ceremonyclient/ec/bls48581/ECP.go

1851 lines
29 KiB
Go
Raw Normal View History

2023-04-15 04:05:26 +00:00
/*
* Copyright (c) 2012-2020 MIRACL UK Ltd.
*
* This file is part of MIRACL Core
* (see https://github.com/miracl/core).
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package bls48581
//import "fmt"
/* Elliptic Curve Point Structure */
type ECP struct {
x *FP
y *FP
z *FP
}
/* Constructors */
func NewECP() *ECP {
E := new(ECP)
E.x = NewFP()
E.y = NewFPint(1)
if CURVETYPE == EDWARDS {
E.z = NewFPint(1)
} else {
E.z = NewFP()
}
return E
}
/* set (x,y) from two BIGs */
func NewECPbigs(ix *BIG, iy *BIG) *ECP {
E := new(ECP)
E.x = NewFPbig(ix)
E.y = NewFPbig(iy)
E.z = NewFPint(1)
E.x.norm()
rhs := RHS(E.x)
if CURVETYPE == MONTGOMERY {
if rhs.qr(nil) != 1 {
E.inf()
}
} else {
y2 := NewFPcopy(E.y)
y2.sqr()
if !y2.Equals(rhs) {
E.inf()
}
}
return E
}
/* set (x,y) from BIG and a bit */
func NewECPbigint(ix *BIG, s int) *ECP {
E := new(ECP)
E.x = NewFPbig(ix)
E.y = NewFP()
E.x.norm()
rhs := RHS(E.x)
E.z = NewFPint(1)
hint := NewFP()
if rhs.qr(hint) == 1 {
ny := rhs.sqrt(hint)
if ny.sign() != s {
ny.neg()
ny.norm()
}
E.y.copy(ny)
} else {
E.inf()
}
return E
}
/* set from x - calculate y from curve equation */
func NewECPbig(ix *BIG) *ECP {
E := new(ECP)
E.x = NewFPbig(ix)
E.y = NewFP()
E.x.norm()
rhs := RHS(E.x)
E.z = NewFPint(1)
hint := NewFP()
if rhs.qr(hint) == 1 {
if CURVETYPE != MONTGOMERY {
E.y.copy(rhs.sqrt(hint))
}
} else {
E.inf()
}
return E
}
/* test for O point-at-infinity */
func (E *ECP) Is_infinity() bool {
// if E.INF {return true}
if CURVETYPE == EDWARDS {
return (E.x.iszilch() && E.y.Equals(E.z))
}
if CURVETYPE == WEIERSTRASS {
return (E.x.iszilch() && E.z.iszilch())
}
if CURVETYPE == MONTGOMERY {
return E.z.iszilch()
}
return true
}
/* Conditional swap of P and Q dependant on d */
func (E *ECP) cswap(Q *ECP, d int) {
E.x.cswap(Q.x, d)
if CURVETYPE != MONTGOMERY {
E.y.cswap(Q.y, d)
}
E.z.cswap(Q.z, d)
}
/* Conditional move of Q to P dependant on d */
func (E *ECP) cmove(Q *ECP, d int) {
E.x.cmove(Q.x, d)
if CURVETYPE != MONTGOMERY {
E.y.cmove(Q.y, d)
}
E.z.cmove(Q.z, d)
}
/* return 1 if b==c, no branching */
func teq(b int32, c int32) int {
x := b ^ c
x -= 1 // if x=0, x now -1
return int((x >> 31) & 1)
}
/* this=P */
func (E *ECP) Copy(P *ECP) {
E.x.copy(P.x)
if CURVETYPE != MONTGOMERY {
E.y.copy(P.y)
}
E.z.copy(P.z)
}
/* this=-this */
func (E *ECP) Neg() {
if CURVETYPE == WEIERSTRASS {
E.y.neg()
E.y.norm()
}
if CURVETYPE == EDWARDS {
E.x.neg()
E.x.norm()
}
return
}
/* Constant time select from pre-computed table */
func (E *ECP) selector(W []*ECP, b int32) {
MP := NewECP()
m := b >> 31
babs := (b ^ m) - m
babs = (babs - 1) / 2
E.cmove(W[0], teq(babs, 0)) // conditional move
E.cmove(W[1], teq(babs, 1))
E.cmove(W[2], teq(babs, 2))
E.cmove(W[3], teq(babs, 3))
E.cmove(W[4], teq(babs, 4))
E.cmove(W[5], teq(babs, 5))
E.cmove(W[6], teq(babs, 6))
E.cmove(W[7], teq(babs, 7))
MP.Copy(E)
MP.Neg()
E.cmove(MP, int(m&1))
}
/* set this=O */
func (E *ECP) inf() {
E.x.zero()
if CURVETYPE != MONTGOMERY {
E.y.one()
}
if CURVETYPE != EDWARDS {
E.z.zero()
} else {
E.z.one()
