curve25519-donna-c64.c (13569B)
1 /* Copyright 2008, Google Inc. 2 * All rights reserved. 3 * 4 * Code released into the public domain. 5 * 6 * curve25519-donna: Curve25519 elliptic curve, public key function 7 * 8 * http://code.google.com/p/curve25519-donna/ 9 * 10 * Adam Langley <agl@imperialviolet.org> 11 * 12 * Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to> 13 * 14 * More information about curve25519 can be found here 15 * http://cr.yp.to/ecdh.html 16 * 17 * djb's sample implementation of curve25519 is written in a special assembly 18 * language called qhasm and uses the floating point registers. 19 * 20 * This is, almost, a clean room reimplementation from the curve25519 paper. It 21 * uses many of the tricks described therein. Only the crecip function is taken 22 * from the sample implementation. 23 */ 24 25 #include "orconfig.h" 26 27 #include <string.h> 28 #include "lib/cc/torint.h" 29 30 typedef uint8_t u8; 31 typedef uint64_t limb; 32 typedef limb felem[5]; 33 // This is a special gcc mode for 128-bit integers. It's implemented on 64-bit 34 // platforms only as far as I know. 35 typedef unsigned uint128_t __attribute__((mode(TI))); 36 37 #undef force_inline 38 #define force_inline __attribute__((always_inline)) 39 40 /* Sum two numbers: output += in */ 41 static inline void force_inline 42 fsum(limb *output, const limb *in) { 43 output[0] += in[0]; 44 output[1] += in[1]; 45 output[2] += in[2]; 46 output[3] += in[3]; 47 output[4] += in[4]; 48 } 49 50 /* Find the difference of two numbers: output = in - output 51 * (note the order of the arguments!) 52 * 53 * Assumes that out[i] < 2**52 54 * On return, out[i] < 2**55 55 */ 56 static inline void force_inline 57 fdifference_backwards(felem out, const felem in) { 58 /* 152 is 19 << 3 */ 59 static const limb two54m152 = (((limb)1) << 54) - 152; 60 static const limb two54m8 = (((limb)1) << 54) - 8; 61 62 out[0] = in[0] + two54m152 - out[0]; 63 out[1] = in[1] + two54m8 - out[1]; 64 out[2] = in[2] + two54m8 - out[2]; 65 out[3] = in[3] + two54m8 - out[3]; 66 out[4] = in[4] + two54m8 - out[4]; 67 } 68 69 /* Multiply a number by a scalar: output = in * scalar */ 70 static inline void force_inline 71 fscalar_product(felem output, const felem in, const limb scalar) { 72 uint128_t a; 73 74 a = ((uint128_t) in[0]) * scalar; 75 output[0] = ((limb)a) & 0x7ffffffffffff; 76 77 a = ((uint128_t) in[1]) * scalar + ((limb) (a >> 51)); 78 output[1] = ((limb)a) & 0x7ffffffffffff; 79 80 a = ((uint128_t) in[2]) * scalar + ((limb) (a >> 51)); 81 output[2] = ((limb)a) & 0x7ffffffffffff; 82 83 a = ((uint128_t) in[3]) * scalar + ((limb) (a >> 51)); 84 output[3] = ((limb)a) & 0x7ffffffffffff; 85 86 a = ((uint128_t) in[4]) * scalar + ((limb) (a >> 51)); 87 output[4] = ((limb)a) & 0x7ffffffffffff; 88 89 output[0] += (a >> 51) * 19; 90 } 91 92 /* Multiply two numbers: output = in2 * in 93 * 94 * output must be distinct to both inputs. The inputs are reduced coefficient 95 * form, the output is not. 96 * 97 * Assumes that in[i] < 2**55 and likewise for in2. 98 * On return, output[i] < 2**52 99 */ 100 static inline void force_inline 101 fmul(felem output, const felem in2, const felem in) { 102 uint128_t t[5]; 103 limb r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c; 104 105 r0 = in[0]; 106 r1 = in[1]; 107 r2 = in[2]; 108 r3 = in[3]; 109 r4 = in[4]; 110 111 s0 = in2[0]; 112 s1 = in2[1]; 113 s2 = in2[2]; 114 s3 = in2[3]; 115 s4 = in2[4]; 116 117 t[0] = ((uint128_t) r0) * s0; 118 t[1] = ((uint128_t) r0) * s1 + ((uint128_t) r1) * s0; 119 t[2] = ((uint128_t) r0) * s2 + ((uint128_t) r2) * s0 + ((uint128_t) r1) * s1; 120 t[3] = ((uint128_t) r0) * s3 + ((uint128_t) r3) * s0 + ((uint128_t) r1) * s2 + ((uint128_t) r2) * s1; 121 t[4] = ((uint128_t) r0) * s4 + ((uint128_t) r4) * s0 + ((uint128_t) r3) * s1 + ((uint128_t) r1) * s3 + ((uint128_t) r2) * s2; 122 123 r4 *= 19; 124 r1 *= 19; 125 r2 *= 19; 126 r3 *= 19; 127 128 t[0] += ((uint128_t) r4) * s1 + ((uint128_t) r1) * s4 + ((uint128_t) r2) * s3 + ((uint128_t) r3) * s2; 129 t[1] += ((uint128_t) r4) * s2 + ((uint128_t) r2) * s4 + ((uint128_t) r3) * s3; 130 t[2] += ((uint128_t) r4) * s3 + ((uint128_t) r3) * s4; 131 t[3] += ((uint128_t) r4) * s4; 132 133 r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51); 134 t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51); 135 t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51); 136 t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51); 137 t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51); 138 r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff; 139 r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff; 140 r2 += c; 141 142 output[0] = r0; 143 output[1] = r1; 144 output[2] = r2; 145 output[3] = r3; 146 output[4] = r4; 147 } 148 149 static inline void force_inline 150 fsquare_times(felem output, const felem in, limb count) { 151 uint128_t t[5]; 152 limb r0,r1,r2,r3,r4,c; 153 limb d0,d1,d2,d4,d419; 154 155 r0 = in[0]; 156 r1 = in[1]; 157 r2 = in[2]; 158 r3 = in[3]; 159 r4 = in[4]; 160 161 do { 162 d0 = r0 * 2; 163 d1 = r1 * 2; 164 d2 = r2 * 2 * 19; 165 d419 = r4 * 19; 166 d4 = d419 * 2; 167 168 t[0] = ((uint128_t) r0) * r0 + ((uint128_t) d4) * r1 + (((uint128_t) d2) * (r3 )); 169 t[1] = ((uint128_t) d0) * r1 + ((uint128_t) d4) * r2 + (((uint128_t) r3) * (r3 * 19)); 170 t[2] = ((uint128_t) d0) * r2 + ((uint128_t) r1) * r1 + (((uint128_t) d4) * (r3 )); 171 t[3] = ((uint128_t) d0) * r3 + ((uint128_t) d1) * r2 + (((uint128_t) r4) * (d419 )); 172 t[4] = ((uint128_t) d0) * r4 + ((uint128_t) d1) * r3 + (((uint128_t) r2) * (r2 )); 173 174 r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51); 175 t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51); 176 t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51); 177 t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51); 178 t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51); 179 r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff; 180 r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff; 181 r2 += c; 182 } while(--count); 183 184 output[0] = r0; 185 output[1] = r1; 186 output[2] = r2; 187 output[3] = r3; 188 output[4] = r4; 189 } 190 191 /* Load a little-endian 64-bit number */ 192 static limb 193 load_limb(const u8 *in) { 194 return 195 ((limb)in[0]) | 196 (((limb)in[1]) << 8) | 197 (((limb)in[2]) << 16) | 198 (((limb)in[3]) << 24) | 199 (((limb)in[4]) << 32) | 200 (((limb)in[5]) << 40) | 201 (((limb)in[6]) << 48) | 202 (((limb)in[7]) << 56); 203 } 204 205 static void 206 store_limb(u8 *out, limb in) { 207 out[0] = in & 0xff; 208 out[1] = (in >> 8) & 0xff; 209 out[2] = (in >> 16) & 0xff; 210 out[3] = (in >> 24) & 0xff; 211 out[4] = (in >> 32) & 0xff; 212 out[5] = (in >> 40) & 0xff; 213 out[6] = (in >> 48) & 0xff; 214 out[7] = (in >> 56) & 0xff; 215 } 216 217 /* Take a little-endian, 32-byte number and expand it into polynomial form */ 218 static void 219 fexpand(limb *output, const u8 *in) { 220 output[0] = load_limb(in) & 0x7ffffffffffff; 221 output[1] = (load_limb(in+6) >> 3) & 0x7ffffffffffff; 222 output[2] = (load_limb(in+12) >> 6) & 0x7ffffffffffff; 223 output[3] = (load_limb(in+19) >> 1) & 0x7ffffffffffff; 224 output[4] = (load_limb(in+24) >> 