crypto/bn/bn_nist.c

   1 /* crypto/bn/bn_nist.p */
   2 /* ====================================================================
   3  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the
  15  *    distribution.
  16  *
  17  * 3. All advertising materials mentioning features or use of this
  18  *    software must display the following acknowledgment:
  19  *    "This product includes software developed by the OpenSSL Project
  20  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  21  *
  22  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  23  *    endorse or promote products derived from this software without
  24  *    prior written permission. For written permission, please contact
  25  *    openssl-core@openssl.org.
  26  *
  27  * 5. Products derived from this software may not be called "OpenSSL"
  28  *    nor may "OpenSSL" appear in their names without prior written
  29  *    permission of the OpenSSL Project.
  30  *
  31  * 6. Redistributions of any form whatsoever must retain the following
  32  *    acknowledgment:
  33  *    "This product includes software developed by the OpenSSL Project
  34  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  37  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  39  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  40  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  41  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  42  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  43  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  44  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  45  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  46  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  47  * OF THE POSSIBILITY OF SUCH DAMAGE.
  48  * ====================================================================
  49  *
  50  * This product includes cryptographic software written by Eric Young
  51  * (eay@cryptsoft.com).  This product includes software written by Tim
  52  * Hudson (tjh@cryptsoft.com).
  53  *
  54  */
  55
  56 #include "bn_lcl.h"
  57
  58 #define BN_NIST_192_TOP (192+BN_BITS2-1)/BN_BITS2
  59 #define BN_NIST_224_TOP (224+BN_BITS2-1)/BN_BITS2
  60 #define BN_NIST_256_TOP (256+BN_BITS2-1)/BN_BITS2
  61 #define BN_NIST_384_TOP (384+BN_BITS2-1)/BN_BITS2
  62 #define BN_NIST_521_TOP (521+BN_BITS2-1)/BN_BITS2
  63
  64 #if BN_BITS2 == 64
  65 const static BN_ULONG _nist_p_192[] = {0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFE,
  66         0xFFFFFFFFFFFFFFFF};
  67 const static BN_ULONG _nist_p_224[] = {0x0000000000000001,0xFFFFFFFF00000000,
  68         0xFFFFFFFFFFFFFFFF,0x00000000FFFFFFFF};
  69 const static BN_ULONG _nist_p_256[] = {0xFFFFFFFFFFFFFFFF,0x00000000FFFFFFFF,
  70         0x0000000000000000,0xFFFFFFFF00000001};
  71 const static BN_ULONG _nist_p_384[] = {0x00000000FFFFFFFF,0xFFFFFFFF00000000,
  72         0xFFFFFFFFFFFFFFFE,0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  73         0xFFFFFFFFFFFFFFFF};
  74 const static BN_ULONG _nist_p_521[] = {0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  75         0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  76         0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  77         0x00000000000001FF};
  78 #elif BN_BITS2 == 32
  79 const static BN_ULONG _nist_p_192[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFE,
  80         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
  81 const static BN_ULONG _nist_p_224[] = {0x00000001,0x00000000,0x00000000,
  82         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
  83 const static BN_ULONG _nist_p_256[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  84         0x00000000,0x00000000,0x00000000,0x00000001,0xFFFFFFFF};
  85 const static BN_ULONG _nist_p_384[] = {0xFFFFFFFF,0x00000000,0x00000000,
  86         0xFFFFFFFF,0xFFFFFFFE,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  87         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
  88 const static BN_ULONG _nist_p_521[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  89         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  90         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  91         0xFFFFFFFF,0x000001FF};
  92 #elif BN_BITS2 == 16
  93 const static BN_ULONG _nist_p_192[] = {0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFE,
