projects / u / mdw / catacomb / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Add cyclic group abstraction, with test code. Separate off exponentation
[u/mdw/catacomb] / mpmont.c
1 /* -*-c-*-
2 *
3 * $Id: mpmont.c,v 1.17 2004/04/01 12:50:09 mdw Exp $
4 *
5 * Montgomery reduction
6 *
7 * (c) 1999 Straylight/Edgeware
8 */
9
10 /*----- Licensing notice --------------------------------------------------*
11 *
12 * This file is part of Catacomb.
13 *
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
18 *
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
23 *
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
27 * MA 02111-1307, USA.
28 */
29
30 /*----- Revision history --------------------------------------------------*
31 *
32 * $Log: mpmont.c,v $
33 * Revision 1.17 2004/04/01 12:50:09 mdw
34 * Add cyclic group abstraction, with test code. Separate off exponentation
35 * functions for better static linking. Fix a buttload of bugs on the way.
36 * Generally ensure that negative exponents do inversion correctly. Add
37 * table of standard prime-field subgroups. (Binary field subgroups are
38 * currently unimplemented but easy to add if anyone ever finds a good one.)
39 *
40 * Revision 1.16 2002/01/13 13:40:31 mdw
41 * Avoid trashing arguments before we've used them.
42 *
43 * Revision 1.15 2001/06/16 13:00:20 mdw
44 * Use the generic exponentiation functions.
45 *
46 * Revision 1.14 2001/02/22 09:04:26 mdw
47 * Cosmetic fix.
48 *
49 * Revision 1.13 2001/02/03 12:00:29 mdw
50 * Now @mp_drop@ checks its argument is non-NULL before attempting to free
51 * it. Note that the macro version @MP_DROP@ doesn't do this.
52 *
53 * Revision 1.12 2000/10/08 15:48:35 mdw
54 * Rename Karatsuba constants now that we have @gfx_kmul@ too.
55 *
56 * Revision 1.11 2000/10/08 12:04:27 mdw
57 * (mpmont_reduce, mpmont_mul): Cope with negative numbers.
58 *
59 * Revision 1.10 2000/07/29 17:05:43 mdw
60 * (mpmont_expr): Use sliding window exponentiation, with a drop-through
61 * for small exponents to use a simple left-to-right bitwise routine. This
62 * can reduce modexp times by up to a quarter.
63 *
64 * Revision 1.9 2000/06/17 11:45:09 mdw
65 * Major memory management overhaul. Added arena support. Use the secure
66 * arena for secret integers. Replace and improve the MP management macros
67 * (e.g., replace MP_MODIFY by MP_DEST).
68 *
69 * Revision 1.8 1999/12/22 15:55:00 mdw
70 * Adjust Karatsuba parameters.
71 *
72 * Revision 1.7 1999/12/11 01:51:14 mdw
73 * Use a Karatsuba-based reduction for large moduli.
74 *
75 * Revision 1.6 1999/12/10 23:18:39 mdw
76 * Change interface for suggested destinations.
77 *
78 * Revision 1.5 1999/11/22 13:58:40 mdw
79 * Add an option to disable Montgomery reduction, so that performance
80 * comparisons can be done.
81 *
82 * Revision 1.4 1999/11/21 12:27:06 mdw
83 * Remove a division from the Montgomery setup by calculating
84 * %$R^2 \bmod m$% first and then %$R \bmod m$% by Montgomery reduction of
85 * %$R^2$%.
86 *
87 * Revision 1.3 1999/11/21 11:35:10 mdw
88 * Performance improvement: use @mp_sqr@ and @mpmont_reduce@ instead of
89 * @mpmont_mul@ for squaring in exponentiation.
90 *
91 * Revision 1.2 1999/11/19 13:17:26 mdw
92 * Add extra interface to exponentiation which returns a Montgomerized
93 * result.
94 *
95 * Revision 1.1 1999/11/17 18:02:16 mdw
96 * New multiprecision integer arithmetic suite.
97 *
98 */
99
100 /*----- Header files ------------------------------------------------------*/
101
102 #include "mp.h"
103 #include "mpmont.h"
104
105 /*----- Tweakables --------------------------------------------------------*/
106
107 /* --- @MPMONT_DISABLE@ --- *
108 *
109 * Replace all the clever Montgomery reduction with good old-fashioned long
110 * division.
