mirror of
https://github.com/bitcoin/bitcoin.git
synced 2025-01-13 13:22:38 -03:00
Add overflow analysis to field_10x26_impl.h
This commit is contained in:
Pieter Wuille
parent
a51859871a
commit
f8cce95650
1 changed files with 212 additions and 0 deletions
|
|
@ -245,7 +245,33 @@ SECP256K1_INLINE static void secp256k1_fe_add(secp256k1_fe_t *r, const secp256k1
|
|||
#endif
|
||||
}
|
||||
|
||||
#ifdef VERIFY
|
||||
#define VERIFY_BITS(x, n) VERIFY_CHECK(((x) >> (n)) == 0)
|
||||
#else
|
||||
#define VERIFY_BITS(x, n) do { } while(0)
|
||||
#endif
|
||||
|
||||
SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uint32_t *b, uint32_t *r) {
|
||||
VERIFY_BITS(a[0], 30);
|
||||
VERIFY_BITS(a[1], 30);
|
||||
VERIFY_BITS(a[2], 30);
|
||||
VERIFY_BITS(a[3], 30);
|
||||
VERIFY_BITS(a[4], 30);
|
||||
VERIFY_BITS(a[5], 30);
|
||||
VERIFY_BITS(a[6], 30);
|
||||
VERIFY_BITS(a[7], 30);
|
||||
VERIFY_BITS(a[8], 30);
|
||||
VERIFY_BITS(a[9], 26);
|
||||
VERIFY_BITS(b[0], 30);
|
||||
VERIFY_BITS(b[1], 30);
|
||||
VERIFY_BITS(b[2], 30);
|
||||
VERIFY_BITS(b[3], 30);
|
||||
VERIFY_BITS(b[4], 30);
|
||||
VERIFY_BITS(b[5], 30);
|
||||
VERIFY_BITS(b[6], 30);
|
||||
VERIFY_BITS(b[7], 30);
|
||||
VERIFY_BITS(b[8], 30);
|
||||
VERIFY_BITS(b[9], 26);
|
||||
|
||||
const uint32_t M = 0x3FFFFFFUL, R0 = 0x3D10UL, R1 = 0x400UL;
|
||||
// [... a b c] is a shorthand for ... + a<<52 + b<<26 + c<<0 mod n.
|
||||
|
|
@ -264,11 +290,15 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[7] * b[2]
|
||||
+ (uint64_t)a[8] * b[1]
|
||||
+ (uint64_t)a[9] * b[0];
|
||||
// VERIFY_BITS(d, 64);
|
||||
// [d 0 0 0 0 0 0 0 0 0] = [p9 0 0 0 0 0 0 0 0 0]
|
||||
uint32_t t9 = d & M; d >>= 26;
|
||||
VERIFY_BITS(t9, 26);
|
||||
VERIFY_BITS(d, 38);
|
||||
// [d t9 0 0 0 0 0 0 0 0 0] = [p9 0 0 0 0 0 0 0 0 0]
|
||||
|
||||
c = (uint64_t)a[0] * b[0];
|
||||
VERIFY_BITS(c, 60);
|
||||
// [d t9 0 0 0 0 0 0 0 0 c] = [p9 0 0 0 0 0 0 0 0 p0]
|
||||
d += (uint64_t)a[1] * b[9]
|
||||
+ (uint64_t)a[2] * b[8]
|
||||
|
|
@ -279,15 +309,22 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[7] * b[3]
|
||||
+ (uint64_t)a[8] * b[2]
|
||||
+ (uint64_t)a[9] * b[1];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d t9 0 0 0 0 0 0 0 0 c] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
uint64_t u0 = d & M; d >>= 26; c += u0 * R0;
|
||||
VERIFY_BITS(u0, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
VERIFY_BITS(c, 61);
|
||||
// [d u0 t9 0 0 0 0 0 0 0 0 c-u0*R0] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
uint32_t t0 = c & M; c >>= 26; c += u0 * R1;
|
||||
VERIFY_BITS(t0, 26);
|
||||
VERIFY_BITS(c, 37);
|
||||
// [d u0 t9 0 0 0 0 0 0 0 c-u0*R1 t0-u0*R0] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
// [d 0 t9 0 0 0 0 0 0 0 c t0] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
|
||||
c += (uint64_t)a[0] * b[1]
|
||||
+ (uint64_t)a[1] * b[0];
|
||||
VERIFY_BITS(c, 62);
|
||||
// [d 0 t9 0 0 0 0 0 0 0 c t0] = [p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
d += (uint64_t)a[2] * b[9]
|
||||
+ (uint64_t)a[3] * b[8]
|
||||
|
|
@ -297,16 +334,23 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[7] * b[4]
|
||||
+ (uint64_t)a[8] * b[3]
|
||||
+ (uint64_t)a[9] * b[2];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d 0 t9 0 0 0 0 0 0 0 c t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
uint64_t u1 = d & M; d >>= 26; c += u1 * R0;
|
||||
