core/vm, crypto/bls12381, params: add bls12-381 elliptic curve precompiles (#21018)
* crypto: add bls12-381 elliptic curve wrapper
* params: add bls12-381 precompile gas parameters
* core/vm: add bls12-381 precompiles
* core/vm: add bls12-381 precompile tests
* go.mod, go.sum: use latest bls12381 lib
* core/vm: move point encode/decode functions to base library
* crypto/bls12381: introduce bls12-381 library init function
* crypto/bls12381: import bls12381 elliptic curve implementation
* go.mod, go.sum: remove bls12-381 library
* remove unsued frobenious coeffs
supress warning for inp that used in asm
* add mappings tests for zero inputs
fix swu g2 minus z inverse constant
* crypto/bls12381: fix typo
* crypto/bls12381: better comments for bls12381 constants
* crypto/bls12381: swu, use single conditional for e2
* crypto/bls12381: utils, delete empty line
* crypto/bls12381: utils, use FromHex for string to big
* crypto/bls12381: g1, g2, strict length check for FromBytes
* crypto/bls12381: field_element, comparision changes
* crypto/bls12381: change swu, isogeny constants with hex values
* core/vm: fix point multiplication comments
* core/vm: fix multiexp gas calculation and lookup for g1 and g2
* core/vm: simpler imput length check for multiexp and pairing precompiles
* core/vm: rm empty multiexp result declarations
* crypto/bls12381: remove modulus type definition
* crypto/bls12381: use proper init function
* crypto/bls12381: get rid of new lines at fatal desciprtions
* crypto/bls12-381: fix no-adx assembly multiplication
* crypto/bls12-381: remove old config function
* crypto/bls12381: update multiplication backend
this commit changes mul backend to 6limb eip1962 backend
mul assign operations are dropped
* core/vm/contracts_tests: externalize test vectors for precompiles
* core/vm/contracts_test: externalize failure-cases for precompiles
* core/vm: linting
* go.mod: tiny up sum file
* core/vm: fix goimports linter issues
* crypto/bls12381: build tags for plain ASM or ADX implementation
Co-authored-by: Martin Holst Swende <martin@swende.se>
Co-authored-by: Péter Szilágyi <peterke@gmail.com>
2020-06-03 06:44:32 +00:00
|
|
|
// Native go field arithmetic code is generated with 'goff'
|
|
|
|
|
// https://github.com/ConsenSys/goff
|
|
|
|
|
// Many function signature of field operations are renamed.
|
|
|
|
|
|
|
|
|
|
// Copyright 2020 ConsenSys AG
|
|
|
|
|
//
|
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
|
//
|
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
//
|
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
|
|
// field modulus q =
|
|
|
|
|
//
|
|
|
|
|
// 4002409555221667393417789825735904156556882819939007885332058136124031650490837864442687629129015664037894272559787
|
|
|
|
|
// Code generated by goff DO NOT EDIT
|
|
|
|
|
// goff version: v0.1.0 - build: 790f1f56eac432441e043abff8819eacddd1d668
|
|
|
|
|
// fe are assumed to be in Montgomery form in all methods
|
|
|
|
|
|
|
|
|
|
// /!\ WARNING /!\
|
|
|
|
|
// this code has not been audited and is provided as-is. In particular,
|
|
|
|
|
// there is no security guarantees such as constant time implementation
|
|
|
|
|
// or side-channel attack resistance
|
|
|
|
|
// /!\ WARNING /!\
|
|
|
|
|
|
|
|
|
|
// Package bls (generated by goff) contains field arithmetics operations
|
|
|
|
|
|
|
|
|
|
// +build !amd64 !blsasm,!blsadx
|
|
|
|
|
|
|
|
|
|
package bls12381
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
|
"math/bits"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
func add(z, x, y *fe) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
|
