 & UINT8_C(0xff)); + x53 = (x51 >> 8); + x54 = (uint8_t)(x53 & UINT8_C(0xff)); + x55 = (x53 >> 8); + x56 = (uint8_t)(x55 & UINT8_C(0xff)); + x57 = (x55 >> 8); + x58 = (uint8_t)(x57 & UINT8_C(0xff)); + x59 = (x57 >> 8); + x60 = (uint8_t)(x59 & UINT8_C(0xff)); + x61 = (x59 >> 8); + x62 = (uint8_t)(x61 & UINT8_C(0xff)); + x63 = (x61 >> 8); + x64 = (uint8_t)(x63 & UINT8_C(0xff)); + x65 = (uint8_t)(x63 >> 8); + x66 = (x23 + (uint64_t)x65); + x67 = (uint8_t)(x66 & UINT8_C(0xff)); + x68 = (x66 >> 8); + x69 = (uint8_t)(x68 & UINT8_C(0xff)); + x70 = (x68 >> 8); + x71 = (uint8_t)(x70 & UINT8_C(0xff)); + x72 = (x70 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); + x74 = (x72 >> 8); + x75 = (uint8_t)(x74 & UINT8_C(0xff)); + x76 = (x74 >> 8); + x77 = (uint8_t)(x76 & UINT8_C(0xff)); + x78 = (uint8_t)(x76 >> 8); + x79 = (x22 + (uint64_t)x78); + x80 = (uint8_t)(x79 & UINT8_C(0xff)); + x81 = (x79 >> 8); + x82 = (uint8_t)(x81 & UINT8_C(0xff)); + x83 = (x81 >> 8); + x84 = (uint8_t)(x83 & UINT8_C(0xff)); + x85 = (x83 >> 8); + x86 = (uint8_t)(x85 & UINT8_C(0xff)); + x87 = (x85 >> 8); + x88 = (uint8_t)(x87 & UINT8_C(0xff)); + x89 = (x87 >> 8); + x90 = (uint8_t)(x89 & UINT8_C(0xff)); + x91 = (uint8_t)(x89 >> 8); + out1[0] = x26; + out1[1] = x28; + out1[2] = x30; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x39; + out1[7] = x41; + out1[8] = x43; + out1[9] = x45; + out1[10] = x47; + out1[11] = x49; + out1[12] = x52; + out1[13] = x54; + out1[14] = x56; + out1[15] = x58; + out1[16] = x60; + out1[17] = x62; + out1[18] = x64; + out1[19] = x67; + out1[20] = x69; + out1[21] = x71; + out1[22] = x73; + out1[23] = x75; + out1[24] = x77; + out1[25] = x80; + out1[26] = x82; + out1[27] = x84; + out1[28] = x86; + out1[29] = x88; + out1[30] = x90; + out1[31] = x91; } /* @@ -941,7 +960,7 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_from_bytes( uint64_t out1[5], const uint8_t arg1[32]) { @@ -978,22 +997,44 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_from_bytes( uint64_t x31; uint8_t x32; uint64_t x33; - uint8_t x34; + uint64_t x34; uint64_t x35; uint64_t x36; uint64_t x37; uint64_t x38; uint64_t x39; - uint64_t x40; - fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1 x41; + uint8_t x40; + uint64_t x41; uint64_t x42; uint64_t x43; - uint8_t x44; + uint64_t x44; uint64_t x45; uint64_t x46; - uint8_t x47; - uint64_t x48; + uint64_t x47; + fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1 x48; uint64_t x49; + uint64_t x50; + uint64_t x51; + uint64_t x52; + uint64_t x53; + uint64_t x54; + uint64_t x55; + uint64_t x56; + uint8_t x57; + uint64_t x58; + uint64_t x59; + uint64_t x60; + uint64_t x61; + uint64_t x62; + uint64_t x63; + uint64_t x64; + uint8_t x65; + uint64_t x66; + uint64_t x67; + uint64_t x68; + uint64_t x69; + uint64_t x70; + uint64_t x71; x1 = ((uint64_t)(arg1[31]) << 43); x2 = ((uint64_t)(arg1[30]) << 35); x3 = ((uint64_t)(arg1[29]) << 27); @@ -1026,28 +1067,50 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_from_bytes( x30 = ((uint64_t)(arg1[2]) << 16); x31 = ((uint64_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + x26)))))); - x34 = (uint8_t)(x33 >> 52); - x35 = (x33 & UINT64_C(0xfffffffffffff)); - x36 = (x6 + (x5 + (x4 + (x3 + (x2 + x1))))); - x37 = (x12 + (x11 + (x10 + (x9 + (x8 + x7))))); - x38 = (x19 + (x18 + (x17 + (x16 + (x15 + (x14 + x13)))))); - x39 = (x25 + (x24 + (x23 + (x22 + (x21 + x20))))); - x40 = (x34 + x39); - x41 = (fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1)(x40 >> 51); - x42 = (x40 & UINT64_C(0x7ffffffffffff)); - x43 = (x41 + x38); - x44 = (uint8_t)(x43 >> 51); - x45 = (x43 & UINT64_C(0x7ffffffffffff)); - x46 = (x44 + x37); - x47 = (uint8_t)(x46 >> 51); - x48 = (x46 & UINT64_C(0x7ffffffffffff)); - x49 = (x47 + x36); - out1[0] = x35; - out1[1] = x42; - out1[2] = x45; - out1[3] = x48; - out1[4] = x49; + x33 = (x31 + (uint64_t)x32); + x34 = (x30 + x33); + x35 = (x29 + x34); + x36 = (x28 + x35); + x37 = (x27 + x36); + x38 = (x26 + x37); + x39 = (x38 & UINT64_C(0xfffffffffffff)); + x40 = (uint8_t)(x38 >> 52); + x41 = (x25 + (uint64_t)x40); + x42 = (x24 + x41); + x43 = (x23 + x42); + x44 = (x22 + x43); + x45 = (x21 + x44); + x46 = (x20 + x45); + x47 = (x46 & UINT64_C(0x7ffffffffffff)); + x48 = (fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1)(x46 >> 51); + x49 = (x19 + (uint64_t)x48); + x50 = (x18 + x49); + x51 = (x17 + x50); + x52 = (x16 + x51); + x53 = (x15 + x52); + x54 = (x14 + x53); + x55 = (x13 + x54); + x56 = (x55 & UINT64_C(0x7ffffffffffff)); + x57 = (uint8_t)(x55 >> 51); + x58 = (x12 + (uint64_t)x57); + x59 = (x11 + x58); + x60 = (x10 + x59); + x61 = (x9 + x60); + x62 = (x8 + x61); + x63 = (x7 + x62); + x64 = (x63 & UINT64_C(0x7ffffffffffff)); + x65 = (uint8_t)(x63 >> 51); + x66 = (x6 + (uint64_t)x65); + x67 = (x5 + x66); + x68 = (x4 + x67); + x69 = (x3 + x68); + x70 = (x2 + x69); + x71 = (x1 + x70); + out1[0] = x39; + out1[1] = x47; + out1[2] = x56; + out1[3] = x64; + out1[4] = x71; } /* END verbatim fiat code */ @@ -3455,7 +3518,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -3463,7 +3526,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -3537,7 +3600,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -3625,8 +3688,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -3698,6 +3761,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -3713,6 +3782,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -3723,6 +3797,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -3740,8 +3820,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_256_paramSetA( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -3780,6 +3865,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_256_paramSetA(const EC_GROUP *group, EC_POINT *r, @@ -3819,6 +3908,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_256_paramSetA(const EC_GROUP *group, EC_POINT *r, @@ -3865,6 +3958,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_256_PARAMSETA_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -3915,18 +4012,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_tc26_gost_3410_2012_256_paramSetA 32 '(auto)' '2^256 - 617' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_tc26_gost_3410_2012_256_paramSetA 32 '(auto)' '2^256 - 617' */ /* curve description: id_tc26_gost_3410_2012_256_paramSetA */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ /* n = 11 (from "(auto)") */ /* s-c = 2^256 - [(1, 617)] (from "2^256 - 617") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 0, 1] */ /* eval z = z[0] + (z[1] << 24) + (z[2] << 47) + (z[3] << 70) + (z[4] << 94) + (z[5] << 117) + (z[6] << 140) + (z[7] << 163) + (z[8] << 187) + (z[9] << 210) + (z[10] << 233) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) */ +/* balance = [0x1fffb2e, 0xfffffe, 0xfffffe, 0x1fffffe, 0xfffffe, 0xfffffe, 0xfffffe, 0x1fffffe, 0xfffffe, 0xfffffe, 0xfffffe] */ #include typedef unsigned char fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1; @@ -3936,6 +4034,17 @@ typedef signed char fiat_id_tc26_gost_3410_2012_256_paramSetA_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_256_PARAMSETA_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_256_paramSetA_addcarryx_u24 is an addition with carry. * Postconditions: @@ -4069,7 +4178,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_256_paramSetA_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u32(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_256_paramSetA_value_barrier_u32((~x2)) & + arg2)); *out1 = x3; } @@ -4079,10 +4191,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_cmovznz_u32( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] - * arg2: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * arg1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] + * arg2: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_mul( uint32_t out1[11], const uint32_t arg1[11], const uint32_t arg2[11]) { @@ -4482,9 +4594,9 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * arg1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_square( uint32_t out1[11], const uint32_t arg1[11]) { @@ -4781,9 +4893,9 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * arg1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry( uint32_t out1[11], const uint32_t arg1[11]) { @@ -4856,10 +4968,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] - * arg2: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] + * arg2: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: - * out1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * out1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_add( uint32_t out1[11], const uint32_t arg1[11], const uint32_t arg2[11]) { @@ -4904,10 +5016,10 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] - * arg2: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] + * arg2: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: - * out1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * out1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_sub( uint32_t out1[11], const uint32_t arg1[11], const uint32_t arg2[11]) { @@ -4952,9 +5064,9 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: - * out1: [[0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x34ccccb], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664], [0x0 ~> 0x1a66664]] + * out1: [[0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x3000000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000], [0x0 ~> 0x1800000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_opp( uint32_t out1[11], const uint32_t arg1[11]) { @@ -5060,7 +5172,7 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] * * Input Bounds: - * arg1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * arg1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -5120,76 +5232,75 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes( uint32_t x52; uint32_t x53; uint32_t x54; - uint32_t x55; - uint8_t x56; + uint8_t x55; + uint32_t x56; uint8_t x57; uint8_t x58; uint8_t x59; uint32_t x60; uint8_t x61; uint8_t x62; - uint8_t x63; - uint32_t x64; + uint32_t x63; + uint8_t x64; uint32_t x65; uint8_t x66; uint32_t x67; uint8_t x68; uint8_t x69; - uint8_t x70; - uint32_t x71; + uint32_t x70; + uint8_t x71; uint32_t x72; uint8_t x73; uint32_t x74; uint8_t x75; uint8_t x76; - uint8_t x77; - uint32_t x78; + uint32_t x77; + uint8_t x78; uint32_t x79; uint8_t x80; uint32_t x81; uint8_t x82; uint8_t x83; - uint8_t x84; - uint32_t x85; + uint32_t x84; + uint8_t x85; uint32_t x86; uint8_t x87; uint32_t x88; uint8_t x89; uint8_t x90; - uint8_t x91; - uint32_t x92; + uint32_t x91; + uint8_t x92; uint32_t x93; uint8_t x94; uint32_t x95; uint8_t x96; uint8_t x97; - uint8_t x98; - uint32_t x99; + uint32_t x98; + uint8_t x99; uint32_t x100; uint8_t x101; uint32_t x102; uint8_t x103; uint8_t x104; - uint8_t x105; - uint32_t x106; + uint32_t x105; + uint8_t x106; uint32_t x107; uint8_t x108; uint32_t x109; uint8_t x110; uint8_t x111; - uint8_t x112; - uint32_t x113; + uint32_t x112; + uint8_t x113; uint32_t x114; uint8_t x115; uint32_t x116; uint8_t x117; fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1 x118; - uint8_t x119; - uint32_t x120; + uint32_t x119; + uint8_t x120; uint32_t x121; uint8_t x122; uint8_t x123; - uint8_t x124; fiat_id_tc26_gost_3410_2012_256_paramSetA_subborrowx_u24( &x1, &x2, 0x0, (arg1[0]), UINT32_C(0xfffd97)); fiat_id_tc26_gost_3410_2012_256_paramSetA_subborrowx_u23( @@ -5245,107 +5356,106 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes( x52 = (x32 << 6); x53 = (x30 << 6); x54 = (x28 << 7); - x55 = (x24 >> 8); - x56 = (uint8_t)(x24 & UINT8_C(0xff)); - x57 = (uint8_t)(x55 >> 8); - x58 = (uint8_t)(x55 & UINT8_C(0xff)); - x59 = (uint8_t)(x57 & UINT8_C(0xff)); + x55 = (uint8_t)(x24 & UINT8_C(0xff)); + x56 = (x24 >> 8); + x57 = (uint8_t)(x56 & UINT8_C(0xff)); + x58 = (uint8_t)(x56 >> 8); + x59 = (uint8_t)(x26 & UINT8_C(0xff)); x60 = (x26 >> 8); - x61 = (uint8_t)(x26 & UINT8_C(0xff)); + x61 = (uint8_t)(x60 & UINT8_C(0xff)); x62 = (uint8_t)(x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - x64 = (x62 + x54); - x65 = (x64 >> 8); - x66 = (uint8_t)(x64 & UINT8_C(0xff)); + x63 = (x54 + (uint32_t)x62); + x64 = (uint8_t)(x63 & UINT8_C(0xff)); + x65 = (x63 >> 8); + x66 = (uint8_t)(x65 & UINT8_C(0xff)); x67 = (x65 >> 8); - x68 = (uint8_t)(x65 & UINT8_C(0xff)); + x68 = (uint8_t)(x67 & UINT8_C(0xff)); x69 = (uint8_t)(x67 >> 8); - x70 = (uint8_t)(x67 & UINT8_C(0xff)); - x71 = (x69 + x53); - x72 = (x71 >> 8); - x73 = (uint8_t)(x71 & UINT8_C(0xff)); + x70 = (x53 + (uint32_t)x69); + x71 = (uint8_t)(x70 & UINT8_C(0xff)); + x72 = (x70 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); x74 = (x72 >> 8); - x75 = (uint8_t)(x72 & UINT8_C(0xff)); + x75 = (uint8_t)(x74 & UINT8_C(0xff)); x76 = (uint8_t)(x74 >> 8); - x77 = (uint8_t)(x74 & UINT8_C(0xff)); - x78 = (x76 + x52); - x79 = (x78 >> 8); - x80 = (uint8_t)(x78 & UINT8_C(0xff)); + x77 = (x52 + (uint32_t)x76); + x78 = (uint8_t)(x77 & UINT8_C(0xff)); + x79 = (x77 >> 8); + x80 = (uint8_t)(x79 & UINT8_C(0xff)); x81 = (x79 >> 8); - x82 = (uint8_t)(x79 & UINT8_C(0xff)); + x82 = (uint8_t)(x81 & UINT8_C(0xff)); x83 = (uint8_t)(x81 >> 8); - x84 = (uint8_t)(x81 & UINT8_C(0xff)); - x85 = (x83 + x51); - x86 = (x85 >> 8); - x87 = (uint8_t)(x85 & UINT8_C(0xff)); + x84 = (x51 + (uint32_t)x83); + x85 = (uint8_t)(x84 & UINT8_C(0xff)); + x86 = (x84 >> 8); + x87 = (uint8_t)(x86 & UINT8_C(0xff)); x88 = (x86 >> 8); - x89 = (uint8_t)(x86 & UINT8_C(0xff)); + x89 = (uint8_t)(x88 & UINT8_C(0xff)); x90 = (uint8_t)(x88 >> 8); - x91 = (uint8_t)(x88 & UINT8_C(0xff)); - x92 = (x90 + x50); - x93 = (x92 >> 8); - x94 = (uint8_t)(x92 & UINT8_C(0xff)); + x91 = (x50 + (uint32_t)x90); + x92 = (uint8_t)(x91 & UINT8_C(0xff)); + x93 = (x91 >> 8); + x94 = (uint8_t)(x93 & UINT8_C(0xff)); x95 = (x93 >> 8); - x96 = (uint8_t)(x93 & UINT8_C(0xff)); + x96 = (uint8_t)(x95 & UINT8_C(0xff)); x97 = (uint8_t)(x95 >> 8); - x98 = (uint8_t)(x95 & UINT8_C(0xff)); - x99 = (x97 + x49); - x100 = (x99 >> 8); - x101 = (uint8_t)(x99 & UINT8_C(0xff)); + x98 = (x49 + (uint32_t)x97); + x99 = (uint8_t)(x98 & UINT8_C(0xff)); + x100 = (x98 >> 8); + x101 = (uint8_t)(x100 & UINT8_C(0xff)); x102 = (x100 >> 8); - x103 = (uint8_t)(x100 & UINT8_C(0xff)); + x103 = (uint8_t)(x102 & UINT8_C(0xff)); x104 = (uint8_t)(x102 >> 8); - x105 = (uint8_t)(x102 & UINT8_C(0xff)); - x106 = (x104 + x48); - x107 = (x106 >> 8); - x108 = (uint8_t)(x106 & UINT8_C(0xff)); + x105 = (x48 + (uint32_t)x104); + x106 = (uint8_t)(x105 & UINT8_C(0xff)); + x107 = (x105 >> 8); + x108 = (uint8_t)(x107 & UINT8_C(0xff)); x109 = (x107 >> 8); - x110 = (uint8_t)(x107 & UINT8_C(0xff)); + x110 = (uint8_t)(x109 & UINT8_C(0xff)); x111 = (uint8_t)(x109 >> 8); - x112 = (uint8_t)(x109 & UINT8_C(0xff)); - x113 = (x111 + x47); - x114 = (x113 >> 8); - x115 = (uint8_t)(x113 & UINT8_C(0xff)); + x112 = (x47 + (uint32_t)x111); + x113 = (uint8_t)(x112 & UINT8_C(0xff)); + x114 = (x112 >> 8); + x115 = (uint8_t)(x114 & UINT8_C(0xff)); x116 = (x114 >> 8); - x117 = (uint8_t)(x114 & UINT8_C(0xff)); + x117 = (uint8_t)(x116 & UINT8_C(0xff)); x118 = (fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1)(x116 >> 8); - x119 = (uint8_t)(x116 & UINT8_C(0xff)); - x120 = (x118 + x46); - x121 = (x120 >> 8); - x122 = (uint8_t)(x120 & UINT8_C(0xff)); + x119 = (x46 + (uint32_t)x118); + x120 = (uint8_t)(x119 & UINT8_C(0xff)); + x121 = (x119 >> 8); + x122 = (uint8_t)(x121 & UINT8_C(0xff)); x123 = (uint8_t)(x121 >> 8); - x124 = (uint8_t)(x121 & UINT8_C(0xff)); - out1[0] = x56; - out1[1] = x58; - out1[2] = x59; - out1[3] = x61; - out1[4] = x63; - out1[5] = x66; - out1[6] = x68; - out1[7] = x70; - out1[8] = x73; - out1[9] = x75; - out1[10] = x77; - out1[11] = x80; - out1[12] = x82; - out1[13] = x84; - out1[14] = x87; - out1[15] = x89; - out1[16] = x91; - out1[17] = x94; - out1[18] = x96; - out1[19] = x98; - out1[20] = x101; - out1[21] = x103; - out1[22] = x105; - out1[23] = x108; - out1[24] = x110; - out1[25] = x112; - out1[26] = x115; - out1[27] = x117; - out1[28] = x119; - out1[29] = x122; - out1[30] = x124; + out1[0] = x55; + out1[1] = x57; + out1[2] = x58; + out1[3] = x59; + out1[4] = x61; + out1[5] = x64; + out1[6] = x66; + out1[7] = x68; + out1[8] = x71; + out1[9] = x73; + out1[10] = x75; + out1[11] = x78; + out1[12] = x80; + out1[13] = x82; + out1[14] = x85; + out1[15] = x87; + out1[16] = x89; + out1[17] = x92; + out1[18] = x94; + out1[19] = x96; + out1[20] = x99; + out1[21] = x101; + out1[22] = x103; + out1[23] = x106; + out1[24] = x108; + out1[25] = x110; + out1[26] = x113; + out1[27] = x115; + out1[28] = x117; + out1[29] = x120; + out1[30] = x122; out1[31] = x123; } @@ -5357,7 +5467,7 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x1199999], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc], [0x0 ~> 0x8ccccc]] + * out1: [[0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x1000000], [0x0 ~> 0x800000], [0x0 ~> 0x800000], [0x0 ~> 0x800000]] */ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_from_bytes( uint32_t out1[11], const uint8_t arg1[32]) { @@ -5398,40 +5508,49 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_from_bytes( uint32_t x35; uint32_t x36; uint32_t x37; - uint32_t x38; + fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1 x38; uint32_t x39; uint32_t x40; uint32_t x41; uint32_t x42; - uint32_t x43; + uint8_t x43; uint32_t x44; - fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1 x45; + uint32_t x45; uint32_t x46; uint32_t x47; uint8_t x48; uint32_t x49; uint32_t x50; - uint8_t x51; + uint32_t x51; uint32_t x52; - uint32_t x53; - uint8_t x54; + uint8_t x53; + uint32_t x54; uint32_t x55; uint32_t x56; - uint8_t x57; - uint32_t x58; + uint32_t x57; + uint8_t x58; uint32_t x59; - uint8_t x60; + uint32_t x60; uint32_t x61; uint32_t x62; uint8_t x63; uint32_t x64; uint32_t x65; - uint8_t x66; + uint32_t x66; uint32_t x67; - uint32_t x68; - uint8_t x69; + uint8_t x68; + uint32_t x69; uint32_t x70; uint32_t x71; + uint32_t x72; + uint8_t x73; + uint32_t x74; + uint32_t x75; + uint32_t x76; + uint32_t x77; + uint8_t x78; + uint32_t x79; + uint32_t x80; x1 = ((uint32_t)(arg1[31]) << 15); x2 = ((uint32_t)(arg1[30]) << 7); x3 = ((uint32_t)(arg1[29]) << 22); @@ -5464,56 +5583,65 @@ static void fiat_id_tc26_gost_3410_2012_256_paramSetA_from_bytes( x30 = ((uint32_t)(arg1[2]) << 16); x31 = ((uint32_t)(arg1[1]) << 8); x32 = (arg1[0]); - x33 = (x32 + (x31 + x30)); - x34 = (x33 & UINT32_C(0xffffff)); - x35 = (x2 + x1); - x36 = (x5 + (x4 + x3)); - x37 = (x8 + (x7 + x6)); - x38 = (x11 + (x10 + x9)); - x39 = (x14 + (x13 + x12)); - x40 = (x17 + (x16 + x15)); - x41 = (x20 + (x19 + x18)); - x42 = (x23 + (x22 + x21)); - x43 = (x26 + (x25 + x24)); - x44 = (x29 + (x28 + x27)); - x45 = (fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1)(x44 >> 23); - x46 = (x44 & UINT32_C(0x7fffff)); - x47 = (x45 + x43); - x48 = (uint8_t)(x47 >> 23); - x49 = (x47 & UINT32_C(0x7fffff)); - x50 = (x48 + x42); - x51 = (uint8_t)(x50 >> 24); - x52 = (x50 & UINT32_C(0xffffff)); - x53 = (x51 + x41); - x54 = (uint8_t)(x53 >> 23); - x55 = (x53 & UINT32_C(0x7fffff)); - x56 = (x54 + x40); - x57 = (uint8_t)(x56 >> 23); - x58 = (x56 & UINT32_C(0x7fffff)); - x59 = (x57 + x39); - x60 = (uint8_t)(x59 >> 23); - x61 = (x59 & UINT32_C(0x7fffff)); - x62 = (x60 + x38); - x63 = (uint8_t)(x62 >> 24); - x64 = (x62 & UINT32_C(0xffffff)); - x65 = (x63 + x37); - x66 = (uint8_t)(x65 >> 23); - x67 = (x65 & UINT32_C(0x7fffff)); - x68 = (x66 + x36); - x69 = (uint8_t)(x68 >> 23); - x70 = (x68 & UINT32_C(0x7fffff)); - x71 = (x69 + x35); + x33 = (x31 + (uint32_t)x32); + x34 = (x30 + x33); + x35 = (x28 + (uint32_t)x29); + x36 = (x27 + x35); + x37 = (x36 & UINT32_C(0x7fffff)); + x38 = (fiat_id_tc26_gost_3410_2012_256_paramSetA_uint1)(x36 >> 23); + x39 = (x26 + (uint32_t)x38); + x40 = (x25 + x39); + x41 = (x24 + x40); + x42 = (x41 & UINT32_C(0x7fffff)); + x43 = (uint8_t)(x41 >> 23); + x44 = (x23 + (uint32_t)x43); + x45 = (x22 + x44); + x46 = (x21 + x45); + x47 = (x46 & UINT32_C(0xffffff)); + x48 = (uint8_t)(x46 >> 24); + x49 = (x20 + (uint32_t)x48); + x50 = (x19 + x49); + x51 = (x18 + x50); + x52 = (x51 & UINT32_C(0x7fffff)); + x53 = (uint8_t)(x51 >> 23); + x54 = (x17 + (uint32_t)x53); + x55 = (x16 + x54); + x56 = (x15 + x55); + x57 = (x56 & UINT32_C(0x7fffff)); + x58 = (uint8_t)(x56 >> 23); + x59 = (x14 + (uint32_t)x58); + x60 = (x13 + x59); + x61 = (x12 + x60); + x62 = (x61 & UINT32_C(0x7fffff)); + x63 = (uint8_t)(x61 >> 23); + x64 = (x11 + (uint32_t)x63); + x65 = (x10 + x64); + x66 = (x9 + x65); + x67 = (x66 & UINT32_C(0xffffff)); + x68 = (uint8_t)(x66 >> 24); + x69 = (x8 + (uint32_t)x68); + x70 = (x7 + x69); + x71 = (x6 + x70); + x72 = (x71 & UINT32_C(0x7fffff)); + x73 = (uint8_t)(x71 >> 23); + x74 = (x5 + (uint32_t)x73); + x75 = (x4 + x74); + x76 = (x3 + x75); + x77 = (x76 & UINT32_C(0x7fffff)); + x78 = (uint8_t)(x76 >> 23); + x79 = (x2 + (uint32_t)x78); + x80 = (x1 + x79); out1[0] = x34; - out1[1] = x46; - out1[2] = x49; - out1[3] = x52; - out1[4] = x55; - out1[5] = x58; - out1[6] = x61; - out1[7] = x64; - out1[8] = x67; - out1[9] = x70; - out1[10] = x71; + out1[1] = x37; + out1[2] = x42; + out1[3] = x47; + out1[4] = x52; + out1[5] = x57; + out1[6] = x62; + out1[7] = x67; + out1[8] = x72; + out1[9] = x77; + out1[10] = x80; } /* END verbatim fiat code */ @@ -8464,8 +8592,8 @@ static void point_edwards2legacy(pt_prj_t *Q, const pt_prj_t *P) { /* temporary variables */ fe_t t0; /* constants */ - const limb_t *T = const_T; const limb_t *S = const_S; + const limb_t *T = const_T; const limb_t *X1 = P->X; const limb_t *Y1 = P->Y; const limb_t *Z1 = P->Z; @@ -8492,8 +8620,8 @@ static void point_edwards2legacy(pt_prj_t *Q, const pt_prj_t *P) { */ static void point_legacy2edwards(pt_prj_t *Q, const pt_aff_t *P) { /* constants */ - const limb_t *T = const_T; const limb_t *S = const_S; + const limb_t *T = const_T; const limb_t *X1 = P->X; const limb_t *Y1 = P->Y; limb_t *X3 = Q->X; @@ -8597,7 +8725,7 @@ static void scalar_wnaf(int8_t out[257], const unsigned char in[32]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], @@ -8605,7 +8733,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[32], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[257] = {0}; int8_t bnaf[257] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -8679,7 +8807,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[52] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -8767,8 +8895,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[32], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[52] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -8840,6 +8968,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[32]) { fiat_id_tc26_gost_3410_2012_256_paramSetA_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], const unsigned char a[32], const unsigned char b[32], const unsigned char inx[32], @@ -8855,6 +8989,11 @@ static void point_mul_two(unsigned char outx[32], unsigned char outy[32], fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32]) { pt_aff_t P; @@ -8865,6 +9004,12 @@ static void point_mul_g(unsigned char outx[32], unsigned char outy[32], fiat_id_tc26_gost_3410_2012_256_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[32], unsigned char outy[32], const unsigned char scalar[32], const unsigned char inx[32], @@ -8882,8 +9027,13 @@ static void point_mul(unsigned char outx[32], unsigned char outy[32], #include +/* the zero field element */ static const unsigned char const_zb[32] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_256_paramSetA( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -8922,6 +9072,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_256_paramSetA(const EC_GROUP *group, EC_POINT *r, @@ -8961,6 +9115,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_256_paramSetA(const EC_GROUP *group, EC_POINT *r, diff --git a/ecp_id_tc26_gost_3410_2012_512_paramSetA.c b/ecp_id_tc26_gost_3410_2012_512_paramSetA.c index 8667cc7..5c50d83 100644 --- a/ecp_id_tc26_gost_3410_2012_512_paramSetA.c +++ b/ecp_id_tc26_gost_3410_2012_512_paramSetA.