7 #ifndef SECP256K1_FIELD_REPR_IMPL_H 8 #define SECP256K1_FIELD_REPR_IMPL_H 15 const uint32_t *d = a->
n;
16 int m = a->normalized ? 1 : 2 * a->magnitude, r = 1;
17 r &= (d[0] <= 0x3FFFFFFUL * m);
18 r &= (d[1] <= 0x3FFFFFFUL * m);
19 r &= (d[2] <= 0x3FFFFFFUL * m);
20 r &= (d[3] <= 0x3FFFFFFUL * m);
21 r &= (d[4] <= 0x3FFFFFFUL * m);
22 r &= (d[5] <= 0x3FFFFFFUL * m);
23 r &= (d[6] <= 0x3FFFFFFUL * m);
24 r &= (d[7] <= 0x3FFFFFFUL * m);
25 r &= (d[8] <= 0x3FFFFFFUL * m);
26 r &= (d[9] <= 0x03FFFFFUL * m);
27 r &= (a->magnitude >= 0);
28 r &= (a->magnitude <= 32);
30 r &= (a->magnitude <= 1);
31 if (r && (d[9] == 0x03FFFFFUL)) {
32 uint32_t mid = d[8] & d[7] & d[6] & d[5] & d[4] & d[3] & d[2];
33 if (mid == 0x3FFFFFFUL) {
34 r &= ((d[1] + 0x40UL + ((d[0] + 0x3D1UL) >> 26)) <= 0x3FFFFFFUL);
43 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
44 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
48 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
51 t0 += x * 0x3D1UL; t1 += (x << 6);
52 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
53 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
54 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL; m = t2;
55 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL; m &= t3;
56 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL; m &= t4;
57 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL; m &= t5;
58 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL; m &= t6;
59 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL; m &= t7;
60 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL; m &= t8;
66 x = (t9 >> 22) | ((t9 == 0x03FFFFFUL) & (m == 0x3FFFFFFUL)
67 & ((t1 + 0x40UL + ((t0 + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
70 t0 += x * 0x3D1UL; t1 += (x << 6);
71 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
72 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
73 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
74 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
75 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
76 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
77 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
78 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
79 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
87 r->
n[0] = t0; r->
n[1] = t1; r->
n[2] = t2; r->
n[3] = t3; r->
n[4] = t4;
88 r->
n[5] = t5; r->
n[6] = t6; r->
n[7] = t7; r->
n[8] = t8; r->
n[9] = t9;
93 secp256k1_fe_verify(r);
98 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
99 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
102 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
105 t0 += x * 0x3D1UL; t1 += (x << 6);
106 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
107 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
