|
9
|
1 |
<?php
|
|
|
2 |
|
|
|
3 |
if (class_exists('ParagonIE_Sodium_Core_Curve25519', false)) {
|
|
|
4 |
return;
|
|
|
5 |
}
|
|
|
6 |
|
|
|
7 |
/**
|
|
|
8 |
* Class ParagonIE_Sodium_Core_Curve25519
|
|
|
9 |
*
|
|
|
10 |
* Implements Curve25519 core functions
|
|
|
11 |
*
|
|
|
12 |
* Based on the ref10 curve25519 code provided by libsodium
|
|
|
13 |
*
|
|
|
14 |
* @ref https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c
|
|
|
15 |
*/
|
|
|
16 |
abstract class ParagonIE_Sodium_Core_Curve25519 extends ParagonIE_Sodium_Core_Curve25519_H
|
|
|
17 |
{
|
|
|
18 |
/**
|
|
|
19 |
* Get a field element of size 10 with a value of 0
|
|
|
20 |
*
|
|
|
21 |
* @internal You should not use this directly from another application
|
|
|
22 |
*
|
|
|
23 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
24 |
*/
|
|
|
25 |
public static function fe_0()
|
|
|
26 |
{
|
|
|
27 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
|
|
|
28 |
array(0, 0, 0, 0, 0, 0, 0, 0, 0, 0)
|
|
|
29 |
);
|
|
|
30 |
}
|
|
|
31 |
|
|
|
32 |
/**
|
|
|
33 |
* Get a field element of size 10 with a value of 1
|
|
|
34 |
*
|
|
|
35 |
* @internal You should not use this directly from another application
|
|
|
36 |
*
|
|
|
37 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
38 |
*/
|
|
|
39 |
public static function fe_1()
|
|
|
40 |
{
|
|
|
41 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
|
|
|
42 |
array(1, 0, 0, 0, 0, 0, 0, 0, 0, 0)
|
|
|
43 |
);
|
|
|
44 |
}
|
|
|
45 |
|
|
|
46 |
/**
|
|
|
47 |
* Add two field elements.
|
|
|
48 |
*
|
|
|
49 |
* @internal You should not use this directly from another application
|
|
|
50 |
*
|
|
|
51 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
52 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $g
|
|
|
53 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
54 |
* @psalm-suppress MixedAssignment
|
|
|
55 |
* @psalm-suppress MixedOperand
|
|
|
56 |
*/
|
|
|
57 |
public static function fe_add(
|
|
|
58 |
ParagonIE_Sodium_Core_Curve25519_Fe $f,
|
|
|
59 |
ParagonIE_Sodium_Core_Curve25519_Fe $g
|
|
|
60 |
) {
|
|
|
61 |
/** @var array<int, int> $arr */
|
|
|
62 |
$arr = array();
|
|
|
63 |
for ($i = 0; $i < 10; ++$i) {
|
|
|
64 |
$arr[$i] = (int) ($f[$i] + $g[$i]);
|
|
|
65 |
}
|
|
|
66 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($arr);
|
|
|
67 |
}
|
|
|
68 |
|
|
|
69 |
/**
|
|
|
70 |
* Constant-time conditional move.
|
|
|
71 |
*
|
|
|
72 |
* @internal You should not use this directly from another application
|
|
|
73 |
*
|
|
|
74 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
75 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $g
|
|
|
76 |
* @param int $b
|
|
|
77 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
78 |
* @psalm-suppress MixedAssignment
|
|
|
79 |
*/
|
|
|
80 |
public static function fe_cmov(
|
|
|
81 |
ParagonIE_Sodium_Core_Curve25519_Fe $f,
|
|
|
82 |
ParagonIE_Sodium_Core_Curve25519_Fe $g,
|
|
|
83 |
$b = 0
|
|
|
84 |
) {
|
|
|
85 |
/** @var array<int, int> $h */
|
|
|
86 |
$h = array();
|
|
|
87 |
$b *= -1;
|
|
|
88 |
for ($i = 0; $i < 10; ++$i) {
|
|
|
89 |
$x = (($f[$i] ^ $g[$i]) & $b);
|
|
18
|
90 |
$h[$i] = ($f[$i]) ^ $x;
|
|
9
|
91 |
}
|
|
|
92 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($h);
|
|
|
93 |
}
|
|
|
94 |
|
|
|
95 |
/**
|
|
|
96 |
* Create a copy of a field element.
|
|
|
97 |
*
|
|
|
98 |
* @internal You should not use this directly from another application
|
|
|
99 |
*
|
|
|
100 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
101 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
102 |
*/
|
|
|
103 |
public static function fe_copy(ParagonIE_Sodium_Core_Curve25519_Fe $f)
|
|
|
104 |
{
|
|
|
105 |
$h = clone $f;
|
|
|
106 |
return $h;
|
|
|
107 |
}
|
|
|
108 |
|
|
|
109 |
/**
|
|
|
110 |
* Give: 32-byte string.
|
|
|
111 |
* Receive: A field element object to use for internal calculations.
|
|
|
112 |
*
|
|
|
113 |
* @internal You should not use this directly from another application
|
|
|
114 |
*
|
|
|
115 |
* @param string $s
|
|
|
116 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
117 |
* @throws RangeException
|
|
|
118 |
* @throws TypeError
|
|
|
119 |
*/
|
|
|
120 |
public static function fe_frombytes($s)
|
|
|
121 |
{
|
|
|
122 |
if (self::strlen($s) !== 32) {
|
|
|
123 |
throw new RangeException('Expected a 32-byte string.');
|
|
|
124 |
}
|
|
|
125 |
/** @var int $h0 */
|
|
|
126 |
$h0 = self::load_4($s);
|
|
|
127 |
/** @var int $h1 */
|
|
|
128 |
$h1 = self::load_3(self::substr($s, 4, 3)) << 6;
|
|
|
129 |
/** @var int $h2 */
|
|
|
130 |
$h2 = self::load_3(self::substr($s, 7, 3)) << 5;
|
|
|
131 |
/** @var int $h3 */
|
|
|
132 |
$h3 = self::load_3(self::substr($s, 10, 3)) << 3;
|
|
|
133 |
/** @var int $h4 */
|
|
|
134 |
$h4 = self::load_3(self::substr($s, 13, 3)) << 2;
|
|
|
135 |
/** @var int $h5 */
|
|
|
136 |
$h5 = self::load_4(self::substr($s, 16, 4));
|
|
|
137 |
/** @var int $h6 */
|
|
|
138 |
$h6 = self::load_3(self::substr($s, 20, 3)) << 7;
|
|
|
139 |
/** @var int $h7 */
|
|
|
140 |
$h7 = self::load_3(self::substr($s, 23, 3)) << 5;
|
|
|
141 |
/** @var int $h8 */
|
|
|
142 |
$h8 = self::load_3(self::substr($s, 26, 3)) << 4;
|
|
|
143 |
/** @var int $h9 */
|
|
|
144 |
$h9 = (self::load_3(self::substr($s, 29, 3)) & 8388607) << 2;
|
|
|
145 |
|
|
|
146 |
/** @var int $carry9 */
|
|
|
147 |
$carry9 = ($h9 + (1 << 24)) >> 25;
|
|
|
148 |
$h0 += self::mul($carry9, 19, 5);
|
|
|
149 |
$h9 -= $carry9 << 25;
|
|
|
150 |
/** @var int $carry1 */
|
|
|
151 |
$carry1 = ($h1 + (1 << 24)) >> 25;
|
|
|
152 |
$h2 += $carry1;
|
|
|
153 |
$h1 -= $carry1 << 25;
|
|
|
154 |
/** @var int $carry3 */
|
|
|
155 |
$carry3 = ($h3 + (1 << 24)) >> 25;
|
|
|
156 |
$h4 += $carry3;
|
|
|
157 |
$h3 -= $carry3 << 25;
|
|
|
158 |
/** @var int $carry5 */
|
|
|
159 |
$carry5 = ($h5 + (1 << 24)) >> 25;
|
|
|
160 |
$h6 += $carry5;
|
|
|
161 |
$h5 -= $carry5 << 25;
|
|
|
162 |
/** @var int $carry7 */
|
|
|
163 |
$carry7 = ($h7 + (1 << 24)) >> 25;
|
|
|
164 |
$h8 += $carry7;
|
|
|
165 |
$h7 -= $carry7 << 25;
|
|
|
166 |
|
|
|
167 |
/** @var int $carry0 */
|
|
|
168 |
$carry0 = ($h0 + (1 << 25)) >> 26;
|
|
|
169 |
$h1 += $carry0;
|
|
|
170 |
$h0 -= $carry0 << 26;
|
|
|
171 |
/** @var int $carry2 */
|
|
|
172 |
$carry2 = ($h2 + (1 << 25)) >> 26;
|
|
|
173 |
$h3 += $carry2;
|
|
|
174 |
$h2 -= $carry2 << 26;
|
|
|
175 |
/** @var int $carry4 */
|
|
|
176 |
$carry4 = ($h4 + (1 << 25)) >> 26;
|
|
|
177 |
$h5 += $carry4;
|
|
|
178 |
$h4 -= $carry4 << 26;
|
|
|
179 |
/** @var int $carry6 */
|
|
|
180 |
$carry6 = ($h6 + (1 << 25)) >> 26;
|
|
|
181 |
$h7 += $carry6;
|
|
|
182 |
$h6 -= $carry6 << 26;
|
|
|
183 |
/** @var int $carry8 */
|
|
|
184 |
$carry8 = ($h8 + (1 << 25)) >> 26;
|
|
|
185 |
$h9 += $carry8;
|
|
|
186 |
$h8 -= $carry8 << 26;
|
|
|
187 |
|
|
|
188 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
|
|
|
189 |
array(
|
|
|
190 |
(int) $h0,
|
|
|
191 |
(int) $h1,
|
|
|
192 |
(int) $h2,
|
|
|
193 |
(int) $h3,
|
|
|
194 |
(int) $h4,
|
|
|
195 |
(int) $h5,
|
|
|
196 |
(int) $h6,
|
|
|
197 |
(int) $h7,
|
|
|
198 |
(int) $h8,
|
|
|
199 |
(int) $h9
|
|
|
200 |
)
|
|
|
201 |
);
|
|
|
202 |
}
|
|
|
203 |
|
|
|
204 |
/**
|
|
|
205 |
* Convert a field element to a byte string.
|
|
|
206 |
*
|
|
|
207 |
* @internal You should not use this directly from another application
|
|
|
208 |
*
|
|
|
209 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $h
|
|
|
210 |
* @return string
|
|
|
211 |
*/
|
|
|
212 |
public static function fe_tobytes(ParagonIE_Sodium_Core_Curve25519_Fe $h)
|
|
|
213 |
{
|
|
|
214 |
/** @var int $h0 */
|
|
|
215 |
$h0 = (int) $h[0];
|
|
|
216 |
/** @var int $h1 */
|
|
|
217 |
$h1 = (int) $h[1];
|
|
|
218 |
/** @var int $h2 */
|
|
|
219 |
$h2 = (int) $h[2];
|
|
|
220 |
/** @var int $h3 */
|
|
|
221 |
$h3 = (int) $h[3];
|
|
|
222 |
/** @var int $h4 */
|
|
|
223 |
$h4 = (int) $h[4];
|
|
|
224 |
/** @var int $h5 */
|
|
|
225 |
$h5 = (int) $h[5];
|
|
|
226 |
/** @var int $h6 */
|
|
|
227 |
$h6 = (int) $h[6];
|
|
|
228 |
/** @var int $h7 */
|
|
|
229 |
$h7 = (int) $h[7];
|
|
|
230 |
/** @var int $h8 */
|
|
|
231 |
$h8 = (int) $h[8];
|
|
|
232 |
/** @var int $h9 */
|
|
|
233 |
$h9 = (int) $h[9];
|
|
|
234 |
|
|
|
235 |
/** @var int $q */
|
|
|
236 |
$q = (self::mul($h9, 19, 5) + (1 << 24)) >> 25;
|
|
|
237 |
/** @var int $q */
|
|
|
238 |
$q = ($h0 + $q) >> 26;
|
|
|
239 |
/** @var int $q */
|
|
|
240 |
$q = ($h1 + $q) >> 25;
|
|
|
241 |
/** @var int $q */
|
|
|
242 |
$q = ($h2 + $q) >> 26;
|
|
|
243 |
/** @var int $q */
|
|
|
244 |
$q = ($h3 + $q) >> 25;
|
|
|
245 |
/** @var int $q */
|
|
|
246 |
$q = ($h4 + $q) >> 26;
|
|
|
247 |
/** @var int $q */
|
|
|
248 |
$q = ($h5 + $q) >> 25;
|
|
|
249 |
/** @var int $q */
|
|
|
250 |
$q = ($h6 + $q) >> 26;
|
|
|
251 |
/** @var int $q */
|
|
|
252 |
$q = ($h7 + $q) >> 25;
|
|
|
253 |
/** @var int $q */
|
|
|
254 |
$q = ($h8 + $q) >> 26;
|
|
|
255 |
/** @var int $q */
|
|
|
256 |
$q = ($h9 + $q) >> 25;
|
|
|
257 |
|
|
|
258 |
$h0 += self::mul($q, 19, 5);
|
|
|
259 |
|
|
|
260 |
/** @var int $carry0 */
|
|
|
261 |
$carry0 = $h0 >> 26;
|
|
|
262 |
$h1 += $carry0;
|
|
|
263 |
$h0 -= $carry0 << 26;
|
|
|
264 |
/** @var int $carry1 */
|
|
|
265 |
$carry1 = $h1 >> 25;
|
|
|
266 |
$h2 += $carry1;
|
|
|
267 |
$h1 -= $carry1 << 25;
|
|
|
268 |
/** @var int $carry2 */
|
|
|
269 |
$carry2 = $h2 >> 26;
|
|
|
270 |
$h3 += $carry2;
|
|
|
271 |
$h2 -= $carry2 << 26;
|
|
|
272 |
/** @var int $carry3 */
|
|
|
273 |
$carry3 = $h3 >> 25;
|
|
|
274 |
$h4 += $carry3;
|
|
|
275 |
$h3 -= $carry3 << 25;
|
|
|
276 |
/** @var int $carry4 */
|
|
|
277 |
$carry4 = $h4 >> 26;
|
|
|
278 |
$h5 += $carry4;
|
|
|
279 |
$h4 -= $carry4 << 26;
|
|
|
280 |
/** @var int $carry5 */
|
|
|
281 |
$carry5 = $h5 >> 25;
|
|
|
282 |
$h6 += $carry5;
|
|
|
283 |
$h5 -= $carry5 << 25;
|
|
|
284 |
/** @var int $carry6 */
|
|
|
285 |
$carry6 = $h6 >> 26;
|
|
|
286 |
$h7 += $carry6;
|
|
|
287 |
$h6 -= $carry6 << 26;
|
|
|
288 |
/** @var int $carry7 */
|
|
|
289 |
$carry7 = $h7 >> 25;
|
|
|
290 |
$h8 += $carry7;
|
|
|
291 |
$h7 -= $carry7 << 25;
|
|
|
292 |
/** @var int $carry8 */
|
|
|
293 |
$carry8 = $h8 >> 26;
|
|
|
294 |
$h9 += $carry8;
|
|
|
295 |
$h8 -= $carry8 << 26;
|
|
|
296 |
/** @var int $carry9 */
|
|
|
297 |
$carry9 = $h9 >> 25;
|
|
|
298 |
$h9 -= $carry9 << 25;
|
|
|
299 |
|
|
|
300 |
/**
|
|
|
301 |
* @var array<int, int>
|
|
|
302 |
*/
|
|
|
303 |
$s = array(
|
|
|
304 |
(int) (($h0 >> 0) & 0xff),
|
|
|
305 |
(int) (($h0 >> 8) & 0xff),
|
|
|
306 |
(int) (($h0 >> 16) & 0xff),
|
|
|
307 |
(int) ((($h0 >> 24) | ($h1 << 2)) & 0xff),
|
|
|
308 |
(int) (($h1 >> 6) & 0xff),
|
|
|
309 |
(int) (($h1 >> 14) & 0xff),
|
|
|
310 |
(int) ((($h1 >> 22) | ($h2 << 3)) & 0xff),
|
|
|
311 |
(int) (($h2 >> 5) & 0xff),
|
|
|
312 |
(int) (($h2 >> 13) & 0xff),
|
|
|
313 |
(int) ((($h2 >> 21) | ($h3 << 5)) & 0xff),
|
|
|
314 |
(int) (($h3 >> 3) & 0xff),
|
|
|
315 |
(int) (($h3 >> 11) & 0xff),
|
|
|
316 |
(int) ((($h3 >> 19) | ($h4 << 6)) & 0xff),
|
|
|
317 |
(int) (($h4 >> 2) & 0xff),
|
|
|
318 |
(int) (($h4 >> 10) & 0xff),
|
|
|
319 |
(int) (($h4 >> 18) & 0xff),
|
|
|
320 |
(int) (($h5 >> 0) & 0xff),
|
|
|
321 |
(int) (($h5 >> 8) & 0xff),
|
|
|
322 |
(int) (($h5 >> 16) & 0xff),
|
|
|
323 |
(int) ((($h5 >> 24) | ($h6 << 1)) & 0xff),
|
|
|
324 |
(int) (($h6 >> 7) & 0xff),
|
|
|
325 |
(int) (($h6 >> 15) & 0xff),
|
|
|
326 |
(int) ((($h6 >> 23) | ($h7 << 3)) & 0xff),
|
|
|
327 |
(int) (($h7 >> 5) & 0xff),
|
|
|
328 |
(int) (($h7 >> 13) & 0xff),
|
|
|
329 |
(int) ((($h7 >> 21) | ($h8 << 4)) & 0xff),
|
|
|
330 |
(int) (($h8 >> 4) & 0xff),
|
|
|
331 |
(int) (($h8 >> 12) & 0xff),
|
|
|
332 |
(int) ((($h8 >> 20) | ($h9 << 6)) & 0xff),
|
|
|
333 |
(int) (($h9 >> 2) & 0xff),
|
|
|
334 |
(int) (($h9 >> 10) & 0xff),
|
|
|
335 |
(int) (($h9 >> 18) & 0xff)
|
|
|
336 |
);
|
|
|
337 |
return self::intArrayToString($s);
|
|
|
338 |
}
|
|
|
339 |
|
|
|
340 |
/**
|
|
|
341 |
* Is a field element negative? (1 = yes, 0 = no. Used in calculations.)
|
|
|
342 |
*
|
|
|
343 |
* @internal You should not use this directly from another application
|
|
|
344 |
*
|
|
|
345 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
346 |
* @return int
|
|
|
347 |
* @throws SodiumException
|
|
|
348 |
* @throws TypeError
|
|
|
349 |
*/
|
|
|
350 |
public static function fe_isnegative(ParagonIE_Sodium_Core_Curve25519_Fe $f)
|
|
|
351 |
{
|
|
|
352 |
$str = self::fe_tobytes($f);
|
|
|
353 |
return (int) (self::chrToInt($str[0]) & 1);
|
|
|
354 |
}
|
|
|
355 |
|
|
|
356 |
/**
|
|
|
357 |
* Returns 0 if this field element results in all NUL bytes.
|
|
|
358 |
*
|
|
|
359 |
* @internal You should not use this directly from another application
|
|
|
360 |
*
|
|
|
361 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
362 |
* @return bool
|
|
|
363 |
* @throws SodiumException
|
|
|
364 |
* @throws TypeError
|
|
|
365 |
*/
|
|
|
366 |
public static function fe_isnonzero(ParagonIE_Sodium_Core_Curve25519_Fe $f)
|
|
|
367 |
{
|
|
|
368 |
static $zero;
|
|
|
369 |
if ($zero === null) {
|
|
|
370 |
$zero = str_repeat("\x00", 32);
|
|
|
371 |
}
|
|
|
372 |
/** @var string $zero */
|
|
|
373 |
/** @var string $str */
|
|
|
374 |
$str = self::fe_tobytes($f);
|
|
|
375 |
return !self::verify_32($str, (string) $zero);
|
|
|
376 |
}
|
|
|
377 |
|
|
|
378 |
/**
|
|
|
379 |
* Multiply two field elements
|
|
|
380 |
*
|
|
|
381 |
* h = f * g
|
|
|
382 |
*
|
|
|
383 |
* @internal You should not use this directly from another application
|
|
|
384 |
*
|
|
|
385 |
* @security Is multiplication a source of timing leaks? If so, can we do
|
|
|
386 |
* anything to prevent that from happening?
|
|
|
387 |
*
|
|
|
388 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
389 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $g
|
|
|
390 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
391 |
*/
|
|
|
392 |
public static function fe_mul(
|
|
|
393 |
ParagonIE_Sodium_Core_Curve25519_Fe $f,
|
|
|
394 |
ParagonIE_Sodium_Core_Curve25519_Fe $g
|
|
|
395 |
) {
|
|
|
396 |
/** @var int $f0 */
|
|
|
397 |
$f0 = $f[0];
|
|
|
398 |
/** @var int $f1 */
|
|
|
399 |
$f1 = $f[1];
|
|
|
400 |
/** @var int $f2 */
|
|
|
401 |
$f2 = $f[2];
|
|
|
402 |
/** @var int $f3 */
|
|
|
403 |
$f3 = $f[3];
|
|
|
404 |
/** @var int $f4 */
|
|
|
405 |
$f4 = $f[4];
|
|
|
406 |
/** @var int $f5 */
|
|
|
407 |
$f5 = $f[5];
|
|
|
408 |
/** @var int $f6 */
|
|
|
409 |
$f6 = $f[6];
|
|
|
410 |
/** @var int $f7 */
|
|
|
411 |
$f7 = $f[7];
|
|
|
412 |
/** @var int $f8 */
|
|
|
413 |
$f8 = $f[8];
|
|
|
414 |
/** @var int $f9 */
|
|
|
415 |
$f9 = $f[9];
|
|
|
416 |
/** @var int $g0 */
|
|
|
417 |
$g0 = $g[0];
|
|
|
418 |
/** @var int $g1 */
|
|
|
419 |
$g1 = $g[1];
|
|
|
420 |
/** @var int $g2 */
|
|
|
421 |
$g2 = $g[2];
|
|
|
422 |
/** @var int $g3 */
|
|
|
423 |
$g3 = $g[3];
|
|
|
424 |
/** @var int $g4 */
|
|
|
425 |
$g4 = $g[4];
|
|
|
426 |
/** @var int $g5 */
|
|
|
427 |
$g5 = $g[5];
|
|
|
428 |
/** @var int $g6 */
|
|
|
429 |
$g6 = $g[6];
|
|
|
430 |
/** @var int $g7 */
|
|
|
431 |
$g7 = $g[7];
|
|
|
432 |
/** @var int $g8 */
|
|
|
433 |
$g8 = $g[8];
|
|
|
434 |
/** @var int $g9 */
|
|
|
435 |
$g9 = $g[9];
|
|
|
436 |
$g1_19 = self::mul($g1, 19, 5);
|
|
|
437 |
$g2_19 = self::mul($g2, 19, 5);
|
|
|
438 |
$g3_19 = self::mul($g3, 19, 5);
|
|
|
439 |
$g4_19 = self::mul($g4, 19, 5);
|
|
|
440 |
$g5_19 = self::mul($g5, 19, 5);
|
|
|
441 |
$g6_19 = self::mul($g6, 19, 5);
|
|
|
442 |
$g7_19 = self::mul($g7, 19, 5);
|
|
|
443 |
$g8_19 = self::mul($g8, 19, 5);
|
|
|
444 |
$g9_19 = self::mul($g9, 19, 5);
|
|
|
445 |
/** @var int $f1_2 */
|
|
|
446 |
$f1_2 = $f1 << 1;
|
|
|
447 |
/** @var int $f3_2 */
|
|
|
448 |
$f3_2 = $f3 << 1;
|
|
|
449 |
/** @var int $f5_2 */
|
|
|
450 |
$f5_2 = $f5 << 1;
|
|
|
451 |
/** @var int $f7_2 */
|
|
|
452 |
$f7_2 = $f7 << 1;
|
|
|
453 |
/** @var int $f9_2 */
|
|
|
454 |
$f9_2 = $f9 << 1;
|
|
|
455 |
$f0g0 = self::mul($f0, $g0, 26);
|
|
|
456 |
$f0g1 = self::mul($f0, $g1, 25);
|
|
|
457 |
$f0g2 = self::mul($f0, $g2, 26);
|
|
|
458 |
$f0g3 = self::mul($f0, $g3, 25);
|
|
|
459 |
$f0g4 = self::mul($f0, $g4, 26);
|
|
|
460 |
$f0g5 = self::mul($f0, $g5, 25);
|
|
|
461 |
$f0g6 = self::mul($f0, $g6, 26);
|
|
|
462 |
$f0g7 = self::mul($f0, $g7, 25);
|
|
|
463 |
$f0g8 = self::mul($f0, $g8, 26);
|
|
|
464 |
$f0g9 = self::mul($f0, $g9, 26);
|
|
|
465 |
$f1g0 = self::mul($f1, $g0, 26);
|
|
|
466 |
$f1g1_2 = self::mul($f1_2, $g1, 25);
|
|
|
467 |
$f1g2 = self::mul($f1, $g2, 26);
|
|
|
468 |
$f1g3_2 = self::mul($f1_2, $g3, 25);
|
|
|
469 |
$f1g4 = self::mul($f1, $g4, 26);
|
|
|
470 |
$f1g5_2 = self::mul($f1_2, $g5, 25);
|
|
|
471 |
$f1g6 = self::mul($f1, $g6, 26);
|
|
|
472 |
$f1g7_2 = self::mul($f1_2, $g7, 25);
|
|
|
473 |
$f1g8 = self::mul($f1, $g8, 26);
|
|
|
474 |
$f1g9_38 = self::mul($g9_19, $f1_2, 26);
|
|
|
475 |
$f2g0 = self::mul($f2, $g0, 26);
|
|
|
476 |
$f2g1 = self::mul($f2, $g1, 25);
|
|
|
477 |
$f2g2 = self::mul($f2, $g2, 26);
|
|
|
478 |
$f2g3 = self::mul($f2, $g3, 25);
|
|
|
479 |
$f2g4 = self::mul($f2, $g4, 26);
|
|
|
480 |
$f2g5 = self::mul($f2, $g5, 25);
|
|
|
481 |
$f2g6 = self::mul($f2, $g6, 26);
|
|
|
482 |
$f2g7 = self::mul($f2, $g7, 25);
|
|
|
483 |
$f2g8_19 = self::mul($g8_19, $f2, 26);
|
|
|
484 |
$f2g9_19 = self::mul($g9_19, $f2, 26);
|
|
|
485 |
$f3g0 = self::mul($f3, $g0, 26);
|
|
|
486 |
$f3g1_2 = self::mul($f3_2, $g1, 25);
|
|
|
487 |
$f3g2 = self::mul($f3, $g2, 26);
|
|
|
488 |
$f3g3_2 = self::mul($f3_2, $g3, 25);
|
|
|
489 |
$f3g4 = self::mul($f3, $g4, 26);
|
|
|
490 |
$f3g5_2 = self::mul($f3_2, $g5, 25);
|
|
|
491 |
$f3g6 = self::mul($f3, $g6, 26);
|
|
|
492 |
$f3g7_38 = self::mul($g7_19, $f3_2, 26);
|
|
|
493 |
$f3g8_19 = self::mul($g8_19, $f3, 25);
|
|
|
494 |
$f3g9_38 = self::mul($g9_19, $f3_2, 26);
|
|
|
495 |
$f4g0 = self::mul($f4, $g0, 26);
|
|
|
496 |
$f4g1 = self::mul($f4, $g1, 25);
|
|
|
497 |
$f4g2 = self::mul($f4, $g2, 26);
|
|
|
498 |
$f4g3 = self::mul($f4, $g3, 25);
|
|
|
499 |
$f4g4 = self::mul($f4, $g4, 26);
|
|
|
500 |
$f4g5 = self::mul($f4, $g5, 25);
|
|
|
501 |
$f4g6_19 = self::mul($g6_19, $f4, 26);
|
|
|
502 |
$f4g7_19 = self::mul($g7_19, $f4, 26);
|
|
|
503 |
$f4g8_19 = self::mul($g8_19, $f4, 26);
|
|
|
504 |
$f4g9_19 = self::mul($g9_19, $f4, 26);
|
|
|
505 |
$f5g0 = self::mul($f5, $g0, 26);
|
|
|
506 |
$f5g1_2 = self::mul($f5_2, $g1, 25);
|
|
|
507 |
$f5g2 = self::mul($f5, $g2, 26);
|
|
|
508 |
$f5g3_2 = self::mul($f5_2, $g3, 25);
|
|
|
509 |
$f5g4 = self::mul($f5, $g4, 26);
|
|
|
510 |
$f5g5_38 = self::mul($g5_19, $f5_2, 26);
|
|
|
511 |
$f5g6_19 = self::mul($g6_19, $f5, 25);
|
|
|
512 |
$f5g7_38 = self::mul($g7_19, $f5_2, 26);
|
|
|
513 |
$f5g8_19 = self::mul($g8_19, $f5, 25);
|
|
|
514 |
$f5g9_38 = self::mul($g9_19, $f5_2, 26);
|
|
|
515 |
$f6g0 = self::mul($f6, $g0, 26);
|
|
|
516 |
$f6g1 = self::mul($f6, $g1, 25);
|
|
|
517 |
$f6g2 = self::mul($f6, $g2, 26);
|
|
|
518 |
$f6g3 = self::mul($f6, $g3, 25);
|
|
|
519 |
$f6g4_19 = self::mul($g4_19, $f6, 26);
|
|
|
520 |
$f6g5_19 = self::mul($g5_19, $f6, 26);
|
|
|
521 |
$f6g6_19 = self::mul($g6_19, $f6, 26);
|
|
|
522 |
$f6g7_19 = self::mul($g7_19, $f6, 26);
|
|
|
523 |
$f6g8_19 = self::mul($g8_19, $f6, 26);
|
|
|
524 |
$f6g9_19 = self::mul($g9_19, $f6, 26);
|
|
|
525 |
$f7g0 = self::mul($f7, $g0, 26);
|
|
|
526 |
$f7g1_2 = self::mul($f7_2, $g1, 25);
|
|
|
527 |
$f7g2 = self::mul($f7, $g2, 26);
|
|
|
528 |
$f7g3_38 = self::mul($g3_19, $f7_2, 26);
|
|
|
529 |
$f7g4_19 = self::mul($g4_19, $f7, 26);
|
|
|
530 |
$f7g5_38 = self::mul($g5_19, $f7_2, 26);
|
|
|
531 |
$f7g6_19 = self::mul($g6_19, $f7, 25);
|
|
|
532 |
$f7g7_38 = self::mul($g7_19, $f7_2, 26);
|
|
|
533 |
$f7g8_19 = self::mul($g8_19, $f7, 25);
|
|
|
534 |
$f7g9_38 = self::mul($g9_19,$f7_2, 26);
|
|
|
535 |
$f8g0 = self::mul($f8, $g0, 26);
|
|
|
536 |
$f8g1 = self::mul($f8, $g1, 25);
|
|
|
537 |
$f8g2_19 = self::mul($g2_19, $f8, 26);
|
|
|
538 |
$f8g3_19 = self::mul($g3_19, $f8, 26);
|
|
|
539 |
$f8g4_19 = self::mul($g4_19, $f8, 26);
|
|
|
540 |
$f8g5_19 = self::mul($g5_19, $f8, 26);
|
|
|
541 |
$f8g6_19 = self::mul($g6_19, $f8, 26);
|
|
|
542 |
$f8g7_19 = self::mul($g7_19, $f8, 26);
|
|
|
543 |
$f8g8_19 = self::mul($g8_19, $f8, 26);
|
|
|
544 |
$f8g9_19 = self::mul($g9_19, $f8, 26);
|
|
|
545 |
$f9g0 = self::mul($f9, $g0, 26);
|
|
|
546 |
$f9g1_38 = self::mul($g1_19, $f9_2, 26);
|
|
|
547 |
$f9g2_19 = self::mul($g2_19, $f9, 25);
|
|
|
548 |
$f9g3_38 = self::mul($g3_19, $f9_2, 26);
|
|
|
549 |
$f9g4_19 = self::mul($g4_19, $f9, 25);
|
|
|
550 |
$f9g5_38 = self::mul($g5_19, $f9_2, 26);
|
|
|
551 |
$f9g6_19 = self::mul($g6_19, $f9, 25);
|
|
|
552 |
$f9g7_38 = self::mul($g7_19, $f9_2, 26);
|
|
|
553 |
$f9g8_19 = self::mul($g8_19, $f9, 25);
|
|
|
554 |
$f9g9_38 = self::mul($g9_19, $f9_2, 26);
|
|
|
555 |
$h0 = $f0g0 + $f1g9_38 + $f2g8_19 + $f3g7_38 + $f4g6_19 + $f5g5_38 + $f6g4_19 + $f7g3_38 + $f8g2_19 + $f9g1_38;
|
|
|
556 |
$h1 = $f0g1 + $f1g0 + $f2g9_19 + $f3g8_19 + $f4g7_19 + $f5g6_19 + $f6g5_19 + $f7g4_19 + $f8g3_19 + $f9g2_19;
|
|
|
557 |
$h2 = $f0g2 + $f1g1_2 + $f2g0 + $f3g9_38 + $f4g8_19 + $f5g7_38 + $f6g6_19 + $f7g5_38 + $f8g4_19 + $f9g3_38;
|
|
|
558 |
$h3 = $f0g3 + $f1g2 + $f2g1 + $f3g0 + $f4g9_19 + $f5g8_19 + $f6g7_19 + $f7g6_19 + $f8g5_19 + $f9g4_19;
|
|
|
559 |
$h4 = $f0g4 + $f1g3_2 + $f2g2 + $f3g1_2 + $f4g0 + $f5g9_38 + $f6g8_19 + $f7g7_38 + $f8g6_19 + $f9g5_38;
|
|
|
560 |
$h5 = $f0g5 + $f1g4 + $f2g3 + $f3g2 + $f4g1 + $f5g0 + $f6g9_19 + $f7g8_19 + $f8g7_19 + $f9g6_19;
|
|
|
561 |
$h6 = $f0g6 + $f1g5_2 + $f2g4 + $f3g3_2 + $f4g2 + $f5g1_2 + $f6g0 + $f7g9_38 + $f8g8_19 + $f9g7_38;
|
|
|
562 |
$h7 = $f0g7 + $f1g6 + $f2g5 + $f3g4 + $f4g3 + $f5g2 + $f6g1 + $f7g0 + $f8g9_19 + $f9g8_19;
|
|
|
563 |
$h8 = $f0g8 + $f1g7_2 + $f2g6 + $f3g5_2 + $f4g4 + $f5g3_2 + $f6g2 + $f7g1_2 + $f8g0 + $f9g9_38;
|
|
|
564 |
$h9 = $f0g9 + $f1g8 + $f2g7 + $f3g6 + $f4g5 + $f5g4 + $f6g3 + $f7g2 + $f8g1 + $f9g0 ;
|
|
|
565 |
|
|
|
566 |
/** @var int $carry0 */
|
|
|
567 |
$carry0 = ($h0 + (1 << 25)) >> 26;
|
|
|
568 |
$h1 += $carry0;
|
|
|
569 |
$h0 -= $carry0 << 26;
|
|
|
570 |
/** @var int $carry4 */
|
|
|
571 |
$carry4 = ($h4 + (1 << 25)) >> 26;
|
|
|
572 |
$h5 += $carry4;
|
|
|
573 |
$h4 -= $carry4 << 26;
|
|
|
574 |
|
|
|
575 |
/** @var int $carry1 */
|
|
|
576 |
$carry1 = ($h1 + (1 << 24)) >> 25;
|
|
|
577 |
$h2 += $carry1;
|
|
|
578 |
$h1 -= $carry1 << 25;
|
|
|
579 |
/** @var int $carry5 */
|
|
|
580 |
$carry5 = ($h5 + (1 << 24)) >> 25;
|
|
|
581 |
$h6 += $carry5;
|
|
|
582 |
$h5 -= $carry5 << 25;
|
|
|
583 |
|
|
|
584 |
/** @var int $carry2 */
|
|
|
585 |
$carry2 = ($h2 + (1 << 25)) >> 26;
|
|
|
586 |
$h3 += $carry2;
|
|
|
587 |
$h2 -= $carry2 << 26;
|
|
|
588 |
/** @var int $carry6 */
|
|
|
589 |
$carry6 = ($h6 + (1 << 25)) >> 26;
|
|
|
590 |
$h7 += $carry6;
|
|
|
591 |
$h6 -= $carry6 << 26;
|
|
|
592 |
|
|
|
593 |
/** @var int $carry3 */
|
|
|
594 |
$carry3 = ($h3 + (1 << 24)) >> 25;
|
|
|
595 |
$h4 += $carry3;
|
|
|
596 |
$h3 -= $carry3 << 25;
|
|
|
597 |
/** @var int $carry7 */
|
|
|
598 |
$carry7 = ($h7 + (1 << 24)) >> 25;
|
|
|
599 |
$h8 += $carry7;
|
|
|
600 |
$h7 -= $carry7 << 25;
|
|
|
601 |
|
|
|
602 |
/** @var int $carry4 */
|
|
|
603 |
$carry4 = ($h4 + (1 << 25)) >> 26;
|
|
|
604 |
$h5 += $carry4;
|
|
|
605 |
$h4 -= $carry4 << 26;
|
|
|
606 |
/** @var int $carry8 */
|
|
|
607 |
$carry8 = ($h8 + (1 << 25)) >> 26;
|
|
|
608 |
$h9 += $carry8;
|
|
|
609 |
$h8 -= $carry8 << 26;
|
|
|
610 |
|
|
|
611 |
/** @var int $carry9 */
|
|
|
612 |
$carry9 = ($h9 + (1 << 24)) >> 25;
|
|
|
613 |
$h0 += self::mul($carry9, 19, 5);
|
|
|
614 |
$h9 -= $carry9 << 25;
|
|
|
615 |
|
|
|
616 |
/** @var int $carry0 */
|
|
|
617 |
$carry0 = ($h0 + (1 << 25)) >> 26;
|
|
|
618 |
$h1 += $carry0;
|
|
|
619 |
$h0 -= $carry0 << 26;
|
|
|
620 |
|
|
|
621 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
|
|
|
622 |
array(
|
|
|
623 |
(int) $h0,
|
|
|
624 |
(int) $h1,
|
|
|
625 |
(int) $h2,
|
|
|
626 |
(int) $h3,
|
|
|
627 |
(int) $h4,
|
|
|
628 |
(int) $h5,
|
|
|
629 |
(int) $h6,
|
|
|
630 |
(int) $h7,
|
|
|
631 |
(int) $h8,
|
|
|
632 |
(int) $h9
|
|
|
633 |
)
|
|
|
634 |
);
|
|
|
635 |
}
|
|
|
636 |
|
|
|
637 |
/**
|
|
|
638 |
* Get the negative values for each piece of the field element.
