projects / u / mdw / catacomb / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Document the tweakables.
[u/mdw/catacomb] / mpmont.c
CommitLineData
d3409d5e 1/* -*-c-*-
2 *
93feaa6e 3 * $Id: mpmont.c,v 1.4 1999/11/21 12:27:06 mdw Exp $
d3409d5e 4 *
5 * Montgomery reduction
6 *
7 * (c) 1999 Straylight/Edgeware
8 */
9
10/*----- Licensing notice --------------------------------------------------*
11 *
12 * This file is part of Catacomb.
13 *
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
18 *
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
23 *
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
27 * MA 02111-1307, USA.
28 */
29
30/*----- Revision history --------------------------------------------------*
31 *
32 * $Log: mpmont.c,v $
93feaa6e 33 * Revision 1.4 1999/11/21 12:27:06 mdw
34 * Remove a division from the Montgomery setup by calculating
35 * %$R^2 \bmod m$% first and then %$R \bmod m$% by Montgomery reduction of
36 * %$R^2$%.
37 *
79a34029 38 * Revision 1.3 1999/11/21 11:35:10 mdw
39 * Performance improvement: use @mp_sqr@ and @mpmont_reduce@ instead of
40 * @mpmont_mul@ for squaring in exponentiation.
41 *
17ad212e 42 * Revision 1.2 1999/11/19 13:17:26 mdw
43 * Add extra interface to exponentiation which returns a Montgomerized
44 * result.
45 *
d3409d5e 46 * Revision 1.1 1999/11/17 18:02:16 mdw
47 * New multiprecision integer arithmetic suite.
48 *
49 */
50
51/*----- Header files ------------------------------------------------------*/
52
53#include "mp.h"
54#include "mpmont.h"
55
56/*----- Main code ---------------------------------------------------------*/
57
58/* --- @mpmont_create@ --- *
59 *
60 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
61 * @mp *m@ = modulus to use
62 *
63 * Returns: ---
64 *
65 * Use: Initializes a Montgomery reduction context ready for use.
66 */
67
68void mpmont_create(mpmont *mm, mp *m)
69{
70 /* --- Take a copy of the modulus --- */
71
72 mp_shrink(m);
73 mm->m = MP_COPY(m);
74
75 /* --- Find the magic value @mi@ --- *
76 *
77 * This is a slightly grungy way of solving the problem, but it does work.
78 */
79
80 {
81 mpw av[2] = { 0, 1 };
82 mp a, b;
83 mp *i;
84 mpw mi;
85
86 mp_build(&a, av, av + 2);
87 mp_build(&b, m->v, m->v + 1);
88 mp_gcd(0, 0, &i, &a, &b);
89 mi = i->v[0];
90 if (!(i->f & MP_NEG))
91 mi = MPW(-mi);
92 mm->mi = mi;
93 MP_DROP(i);
94 }
95
96 /* --- Discover the values %$R \bmod m$% and %$R^2 \bmod m$% --- */
97
98 {
99 size_t l = MP_LEN(m);
93feaa6e 100 mp *r = mp_create(2 * l + 1);
d3409d5e 101
102 mm->shift = l * MPW_BITS;
103 MPX_ZERO(r->v, r->vl - 1);
104 r->vl[-1] = 1;
93feaa6e 105 mm->r2 = MP_NEW;
d3409d5e 106 mp_div(0, &mm->r2, r, m);
93feaa6e 107 mm->r = mpmont_reduce(mm, MP_NEW, mm->r2);
d3409d5e 108 MP_DROP(r);
109 }
110}
111
112/* --- @mpmont_destroy@ --- *
113 *
114 * Arguments: @mpmont *mm@ = pointer to a Montgomery reduction context
115 *
116 * Returns: ---
117 *
118 * Use: Disposes of a context when it's no longer of any use to
119 * anyone.
