1 // Copyright (c) 2017 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
4
5 // Package field implements fast arithmetic modulo 2^255-19.
6 package field
7
8 import (
9 _ "crypto/internal/fips140/check"
10 "crypto/internal/fips140/subtle"
11 "crypto/internal/fips140deps/byteorder"
12 "errors"
13 "math/bits"
14 )
15
16 // Element represents an element of the field GF(2^255-19). Note that this
17 // is not a cryptographically secure group, and should only be used to interact
18 // with edwards25519.Point coordinates.
19 //
20 // This type works similarly to math/big.Int, and all arguments and receivers
21 // are allowed to alias.
22 //
23 // The zero value is a valid zero element.
24 type Element struct {
25 // An element t represents the integer
26 // t.l0 + t.l1*2^51 + t.l2*2^102 + t.l3*2^153 + t.l4*2^204
27 //
28 // Between operations, all limbs are expected to be lower than 2^52.
29 l0 uint64
30 l1 uint64
31 l2 uint64
32 l3 uint64
33 l4 uint64
34 }
35
36 const maskLow51Bits uint64 = (1 << 51) - 1
37
38 var feZero = &Element{0, 0, 0, 0, 0}
39
40 // Zero sets v = 0, and returns v.
41 func (v *Element) Zero() *Element {
42 *v = *feZero
43 return v
44 }
45
46 var feOne = &Element{1, 0, 0, 0, 0}
47
48 // One sets v = 1, and returns v.
49 func (v *Element) One() *Element {
50 *v = *feOne
51 return v
52 }
53
54 // reduce reduces v modulo 2^255 - 19 and returns it.
55 func (v *Element) reduce() *Element {
56 v.carryPropagate()
57
58 // After the light reduction we now have a field element representation
59 // v < 2^255 + 2^13 * 19, but need v < 2^255 - 19.
60
61 // If v >= 2^255 - 19, then v + 19 >= 2^255, which would overflow 2^255 - 1,
62 // generating a carry. That is, c will be 0 if v < 2^255 - 19, and 1 otherwise.
63 c := (v.l0 + 19) >> 51
64 c = (v.l1 + c) >> 51
65 c = (v.l2 + c) >> 51
66 c = (v.l3 + c) >> 51
67 c = (v.l4 + c) >> 51
68
69 // If v < 2^255 - 19 and c = 0, this will be a no-op. Otherwise, it's
70 // effectively applying the reduction identity to the carry.
71 v.l0 += 19 * c
72
73 v.l1 += v.l0 >> 51
74 v.l0 = v.l0 & maskLow51Bits
75 v.l2 += v.l1 >> 51
76 v.l1 = v.l1 & maskLow51Bits
77 v.l3 += v.l2 >> 51
78 v.l2 = v.l2 & maskLow51Bits
79 v.l4 += v.l3 >> 51
80 v.l3 = v.l3 & maskLow51Bits
81 // no additional carry
82 v.l4 = v.l4 & maskLow51Bits
83
84 return v
85 }
86
87 // Add sets v = a + b, and returns v.
88 func (v *Element) Add(a, b *Element) *Element {
89 v.l0 = a.l0 + b.l0
90 v.l1 = a.l1 + b.l1
91 v.l2 = a.l2 + b.l2
92 v.l3 = a.l3 + b.l3
93 v.l4 = a.l4 + b.l4
94 return v.carryPropagate()
95 }
96
97 // Subtract sets v = a - b, and returns v.
98 func (v *Element) Subtract(a, b *Element) *Element {
99 // We first add 2 * p, to guarantee the subtraction won't underflow, and
100 // then subtract b (which can be up to 2^255 + 2^13 * 19).
101 v.l0 = (a.l0 + 0xFFFFFFFFFFFDA) - b.l0
102 v.l1 = (a.l1 + 0xFFFFFFFFFFFFE) - b.l1
103 v.l2 = (a.l2 + 0xFFFFFFFFFFFFE) - b.l2
104 v.l3 = (a.l3 + 0xFFFFFFFFFFFFE) - b.l3
105 v.l4 = (a.l4 + 0xFFFFFFFFFFFFE) - b.l4
106 return v.carryPropagate()
107 }
108
109 // Negate sets v = -a, and returns v.
110 func (v *Element) Negate(a *Element) *Element {
111 return v.Subtract(feZero, a)
112 }
113
114 // Invert sets v = 1/z mod p, and returns v.
115 //
116 // If z == 0, Invert returns v = 0.
117 func (v *Element) Invert(z *Element) *Element {
118 // Inversion is implemented as exponentiation with exponent p − 2. It uses the
119 // same sequence of 255 squarings and 11 multiplications as [Curve25519].
