Renamed from `rsa-decrypt', since the name was no longer appropriate.

[u/mdw/catacomb] / mp-arith.c

/* -*-c-*-
 *
 * $Id: mp-arith.c,v 1.7 2000/06/22 19:02:53 mdw Exp $
 *
 * Basic arithmetic on multiprecision integers
 *
 * (c) 1999 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 * 
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 * 
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------* 
 *
 * $Log: mp-arith.c,v $
 * Revision 1.7  2000/06/22 19:02:53  mdw
 * New function @mp_odd@ to extract powers of two from an integer.  This is
 * common code from the Rabin-Miller test, RSA key recovery and modular
 * square-root extraction.
 *
 * Revision 1.6  2000/06/17 11:45:09  mdw
 * Major memory management overhaul.  Added arena support.  Use the secure
 * arena for secret integers.  Replace and improve the MP management macros
 * (e.g., replace MP_MODIFY by MP_DEST).
 *
 * Revision 1.5  1999/12/22 15:54:41  mdw
 * Adjust Karatsuba parameters.  Calculate destination size better.
 *
 * Revision 1.4  1999/12/13 15:35:16  mdw
 * Slightly different rules on memory allocation.
 *
 * Revision 1.3  1999/12/11 10:57:43  mdw
 * Karatsuba squaring algorithm.
 *
 * Revision 1.2  1999/12/10 23:18:39  mdw
 * Change interface for suggested destinations.
 *
 * Revision 1.1  1999/11/17 18:02:16  mdw
 * New multiprecision integer arithmetic suite.
 *
 */

/*----- Header files ------------------------------------------------------*/

#include "mp.h"

/*----- Macros ------------------------------------------------------------*/

#define MAX(x, y) ((x) >= (y) ? (x) : (y))

/*----- Main code ---------------------------------------------------------*/

/* --- @mp_2c@ --- *
 *
 * Arguments:	@mp *a@ = source
 *
 * Returns:	Result, @a@ converted to two's complement notation.
 */

mp *mp_2c(mp *d, mp *a)
{
  if (!(a->f & MP_NEG))
    return (MP_COPY(a));

  MP_DEST(d, MP_LEN(a), a->f);
  mpx_2c(d->v, d->vl, a->v, a->vl);
  d->f = a->f & MP_BURN;
  MP_SHRINK(d);
  return (d);
}

/* --- @mp_sm@ --- *
 *
 * Arguments:	@mp *d@ = destination
 *		@mp *a@ = source
 *
 * Returns:	Result, @a@ converted to the native signed-magnitude
 *		notation.
 */

mp *mp_sm(mp *d, mp *a)
{
  if (!MP_LEN(a) || a->vl[-1] < MPW_MAX / 2)
    return (MP_COPY(a));

  MP_DEST(d, MP_LEN(a), a->f);
  mpx_2c(d->v, d->vl, a->v, a->vl);
  d->f = (a->f & (MP_BURN | MP_NEG)) ^ MP_NEG;
  MP_SHRINK(d);
  return (d);  
}

/* --- @mp_lsl@ --- *
 *
 * Arguments:	@mp *d@ = destination
 *		@mp *a@ = source
 *		@size_t n@ = number of bits to move
 *
 * Returns:	Result, @a@ shifted left by @n@.
 */

mp *mp_lsl(mp *d, mp *a, size_t n)
{
  MP_DEST(d, MP_LEN(a) + (n + MPW_BITS - 1) / MPW_BITS, a->f);
  mpx_lsl(d->v, d->vl, a->v, a->vl, n);
  d->f = a->f & (MP_NEG | MP_BURN);
  MP_SHRINK(d);
  return (d);
}

/* --- @mp_lsr@ --- *
 *
 * Arguments:	@mp *d@ = destination
 *		@mp *a@ = source
 *		@size_t n@ = number of bits to move
 *
 * Returns:	Result, @a@ shifted left by @n@.
 */

mp *mp_lsr(mp *d, mp *a, size_t n)
{
  MP_DEST(d, MP_LEN(a), a->f);
  mpx_lsr(d->v, d->vl, a->v, a->vl, n);
  d->f = a->f & (MP_NEG | MP_BURN);
  MP_SHRINK(d);
  return (d);
}