120 */
121
122void mpmont_destroy(mpmont *mm)
123{
124 MP_DROP(mm->m);
125 MP_DROP(mm->r);
126 MP_DROP(mm->r2);
127}
128
129/* --- @mpmont_reduce@ --- *
130 *
131 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
132 * @mp *d@ = destination
133 * @const mp *a@ = source, assumed positive
134 *
135 * Returns: Result, %$a R^{-1} \bmod m$%.
136 */
137
138mp *mpmont_reduce(mpmont *mm, mp *d, const mp *a)
139{
140 mpw *dv, *dvl;
141 const mpw *mv, *mvl;
142 size_t n;
143
144 /* --- Initial conditioning of the arguments --- */
145
146 n = MP_LEN(mm->m);
147
148 if (d == a)
79a34029 149 MP_MODIFY(d, 2 * n + 1);
d3409d5e 150 else {
79a34029 151 MP_MODIFY(d, 2 * n + 1);
d3409d5e 152 memcpy(d->v, a->v, MPWS(MP_LEN(a)));
153 memset(d->v + MP_LEN(a), 0, MPWS(MP_LEN(d) - MP_LEN(a)));
154 }
155
156 dv = d->v; dvl = d->vl;
157 mv = mm->m->v; mvl = mm->m->vl;
158
159 /* --- Let's go to work --- */
160
161 while (n--) {
162 mpw u = MPW(*dv * mm->mi);
163 MPX_UMLAN(dv, dvl, mv, mvl, u);
164 dv++;
165 }
166
167 /* --- Done --- */
168
169 memmove(d->v, dv, MPWS(dvl - dv));
170 d->vl -= dv - d->v;
171 MP_SHRINK(d);
172 d->f = a->f & MP_BURN;
17ad212e 173 if (MP_CMP(d, >=, mm->m))
174 d = mp_sub(d, d, mm->m);
d3409d5e 175 return (d);
176}
177
178/* --- @mpmont_mul@ --- *
179 *
180 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
181 * @mp *d@ = destination
182 * @const mp *a, *b@ = sources, assumed positive
183 *
184 * Returns: Result, %$a b R^{-1} \bmod m$%.
185 */
186
187mp *mpmont_mul(mpmont *mm, mp *d, const mp *a, const mp *b)
188{
189 mpw *dv, *dvl;
190 const mpw *av, *avl;
191 const mpw *bv, *bvl;
192 const mpw *mv, *mvl;
193 mpw y;
194 size_t n, i;
195
196 /* --- Initial conditioning of the arguments --- */
197
198 if (MP_LEN(a) > MP_LEN(b)) {
199 const mp *t = a; a = b; b = t;
200 }
201 n = MP_LEN(mm->m);
202
203 MP_MODIFY(d, 2 * n + 1);
204 dv = d->v; dvl = d->vl;
205 MPX_ZERO(dv, dvl);
206 av = a->v; avl = a->vl;
207 bv = b->v; bvl = b->vl;
208 mv = mm->m->v; mvl = mm->m->vl;
209 y = *bv;
210
211 /* --- Montgomery multiplication phase --- */
212
213 i = 0;
214 while (i < n && av < avl) {
215 mpw x = *av++;
216 mpw u = MPW((*dv + x * y) * mm->mi);
217 MPX_UMLAN(dv, dvl, bv, bvl, x);
218 MPX_UMLAN(dv, dvl, mv, mvl, u);
219 dv++;
220 i++;
221 }
222
223 /* --- Simpler Montgomery reduction phase --- */
224
225 while (i < n) {
226 mpw u = MPW(*dv * mm->mi);
227 MPX_UMLAN(dv, dvl, mv, mvl, u);
228 dv++;
229 i++;
230 }
231
232 /* --- Done --- */
233
234 memmove(d->v, dv, MPWS(dvl - dv));
235 d->vl -= dv - d->v;
236 MP_SHRINK(d);
237 d->f = (a->f | b->f) & MP_BURN;
17ad212e 238 if (MP_CMP(d, >=, mm->m))
239 d = mp_sub(d, d, mm->m);
d3409d5e 240 return (d);
241}
242
17ad212e 243/* --- @mpmont_expr@ --- *
d3409d5e 244 *
245 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
246 * @const mp *a@ = base
247 * @const mp *e@ = exponent
248 *
17ad212e 249 * Returns: Result, %$a^e R \bmod m$%.
