Mercurial > dropbear
annotate bn_fast_mp_montgomery_reduce.c @ 203:e109027b9edf libtommath LTM_DB_0.46 LTM_DB_0.47
Don't remove ~ files on make clean (and find -type was wrong anyway)
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Wed, 11 May 2005 16:27:28 +0000 |
| parents | d8254fc979e9 |
| children |
| rev | line source |
|---|---|
| 142 | 1 #include <tommath.h> |
| 2 #ifdef BN_FAST_MP_MONTGOMERY_REDUCE_C | |
| 2 | 3 /* LibTomMath, multiple-precision integer library -- Tom St Denis |
| 4 * | |
| 5 * LibTomMath is a library that provides multiple-precision | |
| 6 * integer arithmetic as well as number theoretic functionality. | |
| 7 * | |
| 8 * The library was designed directly after the MPI library by | |
| 9 * Michael Fromberger but has been written from scratch with | |
| 10 * additional optimizations in place. | |
| 11 * | |
| 12 * The library is free for all purposes without any express | |
| 13 * guarantee it works. | |
| 14 * | |
| 15 * Tom St Denis, [email protected], http://math.libtomcrypt.org | |
| 16 */ | |
| 17 | |
| 18 /* computes xR**-1 == x (mod N) via Montgomery Reduction | |
| 19 * | |
| 142 | 20 * This is an optimized implementation of montgomery_reduce |
| 2 | 21 * which uses the comba method to quickly calculate the columns of the |
| 22 * reduction. | |
| 23 * | |
| 24 * Based on Algorithm 14.32 on pp.601 of HAC. | |
| 25 */ | |
|
190
d8254fc979e9
Initial import of libtommath 0.35
Matt Johnston <matt@ucc.asn.au>
parents:
142
diff
changeset
|
26 int fast_mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho) |
| 2 | 27 { |
| 28 int ix, res, olduse; | |
| 29 mp_word W[MP_WARRAY]; | |
| 30 | |
| 31 /* get old used count */ | |
| 32 olduse = x->used; | |
| 33 | |
| 34 /* grow a as required */ | |
| 35 if (x->alloc < n->used + 1) { | |
| 36 if ((res = mp_grow (x, n->used + 1)) != MP_OKAY) { | |
| 37 return res; | |
| 38 } | |
| 39 } | |
| 40 | |
| 41 /* first we have to get the digits of the input into | |
| 42 * an array of double precision words W[...] | |
| 43 */ | |
| 44 { | |
| 45 register mp_word *_W; | |
| 46 register mp_digit *tmpx; | |
| 47 | |
| 48 /* alias for the W[] array */ | |
| 49 _W = W; | |
| 50 | |
| 51 /* alias for the digits of x*/ | |
| 52 tmpx = x->dp; | |
| 53 | |
| 54 /* copy the digits of a into W[0..a->used-1] */ | |
| 55 for (ix = 0; ix < x->used; ix++) { | |
| 56 *_W++ = *tmpx++; | |
| 57 } | |
| 58 | |
| 59 /* zero the high words of W[a->used..m->used*2] */ | |
| 60 for (; ix < n->used * 2 + 1; ix++) { | |
| 61 *_W++ = 0; | |
| 62 } | |
| 63 } | |
| 64 | |
| 65 /* now we proceed to zero successive digits | |
| 66 * from the least significant upwards | |
| 67 */ | |
| 68 for (ix = 0; ix < n->used; ix++) { | |
| 69 /* mu = ai * m' mod b | |
| 70 * | |
| 71 * We avoid a double precision multiplication (which isn't required) | |
| 72 * by casting the value down to a mp_digit. Note this requires | |
| 73 * that W[ix-1] have the carry cleared (see after the inner loop) | |
| 74 */ | |
| 75 register mp_digit mu; | |