VERIFY_BITS(u1, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d u1 0 t9 0 0 0 0 0 0 0 c-u1*R0 t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
uint32_t t1 = c & M; c >>= 26; c += u1 * R1;
|
||||
VERIFY_BITS(t1, 26);
|
||||
VERIFY_BITS(c, 38);
|
||||
// [d u1 0 t9 0 0 0 0 0 0 c-u1*R1 t1-u1*R0 t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
// [d 0 0 t9 0 0 0 0 0 0 c t1 t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
|
||||
c += (uint64_t)a[0] * b[2]
|
||||
+ (uint64_t)a[1] * b[1]
|
||||
+ (uint64_t)a[2] * b[0];
|
||||
VERIFY_BITS(c, 62);
|
||||
// [d 0 0 t9 0 0 0 0 0 0 c t1 t0] = [p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
d += (uint64_t)a[3] * b[9]
|
||||
+ (uint64_t)a[4] * b[8]
|
||||
|
|
@ -315,10 +359,16 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[7] * b[5]
|
||||
+ (uint64_t)a[8] * b[4]
|
||||
+ (uint64_t)a[9] * b[3];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d 0 0 t9 0 0 0 0 0 0 c t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
uint64_t u2 = d & M; d >>= 26; c += u2 * R0;
|
||||
VERIFY_BITS(u2, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d u2 0 0 t9 0 0 0 0 0 0 c-u2*R0 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
uint32_t t2 = c & M; c >>= 26; c += u2 * R1;
|
||||
VERIFY_BITS(t2, 26);
|
||||
VERIFY_BITS(c, 38);
|
||||
// [d u2 0 0 t9 0 0 0 0 0 c-u2*R1 t2-u2*R0 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
// [d 0 0 0 t9 0 0 0 0 0 c t2 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
|
||||
|
|
@ -326,6 +376,7 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[1] * b[2]
|
||||
+ (uint64_t)a[2] * b[1]
|
||||
+ (uint64_t)a[3] * b[0];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 t9 0 0 0 0 0 c t2 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
d += (uint64_t)a[4] * b[9]
|
||||
+ (uint64_t)a[5] * b[8]
|
||||
|
|
@ -333,10 +384,16 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[7] * b[6]
|
||||
+ (uint64_t)a[8] * b[5]
|
||||
+ (uint64_t)a[9] * b[4];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d 0 0 0 t9 0 0 0 0 0 c t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
uint64_t u3 = d & M; d >>= 26; c += u3 * R0;
|
||||
VERIFY_BITS(u3, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u3 0 0 0 t9 0 0 0 0 0 c-u3*R0 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
uint32_t t3 = c & M; c >>= 26; c += u3 * R1;
|
||||
VERIFY_BITS(t3, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u3 0 0 0 t9 0 0 0 0 c-u3*R1 t3-u3*R0 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 t9 0 0 0 0 c t3 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -345,16 +402,23 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[2] * b[2]
|
||||
+ (uint64_t)a[3] * b[1]
|
||||
+ (uint64_t)a[4] * b[0];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 0 t9 0 0 0 0 c t3 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)a[5] * b[9]
|
||||
+ (uint64_t)a[6] * b[8]
|
||||
+ (uint64_t)a[7] * b[7]
|
||||
+ (uint64_t)a[8] * b[6]
|
||||
+ (uint64_t)a[9] * b[5];
|
||||
VERIFY_BITS(d, 62);
|
||||
// [d 0 0 0 0 t9 0 0 0 0 c t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
uint64_t u4 = d & M; d >>= 26; c += u4 * R0;
|
||||
VERIFY_BITS(u4, 26);
|
||||
VERIFY_BITS(d, 36);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u4 0 0 0 0 t9 0 0 0 0 c-u4*R0 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
uint32_t t4 = c & M; c >>= 26; c += u4 * R1;
|
||||
