From 6926113a10774528d211f20b997859c985995734 Mon Sep 17 00:00:00 2001 From: Sun Yimin Date: Wed, 14 Aug 2024 10:38:13 +0800 Subject: [PATCH] sm2ec/fiat: regenerate to include more functions and scalar/order related --- internal/sm2ec/fiat/generate.go | 9 +- internal/sm2ec/fiat/sm2p256_fiat64.go | 339 ++- internal/sm2ec/fiat/sm2p256_order.go | 1299 ------------ internal/sm2ec/fiat/sm2p256scalar.go | 133 ++ internal/sm2ec/fiat/sm2p256scalar_fiat64.go | 1887 +++++++++++++++++ internal/sm2ec/fiat/sm2p256scalar_invert.go | 201 ++ ...56_order_test.go => sm2p256scalar_test.go} | 0 internal/sm2ec/sm2p256_ord.go | 81 +- 8 files changed, 2567 insertions(+), 1382 deletions(-) delete mode 100644 internal/sm2ec/fiat/sm2p256_order.go create mode 100644 internal/sm2ec/fiat/sm2p256scalar.go create mode 100644 internal/sm2ec/fiat/sm2p256scalar_fiat64.go create mode 100644 internal/sm2ec/fiat/sm2p256scalar_invert.go rename internal/sm2ec/fiat/{sm2p256_order_test.go => sm2p256scalar_test.go} (100%) diff --git a/internal/sm2ec/fiat/generate.go b/internal/sm2ec/fiat/generate.go index d0907047..2fd525bc 100644 --- a/internal/sm2ec/fiat/generate.go +++ b/internal/sm2ec/fiat/generate.go @@ -30,6 +30,13 @@ var curves = []struct { FiatType: "[4]uint64", BytesLen: 32, }, + { + Element: "SM2P256OrderElement", + Prime: "2^256 - 2^224 - 188730267045675049073202170516080344797", + Prefix: "sm2p256scalar", + FiatType: "[4]uint64", + BytesLen: 32, + }, } func main() { @@ -70,7 +77,7 @@ func main() { "--doc-prepend-header", "Code generated by Fiat Cryptography. DO NOT EDIT.", "--package-name", "fiat", "--no-prefix-fiat", c.Prefix, "64", c.Prime, "mul", "square", "add", "sub", "one", "from_montgomery", "to_montgomery", - "selectznz", "to_bytes", "from_bytes") + "selectznz", "to_bytes", "from_bytes", "nonzero", "opp", "msat", "divstep", "divstep_precomp") cmd.Stderr = os.Stderr out, err := cmd.Output() if err != nil { diff --git a/internal/sm2ec/fiat/sm2p256_fiat64.go b/internal/sm2ec/fiat/sm2p256_fiat64.go index 4bd6df62..e1818de4 100644 --- a/internal/sm2ec/fiat/sm2p256_fiat64.go +++ b/internal/sm2ec/fiat/sm2p256_fiat64.go @@ -1,12 +1,12 @@ // Code generated by Fiat Cryptography. DO NOT EDIT. // -// Autogenerated: word_by_word_montgomery --lang Go --no-wide-int --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --internal-static --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name fiat --no-prefix-fiat sm2p256 64 '2^256 - 2^224 - 2^96 + 2^64 - 1' mul square add sub one from_montgomery to_montgomery selectznz to_bytes from_bytes +// Autogenerated: word_by_word_montgomery --lang Go --no-wide-int --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --internal-static --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name fiat --no-prefix-fiat sm2p256 64 '2^256 - 2^224 - 2^96 + 2^64 - 1' mul square add sub one from_montgomery to_montgomery selectznz to_bytes from_bytes nonzero opp msat divstep divstep_precomp // // curve description: sm2p256 // // machine_wordsize = 64 (from "64") // -// requested operations: mul, square, add, sub, one, from_montgomery, to_montgomery, selectznz, to_bytes, from_bytes +// requested operations: mul, square, add, sub, one, from_montgomery, to_montgomery, selectznz, to_bytes, from_bytes, nonzero, opp, msat, divstep, divstep_precomp // // m = 0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff (from "2^256 - 2^224 - 2^96 + 2^64 - 1") // @@ -41,7 +41,7 @@ package fiat import "math/bits" type sm2p256Uint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 -type sm2p256Int1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 +type sm2p256Int1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 // The type sm2p256MontgomeryDomainFieldElement is a field element in the Montgomery domain. // @@ -1315,7 +1315,7 @@ func sm2p256ToMontgomery(out1 *sm2p256MontgomeryDomainFieldElement, arg1 *sm2p25 // sm2p256Selectznz is a multi-limb conditional select. // // Postconditions: -// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3) +// out1 = (if arg1 = 0 then arg2 else arg3) // // Input Bounds: // arg1: [0x0 ~> 0x1] @@ -1522,3 +1522,334 @@ func sm2p256FromBytes(out1 *[4]uint64, arg1 *[32]uint8) { out1[2] = x53 out1[3] = x60 } + +// sm2p256Nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +// +// Input Bounds: +// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// Output Bounds: +// out1: [0x0 ~> 0xffffffffffffffff] +func sm2p256Nonzero(out1 *uint64, arg1 *[4]uint64) { + x1 := (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))) + *out1 = x1 +} + +// sm2p256Opp negates a field element in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +// 0 ≤ eval out1 < m +// +func sm2p256Opp(out1 *sm2p256MontgomeryDomainFieldElement, arg1 *sm2p256MontgomeryDomainFieldElement) { + var x1 uint64 + var x2 uint64 + x1, x2 = bits.Sub64(uint64(0x0), arg1[0], uint64(0x0)) + var x3 uint64 + var x4 uint64 + x3, x4 = bits.Sub64(uint64(0x0), arg1[1], uint64(sm2p256Uint1(x2))) + var x5 uint64 + var x6 uint64 + x5, x6 = bits.Sub64(uint64(0x0), arg1[2], uint64(sm2p256Uint1(x4))) + var x7 uint64 + var x8 uint64 + x7, x8 = bits.Sub64(uint64(0x0), arg1[3], uint64(sm2p256Uint1(x6))) + var x9 uint64 + sm2p256CmovznzU64(&x9, sm2p256Uint1(x8), uint64(0x0), 0xffffffffffffffff) + var x10 uint64 + var x11 uint64 + x10, x11 = bits.Add64(x1, x9, uint64(0x0)) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(x3, (x9 & 0xffffffff00000000), uint64(sm2p256Uint1(x11))) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(x5, x9, uint64(sm2p256Uint1(x13))) + var x16 uint64 + x16, _ = bits.Add64(x7, (x9 & 0xfffffffeffffffff), uint64(sm2p256Uint1(x15))) + out1[0] = x10 + out1[1] = x12 + out1[2] = x14 + out1[3] = x16 +} + +// sm2p256Msat returns the saturated representation of the prime modulus. +// +// Postconditions: +// twos_complement_eval out1 = m +// 0 ≤ eval out1 < m +// +// Output Bounds: +// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256Msat(out1 *[5]uint64) { + out1[0] = 0xffffffffffffffff + out1[1] = 0xffffffff00000000 + out1[2] = 0xffffffffffffffff + out1[3] = 0xfffffffeffffffff + out1[4] = uint64(0x0) +} + +// sm2p256Divstep computes a divstep. +// +// Preconditions: +// 0 ≤ eval arg4 < m +// 0 ≤ eval arg5 < m +// Postconditions: +// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +// 0 ≤ eval out5 < m +// 0 ≤ eval out5 < m +// 0 ≤ eval out2 < m +// 0 ≤ eval out3 < m +// +// Input Bounds: +// arg1: [0x0 ~> 0xffffffffffffffff] +// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// Output Bounds: +// out1: [0x0 ~> 0xffffffffffffffff] +// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256Divstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4]uint64, out5 *[4]uint64, arg1 uint64, arg2 *[5]uint64, arg3 *[5]uint64, arg4 *[4]uint64, arg5 *[4]uint64) { + var x1 uint64 + x1, _ = bits.Add64((^arg1), uint64(0x1), uint64(0x0)) + x3 := (sm2p256Uint1((x1 >> 63)) & (sm2p256Uint1(arg3[0]) & 0x1)) + var x4 uint64 + x4, _ = bits.Add64((^arg1), uint64(0x1), uint64(0x0)) + var x6 uint64 + sm2p256CmovznzU64(&x6, x3, arg1, x4) + var x7 uint64 + sm2p256CmovznzU64(&x7, x3, arg2[0], arg3[0]) + var x8 uint64 + sm2p256CmovznzU64(&x8, x3, arg2[1], arg3[1]) + var x9 uint64 + sm2p256CmovznzU64(&x9, x3, arg2[2], arg3[2]) + var x10 uint64 + sm2p256CmovznzU64(&x10, x3, arg2[3], arg3[3]) + var x11 uint64 + sm2p256CmovznzU64(&x11, x3, arg2[4], arg3[4]) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(uint64(0x1), (^arg2[0]), uint64(0x0)) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(uint64(0x0), (^arg2[1]), uint64(sm2p256Uint1(x13))) + var x16 uint64 + var x17 uint64 + x16, x17 = bits.Add64(uint64(0x0), (^arg2[2]), uint64(sm2p256Uint1(x15))) + var x18 uint64 + var x19 uint64 + x18, x19 = bits.Add64(uint64(0x0), (^arg2[3]), uint64(sm2p256Uint1(x17))) + var x20 uint64 + x20, _ = bits.Add64(uint64(0x0), (^arg2[4]), uint64(sm2p256Uint1(x19))) + var x22 uint64 + sm2p256CmovznzU64(&x22, x3, arg3[0], x12) + var x23 uint64 + sm2p256CmovznzU64(&x23, x3, arg3[1], x14) + var x24 uint64 + sm2p256CmovznzU64(&x24, x3, arg3[2], x16) + var x25 uint64 + sm2p256CmovznzU64(&x25, x3, arg3[3], x18) + var x26 uint64 + sm2p256CmovznzU64(&x26, x3, arg3[4], x20) + var x27 uint64 + sm2p256CmovznzU64(&x27, x3, arg4[0], arg5[0]) + var x28 uint64 + sm2p256CmovznzU64(&x28, x3, arg4[1], arg5[1]) + var x29 uint64 + sm2p256CmovznzU64(&x29, x3, arg4[2], arg5[2]) + var x30 uint64 + sm2p256CmovznzU64(&x30, x3, arg4[3], arg5[3]) + var x31 uint64 + var x32 uint64 + x31, x32 = bits.Add64(x27, x27, uint64(0x0)) + var x33 uint64 + var x34 uint64 + x33, x34 = bits.Add64(x28, x28, uint64(sm2p256Uint1(x32))) + var x35 uint64 + var x36 uint64 + x35, x36 = bits.Add64(x29, x29, uint64(sm2p256Uint1(x34))) + var x37 uint64 + var x38 uint64 + x37, x38 = bits.Add64(x30, x30, uint64(sm2p256Uint1(x36))) + var x39 uint64 + var x40 uint64 + x39, x40 = bits.Sub64(x31, 0xffffffffffffffff, uint64(0x0)) + var x41 uint64 + var x42 uint64 + x41, x42 = bits.Sub64(x33, 0xffffffff00000000, uint64(sm2p256Uint1(x40))) + var x43 uint64 + var x44 uint64 + x43, x44 = bits.Sub64(x35, 0xffffffffffffffff, uint64(sm2p256Uint1(x42))) + var x45 uint64 + var x46 uint64 + x45, x46 = bits.Sub64(x37, 0xfffffffeffffffff, uint64(sm2p256Uint1(x44))) + var x48 uint64 + _, x48 = bits.Sub64(uint64(sm2p256Uint1(x38)), uint64(0x0), uint64(sm2p256Uint1(x46))) + x49 := arg4[3] + x50 := arg4[2] + x51 := arg4[1] + x52 := arg4[0] + var x53 uint64 + var x54 uint64 + x53, x54 = bits.Sub64(uint64(0x0), x52, uint64(0x0)) + var x55 uint64 + var x56 uint64 + x55, x56 = bits.Sub64(uint64(0x0), x51, uint64(sm2p256Uint1(x54))) + var x57 uint64 + var x58 uint64 + x57, x58 = bits.Sub64(uint64(0x0), x50, uint64(sm2p256Uint1(x56))) + var x59 uint64 + var x60 uint64 + x59, x60 = bits.Sub64(uint64(0x0), x49, uint64(sm2p256Uint1(x58))) + var x61 uint64 + sm2p256CmovznzU64(&x61, sm2p256Uint1(x60), uint64(0x0), 0xffffffffffffffff) + var x62 uint64 + var x63 uint64 + x62, x63 = bits.Add64(x53, x61, uint64(0x0)) + var x64 uint64 + var x65 uint64 + x64, x65 = bits.Add64(x55, (x61 & 0xffffffff00000000), uint64(sm2p256Uint1(x63))) + var x66 uint64 + var x67 uint64 + x66, x67 = bits.Add64(x57, x61, uint64(sm2p256Uint1(x65))) + var x68 uint64 + x68, _ = bits.Add64(x59, (x61 & 0xfffffffeffffffff), uint64(sm2p256Uint1(x67))) + var x70 uint64 + sm2p256CmovznzU64(&x70, x3, arg5[0], x62) + var x71 uint64 + sm2p256CmovznzU64(&x71, x3, arg5[1], x64) + var x72 uint64 + sm2p256CmovznzU64(&x72, x3, arg5[2], x66) + var x73 uint64 + sm2p256CmovznzU64(&x73, x3, arg5[3], x68) + x74 := (sm2p256Uint1(x22) & 0x1) + var x75 uint64 + sm2p256CmovznzU64(&x75, x74, uint64(0x0), x7) + var x76 uint64 + sm2p256CmovznzU64(&x76, x74, uint64(0x0), x8) + var x77 uint64 + sm2p256CmovznzU64(&x77, x74, uint64(0x0), x9) + var x78 uint64 + sm2p256CmovznzU64(&x78, x74, uint64(0x0), x10) + var x79 uint64 + sm2p256CmovznzU64(&x79, x74, uint64(0x0), x11) + var x80 uint64 + var x81 uint64 + x80, x81 = bits.Add64(x22, x75, uint64(0x0)) + var x82 uint64 + var x83 uint64 + x82, x83 = bits.Add64(x23, x76, uint64(sm2p256Uint1(x81))) + var x84 uint64 + var x85 uint64 + x84, x85 = bits.Add64(x24, x77, uint64(sm2p256Uint1(x83))) + var x86 uint64 + var x87 uint64 + x86, x87 = bits.Add64(x25, x78, uint64(sm2p256Uint1(x85))) + var x88 uint64 + x88, _ = bits.Add64(x26, x79, uint64(sm2p256Uint1(x87))) + var x90 uint64 + sm2p256CmovznzU64(&x90, x74, uint64(0x0), x27) + var x91 uint64 + sm2p256CmovznzU64(&x91, x74, uint64(0x0), x28) + var x92 uint64 + sm2p256CmovznzU64(&x92, x74, uint64(0x0), x29) + var x93 uint64 + sm2p256CmovznzU64(&x93, x74, uint64(0x0), x30) + var x94 uint64 + var x95 uint64 + x94, x95 = bits.Add64(x70, x90, uint64(0x0)) + var x96 uint64 + var x97 uint64 + x96, x97 = bits.Add64(x71, x91, uint64(sm2p256Uint1(x95))) + var x98 uint64 + var x99 uint64 + x98, x99 = bits.Add64(x72, x92, uint64(sm2p256Uint1(x97))) + var x100 uint64 + var x101 uint64 + x100, x101 = bits.Add64(x73, x93, uint64(sm2p256Uint1(x99))) + var x102 uint64 + var x103 uint64 + x102, x103 = bits.Sub64(x94, 0xffffffffffffffff, uint64(0x0)) + var x104 uint64 + var x105 uint64 + x104, x105 = bits.Sub64(x96, 0xffffffff00000000, uint64(sm2p256Uint1(x103))) + var x106 uint64 + var x107 uint64 + x106, x107 = bits.Sub64(x98, 0xffffffffffffffff, uint64(sm2p256Uint1(x105))) + var x108 uint64 + var x109 uint64 + x108, x109 = bits.Sub64(x100, 0xfffffffeffffffff, uint64(sm2p256Uint1(x107))) + var x111 uint64 + _, x111 = bits.Sub64(uint64(sm2p256Uint1(x101)), uint64(0x0), uint64(sm2p256Uint1(x109))) + var x112 uint64 + x112, _ = bits.Add64(x6, uint64(0x1), uint64(0x0)) + x114 := ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)) + x115 := ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)) + x116 := ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)) + x117 := ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)) + x118 := ((x88 & 0x8000000000000000) | (x88 >> 1)) + var x119 uint64 + sm2p256CmovznzU64(&x119, sm2p256Uint1(x48), x39, x31) + var x120 uint64 + sm2p256CmovznzU64(&x120, sm2p256Uint1(x48), x41, x33) + var x121 uint64 + sm2p256CmovznzU64(&x121, sm2p256Uint1(x48), x43, x35) + var x122 uint64 + sm2p256CmovznzU64(&x122, sm2p256Uint1(x48), x45, x37) + var x123 uint64 + sm2p256CmovznzU64(&x123, sm2p256Uint1(x111), x102, x94) + var x124 uint64 + sm2p256CmovznzU64(&x124, sm2p256Uint1(x111), x104, x96) + var x125 uint64 + sm2p256CmovznzU64(&x125, sm2p256Uint1(x111), x106, x98) + var x126 uint64 + sm2p256CmovznzU64(&x126, sm2p256Uint1(x111), x108, x100) + *out1 = x112 + out2[0] = x7 + out2[1] = x8 + out2[2] = x9 + out2[3] = x10 + out2[4] = x11 + out3[0] = x114 + out3[1] = x115 + out3[2] = x116 + out3[3] = x117 + out3[4] = x118 + out4[0] = x119 + out4[1] = x120 + out4[2] = x121 + out4[3] = x122 + out5[0] = x123 + out5[1] = x124 + out5[2] = x125 + out5[3] = x126 +} + +// sm2p256DivstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +// +// Postconditions: +// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +// 0 ≤ eval out1 < m +// +// Output Bounds: +// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256DivstepPrecomp(out1 *[4]uint64) { + out1[0] = 0x500000028ffffffe + out1[1] = 0xe80000009ffffffe + out1[2] = 0xd00000018ffffffe + out1[3] = 0x280000011ffffffd +} diff --git a/internal/sm2ec/fiat/sm2p256_order.go b/internal/sm2ec/fiat/sm2p256_order.go deleted file mode 100644 index 0b142296..00000000 --- a/internal/sm2ec/fiat/sm2p256_order.go +++ /dev/null @@ -1,1299 +0,0 @@ -package fiat - -import ( - "errors" - "math/bits" -) - -var orderK0 uint64 = 0x327f9e8872350975 - -// SM2P256OrderElement is an integer modulo 0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123. -// -// The zero value is a valid zero element. -type SM2P256OrderElement struct { - // Values are represented internally always in the Montgomery domain, and - // converted in Bytes and SetBytes. - x sm2p256MontgomeryDomainFieldElement -} - -// One sets e = 1, and returns e. -func (e *SM2P256OrderElement) One() *SM2P256OrderElement { - e.x[0] = 0xac440bf6c62abedd - e.x[1] = 0x8dfc2094de39fad4 - e.x[2] = uint64(0x0) - e.x[3] = 0x100000000 - return e -} - -// Add sets e = t1 + t2, and returns e. -func (e *SM2P256OrderElement) Add(t1, t2 *SM2P256OrderElement) *SM2P256OrderElement { - var x1 uint64 - var x2 uint64 - x1, x2 = bits.Add64(t1.x[0], t2.x[0], uint64(0x0)) - var x3 uint64 - var x4 uint64 - x3, x4 = bits.Add64(t1.x[1], t2.x[1], uint64(sm2p256Uint1(x2))) - var x5 uint64 - var x6 uint64 - x5, x6 = bits.Add64(t1.x[2], t2.x[2], uint64(sm2p256Uint1(x4))) - var x7 uint64 - var x8 uint64 - x7, x8 = bits.Add64(t1.x[3], t2.x[3], uint64(sm2p256Uint1(x6))) - var x9 uint64 - var x10 uint64 - x9, x10 = bits.Sub64(x1, 0x53bbf40939d54123, uint64(0x0)) - var x11 uint64 - var x12 uint64 - x11, x12 = bits.Sub64(x3, 0x7203df6b21c6052b, uint64(sm2p256Uint1(x10))) - var x13 uint64 - var x14 uint64 - x13, x14 = bits.Sub64(x5, 