p224_fiat64.mx raw
1 // Code generated by Fiat Cryptography. DO NOT EDIT.
2 //
3 // Autogenerated: word_by_word_montgomery --lang Go --no-wide-int --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --internal-static --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name fiat --no-prefix-fiat p224 64 '2^224 - 2^96 + 1' mul square add sub one from_montgomery to_montgomery selectznz to_bytes from_bytes
4 //
5 // curve description: p224
6 //
7 // machine_wordsize = 64 (from "64")
8 //
9 // requested operations: mul, square, add, sub, one, from_montgomery, to_montgomery, selectznz, to_bytes, from_bytes
10 //
11 // m = 0xffffffffffffffffffffffffffffffff000000000000000000000001 (from "2^224 - 2^96 + 1")
12 //
13 //
14 //
15 // NOTE: In addition to the bounds specified above each function, all
16 //
17 // functions synthesized for this Montgomery arithmetic require the
18 //
19 // input to be strictly less than the prime modulus (m), and also
20 //
21 // require the input to be in the unique saturated representation.
22 //
23 // All functions also ensure that these two properties are true of
24 //
25 // return values.
26 //
27 //
28 //
29 // Computed values:
30 //
31 // eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
32 //
33 // bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216)
34 //
35 // twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
36 //
37 // if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
38
39 package fiat
40
41 import "math/bits"
42
43 type p224Uint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
44 type p224Int1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
45
46 // The type p224MontgomeryDomainFieldElement is a field element in the Montgomery domain.
47 //
48 // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
49 type p224MontgomeryDomainFieldElement [4]uint64
50
51 // The type p224NonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain.
52 //
53 // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
54 type p224NonMontgomeryDomainFieldElement [4]uint64
55
56 // p224CmovznzU64 is a single-word conditional move.
57 //
58 // Postconditions:
59 //
60 // out1 = (if arg1 = 0 then arg2 else arg3)
61 //
62 // Input Bounds:
63 //
64 // arg1: [0x0 ~> 0x1]
65 // arg2: [0x0 ~> 0xffffffffffffffff]
66 // arg3: [0x0 ~> 0xffffffffffffffff]
67 //
68 // Output Bounds:
69 //
70 // out1: [0x0 ~> 0xffffffffffffffff]
71 func p224CmovznzU64(out1 *uint64, arg1 p224Uint1, arg2 uint64, arg3 uint64) {
72 x1 := (uint64(arg1) * 0xffffffffffffffff)
73 x2 := ((x1 & arg3) | ((^x1) & arg2))
74 *out1 = x2
75 }
76
77 // p224Mul multiplies two field elements in the Montgomery domain.
78 //
79 // Preconditions:
80 //
81 // 0 ≤ eval arg1 < m
82 // 0 ≤ eval arg2 < m
83 //
84 // Postconditions:
85 //
86 // eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
87 // 0 ≤ eval out1 < m
88 func p224Mul(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement, arg2 *p224MontgomeryDomainFieldElement) {
89 x1 := arg1[1]
90 x2 := arg1[2]
91 x3 := arg1[3]
92 x4 := arg1[0]
93 var x5 uint64
94 var x6 uint64
95 x6, x5 = bits.Mul64(x4, arg2[3])
96 var x7 uint64
97 var x8 uint64
98 x8, x7 = bits.Mul64(x4, arg2[2])
99 var x9 uint64
100 var x10 uint64
101 x10, x9 = bits.Mul64(x4, arg2[1])
102 var x11 uint64
103 var x12 uint64
104 x12, x11 = bits.Mul64(x4, arg2[0])
105 var x13 uint64
106 var x14 uint64
107 x13, x14 = bits.Add64(x12, x9, uint64(0x0))
108 var x15 uint64
109 var x16 uint64
110 x15, x16 = bits.Add64(x10, x7, uint64(p224Uint1(x14)))
111 var x17 uint64
112 var x18 uint64
113 x17, x18 = bits.Add64(x8, x5, uint64(p224Uint1(x16)))
114 x19 := (uint64(p224Uint1(x18)) + x6)
115 var x20 uint64
116 _, x20 = bits.Mul64(x11, 0xffffffffffffffff)
117 var x22 uint64
118 var x23 uint64
119 x23, x22 = bits.Mul64(x20, 0xffffffff)
120 var x24 uint64
121 var x25 uint64
122 x25, x24 = bits.Mul64(x20, 0xffffffffffffffff)
123 var x26 uint64
124 var x27 uint64
125 x27, x26 = bits.Mul64(x20, 0xffffffff00000000)
126 var x28 uint64
127 var x29 uint64
128 x28, x29 = bits.Add64(x27, x24, uint64(0x0))
129 var x30 uint64
130 var x31 uint64
131 x30, x31 = bits.Add64(x25, x22, uint64(p224Uint1(x29)))
132 x32 := (uint64(p224Uint1(x31)) + x23)
133 var x34 uint64
134 _, x34 = bits.Add64(x11, x20, uint64(0x0))
135 var x35 uint64
136 var x36 uint64
137 x35, x36 = bits.Add64(x13, x26, uint64(p224Uint1(x34)))
138 var x37 uint64
139 var x38 uint64
140 x37, x38 = bits.Add64(x15, x28, uint64(p224Uint1(x36)))
141 var x39 uint64
142 var x40 uint64
143 x39, x40 = bits.Add64(x17, x30, uint64(p224Uint1(x38)))
144 var x41 uint64
145 var x42 uint64
146 x41, x42 = bits.Add64(x19, x32, uint64(p224Uint1(x40)))
147 var x43 uint64
148 var x44 uint64
149 x44, x43 = bits.Mul64(x1, arg2[3])
150 var x45 uint64
151 var x46 uint64
152 x46, x45 = bits.Mul64(x1, arg2[2])
153 var x47 uint64
154 var x48 uint64
155 x48, x47 = bits.Mul64(x1, arg2[1])
156 var x49 uint64
157 var x50 uint64
158 x50, x49 = bits.Mul64(x1, arg2[0])
159 var x51 uint64
160 var x52 uint64
161 x51, x52 = bits.Add64(x50, x47, uint64(0x0))
162 var x53 uint64
163 var x54 uint64
164 x53, x54 = bits.Add64(x48, x45, uint64(p224Uint1(x52)))
165 var x55 uint64
166 var x56 uint64
167 x55, x56 = bits.Add64(x46, x43, uint64(p224Uint1(x54)))
168 x57 := (uint64(p224Uint1(x56)) + x44)
169 var x58 uint64
170 var x59 uint64
171 x58, x59 = bits.Add64(x35, x49, uint64(0x0))
172 var x60 uint64
173 var x61 uint64
174 x60, x61 = bits.Add64(x37, x51, uint64(p224Uint1(x59)))
175 var x62 uint64
176 var x63 uint64
177 x62, x63 = bits.Add64(x39, x53, uint64(p224Uint1(x61)))
178 var x64 uint64
179 var x65 uint64
180 x64, x65 = bits.Add64(x41, x55, uint64(p224Uint1(x63)))
181 var x66 uint64
182 var x67 uint64
183 x66, x67 = bits.Add64(uint64(p224Uint1(x42)), x57, uint64(p224Uint1(x65)))
184 var x68 uint64
185 _, x68 = bits.Mul64(x58, 0xffffffffffffffff)
186 var x70 uint64
187 var x71 uint64
188 x71, x70 = bits.Mul64(x68, 0xffffffff)
189 var x72 uint64
190 var x73 uint64
191 x73, x72 = bits.Mul64(x68, 0xffffffffffffffff)
192 var x74 uint64
193 var x75 uint64
194 x75, x74 = bits.Mul64(x68, 0xffffffff00000000)
195 var x76 uint64
196 var x77 uint64
197 x76, x77 = bits.Add64(x75, x72, uint64(0x0))
198 var x78 uint64
199 var x79 uint64