108 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
109 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
110 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
111 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
112 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
113 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
114 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
119 r->
n[0] = t0; r->
n[1] = t1; r->
n[2] = t2; r->
n[3] = t3; r->
n[4] = t4;
120 r->
n[5] = t5; r->
n[6] = t6; r->
n[7] = t7; r->
n[8] = t8; r->
n[9] = t9;
124 secp256k1_fe_verify(r);
129 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
130 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
134 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
137 t0 += x * 0x3D1UL; t1 += (x << 6);
138 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
139 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
140 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL; m = t2;
141 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL; m &= t3;
142 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL; m &= t4;
143 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL; m &= t5;
144 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL; m &= t6;
145 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL; m &= t7;
146 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL; m &= t8;
152 x = (t9 >> 22) | ((t9 == 0x03FFFFFUL) & (m == 0x3FFFFFFUL)
153 & ((t1 + 0x40UL + ((t0 + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
156 t0 += 0x3D1UL; t1 += (x << 6);
157 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
158 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
159 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
160 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
161 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
162 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
163 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
164 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
165 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
174 r->
n[0] = t0; r->
n[1] = t1; r->
n[2] = t2; r->
n[3] = t3; r->
n[4] = t4;
175 r->
n[5] = t5; r->
n[6] = t6; r->
n[7] = t7; r->
n[8] = t8; r->
n[9] = t9;
180 secp256k1_fe_verify(r);
185 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
186 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
192 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
195 t0 += x * 0x3D1UL; t1 += (x << 6);
196 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL; z0 = t0; z1 = t0 ^ 0x3D0UL;
197 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL; z0 |= t1; z1 &= t1 ^ 0x40UL;
198 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL; z0 |= t2; z1 &= t2;