|
|
|
|
z[0], carry = bits.Add64(x[0], y[0], 0)
|
|
|
|
|
z[1], carry = bits.Add64(x[1], y[1], carry)
|
|
|
|
|
z[2], carry = bits.Add64(x[2], y[2], carry)
|
|
|
|
|
z[3], carry = bits.Add64(x[3], y[3], carry)
|
|
|
|
|
z[4], carry = bits.Add64(x[4], y[4], carry)
|
|
|
|
|
z[5], _ = bits.Add64(x[5], y[5], carry)
|
|
|
|
|
|
|
|
|
|
// if z > q --> z -= q
|
|
|
|
|
// note: this is NOT constant time
|
|
|
|
|
if !(z[5] < 1873798617647539866 || (z[5] == 1873798617647539866 && (z[4] < 5412103778470702295 || (z[4] == 5412103778470702295 && (z[3] < 7239337960414712511 || (z[3] == 7239337960414712511 && (z[2] < 7435674573564081700 || (z[2] == 7435674573564081700 && (z[1] < 2210141511517208575 || (z[1] == 2210141511517208575 && (z[0] < 13402431016077863595))))))))))) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(z[0], 13402431016077863595, 0)
|
|
|
|
|
z[1], b = bits.Sub64(z[1], 2210141511517208575, b)
|
|
|
|
|
z[2], b = bits.Sub64(z[2], 7435674573564081700, b)
|
|
|
|
|
z[3], b = bits.Sub64(z[3], 7239337960414712511, b)
|
|
|
|
|
z[4], b = bits.Sub64(z[4], 5412103778470702295, b)
|
|
|
|
|
z[5], _ = bits.Sub64(z[5], 1873798617647539866, b)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func addAssign(x, y *fe) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
|
|
|
|
|
x[0], carry = bits.Add64(x[0], y[0], 0)
|
|
|
|
|
x[1], carry = bits.Add64(x[1], y[1], carry)
|
|
|
|
|
x[2], carry = bits.Add64(x[2], y[2], carry)
|
|
|
|
|
x[3], carry = bits.Add64(x[3], y[3], carry)
|
|
|
|
|
x[4], carry = bits.Add64(x[4], y[4], carry)
|
|
|
|
|
x[5], _ = bits.Add64(x[5], y[5], carry)
|
|
|
|
|
|
|
|
|
|
// if z > q --> z -= q
|
|
|
|
|
// note: this is NOT constant time
|
|
|
|
|
if !(x[5] < 1873798617647539866 || (x[5] == 1873798617647539866 && (x[4] < 5412103778470702295 || (x[4] == 5412103778470702295 && (x[3] < 7239337960414712511 || (x[3] == 7239337960414712511 && (x[2] < 7435674573564081700 || (x[2] == 7435674573564081700 && (x[1] < 2210141511517208575 || (x[1] == 2210141511517208575 && (x[0] < 13402431016077863595))))))))))) {
|
|
|
|
|
var b uint64
|
|
|
|
|
x[0], b = bits.Sub64(x[0], 13402431016077863595, 0)
|
|
|
|
|
x[1], b = bits.Sub64(x[1], 2210141511517208575, b)
|
|
|
|
|
x[2], b = bits.Sub64(x[2], 7435674573564081700, b)
|
|
|
|
|
x[3], b = bits.Sub64(x[3], 7239337960414712511, b)
|
|
|
|
|
x[4], b = bits.Sub64(x[4], 5412103778470702295, b)
|
|
|
|
|
x[5], _ = bits.Sub64(x[5], 1873798617647539866, b)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func ladd(z, x, y *fe) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
z[0], carry = bits.Add64(x[0], y[0], 0)
|
|
|
|
|
z[1], carry = bits.Add64(x[1], y[1], carry)
|
|
|
|
|
z[2], carry = bits.Add64(x[2], y[2], carry)
|
|
|
|
|
z[3], carry = bits.Add64(x[3], y[3], carry)
|
|
|
|
|
z[4], carry = bits.Add64(x[4], y[4], carry)
|
|
|
|
|
z[5], _ = bits.Add64(x[5], y[5], carry)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func laddAssign(x, y *fe) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
x[0], carry = bits.Add64(x[0], y[0], 0)
|
|
|
|
|
x[1], carry = bits.Add64(x[1], y[1], carry)
|
|
|
|
|
x[2], carry = bits.Add64(x[2], y[2], carry)
|
|
|
|
|
x[3], carry = bits.Add64(x[3], y[3], carry)
|
|
|
|
|
x[4], carry = bits.Add64(x[4], y[4], carry)
|
|
|
|
|
x[5], _ = bits.Add64(x[5], y[5], carry)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func double(z, x *fe) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
|
|
|
|
|
z[0], carry = bits.Add64(x[0], x[0], 0)
|
|
|
|
|
z[1], carry = bits.Add64(x[1], x[1], carry)
|
|
|
|
|
z[2], carry = bits.Add64(x[2], x[2], carry)
