You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@milagro.apache.org by km...@apache.org on 2019/02/08 08:06:43 UTC
[incubator-milagro-crypto] 13/15: update code
This is an automated email from the ASF dual-hosted git repository.
kmccusker pushed a commit to branch update-code
in repository https://gitbox.apache.org/repos/asf/incubator-milagro-crypto.git
commit 1add756065bc30f21dc32a317ad9b17f19aa346f
Author: Brian Spector <br...@Brians-MacBook-Air-2018.local>
AuthorDate: Tue Jan 15 15:11:57 2019 +0000
update code
---
LICENSE-2.0.TXT | 202 ---
NOTICE.txt | 5 -
readme.txt | 41 -
version22/amcl22.pdf | Bin 419918 -> 0 bytes
version22/bigtobig.cpp | 292 ----
version22/blsgen.cpp | 194 ---
version22/bngen.cpp | 251 ---
version22/c/CARSK.pem | 54 -
version22/c/aes.c | 702 --------
version22/c/amcl.h | 2935 --------------------------------
version22/c/arch.h | 119 --
version22/c/benchtest_ec.c | 212 ---
version22/c/benchtest_pair.c | 257 ---
version22/c/big.c | 1525 -----------------
version22/c/build_ec | 22 -
version22/c/build_ec.bat | 22 -
version22/c/build_pair | 27 -
version22/c/build_pair.bat | 27 -
version22/c/ca.crt | 23 -
version22/c/eccert.pem | 17 -
version22/c/ecdh.c | 751 --------
version22/c/ecdh.h | 206 ---
version22/c/ecp.c | 1176 -------------
version22/c/ecp2.c | 696 --------
version22/c/faster.c | 98 --
version22/c/faster.txt | 25 -
version22/c/ff.c | 1150 -------------
version22/c/fp.c | 608 -------
version22/c/fp12.c | 727 --------
version22/c/fp2.c | 435 -----
version22/c/fp4.c | 651 -------
version22/c/gcm.c | 411 -----
version22/c/hash.c | 422 -----
version22/c/maxstack.c | 62 -
version22/c/mpin.c | 1212 -------------
version22/c/mpin.h | 408 -----
version22/c/oct.c | 428 -----
version22/c/pair.c | 828 ---------
version22/c/rand.c | 172 --
version22/c/randapi.c | 15 -
version22/c/randapi.h | 20 -
version22/c/readme.txt | 77 -
version22/c/rom.c | 1206 -------------
version22/c/rsa.c | 394 -----
version22/c/rsa.h | 99 --
version22/c/testecdh.c | 207 ---
version22/c/testmpin.c | 313 ----
version22/c/testrsa.c | 104 --
version22/c/x509.c | 1079 ------------
version22/c/x509.h | 113 --
version22/check.cpp | 100 --
version22/cs/readme.txt | 36 -
version22/ecgen.cpp | 125 --
version22/go/AES.go | 634 -------
version22/go/BIG.go | 850 ---------
version22/go/BenchtestEC.go | 154 --
version22/go/BenchtestPAIR.go | 206 ---
version22/go/DBIG.go | 256 ---
version22/go/ECDH.go | 547 ------
version22/go/ECP.go | 893 ----------
version22/go/ECP2.go | 568 ------
version22/go/FF.go | 905 ----------
version22/go/FP.go | 279 ---
version22/go/FP12.go | 551 ------
version22/go/FP2.go | 300 ----
version22/go/FP4.go | 479 ------
version22/go/GCM.go | 337 ----
version22/go/HASH256.go | 192 ---
version22/go/HASH384.go | 204 ---
version22/go/HASH512.go | 204 ---
version22/go/MPIN.go | 769 ---------
version22/go/PAIR.go | 641 -------
version22/go/RAND.go | 153 --
version22/go/ROM32.go | 825 ---------
version22/go/ROM64.go | 826 ---------
version22/go/RSA.go | 363 ----
version22/go/TestECDH.go | 164 --
version22/go/TestMPIN.go | 241 ---
version22/go/TestRSA.go | 98 --
version22/go/readme.txt | 50 -
version22/java/AES.java | 695 --------
version22/java/BIG32.java | 1016 -----------
version22/java/BIG64.java | 1040 -----------
version22/java/BenchtestEC.java | 160 --
version22/java/BenchtestPAIR.java | 208 ---
version22/java/DBIG32.java | 308 ----
version22/java/DBIG64.java | 306 ----
version22/java/ECDH.java | 581 -------
version22/java/ECP.java | 917 ----------
version22/java/ECP2.java | 624 -------
version22/java/FF.java | 941 ----------
version22/java/FP.java | 345 ----
version22/java/FP12.java | 641 -------
version22/java/FP2.java | 393 -----
version22/java/FP4.java | 584 -------
version22/java/GCM.java | 374 ----
version22/java/HASH256.java | 216 ---
version22/java/HASH384.java | 227 ---
version22/java/HASH512.java | 229 ---
version22/java/MPIN.java | 853 ----------
version22/java/PAIR.java | 685 --------
version22/java/RAND.java | 161 --
version22/java/ROM32.java | 714 --------
version22/java/ROM64.java | 703 --------
version22/java/RSA.java | 362 ----
version22/java/TestECDH.java | 179 --
version22/java/TestMPIN.java | 270 ---
version22/java/TestRSA.java | 92 -
version22/java/readme.txt | 61 -
version22/java/rsa_private_key.java | 13 -
version22/java/rsa_public_key.java | 11 -
version22/js/AES.js | 634 -------
version22/js/BIG.js | 1037 -----------
version22/js/BenchtestEC.html | 162 --
version22/js/BenchtestPAIR.html | 226 ---
version22/js/DBIG.js | 284 ---
version22/js/ECDH.js | 585 -------
version22/js/ECP.js | 903 ----------
version22/js/ECP2.js | 604 -------
version22/js/FF.js | 947 -----------
version22/js/FP.js | 360 ----
version22/js/FP12.js | 558 ------
version22/js/FP2.js | 321 ----
version22/js/FP4.js | 501 ------
version22/js/GCM.js | 305 ----
version22/js/HASH256.js | 180 --
version22/js/HASH384.js | 238 ---
version22/js/HASH512.js | 236 ---
version22/js/MPIN.js | 933 ----------
version22/js/PAIR.js | 650 -------
version22/js/RAND.js | 148 --
version22/js/ROM.js | 716 --------
version22/js/RSA.js | 392 -----
version22/js/TestECDH.html | 143 --
version22/js/TestMPIN.html | 330 ----
version22/js/TestRSA.html | 115 --
version22/js/UInt64.js | 54 -
version22/js/readme.txt | 41 -
version22/rust/.gitignore | 5 -
version22/rust/Cargo.toml | 24 -
version22/rust/readme.txt | 56 -
version22/rust/src/aes.rs | 628 -------
version22/rust/src/big.rs | 1227 -------------
version22/rust/src/dbig.rs | 249 ---
version22/rust/src/ecdh.rs | 585 -------
version22/rust/src/ecp.rs | 955 -----------
version22/rust/src/ecp2.rs | 677 --------
version22/rust/src/ff.rs | 944 ----------
version22/rust/src/fp.rs | 354 ----
version22/rust/src/fp12.rs | 628 -------
version22/rust/src/fp2.rs | 366 ----
version22/rust/src/fp4.rs | 563 ------
version22/rust/src/gcm.rs | 356 ----
version22/rust/src/hash256.rs | 182 --
version22/rust/src/hash384.rs | 188 --
version22/rust/src/hash512.rs | 189 --
version22/rust/src/lib.rs | 36 -
version22/rust/src/mpin.rs | 768 ---------
version22/rust/src/pair.rs | 674 --------
version22/rust/src/rand.rs | 147 --
version22/rust/src/rom32.rs | 349 ----
version22/rust/src/rom64.rs | 348 ----
version22/rust/src/rsa.rs | 372 ----
version22/rust/tests/benchtest_ec.rs | 185 --
version22/rust/tests/benchtest_pair.rs | 245 ---
version22/rust/tests/test_ecdh.rs | 180 --
version22/rust/tests/test_mpin.rs | 217 ---
version22/rust/tests/test_rsa.rs | 109 --
version22/swift/BenchtestEC.swift | 161 --
version22/swift/BenchtestPAIR.swift | 206 ---
version22/swift/TestECDH.swift | 167 --
version22/swift/TestMPIN.swift | 259 ---
version22/swift/TestRSA.swift | 100 --
version22/swift/aes.swift | 639 -------
version22/swift/big.swift | 1169 -------------
version22/swift/dbig.swift | 265 ---
version22/swift/ecdh.swift | 587 -------
version22/swift/ecp.swift | 923 ----------
version22/swift/ecp2.swift | 618 -------
version22/swift/ff.swift | 927 ----------
version22/swift/fp.swift | 309 ----
version22/swift/fp12.swift | 584 -------
version22/swift/fp2.swift | 329 ----
version22/swift/fp4.swift | 517 ------
version22/swift/gcm.swift | 326 ----
version22/swift/hash256.swift | 188 --
version22/swift/hash384.swift | 198 ---
version22/swift/hash512.swift | 198 ---
version22/swift/main.swift | 13 -
version22/swift/mpin.swift | 833 ---------
version22/swift/pair.swift | 592 -------
version22/swift/rand.swift | 131 --
version22/swift/readme.txt | 135 --
version22/swift/rom32.swift | 645 -------
version22/swift/rom64.swift | 258 ---
version22/swift/rsa.swift | 400 -----
version3/amcl3.pdf | Bin 299401 -> 0 bytes
version3/bestpair.cpp | 623 -------
version3/bigtobig.cpp | 292 ----
version3/c/aes.c | 704 --------
version3/c/amcl.h | 590 -------
version3/c/arch.h | 129 --
version3/c/benchtest_all.c | 1019 -----------
version3/c/big.c | 1535 -----------------
version3/c/big.h | 610 -------
version3/c/config16.py | 367 ----
version3/c/config32.py | 645 -------
version3/c/config64.py | 639 -------
version3/c/config_big.h | 38 -
version3/c/config_curve.h | 44 -
version3/c/config_ff.h | 38 -
version3/c/config_field.h | 34 -
version3/c/ecdh.c | 424 -----
version3/c/ecdh.h | 146 --
version3/c/ecdh_support.c | 352 ----
version3/c/ecdh_support.h | 114 --
version3/c/ecp.c | 1468 ----------------
version3/c/ecp.h | 314 ----
version3/c/ecp2.c | 912 ----------
version3/c/ecp2.h | 220 ---
version3/c/ecp4.c | 1068 ------------
version3/c/ecp4.h | 232 ---
version3/c/ecp8.c | 1311 --------------
version3/c/ecp8.h | 246 ---
version3/c/faster.c | 97 --
version3/c/faster.txt | 29 -
version3/c/fastest.c | 59 -
version3/c/fastest.txt | 28 -
version3/c/ff.c | 1155 -------------
version3/c/ff.h | 296 ----
version3/c/fp.c | 878 ----------
version3/c/fp.h | 245 ---
version3/c/fp12.c | 984 -----------
version3/c/fp12.h | 216 ---
version3/c/fp16.c | 693 --------
version3/c/fp16.h | 260 ---
version3/c/fp2.c | 489 ------
version3/c/fp2.h | 240 ---
version3/c/fp24.c | 1123 ------------
version3/c/fp24.h | 196 ---
version3/c/fp4.c | 800 ---------
version3/c/fp4.h | 305 ----
version3/c/fp48.c | 1385 ---------------
version3/c/fp48.h | 196 ---
version3/c/fp8.c | 795 ---------
version3/c/fp8.h | 294 ----
version3/c/gcm.c | 411 -----
version3/c/hash.c | 607 -------
version3/c/mpin.c | 995 -----------
version3/c/mpin.h | 345 ----
version3/c/mpin192.c | 975 -----------
version3/c/mpin192.h | 339 ----
version3/c/mpin256.c | 998 -----------
version3/c/mpin256.h | 339 ----
version3/c/newhope.c | 513 ------
version3/c/newhope.h | 51 -
version3/c/oct.c | 429 -----
version3/c/pair.c | 1027 -----------
version3/c/pair.h | 103 --
version3/c/pair192.c | 752 --------
version3/c/pair192.h | 77 -
version3/c/pair256.c | 864 ----------
version3/c/pair256.h | 77 -
version3/c/pbc_support.c | 180 --
version3/c/pbc_support.h | 96 --
version3/c/rand.c | 172 --
version3/c/randapi.c | 15 -
version3/c/randapi.h | 46 -
version3/c/readme.txt | 75 -
version3/c/rom_curve_ANSSI.c | 33 -
version3/c/rom_curve_BLS24.c | 67 -
version3/c/rom_curve_BLS381.c | 62 -
version3/c/rom_curve_BLS383.c | 62 -
version3/c/rom_curve_BLS461.c | 59 -
version3/c/rom_curve_BLS48.c | 88 -
version3/c/rom_curve_BN254.c | 80 -
version3/c/rom_curve_BN254CX.c | 81 -
version3/c/rom_curve_BRAINPOOL.c | 36 -
version3/c/rom_curve_C25519.c | 27 -
version3/c/rom_curve_C41417.c | 35 -
version3/c/rom_curve_ED25519.c | 45 -
version3/c/rom_curve_FP256BN.c | 86 -
version3/c/rom_curve_FP512BN.c | 87 -
version3/c/rom_curve_GOLDILOCKS.c | 37 -
version3/c/rom_curve_HIFIVE.c | 37 -
version3/c/rom_curve_NIST256.c | 37 -
version3/c/rom_curve_NIST384.c | 36 -
version3/c/rom_curve_NIST521.c | 35 -
version3/c/rom_curve_NUMS256E.c | 43 -
version3/c/rom_curve_NUMS256W.c | 34 -
version3/c/rom_curve_NUMS384E.c | 34 -
version3/c/rom_curve_NUMS384W.c | 34 -
version3/c/rom_curve_NUMS512E.c | 33 -
version3/c/rom_curve_NUMS512W.c | 34 -
version3/c/rom_curve_SECP256K1.c | 39 -
version3/c/rom_field_25519.c | 33 -
version3/c/rom_field_256PME.c | 28 -
version3/c/rom_field_256PMW.c | 26 -
version3/c/rom_field_384PM.c | 25 -
version3/c/rom_field_512PM.c | 25 -
version3/c/rom_field_ANSSI.c | 25 -
version3/c/rom_field_BLS24.c | 32 -
version3/c/rom_field_BLS381.c | 30 -
version3/c/rom_field_BLS383.c | 30 -
version3/c/rom_field_BLS461.c | 31 -
version3/c/rom_field_BLS48.c | 32 -
version3/c/rom_field_BN254.c | 37 -
version3/c/rom_field_BN254CX.c | 38 -
version3/c/rom_field_BRAINPOOL.c | 25 -
version3/c/rom_field_C41417.c | 25 -
version3/c/rom_field_FP256BN.c | 36 -
version3/c/rom_field_FP512BN.c | 38 -
version3/c/rom_field_GOLDILOCKS.c | 30 -
version3/c/rom_field_HIFIVE.c | 27 -
version3/c/rom_field_NIST256.c | 27 -
version3/c/rom_field_NIST384.c | 27 -
version3/c/rom_field_NIST521.c | 25 -
version3/c/rom_field_SECP256K1.c | 28 -
version3/c/rsa.c | 162 --
version3/c/rsa.h | 110 --
version3/c/rsa_support.c | 237 ---
version3/c/rsa_support.h | 62 -
version3/c/testall.c | 1627 ------------------
version3/c/testnhs.c | 71 -
version3/c/x509.c | 1097 ------------
version3/c/x509.h | 109 --
version3/check.cpp | 108 --
version3/cpp/aes.cpp | 706 --------
version3/cpp/amcl.h | 585 -------
version3/cpp/arch.h | 98 --
version3/cpp/benchtest_all.cpp | 973 -----------
version3/cpp/big.cpp | 1508 ----------------
version3/cpp/big.h | 595 -------
version3/cpp/config16.py | 370 ----
version3/cpp/config32.py | 641 -------
version3/cpp/config64.py | 641 -------
version3/cpp/config_big.h | 12 -
version3/cpp/config_curve.h | 47 -
version3/cpp/config_ff.h | 13 -
version3/cpp/config_field.h | 15 -
version3/cpp/ecdh.cpp | 435 -----
version3/cpp/ecdh.h | 154 --
version3/cpp/ecdh_support.cpp | 351 ----
version3/cpp/ecdh_support.h | 84 -
version3/cpp/ecp.cpp | 1467 ----------------
version3/cpp/ecp.h | 293 ----
version3/cpp/ecp2.cpp | 922 ----------
version3/cpp/ecp2.h | 203 ---
version3/cpp/ecp4.cpp | 1074 ------------
version3/cpp/ecp4.h | 243 ---
version3/cpp/ecp8.cpp | 1318 --------------
version3/cpp/ecp8.h | 253 ---
version3/cpp/ff.cpp | 1181 -------------
version3/cpp/ff.h | 276 ---
version3/cpp/fp.cpp | 878 ----------
version3/cpp/fp.h | 229 ---
version3/cpp/fp12.cpp | 1005 -----------
version3/cpp/fp12.h | 194 ---
version3/cpp/fp16.cpp | 697 --------
version3/cpp/fp16.h | 264 ---
version3/cpp/fp2.cpp | 486 ------
version3/cpp/fp2.h | 219 ---
version3/cpp/fp24.cpp | 1126 ------------
version3/cpp/fp24.h | 200 ---
version3/cpp/fp4.cpp | 808 ---------
version3/cpp/fp4.h | 286 ----
version3/cpp/fp48.cpp | 1389 ---------------
version3/cpp/fp48.h | 199 ---
version3/cpp/fp8.cpp | 800 ---------
version3/cpp/fp8.h | 301 ----
version3/cpp/gcm.cpp | 413 -----
version3/cpp/hash.cpp | 599 -------
version3/cpp/mpin.cpp | 1012 -----------
version3/cpp/mpin.h | 340 ----
version3/cpp/mpin192.cpp | 985 -----------
version3/cpp/mpin192.h | 340 ----
version3/cpp/mpin256.cpp | 1006 -----------
version3/cpp/mpin256.h | 340 ----
version3/cpp/newhope.cpp | 515 ------
version3/cpp/newhope.h | 54 -
version3/cpp/oct.cpp | 431 -----
version3/cpp/pair.cpp | 983 -----------
version3/cpp/pair.h | 80 -
version3/cpp/pair192.cpp | 758 ---------
version3/cpp/pair192.h | 80 -
version3/cpp/pair256.cpp | 878 ----------
version3/cpp/pair256.h | 80 -
version3/cpp/pbc_support.cpp | 179 --
version3/cpp/pbc_support.h | 66 -
version3/cpp/rand.cpp | 174 --
version3/cpp/randapi.cpp | 17 -
version3/cpp/randapi.h | 24 -
version3/cpp/readme.txt | 61 -
version3/cpp/rom_curve_ANSSI.cpp | 42 -
version3/cpp/rom_curve_BLS24.cpp | 78 -
version3/cpp/rom_curve_BLS381.cpp | 64 -
version3/cpp/rom_curve_BLS383.cpp | 68 -
version3/cpp/rom_curve_BLS461.cpp | 69 -
version3/cpp/rom_curve_BLS48.cpp | 95 --
version3/cpp/rom_curve_BN254.cpp | 89 -
version3/cpp/rom_curve_BN254CX.cpp | 83 -
version3/cpp/rom_curve_BRAINPOOL.cpp | 43 -
version3/cpp/rom_curve_C25519.cpp | 36 -
version3/cpp/rom_curve_C41417.cpp | 42 -
version3/cpp/rom_curve_ED25519.cpp | 54 -
version3/cpp/rom_curve_FP256BN.cpp | 86 -
version3/cpp/rom_curve_FP512BN.cpp | 88 -
version3/cpp/rom_curve_GOLDILOCKS.cpp | 43 -
version3/cpp/rom_curve_HIFIVE.cpp | 43 -
version3/cpp/rom_curve_NIST256.cpp | 44 -
version3/cpp/rom_curve_NIST384.cpp | 42 -
version3/cpp/rom_curve_NIST521.cpp | 42 -
version3/cpp/rom_curve_NUMS256E.cpp | 53 -
version3/cpp/rom_curve_NUMS256W.cpp | 44 -
version3/cpp/rom_curve_NUMS384E.cpp | 42 -
version3/cpp/rom_curve_NUMS384W.cpp | 42 -
version3/cpp/rom_curve_NUMS512E.cpp | 42 -
version3/cpp/rom_curve_NUMS512W.cpp | 42 -
version3/cpp/rom_curve_SECP256K1.cpp | 45 -
version3/cpp/rom_field_ANSSI.cpp | 34 -
version3/cpp/rom_field_BLS24.cpp | 37 -
version3/cpp/rom_field_BLS381.cpp | 39 -
version3/cpp/rom_field_BLS383.cpp | 39 -
version3/cpp/rom_field_BLS461.cpp | 40 -
version3/cpp/rom_field_BLS48.cpp | 38 -
version3/cpp/rom_field_BN254.cpp | 48 -
version3/cpp/rom_field_BN254CX.cpp | 49 -
version3/cpp/rom_field_BRAINPOOL.cpp | 34 -
version3/cpp/rom_field_C41417.cpp | 34 -
version3/cpp/rom_field_F25519.cpp | 43 -
version3/cpp/rom_field_F256PME.cpp | 41 -
version3/cpp/rom_field_F256PMW.cpp | 36 -
version3/cpp/rom_field_F384PM.cpp | 35 -
version3/cpp/rom_field_F512PM.cpp | 35 -
version3/cpp/rom_field_FP256BN.cpp | 45 -
version3/cpp/rom_field_FP512BN.cpp | 47 -
version3/cpp/rom_field_GOLDILOCKS.cpp | 38 -
version3/cpp/rom_field_HIFIVE.cpp | 35 -
version3/cpp/rom_field_NIST256.cpp | 35 -
version3/cpp/rom_field_NIST384.cpp | 35 -
version3/cpp/rom_field_NIST521.cpp | 34 -
version3/cpp/rom_field_SECP256K1.cpp | 38 -
version3/cpp/rsa.cpp | 164 --
version3/cpp/rsa.h | 106 --
version3/cpp/rsa_support.cpp | 239 ---
version3/cpp/rsa_support.h | 49 -
version3/cpp/testall.cpp | 1643 ------------------
version3/cpp/testnhs.cpp | 73 -
version3/cpp/x509.cpp | 1097 ------------
version3/cpp/x509.h | 115 --
version3/curves.txt | 35 -
version3/go/AES.go | 634 -------
version3/go/ARCH32.go | 28 -
version3/go/ARCH64.go | 26 -
version3/go/BIG32.go | 961 -----------
version3/go/BIG64.go | 963 -----------
version3/go/BenchtestALL.go | 881 ----------
version3/go/DBIG.go | 274 ---
version3/go/ECDH.go | 565 ------
version3/go/ECP.go | 1038 -----------
version3/go/ECP2.go | 701 --------
version3/go/ECP4.go | 711 --------
version3/go/ECP8.go | 862 ----------
version3/go/FF32.go | 943 ----------
version3/go/FF64.go | 943 ----------
version3/go/FP.go | 556 ------
version3/go/FP12.go | 765 ---------
version3/go/FP16.go | 527 ------
version3/go/FP2.go | 333 ----
version3/go/FP24.go | 885 ----------
version3/go/FP4.go | 590 -------
version3/go/FP48.go | 998 -----------
version3/go/FP8.go | 606 -------
version3/go/GCM.go | 337 ----
version3/go/HASH256.go | 193 ---
version3/go/HASH384.go | 206 ---
version3/go/HASH512.go | 206 ---
version3/go/MPIN.go | 755 --------
version3/go/MPIN192.go | 760 ---------
version3/go/MPIN256.go | 728 --------
version3/go/NHS.go | 539 ------
version3/go/PAIR.go | 777 ---------
version3/go/PAIR192.go | 574 -------
version3/go/PAIR256.go | 563 ------
version3/go/RAND.go | 153 --
version3/go/ROM_ANSSI_32.go | 36 -
version3/go/ROM_ANSSI_64.go | 36 -
version3/go/ROM_BLS24_32.go | 58 -
version3/go/ROM_BLS24_64.go | 58 -
version3/go/ROM_BLS381_32.go | 56 -
version3/go/ROM_BLS381_64.go | 58 -
version3/go/ROM_BLS383_32.go | 55 -
version3/go/ROM_BLS383_64.go | 55 -
version3/go/ROM_BLS461_32.go | 54 -
version3/go/ROM_BLS461_64.go | 54 -
version3/go/ROM_BLS48_32.go | 66 -
version3/go/ROM_BLS48_64.go | 66 -
version3/go/ROM_BN254CX_32.go | 56 -
version3/go/ROM_BN254CX_64.go | 56 -
version3/go/ROM_BN254_32.go | 56 -
version3/go/ROM_BN254_64.go | 56 -
version3/go/ROM_BRAINPOOL_32.go | 38 -
version3/go/ROM_BRAINPOOL_64.go | 38 -
version3/go/ROM_C25519_32.go | 36 -
version3/go/ROM_C25519_64.go | 36 -
version3/go/ROM_C41417_32.go | 37 -
version3/go/ROM_C41417_64.go | 36 -
version3/go/ROM_ED25519_32.go | 37 -
version3/go/ROM_ED25519_64.go | 38 -
version3/go/ROM_FP256BN_32.go | 56 -
version3/go/ROM_FP256BN_64.go | 54 -
version3/go/ROM_FP512BN_32.go | 57 -
version3/go/ROM_FP512BN_64.go | 55 -
version3/go/ROM_GOLDILOCKS_32.go | 36 -
version3/go/ROM_GOLDILOCKS_64.go | 37 -
version3/go/ROM_HIFIVE_32.go | 36 -
version3/go/ROM_HIFIVE_64.go | 36 -
version3/go/ROM_NIST256_32.go | 36 -
version3/go/ROM_NIST256_64.go | 36 -
version3/go/ROM_NIST384_32.go | 36 -
version3/go/ROM_NIST384_64.go | 36 -
version3/go/ROM_NIST521_32.go | 37 -
version3/go/ROM_NIST521_64.go | 37 -
version3/go/ROM_NUMS256E_32.go | 36 -
version3/go/ROM_NUMS256E_64.go | 36 -
version3/go/ROM_NUMS256W_32.go | 36 -
version3/go/ROM_NUMS256W_64.go | 37 -
version3/go/ROM_NUMS384E_32.go | 36 -
version3/go/ROM_NUMS384E_64.go | 36 -
version3/go/ROM_NUMS384W_32.go | 36 -
version3/go/ROM_NUMS384W_64.go | 36 -
version3/go/ROM_NUMS512E_32.go | 36 -
version3/go/ROM_NUMS512E_64.go | 36 -
version3/go/ROM_NUMS512W_32.go | 37 -
version3/go/ROM_NUMS512W_64.go | 36 -
version3/go/ROM_SEC256K1_64.go | 39 -
version3/go/ROM_SECP256K1_32.go | 39 -
version3/go/RSA.go | 361 ----
version3/go/SHA3.go | 258 ---
version3/go/TestALL.go | 1315 --------------
version3/go/TestNHS.go | 64 -
version3/go/config32.py | 357 ----
version3/go/config64.py | 357 ----
version3/go/readme.txt | 49 -
version3/java/AES.java | 695 --------
version3/java/BIG32.java | 934 ----------
version3/java/BIG64.java | 933 ----------
version3/java/DBIG32.java | 282 ---
version3/java/DBIG64.java | 280 ---
version3/java/ECDH.java | 608 -------
version3/java/ECP.java | 1112 ------------
version3/java/ECP2.java | 798 ---------
version3/java/ECP4.java | 770 ---------
version3/java/ECP8.java | 932 ----------
version3/java/FF32.java | 1029 -----------
version3/java/FF64.java | 1028 -----------
version3/java/FP12.java | 910 ----------
version3/java/FP16.java | 565 ------
version3/java/FP2.java | 425 -----
version3/java/FP24.java | 854 ----------
version3/java/FP32.java | 678 --------
version3/java/FP4.java | 724 --------
version3/java/FP48.java | 1060 ------------
version3/java/FP64.java | 682 --------
version3/java/FP8.java | 658 -------
version3/java/GCM.java | 376 ----
version3/java/HASH256.java | 218 ---
version3/java/HASH384.java | 229 ---
version3/java/HASH512.java | 232 ---
version3/java/MPIN.java | 823 ---------
version3/java/MPIN192.java | 806 ---------
version3/java/MPIN256.java | 815 ---------
version3/java/NHS.java | 577 -------
version3/java/OLDECP.java | 1044 ------------
version3/java/OLDECP2.java | 781 ---------
version3/java/PAIR.java | 817 ---------
version3/java/PAIR192.java | 550 ------
version3/java/PAIR256.java | 628 -------
version3/java/RAND.java | 163 --
version3/java/README.md | 27 -
version3/java/ROM_ANSSI_32.java | 42 -
version3/java/ROM_ANSSI_64.java | 43 -
version3/java/ROM_BLS24_32.java | 60 -
version3/java/ROM_BLS24_64.java | 60 -
version3/java/ROM_BLS381_32.java | 57 -
version3/java/ROM_BLS381_64.java | 57 -
version3/java/ROM_BLS383_32.java | 58 -
version3/java/ROM_BLS383_64.java | 55 -
version3/java/ROM_BLS461_32.java | 56 -
version3/java/ROM_BLS461_64.java | 56 -
version3/java/ROM_BLS48_32.java | 68 -
version3/java/ROM_BLS48_64.java | 68 -
version3/java/ROM_BN254CX_32.java | 57 -
version3/java/ROM_BN254CX_64.java | 58 -
version3/java/ROM_BN254_32.java | 55 -
version3/java/ROM_BN254_64.java | 55 -
version3/java/ROM_BRAINPOOL_32.java | 44 -
version3/java/ROM_BRAINPOOL_64.java | 43 -
version3/java/ROM_C25519_32.java | 41 -
version3/java/ROM_C25519_64.java | 42 -
version3/java/ROM_C41417_32.java | 41 -
version3/java/ROM_C41417_64.java | 44 -
version3/java/ROM_ED25519_32.java | 41 -
version3/java/ROM_ED25519_64.java | 43 -
version3/java/ROM_FP256BN_32.java | 56 -
version3/java/ROM_FP256BN_64.java | 55 -
version3/java/ROM_FP512BN_32.java | 55 -
version3/java/ROM_FP512BN_64.java | 56 -
version3/java/ROM_GOLDILOCKS_32.java | 43 -
version3/java/ROM_GOLDILOCKS_64.java | 44 -
version3/java/ROM_HIFIVE_32.java | 42 -
version3/java/ROM_HIFIVE_64.java | 43 -
version3/java/ROM_NIST256_32.java | 45 -
version3/java/ROM_NIST256_64.java | 43 -
version3/java/ROM_NIST384_32.java | 43 -
version3/java/ROM_NIST384_64.java | 44 -
version3/java/ROM_NIST521_32.java | 43 -
version3/java/ROM_NIST521_64.java | 44 -
version3/java/ROM_NUMS256E_32.java | 39 -
version3/java/ROM_NUMS256E_64.java | 42 -
version3/java/ROM_NUMS256W_32.java | 44 -
version3/java/ROM_NUMS256W_64.java | 45 -
version3/java/ROM_NUMS384E_32.java | 40 -
version3/java/ROM_NUMS384E_64.java | 40 -
version3/java/ROM_NUMS384W_32.java | 43 -
version3/java/ROM_NUMS384W_64.java | 55 -
version3/java/ROM_NUMS512E_32.java | 40 -
version3/java/ROM_NUMS512E_64.java | 40 -
version3/java/ROM_NUMS512W_32.java | 40 -
version3/java/ROM_NUMS512W_64.java | 41 -
version3/java/ROM_SECP256K1_32.java | 45 -
version3/java/ROM_SECP256K1_64.java | 43 -
version3/java/RSA.java | 369 ----
version3/java/SHA3.java | 255 ---
version3/java/TestECDH.java | 192 ---
version3/java/TestMPIN.java | 297 ----
version3/java/TestMPIN192.java | 297 ----
version3/java/TestMPIN256.java | 297 ----
version3/java/TestNHS.java | 70 -
version3/java/TestRSA.java | 111 --
version3/java/TesttimeECDH.java | 103 --
version3/java/TesttimeMPIN.java | 195 ---
version3/java/TesttimeMPIN192.java | 195 ---
version3/java/TesttimeMPIN256.java | 195 ---
version3/java/TesttimeRSA.java | 99 --
version3/java/config32.py | 387 -----
version3/java/config64.py | 386 -----
version3/java/pom.xml | 19 -
version3/java/private_key.java | 16 -
version3/java/public_key.java | 14 -
version3/js/BenchtestALL.html | 1076 ------------
version3/js/TestALL.html | 1527 -----------------
version3/js/TestNHS.html | 56 -
version3/js/aes.js | 705 --------
version3/js/big.js | 1552 -----------------
version3/js/ctx.js | 611 -------
version3/js/ecdh.js | 771 ---------
version3/js/ecp.js | 1398 ---------------
version3/js/ecp2.js | 921 ----------
version3/js/ecp4.js | 885 ----------
version3/js/ecp8.js | 1061 ------------
version3/js/ff.js | 1002 -----------
version3/js/fp.js | 708 --------
version3/js/fp12.js | 893 ----------
version3/js/fp16.js | 573 -------
version3/js/fp2.js | 405 -----
version3/js/fp24.js | 963 -----------
version3/js/fp4.js | 642 -------
version3/js/fp48.js | 1271 --------------
version3/js/fp8.js | 660 -------
version3/js/gcm.js | 428 -----
version3/js/hash256.js | 198 ---
version3/js/hash384.js | 275 ---
version3/js/hash512.js | 277 ---
version3/js/include.html | 25 -
version3/js/mpin.js | 1059 ------------
version3/js/mpin192.js | 1046 ------------
version3/js/mpin256.js | 1080 ------------
version3/js/nhs.js | 565 ------
version3/js/pair.js | 774 ---------
version3/js/pair192.js | 545 ------
version3/js/pair256.js | 622 -------
version3/js/rand.js | 184 --
version3/js/readme.txt | 48 -
version3/js/rom_curve.js | 1127 ------------
version3/js/rom_field.js | 425 -----
version3/js/rsa.js | 515 ------
version3/js/sha3.js | 264 ---
version3/js/uint64.js | 61 -
version3/python/big.py | 159 --
version3/python/bls381.py | 40 -
version3/python/bls383.py | 40 -
version3/python/bn254.py | 38 -
version3/python/bn254cx.py | 39 -
version3/python/c25519.py | 19 -
version3/python/config.py | 175 --
version3/python/constants.py | 17 -
version3/python/ecdh.py | 162 --
version3/python/ecp.py | 634 -------
version3/python/ecp2.py | 290 ----
version3/python/ed25519.py | 19 -
version3/python/fp.py | 97 --
version3/python/fp12.py | 314 ----
version3/python/fp2.py | 153 --
version3/python/fp4.py | 144 --
version3/python/goldilocks.py | 19 -
version3/python/mpin.py | 227 ---
version3/python/nist256.py | 19 -
version3/python/nist384.py | 19 -
version3/python/nist521.py | 20 -
version3/python/pair.py | 317 ----
version3/python/readme.txt | 39 -
version3/python/sec256k1.py | 19 -
version3/python/test.py | 122 --
version3/readme.txt | 17 -
version3/romgen.cpp | 1561 -----------------
version3/rust/BenchtestALL.rs | 970 -----------
version3/rust/TestALL.rs | 1235 --------------
version3/rust/TestNHS.rs | 76 -
version3/rust/aes.rs | 628 -------
version3/rust/arch32.rs | 22 -
version3/rust/arch64.rs | 22 -
version3/rust/big.rs | 1078 ------------
version3/rust/config32.py | 400 -----
version3/rust/config64.py | 399 -----
version3/rust/dbig.rs | 272 ---
version3/rust/ecdh.rs | 604 -------
version3/rust/ecp.rs | 1065 ------------
version3/rust/ecp2.rs | 671 --------
version3/rust/ecp4.rs | 702 --------
version3/rust/ecp8.rs | 873 ----------
version3/rust/ff.rs | 1018 -----------
version3/rust/fp.rs | 625 -------
version3/rust/fp12.rs | 798 ---------
version3/rust/fp16.rs | 553 ------
version3/rust/fp2.rs | 353 ----
version3/rust/fp24.rs | 840 ---------
version3/rust/fp4.rs | 624 -------
version3/rust/fp48.rs | 1069 ------------
version3/rust/fp8.rs | 635 -------
version3/rust/gcm.rs | 356 ----
version3/rust/hash256.rs | 177 --
version3/rust/hash384.rs | 189 --
version3/rust/hash512.rs | 190 ---
version3/rust/lib.rs | 10 -
version3/rust/mod.rs | 11 -
version3/rust/modecc.rs | 8 -
version3/rust/modpf.rs | 11 -
version3/rust/modpf192.rs | 12 -
version3/rust/modpf256.rs | 13 -
version3/rust/modrsa.rs | 6 -
version3/rust/mpin.rs | 800 ---------
version3/rust/mpin192.rs | 780 ---------
version3/rust/mpin256.rs | 791 ---------
version3/rust/nhs.rs | 511 ------
version3/rust/pair.rs | 764 ---------
version3/rust/pair192.rs | 494 ------
version3/rust/pair256.rs | 574 -------
version3/rust/rand.rs | 147 --
version3/rust/readme.txt | 40 -
version3/rust/rom_anssi_32.rs | 39 -
version3/rust/rom_anssi_64.rs | 39 -
version3/rust/rom_bls24_32.rs | 59 -
version3/rust/rom_bls24_64.rs | 59 -
version3/rust/rom_bls381_32.rs | 57 -
version3/rust/rom_bls381_64.rs | 56 -
version3/rust/rom_bls383_32.rs | 55 -
version3/rust/rom_bls383_64.rs | 55 -
version3/rust/rom_bls461_32.rs | 55 -
version3/rust/rom_bls461_64.rs | 56 -
version3/rust/rom_bls48_32.rs | 67 -
version3/rust/rom_bls48_64.rs | 67 -
version3/rust/rom_bn254CX_32.rs | 56 -
version3/rust/rom_bn254CX_64.rs | 58 -
version3/rust/rom_bn254_32.rs | 53 -
version3/rust/rom_bn254_64.rs | 53 -
version3/rust/rom_brainpool_32.rs | 40 -
version3/rust/rom_brainpool_64.rs | 40 -
version3/rust/rom_c25519_32.rs | 39 -
version3/rust/rom_c25519_64.rs | 38 -
version3/rust/rom_c41417_32.rs | 38 -
version3/rust/rom_c41417_64.rs | 38 -
version3/rust/rom_ed25519_32.rs | 38 -
version3/rust/rom_ed25519_64.rs | 38 -
version3/rust/rom_fp256bn_32.rs | 54 -
version3/rust/rom_fp256bn_64.rs | 54 -
version3/rust/rom_fp512bn_32.rs | 53 -
version3/rust/rom_fp512bn_64.rs | 53 -
version3/rust/rom_goldilocks_32.rs | 38 -
version3/rust/rom_goldilocks_64.rs | 38 -
version3/rust/rom_hifive_32.rs | 38 -
version3/rust/rom_hifive_64.rs | 38 -
version3/rust/rom_nist256_32.rs | 41 -
version3/rust/rom_nist256_64.rs | 40 -
version3/rust/rom_nist384_32.rs | 38 -
version3/rust/rom_nist384_64.rs | 38 -
version3/rust/rom_nist521_32.rs | 39 -
version3/rust/rom_nist521_64.rs | 38 -
version3/rust/rom_nums256e_32.rs | 40 -
version3/rust/rom_nums256e_64.rs | 42 -
version3/rust/rom_nums256w_32.rs | 38 -
version3/rust/rom_nums256w_64.rs | 40 -
version3/rust/rom_nums384e_32.rs | 40 -
version3/rust/rom_nums384e_64.rs | 39 -
version3/rust/rom_nums384w_32.rs | 39 -
version3/rust/rom_nums384w_64.rs | 38 -
version3/rust/rom_nums512e_32.rs | 37 -
version3/rust/rom_nums512e_64.rs | 38 -
version3/rust/rom_nums512w_32.rs | 39 -
version3/rust/rom_nums512w_64.rs | 38 -
version3/rust/rom_secp256k1_32.rs | 40 -
version3/rust/rom_secp256k1_64.rs | 39 -
version3/rust/rsa.rs | 362 ----
version3/rust/sha3.rs | 242 ---
version3/swift/BenchtestALL.swift | 888 ----------
version3/swift/TestALL.swift | 1425 ----------------
version3/swift/TestNHS.swift | 70 -
version3/swift/aes.swift | 641 -------
version3/swift/big.swift | 1150 -------------
version3/swift/config32.py | 354 ----
version3/swift/config64.py | 352 ----
version3/swift/dbig.swift | 291 ----
version3/swift/ecdh.swift | 595 -------
version3/swift/ecp.swift | 1070 ------------
version3/swift/ecp2.swift | 735 --------
version3/swift/ecp4.swift | 739 --------
version3/swift/ecp8.swift | 894 ----------
version3/swift/ff.swift | 996 -----------
version3/swift/fp.swift | 616 -------
version3/swift/fp12.swift | 815 ---------
version3/swift/fp16.swift | 576 -------
version3/swift/fp2.swift | 359 ----
version3/swift/fp24.swift | 852 ---------
version3/swift/fp4.swift | 632 -------
version3/swift/fp48.swift | 1071 ------------
version3/swift/fp8.swift | 658 -------
version3/swift/gcm.swift | 326 ----
version3/swift/hash256.swift | 188 --
version3/swift/hash384.swift | 198 ---
version3/swift/hash512.swift | 198 ---
version3/swift/mpin.swift | 822 ---------
version3/swift/mpin192.swift | 828 ---------
version3/swift/mpin256.swift | 816 ---------
version3/swift/nhs.swift | 550 ------
version3/swift/pair.swift | 724 --------
version3/swift/pair192.swift | 512 ------
version3/swift/pair256.swift | 587 -------
version3/swift/rand.swift | 136 --
version3/swift/readme.txt | 43 -
version3/swift/rom_anssi.swift | 73 -
version3/swift/rom_bls24.swift | 104 --
version3/swift/rom_bls381.swift | 105 --
version3/swift/rom_bls383.swift | 101 --
version3/swift/rom_bls461.swift | 107 --
version3/swift/rom_bls48.swift | 120 --
version3/swift/rom_bn254.swift | 104 --
version3/swift/rom_bn254CX.swift | 106 --
version3/swift/rom_brainpool.swift | 74 -
version3/swift/rom_c25519.swift | 72 -
version3/swift/rom_c41417.swift | 71 -
version3/swift/rom_ed25519.swift | 72 -
version3/swift/rom_fp256bn.swift | 102 --
version3/swift/rom_fp512bn.swift | 105 --
version3/swift/rom_goldilocks.swift | 70 -
version3/swift/rom_hifive.swift | 72 -
version3/swift/rom_nist256.swift | 70 -
version3/swift/rom_nist384.swift | 70 -
version3/swift/rom_nist521.swift | 71 -
version3/swift/rom_nums256e.swift | 72 -
version3/swift/rom_nums256w.swift | 72 -
version3/swift/rom_nums384e.swift | 72 -
version3/swift/rom_nums384w.swift | 73 -
version3/swift/rom_nums512e.swift | 75 -
version3/swift/rom_nums512w.swift | 72 -
version3/swift/rom_secp256k1.swift | 70 -
version3/swift/rsa.swift | 390 -----
version3/swift/sha3.swift | 264 ---
version3/wasm/config.py | 669 --------
version3/wasm/readme.txt | 72 -
879 files changed, 297899 deletions(-)
diff --git a/LICENSE-2.0.TXT b/LICENSE-2.0.TXT
deleted file mode 100644
index 9b5e401..0000000
--- a/LICENSE-2.0.TXT
+++ /dev/null
@@ -1,202 +0,0 @@
-
- Apache License
- Version 2.0, January 2004
- http://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
\ No newline at end of file
diff --git a/NOTICE.txt b/NOTICE.txt
deleted file mode 100644
index 2e6c028..0000000
--- a/NOTICE.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Apache Milagro Crypto Libraries
-Copyright 2016 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
diff --git a/readme.txt b/readme.txt
deleted file mode 100644
index 5469379..0000000
--- a/readme.txt
+++ /dev/null
@@ -1,41 +0,0 @@
-The Apache Milagro Cryptographic Library
-
-Note that the AMCL currently comes in two versions, version 2.2
-and version 3.1
-
-AMCL v2.2 is presented in what might be called a pre-library state.