111 */
112
113 /* #define MPMONT_DISABLE */
114
115 /*----- Reduction and multiplication --------------------------------------*/
116
117 /* --- @mpmont_create@ --- *
118 *
119 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
120 * @mp *m@ = modulus to use
121 *
122 * Returns: ---
123 *
124 * Use: Initializes a Montgomery reduction context ready for use.
125 * The argument @m@ must be a positive odd integer.
126 */
127
128 #ifdef MPMONT_DISABLE
129
130 void mpmont_create(mpmont *mm, mp *m)
131 {
132 mp_shrink(m);
133 mm->m = MP_COPY(m);
134 mm->r = MP_ONE;
135 mm->r2 = MP_ONE;
136 mm->mi = MP_ONE;
137 }
138
139 #else
140
141 void mpmont_create(mpmont *mm, mp *m)
142 {
143 size_t n = MP_LEN(m);
144 mp *r2 = mp_new(2 * n + 1, 0);
145 mp r;
146
147 /* --- Validate the arguments --- */
148
149 assert(((void)"Montgomery modulus must be positive",
150 (m->f & MP_NEG) == 0));
151 assert(((void)"Montgomery modulus must be odd", m->v[0] & 1));
152
153 /* --- Take a copy of the modulus --- */
154
155 mp_shrink(m);
156 mm->m = MP_COPY(m);
157
158 /* --- Determine %$R^2$% --- */
159
160 mm->n = n;
161 MPX_ZERO(r2->v, r2->vl - 1);
162 r2->vl[-1] = 1;
163
164 /* --- Find the magic value @mi@ --- */
165
166 mp_build(&r, r2->v + n, r2->vl);
167 mm->mi = MP_NEW;
168 mp_gcd(0, 0, &mm->mi, &r, m);
169 mm->mi = mp_sub(mm->mi, &r, mm->mi);
170
171 /* --- Discover the values %$R \bmod m$% and %$R^2 \bmod m$% --- */
172
173 mm->r2 = MP_NEW;
174 mp_div(0, &mm->r2, r2, m);
175 mm->r = mpmont_reduce(mm, MP_NEW, mm->r2);
176 MP_DROP(r2);
177 }
178
179 #endif
180
181 /* --- @mpmont_destroy@ --- *
182 *
183 * Arguments: @mpmont *mm@ = pointer to a Montgomery reduction context
184 *
185 * Returns: ---
186 *
187 * Use: Disposes of a context when it's no longer of any use to
188 * anyone.
189 */
190
191 void mpmont_destroy(mpmont *mm)
192 {
193 MP_DROP(mm->m);
194 MP_DROP(mm->r);
195 MP_DROP(mm->r2);
196 MP_DROP(mm->mi);
197 }
198
199 /* --- @mpmont_reduce@ --- *
200 *
201 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
202 * @mp *d@ = destination
203 * @mp *a@ = source, assumed positive
204 *
205 * Returns: Result, %$a R^{-1} \bmod m$%.
206 */
207
208 #ifdef MPMONT_DISABLE
209
210 mp *mpmont_reduce(mpmont *mm, mp *d, mp *a)
211 {
212 mp_div(0, &d, a, mm->m);
213 return (d);
214 }
215
216 #else
217
218 mp *mpmont_reduce(mpmont *mm, mp *d, mp *a)
219 {
220 size_t n = mm->n;
221
222 /* --- Check for serious Karatsuba reduction --- */
223
224 if (n > MPK_THRESH * 3) {
225 mp al;
226 mpw *vl;
227 mp *u;
228
229 if (MP_LEN(a) >= n)
230 vl = a->v + n;
231 else
232 vl = a->vl;
233 mp_build(&al, a->v, vl);
234 u = mp_mul(MP_NEW, &al, mm->mi);
235 if (MP_LEN(u) > n)
236 u->vl = u->v + n;
237 u = mp_mul(u, u, mm->m);
238 d = mp_add(d, a, u);
239 mp_drop(u);
240 }
241
242 /* --- Otherwise do it the hard way --- */
243
244 else {
245 mpw *dv, *dvl;
246 mpw *mv, *mvl;
247 mpw mi;
248 size_t k = n;
249
250 /* --- Initial conditioning of the arguments --- */
251
252 a = MP_COPY(a);
253 if (d)
254 MP_DROP(d);
255 d = a;