VERIFY_BITS(t4, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u4 0 0 0 0 t9 0 0 0 c-u4*R1 t4-u4*R0 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 t9 0 0 0 c t4 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -364,15 +428,22 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[3] * b[2]
|
||||
+ (uint64_t)a[4] * b[1]
|
||||
+ (uint64_t)a[5] * b[0];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 0 0 t9 0 0 0 c t4 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)a[6] * b[9]
|
||||
+ (uint64_t)a[7] * b[8]
|
||||
+ (uint64_t)a[8] * b[7]
|
||||
+ (uint64_t)a[9] * b[6];
|
||||
VERIFY_BITS(d, 62);
|
||||
// [d 0 0 0 0 0 t9 0 0 0 c t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u5 = d & M; d >>= 26; c += u5 * R0;
|
||||
VERIFY_BITS(u5, 26);
|
||||
VERIFY_BITS(d, 36);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u5 0 0 0 0 0 t9 0 0 0 c-u5*R0 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
uint32_t t5 = c & M; c >>= 26; c += u5 * R1;
|
||||
VERIFY_BITS(t5, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u5 0 0 0 0 0 t9 0 0 c-u5*R1 t5-u5*R0 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 t9 0 0 c t5 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -383,14 +454,21 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[4] * b[2]
|
||||
+ (uint64_t)a[5] * b[1]
|
||||
+ (uint64_t)a[6] * b[0];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 0 0 0 t9 0 0 c t5 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)a[7] * b[9]
|
||||
+ (uint64_t)a[8] * b[8]
|
||||
+ (uint64_t)a[9] * b[7];
|
||||
VERIFY_BITS(d, 61);
|
||||
// [d 0 0 0 0 0 0 t9 0 0 c t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u6 = d & M; d >>= 26; c += u6 * R0;
|
||||
VERIFY_BITS(u6, 26);
|
||||
VERIFY_BITS(d, 35);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u6 0 0 0 0 0 0 t9 0 0 c-u6*R0 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint32_t t6 = c & M; c >>= 26; c += u6 * R1;
|
||||
VERIFY_BITS(t6, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u6 0 0 0 0 0 0 t9 0 c-u6*R1 t6-u6*R0 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 t9 0 c t6 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -402,13 +480,22 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[5] * b[2]
|
||||
+ (uint64_t)a[6] * b[1]
|
||||
+ (uint64_t)a[7] * b[0];
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x8000007C00000007ULL);
|
||||
// [d 0 0 0 0 0 0 0 t9 0 c t6 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)a[8] * b[9]
|
||||
+ (uint64_t)a[9] * b[8];
|
||||
VERIFY_BITS(d, 58);
|
||||
// [d 0 0 0 0 0 0 0 t9 0 c t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u7 = d & M; d >>= 26; c += u7 * R0;
|
||||
VERIFY_BITS(u7, 26);
|
||||
VERIFY_BITS(d, 32);
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x800001703FFFC2F7ULL);
|
||||
// [d u7 0 0 0 0 0 0 0 t9 0 c-u7*R0 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint32_t t7 = c & M; c >>= 26; c += u7 * R1;
|
||||
VERIFY_BITS(t7, 26);
|
||||
VERIFY_BITS(c, 38);
|
||||
// [d u7 0 0 0 0 0 0 0 t9 c-u7*R1 t7-u7*R0 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 0 t9 c t7 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -421,49 +508,86 @@ SECP256K1_INLINE static void secp256k1_fe_mul_inner(const uint32_t *a, const uin
|
|||
+ (uint64_t)a[6] * b[2]
|
||||
+ (uint64_t)a[7] * b[1]
|
||||
+ (uint64_t)a[8] * b[0];
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x9000007B80000008ULL);
|
||||