200 x78, x79 = bits.Add64(x73, x70, uint64(p224Uint1(x77)))
201 x80 := (uint64(p224Uint1(x79)) + x71)
202 var x82 uint64
203 _, x82 = bits.Add64(x58, x68, uint64(0x0))
204 var x83 uint64
205 var x84 uint64
206 x83, x84 = bits.Add64(x60, x74, uint64(p224Uint1(x82)))
207 var x85 uint64
208 var x86 uint64
209 x85, x86 = bits.Add64(x62, x76, uint64(p224Uint1(x84)))
210 var x87 uint64
211 var x88 uint64
212 x87, x88 = bits.Add64(x64, x78, uint64(p224Uint1(x86)))
213 var x89 uint64
214 var x90 uint64
215 x89, x90 = bits.Add64(x66, x80, uint64(p224Uint1(x88)))
216 x91 := (uint64(p224Uint1(x90)) + uint64(p224Uint1(x67)))
217 var x92 uint64
218 var x93 uint64
219 x93, x92 = bits.Mul64(x2, arg2[3])
220 var x94 uint64
221 var x95 uint64
222 x95, x94 = bits.Mul64(x2, arg2[2])
223 var x96 uint64
224 var x97 uint64
225 x97, x96 = bits.Mul64(x2, arg2[1])
226 var x98 uint64
227 var x99 uint64
228 x99, x98 = bits.Mul64(x2, arg2[0])
229 var x100 uint64
230 var x101 uint64
231 x100, x101 = bits.Add64(x99, x96, uint64(0x0))
232 var x102 uint64
233 var x103 uint64
234 x102, x103 = bits.Add64(x97, x94, uint64(p224Uint1(x101)))
235 var x104 uint64
236 var x105 uint64
237 x104, x105 = bits.Add64(x95, x92, uint64(p224Uint1(x103)))
238 x106 := (uint64(p224Uint1(x105)) + x93)
239 var x107 uint64
240 var x108 uint64
241 x107, x108 = bits.Add64(x83, x98, uint64(0x0))
242 var x109 uint64
243 var x110 uint64
244 x109, x110 = bits.Add64(x85, x100, uint64(p224Uint1(x108)))
245 var x111 uint64
246 var x112 uint64
247 x111, x112 = bits.Add64(x87, x102, uint64(p224Uint1(x110)))
248 var x113 uint64
249 var x114 uint64
250 x113, x114 = bits.Add64(x89, x104, uint64(p224Uint1(x112)))
251 var x115 uint64
252 var x116 uint64
253 x115, x116 = bits.Add64(x91, x106, uint64(p224Uint1(x114)))
254 var x117 uint64
255 _, x117 = bits.Mul64(x107, 0xffffffffffffffff)
256 var x119 uint64
257 var x120 uint64
258 x120, x119 = bits.Mul64(x117, 0xffffffff)
259 var x121 uint64
260 var x122 uint64
261 x122, x121 = bits.Mul64(x117, 0xffffffffffffffff)
262 var x123 uint64
263 var x124 uint64
264 x124, x123 = bits.Mul64(x117, 0xffffffff00000000)
265 var x125 uint64
266 var x126 uint64
267 x125, x126 = bits.Add64(x124, x121, uint64(0x0))
268 var x127 uint64
269 var x128 uint64
270 x127, x128 = bits.Add64(x122, x119, uint64(p224Uint1(x126)))
271 x129 := (uint64(p224Uint1(x128)) + x120)
272 var x131 uint64
273 _, x131 = bits.Add64(x107, x117, uint64(0x0))
274 var x132 uint64
275 var x133 uint64
276 x132, x133 = bits.Add64(x109, x123, uint64(p224Uint1(x131)))
277 var x134 uint64
278 var x135 uint64
279 x134, x135 = bits.Add64(x111, x125, uint64(p224Uint1(x133)))
280 var x136 uint64
281 var x137 uint64
282 x136, x137 = bits.Add64(x113, x127, uint64(p224Uint1(x135)))
283 var x138 uint64
284 var x139 uint64
285 x138, x139 = bits.Add64(x115, x129, uint64(p224Uint1(x137)))
286 x140 := (uint64(p224Uint1(x139)) + uint64(p224Uint1(x116)))
287 var x141 uint64
288 var x142 uint64
289 x142, x141 = bits.Mul64(x3, arg2[3])
290 var x143 uint64
291 var x144 uint64
292 x144, x143 = bits.Mul64(x3, arg2[2])
293 var x145 uint64
294 var x146 uint64
295 x146, x145 = bits.Mul64(x3, arg2[1])
296 var x147 uint64
297 var x148 uint64
298 x148, x147 = bits.Mul64(x3, arg2[0])
299 var x149 uint64
300 var x150 uint64
301 x149, x150 = bits.Add64(x148, x145, uint64(0x0))
302 var x151 uint64
303 var x152 uint64
304 x151, x152 = bits.Add64(x146, x143, uint64(p224Uint1(x150)))
305 var x153 uint64
306 var x154 uint64
307 x153, x154 = bits.Add64(x144, x141, uint64(p224Uint1(x152)))
308 x155 := (uint64(p224Uint1(x154)) + x142)
309 var x156 uint64
310 var x157 uint64
311 x156, x157 = bits.Add64(x132, x147, uint64(0x0))
312 var x158 uint64
313 var x159 uint64
314 x158, x159 = bits.Add64(x134, x149, uint64(p224Uint1(x157)))
315 var x160 uint64
316 var x161 uint64
317 x160, x161 = bits.Add64(x136, x151, uint64(p224Uint1(x159)))
318 var x162 uint64
319 var x163 uint64
320 x162, x163 = bits.Add64(x138, x153, uint64(p224Uint1(x161)))
321 var x164 uint64
322 var x165 uint64
323 x164, x165 = bits.Add64(x140, x155, uint64(p224Uint1(x163)))
324 var x166 uint64
325 _, x166 = bits.Mul64(x156, 0xffffffffffffffff)
326 var x168 uint64
327 var x169 uint64
328 x169, x168 = bits.Mul64(x166, 0xffffffff)
329 var x170 uint64
330 var x171 uint64
331 x171, x170 = bits.Mul64(x166, 0xffffffffffffffff)
332 var x172 uint64
333 var x173 uint64
334 x173, x172 = bits.Mul64(x166, 0xffffffff00000000)
335 var x174 uint64
336 var x175 uint64
337 x174, x175 = bits.Add64(x173, x170, uint64(0x0))
338 var x176 uint64
339 var x177 uint64
340 x176, x177 = bits.Add64(x171, x168, uint64(p224Uint1(x175)))
341 x178 := (uint64(p224Uint1(x177)) + x169)
342 var x180 uint64
343 _, x180 = bits.Add64(x156, x166, uint64(0x0))
344 var x181 uint64
345 var x182 uint64
346 x181, x182 = bits.Add64(x158, x172, uint64(p224Uint1(x180)))
347 var x183 uint64
348 var x184 uint64
349 x183, x184 = bits.Add64(x160, x174, uint64(p224Uint1(x182)))
350 var x185 uint64
351 var x186 uint64
352 x185, x186 = bits.Add64(x162, x176, uint64(p224Uint1(x184)))
353 var x187 uint64
354 var x188 uint64
355 x187, x188 = bits.Add64(x164, x178, uint64(p224Uint1(x186)))
356 x189 := (uint64(p224Uint1(x188)) + uint64(p224Uint1(x165)))
357 var x190 uint64
358 var x191 uint64
359 x190, x191 = bits.Sub64(x181, uint64(0x1), uint64(0x0))
360 var x192 uint64
361 var x193 uint64
362 x192, x193 = bits.Sub64(x183, 0xffffffff00000000, uint64(p224Uint1(x191)))
363 var x194 uint64
364 var x195 uint64
365 x194, x195 = bits.Sub64(x185, 0xffffffffffffffff, uint64(p224Uint1(x193)))
366 var x196 uint64
367 var x197 uint64
368 x196, x197 = bits.Sub64(x187, 0xffffffff, uint64(p224Uint1(x195)))
369 var x199 uint64
370 _, x199 = bits.Sub64(x189, uint64(0x0), uint64(p224Uint1(x197)))
371 var x200 uint64
372 p224CmovznzU64(&x200, p224Uint1(x199), x190, x181)
373 var x201 uint64
374 p224CmovznzU64(&x201, p224Uint1(x199), x192, x183)
375 var x202 uint64
376 p224CmovznzU64(&x202, p224Uint1(x199), x194, x185)
377 var x203 uint64
378 p224CmovznzU64(&x203, p224Uint1(x199), x196, x187)
379 out1[0] = x200
380 out1[1] = x201
381 out1[2] = x202
382 out1[3] = x203
383 }
384
385 // p224Square squares a field element in the Montgomery domain.