|
|
|
|
|
z[3], carry = bits.Add64(x[3], x[3], carry)
|
|
|
|
|
z[4], carry = bits.Add64(x[4], x[4], carry)
|
|
|
|
|
z[5], _ = bits.Add64(x[5], x[5], carry)
|
|
|
|
|
|
|
|
|
|
// if z > q --> z -= q
|
|
|
|
|
// note: this is NOT constant time
|
|
|
|
|
if !(z[5] < 1873798617647539866 || (z[5] == 1873798617647539866 && (z[4] < 5412103778470702295 || (z[4] == 5412103778470702295 && (z[3] < 7239337960414712511 || (z[3] == 7239337960414712511 && (z[2] < 7435674573564081700 || (z[2] == 7435674573564081700 && (z[1] < 2210141511517208575 || (z[1] == 2210141511517208575 && (z[0] < 13402431016077863595))))))))))) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(z[0], 13402431016077863595, 0)
|
|
|
|
|
z[1], b = bits.Sub64(z[1], 2210141511517208575, b)
|
|
|
|
|
z[2], b = bits.Sub64(z[2], 7435674573564081700, b)
|
|
|
|
|
z[3], b = bits.Sub64(z[3], 7239337960414712511, b)
|
|
|
|
|
z[4], b = bits.Sub64(z[4], 5412103778470702295, b)
|
|
|
|
|
z[5], _ = bits.Sub64(z[5], 1873798617647539866, b)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func doubleAssign(z *fe) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
|
|
|
|
|
z[0], carry = bits.Add64(z[0], z[0], 0)
|
|
|
|
|
z[1], carry = bits.Add64(z[1], z[1], carry)
|
|
|
|
|
z[2], carry = bits.Add64(z[2], z[2], carry)
|
|
|
|
|
z[3], carry = bits.Add64(z[3], z[3], carry)
|
|
|
|
|
z[4], carry = bits.Add64(z[4], z[4], carry)
|
|
|
|
|
z[5], _ = bits.Add64(z[5], z[5], carry)
|
|
|
|
|
|
|
|
|
|
// if z > q --> z -= q
|
|
|
|
|
// note: this is NOT constant time
|
|
|
|
|
if !(z[5] < 1873798617647539866 || (z[5] == 1873798617647539866 && (z[4] < 5412103778470702295 || (z[4] == 5412103778470702295 && (z[3] < 7239337960414712511 || (z[3] == 7239337960414712511 && (z[2] < 7435674573564081700 || (z[2] == 7435674573564081700 && (z[1] < 2210141511517208575 || (z[1] == 2210141511517208575 && (z[0] < 13402431016077863595))))))))))) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(z[0], 13402431016077863595, 0)
|
|
|
|
|
z[1], b = bits.Sub64(z[1], 2210141511517208575, b)
|
|
|
|
|
z[2], b = bits.Sub64(z[2], 7435674573564081700, b)
|
|
|
|
|
z[3], b = bits.Sub64(z[3], 7239337960414712511, b)
|
|
|
|
|
z[4], b = bits.Sub64(z[4], 5412103778470702295, b)
|
|
|
|
|
z[5], _ = bits.Sub64(z[5], 1873798617647539866, b)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func ldouble(z, x *fe) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
|
|
|
|
|
z[0], carry = bits.Add64(x[0], x[0], 0)
|
|
|
|
|
z[1], carry = bits.Add64(x[1], x[1], carry)
|
|
|
|
|
z[2], carry = bits.Add64(x[2], x[2], carry)
|
|
|
|
|
z[3], carry = bits.Add64(x[3], x[3], carry)
|
|
|
|
|
z[4], carry = bits.Add64(x[4], x[4], carry)
|
|
|
|
|
z[5], _ = bits.Add64(x[5], x[5], carry)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func sub(z, x, y *fe) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(x[0], y[0], 0)
|
|
|
|
|
z[1], b = bits.Sub64(x[1], y[1], b)
|
|
|
|
|
z[2], b = bits.Sub64(x[2], y[2], b)
|
|
|
|
|
z[3], b = bits.Sub64(x[3], y[3], b)
|
|
|
|
|
z[4], b = bits.Sub64(x[4], y[4], b)
|
|
|
|
|
z[5], b = bits.Sub64(x[5], y[5], b)
|
|
|
|
|
if b != 0 {
|
|
|
|
|
var c uint64
|
|
|
|
|
z[0], c = bits.Add64(z[0], 13402431016077863595, 0)
|
|
|
|
|
z[1], c = bits.Add64(z[1], 2210141511517208575, c)
|
|
|
|
|
z[2], c = bits.Add64(z[2], 7435674573564081700, c)
|
|
|
|
|
z[3], c = bits.Add64(z[3], 7239337960414712511, c)
|
|
|
|
|
z[4], c = bits.Add64(z[4], 5412103778470702295, c)
|
|
|
|
|
z[5], _ = bits.Add64(z[5], 1873798617647539866, c)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func subAssign(z, x *fe) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(z[0], x[0], 0)