|
|
|
639 |
*
|
|
|
640 |
* h = -f
|
|
|
641 |
*
|
|
|
642 |
* @internal You should not use this directly from another application
|
|
|
643 |
*
|
|
|
644 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
645 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
646 |
* @psalm-suppress MixedAssignment
|
|
|
647 |
*/
|
|
|
648 |
public static function fe_neg(ParagonIE_Sodium_Core_Curve25519_Fe $f)
|
|
|
649 |
{
|
|
|
650 |
$h = new ParagonIE_Sodium_Core_Curve25519_Fe();
|
|
|
651 |
for ($i = 0; $i < 10; ++$i) {
|
|
|
652 |
$h[$i] = -$f[$i];
|
|
|
653 |
}
|
|
|
654 |
return $h;
|
|
|
655 |
}
|
|
|
656 |
|
|
|
657 |
/**
|
|
|
658 |
* Square a field element
|
|
|
659 |
*
|
|
|
660 |
* h = f * f
|
|
|
661 |
*
|
|
|
662 |
* @internal You should not use this directly from another application
|
|
|
663 |
*
|
|
|
664 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
665 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
666 |
*/
|
|
|
667 |
public static function fe_sq(ParagonIE_Sodium_Core_Curve25519_Fe $f)
|
|
|
668 |
{
|
|
|
669 |
$f0 = (int) $f[0];
|
|
|
670 |
$f1 = (int) $f[1];
|
|
|
671 |
$f2 = (int) $f[2];
|
|
|
672 |
$f3 = (int) $f[3];
|
|
|
673 |
$f4 = (int) $f[4];
|
|
|
674 |
$f5 = (int) $f[5];
|
|
|
675 |
$f6 = (int) $f[6];
|
|
|
676 |
$f7 = (int) $f[7];
|
|
|
677 |
$f8 = (int) $f[8];
|
|
|
678 |
$f9 = (int) $f[9];
|
|
|
679 |
|
|
|
680 |
/** @var int $f0_2 */
|
|
|
681 |
$f0_2 = $f0 << 1;
|
|
|
682 |
/** @var int $f1_2 */
|
|
|
683 |
$f1_2 = $f1 << 1;
|
|
|
684 |
/** @var int $f2_2 */
|
|
|
685 |
$f2_2 = $f2 << 1;
|
|
|
686 |
/** @var int $f3_2 */
|
|
|
687 |
$f3_2 = $f3 << 1;
|
|
|
688 |
/** @var int $f4_2 */
|
|
|
689 |
$f4_2 = $f4 << 1;
|
|
|
690 |
/** @var int $f5_2 */
|
|
|
691 |
$f5_2 = $f5 << 1;
|
|
|
692 |
/** @var int $f6_2 */
|
|
|
693 |
$f6_2 = $f6 << 1;
|
|
|
694 |
/** @var int $f7_2 */
|
|
|
695 |
$f7_2 = $f7 << 1;
|
|
|
696 |
$f5_38 = self::mul($f5, 38, 6);
|
|
|
697 |
$f6_19 = self::mul($f6, 19, 5);
|
|
|
698 |
$f7_38 = self::mul($f7, 38, 6);
|
|
|
699 |
$f8_19 = self::mul($f8, 19, 5);
|
|
|
700 |
$f9_38 = self::mul($f9, 38, 6);
|
|
|
701 |
$f0f0 = self::mul($f0, $f0, 25);
|
|
|
702 |
$f0f1_2 = self::mul($f0_2, $f1, 24);
|
|
18
|
703 |
$f0f2_2 = self::mul($f0_2, $f2, 26);
|
|
9
|
704 |
$f0f3_2 = self::mul($f0_2, $f3, 24);
|
|
|
705 |
$f0f4_2 = self::mul($f0_2, $f4, 25);
|
|
|
706 |
$f0f5_2 = self::mul($f0_2, $f5, 25);
|
|
|
707 |
$f0f6_2 = self::mul($f0_2, $f6, 25);
|
|
|
708 |
$f0f7_2 = self::mul($f0_2, $f7, 24);
|
|
|
709 |
$f0f8_2 = self::mul($f0_2, $f8, 25);
|
|
|
710 |
$f0f9_2 = self::mul($f0_2, $f9, 25);
|
|
|
711 |
$f1f1_2 = self::mul($f1_2, $f1, 24);
|
|
18
|
712 |
$f1f2_2 = self::mul($f1_2, $f2, 26);
|
|
9
|
713 |
$f1f3_4 = self::mul($f1_2, $f3_2, 25);
|
|
|
714 |
$f1f4_2 = self::mul($f1_2, $f4, 25);
|
|
|
715 |
$f1f5_4 = self::mul($f1_2, $f5_2, 26);
|
|
|
716 |
$f1f6_2 = self::mul($f1_2, $f6, 25);
|
|
|
717 |
$f1f7_4 = self::mul($f1_2, $f7_2, 25);
|
|
|
718 |
$f1f8_2 = self::mul($f1_2, $f8, 25);
|
|
|
719 |
$f1f9_76 = self::mul($f9_38, $f1_2, 25);
|
|
18
|
720 |
$f2f2 = self::mul($f2, $f2, 26);
|
|
9
|
721 |
$f2f3_2 = self::mul($f2_2, $f3, 24);
|
|
|
722 |
$f2f4_2 = self::mul($f2_2, $f4, 25);
|
|
|
723 |
$f2f5_2 = self::mul($f2_2, $f5, 25);
|
|
|
724 |
$f2f6_2 = self::mul($f2_2, $f6, 25);
|
|
18
|
725 |
$f2f7_2 = self::mul($f2_2, $f7, 25);
|
|
|
726 |
$f2f8_38 = self::mul($f8_19, $f2_2, 27);
|
|
|
727 |
$f2f9_38 = self::mul($f9_38, $f2, 26);
|
|
|
728 |
$f3f3_2 = self::mul($f3_2, $f3, 25);
|
|
9
|
729 |
$f3f4_2 = self::mul($f3_2, $f4, 25);
|
|
|
730 |
$f3f5_4 = self::mul($f3_2, $f5_2, 26);
|
|
|
731 |
$f3f6_2 = self::mul($f3_2, $f6, 25);
|
|
|
732 |
$f3f7_76 = self::mul($f7_38, $f3_2, 25);
|
|
|
733 |
$f3f8_38 = self::mul($f8_19, $f3_2, 25);
|
|
|
734 |
$f3f9_76 = self::mul($f9_38, $f3_2, 25);
|
|
|
735 |
$f4f4 = self::mul($f4, $f4, 25);
|
|
|
736 |
$f4f5_2 = self::mul($f4_2, $f5, 25);
|
|
|
737 |
$f4f6_38 = self::mul($f6_19, $f4_2, 26);
|
|
|
738 |
$f4f7_38 = self::mul($f7_38, $f4, 25);
|
|
|
739 |
$f4f8_38 = self::mul($f8_19, $f4_2, 26);
|
|
|
740 |
$f4f9_38 = self::mul($f9_38, $f4, 25);
|
|
|
741 |
$f5f5_38 = self::mul($f5_38, $f5, 25);
|
|
|
742 |
$f5f6_38 = self::mul($f6_19, $f5_2, 26);
|
|
|
743 |
$f5f7_76 = self::mul($f7_38, $f5_2, 26);
|
|
|
744 |
$f5f8_38 = self::mul($f8_19, $f5_2, 26);
|
|
|
745 |
$f5f9_76 = self::mul($f9_38, $f5_2, 26);
|
|
|
746 |
$f6f6_19 = self::mul($f6_19, $f6, 25);
|
|
|
747 |
$f6f7_38 = self::mul($f7_38, $f6, 25);
|
|
|
748 |
$f6f8_38 = self::mul($f8_19, $f6_2, 26);
|
|
|
749 |
$f6f9_38 = self::mul($f9_38, $f6, 25);
|
|
|
750 |
$f7f7_38 = self::mul($f7_38, $f7, 24);
|
|
|
751 |
$f7f8_38 = self::mul($f8_19, $f7_2, 25);
|
|
|
752 |
$f7f9_76 = self::mul($f9_38, $f7_2, 25);
|
|
|
753 |
$f8f8_19 = self::mul($f8_19, $f8, 25);
|
|
|
754 |
$f8f9_38 = self::mul($f9_38, $f8, 25);
|
|
|
755 |
$f9f9_38 = self::mul($f9_38, $f9, 25);
|
|
|
756 |
$h0 = $f0f0 + $f1f9_76 + $f2f8_38 + $f3f7_76 + $f4f6_38 + $f5f5_38;
|
|
|
757 |
$h1 = $f0f1_2 + $f2f9_38 + $f3f8_38 + $f4f7_38 + $f5f6_38;
|
|
|
758 |
$h2 = $f0f2_2 + $f1f1_2 + $f3f9_76 + $f4f8_38 + $f5f7_76 + $f6f6_19;
|
|
|
759 |
$h3 = $f0f3_2 + $f1f2_2 + $f4f9_38 + $f5f8_38 + $f6f7_38;
|
|
|
760 |
$h4 = $f0f4_2 + $f1f3_4 + $f2f2 + $f5f9_76 + $f6f8_38 + $f7f7_38;
|
|
|
761 |
$h5 = $f0f5_2 + $f1f4_2 + $f2f3_2 + $f6f9_38 + $f7f8_38;
|
|
|
762 |
$h6 = $f0f6_2 + $f1f5_4 + $f2f4_2 + $f3f3_2 + $f7f9_76 + $f8f8_19;
|
|
|
763 |
$h7 = $f0f7_2 + $f1f6_2 + $f2f5_2 + $f3f4_2 + $f8f9_38;
|
|
|
764 |
$h8 = $f0f8_2 + $f1f7_4 + $f2f6_2 + $f3f5_4 + $f4f4 + $f9f9_38;
|
|
|
765 |
$h9 = $f0f9_2 + $f1f8_2 + $f2f7_2 + $f3f6_2 + $f4f5_2;
|
|
|
766 |
|
|
|
767 |
/** @var int $carry0 */
|
|
|
768 |
$carry0 = ($h0 + (1 << 25)) >> 26;
|
|
|
769 |
$h1 += $carry0;
|
|
|
770 |
$h0 -= $carry0 << 26;
|
|
|
771 |
/** @var int $carry4 */
|
|
|
772 |
$carry4 = ($h4 + (1 << 25)) >> 26;
|
|
|
773 |
$h5 += $carry4;
|
|
|
774 |
$h4 -= $carry4 << 26;
|
|
|
775 |
|
|
|
776 |
/** @var int $carry1 */
|
|
|
777 |
$carry1 = ($h1 + (1 << 24)) >> 25;
|
|
|
778 |
$h2 += $carry1;
|
|
|
779 |
$h1 -= $carry1 << 25;
|
|
|
780 |
/** @var int $carry5 */
|
|
|
781 |
$carry5 = ($h5 + (1 << 24)) >> 25;
|
|
|
782 |
$h6 += $carry5;
|
|
|
783 |
$h5 -= $carry5 << 25;
|
|
|
784 |
|
|
|
785 |
/** @var int $carry2 */
|
|
|
786 |
$carry2 = ($h2 + (1 << 25)) >> 26;
|
|
|
787 |
$h3 += $carry2;
|
|
|
788 |
$h2 -= $carry2 << 26;
|
|
|
789 |
/** @var int $carry6 */
|
|
|
790 |
$carry6 = ($h6 + (1 << 25)) >> 26;
|
|
|
791 |
$h7 += $carry6;
|
|
|
792 |
$h6 -= $carry6 << 26;
|
|
|
793 |
|
|
|
794 |
/** @var int $carry3 */
|
|
|
795 |
$carry3 = ($h3 + (1 << 24)) >> 25;
|
|
|
796 |
$h4 += $carry3;
|
|
|
797 |
$h3 -= $carry3 << 25;
|
|
|
798 |
/** @var int $carry7 */
|
|
|
799 |
$carry7 = ($h7 + (1 << 24)) >> 25;
|
|
|
800 |
$h8 += $carry7;
|
|
|
801 |
$h7 -= $carry7 << 25;
|
|
|
802 |
|
|
|
803 |
/** @var int $carry4 */
|
|
|
804 |
$carry4 = ($h4 + (1 << 25)) >> 26;
|
|
|
805 |
$h5 += $carry4;
|
|
|
806 |
$h4 -= $carry4 << 26;
|
|
|
807 |
/** @var int $carry8 */
|
|
|
808 |
$carry8 = ($h8 + (1 << 25)) >> 26;
|
|
|
809 |
$h9 += $carry8;
|
|
|
810 |
$h8 -= $carry8 << 26;
|
|
|
811 |
|
|
|
812 |
/** @var int $carry9 */
|
|
|
813 |
$carry9 = ($h9 + (1 << 24)) >> 25;
|
|
|
814 |
$h0 += self::mul($carry9, 19, 5);
|
|
|
815 |
$h9 -= $carry9 << 25;
|
|
|
816 |
|
|
|
817 |
/** @var int $carry0 */
|
|
|
818 |
$carry0 = ($h0 + (1 << 25)) >> 26;
|
|
|
819 |
$h1 += $carry0;
|
|
|
820 |
$h0 -= $carry0 << 26;
|
|
|
821 |
|
|
|
822 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
|
|
|
823 |
array(
|
|
|
824 |
(int) $h0,
|
|
|
825 |
(int) $h1,
|
|
|
826 |
(int) $h2,
|
|
|
827 |
(int) $h3,
|
|
|
828 |
(int) $h4,
|
|
|
829 |
(int) $h5,
|
|
|
830 |
(int) $h6,
|
|
|
831 |
(int) $h7,
|
|
|
832 |
(int) $h8,
|
|
|
833 |
(int) $h9
|
|
|
834 |
)
|
|
|
835 |
);
|
|
|
836 |
}
|
|
|
837 |
|
|
|
838 |
|
|
|
839 |
/**
|
|
|
840 |
* Square and double a field element
|
|
|
841 |
*
|
|
|
842 |
* h = 2 * f * f
|
|
|
843 |
*
|
|
|
844 |
* @internal You should not use this directly from another application
|
|
|
845 |
*
|
|
|
846 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
847 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
848 |
*/
|
|
|
849 |
public static function fe_sq2(ParagonIE_Sodium_Core_Curve25519_Fe $f)
|
|
|
850 |
{
|
|
|
851 |
$f0 = (int) $f[0];
|
|
|
852 |
$f1 = (int) $f[1];
|
|
|
853 |
$f2 = (int) $f[2];
|
|
|
854 |
$f3 = (int) $f[3];
|
|
|
855 |
$f4 = (int) $f[4];
|
|
|
856 |
$f5 = (int) $f[5];
|
|
|
857 |
$f6 = (int) $f[6];
|
|
|
858 |
$f7 = (int) $f[7];
|
|
|
859 |
$f8 = (int) $f[8];
|
|
|
860 |
$f9 = (int) $f[9];
|
|
|
861 |
|
|
|
862 |
/** @var int $f0_2 */
|
|
|
863 |
$f0_2 = $f0 << 1;
|
|
|
864 |
/** @var int $f1_2 */
|
|
|
865 |
$f1_2 = $f1 << 1;
|
|
|
866 |
/** @var int $f2_2 */
|
|
|
867 |
$f2_2 = $f2 << 1;
|
|
|
868 |
/** @var int $f3_2 */
|
|
|
869 |
$f3_2 = $f3 << 1;
|
|
|
870 |
/** @var int $f4_2 */
|
|
|
871 |
$f4_2 = $f4 << 1;
|
|
|
872 |
/** @var int $f5_2 */
|
|
|
873 |
$f5_2 = $f5 << 1;
|
|
|
874 |
/** @var int $f6_2 */
|
|
|
875 |
$f6_2 = $f6 << 1;
|
|
|
876 |
/** @var int $f7_2 */
|
|
|
877 |
$f7_2 = $f7 << 1;
|
|
|
878 |
$f5_38 = self::mul($f5, 38, 6); /* 1.959375*2^30 */
|
|
|
879 |
$f6_19 = self::mul($f6, 19, 5); /* 1.959375*2^30 */
|
|
|
880 |
$f7_38 = self::mul($f7, 38, 6); /* 1.959375*2^30 */
|
|
|
881 |
$f8_19 = self::mul($f8, 19, 5); /* 1.959375*2^30 */
|
|
|
882 |
$f9_38 = self::mul($f9, 38, 6); /* 1.959375*2^30 */
|
|
|
883 |
$f0f0 = self::mul($f0, $f0, 24);
|
|
|
884 |
$f0f1_2 = self::mul($f0_2, $f1, 24);
|
|
|
885 |
$f0f2_2 = self::mul($f0_2, $f2, 24);
|
|
|
886 |
$f0f3_2 = self::mul($f0_2, $f3, 24);
|
|
|
887 |
$f0f4_2 = self::mul($f0_2, $f4, 24);
|
|
|
888 |
$f0f5_2 = self::mul($f0_2, $f5, 24);
|
|
|
889 |
$f0f6_2 = self::mul($f0_2, $f6, 24);
|
|
|
890 |
$f0f7_2 = self::mul($f0_2, $f7, 24);
|
|
|
891 |
$f0f8_2 = self::mul($f0_2, $f8, 24);
|
|
|
892 |
$f0f9_2 = self::mul($f0_2, $f9, 24);
|
|
|
893 |
$f1f1_2 = self::mul($f1_2, $f1, 24);
|
|
|
894 |
$f1f2_2 = self::mul($f1_2, $f2, 24);
|
|
|
895 |
$f1f3_4 = self::mul($f1_2, $f3_2, 24);
|
|
|
896 |
$f1f4_2 = self::mul($f1_2, $f4, 24);
|
|
|
897 |
$f1f5_4 = self::mul($f1_2, $f5_2, 24);
|
|
|
898 |
$f1f6_2 = self::mul($f1_2, $f6, 24);
|
|
|
899 |
$f1f7_4 = self::mul($f1_2, $f7_2, 24);
|
|
|
900 |
$f1f8_2 = self::mul($f1_2, $f8, 24);
|
|
|
901 |
$f1f9_76 = self::mul($f9_38, $f1_2, 24);
|
|
|
902 |
$f2f2 = self::mul($f2, $f2, 24);
|
|
|
903 |
$f2f3_2 = self::mul($f2_2, $f3, 24);
|
|
|
904 |
$f2f4_2 = self::mul($f2_2, $f4, 24);
|
|
|
905 |
$f2f5_2 = self::mul($f2_2, $f5, 24);
|
|
|
906 |
$f2f6_2 = self::mul($f2_2, $f6, 24);
|
|
|
907 |
$f2f7_2 = self::mul($f2_2, $f7, 24);
|
|
|
908 |
$f2f8_38 = self::mul($f8_19, $f2_2, 25);
|
|
|
909 |
$f2f9_38 = self::mul($f9_38, $f2, 24);
|
|
|
910 |
$f3f3_2 = self::mul($f3_2, $f3, 24);
|
|
|
911 |
$f3f4_2 = self::mul($f3_2, $f4, 24);
|
|
|
912 |
$f3f5_4 = self::mul($f3_2, $f5_2, 24);
|
|
|
913 |
$f3f6_2 = self::mul($f3_2, $f6, 24);
|
|
|
914 |
$f3f7_76 = self::mul($f7_38, $f3_2, 24);
|
|
|
915 |
$f3f8_38 = self::mul($f8_19, $f3_2, 24);
|
|
|
916 |
$f3f9_76 = self::mul($f9_38, $f3_2, 24);
|
|
|
917 |
$f4f4 = self::mul($f4, $f4, 24);
|
|
|
918 |
$f4f5_2 = self::mul($f4_2, $f5, 24);
|
|
|
919 |
$f4f6_38 = self::mul($f6_19, $f4_2, 25);
|
|
|
920 |
$f4f7_38 = self::mul($f7_38, $f4, 24);
|
|
|
921 |
$f4f8_38 = self::mul($f8_19, $f4_2, 25);
|
|
|
922 |
$f4f9_38 = self::mul($f9_38, $f4, 24);
|
|
|
923 |
$f5f5_38 = self::mul($f5_38, $f5, 24);
|
|
|
924 |
$f5f6_38 = self::mul($f6_19, $f5_2, 24);
|
|
|
925 |
$f5f7_76 = self::mul($f7_38, $f5_2, 24);
|
|
|
926 |
$f5f8_38 = self::mul($f8_19, $f5_2, 24);
|
|
|
927 |
$f5f9_76 = self::mul($f9_38, $f5_2, 24);
|
|
|
928 |
$f6f6_19 = self::mul($f6_19, $f6, 24);
|
|
|
929 |
$f6f7_38 = self::mul($f7_38, $f6, 24);
|
|
|
930 |
$f6f8_38 = self::mul($f8_19, $f6_2, 25);
|
|
|
931 |
$f6f9_38 = self::mul($f9_38, $f6, 24);
|
|
|
932 |
$f7f7_38 = self::mul($f7_38, $f7, 24);
|
|
|
933 |
$f7f8_38 = self::mul($f8_19, $f7_2, 24);
|
|
|
934 |
$f7f9_76 = self::mul($f9_38, $f7_2, 24);
|
|
|
935 |
$f8f8_19 = self::mul($f8_19, $f8, 24);
|
|
|
936 |
$f8f9_38 = self::mul($f9_38, $f8, 24);
|
|
|
937 |
$f9f9_38 = self::mul($f9_38, $f9, 24);
|
|
|
938 |
|
|
|
939 |
/** @var int $h0 */
|
|
|
940 |
$h0 = (int) ($f0f0 + $f1f9_76 + $f2f8_38 + $f3f7_76 + $f4f6_38 + $f5f5_38) << 1;
|
|
|
941 |
/** @var int $h1 */
|
|
|
942 |
$h1 = (int) ($f0f1_2 + $f2f9_38 + $f3f8_38 + $f4f7_38 + $f5f6_38) << 1;
|
|
|
943 |
/** @var int $h2 */
|
|
|
944 |
$h2 = (int) ($f0f2_2 + $f1f1_2 + $f3f9_76 + $f4f8_38 + $f5f7_76 + $f6f6_19) << 1;
|
|
|
945 |
/** @var int $h3 */
|
|
|
946 |
$h3 = (int) ($f0f3_2 + $f1f2_2 + $f4f9_38 + $f5f8_38 + $f6f7_38) << 1;
|
|
|
947 |
/** @var int $h4 */
|
|
|
948 |
$h4 = (int) ($f0f4_2 + $f1f3_4 + $f2f2 + $f5f9_76 + $f6f8_38 + $f7f7_38) << 1;
|
|
|
949 |
/** @var int $h5 */
|
|
|
950 |
$h5 = (int) ($f0f5_2 + $f1f4_2 + $f2f3_2 + $f6f9_38 + $f7f8_38) << 1;
|
|
|
951 |
/** @var int $h6 */
|
|
|
952 |
$h6 = (int) ($f0f6_2 + $f1f5_4 + $f2f4_2 + $f3f3_2 + $f7f9_76 + $f8f8_19) << 1;
|
|
|
953 |
/** @var int $h7 */
|
|
|
954 |
$h7 = (int) ($f0f7_2 + $f1f6_2 + $f2f5_2 + $f3f4_2 + $f8f9_38) << 1;
|
|
|
955 |
/** @var int $h8 */
|
|
|
956 |
$h8 = (int) ($f0f8_2 + $f1f7_4 + $f2f6_2 + $f3f5_4 + $f4f4 + $f9f9_38) << 1;
|
|
|
957 |
/** @var int $h9 */
|
|
|
958 |
$h9 = (int) ($f0f9_2 + $f1f8_2 + $f2f7_2 + $f3f6_2 + $f4f5_2) << 1;
|
|
|
959 |
|
|
|
960 |
/** @var int $carry0 */
|
|
|
961 |
$carry0 = ($h0 + (1 << 25)) >> 26;
|
|
|
962 |
$h1 += $carry0;
|
|
|
963 |
$h0 -= $carry0 << 26;
|
|
|
964 |
/** @var int $carry4 */
|
|
|
965 |
$carry4 = ($h4 + (1 << 25)) >> 26;
|
|
|
966 |
$h5 += $carry4;
|
|
|
967 |
$h4 -= $carry4 << 26;
|
|
|
968 |
|
|
|
969 |
/** @var int $carry1 */
|
|
|
970 |
$carry1 = ($h1 + (1 << 24)) >> 25;
|
|
|
971 |
$h2 += $carry1;
|
|
|
972 |
$h1 -= $carry1 << 25;
|
|
|
973 |
/** @var int $carry5 */
|
|
|
974 |
$carry5 = ($h5 + (1 << 24)) >> 25;
|
|
|
975 |
$h6 += $carry5;
|
|
|
976 |
$h5 -= $carry5 << 25;
|
|
|
977 |
|
|
|
978 |
/** @var int $carry2 */
|
|
|
979 |
$carry2 = ($h2 + (1 << 25)) >> 26;
|
|
|
980 |
$h3 += $carry2;
|
|
|
981 |
$h2 -= $carry2 << 26;
|
|
|
982 |
/** @var int $carry6 */
|
|
|
983 |
$carry6 = ($h6 + (1 << 25)) >> 26;
|
|
|
984 |
$h7 += $carry6;
|
|
|
985 |
$h6 -= $carry6 << 26;
|
|
|
986 |
|
|
|
987 |
/** @var int $carry3 */
|
|
|
988 |
$carry3 = ($h3 + (1 << 24)) >> 25;
|
|
|
989 |
$h4 += $carry3;
|
|
|
990 |
$h3 -= $carry3 << 25;
|
|
|
991 |
/** @var int $carry7 */
|
|
|
992 |
$carry7 = ($h7 + (1 << 24)) >> 25;
|
|
|
993 |
$h8 += $carry7;
|
|
|
994 |
$h7 -= $carry7 << 25;
|
|
|
995 |
|
|
|
996 |
/** @var int $carry4 */
|
|
|
997 |
$carry4 = ($h4 + (1 << 25)) >> 26;
|
|
|
998 |
$h5 += $carry4;
|
|
|
999 |
$h4 -= $carry4 << 26;
|
|
|
1000 |
/** @var int $carry8 */
|
|
|
1001 |
$carry8 = ($h8 + (1 << 25)) >> 26;
|
|
|
1002 |
$h9 += $carry8;
|
|
|
1003 |
$h8 -= $carry8 << 26;
|
|
|
1004 |
|
|
|
1005 |
/** @var int $carry9 */
|
|
|
1006 |
$carry9 = ($h9 + (1 << 24)) >> 25;
|
|
|
1007 |
$h0 += self::mul($carry9, 19, 5);
|
|
|
1008 |
$h9 -= $carry9 << 25;
|
|
|
1009 |
|
|
|
1010 |
/** @var int $carry0 */
|
|
|
1011 |
$carry0 = ($h0 + (1 << 25)) >> 26;
|
|
|
1012 |
$h1 += $carry0;
|
|
|
1013 |
$h0 -= $carry0 << 26;
|
|
|
1014 |
|
|
|
1015 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
|
|
|
1016 |
array(
|
|
|
1017 |
(int) $h0,
|
|
|
1018 |
(int) $h1,
|
|
|
1019 |
(int) $h2,
|
|
|
1020 |
(int) $h3,
|
|
|
1021 |
(int) $h4,
|
|
|
1022 |
(int) $h5,
|
|
|
1023 |
(int) $h6,
|
|
|
1024 |
(int) $h7,
|
|
|
1025 |
(int) $h8,
|
|
|
1026 |
(int) $h9
|
|
|
1027 |
)
|
|
|
1028 |
);
|
|
|
1029 |
}
|
|
|
1030 |
|
|
|
1031 |
/**
|
|
|
1032 |
* @internal You should not use this directly from another application
|
|
|
1033 |
*
|
|
|
1034 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $Z
|
|
|
1035 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
1036 |
*/
|
|
|
1037 |
public static function fe_invert(ParagonIE_Sodium_Core_Curve25519_Fe $Z)
|
|
|
1038 |
{
|
|
|
1039 |
$z = clone $Z;
|
|
|
1040 |
$t0 = self::fe_sq($z);
|
|
|
1041 |
$t1 = self::fe_sq($t0);
|
|
|
1042 |
$t1 = self::fe_sq($t1);
|
|
|
1043 |
$t1 = self::fe_mul($z, $t1);
|
|
|
1044 |
$t0 = self::fe_mul($t0, $t1);
|
|
|
1045 |
$t2 = self::fe_sq($t0);
|
|
|
1046 |
$t1 = self::fe_mul($t1, $t2);
|
|
|
1047 |
$t2 = self::fe_sq($t1);
|
|
|
1048 |
for ($i = 1; $i < 5; ++$i) {
|
|
|
1049 |
$t2 = self::fe_sq($t2);
|
|
|
1050 |
}
|
|
|
1051 |
$t1 = self::fe_mul($t2, $t1);
|
|
|
1052 |
$t2 = self::fe_sq($t1);
|
|
|
1053 |
for ($i = 1; $i < 10; ++$i) {
|
|
|
1054 |
$t2 = self::fe_sq($t2);
|
|
|
1055 |
}
|
|
|
1056 |
$t2 = self::fe_mul($t2, $t1);
|
|
|
1057 |
$t3 = self::fe_sq($t2);
|
|
|
1058 |
for ($i = 1; $i < 20; ++$i) {
|
|
|
1059 |
$t3 = self::fe_sq($t3);
|
|
|
1060 |
}
|
|
|
1061 |
$t2 = self::fe_mul($t3, $t2);
|
|
|
1062 |
$t2 = self::fe_sq($t2);
|
|
|
1063 |
for ($i = 1; $i < 10; ++$i) {
|
|
|
1064 |
$t2 = self::fe_sq($t2);
|
|
|
1065 |
}
|
|
|
1066 |
$t1 = self::fe_mul($t2, $t1);
|
|
|
1067 |
$t2 = self::fe_sq($t1);
|
|
|
1068 |
for ($i = 1; $i < 50; ++$i) {
|
|
|
1069 |
$t2 = self::fe_sq($t2);
|
|
|
1070 |
}
|
|
|
1071 |
$t2 = self::fe_mul($t2, $t1);
|
|
|
1072 |
$t3 = self::fe_sq($t2);
|
|
|
1073 |
for ($i = 1; $i < 100; ++$i) {
|
|
|
1074 |
$t3 = self::fe_sq($t3);
|
|
|
1075 |
}
|
|
|
1076 |
$t2 = self::fe_mul($t3, $t2);
|
|
|
1077 |
$t2 = self::fe_sq($t2);
|
|
|
1078 |
for ($i = 1; $i < 50; ++$i) {
|
|
|
1079 |
$t2 = self::fe_sq($t2);
|
|
|
1080 |
}
|
|
|
1081 |
$t1 = self::fe_mul($t2, $t1);
|
|
|
1082 |
$t1 = self::fe_sq($t1);
|
|
|
1083 |
for ($i = 1; $i < 5; ++$i) {
|
|
|
1084 |
$t1 = self::fe_sq($t1);
|
|
|
1085 |
}
|
|
|
1086 |
return self::fe_mul($t1, $t0);
|
|
|
1087 |
}
|
|
|
1088 |
|
|
|
1089 |
/**
|
|
|
1090 |
* @internal You should not use this directly from another application
|
|
|
1091 |
*
|
|
|
1092 |
* @ref https://github.com/jedisct1/libsodium/blob/68564326e1e9dc57ef03746f85734232d20ca6fb/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c#L1054-L1106
|
|
|
1093 |
*
|
|
|
1094 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $z
|
|
|
1095 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
1096 |
*/
|
|
|
1097 |
public static function fe_pow22523(ParagonIE_Sodium_Core_Curve25519_Fe $z)
|
|
|
1098 |
{
|
|
|
1099 |
# fe_sq(t0, z);
|
|
|
1100 |
# fe_sq(t1, t0);
|
|
|
1101 |
# fe_sq(t1, t1);
|
|
|
1102 |
# fe_mul(t1, z, t1);
|
|
|
1103 |
# fe_mul(t0, t0, t1);
|
|
|
1104 |
# fe_sq(t0, t0);
|
|
|
1105 |
# fe_mul(t0, t1, t0);
|
|
|
1106 |
# fe_sq(t1, t0);
|
|
|
1107 |
$t0 = self::fe_sq($z);
|
|
|
1108 |
$t1 = self::fe_sq($t0);
|
|
|
1109 |
$t1 = self::fe_sq($t1);
|
|
|
1110 |
$t1 = self::fe_mul($z, $t1);
|
|
|
1111 |
$t0 = self::fe_mul($t0, $t1);
|
|
|
1112 |
$t0 = self::fe_sq($t0);
|
|
|
1113 |
$t0 = self::fe_mul($t1, $t0);
|
|
|
1114 |
$t1 = self::fe_sq($t0);
|
|
|
1115 |
|
|
|
1116 |
# for (i = 1; i < 5; ++i) {
|
|
|
1117 |
# fe_sq(t1, t1);
|
|
|
1118 |
# }
|
|
|
1119 |
for ($i = 1; $i < 5; ++$i) {
|
|
|
1120 |
$t1 = self::fe_sq($t1);
|
|
|
1121 |
}
|
|
|
1122 |
|
|
|
1123 |
# fe_mul(t0, t1, t0);
|
|
|
1124 |
# fe_sq(t1, t0);
|
|
|
1125 |
$t0 = self::fe_mul($t1, $t0);
|
|
|
1126 |
$t1 = self::fe_sq($t0);
|
|
|
1127 |
|
|
|
1128 |
# for (i = 1; i < 10; ++i) {
|
|
|
1129 |
# fe_sq(t1, t1);
|
|
|
1130 |
# }
|
|
|
1131 |
for ($i = 1; $i < 10; ++$i) {
|
|
|
1132 |
$t1 = self::fe_sq($t1);
|
|
|
1133 |
}
|
|
|
1134 |
|
|
|
1135 |
# fe_mul(t1, t1, t0);
|
|
|
1136 |
# fe_sq(t2, t1);
|
|
|
1137 |
$t1 = self::fe_mul($t1, $t0);
|
|
|
1138 |
$t2 = self::fe_sq($t1);
|
|
|
1139 |
|
|
|
1140 |
# for (i = 1; i < 20; ++i) {
|
|
|
1141 |
# fe_sq(t2, t2);
|
|
|
1142 |
# }
|
|
|
1143 |
for ($i = 1; $i < 20; ++$i) {
|
|
|
1144 |
$t2 = self::fe_sq($t2);
|
|
|
1145 |
}
|
|
|
1146 |
|
|
|
1147 |
# fe_mul(t1, t2, t1);
|
|
|
1148 |
# fe_sq(t1, t1);
|
|
|
1149 |
$t1 = self::fe_mul($t2, $t1);
|
|
|
1150 |
$t1 = self::fe_sq($t1);
|
|
|
1151 |
|
|
|
1152 |
# for (i = 1; i < 10; ++i) {
|
|
|
1153 |
# fe_sq(t1, t1);
|
|
|
1154 |
# }
|
|
|
1155 |
for ($i = 1; $i < 10; ++$i) {
|
|
|
1156 |
$t1 = self::fe_sq($t1);
|
|
|
1157 |
}
|
|
|
1158 |
|
|
|
1159 |
# fe_mul(t0, t1, t0);
|
|
|
1160 |
# fe_sq(t1, t0);
|
|
|
1161 |
$t0 = self::fe_mul($t1, $t0);
|
|
|
1162 |
$t1 = self::fe_sq($t0);
|
|
|
1163 |
|
|
|
1164 |
# for (i = 1; i < 50; ++i) {
|
|
|
1165 |
# fe_sq(t1, t1);
|
|
|
1166 |
# }
|
|
|
1167 |
for ($i = 1; $i < 50; ++$i) {
|
|
|
1168 |
$t1 = self::fe_sq($t1);
|
|
|
1169 |
}
|
|
|
1170 |
|
|
|
1171 |
# fe_mul(t1, t1, t0);
|
|
|
1172 |
# fe_sq(t2, t1);
|
|
|
1173 |
$t1 = self::fe_mul($t1, $t0);
|
|
|
1174 |
$t2 = self::fe_sq($t1);
|
|
|
1175 |
|
|
|
1176 |
# for (i = 1; i < 100; ++i) {
|
|
|
1177 |
# fe_sq(t2, t2);
|
|
|
1178 |
# }
|
|
|
1179 |
for ($i = 1; $i < 100; ++$i) {
|
|
|
1180 |
$t2 = self::fe_sq($t2);
|
|
|
1181 |
}
|
|
|
1182 |
|
|
|
1183 |
# fe_mul(t1, t2, t1);
|
|
|
1184 |
# fe_sq(t1, t1);
|
|
|
1185 |
$t1 = self::fe_mul($t2, $t1);
|
|
|
1186 |
$t1 = self::fe_sq($t1);
|
|
|
1187 |
|
|
|
1188 |
# for (i = 1; i < 50; ++i) {
|
|
|
1189 |
# fe_sq(t1, t1);
|
|
|
1190 |
# }
|
|
|
1191 |
for ($i = 1; $i < 50; ++$i) {
|
|
|
1192 |
$t1 = self::fe_sq($t1);
|
|
|
1193 |
}
|
|
|
1194 |
|
|
|
1195 |
# fe_mul(t0, t1, t0);
|
|
|
1196 |
# fe_sq(t0, t0);
|
|
|
1197 |
# fe_sq(t0, t0);
|
|
|
1198 |
# fe_mul(out, t0, z);
|
|
|
1199 |
$t0 = self::fe_mul($t1, $t0);
|
|
|
1200 |
$t0 = self::fe_sq($t0);
|
|
|
1201 |
$t0 = self::fe_sq($t0);
|
|
|
1202 |
return self::fe_mul($t0, $z);
|
|
|
1203 |
}
|
|
|
1204 |
|
|
|
1205 |
/**
|
|
|
1206 |
* Subtract two field elements.