0xffffffffffffffff, uint64(sm2p256Uint1(x12))) - var x15 uint64 - var x16 uint64 - x15, x16 = bits.Sub64(x7, 0xfffffffeffffffff, uint64(sm2p256Uint1(x14))) - var x18 uint64 - _, x18 = bits.Sub64(uint64(sm2p256Uint1(x8)), uint64(0x0), uint64(sm2p256Uint1(x16))) - var x19 uint64 - sm2p256CmovznzU64(&x19, sm2p256Uint1(x18), x9, x1) - var x20 uint64 - sm2p256CmovznzU64(&x20, sm2p256Uint1(x18), x11, x3) - var x21 uint64 - sm2p256CmovznzU64(&x21, sm2p256Uint1(x18), x13, x5) - var x22 uint64 - sm2p256CmovznzU64(&x22, sm2p256Uint1(x18), x15, x7) - e.x[0] = x19 - e.x[1] = x20 - e.x[2] = x21 - e.x[3] = x22 - return e -} - -// Sub sets e = t1 - t2, and returns e. -func (e *SM2P256OrderElement) Sub(t1, t2 *SM2P256OrderElement) *SM2P256OrderElement { - var x1 uint64 - var x2 uint64 - x1, x2 = bits.Sub64(t1.x[0], t2.x[0], uint64(0x0)) - var x3 uint64 - var x4 uint64 - x3, x4 = bits.Sub64(t1.x[1], t2.x[1], uint64(sm2p256Uint1(x2))) - var x5 uint64 - var x6 uint64 - x5, x6 = bits.Sub64(t1.x[2], t2.x[2], uint64(sm2p256Uint1(x4))) - var x7 uint64 - var x8 uint64 - x7, x8 = bits.Sub64(t1.x[3], t2.x[3], uint64(sm2p256Uint1(x6))) - var x9 uint64 - sm2p256CmovznzU64(&x9, sm2p256Uint1(x8), uint64(0x0), 0xffffffffffffffff) - var x10 uint64 - var x11 uint64 - x10, x11 = bits.Add64(x1, (x9 & 0x53bbf40939d54123), uint64(0x0)) - var x12 uint64 - var x13 uint64 - x12, x13 = bits.Add64(x3, (x9 & 0x7203df6b21c6052b), uint64(sm2p256Uint1(x11))) - var x14 uint64 - var x15 uint64 - x14, x15 = bits.Add64(x5, x9, uint64(sm2p256Uint1(x13))) - var x16 uint64 - x16, _ = bits.Add64(x7, (x9 & 0xfffffffeffffffff), uint64(sm2p256Uint1(x15))) - e.x[0] = x10 - e.x[1] = x12 - e.x[2] = x14 - e.x[3] = x16 - return e -} - -// Mul sets e = t1 * t2, and returns e. -func (e *SM2P256OrderElement) Mul(t1, t2 *SM2P256OrderElement) *SM2P256OrderElement { - x1 := t1.x[1] - x2 := t1.x[2] - x3 := t1.x[3] - x4 := t1.x[0] - var x5 uint64 - var x6 uint64 - x6, x5 = bits.Mul64(x4, t2.x[3]) - var x7 uint64 - var x8 uint64 - x8, x7 = bits.Mul64(x4, t2.x[2]) - var x9 uint64 - var x10 uint64 - x10, x9 = bits.Mul64(x4, t2.x[1]) - var x11 uint64 - var x12 uint64 - x12, x11 = bits.Mul64(x4, t2.x[0]) - var x13 uint64 - var x14 uint64 - x13, x14 = bits.Add64(x12, x9, uint64(0x0)) - var x15 uint64 - var x16 uint64 - x15, x16 = bits.Add64(x10, x7, uint64(sm2p256Uint1(x14))) - var x17 uint64 - var x18 uint64 - x17, x18 = bits.Add64(x8, x5, uint64(sm2p256Uint1(x16))) - x19 := (uint64(sm2p256Uint1(x18)) + x6) - var x20 uint64 - var x21 uint64 - _, y11 := bits.Mul64(x11, orderK0) - x21, x20 = bits.Mul64(y11, 0xfffffffeffffffff) - var x22 uint64 - var x23 uint64 - x23, x22 = bits.Mul64(y11, 0xffffffffffffffff) - var x24 uint64 - var x25 uint64 - x25, x24 = bits.Mul64(y11, 0x7203df6b21c6052b) - var x26 uint64 - var x27 uint64 - x27, x26 = bits.Mul64(y11, 0x53bbf40939d54123) - var x28 uint64 - var x29 uint64 - x28, x29 = bits.Add64(x27, x24, uint64(0x0)) - var x30 uint64 - var x31 uint64 - x30, x31 = bits.Add64(x25, x22, uint64(sm2p256Uint1(x29))) - var x32 uint64 - var x33 uint64 - x32, x33 = bits.Add64(x23, x20, uint64(sm2p256Uint1(x31))) - x34 := (uint64(sm2p256Uint1(x33)) + x21) - var x36 uint64 - _, x36 = bits.Add64(x11, x26, uint64(0x0)) - var x37 uint64 - var x38 uint64 - x37, x38 = bits.Add64(x13, x28, uint64(sm2p256Uint1(x36))) - var x39 uint64 - var x40 uint64 - x39, x40 = bits.Add64(x15, x30, uint64(sm2p256Uint1(x38))) - var x41 uint64 - var x42 uint64 - x41, x42 = bits.Add64(x17, x32, uint64(sm2p256Uint1(x40))) - var x43 uint64 - var x44 uint64 - x43, x44 = bits.Add64(x19, x34, uint64(sm2p256Uint1(x42))) - var x45 uint64 - var x46 uint64 - x46, x45 = bits.Mul64(x1, t2.x[3]) - var x47 uint64 - var x48 uint64 - x48, x47 = bits.Mul64(x1, t2.x[2]) - var x49 uint64 - var x50 uint64 - x50, x49 = bits.Mul64(x1, t2.x[1]) - var x51 uint64 - var x52 uint64 - x52, x51 = bits.Mul64(x1, t2.x[0]) - var x53 uint64 - var x54 uint64 - x53, x54 = bits.Add64(x52, x49, uint64(0x0)) - var x55 uint64 - var x56 uint64 - x55, x56 = bits.Add64(x50, x47, uint64(sm2p256Uint1(x54))) - var x57 uint64 - var x58 uint64 - x57, x58 = bits.Add64(x48, x45, uint64(sm2p256Uint1(x56))) - x59 := (uint64(sm2p256Uint1(x58)) + x46) - var x60 uint64 - var x61 uint64 - x60, x61 = bits.Add64(x37, x51, uint64(0x0)) - var x62 uint64 - var x63 uint64 - x62, x63 = bits.Add64(x39, x53, uint64(sm2p256Uint1(x61))) - var x64 uint64 - var x65 uint64 - x64, x65 = bits.Add64(x41, x55, uint64(sm2p256Uint1(x63))) - var x66 uint64 - var x67 uint64 - x66, x67 = bits.Add64(x43, x57, uint64(sm2p256Uint1(x65))) - var x68 uint64 - var x69 uint64 - x68, x69 = bits.Add64(uint64(sm2p256Uint1(x44)), x59, uint64(sm2p256Uint1(x67))) - var x70 uint64 - var x71 uint64 - _, y60 := bits.Mul64(x60, orderK0) - x71, x70 = bits.Mul64(y60, 0xfffffffeffffffff) - var x72 uint64 - var x73 uint64 - x73, x72 = bits.Mul64(y60, 0xffffffffffffffff) - var x74 uint64 - var x75 uint64 - x75, x74 = bits.Mul64(y60, 0x7203df6b21c6052b) - var x76 uint64 - var x77 uint64 - x77, x76 = bits.Mul64(y60, 0x53bbf40939d54123) - var x78 uint64 - var x79 uint64 - x78, x79 = bits.Add64(x77, x74, uint64(0x0)) - var x80 uint64 - var x81 uint64 - x80, x81 = bits.Add64(x75, x72, uint64(sm2p256Uint1(x79))) - var x82 uint64 - var x83 uint64 - x82, x83 = bits.Add64(x73, x70, uint64(sm2p256Uint1(x81))) - x84 := (uint64(sm2p256Uint1(x83)) + x71) - var x86 uint64 - _, x86 = bits.Add64(x60, x76, uint64(0x0)) - var x87 uint64 - var x88 uint64 - x87, x88 = bits.Add64(x62, x78, uint64(sm2p256Uint1(x86))) - var x89 uint64 - var x90 uint64 - x89, x90 = bits.Add64(x64, x80, uint64(sm2p256Uint1(x88))) - var x91 uint64 - var x92 uint64 - x91, x92 = bits.Add64(x66, x82, uint64(sm2p256Uint1(x90))) - var x93 uint64 - var x94 uint64 - x93, x94 = bits.Add64(x68, x84, uint64(sm2p256Uint1(x92))) - x95 := (uint64(sm2p256Uint1(x94)) + uint64(sm2p256Uint1(x69))) - var x96 uint64 - var x97 uint64 - x97, x96 = bits.Mul64(x2, t2.x[3]) - var x98 uint64 - var x99 uint64 - x99, x98 = bits.Mul64(x2, t2.x[2]) - var x100 uint64 - var x101 uint64 - x101, x100 = bits.Mul64(x2, t2.x[1]) - var x102 uint64 - var x103 uint64 - x103, x102 = bits.Mul64(x2, t2.x[0]) - var x104 uint64 - var x105 uint64 - x104, x105 = bits.Add64(x103, x100, uint64(0x0)) - var x106 uint64 - var x107 uint64 - x106, x107 = bits.Add64(x101, x98, uint64(sm2p256Uint1(x105))) - var x108 uint64 - var x109 uint64 - x108, x109 = bits.Add64(x99, x96, uint64(sm2p256Uint1(x107))) - x110 := (uint64(sm2p256Uint1(x109)) + x97) - var x111 uint64 - var x112 uint64 - x111, x112 = bits.Add64(x87, x102, uint64(0x0)) - var x113 uint64 - var x114 uint64 - x113, x114 = bits.Add64(x89, x104, uint64(sm2p256Uint1(x112))) - var x115 uint64 - var x116 uint64 - x115, x116 = bits.Add64(x91, x106, uint64(sm2p256Uint1(x114))) - var x117 uint64 - var x118 uint64 - x117, x118 = bits.Add64(x93, x108, uint64(sm2p256Uint1(x116))) - var x119 uint64 - var x120 uint64 - x119, x120 = bits.Add64(x95, x110, uint64(sm2p256Uint1(x118))) - var x121 uint64 - var x122 uint64 - _, y111 := bits.Mul64(x111, orderK0) - x122, x121 = bits.Mul64(y111, 0xfffffffeffffffff) - var x123 uint64 - var x124 uint64 - x124, x123 = bits.Mul64(y111, 0xffffffffffffffff) - var x125 uint64 - var x126 uint64 - x126, x125 = bits.Mul64(y111, 0x7203df6b21c6052b) - var x127 uint64 - var x128 uint64 - x128, x127 = bits.Mul64(y111, 0x53bbf40939d54123) - var x129 uint64 - var x130 uint64 - x129, x130 = bits.Add64(x128, x125, uint64(0x0)) - var x131 uint64 - var x132 uint64 - x131, x132 = bits.Add64(x126, x123, uint64(sm2p256Uint1(x130))) - var x133 uint64 - var x134 uint64 - x133, x134 = bits.Add64(x124, x121, uint64(sm2p256Uint1(x132))) - x135 := (uint64(sm2p256Uint1(x134)) + x122) - var x137 uint64 - _, x137 = bits.Add64(x111, x127, uint64(0x0)) - var x138 uint64 - var x139 uint64 - x138, x139 = bits.Add64(x113, x129, uint64(sm2p256Uint1(x137))) - var x140 uint64 - var x141 uint64 - x140, x141 = bits.Add64(x115, x131, uint64(sm2p256Uint1(x139))) - var x142 uint64 - var x143 uint64 - x142, x143 = bits.Add64(x117, x133, uint64(sm2p256Uint1(x141))) - var x144 uint64 - var x145 uint64 - x144, x145 = bits.Add64(x119, x135, uint64(sm2p256Uint1(x143))) - x146 := (uint64(sm2p256Uint1(x145)) + uint64(sm2p256Uint1(x120))) - var x147 uint64 - var x148 uint64 - x148, x147 = bits.Mul64(x3, t2.x[3]) - var x149 uint64 - var x150 uint64 - x150, x149 = bits.Mul64(x3, t2.x[2]) - var x151 uint64 - var x152 uint64 - x152, x151 = bits.Mul64(x3, t2.x[1]) - var x153 uint64 - var x154 uint64 - x154, x153 = bits.Mul64(x3, t2.x[0]) - var x155 uint64 - var x156 uint64 - x155, x156 = bits.Add64(x154, x151, uint64(0x0)) - var x157 uint64 - var x158 uint64 - x157, x158 = bits.Add64(x152, x149, uint64(sm2p256Uint1(x156))) - var x159 uint64 - var x160 uint64 - x159, x160 = bits.Add64(x150, x147, uint64(sm2p256Uint1(x158))) - x161 := (uint64(sm2p256Uint1(x160)) + x148) - var x162 uint64 - var x163 uint64 - x162, x163 = bits.Add64(x138, x153, uint64(0x0)) - var x164 uint64 - var x165 uint64 - x164, x165 = bits.Add64(x140, x155, uint64(sm2p256Uint1(x163))) - var x166 uint64 - var x167 uint64 - x166, x167 = bits.Add64(x142, x157, uint64(sm2p256Uint1(x165))) - var x168 uint64 - var x169 uint64 - x168, x169 = bits.Add64(x144, x159, uint64(sm2p256Uint1(x167))) - var x170 uint64 - var x171 uint64 - x170, x171 = bits.Add64(x146, x161, uint64(sm2p256Uint1(x169))) - var x172 uint64 - var x173 uint64 - _, y162 := bits.Mul64(x162, orderK0) - x173, x172 = bits.Mul64(y162, 0xfffffffeffffffff) - var x174 uint64 - var x175 uint64 - x175, x174 = bits.Mul64(y162, 0xffffffffffffffff) - var x176 uint64 - var x177 uint64 - x177, x176 = bits.Mul64(y162, 0x7203df6b21c6052b) - var x178 uint64 - var x179 uint64 - x179, x178 = bits.Mul64(y162, 0x53bbf40939d54123) - var x180 uint64 - var x181 uint64 - x180, x181 = bits.Add64(x179, x176, uint64(0x0)) - var x182 uint64 - var x183 uint64 - x182, x183 = bits.Add64(x177, x174, uint64(sm2p256Uint1(x181))) - var x184 uint64 - var x185 uint64 - x184, x185 = bits.Add64(x175, x172, uint64(sm2p256Uint1(x183))) - x186 := (uint64(sm2p256Uint1(x185)) + x173) - var x188 uint64 - _, x188 = bits.Add64(x162, x178, uint64(0x0)) - var x189 uint64 - var x190 uint64 - x189, x190 = bits.Add64(x164, x180, uint64(sm2p256Uint1(x188))) - var x191 uint64 - var x192 uint64 - x191, x192 = bits.Add64(x166, x182, uint64(sm2p256Uint1(x190))) - var x193 uint64 - var x194 uint64 - x193, x194 = bits.Add64(x168, x184, uint64(sm2p256Uint1(x192))) - var x195 uint64 - var x196 uint64 - x195, x196 = bits.Add64(x170, x186, uint64(sm2p256Uint1(x194))) - x197 := (uint64(sm2p256Uint1(x196)) + uint64(sm2p256Uint1(x171))) - var x198 uint64 - var x199 uint64 - x198, x199 = bits.Sub64(x189, 0x53bbf40939d54123, uint64(0x0)) - var x200 uint64 - var x201 uint64 - x200, x201 = bits.Sub64(x191, 0x7203df6b21c6052b, uint64(sm2p256Uint1(x199))) - var x202 uint64 - var x203 uint64 - x202, x203 = bits.Sub64(x193, 0xffffffffffffffff, uint64(sm2p256Uint1(x201))) - var x204 uint64 - var x205 uint64 - x204, x205 = bits.Sub64(x195, 0xfffffffeffffffff, uint64(sm2p256Uint1(x203))) - var x207 uint64 - _, x207 = bits.Sub64(x197, uint64(0x0), uint64(sm2p256Uint1(x205))) - var x208 uint64 - sm2p256CmovznzU64(&x208, sm2p256Uint1(x207), x198, x189) - var x209 uint64 - sm2p256CmovznzU64(&x209, sm2p256Uint1(x207), x200, x191) - var x210 uint64 - sm2p256CmovznzU64(&x210, sm2p256Uint1(x207), x202, x193) - var x211 uint64 - sm2p256CmovznzU64(&x211, sm2p256Uint1(x207), x204, x195) - e.x[0] = x208 - e.x[1] = x209 - e.x[2] = x210 - e.x[3] = x211 - - return e -} - -// Select sets v to a if cond == 1, and to b if cond == 0. -func (v *SM2P256OrderElement) Select(a, b *SM2P256OrderElement, cond int) *SM2P256OrderElement { - sm2p256Selectznz((*sm2p256UntypedFieldElement)(&v.x), sm2p256Uint1(cond), - (*sm2p256UntypedFieldElement)(&b.x), (*sm2p256UntypedFieldElement)(&a.x)) - return v -} - -// Square sets e = t * t, and returns e. -func (e *SM2P256OrderElement) Square(t *SM2P256OrderElement) *SM2P256OrderElement { - x1 := t.x[1] - x2 := t.x[2] - x3 := t.x[3] - x4 := t.x[0] - var x5 uint64 - var x6 uint64 - x6, x5 = bits.Mul64(x4, t.x[3]) - var x7 uint64 - var x8 uint64 - x8, x7 = bits.Mul64(x4, t.x[2]) - var x9 uint64 - var x10 uint64 - x10, x9 = bits.Mul64(x4, t.x[1]) - var x11 uint64 - var x12 uint64 - x12, x11 = bits.Mul64(x4, t.x[0]) - var x13 uint64 - var x14 uint64 - x13, x14 = bits.Add64(x12, x9, uint64(0x0)) - var x15 uint64 - var x16 uint64 - x15, x16 = bits.Add64(x10, x7, uint64(sm2p256Uint1(x14))) - var x17 uint64 - var x18 uint64 - x17, x18 = bits.Add64(x8, x5, uint64(sm2p256Uint1(x16))) - x19 := (uint64(sm2p256Uint1(x18)) + x6) - var x20 uint64 - var x21 uint64 - _, y11 := bits.Mul64(x11, orderK0) - x21, x20 = bits.Mul64(y11, 0xfffffffeffffffff) - var x22 uint64 - var x23 uint64 - x23, x22 = bits.Mul64(y11, 0xffffffffffffffff) - var x24 uint64 - var x25 uint64 - x25, x24 = bits.Mul64(y11, 0x7203df6b21c6052b) - var x26 uint64 - var x27 uint64 - x27, x26 = bits.Mul64(y11, 0x53bbf40939d54123) - var x28 uint64 - var x29 uint64 - x28, x29 = bits.Add64(x27, x24, uint64(0x0)) - var x30 uint64 - var x31 uint64 - x30, x31 = bits.Add64(x25, x22, uint64(sm2p256Uint1(x29))) - var x32 uint64 - var x33 uint64 - x32, x33 = bits.Add64(x23, x20, uint64(sm2p256Uint1(x31))) - x34 := (uint64(sm2p256Uint1(x33)) + x21) - var x36 uint64 - _, x36 = bits.Add64(x11, x26, uint64(0x0)) - var x37 uint64 - var x38 uint64 - x37, x38 = bits.Add64(x13, x28, uint64(sm2p256Uint1(x36))) - var x39 uint64 - var x40 uint64 - x39, x40 = bits.Add64(x15, x30, uint64(sm2p256Uint1(x38))) - var x41 uint64 - var x42 uint64 - x41, x42 = bits.Add64(x17, x32, uint64(sm2p256Uint1(x40))) - var x43 uint64 - var x44 uint64 - x43, x44 = bits.Add64(x19, x34, uint64(sm2p256Uint1(x42))) - var x45 uint64 - var x46 uint64 - x46, x45 = bits.Mul64(x1, t.x[3]) - var x47 uint64 - var x48 uint64 - x48, x47 = bits.Mul64(x1, t.x[2]) - var x49 uint64 - var x50 uint64 - x50, x49 = bits.Mul64(x1, t.x[1]) - var x51 uint64 - var x52 uint64 - x52, x51 = bits.Mul64(x1, t.x[0]) - var x53 uint64 - var x54 uint64 - x53, x54 = bits.Add64(x52, x49, uint64(0x0)) - var x55 uint64 - var x56 uint64 - x55, x56 = bits.Add64(x50, x47, uint64(sm2p256Uint1(x54))) - var x57 uint64 - var x58 uint64 - x57, x58 = bits.Add64(x48, x45, uint64(sm2p256Uint1(x56))) - x59 := (uint64(sm2p256Uint1(x58)) + x46) - var x60 uint64 - var x61 uint64 - x60, x61 = bits.Add64(x37, x51, uint64(0x0)) - var x62 uint64 - var x63 uint64 - x62, x63 = bits.Add64(x39, x53, uint64(sm2p256Uint1(x61))) - var x64 uint64 - var x65 uint64 - x64, x65 = bits.Add64(x41, x55, uint64(sm2p256Uint1(x63))) - var x66 uint64 - var x67 uint64 - x66, x67 = bits.Add64(x43, x57, uint64(sm2p256Uint1(x65))) - var x68 uint64 - var x69 uint64 - x68, x69 = bits.Add64(uint64(sm2p256Uint1(x44)), x59, uint64(sm2p256Uint1(x67))) - var x70 uint64 - var x71 uint64 - _, y60 := bits.Mul64(x60, orderK0) - x71, x70 = bits.Mul64(y60, 0xfffffffeffffffff) - var x72 uint64 - var x73 uint64 - x73, x72 = bits.Mul64(y60, 0xffffffffffffffff) - var x74 uint64 - var x75 uint64 - x75, x74 = bits.Mul64(y60, 0x7203df6b21c6052b) - var x76 uint64 - var x77 uint64 - x77, x76 = bits.Mul64(y60, 0x53bbf40939d54123) - var x78 uint64 - var x79 uint64 - x78, x79 = bits.Add64(x77, x74, uint64(0x0)) - var x80 uint64 - var x81 uint64 - x80, x81 = bits.Add64(x75, x72, uint64(sm2p256Uint1(x79))) - var x82 uint64 - var x83 uint64 - x82, x83 = bits.Add64(x73, x70, uint64(sm2p256Uint1(x81))) - x84 := (uint64(sm2p256Uint1(x83)) + x71) - var x86 uint64 - _, x86 = bits.Add64(x60, x76, uint64(0x0)) - var x87 uint64 - var x88 uint64 - x87, x88 = bits.Add64(x62, x78, uint64(sm2p256Uint1(x86))) - var x89 uint64 - var x90 uint64 - x89, x90 = bits.Add64(x64, x80, uint64(sm2p256Uint1(x88))) - var x91 uint64 - var x92 uint64 - x91, x92 = bits.Add64(x66, x82, uint64(sm2p256Uint1(x90))) - var x93 uint64 - var x94 