199 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL; z0 |= t3; z1 &= t3;
200 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL; z0 |= t4; z1 &= t4;
201 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL; z0 |= t5; z1 &= t5;
202 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL; z0 |= t6; z1 &= t6;
203 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL; z0 |= t7; z1 &= t7;
204 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL; z0 |= t8; z1 &= t8;
205 z0 |= t9; z1 &= t9 ^ 0x3C00000UL;
210 return (z0 == 0) | (z1 == 0x3FFFFFFUL);
214 uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
228 z0 = t0 & 0x3FFFFFFUL;
232 if ((z0 != 0UL) & (z1 != 0x3FFFFFFUL)) {
249 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL; z0 |= t1; z1 &= t1 ^ 0x40UL;
250 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL; z0 |= t2; z1 &= t2;
251 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL; z0 |= t3; z1 &= t3;
252 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL; z0 |= t4; z1 &= t4;
253 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL; z0 |= t5; z1 &= t5;
254 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL; z0 |= t6; z1 &= t6;
255 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL; z0 |= t7; z1 &= t7;
256 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL; z0 |= t8; z1 &= t8;
257 z0 |= t9; z1 &= t9 ^ 0x3C00000UL;
262 return (z0 == 0) | (z1 == 0x3FFFFFFUL);
267 r->
n[1] = r->
n[2] = r->
n[3] = r->
n[4] = r->
n[5] = r->
n[6] = r->
n[7] = r->
n[8] = r->
n[9] = 0;
271 secp256k1_fe_verify(r);
276 const uint32_t *t = a->
n;
279 secp256k1_fe_verify(a);
281 return (t[0] | t[1] | t[2] | t[3] | t[4] | t[5] | t[6] | t[7] | t[8] | t[9]) == 0;
287 secp256k1_fe_verify(a);
298 for (i=0; i<10; i++) {
308 secp256k1_fe_verify(a);
309 secp256k1_fe_verify(b);
311 for (i = 9; i >= 0; i--) {
312 if (a->
n[i] > b->
n[i]) {
315 if (a->
n[i] < b->
n[i]) {
324 r->
n[0] = (uint32_t)a[31] | ((uint32_t)a[30] << 8) | ((uint32_t)a[29] << 16) | ((uint32_t)(a[28] & 0x3) << 24);
325 r->
n[1] = (uint32_t)((a[28] >> 2) & 0x3f) | ((uint32_t)a[27] << 6) | ((uint32_t)a[26] << 14) | ((uint32_t)(a[25] & 0xf) << 22);
326 r->
n[2] = (uint32_t)((a[25] >> 4) & 0xf) | ((uint32_t)a[24] << 4) | ((uint32_t)a[23] << 12) | ((uint32_t)(a[22] & 0x3f) << 20);
327 r->
n[3] = (uint32_t)((a[22] >> 6) & 0x3) | ((uint32_t)a[21] << 2) | ((uint32_t)a[20] << 10) | ((uint32_t)a[19] << 18);
328 r->
n[4] = (uint32_t)a[18] | ((uint32_t)a[17] << 8) | ((uint32_t)a[16] << 16) | ((uint32_t)(a[15] & 0x3) << 24);
329 r->
n[5] = (uint32_t)((a[15] >> 2) & 0x3f) | ((uint32_t)a[14] << 6) | ((uint32_t)a[13] << 14) | ((uint32_t)(a[12] & 0xf) << 22);
330 r->
n[6] = (uint32_t)((a[12] >> 4) & 0xf) | ((uint32_t)a[11] << 4) | ((uint32_t)a[10] << 12) | ((uint32_t)(a[9] & 0x3f) << 20);
