tommath/bn_mp_exptmod_fast.c

322 lines
7.9 KiB
C
Raw Normal View History

#include <tommath_private.h>
2004-10-29 18:07:18 -04:00
#ifdef BN_MP_EXPTMOD_FAST_C
2003-02-28 11:08:34 -05:00
/* LibTomMath, multiple-precision integer library -- Tom St Denis
*
2003-08-04 21:24:44 -04:00
* LibTomMath is a library that provides multiple-precision
2003-02-28 11:08:34 -05:00
* integer arithmetic as well as number theoretic functionality.
*
2003-08-04 21:24:44 -04:00
* The library was designed directly after the MPI library by
2003-02-28 11:08:34 -05:00
* Michael Fromberger but has been written from scratch with
* additional optimizations in place.
*
* The library is free for all purposes without any express
* guarantee it works.
*
* Tom St Denis, tstdenis82@gmail.com, http://libtom.org
2003-02-28 11:08:34 -05:00
*/
2003-09-19 18:43:07 -04:00
/* computes Y == G**X mod P, HAC pp.616, Algorithm 14.85
2003-02-28 11:08:34 -05:00
*
* Uses a left-to-right k-ary sliding window to compute the modular exponentiation.
* The value of k changes based on the size of the exponent.
*
2003-05-17 08:33:54 -04:00
* Uses Montgomery or Diminished Radix reduction [whichever appropriate]
2003-02-28 11:08:34 -05:00
*/
2003-07-02 11:39:39 -04:00
#ifdef MP_LOW_MEM
#define TAB_SIZE 32
#else
#define TAB_SIZE 256
#endif
2005-02-12 03:40:15 -05:00
int mp_exptmod_fast (mp_int * G, mp_int * X, mp_int * P, mp_int * Y, int redmode)
2003-02-28 11:08:34 -05:00
{
2003-07-02 11:39:39 -04:00
mp_int M[TAB_SIZE], res;
2003-02-28 11:09:08 -05:00
mp_digit buf, mp;
int err, bitbuf, bitcpy, bitcnt, mode, digidx, x, y, winsize;
2003-09-19 18:43:07 -04:00
2003-05-29 09:35:26 -04:00
/* use a pointer to the reduction algorithm. This allows us to use
* one of many reduction algorithms without modding the guts of
2003-09-19 18:43:07 -04:00
* the code with if statements everywhere.
2003-05-29 09:35:26 -04:00
*/
2003-03-22 10:10:20 -05:00
int (*redux)(mp_int*,mp_int*,mp_digit);
2003-05-17 08:33:54 -04:00
2003-02-28 11:08:34 -05:00
/* find window size */
x = mp_count_bits(X);
2003-02-28 11:08:34 -05:00
if (x <= 7) {
winsize = 2;
} else if (x <= 36) {
winsize = 3;
} else if (x <= 140) {
winsize = 4;
} else if (x <= 450) {
winsize = 5;
} else if (x <= 1303) {
winsize = 6;
} else if (x <= 3529) {
winsize = 7;
} else {
winsize = 8;
}
2003-05-17 08:33:54 -04:00
#ifdef MP_LOW_MEM
if (winsize > 5) {
winsize = 5;
}
#endif
2003-07-02 11:39:39 -04:00
/* init M array */
/* init first cell */
2017-06-24 10:48:10 -04:00
if ((err = mp_init_size(&M[1], P->alloc)) != MP_OKAY) {
2003-09-19 18:43:07 -04:00
return err;
2003-07-02 11:39:39 -04:00
}
2003-05-17 08:33:54 -04:00
2003-07-02 11:39:39 -04:00
/* now init the second half of the array */
for (x = 1<<(winsize-1); x < (1 << winsize); x++) {
2017-06-24 10:48:10 -04:00
if ((err = mp_init_size(&M[x], P->alloc)) != MP_OKAY) {
2003-07-02 11:39:39 -04:00
for (y = 1<<(winsize-1); y < x; y++) {
mp_clear(&M[y]);
2003-02-28 11:08:34 -05:00
}
2003-07-02 11:39:39 -04:00
mp_clear(&M[1]);
2003-02-28 11:08:34 -05:00
return err;
}
}
2003-05-17 08:33:54 -04:00
2003-05-29 09:35:26 -04:00
/* determine and setup reduction code */
2003-03-22 10:10:20 -05:00
if (redmode == 0) {
2017-08-29 23:51:11 -04:00
#ifdef BN_MP_MONTGOMERY_SETUP_C
2003-03-22 10:10:20 -05:00
/* now setup montgomery */
if ((err = mp_montgomery_setup(P, &mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_M;
2003-03-22 10:10:20 -05:00
}
2004-10-29 18:07:18 -04:00
#else
err = MP_VAL;
2004-12-22 21:40:37 -05:00
goto LBL_M;
2004-10-29 18:07:18 -04:00
#endif
2003-09-19 18:43:07 -04:00
2003-05-17 08:33:54 -04:00
/* automatically pick the comba one if available (saves quite a few calls/ifs) */
2004-10-29 18:07:18 -04:00
#ifdef BN_FAST_MP_MONTGOMERY_REDUCE_C