386 //
387 // Preconditions:
388 //
389 // 0 ≤ eval arg1 < m
390 //
391 // Postconditions:
392 //
393 // eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
394 // 0 ≤ eval out1 < m
395 func p224Square(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement) {
396 x1 := arg1[1]
397 x2 := arg1[2]
398 x3 := arg1[3]
399 x4 := arg1[0]
400 var x5 uint64
401 var x6 uint64
402 x6, x5 = bits.Mul64(x4, arg1[3])
403 var x7 uint64
404 var x8 uint64
405 x8, x7 = bits.Mul64(x4, arg1[2])
406 var x9 uint64
407 var x10 uint64
408 x10, x9 = bits.Mul64(x4, arg1[1])
409 var x11 uint64
410 var x12 uint64
411 x12, x11 = bits.Mul64(x4, arg1[0])
412 var x13 uint64
413 var x14 uint64
414 x13, x14 = bits.Add64(x12, x9, uint64(0x0))
415 var x15 uint64
416 var x16 uint64
417 x15, x16 = bits.Add64(x10, x7, uint64(p224Uint1(x14)))
418 var x17 uint64
419 var x18 uint64
420 x17, x18 = bits.Add64(x8, x5, uint64(p224Uint1(x16)))
421 x19 := (uint64(p224Uint1(x18)) + x6)
422 var x20 uint64
423 _, x20 = bits.Mul64(x11, 0xffffffffffffffff)
424 var x22 uint64
425 var x23 uint64
426 x23, x22 = bits.Mul64(x20, 0xffffffff)
427 var x24 uint64
428 var x25 uint64
429 x25, x24 = bits.Mul64(x20, 0xffffffffffffffff)
430 var x26 uint64
431 var x27 uint64
432 x27, x26 = bits.Mul64(x20, 0xffffffff00000000)
433 var x28 uint64
434 var x29 uint64
435 x28, x29 = bits.Add64(x27, x24, uint64(0x0))
436 var x30 uint64
437 var x31 uint64
438 x30, x31 = bits.Add64(x25, x22, uint64(p224Uint1(x29)))
439 x32 := (uint64(p224Uint1(x31)) + x23)
440 var x34 uint64
441 _, x34 = bits.Add64(x11, x20, uint64(0x0))
442 var x35 uint64
443 var x36 uint64
444 x35, x36 = bits.Add64(x13, x26, uint64(p224Uint1(x34)))
445 var x37 uint64
446 var x38 uint64
447 x37, x38 = bits.Add64(x15, x28, uint64(p224Uint1(x36)))
448 var x39 uint64
449 var x40 uint64
450 x39, x40 = bits.Add64(x17, x30, uint64(p224Uint1(x38)))
451 var x41 uint64
452 var x42 uint64
453 x41, x42 = bits.Add64(x19, x32, uint64(p224Uint1(x40)))
454 var x43 uint64
455 var x44 uint64
456 x44, x43 = bits.Mul64(x1, arg1[3])
457 var x45 uint64
458 var x46 uint64
459 x46, x45 = bits.Mul64(x1, arg1[2])
460 var x47 uint64
461 var x48 uint64
462 x48, x47 = bits.Mul64(x1, arg1[1])
463 var x49 uint64
464 var x50 uint64
465 x50, x49 = bits.Mul64(x1, arg1[0])
466 var x51 uint64
467 var x52 uint64
468 x51, x52 = bits.Add64(x50, x47, uint64(0x0))
469 var x53 uint64
470 var x54 uint64
471 x53, x54 = bits.Add64(x48, x45, uint64(p224Uint1(x52)))
472 var x55 uint64
473 var x56 uint64
474 x55, x56 = bits.Add64(x46, x43, uint64(p224Uint1(x54)))
475 x57 := (uint64(p224Uint1(x56)) + x44)
476 var x58 uint64
477 var x59 uint64
478 x58, x59 = bits.Add64(x35, x49, uint64(0x0))
479 var x60 uint64
480 var x61 uint64
481 x60, x61 = bits.Add64(x37, x51, uint64(p224Uint1(x59)))
482 var x62 uint64
483 var x63 uint64
484 x62, x63 = bits.Add64(x39, x53, uint64(p224Uint1(x61)))
485 var x64 uint64
486 var x65 uint64
487 x64, x65 = bits.Add64(x41, x55, uint64(p224Uint1(x63)))
488 var x66 uint64
489 var x67 uint64
490 x66, x67 = bits.Add64(uint64(p224Uint1(x42)), x57, uint64(p224Uint1(x65)))
491 var x68 uint64
492 _, x68 = bits.Mul64(x58, 0xffffffffffffffff)
493 var x70 uint64
494 var x71 uint64
495 x71, x70 = bits.Mul64(x68, 0xffffffff)
496 var x72 uint64
497 var x73 uint64
498 x73, x72 = bits.Mul64(x68, 0xffffffffffffffff)
499 var x74 uint64
500 var x75 uint64
501 x75, x74 = bits.Mul64(x68, 0xffffffff00000000)
502 var x76 uint64
503 var x77 uint64
504 x76, x77 = bits.Add64(x75, x72, uint64(0x0))
505 var x78 uint64
506 var x79 uint64
507 x78, x79 = bits.Add64(x73, x70, uint64(p224Uint1(x77)))
508 x80 := (uint64(p224Uint1(x79)) + x71)
509 var x82 uint64
510 _, x82 = bits.Add64(x58, x68, uint64(0x0))
511 var x83 uint64
512 var x84 uint64
513 x83, x84 = bits.Add64(x60, x74, uint64(p224Uint1(x82)))
514 var x85 uint64
515 var x86 uint64
516 x85, x86 = bits.Add64(x62, x76, uint64(p224Uint1(x84)))
517 var x87 uint64
518 var x88 uint64
519 x87, x88 = bits.Add64(x64, x78, uint64(p224Uint1(x86)))
520 var x89 uint64
521 var x90 uint64
522 x89, x90 = bits.Add64(x66, x80, uint64(p224Uint1(x88)))
523 x91 := (uint64(p224Uint1(x90)) + uint64(p224Uint1(x67)))
524 var x92 uint64
525 var x93 uint64
526 x93, x92 = bits.Mul64(x2, arg1[3])
527 var x94 uint64
528 var x95 uint64
529 x95, x94 = bits.Mul64(x2, arg1[2])
530 var x96 uint64
531 var x97 uint64
532 x97, x96 = bits.Mul64(x2, arg1[1])
533 var x98 uint64
534 var x99 uint64
535 x99, x98 = bits.Mul64(x2, arg1[0])
536 var x100 uint64
537 var x101 uint64
538 x100, x101 = bits.Add64(x99, x96, uint64(0x0))
539 var x102 uint64
540 var x103 uint64
541 x102, x103 = bits.Add64(x97, x94, uint64(p224Uint1(x101)))
542 var x104 uint64
543 var x105 uint64
544 x104, x105 = bits.Add64(x95, x92, uint64(p224Uint1(x103)))
545 x106 := (uint64(p224Uint1(x105)) + x93)
546 var x107 uint64
547 var x108 uint64
548 x107, x108 = bits.Add64(x83, x98, uint64(0x0))
549 var x109 uint64
550 var x110 uint64
551 x109, x110 = bits.Add64(x85, x100, uint64(p224Uint1(x108)))
552 var x111 uint64
553 var x112 uint64
554 x111, x112 = bits.Add64(x87, x102, uint64(p224Uint1(x110)))
555 var x113 uint64
556 var x114 uint64
557 x113, x114 = bits.Add64(x89, x104, uint64(p224Uint1(x112)))
558 var x115 uint64
559 var x116 uint64
560 x115, x116 = bits.Add64(x91, x106, uint64(p224Uint1(x114)))
561 var x117 uint64
562 _, x117 = bits.Mul64(x107, 0xffffffffffffffff)
563 var x119 uint64
564 var x120 uint64
565 x120, x119 = bits.Mul64(x117, 0xffffffff)
566 var x121 uint64
567 var x122 uint64
568 x122, x121 = bits.Mul64(x117, 0xffffffffffffffff)
569 var x123 uint64
570 var x124 uint64
571 x124, x123 = bits.Mul64(x117, 0xffffffff00000000)
572 var x125 uint64
573 var x126 uint64