// [d 0 0 0 0 0 0 0 0 t9 c t7 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)a[9] * b[9];
|
||||
VERIFY_BITS(d, 57);
|
||||
// [d 0 0 0 0 0 0 0 0 t9 c t7 t6 t5 t4 t3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u8 = d & M; d >>= 26; c += u8 * R0;
|
||||
VERIFY_BITS(u8, 26);
|
||||
VERIFY_BITS(d, 31);
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x9000016FBFFFC2F8ULL);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 t5 t4 t3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
r[3] = t3;
|
||||
VERIFY_BITS(r[3], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 t5 t4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[4] = t4;
|
||||
VERIFY_BITS(r[4], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 t5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[5] = t5;
|
||||
VERIFY_BITS(r[5], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[6] = t6;
|
||||
VERIFY_BITS(r[6], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[7] = t7;
|
||||
VERIFY_BITS(r[7], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
r[8] = c & M; c >>= 26; c += u8 * R1;
|
||||
VERIFY_BITS(r[8], 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9+c-u8*R1 r8-u8*R0 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 0 0 t9+c r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
c += d * R0 + t9;
|
||||
VERIFY_BITS(c, 45);
|
||||
// [d 0 0 0 0 0 0 0 0 0 c-d*R0 r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[9] = c & (M >> 4); c >>= 22; c += d * (R1 << 4);
|
||||
VERIFY_BITS(r[9], 22);
|
||||
VERIFY_BITS(c, 46);
|
||||
// [d 0 0 0 0 0 0 0 0 r9+((c-d*R1<<4)<<22)-d*R0 r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 -d*R1 r9+(c<<22)-d*R0 r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
d = c * (R0 >> 4) + t0;
|
||||
VERIFY_BITS(d, 56);
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 t1 d-c*R0>>4] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[0] = d & M; d >>= 26;
|
||||
VERIFY_BITS(r[0], 26);
|
||||
VERIFY_BITS(d, 30);
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 t1+d r0-c*R0>>4] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += c * (R1 >> 4) + t1;
|
||||
VERIFY_BITS(d, 53);
|
||||
VERIFY_CHECK(d <= 0x10000003FFFFBFULL);
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 d-c*R1>>4 r0-c*R0>>4] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [r9 r8 r7 r6 r5 r4 r3 t2 d r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[1] = d & M; d >>= 26;
|
||||
VERIFY_BITS(r[1], 26);
|
||||
VERIFY_BITS(d, 27);
|
||||
VERIFY_CHECK(d <= 0x4000000ULL);
|
||||
// [r9 r8 r7 r6 r5 r4 r3 t2+d r1 r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += t2;
|
||||
VERIFY_BITS(d, 27);
|
||||
// [r9 r8 r7 r6 r5 r4 r3 d r1 r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[2] = d;
|
||||
VERIFY_BITS(r[2], 27);
|
||||
// [r9 r8 r7 r6 r5 r4 r3 r2 r1 r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
}
|
||||
|
||||
SECP256K1_INLINE static void secp256k1_fe_sqr_inner(const uint32_t *a, uint32_t *r) {
|
||||
VERIFY_BITS(a[0], 30);
|
||||
VERIFY_BITS(a[1], 30);
|
||||
VERIFY_BITS(a[2], 30);
|
||||
VERIFY_BITS(a[3], 30);
|
||||
VERIFY_BITS(a[4], 30);
|
||||
VERIFY_BITS(a[5], 30);
|
||||
VERIFY_BITS(a[6], 30);
|
||||
VERIFY_BITS(a[7], 30);
|
||||
VERIFY_BITS(a[8], 30);
|
||||
VERIFY_BITS(a[9], 26);
|
||||
|
||||
const uint32_t M = 0x3FFFFFFUL, R0 = 0x3D10UL, R1 = 0x400UL;
|
||||
// [... a b c] is a shorthand for ... + a<<52 + b<<26 + c<<0 mod n.