|
|
|
1207 |
*
|
|
|
1208 |
* h = f - g
|
|
|
1209 |
*
|
|
|
1210 |
* Preconditions:
|
|
|
1211 |
* |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
|
|
1212 |
* |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
|
|
1213 |
*
|
|
|
1214 |
* Postconditions:
|
|
|
1215 |
* |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
|
|
1216 |
*
|
|
|
1217 |
* @internal You should not use this directly from another application
|
|
|
1218 |
*
|
|
|
1219 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $f
|
|
|
1220 |
* @param ParagonIE_Sodium_Core_Curve25519_Fe $g
|
|
|
1221 |
* @return ParagonIE_Sodium_Core_Curve25519_Fe
|
|
|
1222 |
* @psalm-suppress MixedOperand
|
|
|
1223 |
*/
|
|
|
1224 |
public static function fe_sub(ParagonIE_Sodium_Core_Curve25519_Fe $f, ParagonIE_Sodium_Core_Curve25519_Fe $g)
|
|
|
1225 |
{
|
|
|
1226 |
return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(
|
|
|
1227 |
array(
|
|
|
1228 |
(int) ($f[0] - $g[0]),
|
|
|
1229 |
(int) ($f[1] - $g[1]),
|
|
|
1230 |
(int) ($f[2] - $g[2]),
|
|
|
1231 |
(int) ($f[3] - $g[3]),
|
|
|
1232 |
(int) ($f[4] - $g[4]),
|
|
|
1233 |
(int) ($f[5] - $g[5]),
|
|
|
1234 |
(int) ($f[6] - $g[6]),
|
|
|
1235 |
(int) ($f[7] - $g[7]),
|
|
|
1236 |
(int) ($f[8] - $g[8]),
|
|
|
1237 |
(int) ($f[9] - $g[9])
|
|
|
1238 |
)
|
|
|
1239 |
);
|
|
|
1240 |
}
|
|
|
1241 |
|
|
|
1242 |
/**
|
|
|
1243 |
* Add two group elements.
|
|
|
1244 |
*
|
|
|
1245 |
* r = p + q
|
|
|
1246 |
*
|
|
|
1247 |
* @internal You should not use this directly from another application
|
|
|
1248 |
*
|
|
|
1249 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1250 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Cached $q
|
|
|
1251 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
|
|
|
1252 |
*/
|
|
|
1253 |
public static function ge_add(
|
|
|
1254 |
ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p,
|
|
|
1255 |
ParagonIE_Sodium_Core_Curve25519_Ge_Cached $q
|
|
|
1256 |
) {
|
|
|
1257 |
$r = new ParagonIE_Sodium_Core_Curve25519_Ge_P1p1();
|
|
|
1258 |
$r->X = self::fe_add($p->Y, $p->X);
|
|
|
1259 |
$r->Y = self::fe_sub($p->Y, $p->X);
|
|
|
1260 |
$r->Z = self::fe_mul($r->X, $q->YplusX);
|
|
|
1261 |
$r->Y = self::fe_mul($r->Y, $q->YminusX);
|
|
|
1262 |
$r->T = self::fe_mul($q->T2d, $p->T);
|
|
|
1263 |
$r->X = self::fe_mul($p->Z, $q->Z);
|
|
|
1264 |
$t0 = self::fe_add($r->X, $r->X);
|
|
|
1265 |
$r->X = self::fe_sub($r->Z, $r->Y);
|
|
|
1266 |
$r->Y = self::fe_add($r->Z, $r->Y);
|
|
|
1267 |
$r->Z = self::fe_add($t0, $r->T);
|
|
|
1268 |
$r->T = self::fe_sub($t0, $r->T);
|
|
|
1269 |
return $r;
|
|
|
1270 |
}
|
|
|
1271 |
|
|
|
1272 |
/**
|
|
|
1273 |
* @internal You should not use this directly from another application
|
|
|
1274 |
*
|
|
|
1275 |
* @ref https://github.com/jedisct1/libsodium/blob/157c4a80c13b117608aeae12178b2d38825f9f8f/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c#L1185-L1215
|
|
|
1276 |
* @param string $a
|
|
|
1277 |
* @return array<int, mixed>
|
|
|
1278 |
* @throws SodiumException
|
|
|
1279 |
* @throws TypeError
|
|
|
1280 |
*/
|
|
|
1281 |
public static function slide($a)
|
|
|
1282 |
{
|
|
|
1283 |
if (self::strlen($a) < 256) {
|
|
|
1284 |
if (self::strlen($a) < 16) {
|
|
|
1285 |
$a = str_pad($a, 256, '0', STR_PAD_RIGHT);
|
|
|
1286 |
}
|
|
|
1287 |
}
|
|
|
1288 |
/** @var array<int, int> $r */
|
|
|
1289 |
$r = array();
|
|
|
1290 |
|
|
|
1291 |
/** @var int $i */
|
|
|
1292 |
for ($i = 0; $i < 256; ++$i) {
|
|
|
1293 |
$r[$i] = (int) (
|
|
|
1294 |
1 & (
|
|
|
1295 |
self::chrToInt($a[(int) ($i >> 3)])
|
|
|
1296 |
>>
|
|
|
1297 |
($i & 7)
|
|
|
1298 |
)
|
|
|
1299 |
);
|
|
|
1300 |
}
|
|
|
1301 |
|
|
|
1302 |
for ($i = 0;$i < 256;++$i) {
|
|
|
1303 |
if ($r[$i]) {
|
|
|
1304 |
for ($b = 1;$b <= 6 && $i + $b < 256;++$b) {
|
|
|
1305 |
if ($r[$i + $b]) {
|
|
|
1306 |
if ($r[$i] + ($r[$i + $b] << $b) <= 15) {
|
|
|
1307 |
$r[$i] += $r[$i + $b] << $b;
|
|
|
1308 |
$r[$i + $b] = 0;
|
|
|
1309 |
} elseif ($r[$i] - ($r[$i + $b] << $b) >= -15) {
|
|
|
1310 |
$r[$i] -= $r[$i + $b] << $b;
|
|
|
1311 |
for ($k = $i + $b; $k < 256; ++$k) {
|
|
|
1312 |
if (!$r[$k]) {
|
|
|
1313 |
$r[$k] = 1;
|
|
|
1314 |
break;
|
|
|
1315 |
}
|
|
|
1316 |
$r[$k] = 0;
|
|
|
1317 |
}
|
|
|
1318 |
} else {
|
|
|
1319 |
break;
|
|
|
1320 |
}
|
|
|
1321 |
}
|
|
|
1322 |
}
|
|
|
1323 |
}
|
|
|
1324 |
}
|
|
|
1325 |
return $r;
|
|
|
1326 |
}
|
|
|
1327 |
|
|
|
1328 |
/**
|
|
|
1329 |
* @internal You should not use this directly from another application
|
|
|
1330 |
*
|
|
|
1331 |
* @param string $s
|
|
|
1332 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P3
|
|
|
1333 |
* @throws SodiumException
|
|
|
1334 |
* @throws TypeError
|
|
|
1335 |
*/
|
|
|
1336 |
public static function ge_frombytes_negate_vartime($s)
|
|
|
1337 |
{
|
|
|
1338 |
static $d = null;
|
|
|
1339 |
if (!$d) {
|
|
|
1340 |
$d = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$d);
|
|
|
1341 |
}
|
|
|
1342 |
|
|
|
1343 |
# fe_frombytes(h->Y,s);
|
|
|
1344 |
# fe_1(h->Z);
|
|
|
1345 |
$h = new ParagonIE_Sodium_Core_Curve25519_Ge_P3(
|
|
|
1346 |
self::fe_0(),
|
|
|
1347 |
self::fe_frombytes($s),
|
|
|
1348 |
self::fe_1()
|
|
|
1349 |
);
|
|
|
1350 |
|
|
|
1351 |
# fe_sq(u,h->Y);
|
|
|
1352 |
# fe_mul(v,u,d);
|
|
|
1353 |
# fe_sub(u,u,h->Z); /* u = y^2-1 */
|
|
|
1354 |
# fe_add(v,v,h->Z); /* v = dy^2+1 */
|
|
|
1355 |
$u = self::fe_sq($h->Y);
|
|
|
1356 |
/** @var ParagonIE_Sodium_Core_Curve25519_Fe $d */
|
|
|
1357 |
$v = self::fe_mul($u, $d);
|
|
|
1358 |
$u = self::fe_sub($u, $h->Z); /* u = y^2 - 1 */
|
|
|
1359 |
$v = self::fe_add($v, $h->Z); /* v = dy^2 + 1 */
|
|
|
1360 |
|
|
|
1361 |
# fe_sq(v3,v);
|
|
|
1362 |
# fe_mul(v3,v3,v); /* v3 = v^3 */
|
|
|
1363 |
# fe_sq(h->X,v3);
|
|
|
1364 |
# fe_mul(h->X,h->X,v);
|
|
|
1365 |
# fe_mul(h->X,h->X,u); /* x = uv^7 */
|
|
|
1366 |
$v3 = self::fe_sq($v);
|
|
|
1367 |
$v3 = self::fe_mul($v3, $v); /* v3 = v^3 */
|
|
|
1368 |
$h->X = self::fe_sq($v3);
|
|
|
1369 |
$h->X = self::fe_mul($h->X, $v);
|
|
|
1370 |
$h->X = self::fe_mul($h->X, $u); /* x = uv^7 */
|
|
|
1371 |
|
|
|
1372 |
# fe_pow22523(h->X,h->X); /* x = (uv^7)^((q-5)/8) */
|
|
|
1373 |
# fe_mul(h->X,h->X,v3);
|
|
|
1374 |
# fe_mul(h->X,h->X,u); /* x = uv^3(uv^7)^((q-5)/8) */
|
|
|
1375 |
$h->X = self::fe_pow22523($h->X); /* x = (uv^7)^((q-5)/8) */
|
|
|
1376 |
$h->X = self::fe_mul($h->X, $v3);
|
|
|
1377 |
$h->X = self::fe_mul($h->X, $u); /* x = uv^3(uv^7)^((q-5)/8) */
|
|
|
1378 |
|
|
|
1379 |
# fe_sq(vxx,h->X);
|
|
|
1380 |
# fe_mul(vxx,vxx,v);
|
|
|
1381 |
# fe_sub(check,vxx,u); /* vx^2-u */
|
|
|
1382 |
$vxx = self::fe_sq($h->X);
|
|
|
1383 |
$vxx = self::fe_mul($vxx, $v);
|
|
|
1384 |
$check = self::fe_sub($vxx, $u); /* vx^2 - u */
|
|
|
1385 |
|
|
|
1386 |
# if (fe_isnonzero(check)) {
|
|
|
1387 |
# fe_add(check,vxx,u); /* vx^2+u */
|
|
|
1388 |
# if (fe_isnonzero(check)) {
|
|
|
1389 |
# return -1;
|
|
|
1390 |
# }
|
|
|
1391 |
# fe_mul(h->X,h->X,sqrtm1);
|
|
|
1392 |
# }
|
|
|
1393 |
if (self::fe_isnonzero($check)) {
|
|
|
1394 |
$check = self::fe_add($vxx, $u); /* vx^2 + u */
|
|
|
1395 |
if (self::fe_isnonzero($check)) {
|
|
|
1396 |
throw new RangeException('Internal check failed.');
|
|
|
1397 |
}
|
|
|
1398 |
$h->X = self::fe_mul(
|
|
|
1399 |
$h->X,
|
|
|
1400 |
ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$sqrtm1)
|
|
|
1401 |
);
|
|
|
1402 |
}
|
|
|
1403 |
|
|
|
1404 |
# if (fe_isnegative(h->X) == (s[31] >> 7)) {
|
|
|
1405 |
# fe_neg(h->X,h->X);
|
|
|
1406 |
# }
|
|
|
1407 |
$i = self::chrToInt($s[31]);
|
|
|
1408 |
if (self::fe_isnegative($h->X) === ($i >> 7)) {
|
|
|
1409 |
$h->X = self::fe_neg($h->X);
|
|
|
1410 |
}
|
|
|
1411 |
|
|
|
1412 |
# fe_mul(h->T,h->X,h->Y);
|
|
|
1413 |
$h->T = self::fe_mul($h->X, $h->Y);
|
|
|
1414 |
return $h;
|
|
|
1415 |
}
|
|
|
1416 |
|
|
|
1417 |
/**
|
|
|
1418 |
* @internal You should not use this directly from another application
|
|
|
1419 |
*
|
|
|
1420 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R
|
|
|
1421 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1422 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
|
|
|
1423 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
|
|
|
1424 |
*/
|
|
|
1425 |
public static function ge_madd(
|
|
|
1426 |
ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R,
|
|
|
1427 |
ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p,
|
|
|
1428 |
ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
|
|
|
1429 |
) {
|
|
|
1430 |
$r = clone $R;
|
|
|
1431 |
$r->X = self::fe_add($p->Y, $p->X);
|
|
|
1432 |
$r->Y = self::fe_sub($p->Y, $p->X);
|
|
|
1433 |
$r->Z = self::fe_mul($r->X, $q->yplusx);
|
|
|
1434 |
$r->Y = self::fe_mul($r->Y, $q->yminusx);
|
|
|
1435 |
$r->T = self::fe_mul($q->xy2d, $p->T);
|
|
|
1436 |
$t0 = self::fe_add(clone $p->Z, clone $p->Z);
|
|
|
1437 |
$r->X = self::fe_sub($r->Z, $r->Y);
|
|
|
1438 |
$r->Y = self::fe_add($r->Z, $r->Y);
|
|
|
1439 |
$r->Z = self::fe_add($t0, $r->T);
|
|
|
1440 |
$r->T = self::fe_sub($t0, $r->T);
|
|
|
1441 |
|
|
|
1442 |
return $r;
|
|
|
1443 |
}
|
|
|
1444 |
|
|
|
1445 |
/**
|
|
|
1446 |
* @internal You should not use this directly from another application
|
|
|
1447 |
*
|
|
|
1448 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R
|
|
|
1449 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1450 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
|
|
|
1451 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
|
|
|
1452 |
*/
|
|
|
1453 |
public static function ge_msub(
|
|
|
1454 |
ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $R,
|
|
|
1455 |
ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p,
|
|
|
1456 |
ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $q
|
|
|
1457 |
) {
|
|
|
1458 |
$r = clone $R;
|
|
|
1459 |
|
|
|
1460 |
$r->X = self::fe_add($p->Y, $p->X);
|
|
|
1461 |
$r->Y = self::fe_sub($p->Y, $p->X);
|
|
|
1462 |
$r->Z = self::fe_mul($r->X, $q->yminusx);
|
|
|
1463 |
$r->Y = self::fe_mul($r->Y, $q->yplusx);
|
|
|
1464 |
$r->T = self::fe_mul($q->xy2d, $p->T);
|
|
|
1465 |
$t0 = self::fe_add($p->Z, $p->Z);
|
|
|
1466 |
$r->X = self::fe_sub($r->Z, $r->Y);
|
|
|
1467 |
$r->Y = self::fe_add($r->Z, $r->Y);
|
|
|
1468 |
$r->Z = self::fe_sub($t0, $r->T);
|
|
|
1469 |
$r->T = self::fe_add($t0, $r->T);
|
|
|
1470 |
|
|
|
1471 |
return $r;
|
|
|
1472 |
}
|
|
|
1473 |
|
|
|
1474 |
/**
|
|
|
1475 |
* @internal You should not use this directly from another application
|
|
|
1476 |
*
|
|
|
1477 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $p
|
|
|
1478 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P2
|
|
|
1479 |
*/
|
|
|
1480 |
public static function ge_p1p1_to_p2(ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $p)
|
|
|
1481 |
{
|
|
|
1482 |
$r = new ParagonIE_Sodium_Core_Curve25519_Ge_P2();
|
|
|
1483 |
$r->X = self::fe_mul($p->X, $p->T);
|
|
|
1484 |
$r->Y = self::fe_mul($p->Y, $p->Z);
|
|
|
1485 |
$r->Z = self::fe_mul($p->Z, $p->T);
|
|
|
1486 |
return $r;
|
|
|
1487 |
}
|
|
|
1488 |
|
|
|
1489 |
/**
|
|
|
1490 |
* @internal You should not use this directly from another application
|
|
|
1491 |
*
|
|
|
1492 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $p
|
|
|
1493 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P3
|
|
|
1494 |
*/
|
|
|
1495 |
public static function ge_p1p1_to_p3(ParagonIE_Sodium_Core_Curve25519_Ge_P1p1 $p)
|
|
|
1496 |
{
|
|
|
1497 |
$r = new ParagonIE_Sodium_Core_Curve25519_Ge_P3();
|
|
|
1498 |
$r->X = self::fe_mul($p->X, $p->T);
|
|
|
1499 |
$r->Y = self::fe_mul($p->Y, $p->Z);
|
|
|
1500 |
$r->Z = self::fe_mul($p->Z, $p->T);
|
|
|
1501 |
$r->T = self::fe_mul($p->X, $p->Y);
|
|
|
1502 |
return $r;
|
|
|
1503 |
}
|
|
|
1504 |
|
|
|
1505 |
/**
|
|
|
1506 |
* @internal You should not use this directly from another application
|
|
|
1507 |
*
|
|
|
1508 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P2
|
|
|
1509 |
*/
|
|
|
1510 |
public static function ge_p2_0()
|
|
|
1511 |
{
|
|
|
1512 |
return new ParagonIE_Sodium_Core_Curve25519_Ge_P2(
|
|
|
1513 |
self::fe_0(),
|
|
|
1514 |
self::fe_1(),
|
|
|
1515 |
self::fe_1()
|
|
|
1516 |
);
|
|
|
1517 |
}
|
|
|
1518 |
|
|
|
1519 |
/**
|
|
|
1520 |
* @internal You should not use this directly from another application
|
|
|
1521 |
*
|
|
|
1522 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P2 $p
|
|
|
1523 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
|
|
|
1524 |
*/
|
|
|
1525 |
public static function ge_p2_dbl(ParagonIE_Sodium_Core_Curve25519_Ge_P2 $p)
|
|
|
1526 |
{
|
|
|
1527 |
$r = new ParagonIE_Sodium_Core_Curve25519_Ge_P1p1();
|
|
|
1528 |
|
|
|
1529 |
$r->X = self::fe_sq($p->X);
|
|
|
1530 |
$r->Z = self::fe_sq($p->Y);
|
|
|
1531 |
$r->T = self::fe_sq2($p->Z);
|
|
|
1532 |
$r->Y = self::fe_add($p->X, $p->Y);
|
|
|
1533 |
$t0 = self::fe_sq($r->Y);
|
|
|
1534 |
$r->Y = self::fe_add($r->Z, $r->X);
|
|
|
1535 |
$r->Z = self::fe_sub($r->Z, $r->X);
|
|
|
1536 |
$r->X = self::fe_sub($t0, $r->Y);
|
|
|
1537 |
$r->T = self::fe_sub($r->T, $r->Z);
|
|
|
1538 |
|
|
|
1539 |
return $r;
|
|
|
1540 |
}
|
|
|
1541 |
|
|
|
1542 |
/**
|
|
|
1543 |
* @internal You should not use this directly from another application
|
|
|
1544 |
*
|
|
|
1545 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P3
|
|
|
1546 |
*/
|
|
|
1547 |
public static function ge_p3_0()
|
|
|
1548 |
{
|
|
|
1549 |
return new ParagonIE_Sodium_Core_Curve25519_Ge_P3(
|
|
|
1550 |
self::fe_0(),
|
|
|
1551 |
self::fe_1(),
|
|
|
1552 |
self::fe_1(),
|
|
|
1553 |
self::fe_0()
|
|
|
1554 |
);
|
|
|
1555 |
}
|
|
|
1556 |
|
|
|
1557 |
/**
|
|
|
1558 |
* @internal You should not use this directly from another application
|
|
|
1559 |
*
|
|
|
1560 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1561 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_Cached
|
|
|
1562 |
*/
|
|
|
1563 |
public static function ge_p3_to_cached(ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p)
|
|
|
1564 |
{
|
|
|
1565 |
static $d2 = null;
|
|
|
1566 |
if ($d2 === null) {
|
|
|
1567 |
$d2 = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$d2);
|
|
|
1568 |
}
|
|
|
1569 |
/** @var ParagonIE_Sodium_Core_Curve25519_Fe $d2 */
|
|
|
1570 |
$r = new ParagonIE_Sodium_Core_Curve25519_Ge_Cached();
|
|
|
1571 |
$r->YplusX = self::fe_add($p->Y, $p->X);
|
|
|
1572 |
$r->YminusX = self::fe_sub($p->Y, $p->X);
|
|
|
1573 |
$r->Z = self::fe_copy($p->Z);
|
|
|
1574 |
$r->T2d = self::fe_mul($p->T, $d2);
|
|
|
1575 |
return $r;
|
|
|
1576 |
}
|
|
|
1577 |
|
|
|
1578 |
/**
|
|
|
1579 |
* @internal You should not use this directly from another application
|
|
|
1580 |
*
|
|
|
1581 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1582 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P2
|
|
|
1583 |
*/
|
|
|
1584 |
public static function ge_p3_to_p2(ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p)
|
|
|
1585 |
{
|
|
|
1586 |
return new ParagonIE_Sodium_Core_Curve25519_Ge_P2(
|
|
18
|
1587 |
self::fe_copy($p->X),
|
|
|
1588 |
self::fe_copy($p->Y),
|
|
|
1589 |
self::fe_copy($p->Z)
|
|
9
|
1590 |
);
|
|
|
1591 |
}
|
|
|
1592 |
|
|
|
1593 |
/**
|
|
|
1594 |
* @internal You should not use this directly from another application
|
|
|
1595 |
*
|
|
|
1596 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $h
|
|
|
1597 |
* @return string
|
|
|
1598 |
* @throws SodiumException
|
|
|
1599 |
* @throws TypeError
|
|
|
1600 |
*/
|
|
|
1601 |
public static function ge_p3_tobytes(ParagonIE_Sodium_Core_Curve25519_Ge_P3 $h)
|
|
|
1602 |
{
|
|
|
1603 |
$recip = self::fe_invert($h->Z);
|
|
|
1604 |
$x = self::fe_mul($h->X, $recip);
|
|
|
1605 |
$y = self::fe_mul($h->Y, $recip);
|
|
|
1606 |
$s = self::fe_tobytes($y);
|
|
|
1607 |
$s[31] = self::intToChr(
|
|
|
1608 |
self::chrToInt($s[31]) ^ (self::fe_isnegative($x) << 7)
|
|
|
1609 |
);
|
|
|
1610 |
return $s;
|
|
|
1611 |
}
|
|
|
1612 |
|
|
|
1613 |
/**
|
|
|
1614 |
* @internal You should not use this directly from another application
|
|
|
1615 |
*
|
|
|
1616 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1617 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
|
|
|
1618 |
*/
|
|
|
1619 |
public static function ge_p3_dbl(ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p)
|
|
|
1620 |
{
|
|
|
1621 |
$q = self::ge_p3_to_p2($p);
|
|
|
1622 |
return self::ge_p2_dbl($q);
|
|
|
1623 |
}
|
|
|
1624 |
|
|
|
1625 |
/**
|
|
|
1626 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_Precomp
|
|
|
1627 |
*/
|
|
|
1628 |
public static function ge_precomp_0()
|
|
|
1629 |
{
|
|
|
1630 |
return new ParagonIE_Sodium_Core_Curve25519_Ge_Precomp(
|
|
|
1631 |
self::fe_1(),
|
|
|
1632 |
self::fe_1(),
|
|
|
1633 |
self::fe_0()
|
|
|
1634 |
);
|
|
|
1635 |
}
|
|
|
1636 |
|
|
|
1637 |
/**
|
|
|
1638 |
* @internal You should not use this directly from another application
|
|
|
1639 |
*
|
|
|
1640 |
* @param int $b
|
|
|
1641 |
* @param int $c
|
|
|
1642 |
* @return int
|
|
|
1643 |
*/
|
|
|
1644 |
public static function equal($b, $c)
|
|
|
1645 |
{
|
|
18
|
1646 |
return (int) ((($b ^ $c) - 1) >> 31) & 1;
|
|
9
|
1647 |
}
|
|
|
1648 |
|
|
|
1649 |
/**
|
|
|
1650 |
* @internal You should not use this directly from another application
|
|
|
1651 |
*
|
|
|
1652 |
* @param int|string $char
|
|
|
1653 |
* @return int (1 = yes, 0 = no)
|
|
|
1654 |
* @throws SodiumException
|
|
|
1655 |
* @throws TypeError
|
|
|
1656 |
*/
|
|
|
1657 |
public static function negative($char)
|
|
|
1658 |
{
|
|
|
1659 |
if (is_int($char)) {
|
|
18
|
1660 |
return ($char >> 63) & 1;
|
|
9
|
1661 |
}
|
|
|
1662 |
$x = self::chrToInt(self::substr($char, 0, 1));
|
|
|
1663 |
return (int) ($x >> 63);
|
|
|
1664 |
}
|
|
|
1665 |
|
|
|
1666 |
/**
|
|
|
1667 |
* Conditional move
|
|
|
1668 |
*
|
|
|
1669 |
* @internal You should not use this directly from another application
|
|
|
1670 |
*
|
|
|
1671 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $t
|
|
|
1672 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $u
|
|
|
1673 |
* @param int $b
|
|
|
1674 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_Precomp
|
|
|
1675 |
*/
|
|
|
1676 |
public static function cmov(
|
|
|
1677 |
ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $t,
|
|
|
1678 |
ParagonIE_Sodium_Core_Curve25519_Ge_Precomp $u,
|
|
|
1679 |
$b
|
|
|
1680 |
) {
|
|
|
1681 |
if (!is_int($b)) {
|
|
|
1682 |
throw new InvalidArgumentException('Expected an integer.');
|
|
|
1683 |
}
|
|
|
1684 |
return new ParagonIE_Sodium_Core_Curve25519_Ge_Precomp(
|
|
18
|
1685 |
self::fe_cmov($t->yplusx, $u->yplusx, $b),
|
|
9
|
1686 |
self::fe_cmov($t->yminusx, $u->yminusx, $b),
|
|
18
|
1687 |
self::fe_cmov($t->xy2d, $u->xy2d, $b)
|
|
9
|
1688 |
);
|
|
|
1689 |
}
|
|
|
1690 |
|
|
|
1691 |
/**
|
|
18
|
1692 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Cached $t
|
|
|
1693 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Cached $u
|
|
|
1694 |
* @param int $b
|
|
|
1695 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_Cached
|
|
|
1696 |
*/
|
|
|
1697 |
public static function ge_cmov_cached(
|
|
|
1698 |
ParagonIE_Sodium_Core_Curve25519_Ge_Cached $t,
|
|
|
1699 |
ParagonIE_Sodium_Core_Curve25519_Ge_Cached $u,
|
|
|
1700 |
$b
|
|
|
1701 |
) {
|
|
|
1702 |
$b &= 1;
|
|
|
1703 |
$ret = new ParagonIE_Sodium_Core_Curve25519_Ge_Cached();
|
|
|
1704 |
$ret->YplusX = self::fe_cmov($t->YplusX, $u->YplusX, $b);
|
|
|
1705 |
$ret->YminusX = self::fe_cmov($t->YminusX, $u->YminusX, $b);
|
|
|
1706 |
$ret->Z = self::fe_cmov($t->Z, $u->Z, $b);
|
|
|
1707 |
$ret->T2d = self::fe_cmov($t->T2d, $u->T2d, $b);
|
|
|
1708 |
return $ret;
|
|
|
1709 |
}
|
|
|
1710 |
|
|
|
1711 |
/**
|
|
|
1712 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Cached[] $cached
|
|
|
1713 |
* @param int $b
|
|
|
1714 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_Cached
|
|
|
1715 |
* @throws SodiumException
|
|
|
1716 |
*/
|
|
|
1717 |
public static function ge_cmov8_cached(array $cached, $b)
|
|
|
1718 |
{
|
|
|
1719 |
// const unsigned char bnegative = negative(b);
|
|
|
1720 |
// const unsigned char babs = b - (((-bnegative) & b) * ((signed char) 1 << 1));
|
|
|
1721 |
$bnegative = self::negative($b);
|
|
|
1722 |
$babs = $b - (((-$bnegative) & $b) << 1);
|
|
|
1723 |
|
|
|
1724 |
// ge25519_cached_0(t);
|
|
|
1725 |
$t = new ParagonIE_Sodium_Core_Curve25519_Ge_Cached(
|
|
|
1726 |
self::fe_1(),
|
|
|
1727 |
self::fe_1(),
|
|
|
1728 |
self::fe_1(),
|
|
|
1729 |
self::fe_0()
|
|
|
1730 |
);
|
|
|
1731 |
|
|
|
1732 |
// ge25519_cmov_cached(t, &cached[0], equal(babs, 1));
|
|
|
1733 |
// ge25519_cmov_cached(t, &cached[1], equal(babs, 2));
|
|
|
1734 |
// ge25519_cmov_cached(t, &cached[2], equal(babs, 3));
|
|
|
1735 |
// ge25519_cmov_cached(t, &cached[3], equal(babs, 4));
|
|
|
1736 |
// ge25519_cmov_cached(t, &cached[4], equal(babs, 5));
|
|
|
1737 |
// ge25519_cmov_cached(t, &cached[5], equal(babs, 6));
|
|
|
1738 |
// ge25519_cmov_cached(t, &cached[6], equal(babs, 7));
|
|
|
1739 |
// ge25519_cmov_cached(t, &cached[7], equal(babs, 8));
|
|
|
1740 |
for ($x = 0; $x < 8; ++$x) {
|
|
|
1741 |
$t = self::ge_cmov_cached($t, $cached[$x], self::equal($babs, $x + 1));
|
|
|
1742 |
}
|
|
|
1743 |
|
|
|
1744 |
// fe25519_copy(minust.YplusX, t->YminusX);
|
|
|
1745 |
// fe25519_copy(minust.YminusX, t->YplusX);
|
|
|
1746 |
// fe25519_copy(minust.Z, t->Z);
|
|
|
1747 |
// fe25519_neg(minust.T2d, t->T2d);
|
|
|
1748 |
$minust = new ParagonIE_Sodium_Core_Curve25519_Ge_Cached(
|
|
|
1749 |
self::fe_copy($t->YminusX),
|
|
|
1750 |
self::fe_copy($t->YplusX),
|
|
|
1751 |
self::fe_copy($t->Z),
|
|
|
1752 |
self::fe_neg($t->T2d)
|
|
|
1753 |
);
|
|
|
1754 |
return self::ge_cmov_cached($t, $minust, $bnegative);
|
|
|
1755 |
}
|
|
|
1756 |
|
|
|
1757 |
/**
|
|
9
|
1758 |
* @internal You should not use this directly from another application
|
|
|
1759 |
*
|
|
|
1760 |
* @param int $pos
|
|
|
1761 |
* @param int $b
|
|
|
1762 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_Precomp
|
|
|
1763 |
* @throws SodiumException
|
|
|
1764 |
* @throws TypeError
|
|
|
1765 |
* @psalm-suppress MixedArgument
|
|
|
1766 |
* @psalm-suppress MixedArrayAccess
|
|
|
1767 |
* @psalm-suppress MixedArrayOffset
|
|
|
1768 |
*/
|
|
|
1769 |
public static function ge_select($pos = 0, $b = 0)
|
|
|
1770 |
{
|
|
|
1771 |
static $base = null;
|
|
|
1772 |
if ($base === null) {
|
|
|
1773 |
$base = array();
|
|
|
1774 |
/** @var int $i */
|
|
|
1775 |
foreach (self::$base as $i => $bas) {
|
|
|
1776 |
for ($j = 0; $j < 8; ++$j) {
|
|
|
1777 |
$base[$i][$j] = new ParagonIE_Sodium_Core_Curve25519_Ge_Precomp(
|
|
|
1778 |
ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($bas[$j][0]),
|
|
|
1779 |
ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($bas[$j][1]),
|
|
|
1780 |
ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($bas[$j][2])
|
|
|
1781 |
);
|
|
|
1782 |
}
|
|
|
1783 |
}
|
|
|
1784 |
}
|
|
|
1785 |
/** @var array<int, array<int, ParagonIE_Sodium_Core_Curve25519_Ge_Precomp>> $base */
|
|
|
1786 |
if (!is_int($pos)) {
|
|
|
1787 |
throw new InvalidArgumentException('Position must be an integer');
|
|
|
1788 |
}
|
|
|
1789 |
if ($pos < 0 || $pos > 31) {
|
|
|
1790 |
throw new RangeException('Position is out of range [0, 31]');
|
|
|
1791 |
}
|
|
|
1792 |
|
|
|
1793 |
/** @var int $bnegative */
|
|
|
1794 |
$bnegative = self::negative($b);
|
|
|
1795 |
/** @var int $babs */
|
|
|
1796 |
$babs = $b - (((-$bnegative) & $b) << 1);
|
|
|
1797 |
|
|
|
1798 |
$t = self::ge_precomp_0();
|
|
|
1799 |
for ($i = 0; $i < 8; ++$i) {
|
|
|
1800 |
$t = self::cmov(
|
|
|
1801 |
$t,
|
|
|
1802 |
$base[$pos][$i],
|
|
|
1803 |
self::equal($babs, $i + 1)
|
|
|
1804 |
);
|
|
|
1805 |
}
|
|
|
1806 |
$minusT = new ParagonIE_Sodium_Core_Curve25519_Ge_Precomp(
|
|
|
1807 |
self::fe_copy($t->yminusx),
|
|
|
1808 |
self::fe_copy($t->yplusx),
|
|
|
1809 |
self::fe_neg($t->xy2d)
|
|
|
1810 |
);
|
|
|
1811 |
return self::cmov($t, $minusT, $bnegative);
|
|
|
1812 |
}
|
|
|
1813 |
|
|
|
1814 |
/**
|
|
|
1815 |
* Subtract two group elements.