uint64 - x93, x94 = bits.Add64(x68, x84, uint64(sm2p256Uint1(x92))) - x95 := (uint64(sm2p256Uint1(x94)) + uint64(sm2p256Uint1(x69))) - var x96 uint64 - var x97 uint64 - x97, x96 = bits.Mul64(x2, t.x[3]) - var x98 uint64 - var x99 uint64 - x99, x98 = bits.Mul64(x2, t.x[2]) - var x100 uint64 - var x101 uint64 - x101, x100 = bits.Mul64(x2, t.x[1]) - var x102 uint64 - var x103 uint64 - x103, x102 = bits.Mul64(x2, t.x[0]) - var x104 uint64 - var x105 uint64 - x104, x105 = bits.Add64(x103, x100, uint64(0x0)) - var x106 uint64 - var x107 uint64 - x106, x107 = bits.Add64(x101, x98, uint64(sm2p256Uint1(x105))) - var x108 uint64 - var x109 uint64 - x108, x109 = bits.Add64(x99, x96, uint64(sm2p256Uint1(x107))) - x110 := (uint64(sm2p256Uint1(x109)) + x97) - var x111 uint64 - var x112 uint64 - x111, x112 = bits.Add64(x87, x102, uint64(0x0)) - var x113 uint64 - var x114 uint64 - x113, x114 = bits.Add64(x89, x104, uint64(sm2p256Uint1(x112))) - var x115 uint64 - var x116 uint64 - x115, x116 = bits.Add64(x91, x106, uint64(sm2p256Uint1(x114))) - var x117 uint64 - var x118 uint64 - x117, x118 = bits.Add64(x93, x108, uint64(sm2p256Uint1(x116))) - var x119 uint64 - var x120 uint64 - x119, x120 = bits.Add64(x95, x110, uint64(sm2p256Uint1(x118))) - var x121 uint64 - var x122 uint64 - _, y111 := bits.Mul64(x111, orderK0) - x122, x121 = bits.Mul64(y111, 0xfffffffeffffffff) - var x123 uint64 - var x124 uint64 - x124, x123 = bits.Mul64(y111, 0xffffffffffffffff) - var x125 uint64 - var x126 uint64 - x126, x125 = bits.Mul64(y111, 0x7203df6b21c6052b) - var x127 uint64 - var x128 uint64 - x128, x127 = bits.Mul64(y111, 0x53bbf40939d54123) - var x129 uint64 - var x130 uint64 - x129, x130 = bits.Add64(x128, x125, uint64(0x0)) - var x131 uint64 - var x132 uint64 - x131, x132 = bits.Add64(x126, x123, uint64(sm2p256Uint1(x130))) - var x133 uint64 - var x134 uint64 - x133, x134 = bits.Add64(x124, x121, uint64(sm2p256Uint1(x132))) - x135 := (uint64(sm2p256Uint1(x134)) + x122) - var x137 uint64 - _, x137 = bits.Add64(x111, x127, uint64(0x0)) - var x138 uint64 - var x139 uint64 - x138, x139 = bits.Add64(x113, x129, uint64(sm2p256Uint1(x137))) - var x140 uint64 - var x141 uint64 - x140, x141 = bits.Add64(x115, x131, uint64(sm2p256Uint1(x139))) - var x142 uint64 - var x143 uint64 - x142, x143 = bits.Add64(x117, x133, uint64(sm2p256Uint1(x141))) - var x144 uint64 - var x145 uint64 - x144, x145 = bits.Add64(x119, x135, uint64(sm2p256Uint1(x143))) - x146 := (uint64(sm2p256Uint1(x145)) + uint64(sm2p256Uint1(x120))) - var x147 uint64 - var x148 uint64 - x148, x147 = bits.Mul64(x3, t.x[3]) - var x149 uint64 - var x150 uint64 - x150, x149 = bits.Mul64(x3, t.x[2]) - var x151 uint64 - var x152 uint64 - x152, x151 = bits.Mul64(x3, t.x[1]) - var x153 uint64 - var x154 uint64 - x154, x153 = bits.Mul64(x3, t.x[0]) - var x155 uint64 - var x156 uint64 - x155, x156 = bits.Add64(x154, x151, uint64(0x0)) - var x157 uint64 - var x158 uint64 - x157, x158 = bits.Add64(x152, x149, uint64(sm2p256Uint1(x156))) - var x159 uint64 - var x160 uint64 - x159, x160 = bits.Add64(x150, x147, uint64(sm2p256Uint1(x158))) - x161 := (uint64(sm2p256Uint1(x160)) + x148) - var x162 uint64 - var x163 uint64 - x162, x163 = bits.Add64(x138, x153, uint64(0x0)) - var x164 uint64 - var x165 uint64 - x164, x165 = bits.Add64(x140, x155, uint64(sm2p256Uint1(x163))) - var x166 uint64 - var x167 uint64 - x166, x167 = bits.Add64(x142, x157, uint64(sm2p256Uint1(x165))) - var x168 uint64 - var x169 uint64 - x168, x169 = bits.Add64(x144, x159, uint64(sm2p256Uint1(x167))) - var x170 uint64 - var x171 uint64 - x170, x171 = bits.Add64(x146, x161, uint64(sm2p256Uint1(x169))) - var x172 uint64 - var x173 uint64 - _, y162 := bits.Mul64(x162, orderK0) - x173, x172 = bits.Mul64(y162, 0xfffffffeffffffff) - var x174 uint64 - var x175 uint64 - x175, x174 = bits.Mul64(y162, 0xffffffffffffffff) - var x176 uint64 - var x177 uint64 - x177, x176 = bits.Mul64(y162, 0x7203df6b21c6052b) - var x178 uint64 - var x179 uint64 - x179, x178 = bits.Mul64(y162, 0x53bbf40939d54123) - var x180 uint64 - var x181 uint64 - x180, x181 = bits.Add64(x179, x176, uint64(0x0)) - var x182 uint64 - var x183 uint64 - x182, x183 = bits.Add64(x177, x174, uint64(sm2p256Uint1(x181))) - var x184 uint64 - var x185 uint64 - x184, x185 = bits.Add64(x175, x172, uint64(sm2p256Uint1(x183))) - x186 := (uint64(sm2p256Uint1(x185)) + x173) - var x188 uint64 - _, x188 = bits.Add64(x162, x178, uint64(0x0)) - var x189 uint64 - var x190 uint64 - x189, x190 = bits.Add64(x164, x180, uint64(sm2p256Uint1(x188))) - var x191 uint64 - var x192 uint64 - x191, x192 = bits.Add64(x166, x182, uint64(sm2p256Uint1(x190))) - var x193 uint64 - var x194 uint64 - x193, x194 = bits.Add64(x168, x184, uint64(sm2p256Uint1(x192))) - var x195 uint64 - var x196 uint64 - x195, x196 = bits.Add64(x170, x186, uint64(sm2p256Uint1(x194))) - x197 := (uint64(sm2p256Uint1(x196)) + uint64(sm2p256Uint1(x171))) - var x198 uint64 - var x199 uint64 - x198, x199 = bits.Sub64(x189, 0x53bbf40939d54123, uint64(0x0)) - var x200 uint64 - var x201 uint64 - x200, x201 = bits.Sub64(x191, 0x7203df6b21c6052b, uint64(sm2p256Uint1(x199))) - var x202 uint64 - var x203 uint64 - x202, x203 = bits.Sub64(x193, 0xffffffffffffffff, uint64(sm2p256Uint1(x201))) - var x204 uint64 - var x205 uint64 - x204, x205 = bits.Sub64(x195, 0xfffffffeffffffff, uint64(sm2p256Uint1(x203))) - var x207 uint64 - _, x207 = bits.Sub64(x197, uint64(0x0), uint64(sm2p256Uint1(x205))) - var x208 uint64 - sm2p256CmovznzU64(&x208, sm2p256Uint1(x207), x198, x189) - var x209 uint64 - sm2p256CmovznzU64(&x209, sm2p256Uint1(x207), x200, x191) - var x210 uint64 - sm2p256CmovznzU64(&x210, sm2p256Uint1(x207), x202, x193) - var x211 uint64 - sm2p256CmovznzU64(&x211, sm2p256Uint1(x207), x204, x195) - e.x[0] = x208 - e.x[1] = x209 - e.x[2] = x210 - e.x[3] = x211 - - return e -} - -// SetBytes sets e = v, where v is a big-endian 32-byte encoding, and returns e. -// If v is not 32 bytes or it encodes a value higher than 2^256 - 2^224 - 2^96 + 2^64 - 1, -// SetBytes returns nil and an error, and e is unchanged. -func (e *SM2P256OrderElement) SetBytes(v []byte) (*SM2P256OrderElement, error) { - if len(v) != sm2p256ElementLen { - return nil, errors.New("invalid SM2P256OrderElement encoding") - } -/* - // Check for non-canonical encodings (p + k, 2p + k, etc.) by comparing to - // the encoding of -1 mod p, so p - 1, the highest canonical encoding. - var minusOneEncoding = new(SM2P256OrderElement).Sub( - new(SM2P256OrderElement), new(SM2P256OrderElement).One()).Bytes() - for i := range v { - if v[i] < minusOneEncoding[i] { - break - } - if v[i] > minusOneEncoding[i] { - return nil, errors.New("invalid SM2P256OrderElement encoding") - } - } -*/ - var in [sm2p256ElementLen]byte - copy(in[:], v) - sm2p256InvertEndianness(in[:]) - var tmp sm2p256NonMontgomeryDomainFieldElement - sm2p256FromBytes((*sm2p256UntypedFieldElement)(&tmp), &in) - sm2p256OrderToMontgomery(&e.x, &tmp) - return e, nil -} - -// Bytes returns the 32-byte big-endian encoding of e. -func (e *SM2P256OrderElement) Bytes() []byte { - // This function is outlined to make the allocations inline in the caller - // rather than happen on the heap. - var out [sm2p256ElementLen]byte - return e.bytes(&out) -} - -func (e *SM2P256OrderElement) bytes(out *[sm2p256ElementLen]byte) []byte { - var tmp sm2p256NonMontgomeryDomainFieldElement - sm2p256OrderFromMontgomery(&tmp, &e.x) - sm2p256ToBytes(out, (*sm2p256UntypedFieldElement)(&tmp)) - sm2p256InvertEndianness(out[:]) - return out[:] -} - -// sm2p256OrderFromMontgomery translates a field element out of the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m -// 0 ≤ eval out1 < m -// -func sm2p256OrderFromMontgomery(out1 *sm2p256NonMontgomeryDomainFieldElement, arg1 *sm2p256MontgomeryDomainFieldElement) { - x1 := arg1[0] - _, y1 := bits.Mul64(arg1[0], orderK0) - var x2 uint64 - var x3 uint64 - x3, x2 = bits.Mul64(y1, 0xfffffffeffffffff) - var x4 uint64 - var x5 uint64 - x5, x4 = bits.Mul64(y1, 0xffffffffffffffff) - var x6 uint64 - var x7 uint64 - x7, x6 = bits.Mul64(y1, 0x7203df6b21c6052b) - var x8 uint64 - var x9 uint64 - x9, x8 = bits.Mul64(y1, 0x53bbf40939d54123) - var x10 uint64 - var x11 uint64 - x10, x11 = bits.Add64(x9, x6, uint64(0x0)) - var x12 uint64 - var x13 uint64 - x12, x13 = bits.Add64(x7, x4, uint64(sm2p256Uint1(x11))) - var x14 uint64 - var x15 uint64 - x14, x15 = bits.Add64(x5, x2, uint64(sm2p256Uint1(x13))) - var x17 uint64 - _, x17 = bits.Add64(x1, x8, uint64(0x0)) - var x18 uint64 - var x19 uint64 - x18, x19 = bits.Add64(uint64(0x0), x10, uint64(sm2p256Uint1(x17))) - var x20 uint64 - var x21 uint64 - x20, x21 = bits.Add64(uint64(0x0), x12, uint64(sm2p256Uint1(x19))) - var x22 uint64 - var x23 uint64 - x22, x23 = bits.Add64(uint64(0x0), x14, uint64(sm2p256Uint1(x21))) - var x24 uint64 - var x25 uint64 - x24, x25 = bits.Add64(x18, arg1[1], uint64(0x0)) - var x26 uint64 - var x27 uint64 - x26, x27 = bits.Add64(x20, uint64(0x0), uint64(sm2p256Uint1(x25))) - var x28 uint64 - var x29 uint64 - x28, x29 = bits.Add64(x22, uint64(0x0), uint64(sm2p256Uint1(x27))) - var x30 uint64 - var x31 uint64 - _, y24 := bits.Mul64(x24, orderK0) - x31, x30 = bits.Mul64(y24, 0xfffffffeffffffff) - var x32 uint64 - var x33 uint64 - x33, x32 = bits.Mul64(y24, 0xffffffffffffffff) - var x34 uint64 - var x35 uint64 - x35, x34 = bits.Mul64(y24, 0x7203df6b21c6052b) - var x36 uint64 - var x37 uint64 - x37, x36 = bits.Mul64(y24, 0x53bbf40939d54123) - var x38 uint64 - var x39 uint64 - x38, x39 = bits.Add64(x37, x34, uint64(0x0)) - var x40 uint64 - var x41 uint64 - x40, x41 = bits.Add64(x35, x32, uint64(sm2p256Uint1(x39))) - var x42 uint64 - var x43 uint64 - x42, x43 = bits.Add64(x33, x30, uint64(sm2p256Uint1(x41))) - var x45 uint64 - _, x45 = bits.Add64(x24, x36, uint64(0x0)) - var x46 uint64 - var x47 uint64 - x46, x47 = bits.Add64(x26, x38, uint64(sm2p256Uint1(x45))) - var x48 uint64 - var x49 uint64 - x48, x49 = bits.Add64(x28, x40, uint64(sm2p256Uint1(x47))) - var x50 uint64 - var x51 uint64 - x50, x51 = bits.Add64((uint64(sm2p256Uint1(x29)) + (uint64(sm2p256Uint1(x23)) + (uint64(sm2p256Uint1(x15)) + x3))), x42, uint64(sm2p256Uint1(x49))) - var x52 uint64 - var x53 uint64 - x52, x53 = bits.Add64(x46, arg1[2], uint64(0x0)) - var x54 uint64 - var x55 uint64 - x54, x55 = bits.Add64(x48, uint64(0x0), uint64(sm2p256Uint1(x53))) - var x56 uint64 - var x57 uint64 - x56, x57 = bits.Add64(x50, uint64(0x0), uint64(sm2p256Uint1(x55))) - var x58 uint64 - var x59 uint64 - _, y52 := bits.Mul64(x52, orderK0) - x59, x58 = bits.Mul64(y52, 0xfffffffeffffffff) - var x60 uint64 - var x61 uint64 - x61, x60 = bits.Mul64(y52, 0xffffffffffffffff) - var x62 uint64 - var x63 uint64 - x63, x62 = bits.Mul64(y52, 0x7203df6b21c6052b) - var x64 uint64 - var x65 uint64 - x65, x64 = bits.Mul64(y52, 0x53bbf40939d54123) - var x66 uint64 - var x67 uint64 - x66, x67 = bits.Add64(x65, x62, uint64(0x0)) - var x68 uint64 - var x69 uint64 - x68, x69 = bits.Add64(x63, x60, uint64(sm2p256Uint1(x67))) - var x70 uint64 - var x71 uint64 - x70, x71 = bits.Add64(x61, x58, uint64(sm2p256Uint1(x69))) - var x73 uint64 - _, x73 = bits.Add64(x52, x64, uint64(0x0)) - var x74 uint64 - var x75 uint64 - x74, x75 = bits.Add64(x54, x66, uint64(sm2p256Uint1(x73))) - var x76 uint64 - var x77 uint64 - x76, x77 = bits.Add64(x56, x68, uint64(sm2p256Uint1(x75))) - var x78 uint64 - var x79 uint64 - x78, x79 = bits.Add64((uint64(sm2p256Uint1(x57)) + (uint64(sm2p256Uint1(x51)) + (uint64(sm2p256Uint1(x43)) + x31))), x70, uint64(sm2p256Uint1(x77))) - var x80 uint64 - var x81 uint64 - x80, x81 = bits.Add64(x74, arg1[3], uint64(0x0)) - var x82 uint64 - var x83 uint64 - x82, x83 = bits.Add64(x76, uint64(0x0), uint64(sm2p256Uint1(x81))) - var x84 uint64 - var x85 uint64 - x84, x85 = bits.Add64(x78, uint64(0x0), uint64(sm2p256Uint1(x83))) - var x86 uint64 - var x87 uint64 - _, y80 := bits.Mul64(x80, orderK0) - x87, x86 = bits.Mul64(y80, 0xfffffffeffffffff) - var x88 uint64 - var x89 uint64 - x89, x88 = bits.Mul64(y80, 0xffffffffffffffff) - var x90 uint64 - var x91 uint64 - x91, x90 = bits.Mul64(y80, 0x7203df6b21c6052b) - var x92 uint64 - var x93 uint64 - x93, x92 = bits.Mul64(y80, 0x53bbf40939d54123) - var x94 uint64 - var x95 uint64 - x94, x95 = bits.Add64(x93, x90, uint64(0x0)) - var x96 uint64 - var x97 uint64 - x96, x97 = bits.Add64(x91, x88, uint64(sm2p256Uint1(x95))) - var x98 uint64 - var x99 uint64 - x98, x99 = bits.Add64(x89, x86, uint64(sm2p256Uint1(x97))) - var x101 uint64 - _, x101 = bits.Add64(x80, x92, uint64(0x0)) - var x102 uint64 - var x103 uint64 - x102, x103 = bits.Add64(x82, x94, uint64(sm2p256Uint1(x101))) - var x104 uint64 - var x105 uint64 - x104, x105 = bits.Add64(x84, x96, uint64(sm2p256Uint1(x103))) - var x106 uint64 - var x107 uint64 - x106, x107 = bits.Add64((uint64(sm2p256Uint1(x85)) + (uint64(sm2p256Uint1(x79)) + (uint64(sm2p256Uint1(x71)) + x59))), x98, uint64(sm2p256Uint1(x105))) - x108 := (uint64(sm2p256Uint1(x107)) + (uint64(sm2p256Uint1(x99)) + x87)) - var x109 uint64 - var x110 uint64 - x109, x110 = bits.Sub64(x102, 0x53bbf40939d54123, uint64(0x0)) - var x111 uint64 - var x112 uint64 - x111, x112 = bits.Sub64(x104, 0x7203df6b21c6052b, uint64(sm2p256Uint1(x110))) - var x113 uint64 - var x114 uint64 - x113, x114 = bits.Sub64(x106, 0xffffffffffffffff, uint64(sm2p256Uint1(x112))) - var x115 uint64 - var x116 uint64 - x115, x116 = bits.Sub64(x108, 0xfffffffeffffffff, uint64(sm2p256Uint1(x114))) - var x118 uint64 - _, x118 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(sm2p256Uint1(x116))) - var x119 uint64 - sm2p256CmovznzU64(&x119, sm2p256Uint1(x118), x109, x102) - var x120 uint64 - sm2p256CmovznzU64(&x120, sm2p256Uint1(x118), x111, x104) - var x121 uint64 - sm2p256CmovznzU64(&x121, sm2p256Uint1(x118), x113, x106) - var x122 uint64 - sm2p256CmovznzU64(&x122, sm2p256Uint1(x118), x115, x108) - out1[0] = x119 - out1[1] = x120 - out1[2] = x121 - out1[3] = x122 -} - -// sm2p256OrderToMontgomery translates a field element into the Montgomery domain. -// -// Preconditions: -// 0 ≤ eval arg1 < m -// Postconditions: -// eval (from_montgomery out1) mod m = eval arg1 mod m -// 0 ≤ eval out1 < m -// -func sm2p256OrderToMontgomery(out1 *sm2p256MontgomeryDomainFieldElement, arg1 *sm2p256NonMontgomeryDomainFieldElement) { - x1 := arg1[1] - x2 := arg1[2] - x3 := arg1[3] - x4 := arg1[0] - var x5 uint64 - var x6 uint64 - x6, x5 = bits.Mul64(x4, 0x1eb5e412a22b3d3b) - var x7 uint64 - var x8 uint64 - x8, x7 = bits.Mul64(x4, 0x620fc84c3affe0d4) - var x9 uint64 - var x10 uint64 - x10, x9 = bits.Mul64(x4, 0x3464504ade6fa2fa) - var x11 uint64 - var x12 uint64 - x12, x11 = bits.Mul64(x4, 0x901192af7c114f20) - var x13 uint64 - var x14 uint64 - x13, x14 = bits.Add64(x12, x9, uint64(0x0)) - var x15 uint64 - var x16 uint64 - x15, x16 = bits.Add64(x10, x7, uint64(sm2p256Uint1(x14))) - var x17 uint64 - var x18 uint64 - x17, x18 = bits.Add64(x8, x5, uint64(sm2p256Uint1(x16))) - var x19 uint64 - var x20 uint64 - _, y11 := bits.Mul64(x11, orderK0) - x20, x19 = bits.Mul64(y11, 0xfffffffeffffffff) - var x21 uint64 - var x22 uint64 - x22, x21 = bits.Mul64(y11, 0xffffffffffffffff) - var x23 uint64 - var x24 uint64 - x24, x23 = bits.Mul64(y11, 0x7203df6b21c6052b) - var x25 uint64 - var x26 uint64 - x26, x25 = bits.Mul64(y11, 0x53bbf40939d54123) - var x27 uint64 - var x28 uint64 - x27, x28 = bits.Add64(x26, x23, uint64(0x0)) - var x29 uint64 - var x30 uint64 - x29, x30 = bits.Add64(x24, x21, uint64(sm2p256Uint1(x28))) - var x31 uint64 - var x32 uint64 - x31, x32 = bits.Add64(x22, x19, uint64(sm2p256Uint1(x30))) - var x34 uint64 - _, x34 = bits.Add64(x11, x25, uint64(0x0)) - var x35 uint64 - var x36 uint64 - x35, x36 = bits.Add64(x13, x27, uint64(sm2p256Uint1(x34))) - var x37 uint64 - var x38 uint64 - x37, x38 = bits.Add64(x15, x29, uint64(sm2p256Uint1(x36))) - var x39 uint64 - var x40 uint64 - x39, x40 = bits.Add64(x17, x31, uint64(sm2p256Uint1(x38))) - var