authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2021-05-03 09:57:45+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2021-05-03 09:57:45+02:00
log97779442d0a551d96f2a0b1799e96944918af32e
tree7cefd333b1d8ceb28b49158920a6bc79cbe64954
parentc47028cd025f4ce405a9395fa979ff14a3e6349a
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

Prepare std/crypto/pcurves for ecdsa and other curves (#8670)

Functions generated by Fiat-crypto are not prefixed by their description any more. This matches an upstream change. We can now use a single type for different curves and implementations. The field type is now generic, so we can properly handle the base field and scalars without code duplication.

5 files changed, 3005 insertions(+), 898 deletions(-)

lib/std/crypto/pcurves/common.zig created+284
...@@ -0,0 +1,284 @@
1const std = @import("std");
2const builtin = std.builtin;
3const crypto = std.crypto;
4const debug = std.debug;
5const mem = std.mem;
6const meta = std.meta;
7
8const NonCanonicalError = crypto.errors.NonCanonicalError;
9const NotSquareError = crypto.errors.NotSquareError;
10
11/// Parameters to create a finite field type.
12pub const FieldParams = struct {
13 fiat: type,
14 field_order: comptime_int,
15 field_bits: comptime_int,
16 saturated_bits: comptime_int,
17 encoded_length: comptime_int,
18};
19
20/// A field element, internally stored in Montgomery domain.
21pub fn Field(comptime params: FieldParams) type {
22 const fiat = params.fiat;
23 const Limbs = fiat.Limbs;
24
25 return struct {
26 const Fe = @This();
27
28 limbs: Limbs,
29
30 /// Field size.
31 pub const field_order = params.field_order;
32
33 /// Number of bits to represent the set of all elements.
34 pub const field_bits = params.field_bits;
35
36 /// Number of bits that can be saturated without overflowing.
37 pub const saturated_bits = params.saturated_bits;
38
39 /// Number of bytes required to encode an element.
40 pub const encoded_length = params.encoded_length;
41
42 /// Zero.
43 pub const zero: Fe = Fe{ .limbs = mem.zeroes(Limbs) };
44
45 /// One.
46 pub const one = comptime one: {
47 var fe: Fe = undefined;
48 fiat.setOne(&fe.limbs);
49 break :one fe;
50 };
51
52 /// Reject non-canonical encodings of an element.
53 pub fn rejectNonCanonical(s_: [encoded_length]u8, endian: builtin.Endian) NonCanonicalError!void {
54 var s = if (endian == .Little) s_ else orderSwap(s_);
55 const field_order_s = comptime fos: {
56 var fos: [encoded_length]u8 = undefined;
57 mem.writeIntLittle(std.meta.Int(.unsigned, encoded_length * 8), &fos, field_order);
58 break :fos fos;
59 };
60 if (crypto.utils.timingSafeCompare(u8, &s, &field_order_s, .Little) != .lt) {
61 return error.NonCanonical;
62 }
63 }
64
65 /// Swap the endianness of an encoded element.
66 pub fn orderSwap(s: [encoded_length]u8) [encoded_length]u8 {
67 var t = s;
68 for (s) |x, i| t[t.len - 1 - i] = x;
69 return t;
70 }
71
72 /// Unpack a field element.
73 pub fn fromBytes(s_: [encoded_length]u8, endian: builtin.Endian) NonCanonicalError!Fe {
74 var s = if (endian == .Little) s_ else orderSwap(s_);
75 try rejectNonCanonical(s, .Little);
76 var limbs_z: Limbs = undefined;
77 fiat.fromBytes(&limbs_z, s);
78 var limbs: Limbs = undefined;
79 fiat.toMontgomery(&limbs, limbs_z);
80 return Fe{ .limbs = limbs };
81 }
82
83 /// Pack a field element.
84 pub fn toBytes(fe: Fe, endian: builtin.Endian) [encoded_length]u8 {
85 var limbs_z: Limbs = undefined;
86 fiat.fromMontgomery(&limbs_z, fe.limbs);
87 var s: [encoded_length]u8 = undefined;
88 fiat.toBytes(&s, limbs_z);
89 return if (endian == .Little) s else orderSwap(s);
90 }
91
92 /// Element as an integer.
93 pub const IntRepr = meta.Int(.unsigned, params.field_bits);
94
95 /// Create a field element from an integer.
96 pub fn fromInt(comptime x: IntRepr) NonCanonicalError!Fe {
97 var s: [encoded_length]u8 = undefined;
98 mem.writeIntLittle(IntRepr, &s, x);
99 return fromBytes(s, .Little);
100 }
101
102 /// Return the field element as an integer.
103 pub fn toInt(fe: Fe) IntRepr {
104 const s = fe.toBytes(.Little);
105 return mem.readIntLittle(IntRepr, &s);
106 }
107
108 /// Return true if the field element is zero.
109 pub fn isZero(fe: Fe) bool {
110 var z: @TypeOf(fe.limbs[0]) = undefined;
111 fiat.nonzero(&z, fe.limbs);
112 return z == 0;
113 }
114
115 /// Return true if both field elements are equivalent.
116 pub fn equivalent(a: Fe, b: Fe) bool {
117 return a.sub(b).isZero();
118 }
119
120 /// Return true if the element is odd.
121 pub fn isOdd(fe: Fe) bool {
122 const s = fe.toBytes(.Little);
123 return @truncate(u1, s[0]) != 0;
124 }
125
126 /// Conditonally replace a field element with `a` if `c` is positive.
127 pub fn cMov(fe: *Fe, a: Fe, c: u1) void {
128 fiat.selectznz(&fe.limbs, c, fe.limbs, a.limbs);
129 }
130
131 /// Add field elements.
132 pub fn add(a: Fe, b: Fe) Fe {
133 var fe: Fe = undefined;
134 fiat.add(&fe.limbs, a.limbs, b.limbs);
135 return fe;
136 }
137
138 /// Subtract field elements.
139 pub fn sub(a: Fe, b: Fe) Fe {
140 var fe: Fe = undefined;
141 fiat.sub(&fe.limbs, a.limbs, b.limbs);
142 return fe;
143 }
144
145 /// Double a field element.
146 pub fn dbl(a: Fe) Fe {
147 var fe: Fe = undefined;
148 fiat.add(&fe.limbs, a.limbs, a.limbs);
149 return fe;
150 }
151
152 /// Multiply field elements.
153 pub fn mul(a: Fe, b: Fe) Fe {
154 var fe: Fe = undefined;
155 fiat.mul(&fe.limbs, a.limbs, b.limbs);
156 return fe;
157 }
158
159 /// Square a field element.
160 pub fn sq(a: Fe) Fe {
161 var fe: Fe = undefined;
162 fiat.square(&fe.limbs, a.limbs);
163 return fe;
164 }
165
166 /// Square a field element n times.
167 fn sqn(a: Fe, comptime n: comptime_int) Fe {
168 var i: usize = 0;
169 var fe = a;
170 while (i < n) : (i += 1) {
171 fe = fe.sq();
172 }
173 return fe;
174 }
175
176 /// Compute a^n.
177 pub fn pow(a: Fe, comptime T: type, comptime n: T) Fe {
178 var fe = one;
179 var x: T = n;
180 var t = a;
181 while (true) {
182 if (@truncate(u1, x) != 0) fe = fe.mul(t);
183 x >>= 1;
184 if (x == 0) break;
185 t = t.sq();
186 }
187 return fe;
188 }
189
190 /// Negate a field element.
191 pub fn neg(a: Fe) Fe {
192 var fe: Fe = undefined;
193 fiat.opp(&fe.limbs, a.limbs);
194 return fe;
195 }
196
197 /// Return the inverse of a field element, or 0 if a=0.
198 // Field inversion from https://eprint.iacr.org/2021/549.pdf
199 pub fn invert(a: Fe) Fe {
200 const iterations = (49 * field_bits + 57) / 17;
201 const Word = @TypeOf(a.limbs[0]);
202 const XLimbs = [a.limbs.len + 1]Word;
203
204 var d: Word = 1;
205 var f: XLimbs = undefined;
206 fiat.msat(&f);
207
208 var g: XLimbs = undefined;
209 fiat.fromMontgomery(g[0..a.limbs.len], a.limbs);
210 g[g.len - 1] = 0;
211
212 var r: Limbs = undefined;
213 fiat.setOne(&r);
214 var v = mem.zeroes(Limbs);
215
216 var precomp: Limbs = undefined;
217 fiat.divstepPrecomp(&precomp);
218
219 var out1: Word = undefined;
220 var out2: XLimbs = undefined;
221 var out3: XLimbs = undefined;
222 var out4: Limbs = undefined;
223 var out5: Limbs = undefined;
224
225 var i: usize = 0;
226 while (i < iterations - iterations % 2) : (i += 2) {
227 fiat.divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
228 fiat.divstep(&d, &f, &g, &v, &r, out1, out2, out3, out4, out5);
229 }
230 if (iterations % 2 != 0) {
231 fiat.divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
232 mem.copy(Word, &v, &out4);
233 mem.copy(Word, &f, &out2);
234 }
235 var v_opp: Limbs = undefined;
236 fiat.opp(&v_opp, v);
237 fiat.selectznz(&v, @truncate(u1, f[f.len - 1] >> (meta.bitCount(Word) - 1)), v, v_opp);
238 var fe: Fe = undefined;
239 fiat.mul(&fe.limbs, v, precomp);
240 return fe;
241 }
242
243 /// Return true if the field element is a square.
244 pub fn isSquare(x2: Fe) bool {
245 if (field_order == 115792089210356248762697446949407573530086143415290314195533631308867097853951) {
246 const t110 = x2.mul(x2.sq()).sq();
247 const t111 = x2.mul(t110);
248 const t111111 = t111.mul(x2.mul(t110).sqn(3));
249 const x15 = t111111.sqn(6).mul(t111111).sqn(3).mul(t111);
250 const x16 = x15.sq().mul(x2);
251 const x53 = x16.sqn(16).mul(x16).sqn(15);
252 const x47 = x15.mul(x53);
253 const ls = x47.mul(((x53.sqn(17).mul(x2)).sqn(143).mul(x47)).sqn(47)).sq().mul(x2);
254 return ls.equivalent(Fe.one);
255 } else {
256 const ls = x2.pow(std.meta.Int(.unsigned, field_bits), (field_order - 1) / 2); // Legendre symbol
257 return ls.equivalent(Fe.one);
258 }
259 }
260
261 // x=x2^((field_order+1)/4) w/ field order=3 (mod 4).
262 fn uncheckedSqrt(x2: Fe) Fe {
263 comptime debug.assert(field_order % 4 == 3);
264 if (field_order == 115792089210356248762697446949407573530086143415290314195533631308867097853951) {
265 const t11 = x2.mul(x2.sq());
266 const t1111 = t11.mul(t11.sqn(2));
267 const t11111111 = t1111.mul(t1111.sqn(4));
268 const x16 = t11111111.sqn(8).mul(t11111111);
269 return x16.sqn(16).mul(x16).sqn(32).mul(x2).sqn(96).mul(x2).sqn(94);
270 } else {
271 return x2.pow(std.meta.Int(.unsigned, field_bits), (field_order + 1) / 4);
272 }
273 }
274
275 /// Compute the square root of `x2`, returning `error.NotSquare` if `x2` was not a square.
276 pub fn sqrt(x2: Fe) NotSquareError!Fe {
277 const x = x2.uncheckedSqrt();
278 if (x.sq().equivalent(x2)) {
279 return x;
280 }
281 return error.NotSquare;
282 }
283 };
284}
lib/std/crypto/pcurves/p256/field.zig+9-252
...@@ -5,257 +5,14 @@...@@ -5,257 +5,14 @@
5// and substantial portions of the software.5// and substantial portions of the software.
66
7const std = @import("std");7const std = @import("std");
8const builtin = std.builtin;8const common = @import("../common.zig");
9const crypto = std.crypto;
10const debug = std.debug;
11const mem = std.mem;
12const meta = std.meta;
139
14const fiat = @import("p256_64.zig");10const Field = common.Field;
1511
16const NonCanonicalError = crypto.errors.NonCanonicalError;12pub const Fe = Field(.{
17const NotSquareError = crypto.errors.NotSquareError;13 .fiat = @import("p256_64.zig"),
1814 .field_order = 115792089210356248762697446949407573530086143415290314195533631308867097853951,
19const Limbs = fiat.Limbs;15 .field_bits = 256,
2016 .saturated_bits = 255,
21/// A field element, internally stored in Montgomery domain.17 .encoded_length = 32,
22pub const Fe = struct {18});
23 limbs: Limbs,
24
25 /// Field size.
26 pub const field_order = 115792089210356248762697446949407573530086143415290314195533631308867097853951;
27
28 /// Numer of bits that can be saturated without overflowing.
29 pub const saturated_bits = 255;
30
31 /// Zero.
32 pub const zero: Fe = Fe{ .limbs = mem.zeroes(Limbs) };
33
34 /// One.
35 pub const one = comptime one: {
36 var fe: Fe = undefined;
37 fiat.p256SetOne(&fe.limbs);
38 break :one fe;
39 };
40
41 /// Reject non-canonical encodings of an element.
42 pub fn rejectNonCanonical(s_: [32]u8, endian: builtin.Endian) NonCanonicalError!void {
43 var s = if (endian == .Little) s_ else orderSwap(s_);
44 const field_order_s = comptime fos: {
45 var fos: [32]u8 = undefined;
46 mem.writeIntLittle(u256, &fos, field_order);
47 break :fos fos;
48 };
49 if (crypto.utils.timingSafeCompare(u8, &s, &field_order_s, .Little) != .lt) {
50 return error.NonCanonical;
51 }
52 }
53
54 /// Swap the endianness of an encoded element.
55 pub fn orderSwap(s: [32]u8) [32]u8 {
56 var t = s;
57 for (s) |x, i| t[t.len - 1 - i] = x;
58 return t;
59 }
60
61 /// Unpack a field element.
62 pub fn fromBytes(s_: [32]u8, endian: builtin.Endian) NonCanonicalError!Fe {
63 var s = if (endian == .Little) s_ else orderSwap(s_);
64 try rejectNonCanonical(s, .Little);
65 var limbs_z: Limbs = undefined;
66 fiat.p256FromBytes(&limbs_z, s);
67 var limbs: Limbs = undefined;
68 fiat.p256ToMontgomery(&limbs, limbs_z);
69 return Fe{ .limbs = limbs };
70 }
71
72 /// Pack a field element.
73 pub fn toBytes(fe: Fe, endian: builtin.Endian) [32]u8 {
74 var limbs_z: Limbs = undefined;
75 fiat.p256FromMontgomery(&limbs_z, fe.limbs);
76 var s: [32]u8 = undefined;
77 fiat.p256ToBytes(&s, limbs_z);
78 return if (endian == .Little) s else orderSwap(s);
79 }
80
81 /// Create a field element from an integer.
82 pub fn fromInt(comptime x: u256) NonCanonicalError!Fe {
83 var s: [32]u8 = undefined;
84 mem.writeIntLittle(u256, &s, x);
85 return fromBytes(s, .Little);
86 }
87
88 /// Return the field element as an integer.
89 pub fn toInt(fe: Fe) u256 {
90 const s = fe.toBytes(.Little);
91 return mem.readIntLittle(u256, &s);
92 }
93
94 /// Return true if the field element is zero.
95 pub fn isZero(fe: Fe) bool {
96 var z: @TypeOf(fe.limbs[0]) = undefined;
97 fiat.p256Nonzero(&z, fe.limbs);
98 return z == 0;
99 }
100
101 /// Return true if both field elements are equivalent.
102 pub fn equivalent(a: Fe, b: Fe) bool {
103 return a.sub(b).isZero();
104 }
105
106 /// Return true if the element is odd.
107 pub fn isOdd(fe: Fe) bool {
108 const s = fe.toBytes(.Little);
109 return @truncate(u1, s[0]) != 0;
110 }
111
112 /// Conditonally replace a field element with `a` if `c` is positive.
113 pub fn cMov(fe: *Fe, a: Fe, c: u1) void {
114 fiat.p256Selectznz(&fe.limbs, c, fe.limbs, a.limbs);
115 }
116
117 /// Add field elements.
118 pub fn add(a: Fe, b: Fe) Fe {
119 var fe: Fe = undefined;
120 fiat.p256Add(&fe.limbs, a.limbs, b.limbs);
121 return fe;
122 }
123
124 /// Subtract field elements.
125 pub fn sub(a: Fe, b: Fe) Fe {
126 var fe: Fe = undefined;
127 fiat.p256Sub(&fe.limbs, a.limbs, b.limbs);
128 return fe;
129 }
130
131 /// Double a field element.
132 pub fn dbl(a: Fe) Fe {
133 var fe: Fe = undefined;
134 fiat.p256Add(&fe.limbs, a.limbs, a.limbs);
135 return fe;
136 }
137
138 /// Multiply field elements.
139 pub fn mul(a: Fe, b: Fe) Fe {
140 var fe: Fe = undefined;
141 fiat.p256Mul(&fe.limbs, a.limbs, b.limbs);
142 return fe;
143 }
144
145 /// Square a field element.
146 pub fn sq(a: Fe) Fe {
147 var fe: Fe = undefined;
148 fiat.p256Square(&fe.limbs, a.limbs);
149 return fe;
150 }
151
152 /// Square a field element n times.
153 fn sqn(a: Fe, comptime n: comptime_int) Fe {
154 var i: usize = 0;
155 var fe = a;
156 while (i < n) : (i += 1) {
157 fe = fe.sq();
158 }
159 return fe;
160 }
161
162 /// Compute a^n.
163 pub fn pow(a: Fe, comptime T: type, comptime n: T) Fe {
164 var fe = one;
165 var x: T = n;
166 var t = a;
167 while (true) {
168 if (@truncate(u1, x) != 0) fe = fe.mul(t);
169 x >>= 1;
170 if (x == 0) break;
171 t = t.sq();
172 }
173 return fe;
174 }
175
176 /// Negate a field element.
177 pub fn neg(a: Fe) Fe {
178 var fe: Fe = undefined;
179 fiat.p256Opp(&fe.limbs, a.limbs);
180 return fe;
181 }
182
183 /// Return the inverse of a field element, or 0 if a=0.
184 // Field inversion from https://eprint.iacr.org/2021/549.pdf
185 pub fn invert(a: Fe) Fe {
186 const len_prime = 256;
187 const iterations = (49 * len_prime + 57) / 17;
188 const Word = @TypeOf(a.limbs[0]);
189 const XLimbs = [a.limbs.len + 1]Word;
190
191 var d: Word = 1;
192 var f: XLimbs = undefined;
193 fiat.p256Msat(&f);
194
195 var g: XLimbs = undefined;
196 fiat.p256FromMontgomery(g[0..a.limbs.len], a.limbs);
197 g[g.len - 1] = 0;
198
199 var r: Limbs = undefined;
200 fiat.p256SetOne(&r);
201 var v = mem.zeroes(Limbs);
202
203 var precomp: Limbs = undefined;
204 fiat.p256DivstepPrecomp(&precomp);
205
206 var out1: Word = undefined;
207 var out2: XLimbs = undefined;
208 var out3: XLimbs = undefined;
209 var out4: Limbs = undefined;
210 var out5: Limbs = undefined;
211
212 var i: usize = 0;
213 while (i < iterations - iterations % 2) : (i += 2) {
214 fiat.p256Divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
215 fiat.p256Divstep(&d, &f, &g, &v, &r, out1, out2, out3, out4, out5);
216 }
217 if (iterations % 2 != 0) {
218 fiat.p256Divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
219 mem.copy(Word, &v, &out4);
220 mem.copy(Word, &f, &out2);
221 }
222 var v_opp: Limbs = undefined;
223 fiat.p256Opp(&v_opp, v);
224 fiat.p256Selectznz(&v, @truncate(u1, f[f.len - 1] >> (meta.bitCount(Word) - 1)), v, v_opp);
225 var fe: Fe = undefined;
226 fiat.p256Mul(&fe.limbs, v, precomp);
227 return fe;
228 }
229
230 /// Return true if the field element is a square.
231 pub fn isSquare(x2: Fe) bool {
232 const t110 = x2.mul(x2.sq()).sq();
233 const t111 = x2.mul(t110);
234 const t111111 = t111.mul(x2.mul(t110).sqn(3));
235 const x15 = t111111.sqn(6).mul(t111111).sqn(3).mul(t111);
236 const x16 = x15.sq().mul(x2);
237 const x53 = x16.sqn(16).mul(x16).sqn(15);
238 const x47 = x15.mul(x53);
239 const ls = x47.mul(((x53.sqn(17).mul(x2)).sqn(143).mul(x47)).sqn(47)).sq().mul(x2); // Legendre symbol, (p-1)/2
240 return ls.equivalent(Fe.one);
241 }
242
243 // x=x2^((field_order+1)/4) w/ field order=3 (mod 4).
244 fn uncheckedSqrt(x2: Fe) Fe {
245 comptime debug.assert(field_order % 4 == 3);
246 const t11 = x2.mul(x2.sq());
247 const t1111 = t11.mul(t11.sqn(2));
248 const t11111111 = t1111.mul(t1111.sqn(4));
249 const x16 = t11111111.sqn(8).mul(t11111111);
250 return x16.sqn(16).mul(x16).sqn(32).mul(x2).sqn(96).mul(x2).sqn(94);
251 }
252
253 /// Compute the square root of `x2`, returning `error.NotSquare` if `x2` was not a square.
254 pub fn sqrt(x2: Fe) NotSquareError!Fe {
255 const x = x2.uncheckedSqrt();
256 if (x.sq().equivalent(x2)) {
257 return x;
258 }
259 return error.NotSquare;
260 }
261};
lib/std/crypto/pcurves/p256/p256_64.zig+673-635
...@@ -1,11 +1,5 @@...@@ -1,11 +1,5 @@
1// SPDX-License-Identifier: MIT1// Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase --no-prefix-fiat --package-name p256 '' 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp
2// Copyright (c) 2015-2021 Zig Contributors2// curve description (via package name): p256
3// This file is part of [zig](https://ziglang.org/), which is MIT licensed.
4// The MIT license requires this copyright notice to be included in all copies
5// and substantial portions of the software.
6
7// Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase p256 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp
8// curve description: p256
9// machine_wordsize = 64 (from "64")3// machine_wordsize = 64 (from "64")
10// requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp4// requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp
11// m = 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff (from "2^256 - 2^224 + 2^192 + 2^96 - 1")5// m = 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff (from "2^256 - 2^224 + 2^192 + 2^96 - 1")
...@@ -20,10 +14,16 @@...@@ -20,10 +14,16 @@
20// Computed values:14// Computed values:
21// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)15// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
22// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)16// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
17// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
18// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
19
20const std = @import("std");
21const cast = std.meta.cast;
22const mode = std.builtin.mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
2323
24pub const Limbs = [4]u64;24pub const Limbs = [4]u64;
2525
26/// The function p256AddcarryxU64 is an addition with carry.26/// The function addcarryxU64 is an addition with carry.
27/// Postconditions:27/// Postconditions:
28/// out1 = (arg1 + arg2 + arg3) mod 2^6428/// out1 = (arg1 + arg2 + arg3) mod 2^64
29/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋29/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
...@@ -35,14 +35,16 @@ pub const Limbs = [4]u64;...@@ -35,14 +35,16 @@ pub const Limbs = [4]u64;
35/// Output Bounds:35/// Output Bounds:
36/// out1: [0x0 ~> 0xffffffffffffffff]36/// out1: [0x0 ~> 0xffffffffffffffff]
37/// out2: [0x0 ~> 0x1]37/// out2: [0x0 ~> 0x1]
38fn p256AddcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {38fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
39 @setRuntimeSafety(mode == .Debug);
40
39 var t: u64 = undefined;41 var t: u64 = undefined;
40 const carry1 = @addWithOverflow(u64, arg2, arg3, &t);42 const carry1 = @addWithOverflow(u64, arg2, arg3, &t);
41 const carry2 = @addWithOverflow(u64, t, arg1, out1);43 const carry2 = @addWithOverflow(u64, t, arg1, out1);
42 out2.* = @boolToInt(carry1) | @boolToInt(carry2);44 out2.* = @boolToInt(carry1) | @boolToInt(carry2);
43}45}
4446
45/// The function p256SubborrowxU64 is a subtraction with borrow.47/// The function subborrowxU64 is a subtraction with borrow.
46/// Postconditions:48/// Postconditions:
47/// out1 = (-arg1 + arg2 + -arg3) mod 2^6449/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
48/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋50/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
...@@ -54,14 +56,16 @@ fn p256AddcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callc...@@ -54,14 +56,16 @@ fn p256AddcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callc
54/// Output Bounds:56/// Output Bounds:
55/// out1: [0x0 ~> 0xffffffffffffffff]57/// out1: [0x0 ~> 0xffffffffffffffff]
56/// out2: [0x0 ~> 0x1]58/// out2: [0x0 ~> 0x1]
57fn p256SubborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {59fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
60 @setRuntimeSafety(mode == .Debug);
61
58 var t: u64 = undefined;62 var t: u64 = undefined;
59 const carry1 = @subWithOverflow(u64, arg2, arg3, &t);63 const carry1 = @subWithOverflow(u64, arg2, arg3, &t);
60 const carry2 = @subWithOverflow(u64, t, arg1, out1);64 const carry2 = @subWithOverflow(u64, t, arg1, out1);
61 out2.* = @boolToInt(carry1) | @boolToInt(carry2);65 out2.* = @boolToInt(carry1) | @boolToInt(carry2);
62}66}
6367
64/// The function p256MulxU64 is a multiplication, returning the full double-width result.68/// The function mulxU64 is a multiplication, returning the full double-width result.
65/// Postconditions:69/// Postconditions:
66/// out1 = (arg1 * arg2) mod 2^6470/// out1 = (arg1 * arg2) mod 2^64
67/// out2 = ⌊arg1 * arg2 / 2^64⌋71/// out2 = ⌊arg1 * arg2 / 2^64⌋
...@@ -72,13 +76,15 @@ fn p256SubborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) call...@@ -72,13 +76,15 @@ fn p256SubborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) call
72/// Output Bounds:76/// Output Bounds:
73/// out1: [0x0 ~> 0xffffffffffffffff]77/// out1: [0x0 ~> 0xffffffffffffffff]
74/// out2: [0x0 ~> 0xffffffffffffffff]78/// out2: [0x0 ~> 0xffffffffffffffff]
75fn p256MulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) callconv(.Inline) void {79fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) callconv(.Inline) void {
80 @setRuntimeSafety(mode == .Debug);
81
76 const x = @as(u128, arg1) * @as(u128, arg2);82 const x = @as(u128, arg1) * @as(u128, arg2);
77 out1.* = @truncate(u64, x);83 out1.* = @truncate(u64, x);
78 out2.* = @truncate(u64, x >> 64);84 out2.* = @truncate(u64, x >> 64);
79}85}
8086
81/// The function p256CmovznzU64 is a single-word conditional move.87/// The function cmovznzU64 is a single-word conditional move.
82/// Postconditions:88/// Postconditions:
83/// out1 = (if arg1 = 0 then arg2 else arg3)89/// out1 = (if arg1 = 0 then arg2 else arg3)
84///90///
...@@ -88,12 +94,14 @@ fn p256MulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) callconv(.Inline) v...@@ -88,12 +94,14 @@ fn p256MulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) callconv(.Inline) v
88/// arg3: [0x0 ~> 0xffffffffffffffff]94/// arg3: [0x0 ~> 0xffffffffffffffff]
89/// Output Bounds:95/// Output Bounds:
90/// out1: [0x0 ~> 0xffffffffffffffff]96/// out1: [0x0 ~> 0xffffffffffffffff]
91fn p256CmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {97fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
98 @setRuntimeSafety(mode == .Debug);
99
92 const mask = 0 -% @as(u64, arg1);100 const mask = 0 -% @as(u64, arg1);
93 out1.* = (mask & arg3) | ((~mask) & arg2);101 out1.* = (mask & arg3) | ((~mask) & arg2);
94}102}
95103
96/// The function p256Mul multiplies two field elements in the Montgomery domain.104/// The function mul multiplies two field elements in the Montgomery domain.