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETA_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -80,18 +84,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_tc26_gost_3410_2012_512_paramSetA 64 '(auto)' '2^512 - 569' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_tc26_gost_3410_2012_512_paramSetA 64 '(auto)' '2^512 - 569' */ /* curve description: id_tc26_gost_3410_2012_512_paramSetA */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ /* n = 10 (from "(auto)") */ /* s-c = 2^512 - [(1, 569)] (from "2^512 - 569") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1] */ /* eval z = z[0] + (z[1] << 52) + (z[2] << 103) + (z[3] << 154) + (z[4] << 205) + (z[5] << 256) + (z[6] << 0x134) + (z[7] << 0x167) + (z[8] << 0x19a) + (z[9] << 0x1cd) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) + (z[55] << 0x1b8) + (z[56] << 0x1c0) + (z[57] << 0x1c8) + (z[58] << 0x1d0) + (z[59] << 0x1d8) + (z[60] << 0x1e0) + (z[61] << 0x1e8) + (z[62] << 0x1f0) + (z[63] << 0x1f8) */ +/* balance = [0x1ffffffffffb8e, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0x1ffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe] */ #include typedef unsigned char fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1; @@ -103,6 +108,17 @@ typedef unsigned __int128 fiat_id_tc26_gost_3410_2012_512_paramSetA_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETA_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_512_paramSetA_addcarryx_u52 is an addition with carry. * Postconditions: @@ -236,7 +252,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_512_paramSetA_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u64(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u64((~x2)) & + arg2)); *out1 = x3; } @@ -246,10 +265,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_cmovznz_u64( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] - * arg2: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] + * arg2: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_mul( uint64_t out1[10], const uint64_t arg1[10], const uint64_t arg2[10]) { @@ -740,9 +759,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_square( uint64_t out1[10], const uint64_t arg1[10]) { @@ -1030,9 +1049,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry( uint64_t out1[10], const uint64_t arg1[10]) { @@ -1100,10 +1119,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_add( uint64_t out1[10], const uint64_t arg1[10], const uint64_t arg2[10]) { @@ -1145,10 +1164,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_sub( uint64_t out1[10], const uint64_t arg1[10], const uint64_t arg2[10]) { @@ -1190,9 +1209,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_opp( uint64_t out1[10], const uint64_t arg1[10]) { @@ -1291,7 +1310,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..63] * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -1346,70 +1365,70 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( uint64_t x47; uint64_t x48; uint64_t x49; - uint64_t x50; - uint8_t x51; - uint64_t x52; - uint8_t x53; - uint64_t x54; - uint8_t x55; - uint64_t x56; - uint8_t x57; - uint64_t x58; - uint8_t x59; + uint8_t x50; + uint64_t x51; + uint8_t x52; + uint64_t x53; + uint8_t x54; + uint64_t x55; + uint8_t x56; + uint64_t x57; + uint8_t x58; + uint64_t x59; uint8_t x60; uint8_t x61; uint64_t x62; - uint64_t x63; - uint8_t x64; - uint64_t x65; - uint8_t x66; - uint64_t x67; - uint8_t x68; - uint64_t x69; - uint8_t x70; - uint64_t x71; - uint8_t x72; + uint8_t x63; + uint64_t x64; + uint8_t x65; + uint64_t x66; + uint8_t x67; + uint64_t x68; + uint8_t x69; + uint64_t x70; + uint8_t x71; + uint64_t x72; uint8_t x73; uint8_t x74; uint64_t x75; - uint64_t x76; - uint8_t x77; - uint64_t x78; - uint8_t x79; - uint64_t x80; - uint8_t x81; - uint64_t x82; - uint8_t x83; - uint64_t x84; - uint8_t x85; - uint64_t x86; - uint8_t x87; + uint8_t x76; + uint64_t x77; + uint8_t x78; + uint64_t x79; + uint8_t x80; + uint64_t x81; + uint8_t x82; + uint64_t x83; + uint8_t x84; + uint64_t x85; + uint8_t x86; + uint64_t x87; uint8_t x88; uint8_t x89; uint64_t x90; - uint64_t x91; - uint8_t x92; - uint64_t x93; - uint8_t x94; - uint64_t x95; - uint8_t x96; - uint64_t x97; - uint8_t x98; - uint64_t x99; - uint8_t x100; + uint8_t x91; + uint64_t x92; + uint8_t x93; + uint64_t x94; + uint8_t x95; + uint64_t x96; + uint8_t x97; + uint64_t x98; + uint8_t x99; + uint64_t x100; uint8_t x101; uint8_t x102; uint64_t x103; - uint64_t x104; - uint8_t x105; - uint64_t x106; - uint8_t x107; - uint64_t x108; - uint8_t x109; - uint64_t x110; - uint8_t x111; - uint64_t x112; - uint8_t x113; + uint8_t x104; + uint64_t x105; + uint8_t x106; + uint64_t x107; + uint8_t x108; + uint64_t x109; + uint8_t x110; + uint64_t x111; + uint8_t x112; + uint64_t x113; uint8_t x114; uint8_t x115; uint8_t x116; @@ -1424,8 +1443,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( uint64_t x125; uint8_t x126; uint8_t x127; - uint8_t x128; - uint64_t x129; + uint64_t x128; + uint8_t x129; uint64_t x130; uint8_t x131; uint64_t x132; @@ -1437,8 +1456,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( uint64_t x138; uint8_t x139; uint8_t x140; - uint8_t x141; - uint64_t x142; + uint64_t x141; + uint8_t x142; uint64_t x143; uint8_t x144; uint64_t x145; @@ -1452,8 +1471,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( uint64_t x153; uint8_t x154; uint8_t x155; - uint8_t x156; - uint64_t x157; + uint64_t x156; + uint8_t x157; uint64_t x158; uint8_t x159; uint64_t x160; @@ -1465,8 +1484,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( uint64_t x166; uint8_t x167; uint8_t x168; - uint8_t x169; - uint64_t x170; + uint64_t x169; + uint8_t x170; uint64_t x171; uint8_t x172; uint64_t x173; @@ -1478,7 +1497,6 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( uint64_t x179; uint8_t x180; uint8_t x181; - uint8_t x182; fiat_id_tc26_gost_3410_2012_512_paramSetA_subborrowx_u52( &x1, &x2, 0x0, (arg1[0]), UINT64_C(0xffffffffffdc7)); fiat_id_tc26_gost_3410_2012_512_paramSetA_subborrowx_u51( @@ -1529,202 +1547,201 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( x47 = (x28 << 2); x48 = (x26 << 7); x49 = (x24 << 4); - x50 = (x22 >> 8); - x51 = (uint8_t)(x22 & UINT8_C(0xff)); - x52 = (x50 >> 8); - x53 = (uint8_t)(x50 & UINT8_C(0xff)); - x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); - x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); - x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); - x60 = (uint8_t)(x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (x60 + x49); - x63 = (x62 >> 8); - x64 = (uint8_t)(x62 & UINT8_C(0xff)); - x65 = (x63 >> 8); - x66 = (uint8_t)(x63 & UINT8_C(0xff)); - x67 = (x65 >> 8); - x68 = (uint8_t)(x65 & UINT8_C(0xff)); - x69 = (x67 >> 8); - x70 = (uint8_t)(x67 & UINT8_C(0xff)); - x71 = (x69 >> 8); - x72 = (uint8_t)(x69 & UINT8_C(0xff)); - x73 = (uint8_t)(x71 >> 8); - x74 = (uint8_t)(x71 & UINT8_C(0xff)); - x75 = (x73 + x48); - x76 = (x75 >> 8); - x77 = (uint8_t)(x75 & UINT8_C(0xff)); - x78 = (x76 >> 8); - x79 = (uint8_t)(x76 & UINT8_C(0xff)); - x80 = (x78 >> 8); - x81 = (uint8_t)(x78 & UINT8_C(0xff)); - x82 = (x80 >> 8); - x83 = (uint8_t)(x80 & UINT8_C(0xff)); - x84 = (x82 >> 8); - x85 = (uint8_t)(x82 & UINT8_C(0xff)); - x86 = (x84 >> 8); - x87 = (uint8_t)(x84 & UINT8_C(0xff)); - x88 = (uint8_t)(x86 >> 8); - x89 = (uint8_t)(x86 & UINT8_C(0xff)); - x90 = (x88 + x47); - x91 = (x90 >> 8); - x92 = (uint8_t)(x90 & UINT8_C(0xff)); - x93 = (x91 >> 8); - x94 = (uint8_t)(x91 & UINT8_C(0xff)); - x95 = (x93 >> 8); - x96 = (uint8_t)(x93 & UINT8_C(0xff)); - x97 = (x95 >> 8); - x98 = (uint8_t)(x95 & UINT8_C(0xff)); - x99 = (x97 >> 8); - x100 = (uint8_t)(x97 & UINT8_C(0xff)); - x101 = (uint8_t)(x99 >> 8); - x102 = (uint8_t)(x99 & UINT8_C(0xff)); - x103 = (x101 + x46); - x104 = (x103 >> 8); - x105 = (uint8_t)(x103 & UINT8_C(0xff)); - x106 = (x104 >> 8); - x107 = (uint8_t)(x104 & UINT8_C(0xff)); - x108 = (x106 >> 8); - x109 = (uint8_t)(x106 & UINT8_C(0xff)); - x110 = (x108 >> 8); - x111 = (uint8_t)(x108 & UINT8_C(0xff)); - x112 = (x110 >> 8); - x113 = (uint8_t)(x110 & UINT8_C(0xff)); - x114 = (uint8_t)(x112 >> 8); - x115 = (uint8_t)(x112 & UINT8_C(0xff)); - x116 = (uint8_t)(x114 & UINT8_C(0xff)); + x50 = (uint8_t)(x22 & UINT8_C(0xff)); + x51 = (x22 >> 8); + x52 = (uint8_t)(x51 & UINT8_C(0xff)); + x53 = (x51 >> 8); + x54 = (uint8_t)(x53 & UINT8_C(0xff)); + x55 = (x53 >> 8); + x56 = (uint8_t)(x55 & UINT8_C(0xff)); + x57 = (x55 >> 8); + x58 = (uint8_t)(x57 & UINT8_C(0xff)); + x59 = (x57 >> 8); + x60 = (uint8_t)(x59 & UINT8_C(0xff)); + x61 = (uint8_t)(x59 >> 8); + x62 = (x49 + (uint64_t)x61); + x63 = (uint8_t)(x62 & UINT8_C(0xff)); + x64 = (x62 >> 8); + x65 = (uint8_t)(x64 & UINT8_C(0xff)); + x66 = (x64 >> 8); + x67 = (uint8_t)(x66 & UINT8_C(0xff)); + x68 = (x66 >> 8); + x69 = (uint8_t)(x68 & UINT8_C(0xff)); + x70 = (x68 >> 8); + x71 = (uint8_t)(x70 & UINT8_C(0xff)); + x72 = (x70 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); + x74 = (uint8_t)(x72 >> 8); + x75 = (x48 + (uint64_t)x74); + x76 = (uint8_t)(x75 & UINT8_C(0xff)); + x77 = (x75 >> 8); + x78 = (uint8_t)(x77 & UINT8_C(0xff)); + x79 = (x77 >> 8); + x80 = (uint8_t)(x79 & UINT8_C(0xff)); + x81 = (x79 >> 8); + x82 = (uint8_t)(x81 & UINT8_C(0xff)); + x83 = (x81 >> 8); + x84 = (uint8_t)(x83 & UINT8_C(0xff)); + x85 = (x83 >> 8); + x86 = (uint8_t)(x85 & UINT8_C(0xff)); + x87 = (x85 >> 8); + x88 = (uint8_t)(x87 & UINT8_C(0xff)); + x89 = (uint8_t)(x87 >> 8); + x90 = (x47 + (uint64_t)x89); + x91 = (uint8_t)(x90 & UINT8_C(0xff)); + x92 = (x90 >> 8); + x93 = (uint8_t)(x92 & UINT8_C(0xff)); + x94 = (x92 >> 8); + x95 = (uint8_t)(x94 & UINT8_C(0xff)); + x96 = (x94 >> 8); + x97 = (uint8_t)(x96 & UINT8_C(0xff)); + x98 = (x96 >> 8); + x99 = (uint8_t)(x98 & UINT8_C(0xff)); + x100 = (x98 >> 8); + x101 = (uint8_t)(x100 & UINT8_C(0xff)); + x102 = (uint8_t)(x100 >> 8); + x103 = (x46 + (uint64_t)x102); + x104 = (uint8_t)(x103 & UINT8_C(0xff)); + x105 = (x103 >> 8); + x106 = (uint8_t)(x105 & UINT8_C(0xff)); + x107 = (x105 >> 8); + x108 = (uint8_t)(x107 & UINT8_C(0xff)); + x109 = (x107 >> 8); + x110 = (uint8_t)(x109 & UINT8_C(0xff)); + x111 = (x109 >> 8); + x112 = (uint8_t)(x111 & UINT8_C(0xff)); + x113 = (x111 >> 8); + x114 = (uint8_t)(x113 & UINT8_C(0xff)); + x115 = (uint8_t)(x113 >> 8); + x116 = (uint8_t)(x32 & UINT8_C(0xff)); x117 = (x32 >> 8); - x118 = (uint8_t)(x32 & UINT8_C(0xff)); + x118 = (uint8_t)(x117 & UINT8_C(0xff)); x119 = (x117 >> 8); - x120 = (uint8_t)(x117 & UINT8_C(0xff)); + x120 = (uint8_t)(x119 & UINT8_C(0xff)); x121 = (x119 >> 8); - x122 = (uint8_t)(x119 & UINT8_C(0xff)); + x122 = (uint8_t)(x121 & UINT8_C(0xff)); x123 = (x121 >> 8); - x124 = (uint8_t)(x121 & UINT8_C(0xff)); + x124 = (uint8_t)(x123 & UINT8_C(0xff)); x125 = (x123 >> 8); - x126 = (uint8_t)(x123 & UINT8_C(0xff)); + x126 = (uint8_t)(x125 & UINT8_C(0xff)); x127 = (uint8_t)(x125 >> 8); - x128 = (uint8_t)(x125 & UINT8_C(0xff)); - x129 = (x127 + x45); - x130 = (x129 >> 8); - x131 = (uint8_t)(x129 & UINT8_C(0xff)); + x128 = (x45 + (uint64_t)x127); + x129 = (uint8_t)(x128 & UINT8_C(0xff)); + x130 = (x128 >> 8); + x131 = (uint8_t)(x130 & UINT8_C(0xff)); x132 = (x130 >> 8); - x133 = (uint8_t)(x130 & UINT8_C(0xff)); + x133 = (uint8_t)(x132 & UINT8_C(0xff)); x134 = (x132 >> 8); - x135 = (uint8_t)(x132 & UINT8_C(0xff)); + x135 = (uint8_t)(x134 & UINT8_C(0xff)); x136 = (x134 >> 8); - x137 = (uint8_t)(x134 & UINT8_C(0xff)); + x137 = (uint8_t)(x136 & UINT8_C(0xff)); x138 = (x136 >> 8); - x139 = (uint8_t)(x136 & UINT8_C(0xff)); + x139 = (uint8_t)(x138 & UINT8_C(0xff)); x140 = (uint8_t)(x138 >> 8); - x141 = (uint8_t)(x138 & UINT8_C(0xff)); - x142 = (x140 + x44); - x143 = (x142 >> 8); - x144 = (uint8_t)(x142 & UINT8_C(0xff)); + x141 = (x44 + (uint64_t)x140); + x142 = (uint8_t)(x141 & UINT8_C(0xff)); + x143 = (x141 >> 8); + x144 = (uint8_t)(x143 & UINT8_C(0xff)); x145 = (x143 >> 8); - x146 = (uint8_t)(x143 & UINT8_C(0xff)); + x146 = (uint8_t)(x145 & UINT8_C(0xff)); x147 = (x145 >> 8); - x148 = (uint8_t)(x145 & UINT8_C(0xff)); + x148 = (uint8_t)(x147 & UINT8_C(0xff)); x149 = (x147 >> 8); - x150 = (uint8_t)(x147 & UINT8_C(0xff)); + x150 = (uint8_t)(x149 & UINT8_C(0xff)); x151 = (x149 >> 8); - x152 = (uint8_t)(x149 & UINT8_C(0xff)); + x152 = (uint8_t)(x151 & UINT8_C(0xff)); x153 = (x151 >> 8); - x154 = (uint8_t)(x151 & UINT8_C(0xff)); + x154 = (uint8_t)(x153 & UINT8_C(0xff)); x155 = (uint8_t)(x153 >> 8); - x156 = (uint8_t)(x153 & UINT8_C(0xff)); - x157 = (x155 + x43); - x158 = (x157 >> 8); - x159 = (uint8_t)(x157 & UINT8_C(0xff)); + x156 = (x43 + (uint64_t)x155); + x157 = (uint8_t)(x156 & UINT8_C(0xff)); + x158 = (x156 >> 8); + x159 = (uint8_t)(x158 & UINT8_C(0xff)); x160 = (x158 >> 8); - x161 = (uint8_t)(x158 & UINT8_C(0xff)); + x161 = (uint8_t)(x160 & UINT8_C(0xff)); x162 = (x160 >> 8); - x163 = (uint8_t)(x160 & UINT8_C(0xff)); + x163 = (uint8_t)(x162 & UINT8_C(0xff)); x164 = (x162 >> 8); - x165 = (uint8_t)(x162 & UINT8_C(0xff)); + x165 = (uint8_t)(x164 & UINT8_C(0xff)); x166 = (x164 >> 8); - x167 = (uint8_t)(x164 & UINT8_C(0xff)); + x167 = (uint8_t)(x166 & UINT8_C(0xff)); x168 = (uint8_t)(x166 >> 8); - x169 = (uint8_t)(x166 & UINT8_C(0xff)); - x170 = (x168 + x42); - x171 = (x170 >> 8); - x172 = (uint8_t)(x170 & UINT8_C(0xff)); + x169 = (x42 + (uint64_t)x168); + x170 = (uint8_t)(x169 & UINT8_C(0xff)); + x171 = (x169 >> 8); + x172 = (uint8_t)(x171 & UINT8_C(0xff)); x173 = (x171 >> 8); - x174 = (uint8_t)(x171 & UINT8_C(0xff)); + x174 = (uint8_t)(x173 & UINT8_C(0xff)); x175 = (x173 >> 8); - x176 = (uint8_t)(x173 & UINT8_C(0xff)); + x176 = (uint8_t)(x175 & UINT8_C(0xff)); x177 = (x175 >> 8); - x178 = (uint8_t)(x175 & UINT8_C(0xff)); + x178 = (uint8_t)(x177 & UINT8_C(0xff)); x179 = (x177 >> 8); - x180 = (uint8_t)(x177 & UINT8_C(0xff)); + x180 = (uint8_t)(x179 & UINT8_C(0xff)); x181 = (uint8_t)(x179 >> 8); - x182 = (uint8_t)(x179 & UINT8_C(0xff)); - out1[0] = x51; - out1[1] = x53; - out1[2] = x55; - out1[3] = x57; - out1[4] = x59; - out1[5] = x61; - out1[6] = x64; - out1[7] = x66; - out1[8] = x68; - out1[9] = x70; - out1[10] = x72; - out1[11] = x74; - out1[12] = x77; - out1[13] = x79; - out1[14] = x81; - out1[15] = x83; - out1[16] = x85; - out1[17] = x87; - out1[18] = x89; - out1[19] = x92; - out1[20] = x94; - out1[21] = x96; - out1[22] = x98; - out1[23] = x100; - out1[24] = x102; - out1[25] = x105; - out1[26] = x107; - out1[27] = x109; - out1[28] = x111; - out1[29] = x113; - out1[30] = x115; - out1[31] = x116; - out1[32] = x118; - out1[33] = x120; - out1[34] = x122; - out1[35] = x124; - out1[36] = x126; - out1[37] = x128; - out1[38] = x131; - out1[39] = x133; - out1[40] = x135; - out1[41] = x137; - out1[42] = x139; - out1[43] = x141; - out1[44] = x144; - out1[45] = x146; - out1[46] = x148; - out1[47] = x150; - out1[48] = x152; - out1[49] = x154; - out1[50] = x156; - out1[51] = x159; - out1[52] = x161; - out1[53] = x163; - out1[54] = x165; - out1[55] = x167; - out1[56] = x169; - out1[57] = x172; - out1[58] = x174; - out1[59] = x176; - out1[60] = x178; - out1[61] = x180; - out1[62] = x182; + out1[0] = x50; + out1[1] = x52; + out1[2] = x54; + out1[3] = x56; + out1[4] = x58; + out1[5] = x60; + out1[6] = x63; + out1[7] = x65; + out1[8] = x67; + out1[9] = x69; + out1[10] = x71; + out1[11] = x73; + out1[12] = x76; + out1[13] = x78; + out1[14] = x80; + out1[15] = x82; + out1[16] = x84; + out1[17] = x86; + out1[18] = x88; + out1[19] = x91; + out1[20] = x93; + out1[21] = x95; + out1[22] = x97; + out1[23] = x99; + out1[24] = x101; + out1[25] = x104; + out1[26] = x106; + out1[27] = x108; + out1[28] = x110; + out1[29] = x112; + out1[30] = x114; + out1[31] = x115; + out1[32] = x116; + out1[33] = x118; + out1[34] = x120; + out1[35] = x122; + out1[36] = x124; + out1[37] = x126; + out1[38] = x129; + out1[39] = x131; + out1[40] = x133; + out1[41] = x135; + out1[42] = x137; + out1[43] = x139; + out1[44] = x142; + out1[45] = x144; + out1[46] = x146; + out1[47] = x148; + out1[48] = x150; + out1[49] = x152; + out1[50] = x154; + out1[51] = x157; + out1[52] = x159; + out1[53] = x161; + out1[54] = x163; + out1[55] = x165; + out1[56] = x167; + out1[57] = x170; + out1[58] = x172; + out1[59] = x174; + out1[60] = x176; + out1[61] = x178; + out1[62] = x180; out1[63] = x181; } @@ -1736,7 +1753,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_from_bytes( uint64_t out1[10], const uint8_t arg1[64]) { @@ -1805,40 +1822,83 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_from_bytes( uint64_t x63; uint8_t x64; uint64_t x65; - uint8_t x66; + uint64_t x66; uint64_t x67; uint64_t x68; uint64_t x69; uint64_t x70; uint64_t x71; - uint64_t x72; + uint8_t x72; uint64_t x73; uint64_t x74; uint64_t x75; uint64_t x76; uint64_t x77; - fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x78; + uint64_t x78; uint64_t x79; - uint64_t x80; - uint8_t x81; + fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x80; + uint64_t x81; uint64_t x82; uint64_t x83; - uint8_t x84; + uint64_t x84; uint64_t x85; uint64_t x86; uint64_t x87; - uint8_t x88; - uint64_t x89; + uint64_t x88; + uint8_t x89; uint64_t x90; - fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x91; + uint64_t x91; uint64_t x92; uint64_t x93; - uint8_t x94; + uint64_t x94; uint64_t x95; uint64_t x96; uint8_t x97; uint64_t x98; uint64_t x99; + uint64_t x100; + uint64_t x101; + uint64_t x102; + uint64_t x103; + uint64_t x104; + uint64_t x105; + uint64_t x106; + uint64_t x107; + uint64_t x108; + uint64_t x109; + uint64_t x110; + uint8_t x111; + uint64_t x112; + uint64_t x113; + uint64_t x114; + uint64_t x115; + uint64_t x116; + uint64_t x117; + uint64_t x118; + fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x119; + uint64_t x120; + uint64_t x121; + uint64_t x122; + uint64_t x123; + uint64_t x124; + uint64_t x125; + uint64_t x126; + uint64_t x127; + uint8_t x128; + uint64_t x129; + uint64_t x130; + uint64_t x131; + uint64_t x132; + uint64_t x133; + uint64_t x134; + uint64_t x135; + uint8_t x136; + uint64_t x137; + uint64_t x138; + uint64_t x139; + uint64_t x140; + uint64_t x141; + uint64_t x142; x1 = ((uint64_t)(arg1[63]) << 43); x2 = ((uint64_t)(arg1[62]) << 35); x3 = ((uint64_t)(arg1[61]) << 27); @@ -1903,51 +1963,94 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_from_bytes( x62 = ((uint64_t)(arg1[2]) << 16); x63 = ((uint64_t)(arg1[1]) << 8); x64 = (arg1[0]); - x65 = (x64 + (x63 + (x62 + (x61 + (x60 + (x59 + x58)))))); - x66 = (uint8_t)(x65 >> 52); - x67 = (x65 & UINT64_C(0xfffffffffffff)); - x68 = (x6 + (x5 + (x4 + (x3 + (x2 + x1))))); - x69 = (x12 + (x11 + (x10 + (x9 + (x8 + x7))))); - x70 = (x19 + (x18 + (x17 + (x16 + (x15 + (x14 + x13)))))); - x71 = (x25 + (x24 + (x23 + (x22 + (x21 + x20))))); - x72 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + x26)))))); - x73 = (x38 + (x37 + (x36 + (x35 + (x34 + x33))))); - x74 = (x44 + (x43 + (x42 + (x41 + (x40 + x39))))); - x75 = (x51 + (x50 + (x49 + (x48 + (x47 + (x46 + x45)))))); - x76 = (x57 + (x56 + (x55 + (x54 + (x53 + x52))))); - x77 = (x66 + x76); - x78 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x77 >> 51); - x79 = (x77 & UINT64_C(0x7ffffffffffff)); - x80 = (x78 + x75); - x81 = (uint8_t)(x80 >> 51); - x82 = (x80 & UINT64_C(0x7ffffffffffff)); - x83 = (x81 + x74); - x84 = (uint8_t)(x83 >> 51); - x85 = (x83 & UINT64_C(0x7ffffffffffff)); - x86 = (x84 + x73); - x87 = (x86 & UINT64_C(0x7ffffffffffff)); - x88 = (uint8_t)(x72 >> 52); - x89 = (x72 & UINT64_C(0xfffffffffffff)); - x90 = (x88 + x71); - x91 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x90 >> 51); - x92 = (x90 & UINT64_C(0x7ffffffffffff)); - x93 = (x91 + x70); - x94 = (uint8_t)(x93 >> 51); - x95 = (x93 & UINT64_C(0x7ffffffffffff)); - x96 = (x94 + x69); - x97 = (uint8_t)(x96 >> 51); - x98 = (x96 & UINT64_C(0x7ffffffffffff)); - x99 = (x97 + x68); - out1[0] = x67; + x65 = (x63 + (uint64_t)x64); + x66 = (x62 + x65); + x67 = (x61 + x66); + x68 = (x60 + x67); + x69 = (x59 + x68); + x70 = (x58 + x69); + x71 = (x70 & UINT64_C(0xfffffffffffff)); + x72 = (uint8_t)(x70 >> 52); + x73 = (x57 + (uint64_t)x72); + x74 = (x56 + x73); + x75 = (x55 + x74); + x76 = (x54 + x75); + x77 = (x53 + x76); + x78 = (x52 + x77); + x79 = (x78 & UINT64_C(0x7ffffffffffff)); + x80 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x78 >> 51); + x81 = (x51 + (uint64_t)x80); + x82 = (x50 + x81); + x83 = (x49 + x82); + x84 = (x48 + x83); + x85 = (x47 + x84); + x86 = (x46 + x85); + x87 = (x45 + x86); + x88 = (x87 & UINT64_C(0x7ffffffffffff)); + x89 = (uint8_t)(x87 >> 51); + x90 = (x44 + (uint64_t)x89); + x91 = (x43 + x90); + x92 = (x42 + x91); + x93 = (x41 + x92); + x94 = (x40 + x93); + x95 = (x39 + x94); + x96 = (x95 & UINT64_C(0x7ffffffffffff)); + x97 = (uint8_t)(x95 >> 51); + x98 = (x38 + (uint64_t)x97); + x99 = (x37 + x98); + x100 = (x36 + x99); + x101 = (x35 + x100); + x102 = (x34 + x101); + x103 = (x33 + x102); + x104 = (x31 + (uint64_t)x32); + x105 = (x30 + x104); + x106 = (x29 + x105); + x107 = (x28 + x106); + x108 = (x27 + x107); + x109 = (x26 + x108); + x110 = (x109 & UINT64_C(0xfffffffffffff)); + x111 = (uint8_t)(x109 >> 52); + x112 = (x25 + (uint64_t)x111); + x113 = (x24 + x112); + x114 = (x23 + x113); + x115 = (x22 + x114); + x116 = (x21 + x115); + x117 = (x20 + x116); + x118 = (x117 & UINT64_C(0x7ffffffffffff)); + x119 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x117 >> 51); + x120 = (x19 + (uint64_t)x119); + x121 = (x18 + x120); + x122 = (x17 + x121); + x123 = (x16 + x122); + x124 = (x15 + x123); + x125 = (x14 + x124); + x126 = (x13 + x125); + x127 = (x126 & UINT64_C(0x7ffffffffffff)); + x128 = (uint8_t)(x126 >> 51); + x129 = (x12 + (uint64_t)x128); + x130 = (x11 + x129); + x131 = (x10 + x130); + x132 = (x9 + x131); + x133 = (x8 + x132); + x134 = (x7 + x133); + x135 = (x134 & UINT64_C(0x7ffffffffffff)); + x136 = (uint8_t)(x134 >> 51); + x137 = (x6 + (uint64_t)x136); + x138 = (x5 + x137); + x139 = (x4 + x138); + x140 = (x3 + x139); + x141 = (x2 + x140); + x142 = (x1 + x141); + out1[0] = x71; out1[1] = x79; - out1[2] = x82; - out1[3] = x85; - out1[4] = x87; - out1[5] = x89; - out1[6] = x92; - out1[7] = x95; - out1[8] = x98; - out1[9] = x99; + out1[2] = x88; + out1[3] = x96; + out1[4] = x103; + out1[5] = x110; + out1[6] = x118; + out1[7] = x127; + out1[8] = x135; + out1[9] = x142; } /* END verbatim fiat code */ @@ -4277,7 +4380,7 @@ static void scalar_wnaf(int8_t out[513], const unsigned char in[64]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], @@ -4285,7 +4388,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[513] = {0}; int8_t bnaf[513] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4351,7 +4454,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[103] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4427,8 +4530,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[103] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -4489,6 +4592,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], const unsigned char a[64], const unsigned char b[64], const unsigned char inx[64], @@ -4504,6 +4613,11 @@ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64]) { pt_aff_t P; @@ -4514,6 +4628,12 @@ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64], const unsigned char inx[64], @@ -4531,8 +4651,13 @@ static void point_mul(unsigned char outx[64], unsigned char outy[64], #include +/* the zero field element */ static const unsigned char const_zb[64] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_512_paramSetA( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -4571,6 +4696,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_512_paramSetA(const EC_GROUP *group, EC_POINT *r, @@ -4610,6 +4739,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_512_paramSetA(const EC_GROUP *group, EC_POINT *r, @@ -4656,6 +4789,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETA_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -4704,18 +4841,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_tc26_gost_3410_2012_512_paramSetA 32 '(auto)' '2^512 - 569' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_tc26_gost_3410_2012_512_paramSetA 32 '(auto)' '2^512 - 569' */ /* curve description: id_tc26_gost_3410_2012_512_paramSetA */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ /* n = 23 (from "(auto)") */ /* s-c = 2^512 - [(1, 569)] (from "2^512 - 569") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 0, 1] */ /* eval z = z[0] + (z[1] << 23) + (z[2] << 45) + (z[3] << 67) + (z[4] << 90) + (z[5] << 112) + (z[6] << 134) + (z[7] << 156) + (z[8] << 179) + (z[9] << 201) + (z[10] << 223) + (z[11] << 245) + (z[12] << 0x10c) + (z[13] << 0x122) + (z[14] << 0x138) + (z[15] << 0x14e) + (z[16] << 0x165) + (z[17] << 0x17b) + (z[18] << 0x191) + (z[19] << 0x1a7) + (z[20] << 0x1be) + (z[21] << 0x1d4) + (z[22] << 0x1ea) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) + (z[55] << 0x1b8) + (z[56] << 0x1c0) + (z[57] << 0x1c8) + (z[58] << 0x1d0) + (z[59] << 0x1d8) + (z[60] << 0x1e0) + (z[61] << 0x1e8) + (z[62] << 0x1f0) + (z[63] << 0x1f8) */ +/* balance = [0xfffb8e, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe] */ #include typedef unsigned char fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1; @@ -4725,6 +4863,17 @@ typedef signed char fiat_id_tc26_gost_3410_2012_512_paramSetA_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETA_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_512_paramSetA_addcarryx_u22 is an addition with carry. * Postconditions: @@ -4858,7 +5007,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_512_paramSetA_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u32(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_512_paramSetA_value_barrier_u32((~x2)) & + arg2)); *out1 = x3; } @@ -4868,10 +5020,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_cmovznz_u32( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] - * arg2: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * arg1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] + * arg2: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_mul( uint32_t out1[23], const uint32_t arg1[23], const uint32_t arg2[23]) { @@ -6600,9 +6752,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * arg1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_square( uint32_t out1[23], const uint32_t arg1[23]) { @@ -7590,9 +7742,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * arg1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry( uint32_t out1[23], const uint32_t arg1[23]) { @@ -7725,10 +7877,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] - * arg2: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] + * arg2: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: - * out1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * out1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_add( uint32_t out1[23], const uint32_t arg1[23], const uint32_t arg2[23]) { @@ -7809,10 +7961,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] - * arg2: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] + * arg2: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: - * out1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * out1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_sub( uint32_t out1[23], const uint32_t arg1[23], const uint32_t arg2[23]) { @@ -7893,9 +8045,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: - * out1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * out1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_opp( uint32_t out1[23], const uint32_t arg1[23]) { @@ -8085,7 +8237,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..63] * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -8204,150 +8356,148 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( uint32_t x111; uint32_t x112; uint32_t x113; - uint32_t x114; - uint8_t x115; + uint8_t x114; + uint32_t x115; uint8_t x116; uint8_t x117; uint32_t x118; - uint32_t x119; - uint8_t x120; - uint32_t x121; - uint8_t x122; + uint8_t x119; + uint32_t x120; + uint8_t x121; + uint32_t x122; uint8_t x123; uint8_t x124; uint32_t x125; - uint32_t x126; - uint8_t x127; - uint32_t x128; - uint8_t x129; + uint8_t x126; + uint32_t x127; + uint8_t x128; + uint32_t x129; uint8_t x130; uint8_t x131; uint32_t x132; - uint32_t x133; - uint8_t x134; - uint32_t x135; - uint8_t x136; + uint8_t x133; + uint32_t x134; + uint8_t x135; + uint32_t x136; uint8_t x137; uint8_t x138; uint32_t x139; - uint32_t x140; - uint8_t x141; + uint8_t x140; + uint32_t x141; uint8_t x142; uint8_t x143; uint8_t x144; uint32_t x145; uint8_t x146; uint8_t x147; - uint8_t x148; - uint32_t x149; + uint32_t x148; + uint8_t x149; uint32_t x150; uint8_t x151; uint32_t x152; uint8_t x153; uint8_t x154; - uint8_t x155; - uint32_t x156; + uint32_t x155; + uint8_t x156; uint32_t x157; uint8_t x158; uint32_t x159; uint8_t x160; uint8_t x161; - uint8_t x162; - uint32_t x163; + uint32_t x162; + uint8_t x163; uint32_t x164; uint8_t x165; uint32_t x166; uint8_t x167; fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x168; - uint8_t x169; - uint32_t x170; + uint32_t x169; + uint8_t x170; uint32_t x171; uint8_t x172; uint8_t x173; - uint8_t x174; - uint32_t x175; + uint32_t x174; + uint8_t x175; uint32_t x176; uint8_t x177; uint32_t x178; uint8_t x179; uint8_t x180; - uint8_t x181; - uint32_t x182; + uint32_t x181; + uint8_t x182; uint32_t x183; uint8_t x184; uint32_t x185; uint8_t x186; uint8_t x187; - uint8_t x188; - uint32_t x189; + uint32_t x188; + uint8_t x189; uint32_t x190; uint8_t x191; uint32_t x192; uint8_t x193; uint8_t x194; - uint8_t x195; - uint32_t x196; + uint32_t x195; + uint8_t x196; uint32_t x197; uint8_t x198; uint8_t x199; uint8_t x200; - uint8_t x201; - uint32_t x202; + uint32_t x201; + uint8_t x202; uint8_t x203; - uint8_t x204; + uint32_t x204; uint8_t x205; uint32_t x206; - uint32_t x207; - uint8_t x208; - uint32_t x209; + uint8_t x207; + uint32_t x208; + uint8_t x209; uint8_t x210; - uint8_t x211; + uint32_t x211; uint8_t x212; uint32_t x213; - uint32_t x214; - uint8_t x215; - uint32_t x216; + uint8_t x214; + uint32_t x215; + uint8_t x216; uint8_t x217; - uint8_t x218; + uint32_t x218; uint8_t x219; uint32_t x220; - uint32_t x221; - uint8_t x222; - uint32_t x223; - uint8_t x224; - fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x225; + uint8_t x221; + uint32_t x222; + uint8_t x223; + fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x224; + uint32_t x225; uint8_t x226; uint32_t x227; - uint32_t x228; + uint8_t x228; uint8_t x229; - uint8_t x230; + uint32_t x230; uint8_t x231; uint32_t x232; - uint32_t x233; - uint8_t x234; - uint32_t x235; + uint8_t x233; + uint32_t x234; + uint8_t x235; uint8_t x236; - uint8_t x237; + uint32_t x237; uint8_t x238; uint32_t x239; - uint32_t x240; - uint8_t x241; - uint32_t x242; + uint8_t x240; + uint32_t x241; + uint8_t x242; uint8_t x243; - uint8_t x244; + uint32_t x244; uint8_t x245; uint32_t x246; - uint32_t x247; - uint8_t x248; - uint32_t x249; + uint8_t x247; + uint32_t x248; + uint8_t x249; uint8_t x250; - uint8_t x251; + uint32_t x251; uint8_t x252; uint32_t x253; - uint32_t x254; + uint8_t x254; uint8_t x255; - uint8_t x256; - uint8_t x257; fiat_id_tc26_gost_3410_2012_512_paramSetA_subborrowx_u23( &x1, &x2, 0x0, (arg1[0]), UINT32_C(0x7ffdc7)); fiat_id_tc26_gost_3410_2012_512_paramSetA_subborrowx_u22( @@ -8462,214 +8612,212 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( x111 = (x54 << 3); x112 = (x52 << 5); x113 = (x50 << 7); - x114 = (x48 >> 8); - x115 = (uint8_t)(x48 & UINT8_C(0xff)); - x116 = (uint8_t)(x114 >> 8); - x117 = (uint8_t)(x114 & UINT8_C(0xff)); - x118 = (x116 + x113); - x119 = (x118 >> 8); - x120 = (uint8_t)(x118 & UINT8_C(0xff)); - x121 = (x119 >> 8); - x122 = (uint8_t)(x119 & UINT8_C(0xff)); - x123 = (uint8_t)(x121 >> 8); - x124 = (uint8_t)(x121 & UINT8_C(0xff)); - x125 = (x123 + x112); - x126 = (x125 >> 8); - x127 = (uint8_t)(x125 & UINT8_C(0xff)); - x128 = (x126 >> 8); - x129 = (uint8_t)(x126 & UINT8_C(0xff)); - x130 = (uint8_t)(x128 >> 8); - x131 = (uint8_t)(x128 & UINT8_C(0xff)); - x132 = (x130 + x111); - x133 = (x132 >> 8); - x134 = (uint8_t)(x132 & UINT8_C(0xff)); - x135 = (x133 >> 8); - x136 = (uint8_t)(x133 & UINT8_C(0xff)); - x137 = (uint8_t)(x135 >> 8); - x138 = (uint8_t)(x135 & UINT8_C(0xff)); - x139 = (x137 + x110); - x140 = (x139 >> 8); - x141 = (uint8_t)(x139 & UINT8_C(0xff)); - x142 = (uint8_t)(x140 >> 8); - x143 = (uint8_t)(x140 & UINT8_C(0xff)); - x144 = (uint8_t)(x142 & UINT8_C(0xff)); + x114 = (uint8_t)(x48 & UINT8_C(0xff)); + x115 = (x48 >> 8); + x116 = (uint8_t)(x115 & UINT8_C(0xff)); + x117 = (uint8_t)(x115 >> 8); + x118 = (x113 + (uint32_t)x117); + x119 = (uint8_t)(x118 & UINT8_C(0xff)); + x120 = (x118 >> 8); + x121 = (uint8_t)(x120 & UINT8_C(0xff)); + x122 = (x120 >> 8); + x123 = (uint8_t)(x122 & UINT8_C(0xff)); + x124 = (uint8_t)(x122 >> 8); + x125 = (x112 + (uint32_t)x124); + x126 = (uint8_t)(x125 & UINT8_C(0xff)); + x127 = (x125 >> 8); + x128 = (uint8_t)(x127 & UINT8_C(0xff)); + x129 = (x127 >> 8); + x130 = (uint8_t)(x129 & UINT8_C(0xff)); + x131 = (uint8_t)(x129 >> 8); + x132 = (x111 + (uint32_t)x131); + x133 = (uint8_t)(x132 & UINT8_C(0xff)); + x134 = (x132 >> 8); + x135 = (uint8_t)(x134 & UINT8_C(0xff)); + x136 = (x134 >> 8); + x137 = (uint8_t)(x136 & UINT8_C(0xff)); + x138 = (uint8_t)(x136 >> 8); + x139 = (x110 + (uint32_t)x138); + x140 = (uint8_t)(x139 & UINT8_C(0xff)); + x141 = (x139 >> 8); + x142 = (uint8_t)(x141 & UINT8_C(0xff)); + x143 = (uint8_t)(x141 >> 8); + x144 = (uint8_t)(x58 & UINT8_C(0xff)); x145 = (x58 >> 8); - x146 = (uint8_t)(x58 & UINT8_C(0xff)); + x146 = (uint8_t)(x145 & UINT8_C(0xff)); x147 = (uint8_t)(x145 >> 8); - x148 = (uint8_t)(x145 & UINT8_C(0xff)); - x149 = (x147 + x109); - x150 = (x149 >> 8); - x151 = (uint8_t)(x149 & UINT8_C(0xff)); + x148 = (x109 + (uint32_t)x147); + x149 = (uint8_t)(x148 & UINT8_C(0xff)); + x150 = (x148 >> 8); + x151 = (uint8_t)(x150 & UINT8_C(0xff)); x152 = (x150 >> 8); - x153 = (uint8_t)(x150 & UINT8_C(0xff)); + x153 = (uint8_t)(x152 & UINT8_C(0xff)); x154 = (uint8_t)(x152 >> 8); - x155 = (uint8_t)(x152 & UINT8_C(0xff)); - x156 = (x154 + x108); - x157 = (x156 >> 8); - x158 = (uint8_t)(x156 & UINT8_C(0xff)); + x155 = (x108 + (uint32_t)x154); + x156 = (uint8_t)(x155 & UINT8_C(0xff)); + x157 = (x155 >> 8); + x158 = (uint8_t)(x157 & UINT8_C(0xff)); x159 = (x157 >> 8); - x160 = (uint8_t)(x157 & UINT8_C(0xff)); + x160 = (uint8_t)(x159 & UINT8_C(0xff)); x161 = (uint8_t)(x159 >> 8); - x162 = (uint8_t)(x159 & UINT8_C(0xff)); - x163 = (x161 + x107); - x164 = (x163 >> 8); - x165 = (uint8_t)(x163 & UINT8_C(0xff)); + x162 = (x107 + (uint32_t)x161); + x163 = (uint8_t)(x162 & UINT8_C(0xff)); + x164 = (x162 >> 8); + x165 = (uint8_t)(x164 & UINT8_C(0xff)); x166 = (x164 >> 8); - x167 = (uint8_t)(x164 & UINT8_C(0xff)); + x167 = (uint8_t)(x166 & UINT8_C(0xff)); x168 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x166 >> 8); - x169 = (uint8_t)(x166 & UINT8_C(0xff)); - x170 = (x168 + x106); - x171 = (x170 >> 8); - x172 = (uint8_t)(x170 & UINT8_C(0xff)); + x169 = (x106 + (uint32_t)x168); + x170 = (uint8_t)(x169 & UINT8_C(0xff)); + x171 = (x169 >> 8); + x172 = (uint8_t)(x171 & UINT8_C(0xff)); x173 = (uint8_t)(x171 >> 8); - x174 = (uint8_t)(x171 & UINT8_C(0xff)); - x175 = (x173 + x105); - x176 = (x175 >> 8); - x177 = (uint8_t)(x175 & UINT8_C(0xff)); + x174 = (x105 + (uint32_t)x173); + x175 = (uint8_t)(x174 & UINT8_C(0xff)); + x176 = (x174 >> 8); + x177 = (uint8_t)(x176 & UINT8_C(0xff)); x178 = (x176 >> 8); - x179 = (uint8_t)(x176 & UINT8_C(0xff)); + x179 = (uint8_t)(x178 & UINT8_C(0xff)); x180 = (uint8_t)(x178 >> 8); - x181 = (uint8_t)(x178 & UINT8_C(0xff)); - x182 = (x180 + x104); - x183 = (x182 >> 8); - x184 = (uint8_t)(x182 & UINT8_C(0xff)); + x181 = (x104 + (uint32_t)x180); + x182 = (uint8_t)(x181 & UINT8_C(0xff)); + x183 = (x181 >> 8); + x184 = (uint8_t)(x183 & UINT8_C(0xff)); x185 = (x183 >> 8); - x186 = (uint8_t)(x183 & UINT8_C(0xff)); + x186 = (uint8_t)(x185 & UINT8_C(0xff)); x187 = (uint8_t)(x185 >> 8); - x188 = (uint8_t)(x185 & UINT8_C(0xff)); - x189 = (x187 + x103); - x190 = (x189 >> 8); - x191 = (uint8_t)(x189 & UINT8_C(0xff)); + x188 = (x103 + (uint32_t)x187); + x189 = (uint8_t)(x188 & UINT8_C(0xff)); + x190 = (x188 >> 8); + x191 = (uint8_t)(x190 & UINT8_C(0xff)); x192 = (x190 >> 8); - x193 = (uint8_t)(x190 & UINT8_C(0xff)); + x193 = (uint8_t)(x192 & UINT8_C(0xff)); x194 = (uint8_t)(x192 >> 8); - x195 = (uint8_t)(x192 & UINT8_C(0xff)); - x196 = (x194 + x102); - x197 = (x196 >> 8); - x198 = (uint8_t)(x196 & UINT8_C(0xff)); + x195 = (x102 + (uint32_t)x194); + x196 = (uint8_t)(x195 & UINT8_C(0xff)); + x197 = (x195 >> 8); + x198 = (uint8_t)(x197 & UINT8_C(0xff)); x199 = (uint8_t)(x197 >> 8); - x200 = (uint8_t)(x197 & UINT8_C(0xff)); - x201 = (uint8_t)(x199 & UINT8_C(0xff)); - x202 = (x76 >> 8); - x203 = (uint8_t)(x76 & UINT8_C(0xff)); - x204 = (uint8_t)(x202 >> 8); - x205 = (uint8_t)(x202 & UINT8_C(0xff)); - x206 = (x204 + x101); - x207 = (x206 >> 8); - x208 = (uint8_t)(x206 & UINT8_C(0xff)); - x209 = (x207 >> 8); - x210 = (uint8_t)(x207 & UINT8_C(0xff)); - x211 = (uint8_t)(x209 >> 8); - x212 = (uint8_t)(x209 & UINT8_C(0xff)); - x213 = (x211 + x100); - x214 = (x213 >> 8); - x215 = (uint8_t)(x213 & UINT8_C(0xff)); - x216 = (x214 >> 8); - x217 = (uint8_t)(x214 & UINT8_C(0xff)); - x218 = (uint8_t)(x216 >> 8); - x219 = (uint8_t)(x216 & UINT8_C(0xff)); - x220 = (x218 + x99); - x221 = (x220 >> 8); - x222 = (uint8_t)(x220 & UINT8_C(0xff)); - x223 = (x221 >> 8); - x224 = (uint8_t)(x221 & UINT8_C(0xff)); - x225 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x223 >> 8); - x226 = (uint8_t)(x223 & UINT8_C(0xff)); - x227 = (x225 + x98); - x228 = (x227 >> 8); - x229 = (uint8_t)(x227 & UINT8_C(0xff)); - x230 = (uint8_t)(x228 >> 8); - x231 = (uint8_t)(x228 & UINT8_C(0xff)); - x232 = (x230 + x97); - x233 = (x232 >> 8); - x234 = (uint8_t)(x232 & UINT8_C(0xff)); - x235 = (x233 >> 8); - x236 = (uint8_t)(x233 & UINT8_C(0xff)); - x237 = (uint8_t)(x235 >> 8); - x238 = (uint8_t)(x235 & UINT8_C(0xff)); - x239 = (x237 + x96); - x240 = (x239 >> 8); - x241 = (uint8_t)(x239 & UINT8_C(0xff)); - x242 = (x240 >> 8); - x243 = (uint8_t)(x240 & UINT8_C(0xff)); - x244 = (uint8_t)(x242 >> 8); - x245 = (uint8_t)(x242 & UINT8_C(0xff)); - x246 = (x244 + x95); - x247 = (x246 >> 8); - x248 = (uint8_t)(x246 & UINT8_C(0xff)); - x249 = (x247 >> 8); - x250 = (uint8_t)(x247 & UINT8_C(0xff)); - x251 = (uint8_t)(x249 >> 8); - x252 = (uint8_t)(x249 & UINT8_C(0xff)); - x253 = (x251 + x94); - x254 = (x253 >> 8); - x255 = (uint8_t)(x253 & UINT8_C(0xff)); - x256 = (uint8_t)(x254 >> 8); - x257 = (uint8_t)(x254 & UINT8_C(0xff)); - out1[0] = x115; - out1[1] = x117; - out1[2] = x120; - out1[3] = x122; - out1[4] = x124; - out1[5] = x127; - out1[6] = x129; - out1[7] = x131; - out1[8] = x134; - out1[9] = x136; - out1[10] = x138; - out1[11] = x141; - out1[12] = x143; - out1[13] = x144; - out1[14] = x146; - out1[15] = x148; - out1[16] = x151; - out1[17] = x153; - out1[18] = x155; - out1[19] = x158; - out1[20] = x160; - out1[21] = x162; - out1[22] = x165; - out1[23] = x167; - out1[24] = x169; - out1[25] = x172; - out1[26] = x174; - out1[27] = x177; - out1[28] = x179; - out1[29] = x181; - out1[30] = x184; - out1[31] = x186; - out1[32] = x188; - out1[33] = x191; - out1[34] = x193; - out1[35] = x195; - out1[36] = x198; - out1[37] = x200; - out1[38] = x201; - out1[39] = x203; - out1[40] = x205; - out1[41] = x208; - out1[42] = x210; - out1[43] = x212; - out1[44] = x215; - out1[45] = x217; - out1[46] = x219; - out1[47] = x222; - out1[48] = x224; - out1[49] = x226; - out1[50] = x229; - out1[51] = x231; - out1[52] = x234; - out1[53] = x236; - out1[54] = x238; - out1[55] = x241; - out1[56] = x243; - out1[57] = x245; - out1[58] = x248; - out1[59] = x250; - out1[60] = x252; - out1[61] = x255; - out1[62] = x257; - out1[63] = x256; + x200 = (uint8_t)(x76 & UINT8_C(0xff)); + x201 = (x76 >> 8); + x202 = (uint8_t)(x201 & UINT8_C(0xff)); + x203 = (uint8_t)(x201 >> 8); + x204 = (x101 + (uint32_t)x203); + x205 = (uint8_t)(x204 & UINT8_C(0xff)); + x206 = (x204 >> 8); + x207 = (uint8_t)(x206 & UINT8_C(0xff)); + x208 = (x206 >> 8); + x209 = (uint8_t)(x208 & UINT8_C(0xff)); + x210 = (uint8_t)(x208 >> 8); + x211 = (x100 + (uint32_t)x210); + x212 = (uint8_t)(x211 & UINT8_C(0xff)); + x213 = (x211 >> 8); + x214 = (uint8_t)(x213 & UINT8_C(0xff)); + x215 = (x213 >> 8); + x216 = (uint8_t)(x215 & UINT8_C(0xff)); + x217 = (uint8_t)(x215 >> 8); + x218 = (x99 + (uint32_t)x217); + x219 = (uint8_t)(x218 & UINT8_C(0xff)); + x220 = (x218 >> 8); + x221 = (uint8_t)(x220 & UINT8_C(0xff)); + x222 = (x220 >> 8); + x223 = (uint8_t)(x222 & UINT8_C(0xff)); + x224 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x222 >> 8); + x225 = (x98 + (uint32_t)x224); + x226 = (uint8_t)(x225 & UINT8_C(0xff)); + x227 = (x225 >> 8); + x228 = (uint8_t)(x227 & UINT8_C(0xff)); + x229 = (uint8_t)(x227 >> 8); + x230 = (x97 + (uint32_t)x229); + x231 = (uint8_t)(x230 & UINT8_C(0xff)); + x232 = (x230 >> 8); + x233 = (uint8_t)(x232 & UINT8_C(0xff)); + x234 = (x232 >> 8); + x235 = (uint8_t)(x234 & UINT8_C(0xff)); + x236 = (uint8_t)(x234 >> 8); + x237 = (x96 + (uint32_t)x236); + x238 = (uint8_t)(x237 & UINT8_C(0xff)); + x239 = (x237 >> 8); + x240 = (uint8_t)(x239 & UINT8_C(0xff)); + x241 = (x239 >> 8); + x242 = (uint8_t)(x241 & UINT8_C(0xff)); + x243 = (uint8_t)(x241 >> 8); + x244 = (x95 + (uint32_t)x243); + x245 = (uint8_t)(x244 & UINT8_C(0xff)); + x246 = (x244 >> 8); + x247 = (uint8_t)(x246 & UINT8_C(0xff)); + x248 = (x246 >> 8); + x249 = (uint8_t)(x248 & UINT8_C(0xff)); + x250 = (uint8_t)(x248 >> 8); + x251 = (x94 + (uint32_t)x250); + x252 = (uint8_t)(x251 & UINT8_C(0xff)); + x253 = (x251 >> 8); + x254 = (uint8_t)(x253 & UINT8_C(0xff)); + x255 = (uint8_t)(x253 >> 