7 #ifndef SECP256K1_FIELD_REPR_IMPL_H
8 #define SECP256K1_FIELD_REPR_IMPL_H
16 const uint32_t *d = a->
n;
17 int m = a->normalized ? 1 : 2 * a->magnitude, r = 1;
18 r &= (d[0] <= 0x3FFFFFFUL *
m);
19 r &= (d[1] <= 0x3FFFFFFUL *
m);
20 r &= (d[2] <= 0x3FFFFFFUL *
m);
21 r &= (d[3] <= 0x3FFFFFFUL *
m);
22 r &= (d[4] <= 0x3FFFFFFUL *
m);
23 r &= (d[5] <= 0x3FFFFFFUL *
m);
24 r &= (d[6] <= 0x3FFFFFFUL *
m);
25 r &= (d[7] <= 0x3FFFFFFUL *
m);
26 r &= (d[8] <= 0x3FFFFFFUL *
m);
27 r &= (d[9] <= 0x03FFFFFUL *
m);
28 r &= (a->magnitude >= 0);
29 r &= (a->magnitude <= 32);
31 r &= (a->magnitude <= 1);
32 if (r && (d[9] == 0x03FFFFFUL)) {
33 uint32_t mid = d[8] & d[7] & d[6] & d[5] & d[4] & d[3] & d[2];
34 if (mid == 0x3FFFFFFUL) {
35 r &= ((d[1] + 0x40UL + ((d[0] + 0x3D1UL) >> 26)) <= 0x3FFFFFFUL);
44 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
45 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
49 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
52 t0 += x * 0x3D1UL; t1 += (x << 6);
53 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
54 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
55 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
m = t2;
56 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
m &= t3;
57 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
m &= t4;
58 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
m &= t5;
59 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
m &= t6;
60 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
m &= t7;
61 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
m &= t8;
67 x = (t9 >> 22) | ((t9 == 0x03FFFFFUL) & (
m == 0x3FFFFFFUL)
68 & ((t1 + 0x40UL + ((t0 + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
71 t0 += x * 0x3D1UL; t1 += (x << 6);
72 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
73 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
74 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
75 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
76 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
77 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
78 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
79 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
80 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
88 r->
n[0] = t0; r->
n[1] = t1; r->
n[2] = t2; r->
n[3] = t3; r->
n[4] = t4;
89 r->
n[5] = t5; r->
n[6] = t6; r->
n[7] = t7; r->
n[8] = t8; r->
n[9] = t9;
94 secp256k1_fe_verify(r);
99 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
100 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
103 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
106 t0 += x * 0x3D1UL; t1 += (x << 6);
