3 This file is part of the ARM-Crypto-Lib.
4 Copyright (C) 2008 Daniel Otte (daniel.otte@rub.de)
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * \license GPLv3 or later
30 #define STRING(x) STRING2(x)
31 #define STR_LINE STRING(__LINE__)
36 #define PREFERE_HEAP_SPACE 1
38 #if PREFERE_HEAP_SPACE
41 #define ALLOC_BIGINT_WORDS(var,words) bigint_word_t *(var) = malloc((words) * sizeof(bigint_word_t))
42 #define FREE(x) free(x)
46 #define ALLOC_BIGINT_WORDS(var,words) bigint_word_t var[words]
56 #include "bigint_io.h"
61 #define MAX(a,b) (((a)>(b))?(a):(b))
65 #define MIN(a,b) (((a) < (b)) ? (a) : (b))
68 #define SET_FBS(a, v) do {(a)->info &= ~BIGINT_FBS_MASK; (a)->info |= (v);} while(0)
69 #define GET_FBS(a) ((a)->info & BIGINT_FBS_MASK)
70 #define SET_NEG(a) (a)->info |= BIGINT_NEG_MASK
71 #define SET_POS(a) (a)->info &= ~BIGINT_NEG_MASK
72 #define XCHG(a,b) do{(a) ^= (b); (b) ^= (a); (a) ^= (b);} while(0)
73 #define XCHG_PTR(a,b) do{ a = (void*)(((intptr_t)(a)) ^ ((intptr_t)(b))); \
74 b = (void*)(((intptr_t)(a)) ^ ((intptr_t)(b))); \
75 a = (void*)(((intptr_t)(a)) ^ ((intptr_t)(b)));} while(0)
77 #define GET_SIGN(a) ((a)->info & BIGINT_NEG_MASK)
79 /******************************************************************************/
80 void bigint_adjust(bigint_t *a){
81 while (a->length_W != 0 && a->wordv[a->length_W - 1] == 0) {
84 if (a->length_W == 0) {
89 uint8_t i = BIGINT_WORD_SIZE - 1;
90 t = a->wordv[a->length_W - 1];
91 while ((t & (((bigint_word_t)1) << (BIGINT_WORD_SIZE - 1))) == 0 && i) {
98 /******************************************************************************/
100 bigint_length_t bigint_length_b(const bigint_t *a){
101 if(!a->length_W || a->length_W==0){
104 return (a->length_W-1) * BIGINT_WORD_SIZE + GET_FBS(a);
107 /******************************************************************************/
109 bigint_length_t bigint_length_B(const bigint_t *a){
110 return a->length_W * sizeof(bigint_word_t);
113 /******************************************************************************/
115 int32_t bigint_get_first_set_bit(const bigint_t *a){
116 if(a->length_W == 0) {
119 return (a->length_W-1) * sizeof(bigint_word_t) * CHAR_BIT + GET_FBS(a);
123 /******************************************************************************/
125 int32_t bigint_get_last_set_bit(const bigint_t *a){
129 if (a->length_W == 0) {
132 while (a->wordv[r] == 0 && r < a->length_W) {
135 if (a->wordv[r] == 0) {
136 return (uint32_t)(-1);
138 while ((x&a->wordv[r])==0) {
142 return r * BIGINT_WORD_SIZE + b;
145 /******************************************************************************/
147 void bigint_copy(bigint_t *dest, const bigint_t *src){
148 if(dest->wordv != src->wordv){
149 memcpy(dest->wordv, src->wordv, src->length_W * sizeof(bigint_word_t));
151 dest->length_W = src->length_W;
152 dest->info = src->info;
155 /******************************************************************************/
157 /* this should be implemented in assembly */
158 void bigint_add_u(bigint_t *dest, const bigint_t *a, const bigint_t *b){
160 bigint_wordplus_t t = 0LL;