331 r->
n[7] = (uint32_t)((a[9] >> 6) & 0x3) | ((uint32_t)a[8] << 2) | ((uint32_t)a[7] << 10) | ((uint32_t)a[6] << 18);
332 r->
n[8] = (uint32_t)a[5] | ((uint32_t)a[4] << 8) | ((uint32_t)a[3] << 16) | ((uint32_t)(a[2] & 0x3) << 24);
333 r->
n[9] = (uint32_t)((a[2] >> 2) & 0x3f) | ((uint32_t)a[1] << 6) | ((uint32_t)a[0] << 14);
335 ret = !((r->
n[9] == 0x3FFFFFUL) & ((r->
n[8] & r->
n[7] & r->
n[6] & r->
n[5] & r->
n[4] & r->
n[3] & r->
n[2]) == 0x3FFFFFFUL) & ((r->
n[1] + 0x40UL + ((r->
n[0] + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
340 secp256k1_fe_verify(r);
352 secp256k1_fe_verify(a);
354 r[0] = (a->
n[9] >> 14) & 0xff;
355 r[1] = (a->
n[9] >> 6) & 0xff;
356 r[2] = ((a->
n[9] & 0x3F) << 2) | ((a->
n[8] >> 24) & 0x3);
357 r[3] = (a->
n[8] >> 16) & 0xff;
358 r[4] = (a->
n[8] >> 8) & 0xff;
359 r[5] = a->
n[8] & 0xff;
360 r[6] = (a->
n[7] >> 18) & 0xff;
361 r[7] = (a->
n[7] >> 10) & 0xff;
362 r[8] = (a->
n[7] >> 2) & 0xff;
363 r[9] = ((a->
n[7] & 0x3) << 6) | ((a->
n[6] >> 20) & 0x3f);
364 r[10] = (a->
n[6] >> 12) & 0xff;
365 r[11] = (a->
n[6] >> 4) & 0xff;
366 r[12] = ((a->
n[6] & 0xf) << 4) | ((a->
n[5] >> 22) & 0xf);
367 r[13] = (a->
n[5] >> 14) & 0xff;
368 r[14] = (a->
n[5] >> 6) & 0xff;
369 r[15] = ((a->
n[5] & 0x3f) << 2) | ((a->
n[4] >> 24) & 0x3);
370 r[16] = (a->
n[4] >> 16) & 0xff;
371 r[17] = (a->
n[4] >> 8) & 0xff;
372 r[18] = a->
n[4] & 0xff;
373 r[19] = (a->
n[3] >> 18) & 0xff;
374 r[20] = (a->
n[3] >> 10) & 0xff;
375 r[21] = (a->
n[3] >> 2) & 0xff;
376 r[22] = ((a->
n[3] & 0x3) << 6) | ((a->
n[2] >> 20) & 0x3f);
377 r[23] = (a->
n[2] >> 12) & 0xff;
378 r[24] = (a->
n[2] >> 4) & 0xff;
379 r[25] = ((a->
n[2] & 0xf) << 4) | ((a->
n[1] >> 22) & 0xf);
380 r[26] = (a->
n[1] >> 14) & 0xff;
381 r[27] = (a->
n[1] >> 6) & 0xff;
382 r[28] = ((a->
n[1] & 0x3f) << 2) | ((a->
n[0] >> 24) & 0x3);
383 r[29] = (a->
n[0] >> 16) & 0xff;
384 r[30] = (a->
n[0] >> 8) & 0xff;
385 r[31] = a->
n[0] & 0xff;
391 secp256k1_fe_verify(a);
393 r->
n[0] = 0x3FFFC2FUL * 2 * (m + 1) - a->
n[0];
394 r->
n[1] = 0x3FFFFBFUL * 2 * (m + 1) - a->
n[1];
395 r->
n[2] = 0x3FFFFFFUL * 2 * (m + 1) - a->
n[2];
396 r->
n[3] = 0x3FFFFFFUL * 2 * (m + 1) - a->
n[3];
397 r->
n[4] = 0x3FFFFFFUL * 2 * (m + 1) - a->
n[4];
398 r->
n[5] = 0x3FFFFFFUL * 2 * (m + 1) - a->
n[5];
399 r->
n[6] = 0x3FFFFFFUL * 2 * (m + 1) - a->
n[6];
400 r->
n[7] = 0x3FFFFFFUL * 2 * (m + 1) - a->
n[7];
401 r->
n[8] = 0x3FFFFFFUL * 2 * (m + 1) - a->
n[8];
402 r->
n[9] = 0x03FFFFFUL * 2 * (m + 1) - a->
n[9];
404 r->magnitude = m + 1;
406 secp256k1_fe_verify(r);
424 secp256k1_fe_verify(r);
430 secp256k1_fe_verify(a);
443 r->magnitude += a->magnitude;
445 secp256k1_fe_verify(r);