256 MP_DEST(d, 2 * n + 1, a->f);
257
258 dv = d->v; dvl = d->vl;
259 mv = mm->m->v; mvl = mm->m->vl;
260
261 /* --- Let's go to work --- */
262
263 mi = mm->mi->v[0];
264 while (k--) {
265 mpw u = MPW(*dv * mi);
266 MPX_UMLAN(dv, dvl, mv, mvl, u);
267 dv++;
268 }
269 }
270
271 /* --- Wrap everything up --- */
272
273 memmove(d->v, d->v + n, MPWS(MP_LEN(d) - n));
274 d->vl -= n;
275 if (MPX_UCMP(d->v, d->vl, >=, mm->m->v, mm->m->vl))
276 mpx_usub(d->v, d->vl, d->v, d->vl, mm->m->v, mm->m->vl);
277 if (d->f & MP_NEG) {
278 mpx_usub(d->v, d->vl, mm->m->v, mm->m->vl, d->v, d->vl);
279 d->f &= ~MP_NEG;
280 }
281 MP_SHRINK(d);
282 return (d);
283 }
284
285 #endif
286
287 /* --- @mpmont_mul@ --- *
288 *
289 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
290 * @mp *d@ = destination
291 * @mp *a, *b@ = sources, assumed positive
292 *
293 * Returns: Result, %$a b R^{-1} \bmod m$%.
294 */
295
296 #ifdef MPMONT_DISABLE
297
298 mp *mpmont_mul(mpmont *mm, mp *d, mp *a, mp *b)
299 {
300 d = mp_mul(d, a, b);
301 mp_div(0, &d, d, mm->m);
302 return (d);
303 }
304
305 #else
306
307 mp *mpmont_mul(mpmont *mm, mp *d, mp *a, mp *b)
308 {
309 if (mm->n > MPK_THRESH * 3) {
310 d = mp_mul(d, a, b);
311 d = mpmont_reduce(mm, d, d);
312 } else {
313 mpw *dv, *dvl;
314 mpw *av, *avl;
315 mpw *bv, *bvl;
316 mpw *mv, *mvl;
317 mpw y;
318 size_t n, i;
319 mpw mi;
320
321 /* --- Initial conditioning of the arguments --- */
322
323 if (MP_LEN(a) > MP_LEN(b)) {
324 mp *t = a; a = b; b = t;
325 }
326 n = MP_LEN(mm->m);
327
328 a = MP_COPY(a);
329 b = MP_COPY(b);
330 MP_DEST(d, 2 * n + 1, a->f | b->f | MP_UNDEF);
331 dv = d->v; dvl = d->vl;
332 MPX_ZERO(dv, dvl);
333 av = a->v; avl = a->vl;
334 bv = b->v; bvl = b->vl;
335 mv = mm->m->v; mvl = mm->m->vl;
336 y = *bv;
337
338 /* --- Montgomery multiplication phase --- */
339
340 i = 0;
341 mi = mm->mi->v[0];
342 while (i < n && av < avl) {
343 mpw x = *av++;
344 mpw u = MPW((*dv + x * y) * mi);
345 MPX_UMLAN(dv, dvl, bv, bvl, x);
346 MPX_UMLAN(dv, dvl, mv, mvl, u);
347 dv++;
348 i++;
349 }
350
351 /* --- Simpler Montgomery reduction phase --- */
352
353 while (i < n) {
354 mpw u = MPW(*dv * mi);
355 MPX_UMLAN(dv, dvl, mv, mvl, u);
356 dv++;
357 i++;
358 }
359
360 /* --- Done --- */
361
362 memmove(d->v, dv, MPWS(dvl - dv));
363 d->vl -= dv - d->v;
364 if (MPX_UCMP(d->v, d->vl, >=, mm->m->v, mm->m->vl))
365 mpx_usub(d->v, d->vl, d->v, d->vl, mm->m->v, mm->m->vl);
366 if ((a->f ^ b->f) & MP_NEG)
367 mpx_usub(d->v, d->vl, mm->m->v, mm->m->vl, d->v, d->vl);
368 MP_SHRINK(d);
369 d->f = (a->f | b->f) & MP_BURN;
370 MP_DROP(a);
371 MP_DROP(b);
372 }
373
374 return (d);
375 }
376
377 #endif
378
379 /*----- Test rig ----------------------------------------------------------*/
380
381 #ifdef TEST_RIG
382
383 static int tcreate(dstr *v)
384 {
385 mp *m = *(mp **)v[0].buf;
386 mp *mi = *(mp **)v[1].buf;
387 mp *r = *(mp **)v[2].buf;
388 mp *r2 = *(mp **)v[3].buf;
389
390 mpmont mm;
391 int ok = 1;
392
393 mpmont_create(&mm, m);
394
395 if (mm.mi->v[0] != mi->v[0]) {