12) & 0x7ffffffffffff; 225 } 226 227 /* Take a fully reduced polynomial form number and contract it into a 228 * little-endian, 32-byte array 229 */ 230 static void 231 fcontract(u8 *output, const felem input) { 232 uint128_t t[5]; 233 234 t[0] = input[0]; 235 t[1] = input[1]; 236 t[2] = input[2]; 237 t[3] = input[3]; 238 t[4] = input[4]; 239 240 t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; 241 t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; 242 t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; 243 t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; 244 t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; 245 246 t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; 247 t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; 248 t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; 249 t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; 250 t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; 251 252 /* now t is between 0 and 2^255-1, properly carried. */ 253 /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */ 254 255 t[0] += 19; 256 257 t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; 258 t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; 259 t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; 260 t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; 261 t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; 262 263 /* now between 19 and 2^255-1 in both cases, and offset by 19. */ 264 265 t[0] += 0x8000000000000 - 19; 266 t[1] += 0x8000000000000 - 1; 267 t[2] += 0x8000000000000 - 1; 268 t[3] += 0x8000000000000 - 1; 269 t[4] += 0x8000000000000 - 1; 270 271 /* now between 2^255 and 2^256-20, and offset by 2^255. */ 272 273 t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; 274 t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; 275 t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; 276 t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; 277 t[4] &= 0x7ffffffffffff; 278 279 store_limb(output, t[0] | (t[1] << 51)); 280 store_limb(output+8, (t[1] >> 13) | (t[2] << 38)); 281 store_limb(output+16, (t[2] >> 26) | (t[3] << 25)); 282 store_limb(output+24, (t[3] >> 39) | (t[4] << 12)); 283 } 284 285 /* Input: Q, Q', Q-Q' 286 * Output: 2Q, Q+Q' 287 * 288 * x2 z3: long form 289 * x3 z3: long form 290 * x z: short form, destroyed 291 * xprime zprime: short form, destroyed 292 * qmqp: short form, preserved 293 */ 294 static void 295 fmonty(limb *x2, limb *z2, /* output 2Q */ 296 limb *x3, limb *z3, /* output Q + Q' */ 297 limb *x, limb *z, /* input Q */ 298 limb *xprime, limb *zprime, /* input Q' */ 299 const limb *qmqp /* input Q - Q' */) { 300 limb origx[5], origxprime[5], zzz[5], xx[5], zz[5], xxprime[5], 301 zzprime[5], zzzprime[5]; 302 303 memcpy(origx, x, 5 * sizeof(limb)); 304 fsum(x, z); 305 fdifference_backwards(z, origx); // does x - z 306 307 memcpy(origxprime, xprime, sizeof(limb) * 5); 308 fsum(xprime, zprime); 309 fdifference_backwards(zprime, origxprime); 310 fmul(xxprime, xprime, z); 311 fmul(zzprime, x, zprime); 312 memcpy(origxprime, xxprime, sizeof(limb) * 5); 313 fsum(xxprime, zzprime); 314 fdifference_backwards(zzprime, origxprime); 315 fsquare_times(x3, xxprime, 1); 316 fsquare_times(zzzprime, zzprime, 1); 317 fmul(z3, zzzprime, qmqp); 318 319 fsquare_times(xx, x, 1); 320 fsquare_times(zz, z, 1); 321 fmul(x2, xx, zz); 322 fdifference_backwards(zz, xx); // does zz = xx - zz 323 fscalar_product(zzz, zz, 121665); 324 fsum(zzz, xx); 325 fmul(z2, zz, zzz); 326 } 327 328 // ----------------------------------------------------------------------------- 329 // Maybe swap the contents of two limb arrays (@a and @b), each @len elements 330 // long. Perform the swap iff @swap is non-zero. 331 // 332 // This function performs the swap without leaking any side-channel 333 // information. 