449 #if defined(USE_EXTERNAL_ASM) 458 #define VERIFY_BITS(x, n) VERIFY_CHECK(((x) >> (n)) == 0) 460 #define VERIFY_BITS(x, n) do { } while(0) 465 uint64_t u0, u1, u2, u3, u4, u5, u6, u7, u8;
466 uint32_t t9, t1, t0, t2, t3, t4, t5, t6, t7;
467 const uint32_t M = 0x3FFFFFFUL, R0 = 0x3D10UL, R1 = 0x400UL;
496 d = (uint64_t)a[0] * b[9]
497 + (uint64_t)a[1] * b[8]
498 + (uint64_t)a[2] * b[7]
499 + (uint64_t)a[3] * b[6]
500 + (uint64_t)a[4] * b[5]
501 + (uint64_t)a[5] * b[4]
502 + (uint64_t)a[6] * b[3]
503 + (uint64_t)a[7] * b[2]
504 + (uint64_t)a[8] * b[1]
505 + (uint64_t)a[9] * b[0];
508 t9 = d & M; d >>= 26;
513 c = (uint64_t)a[0] * b[0];
516 d += (uint64_t)a[1] * b[9]
517 + (uint64_t)a[2] * b[8]
518 + (uint64_t)a[3] * b[7]
519 + (uint64_t)a[4] * b[6]
520 + (uint64_t)a[5] * b[5]
521 + (uint64_t)a[6] * b[4]
522 + (uint64_t)a[7] * b[3]
523 + (uint64_t)a[8] * b[2]
524 + (uint64_t)a[9] * b[1];
527 u0 = d & M; d >>= 26; c += u0 * R0;
532 t0 = c & M; c >>= 26; c += u0 * R1;
538 c += (uint64_t)a[0] * b[1]
539 + (uint64_t)a[1] * b[0];
542 d += (uint64_t)a[2] * b[9]
543 + (uint64_t)a[3] * b[8]
544 + (uint64_t)a[4] * b[7]
545 + (uint64_t)a[5] * b[6]
546 + (uint64_t)a[6] * b[5]
547 + (uint64_t)a[7] * b[4]
548 + (uint64_t)a[8] * b[3]
549 + (uint64_t)a[9] * b[2];
552 u1 = d & M; d >>= 26; c += u1 * R0;
557 t1 = c & M; c >>= 26; c += u1 * R1;
563 c += (uint64_t)a[0] * b[2]
564 + (uint64_t)a[1] * b[1]
565 + (uint64_t)a[2] * b[0];
568 d += (uint64_t)a[3] * b[9]
569 + (uint64_t)a[4] * b[8]
570 + (uint64_t)a[5] * b[7]
571 + (uint64_t)a[6] * b[6]
572 + (uint64_t)a[7] * b[5]
573 + (uint64_t)a[8] * b[4]
574 + (uint64_t)a[9] * b[3];
577 u2 = d & M; d >>= 26; c += u2 * R0;
582 t2 = c & M; c >>= 26; c += u2 * R1;
588 c += (uint64_t)a[0] * b[3]
589 + (uint64_t)a[1] * b[2]
590 + (uint64_t)a[2] * b[1]
591 + (uint64_t)a[3] * b[0];
594 d += (uint64_t)a[4] * b[9]
595 + (uint64_t)a[5] * b[8]
596 + (uint64_t)a[6] * b[7]
597 + (uint64_t)a[7] * b[6]
598 + (uint64_t)a[8] * b[5]
599 + (uint64_t)a[9] * b[4];
602 u3 = d & M; d >>= 26; c += u3 * R0;
607 t3 = c & M; c >>= 26; c += u3 * R1;
613 c += (uint64_t)a[0] * b[4]
614 + (uint64_t)a[1] * b[3]
615 + (uint64_t)a[2] * b[2]
616 + (uint64_t)a[3] * b[1]
617 + (uint64_t)a[4] * b[0];
620 d += (uint64_t)a[5] * b[9]
621 + (uint64_t)a[6] * b[8]
622 + (uint64_t)a[7] * b[7]
623 + (uint64_t)a[8] * b[6]
624 + (uint64_t)a[9] * b[5];
627 u4 = d & M; d >>= 26; c += u4 * R0;
632 t4 = c & M; c >>= 26; c += u4 * R1;
638 c += (uint64_t)a[0] * b[5]
639 + (uint64_t)a[1] * b[4]
640 + (uint64_t)a[2] * b[3]
641 + (uint64_t)a[3] * b[2]
642 + (uint64_t)a[4] * b[1]
643 + (uint64_t)a[5] * b[0];
646 d += (uint64_t)a[6] * b[9]
647 + (uint64_t)a[7] * b[8]
648 + (uint64_t)a[8] * b[7]
649 + (uint64_t)a[9] * b[6];
652 u5 = d & M; d >>= 26; c += u5 * R0;
657 t5 = c & M; c >>= 26; c += u5 * R1;
663 c += (uint64_t)a[0] * b[6]
