PRCYCoin  2.0.0.7rc1
P2P Digital Currency
scalar_8x32_impl.h
Go to the documentation of this file.
1 /**********************************************************************
2  * Copyright (c) 2014 Pieter Wuille *
3  * Distributed under the MIT software license, see the accompanying *
4  * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
5  **********************************************************************/
6 
7 #ifndef _SECP256K1_SCALAR_REPR_IMPL_H_
8 #define _SECP256K1_SCALAR_REPR_IMPL_H_
9 
10 /* Limbs of the secp256k1 order. */
11 #define SECP256K1_N_0 ((uint32_t)0xD0364141UL)
12 #define SECP256K1_N_1 ((uint32_t)0xBFD25E8CUL)
13 #define SECP256K1_N_2 ((uint32_t)0xAF48A03BUL)
14 #define SECP256K1_N_3 ((uint32_t)0xBAAEDCE6UL)
15 #define SECP256K1_N_4 ((uint32_t)0xFFFFFFFEUL)
16 #define SECP256K1_N_5 ((uint32_t)0xFFFFFFFFUL)
17 #define SECP256K1_N_6 ((uint32_t)0xFFFFFFFFUL)
18 #define SECP256K1_N_7 ((uint32_t)0xFFFFFFFFUL)
19 
20 /* Limbs of 2^256 minus the secp256k1 order. */
21 #define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
22 #define SECP256K1_N_C_1 (~SECP256K1_N_1)
23 #define SECP256K1_N_C_2 (~SECP256K1_N_2)
24 #define SECP256K1_N_C_3 (~SECP256K1_N_3)
25 #define SECP256K1_N_C_4 (1)
26 
27 /* Limbs of half the secp256k1 order. */
28 #define SECP256K1_N_H_0 ((uint32_t)0x681B20A0UL)
29 #define SECP256K1_N_H_1 ((uint32_t)0xDFE92F46UL)
30 #define SECP256K1_N_H_2 ((uint32_t)0x57A4501DUL)
31 #define SECP256K1_N_H_3 ((uint32_t)0x5D576E73UL)
32 #define SECP256K1_N_H_4 ((uint32_t)0xFFFFFFFFUL)
33 #define SECP256K1_N_H_5 ((uint32_t)0xFFFFFFFFUL)
34 #define SECP256K1_N_H_6 ((uint32_t)0xFFFFFFFFUL)
35 #define SECP256K1_N_H_7 ((uint32_t)0x7FFFFFFFUL)
36 
37 SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar_t *r) {
38  r->d[0] = 0;
39  r->d[1] = 0;
40  r->d[2] = 0;
41  r->d[3] = 0;
42  r->d[4] = 0;
43  r->d[5] = 0;
44  r->d[6] = 0;
45  r->d[7] = 0;
46 }
47 
48 SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar_t *r, unsigned int v) {
49  r->d[0] = v;
50  r->d[1] = 0;
51  r->d[2] = 0;
52  r->d[3] = 0;
53  r->d[4] = 0;
54  r->d[5] = 0;
55  r->d[6] = 0;
56  r->d[7] = 0;
57 }
58 
59 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count) {
60  VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5);
61  return (a->d[offset >> 5] >> (offset & 0x1F)) & ((1 << count) - 1);
62 }
63 
64 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar_t *a, unsigned int offset, unsigned int count) {
65  VERIFY_CHECK(count < 32);
66  VERIFY_CHECK(offset + count <= 256);
67  if ((offset + count - 1) >> 5 == offset >> 5) {
68  return secp256k1_scalar_get_bits(a, offset, count);
69  } else {
70  VERIFY_CHECK((offset >> 5) + 1 < 8);
71  return ((a->d[offset >> 5] >> (offset & 0x1F)) | (a->d[(offset >> 5) + 1] << (32 - (offset & 0x1F)))) & ((((uint32_t)1) << count) - 1);
72  }
73 }
74 
75 SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar_t *a) {
76  int yes = 0;
77  int no = 0;
78  no |= (a->d[7] < SECP256K1_N_7); /* No need for a > check. */
79  no |= (a->d[6] < SECP256K1_N_6); /* No need for a > check. */
80  no |= (a->d[5] < SECP256K1_N_5); /* No need for a > check. */
81  no |= (a->d[4] < SECP256K1_N_4);
82  yes |= (a->d[4] > SECP256K1_N_4) & ~no;
83  no |= (a->d[3] < SECP256K1_N_3) & ~yes;
84  yes |= (a->d[3] > SECP256K1_N_3) & ~no;
85  no |= (a->d[2] < SECP256K1_N_2) & ~yes;
86  yes |= (a->d[2] > SECP256K1_N_2) & ~no;
87  no |= (a->d[1] < SECP256K1_N_1) & ~yes;
88  yes |= (a->d[1] > SECP256K1_N_1) & ~no;