|
||||
|
|
@ -477,88 +601,133 @@ SECP256K1_INLINE static void secp256k1_fe_sqr_inner(const uint32_t *a, uint32_t
|
|||
+ (uint64_t)(a[2]*2) * a[7]
|
||||
+ (uint64_t)(a[3]*2) * a[6]
|
||||
+ (uint64_t)(a[4]*2) * a[5];
|
||||
// VERIFY_BITS(d, 64);
|
||||
// [d 0 0 0 0 0 0 0 0 0] = [p9 0 0 0 0 0 0 0 0 0]
|
||||
uint32_t t9 = d & M; d >>= 26;
|
||||
VERIFY_BITS(t9, 26);
|
||||
VERIFY_BITS(d, 38);
|
||||
// [d t9 0 0 0 0 0 0 0 0 0] = [p9 0 0 0 0 0 0 0 0 0]
|
||||
|
||||
c = (uint64_t)a[0] * a[0];
|
||||
VERIFY_BITS(c, 60);
|
||||
// [d t9 0 0 0 0 0 0 0 0 c] = [p9 0 0 0 0 0 0 0 0 p0]
|
||||
d += (uint64_t)(a[1]*2) * a[9]
|
||||
+ (uint64_t)(a[2]*2) * a[8]
|
||||
+ (uint64_t)(a[3]*2) * a[7]
|
||||
+ (uint64_t)(a[4]*2) * a[6]
|
||||
+ (uint64_t)a[5] * a[5];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d t9 0 0 0 0 0 0 0 0 c] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
uint64_t u0 = d & M; d >>= 26; c += u0 * R0;
|
||||
VERIFY_BITS(u0, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
VERIFY_BITS(c, 61);
|
||||
// [d u0 t9 0 0 0 0 0 0 0 0 c-u0*R0] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
uint32_t t0 = c & M; c >>= 26; c += u0 * R1;
|
||||
VERIFY_BITS(t0, 26);
|
||||
VERIFY_BITS(c, 37);
|
||||
// [d u0 t9 0 0 0 0 0 0 0 c-u0*R1 t0-u0*R0] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
// [d 0 t9 0 0 0 0 0 0 0 c t0] = [p10 p9 0 0 0 0 0 0 0 0 p0]
|
||||
|
||||
c += (uint64_t)(a[0]*2) * a[1];
|
||||
VERIFY_BITS(c, 62);
|
||||
// [d 0 t9 0 0 0 0 0 0 0 c t0] = [p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
d += (uint64_t)(a[2]*2) * a[9]
|
||||
+ (uint64_t)(a[3]*2) * a[8]
|
||||
+ (uint64_t)(a[4]*2) * a[7]
|
||||
+ (uint64_t)(a[5]*2) * a[6];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d 0 t9 0 0 0 0 0 0 0 c t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
uint64_t u1 = d & M; d >>= 26; c += u1 * R0;
|
||||
VERIFY_BITS(u1, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d u1 0 t9 0 0 0 0 0 0 0 c-u1*R0 t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
uint32_t t1 = c & M; c >>= 26; c += u1 * R1;
|
||||
VERIFY_BITS(t1, 26);
|
||||
VERIFY_BITS(c, 38);
|
||||
// [d u1 0 t9 0 0 0 0 0 0 c-u1*R1 t1-u1*R0 t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
// [d 0 0 t9 0 0 0 0 0 0 c t1 t0] = [p11 p10 p9 0 0 0 0 0 0 0 p1 p0]
|
||||
|
||||
c += (uint64_t)(a[0]*2) * a[2]
|
||||
+ (uint64_t)a[1] * a[1];
|
||||
VERIFY_BITS(c, 62);
|
||||
// [d 0 0 t9 0 0 0 0 0 0 c t1 t0] = [p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
d += (uint64_t)(a[3]*2) * a[9]
|
||||
+ (uint64_t)(a[4]*2) * a[8]
|
||||
+ (uint64_t)(a[5]*2) * a[7]
|
||||
+ (uint64_t)a[6] * a[6];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d 0 0 t9 0 0 0 0 0 0 c t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
uint64_t u2 = d & M; d >>= 26; c += u2 * R0;
|
||||
VERIFY_BITS(u2, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d u2 0 0 t9 0 0 0 0 0 0 c-u2*R0 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