107 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
108 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
109 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
110 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
111 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
112 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
113 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
114 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
115 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
120 r->
n[0] = t0; r->
n[1] = t1; r->
n[2] = t2; r->
n[3] = t3; r->
n[4] = t4;
121 r->
n[5] = t5; r->
n[6] = t6; r->
n[7] = t7; r->
n[8] = t8; r->
n[9] = t9;
125 secp256k1_fe_verify(r);
130 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
131 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
135 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
138 t0 += x * 0x3D1UL; t1 += (x << 6);
139 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
140 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
141 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
m = t2;
142 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
m &= t3;
143 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
m &= t4;
144 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
m &= t5;
145 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
m &= t6;
146 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
m &= t7;
147 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
m &= t8;
153 x = (t9 >> 22) | ((t9 == 0x03FFFFFUL) & (
m == 0x3FFFFFFUL)
154 & ((t1 + 0x40UL + ((t0 + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
157 t0 += 0x3D1UL; t1 += (x << 6);
158 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL;
159 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL;
160 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL;
161 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL;
162 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL;
163 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL;
164 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL;
165 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL;
166 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL;
175 r->
n[0] = t0; r->
n[1] = t1; r->
n[2] = t2; r->
n[3] = t3; r->
n[4] = t4;
176 r->
n[5] = t5; r->
n[6] = t6; r->
n[7] = t7; r->
n[8] = t8; r->
n[9] = t9;
181 secp256k1_fe_verify(r);
186 uint32_t t0 = r->
n[0], t1 = r->
n[1], t2 = r->
n[2], t3 = r->
n[3], t4 = r->
n[4],
187 t5 = r->
n[5], t6 = r->
n[6], t7 = r->
n[7], t8 = r->
n[8], t9 = r->
n[9];
193 uint32_t x = t9 >> 22; t9 &= 0x03FFFFFUL;
196 t0 += x * 0x3D1UL; t1 += (x << 6);
197 t1 += (t0 >> 26); t0 &= 0x3FFFFFFUL; z0 = t0; z1 = t0 ^ 0x3D0UL;