/* --- @mp_cmp@ --- *
 *
 * Arguments:	@const mp *a, *b@ = two numbers
 *
 * Returns:	Less than, equal to or greater than zero, according to
 *		whether @a@ is less than, equal to or greater than @b@.
 */

int mp_cmp(const mp *a, const mp *b)
{
  if (!((a->f ^ b->f) & MP_NEG))
    return (mpx_ucmp(a->v, a->vl, b->v, b->vl));
  else if (a->f & MP_NEG)
    return (-1);
  else
    return (+1);
}

/* --- @mp_add@ --- *
 *
 * Arguments:	@mp *d@ = destination
 *		@mp *a, *b@ = sources
 *
 * Returns:	Result, @a@ added to @b@.
 */

mp *mp_add(mp *d, mp *a, mp *b)
{
  MP_DEST(d, MAX(MP_LEN(a), MP_LEN(b)) + 1, a->f | b->f);
  if (!((a->f ^ b->f) & MP_NEG))
    mpx_uadd(d->v, d->vl, a->v, a->vl, b->v, b->vl);
  else {
    if (MPX_UCMP(a->v, a->vl, <, b->v, b->vl)) {
      mp *t = a; a = b; b = t;
    }
    mpx_usub(d->v, d->vl, a->v, a->vl, b->v, b->vl);
  }
  d->f = ((a->f | b->f) & MP_BURN) | (a->f & MP_NEG);
  MP_SHRINK(d);
  return (d);
}

/* --- @mp_sub@ --- *
 *
 * Arguments:	@mp *d@ = destination
 *		@mp *a, *b@ = sources
 *
 * Returns:	Result, @b@ subtracted from @a@.
 */

mp *mp_sub(mp *d, mp *a, mp *b)
{
  unsigned sgn = 0;
  MP_DEST(d, MAX(MP_LEN(a), MP_LEN(b)) + 1, a->f | b->f);
  if ((a->f ^ b->f) & MP_NEG)
    mpx_uadd(d->v, d->vl, a->v, a->vl, b->v, b->vl);
  else {
    if (MPX_UCMP(a->v, a->vl, <, b->v, b->vl)) {
      mp *t = a; a = b; b = t;
      sgn = MP_NEG;
    }
    mpx_usub(d->v, d->vl, a->v, a->vl, b->v, b->vl);
  }
  d->f = ((a->f | b->f) & MP_BURN) | ((a->f ^ sgn) & MP_NEG);
  MP_SHRINK(d);
  return (d);
}

/* --- @mp_mul@ --- *
 *
 * Arguments:	@mp *d@ = destination
 *		@mp *a, *b@ = sources
 *
 * Returns:	Result, @a@ multiplied by @b@.
 */

mp *mp_mul(mp *d, mp *a, mp *b)
{
  a = MP_COPY(a);
  b = MP_COPY(b);

  if (MP_LEN(a) <= KARATSUBA_CUTOFF || MP_LEN(b) <= KARATSUBA_CUTOFF) {
    MP_DEST(d, MP_LEN(a) + MP_LEN(b), a->f | b->f | MP_UNDEF);
    mpx_umul(d->v, d->vl, a->v, a->vl, b->v, b->vl);
  } else {
    size_t m = 2 * MAX(MP_LEN(a), MP_LEN(b)) + 2;
    mpw *s;
    MP_DEST(d, m, a->f | b->f | MP_UNDEF);
    m += KARATSUBA_SLOP;
    s = mpalloc(d->a, m);
    mpx_kmul(d->v, d->vl, a->v, a->vl, b->v, b->vl, s, s + m);
    mpfree(d->a, s);
  }

  d->f = ((a->f | b->f) & MP_BURN) | ((a->f ^ b->f) & MP_NEG);
  MP_SHRINK(d);
  MP_DROP(a);
  MP_DROP(b);
  return (d);
}

/* --- @mp_sqr@ --- *
 *
 * Arguments:	@mp *d@ = destination
 *		@mp *a@ = source
 *
 * Returns:	Result, @a@ squared.
 */

mp *mp_sqr(mp *d, mp *a)
{
  size_t m = MP_LEN(a);

  a = MP_COPY(a);
  MP_DEST(d, 2 * m + 2, a->f | MP_UNDEF);
  if (m > KARATSUBA_CUTOFF) {
    mpw *s;
    m = 2 * (m + 1) + KARATSUBA_SLOP;
    s = mpalloc(d->a, m);
    mpx_ksqr(d->v, d->vl, a->v, a->vl, s, s + m);
    mpfree(d->a, s);
  } else 
    mpx_usqr(d->v, d->vl, a->v, a->vl);
  d->f = a->f & MP_BURN;
  MP_SHRINK(d);
  MP_DROP(a);
  return (d);
}

