projects / u / mdw / catacomb / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
New function for division by a small integer.
[u/mdw/catacomb] / mpmont.c
1 /* -*-c-*-
2 *
3 * $Id: mpmont.c,v 1.7 1999/12/11 01:51:14 mdw Exp $
4 *
5 * Montgomery reduction
6 *
7 * (c) 1999 Straylight/Edgeware
8 */
9
10 /*----- Licensing notice --------------------------------------------------*
11 *
12 * This file is part of Catacomb.
13 *
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
18 *
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
23 *
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
27 * MA 02111-1307, USA.
28 */
29
30 /*----- Revision history --------------------------------------------------*
31 *
32 * $Log: mpmont.c,v $
33 * Revision 1.7 1999/12/11 01:51:14 mdw
34 * Use a Karatsuba-based reduction for large moduli.
35 *
36 * Revision 1.6 1999/12/10 23:18:39 mdw
37 * Change interface for suggested destinations.
38 *
39 * Revision 1.5 1999/11/22 13:58:40 mdw
40 * Add an option to disable Montgomery reduction, so that performance
41 * comparisons can be done.
42 *
43 * Revision 1.4 1999/11/21 12:27:06 mdw
44 * Remove a division from the Montgomery setup by calculating
45 * %$R^2 \bmod m$% first and then %$R \bmod m$% by Montgomery reduction of
46 * %$R^2$%.
47 *
48 * Revision 1.3 1999/11/21 11:35:10 mdw
49 * Performance improvement: use @mp_sqr@ and @mpmont_reduce@ instead of
50 * @mpmont_mul@ for squaring in exponentiation.
51 *
52 * Revision 1.2 1999/11/19 13:17:26 mdw
53 * Add extra interface to exponentiation which returns a Montgomerized
54 * result.
55 *
56 * Revision 1.1 1999/11/17 18:02:16 mdw
57 * New multiprecision integer arithmetic suite.
58 *
59 */
60
61 /*----- Header files ------------------------------------------------------*/
62
63 #include "mp.h"
64 #include "mpmont.h"
65
66 /*----- Tweakables --------------------------------------------------------*/
67
68 /* --- @MPMONT_DISABLE@ --- *
69 *
70 * Replace all the clever Montgomery reduction with good old-fashioned long
71 * division.
72 */
73
74 /* #define MPMONT_DISABLE */
75
76 /*----- Main code ---------------------------------------------------------*/
77
78 /* --- @mpmont_create@ --- *
79 *
80 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
81 * @mp *m@ = modulus to use
82 *
83 * Returns: ---
84 *
85 * Use: Initializes a Montgomery reduction context ready for use.
86 * The argument @m@ must be a positive odd integer.
87 */
88
89 #ifdef MPMONT_DISABLE
90
91 void mpmont_create(mpmont *mm, mp *m)
92 {
93 mp_shrink(m);
94 mm->m = MP_COPY(m);
95 mm->r = MP_ONE;
96 mm->r2 = MP_ONE;
97 mm->mi = MP_ONE;
98 }
99
100 #else
101
102 void mpmont_create(mpmont *mm, mp *m)
103 {
104 size_t n = MP_LEN(m);
105 mp *r2 = mp_create(2 * n + 1);
106 mp r;
107
108 /* --- Validate the arguments --- */
109
110 assert(((void)"Montgomery modulus must be positive",
111 (m->f & MP_NEG) == 0));
112 assert(((void)"Montgomery modulus must be odd", m->v[0] & 1));
113
114 /* --- Take a copy of the modulus --- */
115
116 mp_shrink(m);
117 mm->m = MP_COPY(m);
118
119 /* --- Determine %$R^2$% --- */
120
121 mm->n = n;
122 MPX_ZERO(r2->v, r2->vl - 1);
123 r2->vl[-1] = 1;
124
125 /* --- Find the magic value @mi@ --- */
126
127 mp_build(&r, r2->v + n, r2->vl);
128 mm->mi = MP_NEW;
129 mp_gcd(0, 0, &mm->mi, &r, m);
130 mm->mi = mp_sub(mm->mi, &r, mm->mi);
131
132 /* --- Discover the values %$R \bmod m$% and %$R^2 \bmod m$% --- */
133
134 mm->r2 = MP_NEW;
135 mp_div(0, &mm->r2, r2, m);
136 mm->r = mpmont_reduce(mm, MP_NEW, mm->r2);
137 MP_DROP(r2);
138 }
139
140 #endif
141
142 /* --- @mpmont_destroy@ --- *
143 *
144 * Arguments: @mpmont *mm@ = pointer to a Montgomery reduction context
145 *
146 * Returns: ---
147 *
148 * Use: Disposes of a context when it's no longer of any use to
149 * anyone.