-
-In the various supported languages the source code is made available,
-but it is not organised into rigid packages/crates/jars/whatever
-It is expected that the consumer will themselves take this final step,
-depending on the exact requirements of their project.
-
-Note that version 2.2 is no longer supported.
-
-AMCL v3.1 uses a standard Python 3 script to build libraries in all
-supported languages. New users should use this version.
-
-The main improvement is that AMCL v3 can optionally simultaneously support
-multiple elliptic curves and RSA key sizes within a single appliction.
-
-Note that AMCL is largely configured at compile time. In version 3 this
-configuration is handled by the Python script.
-
-AMCL is available in 32-bit and 64-bit versions in most languages. Limited
-support for 16-bit processors is provided by the C version.
-
-Now languages like to remain "standard" irrespective of the underlying
-hardware. However when it comes to optimal performance, it is impossible
-to remain architecture-agnostic. If a processor supports 64-bit
-instructions that operate on 64-bit registers, it will be a waste not to
-use them. Therefore the 64-bit language versions should always be used
-on 64-bit processors.
-
-Version 3.1 is a major "under the hood" upgrade. Field arithmetic is
-performed using ideas from http://eprint.iacr.org/2017/437 to ensure
-that critical calculations are performed in constant time. This strongly
-mitigates against side-channel attacks. Exception-free formulae are
-now used for Weierstrass elliptic curves. A new standardised script
-builds for the same set of curves across all languages.
-
-
diff --git a/version22/amcl22.pdf b/version22/amcl22.pdf
deleted file mode 100644
index b5ba27f..0000000
Binary files a/version22/amcl22.pdf and /dev/null differ
diff --git a/version22/bigtobig.cpp b/version22/bigtobig.cpp
deleted file mode 100644
index fbc89ea..0000000
--- a/version22/bigtobig.cpp
+++ /dev/null
@@ -1,292 +0,0 @@
-/*
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied. See the License for the
-specific language governing permissions and limitations
-under the License.
-*/
-
-//
-// Program to convert from Big to AMCL BIG format
-// cl /O2 bigtobig.cpp big.cpp miracl.lib
-// g++ -O2 bigtobig.cpp big.cpp miracl.a -o bigtobig
-//
-//
-
-#include <iostream>
-#include "zzn.h"
-
-using namespace std;
-
-Miracl precision=100;
-
-// Code to parse formula in command line
-// This code isn't mine, but its public domain
-// Shamefully I forget the source
-//
-// NOTE: It may be necessary on some platforms to change the operators * and #
-//
-
-#if defined(unix)
-#define TIMES '.'
-#define RAISE '^'
-#else
-#define TIMES '*'
-#define RAISE '#'
-#endif
-
-Big tt;
-static char *ss;
-
-void eval_power (Big& oldn,Big& n,char op)
-{
- if (op) n=pow(oldn,toint(n)); // power(oldn,size(n),n,n);
-}
-
-void eval_product (Big& oldn,Big& n,char op)
-{
- switch (op)
- {
- case TIMES:
- n*=oldn;
- break;
- case '/':
- n=oldn/n;
- break;
- case '%':
- n=oldn%n;
- }
-}
-
-void eval_sum (Big& oldn,Big& n,char op)
-{
- switch (op)
- {
- case '+':
- n+=oldn;
- break;
- case '-':
- n=oldn-n;
- }
-}
-
-void eval (void)
-{
- Big oldn[3];
- Big n;
- int i;
- char oldop[3];
- char op;
- char minus;
- for (i=0;i<3;i++)
- {
- oldop[i]=0;
- }
-LOOP:
- while (*ss==' ')
- ss++;
- if (*ss=='-') /* Unary minus */
- {
- ss++;
- minus=1;
- }
- else
- minus=0;
- while (*ss==' ')
- ss++;
- if (*ss=='(' || *ss=='[' || *ss=='{') /* Number is subexpression */
- {
- ss++;
- eval ();
- n=tt;
- }
- else /* Number is decimal value */
- {
- for (i=0;ss[i]>='0' && ss[i]<='9';i++)
- ;
- if (!i) /* No digits found */
- {
- cout << "Error - invalid number" << endl;
- exit (20);
- }
- op=ss[i];
- ss[i]=0;
- n=atoi(ss);
- ss+=i;
- *ss=op;
- }
- if (minus) n=-n;
- do
- op=*ss++;
- while (op==' ');
- if (op==0 || op==')' || op==']' || op=='}')
- {
- eval_power (oldn[2],n,oldop[2]);
- eval_product (oldn[1],n,oldop[1]);
- eval_sum (oldn[0],n,oldop[0]);
- tt=n;
- return;
- }
- else
- {
- if (op==RAISE)
- {
- eval_power (oldn[2],n,oldop[2]);
- oldn[2]=n;
- oldop[2]=RAISE;
- }
- else
- {
- if (op==TIMES || op=='/' || op=='%')
- {
- eval_power (oldn[2],n,oldop[2]);
- oldop[2]=0;
- eval_product (oldn[1],n,oldop[1]);
- oldn[1]=n;
- oldop[1]=op;
- }
- else
- {
- if (op=='+' || op=='-')
- {
- eval_power (oldn[2],n,oldop[2]);
- oldop[2]=0;
- eval_product (oldn[1],n,oldop[1]);
- oldop[1]=0;
- eval_sum (oldn[0],n,oldop[0]);
- oldn[0]=n;
- oldop[0]=op;
- }
- else /* Error - invalid operator */
- {
- cout << "Error - invalid operator" << endl;
- exit (20);
- }
- }
- }
- }
- goto LOOP;
-}
-
-void output(int w,Big t,Big m)
-{
- Big y=t;
-
- for (int i=0;i<w;i++)
- {
- cout << "0x" << y%m ;
- if (i<w-1) cout << ",";
- y/=m;
- }
- cout << endl;
-}
-
-int main(int argc, char **argv)
-{
- int i,ip,chunk,basebits;
- Big n,m;
- BOOL gotP,gotA,gotB;
- int Base;
- miracl *mip=&precision;
- argv++; argc--;
- if (argc<1)
- {
- cout << "Program converts from Big to BIG" << endl;
- cout << "bigtobig <big number> <chunk>> <basebits>" << endl;
- cout << "OR" << endl;
- cout << "bigtobig <formula for big number> <chunk>> <basebits>" << endl;
-#if defined(unix)
- cout << "e.g. bigtobig -f 2^255-19 32 29" << endl;
-#else
- cout << "e.g. bigtobig -f 2#255-19 32 29" << endl;
-#endif
- cout << "To input Big number in Hex, precede with -h" << endl;
- return 0;
- }
-
- ip=0;
- gprime(1000);
- gotP=gotA=gotB=FALSE;
- n=0;
- Base=10;
- while (ip<argc)
- {
- if (!gotP && strcmp(argv[ip],"-f")==0)
- {
- ip++;
- if (!gotP && ip<argc)
- {
-
- ss=argv[ip++];
- tt=0;
- eval();
- n=tt;
- gotP=TRUE;
- continue;
- }
- else
- {
- cout << "Error in command line" << endl;
- return 0;
- }
- }
-
-
- if (strcmp(argv[ip],"-h")==0)
- {
- ip++;
- Base=16;
- continue;
- }
-
- if (!gotP)
- {
- mip->IOBASE=Base;
- n=argv[ip++];
- mip->IOBASE=10;
- gotP=TRUE;
- continue;
- }
- if (!gotA)
- {
- mip->IOBASE=Base;
- chunk=atoi(argv[ip++]);
- gotA=TRUE;
- continue;
- }
- if (!gotB)
- {
- mip->IOBASE=Base;
- basebits=atoi(argv[ip++]);
- gotB=TRUE;
- continue;
- }
- cout << "Error in command line" << endl;
- return 0;
- }
- if (!gotP || !gotA || !gotB)
- {
- cout << "Error in command line" << endl;
- return 0;
- }
-
- mip->IOBASE=16;
-
- m=pow((Big)2,basebits);
-
- output(1+bits(n)/basebits,n,m);
-
- return 0;
-}
-
diff --git a/version22/blsgen.cpp b/version22/blsgen.cpp
deleted file mode 100644
index 9b08b7c..0000000
--- a/version22/blsgen.cpp
+++ /dev/null
@@ -1,194 +0,0 @@
-/*
-Copyright 2015 CertiVox UK Ltd
-
-This file is part of The CertiVox MIRACL IOT Crypto SDK (MiotCL)
-
-MiotCL is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-MiotCL is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with MiotCL. If not, see <http://www.gnu.org/licenses/>.
-
-You can be released from the requirements of the license by purchasing
-a commercial license.
-*/
-
-/* BLSGEN - Helper MIRACL program to generate constants for BlS curves
-
-(MINGW build)
-
-g++ -O3 blsgen.cpp big.cpp zzn.cpp ecn.cpp zzn2.cpp ecn2.cpp miracl.a -o blsgen.exe
-
-This ONLY works for D-type curves of the form y^2=x^3+1, with a positive x parameter
-
-*/
-
-#include <iostream>
-#include "big.h"
-#include "ecn.h"
-#include "zzn2.h"
-#include "ecn2.h"
-
-using namespace std;
-
-Miracl precision(20,0);
-
-Big output(int chunk,int w,Big t,Big m)
-{
- Big last,y=t;
-
- cout << "{";
- for (int i=0;i<w;i++)
- {
- last=y%m;
- cout << "0x" << last;
- y/=m;
- if (i==w-1) break;
- if (chunk==64) cout << "L,";
- else cout << ",";
- }
-
- if (chunk==64) cout << "L}";
- else cout << "}";
- return last;
-}
-
-void set_frobenius_constant(ZZn2 &X)
-{
- Big p=get_modulus();
- switch (get_mip()->pmod8)
- {
- case 5:
- X.set((Big)0,(Big)1); // = (sqrt(-2)^(p-1)/2
- break;
- case 3: // = (1+sqrt(-1))^(p-1)/2
- X.set((Big)1,(Big)1);
- break;
- case 7:
- X.set((Big)2,(Big)1); // = (2+sqrt(-1))^(p-1)/2
- default: break;
- }
- X=pow(X,(p-1)/6);
-}
-
-/* Fill in this bit yourself.... */
-
-#define CHUNK 64 /* processor word size */
-#define MBITS 455 /* Modulus size in bits */
-
-/* This next from output of check.cpp program */
-#define BASEBITS 60
-
-#define MODTYPE NOT_SPECIAL
-#define CURVETYPE WEIERSTRASS
-#define CURVE_A 0 // like A parameter in CURVE: y^2=x^3+Ax+B
-
-/* .....to here */
-
-#define WORDS (1+((MBITS-1)/BASEBITS))
-
-int main()
-{
- miracl *mip=&precision;
- Big p,q,R,Beta;
- Big m,x,y,w,t,c,n,r,a,b,gx,gy,B,xa,xb,ya,yb,cof;
- Big np,PP,TT,FF;
- ZZn cru;
- ZZn2 X;
- ECn P;
- ECn2 Q;
- ZZn2 Xa,Ya;
- int i,j;
-
- mip->IOBASE=16;
-
-/* Set BLS value x which determines curve */
-
- x= (char *)"10002000002000010007";
- B=1;
- x= (char *)"10000000000004100100";
- B=7;
- x= (char *)"10000020000080000800";
- B=10;
-/* ... to here */
-
- p=(pow(x,6)-2*pow(x,5)+2*pow(x,3)+x+1)/3;
- ecurve((Big)0,B,p,MR_AFFINE);
- mip->TWIST=MR_SEXTIC_D;
- t=x+1;
- q=pow(x,4)-x*x+1;
- cof=(p+1-t)/q;
-
-// cout << "cof= " << (p+1-t)/q << endl;
-
- gx=-1; gy=3;
- if (!P.set(gx,gy))
- {
- cout << "Failed - try another x " << endl;
- return 0;
- }
-
-// while (!P.set(gx) || (cof*P).iszero()) gx=gx+1;
-
- P*=cof;
- P.get(gx,gy);
-
- cout << "MOD8 " << p%8 << endl;
-
- m=pow((Big)2,BASEBITS);
-
- cout << "MConst=0x" << inverse(m-p%m,m) << ";" << endl;
-
- cout << "Modulus="; output(CHUNK,WORDS,p,m); cout << ";" << endl;
-
- cout << "CURVE_Order="; output(CHUNK,WORDS,q,m); cout << ";" << endl;
- cout << "CURVE_Cof="; output(CHUNK,WORDS,cof,m); cout << ";" << endl;
- cout << "CURVE_B= "; output(CHUNK,WORDS,B,m); cout << ";" << endl;
- cout << "CURVE_Gx="; output(CHUNK,WORDS,gx,m); cout << ";" << endl;
- cout << "CURVE_Gy="; output(CHUNK,WORDS,gy,m); cout << ";" << endl;
- cout << endl;
- cout << "CURVE_Bnx="; output(CHUNK,WORDS,x,m); cout << ";" << endl;
-
- modulo(p);
-
- cru=pow((ZZn)2,(p-1)/3);
- cru*=cru; // right cube root of unity
-
- cout << "CURVE_Cru="; output(CHUNK,WORDS,(Big)cru,m); cout << ";" << endl;
-
- set_frobenius_constant(X);
- X.get(a,b);
- cout << "CURVE_Fra="; output(CHUNK,WORDS,a,m); cout << ";" << endl;
- cout << "CURVE_Frb="; output(CHUNK,WORDS,b,m); cout << ";" << endl;
-
- while (!Q.set(randn2())) ;
-
- TT=t*t-2*p;
- PP=p*p;
- FF=sqrt((4*PP-TT*TT)/3);
- np=PP+1-(-3*FF+TT)/2; // 2 possibilities...
-
- Q=(np/q)*Q;
-
- Q.get(Xa,Ya);
- Xa.get(a,b);
- cout << "CURVE_Pxa="; output(CHUNK,WORDS,a,m); cout << ";" << endl;
- cout << "CURVE_Pxb="; output(CHUNK,WORDS,b,m); cout << ";" << endl;
- Ya.get(a,b);
- cout << "CURVE_Pya="; output(CHUNK,WORDS,a,m); cout << ";" << endl;
- cout << "CURVE_Pyb="; output(CHUNK,WORDS,b,m); cout << ";" << endl;
-
- Q*=q;
- if (!Q.iszero())
- {
- cout << "**** Failed ****" << endl;
- cout << "\nQ= " << Q << endl << endl;
- }
-}
diff --git a/version22/bngen.cpp b/version22/bngen.cpp
deleted file mode 100644
index da4c10c..0000000
--- a/version22/bngen.cpp
+++ /dev/null
@@ -1,251 +0,0 @@
-/*
-Copyright 2015 CertiVox UK Ltd
-
-This file is part of The CertiVox MIRACL IOT Crypto SDK (MiotCL)
-
-MiotCL is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-MiotCL is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with MiotCL. If not, see <http://www.gnu.org/licenses/>.
-
-You can be released from the requirements of the license by purchasing
-a commercial license.
-*/
-
-/* BNGEN - Helper MIRACL program to generate constants for BN curve
-
-(MINGW build)
-
-g++ -O3 bngen.cpp big.cpp zzn.cpp zzn2.cpp ecn2.cpp miracl.a -o bngen.exe
-
-This ONLY works for D-type curves of the form y^2=x^3+2, with a negative x parameter, and x=3 mod 4
-
-*/
-
-#include <iostream>
-#include "big.h"
-#include "zzn2.h"
-#include "ecn2.h"
-
-using namespace std;
-
-Miracl precision(20,0);
-
-Big output(int chunk,int w,Big t,Big m)
-{
- Big last,y=t;
-
- cout << "{";
- for (int i=0;i<w;i++)
- {
- last=y%m;
- cout << "0x" << last;
- y/=m;
- if (i==w-1) break;
- if (chunk==64) cout << "L,";
- else cout << ",";
- }
-
- if (chunk==64) cout << "L}";
- else cout << "}";
- return last;
-}
-
-void q_power_frobenius(ECn2 &A,ZZn2 &F)
-{
-// Fast multiplication of A by q (for Trace-Zero group members only)
- ZZn2 x,y,z,w,r;
-
- A.get(x,y);
-
- w=F*F;
- r=F;
-
- if (get_mip()->TWIST==MR_SEXTIC_M) r=inverse(F); // could be precalculated
- if (get_mip()->TWIST==MR_SEXTIC_D) r=F;
-
- w=r*r;
- x=w*conj(x);
- y=r*w*conj(y);
-
- A.set(x,y);
-}
-
-//
-// Faster Hashing to G2 - Fuentes-Castaneda, Knapp and Rodriguez-Henriquez
-//
-
-void cofactor(ECn2& S,ZZn2 &F,Big& x)
-{
- ECn2 T,K;
- T=S;
- T*=-x;
- T.norm();
- K=(T+T)+T;
- K.norm();
- q_power_frobenius(K,F);
- q_power_frobenius(S,F); q_power_frobenius(S,F); q_power_frobenius(S,F);
- S+=T; S+=K;
- q_power_frobenius(T,F); q_power_frobenius(T,F);
- S+=T;
- S.norm();
-}
-
-void set_frobenius_constant(ZZn2 &X)
-{
- Big p=get_modulus();
- switch (get_mip()->pmod8)
- {
- case 5:
- X.set((Big)0,(Big)1); // = (sqrt(-2)^(p-1)/2
- break;
- case 3: // = (1+sqrt(-1))^(p-1)/2
- X.set((Big)1,(Big)1);
- break;
- case 7:
- X.set((Big)2,(Big)1); // = (2+sqrt(-1))^(p-1)/2
- default: break;
- }
- X=pow(X,(p-1)/6);
-}
-
-/* Fill in this bit yourself.... */
-
-#define CHUNK 64 /* processor word size */
-#define MBITS 454 /* Modulus size in bits */
-
-/* This next from output of check.cpp program */
-#define BASEBITS 60
-
-#define MODTYPE NOT_SPECIAL
-#define CURVETYPE WEIERSTRASS
-#define CURVE_A 0 // like A parameter in CURVE: y^2=x^3+Ax+B
-
-/* .....to here */
-
-#define WORDS (1+((MBITS-1)/BASEBITS))
-
-int main()
-{
- miracl *mip=&precision;
- Big p,q,R,cru;
- Big m,x,y,w,t,c,n,r,a,b,gx,gy,B,xa,xb,ya,yb,cof;
- ZZn2 X;
- ECn2 Q;
- ZZn2 Xa,Ya;
- int i;
-
- mip->IOBASE=16;
-
-/* Set BN value x which determines curve - note that x is assumed to be negative */
-
-// x=(char *)"6000000000101041"; // for full 256-bit GT_STRONG parameter
-// x=(char *)"4080000000000001"; // Fast but not not GT_STRONG parameter
-
-// x=(char *)"4000020100608205"; // G2 and GT-Strong parameter
-// x=(char *)"4000000003C012B1"; // CertiVox's GT_STRONG parameter
-// x=(char *)"10000000000000000000004000000000000001001";
-// x=(char *)"4000806000004081"; // Best GT_STRONG parameter
-
-/* Fill in this bit yourself... */
-
-// x=(char *)"4080000000000001"; // Nogami's fast parameter
- x=(char *)"10000010000000000000100000001";
-// x=(char *)"10000000000000000000004000000000000001001";
-
-/* ... to here */
-
- p=36*pow(x,4)-36*pow(x,3)+24*x*x-6*x+1;
- ecurve((Big)0,(Big)2,p,MR_AFFINE);
- mip->TWIST=MR_SEXTIC_D;
- t=6*x*x+1;
- q=p+1-t;
- cof=1;
- B=2;
- gx=p-1;
- gy=1;
-
- cout << "MOD8 " << p%8 << endl;
-
- m=pow((Big)2,BASEBITS);
-
- cout << "MConst=0x" << inverse(m-p%m,m) << ";" << endl;
-
- cout << "Modulus="; output(CHUNK,WORDS,p,m); cout << ";" << endl;
-
- cout << "CURVE_Order="; output(CHUNK,WORDS,q,m); cout << ";" << endl;
- cout << "CURVE_Cof="; output(CHUNK,WORDS,cof,m); cout << ";" << endl;
- cout << "CURVE_B= "; output(CHUNK,WORDS,B,m); cout << ";" << endl;
- cout << "CURVE_Gx="; output(CHUNK,WORDS,gx,m); cout << ";" << endl;
- cout << "CURVE_Gy="; output(CHUNK,WORDS,gy,m); cout << ";" << endl;
- cout << endl;
- cout << "CURVE_Bnx="; output(CHUNK,WORDS,x,m); cout << ";" << endl;
-
- cru=(18*pow(x,3)-18*x*x+9*x-2);
- cout << "CURVE_Cru="; output(CHUNK,WORDS,cru,m); cout << ";" << endl;
-
- set_frobenius_constant(X);
- X.get(a,b);
- cout << "CURVE_Fra="; output(CHUNK,WORDS,a,m); cout << ";" << endl;
- cout << "CURVE_Frb="; output(CHUNK,WORDS,b,m); cout << ";" << endl;
-
- Xa.set((ZZn)0,(ZZn)-1);
- Ya.set((ZZn)1,ZZn(0));
- Q.set(Xa,Ya);
-
-// cofactor(Q,X,x);
-
- Q=(p-1+t)*Q;
-
- Q.get(Xa,Ya);
- Xa.get(a,b);
- cout << "CURVE_Pxa="; output(CHUNK,WORDS,a,m); cout << ";" << endl;
- cout << "CURVE_Pxb="; output(CHUNK,WORDS,b,m); cout << ";" << endl;
- Ya.get(a,b);
- cout << "CURVE_Pya="; output(CHUNK,WORDS,a,m); cout << ";" << endl;
- cout << "CURVE_Pyb="; output(CHUNK,WORDS,b,m); cout << ";" << endl;
-
-// Q*=q;
-// cout << "Q= " << Q << endl;
-
-
- cout << "CURVE_W[2]={"; output(CHUNK,WORDS,6*x*x-4*x+1,m);cout << ","; output(CHUNK,WORDS,(2*x-1),m); cout << "};" << endl;
- cout << "CURVE_SB[2][2]={"; cout << "{"; output(CHUNK,WORDS,6*x*x-2*x,m); cout << ","; output(CHUNK,WORDS,(2*x-1),m); cout << "}";cout << ","; cout << "{"; output(CHUNK,WORDS,(2*x-1),m); cout << ","; output(CHUNK,WORDS,q-(6*x*x-4*x+1),m); cout << "}"; cout << "};" << endl;
-
- cout << "CURVE_WB[4]={"; output(CHUNK,WORDS,2*x*x-3*x+1,m); cout << ","; output(CHUNK,WORDS,12*x*x*x-8*x*x+x,m);
- cout << ","; output(CHUNK,WORDS,6*x*x*x-4*x*x+x,m); cout << ","; output(CHUNK,WORDS,2*x*x-x,m); cout << "};" << endl;
-
- cout << "CURVE_BB[4][4]={";
- cout << "{";
- output(CHUNK,WORDS,q-x+1,m);
- cout << ","; output(CHUNK,WORDS,q-x,m);
- cout << ","; output(CHUNK,WORDS,q-x,m);
- cout << ","; output(CHUNK,WORDS,2*x,m);
- cout << "}";
-
- cout << ","; cout << "{";output(CHUNK,WORDS,2*x-1,m);
- cout << ","; output(CHUNK,WORDS,q-x,m);
- cout << ","; output(CHUNK,WORDS,q-x+1,m);
- cout << ","; output(CHUNK,WORDS,q-x,m);
- cout << "}";
- cout << ","; cout << "{"; output(CHUNK,WORDS,2*x,m);
- cout << ","; output(CHUNK,WORDS,2*x-1,m);
- cout << ","; output(CHUNK,WORDS,2*x-1,m);
- cout << ","; output(CHUNK,WORDS,2*x-1,m);
- cout << "}";
-
- cout << ","; cout << "{"; output(CHUNK,WORDS,x+1,m);
- cout << ","; output(CHUNK,WORDS,4*x-2,m);
- cout << ","; output(CHUNK,WORDS,q-2*x-1,m);
- cout << ","; output(CHUNK,WORDS,x+1,m);
- cout << "}";
- cout << "};" << endl;
-}
diff --git a/version22/c/CARSK.pem b/version22/c/CARSK.pem
deleted file mode 100644
index 743aead..0000000
--- a/version22/c/CARSK.pem
+++ /dev/null
@@ -1,54 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-256-CBC,E7A447797FE65D8D1309B743D8BA74B7
-
-G+ZhtxB+W4fKo11fAzggY0OOOB1RAwwSZFZ0DhlYEl76BLMUlXUfiziGQvpKcKdW
-aKcCPqmWw0TFkgwdwRB1NPu2tX786tNF3tIQa33TEuaY1ekyP9DpQdGksNHEIZ5N
-fCW22KJ+7lcm5/0G8IJXXUAAXiE65o+X+6vlmT9nzSPlCKOZvb0ITtahuphzg6l3
-QmXHYYtflKoqv9mFo63IGIp2EXjAlJUlVs+8f1NG+8b4J0KrHXx5MmvNBn+86GEV
-8lyryqgVFRxfbcvDI2s7GGLW4KZCDCRxRrG3GTtXRjJaVjw7VutL1teUfHKOegpA
-iFa0HNpILpqu6K99DBcteJaFxW3gOr3PdaylC046G+P059AnBA86lsJedKjbJ3WW
-DXtOawuBIQ3iIrGJ/q5vMK7cbAG785HOaqMQth0YPB/VFklsjAd/RW2CKr94ggB9
-wU1/IUcJ25pz/ph/7h7KDjoxIa1OEx5EHzzrFc88jGAmEBSfx6J5tU2GtruJhoqr
-SpiW36KQt+xFydfjywxO32BQ9YPae1yeQQwrX67YBNUkQhQpff7KxqqQJt7wqAVL
-vD4jthqRHOutco/It0cuqyO8dK01UDB6UIZdRlJuJ83HmqI+3YDtd2MOUIteSXMb
-4wAhMf1XFB6FQUuzB9Nc85wXWa5a7qyP63VMoPgiqgh7g5Is52hlcFcIBz6GE+h6
-Oz8FnaVX5K7Co2XojTJ3f99t5oEvF3aMPbCnG6izFQYNH+o8XTxRrldpb7hvoU6t
-z3lh4i8p2lq/DO1F8C9jKX0nJiSK311beuqkb0pA4VBPYNYBvx+UP3zBdcE82sab
-2flx1m6/OrJnyDMAOZAUFdbarU4AFJgLrBWbDjouCDHlQLZjY6ubBlvmslzY9QdR
-A1ssy1+wi39bM6ZSnrS1310/JDQPdIrd6Srh6e+54xiJHpjcvqE77uBeeje9ilHB
-pXdKi6Hv873yrI5T/F5zonKoFc1OO4cOrc8MLaQs0kJTcjXdg9uNk3AYKDYyq5JV
-gvJU2c/W/Z4pq0ve2ekETXjaoz2DSzbg1LGgzy/AOdPukmNgADn9qRyNtgwr30ix
-kDRjEG9bt5unkskXjdqtwl6mKiYvtM2SPfncdyCW3tqW++a7GvlA1TLecgzw9t40
-+m0gKcIBj/vy6VFiLluQy7J59+MD6BNVxSeFvR2gMsj1sIxsIrq4lxPyG4knp3RA
-JeKTDes5DrquboJ1usl2ra8v5njJB8phHDVss4rBtlWuw5zBagaTN2PU8GLzmte6
-6PeagGDYNl2zoTMVOtTQ1BYDE08IS6ZNqSftrkGx4ypDnI5EHqoAl+ksSenGq2eg
-0/vW768hHSmQXIZHsV6YuI2nqYoM+SDAAFg38hnrtoIYEf0XYhHhr3hasL1ckWxG
-Q/fAlZynbxKL98KKB47eXXky0CHeJ77zICD1sotXIJJN4yMeDW14HIFCV/G9l+RI
-NYHCYzlnoaz244TTidsyYt02GYbR3zshhUw1CNn4THHQl9p4o7jYO/gFZtelc3+V
-SeVOKCXiSnJPhPiFVbnhlpJ7+4GhdpZRi84a6aLRinOUZf0WjYspOKhEaPOP5e1m
-ZKgC6vqqWawN+NQhHNG/S8Opu/TAt0hNE5fCYUUdWCL3MmuJPSsJ0orEtV3TAqLz
-q4znU2fzh3nuTKVWxeHbiVJ8dW50JhhixDYW4KrW8U/KHpqIRc3CztZllFrH/5ly
-al1FqhsNt4DgJwgqz34MMtKFOWw5K9/DPB/Dy0s9BrxkE5B6dxwj5S9RcVMkkkw/
-xVF2qt7ApLcPl84iQtP+Dz+bGWCL7LeeO5JG42Al4M3buO5b+34N4CpRHZh5E6AW
-uRbFuY/RiiqOxG+PQmWRdnEReBf4ORgocr5Kv3PAjp2LUf4aeSBsmml2CV7lgJue
-BOPJuiHL9YTfBchABi1dkMTjXUshtbtxLmBVJmkFsaTsMZsKKKRuIk+O80yYOncd
-uF+vKn1+F1hMV84ejIjLjreq+yTSDvVlmQn5v4jbDLtlpYBFoaMPq1GBqt0ZYSrK
-/sy/sy+jzneESlb520jOtSd2sryXL3jJOxJauZltALmJ5ZqImJ1NXZ8vTTwLmMaA
-DG3PqtZprI8oOj/iPXCcMPXkaLWJ+lVIfIqfxXYSMwj9ZVYoRBaYmym33v7pZtkn
-/8zLXv8J19LSoG+Ykfaf7Sf8fi0FzRmrj7jjXc2Sf5m1PhS2Ss17J8YydXeulKER
-M1TPOcfrkvdHZzt+ECNkqDxbbskaUTm9HdZ5HTdybnLryQalEzR9jzC02QobDOiI
-eQ6j0MjEpK4KQ9HY+deZiFysKQopvBjD7uSoq8gTBtLD4gpYVveD7Y5tlwVknrhl
-iFhdRCAgC6XLE+N7PkQm+nyI9T/IERSP9zDQyTguJKP4sq3Hl6hCkjuuogD6nLmP
-pKL4z+u0pqEakNExFxsDL/hf2G3KnFEJHhtT4/JlxuuJhdKs1uCO7zzWratwbFM1
-EQ9euYxLutt/5sNOaU+uabmk4R4ziRsdFYDOHBQR3IhoUJ9L4UhPvMZTo+ZSHpWC
-ellUk5UspPR3pzcd+lnQQGNTkwzMWayhSFfFJ6sdvfd1TTNflYpFhLHOD+ZSx4go
-/VrkSOkoXZtdr8a6cqOI1wOQIoeYjama4h+R+XW1jrc52GHchhrx7ZPjWGllYN5g
-ypzWl9gFbGGfx1gmIt6OCfCIcGxOMS7o5taCUpjiqU75Ts4Ri+/c6RJcI3CqBBT6
-mJ+nSfTZ7hMTaCmmmkYbvcCcAVZ9W/IxyVMj/p7pI7sH65vz3mNC7E/veF7rlSSZ
-EvgSjv12FgmD5rGtW5b0bbbylOvRygo1BpgCWSp91R22Yw+pjZilSvy0kWEMq2yx
-d6sLdkjZgLtp2NPMCM51OpuO0Hidd7KwdaJoB5rJwGs1+JWKtv/Xr4cSBXzpgDWl
-LxaGwC0KcDVoGRqvJldGuCpdN56yC46njzgZmQBq2QXthrJ1wveMiwpyFd/fu4KJ
-gu+OlNzMvZRz9zJkfHdswnx/P/E+FR/yv+W1ZKKhb6hBHoW7HOuJecjmbZpD562Y
-snzQ+Ehc3H88Mykzcc/iHZabNbP+M2TcPQ5eLvd2oPKsSFZw7EHU1B6XFpzk6r8x
------END RSA PRIVATE KEY-----
diff --git a/version22/c/aes.c b/version22/c/aes.c
deleted file mode 100644
index f876c51..0000000
--- a/version22/c/aes.c
+++ /dev/null
@@ -1,702 +0,0 @@
-/*
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied. See the License for the
-specific language governing permissions and limitations
-under the License.