664 + (uint64_t)a[1] * b[5]
665 + (uint64_t)a[2] * b[4]
666 + (uint64_t)a[3] * b[3]
667 + (uint64_t)a[4] * b[2]
668 + (uint64_t)a[5] * b[1]
669 + (uint64_t)a[6] * b[0];
672 d += (uint64_t)a[7] * b[9]
673 + (uint64_t)a[8] * b[8]
674 + (uint64_t)a[9] * b[7];
677 u6 = d & M; d >>= 26; c += u6 * R0;
682 t6 = c & M; c >>= 26; c += u6 * R1;
688 c += (uint64_t)a[0] * b[7]
689 + (uint64_t)a[1] * b[6]
690 + (uint64_t)a[2] * b[5]
691 + (uint64_t)a[3] * b[4]
692 + (uint64_t)a[4] * b[3]
693 + (uint64_t)a[5] * b[2]
694 + (uint64_t)a[6] * b[1]
695 + (uint64_t)a[7] * b[0];
699 d += (uint64_t)a[8] * b[9]
700 + (uint64_t)a[9] * b[8];
703 u7 = d & M; d >>= 26; c += u7 * R0;
709 t7 = c & M; c >>= 26; c += u7 * R1;
715 c += (uint64_t)a[0] * b[8]
716 + (uint64_t)a[1] * b[7]
717 + (uint64_t)a[2] * b[6]
718 + (uint64_t)a[3] * b[5]
719 + (uint64_t)a[4] * b[4]
720 + (uint64_t)a[5] * b[3]
721 + (uint64_t)a[6] * b[2]
722 + (uint64_t)a[7] * b[1]
723 + (uint64_t)a[8] * b[0];
727 d += (uint64_t)a[9] * b[9];
730 u8 = d & M; d >>= 26; c += u8 * R0;
753 r[8] = c & M; c >>= 26; c += u8 * R1;
761 r[9] = c & (M >> 4); c >>= 22; c += d * (R1 << 4);
768 d = c * (R0 >> 4) + t0;
771 r[0] = d & M; d >>= 26;
775 d += c * (R1 >> 4) + t1;
780 r[1] = d & M; d >>= 26;
795 uint64_t u0, u1, u2, u3, u4, u5, u6, u7, u8;
796 uint32_t t9, t0, t1, t2, t3, t4, t5, t6, t7;
797 const uint32_t M = 0x3FFFFFFUL, R0 = 0x3D10UL, R1 = 0x400UL;
815 d = (uint64_t)(a[0]*2) * a[9]
816 + (uint64_t)(a[1]*2) * a[8]
817 + (uint64_t)(a[2]*2) * a[7]
818 + (uint64_t)(a[3]*2) * a[6]
819 + (uint64_t)(a[4]*2) * a[5];
822 t9 = d & M; d >>= 26;
827 c = (uint64_t)a[0] * a[0];
830 d += (uint64_t)(a[1]*2) * a[9]
831 + (uint64_t)(a[2]*2) * a[8]
832 + (uint64_t)(a[3]*2) * a[7]
833 + (uint64_t)(a[4]*2) * a[6]
834 + (uint64_t)a[5] * a[5];
837 u0 = d & M; d >>= 26; c += u0 * R0;
842 t0 = c & M; c >>= 26; c += u0 * R1;
848 c += (uint64_t)(a[0]*2) * a[1];
851 d += (uint64_t)(a[2]*2) * a[9]
852 + (uint64_t)(a[3]*2) * a[8]
853 + (uint64_t)(a[4]*2) * a[7]
854 + (uint64_t)(a[5]*2) * a[6];
857 u1 = d & M; d >>= 26; c += u1 * R0;
862 t1 = c & M; c >>= 26; c += u1 * R1;
868 c += (uint64_t)(a[0]*2) * a[2]
869 + (uint64_t)a[1] * a[1];
872 d += (uint64_t)(a[3]*2) * a[9]
873 + (uint64_t)(a[4]*2) * a[8]
874 + (uint64_t)(a[5]*2) * a[7]
875 + (uint64_t)a[6] * a[6];
878 u2 = d & M; d >>= 26; c += u2 * R0;
883 t2 = c & M; c >>= 26; c += u2 * R1;
889 c += (uint64_t)(a[0]*2) * a[3]
890 + (uint64_t)(a[1]*2) * a[2];
893 d += (uint64_t)(a[4]*2) * a[9]
894 + (uint64_t)(a[5]*2) * a[8]
895 + (uint64_t)(a[6]*2) * a[7];
898 u3 = d & M; d >>= 26; c += u3 * R0;
903 t3 = c & M; c >>= 26; c += u3 * R1;
909 c += (uint64_t)(a[0]*2) * a[4]
910 + (uint64_t)(a[1]*2) * a[3]
911 + (uint64_t)a[2] * a[2];
914 d += (uint64_t)(a[5]*2) * a[9]
915 + (uint64_t)(a[6]*2) * a[8]