  94         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF};
  95 const static BN_ULONG _nist_p_224[] = {0x0001,0x0000,0x0000,0x0000,0x0000,
  96         0x0000,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF};
  97 const static BN_ULONG _nist_p_256[] = {0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
  98         0xFFFF,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0001,0x0000,0xFFFF,
  99         0xFFFF};
 100 const static BN_ULONG _nist_p_384[] = {0xFFFF,0xFFFF,0x0000,0x0000,0x0000,
 101         0x0000,0xFFFF,0xFFFF,0xFFFE,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 102         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF};
 103 const static BN_ULONG _nist_p_521[] = {0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 104         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 105         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 106         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0x01FF};
 107 #elif BN_BITS2 == 8
 108 const static BN_ULONG _nist_p_192[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 109         0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 110         0xFF,0xFF};
 111 const static BN_ULONG _nist_p_224[] = {0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 112         0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 113         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 114 const static BN_ULONG _nist_p_256[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 115         0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 116         0x00,0x00,0x01,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF};
 117 const static BN_ULONG _nist_p_384[] = {0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x00,
 118         0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,
 119         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 120         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 121 const static BN_ULONG _nist_p_521[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 122         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 123         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 124         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 125         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 126         0xFF,0x01};
 127 #endif
 128
 129 const BIGNUM *BN_get0_nist_prime_192(void)
 130         {
 131         static BIGNUM const_nist_192={(BN_ULONG *)_nist_p_192,BN_NIST_192_TOP,
 132                 BN_NIST_192_TOP, 0, BN_FLG_STATIC_DATA};
 133         return &const_nist_192;
 134         }
 135
 136 const BIGNUM *BN_get0_nist_prime_224(void)
 137         {
 138         static BIGNUM const_nist_224={(BN_ULONG *)_nist_p_224,BN_NIST_224_TOP,
 139                 BN_NIST_224_TOP, 0, BN_FLG_STATIC_DATA};
 140         return &const_nist_224;
 141         }
 142
 143 const BIGNUM *BN_get0_nist_prime_256(void)
 144         {
 145         static BIGNUM const_nist_256={(BN_ULONG *)_nist_p_256,BN_NIST_256_TOP,
 146                 BN_NIST_256_TOP, 0, BN_FLG_STATIC_DATA};
 147         return &const_nist_256;
 148         }
 149
 150 const BIGNUM *BN_get0_nist_prime_384(void)
 151         {
 152         static BIGNUM const_nist_384={(BN_ULONG *)_nist_p_384,BN_NIST_384_TOP,
 153                 BN_NIST_384_TOP, 0, BN_FLG_STATIC_DATA};
 154         return &const_nist_384;
 155         }
 156
 157 const BIGNUM *BN_get0_nist_prime_521(void)
 158         {
 159         static BIGNUM const_nist_521={(BN_ULONG *)_nist_p_521,BN_NIST_521_TOP,
 160                 BN_NIST_521_TOP, 0, BN_FLG_STATIC_DATA};
 161         return &const_nist_521;
 162         }
 163
 164 /* some misc internal functions */
 165 static BN_ULONG _256_data[BN_NIST_256_TOP*6];
 166 static int _is_set_256_data = 0;
 167 static void _init_256_data(void);
 168
 169 static BN_ULONG _384_data[BN_NIST_384_TOP*8];
 170 static int _is_set_384_data = 0;
 171 static void _init_384_data(void);
 172
 173 #define BN_NIST_ADD_ONE(a)      while (!(++(*(a)))) ++(a);
 174 #define __buf_0                 (BN_ULONG)0
 175 #define __buf_0_1               (BN_ULONG)0
 176 #define __buf_0_2               (BN_ULONG)0
 177 #if BN_BITS2 == 64
 178 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n = (BN_ULONG)0;
 179 #define BN_CP_64_TO_BUF(n)      __buf_##n = (a)[(n)];