150 */
151
152 void mpmont_destroy(mpmont *mm)
153 {
154 MP_DROP(mm->m);
155 MP_DROP(mm->r);
156 MP_DROP(mm->r2);
157 MP_DROP(mm->mi);
158 }
159
160 /* --- @mpmont_reduce@ --- *
161 *
162 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
163 * @mp *d@ = destination
164 * @mp *a@ = source, assumed positive
165 *
166 * Returns: Result, %$a R^{-1} \bmod m$%.
167 */
168
169 #ifdef MPMONT_DISABLE
170
171 mp *mpmont_reduce(mpmont *mm, mp *d, mp *a)
172 {
173 mp_div(0, &d, a, mm->m);
174 return (d);
175 }
176
177 #else
178
179 mp *mpmont_reduce(mpmont *mm, mp *d, mp *a)
180 {
181 size_t n = mm->n;
182
183 /* --- Check for serious Karatsuba reduction --- */
184
185 if (n > KARATSUBA_CUTOFF * 2) {
186 mp al;
187 mpw *vl;
188 mp *u;
189
190 if (MP_LEN(a) >= n)
191 vl = a->v + n;
192 else
193 vl = a->vl;
194 mp_build(&al, a->v, vl);
195 u = mp_mul(MP_NEW, &al, mm->mi);
196 if (MP_LEN(u) > n)
197 u->vl = u->v + n;
198 u = mp_mul(u, u, mm->m);
199 d = mp_add(d, a, u);
200 mp_drop(u);
201 }
202
203 /* --- Otherwise do it the hard way --- */
204
205 else {
206 mpw *dv, *dvl;
207 mpw *mv, *mvl;
208 mpw mi;
209 size_t k = n;
210
211 /* --- Initial conditioning of the arguments --- */
212
213 if (d == a)
214 MP_MODIFY(d, 2 * n + 1);
215 else {
216 MP_MODIFY(d, 2 * n + 1);
217 MPX_COPY(d->v, d->vl, a->v, a->vl);
218 }
219
220 dv = d->v; dvl = d->vl;
221 mv = mm->m->v; mvl = mm->m->vl;
222
223 /* --- Let's go to work --- */
224
225 mi = mm->mi->v[0];
226 while (k--) {
227 mpw u = MPW(*dv * mi);
228 MPX_UMLAN(dv, dvl, mv, mvl, u);
229 dv++;
230 }
231 }
232
233 /* --- Wrap everything up --- */
234
235 d->f = a->f & MP_BURN;
236 memmove(d->v, d->v + n, MPWS(MP_LEN(d) - n));
237 d->vl -= n;
238 if (MP_CMP(d, >=, mm->m))
239 d = mp_sub(d, d, mm->m);
240 MP_SHRINK(d);
241 return (d);
242 }
243
244 #endif
245
246 /* --- @mpmont_mul@ --- *
247 *
248 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
249 * @mp *d@ = destination
250 * @mp *a, *b@ = sources, assumed positive
251 *
252 * Returns: Result, %$a b R^{-1} \bmod m$%.
253 */
254
255 #ifdef MPMONT_DISABLE
256
257 mp *mpmont_mul(mpmont *mm, mp *d, mp *a, mp *b)
258 {
259 d = mp_mul(d, a, b);
260 mp_div(0, &d, d, mm->m);
261 return (d);
262 }
263
264 #else
265
266 mp *mpmont_mul(mpmont *mm, mp *d, mp *a, mp *b)
267 {
268 if (mm->n > KARATSUBA_CUTOFF * 2) {
269 d = mp_mul(d, a, b);
270 d = mpmont_reduce(mm, d, d);
271 } else {
272 mpw *dv, *dvl;
273 mpw *av, *avl;
274 mpw *bv, *bvl;
275 mpw *mv, *mvl;
276 mpw y;
277 size_t n, i;
278 mpw mi;
279
280 /* --- Initial conditioning of the arguments --- */
281
282 if (MP_LEN(a) > MP_LEN(b)) {
283 mp *t = a; a = b; b = t;
284 }
285 n = MP_LEN(mm->m);
286
287 a = MP_COPY(a);
288 b = MP_COPY(b);
289 MP_MODIFY(d, 2 * n + 1);
290 dv = d->v; dvl = d->vl;
291 MPX_ZERO(dv, dvl);
292 av = a->v; avl = a->vl;
293 bv = b->v; bvl = b->vl;
294 mv = mm->m->v; mvl = mm->m->vl;
295 y = *bv;
296
297 /* --- Montgomery multiplication phase --- */
298
299 i = 0;
300 mi = mm->mi->v[0];
301 while (i < n && av < avl) {
302 mpw x = *av++;
303 mpw u = MPW((*dv + x * y) * mi);
304 MPX_UMLAN(dv, dvl, bv, bvl, x);
305 MPX_UMLAN(dv, dvl, mv, mvl, u);
306 dv++;
307 i++;
308 }
309
310 /* --- Simpler Montgomery reduction phase --- */
311
312 while (i < n) {
313 mpw u = MPW(*dv * mi);
314 MPX_UMLAN(dv, dvl, mv, mvl, u);
315 dv++;
316 i++;
317 }
318
319 /* --- Done --- */
320
321 memmove(d->v, dv, MPWS(dvl - dv));
322 d->vl -= dv - d->v;
323 MP_SHRINK(d);
324 d->f = (a->f | b->f) & MP_BURN;
325 if (MP_CMP(d, >=, mm->m))
326 d = mp_sub(d, d, mm->m);
327 MP_DROP(a);
328 MP_DROP(b);
329 }
330
331 return (d);
332 }
333
334 #endif
335
336 /* --- @mpmont_expr@ --- *
337 *
338 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
339 * @mp *d@ = fake destination
340 * @mp *a@ = base
341 * @mp *e@ = exponent
342 *
343 * Returns: Result, %$a^e R \bmod m$%.
344 */
345
346 mp *mpmont_expr(mpmont *mm, mp *d, mp *a, mp *e)
347 {
348 mpscan sc;
349 mp *ar = mpmont_mul(mm, MP_NEW, a, mm->r2);
350 mp *x = MP_COPY(mm->r);
351 mp *spare = MP_NEW;
352
353 mp_scan(&sc, e);
354
355 if (MP_STEP(&sc)) {
356 size_t sq = 0;
357 for (;;) {
358 mp *dd;
359 if (MP_BIT(&sc)) {
360 while (sq) {
361 dd = mp_sqr(spare, ar);
362 dd = mpmont_reduce(mm, dd, dd);
363 spare = ar; ar = dd;
364 sq--;
365 }
366 dd = mpmont_mul(mm, spare, x, ar);
367 spare = x; x = dd;
368 }
369 sq++;
370 if (!MP_STEP(&sc))
371 break;
372 }
373 }
374 MP_DROP(ar);
375 if (spare != MP_NEW)
376 MP_DROP(spare);
377 if (d != MP_NEW)
378 MP_DROP(d);
379 return (x);
380 }
381
382 /* --- @mpmont_exp@ --- *
383 *
384 * Arguments: @mpmont *mm@ = pointer to Montgomery reduction context
385 * @mp *d@ = fake destination
386 * @mp *a@ = base
387 * @mp *e@ = exponent
388 *
389 * Returns: Result, %$a^e \bmod m$%.
390 */
391
392 mp *mpmont_exp(mpmont *mm, mp *d, mp *a, mp *e)
393 {
394 d = mpmont_expr(mm, d, a, e);
395 d = mpmont_reduce(mm, d, d);
396 return (d);
397 }
398
399 /*----- Test rig ----------------------------------------------------------*/
400
401 #ifdef TEST_RIG
402
403 static int tcreate(dstr *v)
404 {
405 mp *m = *(mp **)v[0].buf;
406 mp *mi = *(mp **)v[1].buf;
407 mp *r = *(mp **)v[2].buf;
408 mp *r2 = *(mp **)v[3].buf;
409
410 mpmont mm;
411 int ok = 1;
412
413 mpmont_create(&mm, m);
414
415 if (mm.mi->v[0] != mi->v[0]) {
416 fprintf(stderr, "\n*** bad mi: found %lu, expected %lu",
417 (unsigned long)mm.mi->v[0], (unsigned long)mi->v[0]);
418 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
419 fputc('\n', stderr);
420 ok = 0;
421 }
422
423 if (MP_CMP(mm.r, !=, r)) {
424 fputs("\n*** bad r", stderr);
425 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
426 fputs("\nexpected ", stderr); mp_writefile(r, stderr, 10);
427 fputs("\n found ", stderr); mp_writefile(mm.r, stderr, 10);
428 fputc('\n', stderr);
429 ok = 0;
430 }
431
432 if (MP_CMP(mm.r2, !=, r2)) {
433 fputs("\n*** bad r2", stderr);
434 fputs("\nm = ", stderr); mp_writefile(m, stderr, 10);
435 fputs("\nexpected ", stderr); mp_writefile(r2, stderr, 10);
436 fputs("\n found ", stderr); mp_writefile(mm.r2, stderr, 10);
437 fputc('\n', stderr);
438 ok = 0;
439 }
440
441 MP_DROP(m);
442 MP_DROP(mi);
443 MP_DROP(r);
444 MP_DROP(r2);
445 mpmont_destroy(&mm);
446 assert(mparena_count(MPARENA_GLOBAL) == 0);
447 return (ok);
448 }
449
450 static int tmul(dstr *v)
451 {
452 mp *m = *(mp **)v[0].buf;
453 mp *a = *(mp **)v[1].buf;
454 mp *b = *(mp **)v[2].buf;
455 mp *r = *(mp **)v[3].buf;
456 int ok = 1;
457
458 mpmont mm;
459 mpmont_create(&mm, m);
460
461 {
462 mp *qr = mp_mul(MP_NEW, a, b);
463 mp_div(0, &qr, qr, m);
464
465 if (MP_CMP(qr, !=, r)) {
466 fputs("\n*** classical modmul failed", stderr);
467 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
468 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
469 fputs("\n b = ", stderr); mp_writefile(b, stderr, 10);
470 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
471 fputs("\nqr = ", stderr); mp_writefile(qr, stderr, 10);
472 fputc('\n', stderr);
473 ok = 0;
474 }
475
476 mp_drop(qr);
477 }
478
479 {
480 mp *ar = mpmont_mul(&mm, MP_NEW, a, mm.r2);
481 mp *br = mpmont_mul(&mm, MP_NEW, b, mm.r2);
482 mp *mr = mpmont_mul(&mm, MP_NEW, ar, br);
483 mr = mpmont_reduce(&mm, mr, mr);
484 if (MP_CMP(mr, !=, r)) {
485 fputs("\n*** montgomery modmul failed", stderr);
486 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
487 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
488 fputs("\n b = ", stderr); mp_writefile(b, stderr, 10);
489 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
490 fputs("\nmr = ", stderr); mp_writefile(mr, stderr, 10);
491 fputc('\n', stderr);
492 ok = 0;
493 }
494 MP_DROP(ar); MP_DROP(br);
495 mp_drop(mr);
496 }
497
498
499 MP_DROP(m);
500 MP_DROP(a);
501 MP_DROP(b);
502 MP_DROP(r);
503 mpmont_destroy(&mm);
504 assert(mparena_count(MPARENA_GLOBAL) == 0);
505 return ok;
506 }
507
508 static int texp(dstr *v)
509 {
510 mp *m = *(mp **)v[0].buf;
511 mp *a = *(mp **)v[1].buf;
512 mp *b = *(mp **)v[2].buf;
513 mp *r = *(mp **)v[3].buf;
514 mp *mr;
515 int ok = 1;
516
517 mpmont mm;
518 mpmont_create(&mm, m);
519
520 mr = mpmont_exp(&mm, MP_NEW, a, b);
521
522 if (MP_CMP(mr, !=, r)) {
523 fputs("\n*** montgomery modexp failed", stderr);
524 fputs("\n m = ", stderr); mp_writefile(m, stderr, 10);
525 fputs("\n a = ", stderr); mp_writefile(a, stderr, 10);
526 fputs("\n e = ", stderr); mp_writefile(b, stderr, 10);
527 fputs("\n r = ", stderr); mp_writefile(r, stderr, 10);
528 fputs("\nmr = ", stderr); mp_writefile(mr, stderr, 10);
529 fputc('\n', stderr);
530 ok = 0;
531 }
532
533 MP_DROP(m);
534 MP_DROP(a);
535 MP_DROP(b);
536 MP_DROP(r);
537 MP_DROP(mr);
538 mpmont_destroy(&mm);
539 assert(mparena_count(MPARENA_GLOBAL) == 0);
540 return ok;
541 }
542
543
544 static test_chunk tests[] = {
545 { "create", tcreate, { &type_mp, &type_mp, &type_mp, &type_mp, 0 } },
546 { "mul", tmul, { &type_mp, &type_mp, &type_mp, &type_mp, 0 } },
547 { "exp", texp, { &type_mp, &type_mp, &type_mp, &type_mp, 0 } },
548 { 0, 0, { 0 } },
549 };
550
551 int main(int argc, char *argv[])
552 {
553 sub_init();
554 test_run(argc, argv, tests, SRCDIR "/tests/mpmont");
555 return (0);
556 }
557
558 #endif
559
560 /*----- That's all, folks -------------------------------------------------*/
Catacomb cryptographic library (downstream of http://git.distorted.org.uk/~mdw/catacomb/)