198 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL; z0 |= t1; z1 &= t1 ^ 0x40UL;
199 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL; z0 |= t2; z1 &= t2;
200 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL; z0 |= t3; z1 &= t3;
201 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL; z0 |= t4; z1 &= t4;
202 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL; z0 |= t5; z1 &= t5;
203 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL; z0 |= t6; z1 &= t6;
204 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL; z0 |= t7; z1 &= t7;
205 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL; z0 |= t8; z1 &= t8;
206 z0 |= t9; z1 &= t9 ^ 0x3C00000UL;
211 return (z0 == 0) | (z1 == 0x3FFFFFFUL);
215 uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
229 z0 = t0 & 0x3FFFFFFUL;
233 if ((z0 != 0UL) & (z1 != 0x3FFFFFFUL)) {
250 t2 += (t1 >> 26); t1 &= 0x3FFFFFFUL; z0 |= t1; z1 &= t1 ^ 0x40UL;
251 t3 += (t2 >> 26); t2 &= 0x3FFFFFFUL; z0 |= t2; z1 &= t2;
252 t4 += (t3 >> 26); t3 &= 0x3FFFFFFUL; z0 |= t3; z1 &= t3;
253 t5 += (t4 >> 26); t4 &= 0x3FFFFFFUL; z0 |= t4; z1 &= t4;
254 t6 += (t5 >> 26); t5 &= 0x3FFFFFFUL; z0 |= t5; z1 &= t5;
255 t7 += (t6 >> 26); t6 &= 0x3FFFFFFUL; z0 |= t6; z1 &= t6;
256 t8 += (t7 >> 26); t7 &= 0x3FFFFFFUL; z0 |= t7; z1 &= t7;
257 t9 += (t8 >> 26); t8 &= 0x3FFFFFFUL; z0 |= t8; z1 &= t8;
258 z0 |= t9; z1 &= t9 ^ 0x3C00000UL;
263 return (z0 == 0) | (z1 == 0x3FFFFFFUL);
269 r->
n[1] = r->
n[2] = r->
n[3] = r->
n[4] = r->
n[5] = r->
n[6] = r->
n[7] = r->
n[8] = r->
n[9] = 0;
271 r->magnitude = (a != 0);
273 secp256k1_fe_verify(r);
278 const uint32_t *
t = a->
n;
281 secp256k1_fe_verify(a);
283 return (
t[0] |
t[1] |
t[2] |
t[3] |
t[4] |
t[5] |
t[6] |
t[7] |
t[8] |
t[9]) == 0;
289 secp256k1_fe_verify(a);
300 for (i=0; i<10; i++) {
310 secp256k1_fe_verify(a);
311 secp256k1_fe_verify(b);
313 for (i = 9; i >= 0; i--) {
314 if (a->
n[i] > b->
n[i]) {
317 if (a->
n[i] < b->
n[i]) {
326 r->
n[0] = (uint32_t)a[31] | ((uint32_t)a[30] << 8) | ((uint32_t)a[29] << 16) | ((uint32_t)(a[28] & 0x3) << 24);
327 r->
n[1] = (uint32_t)((a[28] >> 2) & 0x3f) | ((uint32_t)a[27] << 6) | ((uint32_t)a[26] << 14) | ((uint32_t)(a[25] & 0xf) << 22);
328 r->
n[2] = (uint32_t)((a[25] >> 4) & 0xf) | ((uint32_t)a[24] << 4) | ((uint32_t)a[23] << 12) | ((uint32_t)(a[22] & 0x3f) << 20);
329 r->
n[3] = (uint32_t)((a[22] >> 6) & 0x3) | ((uint32_t)a[21] << 2) | ((uint32_t)a[20] << 10) | ((uint32_t)a[19] << 18);
330 r->
n[4] = (uint32_t)a[18] | ((uint32_t)a[17] << 8) | ((uint32_t)a[16] << 16) | ((uint32_t)(a[15] & 0x3) << 24);
331 r->
n[5] = (uint32_t)((a[15] >> 2) & 0x3f) | ((uint32_t)a[14] << 6) | ((uint32_t)a[13] << 14) | ((uint32_t)(a[12] & 0xf) << 22);