89  yes |= (a->d[0] >= SECP256K1_N_0) & ~no;
90  return yes;
91 }
92 
93 SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar_t *r, uint32_t overflow) {
94  VERIFY_CHECK(overflow <= 1);
95  uint64_t t = (uint64_t)r->d[0] + overflow * SECP256K1_N_C_0;
96  r->d[0] = t & 0xFFFFFFFFUL; t >>= 32;
97  t += (uint64_t)r->d[1] + overflow * SECP256K1_N_C_1;
98  r->d[1] = t & 0xFFFFFFFFUL; t >>= 32;
99  t += (uint64_t)r->d[2] + overflow * SECP256K1_N_C_2;
100  r->d[2] = t & 0xFFFFFFFFUL; t >>= 32;
101  t += (uint64_t)r->d[3] + overflow * SECP256K1_N_C_3;
102  r->d[3] = t & 0xFFFFFFFFUL; t >>= 32;
103  t += (uint64_t)r->d[4] + overflow * SECP256K1_N_C_4;
104  r->d[4] = t & 0xFFFFFFFFUL; t >>= 32;
105  t += (uint64_t)r->d[5];
106  r->d[5] = t & 0xFFFFFFFFUL; t >>= 32;
107  t += (uint64_t)r->d[6];
108  r->d[6] = t & 0xFFFFFFFFUL; t >>= 32;
109  t += (uint64_t)r->d[7];
110  r->d[7] = t & 0xFFFFFFFFUL;
111  return overflow;
112 }
113 
114 static int secp256k1_scalar_add(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) {
115  uint64_t t = (uint64_t)a->d[0] + b->d[0];
116  r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
117  t += (uint64_t)a->d[1] + b->d[1];
118  r->d[1] = t & 0xFFFFFFFFULL; t >>= 32;
119  t += (uint64_t)a->d[2] + b->d[2];
120  r->d[2] = t & 0xFFFFFFFFULL; t >>= 32;
121  t += (uint64_t)a->d[3] + b->d[3];
122  r->d[3] = t & 0xFFFFFFFFULL; t >>= 32;
123  t += (uint64_t)a->d[4] + b->d[4];
124  r->d[4] = t & 0xFFFFFFFFULL; t >>= 32;
125  t += (uint64_t)a->d[5] + b->d[5];
126  r->d[5] = t & 0xFFFFFFFFULL; t >>= 32;
127  t += (uint64_t)a->d[6] + b->d[6];
128  r->d[6] = t & 0xFFFFFFFFULL; t >>= 32;
129  t += (uint64_t)a->d[7] + b->d[7];
130  r->d[7] = t & 0xFFFFFFFFULL; t >>= 32;
131  int overflow = t + secp256k1_scalar_check_overflow(r);
132  VERIFY_CHECK(overflow == 0 || overflow == 1);
133  secp256k1_scalar_reduce(r, overflow);
134  return overflow;
135 }
136 
137 static void secp256k1_scalar_add_bit(secp256k1_scalar_t *r, unsigned int bit) {
138  VERIFY_CHECK(bit < 256);
139  uint64_t t = (uint64_t)r->d[0] + (((uint32_t)((bit >> 5) == 0)) << (bit & 0x1F));
140  r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
141  t += (uint64_t)r->d[1] + (((uint32_t)((bit >> 5) == 1)) << (bit & 0x1F));
142  r->d[1] = t & 0xFFFFFFFFULL; t >>= 32;
143  t += (uint64_t)r->d[2] + (((uint32_t)((bit >> 5) == 2)) << (bit & 0x1F));
144  r->d[2] = t & 0xFFFFFFFFULL; t >>= 32;
145  t += (uint64_t)r->d[3] + (((uint32_t)((bit >> 5) == 3)) << (bit & 0x1F));
146  r->d[3] = t & 0xFFFFFFFFULL; t >>= 32;
147  t += (uint64_t)r->d[4] + (((uint32_t)((bit >> 5) == 4)) << (bit & 0x1F));
148  r->d[4] = t & 0xFFFFFFFFULL; t >>= 32;
149  t += (uint64_t)r->d[5] + (((uint32_t)((bit >> 5) == 5)) << (bit & 0x1F));
150  r->d[5] = t & 0xFFFFFFFFULL; t >>= 32;
151  t += (uint64_t)r->d[6] + (((uint32_t)((bit >> 5) == 6)) << (bit & 0x1F));
152  r->d[6] = t & 0xFFFFFFFFULL; t >>= 32;
153  t += (uint64_t)r->d[7] + (((uint32_t)((bit >> 5) == 7)) << (bit & 0x1F));
154  r->d[7] = t & 0xFFFFFFFFULL;
155 #ifdef VERIFY
156  VERIFY_CHECK((t >> 32) == 0);
157  VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
158 #endif
159 }
160 
161 static void secp256k1_scalar_set_b32(secp256k1_scalar_t *r, const unsigned char *b32, int *overflow) {
162  r->d[0] = (uint32_t)b32[31] | (uint32_t)b32[30] << 8 | (uint32_t)b32[29] << 16 | (uint32_t)b32[28] << 24;
163  r->d[1] = (uint32_t)b32[27] | (uint32_t)b32[26] << 8 | (uint32_t)b32[25] << 16 | (uint32_t)b32[24] << 24;