|
|
|
1816 |
*
|
|
|
1817 |
* r = p - q
|
|
|
1818 |
*
|
|
|
1819 |
* @internal You should not use this directly from another application
|
|
|
1820 |
*
|
|
|
1821 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1822 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_Cached $q
|
|
|
1823 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P1p1
|
|
|
1824 |
*/
|
|
|
1825 |
public static function ge_sub(
|
|
|
1826 |
ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p,
|
|
|
1827 |
ParagonIE_Sodium_Core_Curve25519_Ge_Cached $q
|
|
|
1828 |
) {
|
|
|
1829 |
$r = new ParagonIE_Sodium_Core_Curve25519_Ge_P1p1();
|
|
|
1830 |
|
|
|
1831 |
$r->X = self::fe_add($p->Y, $p->X);
|
|
|
1832 |
$r->Y = self::fe_sub($p->Y, $p->X);
|
|
|
1833 |
$r->Z = self::fe_mul($r->X, $q->YminusX);
|
|
|
1834 |
$r->Y = self::fe_mul($r->Y, $q->YplusX);
|
|
|
1835 |
$r->T = self::fe_mul($q->T2d, $p->T);
|
|
|
1836 |
$r->X = self::fe_mul($p->Z, $q->Z);
|
|
|
1837 |
$t0 = self::fe_add($r->X, $r->X);
|
|
|
1838 |
$r->X = self::fe_sub($r->Z, $r->Y);
|
|
|
1839 |
$r->Y = self::fe_add($r->Z, $r->Y);
|
|
|
1840 |
$r->Z = self::fe_sub($t0, $r->T);
|
|
|
1841 |
$r->T = self::fe_add($t0, $r->T);
|
|
|
1842 |
|
|
|
1843 |
return $r;
|
|
|
1844 |
}
|
|
|
1845 |
|
|
|
1846 |
/**
|
|
|
1847 |
* Convert a group element to a byte string.
|
|
|
1848 |
*
|
|
|
1849 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P2 $h
|
|
|
1850 |
* @return string
|
|
|
1851 |
* @throws SodiumException
|
|
|
1852 |
* @throws TypeError
|
|
|
1853 |
*/
|
|
|
1854 |
public static function ge_tobytes(ParagonIE_Sodium_Core_Curve25519_Ge_P2 $h)
|
|
|
1855 |
{
|
|
|
1856 |
$recip = self::fe_invert($h->Z);
|
|
|
1857 |
$x = self::fe_mul($h->X, $recip);
|
|
|
1858 |
$y = self::fe_mul($h->Y, $recip);
|
|
|
1859 |
$s = self::fe_tobytes($y);
|
|
|
1860 |
$s[31] = self::intToChr(
|
|
|
1861 |
self::chrToInt($s[31]) ^ (self::fe_isnegative($x) << 7)
|
|
|
1862 |
);
|
|
|
1863 |
return $s;
|
|
|
1864 |
}
|
|
|
1865 |
|
|
|
1866 |
/**
|
|
|
1867 |
* @internal You should not use this directly from another application
|
|
|
1868 |
*
|
|
|
1869 |
* @param string $a
|
|
|
1870 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $A
|
|
|
1871 |
* @param string $b
|
|
|
1872 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P2
|
|
|
1873 |
* @throws SodiumException
|
|
|
1874 |
* @throws TypeError
|
|
|
1875 |
* @psalm-suppress MixedArgument
|
|
|
1876 |
* @psalm-suppress MixedArrayAccess
|
|
|
1877 |
*/
|
|
|
1878 |
public static function ge_double_scalarmult_vartime(
|
|
|
1879 |
$a,
|
|
|
1880 |
ParagonIE_Sodium_Core_Curve25519_Ge_P3 $A,
|
|
|
1881 |
$b
|
|
|
1882 |
) {
|
|
|
1883 |
/** @var array<int, ParagonIE_Sodium_Core_Curve25519_Ge_Cached> $Ai */
|
|
|
1884 |
$Ai = array();
|
|
|
1885 |
|
|
|
1886 |
/** @var array<int, ParagonIE_Sodium_Core_Curve25519_Ge_Precomp> $Bi */
|
|
|
1887 |
static $Bi = array();
|
|
|
1888 |
if (!$Bi) {
|
|
|
1889 |
for ($i = 0; $i < 8; ++$i) {
|
|
|
1890 |
$Bi[$i] = new ParagonIE_Sodium_Core_Curve25519_Ge_Precomp(
|
|
|
1891 |
ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$base2[$i][0]),
|
|
|
1892 |
ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$base2[$i][1]),
|
|
|
1893 |
ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$base2[$i][2])
|
|
|
1894 |
);
|
|
|
1895 |
}
|
|
|
1896 |
}
|
|
|
1897 |
for ($i = 0; $i < 8; ++$i) {
|
|
|
1898 |
$Ai[$i] = new ParagonIE_Sodium_Core_Curve25519_Ge_Cached(
|
|
|
1899 |
self::fe_0(),
|
|
|
1900 |
self::fe_0(),
|
|
|
1901 |
self::fe_0(),
|
|
|
1902 |
self::fe_0()
|
|
|
1903 |
);
|
|
|
1904 |
}
|
|
|
1905 |
|
|
|
1906 |
# slide(aslide,a);
|
|
|
1907 |
# slide(bslide,b);
|
|
|
1908 |
/** @var array<int, int> $aslide */
|
|
|
1909 |
$aslide = self::slide($a);
|
|
|
1910 |
/** @var array<int, int> $bslide */
|
|
|
1911 |
$bslide = self::slide($b);
|
|
|
1912 |
|
|
|
1913 |
# ge_p3_to_cached(&Ai[0],A);
|
|
|
1914 |
# ge_p3_dbl(&t,A); ge_p1p1_to_p3(&A2,&t);
|
|
|
1915 |
$Ai[0] = self::ge_p3_to_cached($A);
|
|
|
1916 |
$t = self::ge_p3_dbl($A);
|
|
|
1917 |
$A2 = self::ge_p1p1_to_p3($t);
|
|
|
1918 |
|
|
|
1919 |
# ge_add(&t,&A2,&Ai[0]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[1],&u);
|
|
|
1920 |
# ge_add(&t,&A2,&Ai[1]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[2],&u);
|
|
|
1921 |
# ge_add(&t,&A2,&Ai[2]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[3],&u);
|
|
|
1922 |
# ge_add(&t,&A2,&Ai[3]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[4],&u);
|
|
|
1923 |
# ge_add(&t,&A2,&Ai[4]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[5],&u);
|
|
|
1924 |
# ge_add(&t,&A2,&Ai[5]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[6],&u);
|
|
|
1925 |
# ge_add(&t,&A2,&Ai[6]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[7],&u);
|
|
|
1926 |
for ($i = 0; $i < 7; ++$i) {
|
|
|
1927 |
$t = self::ge_add($A2, $Ai[$i]);
|
|
|
1928 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
1929 |
$Ai[$i + 1] = self::ge_p3_to_cached($u);
|
|
|
1930 |
}
|
|
|
1931 |
|
|
|
1932 |
# ge_p2_0(r);
|
|
|
1933 |
$r = self::ge_p2_0();
|
|
|
1934 |
|
|
|
1935 |
# for (i = 255;i >= 0;--i) {
|
|
|
1936 |
# if (aslide[i] || bslide[i]) break;
|
|
|
1937 |
# }
|
|
|
1938 |
$i = 255;
|
|
|
1939 |
for (; $i >= 0; --$i) {
|
|
|
1940 |
if ($aslide[$i] || $bslide[$i]) {
|
|
|
1941 |
break;
|
|
|
1942 |
}
|
|
|
1943 |
}
|
|
|
1944 |
|
|
|
1945 |
# for (;i >= 0;--i) {
|
|
|
1946 |
for (; $i >= 0; --$i) {
|
|
|
1947 |
# ge_p2_dbl(&t,r);
|
|
|
1948 |
$t = self::ge_p2_dbl($r);
|
|
|
1949 |
|
|
|
1950 |
# if (aslide[i] > 0) {
|
|
|
1951 |
if ($aslide[$i] > 0) {
|
|
|
1952 |
# ge_p1p1_to_p3(&u,&t);
|
|
|
1953 |
# ge_add(&t,&u,&Ai[aslide[i]/2]);
|
|
|
1954 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
1955 |
$t = self::ge_add(
|
|
|
1956 |
$u,
|
|
|
1957 |
$Ai[(int) floor($aslide[$i] / 2)]
|
|
|
1958 |
);
|
|
|
1959 |
# } else if (aslide[i] < 0) {
|
|
|
1960 |
} elseif ($aslide[$i] < 0) {
|
|
|
1961 |
# ge_p1p1_to_p3(&u,&t);
|
|
|
1962 |
# ge_sub(&t,&u,&Ai[(-aslide[i])/2]);
|
|
|
1963 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
1964 |
$t = self::ge_sub(
|
|
|
1965 |
$u,
|
|
|
1966 |
$Ai[(int) floor(-$aslide[$i] / 2)]
|
|
|
1967 |
);
|
|
|
1968 |
}
|
|
|
1969 |
|
|
|
1970 |
# if (bslide[i] > 0) {
|
|
|
1971 |
if ($bslide[$i] > 0) {
|
|
|
1972 |
/** @var int $index */
|
|
|
1973 |
$index = (int) floor($bslide[$i] / 2);
|
|
|
1974 |
# ge_p1p1_to_p3(&u,&t);
|
|
|
1975 |
# ge_madd(&t,&u,&Bi[bslide[i]/2]);
|
|
|
1976 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
1977 |
$t = self::ge_madd($t, $u, $Bi[$index]);
|
|
|
1978 |
# } else if (bslide[i] < 0) {
|
|
|
1979 |
} elseif ($bslide[$i] < 0) {
|
|
|
1980 |
/** @var int $index */
|
|
|
1981 |
$index = (int) floor(-$bslide[$i] / 2);
|
|
|
1982 |
# ge_p1p1_to_p3(&u,&t);
|
|
|
1983 |
# ge_msub(&t,&u,&Bi[(-bslide[i])/2]);
|
|
|
1984 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
1985 |
$t = self::ge_msub($t, $u, $Bi[$index]);
|
|
|
1986 |
}
|
|
|
1987 |
# ge_p1p1_to_p2(r,&t);
|
|
|
1988 |
$r = self::ge_p1p1_to_p2($t);
|
|
|
1989 |
}
|
|
|
1990 |
return $r;
|
|
|
1991 |
}
|
|
|
1992 |
|
|
|
1993 |
/**
|
|
|
1994 |
* @internal You should not use this directly from another application
|
|
|
1995 |
*
|
|
|
1996 |
* @param string $a
|
|
18
|
1997 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $p
|
|
|
1998 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P3
|
|
|
1999 |
* @throws SodiumException
|
|
|
2000 |
* @throws TypeError
|
|
|
2001 |
* @psalm-suppress MixedAssignment
|
|
|
2002 |
* @psalm-suppress MixedOperand
|
|
|
2003 |
*/
|
|
|
2004 |
public static function ge_scalarmult($a, $p)
|
|
|
2005 |
{
|
|
|
2006 |
$e = array_fill(0, 64, 0);
|
|
|
2007 |
|
|
|
2008 |
/** @var ParagonIE_Sodium_Core_Curve25519_Ge_Cached[] $pi */
|
|
|
2009 |
$pi = array();
|
|
|
2010 |
|
|
|
2011 |
// ge25519_p3_to_cached(&pi[1 - 1], p); /* p */
|
|
|
2012 |
$pi[0] = self::ge_p3_to_cached($p);
|
|
|
2013 |
|
|
|
2014 |
// ge25519_p3_dbl(&t2, p);
|
|
|
2015 |
// ge25519_p1p1_to_p3(&p2, &t2);
|
|
|
2016 |
// ge25519_p3_to_cached(&pi[2 - 1], &p2); /* 2p = 2*p */
|
|
|
2017 |
$t2 = self::ge_p3_dbl($p);
|
|
|
2018 |
$p2 = self::ge_p1p1_to_p3($t2);
|
|
|
2019 |
$pi[1] = self::ge_p3_to_cached($p2);
|
|
|
2020 |
|
|
|
2021 |
// ge25519_add_cached(&t3, p, &pi[2 - 1]);
|
|
|
2022 |
// ge25519_p1p1_to_p3(&p3, &t3);
|
|
|
2023 |
// ge25519_p3_to_cached(&pi[3 - 1], &p3); /* 3p = 2p+p */
|
|
|
2024 |
$t3 = self::ge_add($p, $pi[1]);
|
|
|
2025 |
$p3 = self::ge_p1p1_to_p3($t3);
|
|
|
2026 |
$pi[2] = self::ge_p3_to_cached($p3);
|
|
|
2027 |
|
|
|
2028 |
// ge25519_p3_dbl(&t4, &p2);
|
|
|
2029 |
// ge25519_p1p1_to_p3(&p4, &t4);
|
|
|
2030 |
// ge25519_p3_to_cached(&pi[4 - 1], &p4); /* 4p = 2*2p */
|
|
|
2031 |
$t4 = self::ge_p3_dbl($p2);
|
|
|
2032 |
$p4 = self::ge_p1p1_to_p3($t4);
|
|
|
2033 |
$pi[3] = self::ge_p3_to_cached($p4);
|
|
|
2034 |
|
|
|
2035 |
// ge25519_add_cached(&t5, p, &pi[4 - 1]);
|
|
|
2036 |
// ge25519_p1p1_to_p3(&p5, &t5);
|
|
|
2037 |
// ge25519_p3_to_cached(&pi[5 - 1], &p5); /* 5p = 4p+p */
|
|
|
2038 |
$t5 = self::ge_add($p, $pi[3]);
|
|
|
2039 |
$p5 = self::ge_p1p1_to_p3($t5);
|
|
|
2040 |
$pi[4] = self::ge_p3_to_cached($p5);
|
|
|
2041 |
|
|
|
2042 |
// ge25519_p3_dbl(&t6, &p3);
|
|
|
2043 |
// ge25519_p1p1_to_p3(&p6, &t6);
|
|
|
2044 |
// ge25519_p3_to_cached(&pi[6 - 1], &p6); /* 6p = 2*3p */
|
|
|
2045 |
$t6 = self::ge_p3_dbl($p3);
|
|
|
2046 |
$p6 = self::ge_p1p1_to_p3($t6);
|
|
|
2047 |
$pi[5] = self::ge_p3_to_cached($p6);
|
|
|
2048 |
|
|
|
2049 |
// ge25519_add_cached(&t7, p, &pi[6 - 1]);
|
|
|
2050 |
// ge25519_p1p1_to_p3(&p7, &t7);
|
|
|
2051 |
// ge25519_p3_to_cached(&pi[7 - 1], &p7); /* 7p = 6p+p */
|
|
|
2052 |
$t7 = self::ge_add($p, $pi[5]);
|
|
|
2053 |
$p7 = self::ge_p1p1_to_p3($t7);
|
|
|
2054 |
$pi[6] = self::ge_p3_to_cached($p7);
|
|
|
2055 |
|
|
|
2056 |
// ge25519_p3_dbl(&t8, &p4);
|
|
|
2057 |
// ge25519_p1p1_to_p3(&p8, &t8);
|
|
|
2058 |
// ge25519_p3_to_cached(&pi[8 - 1], &p8); /* 8p = 2*4p */
|
|
|
2059 |
$t8 = self::ge_p3_dbl($p4);
|
|
|
2060 |
$p8 = self::ge_p1p1_to_p3($t8);
|
|
|
2061 |
$pi[7] = self::ge_p3_to_cached($p8);
|
|
|
2062 |
|
|
|
2063 |
|
|
|
2064 |
// for (i = 0; i < 32; ++i) {
|
|
|
2065 |
// e[2 * i + 0] = (a[i] >> 0) & 15;
|
|
|
2066 |
// e[2 * i + 1] = (a[i] >> 4) & 15;
|
|
|
2067 |
// }
|
|
|
2068 |
for ($i = 0; $i < 32; ++$i) {
|
|
|
2069 |
$e[($i << 1) ] = self::chrToInt($a[$i]) & 15;
|
|
|
2070 |
$e[($i << 1) + 1] = (self::chrToInt($a[$i]) >> 4) & 15;
|
|
|
2071 |
}
|
|
|
2072 |
// /* each e[i] is between 0 and 15 */
|
|
|
2073 |
// /* e[63] is between 0 and 7 */
|
|
|
2074 |
|
|
|
2075 |
// carry = 0;
|
|
|
2076 |
// for (i = 0; i < 63; ++i) {
|
|
|
2077 |
// e[i] += carry;
|
|
|
2078 |
// carry = e[i] + 8;
|
|
|
2079 |
// carry >>= 4;
|
|
|
2080 |
// e[i] -= carry * ((signed char) 1 << 4);
|
|
|
2081 |
// }
|
|
|
2082 |
$carry = 0;
|
|
|
2083 |
for ($i = 0; $i < 64; ++$i) {
|
|
|
2084 |
$e[$i] += $carry;
|
|
|
2085 |
$carry = $e[$i] + 8;
|
|
|
2086 |
$carry >>= 4;
|
|
|
2087 |
$e[$i] -= $carry << 4;
|
|
|
2088 |
}
|
|
|
2089 |
// e[63] += carry;
|
|
|
2090 |
// /* each e[i] is between -8 and 8 */
|
|
|
2091 |
$e[63] += $carry;
|
|
|
2092 |
|
|
|
2093 |
// ge25519_p3_0(h);
|
|
|
2094 |
$h = self::ge_p3_0();
|
|
|
2095 |
|
|
|
2096 |
// for (i = 63; i != 0; i--) {
|
|
|
2097 |
for ($i = 63; $i != 0; --$i) {
|
|
|
2098 |
// ge25519_cmov8_cached(&t, pi, e[i]);
|
|
|
2099 |
$t = self::ge_cmov8_cached($pi, $e[$i]);
|
|
|
2100 |
// ge25519_add_cached(&r, h, &t);
|
|
|
2101 |
$r = self::ge_add($h, $t);
|
|
|
2102 |
|
|
|
2103 |
// ge25519_p1p1_to_p2(&s, &r);
|
|
|
2104 |
// ge25519_p2_dbl(&r, &s);
|
|
|
2105 |
// ge25519_p1p1_to_p2(&s, &r);
|
|
|
2106 |
// ge25519_p2_dbl(&r, &s);
|
|
|
2107 |
// ge25519_p1p1_to_p2(&s, &r);
|
|
|
2108 |
// ge25519_p2_dbl(&r, &s);
|
|
|
2109 |
// ge25519_p1p1_to_p2(&s, &r);
|
|
|
2110 |
// ge25519_p2_dbl(&r, &s);
|
|
|
2111 |
$s = self::ge_p1p1_to_p2($r);
|
|
|
2112 |
$r = self::ge_p2_dbl($s);
|
|
|
2113 |
$s = self::ge_p1p1_to_p2($r);
|
|
|
2114 |
$r = self::ge_p2_dbl($s);
|
|
|
2115 |
$s = self::ge_p1p1_to_p2($r);
|
|
|
2116 |
$r = self::ge_p2_dbl($s);
|
|
|
2117 |
$s = self::ge_p1p1_to_p2($r);
|
|
|
2118 |
$r = self::ge_p2_dbl($s);
|
|
|
2119 |
|
|
|
2120 |
// ge25519_p1p1_to_p3(h, &r); /* *16 */
|
|
|
2121 |
$h = self::ge_p1p1_to_p3($r); /* *16 */
|
|
|
2122 |
}
|
|
|
2123 |
|
|
|
2124 |
// ge25519_cmov8_cached(&t, pi, e[i]);
|
|
|
2125 |
// ge25519_add_cached(&r, h, &t);
|
|
|
2126 |
// ge25519_p1p1_to_p3(h, &r);
|
|
|
2127 |
$t = self::ge_cmov8_cached($pi, $e[0]);
|
|
|
2128 |
$r = self::ge_add($h, $t);
|
|
|
2129 |
return self::ge_p1p1_to_p3($r);
|
|
|
2130 |
}
|
|
|
2131 |
|
|
|
2132 |
/**
|
|
|
2133 |
* @internal You should not use this directly from another application
|
|
|
2134 |
*
|
|
|
2135 |
* @param string $a
|
|
9
|
2136 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P3
|
|
|
2137 |
* @throws SodiumException
|
|
|
2138 |
* @throws TypeError
|
|
|
2139 |
* @psalm-suppress MixedAssignment
|
|
|
2140 |
* @psalm-suppress MixedOperand
|
|
|
2141 |
*/
|
|
|
2142 |
public static function ge_scalarmult_base($a)
|
|
|
2143 |
{
|
|
|
2144 |
/** @var array<int, int> $e */
|
|
|
2145 |
$e = array();
|
|
|
2146 |
$r = new ParagonIE_Sodium_Core_Curve25519_Ge_P1p1();
|
|
|
2147 |
|
|
|
2148 |
for ($i = 0; $i < 32; ++$i) {
|
|
|
2149 |
/** @var int $dbl */
|
|
|
2150 |
$dbl = (int) $i << 1;
|
|
|
2151 |
$e[$dbl] = (int) self::chrToInt($a[$i]) & 15;
|
|
|
2152 |
$e[$dbl + 1] = (int) (self::chrToInt($a[$i]) >> 4) & 15;
|
|
|
2153 |
}
|
|
|
2154 |
|
|
|
2155 |
/** @var int $carry */
|
|
|
2156 |
$carry = 0;
|
|
|
2157 |
for ($i = 0; $i < 63; ++$i) {
|
|
|
2158 |
$e[$i] += $carry;
|
|
|
2159 |
/** @var int $carry */
|
|
|
2160 |
$carry = $e[$i] + 8;
|
|
|
2161 |
/** @var int $carry */
|
|
|
2162 |
$carry >>= 4;
|
|
|
2163 |
$e[$i] -= $carry << 4;
|
|
|
2164 |
}
|
|
|
2165 |
/** @var array<int, int> $e */
|
|
|
2166 |
$e[63] += (int) $carry;
|
|
|
2167 |
|
|
|
2168 |
$h = self::ge_p3_0();
|
|
|
2169 |
|
|
|
2170 |
for ($i = 1; $i < 64; $i += 2) {
|
|
|
2171 |
$t = self::ge_select((int) floor($i / 2), (int) $e[$i]);
|
|
|
2172 |
$r = self::ge_madd($r, $h, $t);
|
|
|
2173 |
$h = self::ge_p1p1_to_p3($r);
|
|
|
2174 |
}
|
|
|
2175 |
|
|
|
2176 |
$r = self::ge_p3_dbl($h);
|
|
|
2177 |
|
|
|
2178 |
$s = self::ge_p1p1_to_p2($r);
|
|
|
2179 |
$r = self::ge_p2_dbl($s);
|
|
|
2180 |
$s = self::ge_p1p1_to_p2($r);
|
|
|
2181 |
$r = self::ge_p2_dbl($s);
|
|
|
2182 |
$s = self::ge_p1p1_to_p2($r);
|
|
|
2183 |
$r = self::ge_p2_dbl($s);
|
|
|
2184 |
|
|
|
2185 |
$h = self::ge_p1p1_to_p3($r);
|
|
|
2186 |
|
|
|
2187 |
for ($i = 0; $i < 64; $i += 2) {
|
|
|
2188 |
$t = self::ge_select($i >> 1, (int) $e[$i]);
|
|
|
2189 |
$r = self::ge_madd($r, $h, $t);
|
|
|
2190 |
$h = self::ge_p1p1_to_p3($r);
|
|
|
2191 |
}
|
|
|
2192 |
return $h;
|
|
|
2193 |
}
|
|
|
2194 |
|
|
|
2195 |
/**
|
|
|
2196 |
* Calculates (ab + c) mod l
|
|
|
2197 |
* where l = 2^252 + 27742317777372353535851937790883648493
|
|
|
2198 |
*
|
|
|
2199 |
* @internal You should not use this directly from another application
|
|
|
2200 |
*
|
|
|
2201 |
* @param string $a
|
|
|
2202 |
* @param string $b
|
|
|
2203 |
* @param string $c
|
|
|
2204 |
* @return string
|
|
|
2205 |
* @throws TypeError
|
|
|
2206 |
*/
|
|
|
2207 |
public static function sc_muladd($a, $b, $c)
|
|
|
2208 |
{
|
|
|
2209 |
/** @var int $a0 */
|
|
|
2210 |
$a0 = 2097151 & self::load_3(self::substr($a, 0, 3));
|
|
|
2211 |
/** @var int $a1 */
|
|
|
2212 |
$a1 = 2097151 & (self::load_4(self::substr($a, 2, 4)) >> 5);
|
|
|
2213 |
/** @var int $a2 */
|
|
|
2214 |
$a2 = 2097151 & (self::load_3(self::substr($a, 5, 3)) >> 2);
|
|
|
2215 |
/** @var int $a3 */
|
|
|
2216 |
$a3 = 2097151 & (self::load_4(self::substr($a, 7, 4)) >> 7);
|
|
|
2217 |
/** @var int $a4 */
|
|
|
2218 |
$a4 = 2097151 & (self::load_4(self::substr($a, 10, 4)) >> 4);
|
|
|
2219 |
/** @var int $a5 */
|
|
|
2220 |
$a5 = 2097151 & (self::load_3(self::substr($a, 13, 3)) >> 1);
|
|
|
2221 |
/** @var int $a6 */
|
|
|
2222 |
$a6 = 2097151 & (self::load_4(self::substr($a, 15, 4)) >> 6);
|
|
|
2223 |
/** @var int $a7 */
|
|
|
2224 |
$a7 = 2097151 & (self::load_3(self::substr($a, 18, 3)) >> 3);
|
|
|
2225 |
/** @var int $a8 */
|
|
|
2226 |
$a8 = 2097151 & self::load_3(self::substr($a, 21, 3));
|
|
|
2227 |
/** @var int $a9 */
|
|
|
2228 |
$a9 = 2097151 & (self::load_4(self::substr($a, 23, 4)) >> 5);
|
|
|
2229 |
/** @var int $a10 */
|
|
|
2230 |
$a10 = 2097151 & (self::load_3(self::substr($a, 26, 3)) >> 2);
|
|
|
2231 |
/** @var int $a11 */
|
|
|
2232 |
$a11 = (self::load_4(self::substr($a, 28, 4)) >> 7);
|
|
|
2233 |
|
|
|
2234 |
/** @var int $b0 */
|
|
|
2235 |
$b0 = 2097151 & self::load_3(self::substr($b, 0, 3));
|
|
|
2236 |
/** @var int $b1 */
|
|
|
2237 |
$b1 = 2097151 & (self::load_4(self::substr($b, 2, 4)) >> 5);
|
|
|
2238 |
/** @var int $b2 */
|
|
|
2239 |
$b2 = 2097151 & (self::load_3(self::substr($b, 5, 3)) >> 2);
|
|
|
2240 |
/** @var int $b3 */
|
|
|
2241 |
$b3 = 2097151 & (self::load_4(self::substr($b, 7, 4)) >> 7);
|
|
|
2242 |
/** @var int $b4 */
|
|
|
2243 |
$b4 = 2097151 & (self::load_4(self::substr($b, 10, 4)) >> 4);
|
|
|
2244 |
/** @var int $b5 */
|
|
|
2245 |
$b5 = 2097151 & (self::load_3(self::substr($b, 13, 3)) >> 1);
|
|
|
2246 |
/** @var int $b6 */
|
|
|
2247 |
$b6 = 2097151 & (self::load_4(self::substr($b, 15, 4)) >> 6);
|
|
|
2248 |
/** @var int $b7 */
|
|
|
2249 |
$b7 = 2097151 & (self::load_3(self::substr($b, 18, 3)) >> 3);
|
|
|
2250 |
/** @var int $b8 */
|
|
|
2251 |
$b8 = 2097151 & self::load_3(self::substr($b, 21, 3));
|
|
|
2252 |
/** @var int $b9 */
|
|
|
2253 |
$b9 = 2097151 & (self::load_4(self::substr($b, 23, 4)) >> 5);
|
|
|
2254 |
/** @var int $b10 */
|
|
|
2255 |
$b10 = 2097151 & (self::load_3(self::substr($b, 26, 3)) >> 2);
|
|
|
2256 |
/** @var int $b11 */
|
|
|
2257 |
$b11 = (self::load_4(self::substr($b, 28, 4)) >> 7);
|
|
|
2258 |
|
|
|
2259 |
/** @var int $c0 */
|
|
|
2260 |
$c0 = 2097151 & self::load_3(self::substr($c, 0, 3));
|
|
|
2261 |
/** @var int $c1 */
|
|
|
2262 |
$c1 = 2097151 & (self::load_4(self::substr($c, 2, 4)) >> 5);
|
|
|
2263 |
/** @var int $c2 */
|
|
|
2264 |
$c2 = 2097151 & (self::load_3(self::substr($c, 5, 3)) >> 2);
|
|
|
2265 |
/** @var int $c3 */
|
|
|
2266 |
$c3 = 2097151 & (self::load_4(self::substr($c, 7, 4)) >> 7);
|
|
|
2267 |
/** @var int $c4 */
|
|
|
2268 |
$c4 = 2097151 & (self::load_4(self::substr($c, 10, 4)) >> 4);
|
|
|
2269 |
/** @var int $c5 */
|
|
|
2270 |
$c5 = 2097151 & (self::load_3(self::substr($c, 13, 3)) >> 1);
|
|
|
2271 |
/** @var int $c6 */
|
|
|
2272 |
$c6 = 2097151 & (self::load_4(self::substr($c, 15, 4)) >> 6);
|
|
|
2273 |
/** @var int $c7 */
|
|
|
2274 |
$c7 = 2097151 & (self::load_3(self::substr($c, 18, 3)) >> 3);
|
|
|
2275 |
/** @var int $c8 */
|
|
|
2276 |
$c8 = 2097151 & self::load_3(self::substr($c, 21, 3));
|
|
|
2277 |
/** @var int $c9 */
|
|
|
2278 |
$c9 = 2097151 & (self::load_4(self::substr($c, 23, 4)) >> 5);
|
|
|
2279 |
/** @var int $c10 */
|
|
|
2280 |
$c10 = 2097151 & (self::load_3(self::substr($c, 26, 3)) >> 2);
|
|
|
2281 |
/** @var int $c11 */
|
|
|
2282 |
$c11 = (self::load_4(self::substr($c, 28, 4)) >> 7);
|
|
|
2283 |
|
|
|
2284 |
/* Can't really avoid the pyramid here: */
|
|
|
2285 |
$s0 = $c0 + self::mul($a0, $b0, 24);
|
|
|
2286 |
$s1 = $c1 + self::mul($a0, $b1, 24) + self::mul($a1, $b0, 24);
|
|
|
2287 |
$s2 = $c2 + self::mul($a0, $b2, 24) + self::mul($a1, $b1, 24) + self::mul($a2, $b0, 24);
|
|
|
2288 |
$s3 = $c3 + self::mul($a0, $b3, 24) + self::mul($a1, $b2, 24) + self::mul($a2, $b1, 24) + self::mul($a3, $b0, 24);
|
|
|
2289 |
$s4 = $c4 + self::mul($a0, $b4, 24) + self::mul($a1, $b3, 24) + self::mul($a2, $b2, 24) + self::mul($a3, $b1, 24) +
|
|
|
2290 |
self::mul($a4, $b0, 24);
|
|
|
2291 |
$s5 = $c5 + self::mul($a0, $b5, 24) + self::mul($a1, $b4, 24) + self::mul($a2, $b3, 24) + self::mul($a3, $b2, 24) +
|
|
|
2292 |
self::mul($a4, $b1, 24) + self::mul($a5, $b0, 24);
|
|
|
2293 |