332 r->
n[6] = (uint32_t)((a[12] >> 4) & 0xf) | ((uint32_t)a[11] << 4) | ((uint32_t)a[10] << 12) | ((uint32_t)(a[9] & 0x3f) << 20);
333 r->
n[7] = (uint32_t)((a[9] >> 6) & 0x3) | ((uint32_t)a[8] << 2) | ((uint32_t)a[7] << 10) | ((uint32_t)a[6] << 18);
334 r->
n[8] = (uint32_t)a[5] | ((uint32_t)a[4] << 8) | ((uint32_t)a[3] << 16) | ((uint32_t)(a[2] & 0x3) << 24);
335 r->
n[9] = (uint32_t)((a[2] >> 2) & 0x3f) | ((uint32_t)a[1] << 6) | ((uint32_t)a[0] << 14);
337 ret = !((r->
n[9] == 0x3FFFFFUL) & ((r->
n[8] & r->
n[7] & r->
n[6] & r->
n[5] & r->
n[4] & r->
n[3] & r->
n[2]) == 0x3FFFFFFUL) & ((r->
n[1] + 0x40UL + ((r->
n[0] + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
342 secp256k1_fe_verify(r);
354 secp256k1_fe_verify(a);
356 r[0] = (a->
n[9] >> 14) & 0xff;
357 r[1] = (a->
n[9] >> 6) & 0xff;
358 r[2] = ((a->
n[9] & 0x3F) << 2) | ((a->
n[8] >> 24) & 0x3);
359 r[3] = (a->
n[8] >> 16) & 0xff;
360 r[4] = (a->
n[8] >> 8) & 0xff;
361 r[5] = a->
n[8] & 0xff;
362 r[6] = (a->
n[7] >> 18) & 0xff;
363 r[7] = (a->
n[7] >> 10) & 0xff;
364 r[8] = (a->
n[7] >> 2) & 0xff;
365 r[9] = ((a->
n[7] & 0x3) << 6) | ((a->
n[6] >> 20) & 0x3f);
366 r[10] = (a->
n[6] >> 12) & 0xff;
367 r[11] = (a->
n[6] >> 4) & 0xff;
368 r[12] = ((a->
n[6] & 0xf) << 4) | ((a->
n[5] >> 22) & 0xf);
369 r[13] = (a->
n[5] >> 14) & 0xff;
370 r[14] = (a->
n[5] >> 6) & 0xff;
371 r[15] = ((a->
n[5] & 0x3f) << 2) | ((a->
n[4] >> 24) & 0x3);
372 r[16] = (a->
n[4] >> 16) & 0xff;
373 r[17] = (a->
n[4] >> 8) & 0xff;
374 r[18] = a->
n[4] & 0xff;
375 r[19] = (a->
n[3] >> 18) & 0xff;
376 r[20] = (a->
n[3] >> 10) & 0xff;
377 r[21] = (a->
n[3] >> 2) & 0xff;
378 r[22] = ((a->
n[3] & 0x3) << 6) | ((a->
n[2] >> 20) & 0x3f);
379 r[23] = (a->
n[2] >> 12) & 0xff;
380 r[24] = (a->
n[2] >> 4) & 0xff;
381 r[25] = ((a->
n[2] & 0xf) << 4) | ((a->
n[1] >> 22) & 0xf);
382 r[26] = (a->
n[1] >> 14) & 0xff;
383 r[27] = (a->
n[1] >> 6) & 0xff;
384 r[28] = ((a->
n[1] & 0x3f) << 2) | ((a->
n[0] >> 24) & 0x3);
385 r[29] = (a->
n[0] >> 16) & 0xff;
386 r[30] = (a->
n[0] >> 8) & 0xff;
387 r[31] = a->
n[0] & 0xff;
393 secp256k1_fe_verify(a);
395 r->
n[0] = 0x3FFFC2FUL * 2 * (
m + 1) - a->
n[0];
396 r->
n[1] = 0x3FFFFBFUL * 2 * (
m + 1) - a->
n[1];
397 r->
n[2] = 0x3FFFFFFUL * 2 * (
m + 1) - a->
n[2];
398 r->
n[3] = 0x3FFFFFFUL * 2 * (
m + 1) - a->
n[3];
399 r->
n[4] = 0x3FFFFFFUL * 2 * (
m + 1) - a->
n[4];
400 r->
n[5] = 0x3FFFFFFUL * 2 * (
m + 1) - a->
n[5];
401 r->
n[6] = 0x3FFFFFFUL * 2 * (
m + 1) - a->
n[6];
402 r->
n[7] = 0x3FFFFFFUL * 2 * (
m + 1) - a->
n[7];
403 r->
n[8] = 0x3FFFFFFUL * 2 * (
m + 1) - a->
n[8];
404 r->
n[9] = 0x03FFFFFUL * 2 * (
m + 1) - a->