/* --- @mp_div@ --- *
 *
 * Arguments:	@mp **qq, **rr@ = destination, quotient and remainder
 *		@mp *a, *b@ = sources
 *
 * Use:		Calculates the quotient and remainder when @a@ is divided by
 *		@b@.  The destinations @*qq@ and @*rr@ must be distinct.
 *		Either of @qq@ or @rr@ may be null to indicate that the
 *		result is irrelevant.  (Discarding both results is silly.)
 *		There is a performance advantage if @a == *rr@.
 *
 *		The behaviour when @a@ and @b@ have the same sign is
 *		straightforward.  When the signs differ, this implementation
 *		chooses @r@ to have the same sign as @b@, rather than the
 *		more normal choice that the remainder has the same sign as
 *		the dividend.  This makes modular arithmetic a little more
 *		straightforward.
 */

void mp_div(mp **qq, mp **rr, mp *a, mp *b)
 {
  mp *r = rr ? *rr : MP_NEW;
  mp *q = qq ? *qq : MP_NEW;
  mpw *sv, *svl;

  /* --- Set the remainder up right --- *
   *
   * Just in case the divisor is larger, be able to cope with this.  It's not
   * important in @mpx_udiv@, but it is here because of the sign correction.
   */

  b = MP_COPY(b);
  a = MP_COPY(a);
  if (r)
    MP_DROP(r);
  r = a;
  MP_DEST(r, MP_LEN(a) + 2, a->f | b->f);

  /* --- Fix up the quotient too --- */

  r = MP_COPY(r);
  MP_DEST(q, MP_LEN(r), r->f | MP_UNDEF);
  MP_DROP(r);

  /* --- Set up some temporary workspace --- */

  {
    size_t rq = MP_LEN(b) + 1;
    sv = mpalloc(r->a, rq);
    svl = sv + rq;
  }

  /* --- Perform the calculation --- */

  mpx_udiv(q->v, q->vl, r->v, r->vl, b->v, b->vl, sv, svl);

  /* --- Sort out the sign of the results --- *
   *
   * If the signs of the arguments differ, and the remainder is nonzero, I
   * must add one to the absolute value of the quotient and subtract the
   * remainder from @b@.
   */

  q->f = ((r->f | b->f) & MP_BURN) | ((r->f ^ b->f) & MP_NEG);
  if (q->f & MP_NEG) {
    mpw *v;
    for (v = r->v; v < r->vl; v++) {
      if (*v) {
	MPX_UADDN(q->v, q->vl, 1);
	mpx_usub(r->v, r->vl, b->v, b->vl, r->v, r->vl);
	break;
      }
    }
  }

  r->f = ((r->f | b->f) & MP_BURN) | (b->f & MP_NEG);

  /* --- Store the return values --- */

  mpfree(r->a, sv);
  MP_DROP(b);

  if (!qq)
    MP_DROP(q);
  else {
    MP_SHRINK(q);
    *qq = q;
  }

  if (!rr)
    MP_DROP(r);
  else {
    MP_SHRINK(r);
    *rr = r;
  }
}

/* --- @mp_odd@ --- *
 *
 * Arguments:	@mp *d@ = pointer to destination integer
 *		@mp *m@ = pointer to source integer
 *		@size_t *s@ = where to store the power of 2
 *
 * Returns:	An odd integer integer %$t$% such that %$m = 2^s t$%.
 *
 * Use:		Computes a power of two and an odd integer which, when
 *		multiplied, give a specified result.  This sort of thing is
 *		useful in number theory quite often.
 */

mp *mp_odd(mp *d, mp *m, size_t *s)
{
  size_t ss = 0;
  const mpw *v, *vl;

  v = m->v;
  vl = m->vl;
  for (; !*v && v < vl; v++)
    ss += MPW_BITS;
  if (v >= vl)
    ss = 0;
  else {
    mpw x = *v;
    mpw mask = MPW_MAX;
    unsigned z = MPW_BITS / 2;

    while (z) {
      mask >>= z;
      if (!(x & mask)) {
	x >>= z;
	ss += z;
      }
      z >>= 1;
    }
  }