|
|
|
|
|
z[1], b = bits.Sub64(z[1], x[1], b)
|
|
|
|
|
z[2], b = bits.Sub64(z[2], x[2], b)
|
|
|
|
|
z[3], b = bits.Sub64(z[3], x[3], b)
|
|
|
|
|
z[4], b = bits.Sub64(z[4], x[4], b)
|
|
|
|
|
z[5], b = bits.Sub64(z[5], x[5], b)
|
|
|
|
|
if b != 0 {
|
|
|
|
|
var c uint64
|
|
|
|
|
z[0], c = bits.Add64(z[0], 13402431016077863595, 0)
|
|
|
|
|
z[1], c = bits.Add64(z[1], 2210141511517208575, c)
|
|
|
|
|
z[2], c = bits.Add64(z[2], 7435674573564081700, c)
|
|
|
|
|
z[3], c = bits.Add64(z[3], 7239337960414712511, c)
|
|
|
|
|
z[4], c = bits.Add64(z[4], 5412103778470702295, c)
|
|
|
|
|
z[5], _ = bits.Add64(z[5], 1873798617647539866, c)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func lsubAssign(z, x *fe) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(z[0], x[0], 0)
|
|
|
|
|
z[1], b = bits.Sub64(z[1], x[1], b)
|
|
|
|
|
z[2], b = bits.Sub64(z[2], x[2], b)
|
|
|
|
|
z[3], b = bits.Sub64(z[3], x[3], b)
|
|
|
|
|
z[4], b = bits.Sub64(z[4], x[4], b)
|
2021-01-06 11:06:44 +00:00
|
|
|
z[5], _ = bits.Sub64(z[5], x[5], b)
|
core/vm, crypto/bls12381, params: add bls12-381 elliptic curve precompiles (#21018)
* crypto: add bls12-381 elliptic curve wrapper
* params: add bls12-381 precompile gas parameters
* core/vm: add bls12-381 precompiles
* core/vm: add bls12-381 precompile tests
* go.mod, go.sum: use latest bls12381 lib
* core/vm: move point encode/decode functions to base library
* crypto/bls12381: introduce bls12-381 library init function
* crypto/bls12381: import bls12381 elliptic curve implementation
* go.mod, go.sum: remove bls12-381 library
* remove unsued frobenious coeffs
supress warning for inp that used in asm
* add mappings tests for zero inputs
fix swu g2 minus z inverse constant
* crypto/bls12381: fix typo
* crypto/bls12381: better comments for bls12381 constants
* crypto/bls12381: swu, use single conditional for e2
* crypto/bls12381: utils, delete empty line
* crypto/bls12381: utils, use FromHex for string to big
* crypto/bls12381: g1, g2, strict length check for FromBytes
* crypto/bls12381: field_element, comparision changes
* crypto/bls12381: change swu, isogeny constants with hex values
* core/vm: fix point multiplication comments
* core/vm: fix multiexp gas calculation and lookup for g1 and g2
* core/vm: simpler imput length check for multiexp and pairing precompiles
* core/vm: rm empty multiexp result declarations
* crypto/bls12381: remove modulus type definition
* crypto/bls12381: use proper init function
* crypto/bls12381: get rid of new lines at fatal desciprtions
* crypto/bls12-381: fix no-adx assembly multiplication
* crypto/bls12-381: remove old config function
* crypto/bls12381: update multiplication backend
this commit changes mul backend to 6limb eip1962 backend
mul assign operations are dropped
* core/vm/contracts_tests: externalize test vectors for precompiles
* core/vm/contracts_test: externalize failure-cases for precompiles
* core/vm: linting
* go.mod: tiny up sum file
* core/vm: fix goimports linter issues
* crypto/bls12381: build tags for plain ASM or ADX implementation
Co-authored-by: Martin Holst Swende <martin@swende.se>
Co-authored-by: Péter Szilágyi <peterke@gmail.com>
2020-06-03 06:44:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func neg(z *fe, x *fe) {
|
|
|
|
|
if x.isZero() {
|
|
|
|
|
z.zero()
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
var borrow uint64
|
|
|
|
|
z[0], borrow = bits.Sub64(13402431016077863595, x[0], 0)
|
|
|
|
|
z[1], borrow = bits.Sub64(2210141511517208575, x[1], borrow)
|
|
|
|
|