$s6 = $c6 + self::mul($a0, $b6, 24) + self::mul($a1, $b5, 24) + self::mul($a2, $b4, 24) + self::mul($a3, $b3, 24) +
|
|
|
2294 |
self::mul($a4, $b2, 24) + self::mul($a5, $b1, 24) + self::mul($a6, $b0, 24);
|
|
|
2295 |
$s7 = $c7 + self::mul($a0, $b7, 24) + self::mul($a1, $b6, 24) + self::mul($a2, $b5, 24) + self::mul($a3, $b4, 24) +
|
|
|
2296 |
self::mul($a4, $b3, 24) + self::mul($a5, $b2, 24) + self::mul($a6, $b1, 24) + self::mul($a7, $b0, 24);
|
|
|
2297 |
$s8 = $c8 + self::mul($a0, $b8, 24) + self::mul($a1, $b7, 24) + self::mul($a2, $b6, 24) + self::mul($a3, $b5, 24) +
|
|
|
2298 |
self::mul($a4, $b4, 24) + self::mul($a5, $b3, 24) + self::mul($a6, $b2, 24) + self::mul($a7, $b1, 24) +
|
|
|
2299 |
self::mul($a8, $b0, 24);
|
|
|
2300 |
$s9 = $c9 + self::mul($a0, $b9, 24) + self::mul($a1, $b8, 24) + self::mul($a2, $b7, 24) + self::mul($a3, $b6, 24) +
|
|
|
2301 |
self::mul($a4, $b5, 24) + self::mul($a5, $b4, 24) + self::mul($a6, $b3, 24) + self::mul($a7, $b2, 24) +
|
|
|
2302 |
self::mul($a8, $b1, 24) + self::mul($a9, $b0, 24);
|
|
|
2303 |
$s10 = $c10 + self::mul($a0, $b10, 24) + self::mul($a1, $b9, 24) + self::mul($a2, $b8, 24) + self::mul($a3, $b7, 24) +
|
|
|
2304 |
self::mul($a4, $b6, 24) + self::mul($a5, $b5, 24) + self::mul($a6, $b4, 24) + self::mul($a7, $b3, 24) +
|
|
|
2305 |
self::mul($a8, $b2, 24) + self::mul($a9, $b1, 24) + self::mul($a10, $b0, 24);
|
|
|
2306 |
$s11 = $c11 + self::mul($a0, $b11, 24) + self::mul($a1, $b10, 24) + self::mul($a2, $b9, 24) + self::mul($a3, $b8, 24) +
|
|
|
2307 |
self::mul($a4, $b7, 24) + self::mul($a5, $b6, 24) + self::mul($a6, $b5, 24) + self::mul($a7, $b4, 24) +
|
|
|
2308 |
self::mul($a8, $b3, 24) + self::mul($a9, $b2, 24) + self::mul($a10, $b1, 24) + self::mul($a11, $b0, 24);
|
|
|
2309 |
$s12 = self::mul($a1, $b11, 24) + self::mul($a2, $b10, 24) + self::mul($a3, $b9, 24) + self::mul($a4, $b8, 24) +
|
|
|
2310 |
self::mul($a5, $b7, 24) + self::mul($a6, $b6, 24) + self::mul($a7, $b5, 24) + self::mul($a8, $b4, 24) +
|
|
|
2311 |
self::mul($a9, $b3, 24) + self::mul($a10, $b2, 24) + self::mul($a11, $b1, 24);
|
|
|
2312 |
$s13 = self::mul($a2, $b11, 24) + self::mul($a3, $b10, 24) + self::mul($a4, $b9, 24) + self::mul($a5, $b8, 24) +
|
|
|
2313 |
self::mul($a6, $b7, 24) + self::mul($a7, $b6, 24) + self::mul($a8, $b5, 24) + self::mul($a9, $b4, 24) +
|
|
|
2314 |
self::mul($a10, $b3, 24) + self::mul($a11, $b2, 24);
|
|
|
2315 |
$s14 = self::mul($a3, $b11, 24) + self::mul($a4, $b10, 24) + self::mul($a5, $b9, 24) + self::mul($a6, $b8, 24) +
|
|
|
2316 |
self::mul($a7, $b7, 24) + self::mul($a8, $b6, 24) + self::mul($a9, $b5, 24) + self::mul($a10, $b4, 24) +
|
|
|
2317 |
self::mul($a11, $b3, 24);
|
|
|
2318 |
$s15 = self::mul($a4, $b11, 24) + self::mul($a5, $b10, 24) + self::mul($a6, $b9, 24) + self::mul($a7, $b8, 24) +
|
|
|
2319 |
self::mul($a8, $b7, 24) + self::mul($a9, $b6, 24) + self::mul($a10, $b5, 24) + self::mul($a11, $b4, 24);
|
|
|
2320 |
$s16 = self::mul($a5, $b11, 24) + self::mul($a6, $b10, 24) + self::mul($a7, $b9, 24) + self::mul($a8, $b8, 24) +
|
|
|
2321 |
self::mul($a9, $b7, 24) + self::mul($a10, $b6, 24) + self::mul($a11, $b5, 24);
|
|
|
2322 |
$s17 = self::mul($a6, $b11, 24) + self::mul($a7, $b10, 24) + self::mul($a8, $b9, 24) + self::mul($a9, $b8, 24) +
|
|
|
2323 |
self::mul($a10, $b7, 24) + self::mul($a11, $b6, 24);
|
|
|
2324 |
$s18 = self::mul($a7, $b11, 24) + self::mul($a8, $b10, 24) + self::mul($a9, $b9, 24) + self::mul($a10, $b8, 24) +
|
|
|
2325 |
self::mul($a11, $b7, 24);
|
|
|
2326 |
$s19 = self::mul($a8, $b11, 24) + self::mul($a9, $b10, 24) + self::mul($a10, $b9, 24) + self::mul($a11, $b8, 24);
|
|
|
2327 |
$s20 = self::mul($a9, $b11, 24) + self::mul($a10, $b10, 24) + self::mul($a11, $b9, 24);
|
|
|
2328 |
$s21 = self::mul($a10, $b11, 24) + self::mul($a11, $b10, 24);
|
|
|
2329 |
$s22 = self::mul($a11, $b11, 24);
|
|
|
2330 |
$s23 = 0;
|
|
|
2331 |
|
|
|
2332 |
/** @var int $carry0 */
|
|
|
2333 |
$carry0 = ($s0 + (1 << 20)) >> 21;
|
|
|
2334 |
$s1 += $carry0;
|
|
|
2335 |
$s0 -= $carry0 << 21;
|
|
|
2336 |
/** @var int $carry2 */
|
|
|
2337 |
$carry2 = ($s2 + (1 << 20)) >> 21;
|
|
|
2338 |
$s3 += $carry2;
|
|
|
2339 |
$s2 -= $carry2 << 21;
|
|
|
2340 |
/** @var int $carry4 */
|
|
|
2341 |
$carry4 = ($s4 + (1 << 20)) >> 21;
|
|
|
2342 |
$s5 += $carry4;
|
|
|
2343 |
$s4 -= $carry4 << 21;
|
|
|
2344 |
/** @var int $carry6 */
|
|
|
2345 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
2346 |
$s7 += $carry6;
|
|
|
2347 |
$s6 -= $carry6 << 21;
|
|
|
2348 |
/** @var int $carry8 */
|
|
|
2349 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
2350 |
$s9 += $carry8;
|
|
|
2351 |
$s8 -= $carry8 << 21;
|
|
|
2352 |
/** @var int $carry10 */
|
|
|
2353 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
2354 |
$s11 += $carry10;
|
|
|
2355 |
$s10 -= $carry10 << 21;
|
|
|
2356 |
/** @var int $carry12 */
|
|
|
2357 |
$carry12 = ($s12 + (1 << 20)) >> 21;
|
|
|
2358 |
$s13 += $carry12;
|
|
|
2359 |
$s12 -= $carry12 << 21;
|
|
|
2360 |
/** @var int $carry14 */
|
|
|
2361 |
$carry14 = ($s14 + (1 << 20)) >> 21;
|
|
|
2362 |
$s15 += $carry14;
|
|
|
2363 |
$s14 -= $carry14 << 21;
|
|
|
2364 |
/** @var int $carry16 */
|
|
|
2365 |
$carry16 = ($s16 + (1 << 20)) >> 21;
|
|
|
2366 |
$s17 += $carry16;
|
|
|
2367 |
$s16 -= $carry16 << 21;
|
|
|
2368 |
/** @var int $carry18 */
|
|
|
2369 |
$carry18 = ($s18 + (1 << 20)) >> 21;
|
|
|
2370 |
$s19 += $carry18;
|
|
|
2371 |
$s18 -= $carry18 << 21;
|
|
|
2372 |
/** @var int $carry20 */
|
|
|
2373 |
$carry20 = ($s20 + (1 << 20)) >> 21;
|
|
|
2374 |
$s21 += $carry20;
|
|
|
2375 |
$s20 -= $carry20 << 21;
|
|
|
2376 |
/** @var int $carry22 */
|
|
|
2377 |
$carry22 = ($s22 + (1 << 20)) >> 21;
|
|
|
2378 |
$s23 += $carry22;
|
|
|
2379 |
$s22 -= $carry22 << 21;
|
|
|
2380 |
|
|
|
2381 |
/** @var int $carry1 */
|
|
|
2382 |
$carry1 = ($s1 + (1 << 20)) >> 21;
|
|
|
2383 |
$s2 += $carry1;
|
|
|
2384 |
$s1 -= $carry1 << 21;
|
|
|
2385 |
/** @var int $carry3 */
|
|
|
2386 |
$carry3 = ($s3 + (1 << 20)) >> 21;
|
|
|
2387 |
$s4 += $carry3;
|
|
|
2388 |
$s3 -= $carry3 << 21;
|
|
|
2389 |
/** @var int $carry5 */
|
|
|
2390 |
$carry5 = ($s5 + (1 << 20)) >> 21;
|
|
|
2391 |
$s6 += $carry5;
|
|
|
2392 |
$s5 -= $carry5 << 21;
|
|
|
2393 |
/** @var int $carry7 */
|
|
|
2394 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
2395 |
$s8 += $carry7;
|
|
|
2396 |
$s7 -= $carry7 << 21;
|
|
|
2397 |
/** @var int $carry9 */
|
|
|
2398 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
2399 |
$s10 += $carry9;
|
|
|
2400 |
$s9 -= $carry9 << 21;
|
|
|
2401 |
/** @var int $carry11 */
|
|
|
2402 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
2403 |
$s12 += $carry11;
|
|
|
2404 |
$s11 -= $carry11 << 21;
|
|
|
2405 |
/** @var int $carry13 */
|
|
|
2406 |
$carry13 = ($s13 + (1 << 20)) >> 21;
|
|
|
2407 |
$s14 += $carry13;
|
|
|
2408 |
$s13 -= $carry13 << 21;
|
|
|
2409 |
/** @var int $carry15 */
|
|
|
2410 |
$carry15 = ($s15 + (1 << 20)) >> 21;
|
|
|
2411 |
$s16 += $carry15;
|
|
|
2412 |
$s15 -= $carry15 << 21;
|
|
|
2413 |
/** @var int $carry17 */
|
|
|
2414 |
$carry17 = ($s17 + (1 << 20)) >> 21;
|
|
|
2415 |
$s18 += $carry17;
|
|
|
2416 |
$s17 -= $carry17 << 21;
|
|
|
2417 |
/** @var int $carry19 */
|
|
|
2418 |
$carry19 = ($s19 + (1 << 20)) >> 21;
|
|
|
2419 |
$s20 += $carry19;
|
|
|
2420 |
$s19 -= $carry19 << 21;
|
|
|
2421 |
/** @var int $carry21 */
|
|
|
2422 |
$carry21 = ($s21 + (1 << 20)) >> 21;
|
|
|
2423 |
$s22 += $carry21;
|
|
|
2424 |
$s21 -= $carry21 << 21;
|
|
|
2425 |
|
|
|
2426 |
$s11 += self::mul($s23, 666643, 20);
|
|
|
2427 |
$s12 += self::mul($s23, 470296, 19);
|
|
|
2428 |
$s13 += self::mul($s23, 654183, 20);
|
|
|
2429 |
$s14 -= self::mul($s23, 997805, 20);
|
|
|
2430 |
$s15 += self::mul($s23, 136657, 18);
|
|
|
2431 |
$s16 -= self::mul($s23, 683901, 20);
|
|
|
2432 |
|
|
|
2433 |
$s10 += self::mul($s22, 666643, 20);
|
|
|
2434 |
$s11 += self::mul($s22, 470296, 19);
|
|
|
2435 |
$s12 += self::mul($s22, 654183, 20);
|
|
|
2436 |
$s13 -= self::mul($s22, 997805, 20);
|
|
|
2437 |
$s14 += self::mul($s22, 136657, 18);
|
|
|
2438 |
$s15 -= self::mul($s22, 683901, 20);
|
|
|
2439 |
|
|
|
2440 |
$s9 += self::mul($s21, 666643, 20);
|
|
|
2441 |
$s10 += self::mul($s21, 470296, 19);
|
|
|
2442 |
$s11 += self::mul($s21, 654183, 20);
|
|
|
2443 |
$s12 -= self::mul($s21, 997805, 20);
|
|
|
2444 |
$s13 += self::mul($s21, 136657, 18);
|
|
|
2445 |
$s14 -= self::mul($s21, 683901, 20);
|
|
|
2446 |
|
|
|
2447 |
$s8 += self::mul($s20, 666643, 20);
|
|
|
2448 |
$s9 += self::mul($s20, 470296, 19);
|
|
|
2449 |
$s10 += self::mul($s20, 654183, 20);
|
|
|
2450 |
$s11 -= self::mul($s20, 997805, 20);
|
|
|
2451 |
$s12 += self::mul($s20, 136657, 18);
|
|
|
2452 |
$s13 -= self::mul($s20, 683901, 20);
|
|
|
2453 |
|
|
|
2454 |
$s7 += self::mul($s19, 666643, 20);
|
|
|
2455 |
$s8 += self::mul($s19, 470296, 19);
|
|
|
2456 |
$s9 += self::mul($s19, 654183, 20);
|
|
|
2457 |
$s10 -= self::mul($s19, 997805, 20);
|
|
|
2458 |
$s11 += self::mul($s19, 136657, 18);
|
|
|
2459 |
$s12 -= self::mul($s19, 683901, 20);
|
|
|
2460 |
|
|
|
2461 |
$s6 += self::mul($s18, 666643, 20);
|
|
|
2462 |
$s7 += self::mul($s18, 470296, 19);
|
|
|
2463 |
$s8 += self::mul($s18, 654183, 20);
|
|
|
2464 |
$s9 -= self::mul($s18, 997805, 20);
|
|
|
2465 |
$s10 += self::mul($s18, 136657, 18);
|
|
|
2466 |
$s11 -= self::mul($s18, 683901, 20);
|
|
|
2467 |
|
|
|
2468 |
/** @var int $carry6 */
|
|
|
2469 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
2470 |
$s7 += $carry6;
|
|
|
2471 |
$s6 -= $carry6 << 21;
|
|
|
2472 |
/** @var int $carry8 */
|
|
|
2473 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
2474 |
$s9 += $carry8;
|
|
|
2475 |
$s8 -= $carry8 << 21;
|
|
|
2476 |
/** @var int $carry10 */
|
|
|
2477 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
2478 |
$s11 += $carry10;
|
|
|
2479 |
$s10 -= $carry10 << 21;
|
|
|
2480 |
/** @var int $carry12 */
|
|
|
2481 |
$carry12 = ($s12 + (1 << 20)) >> 21;
|
|
|
2482 |
$s13 += $carry12;
|
|
|
2483 |
$s12 -= $carry12 << 21;
|
|
|
2484 |
/** @var int $carry14 */
|
|
|
2485 |
$carry14 = ($s14 + (1 << 20)) >> 21;
|
|
|
2486 |
$s15 += $carry14;
|
|
|
2487 |
$s14 -= $carry14 << 21;
|
|
|
2488 |
/** @var int $carry16 */
|
|
|
2489 |
$carry16 = ($s16 + (1 << 20)) >> 21;
|
|
|
2490 |
$s17 += $carry16;
|
|
|
2491 |
$s16 -= $carry16 << 21;
|
|
|
2492 |
|
|
|
2493 |
/** @var int $carry7 */
|
|
|
2494 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
2495 |
$s8 += $carry7;
|
|
|
2496 |
$s7 -= $carry7 << 21;
|
|
|
2497 |
/** @var int $carry9 */
|
|
|
2498 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
2499 |
$s10 += $carry9;
|
|
|
2500 |
$s9 -= $carry9 << 21;
|
|
|
2501 |
/** @var int $carry11 */
|
|
|
2502 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
2503 |
$s12 += $carry11;
|
|
|
2504 |
$s11 -= $carry11 << 21;
|
|
|
2505 |
/** @var int $carry13 */
|
|
|
2506 |
$carry13 = ($s13 + (1 << 20)) >> 21;
|
|
|
2507 |
$s14 += $carry13;
|
|
|
2508 |
$s13 -= $carry13 << 21;
|
|
|
2509 |
/** @var int $carry15 */
|
|
|
2510 |
$carry15 = ($s15 + (1 << 20)) >> 21;
|
|
|
2511 |
$s16 += $carry15;
|
|
|
2512 |
$s15 -= $carry15 << 21;
|
|
|
2513 |
|
|
|
2514 |
$s5 += self::mul($s17, 666643, 20);
|
|
|
2515 |
$s6 += self::mul($s17, 470296, 19);
|
|
|
2516 |
$s7 += self::mul($s17, 654183, 20);
|
|
|
2517 |
$s8 -= self::mul($s17, 997805, 20);
|
|
|
2518 |
$s9 += self::mul($s17, 136657, 18);
|
|
|
2519 |
$s10 -= self::mul($s17, 683901, 20);
|
|
|
2520 |
|
|
|
2521 |
$s4 += self::mul($s16, 666643, 20);
|
|
|
2522 |
$s5 += self::mul($s16, 470296, 19);
|
|
|
2523 |
$s6 += self::mul($s16, 654183, 20);
|
|
|
2524 |
$s7 -= self::mul($s16, 997805, 20);
|
|
|
2525 |
$s8 += self::mul($s16, 136657, 18);
|
|
|
2526 |
$s9 -= self::mul($s16, 683901, 20);
|
|
|
2527 |
|
|
|
2528 |
$s3 += self::mul($s15, 666643, 20);
|
|
|
2529 |
$s4 += self::mul($s15, 470296, 19);
|
|
|
2530 |
$s5 += self::mul($s15, 654183, 20);
|
|
|
2531 |
$s6 -= self::mul($s15, 997805, 20);
|
|
|
2532 |
$s7 += self::mul($s15, 136657, 18);
|
|
|
2533 |
$s8 -= self::mul($s15, 683901, 20);
|
|
|
2534 |
|
|
|
2535 |
$s2 += self::mul($s14, 666643, 20);
|
|
|
2536 |
$s3 += self::mul($s14, 470296, 19);
|
|
|
2537 |
$s4 += self::mul($s14, 654183, 20);
|
|
|
2538 |
$s5 -= self::mul($s14, 997805, 20);
|
|
|
2539 |
$s6 += self::mul($s14, 136657, 18);
|
|
|
2540 |
$s7 -= self::mul($s14, 683901, 20);
|
|
|
2541 |
|
|
|
2542 |
$s1 += self::mul($s13, 666643, 20);
|
|
|
2543 |
$s2 += self::mul($s13, 470296, 19);
|
|
|
2544 |
$s3 += self::mul($s13, 654183, 20);
|
|
|
2545 |
$s4 -= self::mul($s13, 997805, 20);
|
|
|
2546 |
$s5 += self::mul($s13, 136657, 18);
|
|
|
2547 |
$s6 -= self::mul($s13, 683901, 20);
|
|
|
2548 |
|
|
|
2549 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
2550 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
2551 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
2552 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
2553 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
2554 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
2555 |
$s12 = 0;
|
|
|
2556 |
|
|
|
2557 |
/** @var int $carry0 */
|
|
|
2558 |
$carry0 = ($s0 + (1 << 20)) >> 21;
|
|
|
2559 |
$s1 += $carry0;
|
|
|
2560 |
$s0 -= $carry0 << 21;
|
|
|
2561 |
/** @var int $carry2 */
|
|
|
2562 |
$carry2 = ($s2 + (1 << 20)) >> 21;
|
|
|
2563 |
$s3 += $carry2;
|
|
|
2564 |
$s2 -= $carry2 << 21;
|
|
|
2565 |
/** @var int $carry4 */
|
|
|
2566 |
$carry4 = ($s4 + (1 << 20)) >> 21;
|
|
|
2567 |
$s5 += $carry4;
|
|
|
2568 |
$s4 -= $carry4 << 21;
|
|
|
2569 |
/** @var int $carry6 */
|
|
|
2570 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
2571 |
$s7 += $carry6;
|
|
|
2572 |
$s6 -= $carry6 << 21;
|
|
|
2573 |
/** @var int $carry8 */
|
|
|
2574 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
2575 |
$s9 += $carry8;
|
|
|
2576 |
$s8 -= $carry8 << 21;
|
|
|
2577 |
/** @var int $carry10 */
|
|
|
2578 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
2579 |
$s11 += $carry10;
|
|
|
2580 |
$s10 -= $carry10 << 21;
|
|
|
2581 |
|
|
|
2582 |
/** @var int $carry1 */
|
|
|
2583 |
$carry1 = ($s1 + (1 << 20)) >> 21;
|
|
|
2584 |
$s2 += $carry1;
|
|
|
2585 |
$s1 -= $carry1 << 21;
|
|
|
2586 |
/** @var int $carry3 */
|
|
|
2587 |
$carry3 = ($s3 + (1 << 20)) >> 21;
|
|
|
2588 |
$s4 += $carry3;
|
|
|
2589 |
$s3 -= $carry3 << 21;
|
|
|
2590 |
/** @var int $carry5 */
|
|
|
2591 |
$carry5 = ($s5 + (1 << 20)) >> 21;
|
|
|
2592 |
$s6 += $carry5;
|
|
|
2593 |
$s5 -= $carry5 << 21;
|
|
|
2594 |
/** @var int $carry7 */
|
|
|
2595 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
2596 |
$s8 += $carry7;
|
|
|
2597 |
$s7 -= $carry7 << 21;
|
|
|
2598 |
/** @var int $carry9 */
|
|
|
2599 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
2600 |
$s10 += $carry9;
|
|
|
2601 |
$s9 -= $carry9 << 21;
|
|
|
2602 |
/** @var int $carry11 */
|
|
|
2603 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
2604 |
$s12 += $carry11;
|
|
|
2605 |
$s11 -= $carry11 << 21;
|
|
|
2606 |
|
|
|
2607 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
2608 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
2609 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
2610 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
2611 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
2612 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
2613 |
$s12 = 0;
|
|
|
2614 |
|
|
|
2615 |
/** @var int $carry0 */
|
|
|
2616 |
$carry0 = $s0 >> 21;
|
|
|
2617 |
$s1 += $carry0;
|
|
|
2618 |
$s0 -= $carry0 << 21;
|
|
|
2619 |
/** @var int $carry1 */
|
|
|
2620 |
$carry1 = $s1 >> 21;
|
|
|
2621 |
$s2 += $carry1;
|
|
|
2622 |
$s1 -= $carry1 << 21;
|
|
|
2623 |
/** @var int $carry2 */
|
|
|
2624 |
$carry2 = $s2 >> 21;
|
|
|
2625 |
$s3 += $carry2;
|
|
|
2626 |
$s2 -= $carry2 << 21;
|
|
|
2627 |
/** @var int $carry3 */
|
|
|
2628 |
$carry3 = $s3 >> 21;
|
|
|
2629 |
$s4 += $carry3;
|
|
|
2630 |
$s3 -= $carry3 << 21;
|
|
|
2631 |
/** @var int $carry4 */
|
|
|
2632 |
$carry4 = $s4 >> 21;
|
|
|
2633 |
$s5 += $carry4;
|
|
|
2634 |
$s4 -= $carry4 << 21;
|
|
|
2635 |
/** @var int $carry5 */
|
|
|
2636 |
$carry5 = $s5 >> 21;
|
|
|
2637 |
$s6 += $carry5;
|
|
|
2638 |
$s5 -= $carry5 << 21;
|
|
|
2639 |
/** @var int $carry6 */
|
|
|
2640 |
$carry6 = $s6 >> 21;
|
|
|
2641 |
$s7 += $carry6;
|
|
|
2642 |
$s6 -= $carry6 << 21;
|
|
|
2643 |
/** @var int $carry7 */
|
|
|
2644 |
$carry7 = $s7 >> 21;
|
|
|
2645 |
$s8 += $carry7;
|
|
|
2646 |
$s7 -= $carry7 << 21;
|
|
|
2647 |
/** @var int $carry8 */
|
|
|
2648 |
$carry8 = $s8 >> 21;
|
|
|
2649 |
$s9 += $carry8;
|
|
|
2650 |
$s8 -= $carry8 << 21;
|
|
|
2651 |
/** @var int $carry9 */
|
|
|
2652 |
$carry9 = $s9 >> 21;
|
|
|
2653 |
$s10 += $carry9;
|
|
|
2654 |
$s9 -= $carry9 << 21;
|
|
|
2655 |
/** @var int $carry10 */
|
|
|
2656 |
$carry10 = $s10 >> 21;
|
|
|
2657 |
$s11 += $carry10;
|
|
|
2658 |
$s10 -= $carry10 << 21;
|
|
|
2659 |
/** @var int $carry11 */
|
|
|
2660 |
$carry11 = $s11 >> 21;
|
|
|
2661 |
$s12 += $carry11;
|
|
|
2662 |
$s11 -= $carry11 << 21;
|
|
|
2663 |
|
|
|
2664 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
2665 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
2666 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
2667 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
2668 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
2669 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
2670 |
|
|
|
2671 |
/** @var int $carry0 */
|
|
|
2672 |
$carry0 = $s0 >> 21;
|
|
|
2673 |
$s1 += $carry0;
|
|
|
2674 |
$s0 -= $carry0 << 21;
|
|
|
2675 |
/** @var int $carry1 */
|
|
|
2676 |
$carry1 = $s1 >> 21;
|
|
|
2677 |
$s2 += $carry1;
|
|
|
2678 |
$s1 -= $carry1 << 21;
|
|
|
2679 |
/** @var int $carry2 */
|
|
|
2680 |
$carry2 = $s2 >> 21;
|
|
|
2681 |
$s3 += $carry2;
|
|
|
2682 |
$s2 -= $carry2 << 21;
|
|
|
2683 |
/** @var int $carry3 */
|
|
|
2684 |
$carry3 = $s3 >> 21;
|
|
|
2685 |
$s4 += $carry3;
|
|
|
2686 |
$s3 -= $carry3 << 21;
|
|
|
2687 |
/** @var int $carry4 */
|
|
|
2688 |
$carry4 = $s4 >> 21;
|
|
|
2689 |
$s5 += $carry4;
|
|
|
2690 |
$s4 -= $carry4 << 21;
|
|
|
2691 |
/** @var int $carry5 */
|
|
|
2692 |
$carry5 = $s5 >> 21;
|
|
|
2693 |
$s6 += $carry5;
|
|
|
2694 |
$s5 -= $carry5 << 21;
|
|
|
2695 |
/** @var int $carry6 */
|
|
|
2696 |
$carry6 = $s6 >> 21;
|
|
|
2697 |
$s7 += $carry6;
|
|
|
2698 |
$s6 -= $carry6 << 21;
|
|
|
2699 |
/** @var int $carry7 */
|
|
|
2700 |
$carry7 = $s7 >> 21;
|
|
|
2701 |
$s8 += $carry7;
|
|
|
2702 |
$s7 -= $carry7 << 21;
|
|
|
2703 |
/** @var int $carry8 */
|
|
|
2704 |
$carry8 = $s8 >> 21;
|
|
|
2705 |
$s9 += $carry8;
|
|
|
2706 |
$s8 -= $carry8 << 21;
|
|
|
2707 |
/** @var int $carry9 */
|
|
|
2708 |
$carry9 = $s9 >> 21;
|
|
|
2709 |
$s10 += $carry9;
|
|
|
2710 |
$s9 -= $carry9 << 21;
|
|
|
2711 |
/** @var int $carry10 */
|
|
|
2712 |
$carry10 = $s10 >> 21;
|
|
|
2713 |
$s11 += $carry10;
|
|
|
2714 |
$s10 -= $carry10 << 21;
|
|
|
2715 |
|
|
|
2716 |
/**
|
|
|
2717 |
* @var array<int, int>
|
|
|
2718 |
*/
|
|
|
2719 |
$arr = array(
|
|
|
2720 |
(int) (0xff & ($s0 >> 0)),
|
|
|
2721 |
(int) (0xff & ($s0 >> 8)),
|
|
|
2722 |
(int) (0xff & (($s0 >> 16) | $s1 << 5)),
|
|
|
2723 |
(int) (0xff & ($s1 >> 3)),
|
|
|
2724 |
(int) (0xff & ($s1 >> 11)),
|
|
|
2725 |
(int) (0xff & (($s1 >> 19) | $s2 << 2)),
|
|
|
2726 |
(int) (0xff & ($s2 >> 6)),
|
|
|
2727 |
(int) (0xff & (($s2 >> 14) | $s3 << 7)),
|
|
|
2728 |
(int) (0xff & ($s3 >> 1)),
|
|
|
2729 |
(int) (0xff & ($s3 >> 9)),
|
|
|
2730 |
(int) (0xff & (($s3 >> 17) | $s4 << 4)),
|
|
|
2731 |
(int) (0xff & ($s4 >> 4)),
|
|
|
2732 |
(int) (0xff & ($s4 >> 12)),
|
|
|
2733 |
(int) (0xff & (($s4 >> 20) | $s5 << 1)),
|
|
|
2734 |
(int) (0xff & ($s5 >> 7)),
|
|
|
2735 |
(int) (0xff & (($s5 >> 15) | $s6 << 6)),
|
|
|
2736 |
(int) (0xff & ($s6 >> 2)),
|
|
|
2737 |
(int) (0xff & ($s6 >> 10)),
|
|
|
2738 |
(int) (0xff & (($s6 >> 18) | $s7 << 3)),
|
|
|
2739 |
(int) (0xff & ($s7 >> 5)),
|
|
|
2740 |
(int) (0xff & ($s7 >> 13)),
|
|
|
2741 |
(int) (0xff & ($s8 >> 0)),
|
|
|
2742 |
(int) (0xff & ($s8 >> 8)),
|
|
|
2743 |
(int) (0xff & (($s8 >> 16) | $s9 << 5)),
|
|
|
2744 |
(int) (0xff & ($s9 >> 3)),
|
|
|
2745 |