916 + (uint64_t)a[7] * a[7];
919 u4 = d & M; d >>= 26; c += u4 * R0;
924 t4 = c & M; c >>= 26; c += u4 * R1;
930 c += (uint64_t)(a[0]*2) * a[5]
931 + (uint64_t)(a[1]*2) * a[4]
932 + (uint64_t)(a[2]*2) * a[3];
935 d += (uint64_t)(a[6]*2) * a[9]
936 + (uint64_t)(a[7]*2) * a[8];
939 u5 = d & M; d >>= 26; c += u5 * R0;
944 t5 = c & M; c >>= 26; c += u5 * R1;
950 c += (uint64_t)(a[0]*2) * a[6]
951 + (uint64_t)(a[1]*2) * a[5]
952 + (uint64_t)(a[2]*2) * a[4]
953 + (uint64_t)a[3] * a[3];
956 d += (uint64_t)(a[7]*2) * a[9]
957 + (uint64_t)a[8] * a[8];
960 u6 = d & M; d >>= 26; c += u6 * R0;
965 t6 = c & M; c >>= 26; c += u6 * R1;
971 c += (uint64_t)(a[0]*2) * a[7]
972 + (uint64_t)(a[1]*2) * a[6]
973 + (uint64_t)(a[2]*2) * a[5]
974 + (uint64_t)(a[3]*2) * a[4];
978 d += (uint64_t)(a[8]*2) * a[9];
981 u7 = d & M; d >>= 26; c += u7 * R0;
987 t7 = c & M; c >>= 26; c += u7 * R1;
993 c += (uint64_t)(a[0]*2) * a[8]
994 + (uint64_t)(a[1]*2) * a[7]
995 + (uint64_t)(a[2]*2) * a[6]
996 + (uint64_t)(a[3]*2) * a[5]
997 + (uint64_t)a[4] * a[4];
1001 d += (uint64_t)a[9] * a[9];
1004 u8 = d & M; d >>= 26; c += u8 * R0;
1027 r[8] = c & M; c >>= 26; c += u8 * R1;
1035 r[9] = c & (M >> 4); c >>= 22; c += d * (R1 << 4);
1042 d = c * (R0 >> 4) + t0;
1045 r[0] = d & M; d >>= 26;
1049 d += c * (R1 >> 4) + t1;
1054 r[1] = d & M; d >>= 26;
1072 secp256k1_fe_verify(a);
1073 secp256k1_fe_verify(b);
1081 secp256k1_fe_verify(r);
1088 secp256k1_fe_verify(a);
1094 secp256k1_fe_verify(r);
1099 uint32_t mask0, mask1;
1101 mask0 = flag + ~((uint32_t)0);
1103 r->
n[0] = (r->
n[0] & mask0) | (a->
n[0] & mask1);
1104 r->
n[1] = (r->
n[1] & mask0) | (a->
n[1] & mask1);
1105 r->
n[2] = (r->
n[2] & mask0) | (a->
n[2] & mask1);
1106 r->
n[3] = (r->
n[3] & mask0) | (a->
n[3] & mask1);
1107 r->
n[4] = (r->
n[4] & mask0) | (a->
n[4] & mask1);
1108 r->
n[5] = (r->
n[5] & mask0) | (a->
n[5] & mask1);
1109 r->
n[6] = (r->
n[6] & mask0) | (a->
n[6] & mask1);
1110 r->
n[7] = (r->
n[7] & mask0) | (a->
n[7] & mask1);
1111 r->
n[8] = (r->
n[8] & mask0) | (a->
n[8] & mask1);
1112 r->
n[9] = (r->
n[9] & mask0) | (a->
n[9] & mask1);
1115 r->magnitude = a->magnitude;
1116 r->normalized = a->normalized;
1122 uint32_t mask0, mask1;
1124 mask0 = flag + ~((uint32_t)0);
1126 r->
n[0] = (r->
n[0] & mask0) | (a->
n[0] & mask1);
1127 r->
n[1] = (r->
n[1] & mask0) | (a->
n[1] & mask1);
1128 r->
n[2] = (r->
n[2] & mask0) | (a->
n[2] & mask1);
1129 r->
n[3] = (r->
n[3] & mask0) | (a->
n[3] & mask1);
1130 r->
n[4] = (r->
n[4] & mask0) | (a->
n[4] & mask1);
1131 r->
n[5] = (r->
n[5] & mask0) | (a->
n[5] & mask1);
1132 r->
n[6] = (r->
n[6] & mask0) | (a->
n[6] & mask1);
1133 r->
n[7] = (r->
n[7] & mask0) | (a->
n[7] & mask1);
1140 r->
n[0] = a->
n[0] | a->
n[1] << 26;
1141 r->
n[1] = a->
n[1] >> 6 | a->