97/// Preconditions:105/// Preconditions:
98/// 0 ≤ eval arg1 < m106/// 0 ≤ eval arg1 < m
99/// 0 ≤ eval arg2 < m107/// 0 ≤ eval arg2 < m
...@@ -106,289 +114,291 @@ fn p256CmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline)...@@ -106,289 +114,291 @@ fn p256CmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline)
106/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]114/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
107/// Output Bounds:115/// Output Bounds:
108/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]116/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
109pub fn p256Mul(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {117pub fn mul(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
110 const x1: u64 = (arg1[1]);118 @setRuntimeSafety(mode == .Debug);
111 const x2: u64 = (arg1[2]);119
112 const x3: u64 = (arg1[3]);120 const x1 = (arg1[1]);
113 const x4: u64 = (arg1[0]);121 const x2 = (arg1[2]);
122 const x3 = (arg1[3]);
123 const x4 = (arg1[0]);
114 var x5: u64 = undefined;124 var x5: u64 = undefined;
115 var x6: u64 = undefined;125 var x6: u64 = undefined;
116 p256MulxU64(&x5, &x6, x4, (arg2[3]));126 mulxU64(&x5, &x6, x4, (arg2[3]));
117 var x7: u64 = undefined;127 var x7: u64 = undefined;
118 var x8: u64 = undefined;128 var x8: u64 = undefined;
119 p256MulxU64(&x7, &x8, x4, (arg2[2]));129 mulxU64(&x7, &x8, x4, (arg2[2]));
120 var x9: u64 = undefined;130 var x9: u64 = undefined;
121 var x10: u64 = undefined;131 var x10: u64 = undefined;
122 p256MulxU64(&x9, &x10, x4, (arg2[1]));132 mulxU64(&x9, &x10, x4, (arg2[1]));
123 var x11: u64 = undefined;133 var x11: u64 = undefined;
124 var x12: u64 = undefined;134 var x12: u64 = undefined;
125 p256MulxU64(&x11, &x12, x4, (arg2[0]));135 mulxU64(&x11, &x12, x4, (arg2[0]));
126 var x13: u64 = undefined;136 var x13: u64 = undefined;
127 var x14: u1 = undefined;137 var x14: u1 = undefined;
128 p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);138 addcarryxU64(&x13, &x14, 0x0, x12, x9);
129 var x15: u64 = undefined;139 var x15: u64 = undefined;
130 var x16: u1 = undefined;140 var x16: u1 = undefined;
131 p256AddcarryxU64(&x15, &x16, x14, x10, x7);141 addcarryxU64(&x15, &x16, x14, x10, x7);
132 var x17: u64 = undefined;142 var x17: u64 = undefined;
133 var x18: u1 = undefined;143 var x18: u1 = undefined;
134 p256AddcarryxU64(&x17, &x18, x16, x8, x5);144 addcarryxU64(&x17, &x18, x16, x8, x5);
135 const x19: u64 = (@intCast(u64, x18) + x6);145 const x19 = (cast(u64, x18) + x6);
136 var x20: u64 = undefined;146 var x20: u64 = undefined;
137 var x21: u64 = undefined;147 var x21: u64 = undefined;
138 p256MulxU64(&x20, &x21, x11, 0xffffffff00000001);148 mulxU64(&x20, &x21, x11, 0xffffffff00000001);
139 var x22: u64 = undefined;149 var x22: u64 = undefined;
140 var x23: u64 = undefined;150 var x23: u64 = undefined;
141 p256MulxU64(&x22, &x23, x11, 0xffffffff);151 mulxU64(&x22, &x23, x11, 0xffffffff);
142 var x24: u64 = undefined;152 var x24: u64 = undefined;
143 var x25: u64 = undefined;153 var x25: u64 = undefined;
144 p256MulxU64(&x24, &x25, x11, 0xffffffffffffffff);154 mulxU64(&x24, &x25, x11, 0xffffffffffffffff);
145 var x26: u64 = undefined;155 var x26: u64 = undefined;
146 var x27: u1 = undefined;156 var x27: u1 = undefined;
147 p256AddcarryxU64(&x26, &x27, 0x0, x25, x22);157 addcarryxU64(&x26, &x27, 0x0, x25, x22);
148 const x28: u64 = (@intCast(u64, x27) + x23);158 const x28 = (cast(u64, x27) + x23);
149 var x29: u64 = undefined;159 var x29: u64 = undefined;
150 var x30: u1 = undefined;160 var x30: u1 = undefined;
151 p256AddcarryxU64(&x29, &x30, 0x0, x11, x24);161 addcarryxU64(&x29, &x30, 0x0, x11, x24);
152 var x31: u64 = undefined;162 var x31: u64 = undefined;
153 var x32: u1 = undefined;163 var x32: u1 = undefined;
154 p256AddcarryxU64(&x31, &x32, x30, x13, x26);164 addcarryxU64(&x31, &x32, x30, x13, x26);
155 var x33: u64 = undefined;165 var x33: u64 = undefined;
156 var x34: u1 = undefined;166 var x34: u1 = undefined;
157 p256AddcarryxU64(&x33, &x34, x32, x15, x28);167 addcarryxU64(&x33, &x34, x32, x15, x28);
158 var x35: u64 = undefined;168 var x35: u64 = undefined;
159 var x36: u1 = undefined;169 var x36: u1 = undefined;
160 p256AddcarryxU64(&x35, &x36, x34, x17, x20);170 addcarryxU64(&x35, &x36, x34, x17, x20);
161 var x37: u64 = undefined;171 var x37: u64 = undefined;
162 var x38: u1 = undefined;172 var x38: u1 = undefined;
163 p256AddcarryxU64(&x37, &x38, x36, x19, x21);173 addcarryxU64(&x37, &x38, x36, x19, x21);
164 var x39: u64 = undefined;174 var x39: u64 = undefined;
165 var x40: u64 = undefined;175 var x40: u64 = undefined;
166 p256MulxU64(&x39, &x40, x1, (arg2[3]));176 mulxU64(&x39, &x40, x1, (arg2[3]));
167 var x41: u64 = undefined;177 var x41: u64 = undefined;
168 var x42: u64 = undefined;178 var x42: u64 = undefined;
169 p256MulxU64(&x41, &x42, x1, (arg2[2]));179 mulxU64(&x41, &x42, x1, (arg2[2]));
170 var x43: u64 = undefined;180 var x43: u64 = undefined;
171 var x44: u64 = undefined;181 var x44: u64 = undefined;
172 p256MulxU64(&x43, &x44, x1, (arg2[1]));182 mulxU64(&x43, &x44, x1, (arg2[1]));
173 var x45: u64 = undefined;183 var x45: u64 = undefined;
174 var x46: u64 = undefined;184 var x46: u64 = undefined;
175 p256MulxU64(&x45, &x46, x1, (arg2[0]));185 mulxU64(&x45, &x46, x1, (arg2[0]));
176 var x47: u64 = undefined;186 var x47: u64 = undefined;
177 var x48: u1 = undefined;187 var x48: u1 = undefined;
178 p256AddcarryxU64(&x47, &x48, 0x0, x46, x43);188 addcarryxU64(&x47, &x48, 0x0, x46, x43);
179 var x49: u64 = undefined;189 var x49: u64 = undefined;
180 var x50: u1 = undefined;190 var x50: u1 = undefined;
181 p256AddcarryxU64(&x49, &x50, x48, x44, x41);191 addcarryxU64(&x49, &x50, x48, x44, x41);
182 var x51: u64 = undefined;192 var x51: u64 = undefined;
183 var x52: u1 = undefined;193 var x52: u1 = undefined;
184 p256AddcarryxU64(&x51, &x52, x50, x42, x39);194 addcarryxU64(&x51, &x52, x50, x42, x39);
185 const x53: u64 = (@intCast(u64, x52) + x40);195 const x53 = (cast(u64, x52) + x40);
186 var x54: u64 = undefined;196 var x54: u64 = undefined;
187 var x55: u1 = undefined;197 var x55: u1 = undefined;
188 p256AddcarryxU64(&x54, &x55, 0x0, x31, x45);198 addcarryxU64(&x54, &x55, 0x0, x31, x45);
189 var x56: u64 = undefined;199 var x56: u64 = undefined;
190 var x57: u1 = undefined;200 var x57: u1 = undefined;
191 p256AddcarryxU64(&x56, &x57, x55, x33, x47);201 addcarryxU64(&x56, &x57, x55, x33, x47);
192 var x58: u64 = undefined;202 var x58: u64 = undefined;
193 var x59: u1 = undefined;203 var x59: u1 = undefined;
194 p256AddcarryxU64(&x58, &x59, x57, x35, x49);204 addcarryxU64(&x58, &x59, x57, x35, x49);
195 var x60: u64 = undefined;205 var x60: u64 = undefined;
196 var x61: u1 = undefined;206 var x61: u1 = undefined;
197 p256AddcarryxU64(&x60, &x61, x59, x37, x51);207 addcarryxU64(&x60, &x61, x59, x37, x51);
198 var x62: u64 = undefined;208 var x62: u64 = undefined;
199 var x63: u1 = undefined;209 var x63: u1 = undefined;
200 p256AddcarryxU64(&x62, &x63, x61, @intCast(u64, x38), x53);210 addcarryxU64(&x62, &x63, x61, cast(u64, x38), x53);
201 var x64: u64 = undefined;211 var x64: u64 = undefined;
202 var x65: u64 = undefined;212 var x65: u64 = undefined;
203 p256MulxU64(&x64, &x65, x54, 0xffffffff00000001);213 mulxU64(&x64, &x65, x54, 0xffffffff00000001);
204 var x66: u64 = undefined;214 var x66: u64 = undefined;
205 var x67: u64 = undefined;215 var x67: u64 = undefined;
206 p256MulxU64(&x66, &x67, x54, 0xffffffff);216 mulxU64(&x66, &x67, x54, 0xffffffff);
207 var x68: u64 = undefined;217 var x68: u64 = undefined;
208 var x69: u64 = undefined;218 var x69: u64 = undefined;
209 p256MulxU64(&x68, &x69, x54, 0xffffffffffffffff);219 mulxU64(&x68, &x69, x54, 0xffffffffffffffff);
210 var x70: u64 = undefined;220 var x70: u64 = undefined;
211 var x71: u1 = undefined;221 var x71: u1 = undefined;
212 p256AddcarryxU64(&x70, &x71, 0x0, x69, x66);222 addcarryxU64(&x70, &x71, 0x0, x69, x66);
213 const x72: u64 = (@intCast(u64, x71) + x67);223 const x72 = (cast(u64, x71) + x67);
214 var x73: u64 = undefined;224 var x73: u64 = undefined;
215 var x74: u1 = undefined;225 var x74: u1 = undefined;
216 p256AddcarryxU64(&x73, &x74, 0x0, x54, x68);226 addcarryxU64(&x73, &x74, 0x0, x54, x68);
217 var x75: u64 = undefined;227 var x75: u64 = undefined;
218 var x76: u1 = undefined;228 var x76: u1 = undefined;
219 p256AddcarryxU64(&x75, &x76, x74, x56, x70);229 addcarryxU64(&x75, &x76, x74, x56, x70);
220 var x77: u64 = undefined;230 var x77: u64 = undefined;
221 var x78: u1 = undefined;231 var x78: u1 = undefined;
222 p256AddcarryxU64(&x77, &x78, x76, x58, x72);232 addcarryxU64(&x77, &x78, x76, x58, x72);
223 var x79: u64 = undefined;233 var x79: u64 = undefined;
224 var x80: u1 = undefined;234 var x80: u1 = undefined;
225 p256AddcarryxU64(&x79, &x80, x78, x60, x64);235 addcarryxU64(&x79, &x80, x78, x60, x64);
226 var x81: u64 = undefined;236 var x81: u64 = undefined;
227 var x82: u1 = undefined;237 var x82: u1 = undefined;
228 p256AddcarryxU64(&x81, &x82, x80, x62, x65);238 addcarryxU64(&x81, &x82, x80, x62, x65);
229 const x83: u64 = (@intCast(u64, x82) + @intCast(u64, x63));239 const x83 = (cast(u64, x82) + cast(u64, x63));
230 var x84: u64 = undefined;240 var x84: u64 = undefined;
231 var x85: u64 = undefined;241 var x85: u64 = undefined;
232 p256MulxU64(&x84, &x85, x2, (arg2[3]));242 mulxU64(&x84, &x85, x2, (arg2[3]));
233 var x86: u64 = undefined;243 var x86: u64 = undefined;
234 var x87: u64 = undefined;244 var x87: u64 = undefined;
235 p256MulxU64(&x86, &x87, x2, (arg2[2]));245 mulxU64(&x86, &x87, x2, (arg2[2]));
236 var x88: u64 = undefined;246 var x88: u64 = undefined;
237 var x89: u64 = undefined;247 var x89: u64 = undefined;
238 p256MulxU64(&x88, &x89, x2, (arg2[1]));248 mulxU64(&x88, &x89, x2, (arg2[1]));
239 var x90: u64 = undefined;249 var x90: u64 = undefined;
240 var x91: u64 = undefined;250 var x91: u64 = undefined;
241 p256MulxU64(&x90, &x91, x2, (arg2[0]));251 mulxU64(&x90, &x91, x2, (arg2[0]));
242 var x92: u64 = undefined;252 var x92: u64 = undefined;
243 var x93: u1 = undefined;253 var x93: u1 = undefined;
244 p256AddcarryxU64(&x92, &x93, 0x0, x91, x88);254 addcarryxU64(&x92, &x93, 0x0, x91, x88);
245 var x94: u64 = undefined;255 var x94: u64 = undefined;
246 var x95: u1 = undefined;256 var x95: u1 = undefined;
247 p256AddcarryxU64(&x94, &x95, x93, x89, x86);257 addcarryxU64(&x94, &x95, x93, x89, x86);
248 var x96: u64 = undefined;258 var x96: u64 = undefined;
249 var x97: u1 = undefined;259 var x97: u1 = undefined;
250 p256AddcarryxU64(&x96, &x97, x95, x87, x84);260 addcarryxU64(&x96, &x97, x95, x87, x84);
251 const x98: u64 = (@intCast(u64, x97) + x85);261 const x98 = (cast(u64, x97) + x85);
252 var x99: u64 = undefined;262 var x99: u64 = undefined;
253 var x100: u1 = undefined;263 var x100: u1 = undefined;
254 p256AddcarryxU64(&x99, &x100, 0x0, x75, x90);264 addcarryxU64(&x99, &x100, 0x0, x75, x90);
255 var x101: u64 = undefined;265 var x101: u64 = undefined;
256 var x102: u1 = undefined;266 var x102: u1 = undefined;
257 p256AddcarryxU64(&x101, &x102, x100, x77, x92);267 addcarryxU64(&x101, &x102, x100, x77, x92);
258 var x103: u64 = undefined;268 var x103: u64 = undefined;
259 var x104: u1 = undefined;269 var x104: u1 = undefined;
260 p256AddcarryxU64(&x103, &x104, x102, x79, x94);270 addcarryxU64(&x103, &x104, x102, x79, x94);
261 var x105: u64 = undefined;271 var x105: u64 = undefined;
262 var x106: u1 = undefined;272 var x106: u1 = undefined;
263 p256AddcarryxU64(&x105, &x106, x104, x81, x96);273 addcarryxU64(&x105, &x106, x104, x81, x96);
264 var x107: u64 = undefined;274 var x107: u64 = undefined;
265 var x108: u1 = undefined;275 var x108: u1 = undefined;
266 p256AddcarryxU64(&x107, &x108, x106, x83, x98);276 addcarryxU64(&x107, &x108, x106, x83, x98);
267 var x109: u64 = undefined;277 var x109: u64 = undefined;
268 var x110: u64 = undefined;278 var x110: u64 = undefined;
269 p256MulxU64(&x109, &x110, x99, 0xffffffff00000001);279 mulxU64(&x109, &x110, x99, 0xffffffff00000001);
270 var x111: u64 = undefined;280 var x111: u64 = undefined;
271 var x112: u64 = undefined;281 var x112: u64 = undefined;
272 p256MulxU64(&x111, &x112, x99, 0xffffffff);282 mulxU64(&x111, &x112, x99, 0xffffffff);
273 var x113: u64 = undefined;283 var x113: u64 = undefined;
274 var x114: u64 = undefined;284 var x114: u64 = undefined;
275 p256MulxU64(&x113, &x114, x99, 0xffffffffffffffff);285 mulxU64(&x113, &x114, x99, 0xffffffffffffffff);
276 var x115: u64 = undefined;286 var x115: u64 = undefined;
277 var x116: u1 = undefined;287 var x116: u1 = undefined;
278 p256AddcarryxU64(&x115, &x116, 0x0, x114, x111);288 addcarryxU64(&x115, &x116, 0x0, x114, x111);
279 const x117: u64 = (@intCast(u64, x116) + x112);289 const x117 = (cast(u64, x116) + x112);
280 var x118: u64 = undefined;290 var x118: u64 = undefined;
281 var x119: u1 = undefined;291 var x119: u1 = undefined;
282 p256AddcarryxU64(&x118, &x119, 0x0, x99, x113);292 addcarryxU64(&x118, &x119, 0x0, x99, x113);
283 var x120: u64 = undefined;293 var x120: u64 = undefined;
284 var x121: u1 = undefined;294 var x121: u1 = undefined;
285 p256AddcarryxU64(&x120, &x121, x119, x101, x115);295 addcarryxU64(&x120, &x121, x119, x101, x115);
286 var x122: u64 = undefined;296 var x122: u64 = undefined;
287 var x123: u1 = undefined;297 var x123: u1 = undefined;
288 p256AddcarryxU64(&x122, &x123, x121, x103, x117);298 addcarryxU64(&x122, &x123, x121, x103, x117);
289 var x124: u64 = undefined;299 var x124: u64 = undefined;
290 var x125: u1 = undefined;300 var x125: u1 = undefined;
291 p256AddcarryxU64(&x124, &x125, x123, x105, x109);301 addcarryxU64(&x124, &x125, x123, x105, x109);
292 var x126: u64 = undefined;302 var x126: u64 = undefined;
293 var x127: u1 = undefined;303 var x127: u1 = undefined;
294 p256AddcarryxU64(&x126, &x127, x125, x107, x110);304 addcarryxU64(&x126, &x127, x125, x107, x110);
295 const x128: u64 = (@intCast(u64, x127) + @intCast(u64, x108));305 const x128 = (cast(u64, x127) + cast(u64, x108));
296 var x129: u64 = undefined;306 var x129: u64 = undefined;
297 var x130: u64 = undefined;307 var x130: u64 = undefined;
298 p256MulxU64(&x129, &x130, x3, (arg2[3]));308 mulxU64(&x129, &x130, x3, (arg2[3]));
299 var x131: u64 = undefined;309 var x131: u64 = undefined;
300 var x132: u64 = undefined;310 var x132: u64 = undefined;
301 p256MulxU64(&x131, &x132, x3, (arg2[2]));311 mulxU64(&x131, &x132, x3, (arg2[2]));
302 var x133: u64 = undefined;312 var x133: u64 = undefined;
303 var x134: u64 = undefined;313 var x134: u64 = undefined;
304 p256MulxU64(&x133, &x134, x3, (arg2[1]));314 mulxU64(&x133, &x134, x3, (arg2[1]));
305 var x135: u64 = undefined;315 var x135: u64 = undefined;
306 var x136: u64 = undefined;316 var x136: u64 = undefined;
307 p256MulxU64(&x135, &x136, x3, (arg2[0]));317 mulxU64(&x135, &x136, x3, (arg2[0]));
308 var x137: u64 = undefined;318 var x137: u64 = undefined;
309 var x138: u1 = undefined;319 var x138: u1 = undefined;
310 p256AddcarryxU64(&x137, &x138, 0x0, x136, x133);320 addcarryxU64(&x137, &x138, 0x0, x136, x133);
311 var x139: u64 = undefined;321 var x139: u64 = undefined;
312 var x140: u1 = undefined;322 var x140: u1 = undefined;
313 p256AddcarryxU64(&x139, &x140, x138, x134, x131);323 addcarryxU64(&x139, &x140, x138, x134, x131);
314 var x141: u64 = undefined;324 var x141: u64 = undefined;
315 var x142: u1 = undefined;325 var x142: u1 = undefined;
316 p256AddcarryxU64(&x141, &x142, x140, x132, x129);326 addcarryxU64(&x141, &x142, x140, x132, x129);
317 const x143: u64 = (@intCast(u64, x142) + x130);327 const x143 = (cast(u64, x142) + x130);
318 var x144: u64 = undefined;328 var x144: u64 = undefined;
319 var x145: u1 = undefined;329 var x145: u1 = undefined;
320 p256AddcarryxU64(&x144, &x145, 0x0, x120, x135);330 addcarryxU64(&x144, &x145, 0x0, x120, x135);
321 var x146: u64 = undefined;331 var x146: u64 = undefined;
322 var x147: u1 = undefined;332 var x147: u1 = undefined;
323 p256AddcarryxU64(&x146, &x147, x145, x122, x137);333 addcarryxU64(&x146, &x147, x145, x122, x137);
324 var x148: u64 = undefined;334 var x148: u64 = undefined;
325 var x149: u1 = undefined;335 var x149: u1 = undefined;
326 p256AddcarryxU64(&x148, &x149, x147, x124, x139);336 addcarryxU64(&x148, &x149, x147, x124, x139);
327 var x150: u64 = undefined;337 var x150: u64 = undefined;
328 var x151: u1 = undefined;338 var x151: u1 = undefined;
329 p256AddcarryxU64(&x150, &x151, x149, x126, x141);339 addcarryxU64(&x150, &x151, x149, x126, x141);
330 var x152: u64 = undefined;340 var x152: u64 = undefined;
331 var x153: u1 = undefined;341 var x153: u1 = undefined;
332 p256AddcarryxU64(&x152, &x153, x151, x128, x143);342 addcarryxU64(&x152, &x153, x151, x128, x143);
333 var x154: u64 = undefined;343 var x154: u64 = undefined;
334 var x155: u64 = undefined;344 var x155: u64 = undefined;
335 p256MulxU64(&x154, &x155, x144, 0xffffffff00000001);345 mulxU64(&x154, &x155, x144, 0xffffffff00000001);
336 var x156: u64 = undefined;346 var x156: u64 = undefined;
337 var x157: u64 = undefined;347 var x157: u64 = undefined;
338 p256MulxU64(&x156, &x157, x144, 0xffffffff);348 mulxU64(&x156, &x157, x144, 0xffffffff);
339 var x158: u64 = undefined;349 var x158: u64 = undefined;
340 var x159: u64 = undefined;350 var x159: u64 = undefined;
341 p256MulxU64(&x158, &x159, x144, 0xffffffffffffffff);351 mulxU64(&x158, &x159, x144, 0xffffffffffffffff);
342 var x160: u64 = undefined;352 var x160: u64 = undefined;
343 var x161: u1 = undefined;353 var x161: u1 = undefined;
344 p256AddcarryxU64(&x160, &x161, 0x0, x159, x156);354 addcarryxU64(&x160, &x161, 0x0, x159, x156);
345 const x162: u64 = (@intCast(u64, x161) + x157);355 const x162 = (cast(u64, x161) + x157);
346 var x163: u64 = undefined;356 var x163: u64 = undefined;
347 var x164: u1 = undefined;357 var x164: u1 = undefined;
348 p256AddcarryxU64(&x163, &x164, 0x0, x144, x158);358 addcarryxU64(&x163, &x164, 0x0, x144, x158);
349 var x165: u64 = undefined;359 var x165: u64 = undefined;
350 var x166: u1 = undefined;360 var x166: u1 = undefined;
351 p256AddcarryxU64(&x165, &x166, x164, x146, x160);361 addcarryxU64(&x165, &x166, x164, x146, x160);
352 var x167: u64 = undefined;362 var x167: u64 = undefined;
353 var x168: u1 = undefined;363 var x168: u1 = undefined;
354 p256AddcarryxU64(&x167, &x168, x166, x148, x162);364 addcarryxU64(&x167, &x168, x166, x148, x162);
355 var x169: u64 = undefined;365 var x169: u64 = undefined;
356 var x170: u1 = undefined;366 var x170: u1 = undefined;
357 p256AddcarryxU64(&x169, &x170, x168, x150, x154);367 addcarryxU64(&x169, &x170, x168, x150, x154);
358 var x171: u64 = undefined;368 var x171: u64 = undefined;
359 var x172: u1 = undefined;369 var x172: u1 = undefined;
360 p256AddcarryxU64(&x171, &x172, x170, x152, x155);370 addcarryxU64(&x171, &x172, x170, x152, x155);
361 const x173: u64 = (@intCast(u64, x172) + @intCast(u64, x153));371 const x173 = (cast(u64, x172) + cast(u64, x153));
362 var x174: u64 = undefined;372 var x174: u64 = undefined;
363 var x175: u1 = undefined;373 var x175: u1 = undefined;
364 p256SubborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);374 subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
365 var x176: u64 = undefined;375 var x176: u64 = undefined;
366 var x177: u1 = undefined;376 var x177: u1 = undefined;
367 p256SubborrowxU64(&x176, &x177, x175, x167, 0xffffffff);377 subborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
368 var x178: u64 = undefined;378 var x178: u64 = undefined;
369 var x179: u1 = undefined;379 var x179: u1 = undefined;
370 p256SubborrowxU64(&x178, &x179, x177, x169, @intCast(u64, 0x0));380 subborrowxU64(&x178, &x179, x177, x169, cast(u64, 0x0));
371 var x180: u64 = undefined;381 var x180: u64 = undefined;
372 var x181: u1 = undefined;382 var x181: u1 = undefined;
373 p256SubborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);383 subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
374 var x182: u64 = undefined;384 var x182: u64 = undefined;
375 var x183: u1 = undefined;385 var x183: u1 = undefined;
376 p256SubborrowxU64(&x182, &x183, x181, x173, @intCast(u64, 0x0));386 subborrowxU64(&x182, &x183, x181, x173, cast(u64, 0x0));
377 var x184: u64 = undefined;387 var x184: u64 = undefined;
378 p256CmovznzU64(&x184, x183, x174, x165);388 cmovznzU64(&x184, x183, x174, x165);
379 var x185: u64 = undefined;389 var x185: u64 = undefined;
380 p256CmovznzU64(&x185, x183, x176, x167);390 cmovznzU64(&x185, x183, x176, x167);
381 var x186: u64 = undefined;391 var x186: u64 = undefined;
382 p256CmovznzU64(&x186, x183, x178, x169);392 cmovznzU64(&x186, x183, x178, x169);
383 var x187: u64 = undefined;393 var x187: u64 = undefined;
384 p256CmovznzU64(&x187, x183, x180, x171);394 cmovznzU64(&x187, x183, x180, x171);
385 out1[0] = x184;395 out1[0] = x184;
386 out1[1] = x185;396 out1[1] = x185;
387 out1[2] = x186;397 out1[2] = x186;
388 out1[3] = x187;398 out1[3] = x187;
389}399}
390400
391/// The function p256Square squares a field element in the Montgomery domain.401/// The function square squares a field element in the Montgomery domain.
392/// Preconditions:402/// Preconditions:
393/// 0 ≤ eval arg1 < m403/// 0 ≤ eval arg1 < m
394/// Postconditions:404/// Postconditions:
...@@ -399,289 +409,291 @@ pub fn p256Mul(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {...@@ -399,289 +409,291 @@ pub fn p256Mul(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
399/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]409/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
400/// Output Bounds:410/// Output Bounds:
401/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]411/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
402pub fn p256Square(out1: *Limbs, arg1: Limbs) void {412pub fn square(out1: *[4]u64, arg1: [4]u64) void {
403 const x1: u64 = (arg1[1]);413 @setRuntimeSafety(mode == .Debug);
404 const x2: u64 = (arg1[2]);414
405 const x3: u64 = (arg1[3]);415 const x1 = (arg1[1]);
406 const x4: u64 = (arg1[0]);416 const x2 = (arg1[2]);
417 const x3 = (arg1[3]);
418 const x4 = (arg1[0]);
407 var x5: u64 = undefined;419 var x5: u64 = undefined;
408 var x6: u64 = undefined;420 var x6: u64 = undefined;
409 p256MulxU64(&x5, &x6, x4, (arg1[3]));421 mulxU64(&x5, &x6, x4, (arg1[3]));
410 var x7: u64 = undefined;422 var x7: u64 = undefined;
411 var x8: u64 = undefined;423 var x8: u64 = undefined;
412 p256MulxU64(&x7, &x8, x4, (arg1[2]));424 mulxU64(&x7, &x8, x4, (arg1[2]));
413 var x9: u64 = undefined;425 var x9: u64 = undefined;
414 var x10: u64 = undefined;426 var x10: u64 = undefined;
415 p256MulxU64(&x9, &x10, x4, (arg1[1]));427 mulxU64(&x9, &x10, x4, (arg1[1]));
416 var x11: u64 = undefined;428 var x11: u64 = undefined;
417 var x12: u64 = undefined;429 var x12: u64 = undefined;
418 p256MulxU64(&x11, &x12, x4, (arg1[0]));430 mulxU64(&x11, &x12, x4, (arg1[0]));
419 var x13: u64 = undefined;431 var x13: u64 = undefined;
420 var x14: u1 = undefined;432 var x14: u1 = undefined;
421 p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);433 addcarryxU64(&x13, &x14, 0x0, x12, x9);
422 var x15: u64 = undefined;434 var x15: u64 = undefined;
423 var x16: u1 = undefined;435 var x16: u1 = undefined;
424 p256AddcarryxU64(&x15, &x16, x14, x10, x7);436 addcarryxU64(&x15, &x16, x14, x10, x7);
425 var x17: u64 = undefined;437 var x17: u64 = undefined;
426 var x18: u1 = undefined;438 var x18: u1 = undefined;
427 p256AddcarryxU64(&x17, &x18, x16, x8, x5);439 addcarryxU64(&x17, &x18, x16, x8, x5);
428 const x19: u64 = (@intCast(u64, x18) + x6);440 const x19 = (cast(u64, x18) + x6);
429 var x20: u64 = undefined;441 var x20: u64 = undefined;
430 var x21: u64 = undefined;442 var x21: u64 = undefined;
431 p256MulxU64(&x20, &x21, x11, 0xffffffff00000001);443 mulxU64(&x20, &x21, x11, 0xffffffff00000001);
432 var x22: u64 = undefined;444 var x22: u64 = undefined;
433 var x23: u64 = undefined;445 var x23: u64 = undefined;
434 p256MulxU64(&x22, &x23, x11, 0xffffffff);446 mulxU64(&x22, &x23, x11, 0xffffffff);
435 var x24: u64 = undefined;447 var x24: u64 = undefined;
436 var x25: u64 = undefined;448 var x25: u64 = undefined;
437 p256MulxU64(&x24, &x25, x11, 0xffffffffffffffff);449 mulxU64(&x24, &x25, x11, 0xffffffffffffffff);
438 var x26: u64 = undefined;450 var x26: u64 = undefined;
439 var x27: u1 = undefined;451 var x27: u1 = undefined;
440 p256AddcarryxU64(&x26, &x27, 0x0, x25, x22);452 addcarryxU64(&x26, &x27, 0x0, x25, x22);
441 const x28: u64 = (@intCast(u64, x27) + x23);453 const x28 = (cast(u64, x27) + x23);
442 var x29: u64 = undefined;454 var x29: u64 = undefined;
443 var x30: u1 = undefined;455 var x30: u1 = undefined;
444 p256AddcarryxU64(&x29, &x30, 0x0, x11, x24);456 addcarryxU64(&x29, &x30, 0x0, x11, x24);
445 var x31: u64 = undefined;457 var x31: u64 = undefined;
446 var x32: u1 = undefined;458 var x32: u1 = undefined;
447 p256AddcarryxU64(&x31, &x32, x30, x13, x26);459 addcarryxU64(&x31, &x32, x30, x13, x26);
448 var x33: u64 = undefined;460 var x33: u64 = undefined;
449 var x34: u1 = undefined;461 var x34: u1 = undefined;
450 p256AddcarryxU64(&x33, &x34, x32, x15, x28);462 addcarryxU64(&x33, &x34, x32, x15, x28);
451 var x35: u64 = undefined;463 var x35: u64 = undefined;
452 var x36: u1 = undefined;464 var x36: u1 = undefined;
453 p256AddcarryxU64(&x35, &x36, x34, x17, x20);465 addcarryxU64(&x35, &x36, x34, x17, x20);
454 var x37: u64 = undefined;466 var x37: u64 = undefined;
455 var x38: u1 = undefined;467 var x38: u1 = undefined;
456 p256AddcarryxU64(&x37, &x38, x36, x19, x21);468 addcarryxU64(&x37, &x38, x36, x19, x21);
457 var x39: u64 = undefined;469 var x39: u64 = undefined;
458 var x40: u64 = undefined;470 var x40: u64 = undefined;
459 p256MulxU64(&x39, &x40, x1, (arg1[3]));471 mulxU64(&x39, &x40, x1, (arg1[3]));
460 var x41: u64 = undefined;472 var x41: u64 = undefined;
461 var x42: u64 = undefined;473 var x42: u64 = undefined;
462 p256MulxU64(&x41, &x42, x1, (arg1[2]));474 mulxU64(&x41, &x42, x1, (arg1[2]));
463 var x43: u64 = undefined;475 var x43: u64 = undefined;
464 var x44: u64 = undefined;476 var x44: u64 = undefined;
465 p256MulxU64(&x43, &x44, x1, (arg1[1]));477 mulxU64(&x43, &x44, x1, (arg1[1]));
466 var x45: u64 = undefined;478 var x45: u64 = undefined;
467 var x46: u64 = undefined;479 var x46: u64 = undefined;
468 p256MulxU64(&x45, &x46, x1, (arg1[0]));480 mulxU64(&x45, &x46, x1, (arg1[0]));
469 var x47: u64 = undefined;481 var x47: u64 = undefined;
470 var x48: u1 = undefined;482 var x48: u1 = undefined;
471 p256AddcarryxU64(&x47, &x48, 0x0, x46, x43);483 addcarryxU64(&x47, &x48, 0x0, x46, x43);
472 var x49: u64 = undefined;484 var x49: u64 = undefined;
473 var x50: u1 = undefined;485 var x50: u1 = undefined;
474 p256AddcarryxU64(&x49, &x50, x48, x44, x41);486 addcarryxU64(&x49, &x50, x48, x44, x41);
475 var x51: u64 = undefined;487 var x51: u64 = undefined;
476 var x52: u1 = undefined;488 var x52: u1 = undefined;
477 p256AddcarryxU64(&x51, &x52, x50, x42, x39);489 addcarryxU64(&x51, &x52, x50, x42, x39);
478 const x53: u64 = (@intCast(u64, x52) + x40);490 const x53 = (cast(u64, x52) + x40);
479 var x54: u64 = undefined;491 var x54: u64 = undefined;
480 var x55: u1 = undefined;492 var x55: u1 = undefined;
481 p256AddcarryxU64(&x54, &x55, 0x0, x31, x45);493 addcarryxU64(&x54, &x55, 0x0, x31, x45);
482 var x56: u64 = undefined;494 var x56: u64 = undefined;
483 var x57: u1 = undefined;495 var x57: u1 = undefined;
484 p256AddcarryxU64(&x56, &x57, x55, x33, x47);496 addcarryxU64(&x56, &x57, x55, x33, x47);
485 var x58: u64 = undefined;497 var x58: u64 = undefined;
486 var x59: u1 = undefined;498 var x59: u1 = undefined;
487 p256AddcarryxU64(&x58, &x59, x57, x35, x49);499 addcarryxU64(&x58, &x59, x57, x35, x49);
488 var x60: u64 = undefined;500 var x60: u64 = undefined;
489 var x61: u1 = undefined;501 var x61: u1 = undefined;
490 p256AddcarryxU64(&x60, &x61, x59, x37, x51);502 addcarryxU64(&x60, &x61, x59, x37, x51);
491 var x62: u64 = undefined;503 var x62: u64 = undefined;
492 var x63: u1 = undefined;504 var x63: u1 = undefined;
493 p256AddcarryxU64(&x62, &x63, x61, @intCast(u64, x38), x53);505 addcarryxU64(&x62, &x63, x61, cast(u64, x38), x53);
494 var x64: u64 = undefined;506 var x64: u64 = undefined;
495 var x65: u64 = undefined;507 var x65: u64 = undefined;
496 p256MulxU64(&x64, &x65, x54, 0xffffffff00000001);508 mulxU64(&x64, &x65, x54, 0xffffffff00000001);
497 var x66: u64 = undefined;509 var x66: u64 = undefined;
498 var x67: u64 = undefined;510 var x67: u64 = undefined;
499 p256MulxU64(&x66, &x67, x54, 0xffffffff);511 mulxU64(&x66, &x67, x54, 0xffffffff);
500 var x68: u64 = undefined;512 var x68: u64 = undefined;
501 var x69: u64 = undefined;513 var x69: u64 = undefined;
502 p256MulxU64(&x68, &x69, x54, 0xffffffffffffffff);514 mulxU64(&x68, &x69, x54, 0xffffffffffffffff);
503 var x70: u64 = undefined;515 var x70: u64 = undefined;
504 var x71: u1 = undefined;516 var x71: u1 = undefined;
505 p256AddcarryxU64(&x70, &x71, 0x0, x69, x66);517 addcarryxU64(&x70, &x71, 0x0, x69, x66);
506 const x72: u64 = (@intCast(u64, x71) + x67);518 const x72 = (cast(u64, x71) + x67);
507 var x73: u64 = undefined;519 var x73: u64 = undefined;
508 var x74: u1 = undefined;520 var x74: u1 = undefined;
509 p256AddcarryxU64(&x73, &x74, 0x0, x54, x68);521 addcarryxU64(&x73, &x74, 0x0, x54, x68);
510 var x75: u64 = undefined;522 var x75: u64 = undefined;
511 var x76: u1 = undefined;523 var x76: u1 = undefined;
512 p256AddcarryxU64(&x75, &x76, x74, x56, x70);524 addcarryxU64(&x75, &x76, x74, x56, x70);
513 var x77: u64 = undefined;525 var x77: u64 = undefined;
514 var x78: u1 = undefined;526 var x78: u1 = undefined;
515 p256AddcarryxU64(&x77, &x78, x76, x58, x72);527 addcarryxU64(&x77, &x78, x76, x58, x72);
516 var x79: u64 = undefined;528 var x79: u64 = undefined;
517 var x80: u1 = undefined;529 var x80: u1 = undefined;
518 p256AddcarryxU64(&x79, &x80, x78, x60, x64);530 addcarryxU64(&x79, &x80, x78, x60, x64);
519 var x81: u64 = undefined;531 var x81: u64 = undefined;
520 var x82: u1 = undefined;532 var x82: u1 = undefined;
521 p256AddcarryxU64(&x81, &x82, x80, x62, x65);533 addcarryxU64(&x81, &x82, x80, x62, x65);
522 const x83: u64 = (@intCast(u64, x82) + @intCast(u64, x63));534 const x83 = (cast(u64, x82) + cast(u64, x63));
523 var x84: u64 = undefined;535 var x84: u64 = undefined;
524 var x85: u64 = undefined;536 var x85: u64 = undefined;
525 p256MulxU64(&x84, &x85, x2, (arg1[3]));537 mulxU64(&x84, &x85, x2, (arg1[3]));
526 var x86: u64 = undefined;538 var x86: u64 = undefined;
527 var x87: u64 = undefined;539 var x87: u64 = undefined;
528 p256MulxU64(&x86, &x87, x2, (arg1[2]));540 mulxU64(&x86, &x87, x2, (arg1[2]));
529 var x88: u64 = undefined;541 var x88: u64 = undefined;
530 var x89: u64 = undefined;542 var x89: u64 = undefined;
531 p256MulxU64(&x88, &x89, x2, (arg1[1]));543 mulxU64(&x88, &x89, x2, (arg1[1]));
532 var x90: u64 = undefined;544 var x90: u64 = undefined;
533 var x91: u64 = undefined;545 var x91: u64 = undefined;
534 p256MulxU64(&x90, &x91, x2, (arg1[0]));546 mulxU64(&x90, &x91, x2, (arg1[0]));
535 var x92: u64 = undefined;547 var x92: u64 = undefined;
536 var x93: u1 = undefined;548 var x93: u1 = undefined;
537 p256AddcarryxU64(&x92, &x93, 0x0, x91, x88);549 addcarryxU64(&x92, &x93, 0x0, x91, x88);
538 var x94: u64 = undefined;550 var x94: u64 = undefined;
539 var x95: u1 = undefined;551 var x95: u1 = undefined;
540 p256AddcarryxU64(&x94, &x95, x93, x89, x86);552 addcarryxU64(&x94, &x95, x93, x89, x86);
541 var x96: u64 = undefined;553 var x96: u64 = undefined;
542 var x97: u1 = undefined;554 var x97: u1 = undefined;
543 p256AddcarryxU64(&x96, &x97, x95, x87, x84);555 addcarryxU64(&x96, &x97, x95, x87, x84);
544 const x98: u64 = (@intCast(u64, x97) + x85);556 const x98 = (cast(u64, x97) + x85);