x41 uint64 - var x42 uint64 - x41, x42 = bits.Add64((uint64(sm2p256Uint1(x18)) + x6), (uint64(sm2p256Uint1(x32)) + x20), uint64(sm2p256Uint1(x40))) - var x43 uint64 - var x44 uint64 - x44, x43 = bits.Mul64(x1, 0x1eb5e412a22b3d3b) - var x45 uint64 - var x46 uint64 - x46, x45 = bits.Mul64(x1, 0x620fc84c3affe0d4) - var x47 uint64 - var x48 uint64 - x48, x47 = bits.Mul64(x1, 0x3464504ade6fa2fa) - var x49 uint64 - var x50 uint64 - x50, x49 = bits.Mul64(x1, 0x901192af7c114f20) - var x51 uint64 - var x52 uint64 - x51, x52 = bits.Add64(x50, x47, uint64(0x0)) - var x53 uint64 - var x54 uint64 - x53, x54 = bits.Add64(x48, x45, uint64(sm2p256Uint1(x52))) - var x55 uint64 - var x56 uint64 - x55, x56 = bits.Add64(x46, x43, uint64(sm2p256Uint1(x54))) - var x57 uint64 - var x58 uint64 - x57, x58 = bits.Add64(x35, x49, uint64(0x0)) - var x59 uint64 - var x60 uint64 - x59, x60 = bits.Add64(x37, x51, uint64(sm2p256Uint1(x58))) - var x61 uint64 - var x62 uint64 - x61, x62 = bits.Add64(x39, x53, uint64(sm2p256Uint1(x60))) - var x63 uint64 - var x64 uint64 - x63, x64 = bits.Add64(x41, x55, uint64(sm2p256Uint1(x62))) - var x65 uint64 - var x66 uint64 - _, y57 := bits.Mul64(x57, orderK0) - x66, x65 = bits.Mul64(y57, 0xfffffffeffffffff) - var x67 uint64 - var x68 uint64 - x68, x67 = bits.Mul64(y57, 0xffffffffffffffff) - var x69 uint64 - var x70 uint64 - x70, x69 = bits.Mul64(y57, 0x7203df6b21c6052b) - var x71 uint64 - var x72 uint64 - x72, x71 = bits.Mul64(y57, 0x53bbf40939d54123) - var x73 uint64 - var x74 uint64 - x73, x74 = bits.Add64(x72, x69, uint64(0x0)) - var x75 uint64 - var x76 uint64 - x75, x76 = bits.Add64(x70, x67, uint64(sm2p256Uint1(x74))) - var x77 uint64 - var x78 uint64 - x77, x78 = bits.Add64(x68, x65, uint64(sm2p256Uint1(x76))) - var x80 uint64 - _, x80 = bits.Add64(x57, x71, uint64(0x0)) - var x81 uint64 - var x82 uint64 - x81, x82 = bits.Add64(x59, x73, uint64(sm2p256Uint1(x80))) - var x83 uint64 - var x84 uint64 - x83, x84 = bits.Add64(x61, x75, uint64(sm2p256Uint1(x82))) - var x85 uint64 - var x86 uint64 - x85, x86 = bits.Add64(x63, x77, uint64(sm2p256Uint1(x84))) - var x87 uint64 - var x88 uint64 - x87, x88 = bits.Add64(((uint64(sm2p256Uint1(x64)) + uint64(sm2p256Uint1(x42))) + (uint64(sm2p256Uint1(x56)) + x44)), (uint64(sm2p256Uint1(x78)) + x66), uint64(sm2p256Uint1(x86))) - var x89 uint64 - var x90 uint64 - x90, x89 = bits.Mul64(x2, 0x1eb5e412a22b3d3b) - var x91 uint64 - var x92 uint64 - x92, x91 = bits.Mul64(x2, 0x620fc84c3affe0d4) - var x93 uint64 - var x94 uint64 - x94, x93 = bits.Mul64(x2, 0x3464504ade6fa2fa) - var x95 uint64 - var x96 uint64 - x96, x95 = bits.Mul64(x2, 0x901192af7c114f20) - var x97 uint64 - var x98 uint64 - x97, x98 = bits.Add64(x96, x93, uint64(0x0)) - var x99 uint64 - var x100 uint64 - x99, x100 = bits.Add64(x94, x91, uint64(sm2p256Uint1(x98))) - var x101 uint64 - var x102 uint64 - x101, x102 = bits.Add64(x92, x89, uint64(sm2p256Uint1(x100))) - var x103 uint64 - var x104 uint64 - x103, x104 = bits.Add64(x81, x95, uint64(0x0)) - var x105 uint64 - var x106 uint64 - x105, x106 = bits.Add64(x83, x97, uint64(sm2p256Uint1(x104))) - var x107 uint64 - var x108 uint64 - x107, x108 = bits.Add64(x85, x99, uint64(sm2p256Uint1(x106))) - var x109 uint64 - var x110 uint64 - x109, x110 = bits.Add64(x87, x101, uint64(sm2p256Uint1(x108))) - var x111 uint64 - var x112 uint64 - _, y103 := bits.Mul64(x103, orderK0) - x112, x111 = bits.Mul64(y103, 0xfffffffeffffffff) - var x113 uint64 - var x114 uint64 - x114, x113 = bits.Mul64(y103, 0xffffffffffffffff) - var x115 uint64 - var x116 uint64 - x116, x115 = bits.Mul64(y103, 0x7203df6b21c6052b) - var x117 uint64 - var x118 uint64 - x118, x117 = bits.Mul64(y103, 0x53bbf40939d54123) - var x119 uint64 - var x120 uint64 - x119, x120 = bits.Add64(x118, x115, uint64(0x0)) - var x121 uint64 - var x122 uint64 - x121, x122 = bits.Add64(x116, x113, uint64(sm2p256Uint1(x120))) - var x123 uint64 - var x124 uint64 - x123, x124 = bits.Add64(x114, x111, uint64(sm2p256Uint1(x122))) - var x126 uint64 - _, x126 = bits.Add64(x103, x117, uint64(0x0)) - var x127 uint64 - var x128 uint64 - x127, x128 = bits.Add64(x105, x119, uint64(sm2p256Uint1(x126))) - var x129 uint64 - var x130 uint64 - x129, x130 = bits.Add64(x107, x121, uint64(sm2p256Uint1(x128))) - var x131 uint64 - var x132 uint64 - x131, x132 = bits.Add64(x109, x123, uint64(sm2p256Uint1(x130))) - var x133 uint64 - var x134 uint64 - x133, x134 = bits.Add64(((uint64(sm2p256Uint1(x110)) + uint64(sm2p256Uint1(x88))) + (uint64(sm2p256Uint1(x102)) + x90)), (uint64(sm2p256Uint1(x124)) + x112), uint64(sm2p256Uint1(x132))) - var x135 uint64 - var x136 uint64 - x136, x135 = bits.Mul64(x3, 0x1eb5e412a22b3d3b) - var x137 uint64 - var x138 uint64 - x138, x137 = bits.Mul64(x3, 0x620fc84c3affe0d4) - var x139 uint64 - var x140 uint64 - x140, x139 = bits.Mul64(x3, 0x3464504ade6fa2fa) - var x141 uint64 - var x142 uint64 - x142, x141 = bits.Mul64(x3, 0x901192af7c114f20) - var x143 uint64 - var x144 uint64 - x143, x144 = bits.Add64(x142, x139, uint64(0x0)) - var x145 uint64 - var x146 uint64 - x145, x146 = bits.Add64(x140, x137, uint64(sm2p256Uint1(x144))) - var x147 uint64 - var x148 uint64 - x147, x148 = bits.Add64(x138, x135, uint64(sm2p256Uint1(x146))) - var x149 uint64 - var x150 uint64 - x149, x150 = bits.Add64(x127, x141, uint64(0x0)) - var x151 uint64 - var x152 uint64 - x151, x152 = bits.Add64(x129, x143, uint64(sm2p256Uint1(x150))) - var x153 uint64 - var x154 uint64 - x153, x154 = bits.Add64(x131, x145, uint64(sm2p256Uint1(x152))) - var x155 uint64 - var x156 uint64 - x155, x156 = bits.Add64(x133, x147, uint64(sm2p256Uint1(x154))) - var x157 uint64 - var x158 uint64 - _, y149 := bits.Mul64(x149, orderK0) - x158, x157 = bits.Mul64(y149, 0xfffffffeffffffff) - var x159 uint64 - var x160 uint64 - x160, x159 = bits.Mul64(y149, 0xffffffffffffffff) - var x161 uint64 - var x162 uint64 - x162, x161 = bits.Mul64(y149, 0x7203df6b21c6052b) - var x163 uint64 - var x164 uint64 - x164, x163 = bits.Mul64(y149, 0x53bbf40939d54123) - var x165 uint64 - var x166 uint64 - x165, x166 = bits.Add64(x164, x161, uint64(0x0)) - var x167 uint64 - var x168 uint64 - x167, x168 = bits.Add64(x162, x159, uint64(sm2p256Uint1(x166))) - var x169 uint64 - var x170 uint64 - x169, x170 = bits.Add64(x160, x157, uint64(sm2p256Uint1(x168))) - var x172 uint64 - _, x172 = bits.Add64(x149, x163, uint64(0x0)) - var x173 uint64 - var x174 uint64 - x173, x174 = bits.Add64(x151, x165, uint64(sm2p256Uint1(x172))) - var x175 uint64 - var x176 uint64 - x175, x176 = bits.Add64(x153, x167, uint64(sm2p256Uint1(x174))) - var x177 uint64 - var x178 uint64 - x177, x178 = bits.Add64(x155, x169, uint64(sm2p256Uint1(x176))) - var x179 uint64 - var x180 uint64 - x179, x180 = bits.Add64(((uint64(sm2p256Uint1(x156)) + uint64(sm2p256Uint1(x134))) + (uint64(sm2p256Uint1(x148)) + x136)), (uint64(sm2p256Uint1(x170)) + x158), uint64(sm2p256Uint1(x178))) - var x181 uint64 - var x182 uint64 - x181, x182 = bits.Sub64(x173, 0x53bbf40939d54123, uint64(0x0)) - var x183 uint64 - var x184 uint64 - x183, x184 = bits.Sub64(x175, 0x7203df6b21c6052b, uint64(sm2p256Uint1(x182))) - var x185 uint64 - var x186 uint64 - x185, x186 = bits.Sub64(x177, 0xffffffffffffffff, uint64(sm2p256Uint1(x184))) - var x187 uint64 - var x188 uint64 - x187, x188 = bits.Sub64(x179, 0xfffffffeffffffff, uint64(sm2p256Uint1(x186))) - var x190 uint64 - _, x190 = bits.Sub64(uint64(sm2p256Uint1(x180)), uint64(0x0), uint64(sm2p256Uint1(x188))) - var x191 uint64 - sm2p256CmovznzU64(&x191, sm2p256Uint1(x190), x181, x173) - var x192 uint64 - sm2p256CmovznzU64(&x192, sm2p256Uint1(x190), x183, x175) - var x193 uint64 - sm2p256CmovznzU64(&x193, sm2p256Uint1(x190), x185, x177) - var x194 uint64 - sm2p256CmovznzU64(&x194, sm2p256Uint1(x190), x187, x179) - out1[0] = x191 - out1[1] = x192 - out1[2] = x193 - out1[3] = x194 -} diff --git a/internal/sm2ec/fiat/sm2p256scalar.go b/internal/sm2ec/fiat/sm2p256scalar.go new file mode 100644 index 00000000..439372f5 --- /dev/null +++ b/internal/sm2ec/fiat/sm2p256scalar.go @@ -0,0 +1,133 @@ +// Copyright 2021 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +// Code generated by generate.go. DO NOT EDIT. + +package fiat + +import ( + "crypto/subtle" + "errors" +) + +// SM2P256OrderElement is an integer modulo 2^256 - 2^224 - 188730267045675049073202170516080344797. +// +// The zero value is a valid zero element. +type SM2P256OrderElement struct { + // Values are represented internally always in the Montgomery domain, and + // converted in Bytes and SetBytes. + x sm2p256scalarMontgomeryDomainFieldElement +} + +const sm2p256scalarElementLen = 32 + +type sm2p256scalarUntypedFieldElement = [4]uint64 + +// One sets e = 1, and returns e. +func (e *SM2P256OrderElement) One() *SM2P256OrderElement { + sm2p256scalarSetOne(&e.x) + return e +} + +// Equal returns 1 if e == t, and zero otherwise. +func (e *SM2P256OrderElement) Equal(t *SM2P256OrderElement) int { + eBytes := e.Bytes() + tBytes := t.Bytes() + return subtle.ConstantTimeCompare(eBytes, tBytes) +} + +// IsZero returns 1 if e == 0, and zero otherwise. +func (e *SM2P256OrderElement) IsZero() int { + zero := make([]byte, sm2p256scalarElementLen) + eBytes := e.Bytes() + return subtle.ConstantTimeCompare(eBytes, zero) +} + +// Set sets e = t, and returns e. +func (e *SM2P256OrderElement) Set(t *SM2P256OrderElement) *SM2P256OrderElement { + e.x = t.x + return e +} + +// Bytes returns the 32-byte big-endian encoding of e. +func (e *SM2P256OrderElement) Bytes() []byte { + // This function is outlined to make the allocations inline in the caller + // rather than happen on the heap. + var out [sm2p256scalarElementLen]byte + return e.bytes(&out) +} + +func (e *SM2P256OrderElement) bytes(out *[sm2p256scalarElementLen]byte) []byte { + var tmp sm2p256scalarNonMontgomeryDomainFieldElement + sm2p256scalarFromMontgomery(&tmp, &e.x) + sm2p256scalarToBytes(out, (*sm2p256scalarUntypedFieldElement)(&tmp)) + sm2p256scalarInvertEndianness(out[:]) + return out[:] +} + +// SetBytes sets e = v, where v is a big-endian 32-byte encoding, and returns e. +// If v is not 32 bytes or it encodes a value higher than 2^256 - 2^224 - 188730267045675049073202170516080344797, +// SetBytes returns nil and an error, and e is unchanged. +func (e *SM2P256OrderElement) SetBytes(v []byte) (*SM2P256OrderElement, error) { + if len(v) != sm2p256scalarElementLen { + return nil, errors.New("invalid SM2P256OrderElement encoding") + } + /* + // Check for non-canonical encodings (p + k, 2p + k, etc.) by comparing to + // the encoding of -1 mod p, so p - 1, the highest canonical encoding. + var minusOneEncoding = new(SM2P256OrderElement).Sub( + new(SM2P256OrderElement), new(SM2P256OrderElement).One()).Bytes() + for i := range v { + if v[i] < minusOneEncoding[i] { + break + } + if v[i] > minusOneEncoding[i] { + return nil, errors.New("invalid SM2P256OrderElement encoding") + } + }*/ + var in [sm2p256scalarElementLen]byte + copy(in[:], v) + sm2p256scalarInvertEndianness(in[:]) + var tmp sm2p256scalarNonMontgomeryDomainFieldElement + sm2p256scalarFromBytes((*sm2p256scalarUntypedFieldElement)(&tmp), &in) + sm2p256scalarToMontgomery(&e.x, &tmp) + return e, nil +} + +// Add sets e = t1 + t2, and returns e. +func (e *SM2P256OrderElement) Add(t1, t2 *SM2P256OrderElement) *SM2P256OrderElement { + sm2p256scalarAdd(&e.x, &t1.x, &t2.x) + return e +} + +// Sub sets e = t1 - t2, and returns e. +func (e *SM2P256OrderElement) Sub(t1, t2 *SM2P256OrderElement) *SM2P256OrderElement { + sm2p256scalarSub(&e.x, &t1.x, &t2.x) + return e +} + +// Mul sets e = t1 * t2, and returns e. +func (e *SM2P256OrderElement) Mul(t1, t2 *SM2P256OrderElement) *SM2P256OrderElement { + sm2p256scalarMul(&e.x, &t1.x, &t2.x) + return e +} + +// Square sets e = t * t, and returns e. +func (e *SM2P256OrderElement) Square(t *SM2P256OrderElement) *SM2P256OrderElement { + sm2p256scalarSquare(&e.x, &t.x) + return e +} + +// Select sets v to a if cond == 1, and to b if cond == 0. +func (v *SM2P256OrderElement) Select(a, b *SM2P256OrderElement, cond int) *SM2P256OrderElement { + sm2p256scalarSelectznz((*sm2p256scalarUntypedFieldElement)(&v.x), sm2p256scalarUint1(cond), + (*sm2p256scalarUntypedFieldElement)(&b.x), (*sm2p256scalarUntypedFieldElement)(&a.x)) + return v +} + +func sm2p256scalarInvertEndianness(v []byte) { + for i := 0; i < len(v)/2; i++ { + v[i], v[len(v)-1-i] = v[len(v)-1-i], v[i] + } +} diff --git a/internal/sm2ec/fiat/sm2p256scalar_fiat64.go b/internal/sm2ec/fiat/sm2p256scalar_fiat64.go new file mode 100644 index 00000000..1733aad4 --- /dev/null +++ b/internal/sm2ec/fiat/sm2p256scalar_fiat64.go @@ -0,0 +1,1887 @@ +// Code generated by Fiat Cryptography. DO NOT EDIT. +// +// Autogenerated: word_by_word_montgomery --lang Go --no-wide-int --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --internal-static --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name fiat --no-prefix-fiat sm2p256scalar 64 '2^256 - 2^224 - 188730267045675049073202170516080344797' mul square add sub one from_montgomery to_montgomery selectznz to_bytes from_bytes nonzero opp msat divstep divstep_precomp +// +// curve description: sm2p256scalar +// +// machine_wordsize = 64 (from "64") +// +// requested operations: mul, square, add, sub, one, from_montgomery, to_montgomery, selectznz, to_bytes, from_bytes, nonzero, opp, msat, divstep, divstep_precomp +// +// m = 0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123 (from "2^256 - 2^224 - 188730267045675049073202170516080344797") +// +// +// +// NOTE: In addition to the bounds specified above each function, all +// +// functions synthesized for this Montgomery arithmetic require the +// +// input to be strictly less than the prime modulus (m), and also +// +// require the input to be in the unique saturated representation. +// +// All functions also ensure that these two properties are true of +// +// return values. +// +// +// +// Computed values: +// +// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +// +// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +// +// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +// +// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +package fiat + +import "math/bits" + +type sm2p256scalarUint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 +type sm2p256scalarInt1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 + +// The type sm2p256scalarMontgomeryDomainFieldElement is a field element in the Montgomery domain. +// +// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +type sm2p256scalarMontgomeryDomainFieldElement [4]uint64 + +// The type sm2p256scalarNonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain. +// +// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +type sm2p256scalarNonMontgomeryDomainFieldElement [4]uint64 + +// sm2p256scalarCmovznzU64 is a single-word conditional move. +// +// Postconditions: +// out1 = (if arg1 = 0 then arg2 else arg3) +// +// Input Bounds: +// arg1: [0x0 ~> 0x1] +// arg2: [0x0 ~> 0xffffffffffffffff] +// arg3: [0x0 ~> 0xffffffffffffffff] +// Output Bounds: +// out1: [0x0 ~> 0xffffffffffffffff] +func sm2p256scalarCmovznzU64(out1 *uint64, arg1 sm2p256scalarUint1, arg2 uint64, arg3 uint64) { + x1 := (uint64(arg1) * 0xffffffffffffffff) + x2 := ((x1 & arg3) | ((^x1) & arg2)) + *out1 = x2 +} + +// sm2p256scalarMul multiplies two field elements in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// 0 ≤ eval arg2 < m +// Postconditions: +// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarMul(out1 *sm2p256scalarMontgomeryDomainFieldElement, arg1 *sm2p256scalarMontgomeryDomainFieldElement, arg2 *sm2p256scalarMontgomeryDomainFieldElement) { + x1 := arg1[1] + x2 := arg1[2] + x3 := arg1[3] + x4 := arg1[0] + var x5 uint64 + var x6 uint64 + x6, x5 = bits.Mul64(x4, arg2[3]) + var x7 uint64 + var x8 uint64 + x8, x7 = bits.Mul64(x4, arg2[2]) + var x9 uint64 + var x10 uint64 + x10, x9 = bits.Mul64(x4, arg2[1]) + var x11 