n[9];
406 r->magnitude =
m + 1;
408 secp256k1_fe_verify(r);
426 secp256k1_fe_verify(r);
432 secp256k1_fe_verify(a);
445 r->magnitude += a->magnitude;
447 secp256k1_fe_verify(r);
451 #if defined(USE_EXTERNAL_ASM)
460 #define VERIFY_BITS(x, n) VERIFY_CHECK(((x) >> (n)) == 0)
462 #define VERIFY_BITS(x, n) do { } while(0)
467 uint64_t u0, u1, u2, u3, u4, u5, u6, u7,
u8;
468 uint32_t t9, t1, t0, t2, t3, t4, t5, t6, t7;
469 const uint32_t
M = 0x3FFFFFFUL, R0 = 0x3D10UL, R1 = 0x400UL;
498 d = (uint64_t)a[0] * b[9]
499 + (uint64_t)a[1] * b[8]
500 + (uint64_t)a[2] * b[7]
501 + (uint64_t)a[3] * b[6]
502 + (uint64_t)a[4] * b[5]
503 + (uint64_t)a[5] * b[4]
504 + (uint64_t)a[6] * b[3]
505 + (uint64_t)a[7] * b[2]
506 + (uint64_t)a[8] * b[1]
507 + (uint64_t)a[9] * b[0];
510 t9 = d &
M; d >>= 26;
515 c = (uint64_t)a[0] * b[0];
518 d += (uint64_t)a[1] * b[9]
519 + (uint64_t)a[2] * b[8]
520 + (uint64_t)a[3] * b[7]
521 + (uint64_t)a[4] * b[6]
522 + (uint64_t)a[5] * b[5]
523 + (uint64_t)a[6] * b[4]
524 + (uint64_t)a[7] * b[3]
525 + (uint64_t)a[8] * b[2]
526 + (uint64_t)a[9] * b[1];
529 u0 = d &
M; d >>= 26; c += u0 * R0;
534 t0 = c &
M; c >>= 26; c += u0 * R1;
540 c += (uint64_t)a[0] * b[1]
541 + (uint64_t)a[1] * b[0];
544 d += (uint64_t)a[2] * b[9]
545 + (uint64_t)a[3] * b[8]
546 + (uint64_t)a[4] * b[7]
547 + (uint64_t)a[5] * b[6]
548 + (uint64_t)a[6] * b[5]
549 + (uint64_t)a[7] * b[4]
550 + (uint64_t)a[8] * b[3]
551 + (uint64_t)a[9] * b[2];
554 u1 = d &
M; d >>= 26; c += u1 * R0;
559 t1 = c &
M; c >>= 26; c += u1 * R1;
565 c += (uint64_t)a[0] * b[2]
566 + (uint64_t)a[1] * b[1]
567 + (uint64_t)a[2] * b[0];
570 d += (uint64_t)a[3] * b[9]
571 + (uint64_t)a[4] * b[8]
572 + (uint64_t)a[5] * b[7]
573 + (uint64_t)a[6] * b[6]
574 + (uint64_t)a[7] * b[5]
575 + (uint64_t)a[8] * b[4]
576 + (uint64_t)a[9] * b[3];
579 u2 = d &
M; d >>= 26; c += u2 * R0;
584 t2 = c &
M; c >>= 26; c += u2 * R1;
590 c += (uint64_t)a[0] * b[3]
591 + (uint64_t)a[1] * b[2]
592 + (uint64_t)a[2] * b[1]
593 + (uint64_t)a[3] * b[0];
596 d += (uint64_t)a[4] * b[9]
597 + (uint64_t)a[5] * b[8]
598 + (uint64_t)a[6] * b[7]
599 + (uint64_t)a[7] * b[6]
600 + (uint64_t)a[8] * b[5]
601 + (uint64_t)a[9] * b[4];
604 u3 = d &
M; d >>= 26; c += u3 * R0;
609 t3 = c &
M; c >>= 26; c += u3 * R1;
615 c += (uint64_t)a[0] * b[4]
616 + (uint64_t)a[1] * b[3]
617 + (uint64_t)a[2] * b[2]
618 + (uint64_t)a[3] * b[1]
619 + (uint64_t)a[4] * b[0];
622 d += (uint64_t)a[5] * b[9]
623 + (uint64_t)a[6] * b[8]
624 + (uint64_t)a[7] * b[7]
625 + (uint64_t)a[8] * b[6]
626 + (uint64_t)a[9] * b[5];
629 u4 = d &
M; d >>= 26; c += u4 * R0;
634 t4 = c &
M; c >>= 26; c += u4 * R1;
640 c += (uint64_t)a[0] * b[5]
641 + (uint64_t)a[1] * b[4]