-*/
-
-
-/*
- * Implementation of the NIST Advanced Ecryption Standard
- *
- * SU=m, SU is Stack Usage
- */
-
-#include <stdlib.h>
-#include "arch.h"
-#include "amcl.h"
-
-/* this is fixed */
-#define NB 4
-
-/* Rotates 32-bit word left by 1, 2 or 3 byte */
-
-#define ROTL8(x) (((x)<<8)|((x)>>24))
-#define ROTL16(x) (((x)<<16)|((x)>>16))
-#define ROTL24(x) (((x)<<24)|((x)>>8))
-
-static const uchar InCo[4]= {0xB,0xD,0x9,0xE}; /* Inverse Coefficients */
-
-static const uchar ptab[]=
-{
- 1,3,5,15,17,51,85,255,26,46,114,150,161,248,19,53,
- 95,225,56,72,216,115,149,164,247,2,6,10,30,34,102,170,
- 229,52,92,228,55,89,235,38,106,190,217,112,144,171,230,49,
- 83,245,4,12,20,60,68,204,79,209,104,184,211,110,178,205,
- 76,212,103,169,224,59,77,215,98,166,241,8,24,40,120,136,
- 131,158,185,208,107,189,220,127,129,152,179,206,73,219,118,154,
- 181,196,87,249,16,48,80,240,11,29,39,105,187,214,97,163,
- 254,25,43,125,135,146,173,236,47,113,147,174,233,32,96,160,
- 251,22,58,78,210,109,183,194,93,231,50,86,250,21,63,65,
- 195,94,226,61,71,201,64,192,91,237,44,116,156,191,218,117,
- 159,186,213,100,172,239,42,126,130,157,188,223,122,142,137,128,
- 155,182,193,88,232,35,101,175,234,37,111,177,200,67,197,84,
- 252,31,33,99,165,244,7,9,27,45,119,153,176,203,70,202,
- 69,207,74,222,121,139,134,145,168,227,62,66,198,81,243,14,
- 18,54,90,238,41,123,141,140,143,138,133,148,167,242,13,23,
- 57,75,221,124,132,151,162,253,28,36,108,180,199,82,246,1
-};
-
-static const uchar ltab[]=
-{
- 0,255,25,1,50,2,26,198,75,199,27,104,51,238,223,3,
- 100,4,224,14,52,141,129,239,76,113,8,200,248,105,28,193,
- 125,194,29,181,249,185,39,106,77,228,166,114,154,201,9,120,
- 101,47,138,5,33,15,225,36,18,240,130,69,53,147,218,142,
- 150,143,219,189,54,208,206,148,19,92,210,241,64,70,131,56,
- 102,221,253,48,191,6,139,98,179,37,226,152,34,136,145,16,
- 126,110,72,195,163,182,30,66,58,107,40,84,250,133,61,186,
- 43,121,10,21,155,159,94,202,78,212,172,229,243,115,167,87,
- 175,88,168,80,244,234,214,116,79,174,233,213,231,230,173,232,
- 44,215,117,122,235,22,11,245,89,203,95,176,156,169,81,160,
- 127,12,246,111,23,196,73,236,216,67,31,45,164,118,123,183,
- 204,187,62,90,251,96,177,134,59,82,161,108,170,85,41,157,
- 151,178,135,144,97,190,220,252,188,149,207,205,55,63,91,209,
- 83,57,132,60,65,162,109,71,20,42,158,93,86,242,211,171,
- 68,17,146,217,35,32,46,137,180,124,184,38,119,153,227,165,
- 103,74,237,222,197,49,254,24,13,99,140,128,192,247,112,7
-};
-
-static const uchar fbsub[]=
-{
- 99,124,119,123,242,107,111,197,48,1,103,43,254,215,171,118,
- 202,130,201,125,250,89,71,240,173,212,162,175,156,164,114,192,
- 183,253,147,38,54,63,247,204,52,165,229,241,113,216,49,21,
- 4,199,35,195,24,150,5,154,7,18,128,226,235,39,178,117,
- 9,131,44,26,27,110,90,160,82,59,214,179,41,227,47,132,
- 83,209,0,237,32,252,177,91,106,203,190,57,74,76,88,207,
- 208,239,170,251,67,77,51,133,69,249,2,127,80,60,159,168,
- 81,163,64,143,146,157,56,245,188,182,218,33,16,255,243,210,
- 205,12,19,236,95,151,68,23,196,167,126,61,100,93,25,115,
- 96,129,79,220,34,42,144,136,70,238,184,20,222,94,11,219,
- 224,50,58,10,73,6,36,92,194,211,172,98,145,149,228,121,
- 231,200,55,109,141,213,78,169,108,86,244,234,101,122,174,8,
- 186,120,37,46,28,166,180,198,232,221,116,31,75,189,139,138,
- 112,62,181,102,72,3,246,14,97,53,87,185,134,193,29,158,
- 225,248,152,17,105,217,142,148,155,30,135,233,206,85,40,223,
- 140,161,137,13,191,230,66,104,65,153,45,15,176,84,187,22
-};
-
-static const uchar rbsub[]=
-{
- 82,9,106,213,48,54,165,56,191,64,163,158,129,243,215,251,
- 124,227,57,130,155,47,255,135,52,142,67,68,196,222,233,203,
- 84,123,148,50,166,194,35,61,238,76,149,11,66,250,195,78,
- 8,46,161,102,40,217,36,178,118,91,162,73,109,139,209,37,
- 114,248,246,100,134,104,152,22,212,164,92,204,93,101,182,146,
- 108,112,72,80,253,237,185,218,94,21,70,87,167,141,157,132,
- 144,216,171,0,140,188,211,10,247,228,88,5,184,179,69,6,
- 208,44,30,143,202,63,15,2,193,175,189,3,1,19,138,107,
- 58,145,17,65,79,103,220,234,151,242,207,206,240,180,230,115,
- 150,172,116,34,231,173,53,133,226,249,55,232,28,117,223,110,
- 71,241,26,113,29,41,197,137,111,183,98,14,170,24,190,27,
- 252,86,62,75,198,210,121,32,154,219,192,254,120,205,90,244,
- 31,221,168,51,136,7,199,49,177,18,16,89,39,128,236,95,
- 96,81,127,169,25,181,74,13,45,229,122,159,147,201,156,239,
- 160,224,59,77,174,42,245,176,200,235,187,60,131,83,153,97,
- 23,43,4,126,186,119,214,38,225,105,20,99,85,33,12,125
-};
-
-static const unsign32 rco[]=
-{1,2,4,8,16,32,64,128,27,54,108,216,171,77,154,47};
-
-static const unsign32 ftable[]=
-{
- 0xa56363c6,0x847c7cf8,0x997777ee,0x8d7b7bf6,0xdf2f2ff,0xbd6b6bd6,
- 0xb16f6fde,0x54c5c591,0x50303060,0x3010102,0xa96767ce,0x7d2b2b56,
- 0x19fefee7,0x62d7d7b5,0xe6abab4d,0x9a7676ec,0x45caca8f,0x9d82821f,
- 0x40c9c989,0x877d7dfa,0x15fafaef,0xeb5959b2,0xc947478e,0xbf0f0fb,
- 0xecadad41,0x67d4d4b3,0xfda2a25f,0xeaafaf45,0xbf9c9c23,0xf7a4a453,
- 0x967272e4,0x5bc0c09b,0xc2b7b775,0x1cfdfde1,0xae93933d,0x6a26264c,
- 0x5a36366c,0x413f3f7e,0x2f7f7f5,0x4fcccc83,0x5c343468,0xf4a5a551,
- 0x34e5e5d1,0x8f1f1f9,0x937171e2,0x73d8d8ab,0x53313162,0x3f15152a,
- 0xc040408,0x52c7c795,0x65232346,0x5ec3c39d,0x28181830,0xa1969637,
- 0xf05050a,0xb59a9a2f,0x907070e,0x36121224,0x9b80801b,0x3de2e2df,
- 0x26ebebcd,0x6927274e,0xcdb2b27f,0x9f7575ea,0x1b090912,0x9e83831d,
- 0x742c2c58,0x2e1a1a34,0x2d1b1b36,0xb26e6edc,0xee5a5ab4,0xfba0a05b,
- 0xf65252a4,0x4d3b3b76,0x61d6d6b7,0xceb3b37d,0x7b292952,0x3ee3e3dd,
- 0x712f2f5e,0x97848413,0xf55353a6,0x68d1d1b9,0x0,0x2cededc1,
- 0x60202040,0x1ffcfce3,0xc8b1b179,0xed5b5bb6,0xbe6a6ad4,0x46cbcb8d,
- 0xd9bebe67,0x4b393972,0xde4a4a94,0xd44c4c98,0xe85858b0,0x4acfcf85,
- 0x6bd0d0bb,0x2aefefc5,0xe5aaaa4f,0x16fbfbed,0xc5434386,0xd74d4d9a,
- 0x55333366,0x94858511,0xcf45458a,0x10f9f9e9,0x6020204,0x817f7ffe,
- 0xf05050a0,0x443c3c78,0xba9f9f25,0xe3a8a84b,0xf35151a2,0xfea3a35d,
- 0xc0404080,0x8a8f8f05,0xad92923f,0xbc9d9d21,0x48383870,0x4f5f5f1,
- 0xdfbcbc63,0xc1b6b677,0x75dadaaf,0x63212142,0x30101020,0x1affffe5,
- 0xef3f3fd,0x6dd2d2bf,0x4ccdcd81,0x140c0c18,0x35131326,0x2fececc3,
- 0xe15f5fbe,0xa2979735,0xcc444488,0x3917172e,0x57c4c493,0xf2a7a755,
- 0x827e7efc,0x473d3d7a,0xac6464c8,0xe75d5dba,0x2b191932,0x957373e6,
- 0xa06060c0,0x98818119,0xd14f4f9e,0x7fdcdca3,0x66222244,0x7e2a2a54,
- 0xab90903b,0x8388880b,0xca46468c,0x29eeeec7,0xd3b8b86b,0x3c141428,
- 0x79dedea7,0xe25e5ebc,0x1d0b0b16,0x76dbdbad,0x3be0e0db,0x56323264,
- 0x4e3a3a74,0x1e0a0a14,0xdb494992,0xa06060c,0x6c242448,0xe45c5cb8,
- 0x5dc2c29f,0x6ed3d3bd,0xefacac43,0xa66262c4,0xa8919139,0xa4959531,
- 0x37e4e4d3,0x8b7979f2,0x32e7e7d5,0x43c8c88b,0x5937376e,0xb76d6dda,
- 0x8c8d8d01,0x64d5d5b1,0xd24e4e9c,0xe0a9a949,0xb46c6cd8,0xfa5656ac,
- 0x7f4f4f3,0x25eaeacf,0xaf6565ca,0x8e7a7af4,0xe9aeae47,0x18080810,
- 0xd5baba6f,0x887878f0,0x6f25254a,0x722e2e5c,0x241c1c38,0xf1a6a657,
- 0xc7b4b473,0x51c6c697,0x23e8e8cb,0x7cdddda1,0x9c7474e8,0x211f1f3e,
- 0xdd4b4b96,0xdcbdbd61,0x868b8b0d,0x858a8a0f,0x907070e0,0x423e3e7c,
- 0xc4b5b571,0xaa6666cc,0xd8484890,0x5030306,0x1f6f6f7,0x120e0e1c,
- 0xa36161c2,0x5f35356a,0xf95757ae,0xd0b9b969,0x91868617,0x58c1c199,
- 0x271d1d3a,0xb99e9e27,0x38e1e1d9,0x13f8f8eb,0xb398982b,0x33111122,
- 0xbb6969d2,0x70d9d9a9,0x898e8e07,0xa7949433,0xb69b9b2d,0x221e1e3c,
- 0x92878715,0x20e9e9c9,0x49cece87,0xff5555aa,0x78282850,0x7adfdfa5,
- 0x8f8c8c03,0xf8a1a159,0x80898909,0x170d0d1a,0xdabfbf65,0x31e6e6d7,
- 0xc6424284,0xb86868d0,0xc3414182,0xb0999929,0x772d2d5a,0x110f0f1e,
- 0xcbb0b07b,0xfc5454a8,0xd6bbbb6d,0x3a16162c
-};
-
-static const unsign32 rtable[]=
-{
- 0x50a7f451,0x5365417e,0xc3a4171a,0x965e273a,0xcb6bab3b,0xf1459d1f,
- 0xab58faac,0x9303e34b,0x55fa3020,0xf66d76ad,0x9176cc88,0x254c02f5,
- 0xfcd7e54f,0xd7cb2ac5,0x80443526,0x8fa362b5,0x495ab1de,0x671bba25,
- 0x980eea45,0xe1c0fe5d,0x2752fc3,0x12f04c81,0xa397468d,0xc6f9d36b,
- 0xe75f8f03,0x959c9215,0xeb7a6dbf,0xda595295,0x2d83bed4,0xd3217458,
- 0x2969e049,0x44c8c98e,0x6a89c275,0x78798ef4,0x6b3e5899,0xdd71b927,
- 0xb64fe1be,0x17ad88f0,0x66ac20c9,0xb43ace7d,0x184adf63,0x82311ae5,
- 0x60335197,0x457f5362,0xe07764b1,0x84ae6bbb,0x1ca081fe,0x942b08f9,
- 0x58684870,0x19fd458f,0x876cde94,0xb7f87b52,0x23d373ab,0xe2024b72,
- 0x578f1fe3,0x2aab5566,0x728ebb2,0x3c2b52f,0x9a7bc586,0xa50837d3,
- 0xf2872830,0xb2a5bf23,0xba6a0302,0x5c8216ed,0x2b1ccf8a,0x92b479a7,
- 0xf0f207f3,0xa1e2694e,0xcdf4da65,0xd5be0506,0x1f6234d1,0x8afea6c4,
- 0x9d532e34,0xa055f3a2,0x32e18a05,0x75ebf6a4,0x39ec830b,0xaaef6040,
- 0x69f715e,0x51106ebd,0xf98a213e,0x3d06dd96,0xae053edd,0x46bde64d,
- 0xb58d5491,0x55dc471,0x6fd40604,0xff155060,0x24fb9819,0x97e9bdd6,
- 0xcc434089,0x779ed967,0xbd42e8b0,0x888b8907,0x385b19e7,0xdbeec879,
- 0x470a7ca1,0xe90f427c,0xc91e84f8,0x0,0x83868009,0x48ed2b32,
- 0xac70111e,0x4e725a6c,0xfbff0efd,0x5638850f,0x1ed5ae3d,0x27392d36,
- 0x64d90f0a,0x21a65c68,0xd1545b9b,0x3a2e3624,0xb1670a0c,0xfe75793,
- 0xd296eeb4,0x9e919b1b,0x4fc5c080,0xa220dc61,0x694b775a,0x161a121c,
- 0xaba93e2,0xe52aa0c0,0x43e0223c,0x1d171b12,0xb0d090e,0xadc78bf2,
- 0xb9a8b62d,0xc8a91e14,0x8519f157,0x4c0775af,0xbbdd99ee,0xfd607fa3,
- 0x9f2601f7,0xbcf5725c,0xc53b6644,0x347efb5b,0x7629438b,0xdcc623cb,
- 0x68fcedb6,0x63f1e4b8,0xcadc31d7,0x10856342,0x40229713,0x2011c684,
- 0x7d244a85,0xf83dbbd2,0x1132f9ae,0x6da129c7,0x4b2f9e1d,0xf330b2dc,
- 0xec52860d,0xd0e3c177,0x6c16b32b,0x99b970a9,0xfa489411,0x2264e947,
- 0xc48cfca8,0x1a3ff0a0,0xd82c7d56,0xef903322,0xc74e4987,0xc1d138d9,
- 0xfea2ca8c,0x360bd498,0xcf81f5a6,0x28de7aa5,0x268eb7da,0xa4bfad3f,
- 0xe49d3a2c,0xd927850,0x9bcc5f6a,0x62467e54,0xc2138df6,0xe8b8d890,
- 0x5ef7392e,0xf5afc382,0xbe805d9f,0x7c93d069,0xa92dd56f,0xb31225cf,
- 0x3b99acc8,0xa77d1810,0x6e639ce8,0x7bbb3bdb,0x97826cd,0xf418596e,
- 0x1b79aec,0xa89a4f83,0x656e95e6,0x7ee6ffaa,0x8cfbc21,0xe6e815ef,
- 0xd99be7ba,0xce366f4a,0xd4099fea,0xd67cb029,0xafb2a431,0x31233f2a,
- 0x3094a5c6,0xc066a235,0x37bc4e74,0xa6ca82fc,0xb0d090e0,0x15d8a733,
- 0x4a9804f1,0xf7daec41,0xe50cd7f,0x2ff69117,0x8dd64d76,0x4db0ef43,
- 0x544daacc,0xdf0496e4,0xe3b5d19e,0x1b886a4c,0xb81f2cc1,0x7f516546,
- 0x4ea5e9d,0x5d358c01,0x737487fa,0x2e410bfb,0x5a1d67b3,0x52d2db92,
- 0x335610e9,0x1347d66d,0x8c61d79a,0x7a0ca137,0x8e14f859,0x893c13eb,
- 0xee27a9ce,0x35c961b7,0xede51ce1,0x3cb1477a,0x59dfd29c,0x3f73f255,
- 0x79ce1418,0xbf37c773,0xeacdf753,0x5baafd5f,0x146f3ddf,0x86db4478,
- 0x81f3afca,0x3ec468b9,0x2c342438,0x5f40a3c2,0x72c31d16,0xc25e2bc,
- 0x8b493c28,0x41950dff,0x7101a839,0xdeb30c08,0x9ce4b4d8,0x90c15664,
- 0x6184cb7b,0x70b632d5,0x745c6c48,0x4257b8d0
-};
-
-#define MR_TOBYTE(x) ((uchar)((x)))
-
-static unsign32 pack(const uchar *b)
-{
- /* pack bytes into a 32-bit Word */
- return ((unsign32)b[3]<<24)|((unsign32)b[2]<<16)|((unsign32)b[1]<<8)|(unsign32)b[0];
-}
-
-static void unpack(unsign32 a,uchar *b)
-{
- /* unpack bytes from a word */
- b[0]=MR_TOBYTE(a);
- b[1]=MR_TOBYTE(a>>8);
- b[2]=MR_TOBYTE(a>>16);
- b[3]=MR_TOBYTE(a>>24);
-}
-
-/* SU= 8 */
-static uchar bmul(uchar x,uchar y)
-{
- /* x.y= AntiLog(Log(x) + Log(y)) */
- if (x && y) return ptab[(ltab[x]+ltab[y])%255];
- else return 0;
-}
-
-static unsign32 SubByte(unsign32 a)
-{
- uchar b[4];
- unpack(a,b);
- b[0]=fbsub[b[0]];
- b[1]=fbsub[b[1]];
- b[2]=fbsub[b[2]];
- b[3]=fbsub[b[3]];
- return pack(b);
-}
-
-/* SU= 16 */
-static uchar product(unsign32 x,unsign32 y)
-{
- /* dot product of two 4-byte arrays */
- uchar xb[4],yb[4];
- unpack(x,xb);
- unpack(y,yb);
- return bmul(xb[0],yb[0])^bmul(xb[1],yb[1])^bmul(xb[2],yb[2])^bmul(xb[3],yb[3]);
-}
-
-static unsign32 InvMixCol(unsign32 x)
-{
- /* matrix Multiplication */
- unsign32 y,m;
- uchar b[4];
-
- m=pack(InCo);
- b[3]=product(m,x);
- m=ROTL24(m);
- b[2]=product(m,x);
- m=ROTL24(m);
- b[1]=product(m,x);
- m=ROTL24(m);
- b[0]=product(m,x);
- y=pack(b);
- return y;
-}
-
-/* SU= 8 */
-/* reset cipher */
-void AES_reset(amcl_aes *a,int mode,char *iv)
-{
- /* reset mode, or reset iv */
- int i;
- a->mode=mode;
- for (i=0; i<4*NB; i++)
- a->f[i]=0;
- if (mode!=ECB && iv!=NULL)
- {
- for (i=0; i<4*NB; i++)
- a->f[i]=iv[i];
- }
-}
-
-void AES_getreg(amcl_aes *a,char *ir)
-{
- int i;
- for (i=0; i<4*NB; i++) ir[i]=a->f[i];
-}
-
-/* SU= 72 */
-/* Initialise cipher */
-int AES_init(amcl_aes* a,int mode,int nk,char *key,char *iv)
-{
- /* Key length Nk=16, 24 or 32 bytes */
- /* Key Scheduler. Create expanded encryption key */
- int i,j,k,N,nr;
- unsign32 CipherKey[8];
-
- nk/=4;
-
- if (nk!=4 && nk!=6 && nk!=8) return 0;
-
- nr=6+nk;
-
- a->Nk=nk;
- a->Nr=nr;
-
- AES_reset(a,mode,iv);
-
- N=NB*(nr+1);
-
- for (i=j=0; i<nk; i++,j+=4)
- {
- CipherKey[i]=pack((uchar *)&key[j]);
- }
- for (i=0; i<nk; i++) a->fkey[i]=CipherKey[i];
- for (j=nk,k=0; j<N; j+=nk,k++)
- {
- a->fkey[j]=a->fkey[j-nk]^SubByte(ROTL24(a->fkey[j-1]))^rco[k];
- if (nk<=6)
- {
- for (i=1; i<nk && (i+j)<N; i++)
- a->fkey[i+j]=a->fkey[i+j-nk]^a->fkey[i+j-1];
- }
- else
- {
- for (i=1; i<4 && (i+j)<N; i++)
- a->fkey[i+j]=a->fkey[i+j-nk]^a->fkey[i+j-1];
- if ((j+4)<N) a->fkey[j+4]=a->fkey[j+4-nk]^SubByte(a->fkey[j+3]);
- for (i=5; i<nk && (i+j)<N; i++)
- a->fkey[i+j]=a->fkey[i+j-nk]^a->fkey[i+j-1];
- }
-
- }
- /* now for the expanded decrypt key in reverse order */
-
- for (j=0; j<NB; j++) a->rkey[j+N-NB]=a->fkey[j];
- for (i=NB; i<N-NB; i+=NB)
- {
- k=N-NB-i;
- for (j=0; j<NB; j++) a->rkey[k+j]=InvMixCol(a->fkey[i+j]);
- }
- for (j=N-NB; j<N; j++) a->rkey[j-N+NB]=a->fkey[j];
- return 1;
-}
-
-/* SU= 80 */
-/* Encrypt a single block */
-void AES_ecb_encrypt(amcl_aes *a,uchar *buff)
-{
- int i,j,k;
- unsign32 p[4],q[4],*x,*y,*t;
-
- for (i=j=0; i<NB; i++,j+=4)
- {
- p[i]=pack((uchar *)&buff[j]);
- p[i]^=a->fkey[i];
- }
-
- k=NB;
- x=p;
- y=q;
-
- /* State alternates between x and y */
- for (i=1; i<a->Nr; i++)
- {
-
- y[0]=a->fkey[k]^ftable[MR_TOBYTE(x[0])]^
- ROTL8(ftable[MR_TOBYTE(x[1]>>8)])^
- ROTL16(ftable[MR_TOBYTE(x[2]>>16)])^
- ROTL24(ftable[x[3]>>24]);
- y[1]=a->fkey[k+1]^ftable[MR_TOBYTE(x[1])]^
- ROTL8(ftable[MR_TOBYTE(x[2]>>8)])^
- ROTL16(ftable[MR_TOBYTE(x[3]>>16)])^
- ROTL24(ftable[x[0]>>24]);
- y[2]=a->fkey[k+2]^ftable[MR_TOBYTE(x[2])]^
- ROTL8(ftable[MR_TOBYTE(x[3]>>8)])^
- ROTL16(ftable[MR_TOBYTE(x[0]>>16)])^
- ROTL24(ftable[x[1]>>24]);
- y[3]=a->fkey[k+3]^ftable[MR_TOBYTE(x[3])]^
- ROTL8(ftable[MR_TOBYTE(x[0]>>8)])^
- ROTL16(ftable[MR_TOBYTE(x[1]>>16)])^
- ROTL24(ftable[x[2]>>24]);
-
- k+=4;
- t=x;
- x=y;
- y=t; /* swap pointers */
- }
-
- /* Last Round */
-
- y[0]=a->fkey[k]^(unsign32)fbsub[MR_TOBYTE(x[0])]^
- ROTL8((unsign32)fbsub[MR_TOBYTE(x[1]>>8)])^
- ROTL16((unsign32)fbsub[MR_TOBYTE(x[2]>>16)])^
- ROTL24((unsign32)fbsub[x[3]>>24]);
- y[1]=a->fkey[k+1]^(unsign32)fbsub[MR_TOBYTE(x[1])]^
- ROTL8((unsign32)fbsub[MR_TOBYTE(x[2]>>8)])^
- ROTL16((unsign32)fbsub[MR_TOBYTE(x[3]>>16)])^
- ROTL24((unsign32)fbsub[x[0]>>24]);
- y[2]=a->fkey[k+2]^(unsign32)fbsub[MR_TOBYTE(x[2])]^
- ROTL8((unsign32)fbsub[MR_TOBYTE(x[3]>>8)])^
- ROTL16((unsign32)fbsub[MR_TOBYTE(x[0]>>16)])^
- ROTL24((unsign32)fbsub[x[1]>>24]);
- y[3]=a->fkey[k+3]^(unsign32)fbsub[MR_TOBYTE(x[3])]^
- ROTL8((unsign32)fbsub[MR_TOBYTE(x[0]>>8)])^
- ROTL16((unsign32)fbsub[MR_TOBYTE(x[1]>>16)])^
- ROTL24((unsign32)fbsub[x[2]>>24]);
-
- for (i=j=0; i<NB; i++,j+=4)
- {
- unpack(y[i],(uchar *)&buff[j]);
- x[i]=y[i]=0; /* clean up stack */
- }
-}
-
-/* SU= 80 */
-/* Decrypt a single block */
-void AES_ecb_decrypt(amcl_aes *a,uchar *buff)
-{
- int i,j,k;
- unsign32 p[4],q[4],*x,*y,*t;
-
- for (i=j=0; i<NB; i++,j+=4)
- {
- p[i]=pack((uchar *)&buff[j]);
- p[i]^=a->rkey[i];
- }
-
- k=NB;
- x=p;
- y=q;
-
- /* State alternates between x and y */
- for (i=1; i<a->Nr; i++)
- {
- /* Nr is number of rounds. May be odd. */
-
- y[0]=a->rkey[k]^rtable[MR_TOBYTE(x[0])]^
- ROTL8(rtable[MR_TOBYTE(x[3]>>8)])^
- ROTL16(rtable[MR_TOBYTE(x[2]>>16)])^
- ROTL24(rtable[x[1]>>24]);
- y[1]=a->rkey[k+1]^rtable[MR_TOBYTE(x[1])]^
- ROTL8(rtable[MR_TOBYTE(x[0]>>8)])^
- ROTL16(rtable[MR_TOBYTE(x[3]>>16)])^
- ROTL24(rtable[x[2]>>24]);
- y[2]=a->rkey[k+2]^rtable[MR_TOBYTE(x[2])]^
- ROTL8(rtable[MR_TOBYTE(x[1]>>8)])^
- ROTL16(rtable[MR_TOBYTE(x[0]>>16)])^
- ROTL24(rtable[x[3]>>24]);
- y[3]=a->rkey[k+3]^rtable[MR_TOBYTE(x[3])]^
- ROTL8(rtable[MR_TOBYTE(x[2]>>8)])^
- ROTL16(rtable[MR_TOBYTE(x[1]>>16)])^
- ROTL24(rtable[x[0]>>24]);
-
- k+=4;
- t=x;
- x=y;
- y=t; /* swap pointers */
- }
-
-
- /* Last Round */
- y[0]=a->rkey[k]^(unsign32)rbsub[MR_TOBYTE(x[0])]^
- ROTL8((unsign32)rbsub[MR_TOBYTE(x[3]>>8)])^
- ROTL16((unsign32)rbsub[MR_TOBYTE(x[2]>>16)])^
- ROTL24((unsign32)rbsub[x[1]>>24]);
- y[1]=a->rkey[k+1]^(unsign32)rbsub[MR_TOBYTE(x[1])]^
- ROTL8((unsign32)rbsub[MR_TOBYTE(x[0]>>8)])^
- ROTL16((unsign32)rbsub[MR_TOBYTE(x[3]>>16)])^
- ROTL24((unsign32)rbsub[x[2]>>24]);
- y[2]=a->rkey[k+2]^(unsign32)rbsub[MR_TOBYTE(x[2])]^
- ROTL8((unsign32)rbsub[MR_TOBYTE(x[1]>>8)])^
- ROTL16((unsign32)rbsub[MR_TOBYTE(x[0]>>16)])^
- ROTL24((unsign32)rbsub[x[3]>>24]);
- y[3]=a->rkey[k+3]^(unsign32)rbsub[MR_TOBYTE(x[3])]^
- ROTL8((unsign32)rbsub[MR_TOBYTE(x[2]>>8)])^
- ROTL16((unsign32)rbsub[MR_TOBYTE(x[1]>>16)])^
- ROTL24((unsign32)rbsub[x[0]>>24]);
-
- for (i=j=0; i<NB; i++,j+=4)
- {
- unpack(y[i],(uchar *)&buff[j]);
- x[i]=y[i]=0; /* clean up stack */
- }
-
-}
-
-/* simple default increment function */
-static void increment(char *f)
-{
- int i;
- for (i=0; i<16; i++)
- {
- f[i]++;
- if (f[i]!=0) break;
- }
-}
-
-/* SU= 40 */
-/* Encrypt using selected mode of operation */
-unsign32 AES_encrypt(amcl_aes* a,char *buff)
-{
- int j,bytes;
- char st[16];
- unsign32 fell_off;
-
- /* Supported Modes of Operation */
-
- fell_off=0;
- switch (a->mode)
- {
- case ECB:
- AES_ecb_encrypt(a,(uchar *)buff);
- return 0;
- case CBC:
- for (j=0; j<4*NB; j++) buff[j]^=a->f[j];
- AES_ecb_encrypt(a,(uchar *)buff);
- for (j=0; j<4*NB; j++) a->f[j]=buff[j];
- return 0;
-
- case CFB1:
- case CFB2:
- case CFB4:
- bytes=a->mode-CFB1+1;
- for (j=0; j<bytes; j++) fell_off=(fell_off<<8)|a->f[j];
- for (j=0; j<4*NB; j++) st[j]=a->f[j];
- for (j=bytes; j<4*NB; j++) a->f[j-bytes]=a->f[j];
- AES_ecb_encrypt(a,(uchar *)st);
- for (j=0; j<bytes; j++)
- {
- buff[j]^=st[j];
- a->f[16-bytes+j]=buff[j];
- }
- return fell_off;
-
- case OFB1:
- case OFB2:
- case OFB4:
- case OFB8:
- case OFB16:
-
- bytes=a->mode-OFB1+1;
- AES_ecb_encrypt(a,(uchar *)(a->f));
- for (j=0; j<bytes; j++) buff[j]^=a->f[j];
- return 0;
-
- case CTR1:
- case CTR2:
- case CTR4:
- case CTR8:
- case CTR16:
-
- bytes=a->mode-CTR1+1;
- for (j=0; j<4*NB; j++) st[j]=a->f[j];
- AES_ecb_encrypt(a,(uchar *)st);
- for (j=0; j<bytes; j++) buff[j]^=st[j];
- increment(a->f);
-
- default:
- return 0;
- }
-}
-
-/* SU= 40 */
-/* Decrypt using selected mode of operation */
-unsign32 AES_decrypt(amcl_aes *a,char *buff)
-{
- int j,bytes;
- char st[16];
- unsign32 fell_off;
-
- /* Supported modes of operation */
- fell_off=0;
- switch (a->mode)
- {
- case ECB:
- AES_ecb_decrypt(a,(uchar *)buff);
- return 0;
- case CBC:
- for (j=0; j<4*NB; j++)
- {
- st[j]=a->f[j];
- a->f[j]=buff[j];
- }
- AES_ecb_decrypt(a,(uchar *)buff);
- for (j=0; j<4*NB; j++)
- {
- buff[j]^=st[j];
- st[j]=0;
- }
- return 0;
- case CFB1:
- case CFB2:
- case CFB4:
- bytes=a->mode-CFB1+1;
- for (j=0; j<bytes; j++) fell_off=(fell_off<<8)|a->f[j];
- for (j=0; j<4*NB; j++) st[j]=a->f[j];
- for (j=bytes; j<4*NB; j++) a->f[j-bytes]=a->f[j];
- AES_ecb_encrypt(a,(uchar *)st);
- for (j=0; j<bytes; j++)
- {
- a->f[16-bytes+j]=buff[j];
- buff[j]^=st[j];
- }
- return fell_off;
- case OFB1:
- case OFB2:
- case OFB4:
- case OFB8:
- case OFB16:
- bytes=a->mode-OFB1+1;
- AES_ecb_encrypt(a,(uchar *)(a->f));
- for (j=0; j<bytes; j++) buff[j]^=a->f[j];
- return 0;
-
- case CTR1:
- case CTR2:
- case CTR4:
- case CTR8:
- case CTR16:
-
- bytes=a->mode-CTR1+1;
- for (j=0; j<4*NB; j++) st[j]=a->f[j];
- AES_ecb_encrypt(a,(uchar *)st);
- for (j=0; j<bytes; j++) buff[j]^=st[j];
- increment(a->f);
-
- default:
- return 0;
- }
-}
-
-/* Clean up and delete left-overs */
-void AES_end(amcl_aes *a)
-{
- /* clean up */
- int i;
- for (i=0; i<NB*(a->Nr+1); i++)
- a->fkey[i]=a->rkey[i]=0;
- for (i=0; i<4*NB; i++)
- a->f[i]=0;
-}
-
-
-/*
-#include <stdio.h>
-
-#define KK 32
-
-int main()
-{
- int i;
- amcl_aes a;
- unsign32 t;
- uchar x,y;
-
- char key[KK];
- char block[16];
- char iv[16];
- for (i=0;i<KK;i++) key[i]=5;
- key[0]=1;
- for (i=0;i<16;i++) iv[i]=i;
- for (i=0;i<16;i++) block[i]=i;
-
- AES_init(&a,CTR16,KK,key,iv);
-
- printf("Plain= ");
- for (i=0;i<16;i++) printf("%02x",block[i]);
- printf("\n");
- AES_encrypt(&a,block);
- printf("Encrypt= ");
- for (i=0;i<16;i++) printf("%02x",(uchar)block[i]);
- printf("\n");
- AES_reset(&a,CTR16,iv);
- AES_decrypt(&a,block);
- printf("Decrypt= ");
- for (i=0;i<16;i++) printf("%02x",(uchar)block[i]);
- printf("\n");
-
- AES_end(&a);
-
- return 0;
-}
-
-*/
-
diff --git a/version22/c/amcl.h b/version22/c/amcl.h
deleted file mode 100644
index 26a74c3..0000000
--- a/version22/c/amcl.h
+++ /dev/null
@@ -1,2935 +0,0 @@
-/*
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-*/
-
-/* AMCL header file */
-/* Designed for AES-128/192/256 security, 254-521 bit elliptic curves and BN curves for pairings */
-/* Each "limb" of a big number occupies at most (n-3) bits of an n-bit computer word. The most significant word must have at least 4 extra unused bits */
-
-/**
- * @file amcl.h
- * @author Mike Scott and Kealan McCusker
- * @date 19th May 2015
- * @brief Main Header File
- *
- * Allows some user configuration
- * defines structures
- * declares functions
- *
- */
-
-/* NOTE: There is only one user configurable section in this header - see below */
-
-#ifndef AMCL_H
-#define AMCL_H
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <inttypes.h>
-#include "arch.h"
-
-#ifdef CMAKE
-#define AMCL_VERSION_MAJOR @AMCL_VERSION_MAJOR@ /**< Major version of the library */
-#define AMCL_VERSION_MINOR @AMCL_VERSION_MINOR@ /**< Minor version of the library */
-#define AMCL_VERSION_PATCH @AMCL_VERSION_PATCH@ /**< Patch version of the library */
-#define OS "@OS@" /**< Operative system */
-#cmakedefine USE_PATENTS /**< Use Patents */
-#cmakedefine USE_ANONYMOUS /**< Use Anonymous Configuration in MPin */
-#endif
-
-/* Curve types */
-
-#define WEIERSTRASS 0 /**< Short Weierstrass form curve */
-#define EDWARDS 1 /**< Edwards or Twisted Edwards curve */
-#define MONTGOMERY 2 /**< Montgomery form curve */
-
-/* Elliptic curves are defined over prime fields */
-/* Here are some popular EC prime fields for which we have prepared standard curves. Feel free to specify your own. */
-
-#define NIST256 0 /**< For the NIST 256-bit standard curve - WEIERSTRASS only */
-#define C25519 1 /**< Bernstein's Modulus 2^255-19 - EDWARDS or MONTGOMERY only */
-#define BRAINPOOL 2 /**< For Brainpool 256-bit curve - WEIERSTRASS only */
-#define ANSSI 3 /**< For French 256-bit standard curve - WEIERSTRASS only */
-#define MF254 4 /**< For NUMS curves from Bos et al - 254-bit Montgomery friendly modulus - WEIERSTRASS or EDWARDS or MONTGOMERY */
-#define MS255 5 /**< For NUMS curve - 255-bit pseudo-mersenne modulus - WEIERSTRASS or EDWARDS or MONTGOMERY */
-#define MF256 6 /**< For NUMS curve - 256-bit Montgomery friendly modulus - WEIERSTRASS or EDWARDS or MONTGOMERY */
-#define MS256 7 /**< For NUMS curve - 256-bit pseudo-merseene modulus - WEIERSTRASS or EDWARDS or MONTGOMERY */
-#define HIFIVE 8 /**< My 336-bit pseudo-mersenne modulus - EDWARDS only */
-#define GOLDILOCKS 9 /**< Goldilocks generalized-mersenne modulus - EDWARDS only */
-#define NIST384 10 /**< For the NIST 384-bit standard curve - WEIERSTRASS only */
-#define C41417 11 /**< Bernstein et al Curve41417 2^414-17 - EDWARDS only */
-#define NIST521 12 /**< For the NIST 521-bit standard curve - WEIERSTRASS only */
-
-/* BN Curves */
-#define BN_CURVES 100 /**< Barreto-Naehrig curves */
-#define BN454 100 /**< New AES-128 security BN curve - Modulus built from -0x10000010000000000000100000001 - WEIERSTRASS only */
-#define BN646 101 /**< AES-192 security BN curve - Modulus built from t=-0x10000000000000000000004000000000000001001 - WEIERSTRASS only */
-
-/* A few 254-bit alternative BN curves */
-#define BN254 102 /**< Standard Nogami BN curve - fastest. Modulus built from t=-0x4080000000000001 - WEIERSTRASS only */
-
-/* GT_STRONG curves */
-#define BN254_CX 103 /**< Our CertiVox BN curve. Modulus built from t=-0x4000000003C012B1 - WEIERSTRASS only */
-#define BN254_T 104 /**< GT_Strong BN curve. Modulus built from t=-0x4000806000004081 - WEIERSTRASS only */
-#define BN254_T2 105 /**< G2 and GT-Strong BN curve. Modulus built from t=-0x4000020100608205 - WEIERSTRASS only */
-
-/* BLS-12 Curves */
-#define BLS_CURVES 200 /**< Barreto-Lynn-Scott curves */
-#define BLS455 200 /**< New AES-128 security BLS curve - Modulus built from -0x10002000002000010007 - WEIERSTRASS only */
-#define BLS383 201 /**< New AES-128 security BLS curve - Modulus built from -0x1101000000040110 - WEIERSTRASS only */
-
-
-/*** START OF USER CONFIGURABLE SECTION - set architecture and choose modulus and curve ***/
-
-#ifdef CMAKE
-#define CHOICE @AMCL_CHOICE@ /**< Current choice of Field */
-#else
-#define CHOICE BN254_CX /**< Current choice of Field */
-#endif
-
-/* For some moduli only one parameterisation of curve may supported. For others there is a choice of WEIERSTRASS, EDWARDS or MONTGOMERY curves. See above. */
-#ifdef CMAKE
-#define CURVETYPE @AMCL_CURVETYPE@ /**< Note that not all curve types are supported - see above */
-#else
-#define CURVETYPE WEIERSTRASS /**< Note that not all curve types are supported - see above */
-#endif
-
-
-/* Actual curve parameters associated with these choices can be found in rom.c */
-
-/* These next options only apply for pairings */
-#ifdef USE_PATENTS
-#define USE_GLV /**< Note this method is patented (GLV), so maybe you want to comment this out */
-#define USE_GS_G2 /**< Well we didn't patent it :) But may be covered by GLV patent :( */
-#endif
-#define USE_GS_GT /**< Not patented, so probably safe to always use this */
-
-/* Finite field support - for RSA, DH etc. */
-#ifdef CMAKE
-#define FFLEN @AMCL_FFLEN@ /**< 2^n multiplier of BIGBITS to specify supported Finite Field size, e.g 2048=256*2^3 where BIGBITS=256 */
-#else
-#define FFLEN 8 /**< 2^n multiplier of BIGBITS to specify supported Finite Field size, e.g 2048=256*2^3 where BIGBITS=256 */
-#endif
-
-
-
-/* For debugging Only.*/
-#ifdef CMAKE
-#cmakedefine DEBUG_REDUCE /**< Print debug message for field reduction */
-#cmakedefine DEBUG_NORM /**< Detect digit overflow */
-#cmakedefine GET_STATS /**< Debug statistics - use with debugger */
-#else
-//#define DEBUG_REDUCE
-//#define DEBUG_NORM
-//#define GET_STATS
-#endif
-
-
-// #define UNWOUND
-
-/*** END OF USER CONFIGURABLE SECTION ***/
-
-
-
-
-
-
-
-
-#define NLEN (1+((MBITS-1)/BASEBITS)) /**< Number of words in BIG. */
-#define MODBYTES (1+(MBITS-1)/8) /**< Number of bytes in Modulus */
-#define BIGBITS (MODBYTES*8) /**< Number of bits representable in a BIG */
-#define FF_BITS (BIGBITS*FFLEN) /**< Finite Field Size in bits - must be BIGBITS.2^n */
-
-/* modulus types */
-
-#define NOT_SPECIAL 0 /**< Modulus of no exploitable form */
-#define PSEUDO_MERSENNE 1 /**< Pseudo-mersenne modulus of form $2^n-c$ */
-#define MONTGOMERY_FRIENDLY 3 /**< Montgomery Friendly modulus of form $2^a(2^b-c)-1$ */
-#define GENERALISED_MERSENNE 2 /**< Generalised-mersenne modulus of form $2^n-2^m-1$, GOLDILOCKS only */
-
-/* Built-in curves defined here */
-/* MIRACL check.cpp utility used to determine optimal choice for BASEBITS */
-
-/* Define AES_S if the desired AES-equivalent security is significantly less than the group order */
-
-
-#if CHOICE==NIST256
-#define MBITS 256 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#define BASEBITS 13 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==C25519
-#define MBITS 255 /**< Number of bits in Modulus */
-#define MOD8 5 /**< Modulus mod 8 */
-#define MODTYPE PSEUDO_MERSENNE /**< Modulus type */
-#if CURVETYPE==WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#if CURVETYPE==MONTGOMERY
-#error Not supported
-#else
-#define BASEBITS 13 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==BRAINPOOL
-#define MBITS 256 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#define BASEBITS 13 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==ANSSI
-#define MBITS 256 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#define BASEBITS 13 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-/**< NUMS curve from Bos et al. paper */
-
-#if CHOICE==MF254
-#define MBITS 254 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE MONTGOMERY_FRIENDLY /**< Modulus type */
-#if CHUNK==16
-#error Not Supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-
-#if CHOICE==MF256
-#define MBITS 256 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE MONTGOMERY_FRIENDLY /**< Modulus type */
-#if CHUNK==16
-#error Not Supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-
-#if CHOICE==MS255
-#define MBITS 255 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE PSEUDO_MERSENNE /**< Modulus type */
-#if CHUNK==16
-#define BASEBITS 13 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-
-#if CHOICE==MS256
-#define MBITS 256 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE PSEUDO_MERSENNE /**< Modulus type */
-#if CHUNK==16
-#define BASEBITS 13 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-
-#if CHOICE==HIFIVE
-#define MBITS 336 /**< Number of bits in Modulus */
-#define MOD8 5 /**< Modulus mod 8 */
-#define MODTYPE PSEUDO_MERSENNE /**< Modulus type */
-#define AES_S 128 /**< Desired AES equivalent strength */
-#if CURVETYPE!=EDWARDS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not Supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 60 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==GOLDILOCKS
-#define MBITS 448 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE GENERALISED_MERSENNE /**< Modulus type */
-#if CURVETYPE!=EDWARDS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not Supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 60 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==NIST384
-#define MBITS 384 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 28 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==C41417
-#define MBITS 414 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE PSEUDO_MERSENNE /**< Modulus type */
-#if CURVETYPE!=EDWARDS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 60 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==NIST521
-#define MBITS 521 /**< Number of bits in Modulus */
-#define MOD8 7 /**< Modulus mod 8 */
-#define MODTYPE PSEUDO_MERSENNE /**< Modulus type */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 28 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 60 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-/* New BN curve to be used for AES-128 security as response to new DL developments - see Kim & Barbulescu ePrint Archive: Report 2015/1027 */
-
-#if CHOICE==BN454
-#define MBITS 454 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#define AES_S 128 /**< Desired AES equivalent strength */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 60 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-/* New BLS curve to be used for AES-128 security as response to new DL developments - see Kim & Barbulescu ePrint Archive: Report 2015/1027 */
-
-#if CHOICE==BLS455
-#define MBITS 455 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#define AES_S 128 /**< Desired AES equivalent strength */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 60 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-
-#if CHOICE==BLS383
-#define MBITS 383 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 28 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE==BN646
-#define MBITS 646 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#define AES_S 192 /**< Desired AES equivalent strength */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#error Not supported
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 60 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-#if CHOICE<BLS_CURVES
-
-#if CHOICE>=BN254 /* Its a BN curve */
-#define MBITS 254 /**< Number of bits in Modulus */
-#define MOD8 3 /**< Modulus mod 8 */
-#define MODTYPE NOT_SPECIAL /**< Modulus type */
-#if CURVETYPE!=WEIERSTRASS
-#error Not supported
-#else
-#if CHUNK==16
-#define BASEBITS 13 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 32
-#define BASEBITS 29 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#if CHUNK == 64
-#define BASEBITS 56 /**< Numbers represented to base 2*BASEBITS */
-#endif
-#endif
-#endif
-
-
-#if CHOICE>BN254
-#define GT_STRONG /**< Using a GT-Strong 254-bit BN curve */
-#endif
-#endif
-
-
-/* Don't mess with anything below this line */
-
-#ifdef GET_STATS
-extern int tsqr,rsqr,tmul,rmul;
-extern int tadd,radd,tneg,rneg;
-extern int tdadd,rdadd,tdneg,rdneg;
-#endif
-
-#define DCHUNK 2*CHUNK /**< Number of bits in double-length type */
-#define DNLEN 2*NLEN /**< double length required for products of BIGs */
-#define HFLEN (FFLEN/2) /**< Useful for half-size RSA private key operations */
-
-#define CHUNK_BITS 8*sizeof(chunk) /**< Number of bits in a chunk */
-
-#ifdef DEBUG_NORM /* Add an extra location to track chunk extension */
-typedef chunk BIG[NLEN+1]; /**< Define type BIG as array of chunks */
-typedef chunk DBIG[DNLEN+1]; /**< Define type DBIG as array of chunks */
-#else
-typedef chunk BIG[NLEN]; /**< Define type BIG as array of chunks */
-typedef chunk DBIG[DNLEN]; /**< Define type DBIG as array of chunks */
-#endif
-
-#define HBITS (BASEBITS/2) /**< Number of bits in number base divided by 2 */
-#define HBITS1 ((BASEBITS+1)/2) /**< Number of bits in number base plus 1 divided by 2 */
-#define HDIFF (HBITS1-HBITS) /**< Will be either 0 or 1, depending if number of bits in number base is even or odd */
-
-#define BMASK (((chunk)1<<BASEBITS)-1) /**< Mask = 2^BASEBITS-1 */
-#define HMASK (((chunk)1<<HBITS)-1) /**< Mask = 2^HBITS-1 */
-#define HMASK1 (((chunk)1<<HBITS1)-1) /**< Mask = 2^HBITS1-1 */
-
-#define MODBITS MBITS /**< Number of bits in Modulus for selected curve */
-#define TBITS (MBITS%BASEBITS) /**< Number of active bits in top word */
-#define TMASK (((chunk)1<<TBITS)-1) /**< Mask for active bits in top word */
-#define NEXCESS (1<<(CHUNK-BASEBITS-1)) /**< 2^(CHUNK-BASEBITS-1) - digit cannot be multiplied by more than this before normalisation */
-#define FEXCESS ((chunk)1<<(BASEBITS*NLEN-MBITS)) /**< 2^(BASEBITS*NLEN-MODBITS) - normalised BIG can be multiplied by more than this before reduction */
-#define OMASK (-((chunk)(1)<<TBITS)) /**< for masking out overflow bits */
-
-/* catch field excesses */
-#define EXCESS(a) ((a[NLEN-1]&OMASK)>>(TBITS)) /**< Field Excess */
-
-
-#define P_MBITS (MODBYTES*8)
-#define P_TBITS (P_MBITS%BASEBITS)
-#define P_EXCESS(a) ((a[NLEN-1])>>(P_TBITS))
-#define P_FEXCESS ((chunk)1<<(BASEBITS*NLEN-P_MBITS))
-
-
-
-/* Field Params - see rom.c */
-extern const BIG Modulus; /**< Actual Modulus set in rom.c */
-extern const chunk MConst; /**< Montgomery only - 1/p mod 2^BASEBITS */
-
-/* Curve Params - see rom.c */
-extern const int CURVE_A; /**< Elliptic curve A parameter */
-extern const BIG CURVE_B; /**< Elliptic curve B parameter */
-extern const BIG CURVE_Order; /**< Elliptic curve group order */
-extern const BIG CURVE_Cof; /**< Elliptic curve cofactor */
-
-/* Generator point on G1 */
-extern const BIG CURVE_Gx; /**< x-coordinate of generator point in group G1 */
-extern const BIG CURVE_Gy; /**< y-coordinate of generator point in group G1 */
-
-/* For Pairings only */
-
-/* Generator point on G2 */
-extern const BIG CURVE_Pxa; /**< real part of x-coordinate of generator point in group G2 */
-extern const BIG CURVE_Pxb; /**< imaginary part of x-coordinate of generator point in group G2 */
-extern const BIG CURVE_Pya; /**< real part of y-coordinate of generator point in group G2 */
-extern const BIG CURVE_Pyb; /**< imaginary part of y-coordinate of generator point in group G2 */
-
-extern const BIG CURVE_Bnx; /**< BN curve x parameter */
-
-extern const BIG CURVE_Cru; /**< BN curve Cube Root of Unity */
-
-extern const BIG CURVE_Fra; /**< real part of BN curve Frobenius Constant */
-extern const BIG CURVE_Frb; /**< imaginary part of BN curve Frobenius Constant */
-
-
-extern const BIG CURVE_W[2]; /**< BN curve constant for GLV decomposition */
-extern const BIG CURVE_SB[2][2]; /**< BN curve constant for GLV decomposition */
-extern const BIG CURVE_WB[4]; /**< BN curve constant for GS decomposition */
-extern const BIG CURVE_BB[4][4]; /**< BN curve constant for GS decomposition */
-
-/* Structures */
-
-/**
- @brief ECP structure - Elliptic Curve Point over base field
-*/
-
-typedef struct
-{
-#if CURVETYPE!=EDWARDS
- int inf; /**< Infinity Flag - not needed for Edwards representation */
-#endif
- BIG x; /**< x-coordinate of point */
-#if CURVETYPE!=MONTGOMERY
- BIG y; /**< y-coordinate of point. Not needed for Montgomery representation */
-#endif
- BIG z;/**< z-coordinate of point */
-} ECP;
-
-/**
- @brief FP2 Structure - quadratic extension field
-*/
-
-typedef struct
-{
- BIG a; /**< real part of FP2 */
- BIG b; /**< imaginary part of FP2 */
-} FP2;
-
-/**
- @brief FP4 Structure - towered over two FP2
-*/
-
-typedef struct
-{
- FP2 a; /**< real part of FP4 */
- FP2 b; /**< imaginary part of FP4 */
-} FP4;
-
-/**
- @brief FP12 Structure - towered over three FP4
-*/
-
-typedef struct
-{
- FP4 a; /**< first part of FP12 */
- FP4 b; /**< second part of FP12 */
- FP4 c; /**< third part of FP12 */
-} FP12;
-
-/**
- @brief ECP2 Structure - Elliptic Curve Point over quadratic extension field
-*/
-
-typedef struct
-{
- int inf; /**< Infinity Flag */
- FP2 x; /**< x-coordinate of point */
- FP2 y; /**< y-coordinate of point */
- FP2 z; /**< z-coordinate of point */
-} ECP2;
-
-/**
- * @brief SHA256 hash function instance */
-typedef struct
-{
- unsign32 length[2]; /**< 64-bit input length */
- unsign32 h[8]; /**< Internal state */
- unsign32 w[80]; /**< Internal state */
- int hlen; /**< Hash length in bytes */
-} hash256;
-
-/**
- * @brief SHA384-512 hash function instance */
-typedef struct
-{
- unsign64 length[2]; /**< 64-bit input length */
- unsign64 h[8]; /**< Internal state */
- unsign64 w[80]; /**< Internal state */
- int hlen; /**< Hash length in bytes */
-} hash512;
-
-/**
- * @brief SHA384 hash function instance */
-typedef hash512 hash384;
-
-#define SHA256 32 /**< SHA-256 hashing */
-#define SHA384 48 /**< SHA-384 hashing */
-#define SHA512 64 /**< SHA-512 hashing */
-
-/* Symmetric Encryption AES structure */
-
-#define ECB 0 /**< Electronic Code Book */
-#define CBC 1 /**< Cipher Block Chaining */
-#define CFB1 2 /**< Cipher Feedback - 1 byte */
-#define CFB2 3 /**< Cipher Feedback - 2 bytes */
-#define CFB4 5 /**< Cipher Feedback - 4 bytes */
-#define OFB1 14 /**< Output Feedback - 1 byte */
-#define OFB2 15 /**< Output Feedback - 2 bytes */
-#define OFB4 17 /**< Output Feedback - 4 bytes */
-#define OFB8 21 /**< Output Feedback - 8 bytes */
-#define OFB16 29 /**< Output Feedback - 16 bytes */
-#define CTR1 30 /**< Counter Mode - 1 byte */
-#define CTR2 31 /**< Counter Mode - 2 bytes */
-#define CTR4 33 /**< Counter Mode - 4 bytes */
-#define CTR8 37 /**< Counter Mode - 8 bytes */
-#define CTR16 45 /**< Counter Mode - 16 bytes */
-
-#define uchar unsigned char /**< Unsigned char */
-
-/**
- @brief AES instance
-*/
-
-
-typedef struct
-{
- int Nk; /**< AES Key Length */
- int Nr; /**< AES Number of rounds */
- int mode; /**< AES mode of operation */
- unsign32 fkey[60]; /**< subkeys for encrypton */
- unsign32 rkey[60]; /**< subkeys for decrypton */
- char f[16]; /**< buffer for chaining vector */
-} amcl_aes;
-
-/* AES-GCM suppport. */
-
-#define GCM_ACCEPTING_HEADER 0 /**< GCM status */
-#define GCM_ACCEPTING_CIPHER 1 /**< GCM status */
-#define GCM_NOT_ACCEPTING_MORE 2 /**< GCM status */
-#define GCM_FINISHED 3 /**< GCM status */
-#define GCM_ENCRYPTING 0 /**< GCM mode */
-#define GCM_DECRYPTING 1 /**< GCM mode */
-
-
-/**
- @brief GCM mode instance, using AES internally
-*/
-
-typedef struct
-{
- unsign32 table[128][4]; /**< 2k byte table */
- uchar stateX[16]; /**< GCM Internal State */
- uchar Y_0[16]; /**< GCM Internal State */
- unsign32 lenA[2]; /**< GCM 64-bit length of header */
- unsign32 lenC[2]; /**< GCM 64-bit length of ciphertext */
- int status; /**< GCM Status */
- amcl_aes a; /**< Internal Instance of AMCL_AES cipher */
-} gcm;
-
-/* Marsaglia & Zaman Random number generator constants */
-
-#define NK 21 /**< PRNG constant */
-#define NJ 6 /**< PRNG constant */
-#define NV 8 /**< PRNG constant */
-
-
-/**
- @brief Cryptographically secure pseudo-random number generator instance
-*/
-
-typedef struct
-{
- unsign32 ira[NK]; /**< random number array */
- int rndptr; /**< pointer into array */
- unsign32 borrow; /**< borrow as a result of subtraction */
- int pool_ptr; /**< pointer into random pool */
- char pool[32]; /**< random pool */
-} csprng;
-
-
-/**
- @brief Portable representation of a big positive number
-*/
-
-typedef struct
-{
- int len; /**< length in bytes */
- int max; /**< max length allowed - enforce truncation */
- char *val; /**< byte array */
-} octet;
-
-/**
- @brief Integer Factorisation Public Key
-*/
-
-typedef struct
-{
- sign32 e; /**< RSA exponent (typically 65537) */
- BIG n[FFLEN]; /**< An array of BIGs to store public key */
-} rsa_public_key;
-
-/**
- @brief Integer Factorisation Private Key
-*/
-
-typedef struct
-{
- BIG p[FFLEN/2]; /**< secret prime p */
- BIG q[FFLEN/2]; /**< secret prime q */
- BIG dp[FFLEN/2]; /**< decrypting exponent mod (p-1) */
- BIG dq[FFLEN/2]; /**< decrypting exponent mod (q-1) */
- BIG c[FFLEN/2]; /**< 1/p mod q */
-} rsa_private_key;
-
-/*
-
-Note that a normalised BIG consists of digits mod 2^BASEBITS
-However BIG digits may be "extended" up to 2^(WORDLENGTH-1).