uint64 + var x12 uint64 + x12, x11 = bits.Mul64(x4, arg2[0]) + var x13 uint64 + var x14 uint64 + x13, x14 = bits.Add64(x12, x9, uint64(0x0)) + var x15 uint64 + var x16 uint64 + x15, x16 = bits.Add64(x10, x7, uint64(sm2p256scalarUint1(x14))) + var x17 uint64 + var x18 uint64 + x17, x18 = bits.Add64(x8, x5, uint64(sm2p256scalarUint1(x16))) + x19 := (uint64(sm2p256scalarUint1(x18)) + x6) + var x20 uint64 + _, x20 = bits.Mul64(x11, 0x327f9e8872350975) + var x22 uint64 + var x23 uint64 + x23, x22 = bits.Mul64(x20, 0xfffffffeffffffff) + var x24 uint64 + var x25 uint64 + x25, x24 = bits.Mul64(x20, 0xffffffffffffffff) + var x26 uint64 + var x27 uint64 + x27, x26 = bits.Mul64(x20, 0x7203df6b21c6052b) + var x28 uint64 + var x29 uint64 + x29, x28 = bits.Mul64(x20, 0x53bbf40939d54123) + var x30 uint64 + var x31 uint64 + x30, x31 = bits.Add64(x29, x26, uint64(0x0)) + var x32 uint64 + var x33 uint64 + x32, x33 = bits.Add64(x27, x24, uint64(sm2p256scalarUint1(x31))) + var x34 uint64 + var x35 uint64 + x34, x35 = bits.Add64(x25, x22, uint64(sm2p256scalarUint1(x33))) + x36 := (uint64(sm2p256scalarUint1(x35)) + x23) + var x38 uint64 + _, x38 = bits.Add64(x11, x28, uint64(0x0)) + var x39 uint64 + var x40 uint64 + x39, x40 = bits.Add64(x13, x30, uint64(sm2p256scalarUint1(x38))) + var x41 uint64 + var x42 uint64 + x41, x42 = bits.Add64(x15, x32, uint64(sm2p256scalarUint1(x40))) + var x43 uint64 + var x44 uint64 + x43, x44 = bits.Add64(x17, x34, uint64(sm2p256scalarUint1(x42))) + var x45 uint64 + var x46 uint64 + x45, x46 = bits.Add64(x19, x36, uint64(sm2p256scalarUint1(x44))) + var x47 uint64 + var x48 uint64 + x48, x47 = bits.Mul64(x1, arg2[3]) + var x49 uint64 + var x50 uint64 + x50, x49 = bits.Mul64(x1, arg2[2]) + var x51 uint64 + var x52 uint64 + x52, x51 = bits.Mul64(x1, arg2[1]) + var x53 uint64 + var x54 uint64 + x54, x53 = bits.Mul64(x1, arg2[0]) + var x55 uint64 + var x56 uint64 + x55, x56 = bits.Add64(x54, x51, uint64(0x0)) + var x57 uint64 + var x58 uint64 + x57, x58 = bits.Add64(x52, x49, uint64(sm2p256scalarUint1(x56))) + var x59 uint64 + var x60 uint64 + x59, x60 = bits.Add64(x50, x47, uint64(sm2p256scalarUint1(x58))) + x61 := (uint64(sm2p256scalarUint1(x60)) + x48) + var x62 uint64 + var x63 uint64 + x62, x63 = bits.Add64(x39, x53, uint64(0x0)) + var x64 uint64 + var x65 uint64 + x64, x65 = bits.Add64(x41, x55, uint64(sm2p256scalarUint1(x63))) + var x66 uint64 + var x67 uint64 + x66, x67 = bits.Add64(x43, x57, uint64(sm2p256scalarUint1(x65))) + var x68 uint64 + var x69 uint64 + x68, x69 = bits.Add64(x45, x59, uint64(sm2p256scalarUint1(x67))) + var x70 uint64 + var x71 uint64 + x70, x71 = bits.Add64(uint64(sm2p256scalarUint1(x46)), x61, uint64(sm2p256scalarUint1(x69))) + var x72 uint64 + _, x72 = bits.Mul64(x62, 0x327f9e8872350975) + var x74 uint64 + var x75 uint64 + x75, x74 = bits.Mul64(x72, 0xfffffffeffffffff) + var x76 uint64 + var x77 uint64 + x77, x76 = bits.Mul64(x72, 0xffffffffffffffff) + var x78 uint64 + var x79 uint64 + x79, x78 = bits.Mul64(x72, 0x7203df6b21c6052b) + var x80 uint64 + var x81 uint64 + x81, x80 = bits.Mul64(x72, 0x53bbf40939d54123) + var x82 uint64 + var x83 uint64 + x82, x83 = bits.Add64(x81, x78, uint64(0x0)) + var x84 uint64 + var x85 uint64 + x84, x85 = bits.Add64(x79, x76, uint64(sm2p256scalarUint1(x83))) + var x86 uint64 + var x87 uint64 + x86, x87 = bits.Add64(x77, x74, uint64(sm2p256scalarUint1(x85))) + x88 := (uint64(sm2p256scalarUint1(x87)) + x75) + var x90 uint64 + _, x90 = bits.Add64(x62, x80, uint64(0x0)) + var x91 uint64 + var x92 uint64 + x91, x92 = bits.Add64(x64, x82, uint64(sm2p256scalarUint1(x90))) + var x93 uint64 + var x94 uint64 + x93, x94 = bits.Add64(x66, x84, uint64(sm2p256scalarUint1(x92))) + var x95 uint64 + var x96 uint64 + x95, x96 = bits.Add64(x68, x86, uint64(sm2p256scalarUint1(x94))) + var x97 uint64 + var x98 uint64 + x97, x98 = bits.Add64(x70, x88, uint64(sm2p256scalarUint1(x96))) + x99 := (uint64(sm2p256scalarUint1(x98)) + uint64(sm2p256scalarUint1(x71))) + var x100 uint64 + var x101 uint64 + x101, x100 = bits.Mul64(x2, arg2[3]) + var x102 uint64 + var x103 uint64 + x103, x102 = bits.Mul64(x2, arg2[2]) + var x104 uint64 + var x105 uint64 + x105, x104 = bits.Mul64(x2, arg2[1]) + var x106 uint64 + var x107 uint64 + x107, x106 = bits.Mul64(x2, arg2[0]) + var x108 uint64 + var x109 uint64 + x108, x109 = bits.Add64(x107, x104, uint64(0x0)) + var x110 uint64 + var x111 uint64 + x110, x111 = bits.Add64(x105, x102, uint64(sm2p256scalarUint1(x109))) + var x112 uint64 + var x113 uint64 + x112, x113 = bits.Add64(x103, x100, uint64(sm2p256scalarUint1(x111))) + x114 := (uint64(sm2p256scalarUint1(x113)) + x101) + var x115 uint64 + var x116 uint64 + x115, x116 = bits.Add64(x91, x106, uint64(0x0)) + var x117 uint64 + var x118 uint64 + x117, x118 = bits.Add64(x93, x108, uint64(sm2p256scalarUint1(x116))) + var x119 uint64 + var x120 uint64 + x119, x120 = bits.Add64(x95, x110, uint64(sm2p256scalarUint1(x118))) + var x121 uint64 + var x122 uint64 + x121, x122 = bits.Add64(x97, x112, uint64(sm2p256scalarUint1(x120))) + var x123 uint64 + var x124 uint64 + x123, x124 = bits.Add64(x99, x114, uint64(sm2p256scalarUint1(x122))) + var x125 uint64 + _, x125 = bits.Mul64(x115, 0x327f9e8872350975) + var x127 uint64 + var x128 uint64 + x128, x127 = bits.Mul64(x125, 0xfffffffeffffffff) + var x129 uint64 + var x130 uint64 + x130, x129 = bits.Mul64(x125, 0xffffffffffffffff) + var x131 uint64 + var x132 uint64 + x132, x131 = bits.Mul64(x125, 0x7203df6b21c6052b) + var x133 uint64 + var x134 uint64 + x134, x133 = bits.Mul64(x125, 0x53bbf40939d54123) + var x135 uint64 + var x136 uint64 + x135, x136 = bits.Add64(x134, x131, uint64(0x0)) + var x137 uint64 + var x138 uint64 + x137, x138 = bits.Add64(x132, x129, uint64(sm2p256scalarUint1(x136))) + var x139 uint64 + var x140 uint64 + x139, x140 = bits.Add64(x130, x127, uint64(sm2p256scalarUint1(x138))) + x141 := (uint64(sm2p256scalarUint1(x140)) + x128) + var x143 uint64 + _, x143 = bits.Add64(x115, x133, uint64(0x0)) + var x144 uint64 + var x145 uint64 + x144, x145 = bits.Add64(x117, x135, uint64(sm2p256scalarUint1(x143))) + var x146 uint64 + var x147 uint64 + x146, x147 = bits.Add64(x119, x137, uint64(sm2p256scalarUint1(x145))) + var x148 uint64 + var x149 uint64 + x148, x149 = bits.Add64(x121, x139, uint64(sm2p256scalarUint1(x147))) + var x150 uint64 + var x151 uint64 + x150, x151 = bits.Add64(x123, x141, uint64(sm2p256scalarUint1(x149))) + x152 := (uint64(sm2p256scalarUint1(x151)) + uint64(sm2p256scalarUint1(x124))) + var x153 uint64 + var x154 uint64 + x154, x153 = bits.Mul64(x3, arg2[3]) + var x155 uint64 + var x156 uint64 + x156, x155 = bits.Mul64(x3, arg2[2]) + var x157 uint64 + var x158 uint64 + x158, x157 = bits.Mul64(x3, arg2[1]) + var x159 uint64 + var x160 uint64 + x160, x159 = bits.Mul64(x3, arg2[0]) + var x161 uint64 + var x162 uint64 + x161, x162 = bits.Add64(x160, x157, uint64(0x0)) + var x163 uint64 + var x164 uint64 + x163, x164 = bits.Add64(x158, x155, uint64(sm2p256scalarUint1(x162))) + var x165 uint64 + var x166 uint64 + x165, x166 = bits.Add64(x156, x153, uint64(sm2p256scalarUint1(x164))) + x167 := (uint64(sm2p256scalarUint1(x166)) + x154) + var x168 uint64 + var x169 uint64 + x168, x169 = bits.Add64(x144, x159, uint64(0x0)) + var x170 uint64 + var x171 uint64 + x170, x171 = bits.Add64(x146, x161, uint64(sm2p256scalarUint1(x169))) + var x172 uint64 + var x173 uint64 + x172, x173 = bits.Add64(x148, x163, uint64(sm2p256scalarUint1(x171))) + var x174 uint64 + var x175 uint64 + x174, x175 = bits.Add64(x150, x165, uint64(sm2p256scalarUint1(x173))) + var x176 uint64 + var x177 uint64 + x176, x177 = bits.Add64(x152, x167, uint64(sm2p256scalarUint1(x175))) + var x178 uint64 + _, x178 = bits.Mul64(x168, 0x327f9e8872350975) + var x180 uint64 + var x181 uint64 + x181, x180 = bits.Mul64(x178, 0xfffffffeffffffff) + var x182 uint64 + var x183 uint64 + x183, x182 = bits.Mul64(x178, 0xffffffffffffffff) + var x184 uint64 + var x185 uint64 + x185, x184 = bits.Mul64(x178, 0x7203df6b21c6052b) + var x186 uint64 + var x187 uint64 + x187, x186 = bits.Mul64(x178, 0x53bbf40939d54123) + var x188 uint64 + var x189 uint64 + x188, x189 = bits.Add64(x187, x184, uint64(0x0)) + var x190 uint64 + var x191 uint64 + x190, x191 = bits.Add64(x185, x182, uint64(sm2p256scalarUint1(x189))) + var x192 uint64 + var x193 uint64 + x192, x193 = bits.Add64(x183, x180, uint64(sm2p256scalarUint1(x191))) + x194 := (uint64(sm2p256scalarUint1(x193)) + x181) + var x196 uint64 + _, x196 = bits.Add64(x168, x186, uint64(0x0)) + var x197 uint64 + var x198 uint64 + x197, x198 = bits.Add64(x170, x188, uint64(sm2p256scalarUint1(x196))) + var x199 uint64 + var x200 uint64 + x199, x200 = bits.Add64(x172, x190, uint64(sm2p256scalarUint1(x198))) + var x201 uint64 + var x202 uint64 + x201, x202 = bits.Add64(x174, x192, uint64(sm2p256scalarUint1(x200))) + var x203 uint64 + var x204 uint64 + x203, x204 = bits.Add64(x176, x194, uint64(sm2p256scalarUint1(x202))) + x205 := (uint64(sm2p256scalarUint1(x204)) + uint64(sm2p256scalarUint1(x177))) + var x206 uint64 + var x207 uint64 + x206, x207 = bits.Sub64(x197, 0x53bbf40939d54123, uint64(0x0)) + var x208 uint64 + var x209 uint64 + x208, x209 = bits.Sub64(x199, 0x7203df6b21c6052b, uint64(sm2p256scalarUint1(x207))) + var x210 uint64 + var x211 uint64 + x210, x211 = bits.Sub64(x201, 0xffffffffffffffff, uint64(sm2p256scalarUint1(x209))) + var x212 uint64 + var x213 uint64 + x212, x213 = bits.Sub64(x203, 0xfffffffeffffffff, uint64(sm2p256scalarUint1(x211))) + var x215 uint64 + _, x215 = bits.Sub64(x205, uint64(0x0), uint64(sm2p256scalarUint1(x213))) + var x216 uint64 + sm2p256scalarCmovznzU64(&x216, sm2p256scalarUint1(x215), x206, x197) + var x217 uint64 + sm2p256scalarCmovznzU64(&x217, sm2p256scalarUint1(x215), x208, x199) + var x218 uint64 + sm2p256scalarCmovznzU64(&x218, sm2p256scalarUint1(x215), x210, x201) + var x219 uint64 + sm2p256scalarCmovznzU64(&x219, sm2p256scalarUint1(x215), x212, x203) + out1[0] = x216 + out1[1] = x217 + out1[2] = x218 + out1[3] = x219 +} + +// sm2p256scalarSquare squares a field element in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarSquare(out1 *sm2p256scalarMontgomeryDomainFieldElement, arg1 *sm2p256scalarMontgomeryDomainFieldElement) { + x1 := arg1[1] + x2 := arg1[2] + x3 := arg1[3] + x4 := arg1[0] + var x5 uint64 + var x6 uint64 + x6, x5 = bits.Mul64(x4, arg1[3]) + var x7 uint64 + var x8 uint64 + x8, x7 = bits.Mul64(x4, arg1[2]) + var x9 uint64 + var x10 uint64 + x10, x9 = bits.Mul64(x4, arg1[1]) + var x11 uint64 + var x12 uint64 + x12, x11 = bits.Mul64(x4, arg1[0]) + var x13 uint64 + var x14 uint64 + x13, x14 = bits.Add64(x12, x9, uint64(0x0)) + var x15 uint64 + var x16 uint64 + x15, x16 = bits.Add64(x10, x7, uint64(sm2p256scalarUint1(x14))) + var x17 uint64 + var x18 uint64 + x17, x18 = bits.Add64(x8, x5, uint64(sm2p256scalarUint1(x16))) + x19 := (uint64(sm2p256scalarUint1(x18)) + x6) + var x20 uint64 + _, x20 = bits.Mul64(x11, 0x327f9e8872350975) + var x22 uint64 + var x23 uint64 + x23, x22 = bits.Mul64(x20, 0xfffffffeffffffff) + var x24 uint64 + var x25 uint64 + x25, x24 = bits.Mul64(x20, 0xffffffffffffffff) + var x26 uint64 + var x27 uint64 + x27, x26 = bits.Mul64(x20, 0x7203df6b21c6052b) + var x28 uint64 + var x29 uint64 + x29, x28 = bits.Mul64(x20, 0x53bbf40939d54123) + var x30 uint64 + var x31 uint64 + x30, x31 = bits.Add64(x29, x26, uint64(0x0)) + var x32 uint64 + var x33 uint64 + x32, x33 = bits.Add64(x27, x24, uint64(sm2p256scalarUint1(x31))) + var x34 uint64 + var x35 uint64 + x34, x35 = bits.Add64(x25, x22, uint64(sm2p256scalarUint1(x33))) + x36 := (uint64(sm2p256scalarUint1(x35)) + x23) + var x38 uint64 + _, x38 = bits.Add64(x11, x28, uint64(0x0)) + var x39 uint64 + var x40 uint64 + x39, x40 = bits.Add64(x13, x30, uint64(sm2p256scalarUint1(x38))) + var x41 uint64 + var x42 uint64 + x41, x42 = bits.Add64(x15, x32, uint64(sm2p256scalarUint1(x40))) + var x43 uint64 + var x44 uint64 + x43, x44 = bits.Add64(x17, x34, uint64(sm2p256scalarUint1(x42))) + var x45 uint64 + var x46 uint64 + x45, x46 = bits.Add64(x19, x36, uint64(sm2p256scalarUint1(x44))) + var x47 uint64 + var x48 uint64 + x48, x47 = bits.Mul64(x1, arg1[3]) + var x49 uint64 + var x50 uint64 + x50, x49 = bits.Mul64(x1, arg1[2]) + var x51 uint64 + var x52 uint64 + x52, x51 = bits.Mul64(x1, arg1[1]) + var x53 uint64 + var x54 uint64 + x54, x53 = bits.Mul64(x1, arg1[0]) + var x55 uint64 + var x56 uint64 + x55, x56 = bits.Add64(x54, x51, uint64(0x0)) + var x57 uint64 + var x58 uint64 + x57, x58 = bits.Add64(x52, x49, uint64(sm2p256scalarUint1(x56))) + var x59 uint64 + var x60 uint64 + x59, x60 = bits.Add64(x50, x47, uint64(sm2p256scalarUint1(x58))) + x61 := (uint64(sm2p256scalarUint1(x60)) + x48) + var x62 uint64 + var x63 uint64 + x62, x63 = bits.Add64(x39, x53, uint64(0x0)) + var x64 uint64 + var x65 uint64 + x64, x65 = bits.Add64(x41, x55, uint64(sm2p256scalarUint1(x63))) + var x66 uint64 + var x67 uint64 + x66, x67 = bits.Add64(x43, x57, uint64(sm2p256scalarUint1(x65))) + var x68 uint64 + var x69 uint64 + x68, x69 = bits.Add64(x45, x59, uint64(sm2p256scalarUint1(x67))) + var x70 uint64 + var x71 uint64 + x70, x71 = bits.Add64(uint64(sm2p256scalarUint1(x46)), x61, uint64(sm2p256scalarUint1(x69))) + var x72 uint64 + _, x72 = bits.Mul64(x62, 0x327f9e8872350975) + var x74 uint64 + var x75 uint64 + x75, x74 = bits.Mul64(x72, 0xfffffffeffffffff) + var x76 uint64 + var x77 uint64 + x77, x76 = bits.Mul64(x72, 0xffffffffffffffff) + var x78 uint64 + var x79 uint64 + x79, x78 = bits.Mul64(x72, 0x7203df6b21c6052b) + var x80 uint64 + var x81 uint64 + x81, x80 = bits.Mul64(x72, 0x53bbf40939d54123) + var x82 uint64 + var x83 uint64 + x82, x83 = bits.Add64(x81, x78, uint64(0x0)) + var x84 uint64 + var x85 uint64 + x84, x85 = bits.Add64(x79, x76, uint64(sm2p256scalarUint1(x83))) + var x86 uint64 + var x87 uint64 + x86, x87 = bits.Add64(x77, x74, uint64(sm2p256scalarUint1(x85))) + x88 := (uint64(sm2p256scalarUint1(x87)) + x75) + var x90 uint64 + _, x90 = bits.Add64(x62, x80, uint64(0x0)) + var x91 uint64 + var x92 uint64 + x91, x92 = bits.Add64(x64, x82, uint64(sm2p256scalarUint1(x90))) + var x93 uint64 + var x94 uint64 + x93, x94 = bits.Add64(x66, x84, uint64(sm2p256scalarUint1(x92))) + var x95 uint64 + var x96 uint64 + x95, x96 = bits.Add64(x68, x86, uint64(sm2p256scalarUint1(x94))) + var x97 uint64 + var x98 uint64 + x97, x98 = bits.Add64(x70, x88, uint64(sm2p256scalarUint1(x96))) + x99 := (uint64(sm2p256scalarUint1(x98)) + uint64(sm2p256scalarUint1(x71))) + var x100 uint64 + var x101 uint64 + x101, x100 = bits.Mul64(x2, arg1[3]) + var x102 uint64 + var x103 uint64 + x103, x102 = bits.Mul64(x2, arg1[2]) + var x104 uint64 + var x105 uint64 + x105, x104 = bits.Mul64(x2, arg1[1]) + var x106 uint64 + var x107 uint64 + x107, x106 = bits.Mul64(x2, arg1[0]) + var x108 uint64 + var x109 uint64 + x108, x109 = bits.Add64(x107, x104, uint64(0x0)) + var x110 uint64 + var x111 uint64 + x110, x111 = bits.Add64(x105, x102, uint64(sm2p256scalarUint1(x109))) + var x112 uint64 + var x113 uint64 + x112, x113 = bits.Add64(x103, x100, uint64(sm2p256scalarUint1(x111))) + x114 := (uint64(sm2p256scalarUint1(x113)) + x101) + var x115 uint64 + var x116 uint64 + x115, x116 = bits.Add64(x91, x106, uint64(0x0)) + var x117 uint64 + var x118 uint64 + x117, x118 = bits.Add64(x93, x108, uint64(sm2p256scalarUint1(x116))) + var x119 uint64 + var x120 uint64 + x119, x120 = bits.Add64(x95, x110, uint64(sm2p256scalarUint1(x118))) + var x121 uint64 + var x122 uint64 + x121, x122 = bits.Add64(x97, x112, uint64(sm2p256scalarUint1(x120))) + var x123 uint64 + var x124 uint64 + x123, x124 = bits.Add64(x99, x114, uint64(sm2p256scalarUint1(x122))) + var x125 uint64 + _, x125 = bits.Mul64(x115, 0x327f9e8872350975) + var x127 uint64 + var x128 uint64 + x128, x127 = bits.Mul64(x125, 0xfffffffeffffffff) + var x129 uint64 + var x130 uint64 + x130, x129 = bits.Mul64(x125, 0xffffffffffffffff) + var x131 uint64 + var x132 uint64 + x132, x131 = bits.Mul64(x125, 0x7203df6b21c6052b) + var x133 uint64 + var x134 uint64 + x134, x133 = bits.Mul64(x125, 0x53bbf40939d54123) + var x135 uint64 + var x136 uint64 + x135, x136 = bits.Add64(x134, x131, uint64(0x0)) + var x137 uint64 + var x138 uint64 + x137, x138 = bits.Add64(x132, x129, uint64(sm2p256scalarUint1(x136))) + var x139 uint64 + var x140 uint64 + x139, x140 = bits.Add64(x130, x127, uint64(sm2p256scalarUint1(x138))) + x141 := (uint64(sm2p256scalarUint1(x140)) + x128) + var x143 uint64 + _, x143 = bits.Add64(x115, x133, uint64(0x0)) + var x144 uint64 + var x145 uint64 + x144, x145 = bits.Add64(x117, x135, uint64(sm2p256scalarUint1(x143))) + var x146 uint64 + var x147 uint64 + x146, x147 = bits.Add64(x119, x137, uint64(sm2p256scalarUint1(x145))) + var x148 uint64 + var x149 uint64 + x148, x149 = bits.Add64(x121, x139, uint64(sm2p256scalarUint1(x147))) + var x150 uint64 + var x151 uint64 + x150, x151 = bits.Add64(x123, x141, uint64(sm2p256scalarUint1(x149))) + x152 := (uint64(sm2p256scalarUint1(x151)) + uint64(sm2p256scalarUint1(x124))) + var x153 uint64 + var x154 uint64 + x154, x153 = bits.Mul64(x3, arg1[3]) + var x155 uint64 + var x156 uint64 + x156, x155 = bits.Mul64(x3, arg1[2]) + var x157 uint64 + var x158 uint64 + x158, x157 = bits.Mul64(x3, arg1[1]) + var x159 uint64 + var x160 uint64 + x160, x159 = bits.Mul64(x3, arg1[0]) + var x161 uint64 + var x162 uint64 + x161, x162 = bits.Add64(x160, x157, uint64(0x0)) + var x163 uint64 + var x164 uint64 + x163, x164 = bits.Add64(x158, x155, uint64(sm2p256scalarUint1(x162))) + var x165 uint64 + var x166 uint64 + x165, x166 = bits.Add64(x156, x153, uint64(sm2p256scalarUint1(x164))) + x167 := (uint64(sm2p256scalarUint1(x166)) + x154) + var x168 uint64 + var x169 uint64 + x168, x169 = bits.Add64(x144, x159, uint64(0x0)) + var x170 uint64 + var x171 uint64 + x170, x171 = bits.Add64(x146, x161, uint64(sm2p256scalarUint1(x169))) + var x172 uint64 + var x173 uint64 + x172, x173 = bits.Add64(x148, x163, uint64(sm2p256scalarUint1(x171))) + var x174 uint64 + var x175 uint64 + x174, x175 = bits.Add64(x150, x165, uint64(sm2p256scalarUint1(x173))) + var x176 uint64 + var x177 uint64 + x176, x177 = bits.Add64(x152, x167, uint64(sm2p256scalarUint1(x175))) + var x178 uint64 + _, x178 = bits.Mul64(x168, 0x327f9e8872350975) + var x180 uint64 + var x181 uint64 + x181, x180 = bits.Mul64(x178, 0xfffffffeffffffff) + var x182 uint64 + var x183 uint64 + x183, x182 = bits.Mul64(x178, 0xffffffffffffffff) + var x184 uint64 + var x185 uint64 + x185, x184 = bits.Mul64(x178, 0x7203df6b21c6052b) + var x186 uint64 + var x187 uint64 + x187, x186 = bits.Mul64(x178, 0x53bbf40939d54123) + var x188 uint64 + var x189 uint64 + x188, x189 = bits.Add64(x187, x184, uint64(0x0)) + var x190 uint64 + var x191 uint64 + x190, x191 = bits.Add64(x185, x182, uint64(sm2p256scalarUint1(x189))) + var x192 uint64 + var x193 uint64 + x192, x193 = bits.Add64(x183, x180, uint64(sm2p256scalarUint1(x191))) + x194 := (uint64(sm2p256scalarUint1(x193)) + x181) + var x196 uint64 + _, x196 = bits.Add64(x168, x186, uint64(0x0)) + var x197 uint64 + var x198 uint64 + x197, x198 = bits.Add64(x170, x188, uint64(sm2p256scalarUint1(x196))) + var x199 uint64 + var x200 uint64 + x199, x200 = bits.Add64(x172, x190, uint64(sm2p256scalarUint1(x198))) + var x201 uint64 + var x202 uint64 + x201, x202 = bits.Add64(x174, x192, uint64(sm2p256scalarUint1(x200))) + var x203 uint64 + var x204 uint64 + x203, x204 = bits.Add64(x176, x194, uint64(sm2p256scalarUint1(x202))) + x205 := (uint64(sm2p256scalarUint1(x204)) + uint64(sm2p256scalarUint1(x177))) + var x206 uint64 + var x207 uint64 + x206, x207 = bits.Sub64(x197, 0x53bbf40939d54123, uint64(0x0)) + var x208 uint64 + var x209 uint64 + x208, x209 = bits.Sub64(x199, 0x7203df6b21c6052b, uint64(sm2p256scalarUint1(x207))) + var x210 uint64 + var x211 uint64 + x210, x211 = bits.Sub64(x201, 0xffffffffffffffff, uint64(sm2p256scalarUint1(x209))) + var x212 uint64 + var x213 uint64 + x212, x213 = bits.Sub64(x203, 0xfffffffeffffffff, uint64(sm2p256scalarUint1(x211))) + var x215 uint64 + _, x215 = bits.Sub64(x205, uint64(0x0), uint64(sm2p256scalarUint1(x213))) + var x216 uint64 + sm2p256scalarCmovznzU64(&x216, sm2p256scalarUint1(x215), x206, x197) + var x217 uint64 + sm2p256scalarCmovznzU64(&x217, sm2p256scalarUint1(x215), x208, x199) + var x218 uint64 + sm2p256scalarCmovznzU64(&x218, sm2p256scalarUint1(x215), x210, x201) + var x219 uint64 + sm2p256scalarCmovznzU64(&x219, sm2p256scalarUint1(x215), x212, x203) + out1[0] = x216 + out1[1] = x217 + out1[2] = x218 + out1[3] = x219 +} + +// sm2p256scalarAdd adds two field elements in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// 0 ≤ eval arg2 < m +// Postconditions: +// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarAdd(out1 *sm2p256scalarMontgomeryDomainFieldElement, arg1 *sm2p256scalarMontgomeryDomainFieldElement, arg2 *sm2p256scalarMontgomeryDomainFieldElement) { + var x1 uint64 + var x2 uint64 + x1, x2 = bits.Add64(arg1[0], arg2[0], uint64(0x0)) + var x3 uint64 + var x4 uint64 + x3, x4 = bits.Add64(arg1[1], arg2[1], uint64(sm2p256scalarUint1(x2))) + var x5 uint64 + var x6 uint64 + x5, x6 = bits.Add64(arg1[2], arg2[2], uint64(sm2p256scalarUint1(x4))) + var x7 uint64 + var x8 uint64 + x7, x8 = bits.Add64(arg1[3], arg2[3], uint64(sm2p256scalarUint1(x6))) + var x9 uint64 + var x10 uint64 + x9, x10 = bits.Sub64(x1, 0x53bbf40939d54123, uint64(0x0)) + var x11 uint64 + var x12 uint64 + x11, x12 = bits.Sub64(x3, 0x7203df6b21c6052b, uint64(sm2p256scalarUint1(x10))) + var x13 uint64 + var x14 uint64 + x13, x14 = bits.Sub64(x5, 0xffffffffffffffff, uint64(sm2p256scalarUint1(x12))) + var x15 uint64 + var x16 uint64 + x15, x16 = bits.Sub64(x7, 0xfffffffeffffffff, uint64(sm2p256scalarUint1(x14))) + var x18 uint64 + _, x18 = bits.Sub64(uint64(sm2p256scalarUint1(x8)), uint64(0x0), uint64(sm2p256scalarUint1(x16))) + var x19 uint64 + sm2p256scalarCmovznzU64(&x19, sm2p256scalarUint1(x18), x9, x1) + var x20 uint64 + sm2p256scalarCmovznzU64(&x20, sm2p256scalarUint1(x18), x11, x3) + var x21 uint64 + sm2p256scalarCmovznzU64(&x21, sm2p256scalarUint1(x18), x13, x5) + var x22 uint64 + sm2p256scalarCmovznzU64(&x22, sm2p256scalarUint1(x18), x15, x7) + out1[0] = x19 + out1[1] = x20 + out1[2] = x21 + out1[3] = x22 +} + +// sm2p256scalarSub subtracts two field elements in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// 0 ≤ eval arg2 < m +// Postconditions: +// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarSub(out1 *sm2p256scalarMontgomeryDomainFieldElement, arg1 *sm2p256scalarMontgomeryDomainFieldElement, arg2 *sm2p256scalarMontgomeryDomainFieldElement) { + var x1 uint64 + var x2 uint64 + x1, x2 = bits.Sub64(arg1[0], arg2[0], uint64(0x0)) + var x3 uint64 + var x4 uint64 + x3, x4 = bits.Sub64(arg1[1], arg2[1], uint64(sm2p256scalarUint1(x2))) + var x5 uint64 + var x6 uint64 + x5, x6 = bits.Sub64(arg1[2], arg2[2], uint64(sm2p256scalarUint1(x4))) + var x7 uint64 + var x8 uint64 + x7, x8 = bits.Sub64(arg1[3], arg2[3], uint64(sm2p256scalarUint1(x6))) + var x9 uint64 + sm2p256scalarCmovznzU64(&x9, sm2p256scalarUint1(x8), uint64(0x0), 0xffffffffffffffff) + var x10 uint64 + var x11 uint64 + x10, x11 = bits.Add64(x1, (x9 & 0x53bbf40939d54123), uint64(0x0)) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(x3, (x9 & 0x7203df6b21c6052b), uint64(sm2p256scalarUint1(x11))) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(x5, x9, uint64(sm2p256scalarUint1(x13))) + var x16 uint64 + x16, _ = bits.Add64(x7, (x9 & 0xfffffffeffffffff), uint64(sm2p256scalarUint1(x15))) + out1[0] = x10 + out1[1] = x12 + out1[2] = x14 + out1[3] = x16 +} + +// sm2p256scalarSetOne returns the field element one in the Montgomery domain. +// +// Postconditions: +// eval (from_montgomery out1) mod m = 1 mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarSetOne(out1 *sm2p256scalarMontgomeryDomainFieldElement) { + out1[0] = 0xac440bf6c62abedd + out1[1] = 0x8dfc2094de39fad4 + out1[2] = uint64(0x0) + out1[3] = 0x100000000 +} + +// sm2p256scalarFromMontgomery translates a field element out of the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarFromMontgomery(out1 *sm2p256scalarNonMontgomeryDomainFieldElement, arg1 *sm2p256scalarMontgomeryDomainFieldElement) { + x1 := arg1[0] + var x2 uint64 + _, x2 = bits.Mul64(x1, 0x327f9e8872350975) + var x4 uint64 + var x5 uint64 + x5, x4 = bits.Mul64(x2, 0xfffffffeffffffff) + var x6 uint64 + var x7 uint64 + x7, x6 = bits.Mul64(x2, 0xffffffffffffffff) + var x8 uint64 + var x9 uint64 + x9, x8 = bits.Mul64(x2, 0x7203df6b21c6052b) + var x10 uint64 + var x11 uint64 + x11, x10 = bits.Mul64(x2, 0x53bbf40939d54123) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(x11, x8, uint64(0x0)) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(x9, x6, uint64(sm2p256scalarUint1(x13))) + var x16 uint64 + var x17 uint64 + x16, x17 = bits.Add64(x7, x4, uint64(sm2p256scalarUint1(x15))) + var x19 uint64 + _, x19 = bits.Add64(x1, x10, uint64(0x0)) + var x20 uint64 + var x21 uint64 + x20, x21 = bits.Add64(uint64(0x0), x12, uint64(sm2p256scalarUint1(x19))) + var x22 uint64 + var x23 uint64 + x22, x23 = bits.Add64(uint64(0x0), x14, uint64(sm2p256scalarUint1(x21))) + var x24 uint64 + var x25 uint64 + x24, x25 = bits.Add64(uint64(0x0), x16, uint64(sm2p256scalarUint1(x23))) + var x26 uint64 + var x27 uint64 + x26, x27 = bits.Add64(x20, arg1[1], uint64(0x0)) + var x28 uint64 + var x29 uint64 + x28, x29 = bits.Add64(x22, uint64(0x0), uint64(sm2p256scalarUint1(x27))) + var x30 uint64 + var x31 uint64 + x30, x31 = bits.Add64(x24, uint64(0x0), uint64(sm2p256scalarUint1(x29))) + var x32 uint64 + _, x32 = bits.Mul64(x26, 0x327f9e8872350975) + var x34 uint64 + var x35 uint64 + x35, x34 = bits.Mul64(x32, 0xfffffffeffffffff) + var x36 uint64 + var x37 uint64 + x37, x36 = bits.Mul64(x32, 0xffffffffffffffff) + var x38 uint64 + var x39 uint64 + x39, x38 = bits.Mul64(x32, 0x7203df6b21c6052b) + var x40 uint64 + var x41 uint64 + x41, x40 = bits.Mul64(x32, 0x53bbf40939d54123) + var x42 uint64 + var x43 uint64 + x42, x43 = bits.Add64(x41, x38, uint64(0x0)) + var x44 uint64 + var x45 uint64 + x44, x45 = bits.Add64(x39, x36, uint64(sm2p256scalarUint1(x43))) + var x46 uint64 + var x47 uint64 + x46, x47 = bits.Add64(x37, x34, uint64(sm2p256scalarUint1(x45))) + var x49 uint64 + _, x49 = bits.Add64(x26, x40, uint64(0x0)) + var x50 uint64 + var x51 uint64 + x50, x51 = bits.Add64(x28, x42, uint64(sm2p256scalarUint1(x49))) + var x52 uint64 + var x53 uint64 + x52, x53 = bits.Add64(x30, x44, uint64(sm2p256scalarUint1(x51))) + var x54 uint64 + var x55 uint64 + x54, x55 = bits.Add64((uint64(sm2p256scalarUint1(x31)) + (uint64(sm2p256scalarUint1(x25)) + (uint64(sm2p256scalarUint1(x17)) + x5))), x46, uint64(sm2p256scalarUint1(x53))) + var x56 uint64 + var x57 uint64 + x56, x57 = bits.Add64(x50, arg1[2], uint64(0x0)) + var x58 uint64 + var x59 uint64 + x58, x59 = bits.Add64(x52, uint64(0x0), uint64(sm2p256scalarUint1(x57))) + var x60 uint64 + var x61 uint64 + x60, x61 = bits.Add64(x54, uint64(0x0), uint64(sm2p256scalarUint1(x59))) + var x62 uint64 + _, x62 = bits.Mul64(x56, 0x327f9e8872350975) + var x64 uint64 + var x65 uint64 + x65, x64 = bits.Mul64(x62, 0xfffffffeffffffff) + var x66 uint64 + var x67 uint64 + x67, x66 = bits.Mul64(x62, 0xffffffffffffffff) + var x68 uint64 + var x69 uint64 + x69, x68 = bits.Mul64(x62, 0x7203df6b21c6052b) + var x70 uint64 + var x71 uint64 + x71, x70 = bits.Mul64(x62, 0x53bbf40939d54123) + var x72 uint64 + var x73 uint64 + x72, x73 = bits.Add64(x71, x68, uint64(0x0)) + var x74 uint64 + var x75 uint64 + x74, x75 = bits.Add64(x69, x66, uint64(sm2p256scalarUint1(x73))) + var x76 uint64 + var x77 uint64 + x76, x77 = bits.Add64(x67, x64, uint64(sm2p256scalarUint1(x75))) + var x79 uint64 + _, x79 = bits.Add64(x56, x70, uint64(0x0)) + var x80 uint64 + var x81 uint64 + x80, x81 = bits.Add64(x58, x72, uint64(sm2p256scalarUint1(x79))) + var x82 uint64 + var x83 uint64 + x82, x83 = bits.Add64(x60, x74, uint64(sm2p256scalarUint1(x81))) + var x84 uint64 + var x85 uint64 + x84, x85 = bits.Add64((uint64(sm2p256scalarUint1(x61)) + (uint64(sm2p256scalarUint1(x55)) + (uint64(sm2p256scalarUint1(x47)) + x35))), x76, uint64(sm2p256scalarUint1(x83))) + var x86 uint64 + var x87 uint64 + x86, x87 = bits.Add64(x80, arg1[3], uint64(0x0)) + var x88 uint64 + var x89 uint64 + x88, x89 = bits.Add64(x82, uint64(0x0), uint64(sm2p256scalarUint1(x87))) + var x90 uint64 + var x91 uint64 + x90, x91 = bits.Add64(x84, uint64(0x0), uint64(sm2p256scalarUint1(x89))) + var x92 uint64 + _, x92 = bits.Mul64(x86, 0x327f9e8872350975) + var x94 uint64 + var x95 uint64 + x95, x94 = bits.Mul64(x92, 0xfffffffeffffffff) + var x96 uint64 + var x97 uint64 + x97, x96 = bits.Mul64(x92, 0xffffffffffffffff) + var x98 uint64 + var x99 uint64 + x99, x98 = bits.Mul64(x92, 0x7203df6b21c6052b) + var x100 uint64 + var x101 uint64 + x101, x100 = bits.Mul64(x92, 0x53bbf40939d54123) + var x102 uint64 + var x103 uint64 + x102, x103 = bits.Add64(x101, x98, uint64(0x0)) + var x104 uint64 + var x105 uint64 + x104, x105 = bits.Add64(x99, x96, uint64(sm2p256scalarUint1(x103))) + var x106 uint64 + var x107 uint64 + x106, x107 = bits.Add64(x97, x94, uint64(sm2p256scalarUint1(x105))) + var x109 uint64 + _, x109 = bits.Add64(x86, x100, uint64(0x0)) + var x110 uint64 + var x111 uint64 + x110, x111 = bits.Add64(x88, x102, uint64(sm2p256scalarUint1(x109))) + var x112 uint64 + var x113 uint64 + x112, x113 = bits.Add64(x90, x104, uint64(sm2p256scalarUint1(x111))) + var x114 uint64 + var x115 uint64 + x114, x115 = bits.Add64((uint64(sm2p256scalarUint1(x91)) + (uint64(sm2p256scalarUint1(x85)) + (uint64(sm2p256scalarUint1(x77)) + x65))), x106, uint64(sm2p256scalarUint1(x113))) + x116 := (uint64(sm2p256scalarUint1(x115)) + (uint64(sm2p256scalarUint1(x107)) + x95)) + var x117 uint64 + var x118 uint64 + x117, x118 = bits.Sub64(x110, 0x53bbf40939d54123, uint64(0x0)) + var x119 uint64 + var x120 uint64 + x119, x120 = bits.Sub64(x112, 0x7203df6b21c6052b, uint64(sm2p256scalarUint1(x118))) + var x121 uint64 + var x122 uint64 + x121, x122 = bits.Sub64(x114, 0xffffffffffffffff, uint64(sm2p256scalarUint1(x120))) + var x123 uint64 + var x124 uint64 + x123, x124 = bits.Sub64(x116, 0xfffffffeffffffff, uint64(sm2p256scalarUint1(x122))) + var x126 uint64 + _, x126 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(sm2p256scalarUint1(x124))) + var x127 uint64 + sm2p256scalarCmovznzU64(&x127, sm2p256scalarUint1(x126), x117, x110) + var x128 uint64 + sm2p256scalarCmovznzU64(&x128, sm2p256scalarUint1(x126), x119, x112) + var x129 uint64 + sm2p256scalarCmovznzU64(&x129, sm2p256scalarUint1(x126), x121, x114) + var x130 uint64 + sm2p256scalarCmovznzU64(&x130, sm2p256scalarUint1(x126), x123, x116) + out1[0] = x127 + out1[1] = x128 + out1[2] = x129 + out1[3] = x130 +} + +// sm2p256scalarToMontgomery translates a field element into the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval (from_montgomery out1) mod m = eval arg1 mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarToMontgomery(out1 *sm2p256scalarMontgomeryDomainFieldElement, arg1 *sm2p256scalarNonMontgomeryDomainFieldElement) { + x1 := arg1[1] + x2 := arg1[2] + x3 := arg1[3] + x4 := arg1[0] + var x5 uint64 + var x6 uint64 + x6, x5 = bits.Mul64(x4, 0x1eb5e412a22b3d3b) + var x7 uint64 + var x8 uint64 + x8, x7 = bits.Mul64(x4, 0x620fc84c3affe0d4) + var x9 uint64 + var x10 uint64 + x10, x9 = bits.Mul64(x4, 0x3464504ade6fa2fa) + var x11 uint64 + var x12 uint64 + x12, x11 = bits.Mul64(x4, 0x901192af7c114f20) + var x13 uint64 + var x14 uint64 + x13, x14 = bits.Add64(x12, x9, uint64(0x0)) + var x15 uint64 + var x16 uint64 + x15, x16 = bits.Add64(x10, x7, uint64(sm2p256scalarUint1(x14))) + var x17 uint64 + var x18 uint64 + x17, x18 = bits.Add64(x8, x5, uint64(sm2p256scalarUint1(x16))) + var x19 uint64 + _, x19 = bits.Mul64(x11, 0x327f9e8872350975) + var x21 uint64 + var x22 uint64 + x22, x21 = bits.Mul64(x19, 0xfffffffeffffffff) + var x23 uint64 + var x24 uint64 + x24, x23 = bits.Mul64(x19, 0xffffffffffffffff) + var x25 uint64 + var x26 uint64 + x26, x25 = bits.Mul64(x19, 0x7203df6b21c6052b) + var x27 uint64 + var x28 uint64 + x28, x27 = bits.Mul64(x19, 0x53bbf40939d54123) + var x29 uint64 + var x30 uint64 + x29, x30 = bits.Add64(x28, x25, uint64(0x0)) + var x31 uint64 + var x32 uint64 + x31, x32 = bits.Add64(x26, x23, uint64(sm2p256scalarUint1(x30))) + var x33 uint64 + var x34 uint64 + x33, x34 = bits.Add64(x24, x21, uint64(sm2p256scalarUint1(x32))) + var x36 uint64 + _, x36 = bits.Add64(x11, x27, uint64(0x0)) + var x37 uint64 + var x38 uint64 + x37, x38 = bits.Add64(x13, x29, uint64(sm2p256scalarUint1(x36))) + var x39 uint64 + var x40 uint64 + x39, x40 = bits.Add64(x15, x31, uint64(sm2p256scalarUint1(x38))) + var x41 uint64 + var x42 uint64 + x41, x42 = bits.Add64(x17, x33, uint64(sm2p256scalarUint1(x40))) + var x43 uint64 + var x44 uint64 + x43, x44 = bits.Add64((uint64(sm2p256scalarUint1(x18)) + x6), (uint64(sm2p256scalarUint1(x34)) + x22), uint64(sm2p256scalarUint1(x42))) + var x45 uint64 + var x46 uint64 + x46, x45 = bits.Mul64(x1, 0x1eb5e412a22b3d3b) + var x47 uint64 + var x48 uint64 + x48, x47 = bits.Mul64(x1, 0x620fc84c3affe0d4) + var x49 uint64 + var x50 uint64 + x50, x49 = bits.Mul64(x1, 0x3464504ade6fa2fa) + var x51 uint64 + var x52 uint64 + x52, x51 = bits.Mul64(x1, 0x901192af7c114f20) + var x53 uint64 + var x54 uint64 + x53, x54 = bits.Add64(x52, x49, uint64(0x0)) + var x55 uint64 + var x56 uint64 + x55, x56 = bits.Add64(x50, x47, uint64(sm2p256scalarUint1(x54))) + var x57 uint64 + var x58 uint64 + x57, x58 = bits.Add64(x48, x45, uint64(sm2p256scalarUint1(x56))) + var x59 uint64 + var x60 uint64 + x59, x60 = bits.Add64(x37, x51, uint64(0x0)) + var x61 uint64 + var x62 uint64 + x61, x62 = bits.Add64(x39, x53, uint64(sm2p256scalarUint1(x60))) + var x63 uint64 + var x64 uint64 + x63, x64 = bits.Add64(x41, x55, uint64(sm2p256scalarUint1(x62))) + var x65 uint64 + var x66 uint64 + x65, x66 = bits.Add64(x43, x57, uint64(sm2p256scalarUint1(x64))) + var x67 uint64 + _, x67 = bits.Mul64(x59, 0x327f9e8872350975) + var x69 uint64 + var x70 uint64 + x70, x69 = bits.Mul64(x67, 0xfffffffeffffffff) + var x71 uint64 + var x72 uint64 + x72, x71 = bits.Mul64(x67, 0xffffffffffffffff) + var x73 uint64 + var x74 uint64 + x74, x73 = bits.Mul64(x67, 0x7203df6b21c6052b) + var x75 uint64 + var x76 uint64 + x76, x75 = bits.Mul64(x67, 0x53bbf40939d54123) + var x77 uint64 + var x78 uint64 + x77, x78 = bits.Add64(x76, x73, uint64(0x0)) + var x79 uint64 + var x80 uint64 + x79, x80 = bits.Add64(x74, x71, uint64(sm2p256scalarUint1(x78))) + var x81 uint64 + var x82 uint64 + x81, x82 = bits.Add64(x72, x69, uint64(sm2p256scalarUint1(x80))) + var x84 uint64 + _, x84 = bits.Add64(x59, x75, uint64(0x0)) + var x85 uint64 + var x86 uint64 + x85, x86 = bits.Add64(x61, x77, uint64(sm2p256scalarUint1(x84))) + var x87 uint64 + var x88 uint64 + x87, x88 = bits.Add64(x63, x79, uint64(sm2p256scalarUint1(x86))) + var x89 uint64 + var x90 uint64 + x89, x90 = bits.Add64(x65, x81, uint64(sm2p256scalarUint1(x88))) + var x91 uint64 + var x92 uint64 + x91, x92 = bits.Add64(((uint64(sm2p256scalarUint1(x66)) + uint64(sm2p256scalarUint1(x44))) + (uint64(sm2p256scalarUint1(x58)) + x46)), (uint64(sm2p256scalarUint1(x82)) + x70), uint64(sm2p256scalarUint1(x90))) + var x93 uint64 + var x94 uint64 + x94, x93 = bits.Mul64(x2, 0x1eb5e412a22b3d3b) + var x95 uint64 + var x96 uint64 + x96, x95 = bits.Mul64(x2, 0x620fc84c3affe0d4) + var x97 uint64 + var x98 uint64 + x98, x97 = bits.Mul64(x2, 0x3464504ade6fa2fa) + var x99 uint64 + var x100 uint64 + x100, x99 = bits.Mul64(x2, 0x901192af7c114f20) + var x101 uint64 + var x102 uint64 + x101, x102 = bits.Add64(x100, x97, uint64(0x0)) + var x103 uint64 + var x104 uint64 + x103, x104 = bits.Add64(x98, x95, uint64(sm2p256scalarUint1(x102))) + var x105 uint64 + var x106 uint64 + x105, x106 = bits.Add64(x96, x93, uint64(sm2p256scalarUint1(x104))) + var x107 uint64 + var x108 uint64 + x107, x108 = bits.Add64(x85, x99, uint64(0x0)) + var x109 uint64 + var x110 uint64 + x109, x110 = bits.Add64(x87, x101, uint64(sm2p256scalarUint1(x108))) + var x111 uint64 + var x112 uint64 + x111, x112 = bits.Add64(x89, x103, uint64(sm2p256scalarUint1(x110))) + var x113 uint64 + var x114 uint64 + x113, x114 = bits.Add64(x91, x105, uint64(sm2p256scalarUint1(x112))) + var x115 uint64 + _, x115 = bits.Mul64(x107, 0x327f9e8872350975) + var x117 uint64 + var x118 uint64 + x118, x117 = bits.Mul64(x115, 0xfffffffeffffffff) + var x119 uint64 + var x120 uint64 + x120, x119 = bits.Mul64(x115, 0xffffffffffffffff) + var x121 uint64 + var x122 uint64 + x122, x121 = bits.Mul64(x115, 0x7203df6b21c6052b) + var x123 uint64 + var x124 uint64 + x124, x123 = bits.Mul64(x115, 0x53bbf40939d54123) + var x125 uint64 + var x126 uint64 + x125, x126 = bits.Add64(x124, x121, uint64(0x0)) + var x127 uint64 + var x128 uint64 + x127, x128 = bits.Add64(x122, x119, uint64(sm2p256scalarUint1(x126))) + var x129 uint64 + var x130 uint64 + x129, x130 = bits.Add64(x120, x117, uint64(sm2p256scalarUint1(x128))) + var x132 uint64 + _, x132 = bits.Add64(x107, x123, uint64(0x0)) + var x133 uint64 + var x134 uint64 + x133, x134 = bits.Add64(x109, x125, uint64(sm2p256scalarUint1(x132))) + var x135 uint64 + var x136 uint64 + x135, x136 = bits.Add64(x111, x127, uint64(sm2p256scalarUint1(x134))) + var x137 uint64 + var x138 uint64 + x137, x138 = bits.Add64(x113, x129, uint64(sm2p256scalarUint1(x136))) + var x139 uint64 + var x140 uint64 + x139, x140 = bits.Add64(((uint64(sm2p256scalarUint1(x114)) + uint64(sm2p256scalarUint1(x92))) + (uint64(sm2p256scalarUint1(x106)) + x94)), (uint64(sm2p256scalarUint1(x130)) + x118), uint64(sm2p256scalarUint1(x138))) + var x141 uint64 + var x142 uint64 + x142, x141 = bits.Mul64(x3, 0x1eb5e412a22b3d3b) + var x143 uint64 + var x144 uint64 + x144, x143 = bits.Mul64(x3, 0x620fc84c3affe0d4) + var x145 uint64 + var x146 uint64 + x146, x145 = bits.Mul64(x3, 0x3464504ade6fa2fa) + var x147 uint64 + var x148 uint64 + x148, x147 = bits.Mul64(x3, 0x901192af7c114f20) + var x149 uint64 + var x150 uint64 + x149, x150 = bits.Add64(x148, x145, uint64(0x0)) + var x151 uint64 + var x152 uint64 + x151, x152 = bits.Add64(x146, x143, uint64(sm2p256scalarUint1(x150))) + var x153 uint64 + var x154 uint64 + x153, x154 = bits.Add64(x144, x141, uint64(sm2p256scalarUint1(x152))) + var x155 uint64 + var x156 uint64 + x155, x156 = bits.Add64(x133, x147, uint64(0x0)) + var x157 uint64 + var x158 uint64 + x157, x158 = bits.Add64(x135, x149, uint64(sm2p256scalarUint1(x156))) + var x159 uint64 + var x160 uint64 + x159, x160 = bits.Add64(x137, x151, uint64(sm2p256scalarUint1(x158))) + var x161 uint64 + var x162 uint64 + x161, x162 = bits.Add64(x139, x153, uint64(sm2p256scalarUint1(x160))) + var x163 uint64 + _, x163 = bits.Mul64(x155, 0x327f9e8872350975) + var x165 uint64 + var x166 uint64 + x166, x165 = bits.Mul64(x163, 0xfffffffeffffffff) + var x167 uint64 + var x168 uint64 + x168, x167 = bits.Mul64(x163, 0xffffffffffffffff) + var x169 uint64 + var x170 uint64 + x170, x169 = bits.Mul64(x163, 0x7203df6b21c6052b) + var x171 uint64 + var x172 uint64 + x172, x171 = bits.Mul64(x163, 0x53bbf40939d54123) + var x173 uint64 + var x174 uint64 + x173, x174 = bits.Add64(x172, x169, uint64(0x0)) + var x175 uint64 + var x176 uint64 + x175, x176 = bits.Add64(x170, x167, uint64(sm2p256scalarUint1(x174))) + var x177 uint64 + var x178 uint64 + x177, x178 = bits.Add64(x168, x165, uint64(sm2p256scalarUint1(x176))) + var x180 uint64 + _, x180 = bits.Add64(x155, x171, uint64(0x0)) + var x181 uint64 + var x182 uint64 + x181, x182 = bits.Add64(x157, x173, uint64(sm2p256scalarUint1(x180))) + var x183 uint64 + var x184 uint64 + x183, x184 = bits.Add64(x159, x175, uint64(sm2p256scalarUint1(x182))) + var x185 uint64 + var x186 uint64 + x185, x186 = bits.Add64(x161, x177, uint64(sm2p256scalarUint1(x184))) + var x187 uint64 + var x188 uint64 + x187, x188 = bits.Add64(((uint64(sm2p256scalarUint1(x162)) + uint64(sm2p256scalarUint1(x140))) + (uint64(sm2p256scalarUint1(x154)) + x142)), (uint64(sm2p256scalarUint1(x178)) + x166), uint64(sm2p256scalarUint1(x186))) + var x189 uint64 + var x190 uint64 + x189, x190 = bits.Sub64(x181, 0x53bbf40939d54123, uint64(0x0)) + var x191 uint64 + var x192 uint64 + x191, x192 = bits.Sub64(x183, 0x7203df6b21c6052b, uint64(sm2p256scalarUint1(x190))) + var x193 uint64 + var x194 uint64 + x193, x194 = bits.Sub64(x185, 0xffffffffffffffff, uint64(sm2p256scalarUint1(x192))) + var x195 uint64 + var x196 uint64 + x195, x196 = bits.Sub64(x187, 0xfffffffeffffffff, uint64(sm2p256scalarUint1(x194))) + var x198 uint64 + _, x198 = bits.Sub64(uint64(sm2p256scalarUint1(x188)), uint64(0x0), uint64(sm2p256scalarUint1(x196))) + var x199 uint64 + sm2p256scalarCmovznzU64(&x199, sm2p256scalarUint1(x198), x189, x181) + var x200 uint64 + sm2p256scalarCmovznzU64(&x200, sm2p256scalarUint1(x198), x191, x183) + var x201 uint64 + sm2p256scalarCmovznzU64(&x201, sm2p256scalarUint1(x198), x193, x185) + var x202 uint64 + sm2p256scalarCmovznzU64(&x202, sm2p256scalarUint1(x198), x195, x187) + out1[0] = x199 + out1[1] = x200 + out1[2] = x201 + out1[3] = x202 +} + +// sm2p256scalarSelectznz is a multi-limb conditional select. +// +// Postconditions: +// out1 = (if arg1 = 0 then arg2 else arg3) +// +// Input Bounds: +// arg1: [0x0 ~> 0x1] +// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// Output Bounds: +// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256scalarSelectznz(out1 *[4]uint64, arg1 sm2p256scalarUint1, arg2 *[4]uint64, arg3 *[4]uint64) { + var x1 uint64 + sm2p256scalarCmovznzU64(&x1, arg1, arg2[0], arg3[0]) + var x2 uint64 + sm2p256scalarCmovznzU64(&x2, arg1, arg2[1], arg3[1]) + var x3 uint64 + sm2p256scalarCmovznzU64(&x3, arg1, arg2[2], arg3[2]) + var x4 uint64 + sm2p256scalarCmovznzU64(&x4, arg1, arg2[3], arg3[3]) + out1[0] = x1 + out1[1] = x2 + out1[2] = x3 + out1[3] = x4 +} + +// sm2p256scalarToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +// +// Input Bounds: +// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// Output Bounds: +// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +func sm2p256scalarToBytes(out1 *[32]uint8, arg1 *[4]uint64) { + x1 := arg1[3] + x2 := arg1[2] + x3 := arg1[1] + x4 := arg1[0] + x5 := (uint8(x4) & 0xff) + x6 := (x4 >> 8) + x7 := (uint8(x6) & 0xff) + x8 := (x6 >> 8) + x9 := (uint8(x8) & 0xff) + x10 := (x8 >> 8) + x11 := (uint8(x10) & 0xff) + x12 := (x10 >> 8) + x13 := (uint8(x12) & 0xff) + x14 := (x12 >> 8) + x15 := (uint8(x14) & 0xff) + x16 := (x14 >> 8) + x17 := (uint8(x16) & 0xff) + x18 := uint8((x16 >> 8)) + x19 := (uint8(x3) & 0xff) + x20 := (x3 >> 8) + x21 := (uint8(x20) & 0xff) + x22 := (x20 >> 8) + x23 := (uint8(x22) & 0xff) + x24 := (x22 >> 8) + x25 := (uint8(x24) & 0xff) + x26 := (x24 >> 8) + x27 := (uint8(x26) & 0xff) + x28 := (x26 >> 8) + x29 := (uint8(x28) & 0xff) + x30 := (x28 >> 8) + x31 := (uint8(x30) & 0xff) + x32 := uint8((x30 >> 8)) + x33 := (uint8(x2) & 0xff) + x34 := (x2 >> 8) + x35 := (uint8(x34) & 0xff) + x36 := (x34 >> 8) + x37 := (uint8(x36) & 0xff) + x38 := (x36 >> 8) + x39 := (uint8(x38) & 0xff) + x40 := (x38 >> 8) + x41 := (uint8(x40) & 0xff) + x42 := (x40 >> 8) + x43 := (uint8(x42) & 0xff) + x44 := (x42 >> 8) + x45 := (uint8(x44) & 0xff) + x46 := uint8((x44 >> 8)) + x47 := (uint8(x1) & 0xff) + x48 := (x1 >> 8) + x49 := (uint8(x48) & 0xff) + x50 := (x48 >> 8) + x51 := (uint8(x50) & 0xff) + x52 := (x50 >> 8) + x53 := (uint8(x52) & 0xff) + x54 := (x52 >> 8) + x55 := (uint8(x54) & 0xff) + x56 := (x54 >> 8) + x57 := (uint8(x56) & 0xff) + x58 := (x56 >> 8) + x59 := (uint8(x58) & 0xff) + x60 := uint8((x58 >> 8)) + out1[0] = x5 + out1[1] = x7 + out1[2] = x9 + out1[3] = x11 + out1[4] = x13 + out1[5] = x15 + out1[6] = x17 + out1[7] = x18 + out1[8] = x19 + out1[9] = x21 + out1[10] = x23 + out1[11] = x25 + out1[12] = x27 + out1[13] = x29 + out1[14] = x31 + out1[15] = x32 + out1[16] = x33 + out1[17] = x35 + out1[18] = x37 + out1[19] = x39 + out1[20] = x41 + out1[21] = x43 + out1[22] = x45 + out1[23] = x46 + out1[24] = x47 + out1[25] = x49 + out1[26] = x51 + out1[27] = x53 + out1[28] = x55 + out1[29] = x57 + out1[30] = x59 + out1[31] = x60 +} + +// sm2p256scalarFromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +// +// Preconditions: +// 0 ≤ bytes_eval arg1 < m +// Postconditions: +// eval out1 mod m = bytes_eval arg1 mod m +// 0 ≤ eval out1 < m +// +// Input Bounds: +// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +// Output Bounds: +// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256scalarFromBytes(out1 *[4]uint64, arg1 *[32]uint8) { + x1 := (uint64(arg1[31]) << 56) + x2 := (uint64(arg1[30]) << 48) + x3 := (uint64(arg1[29]) << 40) + x4 := (uint64(arg1[28]) << 32) + x5 := (uint64(arg1[27]) << 24) + x6 := (uint64(arg1[26]) << 16) + x7 := (uint64(arg1[25]) << 8) + x8 := arg1[24] + x9 := (uint64(arg1[23]) << 56) + x10 := (uint64(arg1[22]) << 48) + x11 := (uint64(arg1[21]) << 40) + x12 := (uint64(arg1[20]) << 32) + x13 := (uint64(arg1[19]) << 24) + x14 := (uint64(arg1[18]) << 16) + x15 := (uint64(arg1[17]) << 8) + x16 := arg1[16] + x17 := (uint64(arg1[15]) << 56) + x18 := (uint64(arg1[14]) << 48) + x19 := (uint64(arg1[13]) << 40) + x20 := (uint64(arg1[12]) << 32) + x21 := (uint64(arg1[11]) << 24) + x22 := (uint64(arg1[10]) << 16) + x23 := (uint64(arg1[9]) << 8) + x24 := arg1[8] + x25 := (uint64(arg1[7]) << 56) + x26 := (uint64(arg1[6]) << 48) + x27 := (uint64(arg1[5]) << 40) + x28 := (uint64(arg1[4]) << 32) + x29 := (uint64(arg1[3]) << 24) + x30 := (uint64(arg1[2]) << 16) + x31 := (uint64(arg1[1]) << 8) + x32 := arg1[0] + x33 := (x31 + uint64(x32)) + x34 := (x30 + x33) + x35 := (x29 + x34) + x36 := (x28 + x35) + x37 := (x27 + x36) + x38 := (x26 + x37) + x39 := (x25 + x38) + x40 := (x23 + uint64(x24)) + x41 := (x22 + x40) + x42 := (x21 + x41) + x43 := (x20 + x42) + x44 := (x19 + x43) + x45 := (x18 + x44) + x46 := (x17 + x45) + x47 := (x15 + uint64(x16)) + x48 := (x14 + x47) + x49 := (x13 + x48) + x50 := (x12 + x49) + x51 := (x11 + x50) + x52 := (x10 + x51) + x53 := (x9 + x52) + x54 := (x7 + uint64(x8)) + x55 := (x6 + x54) + x56 := (x5 + x55) + x57 := (x4 + x56) + x58 := (x3 + x57) + x59 := (x2 + x58) + x60 := (x1 + x59) + out1[0] = x39 + out1[1] = x46 + out1[2] = x53 + out1[3] = x60 +} + +// sm2p256scalarNonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +// +// Input Bounds: +// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// Output Bounds: +// out1: [0x0 ~> 0xffffffffffffffff] +func sm2p256scalarNonzero(out1 *uint64, arg1 *[4]uint64) { + x1 := (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))) + *out1 = x1 +} + +// sm2p256scalarOpp negates a field element in the Montgomery domain. +// +// Preconditions: +// 0 ≤ eval arg1 < m +// Postconditions: +// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +// 0 ≤ eval out1 < m +// +func sm2p256scalarOpp(out1 *sm2p256scalarMontgomeryDomainFieldElement, arg1 *sm2p256scalarMontgomeryDomainFieldElement) { + var x1 uint64 + var x2 uint64 + x1, x2 = bits.Sub64(uint64(0x0), arg1[0], uint64(0x0)) + var x3 uint64 + var x4 uint64 + x3, x4 = bits.Sub64(uint64(0x0), arg1[1], uint64(sm2p256scalarUint1(x2))) + var x5 uint64 + var x6 uint64 + x5, x6 = bits.Sub64(uint64(0x0), arg1[2], uint64(sm2p256scalarUint1(x4))) + var x7 uint64 + var x8 uint64 + x7, x8 = bits.Sub64(uint64(0x0), arg1[3], uint64(sm2p256scalarUint1(x6))) + var x9 uint64 + sm2p256scalarCmovznzU64(&x9, sm2p256scalarUint1(x8), uint64(0x0), 0xffffffffffffffff) + var x10 uint64 + var x11 uint64 + x10, x11 = bits.Add64(x1, (x9 & 0x53bbf40939d54123), uint64(0x0)) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(x3, (x9 & 0x7203df6b21c6052b), uint64(sm2p256scalarUint1(x11))) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(x5, x9, uint64(sm2p256scalarUint1(x13))) + var x16 uint64 + x16, _ = bits.Add64(x7, (x9 & 0xfffffffeffffffff), uint64(sm2p256scalarUint1(x15))) + out1[0] = x10 + out1[1] = x12 + out1[2] = x14 + out1[3] = x16 +} + +// sm2p256scalarMsat returns the saturated representation of the prime modulus. +// +// Postconditions: +// twos_complement_eval out1 = m +// 0 ≤ eval out1 < m +// +// Output Bounds: +// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256scalarMsat(out1 *[5]uint64) { + out1[0] = 0x53bbf40939d54123 + out1[1] = 0x7203df6b21c6052b + out1[2] = 0xffffffffffffffff + out1[3] = 0xfffffffeffffffff + out1[4] = uint64(0x0) +} + +// sm2p256scalarDivstep computes a divstep. +// +// Preconditions: +// 0 ≤ eval arg4 < m +// 0 ≤ eval arg5 < m +// Postconditions: +// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +// 0 ≤ eval out5 < m +// 0 ≤ eval out5 < m +// 0 ≤ eval out2 < m +// 0 ≤ eval out3 < m +// +// Input Bounds: +// arg1: [0x0 ~> 0xffffffffffffffff] +// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// Output Bounds: +// out1: [0x0 ~> 0xffffffffffffffff] +// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256scalarDivstep(out1 *uint64, out2 *[5]uint64, out3 *[5]uint64, out4 *[4]uint64, out5 *[4]uint64, arg1 uint64, arg2 *[5]uint64, arg3 *[5]uint64, arg4 *[4]uint64, arg5 *[4]uint64) { + var x1 uint64 + x1, _ = bits.Add64((^arg1), uint64(0x1), uint64(0x0)) + x3 := (sm2p256scalarUint1((x1 >> 63)) & (sm2p256scalarUint1(arg3[0]) & 0x1)) + var x4 uint64 + x4, _ = bits.Add64((^arg1), uint64(0x1), uint64(0x0)) + var x6 uint64 + sm2p256scalarCmovznzU64(&x6, x3, arg1, x4) + var x7 uint64 + sm2p256scalarCmovznzU64(&x7, x3, arg2[0], arg3[0]) + var x8 uint64 + sm2p256scalarCmovznzU64(&x8, x3, arg2[1], arg3[1]) + var x9 uint64 + sm2p256scalarCmovznzU64(&x9, x3, arg2[2], arg3[2]) + var x10 uint64 + sm2p256scalarCmovznzU64(&x10, x3, arg2[3], arg3[3]) + var x11 uint64 + sm2p256scalarCmovznzU64(&x11, x3, arg2[4], arg3[4]) + var x12 uint64 + var x13 uint64 + x12, x13 = bits.Add64(uint64(0x1), (^arg2[0]), uint64(0x0)) + var x14 uint64 + var x15 uint64 + x14, x15 = bits.Add64(uint64(0x0), (^arg2[1]), uint64(sm2p256scalarUint1(x13))) + var x16 uint64 + var x17 uint64 + x16, x17 = bits.Add64(uint64(0x0), (^arg2[2]), uint64(sm2p256scalarUint1(x15))) + var x18 uint64 + var x19 uint64 + x18, x19 = bits.Add64(uint64(0x0), (^arg2[3]), uint64(sm2p256scalarUint1(x17))) + var x20 uint64 + x20, _ = bits.Add64(uint64(0x0), (^arg2[4]), uint64(sm2p256scalarUint1(x19))) + var x22 uint64 + sm2p256scalarCmovznzU64(&x22, x3, arg3[0], x12) + var x23 uint64 + sm2p256scalarCmovznzU64(&x23, x3, arg3[1], x14) + var x24 uint64 + sm2p256scalarCmovznzU64(&x24, x3, arg3[2], x16) + var x25 uint64 + sm2p256scalarCmovznzU64(&x25, x3, arg3[3], x18) + var x26 uint64 + sm2p256scalarCmovznzU64(&x26, x3, arg3[4], x20) + var x27 uint64 + sm2p256scalarCmovznzU64(&x27, x3, arg4[0], arg5[0]) + var x28 uint64 + sm2p256scalarCmovznzU64(&x28, x3, arg4[1], arg5[1]) + var x29 uint64 + sm2p256scalarCmovznzU64(&x29, x3, arg4[2], arg5[2]) + var x30 uint64 + sm2p256scalarCmovznzU64(&x30, x3, arg4[3], arg5[3]) + var x31 uint64 + var x32 uint64 + x31, x32 = bits.Add64(x27, x27, uint64(0x0)) + var x33 uint64 + var x34 uint64 + x33, x34 = bits.Add64(x28, x28, uint64(sm2p256scalarUint1(x32))) + var x35 uint64 + var x36 uint64 + x35, x36 = bits.Add64(x29, x29, uint64(sm2p256scalarUint1(x34))) + var x37 uint64 + var x38 uint64 + x37, x38 = bits.Add64(x30, x30, uint64(sm2p256scalarUint1(x36))) + var x39 uint64 + var x40 uint64 + x39, x40 = bits.Sub64(x31, 0x53bbf40939d54123, uint64(0x0)) + var x41 uint64 + var x42 uint64 + x41, x42 = bits.Sub64(x33, 0x7203df6b21c6052b, uint64(sm2p256scalarUint1(x40))) + var x43 uint64 + var x44 uint64 + x43, x44 = bits.Sub64(x35, 0xffffffffffffffff, uint64(sm2p256scalarUint1(x42))) + var x45 uint64 + var x46 uint64 + x45, x46 = bits.Sub64(x37, 0xfffffffeffffffff, uint64(sm2p256scalarUint1(x44))) + var x48 uint64 + _, x48 = bits.Sub64(uint64(sm2p256scalarUint1(x38)), uint64(0x0), uint64(sm2p256scalarUint1(x46))) + x49 := arg4[3] + x50 := arg4[2] + x51 := arg4[1] + x52 := arg4[0] + var x53 uint64 + var x54 uint64 + x53, x54 = bits.Sub64(uint64(0x0), x52, uint64(0x0)) + var x55 uint64 + var x56 uint64 + x55, x56 = bits.Sub64(uint64(0x0), x51, uint64(sm2p256scalarUint1(x54))) + var x57 uint64 + var x58 uint64 + x57, x58 = bits.Sub64(uint64(0x0), x50, uint64(sm2p256scalarUint1(x56))) + var x59 uint64 + var x60 uint64 + x59, x60 = bits.Sub64(uint64(0x0), x49, uint64(sm2p256scalarUint1(x58))) + var x61 uint64 + sm2p256scalarCmovznzU64(&x61, sm2p256scalarUint1(x60), uint64(0x0), 0xffffffffffffffff) + var x62 uint64 + var x63 uint64 + x62, x63 = bits.Add64(x53, (x61 & 0x53bbf40939d54123), uint64(0x0)) + var x64 uint64 + var x65 uint64 + x64, x65 = bits.Add64(x55, (x61 & 0x7203df6b21c6052b), uint64(sm2p256scalarUint1(x63))) + var x66 uint64 + var x67 uint64 + x66, x67 = bits.Add64(x57, x61, uint64(sm2p256scalarUint1(x65))) + var x68 uint64 + x68, _ = bits.Add64(x59, (x61 & 0xfffffffeffffffff), uint64(sm2p256scalarUint1(x67))) + var x70 uint64 + sm2p256scalarCmovznzU64(&x70, x3, arg5[0], x62) + var x71 uint64 + sm2p256scalarCmovznzU64(&x71, x3, arg5[1], x64) + var x72 uint64 + sm2p256scalarCmovznzU64(&x72, x3, arg5[2], x66) + var x73 uint64 + sm2p256scalarCmovznzU64(&x73, x3, arg5[3], x68) + x74 := (sm2p256scalarUint1(x22) & 0x1) + var x75 uint64 + sm2p256scalarCmovznzU64(&x75, x74, uint64(0x0), x7) + var x76 uint64 + sm2p256scalarCmovznzU64(&x76, x74, uint64(0x0), x8) + var x77 uint64 + sm2p256scalarCmovznzU64(&x77, x74, uint64(0x0), x9) + var x78 uint64 + sm2p256scalarCmovznzU64(&x78, x74, uint64(0x0), x10) + var x79 uint64 + sm2p256scalarCmovznzU64(&x79, x74, uint64(0x0), x11) + var x80 uint64 + var x81 uint64 + x80, x81 = bits.Add64(x22, x75, uint64(0x0)) + var x82 uint64 + var x83 uint64 + x82, x83 = bits.Add64(x23, x76, uint64(sm2p256scalarUint1(x81))) + var x84 uint64 + var x85 uint64 + x84, x85 = bits.Add64(x24, x77, uint64(sm2p256scalarUint1(x83))) + var x86 uint64 + var x87 uint64 + x86, x87 = bits.Add64(x25, x78, uint64(sm2p256scalarUint1(x85))) + var x88 uint64 + x88, _ = bits.Add64(x26, x79, uint64(sm2p256scalarUint1(x87))) + var x90 uint64 + sm2p256scalarCmovznzU64(&x90, x74, uint64(0x0), x27) + var x91 uint64 + sm2p256scalarCmovznzU64(&x91, x74, uint64(0x0), x28) + var x92 uint64 + sm2p256scalarCmovznzU64(&x92, x74, uint64(0x0), x29) + var x93 uint64 + sm2p256scalarCmovznzU64(&x93, x74, uint64(0x0), x30) + var x94 uint64 + var x95 uint64 + x94, x95 = bits.Add64(x70, x90, uint64(0x0)) + var x96 uint64 + var x97 uint64 + x96, x97 = bits.Add64(x71, x91, uint64(sm2p256scalarUint1(x95))) + var x98 uint64 + var x99 uint64 + x98, x99 = bits.Add64(x72, x92, uint64(sm2p256scalarUint1(x97))) + var x100 uint64 + var x101 uint64 + x100, x101 = bits.Add64(x73, x93, uint64(sm2p256scalarUint1(x99))) + var x102 uint64 + var x103 uint64 + x102, x103 = bits.Sub64(x94, 0x53bbf40939d54123, uint64(0x0)) + var x104 uint64 + var x105 uint64 + x104, x105 = bits.Sub64(x96, 0x7203df6b21c6052b, uint64(sm2p256scalarUint1(x103))) + var x106 uint64 + var x107 uint64 + x106, x107 = bits.Sub64(x98, 0xffffffffffffffff, uint64(sm2p256scalarUint1(x105))) + var x108 uint64 + var x109 uint64 + x108, x109 = bits.Sub64(x100, 0xfffffffeffffffff, uint64(sm2p256scalarUint1(x107))) + var x111 uint64 + _, x111 = bits.Sub64(uint64(sm2p256scalarUint1(x101)), uint64(0x0), uint64(sm2p256scalarUint1(x109))) + var x112 uint64 + x112, _ = bits.Add64(x6, uint64(0x1), uint64(0x0)) + x114 := ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)) + x115 := ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)) + x116 := ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)) + x117 := ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)) + x118 := ((x88 & 0x8000000000000000) | (x88 >> 1)) + var x119 uint64 + sm2p256scalarCmovznzU64(&x119, sm2p256scalarUint1(x48), x39, x31) + var x120 uint64 + sm2p256scalarCmovznzU64(&x120, sm2p256scalarUint1(x48), x41, x33) + var x121 uint64 + sm2p256scalarCmovznzU64(&x121, sm2p256scalarUint1(x48), x43, x35) + var x122 uint64 + sm2p256scalarCmovznzU64(&x122, sm2p256scalarUint1(x48), x45, x37) + var x123 uint64 + sm2p256scalarCmovznzU64(&x123, sm2p256scalarUint1(x111), x102, x94) + var x124 uint64 + sm2p256scalarCmovznzU64(&x124, sm2p256scalarUint1(x111), x104, x96) + var x125 uint64 + sm2p256scalarCmovznzU64(&x125, sm2p256scalarUint1(x111), x106, x98) + var x126 uint64 + sm2p256scalarCmovznzU64(&x126, sm2p256scalarUint1(x111), x108, x100) + *out1 = x112 + out2[0] = x7 + out2[1] = x8 + out2[2] = x9 + out2[3] = x10 + out2[4] = x11 + out3[0] = x114 + out3[1] = x115 + out3[2] = x116 + out3[3] = x117 + out3[4] = x118 + out4[0] = x119 + out4[1] = x120 + out4[2] = x121 + out4[3] = x122 + out5[0] = x123 + out5[1] = x124 + out5[2] = x125 + out5[3] = x126 +} + +// sm2p256scalarDivstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +// +// Postconditions: +// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +// 0 ≤ eval out1 < m +// +// Output Bounds: +// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +func sm2p256scalarDivstepPrecomp(out1 *[4]uint64) { + out1[0] = 0x1aa32707b351756d + out1[1] = 0xabdd671e2a62fa + out1[2] = 0x49280d7dd4009a81 + out1[3] = 0xd730336ee6bb86e8 +} diff --git a/internal/sm2ec/fiat/sm2p256scalar_invert.go b/internal/sm2ec/fiat/sm2p256scalar_invert.go new file mode 100644 index 00000000..01dcf17f --- /dev/null +++ b/internal/sm2ec/fiat/sm2p256scalar_invert.go @@ -0,0 +1,201 @@ +// Copyright 2021 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. +// Code generated by addchain. DO NOT EDIT. +package fiat + +// Invert sets e = 1/x, and returns e. +// +// If x == 0, Invert returns e = 0. +func (e *SM2P256OrderElement) Invert(x *SM2P256OrderElement) *SM2P256OrderElement { + // Inversion is implemented as exponentiation with exponent p − 2. + // The sequence of 41 multiplications and 253 squarings is derived from the + // following addition chain generated with github.com/mmcloughlin/addchain v0.4.0. + // + // _10 = 2*1 + // _11 = 1 + _10 + // _100 = 1 + _11 + // _101 = 1 + _100 + // _111 = _10 + _101 + // _1001 = _10 + _111 + // _1101 = _100 + _1001 + // _1111 = _10 + _1101 + // _11110 = 2*_1111 + // _11111 = 1 + _11110 + // _111110 = 2*_11111 + // _111111 = 1 + _111110 + // _1111110 = 2*_111111 + // i20 = _1111110 << 6 + _1111110 + // x18 = i20 << 5 + _111111 + // x31 = x18 << 13 + i20 + 1 + // i42 = 2*x31 + // i44 = i42 << 2 + // i140 = ((i44 << 32 + i44) << 29 + i42) << 33 + // i150 = ((i44 + i140 + _111) << 4 + _111) << 3 + // i170 = ((1 + i150) << 11 + _1111) << 6 + _11111 + // i183 = ((i170 << 5 + _1101) << 3 + _11) << 3 + // i198 = ((1 + i183) << 7 + _111) << 5 + _11 + // i219 = ((i198 << 9 + _101) << 5 + _101) << 5 + // i231 = ((_1101 + i219) << 5 + _1001) << 4 + _1101 + // i244 = ((i231 << 2 + _11) << 7 + _111111) << 2 + // i262 = ((1 + i244) << 10 + _1001) << 5 + _111 + // i277 = ((i262 << 5 + _111) << 4 + _101) << 4 + // return ((_101 + i277) << 9 + _1001) << 5 + 1 + // + var z = new(SM2P256OrderElement).Set(e) + var t0 = new(SM2P256OrderElement) + var t1 = new(SM2P256OrderElement) + var t2 = new(SM2P256OrderElement) + var t3 = new(SM2P256OrderElement) + var t4 = new(SM2P256OrderElement) + var t5 = new(SM2P256OrderElement) + var t6 = new(SM2P256OrderElement) + var t7 = new(SM2P256OrderElement) + var t8 = new(SM2P256OrderElement) + var t9 = new(SM2P256OrderElement) + + t2.Square(x) + t3.Mul(x, t2) + t4.Mul(x, t3) + t0.Mul(x, t4) + t1.Mul(t2, t0) + z.Mul(t2, t1) + t4.Mul(t4, z) + t6.Mul(t2, t4) + t2.Square(t6) + t5.Mul(x, t2) + t2.Square(t5) + t2.Mul(x, t2) + t7.Square(t2) + t8.Square(t7) + for s := 1; s < 6; s++ { + t8.Square(t8) + } + t7.Mul(t7, t8) + t8.Square(t7) + for s := 1; s < 5; s++ { + t8.Square(t8) + } + t8.Mul(t2, t8) + for s := 0; s < 13; s++ { + t8.Square(t8) + } + t7.Mul(t7, t8) + t7.Mul(x, t7) + t8.Square(t7) + t7.Square(t8) + for s := 1; s < 2; s++ { + t7.Square(t7) + } + t9.Square(t7) + for s := 1; s < 32; s++ { + t9.Square(t9) + } + t9.Mul(t7, t9) + for s := 0; s < 29; s++ { + t9.Square(t9) + } + t8.Mul(t8, t9) + for s := 0; s < 33; s++ { + t8.Square(t8) + } + t7.Mul(t7, t8) + t7.Mul(t1, t7) + for s := 0; s < 4; s++ { + t7.Square(t7) + } + t7.Mul(t1, t7) + for s := 0; s < 3; s++ { + t7.Square(t7) + } + t7.Mul(x, t7) + for s := 0; s < 11; s++ { + t7.Square(t7) + } + t6.Mul(t6, t7) + for s := 0; s < 6; s++ { + t6.Square(t6) + } + t5.Mul(t5, t6) + for s := 0; s < 5; s++ { + t5.Square(t5) + } + t5.Mul(t4, t5) + for s := 0; s < 3; s++ { + t5.Square(t5) + } + t5.Mul(t3, t5) + for s := 0; s < 3; s++ { + t5.Square(t5) + } + t5.Mul(x, t5) + for s := 0; s < 7; s++ { + t5.Square(t5) + } + t5.Mul(t1, t5) + for s := 0; s < 5; s++ { + t5.Square(t5) + } + t5.Mul(t3, t5) + for s := 0; s < 9; s++ { + t5.Square(t5) + } + t5.Mul(t0, t5) + for s := 0; s < 5; s++ { + t5.Square(t5) + } + t5.Mul(t0, t5) + for s := 0; s < 5; s++ { + t5.Square(t5) + } + t5.Mul(t4, t5) + for s := 0; s < 5; s++ { + t5.Square(t5) + } + t5.Mul(z, t5) + for s := 0; s < 4; s++ { + t5.Square(t5) + } + t4.Mul(t4, t5) + for s := 0; s < 2; s++ { + t4.Square(t4) + } + t3.Mul(t3, t4) + for s := 0; s < 7; s++ { + t3.Square(t3) + } + t2.Mul(t2, t3) + for s := 0; s < 2; s++ { + t2.Square(t2) + } + t2.Mul(x, t2) + for s := 0; s < 10; s++ { + t2.Square(t2) + } + t2.Mul(z, t2) + for s := 0; s < 5; s++ { + t2.Square(t2) + } + t2.Mul(t1, t2) + for s := 0; s < 5; s++ { + t2.Square(t2) + } + t1.Mul(t1, t2) + for s := 0; s < 4; s++ { + t1.Square(t1) + } + t1.Mul(t0, t1) + for s := 0; s < 4; s++ { + t1.Square(t1) + } + t0.Mul(t0, t1) + for s := 0; s < 9; s++ { + t0.Square(t0) + } + z.Mul(z, t0) + for s := 0; s < 5; s++ { + z.Square(z) + } + z.Mul(x, z) + return e.Set(z) +} diff --git a/internal/sm2ec/fiat/sm2p256_order_test.go b/internal/sm2ec/fiat/sm2p256scalar_test.go similarity index 100% rename from internal/sm2ec/fiat/sm2p256_order_test.go rename to internal/sm2ec/fiat/sm2p256scalar_test.go diff --git a/internal/sm2ec/sm2p256_ord.go b/internal/sm2ec/sm2p256_ord.go index 754040b8..76a917fd 100644 --- a/internal/sm2ec/sm2p256_ord.go +++ b/internal/sm2ec/sm2p256_ord.go @@ -20,87 +20,12 @@ func P256OrdInverse(k []byte) ([]byte, error) { return nil, errors.New("invalid scalar length") } x := new(fiat.SM2P256OrderElement) - _1 := new(fiat.SM2P256OrderElement) - _, err := _1.SetBytes(k) + _, err := x.SetBytes(k) if err != nil { return nil, err } - - _11 := new(fiat.SM2P256OrderElement) - _101 := new(fiat.SM2P256OrderElement) - _111 := new(fiat.SM2P256OrderElement) - _1111 := new(fiat.SM2P256OrderElement) - _10101 := new(fiat.SM2P256OrderElement) - _101111 := new(fiat.SM2P256OrderElement) - t := new(fiat.SM2P256OrderElement) - m := new(fiat.SM2P256OrderElement) - - m.Square(_1) - _11.Mul(m, _1) - _101.Mul(m, _11) - _111.Mul(m, _101) - x.Square(_101) - _1111.Mul(_101, x) - - t.Square(x) - _10101.Mul(t, _1) - x.Square(_10101) - _101111.Mul(x, _101) - x.Mul(_10101, x) - t.Square(x) - t.Square(t) - - m.Mul(t, m) - t.Mul(t, _11) - x.Square(t) - for i := 1; i < 8; i++ { - x.Square(x) - } - m.Mul(x, m) - x.Mul(x, t) - - t.Square(x) - for i := 1; i < 16; i++ { - t.Square(t) - } - m.Mul(t, m) - t.Mul(t, x) - - x.Square(m) - for i := 1; i < 32; i++ { - x.Square(x) - } - x.Mul(x, t) - for i := 0; i < 32; i++ { - x.Square(x) - } - x.Mul(x, t) - for i := 0; i < 32; i++ { - x.Square(x) - } - x.Mul(x, t) - - sqrs := []uint8{ - 4, 3, 11, 5, 3, 5, 1, - 3, 7, 5, 9, 7, 5, 5, - 4, 5, 2, 2, 7, 3, 5, - 5, 6, 2, 6, 3, 5, - } - muls := []*fiat.SM2P256OrderElement{ - _111, _1, _1111, _1111, _101, _10101, _1, - _1, _111, _11, _101, _10101, _10101, _111, - _111, _1111, _11, _1, _1, _1, _111, - _111, _10101, _1, _1, _1, _1} - - for i, s := range sqrs { - for j := 0; j < int(s); j++ { - x.Square(x) - } - x.Mul(x, muls[i]) - } - - return x.Bytes(), nil - + xinv := new(fiat.SM2P256OrderElement).Invert(x) + return xinv.Bytes(), nil } // P256OrdMul multiplication modulo org(G).