| 76 mu = (mp_digit) (((W[ix] & MP_MASK) * rho) & MP_MASK); | |
| 77 | |
| 78 /* a = a + mu * m * b**i | |
| 79 * | |
| 80 * This is computed in place and on the fly. The multiplication | |
| 81 * by b**i is handled by offseting which columns the results | |
| 82 * are added to. | |
| 83 * | |
| 84 * Note the comba method normally doesn't handle carries in the | |
| 85 * inner loop In this case we fix the carry from the previous | |
| 86 * column since the Montgomery reduction requires digits of the | |
| 87 * result (so far) [see above] to work. This is | |
| 88 * handled by fixing up one carry after the inner loop. The | |
| 89 * carry fixups are done in order so after these loops the | |
| 90 * first m->used words of W[] have the carries fixed | |
| 91 */ | |
| 92 { | |
| 93 register int iy; | |
| 94 register mp_digit *tmpn; | |
| 95 register mp_word *_W; | |
| 96 | |
| 97 /* alias for the digits of the modulus */ | |
| 98 tmpn = n->dp; | |
| 99 | |
| 100 /* Alias for the columns set by an offset of ix */ | |
| 101 _W = W + ix; | |
| 102 | |
| 103 /* inner loop */ | |
| 104 for (iy = 0; iy < n->used; iy++) { | |
| 105 *_W++ += ((mp_word)mu) * ((mp_word)*tmpn++); | |
| 106 } | |
| 107 } | |
| 108 | |
| 109 /* now fix carry for next digit, W[ix+1] */ | |
| 110 W[ix + 1] += W[ix] >> ((mp_word) DIGIT_BIT); | |
| 111 } | |
| 112 | |
| 113 /* now we have to propagate the carries and | |
| 114 * shift the words downward [all those least | |
| 115 * significant digits we zeroed]. | |
| 116 */ | |
| 117 { | |
| 118 register mp_digit *tmpx; | |
| 119 register mp_word *_W, *_W1; | |
| 120 | |
| 121 /* nox fix rest of carries */ | |
| 122 | |
| 123 /* alias for current word */ | |
| 124 _W1 = W + ix; | |
| 125 | |
| 126 /* alias for next word, where the carry goes */ | |
| 127 _W = W + ++ix; | |
| 128 | |
| 129 for (; ix <= n->used * 2 + 1; ix++) { | |
| 130 *_W++ += *_W1++ >> ((mp_word) DIGIT_BIT); | |
| 131 } | |
| 132 | |
| 133 /* copy out, A = A/b**n | |
| 134 * | |
| 135 * The result is A/b**n but instead of converting from an | |
| 136 * array of mp_word to mp_digit than calling mp_rshd | |
| 137 * we just copy them in the right order | |
| 138 */ | |
| 139 | |
| 140 /* alias for destination word */ | |
| 141 tmpx = x->dp; | |
| 142 | |
| 143 /* alias for shifted double precision result */ | |
| 144 _W = W + n->used; | |
| 145 | |
| 146 for (ix = 0; ix < n->used + 1; ix++) { | |
| 147 *tmpx++ = (mp_digit)(*_W++ & ((mp_word) MP_MASK)); | |
| 148 } | |
| 149 | |
| 150 /* zero oldused digits, if the input a was larger than | |
| 151 * m->used+1 we'll have to clear the digits | |
| 152 */ | |
| 153 for (; ix < olduse; ix++) { | |
| 154 *tmpx++ = 0; | |
| 155 } | |
| 156 } | |
| 157 | |
| 158 /* set the max used and clamp */ | |
| 159 x->used = n->used + 1; | |
| 160 mp_clamp (x); | |
| 161 | |
| 162 /* if A >= m then A = A - m */ | |
| 163 if (mp_cmp_mag (x, n) != MP_LT) { | |
| 164 return s_mp_sub (x, n, x); | |
| 165 } | |
| 166 return MP_OKAY; | |
| 167 } | |
| 142 | 168 #endif |