}
}
/* Test P == Q */
func (E *ECP) Equals(Q *ECP) bool {
a := NewFP()
b := NewFP()
a.copy(E.x)
a.mul(Q.z)
a.reduce()
b.copy(Q.x)
b.mul(E.z)
b.reduce()
if !a.Equals(b) {
return false
}
if CURVETYPE != MONTGOMERY {
a.copy(E.y)
a.mul(Q.z)
a.reduce()
b.copy(Q.y)
b.mul(E.z)
b.reduce()
if !a.Equals(b) {
return false
}
}
return true
}
/* Calculate RHS of curve equation */
func RHS(x *FP) *FP {
r := NewFPcopy(x)
r.sqr()
if CURVETYPE == WEIERSTRASS { // x^3+Ax+B
b := NewFPbig(NewBIGints(CURVE_B))
r.mul(x)
if CURVE_A == -3 {
cx := NewFPcopy(x)
cx.imul(3)
cx.neg()
cx.norm()
r.add(cx)
}
r.add(b)
}
if CURVETYPE == EDWARDS { // (Ax^2-1)/(Bx^2-1)
b := NewFPbig(NewBIGints(CURVE_B))
one := NewFPint(1)
b.mul(r)
b.sub(one)
b.norm()
if CURVE_A == -1 {
r.neg()
}
r.sub(one)
r.norm()
b.inverse(nil)
r.mul(b)
}
if CURVETYPE == MONTGOMERY { // x^3+Ax^2+x
x3 := NewFP()
x3.copy(r)
x3.mul(x)
r.imul(CURVE_A)
r.add(x3)
r.add(x)
}
r.reduce()
return r
}
/* set to affine - from (x,y,z) to (x,y) */
func (E *ECP) Affine() {
if E.Is_infinity() {
return
}
one := NewFPint(1)
if E.z.Equals(one) {
return
}
E.z.inverse(nil)
E.x.mul(E.z)
E.x.reduce()
if CURVETYPE != MONTGOMERY {
E.y.mul(E.z)
E.y.reduce()
}
E.z.copy(one)
}
/* extract x as a BIG */
func (E *ECP) GetX() *BIG {
W := NewECP()
W.Copy(E)
W.Affine()
return W.x.redc()
}
/* extract y as a BIG */
func (E *ECP) GetY() *BIG {
W := NewECP()
W.Copy(E)
W.Affine()
return W.y.redc()
}
/* get sign of Y */
func (E *ECP) GetS() int {
W := NewECP()
W.Copy(E)
W.Affine()
return W.y.sign()
}
/* extract x as an FP */
func (E *ECP) getx() *FP {
return E.x
}
/* extract y as an FP */
func (E *ECP) gety() *FP {
return E.y
}
/* extract z as an FP */
func (E *ECP) getz() *FP {
return E.z
}
/* convert to byte array */
func (E *ECP) ToBytes(b []byte, compress bool) {
var t [int(MODBYTES)]byte
MB := int(MODBYTES)
alt := false
W := NewECP()
W.Copy(E)
W.Affine()
W.x.redc().ToBytes(t[:])
if CURVETYPE == MONTGOMERY {
for i := 0; i < MB; i++ {
b[i] = t[i]
}
//b[0] = 0x06
return
}
if (MODBITS-1)%8 <= 4 && ALLOW_ALT_COMPRESS {
alt = true
}
if alt {
for i := 0; i < MB; i++ {
b[i] = t[i]
}
if compress {
b[0] |= 0x80
if W.y.islarger() == 1 {
b[0] |= 0x20
}
} else {
W.y.redc().ToBytes(t[:])
for i := 0; i < MB; i++ {
b[i+MB] = t[i]
}
}
} else {
for i := 0; i < MB; i++ {
b[i+1] = t[i]
}
if compress {
b[0] = 0x02
if W.y.sign() == 1 {
b[0] = 0x03
}
return
}
b[0] = 0x04
W.y.redc().ToBytes(t[:])
for i := 0; i < MB; i++ {
b[i+MB+1] = t[i]
}
}
}
/* convert from byte array to point */
func ECP_fromBytes(b []byte) *ECP {
var t [int(MODBYTES)]byte
MB := int(MODBYTES)
p := NewBIGints(Modulus)
alt := false
if CURVETYPE == MONTGOMERY {
for i := 0; i < MB; i++ {
t[i] = b[i]
}
px := FromBytes(t[:])
if Comp(px, p) >= 0 {
return NewECP()
}
return NewECPbig(px)
}
if (MODBITS-1)%8 <= 4 && ALLOW_ALT_COMPRESS {
alt = true
}
if alt {
for i := 0; i < MB; i++ {
t[i] = b[i]
}
t[0] &= 0x1f
px := FromBytes(t[:])
if (b[0] & 0x80) == 0 {
for i := 0; i < MB; i++ {
t[i] = b[i+MB]
}
py := FromBytes(t[:])
return NewECPbigs(px, py)
} else {
sgn := (b[0] & 0x20) >> 5
P := NewECPbigint(px, 0)
cmp := P.y.islarger()
