fp12e.c 8.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346
  1. /*
  2. * File: dclxvi-20130329/fp12e.c
  3. * Author: Ruben Niederhagen, Peter Schwabe
  4. * Public Domain
  5. */
  6. #include <stdio.h>
  7. #include <assert.h>
  8. //AVANT
  9. //#include "fp6e.h"
  10. //#include "fp12e.h"
  11. //APRES
  12. #include "mul.h"
  13. extern "C" {
  14. #include "fpe.h"
  15. #include "fp2e.h"
  16. #include "fp6e.h"
  17. #include "fp12e.h"
  18. }
  19. extern const fp2e_t bn_zpminus1;
  20. extern const fpe_t bn_zeta;
  21. // Set fp12e_t rop to given value:
  22. void fp12e_set(fp12e_t rop, const fp12e_t op)
  23. {
  24. fp6e_set(rop->m_a, op->m_a);
  25. fp6e_set(rop->m_b, op->m_b);
  26. }
  27. // Initialize an fp12e, set to value given in two fp6es
  28. void fp12e_set_fp6e(fp12e_t rop, const fp6e_t a, const fp6e_t b)
  29. {
  30. fp6e_set(rop->m_a, a);
  31. fp6e_set(rop->m_b, b);
  32. }
  33. // Set rop to one:
  34. void fp12e_setone(fp12e_t rop)
  35. {
  36. fp6e_setzero(rop->m_a);
  37. fp6e_setone(rop->m_b);
  38. }
  39. // Set rop to zero:
  40. void fp12e_setzero(fp12e_t rop)
  41. {
  42. fp6e_setzero(rop->m_a);
  43. fp6e_setzero(rop->m_b);
  44. }
  45. // Compare for equality:
  46. int fp12e_iseq(const fp12e_t op1, const fp12e_t op2)
  47. {
  48. int ret = fp6e_iseq(op1->m_a, op2->m_a);
  49. ret = ret && fp6e_iseq(op1->m_b, op2->m_b);
  50. return ret;
  51. }
  52. int fp12e_isone(const fp12e_t op)
  53. {
  54. int ret = fp6e_iszero(op->m_a);
  55. ret = ret && fp6e_isone(op->m_b);
  56. return ret;
  57. }
  58. int fp12e_iszero(const fp12e_t op)
  59. {
  60. int ret = fp6e_iszero(op->m_a);
  61. ret = ret && fp6e_iszero(op->m_b);
  62. return ret;
  63. }
  64. void fp12e_cmov(fp12e_t rop, const fp12e_t op, int c)
  65. {
  66. fp6e_cmov(rop->m_a, op->m_a, c);
  67. fp6e_cmov(rop->m_b, op->m_b, c);
  68. }
  69. // Compute conjugate over Fp6:
  70. void fp12e_conjugate(fp12e_t rop, const fp12e_t op2)
  71. {
  72. fp6e_neg(rop->m_a, op2->m_a);
  73. fp6e_set(rop->m_b, op2->m_b);
  74. }
  75. // Add two fp12e, store result in rop:
  76. void fp12e_add(fp12e_t rop, const fp12e_t op1, const fp12e_t op2)
  77. {
  78. fp6e_add(rop->m_a, op1->m_a, op2->m_a);
  79. fp6e_add(rop->m_b, op1->m_b, op2->m_b);
  80. }
  81. // Subtract op2 from op1, store result in rop:
  82. void fp12e_sub(fp12e_t rop, const fp12e_t op1, const fp12e_t op2)
  83. {
  84. fp6e_sub(rop->m_a, op1->m_a, op2->m_a);
  85. fp6e_sub(rop->m_b, op1->m_b, op2->m_b);
  86. }
  87. // Multiply two fp12e, store result in rop:
  88. void fp12e_mul(fp12e_t rop, const fp12e_t op1, const fp12e_t op2)
  89. {
  90. #ifdef BENCH
  91. nummultp12 ++;
  92. multp12cycles -= cpucycles();
  93. #endif
  94. fp6e_t tmp1, tmp2, tmp3; // Needed to store intermediary results
  95. fp6e_mul(tmp1, op1->m_a, op2->m_a);
  96. fp6e_mul(tmp3, op1->m_b, op2->m_b);
  97. fp6e_add(tmp2, op2->m_a, op2->m_b);
  98. fp6e_short_coeffred(tmp2);
  99. fp6e_add(rop->m_a, op1->m_a, op1->m_b);
  100. fp6e_short_coeffred(rop->m_a);
  101. fp6e_set(rop->m_b, tmp3);
  102. fp6e_mul(rop->m_a, rop->m_a, tmp2);
  103. fp6e_sub(rop->m_a, rop->m_a, tmp1);
  104. fp6e_sub(rop->m_a, rop->m_a, rop->m_b);
  105. fp6e_short_coeffred(rop->m_a);
  106. fp6e_multau(tmp1, tmp1);
  107. fp6e_add(rop->m_b, rop->m_b, tmp1);
  108. fp6e_short_coeffred(rop->m_b);
