<?php

if (class_exists('ParagonIE_Sodium_Core_Curve25519', false)) {

    return;

}

/**

 * Class ParagonIE_Sodium_Core_Curve25519

 *

 * Implements Curve25519 core functions

 *

 * Based on the ref10 curve25519 code provided by libsodium

 *

 * @ref https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c

 */

abstract class ParagonIE_Sodium_Core_Curve25519 extends ParagonIE_Sodium_Core_Curve25519_H

{

    /**

     * Get a field element of size 10 with a value of 0

     *

     * @internal You should not use this directly from another application

     *

     * @return ParagonIE_Sodium_Core_Curve25519_Fe

     */

    public static function fe_0()

    {

        return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(

            array(0, 0, 0, 0, 0, 0, 0, 0, 0, 0)

        );

    }

    /**

     * Get a field element of size 10 with a value of 1

     *

     * @internal You should not use this directly from another application

     *

     * @return ParagonIE_Sodium_Core_Curve25519_Fe

     */

    public static function fe_1()

    {

        return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(

            array(1, 0, 0, 0, 0, 0, 0, 0, 0, 0)

        );

    }

    /**

     * Add two field elements.

     *

     * @internal You should not use this directly from another application

     *

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $f

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $g

     * @return ParagonIE_Sodium_Core_Curve25519_Fe

     * @psalm-suppress MixedAssignment

     * @psalm-suppress MixedOperand

     */

    public static function fe_add(

        ParagonIE_Sodium_Core_Curve25519_Fe $f,

        ParagonIE_Sodium_Core_Curve25519_Fe $g

    ) {

        /** @var array<int, int> $arr */

        $arr = array();

        for ($i = 0; $i < 10; ++$i) {

            $arr[$i] = (int) ($f[$i] + $g[$i]);

        }

        return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($arr);

    }

    /**

     * Constant-time conditional move.

     *

     * @internal You should not use this directly from another application

     *

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $f

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $g

     * @param int $b

     * @return ParagonIE_Sodium_Core_Curve25519_Fe

     * @psalm-suppress MixedAssignment

     */

    public static function fe_cmov(

        ParagonIE_Sodium_Core_Curve25519_Fe $f,

        ParagonIE_Sodium_Core_Curve25519_Fe $g,

        $b = 0

    ) {

        /** @var array<int, int> $h */

        $h = array();

        $b *= -1;

        for ($i = 0; $i < 10; ++$i) {

            $x = (($f[$i] ^ $g[$i]) & $b);

            $h[$i] = ($f[$i]) ^ $x;

        }

        return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray($h);

    }

    /**

     * Create a copy of a field element.

     *

     * @internal You should not use this directly from another application

     *

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $f

     * @return ParagonIE_Sodium_Core_Curve25519_Fe

     */

    public static function fe_copy(ParagonIE_Sodium_Core_Curve25519_Fe $f)

    {

        $h = clone $f;

        return $h;

    }

    /**

     * Give: 32-byte string.

     * Receive: A field element object to use for internal calculations.

     *

     * @internal You should not use this directly from another application

     *

     * @param string $s

     * @return ParagonIE_Sodium_Core_Curve25519_Fe

     * @throws RangeException

     * @throws TypeError

     */

    public static function fe_frombytes($s)

    {

        if (self::strlen($s) !== 32) {

            throw new RangeException('Expected a 32-byte string.');

        }

        $h0 = self::load_4($s);

        $h1 = self::load_3(self::substr($s, 4, 3)) << 6;

        $h2 = self::load_3(self::substr($s, 7, 3)) << 5;

        $h3 = self::load_3(self::substr($s, 10, 3)) << 3;

        $h4 = self::load_3(self::substr($s, 13, 3)) << 2;

        $h5 = self::load_4(self::substr($s, 16, 4));

        $h6 = self::load_3(self::substr($s, 20, 3)) << 7;

        $h7 = self::load_3(self::substr($s, 23, 3)) << 5;