if (sgn == 1 && cmp != 1) || (sgn == 0 && cmp == 1) {
P.Neg()
}
return P
}
} else {
for i := 0; i < MB; i++ {
t[i] = b[i+1]
}
px := FromBytes(t[:])
if Comp(px, p) >= 0 {
return NewECP()
}
if b[0] == 0x04 {
for i := 0; i < MB; i++ {
t[i] = b[i+MB+1]
}
py := FromBytes(t[:])
if Comp(py, p) >= 0 {
return NewECP()
}
return NewECPbigs(px, py)
}
if b[0] == 0x02 || b[0] == 0x03 {
return NewECPbigint(px, int(b[0]&1))
}
}
return NewECP()
}
/* convert to hex string */
func (E *ECP) ToString() string {
W := NewECP()
W.Copy(E)
W.Affine()
if W.Is_infinity() {
return "infinity"
}
if CURVETYPE == MONTGOMERY {
return "(" + W.x.redc().ToString() + ")"
} else {
return "(" + W.x.redc().ToString() + "," + W.y.redc().ToString() + ")"
}
}
/* this*=2 */
func (E *ECP) dbl() {
if CURVETYPE == WEIERSTRASS {
if CURVE_A == 0 {
t0 := NewFPcopy(E.y)
t0.sqr()
t1 := NewFPcopy(E.y)
t1.mul(E.z)
t2 := NewFPcopy(E.z)
t2.sqr()
E.z.copy(t0)
E.z.add(t0)
E.z.norm()
E.z.add(E.z)
E.z.add(E.z)
E.z.norm()
t2.imul(3 * CURVE_B_I)
x3 := NewFPcopy(t2)
x3.mul(E.z)
y3 := NewFPcopy(t0)
y3.add(t2)
y3.norm()
E.z.mul(t1)
t1.copy(t2)
t1.add(t2)
t2.add(t1)
t0.sub(t2)
t0.norm()
y3.mul(t0)
y3.add(x3)
t1.copy(E.x)
t1.mul(E.y)
E.x.copy(t0)
E.x.norm()
E.x.mul(t1)
E.x.add(E.x)
E.x.norm()
E.y.copy(y3)
E.y.norm()
} else {
t0 := NewFPcopy(E.x)
t1 := NewFPcopy(E.y)
t2 := NewFPcopy(E.z)
t3 := NewFPcopy(E.x)
z3 := NewFPcopy(E.z)
y3 := NewFP()
x3 := NewFP()
b := NewFP()
if CURVE_B_I == 0 {
b.copy(NewFPbig(NewBIGints(CURVE_B)))
}
t0.sqr() //1 x^2
t1.sqr() //2 y^2
t2.sqr() //3
t3.mul(E.y) //4
t3.add(t3)
t3.norm() //5
z3.mul(E.x) //6
z3.add(z3)
z3.norm() //7
y3.copy(t2)
if CURVE_B_I == 0 {
y3.mul(b)
} else {
y3.imul(CURVE_B_I)
}
y3.sub(z3) //9 ***
x3.copy(y3)
x3.add(y3)
x3.norm() //10
y3.add(x3) //11
x3.copy(t1)
x3.sub(y3)
x3.norm() //12
y3.add(t1)
y3.norm() //13
y3.mul(x3) //14
x3.mul(t3) //15
t3.copy(t2)
t3.add(t2) //16
t2.add(t3) //17
if CURVE_B_I == 0 {
z3.mul(b)
} else {
z3.imul(CURVE_B_I)
}
z3.sub(t2) //19
z3.sub(t0)
z3.norm() //20 ***
t3.copy(z3)
t3.add(z3) //21
z3.add(t3)
z3.norm() //22
t3.copy(t0)
t3.add(t0) //23
t0.add(t3) //24
t0.sub(t2)
t0.norm() //25
t0.mul(z3) //26
y3.add(t0) //27
t0.copy(E.y)
t0.mul(E.z) //28
t0.add(t0)
t0.norm() //29
z3.mul(t0) //30
x3.sub(z3) //x3.norm();//31
t0.add(t0)
t0.norm() //32
t1.add(t1)
t1.norm() //33
z3.copy(t0)
z3.mul(t1) //34
E.x.copy(x3)
E.x.norm()
E.y.copy(y3)
E.y.norm()
E.z.copy(z3)
E.z.norm()
}
}
if CURVETYPE == EDWARDS {
C := NewFPcopy(E.x)
D := NewFPcopy(E.y)
H := NewFPcopy(E.z)
J := NewFP()
E.x.mul(E.y)
E.x.add(E.x)
E.x.norm()
C.sqr()
D.sqr()
if CURVE_A == -1 {
C.neg()
}
E.y.copy(C)
E.y.add(D)
E.y.norm()
H.sqr()
H.add(H)
E.z.copy(E.y)
J.copy(E.y)
J.sub(H)
J.norm()
E.x.mul(J)
C.sub(D)
C.norm()
E.y.mul(C)
E.z.mul(J)
}
if CURVETYPE == MONTGOMERY {
A := NewFPcopy(E.x)
B := NewFPcopy(E.x)
AA := NewFP()
BB := NewFP()
C := NewFP()
A.add(E.z)
A.norm()
AA.copy(A)
AA.sqr()
B.sub(E.z)
B.norm()
BB.copy(B)
BB.sqr()
C.copy(AA)
C.sub(BB)
C.norm()
E.x.copy(AA)
E.x.mul(BB)
A.copy(C)
A.imul((CURVE_A + 2) / 4)
BB.add(A)
BB.norm()
E.z.copy(BB)
E.z.mul(C)
}
return
}
/* this+=Q */
func (E *ECP) Add(Q *ECP) {