 180 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n;
 181 #define BN_CASE_64_BIT(n,a)     case (n): __buf_##n = (a)[(n)];
 182 #if     UINT_MAX == 4294967295UL
 183 #define nist32  unsigned int
 184 #define BN_32_BIT_BUF(n)        nist32 __buf_##n = (nist32)0;
 185 #define BN_CP_32_TO_BUF(n)      __buf_##n = ((nist32 *)(a))[(n)];
 186 #define BN_CP_32_FROM_BUF(a,n)  *((nist32)(a))++ = __buf_##n;
 187 #define BN_CASE_32_BIT(n,a)     case (n): __buf_##n = ((nist32)(a))[(n)];
 188 #elif   ULONG_MAX == 4294967295UL
 189 #define nist32  unsigned long
 190 #define BN_32_BIT_BUF(n)        nist32 __buf_##n = (nist32)0;
 191 #define BN_CP_32_TO_BUF(n)      __buf_##n = ((nist32 *)(a))[(n)];
 192 #define BN_CP_32_FROM_BUF(a,n)  *((nist32)(a))++ = __buf_##n;
 193 #define BN_CASE_32_BIT(n,a)     case (n): __buf_##n = ((nist32)(a))[(n)];
 194 #else
 195 #define NO_32_BIT_TYPE
 196 #endif
 197 #elif BN_BITS2 == 32
 198 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 199                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;
 200 #define BN_CP_64_TO_BUF(n)      __buf_##n##_2 = (a)[2*(n)+1];\
 201                                 __buf_##n##_1 = (a)[2*(n)];
 202 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 203                                 *(a)++ = __buf_##n##_2;
 204 #define BN_CASE_64_BIT(n,a)     case 2*(n)+1: __buf_##n##_2 = (a)[2*(n)+1];\
 205                                 case 2*(n):   __buf_##n##_1 = (a)[2*(n)];
 206
 207 #define BN_32_BIT_BUF(n)        BN_ULONG __buf_##n = (BN_ULONG)0;
 208 #define BN_CP_32_TO_BUF(n)      __buf_##n = (a)[(n)];
 209 #define BN_CP_32_FROM_BUF(a,n)  *(a)++ = __buf_##n;
 210 #define BN_CASE_32_BIT(n,a)     case (n): __buf_##n = (a)[(n)];
 211 #elif BN_BITS2 == 16
 212 #define __buf_0_3               (BN_ULONG)0
 213 #define __buf_0_4               (BN_ULONG)0
 214 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 215                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;\
 216                                 BN_ULONG __buf_##n##_3 = (BN_ULONG)0;\
 217                                 BN_ULONG __buf_##n##_4 = (BN_ULONG)0;
 218 #define BN_CP_64_TO_BUF(n)      __buf_##n##_4 = (a)[4*(n)+3];\
 219                                 __buf_##n##_3 = (a)[4*(n)+2];\
 220                                 __buf_##n##_2 = (a)[4*(n)+1];\
 221                                 __buf_##n##_1 = (a)[4*(n)];
 222 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 223                                 *(a)++ = __buf_##n##_2;\
 224                                 *(a)++ = __buf_##n##_3;\
 225                                 *(a)++ = __buf_##n##_4;
 226 #define BN_CASE_64_BIT(n,a)     case 4*(n)+3: __buf_##n##_4 = (a)[4*(n)+3];\
 227                                 case 4*(n)+2: __buf_##n##_3 = (a)[4*(n)+2];\
 228                                 case 4*(n)+1: __buf_##n##_2 = (a)[4*(n)+1];\
 229                                 case 4*(n):   __buf_##n##_1 = (a)[4*(n)];
 230 #define BN_32_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 231                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;
 232 #define BN_CP_32_TO_BUF(n)      __buf_##n##_1 = (a)[2*(n)];\
 233                                 __buf_##n##_2 = (a)[2*(n)+1];
 234 #define BN_CP_32_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 235                                 *(a)++ = __buf_##n##_2;
 236 #define BN_CASE_32_BIT(n,a)     case 2*(n)+1: __buf_##n##_2 = (a)[2*(n)+1];\
 237                                 case 2*(n):   __buf_##n##_1 = (a)[2*(n)];
 238 #elif BN_BITS2 == 8
 239 #define __buf_0_3               (BN_ULONG)0
 240 #define __buf_0_4               (BN_ULONG)0
 241 #define __buf_0_5               (BN_ULONG)0
 242 #define __buf_0_6               (BN_ULONG)0
 243 #define __buf_0_7               (BN_ULONG)0
 244 #define __buf_0_8               (BN_ULONG)0
 245 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 246                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;\
 247                                 BN_ULONG __buf_##n##_3 = (BN_ULONG)0;\
 248                                 BN_ULONG __buf_##n##_4 = (BN_ULONG)0;\
 249                                 BN_ULONG __buf_##n##_5 = (BN_ULONG)0;\
 250                                 BN_ULONG __buf_##n##_6 = (BN_ULONG)0;\
 251                                 BN_ULONG __buf_##n##_7 = (BN_ULONG)0;\