d3409d5e 250 */
251
17ad212e 252mp *mpmont_expr(mpmont *mm, const mp *a, const mp *e)
d3409d5e 253{
254 mpscan sc;
255 mp *ar = mpmont_mul(mm, MP_NEW, a, mm->r2);
256 mp *d = MP_COPY(mm->r);
17ad212e 257 mp *spare = MP_NEW;
d3409d5e 258
259 mp_scan(&sc, e);
260
261 if (MP_STEP(&sc)) {
17ad212e 262 size_t sq = 0;
d3409d5e 263 for (;;) {
264 mp *dd;
265 if (MP_BIT(&sc)) {
17ad212e 266 while (sq) {
79a34029 267 dd = mp_sqr(spare, ar);
268 dd = mpmont_reduce(mm, dd, dd);
17ad212e 269 spare = ar; ar = dd;
270 sq--;
271 }
272 dd = mpmont_mul(mm, spare, d, ar);
273 spare = d; d = dd;
d3409d5e 274 }
17ad212e 275 sq++;
d3409d5e 276 if (!MP_STEP(&sc))
277 break;
d3409d5e 278 }
279 }
280 MP_DROP(ar);
17ad212e 281 if (spare != MP_NEW)
282 MP_DROP(spare);
283 return (d);
284}
285
286/* --- @mpmont_exp@ --- *
287 *
288 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
289 * @const mp *a@ = base
290 * @const mp *e@ = exponent
291 *
292 * Returns: Result, %$a^e \bmod m$%.
293 */
294
295mp *mpmont_exp(mpmont *mm, const mp *a, const mp *e)
296{
297 mp *d = mpmont_expr(mm, a, e);
298 d = mpmont_reduce(mm, d, d);
299 return (d);
d3409d5e 300}
301
302/*----- Test rig ----------------------------------------------------------*/
303
304#ifdef TEST_RIG
305
306static int tcreate(dstr *v)
307{
308 mp *m = *(mp **)v[0].buf;
309 mp *mi = *(mp **)v[1].buf;
310 mp *r = *(mp **)v[2].buf;
311 mp *r2 = *(mp **)v[3].buf;
312
313 mpmont mm;
314 int ok = 1;
315
316 mpmont_create(&mm, m);
317
318 if (mm.mi != mi->v[0]) {
319 fprintf(stderr, "\n*** bad mi: found %lu, expected %lu",
320 (unsigned long)mm.mi, (unsigned long)mi->v[0]);
321 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
322 fputc('\n', stderr);
323 ok = 0;
324 }
325
326 if (MP_CMP(mm.r, !=, r)) {
327 fputs("\n*** bad r", stderr);
328 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
329 fputs("\nexpected ", stderr); mp_writefile(r, stderr, 10);
17ad212e 330 fputs("\n found ", stderr); mp_writefile(mm.r, stderr, 10);
d3409d5e 331 fputc('\n', stderr);
332 ok = 0;
333 }
334
335 if (MP_CMP(mm.r2, !=, r2)) {
336 fputs("\n*** bad r2", stderr);
337 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
338 fputs("\nexpected ", stderr); mp_writefile(r2, stderr, 10);
17ad212e 339 fputs("\n found ", stderr); mp_writefile(mm.r2, stderr, 10);
d3409d5e 340 fputc('\n', stderr);
341 ok = 0;
342 }
343
344 MP_DROP(m);
345 MP_DROP(mi);
346 MP_DROP(r);
347 MP_DROP(r2);
348 mpmont_destroy(&mm);
349 return (ok);
350}
351
352static int tmul(dstr *v)
353{
354 mp *m = *(mp **)v[0].buf;
355 mp *a = *(mp **)v[1].buf;
356 mp *b = *(mp **)v[2].buf;
357 mp *r = *(mp **)v[3].buf;
d3409d5e 358 int ok = 1;
359
360 mpmont mm;
361 mpmont_create(&mm, m);
362
363 {
79a34029 364 mp *qr = mp_mul(MP_NEW, a, b);