if CURVETYPE == WEIERSTRASS {
if CURVE_A == 0 {
b := 3 * CURVE_B_I
t0 := NewFPcopy(E.x)
t0.mul(Q.x)
t1 := NewFPcopy(E.y)
t1.mul(Q.y)
t2 := NewFPcopy(E.z)
t2.mul(Q.z)
t3 := NewFPcopy(E.x)
t3.add(E.y)
t3.norm()
t4 := NewFPcopy(Q.x)
t4.add(Q.y)
t4.norm()
t3.mul(t4)
t4.copy(t0)
t4.add(t1)
t3.sub(t4)
t3.norm()
t4.copy(E.y)
t4.add(E.z)
t4.norm()
x3 := NewFPcopy(Q.y)
x3.add(Q.z)
x3.norm()
t4.mul(x3)
x3.copy(t1)
x3.add(t2)
t4.sub(x3)
t4.norm()
x3.copy(E.x)
x3.add(E.z)
x3.norm()
y3 := NewFPcopy(Q.x)
y3.add(Q.z)
y3.norm()
x3.mul(y3)
y3.copy(t0)
y3.add(t2)
y3.rsub(x3)
y3.norm()
x3.copy(t0)
x3.add(t0)
t0.add(x3)
t0.norm()
t2.imul(b)
z3 := NewFPcopy(t1)
z3.add(t2)
z3.norm()
t1.sub(t2)
t1.norm()
y3.imul(b)
x3.copy(y3)
x3.mul(t4)
t2.copy(t3)
t2.mul(t1)
x3.rsub(t2)
y3.mul(t0)
t1.mul(z3)
y3.add(t1)
t0.mul(t3)
z3.mul(t4)
z3.add(t0)
E.x.copy(x3)
E.x.norm()
E.y.copy(y3)
E.y.norm()
E.z.copy(z3)
E.z.norm()
} else {
t0 := NewFPcopy(E.x)
t1 := NewFPcopy(E.y)
t2 := NewFPcopy(E.z)
t3 := NewFPcopy(E.x)
t4 := NewFPcopy(Q.x)
z3 := NewFP()
y3 := NewFPcopy(Q.x)
x3 := NewFPcopy(Q.y)
b := NewFP()
if CURVE_B_I == 0 {
b.copy(NewFPbig(NewBIGints(CURVE_B)))
}
t0.mul(Q.x) //1
t1.mul(Q.y) //2
t2.mul(Q.z) //3
t3.add(E.y)
t3.norm() //4
t4.add(Q.y)
t4.norm() //5
t3.mul(t4) //6
t4.copy(t0)
t4.add(t1) //7
t3.sub(t4)
t3.norm() //8
t4.copy(E.y)
t4.add(E.z)
t4.norm() //9
x3.add(Q.z)
x3.norm() //10
t4.mul(x3) //11
x3.copy(t1)
x3.add(t2) //12
t4.sub(x3)
t4.norm() //13
x3.copy(E.x)
x3.add(E.z)
x3.norm() //14
y3.add(Q.z)
y3.norm() //15
x3.mul(y3) //16
y3.copy(t0)
y3.add(t2) //17
y3.rsub(x3)
y3.norm() //18
z3.copy(t2)
if CURVE_B_I == 0 {
z3.mul(b)
} else {
z3.imul(CURVE_B_I)
}
x3.copy(y3)
x3.sub(z3)
x3.norm() //20
z3.copy(x3)
z3.add(x3) //21
x3.add(z3) //22
z3.copy(t1)
z3.sub(x3)
z3.norm() //23
x3.add(t1)
x3.norm() //24
if CURVE_B_I == 0 {
y3.mul(b)
} else {
y3.imul(CURVE_B_I)
}
t1.copy(t2)
t1.add(t2) //26
t2.add(t1) //27
y3.sub(t2) //28
y3.sub(t0)
y3.norm() //29
t1.copy(y3)
t1.add(y3) //30
y3.add(t1)
y3.norm() //31
t1.copy(t0)
t1.add(t0) //32
t0.add(t1) //33
t0.sub(t2)
t0.norm() //34
t1.copy(t4)
t1.mul(y3) //35
t2.copy(t0)
t2.mul(y3) //36
y3.copy(x3)
y3.mul(z3) //37
y3.add(t2) //38
x3.mul(t3) //39
x3.sub(t1) //40
z3.mul(t4) //41
t1.copy(t3)
t1.mul(t0) //42
z3.add(t1)
E.x.copy(x3)
E.x.norm()
E.y.copy(y3)
E.y.norm()
E.z.copy(z3)
E.z.norm()
}
}
if CURVETYPE == EDWARDS {
b := NewFPbig(NewBIGints(CURVE_B))
A := NewFPcopy(E.z)
B := NewFP()
C := NewFPcopy(E.x)
D := NewFPcopy(E.y)
EE := NewFP()
F := NewFP()
G := NewFP()
A.mul(Q.z)
B.copy(A)
B.sqr()
C.mul(Q.x)
D.mul(Q.y)
EE.copy(C)
EE.mul(D)
EE.mul(b)
F.copy(B)
F.sub(EE)
G.copy(B)
G.add(EE)
if CURVE_A == 1 {
EE.copy(D)
EE.sub(C)
}
C.add(D)
B.copy(E.x)
B.add(E.y)
D.copy(Q.x)
D.add(Q.y)
B.norm()
D.norm()
B.mul(D)
B.sub(C)
B.norm()
F.norm()
B.mul(F)
E.x.copy(A)
E.x.mul(B)
G.norm()
if CURVE_A == 1 {
EE.norm()
C.copy(EE)
C.mul(G)
}
if CURVE_A == -1 {
C.norm()
C.mul(G)
}
E.y.copy(A)
E.y.mul(C)
E.z.copy(F)
E.z.mul(G)
}
return
}
/* Differential Add for Montgomery curves. this+=Q where W is this-Q and is affine. */
func (E *ECP) dadd(Q *ECP, W *ECP) {
A := NewFPcopy(E.x)
B := NewFPcopy(E.x)