545 var x99: u64 = undefined;557 var x99: u64 = undefined;
546 var x100: u1 = undefined;558 var x100: u1 = undefined;
547 p256AddcarryxU64(&x99, &x100, 0x0, x75, x90);559 addcarryxU64(&x99, &x100, 0x0, x75, x90);
548 var x101: u64 = undefined;560 var x101: u64 = undefined;
549 var x102: u1 = undefined;561 var x102: u1 = undefined;
550 p256AddcarryxU64(&x101, &x102, x100, x77, x92);562 addcarryxU64(&x101, &x102, x100, x77, x92);
551 var x103: u64 = undefined;563 var x103: u64 = undefined;
552 var x104: u1 = undefined;564 var x104: u1 = undefined;
553 p256AddcarryxU64(&x103, &x104, x102, x79, x94);565 addcarryxU64(&x103, &x104, x102, x79, x94);
554 var x105: u64 = undefined;566 var x105: u64 = undefined;
555 var x106: u1 = undefined;567 var x106: u1 = undefined;
556 p256AddcarryxU64(&x105, &x106, x104, x81, x96);568 addcarryxU64(&x105, &x106, x104, x81, x96);
557 var x107: u64 = undefined;569 var x107: u64 = undefined;
558 var x108: u1 = undefined;570 var x108: u1 = undefined;
559 p256AddcarryxU64(&x107, &x108, x106, x83, x98);571 addcarryxU64(&x107, &x108, x106, x83, x98);
560 var x109: u64 = undefined;572 var x109: u64 = undefined;
561 var x110: u64 = undefined;573 var x110: u64 = undefined;
562 p256MulxU64(&x109, &x110, x99, 0xffffffff00000001);574 mulxU64(&x109, &x110, x99, 0xffffffff00000001);
563 var x111: u64 = undefined;575 var x111: u64 = undefined;
564 var x112: u64 = undefined;576 var x112: u64 = undefined;
565 p256MulxU64(&x111, &x112, x99, 0xffffffff);577 mulxU64(&x111, &x112, x99, 0xffffffff);
566 var x113: u64 = undefined;578 var x113: u64 = undefined;
567 var x114: u64 = undefined;579 var x114: u64 = undefined;
568 p256MulxU64(&x113, &x114, x99, 0xffffffffffffffff);580 mulxU64(&x113, &x114, x99, 0xffffffffffffffff);
569 var x115: u64 = undefined;581 var x115: u64 = undefined;
570 var x116: u1 = undefined;582 var x116: u1 = undefined;
571 p256AddcarryxU64(&x115, &x116, 0x0, x114, x111);583 addcarryxU64(&x115, &x116, 0x0, x114, x111);
572 const x117: u64 = (@intCast(u64, x116) + x112);584 const x117 = (cast(u64, x116) + x112);
573 var x118: u64 = undefined;585 var x118: u64 = undefined;
574 var x119: u1 = undefined;586 var x119: u1 = undefined;
575 p256AddcarryxU64(&x118, &x119, 0x0, x99, x113);587 addcarryxU64(&x118, &x119, 0x0, x99, x113);
576 var x120: u64 = undefined;588 var x120: u64 = undefined;
577 var x121: u1 = undefined;589 var x121: u1 = undefined;
578 p256AddcarryxU64(&x120, &x121, x119, x101, x115);590 addcarryxU64(&x120, &x121, x119, x101, x115);
579 var x122: u64 = undefined;591 var x122: u64 = undefined;
580 var x123: u1 = undefined;592 var x123: u1 = undefined;
581 p256AddcarryxU64(&x122, &x123, x121, x103, x117);593 addcarryxU64(&x122, &x123, x121, x103, x117);
582 var x124: u64 = undefined;594 var x124: u64 = undefined;
583 var x125: u1 = undefined;595 var x125: u1 = undefined;
584 p256AddcarryxU64(&x124, &x125, x123, x105, x109);596 addcarryxU64(&x124, &x125, x123, x105, x109);
585 var x126: u64 = undefined;597 var x126: u64 = undefined;
586 var x127: u1 = undefined;598 var x127: u1 = undefined;
587 p256AddcarryxU64(&x126, &x127, x125, x107, x110);599 addcarryxU64(&x126, &x127, x125, x107, x110);
588 const x128: u64 = (@intCast(u64, x127) + @intCast(u64, x108));600 const x128 = (cast(u64, x127) + cast(u64, x108));
589 var x129: u64 = undefined;601 var x129: u64 = undefined;
590 var x130: u64 = undefined;602 var x130: u64 = undefined;
591 p256MulxU64(&x129, &x130, x3, (arg1[3]));603 mulxU64(&x129, &x130, x3, (arg1[3]));
592 var x131: u64 = undefined;604 var x131: u64 = undefined;
593 var x132: u64 = undefined;605 var x132: u64 = undefined;
594 p256MulxU64(&x131, &x132, x3, (arg1[2]));606 mulxU64(&x131, &x132, x3, (arg1[2]));
595 var x133: u64 = undefined;607 var x133: u64 = undefined;
596 var x134: u64 = undefined;608 var x134: u64 = undefined;
597 p256MulxU64(&x133, &x134, x3, (arg1[1]));609 mulxU64(&x133, &x134, x3, (arg1[1]));
598 var x135: u64 = undefined;610 var x135: u64 = undefined;
599 var x136: u64 = undefined;611 var x136: u64 = undefined;
600 p256MulxU64(&x135, &x136, x3, (arg1[0]));612 mulxU64(&x135, &x136, x3, (arg1[0]));
601 var x137: u64 = undefined;613 var x137: u64 = undefined;
602 var x138: u1 = undefined;614 var x138: u1 = undefined;
603 p256AddcarryxU64(&x137, &x138, 0x0, x136, x133);615 addcarryxU64(&x137, &x138, 0x0, x136, x133);
604 var x139: u64 = undefined;616 var x139: u64 = undefined;
605 var x140: u1 = undefined;617 var x140: u1 = undefined;
606 p256AddcarryxU64(&x139, &x140, x138, x134, x131);618 addcarryxU64(&x139, &x140, x138, x134, x131);
607 var x141: u64 = undefined;619 var x141: u64 = undefined;
608 var x142: u1 = undefined;620 var x142: u1 = undefined;
609 p256AddcarryxU64(&x141, &x142, x140, x132, x129);621 addcarryxU64(&x141, &x142, x140, x132, x129);
610 const x143: u64 = (@intCast(u64, x142) + x130);622 const x143 = (cast(u64, x142) + x130);
611 var x144: u64 = undefined;623 var x144: u64 = undefined;
612 var x145: u1 = undefined;624 var x145: u1 = undefined;
613 p256AddcarryxU64(&x144, &x145, 0x0, x120, x135);625 addcarryxU64(&x144, &x145, 0x0, x120, x135);
614 var x146: u64 = undefined;626 var x146: u64 = undefined;
615 var x147: u1 = undefined;627 var x147: u1 = undefined;
616 p256AddcarryxU64(&x146, &x147, x145, x122, x137);628 addcarryxU64(&x146, &x147, x145, x122, x137);
617 var x148: u64 = undefined;629 var x148: u64 = undefined;
618 var x149: u1 = undefined;630 var x149: u1 = undefined;
619 p256AddcarryxU64(&x148, &x149, x147, x124, x139);631 addcarryxU64(&x148, &x149, x147, x124, x139);
620 var x150: u64 = undefined;632 var x150: u64 = undefined;
621 var x151: u1 = undefined;633 var x151: u1 = undefined;
622 p256AddcarryxU64(&x150, &x151, x149, x126, x141);634 addcarryxU64(&x150, &x151, x149, x126, x141);
623 var x152: u64 = undefined;635 var x152: u64 = undefined;
624 var x153: u1 = undefined;636 var x153: u1 = undefined;
625 p256AddcarryxU64(&x152, &x153, x151, x128, x143);637 addcarryxU64(&x152, &x153, x151, x128, x143);
626 var x154: u64 = undefined;638 var x154: u64 = undefined;
627 var x155: u64 = undefined;639 var x155: u64 = undefined;
628 p256MulxU64(&x154, &x155, x144, 0xffffffff00000001);640 mulxU64(&x154, &x155, x144, 0xffffffff00000001);
629 var x156: u64 = undefined;641 var x156: u64 = undefined;
630 var x157: u64 = undefined;642 var x157: u64 = undefined;
631 p256MulxU64(&x156, &x157, x144, 0xffffffff);643 mulxU64(&x156, &x157, x144, 0xffffffff);
632 var x158: u64 = undefined;644 var x158: u64 = undefined;
633 var x159: u64 = undefined;645 var x159: u64 = undefined;
634 p256MulxU64(&x158, &x159, x144, 0xffffffffffffffff);646 mulxU64(&x158, &x159, x144, 0xffffffffffffffff);
635 var x160: u64 = undefined;647 var x160: u64 = undefined;
636 var x161: u1 = undefined;648 var x161: u1 = undefined;
637 p256AddcarryxU64(&x160, &x161, 0x0, x159, x156);649 addcarryxU64(&x160, &x161, 0x0, x159, x156);
638 const x162: u64 = (@intCast(u64, x161) + x157);650 const x162 = (cast(u64, x161) + x157);
639 var x163: u64 = undefined;651 var x163: u64 = undefined;
640 var x164: u1 = undefined;652 var x164: u1 = undefined;
641 p256AddcarryxU64(&x163, &x164, 0x0, x144, x158);653 addcarryxU64(&x163, &x164, 0x0, x144, x158);
642 var x165: u64 = undefined;654 var x165: u64 = undefined;
643 var x166: u1 = undefined;655 var x166: u1 = undefined;
644 p256AddcarryxU64(&x165, &x166, x164, x146, x160);656 addcarryxU64(&x165, &x166, x164, x146, x160);
645 var x167: u64 = undefined;657 var x167: u64 = undefined;
646 var x168: u1 = undefined;658 var x168: u1 = undefined;
647 p256AddcarryxU64(&x167, &x168, x166, x148, x162);659 addcarryxU64(&x167, &x168, x166, x148, x162);
648 var x169: u64 = undefined;660 var x169: u64 = undefined;
649 var x170: u1 = undefined;661 var x170: u1 = undefined;
650 p256AddcarryxU64(&x169, &x170, x168, x150, x154);662 addcarryxU64(&x169, &x170, x168, x150, x154);
651 var x171: u64 = undefined;663 var x171: u64 = undefined;
652 var x172: u1 = undefined;664 var x172: u1 = undefined;
653 p256AddcarryxU64(&x171, &x172, x170, x152, x155);665 addcarryxU64(&x171, &x172, x170, x152, x155);
654 const x173: u64 = (@intCast(u64, x172) + @intCast(u64, x153));666 const x173 = (cast(u64, x172) + cast(u64, x153));
655 var x174: u64 = undefined;667 var x174: u64 = undefined;
656 var x175: u1 = undefined;668 var x175: u1 = undefined;
657 p256SubborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);669 subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
658 var x176: u64 = undefined;670 var x176: u64 = undefined;
659 var x177: u1 = undefined;671 var x177: u1 = undefined;
660 p256SubborrowxU64(&x176, &x177, x175, x167, 0xffffffff);672 subborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
661 var x178: u64 = undefined;673 var x178: u64 = undefined;
662 var x179: u1 = undefined;674 var x179: u1 = undefined;
663 p256SubborrowxU64(&x178, &x179, x177, x169, @intCast(u64, 0x0));675 subborrowxU64(&x178, &x179, x177, x169, cast(u64, 0x0));
664 var x180: u64 = undefined;676 var x180: u64 = undefined;
665 var x181: u1 = undefined;677 var x181: u1 = undefined;
666 p256SubborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);678 subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
667 var x182: u64 = undefined;679 var x182: u64 = undefined;
668 var x183: u1 = undefined;680 var x183: u1 = undefined;
669 p256SubborrowxU64(&x182, &x183, x181, x173, @intCast(u64, 0x0));681 subborrowxU64(&x182, &x183, x181, x173, cast(u64, 0x0));
670 var x184: u64 = undefined;682 var x184: u64 = undefined;
671 p256CmovznzU64(&x184, x183, x174, x165);683 cmovznzU64(&x184, x183, x174, x165);
672 var x185: u64 = undefined;684 var x185: u64 = undefined;
673 p256CmovznzU64(&x185, x183, x176, x167);685 cmovznzU64(&x185, x183, x176, x167);
674 var x186: u64 = undefined;686 var x186: u64 = undefined;
675 p256CmovznzU64(&x186, x183, x178, x169);687 cmovznzU64(&x186, x183, x178, x169);
676 var x187: u64 = undefined;688 var x187: u64 = undefined;
677 p256CmovznzU64(&x187, x183, x180, x171);689 cmovznzU64(&x187, x183, x180, x171);
678 out1[0] = x184;690 out1[0] = x184;
679 out1[1] = x185;691 out1[1] = x185;
680 out1[2] = x186;692 out1[2] = x186;
681 out1[3] = x187;693 out1[3] = x187;
682}694}
683695
684/// The function p256Add adds two field elements in the Montgomery domain.696/// The function add adds two field elements in the Montgomery domain.
685/// Preconditions:697/// Preconditions:
686/// 0 ≤ eval arg1 < m698/// 0 ≤ eval arg1 < m
687/// 0 ≤ eval arg2 < m699/// 0 ≤ eval arg2 < m
...@@ -694,49 +706,51 @@ pub fn p256Square(out1: *Limbs, arg1: Limbs) void {...@@ -694,49 +706,51 @@ pub fn p256Square(out1: *Limbs, arg1: Limbs) void {
694/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]706/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
695/// Output Bounds:707/// Output Bounds:
696/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]708/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
697pub fn p256Add(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {709pub fn add(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
710 @setRuntimeSafety(mode == .Debug);
711
698 var x1: u64 = undefined;712 var x1: u64 = undefined;
699 var x2: u1 = undefined;713 var x2: u1 = undefined;
700 p256AddcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));714 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
701 var x3: u64 = undefined;715 var x3: u64 = undefined;
702 var x4: u1 = undefined;716 var x4: u1 = undefined;
703 p256AddcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));717 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
704 var x5: u64 = undefined;718 var x5: u64 = undefined;
705 var x6: u1 = undefined;719 var x6: u1 = undefined;
706 p256AddcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));720 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
707 var x7: u64 = undefined;721 var x7: u64 = undefined;
708 var x8: u1 = undefined;722 var x8: u1 = undefined;
709 p256AddcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));723 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
710 var x9: u64 = undefined;724 var x9: u64 = undefined;
711 var x10: u1 = undefined;725 var x10: u1 = undefined;
712 p256SubborrowxU64(&x9, &x10, 0x0, x1, 0xffffffffffffffff);726 subborrowxU64(&x9, &x10, 0x0, x1, 0xffffffffffffffff);
713 var x11: u64 = undefined;727 var x11: u64 = undefined;
714 var x12: u1 = undefined;728 var x12: u1 = undefined;
715 p256SubborrowxU64(&x11, &x12, x10, x3, 0xffffffff);729 subborrowxU64(&x11, &x12, x10, x3, 0xffffffff);
716 var x13: u64 = undefined;730 var x13: u64 = undefined;
717 var x14: u1 = undefined;731 var x14: u1 = undefined;
718 p256SubborrowxU64(&x13, &x14, x12, x5, @intCast(u64, 0x0));732 subborrowxU64(&x13, &x14, x12, x5, cast(u64, 0x0));
719 var x15: u64 = undefined;733 var x15: u64 = undefined;
720 var x16: u1 = undefined;734 var x16: u1 = undefined;
721 p256SubborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000001);735 subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000001);
722 var x17: u64 = undefined;736 var x17: u64 = undefined;
723 var x18: u1 = undefined;737 var x18: u1 = undefined;
724 p256SubborrowxU64(&x17, &x18, x16, @intCast(u64, x8), @intCast(u64, 0x0));738 subborrowxU64(&x17, &x18, x16, cast(u64, x8), cast(u64, 0x0));
725 var x19: u64 = undefined;739 var x19: u64 = undefined;
726 p256CmovznzU64(&x19, x18, x9, x1);740 cmovznzU64(&x19, x18, x9, x1);
727 var x20: u64 = undefined;741 var x20: u64 = undefined;
728 p256CmovznzU64(&x20, x18, x11, x3);742 cmovznzU64(&x20, x18, x11, x3);
729 var x21: u64 = undefined;743 var x21: u64 = undefined;
730 p256CmovznzU64(&x21, x18, x13, x5);744 cmovznzU64(&x21, x18, x13, x5);
731 var x22: u64 = undefined;745 var x22: u64 = undefined;
732 p256CmovznzU64(&x22, x18, x15, x7);746 cmovznzU64(&x22, x18, x15, x7);
733 out1[0] = x19;747 out1[0] = x19;
734 out1[1] = x20;748 out1[1] = x20;
735 out1[2] = x21;749 out1[2] = x21;
736 out1[3] = x22;750 out1[3] = x22;
737}751}
738752
739/// The function p256Sub subtracts two field elements in the Montgomery domain.753/// The function sub subtracts two field elements in the Montgomery domain.
740/// Preconditions:754/// Preconditions:
741/// 0 ≤ eval arg1 < m755/// 0 ≤ eval arg1 < m
742/// 0 ≤ eval arg2 < m756/// 0 ≤ eval arg2 < m
...@@ -749,40 +763,42 @@ pub fn p256Add(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {...@@ -749,40 +763,42 @@ pub fn p256Add(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
749/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]763/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
750/// Output Bounds:764/// Output Bounds:
751/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]765/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
752pub fn p256Sub(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {766pub fn sub(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
767 @setRuntimeSafety(mode == .Debug);
768
753 var x1: u64 = undefined;769 var x1: u64 = undefined;
754 var x2: u1 = undefined;770 var x2: u1 = undefined;
755 p256SubborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));771 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
756 var x3: u64 = undefined;772 var x3: u64 = undefined;
757 var x4: u1 = undefined;773 var x4: u1 = undefined;
758 p256SubborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));774 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
759 var x5: u64 = undefined;775 var x5: u64 = undefined;
760 var x6: u1 = undefined;776 var x6: u1 = undefined;
761 p256SubborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));777 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
762 var x7: u64 = undefined;778 var x7: u64 = undefined;
763 var x8: u1 = undefined;779 var x8: u1 = undefined;
764 p256SubborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));780 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
765 var x9: u64 = undefined;781 var x9: u64 = undefined;
766 p256CmovznzU64(&x9, x8, @intCast(u64, 0x0), 0xffffffffffffffff);782 cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
767 var x10: u64 = undefined;783 var x10: u64 = undefined;
768 var x11: u1 = undefined;784 var x11: u1 = undefined;
769 p256AddcarryxU64(&x10, &x11, 0x0, x1, x9);785 addcarryxU64(&x10, &x11, 0x0, x1, x9);
770 var x12: u64 = undefined;786 var x12: u64 = undefined;
771 var x13: u1 = undefined;787 var x13: u1 = undefined;
772 p256AddcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));788 addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
773 var x14: u64 = undefined;789 var x14: u64 = undefined;
774 var x15: u1 = undefined;790 var x15: u1 = undefined;
775 p256AddcarryxU64(&x14, &x15, x13, x5, @intCast(u64, 0x0));791 addcarryxU64(&x14, &x15, x13, x5, cast(u64, 0x0));
776 var x16: u64 = undefined;792 var x16: u64 = undefined;
777 var x17: u1 = undefined;793 var x17: u1 = undefined;
778 p256AddcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));794 addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
779 out1[0] = x10;795 out1[0] = x10;
780 out1[1] = x12;796 out1[1] = x12;
781 out1[2] = x14;797 out1[2] = x14;
782 out1[3] = x16;798 out1[3] = x16;
783}799}
784800
785/// The function p256Opp negates a field element in the Montgomery domain.801/// The function opp negates a field element in the Montgomery domain.
786/// Preconditions:802/// Preconditions:
787/// 0 ≤ eval arg1 < m803/// 0 ≤ eval arg1 < m
788/// Postconditions:804/// Postconditions:
...@@ -793,40 +809,42 @@ pub fn p256Sub(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {...@@ -793,40 +809,42 @@ pub fn p256Sub(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
793/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]809/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
794/// Output Bounds:810/// Output Bounds:
795/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]811/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
796pub fn p256Opp(out1: *Limbs, arg1: Limbs) void {812pub fn opp(out1: *[4]u64, arg1: [4]u64) void {
813 @setRuntimeSafety(mode == .Debug);
814
797 var x1: u64 = undefined;815 var x1: u64 = undefined;
798 var x2: u1 = undefined;816 var x2: u1 = undefined;
799 p256SubborrowxU64(&x1, &x2, 0x0, @intCast(u64, 0x0), (arg1[0]));817 subborrowxU64(&x1, &x2, 0x0, cast(u64, 0x0), (arg1[0]));
800 var x3: u64 = undefined;818 var x3: u64 = undefined;
801 var x4: u1 = undefined;819 var x4: u1 = undefined;
802 p256SubborrowxU64(&x3, &x4, x2, @intCast(u64, 0x0), (arg1[1]));820 subborrowxU64(&x3, &x4, x2, cast(u64, 0x0), (arg1[1]));
803 var x5: u64 = undefined;821 var x5: u64 = undefined;
804 var x6: u1 = undefined;822 var x6: u1 = undefined;
805 p256SubborrowxU64(&x5, &x6, x4, @intCast(u64, 0x0), (arg1[2]));823 subborrowxU64(&x5, &x6, x4, cast(u64, 0x0), (arg1[2]));
806 var x7: u64 = undefined;824 var x7: u64 = undefined;
807 var x8: u1 = undefined;825 var x8: u1 = undefined;
808 p256SubborrowxU64(&x7, &x8, x6, @intCast(u64, 0x0), (arg1[3]));826 subborrowxU64(&x7, &x8, x6, cast(u64, 0x0), (arg1[3]));
809 var x9: u64 = undefined;827 var x9: u64 = undefined;
810 p256CmovznzU64(&x9, x8, @intCast(u64, 0x0), 0xffffffffffffffff);828 cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
811 var x10: u64 = undefined;829 var x10: u64 = undefined;
812 var x11: u1 = undefined;830 var x11: u1 = undefined;
813 p256AddcarryxU64(&x10, &x11, 0x0, x1, x9);831 addcarryxU64(&x10, &x11, 0x0, x1, x9);
814 var x12: u64 = undefined;832 var x12: u64 = undefined;
815 var x13: u1 = undefined;833 var x13: u1 = undefined;
816 p256AddcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));834 addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
817 var x14: u64 = undefined;835 var x14: u64 = undefined;
818 var x15: u1 = undefined;836 var x15: u1 = undefined;
819 p256AddcarryxU64(&x14, &x15, x13, x5, @intCast(u64, 0x0));837 addcarryxU64(&x14, &x15, x13, x5, cast(u64, 0x0));
820 var x16: u64 = undefined;838 var x16: u64 = undefined;
821 var x17: u1 = undefined;839 var x17: u1 = undefined;
822 p256AddcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));840 addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
823 out1[0] = x10;841 out1[0] = x10;
824 out1[1] = x12;842 out1[1] = x12;
825 out1[2] = x14;843 out1[2] = x14;
826 out1[3] = x16;844 out1[3] = x16;
827}845}
828846
829/// The function p256FromMontgomery translates a field element out of the Montgomery domain.847/// The function fromMontgomery translates a field element out of the Montgomery domain.
830/// Preconditions:848/// Preconditions:
831/// 0 ≤ eval arg1 < m849/// 0 ≤ eval arg1 < m
832/// Postconditions:850/// Postconditions:
...@@ -837,150 +855,152 @@ pub fn p256Opp(out1: *Limbs, arg1: Limbs) void {...@@ -837,150 +855,152 @@ pub fn p256Opp(out1: *Limbs, arg1: Limbs) void {
837/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]855/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
838/// Output Bounds:856/// Output Bounds:
839/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]857/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
840pub fn p256FromMontgomery(out1: *Limbs, arg1: Limbs) void {858pub fn fromMontgomery(out1: *[4]u64, arg1: [4]u64) void {
841 const x1: u64 = (arg1[0]);859 @setRuntimeSafety(mode == .Debug);
860
861 const x1 = (arg1[0]);
842 var x2: u64 = undefined;862 var x2: u64 = undefined;
843 var x3: u64 = undefined;863 var x3: u64 = undefined;
844 p256MulxU64(&x2, &x3, x1, 0xffffffff00000001);864 mulxU64(&x2, &x3, x1, 0xffffffff00000001);
845 var x4: u64 = undefined;865 var x4: u64 = undefined;
846 var x5: u64 = undefined;866 var x5: u64 = undefined;
847 p256MulxU64(&x4, &x5, x1, 0xffffffff);867 mulxU64(&x4, &x5, x1, 0xffffffff);
848 var x6: u64 = undefined;868 var x6: u64 = undefined;
849 var x7: u64 = undefined;869 var x7: u64 = undefined;
850 p256MulxU64(&x6, &x7, x1, 0xffffffffffffffff);870 mulxU64(&x6, &x7, x1, 0xffffffffffffffff);
851 var x8: u64 = undefined;871 var x8: u64 = undefined;
852 var x9: u1 = undefined;872 var x9: u1 = undefined;
853 p256AddcarryxU64(&x8, &x9, 0x0, x7, x4);873 addcarryxU64(&x8, &x9, 0x0, x7, x4);
854 var x10: u64 = undefined;874 var x10: u64 = undefined;
855 var x11: u1 = undefined;875 var x11: u1 = undefined;
856 p256AddcarryxU64(&x10, &x11, 0x0, x1, x6);876 addcarryxU64(&x10, &x11, 0x0, x1, x6);
857 var x12: u64 = undefined;877 var x12: u64 = undefined;
858 var x13: u1 = undefined;878 var x13: u1 = undefined;
859 p256AddcarryxU64(&x12, &x13, x11, @intCast(u64, 0x0), x8);879 addcarryxU64(&x12, &x13, x11, cast(u64, 0x0), x8);
860 var x14: u64 = undefined;880 var x14: u64 = undefined;
861 var x15: u1 = undefined;881 var x15: u1 = undefined;
862 p256AddcarryxU64(&x14, &x15, 0x0, x12, (arg1[1]));882 addcarryxU64(&x14, &x15, 0x0, x12, (arg1[1]));
863 var x16: u64 = undefined;883 var x16: u64 = undefined;
864 var x17: u64 = undefined;884 var x17: u64 = undefined;
865 p256MulxU64(&x16, &x17, x14, 0xffffffff00000001);885 mulxU64(&x16, &x17, x14, 0xffffffff00000001);
866 var x18: u64 = undefined;886 var x18: u64 = undefined;
867 var x19: u64 = undefined;887 var x19: u64 = undefined;
868 p256MulxU64(&x18, &x19, x14, 0xffffffff);888 mulxU64(&x18, &x19, x14, 0xffffffff);
869 var x20: u64 = undefined;889 var x20: u64 = undefined;
870 var x21: u64 = undefined;890 var x21: u64 = undefined;
871 p256MulxU64(&x20, &x21, x14, 0xffffffffffffffff);891 mulxU64(&x20, &x21, x14, 0xffffffffffffffff);
872 var x22: u64 = undefined;892 var x22: u64 = undefined;
873 var x23: u1 = undefined;893 var x23: u1 = undefined;
874 p256AddcarryxU64(&x22, &x23, 0x0, x21, x18);894 addcarryxU64(&x22, &x23, 0x0, x21, x18);
875 var x24: u64 = undefined;895 var x24: u64 = undefined;
876 var x25: u1 = undefined;896 var x25: u1 = undefined;
877 p256AddcarryxU64(&x24, &x25, 0x0, x14, x20);897 addcarryxU64(&x24, &x25, 0x0, x14, x20);
878 var x26: u64 = undefined;898 var x26: u64 = undefined;
879 var x27: u1 = undefined;899 var x27: u1 = undefined;
880 p256AddcarryxU64(&x26, &x27, x25, (@intCast(u64, x15) + (@intCast(u64, x13) + (@intCast(u64, x9) + x5))), x22);900 addcarryxU64(&x26, &x27, x25, (cast(u64, x15) + (cast(u64, x13) + (cast(u64, x9) + x5))), x22);
881 var x28: u64 = undefined;901 var x28: u64 = undefined;
882 var x29: u1 = undefined;902 var x29: u1 = undefined;
883 p256AddcarryxU64(&x28, &x29, x27, x2, (@intCast(u64, x23) + x19));903 addcarryxU64(&x28, &x29, x27, x2, (cast(u64, x23) + x19));
884 var x30: u64 = undefined;904 var x30: u64 = undefined;
885 var x31: u1 = undefined;905 var x31: u1 = undefined;
886 p256AddcarryxU64(&x30, &x31, x29, x3, x16);906 addcarryxU64(&x30, &x31, x29, x3, x16);
887 var x32: u64 = undefined;907 var x32: u64 = undefined;
888 var x33: u1 = undefined;908 var x33: u1 = undefined;
889 p256AddcarryxU64(&x32, &x33, 0x0, x26, (arg1[2]));909 addcarryxU64(&x32, &x33, 0x0, x26, (arg1[2]));
890 var x34: u64 = undefined;910 var x34: u64 = undefined;
891 var x35: u1 = undefined;911 var x35: u1 = undefined;
892 p256AddcarryxU64(&x34, &x35, x33, x28, @intCast(u64, 0x0));912 addcarryxU64(&x34, &x35, x33, x28, cast(u64, 0x0));
893 var x36: u64 = undefined;913 var x36: u64 = undefined;
894 var x37: u1 = undefined;914 var x37: u1 = undefined;
895 p256AddcarryxU64(&x36, &x37, x35, x30, @intCast(u64, 0x0));915 addcarryxU64(&x36, &x37, x35, x30, cast(u64, 0x0));
896 var x38: u64 = undefined;916 var x38: u64 = undefined;
897 var x39: u64 = undefined;917 var x39: u64 = undefined;
898 p256MulxU64(&x38, &x39, x32, 0xffffffff00000001);918 mulxU64(&x38, &x39, x32, 0xffffffff00000001);
899 var x40: u64 = undefined;919 var x40: u64 = undefined;
900 var x41: u64 = undefined;920 var x41: u64 = undefined;
901 p256MulxU64(&x40, &x41, x32, 0xffffffff);921 mulxU64(&x40, &x41, x32, 0xffffffff);
902 var x42: u64 = undefined;922 var x42: u64 = undefined;
903 var x43: u64 = undefined;923 var x43: u64 = undefined;
904 p256MulxU64(&x42, &x43, x32, 0xffffffffffffffff);924 mulxU64(&x42, &x43, x32, 0xffffffffffffffff);
905 var x44: u64 = undefined;925 var x44: u64 = undefined;
906 var x45: u1 = undefined;926 var x45: u1 = undefined;
907 p256AddcarryxU64(&x44, &x45, 0x0, x43, x40);927 addcarryxU64(&x44, &x45, 0x0, x43, x40);
908 var x46: u64 = undefined;928 var x46: u64 = undefined;
909 var x47: u1 = undefined;929 var x47: u1 = undefined;
910 p256AddcarryxU64(&x46, &x47, 0x0, x32, x42);930 addcarryxU64(&x46, &x47, 0x0, x32, x42);
911 var x48: u64 = undefined;931 var x48: u64 = undefined;
912 var x49: u1 = undefined;932 var x49: u1 = undefined;
913 p256AddcarryxU64(&x48, &x49, x47, x34, x44);933 addcarryxU64(&x48, &x49, x47, x34, x44);
914 var x50: u64 = undefined;934 var x50: u64 = undefined;
915 var x51: u1 = undefined;935 var x51: u1 = undefined;
916 p256AddcarryxU64(&x50, &x51, x49, x36, (@intCast(u64, x45) + x41));936 addcarryxU64(&x50, &x51, x49, x36, (cast(u64, x45) + x41));
917 var x52: u64 = undefined;937 var x52: u64 = undefined;
918 var x53: u1 = undefined;938 var x53: u1 = undefined;
919 p256AddcarryxU64(&x52, &x53, x51, (@intCast(u64, x37) + (@intCast(u64, x31) + x17)), x38);939 addcarryxU64(&x52, &x53, x51, (cast(u64, x37) + (cast(u64, x31) + x17)), x38);
920 var x54: u64 = undefined;940 var x54: u64 = undefined;
921 var x55: u1 = undefined;941 var x55: u1 = undefined;
922 p256AddcarryxU64(&x54, &x55, 0x0, x48, (arg1[3]));942 addcarryxU64(&x54, &x55, 0x0, x48, (arg1[3]));
923 var x56: u64 = undefined;943 var x56: u64 = undefined;
924 var x57: u1 = undefined;944 var x57: u1 = undefined;
925 p256AddcarryxU64(&x56, &x57, x55, x50, @intCast(u64, 0x0));945 addcarryxU64(&x56, &x57, x55, x50, cast(u64, 0x0));
926 var x58: u64 = undefined;946 var x58: u64 = undefined;
927 var x59: u1 = undefined;947 var x59: u1 = undefined;
928 p256AddcarryxU64(&x58, &x59, x57, x52, @intCast(u64, 0x0));948 addcarryxU64(&x58, &x59, x57, x52, cast(u64, 0x0));
929 var x60: u64 = undefined;949 var x60: u64 = undefined;
930 var x61: u64 = undefined;950 var x61: u64 = undefined;
931 p256MulxU64(&x60, &x61, x54, 0xffffffff00000001);951 mulxU64(&x60, &x61, x54, 0xffffffff00000001);
932 var x62: u64 = undefined;952 var x62: u64 = undefined;
933 var x63: u64 = undefined;953 var x63: u64 = undefined;
934 p256MulxU64(&x62, &x63, x54, 0xffffffff);954 mulxU64(&x62, &x63, x54, 0xffffffff);
935 var x64: u64 = undefined;955 var x64: u64 = undefined;
936 var x65: u64 = undefined;956 var x65: u64 = undefined;
937 p256MulxU64(&x64, &x65, x54, 0xffffffffffffffff);957 mulxU64(&x64, &x65, x54, 0xffffffffffffffff);
938 var x66: u64 = undefined;958 var x66: u64 = undefined;
939 var x67: u1 = undefined;959 var x67: u1 = undefined;
940 p256AddcarryxU64(&x66, &x67, 0x0, x65, x62);960 addcarryxU64(&x66, &x67, 0x0, x65, x62);
941 var x68: u64 = undefined;961 var x68: u64 = undefined;
942 var x69: u1 = undefined;962 var x69: u1 = undefined;
943 p256AddcarryxU64(&x68, &x69, 0x0, x54, x64);963 addcarryxU64(&x68, &x69, 0x0, x54, x64);
944 var x70: u64 = undefined;964 var x70: u64 = undefined;
945 var x71: u1 = undefined;965 var x71: u1 = undefined;
946 p256AddcarryxU64(&x70, &x71, x69, x56, x66);966 addcarryxU64(&x70, &x71, x69, x56, x66);
947 var x72: u64 = undefined;967 var x72: u64 = undefined;
948 var x73: u1 = undefined;968 var x73: u1 = undefined;
949 p256AddcarryxU64(&x72, &x73, x71, x58, (@intCast(u64, x67) + x63));969 addcarryxU64(&x72, &x73, x71, x58, (cast(u64, x67) + x63));
950 var x74: u64 = undefined;970 var x74: u64 = undefined;
951 var x75: u1 = undefined;971 var x75: u1 = undefined;
952 p256AddcarryxU64(&x74, &x75, x73, (@intCast(u64, x59) + (@intCast(u64, x53) + x39)), x60);972 addcarryxU64(&x74, &x75, x73, (cast(u64, x59) + (cast(u64, x53) + x39)), x60);
953 const x76: u64 = (@intCast(u64, x75) + x61);973 const x76 = (cast(u64, x75) + x61);
954 var x77: u64 = undefined;974 var x77: u64 = undefined;
955 var x78: u1 = undefined;975 var x78: u1 = undefined;
956 p256SubborrowxU64(&x77, &x78, 0x0, x70, 0xffffffffffffffff);976 subborrowxU64(&x77, &x78, 0x0, x70, 0xffffffffffffffff);
957 var x79: u64 = undefined;977 var x79: u64 = undefined;
958 var x80: u1 = undefined;978 var x80: u1 = undefined;
959 p256SubborrowxU64(&x79, &x80, x78, x72, 0xffffffff);979 subborrowxU64(&x79, &x80, x78, x72, 0xffffffff);
960 var x81: u64 = undefined;980 var x81: u64 = undefined;
961 var x82: u1 = undefined;981 var x82: u1 = undefined;
962 p256SubborrowxU64(&x81, &x82, x80, x74, @intCast(u64, 0x0));982 subborrowxU64(&x81, &x82, x80, x74, cast(u64, 0x0));
963 var x83: u64 = undefined;983 var x83: u64 = undefined;
964 var x84: u1 = undefined;984 var x84: u1 = undefined;
965 p256SubborrowxU64(&x83, &x84, x82, x76, 0xffffffff00000001);985 subborrowxU64(&x83, &x84, x82, x76, 0xffffffff00000001);
966 var x85: u64 = undefined;986 var x85: u64 = undefined;
967 var x86: u1 = undefined;987 var x86: u1 = undefined;
968 p256SubborrowxU64(&x85, &x86, x84, @intCast(u64, 0x0), @intCast(u64, 0x0));988 subborrowxU64(&x85, &x86, x84, cast(u64, 0x0), cast(u64, 0x0));
969 var x87: u64 = undefined;989 var x87: u64 = undefined;
970 p256CmovznzU64(&x87, x86, x77, x70);990 cmovznzU64(&x87, x86, x77, x70);
971 var x88: u64 = undefined;991 var x88: u64 = undefined;
972 p256CmovznzU64(&x88, x86, x79, x72);992 cmovznzU64(&x88, x86, x79, x72);
973 var x89: u64 = undefined;993 var x89: u64 = undefined;
974 p256CmovznzU64(&x89, x86, x81, x74);994 cmovznzU64(&x89, x86, x81, x74);
975 var x90: u64 = undefined;995 var x90: u64 = undefined;
976 p256CmovznzU64(&x90, x86, x83, x76);996 cmovznzU64(&x90, x86, x83, x76);
977 out1[0] = x87;997 out1[0] = x87;
978 out1[1] = x88;998 out1[1] = x88;
979 out1[2] = x89;999 out1[2] = x89;
980 out1[3] = x90;1000 out1[3] = x90;
981}1001}
9821002
983/// The function p256ToMontgomery translates a field element into the Montgomery domain.1003/// The function toMontgomery translates a field element into the Montgomery domain.