        $h8 = self::load_3(self::substr($s, 26, 3)) << 4;

        $h9 = (self::load_3(self::substr($s, 29, 3)) & 8388607) << 2;

        $carry9 = ($h9 + (1 << 24)) >> 25;

        $h0 += self::mul($carry9, 19, 5);

        $h9 -= $carry9 << 25;

        $carry1 = ($h1 + (1 << 24)) >> 25;

        $h2 += $carry1;

        $h1 -= $carry1 << 25;

        $carry3 = ($h3 + (1 << 24)) >> 25;

        $h4 += $carry3;

        $h3 -= $carry3 << 25;

        $carry5 = ($h5 + (1 << 24)) >> 25;

        $h6 += $carry5;

        $h5 -= $carry5 << 25;

        $carry7 = ($h7 + (1 << 24)) >> 25;

        $h8 += $carry7;

        $h7 -= $carry7 << 25;

        $carry0 = ($h0 + (1 << 25)) >> 26;

        $h1 += $carry0;

        $h0 -= $carry0 << 26;

        $carry2 = ($h2 + (1 << 25)) >> 26;

        $h3 += $carry2;

        $h2 -= $carry2 << 26;

        $carry4 = ($h4 + (1 << 25)) >> 26;

        $h5 += $carry4;

        $h4 -= $carry4 << 26;

        $carry6 = ($h6 + (1 << 25)) >> 26;

        $h7 += $carry6;

        $h6 -= $carry6 << 26;

        $carry8 = ($h8 + (1 << 25)) >> 26;

        $h9 += $carry8;

        $h8 -= $carry8 << 26;

        return ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(

            array(

                (int) $h0,

                (int) $h1,

                (int) $h2,

                (int) $h3,

                (int) $h4,

                (int) $h5,

                (int) $h6,

                (int) $h7,

                (int) $h8,

                (int) $h9

            )

        );

    }

    /**

     * Convert a field element to a byte string.

     *

     * @internal You should not use this directly from another application

     *

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $h

     * @return string

     */

    public static function fe_tobytes(ParagonIE_Sodium_Core_Curve25519_Fe $h)

    {

        $h0 = (int) $h[0];

        $h1 = (int) $h[1];

        $h2 = (int) $h[2];

        $h3 = (int) $h[3];

        $h4 = (int) $h[4];

        $h5 = (int) $h[5];

        $h6 = (int) $h[6];

        $h7 = (int) $h[7];

        $h8 = (int) $h[8];

        $h9 = (int) $h[9];

        $q = (self::mul($h9, 19, 5) + (1 << 24)) >> 25;

        $q = ($h0 + $q) >> 26;

        $q = ($h1 + $q) >> 25;

        $q = ($h2 + $q) >> 26;

        $q = ($h3 + $q) >> 25;

        $q = ($h4 + $q) >> 26;

        $q = ($h5 + $q) >> 25;

        $q = ($h6 + $q) >> 26;

        $q = ($h7 + $q) >> 25;

        $q = ($h8 + $q) >> 26;

        $q = ($h9 + $q) >> 25;

        $h0 += self::mul($q, 19, 5);

        $carry0 = $h0 >> 26;

        $h1 += $carry0;

        $h0 -= $carry0 << 26;

        $carry1 = $h1 >> 25;

        $h2 += $carry1;

        $h1 -= $carry1 << 25;

        $carry2 = $h2 >> 26;

        $h3 += $carry2;

        $h2 -= $carry2 << 26;

        $carry3 = $h3 >> 25;

        $h4 += $carry3;

        $h3 -= $carry3 << 25;

        $carry4 = $h4 >> 26;

        $h5 += $carry4;

        $h4 -= $carry4 << 26;

        $carry5 = $h5 >> 25;

        $h6 += $carry5;

        $h5 -= $carry5 << 25;

        $carry6 = $h6 >> 26;

        $h7 += $carry6;

        $h6 -= $carry6 << 26;

        $carry7 = $h7 >> 25;