8); + out1[0] = x114; + out1[1] = x116; + out1[2] = x119; + out1[3] = x121; + out1[4] = x123; + out1[5] = x126; + out1[6] = x128; + out1[7] = x130; + out1[8] = x133; + out1[9] = x135; + out1[10] = x137; + out1[11] = x140; + out1[12] = x142; + out1[13] = x143; + out1[14] = x144; + out1[15] = x146; + out1[16] = x149; + out1[17] = x151; + out1[18] = x153; + out1[19] = x156; + out1[20] = x158; + out1[21] = x160; + out1[22] = x163; + out1[23] = x165; + out1[24] = x167; + out1[25] = x170; + out1[26] = x172; + out1[27] = x175; + out1[28] = x177; + out1[29] = x179; + out1[30] = x182; + out1[31] = x184; + out1[32] = x186; + out1[33] = x189; + out1[34] = x191; + out1[35] = x193; + out1[36] = x196; + out1[37] = x198; + out1[38] = x199; + out1[39] = x200; + out1[40] = x202; + out1[41] = x205; + out1[42] = x207; + out1[43] = x209; + out1[44] = x212; + out1[45] = x214; + out1[46] = x216; + out1[47] = x219; + out1[48] = x221; + out1[49] = x223; + out1[50] = x226; + out1[51] = x228; + out1[52] = x231; + out1[53] = x233; + out1[54] = x235; + out1[55] = x238; + out1[56] = x240; + out1[57] = x242; + out1[58] = x245; + out1[59] = x247; + out1[60] = x249; + out1[61] = x252; + out1[62] = x254; + out1[63] = x255; } /* @@ -8680,7 +8828,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_from_bytes( uint32_t out1[23], const uint8_t arg1[64]) { @@ -8749,90 +8897,106 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_from_bytes( uint32_t x63; uint8_t x64; uint32_t x65; - fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x66; + uint32_t x66; uint32_t x67; - uint32_t x68; + fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x68; uint32_t x69; uint32_t x70; uint32_t x71; uint32_t x72; - uint32_t x73; + uint8_t x73; uint32_t x74; uint32_t x75; uint32_t x76; uint32_t x77; - uint32_t x78; + uint8_t x78; uint32_t x79; uint32_t x80; uint32_t x81; uint32_t x82; - uint32_t x83; + uint8_t x83; uint32_t x84; uint32_t x85; uint32_t x86; uint32_t x87; uint32_t x88; - uint32_t x89; + uint8_t x89; uint32_t x90; - uint8_t x91; + uint32_t x91; uint32_t x92; uint32_t x93; uint8_t x94; uint32_t x95; uint32_t x96; - uint8_t x97; + uint32_t x97; uint32_t x98; - uint32_t x99; + uint8_t x99; uint32_t x100; - uint8_t x101; + uint32_t x101; uint32_t x102; uint32_t x103; uint8_t x104; uint32_t x105; uint32_t x106; - uint8_t x107; - uint32_t x108; + uint32_t x107; + fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x108; uint32_t x109; - uint8_t x110; + uint32_t x110; uint32_t x111; uint32_t x112; - fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x113; + uint8_t x113; uint32_t x114; uint32_t x115; - uint8_t x116; + uint32_t x116; uint32_t x117; - uint32_t x118; - uint8_t x119; + uint8_t x118; + uint32_t x119; uint32_t x120; uint32_t x121; - uint8_t x122; - uint32_t x123; + uint32_t x122; + uint8_t x123; uint32_t x124; uint32_t x125; - uint8_t x126; + uint32_t x126; uint32_t x127; uint32_t x128; uint8_t x129; uint32_t x130; uint32_t x131; - uint8_t x132; + uint32_t x132; uint32_t x133; - uint32_t x134; - uint8_t x135; + uint8_t x134; + uint32_t x135; uint32_t x136; uint32_t x137; - fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x138; - uint32_t x139; + uint32_t x138; + uint8_t x139; uint32_t x140; - uint8_t x141; + uint32_t x141; uint32_t x142; uint32_t x143; uint8_t x144; uint32_t x145; uint32_t x146; - uint8_t x147; - uint32_t x148; + uint32_t x147; + fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1 x148; uint32_t x149; + uint32_t x150; + uint32_t x151; + uint32_t x152; + uint8_t x153; + uint32_t x154; + uint32_t x155; + uint32_t x156; + uint32_t x157; + uint8_t x158; + uint32_t x159; + uint32_t x160; + uint32_t x161; + uint32_t x162; + uint8_t x163; + uint32_t x164; + uint32_t x165; x1 = ((uint32_t)(arg1[63]) << 14); x2 = ((uint32_t)(arg1[62]) << 6); x3 = ((uint32_t)(arg1[61]) << 20); @@ -8897,114 +9061,130 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetA_from_bytes( x62 = ((uint32_t)(arg1[2]) << 16); x63 = ((uint32_t)(arg1[1]) << 8); x64 = (arg1[0]); - x65 = (x64 + (x63 + x62)); - x66 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x65 >> 23); - x67 = (x65 & UINT32_C(0x7fffff)); - x68 = (x2 + x1); - x69 = (x5 + (x4 + x3)); - x70 = (x8 + (x7 + x6)); - x71 = (x11 + (x10 + x9)); - x72 = (x13 + x12); - x73 = (x16 + (x15 + x14)); - x74 = (x19 + (x18 + x17)); - x75 = (x22 + (x21 + x20)); - x76 = (x25 + (x24 + x23)); - x77 = (x27 + x26); - x78 = (x30 + (x29 + x28)); - x79 = (x33 + (x32 + x31)); - x80 = (x36 + (x35 + x34)); - x81 = (x38 + x37); - x82 = (x41 + (x40 + x39)); - x83 = (x44 + (x43 + x42)); - x84 = (x47 + (x46 + x45)); - x85 = (x50 + (x49 + x48)); - x86 = (x52 + x51); - x87 = (x55 + (x54 + x53)); - x88 = (x58 + (x57 + x56)); - x89 = (x61 + (x60 + x59)); - x90 = (x66 + x89); - x91 = (uint8_t)(x90 >> 22); - x92 = (x90 & UINT32_C(0x3fffff)); - x93 = (x91 + x88); - x94 = (uint8_t)(x93 >> 22); - x95 = (x93 & UINT32_C(0x3fffff)); - x96 = (x94 + x87); - x97 = (uint8_t)(x96 >> 23); - x98 = (x96 & UINT32_C(0x7fffff)); - x99 = (x97 + x86); - x100 = (x99 & UINT32_C(0x3fffff)); - x101 = (uint8_t)(x85 >> 22); - x102 = (x85 & UINT32_C(0x3fffff)); - x103 = (x101 + x84); - x104 = (uint8_t)(x103 >> 22); - x105 = (x103 & UINT32_C(0x3fffff)); - x106 = (x104 + x83); - x107 = (uint8_t)(x106 >> 23); - x108 = (x106 & UINT32_C(0x7fffff)); - x109 = (x107 + x82); - x110 = (uint8_t)(x109 >> 22); - x111 = (x109 & UINT32_C(0x3fffff)); - x112 = (x110 + x81); - x113 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x112 >> 22); - x114 = (x112 & UINT32_C(0x3fffff)); - x115 = (x113 + x80); - x116 = (uint8_t)(x115 >> 22); - x117 = (x115 & UINT32_C(0x3fffff)); - x118 = (x116 + x79); - x119 = (uint8_t)(x118 >> 23); - x120 = (x118 & UINT32_C(0x7fffff)); - x121 = (x119 + x78); - x122 = (uint8_t)(x121 >> 22); - x123 = (x121 & UINT32_C(0x3fffff)); - x124 = (x122 + x77); - x125 = (x124 & UINT32_C(0x3fffff)); - x126 = (uint8_t)(x76 >> 22); - x127 = (x76 & UINT32_C(0x3fffff)); - x128 = (x126 + x75); - x129 = (uint8_t)(x128 >> 23); - x130 = (x128 & UINT32_C(0x7fffff)); - x131 = (x129 + x74); - x132 = (uint8_t)(x131 >> 22); - x133 = (x131 & UINT32_C(0x3fffff)); - x134 = (x132 + x73); - x135 = (uint8_t)(x134 >> 22); - x136 = (x134 & UINT32_C(0x3fffff)); - x137 = (x135 + x72); - x138 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x137 >> 22); - x139 = (x137 & UINT32_C(0x3fffff)); - x140 = (x138 + x71); - x141 = (uint8_t)(x140 >> 23); - x142 = (x140 & UINT32_C(0x7fffff)); - x143 = (x141 + x70); - x144 = (uint8_t)(x143 >> 22); - x145 = (x143 & UINT32_C(0x3fffff)); - x146 = (x144 + x69); - x147 = (uint8_t)(x146 >> 22); - x148 = (x146 & UINT32_C(0x3fffff)); - x149 = (x147 + x68); + x65 = (x63 + (uint32_t)x64); + x66 = (x62 + x65); + x67 = (x66 & UINT32_C(0x7fffff)); + x68 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x66 >> 23); + x69 = (x61 + (uint32_t)x68); + x70 = (x60 + x69); + x71 = (x59 + x70); + x72 = (x71 & UINT32_C(0x3fffff)); + x73 = (uint8_t)(x71 >> 22); + x74 = (x58 + (uint32_t)x73); + x75 = (x57 + x74); + x76 = (x56 + x75); + x77 = (x76 & UINT32_C(0x3fffff)); + x78 = (uint8_t)(x76 >> 22); + x79 = (x55 + (uint32_t)x78); + x80 = (x54 + x79); + x81 = (x53 + x80); + x82 = (x81 & UINT32_C(0x7fffff)); + x83 = (uint8_t)(x81 >> 23); + x84 = (x52 + (uint32_t)x83); + x85 = (x51 + x84); + x86 = (x49 + (uint32_t)x50); + x87 = (x48 + x86); + x88 = (x87 & UINT32_C(0x3fffff)); + x89 = (uint8_t)(x87 >> 22); + x90 = (x47 + (uint32_t)x89); + x91 = (x46 + x90); + x92 = (x45 + x91); + x93 = (x92 & UINT32_C(0x3fffff)); + x94 = (uint8_t)(x92 >> 22); + x95 = (x44 + (uint32_t)x94); + x96 = (x43 + x95); + x97 = (x42 + x96); + x98 = (x97 & UINT32_C(0x7fffff)); + x99 = (uint8_t)(x97 >> 23); + x100 = (x41 + (uint32_t)x99); + x101 = (x40 + x100); + x102 = (x39 + x101); + x103 = (x102 & UINT32_C(0x3fffff)); + x104 = (uint8_t)(x102 >> 22); + x105 = (x38 + (uint32_t)x104); + x106 = (x37 + x105); + x107 = (x106 & UINT32_C(0x3fffff)); + x108 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x106 >> 22); + x109 = (x36 + (uint32_t)x108); + x110 = (x35 + x109); + x111 = (x34 + x110); + x112 = (x111 & UINT32_C(0x3fffff)); + x113 = (uint8_t)(x111 >> 22); + x114 = (x33 + (uint32_t)x113); + x115 = (x32 + x114); + x116 = (x31 + x115); + x117 = (x116 & UINT32_C(0x7fffff)); + x118 = (uint8_t)(x116 >> 23); + x119 = (x30 + (uint32_t)x118); + x120 = (x29 + x119); + x121 = (x28 + x120); + x122 = (x121 & UINT32_C(0x3fffff)); + x123 = (uint8_t)(x121 >> 22); + x124 = (x27 + (uint32_t)x123); + x125 = (x26 + x124); + x126 = (x24 + (uint32_t)x25); + x127 = (x23 + x126); + x128 = (x127 & UINT32_C(0x3fffff)); + x129 = (uint8_t)(x127 >> 22); + x130 = (x22 + (uint32_t)x129); + x131 = (x21 + x130); + x132 = (x20 + x131); + x133 = (x132 & UINT32_C(0x7fffff)); + x134 = (uint8_t)(x132 >> 23); + x135 = (x19 + (uint32_t)x134); + x136 = (x18 + x135); + x137 = (x17 + x136); + x138 = (x137 & UINT32_C(0x3fffff)); + x139 = (uint8_t)(x137 >> 22); + x140 = (x16 + (uint32_t)x139); + x141 = (x15 + x140); + x142 = (x14 + x141); + x143 = (x142 & UINT32_C(0x3fffff)); + x144 = (uint8_t)(x142 >> 22); + x145 = (x13 + (uint32_t)x144); + x146 = (x12 + x145); + x147 = (x146 & UINT32_C(0x3fffff)); + x148 = (fiat_id_tc26_gost_3410_2012_512_paramSetA_uint1)(x146 >> 22); + x149 = (x11 + (uint32_t)x148); + x150 = (x10 + x149); + x151 = (x9 + x150); + x152 = (x151 & UINT32_C(0x7fffff)); + x153 = (uint8_t)(x151 >> 23); + x154 = (x8 + (uint32_t)x153); + x155 = (x7 + x154); + x156 = (x6 + x155); + x157 = (x156 & UINT32_C(0x3fffff)); + x158 = (uint8_t)(x156 >> 22); + x159 = (x5 + (uint32_t)x158); + x160 = (x4 + x159); + x161 = (x3 + x160); + x162 = (x161 & UINT32_C(0x3fffff)); + x163 = (uint8_t)(x161 >> 22); + x164 = (x2 + (uint32_t)x163); + x165 = (x1 + x164); out1[0] = x67; - out1[1] = x92; - out1[2] = x95; - out1[3] = x98; - out1[4] = x100; - out1[5] = x102; - out1[6] = x105; - out1[7] = x108; - out1[8] = x111; - out1[9] = x114; - out1[10] = x117; - out1[11] = x120; - out1[12] = x123; + out1[1] = x72; + out1[2] = x77; + out1[3] = x82; + out1[4] = x85; + out1[5] = x88; + out1[6] = x93; + out1[7] = x98; + out1[8] = x103; + out1[9] = x107; + out1[10] = x112; + out1[11] = x117; + out1[12] = x122; out1[13] = x125; - out1[14] = x127; - out1[15] = x130; - out1[16] = x133; - out1[17] = x136; - out1[18] = x139; - out1[19] = x142; - out1[20] = x145; - out1[21] = x148; - out1[22] = x149; + out1[14] = x128; + out1[15] = x133; + out1[16] = x138; + out1[17] = x143; + out1[18] = x147; + out1[19] = x152; + out1[20] = x157; + out1[21] = x162; + out1[22] = x165; } /* END verbatim fiat code */ @@ -12234,7 +12414,7 @@ static void scalar_wnaf(int8_t out[513], const unsigned char in[64]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], @@ -12242,7 +12422,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[513] = {0}; int8_t bnaf[513] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -12308,7 +12488,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[103] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -12384,8 +12564,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[103] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -12446,6 +12626,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { fiat_id_tc26_gost_3410_2012_512_paramSetA_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], const unsigned char a[64], const unsigned char b[64], const unsigned char inx[64], @@ -12461,6 +12647,11 @@ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64]) { pt_aff_t P; @@ -12471,6 +12662,12 @@ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetA_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64], const unsigned char inx[64], @@ -12488,8 +12685,13 @@ static void point_mul(unsigned char outx[64], unsigned char outy[64], #include +/* the zero field element */ static const unsigned char const_zb[64] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_512_paramSetA( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -12528,6 +12730,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_512_paramSetA(const EC_GROUP *group, EC_POINT *r, @@ -12567,6 +12773,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_512_paramSetA(const EC_GROUP *group, EC_POINT *r, diff --git a/ecp_id_tc26_gost_3410_2012_512_paramSetB.c b/ecp_id_tc26_gost_3410_2012_512_paramSetB.c index 83f2112..7b0f4d2 100644 --- a/ecp_id_tc26_gost_3410_2012_512_paramSetB.c +++ b/ecp_id_tc26_gost_3410_2012_512_paramSetB.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETB_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -73,7 +77,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_tc26_gost_3410_2012_512_paramSetB 64 '2^511 + 111' */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_tc26_gost_3410_2012_512_paramSetB 64 '2^511 + 111' */ /* curve description: id_tc26_gost_3410_2012_512_paramSetB */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ @@ -100,6 +104,17 @@ typedef unsigned __int128 fiat_id_tc26_gost_3410_2012_512_paramSetB_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETB_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_addcarryx_u64 is an addition with carry. * Postconditions: @@ -206,7 +221,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_512_paramSetB_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u64(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u64((~x2)) & + arg2)); *out1 = x3; } @@ -3786,12 +3804,11 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_montgomery( static void fiat_id_tc26_gost_3410_2012_512_paramSetB_nonzero( uint64_t *out1, const uint64_t arg1[8]) { uint64_t x1; - x1 = ((arg1[0]) | - ((arg1[1]) | - ((arg1[2]) | - ((arg1[3]) | - ((arg1[4]) | - ((arg1[5]) | ((arg1[6]) | ((arg1[7]) | (uint64_t)0x0)))))))); + x1 = + ((arg1[0]) | + ((arg1[1]) | + ((arg1[2]) | + ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); *out1 = x1; } @@ -3845,7 +3862,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_selectznz( } /* - * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -3866,18 +3883,18 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint64_t x6; uint64_t x7; uint64_t x8; - uint64_t x9; - uint8_t x10; - uint64_t x11; - uint8_t x12; - uint64_t x13; - uint8_t x14; - uint64_t x15; - uint8_t x16; - uint64_t x17; - uint8_t x18; - uint64_t x19; - uint8_t x20; + uint8_t x9; + uint64_t x10; + uint8_t x11; + uint64_t x12; + uint8_t x13; + uint64_t x14; + uint8_t x15; + uint64_t x16; + uint8_t x17; + uint64_t x18; + uint8_t x19; + uint64_t x20; uint8_t x21; uint8_t x22; uint8_t x23; @@ -3895,21 +3912,21 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint8_t x35; uint8_t x36; uint8_t x37; - uint8_t x38; - uint64_t x39; - uint8_t x40; - uint64_t x41; - uint8_t x42; - uint64_t x43; - uint8_t x44; - uint64_t x45; - uint8_t x46; - uint64_t x47; - uint8_t x48; - uint64_t x49; + uint64_t x38; + uint8_t x39; + uint64_t x40; + uint8_t x41; + uint64_t x42; + uint8_t x43; + uint64_t x44; + uint8_t x45; + uint64_t x46; + uint8_t x47; + uint64_t x48; + uint8_t x49; uint8_t x50; uint8_t x51; - uint8_t x52; + uint64_t x52; uint8_t x53; uint64_t x54; uint8_t x55; @@ -3921,25 +3938,25 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint8_t x61; uint64_t x62; uint8_t x63; - uint64_t x64; + uint8_t x64; uint8_t x65; - uint8_t x66; + uint64_t x66; uint8_t x67; - uint8_t x68; - uint64_t x69; - uint8_t x70; - uint64_t x71; - uint8_t x72; - uint64_t x73; - uint8_t x74; - uint64_t x75; - uint8_t x76; - uint64_t x77; + uint64_t x68; + uint8_t x69; + uint64_t x70; + uint8_t x71; + uint64_t x72; + uint8_t x73; + uint64_t x74; + uint8_t x75; + uint64_t x76; + uint8_t x77; uint8_t x78; - uint64_t x79; - uint8_t x80; + uint8_t x79; + uint64_t x80; uint8_t x81; - uint8_t x82; + uint64_t x82; uint8_t x83; uint64_t x84; uint8_t x85; @@ -3949,27 +3966,27 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint8_t x89; uint64_t x90; uint8_t x91; - uint64_t x92; + uint8_t x92; uint8_t x93; uint64_t x94; uint8_t x95; - uint8_t x96; + uint64_t x96; uint8_t x97; - uint8_t x98; - uint64_t x99; - uint8_t x100; - uint64_t x101; - uint8_t x102; - uint64_t x103; - uint8_t x104; - uint64_t x105; + uint64_t x98; + uint8_t x99; + uint64_t x100; + uint8_t x101; + uint64_t x102; + uint8_t x103; + uint64_t x104; + uint8_t x105; uint8_t x106; - uint64_t x107; - uint8_t x108; - uint64_t x109; - uint8_t x110; + uint8_t x107; + uint64_t x108; + uint8_t x109; + uint64_t x110; uint8_t x111; - uint8_t x112; + uint64_t x112; uint8_t x113; uint64_t x114; uint8_t x115; @@ -3977,14 +3994,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint8_t x117; uint64_t x118; uint8_t x119; - uint64_t x120; - uint8_t x121; - uint64_t x122; - uint8_t x123; - uint64_t x124; - uint8_t x125; - uint8_t x126; - uint8_t x127; + uint8_t x120; x1 = (arg1[7]); x2 = (arg1[6]); x3 = (arg1[5]); @@ -3993,193 +4003,186 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( x6 = (arg1[2]); x7 = (arg1[1]); x8 = (arg1[0]); - x9 = (x8 >> 8); - x10 = (uint8_t)(x8 & UINT8_C(0xff)); - x11 = (x9 >> 8); - x12 = (uint8_t)(x9 & UINT8_C(0xff)); - x13 = (x11 >> 8); - x14 = (uint8_t)(x11 & UINT8_C(0xff)); - x15 = (x13 >> 8); - x16 = (uint8_t)(x13 & UINT8_C(0xff)); - x17 = (x15 >> 8); - x18 = (uint8_t)(x15 & UINT8_C(0xff)); - x19 = (x17 >> 8); - x20 = (uint8_t)(x17 & UINT8_C(0xff)); - x21 = (uint8_t)(x19 >> 8); - x22 = (uint8_t)(x19 & UINT8_C(0xff)); - x23 = (uint8_t)(x21 & UINT8_C(0xff)); + x9 = (uint8_t)(x8 & UINT8_C(0xff)); + x10 = (x8 >> 8); + x11 = (uint8_t)(x10 & UINT8_C(0xff)); + x12 = (x10 >> 8); + x13 = (uint8_t)(x12 & UINT8_C(0xff)); + x14 = (x12 >> 8); + x15 = (uint8_t)(x14 & UINT8_C(0xff)); + x16 = (x14 >> 8); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); + x18 = (x16 >> 8); + x19 = (uint8_t)(x18 & UINT8_C(0xff)); + x20 = (x18 >> 8); + x21 = (uint8_t)(x20 & UINT8_C(0xff)); + x22 = (uint8_t)(x20 >> 8); + x23 = (uint8_t)(x7 & UINT8_C(0xff)); x24 = (x7 >> 8); - x25 = (uint8_t)(x7 & UINT8_C(0xff)); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); x26 = (x24 >> 8); - x27 = (uint8_t)(x24 & UINT8_C(0xff)); + x27 = (uint8_t)(x26 & UINT8_C(0xff)); x28 = (x26 >> 8); - x29 = (uint8_t)(x26 & UINT8_C(0xff)); + x29 = (uint8_t)(x28 & UINT8_C(0xff)); x30 = (x28 >> 8); - x31 = (uint8_t)(x28 & UINT8_C(0xff)); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); x32 = (x30 >> 8); - x33 = (uint8_t)(x30 & UINT8_C(0xff)); + x33 = (uint8_t)(x32 & UINT8_C(0xff)); x34 = (x32 >> 8); - x35 = (uint8_t)(x32 & UINT8_C(0xff)); + x35 = (uint8_t)(x34 & UINT8_C(0xff)); x36 = (uint8_t)(x34 >> 8); - x37 = (uint8_t)(x34 & UINT8_C(0xff)); - x38 = (uint8_t)(x36 & UINT8_C(0xff)); - x39 = (x6 >> 8); - x40 = (uint8_t)(x6 & UINT8_C(0xff)); - x41 = (x39 >> 8); - x42 = (uint8_t)(x39 & UINT8_C(0xff)); - x43 = (x41 >> 8); - x44 = (uint8_t)(x41 & UINT8_C(0xff)); - x45 = (x43 >> 8); - x46 = (uint8_t)(x43 & UINT8_C(0xff)); - x47 = (x45 >> 8); - x48 = (uint8_t)(x45 & UINT8_C(0xff)); - x49 = (x47 >> 8); - x50 = (uint8_t)(x47 & UINT8_C(0xff)); - x51 = (uint8_t)(x49 >> 8); - x52 = (uint8_t)(x49 & UINT8_C(0xff)); - x53 = (uint8_t)(x51 & UINT8_C(0xff)); - x54 = (x5 >> 8); - x55 = (uint8_t)(x5 & UINT8_C(0xff)); + x37 = (uint8_t)(x6 & UINT8_C(0xff)); + x38 = (x6 >> 8); + x39 = (uint8_t)(x38 & UINT8_C(0xff)); + x40 = (x38 >> 8); + x41 = (uint8_t)(x40 & UINT8_C(0xff)); + x42 = (x40 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (x42 >> 8); + x45 = (uint8_t)(x44 & UINT8_C(0xff)); + x46 = (x44 >> 8); + x47 = (uint8_t)(x46 & UINT8_C(0xff)); + x48 = (x46 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (uint8_t)(x48 >> 8); + x51 = (uint8_t)(x5 & UINT8_C(0xff)); + x52 = (x5 >> 8); + x53 = (uint8_t)(x52 & UINT8_C(0xff)); + x54 = (x52 >> 8); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); + x57 = (uint8_t)(x56 & UINT8_C(0xff)); x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); + x59 = (uint8_t)(x58 & UINT8_C(0xff)); x60 = (x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); + x61 = (uint8_t)(x60 & UINT8_C(0xff)); x62 = (x60 >> 8); - x63 = (uint8_t)(x60 & UINT8_C(0xff)); - x64 = (x62 >> 8); - x65 = (uint8_t)(x62 & UINT8_C(0xff)); - x66 = (uint8_t)(x64 >> 8); - x67 = (uint8_t)(x64 & UINT8_C(0xff)); - x68 = (uint8_t)(x66 & UINT8_C(0xff)); - x69 = (x4 >> 8); - x70 = (uint8_t)(x4 & UINT8_C(0xff)); - x71 = (x69 >> 8); - x72 = (uint8_t)(x69 & UINT8_C(0xff)); - x73 = (x71 >> 8); - x74 = (uint8_t)(x71 & UINT8_C(0xff)); - x75 = (x73 >> 8); - x76 = (uint8_t)(x73 & UINT8_C(0xff)); - x77 = (x75 >> 8); - x78 = (uint8_t)(x75 & UINT8_C(0xff)); - x79 = (x77 >> 8); - x80 = (uint8_t)(x77 & UINT8_C(0xff)); - x81 = (uint8_t)(x79 >> 8); - x82 = (uint8_t)(x79 & UINT8_C(0xff)); - x83 = (uint8_t)(x81 & UINT8_C(0xff)); - x84 = (x3 >> 8); - x85 = (uint8_t)(x3 & UINT8_C(0xff)); + x63 = (uint8_t)(x62 & UINT8_C(0xff)); + x64 = (uint8_t)(x62 >> 8); + x65 = (uint8_t)(x4 & UINT8_C(0xff)); + x66 = (x4 >> 8); + x67 = (uint8_t)(x66 & UINT8_C(0xff)); + x68 = (x66 >> 8); + x69 = (uint8_t)(x68 & UINT8_C(0xff)); + x70 = (x68 >> 8); + x71 = (uint8_t)(x70 & UINT8_C(0xff)); + x72 = (x70 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); + x74 = (x72 >> 8); + x75 = (uint8_t)(x74 & UINT8_C(0xff)); + x76 = (x74 >> 8); + x77 = (uint8_t)(x76 & UINT8_C(0xff)); + x78 = (uint8_t)(x76 >> 8); + x79 = (uint8_t)(x3 & UINT8_C(0xff)); + x80 = (x3 >> 8); + x81 = (uint8_t)(x80 & UINT8_C(0xff)); + x82 = (x80 >> 8); + x83 = (uint8_t)(x82 & UINT8_C(0xff)); + x84 = (x82 >> 8); + x85 = (uint8_t)(x84 & UINT8_C(0xff)); x86 = (x84 >> 8); - x87 = (uint8_t)(x84 & UINT8_C(0xff)); + x87 = (uint8_t)(x86 & UINT8_C(0xff)); x88 = (x86 >> 8); - x89 = (uint8_t)(x86 & UINT8_C(0xff)); + x89 = (uint8_t)(x88 & UINT8_C(0xff)); x90 = (x88 >> 8); - x91 = (uint8_t)(x88 & UINT8_C(0xff)); - x92 = (x90 >> 8); - x93 = (uint8_t)(x90 & UINT8_C(0xff)); - x94 = (x92 >> 8); - x95 = (uint8_t)(x92 & UINT8_C(0xff)); - x96 = (uint8_t)(x94 >> 8); - x97 = (uint8_t)(x94 & UINT8_C(0xff)); - x98 = (uint8_t)(x96 & UINT8_C(0xff)); - x99 = (x2 >> 8); - x100 = (uint8_t)(x2 & UINT8_C(0xff)); - x101 = (x99 >> 8); - x102 = (uint8_t)(x99 & UINT8_C(0xff)); - x103 = (x101 >> 