C := NewFPcopy(Q.x)
D := NewFPcopy(Q.x)
DA := NewFP()
CB := NewFP()
A.add(E.z)
B.sub(E.z)
C.add(Q.z)
D.sub(Q.z)
A.norm()
D.norm()
DA.copy(D)
DA.mul(A)
C.norm()
B.norm()
CB.copy(C)
CB.mul(B)
A.copy(DA)
A.add(CB)
A.norm()
A.sqr()
B.copy(DA)
B.sub(CB)
B.norm()
B.sqr()
E.x.copy(A)
E.z.copy(W.x)
E.z.mul(B)
}
/* this-=Q */
func (E *ECP) Sub(Q *ECP) {
NQ := NewECP()
NQ.Copy(Q)
NQ.Neg()
E.Add(NQ)
}
/* constant time multiply by small integer of length bts - use ladder */
func (E *ECP) pinmul(e int32, bts int32) *ECP {
if CURVETYPE == MONTGOMERY {
return E.mul(NewBIGint(int(e)))
} else {
P := NewECP()
R0 := NewECP()
R1 := NewECP()
R1.Copy(E)
for i := bts - 1; i >= 0; i-- {
b := int((e >> uint32(i)) & 1)
P.Copy(R1)
P.Add(R0)
R0.cswap(R1, b)
R1.Copy(P)
R0.dbl()
R0.cswap(R1, b)
}
P.Copy(R0)
return P
}
}
// Point multiplication, multiplies a point P by a scalar e
// This code has no inherent awareness of the order of the curve, or the order of the point.
// The order of the curve will be h.r, where h is a cofactor, and r is a large prime
// Typically P will be of order r (but not always), and typically e will be less than r (but not always)
// A problem can arise if a secret e is a few bits less than r, as the leading zeros in e will leak via a timing attack
// The secret e may however be greater than r (see RFC7748 which combines elimination of a small cofactor h with the point multiplication, using an e>r)
// Our solution is to use as a multiplier an e, whose length in bits is that of the logical OR of e and r, hence allowing e>r while forcing inclusion of leading zeros if e<r.
// The point multiplication methods used will process leading zeros correctly.
// So this function leaks information about the length of e...
func (E *ECP) mul(e *BIG) *ECP {
return E.clmul(e, e)
}
// .. but this one does not (typically set maxe=r)
// Set P=e*P
/* return e.this */
func (E *ECP) clmul(e *BIG, maxe *BIG) *ECP {
if e.iszilch() || E.Is_infinity() {
return NewECP()
}
P := NewECP()
cm := NewBIGcopy(e)
cm.or(maxe)
max := cm.nbits()
if CURVETYPE == MONTGOMERY {
/* use Ladder */
D := NewECP()
R0 := NewECP()
R0.Copy(E)
R1 := NewECP()
R1.Copy(E)
R1.dbl()
D.Copy(E)
D.Affine()
nb := max
for i := nb - 2; i >= 0; i-- {
b := int(e.bit(i))
P.Copy(R1)
P.dadd(R0, D)
R0.cswap(R1, b)
R1.Copy(P)
R0.dbl()
R0.cswap(R1, b)
}
P.Copy(R0)
} else {
// fixed size windows
mt := NewBIG()
t := NewBIG()
Q := NewECP()
C := NewECP()
var W []*ECP
var w [1 + (NLEN*int(BASEBITS)+3)/4]int8
Q.Copy(E)
Q.dbl()
W = append(W, NewECP())
W[0].Copy(E)
for i := 1; i < 8; i++ {
W = append(W, NewECP())
W[i].Copy(W[i-1])
W[i].Add(Q)
}
// make exponent odd - add 2P if even, P if odd
t.copy(e)
s := int(t.parity())
t.inc(1)
t.norm()
ns := int(t.parity())
mt.copy(t)
mt.inc(1)
mt.norm()
t.cmove(mt, s)
Q.cmove(E, ns)
C.Copy(Q)
nb := 1 + (max+3)/4
// convert exponent to signed 4-bit window
for i := 0; i < nb; i++ {
w[i] = int8(t.lastbits(5) - 16)
t.dec(int(w[i]))
t.norm()
t.fshr(4)
}
w[nb] = int8(t.lastbits(5))
//P.Copy(W[(int(w[nb])-1)/2])
P.selector(W, int32(w[nb]))
for i := nb - 1; i >= 0; i-- {
Q.selector(W, int32(w[i]))
P.dbl()
P.dbl()
P.dbl()