161 if (a->length_W < b->length_W) {
164 for(i = 0; i < b->length_W; ++i) {
167 dest->wordv[i] = (bigint_word_t)t;
168 t >>= BIGINT_WORD_SIZE;
170 for(; i < a->length_W; ++i){
172 dest->wordv[i] = (bigint_word_t)t;
173 t >>= BIGINT_WORD_SIZE;
176 dest->wordv[i++] = (bigint_word_t)t;
183 /******************************************************************************/
185 /* this should be implemented in assembly */
186 void bigint_add_scale_u(bigint_t *dest, const bigint_t *a, bigint_length_t scale){
187 if(a->length_W == 0){
191 bigint_add_u(dest, dest, a);
195 #if BIGINT_WORD_SIZE == 8
196 memset(dest->wordv + dest->length_W, 0, MAX(dest->length_W, a->length_W + scale) - dest->length_W);
197 x.wordv = dest->wordv + scale;
198 x.length_W = dest->length_W - scale;
199 if((int16_t)x.length_W < 0){
205 bigint_add_u(&x, &x, a);
206 dest->length_W = x.length_W + scale;
211 bigint_length_t word_shift = scale / sizeof(bigint_word_t), byte_shift = scale % sizeof(bigint_word_t);
212 bigint_word_t bv[a->length_W + 1];
214 bv[0] = bv[a->length_W] = 0;
215 memcpy((uint8_t*)bv + byte_shift, a->wordv, a->length_W * sizeof(bigint_word_t));
216 s.length_W = a->length_W + 1;
218 memset(dest->wordv + dest->length_W, 0, (MAX(dest->length_W, s.length_W + word_shift) - dest->length_W) * sizeof(bigint_word_t));
219 x.wordv = dest->wordv + word_shift;
220 x.length_W = dest->length_W - word_shift;
221 if((int16_t)x.length_W < 0){
227 bigint_add_u(&x, &x, &s);
228 dest->length_W = x.length_W + word_shift;
234 /******************************************************************************/
236 /* this should be implemented in assembly */
237 void bigint_sub_u(bigint_t *dest, const bigint_t *a, const bigint_t *b){
240 bigint_wordplus_signed_t t = 0;
242 if(b->length_W == 0){
243 bigint_copy(dest, a);
247 if(a->length_W == 0){
248 bigint_copy(dest, b);
252 r = bigint_cmp_u(a,b);
254 bigint_set_zero(dest);
258 bigint_sub_u(dest, b, a);
262 for(i = 0; i < a->length_W; ++i){
268 dest->wordv[i] = (bigint_word_t)t;
269 borrow = t < 0 ? 1 : 0;
276 /******************************************************************************/
278 int8_t bigint_cmp_u(const bigint_t *a, const bigint_t *b){
279 if(a->length_W > b->length_W){
282 if(a->length_W < b->length_W){
285 if(a->length_W == 0){
291 if(a->wordv[i] != b->wordv[i]){
292 if(a->wordv[i] > b->wordv[i]){
302 /******************************************************************************/
304 void bigint_add_s(bigint_t *dest, const bigint_t *a, const bigint_t *b){
307 s |= GET_SIGN(b)?1:0;
309 case 0: /* both positive */
310 bigint_add_u(dest, a,b);
313 case 1: /* a positive, b negative */
314 bigint_sub_u(dest, a, b);
316 case 2: /* a negative, b positive */
317 bigint_sub_u(dest, b, a);
319 case 3: /* both negative */
320 bigint_add_u(dest, a, b);
323 default: /* how can this happen?*/
328 /******************************************************************************/
330 void bigint_sub_s(bigint_t *dest, const bigint_t *a, const bigint_t *b){
333 s |= GET_SIGN(b)?1:0;
335 case 0: /* both positive */
336 bigint_sub_u(dest, a,b);