z[2], borrow = bits.Sub64(7435674573564081700, x[2], borrow)
|
|
|
|
|
z[3], borrow = bits.Sub64(7239337960414712511, x[3], borrow)
|
|
|
|
|
z[4], borrow = bits.Sub64(5412103778470702295, x[4], borrow)
|
|
|
|
|
z[5], _ = bits.Sub64(1873798617647539866, x[5], borrow)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func mul(z, x, y *fe) {
|
|
|
|
|
var t [6]uint64
|
|
|
|
|
var c [3]uint64
|
|
|
|
|
{
|
|
|
|
|
// round 0
|
|
|
|
|
v := x[0]
|
|
|
|
|
c[1], c[0] = bits.Mul64(v, y[0])
|
|
|
|
|
m := c[0] * 9940570264628428797
|
|
|
|
|
c[2] = madd0(m, 13402431016077863595, c[0])
|
|
|
|
|
c[1], c[0] = madd1(v, y[1], c[1])
|
|
|
|
|
c[2], t[0] = madd2(m, 2210141511517208575, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd1(v, y[2], c[1])
|
|
|
|
|
c[2], t[1] = madd2(m, 7435674573564081700, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd1(v, y[3], c[1])
|
|
|
|
|
c[2], t[2] = madd2(m, 7239337960414712511, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd1(v, y[4], c[1])
|
|
|
|
|
c[2], t[3] = madd2(m, 5412103778470702295, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd1(v, y[5], c[1])
|
|
|
|
|
t[5], t[4] = madd3(m, 1873798617647539866, c[0], c[2], c[1])
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 1
|
|
|
|
|
v := x[1]
|
|
|
|
|
c[1], c[0] = madd1(v, y[0], t[0])
|
|
|
|
|
m := c[0] * 9940570264628428797
|
|
|
|
|
c[2] = madd0(m, 13402431016077863595, c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[1], c[1], t[1])
|
|
|
|
|
c[2], t[0] = madd2(m, 2210141511517208575, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[2], c[1], t[2])
|
|
|
|
|
c[2], t[1] = madd2(m, 7435674573564081700, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[3], c[1], t[3])
|
|
|
|
|
c[2], t[2] = madd2(m, 7239337960414712511, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[4], c[1], t[4])
|
|
|
|
|
c[2], t[3] = madd2(m, 5412103778470702295, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[5], c[1], t[5])
|
|
|
|
|
t[5], t[4] = madd3(m, 1873798617647539866, c[0], c[2], c[1])
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 2
|
|
|
|
|
v := x[2]
|
|
|
|
|
c[1], c[0] = madd1(v, y[0], t[0])
|
|
|
|
|
m := c[0] * 9940570264628428797
|
|
|
|
|
c[2] = madd0(m, 13402431016077863595, c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[1], c[1], t[1])
|
|
|
|
|
c[2], t[0] = madd2(m, 2210141511517208575, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[2], c[1], t[2])
|
|
|
|
|
c[2], t[1] = madd2(m, 7435674573564081700, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[3], c[1], t[3])
|
|
|
|
|
c[2], t[2] = madd2(m, 7239337960414712511, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[4], c[1], t[4])
|
|
|
|
|
c[2], t[3] = madd2(m, 5412103778470702295, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[5], c[1], t[5])
|
|
|
|
|
t[5], t[4] = madd3(m, 1873798617647539866, c[0], c[2], c[1])
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 3
|
|
|
|
|
v := x[3]
|
|
|
|
|
c[1], c[0] = madd1(v, y[0], t[0])
|
|
|
|
|
m := c[0] * 9940570264628428797
|
|
|
|
|
c[2] = madd0(m, 13402431016077863595, c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[1], c[1], t[1])
|
|
|
|
|
c[2], t[0] = madd2(m, 2210141511517208575, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[2], c[1], t[2])
|
|
|
|
|
c[2], t[1] = madd2(m, 7435674573564081700, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[3], c[1], t[3])
|
|
|
|
|
c[2], t[2] = madd2(m, 7239337960414712511, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[4], c[1], t[4])
|
|
|
|
|
c[2], t[3] = madd2(m, 5412103778470702295, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[5], c[1], t[5])