574 x125, x126 = bits.Add64(x124, x121, uint64(0x0))
575 var x127 uint64
576 var x128 uint64
577 x127, x128 = bits.Add64(x122, x119, uint64(p224Uint1(x126)))
578 x129 := (uint64(p224Uint1(x128)) + x120)
579 var x131 uint64
580 _, x131 = bits.Add64(x107, x117, uint64(0x0))
581 var x132 uint64
582 var x133 uint64
583 x132, x133 = bits.Add64(x109, x123, uint64(p224Uint1(x131)))
584 var x134 uint64
585 var x135 uint64
586 x134, x135 = bits.Add64(x111, x125, uint64(p224Uint1(x133)))
587 var x136 uint64
588 var x137 uint64
589 x136, x137 = bits.Add64(x113, x127, uint64(p224Uint1(x135)))
590 var x138 uint64
591 var x139 uint64
592 x138, x139 = bits.Add64(x115, x129, uint64(p224Uint1(x137)))
593 x140 := (uint64(p224Uint1(x139)) + uint64(p224Uint1(x116)))
594 var x141 uint64
595 var x142 uint64
596 x142, x141 = bits.Mul64(x3, arg1[3])
597 var x143 uint64
598 var x144 uint64
599 x144, x143 = bits.Mul64(x3, arg1[2])
600 var x145 uint64
601 var x146 uint64
602 x146, x145 = bits.Mul64(x3, arg1[1])
603 var x147 uint64
604 var x148 uint64
605 x148, x147 = bits.Mul64(x3, arg1[0])
606 var x149 uint64
607 var x150 uint64
608 x149, x150 = bits.Add64(x148, x145, uint64(0x0))
609 var x151 uint64
610 var x152 uint64
611 x151, x152 = bits.Add64(x146, x143, uint64(p224Uint1(x150)))
612 var x153 uint64
613 var x154 uint64
614 x153, x154 = bits.Add64(x144, x141, uint64(p224Uint1(x152)))
615 x155 := (uint64(p224Uint1(x154)) + x142)
616 var x156 uint64
617 var x157 uint64
618 x156, x157 = bits.Add64(x132, x147, uint64(0x0))
619 var x158 uint64
620 var x159 uint64
621 x158, x159 = bits.Add64(x134, x149, uint64(p224Uint1(x157)))
622 var x160 uint64
623 var x161 uint64
624 x160, x161 = bits.Add64(x136, x151, uint64(p224Uint1(x159)))
625 var x162 uint64
626 var x163 uint64
627 x162, x163 = bits.Add64(x138, x153, uint64(p224Uint1(x161)))
628 var x164 uint64
629 var x165 uint64
630 x164, x165 = bits.Add64(x140, x155, uint64(p224Uint1(x163)))
631 var x166 uint64
632 _, x166 = bits.Mul64(x156, 0xffffffffffffffff)
633 var x168 uint64
634 var x169 uint64
635 x169, x168 = bits.Mul64(x166, 0xffffffff)
636 var x170 uint64
637 var x171 uint64
638 x171, x170 = bits.Mul64(x166, 0xffffffffffffffff)
639 var x172 uint64
640 var x173 uint64
641 x173, x172 = bits.Mul64(x166, 0xffffffff00000000)
642 var x174 uint64
643 var x175 uint64
644 x174, x175 = bits.Add64(x173, x170, uint64(0x0))
645 var x176 uint64
646 var x177 uint64
647 x176, x177 = bits.Add64(x171, x168, uint64(p224Uint1(x175)))
648 x178 := (uint64(p224Uint1(x177)) + x169)
649 var x180 uint64
650 _, x180 = bits.Add64(x156, x166, uint64(0x0))
651 var x181 uint64
652 var x182 uint64
653 x181, x182 = bits.Add64(x158, x172, uint64(p224Uint1(x180)))
654 var x183 uint64
655 var x184 uint64
656 x183, x184 = bits.Add64(x160, x174, uint64(p224Uint1(x182)))
657 var x185 uint64
658 var x186 uint64
659 x185, x186 = bits.Add64(x162, x176, uint64(p224Uint1(x184)))
660 var x187 uint64
661 var x188 uint64
662 x187, x188 = bits.Add64(x164, x178, uint64(p224Uint1(x186)))
663 x189 := (uint64(p224Uint1(x188)) + uint64(p224Uint1(x165)))
664 var x190 uint64
665 var x191 uint64
666 x190, x191 = bits.Sub64(x181, uint64(0x1), uint64(0x0))
667 var x192 uint64
668 var x193 uint64
669 x192, x193 = bits.Sub64(x183, 0xffffffff00000000, uint64(p224Uint1(x191)))
670 var x194 uint64
671 var x195 uint64
672 x194, x195 = bits.Sub64(x185, 0xffffffffffffffff, uint64(p224Uint1(x193)))
673 var x196 uint64
674 var x197 uint64
675 x196, x197 = bits.Sub64(x187, 0xffffffff, uint64(p224Uint1(x195)))
676 var x199 uint64
677 _, x199 = bits.Sub64(x189, uint64(0x0), uint64(p224Uint1(x197)))
678 var x200 uint64
679 p224CmovznzU64(&x200, p224Uint1(x199), x190, x181)
680 var x201 uint64
681 p224CmovznzU64(&x201, p224Uint1(x199), x192, x183)
682 var x202 uint64
683 p224CmovznzU64(&x202, p224Uint1(x199), x194, x185)
684 var x203 uint64
685 p224CmovznzU64(&x203, p224Uint1(x199), x196, x187)
686 out1[0] = x200
687 out1[1] = x201
688 out1[2] = x202
689 out1[3] = x203
690 }
691
692 // p224Add adds two field elements in the Montgomery domain.
693 //
694 // Preconditions:
695 //
696 // 0 ≤ eval arg1 < m
697 // 0 ≤ eval arg2 < m
698 //
699 // Postconditions:
700 //
701 // eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
702 // 0 ≤ eval out1 < m
703 func p224Add(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement, arg2 *p224MontgomeryDomainFieldElement) {
704 var x1 uint64
705 var x2 uint64
706 x1, x2 = bits.Add64(arg1[0], arg2[0], uint64(0x0))
707 var x3 uint64
708 var x4 uint64
709 x3, x4 = bits.Add64(arg1[1], arg2[1], uint64(p224Uint1(x2)))
710 var x5 uint64
711 var x6 uint64
712 x5, x6 = bits.Add64(arg1[2], arg2[2], uint64(p224Uint1(x4)))
713 var x7 uint64
714 var x8 uint64
715 x7, x8 = bits.Add64(arg1[3], arg2[3], uint64(p224Uint1(x6)))
716 var x9 uint64
717 var x10 uint64
718 x9, x10 = bits.Sub64(x1, uint64(0x1), uint64(0x0))
719 var x11 uint64
720 var x12 uint64
721 x11, x12 = bits.Sub64(x3, 0xffffffff00000000, uint64(p224Uint1(x10)))
722 var x13 uint64
723 var x14 uint64
724 x13, x14 = bits.Sub64(x5, 0xffffffffffffffff, uint64(p224Uint1(x12)))
725 var x15 uint64
726 var x16 uint64
727 x15, x16 = bits.Sub64(x7, 0xffffffff, uint64(p224Uint1(x14)))
728 var x18 uint64
729 _, x18 = bits.Sub64(uint64(p224Uint1(x8)), uint64(0x0), uint64(p224Uint1(x16)))
730 var x19 uint64
731 p224CmovznzU64(&x19, p224Uint1(x18), x9, x1)
732 var x20 uint64
733 p224CmovznzU64(&x20, p224Uint1(x18), x11, x3)
734 var x21 uint64
735 p224CmovznzU64(&x21, p224Uint1(x18), x13, x5)
736 var x22 uint64
737 p224CmovznzU64(&x22, p224Uint1(x18), x15, x7)
738 out1[0] = x19
739 out1[1] = x20
740 out1[2] = x21
741 out1[3] = x22
742 }
743
744 // p224Sub subtracts two field elements in the Montgomery domain.