338 case 1: /* a positive, b negative */
339 bigint_add_u(dest, a, b);
342 case 2: /* a negative, b positive */
343 bigint_add_u(dest, a, b);
346 case 3: /* both negative */
347 bigint_sub_u(dest, b, a);
349 default: /* how can this happen?*/
355 /******************************************************************************/
357 int8_t bigint_cmp_s(const bigint_t *a, const bigint_t *b){
359 if(a->length_W==0 && b->length_W==0){
363 s |= GET_SIGN(b)?1:0;
365 case 0: /* both positive */
366 return bigint_cmp_u(a, b);
368 case 1: /* a positive, b negative */
371 case 2: /* a negative, b positive */
374 case 3: /* both negative */
375 return bigint_cmp_u(b, a);
377 default: /* how can this happen?*/
380 return 0; /* just to satisfy the compiler */
383 /******************************************************************************/
385 void bigint_shiftleft_bits(bigint_t *a, uint8_t shift) {
387 bigint_wordplus_t t = 0;
389 for (i = 0; i < a->length_W; ++i) {
390 t |= ((bigint_wordplus_t)a->wordv[i]) << shift;
391 a->wordv[i] = (bigint_word_t)t;
392 t >>= BIGINT_WORD_SIZE;
395 a->wordv[a->length_W++] = (bigint_word_t)t;
400 /******************************************************************************/
402 void bigint_shiftleft(bigint_t *a, bigint_length_t shift){
403 bigint_length_t byteshift;
406 if (a->length_W == 0 || shift == 0) {
409 byteshift = shift / 8;
410 bitshift = shift & 7;
411 if (byteshift % sizeof(bigint_word_t)) {
412 a->wordv[a->length_W + byteshift / sizeof(bigint_t)] = 0;
415 memmove(((uint8_t*)a->wordv) + byteshift, a->wordv, a->length_W * sizeof(bigint_word_t));
416 memset(a->wordv, 0, byteshift);
417 a->length_W += (byteshift + sizeof(bigint_word_t) - 1) / sizeof(bigint_word_t);
423 bigint_shiftleft_bits(a, bitshift);
427 /******************************************************************************/
429 void bigint_shiftright_bits(bigint_t *a, uint8_t shift){
431 bigint_wordplus_t t = 0;
435 t |= ((bigint_wordplus_t)(a->wordv[i])) << (BIGINT_WORD_SIZE - shift);
436 a->wordv[i] = (bigint_word_t)(t >> BIGINT_WORD_SIZE);
437 t <<= BIGINT_WORD_SIZE;
443 /******************************************************************************/
445 void bigint_shiftright_1bit(bigint_t *a){
447 bigint_word_t t1 = 0, t2;
451 t2 = a->wordv[i] & 1;
454 t1 = t2 << (BIGINT_WORD_SIZE - 1);
459 /******************************************************************************/
461 void bigint_shiftright_1word(bigint_t *a){
462 if (a->length_W == 0) {
465 memmove(a->wordv, &a->wordv[1], (a->length_W - 1) * sizeof(bigint_word_t));
469 /******************************************************************************/
471 void bigint_shiftright(bigint_t *a, bigint_length_t shift){
472 bigint_length_t byteshift = shift / 8;
473 uint8_t bitshift = shift & 7;
475 if (a->length_W == 0) {
479 if(bigint_get_first_set_bit(a) < shift){ /* we would shift out more than we have */
485 memmove(a->wordv, (uint8_t*)a->wordv + byteshift, a->length_W * sizeof(bigint_word_t) - byteshift);
486 memset((uint8_t*)&a->wordv[a->length_W] - byteshift, 0, byteshift);
487 a->length_W -= byteshift / sizeof(bigint_word_t);