if ((((P->used * 2) + 1) < MP_WARRAY) &&
(P->used < (1 << ((CHAR_BIT * sizeof(mp_word)) - (2 * DIGIT_BIT))))) {
2003-05-17 08:33:54 -04:00
redux = fast_mp_montgomery_reduce;
2017-08-29 23:51:11 -04:00
} else
2004-10-29 18:07:18 -04:00
#endif
{
#ifdef BN_MP_MONTGOMERY_REDUCE_C
2003-08-04 21:24:44 -04:00
/* use slower baseline Montgomery method */
2003-05-17 08:33:54 -04:00
redux = mp_montgomery_reduce;
2004-10-29 18:07:18 -04:00
#else
err = MP_VAL;
2004-12-22 21:40:37 -05:00
goto LBL_M;
2004-10-29 18:07:18 -04:00
#endif
2003-05-17 08:33:54 -04:00
}
2003-05-29 09:35:26 -04:00
} else if (redmode == 1) {
2004-10-29 18:07:18 -04:00
#if defined(BN_MP_DR_SETUP_C) && defined(BN_MP_DR_REDUCE_C)
2003-08-04 21:24:44 -04:00
/* setup DR reduction for moduli of the form B**k - b */
2003-03-22 10:10:20 -05:00
mp_dr_setup(P, &mp);
redux = mp_dr_reduce;
2004-10-29 18:07:18 -04:00
#else
err = MP_VAL;
2004-12-22 21:40:37 -05:00
goto LBL_M;
2004-10-29 18:07:18 -04:00
#endif
2003-05-29 09:35:26 -04:00
} else {
2004-10-29 18:07:18 -04:00
#if defined(BN_MP_REDUCE_2K_SETUP_C) && defined(BN_MP_REDUCE_2K_C)
2003-08-04 21:24:44 -04:00
/* setup DR reduction for moduli of the form 2**k - b */
2003-05-29 09:35:26 -04:00
if ((err = mp_reduce_2k_setup(P, &mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_M;
2003-05-29 09:35:26 -04:00
}
redux = mp_reduce_2k;
2004-10-29 18:07:18 -04:00
#else
err = MP_VAL;
2004-12-22 21:40:37 -05:00
goto LBL_M;
2004-10-29 18:07:18 -04:00
#endif
2003-02-28 11:08:34 -05:00
}
/* setup result */
if ((err = mp_init_size(&res, P->alloc)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_M;
2003-02-28 11:08:34 -05:00
}
/* create M table
*
2004-10-29 18:07:18 -04:00
2003-02-28 11:08:34 -05:00
*
* The first half of the table is not computed though accept for M[0] and M[1]
*/
2003-02-28 11:09:08 -05:00
2003-03-22 10:10:20 -05:00
if (redmode == 0) {
2004-10-29 18:07:18 -04:00
#ifdef BN_MP_MONTGOMERY_CALC_NORMALIZATION_C
2003-03-22 10:10:20 -05:00
/* now we need R mod m */
if ((err = mp_montgomery_calc_normalization(&res, P)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-03-22 10:10:20 -05:00
}
2003-02-28 11:08:34 -05:00
2003-03-22 10:10:20 -05:00
/* now set M[1] to G * R mod m */
if ((err = mp_mulmod(G, &res, P, &M[1])) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-03-22 10:10:20 -05:00
}
#else
err = MP_VAL;
goto LBL_RES;
#endif
2003-03-22 10:10:20 -05:00
} else {
mp_set(&res, 1);
if ((err = mp_mod(G, P, &M[1])) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-03-22 10:10:20 -05:00
}
2003-02-28 11:08:34 -05:00
}
2003-05-17 08:33:54 -04:00
2003-02-28 11:08:34 -05:00
/* compute the value at M[1<<(winsize-1)] by squaring M[1] (winsize-1) times */
if ((err = mp_copy(&M[1], &M[1 << (winsize - 1)])) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
for (x = 0; x < (winsize - 1); x++) {
if ((err = mp_sqr(&M[1 << (winsize - 1)], &M[1 << (winsize - 1)])) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
if ((err = redux(&M[1 << (winsize - 1)], P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
}
/* create upper table */
for (x = (1 << (winsize - 1)) + 1; x < (1 << winsize); x++) {
if ((err = mp_mul(&M[x - 1], &M[1], &M[x])) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
if ((err = redux(&M[x], P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
}
/* set initial mode and bit cnt */
2003-05-17 08:33:54 -04:00
mode = 0;
bitcnt = 1;
buf = 0;
2003-02-28 11:08:34 -05:00
digidx = X->used - 1;
2003-05-29 09:35:26 -04:00
bitcpy = 0;
bitbuf = 0;
2003-02-28 11:08:34 -05:00
for (;;) {
/* grab next digit as required */
if (--bitcnt == 0) {
2003-08-04 21:24:44 -04:00
/* if digidx == -1 we are out of digits so break */
2003-02-28 11:08:34 -05:00
