|
142
|
1 #include <tommath.h> |
|
|
2 #ifdef BN_FAST_MP_MONTGOMERY_REDUCE_C |
|
2
|
3 /* LibTomMath, multiple-precision integer library -- Tom St Denis |
|
|
4 * |
|
|
5 * LibTomMath is a library that provides multiple-precision |
|
|
6 * integer arithmetic as well as number theoretic functionality. |
|
|
7 * |
|
|
8 * The library was designed directly after the MPI library by |
|
|
9 * Michael Fromberger but has been written from scratch with |
|
|
10 * additional optimizations in place. |
|
|
11 * |
|
|
12 * The library is free for all purposes without any express |
|
|
13 * guarantee it works. |
|
|
14 * |
|
|
15 * Tom St Denis, [email protected], http://math.libtomcrypt.org |
|
|
16 */ |
|
|
17 |
|
|
18 /* computes xR**-1 == x (mod N) via Montgomery Reduction |
|
|
19 * |
|
142
|
20 * This is an optimized implementation of montgomery_reduce |
|
2
|
21 * which uses the comba method to quickly calculate the columns of the |
|
|
22 * reduction. |
|
|
23 * |
|
|
24 * Based on Algorithm 14.32 on pp.601 of HAC. |
|
|
25 */ |
|
|
26 int |
|
|
27 fast_mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho) |
|
|
28 { |
|
|
29 int ix, res, olduse; |
|
|
30 mp_word W[MP_WARRAY]; |
|
|
31 |
|
|
32 /* get old used count */ |
|
|
33 olduse = x->used; |
|
|
34 |
|
|
35 /* grow a as required */ |
|
|
36 if (x->alloc < n->used + 1) { |
|
|
37 if ((res = mp_grow (x, n->used + 1)) != MP_OKAY) { |
|
|
38 return res; |
|
|
39 } |
|
|
40 } |
|
|
41 |
|
|
42 /* first we have to get the digits of the input into |
|
|
43 * an array of double precision words W[...] |
|
|
44 */ |
|
|
45 { |
|
|
46 register mp_word *_W; |
|
|
47 register mp_digit *tmpx; |
|
|
48 |
|
|
49 /* alias for the W[] array */ |
|
|
50 _W = W; |
|
|
51 |
|
|
52 /* alias for the digits of x*/ |
|
|
53 tmpx = x->dp; |
|
|
54 |
|
|
55 /* copy the digits of a into W[0..a->used-1] */ |
|
|
56 for (ix = 0; ix < x->used; ix++) { |
|
|
57 *_W++ = *tmpx++; |
|
|
58 } |
|
|
59 |
|
|
60 /* zero the high words of W[a->used..m->used*2] */ |
|
|
61 for (; ix < n->used * 2 + 1; ix++) { |
|
|
62 *_W++ = 0; |
|
|
63 } |
|
|
64 } |
|
|
65 |
|
|
66 /* now we proceed to zero successive digits |
|
|
67 * from the least significant upwards |
|
|
68 */ |
|
|
69 for (ix = 0; ix < n->used; ix++) { |
|
|
70 /* mu = ai * m' mod b |
|
|
71 * |
|
|
72 * We avoid a double precision multiplication (which isn't required) |
|
|
73 * by casting the value down to a mp_digit. Note this requires |
|
|
74 * that W[ix-1] have the carry cleared (see after the inner loop) |
|
|
75 */ |
|
|
76 register mp_digit mu; |
|
|
77 mu = (mp_digit) (((W[ix] & MP_MASK) * rho) & MP_MASK); |
|
|
78 |
|
|
79 /* a = a + mu * m * b**i |
|
|
80 * |
|
|
81 * This is computed in place and on the fly. The multiplication |
|
|
82 * by b**i is handled by offseting which columns the results |
|
|
83 * are added to. |
|
|
84 * |
|
|
85 * Note the comba method normally doesn't handle carries in the |
|
|
86 * inner loop In this case we fix the carry from the previous |
|
|
87 * column since the Montgomery reduction requires digits of the |
|
|
88 * result (so far) [see above] to work. This is |
|
|
89 * handled by fixing up one carry after the inner loop. The |
|
|
90 * carry fixups are done in order so after these loops the |
|
|
91 * first m->used words of W[] have the carries fixed |
|
|
92 */ |
|
|
93 { |
|
|
94 register int iy; |
|
|
95 register mp_digit *tmpn; |
|
|
96 register mp_word *_W; |
|
|
97 |
|
|
98 /* alias for the digits of the modulus */ |
|
|
99 tmpn = n->dp; |
|
|
100 |
|
|
101 /* Alias for the columns set by an offset of ix */ |
|
|
102 _W = W + ix; |
|
|
103 |
|
|
104 /* inner loop */ |
|
|
105 for (iy = 0; iy < n->used; iy++) { |
|
|
106 *_W++ += ((mp_word)mu) * ((mp_word)*tmpn++); |
|
|
107 } |
|
|
108 } |
|
|
109 |
|
|
110 /* now fix carry for next digit, W[ix+1] */ |
|
|
111 W[ix + 1] += W[ix] >> ((mp_word) DIGIT_BIT); |
|
|
112 } |
|
|
113 |
|
|
114 /* now we have to propagate the carries and |
|
|
115 * shift the words downward [all those least |
|
|
116 * significant digits we zeroed]. |
|
|
117 */ |
|
|
118 { |
|
|
119 register mp_digit *tmpx; |
|
|
120 register mp_word *_W, *_W1; |
|
|
121 |
|
|
122 /* nox fix rest of carries */ |
|
|
123 |
|
|
124 /* alias for current word */ |
|
|
125 _W1 = W + ix; |
|
|
126 |
|
|
127 /* alias for next word, where the carry goes */ |
|
|
128 _W = W + ++ix; |
|
|
129 |
|
|
130 for (; ix <= n->used * 2 + 1; ix++) { |
|
|
131 *_W++ += *_W1++ >> ((mp_word) DIGIT_BIT); |
|
|
132 } |
|
|
133 |
|
|
134 /* copy out, A = A/b**n |
|
|
135 * |
|
|
136 * The result is A/b**n but instead of converting from an |
|
|
137 * array of mp_word to mp_digit than calling mp_rshd |
|
|
138 * we just copy them in the right order |
|
|
139 */ |
|
|
140 |
|
|
141 /* alias for destination word */ |
|
|
142 tmpx = x->dp; |
|
|
143 |
|
|
144 /* alias for shifted double precision result */ |
|
|
145 _W = W + n->used; |
|
|
146 |
|
|
147 for (ix = 0; ix < n->used + 1; ix++) { |
|
|
148 *tmpx++ = (mp_digit)(*_W++ & ((mp_word) MP_MASK)); |
|
|
149 } |
|
|
150 |
|
|
151 /* zero oldused digits, if the input a was larger than |
|
|
152 * m->used+1 we'll have to clear the digits |
|
|
153 */ |
|
|
154 for (; ix < olduse; ix++) { |
|
|
155 *tmpx++ = 0; |
|
|
156 } |
|
|
157 } |
|
|
158 |
|
|
159 /* set the max used and clamp */ |
|
|
160 x->used = n->used + 1; |
|
|
161 mp_clamp (x); |
|
|
162 |
|
|
163 /* if A >= m then A = A - m */ |
|
|
164 if (mp_cmp_mag (x, n) != MP_LT) { |
|
|
165 return s_mp_sub (x, n, x); |
|
|
166 } |
|
|
167 return MP_OKAY; |
|
|
168 } |
|
142
|
169 #endif |