8); - x104 = (uint8_t)(x101 & UINT8_C(0xff)); - x105 = (x103 >> 8); - x106 = (uint8_t)(x103 & UINT8_C(0xff)); - x107 = (x105 >> 8); - x108 = (uint8_t)(x105 & UINT8_C(0xff)); - x109 = (x107 >> 8); - x110 = (uint8_t)(x107 & UINT8_C(0xff)); - x111 = (uint8_t)(x109 >> 8); - x112 = (uint8_t)(x109 & UINT8_C(0xff)); - x113 = (uint8_t)(x111 & UINT8_C(0xff)); - x114 = (x1 >> 8); - x115 = (uint8_t)(x1 & UINT8_C(0xff)); + x91 = (uint8_t)(x90 & UINT8_C(0xff)); + x92 = (uint8_t)(x90 >> 8); + x93 = (uint8_t)(x2 & UINT8_C(0xff)); + x94 = (x2 >> 8); + x95 = (uint8_t)(x94 & UINT8_C(0xff)); + x96 = (x94 >> 8); + x97 = (uint8_t)(x96 & UINT8_C(0xff)); + x98 = (x96 >> 8); + x99 = (uint8_t)(x98 & UINT8_C(0xff)); + x100 = (x98 >> 8); + x101 = (uint8_t)(x100 & UINT8_C(0xff)); + x102 = (x100 >> 8); + x103 = (uint8_t)(x102 & UINT8_C(0xff)); + x104 = (x102 >> 8); + x105 = (uint8_t)(x104 & UINT8_C(0xff)); + x106 = (uint8_t)(x104 >> 8); + x107 = (uint8_t)(x1 & UINT8_C(0xff)); + x108 = (x1 >> 8); + x109 = (uint8_t)(x108 & UINT8_C(0xff)); + x110 = (x108 >> 8); + x111 = (uint8_t)(x110 & UINT8_C(0xff)); + x112 = (x110 >> 8); + x113 = (uint8_t)(x112 & UINT8_C(0xff)); + x114 = (x112 >> 8); + x115 = (uint8_t)(x114 & UINT8_C(0xff)); x116 = (x114 >> 8); - x117 = (uint8_t)(x114 & UINT8_C(0xff)); + x117 = (uint8_t)(x116 & UINT8_C(0xff)); x118 = (x116 >> 8); - x119 = (uint8_t)(x116 & UINT8_C(0xff)); - x120 = (x118 >> 8); - x121 = (uint8_t)(x118 & UINT8_C(0xff)); - x122 = (x120 >> 8); - x123 = (uint8_t)(x120 & UINT8_C(0xff)); - x124 = (x122 >> 8); - x125 = (uint8_t)(x122 & UINT8_C(0xff)); - x126 = (uint8_t)(x124 >> 8); - x127 = (uint8_t)(x124 & UINT8_C(0xff)); - out1[0] = x10; - out1[1] = x12; - out1[2] = x14; - out1[3] = x16; - out1[4] = x18; - out1[5] = x20; - out1[6] = x22; - out1[7] = x23; - out1[8] = x25; - out1[9] = x27; - out1[10] = x29; - out1[11] = x31; - out1[12] = x33; - out1[13] = x35; - out1[14] = x37; - out1[15] = x38; - out1[16] = x40; - out1[17] = x42; - out1[18] = x44; - out1[19] = x46; - out1[20] = x48; - out1[21] = x50; - out1[22] = x52; - out1[23] = x53; - out1[24] = x55; - out1[25] = x57; - out1[26] = x59; - out1[27] = x61; - out1[28] = x63; - out1[29] = x65; - out1[30] = x67; - out1[31] = x68; - out1[32] = x70; - out1[33] = x72; - out1[34] = x74; - out1[35] = x76; - out1[36] = x78; - out1[37] = x80; - out1[38] = x82; - out1[39] = x83; - out1[40] = x85; - out1[41] = x87; - out1[42] = x89; - out1[43] = x91; - out1[44] = x93; - out1[45] = x95; - out1[46] = x97; - out1[47] = x98; - out1[48] = x100; - out1[49] = x102; - out1[50] = x104; - out1[51] = x106; - out1[52] = x108; - out1[53] = x110; - out1[54] = x112; - out1[55] = x113; - out1[56] = x115; - out1[57] = x117; - out1[58] = x119; - out1[59] = x121; - out1[60] = x123; - out1[61] = x125; - out1[62] = x127; - out1[63] = x126; + x119 = (uint8_t)(x118 & UINT8_C(0xff)); + x120 = (uint8_t)(x118 >> 8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x15; + out1[4] = x17; + out1[5] = x19; + out1[6] = x21; + out1[7] = x22; + out1[8] = x23; + out1[9] = x25; + out1[10] = x27; + out1[11] = x29; + out1[12] = x31; + out1[13] = x33; + out1[14] = x35; + out1[15] = x36; + out1[16] = x37; + out1[17] = x39; + out1[18] = x41; + out1[19] = x43; + out1[20] = x45; + out1[21] = x47; + out1[22] = x49; + out1[23] = x50; + out1[24] = x51; + out1[25] = x53; + out1[26] = x55; + out1[27] = x57; + out1[28] = x59; + out1[29] = x61; + out1[30] = x63; + out1[31] = x64; + out1[32] = x65; + out1[33] = x67; + out1[34] = x69; + out1[35] = x71; + out1[36] = x73; + out1[37] = x75; + out1[38] = x77; + out1[39] = x78; + out1[40] = x79; + out1[41] = x81; + out1[42] = x83; + out1[43] = x85; + out1[44] = x87; + out1[45] = x89; + out1[46] = x91; + out1[47] = x92; + out1[48] = x93; + out1[49] = x95; + out1[50] = x97; + out1[51] = x99; + out1[52] = x101; + out1[53] = x103; + out1[54] = x105; + out1[55] = x106; + out1[56] = x107; + out1[57] = x109; + out1[58] = x111; + out1[59] = x113; + out1[60] = x115; + out1[61] = x117; + out1[62] = x119; + out1[63] = x120; } /* - * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -4272,6 +4275,47 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes( uint64_t x77; uint64_t x78; uint64_t x79; + uint64_t x80; + uint64_t x81; + uint64_t x82; + uint64_t x83; + uint64_t x84; + uint64_t x85; + uint64_t x86; + uint64_t x87; + uint64_t x88; + uint64_t x89; + uint64_t x90; + uint64_t x91; + uint64_t x92; + uint64_t x93; + uint64_t x94; + uint64_t x95; + uint64_t x96; + uint64_t x97; + uint64_t x98; + uint64_t x99; + uint64_t x100; + uint64_t x101; + uint64_t x102; + uint64_t x103; + uint64_t x104; + uint64_t x105; + uint64_t x106; + uint64_t x107; + uint64_t x108; + uint64_t x109; + uint64_t x110; + uint64_t x111; + uint64_t x112; + uint64_t x113; + uint64_t x114; + uint64_t x115; + uint64_t x116; + uint64_t x117; + uint64_t x118; + uint64_t x119; + uint64_t x120; x1 = ((uint64_t)(arg1[63]) << 56); x2 = ((uint64_t)(arg1[62]) << 48); x3 = ((uint64_t)(arg1[61]) << 40); @@ -4336,29 +4380,70 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes( x62 = ((uint64_t)(arg1[2]) << 16); x63 = ((uint64_t)(arg1[1]) << 8); x64 = (arg1[0]); - x65 = (x64 + (x63 + (x62 + (x61 + (x60 + (x59 + (x58 + x57))))))); - x66 = (x65 & UINT64_C(0xffffffffffffffff)); - x67 = (x8 + (x7 + (x6 + (x5 + (x4 + (x3 + (x2 + x1))))))); - x68 = (x16 + (x15 + (x14 + (x13 + (x12 + (x11 + (x10 + x9))))))); - x69 = (x24 + (x23 + (x22 + (x21 + (x20 + (x19 + (x18 + x17))))))); - x70 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + (x26 + x25))))))); - x71 = (x40 + (x39 + (x38 + (x37 + (x36 + (x35 + (x34 + x33))))))); - x72 = (x48 + (x47 + (x46 + (x45 + (x44 + (x43 + (x42 + x41))))))); - x73 = (x56 + (x55 + (x54 + (x53 + (x52 + (x51 + (x50 + x49))))))); - x74 = (x73 & UINT64_C(0xffffffffffffffff)); - x75 = (x72 & UINT64_C(0xffffffffffffffff)); - x76 = (x71 & UINT64_C(0xffffffffffffffff)); - x77 = (x70 & UINT64_C(0xffffffffffffffff)); - x78 = (x69 & UINT64_C(0xffffffffffffffff)); - x79 = (x68 & UINT64_C(0xffffffffffffffff)); - out1[0] = x66; - out1[1] = x74; - out1[2] = x75; - out1[3] = x76; - out1[4] = x77; - out1[5] = x78; - out1[6] = x79; - out1[7] = x67; + x65 = (x63 + (uint64_t)x64); + x66 = (x62 + x65); + x67 = (x61 + x66); + x68 = (x60 + x67); + x69 = (x59 + x68); + x70 = (x58 + x69); + x71 = (x57 + x70); + x72 = (x55 + (uint64_t)x56); + x73 = (x54 + x72); + x74 = (x53 + x73); + x75 = (x52 + x74); + x76 = (x51 + x75); + x77 = (x50 + x76); + x78 = (x49 + x77); + x79 = (x47 + (uint64_t)x48); + x80 = (x46 + x79); + x81 = (x45 + x80); + x82 = (x44 + x81); + x83 = (x43 + x82); + x84 = (x42 + x83); + x85 = (x41 + x84); + x86 = (x39 + (uint64_t)x40); + x87 = (x38 + x86); + x88 = (x37 + x87); + x89 = (x36 + x88); + x90 = (x35 + x89); + x91 = (x34 + x90); + x92 = (x33 + x91); + x93 = (x31 + (uint64_t)x32); + x94 = (x30 + x93); + x95 = (x29 + x94); + x96 = (x28 + x95); + x97 = (x27 + x96); + x98 = (x26 + x97); + x99 = (x25 + x98); + x100 = (x23 + (uint64_t)x24); + x101 = (x22 + x100); + x102 = (x21 + x101); + x103 = (x20 + x102); + x104 = (x19 + x103); + x105 = (x18 + x104); + x106 = (x17 + x105); + x107 = (x15 + (uint64_t)x16); + x108 = (x14 + x107); + x109 = (x13 + x108); + x110 = (x12 + x109); + x111 = (x11 + x110); + x112 = (x10 + x111); + x113 = (x9 + x112); + x114 = (x7 + (uint64_t)x8); + x115 = (x6 + x114); + x116 = (x5 + x115); + x117 = (x4 + x116); + x118 = (x3 + x117); + x119 = (x2 + x118); + x120 = (x1 + x119); + out1[0] = x71; + out1[1] = x78; + out1[2] = x85; + out1[3] = x92; + out1[4] = x99; + out1[5] = x106; + out1[6] = x113; + out1[7] = x120; } /* END verbatim fiat code */ @@ -6507,7 +6592,7 @@ static void scalar_wnaf(int8_t out[513], const unsigned char in[64]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], @@ -6515,7 +6600,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[513] = {0}; int8_t bnaf[513] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -6581,7 +6666,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[103] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -6657,8 +6742,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[103] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -6719,6 +6804,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { fiat_id_tc26_gost_3410_2012_512_paramSetB_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], const unsigned char a[64], const unsigned char b[64], const unsigned char inx[64], @@ -6738,6 +6829,11 @@ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64]) { pt_aff_t P; @@ -6750,6 +6846,12 @@ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64], const unsigned char inx[64], @@ -6771,8 +6873,13 @@ static void point_mul(unsigned char outx[64], unsigned char outy[64], #include +/* the zero field element */ static const unsigned char const_zb[64] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_512_paramSetB( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -6811,6 +6918,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_512_paramSetB(const EC_GROUP *group, EC_POINT *r, @@ -6850,6 +6961,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_512_paramSetB(const EC_GROUP *group, EC_POINT *r, @@ -6896,6 +7011,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETB_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -6937,7 +7056,7 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: word_by_word_montgomery --static id_tc26_gost_3410_2012_512_paramSetB 32 '2^511 + 111' */ +/* Autogenerated: word_by_word_montgomery --static --use-value-barrier id_tc26_gost_3410_2012_512_paramSetB 32 '2^511 + 111' */ /* curve description: id_tc26_gost_3410_2012_512_paramSetB */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ @@ -6962,6 +7081,17 @@ typedef signed char fiat_id_tc26_gost_3410_2012_512_paramSetB_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETB_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_addcarryx_u32 is an addition with carry. * Postconditions: @@ -7066,7 +7196,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_512_paramSetB_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u32(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_512_paramSetB_value_barrier_u32((~x2)) & + arg2)); *out1 = x3; } @@ -18238,22 +18371,20 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_montgomery( static void fiat_id_tc26_gost_3410_2012_512_paramSetB_nonzero( uint32_t *out1, const uint32_t arg1[16]) { uint32_t x1; - x1 = - ((arg1[0]) | - ((arg1[1]) | - ((arg1[2]) | - ((arg1[3]) | - ((arg1[4]) | - ((arg1[5]) | - ((arg1[6]) | - ((arg1[7]) | - ((arg1[8]) | - ((arg1[9]) | - ((arg1[10]) | - ((arg1[11]) | - ((arg1[12]) | - ((arg1[13]) | - ((arg1[14]) | ((arg1[15]) | (uint32_t)0x0)))))))))))))))); + x1 = ((arg1[0]) | + ((arg1[1]) | + ((arg1[2]) | + ((arg1[3]) | + ((arg1[4]) | + ((arg1[5]) | + ((arg1[6]) | + ((arg1[7]) | + ((arg1[8]) | + ((arg1[9]) | + ((arg1[10]) | + ((arg1[11]) | + ((arg1[12]) | + ((arg1[13]) | ((arg1[14]) | (arg1[15])))))))))))))))); *out1 = x1; } @@ -18339,7 +18470,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_selectznz( } /* - * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes serializes a field element in the Montgomery domain to bytes in little-endian order. + * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. * Preconditions: * 0 ≤ eval arg1 < m * Postconditions: @@ -18368,10 +18499,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint32_t x14; uint32_t x15; uint32_t x16; - uint32_t x17; - uint8_t x18; - uint32_t x19; - uint8_t x20; + uint8_t x17; + uint32_t x18; + uint8_t x19; + uint32_t x20; uint8_t x21; uint8_t x22; uint8_t x23; @@ -18381,39 +18512,39 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint8_t x27; uint8_t x28; uint8_t x29; - uint8_t x30; - uint32_t x31; - uint8_t x32; - uint32_t x33; + uint32_t x30; + uint8_t x31; + uint32_t x32; + uint8_t x33; uint8_t x34; uint8_t x35; - uint8_t x36; + uint32_t x36; uint8_t x37; uint32_t x38; uint8_t x39; - uint32_t x40; + uint8_t x40; uint8_t x41; - uint8_t x42; + uint32_t x42; uint8_t x43; - uint8_t x44; - uint32_t x45; + uint32_t x44; + uint8_t x45; uint8_t x46; - uint32_t x47; - uint8_t x48; + uint8_t x47; + uint32_t x48; uint8_t x49; - uint8_t x50; + uint32_t x50; uint8_t x51; - uint32_t x52; + uint8_t x52; uint8_t x53; uint32_t x54; uint8_t x55; - uint8_t x56; + uint32_t x56; uint8_t x57; uint8_t x58; - uint32_t x59; - uint8_t x60; - uint32_t x61; - uint8_t x62; + uint8_t x59; + uint32_t x60; + uint8_t x61; + uint32_t x62; uint8_t x63; uint8_t x64; uint8_t x65; @@ -18423,39 +18554,39 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint8_t x69; uint8_t x70; uint8_t x71; - uint8_t x72; - uint32_t x73; - uint8_t x74; - uint32_t x75; + uint32_t x72; + uint8_t x73; + uint32_t x74; + uint8_t x75; uint8_t x76; uint8_t x77; - uint8_t x78; + uint32_t x78; uint8_t x79; uint32_t x80; uint8_t x81; - uint32_t x82; + uint8_t x82; uint8_t x83; - uint8_t x84; + uint32_t x84; uint8_t x85; - uint8_t x86; - uint32_t x87; + uint32_t x86; + uint8_t x87; uint8_t x88; - uint32_t x89; - uint8_t x90; + uint8_t x89; + uint32_t x90; uint8_t x91; - uint8_t x92; + uint32_t x92; uint8_t x93; - uint32_t x94; + uint8_t x94; uint8_t x95; uint32_t x96; uint8_t x97; - uint8_t x98; + uint32_t x98; uint8_t x99; uint8_t x100; - uint32_t x101; - uint8_t x102; - uint32_t x103; - uint8_t x104; + uint8_t x101; + uint32_t x102; + uint8_t x103; + uint32_t x104; uint8_t x105; uint8_t x106; uint8_t x107; @@ -18464,21 +18595,6 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( uint32_t x110; uint8_t x111; uint8_t x112; - uint8_t x113; - uint8_t x114; - uint32_t x115; - uint8_t x116; - uint32_t x117; - uint8_t x118; - uint8_t x119; - uint8_t x120; - uint8_t x121; - uint32_t x122; - uint8_t x123; - uint32_t x124; - uint8_t x125; - uint8_t x126; - uint8_t x127; x1 = (arg1[15]); x2 = (arg1[14]); x3 = (arg1[13]); @@ -18495,185 +18611,170 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes( x14 = (arg1[2]); x15 = (arg1[1]); x16 = (arg1[0]); - x17 = (x16 >> 8); - x18 = (uint8_t)(x16 & UINT8_C(0xff)); - x19 = (x17 >> 8); - x20 = (uint8_t)(x17 & UINT8_C(0xff)); - x21 = (uint8_t)(x19 >> 8); - x22 = (uint8_t)(x19 & UINT8_C(0xff)); - x23 = (uint8_t)(x21 & UINT8_C(0xff)); + x17 = (uint8_t)(x16 & UINT8_C(0xff)); + x18 = (x16 >> 8); + x19 = (uint8_t)(x18 & UINT8_C(0xff)); + x20 = (x18 >> 8); + x21 = (uint8_t)(x20 & UINT8_C(0xff)); + x22 = (uint8_t)(x20 >> 8); + x23 = (uint8_t)(x15 & UINT8_C(0xff)); x24 = (x15 >> 8); - x25 = (uint8_t)(x15 & UINT8_C(0xff)); + x25 = (uint8_t)(x24 & UINT8_C(0xff)); x26 = (x24 >> 8); - x27 = (uint8_t)(x24 & UINT8_C(0xff)); + x27 = (uint8_t)(x26 & UINT8_C(0xff)); x28 = (uint8_t)(x26 >> 8); - x29 = (uint8_t)(x26 & UINT8_C(0xff)); - x30 = (uint8_t)(x28 & UINT8_C(0xff)); - x31 = (x14 >> 8); - x32 = (uint8_t)(x14 & UINT8_C(0xff)); - x33 = (x31 >> 8); - x34 = (uint8_t)(x31 & UINT8_C(0xff)); - x35 = (uint8_t)(x33 >> 8); - x36 = (uint8_t)(x33 & UINT8_C(0xff)); - x37 = (uint8_t)(x35 & UINT8_C(0xff)); - x38 = (x13 >> 8); - x39 = (uint8_t)(x13 & UINT8_C(0xff)); - x40 = (x38 >> 8); - x41 = (uint8_t)(x38 & UINT8_C(0xff)); - x42 = (uint8_t)(x40 >> 8); - x43 = (uint8_t)(x40 & UINT8_C(0xff)); - x44 = (uint8_t)(x42 & UINT8_C(0xff)); - x45 = (x12 >> 8); - x46 = (uint8_t)(x12 & UINT8_C(0xff)); - x47 = (x45 >> 8); - x48 = (uint8_t)(x45 & UINT8_C(0xff)); - x49 = (uint8_t)(x47 >> 8); - x50 = (uint8_t)(x47 & UINT8_C(0xff)); - x51 = (uint8_t)(x49 & UINT8_C(0xff)); - x52 = (x11 >> 8); - x53 = (uint8_t)(x11 & UINT8_C(0xff)); - x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); - x56 = (uint8_t)(x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); - x58 = (uint8_t)(x56 & UINT8_C(0xff)); - x59 = (x10 >> 8); - x60 = (uint8_t)(x10 & UINT8_C(0xff)); - x61 = (x59 >> 8); - x62 = (uint8_t)(x59 & UINT8_C(0xff)); - x63 = (uint8_t)(x61 >> 8); - x64 = (uint8_t)(x61 & UINT8_C(0xff)); - x65 = (uint8_t)(x63 & UINT8_C(0xff)); - x66 = (x9 >> 8); - x67 = (uint8_t)(x9 & UINT8_C(0xff)); + x29 = (uint8_t)(x14 & UINT8_C(0xff)); + x30 = (x14 >> 8); + x31 = (uint8_t)(x30 & UINT8_C(0xff)); + x32 = (x30 >> 8); + x33 = (uint8_t)(x32 & UINT8_C(0xff)); + x34 = (uint8_t)(x32 >> 8); + x35 = (uint8_t)(x13 & UINT8_C(0xff)); + x36 = (x13 >> 8); + x37 = (uint8_t)(x36 & UINT8_C(0xff)); + x38 = (x36 >> 8); + x39 = (uint8_t)(x38 & UINT8_C(0xff)); + x40 = (uint8_t)(x38 >> 8); + x41 = (uint8_t)(x12 & UINT8_C(0xff)); + x42 = (x12 >> 8); + x43 = (uint8_t)(x42 & UINT8_C(0xff)); + x44 = (x42 >> 8); + x45 = (uint8_t)(x44 & UINT8_C(0xff)); + x46 = (uint8_t)(x44 >> 8); + x47 = (uint8_t)(x11 & UINT8_C(0xff)); + x48 = (x11 >> 8); + x49 = (uint8_t)(x48 & UINT8_C(0xff)); + x50 = (x48 >> 8); + x51 = (uint8_t)(x50 & UINT8_C(0xff)); + x52 = (uint8_t)(x50 >> 8); + x53 = (uint8_t)(x10 & UINT8_C(0xff)); + x54 = (x10 >> 8); + x55 = (uint8_t)(x54 & UINT8_C(0xff)); + x56 = (x54 >> 8); + x57 = (uint8_t)(x56 & UINT8_C(0xff)); + x58 = (uint8_t)(x56 >> 8); + x59 = (uint8_t)(x9 & UINT8_C(0xff)); + x60 = (x9 >> 8); + x61 = (uint8_t)(x60 & UINT8_C(0xff)); + x62 = (x60 >> 8); + x63 = (uint8_t)(x62 & UINT8_C(0xff)); + x64 = (uint8_t)(x62 >> 8); + x65 = (uint8_t)(x8 & UINT8_C(0xff)); + x66 = (x8 >> 8); + x67 = (uint8_t)(x66 & UINT8_C(0xff)); x68 = (x66 >> 8); - x69 = (uint8_t)(x66 & UINT8_C(0xff)); + x69 = (uint8_t)(x68 & UINT8_C(0xff)); x70 = (uint8_t)(x68 >> 8); - x71 = (uint8_t)(x68 & UINT8_C(0xff)); - x72 = (uint8_t)(x70 & UINT8_C(0xff)); - x73 = (x8 >> 8); - x74 = (uint8_t)(x8 & UINT8_C(0xff)); - x75 = (x73 >> 8); - x76 = (uint8_t)(x73 & UINT8_C(0xff)); - x77 = (uint8_t)(x75 >> 8); - x78 = (uint8_t)(x75 & UINT8_C(0xff)); - x79 = (uint8_t)(x77 & UINT8_C(0xff)); - x80 = (x7 >> 8); - x81 = (uint8_t)(x7 & UINT8_C(0xff)); - x82 = (x80 >> 8); - x83 = (uint8_t)(x80 & UINT8_C(0xff)); - x84 = (uint8_t)(x82 >> 8); - x85 = (uint8_t)(x82 & UINT8_C(0xff)); - x86 = (uint8_t)(x84 & UINT8_C(0xff)); - x87 = (x6 >> 8); - x88 = (uint8_t)(x6 & UINT8_C(0xff)); - x89 = (x87 >> 8); - x90 = (uint8_t)(x87 & UINT8_C(0xff)); - x91 = (uint8_t)(x89 >> 8); - x92 = (uint8_t)(x89 & UINT8_C(0xff)); - x93 = (uint8_t)(x91 & UINT8_C(0xff)); - x94 = (x5 >> 8); - x95 = (uint8_t)(x5 & UINT8_C(0xff)); - x96 = (x94 >> 8); - x97 = (uint8_t)(x94 & UINT8_C(0xff)); - x98 = (uint8_t)(x96 >> 8); - x99 = (uint8_t)(x96 & UINT8_C(0xff)); - x100 = (uint8_t)(x98 & UINT8_C(0xff)); - x101 = (x4 >> 8); - x102 = (uint8_t)(x4 & UINT8_C(0xff)); - x103 = (x101 >> 8); - x104 = (uint8_t)(x101 & UINT8_C(0xff)); - x105 = (uint8_t)(x103 >> 8); - x106 = (uint8_t)(x103 & UINT8_C(0xff)); - x107 = (uint8_t)(x105 & UINT8_C(0xff)); - x108 = (x3 >> 8); - x109 = (uint8_t)(x3 & UINT8_C(0xff)); + x71 = (uint8_t)(x7 & UINT8_C(0xff)); + x72 = (x7 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); + x74 = (x72 >> 8); + x75 = (uint8_t)(x74 & UINT8_C(0xff)); + x76 = (uint8_t)(x74 >> 8); + x77 = (uint8_t)(x6 & UINT8_C(0xff)); + x78 = (x6 >> 8); + x79 = (uint8_t)(x78 & UINT8_C(0xff)); + x80 = (x78 >> 8); + x81 = (uint8_t)(x80 & UINT8_C(0xff)); + x82 = (uint8_t)(x80 >> 8); + x83 = (uint8_t)(x5 & UINT8_C(0xff)); + x84 = (x5 >> 8); + x85 = (uint8_t)(x84 & UINT8_C(0xff)); + x86 = (x84 >> 8); + x87 = (uint8_t)(x86 & UINT8_C(0xff)); + x88 = (uint8_t)(x86 >> 8); + x89 = (uint8_t)(x4 & UINT8_C(0xff)); + x90 = (x4 >> 8); + x91 = (uint8_t)(x90 & UINT8_C(0xff)); + x92 = (x90 >> 8); + x93 = (uint8_t)(x92 & UINT8_C(0xff)); + x94 = (uint8_t)(x92 >> 8); + x95 = (uint8_t)(x3 & UINT8_C(0xff)); + x96 = (x3 >> 8); + x97 = (uint8_t)(x96 & UINT8_C(0xff)); + x98 = (x96 >> 8); + x99 = (uint8_t)(x98 & UINT8_C(0xff)); + x100 = (uint8_t)(x98 >> 8); + x101 = (uint8_t)(x2 & UINT8_C(0xff)); + x102 = (x2 >> 8); + x103 = (uint8_t)(x102 & UINT8_C(0xff)); + x104 = (x102 >> 8); + x105 = (uint8_t)(x104 & UINT8_C(0xff)); + x106 = (uint8_t)(x104 >> 8); + x107 = (uint8_t)(x1 & UINT8_C(0xff)); + x108 = (x1 >> 8); + x109 = (uint8_t)(x108 & UINT8_C(0xff)); x110 = (x108 >> 8); - x111 = (uint8_t)(x108 & UINT8_C(0xff)); + x111 = (uint8_t)(x110 & UINT8_C(0xff)); x112 = (uint8_t)(x110 >> 8); - x113 = (uint8_t)(x110 & UINT8_C(0xff)); - x114 = (uint8_t)(x112 & UINT8_C(0xff)); - x115 = (x2 >> 8); - x116 = (uint8_t)(x2 & UINT8_C(0xff)); - x117 = (x115 >> 8); - x118 = (uint8_t)(x115 & UINT8_C(0xff)); - x119 = (uint8_t)(x117 >> 8); - x120 = (uint8_t)(x117 & UINT8_C(0xff)); - x121 = (uint8_t)(x119 & UINT8_C(0xff)); - x122 = (x1 >> 8); - x123 = (uint8_t)(x1 & UINT8_C(0xff)); - x124 = (x122 >> 8); - x125 = (uint8_t)(x122 & UINT8_C(0xff)); - x126 = (uint8_t)(x124 >> 8); - x127 = (uint8_t)(x124 & UINT8_C(0xff)); - out1[0] = x18; - out1[1] = x20; - out1[2] = x22; - out1[3] = x23; - out1[4] = x25; - out1[5] = x27; - out1[6] = x29; - out1[7] = x30; - out1[8] = x32; - out1[9] = x34; - out1[10] = x36; - out1[11] = x37; - out1[12] = x39; - out1[13] = x41; - out1[14] = x43; - out1[15] = x44; - out1[16] = x46; - out1[17] = x48; - out1[18] = x50; - out1[19] = x51; - out1[20] = x53; - out1[21] = x55; - out1[22] = x57; - out1[23] = x58; - out1[24] = x60; - out1[25] = x62; - out1[26] = x64; - out1[27] = x65; - out1[28] = x67; - out1[29] = x69; - out1[30] = x71; - out1[31] = x72; - out1[32] = x74; - out1[33] = x76; - out1[34] = x78; - out1[35] = x79; - out1[36] = x81; - out1[37] = x83; - out1[38] = x85; - out1[39] = x86; - out1[40] = x88; - out1[41] = x90; - out1[42] = x92; - out1[43] = x93; - out1[44] = x95; - out1[45] = x97; - out1[46] = x99; - out1[47] = x100; - out1[48] = x102; - out1[49] = x104; - out1[50] = x106; - out1[51] = x107; - out1[52] = x109; - out1[53] = x111; - out1[54] = x113; - out1[55] = x114; - out1[56] = x116; - out1[57] = x118; - out1[58] = x120; - out1[59] = x121; - out1[60] = x123; - out1[61] = x125; - out1[62] = x127; - out1[63] = x126; + out1[0] = x17; + out1[1] = x19; + out1[2] = x21; + out1[3] = x22; + out1[4] = x23; + out1[5] = x25; + out1[6] = x27; + out1[7] = x28; + out1[8] = x29; + out1[9] = x31; + out1[10] = x33; + out1[11] = x34; + out1[12] = x35; + out1[13] = x37; + out1[14] = x39; + out1[15] = x40; + out1[16] = x41; + out1[17] = x43; + out1[18] = x45; + out1[19] = x46; + out1[20] = x47; + out1[21] = x49; + out1[22] = x51; + out1[23] = x52; + out1[24] = x53; + out1[25] = x55; + out1[26] = x57; + out1[27] = x58; + out1[28] = x59; + out1[29] = x61; + out1[30] = x63; + out1[31] = x64; + out1[32] = x65; + out1[33] = x67; + out1[34] = x69; + out1[35] = x70; + out1[36] = x71; + out1[37] = x73; + out1[38] = x75; + out1[39] = x76; + out1[40] = x77; + out1[41] = x79; + out1[42] = x81; + out1[43] = x82; + out1[44] = x83; + out1[45] = x85; + out1[46] = x87; + out1[47] = x88; + out1[48] = x89; + out1[49] = x91; + out1[50] = x93; + out1[51] = x94; + out1[52] = x95; + out1[53] = x97; + out1[54] = x99; + out1[55] = x100; + out1[56] = x101; + out1[57] = x103; + out1[58] = x105; + out1[59] = x106; + out1[60] = x107; + out1[61] = x109; + out1[62] = x111; + out1[63] = x112; } /* - * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes deserializes a field element in the Montgomery domain from bytes in little-endian order. + * The function fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. * Preconditions: * 0 ≤ bytes_eval arg1 < m * Postconditions: @@ -18782,6 +18883,23 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes( uint32_t x93; uint32_t x94; uint32_t x95; + uint32_t x96; + uint32_t x97; + uint32_t x98; + uint32_t x99; + uint32_t x100; + uint32_t x101; + uint32_t x102; + uint32_t x103; + uint32_t x104; + uint32_t x105; + uint32_t x106; + uint32_t x107; + uint32_t x108; + uint32_t x109; + uint32_t x110; + uint32_t x111; + uint32_t x112; x1 = ((uint32_t)(arg1[63]) << 24); x2 = ((uint32_t)(arg1[62]) << 16); x3 = ((uint32_t)(arg1[61]) << 8); @@ -18846,53 +18964,70 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetB_from_bytes( x62 = ((uint32_t)(arg1[2]) << 16); x63 = ((uint32_t)(arg1[1]) << 8); x64 = (arg1[0]); - x65 = (x64 + (x63 + (x62 + x61))); - x66 = (x65 & UINT32_C(0xffffffff)); - x67 = (x4 + (x3 + (x2 + x1))); - x68 = (x8 + (x7 + (x6 + x5))); - x69 = (x12 + (x11 + (x10 + x9))); - x70 = (x16 + (x15 + (x14 + x13))); - x71 = (x20 + (x19 + (x18 + x17))); - x72 = (x24 + (x23 + (x22 + x21))); - x73 = (x28 + (x27 + (x26 + x25))); - x74 = (x32 + (x31 + (x30 + x29))); - x75 = (x36 + (x35 + (x34 + x33))); - x76 = (x40 + (x39 + (x38 + x37))); - x77 = (x44 + (x43 + (x42 + x41))); - x78 = (x48 + (x47 + (x46 + x45))); - x79 = (x52 + (x51 + (x50 + x49))); - x80 = (x56 + (x55 + (x54 + x53))); - x81 = (x60 + (x59 + (x58 + x57))); - x82 = (x81 & UINT32_C(0xffffffff)); - x83 = (x80 & UINT32_C(0xffffffff)); - x84 = (x79 & UINT32_C(0xffffffff)); - x85 = (x78 & UINT32_C(0xffffffff)); - x86 = (x77 & UINT32_C(0xffffffff)); - x87 = (x76 & UINT32_C(0xffffffff)); - x88 = (x75 & UINT32_C(0xffffffff)); - x89 = (x74 & UINT32_C(0xffffffff)); - x90 = (x73 & UINT32_C(0xffffffff)); - x91 = (x72 & UINT32_C(0xffffffff)); - x92 = (x71 & UINT32_C(0xffffffff)); - x93 = (x70 & UINT32_C(0xffffffff)); - x94 = (x69 & UINT32_C(0xffffffff)); - x95 = (x68 & UINT32_C(0xffffffff)); - out1[0] = x66; - out1[1] = x82; - out1[2] = x83; - out1[3] = x84; - out1[4] = x85; - out1[5] = x86; - out1[6] = x87; + x65 = (x63 + (uint32_t)x64); + x66 = (x62 + x65); + x67 = (x61 + x66); + x68 = (x59 + (uint32_t)x60); + x69 = (x58 + x68); + x70 = (x57 + x69); + x71 = (x55 + (uint32_t)x56); + x72 = (x54 + x71); + x73 = (x53 + x72); + x74 = (x51 + (uint32_t)x52); + x75 = (x50 + x74); + x76 = (x49 + x75); + x77 = (x47 + (uint32_t)x48); + x78 = (x46 + x77); + x79 = (x45 + x78); + x80 = (x43 + (uint32_t)x44); + x81 = (x42 + x80); + x82 = (x41 + x81); + x83 = (x39 + (uint32_t)x40); + x84 = (x38 + x83); + x85 = (x37 + x84); + x86 = (x35 + (uint32_t)x36); + x87 = (x34 + x86); + x88 = (x33 + x87); + x89 = (x31 + (uint32_t)x32); + x90 = (x30 + x89); + x91 = (x29 + x90); + x92 = (x27 + (uint32_t)x28); + x93 = (x26 + x92); + x94 = (x25 + x93); + x95 = (x23 + (uint32_t)x24); + x96 = (x22 + x95); + x97 = (x21 + x96); + x98 = (x19 + (uint32_t)x20); + x99 = (x18 + x98); + x100 = (x17 + x99); + x101 = (x15 + (uint32_t)x16); + x102 = (x14 + x101); + x103 = (x13 + x102); + x104 = (x11 + (uint32_t)x12); + x105 = (x10 + x104); + x106 = (x9 + x105); + x107 = (x7 + (uint32_t)x8); + x108 = (x6 + x107); + x109 = (x5 + x108); + x110 = (x3 + (uint32_t)x4); + x111 = (x2 + x110); + x112 = (x1 + x111); + out1[0] = x67; + out1[1] = x70; + out1[2] = x73; + out1[3] = x76; + out1[4] = x79; + out1[5] = x82; + out1[6] = x85; out1[7] = x88; - out1[8] = x89; - out1[9] = x90; - out1[10] = x91; - out1[11] = x92; - out1[12] = x93; - out1[13] = x94; - out1[14] = x95; - out1[15] = x67; + out1[8] = x91; + out1[9] = x94; + out1[10] = x97; + out1[11] = x100; + out1[12] = x103; + out1[13] = x106; + out1[14] = x109; + out1[15] = x112; } /* END verbatim fiat code */ @@ -21941,7 +22076,7 @@ static void scalar_wnaf(int8_t out[513], const unsigned char in[64]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], @@ -21949,7 +22084,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[513] = {0}; int8_t bnaf[513] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -22015,7 +22150,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[103] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -22091,8 +22226,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[103] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -22153,6 +22288,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { fiat_id_tc26_gost_3410_2012_512_paramSetB_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], const unsigned char a[64], const unsigned char b[64], const unsigned char inx[64], @@ -22172,6 +22313,11 @@ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64]) { pt_aff_t P; @@ -22184,6 +22330,12 @@ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetB_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64], const unsigned char inx[64], @@ -22205,8 +22357,13 @@ static void point_mul(unsigned char outx[64], unsigned char outy[64], #include +/* the zero field element */ static const unsigned char const_zb[64] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_512_paramSetB( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -22245,6 +22402,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_512_paramSetB(const EC_GROUP *group, EC_POINT *r, @@ -22284,6 +22445,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_512_paramSetB(const EC_GROUP *group, EC_POINT *r, diff --git a/ecp_id_tc26_gost_3410_2012_512_paramSetC.c b/ecp_id_tc26_gost_3410_2012_512_paramSetC.c index f5d379e..c239f9f 100644 --- a/ecp_id_tc26_gost_3410_2012_512_paramSetC.c +++ b/ecp_id_tc26_gost_3410_2012_512_paramSetC.c @@ -32,6 +32,10 @@ typedef uint64_t fe_t[LIMB_CNT]; typedef uint64_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETC_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -82,18 +86,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_tc26_gost_3410_2012_512_paramSetC 64 '(auto)' '2^512 - 569' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_tc26_gost_3410_2012_512_paramSetC 64 '(auto)' '2^512 - 569' */ /* curve description: id_tc26_gost_3410_2012_512_paramSetC */ /* machine_wordsize = 64 (from "64") */ /* requested operations: (all) */ /* n = 10 (from "(auto)") */ /* s-c = 2^512 - [(1, 569)] (from "2^512 - 569") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1] */ /* eval z = z[0] + (z[1] << 52) + (z[2] << 103) + (z[3] << 154) + (z[4] << 205) + (z[5] << 256) + (z[6] << 0x134) + (z[7] << 0x167) + (z[8] << 0x19a) + (z[9] << 0x1cd) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) + (z[55] << 0x1b8) + (z[56] << 0x1c0) + (z[57] << 0x1c8) + (z[58] << 0x1d0) + (z[59] << 0x1d8) + (z[60] << 0x1e0) + (z[61] << 0x1e8) + (z[62] << 0x1f0) + (z[63] << 0x1f8) */ +/* balance = [0x1ffffffffffb8e, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0x1ffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe] */ #include typedef unsigned char fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1; @@ -105,6 +110,17 @@ typedef unsigned __int128 fiat_id_tc26_gost_3410_2012_512_paramSetC_uint128; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETC_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint64_t +fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u64(uint64_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u64(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_512_paramSetC_addcarryx_u52 is an addition with carry. * Postconditions: @@ -238,7 +254,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_cmovznz_u64( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_512_paramSetC_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u64(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u64((~x2)) & + arg2)); *out1 = x3; } @@ -248,10 +267,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_cmovznz_u64( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] - * arg2: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] + * arg2: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_mul( uint64_t out1[10], const uint64_t arg1[10], const uint64_t arg2[10]) { @@ -742,9 +761,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_square( uint64_t out1[10], const uint64_t arg1[10]) { @@ -1032,9 +1051,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * arg1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry( uint64_t out1[10], const uint64_t arg1[10]) { @@ -1102,10 +1121,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_add( uint64_t out1[10], const uint64_t arg1[10], const uint64_t arg2[10]) { @@ -1147,10 +1166,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] - * arg2: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] + * arg2: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_sub( uint64_t out1[10], const uint64_t arg1[10], const uint64_t arg2[10]) { @@ -1192,9 +1211,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: - * out1: [[0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x34cccccccccccb], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664], [0x0 ~> 0x1a666666666664]] + * out1: [[0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x30000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_opp( uint64_t out1[10], const uint64_t arg1[10]) { @@ -1293,7 +1312,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..63] * * Input Bounds: - * arg1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * arg1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -1348,70 +1367,70 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( uint64_t x47; uint64_t x48; uint64_t x49; - uint64_t x50; - uint8_t x51; - uint64_t x52; - uint8_t x53; - uint64_t x54; - uint8_t x55; - uint64_t x56; - uint8_t x57; - uint64_t x58; - uint8_t x59; + uint8_t x50; + uint64_t x51; + uint8_t x52; + uint64_t x53; + uint8_t x54; + uint64_t x55; + uint8_t x56; + uint64_t x57; + uint8_t x58; + uint64_t x59; uint8_t x60; uint8_t x61; uint64_t x62; - uint64_t x63; - uint8_t x64; - uint64_t x65; - uint8_t x66; - uint64_t x67; - uint8_t x68; - uint64_t x69; - uint8_t x70; - uint64_t x71; - uint8_t x72; + uint8_t x63; + uint64_t x64; + uint8_t x65; + uint64_t x66; + uint8_t x67; + uint64_t x68; + uint8_t x69; + uint64_t x70; + uint8_t x71; + uint64_t x72; uint8_t x73; uint8_t x74; uint64_t x75; - uint64_t x76; - uint8_t x77; - uint64_t x78; - uint8_t x79; - uint64_t x80; - uint8_t x81; - uint64_t x82; - uint8_t x83; - uint64_t x84; - uint8_t x85; - uint64_t x86; - uint8_t x87; + uint8_t x76; + uint64_t x77; + uint8_t x78; + uint64_t x79; + uint8_t x80; + uint64_t x81; + uint8_t x82; + uint64_t x83; + uint8_t x84; + uint64_t x85; + uint8_t x86; + uint64_t x87; uint8_t x88; uint8_t x89; uint64_t x90; - uint64_t x91; - uint8_t x92; - uint64_t x93; - uint8_t x94; - uint64_t x95; - uint8_t x96; - uint64_t x97; - uint8_t x98; - uint64_t x99; - uint8_t x100; + uint8_t x91; + uint64_t x92; + uint8_t x93; + uint64_t x94; + uint8_t x95; + uint64_t x96; + uint8_t x97; + uint64_t x98; + uint8_t x99; + uint64_t x100; uint8_t x101; uint8_t x102; uint64_t x103; - uint64_t x104; - uint8_t x105; - uint64_t x106; - uint8_t x107; - uint64_t x108; - uint8_t x109; - uint64_t x110; - uint8_t x111; - uint64_t x112; - uint8_t x113; + uint8_t x104; + uint64_t x105; + uint8_t x106; + uint64_t x107; + uint8_t x108; + uint64_t x109; + uint8_t x110; + uint64_t x111; + uint8_t x112; + uint64_t x113; uint8_t x114; uint8_t x115; uint8_t x116; @@ -1426,8 +1445,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( uint64_t x125; uint8_t x126; uint8_t x127; - uint8_t x128; - uint64_t x129; + uint64_t x128; + uint8_t x129; uint64_t x130; uint8_t x131; uint64_t x132; @@ -1439,8 +1458,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( uint64_t x138; uint8_t x139; uint8_t x140; - uint8_t x141; - uint64_t x142; + uint64_t x141; + uint8_t x142; uint64_t x143; uint8_t x144; uint64_t x145; @@ -1454,8 +1473,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( uint64_t x153; uint8_t x154; uint8_t x155; - uint8_t x156; - uint64_t x157; + uint64_t x156; + uint8_t x157; uint64_t x158; uint8_t x159; uint64_t x160; @@ -1467,8 +1486,8 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( uint64_t x166; uint8_t x167; uint8_t x168; - uint8_t x169; - uint64_t x170; + uint64_t x169; + uint8_t x170; uint64_t x171; uint8_t x172; uint64_t x173; @@ -1480,7 +1499,6 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( uint64_t x179; uint8_t x180; uint8_t x181; - uint8_t x182; fiat_id_tc26_gost_3410_2012_512_paramSetC_subborrowx_u52( &x1, &x2, 0x0, (arg1[0]), UINT64_C(0xffffffffffdc7)); fiat_id_tc26_gost_3410_2012_512_paramSetC_subborrowx_u51( @@ -1531,202 +1549,201 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( x47 = (x28 << 2); x48 = (x26 << 7); x49 = (x24 << 4); - x50 = (x22 >> 8); - x51 = (uint8_t)(x22 & UINT8_C(0xff)); - x52 = (x50 >> 8); - x53 = (uint8_t)(x50 & UINT8_C(0xff)); - x54 = (x52 >> 8); - x55 = (uint8_t)(x52 & UINT8_C(0xff)); - x56 = (x54 >> 8); - x57 = (uint8_t)(x54 & UINT8_C(0xff)); - x58 = (x56 >> 8); - x59 = (uint8_t)(x56 & UINT8_C(0xff)); - x60 = (uint8_t)(x58 >> 8); - x61 = (uint8_t)(x58 & UINT8_C(0xff)); - x62 = (x60 + x49); - x63 = (x62 >> 8); - x64 = (uint8_t)(x62 & UINT8_C(0xff)); - x65 = (x63 >> 8); - x66 = (uint8_t)(x63 & UINT8_C(0xff)); - x67 = (x65 >> 8); - x68 = (uint8_t)(x65 & UINT8_C(0xff)); - x69 = (x67 >> 8); - x70 = (uint8_t)(x67 & UINT8_C(0xff)); - x71 = (x69 >> 8); - x72 = (uint8_t)(x69 & UINT8_C(0xff)); - x73 = (uint8_t)(x71 >> 8); - x74 = (uint8_t)(x71 & UINT8_C(0xff)); - x75 = (x73 + x48); - x76 = (x75 >> 8); - x77 = (uint8_t)(x75 & UINT8_C(0xff)); - x78 = (x76 >> 8); - x79 = (uint8_t)(x76 & UINT8_C(0xff)); - x80 = (x78 >> 8); - x81 = (uint8_t)(x78 & UINT8_C(0xff)); - x82 = (x80 >> 8); - x83 = (uint8_t)(x80 & UINT8_C(0xff)); - x84 = (x82 >> 8); - x85 = (uint8_t)(x82 & UINT8_C(0xff)); - x86 = (x84 >> 8); - x87 = (uint8_t)(x84 & UINT8_C(0xff)); - x88 = (uint8_t)(x86 >> 8); - x89 = (uint8_t)(x86 & UINT8_C(0xff)); - x90 = (x88 + x47); - x91 = (x90 >> 8); - x92 = (uint8_t)(x90 & UINT8_C(0xff)); - x93 = (x91 >> 8); - x94 = (uint8_t)(x91 & UINT8_C(0xff)); - x95 = (x93 >> 8); - x96 = (uint8_t)(x93 & UINT8_C(0xff)); - x97 = (x95 >> 8); - x98 = (uint8_t)(x95 & UINT8_C(0xff)); - x99 = (x97 >> 8); - x100 = (uint8_t)(x97 & UINT8_C(0xff)); - x101 = (uint8_t)(x99 >> 8); - x102 = (uint8_t)(x99 & UINT8_C(0xff)); - x103 = (x101 + x46); - x104 = (x103 >> 8); - x105 = (uint8_t)(x103 & UINT8_C(0xff)); - x106 = (x104 >> 8); - x107 = (uint8_t)(x104 & UINT8_C(0xff)); - x108 = (x106 >> 8); - x109 = (uint8_t)(x106 & UINT8_C(0xff)); - x110 = (x108 >> 8); - x111 = (uint8_t)(x108 & UINT8_C(0xff)); - x112 = (x110 >> 8); - x113 = (uint8_t)(x110 & UINT8_C(0xff)); - x114 = (uint8_t)(x112 >> 8); - x115 = (uint8_t)(x112 & UINT8_C(0xff)); - x116 = (uint8_t)(x114 & UINT8_C(0xff)); + x50 = (uint8_t)(x22 & UINT8_C(0xff)); + x51 = (x22 >> 8); + x52 = (uint8_t)(x51 & UINT8_C(0xff)); + x53 = (x51 >> 8); + x54 = (uint8_t)(x53 & UINT8_C(0xff)); + x55 = (x53 >> 8); + x56 = (uint8_t)(x55 & UINT8_C(0xff)); + x57 = (x55 >> 8); + x58 = (uint8_t)(x57 & UINT8_C(0xff)); + x59 = (x57 >> 8); + x60 = (uint8_t)(x59 & UINT8_C(0xff)); + x61 = (uint8_t)(x59 >> 8); + x62 = (x49 + (uint64_t)x61); + x63 = (uint8_t)(x62 & UINT8_C(0xff)); + x64 = (x62 >> 8); + x65 = (uint8_t)(x64 & UINT8_C(0xff)); + x66 = (x64 >> 8); + x67 = (uint8_t)(x66 & UINT8_C(0xff)); + x68 = (x66 >> 8); + x69 = (uint8_t)(x68 & UINT8_C(0xff)); + x70 = (x68 >> 8); + x71 = (uint8_t)(x70 & UINT8_C(0xff)); + x72 = (x70 >> 8); + x73 = (uint8_t)(x72 & UINT8_C(0xff)); + x74 = (uint8_t)(x72 >> 8); + x75 = (x48 + (uint64_t)x74); + x76 = (uint8_t)(x75 & UINT8_C(0xff)); + x77 = (x75 >> 8); + x78 = (uint8_t)(x77 & UINT8_C(0xff)); + x79 = (x77 >> 8); + x80 = (uint8_t)(x79 & UINT8_C(0xff)); + x81 = (x79 >> 8); + x82 = (uint8_t)(x81 & UINT8_C(0xff)); + x83 = (x81 >> 8); + x84 = (uint8_t)(x83 & UINT8_C(0xff)); + x85 = (x83 >> 8); + x86 = (uint8_t)(x85 & UINT8_C(0xff)); + x87 = (x85 >> 8); + x88 = (uint8_t)(x87 & UINT8_C(0xff)); + x89 = (uint8_t)(x87 >> 8); + x90 = (x47 + (uint64_t)x89); + x91 = (uint8_t)(x90 & UINT8_C(0xff)); + x92 = (x90 >> 8); + x93 = (uint8_t)(x92 & UINT8_C(0xff)); + x94 = (x92 >> 8); + x95 = (uint8_t)(x94 & UINT8_C(0xff)); + x96 = (x94 >> 8); + x97 = (uint8_t)(x96 & UINT8_C(0xff)); + x98 = (x96 >> 8); + x99 = (uint8_t)(x98 & UINT8_C(0xff)); + x100 = (x98 >> 8); + x101 = (uint8_t)(x100 & UINT8_C(0xff)); + x102 = (uint8_t)(x100 >> 8); + x103 = (x46 + (uint64_t)x102); + x104 = (uint8_t)(x103 & UINT8_C(0xff)); + x105 = (x103 >> 8); + x106 = (uint8_t)(x105 & UINT8_C(0xff)); + x107 = (x105 >> 8); + x108 = (uint8_t)(x107 & UINT8_C(0xff)); + x109 = (x107 >> 8); + x110 = (uint8_t)(x109 & UINT8_C(0xff)); + x111 = (x109 >> 8); + x112 = (uint8_t)(x111 & UINT8_C(0xff)); + x113 = (x111 >> 8); + x114 = (uint8_t)(x113 & UINT8_C(0xff)); + x115 = (uint8_t)(x113 >> 8); + x116 = (uint8_t)(x32 & UINT8_C(0xff)); x117 = (x32 >> 8); - x118 = (uint8_t)(x32 & UINT8_C(0xff)); + x118 = (uint8_t)(x117 & UINT8_C(0xff)); x119 = (x117 >> 8); - x120 = (uint8_t)(x117 & UINT8_C(0xff)); + x120 = (uint8_t)(x119 & UINT8_C(0xff)); x121 = (x119 >> 8); - x122 = (uint8_t)(x119 & UINT8_C(0xff)); + x122 = (uint8_t)(x121 & UINT8_C(0xff)); x123 = (x121 >> 8); - x124 = (uint8_t)(x121 & UINT8_C(0xff)); + x124 = (uint8_t)(x123 & UINT8_C(0xff)); x125 = (x123 >> 8); - x126 = (uint8_t)(x123 & UINT8_C(0xff)); + x126 = (uint8_t)(x125 & UINT8_C(0xff)); x127 = (uint8_t)(x125 >> 8); - x128 = (uint8_t)(x125 & UINT8_C(0xff)); - x129 = (x127 + x45); - x130 = (x129 >> 8); - x131 = (uint8_t)(x129 & UINT8_C(0xff)); + x128 = (x45 + (uint64_t)x127); + x129 = (uint8_t)(x128 & UINT8_C(0xff)); + x130 = (x128 >> 8); + x131 = (uint8_t)(x130 & UINT8_C(0xff)); x132 = (x130 >> 8); - x133 = (uint8_t)(x130 & UINT8_C(0xff)); + x133 = (uint8_t)(x132 & UINT8_C(0xff)); x134 = (x132 >> 8); - x135 = (uint8_t)(x132 & UINT8_C(0xff)); + x135 = (uint8_t)(x134 & UINT8_C(0xff)); x136 = (x134 >> 8); - x137 = (uint8_t)(x134 & UINT8_C(0xff)); + x137 = (uint8_t)(x136 & UINT8_C(0xff)); x138 = (x136 >> 8); - x139 = (uint8_t)(x136 & UINT8_C(0xff)); + x139 = (uint8_t)(x138 & UINT8_C(0xff)); x140 = (uint8_t)(x138 >> 8); - x141 = (uint8_t)(x138 & UINT8_C(0xff)); - x142 = (x140 + x44); - x143 = (x142 >> 8); - x144 = (uint8_t)(x142 & UINT8_C(0xff)); + x141 = (x44 + (uint64_t)x140); + x142 = (uint8_t)(x141 & UINT8_C(0xff)); + x143 = (x141 >> 8); + x144 = (uint8_t)(x143 & UINT8_C(0xff)); x145 = (x143 >> 8); - x146 = (uint8_t)(x143 & UINT8_C(0xff)); + x146 = (uint8_t)(x145 & UINT8_C(0xff)); x147 = (x145 >> 8); - x148 = (uint8_t)(x145 & UINT8_C(0xff)); + x148 = (uint8_t)(x147 & UINT8_C(0xff)); x149 = (x147 >> 8); - x150 = (uint8_t)(x147 & UINT8_C(0xff)); + x150 = (uint8_t)(x149 & UINT8_C(0xff)); x151 = (x149 >> 8); - x152 = (uint8_t)(x149 & UINT8_C(0xff)); + x152 = (uint8_t)(x151 & UINT8_C(0xff)); x153 = (x151 >> 8); - x154 = (uint8_t)(x151 & UINT8_C(0xff)); + x154 = (uint8_t)(x153 & UINT8_C(0xff)); x155 = (uint8_t)(x153 >> 8); - x156 = (uint8_t)(x153 & UINT8_C(0xff)); - x157 = (x155 + x43); - x158 = (x157 >> 8); - x159 = (uint8_t)(x157 & UINT8_C(0xff)); + x156 = (x43 + (uint64_t)x155); + x157 = (uint8_t)(x156 & UINT8_C(0xff)); + x158 = (x156 >> 8); + x159 = (uint8_t)(x158 & UINT8_C(0xff)); x160 = (x158 >> 8); - x161 = (uint8_t)(x158 & UINT8_C(0xff)); + x161 = (uint8_t)(x160 & UINT8_C(0xff)); x162 = (x160 >> 8); - x163 = (uint8_t)(x160 & UINT8_C(0xff)); + x163 = (uint8_t)(x162 & UINT8_C(0xff)); x164 = (x162 >> 8); - x165 = (uint8_t)(x162 & UINT8_C(0xff)); + x165 = (uint8_t)(x164 & UINT8_C(0xff)); x166 = (x164 >> 8); - x167 = (uint8_t)(x164 & UINT8_C(0xff)); + x167 = (uint8_t)(x166 & UINT8_C(0xff)); x168 = (uint8_t)(x166 >> 8); - x169 = (uint8_t)(x166 & UINT8_C(0xff)); - x170 = (x168 + x42); - x171 = (x170 >> 8); - x172 = (uint8_t)(x170 & UINT8_C(0xff)); + x169 = (x42 + (uint64_t)x168); + x170 = (uint8_t)(x169 & UINT8_C(0xff)); + x171 = (x169 >> 8); + x172 = (uint8_t)(x171 & UINT8_C(0xff)); x173 = (x171 >> 8); - x174 = (uint8_t)(x171 & UINT8_C(0xff)); + x174 = (uint8_t)(x173 & UINT8_C(0xff)); x175 = (x173 >> 8); - x176 = (uint8_t)(x173 & UINT8_C(0xff)); + x176 = (uint8_t)(x175 & UINT8_C(0xff)); x177 = (x175 >> 8); - x178 = (uint8_t)(x175 & UINT8_C(0xff)); + x178 = (uint8_t)(x177 & UINT8_C(0xff)); x179 = (x177 >> 8); - x180 = (uint8_t)(x177 & UINT8_C(0xff)); + x180 = (uint8_t)(x179 & UINT8_C(0xff)); x181 = (uint8_t)(x179 >> 8); - x182 = (uint8_t)(x179 & UINT8_C(0xff)); - out1[0] = x51; - out1[1] = x53; - out1[2] = x55; - out1[3] = x57; - out1[4] = x59; - out1[5] = x61; - out1[6] = x64; - out1[7] = x66; - out1[8] = x68; - out1[9] = x70; - out1[10] = x72; - out1[11] = x74; - out1[12] = x77; - out1[13] = x79; - out1[14] = x81; - out1[15] = x83; - out1[16] = x85; - out1[17] = x87; - out1[18] = x89; - out1[19] = x92; - out1[20] = x94; - out1[21] = x96; - out1[22] = x98; - out1[23] = x100; - out1[24] = x102; - out1[25] = x105; - out1[26] = x107; - out1[27] = x109; - out1[28] = x111; - out1[29] = x113; - out1[30] = x115; - out1[31] = x116; - out1[32] = x118; - out1[33] = x120; - out1[34] = x122; - out1[35] = x124; - out1[36] = x126; - out1[37] = x128; - out1[38] = x131; - out1[39] = x133; - out1[40] = x135; - out1[41] = x137; - out1[42] = x139; - out1[43] = x141; - out1[44] = x144; - out1[45] = x146; - out1[46] = x148; - out1[47] = x150; - out1[48] = x152; - out1[49] = x154; - out1[50] = x156; - out1[51] = x159; - out1[52] = x161; - out1[53] = x163; - out1[54] = x165; - out1[55] = x167; - out1[56] = x169; - out1[57] = x172; - out1[58] = x174; - out1[59] = x176; - out1[60] = x178; - out1[61] = x180; - out1[62] = x182; + out1[0] = x50; + out1[1] = x52; + out1[2] = x54; + out1[3] = x56; + out1[4] = x58; + out1[5] = x60; + out1[6] = x63; + out1[7] = x65; + out1[8] = x67; + out1[9] = x69; + out1[10] = x71; + out1[11] = x73; + out1[12] = x76; + out1[13] = x78; + out1[14] = x80; + out1[15] = x82; + out1[16] = x84; + out1[17] = x86; + out1[18] = x88; + out1[19] = x91; + out1[20] = x93; + out1[21] = x95; + out1[22] = x97; + out1[23] = x99; + out1[24] = x101; + out1[25] = x104; + out1[26] = x106; + out1[27] = x108; + out1[28] = x110; + out1[29] = x112; + out1[30] = x114; + out1[31] = x115; + out1[32] = x116; + out1[33] = x118; + out1[34] = x120; + out1[35] = x122; + out1[36] = x124; + out1[37] = x126; + out1[38] = x129; + out1[39] = x131; + out1[40] = x133; + out1[41] = x135; + out1[42] = x137; + out1[43] = x139; + out1[44] = x142; + out1[45] = x144; + out1[46] = x146; + out1[47] = x148; + out1[48] = x150; + out1[49] = x152; + out1[50] = x154; + out1[51] = x157; + out1[52] = x159; + out1[53] = x161; + out1[54] = x163; + out1[55] = x165; + out1[56] = x167; + out1[57] = x170; + out1[58] = x172; + out1[59] = x174; + out1[60] = x176; + out1[61] = x178; + out1[62] = x180; out1[63] = x181; } @@ -1738,7 +1755,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x11999999999999], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc], [0x0 ~> 0x8cccccccccccc]] + * out1: [[0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x10000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_from_bytes( uint64_t out1[10], const uint8_t arg1[64]) { @@ -1807,40 +1824,83 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_from_bytes( uint64_t x63; uint8_t x64; uint64_t x65; - uint8_t x66; + uint64_t x66; uint64_t x67; uint64_t x68; uint64_t x69; uint64_t x70; uint64_t x71; - uint64_t x72; + uint8_t x72; uint64_t x73; uint64_t x74; uint64_t x75; uint64_t x76; uint64_t x77; - fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x78; + uint64_t x78; uint64_t x79; - uint64_t x80; - uint8_t x81; + fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x80; + uint64_t x81; uint64_t x82; uint64_t x83; - uint8_t x84; + uint64_t x84; uint64_t x85; uint64_t x86; uint64_t x87; - uint8_t x88; - uint64_t x89; + uint64_t x88; + uint8_t x89; uint64_t x90; - fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x91; + uint64_t x91; uint64_t x92; uint64_t x93; - uint8_t x94; + uint64_t x94; uint64_t x95; uint64_t x96; uint8_t x97; uint64_t x98; uint64_t x99; + uint64_t x100; + uint64_t x101; + uint64_t x102; + uint64_t x103; + uint64_t x104; + uint64_t x105; + uint64_t x106; + uint64_t x107; + uint64_t x108; + uint64_t x109; + uint64_t x110; + uint8_t x111; + uint64_t x112; + uint64_t x113; + uint64_t x114; + uint64_t x115; + uint64_t x116; + uint64_t x117; + uint64_t x118; + fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x119; + uint64_t x120; + uint64_t x121; + uint64_t x122; + uint64_t x123; + uint64_t x124; + uint64_t x125; + uint64_t x126; + uint64_t x127; + uint8_t x128; + uint64_t x129; + uint64_t x130; + uint64_t x131; + uint64_t x132; + uint64_t x133; + uint64_t x134; + uint64_t x135; + uint8_t x136; + uint64_t x137; + uint64_t x138; + uint64_t x139; + uint64_t x140; + uint64_t x141; + uint64_t x142; x1 = ((uint64_t)(arg1[63]) << 43); x2 = ((uint64_t)(arg1[62]) << 35); x3 = ((uint64_t)(arg1[61]) << 27); @@ -1905,51 +1965,94 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_from_bytes( x62 = ((uint64_t)(arg1[2]) << 16); x63 = ((uint64_t)(arg1[1]) << 8); x64 = (arg1[0]); - x65 = (x64 + (x63 + (x62 + (x61 + (x60 + (x59 + x58)))))); - x66 = (uint8_t)(x65 >> 52); - x67 = (x65 & UINT64_C(0xfffffffffffff)); - x68 = (x6 + (x5 + (x4 + (x3 + (x2 + x1))))); - x69 = (x12 + (x11 + (x10 + (x9 + (x8 + x7))))); - x70 = (x19 + (x18 + (x17 + (x16 + (x15 + (x14 + x13)))))); - x71 = (x25 + (x24 + (x23 + (x22 + (x21 + x20))))); - x72 = (x32 + (x31 + (x30 + (x29 + (x28 + (x27 + x26)))))); - x73 = (x38 + (x37 + (x36 + (x35 + (x34 + x33))))); - x74 = (x44 + (x43 + (x42 + (x41 + (x40 + x39))))); - x75 = (x51 + (x50 + (x49 + (x48 + (x47 + (x46 + x45)))))); - x76 = (x57 + (x56 + (x55 + (x54 + (x53 + x52))))); - x77 = (x66 + x76); - x78 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x77 >> 51); - x79 = (x77 & UINT64_C(0x7ffffffffffff)); - x80 = (x78 + x75); - x81 = (uint8_t)(x80 >> 51); - x82 = (x80 & UINT64_C(0x7ffffffffffff)); - x83 = (x81 + x74); - x84 = (uint8_t)(x83 >> 51); - x85 = (x83 & UINT64_C(0x7ffffffffffff)); - x86 = (x84 + x73); - x87 = (x86 & UINT64_C(0x7ffffffffffff)); - x88 = (uint8_t)(x72 >> 52); - x89 = (x72 & UINT64_C(0xfffffffffffff)); - x90 = (x88 + x71); - x91 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x90 >> 51); - x92 = (x90 & UINT64_C(0x7ffffffffffff)); - x93 = (x91 + x70); - x94 = (uint8_t)(x93 >> 51); - x95 = (x93 & UINT64_C(0x7ffffffffffff)); - x96 = (x94 + x69); - x97 = (uint8_t)(x96 >> 51); - x98 = (x96 & UINT64_C(0x7ffffffffffff)); - x99 = (x97 + x68); - out1[0] = x67; + x65 = (x63 + (uint64_t)x64); + x66 = (x62 + x65); + x67 = (x61 + x66); + x68 = (x60 + x67); + x69 = (x59 + x68); + x70 = (x58 + x69); + x71 = (x70 & UINT64_C(0xfffffffffffff)); + x72 = (uint8_t)(x70 >> 52); + x73 = (x57 + (uint64_t)x72); + x74 = (x56 + x73); + x75 = (x55 + x74); + x76 = (x54 + x75); + x77 = (x53 + x76); + x78 = (x52 + x77); + x79 = (x78 & UINT64_C(0x7ffffffffffff)); + x80 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x78 >> 51); + x81 = (x51 + (uint64_t)x80); + x82 = (x50 + x81); + x83 = (x49 + x82); + x84 = (x48 + x83); + x85 = (x47 + x84); + x86 = (x46 + x85); + x87 = (x45 + x86); + x88 = (x87 & UINT64_C(0x7ffffffffffff)); + x89 = (uint8_t)(x87 >> 51); + x90 = (x44 + (uint64_t)x89); + x91 = (x43 + x90); + x92 = (x42 + x91); + x93 = (x41 + x92); + x94 = (x40 + x93); + x95 = (x39 + x94); + x96 = (x95 & UINT64_C(0x7ffffffffffff)); + x97 = (uint8_t)(x95 >> 51); + x98 = (x38 + (uint64_t)x97); + x99 = (x37 + x98); + x100 = (x36 + x99); + x101 = (x35 + x100); + x102 = (x34 + x101); + x103 = (x33 + x102); + x104 = (x31 + (uint64_t)x32); + x105 = (x30 + x104); + x106 = (x29 + x105); + x107 = (x28 + x106); + x108 = (x27 + x107); + x109 = (x26 + x108); + x110 = (x109 & UINT64_C(0xfffffffffffff)); + x111 = (uint8_t)(x109 >> 52); + x112 = (x25 + (uint64_t)x111); + x113 = (x24 + x112); + x114 = (x23 + x113); + x115 = (x22 + x114); + x116 = (x21 + x115); + x117 = (x20 + x116); + x118 = (x117 & UINT64_C(0x7ffffffffffff)); + x119 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x117 >> 51); + x120 = (x19 + (uint64_t)x119); + x121 = (x18 + x120); + x122 = (x17 + x121); + x123 = (x16 + x122); + x124 = (x15 + x123); + x125 = (x14 + x124); + x126 = (x13 + x125); + x127 = (x126 & UINT64_C(0x7ffffffffffff)); + x128 = (uint8_t)(x126 >> 51); + x129 = (x12 + (uint64_t)x128); + x130 = (x11 + x129); + x131 = (x10 + x130); + x132 = (x9 + x131); + x133 = (x8 + x132); + x134 = (x7 + x133); + x135 = (x134 & UINT64_C(0x7ffffffffffff)); + x136 = (uint8_t)(x134 >> 51); + x137 = (x6 + (uint64_t)x136); + x138 = (x5 + x137); + x139 = (x4 + x138); + x140 = (x3 + x139); + x141 = (x2 + x140); + x142 = (x1 + x141); + out1[0] = x71; out1[1] = x79; - out1[2] = x82; - out1[3] = x85; - out1[4] = x87; - out1[5] = x89; - out1[6] = x92; - out1[7] = x95; - out1[8] = x98; - out1[9] = x99; + out1[2] = x88; + out1[3] = x96; + out1[4] = x103; + out1[5] = x110; + out1[6] = x118; + out1[7] = x127; + out1[8] = x135; + out1[9] = x142; } /* END verbatim fiat code */ @@ -4128,8 +4231,8 @@ static void point_edwards2legacy(pt_prj_t *Q, const pt_prj_t *P) { /* temporary variables */ fe_t t0; /* constants */ - const limb_t *S = const_S; const limb_t *T = const_T; + const limb_t *S = const_S; const limb_t *X1 = P->X; const limb_t *Y1 = P->Y; const limb_t *Z1 = P->Z; @@ -4261,7 +4364,7 @@ static void scalar_wnaf(int8_t out[513], const unsigned char in[64]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], @@ -4269,7 +4372,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[513] = {0}; int8_t bnaf[513] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4343,7 +4446,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[103] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -4431,8 +4534,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[103] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -4504,6 +4607,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], const unsigned char a[64], const unsigned char b[64], const unsigned char inx[64], @@ -4519,6 +4628,11 @@ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64]) { pt_aff_t P; @@ -4529,6 +4643,12 @@ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64], const unsigned char inx[64], @@ -4546,8 +4666,13 @@ static void point_mul(unsigned char outx[64], unsigned char outy[64], #include +/* the zero field element */ static const unsigned char const_zb[64] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_512_paramSetC( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -4586,6 +4711,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_512_paramSetC(const EC_GROUP *group, EC_POINT *r, @@ -4625,6 +4754,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_512_paramSetC(const EC_GROUP *group, EC_POINT *r, @@ -4671,6 +4804,10 @@ err: typedef uint32_t fe_t[LIMB_CNT]; typedef uint32_t limb_t; +#ifdef OPENSSL_NO_ASM +#define FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETC_NO_ASM +#endif + #define fe_copy(d, s) memcpy(d, s, sizeof(fe_t)) #define fe_set_zero(d) memset(d, 0, sizeof(fe_t)) @@ -4721,18 +4858,19 @@ typedef struct { * SOFTWARE. */ -/* Autogenerated: unsaturated_solinas --static id_tc26_gost_3410_2012_512_paramSetC 32 '(auto)' '2^512 - 569' */ +/* Autogenerated: unsaturated_solinas --static --use-value-barrier id_tc26_gost_3410_2012_512_paramSetC 32 '(auto)' '2^512 - 569' */ /* curve description: id_tc26_gost_3410_2012_512_paramSetC */ /* machine_wordsize = 32 (from "32") */ /* requested operations: (all) */ /* n = 23 (from "(auto)") */ /* s-c = 2^512 - [(1, 569)] (from "2^512 - 569") */ -/* tight_bounds_multiplier = 1.1 (from "") */ +/* tight_bounds_multiplier = 1 (from "") */ /* */ /* Computed values: */ /* carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 0, 1] */ /* eval z = z[0] + (z[1] << 23) + (z[2] << 45) + (z[3] << 67) + (z[4] << 90) + (z[5] << 112) + (z[6] << 134) + (z[7] << 156) + (z[8] << 179) + (z[9] << 201) + (z[10] << 223) + (z[11] << 245) + (z[12] << 0x10c) + (z[13] << 0x122) + (z[14] << 0x138) + (z[15] << 0x14e) + (z[16] << 0x165) + (z[17] << 0x17b) + (z[18] << 0x191) + (z[19] << 0x1a7) + (z[20] << 0x1be) + (z[21] << 0x1d4) + (z[22] << 0x1ea) */ /* bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) + (z[55] << 0x1b8) + (z[56] << 0x1c0) + (z[57] << 0x1c8) + (z[58] << 0x1d0) + (z[59] << 0x1d8) + (z[60] << 0x1e0) + (z[61] << 0x1e8) + (z[62] << 0x1f0) + (z[63] << 0x1f8) */ +/* balance = [0xfffb8e, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe, 0xfffffe, 0x7ffffe, 0x7ffffe, 0x7ffffe] */ #include typedef unsigned char fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1; @@ -4742,6 +4880,17 @@ typedef signed char fiat_id_tc26_gost_3410_2012_512_paramSetC_int1; #error "This code only works on a two's complement system" #endif +#if !defined(FIAT_ID_TC26_GOST_3410_2012_512_PARAMSETC_NO_ASM) && \ + (defined(__GNUC__) || defined(__clang__)) +static __inline__ uint32_t +fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u32(uint32_t a) { + __asm__("" : "+r"(a) : /* no inputs */); + return a; +} +#else +#define fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u32(x) (x) +#endif + /* * The function fiat_id_tc26_gost_3410_2012_512_paramSetC_addcarryx_u22 is an addition with carry. * Postconditions: @@ -4875,7 +5024,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_cmovznz_u32( x1 = (!(!arg1)); x2 = ((fiat_id_tc26_gost_3410_2012_512_paramSetC_int1)(0x0 - x1) & UINT32_C(0xffffffff)); - x3 = ((x2 & arg3) | ((~x2) & arg2)); + x3 = ((fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u32(x2) & + arg3) | + (fiat_id_tc26_gost_3410_2012_512_paramSetC_value_barrier_u32((~x2)) & + arg2)); *out1 = x3; } @@ -4885,10 +5037,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_cmovznz_u32( * eval out1 mod m = (eval arg1 * eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] - * arg2: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * arg1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] + * arg2: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_mul( uint32_t out1[23], const uint32_t arg1[23], const uint32_t arg2[23]) { @@ -6617,9 +6769,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_mul( * eval out1 mod m = (eval arg1 * eval arg1) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * arg1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_square( uint32_t out1[23], const uint32_t arg1[23]) { @@ -7607,9 +7759,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_square( * eval out1 mod m = eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * arg1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry( uint32_t out1[23], const uint32_t arg1[23]) { @@ -7742,10 +7894,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_carry( * eval out1 mod m = (eval arg1 + eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] - * arg2: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] + * arg2: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: - * out1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * out1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_add( uint32_t out1[23], const uint32_t arg1[23], const uint32_t arg2[23]) { @@ -7826,10 +7978,10 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_add( * eval out1 mod m = (eval arg1 - eval arg2) mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] - * arg2: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] + * arg2: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: - * out1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * out1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_sub( uint32_t out1[23], const uint32_t arg1[23], const uint32_t arg2[23]) { @@ -7910,9 +8062,9 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_sub( * eval out1 mod m = -eval arg1 mod m * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: - * out1: [[0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0x1a66664], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332], [0x0 ~> 0xd33332]] + * out1: [[0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0x1800000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000], [0x0 ~> 0xc00000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_opp( uint32_t out1[23], const uint32_t arg1[23]) { @@ -8102,7 +8254,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_selectznz( * out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..63] * * Input Bounds: - * arg1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * arg1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] * Output Bounds: * out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] */ @@ -8221,150 +8373,148 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( uint32_t x111; uint32_t x112; uint32_t x113; - uint32_t x114; - uint8_t x115; + uint8_t x114; + uint32_t x115; uint8_t x116; uint8_t x117; uint32_t x118; - uint32_t x119; - uint8_t x120; - uint32_t x121; - uint8_t x122; + uint8_t x119; + uint32_t x120; + uint8_t x121; + uint32_t x122; uint8_t x123; uint8_t x124; uint32_t x125; - uint32_t x126; - uint8_t x127; - uint32_t x128; - uint8_t x129; + uint8_t x126; + uint32_t x127; + uint8_t x128; + uint32_t x129; uint8_t x130; uint8_t x131; uint32_t x132; - uint32_t x133; - uint8_t x134; - uint32_t x135; - uint8_t x136; + uint8_t x133; + uint32_t x134; + uint8_t x135; + uint32_t x136; uint8_t x137; uint8_t x138; uint32_t x139; - uint32_t x140; - uint8_t x141; + uint8_t x140; + uint32_t x141; uint8_t x142; uint8_t x143; uint8_t x144; uint32_t x145; uint8_t x146; uint8_t x147; - uint8_t x148; - uint32_t x149; + uint32_t x148; + uint8_t x149; uint32_t x150; uint8_t x151; uint32_t x152; uint8_t x153; uint8_t x154; - uint8_t x155; - uint32_t x156; + uint32_t x155; + uint8_t x156; uint32_t x157; uint8_t x158; uint32_t x159; uint8_t x160; uint8_t x161; - uint8_t x162; - uint32_t x163; + uint32_t x162; + uint8_t x163; uint32_t x164; uint8_t x165; uint32_t x166; uint8_t x167; fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x168; - uint8_t x169; - uint32_t x170; + uint32_t x169; + uint8_t x170; uint32_t x171; uint8_t x172; uint8_t x173; - uint8_t x174; - uint32_t x175; + uint32_t x174; + uint8_t x175; uint32_t x176; uint8_t x177; uint32_t x178; uint8_t x179; uint8_t x180; - uint8_t x181; - uint32_t x182; + uint32_t x181; + uint8_t x182; uint32_t x183; uint8_t x184; uint32_t x185; uint8_t x186; uint8_t x187; - uint8_t x188; - uint32_t x189; + uint32_t x188; + uint8_t x189; uint32_t x190; uint8_t x191; uint32_t x192; uint8_t x193; uint8_t x194; - uint8_t x195; - uint32_t x196; + uint32_t x195; + uint8_t x196; uint32_t x197; uint8_t x198; uint8_t x199; uint8_t x200; - uint8_t x201; - uint32_t x202; + uint32_t x201; + uint8_t x202; uint8_t x203; - uint8_t x204; + uint32_t x204; uint8_t x205; uint32_t x206; - uint32_t x207; - uint8_t x208; - uint32_t x209; + uint8_t x207; + uint32_t x208; + uint8_t x209; uint8_t x210; - uint8_t x211; + uint32_t x211; uint8_t x212; uint32_t x213; - uint32_t x214; - uint8_t x215; - uint32_t x216; + uint8_t x214; + uint32_t x215; + uint8_t x216; uint8_t x217; - uint8_t x218; + uint32_t x218; uint8_t x219; uint32_t x220; - uint32_t x221; - uint8_t x222; - uint32_t x223; - uint8_t x224; - fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x225; + uint8_t x221; + uint32_t x222; + uint8_t x223; + fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x224; + uint32_t x225; uint8_t x226; uint32_t x227; - uint32_t x228; + uint8_t x228; uint8_t x229; - uint8_t x230; + uint32_t x230; uint8_t x231; uint32_t x232; - uint32_t x233; - uint8_t x234; - uint32_t x235; + uint8_t x233; + uint32_t x234; + uint8_t x235; uint8_t x236; - uint8_t x237; + uint32_t x237; uint8_t x238; uint32_t x239; - uint32_t x240; - uint8_t x241; - uint32_t x242; + uint8_t x240; + uint32_t x241; + uint8_t x242; uint8_t x243; - uint8_t x244; + uint32_t x244; uint8_t x245; uint32_t x246; - uint32_t x247; - uint8_t x248; - uint32_t x249; + uint8_t x247; + uint32_t x248; + uint8_t x249; uint8_t x250; - uint8_t x251; + uint32_t x251; uint8_t x252; uint32_t x253; - uint32_t x254; + uint8_t x254; uint8_t x255; - uint8_t x256; - uint8_t x257; fiat_id_tc26_gost_3410_2012_512_paramSetC_subborrowx_u23( &x1, &x2, 0x0, (arg1[0]), UINT32_C(0x7ffdc7)); fiat_id_tc26_gost_3410_2012_512_paramSetC_subborrowx_u22( @@ -8479,214 +8629,212 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( x111 = (x54 << 3); x112 = (x52 << 5); x113 = (x50 << 7); - x114 = (x48 >> 8); - x115 = (uint8_t)(x48 & UINT8_C(0xff)); - x116 = (uint8_t)(x114 >> 8); - x117 = (uint8_t)(x114 & UINT8_C(0xff)); - x118 = (x116 + x113); - x119 = (x118 >> 8); - x120 = (uint8_t)(x118 & UINT8_C(0xff)); - x121 = (x119 >> 8); - x122 = (uint8_t)(x119 & UINT8_C(0xff)); - x123 = (uint8_t)(x121 >> 8); - x124 = (uint8_t)(x121 & UINT8_C(0xff)); - x125 = (x123 + x112); - x126 = (x125 >> 8); - x127 = (uint8_t)(x125 & UINT8_C(0xff)); - x128 = (x126 >> 8); - x129 = (uint8_t)(x126 & UINT8_C(0xff)); - x130 = (uint8_t)(x128 >> 8); - x131 = (uint8_t)(x128 & UINT8_C(0xff)); - x132 = (x130 + x111); - x133 = (x132 >> 8); - x134 = (uint8_t)(x132 & UINT8_C(0xff)); - x135 = (x133 >> 8); - x136 = (uint8_t)(x133 & UINT8_C(0xff)); - x137 = (uint8_t)(x135 >> 8); - x138 = (uint8_t)(x135 & UINT8_C(0xff)); - x139 = (x137 + x110); - x140 = (x139 >> 8); - x141 = (uint8_t)(x139 & UINT8_C(0xff)); - x142 = (uint8_t)(x140 >> 8); - x143 = (uint8_t)(x140 & UINT8_C(0xff)); - x144 = (uint8_t)(x142 & UINT8_C(0xff)); + x114 = (uint8_t)(x48 & UINT8_C(0xff)); + x115 = (x48 >> 8); + x116 = (uint8_t)(x115 & UINT8_C(0xff)); + x117 = (uint8_t)(x115 >> 8); + x118 = (x113 + (uint32_t)x117); + x119 = (uint8_t)(x118 & UINT8_C(0xff)); + x120 = (x118 >> 8); + x121 = (uint8_t)(x120 & UINT8_C(0xff)); + x122 = (x120 >> 8); + x123 = (uint8_t)(x122 & UINT8_C(0xff)); + x124 = (uint8_t)(x122 >> 8); + x125 = (x112 + (uint32_t)x124); + x126 = (uint8_t)(x125 & UINT8_C(0xff)); + x127 = (x125 >> 8); + x128 = (uint8_t)(x127 & UINT8_C(0xff)); + x129 = (x127 >> 8); + x130 = (uint8_t)(x129 & UINT8_C(0xff)); + x131 = (uint8_t)(x129 >> 8); + x132 = (x111 + (uint32_t)x131); + x133 = (uint8_t)(x132 & UINT8_C(0xff)); + x134 = (x132 >> 8); + x135 = (uint8_t)(x134 & UINT8_C(0xff)); + x136 = (x134 >> 8); + x137 = (uint8_t)(x136 & UINT8_C(0xff)); + x138 = (uint8_t)(x136 >> 8); + x139 = (x110 + (uint32_t)x138); + x140 = (uint8_t)(x139 & UINT8_C(0xff)); + x141 = (x139 >> 8); + x142 = (uint8_t)(x141 & UINT8_C(0xff)); + x143 = (uint8_t)(x141 >> 8); + x144 = (uint8_t)(x58 & UINT8_C(0xff)); x145 = (x58 >> 8); - x146 = (uint8_t)(x58 & UINT8_C(0xff)); + x146 = (uint8_t)(x145 & UINT8_C(0xff)); x147 = (uint8_t)(x145 >> 8); - x148 = (uint8_t)(x145 & UINT8_C(0xff)); - x149 = (x147 + x109); - x150 = (x149 >> 8); - x151 = (uint8_t)(x149 & UINT8_C(0xff)); + x148 = (x109 + (uint32_t)x147); + x149 = (uint8_t)(x148 & UINT8_C(0xff)); + x150 = (x148 >> 8); + x151 = (uint8_t)(x150 & UINT8_C(0xff)); x152 = (x150 >> 8); - x153 = (uint8_t)(x150 & UINT8_C(0xff)); + x153 = (uint8_t)(x152 & UINT8_C(0xff)); x154 = (uint8_t)(x152 >> 8); - x155 = (uint8_t)(x152 & UINT8_C(0xff)); - x156 = (x154 + x108); - x157 = (x156 >> 8); - x158 = (uint8_t)(x156 & UINT8_C(0xff)); + x155 = (x108 + (uint32_t)x154); + x156 = (uint8_t)(x155 & UINT8_C(0xff)); + x157 = (x155 >> 8); + x158 = (uint8_t)(x157 & UINT8_C(0xff)); x159 = (x157 >> 8); - x160 = (uint8_t)(x157 & UINT8_C(0xff)); + x160 = (uint8_t)(x159 & UINT8_C(0xff)); x161 = (uint8_t)(x159 >> 8); - x162 = (uint8_t)(x159 & UINT8_C(0xff)); - x163 = (x161 + x107); - x164 = (x163 >> 8); - x165 = (uint8_t)(x163 & UINT8_C(0xff)); + x162 = (x107 + (uint32_t)x161); + x163 = (uint8_t)(x162 & UINT8_C(0xff)); + x164 = (x162 >> 8); + x165 = (uint8_t)(x164 & UINT8_C(0xff)); x166 = (x164 >> 8); - x167 = (uint8_t)(x164 & UINT8_C(0xff)); + x167 = (uint8_t)(x166 & UINT8_C(0xff)); x168 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x166 >> 8); - x169 = (uint8_t)(x166 & UINT8_C(0xff)); - x170 = (x168 + x106); - x171 = (x170 >> 8); - x172 = (uint8_t)(x170 & UINT8_C(0xff)); + x169 = (x106 + (uint32_t)x168); + x170 = (uint8_t)(x169 & UINT8_C(0xff)); + x171 = (x169 >> 8); + x172 = (uint8_t)(x171 & UINT8_C(0xff)); x173 = (uint8_t)(x171 >> 8); - x174 = (uint8_t)(x171 & UINT8_C(0xff)); - x175 = (x173 + x105); - x176 = (x175 >> 8); - x177 = (uint8_t)(x175 & UINT8_C(0xff)); + x174 = (x105 + (uint32_t)x173); + x175 = (uint8_t)(x174 & UINT8_C(0xff)); + x176 = (x174 >> 8); + x177 = (uint8_t)(x176 & UINT8_C(0xff)); x178 = (x176 >> 8); - x179 = (uint8_t)(x176 & UINT8_C(0xff)); + x179 = (uint8_t)(x178 & UINT8_C(0xff)); x180 = (uint8_t)(x178 >> 8); - x181 = (uint8_t)(x178 & UINT8_C(0xff)); - x182 = (x180 + x104); - x183 = (x182 >> 8); - x184 = (uint8_t)(x182 & UINT8_C(0xff)); + x181 = (x104 + (uint32_t)x180); + x182 = (uint8_t)(x181 & UINT8_C(0xff)); + x183 = (x181 >> 8); + x184 = (uint8_t)(x183 & UINT8_C(0xff)); x185 = (x183 >> 8); - x186 = (uint8_t)(x183 & UINT8_C(0xff)); + x186 = (uint8_t)(x185 & UINT8_C(0xff)); x187 = (uint8_t)(x185 >> 8); - x188 = (uint8_t)(x185 & UINT8_C(0xff)); - x189 = (x187 + x103); - x190 = (x189 >> 8); - x191 = (uint8_t)(x189 & UINT8_C(0xff)); + x188 = (x103 + (uint32_t)x187); + x189 = (uint8_t)(x188 & UINT8_C(0xff)); + x190 = (x188 >> 8); + x191 = (uint8_t)(x190 & UINT8_C(0xff)); x192 = (x190 >> 8); - x193 = (uint8_t)(x190 & UINT8_C(0xff)); + x193 = (uint8_t)(x192 & UINT8_C(0xff)); x194 = (uint8_t)(x192 >> 8); - x195 = (uint8_t)(x192 & UINT8_C(0xff)); - x196 = (x194 + x102); - x197 = (x196 >> 8); - x198 = (uint8_t)(x196 & UINT8_C(0xff)); + x195 = (x102 + (uint32_t)x194); + x196 = (uint8_t)(x195 & UINT8_C(0xff)); + x197 = (x195 >> 8); + x198 = (uint8_t)(x197 & UINT8_C(0xff)); x199 = (uint8_t)(x197 >> 8); - x200 = (uint8_t)(x197 & UINT8_C(0xff)); - x201 = (uint8_t)(x199 & UINT8_C(0xff)); - x202 = (x76 >> 8); - x203 = (uint8_t)(x76 & UINT8_C(0xff)); - x204 = (uint8_t)(x202 >> 8); - x205 = (uint8_t)(x202 & UINT8_C(0xff)); - x206 = (x204 + x101); - x207 = (x206 >> 8); - x208 = (uint8_t)(x206 & UINT8_C(0xff)); - x209 = (x207 >> 8); - x210 = (uint8_t)(x207 & UINT8_C(0xff)); - x211 = (uint8_t)(x209 >> 8); - x212 = (uint8_t)(x209 & UINT8_C(0xff)); - x213 = (x211 + x100); - x214 = (x213 >> 8); - x215 = (uint8_t)(x213 & UINT8_C(0xff)); - x216 = (x214 >> 8); - x217 = (uint8_t)(x214 & UINT8_C(0xff)); - x218 = (uint8_t)(x216 >> 8); - x219 = (uint8_t)(x216 & UINT8_C(0xff)); - x220 = (x218 + x99); - x221 = (x220 >> 8); - x222 = (uint8_t)(x220 & UINT8_C(0xff)); - x223 = (x221 >> 8); - x224 = (uint8_t)(x221 & UINT8_C(0xff)); - x225 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x223 >> 8); - x226 = (uint8_t)(x223 & UINT8_C(0xff)); - x227 = (x225 + x98); - x228 = (x227 >> 8); - x229 = (uint8_t)(x227 & UINT8_C(0xff)); - x230 = (uint8_t)(x228 >> 8); - x231 = (uint8_t)(x228 & UINT8_C(0xff)); - x232 = (x230 + x97); - x233 = (x232 >> 8); - x234 = (uint8_t)(x232 & UINT8_C(0xff)); - x235 = (x233 >> 8); - x236 = (uint8_t)(x233 & UINT8_C(0xff)); - x237 = (uint8_t)(x235 >> 8); - x238 = (uint8_t)(x235 & UINT8_C(0xff)); - x239 = (x237 + x96); - x240 = (x239 >> 8); - x241 = (uint8_t)(x239 & UINT8_C(0xff)); - x242 = (x240 >> 8); - x243 = (uint8_t)(x240 & UINT8_C(0xff)); - x244 = (uint8_t)(x242 >> 8); - x245 = (uint8_t)(x242 & UINT8_C(0xff)); - x246 = (x244 + x95); - x247 = (x246 >> 8); - x248 = (uint8_t)(x246 & UINT8_C(0xff)); - x249 = (x247 >> 8); - x250 = (uint8_t)(x247 & UINT8_C(0xff)); - x251 = (uint8_t)(x249 >> 8); - x252 = (uint8_t)(x249 & UINT8_C(0xff)); - x253 = (x251 + x94); - x254 = (x253 >> 8); - x255 = (uint8_t)(x253 & UINT8_C(0xff)); - x256 = (uint8_t)(x254 >> 8); - x257 = (uint8_t)(x254 & UINT8_C(0xff)); - out1[0] = x115; - out1[1] = x117; - out1[2] = x120; - out1[3] = x122; - out1[4] = x124; - out1[5] = x127; - out1[6] = x129; - out1[7] = x131; - out1[8] = x134; - out1[9] = x136; - out1[10] = x138; - out1[11] = x141; - out1[12] = x143; - out1[13] = x144; - out1[14] = x146; - out1[15] = x148; - out1[16] = x151; - out1[17] = x153; - out1[18] = x155; - out1[19] = x158; - out1[20] = x160; - out1[21] = x162; - out1[22] = x165; - out1[23] = x167; - out1[24] = x169; - out1[25] = x172; - out1[26] = x174; - out1[27] = x177; - out1[28] = x179; - out1[29] = x181; - out1[30] = x184; - out1[31] = x186; - out1[32] = x188; - out1[33] = x191; - out1[34] = x193; - out1[35] = x195; - out1[36] = x198; - out1[37] = x200; - out1[38] = x201; - out1[39] = x203; - out1[40] = x205; - out1[41] = x208; - out1[42] = x210; - out1[43] = x212; - out1[44] = x215; - out1[45] = x217; - out1[46] = x219; - out1[47] = x222; - out1[48] = x224; - out1[49] = x226; - out1[50] = x229; - out1[51] = x231; - out1[52] = x234; - out1[53] = x236; - out1[54] = x238; - out1[55] = x241; - out1[56] = x243; - out1[57] = x245; - out1[58] = x248; - out1[59] = x250; - out1[60] = x252; - out1[61] = x255; - out1[62] = x257; - out1[63] = x256; + x200 = (uint8_t)(x76 & UINT8_C(0xff)); + x201 = (x76 >> 8); + x202 = (uint8_t)(x201 & UINT8_C(0xff)); + x203 = (uint8_t)(x201 >> 8); + x204 = (x101 + (uint32_t)x203); + x205 = (uint8_t)(x204 & UINT8_C(0xff)); + x206 = (x204 >> 8); + x207 = (uint8_t)(x206 & UINT8_C(0xff)); + x208 = (x206 >> 8); + x209 = (uint8_t)(x208 & UINT8_C(0xff)); + x210 = (uint8_t)(x208 >> 8); + x211 = (x100 + (uint32_t)x210); + x212 = (uint8_t)(x211 & UINT8_C(0xff)); + x213 = (x211 >> 8); + x214 = (uint8_t)(x213 & UINT8_C(0xff)); + x215 = (x213 >> 8); + x216 = (uint8_t)(x215 & UINT8_C(0xff)); + x217 = (uint8_t)(x215 >> 8); + x218 = (x99 + (uint32_t)x217); + x219 = (uint8_t)(x218 & UINT8_C(0xff)); + x220 = (x218 >> 8); + x221 = (uint8_t)(x220 & UINT8_C(0xff)); + x222 = (x220 >> 8); + x223 = (uint8_t)(x222 & UINT8_C(0xff)); + x224 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x222 >> 8); + x225 = (x98 + (uint32_t)x224); + x226 = (uint8_t)(x225 & UINT8_C(0xff)); + x227 = (x225 >> 8); + x228 = (uint8_t)(x227 & UINT8_C(0xff)); + x229 = (uint8_t)(x227 >> 8); + x230 = (x97 + (uint32_t)x229); + x231 = (uint8_t)(x230 & UINT8_C(0xff)); + x232 = (x230 >> 8); + x233 = (uint8_t)(x232 & UINT8_C(0xff)); + x234 = (x232 >> 8); + x235 = (uint8_t)(x234 & UINT8_C(0xff)); + x236 = (uint8_t)(x234 >> 8); + x237 = (x96 + (uint32_t)x236); + x238 = (uint8_t)(x237 & UINT8_C(0xff)); + x239 = (x237 >> 8); + x240 = (uint8_t)(x239 & UINT8_C(0xff)); + x241 = (x239 >> 8); + x242 = (uint8_t)(x241 & UINT8_C(0xff)); + x243 = (uint8_t)(x241 >> 8); + x244 = (x95 + (uint32_t)x243); + x245 = (uint8_t)(x244 & UINT8_C(0xff)); + x246 = (x244 >> 8); + x247 = (uint8_t)(x246 & UINT8_C(0xff)); + x248 = (x246 >> 8); + x249 = (uint8_t)(x248 & UINT8_C(0xff)); + x250 = (uint8_t)(x248 >> 8); + x251 = (x94 + (uint32_t)x250); + x252 = (uint8_t)(x251 & UINT8_C(0xff)); + x253 = (x251 >> 8); + x254 = (uint8_t)(x253 & UINT8_C(0xff)); + x255 = (uint8_t)(x253 >> 8); + out1[0] = x114; + out1[1] = x116; + out1[2] = x119; + out1[3] = x121; + out1[4] = x123; + out1[5] = x126; + out1[6] = x128; + out1[7] = x130; + out1[8] = x133; + out1[9] = x135; + out1[10] = x137; + out1[11] = x140; + out1[12] = x142; + out1[13] = x143; + out1[14] = x144; + out1[15] = x146; + out1[16] = x149; + out1[17] = x151; + out1[18] = x153; + out1[19] = x156; + out1[20] = x158; + out1[21] = x160; + out1[22] = x163; + out1[23] = x165; + out1[24] = x167; + out1[25] = x170; + out1[26] = x172; + out1[27] = x175; + out1[28] = x177; + out1[29] = x179; + out1[30] = x182; + out1[31] = x184; + out1[32] = x186; + out1[33] = x189; + out1[34] = x191; + out1[35] = x193; + out1[36] = x196; + out1[37] = x198; + out1[38] = x199; + out1[39] = x200; + out1[40] = x202; + out1[41] = x205; + out1[42] = x207; + out1[43] = x209; + out1[44] = x212; + out1[45] = x214; + out1[46] = x216; + out1[47] = x219; + out1[48] = x221; + out1[49] = x223; + out1[50] = x226; + out1[51] = x228; + out1[52] = x231; + out1[53] = x233; + out1[54] = x235; + out1[55] = x238; + out1[56] = x240; + out1[57] = x242; + out1[58] = x245; + out1[59] = x247; + out1[60] = x249; + out1[61] = x252; + out1[62] = x254; + out1[63] = x255; } /* @@ -8697,7 +8845,7 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes( * Input Bounds: * arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] * Output Bounds: - * out1: [[0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x8ccccc], [0x0 ~> 0x466666], [0x0 ~> 0x466666], [0x0 ~> 0x466666]] + * out1: [[0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x800000], [0x0 ~> 0x400000], [0x0 ~> 0x400000], [0x0 ~> 0x400000]] */ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_from_bytes( uint32_t out1[23], const uint8_t arg1[64]) { @@ -8766,90 +8914,106 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_from_bytes( uint32_t x63; uint8_t x64; uint32_t x65; - fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x66; + uint32_t x66; uint32_t x67; - uint32_t x68; + fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x68; uint32_t x69; uint32_t x70; uint32_t x71; uint32_t x72; - uint32_t x73; + uint8_t x73; uint32_t x74; uint32_t x75; uint32_t x76; uint32_t x77; - uint32_t x78; + uint8_t x78; uint32_t x79; uint32_t x80; uint32_t x81; uint32_t x82; - uint32_t x83; + uint8_t x83; uint32_t x84; uint32_t x85; uint32_t x86; uint32_t x87; uint32_t x88; - uint32_t x89; + uint8_t x89; uint32_t x90; - uint8_t x91; + uint32_t x91; uint32_t x92; uint32_t x93; uint8_t x94; uint32_t x95; uint32_t x96; - uint8_t x97; + uint32_t x97; uint32_t x98; - uint32_t x99; + uint8_t x99; uint32_t x100; - uint8_t x101; + uint32_t x101; uint32_t x102; uint32_t x103; uint8_t x104; uint32_t x105; uint32_t x106; - uint8_t x107; - uint32_t x108; + uint32_t x107; + fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x108; uint32_t x109; - uint8_t x110; + uint32_t x110; uint32_t x111; uint32_t x112; - fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x113; + uint8_t x113; uint32_t x114; uint32_t x115; - uint8_t x116; + uint32_t x116; uint32_t x117; - uint32_t x118; - uint8_t x119; + uint8_t x118; + uint32_t x119; uint32_t x120; uint32_t x121; - uint8_t x122; - uint32_t x123; + uint32_t x122; + uint8_t x123; uint32_t x124; uint32_t x125; - uint8_t x126; + uint32_t x126; uint32_t x127; uint32_t x128; uint8_t x129; uint32_t x130; uint32_t x131; - uint8_t x132; + uint32_t x132; uint32_t x133; - uint32_t x134; - uint8_t x135; + uint8_t x134; + uint32_t x135; uint32_t x136; uint32_t x137; - fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x138; - uint32_t x139; + uint32_t x138; + uint8_t x139; uint32_t x140; - uint8_t x141; + uint32_t x141; uint32_t x142; uint32_t x143; uint8_t x144; uint32_t x145; uint32_t x146; - uint8_t x147; - uint32_t x148; + uint32_t x147; + fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1 x148; uint32_t x149; + uint32_t x150; + uint32_t x151; + uint32_t x152; + uint8_t x153; + uint32_t x154; + uint32_t x155; + uint32_t x156; + uint32_t x157; + uint8_t x158; + uint32_t x159; + uint32_t x160; + uint32_t x161; + uint32_t x162; + uint8_t x163; + uint32_t x164; + uint32_t x165; x1 = ((uint32_t)(arg1[63]) << 14); x2 = ((uint32_t)(arg1[62]) << 6); x3 = ((uint32_t)(arg1[61]) << 20); @@ -8914,114 +9078,130 @@ static void fiat_id_tc26_gost_3410_2012_512_paramSetC_from_bytes( x62 = ((uint32_t)(arg1[2]) << 16); x63 = ((uint32_t)(arg1[1]) << 8); x64 = (arg1[0]); - x65 = (x64 + (x63 + x62)); - x66 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x65 >> 23); - x67 = (x65 & UINT32_C(0x7fffff)); - x68 = (x2 + x1); - x69 = (x5 + (x4 + x3)); - x70 = (x8 + (x7 + x6)); - x71 = (x11 + (x10 + x9)); - x72 = (x13 + x12); - x73 = (x16 + (x15 + x14)); - x74 = (x19 + (x18 + x17)); - x75 = (x22 + (x21 + x20)); - x76 = (x25 + (x24 + x23)); - x77 = (x27 + x26); - x78 = (x30 + (x29 + x28)); - x79 = (x33 + (x32 + x31)); - x80 = (x36 + (x35 + x34)); - x81 = (x38 + x37); - x82 = (x41 + (x40 + x39)); - x83 = (x44 + (x43 + x42)); - x84 = (x47 + (x46 + x45)); - x85 = (x50 + (x49 + x48)); - x86 = (x52 + x51); - x87 = (x55 + (x54 + x53)); - x88 = (x58 + (x57 + x56)); - x89 = (x61 + (x60 + x59)); - x90 = (x66 + x89); - x91 = (uint8_t)(x90 >> 22); - x92 = (x90 & UINT32_C(0x3fffff)); - x93 = (x91 + x88); - x94 = (uint8_t)(x93 >> 22); - x95 = (x93 & UINT32_C(0x3fffff)); - x96 = (x94 + x87); - x97 = (uint8_t)(x96 >> 23); - x98 = (x96 & UINT32_C(0x7fffff)); - x99 = (x97 + x86); - x100 = (x99 & UINT32_C(0x3fffff)); - x101 = (uint8_t)(x85 >> 22); - x102 = (x85 & UINT32_C(0x3fffff)); - x103 = (x101 + x84); - x104 = (uint8_t)(x103 >> 22); - x105 = (x103 & UINT32_C(0x3fffff)); - x106 = (x104 + x83); - x107 = (uint8_t)(x106 >> 23); - x108 = (x106 & UINT32_C(0x7fffff)); - x109 = (x107 + x82); - x110 = (uint8_t)(x109 >> 22); - x111 = (x109 & UINT32_C(0x3fffff)); - x112 = (x110 + x81); - x113 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x112 >> 22); - x114 = (x112 & UINT32_C(0x3fffff)); - x115 = (x113 + x80); - x116 = (uint8_t)(x115 >> 22); - x117 = (x115 & UINT32_C(0x3fffff)); - x118 = (x116 + x79); - x119 = (uint8_t)(x118 >> 23); - x120 = (x118 & UINT32_C(0x7fffff)); - x121 = (x119 + x78); - x122 = (uint8_t)(x121 >> 22); - x123 = (x121 & UINT32_C(0x3fffff)); - x124 = (x122 + x77); - x125 = (x124 & UINT32_C(0x3fffff)); - x126 = (uint8_t)(x76 >> 22); - x127 = (x76 & UINT32_C(0x3fffff)); - x128 = (x126 + x75); - x129 = (uint8_t)(x128 >> 23); - x130 = (x128 & UINT32_C(0x7fffff)); - x131 = (x129 + x74); - x132 = (uint8_t)(x131 >> 22); - x133 = (x131 & UINT32_C(0x3fffff)); - x134 = (x132 + x73); - x135 = (uint8_t)(x134 >> 22); - x136 = (x134 & UINT32_C(0x3fffff)); - x137 = (x135 + x72); - x138 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x137 >> 22); - x139 = (x137 & UINT32_C(0x3fffff)); - x140 = (x138 + x71); - x141 = (uint8_t)(x140 >> 23); - x142 = (x140 & UINT32_C(0x7fffff)); - x143 = (x141 + x70); - x144 = (uint8_t)(x143 >> 22); - x145 = (x143 & UINT32_C(0x3fffff)); - x146 = (x144 + x69); - x147 = (uint8_t)(x146 >> 22); - x148 = (x146 & UINT32_C(0x3fffff)); - x149 = (x147 + x68); + x65 = (x63 + (uint32_t)x64); + x66 = (x62 + x65); + x67 = (x66 & UINT32_C(0x7fffff)); + x68 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x66 >> 23); + x69 = (x61 + (uint32_t)x68); + x70 = (x60 + x69); + x71 = (x59 + x70); + x72 = (x71 & UINT32_C(0x3fffff)); + x73 = (uint8_t)(x71 >> 22); + x74 = (x58 + (uint32_t)x73); + x75 = (x57 + x74); + x76 = (x56 + x75); + x77 = (x76 & UINT32_C(0x3fffff)); + x78 = (uint8_t)(x76 >> 22); + x79 = (x55 + (uint32_t)x78); + x80 = (x54 + x79); + x81 = (x53 + x80); + x82 = (x81 & UINT32_C(0x7fffff)); + x83 = (uint8_t)(x81 >> 23); + x84 = (x52 + (uint32_t)x83); + x85 = (x51 + x84); + x86 = (x49 + (uint32_t)x50); + x87 = (x48 + x86); + x88 = (x87 & UINT32_C(0x3fffff)); + x89 = (uint8_t)(x87 >> 22); + x90 = (x47 + (uint32_t)x89); + x91 = (x46 + x90); + x92 = (x45 + x91); + x93 = (x92 & UINT32_C(0x3fffff)); + x94 = (uint8_t)(x92 >> 22); + x95 = (x44 + (uint32_t)x94); + x96 = (x43 + x95); + x97 = (x42 + x96); + x98 = (x97 & UINT32_C(0x7fffff)); + x99 = (uint8_t)(x97 >> 23); + x100 = (x41 + (uint32_t)x99); + x101 = (x40 + x100); + x102 = (x39 + x101); + x103 = (x102 & UINT32_C(0x3fffff)); + x104 = (uint8_t)(x102 >> 22); + x105 = (x38 + (uint32_t)x104); + x106 = (x37 + x105); + x107 = (x106 & UINT32_C(0x3fffff)); + x108 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x106 >> 22); + x109 = (x36 + (uint32_t)x108); + x110 = (x35 + x109); + x111 = (x34 + x110); + x112 = (x111 & UINT32_C(0x3fffff)); + x113 = (uint8_t)(x111 >> 22); + x114 = (x33 + (uint32_t)x113); + x115 = (x32 + x114); + x116 = (x31 + x115); + x117 = (x116 & UINT32_C(0x7fffff)); + x118 = (uint8_t)(x116 >> 23); + x119 = (x30 + (uint32_t)x118); + x120 = (x29 + x119); + x121 = (x28 + x120); + x122 = (x121 & UINT32_C(0x3fffff)); + x123 = (uint8_t)(x121 >> 22); + x124 = (x27 + (uint32_t)x123); + x125 = (x26 + x124); + x126 = (x24 + (uint32_t)x25); + x127 = (x23 + x126); + x128 = (x127 & UINT32_C(0x3fffff)); + x129 = (uint8_t)(x127 >> 22); + x130 = (x22 + (uint32_t)x129); + x131 = (x21 + x130); + x132 = (x20 + x131); + x133 = (x132 & UINT32_C(0x7fffff)); + x134 = (uint8_t)(x132 >> 23); + x135 = (x19 + (uint32_t)x134); + x136 = (x18 + x135); + x137 = (x17 + x136); + x138 = (x137 & UINT32_C(0x3fffff)); + x139 = (uint8_t)(x137 >> 22); + x140 = (x16 + (uint32_t)x139); + x141 = (x15 + x140); + x142 = (x14 + x141); + x143 = (x142 & UINT32_C(0x3fffff)); + x144 = (uint8_t)(x142 >> 22); + x145 = (x13 + (uint32_t)x144); + x146 = (x12 + x145); + x147 = (x146 & UINT32_C(0x3fffff)); + x148 = (fiat_id_tc26_gost_3410_2012_512_paramSetC_uint1)(x146 >> 22); + x149 = (x11 + (uint32_t)x148); + x150 = (x10 + x149); + x151 = (x9 + x150); + x152 = (x151 & UINT32_C(0x7fffff)); + x153 = (uint8_t)(x151 >> 23); + x154 = (x8 + (uint32_t)x153); + x155 = (x7 + x154); + x156 = (x6 + x155); + x157 = (x156 & UINT32_C(0x3fffff)); + x158 = (uint8_t)(x156 >> 22); + x159 = (x5 + (uint32_t)x158); + x160 = (x4 + x159); + x161 = (x3 + x160); + x162 = (x161 & UINT32_C(0x3fffff)); + x163 = (uint8_t)(x161 >> 22); + x164 = (x2 + (uint32_t)x163); + x165 = (x1 + x164); out1[0] = x67; - out1[1] = x92; - out1[2] = x95; - out1[3] = x98; - out1[4] = x100; - out1[5] = x102; - out1[6] = x105; - out1[7] = x108; - out1[8] = x111; - out1[9] = x114; - out1[10] = x117; - out1[11] = x120; - out1[12] = x123; + out1[1] = x72; + out1[2] = x77; + out1[3] = x82; + out1[4] = x85; + out1[5] = x88; + out1[6] = x93; + out1[7] = x98; + out1[8] = x103; + out1[9] = x107; + out1[10] = x112; + out1[11] = x117; + out1[12] = x122; out1[13] = x125; - out1[14] = x127; - out1[15] = x130; - out1[16] = x133; - out1[17] = x136; - out1[18] = x139; - out1[19] = x142; - out1[20] = x145; - out1[21] = x148; - out1[22] = x149; + out1[14] = x128; + out1[15] = x133; + out1[16] = x138; + out1[17] = x143; + out1[18] = x147; + out1[19] = x152; + out1[20] = x157; + out1[21] = x162; + out1[22] = x165; } /* END verbatim fiat code */ @@ -12111,7 +12291,7 @@ static void scalar_wnaf(int8_t out[513], const unsigned char in[64]) { } /*- - * Simulateous scalar multiplication: interleaved "textbook" wnaf. + * Simultaneous scalar multiplication: interleaved "textbook" wnaf. * NB: not constant time */ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], @@ -12119,7 +12299,7 @@ static void var_smul_wnaf_two(pt_aff_t *out, const unsigned char a[64], int i, d, is_neg, is_inf = 1, flipped = 0; int8_t anaf[513] = {0}; int8_t bnaf[513] = {0}; - pt_prj_t Q; + pt_prj_t Q = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -12193,7 +12373,7 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], const pt_aff_t *P) { int i, j, d, diff, is_neg; int8_t rnaf[103] = {0}; - pt_prj_t Q, lut; + pt_prj_t Q = {0}, lut = {0}; pt_prj_t precomp[DRADIX / 2]; precomp_wnaf(precomp, P); @@ -12281,8 +12461,8 @@ static void var_smul_rwnaf(pt_aff_t *out, const unsigned char scalar[64], static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { int i, j, k, d, diff, is_neg = 0; int8_t rnaf[103] = {0}; - pt_prj_t Q, R; - pt_aff_t lut; + pt_prj_t Q = {0}, R = {0}; + pt_aff_t lut = {0}; scalar_rwnaf(rnaf, scalar); @@ -12354,6 +12534,12 @@ static void fixed_smul_cmb(pt_aff_t *out, const unsigned char scalar[64]) { fiat_id_tc26_gost_3410_2012_512_paramSetC_carry_mul(out->Y, Q.Y, Q.Z); } +/*- + * Wrapper: simultaneous scalar mutiplication. + * outx, outy := a * G + b * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], const unsigned char a[64], const unsigned char b[64], const unsigned char inx[64], @@ -12369,6 +12555,11 @@ static void point_mul_two(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes(outy, P.Y); } +/*- + * Wrapper: fixed scalar mutiplication. + * outx, outy := scalar * G + * Everything is LE byte ordering. + */ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64]) { pt_aff_t P; @@ -12379,6 +12570,12 @@ static void point_mul_g(unsigned char outx[64], unsigned char outy[64], fiat_id_tc26_gost_3410_2012_512_paramSetC_to_bytes(outy, P.Y); } +/*- + * Wrapper: variable point scalar mutiplication. + * outx, outy := scalar * P + * where P = (inx, iny). + * Everything is LE byte ordering. + */ static void point_mul(unsigned char outx[64], unsigned char outy[64], const unsigned char scalar[64], const unsigned char inx[64], @@ -12396,8 +12593,13 @@ static void point_mul(unsigned char outx[64], unsigned char outy[64], #include +/* the zero field element */ static const unsigned char const_zb[64] = {0}; +/*- + * An OpenSSL wrapper for simultaneous scalar multiplication. + * r := n * G + m * q + */ int point_mul_two_id_tc26_gost_3410_2012_512_paramSetC( const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, @@ -12436,6 +12638,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for variable point scalar multiplication. + * r := m * q + */ int point_mul_id_tc26_gost_3410_2012_512_paramSetC(const EC_GROUP *group, EC_POINT *r, @@ -12475,6 +12681,10 @@ err: return ret; } +/*- + * An OpenSSL wrapper for fixed scalar multiplication. + * r := n * G + */ int point_mul_g_id_tc26_gost_3410_2012_512_paramSetC(const EC_GROUP *group, EC_POINT *r,