 252                                 BN_ULONG __buf_##n##_8 = (BN_ULONG)0;
 253 #define BN_CP_64_TO_BUF(n)      __buf_##n##_8 = (a)[8*(n)+7];\
 254                                 __buf_##n##_7 = (a)[8*(n)+6];\
 255                                 __buf_##n##_6 = (a)[8*(n)+5];\
 256                                 __buf_##n##_5 = (a)[8*(n)+4];\
 257                                 __buf_##n##_4 = (a)[8*(n)+3];\
 258                                 __buf_##n##_3 = (a)[8*(n)+2];\
 259                                 __buf_##n##_2 = (a)[8*(n)+1];\
 260                                 __buf_##n##_1 = (a)[8*(n)];
 261 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 262                                 *(a)++ = __buf_##n##_2;\
 263                                 *(a)++ = __buf_##n##_3;\
 264                                 *(a)++ = __buf_##n##_4;\
 265                                 *(a)++ = __buf_##n##_5;\
 266                                 *(a)++ = __buf_##n##_6;\
 267                                 *(a)++ = __buf_##n##_7;\
 268                                 *(a)++ = __buf_##n##_8;
 269 #define BN_CASE_64_BIT(n,a)     case 8*(n)+7: __buf_##n##_8 = (a)[8*(n)+7];\
 270                                 case 8*(n)+6: __buf_##n##_7 = (a)[8*(n)+6];\
 271                                 case 8*(n)+5: __buf_##n##_6 = (a)[8*(n)+5];\
 272                                 case 8*(n)+4: __buf_##n##_5 = (a)[8*(n)+4];\
 273                                 case 8*(n)+3: __buf_##n##_4 = (a)[8*(n)+3];\
 274                                 case 8*(n)+2: __buf_##n##_3 = (a)[8*(n)+2];\
 275                                 case 8*(n)+1: __buf_##n##_2 = (a)[8*(n)+1];\
 276                                 case 8*(n):   __buf_##n##_1 = (a)[8*(n)];
 277 #define BN_32_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 278                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;\
 279                                 BN_ULONG __buf_##n##_3 = (BN_ULONG)0;\
 280                                 BN_ULONG __buf_##n##_4 = (BN_ULONG)0;
 281 #define BN_CP_32_TO_BUF(n)      __buf_##n##_1 = (a)[4*(n)];\
 282                                 __buf_##n##_2 = (a)[4*(n)+1];\
 283                                 __buf_##n##_3 = (a)[4*(n)+2];\
 284                                 __buf_##n##_4 = (a)[4*(n)+3];
 285 #define BN_CP_32_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 286                                 *(a)++ = __buf_##n##_2;\
 287                                 *(a)++ = __buf_##n##_3;\
 288                                 *(a)++ = __buf_##n##_4;
 289 #define BN_CASE_32_BIT(n,a)     case 4*(n)+3: __buf_##n##_4 = (a)[4*(n)+3];\
 290                                 case 4*(n)+2: __buf_##n##_3 = (a)[4*(n)+2];\
 291                                 case 4*(n)+1: __buf_##n##_2 = (a)[4*(n)+1];\
 292                                 case 4*(n):   __buf_##n##_1 = (a)[4*(n)];
 293 #endif
 294
 295
 296 #define BN_192_SET(d,a1,a2,a3) \
 297         {\
 298         register BN_ULONG *td = (d);\
 299         BN_CP_64_FROM_BUF(td,a3); BN_CP_64_FROM_BUF(td,a2);\
 300         BN_CP_64_FROM_BUF(td,a1);\
 301         }
 302
 303 int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 304         BN_CTX *ctx)
 305         {
 306         int      top;
 307         BN_ULONG carry = 0;
 308         register BN_ULONG *r_d, *a_d;
 309         BN_ULONG t_d[BN_NIST_192_TOP];
 310         BN_64_BIT_BUF(3)  BN_64_BIT_BUF(4)
 311         BN_64_BIT_BUF(5)
 312
 313         top = BN_ucmp(field, a);
 314         if (top == 0)
 315                 return BN_zero(r);
 316         else if (top > 0)
 317                 return (r == a)? 1 : !!BN_copy(r ,a);
 318
 319         if (r != a)
 320                 if (!BN_ncopy(r, a, BN_NIST_192_TOP))
 321                         return 0;
 322
 323         r_d = r->d;
 324         a_d = a->d;
 325         top = a->top-1;
 326
 327         switch (top)
 328                 {
 329                 BN_CASE_64_BIT(5, a_d)
 330                 BN_CASE_64_BIT(4, a_d)
 331                 BN_CASE_64_BIT(3, a_d)
 332                         break;
 333                 default: /* a->top == field->top */
 334                         return BN_usub(r, a, field);
 335                 }
 336
 337         BN_192_SET(t_d,0,3,3)
 338         if (bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP))