|
|
|
|
|
t[5], t[4] = madd3(m, 1873798617647539866, c[0], c[2], c[1])
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 4
|
|
|
|
|
v := x[4]
|
|
|
|
|
c[1], c[0] = madd1(v, y[0], t[0])
|
|
|
|
|
m := c[0] * 9940570264628428797
|
|
|
|
|
c[2] = madd0(m, 13402431016077863595, c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[1], c[1], t[1])
|
|
|
|
|
c[2], t[0] = madd2(m, 2210141511517208575, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[2], c[1], t[2])
|
|
|
|
|
c[2], t[1] = madd2(m, 7435674573564081700, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[3], c[1], t[3])
|
|
|
|
|
c[2], t[2] = madd2(m, 7239337960414712511, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[4], c[1], t[4])
|
|
|
|
|
c[2], t[3] = madd2(m, 5412103778470702295, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[5], c[1], t[5])
|
|
|
|
|
t[5], t[4] = madd3(m, 1873798617647539866, c[0], c[2], c[1])
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 5
|
|
|
|
|
v := x[5]
|
|
|
|
|
c[1], c[0] = madd1(v, y[0], t[0])
|
|
|
|
|
m := c[0] * 9940570264628428797
|
|
|
|
|
c[2] = madd0(m, 13402431016077863595, c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[1], c[1], t[1])
|
|
|
|
|
c[2], z[0] = madd2(m, 2210141511517208575, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[2], c[1], t[2])
|
|
|
|
|
c[2], z[1] = madd2(m, 7435674573564081700, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[3], c[1], t[3])
|
|
|
|
|
c[2], z[2] = madd2(m, 7239337960414712511, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[4], c[1], t[4])
|
|
|
|
|
c[2], z[3] = madd2(m, 5412103778470702295, c[2], c[0])
|
|
|
|
|
c[1], c[0] = madd2(v, y[5], c[1], t[5])
|
|
|
|
|
z[5], z[4] = madd3(m, 1873798617647539866, c[0], c[2], c[1])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// if z > q --> z -= q
|
|
|
|
|
// note: this is NOT constant time
|
|
|
|
|
if !(z[5] < 1873798617647539866 || (z[5] == 1873798617647539866 && (z[4] < 5412103778470702295 || (z[4] == 5412103778470702295 && (z[3] < 7239337960414712511 || (z[3] == 7239337960414712511 && (z[2] < 7435674573564081700 || (z[2] == 7435674573564081700 && (z[1] < 2210141511517208575 || (z[1] == 2210141511517208575 && (z[0] < 13402431016077863595))))))))))) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(z[0], 13402431016077863595, 0)
|
|
|
|
|
z[1], b = bits.Sub64(z[1], 2210141511517208575, b)
|
|
|
|
|
z[2], b = bits.Sub64(z[2], 7435674573564081700, b)
|
|
|
|
|
z[3], b = bits.Sub64(z[3], 7239337960414712511, b)
|
|
|
|
|
z[4], b = bits.Sub64(z[4], 5412103778470702295, b)
|
|
|
|
|
z[5], _ = bits.Sub64(z[5], 1873798617647539866, b)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func square(z, x *fe) {
|
|
|
|
|
|
|
|
|
|
var p [6]uint64
|
|
|
|
|
|
|
|
|
|
var u, v uint64
|
|
|
|
|
{
|
|
|
|
|
// round 0
|
|
|
|
|
u, p[0] = bits.Mul64(x[0], x[0])
|
|
|
|
|
m := p[0] * 9940570264628428797
|
|
|
|
|
C := madd0(m, 13402431016077863595, p[0])
|
|
|
|
|
var t uint64
|
|
|
|
|
t, u, v = madd1sb(x[0], x[1], u)
|
|
|
|
|
C, p[0] = madd2(m, 2210141511517208575, v, C)
|
|
|
|
|
t, u, v = madd1s(x[0], x[2], t, u)
|
|
|
|
|
C, p[1] = madd2(m, 7435674573564081700, v, C)
|
|
|
|
|
t, u, v = madd1s(x[0], x[3], t, u)
|
|
|
|
|
C, p[2] = madd2(m, 7239337960414712511, v, C)
|
|
|
|
|
t, u, v = madd1s(x[0], x[4], t, u)
|
|
|
|
|
C, p[3] = madd2(m, 5412103778470702295, v, C)
|
|
|
|
|
_, u, v = madd1s(x[0], x[5], t, u)
|
|
|
|
|
p[5], p[4] = madd3(m, 1873798617647539866, v, C, u)
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 1
|
|
|
|
|
m := p[0] * 9940570264628428797