642 + (uint64_t)a[2] * b[3]
643 + (uint64_t)a[3] * b[2]
644 + (uint64_t)a[4] * b[1]
645 + (uint64_t)a[5] * b[0];
648 d += (uint64_t)a[6] * b[9]
649 + (uint64_t)a[7] * b[8]
650 + (uint64_t)a[8] * b[7]
651 + (uint64_t)a[9] * b[6];
654 u5 = d &
M; d >>= 26; c += u5 * R0;
659 t5 = c &
M; c >>= 26; c += u5 * R1;
665 c += (uint64_t)a[0] * b[6]
666 + (uint64_t)a[1] * b[5]
667 + (uint64_t)a[2] * b[4]
668 + (uint64_t)a[3] * b[3]
669 + (uint64_t)a[4] * b[2]
670 + (uint64_t)a[5] * b[1]
671 + (uint64_t)a[6] * b[0];
674 d += (uint64_t)a[7] * b[9]
675 + (uint64_t)a[8] * b[8]
676 + (uint64_t)a[9] * b[7];
679 u6 = d &
M; d >>= 26; c += u6 * R0;
684 t6 = c &
M; c >>= 26; c += u6 * R1;
690 c += (uint64_t)a[0] * b[7]
691 + (uint64_t)a[1] * b[6]
692 + (uint64_t)a[2] * b[5]
693 + (uint64_t)a[3] * b[4]
694 + (uint64_t)a[4] * b[3]
695 + (uint64_t)a[5] * b[2]
696 + (uint64_t)a[6] * b[1]
697 + (uint64_t)a[7] * b[0];
701 d += (uint64_t)a[8] * b[9]
702 + (uint64_t)a[9] * b[8];
705 u7 = d &
M; d >>= 26; c += u7 * R0;
711 t7 = c &
M; c >>= 26; c += u7 * R1;
717 c += (uint64_t)a[0] * b[8]
718 + (uint64_t)a[1] * b[7]
719 + (uint64_t)a[2] * b[6]
720 + (uint64_t)a[3] * b[5]
721 + (uint64_t)a[4] * b[4]
722 + (uint64_t)a[5] * b[3]
723 + (uint64_t)a[6] * b[2]
724 + (uint64_t)a[7] * b[1]
725 + (uint64_t)a[8] * b[0];
729 d += (uint64_t)a[9] * b[9];
732 u8 = d &
M; d >>= 26; c +=
u8 * R0;
755 r[8] = c &
M; c >>= 26; c +=
u8 * R1;
763 r[9] = c & (
M >> 4); c >>= 22; c += d * (R1 << 4);
770 d = c * (R0 >> 4) + t0;
773 r[0] = d &
M; d >>= 26;
777 d += c * (R1 >> 4) + t1;
782 r[1] = d &
M; d >>= 26;
797 uint64_t u0, u1, u2, u3, u4, u5, u6, u7,
u8;
798 uint32_t t9, t0, t1, t2, t3, t4, t5, t6, t7;
799 const uint32_t
M = 0x3FFFFFFUL, R0 = 0x3D10UL, R1 = 0x400UL;
817 d = (uint64_t)(a[0]*2) * a[9]
818 + (uint64_t)(a[1]*2) * a[8]
819 + (uint64_t)(a[2]*2) * a[7]
820 + (uint64_t)(a[3]*2) * a[6]
821 + (uint64_t)(a[4]*2) * a[5];
824 t9 = d &
M; d >>= 26;
829 c = (uint64_t)a[0] * a[0];
832 d += (uint64_t)(a[1]*2) * a[9]
833 + (uint64_t)(a[2]*2) * a[8]
834 + (uint64_t)(a[3]*2) * a[7]
835 + (uint64_t)(a[4]*2) * a[6]
836 + (uint64_t)a[5] * a[5];
839 u0 = d &
M; d >>= 26; c += u0 * R0;
844 t0 = c &
M; c >>= 26; c += u0 * R1;
850 c += (uint64_t)(a[0]*2) * a[1];
853 d += (uint64_t)(a[2]*2) * a[9]
854 + (uint64_t)(a[3]*2) * a[8]
855 + (uint64_t)(a[4]*2) * a[7]
856 + (uint64_t)(a[5]*2) * a[6];
859 u1 = d &
M; d >>= 26; c += u1 * R0;
864 t1 = c &
M; c >>= 26; c += u1 * R1;
870 c += (uint64_t)(a[0]*2) * a[2]
871 + (uint64_t)a[1] * a[1];
874 d += (uint64_t)(a[3]*2) * a[9]
875 + (uint64_t)(a[4]*2) * a[8]
876 + (uint64_t)(a[5]*2) * a[7]
877 + (uint64_t)a[6] * a[6];
880 u2 = d &
M; d >>= 26; c += u2 * R0;