-
-BIGs in extended form may need to be normalised before certain
-operations.
-
-A BIG may be "reduced" to be less that the Modulus, or it
-may be "unreduced" and allowed to grow greater than the
-Modulus.
-
-Normalisation is quite fast. Reduction involves conditional branches,
-which can be regarded as significant "speed bumps". We try to
-delay reductions as much as possible. Reductions may also involve
-side channel leakage, so delaying and batching them
-hopefully disguises internal operations.
-
-*/
-
-/* BIG number prototypes */
-
-/** @brief Calculates a*b+c+*d
- *
- Calculate partial product of a.b, add in carry c, and add total to d
- @param a multiplier
- @param b multiplicand
- @param c carry
- @param d pointer to accumulated bottom half of result
- @return top half of result
- */
-extern chunk muladd(chunk a,chunk b,chunk c,chunk *d);
-/** @brief Tests for BIG equal to zero
- *
- @param x a BIG number
- @return 1 if zero, else returns 0
- */
-extern int BIG_iszilch(BIG x);
-/** @brief Tests for DBIG equal to zero
- *
- @param x a DBIG number
- @return 1 if zero, else returns 0
- */
-extern int BIG_diszilch(DBIG x);
-/** @brief Outputs a BIG number to the console
- *
- @param x a BIG number
- */
-extern void BIG_output(BIG x);
-/** @brief Outputs a BIG number to the console in raw form (for debugging)
- *
- @param x a BIG number
- */
-extern void BIG_rawoutput(BIG x);
-/** @brief Conditional constant time swap of two BIG numbers
- *
- Conditionally swaps parameters in constant time (without branching)
- @param x a BIG number
- @param y another BIG number
- @param s swap takes place if not equal to 0
- */
-extern void BIG_cswap(BIG x,BIG y,int s);
-/** @brief Conditional copy of BIG number
- *
- Conditionally copies second parameter to the first (without branching)
- @param x a BIG number
- @param y another BIG number
- @param s copy takes place if not equal to 0
- */
-extern void BIG_cmove(BIG x,BIG y,int s);
-/** @brief Conditional copy of DBIG number
- *
- Conditionally copies second parameter to the first (without branching)
- @param x a DBIG number
- @param y another DBIG number
- @param s copy takes place if not equal to 0
- */
-extern void BIG_dcmove(BIG x,BIG y,int s);
-/** @brief Convert from BIG number to byte array
- *
- @param a byte array
- @param x BIG number
- */
-extern void BIG_toBytes(char *a,BIG x);
-/** @brief Convert to BIG number from byte array
- *
- @param x BIG number
- @param a byte array
- */
-extern void BIG_fromBytes(BIG x,char *a);
-/** @brief Convert to BIG number from byte array of given length
- *
- @param x BIG number
- @param a byte array
- @param s byte array length
- */
-extern void BIG_fromBytesLen(BIG x,char *a,int s);
-/**@brief Convert to DBIG number from byte array of given length
- *
- @param x DBIG number
- @param a byte array
- @param s byte array length
- */
-extern void BIG_dfromBytesLen(DBIG x,char *a,int s);
-/** @brief Outputs a DBIG number to the console
- *
- @param x a DBIG number
- */
-extern void BIG_doutput(DBIG x);
-/** @brief Copy BIG from Read-Only Memory to a BIG
- *
- @param x BIG number
- @param y BIG number in ROM
- */
-extern void BIG_rcopy(BIG x,const BIG y);
-/** @brief Copy BIG to another BIG
- *
- @param x BIG number
- @param y BIG number to be copied
- */
-extern void BIG_copy(BIG x,BIG y);
-/** @brief Copy DBIG to another DBIG
- *
- @param x DBIG number
- @param y DBIG number to be copied
- */
-extern void BIG_dcopy(DBIG x,DBIG y);
-/** @brief Copy BIG to upper half of DBIG
- *
- @param x DBIG number
- @param y BIG number to be copied
- */
-extern void BIG_dsucopy(DBIG x,BIG y);
-/** @brief Copy BIG to lower half of DBIG
- *
- @param x DBIG number
- @param y BIG number to be copied
- */
-extern void BIG_dscopy(DBIG x,BIG y);
-/** @brief Copy lower half of DBIG to a BIG
- *
- @param x BIG number
- @param y DBIG number to be copied
- */
-extern void BIG_sdcopy(BIG x,DBIG y);
-/** @brief Copy upper half of DBIG to a BIG
- *
- @param x BIG number
- @param y DBIG number to be copied
- */
-extern void BIG_sducopy(BIG x,DBIG y);
-/** @brief Set BIG to zero
- *
- @param x BIG number to be set to zero
- */
-extern void BIG_zero(BIG x);
-/** @brief Set DBIG to zero
- *
- @param x DBIG number to be set to zero
- */
-extern void BIG_dzero(DBIG x);
-/** @brief Set BIG to one (unity)
- *
- @param x BIG number to be set to one.
- */
-extern void BIG_one(BIG x);
-/** @brief Set BIG to inverse mod 2^256
- *
- @param x BIG number to be inverted
- */
-extern void BIG_invmod2m(BIG x);
-/** @brief Set BIG to sum of two BIGs - output not normalised
- *
- @param x BIG number, sum of other two
- @param y BIG number
- @param z BIG number
- */
-extern void BIG_add(BIG x,BIG y,BIG z);
-/** @brief Increment BIG by a small integer - output not normalised
- *
- @param x BIG number to be incremented
- @param i integer
- */
-extern void BIG_inc(BIG x,int i);
-/** @brief Set BIG to difference of two BIGs
- *
- @param x BIG number, difference of other two - output not normalised
- @param y BIG number
- @param z BIG number
- */
-extern void BIG_sub(BIG x,BIG y,BIG z);
-/** @brief Decrement BIG by a small integer - output not normalised
- *
- @param x BIG number to be decremented
- @param i integer
- */
-extern void BIG_dec(BIG x,int i);
-/** @brief Set DBIG to difference of two DBIGs
- *
- @param x DBIG number, difference of other two - output not normalised
- @param y DBIG number
- @param z DBIG number
- */
-extern void BIG_dsub(DBIG x,DBIG y,DBIG z);
-/** @brief Multiply BIG by a small integer - output not normalised
- *
- @param x BIG number, product of other two
- @param y BIG number
- @param i small integer
- */
-extern void BIG_imul(BIG x,BIG y,int i);
-/** @brief Multiply BIG by not-so-small small integer - output normalised
- *
- @param x BIG number, product of other two
- @param y BIG number
- @param i small integer
- @return Overflowing bits
- */
-extern chunk BIG_pmul(BIG x,BIG y,int i);
-/** @brief Divide BIG by 3 - output normalised
- *
- @param x BIG number
- @return Remainder
- */
-extern int BIG_div3(BIG x);
-/** @brief Multiply BIG by even bigger small integer resulting in a DBIG - output normalised
- *
- @param x DBIG number, product of other two
- @param y BIG number
- @param i small integer
- */
-extern void BIG_pxmul(DBIG x,BIG y,int i);
-/** @brief Multiply BIG by another BIG resulting in DBIG - inputs normalised and output normalised
- *
- @param x DBIG number, product of other two
- @param y BIG number
- @param z BIG number
- */
-extern void BIG_mul(DBIG x,BIG y,BIG z);
-/** @brief Multiply BIG by another BIG resulting in another BIG - inputs normalised and output normalised
- *
- Note that the product must fit into a BIG, and x must be distinct from y and z
- @param x BIG number, product of other two
- @param y BIG number
- @param z BIG number
- */
-extern void BIG_smul(BIG x,BIG y,BIG z);
-/** @brief Square BIG resulting in a DBIG - input normalised and output normalised
- *
- @param x DBIG number, square of a BIG
- @param y BIG number to be squared
- */
-extern void BIG_sqr(DBIG x,BIG y);
-
-/** @brief Montgomery reduction of a DBIG to a BIG - input normalised and output normalised
- *
- @param a BIG number, reduction of a BIG
- @param md BIG number, the modulus
- @param MC the Montgomery Constant
- @param d DBIG number to be reduced
- */
-extern void BIG_monty(BIG a,BIG md,chunk MC,DBIG d);
-
-/** @brief Shifts a BIG left by any number of bits - input must be normalised, output normalised
- *
- @param x BIG number to be shifted
- @param s Number of bits to shift
- */
-extern void BIG_shl(BIG x,int s);
-/** @brief Fast shifts a BIG left by a small number of bits - input must be normalised, output will be normalised
- *
- The number of bits to be shifted must be less than BASEBITS
- @param x BIG number to be shifted
- @param s Number of bits to shift
- @return Overflow bits
- */
-extern int BIG_fshl(BIG x,int s);
-/** @brief Shifts a DBIG left by any number of bits - input must be normalised, output normalised
- *
- @param x DBIG number to be shifted
- @param s Number of bits to shift
- */
-extern void BIG_dshl(DBIG x,int s);
-/** @brief Shifts a BIG right by any number of bits - input must be normalised, output normalised
- *
- @param x BIG number to be shifted
- @param s Number of bits to shift
- */
-extern void BIG_shr(BIG x,int s);
-/** @brief Fast shifts a BIG right by a small number of bits - input must be normalised, output will be normalised
- *
- The number of bits to be shifted must be less than BASEBITS
- @param x BIG number to be shifted
- @param s Number of bits to shift
- @return Shifted out bits
- */
-extern int BIG_fshr(BIG x,int s);
-/** @brief Shifts a DBIG right by any number of bits - input must be normalised, output normalised
- *
- @param x DBIG number to be shifted
- @param s Number of bits to shift
- */
-extern void BIG_dshr(DBIG x,int s);
-/** @brief Splits a DBIG into two BIGs - input must be normalised, outputs normalised
- *
- Internal function. The value of s must be approximately in the middle of the DBIG.
- Typically used to extract z mod 2^MODBITS and z/2^MODBITS
- @param x BIG number, top half of z
- @param y BIG number, bottom half of z
- @param z DBIG number to be split in two.
- @param s Bit position at which to split
- @return carry-out from top half
- */
-extern chunk BIG_split(BIG x,BIG y,DBIG z,int s);
-/** @brief Normalizes a BIG number - output normalised
- *
- All digits of the input BIG are reduced mod 2^BASEBITS
- @param x BIG number to be normalised
- */
-extern chunk BIG_norm(BIG x);
-/** @brief Normalizes a DBIG number - output normalised
- *
- All digits of the input DBIG are reduced mod 2^BASEBITS
- @param x DBIG number to be normalised
- */
-extern void BIG_dnorm(DBIG x);
-/** @brief Compares two BIG numbers. Inputs must be normalised externally
- *
- @param x first BIG number to be compared
- @param y second BIG number to be compared
- @return -1 is x<y, 0 if x=y, 1 if x>y
- */
-extern int BIG_comp(BIG x,BIG y);
-/** @brief Compares two DBIG numbers. Inputs must be normalised externally
- *
- @param x first DBIG number to be compared
- @param y second DBIG number to be compared
- @return -1 is x<y, 0 if x=y, 1 if x>y
- */
-extern int BIG_dcomp(DBIG x,DBIG y);
-/** @brief Calculate number of bits in a BIG - output normalised
- *
- @param x BIG number
- @return Number of bits in x
- */
-extern int BIG_nbits(BIG x);
-/** @brief Calculate number of bits in a DBIG - output normalised
- *
- @param x DBIG number
- @return Number of bits in x
- */
-extern int BIG_dnbits(DBIG x);
-/** @brief Reduce x mod n - input and output normalised
- *
- Slow but rarely used
- @param x BIG number to be reduced mod n
- @param n The modulus
- */
-extern void BIG_mod(BIG x,BIG n);
-/** @brief Divide x by n - output normalised
- *
- Slow but rarely used
- @param x BIG number to be divided by n
- @param n The Divisor
- */
-extern void BIG_sdiv(BIG x,BIG n);
-/** @brief x=y mod n - output normalised
- *
- Slow but rarely used. y is destroyed.
- @param x BIG number, on exit = y mod n
- @param y DBIG number
- @param n Modulus
- */
-extern void BIG_dmod(BIG x,DBIG y,BIG n);
-/** @brief x=y/n - output normalised
- *
- Slow but rarely used. y is destroyed.
- @param x BIG number, on exit = y/n
- @param y DBIG number
- @param n Modulus
- */
-extern void BIG_ddiv(BIG x,DBIG y,BIG n);
-/** @brief return parity of BIG, that is the least significant bit
- *
- @param x BIG number
- @return 0 or 1
- */
-extern int BIG_parity(BIG x);
-/** @brief return i-th of BIG
- *
- @param x BIG number
- @param i the bit of x to be returned
- @return 0 or 1
- */
-extern int BIG_bit(BIG x,int i);
-/** @brief return least significant bits of a BIG
- *
- @param x BIG number
- @param n number of bits to return. Assumed to be less than BASEBITS.
- @return least significant n bits as an integer
- */
-extern int BIG_lastbits(BIG x,int n);
-/** @brief Create a random BIG from a random number generator
- *
- Assumes that the random number generator has been suitably initialised
- @param x BIG number, on exit a random number
- @param r A pointer to a Cryptographically Secure Random Number Generator
- */
-extern void BIG_random(BIG x,csprng *r);
-/** @brief Create an unbiased random BIG from a random number generator, reduced with respect to a modulus
- *
- Assumes that the random number generator has been suitably initialised
- @param x BIG number, on exit a random number
- @param n The modulus
- @param r A pointer to a Cryptographically Secure Random Number Generator
- */
-extern void BIG_randomnum(BIG x,BIG n,csprng *r);
-/** brief return NAF (Non-Adjacent-Form) value as +/- 1, 3 or 5, inputs must be normalised
- *
- Given x and 3*x extracts NAF value from given bit position, and returns number of bits processed, and number of trailing zeros detected if any
- param x BIG number
- param x3 BIG number, three times x
- param i bit position
- param nbs pointer to integer returning number of bits processed
- param nzs pointer to integer returning number of trailing 0s
- return + or - 1, 3 or 5
-*/
-//extern int BIG_nafbits(BIG x,BIG x3,int i,int *nbs,int *nzs);
-
-/** @brief Calculate x=y*z mod n
- *
- Slow method for modular multiplication
- @param x BIG number, on exit = y*z mod n
- @param y BIG number
- @param z BIG number
- @param n The BIG Modulus
- */
-extern void BIG_modmul(BIG x,BIG y,BIG z,BIG n);
-/** @brief Calculate x=y/z mod n
- *
- Slow method for modular division
- @param x BIG number, on exit = y/z mod n
- @param y BIG number
- @param z BIG number
- @param n The BIG Modulus
- */
-extern void BIG_moddiv(BIG x,BIG y,BIG z,BIG n);
-/** @brief Calculate x=y^2 mod n
- *
- Slow method for modular squaring
- @param x BIG number, on exit = y^2 mod n
- @param y BIG number
- @param n The BIG Modulus
- */
-extern void BIG_modsqr(BIG x,BIG y,BIG n);
-/** @brief Calculate x=-y mod n
- *
- Modular negation
- @param x BIG number, on exit = -y mod n
- @param y BIG number
- @param n The BIG Modulus
- */
-extern void BIG_modneg(BIG x,BIG y,BIG n);
-/** @brief Calculate jacobi Symbol (x/y)
- *
- @param x BIG number
- @param y BIG number
- @return Jacobi symbol, -1,0 or 1
- */
-extern int BIG_jacobi(BIG x,BIG y);
-/** @brief Calculate x=1/y mod n
- *
- Modular Inversion - This is slow. Uses binary method.
- @param x BIG number, on exit = 1/y mod n
- @param y BIG number
- @param n The BIG Modulus
- */
-extern void BIG_invmodp(BIG x,BIG y,BIG n);
-/** @brief Calculate x=x mod 2^m
- *
- Truncation
- @param x BIG number, on reduced mod 2^m
- @param m new truncated size
-*/
-extern void BIG_mod2m(BIG x,int m);
-
-
-
-/* FP prototypes */
-
-/** @brief Tests for BIG equal to zero mod Modulus
- *
- @param x BIG number to be tested
- @return 1 if zero, else returns 0
- */
-extern int FP_iszilch(BIG x);
-/** @brief Converts from BIG integer to n-residue form mod Modulus
- *
- @param x BIG number to be converted
- */
-extern void FP_nres(BIG x);
-/** @brief Converts from n-residue form back to BIG integer form
- *
- @param x BIG number to be converted
- */
-extern void FP_redc(BIG x);
-/** @brief Sets BIG to representation of unity in n-residue form
- *
- @param x BIG number to be set equal to unity.
- */
-extern void FP_one(BIG x);
-/** @brief Reduces DBIG to BIG exploiting special form of the modulus
- *
- This function comes in different flavours depending on the form of Modulus that is currently in use.
- @param r BIG number, on exit = d mod Modulus
- @param d DBIG number to be reduced
- */
-extern void FP_mod(BIG r,DBIG d);
-/** @brief Fast Modular multiplication of two BIGs in n-residue form, mod Modulus
- *
- Uses appropriate fast modular reduction method
- @param x BIG number, on exit the modular product = y*z mod Modulus
- @param y BIG number, the multiplicand
- @param z BIG number, the multiplier
- */
-extern void FP_mul(BIG x,BIG y,BIG z);
-/** @brief Fast Modular multiplication of a BIG in n-residue form, by a small integer, mod Modulus
- *
- @param x BIG number, on exit the modular product = y*i mod Modulus
- @param y BIG number, the multiplicand
- @param i a small number, the multiplier
- */
-extern void FP_imul(BIG x,BIG y,int i);
-/** @brief Fast Modular squaring of a BIG in n-residue form, mod Modulus
- *
- Uses appropriate fast modular reduction method
- @param x BIG number, on exit the modular product = y^2 mod Modulus
- @param y BIG number, the number to be squared
-
- */
-extern void FP_sqr(BIG x,BIG y);
-/** @brief Modular addition of two BIGs in n-residue form, mod Modulus
- *
- @param x BIG number, on exit the modular sum = y+z mod Modulus
- @param y BIG number
- @param z BIG number
- */
-extern void FP_add(BIG x,BIG y,BIG z);
-/** @brief Modular subtraction of two BIGs in n-residue form, mod Modulus
- *
- @param x BIG number, on exit the modular difference = y-z mod Modulus
- @param y BIG number
- @param z BIG number
- */
-extern void FP_sub(BIG x,BIG y,BIG z);
-/** @brief Modular division by 2 of a BIG in n-residue form, mod Modulus
- *
- @param x BIG number, on exit =y/2 mod Modulus
- @param y BIG number
- */
-extern void FP_div2(BIG x,BIG y);
-/** @brief Fast Modular exponentiation of a BIG in n-residue form, to the power of a BIG, mod Modulus
- *
- @param x BIG number, on exit = y^z mod Modulus
- @param y BIG number
- @param z Big number exponent
- */
-extern void FP_pow(BIG x,BIG y,BIG z);
-/** @brief Fast Modular square root of a BIG in n-residue form, mod Modulus
- *
- @param x BIG number, on exit = sqrt(y) mod Modulus
- @param y BIG number, the number whose square root is calculated
-
- */
-extern void FP_sqrt(BIG x,BIG y);
-/** @brief Modular negation of a BIG in n-residue form, mod Modulus
- *
- @param x BIG number, on exit = -y mod Modulus
- @param y BIG number
- */
-extern void FP_neg(BIG x,BIG y);
-/** @brief Outputs a BIG number that is in n-residue form to the console
- *
- Converts from n-residue form before output
- @param x a BIG number
- */
-extern void FP_output(BIG x);
-/** @brief Outputs a BIG number that is in n-residue form to the console, in raw form
- *
- Converts from n-residue form before output
- @param x a BIG number
- */
-extern void FP_rawoutput(BIG x);
-/** @brief Reduces possibly unreduced BIG mod Modulus
- *
- @param x BIG number, on exit reduced mod Modulus
- */
-extern void FP_reduce(BIG x);
-/** @brief Tests for BIG a quadratic residue mod Modulus
- *
- @param x BIG number to be tested
- @return 1 if quadratic residue, else returns 0 if quadratic non-residue
- */
-extern int FP_qr(BIG x);
-/** @brief Modular inverse of a BIG in n-residue form, mod Modulus
- *
- @param x BIG number, on exit = 1/y mod Modulus
- @param y BIG number
- */
-extern void FP_inv(BIG x,BIG y);
-
-
-/* FP2 prototypes */
-
-/** @brief Tests for FP2 equal to zero
- *
- @param x FP2 number to be tested
- @return 1 if zero, else returns 0
- */
-extern int FP2_iszilch(FP2 *x);
-/** @brief Conditional copy of FP2 number
- *
- Conditionally copies second parameter to the first (without branching)
- @param x FP2 instance, set to y if s!=0
- @param y another FP2 instance
- @param s copy only takes place if not equal to 0
- */
-extern void FP2_cmove(FP2 *x,FP2 *y,int s);
-/** @brief Tests for FP2 equal to one
- *
- @param x FP2 instance to be tested
- @return 1 if x=1, else returns 0
- */
-extern int FP2_isunity(FP2 *x);
-/** @brief Tests for equality of two FP2s
- *
- @param x FP2 instance to be compared
- @param y FP2 instance to be compared
- @return 1 if x=y, else returns 0
- */
-extern int FP2_equals(FP2 *x,FP2 *y);
-/** @brief Initialise FP2 from two BIGs in n-residue form
- *
- @param x FP2 instance to be initialised
- @param a BIG to form real part of FP2
- @param b BIG to form imaginary part of FP2
- */
-extern void FP2_from_FPs(FP2 *x,BIG a,BIG b);
-/** @brief Initialise FP2 from two BIG integers
- *
- @param x FP2 instance to be initialised
- @param a BIG to form real part of FP2
- @param b BIG to form imaginary part of FP2
- */
-extern void FP2_from_BIGs(FP2 *x,BIG a,BIG b);
-/** @brief Initialise FP2 from single BIG in n-residue form
- *
- Imaginary part is set to zero
- @param x FP2 instance to be initialised
- @param a BIG to form real part of FP2
- */
-extern void FP2_from_FP(FP2 *x,BIG a);
-/** @brief Initialise FP2 from single BIG
- *
- Imaginary part is set to zero
- @param x FP2 instance to be initialised
- @param a BIG to form real part of FP2
- */
-extern void FP2_from_BIG(FP2 *x,BIG a);
-/** @brief Copy FP2 to another FP2
- *
- @param x FP2 instance, on exit = y
- @param y FP2 instance to be copied
- */
-extern void FP2_copy(FP2 *x,FP2 *y);
-/** @brief Set FP2 to zero
- *
- @param x FP2 instance to be set to zero
- */
-extern void FP2_zero(FP2 *x);
-/** @brief Set FP2 to unity
- *
- @param x FP2 instance to be set to one
- */
-extern void FP2_one(FP2 *x);
-/** @brief Negation of FP2
- *
- @param x FP2 instance, on exit = -y
- @param y FP2 instance
- */
-extern void FP2_neg(FP2 *x,FP2 *y);
-/** @brief Conjugation of FP2
- *
- If y=(a,b) on exit x=(a,-b)
- @param x FP2 instance, on exit = conj(y)
- @param y FP2 instance
- */
-extern void FP2_conj(FP2 *x,FP2 *y);
-/** @brief addition of two FP2s
- *
- @param x FP2 instance, on exit = y+z
- @param y FP2 instance
- @param z FP2 instance
- */
-extern void FP2_add(FP2 *x,FP2 *y,FP2 *z);
-/** @brief subtraction of two FP2s
- *
- @param x FP2 instance, on exit = y-z
- @param y FP2 instance
- @param z FP2 instance
- */
-extern void FP2_sub(FP2 *x,FP2 *y,FP2 *z);
-/** @brief Multiplication of an FP2 by an n-residue
- *
- @param x FP2 instance, on exit = y*b
- @param y FP2 instance
- @param b BIG n-residue
- */
-extern void FP2_pmul(FP2 *x,FP2 *y,BIG b);
-/** @brief Multiplication of an FP2 by a small integer
- *
- @param x FP2 instance, on exit = y*i
- @param y FP2 instance
- @param i an integer
- */
-extern void FP2_imul(FP2 *x,FP2 *y,int i);
-/** @brief Squaring an FP2
- *
- @param x FP2 instance, on exit = y^2
- @param y FP2 instance
- */
-extern void FP2_sqr(FP2 *x,FP2 *y);
-/** @brief Multiplication of two FP2s
- *
- @param x FP2 instance, on exit = y*z
- @param y FP2 instance
- @param z FP2 instance
- */
-extern void FP2_mul(FP2 *x,FP2 *y,FP2 *z);
-/** @brief Formats and outputs an FP2 to the console
- *
- @param x FP2 instance
- */
-extern void FP2_output(FP2 *x);
-/** @brief Formats and outputs an FP2 to the console in raw form (for debugging)
- *
- @param x FP2 instance
- */
-extern void FP2_rawoutput(FP2 *x);
-/** @brief Inverting an FP2
- *
- @param x FP2 instance, on exit = 1/y
- @param y FP2 instance
- */
-extern void FP2_inv(FP2 *x,FP2 *y);
-/** @brief Divide an FP2 by 2
- *
- @param x FP2 instance, on exit = y/2
- @param y FP2 instance
- */
-extern void FP2_div2(FP2 *x,FP2 *y);
-/** @brief Multiply an FP2 by (1+sqrt(-1))
- *
- Note that (1+sqrt(-1)) is irreducible for FP4
- @param x FP2 instance, on exit = x*(1+sqrt(-1))
- */
-extern void FP2_mul_ip(FP2 *x);
-/** @brief Divide an FP2 by (1+sqrt(-1))
- *
- Note that (1+sqrt(-1)) is irreducible for FP4
- @param x FP2 instance, on exit = x/(1+sqrt(-1))
- */
-extern void FP2_div_ip(FP2 *x);
-/** @brief Normalises the components of an FP2
- *
- @param x FP2 instance to be normalised
- */
-extern void FP2_norm(FP2 *x);
-/** @brief Reduces all components of possibly unreduced FP2 mod Modulus
- *
- @param x FP2 instance, on exit reduced mod Modulus
- */
-extern void FP2_reduce(FP2 *x);
-/** @brief Raises an FP2 to the power of a BIG
- *
- @param x FP2 instance, on exit = y^b
- @param y FP2 instance
- @param b BIG number
- */
-extern void FP2_pow(FP2 *x,FP2 *y,BIG b);
-/** @brief Square root of an FP2
- *
- @param x FP2 instance, on exit = sqrt(y)
- @param y FP2 instance
- */
-extern int FP2_sqrt(FP2 *x,FP2 *y);
-
-
-
-/* ECP E(Fp) prototypes */
-/** @brief Tests for ECP point equal to infinity
- *
- @param P ECP point to be tested
- @return 1 if infinity, else returns 0
- */
-extern int ECP_isinf(ECP *P);
-/** @brief Tests for equality of two ECPs
- *
- @param P ECP instance to be compared
- @param Q ECP instance to be compared
- @return 1 if P=Q, else returns 0
- */
-extern int ECP_equals(ECP *P,ECP *Q);
-/** @brief Copy ECP point to another ECP point
- *
- @param P ECP instance, on exit = Q
- @param Q ECP instance to be copied
- */
-extern void ECP_copy(ECP *P,ECP *Q);
-/** @brief Negation of an ECP point
- *
- @param P ECP instance, on exit = -P
- */
-extern void ECP_neg(ECP *P);
-/** @brief Set ECP to point-at-infinity
- *
- @param P ECP instance to be set to infinity
- */
-extern void ECP_inf(ECP *P);
-/** @brief Calculate Right Hand Side of curve equation y^2=f(x)
- *
- Function f(x) depends on form of elliptic curve, Weierstrass, Edwards or Montgomery.
- Used internally.
- @param r BIG n-residue value of f(x)
- @param x BIG n-residue x
- */
-extern void ECP_rhs(BIG r,BIG x);
-/** @brief Set ECP to point(x,y) given just x and sign of y
- *
- Point P set to infinity if no such point on the curve. If x is on the curve then y is calculated from the curve equation.
- The correct y value (plus or minus) is selected given its sign s.
- @param P ECP instance to be set (x,[y])
- @param x BIG x coordinate of point
- @param s an integer representing the "sign" of y, in fact its least significant bit.
- */
-extern int ECP_setx(ECP *P,BIG x,int s);
-
-#if CURVETYPE==MONTGOMERY
-/** @brief Set ECP to point(x,[y]) given x
- *
- Point P set to infinity if no such point on the curve. Note that y coordinate is not needed.
- @param P ECP instance to be set (x,[y])
- @param x BIG x coordinate of point
- @return 1 if point exists, else 0
- */
-extern int ECP_set(ECP *P,BIG x);
-/** @brief Extract x coordinate of an ECP point P
- *
- @param x BIG on exit = x coordinate of point
- @param P ECP instance (x,[y])
- @return -1 if P is point-at-infinity, else 0
- */
-extern int ECP_get(BIG x,ECP *P);
-/** @brief Adds ECP instance Q to ECP instance P, given difference D=P-Q
- *
- Differential addition of points on a Montgomery curve
- @param P ECP instance, on exit =P+Q
- @param Q ECP instance to be added to P
- @param D Difference between P and Q
- */
-extern void ECP_add(ECP *P,ECP *Q,ECP *D);
-#else
-/** @brief Set ECP to point(x,y) given x and y
- *
- Point P set to infinity if no such point on the curve.
- @param P ECP instance to be set (x,y)
- @param x BIG x coordinate of point
- @param y BIG y coordinate of point
- @return 1 if point exists, else 0
- */
-extern int ECP_set(ECP *P,BIG x,BIG y);
-/** @brief Extract x and y coordinates of an ECP point P
- *
- If x=y, returns only x
- @param x BIG on exit = x coordinate of point
- @param y BIG on exit = y coordinate of point (unless x=y)
- @param P ECP instance (x,y)
- @return sign of y, or -1 if P is point-at-infinity
- */
-extern int ECP_get(BIG x,BIG y,ECP *P);
-/** @brief Adds ECP instance Q to ECP instance P
- *
- @param P ECP instance, on exit =P+Q
- @param Q ECP instance to be added to P
- */
-extern void ECP_add(ECP *P,ECP *Q);
-/** @brief Subtracts ECP instance Q from ECP instance P
- *
- @param P ECP instance, on exit =P-Q
- @param Q ECP instance to be subtracted from P
- */
-extern void ECP_sub(ECP *P,ECP *Q);
-#endif
-/** @brief Converts an ECP point from Projective (x,y,z) coordinates to affine (x,y) coordinates
- *
- @param P ECP instance to be converted to affine form
- */
-extern void ECP_affine(ECP *P);
-/** @brief Formats and outputs an ECP point to the console, in projective coordinates
- *
- @param P ECP instance to be printed
- */
-extern void ECP_outputxyz(ECP *P);
-/** @brief Formats and outputs an ECP point to the console, converted to affine coordinates
- *
- @param P ECP instance to be printed
- */
-extern void ECP_output(ECP * P);
-/** @brief Formats and outputs an ECP point to an octet string
- *
- The octet string is created in the standard form 04|x|y, except for Montgomery curve in which case it is 06|x
- Here x (and y) are the x and y coordinates in big-endian base 256 form.
- @param S output octet string
- @param P ECP instance to be converted to an octet string
- */
-extern void ECP_toOctet(octet *S,ECP *P);
-/** @brief Creates an ECP point from an octet string
- *
- The octet string is in the standard form 0x04|x|y, except for Montgomery curve in which case it is 0x06|x
- Here x (and y) are the x and y coordinates in left justified big-endian base 256 form.
- @param P ECP instance to be created from the octet string
- @param S input octet string
- return 1 if octet string corresponds to a point on the curve, else 0
- */
-extern int ECP_fromOctet(ECP *P,octet *S);
-/** @brief Doubles an ECP instance P
- *
- @param P ECP instance, on exit =2*P
- */
-extern void ECP_dbl(ECP *P);
-/** @brief Multiplies an ECP instance P by a small integer, side-channel resistant
- *
- @param P ECP instance, on exit =i*P
- @param i small integer multiplier
- @param b maximum number of bits in multiplier
- */
-extern void ECP_pinmul(ECP *P,int i,int b);
-/** @brief Multiplies an ECP instance P by a BIG, side-channel resistant
- *
- Uses Montgomery ladder for Montgomery curves, otherwise fixed sized windows.