164  r->d[2] = (uint32_t)b32[23] | (uint32_t)b32[22] << 8 | (uint32_t)b32[21] << 16 | (uint32_t)b32[20] << 24;
165  r->d[3] = (uint32_t)b32[19] | (uint32_t)b32[18] << 8 | (uint32_t)b32[17] << 16 | (uint32_t)b32[16] << 24;
166  r->d[4] = (uint32_t)b32[15] | (uint32_t)b32[14] << 8 | (uint32_t)b32[13] << 16 | (uint32_t)b32[12] << 24;
167  r->d[5] = (uint32_t)b32[11] | (uint32_t)b32[10] << 8 | (uint32_t)b32[9] << 16 | (uint32_t)b32[8] << 24;
168  r->d[6] = (uint32_t)b32[7] | (uint32_t)b32[6] << 8 | (uint32_t)b32[5] << 16 | (uint32_t)b32[4] << 24;
169  r->d[7] = (uint32_t)b32[3] | (uint32_t)b32[2] << 8 | (uint32_t)b32[1] << 16 | (uint32_t)b32[0] << 24;
170  int over = secp256k1_scalar_reduce(r, secp256k1_scalar_check_overflow(r));
171  if (overflow) {
172  *overflow = over;
173  }
174 }
175 
176 static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar_t* a) {
177  bin[0] = a->d[7] >> 24; bin[1] = a->d[7] >> 16; bin[2] = a->d[7] >> 8; bin[3] = a->d[7];
178  bin[4] = a->d[6] >> 24; bin[5] = a->d[6] >> 16; bin[6] = a->d[6] >> 8; bin[7] = a->d[6];
179  bin[8] = a->d[5] >> 24; bin[9] = a->d[5] >> 16; bin[10] = a->d[5] >> 8; bin[11] = a->d[5];
180  bin[12] = a->d[4] >> 24; bin[13] = a->d[4] >> 16; bin[14] = a->d[4] >> 8; bin[15] = a->d[4];
181  bin[16] = a->d[3] >> 24; bin[17] = a->d[3] >> 16; bin[18] = a->d[3] >> 8; bin[19] = a->d[3];
182  bin[20] = a->d[2] >> 24; bin[21] = a->d[2] >> 16; bin[22] = a->d[2] >> 8; bin[23] = a->d[2];
183  bin[24] = a->d[1] >> 24; bin[25] = a->d[1] >> 16; bin[26] = a->d[1] >> 8; bin[27] = a->d[1];
184  bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0];
185 }
186 
187 SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar_t *a) {
188  return (a->d[0] | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
189 }
190 
191 static void secp256k1_scalar_negate(secp256k1_scalar_t *r, const secp256k1_scalar_t *a) {
192  uint32_t nonzero = 0xFFFFFFFFUL * (secp256k1_scalar_is_zero(a) == 0);
193  uint64_t t = (uint64_t)(~a->d[0]) + SECP256K1_N_0 + 1;
194  r->d[0] = t & nonzero; t >>= 32;
195  t += (uint64_t)(~a->d[1]) + SECP256K1_N_1;
196  r->d[1] = t & nonzero; t >>= 32;
197  t += (uint64_t)(~a->d[2]) + SECP256K1_N_2;
198  r->d[2] = t & nonzero; t >>= 32;
199  t += (uint64_t)(~a->d[3]) + SECP256K1_N_3;
200  r->d[3] = t & nonzero; t >>= 32;
201  t += (uint64_t)(~a->d[4]) + SECP256K1_N_4;
202  r->d[4] = t & nonzero; t >>= 32;
203  t += (uint64_t)(~a->d[5]) + SECP256K1_N_5;
204  r->d[5] = t & nonzero; t >>= 32;
205  t += (uint64_t)(~a->d[6]) + SECP256K1_N_6;
206  r->d[6] = t & nonzero; t >>= 32;
207  t += (uint64_t)(~a->d[7]) + SECP256K1_N_7;
208  r->d[7] = t & nonzero;
209 }
210 
211 SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar_t *a) {
212  return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
213 }
214 
215 static int secp256k1_scalar_is_high(const secp256k1_scalar_t *a) {
216  int yes = 0;
217  int no = 0;
218  no |= (a->d[7] < SECP256K1_N_H_7);
219  yes |= (a->d[7] > SECP256K1_N_H_7) & ~no;
220  no |= (a->d[6] < SECP256K1_N_H_6) & ~yes; /* No need for a > check. */
221  no |= (a->d[5] < SECP256K1_N_H_5) & ~yes; /* No need for a > check. */
222  no |= (a->d[4] < SECP256K1_N_H_4) & ~yes; /* No need for a > check. */
223  no |= (a->d[3] < SECP256K1_N_H_3) & ~yes;
224  yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
225  no |= (a->d[2] < SECP256K1_N_H_2) & ~yes;
226  yes |= (a->d[2] > SECP256K1_N_H_2) & ~no;
227  no |= (a->d[1] < SECP256K1_N_H_1) & ~yes;