uint32_t t2 = c & M; c >>= 26; c += u2 * R1;
|
||||
VERIFY_BITS(t2, 26);
|
||||
VERIFY_BITS(c, 38);
|
||||
// [d u2 0 0 t9 0 0 0 0 0 c-u2*R1 t2-u2*R0 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
// [d 0 0 0 t9 0 0 0 0 0 c t2 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 0 p2 p1 p0]
|
||||
|
||||
c += (uint64_t)(a[0]*2) * a[3]
|
||||
+ (uint64_t)(a[1]*2) * a[2];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 t9 0 0 0 0 0 c t2 t1 t0] = [p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
d += (uint64_t)(a[4]*2) * a[9]
|
||||
+ (uint64_t)(a[5]*2) * a[8]
|
||||
+ (uint64_t)(a[6]*2) * a[7];
|
||||
VERIFY_BITS(d, 63);
|
||||
// [d 0 0 0 t9 0 0 0 0 0 c t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
uint64_t u3 = d & M; d >>= 26; c += u3 * R0;
|
||||
VERIFY_BITS(u3, 26);
|
||||
VERIFY_BITS(d, 37);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u3 0 0 0 t9 0 0 0 0 0 c-u3*R0 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
uint32_t t3 = c & M; c >>= 26; c += u3 * R1;
|
||||
VERIFY_BITS(t3, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u3 0 0 0 t9 0 0 0 0 c-u3*R1 t3-u3*R0 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 t9 0 0 0 0 c t3 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 0 p3 p2 p1 p0]
|
||||
|
||||
c += (uint64_t)(a[0]*2) * a[4]
|
||||
+ (uint64_t)(a[1]*2) * a[3]
|
||||
+ (uint64_t)a[2] * a[2];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 0 t9 0 0 0 0 c t3 t2 t1 t0] = [p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)(a[5]*2) * a[9]
|
||||
+ (uint64_t)(a[6]*2) * a[8]
|
||||
+ (uint64_t)a[7] * a[7];
|
||||
VERIFY_BITS(d, 62);
|
||||
// [d 0 0 0 0 t9 0 0 0 0 c t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
uint64_t u4 = d & M; d >>= 26; c += u4 * R0;
|
||||
VERIFY_BITS(u4, 26);
|
||||
VERIFY_BITS(d, 36);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u4 0 0 0 0 t9 0 0 0 0 c-u4*R0 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
uint32_t t4 = c & M; c >>= 26; c += u4 * R1;
|
||||
VERIFY_BITS(t4, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u4 0 0 0 0 t9 0 0 0 c-u4*R1 t4-u4*R0 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 t9 0 0 0 c t4 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 0 p4 p3 p2 p1 p0]
|
||||
|
||||
c += (uint64_t)(a[0]*2) * a[5]
|
||||
+ (uint64_t)(a[1]*2) * a[4]
|
||||
+ (uint64_t)(a[2]*2) * a[3];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 0 0 t9 0 0 0 c t4 t3 t2 t1 t0] = [p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)(a[6]*2) * a[9]
|
||||
+ (uint64_t)(a[7]*2) * a[8];
|
||||
VERIFY_BITS(d, 62);
|
||||
// [d 0 0 0 0 0 t9 0 0 0 c t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u5 = d & M; d >>= 26; c += u5 * R0;
|
||||
VERIFY_BITS(u5, 26);
|
||||
VERIFY_BITS(d, 36);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u5 0 0 0 0 0 t9 0 0 0 c-u5*R0 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
uint32_t t5 = c & M; c >>= 26; c += u5 * R1;
|
||||