P.dbl()
P.Add(Q)
}
P.Sub(C) /* apply correction */
}
return P
}
/* Public version */
func (E *ECP) Mul(e *BIG) *ECP {
return E.mul(e)
}
// Generic multi-multiplication, fixed 4-bit window, P=Sigma e_i*X_i
func ECP_muln(n int, X []*ECP, e []*BIG) *ECP {
P := NewECP()
R := NewECP()
S := NewECP()
var B []*ECP
t := NewBIG()
for i := 0; i < 16; i++ {
B = append(B, NewECP())
}
mt := NewBIGcopy(e[0])
mt.norm()
for i := 1; i < n; i++ { // find biggest
t.copy(e[i])
t.norm()
k := Comp(t, mt)
mt.cmove(t, (k+1)/2)
}
nb := (mt.nbits() + 3) / 4
for i := nb - 1; i >= 0; i-- {
for j := 0; j < 16; j++ {
B[j].inf()
}
for j := 0; j < n; j++ {
mt.copy(e[j])
mt.norm()
mt.shr(uint(i * 4))
k := mt.lastbits(4)
B[k].Add(X[j])
}
R.inf()
S.inf()
for j := 15; j >= 1; j-- {
R.Add(B[j])
S.Add(R)
}
for j := 0; j < 4; j++ {
P.dbl()
}
P.Add(S)
}
return P
}
/* Return e.this+f.Q */
func (E *ECP) Mul2(e *BIG, Q *ECP, f *BIG) *ECP {
te := NewBIG()
tf := NewBIG()
mt := NewBIG()
S := NewECP()
T := NewECP()
C := NewECP()
var W []*ECP
var w [1 + (NLEN*int(BASEBITS)+1)/2]int8
te.copy(e)
tf.copy(f)
// precompute table
for i := 0; i < 8; i++ {
W = append(W, NewECP())
}
W[1].Copy(E)
W[1].Sub(Q)
W[2].Copy(E)
W[2].Add(Q)
S.Copy(Q)
S.dbl()
W[0].Copy(W[1])
W[0].Sub(S)
W[3].Copy(W[2])
W[3].Add(S)
T.Copy(E)
T.dbl()
W[5].Copy(W[1])
W[5].Add(T)
W[6].Copy(W[2])
W[6].Add(T)
W[4].Copy(W[5])
W[4].Sub(S)
W[7].Copy(W[6])
W[7].Add(S)
// if multiplier is odd, add 2, else add 1 to multiplier, and add 2P or P to correction
s := int(te.parity())
te.inc(1)
te.norm()
ns := int(te.parity())
mt.copy(te)
mt.inc(1)
mt.norm()
te.cmove(mt, s)
T.cmove(E, ns)
C.Copy(T)
s = int(tf.parity())
tf.inc(1)
tf.norm()
ns = int(tf.parity())
mt.copy(tf)
mt.inc(1)
mt.norm()
tf.cmove(mt, s)
S.cmove(Q, ns)
C.Add(S)
mt.copy(te)
mt.add(tf)
mt.norm()
nb := 1 + (mt.nbits()+1)/2
// convert exponent to signed 2-bit window
for i := 0; i < nb; i++ {
a := (te.lastbits(3) - 4)
te.dec(int(a))
te.norm()
te.fshr(2)
b := (tf.lastbits(3) - 4)
tf.dec(int(b))
tf.norm()
tf.fshr(2)
w[i] = int8(4*a + b)
}
w[nb] = int8(4*te.lastbits(3) + tf.lastbits(3))
//S.Copy(W[(w[nb]-1)/2])
S.selector(W, int32(w[nb]))
for i := nb - 1; i >= 0; i-- {
T.selector(W, int32(w[i]))
S.dbl()
S.dbl()
S.Add(T)
}
S.Sub(C) /* apply correction */
return S
}
func (E *ECP) Cfp() {
cf := CURVE_Cof_I
if cf == 1 {
return
}
if cf == 4 {
E.dbl()
E.dbl()
return
}
if cf == 8 {
E.dbl()
E.dbl()
E.dbl()
return
}
c := NewBIGints(CURVE_Cof)
E.Copy(E.mul(c))
}
/* Hunt and Peck a BIG to a curve point */
func ECP_hap2point(h *BIG) *ECP {
var P *ECP
x := NewBIGcopy(h)
for true {
if CURVETYPE != MONTGOMERY {
P = NewECPbigint(x, 0)
} else {
P = NewECPbig(x)
}
x.inc(1)
x.norm()
if !P.Is_infinity() {
break
}
}
return P
}
/* Constant time Map to Point */
func ECP_map2point(h *FP) *ECP {
P := NewECP()
if CURVETYPE == MONTGOMERY {
// Elligator 2
X1 := NewFP()
X2 := NewFP()
w := NewFP()
one := NewFPint(1)
A := NewFPint(CURVE_A)
t := NewFPcopy(h)
N := NewFP()
D := NewFP()
hint := NewFP()
t.sqr()
if PM1D2 == 2 {
t.add(t)
}
if PM1D2 == 1 {
t.neg()
}
if PM1D2 > 2 {
t.imul(QNRI)
}
t.norm()
D.copy(t)
D.add(one)
D.norm()
X1.copy(A)
X1.neg()