(int) (0xff & ($s9 >> 11)),
|
|
|
2746 |
(int) (0xff & (($s9 >> 19) | $s10 << 2)),
|
|
|
2747 |
(int) (0xff & ($s10 >> 6)),
|
|
|
2748 |
(int) (0xff & (($s10 >> 14) | $s11 << 7)),
|
|
|
2749 |
(int) (0xff & ($s11 >> 1)),
|
|
|
2750 |
(int) (0xff & ($s11 >> 9)),
|
|
|
2751 |
0xff & ($s11 >> 17)
|
|
|
2752 |
);
|
|
|
2753 |
return self::intArrayToString($arr);
|
|
|
2754 |
}
|
|
|
2755 |
|
|
|
2756 |
/**
|
|
|
2757 |
* @internal You should not use this directly from another application
|
|
|
2758 |
*
|
|
|
2759 |
* @param string $s
|
|
|
2760 |
* @return string
|
|
|
2761 |
* @throws TypeError
|
|
|
2762 |
*/
|
|
|
2763 |
public static function sc_reduce($s)
|
|
|
2764 |
{
|
|
|
2765 |
/** @var int $s0 */
|
|
|
2766 |
$s0 = 2097151 & self::load_3(self::substr($s, 0, 3));
|
|
|
2767 |
/** @var int $s1 */
|
|
|
2768 |
$s1 = 2097151 & (self::load_4(self::substr($s, 2, 4)) >> 5);
|
|
|
2769 |
/** @var int $s2 */
|
|
|
2770 |
$s2 = 2097151 & (self::load_3(self::substr($s, 5, 3)) >> 2);
|
|
|
2771 |
/** @var int $s3 */
|
|
|
2772 |
$s3 = 2097151 & (self::load_4(self::substr($s, 7, 4)) >> 7);
|
|
|
2773 |
/** @var int $s4 */
|
|
|
2774 |
$s4 = 2097151 & (self::load_4(self::substr($s, 10, 4)) >> 4);
|
|
|
2775 |
/** @var int $s5 */
|
|
|
2776 |
$s5 = 2097151 & (self::load_3(self::substr($s, 13, 3)) >> 1);
|
|
|
2777 |
/** @var int $s6 */
|
|
|
2778 |
$s6 = 2097151 & (self::load_4(self::substr($s, 15, 4)) >> 6);
|
|
|
2779 |
/** @var int $s7 */
|
|
|
2780 |
$s7 = 2097151 & (self::load_3(self::substr($s, 18, 4)) >> 3);
|
|
|
2781 |
/** @var int $s8 */
|
|
|
2782 |
$s8 = 2097151 & self::load_3(self::substr($s, 21, 3));
|
|
|
2783 |
/** @var int $s9 */
|
|
|
2784 |
$s9 = 2097151 & (self::load_4(self::substr($s, 23, 4)) >> 5);
|
|
|
2785 |
/** @var int $s10 */
|
|
|
2786 |
$s10 = 2097151 & (self::load_3(self::substr($s, 26, 3)) >> 2);
|
|
|
2787 |
/** @var int $s11 */
|
|
|
2788 |
$s11 = 2097151 & (self::load_4(self::substr($s, 28, 4)) >> 7);
|
|
|
2789 |
/** @var int $s12 */
|
|
|
2790 |
$s12 = 2097151 & (self::load_4(self::substr($s, 31, 4)) >> 4);
|
|
|
2791 |
/** @var int $s13 */
|
|
|
2792 |
$s13 = 2097151 & (self::load_3(self::substr($s, 34, 3)) >> 1);
|
|
|
2793 |
/** @var int $s14 */
|
|
|
2794 |
$s14 = 2097151 & (self::load_4(self::substr($s, 36, 4)) >> 6);
|
|
|
2795 |
/** @var int $s15 */
|
|
|
2796 |
$s15 = 2097151 & (self::load_3(self::substr($s, 39, 4)) >> 3);
|
|
|
2797 |
/** @var int $s16 */
|
|
|
2798 |
$s16 = 2097151 & self::load_3(self::substr($s, 42, 3));
|
|
|
2799 |
/** @var int $s17 */
|
|
|
2800 |
$s17 = 2097151 & (self::load_4(self::substr($s, 44, 4)) >> 5);
|
|
|
2801 |
/** @var int $s18 */
|
|
|
2802 |
$s18 = 2097151 & (self::load_3(self::substr($s, 47, 3)) >> 2);
|
|
|
2803 |
/** @var int $s19 */
|
|
|
2804 |
$s19 = 2097151 & (self::load_4(self::substr($s, 49, 4)) >> 7);
|
|
|
2805 |
/** @var int $s20 */
|
|
|
2806 |
$s20 = 2097151 & (self::load_4(self::substr($s, 52, 4)) >> 4);
|
|
|
2807 |
/** @var int $s21 */
|
|
|
2808 |
$s21 = 2097151 & (self::load_3(self::substr($s, 55, 3)) >> 1);
|
|
|
2809 |
/** @var int $s22 */
|
|
|
2810 |
$s22 = 2097151 & (self::load_4(self::substr($s, 57, 4)) >> 6);
|
|
|
2811 |
/** @var int $s23 */
|
|
|
2812 |
$s23 = (self::load_4(self::substr($s, 60, 4)) >> 3);
|
|
|
2813 |
|
|
|
2814 |
$s11 += self::mul($s23, 666643, 20);
|
|
|
2815 |
$s12 += self::mul($s23, 470296, 19);
|
|
|
2816 |
$s13 += self::mul($s23, 654183, 20);
|
|
|
2817 |
$s14 -= self::mul($s23, 997805, 20);
|
|
|
2818 |
$s15 += self::mul($s23, 136657, 18);
|
|
|
2819 |
$s16 -= self::mul($s23, 683901, 20);
|
|
|
2820 |
|
|
|
2821 |
$s10 += self::mul($s22, 666643, 20);
|
|
|
2822 |
$s11 += self::mul($s22, 470296, 19);
|
|
|
2823 |
$s12 += self::mul($s22, 654183, 20);
|
|
|
2824 |
$s13 -= self::mul($s22, 997805, 20);
|
|
|
2825 |
$s14 += self::mul($s22, 136657, 18);
|
|
|
2826 |
$s15 -= self::mul($s22, 683901, 20);
|
|
|
2827 |
|
|
|
2828 |
$s9 += self::mul($s21, 666643, 20);
|
|
|
2829 |
$s10 += self::mul($s21, 470296, 19);
|
|
|
2830 |
$s11 += self::mul($s21, 654183, 20);
|
|
|
2831 |
$s12 -= self::mul($s21, 997805, 20);
|
|
|
2832 |
$s13 += self::mul($s21, 136657, 18);
|
|
|
2833 |
$s14 -= self::mul($s21, 683901, 20);
|
|
|
2834 |
|
|
|
2835 |
$s8 += self::mul($s20, 666643, 20);
|
|
|
2836 |
$s9 += self::mul($s20, 470296, 19);
|
|
|
2837 |
$s10 += self::mul($s20, 654183, 20);
|
|
|
2838 |
$s11 -= self::mul($s20, 997805, 20);
|
|
|
2839 |
$s12 += self::mul($s20, 136657, 18);
|
|
|
2840 |
$s13 -= self::mul($s20, 683901, 20);
|
|
|
2841 |
|
|
|
2842 |
$s7 += self::mul($s19, 666643, 20);
|
|
|
2843 |
$s8 += self::mul($s19, 470296, 19);
|
|
|
2844 |
$s9 += self::mul($s19, 654183, 20);
|
|
|
2845 |
$s10 -= self::mul($s19, 997805, 20);
|
|
|
2846 |
$s11 += self::mul($s19, 136657, 18);
|
|
|
2847 |
$s12 -= self::mul($s19, 683901, 20);
|
|
|
2848 |
|
|
|
2849 |
$s6 += self::mul($s18, 666643, 20);
|
|
|
2850 |
$s7 += self::mul($s18, 470296, 19);
|
|
|
2851 |
$s8 += self::mul($s18, 654183, 20);
|
|
|
2852 |
$s9 -= self::mul($s18, 997805, 20);
|
|
|
2853 |
$s10 += self::mul($s18, 136657, 18);
|
|
|
2854 |
$s11 -= self::mul($s18, 683901, 20);
|
|
|
2855 |
|
|
|
2856 |
/** @var int $carry6 */
|
|
|
2857 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
2858 |
$s7 += $carry6;
|
|
|
2859 |
$s6 -= $carry6 << 21;
|
|
|
2860 |
/** @var int $carry8 */
|
|
|
2861 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
2862 |
$s9 += $carry8;
|
|
|
2863 |
$s8 -= $carry8 << 21;
|
|
|
2864 |
/** @var int $carry10 */
|
|
|
2865 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
2866 |
$s11 += $carry10;
|
|
|
2867 |
$s10 -= $carry10 << 21;
|
|
|
2868 |
/** @var int $carry12 */
|
|
|
2869 |
$carry12 = ($s12 + (1 << 20)) >> 21;
|
|
|
2870 |
$s13 += $carry12;
|
|
|
2871 |
$s12 -= $carry12 << 21;
|
|
|
2872 |
/** @var int $carry14 */
|
|
|
2873 |
$carry14 = ($s14 + (1 << 20)) >> 21;
|
|
|
2874 |
$s15 += $carry14;
|
|
|
2875 |
$s14 -= $carry14 << 21;
|
|
|
2876 |
/** @var int $carry16 */
|
|
|
2877 |
$carry16 = ($s16 + (1 << 20)) >> 21;
|
|
|
2878 |
$s17 += $carry16;
|
|
|
2879 |
$s16 -= $carry16 << 21;
|
|
|
2880 |
|
|
|
2881 |
/** @var int $carry7 */
|
|
|
2882 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
2883 |
$s8 += $carry7;
|
|
|
2884 |
$s7 -= $carry7 << 21;
|
|
|
2885 |
/** @var int $carry9 */
|
|
|
2886 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
2887 |
$s10 += $carry9;
|
|
|
2888 |
$s9 -= $carry9 << 21;
|
|
|
2889 |
/** @var int $carry11 */
|
|
|
2890 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
2891 |
$s12 += $carry11;
|
|
|
2892 |
$s11 -= $carry11 << 21;
|
|
|
2893 |
/** @var int $carry13 */
|
|
|
2894 |
$carry13 = ($s13 + (1 << 20)) >> 21;
|
|
|
2895 |
$s14 += $carry13;
|
|
|
2896 |
$s13 -= $carry13 << 21;
|
|
|
2897 |
/** @var int $carry15 */
|
|
|
2898 |
$carry15 = ($s15 + (1 << 20)) >> 21;
|
|
|
2899 |
$s16 += $carry15;
|
|
|
2900 |
$s15 -= $carry15 << 21;
|
|
|
2901 |
|
|
|
2902 |
$s5 += self::mul($s17, 666643, 20);
|
|
|
2903 |
$s6 += self::mul($s17, 470296, 19);
|
|
|
2904 |
$s7 += self::mul($s17, 654183, 20);
|
|
|
2905 |
$s8 -= self::mul($s17, 997805, 20);
|
|
|
2906 |
$s9 += self::mul($s17, 136657, 18);
|
|
|
2907 |
$s10 -= self::mul($s17, 683901, 20);
|
|
|
2908 |
|
|
|
2909 |
$s4 += self::mul($s16, 666643, 20);
|
|
|
2910 |
$s5 += self::mul($s16, 470296, 19);
|
|
|
2911 |
$s6 += self::mul($s16, 654183, 20);
|
|
|
2912 |
$s7 -= self::mul($s16, 997805, 20);
|
|
|
2913 |
$s8 += self::mul($s16, 136657, 18);
|
|
|
2914 |
$s9 -= self::mul($s16, 683901, 20);
|
|
|
2915 |
|
|
|
2916 |
$s3 += self::mul($s15, 666643, 20);
|
|
|
2917 |
$s4 += self::mul($s15, 470296, 19);
|
|
|
2918 |
$s5 += self::mul($s15, 654183, 20);
|
|
|
2919 |
$s6 -= self::mul($s15, 997805, 20);
|
|
|
2920 |
$s7 += self::mul($s15, 136657, 18);
|
|
|
2921 |
$s8 -= self::mul($s15, 683901, 20);
|
|
|
2922 |
|
|
|
2923 |
$s2 += self::mul($s14, 666643, 20);
|
|
|
2924 |
$s3 += self::mul($s14, 470296, 19);
|
|
|
2925 |
$s4 += self::mul($s14, 654183, 20);
|
|
|
2926 |
$s5 -= self::mul($s14, 997805, 20);
|
|
|
2927 |
$s6 += self::mul($s14, 136657, 18);
|
|
|
2928 |
$s7 -= self::mul($s14, 683901, 20);
|
|
|
2929 |
|
|
|
2930 |
$s1 += self::mul($s13, 666643, 20);
|
|
|
2931 |
$s2 += self::mul($s13, 470296, 19);
|
|
|
2932 |
$s3 += self::mul($s13, 654183, 20);
|
|
|
2933 |
$s4 -= self::mul($s13, 997805, 20);
|
|
|
2934 |
$s5 += self::mul($s13, 136657, 18);
|
|
|
2935 |
$s6 -= self::mul($s13, 683901, 20);
|
|
|
2936 |
|
|
|
2937 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
2938 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
2939 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
2940 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
2941 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
2942 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
2943 |
$s12 = 0;
|
|
|
2944 |
|
|
|
2945 |
/** @var int $carry0 */
|
|
|
2946 |
$carry0 = ($s0 + (1 << 20)) >> 21;
|
|
|
2947 |
$s1 += $carry0;
|
|
|
2948 |
$s0 -= $carry0 << 21;
|
|
|
2949 |
/** @var int $carry2 */
|
|
|
2950 |
$carry2 = ($s2 + (1 << 20)) >> 21;
|
|
|
2951 |
$s3 += $carry2;
|
|
|
2952 |
$s2 -= $carry2 << 21;
|
|
|
2953 |
/** @var int $carry4 */
|
|
|
2954 |
$carry4 = ($s4 + (1 << 20)) >> 21;
|
|
|
2955 |
$s5 += $carry4;
|
|
|
2956 |
$s4 -= $carry4 << 21;
|
|
|
2957 |
/** @var int $carry6 */
|
|
|
2958 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
2959 |
$s7 += $carry6;
|
|
|
2960 |
$s6 -= $carry6 << 21;
|
|
|
2961 |
/** @var int $carry8 */
|
|
|
2962 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
2963 |
$s9 += $carry8;
|
|
|
2964 |
$s8 -= $carry8 << 21;
|
|
|
2965 |
/** @var int $carry10 */
|
|
|
2966 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
2967 |
$s11 += $carry10;
|
|
|
2968 |
$s10 -= $carry10 << 21;
|
|
|
2969 |
|
|
|
2970 |
/** @var int $carry1 */
|
|
|
2971 |
$carry1 = ($s1 + (1 << 20)) >> 21;
|
|
|
2972 |
$s2 += $carry1;
|
|
|
2973 |
$s1 -= $carry1 << 21;
|
|
|
2974 |
/** @var int $carry3 */
|
|
|
2975 |
$carry3 = ($s3 + (1 << 20)) >> 21;
|
|
|
2976 |
$s4 += $carry3;
|
|
|
2977 |
$s3 -= $carry3 << 21;
|
|
|
2978 |
/** @var int $carry5 */
|
|
|
2979 |
$carry5 = ($s5 + (1 << 20)) >> 21;
|
|
|
2980 |
$s6 += $carry5;
|
|
|
2981 |
$s5 -= $carry5 << 21;
|
|
|
2982 |
/** @var int $carry7 */
|
|
|
2983 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
2984 |
$s8 += $carry7;
|
|
|
2985 |
$s7 -= $carry7 << 21;
|
|
|
2986 |
/** @var int $carry9 */
|
|
|
2987 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
2988 |
$s10 += $carry9;
|
|
|
2989 |
$s9 -= $carry9 << 21;
|
|
|
2990 |
/** @var int $carry11 */
|
|
|
2991 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
2992 |
$s12 += $carry11;
|
|
|
2993 |
$s11 -= $carry11 << 21;
|
|
|
2994 |
|
|
|
2995 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
2996 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
2997 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
2998 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
2999 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
3000 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
3001 |
$s12 = 0;
|
|
|
3002 |
|
|
|
3003 |
/** @var int $carry0 */
|
|
|
3004 |
$carry0 = $s0 >> 21;
|
|
|
3005 |
$s1 += $carry0;
|
|
|
3006 |
$s0 -= $carry0 << 21;
|
|
|
3007 |
/** @var int $carry1 */
|
|
|
3008 |
$carry1 = $s1 >> 21;
|
|
|
3009 |
$s2 += $carry1;
|
|
|
3010 |
$s1 -= $carry1 << 21;
|
|
|
3011 |
/** @var int $carry2 */
|
|
|
3012 |
$carry2 = $s2 >> 21;
|
|
|
3013 |
$s3 += $carry2;
|
|
|
3014 |
$s2 -= $carry2 << 21;
|
|
|
3015 |
/** @var int $carry3 */
|
|
|
3016 |
$carry3 = $s3 >> 21;
|
|
|
3017 |
$s4 += $carry3;
|
|
|
3018 |
$s3 -= $carry3 << 21;
|
|
|
3019 |
/** @var int $carry4 */
|
|
|
3020 |
$carry4 = $s4 >> 21;
|
|
|
3021 |
$s5 += $carry4;
|
|
|
3022 |
$s4 -= $carry4 << 21;
|
|
|
3023 |
/** @var int $carry5 */
|
|
|
3024 |
$carry5 = $s5 >> 21;
|
|
|
3025 |
$s6 += $carry5;
|
|
|
3026 |
$s5 -= $carry5 << 21;
|
|
|
3027 |
/** @var int $carry6 */
|
|
|
3028 |
$carry6 = $s6 >> 21;
|
|
|
3029 |
$s7 += $carry6;
|
|
|
3030 |
$s6 -= $carry6 << 21;
|
|
|
3031 |
/** @var int $carry7 */
|
|
|
3032 |
$carry7 = $s7 >> 21;
|
|
|
3033 |
$s8 += $carry7;
|
|
|
3034 |
$s7 -= $carry7 << 21;
|
|
|
3035 |
/** @var int $carry8 */
|
|
|
3036 |
$carry8 = $s8 >> 21;
|
|
|
3037 |
$s9 += $carry8;
|
|
|
3038 |
$s8 -= $carry8 << 21;
|
|
|
3039 |
/** @var int $carry9 */
|
|
|
3040 |
$carry9 = $s9 >> 21;
|
|
|
3041 |
$s10 += $carry9;
|
|
|
3042 |
$s9 -= $carry9 << 21;
|
|
|
3043 |
/** @var int $carry10 */
|
|
|
3044 |
$carry10 = $s10 >> 21;
|
|
|
3045 |
$s11 += $carry10;
|
|
|
3046 |
$s10 -= $carry10 << 21;
|
|
|
3047 |
/** @var int $carry11 */
|
|
|
3048 |
$carry11 = $s11 >> 21;
|
|
|
3049 |
$s12 += $carry11;
|
|
|
3050 |
$s11 -= $carry11 << 21;
|
|
|
3051 |
|
|
|
3052 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
3053 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
3054 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
3055 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
3056 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
3057 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
3058 |
|
|
|
3059 |
/** @var int $carry0 */
|
|
|
3060 |
$carry0 = $s0 >> 21;
|
|
|
3061 |
$s1 += $carry0;
|
|
|
3062 |
$s0 -= $carry0 << 21;
|
|
|
3063 |
/** @var int $carry1 */
|
|
|
3064 |
$carry1 = $s1 >> 21;
|
|
|
3065 |
$s2 += $carry1;
|
|
|
3066 |
$s1 -= $carry1 << 21;
|
|
|
3067 |
/** @var int $carry2 */
|
|
|
3068 |
$carry2 = $s2 >> 21;
|
|
|
3069 |
$s3 += $carry2;
|
|
|
3070 |
$s2 -= $carry2 << 21;
|
|
|
3071 |
/** @var int $carry3 */
|
|
|
3072 |
$carry3 = $s3 >> 21;
|
|
|
3073 |
$s4 += $carry3;
|
|
|
3074 |
$s3 -= $carry3 << 21;
|
|
|
3075 |
/** @var int $carry4 */
|
|
|
3076 |
$carry4 = $s4 >> 21;
|
|
|
3077 |
$s5 += $carry4;
|
|
|
3078 |
$s4 -= $carry4 << 21;
|
|
|
3079 |
/** @var int $carry5 */
|
|
|
3080 |
$carry5 = $s5 >> 21;
|
|
|
3081 |
$s6 += $carry5;
|
|
|
3082 |
$s5 -= $carry5 << 21;
|
|
|
3083 |
/** @var int $carry6 */
|
|
|
3084 |
$carry6 = $s6 >> 21;
|
|
|
3085 |
$s7 += $carry6;
|
|
|
3086 |
$s6 -= $carry6 << 21;
|
|
|
3087 |
/** @var int $carry7 */
|
|
|
3088 |
$carry7 = $s7 >> 21;
|
|
|
3089 |
$s8 += $carry7;
|
|
|
3090 |
$s7 -= $carry7 << 21;
|
|
|
3091 |
/** @var int $carry8 */
|
|
|
3092 |
$carry8 = $s8 >> 21;
|
|
|
3093 |
$s9 += $carry8;
|
|
|
3094 |
$s8 -= $carry8 << 21;
|
|
|
3095 |
/** @var int $carry9 */
|
|
|
3096 |
$carry9 = $s9 >> 21;
|
|
|
3097 |
$s10 += $carry9;
|
|
|
3098 |
$s9 -= $carry9 << 21;
|
|
|
3099 |
/** @var int $carry10 */
|
|
|
3100 |
$carry10 = $s10 >> 21;
|
|
|
3101 |
$s11 += $carry10;
|
|
|
3102 |
$s10 -= $carry10 << 21;
|
|
|
3103 |
|
|
|
3104 |
/**
|
|
|
3105 |
* @var array<int, int>
|
|
|
3106 |
*/
|
|
|
3107 |
$arr = array(
|
|
|
3108 |
(int) ($s0 >> 0),
|
|
|
3109 |
(int) ($s0 >> 8),
|
|
|
3110 |
(int) (($s0 >> 16) | $s1 << 5),
|
|
|
3111 |
(int) ($s1 >> 3),
|
|
|
3112 |
(int) ($s1 >> 11),
|
|
|
3113 |
(int) (($s1 >> 19) | $s2 << 2),
|
|
|
3114 |
(int) ($s2 >> 6),
|
|
|
3115 |
(int) (($s2 >> 14) | $s3 << 7),
|
|
|
3116 |
(int) ($s3 >> 1),
|
|
|
3117 |
(int) ($s3 >> 9),
|
|
|
3118 |
(int) (($s3 >> 17) | $s4 << 4),
|
|
|
3119 |
(int) ($s4 >> 4),
|
|
|
3120 |
(int) ($s4 >> 12),
|
|
|
3121 |
(int) (($s4 >> 20) | $s5 << 1),
|
|
|
3122 |
(int) ($s5 >> 7),
|
|
|
3123 |
(int) (($s5 >> 15) | $s6 << 6),
|
|
|
3124 |
(int) ($s6 >> 2),
|
|
|
3125 |
(int) ($s6 >> 10),
|
|
|
3126 |
(int) (($s6 >> 18) | $s7 << 3),
|
|
|
3127 |
(int) ($s7 >> 5),
|
|
|
3128 |
(int) ($s7 >> 13),
|
|
|
3129 |
(int) ($s8 >> 0),
|
|
|
3130 |
(int) ($s8 >> 8),
|
|
|
3131 |
(int) (($s8 >> 16) | $s9 << 5),
|
|
|
3132 |
(int) ($s9 >> 3),
|
|
|
3133 |
(int) ($s9 >> 11),
|
|
|
3134 |
(int) (($s9 >> 19) | $s10 << 2),
|
|
|
3135 |
(int) ($s10 >> 6),
|
|
|
3136 |
(int) (($s10 >> 14) | $s11 << 7),
|
|
|
3137 |
(int) ($s11 >> 1),
|
|
|
3138 |
(int) ($s11 >> 9),
|
|
|
3139 |
(int) $s11 >> 17
|
|
|
3140 |
);
|
|
|
3141 |
return self::intArrayToString($arr);
|
|
|
3142 |
}
|
|
|
3143 |
|
|
|
3144 |
/**
|
|
|
3145 |
* multiply by the order of the main subgroup l = 2^252+27742317777372353535851937790883648493
|
|
|
3146 |
*
|
|
|
3147 |
* @param ParagonIE_Sodium_Core_Curve25519_Ge_P3 $A
|
|
|
3148 |
* @return ParagonIE_Sodium_Core_Curve25519_Ge_P3
|
|
|
3149 |
*/
|
|
|
3150 |
public static function ge_mul_l(ParagonIE_Sodium_Core_Curve25519_Ge_P3 $A)
|
|
|
3151 |
{
|
|
|
3152 |
/** @var array<int, int> $aslide */
|
|
|
3153 |
$aslide = array(
|
|
|
3154 |
13, 0, 0, 0, 0, -1, 0, 0, 0, 0, -11, 0, 0, 0, 0, 0, 0, -5, 0, 0, 0,
|
|
|
3155 |
0, 0, 0, -3, 0, 0, 0, 0, -13, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0, 3, 0,
|
|
|
3156 |
0, 0, 0, -13, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 11, 0, 0, 0,
|
|
|
3157 |
0, 0, 11, 0, 0, 0, 0, -13, 0, 0, 0, 0, 0, 0, -3, 0, 0, 0, 0, 0, -1,
|
|
|
3158 |
0, 0, 0, 0, 3, 0, 0, 0, 0, -11, 0, 0, 0, 0, 0, 0, 0, 15, 0, 0, 0,
|
|
|
3159 |
0, 0, -1, 0, 0, 0, 0, -1, 0, 0, 0, 0, 7, 0, 0, 0, 0, 5, 0, 0, 0, 0,
|
|
|
3160 |
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
|
|
3161 |
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
|
|
3162 |
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
|
|
3163 |
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
|
|
3164 |
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
|
|
3165 |
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1
|
|
|
3166 |
);
|
|
|
3167 |
|
|
|
3168 |
/** @var array<int, ParagonIE_Sodium_Core_Curve25519_Ge_Cached> $Ai size 8 */
|
|
|
3169 |
$Ai = array();
|
|
|
3170 |
|
|
|
3171 |
# ge_p3_to_cached(&Ai[0], A);
|
|
|
3172 |
$Ai[0] = self::ge_p3_to_cached($A);
|
|
|
3173 |
# ge_p3_dbl(&t, A);
|
|
|
3174 |
$t = self::ge_p3_dbl($A);
|
|
|
3175 |
# ge_p1p1_to_p3(&A2, &t);
|
|
|
3176 |
$A2 = self::ge_p1p1_to_p3($t);
|
|
|
3177 |
|
|
|
3178 |
for ($i = 1; $i < 8; ++$i) {
|
|
|
3179 |
# ge_add(&t, &A2, &Ai[0]);
|
|
|
3180 |
$t = self::ge_add($A2, $Ai[$i - 1]);
|
|
|
3181 |
# ge_p1p1_to_p3(&u, &t);
|
|
|
3182 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
3183 |
# ge_p3_to_cached(&Ai[i], &u);
|
|
|
3184 |
$Ai[$i] = self::ge_p3_to_cached($u);
|
|
|
3185 |
}
|
|
|
3186 |
|
|
|
3187 |
$r = self::ge_p3_0();
|
|
|
3188 |
for ($i = 252; $i >= 0; --$i) {
|
|
|
3189 |
$t = self::ge_p3_dbl($r);
|
|
|
3190 |
if ($aslide[$i] > 0) {
|
|
|
3191 |
# ge_p1p1_to_p3(&u, &t);
|
|
|
3192 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
3193 |
# ge_add(&t, &u, &Ai[aslide[i] / 2]);
|
|
|
3194 |
$t = self::ge_add($u, $Ai[(int)($aslide[$i] / 2)]);
|
|
|
3195 |
} elseif ($aslide[$i] < 0) {
|
|
|
3196 |
# ge_p1p1_to_p3(&u, &t);
|
|
|
3197 |
$u = self::ge_p1p1_to_p3($t);
|
|
|
3198 |
# ge_sub(&t, &u, &Ai[(-aslide[i]) / 2]);
|
|
|
3199 |
$t = self::ge_sub($u, $Ai[(int)(-$aslide[$i] / 2)]);
|
|
|
3200 |
}
|
|
|
3201 |
}
|
|
|
3202 |
|
|
|
3203 |
# ge_p1p1_to_p3(r, &t);
|
|
|
3204 |
return self::ge_p1p1_to_p3($t);
|
|
|
3205 |
}
|
|
18
|
3206 |
|
|
|
3207 |
/**
|
|
|
3208 |
* @param string $a
|
|
|
3209 |
* @param string $b
|
|
|
3210 |
* @return string
|
|
|
3211 |
*/
|
|
|
3212 |
public static function sc25519_mul($a, $b)
|
|
|
3213 |
{
|
|
|
3214 |
// int64_t a0 = 2097151 & load_3(a);
|
|
|
3215 |
// int64_t a1 = 2097151 & (load_4(a + 2) >> 5);
|
|
|
3216 |
// int64_t a2 = 2097151 & (load_3(a + 5) >> 2);
|
|
|
3217 |
// int64_t a3 = 2097151 & (load_4(a + 7) >> 7);
|
|
|
3218 |
// int64_t a4 = 2097151 & (load_4(a + 10) >> 4);
|
|
|
3219 |
// int64_t a5 = 2097151 & (load_3(a + 13) >> 1);
|
|
|
3220 |
// int64_t a6 = 2097151 & (load_4(a + 15) >> 6);
|
|
|
3221 |
// int64_t a7 = 2097151 & (load_3(a + 18) >> 3);
|
|
|
3222 |
// int64_t a8 = 2097151 & load_3(a + 21);
|
|
|
3223 |
// int64_t a9 = 2097151 & (load_4(a + 23) >> 5);
|
|
|
3224 |
// int64_t a10 = 2097151 & (load_3(a + 26) >> 2);
|
|
|
3225 |
// int64_t a11 = (load_4(a + 28) >> 7);
|
|
|
3226 |
$a0 = 2097151 & self::load_3(self::substr($a, 0, 3));
|
|
|
3227 |
$a1 = 2097151 & (self::load_4(self::substr($a, 2, 4)) >> 5);
|
|
|
3228 |
$a2 = 2097151 & (self::load_3(self::substr($a, 5, 3)) >> 2);
|
|
|
3229 |
$a3 = 2097151 & (self::load_4(self::substr($a, 7, 4)) >> 7);