334 // ----------------------------------------------------------------------------- 335 static void 336 swap_conditional(limb a[5], limb b[5], limb iswap) { 337 unsigned i; 338 const limb swap = -iswap; 339 340 for (i = 0; i < 5; ++i) { 341 const limb x = swap & (a[i] ^ b[i]); 342 a[i] ^= x; 343 b[i] ^= x; 344 } 345 } 346 347 /* Calculates nQ where Q is the x-coordinate of a point on the curve 348 * 349 * resultx/resultz: the x coordinate of the resulting curve point (short form) 350 * n: a little endian, 32-byte number 351 * q: a point of the curve (short form) 352 */ 353 static void 354 cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) { 355 limb a[5] = {0}, b[5] = {1}, c[5] = {1}, d[5] = {0}; 356 limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t; 357 limb e[5] = {0}, f[5] = {1}, g[5] = {0}, h[5] = {1}; 358 limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h; 359 360 unsigned i, j; 361 362 memcpy(nqpqx, q, sizeof(limb) * 5); 363 364 for (i = 0; i < 32; ++i) { 365 u8 byte = n[31 - i]; 366 for (j = 0; j < 8; ++j) { 367 const limb bit = byte >> 7; 368 369 swap_conditional(nqx, nqpqx, bit); 370 swap_conditional(nqz, nqpqz, bit); 371 fmonty(nqx2, nqz2, 372 nqpqx2, nqpqz2, 373 nqx, nqz, 374 nqpqx, nqpqz, 375 q); 376 swap_conditional(nqx2, nqpqx2, bit); 377 swap_conditional(nqz2, nqpqz2, bit); 378 379 t = nqx; 380 nqx = nqx2; 381 nqx2 = t; 382 t = nqz; 383 nqz = nqz2; 384 nqz2 = t; 385 t = nqpqx; 386 nqpqx = nqpqx2; 387 nqpqx2 = t; 388 t = nqpqz; 389 nqpqz = nqpqz2; 390 nqpqz2 = t; 391 392 byte <<= 1; 393 } 394 } 395 396 memcpy(resultx, nqx, sizeof(limb) * 5); 397 memcpy(resultz, nqz, sizeof(limb) * 5); 398 } 399 400 401 // ----------------------------------------------------------------------------- 402 // Shamelessly copied from djb's code, tightened a little 403 // ----------------------------------------------------------------------------- 404 static void 405 crecip(felem out, const felem z) { 406 felem a,t0,b,c; 407 408 /* 2 */ fsquare_times(a, z, 1); // a = 2 409 /* 8 */ fsquare_times(t0, a, 2); 410 /* 9 */ fmul(b, t0, z); // b = 9 411 /* 11 */ fmul(a, b, a); // a = 11 412 /* 22 */ fsquare_times(t0, a, 1); 413 /* 2^5 - 2^0 = 31 */ fmul(b, t0, b); 414 /* 2^10 - 2^5 */ fsquare_times(t0, b, 5); 415 /* 2^10 - 2^0 */ fmul(b, t0, b); 416 /* 2^20 - 2^10 */ fsquare_times(t0, b, 10); 417 /* 2^20 - 2^0 */ fmul(c, t0, b); 418 /* 2^40 - 2^20 */ fsquare_times(t0, c, 20); 419 /* 2^40 - 2^0 */ fmul(t0, t0, c); 420 /* 2^50 - 2^10 */ fsquare_times(t0, t0, 10); 421 /* 2^50 - 2^0 */ fmul(b, t0, b); 422 /* 2^100 - 2^50 */ fsquare_times(t0, b, 50); 423 /* 2^100 - 2^0 */ fmul(c, t0, b); 424 /* 2^200 - 2^100 */ fsquare_times(t0, c, 100); 425 /* 2^200 - 2^0 */ fmul(t0, t0, c); 426 /* 2^250 - 2^50 */ fsquare_times(t0, t0, 50); 427 /* 2^250 - 2^0 */ fmul(t0, t0, b); 428 /* 2^255 - 2^5 */ fsquare_times(t0, t0, 5); 429 /* 2^255 - 21 */ fmul(out, t0, a); 430 } 431 432 int curve25519_donna(u8 *, const u8 *, const u8 *); 433 434 int 435 curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) { 436 limb bp[5], x[5], z[5], zmone[5]; 437 uint8_t e[32]; 438 int i; 439 440 for (i = 0;i < 32;++i) e[i] = secret[i]; 441 e[0] &= 248; 442 e[31] &= 127; 443 e[31] |= 64; 444 445 fexpand(bp, basepoint); 446 cmult(x, z, e, bp); 447 crecip(zmone, z); 448 fmul(z, x, zmone); 449 fcontract(mypublic, z); 450 return 0; 451 }