  109. #ifdef BENCH
  110. multp12cycles += cpucycles();
  111. #endif
  112. }
  113. void fp12e_mul_fp6e(fp12e_t rop, const fp12e_t op1, const fp6e_t op2)
  114. {
  115. fp6e_mul(rop->m_a, op1->m_a, op2);
  116. fp6e_mul(rop->m_b, op1->m_b, op2);
  117. }
  118. // Square an fp12e, store result in rop:
  119. void fp12e_square(fp12e_t rop, const fp12e_t op)
  120. {
  121. #ifdef BENCH
  122. numsqp12 ++;
  123. sqp12cycles -= cpucycles();
  124. #endif
  125. fp6e_t tmp1, tmp2, tmp3; // Needed to store intermediary results
  126. fp6e_mul(tmp1, op->m_a, op->m_b);
  127. fp6e_add(tmp2, op->m_a, op->m_b);
  128. fp6e_short_coeffred(tmp2);
  129. fp6e_multau(tmp3, op->m_a);
  130. fp6e_add(rop->m_b, tmp3, op->m_b);
  131. fp6e_short_coeffred(rop->m_b);
  132. fp6e_mul(rop->m_b, rop->m_b, tmp2);
  133. fp6e_sub(rop->m_b, rop->m_b, tmp1);
  134. fp6e_multau(tmp2, tmp1);
  135. fp6e_sub(rop->m_b, rop->m_b, tmp2);
  136. fp6e_short_coeffred(rop->m_b);
  137. fp6e_add(rop->m_a, tmp1, tmp1);
  138. fp6e_short_coeffred(rop->m_a);
  139. #ifdef BENCH
  140. sqp12cycles += cpucycles();
  141. #endif
  142. }
  143. // Multiply an fp12e by a line function value, store result in rop:
  144. // The line function is given by 3 fp2e elements op2, op3, op4 as
  145. // line = (op2*tau + op3)*z + op4 = a2*z + b2.
  146. void fp12e_mul_line(fp12e_t rop, const fp12e_t op1, const fp2e_t op2, const fp2e_t op3, const fp2e_t op4)
  147. {
  148. #ifdef BENCH
  149. nummultp12 ++;
  150. multp12cycles -= cpucycles();
  151. #endif
  152. fp2e_t fp2_0, tmp;
  153. fp6e_t tmp1, tmp2, tmp3; // Needed to store intermediary results
  154. fp2e_setzero(fp2_0); // fp2_0 = 0
  155. fp6e_set_fp2e(tmp1, fp2_0, op2, op3); // tmp1 = a2 = op2*tau + op3
  156. fp6e_mul_shortfp6e(tmp1, op1->m_a, tmp1); // tmp1 = a1*a2
  157. fp6e_mul_fp2e(tmp3, op1->m_b, op4); // tmp3 = b1*op4 = b1*b2
  158. fp2e_add(tmp, op3, op4);
  159. fp2e_short_coeffred(tmp);
  160. fp6e_set_fp2e(tmp2, fp2_0, op2, tmp); // tmp2 = a2 + b2
  161. fp6e_add(rop->m_a, op1->m_a, op1->m_b); // a3 = a1 + b1
  162. fp6e_short_coeffred(rop->m_a);
  163. fp6e_set(rop->m_b, tmp3); // b3 = b1*b2
  164. fp6e_mul_shortfp6e(rop->m_a, rop->m_a, tmp2);// a3 = (a1+b1)*(a2+b2)
  165. fp6e_sub(rop->m_a, rop->m_a, tmp1);
  166. fp6e_sub(rop->m_a, rop->m_a, rop->m_b); // a3 = a1*b2 + a2*b1
  167. fp6e_short_coeffred(rop->m_a);
  168. fp6e_multau(tmp1, tmp1); // tmp1 = a1*a2*tau
  169. fp6e_add(rop->m_b, rop->m_b, tmp1); // b3 = b1*b2 + a1*a2*tau
  170. fp6e_short_coeffred(rop->m_b);
  171. #ifdef BENCH
  172. multp12cycles += cpucycles();
  173. #endif
  174. }
  175. void fp12e_pow_vartime(fp12e_t rop, const fp12e_t op, const scalar_t exp)
  176. {
  177. fp12e_t dummy;
  178. unsigned int startbit;
  179. startbit = scalar_scanb(exp);
  180. fp12e_set(dummy, op);
  181. fp12e_set(rop,op);
  182. int i;
  183. for(i = startbit; i > 0; i--)
  184. {
  185. fp12e_square(rop, rop);
  186. if(scalar_getbit(exp, i - 1))
  187. fp12e_mul(rop, rop, dummy);
  188. }
  189. }
  190. // Implicit fp4 squaring for Granger/Scott special squaring in final expo
  191. // fp4e_square takes two fp2e op1, op2 representing the fp4 element
  192. // op1*z^3 + op2, writes the square to rop1, rop2 representing rop1*z^3 + rop2.
  193. // (op1*z^3 + op2)^2 = (2*op1*op2)*z^3 + (op1^2*xi + op2^2).