984/// Preconditions:1004/// Preconditions:
985/// 0 ≤ eval arg1 < m1005/// 0 ≤ eval arg1 < m
986/// Postconditions:1006/// Postconditions:
...@@ -991,269 +1011,271 @@ pub fn p256FromMontgomery(out1: *Limbs, arg1: Limbs) void {...@@ -991,269 +1011,271 @@ pub fn p256FromMontgomery(out1: *Limbs, arg1: Limbs) void {
991/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1011/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
992/// Output Bounds:1012/// Output Bounds:
993/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1013/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
994pub fn p256ToMontgomery(out1: *Limbs, arg1: Limbs) void {1014pub fn toMontgomery(out1: *[4]u64, arg1: [4]u64) void {
995 const x1: u64 = (arg1[1]);1015 @setRuntimeSafety(mode == .Debug);
996 const x2: u64 = (arg1[2]);1016
997 const x3: u64 = (arg1[3]);1017 const x1 = (arg1[1]);
998 const x4: u64 = (arg1[0]);1018 const x2 = (arg1[2]);
1019 const x3 = (arg1[3]);
1020 const x4 = (arg1[0]);
999 var x5: u64 = undefined;1021 var x5: u64 = undefined;
1000 var x6: u64 = undefined;1022 var x6: u64 = undefined;
1001 p256MulxU64(&x5, &x6, x4, 0x4fffffffd);1023 mulxU64(&x5, &x6, x4, 0x4fffffffd);
1002 var x7: u64 = undefined;1024 var x7: u64 = undefined;
1003 var x8: u64 = undefined;1025 var x8: u64 = undefined;
1004 p256MulxU64(&x7, &x8, x4, 0xfffffffffffffffe);1026 mulxU64(&x7, &x8, x4, 0xfffffffffffffffe);
1005 var x9: u64 = undefined;1027 var x9: u64 = undefined;
1006 var x10: u64 = undefined;1028 var x10: u64 = undefined;
1007 p256MulxU64(&x9, &x10, x4, 0xfffffffbffffffff);1029 mulxU64(&x9, &x10, x4, 0xfffffffbffffffff);
1008 var x11: u64 = undefined;1030 var x11: u64 = undefined;
1009 var x12: u64 = undefined;1031 var x12: u64 = undefined;
1010 p256MulxU64(&x11, &x12, x4, 0x3);1032 mulxU64(&x11, &x12, x4, 0x3);
1011 var x13: u64 = undefined;1033 var x13: u64 = undefined;
1012 var x14: u1 = undefined;1034 var x14: u1 = undefined;
1013 p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);1035 addcarryxU64(&x13, &x14, 0x0, x12, x9);
1014 var x15: u64 = undefined;1036 var x15: u64 = undefined;
1015 var x16: u1 = undefined;1037 var x16: u1 = undefined;
1016 p256AddcarryxU64(&x15, &x16, x14, x10, x7);1038 addcarryxU64(&x15, &x16, x14, x10, x7);
1017 var x17: u64 = undefined;1039 var x17: u64 = undefined;
1018 var x18: u1 = undefined;1040 var x18: u1 = undefined;
1019 p256AddcarryxU64(&x17, &x18, x16, x8, x5);1041 addcarryxU64(&x17, &x18, x16, x8, x5);
1020 var x19: u64 = undefined;1042 var x19: u64 = undefined;
1021 var x20: u64 = undefined;1043 var x20: u64 = undefined;
1022 p256MulxU64(&x19, &x20, x11, 0xffffffff00000001);1044 mulxU64(&x19, &x20, x11, 0xffffffff00000001);
1023 var x21: u64 = undefined;1045 var x21: u64 = undefined;
1024 var x22: u64 = undefined;1046 var x22: u64 = undefined;
1025 p256MulxU64(&x21, &x22, x11, 0xffffffff);1047 mulxU64(&x21, &x22, x11, 0xffffffff);
1026 var x23: u64 = undefined;1048 var x23: u64 = undefined;
1027 var x24: u64 = undefined;1049 var x24: u64 = undefined;
1028 p256MulxU64(&x23, &x24, x11, 0xffffffffffffffff);1050 mulxU64(&x23, &x24, x11, 0xffffffffffffffff);
1029 var x25: u64 = undefined;1051 var x25: u64 = undefined;
1030 var x26: u1 = undefined;1052 var x26: u1 = undefined;
1031 p256AddcarryxU64(&x25, &x26, 0x0, x24, x21);1053 addcarryxU64(&x25, &x26, 0x0, x24, x21);
1032 var x27: u64 = undefined;1054 var x27: u64 = undefined;
1033 var x28: u1 = undefined;1055 var x28: u1 = undefined;
1034 p256AddcarryxU64(&x27, &x28, 0x0, x11, x23);1056 addcarryxU64(&x27, &x28, 0x0, x11, x23);
1035 var x29: u64 = undefined;1057 var x29: u64 = undefined;
1036 var x30: u1 = undefined;1058 var x30: u1 = undefined;
1037 p256AddcarryxU64(&x29, &x30, x28, x13, x25);1059 addcarryxU64(&x29, &x30, x28, x13, x25);
1038 var x31: u64 = undefined;1060 var x31: u64 = undefined;
1039 var x32: u1 = undefined;1061 var x32: u1 = undefined;
1040 p256AddcarryxU64(&x31, &x32, x30, x15, (@intCast(u64, x26) + x22));1062 addcarryxU64(&x31, &x32, x30, x15, (cast(u64, x26) + x22));
1041 var x33: u64 = undefined;1063 var x33: u64 = undefined;
1042 var x34: u1 = undefined;1064 var x34: u1 = undefined;
1043 p256AddcarryxU64(&x33, &x34, x32, x17, x19);1065 addcarryxU64(&x33, &x34, x32, x17, x19);
1044 var x35: u64 = undefined;1066 var x35: u64 = undefined;
1045 var x36: u1 = undefined;1067 var x36: u1 = undefined;
1046 p256AddcarryxU64(&x35, &x36, x34, (@intCast(u64, x18) + x6), x20);1068 addcarryxU64(&x35, &x36, x34, (cast(u64, x18) + x6), x20);
1047 var x37: u64 = undefined;1069 var x37: u64 = undefined;
1048 var x38: u64 = undefined;1070 var x38: u64 = undefined;
1049 p256MulxU64(&x37, &x38, x1, 0x4fffffffd);1071 mulxU64(&x37, &x38, x1, 0x4fffffffd);
1050 var x39: u64 = undefined;1072 var x39: u64 = undefined;
1051 var x40: u64 = undefined;1073 var x40: u64 = undefined;
1052 p256MulxU64(&x39, &x40, x1, 0xfffffffffffffffe);1074 mulxU64(&x39, &x40, x1, 0xfffffffffffffffe);
1053 var x41: u64 = undefined;1075 var x41: u64 = undefined;
1054 var x42: u64 = undefined;1076 var x42: u64 = undefined;
1055 p256MulxU64(&x41, &x42, x1, 0xfffffffbffffffff);1077 mulxU64(&x41, &x42, x1, 0xfffffffbffffffff);
1056 var x43: u64 = undefined;1078 var x43: u64 = undefined;
1057 var x44: u64 = undefined;1079 var x44: u64 = undefined;
1058 p256MulxU64(&x43, &x44, x1, 0x3);1080 mulxU64(&x43, &x44, x1, 0x3);
1059 var x45: u64 = undefined;1081 var x45: u64 = undefined;
1060 var x46: u1 = undefined;1082 var x46: u1 = undefined;
1061 p256AddcarryxU64(&x45, &x46, 0x0, x44, x41);1083 addcarryxU64(&x45, &x46, 0x0, x44, x41);
1062 var x47: u64 = undefined;1084 var x47: u64 = undefined;
1063 var x48: u1 = undefined;1085 var x48: u1 = undefined;
1064 p256AddcarryxU64(&x47, &x48, x46, x42, x39);1086 addcarryxU64(&x47, &x48, x46, x42, x39);
1065 var x49: u64 = undefined;1087 var x49: u64 = undefined;
1066 var x50: u1 = undefined;1088 var x50: u1 = undefined;
1067 p256AddcarryxU64(&x49, &x50, x48, x40, x37);1089 addcarryxU64(&x49, &x50, x48, x40, x37);
1068 var x51: u64 = undefined;1090 var x51: u64 = undefined;
1069 var x52: u1 = undefined;1091 var x52: u1 = undefined;
1070 p256AddcarryxU64(&x51, &x52, 0x0, x29, x43);1092 addcarryxU64(&x51, &x52, 0x0, x29, x43);
1071 var x53: u64 = undefined;1093 var x53: u64 = undefined;
1072 var x54: u1 = undefined;1094 var x54: u1 = undefined;
1073 p256AddcarryxU64(&x53, &x54, x52, x31, x45);1095 addcarryxU64(&x53, &x54, x52, x31, x45);
1074 var x55: u64 = undefined;1096 var x55: u64 = undefined;
1075 var x56: u1 = undefined;1097 var x56: u1 = undefined;
1076 p256AddcarryxU64(&x55, &x56, x54, x33, x47);1098 addcarryxU64(&x55, &x56, x54, x33, x47);
1077 var x57: u64 = undefined;1099 var x57: u64 = undefined;
1078 var x58: u1 = undefined;1100 var x58: u1 = undefined;
1079 p256AddcarryxU64(&x57, &x58, x56, x35, x49);1101 addcarryxU64(&x57, &x58, x56, x35, x49);
1080 var x59: u64 = undefined;1102 var x59: u64 = undefined;
1081 var x60: u64 = undefined;1103 var x60: u64 = undefined;
1082 p256MulxU64(&x59, &x60, x51, 0xffffffff00000001);1104 mulxU64(&x59, &x60, x51, 0xffffffff00000001);
1083 var x61: u64 = undefined;1105 var x61: u64 = undefined;
1084 var x62: u64 = undefined;1106 var x62: u64 = undefined;
1085 p256MulxU64(&x61, &x62, x51, 0xffffffff);1107 mulxU64(&x61, &x62, x51, 0xffffffff);
1086 var x63: u64 = undefined;1108 var x63: u64 = undefined;
1087 var x64: u64 = undefined;1109 var x64: u64 = undefined;
1088 p256MulxU64(&x63, &x64, x51, 0xffffffffffffffff);1110 mulxU64(&x63, &x64, x51, 0xffffffffffffffff);
1089 var x65: u64 = undefined;1111 var x65: u64 = undefined;
1090 var x66: u1 = undefined;1112 var x66: u1 = undefined;
1091 p256AddcarryxU64(&x65, &x66, 0x0, x64, x61);1113 addcarryxU64(&x65, &x66, 0x0, x64, x61);
1092 var x67: u64 = undefined;1114 var x67: u64 = undefined;
1093 var x68: u1 = undefined;1115 var x68: u1 = undefined;
1094 p256AddcarryxU64(&x67, &x68, 0x0, x51, x63);1116 addcarryxU64(&x67, &x68, 0x0, x51, x63);
1095 var x69: u64 = undefined;1117 var x69: u64 = undefined;
1096 var x70: u1 = undefined;1118 var x70: u1 = undefined;
1097 p256AddcarryxU64(&x69, &x70, x68, x53, x65);1119 addcarryxU64(&x69, &x70, x68, x53, x65);
1098 var x71: u64 = undefined;1120 var x71: u64 = undefined;
1099 var x72: u1 = undefined;1121 var x72: u1 = undefined;
1100 p256AddcarryxU64(&x71, &x72, x70, x55, (@intCast(u64, x66) + x62));1122 addcarryxU64(&x71, &x72, x70, x55, (cast(u64, x66) + x62));
1101 var x73: u64 = undefined;1123 var x73: u64 = undefined;
1102 var x74: u1 = undefined;1124 var x74: u1 = undefined;
1103 p256AddcarryxU64(&x73, &x74, x72, x57, x59);1125 addcarryxU64(&x73, &x74, x72, x57, x59);
1104 var x75: u64 = undefined;1126 var x75: u64 = undefined;
1105 var x76: u1 = undefined;1127 var x76: u1 = undefined;
1106 p256AddcarryxU64(&x75, &x76, x74, ((@intCast(u64, x58) + @intCast(u64, x36)) + (@intCast(u64, x50) + x38)), x60);1128 addcarryxU64(&x75, &x76, x74, ((cast(u64, x58) + cast(u64, x36)) + (cast(u64, x50) + x38)), x60);
1107 var x77: u64 = undefined;1129 var x77: u64 = undefined;
1108 var x78: u64 = undefined;1130 var x78: u64 = undefined;
1109 p256MulxU64(&x77, &x78, x2, 0x4fffffffd);1131 mulxU64(&x77, &x78, x2, 0x4fffffffd);
1110 var x79: u64 = undefined;1132 var x79: u64 = undefined;
1111 var x80: u64 = undefined;1133 var x80: u64 = undefined;
1112 p256MulxU64(&x79, &x80, x2, 0xfffffffffffffffe);1134 mulxU64(&x79, &x80, x2, 0xfffffffffffffffe);
1113 var x81: u64 = undefined;1135 var x81: u64 = undefined;
1114 var x82: u64 = undefined;1136 var x82: u64 = undefined;
1115 p256MulxU64(&x81, &x82, x2, 0xfffffffbffffffff);1137 mulxU64(&x81, &x82, x2, 0xfffffffbffffffff);
1116 var x83: u64 = undefined;1138 var x83: u64 = undefined;
1117 var x84: u64 = undefined;1139 var x84: u64 = undefined;
1118 p256MulxU64(&x83, &x84, x2, 0x3);1140 mulxU64(&x83, &x84, x2, 0x3);
1119 var x85: u64 = undefined;1141 var x85: u64 = undefined;
1120 var x86: u1 = undefined;1142 var x86: u1 = undefined;
1121 p256AddcarryxU64(&x85, &x86, 0x0, x84, x81);1143 addcarryxU64(&x85, &x86, 0x0, x84, x81);
1122 var x87: u64 = undefined;1144 var x87: u64 = undefined;
1123 var x88: u1 = undefined;1145 var x88: u1 = undefined;
1124 p256AddcarryxU64(&x87, &x88, x86, x82, x79);1146 addcarryxU64(&x87, &x88, x86, x82, x79);
1125 var x89: u64 = undefined;1147 var x89: u64 = undefined;
1126 var x90: u1 = undefined;1148 var x90: u1 = undefined;
1127 p256AddcarryxU64(&x89, &x90, x88, x80, x77);1149 addcarryxU64(&x89, &x90, x88, x80, x77);
1128 var x91: u64 = undefined;1150 var x91: u64 = undefined;
1129 var x92: u1 = undefined;1151 var x92: u1 = undefined;
1130 p256AddcarryxU64(&x91, &x92, 0x0, x69, x83);1152 addcarryxU64(&x91, &x92, 0x0, x69, x83);
1131 var x93: u64 = undefined;1153 var x93: u64 = undefined;
1132 var x94: u1 = undefined;1154 var x94: u1 = undefined;
1133 p256AddcarryxU64(&x93, &x94, x92, x71, x85);1155 addcarryxU64(&x93, &x94, x92, x71, x85);
1134 var x95: u64 = undefined;1156 var x95: u64 = undefined;
1135 var x96: u1 = undefined;1157 var x96: u1 = undefined;
1136 p256AddcarryxU64(&x95, &x96, x94, x73, x87);1158 addcarryxU64(&x95, &x96, x94, x73, x87);
1137 var x97: u64 = undefined;1159 var x97: u64 = undefined;
1138 var x98: u1 = undefined;1160 var x98: u1 = undefined;
1139 p256AddcarryxU64(&x97, &x98, x96, x75, x89);1161 addcarryxU64(&x97, &x98, x96, x75, x89);
1140 var x99: u64 = undefined;1162 var x99: u64 = undefined;
1141 var x100: u64 = undefined;1163 var x100: u64 = undefined;
1142 p256MulxU64(&x99, &x100, x91, 0xffffffff00000001);1164 mulxU64(&x99, &x100, x91, 0xffffffff00000001);
1143 var x101: u64 = undefined;1165 var x101: u64 = undefined;
1144 var x102: u64 = undefined;1166 var x102: u64 = undefined;
1145 p256MulxU64(&x101, &x102, x91, 0xffffffff);1167 mulxU64(&x101, &x102, x91, 0xffffffff);
1146 var x103: u64 = undefined;1168 var x103: u64 = undefined;
1147 var x104: u64 = undefined;1169 var x104: u64 = undefined;
1148 p256MulxU64(&x103, &x104, x91, 0xffffffffffffffff);1170 mulxU64(&x103, &x104, x91, 0xffffffffffffffff);
1149 var x105: u64 = undefined;1171 var x105: u64 = undefined;
1150 var x106: u1 = undefined;1172 var x106: u1 = undefined;
1151 p256AddcarryxU64(&x105, &x106, 0x0, x104, x101);1173 addcarryxU64(&x105, &x106, 0x0, x104, x101);
1152 var x107: u64 = undefined;1174 var x107: u64 = undefined;
1153 var x108: u1 = undefined;1175 var x108: u1 = undefined;
1154 p256AddcarryxU64(&x107, &x108, 0x0, x91, x103);1176 addcarryxU64(&x107, &x108, 0x0, x91, x103);
1155 var x109: u64 = undefined;1177 var x109: u64 = undefined;
1156 var x110: u1 = undefined;1178 var x110: u1 = undefined;
1157 p256AddcarryxU64(&x109, &x110, x108, x93, x105);1179 addcarryxU64(&x109, &x110, x108, x93, x105);
1158 var x111: u64 = undefined;1180 var x111: u64 = undefined;
1159 var x112: u1 = undefined;1181 var x112: u1 = undefined;
1160 p256AddcarryxU64(&x111, &x112, x110, x95, (@intCast(u64, x106) + x102));1182 addcarryxU64(&x111, &x112, x110, x95, (cast(u64, x106) + x102));
1161 var x113: u64 = undefined;1183 var x113: u64 = undefined;
1162 var x114: u1 = undefined;1184 var x114: u1 = undefined;
1163 p256AddcarryxU64(&x113, &x114, x112, x97, x99);1185 addcarryxU64(&x113, &x114, x112, x97, x99);
1164 var x115: u64 = undefined;1186 var x115: u64 = undefined;
1165 var x116: u1 = undefined;1187 var x116: u1 = undefined;
1166 p256AddcarryxU64(&x115, &x116, x114, ((@intCast(u64, x98) + @intCast(u64, x76)) + (@intCast(u64, x90) + x78)), x100);1188 addcarryxU64(&x115, &x116, x114, ((cast(u64, x98) + cast(u64, x76)) + (cast(u64, x90) + x78)), x100);
1167 var x117: u64 = undefined;1189 var x117: u64 = undefined;
1168 var x118: u64 = undefined;1190 var x118: u64 = undefined;
1169 p256MulxU64(&x117, &x118, x3, 0x4fffffffd);1191 mulxU64(&x117, &x118, x3, 0x4fffffffd);
1170 var x119: u64 = undefined;1192 var x119: u64 = undefined;
1171 var x120: u64 = undefined;1193 var x120: u64 = undefined;
1172 p256MulxU64(&x119, &x120, x3, 0xfffffffffffffffe);1194 mulxU64(&x119, &x120, x3, 0xfffffffffffffffe);
1173 var x121: u64 = undefined;1195 var x121: u64 = undefined;
1174 var x122: u64 = undefined;1196 var x122: u64 = undefined;
1175 p256MulxU64(&x121, &x122, x3, 0xfffffffbffffffff);1197 mulxU64(&x121, &x122, x3, 0xfffffffbffffffff);
1176 var x123: u64 = undefined;1198 var x123: u64 = undefined;
1177 var x124: u64 = undefined;1199 var x124: u64 = undefined;
1178 p256MulxU64(&x123, &x124, x3, 0x3);1200 mulxU64(&x123, &x124, x3, 0x3);
1179 var x125: u64 = undefined;1201 var x125: u64 = undefined;
1180 var x126: u1 = undefined;1202 var x126: u1 = undefined;
1181 p256AddcarryxU64(&x125, &x126, 0x0, x124, x121);1203 addcarryxU64(&x125, &x126, 0x0, x124, x121);
1182 var x127: u64 = undefined;1204 var x127: u64 = undefined;
1183 var x128: u1 = undefined;1205 var x128: u1 = undefined;
1184 p256AddcarryxU64(&x127, &x128, x126, x122, x119);1206 addcarryxU64(&x127, &x128, x126, x122, x119);
1185 var x129: u64 = undefined;1207 var x129: u64 = undefined;
1186 var x130: u1 = undefined;1208 var x130: u1 = undefined;
1187 p256AddcarryxU64(&x129, &x130, x128, x120, x117);1209 addcarryxU64(&x129, &x130, x128, x120, x117);
1188 var x131: u64 = undefined;1210 var x131: u64 = undefined;
1189 var x132: u1 = undefined;1211 var x132: u1 = undefined;
1190 p256AddcarryxU64(&x131, &x132, 0x0, x109, x123);1212 addcarryxU64(&x131, &x132, 0x0, x109, x123);
1191 var x133: u64 = undefined;1213 var x133: u64 = undefined;
1192 var x134: u1 = undefined;1214 var x134: u1 = undefined;
1193 p256AddcarryxU64(&x133, &x134, x132, x111, x125);1215 addcarryxU64(&x133, &x134, x132, x111, x125);
1194 var x135: u64 = undefined;1216 var x135: u64 = undefined;
1195 var x136: u1 = undefined;1217 var x136: u1 = undefined;
1196 p256AddcarryxU64(&x135, &x136, x134, x113, x127);1218 addcarryxU64(&x135, &x136, x134, x113, x127);
1197 var x137: u64 = undefined;1219 var x137: u64 = undefined;
1198 var x138: u1 = undefined;1220 var x138: u1 = undefined;
1199 p256AddcarryxU64(&x137, &x138, x136, x115, x129);1221 addcarryxU64(&x137, &x138, x136, x115, x129);
1200 var x139: u64 = undefined;1222 var x139: u64 = undefined;
1201 var x140: u64 = undefined;1223 var x140: u64 = undefined;
1202 p256MulxU64(&x139, &x140, x131, 0xffffffff00000001);1224 mulxU64(&x139, &x140, x131, 0xffffffff00000001);
1203 var x141: u64 = undefined;1225 var x141: u64 = undefined;
1204 var x142: u64 = undefined;1226 var x142: u64 = undefined;
1205 p256MulxU64(&x141, &x142, x131, 0xffffffff);1227 mulxU64(&x141, &x142, x131, 0xffffffff);
1206 var x143: u64 = undefined;1228 var x143: u64 = undefined;
1207 var x144: u64 = undefined;1229 var x144: u64 = undefined;
1208 p256MulxU64(&x143, &x144, x131, 0xffffffffffffffff);1230 mulxU64(&x143, &x144, x131, 0xffffffffffffffff);
1209 var x145: u64 = undefined;1231 var x145: u64 = undefined;
1210 var x146: u1 = undefined;1232 var x146: u1 = undefined;
1211 p256AddcarryxU64(&x145, &x146, 0x0, x144, x141);1233 addcarryxU64(&x145, &x146, 0x0, x144, x141);
1212 var x147: u64 = undefined;1234 var x147: u64 = undefined;
1213 var x148: u1 = undefined;1235 var x148: u1 = undefined;
1214 p256AddcarryxU64(&x147, &x148, 0x0, x131, x143);1236 addcarryxU64(&x147, &x148, 0x0, x131, x143);
1215 var x149: u64 = undefined;1237 var x149: u64 = undefined;
1216 var x150: u1 = undefined;1238 var x150: u1 = undefined;
1217 p256AddcarryxU64(&x149, &x150, x148, x133, x145);1239 addcarryxU64(&x149, &x150, x148, x133, x145);
1218 var x151: u64 = undefined;1240 var x151: u64 = undefined;
1219 var x152: u1 = undefined;1241 var x152: u1 = undefined;
1220 p256AddcarryxU64(&x151, &x152, x150, x135, (@intCast(u64, x146) + x142));1242 addcarryxU64(&x151, &x152, x150, x135, (cast(u64, x146) + x142));
1221 var x153: u64 = undefined;1243 var x153: u64 = undefined;
1222 var x154: u1 = undefined;1244 var x154: u1 = undefined;
1223 p256AddcarryxU64(&x153, &x154, x152, x137, x139);1245 addcarryxU64(&x153, &x154, x152, x137, x139);
1224 var x155: u64 = undefined;1246 var x155: u64 = undefined;
1225 var x156: u1 = undefined;1247 var x156: u1 = undefined;
1226 p256AddcarryxU64(&x155, &x156, x154, ((@intCast(u64, x138) + @intCast(u64, x116)) + (@intCast(u64, x130) + x118)), x140);1248 addcarryxU64(&x155, &x156, x154, ((cast(u64, x138) + cast(u64, x116)) + (cast(u64, x130) + x118)), x140);
1227 var x157: u64 = undefined;1249 var x157: u64 = undefined;
1228 var x158: u1 = undefined;1250 var x158: u1 = undefined;
1229 p256SubborrowxU64(&x157, &x158, 0x0, x149, 0xffffffffffffffff);1251 subborrowxU64(&x157, &x158, 0x0, x149, 0xffffffffffffffff);
1230 var x159: u64 = undefined;1252 var x159: u64 = undefined;
1231 var x160: u1 = undefined;1253 var x160: u1 = undefined;
1232 p256SubborrowxU64(&x159, &x160, x158, x151, 0xffffffff);1254 subborrowxU64(&x159, &x160, x158, x151, 0xffffffff);
1233 var x161: u64 = undefined;1255 var x161: u64 = undefined;
1234 var x162: u1 = undefined;1256 var x162: u1 = undefined;
1235 p256SubborrowxU64(&x161, &x162, x160, x153, @intCast(u64, 0x0));1257 subborrowxU64(&x161, &x162, x160, x153, cast(u64, 0x0));
1236 var x163: u64 = undefined;1258 var x163: u64 = undefined;
1237 var x164: u1 = undefined;1259 var x164: u1 = undefined;
1238 p256SubborrowxU64(&x163, &x164, x162, x155, 0xffffffff00000001);1260 subborrowxU64(&x163, &x164, x162, x155, 0xffffffff00000001);
1239 var x165: u64 = undefined;1261 var x165: u64 = undefined;
1240 var x166: u1 = undefined;1262 var x166: u1 = undefined;
1241 p256SubborrowxU64(&x165, &x166, x164, @intCast(u64, x156), @intCast(u64, 0x0));1263 subborrowxU64(&x165, &x166, x164, cast(u64, x156), cast(u64, 0x0));
1242 var x167: u64 = undefined;1264 var x167: u64 = undefined;
1243 p256CmovznzU64(&x167, x166, x157, x149);1265 cmovznzU64(&x167, x166, x157, x149);
1244 var x168: u64 = undefined;1266 var x168: u64 = undefined;
1245 p256CmovznzU64(&x168, x166, x159, x151);1267 cmovznzU64(&x168, x166, x159, x151);
1246 var x169: u64 = undefined;1268 var x169: u64 = undefined;
1247 p256CmovznzU64(&x169, x166, x161, x153);1269 cmovznzU64(&x169, x166, x161, x153);
1248 var x170: u64 = undefined;1270 var x170: u64 = undefined;
1249 p256CmovznzU64(&x170, x166, x163, x155);1271 cmovznzU64(&x170, x166, x163, x155);
1250 out1[0] = x167;1272 out1[0] = x167;
1251 out1[1] = x168;1273 out1[1] = x168;
1252 out1[2] = x169;1274 out1[2] = x169;
1253 out1[3] = x170;1275 out1[3] = x170;
1254}1276}
12551277
1256/// The function p256Nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.1278/// The function nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
1257/// Preconditions:1279/// Preconditions:
1258/// 0 ≤ eval arg1 < m1280/// 0 ≤ eval arg1 < m
1259/// Postconditions:1281/// Postconditions:
...@@ -1263,12 +1285,14 @@ pub fn p256ToMontgomery(out1: *Limbs, arg1: Limbs) void {...@@ -1263,12 +1285,14 @@ pub fn p256ToMontgomery(out1: *Limbs, arg1: Limbs) void {
1263/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1285/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1264/// Output Bounds:1286/// Output Bounds:
1265/// out1: [0x0 ~> 0xffffffffffffffff]1287/// out1: [0x0 ~> 0xffffffffffffffff]
1266pub fn p256Nonzero(out1: *u64, arg1: Limbs) void {1288pub fn nonzero(out1: *u64, arg1: [4]u64) void {
1267 const x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))));1289 @setRuntimeSafety(mode == .Debug);
1290
1291 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))));
1268 out1.* = x1;1292 out1.* = x1;
1269}1293}
12701294
1271/// The function p256Selectznz is a multi-limb conditional select.1295/// The function selectznz is a multi-limb conditional select.