|
|
|
3230 |
$a4 = 2097151 & (self::load_4(self::substr($a, 10, 4)) >> 4);
|
|
|
3231 |
$a5 = 2097151 & (self::load_3(self::substr($a, 13, 3)) >> 1);
|
|
|
3232 |
$a6 = 2097151 & (self::load_4(self::substr($a, 15, 4)) >> 6);
|
|
|
3233 |
$a7 = 2097151 & (self::load_3(self::substr($a, 18, 3)) >> 3);
|
|
|
3234 |
$a8 = 2097151 & self::load_3(self::substr($a, 21, 3));
|
|
|
3235 |
$a9 = 2097151 & (self::load_4(self::substr($a, 23, 4)) >> 5);
|
|
|
3236 |
$a10 = 2097151 & (self::load_3(self::substr($a, 26, 3)) >> 2);
|
|
|
3237 |
$a11 = (self::load_4(self::substr($a, 28, 4)) >> 7);
|
|
|
3238 |
|
|
|
3239 |
// int64_t b0 = 2097151 & load_3(b);
|
|
|
3240 |
// int64_t b1 = 2097151 & (load_4(b + 2) >> 5);
|
|
|
3241 |
// int64_t b2 = 2097151 & (load_3(b + 5) >> 2);
|
|
|
3242 |
// int64_t b3 = 2097151 & (load_4(b + 7) >> 7);
|
|
|
3243 |
// int64_t b4 = 2097151 & (load_4(b + 10) >> 4);
|
|
|
3244 |
// int64_t b5 = 2097151 & (load_3(b + 13) >> 1);
|
|
|
3245 |
// int64_t b6 = 2097151 & (load_4(b + 15) >> 6);
|
|
|
3246 |
// int64_t b7 = 2097151 & (load_3(b + 18) >> 3);
|
|
|
3247 |
// int64_t b8 = 2097151 & load_3(b + 21);
|
|
|
3248 |
// int64_t b9 = 2097151 & (load_4(b + 23) >> 5);
|
|
|
3249 |
// int64_t b10 = 2097151 & (load_3(b + 26) >> 2);
|
|
|
3250 |
// int64_t b11 = (load_4(b + 28) >> 7);
|
|
|
3251 |
$b0 = 2097151 & self::load_3(self::substr($b, 0, 3));
|
|
|
3252 |
$b1 = 2097151 & (self::load_4(self::substr($b, 2, 4)) >> 5);
|
|
|
3253 |
$b2 = 2097151 & (self::load_3(self::substr($b, 5, 3)) >> 2);
|
|
|
3254 |
$b3 = 2097151 & (self::load_4(self::substr($b, 7, 4)) >> 7);
|
|
|
3255 |
$b4 = 2097151 & (self::load_4(self::substr($b, 10, 4)) >> 4);
|
|
|
3256 |
$b5 = 2097151 & (self::load_3(self::substr($b, 13, 3)) >> 1);
|
|
|
3257 |
$b6 = 2097151 & (self::load_4(self::substr($b, 15, 4)) >> 6);
|
|
|
3258 |
$b7 = 2097151 & (self::load_3(self::substr($b, 18, 3)) >> 3);
|
|
|
3259 |
$b8 = 2097151 & self::load_3(self::substr($b, 21, 3));
|
|
|
3260 |
$b9 = 2097151 & (self::load_4(self::substr($b, 23, 4)) >> 5);
|
|
|
3261 |
$b10 = 2097151 & (self::load_3(self::substr($b, 26, 3)) >> 2);
|
|
|
3262 |
$b11 = (self::load_4(self::substr($b, 28, 4)) >> 7);
|
|
|
3263 |
|
|
|
3264 |
// s0 = a0 * b0;
|
|
|
3265 |
// s1 = a0 * b1 + a1 * b0;
|
|
|
3266 |
// s2 = a0 * b2 + a1 * b1 + a2 * b0;
|
|
|
3267 |
// s3 = a0 * b3 + a1 * b2 + a2 * b1 + a3 * b0;
|
|
|
3268 |
// s4 = a0 * b4 + a1 * b3 + a2 * b2 + a3 * b1 + a4 * b0;
|
|
|
3269 |
// s5 = a0 * b5 + a1 * b4 + a2 * b3 + a3 * b2 + a4 * b1 + a5 * b0;
|
|
|
3270 |
// s6 = a0 * b6 + a1 * b5 + a2 * b4 + a3 * b3 + a4 * b2 + a5 * b1 + a6 * b0;
|
|
|
3271 |
// s7 = a0 * b7 + a1 * b6 + a2 * b5 + a3 * b4 + a4 * b3 + a5 * b2 +
|
|
|
3272 |
// a6 * b1 + a7 * b0;
|
|
|
3273 |
// s8 = a0 * b8 + a1 * b7 + a2 * b6 + a3 * b5 + a4 * b4 + a5 * b3 +
|
|
|
3274 |
// a6 * b2 + a7 * b1 + a8 * b0;
|
|
|
3275 |
// s9 = a0 * b9 + a1 * b8 + a2 * b7 + a3 * b6 + a4 * b5 + a5 * b4 +
|
|
|
3276 |
// a6 * b3 + a7 * b2 + a8 * b1 + a9 * b0;
|
|
|
3277 |
// s10 = a0 * b10 + a1 * b9 + a2 * b8 + a3 * b7 + a4 * b6 + a5 * b5 +
|
|
|
3278 |
// a6 * b4 + a7 * b3 + a8 * b2 + a9 * b1 + a10 * b0;
|
|
|
3279 |
// s11 = a0 * b11 + a1 * b10 + a2 * b9 + a3 * b8 + a4 * b7 + a5 * b6 +
|
|
|
3280 |
// a6 * b5 + a7 * b4 + a8 * b3 + a9 * b2 + a10 * b1 + a11 * b0;
|
|
|
3281 |
// s12 = a1 * b11 + a2 * b10 + a3 * b9 + a4 * b8 + a5 * b7 + a6 * b6 +
|
|
|
3282 |
// a7 * b5 + a8 * b4 + a9 * b3 + a10 * b2 + a11 * b1;
|
|
|
3283 |
// s13 = a2 * b11 + a3 * b10 + a4 * b9 + a5 * b8 + a6 * b7 + a7 * b6 +
|
|
|
3284 |
// a8 * b5 + a9 * b4 + a10 * b3 + a11 * b2;
|
|
|
3285 |
// s14 = a3 * b11 + a4 * b10 + a5 * b9 + a6 * b8 + a7 * b7 + a8 * b6 +
|
|
|
3286 |
// a9 * b5 + a10 * b4 + a11 * b3;
|
|
|
3287 |
// s15 = a4 * b11 + a5 * b10 + a6 * b9 + a7 * b8 + a8 * b7 + a9 * b6 +
|
|
|
3288 |
// a10 * b5 + a11 * b4;
|
|
|
3289 |
// s16 =
|
|
|
3290 |
// a5 * b11 + a6 * b10 + a7 * b9 + a8 * b8 + a9 * b7 + a10 * b6 + a11 * b5;
|
|
|
3291 |
// s17 = a6 * b11 + a7 * b10 + a8 * b9 + a9 * b8 + a10 * b7 + a11 * b6;
|
|
|
3292 |
// s18 = a7 * b11 + a8 * b10 + a9 * b9 + a10 * b8 + a11 * b7;
|
|
|
3293 |
// s19 = a8 * b11 + a9 * b10 + a10 * b9 + a11 * b8;
|
|
|
3294 |
// s20 = a9 * b11 + a10 * b10 + a11 * b9;
|
|
|
3295 |
// s21 = a10 * b11 + a11 * b10;
|
|
|
3296 |
// s22 = a11 * b11;
|
|
|
3297 |
// s23 = 0;
|
|
|
3298 |
$s0 = self::mul($a0, $b0, 22);
|
|
|
3299 |
$s1 = self::mul($a0, $b1, 22) + self::mul($a1, $b0, 22);
|
|
|
3300 |
$s2 = self::mul($a0, $b2, 22) + self::mul($a1, $b1, 22) + self::mul($a2, $b0, 22);
|
|
|
3301 |
$s3 = self::mul($a0, $b3, 22) + self::mul($a1, $b2, 22) + self::mul($a2, $b1, 22) + self::mul($a3, $b0, 22);
|
|
|
3302 |
$s4 = self::mul($a0, $b4, 22) + self::mul($a1, $b3, 22) + self::mul($a2, $b2, 22) + self::mul($a3, $b1, 22) +
|
|
|
3303 |
self::mul($a4, $b0, 22);
|
|
|
3304 |
$s5 = self::mul($a0, $b5, 22) + self::mul($a1, $b4, 22) + self::mul($a2, $b3, 22) + self::mul($a3, $b2, 22) +
|
|
|
3305 |
self::mul($a4, $b1, 22) + self::mul($a5, $b0, 22);
|
|
|
3306 |
$s6 = self::mul($a0, $b6, 22) + self::mul($a1, $b5, 22) + self::mul($a2, $b4, 22) + self::mul($a3, $b3, 22) +
|
|
|
3307 |
self::mul($a4, $b2, 22) + self::mul($a5, $b1, 22) + self::mul($a6, $b0, 22);
|
|
|
3308 |
$s7 = self::mul($a0, $b7, 22) + self::mul($a1, $b6, 22) + self::mul($a2, $b5, 22) + self::mul($a3, $b4, 22) +
|
|
|
3309 |
self::mul($a4, $b3, 22) + self::mul($a5, $b2, 22) + self::mul($a6, $b1, 22) + self::mul($a7, $b0, 22);
|
|
|
3310 |
$s8 = self::mul($a0, $b8, 22) + self::mul($a1, $b7, 22) + self::mul($a2, $b6, 22) + self::mul($a3, $b5, 22) +
|
|
|
3311 |
self::mul($a4, $b4, 22) + self::mul($a5, $b3, 22) + self::mul($a6, $b2, 22) + self::mul($a7, $b1, 22) +
|
|
|
3312 |
self::mul($a8, $b0, 22);
|
|
|
3313 |
$s9 = self::mul($a0, $b9, 22) + self::mul($a1, $b8, 22) + self::mul($a2, $b7, 22) + self::mul($a3, $b6, 22) +
|
|
|
3314 |
self::mul($a4, $b5, 22) + self::mul($a5, $b4, 22) + self::mul($a6, $b3, 22) + self::mul($a7, $b2, 22) +
|
|
|
3315 |
self::mul($a8, $b1, 22) + self::mul($a9, $b0, 22);
|
|
|
3316 |
$s10 = self::mul($a0, $b10, 22) + self::mul($a1, $b9, 22) + self::mul($a2, $b8, 22) + self::mul($a3, $b7, 22) +
|
|
|
3317 |
self::mul($a4, $b6, 22) + self::mul($a5, $b5, 22) + self::mul($a6, $b4, 22) + self::mul($a7, $b3, 22) +
|
|
|
3318 |
self::mul($a8, $b2, 22) + self::mul($a9, $b1, 22) + self::mul($a10, $b0, 22);
|
|
|
3319 |
$s11 = self::mul($a0, $b11, 22) + self::mul($a1, $b10, 22) + self::mul($a2, $b9, 22) + self::mul($a3, $b8, 22) +
|
|
|
3320 |
self::mul($a4, $b7, 22) + self::mul($a5, $b6, 22) + self::mul($a6, $b5, 22) + self::mul($a7, $b4, 22) +
|
|
|
3321 |
self::mul($a8, $b3, 22) + self::mul($a9, $b2, 22) + self::mul($a10, $b1, 22) + self::mul($a11, $b0, 22);
|
|
|
3322 |
$s12 = self::mul($a1, $b11, 22) + self::mul($a2, $b10, 22) + self::mul($a3, $b9, 22) + self::mul($a4, $b8, 22) +
|
|
|
3323 |
self::mul($a5, $b7, 22) + self::mul($a6, $b6, 22) + self::mul($a7, $b5, 22) + self::mul($a8, $b4, 22) +
|
|
|
3324 |
self::mul($a9, $b3, 22) + self::mul($a10, $b2, 22) + self::mul($a11, $b1, 22);
|
|
|
3325 |
$s13 = self::mul($a2, $b11, 22) + self::mul($a3, $b10, 22) + self::mul($a4, $b9, 22) + self::mul($a5, $b8, 22) +
|
|
|
3326 |
self::mul($a6, $b7, 22) + self::mul($a7, $b6, 22) + self::mul($a8, $b5, 22) + self::mul($a9, $b4, 22) +
|
|
|
3327 |
self::mul($a10, $b3, 22) + self::mul($a11, $b2, 22);
|
|
|
3328 |
$s14 = self::mul($a3, $b11, 22) + self::mul($a4, $b10, 22) + self::mul($a5, $b9, 22) + self::mul($a6, $b8, 22) +
|
|
|
3329 |
self::mul($a7, $b7, 22) + self::mul($a8, $b6, 22) + self::mul($a9, $b5, 22) + self::mul($a10, $b4, 22) +
|
|
|
3330 |
self::mul($a11, $b3, 22);
|
|
|
3331 |
$s15 = self::mul($a4, $b11, 22) + self::mul($a5, $b10, 22) + self::mul($a6, $b9, 22) + self::mul($a7, $b8, 22) +
|
|
|
3332 |
self::mul($a8, $b7, 22) + self::mul($a9, $b6, 22) + self::mul($a10, $b5, 22) + self::mul($a11, $b4, 22);
|
|
|
3333 |
$s16 =
|
|
|
3334 |
self::mul($a5, $b11, 22) + self::mul($a6, $b10, 22) + self::mul($a7, $b9, 22) + self::mul($a8, $b8, 22) +
|
|
|
3335 |
self::mul($a9, $b7, 22) + self::mul($a10, $b6, 22) + self::mul($a11, $b5, 22);
|
|
|
3336 |
$s17 = self::mul($a6, $b11, 22) + self::mul($a7, $b10, 22) + self::mul($a8, $b9, 22) + self::mul($a9, $b8, 22) +
|
|
|
3337 |
self::mul($a10, $b7, 22) + self::mul($a11, $b6, 22);
|
|
|
3338 |
$s18 = self::mul($a7, $b11, 22) + self::mul($a8, $b10, 22) + self::mul($a9, $b9, 22) + self::mul($a10, $b8, 22)
|
|
|
3339 |
+ self::mul($a11, $b7, 22);
|
|
|
3340 |
$s19 = self::mul($a8, $b11, 22) + self::mul($a9, $b10, 22) + self::mul($a10, $b9, 22) +
|
|
|
3341 |
self::mul($a11, $b8, 22);
|
|
|
3342 |
$s20 = self::mul($a9, $b11, 22) + self::mul($a10, $b10, 22) + self::mul($a11, $b9, 22);
|
|
|
3343 |
$s21 = self::mul($a10, $b11, 22) + self::mul($a11, $b10, 22);
|
|
|
3344 |
$s22 = self::mul($a11, $b11, 22);
|
|
|
3345 |
$s23 = 0;
|
|
|
3346 |
|
|
|
3347 |
// carry0 = (s0 + (int64_t) (1L << 20)) >> 21;
|
|
|
3348 |
// s1 += carry0;
|
|
|
3349 |
// s0 -= carry0 * ((uint64_t) 1L << 21);
|
|
|
3350 |
$carry0 = ($s0 + (1 << 20)) >> 21;
|
|
|
3351 |
$s1 += $carry0;
|
|
|
3352 |
$s0 -= $carry0 << 21;
|
|
|
3353 |
// carry2 = (s2 + (int64_t) (1L << 20)) >> 21;
|
|
|
3354 |
// s3 += carry2;
|
|
|
3355 |
// s2 -= carry2 * ((uint64_t) 1L << 21);
|
|
|
3356 |
$carry2 = ($s2 + (1 << 20)) >> 21;
|
|
|
3357 |
$s3 += $carry2;
|
|
|
3358 |
$s2 -= $carry2 << 21;
|
|
|
3359 |
// carry4 = (s4 + (int64_t) (1L << 20)) >> 21;
|
|
|
3360 |
// s5 += carry4;
|
|
|
3361 |
// s4 -= carry4 * ((uint64_t) 1L << 21);
|
|
|
3362 |
$carry4 = ($s4 + (1 << 20)) >> 21;
|
|
|
3363 |
$s5 += $carry4;
|
|
|
3364 |
$s4 -= $carry4 << 21;
|
|
|
3365 |
// carry6 = (s6 + (int64_t) (1L << 20)) >> 21;
|
|
|
3366 |
// s7 += carry6;
|
|
|
3367 |
// s6 -= carry6 * ((uint64_t) 1L << 21);
|
|
|
3368 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
3369 |
$s7 += $carry6;
|
|
|
3370 |
$s6 -= $carry6 << 21;
|
|
|
3371 |
// carry8 = (s8 + (int64_t) (1L << 20)) >> 21;
|
|
|
3372 |
// s9 += carry8;
|
|
|
3373 |
// s8 -= carry8 * ((uint64_t) 1L << 21);
|
|
|
3374 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
3375 |
$s9 += $carry8;
|
|
|
3376 |
$s8 -= $carry8 << 21;
|
|
|
3377 |
// carry10 = (s10 + (int64_t) (1L << 20)) >> 21;
|
|
|
3378 |
// s11 += carry10;
|
|
|
3379 |
// s10 -= carry10 * ((uint64_t) 1L << 21);
|
|
|
3380 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
3381 |
$s11 += $carry10;
|
|
|
3382 |
$s10 -= $carry10 << 21;
|
|
|
3383 |
// carry12 = (s12 + (int64_t) (1L << 20)) >> 21;
|
|
|
3384 |
// s13 += carry12;
|
|
|
3385 |
// s12 -= carry12 * ((uint64_t) 1L << 21);
|
|
|
3386 |
$carry12 = ($s12 + (1 << 20)) >> 21;
|
|
|
3387 |
$s13 += $carry12;
|
|
|
3388 |
$s12 -= $carry12 << 21;
|
|
|
3389 |
// carry14 = (s14 + (int64_t) (1L << 20)) >> 21;
|
|
|
3390 |
// s15 += carry14;
|
|
|
3391 |
// s14 -= carry14 * ((uint64_t) 1L << 21);
|
|
|
3392 |
$carry14 = ($s14 + (1 << 20)) >> 21;
|
|
|
3393 |
$s15 += $carry14;
|
|
|
3394 |
$s14 -= $carry14 << 21;
|
|
|
3395 |
// carry16 = (s16 + (int64_t) (1L << 20)) >> 21;
|
|
|
3396 |
// s17 += carry16;
|
|
|
3397 |
// s16 -= carry16 * ((uint64_t) 1L << 21);
|
|
|
3398 |
$carry16 = ($s16 + (1 << 20)) >> 21;
|
|
|
3399 |
$s17 += $carry16;
|
|
|
3400 |
$s16 -= $carry16 << 21;
|
|
|
3401 |
// carry18 = (s18 + (int64_t) (1L << 20)) >> 21;
|
|
|
3402 |
// s19 += carry18;
|
|
|
3403 |
// s18 -= carry18 * ((uint64_t) 1L << 21);
|
|
|
3404 |
$carry18 = ($s18 + (1 << 20)) >> 21;
|
|
|
3405 |
$s19 += $carry18;
|
|
|
3406 |
$s18 -= $carry18 << 21;
|
|
|
3407 |
// carry20 = (s20 + (int64_t) (1L << 20)) >> 21;
|
|
|
3408 |
// s21 += carry20;
|
|
|
3409 |
// s20 -= carry20 * ((uint64_t) 1L << 21);
|
|
|
3410 |
$carry20 = ($s20 + (1 << 20)) >> 21;
|
|
|
3411 |
$s21 += $carry20;
|
|
|
3412 |
$s20 -= $carry20 << 21;
|
|
|
3413 |
// carry22 = (s22 + (int64_t) (1L << 20)) >> 21;
|
|
|
3414 |
// s23 += carry22;
|
|
|
3415 |
// s22 -= carry22 * ((uint64_t) 1L << 21);
|
|
|
3416 |
$carry22 = ($s22 + (1 << 20)) >> 21;
|
|
|
3417 |
$s23 += $carry22;
|
|
|
3418 |
$s22 -= $carry22 << 21;
|
|
|
3419 |
|
|
|
3420 |
// carry1 = (s1 + (int64_t) (1L << 20)) >> 21;
|
|
|
3421 |
// s2 += carry1;
|
|
|
3422 |
// s1 -= carry1 * ((uint64_t) 1L << 21);
|
|
|
3423 |
$carry1 = ($s1 + (1 << 20)) >> 21;
|
|
|
3424 |
$s2 += $carry1;
|
|
|
3425 |
$s1 -= $carry1 << 21;
|
|
|
3426 |
// carry3 = (s3 + (int64_t) (1L << 20)) >> 21;
|
|
|
3427 |
// s4 += carry3;
|
|
|
3428 |
// s3 -= carry3 * ((uint64_t) 1L << 21);
|
|
|
3429 |
$carry3 = ($s3 + (1 << 20)) >> 21;
|
|
|
3430 |
$s4 += $carry3;
|
|
|
3431 |
$s3 -= $carry3 << 21;
|
|
|
3432 |
// carry5 = (s5 + (int64_t) (1L << 20)) >> 21;
|
|
|
3433 |
// s6 += carry5;
|
|
|
3434 |
// s5 -= carry5 * ((uint64_t) 1L << 21);
|
|
|
3435 |
$carry5 = ($s5 + (1 << 20)) >> 21;
|
|
|
3436 |
$s6 += $carry5;
|
|
|
3437 |
$s5 -= $carry5 << 21;
|
|
|
3438 |
// carry7 = (s7 + (int64_t) (1L << 20)) >> 21;
|
|
|
3439 |
// s8 += carry7;
|
|
|
3440 |
// s7 -= carry7 * ((uint64_t) 1L << 21);
|
|
|
3441 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
3442 |
$s8 += $carry7;
|
|
|
3443 |
$s7 -= $carry7 << 21;
|
|
|
3444 |
// carry9 = (s9 + (int64_t) (1L << 20)) >> 21;
|
|
|
3445 |
// s10 += carry9;
|
|
|
3446 |
// s9 -= carry9 * ((uint64_t) 1L << 21);
|
|
|
3447 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
3448 |
$s10 += $carry9;
|
|
|
3449 |
$s9 -= $carry9 << 21;
|
|
|
3450 |
// carry11 = (s11 + (int64_t) (1L << 20)) >> 21;
|
|
|
3451 |
// s12 += carry11;
|
|
|
3452 |
// s11 -= carry11 * ((uint64_t) 1L << 21);
|
|
|
3453 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
3454 |
$s12 += $carry11;
|
|
|
3455 |
$s11 -= $carry11 << 21;
|
|
|
3456 |
// carry13 = (s13 + (int64_t) (1L << 20)) >> 21;
|
|
|
3457 |
// s14 += carry13;
|
|
|
3458 |
// s13 -= carry13 * ((uint64_t) 1L << 21);
|
|
|
3459 |
$carry13 = ($s13 + (1 << 20)) >> 21;
|
|
|
3460 |
$s14 += $carry13;
|
|
|
3461 |
$s13 -= $carry13 << 21;
|
|
|
3462 |
// carry15 = (s15 + (int64_t) (1L << 20)) >> 21;
|
|
|
3463 |
// s16 += carry15;
|
|
|
3464 |
// s15 -= carry15 * ((uint64_t) 1L << 21);
|
|
|
3465 |
$carry15 = ($s15 + (1 << 20)) >> 21;
|
|
|
3466 |
$s16 += $carry15;
|
|
|
3467 |
$s15 -= $carry15 << 21;
|
|
|
3468 |
// carry17 = (s17 + (int64_t) (1L << 20)) >> 21;
|
|
|
3469 |
// s18 += carry17;
|
|
|
3470 |
// s17 -= carry17 * ((uint64_t) 1L << 21);
|
|
|
3471 |
$carry17 = ($s17 + (1 << 20)) >> 21;
|
|
|
3472 |
$s18 += $carry17;
|
|
|
3473 |
$s17 -= $carry17 << 21;
|
|
|
3474 |
// carry19 = (s19 + (int64_t) (1L << 20)) >> 21;
|
|
|
3475 |
// s20 += carry19;
|
|
|
3476 |
// s19 -= carry19 * ((uint64_t) 1L << 21);
|
|
|
3477 |
$carry19 = ($s19 + (1 << 20)) >> 21;
|
|
|
3478 |
$s20 += $carry19;
|
|
|
3479 |
$s19 -= $carry19 << 21;
|
|
|
3480 |
// carry21 = (s21 + (int64_t) (1L << 20)) >> 21;
|
|
|
3481 |
// s22 += carry21;
|
|
|
3482 |
// s21 -= carry21 * ((uint64_t) 1L << 21);
|
|
|
3483 |
$carry21 = ($s21 + (1 << 20)) >> 21;
|
|
|
3484 |
$s22 += $carry21;
|
|
|
3485 |
$s21 -= $carry21 << 21;
|
|
|
3486 |
|
|
|
3487 |
// s11 += s23 * 666643;
|
|
|
3488 |
// s12 += s23 * 470296;
|
|
|
3489 |
// s13 += s23 * 654183;
|
|
|
3490 |
// s14 -= s23 * 997805;
|
|
|
3491 |
// s15 += s23 * 136657;
|
|
|
3492 |
// s16 -= s23 * 683901;
|
|
|
3493 |
$s11 += self::mul($s23, 666643, 20);
|
|
|
3494 |
$s12 += self::mul($s23, 470296, 19);
|
|
|
3495 |
$s13 += self::mul($s23, 654183, 20);
|
|
|
3496 |
$s14 -= self::mul($s23, 997805, 20);
|
|
|
3497 |
$s15 += self::mul($s23, 136657, 18);
|
|
|
3498 |
$s16 -= self::mul($s23, 683901, 20);
|
|
|
3499 |
|
|
|
3500 |
// s10 += s22 * 666643;
|
|
|
3501 |
// s11 += s22 * 470296;
|
|
|
3502 |
// s12 += s22 * 654183;
|
|
|
3503 |
// s13 -= s22 * 997805;
|
|
|
3504 |
// s14 += s22 * 136657;
|
|
|
3505 |
// s15 -= s22 * 683901;
|
|
|
3506 |
$s10 += self::mul($s22, 666643, 20);
|
|
|
3507 |
$s11 += self::mul($s22, 470296, 19);
|
|
|
3508 |
$s12 += self::mul($s22, 654183, 20);
|
|
|
3509 |
$s13 -= self::mul($s22, 997805, 20);
|
|
|
3510 |
$s14 += self::mul($s22, 136657, 18);
|
|
|
3511 |
$s15 -= self::mul($s22, 683901, 20);
|
|
|
3512 |
|
|
|
3513 |
// s9 += s21 * 666643;
|
|
|
3514 |
// s10 += s21 * 470296;
|
|
|
3515 |
// s11 += s21 * 654183;
|
|
|
3516 |
// s12 -= s21 * 997805;
|
|
|
3517 |
// s13 += s21 * 136657;
|
|
|
3518 |
// s14 -= s21 * 683901;
|
|
|
3519 |
$s9 += self::mul($s21, 666643, 20);
|
|
|
3520 |
$s10 += self::mul($s21, 470296, 19);
|
|
|
3521 |
$s11 += self::mul($s21, 654183, 20);
|
|
|
3522 |
$s12 -= self::mul($s21, 997805, 20);
|
|
|
3523 |
$s13 += self::mul($s21, 136657, 18);
|
|
|
3524 |
$s14 -= self::mul($s21, 683901, 20);
|
|
|
3525 |
|
|
|
3526 |
// s8 += s20 * 666643;
|
|
|
3527 |
// s9 += s20 * 470296;
|
|
|
3528 |
// s10 += s20 * 654183;
|
|
|
3529 |
// s11 -= s20 * 997805;
|
|
|
3530 |
// s12 += s20 * 136657;
|
|
|
3531 |
// s13 -= s20 * 683901;
|
|
|
3532 |
$s8 += self::mul($s20, 666643, 20);
|
|
|
3533 |
$s9 += self::mul($s20, 470296, 19);
|
|
|
3534 |
$s10 += self::mul($s20, 654183, 20);
|
|
|
3535 |
$s11 -= self::mul($s20, 997805, 20);
|
|
|
3536 |
$s12 += self::mul($s20, 136657, 18);
|
|
|
3537 |
$s13 -= self::mul($s20, 683901, 20);
|
|
|
3538 |
|
|
|
3539 |
// s7 += s19 * 666643;
|
|
|
3540 |
// s8 += s19 * 470296;
|
|
|
3541 |
// s9 += s19 * 654183;
|
|
|
3542 |
// s10 -= s19 * 997805;
|
|
|
3543 |
// s11 += s19 * 136657;
|
|
|
3544 |
// s12 -= s19 * 683901;
|
|
|
3545 |
$s7 += self::mul($s19, 666643, 20);
|
|
|
3546 |
$s8 += self::mul($s19, 470296, 19);
|
|
|
3547 |
$s9 += self::mul($s19, 654183, 20);
|
|
|
3548 |
$s10 -= self::mul($s19, 997805, 20);
|
|
|
3549 |
$s11 += self::mul($s19, 136657, 18);
|
|
|
3550 |
$s12 -= self::mul($s19, 683901, 20);
|
|
|
3551 |
|
|
|
3552 |
// s6 += s18 * 666643;
|
|
|
3553 |
// s7 += s18 * 470296;
|
|
|
3554 |
// s8 += s18 * 654183;
|
|
|
3555 |
// s9 -= s18 * 997805;
|
|
|
3556 |
// s10 += s18 * 136657;
|
|
|
3557 |
// s11 -= s18 * 683901;
|
|
|
3558 |
$s6 += self::mul($s18, 666643, 20);
|
|
|
3559 |
$s7 += self::mul($s18, 470296, 19);
|
|
|
3560 |
$s8 += self::mul($s18, 654183, 20);
|
|
|
3561 |
$s9 -= self::mul($s18, 997805, 20);
|
|
|
3562 |
$s10 += self::mul($s18, 136657, 18);
|
|
|
3563 |
$s11 -= self::mul($s18, 683901, 20);
|
|
|
3564 |
|
|
|
3565 |
// carry6 = (s6 + (int64_t) (1L << 20)) >> 21;
|
|
|
3566 |
// s7 += carry6;
|
|
|
3567 |
// s6 -= carry6 * ((uint64_t) 1L << 21);
|
|
|
3568 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
3569 |
$s7 += $carry6;
|
|
|
3570 |
$s6 -= $carry6 << 21;
|
|
|
3571 |
// carry8 = (s8 + (int64_t) (1L << 20)) >> 21;
|
|
|
3572 |
// s9 += carry8;
|
|
|
3573 |
// s8 -= carry8 * ((uint64_t) 1L << 21);
|
|
|
3574 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
3575 |
$s9 += $carry8;
|
|
|
3576 |
$s8 -= $carry8 << 21;
|
|
|
3577 |
// carry10 = (s10 + (int64_t) (1L << 20)) >> 21;
|
|
|
3578 |
// s11 += carry10;
|
|
|
3579 |
// s10 -= carry10 * ((uint64_t) 1L << 21);
|
|
|
3580 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
3581 |
$s11 += $carry10;
|
|
|
3582 |
$s10 -= $carry10 << 21;
|
|
|
3583 |
// carry12 = (s12 + (int64_t) (1L << 20)) >> 21;
|
|
|
3584 |
// s13 += carry12;
|
|
|
3585 |
// s12 -= carry12 * ((uint64_t) 1L << 21);
|
|
|
3586 |
$carry12 = ($s12 + (1 << 20)) >> 21;
|
|
|
3587 |
$s13 += $carry12;
|
|
|
3588 |
$s12 -= $carry12 << 21;
|
|
|
3589 |
// carry14 = (s14 + (int64_t) (1L << 20)) >> 21;
|
|
|
3590 |
// s15 += carry14;
|
|
|
3591 |
// s14 -= carry14 * ((uint64_t) 1L << 21);
|
|
|
3592 |
$carry14 = ($s14 + (1 << 20)) >> 21;
|
|
|
3593 |
$s15 += $carry14;
|
|
|
3594 |
$s14 -= $carry14 << 21;
|
|
|
3595 |
// carry16 = (s16 + (int64_t) (1L << 20)) >> 21;
|
|
|
3596 |
// s17 += carry16;
|
|
|
3597 |
// s16 -= carry16 * ((uint64_t) 1L << 21);
|
|
|
3598 |
$carry16 = ($s16 + (1 << 20)) >> 21;
|
|
|
3599 |
$s17 += $carry16;
|
|
|
3600 |
$s16 -= $carry16 << 21;
|
|
|
3601 |
|
|
|
3602 |
// carry7 = (s7 + (int64_t) (1L << 20)) >> 21;
|
|
|
3603 |
// s8 += carry7;
|
|
|
3604 |
// s7 -= carry7 * ((uint64_t) 1L << 21);
|
|
|