  194. void fp4e_square(fp2e_t rop1, fp2e_t rop2, const fp2e_t op1, const fp2e_t op2)
  195. {
  196. fp2e_t t1, t2;
  197. fp2e_square(t1, op1); // t1 = op1^2
  198. fp2e_square(t2, op2); // t2 = op2^2
  199. //fp2e_mul(rop1, op1, op2); // rop1 = op1*op2
  200. //fp2e_add(rop1, rop1, rop1); // rop1 = 2*op1*op2
  201. fp2e_add(rop1, op1, op2);
  202. fp2e_short_coeffred(rop1);
  203. fp2e_square(rop1, rop1);
  204. fp2e_sub2(rop1, t1);
  205. fp2e_sub2(rop1, t2); // rop1 = 2*op1*op2
  206. fp2e_mulxi(rop2, t1); // rop2 = op1^2*xi
  207. fp2e_add2(rop2, t2); // rop2 = op1^2*xi + op2^2
  208. }
  209. // Special squaring for use on elements in T_6(fp2) (after the
  210. // easy part of the final exponentiation. Used in the hard part
  211. // of the final exponentiation. Function uses formulas in
  212. // Granger/Scott (PKC2010).
  213. void fp12e_special_square_finexp(fp12e_t rop, const fp12e_t op)
  214. {
  215. fp2e_t f00, f01, f02, f10, f11, f12;
  216. fp2e_t t00, t01, t02, t10, t11, t12, t;
  217. fp6e_t f0, f1;
  218. fp4e_square(t11, t00, op->m_a->m_b, op->m_b->m_c);
  219. fp4e_square(t12, t01, op->m_b->m_a, op->m_a->m_c);
  220. fp4e_square(t02, t10, op->m_a->m_a, op->m_b->m_b);
  221. fp2e_mulxi(t, t02);
  222. fp2e_set(t02, t10);
  223. fp2e_set(t10, t);
  224. fp2e_mul_scalar(f00, op->m_b->m_c, -2);
  225. fp2e_mul_scalar(f01, op->m_b->m_b, -2);
  226. fp2e_mul_scalar(f02, op->m_b->m_a, -2);
  227. fp2e_double(f10, op->m_a->m_c);
  228. fp2e_double(f11, op->m_a->m_b);
  229. fp2e_double(f12, op->m_a->m_a);
  230. fp2e_triple2(t00);
  231. fp2e_triple2(t01);
  232. fp2e_triple2(t02);
  233. fp2e_triple2(t10);
  234. fp2e_triple2(t11);
  235. fp2e_triple2(t12);
  236. fp2e_add2(f00, t00);
  237. fp2e_add2(f01, t01);
  238. fp2e_add2(f02, t02);
  239. fp2e_add2(f10, t10);
  240. fp2e_add2(f11, t11);
  241. fp2e_add2(f12, t12);
  242. fp6e_set_fp2e(f0, f02, f01, f00);
  243. fp6e_short_coeffred(f0);
  244. fp6e_set_fp2e(f1, f12, f11, f10);
  245. fp6e_short_coeffred(f1);
  246. fp12e_set_fp6e(rop,f1,f0);
  247. }
  248. void fp12e_invert(fp12e_t rop, const fp12e_t op)
  249. {
  250. #ifdef BENCH
  251. numinvp12 ++;
  252. invp12cycles -= cpucycles();
  253. #endif
  254. fp6e_t tmp1, tmp2; // Needed to store intermediary results
  255. fp6e_squaredouble(tmp1, op->m_a);
  256. fp6e_squaredouble(tmp2, op->m_b);
  257. fp6e_multau(tmp1, tmp1);
  258. fp6e_sub(tmp1, tmp2, tmp1);
  259. fp6e_short_coeffred(tmp1);
  260. fp6e_invert(tmp1, tmp1);
  261. fp6e_add(tmp1,tmp1,tmp1);
  262. fp6e_short_coeffred(tmp1);
  263. fp12e_set(rop, op);
  264. fp6e_neg(rop->m_a, rop->m_a);
  265. fp12e_mul_fp6e(rop, rop, tmp1);
  266. #ifdef BENCH
  267. invp12cycles += cpucycles();
  268. #endif
  269. }
  270. void fp12e_frobenius_p(fp12e_t rop, const fp12e_t op)
  271. {
  272. fp6e_frobenius_p(rop->m_a, op->m_a);
  273. fp6e_frobenius_p(rop->m_b, op->m_b);
  274. fp6e_mul_fp2e(rop->m_a, rop->m_a, bn_zpminus1);
  275. }
  276. void fp12e_frobenius_p2(fp12e_t rop, const fp12e_t op)
  277. {
  278. fp6e_t t;
  279. fp6e_frobenius_p2(rop->m_a, op->m_a);
  280. fp6e_frobenius_p2(rop->m_b, op->m_b);
  281. fp6e_mul_fpe(t, rop->m_a, bn_zeta);
  282. fp6e_neg(rop->m_a, t);
  283. }
  284. // Print the element to stdout:
  285. void fp12e_print(FILE *outfile, const fp12e_t op)
  286. {
  287. fp6e_print(outfile, op->m_a);
  288. fprintf(outfile, " * Z\n\n + ");
  289. fp6e_print(outfile, op->m_b);
  290. }