365 mp_div(0, &qr, qr, m);
366
367 if (MP_CMP(qr, !=, r)) {
368 fputs("\n*** classical modmul failed", stderr);
369 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
370 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
371 fputs("\n b = ", stderr); mp_writefile(b, stderr, 10);
372 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
373 fputs("\nqr = ", stderr); mp_writefile(qr, stderr, 10);
374 fputc('\n', stderr);
375 ok = 0;
376 }
377
378 mp_drop(qr);
379 }
380
381 {
d3409d5e 382 mp *ar = mpmont_mul(&mm, MP_NEW, a, mm.r2);
383 mp *br = mpmont_mul(&mm, MP_NEW, b, mm.r2);
79a34029 384 mp *mr = mpmont_mul(&mm, MP_NEW, ar, br);
d3409d5e 385 mr = mpmont_reduce(&mm, mr, mr);
79a34029 386 if (MP_CMP(mr, !=, r)) {
387 fputs("\n*** montgomery modmul failed", stderr);
388 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
389 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
390 fputs("\n b = ", stderr); mp_writefile(b, stderr, 10);
391 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
392 fputs("\nmr = ", stderr); mp_writefile(mr, stderr, 10);
393 fputc('\n', stderr);
394 ok = 0;
395 }
d3409d5e 396 MP_DROP(ar); MP_DROP(br);
79a34029 397 mp_drop(mr);
d3409d5e 398 }
399
d3409d5e 400
401 MP_DROP(m);
402 MP_DROP(a);
403 MP_DROP(b);
404 MP_DROP(r);
d3409d5e 405 mpmont_destroy(&mm);
406 return ok;
407}
408
409static int texp(dstr *v)
410{
411 mp *m = *(mp **)v[0].buf;
412 mp *a = *(mp **)v[1].buf;
413 mp *b = *(mp **)v[2].buf;
414 mp *r = *(mp **)v[3].buf;
415 mp *mr;
416 int ok = 1;
417
418 mpmont mm;
419 mpmont_create(&mm, m);
420
421 mr = mpmont_exp(&mm, a, b);
422
423 if (MP_CMP(mr, !=, r)) {
424 fputs("\n*** montgomery modexp failed", stderr);
425 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
426 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
427 fputs("\n e = ", stderr); mp_writefile(b, stderr, 10);
428 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
429 fputs("\nmr = ", stderr); mp_writefile(mr, stderr, 10);
430 fputc('\n', stderr);
431 ok = 0;
432 }
433
434 MP_DROP(m);
435 MP_DROP(a);
436 MP_DROP(b);
437 MP_DROP(r);
438 MP_DROP(mr);
439 mpmont_destroy(&mm);
440 return ok;
441}
442
443
444static test_chunk tests[] = {
445 { "create", tcreate, { &type_mp, &type_mp, &type_mp, &type_mp } },
446 { "mul", tmul, { &type_mp, &type_mp, &type_mp, &type_mp } },
447 { "exp", texp, { &type_mp, &type_mp, &type_mp, &type_mp } },
448 { 0, 0, { 0 } },
449};
450
451int main(int argc, char *argv[])
452{
453 sub_init();
454 test_run(argc, argv, tests, SRCDIR "/tests/mpmont");
455 return (0);
456}
457
458#endif
459
460/*----- That's all, folks -------------------------------------------------*/
Catacomb cryptographic library (downstream of http://git.distorted.org.uk/~mdw/catacomb/)