X1.norm()
X2.copy(X1)
X2.mul(t)
w.copy(X1)
w.sqr()
N.copy(w)
N.mul(X1)
w.mul(A)
w.mul(D)
N.add(w)
t.copy(D)
t.sqr()
t.mul(X1)
N.add(t)
N.norm()
t.copy(N)
t.mul(D)
qres := t.qr(hint)
w.copy(t)
w.inverse(hint)
D.copy(w)
D.mul(N)
X1.mul(D)
X2.mul(D)
X1.cmove(X2, 1-qres)
a := X1.redc()
P.Copy(NewECPbig(a))
}
if CURVETYPE == EDWARDS {
// Elligator 2 - map to Montgomery, place point, map back
X1 := NewFP()
X2 := NewFP()
t := NewFPcopy(h)
w := NewFP()
one := NewFPint(1)
A := NewFP()
w1 := NewFP()
w2 := NewFP()
B := NewFPbig(NewBIGints(CURVE_B))
Y := NewFP()
K := NewFP()
D := NewFP()
hint := NewFP()
//Y3:=NewFP()
rfc := 0
if MODTYPE != GENERALISED_MERSENNE {
A.copy(B)
if CURVE_A == 1 {
A.add(one)
B.sub(one)
} else {
A.sub(one)
B.add(one)
}
A.norm()
B.norm()
A.div2()
B.div2()
B.div2()
K.copy(B)
K.neg()
K.norm()
//K.inverse(nil)
K.invsqrt(K, w1)
rfc = RIADZ
if rfc == 1 { // RFC7748
A.mul(K)
K.mul(w1)
//K=K.sqrt(nil)
} else {
B.sqr()
}
} else {
rfc = 1
A.copy(NewFPint(156326))
}
t.sqr()
qnr := 0
if PM1D2 == 2 {
t.add(t)
qnr = 2
}
if PM1D2 == 1 {
t.neg()
qnr = -1
}
if PM1D2 > 2 {
t.imul(QNRI)
qnr = QNRI
}
t.norm()
D.copy(t)
D.add(one)
D.norm()
X1.copy(A)
X1.neg()
X1.norm()
X2.copy(X1)
X2.mul(t)
// Figure out RHS of Montgomery curve in rational form gx1/d^3
w.copy(X1)
w.sqr()
w1.copy(w)
w1.mul(X1)
w.mul(A)
w.mul(D)
w1.add(w)
w2.copy(D)
w2.sqr()
if rfc == 0 {
w.copy(X1)
w.mul(B)
w2.mul(w)
w1.add(w2)
} else {
w2.mul(X1)
w1.add(w2)
}
w1.norm()
B.copy(w1)
B.mul(D)
qres := B.qr(hint)
w.copy(B)
w.inverse(hint)
D.copy(w)
D.mul(w1)
X1.mul(D)
X2.mul(D)
D.sqr()
w1.copy(B)
w1.imul(qnr)
w.copy(NewFPbig(NewBIGints(CURVE_HTPC)))
w.mul(hint)
w2.copy(D)
w2.mul(h)
X1.cmove(X2, 1-qres)
B.cmove(w1, 1-qres)
hint.cmove(w, 1-qres)
D.cmove(w2, 1-qres)
Y.copy(B.sqrt(hint))
Y.mul(D)
/*
Y.copy(B.sqrt(hint))
Y.mul(D)
B.imul(qnr)
w.copy(NewFPbig(NewBIGints(CURVE_HTPC)))
hint.mul(w)
Y3.copy(B.sqrt(hint))
D.mul(h)
Y3.mul(D)
X1.cmove(X2,1-qres)
Y.cmove(Y3,1-qres)
*/
w.copy(Y)
w.neg()
w.norm()
Y.cmove(w, qres^Y.sign())
if rfc == 0 {
X1.mul(K)
Y.mul(K)
}
if MODTYPE == GENERALISED_MERSENNE {
t.copy(X1)
t.sqr()
w.copy(t)
w.add(one)
w.norm()
t.sub(one)
t.norm()
w1.copy(t)
w1.mul(Y)
w1.add(w1)
X2.copy(w1)
X2.add(w1)
X2.norm()
t.sqr()
Y.sqr()
Y.add(Y)
Y.add(Y)
Y.norm()
B.copy(t)
B.add(Y)
B.norm()
w2.copy(Y)
w2.sub(t)
w2.norm()
w2.mul(X1)
t.mul(X1)
Y.div2()
w1.copy(Y)
w1.mul(w)
w1.rsub(t)
w1.norm()
t.copy(X2)
t.mul(w1)
P.x.copy(t)
t.copy(w2)
t.mul(B)
P.y.copy(t)
t.copy(w1)
t.mul(B)
P.z.copy(t)
return P
} else {
w1.copy(X1)
w1.add(one)
w1.norm()
w2.copy(X1)
w2.sub(one)
w2.norm()
t.copy(w1)
t.mul(Y)
X1.mul(w1)
if rfc == 1 {
X1.mul(K)
}
Y.mul(w2)
P.x.copy(X1)
P.y.copy(Y)
P.z.copy(t)
return P
}
}
if CURVETYPE == WEIERSTRASS {
// swu method
A := NewFP()
B := NewFP()
X1 := NewFP()
X2 := NewFP()
X3 := NewFP()
one := NewFPint(1)
Y := NewFP()
D := NewFP()
t := NewFPcopy(h)
w := NewFP()
D2 := NewFP()
hint := NewFP()
GX1 := NewFP()
//Y3:=NewFP()
sgn := t.sign()
if CURVE_A != 0 || HTC_ISO != 0 {
if HTC_ISO != 0 {
/* CAHCZS
A.copy(NewFPbig(NewBIGints(CURVE_Ad)))
B.copy(NewFPbig(NewBIGints(CURVE_Bd)))
CAHCZF */
} else {
