Mercurial > dropbear

comparison libtommath/bn_s_mp_montgomery_reduce_fast.c @ 1739:13d834efc376 fuzz

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
merge from main
author Matt Johnston <matt@ucc.asn.au>
date Thu, 15 Oct 2020 19:55:15 +0800
parents 1051e4eea25a
children
comparison
equal deleted inserted replaced
1562:768ebf737aa0 1739:13d834efc376
1 #include "tommath_private.h"
2 #ifdef BN_S_MP_MONTGOMERY_REDUCE_FAST_C
3 /* LibTomMath, multiple-precision integer library -- Tom St Denis */
4 /* SPDX-License-Identifier: Unlicense */
5
6 /* computes xR**-1 == x (mod N) via Montgomery Reduction
7 *
8 * This is an optimized implementation of montgomery_reduce
9 * which uses the comba method to quickly calculate the columns of the
10 * reduction.
11 *
12 * Based on Algorithm 14.32 on pp.601 of HAC.
13 */
14 mp_err s_mp_montgomery_reduce_fast(mp_int *x, const mp_int *n, mp_digit rho)
15 {
16 int ix, olduse;
17 mp_err err;
18 mp_word W[MP_WARRAY];
19
20 if (x->used > MP_WARRAY) {
21 return MP_VAL;
22 }
23
24 /* get old used count */
25 olduse = x->used;
26
27 /* grow a as required */
28 if (x->alloc < (n->used + 1)) {
29 if ((err = mp_grow(x, n->used + 1)) != MP_OKAY) {
30 return err;
31 }
32 }
33
34 /* first we have to get the digits of the input into
35 * an array of double precision words W[...]
36 */
37 {
38 mp_word *_W;
39 mp_digit *tmpx;
40
41 /* alias for the W[] array */
42 _W = W;
43
44 /* alias for the digits of x*/
45 tmpx = x->dp;
46
47 /* copy the digits of a into W[0..a->used-1] */
48 for (ix = 0; ix < x->used; ix++) {
49 *_W++ = *tmpx++;
50 }
51
52 /* zero the high words of W[a->used..m->used*2] */
53 if (ix < ((n->used * 2) + 1)) {
54 MP_ZERO_BUFFER(_W, sizeof(mp_word) * (size_t)(((n->used * 2) + 1) - ix));
55 }
56 }
57
58 /* now we proceed to zero successive digits
59 * from the least significant upwards
60 */
61 for (ix = 0; ix < n->used; ix++) {
62 /* mu = ai * m' mod b
63 *
64 * We avoid a double precision multiplication (which isn't required)
65 * by casting the value down to a mp_digit. Note this requires
66 * that W[ix-1] have the carry cleared (see after the inner loop)
67 */
68 mp_digit mu;
69 mu = ((W[ix] & MP_MASK) * rho) & MP_MASK;
70
71 /* a = a + mu * m * b**i
72 *
73 * This is computed in place and on the fly. The multiplication
74 * by b**i is handled by offseting which columns the results
75 * are added to.
76 *
77 * Note the comba method normally doesn't handle carries in the
78 * inner loop In this case we fix the carry from the previous
79 * column since the Montgomery reduction requires digits of the
80 * result (so far) [see above] to work. This is
81 * handled by fixing up one carry after the inner loop. The
82 * carry fixups are done in order so after these loops the
83 * first m->used words of W[] have the carries fixed
84 */
85 {
86 int iy;
87 mp_digit *tmpn;
88 mp_word *_W;
89
90 /* alias for the digits of the modulus */
91 tmpn = n->dp;
92
93 /* Alias for the columns set by an offset of ix */
94 _W = W + ix;
95
96 /* inner loop */
97 for (iy = 0; iy < n->used; iy++) {
98 *_W++ += (mp_word)mu * (mp_word)*tmpn++;
99 }
100 }
101
102 /* now fix carry for next digit, W[ix+1] */
103 W[ix + 1] += W[ix] >> (mp_word)MP_DIGIT_BIT;
104 }
105
106 /* now we have to propagate the carries and
107 * shift the words downward [all those least
108 * significant digits we zeroed].
109 */
110 {
111 mp_digit *tmpx;
112 mp_word *_W, *_W1;
113
114 /* nox fix rest of carries */
115
116 /* alias for current word */
117 _W1 = W + ix;
118
119 /* alias for next word, where the carry goes */
120 _W = W + ++ix;
121
122 for (; ix < ((n->used * 2) + 1); ix++) {
123 *_W++ += *_W1++ >> (mp_word)MP_DIGIT_BIT;
124 }
125
126 /* copy out, A = A/b**n
127 *
128 * The result is A/b**n but instead of converting from an
129 * array of mp_word to mp_digit than calling mp_rshd
130 * we just copy them in the right order
131 */
132
133 /* alias for destination word */
134 tmpx = x->dp;
135
136 /* alias for shifted double precision result */
137 _W = W + n->used;
138
139 for (ix = 0; ix < (n->used + 1); ix++) {
140 *tmpx++ = *_W++ & (mp_word)MP_MASK;
141 }
142
143 /* zero oldused digits, if the input a was larger than
144 * m->used+1 we'll have to clear the digits
145 */
146 MP_ZERO_DIGITS(tmpx, olduse - ix);
147 }
148
149 /* set the max used and clamp */
150 x->used = n->used + 1;
151 mp_clamp(x);
152
153 /* if A >= m then A = A - m */
154 if (mp_cmp_mag(x, n) != MP_LT) {
155 return s_mp_sub(x, n, x);
156 }
157 return MP_OKAY;
158 }
159 #endif