 339                 ++carry;
 340
 341         BN_192_SET(t_d,4,4,0)
 342         if (bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP))
 343                 ++carry;
 344
 345         BN_192_SET(t_d,5,5,5)
 346         if (bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP))
 347                 ++carry;
 348
 349         while (carry)
 350                 {
 351                 if (bn_sub_words(r_d, r_d, _nist_p_192, BN_NIST_192_TOP))
 352                         --carry;
 353                 }
 354         r->top = BN_NIST_192_TOP;
 355
 356 #if 0
 357         bn_clear_top2max(r);
 358 #endif
 359         bn_fix_top(r);
 360
 361         if (BN_ucmp(r, field) >= 0)
 362                 {
 363                 bn_sub_words(r_d, r_d, _nist_p_192, BN_NIST_192_TOP);
 364                 bn_fix_top(r);
 365                 }
 366
 367         return 1;
 368         }
 369
 370 #define BN_224_SET(d,a1,a2,a3,a4,a5,a6,a7) \
 371         {\
 372         register BN_ULONG *td = (d);\
 373         BN_CP_32_FROM_BUF(td,a7); BN_CP_32_FROM_BUF(td,a6);\
 374         BN_CP_32_FROM_BUF(td,a5); BN_CP_32_FROM_BUF(td,a4);\
 375         BN_CP_32_FROM_BUF(td,a3); BN_CP_32_FROM_BUF(td,a2);\
 376         BN_CP_32_FROM_BUF(td,a1);\
 377         }
 378
 379 int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 380         BN_CTX *ctx)
 381         {
 382 #ifndef NO_32_BIT_TYPE
 383         int     tmp_int;
 384         int     carry = 0;
 385         BN_ULONG *r_d, *a_d;
 386         BN_ULONG t_d[BN_NIST_224_TOP];
 387         BN_32_BIT_BUF(7)  BN_32_BIT_BUF(8)
 388         BN_32_BIT_BUF(9)  BN_32_BIT_BUF(10)
 389         BN_32_BIT_BUF(11) BN_32_BIT_BUF(12)
 390         BN_32_BIT_BUF(13)
 391
 392         tmp_int = BN_ucmp(field, a);
 393         if (tmp_int == 0)
 394                 return BN_zero(r);
 395         else if (tmp_int > 0)
 396                 return (r == a)? 1 : !!BN_copy(r ,a);
 397
 398         if (r != a)
 399                 if (!BN_ncopy(r, a, BN_NIST_224_TOP))
 400                         return 0;
 401
 402         r_d = r->d;
 403         a_d = a->d;
 404
 405         tmp_int = a->top-1;
 406
 407         switch (tmp_int)
 408                 {
 409                 BN_CASE_32_BIT(13, a_d)
 410                 BN_CASE_32_BIT(12, a_d)
 411                 BN_CASE_32_BIT(11, a_d)
 412                 BN_CASE_32_BIT(10, a_d)
 413                 BN_CASE_32_BIT(9,  a_d)
 414                 BN_CASE_32_BIT(8,  a_d)
 415                 BN_CASE_32_BIT(7,  a_d)
 416                         break;
 417                 default: /* a->top == field->top */
 418                         return BN_usub(r, a, field);
 419                 }
 420
 421         BN_224_SET(t_d,10,9,8,7,0,0,0)
 422         if (bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 423                 ++carry;
 424         BN_224_SET(t_d,0,13,12,11,0,0,0)
 425         if (bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 426                 ++carry;
 427         BN_224_SET(t_d,13,12,11,10,9,8,7)
 428         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 429                 --carry;
 430         BN_224_SET(t_d,0,0,0,0,13,12,11)
 431         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 432                 --carry;
 433
 434         if (carry > 0)
 435                 while (carry)
 436                         {
 437                         if (bn_sub_words(r_d,r_d,_nist_p_224,BN_NIST_224_TOP))
 438                                 --carry;
 439                         }
 440         else if (carry < 0)
 441                 while (carry)
 442                         {
 443                         if (bn_add_words(r_d,r_d,_nist_p_224,BN_NIST_224_TOP))
 444                                 ++carry;
 445                         }
 446
 447         r->top = BN_NIST_224_TOP;
 448 #if 0
 449         bn_clear_top2max(r);
 450 #endif
 451         bn_fix_top(r);
 452
 453         if (BN_ucmp(r, field) >= 0)
 454                 {
 455                 bn_sub_words(r_d, r_d, _nist_p_224, BN_NIST_224_TOP);
 456                 bn_fix_top(r);
 457                 }
 458         return 1;
 459 #else
 460         return 0;
 461 #endif
 462         }
 463
 464 static void _init_256_data(void)
 465         {
 466         int     i;
 467         BN_ULONG *tmp1 = _256_data;
 468         const BN_ULONG *tmp2 = tmp1;
