1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
// +build noasm arm64
package csidh
import "math/bits"
func mul512(r, m1 *fp, m2 uint64) {
var c, h, l uint64
c, r[0] = bits.Mul64(m2, m1[0])
h, l = bits.Mul64(m2, m1[1])
r[1], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[2])
r[2], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[3])
r[3], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[4])
r[4], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[5])
r[5], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[6])
r[6], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[7])
r[7], _ = bits.Add64(l, c, 0)
}
func mul576(r *[9]uint64, m1 *fp, m2 uint64) {
var c, h, l uint64
c, r[0] = bits.Mul64(m2, m1[0])
h, l = bits.Mul64(m2, m1[1])
r[1], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[2])
r[2], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[3])
r[3], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[4])
r[4], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[5])
r[5], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[6])
r[6], c = bits.Add64(l, c, 0)
c = h + c
h, l = bits.Mul64(m2, m1[7])
r[7], c = bits.Add64(l, c, 0)
r[8], c = bits.Add64(h, c, 0)
r[8] += c
}
func cswap512(x, y *fp, choice uint8) {
var tmp uint64
mask64 := 0 - uint64(choice)
for i := 0; i < numWords; i++ {
tmp = mask64 & (x[i] ^ y[i])
x[i] = tmp ^ x[i]
y[i] = tmp ^ y[i]
}
}
func mul(res, x, y *fp) {
mulGeneric(res, x, y)
}
// mulRdc performs montgomery multiplication r = x * y mod P.
// Returned result r is already reduced and in Montgomery domain.
func mulRdc(r, x, y *fp) {
var t fp
var c uint64
mulGeneric(r, x, y)
// if p <= r < 2p then r = r-p
t[0], c = bits.Sub64(r[0], p[0], 0)
t[1], c = bits.Sub64(r[1], p[1], c)
t[2], c = bits.Sub64(r[2], p[2], c)
t[3], c = bits.Sub64(r[3], p[3], c)
t[4], c = bits.Sub64(r[4], p[4], c)
t[5], c = bits.Sub64(r[5], p[5], c)
t[6], c = bits.Sub64(r[6], p[6], c)
t[7], c = bits.Sub64(r[7], p[7], c)
var w = uint64(0 - uint64(c))
r[0] = ctPick64(w, r[0], t[0])
r[1] = ctPick64(w, r[1], t[1])
r[2] = ctPick64(w, r[2], t[2])
r[3] = ctPick64(w, r[3], t[3])
r[4] = ctPick64(w, r[4], t[4])
r[5] = ctPick64(w, r[5], t[5])
r[6] = ctPick64(w, r[6], t[6])
r[7] = ctPick64(w, r[7], t[7])
}
|