120 var z2, z9, z11, z2_5_0, z2_10_0, z2_20_0, z2_50_0, z2_100_0, t Element
121
122 z2.Square(z) // 2
123 t.Square(&z2) // 4
124 t.Square(&t) // 8
125 z9.Multiply(&t, z) // 9
126 z11.Multiply(&z9, &z2) // 11
127 t.Square(&z11) // 22
128 z2_5_0.Multiply(&t, &z9) // 31 = 2^5 - 2^0
129
130 t.Square(&z2_5_0) // 2^6 - 2^1
131 for i := 0; i < 4; i++ {
132 t.Square(&t) // 2^10 - 2^5
133 }
134 z2_10_0.Multiply(&t, &z2_5_0) // 2^10 - 2^0
135
136 t.Square(&z2_10_0) // 2^11 - 2^1
137 for i := 0; i < 9; i++ {
138 t.Square(&t) // 2^20 - 2^10
139 }
140 z2_20_0.Multiply(&t, &z2_10_0) // 2^20 - 2^0
141
142 t.Square(&z2_20_0) // 2^21 - 2^1
143 for i := 0; i < 19; i++ {
144 t.Square(&t) // 2^40 - 2^20
145 }
146 t.Multiply(&t, &z2_20_0) // 2^40 - 2^0
147
148 t.Square(&t) // 2^41 - 2^1
149 for i := 0; i < 9; i++ {
150 t.Square(&t) // 2^50 - 2^10
151 }
152 z2_50_0.Multiply(&t, &z2_10_0) // 2^50 - 2^0
153
154 t.Square(&z2_50_0) // 2^51 - 2^1
155 for i := 0; i < 49; i++ {
156 t.Square(&t) // 2^100 - 2^50
157 }
158 z2_100_0.Multiply(&t, &z2_50_0) // 2^100 - 2^0
159
160 t.Square(&z2_100_0) // 2^101 - 2^1
161 for i := 0; i < 99; i++ {
162 t.Square(&t) // 2^200 - 2^100
163 }
164 t.Multiply(&t, &z2_100_0) // 2^200 - 2^0
165
166 t.Square(&t) // 2^201 - 2^1
167 for i := 0; i < 49; i++ {
168 t.Square(&t) // 2^250 - 2^50
169 }
170 t.Multiply(&t, &z2_50_0) // 2^250 - 2^0
171
172 t.Square(&t) // 2^251 - 2^1
173 t.Square(&t) // 2^252 - 2^2
174 t.Square(&t) // 2^253 - 2^3
175 t.Square(&t) // 2^254 - 2^4
176 t.Square(&t) // 2^255 - 2^5
177
178 return v.Multiply(&t, &z11) // 2^255 - 21
179 }
180
181 // Set sets v = a, and returns v.
182 func (v *Element) Set(a *Element) *Element {
183 *v = *a
184 return v
185 }
186
187 // SetBytes sets v to x, where x is a 32-byte little-endian encoding. If x is
188 // not of the right length, SetBytes returns nil and an error, and the
189 // receiver is unchanged.
190 //
191 // Consistent with RFC 7748, the most significant bit (the high bit of the
192 // last byte) is ignored, and non-canonical values (2^255-19 through 2^255-1)
193 // are accepted. Note that this is laxer than specified by RFC 8032, but
194 // consistent with most Ed25519 implementations.
195 func (v *Element) SetBytes(x []byte) (*Element, error) {
196 if len(x) != 32 {
197 return nil, errors.New("edwards25519: invalid field element input size")
198 }
199
200 // Bits 0:51 (bytes 0:8, bits 0:64, shift 0, mask 51).
201 v.l0 = byteorder.LEUint64(x[0:8])
202 v.l0 &= maskLow51Bits
203 // Bits 51:102 (bytes 6:14, bits 48:112, shift 3, mask 51).
204 v.l1 = byteorder.LEUint64(x[6:14]) >> 3
205 v.l1 &= maskLow51Bits
206 // Bits 102:153 (bytes 12:20, bits 96:160, shift 6, mask 51).
207 v.l2 = byteorder.LEUint64(x[12:20]) >> 6
208 v.l2 &= maskLow51Bits
209 // Bits 153:204 (bytes 19:27, bits 152:216, shift 1, mask 51).
210 v.l3 = byteorder.LEUint64(x[19:27]) >> 1
211 v.l3 &= maskLow51Bits
212 // Bits 204:255 (bytes 24:32, bits 192:256, shift 12, mask 51).
213 // Note: not bytes 25:33, shift 4, to avoid overread.
214 v.l4 = byteorder.LEUint64(x[24:32]) >> 12
215 v.l4 &= maskLow51Bits
216
217 return v, nil
218 }
219
220 // Bytes returns the canonical 32-byte little-endian encoding of v.
221 func (v *Element) Bytes() []byte {
222 // This function is outlined to make the allocations inline in the caller
223 // rather than happen on the heap.
224 var out [32]byte
225 return v.bytes(&out)
226 }
227
228 func (v *Element) bytes(out *[32]byte) []byte {
229 t := *v
230 t.reduce()
231
232 // Pack five 51-bit limbs into four 64-bit words:
233 //
234 // 255 204 153 102 51 0
235 // ├──l4──┼──l3──┼──l2──┼──l1──┼──l0──┤
236 // ├───u3───┼───u2───┼───u1───┼───u0───┤
237 // 256 192 128 64 0
238
239 u0 := t.l1<<51 | t.l0
240 u1 := t.l2<<(102-64) | t.l1>>(64-51)
241 u2 := t.l3<<(153-128) | t.l2>>(128-102)
242 u3 := t.l4<<(204-192) | t.l3>>(192-153)
243
244 byteorder.LEPutUint64(out[0*8:], u0)
245 byteorder.LEPutUint64(out[1*8:], u1)
246 byteorder.LEPutUint64(out[2*8:], u2)
247 byteorder.LEPutUint64(out[3*8:], u3)
248
249 return out[:]
250 }
251
252 // Equal returns 1 if v and u are equal, and 0 otherwise.
253 func (v *Element) Equal(u *Element) int {
254 sa, sv := u.Bytes(), v.Bytes()
255 return subtle.ConstantTimeCompare(sa, sv)
256 }
257
258 // mask64Bits returns 0xffffffff if cond is 1, and 0 otherwise.
259 func mask64Bits(cond int) uint64 { return ^(uint64(cond) - 1) }
260
261 // Select sets v to a if cond == 1, and to b if cond == 0.
262 func (v *Element) Select(a, b *Element, cond int) *Element {
263 m := mask64Bits(cond)
264 v.l0 = (m & a.l0) | (^m & b.l0)
265 v.l1 = (m & a.l1) | (^m & b.l1)
266 v.l2 = (m & a.l2) | (^m & b.l2)
267 v.l3 = (m & a.l3) | (^m & b.l3)
268 v.l4 = (m & a.l4) | (^m & b.l4)
269 return v
270 }
271
272 // Swap swaps v and u if cond == 1 or leaves them unchanged if cond == 0, and returns v.
273 func (v *Element) Swap(u *Element, cond int) {
274 m := mask64Bits(cond)
275 t := m & (v.l0 ^ u.l0)
276 v.l0 ^= t
277 u.l0 ^= t
278 t = m & (v.l1 ^ u.l1)
279 v.l1 ^= t
280 u.l1 ^= t
281 t = m & (v.l2 ^ u.l2)
282 v.l2 ^= t
283 u.l2 ^= t
284 t = m & (v.l3 ^ u.l3)
285 v.l3 ^= t
286 u.l3 ^= t
287 t = m & (v.l4 ^ u.l4)
288 v.l4 ^= t
289 u.l4 ^= t
290 }
291
292 // IsNegative returns 1 if v is negative, and 0 otherwise.
293 func (v *Element) IsNegative() int {
294 return int(v.Bytes()[0] & 1)
295 }
296
297 // Absolute sets v to |u|, and returns v.
298 func (v *Element) Absolute(u *Element) *Element {
299 return v.Select((&Element{}).Negate(u), u, u.IsNegative())
300 }
301
302 // Multiply sets v = x * y, and returns v.
303 func (v *Element) Multiply(x, y *Element) *Element {
304 feMul(v, x, y)
305 return v
306 }
307
308 // Square sets v = x * x, and returns v.
309 func (v *Element) Square(x *Element) *Element {
310 feSquare(v, x)
311 return v
312 }
313
314 // Mult32 sets v = x * y, and returns v.
315 func (v *Element) Mult32(x *Element, y uint32) *Element {
316 x0lo, x0hi := mul51(x.l0, y)
317 x1lo, x1hi := mul51(x.l1, y)
318 x2lo, x2hi := mul51(x.l2, y)
319 x3lo, x3hi := mul51(x.l3, y)
320 x4lo, x4hi := mul51(x.l4, y)
321 v.l0 = x0lo + 19*x4hi // carried over per the reduction identity
322 v.l1 = x1lo + x0hi
323 v.l2 = x2lo + x1hi
324 v.l3 = x3lo + x2hi
325 v.l4 = x4lo + x3hi
326 // The hi portions are going to be only 32 bits, plus any previous excess,
327 // so we can skip the carry propagation.
328 return v
329 }
330
331 // mul51 returns lo + hi * 2⁵¹ = a * b.
332 func mul51(a uint64, b uint32) (lo uint64, hi uint64) {
333 mh, ml := bits.Mul64(a, uint64(b))
334 lo = ml & maskLow51Bits
335 hi = (mh << 13) | (ml >> 51)
336 return
337 }
338
339 // Pow22523 set v = x^((p-5)/8), and returns v. (p-5)/8 is 2^252-3.
340 func (v *Element) Pow22523(x *Element) *Element {
341 var t0, t1, t2 Element
342
343 t0.Square(x) // x^2
344 t1.Square(&t0) // x^4
345 t1.Square(&t1) // x^8
346 t1.Multiply(x, &t1) // x^9
347 t0.Multiply(&t0, &t1) // x^11
348 t0.Square(&t0) // x^22
349 t0.Multiply(&t1, &t0) // x^31
350 t1.Square(&t0) // x^62
351 for i := 1; i < 5; i++ { // x^992
352 t1.Square(&t1)
353 }
354 t0.Multiply(&t1, &t0) // x^1023 -> 1023 = 2^10 - 1
355 t1.Square(&t0) // 2^11 - 2
356 for i := 1; i < 10; i++ { // 2^20 - 2^10
357 t1.Square(&t1)
358 }
359 t1.Multiply(&t1, &t0) // 2^20 - 1
360 t2.Square(&t1) // 2^21 - 2
361 for i := 1; i < 20; i++ { // 2^40 - 2^20
362 t2.Square(&t2)
363 }
364 t1.Multiply(&t2, &t1) // 2^40 - 1
365 t1.Square(&t1) // 2^41 - 2
366 for i := 1; i < 10; i++ { // 2^50 - 2^10
367 t1.Square(&t1)
368 }
369 t0.Multiply(&t1, &t0) // 2^50 - 1
370 t1.Square(&t0) // 2^51 - 2
371 for i := 1; i < 50; i++ { // 2^100 - 2^50
372 t1.Square(&t1)
373 }
374 t1.Multiply(&t1, &t0) // 2^100 - 1
375 t2.Square(&t1) // 2^101 - 2
376 for i := 1; i < 100; i++ { // 2^200 - 2^100
377 t2.Square(&t2)
378 }
379 t1.Multiply(&t2, &t1) // 2^200 - 1
380 t1.Square(&t1) // 2^201 - 2
381 for i := 1; i < 50; i++ { // 2^250 - 2^50
382 t1.Square(&t1)
383 }
384 t0.Multiply(&t1, &t0) // 2^250 - 1
385 t0.Square(&t0) // 2^251 - 2
386 t0.Square(&t0) // 2^252 - 4
387 return v.Multiply(&t0, x) // 2^252 - 3 -> x^(2^252-3)
388 }
389
390 // sqrtM1 is 2^((p-1)/4), which squared is equal to -1 by Euler's Criterion.
391 var sqrtM1 = &Element{1718705420411056, 234908883556509,
392 2233514472574048, 2117202627021982, 765476049583133}
393
394 // SqrtRatio sets r to the non-negative square root of the ratio of u and v.
395 //
396 // If u/v is square, SqrtRatio returns r and 1. If u/v is not square, SqrtRatio
397 // sets r according to Section 4.3 of draft-irtf-cfrg-ristretto255-decaf448-00,
398 // and returns r and 0.
399 func (r *Element) SqrtRatio(u, v *Element) (R *Element, wasSquare int) {
400 t0 := &Element{}
401
402 // r = (u * v3) * (u * v7)^((p-5)/8)
403 v2 := (&Element{}).Square(v)
404 uv3 := (&Element{}).Multiply(u, t0.Multiply(v2, v))
405 uv7 := (&Element{}).Multiply(uv3, t0.Square(v2))
406 rr := (&Element{}).Multiply(uv3, t0.Pow22523(uv7))
407
408 check := (&Element{}).Multiply(v, t0.Square(rr)) // check = v * r^2
409
410 uNeg := (&Element{}).Negate(u)
411 correctSignSqrt := check.Equal(u)
412 flippedSignSqrt := check.Equal(uNeg)
413 flippedSignSqrtI := check.Equal(t0.Multiply(uNeg, sqrtM1))
414
415 rPrime := (&Element{}).Multiply(rr, sqrtM1) // r_prime = SQRT_M1 * r
416 // r = CT_SELECT(r_prime IF flipped_sign_sqrt | flipped_sign_sqrt_i ELSE r)
417 rr.Select(rPrime, rr, flippedSignSqrt|flippedSignSqrtI)
418
419 r.Absolute(rr) // Choose the nonnegative square root.
420 return r, correctSignSqrt | flippedSignSqrt
421 }
422