  *s = ss;
  return (mp_lsr(d, m, ss));
}

/*----- Test rig ----------------------------------------------------------*/

#ifdef TEST_RIG

static int verify(const char *op, mp *expect, mp *result, mp *a, mp *b)
{
  if (MP_CMP(expect, !=, result)) {
    fprintf(stderr, "\n*** %s failed", op);
    fputs("\n*** a      = ", stderr); mp_writefile(a, stderr, 10);
    fputs("\n*** b      = ", stderr); mp_writefile(b, stderr, 10);
    fputs("\n*** result = ", stderr); mp_writefile(result, stderr, 10);
    fputs("\n*** expect = ", stderr); mp_writefile(expect, stderr, 10);
    fputc('\n', stderr);
    return (0);
  }
  return (1);
}

#define RIG(name, op)							\
  static int t##name(dstr *v)						\
  {									\
    mp *a = *(mp **)v[0].buf;						\
    mpw n = *(int *)v[1].buf;						\
    mp b;								\
    mp *r = *(mp **)v[2].buf;						\
    mp *c = op(MP_NEW, a, n);						\
    int ok;								\
    mp_build(&b, &n, &n + 1);						\
    ok = verify(#name, r, c, a, &b);					\
    mp_drop(a); mp_drop(c); mp_drop(r);					\
    assert(mparena_count(MPARENA_GLOBAL) == 0);				\
    return (ok);							\
  }

RIG(lsl, mp_lsl)
RIG(lsr, mp_lsr)

#undef RIG

#define RIG(name, op)							\
  static int t##name(dstr *v)						\
  {									\
    mp *a = *(mp **)v[0].buf;						\
    mp *b = *(mp **)v[1].buf;						\
    mp *r = *(mp **)v[2].buf;						\
    mp *c = op(MP_NEW, a, b);						\
    int ok = verify(#name, r, c, a, b);					\
    mp_drop(a); mp_drop(b); mp_drop(c); mp_drop(r);			\
    assert(mparena_count(MPARENA_GLOBAL) == 0);				\
    return (ok);							\
  }

RIG(add, mp_add)
RIG(sub, mp_sub)
RIG(mul, mp_mul)

#undef RIG

static int tdiv(dstr *v)
{
  mp *a = *(mp **)v[0].buf;
  mp *b = *(mp **)v[1].buf;
  mp *q = *(mp **)v[2].buf;
  mp *r = *(mp **)v[3].buf;
  mp *c = MP_NEW, *d = MP_NEW;
  int ok = 1;
  mp_div(&c, &d, a, b);
  ok &= verify("div(quotient)", q, c, a, b);
  ok &= verify("div(remainder)", r, d, a, b);
  mp_drop(a); mp_drop(b); mp_drop(c); mp_drop(d); mp_drop(r); mp_drop(q);
  assert(mparena_count(MPARENA_GLOBAL) == 0);
  return (ok);
}

static int todd(dstr *v)
{
  mp *a = *(mp **)v[0].buf;
  size_t rs = *(uint32 *)v[1].buf;
  mp *rt = *(mp **)v[2].buf;
  int ok = 1;
  mp *t;
  size_t s;
  t = mp_odd(MP_NEW, a, &s);
  if (s != rs || MP_CMP(t, !=, rt)) {
    ok = 0;
    fprintf(stderr, "\n*** odd failed");
    fputs("\n*** a  = ", stderr); mp_writefile(a, stderr, 10);
    fprintf(stderr, "\n*** s  = %lu", (unsigned long)s);
    fputs("\n*** t  = ", stderr); mp_writefile(t, stderr, 10);
    fprintf(stderr, "\n*** rs = %lu", (unsigned long)rs);
    fputs("\n*** rt = ", stderr); mp_writefile(rt, stderr, 10);
    fputc('\n', stderr);
  }
  mp_drop(a);
  mp_drop(rt);
  mp_drop(t);
  return (ok);
}

static test_chunk tests[] = {
  { "lsl", tlsl, { &type_mp, &type_mp, &type_mp, 0 } },
  { "lsr", tlsr, { &type_mp, &type_mp, &type_mp, 0 } },
  { "add", tadd, { &type_mp, &type_mp, &type_mp, 0 } },
  { "sub", tsub, { &type_mp, &type_mp, &type_mp, 0 } },
  { "mul", tmul, { &type_mp, &type_mp, &type_mp, 0 } },
  { "div", tdiv, { &type_mp, &type_mp, &type_mp, &type_mp, 0 } },
  { "odd", todd, { &type_mp, &type_uint32, &type_mp, 0 } },
  { 0, 0, { 0 } },
};

int main(int argc, char *argv[])
{
  sub_init();
  test_run(argc, argv, tests, SRCDIR "/tests/mp");
  return (0);
}

#endif

/*----- That's all, folks -------------------------------------------------*/