VERIFY_BITS(t5, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u5 0 0 0 0 0 t9 0 0 c-u5*R1 t5-u5*R0 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 t9 0 0 c t5 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 0 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -566,13 +735,20 @@ SECP256K1_INLINE static void secp256k1_fe_sqr_inner(const uint32_t *a, uint32_t
|
|||
+ (uint64_t)(a[1]*2) * a[5]
|
||||
+ (uint64_t)(a[2]*2) * a[4]
|
||||
+ (uint64_t)a[3] * a[3];
|
||||
VERIFY_BITS(c, 63);
|
||||
// [d 0 0 0 0 0 0 t9 0 0 c t5 t4 t3 t2 t1 t0] = [p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)(a[7]*2) * a[9]
|
||||
+ (uint64_t)a[8] * a[8];
|
||||
VERIFY_BITS(d, 61);
|
||||
// [d 0 0 0 0 0 0 t9 0 0 c t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u6 = d & M; d >>= 26; c += u6 * R0;
|
||||
VERIFY_BITS(u6, 26);
|
||||
VERIFY_BITS(d, 35);
|
||||
// VERIFY_BITS(c, 64);
|
||||
// [d u6 0 0 0 0 0 0 t9 0 0 c-u6*R0 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint32_t t6 = c & M; c >>= 26; c += u6 * R1;
|
||||
VERIFY_BITS(t6, 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u6 0 0 0 0 0 0 t9 0 c-u6*R1 t6-u6*R0 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 t9 0 c t6 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 0 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -580,12 +756,21 @@ SECP256K1_INLINE static void secp256k1_fe_sqr_inner(const uint32_t *a, uint32_t
|
|||
+ (uint64_t)(a[1]*2) * a[6]
|
||||
+ (uint64_t)(a[2]*2) * a[5]
|
||||
+ (uint64_t)(a[3]*2) * a[4];
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x8000007C00000007ULL);
|
||||
// [d 0 0 0 0 0 0 0 t9 0 c t6 t5 t4 t3 t2 t1 t0] = [p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)(a[8]*2) * a[9];
|
||||
VERIFY_BITS(d, 58);
|
||||
// [d 0 0 0 0 0 0 0 t9 0 c t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u7 = d & M; d >>= 26; c += u7 * R0;
|
||||
VERIFY_BITS(u7, 26);
|
||||
VERIFY_BITS(d, 32);
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x800001703FFFC2F7ULL);
|
||||
// [d u7 0 0 0 0 0 0 0 t9 0 c-u7*R0 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint32_t t7 = c & M; c >>= 26; c += u7 * R1;
|
||||
VERIFY_BITS(t7, 26);
|
||||
VERIFY_BITS(c, 38);
|
||||
// [d u7 0 0 0 0 0 0 0 t9 c-u7*R1 t7-u7*R0 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 0 t9 c t7 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 0 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
|
|
@ -594,45 +779,72 @@ SECP256K1_INLINE static void secp256k1_fe_sqr_inner(const uint32_t *a, uint32_t
|
|||
+ (uint64_t)(a[2]*2) * a[6]
|
||||
+ (uint64_t)(a[3]*2) * a[5]
|
||||
+ (uint64_t)a[4] * a[4];
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x9000007B80000008ULL);
|
||||
// [d 0 0 0 0 0 0 0 0 t9 c t7 t6 t5 t4 t3 t2 t1 t0] = [p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += (uint64_t)a[9] * a[9];
|
||||
VERIFY_BITS(d, 57);
|
||||
// [d 0 0 0 0 0 0 0 0 t9 c t7 t6 t5 t4 t3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
uint64_t u8 = d & M; d >>= 26; c += u8 * R0;