745 //
746 // Preconditions:
747 //
748 // 0 ≤ eval arg1 < m
749 // 0 ≤ eval arg2 < m
750 //
751 // Postconditions:
752 //
753 // eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
754 // 0 ≤ eval out1 < m
755 func p224Sub(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement, arg2 *p224MontgomeryDomainFieldElement) {
756 var x1 uint64
757 var x2 uint64
758 x1, x2 = bits.Sub64(arg1[0], arg2[0], uint64(0x0))
759 var x3 uint64
760 var x4 uint64
761 x3, x4 = bits.Sub64(arg1[1], arg2[1], uint64(p224Uint1(x2)))
762 var x5 uint64
763 var x6 uint64
764 x5, x6 = bits.Sub64(arg1[2], arg2[2], uint64(p224Uint1(x4)))
765 var x7 uint64
766 var x8 uint64
767 x7, x8 = bits.Sub64(arg1[3], arg2[3], uint64(p224Uint1(x6)))
768 var x9 uint64
769 p224CmovznzU64(&x9, p224Uint1(x8), uint64(0x0), 0xffffffffffffffff)
770 var x10 uint64
771 var x11 uint64
772 x10, x11 = bits.Add64(x1, uint64((p224Uint1(x9) & 0x1)), uint64(0x0))
773 var x12 uint64
774 var x13 uint64
775 x12, x13 = bits.Add64(x3, (x9 & 0xffffffff00000000), uint64(p224Uint1(x11)))
776 var x14 uint64
777 var x15 uint64
778 x14, x15 = bits.Add64(x5, x9, uint64(p224Uint1(x13)))
779 var x16 uint64
780 x16, _ = bits.Add64(x7, (x9 & 0xffffffff), uint64(p224Uint1(x15)))
781 out1[0] = x10
782 out1[1] = x12
783 out1[2] = x14
784 out1[3] = x16
785 }
786
787 // p224SetOne returns the field element one in the Montgomery domain.
788 //
789 // Postconditions:
790 //
791 // eval (from_montgomery out1) mod m = 1 mod m
792 // 0 ≤ eval out1 < m
793 func p224SetOne(out1 *p224MontgomeryDomainFieldElement) {
794 out1[0] = 0xffffffff00000000
795 out1[1] = 0xffffffffffffffff
796 out1[2] = uint64(0x0)
797 out1[3] = uint64(0x0)
798 }
799
800 // p224FromMontgomery translates a field element out of the Montgomery domain.
801 //
802 // Preconditions:
803 //
804 // 0 ≤ eval arg1 < m
805 //
806 // Postconditions:
807 //
808 // eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
809 // 0 ≤ eval out1 < m
810 func p224FromMontgomery(out1 *p224NonMontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement) {
811 x1 := arg1[0]
812 var x2 uint64
813 _, x2 = bits.Mul64(x1, 0xffffffffffffffff)
814 var x4 uint64
815 var x5 uint64
816 x5, x4 = bits.Mul64(x2, 0xffffffff)
817 var x6 uint64
818 var x7 uint64
819 x7, x6 = bits.Mul64(x2, 0xffffffffffffffff)
820 var x8 uint64
821 var x9 uint64
822 x9, x8 = bits.Mul64(x2, 0xffffffff00000000)
823 var x10 uint64
824 var x11 uint64
825 x10, x11 = bits.Add64(x9, x6, uint64(0x0))
826 var x12 uint64
827 var x13 uint64
828 x12, x13 = bits.Add64(x7, x4, uint64(p224Uint1(x11)))
829 var x15 uint64
830 _, x15 = bits.Add64(x1, x2, uint64(0x0))
831 var x16 uint64
832 var x17 uint64
833 x16, x17 = bits.Add64(uint64(0x0), x8, uint64(p224Uint1(x15)))
834 var x18 uint64
835 var x19 uint64
836 x18, x19 = bits.Add64(uint64(0x0), x10, uint64(p224Uint1(x17)))
837 var x20 uint64
838 var x21 uint64
839 x20, x21 = bits.Add64(uint64(0x0), x12, uint64(p224Uint1(x19)))
840 var x22 uint64
841 var x23 uint64
842 x22, x23 = bits.Add64(x16, arg1[1], uint64(0x0))
843 var x24 uint64
844 var x25 uint64
845 x24, x25 = bits.Add64(x18, uint64(0x0), uint64(p224Uint1(x23)))
846 var x26 uint64
847 var x27 uint64
848 x26, x27 = bits.Add64(x20, uint64(0x0), uint64(p224Uint1(x25)))
849 var x28 uint64
850 _, x28 = bits.Mul64(x22, 0xffffffffffffffff)
851 var x30 uint64
852 var x31 uint64
853 x31, x30 = bits.Mul64(x28, 0xffffffff)
854 var x32 uint64
855 var x33 uint64
856 x33, x32 = bits.Mul64(x28, 0xffffffffffffffff)
857 var x34 uint64
858 var x35 uint64
859 x35, x34 = bits.Mul64(x28, 0xffffffff00000000)
860 var x36 uint64
861 var x37 uint64
862 x36, x37 = bits.Add64(x35, x32, uint64(0x0))
863 var x38 uint64
864 var x39 uint64
865 x38, x39 = bits.Add64(x33, x30, uint64(p224Uint1(x37)))
866 var x41 uint64
867 _, x41 = bits.Add64(x22, x28, uint64(0x0))
868 var x42 uint64
869 var x43 uint64
870 x42, x43 = bits.Add64(x24, x34, uint64(p224Uint1(x41)))
871 var x44 uint64
872 var x45 uint64
873 x44, x45 = bits.Add64(x26, x36, uint64(p224Uint1(x43)))
874 var x46 uint64
875 var x47 uint64
876 x46, x47 = bits.Add64((uint64(p224Uint1(x27)) + (uint64(p224Uint1(x21)) + (uint64(p224Uint1(x13)) + x5))), x38, uint64(p224Uint1(x45)))
877 var x48 uint64
878 var x49 uint64
879 x48, x49 = bits.Add64(x42, arg1[2], uint64(0x0))
880 var x50 uint64
881 var x51 uint64
882 x50, x51 = bits.Add64(x44, uint64(0x0), uint64(p224Uint1(x49)))
883 var x52 uint64
884 var x53 uint64
885 x52, x53 = bits.Add64(x46, uint64(0x0), uint64(p224Uint1(x51)))
886 var x54 uint64
887 _, x54 = bits.Mul64(x48, 0xffffffffffffffff)
888 var x56 uint64
889 var x57 uint64
890 x57, x56 = bits.Mul64(x54, 0xffffffff)
891 var x58 uint64
892 var x59 uint64
893 x59, x58 = bits.Mul64(x54, 0xffffffffffffffff)
894 var x60 uint64
895 var x61 uint64
896 x61, x60 = bits.Mul64(x54, 0xffffffff00000000)
897 var x62 uint64
898 var x63 uint64
899 x62, x63 = bits.Add64(x61, x58, uint64(0x0))
900 var x64 uint64
901 var x65 uint64
902 x64, x65 = bits.Add64(x59, x56, uint64(p224Uint1(x63)))
903 var x67 uint64
904 _, x67 = bits.Add64(x48, x54, uint64(0x0))
905 var x68 uint64
906 var x69 uint64
907 x68, x69 = bits.Add64(x50, x60, uint64(p224Uint1(x67)))
908 var x70 uint64
909 var x71 uint64
910 x70, x71 = bits.Add64(x52, x62, uint64(p224Uint1(x69)))
911 var x72 uint64
912 var x73 uint64
913 x72, x73 = bits.Add64((uint64(p224Uint1(x53)) + (uint64(p224Uint1(x47)) + (uint64(p224Uint1(x39)) + x31))), x64, uint64(p224Uint1(x71)))
914 var x74 uint64
915 var x75 uint64
916 x74, x75 = bits.Add64(x68, arg1[3], uint64(0x0))
917 var x76 uint64
918 var x77 uint64
919 x76, x77 = bits.Add64(x70, uint64(0x0), uint64(p224Uint1(x75)))
920 var x78 uint64
921 var x79 uint64