- @param P ECP instance, on exit =b*P
- @param b BIG number multiplier
-
- */
-extern void ECP_mul(ECP *P,BIG b);
-/** @brief Calculates double multiplication P=e*P+f*Q, side-channel resistant
- *
- @param P ECP instance, on exit =e*P+f*Q
- @param Q ECP instance
- @param e BIG number multiplier
- @param f BIG number multiplier
- */
-extern void ECP_mul2(ECP *P,ECP *Q,BIG e,BIG f);
-
-
-
-/* ECP2 E(Fp2) prototypes */
-/** @brief Tests for ECP2 point equal to infinity
- *
- @param P ECP2 point to be tested
- @return 1 if infinity, else returns 0
- */
-extern int ECP2_isinf(ECP2 *P);
-/** @brief Copy ECP2 point to another ECP2 point
- *
- @param P ECP2 instance, on exit = Q
- @param Q ECP2 instance to be copied
- */
-extern void ECP2_copy(ECP2 *P,ECP2 *Q);
-/** @brief Set ECP2 to point-at-infinity
- *
- @param P ECP2 instance to be set to infinity
- */
-extern void ECP2_inf(ECP2 *P);
-/** @brief Tests for equality of two ECP2s
- *
- @param P ECP2 instance to be compared
- @param Q ECP2 instance to be compared
- @return 1 if P=Q, else returns 0
- */
-extern int ECP2_equals(ECP2 *P,ECP2 *Q);
-/** @brief Converts an ECP2 point from Projective (x,y,z) coordinates to affine (x,y) coordinates
- *
- @param P ECP2 instance to be converted to affine form
- */
-extern void ECP2_affine(ECP2 *P);
-/** @brief Extract x and y coordinates of an ECP2 point P
- *
- If x=y, returns only x
- @param x FP2 on exit = x coordinate of point
- @param y FP2 on exit = y coordinate of point (unless x=y)
- @param P ECP2 instance (x,y)
- @return -1 if P is point-at-infinity, else 0
- */
-extern int ECP2_get(FP2 *x,FP2 *y,ECP2 *P);
-/** @brief Formats and outputs an ECP2 point to the console, converted to affine coordinates
- *
- @param P ECP2 instance to be printed
- */
-extern void ECP2_output(ECP2 *P);
-/** @brief Formats and outputs an ECP2 point to the console, in projective coordinates
- *
- @param P ECP2 instance to be printed
- */
-extern void ECP2_outputxyz(ECP2 *P);
-/** @brief Formats and outputs an ECP2 point to an octet string
- *
- The octet string is created in the form x|y.
- Convert the real and imaginary parts of the x and y coordinates to big-endian base 256 form.
- @param S output octet string
- @param P ECP2 instance to be converted to an octet string
- */
-extern void ECP2_toOctet(octet *S,ECP2 *P);
-/** @brief Creates an ECP2 point from an octet string
- *
- The octet string is in the form x|y
- The real and imaginary parts of the x and y coordinates are in big-endian base 256 form.
- @param P ECP2 instance to be created from the octet string
- @param S input octet string
- return 1 if octet string corresponds to a point on the curve, else 0
- */
-extern int ECP2_fromOctet(ECP2 *P,octet *S);
-/** @brief Calculate Right Hand Side of curve equation y^2=f(x)
- *
- Function f(x)=x^3+Ax+B
- Used internally.
- @param r FP2 value of f(x)
- @param x FP2 instance
- */
-extern void ECP2_rhs(FP2 *r,FP2 *x);
-/** @brief Set ECP2 to point(x,y) given x and y
- *
- Point P set to infinity if no such point on the curve.
- @param P ECP2 instance to be set (x,y)
- @param x FP2 x coordinate of point
- @param y FP2 y coordinate of point
- @return 1 if point exists, else 0
- */
-extern int ECP2_set(ECP2 *P,FP2 *x,FP2 *y);
-/** @brief Set ECP to point(x,[y]) given x
- *
- Point P set to infinity if no such point on the curve. Otherwise y coordinate is calculated from x.
- @param P ECP instance to be set (x,[y])
- @param x BIG x coordinate of point
- @return 1 if point exists, else 0
- */
-extern int ECP2_setx(ECP2 *P,FP2 *x);
-/** @brief Negation of an ECP2 point
- *
- @param P ECP2 instance, on exit = -P
- */
-extern void ECP2_neg(ECP2 *P);
-/** @brief Doubles an ECP2 instance P
- *
- @param P ECP2 instance, on exit =2*P
- */
-extern int ECP2_dbl(ECP2 *P);
-/** @brief Adds ECP2 instance Q to ECP2 instance P
- *
- @param P ECP2 instance, on exit =P+Q
- @param Q ECP2 instance to be added to P
- */
-extern int ECP2_add(ECP2 *P,ECP2 *Q);
-/** @brief Subtracts ECP instance Q from ECP2 instance P
- *
- @param P ECP2 instance, on exit =P-Q
- @param Q ECP2 instance to be subtracted from P
- */
-extern void ECP2_sub(ECP2 *P,ECP2 *Q);
-/** @brief Multiplies an ECP2 instance P by a BIG, side-channel resistant
- *
- Uses fixed sized windows.
- @param P ECP2 instance, on exit =b*P
- @param b BIG number multiplier
-
- */
-extern void ECP2_mul(ECP2 *P,BIG b);
-/** @brief Multiplies an ECP2 instance P by the internal modulus p, using precalculated Frobenius constant f
- *
- Fast point multiplication using Frobenius
- @param P ECP2 instance, on exit = p*P
- @param f FP2 precalculated Frobenius constant
-
- */
-extern void ECP2_frob(ECP2 *P,FP2 *f);
-/** @brief Calculates P=b[0]*Q[0]+b[1]*Q[1]+b[2]*Q[2]+b[3]*Q[3]
- *
- @param P ECP2 instance, on exit = b[0]*Q[0]+b[1]*Q[1]+b[2]*Q[2]+b[3]*Q[3]
- @param Q ECP2 array of 4 points
- @param b BIG array of 4 multipliers
- */
-extern void ECP2_mul4(ECP2 *P,ECP2 *Q,BIG *b);
-
-
-
-/* FP4 prototypes */
-/** @brief Tests for FP4 equal to zero
- *
- @param x FP4 number to be tested
- @return 1 if zero, else returns 0
- */
-extern int FP4_iszilch(FP4 *x);
-/** @brief Tests for FP4 equal to unity
- *
- @param x FP4 number to be tested
- @return 1 if unity, else returns 0
- */
-extern int FP4_isunity(FP4 *x);
-/** @brief Tests for equality of two FP4s
- *
- @param x FP4 instance to be compared
- @param y FP4 instance to be compared
- @return 1 if x=y, else returns 0
- */
-extern int FP4_equals(FP4 *x,FP4 *y);
-/** @brief Tests for FP4 having only a real part and no imaginary part
- *
- @param x FP4 number to be tested
- @return 1 if real, else returns 0
- */
-extern int FP4_isreal(FP4 *x);
-/** @brief Initialise FP4 from two FP2s
- *
- @param x FP4 instance to be initialised
- @param a FP2 to form real part of FP4
- @param b FP2 to form imaginary part of FP4
- */
-extern void FP4_from_FP2s(FP4 *x,FP2 *a,FP2 *b);
-/** @brief Initialise FP4 from single FP2
- *
- Imaginary part is set to zero
- @param x FP4 instance to be initialised
- @param a FP2 to form real part of FP4
- */
-extern void FP4_from_FP2(FP4 *x,FP2 *a);
-/** @brief Copy FP4 to another FP4
- *
- @param x FP4 instance, on exit = y
- @param y FP4 instance to be copied
- */
-extern void FP4_copy(FP4 *x,FP4 *y);
-/** @brief Set FP4 to zero
- *
- @param x FP4 instance to be set to zero
- */
-extern void FP4_zero(FP4 *x);
-/** @brief Set FP4 to unity
- *
- @param x FP4 instance to be set to one
- */
-extern void FP4_one(FP4 *x);
-/** @brief Negation of FP4
- *
- @param x FP4 instance, on exit = -y
- @param y FP4 instance
- */
-extern void FP4_neg(FP4 *x,FP4 *y);
-/** @brief Conjugation of FP4
- *
- If y=(a,b) on exit x=(a,-b)
- @param x FP4 instance, on exit = conj(y)
- @param y FP4 instance
- */
-extern void FP4_conj(FP4 *x,FP4 *y);
-/** @brief Negative conjugation of FP4
- *
- If y=(a,b) on exit x=(-a,b)
- @param x FP4 instance, on exit = -conj(y)
- @param y FP4 instance
- */
-extern void FP4_nconj(FP4 *x,FP4 *y);
-/** @brief addition of two FP4s
- *
- @param x FP4 instance, on exit = y+z
- @param y FP4 instance
- @param z FP4 instance
- */
-extern void FP4_add(FP4 *x,FP4 *y,FP4 *z);
-/** @brief subtraction of two FP4s
- *
- @param x FP4 instance, on exit = y-z
- @param y FP4 instance
- @param z FP4 instance
- */
-extern void FP4_sub(FP4 *x,FP4 *y,FP4 *z);
-/** @brief Multiplication of an FP4 by an FP2
- *
- @param x FP4 instance, on exit = y*a
- @param y FP4 instance
- @param a FP2 multiplier
- */
-extern void FP4_pmul(FP4 *x,FP4 *y,FP2 *a);
-/** @brief Multiplication of an FP4 by a small integer
- *
- @param x FP4 instance, on exit = y*i
- @param y FP4 instance
- @param i an integer
- */
-extern void FP4_imul(FP4 *x,FP4 *y,int i);
-/** @brief Squaring an FP4
- *
- @param x FP4 instance, on exit = y^2
- @param y FP4 instance
- */
-extern void FP4_sqr(FP4 *x,FP4 *y);
-/** @brief Multiplication of two FP4s
- *
- @param x FP4 instance, on exit = y*z
- @param y FP4 instance
- @param z FP4 instance
- */
-extern void FP4_mul(FP4 *x,FP4 *y,FP4 *z);
-/** @brief Inverting an FP4
- *
- @param x FP4 instance, on exit = 1/y
- @param y FP4 instance
- */
-extern void FP4_inv(FP4 *x,FP4 *y);
-/** @brief Formats and outputs an FP4 to the console
- *
- @param x FP4 instance to be printed
- */
-extern void FP4_output(FP4 *x);
-/** @brief Formats and outputs an FP4 to the console in raw form (for debugging)
- *
- @param x FP4 instance to be printed
- */
-extern void FP4_rawoutput(FP4 *x);
-/** @brief multiplies an FP4 instance by irreducible polynomial sqrt(1+sqrt(-1))
- *
- @param x FP4 instance, on exit = sqrt(1+sqrt(-1)*x
- */
-extern void FP4_times_i(FP4 *x);
-/** @brief Normalises the components of an FP4
- *
- @param x FP4 instance to be normalised
- */
-extern void FP4_norm(FP4 *x);
-/** @brief Reduces all components of possibly unreduced FP4 mod Modulus
- *
- @param x FP4 instance, on exit reduced mod Modulus
- */
-extern void FP4_reduce(FP4 *x);
-/** @brief Raises an FP4 to the power of a BIG
- *
- @param x FP4 instance, on exit = y^b
- @param y FP4 instance
- @param b BIG number
- */
-extern void FP4_pow(FP4 *x,FP4 *y,BIG b);
-/** @brief Raises an FP4 to the power of the internal modulus p, using the Frobenius
- *
- @param x FP4 instance, on exit = x^p
- @param f FP2 precalculated Frobenius constant
- */
-extern void FP4_frob(FP4 *x,FP2 *f);
-/** @brief Calculates the XTR addition function r=w*x-conj(x)*y+z
- *
- @param r FP4 instance, on exit = w*x-conj(x)*y+z
- @param w FP4 instance
- @param x FP4 instance
- @param y FP4 instance
- @param z FP4 instance
- */
-extern void FP4_xtr_A(FP4 *r,FP4 *w,FP4 *x,FP4 *y,FP4 *z);
-/** @brief Calculates the XTR doubling function r=x^2-2*conj(x)
- *
- @param r FP4 instance, on exit = x^2-2*conj(x)
- @param x FP4 instance
- */
-extern void FP4_xtr_D(FP4 *r,FP4 *x);
-/** @brief Calculates FP4 trace of an FP12 raised to the power of a BIG number
- *
- XTR single exponentiation
- @param r FP4 instance, on exit = trace(w^b)
- @param x FP4 instance, trace of an FP12 w
- @param b BIG number
- */
-extern void FP4_xtr_pow(FP4 *r,FP4 *x,BIG b);
-/** @brief Calculates FP4 trace of c^a.d^b, where c and d are derived from FP4 traces of FP12s
- *
- XTR double exponentiation
- Assumes c=tr(x^m), d=tr(x^n), e=tr(x^(m-n)), f=tr(x^(m-2n))
- @param r FP4 instance, on exit = trace(c^a.d^b)
- @param c FP4 instance, trace of an FP12
- @param d FP4 instance, trace of an FP12
- @param e FP4 instance, trace of an FP12
- @param f FP4 instance, trace of an FP12
- @param a BIG number
- @param b BIG number
- */
-extern void FP4_xtr_pow2(FP4 *r,FP4 *c,FP4 *d,FP4 *e,FP4 *f,BIG a,BIG b);
-
-
-
-/* FP12 prototypes */
-/** @brief Tests for FP12 equal to zero
- *
- @param x FP12 number to be tested
- @return 1 if zero, else returns 0
- */
-extern int FP12_iszilch(FP12 *x);
-/** @brief Tests for FP12 equal to unity
- *
- @param x FP12 number to be tested
- @return 1 if unity, else returns 0
- */
-extern int FP12_isunity(FP12 *x);
-/** @brief Copy FP12 to another FP12
- *
- @param x FP12 instance, on exit = y
- @param y FP12 instance to be copied
- */
-extern void FP12_copy(FP12 *x,FP12 *y);
-/** @brief Set FP12 to unity
- *
- @param x FP12 instance to be set to one
- */
-extern void FP12_one(FP12 *x);
-/** @brief Tests for equality of two FP12s
- *
- @param x FP12 instance to be compared
- @param y FP12 instance to be compared
- @return 1 if x=y, else returns 0
- */
-extern int FP12_equals(FP12 *x,FP12 *y);
-/** @brief Conjugation of FP12
- *
- If y=(a,b,c) (where a,b,c are its three FP4 components) on exit x=(conj(a),-conj(b),conj(c))
- @param x FP12 instance, on exit = conj(y)
- @param y FP12 instance
- */
-extern void FP12_conj(FP12 *x,FP12 *y);
-/** @brief Initialise FP12 from single FP4
- *
- Sets first FP4 component of an FP12, other components set to zero
- @param x FP12 instance to be initialised
- @param a FP4 to form first part of FP4
- */
-extern void FP12_from_FP4(FP12 *x,FP4 *a);
-/** @brief Initialise FP12 from three FP4s
- *
- @param x FP12 instance to be initialised
- @param a FP4 to form first part of FP12
- @param b FP4 to form second part of FP12
- @param c FP4 to form third part of FP12
- */
-extern void FP12_from_FP4s(FP12 *x,FP4 *a,FP4* b,FP4 *c);
-/** @brief Fast Squaring of an FP12 in "unitary" form
- *
- @param x FP12 instance, on exit = y^2
- @param y FP4 instance, must be unitary
- */
-extern void FP12_usqr(FP12 *x,FP12 *y);
-/** @brief Squaring an FP12
- *
- @param x FP12 instance, on exit = y^2
- @param y FP12 instance
- */
-extern void FP12_sqr(FP12 *x,FP12 *y);
-/** @brief Fast multiplication of an FP12 by an FP12 that arises from an ATE pairing line function
- *
- Here the multiplier has a special form that can be exploited
- @param x FP12 instance, on exit = x*y
- @param y FP12 instance, of special form
- */
-extern void FP12_smul(FP12 *x,FP12 *y);
-/** @brief Multiplication of two FP12s
- *
- @param x FP12 instance, on exit = x*y
- @param y FP12 instance, the multiplier
- */
-extern void FP12_mul(FP12 *x,FP12 *y);
-/** @brief Inverting an FP12
- *
- @param x FP12 instance, on exit = 1/y
- @param y FP12 instance
- */
-extern void FP12_inv(FP12 *x,FP12 *y);
-/** @brief Raises an FP12 to the power of a BIG
- *
- @param r FP12 instance, on exit = y^b
- @param x FP12 instance
- @param b BIG number
- */
-extern void FP12_pow(FP12 *r,FP12 *x,BIG b);
-/** @brief Raises an FP12 instance x to a small integer power, side-channel resistant
- *
- @param x ECP instance, on exit = x^i
- @param i small integer exponent
- @param b maximum number of bits in exponent
- */
-extern void FP12_pinpow(FP12 *x,int i,int b);
-/** @brief Calculate x[0]^b[0].x[1]^b[1].x[2]^b[2].x[3]^b[3], side-channel resistant
- *
- @param r ECP instance, on exit = x[0]^b[0].x[1]^b[1].x[2]^b[2].x[3]^b[3]
- @param x FP12 array with 4 FP12s
- @param b BIG array of 4 exponents
- */
-extern void FP12_pow4(FP12 *r,FP12 *x,BIG *b);
-/** @brief Raises an FP12 to the power of the internal modulus p, using the Frobenius
- *
- @param x FP12 instance, on exit = x^p
- @param f FP2 precalculated Frobenius constant
- */
-extern void FP12_frob(FP12 *x,FP2 *f);
-/** @brief Reduces all components of possibly unreduced FP12 mod Modulus
- *
- @param x FP12 instance, on exit reduced mod Modulus
- */
-extern void FP12_reduce(FP12 *x);
-/** @brief Normalises the components of an FP12
- *
- @param x FP12 instance to be normalised
- */
-extern void FP12_norm(FP12 *x);
-/** @brief Formats and outputs an FP12 to the console
- *
- @param x FP12 instance to be printed
- */
-extern void FP12_output(FP12 *x);
-/** @brief Formats and outputs an FP12 instance to an octet string
- *
- Serializes the components of an FP12 to big-endian base 256 form.
- @param S output octet string
- @param x FP12 instance to be converted to an octet string
- */
-extern void FP12_toOctet(octet *S,FP12 *x);
-/** @brief Creates an FP12 instance from an octet string
- *
- De-serializes the components of an FP12 to create an FP12 from big-endian base 256 components.
- @param x FP12 instance to be created from an octet string
- @param S input octet string
-
- */
-extern void FP12_fromOctet(FP12 *x,octet *S);
-/** @brief Calculate the trace of an FP12
- *
- @param t FP4 trace of x, on exit = tr(x)
- @param x FP12 instance
-
- */
-extern void FP12_trace(FP4 *t,FP12 *x);
-
-
-
-/* Pairing function prototypes */
-/** @brief Calculate Miller loop for Optimal ATE pairing e(P,Q)
- *
- @param r FP12 result of the pairing calculation e(P,Q)
- @param P ECP2 instance, an element of G2
- @param Q ECP instance, an element of G1
-
- */
-extern void PAIR_ate(FP12 *r,ECP2 *P,ECP *Q);
-/** @brief Calculate Miller loop for Optimal ATE double-pairing e(P,Q).e(R,S)
- *
- Faster than calculating two separate pairings
- @param r FP12 result of the pairing calculation e(P,Q).e(R,S), an element of GT
- @param P ECP2 instance, an element of G2
- @param Q ECP instance, an element of G1
- @param R ECP2 instance, an element of G2
- @param S ECP instance, an element of G1
- */
-extern void PAIR_double_ate(FP12 *r,ECP2 *P,ECP *Q,ECP2 *R,ECP *S);
-/** @brief Final exponentiation of pairing, converts output of Miller loop to element in GT
- *
- Here p is the internal modulus, and r is the group order
- @param x FP12, on exit = x^((p^12-1)/r)
- */
-extern void PAIR_fexp(FP12 *x);
-/** @brief Fast point multiplication of a member of the group G1 by a BIG number
- *
- May exploit endomorphism for speed.
- @param Q ECP member of G1.
- @param b BIG multiplier
-
- */
-extern void PAIR_G1mul(ECP *Q,BIG b);
-/** @brief Fast point multiplication of a member of the group G2 by a BIG number
- *
- May exploit endomorphism for speed.
- @param P ECP2 member of G1.
- @param b BIG multiplier
-
- */
-extern void PAIR_G2mul(ECP2 *P,BIG b);
-/** @brief Fast raising of a member of GT to a BIG power
- *
- May exploit endomorphism for speed.
- @param x FP12 member of GT.
- @param b BIG exponent
-
- */
-extern void PAIR_GTpow(FP12 *x,BIG b);
-/** @brief Tests FP12 for membership of GT
- *
- @param x FP12 instance
- @return 1 if x is in GT, else return 0
-
- */
-extern int PAIR_GTmember(FP12 *x);
-
-
-
-/* Finite Field Prototypes */
-/** @brief Copy one FF element of given length to another
- *
- @param x FF instance to be copied to, on exit = y
- @param y FF instance to be copied from
- @param n size of FF in BIGs
-
- */
-extern void FF_copy(BIG *x,BIG *y,int n);
-/** @brief Initialize an FF element of given length from a 32-bit integer m
- *
- @param x FF instance to be copied to, on exit = m
- @param m integer
- @param n size of FF in BIGs
- */
-extern void FF_init(BIG *x,sign32 m,int n);
-/** @brief Set FF element of given size to zero
- *
- @param x FF instance to be set to zero
- @param n size of FF in BIGs
- */
-extern void FF_zero(BIG *x,int n);
-/** @brief Tests for FF element equal to zero
- *
- @param x FF number to be tested
- @param n size of FF in BIGs
- @return 1 if zero, else returns 0
- */
-extern int FF_iszilch(BIG *x,int n);
-/** @brief return parity of an FF, that is the least significant bit
- *
- @param x FF number
- @return 0 or 1
- */
-extern int FF_parity(BIG *x);
-/** @brief return least significant m bits of an FF
- *
- @param x FF number
- @param m number of bits to return. Assumed to be less than BASEBITS.
- @return least significant n bits as an integer
- */
-extern int FF_lastbits(BIG *x,int m);
-/** @brief Set FF element of given size to unity
- *
- @param x FF instance to be set to unity
- @param n size of FF in BIGs
- */
-extern void FF_one(BIG *x,int n);
-/** @brief Compares two FF numbers. Inputs must be normalised externally
- *
- @param x first FF number to be compared
- @param y second FF number to be compared
- @param n size of FF in BIGs
- @return -1 is x<y, 0 if x=y, 1 if x>y
- */
-extern int FF_comp(BIG *x,BIG *y,int n);
-/** @brief addition of two FFs
- *
- @param x FF instance, on exit = y+z
- @param y FF instance
- @param z FF instance
- @param n size of FF in BIGs
- */
-extern void FF_add(BIG *x,BIG *y,BIG *z,int n);
-/** @brief subtraction of two FFs
- *
- @param x FF instance, on exit = y-z
- @param y FF instance
- @param z FF instance
- @param n size of FF in BIGs
- */
-extern void FF_sub(BIG *x,BIG *y,BIG *z,int n);
-/** @brief increment an FF by an integer,and normalise
- *
- @param x FF instance, on exit = x+m
- @param m an integer to be added to x
- @param n size of FF in BIGs
- */
-extern void FF_inc(BIG *x,int m,int n);
-/** @brief Decrement an FF by an integer,and normalise
- *
- @param x FF instance, on exit = x-m
- @param m an integer to be subtracted from x
- @param n size of FF in BIGs
- */
-extern void FF_dec(BIG *x,int m,int n);
-/** @brief Normalises the components of an FF
- *
- @param x FF instance to be normalised
- @param n size of FF in BIGs
- */
-extern void FF_norm(BIG *x,int n);
-/** @brief Shift left an FF by 1 bit
- *
- @param x FF instance to be shifted left
- @param n size of FF in BIGs
- */
-extern void FF_shl(BIG *x,int n);
-/** @brief Shift right an FF by 1 bit
- *
- @param x FF instance to be shifted right
- @param n size of FF in BIGs
- */
-extern void FF_shr(BIG *x,int n);
-/** @brief Formats and outputs an FF to the console
- *
- @param x FF instance to be printed
- @param n size of FF in BIGs
- */
-extern void FF_output(BIG *x,int n);
-/** @brief Formats and outputs an FF to the console, in raw form
- *
- @param x FF instance to be printed
- @param n size of FF in BIGs
- */
-extern void FF_rawoutput(BIG *x,int n);
-/** @brief Formats and outputs an FF instance to an octet string
- *
- Converts an FF to big-endian base 256 form.
- @param S output octet string
- @param x FF instance to be converted to an octet string
- @param n size of FF in BIGs
- */
-extern void FF_toOctet(octet *S,BIG *x,int n);
-/** @brief Populates an FF instance from an octet string
- *
- Creates FF from big-endian base 256 form.
- @param x FF instance to be created from an octet string
- @param S input octet string
- @param n size of FF in BIGs
- */
-extern void FF_fromOctet(BIG *x,octet *S,int n);
-/** @brief Multiplication of two FFs
- *
- Uses Karatsuba method internally
- @param x FF instance, on exit = y*z
- @param y FF instance
- @param z FF instance
- @param n size of FF in BIGs
- */
-extern void FF_mul(BIG *x,BIG *y,BIG *z,int n);
-/** @brief Reduce FF mod a modulus
- *
- This is slow
- @param x FF instance to be reduced mod m - on exit = x mod m
- @param m FF modulus
- @param n size of FF in BIGs
- */
-extern void FF_mod(BIG *x,BIG *m,int n);
-/** @brief Square an FF
- *
- Uses Karatsuba method internally
- @param x FF instance, on exit = y^2
- @param y FF instance to be squared
- @param n size of FF in BIGs
- */
-extern void FF_sqr(BIG *x,BIG *y,int n);
-/** @brief Reduces a double-length FF with respect to a given modulus
- *
- This is slow
- @param x FF instance, on exit = y mod z
- @param y FF instance, of double length 2*n
- @param z FF modulus
- @param n size of FF in BIGs
- */
-extern void FF_dmod(BIG *x,BIG *y,BIG *z,int n);
-/** @brief Invert an FF mod a prime modulus
- *
- @param x FF instance, on exit = 1/y mod z
- @param y FF instance
- @param z FF prime modulus
- @param n size of FF in BIGs
- */
-extern void FF_invmodp(BIG *x,BIG *y,BIG *z,int n);
-/** @brief Create an FF from a random number generator
- *
- @param x FF instance, on exit x is a random number of length n BIGs with most significant bit a 1
- @param R an instance of a Cryptographically Secure Random Number Generator
- @param n size of FF in BIGs
- */
-extern void FF_random(BIG *x,csprng *R,int n);
-/** @brief Create a random FF less than a given modulus from a random number generator
- *
- @param x FF instance, on exit x is a random number < y
- @param y FF instance, the modulus
- @param R an instance of a Cryptographically Secure Random Number Generator
- @param n size of FF in BIGs
- */
-extern void FF_randomnum(BIG *x,BIG *y,csprng *R,int n);
-/** @brief Calculate r=x^e mod m, side channel resistant
- *
- @param r FF instance, on exit = x^e mod p
- @param x FF instance
- @param e FF exponent
- @param m FF modulus
- @param n size of FF in BIGs
- */
-extern void FF_skpow(BIG *r,BIG *x,BIG * e,BIG *m,int n);
-/** @brief Calculate r=x^e mod m, side channel resistant
- *
- For short BIG exponent
- @param r FF instance, on exit = x^e mod p
- @param x FF instance
- @param e BIG exponent
- @param m FF modulus
- @param n size of FF in BIGs
- */
-extern void FF_skspow(BIG *r,BIG *x,BIG e,BIG *m,int n);
-/** @brief Calculate r=x^e mod m
- *
- For very short integer exponent
- @param r FF instance, on exit = x^e mod p
- @param x FF instance
- @param e integer exponent
- @param m FF modulus
- @param n size of FF in BIGs
- */
-extern void FF_power(BIG *r,BIG *x,int e,BIG *m,int n);
-/** @brief Calculate r=x^e mod m
- *
- @param r FF instance, on exit = x^e mod p
- @param x FF instance
- @param e FF exponent
- @param m FF modulus
- @param n size of FF in BIGs
- */
-extern void FF_pow(BIG *r,BIG *x,BIG *e,BIG *m,int n);
-/** @brief Test if an FF has factor in common with integer s
- *
- @param x FF instance to be tested
- @param s the supplied integer
- @param n size of FF in BIGs
- @return 1 if gcd(x,s)!=1, else return 0
- */
-extern int FF_cfactor(BIG *x,sign32 s,int n);
-/** @brief Test if an FF is prime
- *
- Uses Miller-Rabin Method
- @param x FF instance to be tested
- @param R an instance of a Cryptographically Secure Random Number Generator
- @param n size of FF in BIGs
- @return 1 if x is (almost certainly) prime, else return 0
- */
-extern int FF_prime(BIG *x,csprng *R,int n);
-/** @brief Calculate r=x^e.y^f mod m
- *
- @param r FF instance, on exit = x^e.y^f mod p
- @param x FF instance
- @param e BIG exponent
- @param y FF instance
- @param f BIG exponent
- @param m FF modulus
- @param n size of FF in BIGs
- */
-extern void FF_pow2(BIG *r,BIG *x,BIG e,BIG *y,BIG f,BIG *m,int n);
-
-
-/* Octet string handlers */
-/** @brief Formats and outputs an octet to the console in hex
- *
- @param O Octet to be output
- */
-extern void OCT_output(octet *O);
-/** @brief Formats and outputs an octet to the console as a character string
- *
- @param O Octet to be output
- */
-extern void OCT_output_string(octet *O);
-/** @brief Wipe clean an octet
- *
- @param O Octet to be cleaned
- */
-extern void OCT_clear(octet *O);
-/** @brief Compare two octets
- *
- @param O first Octet to be compared
- @param P second Octet to be compared
- @return 1 if equal, else 0
- */
-extern int OCT_comp(octet *O,octet *P);
-/** @brief Compare first n bytes of two octets
- *
- @param O first Octet to be compared
- @param P second Octet to be compared
- @param n number of bytes to compare
- @return 1 if equal, else 0
- */
-extern int OCT_ncomp(octet *O,octet *P,int n);
-/** @brief Join from a C string to end of an octet
- *
- Truncates if there is no room
- @param O Octet to be written to
- @param s zero terminated string to be joined to octet
- */
-extern void OCT_jstring(octet *O,char *s);
-/** @brief Join bytes to end of an octet
- *
- Truncates if there is no room
- @param O Octet to be written to
- @param s bytes to be joined to end of octet
- @param n number of bytes to join
- */
-extern void OCT_jbytes(octet *O,char *s,int n);
-/** @brief Join single byte to end of an octet, repeated n times
- *
- Truncates if there is no room
- @param O Octet to be written to
- @param b byte to be joined to end of octet
- @param n number of times b is to be joined
- */
-extern void OCT_jbyte(octet *O,int b,int n);
-/** @brief Join one octet to the end of another
- *
- Truncates if there is no room
- @param O Octet to be written to
- @param P Octet to be joined to the end of O
- */
-extern void OCT_joctet(octet *O,octet *P);
-/** @brief XOR common bytes of a pair of Octets
- *
- @param O Octet - on exit = O xor P
- @param P Octet to be xored into O
- */
-extern void OCT_xor(octet *O,octet *P);
-/** @brief reset Octet to zero length
- *
- @param O Octet to be emptied
- */
-extern void OCT_empty(octet *O);
-/** @brief Pad out an Octet to the given length
- *
- Padding is done by inserting leading zeros, so abcd becomes 00abcd
- @param O Octet to be padded
- @param n new length of Octet
- */
-extern int OCT_pad(octet *O,int n);
-/** @brief Convert an Octet to printable base64 number
- *
- @param b zero terminated byte array to take base64 conversion
- @param O Octet to be converted
- */
-extern void OCT_tobase64(char *b,octet *O);
-/** @brief Populate an Octet from base64 number
- *
- @param O Octet to be populated
- @param b zero terminated base64 string
-
- */
-extern void OCT_frombase64(octet *O,char *b);
-/** @brief Copy one Octet into another
- *
- @param O Octet to be copied to
- @param P Octet to be copied from
-
- */
-extern void OCT_copy(octet *O,octet *P);
-/** @brief XOR every byte of an octet with input m
- *
- @param O Octet
- @param m byte to be XORed with every byte of O
-
- */
-extern void OCT_xorbyte(octet *O,int m);
-/** @brief Chops Octet into two, leaving first n bytes in O, moving the rest to P
- *
- @param O Octet to be chopped
- @param P new Octet to be created
- @param n number of bytes to chop off O
-
- */
-extern void OCT_chop(octet *O,octet *P,int n);
-/** @brief Join n bytes of integer m to end of Octet O (big endian)
- *
- Typically n is 4 for a 32-bit integer
- @param O Octet to be appended to
- @param m integer to be appended to O
- @param n number of bytes in m
-
- */
-extern void OCT_jint(octet *O,int m,int n);
-/** @brief Create an Octet from bytes taken from a random number generator
- *
- Truncates if there is no room
- @param O Octet to be populated
- @param R an instance of a Cryptographically Secure Random Number Generator
- @param n number of bytes to extracted from R
-
- */
-extern void OCT_rand(octet *O,csprng *R,int n);
-/** @brief Shifts Octet left by n bytes
- *
- Leftmost bytes disappear
- @param O Octet to be shifted
- @param n number of bytes to shift
-
- */
-extern void OCT_shl(octet *O,int n);
-/** @brief Convert a hex number to an Octet
- *
- @param dst Octet
- @param src Hex string to be converted
- */
-extern void OCT_fromHex(octet *dst,char *src);
-/** @brief Convert an Octet to printable hex number
- *
- @param dst hex value
- @param src Octet to be converted
- */
-extern void OCT_toHex(octet *src,char *dst);
-/** @brief Convert an Octet to string
- *
- @param dst string value
- @param src Octet to be converted
- */
-extern void OCT_toStr(octet *src,char *dst);
-
-
-
-/* Hash function */
-/** @brief Initialise an instance of SHA256
- *
- @param H an instance SHA256
- */
-extern void HASH256_init(hash256 *H);
-/** @brief Add a byte to the hash
- *
- @param H an instance SHA256
- @param b byte to be included in hash
- */
-extern void HASH256_process(hash256 *H,int b);
-/** @brief Generate 32-byte hash
- *
- @param H an instance SHA256
- @param h is the output 32-byte hash
- */
-extern void HASH256_hash(hash256 *H,char *h);
-
-
-/** @brief Initialise an instance of SHA384
- *
- @param H an instance SHA384
- */
-extern void HASH384_init(hash384 *H);
-/** @brief Add a byte to the hash
- *
- @param H an instance SHA384
- @param b byte to be included in hash
- */
-extern void HASH384_process(hash384 *H,int b);
-/** @brief Generate 48-byte hash
- *
- @param H an instance SHA384
- @param h is the output 48-byte hash
- */
-extern void HASH384_hash(hash384 *H,char *h);
-
-
-/** @brief Initialise an instance of SHA512
- *
- @param H an instance SHA512
- */
-extern void HASH512_init(hash512 *H);
-/** @brief Add a byte to the hash
- *
- @param H an instance SHA512
- @param b byte to be included in hash
- */
-extern void HASH512_process(hash512 *H,int b);
-/** @brief Generate 64-byte hash
- *
- @param H an instance SHA512
- @param h is the output 64-byte hash
- */
-extern void HASH512_hash(hash512 *H,char *h);
-
-
-/* AES functions */
-/** @brief Reset AES mode or IV
- *
- @param A an instance of the AMCL_AES
- @param m is the new active mode of operation (ECB, CBC, OFB, CFB etc)
- @param iv the new Initialisation Vector
- */
-extern void AES_reset(amcl_aes *A,int m,char *iv);
-/** @brief Extract chaining vector from AMCL_AES instance
- *
- @param A an instance of the AMCL_AES
- @param f the extracted chaining vector
- */
-extern void AES_getreg(amcl_aes *A,char * f);
-/** @brief Initialise an instance of AMCL_AES and its mode of operation
- *
- @param A an instance AMCL_AES
- @param m is the active mode of operation (ECB, CBC, OFB, CFB etc)
- @param n is the key length in bytes, 16, 24 or 32
- @param k the AES key as an array of 16 bytes
- @param iv the Initialisation Vector
- @return 0 for invalid n
- */
-extern int AES_init(amcl_aes *A,int m,int n,char *k,char *iv);
-/** @brief Encrypt a single 16 byte block in ECB mode
- *
- @param A an instance of the AMCL_AES
- @param b is an array of 16 plaintext bytes, on exit becomes ciphertext
- */
-extern void AES_ecb_encrypt(amcl_aes *A,uchar * b);
-/** @brief Decrypt a single 16 byte block in ECB mode
- *
- @param A an instance of the AMCL_AES
- @param b is an array of 16 cipherext bytes, on exit becomes plaintext
- */
-extern void AES_ecb_decrypt(amcl_aes *A,uchar * b);
-/** @brief Encrypt a single 16 byte block in active mode
- *
- @param A an instance of the AMCL_AES
- @param b is an array of 16 plaintext bytes, on exit becomes ciphertext
- @return 0, or overflow bytes from CFB mode
- */
-extern unsign32 AES_encrypt(amcl_aes *A,char *b );
-/** @brief Decrypt a single 16 byte block in active mode
- *
- @param A an instance of the AMCL_AES
- @param b is an array of 16 ciphertext bytes, on exit becomes plaintext
- @return 0, or overflow bytes from CFB mode
- */
-extern unsign32 AES_decrypt(amcl_aes *A,char *b);
-/** @brief Clean up after application of AES
- *
- @param A an instance of the AMCL_AES
- */
-extern void AES_end(amcl_aes *A);
-
-
-/* AES-GCM functions */
-/** @brief Initialise an instance of AES-GCM mode
- *
- @param G an instance AES-GCM
- @param nk is the key length in bytes, 16, 24 or 32
- @param k the AES key as an array of 16 bytes
- @param n the number of bytes in the Initialisation Vector (IV)
- @param iv the IV
- */
-extern void GCM_init(gcm *G,int nk,char *k,int n,char *iv);
-/** @brief Add header (material to be authenticated but not encrypted)
- *
- Note that this function can be called any number of times with n a multiple of 16, and then one last time with any value for n
- @param G an instance AES-GCM
- @param b is the header material to be added
- @param n the number of bytes in the header
- */
-extern int GCM_add_header(gcm *G,char *b,int n);
-/** @brief Add plaintext and extract ciphertext
- *
- Note that this function can be called any number of times with n a multiple of 16, and then one last time with any value for n
- @param G an instance AES-GCM
- @param c is the ciphertext generated
- @param p is the plaintext material to be added
- @param n the number of bytes in the plaintext
- */
-extern int GCM_add_plain(gcm *G,char *c,char *p,int n);
-/** @brief Add ciphertext and extract plaintext
- *
- Note that this function can be called any number of times with n a multiple of 16, and then one last time with any value for n
- @param G an instance AES-GCM
- @param p is the plaintext generated
- @param c is the ciphertext material to be added
- @param n the number of bytes in the ciphertext
- */
-extern int GCM_add_cipher(gcm *G,char *p,char *c,int n);
-/** @brief Finish off and extract authentication tag (HMAC)
- *
- @param G is an active instance AES-GCM
- @param t is the output 16 byte authentication tag
- */
-extern void GCM_finish(gcm *G,char *t);
-
-
-
-/* random numbers */
-/** @brief Seed a random number generator from an array of bytes
- *
- The provided seed should be truly random
- @param R an instance of a Cryptographically Secure Random Number Generator
- @param n the number of seed bytes provided
- @param b an array of seed bytes
-
- */
-extern void RAND_seed(csprng *R,int n,char *b);
-/** @brief Delete all internal state of a random number generator
- *
- @param R an instance of a Cryptographically Secure Random Number Generator
- */
-extern void RAND_clean(csprng *R);
-/** @brief Return a random byte from a random number generator
- *
- @param R an instance of a Cryptographically Secure Random Number Generator
- @return a random byte
- */
-extern int RAND_byte(csprng *R);
-
-/**
- * @brief Convert to DBIG number from byte array of given length
- *
- * Convert to DBIG number from byte array of given length.