        $h8 += $carry7;

        $h7 -= $carry7 << 25;

        $carry8 = $h8 >> 26;

        $h9 += $carry8;

        $h8 -= $carry8 << 26;

        $carry9 = $h9 >> 25;

        $h9 -= $carry9 << 25;

        /**

         * @var array<int, int>

         */

        $s = array(

            (int) (($h0 >> 0) & 0xff),

            (int) (($h0 >> 8) & 0xff),

            (int) (($h0 >> 16) & 0xff),

            (int) ((($h0 >> 24) | ($h1 << 2)) & 0xff),

            (int) (($h1 >> 6) & 0xff),

            (int) (($h1 >> 14) & 0xff),

            (int) ((($h1 >> 22) | ($h2 << 3)) & 0xff),

            (int) (($h2 >> 5) & 0xff),

            (int) (($h2 >> 13) & 0xff),

            (int) ((($h2 >> 21) | ($h3 << 5)) & 0xff),

            (int) (($h3 >> 3) & 0xff),

            (int) (($h3 >> 11) & 0xff),

            (int) ((($h3 >> 19) | ($h4 << 6)) & 0xff),

            (int) (($h4 >> 2) & 0xff),

            (int) (($h4 >> 10) & 0xff),

            (int) (($h4 >> 18) & 0xff),

            (int) (($h5 >> 0) & 0xff),

            (int) (($h5 >> 8) & 0xff),

            (int) (($h5 >> 16) & 0xff),

            (int) ((($h5 >> 24) | ($h6 << 1)) & 0xff),

            (int) (($h6 >> 7) & 0xff),

            (int) (($h6 >> 15) & 0xff),

            (int) ((($h6 >> 23) | ($h7 << 3)) & 0xff),

            (int) (($h7 >> 5) & 0xff),

            (int) (($h7 >> 13) & 0xff),

            (int) ((($h7 >> 21) | ($h8 << 4)) & 0xff),

            (int) (($h8 >> 4) & 0xff),

            (int) (($h8 >> 12) & 0xff),

            (int) ((($h8 >> 20) | ($h9 << 6)) & 0xff),

            (int) (($h9 >> 2) & 0xff),

            (int) (($h9 >> 10) & 0xff),

            (int) (($h9 >> 18) & 0xff)

        );

        return self::intArrayToString($s);

    }

    /**

     * Is a field element negative? (1 = yes, 0 = no. Used in calculations.)

     *

     * @internal You should not use this directly from another application

     *

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $f

     * @return int

     * @throws SodiumException

     * @throws TypeError

     */

    public static function fe_isnegative(ParagonIE_Sodium_Core_Curve25519_Fe $f)

    {

        $str = self::fe_tobytes($f);

        return (int) (self::chrToInt($str[0]) & 1);

    }

    /**

     * Returns 0 if this field element results in all NUL bytes.

     *

     * @internal You should not use this directly from another application

     *

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $f

     * @return bool

     * @throws SodiumException

     * @throws TypeError

     */

    public static function fe_isnonzero(ParagonIE_Sodium_Core_Curve25519_Fe $f)

    {

        static $zero;

        if ($zero === null) {

            $zero = str_repeat("\x00", 32);

        }

        /** @var string $zero */

        /** @var string $str */

        $str = self::fe_tobytes($f);

        return !self::verify_32($str, (string) $zero);

    }

    /**

     * Multiply two field elements

     *

     * h = f * g

     *

     * @internal You should not use this directly from another application

     *

     * @security Is multiplication a source of timing leaks? If so, can we do

     *           anything to prevent that from happening?

     *

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $f

     * @param ParagonIE_Sodium_Core_Curve25519_Fe $g

     * @return ParagonIE_Sodium_Core_Curve25519_Fe

     */

    public static function fe_mul(

        ParagonIE_Sodium_Core_Curve25519_Fe $f,

        ParagonIE_Sodium_Core_Curve25519_Fe $g

    ) {

        // Ensure limbs aren't oversized.