 469
 470         memcpy(tmp1, _nist_p_256, BN_NIST_256_TOP * sizeof(BN_ULONG));
 471         tmp1 += BN_NIST_256_TOP;
 472
 473         for (i=0; i<5; i++)
 474                 {
 475                 bn_add_words(tmp1, _nist_p_256, tmp2, BN_NIST_256_TOP);
 476                 tmp2  = tmp1;
 477                 tmp1 += BN_NIST_256_TOP;
 478                 }
 479         _is_set_256_data = 1;
 480         }
 481
 482 #define BN_256_SET(d,a1,a2,a3,a4,a5,a6,a7,a8) \
 483         {\
 484         register BN_ULONG *td = (d);\
 485         BN_CP_32_FROM_BUF(td,a8); BN_CP_32_FROM_BUF(td,a7);\
 486         BN_CP_32_FROM_BUF(td,a6); BN_CP_32_FROM_BUF(td,a5);\
 487         BN_CP_32_FROM_BUF(td,a4); BN_CP_32_FROM_BUF(td,a3);\
 488         BN_CP_32_FROM_BUF(td,a2); BN_CP_32_FROM_BUF(td,a1);\
 489         }
 490
 491 int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 492         BN_CTX *ctx)
 493         {
 494 #ifndef NO_32_BIT_TYPE
 495         int     tmp_int;
 496         int     carry = 0;
 497         register BN_ULONG *a_d, *r_d;
 498         BN_ULONG t_d[BN_NIST_256_TOP];
 499         BN_ULONG t_d2[BN_NIST_256_TOP];
 500         BN_32_BIT_BUF(8)  BN_32_BIT_BUF(9)
 501         BN_32_BIT_BUF(10) BN_32_BIT_BUF(11)
 502         BN_32_BIT_BUF(12) BN_32_BIT_BUF(13)
 503         BN_32_BIT_BUF(14) BN_32_BIT_BUF(15)
 504
 505         if (!_is_set_256_data)
 506                 _init_256_data();
 507
 508         tmp_int = BN_ucmp(field, a);
 509         if (tmp_int == 0)
 510                 return BN_zero(r);
 511         else if (tmp_int > 0)
 512                 return (r == a)? 1 : !!BN_copy(r ,a);
 513
 514         if (r != a)
 515                 if (!BN_ncopy(r, a, BN_NIST_256_TOP))
 516                         return 0;
 517
 518         tmp_int = a->top-1;
 519
 520         a_d = a->d;
 521         r_d = r->d;
 522         switch (tmp_int)
 523                 {
 524                 BN_CASE_32_BIT(15, a_d)
 525                 BN_CASE_32_BIT(14, a_d)
 526                 BN_CASE_32_BIT(13, a_d)
 527                 BN_CASE_32_BIT(12, a_d)
 528                 BN_CASE_32_BIT(11, a_d)
 529                 BN_CASE_32_BIT(10, a_d)
 530                 BN_CASE_32_BIT(9,  a_d)
 531                 BN_CASE_32_BIT(8,  a_d)
 532                         break;
 533                 default: /* a->top == field->top */
 534                         return BN_usub(r, a, field);
 535                 }
 536
 537         /*S1*/
 538         BN_256_SET(t_d,15,14,13,12,11,0,0,0)
 539         /*S2*/
 540         BN_256_SET(t_d2,0,15,14,13,12,0,0,0)
 541         if (bn_add_words(t_d, t_d, t_d2, BN_NIST_256_TOP))
 542                 carry = 2;
 543         /* left shift */
 544                 {
 545                 register BN_ULONG *ap,t,c;
 546                 ap = t_d;
 547                 c=0;
 548                 for (tmp_int=BN_NIST_256_TOP; tmp_int != 0; --tmp_int)
 549                         {
 550                         t= *ap;
 551                         *(ap++)=((t<<1)|c)&BN_MASK2;
 552                         c=(t & BN_TBIT)?1:0;
 553                         }
 554                 if (c)
 555                         ++carry;
 556                 }
 557
 558         if (bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 559                 ++carry;
 560         /*S3*/
 561         BN_256_SET(t_d,15,14,0,0,0,10,9,8)
 562         if (bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 563                 ++carry;
 564         /*S4*/
 565         BN_256_SET(t_d,8,13,15,14,13,11,10,9)
 566         if (bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 567                 ++carry;
 568         /*D1*/
 569         BN_256_SET(t_d,10,8,0,0,0,13,12,11)
 570         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 571                 --carry;
 572         /*D2*/
 573         BN_256_SET(t_d,11,9,0,0,15,14,13,12)
 574         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 575                 --carry;
 576         /*D3*/
 577         BN_256_SET(t_d,12,0,10,9,8,15,14,13)
 578         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 579                 --carry;
 580         /*D4*/
 581         BN_256_SET(t_d,13,0,11,10,9,0,15,14)
 582         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 583                 --carry;
 584
 585         if (carry)
 586                 {