- *
- * @param x DBIG number
- * @param a byte array
- * @param s byte array length
- */
-extern void BIG_dfromBytesLen(DBIG x,char *a,int s);
-
-#endif
diff --git a/version22/c/arch.h b/version22/c/arch.h
deleted file mode 100644
index 21753bd..0000000
--- a/version22/c/arch.h
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-*/
-
-/* Architecture definition header file */
-
-/**
- * @file arch.h
- * @author Mike Scott
- * @date 23rd February 2016
- * @brief Architecture Header File
- *
- * Specify Processor Architecture
- *
- */
-
-/* NOTE: There is only one user configurable section in this header - see below */
-
-#ifndef ARCH_H
-#define ARCH_H
-
-
-
-
-/*** START OF USER CONFIGURABLE SECTION - set architecture ***/
-
-#ifdef CMAKE
-#define CHUNK @AMCL_CHUNK@ /**< size of chunk in bits = wordlength of computer = 16, 32 or 64. Note not all curve options are supported on 16-bit processors - see rom.c */
-#else
-#define CHUNK 32 /**< size of chunk in bits = wordlength of computer = 16, 32 or 64. Note not all curve options are supported on 16-bit processors - see rom.c */
-#endif
-
-/*** END OF USER CONFIGURABLE SECTION ***/
-
-
-
-/* Create Integer types */
-/* Support for C99? Note for GCC need to explicitly include -std=c99 in command line */
-
-#if __STDC_VERSION__ >= 199901L
-/* C99 code */
-#define C99
-#else
-/* Not C99 code */
-#endif
-
-#ifndef C99 /* You are on your own! These are for Microsoft C */
-#define sign32 __int32 /**< 32-bit signed integer */
-#define sign8 signed char /**< 8-bit signed integer */
-#define unsign32 unsigned __int32 /**< 32-bit unsigned integer */
-#define unsign64 unsigned long long /**< 64-bit unsigned integer */
-#else
-#include <stdint.h>
-#define sign8 int8_t /**< 8-bit signed integer */
-#define sign32 int32_t /**< 32-bit signed integer */
-#define unsign32 uint32_t /**< 32-bit unsigned integer */
-#define unsign64 uint64_t /**< 64-bit unsigned integer */
-#endif
-
-#define uchar unsigned char /**< Unsigned char */
-
-/* Don't mess with anything below this line unless you know what you are doing */
-/* This next is probably OK, but may need changing for non-C99-standard environments */
-
-/* This next is probably OK, but may need changing for non-C99-standard environments */
-
-#if CHUNK==16
-#ifndef C99
-#define chunk __int16 /**< C type corresponding to word length */
-#define dchunk __int32 /**< Always define double length chunk type if available */
-#else
-#define chunk int16_t /**< C type corresponding to word length */
-#define dchunk int32_t /**< Always define double length chunk type if available */
-#endif
-#endif
-
-#if CHUNK == 32
-#ifndef C99
-#define chunk __int32 /**< C type corresponding to word length */
-#define dchunk __int64 /**< Always define double length chunk type if available */
-#else
-#define chunk int32_t /**< C type corresponding to word length */
-#define dchunk int64_t /**< Always define double length chunk type if available */
-#endif
-#endif
-
-#if CHUNK == 64
-
-#ifndef C99
-#define chunk __int64 /**< C type corresponding to word length */
-/**< Note - no 128-bit type available */
-#else
-#define chunk int64_t /**< C type corresponding to word length */
-#ifdef __GNUC__
-#define dchunk __int128 /**< Always define double length chunk type if available - GCC supports 128 bit type ??? */
-#endif
-#endif
-#endif
-
-#ifdef dchunk
-#define COMBA /**< Use COMBA method for faster BN muls, sqrs and reductions */
-#endif
-
-#endif
diff --git a/version22/c/benchtest_ec.c b/version22/c/benchtest_ec.c
deleted file mode 100644
index 5929d0b..0000000
--- a/version22/c/benchtest_ec.c
+++ /dev/null
@@ -1,212 +0,0 @@
-/* Test and benchmark elliptic curve and RSA functions
- First build amcl.a from build_ec batch file
- gcc -O3 benchtest_ec.c amcl.a -o benchtest_ec.exe
-*/
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <time.h>
-
-#include "amcl.h"
-#include "rsa.h"
-
-#define MIN_TIME 10.0
-#define MIN_ITERS 10
-
-int main()
-{
- csprng RNG;
- BIG s,r,x,y;
- ECP P,G;
- FP12 g;
- int i,iterations;
- clock_t start;
- double elapsed;
- char pr[10];
- unsigned long ran;
- rsa_public_key pub;
- rsa_private_key priv;
- char m[RFS],d[RFS],c[RFS];
- octet M= {0,sizeof(m),m};
- octet D= {0,sizeof(d),d};
- octet C= {0,sizeof(c),c};
-
-#if CHOICE==NIST256
- printf("NIST256 Curve\n");
-#endif
-#if CHOICE==C25519
- printf("C25519 Curve\n");
-#endif
-#if CHOICE==BRAINPOOL
- printf("BRAINPOOL Curve\n");
-#endif
-#if CHOICE==ANSSI
- printf("ANSSI Curve\n");
-#endif
-#if CHOICE==MF254
- printf("MF254 Curve\n");
-#endif
-#if CHOICE==MS255
- printf("MS255 Curve\n");
-#endif
-#if CHOICE==MF256
- printf("MF256 Curve\n");
-#endif
-#if CHOICE==MS256
- printf("MS256 Curve\n");
-#endif
-#if CHOICE==HIFIVE
- printf("HIFIVE Curve\n");
-#endif
-#if CHOICE==GOLDILOCKS
- printf("GOLDILOCKS Curve\n");
-#endif
-#if CHOICE==NIST384
- printf("NIST384 Curve\n");
-#endif
-#if CHOICE==C41417
- printf("C41417 Curve\n");
-#endif
-#if CHOICE==NIST521
- printf("NIST521 Curve\n");
-#endif
-
-#if CHOICE==BN254
- printf("BN254 Curve\n");
-#endif
-#if CHOICE==BN454
- printf("BN454 Curve\n");
-#endif
-#if CHOICE==BN646
- printf("BN646 Curve\n");
-#endif
-
-#if CHOICE==BN254_CX
- printf("BN254_CX Curve\n");
-#endif
-#if CHOICE==BN254_T
- printf("BN254_T Curve\n");
-#endif
-#if CHOICE==BN254_T2
- printf("BN254_T2 Curve\n");
-#endif
-#if CHOICE==BLS455
- printf("BLS455 Curve\n");
-#endif
-#if CHOICE==BLS383
- printf("BLS383 Curve\n");
-#endif
-
-#if CURVETYPE==WEIERSTRASS
- printf("Weierstrass parameterization\n");
-#endif
-#if CURVETYPE==EDWARDS
- printf("Edwards parameterization\n");
-#endif
-#if CURVETYPE==MONTGOMERY
- printf("Montgomery parameterization\n");
-#endif
-
-#if CHUNK==16
- printf("16-bit Build\n");
-#endif
-#if CHUNK==32
- printf("32-bit Build\n");
-#endif
-#if CHUNK==64
- printf("64-bit Build\n");
-#endif
-
- time((time_t *)&ran);
- pr[0]=ran;
- pr[1]=ran>>8;
- pr[2]=ran>>16;
- pr[3]=ran>>24;
- for (i=4;i<10;i++) pr[i]=i;
- RAND_seed(&RNG,10,pr);
-
- BIG_rcopy(x,CURVE_Gx);
-#if CURVETYPE!=MONTGOMERY
- BIG_rcopy(y,CURVE_Gy);
- ECP_set(&G,x,y);
-#else
- ECP_set(&G,x);
-#endif
-
- BIG_rcopy(r,CURVE_Order);
- BIG_randomnum(s,r,&RNG);
- ECP_copy(&P,&G);
- ECP_mul(&P,r);
-
- if (!ECP_isinf(&P))
- {
- printf("FAILURE - rG!=O\n");
- return 0;
- }
-
- iterations=0;
- start=clock();
- do {
- ECP_copy(&P,&G);
- ECP_mul(&P,s);
-
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("EC mul - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- printf("Generating %d-bit RSA public/private key pair\n",FFLEN*BIGBITS);
-
- iterations=0;
- start=clock();
- do {
- RSA_KEY_PAIR(&RNG,65537,&priv,&pub,NULL,NULL);
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("RSA gen - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- //FF_randomnum(plain,pub.n,&RNG,FFLEN);
-
- M.len=RFS;
- for (i=0;i<RFS;i++) M.val[i]=i%128;
-
- iterations=0;
- start=clock();
- do {
- RSA_ENCRYPT(&pub,&M,&C);
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("RSA enc - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- iterations=0;
- start=clock();
- do {
- RSA_DECRYPT(&priv,&C,&D);
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("RSA dec - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- for (i=0;i<RFS;i++)
- {
- if (M.val[i]!=D.val[i])
- {
- printf("FAILURE - RSA decryption\n");
- return 0;
- }
- }
-
- printf("All tests pass\n");
-
- return 0;
-}
diff --git a/version22/c/benchtest_pair.c b/version22/c/benchtest_pair.c
deleted file mode 100644
index c9dcf38..0000000
--- a/version22/c/benchtest_pair.c
+++ /dev/null
@@ -1,257 +0,0 @@
-/* Test and benchmark pairing functions
- First build amcl.a from build_pair batch file
- gcc -O3 benchtest_pair.c amcl.a -o benchtest_pair.exe
-*/
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <time.h>
-
-#include "amcl.h" /* Make sure and select a pairing-friendly curve in here! */
-
-#define MIN_TIME 10.0
-#define MIN_ITERS 10
-
-int main()
-{
- csprng RNG;
- BIG q,s,r,x,y,a,b,m;
- ECP P,G;
- FP2 wx,wy,f;
- FP4 c,cp,cpm1,cpm2,cr;
- ECP2 Q,W;
- FP12 g,w;
- unsigned long ran;
-
- int i,iterations;
- clock_t start;
- double elapsed;
- char pr[10];
-
-#if CHOICE==BN254
- printf("BN254 Curve\n");
-#endif
-#if CHOICE==BN454
- printf("BN454 Curve\n");
-#endif
-#if CHOICE==BN646
- printf("BN646 Curve\n");
-#endif
-
-#if CHOICE==BN254_CX
- printf("BN254_CX Curve\n");
-#endif
-#if CHOICE==BN254_T
- printf("BN254_T Curve\n");
-#endif
-#if CHOICE==BN254_T2
- printf("BN254_T2 Curve\n");
-#endif
-#if CHOICE==BLS455
- printf("BLS455 Curve\n");
-#endif
-#if CHOICE==BLS383
- printf("BLS383 Curve\n");
-#endif
-
-#if CHUNK==16
- printf("16-bit Build\n");
-#endif
-#if CHUNK==32
- printf("32-bit Build\n");
-#endif
-#if CHUNK==64
- printf("64-bit Build\n");
-#endif
-
- time((time_t *)&ran);
- pr[0]=ran;
- pr[1]=ran>>8;
- pr[2]=ran>>16;
- pr[3]=ran>>24;
- for (i=4;i<10;i++) pr[i]=i;
-
- RAND_seed(&RNG,10,pr);
-
- BIG_rcopy(x,CURVE_Gx);
-
- BIG_rcopy(y,CURVE_Gy);
- ECP_set(&G,x,y);
-
-
- BIG_rcopy(r,CURVE_Order);
- BIG_randomnum(s,r,&RNG);
- ECP_copy(&P,&G);
- PAIR_G1mul(&P,r);
-
- if (!ECP_isinf(&P))
- {
- printf("FAILURE - rG!=O\n");
- return 0;
- }
-
- iterations=0;
- start=clock();
- do {
- ECP_copy(&P,&G);
- PAIR_G1mul(&P,s);
-
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("G1 mul - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
-
- BIG_rcopy(wx.a,CURVE_Pxa); FP_nres(wx.a);
- BIG_rcopy(wx.b,CURVE_Pxb); FP_nres(wx.b);
- BIG_rcopy(wy.a,CURVE_Pya); FP_nres(wy.a);
- BIG_rcopy(wy.b,CURVE_Pyb); FP_nres(wy.b);
- ECP2_set(&W,&wx,&wy);
-
- ECP2_copy(&Q,&W);
- ECP2_mul(&Q,r);
-
- if (!ECP2_isinf(&Q))
- {
- printf("FAILURE - rQ!=O\n");
- return 0;
- }
-
- iterations=0;
- start=clock();
- do {
- ECP2_copy(&Q,&W);
- PAIR_G2mul(&Q,s);
-
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("G2 mul - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- PAIR_ate(&w,&Q,&P);
- PAIR_fexp(&w);
-
- FP12_copy(&g,&w);
-
- PAIR_GTpow(&g,r);
-
- if (!FP12_isunity(&g))
- {
- printf("FAILURE - g^r!=1\n");
- return 0;
- }
-
- iterations=0;
- start=clock();
- do {
- FP12_copy(&g,&w);
- PAIR_GTpow(&g,s);
-
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("GT pow - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- BIG_rcopy(a,CURVE_Fra);
- BIG_rcopy(b,CURVE_Frb);
- FP2_from_BIGs(&f,a,b);
-
- BIG_rcopy(q,Modulus);
-
- BIG_copy(m,q);
- BIG_mod(m,r);
-
- BIG_copy(a,s);
- BIG_mod(a,m);
-
- BIG_copy(b,s);
- BIG_sdiv(b,m);
-
- FP12_copy(&g,&w);
- FP12_trace(&c,&g);
-
- FP12_frob(&g,&f);
- FP12_trace(&cp,&g);
-
- FP12_conj(&w,&w);
- FP12_mul(&g,&w);
-
- FP12_trace(&cpm1,&g);
- FP12_mul(&g,&w);
- FP12_trace(&cpm2,&g);
-
- iterations=0;
- start=clock();
- do {
- FP4_xtr_pow2(&cr,&cp,&c,&cpm1,&cpm2,a,b);
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("GT pow (compressed) - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- iterations=0;
- start=clock();
- do {
- PAIR_ate(&w,&Q,&P);
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("PAIRing ATE - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- iterations=0;
- start=clock();
- do {
- FP12_copy(&g,&w);
- PAIR_fexp(&g);
- iterations++;
- elapsed=(clock()-start)/(double)CLOCKS_PER_SEC;
- } while (elapsed<MIN_TIME || iterations<MIN_ITERS);
- elapsed=1000.0*elapsed/iterations;
- printf("PAIRing FEXP - %8d iterations ",iterations);
- printf(" %8.2lf ms per iteration\n",elapsed);
-
- ECP_copy(&P,&G);
- ECP2_copy(&Q,&W);
-
- PAIR_G1mul(&P,s);
- PAIR_ate(&g,&Q,&P);
- PAIR_fexp(&g);
-
- ECP_copy(&P,&G);
-
- PAIR_G2mul(&Q,s);
- PAIR_ate(&w,&Q,&P);
- PAIR_fexp(&w);
-
- if (!FP12_equals(&g,&w))
- {
- printf("FAILURE - e(sQ,p)!=e(Q,sP) \n");
- return 0;
- }
-
- ECP2_copy(&Q,&W);
- PAIR_ate(&g,&Q,&P);
- PAIR_fexp(&g);
-
- PAIR_GTpow(&g,s);
-
- if (!FP12_equals(&g,&w))
- {
- printf("FAILURE - e(sQ,p)!=e(Q,P)^s \n");
- return 0;
- }
-
- printf("All tests pass\n");
-
- return 0;
-}
diff --git a/version22/c/big.c b/version22/c/big.c
deleted file mode 100644
index 1fe6259..0000000
--- a/version22/c/big.c
+++ /dev/null
@@ -1,1525 +0,0 @@
-/*
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-*/
-
-/* AMCL basic functions for BIG type */
-/* SU=m, SU is Stack Usage */
-
-#include "amcl.h"
-
-/* Calculates x*y+c+*r */
-
-#ifdef dchunk
-
-/* Method required to calculate x*y+c+r, bottom half in r, top half returned */
-chunk muladd(chunk x,chunk y,chunk c,chunk *r)
-{
- dchunk prod=(dchunk)x*y+c+*r;
- *r=(chunk)prod&BMASK;
- return (chunk)(prod>>BASEBITS);
-}
-
-#else
-
-/* No integer type available that can store double the wordlength */
-/* accumulate partial products */
-
-chunk muladd(chunk x,chunk y,chunk c,chunk *r)
-{
- chunk x0,x1,y0,y1;
- chunk bot,top,mid,carry;
- x0=x&HMASK;
- x1=(x>>HBITS);
- y0=y&HMASK;
- y1=(y>>HBITS);
- bot=x0*y0;
- top=x1*y1;
- mid=x0*y1+x1*y0;
- x0=mid&HMASK1;
- x1=(mid>>HBITS1);
- bot+=x0<<HBITS;
- bot+=*r;
- bot+=c;
-
-#if HDIFF==1
- bot+=(top&HDIFF)<<(BASEBITS-1);
- top>>=HDIFF;
-#endif
-
- top+=x1;
- carry=bot>>BASEBITS;
- bot&=BMASK;
- top+=carry;
-
- *r=bot;
- return top;
-}
-
-#endif
-
-/*
-
-// Alternative non Standard Solution required if no type available that can store double the wordlength
-// The use of compiler intrinsics is permitted
-
-
-#if CHUNK==64
-#ifdef _WIN64
-#include <intrin.h>
-
-static INLINE chunk muladd(chunk x,chunk y,chunk c,chunk *r)
-{
- chunk t,e;
- uchunk b;
- b=_mul128(x,y,&t);
- e=c+*r;
- b+=e;
-// make correction for possible carry to top half
- if (e<0)
- t-=(b>e);
- else
- t+=(b<e);
-
- *r=b&MASK;
- return (chunk)((t<<(CHUNK-BASEBITS)) | (b>>BASEBITS));
-}
-
-#endif
-#endif
-
-*/
-
-/* test a=0? */
-int BIG_iszilch(BIG a)
-{
- int i;
- for (i=0; i<NLEN; i++)
- if (a[i]!=0) return 0;
- return 1;
-}
-
-/* test a=0? */
-int BIG_diszilch(DBIG a)
-{
- int i;
- for (i=0; i<DNLEN; i++)
- if (a[i]!=0) return 0;
- return 1;
-}
-
-/* SU= 56 */
-/* output a */
-void BIG_output(BIG a)
-{
- BIG b;
- int i,len;
- len=BIG_nbits(a);
- if (len%4==0) len/=4;
- else
- {
- len/=4;
- len++;
- }
- if (len<MODBYTES*2) len=MODBYTES*2;
-
- for (i=len-1; i>=0; i--)
- {
- BIG_copy(b,a);
- BIG_shr(b,i*4);
- printf("%01x",(unsigned int) b[0]&15);
- }
-}
-
-/* SU= 16 */
-void BIG_rawoutput(BIG a)
-{
- int i;
- printf("(");
- for (i=0; i<NLEN-1; i++)
-#if CHUNK==64
- printf("%"PRIxMAX",",(uint64_t) a[i]);
- printf("%"PRIxMAX")",(uint64_t) a[NLEN-1]);
-#else
- printf("%x,",(unsigned int) a[i]);
- printf("%x)",(unsigned int) a[NLEN-1]);
-#endif
-}
-/*
-void BIG_rawdoutput(DBIG a)
-{
- int i;
- printf("(");
- for (i=0;i<DNLEN-1;i++)
-#if CHUNK==64
- printf("%llx,",(long long unsigned int) a[i]);
- printf("%llx)",(long long unsigned int) a[DNLEN-1]);
-#else
- printf("%x,",(unsigned int) a[i]);
- printf("%x)",(unsigned int) a[NLEN-1]);
-#endif
-}
-*/
-/* Swap a and b if d=1 */
-void BIG_cswap(BIG a,BIG b,int d)
-{
- int i;
- chunk t,c=d;
- c=~(c-1);
-#ifdef DEBUG_NORM
- for (i=0; i<=NLEN; i++)
-#else
- for (i=0; i<NLEN; i++)
-#endif
- {
- t=c&(a[i]^b[i]);
- a[i]^=t;
- b[i]^=t;
- }
-}
-
-/* Move b to a if d=1 */
-void BIG_cmove(BIG f,BIG g,int d)
-{
- int i;
- chunk b=(chunk)-d;
-#ifdef DEBUG_NORM
- for (i=0; i<=NLEN; i++)
-#else
- for (i=0; i<NLEN; i++)
-#endif
- {
- f[i]^=(f[i]^g[i])&b;
- }
-}
-
-/* Move g to f if d=1 */
-void BIG_dcmove(DBIG f,DBIG g,int d)
-{
- int i;
- chunk b=(chunk)-d;
-#ifdef DEBUG_NORM
- for (i=0; i<=DNLEN; i++)
-#else
- for (i=0; i<DNLEN; i++)
-#endif
- {
- f[i]^=(f[i]^g[i])&b;
- }
-}
-
-/* convert BIG to/from bytes */
-/* SU= 64 */
-void BIG_toBytes(char *b,BIG a)
-{
- int i;
- BIG c;
- BIG_norm(a);
- BIG_copy(c,a);
- for (i=MODBYTES-1; i>=0; i--)
- {
- b[i]=c[0]&0xff;
- BIG_fshr(c,8);
- }
-}
-
-/* SU= 16 */
-void BIG_fromBytes(BIG a,char *b)
-{
- int i;
- BIG_zero(a);
- for (i=0; i<MODBYTES; i++)
- {
- BIG_fshl(a,8);
- a[0]+=(int)(unsigned char)b[i];
- //BIG_inc(a,(int)(unsigned char)b[i]); BIG_norm(a);
- }
-#ifdef DEBUG_NORM
- a[NLEN]=0;
-#endif
-}
-
-void BIG_fromBytesLen(BIG a,char *b,int s)
-{
- int i,len=s;
- BIG_zero(a);
-
- if (s>MODBYTES) s=MODBYTES;
- for (i=0; i<len; i++)
- {
- BIG_fshl(a,8);
- a[0]+=(int)(unsigned char)b[i];
- }
-#ifdef DEBUG_NORM
- a[NLEN]=0;
-#endif
-}
-
-
-
-/* SU= 88 */
-void BIG_doutput(DBIG a)
-{
- DBIG b;
- int i,len;
- BIG_dnorm(a);
- len=BIG_dnbits(a);
- if (len%4==0) len/=4;
- else
- {
- len/=4;
- len++;
- }
-
- for (i=len-1; i>=0; i--)
- {
- BIG_dcopy(b,a);
- BIG_dshr(b,i*4);
- printf("%01x",(unsigned int) b[0]&15);
- }
-}
-
-/* Copy b=a */
-void BIG_copy(BIG b,BIG a)
-{
- int i;
- for (i=0; i<NLEN; i++)
- b[i]=a[i];
-#ifdef DEBUG_NORM
- b[NLEN]=a[NLEN];
-#endif
-}
-
-/* Copy from ROM b=a */
-void BIG_rcopy(BIG b,const BIG a)
-{
- int i;
- for (i=0; i<NLEN; i++)
- b[i]=a[i];
-#ifdef DEBUG_NORM
- b[NLEN]=0;
-#endif
-}
-
-/* double length DBIG copy b=a */
-void BIG_dcopy(DBIG b,DBIG a)
-{
- int i;
- for (i=0; i<DNLEN; i++)
- b[i]=a[i];
-#ifdef DEBUG_NORM
- b[DNLEN]=a[DNLEN];
-#endif
-}
-
-/* Copy BIG to bottom half of DBIG */
-void BIG_dscopy(DBIG b,BIG a)
-{
- int i;
- for (i=0; i<NLEN-1; i++)
- b[i]=a[i];
-
- b[NLEN-1]=a[NLEN-1]&BMASK; /* top word normalized */
- b[NLEN]=a[NLEN-1]>>BASEBITS;
-
- for (i=NLEN+1; i<DNLEN; i++) b[i]=0;
-#ifdef DEBUG_NORM
- b[DNLEN]=a[NLEN];
-#endif
-}
-
-/* Copy BIG to top half of DBIG */
-void BIG_dsucopy(DBIG b,BIG a)
-{
- int i;
- for (i=0; i<NLEN; i++)
- b[i]=0;
- for (i=NLEN; i<DNLEN; i++)
- b[i]=a[i-NLEN];
-#ifdef DEBUG_NORM
- b[DNLEN]=a[NLEN];
-#endif
-}
-
-/* Copy bottom half of DBIG to BIG */
-void BIG_sdcopy(BIG b,DBIG a)
-{
- int i;
- for (i=0; i<NLEN; i++)
- b[i]=a[i];
-#ifdef DEBUG_NORM
- b[NLEN]=a[DNLEN];
-#endif
-}
-
-/* Copy top half of DBIG to BIG */
-void BIG_sducopy(BIG b,DBIG a)
-{
- int i;
- for (i=0; i<NLEN; i++)
- b[i]=a[i+NLEN];
-#ifdef DEBUG_NORM
- b[NLEN]=a[DNLEN];
-#endif
-}
-
-/* Set a=0 */
-void BIG_zero(BIG a)
-{
- int i;
- for (i=0; i<NLEN; i++)
- a[i]=0;
-#ifdef DEBUG_NORM
- a[NLEN]=0;
-#endif
-}
-
-void BIG_dzero(DBIG a)
-{
- int i;
- for (i=0; i<DNLEN; i++)
- a[i]=0;
-#ifdef DEBUG_NORM
- a[DNLEN]=0;
-#endif
-}
-
-/* set a=1 */
-void BIG_one(BIG a)
-{
- int i;
- a[0]=1;
- for (i=1; i<NLEN; i++)
- a[i]=0;
-#ifdef DEBUG_NORM
- a[NLEN]=0;
-#endif
-}
-
-
-
-/* Set c=a+b */
-/* SU= 8 */
-void BIG_add(BIG c,BIG a,BIG b)
-{
- int i;
- for (i=0; i<NLEN; i++)
- c[i]=a[i]+b[i];
-#ifdef DEBUG_NORM
- c[NLEN]=a[NLEN]+b[NLEN]+1;
- if (c[NLEN]>=NEXCESS) printf("add problem - digit overflow %d\n",c[NLEN]);
-#endif
-}
-
-/* Set c=c+d */
-void BIG_inc(BIG c,int d)
-{
- BIG_norm(c);
- c[0]+=(chunk)d;
-#ifdef DEBUG_NORM
- c[NLEN]=1;
-#endif
-}
-
-/* Set c=a-b */
-/* SU= 8 */
-void BIG_sub(BIG c,BIG a,BIG b)
-{
- int i;
- for (i=0; i<NLEN; i++)
- c[i]=a[i]-b[i];
-#ifdef DEBUG_NORM
- c[NLEN]=a[NLEN]+b[NLEN]+1;
- if (c[NLEN]>=NEXCESS) printf("sub problem - digit overflow %d\n",c[NLEN]);
-#endif
-}
-
-/* SU= 8 */
-
-void BIG_dsub(DBIG c,DBIG a,DBIG b)
-{
- int i;
- for (i=0; i<DNLEN; i++)
- c[i]=a[i]-b[i];
-#ifdef DEBUG_NORM
- c[DNLEN]=a[DNLEN]+b[DNLEN]+1;
- if (c[DNLEN]>=NEXCESS) printf("sub problem - digit overflow %d\n",c[DNLEN]);
-#endif
-}
-
-
-/* Set c=c-1 */
-void BIG_dec(BIG c,int d)
-{
- BIG_norm(c);
- c[0]-=(chunk)d;
-#ifdef DEBUG_NORM
- c[NLEN]=1;
-#endif
-}
-
-/* multiplication r=a*c by c<=NEXCESS */
-void BIG_imul(BIG r,BIG a,int c)
-{
- int i;
- for (i=0; i<NLEN; i++) r[i]=a[i]*c;
-#ifdef DEBUG_NORM
- r[NLEN]=(a[NLEN]+1)*c-1;
- if (r[NLEN]>=NEXCESS) printf("int mul problem - digit overflow %d\n",r[NLEN]);
-#endif
-}
-
-/* multiplication r=a*c by larger integer - c<=FEXCESS */
-/* SU= 24 */
-chunk BIG_pmul(BIG r,BIG a,int c)
-{
- int i;
- chunk ak,carry=0;
- BIG_norm(a);
- for (i=0; i<NLEN; i++)
- {
- ak=a[i];
- r[i]=0;
- carry=muladd(ak,(chunk)c,carry,&r[i]);
- }
-#ifdef DEBUG_NORM
- r[NLEN]=0;
-#endif
- return carry;
-}
-
-/* r/=3 */
-/* SU= 16 */
-int BIG_div3(BIG r)
-{
- int i;
- chunk ak,base,carry=0;
- BIG_norm(r);
- base=((chunk)1<<BASEBITS);
- for (i=NLEN-1; i>=0; i--)
- {
- ak=(carry*base+r[i]);
- r[i]=ak/3;
- carry=ak%3;
- }
- return (int)carry;
-}
-
-/* multiplication c=a*b by even larger integer b>FEXCESS, resulting in DBIG */
-/* SU= 24 */
-void BIG_pxmul(DBIG c,BIG a,int b)
-{
- int j;
- chunk carry;
- BIG_dzero(c);
- carry=0;
- for (j=0; j<NLEN; j++)
- carry=muladd(a[j],(chunk)b,carry,&c[j]);
- c[NLEN]=carry;
-#ifdef DEBUG_NORM
- c[DNLEN]=0;
-#endif
-}
-
-/* .. if you know the result will fit in a BIG, c must be distinct from a and b */
-/* SU= 40 */
-void BIG_smul(BIG c,BIG a,BIG b)
-{
- int i,j;
- chunk carry;
- BIG_norm(a);
- BIG_norm(b);
-
- BIG_zero(c);
- for (i=0; i<NLEN; i++)
- {
- carry=0;
- for (j=0; j<NLEN; j++)
- {
- if (i+j<NLEN)
- carry=muladd(a[i],b[j],carry,&c[i+j]);
- }
- }
-#ifdef DEBUG_NORM
- c[NLEN]=0;
-#endif
-}
-
-/* Set c=a*b */
-/* SU= 72 */
-void BIG_mul(DBIG c,BIG a,BIG b)
-{
- int i;
-#ifdef dchunk
- dchunk t,co;
- dchunk s;
- dchunk d[NLEN];
- int k;
-#endif
-
- /* change here - a and b MUST be normed on input */
-
-// BIG_norm(a); /* needed here to prevent overflow from addition of partial products */
-// BIG_norm(b);
-
- /* Faster to Combafy it.. Let the compiler unroll the loops! */
-
-#ifdef COMBA
-
- /* faster psuedo-Karatsuba method */
-#ifdef UNWOUND
-
- /* Insert output of faster.c here */
-
-#else
- for (i=0; i<NLEN; i++)
- d[i]=(dchunk)a[i]*b[i];
-
- s=d[0];
- t=s;
- c[0]=(chunk)t&BMASK;
- co=t>>BASEBITS;
-
- for (k=1; k<NLEN; k++)
- {
- s+=d[k];
- t=co+s;
- for (i=k; i>=1+k/2; i--) t+=(dchunk)(a[i]-a[k-i])*(b[k-i]-b[i]);
- c[k]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- }
- for (k=NLEN; k<2*NLEN-1; k++)
- {
- s-=d[k-NLEN];
- t=co+s;
- for (i=NLEN-1; i>=1+k/2; i--) t+=(dchunk)(a[i]-a[k-i])*(b[k-i]-b[i]);
- c[k]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- }
- c[2*NLEN-1]=(chunk)co;
-
-#endif
-
-#else
- int j;
- chunk carry;
- BIG_dzero(c);
- for (i=0; i<NLEN; i++)
- {
- carry=0;
- for (j=0; j<NLEN; j++)
- carry=muladd(a[i],b[j],carry,&c[i+j]);
-
- c[NLEN+i]=carry;
- }
-
-#endif
-
-#ifdef DEBUG_NORM
- c[DNLEN]=0;
-#endif
-}
-
-/* Set c=a*a */
-/* SU= 80 */
-void BIG_sqr(DBIG c,BIG a)
-{
- int i,j,last;
-#ifdef dchunk
- dchunk t,co;
-#endif
-
- /* change here - a MUST be normed on input */
-// BIG_norm(a);
-
- /* Note 2*a[i] in loop below and extra addition */
-
-#ifdef COMBA
-
-#ifdef UNWOUND
-
- /* Insert output of faster.c here */
-
-#else
-
- t=(dchunk)a[0]*a[0];
- c[0]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- t=(dchunk)a[1]*a[0];
- t+=t;
- t+=co;
- c[1]=(chunk)t&BMASK;
- co=t>>BASEBITS;
-
- last=NLEN-NLEN%2;
- for (j=2; j<last; j+=2)
- {
- t=(dchunk)a[j]*a[0];
- for (i=1; i<(j+1)/2; i++) t+=(dchunk)a[j-i]*a[i];
- t+=t;
- t+=co;
- t+=(dchunk)a[j/2]*a[j/2];
- c[j]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- t=(dchunk)a[j+1]*a[0];
- for (i=1; i<(j+2)/2; i++) t+=(dchunk)a[j+1-i]*a[i];
- t+=t;
- t+=co;
- c[j+1]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- }
- j=last;
-#if NLEN%2==1
- t=(dchunk)a[j]*a[0];
- for (i=1; i<(j+1)/2; i++) t+=(dchunk)a[j-i]*a[i];
- t+=t;
- t+=co;
- t+=(dchunk)a[j/2]*a[j/2];
- c[j]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- j++;
- t=(dchunk)a[NLEN-1]*a[j-NLEN+1];
- for (i=j-NLEN+2; i<(j+1)/2; i++) t+=(dchunk)a[j-i]*a[i];
- t+=t;
- t+=co;
- c[j]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- j++;
-#endif
- for (; j<DNLEN-2; j+=2)
- {
- t=(dchunk)a[NLEN-1]*a[j-NLEN+1];
- for (i=j-NLEN+2; i<(j+1)/2; i++) t+=(dchunk)a[j-i]*a[i];
- t+=t;
- t+=co;
- t+=(dchunk)a[j/2]*a[j/2];
- c[j]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- t=(dchunk)a[NLEN-1]*a[j-NLEN+2];
- for (i=j-NLEN+3; i<(j+2)/2; i++) t+=(dchunk)a[j+1-i]*a[i];
- t+=t;
- t+=co;
- c[j+1]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- }
-
- t=(dchunk)a[NLEN-1]*a[NLEN-1]+co;
- c[DNLEN-2]=(chunk)t&BMASK;
- co=t>>BASEBITS;
- c[DNLEN-1]=(chunk)co;
-#endif
-
-#else
- chunk carry;
- BIG_dzero(c);
- for (i=0; i<NLEN; i++)
- {
- carry=0;
- for (j=i+1; j<NLEN; j++)
- carry=muladd(a[i],a[j],carry,&c[i+j]);
- c[NLEN+i]=carry;
- }
-
- for (i=0; i<DNLEN; i++) c[i]*=2;
-
- for (i=0; i<NLEN; i++)
- c[2*i+1]+=muladd(a[i],a[i],0,&c[2*i]);
-
- BIG_dnorm(c);
-#endif
-
-
-#ifdef DEBUG_NORM
- c[DNLEN]=0;
-#endif
-
-}
-
-/* Montgomery reduction */
-void BIG_monty(BIG a,BIG md,chunk MC,DBIG d)
-{
- int i,k;
-
-#ifdef dchunk
- dchunk t,c,s;
- dchunk dd[NLEN];
- chunk v[NLEN];
-#endif
-
-#ifdef COMBA
-
-#ifdef UNWOUND
-
- /* Insert output of faster.c here */
-
-#else
-
- t=d[0];
- v[0]=((chunk)t*MC)&BMASK;
- t+=(dchunk)v[0]*md[0];
- c=(t>>BASEBITS)+d[1];
- s=0;
-
- for (k=1; k<NLEN; k++)
- {
- t=c+s+(dchunk)v[0]*md[k];
- for (i=k-1; i>k/2; i--) t+=(dchunk)(v[k-i]-v[i])*(md[i]-md[k-i]);
- v[k]=((chunk)t*MC)&BMASK;
- t+=(dchunk)v[k]*md[0];
- c=(t>>BASEBITS)+d[k+1];
- dd[k]=(dchunk)v[k]*md[k];
- s+=dd[k];
- }
- for (k=NLEN; k<2*NLEN-1; k++)
- {
- t=c+s;
- for (i=NLEN-1; i>=1+k/2; i--) t+=(dchunk)(v[k-i]-v[i])*(md[i]-md[k-i]);
- a[k-NLEN]=(chunk)t&BMASK;
- c=(t>>BASEBITS)+d[k+1];
- s-=dd[k-NLEN+1];
- }
- a[NLEN-1]=(chunk)c&BMASK;
-
-#endif
-
-#ifdef DEBUG_NORM
- a[NLEN]=0;
-#endif
-
-#else
- int j;
- chunk m,carry;
- for (i=0; i<NLEN; i++)
- {
- if (MC==-1) m=(-d[i])&BMASK;
- else
- {
- if (MC==1) m=d[i];
- else m=(MC*d[i])&BMASK;
- }
- carry=0;
- for (j=0; j<NLEN; j++)
- carry=muladd(m,md[j],carry,&d[i+j]);
- d[NLEN+i]+=carry;
- }
- BIG_sducopy(a,d);
- BIG_norm(a);
-
-#endif
-}
-
-/* General shift left of a by n bits */
-/* a MUST be normalised */
-/* SU= 32 */
-void BIG_shl(BIG a,int k)
-{
- int i;
- int n=k%BASEBITS;
- int m=k/BASEBITS;
-
-// a[NLEN-1]=((a[NLEN-1-m]<<n))|(a[NLEN-m-2]>>(BASEBITS-n));
-
- a[NLEN-1]=((a[NLEN-1-m]<<n));
- if (NLEN>=m+2) a[NLEN-1]|=(a[NLEN-m-2]>>(BASEBITS-n));
-
- for (i=NLEN-2; i>m; i--)
- a[i]=((a[i-m]<<n)&BMASK)|(a[i-m-1]>>(BASEBITS-n));
- a[m]=(a[0]<<n)&BMASK;
- for (i=0; i<m; i++) a[i]=0;
-
-}
-
-/* Fast shift left of a by n bits, where n less than a word, Return excess (but store it as well) */
-/* a MUST be normalised */
-/* SU= 16 */
-int BIG_fshl(BIG a,int n)
-{
- int i;
-
- a[NLEN-1]=((a[NLEN-1]<<n))|(a[NLEN-2]>>(BASEBITS-n)); /* top word not masked */
- for (i=NLEN-2; i>0; i--)
- a[i]=((a[i]<<n)&BMASK)|(a[i-1]>>(BASEBITS-n));
- a[0]=(a[0]<<n)&BMASK;
-
- return (int)(a[NLEN-1]>>((8*MODBYTES)%BASEBITS)); /* return excess - only used in ff.c */
-}
-
-/* double length left shift of a by k bits - k can be > BASEBITS , a MUST be normalised */
-/* SU= 32 */
-void BIG_dshl(DBIG a,int k)
-{
- int i;
- int n=k%BASEBITS;
- int m=k/BASEBITS;
-
- a[DNLEN-1]=((a[DNLEN-1-m]<<n))|(a[DNLEN-m-2]>>(BASEBITS-n));
-
- for (i=DNLEN-2; i>m; i--)
- a[i]=((a[i-m]<<n)&BMASK)|(a[i-m-1]>>(BASEBITS-n));
- a[m]=(a[0]<<n)&BMASK;
- for (i=0; i<m; i++) a[i]=0;
-
-}
-
-/* General shift rightof a by k bits */
-/* a MUST be normalised */
-/* SU= 32 */
-void BIG_shr(BIG a,int k)
-{
- int i;
- int n=k%BASEBITS;
- int m=k/BASEBITS;
- for (i=0; i<NLEN-m-1; i++)
- a[i]=(a[m+i]>>n)|((a[m+i+1]<<(BASEBITS-n))&BMASK);
- if (NLEN>m) a[NLEN-m-1]=a[NLEN-1]>>n;
- for (i=NLEN-m; i<NLEN; i++) a[i]=0;
-
-}
-
-/* Faster shift right of a by k bits. Return shifted out part */
-/* a MUST be normalised */
-/* SU= 16 */
-int BIG_fshr(BIG a,int k)
-{
- int i;
- chunk r=a[0]&(((chunk)1<<k)-1); /* shifted out part */
- for (i=0; i<NLEN-1; i++)
- a[i]=(a[i]>>k)|((a[i+1]<<(BASEBITS-k))&BMASK);
- a[NLEN-1]=a[NLEN-1]>>k;
- return (int)r;
-}
-
-/* double length right shift of a by k bits - can be > BASEBITS */
-/* SU= 32 */
-void BIG_dshr(DBIG a,int k)
-{
- int i;
- int n=k%BASEBITS;
- int m=k/BASEBITS;
- for (i=0; i<DNLEN-m-1; i++)
- a[i]=(a[m+i]>>n)|((a[m+i+1]<<(BASEBITS-n))&BMASK);
- a[DNLEN-m-1]=a[DNLEN-1]>>n;
- for (i=DNLEN-m; i<DNLEN; i++ ) a[i]=0;
-}
-
-/* Split DBIG d into two BIGs t|b. Split happens at n bits, where n falls into NLEN word */
-/* d MUST be normalised */
-/* SU= 24 */
-chunk BIG_split(BIG t,BIG b,DBIG d,int n)
-{
- int i;
- chunk nw,carry=0;
- int m=n%BASEBITS;
-// BIG_dnorm(d);
-
- if (m==0)
- {
- for (i=0; i<NLEN; i++) b[i]=d[i];
- if (t!=b)
- {
- for (i=NLEN; i<2*NLEN; i++) t[i-NLEN]=d[i];
- carry=t[NLEN-1]>>BASEBITS;
- t[NLEN-1]=t[NLEN-1]&BMASK; /* top word normalized */
- }
- return carry;
- }
-
- for (i=0; i<NLEN-1; i++) b[i]=d[i];
-
- b[NLEN-1]=d[NLEN-1]&(((chunk)1<<m)-1);
-
- if (t!=b)
- {
- carry=(d[DNLEN-1]<<(BASEBITS-m));
- for (i=DNLEN-2; i>=NLEN-1; i--)
- {
- nw=(d[i]>>m)|carry;
- carry=(d[i]<<(BASEBITS-m))&BMASK;
- t[i-NLEN+1]=nw;
- }
- }
-#ifdef DEBUG_NORM
- t[NLEN]=0;
- b[NLEN]=0;
-#endif
- return carry;
-}
-
-/* you gotta keep the sign of carry! Look - no branching! */
-/* Note that sign bit is needed to disambiguate between +ve and -ve values */
-/* normalise BIG - force all digits < 2^BASEBITS */
-chunk BIG_norm(BIG a)
-{
- int i;
- chunk d,carry=0;
- for (i=0; i<NLEN-1; i++)
- {
- d=a[i]+carry;
- a[i]=d&BMASK;
- carry=d>>BASEBITS;
- }
- a[NLEN-1]=(a[NLEN-1]+carry);
-
-#ifdef DEBUG_NORM
- a[NLEN]=0;
-#endif
- return (a[NLEN-1]>>((8*MODBYTES)%BASEBITS)); /* only used in ff.c */
-}
-
-void BIG_dnorm(DBIG a)
-{
- int i;
- chunk d,carry=0;
- for (i=0; i<DNLEN-1; i++)
- {
- d=a[i]+carry;
- a[i]=d&BMASK;
- carry=d>>BASEBITS;
- }
- a[DNLEN-1]=(a[DNLEN-1]+carry);
-#ifdef DEBUG_NORM
- a[DNLEN]=0;
-#endif
-}
-
-/* Compare a and b. Return 1 for a>b, -1 for a<b, 0 for a==b */
-/* a and b MUST be normalised before call */
-int BIG_comp(BIG a,BIG b)
-{
- int i;
- for (i=NLEN-1; i>=0; i--)
- {
- if (a[i]==b[i]) continue;
- if (a[i]>b[i]) return 1;
- else return -1;
- }
- return 0;
-}
-
-int BIG_dcomp(DBIG a,DBIG b)
-{
- int i;
- for (i=DNLEN-1; i>=0; i--)
- {
- if (a[i]==b[i]) continue;
- if (a[i]>b[i]) return 1;
- else return -1;
- }
- return 0;
-}
-
-/* return number of bits in a */
-/* SU= 8 */
-int BIG_nbits(BIG a)
-{
- int bts,k=NLEN-1;
- chunk c;
- BIG_norm(a);
- while (k>=0 && a[k]==0) k--;
- if (k<0) return 0;
- bts=BASEBITS*k;
- c=a[k];
- while (c!=0)
- {
- c/=2;
- bts++;
- }
- return bts;
-}
-
-/* SU= 8, Calculate number of bits in a DBIG - output normalised */
-int BIG_dnbits(DBIG a)
-{
- int bts,k=DNLEN-1;
- chunk c;
- BIG_dnorm(a);
- while (k>=0 && a[k]==0) k--;
- if (k<0) return 0;
- bts=BASEBITS*k;
- c=a[k];
- while (c!=0)
- {
- c/=2;
- bts++;
- }
- return bts;
-}
-
-
-/* Set b=b mod c */
-/* SU= 16 */
-void BIG_mod(BIG b,BIG c)
-{
- int k=0;
- BIG r; /**/
-
- BIG_norm(b);
- if (BIG_comp(b,c)<0)
- return;
- do
- {
- BIG_fshl(c,1);
- k++;
- }
- while (BIG_comp(b,c)>=0);
-
- while (k>0)
- {
- BIG_fshr(c,1);
-
-// constant time...