if (digidx == -1) {
2003-05-17 08:33:54 -04:00
break;
2003-02-28 11:08:34 -05:00
}
2003-08-04 21:24:44 -04:00
/* read next digit and reset bitcnt */
buf = X->dp[digidx--];
bitcnt = (int)DIGIT_BIT;
2003-02-28 11:08:34 -05:00
}
/* grab the next msb from the exponent */
2003-08-04 21:24:44 -04:00
y = (mp_digit)(buf >> (DIGIT_BIT - 1)) & 1;
2003-05-17 08:33:54 -04:00
buf <<= (mp_digit)1;
2003-02-28 11:08:34 -05:00
/* if the bit is zero and mode == 0 then we ignore it
* These represent the leading zero bits before the first 1 bit
* in the exponent. Technically this opt is not required but it
* does lower the # of trivial squaring/reductions used
*/
if ((mode == 0) && (y == 0)) {
2003-02-28 11:08:34 -05:00
continue;
2003-05-17 08:33:54 -04:00
}
2003-02-28 11:08:34 -05:00
/* if the bit is zero and mode == 1 then we square */
if ((mode == 1) && (y == 0)) {
if ((err = mp_sqr(&res, &res)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
if ((err = redux(&res, P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
continue;
}
/* else we add it to the window */
bitbuf |= (y << (winsize - ++bitcpy));
2003-08-04 21:24:44 -04:00
mode = 2;
2003-02-28 11:08:34 -05:00
if (bitcpy == winsize) {
2003-03-29 13:16:01 -05:00
/* ok window is filled so square as required and multiply */
2003-02-28 11:08:34 -05:00
/* square first */
for (x = 0; x < winsize; x++) {
if ((err = mp_sqr(&res, &res)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-05-17 08:33:54 -04:00
}
if ((err = redux(&res, P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-05-17 08:33:54 -04:00
}
2003-02-28 11:08:34 -05:00
}
/* then multiply */
if ((err = mp_mul(&res, &M[bitbuf], &res)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
if ((err = redux(&res, P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
/* empty window and reset */
2003-05-29 09:35:26 -04:00
bitcpy = 0;
bitbuf = 0;
2003-08-04 21:24:44 -04:00
mode = 1;
2003-02-28 11:08:34 -05:00
}
}
/* if bits remain then square/multiply */
if ((mode == 2) && (bitcpy > 0)) {
2003-02-28 11:08:34 -05:00
/* square then multiply if the bit is set */
for (x = 0; x < bitcpy; x++) {
if ((err = mp_sqr(&res, &res)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
if ((err = redux(&res, P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-02-28 11:08:34 -05:00
}
2003-08-04 21:24:44 -04:00
/* get next bit of the window */
2003-02-28 11:08:34 -05:00
bitbuf <<= 1;
if ((bitbuf & (1 << winsize)) != 0) {
2003-05-17 08:33:54 -04:00
/* then multiply */
if ((err = mp_mul(&res, &M[1], &res)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-05-17 08:33:54 -04:00
}
if ((err = redux(&res, P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-05-17 08:33:54 -04:00
}
2003-02-28 11:08:34 -05:00
}
}
}
2003-03-22 10:10:20 -05:00
if (redmode == 0) {
2003-08-04 21:24:44 -04:00
/* fixup result if Montgomery reduction is used
* recall that any value in a Montgomery system is
* actually multiplied by R mod n. So we have
* to reduce one more time to cancel out the factor
* of R.
*/
2004-10-29 18:07:18 -04:00
if ((err = redux(&res, P, mp)) != MP_OKAY) {
2004-12-22 21:40:37 -05:00
goto LBL_RES;
2003-03-22 10:10:20 -05:00
}
2003-05-17 08:33:54 -04:00
}
2003-02-28 11:08:34 -05:00
2003-08-04 21:24:44 -04:00
/* swap res with Y */
mp_exch(&res, Y);
2003-02-28 11:08:34 -05:00
err = MP_OKAY;
LBL_RES:mp_clear(&res);
2004-12-22 21:40:37 -05:00
LBL_M:
2003-07-02 11:39:39 -04:00
mp_clear(&M[1]);
for (x = 1<<(winsize-1); x < (1 << winsize); x++) {
mp_clear(&M[x]);
2003-02-28 11:08:34 -05:00
}
return err;
}
2004-10-29 18:07:18 -04:00
#endif
2005-08-01 12:37:28 -04:00
2017-08-28 10:27:26 -04:00
/* ref: $Format:%D$ */
/* git commit: $Format:%H$ */
/* commit time: $Format:%ai$ */