        $f = self::fe_normalize($f);

        $g = self::fe_normalize($g);

        $f0 = $f[0];

        $f1 = $f[1];

        $f2 = $f[2];

        $f3 = $f[3];

        $f4 = $f[4];

        $f5 = $f[5];

        $f6 = $f[6];

        $f7 = $f[7];

        $f8 = $f[8];

        $f9 = $f[9];

        $g0 = $g[0];

        $g1 = $g[1];

        $g2 = $g[2];

        $g3 = $g[3];

        $g4 = $g[4];

        $g5 = $g[5];

        $g6 = $g[6];

        $g7 = $g[7];

        $g8 = $g[8];

        $g9 = $g[9];

        $g1_19 = self::mul($g1, 19, 5);

        $g2_19 = self::mul($g2, 19, 5);

        $g3_19 = self::mul($g3, 19, 5);

        $g4_19 = self::mul($g4, 19, 5);

        $g5_19 = self::mul($g5, 19, 5);

        $g6_19 = self::mul($g6, 19, 5);

        $g7_19 = self::mul($g7, 19, 5);

        $g8_19 = self::mul($g8, 19, 5);

        $g9_19 = self::mul($g9, 19, 5);

        $f1_2 = $f1 << 1;

        $f3_2 = $f3 << 1;

        $f5_2 = $f5 << 1;

        $f7_2 = $f7 << 1;

        $f9_2 = $f9 << 1;

        $f0g0    = self::mul($f0,    $g0, 26);

        $f0g1    = self::mul($f0,    $g1, 25);

        $f0g2    = self::mul($f0,    $g2, 26);

        $f0g3    = self::mul($f0,    $g3, 25);

        $f0g4    = self::mul($f0,    $g4, 26);

        $f0g5    = self::mul($f0,    $g5, 25);

        $f0g6    = self::mul($f0,    $g6, 26);

        $f0g7    = self::mul($f0,    $g7, 25);

        $f0g8    = self::mul($f0,    $g8, 26);

        $f0g9    = self::mul($f0,    $g9, 26);

        $f1g0    = self::mul($f1,    $g0, 26);

        $f1g1_2  = self::mul($f1_2,  $g1, 25);

        $f1g2    = self::mul($f1,    $g2, 26);

        $f1g3_2  = self::mul($f1_2,  $g3, 25);

        $f1g4    = self::mul($f1,    $g4, 26);

        $f1g5_2  = self::mul($f1_2,  $g5, 25);

        $f1g6    = self::mul($f1,    $g6, 26);

        $f1g7_2  = self::mul($f1_2,  $g7, 25);

        $f1g8    = self::mul($f1,    $g8, 26);

        $f1g9_38 = self::mul($g9_19, $f1_2, 26);

        $f2g0    = self::mul($f2,    $g0, 26);

        $f2g1    = self::mul($f2,    $g1, 25);

        $f2g2    = self::mul($f2,    $g2, 26);

        $f2g3    = self::mul($f2,    $g3, 25);

        $f2g4    = self::mul($f2,    $g4, 26);

        $f2g5    = self::mul($f2,    $g5, 25);

        $f2g6    = self::mul($f2,    $g6, 26);

        $f2g7    = self::mul($f2,    $g7, 25);

        $f2g8_19 = self::mul($g8_19, $f2, 26);

        $f2g9_19 = self::mul($g9_19, $f2, 26);

        $f3g0    = self::mul($f3,    $g0, 26);

        $f3g1_2  = self::mul($f3_2,  $g1, 25);

        $f3g2    = self::mul($f3,    $g2, 26);

        $f3g3_2  = self::mul($f3_2,  $g3, 25);

        $f3g4    = self::mul($f3,    $g4, 26);

        $f3g5_2  = self::mul($f3_2,  $g5, 25);

        $f3g6    = self::mul($f3,    $g6, 26);

        $f3g7_38 = self::mul($g7_19, $f3_2, 26);