- BIG_sub(r,b,c);
- BIG_norm(r);
- BIG_cmove(b,r,1-((r[NLEN-1]>>(CHUNK-1))&1));
- /*
- if (BIG_comp(b,c)>=0)
- {
- BIG_sub(b,b,c);
- BIG_norm(b);
- }
- */
- k--;
- }
-}
-
-/* Set a=b mod c, b is destroyed. Slow but rarely used. */
-/* SU= 96 */
-void BIG_dmod(BIG a,DBIG b,BIG c)
-{
- int k=0;
- DBIG m,r;
- BIG_dnorm(b);
- BIG_dscopy(m,c);
-
- if (BIG_dcomp(b,m)<0)
- {
- BIG_sdcopy(a,b);
- return;
- }
-
- do
- {
- BIG_dshl(m,1);
- k++;
- }
- while (BIG_dcomp(b,m)>=0);
-
- while (k>0)
- {
- BIG_dshr(m,1);
-// constant time...
- BIG_dsub(r,b,m);
- BIG_dnorm(r);
- BIG_dcmove(b,r,1-((r[DNLEN-1]>>(CHUNK-1))&1));
- /*
- if (BIG_dcomp(b,m)>=0)
- {
- BIG_dsub(b,b,m);
- BIG_dnorm(b);
- }
- */
- k--;
- }
- BIG_sdcopy(a,b);
-}
-
-/* Set a=b/c, b is destroyed. Slow but rarely used. */
-/* SU= 136 */
-
-void BIG_ddiv(BIG a,DBIG b,BIG c)
-{
- int d,k=0;
- DBIG m,dr;
- BIG e,r;
- BIG_dnorm(b);
- BIG_dscopy(m,c);
-
- BIG_zero(a);
- BIG_zero(e);
- BIG_inc(e,1);
-
- while (BIG_dcomp(b,m)>=0)
- {
- BIG_fshl(e,1);
- BIG_dshl(m,1);
- k++;
- }
-
- while (k>0)
- {
- BIG_dshr(m,1);
- BIG_fshr(e,1);
-
- BIG_dsub(dr,b,m);
- BIG_dnorm(dr);
- d=1-((dr[DNLEN-1]>>(CHUNK-1))&1);
- BIG_dcmove(b,dr,d);
-
- BIG_add(r,a,e);
- BIG_norm(r);
- BIG_cmove(a,r,d);
- /*
- if (BIG_dcomp(b,m)>=0)
- {
- BIG_add(a,a,e);
- BIG_norm(a);
- BIG_dsub(b,b,m);
- BIG_dnorm(b);
- } */
- k--;
- }
-}
-
-/* SU= 136 */
-
-void BIG_sdiv(BIG a,BIG c)
-{
- int d,k=0;
- BIG m,e,b,r;
- BIG_norm(a);
- BIG_copy(b,a);
- BIG_copy(m,c);
-
- BIG_zero(a);
- BIG_zero(e);
- BIG_inc(e,1);
-
- while (BIG_comp(b,m)>=0)
- {
- BIG_fshl(e,1);
- BIG_fshl(m,1);
- k++;
- }
-
- while (k>0)
- {
- BIG_fshr(m,1);
- BIG_fshr(e,1);
-
- BIG_sub(r,b,m);
- BIG_norm(r);
- d=1-((r[NLEN-1]>>(CHUNK-1))&1);
- BIG_cmove(b,r,d);
-
- BIG_add(r,a,e);
- BIG_norm(r);
- BIG_cmove(a,r,d);
- /*
- if (BIG_comp(b,m)>=0)
- {
- BIG_sub(b,b,m);
- BIG_norm(b);
- BIG_add(a,a,e);
- BIG_norm(a);
- } */
- k--;
- }
-}
-
-/* return LSB of a */
-int BIG_parity(BIG a)
-{
- return a[0]%2;
-}
-
-/* return n-th bit of a */
-/* SU= 16 */
-int BIG_bit(BIG a,int n)
-{
- if (a[n/BASEBITS]&((chunk)1<<(n%BASEBITS))) return 1;
- else return 0;
-}
-
-/* return NAF value as +/- 1, 3 or 5. x and x3 should be normed.
-nbs is number of bits processed, and nzs is number of trailing 0s detected */
-/* SU= 32 */
-/*
-int BIG_nafbits(BIG x,BIG x3,int i,int *nbs,int *nzs)
-{
- int j,r,nb;
-
- nb=BIG_bit(x3,i)-BIG_bit(x,i);
- *nbs=1;
- *nzs=0;
- if (nb==0) return 0;
- if (i==0) return nb;
-
- if (nb>0) r=1;
- else r=(-1);
-
- for (j=i-1;j>0;j--)
- {
- (*nbs)++;
- r*=2;
- nb=BIG_bit(x3,j)-BIG_bit(x,j);
- if (nb>0) r+=1;
- if (nb<0) r-=1;
- if (abs(r)>5) break;
- }
-
- if (r%2!=0 && j!=0)
- { // backtrack
- if (nb>0) r=(r-1)/2;
- if (nb<0) r=(r+1)/2;
- (*nbs)--;
- }
-
- while (r%2==0)
- { // remove trailing zeros
- r/=2;
- (*nzs)++;
- (*nbs)--;
- }
- return r;
-}
-*/
-
-/* return last n bits of a, where n is small < BASEBITS */
-/* SU= 16 */
-int BIG_lastbits(BIG a,int n)
-{
- int msk=(1<<n)-1;
- BIG_norm(a);
- return ((int)a[0])&msk;
-}
-
-/* get 8*MODBYTES size random number */
-void BIG_random(BIG m,csprng *rng)
-{
- int i,b,j=0,r=0;
- int len=8*MODBYTES;
-
- BIG_zero(m);
- /* generate random BIG */
- for (i=0; i<len; i++)
- {
- if (j==0) r=RAND_byte(rng);
- else r>>=1;
- b=r&1;
- BIG_shl(m,1);
- m[0]+=b;
- j++;
- j&=7;
- }
-
-#ifdef DEBUG_NORM
- m[NLEN]=0;
-#endif
-}
-
-/* get random BIG from rng, modulo q. Done one bit at a time, so its portable */
-
-void BIG_randomnum(BIG m,BIG q,csprng *rng)
-{
- int i,b,j=0,r=0;
- DBIG d;
- BIG_dzero(d);
- /* generate random DBIG */
- for (i=0; i<2*MODBITS; i++)
- {
- if (j==0) r=RAND_byte(rng);
- else r>>=1;
- b=r&1;
- BIG_dshl(d,1);
- d[0]+=b;
- j++;
- j&=7;
- }
- /* reduce modulo a BIG. Removes bias */
- BIG_dmod(m,d,q);
-#ifdef DEBUG_NORM
- m[NLEN]=0;
-#endif
-}
-
-/* Set r=a*b mod m */
-/* SU= 96 */
-void BIG_modmul(BIG r,BIG a,BIG b,BIG m)
-{
- DBIG d;
- BIG_mod(a,m);
- BIG_mod(b,m);
-//BIG_norm(a); BIG_norm(b);
- BIG_mul(d,a,b);
- BIG_dmod(r,d,m);
-}
-
-/* Set a=a*a mod m */
-/* SU= 88 */
-void BIG_modsqr(BIG r,BIG a,BIG m)
-{
- DBIG d;
- BIG_mod(a,m);
-//BIG_norm(a);
- BIG_sqr(d,a);
- BIG_dmod(r,d,m);
-}
-
-/* Set r=-a mod m */
-/* SU= 16 */
-void BIG_modneg(BIG r,BIG a,BIG m)
-{
- BIG_mod(a,m);
- BIG_sub(r,m,a);
- BIG_mod(r,m);
-}
-
-/* Set a=a/b mod m */
-/* SU= 136 */
-void BIG_moddiv(BIG r,BIG a,BIG b,BIG m)
-{
- DBIG d;
- BIG z;
- BIG_mod(a,m);
- BIG_invmodp(z,b,m);
-//BIG_norm(a); BIG_norm(z);
- BIG_mul(d,a,z);
- BIG_dmod(r,d,m);
-}
-
-/* Get jacobi Symbol (a/p). Returns 0, 1 or -1 */
-/* SU= 216 */
-int BIG_jacobi(BIG a,BIG p)
-{
- int n8,k,m=0;
- BIG t,x,n,zilch,one;
- BIG_one(one);
- BIG_zero(zilch);
- if (BIG_parity(p)==0 || BIG_comp(a,zilch)==0 || BIG_comp(p,one)<=0) return 0;
- BIG_norm(a);
- BIG_copy(x,a);
- BIG_copy(n,p);
- BIG_mod(x,p);
-
- while (BIG_comp(n,one)>0)
- {
- if (BIG_comp(x,zilch)==0) return 0;
- n8=BIG_lastbits(n,3);
- k=0;
- while (BIG_parity(x)==0)
- {
- k++;
- BIG_shr(x,1);
- }
- if (k%2==1) m+=(n8*n8-1)/8;
- m+=(n8-1)*(BIG_lastbits(x,2)-1)/4;
- BIG_copy(t,n);
-
- BIG_mod(t,x);
- BIG_copy(n,x);
- BIG_copy(x,t);
- m%=2;
-
- }
- if (m==0) return 1;
- else return -1;
-}
-
-/* Set r=1/a mod p. Binary method */
-/* SU= 240 */
-void BIG_invmodp(BIG r,BIG a,BIG p)
-{
- BIG u,v,x1,x2,t,one;
- BIG_mod(a,p);
- BIG_copy(u,a);
- BIG_copy(v,p);
- BIG_one(one);
- BIG_copy(x1,one);
- BIG_zero(x2);
-
- while (BIG_comp(u,one)!=0 && BIG_comp(v,one)!=0)
- {
- while (BIG_parity(u)==0)
- {
- BIG_shr(u,1);
- if (BIG_parity(x1)!=0)
- {
- BIG_add(x1,p,x1);
- BIG_norm(x1);
- }
- BIG_shr(x1,1);
- }
- while (BIG_parity(v)==0)
- {
- BIG_shr(v,1);
- if (BIG_parity(x2)!=0)
- {
- BIG_add(x2,p,x2);
- BIG_norm(x2);
- }
- BIG_shr(x2,1);
- }
- if (BIG_comp(u,v)>=0)
- {
- BIG_sub(u,u,v);
- BIG_norm(u);
- if (BIG_comp(x1,x2)>=0) BIG_sub(x1,x1,x2);
- else
- {
- BIG_sub(t,p,x2);
- BIG_add(x1,x1,t);
- }
- BIG_norm(x1);
- }
- else
- {
- BIG_sub(v,v,u);
- BIG_norm(v);
- if (BIG_comp(x2,x1)>=0) BIG_sub(x2,x2,x1);
- else
- {
- BIG_sub(t,p,x1);
- BIG_add(x2,x2,t);
- }
- BIG_norm(x2);
- }
- }
- if (BIG_comp(u,one)==0)
- BIG_copy(r,x1);
- else
- BIG_copy(r,x2);
-}
-
-/* set x = x mod 2^m */
-void BIG_mod2m(BIG x,int m)
-{
- int i,wd,bt;
- chunk msk;
-// if (m>=MODBITS) return;
- wd=m/BASEBITS;
- bt=m%BASEBITS;
- msk=((chunk)1<<bt)-1;
- x[wd]&=msk;
- for (i=wd+1; i<NLEN; i++) x[i]=0;
-}
-
-// new
-/* Convert to DBIG number from byte array of given length */
-void BIG_dfromBytesLen(DBIG a,char *b,int s)
-{
- int i,len=s;
- BIG_dzero(a);
-
- for (i=0; i<len; i++)
- {
- BIG_dshl(a,8);
- a[0]+=(int)(unsigned char)b[i];
- }
-#ifdef DEBUG_NORM
- a[NLEN]=0;
-#endif
-}
diff --git a/version22/c/build_ec b/version22/c/build_ec
deleted file mode 100644
index b5dc735..0000000
--- a/version22/c/build_ec
+++ /dev/null
@@ -1,22 +0,0 @@
-
-gcc -std=c99 -c -O3 big.c
-gcc -std=c99 -c -O3 fp.c
-gcc -std=c99 -c -O3 ecp.c
-gcc -std=c99 -c -O3 hash.c
-gcc -std=c99 -c -O3 rand.c
-gcc -std=c99 -c -O3 aes.c
-gcc -std=c99 -c -O3 gcm.c
-gcc -std=c99 -c -O3 oct.c
-gcc -std=c99 -c -O3 rom.c
-
-gcc -std=c99 -c -O3 ff.c
-
-rm amcl.a
-ar rc amcl.a big.o fp.o ecp.o hash.o ff.o
-ar r amcl.a rand.o aes.o gcm.o oct.o rom.o
-
-gcc -std=c99 -O3 testecdh.c ecdh.c randapi.c amcl.a -o testecdh
-gcc -std=c99 -O3 testrsa.c rsa.c randapi.c amcl.a -o testrsa
-gcc -std=c99 -O3 benchtest_ec.c rsa.c amcl.a -o benchtest_ec
-
-rm *.o
diff --git a/version22/c/build_ec.bat b/version22/c/build_ec.bat
deleted file mode 100644
index a49fc25..0000000
--- a/version22/c/build_ec.bat
+++ /dev/null
@@ -1,22 +0,0 @@
-
-gcc -std=c99 -c -O3 big.c
-gcc -std=c99 -c -O3 fp.c
-gcc -std=c99 -c -O3 ecp.c
-gcc -std=c99 -c -O3 hash.c
-gcc -std=c99 -c -O3 rand.c
-gcc -std=c99 -c -O3 aes.c
-gcc -std=c99 -c -O3 gcm.c
-gcc -std=c99 -c -O3 oct.c
-gcc -std=c99 -c -O3 rom.c
-
-gcc -std=c99 -c -O3 ff.c
-
-del amcl.a
-ar rc amcl.a big.o fp.o ecp.o hash.o ff.o
-ar r amcl.a rand.o aes.o gcm.o oct.o rom.o
-
-gcc -std=c99 -O3 testecdh.c ecdh.c randapi.c amcl.a -o testecdh.exe
-gcc -std=c99 -O3 testrsa.c rsa.c randapi.c amcl.a -o testrsa.exe
-gcc -std=c99 -O3 benchtest_ec.c rsa.c amcl.a -o benchtest_ec.exe
-
-del *.o
diff --git a/version22/c/build_pair b/version22/c/build_pair
deleted file mode 100644
index 6b6bae2..0000000
--- a/version22/c/build_pair
+++ /dev/null
@@ -1,27 +0,0 @@
-
-gcc -std=c99 -c -O3 big.c
-gcc -std=c99 -c -O3 fp.c
-gcc -std=c99 -c -O3 ecp.c
-gcc -std=c99 -c -O3 hash.c
-gcc -std=c99 -c -O3 rand.c
-gcc -std=c99 -c -O3 aes.c
-gcc -std=c99 -c -O3 gcm.c
-gcc -std=c99 -c -O3 oct.c
-gcc -std=c99 -c -O3 rom.c
-
-gcc -std=c99 -c -O3 fp2.c
-gcc -std=c99 -c -O3 ecp2.c
-gcc -std=c99 -c -O3 fp4.c
-gcc -std=c99 -c -O3 fp12.c
-gcc -std=c99 -c -O3 pair.c
-
-rm amcl.a
-ar rc amcl.a big.o fp.o ecp.o hash.o
-ar r amcl.a rand.o aes.o gcm.o oct.o rom.o
-
-ar r amcl.a pair.o fp2.o ecp2.o fp4.o fp12.o
-
-gcc -std=c99 -O3 testmpin.c mpin.c randapi.c amcl.a -o testmpin
-gcc -std=c99 -O3 benchtest_pair.c amcl.a -o benchtest_pair
-
-rm *.o
diff --git a/version22/c/build_pair.bat b/version22/c/build_pair.bat
deleted file mode 100644
index 88b5daf..0000000
--- a/version22/c/build_pair.bat
+++ /dev/null
@@ -1,27 +0,0 @@
-
-gcc -std=c99 -c -O3 big.c
-gcc -std=c99 -c -O3 fp.c
-gcc -std=c99 -c -O3 ecp.c
-gcc -std=c99 -c -O3 hash.c
-gcc -std=c99 -c -O3 rand.c
-gcc -std=c99 -c -O3 aes.c
-gcc -std=c99 -c -O3 gcm.c
-gcc -std=c99 -c -O3 oct.c
-gcc -std=c99 -c -O3 rom.c
-
-gcc -std=c99 -c -O3 fp2.c
-gcc -std=c99 -c -O3 ecp2.c
-gcc -std=c99 -c -O3 fp4.c
-gcc -std=c99 -c -O3 fp12.c
-gcc -std=c99 -c -O3 pair.c
-
-del amcl.a
-ar rc amcl.a big.o fp.o ecp.o hash.o
-ar r amcl.a rand.o aes.o gcm.o oct.o rom.o
-
-ar r amcl.a pair.o fp2.o ecp2.o fp4.o fp12.o
-
-gcc -std=c99 -O3 testmpin.c mpin.c randapi.c amcl.a -o testmpin.exe
-gcc -std=c99 -O3 benchtest_pair.c amcl.a -o benchtest_pair.exe
-
-del *.o
diff --git a/version22/c/ca.crt b/version22/c/ca.crt
deleted file mode 100644
index e3ad02f..0000000
--- a/version22/c/ca.crt
+++ /dev/null
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIID6zCCAtOgAwIBAgIJALJxywTGMUA7MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYD
-VQQGEwJJRTEQMA4GA1UECAwHSXJlbGFuZDEPMA0GA1UEBwwGRHVibGluMQ8wDQYD
-VQQKDAZNSVJBQ0wxDTALBgNVBAsMBGxhYnMxEzARBgNVBAMMCk1pa2UgU2NvdHQx
-JDAiBgkqhkiG9w0BCQEWFW1pa2Uuc2NvdHRAbWlyYWNsLmNvbTAeFw0xNjA2MzAx
-NzQyNDFaFw0yMTA2MzAxNzQyNDFaMIGLMQswCQYDVQQGEwJJRTEQMA4GA1UECAwH
-SXJlbGFuZDEPMA0GA1UEBwwGRHVibGluMQ8wDQYDVQQKDAZNSVJBQ0wxDTALBgNV
-BAsMBGxhYnMxEzARBgNVBAMMCk1pa2UgU2NvdHQxJDAiBgkqhkiG9w0BCQEWFW1p
-a2Uuc2NvdHRAbWlyYWNsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
-ggEBAPCTPcPWgiI0ka5Czd0ZzW+gTaMEe9QW7FGu5+9fS6ALrCpdbxdwDX8+OQXZ
-uQJpLYEAIq1pDh3fVQguH/jUM9gQQrS2Lmz3KhXC/J3yv85FRotCGv13ztapMedT
-y2IxzbtPvoQQc+IAlUPX6DtD8JqBoAstrlQUnkMChKztMGR2OERdjNzXmXm+KMMP
-lZzk+EvRwCornVA+SB5QAWj7y/3ISFo0y1WG8ewoQEx3HQYrjXbQP1VTdiLW7dHP
-QP86XKoTMtTBEYWuFhKB9ClCeu4Qqqxqa9UPIVfdro7SoZScCt+OX4KhzLnOCFup
-oLxE+yTDhDpYcCcmI1yglCv9DpMCAwEAAaNQME4wHQYDVR0OBBYEFFH18YEMoxms
-7121N/nQ+Wm3b5smMB8GA1UdIwQYMBaAFFH18YEMoxms7121N/nQ+Wm3b5smMAwG
-A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALCUob0y2O4DSzsqG76yrtCx
-XWxDdgjSkHKzwFK62BzZK5EuCDJrVgCyoLX0SvYvoT9x0wtS+bxJ7TNEGn7Rkp5/
-iSQCUSF7sVRoHqzErk70xVKKDy5FS+zre8k08nJrtRg2u1PmY95NO1SE96BtUVLs
-+8rQuqEX283tqlmqE/SF2+lxOb0WaVrya4oCJfj/XT83pRTcd5w9i7huWltMbKba
-gkmlQ/5q9Ayp/Jh1lLXmxr+/xEbZ2xEop/y+mgVF0vLxap7R5toBA0Yk7vvirlYv
-0hZGqGi5lBc9VeUqm1H/7XCi5xRU3AtJ4QRk4Z1xUa4qAPKfiqlPKd1dVe3Ah3w=
------END CERTIFICATE-----
diff --git a/version22/c/eccert.pem b/version22/c/eccert.pem
deleted file mode 100644
index b9dfca5..0000000
--- a/version22/c/eccert.pem
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICqjCCAZICCQCk9jKdJYtnjDANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMC
-SUUxEDAOBgNVBAgMB0lyZWxhbmQxDzANBgNVBAcMBkR1YmxpbjEPMA0GA1UECgwG
-TUlSQUNMMQ0wCwYDVQQLDARsYWJzMRMwEQYDVQQDDApNaWtlIFNjb3R0MSQwIgYJ
-KoZIhvcNAQkBFhVtaWtlLnNjb3R0QG1pcmFjbC5jb20wHhcNMTYwNjMwMTc0NjQ4
-WhcNMTYwNzMwMTc0NjQ4WjCBjDELMAkGA1UEBhMCSUUxEDAOBgNVBAgMB0lyZWxh
-bmQxDzANBgNVBAcMBkR1YmxpbjEPMA0GA1UECgwGTUlSQUNMMQ0wCwYDVQQLDARs
-YWJzMRgwFgYDVQQDDA9LZWFsYW4gTWNDdXNrZXIxIDAeBgkqhkiG9w0BCQEWEWtl
-YWxhbkBtaXJhY2wuY29tMDkwFAYHKoZIzj0CAQYJKwYBBAHaRw8BAyEASiRQmhO9
-PP+SqodOhXYrnSlcyAOog63E6a4KLDFvAzEwDQYJKoZIhvcNAQELBQADggEBALBy
-fCM/EhdqWBrEnDHtH2/U8xr1eSylHdcfnDSDR+X6KXH5rIJ/397lZQMHB6QSsEiV
-rWzfFDFPPjDN3xEDsZw09ZTT+L8Wi5P3UKR1gtawQCx3ciKEywAU1CU2dV05gvye
-bqIsbFUyH7jOlj6/1hIx9zaiLcoEex6D55MYQuWo664HF3CNdJFk1k4HF+fclRhy
-l4iryp0F9p0Wl5vyn96kg0NwaBZG860oCWDHZsjRq1JeSSaRf9CKNXWbQwjByeEc
-DphpprqmoVcI60cC0TvZZm1x4y7vjCXLD6uCDw3P7fnSp40yce64+IKUr8/cS+QY
-us58KHdLaLXsojZHL3c=
------END CERTIFICATE-----
diff --git a/version22/c/ecdh.c b/version22/c/ecdh.c
deleted file mode 100644
index 74694f7..0000000
--- a/version22/c/ecdh.c
+++ /dev/null
@@ -1,751 +0,0 @@
-/*
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied. See the License for the
-specific language governing permissions and limitations
-under the License.
-*/
-
-/* ECDH/ECIES/ECDSA Functions - see main program below */
-
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <time.h>
-
-#include "ecdh.h"
-
-#define ROUNDUP(a,b) ((a)-1)/(b)+1
-
-/* general purpose hash function w=hash(p|n|x|y) */
-/* pad or truncate ouput to length pad if pad!=0 */
-static void hashit(int sha,octet *p,int n,octet *x,octet *w,int pad)
-{
- int i,c[4],hlen;
- hash256 sha256;
- hash512 sha512;
- char hh[64];
-
- switch (sha)
- {
- case SHA256:
- HASH256_init(&sha256);
- break;
- case SHA384:
- HASH384_init(&sha512);
- break;
- case SHA512:
- HASH512_init(&sha512);
- break;
- }
-
- hlen=sha;
-
- for (i=0; i<p->len; i++)
- {
- switch(sha)
- {
- case SHA256:
- HASH256_process(&sha256,p->val[i]);
- break;
- case SHA384:
- HASH384_process(&sha512,p->val[i]);
- break;
- case SHA512:
- HASH512_process(&sha512,p->val[i]);
- break;
- }
- }
- if (n>0)
- {
- c[0]=(n>>24)&0xff;
- c[1]=(n>>16)&0xff;
- c[2]=(n>>8)&0xff;
- c[3]=(n)&0xff;
- for (i=0; i<4; i++)
- {
- switch(sha)
- {
- case SHA256:
- HASH256_process(&sha256,c[i]);
- break;
- case SHA384:
- HASH384_process(&sha512,c[i]);
- break;
- case SHA512:
- HASH512_process(&sha512,c[i]);
- break;
- }
- }
- }
- if (x!=NULL) for (i=0; i<x->len; i++)
- {
- switch(sha)
- {
- case SHA256:
- HASH256_process(&sha256,x->val[i]);
- break;
- case SHA384:
- HASH384_process(&sha512,x->val[i]);
- break;
- case SHA512:
- HASH512_process(&sha512,x->val[i]);
- break;
- }
- }
-
- switch (sha)
- {
- case SHA256:
- HASH256_hash(&sha256,hh);
- break;
- case SHA384:
- HASH384_hash(&sha512,hh);
- break;
- case SHA512:
- HASH512_hash(&sha512,hh);
- break;
- }
-
- OCT_empty(w);
- if (!pad)
- OCT_jbytes(w,hh,hlen);
- else
- {
- if (pad<=hlen)
- OCT_jbytes(w,hh,pad);
- else
- {
- OCT_jbytes(w,hh,hlen);
- OCT_jbyte(w,0,pad-hlen);
- }
- }
- return;
-}
-
-/* Hash octet p to octet w */
-void HASH(int sha,octet *p,octet *w)
-{
- hashit(sha,p,-1,NULL,w,0);
-}
-
-/* Calculate HMAC of m using key k. HMAC is tag of length olen */
-int HMAC(int sha,octet *m,octet *k,int olen,octet *tag)
-{
- /* Input is from an octet m *
- * olen is requested output length in bytes. k is the key *
- * The output is the calculated tag */
- int hlen,b;
- char h[128],k0[128];
- octet H= {0,sizeof(h),h};
- octet K0= {0,sizeof(k0),k0};
-
- hlen=sha;
- if (hlen>32) b=128;
- else b=64;
-
- if (olen<4 /*|| olen>hlen*/) return 0;
-
- if (k->len > b) hashit(sha,k,-1,NULL,&K0,0);
- else OCT_copy(&K0,k);
-
- OCT_jbyte(&K0,0,b-K0.len);
-
- OCT_xorbyte(&K0,0x36);
-
- hashit(sha,&K0,-1,m,&H,0);
-
- OCT_xorbyte(&K0,0x6a); /* 0x6a = 0x36 ^ 0x5c */
- hashit(sha,&K0,-1,&H,&H,olen);
-
- OCT_empty(tag);
-
- OCT_jbytes(tag,H.val,olen);
-
- return 1;
-}
-
-/* Key Derivation Functions */
-/* Input octet z */
-/* Output key of length olen */
-/*
-void KDF1(octet *z,int olen,octet *key)
-{
- char h[32];
- octet H={0,sizeof(h),h};
- int counter,cthreshold;
- int hlen=32;
-
- OCT_empty(key);
-
- cthreshold=ROUNDUP(olen,hlen);
-
- for (counter=0;counter<cthreshold;counter++)
- {
- hashit(z,counter,NULL,NULL,&H);
- if (key->len+hlen>olen) OCT_jbytes(key,H.val,olen%hlen);
- else OCT_joctet(key,&H);
- }
-}
-*/
-void KDF2(int sha,octet *z,octet *p,int olen,octet *key)
-{
- /* NOTE: the parameter olen is the length of the output k in bytes */
- char h[64];
- octet H= {0,sizeof(h),h};
- int counter,cthreshold;
- int hlen=sha;
-
- OCT_empty(key);
-
- cthreshold=ROUNDUP(olen,hlen);
-
- for (counter=1; counter<=cthreshold; counter++)
- {
- hashit(sha,z,counter,p,&H,0);
- if (key->len+hlen>olen) OCT_jbytes(key,H.val,olen%hlen);
- else OCT_joctet(key,&H);
- }
-
-}
-
-/* Password based Key Derivation Function */
-/* Input password p, salt s, and repeat count */
-/* Output key of length olen */
-void PBKDF2(int sha,octet *p,octet *s,int rep,int olen,octet *key)
-{
- int i,j,len,d=ROUNDUP(olen,sha);
- char f[64],u[64]; /*****/
- octet F= {0,sizeof(f),f};
- octet U= {0,sizeof(u),u};
- OCT_empty(key);
-
- for (i=1; i<=d; i++)
- {
- len=s->len;
- OCT_jint(s,i,4);
-
- HMAC(sha,s,p,sha,&F); /* sha not EFS */
-
- s->len=len;
- OCT_copy(&U,&F);
- for (j=2; j<=rep; j++)
- {
- HMAC(sha,&U,p,sha,&U); /* sha not EFS */
- OCT_xor(&F,&U);
- }
-
- OCT_joctet(key,&F);
- }
-
- OCT_chop(key,NULL,olen);
-}
-
-/* AES encryption/decryption. Encrypt byte array M using key K and returns ciphertext */
-void AES_CBC_IV0_ENCRYPT(octet *k,octet *m,octet *c)
-{
- /* AES CBC encryption, with Null IV and key k */
- /* Input is from an octet string m, output is to an octet string c */
- /* Input is padded as necessary to make up a full final block */
- amcl_aes a;
- int fin;
- int i,j,ipt,opt;
- char buff[16];
- int padlen;
-
- OCT_clear(c);
- if (m->len==0) return;
- AES_init(&a,CBC,k->len,k->val,NULL);
-
- ipt=opt=0;
- fin=0;
- for(;;)
- {
- for (i=0; i<16; i++)
- {
- if (ipt<m->len) buff[i]=m->val[ipt++];
- else
- {
- fin=1;
- break;
- }
- }
- if (fin) break;
- AES_encrypt(&a,buff);
- for (i=0; i<16; i++)
- if (opt<c->max) c->val[opt++]=buff[i];
- }
-
- /* last block, filled up to i-th index */
-
- padlen=16-i;
- for (j=i; j<16; j++) buff[j]=padlen;
- AES_encrypt(&a,buff);
- for (i=0; i<16; i++)
- if (opt<c->max) c->val[opt++]=buff[i];
- AES_end(&a);
- c->len=opt;
-}
-
-/* decrypts and returns TRUE if all consistent, else returns FALSE */
-int AES_CBC_IV0_DECRYPT(octet *k,octet *c,octet *m)
-{
- /* padding is removed */
- amcl_aes a;
- int i,ipt,opt,ch;
- char buff[16];
- int fin,bad;
- int padlen;
- ipt=opt=0;
-
- OCT_clear(m);
- if (c->len==0) return 1;
- ch=c->val[ipt++];
-
- AES_init(&a,CBC,k->len,k->val,NULL);
- fin=0;
-
- for(;;)
- {
- for (i=0; i<16; i++)
- {
- buff[i]=ch;
- if (ipt>=c->len)
- {
- fin=1;
- break;
- }
- else ch=c->val[ipt++];
- }
- AES_decrypt(&a,buff);
- if (fin) break;
- for (i=0; i<16; i++)
- if (opt<m->max) m->val[opt++]=buff[i];
- }
- AES_end(&a);
- bad=0;
- padlen=buff[15];
- if (i!=15 || padlen<1 || padlen>16) bad=1;
- if (padlen>=2 && padlen<=16)
- for (i=16-padlen; i<16; i++) if (buff[i]!=padlen) bad=1;
-
- if (!bad) for (i=0; i<16-padlen; i++)
- if (opt<m->max) m->val[opt++]=buff[i];
-
- m->len=opt;
- if (bad) return 0;
- return 1;
-}
-
-/* Calculate a public/private EC GF(p) key pair. W=S.G mod EC(p),
- * where S is the secret key and W is the public key
- * and G is fixed generator.
- * If RNG is NULL then the private key is provided externally in S
- * otherwise it is generated randomly internally */
-int ECP_KEY_PAIR_GENERATE(csprng *RNG,octet* S,octet *W)
-{
- BIG r,gx,s;
- ECP G;
- int res=0;
- BIG_rcopy(gx,CURVE_Gx);
-
-#if CURVETYPE!=MONTGOMERY
- BIG gy;
- BIG_rcopy(gy,CURVE_Gy);
- ECP_set(&G,gx,gy);
-#else
- ECP_set(&G,gx);
-#endif
-
- BIG_rcopy(r,CURVE_Order);
- if (RNG!=NULL)
- {
- BIG_randomnum(s,r,RNG);
- }
- else
- {
- BIG_fromBytes(s,S->val);
- BIG_mod(s,r);
- }
-
-#ifdef AES_S
- BIG_mod2m(s,2*AES_S);
-// BIG_toBytes(S->val,s);
-#endif
-
- ECP_mul(&G,s);
-#if CURVETYPE!=MONTGOMERY
- ECP_get(gx,gy,&G);
-#else
- ECP_get(gx,&G);
- /*
- ECP_rhs(gy,gx);
- FP_sqrt(gy,gy);
- FP_neg(gy,gy);
- FP_inv(gy,gy);
- FP_mul(r,gx,gy);
- FP_reduce(r);
-
- BIG_zero(gy);
- BIG_inc(gy,486664);
- FP_neg(gy,gy);
- FP_sqrt(gy,gy);
- FP_reduce(gy);
- FP_mul(r,r,gy);
- FP_reduce(r);
-
- printf("x= "); BIG_output(r); printf("\n");
-
- BIG_copy(r,gx);
- BIG_dec(r,1);
- BIG_copy(gy,gx);
- BIG_inc(gy,1);
- FP_inv(gy,gy);
- FP_mul(r,r,gy);
- FP_reduce(r);
-
- printf("y= "); BIG_output(r); printf("\n");
-
- BIG_zero(r);
- BIG_inc(r,121665);
- BIG_zero(gy);
- BIG_inc(gy,121666);
- FP_inv(gy,gy);
- FP_mul(r,r,gy);
- FP_neg(r,r);
- FP_reduce(r);
-
- printf("d= "); BIG_output(r); printf("\n");
- */
-
-#endif
-
- S->len=EGS;
- BIG_toBytes(S->val,s);
-
-#if CURVETYPE!=MONTGOMERY
- W->len=2*EFS+1;
- W->val[0]=4;
- BIG_toBytes(&(W->val[1]),gx);
- BIG_toBytes(&(W->val[EFS+1]),gy);
-#else
- W->len=EFS+1;
- W->val[0]=2;
- BIG_toBytes(&(W->val[1]),gx);
-#endif
-
- return res;
-}
-
-/* validate public key. Set full=true for fuller check */
-int ECP_PUBLIC_KEY_VALIDATE(int full,octet *W)
-{
- BIG q,r,wx;
- ECP WP;
- int valid;
- int res=0;
-
- BIG_rcopy(q,Modulus);
- BIG_rcopy(r,CURVE_Order);
-
- BIG_fromBytes(wx,&(W->val[1]));
- if (BIG_comp(wx,q)>=0) res=ECDH_INVALID_PUBLIC_KEY;
-#if CURVETYPE!=MONTGOMERY
- BIG wy;
- BIG_fromBytes(wy,&(W->val[EFS+1]));
- if (BIG_comp(wy,q)>=0) res=ECDH_INVALID_PUBLIC_KEY;
-#endif
- if (res==0)
- {
-
-#if CURVETYPE!=MONTGOMERY
- valid=ECP_set(&WP,wx,wy);
-#else
- valid=ECP_set(&WP,wx);
-#endif
- if (!valid || ECP_isinf(&WP)) res=ECDH_INVALID_PUBLIC_KEY;
- if (res==0 && full)
- {
-
- ECP_mul(&WP,r);
- if (!ECP_isinf(&WP)) res=ECDH_INVALID_PUBLIC_KEY;
- }
- }
-
- return res;
-}
-
-/* IEEE-1363 Diffie-Hellman online calculation Z=S.WD */
-int ECPSVDP_DH(octet *S,octet *WD,octet *Z)
-{
- BIG r,s,wx;
- int valid;
- ECP W;
- int res=0;
-
- BIG_fromBytes(s,S->val);
-
- BIG_fromBytes(wx,&(WD->val[1]));
-#if CURVETYPE!=MONTGOMERY
- BIG wy;
- BIG_fromBytes(wy,&(WD->val[EFS+1]));
- valid=ECP_set(&W,wx,wy);
-#else
- valid=ECP_set(&W,wx);
-#endif
- if (!valid) res=ECDH_ERROR;
- if (res==0)
- {
- BIG_rcopy(r,CURVE_Order);
- BIG_mod(s,r);
-
- ECP_mul(&W,s);
- if (ECP_isinf(&W)) res=ECDH_ERROR;
- else
- {
-#if CURVETYPE!=MONTGOMERY
- ECP_get(wx,wx,&W);
-#else
- ECP_get(wx,&W);
-#endif
- Z->len=MODBYTES;
- BIG_toBytes(Z->val,wx);
- }
- }
- return res;
-}
-
-#if CURVETYPE!=MONTGOMERY
-
-/* IEEE ECDSA Signature, C and D are signature on F using private key S */
-int ECPSP_DSA(int sha,csprng *RNG,octet *K,octet *S,octet *F,octet *C,octet *D)
-{
- char h[128];
- octet H= {0,sizeof(h),h};
-
- BIG gx,gy,r,s,f,c,d,u,vx,w;
- ECP G,V;
-
- hashit(sha,F,-1,NULL,&H,sha);
- BIG_rcopy(gx,CURVE_Gx);
- BIG_rcopy(gy,CURVE_Gy);
- BIG_rcopy(r,CURVE_Order);
-
- BIG_fromBytes(s,S->val);
-
- int hlen=H.len;
- if (H.len>MODBYTES) hlen=MODBYTES;
- BIG_fromBytesLen(f,H.val,hlen);
-
- ECP_set(&G,gx,gy);
-
- do
- {
- if (RNG!=NULL)
- {
- BIG_randomnum(u,r,RNG);
- BIG_randomnum(w,r,RNG); /* randomize calculation */
- }
- else
- {
- BIG_fromBytes(u,K->val);
- BIG_mod(u,r);
- }
-
-#ifdef AES_S
- BIG_mod2m(u,2*AES_S);
-#endif
- ECP_copy(&V,&G);
- ECP_mul(&V,u);
-
- ECP_get(vx,vx,&V);
-
- BIG_copy(c,vx);
- BIG_mod(c,r);
- if (BIG_iszilch(c)) continue;
- if (RNG!=NULL)
- {
- BIG_modmul(u,u,w,r);
- }
-
- BIG_invmodp(u,u,r);
- BIG_modmul(d,s,c,r);
-
- BIG_add(d,f,d);
- if (RNG!=NULL)
- {
- BIG_modmul(d,d,w,r);
- }
-
- BIG_modmul(d,u,d,r);
-
- }
- while (BIG_iszilch(d));
-
- C->len=D->len=EGS;
-
- BIG_toBytes(C->val,c);
- BIG_toBytes(D->val,d);
-
- return 0;
-}
-
-/* IEEE1363 ECDSA Signature Verification. Signature C and D on F is verified using public key W */
-int ECPVP_DSA(int sha,octet *W,octet *F, octet *C,octet *D)
-{
- char h[128];
- octet H= {0,sizeof(h),h};
-
- BIG r,gx,gy,wx,wy,f,c,d,h2;
- int res=0;
- ECP G,WP;
- int valid;
-
- hashit(sha,F,-1,NULL,&H,sha);
- BIG_rcopy(gx,CURVE_Gx);
- BIG_rcopy(gy,CURVE_Gy);
- BIG_rcopy(r,CURVE_Order);
-
- OCT_shl(C,C->len-MODBYTES);
- OCT_shl(D,D->len-MODBYTES);
-
- BIG_fromBytes(c,C->val);
- BIG_fromBytes(d,D->val);
-
- int hlen=H.len;
- if (hlen>MODBYTES) hlen=MODBYTES;
-
- BIG_fromBytesLen(f,H.val,hlen);
-
- //BIG_fromBytes(f,H.val);
-
- if (BIG_iszilch(c) || BIG_comp(c,r)>=0 || BIG_iszilch(d) || BIG_comp(d,r)>=0)
- res=ECDH_INVALID;
-
- if (res==0)
- {
- BIG_invmodp(d,d,r);
- BIG_modmul(f,f,d,r);
- BIG_modmul(h2,c,d,r);
-
- ECP_set(&G,gx,gy);
-
- BIG_fromBytes(wx,&(W->val[1]));
- BIG_fromBytes(wy,&(W->val[EFS+1]));
-
- valid=ECP_set(&WP,wx,wy);
-
- if (!valid) res=ECDH_ERROR;
- else
- {
- ECP_mul2(&WP,&G,h2,f);
-
- if (ECP_isinf(&WP)) res=ECDH_INVALID;
- else
- {
- ECP_get(d,d,&WP);
- BIG_mod(d,r);
- if (BIG_comp(d,c)!=0) res=ECDH_INVALID;
- }
- }
- }
-
- return res;
-}
-
-/* IEEE1363 ECIES encryption. Encryption of plaintext M uses public key W and produces ciphertext V,C,T */
-void ECP_ECIES_ENCRYPT(int sha,octet *P1,octet *P2,csprng *RNG,octet *W,octet *M,int tlen,octet *V,octet *C,octet *T)
-{
-
- int i,len;
- char z[EFS],vz[3*EFS+1],k[2*EAS],k1[EAS],k2[EAS],l2[8],u[EFS];
- octet Z= {0,sizeof(z),z};
- octet VZ= {0,sizeof(vz),vz};
- octet K= {0,sizeof(k),k};
- octet K1= {0,sizeof(k1),k1};
- octet K2= {0,sizeof(k2),k2};
- octet L2= {0,sizeof(l2),l2};
- octet U= {0,sizeof(u),u};
-
- if (ECP_KEY_PAIR_GENERATE(RNG,&U,V)!=0) return;
- if (ECPSVDP_DH(&U,W,&Z)!=0) return;
-
- OCT_copy(&VZ,V);
- OCT_joctet(&VZ,&Z);
-
- KDF2(sha,&VZ,P1,2*EAS,&K);
-
- K1.len=K2.len=EAS;
- for (i=0; i<EAS; i++)
- {
- K1.val[i]=K.val[i];
- K2.val[i]=K.val[EAS+i];
- }
-
- AES_CBC_IV0_ENCRYPT(&K1,M,C);
-
- OCT_jint(&L2,P2->len,8);
-
- len=C->len;
- OCT_joctet(C,P2);
- OCT_joctet(C,&L2);
- HMAC(sha,C,&K2,tlen,T);
- C->len=len;
-}
-
-/* IEEE1363 ECIES decryption. Decryption of ciphertext V,C,T using private key U outputs plaintext M */
-int ECP_ECIES_DECRYPT(int sha,octet *P1,octet *P2,octet *V,octet *C,octet *T,octet *U,octet *M)
-{
-
- int i,len;
- char z[EFS],vz[3*EFS+1],k[2*EAS],k1[EAS],k2[EAS],l2[8],tag[32];
- octet Z= {0,sizeof(z),z};
- octet VZ= {0,sizeof(vz),vz};
- octet K= {0,sizeof(k),k};
- octet K1= {0,sizeof(k1),k1};
- octet K2= {0,sizeof(k2),k2};
- octet L2= {0,sizeof(l2),l2};
- octet TAG= {0,sizeof(tag),tag};
-
- if (ECPSVDP_DH(U,V,&Z)!=0) return 0;
-
- OCT_copy(&VZ,V);
- OCT_joctet(&VZ,&Z);
-
- KDF2(sha,&VZ,P1,EFS,&K);
-
- K1.len=K2.len=EAS;
- for (i=0; i<EAS; i++)
- {
- K1.val[i]=K.val[i];
- K2.val[i]=K.val[EAS+i];
- }
-
- if (!AES_CBC_IV0_DECRYPT(&K1,C,M)) return 0;
-
- OCT_jint(&L2,P2->len,8);
-
- len=C->len;
- OCT_joctet(C,P2);
- OCT_joctet(C,&L2);
- HMAC(sha,C,&K2,T->len,&TAG);
- C->len=len;
-
- if (!OCT_comp(T,&TAG)) return 0;
-
- return 1;
-
-}
-
-#endif
diff --git a/version22/c/ecdh.h b/version22/c/ecdh.h
deleted file mode 100644
index 7d0536b..0000000
--- a/version22/c/ecdh.h
+++ /dev/null
@@ -1,206 +0,0 @@
-/*
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied. See the License for the
-specific language governing permissions and limitations
-under the License.
