|
2
|
1 /* LibTomMath, multiple-precision integer library -- Tom St Denis |
|
|
2 * |
|
|
3 * LibTomMath is a library that provides multiple-precision |
|
|
4 * integer arithmetic as well as number theoretic functionality. |
|
|
5 * |
|
|
6 * The library was designed directly after the MPI library by |
|
|
7 * Michael Fromberger but has been written from scratch with |
|
|
8 * additional optimizations in place. |
|
|
9 * |
|
|
10 * The library is free for all purposes without any express |
|
|
11 * guarantee it works. |
|
|
12 * |
|
|
13 * Tom St Denis, [email protected], http://math.libtomcrypt.org |
|
|
14 */ |
|
|
15 #include <tommath.h> |
|
|
16 |
|
|
17 /* computes xR**-1 == x (mod N) via Montgomery Reduction */ |
|
|
18 int |
|
|
19 mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho) |
|
|
20 { |
|
|
21 int ix, res, digs; |
|
|
22 mp_digit mu; |
|
|
23 |
|
|
24 /* can the fast reduction [comba] method be used? |
|
|
25 * |
|
|
26 * Note that unlike in mp_mul you're safely allowed *less* |
|
|
27 * than the available columns [255 per default] since carries |
|
|
28 * are fixed up in the inner loop. |
|
|
29 */ |
|
|
30 digs = n->used * 2 + 1; |
|
|
31 if ((digs < MP_WARRAY) && |
|
|
32 n->used < |
|
|
33 (1 << ((CHAR_BIT * sizeof (mp_word)) - (2 * DIGIT_BIT)))) { |
|
|
34 return fast_mp_montgomery_reduce (x, n, rho); |
|
|
35 } |
|
|
36 |
|
|
37 /* grow the input as required */ |
|
|
38 if (x->alloc < digs) { |
|
|
39 if ((res = mp_grow (x, digs)) != MP_OKAY) { |
|
|
40 return res; |
|
|
41 } |
|
|
42 } |
|
|
43 x->used = digs; |
|
|
44 |
|
|
45 for (ix = 0; ix < n->used; ix++) { |
|
|
46 /* mu = ai * rho mod b |
|
|
47 * |
|
|
48 * The value of rho must be precalculated via |
|
|
49 * bn_mp_montgomery_setup() such that |
|
|
50 * it equals -1/n0 mod b this allows the |
|
|
51 * following inner loop to reduce the |
|
|
52 * input one digit at a time |
|
|
53 */ |
|
|
54 mu = (mp_digit) (((mp_word)x->dp[ix]) * ((mp_word)rho) & MP_MASK); |
|
|
55 |
|
|
56 /* a = a + mu * m * b**i */ |
|
|
57 { |
|
|
58 register int iy; |
|
|
59 register mp_digit *tmpn, *tmpx, u; |
|
|
60 register mp_word r; |
|
|
61 |
|
|
62 /* alias for digits of the modulus */ |
|
|
63 tmpn = n->dp; |
|
|
64 |
|
|
65 /* alias for the digits of x [the input] */ |
|
|
66 tmpx = x->dp + ix; |
|
|
67 |
|
|
68 /* set the carry to zero */ |
|
|
69 u = 0; |
|
|
70 |
|
|
71 /* Multiply and add in place */ |
|
|
72 for (iy = 0; iy < n->used; iy++) { |
|
|
73 /* compute product and sum */ |
|
|
74 r = ((mp_word)mu) * ((mp_word)*tmpn++) + |
|
|
75 ((mp_word) u) + ((mp_word) * tmpx); |
|
|
76 |
|
|
77 /* get carry */ |
|
|
78 u = (mp_digit)(r >> ((mp_word) DIGIT_BIT)); |
|
|
79 |
|
|
80 /* fix digit */ |
|
|
81 *tmpx++ = (mp_digit)(r & ((mp_word) MP_MASK)); |
|
|
82 } |
|
|
83 /* At this point the ix'th digit of x should be zero */ |
|
|
84 |
|
|
85 |
|
|
86 /* propagate carries upwards as required*/ |
|
|
87 while (u) { |
|
|
88 *tmpx += u; |
|
|
89 u = *tmpx >> DIGIT_BIT; |
|
|
90 *tmpx++ &= MP_MASK; |
|
|
91 } |
|
|
92 } |
|
|
93 } |
|
|
94 |
|
|
95 /* at this point the n.used'th least |
|
|
96 * significant digits of x are all zero |
|
|
97 * which means we can shift x to the |
|
|
98 * right by n.used digits and the |
|
|
99 * residue is unchanged. |
|
|
100 */ |
|
|
101 |
|
|
102 /* x = x/b**n.used */ |
|
|
103 mp_clamp(x); |
|
|
104 mp_rshd (x, n->used); |
|
|
105 |
|
|
106 /* if x >= n then x = x - n */ |
|
|
107 if (mp_cmp_mag (x, n) != MP_LT) { |
|
|
108 return s_mp_sub (x, n, x); |
|
|
109 } |
|
|
110 |
|
|
111 return MP_OKAY; |
|
|
112 } |