228  yes |= (a->d[1] > SECP256K1_N_H_1) & ~no;
229  yes |= (a->d[0] > SECP256K1_N_H_0) & ~no;
230  return yes;
231 }
232 
233 /* Inspired by the macros in OpenSSL's crypto/bn/asm/x86_64-gcc.c. */
234 
236 #define muladd(a,b) { \
237  uint32_t tl, th; \
238  { \
239  uint64_t t = (uint64_t)a * b; \
240  th = t >> 32; /* at most 0xFFFFFFFE */ \
241  tl = t; \
242  } \
243  c0 += tl; /* overflow is handled on the next line */ \
244  th += (c0 < tl) ? 1 : 0; /* at most 0xFFFFFFFF */ \
245  c1 += th; /* overflow is handled on the next line */ \
246  c2 += (c1 < th) ? 1 : 0; /* never overflows by contract (verified in the next line) */ \
247  VERIFY_CHECK((c1 >= th) || (c2 != 0)); \
248 }
249 
251 #define muladd_fast(a,b) { \
252  uint32_t tl, th; \
253  { \
254  uint64_t t = (uint64_t)a * b; \
255  th = t >> 32; /* at most 0xFFFFFFFE */ \
256  tl = t; \
257  } \
258  c0 += tl; /* overflow is handled on the next line */ \
259  th += (c0 < tl) ? 1 : 0; /* at most 0xFFFFFFFF */ \
260  c1 += th; /* never overflows by contract (verified in the next line) */ \
261  VERIFY_CHECK(c1 >= th); \
262 }
263 
265 #define muladd2(a,b) { \
266  uint32_t tl, th; \
267  { \
268  uint64_t t = (uint64_t)a * b; \
269  th = t >> 32; /* at most 0xFFFFFFFE */ \
270  tl = t; \
271  } \
272  uint32_t th2 = th + th; /* at most 0xFFFFFFFE (in case th was 0x7FFFFFFF) */ \
273  c2 += (th2 < th) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
274  VERIFY_CHECK((th2 >= th) || (c2 != 0)); \
275  uint32_t tl2 = tl + tl; /* at most 0xFFFFFFFE (in case the lowest 63 bits of tl were 0x7FFFFFFF) */ \
276  th2 += (tl2 < tl) ? 1 : 0; /* at most 0xFFFFFFFF */ \
277  c0 += tl2; /* overflow is handled on the next line */ \
278  th2 += (c0 < tl2) ? 1 : 0; /* second overflow is handled on the next line */ \
279  c2 += (c0 < tl2) & (th2 == 0); /* never overflows by contract (verified the next line) */ \
280  VERIFY_CHECK((c0 >= tl2) || (th2 != 0) || (c2 != 0)); \
281  c1 += th2; /* overflow is handled on the next line */ \
282  c2 += (c1 < th2) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
283  VERIFY_CHECK((c1 >= th2) || (c2 != 0)); \
284 }
285 
287 #define sumadd(a) { \
288  c0 += (a); /* overflow is handled on the next line */ \
289  unsigned int over = (c0 < (a)) ? 1 : 0; \
290  c1 += over; /* overflow is handled on the next line */ \
291  c2 += (c1 < over) ? 1 : 0; /* never overflows by contract */ \
292 }
293 
295 #define sumadd_fast(a) { \
296  c0 += (a); /* overflow is handled on the next line */ \
297  c1 += (c0 < (a)) ? 1 : 0; /* never overflows by contract (verified the next line) */ \
298  VERIFY_CHECK((c1 != 0) | (c0 >= (a))); \
299  VERIFY_CHECK(c2 == 0); \
300 }
301 
303 #define extract(n) { \
304  (n) = c0; \
305  c0 = c1; \
306  c1 = c2; \
307  c2 = 0; \
308 }
309 
311 #define extract_fast(n) { \
312  (n) = c0; \
313  c0 = c1; \
314  c1 = 0; \
315  VERIFY_CHECK(c2 == 0); \
316 }
317 
318 static void secp256k1_scalar_reduce_512(secp256k1_scalar_t *r, const uint32_t *l) {
319  uint32_t n0 = l[8], n1 = l[9], n2 = l[10], n3 = l[11], n4 = l[12], n5 = l[13], n6 = l[14], n7 = l[15];
320 
321  /* 96 bit accumulator. */
322  uint32_t c0, c1, c2;
323 
324  /* Reduce 512 bits into 385. */
325  /* m[0..12] = l[0..7] + n[0..7] * SECP256K1_N_C. */
326  c0 = l[0]; c1 = 0; c2 = 0;
327  muladd_fast(n0, SECP256K1_N_C_0);
328  uint32_t m0; extract_fast(m0);
329  sumadd_fast(l[1]);
330  muladd(n1, SECP256K1_N_C_0);
331  muladd(n0, SECP256K1_N_C_1);