885 t2 = c &
M; c >>= 26; c += u2 * R1;
891 c += (uint64_t)(a[0]*2) * a[3]
892 + (uint64_t)(a[1]*2) * a[2];
895 d += (uint64_t)(a[4]*2) * a[9]
896 + (uint64_t)(a[5]*2) * a[8]
897 + (uint64_t)(a[6]*2) * a[7];
900 u3 = d &
M; d >>= 26; c += u3 * R0;
905 t3 = c &
M; c >>= 26; c += u3 * R1;
911 c += (uint64_t)(a[0]*2) * a[4]
912 + (uint64_t)(a[1]*2) * a[3]
913 + (uint64_t)a[2] * a[2];
916 d += (uint64_t)(a[5]*2) * a[9]
917 + (uint64_t)(a[6]*2) * a[8]
918 + (uint64_t)a[7] * a[7];
921 u4 = d &
M; d >>= 26; c += u4 * R0;
926 t4 = c &
M; c >>= 26; c += u4 * R1;
932 c += (uint64_t)(a[0]*2) * a[5]
933 + (uint64_t)(a[1]*2) * a[4]
934 + (uint64_t)(a[2]*2) * a[3];
937 d += (uint64_t)(a[6]*2) * a[9]
938 + (uint64_t)(a[7]*2) * a[8];
941 u5 = d &
M; d >>= 26; c += u5 * R0;
946 t5 = c &
M; c >>= 26; c += u5 * R1;
952 c += (uint64_t)(a[0]*2) * a[6]
953 + (uint64_t)(a[1]*2) * a[5]
954 + (uint64_t)(a[2]*2) * a[4]
955 + (uint64_t)a[3] * a[3];
958 d += (uint64_t)(a[7]*2) * a[9]
959 + (uint64_t)a[8] * a[8];
962 u6 = d &
M; d >>= 26; c += u6 * R0;
967 t6 = c &
M; c >>= 26; c += u6 * R1;
973 c += (uint64_t)(a[0]*2) * a[7]
974 + (uint64_t)(a[1]*2) * a[6]
975 + (uint64_t)(a[2]*2) * a[5]
976 + (uint64_t)(a[3]*2) * a[4];
980 d += (uint64_t)(a[8]*2) * a[9];
983 u7 = d &
M; d >>= 26; c += u7 * R0;
989 t7 = c &
M; c >>= 26; c += u7 * R1;
995 c += (uint64_t)(a[0]*2) * a[8]
996 + (uint64_t)(a[1]*2) * a[7]
997 + (uint64_t)(a[2]*2) * a[6]
998 + (uint64_t)(a[3]*2) * a[5]
999 + (uint64_t)a[4] * a[4];
1003 d += (uint64_t)a[9] * a[9];
1006 u8 = d &
M; d >>= 26; c +=
u8 * R0;
1029 r[8] = c &
M; c >>= 26; c +=
u8 * R1;
1037 r[9] = c & (
M >> 4); c >>= 22; c += d * (R1 << 4);
1044 d = c * (R0 >> 4) + t0;
1047 r[0] = d &
M; d >>= 26;
1051 d += c * (R1 >> 4) + t1;
1056 r[1] = d &
M; d >>= 26;
1074 secp256k1_fe_verify(a);
1075 secp256k1_fe_verify(b);
1083 secp256k1_fe_verify(r);
1090 secp256k1_fe_verify(a);
1096 secp256k1_fe_verify(r);
1101 uint32_t mask0, mask1;
1103 mask0 = flag + ~((uint32_t)0);
1105 r->
n[0] = (r->
n[0] & mask0) | (a->
n[0] & mask1);
1106 r->
n[1] = (r->
n[1] & mask0) | (a->
n[1] & mask1);
1107 r->
n[2] = (r->
n[2] & mask0) | (a->
n[2] & mask1);
1108 r->
n[3] = (r->
n[3] & mask0) | (a->
n[3] & mask1);
1109 r->
n[4] = (r->
n[4] & mask0) | (a->
n[4] & mask1);
1110 r->
n[5] = (r->
n[5] & mask0) | (a->
n[5] & mask1);
1111 r->
n[6] = (r->
n[6] & mask0) | (a->
n[6] & mask1);
1112 r->
n[7] = (r->
n[7] & mask0) | (a->
n[7] & mask1);
1113 r->
n[8] = (r->
n[8] & mask0) | (a->
n[8] & mask1);
1114 r->
n[9] = (r->
n[9] & mask0) | (a->
n[9] & mask1);
1117 r->magnitude = a->magnitude;
1118 r->normalized = a->normalized;
1124 uint32_t mask0, mask1;
1126 mask0 = flag + ~((uint32_t)0);