|
||||
VERIFY_BITS(u8, 26);
|
||||
VERIFY_BITS(d, 31);
|
||||
// VERIFY_BITS(c, 64);
|
||||
VERIFY_CHECK(c <= 0x9000016FBFFFC2F8ULL);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 t5 t4 t3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
r[3] = t3;
|
||||
VERIFY_BITS(r[3], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 t5 t4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[4] = t4;
|
||||
VERIFY_BITS(r[4], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 t5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[5] = t5;
|
||||
VERIFY_BITS(r[5], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 t6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[6] = t6;
|
||||
VERIFY_BITS(r[6], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 t7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[7] = t7;
|
||||
VERIFY_BITS(r[7], 26);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9 c-u8*R0 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
r[8] = c & M; c >>= 26; c += u8 * R1;
|
||||
VERIFY_BITS(r[8], 26);
|
||||
VERIFY_BITS(c, 39);
|
||||
// [d u8 0 0 0 0 0 0 0 0 t9+c-u8*R1 r8-u8*R0 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 0 0 t9+c r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
c += d * R0 + t9;
|
||||
VERIFY_BITS(c, 45);
|
||||
// [d 0 0 0 0 0 0 0 0 0 c-d*R0 r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[9] = c & (M >> 4); c >>= 22; c += d * (R1 << 4);
|
||||
VERIFY_BITS(r[9], 22);
|
||||
VERIFY_BITS(c, 46);
|
||||
// [d 0 0 0 0 0 0 0 0 r9+((c-d*R1<<4)<<22)-d*R0 r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [d 0 0 0 0 0 0 0 -d*R1 r9+(c<<22)-d*R0 r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 t1 t0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
|
||||
d = c * (R0 >> 4) + t0;
|
||||
VERIFY_BITS(d, 56);
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 t1 d-c*R0>>4] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[0] = d & M; d >>= 26;
|
||||
VERIFY_BITS(r[0], 26);
|
||||
VERIFY_BITS(d, 30);
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 t1+d r0-c*R0>>4] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += c * (R1 >> 4) + t1;
|
||||
VERIFY_BITS(d, 53);
|
||||
VERIFY_CHECK(d <= 0x10000003FFFFBFULL);
|
||||
// [r9+(c<<22) r8 r7 r6 r5 r4 r3 t2 d-c*R1>>4 r0-c*R0>>4] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
// [r9 r8 r7 r6 r5 r4 r3 t2 d r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[1] = d & M; d >>= 26;
|
||||
VERIFY_BITS(r[1], 26);
|
||||
VERIFY_BITS(d, 27);
|
||||
VERIFY_CHECK(d <= 0x4000000ULL);
|
||||
// [r9 r8 r7 r6 r5 r4 r3 t2+d r1 r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
d += t2;
|
||||
VERIFY_BITS(d, 27);
|
||||
// [r9 r8 r7 r6 r5 r4 r3 d r1 r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
r[2] = d;
|
||||
VERIFY_BITS(r[2], 27);
|
||||
// [r9 r8 r7 r6 r5 r4 r3 r2 r1 r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0]
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue