2
0

f25519.h 2.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182
  1. /* Arithmetic mod p = 2^255-19
  2. * Daniel Beer <dlbeer@gmail.com>, 8 Jan 2014
  3. *
  4. * This file is in the public domain.
  5. */
  6. #ifndef F25519_H_
  7. #define F25519_H_
  8. #include <stdint.h>
  9. #include <string.h>
  10. /* Field elements are represented as little-endian byte strings. All
  11. * operations have timings which are independent of input data, so they
  12. * can be safely used for cryptography.
  13. *
  14. * Computation is performed on un-normalized elements. These are byte
  15. * strings which fall into the range 0 <= x < 2p. Use f25519_normalize()
  16. * to convert to a value 0 <= x < p.
  17. *
  18. * Elements received from the outside may greater even than 2p.
  19. * f25519_normalize() will correctly deal with these numbers too.
  20. */
  21. #define F25519_SIZE 32
  22. /* Identity constants */
  23. extern const uint8_t f25519_one[F25519_SIZE];
  24. /* Load a small constant */
  25. void f25519_load(uint8_t *x, uint32_t c);
  26. /* Copy two points */
  27. static inline void f25519_copy(uint8_t *x, const uint8_t *a)
  28. {
  29. memcpy(x, a, F25519_SIZE);
  30. }
  31. /* Normalize a field point x < 2*p by subtracting p if necessary */
  32. void f25519_normalize(uint8_t *x);
  33. /* Compare two field points in constant time. Return one if equal, zero
  34. * otherwise. This should be performed only on normalized values.
  35. */
  36. uint8_t f25519_eq(const uint8_t *x, const uint8_t *y);
  37. /* Conditional copy. If condition == 0, then zero is copied to dst. If
  38. * condition == 1, then one is copied to dst. Any other value results in
  39. * undefined behaviour.
  40. */
  41. void f25519_select(uint8_t *dst,
  42. const uint8_t *zero, const uint8_t *one,
  43. uint8_t condition);
  44. /* Add/subtract two field points. The three pointers are not required to
  45. * be distinct.
  46. */
  47. void f25519_add(uint8_t *r, const uint8_t *a, const uint8_t *b);
  48. void f25519_sub(uint8_t *r, const uint8_t *a, const uint8_t *b);
  49. /* Unary negation */
  50. void f25519_neg(uint8_t *r, const uint8_t *a);
  51. /* Multiply two field points. The __distinct variant is used when r is
  52. * known to be in a different location to a and b.
  53. */
  54. void f25519_mul__distinct(uint8_t *r, const uint8_t *a, const uint8_t *b);
  55. /* Take the reciprocal of a field point. The __distinct variant is used
  56. * when r is known to be in a different location to x.
  57. */
  58. void f25519_inv__distinct(uint8_t *r, const uint8_t *x);
  59. /* Compute one of the square roots of the field element, if the element
  60. * is square. The other square is -r.
  61. *
  62. * If the input is not square, the returned value is a valid field
  63. * element, but not the correct answer. If you don't already know that
  64. * your element is square, you should square the return value and test.
  65. */
  66. void f25519_sqrt(uint8_t *r, const uint8_t *x);
  67. #endif