1128 r->
n[0] = (r->
n[0] & mask0) | (a->
n[0] & mask1);
1129 r->
n[1] = (r->
n[1] & mask0) | (a->
n[1] & mask1);
1130 r->
n[2] = (r->
n[2] & mask0) | (a->
n[2] & mask1);
1131 r->
n[3] = (r->
n[3] & mask0) | (a->
n[3] & mask1);
1132 r->
n[4] = (r->
n[4] & mask0) | (a->
n[4] & mask1);
1133 r->
n[5] = (r->
n[5] & mask0) | (a->
n[5] & mask1);
1134 r->
n[6] = (r->
n[6] & mask0) | (a->
n[6] & mask1);
1135 r->
n[7] = (r->
n[7] & mask0) | (a->
n[7] & mask1);
1142 r->
n[0] = a->
n[0] | a->
n[1] << 26;
1143 r->
n[1] = a->
n[1] >> 6 | a->
n[2] << 20;
1144 r->
n[2] = a->
n[2] >> 12 | a->
n[3] << 14;
1145 r->
n[3] = a->
n[3] >> 18 | a->
n[4] << 8;
1146 r->
n[4] = a->
n[4] >> 24 | a->
n[5] << 2 | a->
n[6] << 28;
1147 r->
n[5] = a->
n[6] >> 4 | a->
n[7] << 22;
1148 r->
n[6] = a->
n[7] >> 10 | a->
n[8] << 16;
1149 r->
n[7] = a->
n[8] >> 16 | a->
n[9] << 10;
1153 r->
n[0] = a->
n[0] & 0x3FFFFFFUL;
1154 r->
n[1] = a->
n[0] >> 26 | ((a->
n[1] << 6) & 0x3FFFFFFUL);
1155 r->
n[2] = a->
n[1] >> 20 | ((a->
n[2] << 12) & 0x3FFFFFFUL);
1156 r->
n[3] = a->
n[2] >> 14 | ((a->
n[3] << 18) & 0x3FFFFFFUL);
1157 r->
n[4] = a->
n[3] >> 8 | ((a->
n[4] << 24) & 0x3FFFFFFUL);
1158 r->
n[5] = (a->
n[4] >> 2) & 0x3FFFFFFUL;
1159 r->
n[6] = a->
n[4] >> 28 | ((a->
n[5] << 4) & 0x3FFFFFFUL);
1160 r->
n[7] = a->
n[5] >> 22 | ((a->
n[6] << 10) & 0x3FFFFFFUL);
1161 r->
n[8] = a->
n[6] >> 16 | ((a->
n[7] << 16) & 0x3FFFFFFUL);
1162 r->
n[9] = a->
n[7] >> 10;
1166 secp256k1_fe_verify(r);
1171 const uint32_t M26 = UINT32_MAX >> 6;
1172 const uint32_t a0 = a->
v[0], a1 = a->
v[1], a2 = a->
v[2], a3 = a->
v[3], a4 = a->
v[4],
1173 a5 = a->
v[5], a6 = a->
v[6], a7 = a->
v[7], a8 = a->
v[8];
1189 r->
n[1] = (a0 >> 26 | a1 << 4) & M26;
1190 r->
n[2] = (a1 >> 22 | a2 << 8) & M26;
1191 r->
n[3] = (a2 >> 18 | a3 << 12) & M26;
1192 r->
n[4] = (a3 >> 14 | a4 << 16) & M26;
1193 r->
n[5] = (a4 >> 10 | a5 << 20) & M26;
1194 r->
n[6] = (a5 >> 6 | a6 << 24) & M26;
1195 r->
n[7] = (a6 >> 2 ) & M26;
1196 r->
n[8] = (a6 >> 28 | a7 << 2) & M26;
1197 r->
n[9] = (a7 >> 24 | a8 << 6);
1202 secp256k1_fe_verify(r);
1207 const uint32_t M30 = UINT32_MAX >> 2;
1208 const uint64_t a0 = a->
n[0], a1 = a->
n[1], a2 = a->
n[2], a3 = a->
n[3], a4 = a->
n[4],
1209 a5 = a->
n[5], a6 = a->
n[6], a7 = a->
n[7], a8 = a->
n[8], a9 = a->
n[9];
1215 r->
v[0] = (a0 | a1 << 26) & M30;
1216 r->
v[1] = (a1 >> 4 | a2 << 22) & M30;
1217 r->
v[2] = (a2 >> 8 | a3 << 18) & M30;
1218 r->
v[3] = (a3 >> 12 | a4 << 14) & M30;
1219 r->
v[4] = (a4 >> 16 | a5 << 10) & M30;
1220 r->
v[5] = (a5 >> 20 | a6 << 6) & M30;
1221 r->
v[6] = (a6 >> 24 | a7 << 2
1223 r->
v[7] = (a8 >> 2 | a9 << 24) & M30;
1228 {{-0x3D1, -4, 0, 0, 0, 0, 0, 0, 65536}},