332  uint32_t m1; extract(m1);
333  sumadd(l[2]);
334  muladd(n2, SECP256K1_N_C_0);
335  muladd(n1, SECP256K1_N_C_1);
336  muladd(n0, SECP256K1_N_C_2);
337  uint32_t m2; extract(m2);
338  sumadd(l[3]);
339  muladd(n3, SECP256K1_N_C_0);
340  muladd(n2, SECP256K1_N_C_1);
341  muladd(n1, SECP256K1_N_C_2);
342  muladd(n0, SECP256K1_N_C_3);
343  uint32_t m3; extract(m3);
344  sumadd(l[4]);
345  muladd(n4, SECP256K1_N_C_0);
346  muladd(n3, SECP256K1_N_C_1);
347  muladd(n2, SECP256K1_N_C_2);
348  muladd(n1, SECP256K1_N_C_3);
349  sumadd(n0);
350  uint32_t m4; extract(m4);
351  sumadd(l[5]);
352  muladd(n5, SECP256K1_N_C_0);
353  muladd(n4, SECP256K1_N_C_1);
354  muladd(n3, SECP256K1_N_C_2);
355  muladd(n2, SECP256K1_N_C_3);
356  sumadd(n1);
357  uint32_t m5; extract(m5);
358  sumadd(l[6]);
359  muladd(n6, SECP256K1_N_C_0);
360  muladd(n5, SECP256K1_N_C_1);
361  muladd(n4, SECP256K1_N_C_2);
362  muladd(n3, SECP256K1_N_C_3);
363  sumadd(n2);
364  uint32_t m6; extract(m6);
365  sumadd(l[7]);
366  muladd(n7, SECP256K1_N_C_0);
367  muladd(n6, SECP256K1_N_C_1);
368  muladd(n5, SECP256K1_N_C_2);
369  muladd(n4, SECP256K1_N_C_3);
370  sumadd(n3);
371  uint32_t m7; extract(m7);
372  muladd(n7, SECP256K1_N_C_1);
373  muladd(n6, SECP256K1_N_C_2);
374  muladd(n5, SECP256K1_N_C_3);
375  sumadd(n4);
376  uint32_t m8; extract(m8);
377  muladd(n7, SECP256K1_N_C_2);
378  muladd(n6, SECP256K1_N_C_3);
379  sumadd(n5);
380  uint32_t m9; extract(m9);
381  muladd(n7, SECP256K1_N_C_3);
382  sumadd(n6);
383  uint32_t m10; extract(m10);
384  sumadd_fast(n7);
385  uint32_t m11; extract_fast(m11);
386  VERIFY_CHECK(c0 <= 1);
387  uint32_t m12 = c0;
388 
389  /* Reduce 385 bits into 258. */
390  /* p[0..8] = m[0..7] + m[8..12] * SECP256K1_N_C. */
391  c0 = m0; c1 = 0; c2 = 0;
392  muladd_fast(m8, SECP256K1_N_C_0);
393  uint32_t p0; extract_fast(p0);
394  sumadd_fast(m1);
395  muladd(m9, SECP256K1_N_C_0);
396  muladd(m8, SECP256K1_N_C_1);
397  uint32_t p1; extract(p1);
398  sumadd(m2);
399  muladd(m10, SECP256K1_N_C_0);
400  muladd(m9, SECP256K1_N_C_1);
401  muladd(m8, SECP256K1_N_C_2);
402  uint32_t p2; extract(p2);
403  sumadd(m3);
404  muladd(m11, SECP256K1_N_C_0);
405  muladd(m10, SECP256K1_N_C_1);
406  muladd(m9, SECP256K1_N_C_2);
407  muladd(m8, SECP256K1_N_C_3);
408  uint32_t p3; extract(p3);
409  sumadd(m4);
410  muladd(m12, SECP256K1_N_C_0);
411  muladd(m11, SECP256K1_N_C_1);
412  muladd(m10, SECP256K1_N_C_2);
413  muladd(m9, SECP256K1_N_C_3);
414  sumadd(m8);
415  uint32_t p4; extract(p4);
416  sumadd(m5);
417  muladd(m12, SECP256K1_N_C_1);
418  muladd(m11, SECP256K1_N_C_2);
419  muladd(m10, SECP256K1_N_C_3);
420  sumadd(m9);
421  uint32_t p5; extract(p5);
422  sumadd(m6);
423  muladd(m12, SECP256K1_N_C_2);
424  muladd(m11, SECP256K1_N_C_3);
425  sumadd(m10);
426  uint32_t p6; extract(p6);
427  sumadd_fast(m7);
428  muladd_fast(m12, SECP256K1_N_C_3);
429  sumadd_fast(m11);
430  uint32_t p7; extract_fast(p7);
431  uint32_t p8 = c0 + m12;
432  VERIFY_CHECK(p8 <= 2);
433 
434  /* Reduce 258 bits into 256. */
435  /* r[0..7] = p[0..7] + p[8] * SECP256K1_N_C. */
436  uint64_t c = p0 + (uint64_t)SECP256K1_N_C_0 * p8;
437  r->d[0] = c & 0xFFFFFFFFUL; c >>= 32;
438  c += p1 + (uint64_t)SECP256K1_N_C_1 * p8;
439  r->d[1] = c & 0xFFFFFFFFUL; c >>= 32;
440  c += p2 + (uint64_t)SECP256K1_N_C_2 * p8;
441  r->d[2] = c & 0xFFFFFFFFUL; c >>= 32;
442  c += p3 + (uint64_t)SECP256K1_N_C_3 * p8;
443  r->d[3] = c & 0xFFFFFFFFUL; c >>= 32;