n[2] << 20;
1142 r->
n[2] = a->
n[2] >> 12 | a->
n[3] << 14;
1143 r->
n[3] = a->
n[3] >> 18 | a->
n[4] << 8;
1144 r->
n[4] = a->
n[4] >> 24 | a->
n[5] << 2 | a->
n[6] << 28;
1145 r->
n[5] = a->
n[6] >> 4 | a->
n[7] << 22;
1146 r->
n[6] = a->
n[7] >> 10 | a->
n[8] << 16;
1147 r->
n[7] = a->
n[8] >> 16 | a->
n[9] << 10;
1151 r->
n[0] = a->
n[0] & 0x3FFFFFFUL;
1152 r->
n[1] = a->
n[0] >> 26 | ((a->
n[1] << 6) & 0x3FFFFFFUL);
1153 r->
n[2] = a->
n[1] >> 20 | ((a->
n[2] << 12) & 0x3FFFFFFUL);
1154 r->
n[3] = a->
n[2] >> 14 | ((a->
n[3] << 18) & 0x3FFFFFFUL);
1155 r->
n[4] = a->
n[3] >> 8 | ((a->
n[4] << 24) & 0x3FFFFFFUL);
1156 r->
n[5] = (a->
n[4] >> 2) & 0x3FFFFFFUL;
1157 r->
n[6] = a->
n[4] >> 28 | ((a->
n[5] << 4) & 0x3FFFFFFUL);
1158 r->
n[7] = a->
n[5] >> 22 | ((a->
n[6] << 10) & 0x3FFFFFFUL);
1159 r->
n[8] = a->
n[6] >> 16 | ((a->
n[7] << 16) & 0x3FFFFFFUL);
1160 r->
n[9] = a->
n[7] >> 10;
#define VERIFY_CHECK(cond)
static SECP256K1_INLINE void secp256k1_fe_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a)
static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *SECP256K1_RESTRICT b)
static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag)
static SECP256K1_INLINE void secp256k1_fe_clear(secp256k1_fe *a)
static void secp256k1_fe_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a)
static SECP256K1_INLINE void secp256k1_fe_sqr_inner(uint32_t *r, const uint32_t *a)
static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a)
static SECP256K1_INLINE void secp256k1_fe_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag)
static SECP256K1_INLINE void secp256k1_fe_mul_inner(uint32_t *r, const uint32_t *a, const uint32_t *SECP256K1_RESTRICT b)
static SECP256K1_INLINE int secp256k1_fe_is_odd(const secp256k1_fe *a)
static SECP256K1_INLINE void secp256k1_fe_mul_int(secp256k1_fe *r, int a)
static SECP256K1_INLINE void secp256k1_fe_add(secp256k1_fe *r, const secp256k1_fe *a)
static void secp256k1_fe_normalize_weak(secp256k1_fe *r)
static void secp256k1_fe_normalize(secp256k1_fe *r)
static SECP256K1_INLINE void secp256k1_fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m)
#define SECP256K1_RESTRICT
#define VG_CHECK_VERIFY(x, y)
static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b)
static int secp256k1_fe_normalizes_to_zero(secp256k1_fe *r)
static SECP256K1_INLINE int secp256k1_fe_is_zero(const secp256k1_fe *a)
static void secp256k1_fe_normalize_var(secp256k1_fe *r)
static SECP256K1_INLINE void secp256k1_fe_set_int(secp256k1_fe *r, int a)
#define VERIFY_BITS(x, n)
static int secp256k1_fe_normalizes_to_zero_var(secp256k1_fe *r)
static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe *a)
Convert a field element to a 32-byte big endian value.
static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a)