|
|
|
|
|
C := madd0(m, 13402431016077863595, p[0])
|
|
|
|
|
u, v = madd1(x[1], x[1], p[1])
|
|
|
|
|
C, p[0] = madd2(m, 2210141511517208575, v, C)
|
|
|
|
|
var t uint64
|
|
|
|
|
t, u, v = madd2sb(x[1], x[2], p[2], u)
|
|
|
|
|
C, p[1] = madd2(m, 7435674573564081700, v, C)
|
|
|
|
|
t, u, v = madd2s(x[1], x[3], p[3], t, u)
|
|
|
|
|
C, p[2] = madd2(m, 7239337960414712511, v, C)
|
|
|
|
|
t, u, v = madd2s(x[1], x[4], p[4], t, u)
|
|
|
|
|
C, p[3] = madd2(m, 5412103778470702295, v, C)
|
|
|
|
|
_, u, v = madd2s(x[1], x[5], p[5], t, u)
|
|
|
|
|
p[5], p[4] = madd3(m, 1873798617647539866, v, C, u)
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 2
|
|
|
|
|
m := p[0] * 9940570264628428797
|
|
|
|
|
C := madd0(m, 13402431016077863595, p[0])
|
|
|
|
|
C, p[0] = madd2(m, 2210141511517208575, p[1], C)
|
|
|
|
|
u, v = madd1(x[2], x[2], p[2])
|
|
|
|
|
C, p[1] = madd2(m, 7435674573564081700, v, C)
|
|
|
|
|
var t uint64
|
|
|
|
|
t, u, v = madd2sb(x[2], x[3], p[3], u)
|
|
|
|
|
C, p[2] = madd2(m, 7239337960414712511, v, C)
|
|
|
|
|
t, u, v = madd2s(x[2], x[4], p[4], t, u)
|
|
|
|
|
C, p[3] = madd2(m, 5412103778470702295, v, C)
|
|
|
|
|
_, u, v = madd2s(x[2], x[5], p[5], t, u)
|
|
|
|
|
p[5], p[4] = madd3(m, 1873798617647539866, v, C, u)
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 3
|
|
|
|
|
m := p[0] * 9940570264628428797
|
|
|
|
|
C := madd0(m, 13402431016077863595, p[0])
|
|
|
|
|
C, p[0] = madd2(m, 2210141511517208575, p[1], C)
|
|
|
|
|
C, p[1] = madd2(m, 7435674573564081700, p[2], C)
|
|
|
|
|
u, v = madd1(x[3], x[3], p[3])
|
|
|
|
|
C, p[2] = madd2(m, 7239337960414712511, v, C)
|
|
|
|
|
var t uint64
|
|
|
|
|
t, u, v = madd2sb(x[3], x[4], p[4], u)
|
|
|
|
|
C, p[3] = madd2(m, 5412103778470702295, v, C)
|
|
|
|
|
_, u, v = madd2s(x[3], x[5], p[5], t, u)
|
|
|
|
|
p[5], p[4] = madd3(m, 1873798617647539866, v, C, u)
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 4
|
|
|
|
|
m := p[0] * 9940570264628428797
|
|
|
|
|
C := madd0(m, 13402431016077863595, p[0])
|
|
|
|
|
C, p[0] = madd2(m, 2210141511517208575, p[1], C)
|
|
|
|
|
C, p[1] = madd2(m, 7435674573564081700, p[2], C)
|
|
|
|
|
C, p[2] = madd2(m, 7239337960414712511, p[3], C)
|
|
|
|
|
u, v = madd1(x[4], x[4], p[4])
|
|
|
|
|
C, p[3] = madd2(m, 5412103778470702295, v, C)
|
|
|
|
|
_, u, v = madd2sb(x[4], x[5], p[5], u)
|
|
|
|
|
p[5], p[4] = madd3(m, 1873798617647539866, v, C, u)
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
// round 5
|
|
|
|
|
m := p[0] * 9940570264628428797
|
|
|
|
|
C := madd0(m, 13402431016077863595, p[0])
|
|
|
|
|
C, z[0] = madd2(m, 2210141511517208575, p[1], C)
|
|
|
|
|
C, z[1] = madd2(m, 7435674573564081700, p[2], C)
|
|
|
|
|
C, z[2] = madd2(m, 7239337960414712511, p[3], C)
|
|
|
|
|
C, z[3] = madd2(m, 5412103778470702295, p[4], C)
|
|
|
|
|
u, v = madd1(x[5], x[5], p[5])
|
|
|
|
|
z[5], z[4] = madd3(m, 1873798617647539866, v, C, u)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// if z > q --> z -= q
|
|
|
|
|
// note: this is NOT constant time
|
|
|
|
|
if !(z[5] < 1873798617647539866 || (z[5] == 1873798617647539866 && (z[4] < 5412103778470702295 || (z[4] == 5412103778470702295 && (z[3] < 7239337960414712511 || (z[3] == 7239337960414712511 && (z[2] < 7435674573564081700 || (z[2] == 7435674573564081700 && (z[1] < 2210141511517208575 || (z[1] == 2210141511517208575 && (z[0] < 13402431016077863595))))))))))) {
|
|
|
|
|
var b uint64
|
|
|
|
|
z[0], b = bits.Sub64(z[0], 13402431016077863595, 0)
|
|
|
|
|
z[1], b = bits.Sub64(z[1], 2210141511517208575, b)
|
|
|
|
|
z[2], b = bits.Sub64(z[2], 7435674573564081700, b)