 587                 if (carry > 0)
 588                         bn_sub_words(r_d, r_d, _256_data + BN_NIST_256_TOP *
 589                                 --carry, BN_NIST_256_TOP);
 590                 else
 591                         {
 592                         carry = -carry;
 593                         bn_add_words(r_d, r_d, _256_data + BN_NIST_256_TOP *
 594                                 --carry, BN_NIST_256_TOP);
 595                         }
 596                 }
 597
 598         r->top = BN_NIST_256_TOP;
 599 #if 0
 600         bn_clear_top2max(r);
 601 #endif
 602         bn_fix_top(r);
 603
 604         if (BN_ucmp(r, field) >= 0)
 605                 {
 606                 bn_sub_words(r_d, r_d, _nist_p_256, BN_NIST_256_TOP);
 607                 bn_fix_top(r);
 608                 }
 609         return 1;
 610 #else
 611         return 0;
 612 #endif
 613         }
 614
 615 static void _init_384_data(void)
 616         {
 617         int     i;
 618         BN_ULONG *tmp1 = _384_data;
 619         const BN_ULONG *tmp2 = tmp1;
 620
 621         memcpy(tmp1, _nist_p_384, BN_NIST_384_TOP * sizeof(BN_ULONG));
 622         tmp1 += BN_NIST_384_TOP;
 623
 624         for (i=0; i<7; i++)
 625                 {
 626                 bn_add_words(tmp1, _nist_p_384, tmp2, BN_NIST_384_TOP);
 627                 tmp2  = tmp1;
 628                 tmp1 += BN_NIST_384_TOP;
 629                 }
 630         _is_set_384_data = 1;
 631         }
 632
 633 #define BN_384_SET(d,a1,a2,a3,a4,a5,a6,a7,a8,a9,a10,a11,a12) \
 634         {\
 635         register BN_ULONG *td = (d);\
 636         BN_CP_32_FROM_BUF(td,a12); BN_CP_32_FROM_BUF(td,a11);\
 637         BN_CP_32_FROM_BUF(td,a10); BN_CP_32_FROM_BUF(td,a9);\
 638         BN_CP_32_FROM_BUF(td,a8);  BN_CP_32_FROM_BUF(td,a7);\
 639         BN_CP_32_FROM_BUF(td,a6);  BN_CP_32_FROM_BUF(td,a5);\
 640         BN_CP_32_FROM_BUF(td,a4);  BN_CP_32_FROM_BUF(td,a3);\
 641         BN_CP_32_FROM_BUF(td,a2);  BN_CP_32_FROM_BUF(td,a1);\
 642         }
 643
 644 int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 645         BN_CTX *ctx)
 646         {
 647 #ifndef NO_32_BIT_TYPE
 648         int     tmp_int;
 649         int     carry = 0;
 650         register BN_ULONG *r_d, *a_d;
 651         BN_ULONG t_d[BN_NIST_384_TOP];
 652         BN_32_BIT_BUF(12) BN_32_BIT_BUF(13)
 653         BN_32_BIT_BUF(14) BN_32_BIT_BUF(15)
 654         BN_32_BIT_BUF(16) BN_32_BIT_BUF(17)
 655         BN_32_BIT_BUF(18) BN_32_BIT_BUF(19)
 656         BN_32_BIT_BUF(20) BN_32_BIT_BUF(21)
 657         BN_32_BIT_BUF(22) BN_32_BIT_BUF(23)
 658
 659         if (!_is_set_384_data)
 660                 _init_384_data();
 661
 662         tmp_int = BN_ucmp(field, a);
 663         if (tmp_int == 0)
 664                 return BN_zero(r);
 665         else if (tmp_int > 0)
 666                 return (r == a)? 1 : !!BN_copy(r ,a);
 667
 668         if (r != a)
 669                 if (!BN_ncopy(r, a, BN_NIST_384_TOP))
 670                         return 0;
 671
 672         r_d = r->d;
 673         a_d = a->d;
 674         tmp_int = a->top-1;
 675
 676         switch (tmp_int)
 677                 {
 678                 BN_CASE_32_BIT(23, a_d)
 679                 BN_CASE_32_BIT(22, a_d)
 680                 BN_CASE_32_BIT(21, a_d)
 681                 BN_CASE_32_BIT(20, a_d)
 682                 BN_CASE_32_BIT(19, a_d)
 683                 BN_CASE_32_BIT(18, a_d)
 684                 BN_CASE_32_BIT(17, a_d)
 685                 BN_CASE_32_BIT(16, a_d)
 686                 BN_CASE_32_BIT(15, a_d)
 687                 BN_CASE_32_BIT(14, a_d)
 688                 BN_CASE_32_BIT(13, a_d)
 689                 BN_CASE_32_BIT(12, a_d)
 690                         break;
 691                 default: /* a->top == field->top */
 692                         return BN_usub(r, a, field);
 693                 }
 694
 695         /*S1*/
 696         BN_256_SET(t_d,0,0,0,0,0,23,22,21)
 697                 /* left shift */
 698                 {
 699                 register BN_ULONG *ap,t,c;
 700                 ap = t_d;
 701                 c=0;
 702                 for (tmp_int=BN_NIST_256_TOP; tmp_int != 0; --tmp_int)
 703                         {
 704                         t= *ap;
 705                         *(ap++)=((t<<1)|c)&BN_MASK2;
 706                         c=(t & BN_TBIT)?1:0;