922 x78, x79 = bits.Add64(x72, uint64(0x0), uint64(p224Uint1(x77)))
923 var x80 uint64
924 _, x80 = bits.Mul64(x74, 0xffffffffffffffff)
925 var x82 uint64
926 var x83 uint64
927 x83, x82 = bits.Mul64(x80, 0xffffffff)
928 var x84 uint64
929 var x85 uint64
930 x85, x84 = bits.Mul64(x80, 0xffffffffffffffff)
931 var x86 uint64
932 var x87 uint64
933 x87, x86 = bits.Mul64(x80, 0xffffffff00000000)
934 var x88 uint64
935 var x89 uint64
936 x88, x89 = bits.Add64(x87, x84, uint64(0x0))
937 var x90 uint64
938 var x91 uint64
939 x90, x91 = bits.Add64(x85, x82, uint64(p224Uint1(x89)))
940 var x93 uint64
941 _, x93 = bits.Add64(x74, x80, uint64(0x0))
942 var x94 uint64
943 var x95 uint64
944 x94, x95 = bits.Add64(x76, x86, uint64(p224Uint1(x93)))
945 var x96 uint64
946 var x97 uint64
947 x96, x97 = bits.Add64(x78, x88, uint64(p224Uint1(x95)))
948 var x98 uint64
949 var x99 uint64
950 x98, x99 = bits.Add64((uint64(p224Uint1(x79)) + (uint64(p224Uint1(x73)) + (uint64(p224Uint1(x65)) + x57))), x90, uint64(p224Uint1(x97)))
951 x100 := (uint64(p224Uint1(x99)) + (uint64(p224Uint1(x91)) + x83))
952 var x101 uint64
953 var x102 uint64
954 x101, x102 = bits.Sub64(x94, uint64(0x1), uint64(0x0))
955 var x103 uint64
956 var x104 uint64
957 x103, x104 = bits.Sub64(x96, 0xffffffff00000000, uint64(p224Uint1(x102)))
958 var x105 uint64
959 var x106 uint64
960 x105, x106 = bits.Sub64(x98, 0xffffffffffffffff, uint64(p224Uint1(x104)))
961 var x107 uint64
962 var x108 uint64
963 x107, x108 = bits.Sub64(x100, 0xffffffff, uint64(p224Uint1(x106)))
964 var x110 uint64
965 _, x110 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(p224Uint1(x108)))
966 var x111 uint64
967 p224CmovznzU64(&x111, p224Uint1(x110), x101, x94)
968 var x112 uint64
969 p224CmovznzU64(&x112, p224Uint1(x110), x103, x96)
970 var x113 uint64
971 p224CmovznzU64(&x113, p224Uint1(x110), x105, x98)
972 var x114 uint64
973 p224CmovznzU64(&x114, p224Uint1(x110), x107, x100)
974 out1[0] = x111
975 out1[1] = x112
976 out1[2] = x113
977 out1[3] = x114
978 }
979
980 // p224ToMontgomery translates a field element into the Montgomery domain.
981 //
982 // Preconditions:
983 //
984 // 0 ≤ eval arg1 < m
985 //
986 // Postconditions:
987 //
988 // eval (from_montgomery out1) mod m = eval arg1 mod m
989 // 0 ≤ eval out1 < m
990 func p224ToMontgomery(out1 *p224MontgomeryDomainFieldElement, arg1 *p224NonMontgomeryDomainFieldElement) {
991 x1 := arg1[1]
992 x2 := arg1[2]
993 x3 := arg1[3]
994 x4 := arg1[0]
995 var x5 uint64
996 var x6 uint64
997 x6, x5 = bits.Mul64(x4, 0xffffffff)
998 var x7 uint64
999 var x8 uint64
1000 x8, x7 = bits.Mul64(x4, 0xfffffffe00000000)
1001 var x9 uint64
1002 var x10 uint64
1003 x10, x9 = bits.Mul64(x4, 0xffffffff00000000)
1004 var x11 uint64
1005 var x12 uint64
1006 x12, x11 = bits.Mul64(x4, 0xffffffff00000001)
1007 var x13 uint64
1008 var x14 uint64
1009 x13, x14 = bits.Add64(x12, x9, uint64(0x0))
1010 var x15 uint64
1011 var x16 uint64
1012 x15, x16 = bits.Add64(x10, x7, uint64(p224Uint1(x14)))
1013 var x17 uint64
1014 var x18 uint64
1015 x17, x18 = bits.Add64(x8, x5, uint64(p224Uint1(x16)))
1016 var x19 uint64
1017 _, x19 = bits.Mul64(x11, 0xffffffffffffffff)
1018 var x21 uint64
1019 var x22 uint64
1020 x22, x21 = bits.Mul64(x19, 0xffffffff)
1021 var x23 uint64
1022 var x24 uint64
1023 x24, x23 = bits.Mul64(x19, 0xffffffffffffffff)
1024 var x25 uint64
1025 var x26 uint64
1026 x26, x25 = bits.Mul64(x19, 0xffffffff00000000)
1027 var x27 uint64
1028 var x28 uint64
1029 x27, x28 = bits.Add64(x26, x23, uint64(0x0))
1030 var x29 uint64
1031 var x30 uint64
1032 x29, x30 = bits.Add64(x24, x21, uint64(p224Uint1(x28)))
1033 var x32 uint64
1034 _, x32 = bits.Add64(x11, x19, uint64(0x0))
1035 var x33 uint64
1036 var x34 uint64
1037 x33, x34 = bits.Add64(x13, x25, uint64(p224Uint1(x32)))
1038 var x35 uint64
1039 var x36 uint64
1040 x35, x36 = bits.Add64(x15, x27, uint64(p224Uint1(x34)))
1041 var x37 uint64
1042 var x38 uint64
1043 x37, x38 = bits.Add64(x17, x29, uint64(p224Uint1(x36)))
1044 var x39 uint64
1045 var x40 uint64
1046 x40, x39 = bits.Mul64(x1, 0xffffffff)
1047 var x41 uint64
1048 var x42 uint64
1049 x42, x41 = bits.Mul64(x1, 0xfffffffe00000000)
1050 var x43 uint64
1051 var x44 uint64
1052 x44, x43 = bits.Mul64(x1, 0xffffffff00000000)
1053 var x45 uint64
1054 var x46 uint64
1055 x46, x45 = bits.Mul64(x1, 0xffffffff00000001)
1056 var x47 uint64
1057 var x48 uint64
1058 x47, x48 = bits.Add64(x46, x43, uint64(0x0))
1059 var x49 uint64
1060 var x50 uint64
1061 x49, x50 = bits.Add64(x44, x41, uint64(p224Uint1(x48)))
1062 var x51 uint64
1063 var x52 uint64
1064 x51, x52 = bits.Add64(x42, x39, uint64(p224Uint1(x50)))
1065 var x53 uint64
1066 var x54 uint64
1067 x53, x54 = bits.Add64(x33, x45, uint64(0x0))
1068 var x55 uint64
1069 var x56 uint64
1070 x55, x56 = bits.Add64(x35, x47, uint64(p224Uint1(x54)))
1071 var x57 uint64
1072 var x58 uint64
1073 x57, x58 = bits.Add64(x37, x49, uint64(p224Uint1(x56)))
1074 var x59 uint64
1075 var x60 uint64
1076 x59, x60 = bits.Add64(((uint64(p224Uint1(x38)) + (uint64(p224Uint1(x18)) + x6)) + (uint64(p224Uint1(x30)) + x22)), x51, uint64(p224Uint1(x58)))
1077 var x61 uint64
1078 _, x61 = bits.Mul64(x53, 0xffffffffffffffff)
1079 var x63 uint64
1080 var x64 uint64
1081 x64, x63 = bits.Mul64(x61, 0xffffffff)
1082 var x65 uint64
1083 var x66 uint64
1084 x66, x65 = bits.Mul64(x61, 0xffffffffffffffff)
1085 var x67 uint64
1086 var x68 uint64
1087 x68, x67 = bits.Mul64(x61, 0xffffffff00000000)
1088 var x69 uint64
1089 var x70 uint64
1090 x69, x70 = bits.Add64(x68, x65, uint64(0x0))
1091 var x71 uint64
1092 var x72 uint64
1093 x71, x72 = bits.Add64(x66, x63, uint64(p224Uint1(x70)))
1094 var x74 uint64
1095 _, x74 = bits.Add64(x53, x61, uint64(0x0))
1096 var x75 uint64
1097 var x76 uint64