        $f3g8_19 = self::mul($g8_19, $f3, 25);

        $f3g9_38 = self::mul($g9_19, $f3_2, 26);

        $f4g0    = self::mul($f4,    $g0, 26);

        $f4g1    = self::mul($f4,    $g1, 25);

        $f4g2    = self::mul($f4,    $g2, 26);

        $f4g3    = self::mul($f4,    $g3, 25);

        $f4g4    = self::mul($f4,    $g4, 26);

        $f4g5    = self::mul($f4,    $g5, 25);

        $f4g6_19 = self::mul($g6_19, $f4, 26);

        $f4g7_19 = self::mul($g7_19, $f4, 26);

        $f4g8_19 = self::mul($g8_19, $f4, 26);

        $f4g9_19 = self::mul($g9_19, $f4, 26);

        $f5g0    = self::mul($f5,    $g0, 26);

        $f5g1_2  = self::mul($f5_2,  $g1, 25);

        $f5g2    = self::mul($f5,    $g2, 26);

        $f5g3_2  = self::mul($f5_2,  $g3, 25);

        $f5g4    = self::mul($f5,    $g4, 26);

        $f5g5_38 = self::mul($g5_19, $f5_2, 26);

        $f5g6_19 = self::mul($g6_19, $f5, 25);

        $f5g7_38 = self::mul($g7_19, $f5_2, 26);

        $f5g8_19 = self::mul($g8_19, $f5, 25);

        $f5g9_38 = self::mul($g9_19, $f5_2, 26);

        $f6g0    = self::mul($f6,    $g0, 26);

        $f6g1    = self::mul($f6,    $g1, 25);

        $f6g2    = self::mul($f6,    $g2, 26);

        $f6g3    = self::mul($f6,    $g3, 25);

        $f6g4_19 = self::mul($g4_19, $f6, 26);

        $f6g5_19 = self::mul($g5_19, $f6, 26);

        $f6g6_19 = self::mul($g6_19, $f6, 26);

        $f6g7_19 = self::mul($g7_19, $f6, 26);

        $f6g8_19 = self::mul($g8_19, $f6, 26);

        $f6g9_19 = self::mul($g9_19, $f6, 26);

        $f7g0    = self::mul($f7,    $g0, 26);

        $f7g1_2  = self::mul($f7_2,  $g1, 25);

        $f7g2    = self::mul($f7,    $g2, 26);

        $f7g3_38 = self::mul($g3_19, $f7_2, 26);

        $f7g4_19 = self::mul($g4_19, $f7, 26);

        $f7g5_38 = self::mul($g5_19, $f7_2, 26);

        $f7g6_19 = self::mul($g6_19, $f7, 25);

        $f7g7_38 = self::mul($g7_19, $f7_2, 26);

        $f7g8_19 = self::mul($g8_19, $f7, 25);

        $f7g9_38 = self::mul($g9_19,$f7_2, 26);

        $f8g0    = self::mul($f8,    $g0, 26);

        $f8g1    = self::mul($f8,    $g1, 25);

        $f8g2_19 = self::mul($g2_19, $f8, 26);

        $f8g3_19 = self::mul($g3_19, $f8, 26);

        $f8g4_19 = self::mul($g4_19, $f8, 26);

        $f8g5_19 = self::mul($g5_19, $f8, 26);

        $f8g6_19 = self::mul($g6_19, $f8, 26);

        $f8g7_19 = self::mul($g7_19, $f8, 26);

        $f8g8_19 = self::mul($g8_19, $f8, 26);

        $f8g9_19 = self::mul($g9_19, $f8, 26);

        $f9g0    = self::mul($f9,    $g0, 26);

        $f9g1_38 = self::mul($g1_19, $f9_2, 26);

        $f9g2_19 = self::mul($g2_19, $f9, 25);

        $f9g3_38 = self::mul($g3_19, $f9_2, 26);

        $f9g4_19 = self::mul($g4_19, $f9, 25);