-*/
-
-/**
- * @file ecdh.h
- * @author Mike Scott and Kealan McCusker
- * @date 2nd June 2015
- * @brief ECDH Header file for implementation of standard EC protocols
- *
- * declares functions
- *
- */
-
-#ifndef ECDH_H
-#define ECDH_H
-
-#include "amcl.h"
-
-#define EAS 16 /**< Symmetric Key size - 128 bits */
-#define EGS MODBYTES /**< ECC Group Size in bytes */
-#define EFS MODBYTES /**< ECC Field Size in bytes */
-
-#define HASH_TYPE_ECC SHA256 /**< Hash type */
-
-#define ECDH_OK 0 /**< Function completed without error */
-/*#define ECDH_DOMAIN_ERROR -1*/
-#define ECDH_INVALID_PUBLIC_KEY -2 /**< Public Key is Invalid */
-#define ECDH_ERROR -3 /**< ECDH Internal Error */
-#define ECDH_INVALID -4 /**< ECDH Internal Error */
-/*#define ECDH_DOMAIN_NOT_FOUND -5
-#define ECDH_OUT_OF_MEMORY -6
-#define ECDH_DIV_BY_ZERO -7
-#define ECDH_BAD_ASSUMPTION -8*/
-
-/* ECDH Auxiliary Functions */
-
-
-/** @brief hash an octet into another octet
- *
- @param h is the hash type
- @param I input octet
- @param O output octet - H(I)
- */
-extern void HASH(int h,octet *I,octet *O);
-/** @brief HMAC of message M using key K to create tag of length len in octet tag
- *
- IEEE-1363 MAC1 function. Uses SHA256 internally.
- @param h is the hash type
- @param M input message octet
- @param K input encryption key
- @param len is output desired length of HMAC tag
- @param tag is the output HMAC
- @return 0 for bad parameters, else 1
- */
-extern int HMAC(int h,octet *M,octet *K,int len,octet *tag);
-
-/*extern void KDF1(octet *,int,octet *);*/
-
-/** @brief Key Derivation Function - generates key K from inputs Z and P
- *
- IEEE-1363 KDF2 Key Derivation Function. Uses SHA256 internally.
- @param h is the hash type
- @param Z input octet
- @param P input key derivation parameters - can be NULL
- @param len is output desired length of key
- @param K is the derived key
- */
-extern void KDF2(int h,octet *Z,octet *P,int len,octet *K);
-/** @brief Password Based Key Derivation Function - generates key K from password, salt and repeat counter
- *
- PBKDF2 Password Based Key Derivation Function. Uses SHA256 internally.
- @param h is the hash type
- @param P input password
- @param S input salt
- @param rep Number of times to be iterated.
- @param len is output desired length
- @param K is the derived key
- */
-extern void PBKDF2(int h,octet *P,octet *S,int rep,int len,octet *K);
-/** @brief AES encrypts a plaintext to a ciphtertext
- *
- IEEE-1363 AES_CBC_IV0_ENCRYPT function. Encrypts in CBC mode with a zero IV, padding as necessary to create a full final block.
- @param K AES key
- @param P input plaintext octet
- @param C output ciphertext octet
- */
-extern void AES_CBC_IV0_ENCRYPT(octet *K,octet *P,octet *C);
-/** @brief AES encrypts a plaintext to a ciphtertext
- *
- IEEE-1363 AES_CBC_IV0_DECRYPT function. Decrypts in CBC mode with a zero IV.
- @param K AES key
- @param C input ciphertext octet
- @param P output plaintext octet
- @return 0 if bad input, else 1
- */
-extern int AES_CBC_IV0_DECRYPT(octet *K,octet *C,octet *P);
-
-/* ECDH primitives - support functions */
-/** @brief Generate an ECC public/private key pair
- *
- @param R is a pointer to a cryptographically secure random number generator
- @param s the private key, an output internally randomly generated if R!=NULL, otherwise must be provided as an input
- @param W the output public key, which is s.G, where G is a fixed generator
- @return 0 or an error code
- */
-extern int ECP_KEY_PAIR_GENERATE(csprng *R,octet *s,octet *W);
-/** @brief Validate an ECC public key
- *
- @param f if = 0 just does some simple checks, else tests that W is of the correct order
- @param W the input public key to be validated
- @return 0 if public key is OK, or an error code
- */
-extern int ECP_PUBLIC_KEY_VALIDATE(int f,octet *W);
-
-/* ECDH primitives */
-
-/** @brief Generate Diffie-Hellman shared key
- *
- IEEE-1363 Diffie-Hellman shared secret calculation
- @param s is the input private key,
- @param W the input public key of the other party
- @param K the output shared key, in fact the x-coordinate of s.W
- @return 0 or an error code
- */
-extern int ECPSVDP_DH(octet *s,octet *W,octet *K);
-/*extern int ECPSVDP_DHC(octet *,octet *,int,octet *);*/
-
-/*#if CURVETYPE!=MONTGOMERY */
-/* ECIES functions */
-/*#if CURVETYPE!=MONTGOMERY */
-/* ECIES functions */
-/** @brief ECIES Encryption
- *
- IEEE-1363 ECIES Encryption
- @param h is the hash type
- @param P1 input Key Derivation parameters
- @param P2 input Encoding parameters
- @param R is a pointer to a cryptographically secure random number generator
- @param W the input public key of the recieving party
- @param M is the plaintext message to be encrypted
- @param len the length of the HMAC tag
- @param V component of the output ciphertext
- @param C the output ciphertext
- @param T the output HMAC tag, part of the ciphertext
- */
-extern void ECP_ECIES_ENCRYPT(int h,octet *P1,octet *P2,csprng *R,octet *W,octet *M,int len,octet *V,octet *C,octet *T);
-/** @brief ECIES Decryption
- *
- IEEE-1363 ECIES Decryption
- @param h is the hash type
- @param P1 input Key Derivation parameters
- @param P2 input Encoding parameters
- @param V component of the input ciphertext
- @param C the input ciphertext
- @param T the input HMAC tag, part of the ciphertext
- @param U the input private key for decryption
- @param M the output plaintext message
- @return 1 if successful, else 0
- */
-extern int ECP_ECIES_DECRYPT(int h,octet *P1,octet *P2,octet *V,octet *C,octet *T,octet *U,octet *M);
-
-/* ECDSA functions */
-/** @brief ECDSA Signature
- *
- IEEE-1363 ECDSA Signature
- @param h is the hash type
- @param R is a pointer to a cryptographically secure random number generator
- @param k Ephemeral key. This value is used when R=NULL
- @param s the input private signing key
- @param M the input message to be signed
- @param c component of the output signature
- @param d component of the output signature
-
- */
-extern int ECPSP_DSA(int h,csprng *R,octet *k,octet *s,octet *M,octet *c,octet *d);
-/** @brief ECDSA Signature Verification
- *
- IEEE-1363 ECDSA Signature Verification
- @param h is the hash type
- @param W the input public key
- @param M the input message
- @param c component of the input signature
- @param d component of the input signature
- @return 0 or an error code
- */
-extern int ECPVP_DSA(int h,octet *W,octet *M,octet *c,octet *d);
-/*#endif*/
-
-#endif
-
diff --git a/version22/c/ecp.c b/version22/c/ecp.c
deleted file mode 100644
index a6dcfad..0000000
--- a/version22/c/ecp.c
+++ /dev/null
@@ -1,1176 +0,0 @@
-/*
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied. See the License for the
-specific language governing permissions and limitations
-under the License.
-*/
-
-/* AMCL Elliptic Curve Functions */
-/* SU=m, SU is Stack Usage (Weierstrass Curves) */
-
-//#define HAS_MAIN
-
-#include "amcl.h"
-
-/* test for P=O point-at-infinity */
-int ECP_isinf(ECP *P)
-{
-#if CURVETYPE==EDWARDS
- FP_reduce(P->x);
- FP_reduce(P->y);
- FP_reduce(P->z);
- return (BIG_iszilch(P->x) && BIG_comp(P->y,P->z)==0);
-#else
- return P->inf;
-#endif
-}
-
-/* Conditional swap of P and Q dependant on d */
-static void ECP_cswap(ECP *P,ECP *Q,int d)
-{
- BIG_cswap(P->x,Q->x,d);
-#if CURVETYPE!=MONTGOMERY
- BIG_cswap(P->y,Q->y,d);
-#endif
- BIG_cswap(P->z,Q->z,d);
-#if CURVETYPE!=EDWARDS
- d=~(d-1);
- d=d&(P->inf^Q->inf);
- P->inf^=d;
- Q->inf^=d;
-#endif
-}
-
-#if CURVETYPE!=MONTGOMERY
-/* Conditional move Q to P dependant on d */
-static void ECP_cmove(ECP *P,ECP *Q,int d)
-{
- BIG_cmove(P->x,Q->x,d);
-#if CURVETYPE!=MONTGOMERY
- BIG_cmove(P->y,Q->y,d);
-#endif
- BIG_cmove(P->z,Q->z,d);
-#if CURVETYPE!=EDWARDS
- d=~(d-1);
- P->inf^=(P->inf^Q->inf)&d;
-#endif
-}
-
-/* return 1 if b==c, no branching */
-static int teq(sign32 b,sign32 c)
-{
- sign32 x=b^c;
- x-=1; // if x=0, x now -1
- return (int)((x>>31)&1);
-}
-#endif // CURVETYPE!=MONTGOMERY
-
-#if CURVETYPE!=MONTGOMERY
-/* Constant time select from pre-computed table */
-static void ECP_select(ECP *P,ECP W[],sign32 b)
-{
- ECP MP;
- sign32 m=b>>31;
- sign32 babs=(b^m)-m;
-
- babs=(babs-1)/2;
-
- ECP_cmove(P,&W[0],teq(babs,0)); // conditional move
- ECP_cmove(P,&W[1],teq(babs,1));
- ECP_cmove(P,&W[2],teq(babs,2));
- ECP_cmove(P,&W[3],teq(babs,3));
- ECP_cmove(P,&W[4],teq(babs,4));
- ECP_cmove(P,&W[5],teq(babs,5));
- ECP_cmove(P,&W[6],teq(babs,6));
- ECP_cmove(P,&W[7],teq(babs,7));
-
- ECP_copy(&MP,P);
- ECP_neg(&MP); // minus P
- ECP_cmove(P,&MP,(int)(m&1));
-}
-#endif
-
-/* Test P == Q */
-/* SU=168 */
-int ECP_equals(ECP *P,ECP *Q)
-{
-#if CURVETYPE==WEIERSTRASS
- BIG pz2,qz2,a,b;
- if (ECP_isinf(P) && ECP_isinf(Q)) return 1;
- if (ECP_isinf(P) || ECP_isinf(Q)) return 0;
-
- FP_sqr(pz2,P->z);
- FP_sqr(qz2,Q->z);
-
- FP_mul(a,P->x,qz2);
- FP_mul(b,Q->x,pz2);
- FP_reduce(a);
- FP_reduce(b);
- if (BIG_comp(a,b)!=0) return 0;
-
- FP_mul(a,P->y,qz2);
- FP_mul(a,a,Q->z);
- FP_mul(b,Q->y,pz2);
- FP_mul(b,b,P->z);
- FP_reduce(a);
- FP_reduce(b);
- if (BIG_comp(a,b)!=0) return 0;
- return 1;
-#else
- BIG a,b;
- if (ECP_isinf(P) && ECP_isinf(Q)) return 1;
- if (ECP_isinf(P) || ECP_isinf(Q)) return 0;
-
- FP_mul(a,P->x,Q->z);
- FP_mul(b,Q->x,P->z);
- FP_reduce(a);
- FP_reduce(b);
- if (BIG_comp(a,b)!=0) return 0;
-
-#if CURVETYPE==EDWARDS
- FP_mul(a,P->y,Q->z);
- FP_mul(b,Q->y,P->z);
- FP_reduce(a);
- FP_reduce(b);
- if (BIG_comp(a,b)!=0) return 0;
-#endif
-
- return 1;
-#endif
-}
-
-/* Set P=Q */
-/* SU=16 */
-void ECP_copy(ECP *P,ECP *Q)
-{
-#if CURVETYPE!=EDWARDS
- P->inf=Q->inf;
-#endif
- BIG_copy(P->x,Q->x);
-#if CURVETYPE!=MONTGOMERY
- BIG_copy(P->y,Q->y);
-#endif
- BIG_copy(P->z,Q->z);
-}
-
-/* Set P=-Q */
-#if CURVETYPE!=MONTGOMERY
-/* SU=8 */
-void ECP_neg(ECP *P)
-{
- if (ECP_isinf(P)) return;
-#if CURVETYPE==WEIERSTRASS
- FP_neg(P->y,P->y);
- BIG_norm(P->y);
-#else
- FP_neg(P->x,P->x);
- BIG_norm(P->x);
-#endif
-
-}
-#endif
-
-/* Set P=O */
-void ECP_inf(ECP *P)
-{
-#if CURVETYPE==EDWARDS
- BIG_zero(P->x);
- FP_one(P->y);
- FP_one(P->z);
-#else
- P->inf=1;
-#endif
-}
-
-/* Calculate right Hand Side of curve equation y^2=RHS */
-/* SU=56 */
-void ECP_rhs(BIG v,BIG x)
-{
-#if CURVETYPE==WEIERSTRASS
- /* x^3+Ax+B */
- BIG t;
- FP_sqr(t,x);
- FP_mul(t,t,x);
-
- if (CURVE_A==-3)
- {
- FP_neg(v,x);
- BIG_norm(v);
- BIG_imul(v,v,-CURVE_A);
- BIG_norm(v);
- FP_add(v,t,v);
- }
- else BIG_copy(v,t);
-
- BIG_rcopy(t,CURVE_B);
- FP_nres(t);
- FP_add(v,t,v);
- FP_reduce(v);
-#endif
-
-#if CURVETYPE==EDWARDS
- /* (Ax^2-1)/(Bx^2-1) */
- BIG t,m,one;
- BIG_rcopy(m,Modulus);
- FP_sqr(v,x);
- FP_one(one);
- BIG_rcopy(t,CURVE_B);
- FP_nres(t);
- FP_mul(t,v,t);
- FP_sub(t,t,one);
- if (CURVE_A==1) FP_sub(v,v,one);
-
- if (CURVE_A==-1)
- {
- FP_add(v,v,one);
- FP_neg(v,v);
- }
- FP_redc(v);
- FP_redc(t);
- BIG_moddiv(v,v,t,m);
- FP_nres(v);
-#endif
-
-#if CURVETYPE==MONTGOMERY
- /* x^3+Ax^2+x */
- BIG x2,x3;
- FP_sqr(x2,x);
- FP_mul(x3,x2,x);
- BIG_copy(v,x);
- FP_imul(x2,x2,CURVE_A);
- FP_add(v,v,x2);
- FP_add(v,v,x3);
- FP_reduce(v);
-#endif
-}
-
-/* Set P=(x,y) */
-
-#if CURVETYPE==MONTGOMERY
-
-/* Set P=(x,{y}) */
-
-int ECP_set(ECP *P,BIG x)
-{
- BIG m,rhs;
- BIG_rcopy(m,Modulus);
- BIG_copy(rhs,x);
- FP_nres(rhs);
- ECP_rhs(rhs,rhs);
- FP_redc(rhs);
-
- if (BIG_jacobi(rhs,m)!=1)
- {
- ECP_inf(P);
- return 0;
- }
- P->inf=0;
- BIG_copy(P->x,x);
- FP_nres(P->x);
- FP_one(P->z);
- return 1;
-}
-
-/* Extract x coordinate as BIG */
-int ECP_get(BIG x,ECP *P)
-{
- if (ECP_isinf(P)) return -1;
- ECP_affine(P);
- BIG_copy(x,P->x);
- FP_redc(x);
- return 0;
-}
-
-
-#else
-/* Extract (x,y) and return sign of y. If x and y are the same return only x */
-/* SU=16 */
-int ECP_get(BIG x,BIG y,ECP *P)
-{
- int s;
-#if CURVETYPE!=EDWARDS
- if (ECP_isinf(P)) return -1;
-#endif
- ECP_affine(P);
-
- BIG_copy(y,P->y);
- FP_redc(y);
-
- s=BIG_parity(y);
-
- BIG_copy(x,P->x);
- FP_redc(x);
-
- return s;
-}
-
-/* Set P=(x,{y}) */
-/* SU=96 */
-int ECP_set(ECP *P,BIG x,BIG y)
-{
- BIG rhs,y2;
- BIG_copy(y2,y);
-
- FP_nres(y2);
- FP_sqr(y2,y2);
- FP_reduce(y2);
-
-
-
- BIG_copy(rhs,x);
- FP_nres(rhs);
-
- ECP_rhs(rhs,rhs);
-
- if (BIG_comp(y2,rhs)!=0)
- {
- ECP_inf(P);
- return 0;
- }
-#if CURVETYPE==WEIERSTRASS
- P->inf=0;
-#endif
- BIG_copy(P->x,x);
- FP_nres(P->x);
- BIG_copy(P->y,y);
- FP_nres(P->y);
- FP_one(P->z);
- return 1;
-}
-
-/* Set P=(x,y), where y is calculated from x with sign s */
-/* SU=136 */
-int ECP_setx(ECP *P,BIG x,int s)
-{
- BIG t,rhs,m;
- BIG_rcopy(m,Modulus);
-
- BIG_copy(rhs,x);
- FP_nres(rhs);
- ECP_rhs(rhs,rhs);
- BIG_copy(t,rhs);
- FP_redc(t);
- if (BIG_jacobi(t,m)!=1)
- {
- ECP_inf(P);
- return 0;
- }
-#if CURVETYPE==WEIERSTRASS
- P->inf=0;
-#endif
- BIG_copy(P->x,x);
- FP_nres(P->x);
-
- FP_sqrt(P->y,rhs);
- BIG_copy(rhs,P->y);
- FP_redc(rhs);
- if (BIG_parity(rhs)!=s)
- FP_neg(P->y,P->y);
- FP_reduce(P->y);
- FP_one(P->z);
- return 1;
-}
-
-#endif
-
-/* Convert P to Affine, from (x,y,z) to (x,y) */
-/* SU=160 */
-void ECP_affine(ECP *P)
-{
- BIG one,iz,m;
-#if CURVETYPE==WEIERSTRASS
- BIG izn;
- if (ECP_isinf(P)) return;
- FP_one(one);
- if (BIG_comp(P->z,one)==0) return;
- BIG_rcopy(m,Modulus);
-
- FP_redc(P->z);
- BIG_invmodp(iz,P->z,m);
- FP_nres(iz);
-
- FP_sqr(izn,iz);
- FP_mul(P->x,P->x,izn);
- FP_mul(izn,izn,iz);
- FP_mul(P->y,P->y,izn);
- FP_reduce(P->y);
-
-#endif
-#if CURVETYPE==EDWARDS
- FP_one(one);
- if (BIG_comp(P->z,one)==0) return;
- BIG_rcopy(m,Modulus);
-
- FP_redc(P->z);
- BIG_invmodp(iz,P->z,m);
- FP_nres(iz);
-
- FP_mul(P->x,P->x,iz);
- FP_mul(P->y,P->y,iz);
- FP_reduce(P->y);
-
-#endif
-#if CURVETYPE==MONTGOMERY
- if (ECP_isinf(P)) return;
- FP_one(one);
- if (BIG_comp(P->z,one)==0) return;
-
- BIG_rcopy(m,Modulus);
-
- FP_redc(P->z);
- BIG_invmodp(iz,P->z,m);
- FP_nres(iz);
-
- FP_mul(P->x,P->x,iz);
-
-#endif
- FP_reduce(P->x);
- BIG_copy(P->z,one);
-}
-
-/* SU=120 */
-void ECP_outputxyz(ECP *P)
-{
- BIG x,z;
- if (ECP_isinf(P))
- {
- printf("Infinity\n");
- return;
- }
- BIG_copy(x,P->x);
- FP_reduce(x);
- FP_redc(x);
- BIG_copy(z,P->z);
- FP_reduce(z);
- FP_redc(z);
-
-#if CURVETYPE!=MONTGOMERY
- BIG y;
- BIG_copy(y,P->y);
- FP_reduce(y);
- FP_redc(y);
- printf("(");
- BIG_output(x);
- printf(",");
- BIG_output(y);
- printf(",");
- BIG_output(z);
- printf(")\n");
-
-#else
- printf("(");
- BIG_output(x);
- printf(",");
- BIG_output(z);
- printf(")\n");
-#endif
-}
-
-/* SU=16 */
-/* Output point P */
-void ECP_output(ECP *P)
-{
- if (ECP_isinf(P))
- {
- printf("Infinity\n");
- return;
- }
- ECP_affine(P);
-#if CURVETYPE!=MONTGOMERY
- FP_redc(P->x);
- FP_redc(P->y);
- printf("(");
- BIG_output(P->x);
- printf(",");
- BIG_output(P->y);
- printf(")\n");
- FP_nres(P->x);
- FP_nres(P->y);
-#else
- FP_redc(P->x);
- printf("(");
- BIG_output(P->x);
- printf(")\n");
- FP_nres(P->x);
-#endif
-}
-
-
-/* SU=88 */
-/* Convert P to octet string */
-void ECP_toOctet(octet *W,ECP *P)
-{
-#if CURVETYPE==MONTGOMERY
- BIG x;
- ECP_get(x,P);
- W->len=MODBYTES+1;
- W->val[0]=6;
- BIG_toBytes(&(W->val[1]),x);
-#else
- BIG x,y;
- ECP_get(x,y,P);
- W->len=2*MODBYTES+1;
- W->val[0]=4;
- BIG_toBytes(&(W->val[1]),x);
- BIG_toBytes(&(W->val[MODBYTES+1]),y);
-#endif
-}
-
-/* SU=88 */
-/* Restore P from octet string */
-int ECP_fromOctet(ECP *P,octet *W)
-{
-#if CURVETYPE==MONTGOMERY
- BIG x;
- BIG_fromBytes(x,&(W->val[1]));
- if (ECP_set(P,x)) return 1;
- return 0;
-#else
- BIG x,y;
- BIG_fromBytes(x,&(W->val[1]));
- BIG_fromBytes(y,&(W->val[MODBYTES+1]));
- if (ECP_set(P,x,y)) return 1;
- return 0;
-#endif
-}
-
-
-/* Set P=2P */
-/* SU=272 */
-void ECP_dbl(ECP *P)
-{
-#if CURVETYPE==WEIERSTRASS
- BIG one;
- BIG w1,w7,w8,w2,w3,w6;
- if (ECP_isinf(P)) return;
-
- if (BIG_iszilch(P->y))
- {
- P->inf=1;
- return;
- }
- FP_one(one);
- BIG_zero(w6);
-
- if (CURVE_A==-3)
- {
- if (BIG_comp(P->z,one)==0) BIG_copy(w6,one);
- else FP_sqr(w6,P->z);
- FP_neg(w1,w6);
- FP_add(w3,P->x,w1);
- FP_add(w8,P->x,w6);
- FP_mul(w3,w3,w8);
- BIG_imul(w8,w3,3);
- }
- else
- {
- /* assuming A=0 */
- FP_sqr(w1,P->x);
- BIG_imul(w8,w1,3);
- }
-
- FP_sqr(w2,P->y);
- FP_mul(w3,P->x,w2);
-
- BIG_imul(w3,w3,4);
- FP_neg(w1,w3);
-
- BIG_norm(w1);
-
- FP_sqr(P->x,w8);
- FP_add(P->x,P->x,w1);
- FP_add(P->x,P->x,w1);
-
- BIG_norm(P->x);
-
- if (BIG_comp(P->z,one)==0) BIG_copy(P->z,P->y);
- else FP_mul(P->z,P->z,P->y);
- FP_add(P->z,P->z,P->z);
-
-
- FP_add(w7,w2,w2);
- FP_sqr(w2,w7);
-
- FP_add(w2,w2,w2);
- FP_sub(w3,w3,P->x);
- FP_mul(P->y,w8,w3);
-
- FP_sub(P->y,P->y,w2);
-
- BIG_norm(P->y);
- BIG_norm(P->z);
-
-#endif
-
-#if CURVETYPE==EDWARDS
- /* Not using square for multiplication swap, as (1) it needs more adds, and (2) it triggers more reductions */
- BIG B,C,D,E,F,H,J;
-
- FP_mul(B,P->x,P->y);
- FP_add(B,B,B);
- FP_sqr(C,P->x);
- FP_sqr(D,P->y);
- if (CURVE_A==1) BIG_copy(E,C);
- if (CURVE_A==-1) FP_neg(E,C);
- FP_add(F,E,D);
-
- BIG_norm(F);
-
- FP_sqr(H,P->z);
- FP_add(H,H,H);
- FP_sub(J,F,H);
- FP_mul(P->x,B,J);
- FP_sub(E,E,D);
- FP_mul(P->y,F,E);
- FP_mul(P->z,F,J);
-
- BIG_norm(P->x);
- BIG_norm(P->y);
- BIG_norm(P->z);
-
-#endif
-
-#if CURVETYPE==MONTGOMERY
- BIG A,B,AA,BB,C;
- if (ECP_isinf(P)) return;
-
- FP_add(A,P->x,P->z);
- FP_sqr(AA,A);
- FP_sub(B,P->x,P->z);
- FP_sqr(BB,B);
- FP_sub(C,AA,BB);
-
- FP_mul(P->x,AA,BB);
- FP_imul(A,C,(CURVE_A+2)/4);
- FP_add(BB,BB,A);
- FP_mul(P->z,BB,C);
-
- BIG_norm(P->x);
- BIG_norm(P->z);
-#endif
-}
-
-#if CURVETYPE==MONTGOMERY
-
-/* Set P+=Q. W is difference between P and Q and is affine */
-void ECP_add(ECP *P,ECP *Q,ECP *W)
-{
- BIG A,B,C,D,DA,CB;
-
- FP_add(A,P->x,P->z);
- FP_sub(B,P->x,P->z);
-
- FP_add(C,Q->x,Q->z);
- FP_sub(D,Q->x,Q->z);
-
- FP_mul(DA,D,A);
- FP_mul(CB,C,B);
-
- FP_add(A,DA,CB);
- FP_sqr(A,A);
- FP_sub(B,DA,CB);
- FP_sqr(B,B);
-
- BIG_copy(P->x,A);
- FP_mul(P->z,W->x,B);
-
- FP_reduce(P->z);
- if (BIG_iszilch(P->z)) P->inf=1;
- else P->inf=0;
-
- BIG_norm(P->x);
-}
-
-
-#else
-
-/* Set P+=Q */
-/* SU=248 */
-void ECP_add(ECP *P,ECP *Q)
-{
-#if CURVETYPE==WEIERSTRASS
- int aff;
- BIG one,B,D,E,C,A;
- if (ECP_isinf(Q)) return;
- if (ECP_isinf(P))
- {
- ECP_copy(P,Q);
- return;
- }
-
- FP_one(one);
- aff=1;
- if (BIG_comp(Q->z,one)!=0) aff=0;
-
- if (!aff)
- {
- FP_sqr(A,Q->z);
- FP_mul(C,A,Q->z);
-
- FP_sqr(B,P->z);
- FP_mul(D,B,P->z);
-
- FP_mul(A,P->x,A);
- FP_mul(C,P->y,C);
- }
- else
- {
- BIG_copy(A,P->x);
- BIG_copy(C,P->y);
-
- FP_sqr(B,P->z);
- FP_mul(D,B,P->z);
- }
-
- FP_mul(B,Q->x,B);
- FP_sub(B,B,A); /* B=Qx.z^2-x.Qz^2 */
- FP_mul(D,Q->y,D);
- FP_sub(D,D,C); /* D=Qy.z^3-y.Qz^3 */
-
- FP_reduce(B);
- if (BIG_iszilch(B))
- {
- FP_reduce(D);
- if (BIG_iszilch(D))
- {
- ECP_dbl(P);
- return;
- }
- else
- {
- ECP_inf(P);
- return;
- }
- }
- if (!aff) FP_mul(P->z,P->z,Q->z);
- FP_mul(P->z,P->z,B);
-
- FP_sqr(E,B);
- FP_mul(B,B,E);
- FP_mul(A,A,E);
-
- FP_add(E,A,A);
- FP_add(E,E,B);
-
- FP_sqr(P->x,D);
- FP_sub(P->x,P->x,E);
-
- FP_sub(A,A,P->x);
- FP_mul(P->y,A,D);
- FP_mul(C,C,B);
- FP_sub(P->y,P->y,C);
-
- BIG_norm(P->x);
- BIG_norm(P->y);
- BIG_norm(P->z);
-
-#else
- BIG b,A,B,C,D,E,F,G;
-
- BIG_rcopy(b,CURVE_B);
- FP_nres(b);
- FP_mul(A,P->z,Q->z);
-
- FP_sqr(B,A);
- FP_mul(C,P->x,Q->x);
- FP_mul(D,P->y,Q->y);
- FP_mul(E,C,D);
- FP_mul(E,E,b);
-
- FP_sub(F,B,E);
- FP_add(G,B,E);
-
- if (CURVE_A==1) FP_sub(E,D,C);
- FP_add(C,C,D);
-
- FP_add(B,P->x,P->y);
- FP_add(D,Q->x,Q->y);
- FP_mul(B,B,D);
- FP_sub(B,B,C);
- FP_mul(B,B,F);
- FP_mul(P->x,A,B);
-
-
- if (CURVE_A==1) FP_mul(C,E,G);
- if (CURVE_A==-1)FP_mul(C,C,G);
-
- FP_mul(P->y,A,C);
- FP_mul(P->z,F,G);
-
- BIG_norm(P->x);
- BIG_norm(P->y);
- BIG_norm(P->z);
-
-#endif
-}
-
-/* Set P-=Q */
-/* SU=16 */
-void ECP_sub(ECP *P,ECP *Q)
-{
- ECP_neg(Q);
- ECP_add(P,Q);
- ECP_neg(Q);
-}
-
-#endif
-
-
-#if CURVETYPE==WEIERSTRASS
-/* normalises array of points. Assumes P[0] is normalised already */
-
-static void ECP_multiaffine(int m,ECP P[],BIG work[])
-{
- int i;
- BIG t1,t2;
-
- FP_one(work[0]);
- BIG_copy(work[1],P[0].z);
- for (i=2; i<m; i++)
- FP_mul(work[i],work[i-1],P[i-1].z);
-
- FP_mul(t1,work[m-1],P[m-1].z);
- FP_inv(t1,t1);
-
- BIG_copy(t2,P[m-1].z);
- FP_mul(work[m-1],work[m-1],t1);
-
- for (i=m-2;; i--)
- {
- if (i==0)
- {
- FP_mul(work[0],t1,t2);
- break;
- }
- FP_mul(work[i],work[i],t2);
- FP_mul(work[i],work[i],t1);
- FP_mul(t2,P[i].z,t2);
- }
- /* now work[] contains inverses of all Z coordinates */
-
- for (i=0; i<m; i++)
- {
- FP_one(P[i].z);
- FP_sqr(t1,work[i]);
- FP_mul(P[i].x,P[i].x,t1);
- FP_mul(t1,work[i],t1);
- FP_mul(P[i].y,P[i].y,t1);
- }
-}
-
-#endif
-
-#if CURVETYPE!=MONTGOMERY
-/* constant time multiply by small integer of length bts - use ladder */
-void ECP_pinmul(ECP *P,int e,int bts)
-{
- int i,b;
- ECP R0,R1;
-
- ECP_affine(P);
- ECP_inf(&R0);
- ECP_copy(&R1,P);
-
- for (i=bts-1; i>=0; i--)
- {
- b=(e>>i)&1;
- ECP_copy(P,&R1);
- ECP_add(P,&R0);
- ECP_cswap(&R0,&R1,b);
- ECP_copy(&R1,P);
- ECP_dbl(&R0);
- ECP_cswap(&R0,&R1,b);
- }
- ECP_copy(P,&R0);
- ECP_affine(P);
-}
-#endif
-
-/* Set P=r*P */
-/* SU=424 */
-void ECP_mul(ECP *P,BIG e)
-{
-#if CURVETYPE==MONTGOMERY
- /* Montgomery ladder */
- int nb,i,b;
- ECP R0,R1,D;
- if (ECP_isinf(P)) return;
- if (BIG_iszilch(e))
- {
- ECP_inf(P);
- return;
- }
- ECP_affine(P);
-
- ECP_copy(&R0,P);
- ECP_copy(&R1,P);
- ECP_dbl(&R1);
- ECP_copy(&D,P);
-
- nb=BIG_nbits(e);
- for (i=nb-2; i>=0; i--)
- {
- b=BIG_bit(e,i);
- ECP_copy(P,&R1);
- ECP_add(P,&R0,&D);
- ECP_cswap(&R0,&R1,b);
- ECP_copy(&R1,P);
- ECP_dbl(&R0);
- ECP_cswap(&R0,&R1,b);
- }
- ECP_copy(P,&R0);
-
-#else
- /* fixed size windows */
- int i,nb,s,ns;
- BIG mt,t;
- ECP Q,W[8],C;
- sign8 w[1+(NLEN*BASEBITS+3)/4];
-#if CURVETYPE==WEIERSTRASS
- BIG work[8];
-#endif
- if (ECP_isinf(P)) return;
- if (BIG_iszilch(e))
- {
- ECP_inf(P);
- return;
- }
-
- ECP_affine(P);
-
- /* precompute table */
-
- ECP_copy(&Q,P);
- ECP_dbl(&Q);
-
-//printf("Q= ");ECP_output(&Q); printf("\n");
-
- ECP_copy(&W[0],P);
-
- for (i=1; i<8; i++)
- {
- ECP_copy(&W[i],&W[i-1]);
- ECP_add(&W[i],&Q);
- }
-
-//printf("W[1]= ");ECP_output(&W[1]); printf("\n");
-
- /* convert the table to affine */
-#if CURVETYPE==WEIERSTRASS
- ECP_multiaffine(8,W,work);
-#endif
-
- /* make exponent odd - add 2P if even, P if odd */
- BIG_copy(t,e);
- s=BIG_parity(t);
- BIG_inc(t,1);
- BIG_norm(t);
- ns=BIG_parity(t);
- BIG_copy(mt,t);
- BIG_inc(mt,1);
- BIG_norm(mt);
- BIG_cmove(t,mt,s);
- ECP_cmove(&Q,P,ns);
- ECP_copy(&C,&Q);
-
- nb=1+(BIG_nbits(t)+3)/4;
-
- /* convert exponent to signed 4-bit window */
- for (i=0; i<nb; i++)
- {
- w[i]=BIG_lastbits(t,5)-16;
- BIG_dec(t,w[i]);
- BIG_norm(t);
- BIG_fshr(t,4);
- }
- w[nb]=BIG_lastbits(t,5);
-
- ECP_copy(P,&W[(w[nb]-1)/2]);
- for (i=nb-1; i>=0; i--)
- {
- ECP_select(&Q,W,w[i]);
- ECP_dbl(P);
- ECP_dbl(P);
- ECP_dbl(P);
- ECP_dbl(P);
- ECP_add(P,&Q);
- }
- ECP_sub(P,&C); /* apply correction */
-#endif
- ECP_affine(P);
-}
-
-#if CURVETYPE!=MONTGOMERY
-/* Set P=eP+fQ double multiplication */
-/* constant time - as useful for GLV method in pairings */
-/* SU=456 */
-
-void ECP_mul2(ECP *P,ECP *Q,BIG e,BIG f)
-{
- BIG te,tf,mt;
- ECP S,T,W[8],C;
- sign8 w[1+(NLEN*BASEBITS+1)/2];
- int i,a,b,s,ns,nb;
-#if CURVETYPE==WEIERSTRASS
- BIG work[8];
-#endif
-
- ECP_affine(P);
- ECP_affine(Q);
-
- BIG_copy(te,e);
- BIG_copy(tf,f);
-
- /* precompute table */
- ECP_copy(&W[1],P);
- ECP_sub(&W[1],Q); /* P+Q */
- ECP_copy(&W[2],P);
- ECP_add(&W[2],Q); /* P-Q */
- ECP_copy(&S,Q);
- ECP_dbl(&S); /* S=2Q */
- ECP_copy(&W[0],&W[1]);
- ECP_sub(&W[0],&S);
- ECP_copy(&W[3],&W[2]);
- ECP_add(&W[3],&S);
- ECP_copy(&T,P);
- ECP_dbl(&T); /* T=2P */
- ECP_copy(&W[5],&W[1]);
- ECP_add(&W[5],&T);
- ECP_copy(&W[6],&W[2]);
- ECP_add(&W[6],&T);
- ECP_copy(&W[4],&W[5]);
- ECP_sub(&W[4],&S);
- ECP_copy(&W[7],&W[6]);
- ECP_add(&W[7],&S);
-
-#if CURVETYPE==WEIERSTRASS
- ECP_multiaffine(8,W,work);
-#endif
-
- /* if multiplier is odd, add 2, else add 1 to multiplier, and add 2P or P to correction */
-
- s=BIG_parity(te);
- BIG_inc(te,1);
- BIG_norm(te);
- ns=BIG_parity(te);
- BIG_copy(mt,te);
- BIG_inc(mt,1);
- BIG_norm(mt);
- BIG_cmove(te,mt,s);
- ECP_cmove(&T,P,ns);
- ECP_copy(&C,&T);
-
- s=BIG_parity(tf);
- BIG_inc(tf,1);
- BIG_norm(tf);
- ns=BIG_parity(tf);
- BIG_copy(mt,tf);
- BIG_inc(mt,1);
- BIG_norm(mt);
- BIG_cmove(tf,mt,s);
- ECP_cmove(&S,Q,ns);
- ECP_add(&C,&S);
-
- BIG_add(mt,te,tf);
- BIG_norm(mt);
- nb=1+(BIG_nbits(mt)+1)/2;
-
- /* convert exponent to signed 2-bit window */
- for (i=0; i<nb; i++)
- {
... 294137 lines suppressed ...