492 bigint_shiftright_bits(a, bitshift);
496 /******************************************************************************/
498 void bigint_xor(bigint_t *dest, const bigint_t *a){
500 for(i=0; i<a->length_W; ++i){
501 dest->wordv[i] ^= a->wordv[i];
506 /******************************************************************************/
508 void bigint_set_zero(bigint_t *a){
512 /******************************************************************************/
514 /* using the Karatsuba-Algorithm */
515 /* x*y = (xh*yh)*b**2n + ((xh+xl)*(yh+yl) - xh*yh - xl*yl)*b**n + yh*yl */
516 void bigint_mul_u(bigint_t *dest, const bigint_t *a, const bigint_t *b){
517 if (a->length_W == 0 || b->length_W == 0) {
518 bigint_set_zero(dest);
521 if (dest == a || dest == b) {
523 bigint_word_t d_b[a->length_W + b->length_W];
525 bigint_mul_u(&d, a, b);
526 bigint_copy(dest, &d);
529 if (a->length_W == 1 || b->length_W == 1) {
530 if (a->length_W != 1) {
533 bigint_wordplus_t t = 0;
535 bigint_word_t x = a->wordv[0];
536 for (i = 0; i < b->length_W; ++i) {
537 t += ((bigint_wordplus_t)b->wordv[i]) * ((bigint_wordplus_t)x);
538 dest->wordv[i] = (bigint_word_t)t;
539 t >>= BIGINT_WORD_SIZE;
543 dest->wordv[i] = (bigint_word_t)t;
550 if (a->length_W * sizeof(bigint_word_t) <= 4 && b->length_W * sizeof(bigint_word_t) <= 4) {
551 uint32_t p = 0, q = 0;
553 memcpy(&p, a->wordv, a->length_W * sizeof(bigint_word_t));
554 memcpy(&q, b->wordv, b->length_W * sizeof(bigint_word_t));
555 r = (uint64_t)p * (uint64_t)q;
556 memcpy(dest->wordv, &r, (dest->length_W = a->length_W + b->length_W) * sizeof(bigint_word_t));
560 /* split a in xh & xl; split b in yh & yl */
561 const bigint_length_t n = (MAX(a->length_W, b->length_W) + 1) / 2;
562 bigint_t xl, xh, yl, yh;
565 if (a->length_W <= n) {
566 bigint_set_zero(&xh);
567 xl.length_W = a->length_W;
573 xh.wordv = &(a->wordv[n]);
574 xh.length_W = a->length_W-n;
577 if (b->length_W <= n) {
578 bigint_set_zero(&yh);
579 yl.length_W = b->length_W;
585 yh.wordv = &(b->wordv[n]);
586 yh.length_W = b->length_W-n;
589 /* now we have split up a and b */
590 /* remember we want to do:
591 * x*y = (xh * b**n + xl) * (yh * b**n + yl)
592 * = (xh * yh) * b**2n + xh * b**n * yl + yh * b**n * xl + xl * yl
593 * = (xh * yh) * b**2n + (xh * yl + yh * xl) * b**n + xl *yl
594 * // xh * yl + yh * xl = (xh + yh) * (xl + yl) - xh * yh - xl * yl
595 * x*y = (xh * yh) * b**2n + ((xh+xl)*(yh+yl) - xh*yh - xl*yl)*b**n + xl*yl
596 * 5 9 2 4 3 7 5 6 1 8 1
598 ALLOC_BIGINT_WORDS(tmp_w, 2 * n + 2);
599 ALLOC_BIGINT_WORDS(m_w, 2 * n + 2);
600 bigint_t tmp, tmp2, m;
602 tmp2.wordv = &(tmp_w[n + 1]);
605 bigint_mul_u(dest, &xl, &yl); /* 1: dest <= xl*yl */
606 bigint_add_u(&tmp2, &xh, &xl); /* 2: tmp2 <= xh+xl */
607 bigint_add_u(&tmp, &yh, &yl); /* 3: tmp <= yh+yl */
608 bigint_mul_u(&m, &tmp2, &tmp); /* 4: m <= tmp2*tmp */
609 bigint_mul_u(&tmp, &xh, &yh); /* 5: tmp <= xh*yh */
610 bigint_sub_u(&m, &m, dest); /* 6: m <= m-dest */
611 bigint_sub_u(&m, &m, &tmp); /* 7: m <= m-tmp */
612 bigint_add_scale_u(dest, &m, n * sizeof(bigint_word_t)); /* 8: dest <= dest+m**n*/