444  c += p4 + (uint64_t)p8;
445  r->d[4] = c & 0xFFFFFFFFUL; c >>= 32;
446  c += p5;
447  r->d[5] = c & 0xFFFFFFFFUL; c >>= 32;
448  c += p6;
449  r->d[6] = c & 0xFFFFFFFFUL; c >>= 32;
450  c += p7;
451  r->d[7] = c & 0xFFFFFFFFUL; c >>= 32;
452 
453  /* Final reduction of r. */
454  secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
455 }
456 
457 static void secp256k1_scalar_mul_512(uint32_t l[16], const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) {
458  /* 96 bit accumulator. */
459  uint32_t c0 = 0, c1 = 0, c2 = 0;
460 
461  /* l[0..15] = a[0..7] * b[0..7]. */
462  muladd_fast(a->d[0], b->d[0]);
463  extract_fast(l[0]);
464  muladd(a->d[0], b->d[1]);
465  muladd(a->d[1], b->d[0]);
466  extract(l[1]);
467  muladd(a->d[0], b->d[2]);
468  muladd(a->d[1], b->d[1]);
469  muladd(a->d[2], b->d[0]);
470  extract(l[2]);
471  muladd(a->d[0], b->d[3]);
472  muladd(a->d[1], b->d[2]);
473  muladd(a->d[2], b->d[1]);
474  muladd(a->d[3], b->d[0]);
475  extract(l[3]);
476  muladd(a->d[0], b->d[4]);
477  muladd(a->d[1], b->d[3]);
478  muladd(a->d[2], b->d[2]);
479  muladd(a->d[3], b->d[1]);
480  muladd(a->d[4], b->d[0]);
481  extract(l[4]);
482  muladd(a->d[0], b->d[5]);
483  muladd(a->d[1], b->d[4]);
484  muladd(a->d[2], b->d[3]);
485  muladd(a->d[3], b->d[2]);
486  muladd(a->d[4], b->d[1]);
487  muladd(a->d[5], b->d[0]);
488  extract(l[5]);
489  muladd(a->d[0], b->d[6]);
490  muladd(a->d[1], b->d[5]);
491  muladd(a->d[2], b->d[4]);
492  muladd(a->d[3], b->d[3]);
493  muladd(a->d[4], b->d[2]);
494  muladd(a->d[5], b->d[1]);
495  muladd(a->d[6], b->d[0]);
496  extract(l[6]);
497  muladd(a->d[0], b->d[7]);
498  muladd(a->d[1], b->d[6]);
499  muladd(a->d[2], b->d[5]);
500  muladd(a->d[3], b->d[4]);
501  muladd(a->d[4], b->d[3]);
502  muladd(a->d[5], b->d[2]);
503  muladd(a->d[6], b->d[1]);
504  muladd(a->d[7], b->d[0]);
505  extract(l[7]);
506  muladd(a->d[1], b->d[7]);
507  muladd(a->d[2], b->d[6]);
508  muladd(a->d[3], b->d[5]);
509  muladd(a->d[4], b->d[4]);
510  muladd(a->d[5], b->d[3]);
511  muladd(a->d[6], b->d[2]);
512  muladd(a->d[7], b->d[1]);
513  extract(l[8]);
514  muladd(a->d[2], b->d[7]);
515  muladd(a->d[3], b->d[6]);
516  muladd(a->d[4], b->d[5]);
517  muladd(a->d[5], b->d[4]);
518  muladd(a->d[6], b->d[3]);
519  muladd(a->d[7], b->d[2]);
520  extract(l[9]);
521  muladd(a->d[3], b->d[7]);
522  muladd(a->d[4], b->d[6]);
523  muladd(a->d[5], b->d[5]);
524  muladd(a->d[6], b->d[4]);
525  muladd(a->d[7], b->d[3]);
526  extract(l[10]);
527  muladd(a->d[4], b->d[7]);
528  muladd(a->d[5], b->d[6]);
529  muladd(a->d[6], b->d[5]);
530  muladd(a->d[7], b->d[4]);
531  extract(l[11]);
532  muladd(a->d[5], b->d[7]);
533  muladd(a->d[6], b->d[6]);
534  muladd(a->d[7], b->d[5]);
535  extract(l[12]);
536  muladd(a->d[6], b->d[7]);
537  muladd(a->d[7], b->d[6]);
538  extract(l[13]);
539  muladd_fast(a->d[7], b->d[7]);
540  extract_fast(l[14]);
541  VERIFY_CHECK(c1 == 0);
542  l[15] = c0;
543 }
544 
545 static void secp256k1_scalar_sqr_512(uint32_t l[16], const secp256k1_scalar_t *a) {
546  /* 96 bit accumulator. */
547  uint32_t c0 = 0, c1 = 0, c2 = 0;
548 
549  /* l[0..15] = a[0..7]^2. */
550  muladd_fast(a->d[0], a->d[0]);
551  extract_fast(l[0]);
552  muladd2(a->d[0], a->d[1]);
553  extract(l[1]);
554  muladd2(a->d[0], a->d[2]);
555  muladd(a->d[1], a->d[1]);
556  extract(l[2]);
557  muladd2(a->d[0], a->d[3]);
558  muladd2(a->d[1], a->d[2]);
559  extract(l[3]);
560  muladd2(a->d[0], a->d[4]);
561  muladd2(a->d[1], a->d[3]);
562  muladd(a->d[2], a->d[2]);
563  extract(l[4]);
564  muladd2(a->d[0], a->d[5]);
565  muladd2(a->d[1], a->d[4]);
566  muladd2(a->d[2], a->d[3]);
567  extract(l[5]);
568  muladd2(a->d[0], a->d[6]);
569  muladd2(a->d[1], a->d[5]);
570  muladd2(a->d[2], a->d[4]);
571  muladd(a->d[3], a->d[3]);
572  extract(l[6]);
573  muladd2(a->d[0], a->d[7]);
574  muladd2(a->d[1], a->d[6]);
575  muladd2(a->d[2], a->d[5]);
576  muladd2(a->d[3], a->d[4]);
577  extract(l[7]);
578  muladd2(a->d[1], a->d[7]);
579  muladd2(a->d[2], a->d[6]);
580  muladd2(a->d[3], a->d[5]);
581  muladd(a->d[4], a->d[4]);
582  extract(l[8]);
583  muladd2(a->d[2], a->d[7]);
584  muladd2(a->d[3], a->d[6]);
585  muladd2(a->d[4], a->d[5]);
586  extract(l[9]);
587  muladd2(a->d[3], a->d[7]);
588  muladd2(a->d[4], a->d[6]);
589  muladd(a->d[5], a->d[5]);
590  extract(l[10]);
591  muladd2(a->d[4], a->d[7]);
592  muladd2(a->d[5], a->d[6]);
593  extract(l[11]);
594  muladd2(a->d[5], a->d[7]);
595  muladd(a->d[6], a->d[6]);
596  extract(l[12]);
597  muladd2(a->d[6], a->d[7]);
598  extract(l[13]);
599  muladd_fast(a->d[7], a->d[7]);
600  extract_fast(l[14]);
601  VERIFY_CHECK(c1 == 0);
602  l[15] = c0;
603 }
604 
605 #undef sumadd
606 #undef sumadd_fast
607 #undef muladd
608 #undef muladd_fast
609 #undef muladd2
610 #undef extract
611 #undef extract_fast
612 
613 static void secp256k1_scalar_mul(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) {
614  uint32_t l[16];
615  secp256k1_scalar_mul_512(l, a, b);
616  secp256k1_scalar_reduce_512(r, l);
617 }
618 
619 static void secp256k1_scalar_sqr(secp256k1_scalar_t *r, const secp256k1_scalar_t *a) {
620  uint32_t l[16];
621  secp256k1_scalar_sqr_512(l, a);
622  secp256k1_scalar_reduce_512(r, l);
623 }
624 
625 static void secp256k1_scalar_split_128(secp256k1_scalar_t *r1, secp256k1_scalar_t *r2, const secp256k1_scalar_t *a) {
626  r1->d[0] = a->d[0];
627  r1->d[1] = a->d[1];
628  r1->d[2] = a->d[2];
629  r1->d[3] = a->d[3];
630  r1->d[4] = 0;
631  r1->d[5] = 0;
632  r1->d[6] = 0;
633  r1->d[7] = 0;
634  r2->d[0] = a->d[4];
635  r2->d[1] = a->d[5];
636  r2->d[2] = a->d[6];
637  r2->d[3] = a->d[7];
638  r2->d[4] = 0;
639  r2->d[5] = 0;
640  r2->d[6] = 0;
641  r2->d[7] = 0;
642 }
643 
644 SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar_t *a, const secp256k1_scalar_t *b) {
645  return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3]) | (a->d[4] ^ b->d[4]) | (a->d[5] ^ b->d[5]) | (a->d[6] ^ b->d[6]) | (a->d[7] ^ b->d[7])) == 0;
646 }
647 
648 SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar_t *r, const secp256k1_scalar_t *a, const secp256k1_scalar_t *b, unsigned int shift) {
649  VERIFY_CHECK(shift >= 256);
650  uint32_t l[16];
651  secp256k1_scalar_mul_512(l, a, b);
652  unsigned int shiftlimbs = shift >> 5;
653  unsigned int shiftlow = shift & 0x1F;
654  unsigned int shifthigh = 32 - shiftlow;
655  r->d[0] = shift < 512 ? (l[0 + shiftlimbs] >> shiftlow | (shift < 480 && shiftlow ? (l[1 + shiftlimbs] << shifthigh) : 0)) : 0;
656  r->d[1] = shift < 480 ? (l[1 + shiftlimbs] >> shiftlow | (shift < 448 && shiftlow ? (l[2 + shiftlimbs] << shifthigh) : 0)) : 0;
657  r->d[2] = shift < 448 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 416 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
658  r->d[3] = shift < 416 ? (l[3 + shiftlimbs] >> shiftlow | (shift < 384 && shiftlow ? (l[4 + shiftlimbs] << shifthigh) : 0)) : 0;
659  r->d[4] = shift < 384 ? (l[4 + shiftlimbs] >> shiftlow | (shift < 352 && shiftlow ? (l[5 + shiftlimbs] << shifthigh) : 0)) : 0;
660  r->d[5] = shift < 352 ? (l[5 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[6 + shiftlimbs] << shifthigh) : 0)) : 0;
661  r->d[6] = shift < 320 ? (l[6 + shiftlimbs] >> shiftlow | (shift < 288 && shiftlow ? (l[7 + shiftlimbs] << shifthigh) : 0)) : 0;
662  r->d[7] = shift < 288 ? (l[7 + shiftlimbs] >> shiftlow) : 0;
663  if ((l[(shift - 1) >> 5] >> ((shift - 1) & 0x1f)) & 1) {
664  secp256k1_scalar_add_bit(r, 0);
665  }
666 }
667 
668 #endif
VERIFY_CHECK
#define VERIFY_CHECK(cond)
Definition: util.h:61
SECP256K1_N_C_0
#define SECP256K1_N_C_0
Definition: scalar_8x32_impl.h:21
SECP256K1_N_6
#define SECP256K1_N_6
Definition: scalar_8x32_impl.h:17
b
void const uint64_t * b
Definition: field_5x52_asm_impl.h:10
SECP256K1_N_C_3
#define SECP256K1_N_C_3
Definition: scalar_8x32_impl.h:24
secp256k1_scalar_t::d
uint64_t d[4]
Definition: scalar_4x64.h:18
extract
#define extract(n)
Extract the lowest 32 bits of (c0,c1,c2) into n, and left shift the number 32 bits.
Definition: scalar_8x32_impl.h:303
extract_fast
#define extract_fast(n)
Extract the lowest 32 bits of (c0,c1,c2) into n, and left shift the number 32 bits.
Definition: scalar_8x32_impl.h:311
SECP256K1_N_4
#define SECP256K1_N_4
Definition: scalar_8x32_impl.h:15
SECP256K1_N_H_4
#define SECP256K1_N_H_4
Definition: scalar_8x32_impl.h:32
SECP256K1_N_7
#define SECP256K1_N_7
Definition: scalar_8x32_impl.h:18
SECP256K1_N_H_2
#define SECP256K1_N_H_2
Definition: scalar_8x32_impl.h:30
r
void const uint64_t uint64_t * r
Definition: field_5x52_asm_impl.h:10
SECP256K1_N_0
#define SECP256K1_N_0
Definition: scalar_8x32_impl.h:11
muladd
#define muladd(a, b)
Add a*b to the number defined by (c0,c1,c2).
Definition: scalar_8x32_impl.h:236
sumadd
#define sumadd(a)
Add a to the number defined by (c0,c1,c2).
Definition: scalar_8x32_impl.h:287
SECP256K1_N_H_5
#define SECP256K1_N_H_5
Definition: scalar_8x32_impl.h:33
SECP256K1_N_H_0
#define SECP256K1_N_H_0
Definition: scalar_8x32_impl.h:28
zxcvbn::no
const auto no
Definition: adjacency_graphs.cpp:17
SECP256K1_N_5
#define SECP256K1_N_5
Definition: scalar_8x32_impl.h:16
SECP256K1_N_C_2
#define SECP256K1_N_C_2
Definition: scalar_8x32_impl.h:23
SECP256K1_N_C_1
#define SECP256K1_N_C_1
Definition: scalar_8x32_impl.h:22
SECP256K1_N_H_1
#define SECP256K1_N_H_1
Definition: scalar_8x32_impl.h:29
SECP256K1_N_C_4
#define SECP256K1_N_C_4
Definition: scalar_8x32_impl.h:25
SECP256K1_N_3
#define SECP256K1_N_3
Definition: scalar_8x32_impl.h:14
sumadd_fast
#define sumadd_fast(a)
Add a to the number defined by (c0,c1).
Definition: scalar_8x32_impl.h:295
muladd_fast
#define muladd_fast(a, b)
Add a*b to the number defined by (c0,c1).
Definition: scalar_8x32_impl.h:251
SECP256K1_N_1
#define SECP256K1_N_1
Definition: scalar_8x32_impl.h:12
SECP256K1_N_2
#define SECP256K1_N_2
Definition: scalar_8x32_impl.h:13
SECP256K1_N_H_6
#define SECP256K1_N_H_6
Definition: scalar_8x32_impl.h:34
SECP256K1_N_H_7
#define SECP256K1_N_H_7
Definition: scalar_8x32_impl.h:35
SECP256K1_INLINE
#define SECP256K1_INLINE
Definition: secp256k1.h:23
secp256k1_scalar_t
A scalar modulo the group order of the secp256k1 curve.
Definition: scalar_4x64.h:13
muladd2
#define muladd2(a, b)
Add 2*a*b to the number defined by (c0,c1,c2).
Definition: scalar_8x32_impl.h:265
SECP256K1_N_H_3
#define SECP256K1_N_H_3
Definition: scalar_8x32_impl.h:31
Generated on Tue Apr 28 2026 00:02:59 for PRCYCoin by   doxygen 1.8.17