396 fprintf(stderr, "\n*** bad mi: found %lu, expected %lu",
397 (unsigned long)mm.mi->v[0], (unsigned long)mi->v[0]);
398 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
399 fputc('\n', stderr);
400 ok = 0;
401 }
402
403 if (!MP_EQ(mm.r, r)) {
404 fputs("\n*** bad r", stderr);
405 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
406 fputs("\nexpected ", stderr); mp_writefile(r, stderr, 10);
407 fputs("\n found ", stderr); mp_writefile(mm.r, stderr, 10);
408 fputc('\n', stderr);
409 ok = 0;
410 }
411
412 if (!MP_EQ(mm.r2, r2)) {
413 fputs("\n*** bad r2", stderr);
414 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
415 fputs("\nexpected ", stderr); mp_writefile(r2, stderr, 10);
416 fputs("\n found ", stderr); mp_writefile(mm.r2, stderr, 10);
417 fputc('\n', stderr);
418 ok = 0;
419 }
420
421 MP_DROP(m);
422 MP_DROP(mi);
423 MP_DROP(r);
424 MP_DROP(r2);
425 mpmont_destroy(&mm);
426 assert(mparena_count(MPARENA_GLOBAL) == 0);
427 return (ok);
428 }
429
430 static int tmul(dstr *v)
431 {
432 mp *m = *(mp **)v[0].buf;
433 mp *a = *(mp **)v[1].buf;
434 mp *b = *(mp **)v[2].buf;
435 mp *r = *(mp **)v[3].buf;
436 int ok = 1;
437
438 mpmont mm;
439 mpmont_create(&mm, m);
440
441 {
442 mp *qr = mp_mul(MP_NEW, a, b);
443 mp_div(0, &qr, qr, m);
444
445 if (!MP_EQ(qr, r)) {
446 fputs("\n*** classical modmul failed", stderr);
447 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
448 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
449 fputs("\n b = ", stderr); mp_writefile(b, stderr, 10);
450 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
451 fputs("\nqr = ", stderr); mp_writefile(qr, stderr, 10);
452 fputc('\n', stderr);
453 ok = 0;
454 }
455
456 mp_drop(qr);
457 }
458
459 {
460 mp *ar = mpmont_mul(&mm, MP_NEW, a, mm.r2);
461 mp *br = mpmont_mul(&mm, MP_NEW, b, mm.r2);
462 mp *mr = mpmont_mul(&mm, MP_NEW, ar, br);
463 mr = mpmont_reduce(&mm, mr, mr);
464 if (!MP_EQ(mr, r)) {
465 fputs("\n*** montgomery modmul failed", stderr);
466 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
467 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
468 fputs("\n b = ", stderr); mp_writefile(b, stderr, 10);
469 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
470 fputs("\nmr = ", stderr); mp_writefile(mr, stderr, 10);
471 fputc('\n', stderr);
472 ok = 0;
473 }
474 MP_DROP(ar); MP_DROP(br);
475 mp_drop(mr);
476 }
477
478
479 MP_DROP(m);
480 MP_DROP(a);
481 MP_DROP(b);
482 MP_DROP(r);
483 mpmont_destroy(&mm);
484 assert(mparena_count(MPARENA_GLOBAL) == 0);
485 return ok;
486 }
487
488 static test_chunk tests[] = {
489 { "create", tcreate, { &type_mp, &type_mp, &type_mp, &type_mp, 0 } },
490 { "mul", tmul, { &type_mp, &type_mp, &type_mp, &type_mp, 0 } },
491 { 0, 0, { 0 } },
492 };
493
494 int main(int argc, char *argv[])
495 {
496 sub_init();
497 test_run(argc, argv, tests, SRCDIR "/tests/mpmont");
498 return (0);
499 }
500
501 #endif
502
503 /*----- That's all, folks -------------------------------------------------*/
Catacomb cryptographic library (downstream of http://git.distorted.org.uk/~mdw/catacomb/)