613 bigint_add_scale_u(dest, &tmp, 2 * n * sizeof(bigint_word_t)); /* 9: dest <= dest+tmp**(2*n) */
618 /******************************************************************************/
620 void bigint_mul_s(bigint_t *dest, const bigint_t *a, const bigint_t *b){
623 s |= GET_SIGN(b)?1:0;
625 case 0: /* both positive */
626 bigint_mul_u(dest, a,b);
629 case 1: /* a positive, b negative */
630 bigint_mul_u(dest, a,b);
633 case 2: /* a negative, b positive */
634 bigint_mul_u(dest, a,b);
637 case 3: /* both negative */
638 bigint_mul_u(dest, a,b);
641 default: /* how can this happen?*/
646 /******************************************************************************/
648 void bigint_square(bigint_t *dest, const bigint_t *a) {
649 union __attribute__((packed)) {
651 bigint_wordplus_t uv;
653 bigint_word_t q, c1, c2;
654 bigint_length_t i, j;
656 if (a->length_W * sizeof(bigint_word_t) <= 4) {
658 memcpy(&r, a->wordv, a->length_W * sizeof(bigint_word_t));
660 memcpy(dest->wordv, &r, 2 * a->length_W * sizeof(bigint_word_t));
662 dest->length_W = 2 * a->length_W;
667 if (dest->wordv == a->wordv) {
669 ALLOC_BIGINT_WORDS(d_w, a->length_W * 2);
671 bigint_square(&d, a);
672 bigint_copy(dest, &d);
677 memset(dest->wordv, 0, a->length_W * 2 * sizeof(bigint_word_t));
679 for (i = 0; i < a->length_W; ++i) {
680 acc.uv = (bigint_wordplus_t)a->wordv[i] * (bigint_wordplus_t)a->wordv[i] + (bigint_wordplus_t)dest->wordv[2 * i];
681 dest->wordv[2 * i] = acc.u[0];
684 for (j = i + 1; j < a->length_W; ++j) {
685 acc.uv = (bigint_wordplus_t)a->wordv[i] * (bigint_wordplus_t)a->wordv[j];
686 q = acc.u[1] >> (BIGINT_WORD_SIZE - 1);
688 acc.uv += dest->wordv[i + j];
689 q += (acc.uv < dest->wordv[i + j]);
692 dest->wordv[i + j] = acc.u[0];
693 c1 = (bigint_wordplus_t)acc.u[1] + c2;
696 dest->wordv[i + a->length_W] += c1;
697 if (i < a->length_W - 1) {
698 dest->wordv[i + a->length_W + 1] = c2 + (dest->wordv[i + a->length_W] < c1);
702 dest->length_W = 2 * a->length_W;
706 /******************************************************************************/
708 void bigint_sub_u_bitscale(bigint_t *a, const bigint_t *b, bigint_length_t bitscale){
710 const bigint_length_t word_shift = bitscale / BIGINT_WORD_SIZE;
712 if (a->length_W < b->length_W + word_shift) {
714 cli_putstr("\r\nDBG: *bang*\r\n");
719 ALLOC_BIGINT_WORDS(tmp_w, b->length_W + 1);
721 bigint_copy(&tmp, b);
722 bigint_shiftleft_bits(&tmp, bitscale % BIGINT_WORD_SIZE);
725 x.wordv = &(a->wordv[word_shift]);
726 x.length_W = a->length_W - word_shift;
728 bigint_sub_u(&x, &x, &tmp);
734 /******************************************************************************/
736 void bigint_reduce(bigint_t *a, const bigint_t *r){
737 uint8_t rfbs = GET_FBS(r);
738 if (r->length_W == 0 || a->length_W == 0) {
742 if (bigint_length_b(a) + 3 > bigint_length_b(r)) {
743 if ((r->length_W * sizeof(bigint_word_t) <= 4) && (a->length_W * sizeof(bigint_word_t) <= 4)) {
744 uint32_t p = 0, q = 0;
745 memcpy(&p, a->wordv, a->length_W * sizeof(bigint_word_t));
746 memcpy(&q, r->wordv, r->length_W * sizeof(bigint_word_t));
748 memcpy(a->wordv, &p, a->length_W * sizeof(bigint_word_t));
749 a->length_W = r->length_W;
754 while (a->length_W > r->length_W) {
755 shift = (a->length_W - r->length_W) * CHAR_BIT * sizeof(bigint_word_t) + GET_FBS(a) - rfbs - 1;
756 bigint_sub_u_bitscale(a, r, shift);
758 while ((GET_FBS(a) > rfbs) && (a->length_W == r->length_W)) {
759 shift = GET_FBS(a) - rfbs - 1;
760 bigint_sub_u_bitscale(a, r, shift);
763 while (bigint_cmp_u(a, r) >= 0) {
764 bigint_sub_u(a, a, r);
769 /******************************************************************************/
771 /* calculate dest = a**exp % r */
772 /* using square&multiply */
773 void bigint_expmod_u_sam(bigint_t *dest, const bigint_t *a, const bigint_t *exp, const bigint_t *r){
774 if (a->length_W == 0) {
775 bigint_set_zero(dest);
779 if(exp->length_W == 0){
791 ALLOC_BIGINT_WORDS(base_w, MAX(a->length_W, r->length_W));
792 ALLOC_BIGINT_WORDS(res_w, r->length_W * 2);
796 bigint_copy(&base, a);
797 bigint_reduce(&base, r);
802 bigint_copy(&res, &base);
804 t = exp->wordv[exp->length_W - 1];
805 for (i = exp->length_W; i > 0; --i) {
806 t = exp->wordv[i - 1];
807 for (j = BIGINT_WORD_SIZE; j > 0; --j) {
809 if (t & (((bigint_word_t)1) << (BIGINT_WORD_SIZE - 1))) {
813 bigint_square(&res, &res);
814 bigint_reduce(&res, r);
815 if(t & (((bigint_word_t)1) << (BIGINT_WORD_SIZE - 1))){
816 bigint_mul_u(&res, &res, &base);
817 bigint_reduce(&res, r);
825 bigint_copy(dest, &res);
830 /******************************************************************************/
831 /* gcd <-- gcd(x,y) a*x+b*y=gcd */
832 void bigint_gcdext(bigint_t *gcd, bigint_t *a, bigint_t *b, const bigint_t *x, const bigint_t *y){
833 bigint_length_t i = 0;
834 if(x->length_W == 0 || y->length_W == 0){
836 bigint_set_zero(gcd);
846 if(x->length_W == 1 && x->wordv[0] == 1){
863 if(y->length_W == 1 && y->wordv[0] == 1){
881 while(x->wordv[i] == 0 && y->wordv[i] == 0){
884 bigint_word_t g_b[i + 2], x_b[x->length_W - i], y_b[y->length_W - i];
885 bigint_word_t u_b[x->length_W - i], v_b[y->length_W - i];
886 bigint_word_t a_b[y->length_W + 2], c_b[y->length_W + 2];
887 bigint_word_t b_b[x->length_W + 2], d_b[x->length_W + 2];
888 bigint_t g, x_, y_, u, v, a_, b_, c_, d_;
893 memset(g_b, 0, i * sizeof(bigint_word_t));
897 x_.info = y_.info = 0;
898 x_.length_W = x->length_W - i;
899 y_.length_W = y->length_W - i;
900 memcpy(x_.wordv, x->wordv + i, x_.length_W * sizeof(bigint_word_t));
901 memcpy(y_.wordv, y->wordv + i, y_.length_W * sizeof(bigint_word_t));
903 for(i = 0; (x_.wordv[0] & ((bigint_word_t)1 << i)) == 0 && (y_.wordv[0] & ((bigint_word_t)1 << i)) == 0; ++i)
910 bigint_shiftleft_bits(&g, i);
911 bigint_shiftright_bits(&x_, i);
912 bigint_shiftright_bits(&y_, i);
922 bigint_copy(&u, &x_);
923 bigint_copy(&v, &y_);
930 bigint_set_zero(&b_);
931 bigint_set_zero(&c_);
933 while ((u.wordv[0] & 1) == 0) {
934 bigint_shiftright_1bit(&u);
935 if((a_.wordv[0] & 1) || (b_.wordv[0] & 1)){
936 bigint_add_s(&a_, &a_, &y_);
937 bigint_sub_s(&b_, &b_, &x_);
939 bigint_shiftright_1bit(&a_);
940 bigint_shiftright_1bit(&b_);
942 while ((v.wordv[0] & 1) == 0) {
943 bigint_shiftright_1bit(&v);
944 if((c_.wordv[0] & 1) || (d_.wordv[0] & 1)){
945 bigint_add_s(&c_, &c_, &y_);
946 bigint_sub_s(&d_, &d_, &x_);
948 bigint_shiftright_1bit(&c_);
949 bigint_shiftright_1bit(&d_);
951 if(bigint_cmp_u(&u, &v) >= 0){
952 bigint_sub_u(&u, &u, &v);
953 bigint_sub_s(&a_, &a_, &c_);
954 bigint_sub_s(&b_, &b_, &d_);
956 bigint_sub_u(&v, &v, &u);
957 bigint_sub_s(&c_, &c_, &a_);
958 bigint_sub_s(&d_, &d_, &b_);
962 bigint_mul_s(gcd, &v, &g);
972 /******************************************************************************/
974 void bigint_inverse(bigint_t *dest, const bigint_t *a, const bigint_t *m){
975 bigint_gcdext(NULL, dest, NULL, a, m);
976 while(dest->info&BIGINT_NEG_MASK){
977 bigint_add_s(dest, dest, m);
981 /******************************************************************************/
983 void bigint_changeendianess(bigint_t *a){
985 p = (uint8_t*)a->wordv;
986 q = p + a->length_W * sizeof(bigint_word_t) - 1;
995 /******************************************************************************/
997 void bigint_mul_word_u(bigint_t *a, bigint_word_t b){
998 bigint_wordplus_t c0 = 0, c1 = 0;
1006 for(i = 0; i < a->length_W; ++i){
1007 c1 = ((bigint_wordplus_t)(a->wordv[i])) * ((bigint_wordplus_t)b);
1009 a->wordv[i] = (bigint_word_t)c1;
1010 c0 = c1 >> BIGINT_WORD_SIZE;
1013 a->wordv[a->length_W] = (bigint_word_t)c0;
1019 /******************************************************************************/
1022 void bigint_clip(bigint_t *dest, bigint_length_t length_W){
1023 if(dest->length_W > length_W){
1024 dest->length_W = length_W;
1026 bigint_adjust(dest);
1028 /******************************************************************************/
1032 * dest = (a * b) % m (?)
1035 void bigint_mont_mul(bigint_t *dest, const bigint_t *a, const bigint_t *b, const bigint_t *m, const bigint_t *m_){
1036 const bigint_length_t s = MAX(MAX(a->length_W, b->length_W), m->length_W);
1041 if (a->length_W == 0 || b->length_W == 0) {
1042 bigint_set_zero(dest);
1045 ALLOC_BIGINT_WORDS(u_w, s + 2);
1046 ALLOC_BIGINT_WORDS(t_w, s + 2);
1051 for (i = 0; i < a->length_W; ++i) {
1053 bigint_mul_word_u(&t, a->wordv[i]);
1054 bigint_add_u(&u, &u, &t);
1055 bigint_copy(&t, m_);
1056 if (u.length_W != 0) {
1057 bigint_mul_word_u(&t, u.wordv[0]);
1058 bigint_add_u(&u, &u, &t);
1060 bigint_shiftright_1word(&u);
1062 for (; i < s; ++i) {
1063 bigint_copy(&t, m_);
1064 if (u.length_W != 0) {
1065 bigint_mul_word_u(&t, u.wordv[0]);
1066 bigint_add_u(&u, &u, &t);
1068 bigint_shiftright_1word(&u);
1070 bigint_reduce(&u, m);
1071 bigint_copy(dest, &u);
1076 /******************************************************************************/
1078 void bigint_mont_red(bigint_t *dest, const bigint_t *a, const bigint_t *m, const bigint_t *m_){
1080 bigint_length_t i, s = MAX(a->length_W, MAX(m->length_W, m_->length_W));
1082 if (a->length_W == 0) {
1083 bigint_set_zero(dest);
1087 ALLOC_BIGINT_WORDS(u_w, s + 2);
1088 ALLOC_BIGINT_WORDS(t_w, s + 2);
1092 for (i = 0; i < m->length_W; ++i) {
1093 bigint_copy(&t, m_);
1094 if (u.length_W != 0) {
1095 bigint_mul_word_u(&t, u.wordv[0]);
1096 bigint_add_u(&u, &u, &t);
1098 bigint_shiftright_1word(&u);
1100 bigint_reduce(&u, m);
1101 bigint_copy(dest, &u);
1106 /******************************************************************************/
1108 * m_ = m * (- m0^-1 (mod 2^W))
1110 void bigint_mont_gen_m_(bigint_t* dest, const bigint_t* m){
1111 bigint_word_t x_w[2], m_w_0[1];
1113 if (m->length_W == 0) {
1114 bigint_set_zero(dest);
1117 if ((m->wordv[0] & 1) == 0) {
1119 printf_P(PSTR("ERROR: m must not be even, m = "));
1120 bigint_print_hex(m);
1134 m_0.wordv[0] = m->wordv[0];
1136 bigint_adjust(&m_0);
1137 bigint_inverse(dest, &m_0, &x);
1138 bigint_sub_s(&x, &x, dest);
1139 bigint_copy(dest, m);
1140 bigint_mul_word_u(dest, x.wordv[0]);
1144 /******************************************************************************/
1147 * dest = a * R mod m
1149 void bigint_mont_trans(bigint_t *dest, const bigint_t *a, const bigint_t *m){
1152 ALLOC_BIGINT_WORDS(t_w, a->length_W + m->length_W);
1154 memset(t_w, 0, m->length_W * sizeof(bigint_word_t));
1155 memcpy(&t_w[m->length_W], a->wordv, a->length_W * sizeof(bigint_word_t));
1157 t.length_W = a->length_W + m->length_W;
1158 bigint_reduce(&t, m);
1159 bigint_copy(dest, &t);
1163 /******************************************************************************/
1165 /* calculate dest = a**exp % r */
1166 /* using square&multiply */
1167 void bigint_expmod_u_mont_accel(bigint_t *dest, const bigint_t *a, const bigint_t *exp, const bigint_t *r, const bigint_t *m_){
1168 if(r->length_W == 0) {
1177 if (exp->length_W == 0) {
1184 ALLOC_BIGINT_WORDS(res_w, r->length_W * 2);
1185 ALLOC_BIGINT_WORDS(ax_w, MAX(r->length_W, a->length_W));
1194 bigint_copy(&ax, a);
1195 bigint_reduce(&ax, r);
1197 bigint_mont_trans(&ax, &ax, r);
1198 bigint_mont_trans(&res, &res, r);
1201 t = exp->wordv[exp->length_W - 1];
1202 for (i = exp->length_W; i > 0; --i) {
1203 t = exp->wordv[i - 1];
1204 for(j = BIGINT_WORD_SIZE; j > 0; --j){
1206 if(t & (((bigint_word_t)1) << (BIGINT_WORD_SIZE - 1))){
1211 bigint_square(&res, &res);
1212 bigint_mont_red(&res, &res, r, m_);
1213 if (t & (((bigint_word_t)1) << (BIGINT_WORD_SIZE - 1))) {
1214 bigint_mont_mul(&res, &res, &ax, r, m_);
1221 bigint_mont_red(dest, &res, r, m_);
1226 /******************************************************************************/
1228 void bigint_expmod_u_mont_sam(bigint_t *dest, const bigint_t *a, const bigint_t *exp, const bigint_t *r){
1229 if(r->length_W == 0) {
1232 if(a->length_W == 0) {
1233 bigint_set_zero(dest);
1237 bigint_word_t m_w_[r->length_W + 1];
1239 bigint_mont_gen_m_(&m_, r);
1240 bigint_expmod_u_mont_accel(dest, a, exp, r,&m_);
1243 /******************************************************************************/
1247 void bigint_expmod_u(bigint_t *dest, const bigint_t *a, const bigint_t *exp, const bigint_t *r){
1249 printf("\nDBG: expmod_u (a ** e %% m) <%s %s %d>\n\ta: ", __FILE__, __func__, __LINE__);
1250 bigint_print_hex(a);
1252 bigint_print_hex(exp);
1254 bigint_print_hex(r);
1256 if (0 && r->wordv[0] & 1) {
1257 bigint_expmod_u_mont_sam(dest, a, exp, r);
1259 bigint_expmod_u_sam(dest, a, exp, r);