1272/// Postconditions:1296/// Postconditions:
1273/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)1297/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
1274///1298///
...@@ -1278,22 +1302,24 @@ pub fn p256Nonzero(out1: *u64, arg1: Limbs) void {...@@ -1278,22 +1302,24 @@ pub fn p256Nonzero(out1: *u64, arg1: Limbs) void {
1278/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1302/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1279/// Output Bounds:1303/// Output Bounds:
1280/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1304/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1281pub fn p256Selectznz(out1: *Limbs, arg1: u1, arg2: Limbs, arg3: Limbs) void {1305pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
1306 @setRuntimeSafety(mode == .Debug);
1307
1282 var x1: u64 = undefined;1308 var x1: u64 = undefined;
1283 p256CmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));1309 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
1284 var x2: u64 = undefined;1310 var x2: u64 = undefined;
1285 p256CmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));1311 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
1286 var x3: u64 = undefined;1312 var x3: u64 = undefined;
1287 p256CmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));1313 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
1288 var x4: u64 = undefined;1314 var x4: u64 = undefined;
1289 p256CmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));1315 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
1290 out1[0] = x1;1316 out1[0] = x1;
1291 out1[1] = x2;1317 out1[1] = x2;
1292 out1[2] = x3;1318 out1[2] = x3;
1293 out1[3] = x4;1319 out1[3] = x4;
1294}1320}
12951321
1296/// The function p256ToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.1322/// The function toBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
1297/// Preconditions:1323/// Preconditions:
1298/// 0 ≤ eval arg1 < m1324/// 0 ≤ eval arg1 < m
1299/// Postconditions:1325/// Postconditions:
...@@ -1303,67 +1329,69 @@ pub fn p256Selectznz(out1: *Limbs, arg1: u1, arg2: Limbs, arg3: Limbs) void {...@@ -1303,67 +1329,69 @@ pub fn p256Selectznz(out1: *Limbs, arg1: u1, arg2: Limbs, arg3: Limbs) void {
1303/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1329/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1304/// Output Bounds:1330/// Output Bounds:
1305/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]1331/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1306pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {1332pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
1307 const x1: u64 = (arg1[3]);1333 @setRuntimeSafety(mode == .Debug);
1308 const x2: u64 = (arg1[2]);1334
1309 const x3: u64 = (arg1[1]);1335 const x1 = (arg1[3]);
1310 const x4: u64 = (arg1[0]);1336 const x2 = (arg1[2]);
1311 const x5: u8 = @intCast(u8, (x4 & @intCast(u64, 0xff)));1337 const x3 = (arg1[1]);
1312 const x6: u64 = (x4 >> 8);1338 const x4 = (arg1[0]);
1313 const x7: u8 = @intCast(u8, (x6 & @intCast(u64, 0xff)));1339 const x5 = cast(u8, (x4 & cast(u64, 0xff)));
1314 const x8: u64 = (x6 >> 8);1340 const x6 = (x4 >> 8);
1315 const x9: u8 = @intCast(u8, (x8 & @intCast(u64, 0xff)));1341 const x7 = cast(u8, (x6 & cast(u64, 0xff)));
1316 const x10: u64 = (x8 >> 8);1342 const x8 = (x6 >> 8);
1317 const x11: u8 = @intCast(u8, (x10 & @intCast(u64, 0xff)));1343 const x9 = cast(u8, (x8 & cast(u64, 0xff)));
1318 const x12: u64 = (x10 >> 8);1344 const x10 = (x8 >> 8);
1319 const x13: u8 = @intCast(u8, (x12 & @intCast(u64, 0xff)));1345 const x11 = cast(u8, (x10 & cast(u64, 0xff)));
1320 const x14: u64 = (x12 >> 8);1346 const x12 = (x10 >> 8);
1321 const x15: u8 = @intCast(u8, (x14 & @intCast(u64, 0xff)));1347 const x13 = cast(u8, (x12 & cast(u64, 0xff)));
1322 const x16: u64 = (x14 >> 8);1348 const x14 = (x12 >> 8);
1323 const x17: u8 = @intCast(u8, (x16 & @intCast(u64, 0xff)));1349 const x15 = cast(u8, (x14 & cast(u64, 0xff)));
1324 const x18: u8 = @intCast(u8, (x16 >> 8));1350 const x16 = (x14 >> 8);
1325 const x19: u8 = @intCast(u8, (x3 & @intCast(u64, 0xff)));1351 const x17 = cast(u8, (x16 & cast(u64, 0xff)));
1326 const x20: u64 = (x3 >> 8);1352 const x18 = cast(u8, (x16 >> 8));
1327 const x21: u8 = @intCast(u8, (x20 & @intCast(u64, 0xff)));1353 const x19 = cast(u8, (x3 & cast(u64, 0xff)));
1328 const x22: u64 = (x20 >> 8);1354 const x20 = (x3 >> 8);
1329 const x23: u8 = @intCast(u8, (x22 & @intCast(u64, 0xff)));1355 const x21 = cast(u8, (x20 & cast(u64, 0xff)));
1330 const x24: u64 = (x22 >> 8);1356 const x22 = (x20 >> 8);
1331 const x25: u8 = @intCast(u8, (x24 & @intCast(u64, 0xff)));1357 const x23 = cast(u8, (x22 & cast(u64, 0xff)));
1332 const x26: u64 = (x24 >> 8);1358 const x24 = (x22 >> 8);
1333 const x27: u8 = @intCast(u8, (x26 & @intCast(u64, 0xff)));1359 const x25 = cast(u8, (x24 & cast(u64, 0xff)));
1334 const x28: u64 = (x26 >> 8);1360 const x26 = (x24 >> 8);
1335 const x29: u8 = @intCast(u8, (x28 & @intCast(u64, 0xff)));1361 const x27 = cast(u8, (x26 & cast(u64, 0xff)));
1336 const x30: u64 = (x28 >> 8);1362 const x28 = (x26 >> 8);
1337 const x31: u8 = @intCast(u8, (x30 & @intCast(u64, 0xff)));1363 const x29 = cast(u8, (x28 & cast(u64, 0xff)));
1338 const x32: u8 = @intCast(u8, (x30 >> 8));1364 const x30 = (x28 >> 8);
1339 const x33: u8 = @intCast(u8, (x2 & @intCast(u64, 0xff)));1365 const x31 = cast(u8, (x30 & cast(u64, 0xff)));
1340 const x34: u64 = (x2 >> 8);1366 const x32 = cast(u8, (x30 >> 8));
1341 const x35: u8 = @intCast(u8, (x34 & @intCast(u64, 0xff)));1367 const x33 = cast(u8, (x2 & cast(u64, 0xff)));
1342 const x36: u64 = (x34 >> 8);1368 const x34 = (x2 >> 8);
1343 const x37: u8 = @intCast(u8, (x36 & @intCast(u64, 0xff)));1369 const x35 = cast(u8, (x34 & cast(u64, 0xff)));
1344 const x38: u64 = (x36 >> 8);1370 const x36 = (x34 >> 8);
1345 const x39: u8 = @intCast(u8, (x38 & @intCast(u64, 0xff)));1371 const x37 = cast(u8, (x36 & cast(u64, 0xff)));
1346 const x40: u64 = (x38 >> 8);1372 const x38 = (x36 >> 8);
1347 const x41: u8 = @intCast(u8, (x40 & @intCast(u64, 0xff)));1373 const x39 = cast(u8, (x38 & cast(u64, 0xff)));
1348 const x42: u64 = (x40 >> 8);1374 const x40 = (x38 >> 8);
1349 const x43: u8 = @intCast(u8, (x42 & @intCast(u64, 0xff)));1375 const x41 = cast(u8, (x40 & cast(u64, 0xff)));
1350 const x44: u64 = (x42 >> 8);1376 const x42 = (x40 >> 8);
1351 const x45: u8 = @intCast(u8, (x44 & @intCast(u64, 0xff)));1377 const x43 = cast(u8, (x42 & cast(u64, 0xff)));
1352 const x46: u8 = @intCast(u8, (x44 >> 8));1378 const x44 = (x42 >> 8);
1353 const x47: u8 = @intCast(u8, (x1 & @intCast(u64, 0xff)));1379 const x45 = cast(u8, (x44 & cast(u64, 0xff)));
1354 const x48: u64 = (x1 >> 8);1380 const x46 = cast(u8, (x44 >> 8));
1355 const x49: u8 = @intCast(u8, (x48 & @intCast(u64, 0xff)));1381 const x47 = cast(u8, (x1 & cast(u64, 0xff)));
1356 const x50: u64 = (x48 >> 8);1382 const x48 = (x1 >> 8);
1357 const x51: u8 = @intCast(u8, (x50 & @intCast(u64, 0xff)));1383 const x49 = cast(u8, (x48 & cast(u64, 0xff)));
1358 const x52: u64 = (x50 >> 8);1384 const x50 = (x48 >> 8);
1359 const x53: u8 = @intCast(u8, (x52 & @intCast(u64, 0xff)));1385 const x51 = cast(u8, (x50 & cast(u64, 0xff)));
1360 const x54: u64 = (x52 >> 8);1386 const x52 = (x50 >> 8);
1361 const x55: u8 = @intCast(u8, (x54 & @intCast(u64, 0xff)));1387 const x53 = cast(u8, (x52 & cast(u64, 0xff)));
1362 const x56: u64 = (x54 >> 8);1388 const x54 = (x52 >> 8);
1363 const x57: u8 = @intCast(u8, (x56 & @intCast(u64, 0xff)));1389 const x55 = cast(u8, (x54 & cast(u64, 0xff)));
1364 const x58: u64 = (x56 >> 8);1390 const x56 = (x54 >> 8);
1365 const x59: u8 = @intCast(u8, (x58 & @intCast(u64, 0xff)));1391 const x57 = cast(u8, (x56 & cast(u64, 0xff)));
1366 const x60: u8 = @intCast(u8, (x58 >> 8));1392 const x58 = (x56 >> 8);
1393 const x59 = cast(u8, (x58 & cast(u64, 0xff)));
1394 const x60 = cast(u8, (x58 >> 8));
1367 out1[0] = x5;1395 out1[0] = x5;
1368 out1[1] = x7;1396 out1[1] = x7;
1369 out1[2] = x9;1397 out1[2] = x9;
...@@ -1398,7 +1426,7 @@ pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {...@@ -1398,7 +1426,7 @@ pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {
1398 out1[31] = x60;1426 out1[31] = x60;
1399}1427}
14001428
1401/// The function p256FromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.1429/// The function fromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
1402/// Preconditions:1430/// Preconditions:
1403/// 0 ≤ bytes_eval arg1 < m1431/// 0 ≤ bytes_eval arg1 < m
1404/// Postconditions:1432/// Postconditions:
...@@ -1409,74 +1437,76 @@ pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {...@@ -1409,74 +1437,76 @@ pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {
1409/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]1437/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1410/// Output Bounds:1438/// Output Bounds:
1411/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1439/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1412pub fn p256FromBytes(out1: *Limbs, arg1: [32]u8) void {1440pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
1413 const x1: u64 = (@intCast(u64, (arg1[31])) << 56);1441 @setRuntimeSafety(mode == .Debug);
1414 const x2: u64 = (@intCast(u64, (arg1[30])) << 48);1442
1415 const x3: u64 = (@intCast(u64, (arg1[29])) << 40);1443 const x1 = (cast(u64, (arg1[31])) << 56);
1416 const x4: u64 = (@intCast(u64, (arg1[28])) << 32);1444 const x2 = (cast(u64, (arg1[30])) << 48);
1417 const x5: u64 = (@intCast(u64, (arg1[27])) << 24);1445 const x3 = (cast(u64, (arg1[29])) << 40);
1418 const x6: u64 = (@intCast(u64, (arg1[26])) << 16);1446 const x4 = (cast(u64, (arg1[28])) << 32);
1419 const x7: u64 = (@intCast(u64, (arg1[25])) << 8);1447 const x5 = (cast(u64, (arg1[27])) << 24);
1420 const x8: u8 = (arg1[24]);1448 const x6 = (cast(u64, (arg1[26])) << 16);
1421 const x9: u64 = (@intCast(u64, (arg1[23])) << 56);1449 const x7 = (cast(u64, (arg1[25])) << 8);
1422 const x10: u64 = (@intCast(u64, (arg1[22])) << 48);1450 const x8 = (arg1[24]);
1423 const x11: u64 = (@intCast(u64, (arg1[21])) << 40);1451 const x9 = (cast(u64, (arg1[23])) << 56);
1424 const x12: u64 = (@intCast(u64, (arg1[20])) << 32);1452 const x10 = (cast(u64, (arg1[22])) << 48);
1425 const x13: u64 = (@intCast(u64, (arg1[19])) << 24);1453 const x11 = (cast(u64, (arg1[21])) << 40);
1426 const x14: u64 = (@intCast(u64, (arg1[18])) << 16);1454 const x12 = (cast(u64, (arg1[20])) << 32);
1427 const x15: u64 = (@intCast(u64, (arg1[17])) << 8);1455 const x13 = (cast(u64, (arg1[19])) << 24);
1428 const x16: u8 = (arg1[16]);1456 const x14 = (cast(u64, (arg1[18])) << 16);
1429 const x17: u64 = (@intCast(u64, (arg1[15])) << 56);1457 const x15 = (cast(u64, (arg1[17])) << 8);
1430 const x18: u64 = (@intCast(u64, (arg1[14])) << 48);1458 const x16 = (arg1[16]);
1431 const x19: u64 = (@intCast(u64, (arg1[13])) << 40);1459 const x17 = (cast(u64, (arg1[15])) << 56);
1432 const x20: u64 = (@intCast(u64, (arg1[12])) << 32);1460 const x18 = (cast(u64, (arg1[14])) << 48);
1433 const x21: u64 = (@intCast(u64, (arg1[11])) << 24);1461 const x19 = (cast(u64, (arg1[13])) << 40);
1434 const x22: u64 = (@intCast(u64, (arg1[10])) << 16);1462 const x20 = (cast(u64, (arg1[12])) << 32);
1435 const x23: u64 = (@intCast(u64, (arg1[9])) << 8);1463 const x21 = (cast(u64, (arg1[11])) << 24);
1436 const x24: u8 = (arg1[8]);1464 const x22 = (cast(u64, (arg1[10])) << 16);
1437 const x25: u64 = (@intCast(u64, (arg1[7])) << 56);1465 const x23 = (cast(u64, (arg1[9])) << 8);
1438 const x26: u64 = (@intCast(u64, (arg1[6])) << 48);1466 const x24 = (arg1[8]);
1439 const x27: u64 = (@intCast(u64, (arg1[5])) << 40);1467 const x25 = (cast(u64, (arg1[7])) << 56);
1440 const x28: u64 = (@intCast(u64, (arg1[4])) << 32);1468 const x26 = (cast(u64, (arg1[6])) << 48);
1441 const x29: u64 = (@intCast(u64, (arg1[3])) << 24);1469 const x27 = (cast(u64, (arg1[5])) << 40);
1442 const x30: u64 = (@intCast(u64, (arg1[2])) << 16);1470 const x28 = (cast(u64, (arg1[4])) << 32);
1443 const x31: u64 = (@intCast(u64, (arg1[1])) << 8);1471 const x29 = (cast(u64, (arg1[3])) << 24);
1444 const x32: u8 = (arg1[0]);1472 const x30 = (cast(u64, (arg1[2])) << 16);
1445 const x33: u64 = (x31 + @intCast(u64, x32));1473 const x31 = (cast(u64, (arg1[1])) << 8);
1446 const x34: u64 = (x30 + x33);1474 const x32 = (arg1[0]);
1447 const x35: u64 = (x29 + x34);1475 const x33 = (x31 + cast(u64, x32));
1448 const x36: u64 = (x28 + x35);1476 const x34 = (x30 + x33);
1449 const x37: u64 = (x27 + x36);1477 const x35 = (x29 + x34);
1450 const x38: u64 = (x26 + x37);1478 const x36 = (x28 + x35);
1451 const x39: u64 = (x25 + x38);1479 const x37 = (x27 + x36);
1452 const x40: u64 = (x23 + @intCast(u64, x24));1480 const x38 = (x26 + x37);
1453 const x41: u64 = (x22 + x40);1481 const x39 = (x25 + x38);
1454 const x42: u64 = (x21 + x41);1482 const x40 = (x23 + cast(u64, x24));
1455 const x43: u64 = (x20 + x42);1483 const x41 = (x22 + x40);
1456 const x44: u64 = (x19 + x43);1484 const x42 = (x21 + x41);
1457 const x45: u64 = (x18 + x44);1485 const x43 = (x20 + x42);
1458 const x46: u64 = (x17 + x45);1486 const x44 = (x19 + x43);
1459 const x47: u64 = (x15 + @intCast(u64, x16));1487 const x45 = (x18 + x44);
1460 const x48: u64 = (x14 + x47);1488 const x46 = (x17 + x45);
1461 const x49: u64 = (x13 + x48);1489 const x47 = (x15 + cast(u64, x16));
1462 const x50: u64 = (x12 + x49);1490 const x48 = (x14 + x47);
1463 const x51: u64 = (x11 + x50);1491 const x49 = (x13 + x48);
1464 const x52: u64 = (x10 + x51);1492 const x50 = (x12 + x49);
1465 const x53: u64 = (x9 + x52);1493 const x51 = (x11 + x50);
1466 const x54: u64 = (x7 + @intCast(u64, x8));1494 const x52 = (x10 + x51);
1467 const x55: u64 = (x6 + x54);1495 const x53 = (x9 + x52);
1468 const x56: u64 = (x5 + x55);1496 const x54 = (x7 + cast(u64, x8));
1469 const x57: u64 = (x4 + x56);1497 const x55 = (x6 + x54);
1470 const x58: u64 = (x3 + x57);1498 const x56 = (x5 + x55);
1471 const x59: u64 = (x2 + x58);1499 const x57 = (x4 + x56);
1472 const x60: u64 = (x1 + x59);1500 const x58 = (x3 + x57);
1501 const x59 = (x2 + x58);
1502 const x60 = (x1 + x59);
1473 out1[0] = x39;1503 out1[0] = x39;
1474 out1[1] = x46;1504 out1[1] = x46;
1475 out1[2] = x53;1505 out1[2] = x53;
1476 out1[3] = x60;1506 out1[3] = x60;
1477}1507}
14781508
1479/// The function p256SetOne returns the field element one in the Montgomery domain.1509/// The function setOne returns the field element one in the Montgomery domain.
1480/// Postconditions:1510/// Postconditions:
1481/// eval (from_montgomery out1) mod m = 1 mod m1511/// eval (from_montgomery out1) mod m = 1 mod m
1482/// 0 ≤ eval out1 < m1512/// 0 ≤ eval out1 < m
...@@ -1484,14 +1514,16 @@ pub fn p256FromBytes(out1: *Limbs, arg1: [32]u8) void {...@@ -1484,14 +1514,16 @@ pub fn p256FromBytes(out1: *Limbs, arg1: [32]u8) void {
1484/// Input Bounds:1514/// Input Bounds:
1485/// Output Bounds:1515/// Output Bounds:
1486/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1516/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1487pub fn p256SetOne(out1: *Limbs) void {1517pub fn setOne(out1: *[4]u64) void {
1488 out1[0] = @intCast(u64, 0x1);1518 @setRuntimeSafety(mode == .Debug);
1519
1520 out1[0] = cast(u64, 0x1);
1489 out1[1] = 0xffffffff00000000;1521 out1[1] = 0xffffffff00000000;
1490 out1[2] = 0xffffffffffffffff;1522 out1[2] = 0xffffffffffffffff;
1491 out1[3] = 0xfffffffe;1523 out1[3] = 0xfffffffe;
1492}1524}
14931525
1494/// The function p256Msat returns the saturated representation of the prime modulus.1526/// The function msat returns the saturated representation of the prime modulus.
1495/// Postconditions:1527/// Postconditions:
1496/// twos_complement_eval out1 = m1528/// twos_complement_eval out1 = m
1497/// 0 ≤ eval out1 < m1529/// 0 ≤ eval out1 < m
...@@ -1499,15 +1531,17 @@ pub fn p256SetOne(out1: *Limbs) void {...@@ -1499,15 +1531,17 @@ pub fn p256SetOne(out1: *Limbs) void {
1499/// Input Bounds:1531/// Input Bounds:
1500/// Output Bounds:1532/// Output Bounds:
1501/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1533/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1502pub fn p256Msat(out1: *[5]u64) void {1534pub fn msat(out1: *[5]u64) void {
1535 @setRuntimeSafety(mode == .Debug);
1536
1503 out1[0] = 0xffffffffffffffff;1537 out1[0] = 0xffffffffffffffff;
1504 out1[1] = 0xffffffff;1538 out1[1] = 0xffffffff;
1505 out1[2] = @intCast(u64, 0x0);1539 out1[2] = cast(u64, 0x0);
1506 out1[3] = 0xffffffff00000001;1540 out1[3] = 0xffffffff00000001;
1507 out1[4] = @intCast(u64, 0x0);1541 out1[4] = cast(u64, 0x0);
1508}1542}
15091543
1510/// The function p256Divstep computes a divstep.1544/// The function divstep computes a divstep.
1511/// Preconditions:1545/// Preconditions:
1512/// 0 ≤ eval arg4 < m1546/// 0 ≤ eval arg4 < m
1513/// 0 ≤ eval arg5 < m1547/// 0 ≤ eval arg5 < m
...@@ -1534,209 +1568,211 @@ pub fn p256Msat(out1: *[5]u64) void {...@@ -1534,209 +1568,211 @@ pub fn p256Msat(out1: *[5]u64) void {
1534/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1568/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1535/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1569/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1536/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1570/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1537pub fn p256Divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *Limbs, out5: *Limbs, arg1: u64, arg2: [5]u64, arg3: [5]u64, arg4: Limbs, arg5: Limbs) void {1571pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[4]u64, arg1: u64, arg2: [5]u64, arg3: [5]u64, arg4: [4]u64, arg5: [4]u64) void {
1572 @setRuntimeSafety(mode == .Debug);
1573
1538 var x1: u64 = undefined;1574 var x1: u64 = undefined;
1539 var x2: u1 = undefined;1575 var x2: u1 = undefined;
1540 p256AddcarryxU64(&x1, &x2, 0x0, (~arg1), @intCast(u64, 0x1));1576 addcarryxU64(&x1, &x2, 0x0, (~arg1), cast(u64, 0x1));
1541 const x3: u1 = (@intCast(u1, (x1 >> 63)) & @intCast(u1, ((arg3[0]) & @intCast(u64, 0x1))));1577 const x3 = (cast(u1, (x1 >> 63)) & cast(u1, ((arg3[0]) & cast(u64, 0x1))));
1542 var x4: u64 = undefined;1578 var x4: u64 = undefined;
1543 var x5: u1 = undefined;1579 var x5: u1 = undefined;
1544 p256AddcarryxU64(&x4, &x5, 0x0, (~arg1), @intCast(u64, 0x1));1580 addcarryxU64(&x4, &x5, 0x0, (~arg1), cast(u64, 0x1));
1545 var x6: u64 = undefined;1581 var x6: u64 = undefined;
1546 p256CmovznzU64(&x6, x3, arg1, x4);1582 cmovznzU64(&x6, x3, arg1, x4);
1547 var x7: u64 = undefined;1583 var x7: u64 = undefined;
1548 p256CmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));1584 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
1549 var x8: u64 = undefined;1585 var x8: u64 = undefined;
1550 p256CmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));1586 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
1551 var x9: u64 = undefined;1587 var x9: u64 = undefined;
1552 p256CmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));1588 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
1553 var x10: u64 = undefined;1589 var x10: u64 = undefined;
1554 p256CmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));1590 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
1555 var x11: u64 = undefined;1591 var x11: u64 = undefined;
1556 p256CmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));1592 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
1557 var x12: u64 = undefined;1593 var x12: u64 = undefined;
1558 var x13: u1 = undefined;1594 var x13: u1 = undefined;
1559 p256AddcarryxU64(&x12, &x13, 0x0, @intCast(u64, 0x1), (~(arg2[0])));1595 addcarryxU64(&x12, &x13, 0x0, cast(u64, 0x1), (~(arg2[0])));
1560 var x14: u64 = undefined;1596 var x14: u64 = undefined;
1561 var x15: u1 = undefined;1597 var x15: u1 = undefined;
1562 p256AddcarryxU64(&x14, &x15, x13, @intCast(u64, 0x0), (~(arg2[1])));1598 addcarryxU64(&x14, &x15, x13, cast(u64, 0x0), (~(arg2[1])));
1563 var x16: u64 = undefined;1599 var x16: u64 = undefined;
1564 var x17: u1 = undefined;1600 var x17: u1 = undefined;
1565 p256AddcarryxU64(&x16, &x17, x15, @intCast(u64, 0x0), (~(arg2[2])));1601 addcarryxU64(&x16, &x17, x15, cast(u64, 0x0), (~(arg2[2])));
1566 var x18: u64 = undefined;1602 var x18: u64 = undefined;
1567 var x19: u1 = undefined;1603 var x19: u1 = undefined;
1568 p256AddcarryxU64(&x18, &x19, x17, @intCast(u64, 0x0), (~(arg2[3])));1604 addcarryxU64(&x18, &x19, x17, cast(u64, 0x0), (~(arg2[3])));
1569 var x20: u64 = undefined;1605 var x20: u64 = undefined;
1570 var x21: u1 = undefined;1606 var x21: u1 = undefined;
1571 p256AddcarryxU64(&x20, &x21, x19, @intCast(u64, 0x0), (~(arg2[4])));1607 addcarryxU64(&x20, &x21, x19, cast(u64, 0x0), (~(arg2[4])));
1572 var x22: u64 = undefined;1608 var x22: u64 = undefined;
1573 p256CmovznzU64(&x22, x3, (arg3[0]), x12);1609 cmovznzU64(&x22, x3, (arg3[0]), x12);
1574 var x23: u64 = undefined;1610 var x23: u64 = undefined;
1575 p256CmovznzU64(&x23, x3, (arg3[1]), x14);1611 cmovznzU64(&x23, x3, (arg3[1]), x14);
1576 var x24: u64 = undefined;1612 var x24: u64 = undefined;
1577 p256CmovznzU64(&x24, x3, (arg3[2]), x16);1613 cmovznzU64(&x24, x3, (arg3[2]), x16);
1578 var x25: u64 = undefined;1614 var x25: u64 = undefined;
1579 p256CmovznzU64(&x25, x3, (arg3[3]), x18);1615 cmovznzU64(&x25, x3, (arg3[3]), x18);
1580 var x26: u64 = undefined;1616 var x26: u64 = undefined;
1581 p256CmovznzU64(&x26, x3, (arg3[4]), x20);1617 cmovznzU64(&x26, x3, (arg3[4]), x20);
1582 var x27: u64 = undefined;1618 var x27: u64 = undefined;
1583 p256CmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));1619 cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
1584 var x28: u64 = undefined;1620 var x28: u64 = undefined;
1585 p256CmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));1621 cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
1586 var x29: u64 = undefined;1622 var x29: u64 = undefined;
1587 p256CmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));1623 cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
1588 var x30: u64 = undefined;1624 var x30: u64 = undefined;
1589 p256CmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));1625 cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
1590 var x31: u64 = undefined;1626 var x31: u64 = undefined;
1591 var x32: u1 = undefined;1627 var x32: u1 = undefined;
1592 p256AddcarryxU64(&x31, &x32, 0x0, x27, x27);1628 addcarryxU64(&x31, &x32, 0x0, x27, x27);
1593 var x33: u64 = undefined;1629 var x33: u64 = undefined;
1594 var x34: u1 = undefined;1630 var x34: u1 = undefined;
1595 p256AddcarryxU64(&x33, &x34, x32, x28, x28);1631 addcarryxU64(&x33, &x34, x32, x28, x28);
1596 var x35: u64 = undefined;1632 var x35: u64 = undefined;
1597 var x36: u1 = undefined;1633 var x36: u1 = undefined;
1598 p256AddcarryxU64(&x35, &x36, x34, x29, x29);1634 addcarryxU64(&x35, &x36, x34, x29, x29);
1599 var x37: u64 = undefined;1635 var x37: u64 = undefined;
1600 var x38: u1 = undefined;1636 var x38: u1 = undefined;
1601 p256AddcarryxU64(&x37, &x38, x36, x30, x30);1637 addcarryxU64(&x37, &x38, x36, x30, x30);
1602 var x39: u64 = undefined;1638 var x39: u64 = undefined;
1603 var x40: u1 = undefined;1639 var x40: u1 = undefined;
1604 p256SubborrowxU64(&x39, &x40, 0x0, x31, 0xffffffffffffffff);1640 subborrowxU64(&x39, &x40, 0x0, x31, 0xffffffffffffffff);
1605 var x41: u64 = undefined;1641 var x41: u64 = undefined;
1606 var x42: u1 = undefined;1642 var x42: u1 = undefined;
1607 p256SubborrowxU64(&x41, &x42, x40, x33, 0xffffffff);1643 subborrowxU64(&x41, &x42, x40, x33, 0xffffffff);
1608 var x43: u64 = undefined;1644 var x43: u64 = undefined;
1609 var x44: u1 = undefined;1645 var x44: u1 = undefined;
1610 p256SubborrowxU64(&x43, &x44, x42, x35, @intCast(u64, 0x0));1646 subborrowxU64(&x43, &x44, x42, x35, cast(u64, 0x0));
1611 var x45: u64 = undefined;1647 var x45: u64 = undefined;
1612 var x46: u1 = undefined;1648 var x46: u1 = undefined;
1613 p256SubborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000001);1649 subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000001);
1614 var x47: u64 = undefined;1650 var x47: u64 = undefined;
1615 var x48: u1 = undefined;1651 var x48: u1 = undefined;
1616 p256SubborrowxU64(&x47, &x48, x46, @intCast(u64, x38), @intCast(u64, 0x0));1652 subborrowxU64(&x47, &x48, x46, cast(u64, x38), cast(u64, 0x0));
1617 const x49: u64 = (arg4[3]);1653 const x49 = (arg4[3]);
1618 const x50: u64 = (arg4[2]);1654 const x50 = (arg4[2]);
1619 const x51: u64 = (arg4[1]);1655 const x51 = (arg4[1]);
1620 const x52: u64 = (arg4[0]);1656 const x52 = (arg4[0]);
1621 var x53: u64 = undefined;1657 var x53: u64 = undefined;
1622 var x54: u1 = undefined;1658 var x54: u1 = undefined;
1623 p256SubborrowxU64(&x53, &x54, 0x0, @intCast(u64, 0x0), x52);1659 subborrowxU64(&x53, &x54, 0x0, cast(u64, 0x0), x52);
1624 var x55: u64 = undefined;1660 var x55: u64 = undefined;
1625 var x56: u1 = undefined;1661 var x56: u1 = undefined;
1626 p256SubborrowxU64(&x55, &x56, x54, @intCast(u64, 0x0), x51);1662 subborrowxU64(&x55, &x56, x54, cast(u64, 0x0), x51);
1627 var x57: u64 = undefined;1663 var x57: u64 = undefined;
1628 var x58: u1 = undefined;1664 var x58: u1 = undefined;
1629 p256SubborrowxU64(&x57, &x58, x56, @intCast(u64, 0x0), x50);1665 subborrowxU64(&x57, &x58, x56, cast(u64, 0x0), x50);
1630 var x59: u64 = undefined;1666 var x59: u64 = undefined;
1631 var x60: u1 = undefined;1667 var x60: u1 = undefined;
1632 p256SubborrowxU64(&x59, &x60, x58, @intCast(u64, 0x0), x49);1668 subborrowxU64(&x59, &x60, x58, cast(u64, 0x0), x49);
1633 var x61: u64 = undefined;1669 var x61: u64 = undefined;
1634 p256CmovznzU64(&x61, x60, @intCast(u64, 0x0), 0xffffffffffffffff);1670 cmovznzU64(&x61, x60, cast(u64, 0x0), 0xffffffffffffffff);
1635 var x62: u64 = undefined;1671 var x62: u64 = undefined;
1636 var x63: u1 = undefined;1672 var x63: u1 = undefined;
1637 p256AddcarryxU64(&x62, &x63, 0x0, x53, x61);1673 addcarryxU64(&x62, &x63, 0x0, x53, x61);
1638 var x64: u64 = undefined;1674 var x64: u64 = undefined;
1639 var x65: u1 = undefined;1675 var x65: u1 = undefined;
1640 p256AddcarryxU64(&x64, &x65, x63, x55, (x61 & 0xffffffff));1676 addcarryxU64(&x64, &x65, x63, x55, (x61 & 0xffffffff));
1641 var x66: u64 = undefined;1677 var x66: u64 = undefined;
1642 var x67: u1 = undefined;1678 var x67: u1 = undefined;
1643 p256AddcarryxU64(&x66, &x67, x65, x57, @intCast(u64, 0x0));1679 addcarryxU64(&x66, &x67, x65, x57, cast(u64, 0x0));
1644 var x68: u64 = undefined;1680 var x68: u64 = undefined;
1645 var x69: u1 = undefined;1681 var x69: u1 = undefined;
1646 p256AddcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000001));1682 addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000001));
1647 var x70: u64 = undefined;1683 var x70: u64 = undefined;
1648 p256CmovznzU64(&x70, x3, (arg5[0]), x62);1684 cmovznzU64(&x70, x3, (arg5[0]), x62);
1649 var x71: u64 = undefined;1685 var x71: u64 = undefined;
1650 p256CmovznzU64(&x71, x3, (arg5[1]), x64);1686 cmovznzU64(&x71, x3, (arg5[1]), x64);
1651 var x72: u64 = undefined;1687 var x72: u64 = undefined;
1652 p256CmovznzU64(&x72, x3, (arg5[2]), x66);1688 cmovznzU64(&x72, x3, (arg5[2]), x66);
1653 var x73: u64 = undefined;1689 var x73: u64 = undefined;
1654 p256CmovznzU64(&x73, x3, (arg5[3]), x68);1690 cmovznzU64(&x73, x3, (arg5[3]), x68);
1655 const x74: u1 = @intCast(u1, (x22 & @intCast(u64, 0x1)));1691 const x74 = cast(u1, (x22 & cast(u64, 0x1)));
1656 var x75: u64 = undefined;1692 var x75: u64 = undefined;
1657 p256CmovznzU64(&x75, x74, @intCast(u64, 0x0), x7);1693 cmovznzU64(&x75, x74, cast(u64, 0x0), x7);
1658 var x76: u64 = undefined;1694 var x76: u64 = undefined;
1659 p256CmovznzU64(&x76, x74, @intCast(u64, 0x0), x8);1695 cmovznzU64(&x76, x74, cast(u64, 0x0), x8);
1660 var x77: u64 = undefined;1696 var x77: u64 = undefined;
1661 p256CmovznzU64(&x77, x74, @intCast(u64, 0x0), x9);1697 cmovznzU64(&x77, x74, cast(u64, 0x0), x9);
1662 var x78: u64 = undefined;1698 var x78: u64 = undefined;
1663 p256CmovznzU64(&x78, x74, @intCast(u64, 0x0), x10);1699 cmovznzU64(&x78, x74, cast(u64, 0x0), x10);
1664 var x79: u64 = undefined;1700 var x79: u64 = undefined;
1665 p256CmovznzU64(&x79, x74, @intCast(u64, 0x0), x11);1701 cmovznzU64(&x79, x74, cast(u64, 0x0), x11);
1666 var x80: u64 = undefined;1702 var x80: u64 = undefined;
1667 var x81: u1 = undefined;1703 var x81: u1 = undefined;
1668 p256AddcarryxU64(&x80, &x81, 0x0, x22, x75);1704 addcarryxU64(&x80, &x81, 0x0, x22, x75);
1669 var x82: u64 = undefined;1705 var x82: u64 = undefined;
1670 var x83: u1 = undefined;1706 var x83: u1 = undefined;
1671 p256AddcarryxU64(&x82, &x83, x81, x23, x76);1707 addcarryxU64(&x82, &x83, x81, x23, x76);
1672 var x84: u64 = undefined;1708 var x84: u64 = undefined;
1673 var x85: u1 = undefined;1709 var x85: u1 = undefined;
1674 p256AddcarryxU64(&x84, &x85, x83, x24, x77);1710 addcarryxU64(&x84, &x85, x83, x24, x77);
1675 var x86: u64 = undefined;1711 var x86: u64 = undefined;
1676 var x87: u1 = undefined;1712 var x87: u1 = undefined;
1677 p256AddcarryxU64(&x86, &x87, x85, x25, x78);1713 addcarryxU64(&x86, &x87, x85, x25, x78);
1678 var x88: u64 = undefined;1714 var x88: u64 = undefined;
1679 var x89: u1 = undefined;1715 var x89: u1 = undefined;
1680 p256AddcarryxU64(&x88, &x89, x87, x26, x79);1716 addcarryxU64(&x88, &x89, x87, x26, x79);
1681 var x90: u64 = undefined;1717 var x90: u64 = undefined;
1682 p256CmovznzU64(&x90, x74, @intCast(u64, 0x0), x27);1718 cmovznzU64(&x90, x74, cast(u64, 0x0), x27);
1683 var x91: u64 = undefined;1719 var x91: u64 = undefined;
1684 p256CmovznzU64(&x91, x74, @intCast(u64, 0x0), x28);1720 cmovznzU64(&x91, x74, cast(u64, 0x0), x28);
1685 var x92: u64 = undefined;1721 var x92: u64 = undefined;
1686 p256CmovznzU64(&x92, x74, @intCast(u64, 0x0), x29);1722 cmovznzU64(&x92, x74, cast(u64, 0x0), x29);
1687 var x93: u64 = undefined;1723 var x93: u64 = undefined;
1688 p256CmovznzU64(&x93, x74, @intCast(u64, 0x0), x30);1724 cmovznzU64(&x93, x74, cast(u64, 0x0), x30);
1689 var x94: u64 = undefined;1725 var x94: u64 = undefined;
1690 var x95: u1 = undefined;1726 var x95: u1 = undefined;
1691 p256AddcarryxU64(&x94, &x95, 0x0, x70, x90);1727 addcarryxU64(&x94, &x95, 0x0, x70, x90);
1692 var x96: u64 = undefined;1728 var x96: u64 = undefined;
1693 var x97: u1 = undefined;1729 var x97: u1 = undefined;
1694 p256AddcarryxU64(&x96, &x97, x95, x71, x91);1730 addcarryxU64(&x96, &x97, x95, x71, x91);
1695 var x98: u64 = undefined;1731 var x98: u64 = undefined;
1696 var x99: u1 = undefined;1732 var x99: u1 = undefined;
1697 p256AddcarryxU64(&x98, &x99, x97, x72, x92);1733 addcarryxU64(&x98, &x99, x97, x72, x92);
1698 var x100: u64 = undefined;1734 var x100: u64 = undefined;
1699 var x101: u1 = undefined;1735 var x101: u1 = undefined;
1700 p256AddcarryxU64(&x100, &x101, x99, x73, x93);1736 addcarryxU64(&x100, &x101, x99, x73, x93);
1701 var x102: u64 = undefined;1737 var x102: u64 = undefined;
1702 var x103: u1 = undefined;1738 var x103: u1 = undefined;
1703 p256SubborrowxU64(&x102, &x103, 0x0, x94, 0xffffffffffffffff);1739 subborrowxU64(&x102, &x103, 0x0, x94, 0xffffffffffffffff);
1704 var x104: u64 = undefined;1740 var x104: u64 = undefined;
1705 var x105: u1 = undefined;1741 var x105: u1 = undefined;
1706 p256SubborrowxU64(&x104, &x105, x103, x96, 0xffffffff);1742 subborrowxU64(&x104, &x105, x103, x96, 0xffffffff);
1707 var x106: u64 = undefined;1743 var x106: u64 = undefined;
1708 var x107: u1 = undefined;1744 var x107: u1 = undefined;
1709 p256SubborrowxU64(&x106, &x107, x105, x98, @intCast(u64, 0x0));1745 subborrowxU64(&x106, &x107, x105, x98, cast(u64, 0x0));
1710 var x108: u64 = undefined;1746 var x108: u64 = undefined;
1711 var x109: u1 = undefined;1747 var x109: u1 = undefined;
1712 p256SubborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000001);1748 subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000001);
1713 var x110: u64 = undefined;1749 var x110: u64 = undefined;
1714 var x111: u1 = undefined;1750 var x111: u1 = undefined;
1715 p256SubborrowxU64(&x110, &x111, x109, @intCast(u64, x101), @intCast(u64, 0x0));1751 subborrowxU64(&x110, &x111, x109, cast(u64, x101), cast(u64, 0x0));
1716 var x112: u64 = undefined;1752 var x112: u64 = undefined;
1717 var x113: u1 = undefined;1753 var x113: u1 = undefined;
1718 p256AddcarryxU64(&x112, &x113, 0x0, x6, @intCast(u64, 0x1));1754 addcarryxU64(&x112, &x113, 0x0, x6, cast(u64, 0x1));
1719 const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));1755 const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1720 const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));1756 const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1721 const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));1757 const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1722 const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));1758 const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1723 const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1));1759 const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1));
1724 var x119: u64 = undefined;1760 var x119: u64 = undefined;
1725 p256CmovznzU64(&x119, x48, x39, x31);1761 cmovznzU64(&x119, x48, x39, x31);
1726 var x120: u64 = undefined;1762 var x120: u64 = undefined;
1727 p256CmovznzU64(&x120, x48, x41, x33);1763 cmovznzU64(&x120, x48, x41, x33);
1728 var x121: u64 = undefined;1764 var x121: u64 = undefined;
1729 p256CmovznzU64(&x121, x48, x43, x35);1765 cmovznzU64(&x121, x48, x43, x35);
1730 var x122: u64 = undefined;1766 var x122: u64 = undefined;
1731 p256CmovznzU64(&x122, x48, x45, x37);1767 cmovznzU64(&x122, x48, x45, x37);
1732 var x123: u64 = undefined;1768 var x123: u64 = undefined;
1733 p256CmovznzU64(&x123, x111, x102, x94);1769 cmovznzU64(&x123, x111, x102, x94);
1734 var x124: u64 = undefined;1770 var x124: u64 = undefined;
1735 p256CmovznzU64(&x124, x111, x104, x96);1771 cmovznzU64(&x124, x111, x104, x96);
1736 var x125: u64 = undefined;1772 var x125: u64 = undefined;
1737 p256CmovznzU64(&x125, x111, x106, x98);1773 cmovznzU64(&x125, x111, x106, x98);
1738 var x126: u64 = undefined;1774 var x126: u64 = undefined;
1739 p256CmovznzU64(&x126, x111, x108, x100);1775 cmovznzU64(&x126, x111, x108, x100);
1740 out1.* = x112;1776 out1.* = x112;
1741 out2[0] = x7;1777 out2[0] = x7;
1742 out2[1] = x8;1778 out2[1] = x8;
...@@ -1758,7 +1794,7 @@ pub fn p256Divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *Limbs, out5:...@@ -1758,7 +1794,7 @@ pub fn p256Divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *Limbs, out5:
1758 out5[3] = x126;1794 out5[3] = x126;
1759}1795}
17601796
1761/// The function p256DivstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).1797/// The function divstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
1762/// Postconditions:1798/// Postconditions:
1763/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)1799/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)
1764/// 0 ≤ eval out1 < m1800/// 0 ≤ eval out1 < m
...@@ -1766,7 +1802,9 @@ pub fn p256Divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *Limbs, out5:...@@ -1766,7 +1802,9 @@ pub fn p256Divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *Limbs, out5:
1766/// Input Bounds:1802/// Input Bounds:
1767/// Output Bounds:1803/// Output Bounds:
1768/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]1804/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1769pub fn p256DivstepPrecomp(out1: *Limbs) void {1805pub fn divstepPrecomp(out1: *[4]u64) void {
1806 @setRuntimeSafety(mode == .Debug);
1807
1770 out1[0] = 0x67ffffffb8000000;1808 out1[0] = 0x67ffffffb8000000;
1771 out1[1] = 0xc000000038000000;1809 out1[1] = 0xc000000038000000;
1772 out1[2] = 0xd80000007fffffff;1810 out1[2] = 0xd80000007fffffff;
lib/std/crypto/pcurves/p256/p256_scalar_64.zig created+2016
...@@ -0,0 +1,2016 @@
1// Autogenerated: './src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase --no-prefix-fiat --package-name p256-scalar '' 64 115792089210356248762697446949407573529996955224135760342422259061068512044369
2// curve description (via package name): p256-scalar
3// machine_wordsize = 64 (from "64")
4// requested operations: (all)
5// m = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 (from "115792089210356248762697446949407573529996955224135760342422259061068512044369")
6//
7// NOTE: In addition to the bounds specified above each function, all
8// functions synthesized for this Montgomery arithmetic require the
9// input to be strictly less than the prime modulus (m), and also
10// require the input to be in the unique saturated representation.
11// All functions also ensure that these two properties are true of
12// return values.
13//
14// Computed values:
15// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
16// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
17// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
18// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
19
20const std = @import("std");
21const cast = std.meta.cast;
22const mode = std.builtin.mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
23
24pub const Limbs = [4]u64;
25
26/// The function addcarryxU64 is an addition with carry.
27/// Postconditions:
28/// out1 = (arg1 + arg2 + arg3) mod 2^64
29/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
30///
31/// Input Bounds:
32/// arg1: [0x0 ~> 0x1]
33/// arg2: [0x0 ~> 0xffffffffffffffff]
34/// arg3: [0x0 ~> 0xffffffffffffffff]
35/// Output Bounds:
36/// out1: [0x0 ~> 0xffffffffffffffff]
37/// out2: [0x0 ~> 0x1]
38fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
39 @setRuntimeSafety(mode == .Debug);
40
41 var t: u64 = undefined;
42 const carry1 = @addWithOverflow(u64, arg2, arg3, &t);
43 const carry2 = @addWithOverflow(u64, t, arg1, out1);
44 out2.* = @boolToInt(carry1) | @boolToInt(carry2);
45}
46
47/// The function subborrowxU64 is a subtraction with borrow.
48/// Postconditions:
49/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
50/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
51///
52/// Input Bounds:
53/// arg1: [0x0 ~> 0x1]
54/// arg2: [0x0 ~> 0xffffffffffffffff]
55/// arg3: [0x0 ~> 0xffffffffffffffff]
56/// Output Bounds:
57/// out1: [0x0 ~> 0xffffffffffffffff]
58/// out2: [0x0 ~> 0x1]
59fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
60 @setRuntimeSafety(mode == .Debug);
61
62 var t: u64 = undefined;
63 const carry1 = @subWithOverflow(u64, arg2, arg3, &t);
64 const carry2 = @subWithOverflow(u64, t, arg1, out1);
65 out2.* = @boolToInt(carry1) | @boolToInt(carry2);
66}
67
68/// The function mulxU64 is a multiplication, returning the full double-width result.
69/// Postconditions:
70/// out1 = (arg1 * arg2) mod 2^64
71/// out2 = ⌊arg1 * arg2 / 2^64⌋
72///
73/// Input Bounds:
74/// arg1: [0x0 ~> 0xffffffffffffffff]
75/// arg2: [0x0 ~> 0xffffffffffffffff]
76/// Output Bounds:
77/// out1: [0x0 ~> 0xffffffffffffffff]
78/// out2: [0x0 ~> 0xffffffffffffffff]
79fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) callconv(.Inline) void {
80 @setRuntimeSafety(mode == .Debug);
81
82 const x = @as(u128, arg1) * @as(u128, arg2);
83 out1.* = @truncate(u64, x);
84 out2.* = @truncate(u64, x >> 64);
85}
86
87/// The function cmovznzU64 is a single-word conditional move.
88/// Postconditions:
89/// out1 = (if arg1 = 0 then arg2 else arg3)
90///
91/// Input Bounds:
92/// arg1: [0x0 ~> 0x1]
93/// arg2: [0x0 ~> 0xffffffffffffffff]
94/// arg3: [0x0 ~> 0xffffffffffffffff]
95/// Output Bounds:
96/// out1: [0x0 ~> 0xffffffffffffffff]
97fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
98 @setRuntimeSafety(mode == .Debug);
99
100 const mask = 0 -% @as(u64, arg1);
101 out1.* = (mask & arg3) | ((~mask) & arg2);
102}
103
104/// The function mul multiplies two field elements in the Montgomery domain.
105/// Preconditions:
106/// 0 ≤ eval arg1 < m
107/// 0 ≤ eval arg2 < m
108/// Postconditions:
109/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
110/// 0 ≤ eval out1 < m
111///
112/// Input Bounds:
113/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
114/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
115/// Output Bounds:
116/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
117pub fn mul(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
118 @setRuntimeSafety(mode == .Debug);
119
120 const x1 = (arg1[1]);
121 const x2 = (arg1[2]);
122 const x3 = (arg1[3]);
123 const x4 = (arg1[0]);
124 var x5: u64 = undefined;
125 var x6: u64 = undefined;
126 mulxU64(&x5, &x6, x4, (arg2[3]));
127 var x7: u64 = undefined;
128 var x8: u64 = undefined;
129 mulxU64(&x7, &x8, x4, (arg2[2]));
130 var x9: u64 = undefined;
131 var x10: u64 = undefined;
132 mulxU64(&x9, &x10, x4, (arg2[1]));
133 var x11: u64 = undefined;
134 var x12: u64 = undefined;
135 mulxU64(&x11, &x12, x4, (arg2[0]));
136 var x13: u64 = undefined;
137 var x14: u1 = undefined;
138 addcarryxU64(&x13, &x14, 0x0, x12, x9);
139 var x15: u64 = undefined;
140 var x16: u1 = undefined;
141 addcarryxU64(&x15, &x16, x14, x10, x7);
142 var x17: u64 = undefined;
143 var x18: u1 = undefined;
144 addcarryxU64(&x17, &x18, x16, x8, x5);
145 const x19 = (cast(u64, x18) + x6);
146 var x20: u64 = undefined;
147 var x21: u64 = undefined;
148 mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f);
149 var x22: u64 = undefined;
150 var x23: u64 = undefined;
151 mulxU64(&x22, &x23, x20, 0xffffffff00000000);
152 var x24: u64 = undefined;
153 var x25: u64 = undefined;
154 mulxU64(&x24, &x25, x20, 0xffffffffffffffff);
155 var x26: u64 = undefined;
156 var x27: u64 = undefined;
157 mulxU64(&x26, &x27, x20, 0xbce6faada7179e84);
158 var x28: u64 = undefined;
159 var x29: u64 = undefined;
160 mulxU64(&x28, &x29, x20, 0xf3b9cac2fc632551);
161 var x30: u64 = undefined;
162 var x31: u1 = undefined;
163 addcarryxU64(&x30, &x31, 0x0, x29, x26);
164 var x32: u64 = undefined;
165 var x33: u1 = undefined;
166 addcarryxU64(&x32, &x33, x31, x27, x24);
167 var x34: u64 = undefined;
168 var x35: u1 = undefined;
169 addcarryxU64(&x34, &x35, x33, x25, x22);
170 const x36 = (cast(u64, x35) + x23);
171 var x37: u64 = undefined;
172 var x38: u1 = undefined;
173 addcarryxU64(&x37, &x38, 0x0, x11, x28);
174 var x39: u64 = undefined;
175 var x40: u1 = undefined;
176 addcarryxU64(&x39, &x40, x38, x13, x30);
177 var x41: u64 = undefined;
178 var x42: u1 = undefined;
179 addcarryxU64(&x41, &x42, x40, x15, x32);
180 var x43: u64 = undefined;
181 var x44: u1 = undefined;
182 addcarryxU64(&x43, &x44, x42, x17, x34);
183 var x45: u64 = undefined;
184 var x46: u1 = undefined;
185 addcarryxU64(&x45, &x46, x44, x19, x36);
186 var x47: u64 = undefined;
187 var x48: u64 = undefined;
188 mulxU64(&x47, &x48, x1, (arg2[3]));
189 var x49: u64 = undefined;
190 var x50: u64 = undefined;
191 mulxU64(&x49, &x50, x1, (arg2[2]));
192 var x51: u64 = undefined;
193 var x52: u64 = undefined;
194 mulxU64(&x51, &x52, x1, (arg2[1]));
195 var x53: u64 = undefined;
196 var x54: u64 = undefined;
197 mulxU64(&x53, &x54, x1, (arg2[0]));
198 var x55: u64 = undefined;
199 var x56: u1 = undefined;
200 addcarryxU64(&x55, &x56, 0x0, x54, x51);
201 var x57: u64 = undefined;
202 var x58: u1 = undefined;
203 addcarryxU64(&x57, &x58, x56, x52, x49);
204 var x59: u64 = undefined;
205 var x60: u1 = undefined;
206 addcarryxU64(&x59, &x60, x58, x50, x47);
207 const x61 = (cast(u64, x60) + x48);
208 var x62: u64 = undefined;
209 var x63: u1 = undefined;
210 addcarryxU64(&x62, &x63, 0x0, x39, x53);
211 var x64: u64 = undefined;
212 var x65: u1 = undefined;
213 addcarryxU64(&x64, &x65, x63, x41, x55);
214 var x66: u64 = undefined;
215 var x67: u1 = undefined;
216 addcarryxU64(&x66, &x67, x65, x43, x57);
217 var x68: u64 = undefined;
218 var x69: u1 = undefined;
219 addcarryxU64(&x68, &x69, x67, x45, x59);
220 var x70: u64 = undefined;
221 var x71: u1 = undefined;
222 addcarryxU64(&x70, &x71, x69, cast(u64, x46), x61);
223 var x72: u64 = undefined;
224 var x73: u64 = undefined;
225 mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f);
226 var x74: u64 = undefined;
227 var x75: u64 = undefined;
228 mulxU64(&x74, &x75, x72, 0xffffffff00000000);
229 var x76: u64 = undefined;
230 var x77: u64 = undefined;
231 mulxU64(&x76, &x77, x72, 0xffffffffffffffff);
232 var x78: u64 = undefined;
233 var x79: u64 = undefined;
234 mulxU64(&x78, &x79, x72, 0xbce6faada7179e84);
235 var x80: u64 = undefined;
236 var x81: u64 = undefined;
237 mulxU64(&x80, &x81, x72, 0xf3b9cac2fc632551);
238 var x82: u64 = undefined;
239 var x83: u1 = undefined;
240 addcarryxU64(&x82, &x83, 0x0, x81, x78);
241 var x84: u64 = undefined;
242 var x85: u1 = undefined;
243 addcarryxU64(&x84, &x85, x83, x79, x76);
244 var x86: u64 = undefined;
245 var x87: u1 = undefined;
246 addcarryxU64(&x86, &x87, x85, x77, x74);
247 const x88 = (cast(u64, x87) + x75);
248 var x89: u64 = undefined;
249 var x90: u1 = undefined;
250 addcarryxU64(&x89, &x90, 0x0, x62, x80);
251 var x91: u64 = undefined;
252 var x92: u1 = undefined;
253 addcarryxU64(&x91, &x92, x90, x64, x82);
254 var x93: u64 = undefined;
255 var x94: u1 = undefined;
256 addcarryxU64(&x93, &x94, x92, x66, x84);
257 var x95: u64 = undefined;
258 var x96: u1 = undefined;
259 addcarryxU64(&x95, &x96, x94, x68, x86);
260 var x97: u64 = undefined;
261 var x98: u1 = undefined;
262 addcarryxU64(&x97, &x98, x96, x70, x88);
263 const x99 = (cast(u64, x98) + cast(u64, x71));
264 var x100: u64 = undefined;
265 var x101: u64 = undefined;
266 mulxU64(&x100, &x101, x2, (arg2[3]));
267 var x102: u64 = undefined;
268 var x103: u64 = undefined;
269 mulxU64(&x102, &x103, x2, (arg2[2]));
270 var x104: u64 = undefined;
271 var x105: u64 = undefined;
272 mulxU64(&x104, &x105, x2, (arg2[1]));
273 var x106: u64 = undefined;
274 var x107: u64 = undefined;
275 mulxU64(&x106, &x107, x2, (arg2[0]));
276 var x108: u64 = undefined;
277 var x109: u1 = undefined;
278 addcarryxU64(&x108, &x109, 0x0, x107, x104);
279 var x110: u64 = undefined;
280 var x111: u1 = undefined;
281 addcarryxU64(&x110, &x111, x109, x105, x102);
282 var x112: u64 = undefined;
283 var x113: u1 = undefined;
284 addcarryxU64(&x112, &x113, x111, x103, x100);
285 const x114 = (cast(u64, x113) + x101);
286 var x115: u64 = undefined;
287 var x116: u1 = undefined;
288 addcarryxU64(&x115, &x116, 0x0, x91, x106);
289 var x117: u64 = undefined;
290 var x118: u1 = undefined;
291 addcarryxU64(&x117, &x118, x116, x93, x108);
292 var x119: u64 = undefined;
293 var x120: u1 = undefined;
294 addcarryxU64(&x119, &x120, x118, x95, x110);
295 var x121: u64 = undefined;
296 var x122: u1 = undefined;
297 addcarryxU64(&x121, &x122, x120, x97, x112);
298 var x123: u64 = undefined;
299 var x124: u1 = undefined;
300 addcarryxU64(&x123, &x124, x122, x99, x114);
301 var x125: u64 = undefined;
302 var x126: u64 = undefined;
303 mulxU64(&x125, &x126, x115, 0xccd1c8aaee00bc4f);
304 var x127: u64 = undefined;
305 var x128: u64 = undefined;
306 mulxU64(&x127, &x128, x125, 0xffffffff00000000);
307 var x129: u64 = undefined;
308 var x130: u64 = undefined;
309 mulxU64(&x129, &x130, x125, 0xffffffffffffffff);
310 var x131: u64 = undefined;
311 var x132: u64 = undefined;
312 mulxU64(&x131, &x132, x125, 0xbce6faada7179e84);
313 var x133: u64 = undefined;
314 var x134: u64 = undefined;
315 mulxU64(&x133, &x134, x125, 0xf3b9cac2fc632551);
316 var x135: u64 = undefined;
317 var x136: u1 = undefined;
318 addcarryxU64(&x135, &x136, 0x0, x134, x131);
319 var x137: u64 = undefined;
320 var x138: u1 = undefined;
321 addcarryxU64(&x137, &x138, x136, x132, x129);
322 var x139: u64 = undefined;
323 var x140: u1 = undefined;
324 addcarryxU64(&x139, &x140, x138, x130, x127);
325 const x141 = (cast(u64, x140) + x128);
326 var x142: u64 = undefined;
327 var x143: u1 = undefined;
328 addcarryxU64(&x142, &x143, 0x0, x115, x133);
329 var x144: u64 = undefined;
330 var x145: u1 = undefined;
331 addcarryxU64(&x144, &x145, x143, x117, x135);
332 var x146: u64 = undefined;
333 var x147: u1 = undefined;
334 addcarryxU64(&x146, &x147, x145, x119, x137);
335 var x148: u64 = undefined;
336 var x149: u1 = undefined;
337 addcarryxU64(&x148, &x149, x147, x121, x139);
338 var x150: u64 = undefined;
339 var x151: u1 = undefined;
340 addcarryxU64(&x150, &x151, x149, x123, x141);
341 const x152 = (cast(u64, x151) + cast(u64, x124));
342 var x153: u64 = undefined;
343 var x154: u64 = undefined;
344 mulxU64(&x153, &x154, x3, (arg2[3]));
345 var x155: u64 = undefined;
346 var x156: u64 = undefined;
347 mulxU64(&x155, &x156, x3, (arg2[2]));
348 var x157: u64 = undefined;
349 var x158: u64 = undefined;
350 mulxU64(&x157, &x158, x3, (arg2[1]));
351 var x159: u64 = undefined;
352 var x160: u64 = undefined;
353 mulxU64(&x159, &x160, x3, (arg2[0]));
354 var x161: u64 = undefined;
355 var x162: u1 = undefined;
356 addcarryxU64(&x161, &x162, 0x0, x160, x157);
357 var x163: u64 = undefined;
358 var x164: u1 = undefined;
359 addcarryxU64(&x163, &x164, x162, x158, x155);
360 var x165: u64 = undefined;
361 var x166: u1 = undefined;
362 addcarryxU64(&x165, &x166, x164, x156, x153);
363 const x167 = (cast(u64, x166) + x154);
364 var x168: u64 = undefined;
365 var x169: u1 = undefined;
366 addcarryxU64(&x168, &x169, 0x0, x144, x159);
367 var x170: u64 = undefined;
368 var x171: u1 = undefined;
369 addcarryxU64(&x170, &x171, x169, x146, x161);
370 var x172: u64 = undefined;
371 var x173: u1 = undefined;
372 addcarryxU64(&x172, &x173, x171, x148, x163);
373 var x174: u64 = undefined;
374 var x175: u1 = undefined;
375 addcarryxU64(&x174, &x175, x173, x150, x165);
376 var x176: u64 = undefined;
377 var x177: u1 = undefined;
378 addcarryxU64(&x176, &x177, x175, x152, x167);
379 var x178: u64 = undefined;
380 var x179: u64 = undefined;
381 mulxU64(&x178, &x179, x168, 0xccd1c8aaee00bc4f);
382 var x180: u64 = undefined;
383 var x181: u64 = undefined;
384 mulxU64(&x180, &x181, x178, 0xffffffff00000000);
385 var x182: u64 = undefined;
386 var x183: u64 = undefined;
387 mulxU64(&x182, &x183, x178, 0xffffffffffffffff);
388 var x184: u64 = undefined;
389 var x185: u64 = undefined;
390 mulxU64(&x184, &x185, x178, 0xbce6faada7179e84);
391 var x186: u64 = undefined;
392 var x187: u64 = undefined;
393 mulxU64(&x186, &x187, x178, 0xf3b9cac2fc632551);
394 var x188: u64 = undefined;
395 var x189: u1 = undefined;
396 addcarryxU64(&x188, &x189, 0x0, x187, x184);
397 var x190: u64 = undefined;
398 var x191: u1 = undefined;
399 addcarryxU64(&x190, &x191, x189, x185, x182);
400 var x192: u64 = undefined;
401 var x193: u1 = undefined;
402 addcarryxU64(&x192, &x193, x191, x183, x180);
403 const x194 = (cast(u64, x193) + x181);
404 var x195: u64 = undefined;
405 var x196: u1 = undefined;
406 addcarryxU64(&x195, &x196, 0x0, x168, x186);
407 var x197: u64 = undefined;
408 var x198: u1 = undefined;
409 addcarryxU64(&x197, &x198, x196, x170, x188);
410 var x199: u64 = undefined;
411 var x200: u1 = undefined;
412 addcarryxU64(&x199, &x200, x198, x172, x190);
413 var x201: u64 = undefined;
414 var x202: u1 = undefined;
415 addcarryxU64(&x201, &x202, x200, x174, x192);
416 var x203: u64 = undefined;
417 var x204: u1 = undefined;
418 addcarryxU64(&x203, &x204, x202, x176, x194);
419 const x205 = (cast(u64, x204) + cast(u64, x177));
420 var x206: u64 = undefined;
421 var x207: u1 = undefined;
422 subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551);
423 var x208: u64 = undefined;
424 var x209: u1 = undefined;
425 subborrowxU64(&x208, &x209, x207, x199, 0xbce6faada7179e84);
426 var x210: u64 = undefined;
427 var x211: u1 = undefined;
428 subborrowxU64(&x210, &x211, x209, x201, 0xffffffffffffffff);
429 var x212: u64 = undefined;
430 var x213: u1 = undefined;
431 subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000);
432 var x214: u64 = undefined;
433 var x215: u1 = undefined;
434 subborrowxU64(&x214, &x215, x213, x205, cast(u64, 0x0));
435 var x216: u64 = undefined;
436 cmovznzU64(&x216, x215, x206, x197);
437 var x217: u64 = undefined;
438 cmovznzU64(&x217, x215, x208, x199);
439 var x218: u64 = undefined;
440 cmovznzU64(&x218, x215, x210, x201);
441 var x219: u64 = undefined;
442 cmovznzU64(&x219, x215, x212, x203);
443 out1[0] = x216;
444 out1[1] = x217;
445 out1[2] = x218;
446 out1[3] = x219;
447}
448
449/// The function square squares a field element in the Montgomery domain.
450/// Preconditions:
451/// 0 ≤ eval arg1 < m
452/// Postconditions:
453/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
454/// 0 ≤ eval out1 < m
455///
456/// Input Bounds:
457/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
458/// Output Bounds:
459/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
460pub fn square(out1: *[4]u64, arg1: [4]u64) void {
461 @setRuntimeSafety(mode == .Debug);
462
463 const x1 = (arg1[1]);
464 const x2 = (arg1[2]);
465 const x3 = (arg1[3]);
466 const x4 = (arg1[0]);
467 var x5: u64 = undefined;
468 var x6: u64 = undefined;
469 mulxU64(&x5, &x6, x4, (arg1[3]));
470 var x7: u64 = undefined;
471 var x8: u64 = undefined;
472 mulxU64(&x7, &x8, x4, (arg1[2]));
473 var x9: u64 = undefined;
474 var x10: u64 = undefined;
475 mulxU64(&x9, &x10, x4, (arg1[1]));
476 var x11: u64 = undefined;
477 var x12: u64 = undefined;
478 mulxU64(&x11, &x12, x4, (arg1[0]));
479 var x13: u64 = undefined;
480 var x14: u1 = undefined;
481 addcarryxU64(&x13, &x14, 0x0, x12, x9);
482 var x15: u64 = undefined;
483 var x16: u1 = undefined;
484 addcarryxU64(&x15, &x16, x14, x10, x7);
485 var x17: u64 = undefined;
486 var x18: u1 = undefined;
487 addcarryxU64(&x17, &x18, x16, x8, x5);
488 const x19 = (cast(u64, x18) + x6);
489 var x20: u64 = undefined;
490 var x21: u64 = undefined;
491 mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f);
492 var x22: u64 = undefined;
493 var x23: u64 = undefined;
494 mulxU64(&x22, &x23, x20, 0xffffffff00000000);
495 var x24: u64 = undefined;
496 var x25: u64 = undefined;
497 mulxU64(&x24, &x25, x20, 0xffffffffffffffff);
498 var x26: u64 = undefined;
499 var x27: u64 = undefined;
500 mulxU64(&x26, &x27, x20, 0xbce6faada7179e84);
501 var x28: u64 = undefined;
502 var x29: u64 = undefined;
503 mulxU64(&x28, &x29, x20, 0xf3b9cac2fc632551);
504 var x30: u64 = undefined;
505 var x31: u1 = undefined;
506 addcarryxU64(&x30, &x31, 0x0, x29, x26);
507 var x32: u64 = undefined;
508 var x33: u1 = undefined;
509 addcarryxU64(&x32, &x33, x31, x27, x24);
510 var x34: u64 = undefined;
511 var x35: u1 = undefined;
512 addcarryxU64(&x34, &x35, x33, x25, x22);
513 const x36 = (cast(u64, x35) + x23);
514 var x37: u64 = undefined;
515 var x38: u1 = undefined;
516 addcarryxU64(&x37, &x38, 0x0, x11, x28);
517 var x39: u64 = undefined;
518 var x40: u1 = undefined;
519 addcarryxU64(&x39, &x40, x38, x13, x30);
520 var x41: u64 = undefined;
521 var x42: u1 = undefined;
522 addcarryxU64(&x41, &x42, x40, x15, x32);
523 var x43: u64 = undefined;
524 var x44: u1 = undefined;
525 addcarryxU64(&x43, &x44, x42, x17, x34);
526 var x45: u64 = undefined;
527 var x46: u1 = undefined;
528 addcarryxU64(&x45, &x46, x44, x19, x36);
529 var x47: u64 = undefined;
530 var x48: u64 = undefined;
531 mulxU64(&x47, &x48, x1, (arg1[3]));
532 var x49: u64 = undefined;
533 var x50: u64 = undefined;
534 mulxU64(&x49, &x50, x1, (arg1[2]));
535 var x51: u64 = undefined;
536 var x52: u64 = undefined;
537 mulxU64(&x51, &x52, x1, (arg1[1]));
538 var x53: u64 = undefined;
539 var x54: u64 = undefined;
540 mulxU64(&x53, &x54, x1, (arg1[0]));
541 var x55: u64 = undefined;
542 var x56: u1 = undefined;
543 addcarryxU64(&x55, &x56, 0x0, x54, x51);
544 var x57: u64 = undefined;
545 var x58: u1 = undefined;
546 addcarryxU64(&x57, &x58, x56, x52, x49);
547 var x59: u64 = undefined;
548 var x60: u1 = undefined;
549 addcarryxU64(&x59, &x60, x58, x50, x47);
550 const x61 = (cast(u64, x60) + x48);
551 var x62: u64 = undefined;
552 var x63: u1 = undefined;
553 addcarryxU64(&x62, &x63, 0x0, x39, x53);
554 var x64: u64 = undefined;
555 var x65: u1 = undefined;
556 addcarryxU64(&x64, &x65, x63, x41, x55);
557 var x66: u64 = undefined;
558 var x67: u1 = undefined;
559 addcarryxU64(&x66, &x67, x65, x43, x57);
560 var x68: u64 = undefined;
561 var x69: u1 = undefined;
562 addcarryxU64(&x68, &x69, x67, x45, x59);
563 var x70: u64 = undefined;
564 var x71: u1 = undefined;
565 addcarryxU64(&x70, &x71, x69, cast(u64, x46), x61);
566 var x72: u64 = undefined;
567 var x73: u64 = undefined;
568 mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f);
569 var x74: u64 = undefined;
570 var x75: u64 = undefined;
571 mulxU64(&x74, &x75, x72, 0xffffffff00000000);
572 var x76: u64 = undefined;
573 var x77: u64 = undefined;
574 mulxU64(&x76, &x77, x72, 0xffffffffffffffff);
575 var x78: u64 = undefined;
576 var x79: u64 = undefined;
577 mulxU64(&x78, &x79, x72, 0xbce6faada7179e84);
578 var x80: u64 = undefined;
579 var x81: u64 = undefined;
580 mulxU64(&x80, &x81, x72, 0xf3b9cac2fc632551);
581 var x82: u64 = undefined;
582 var x83: u1 = undefined;
583 addcarryxU64(&x82, &x83, 0x0, x81, x78);
584 var x84: u64 = undefined;
585 var x85: u1 = undefined;
586 addcarryxU64(&x84, &x85, x83, x79, x76);
587 var x86: u64 = undefined;
588 var x87: u1 = undefined;
589 addcarryxU64(&x86, &x87, x85, x77, x74);
590 const x88 = (cast(u64, x87) + x75);
591 var x89: u64 = undefined;
592 var x90: u1 = undefined;
593 addcarryxU64(&x89, &x90, 0x0, x62, x80);
594 var x91: u64 = undefined;
595 var x92: u1 = undefined;
596 addcarryxU64(&x91, &x92, x90, x64, x82);
597 var x93: u64 = undefined;
598 var x94: u1 = undefined;
599 addcarryxU64(&x93, &x94, x92, x66, x84);
600 var x95: u64 = undefined;
601 var x96: u1 = undefined;
602 addcarryxU64(&x95, &x96, x94, x68, x86);
603 var x97: u64 = undefined;
604 var x98: u1 = undefined;
605 addcarryxU64(&x97, &x98, x96, x70, x88);
606 const x99 = (cast(u64, x98) + cast(u64, x71));
607 var x100: u64 = undefined;
608 var x101: u64 = undefined;
609 mulxU64(&x100, &x101, x2, (arg1[3]));
610 var x102: u64 = undefined;
611 var x103: u64 = undefined;
612 mulxU64(&x102, &x103, x2, (arg1[2]));
613 var x104: u64 = undefined;
614 var x105: u64 = undefined;
615 mulxU64(&x104, &x105, x2, (arg1[1]));
616 var x106: u64 = undefined;
617 var x107: u64 = undefined;
618 mulxU64(&x106, &x107, x2, (arg1[0]));
619 var x108: u64 = undefined;
620 var x109: u1 = undefined;
621 addcarryxU64(&x108, &x109, 0x0, x107, x104);
622 var x110: u64 = undefined;
623 var x111: u1 = undefined;
624 addcarryxU64(&x110, &x111, x109, x105, x102);
625 var x112: u64 = undefined;
626 var x113: u1 = undefined;
627 addcarryxU64(&x112, &x113, x111, x103, x100);
628 const x114 = (cast(u64, x113) + x101);
629 var x115: u64 = undefined;
630 var x116: u1 = undefined;
631 addcarryxU64(&x115, &x116, 0x0, x91, x106);
632 var x117: u64 = undefined;
633 var x118: u1 = undefined;
634 addcarryxU64(&x117, &x118, x116, x93, x108);
635 var x119: u64 = undefined;
636 var x120: u1 = undefined;
637 addcarryxU64(&x119, &x120, x118, x95, x110);
638 var x121: u64 = undefined;
639 var x122: u1 = undefined;
640 addcarryxU64(&x121, &x122, x120, x97, x112);
641 var x123: u64 = undefined;
642 var x124: u1 = undefined;
643 addcarryxU64(&x123, &x124, x122, x99, x114);
644 var x125: u64 = undefined;
645 var x126: u64 = undefined;
646 mulxU64(&x125, &x126, x115, 0xccd1c8aaee00bc4f);
647 var x127: u64 = undefined;
648 var x128: u64 = undefined;
649 mulxU64(&x127, &x128, x125, 0xffffffff00000000);
650 var x129: u64 = undefined;
651 var x130: u64 = undefined;
652 mulxU64(&x129, &x130, x125, 0xffffffffffffffff);
653 var x131: u64 = undefined;
654 var x132: u64 = undefined;
655 mulxU64(&x131, &x132, x125, 0xbce6faada7179e84);
656 var x133: u64 = undefined;
657 var x134: u64 = undefined;
658 mulxU64(&x133, &x134, x125, 0xf3b9cac2fc632551);
659 var x135: u64 = undefined;
660 var x136: u1 = undefined;
661 addcarryxU64(&x135, &x136, 0x0, x134, x131);
662 var x137: u64 = undefined;
663 var x138: u1 = undefined;
664 addcarryxU64(&x137, &x138, x136, x132, x129);
665 var x139: u64 = undefined;
666 var x140: u1 = undefined;
667 addcarryxU64(&x139, &x140, x138, x130, x127);
668 const x141 = (cast(u64, x140) + x128);
669 var x142: u64 = undefined;
670 var x143: u1 = undefined;
671 addcarryxU64(&x142, &x143, 0x0, x115, x133);
672 var x144: u64 = undefined;
673 var x145: u1 = undefined;
674 addcarryxU64(&x144, &x145, x143, x117, x135);
675 var x146: u64 = undefined;
676 var x147: u1 = undefined;
677 addcarryxU64(&x146, &x147, x145, x119, x137);
678 var x148: u64 = undefined;
679 var x149: u1 = undefined;
680 addcarryxU64(&x148, &x149, x147, x121, x139);
681 var x150: u64 = undefined;
682 var x151: u1 = undefined;
683 addcarryxU64(&x150, &x151, x149, x123, x141);
684 const x152 = (cast(u64, x151) + cast(u64, x124));
685 var x153: u64 = undefined;
686 var x154: u64 = undefined;
687 mulxU64(&x153, &x154, x3, (arg1[3]));
688 var x155: u64 = undefined;
689 var x156: u64 = undefined;
690 mulxU64(&x155, &x156, x3, (arg1[2]));
691 var x157: u64 = undefined;
692 var x158: u64 = undefined;
693 mulxU64(&x157, &x158, x3, (arg1[1]));
694 var x159: u64 = undefined;
695 var x160: u64 = undefined;
696 mulxU64(&x159, &x160, x3, (arg1[0]));
697 var x161: u64 = undefined;
698 var x162: u1 = undefined;
699 addcarryxU64(&x161, &x162, 0x0, x160, x157);
700 var x163: u64 = undefined;
701 var x164: u1 = undefined;
702 addcarryxU64(&x163, &x164, x162, x158, x155);
703 var x165: u64 = undefined;
704 var x166: u1 = undefined;
705 addcarryxU64(&x165, &x166, x164, x156, x153);
706 const x167 = (cast(u64, x166) + x154);
707 var x168: u64 = undefined;
708 var x169: u1 = undefined;
709 addcarryxU64(&x168, &x169, 0x0, x144, x159);
710 var x170: u64 = undefined;
711 var x171: u1 = undefined;
712 addcarryxU64(&x170, &x171, x169, x146, x161);
713 var x172: u64 = undefined;
714 var x173: u1 = undefined;
715 addcarryxU64(&x172, &x173, x171, x148, x163);
716 var x174: u64 = undefined;
717 var x175: u1 = undefined;
718 addcarryxU64(&x174, &x175, x173, x150, x165);
719 var x176: u64 = undefined;
720 var x177: u1 = undefined;
721 addcarryxU64(&x176, &x177, x175, x152, x167);
722 var x178: u64 = undefined;
723 var x179: u64 = undefined;
724 mulxU64(&x178, &x179, x168, 0xccd1c8aaee00bc4f);
725 var x180: u64 = undefined;
726 var x181: u64 = undefined;
727 mulxU64(&x180, &x181, x178, 0xffffffff00000000);
728 var x182: u64 = undefined;
729 var x183: u64 = undefined;
730 mulxU64(&x182, &x183, x178, 0xffffffffffffffff);
731 var x184: u64 = undefined;
732 var x185: u64 = undefined;
733 mulxU64(&x184, &x185, x178, 0xbce6faada7179e84);
734 var x186: u64 = undefined;
735 var x187: u64 = undefined;
736 mulxU64(&x186, &x187, x178, 0xf3b9cac2fc632551);
737 var x188: u64 = undefined;
738 var x189: u1 = undefined;
739 addcarryxU64(&x188, &x189, 0x0, x187, x184);
740 var x190: u64 = undefined;
741 var x191: u1 = undefined;
742 addcarryxU64(&x190, &x191, x189, x185, x182);
743 var x192: u64 = undefined;
744 var x193: u1 = undefined;
745 addcarryxU64(&x192, &x193, x191, x183, x180);
746 const x194 = (cast(u64, x193) + x181);
747 var x195: u64 = undefined;
748 var x196: u1 = undefined;
749 addcarryxU64(&x195, &x196, 0x0, x168, x186);
750 var x197: u64 = undefined;
751 var x198: u1 = undefined;
752 addcarryxU64(&x197, &x198, x196, x170, x188);
753 var x199: u64 = undefined;
754 var x200: u1 = undefined;
755 addcarryxU64(&x199, &x200, x198, x172, x190);
756 var x201: u64 = undefined;
757 var x202: u1 = undefined;
758 addcarryxU64(&x201, &x202, x200, x174, x192);
759 var x203: u64 = undefined;
760 var x204: u1 = undefined;
761 addcarryxU64(&x203, &x204, x202, x176, x194);
762 const x205 = (cast(u64, x204) + cast(u64, x177));
763 var x206: u64 = undefined;
764 var x207: u1 = undefined;
765 subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551);
766 var x208: u64 = undefined;
767 var x209: u1 = undefined;
768 subborrowxU64(&x208, &x209, x207, x199, 0xbce6faada7179e84);
769 var x210: u64 = undefined;
770 var x211: u1 = undefined;
771 subborrowxU64(&x210, &x211, x209, x201, 0xffffffffffffffff);
772 var x212: u64 = undefined;
773 var x213: u1 = undefined;
774 subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000);
775 var x214: u64 = undefined;
776 var x215: u1 = undefined;
777 subborrowxU64(&x214, &x215, x213, x205, cast(u64, 0x0));
778 var x216: u64 = undefined;
779 cmovznzU64(&x216, x215, x206, x197);
780 var x217: u64 = undefined;
781 cmovznzU64(&x217, x215, x208, x199);
782 var x218: u64 = undefined;
783 cmovznzU64(&x218, x215, x210, x201);
784 var x219: u64 = undefined;
785 cmovznzU64(&x219, x215, x212, x203);
786 out1[0] = x216;
787 out1[1] = x217;
788 out1[2] = x218;
789 out1[3] = x219;
790}
791
792/// The function add adds two field elements in the Montgomery domain.
793/// Preconditions:
794/// 0 ≤ eval arg1 < m
795/// 0 ≤ eval arg2 < m
796/// Postconditions:
797/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
798/// 0 ≤ eval out1 < m
799///
800/// Input Bounds:
801/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
802/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
803/// Output Bounds:
804/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
805pub fn add(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
806 @setRuntimeSafety(mode == .Debug);
807
808 var x1: u64 = undefined;
809 var x2: u1 = undefined;
810 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
811 var x3: u64 = undefined;
812 var x4: u1 = undefined;
813 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
814 var x5: u64 = undefined;
815 var x6: u1 = undefined;
816 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
817 var x7: u64 = undefined;
818 var x8: u1 = undefined;
819 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
820 var x9: u64 = undefined;
821 var x10: u1 = undefined;
822 subborrowxU64(&x9, &x10, 0x0, x1, 0xf3b9cac2fc632551);
823 var x11: u64 = undefined;
824 var x12: u1 = undefined;
825 subborrowxU64(&x11, &x12, x10, x3, 0xbce6faada7179e84);
826 var x13: u64 = undefined;
827 var x14: u1 = undefined;
828 subborrowxU64(&x13, &x14, x12, x5, 0xffffffffffffffff);
829 var x15: u64 = undefined;
830 var x16: u1 = undefined;
831 subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000000);
832 var x17: u64 = undefined;
833 var x18: u1 = undefined;
834 subborrowxU64(&x17, &x18, x16, cast(u64, x8), cast(u64, 0x0));
835 var x19: u64 = undefined;
836 cmovznzU64(&x19, x18, x9, x1);
837 var x20: u64 = undefined;
838 cmovznzU64(&x20, x18, x11, x3);
839 var x21: u64 = undefined;
840 cmovznzU64(&x21, x18, x13, x5);
841 var x22: u64 = undefined;
842 cmovznzU64(&x22, x18, x15, x7);
843 out1[0] = x19;
844 out1[1] = x20;
845 out1[2] = x21;
846 out1[3] = x22;
847}
848
849/// The function sub subtracts two field elements in the Montgomery domain.
850/// Preconditions:
851/// 0 ≤ eval arg1 < m
852/// 0 ≤ eval arg2 < m
853/// Postconditions:
854/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
855/// 0 ≤ eval out1 < m
856///
857/// Input Bounds:
858/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
859/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
860/// Output Bounds:
861/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
862pub fn sub(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
863 @setRuntimeSafety(mode == .Debug);
864
865 var x1: u64 = undefined;
866 var x2: u1 = undefined;
867 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
868 var x3: u64 = undefined;
869 var x4: u1 = undefined;
870 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
871 var x5: u64 = undefined;
872 var x6: u1 = undefined;
873 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
874 var x7: u64 = undefined;
875 var x8: u1 = undefined;
876 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
877 var x9: u64 = undefined;
878 cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
879 var x10: u64 = undefined;
880 var x11: u1 = undefined;
881 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551));
882 var x12: u64 = undefined;
883 var x13: u1 = undefined;
884 addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xbce6faada7179e84));
885 var x14: u64 = undefined;
886 var x15: u1 = undefined;
887 addcarryxU64(&x14, &x15, x13, x5, x9);
888 var x16: u64 = undefined;
889 var x17: u1 = undefined;
890 addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000000));
891 out1[0] = x10;
892 out1[1] = x12;
893 out1[2] = x14;
894 out1[3] = x16;
895}
896
897/// The function opp negates a field element in the Montgomery domain.
898/// Preconditions:
899/// 0 ≤ eval arg1 < m
900/// Postconditions:
901/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
902/// 0 ≤ eval out1 < m
903///
904/// Input Bounds:
905/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
906/// Output Bounds:
907/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
908pub fn opp(out1: *[4]u64, arg1: [4]u64) void {
909 @setRuntimeSafety(mode == .Debug);
910
911 var x1: u64 = undefined;
912 var x2: u1 = undefined;
913 subborrowxU64(&x1, &x2, 0x0, cast(u64, 0x0), (arg1[0]));
914 var x3: u64 = undefined;
915 var x4: u1 = undefined;
916 subborrowxU64(&x3, &x4, x2, cast(u64, 0x0), (arg1[1]));
917 var x5: u64 = undefined;
918 var x6: u1 = undefined;
919 subborrowxU64(&x5, &x6, x4, cast(u64, 0x0), (arg1[2]));
920 var x7: u64 = undefined;
921 var x8: u1 = undefined;
922 subborrowxU64(&x7, &x8, x6, cast(u64, 0x0), (arg1[3]));
923 var x9: u64 = undefined;
924 cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
925 var x10: u64 = undefined;
926 var x11: u1 = undefined;
927 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551));
928 var x12: u64 = undefined;
929 var x13: u1 = undefined;
930 addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xbce6faada7179e84));
931 var x14: u64 = undefined;
932 var x15: u1 = undefined;
933 addcarryxU64(&x14, &x15, x13, x5, x9);
934 var x16: u64 = undefined;
935 var x17: u1 = undefined;
936 addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000000));
937 out1[0] = x10;
938 out1[1] = x12;
939 out1[2] = x14;
940 out1[3] = x16;
941}
942
943/// The function fromMontgomery translates a field element out of the Montgomery domain.
944/// Preconditions:
945/// 0 ≤ eval arg1 < m
946/// Postconditions:
947/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
948/// 0 ≤ eval out1 < m
949///
950/// Input Bounds:
951/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
952/// Output Bounds:
953/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
954pub fn fromMontgomery(out1: *[4]u64, arg1: [4]u64) void {
955 @setRuntimeSafety(mode == .Debug);
956
957 const x1 = (arg1[0]);
958 var x2: u64 = undefined;
959 var x3: u64 = undefined;
960 mulxU64(&x2, &x3, x1, 0xccd1c8aaee00bc4f);
961 var x4: u64 = undefined;
962 var x5: u64 = undefined;
963 mulxU64(&x4, &x5, x2, 0xffffffff00000000);
964 var x6: u64 = undefined;
965 var x7: u64 = undefined;
966 mulxU64(&x6, &x7, x2, 0xffffffffffffffff);
967 var x8: u64 = undefined;
968 var x9: u64 = undefined;
969 mulxU64(&x8, &x9, x2, 0xbce6faada7179e84);
970 var x10: u64 = undefined;
971 var x11: u64 = undefined;
972 mulxU64(&x10, &x11, x2, 0xf3b9cac2fc632551);
973 var x12: u64 = undefined;
974 var x13: u1 = undefined;
975 addcarryxU64(&x12, &x13, 0x0, x11, x8);
976 var x14: u64 = undefined;
977 var x15: u1 = undefined;
978 addcarryxU64(&x14, &x15, x13, x9, x6);
979 var x16: u64 = undefined;
980 var x17: u1 = undefined;
981 addcarryxU64(&x16, &x17, x15, x7, x4);
982 var x18: u64 = undefined;
983 var x19: u1 = undefined;
984 addcarryxU64(&x18, &x19, 0x0, x1, x10);
985 var x20: u64 = undefined;
986 var x21: u1 = undefined;
987 addcarryxU64(&x20, &x21, x19, cast(u64, 0x0), x12);
988 var x22: u64 = undefined;
989 var x23: u1 = undefined;
990 addcarryxU64(&x22, &x23, x21, cast(u64, 0x0), x14);
991 var x24: u64 = undefined;
992 var x25: u1 = undefined;
993 addcarryxU64(&x24, &x25, x23, cast(u64, 0x0), x16);
994 var x26: u64 = undefined;
995 var x27: u1 = undefined;
996 addcarryxU64(&x26, &x27, 0x0, x20, (arg1[1]));
997 var x28: u64 = undefined;
998 var x29: u1 = undefined;
999 addcarryxU64(&x28, &x29, x27, x22, cast(u64, 0x0));
1000 var x30: u64 = undefined;
1001 var x31: u1 = undefined;
1002 addcarryxU64(&x30, &x31, x29, x24, cast(u64, 0x0));
1003 var x32: u64 = undefined;
1004 var x33: u64 = undefined;
1005 mulxU64(&x32, &x33, x26, 0xccd1c8aaee00bc4f);
1006 var x34: u64 = undefined;
1007 var x35: u64 = undefined;
1008 mulxU64(&x34, &x35, x32, 0xffffffff00000000);
1009 var x36: u64 = undefined;
1010 var x37: u64 = undefined;
1011 mulxU64(&x36, &x37, x32, 0xffffffffffffffff);
1012 var x38: u64 = undefined;
1013 var x39: u64 = undefined;
1014 mulxU64(&x38, &x39, x32, 0xbce6faada7179e84);
1015 var x40: u64 = undefined;
1016 var x41: u64 = undefined;
1017 mulxU64(&x40, &x41, x32, 0xf3b9cac2fc632551);
1018 var x42: u64 = undefined;
1019 var x43: u1 = undefined;
1020 addcarryxU64(&x42, &x43, 0x0, x41, x38);
1021 var x44: u64 = undefined;
1022 var x45: u1 = undefined;
1023 addcarryxU64(&x44, &x45, x43, x39, x36);
1024 var x46: u64 = undefined;
1025 var x47: u1 = undefined;
1026 addcarryxU64(&x46, &x47, x45, x37, x34);
1027 var x48: u64 = undefined;
1028 var x49: u1 = undefined;
1029 addcarryxU64(&x48, &x49, 0x0, x26, x40);
1030 var x50: u64 = undefined;
1031 var x51: u1 = undefined;
1032 addcarryxU64(&x50, &x51, x49, x28, x42);
1033 var x52: u64 = undefined;
1034 var x53: u1 = undefined;
1035 addcarryxU64(&x52, &x53, x51, x30, x44);
1036 var x54: u64 = undefined;
1037 var x55: u1 = undefined;
1038 addcarryxU64(&x54, &x55, x53, (cast(u64, x31) + (cast(u64, x25) + (cast(u64, x17) + x5))), x46);
1039 var x56: u64 = undefined;
1040 var x57: u1 = undefined;
1041 addcarryxU64(&x56, &x57, 0x0, x50, (arg1[2]));
1042 var x58: u64 = undefined;
1043 var x59: u1 = undefined;
1044 addcarryxU64(&x58, &x59, x57, x52, cast(u64, 0x0));
1045 var x60: u64 = undefined;
1046 var x61: u1 = undefined;
1047 addcarryxU64(&x60, &x61, x59, x54, cast(u64, 0x0));
1048 var x62: u64 = undefined;
1049 var x63: u64 = undefined;
1050 mulxU64(&x62, &x63, x56, 0xccd1c8aaee00bc4f);
1051 var x64: u64 = undefined;
1052 var x65: u64 = undefined;
1053 mulxU64(&x64, &x65, x62, 0xffffffff00000000);
1054 var x66: u64 = undefined;
1055 var x67: u64 = undefined;
1056 mulxU64(&x66, &x67, x62, 0xffffffffffffffff);
1057 var x68: u64 = undefined;
1058 var x69: u64 = undefined;
1059 mulxU64(&x68, &x69, x62, 0xbce6faada7179e84);
1060 var x70: u64 = undefined;
1061 var x71: u64 = undefined;
1062 mulxU64(&x70, &x71, x62, 0xf3b9cac2fc632551);
1063 var x72: u64 = undefined;
1064 var x73: u1 = undefined;
1065 addcarryxU64(&x72, &x73, 0x0, x71, x68);
1066 var x74: u64 = undefined;
1067 var x75: u1 = undefined;
1068 addcarryxU64(&x74, &x75, x73, x69, x66);
1069 var x76: u64 = undefined;
1070 var x77: u1 = undefined;
1071 addcarryxU64(&x76, &x77, x75, x67, x64);
1072 var x78: u64 = undefined;
1073 var x79: u1 = undefined;
1074 addcarryxU64(&x78, &x79, 0x0, x56, x70);
1075 var x80: u64 = undefined;
1076 var x81: u1 = undefined;
1077 addcarryxU64(&x80, &x81, x79, x58, x72);
1078 var x82: u64 = undefined;
1079 var x83: u1 = undefined;
1080 addcarryxU64(&x82, &x83, x81, x60, x74);
1081 var x84: u64 = undefined;
1082 var x85: u1 = undefined;
1083 addcarryxU64(&x84, &x85, x83, (cast(u64, x61) + (cast(u64, x55) + (cast(u64, x47) + x35))), x76);
1084 var x86: u64 = undefined;
1085 var x87: u1 = undefined;
1086 addcarryxU64(&x86, &x87, 0x0, x80, (arg1[3]));
1087 var x88: u64 = undefined;
1088 var x89: u1 = undefined;
1089 addcarryxU64(&x88, &x89, x87, x82, cast(u64, 0x0));
1090 var x90: u64 = undefined;
1091 var x91: u1 = undefined;
1092 addcarryxU64(&x90, &x91, x89, x84, cast(u64, 0x0));
1093 var x92: u64 = undefined;
1094 var x93: u64 = undefined;
1095 mulxU64(&x92, &x93, x86, 0xccd1c8aaee00bc4f);
1096 var x94: u64 = undefined;
1097 var x95: u64 = undefined;
1098 mulxU64(&x94, &x95, x92, 0xffffffff00000000);
1099 var x96: u64 = undefined;
1100 var x97: u64 = undefined;
1101 mulxU64(&x96, &x97, x92, 0xffffffffffffffff);
1102 var x98: u64 = undefined;
1103 var x99: u64 = undefined;
1104 mulxU64(&x98, &x99, x92, 0xbce6faada7179e84);
1105 var x100: u64 = undefined;
1106 var x101: u64 = undefined;
1107 mulxU64(&x100, &x101, x92, 0xf3b9cac2fc632551);
1108 var x102: u64 = undefined;
1109 var x103: u1 = undefined;
1110 addcarryxU64(&x102, &x103, 0x0, x101, x98);
1111 var x104: u64 = undefined;
1112 var x105: u1 = undefined;
1113 addcarryxU64(&x104, &x105, x103, x99, x96);
1114 var x106: u64 = undefined;
1115 var x107: u1 = undefined;
1116 addcarryxU64(&x106, &x107, x105, x97, x94);
1117 var x108: u64 = undefined;
1118 var x109: u1 = undefined;
1119 addcarryxU64(&x108, &x109, 0x0, x86, x100);
1120 var x110: u64 = undefined;
1121 var x111: u1 = undefined;
1122 addcarryxU64(&x110, &x111, x109, x88, x102);
1123 var x112: u64 = undefined;
1124 var x113: u1 = undefined;
1125 addcarryxU64(&x112, &x113, x111, x90, x104);
1126 var x114: u64 = undefined;
1127 var x115: u1 = undefined;
1128 addcarryxU64(&x114, &x115, x113, (cast(u64, x91) + (cast(u64, x85) + (cast(u64, x77) + x65))), x106);
1129 const x116 = (cast(u64, x115) + (cast(u64, x107) + x95));
1130 var x117: u64 = undefined;
1131 var x118: u1 = undefined;
1132 subborrowxU64(&x117, &x118, 0x0, x110, 0xf3b9cac2fc632551);
1133 var x119: u64 = undefined;
1134 var x120: u1 = undefined;
1135 subborrowxU64(&x119, &x120, x118, x112, 0xbce6faada7179e84);
1136 var x121: u64 = undefined;
1137 var x122: u1 = undefined;
1138 subborrowxU64(&x121, &x122, x120, x114, 0xffffffffffffffff);
1139 var x123: u64 = undefined;
1140 var x124: u1 = undefined;
1141 subborrowxU64(&x123, &x124, x122, x116, 0xffffffff00000000);
1142 var x125: u64 = undefined;
1143 var x126: u1 = undefined;
1144 subborrowxU64(&x125, &x126, x124, cast(u64, 0x0), cast(u64, 0x0));
1145 var x127: u64 = undefined;
1146 cmovznzU64(&x127, x126, x117, x110);
1147 var x128: u64 = undefined;
1148 cmovznzU64(&x128, x126, x119, x112);
1149 var x129: u64 = undefined;
1150 cmovznzU64(&x129, x126, x121, x114);
1151 var x130: u64 = undefined;
1152 cmovznzU64(&x130, x126, x123, x116);
1153 out1[0] = x127;
1154 out1[1] = x128;
1155 out1[2] = x129;
1156 out1[3] = x130;
1157}
1158
1159/// The function toMontgomery translates a field element into the Montgomery domain.
1160/// Preconditions:
1161/// 0 ≤ eval arg1 < m
1162/// Postconditions:
1163/// eval (from_montgomery out1) mod m = eval arg1 mod m
1164/// 0 ≤ eval out1 < m
1165///
1166/// Input Bounds:
1167/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1168/// Output Bounds:
1169/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1170pub fn toMontgomery(out1: *[4]u64, arg1: [4]u64) void {
1171 @setRuntimeSafety(mode == .Debug);
1172
1173 const x1 = (arg1[1]);
1174 const x2 = (arg1[2]);
1175 const x3 = (arg1[3]);
1176 const x4 = (arg1[0]);
1177 var x5: u64 = undefined;
1178 var x6: u64 = undefined;
1179 mulxU64(&x5, &x6, x4, 0x66e12d94f3d95620);
1180 var x7: u64 = undefined;
1181 var x8: u64 = undefined;
1182 mulxU64(&x7, &x8, x4, 0x2845b2392b6bec59);
1183 var x9: u64 = undefined;
1184 var x10: u64 = undefined;
1185 mulxU64(&x9, &x10, x4, 0x4699799c49bd6fa6);
1186 var x11: u64 = undefined;
1187 var x12: u64 = undefined;
1188 mulxU64(&x11, &x12, x4, 0x83244c95be79eea2);
1189 var x13: u64 = undefined;
1190 var x14: u1 = undefined;
1191 addcarryxU64(&x13, &x14, 0x0, x12, x9);
1192 var x15: u64 = undefined;
1193 var x16: u1 = undefined;
1194 addcarryxU64(&x15, &x16, x14, x10, x7);
1195 var x17: u64 = undefined;
1196 var x18: u1 = undefined;
1197 addcarryxU64(&x17, &x18, x16, x8, x5);
1198 var x19: u64 = undefined;
1199 var x20: u64 = undefined;
1200 mulxU64(&x19, &x20, x11, 0xccd1c8aaee00bc4f);
1201 var x21: u64 = undefined;
1202 var x22: u64 = undefined;
1203 mulxU64(&x21, &x22, x19, 0xffffffff00000000);
1204 var x23: u64 = undefined;
1205 var x24: u64 = undefined;
1206 mulxU64(&x23, &x24, x19, 0xffffffffffffffff);
1207 var x25: u64 = undefined;
1208 var x26: u64 = undefined;
1209 mulxU64(&x25, &x26, x19, 0xbce6faada7179e84);
1210 var x27: u64 = undefined;
1211 var x28: u64 = undefined;
1212 mulxU64(&x27, &x28, x19, 0xf3b9cac2fc632551);
1213 var x29: u64 = undefined;
1214 var x30: u1 = undefined;
1215 addcarryxU64(&x29, &x30, 0x0, x28, x25);
1216 var x31: u64 = undefined;
1217 var x32: u1 = undefined;
1218 addcarryxU64(&x31, &x32, x30, x26, x23);
1219 var x33: u64 = undefined;
1220 var x34: u1 = undefined;
1221 addcarryxU64(&x33, &x34, x32, x24, x21);
1222 var x35: u64 = undefined;
1223 var x36: u1 = undefined;
1224 addcarryxU64(&x35, &x36, 0x0, x11, x27);
1225 var x37: u64 = undefined;
1226 var x38: u1 = undefined;
1227 addcarryxU64(&x37, &x38, x36, x13, x29);
1228 var x39: u64 = undefined;
1229 var x40: u1 = undefined;
1230 addcarryxU64(&x39, &x40, x38, x15, x31);
1231 var x41: u64 = undefined;
1232 var x42: u1 = undefined;
1233 addcarryxU64(&x41, &x42, x40, x17, x33);
1234 var x43: u64 = undefined;
1235 var x44: u1 = undefined;
1236 addcarryxU64(&x43, &x44, x42, (cast(u64, x18) + x6), (cast(u64, x34) + x22));
1237 var x45: u64 = undefined;
1238 var x46: u64 = undefined;
1239 mulxU64(&x45, &x46, x1, 0x66e12d94f3d95620);
1240 var x47: u64 = undefined;
1241 var x48: u64 = undefined;
1242 mulxU64(&x47, &x48, x1, 0x2845b2392b6bec59);
1243 var x49: u64 = undefined;
1244 var x50: u64 = undefined;
1245 mulxU64(&x49, &x50, x1, 0x4699799c49bd6fa6);
1246 var x51: u64 = undefined;
1247 var x52: u64 = undefined;
1248 mulxU64(&x51, &x52, x1, 0x83244c95be79eea2);
1249 var x53: u64 = undefined;
1250 var x54: u1 = undefined;
1251 addcarryxU64(&x53, &x54, 0x0, x52, x49);
1252 var x55: u64 = undefined;
1253 var x56: u1 = undefined;
1254 addcarryxU64(&x55, &x56, x54, x50, x47);
1255 var x57: u64 = undefined;
1256 var x58: u1 = undefined;
1257 addcarryxU64(&x57, &x58, x56, x48, x45);
1258 var x59: u64 = undefined;
1259 var x60: u1 = undefined;
1260 addcarryxU64(&x59, &x60, 0x0, x37, x51);
1261 var x61: u64 = undefined;
1262 var x62: u1 = undefined;
1263 addcarryxU64(&x61, &x62, x60, x39, x53);
1264 var x63: u64 = undefined;
1265 var x64: u1 = undefined;
1266 addcarryxU64(&x63, &x64, x62, x41, x55);
1267 var x65: u64 = undefined;
1268 var x66: u1 = undefined;
1269 addcarryxU64(&x65, &x66, x64, x43, x57);
1270 var x67: u64 = undefined;
1271 var x68: u64 = undefined;
1272 mulxU64(&x67, &x68, x59, 0xccd1c8aaee00bc4f);
1273 var x69: u64 = undefined;
1274 var x70: u64 = undefined;
1275 mulxU64(&x69, &x70, x67, 0xffffffff00000000);
1276 var x71: u64 = undefined;
1277 var x72: u64 = undefined;
1278 mulxU64(&x71, &x72, x67, 0xffffffffffffffff);
1279 var x73: u64 = undefined;
1280 var x74: u64 = undefined;
1281 mulxU64(&x73, &x74, x67, 0xbce6faada7179e84);
1282 var x75: u64 = undefined;
1283 var x76: u64 = undefined;
1284 mulxU64(&x75, &x76, x67, 0xf3b9cac2fc632551);
1285 var x77: u64 = undefined;
1286 var x78: u1 = undefined;
1287 addcarryxU64(&x77, &x78, 0x0, x76, x73);
1288 var x79: u64 = undefined;
1289 var x80: u1 = undefined;
1290 addcarryxU64(&x79, &x80, x78, x74, x71);
1291 var x81: u64 = undefined;
1292 var x82: u1 = undefined;
1293 addcarryxU64(&x81, &x82, x80, x72, x69);
1294 var x83: u64 = undefined;
1295 var x84: u1 = undefined;
1296 addcarryxU64(&x83, &x84, 0x0, x59, x75);
1297 var x85: u64 = undefined;
1298 var x86: u1 = undefined;
1299 addcarryxU64(&x85, &x86, x84, x61, x77);
1300 var x87: u64 = undefined;
1301 var x88: u1 = undefined;
1302 addcarryxU64(&x87, &x88, x86, x63, x79);
1303 var x89: u64 = undefined;
1304 var x90: u1 = undefined;
1305 addcarryxU64(&x89, &x90, x88, x65, x81);
1306 var x91: u64 = undefined;
1307 var x92: u1 = undefined;
1308 addcarryxU64(&x91, &x92, x90, ((cast(u64, x66) + cast(u64, x44)) + (cast(u64, x58) + x46)), (cast(u64, x82) + x70));
1309 var x93: u64 = undefined;
1310 var x94: u64 = undefined;
1311 mulxU64(&x93, &x94, x2, 0x66e12d94f3d95620);
1312 var x95: u64 = undefined;
1313 var x96: u64 = undefined;
1314 mulxU64(&x95, &x96, x2, 0x2845b2392b6bec59);
1315 var x97: u64 = undefined;
1316 var x98: u64 = undefined;
1317 mulxU64(&x97, &x98, x2, 0x4699799c49bd6fa6);
1318 var x99: u64 = undefined;
1319 var x100: u64 = undefined;
1320 mulxU64(&x99, &x100, x2, 0x83244c95be79eea2);
1321 var x101: u64 = undefined;
1322 var x102: u1 = undefined;
1323 addcarryxU64(&x101, &x102, 0x0, x100, x97);
1324 var x103: u64 = undefined;
1325 var x104: u1 = undefined;
1326 addcarryxU64(&x103, &x104, x102, x98, x95);
1327 var x105: u64 = undefined;
1328 var x106: u1 = undefined;
1329 addcarryxU64(&x105, &x106, x104, x96, x93);
1330 var x107: u64 = undefined;
1331 var x108: u1 = undefined;
1332 addcarryxU64(&x107, &x108, 0x0, x85, x99);
1333 var x109: u64 = undefined;
1334 var x110: u1 = undefined;
1335 addcarryxU64(&x109, &x110, x108, x87, x101);
1336 var x111: u64 = undefined;
1337 var x112: u1 = undefined;
1338 addcarryxU64(&x111, &x112, x110, x89, x103);
1339 var x113: u64 = undefined;
1340 var x114: u1 = undefined;
1341 addcarryxU64(&x113, &x114, x112, x91, x105);
1342 var x115: u64 = undefined;
1343 var x116: u64 = undefined;
1344 mulxU64(&x115, &x116, x107, 0xccd1c8aaee00bc4f);
1345 var x117: u64 = undefined;
1346 var x118: u64 = undefined;
1347 mulxU64(&x117, &x118, x115, 0xffffffff00000000);
1348 var x119: u64 = undefined;
1349 var x120: u64 = undefined;
1350 mulxU64(&x119, &x120, x115, 0xffffffffffffffff);
1351 var x121: u64 = undefined;
1352 var x122: u64 = undefined;
1353 mulxU64(&x121, &x122, x115, 0xbce6faada7179e84);
1354 var x123: u64 = undefined;
1355 var x124: u64 = undefined;
1356 mulxU64(&x123, &x124, x115, 0xf3b9cac2fc632551);
1357 var x125: u64 = undefined;
1358 var x126: u1 = undefined;
1359 addcarryxU64(&x125, &x126, 0x0, x124, x121);
1360 var x127: u64 = undefined;
1361 var x128: u1 = undefined;
1362 addcarryxU64(&x127, &x128, x126, x122, x119);
1363 var x129: u64 = undefined;
1364 var x130: u1 = undefined;
1365 addcarryxU64(&x129, &x130, x128, x120, x117);
1366 var x131: u64 = undefined;
1367 var x132: u1 = undefined;
1368 addcarryxU64(&x131, &x132, 0x0, x107, x123);
1369 var x133: u64 = undefined;
1370 var x134: u1 = undefined;
1371 addcarryxU64(&x133, &x134, x132, x109, x125);
1372 var x135: u64 = undefined;
1373 var x136: u1 = undefined;
1374 addcarryxU64(&x135, &x136, x134, x111, x127);
1375 var x137: u64 = undefined;
1376 var x138: u1 = undefined;
1377 addcarryxU64(&x137, &x138, x136, x113, x129);
1378 var x139: u64 = undefined;
1379 var x140: u1 = undefined;
1380 addcarryxU64(&x139, &x140, x138, ((cast(u64, x114) + cast(u64, x92)) + (cast(u64, x106) + x94)), (cast(u64, x130) + x118));
1381 var x141: u64 = undefined;
1382 var x142: u64 = undefined;
1383 mulxU64(&x141, &x142, x3, 0x66e12d94f3d95620);
1384 var x143: u64 = undefined;
1385 var x144: u64 = undefined;
1386 mulxU64(&x143, &x144, x3, 0x2845b2392b6bec59);
1387 var x145: u64 = undefined;
1388 var x146: u64 = undefined;
1389 mulxU64(&x145, &x146, x3, 0x4699799c49bd6fa6);
1390 var x147: u64 = undefined;
1391 var x148: u64 = undefined;
1392 mulxU64(&x147, &x148, x3, 0x83244c95be79eea2);
1393 var x149: u64 = undefined;
1394 var x150: u1 = undefined;
1395 addcarryxU64(&x149, &x150, 0x0, x148, x145);
1396 var x151: u64 = undefined;
1397 var x152: u1 = undefined;
1398 addcarryxU64(&x151, &x152, x150, x146, x143);
1399 var x153: u64 = undefined;
1400 var x154: u1 = undefined;
1401 addcarryxU64(&x153, &x154, x152, x144, x141);
1402 var x155: u64 = undefined;
1403 var x156: u1 = undefined;
1404 addcarryxU64(&x155, &x156, 0x0, x133, x147);
1405 var x157: u64 = undefined;
1406 var x158: u1 = undefined;
1407 addcarryxU64(&x157, &x158, x156, x135, x149);
1408 var x159: u64 = undefined;
1409 var x160: u1 = undefined;
1410 addcarryxU64(&x159, &x160, x158, x137, x151);
1411 var x161: u64 = undefined;
1412 var x162: u1 = undefined;
1413 addcarryxU64(&x161, &x162, x160, x139, x153);
1414 var x163: u64 = undefined;
1415 var x164: u64 = undefined;
1416 mulxU64(&x163, &x164, x155, 0xccd1c8aaee00bc4f);
1417 var x165: u64 = undefined;
1418 var x166: u64 = undefined;
1419 mulxU64(&x165, &x166, x163, 0xffffffff00000000);
1420 var x167: u64 = undefined;
1421 var x168: u64 = undefined;
1422 mulxU64(&x167, &x168, x163, 0xffffffffffffffff);
1423 var x169: u64 = undefined;
1424 var x170: u64 = undefined;
1425 mulxU64(&x169, &x170, x163, 0xbce6faada7179e84);
1426 var x171: u64 = undefined;
1427 var x172: u64 = undefined;
1428 mulxU64(&x171, &x172, x163, 0xf3b9cac2fc632551);
1429 var x173: u64 = undefined;
1430 var x174: u1 = undefined;
1431 addcarryxU64(&x173, &x174, 0x0, x172, x169);
1432 var x175: u64 = undefined;
1433 var x176: u1 = undefined;
1434 addcarryxU64(&x175, &x176, x174, x170, x167);
1435 var x177: u64 = undefined;
1436 var x178: u1 = undefined;
1437 addcarryxU64(&x177, &x178, x176, x168, x165);
1438 var x179: u64 = undefined;
1439 var x180: u1 = undefined;
1440 addcarryxU64(&x179, &x180, 0x0, x155, x171);
1441 var x181: u64 = undefined;
1442 var x182: u1 = undefined;
1443 addcarryxU64(&x181, &x182, x180, x157, x173);
1444 var x183: u64 = undefined;
1445 var x184: u1 = undefined;
1446 addcarryxU64(&x183, &x184, x182, x159, x175);
1447 var x185: u64 = undefined;
1448 var x186: u1 = undefined;
1449 addcarryxU64(&x185, &x186, x184, x161, x177);
1450 var x187: u64 = undefined;
1451 var x188: u1 = undefined;
1452 addcarryxU64(&x187, &x188, x186, ((cast(u64, x162) + cast(u64, x140)) + (cast(u64, x154) + x142)), (cast(u64, x178) + x166));
1453 var x189: u64 = undefined;
1454 var x190: u1 = undefined;
1455 subborrowxU64(&x189, &x190, 0x0, x181, 0xf3b9cac2fc632551);
1456 var x191: u64 = undefined;
1457 var x192: u1 = undefined;
1458 subborrowxU64(&x191, &x192, x190, x183, 0xbce6faada7179e84);
1459 var x193: u64 = undefined;
1460 var x194: u1 = undefined;
1461 subborrowxU64(&x193, &x194, x192, x185, 0xffffffffffffffff);
1462 var x195: u64 = undefined;
1463 var x196: u1 = undefined;
1464 subborrowxU64(&x195, &x196, x194, x187, 0xffffffff00000000);
1465 var x197: u64 = undefined;
1466 var x198: u1 = undefined;
1467 subborrowxU64(&x197, &x198, x196, cast(u64, x188), cast(u64, 0x0));
1468 var x199: u64 = undefined;
1469 cmovznzU64(&x199, x198, x189, x181);
1470 var x200: u64 = undefined;
1471 cmovznzU64(&x200, x198, x191, x183);
1472 var x201: u64 = undefined;
1473 cmovznzU64(&x201, x198, x193, x185);
1474 var x202: u64 = undefined;
1475 cmovznzU64(&x202, x198, x195, x187);
1476 out1[0] = x199;
1477 out1[1] = x200;
1478 out1[2] = x201;
1479 out1[3] = x202;
1480}
1481
1482/// The function nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
1483/// Preconditions:
1484/// 0 ≤ eval arg1 < m
1485/// Postconditions:
1486/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
1487///
1488/// Input Bounds:
1489/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1490/// Output Bounds:
1491/// out1: [0x0 ~> 0xffffffffffffffff]
1492pub fn nonzero(out1: *u64, arg1: [4]u64) void {
1493 @setRuntimeSafety(mode == .Debug);
1494
1495 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))));
1496 out1.* = x1;
1497}
1498
1499/// The function selectznz is a multi-limb conditional select.
1500/// Postconditions:
1501/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
1502///
1503/// Input Bounds:
1504/// arg1: [0x0 ~> 0x1]
1505/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1506/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1507/// Output Bounds:
1508/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1509pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
1510 @setRuntimeSafety(mode == .Debug);
1511
1512 var x1: u64 = undefined;
1513 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
1514 var x2: u64 = undefined;
1515 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
1516 var x3: u64 = undefined;
1517 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
1518 var x4: u64 = undefined;
1519 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
1520 out1[0] = x1;
1521 out1[1] = x2;
1522 out1[2] = x3;
1523 out1[3] = x4;
1524}
1525
1526/// The function toBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
1527/// Preconditions:
1528/// 0 ≤ eval arg1 < m
1529/// Postconditions:
1530/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
1531///
1532/// Input Bounds:
1533/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1534/// Output Bounds:
1535/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1536pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
1537 @setRuntimeSafety(mode == .Debug);
1538
1539 const x1 = (arg1[3]);
1540 const x2 = (arg1[2]);
1541 const x3 = (arg1[1]);
1542 const x4 = (arg1[0]);
1543 const x5 = cast(u8, (x4 & cast(u64, 0xff)));
1544 const x6 = (x4 >> 8);
1545 const x7 = cast(u8, (x6 & cast(u64, 0xff)));
1546 const x8 = (x6 >> 8);
1547 const x9 = cast(u8, (x8 & cast(u64, 0xff)));
1548 const x10 = (x8 >> 8);
1549 const x11 = cast(u8, (x10 & cast(u64, 0xff)));
1550 const x12 = (x10 >> 8);
1551 const x13 = cast(u8, (x12 & cast(u64, 0xff)));
1552 const x14 = (x12 >> 8);
1553 const x15 = cast(u8, (x14 & cast(u64, 0xff)));
1554 const x16 = (x14 >> 8);
1555 const x17 = cast(u8, (x16 & cast(u64, 0xff)));
1556 const x18 = cast(u8, (x16 >> 8));
1557 const x19 = cast(u8, (x3 & cast(u64, 0xff)));
1558 const x20 = (x3 >> 8);
1559 const x21 = cast(u8, (x20 & cast(u64, 0xff)));
1560 const x22 = (x20 >> 8);
1561 const x23 = cast(u8, (x22 & cast(u64, 0xff)));
1562 const x24 = (x22 >> 8);
1563 const x25 = cast(u8, (x24 & cast(u64, 0xff)));
1564 const x26 = (x24 >> 8);
1565 const x27 = cast(u8, (x26 & cast(u64, 0xff)));
1566 const x28 = (x26 >> 8);
1567 const x29 = cast(u8, (x28 & cast(u64, 0xff)));
1568 const x30 = (x28 >> 8);
1569 const x31 = cast(u8, (x30 & cast(u64, 0xff)));
1570 const x32 = cast(u8, (x30 >> 8));
1571 const x33 = cast(u8, (x2 & cast(u64, 0xff)));
1572 const x34 = (x2 >> 8);
1573 const x35 = cast(u8, (x34 & cast(u64, 0xff)));
1574 const x36 = (x34 >> 8);
1575 const x37 = cast(u8, (x36 & cast(u64, 0xff)));
1576 const x38 = (x36 >> 8);
1577 const x39 = cast(u8, (x38 & cast(u64, 0xff)));
1578 const x40 = (x38 >> 8);
1579 const x41 = cast(u8, (x40 & cast(u64, 0xff)));
1580 const x42 = (x40 >> 8);
1581 const x43 = cast(u8, (x42 & cast(u64, 0xff)));
1582 const x44 = (x42 >> 8);
1583 const x45 = cast(u8, (x44 & cast(u64, 0xff)));
1584 const x46 = cast(u8, (x44 >> 8));
1585 const x47 = cast(u8, (x1 & cast(u64, 0xff)));
1586 const x48 = (x1 >> 8);
1587 const x49 = cast(u8, (x48 & cast(u64, 0xff)));
1588 const x50 = (x48 >> 8);
1589 const x51 = cast(u8, (x50 & cast(u64, 0xff)));
1590 const x52 = (x50 >> 8);
1591 const x53 = cast(u8, (x52 & cast(u64, 0xff)));
1592 const x54 = (x52 >> 8);
1593 const x55 = cast(u8, (x54 & cast(u64, 0xff)));
1594 const x56 = (x54 >> 8);
1595 const x57 = cast(u8, (x56 & cast(u64, 0xff)));
1596 const x58 = (x56 >> 8);
1597 const x59 = cast(u8, (x58 & cast(u64, 0xff)));
1598 const x60 = cast(u8, (x58 >> 8));
1599 out1[0] = x5;
1600 out1[1] = x7;
1601 out1[2] = x9;
1602 out1[3] = x11;
1603 out1[4] = x13;
1604 out1[5] = x15;
1605 out1[6] = x17;
1606 out1[7] = x18;
1607 out1[8] = x19;
1608 out1[9] = x21;
1609 out1[10] = x23;
1610 out1[11] = x25;
1611 out1[12] = x27;
1612 out1[13] = x29;
1613 out1[14] = x31;
1614 out1[15] = x32;
1615 out1[16] = x33;
1616 out1[17] = x35;
1617 out1[18] = x37;
1618 out1[19] = x39;
1619 out1[20] = x41;
1620 out1[21] = x43;
1621 out1[22] = x45;
1622 out1[23] = x46;
1623 out1[24] = x47;
1624 out1[25] = x49;
1625 out1[26] = x51;
1626 out1[27] = x53;
1627 out1[28] = x55;
1628 out1[29] = x57;
1629 out1[30] = x59;
1630 out1[31] = x60;
1631}
1632
1633/// The function fromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
1634/// Preconditions:
1635/// 0 ≤ bytes_eval arg1 < m
1636/// Postconditions:
1637/// eval out1 mod m = bytes_eval arg1 mod m
1638/// 0 ≤ eval out1 < m
1639///
1640/// Input Bounds:
1641/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1642/// Output Bounds:
1643/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1644pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
1645 @setRuntimeSafety(mode == .Debug);
1646
1647 const x1 = (cast(u64, (arg1[31])) << 56);
1648 const x2 = (cast(u64, (arg1[30])) << 48);
1649 const x3 = (cast(u64, (arg1[29])) << 40);
1650 const x4 = (cast(u64, (arg1[28])) << 32);
1651 const x5 = (cast(u64, (arg1[27])) << 24);
1652 const x6 = (cast(u64, (arg1[26])) << 16);
1653 const x7 = (cast(u64, (arg1[25])) << 8);
1654 const x8 = (arg1[24]);
1655 const x9 = (cast(u64, (arg1[23])) << 56);
1656 const x10 = (cast(u64, (arg1[22])) << 48);
1657 const x11 = (cast(u64, (arg1[21])) << 40);
1658 const x12 = (cast(u64, (arg1[20])) << 32);
1659 const x13 = (cast(u64, (arg1[19])) << 24);
1660 const x14 = (cast(u64, (arg1[18])) << 16);
1661 const x15 = (cast(u64, (arg1[17])) << 8);
1662 const x16 = (arg1[16]);
1663 const x17 = (cast(u64, (arg1[15])) << 56);
1664 const x18 = (cast(u64, (arg1[14])) << 48);
1665 const x19 = (cast(u64, (arg1[13])) << 40);
1666 const x20 = (cast(u64, (arg1[12])) << 32);
1667 const x21 = (cast(u64, (arg1[11])) << 24);
1668 const x22 = (cast(u64, (arg1[10])) << 16);
1669 const x23 = (cast(u64, (arg1[9])) << 8);
1670 const x24 = (arg1[8]);
1671 const x25 = (cast(u64, (arg1[7])) << 56);
1672 const x26 = (cast(u64, (arg1[6])) << 48);
1673 const x27 = (cast(u64, (arg1[5])) << 40);
1674 const x28 = (cast(u64, (arg1[4])) << 32);
1675 const x29 = (cast(u64, (arg1[3])) << 24);
1676 const x30 = (cast(u64, (arg1[2])) << 16);
1677 const x31 = (cast(u64, (arg1[1])) << 8);
1678 const x32 = (arg1[0]);
1679 const x33 = (x31 + cast(u64, x32));
1680 const x34 = (x30 + x33);
1681 const x35 = (x29 + x34);
1682 const x36 = (x28 + x35);
1683 const x37 = (x27 + x36);
1684 const x38 = (x26 + x37);
1685 const x39 = (x25 + x38);
1686 const x40 = (x23 + cast(u64, x24));
1687 const x41 = (x22 + x40);
1688 const x42 = (x21 + x41);
1689 const x43 = (x20 + x42);
1690 const x44 = (x19 + x43);
1691 const x45 = (x18 + x44);
1692 const x46 = (x17 + x45);
1693 const x47 = (x15 + cast(u64, x16));
1694 const x48 = (x14 + x47);
1695 const x49 = (x13 + x48);
1696 const x50 = (x12 + x49);
1697 const x51 = (x11 + x50);
1698 const x52 = (x10 + x51);
1699 const x53 = (x9 + x52);
1700 const x54 = (x7 + cast(u64, x8));
1701 const x55 = (x6 + x54);
1702 const x56 = (x5 + x55);
1703 const x57 = (x4 + x56);
1704 const x58 = (x3 + x57);
1705 const x59 = (x2 + x58);
1706 const x60 = (x1 + x59);
1707 out1[0] = x39;
1708 out1[1] = x46;
1709 out1[2] = x53;
1710 out1[3] = x60;
1711}
1712
1713/// The function setOne returns the field element one in the Montgomery domain.
1714/// Postconditions:
1715/// eval (from_montgomery out1) mod m = 1 mod m
1716/// 0 ≤ eval out1 < m
1717///
1718/// Input Bounds:
1719/// Output Bounds:
1720/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1721pub fn setOne(out1: *[4]u64) void {
1722 @setRuntimeSafety(mode == .Debug);
1723
1724 out1[0] = 0xc46353d039cdaaf;
1725 out1[1] = 0x4319055258e8617b;
1726 out1[2] = cast(u64, 0x0);
1727 out1[3] = 0xffffffff;
1728}
1729
1730/// The function msat returns the saturated representation of the prime modulus.
1731/// Postconditions:
1732/// twos_complement_eval out1 = m
1733/// 0 ≤ eval out1 < m
1734///
1735/// Input Bounds:
1736/// Output Bounds:
1737/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1738pub fn msat(out1: *[5]u64) void {
1739 @setRuntimeSafety(mode == .Debug);
1740
1741 out1[0] = 0xf3b9cac2fc632551;
1742 out1[1] = 0xbce6faada7179e84;
1743 out1[2] = 0xffffffffffffffff;
1744 out1[3] = 0xffffffff00000000;
1745 out1[4] = cast(u64, 0x0);
1746}
1747
1748/// The function divstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
1749/// Postconditions:
1750/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)
1751/// 0 ≤ eval out1 < m
1752///
1753/// Input Bounds:
1754/// Output Bounds:
1755/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1756pub fn divstepPrecomp(out1: *[4]u64) void {
1757 @setRuntimeSafety(mode == .Debug);
1758
1759 out1[0] = 0xd739262fb7fcfbb5;
1760 out1[1] = 0x8ac6f75d20074414;
1761 out1[2] = 0xc67428bfb5e3c256;
1762 out1[3] = 0x444962f2eda7aedf;
1763}
1764
1765/// The function divstep computes a divstep.
1766/// Preconditions:
1767/// 0 ≤ eval arg4 < m
1768/// 0 ≤ eval arg5 < m
1769/// Postconditions:
1770/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
1771/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
1772/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
1773/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
1774/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
1775/// 0 ≤ eval out5 < m
1776/// 0 ≤ eval out5 < m
1777/// 0 ≤ eval out2 < m
1778/// 0 ≤ eval out3 < m
1779///
1780/// Input Bounds:
1781/// arg1: [0x0 ~> 0xffffffffffffffff]
1782/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1783/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1784/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1785/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1786/// Output Bounds:
1787/// out1: [0x0 ~> 0xffffffffffffffff]
1788/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1789/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1790/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1791/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1792pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[4]u64, arg1: u64, arg2: [5]u64, arg3: [5]u64, arg4: [4]u64, arg5: [4]u64) void {
1793 @setRuntimeSafety(mode == .Debug);
1794
1795 var x1: u64 = undefined;
1796 var x2: u1 = undefined;
1797 addcarryxU64(&x1, &x2, 0x0, (~arg1), cast(u64, 0x1));
1798 const x3 = (cast(u1, (x1 >> 63)) & cast(u1, ((arg3[0]) & cast(u64, 0x1))));
1799 var x4: u64 = undefined;
1800 var x5: u1 = undefined;
1801 addcarryxU64(&x4, &x5, 0x0, (~arg1), cast(u64, 0x1));
1802 var x6: u64 = undefined;
1803 cmovznzU64(&x6, x3, arg1, x4);
1804 var x7: u64 = undefined;
1805 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
1806 var x8: u64 = undefined;
1807 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
1808 var x9: u64 = undefined;
1809 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
1810 var x10: u64 = undefined;
1811 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
1812 var x11: u64 = undefined;
1813 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
1814 var x12: u64 = undefined;
1815 var x13: u1 = undefined;
1816 addcarryxU64(&x12, &x13, 0x0, cast(u64, 0x1), (~(arg2[0])));
1817 var x14: u64 = undefined;
1818 var x15: u1 = undefined;
1819 addcarryxU64(&x14, &x15, x13, cast(u64, 0x0), (~(arg2[1])));
1820 var x16: u64 = undefined;
1821 var x17: u1 = undefined;
1822 addcarryxU64(&x16, &x17, x15, cast(u64, 0x0), (~(arg2[2])));
1823 var x18: u64 = undefined;
1824 var x19: u1 = undefined;
1825 addcarryxU64(&x18, &x19, x17, cast(u64, 0x0), (~(arg2[3])));
1826 var x20: u64 = undefined;
1827 var x21: u1 = undefined;
1828 addcarryxU64(&x20, &x21, x19, cast(u64, 0x0), (~(arg2[4])));
1829 var x22: u64 = undefined;
1830 cmovznzU64(&x22, x3, (arg3[0]), x12);
1831 var x23: u64 = undefined;
1832 cmovznzU64(&x23, x3, (arg3[1]), x14);
1833 var x24: u64 = undefined;
1834 cmovznzU64(&x24, x3, (arg3[2]), x16);
1835 var x25: u64 = undefined;
1836 cmovznzU64(&x25, x3, (arg3[3]), x18);
1837 var x26: u64 = undefined;
1838 cmovznzU64(&x26, x3, (arg3[4]), x20);
1839 var x27: u64 = undefined;
1840 cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
1841 var x28: u64 = undefined;
1842 cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
1843 var x29: u64 = undefined;
1844 cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
1845 var x30: u64 = undefined;
1846 cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
1847 var x31: u64 = undefined;
1848 var x32: u1 = undefined;
1849 addcarryxU64(&x31, &x32, 0x0, x27, x27);
1850 var x33: u64 = undefined;
1851 var x34: u1 = undefined;
1852 addcarryxU64(&x33, &x34, x32, x28, x28);
1853 var x35: u64 = undefined;
1854 var x36: u1 = undefined;
1855 addcarryxU64(&x35, &x36, x34, x29, x29);
1856 var x37: u64 = undefined;
1857 var x38: u1 = undefined;
1858 addcarryxU64(&x37, &x38, x36, x30, x30);
1859 var x39: u64 = undefined;
1860 var x40: u1 = undefined;
1861 subborrowxU64(&x39, &x40, 0x0, x31, 0xf3b9cac2fc632551);
1862 var x41: u64 = undefined;
1863 var x42: u1 = undefined;
1864 subborrowxU64(&x41, &x42, x40, x33, 0xbce6faada7179e84);
1865 var x43: u64 = undefined;
1866 var x44: u1 = undefined;
1867 subborrowxU64(&x43, &x44, x42, x35, 0xffffffffffffffff);
1868 var x45: u64 = undefined;
1869 var x46: u1 = undefined;
1870 subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000000);
1871 var x47: u64 = undefined;
1872 var x48: u1 = undefined;
1873 subborrowxU64(&x47, &x48, x46, cast(u64, x38), cast(u64, 0x0));
1874 const x49 = (arg4[3]);
1875 const x50 = (arg4[2]);
1876 const x51 = (arg4[1]);
1877 const x52 = (arg4[0]);
1878 var x53: u64 = undefined;
1879 var x54: u1 = undefined;
1880 subborrowxU64(&x53, &x54, 0x0, cast(u64, 0x0), x52);
1881 var x55: u64 = undefined;
1882 var x56: u1 = undefined;
1883 subborrowxU64(&x55, &x56, x54, cast(u64, 0x0), x51);
1884 var x57: u64 = undefined;
1885 var x58: u1 = undefined;
1886 subborrowxU64(&x57, &x58, x56, cast(u64, 0x0), x50);
1887 var x59: u64 = undefined;
1888 var x60: u1 = undefined;
1889 subborrowxU64(&x59, &x60, x58, cast(u64, 0x0), x49);
1890 var x61: u64 = undefined;
1891 cmovznzU64(&x61, x60, cast(u64, 0x0), 0xffffffffffffffff);
1892 var x62: u64 = undefined;
1893 var x63: u1 = undefined;
1894 addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xf3b9cac2fc632551));
1895 var x64: u64 = undefined;
1896 var x65: u1 = undefined;
1897 addcarryxU64(&x64, &x65, x63, x55, (x61 & 0xbce6faada7179e84));
1898 var x66: u64 = undefined;
1899 var x67: u1 = undefined;
1900 addcarryxU64(&x66, &x67, x65, x57, x61);
1901 var x68: u64 = undefined;
1902 var x69: u1 = undefined;
1903 addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000000));
1904 var x70: u64 = undefined;
1905 cmovznzU64(&x70, x3, (arg5[0]), x62);
1906 var x71: u64 = undefined;
1907 cmovznzU64(&x71, x3, (arg5[1]), x64);
1908 var x72: u64 = undefined;
1909 cmovznzU64(&x72, x3, (arg5[2]), x66);
1910 var x73: u64 = undefined;
1911 cmovznzU64(&x73, x3, (arg5[3]), x68);
1912 const x74 = cast(u1, (x22 & cast(u64, 0x1)));
1913 var x75: u64 = undefined;
1914 cmovznzU64(&x75, x74, cast(u64, 0x0), x7);
1915 var x76: u64 = undefined;
1916 cmovznzU64(&x76, x74, cast(u64, 0x0), x8);
1917 var x77: u64 = undefined;
1918 cmovznzU64(&x77, x74, cast(u64, 0x0), x9);
1919 var x78: u64 = undefined;
1920 cmovznzU64(&x78, x74, cast(u64, 0x0), x10);
1921 var x79: u64 = undefined;
1922 cmovznzU64(&x79, x74, cast(u64, 0x0), x11);
1923 var x80: u64 = undefined;
1924 var x81: u1 = undefined;
1925 addcarryxU64(&x80, &x81, 0x0, x22, x75);
1926 var x82: u64 = undefined;
1927 var x83: u1 = undefined;
1928 addcarryxU64(&x82, &x83, x81, x23, x76);
1929 var x84: u64 = undefined;
1930 var x85: u1 = undefined;
1931 addcarryxU64(&x84, &x85, x83, x24, x77);
1932 var x86: u64 = undefined;
1933 var x87: u1 = undefined;
1934 addcarryxU64(&x86, &x87, x85, x25, x78);
1935 var x88: u64 = undefined;
1936 var x89: u1 = undefined;
1937 addcarryxU64(&x88, &x89, x87, x26, x79);
1938 var x90: u64 = undefined;
1939 cmovznzU64(&x90, x74, cast(u64, 0x0), x27);
1940 var x91: u64 = undefined;
1941 cmovznzU64(&x91, x74, cast(u64, 0x0), x28);
1942 var x92: u64 = undefined;
1943 cmovznzU64(&x92, x74, cast(u64, 0x0), x29);
1944 var x93: u64 = undefined;
1945 cmovznzU64(&x93, x74, cast(u64, 0x0), x30);
1946 var x94: u64 = undefined;
1947 var x95: u1 = undefined;
1948 addcarryxU64(&x94, &x95, 0x0, x70, x90);
1949 var x96: u64 = undefined;
1950 var x97: u1 = undefined;
1951 addcarryxU64(&x96, &x97, x95, x71, x91);
1952 var x98: u64 = undefined;
1953 var x99: u1 = undefined;
1954 addcarryxU64(&x98, &x99, x97, x72, x92);
1955 var x100: u64 = undefined;
1956 var x101: u1 = undefined;
1957 addcarryxU64(&x100, &x101, x99, x73, x93);
1958 var x102: u64 = undefined;
1959 var x103: u1 = undefined;
1960 subborrowxU64(&x102, &x103, 0x0, x94, 0xf3b9cac2fc632551);
1961 var x104: u64 = undefined;
1962 var x105: u1 = undefined;
1963 subborrowxU64(&x104, &x105, x103, x96, 0xbce6faada7179e84);
1964 var x106: u64 = undefined;
1965 var x107: u1 = undefined;
1966 subborrowxU64(&x106, &x107, x105, x98, 0xffffffffffffffff);
1967 var x108: u64 = undefined;
1968 var x109: u1 = undefined;
1969 subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000000);
1970 var x110: u64 = undefined;
1971 var x111: u1 = undefined;
1972 subborrowxU64(&x110, &x111, x109, cast(u64, x101), cast(u64, 0x0));
1973 var x112: u64 = undefined;
1974 var x113: u1 = undefined;
1975 addcarryxU64(&x112, &x113, 0x0, x6, cast(u64, 0x1));
1976 const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1977 const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1978 const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1979 const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1980 const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1));
1981 var x119: u64 = undefined;
1982 cmovznzU64(&x119, x48, x39, x31);
1983 var x120: u64 = undefined;
1984 cmovznzU64(&x120, x48, x41, x33);
1985 var x121: u64 = undefined;
1986 cmovznzU64(&x121, x48, x43, x35);
1987 var x122: u64 = undefined;
1988 cmovznzU64(&x122, x48, x45, x37);
1989 var x123: u64 = undefined;
1990 cmovznzU64(&x123, x111, x102, x94);
1991 var x124: u64 = undefined;
1992 cmovznzU64(&x124, x111, x104, x96);
1993 var x125: u64 = undefined;
1994 cmovznzU64(&x125, x111, x106, x98);
1995 var x126: u64 = undefined;
1996 cmovznzU64(&x126, x111, x108, x100);
1997 out1.* = x112;
1998 out2[0] = x7;
1999 out2[1] = x8;
2000 out2[2] = x9;
2001 out2[3] = x10;
2002 out2[4] = x11;
2003 out3[0] = x114;
2004 out3[1] = x115;
2005 out3[2] = x116;
2006 out3[3] = x117;
2007 out3[4] = x118;
2008 out4[0] = x119;
2009 out4[1] = x120;
2010 out4[2] = x121;
2011 out4[3] = x122;
2012 out5[0] = x123;
2013 out5[1] = x124;
2014 out5[2] = x125;
2015 out5[3] = x126;
2016}
lib/std/crypto/pcurves/p256/scalar.zig+23-11
...@@ -6,32 +6,44 @@...@@ -6,32 +6,44 @@
66
7const std = @import("std");7const std = @import("std");
8const builtin = std.builtin;8const builtin = std.builtin;
9const common = @import("../common.zig");
9const crypto = std.crypto;10const crypto = std.crypto;
10const debug = std.debug;11const debug = std.debug;
11const math = std.math;12const math = std.math;
12const mem = std.mem;13const mem = std.mem;
1314
14const Fe = @import("field.zig").Fe;15const Field = common.Field;
1516
16const NonCanonicalError = std.crypto.errors.NonCanonicalError;17const NonCanonicalError = std.crypto.errors.NonCanonicalError;
17const NotSquareError = std.crypto.errors.NotSquareError;18const NotSquareError = std.crypto.errors.NotSquareError;
1819
20/// Number of bytes required to encode a scalar.
21pub const encoded_length = 32;
22
19/// A compressed scalar, in canonical form.23/// A compressed scalar, in canonical form.
20pub const CompressedScalar = [32]u8;24pub const CompressedScalar = [encoded_length]u8;
25
26const Fe = Field(.{
27 .fiat = @import("p256_scalar_64.zig"),
28 .field_order = 115792089210356248762697446949407573529996955224135760342422259061068512044369,
29 .field_bits = 256,
30 .saturated_bits = 255,
31 .encoded_length = encoded_length,
32});
2133
22/// Reject a scalar whose encoding is not canonical.34/// Reject a scalar whose encoding is not canonical.
23pub fn rejectNonCanonical(s: CompressedScalar) NonCanonicalError!void {35pub fn rejectNonCanonical(s: CompressedScalar, endian: builtin.Endian) NonCanonicalError!void {
24 return Fe.rejectNonCanonical(s);36 return Fe.rejectNonCanonical(s, endian);
25}37}
2638
27/// Reduce a 48-bytes scalar to the field size.39/// Reduce a 48-bytes scalar to the field size.
28pub fn reduce48(s: [48]u8) CompressedScalar {40pub fn reduce48(s: [48]u8, endian: builtin.Endian) CompressedScalar {
29 return Scalar.fromBytes48(s).toBytes();41 return Scalar.fromBytes48(s, endian).toBytes(endian);
30}42}
3143
32/// Reduce a 64-bytes scalar to the field size.44/// Reduce a 64-bytes scalar to the field size.
33pub fn reduce64(s: [64]u8) CompressedScalar {45pub fn reduce64(s: [64]u8, endian: builtin.Endian) CompressedScalar {
34 return ScalarDouble.fromBytes64(s).toBytes();46 return ScalarDouble.fromBytes64(s, endian).toBytes(endian);
35}47}
3648
37/// Return a*b (mod L)49/// Return a*b (mod L)
...@@ -183,19 +195,19 @@ const ScalarDouble = struct {...@@ -183,19 +195,19 @@ const ScalarDouble = struct {
183 }195 }
184 var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero, .x3 = Fe.zero };196 var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero, .x3 = Fe.zero };
185 {197 {
186 var b = [_]u8{0} ** 32;198 var b = [_]u8{0} ** encoded_length;
187 const len = math.min(s.len, 24);199 const len = math.min(s.len, 24);
188 mem.copy(u8, b[0..len], s[0..len]);200 mem.copy(u8, b[0..len], s[0..len]);
189 t.x1 = Fe.fromBytes(b, .Little) catch unreachable;201 t.x1 = Fe.fromBytes(b, .Little) catch unreachable;
190 }202 }
191 if (s_.len >= 24) {203 if (s_.len >= 24) {
192 var b = [_]u8{0} ** 32;204 var b = [_]u8{0} ** encoded_length;
193 const len = math.min(s.len - 24, 24);205 const len = math.min(s.len - 24, 24);
194 mem.copy(u8, b[0..len], s[24..][0..len]);206 mem.copy(u8, b[0..len], s[24..][0..len]);
195 t.x2 = Fe.fromBytes(b, .Little) catch unreachable;207 t.x2 = Fe.fromBytes(b, .Little) catch unreachable;
196 }208 }
197 if (s_.len >= 48) {209 if (s_.len >= 48) {
198 var b = [_]u8{0} ** 32;210 var b = [_]u8{0} ** encoded_length;
199 const len = s.len - 48;211 const len = s.len - 48;
200 mem.copy(u8, b[0..len], s[48..][0..len]);212 mem.copy(u8, b[0..len], s[48..][0..len]);
201 t.x3 = Fe.fromBytes(b, .Little) catch unreachable;213 t.x3 = Fe.fromBytes(b, .Little) catch unreachable;