A.copy(NewFPint(CURVE_A))
B.copy(NewFPbig(NewBIGints(CURVE_B)))
}
// SSWU method
t.sqr()
t.imul(RIADZ)
w.copy(t)
w.add(one)
w.norm()
w.mul(t)
D.copy(A)
D.mul(w)
w.add(one)
w.norm()
w.mul(B)
w.neg()
w.norm()
X2.copy(w)
X3.copy(t)
X3.mul(X2)
// x^3+Ad^2x+Bd^3
GX1.copy(X2)
GX1.sqr()
D2.copy(D)
D2.sqr()
w.copy(A)
w.mul(D2)
GX1.add(w)
GX1.norm()
GX1.mul(X2)
D2.mul(D)
w.copy(B)
w.mul(D2)
GX1.add(w)
GX1.norm()
w.copy(GX1)
w.mul(D)
qr := w.qr(hint)
D.copy(w)
D.inverse(hint)
D.mul(GX1)
X2.mul(D)
X3.mul(D)
t.mul(h)
D2.copy(D)
D2.sqr()
D.copy(D2)
D.mul(t)
t.copy(w)
t.imul(RIADZ)
X1.copy(NewFPbig(NewBIGints(CURVE_HTPC)))
X1.mul(hint)
X2.cmove(X3, 1-qr)
D2.cmove(D, 1-qr)
w.cmove(t, 1-qr)
hint.cmove(X1, 1-qr)
Y.copy(w.sqrt(hint))
Y.mul(D2)
/*
Y.copy(w.sqrt(hint))
Y.mul(D2)
D2.mul(t)
w.imul(RIADZ)
X1.copy(NewFPbig(NewBIGints(CURVE_HTPC)))
hint.mul(X1)
Y3.copy(w.sqrt(hint))
Y3.mul(D2)
X2.cmove(X3,1-qr)
Y.cmove(Y3,1-qr)
*/
ne := Y.sign() ^ sgn
w.copy(Y)
w.neg()
w.norm()
Y.cmove(w, ne)
if HTC_ISO != 0 {
/* CAHCZS
k:=0
isox:=HTC_ISO
isoy:=3*(isox-1)/2
//xnum
xnum:=NewFPbig(NewBIGints(PC[k])); k+=1
for i:=0;i<isox;i++ {
xnum.mul(X2)
w.copy(NewFPbig(NewBIGints(PC[k]))); k+=1
xnum.add(w); xnum.norm()
}
//xden
xden:=NewFPcopy(X2)
w.copy(NewFPbig(NewBIGints(PC[k]))); k+=1
xden.add(w);xden.norm();
for i:=0;i<isox-2;i++ {
xden.mul(X2)
w.copy(NewFPbig(NewBIGints(PC[k]))); k+=1
xden.add(w); xden.norm()
}
//ynum
ynum:=NewFPbig(NewBIGints(PC[k])); k+=1
for i:=0;i<isoy;i++ {
ynum.mul(X2)
w.copy(NewFPbig(NewBIGints(PC[k]))); k+=1
ynum.add(w); ynum.norm()
}
yden:=NewFPcopy(X2)
w.copy(NewFPbig(NewBIGints(PC[k]))); k+=1
yden.add(w);yden.norm();
for i:=0;i<isoy-1;i++ {
yden.mul(X2)
w.copy(NewFPbig(NewBIGints(PC[k]))); k+=1
yden.add(w); yden.norm()
}
ynum.mul(Y)
w.copy(xnum); w.mul(yden)
P.x.copy(w)
w.copy(ynum); w.mul(xden)
P.y.copy(w)
w.copy(xden); w.mul(yden)
P.z.copy(w)
return P
CAHCZF */
} else {
x := X2.redc()
y := Y.redc()
P.Copy(NewECPbigs(x, y))
return P
}
} else {
// Shallue and van de Woestijne
// SQRTm3 not available, so preprocess this out
/* */
Z := RIADZ
X1.copy(NewFPint(Z))
X3.copy(X1)
A.copy(RHS(X1))
B.copy(NewFPbig(NewBIGints(SQRTm3)))
B.imul(Z)
t.sqr()
Y.copy(A)
Y.mul(t)
t.copy(one)
t.add(Y)
t.norm()
Y.rsub(one)
Y.norm()
D.copy(t)
D.mul(Y)
D.mul(B)
w.copy(A)
FP_tpo(D, w)
w.mul(B)
if w.sign() == 1 {
w.neg()
w.norm()
}
w.mul(B)
w.mul(h)
w.mul(Y)
w.mul(D)
X1.neg()
X1.norm()
X1.div2()
X2.copy(X1)
X1.sub(w)
X1.norm()
X2.add(w)
X2.norm()
A.add(A)
A.add(A)
A.norm()
t.sqr()
t.mul(D)
t.sqr()
A.mul(t)
X3.add(A)
X3.norm()
rhs := RHS(X2)
X3.cmove(X2, rhs.qr(nil))
rhs.copy(RHS(X1))
X3.cmove(X1, rhs.qr(nil))
rhs.copy(RHS(X3))
Y.copy(rhs.sqrt(nil))
ne := Y.sign() ^ sgn
w.copy(Y)
w.neg()
w.norm()
Y.cmove(w, ne)
x := X3.redc()
y := Y.redc()
P.Copy(NewECPbigs(x, y))
return P
/* */
}
}
return P
}
func ECP_mapit(h []byte) *ECP {
q := NewBIGints(Modulus)
dx := DBIG_fromBytes(h[:])
x := dx.Mod(q)
P := ECP_hap2point(x)
P.Cfp()
return P
}
func ECP_generator() *ECP {
var G *ECP
gx := NewBIGints(CURVE_Gx)
if CURVETYPE != MONTGOMERY {
gy := NewBIGints(CURVE_Gy)
G = NewECPbigs(gx, gy)
} else {
G = NewECPbig(gx)
}
return G
}