 707                         }
 708                 }
 709         if (bn_add_words(r_d+(128/BN_BITS2), r_d+(128/BN_BITS2),
 710                 t_d, BN_NIST_256_TOP))
 711                 ++carry;
 712         /*S2*/
 713         BN_384_SET(t_d,23,22,21,20,19,18,17,16,15,14,13,12)
 714         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 715                 ++carry;
 716         /*S3*/
 717         BN_384_SET(t_d,20,19,18,17,16,15,14,13,12,23,22,21)
 718         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 719                 ++carry;
 720         /*S4*/
 721         BN_384_SET(t_d,19,18,17,16,15,14,13,12,20,0,23,0)
 722         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 723                 ++carry;
 724         /*S5*/
 725         BN_256_SET(t_d,0,0,0,0,23,22,21,20)
 726         if (bn_add_words(r_d+(128/BN_BITS2), r_d+(128/BN_BITS2),
 727                 t_d, BN_NIST_256_TOP))
 728                 ++carry;
 729         /*S6*/
 730         BN_384_SET(t_d,0,0,0,0,0,0,23,22,21,0,0,20)
 731         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 732                 ++carry;
 733         /*D1*/
 734         BN_384_SET(t_d,22,21,20,19,18,17,16,15,14,13,12,23)
 735         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 736                 --carry;
 737         /*D2*/
 738         BN_384_SET(t_d,0,0,0,0,0,0,0,23,22,21,20,0)
 739         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 740                 --carry;
 741         /*D3*/
 742         BN_384_SET(t_d,0,0,0,0,0,0,0,23,23,0,0,0)
 743         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 744                 --carry;
 745
 746         if (carry)
 747                 {
 748                 if (carry > 0)
 749                         bn_sub_words(r_d, r_d, _384_data + BN_NIST_384_TOP *
 750                                 --carry, BN_NIST_384_TOP);
 751                 else
 752                         {
 753                         carry = -carry;
 754                         bn_add_words(r_d, r_d, _384_data + BN_NIST_384_TOP *
 755                                 --carry, BN_NIST_384_TOP);
 756                         }
 757                 }
 758
 759         r->top = BN_NIST_384_TOP;
 760 #if 0
 761         bn_clear_top2max(r);
 762 #endif
 763         bn_fix_top(r);
 764
 765         if (BN_ucmp(r, field) >= 0)
 766                 {
 767                 bn_sub_words(r_d, r_d, _nist_p_384, BN_NIST_384_TOP);
 768                 bn_fix_top(r);
 769                 }
 770         return 1;
 771 #else
 772         return 0;
 773 #endif
 774         }
 775
 776 int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 777         BN_CTX *ctx)
 778         {
 779 #if BN_BITS2 == 64
 780 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
 781 #elif BN_BITS2 == 32
 782 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
 783 #elif BN_BITS2 == 16
 784 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
 785 #elif BN_BITS2 == 8
 786 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1
 787 #endif
 788         int     top, ret = 0;
 789         BN_ULONG *r_d;
 790         BIGNUM  *tmp;
 791
 792         /* check whether a reduction is necessary */
 793         top = a->top;
 794         if (top < BN_NIST_521_TOP  || ( top == BN_NIST_521_TOP &&
 795            (!(a->d[BN_NIST_521_TOP-1] & ~(BN_NIST_521_TOP_MASK)))))
 796                 return (r == a)? 1 : !!BN_copy(r ,a);
 797
 798         BN_CTX_start(ctx);
 799         tmp = BN_CTX_get(ctx);
 800         if (!tmp)
 801                 goto err;
 802
 803         if (!BN_ncopy(tmp, a, BN_NIST_521_TOP))
 804                 return 0;
 805         if (!BN_rshift(r, a, 521))
 806                 return 0;
 807
 808         if (tmp->top == BN_NIST_521_TOP)
 809                 tmp->d[BN_NIST_521_TOP-1]  &= BN_NIST_521_TOP_MASK;
 810
 811         if (!BN_uadd(r, tmp, r))
 812                 return 0;
 813         top = r->top;
 814         r_d = r->d;
 815         if (top == BN_NIST_521_TOP  &&
 816            (r_d[BN_NIST_521_TOP-1] & ~(BN_NIST_521_TOP_MASK)))
 817                 {
 818                 BN_NIST_ADD_ONE(r_d)
 819                 r_d[BN_NIST_521_TOP-1] &= BN_NIST_521_TOP_MASK;
 820                 }
 821         bn_fix_top(r);
 822
 823         ret = 1;
 824 err:
 825         BN_CTX_end(ctx);
 826
 827         return ret;
 828         }