|
|
|
|
|
z[3], b = bits.Sub64(z[3], 7239337960414712511, b)
|
|
|
|
|
z[4], b = bits.Sub64(z[4], 5412103778470702295, b)
|
|
|
|
|
z[5], _ = bits.Sub64(z[5], 1873798617647539866, b)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// arith.go
|
|
|
|
|
// Copyright 2020 ConsenSys AG
|
|
|
|
|
//
|
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
|
//
|
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
//
|
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
|
|
// Code generated by goff DO NOT EDIT
|
|
|
|
|
|
|
|
|
|
func madd(a, b, t, u, v uint64) (uint64, uint64, uint64) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
hi, lo := bits.Mul64(a, b)
|
|
|
|
|
v, carry = bits.Add64(lo, v, 0)
|
|
|
|
|
u, carry = bits.Add64(hi, u, carry)
|
|
|
|
|
t, _ = bits.Add64(t, 0, carry)
|
|
|
|
|
return t, u, v
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// madd0 hi = a*b + c (discards lo bits)
|
|
|
|
|
func madd0(a, b, c uint64) (hi uint64) {
|
|
|
|
|
var carry, lo uint64
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
_, carry = bits.Add64(lo, c, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// madd1 hi, lo = a*b + c
|
|
|
|
|
func madd1(a, b, c uint64) (hi uint64, lo uint64) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
lo, carry = bits.Add64(lo, c, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// madd2 hi, lo = a*b + c + d
|
|
|
|
|
func madd2(a, b, c, d uint64) (hi uint64, lo uint64) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
c, carry = bits.Add64(c, d, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
lo, carry = bits.Add64(lo, c, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// madd2s superhi, hi, lo = 2*a*b + c + d + e
|
|
|
|
|
func madd2s(a, b, c, d, e uint64) (superhi, hi, lo uint64) {
|
|
|
|
|
var carry, sum uint64
|
|
|
|
|
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
lo, carry = bits.Add64(lo, lo, 0)
|
|
|
|
|
hi, superhi = bits.Add64(hi, hi, carry)
|
|
|
|
|
|
|
|
|
|
sum, carry = bits.Add64(c, e, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
lo, carry = bits.Add64(lo, sum, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, d)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func madd1s(a, b, d, e uint64) (superhi, hi, lo uint64) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
lo, carry = bits.Add64(lo, lo, 0)
|
|
|
|
|
hi, superhi = bits.Add64(hi, hi, carry)
|
|
|
|
|
lo, carry = bits.Add64(lo, e, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, d)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func madd2sb(a, b, c, e uint64) (superhi, hi, lo uint64) {
|
|
|
|
|
var carry, sum uint64
|
|
|
|
|
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
lo, carry = bits.Add64(lo, lo, 0)
|
|
|
|
|
hi, superhi = bits.Add64(hi, hi, carry)
|
|
|
|
|
|
|
|
|
|
sum, carry = bits.Add64(c, e, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
lo, carry = bits.Add64(lo, sum, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func madd1sb(a, b, e uint64) (superhi, hi, lo uint64) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
lo, carry = bits.Add64(lo, lo, 0)
|
|
|
|
|
hi, superhi = bits.Add64(hi, hi, carry)
|
|
|
|
|
lo, carry = bits.Add64(lo, e, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func madd3(a, b, c, d, e uint64) (hi uint64, lo uint64) {
|
|
|
|
|
var carry uint64
|
|
|
|
|
hi, lo = bits.Mul64(a, b)
|
|
|
|
|
c, carry = bits.Add64(c, d, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, 0, carry)
|
|
|
|
|
lo, carry = bits.Add64(lo, c, 0)
|
|
|
|
|
hi, _ = bits.Add64(hi, e, carry)
|
|
|
|
|
return
|
|
|
|
|
}
|