3605 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
3606 |
$s8 += $carry7;
|
|
|
3607 |
$s7 -= $carry7 << 21;
|
|
|
3608 |
// carry9 = (s9 + (int64_t) (1L << 20)) >> 21;
|
|
|
3609 |
// s10 += carry9;
|
|
|
3610 |
// s9 -= carry9 * ((uint64_t) 1L << 21);
|
|
|
3611 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
3612 |
$s10 += $carry9;
|
|
|
3613 |
$s9 -= $carry9 << 21;
|
|
|
3614 |
// carry11 = (s11 + (int64_t) (1L << 20)) >> 21;
|
|
|
3615 |
// s12 += carry11;
|
|
|
3616 |
// s11 -= carry11 * ((uint64_t) 1L << 21);
|
|
|
3617 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
3618 |
$s12 += $carry11;
|
|
|
3619 |
$s11 -= $carry11 << 21;
|
|
|
3620 |
// carry13 = (s13 + (int64_t) (1L << 20)) >> 21;
|
|
|
3621 |
// s14 += carry13;
|
|
|
3622 |
// s13 -= carry13 * ((uint64_t) 1L << 21);
|
|
|
3623 |
$carry13 = ($s13 + (1 << 20)) >> 21;
|
|
|
3624 |
$s14 += $carry13;
|
|
|
3625 |
$s13 -= $carry13 << 21;
|
|
|
3626 |
// carry15 = (s15 + (int64_t) (1L << 20)) >> 21;
|
|
|
3627 |
// s16 += carry15;
|
|
|
3628 |
// s15 -= carry15 * ((uint64_t) 1L << 21);
|
|
|
3629 |
$carry15 = ($s15 + (1 << 20)) >> 21;
|
|
|
3630 |
$s16 += $carry15;
|
|
|
3631 |
$s15 -= $carry15 << 21;
|
|
|
3632 |
|
|
|
3633 |
// s5 += s17 * 666643;
|
|
|
3634 |
// s6 += s17 * 470296;
|
|
|
3635 |
// s7 += s17 * 654183;
|
|
|
3636 |
// s8 -= s17 * 997805;
|
|
|
3637 |
// s9 += s17 * 136657;
|
|
|
3638 |
// s10 -= s17 * 683901;
|
|
|
3639 |
$s5 += self::mul($s17, 666643, 20);
|
|
|
3640 |
$s6 += self::mul($s17, 470296, 19);
|
|
|
3641 |
$s7 += self::mul($s17, 654183, 20);
|
|
|
3642 |
$s8 -= self::mul($s17, 997805, 20);
|
|
|
3643 |
$s9 += self::mul($s17, 136657, 18);
|
|
|
3644 |
$s10 -= self::mul($s17, 683901, 20);
|
|
|
3645 |
|
|
|
3646 |
// s4 += s16 * 666643;
|
|
|
3647 |
// s5 += s16 * 470296;
|
|
|
3648 |
// s6 += s16 * 654183;
|
|
|
3649 |
// s7 -= s16 * 997805;
|
|
|
3650 |
// s8 += s16 * 136657;
|
|
|
3651 |
// s9 -= s16 * 683901;
|
|
|
3652 |
$s4 += self::mul($s16, 666643, 20);
|
|
|
3653 |
$s5 += self::mul($s16, 470296, 19);
|
|
|
3654 |
$s6 += self::mul($s16, 654183, 20);
|
|
|
3655 |
$s7 -= self::mul($s16, 997805, 20);
|
|
|
3656 |
$s8 += self::mul($s16, 136657, 18);
|
|
|
3657 |
$s9 -= self::mul($s16, 683901, 20);
|
|
|
3658 |
|
|
|
3659 |
// s3 += s15 * 666643;
|
|
|
3660 |
// s4 += s15 * 470296;
|
|
|
3661 |
// s5 += s15 * 654183;
|
|
|
3662 |
// s6 -= s15 * 997805;
|
|
|
3663 |
// s7 += s15 * 136657;
|
|
|
3664 |
// s8 -= s15 * 683901;
|
|
|
3665 |
$s3 += self::mul($s15, 666643, 20);
|
|
|
3666 |
$s4 += self::mul($s15, 470296, 19);
|
|
|
3667 |
$s5 += self::mul($s15, 654183, 20);
|
|
|
3668 |
$s6 -= self::mul($s15, 997805, 20);
|
|
|
3669 |
$s7 += self::mul($s15, 136657, 18);
|
|
|
3670 |
$s8 -= self::mul($s15, 683901, 20);
|
|
|
3671 |
|
|
|
3672 |
// s2 += s14 * 666643;
|
|
|
3673 |
// s3 += s14 * 470296;
|
|
|
3674 |
// s4 += s14 * 654183;
|
|
|
3675 |
// s5 -= s14 * 997805;
|
|
|
3676 |
// s6 += s14 * 136657;
|
|
|
3677 |
// s7 -= s14 * 683901;
|
|
|
3678 |
$s2 += self::mul($s14, 666643, 20);
|
|
|
3679 |
$s3 += self::mul($s14, 470296, 19);
|
|
|
3680 |
$s4 += self::mul($s14, 654183, 20);
|
|
|
3681 |
$s5 -= self::mul($s14, 997805, 20);
|
|
|
3682 |
$s6 += self::mul($s14, 136657, 18);
|
|
|
3683 |
$s7 -= self::mul($s14, 683901, 20);
|
|
|
3684 |
|
|
|
3685 |
// s1 += s13 * 666643;
|
|
|
3686 |
// s2 += s13 * 470296;
|
|
|
3687 |
// s3 += s13 * 654183;
|
|
|
3688 |
// s4 -= s13 * 997805;
|
|
|
3689 |
// s5 += s13 * 136657;
|
|
|
3690 |
// s6 -= s13 * 683901;
|
|
|
3691 |
$s1 += self::mul($s13, 666643, 20);
|
|
|
3692 |
$s2 += self::mul($s13, 470296, 19);
|
|
|
3693 |
$s3 += self::mul($s13, 654183, 20);
|
|
|
3694 |
$s4 -= self::mul($s13, 997805, 20);
|
|
|
3695 |
$s5 += self::mul($s13, 136657, 18);
|
|
|
3696 |
$s6 -= self::mul($s13, 683901, 20);
|
|
|
3697 |
|
|
|
3698 |
// s0 += s12 * 666643;
|
|
|
3699 |
// s1 += s12 * 470296;
|
|
|
3700 |
// s2 += s12 * 654183;
|
|
|
3701 |
// s3 -= s12 * 997805;
|
|
|
3702 |
// s4 += s12 * 136657;
|
|
|
3703 |
// s5 -= s12 * 683901;
|
|
|
3704 |
// s12 = 0;
|
|
|
3705 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
3706 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
3707 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
3708 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
3709 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
3710 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
3711 |
$s12 = 0;
|
|
|
3712 |
|
|
|
3713 |
// carry0 = (s0 + (int64_t) (1L << 20)) >> 21;
|
|
|
3714 |
// s1 += carry0;
|
|
|
3715 |
// s0 -= carry0 * ((uint64_t) 1L << 21);
|
|
|
3716 |
$carry0 = ($s0 + (1 << 20)) >> 21;
|
|
|
3717 |
$s1 += $carry0;
|
|
|
3718 |
$s0 -= $carry0 << 21;
|
|
|
3719 |
// carry2 = (s2 + (int64_t) (1L << 20)) >> 21;
|
|
|
3720 |
// s3 += carry2;
|
|
|
3721 |
// s2 -= carry2 * ((uint64_t) 1L << 21);
|
|
|
3722 |
$carry2 = ($s2 + (1 << 20)) >> 21;
|
|
|
3723 |
$s3 += $carry2;
|
|
|
3724 |
$s2 -= $carry2 << 21;
|
|
|
3725 |
// carry4 = (s4 + (int64_t) (1L << 20)) >> 21;
|
|
|
3726 |
// s5 += carry4;
|
|
|
3727 |
// s4 -= carry4 * ((uint64_t) 1L << 21);
|
|
|
3728 |
$carry4 = ($s4 + (1 << 20)) >> 21;
|
|
|
3729 |
$s5 += $carry4;
|
|
|
3730 |
$s4 -= $carry4 << 21;
|
|
|
3731 |
// carry6 = (s6 + (int64_t) (1L << 20)) >> 21;
|
|
|
3732 |
// s7 += carry6;
|
|
|
3733 |
// s6 -= carry6 * ((uint64_t) 1L << 21);
|
|
|
3734 |
$carry6 = ($s6 + (1 << 20)) >> 21;
|
|
|
3735 |
$s7 += $carry6;
|
|
|
3736 |
$s6 -= $carry6 << 21;
|
|
|
3737 |
// carry8 = (s8 + (int64_t) (1L << 20)) >> 21;
|
|
|
3738 |
// s9 += carry8;
|
|
|
3739 |
// s8 -= carry8 * ((uint64_t) 1L << 21);
|
|
|
3740 |
$carry8 = ($s8 + (1 << 20)) >> 21;
|
|
|
3741 |
$s9 += $carry8;
|
|
|
3742 |
$s8 -= $carry8 << 21;
|
|
|
3743 |
// carry10 = (s10 + (int64_t) (1L << 20)) >> 21;
|
|
|
3744 |
// s11 += carry10;
|
|
|
3745 |
// s10 -= carry10 * ((uint64_t) 1L << 21);
|
|
|
3746 |
$carry10 = ($s10 + (1 << 20)) >> 21;
|
|
|
3747 |
$s11 += $carry10;
|
|
|
3748 |
$s10 -= $carry10 << 21;
|
|
|
3749 |
|
|
|
3750 |
// carry1 = (s1 + (int64_t) (1L << 20)) >> 21;
|
|
|
3751 |
// s2 += carry1;
|
|
|
3752 |
// s1 -= carry1 * ((uint64_t) 1L << 21);
|
|
|
3753 |
$carry1 = ($s1 + (1 << 20)) >> 21;
|
|
|
3754 |
$s2 += $carry1;
|
|
|
3755 |
$s1 -= $carry1 << 21;
|
|
|
3756 |
// carry3 = (s3 + (int64_t) (1L << 20)) >> 21;
|
|
|
3757 |
// s4 += carry3;
|
|
|
3758 |
// s3 -= carry3 * ((uint64_t) 1L << 21);
|
|
|
3759 |
$carry3 = ($s3 + (1 << 20)) >> 21;
|
|
|
3760 |
$s4 += $carry3;
|
|
|
3761 |
$s3 -= $carry3 << 21;
|
|
|
3762 |
// carry5 = (s5 + (int64_t) (1L << 20)) >> 21;
|
|
|
3763 |
// s6 += carry5;
|
|
|
3764 |
// s5 -= carry5 * ((uint64_t) 1L << 21);
|
|
|
3765 |
$carry5 = ($s5 + (1 << 20)) >> 21;
|
|
|
3766 |
$s6 += $carry5;
|
|
|
3767 |
$s5 -= $carry5 << 21;
|
|
|
3768 |
// carry7 = (s7 + (int64_t) (1L << 20)) >> 21;
|
|
|
3769 |
// s8 += carry7;
|
|
|
3770 |
// s7 -= carry7 * ((uint64_t) 1L << 21);
|
|
|
3771 |
$carry7 = ($s7 + (1 << 20)) >> 21;
|
|
|
3772 |
$s8 += $carry7;
|
|
|
3773 |
$s7 -= $carry7 << 21;
|
|
|
3774 |
// carry9 = (s9 + (int64_t) (1L << 20)) >> 21;
|
|
|
3775 |
// s10 += carry9;
|
|
|
3776 |
// s9 -= carry9 * ((uint64_t) 1L << 21);
|
|
|
3777 |
$carry9 = ($s9 + (1 << 20)) >> 21;
|
|
|
3778 |
$s10 += $carry9;
|
|
|
3779 |
$s9 -= $carry9 << 21;
|
|
|
3780 |
// carry11 = (s11 + (int64_t) (1L << 20)) >> 21;
|
|
|
3781 |
// s12 += carry11;
|
|
|
3782 |
// s11 -= carry11 * ((uint64_t) 1L << 21);
|
|
|
3783 |
$carry11 = ($s11 + (1 << 20)) >> 21;
|
|
|
3784 |
$s12 += $carry11;
|
|
|
3785 |
$s11 -= $carry11 << 21;
|
|
|
3786 |
|
|
|
3787 |
// s0 += s12 * 666643;
|
|
|
3788 |
// s1 += s12 * 470296;
|
|
|
3789 |
// s2 += s12 * 654183;
|
|
|
3790 |
// s3 -= s12 * 997805;
|
|
|
3791 |
// s4 += s12 * 136657;
|
|
|
3792 |
// s5 -= s12 * 683901;
|
|
|
3793 |
// s12 = 0;
|
|
|
3794 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
3795 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
3796 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
3797 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
3798 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
3799 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
3800 |
$s12 = 0;
|
|
|
3801 |
|
|
|
3802 |
// carry0 = s0 >> 21;
|
|
|
3803 |
// s1 += carry0;
|
|
|
3804 |
// s0 -= carry0 * ((uint64_t) 1L << 21);
|
|
|
3805 |
$carry0 = $s0 >> 21;
|
|
|
3806 |
$s1 += $carry0;
|
|
|
3807 |
$s0 -= $carry0 << 21;
|
|
|
3808 |
// carry1 = s1 >> 21;
|
|
|
3809 |
// s2 += carry1;
|
|
|
3810 |
// s1 -= carry1 * ((uint64_t) 1L << 21);
|
|
|
3811 |
$carry1 = $s1 >> 21;
|
|
|
3812 |
$s2 += $carry1;
|
|
|
3813 |
$s1 -= $carry1 << 21;
|
|
|
3814 |
// carry2 = s2 >> 21;
|
|
|
3815 |
// s3 += carry2;
|
|
|
3816 |
// s2 -= carry2 * ((uint64_t) 1L << 21);
|
|
|
3817 |
$carry2 = $s2 >> 21;
|
|
|
3818 |
$s3 += $carry2;
|
|
|
3819 |
$s2 -= $carry2 << 21;
|
|
|
3820 |
// carry3 = s3 >> 21;
|
|
|
3821 |
// s4 += carry3;
|
|
|
3822 |
// s3 -= carry3 * ((uint64_t) 1L << 21);
|
|
|
3823 |
$carry3 = $s3 >> 21;
|
|
|
3824 |
$s4 += $carry3;
|
|
|
3825 |
$s3 -= $carry3 << 21;
|
|
|
3826 |
// carry4 = s4 >> 21;
|
|
|
3827 |
// s5 += carry4;
|
|
|
3828 |
// s4 -= carry4 * ((uint64_t) 1L << 21);
|
|
|
3829 |
$carry4 = $s4 >> 21;
|
|
|
3830 |
$s5 += $carry4;
|
|
|
3831 |
$s4 -= $carry4 << 21;
|
|
|
3832 |
// carry5 = s5 >> 21;
|
|
|
3833 |
// s6 += carry5;
|
|
|
3834 |
// s5 -= carry5 * ((uint64_t) 1L << 21);
|
|
|
3835 |
$carry5 = $s5 >> 21;
|
|
|
3836 |
$s6 += $carry5;
|
|
|
3837 |
$s5 -= $carry5 << 21;
|
|
|
3838 |
// carry6 = s6 >> 21;
|
|
|
3839 |
// s7 += carry6;
|
|
|
3840 |
// s6 -= carry6 * ((uint64_t) 1L << 21);
|
|
|
3841 |
$carry6 = $s6 >> 21;
|
|
|
3842 |
$s7 += $carry6;
|
|
|
3843 |
$s6 -= $carry6 << 21;
|
|
|
3844 |
// carry7 = s7 >> 21;
|
|
|
3845 |
// s8 += carry7;
|
|
|
3846 |
// s7 -= carry7 * ((uint64_t) 1L << 21);
|
|
|
3847 |
$carry7 = $s7 >> 21;
|
|
|
3848 |
$s8 += $carry7;
|
|
|
3849 |
$s7 -= $carry7 << 21;
|
|
|
3850 |
// carry8 = s8 >> 21;
|
|
|
3851 |
// s9 += carry8;
|
|
|
3852 |
// s8 -= carry8 * ((uint64_t) 1L << 21);
|
|
|
3853 |
$carry8 = $s8 >> 21;
|
|
|
3854 |
$s9 += $carry8;
|
|
|
3855 |
$s8 -= $carry8 << 21;
|
|
|
3856 |
// carry9 = s9 >> 21;
|
|
|
3857 |
// s10 += carry9;
|
|
|
3858 |
// s9 -= carry9 * ((uint64_t) 1L << 21);
|
|
|
3859 |
$carry9 = $s9 >> 21;
|
|
|
3860 |
$s10 += $carry9;
|
|
|
3861 |
$s9 -= $carry9 << 21;
|
|
|
3862 |
// carry10 = s10 >> 21;
|
|
|
3863 |
// s11 += carry10;
|
|
|
3864 |
// s10 -= carry10 * ((uint64_t) 1L << 21);
|
|
|
3865 |
$carry10 = $s10 >> 21;
|
|
|
3866 |
$s11 += $carry10;
|
|
|
3867 |
$s10 -= $carry10 << 21;
|
|
|
3868 |
// carry11 = s11 >> 21;
|
|
|
3869 |
// s12 += carry11;
|
|
|
3870 |
// s11 -= carry11 * ((uint64_t) 1L << 21);
|
|
|
3871 |
$carry11 = $s11 >> 21;
|
|
|
3872 |
$s12 += $carry11;
|
|
|
3873 |
$s11 -= $carry11 << 21;
|
|
|
3874 |
|
|
|
3875 |
// s0 += s12 * 666643;
|
|
|
3876 |
// s1 += s12 * 470296;
|
|
|
3877 |
// s2 += s12 * 654183;
|
|
|
3878 |
// s3 -= s12 * 997805;
|
|
|
3879 |
// s4 += s12 * 136657;
|
|
|
3880 |
// s5 -= s12 * 683901;
|
|
|
3881 |
$s0 += self::mul($s12, 666643, 20);
|
|
|
3882 |
$s1 += self::mul($s12, 470296, 19);
|
|
|
3883 |
$s2 += self::mul($s12, 654183, 20);
|
|
|
3884 |
$s3 -= self::mul($s12, 997805, 20);
|
|
|
3885 |
$s4 += self::mul($s12, 136657, 18);
|
|
|
3886 |
$s5 -= self::mul($s12, 683901, 20);
|
|
|
3887 |
|
|
|
3888 |
// carry0 = s0 >> 21;
|
|
|
3889 |
// s1 += carry0;
|
|
|
3890 |
// s0 -= carry0 * ((uint64_t) 1L << 21);
|
|
|
3891 |
$carry0 = $s0 >> 21;
|
|
|
3892 |
$s1 += $carry0;
|
|
|
3893 |
$s0 -= $carry0 << 21;
|
|
|
3894 |
// carry1 = s1 >> 21;
|
|
|
3895 |
// s2 += carry1;
|
|
|
3896 |
// s1 -= carry1 * ((uint64_t) 1L << 21);
|
|
|
3897 |
$carry1 = $s1 >> 21;
|
|
|
3898 |
$s2 += $carry1;
|
|
|
3899 |
$s1 -= $carry1 << 21;
|
|
|
3900 |
// carry2 = s2 >> 21;
|
|
|
3901 |
// s3 += carry2;
|
|
|
3902 |
// s2 -= carry2 * ((uint64_t) 1L << 21);
|
|
|
3903 |
$carry2 = $s2 >> 21;
|
|
|
3904 |
$s3 += $carry2;
|
|
|
3905 |
$s2 -= $carry2 << 21;
|
|
|
3906 |
// carry3 = s3 >> 21;
|
|
|
3907 |
// s4 += carry3;
|
|
|
3908 |
// s3 -= carry3 * ((uint64_t) 1L << 21);
|
|
|
3909 |
$carry3 = $s3 >> 21;
|
|
|
3910 |
$s4 += $carry3;
|
|
|
3911 |
$s3 -= $carry3 << 21;
|
|
|
3912 |
// carry4 = s4 >> 21;
|
|
|
3913 |
// s5 += carry4;
|
|
|
3914 |
// s4 -= carry4 * ((uint64_t) 1L << 21);
|
|
|
3915 |
$carry4 = $s4 >> 21;
|
|
|
3916 |
$s5 += $carry4;
|
|
|
3917 |
$s4 -= $carry4 << 21;
|
|
|
3918 |
// carry5 = s5 >> 21;
|
|
|
3919 |
// s6 += carry5;
|
|
|
3920 |
// s5 -= carry5 * ((uint64_t) 1L << 21);
|
|
|
3921 |
$carry5 = $s5 >> 21;
|
|
|
3922 |
$s6 += $carry5;
|
|
|
3923 |
$s5 -= $carry5 << 21;
|
|
|
3924 |
// carry6 = s6 >> 21;
|
|
|
3925 |
// s7 += carry6;
|
|
|
3926 |
// s6 -= carry6 * ((uint64_t) 1L << 21);
|
|
|
3927 |
$carry6 = $s6 >> 21;
|
|
|
3928 |
$s7 += $carry6;
|
|
|
3929 |
$s6 -= $carry6 << 21;
|
|
|
3930 |
// carry7 = s7 >> 21;
|
|
|
3931 |
// s8 += carry7;
|
|
|
3932 |
// s7 -= carry7 * ((uint64_t) 1L << 21);
|
|
|
3933 |
$carry7 = $s7 >> 21;
|
|
|
3934 |
$s8 += $carry7;
|
|
|
3935 |
$s7 -= $carry7 << 21;
|
|
|
3936 |
// carry8 = s8 >> 21;
|
|
|
3937 |
// s9 += carry8;
|
|
|
3938 |
// s8 -= carry8 * ((uint64_t) 1L << 21);
|
|
|
3939 |
$carry8 = $s8 >> 21;
|
|
|
3940 |
$s9 += $carry8;
|
|
|
3941 |
$s8 -= $carry8 << 21;
|
|
|
3942 |
// carry9 = s9 >> 21;
|
|
|
3943 |
// s10 += carry9;
|
|
|
3944 |
// s9 -= carry9 * ((uint64_t) 1L << 21);
|
|
|
3945 |
$carry9 = $s9 >> 21;
|
|
|
3946 |
$s10 += $carry9;
|
|
|
3947 |
$s9 -= $carry9 << 21;
|
|
|
3948 |
// carry10 = s10 >> 21;
|
|
|
3949 |
// s11 += carry10;
|
|
|
3950 |
// s10 -= carry10 * ((uint64_t) 1L << 21);
|
|
|
3951 |
$carry10 = $s10 >> 21;
|
|
|
3952 |
$s11 += $carry10;
|
|
|
3953 |
$s10 -= $carry10 << 21;
|
|
|
3954 |
|
|
|
3955 |
$s = array_fill(0, 32, 0);
|
|
|
3956 |
// s[0] = s0 >> 0;
|
|
|
3957 |
$s[0] = $s0 >> 0;
|
|
|
3958 |
// s[1] = s0 >> 8;
|
|
|
3959 |
$s[1] = $s0 >> 8;
|
|
|
3960 |
// s[2] = (s0 >> 16) | (s1 * ((uint64_t) 1 << 5));
|
|
|
3961 |
$s[2] = ($s0 >> 16) | ($s1 << 5);
|
|
|
3962 |
// s[3] = s1 >> 3;
|
|
|
3963 |
$s[3] = $s1 >> 3;
|
|
|
3964 |
// s[4] = s1 >> 11;
|
|
|
3965 |
$s[4] = $s1 >> 11;
|
|
|
3966 |
// s[5] = (s1 >> 19) | (s2 * ((uint64_t) 1 << 2));
|
|
|
3967 |
$s[5] = ($s1 >> 19) | ($s2 << 2);
|
|
|
3968 |
// s[6] = s2 >> 6;
|
|
|
3969 |
$s[6] = $s2 >> 6;
|
|
|
3970 |
// s[7] = (s2 >> 14) | (s3 * ((uint64_t) 1 << 7));
|
|
|
3971 |
$s[7] = ($s2 >> 14) | ($s3 << 7);
|
|
|
3972 |
// s[8] = s3 >> 1;
|
|
|
3973 |
$s[8] = $s3 >> 1;
|
|
|
3974 |
// s[9] = s3 >> 9;
|
|
|
3975 |
$s[9] = $s3 >> 9;
|
|
|
3976 |
// s[10] = (s3 >> 17) | (s4 * ((uint64_t) 1 << 4));
|
|
|
3977 |
$s[10] = ($s3 >> 17) | ($s4 << 4);
|
|
|
3978 |
// s[11] = s4 >> 4;
|
|
|
3979 |
$s[11] = $s4 >> 4;
|
|
|
3980 |
// s[12] = s4 >> 12;
|
|
|
3981 |
$s[12] = $s4 >> 12;
|
|
|
3982 |
// s[13] = (s4 >> 20) | (s5 * ((uint64_t) 1 << 1));
|
|
|
3983 |
$s[13] = ($s4 >> 20) | ($s5 << 1);
|
|
|
3984 |
// s[14] = s5 >> 7;
|
|
|
3985 |
$s[14] = $s5 >> 7;
|
|
|
3986 |
// s[15] = (s5 >> 15) | (s6 * ((uint64_t) 1 << 6));
|
|
|
3987 |
$s[15] = ($s5 >> 15) | ($s6 << 6);
|
|
|
3988 |
// s[16] = s6 >> 2;
|
|
|
3989 |
$s[16] = $s6 >> 2;
|
|
|
3990 |
// s[17] = s6 >> 10;
|
|
|
3991 |
$s[17] = $s6 >> 10;
|
|
|
3992 |
// s[18] = (s6 >> 18) | (s7 * ((uint64_t) 1 << 3));
|
|
|
3993 |
$s[18] = ($s6 >> 18) | ($s7 << 3);
|
|
|
3994 |
// s[19] = s7 >> 5;
|
|
|
3995 |
$s[19] = $s7 >> 5;
|
|
|
3996 |
// s[20] = s7 >> 13;
|
|
|
3997 |
$s[20] = $s7 >> 13;
|
|
|
3998 |
// s[21] = s8 >> 0;
|
|
|
3999 |
$s[21] = $s8 >> 0;
|
|
|
4000 |
// s[22] = s8 >> 8;
|
|
|
4001 |
$s[22] = $s8 >> 8;
|
|
|
4002 |
// s[23] = (s8 >> 16) | (s9 * ((uint64_t) 1 << 5));
|
|
|
4003 |
$s[23] = ($s8 >> 16) | ($s9 << 5);
|
|
|
4004 |
// s[24] = s9 >> 3;
|
|
|
4005 |
$s[24] = $s9 >> 3;
|
|
|
4006 |
// s[25] = s9 >> 11;
|
|
|
4007 |
$s[25] = $s9 >> 11;
|
|
|
4008 |
// s[26] = (s9 >> 19) | (s10 * ((uint64_t) 1 << 2));
|
|
|
4009 |
$s[26] = ($s9 >> 19) | ($s10 << 2);
|
|
|
4010 |
// s[27] = s10 >> 6;
|
|
|
4011 |
$s[27] = $s10 >> 6;
|
|
|
4012 |
// s[28] = (s10 >> 14) | (s11 * ((uint64_t) 1 << 7));
|
|
|
4013 |
$s[28] = ($s10 >> 14) | ($s11 << 7);
|
|
|
4014 |
// s[29] = s11 >> 1;
|
|
|
4015 |
$s[29] = $s11 >> 1;
|
|
|
4016 |
// s[30] = s11 >> 9;
|
|
|
4017 |
$s[30] = $s11 >> 9;
|
|
|
4018 |
// s[31] = s11 >> 17;
|
|
|
4019 |
$s[31] = $s11 >> 17;
|
|
|
4020 |
return self::intArrayToString($s);
|
|
|
4021 |
}
|
|
|
4022 |
|
|
|
4023 |
/**
|
|
|
4024 |
* @param string $s
|
|
|
4025 |
* @return string
|
|
|
4026 |
*/
|
|
|
4027 |
public static function sc25519_sq($s)
|
|
|
4028 |
{
|
|
|
4029 |
return self::sc25519_mul($s, $s);
|
|
|
4030 |
}
|
|
|
4031 |
|
|
|
4032 |
/**
|
|
|
4033 |
* @param string $s
|
|
|
4034 |
* @param int $n
|
|
|
4035 |
* @param string $a
|
|
|
4036 |
* @return string
|
|
|
4037 |
*/
|
|
|
4038 |
public static function sc25519_sqmul($s, $n, $a)
|
|
|
4039 |
{
|
|
|
4040 |
for ($i = 0; $i < $n; ++$i) {
|
|
|
4041 |
$s = self::sc25519_sq($s);
|
|
|
4042 |
}
|
|
|
4043 |
return self::sc25519_mul($s, $a);
|
|
|
4044 |
}
|
|
|
4045 |
|
|
|
4046 |
/**
|
|
|
4047 |
* @param string $s
|
|
|
4048 |
* @return string
|
|
|
4049 |
*/
|
|
|
4050 |
public static function sc25519_invert($s)
|
|
|
4051 |
{
|
|
|
4052 |
$_10 = self::sc25519_sq($s);
|
|
|
4053 |
$_11 = self::sc25519_mul($s, $_10);
|
|
|
4054 |
$_100 = self::sc25519_mul($s, $_11);
|
|
|
4055 |
$_1000 = self::sc25519_sq($_100);
|
|
|
4056 |
$_1010 = self::sc25519_mul($_10, $_1000);
|
|
|
4057 |
$_1011 = self::sc25519_mul($s, $_1010);
|
|
|
4058 |
$_10000 = self::sc25519_sq($_1000);
|
|
|
4059 |
$_10110 = self::sc25519_sq($_1011);
|
|
|
4060 |
$_100000 = self::sc25519_mul($_1010, $_10110);
|
|
|
4061 |
$_100110 = self::sc25519_mul($_10000, $_10110);
|
|
|
4062 |
$_1000000 = self::sc25519_sq($_100000);
|
|
|
4063 |
$_1010000 = self::sc25519_mul($_10000, $_1000000);
|
|
|
4064 |
$_1010011 = self::sc25519_mul($_11, $_1010000);
|
|
|
4065 |
$_1100011 = self::sc25519_mul($_10000, $_1010011);
|
|
|
4066 |
$_1100111 = self::sc25519_mul($_100, $_1100011);
|
|
|
4067 |
$_1101011 = self::sc25519_mul($_100, $_1100111);
|
|
|
4068 |
$_10010011 = self::sc25519_mul($_1000000, $_1010011);
|
|
|
4069 |
$_10010111 = self::sc25519_mul($_100, $_10010011);
|
|
|
4070 |
$_10111101 = self::sc25519_mul($_100110, $_10010111);
|
|
|
4071 |
$_11010011 = self::sc25519_mul($_10110, $_10111101);
|
|
|
4072 |
$_11100111 = self::sc25519_mul($_1010000, $_10010111);
|
|
|
4073 |
$_11101011 = self::sc25519_mul($_100, $_11100111);
|
|
|
4074 |
$_11110101 = self::sc25519_mul($_1010, $_11101011);
|
|
|
4075 |
|
|
|
4076 |
$recip = self::sc25519_mul($_1011, $_11110101);
|
|
|
4077 |
$recip = self::sc25519_sqmul($recip, 126, $_1010011);
|
|
|
4078 |
$recip = self::sc25519_sqmul($recip, 9, $_10);
|
|
|
4079 |
$recip = self::sc25519_mul($recip, $_11110101);
|
|
|
4080 |
$recip = self::sc25519_sqmul($recip, 7, $_1100111);
|
|
|
4081 |
$recip = self::sc25519_sqmul($recip, 9, $_11110101);
|
|
|
4082 |
$recip = self::sc25519_sqmul($recip, 11, $_10111101);
|
|
|
4083 |
$recip = self::sc25519_sqmul($recip, 8, $_11100111);
|
|
|
4084 |
$recip = self::sc25519_sqmul($recip, 9, $_1101011);
|
|
|
4085 |
$recip = self::sc25519_sqmul($recip, 6, $_1011);
|
|
|
4086 |
$recip = self::sc25519_sqmul($recip, 14, $_10010011);
|
|
|
4087 |
$recip = self::sc25519_sqmul($recip, 10, $_1100011);
|
|
|
4088 |
$recip = self::sc25519_sqmul($recip, 9, $_10010111);
|
|
|
4089 |
$recip = self::sc25519_sqmul($recip, 10, $_11110101);
|
|
|
4090 |
$recip = self::sc25519_sqmul($recip, 8, $_11010011);
|
|
|
4091 |
return self::sc25519_sqmul($recip, 8, $_11101011);
|
|
|
4092 |
}
|
|
|
4093 |
|
|
|
4094 |
/**
|
|
|
4095 |
* @param string $s
|
|
|
4096 |
* @return string
|
|
|
4097 |
*/
|
|
|
4098 |
public static function clamp($s)
|
|
|
4099 |
{
|
|
|
4100 |
$s_ = self::stringToIntArray($s);
|
|
|
4101 |
$s_[0] &= 248;
|
|
|
4102 |
$s_[31] |= 64;
|
|
|
4103 |
$s_[31] &= 128;
|
|
|
4104 |
return self::intArrayToString($s_);
|
|
|
4105 |
}
|
|
9
|
4106 |
}
|