1098 x75, x76 = bits.Add64(x55, x67, uint64(p224Uint1(x74)))
1099 var x77 uint64
1100 var x78 uint64
1101 x77, x78 = bits.Add64(x57, x69, uint64(p224Uint1(x76)))
1102 var x79 uint64
1103 var x80 uint64
1104 x79, x80 = bits.Add64(x59, x71, uint64(p224Uint1(x78)))
1105 var x81 uint64
1106 var x82 uint64
1107 x82, x81 = bits.Mul64(x2, 0xffffffff)
1108 var x83 uint64
1109 var x84 uint64
1110 x84, x83 = bits.Mul64(x2, 0xfffffffe00000000)
1111 var x85 uint64
1112 var x86 uint64
1113 x86, x85 = bits.Mul64(x2, 0xffffffff00000000)
1114 var x87 uint64
1115 var x88 uint64
1116 x88, x87 = bits.Mul64(x2, 0xffffffff00000001)
1117 var x89 uint64
1118 var x90 uint64
1119 x89, x90 = bits.Add64(x88, x85, uint64(0x0))
1120 var x91 uint64
1121 var x92 uint64
1122 x91, x92 = bits.Add64(x86, x83, uint64(p224Uint1(x90)))
1123 var x93 uint64
1124 var x94 uint64
1125 x93, x94 = bits.Add64(x84, x81, uint64(p224Uint1(x92)))
1126 var x95 uint64
1127 var x96 uint64
1128 x95, x96 = bits.Add64(x75, x87, uint64(0x0))
1129 var x97 uint64
1130 var x98 uint64
1131 x97, x98 = bits.Add64(x77, x89, uint64(p224Uint1(x96)))
1132 var x99 uint64
1133 var x100 uint64
1134 x99, x100 = bits.Add64(x79, x91, uint64(p224Uint1(x98)))
1135 var x101 uint64
1136 var x102 uint64
1137 x101, x102 = bits.Add64(((uint64(p224Uint1(x80)) + (uint64(p224Uint1(x60)) + (uint64(p224Uint1(x52)) + x40))) + (uint64(p224Uint1(x72)) + x64)), x93, uint64(p224Uint1(x100)))
1138 var x103 uint64
1139 _, x103 = bits.Mul64(x95, 0xffffffffffffffff)
1140 var x105 uint64
1141 var x106 uint64
1142 x106, x105 = bits.Mul64(x103, 0xffffffff)
1143 var x107 uint64
1144 var x108 uint64
1145 x108, x107 = bits.Mul64(x103, 0xffffffffffffffff)
1146 var x109 uint64
1147 var x110 uint64
1148 x110, x109 = bits.Mul64(x103, 0xffffffff00000000)
1149 var x111 uint64
1150 var x112 uint64
1151 x111, x112 = bits.Add64(x110, x107, uint64(0x0))
1152 var x113 uint64
1153 var x114 uint64
1154 x113, x114 = bits.Add64(x108, x105, uint64(p224Uint1(x112)))
1155 var x116 uint64
1156 _, x116 = bits.Add64(x95, x103, uint64(0x0))
1157 var x117 uint64
1158 var x118 uint64
1159 x117, x118 = bits.Add64(x97, x109, uint64(p224Uint1(x116)))
1160 var x119 uint64
1161 var x120 uint64
1162 x119, x120 = bits.Add64(x99, x111, uint64(p224Uint1(x118)))
1163 var x121 uint64
1164 var x122 uint64
1165 x121, x122 = bits.Add64(x101, x113, uint64(p224Uint1(x120)))
1166 var x123 uint64
1167 var x124 uint64
1168 x124, x123 = bits.Mul64(x3, 0xffffffff)
1169 var x125 uint64
1170 var x126 uint64
1171 x126, x125 = bits.Mul64(x3, 0xfffffffe00000000)
1172 var x127 uint64
1173 var x128 uint64
1174 x128, x127 = bits.Mul64(x3, 0xffffffff00000000)
1175 var x129 uint64
1176 var x130 uint64
1177 x130, x129 = bits.Mul64(x3, 0xffffffff00000001)
1178 var x131 uint64
1179 var x132 uint64
1180 x131, x132 = bits.Add64(x130, x127, uint64(0x0))
1181 var x133 uint64
1182 var x134 uint64
1183 x133, x134 = bits.Add64(x128, x125, uint64(p224Uint1(x132)))
1184 var x135 uint64
1185 var x136 uint64
1186 x135, x136 = bits.Add64(x126, x123, uint64(p224Uint1(x134)))
1187 var x137 uint64
1188 var x138 uint64
1189 x137, x138 = bits.Add64(x117, x129, uint64(0x0))
1190 var x139 uint64
1191 var x140 uint64
1192 x139, x140 = bits.Add64(x119, x131, uint64(p224Uint1(x138)))
1193 var x141 uint64
1194 var x142 uint64
1195 x141, x142 = bits.Add64(x121, x133, uint64(p224Uint1(x140)))
1196 var x143 uint64
1197 var x144 uint64
1198 x143, x144 = bits.Add64(((uint64(p224Uint1(x122)) + (uint64(p224Uint1(x102)) + (uint64(p224Uint1(x94)) + x82))) + (uint64(p224Uint1(x114)) + x106)), x135, uint64(p224Uint1(x142)))
1199 var x145 uint64
1200 _, x145 = bits.Mul64(x137, 0xffffffffffffffff)
1201 var x147 uint64
1202 var x148 uint64
1203 x148, x147 = bits.Mul64(x145, 0xffffffff)
1204 var x149 uint64
1205 var x150 uint64
1206 x150, x149 = bits.Mul64(x145, 0xffffffffffffffff)
1207 var x151 uint64
1208 var x152 uint64
1209 x152, x151 = bits.Mul64(x145, 0xffffffff00000000)
1210 var x153 uint64
1211 var x154 uint64
1212 x153, x154 = bits.Add64(x152, x149, uint64(0x0))
1213 var x155 uint64
1214 var x156 uint64
1215 x155, x156 = bits.Add64(x150, x147, uint64(p224Uint1(x154)))
1216 var x158 uint64
1217 _, x158 = bits.Add64(x137, x145, uint64(0x0))
1218 var x159 uint64
1219 var x160 uint64
1220 x159, x160 = bits.Add64(x139, x151, uint64(p224Uint1(x158)))
1221 var x161 uint64
1222 var x162 uint64
1223 x161, x162 = bits.Add64(x141, x153, uint64(p224Uint1(x160)))
1224 var x163 uint64
1225 var x164 uint64
1226 x163, x164 = bits.Add64(x143, x155, uint64(p224Uint1(x162)))
1227 x165 := ((uint64(p224Uint1(x164)) + (uint64(p224Uint1(x144)) + (uint64(p224Uint1(x136)) + x124))) + (uint64(p224Uint1(x156)) + x148))
1228 var x166 uint64
1229 var x167 uint64
1230 x166, x167 = bits.Sub64(x159, uint64(0x1), uint64(0x0))
1231 var x168 uint64
1232 var x169 uint64
1233 x168, x169 = bits.Sub64(x161, 0xffffffff00000000, uint64(p224Uint1(x167)))
1234 var x170 uint64
1235 var x171 uint64
1236 x170, x171 = bits.Sub64(x163, 0xffffffffffffffff, uint64(p224Uint1(x169)))
1237 var x172 uint64
1238 var x173 uint64
1239 x172, x173 = bits.Sub64(x165, 0xffffffff, uint64(p224Uint1(x171)))
1240 var x175 uint64
1241 _, x175 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(p224Uint1(x173)))
1242 var x176 uint64
1243 p224CmovznzU64(&x176, p224Uint1(x175), x166, x159)
1244 var x177 uint64
1245 p224CmovznzU64(&x177, p224Uint1(x175), x168, x161)
1246 var x178 uint64
1247 p224CmovznzU64(&x178, p224Uint1(x175), x170, x163)
1248 var x179 uint64
1249 p224CmovznzU64(&x179, p224Uint1(x175), x172, x165)
1250 out1[0] = x176
1251 out1[1] = x177
1252 out1[2] = x178
1253 out1[3] = x179
1254 }
1255
1256 // p224Selectznz is a multi-limb conditional select.
1257 //
1258 // Postconditions:
1259 //
1260 // eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
1261 //
1262 // Input Bounds:
1263 //
1264 // arg1: [0x0 ~> 0x1]
1265 // arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1266 // arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1267 //
1268 // Output Bounds:
1269 //
1270 // out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1271 func p224Selectznz(out1 *[4]uint64, arg1 p224Uint1, arg2 *[4]uint64, arg3 *[4]uint64) {
1272 var x1 uint64
1273 p224CmovznzU64(&x1, arg1, arg2[0], arg3[0])
1274 var x2 uint64
1275 p224CmovznzU64(&x2, arg1, arg2[1], arg3[1])
1276 var x3 uint64
1277 p224CmovznzU64(&x3, arg1, arg2[2], arg3[2])
1278 var x4 uint64
1279 p224CmovznzU64(&x4, arg1, arg2[3], arg3[3])
1280 out1[0] = x1
1281 out1[1] = x2
1282 out1[2] = x3
1283 out1[3] = x4
1284 }
1285
1286 // p224ToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
1287 //
1288 // Preconditions:
1289 //
1290 // 0 ≤ eval arg1 < m
1291 //
1292 // Postconditions:
1293 //
1294 // out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..27]
1295 //
1296 // Input Bounds:
1297 //
1298 // arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffff]]
1299 //
1300 // Output Bounds:
1301 //
1302 // out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1303 func p224ToBytes(out1 *[28]uint8, arg1 *[4]uint64) {
1304 x1 := arg1[3]
1305 x2 := arg1[2]
1306 x3 := arg1[1]
1307 x4 := arg1[0]
1308 x5 := (uint8(x4) & 0xff)
1309 x6 := (x4 >> 8)
1310 x7 := (uint8(x6) & 0xff)
1311 x8 := (x6 >> 8)
1312 x9 := (uint8(x8) & 0xff)
1313 x10 := (x8 >> 8)
1314 x11 := (uint8(x10) & 0xff)
1315 x12 := (x10 >> 8)
1316 x13 := (uint8(x12) & 0xff)
1317 x14 := (x12 >> 8)
1318 x15 := (uint8(x14) & 0xff)
1319 x16 := (x14 >> 8)
1320 x17 := (uint8(x16) & 0xff)
1321 x18 := uint8((x16 >> 8))
1322 x19 := (uint8(x3) & 0xff)
1323 x20 := (x3 >> 8)
1324 x21 := (uint8(x20) & 0xff)
1325 x22 := (x20 >> 8)
1326 x23 := (uint8(x22) & 0xff)
1327 x24 := (x22 >> 8)
1328 x25 := (uint8(x24) & 0xff)
1329 x26 := (x24 >> 8)
1330 x27 := (uint8(x26) & 0xff)
1331 x28 := (x26 >> 8)
1332 x29 := (uint8(x28) & 0xff)
1333 x30 := (x28 >> 8)
1334 x31 := (uint8(x30) & 0xff)
1335 x32 := uint8((x30 >> 8))
1336 x33 := (uint8(x2) & 0xff)
1337 x34 := (x2 >> 8)
1338 x35 := (uint8(x34) & 0xff)
1339 x36 := (x34 >> 8)
1340 x37 := (uint8(x36) & 0xff)
1341 x38 := (x36 >> 8)
1342 x39 := (uint8(x38) & 0xff)
1343 x40 := (x38 >> 8)
1344 x41 := (uint8(x40) & 0xff)
1345 x42 := (x40 >> 8)
1346 x43 := (uint8(x42) & 0xff)
1347 x44 := (x42 >> 8)
1348 x45 := (uint8(x44) & 0xff)
1349 x46 := uint8((x44 >> 8))
1350 x47 := (uint8(x1) & 0xff)
1351 x48 := (x1 >> 8)
1352 x49 := (uint8(x48) & 0xff)
1353 x50 := (x48 >> 8)
1354 x51 := (uint8(x50) & 0xff)
1355 x52 := uint8((x50 >> 8))
1356 out1[0] = x5
1357 out1[1] = x7
1358 out1[2] = x9
1359 out1[3] = x11
1360 out1[4] = x13
1361 out1[5] = x15
1362 out1[6] = x17
1363 out1[7] = x18
1364 out1[8] = x19
1365 out1[9] = x21
1366 out1[10] = x23
1367 out1[11] = x25
1368 out1[12] = x27
1369 out1[13] = x29
1370 out1[14] = x31
1371 out1[15] = x32
1372 out1[16] = x33
1373 out1[17] = x35
1374 out1[18] = x37
1375 out1[19] = x39
1376 out1[20] = x41
1377 out1[21] = x43
1378 out1[22] = x45
1379 out1[23] = x46
1380 out1[24] = x47
1381 out1[25] = x49
1382 out1[26] = x51
1383 out1[27] = x52
1384 }
1385
1386 // p224FromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
1387 //
1388 // Preconditions:
1389 //
1390 // 0 ≤ bytes_eval arg1 < m
1391 //
1392 // Postconditions:
1393 //
1394 // eval out1 mod m = bytes_eval arg1 mod m
1395 // 0 ≤ eval out1 < m
1396 //
1397 // Input Bounds:
1398 //
1399 // arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1400 //
1401 // Output Bounds:
1402 //
1403 // out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffff]]
1404 func p224FromBytes(out1 *[4]uint64, arg1 *[28]uint8) {
1405 x1 := (uint64(arg1[27]) << 24)
1406 x2 := (uint64(arg1[26]) << 16)
1407 x3 := (uint64(arg1[25]) << 8)
1408 x4 := arg1[24]
1409 x5 := (uint64(arg1[23]) << 56)
1410 x6 := (uint64(arg1[22]) << 48)
1411 x7 := (uint64(arg1[21]) << 40)
1412 x8 := (uint64(arg1[20]) << 32)
1413 x9 := (uint64(arg1[19]) << 24)
1414 x10 := (uint64(arg1[18]) << 16)
1415 x11 := (uint64(arg1[17]) << 8)
1416 x12 := arg1[16]
1417 x13 := (uint64(arg1[15]) << 56)
1418 x14 := (uint64(arg1[14]) << 48)
1419 x15 := (uint64(arg1[13]) << 40)
1420 x16 := (uint64(arg1[12]) << 32)
1421 x17 := (uint64(arg1[11]) << 24)
1422 x18 := (uint64(arg1[10]) << 16)
1423 x19 := (uint64(arg1[9]) << 8)
1424 x20 := arg1[8]
1425 x21 := (uint64(arg1[7]) << 56)
1426 x22 := (uint64(arg1[6]) << 48)
1427 x23 := (uint64(arg1[5]) << 40)
1428 x24 := (uint64(arg1[4]) << 32)
1429 x25 := (uint64(arg1[3]) << 24)
1430 x26 := (uint64(arg1[2]) << 16)
1431 x27 := (uint64(arg1[1]) << 8)
1432 x28 := arg1[0]
1433 x29 := (x27 + uint64(x28))
1434 x30 := (x26 + x29)
1435 x31 := (x25 + x30)
1436 x32 := (x24 + x31)
1437 x33 := (x23 + x32)
1438 x34 := (x22 + x33)
1439 x35 := (x21 + x34)
1440 x36 := (x19 + uint64(x20))
1441 x37 := (x18 + x36)
1442 x38 := (x17 + x37)
1443 x39 := (x16 + x38)
1444 x40 := (x15 + x39)
1445 x41 := (x14 + x40)
1446 x42 := (x13 + x41)
1447 x43 := (x11 + uint64(x12))
1448 x44 := (x10 + x43)
1449 x45 := (x9 + x44)
1450 x46 := (x8 + x45)
1451 x47 := (x7 + x46)
1452 x48 := (x6 + x47)
1453 x49 := (x5 + x48)
1454 x50 := (x3 + uint64(x4))
1455 x51 := (x2 + x50)
1456 x52 := (x1 + x51)
1457 out1[0] = x35
1458 out1[1] = x42
1459 out1[2] = x49
1460 out1[3] = x52
1461 }
1462