        $f9g5_38 = self::mul($g5_19, $f9_2, 26);

        $f9g6_19 = self::mul($g6_19, $f9, 25);

        $f9g7_38 = self::mul($g7_19, $f9_2, 26);

        $f9g8_19 = self::mul($g8_19, $f9, 25);

        $f9g9_38 = self::mul($g9_19, $f9_2, 26);

        $h0 = $f0g0 + $f1g9_38 + $f2g8_19 + $f3g7_38 + $f4g6_19 + $f5g5_38 + $f6g4_19 + $f7g3_38 + $f8g2_19 + $f9g1_38;

        $h1 = $f0g1 + $f1g0    + $f2g9_19 + $f3g8_19 + $f4g7_19 + $f5g6_19 + $f6g5_19 + $f7g4_19 + $f8g3_19 + $f9g2_19;

        $h2 = $f0g2 + $f1g1_2  + $f2g0    + $f3g9_38 + $f4g8_19 + $f5g7_38 + $f6g6_19 + $f7g5_38 + $f8g4_19 + $f9g3_38;

        $h3 = $f0g3 + $f1g2    + $f2g1    + $f3g0    + $f4g9_19 + $f5g8_19 + $f6g7_19 + $f7g6_19 + $f8g5_19 + $f9g4_19;

        $h4 = $f0g4 + $f1g3_2  + $f2g2    + $f3g1_2  + $f4g0    + $f5g9_38 + $f6g8_19 + $f7g7_38 + $f8g6_19 + $f9g5_38;

        $h5 = $f0g5 + $f1g4    + $f2g3    + $f3g2    + $f4g1    + $f5g0    + $f6g9_19 + $f7g8_19 + $f8g7_19 + $f9g6_19;

        $h6 = $f0g6 + $f1g5_2  + $f2g4    + $f3g3_2  + $f4g2    + $f5g1_2  + $f6g0    + $f7g9_38 + $f8g8_19 + $f9g7_38;

        $h7 = $f0g7 + $f1g6    + $f2g5    + $f3g4    + $f4g3    + $f5g2    + $f6g1    + $f7g0    + $f8g9_19 + $f9g8_19;

        $h8 = $f0g8 + $f1g7_2  + $f2g6    + $f3g5_2  + $f4g4    + $f5g3_2  + $f6g2    + $f7g1_2  + $f8g0    + $f9g9_38;

        $h9 = $f0g9 + $f1g8    + $f2g7    + $f3g6    + $f4g5    + $f5g4    + $f6g3    + $f7g2    + $f8g1    + $f9g0   ;

        $carry0 = ($h0 + (1 << 25)) >> 26;

        $h1 += $carry0;

        $h0 -= $carry0 << 26;

        $carry4 = ($h4 + (1 << 25)) >> 26;

        $h5 += $carry4;

        $h4 -= $carry4 << 26;

        $carry1 = ($h1 + (1 << 24)) >> 25;

        $h2 += $carry1;

        $h1 -= $carry1 << 25;

        $carry5 = ($h5 + (1 << 24)) >> 25;

        $h6 += $carry5;

        $h5 -= $carry5 << 25;

        $carry2 = ($h2 + (1 << 25)) >> 26;

        $h3 += $carry2;

        $h2 -= $carry2 << 26;

        $carry6 = ($h6 + (1 << 25)) >> 26;

        $h7 += $carry6;

        $h6 -= $carry6 << 26;

        $carry3 = ($h3 + (1 << 24)) >> 25;

        $h4 += $carry3;

        $h3 -= $carry3 << 25;

        $carry7 = ($h7 + (1 << 24)) >> 25;

        $h8 += $carry7;

        $h7 -= $carry7 << 25;

        $carry4 = ($h4 + (1 << 25)) >> 26;

        $h5 += $carry4;

        $h4 -= $carry4 << 26;

        $carry8 = ($h8 + (1 << 25)) >> 26;

        $h9 += $carry8;

        $h8 -= $carry8 << 26;